@beechcms/api 0.4.0 → 0.4.2

package/src/rate-limit/cloudflare-rate-limiter.test.ts

@@ -0,0 +1,26 @@
+import { describe, it, expect, vi } from 'vitest'
+import { CloudflareRateLimiter } from './cloudflare-rate-limiter'
+
+describe('CloudflareRateLimiter', () => {
+  it('returns isAllowed: true when the Cloudflare binding grants the request', async () => {
+    const mockBinding = { limit: vi.fn().mockResolvedValue({ success: true }) }
+    const limiter = new CloudflareRateLimiter(mockBinding as any)
+    const result = await limiter.checkLimit('192.168.1.1:login')
+    expect(result.isAllowed).toBe(true)
+  })
+
+  it('returns isAllowed: false when the Cloudflare binding blocks the request', async () => {
+    const mockBinding = { limit: vi.fn().mockResolvedValue({ success: false }) }
+    const limiter = new CloudflareRateLimiter(mockBinding as any)
+    const result = await limiter.checkLimit('192.168.1.1:login')
+    expect(result.isAllowed).toBe(false)
+  })
+
+  it('forwards the exact key to the binding so per-key accounting is correct', async () => {
+    const mockBinding = { limit: vi.fn().mockResolvedValue({ success: true }) }
+    const limiter = new CloudflareRateLimiter(mockBinding as any)
+    const key = '10.0.0.1:some-seed:publicApiRead'
+    await limiter.checkLimit(key)
+    expect(mockBinding.limit).toHaveBeenCalledWith({ key })
+  })
+})

package/src/rate-limit/cloudflare-rate-limiter.ts

@@ -0,0 +1,11 @@
+/// <reference types="@cloudflare/workers-types" />
+import type { IRateLimiter, RateLimitResult } from '@beechcms/core'
+
+export class CloudflareRateLimiter implements IRateLimiter {
+  constructor(private readonly binding: RateLimit) {}
+
+  async checkLimit(key: string): Promise<RateLimitResult> {
+    const { success } = await this.binding.limit({ key })
+    return { isAllowed: success }
+  }
+}

package/src/rate-limit/in-memory-rate-limiter.test.ts

@@ -0,0 +1,33 @@
+import { describe, it, expect } from 'vitest'
+import { InMemoryRateLimiter } from './in-memory-rate-limiter'
+
+describe('InMemoryRateLimiter', () => {
+  it('allows requests up to the configured maximum hit count', async () => {
+    const limiter = new InMemoryRateLimiter(3)
+    expect((await limiter.checkLimit('key')).isAllowed).toBe(true)
+    expect((await limiter.checkLimit('key')).isAllowed).toBe(true)
+    expect((await limiter.checkLimit('key')).isAllowed).toBe(true)
+  })
+
+  it('blocks the very next request after maxAllowedHits is reached', async () => {
+    const limiter = new InMemoryRateLimiter(2)
+    await limiter.checkLimit('key')
+    await limiter.checkLimit('key')
+    expect((await limiter.checkLimit('key')).isAllowed).toBe(false)
+  })
+
+  it('tracks hit counts independently for each key', async () => {
+    const limiter = new InMemoryRateLimiter(1)
+    expect((await limiter.checkLimit('ip-a')).isAllowed).toBe(true)
+    expect((await limiter.checkLimit('ip-b')).isAllowed).toBe(true)
+    // Both keys exhausted independently
+    expect((await limiter.checkLimit('ip-a')).isAllowed).toBe(false)
+    expect((await limiter.checkLimit('ip-b')).isAllowed).toBe(false)
+  })
+
+  it('maxAllowedHits = 1 allows exactly one request before blocking', async () => {
+    const limiter = new InMemoryRateLimiter(1)
+    expect((await limiter.checkLimit('k')).isAllowed).toBe(true)
+    expect((await limiter.checkLimit('k')).isAllowed).toBe(false)
+  })
+})

package/src/rate-limit/in-memory-rate-limiter.ts

@@ -0,0 +1,13 @@
+import type { IRateLimiter, RateLimitResult } from '@beechcms/core'
+
+export class InMemoryRateLimiter implements IRateLimiter {
+  private readonly hitCounts = new Map<string, number>()
+
+  constructor(private readonly maxAllowedHits: number) {}
+
+  async checkLimit(key: string): Promise<RateLimitResult> {
+    const currentHits = (this.hitCounts.get(key) ?? 0) + 1
+    this.hitCounts.set(key, currentHits)
+    return { isAllowed: currentHits <= this.maxAllowedHits }
+  }
+}

package/src/rate-limit/no-op-rate-limiter.test.ts

@@ -0,0 +1,18 @@
+import { describe, it, expect } from 'vitest'
+import { NoOpRateLimiter } from './no-op-rate-limiter'
+
+describe('NoOpRateLimiter', () => {
+  it('always returns isAllowed: true regardless of the key', async () => {
+    const limiter = new NoOpRateLimiter()
+    for (let i = 0; i < 100; i++) {
+      expect((await limiter.checkLimit('any-key')).isAllowed).toBe(true)
+    }
+  })
+
+  it('allows all keys without accumulating state', async () => {
+    const limiter = new NoOpRateLimiter()
+    expect((await limiter.checkLimit('ip-a')).isAllowed).toBe(true)
+    expect((await limiter.checkLimit('ip-b')).isAllowed).toBe(true)
+    expect((await limiter.checkLimit('ip-a')).isAllowed).toBe(true)
+  })
+})

package/src/rate-limit/no-op-rate-limiter.ts

@@ -0,0 +1,7 @@
+import type { IRateLimiter, RateLimitResult } from '@beechcms/core'
+
+export class NoOpRateLimiter implements IRateLimiter {
+  async checkLimit(_key: string): Promise<RateLimitResult> {
+    return { isAllowed: true }
+  }
+}

package/src/search-utils.test.ts

@@ -0,0 +1,207 @@
+import { describe, it, expect } from 'vitest'
+import { encodeCursor, decodeCursor, buildFtsQuery, mapFtsRow } from './search-utils'
+import type { Seed } from '@beechcms/core'
+
+const TEXT_SEED = {
+  slug: 'articoli',
+  displayNameAlias: 'title',
+  branches: [
+    { id: 'br_01', alias: 'title', type: 'text', policies: { search: true } },
+  ],
+} as unknown as Seed
+
+const SECOND_SEED = {
+  slug: 'team',
+  displayNameAlias: 'name',
+  branches: [
+    { id: 'br_01', alias: 'name', type: 'text', policies: { search: true } },
+  ],
+} as unknown as Seed
+
+const NO_FTS_SEED = {
+  slug: 'prodotti',
+  displayNameAlias: 'nome',
+  branches: [
+    { id: 'br_01', alias: 'price', type: 'number' },
+  ],
+} as unknown as Seed
+
+// ─── encodeCursor / decodeCursor ─────────────────────────────────────────────
+
+describe('encodeCursor / decodeCursor', () => {
+  it('roundtrip preserves rank and entryId', () => {
+    const cursor = encodeCursor(-1.23456, 'entry-abc')
+    const decoded = decodeCursor(cursor)
+    expect(decoded?.rank).toBeCloseTo(-1.23456)
+    expect(decoded?.entryId).toBe('entry-abc')
+  })
+
+  it('entryId without colons roundtrips correctly (UUID-style IDs)', () => {
+    const entryId = 'f47ac10b-58cc-4372-a567-0e02b2c3d479'
+    const cursor = encodeCursor(-3.7, entryId)
+    const decoded = decodeCursor(cursor)
+    expect(decoded?.rank).toBeCloseTo(-3.7)
+    expect(decoded?.entryId).toBe(entryId)
+  })
+
+  it('returns null for invalid base64', () => {
+    expect(decodeCursor('!!!not-base64!!!')).toBeNull()
+  })
+
+  it('returns null when decoded string has no colon separator', () => {
+    expect(decodeCursor(btoa('noseparator'))).toBeNull()
+  })
+})
+
+// ─── buildFtsQuery ───────────────────────────────────────────────────────────
+
+describe('buildFtsQuery', () => {
+  it('returns empty-result query when no seed has a searchable FTS branch', () => {
+    const result = buildFtsQuery(
+      { q: 'hello', schemaSlug: null, status: null, limit: 20, cursor: null },
+      [NO_FTS_SEED],
+    )
+    expect(result.sql).toContain('WHERE 1=0')
+    expect(result.binds).toHaveLength(0)
+    expect(result.countSql).toContain('SELECT 0 as total')
+  })
+
+  it('throws EMPTY_QUERY when all terms are stripped or too short (single chars)', () => {
+    expect(() =>
+      buildFtsQuery({ q: 'a b', schemaSlug: null, status: null, limit: 20, cursor: null }, [TEXT_SEED]),
+    ).toThrow('EMPTY_QUERY')
+  })
+
+  it('generates a query referencing the seed FTS and content tables', () => {
+    const result = buildFtsQuery(
+      { q: 'hello', schemaSlug: null, status: null, limit: 20, cursor: null },
+      [TEXT_SEED],
+    )
+    expect(result.sql).toContain('fts_articoli')
+    expect(result.sql).toContain('content_articoli')
+    expect(result.sql).toContain('LIMIT ?')
+    expect(result.binds.at(-1)).toBe(21) // limit + 1 for has-more detection
+  })
+
+  it('UNION ALLs multiple seeds when no schemaSlug filter is set', () => {
+    const result = buildFtsQuery(
+      { q: 'test', schemaSlug: null, status: null, limit: 10, cursor: null },
+      [TEXT_SEED, SECOND_SEED],
+    )
+    expect(result.sql).toContain('UNION ALL')
+    expect(result.sql).toContain('fts_articoli')
+    expect(result.sql).toContain('fts_team')
+  })
+
+  it('limits query to the requested schemaSlug when provided', () => {
+    const result = buildFtsQuery(
+      { q: 'test', schemaSlug: 'articoli', status: null, limit: 20, cursor: null },
+      [TEXT_SEED, SECOND_SEED],
+    )
+    expect(result.sql).toContain('fts_articoli')
+    expect(result.sql).not.toContain('fts_team')
+  })
+
+  it('adds status filter to WHERE clause and bind values', () => {
+    const result = buildFtsQuery(
+      { q: 'hello', schemaSlug: null, status: 'published', limit: 20, cursor: null },
+      [TEXT_SEED],
+    )
+    expect(result.sql).toContain('ce.status = ?')
+    expect(result.binds).toContain('published')
+  })
+
+  it('adds cursor-based pagination condition when cursor is valid', () => {
+    const cursor = encodeCursor(-1.5, 'entry-123')
+    const result = buildFtsQuery(
+      { q: 'hello', schemaSlug: null, status: null, limit: 20, cursor },
+      [TEXT_SEED],
+    )
+    expect(result.sql).toContain('bm25')
+    expect(result.binds).toContain('entry-123')
+  })
+
+  it('ignores an invalid cursor and produces no pagination condition', () => {
+    const result = buildFtsQuery(
+      { q: 'hello', schemaSlug: null, status: null, limit: 20, cursor: 'bad-cursor' },
+      [TEXT_SEED],
+    )
+    expect(result.binds).not.toContain('entry-123')
+  })
+
+  it('countSql wraps each seed count in a SUM', () => {
+    const result = buildFtsQuery(
+      { q: 'test', schemaSlug: null, status: null, limit: 10, cursor: null },
+      [TEXT_SEED, SECOND_SEED],
+    )
+    expect(result.countSql).toContain('SUM')
+    expect(result.countSql).toContain('fts_articoli')
+    expect(result.countSql).toContain('fts_team')
+  })
+
+  it('count binds do not include the limit+1 sentinel', () => {
+    const result = buildFtsQuery(
+      { q: 'hello', schemaSlug: null, status: null, limit: 5, cursor: null },
+      [TEXT_SEED],
+    )
+    expect(result.countBinds).not.toContain(6) // limit + 1 must not appear in count binds
+  })
+
+  it('single-character terms (length < 2) are filtered out', () => {
+    // 'a b c' — single-char terms discarded; result depends on remaining terms
+    expect(() =>
+      buildFtsQuery({ q: 'a b c', schemaSlug: null, status: null, limit: 20, cursor: null }, [TEXT_SEED]),
+    ).toThrow('EMPTY_QUERY')
+  })
+
+  it('numeric terms are quoted without prefix expansion', () => {
+    const result = buildFtsQuery(
+      { q: '2024', schemaSlug: null, status: null, limit: 20, cursor: null },
+      [TEXT_SEED],
+    )
+    expect(result.binds[0]).toContain('"2024"')
+  })
+})
+
+// ─── mapFtsRow ───────────────────────────────────────────────────────────────
+
+describe('mapFtsRow', () => {
+  it('maps all FtsRow fields to SearchResultItem', () => {
+    const row = {
+      entry_id: 'e1', schema_slug: 'articoli', slug: 'my-post',
+      status: 'published', title: 'My Post', excerpt: 'A snippet', rank: -1,
+    }
+    const result = mapFtsRow(row)
+    expect(result.id).toBe('e1')
+    expect(result.schema_slug).toBe('articoli')
+    expect(result.slug).toBe('my-post')
+    expect(result.status).toBe('published')
+    expect(result.title).toBe('My Post')
+    expect(result.excerpt).toBe('A snippet')
+    expect(result.data).toEqual({})
+  })
+
+  it('strips HTML tags from excerpt but preserves <mark> and </mark>', () => {
+    const row = {
+      entry_id: 'e1', schema_slug: 'a', slug: null, status: 'draft',
+      title: null, excerpt: '<p>A <mark>word</mark> here</p>', rank: 0,
+    }
+    expect(mapFtsRow(row).excerpt).toBe('A <mark>word</mark> here')
+  })
+
+  it('collapses multiple whitespace characters in excerpt', () => {
+    const row = {
+      entry_id: 'e1', schema_slug: 'a', slug: null, status: 'draft',
+      title: null, excerpt: '<p>  lots   of  space  </p>', rank: 0,
+    }
+    expect(mapFtsRow(row).excerpt).toBe('lots of space')
+  })
+
+  it('returns empty string for null title', () => {
+    const row = {
+      entry_id: 'e1', schema_slug: 'a', slug: null, status: 'draft',
+      title: null, excerpt: '', rank: 0,
+    }
+    expect(mapFtsRow(row).title).toBe('')
+  })
+})

package/src/search-utils.ts

@@ -2,7 +2,7 @@
 // Pure functions — zero Hono dependencies, importable from Vitest.
 // v0.4.0: FTS is per-seed (fts_{slug}), joined with content_{slug} for metadata.
 
-import type { Seed } from "@beechcms/core"
+import type { Seed, SearchResultRow } from "@beechcms/core"
 
 // ─── Types ───────────────────────────────────────────────────────────────────
 
@@ -190,3 +190,20 @@ export function mapFtsRow(row: FtsRow): SearchResultItem {
     data:        {},
   }
 }
+
+/**
+ * Maps a repository-shaped SearchResultRow (camelCase) to the wire-format
+ * SearchResultItem returned by the /api/search route. Keeps the HTML
+ * stripping behaviour previously inlined inside mapFtsRow.
+ */
+export function mapSearchResultRow(row: SearchResultRow): SearchResultItem {
+  return {
+    id:          row.entryId,
+    schema_slug: row.schemaSlug,
+    slug:        row.slug,
+    status:      row.status,
+    title:       row.title ?? "",
+    excerpt:     stripHtmlPreserveMark(row.excerpt ?? ""),
+    data:        {},
+  }
+}

package/src/search.ts

@@ -4,69 +4,58 @@ import { Hono }              from "hono"
 import type { Env, Variables } from "./types"
 import { authMiddleware }    from "./middleware"
 import {
-  buildFtsQuery,
   encodeCursor,
-  mapFtsRow,
-  type FtsRow,
+  mapSearchResultRow,
   type SearchResponse,
 } from "./search-utils"
 
 export const searchRouter = new Hono<{ Bindings: Env; Variables: Variables }>()
 
-searchRouter.use("*", async (c, next) => {
-  return authMiddleware(c.env.JWT_SECRET, {
-    issuer: c.env.JWT_ISSUER,
-    audience: c.env.JWT_AUDIENCE,
-  })(c, next)
-})
+searchRouter.use("*", authMiddleware())
 
 // GET /api/search?q=...&schema_slug=...&status=...&limit=20&cursor=...
 searchRouter.get("/", async (c) => {
-  const q          = c.req.query("q")?.trim() ?? ""
+  const queryText  = c.req.query("q")?.trim() ?? ""
   const schemaSlug = c.req.query("schema_slug") ?? null
   const status     = c.req.query("status") ?? null
   const rawLimit   = parseInt(c.req.query("limit") ?? "20", 10)
   const limit      = Math.min(Math.max(rawLimit, 1), 50)
   const cursor     = c.req.query("cursor") ?? null
 
-  if (q.length < 2) {
+  if (queryText.length < 2) {
     return c.json({ error: "Il parametro 'q' deve avere almeno 2 caratteri." }, 400)
   }
 
-  const seeds = Object.values(c.get('seedRegistry'))
+  const seeds = c.get('seedRegistry').all()
+  const searchRepository = c.get('searchRepository')
 
-  let queryParts: ReturnType<typeof buildFtsQuery>
-  try {
-    queryParts = buildFtsQuery({ q, schemaSlug, status, limit, cursor }, seeds)
-  } catch (e) {
-    if ((e as Error).message === "EMPTY_QUERY") {
-      return c.json({ items: [], nextCursor: null, total: 0 } satisfies SearchResponse)
-    }
-    throw e
+  const queryOptions = {
+    queryText,
+    schemaSlug,
+    statusFilter: status,
+    limit,
+    cursor,
   }
+  const countOptions = { queryText, schemaSlug, statusFilter: status }
 
-  const { sql, binds, countSql, countBinds } = queryParts
-
-  const [ftsResult, countResult] = await Promise.all([
-    c.env.DB.prepare(sql).bind(...binds).all<FtsRow>(),
-    c.env.DB.prepare(countSql).bind(...countBinds).first<{ total: number }>(),
+  const [rawRows, countResult] = await Promise.all([
+    searchRepository.search(queryOptions, seeds),
+    searchRepository.count(countOptions, seeds),
   ])
 
-  const rows  = ftsResult.results ?? []
-  const total = countResult?.total ?? 0
-
-  const hasMore  = rows.length > limit
-  const pageRows = hasMore ? rows.slice(0, limit) : rows
+  const hasMore  = rawRows.length > limit
+  const pageRows = hasMore ? rawRows.slice(0, limit) : rawRows
 
-  const nextCursor = hasMore
-    ? encodeCursor(pageRows.at(-1)!.rank, pageRows.at(-1)!.entry_id)
+  const lastRow = pageRows.at(-1)
+  const nextCursor = hasMore && lastRow
+    ? encodeCursor(lastRow.rank, lastRow.entryId)
     : null
 
   if (pageRows.length === 0) {
-    return c.json({ items: [], nextCursor: null, total } satisfies SearchResponse)
+    return c.json({ items: [], nextCursor: null, total: countResult.total } satisfies SearchResponse)
   }
 
-  const items = pageRows.map(row => mapFtsRow(row))
+  const items = pageRows.map(mapSearchResultRow)
 
-  return c.json({ items, nextCursor, total } satisfies SearchResponse)
+  return c.json({ items, nextCursor, total: countResult.total } satisfies SearchResponse)
 })

package/src/shared/apply-policies.test.ts

@@ -0,0 +1,77 @@
+import { describe, it, expect } from 'vitest'
+import { applyPrivacy, applyVisibility, PrivacyPolicyError } from './apply-policies'
+import type { Seed } from '@beechcms/core'
+
+function makeSeed(branches: any[]): Seed {
+  return { slug: 'test', displayNameAlias: 'title', branches } as unknown as Seed
+}
+
+// ─── applyPrivacy ─────────────────────────────────────────────────────────────
+
+describe('applyPrivacy', () => {
+  it('passes through fields with no privacy policy (default: public)', async () => {
+    const seed = makeSeed([{ id: 'br_01', alias: 'title', type: 'text' }])
+    const result = await applyPrivacy({ title: 'Hello' }, seed)
+    expect(result.title).toBe('Hello')
+  })
+
+  it('hashes the value when branch privacy is "hash"', async () => {
+    const seed = makeSeed([{ id: 'br_01', alias: 'email', type: 'text', policies: { privacy: 'hash' } }])
+    const result = await applyPrivacy({ email: 'user@test.com' }, seed)
+    // sha256 produces a 64-char hex string
+    expect(typeof result.email).toBe('string')
+    expect((result.email as string).length).toBe(64)
+    expect(result.email).not.toBe('user@test.com')
+  })
+
+  it('leaves null/undefined values unhashed even when privacy is "hash"', async () => {
+    const seed = makeSeed([{ id: 'br_01', alias: 'email', type: 'text', policies: { privacy: 'hash' } }])
+    const result = await applyPrivacy({ email: null }, seed)
+    expect(result.email).toBeNull()
+  })
+
+  it('throws PrivacyPolicyError for "encrypt" privacy (not yet implemented)', async () => {
+    const seed = makeSeed([{ id: 'br_01', alias: 'secret', type: 'text', policies: { privacy: 'encrypt' } }])
+    await expect(applyPrivacy({ secret: 'value' }, seed)).rejects.toBeInstanceOf(PrivacyPolicyError)
+  })
+
+  it('passes through fields not present in the seed branches unchanged', async () => {
+    const seed = makeSeed([{ id: 'br_01', alias: 'title', type: 'text' }])
+    const result = await applyPrivacy({ title: 'Hi', extraField: 'extra' }, seed)
+    expect(result.extraField).toBe('extra')
+  })
+})
+
+// ─── applyVisibility ──────────────────────────────────────────────────────────
+
+describe('applyVisibility', () => {
+  it('includes fields with default (visible) visibility', () => {
+    const seed = makeSeed([{ id: 'br_01', alias: 'title', type: 'text' }])
+    const result = applyVisibility({ title: 'Hello' }, seed)
+    expect(result.title).toBe('Hello')
+  })
+
+  it('omits fields with visibility "hidden"', () => {
+    const seed = makeSeed([{ id: 'br_01', alias: 'internal', type: 'text', policies: { visibility: 'hidden' } }])
+    const result = applyVisibility({ internal: 'secret' }, seed)
+    expect(result).not.toHaveProperty('internal')
+  })
+
+  it('masks non-empty string fields with visibility "masked"', () => {
+    const seed = makeSeed([{ id: 'br_01', alias: 'password', type: 'text', policies: { visibility: 'masked' } }])
+    const result = applyVisibility({ password: 'secret123' }, seed)
+    expect(result.password).toBe('••••••••')
+  })
+
+  it('returns null for empty string fields with visibility "masked"', () => {
+    const seed = makeSeed([{ id: 'br_01', alias: 'password', type: 'text', policies: { visibility: 'masked' } }])
+    const result = applyVisibility({ password: '' }, seed)
+    expect(result.password).toBeNull()
+  })
+
+  it('passes through fields not present in the seed branches', () => {
+    const seed = makeSeed([{ id: 'br_01', alias: 'title', type: 'text' }])
+    const result = applyVisibility({ title: 'Hi', extraField: 'pass' }, seed)
+    expect(result.extraField).toBe('pass')
+  })
+})

package/src/shared/automations.repository.d1.ts

@@ -0,0 +1,146 @@
+import type {
+  IAutomationRepository,
+  Automation,
+  AutomationAction,
+  AutomationTrigger,
+  AutomationTriggerEvent,
+  CreateAutomationInput,
+  UpdateAutomationInput,
+  WhenNode,
+} from '@beechcms/core'
+
+interface AutomationRow {
+  id: string
+  seed_slug: string
+  name: string
+  enabled: number
+  triggers: string
+  trigger_conditions: string | null
+  actions: string
+  created_at: number
+  updated_at: number
+}
+
+export class D1AutomationRepository implements IAutomationRepository {
+  constructor(private readonly db: D1Database) {}
+
+  async findActive(seedSlug: string, event: AutomationTriggerEvent): Promise<Automation[]> {
+    const result = seedSlug === '*'
+      ? await this.db
+          .prepare(
+            `SELECT DISTINCT a.* FROM automations a, json_each(a.triggers) t
+             WHERE a.enabled = 1 AND json_extract(t.value, '$.event') = ?`,
+          )
+          .bind(event)
+          .all<AutomationRow>()
+      : await this.db
+          .prepare(
+            `SELECT DISTINCT a.* FROM automations a, json_each(a.triggers) t
+             WHERE a.seed_slug = ? AND a.enabled = 1 AND json_extract(t.value, '$.event') = ?`,
+          )
+          .bind(seedSlug, event)
+          .all<AutomationRow>()
+    return (result.results ?? []).map(rowToAutomation)
+  }
+
+  async list(seedSlug: string): Promise<Automation[]> {
+    const result = await this.db
+      .prepare(`SELECT * FROM automations WHERE seed_slug = ? ORDER BY created_at DESC`)
+      .bind(seedSlug)
+      .all<AutomationRow>()
+    return (result.results ?? []).map(rowToAutomation)
+  }
+
+  async findById(id: string): Promise<Automation | null> {
+    const row = await this.db
+      .prepare(`SELECT * FROM automations WHERE id = ?`)
+      .bind(id)
+      .first<AutomationRow>()
+    return row ? rowToAutomation(row) : null
+  }
+
+  async create(input: CreateAutomationInput): Promise<string> {
+    const id = crypto.randomUUID()
+    const now = Math.floor(Date.now() / 1000)
+    await this.db
+      .prepare(
+        `INSERT INTO automations
+           (id, seed_slug, name, enabled, triggers, trigger_conditions, actions, created_at, updated_at)
+         VALUES (?, ?, ?, 1, ?, ?, ?, ?, ?)`,
+      )
+      .bind(
+        id,
+        input.seed_slug,
+        input.name,
+        JSON.stringify(input.triggers),
+        input.trigger_conditions ? JSON.stringify(input.trigger_conditions) : null,
+        JSON.stringify(input.actions),
+        now,
+        now,
+      )
+      .run()
+    return id
+  }
+
+  async update(id: string, input: UpdateAutomationInput): Promise<void> {
+    const now = Math.floor(Date.now() / 1000)
+    const fields: string[] = []
+    const values: unknown[] = []
+
+    const map: Record<string, unknown> = {
+      seed_slug: input.seed_slug,
+      name: input.name,
+      triggers: input.triggers !== undefined ? JSON.stringify(input.triggers) : undefined,
+      trigger_conditions:
+        input.trigger_conditions !== undefined
+          ? input.trigger_conditions === null
+            ? null
+            : JSON.stringify(input.trigger_conditions)
+          : undefined,
+      actions: input.actions !== undefined ? JSON.stringify(input.actions) : undefined,
+    }
+
+    for (const [column, value] of Object.entries(map)) {
+      if (value !== undefined) {
+        fields.push(`${column} = ?`)
+        values.push(value)
+      }
+    }
+
+    if (fields.length === 0) return
+
+    values.push(now, id)
+    await this.db
+      .prepare(`UPDATE automations SET ${fields.join(', ')}, updated_at = ? WHERE id = ?`)
+      .bind(...values)
+      .run()
+  }
+
+  async toggle(id: string, enabled: boolean): Promise<void> {
+    const now = Math.floor(Date.now() / 1000)
+    await this.db
+      .prepare(`UPDATE automations SET enabled = ?, updated_at = ? WHERE id = ?`)
+      .bind(enabled ? 1 : 0, now, id)
+      .run()
+  }
+
+  async delete(id: string): Promise<void> {
+    await this.db.prepare(`DELETE FROM automations WHERE id = ?`).bind(id).run()
+  }
+}
+
+function rowToAutomation(row: AutomationRow): Automation {
+  return {
+    id: row.id,
+    seed_slug: row.seed_slug,
+    name: row.name,
+    enabled: row.enabled === 1,
+    triggers: JSON.parse(row.triggers) as AutomationTrigger[],
+    trigger_conditions: row.trigger_conditions
+      ? (JSON.parse(row.trigger_conditions) as WhenNode)
+      : null,
+    actions: JSON.parse(row.actions) as AutomationAction[],
+    created_at: row.created_at,
+    updated_at: row.updated_at,
+  }
+}