BeechCMS v0.8.0

Release Date: September 9, 2026

MCP Server — AI Control Plane — Introduced @beechcms/mcp (v1.0.1) featuring an stdio MCP server for IDE agents (Cursor, Claude Desktop). Uses a Plan/Apply mechanism (/api/seeds/:slug/mcp-plan → mcp-apply), 7 tools for schema management, and a secure OAuth 2.0 browser flow with zero passwords in the config. (328, 386, 390)
Zero-Secret Forms SDK — Added @beechcms/forms-react (v1.0.0) featuring a drop-in <BeechForm/> and headless hooks. Implements multi-level bot defense (Time-Trap HMAC single-use tokens, cloaked honeypots, origin whitelisting) and allows public submissions without exposing write API keys. (22, 303, 325, 330)
Edge-Native Vector Search — Released @beechcms/search-client (v0.1.0-preview.1). Compiles binary indices directly to R2 and provides a zero-dependency edge embedding endpoint (/embed) with hybrid lexical and semantic search capabilities. (324, 364)
D1 Canonical Schema Authority — D1 is now the sole source of truth. Includes a new D1-first CLI type generator (beech gen-types typescript) that introspects the database locally or remotely to emit TypeScript interfaces. (337)

seeds.ts Deprecation — seeds.ts is no longer the schema authority. Commands seed:load and seed:create are deprecated. New projects initialize with seeds: [].
Deployment Workflow — beech deploy no longer executes DDL or seeds. Run pnpm beech db:migrate for schema updates.
Public Endpoints Replaced — Legacy /schema and /schema.html endpoints are removed, replaced by the scoped, privacy-aware GET /api/v1/public/:seed/schema.
Client SDK Strict Segregation — The root export of @beechcms/client is now types-only. Import paths must explicitly target /browser (read-only) or /server (full CRUD). (331, 332)
Package Manager — Upgrading requires pnpm 11.25.0.

Continuous Token Bucket Rate Limiting — Replaced legacy limiters with a continuous refill bucket to absorb bursts. Added dual-key (IP + normalized account) validation for auth endpoints and pre-DB limits on /auth/refresh. (338, 366)
Confidential Data Fields — Added publicEdit?: boolean to branch policies. Unauthenticated public requests automatically filter out confidential fields, which are now encrypted at rest in D1. (334)
Webhook Signature Verification — Added HMAC-SHA256 zero-dependency verification for webhooks (verifyBeechWebhookSignature).

Cloudflare R2 Native Binding — Added native support for R2Bucket bindings alongside the S3 provider, resolving 503/500 errors on media endpoints. (307, 353)
Upload Subsystem Hardening — Fixed malformed percent-encoding URIs, constrained multi-URL patterns, unified signature verification, and reintroduced the fallback POST /api/upload. (300, 339)

CodeMirror 6 Integration — Replaced legacy editors with a CodeMirror 6 JSON editor featuring OKLCH theme sync and linting. Loaded asynchronously to improve performance. (373)
Chunk Optimization — Isolated KaTeX and RichText into on-demand chunks, reducing the main bundle by ~700 KB.
Render Performance — Resolved severe input lag in search bars by memoizing AppSidebar, SiteHeader, and DataTable.

Dynamic Release Scripting — Rewrote scripts/release.mjs for per-package release generation and topological sorting.
Test Environment Parity — Added scripts/test-runner.mjs and pinned Docker images to stable tags with optimized port bindings.

VitePress Complete Rewrite — Migrated documentation to VitePress with custom themes (HomeHero, FeaturesBento) and structural overhauls. (378, 379)
Automated Fact-Checking — Introduced scripts/docs-fact-check.mjs running in CI to enforce documentation parity with the codebase.

Self-Referencing Relations — Fixed an issue where self-referencing relations were incorrectly rejected as cycles. (392)
Cycle Error Reporting — Ensured downstream seeds are no longer wrongly implicated in cycle errors. (393)
MCP Slug Validation — Added missing slug format validation to beech_schema_validate. (394)
Transient 5xx Backoff — Implemented retry with backoff for transient 5xx errors in the MCP client. (395)
DataTable Generics — Preserved generics on React.memo(DataTable) preventing type stripping. (396)
Repeater Context — Added tableEmpty to RepeaterMeta.branchItemContext. (398)
MCP Auto-Restart — The MCP server now automatically restarts upon rebuilds. (391)
Timing-Safe Key Verification — Implemented timingSafeEqual for public API key validation to prevent timing attacks. (276)

This release includes 61 commits across 755 modified files (+67,736 / −10,465) since v0.7.0.

Navigation Menu