@beechcms/api 0.4.3 → 0.6.0-preview.1

package/src/features/settings/settings.handler.ts

@@ -1,5 +1,10 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 /// <reference types="@cloudflare/workers-types" />
 import { Hono } from 'hono'
+import { sha256hex, type SiteSettings } from '@beechcms/core'
 import type { Env, Variables } from '../../types'
 
 const settingsApp = new Hono<{ Bindings: Env; Variables: Variables }>()
@@ -12,24 +17,96 @@ const ACTIVITY_LOG_LIMIT = 30
 
 /**
  * GET /api/settings
- * Retrieves the general site configuration.
+ * Retrieves the general site configuration from the database.
  */
 settingsApp.get('/', async (context) => {
+  const s = await context.get('siteSettingsRepository').getAll()
   return context.json({
-    siteTitle: 'Beech CMS',
+    siteTitle: s.siteTitle,
     siteLogo: '/beechLogoDark.svg',
-    defaultLanguage: 'it',
+    defaultLanguage: s.defaultLanguage,
+    timezone: s.timezone,
+    currency: s.currency,
+    company: {
+      name: s.companyName,
+      website: s.companyWebsite,
+      abbreviation: s.companyAbbreviation,
+    },
     dateFormat: context.env.DATE_FORMAT || 'DD-MM-YYYY',
     features: {
       drafts: true,
       media: true,
       search: true,
       activityLog: true,
-      email: !!(context.env.EMAIL_API_KEY || context.env.RESEND_API_KEY),
-    }
+      email: context.env.EMAIL_PROVIDER === 'smtp' || !!(context.env.EMAIL_API_KEY || context.env.RESEND_API_KEY),
+    },
   })
 })
 
+/**
+ * PUT /api/settings
+ * Updates the general site configuration in the database.
+ */
+settingsApp.put('/', async (context) => {
+  let payload: Record<string, unknown>
+  try {
+    payload = await context.req.json()
+  } catch {
+    return context.json({ error: 'Invalid JSON body' }, 400)
+  }
+
+  const siteTitle = typeof payload.siteTitle === 'string' ? payload.siteTitle.trim() : undefined
+  const defaultLanguage = typeof payload.defaultLanguage === 'string' ? payload.defaultLanguage.trim() : undefined
+  const timezone = typeof payload.timezone === 'string' ? payload.timezone.trim() : undefined
+  const currency = typeof payload.currency === 'string' ? payload.currency.trim() : undefined
+
+  let companyName: string | undefined | null = undefined
+  let companyWebsite: string | undefined | null = undefined
+  let companyAbbreviation: string | undefined | null = undefined
+
+  if (payload.company !== undefined) {
+    if (payload.company === null) {
+      companyName = null
+      companyWebsite = null
+      companyAbbreviation = null
+    } else if (typeof payload.company === 'object') {
+      const company = payload.company as Record<string, unknown>
+      companyName = typeof company.name === 'string' ? company.name.trim() : (company.name === null ? null : undefined)
+      companyWebsite = typeof company.website === 'string' ? (company.website.trim() || null) : (company.website === null ? null : undefined)
+      companyAbbreviation = typeof company.abbreviation === 'string' ? (company.abbreviation.trim() || null) : (company.abbreviation === null ? null : undefined)
+    }
+  }
+
+  if (defaultLanguage !== undefined && !['it', 'en'].includes(defaultLanguage)) {
+    return context.json({ type: 'bad-request', title: 'Bad Request', status: 400, detail: 'Invalid default language (must be it or en)' }, 400)
+  }
+
+  if (companyWebsite && companyWebsite !== '') {
+    try {
+      new URL(companyWebsite)
+    } catch {
+      return context.json({ type: 'bad-request', title: 'Bad Request', status: 400, detail: 'Invalid company website URL' }, 400)
+    }
+  }
+
+  const fieldsToUpdate: Partial<SiteSettings> = {}
+  if (siteTitle !== undefined) fieldsToUpdate.siteTitle = siteTitle
+  if (defaultLanguage !== undefined) fieldsToUpdate.defaultLanguage = defaultLanguage
+  if (timezone !== undefined) fieldsToUpdate.timezone = timezone
+  if (currency !== undefined) fieldsToUpdate.currency = currency
+  if (companyName !== undefined) fieldsToUpdate.companyName = companyName
+  if (companyWebsite !== undefined) fieldsToUpdate.companyWebsite = companyWebsite
+  if (companyAbbreviation !== undefined) fieldsToUpdate.companyAbbreviation = companyAbbreviation
+
+  // If companyName is updated and siteTitle isn't specified, sync siteTitle
+  if (companyName && siteTitle === undefined) {
+    fieldsToUpdate.siteTitle = companyName
+  }
+
+  await context.get('siteSettingsRepository').setMany(fieldsToUpdate)
+  return context.json({ success: true })
+})
+
 /**
  * GET /api/settings/me
  * Retrieves the currently authenticated user's profile and preferences.
@@ -49,11 +126,18 @@ settingsApp.get('/me', async (context) => {
     notificationPreferences = {}
   }
 
+  let avatarUrl = currentUser.avatarUrl
+  if (!avatarUrl && currentUser.email) {
+    const emailHash = await sha256hex(currentUser.email.trim().toLowerCase())
+    avatarUrl = `https://gravatar.com/avatar/${emailHash}?d=mp`
+  }
+
   return context.json({
     id: currentUser.id,
     email: currentUser.email,
     name: currentUser.name,
-    avatarUrl: currentUser.avatarUrl,
+    surname: currentUser.surname,
+    avatarUrl,
     notificationPrefs: {
       contentCreate: notificationPreferences.contentCreate ?? true,
       contentUpdate: notificationPreferences.contentUpdate ?? true,
@@ -78,6 +162,7 @@ settingsApp.put('/profile', async (context) => {
   }
 
   const nameInput = typeof payload.name === 'string' ? payload.name.trim() : null
+  const surnameInput = typeof payload.surname === 'string' ? payload.surname.trim() : null
   const emailInput = typeof payload.email === 'string' ? payload.email.trim().toLowerCase() : null
 
   if (emailInput !== null && !EMAIL_VALIDATION_REGEX.test(emailInput)) {
@@ -88,7 +173,11 @@ settingsApp.put('/profile', async (context) => {
     return context.json({ type: 'bad-request', title: 'Bad Request', status: 400, detail: 'Name is too long (maximum 100 characters)' }, 400)
   }
 
-  const hasNoFields = nameInput === null && emailInput === null
+  if (surnameInput !== null && surnameInput.length > 100) {
+    return context.json({ type: 'bad-request', title: 'Bad Request', status: 400, detail: 'Surname is too long (maximum 100 characters)' }, 400)
+  }
+
+  const hasNoFields = nameInput === null && surnameInput === null && emailInput === null
   if (hasNoFields) {
     return context.json({ error: 'No fields to update' }, 400)
   }
@@ -100,8 +189,9 @@ settingsApp.put('/profile', async (context) => {
     }
   }
 
-  const fieldsToUpdate: { name?: string; email?: string } = {}
+  const fieldsToUpdate: { name?: string; surname?: string; email?: string } = {}
   if (nameInput !== null) fieldsToUpdate.name = nameInput
+  if (surnameInput !== null) fieldsToUpdate.surname = surnameInput
   if (emailInput !== null) fieldsToUpdate.email = emailInput
 
   await context.get('userRepository').updateProfile(userId, fieldsToUpdate)

package/src/features/setup/index.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 /// <reference types="@cloudflare/workers-types" />
 import { Hono } from 'hono'
 import type { Env, Variables } from '../../types'
@@ -7,16 +11,25 @@ const setupApp = new Hono<{ Bindings: Env; Variables: Variables }>()
 
 /**
  * GET /auth/setup
- * Checks if the application needs an initial setup (i.e., if no users exist).
+ * Returns setup status + environment flags for the wizard.
  */
 setupApp.get('/auth/setup', async (context) => {
   const userCount = await context.get('userRepository').countAll()
-  return context.json({ needsSetup: userCount === 0 })
+  const isDeveloper = context.env.ENV === 'development'
+  const mail =
+    context.env.EMAIL_PROVIDER === 'smtp' ||
+    !!(context.env.EMAIL_API_KEY || context.env.RESEND_API_KEY)
+  const qstash = !!context.env.QSTASH_TOKEN
+
+  return context.json({
+    needsSetup: userCount === 0,
+    environment: { isDeveloper, services: { mail, qstash } },
+  })
 })
 
 /**
  * POST /auth/setup
- * Creates the first administrator account. This endpoint is disabled once at least one user exists.
+ * Creates the first administrator account and persists site defaults.
  */
 setupApp.post('/auth/setup', async (context) => {
   const userCount = await context.get('userRepository').countAll()
@@ -26,7 +39,7 @@ setupApp.post('/auth/setup', async (context) => {
       type: 'setup-already-done',
       title: 'Setup already completed',
       status: 403,
-      detail: 'An administrator account already exists. Initial setup can only be performed once.'
+      detail: 'An administrator account already exists. Initial setup can only be performed once.',
     })
   }
 
@@ -38,7 +51,7 @@ setupApp.post('/auth/setup', async (context) => {
       type: 'bad-request',
       title: 'Invalid JSON body',
       status: 400,
-      detail: 'The request body could not be parsed as valid JSON.'
+      detail: 'The request body could not be parsed as valid JSON.',
     })
   }
 
@@ -47,18 +60,19 @@ setupApp.post('/auth/setup', async (context) => {
       type: 'bad-request',
       title: 'Invalid request',
       status: 400,
-      detail: 'The request payload is missing or invalid.'
+      detail: 'The request payload is missing or invalid.',
     })
   }
 
-  const { email, password, name } = payload as Record<string, unknown>
+  const p = payload as Record<string, unknown>
+  const { email, password, name, surname, settings, track, company, loadDemoData } = p
 
   if (typeof email !== 'string' || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email.trim())) {
     return publicProblem(context, {
       type: 'validation-error',
       title: 'Valid email required',
       status: 422,
-      detail: 'A valid email address is required for the administrator account.'
+      detail: 'A valid email address is required for the administrator account.',
     })
   }
 
@@ -67,13 +81,97 @@ setupApp.post('/auth/setup', async (context) => {
       type: 'validation-error',
       title: 'Invalid password',
       status: 422,
-      detail: 'Password must be between 8 and 128 characters long.'
+      detail: 'Password must be between 8 and 128 characters long.',
+    })
+  }
+
+  if (!settings || typeof settings !== 'object') {
+    return publicProblem(context, {
+      type: 'validation-error',
+      title: 'Settings required',
+      status: 422,
+      detail: 'settings.language, settings.timezone, and settings.currency are required.',
     })
   }
 
+  const s = settings as Record<string, unknown>
+  const language = typeof s.language === 'string' ? s.language : ''
+  const timezone = typeof s.timezone === 'string' ? s.timezone.trim() : ''
+  const currency = typeof s.currency === 'string' ? s.currency.trim() : ''
+
+  if (!['it', 'en'].includes(language)) {
+    return publicProblem(context, {
+      type: 'validation-error',
+      title: 'Invalid language',
+      status: 422,
+      detail: 'settings.language must be "it" or "en".',
+    })
+  }
+
+  if (!timezone) {
+    return publicProblem(context, {
+      type: 'validation-error',
+      title: 'Timezone required',
+      status: 422,
+      detail: 'settings.timezone must be a non-empty IANA timezone string.',
+    })
+  }
+
+  if (!currency) {
+    return publicProblem(context, {
+      type: 'validation-error',
+      title: 'Currency required',
+      status: 422,
+      detail: 'settings.currency must be a non-empty ISO 4217 currency code.',
+    })
+  }
+
+  if (track === 'normal') {
+    if (!company || typeof company !== 'object') {
+      return publicProblem(context, {
+        type: 'validation-error',
+        title: 'Company info required',
+        status: 422,
+        detail: 'company.name and company.website are required for the normal track.',
+      })
+    }
+    const c = company as Record<string, unknown>
+    if (typeof c.name !== 'string' || !c.name.trim()) {
+      return publicProblem(context, {
+        type: 'validation-error',
+        title: 'Company name required',
+        status: 422,
+        detail: 'company.name must be a non-empty string.',
+      })
+    }
+    if (typeof c.website !== 'string' || !c.website.trim()) {
+      return publicProblem(context, {
+        type: 'validation-error',
+        title: 'Company website required',
+        status: 422,
+        detail: 'company.website must be a valid URL.',
+      })
+    }
+    try {
+      new URL(c.website.trim())
+    } catch {
+      return publicProblem(context, {
+        type: 'validation-error',
+        title: 'Invalid company website',
+        status: 422,
+        detail: 'company.website must be a valid URL.',
+      })
+    }
+  }
+
+  if (track === 'developer' && loadDemoData === true) {
+    await context.get('demoDataRepository').loadDemoData()
+  }
+
   const passwordHash = await context.get('hashProvider').hash(password)
   const normalizedEmail = email.trim().toLowerCase()
   const normalizedName = typeof name === 'string' ? name.trim() : null
+  const normalizedSurname = typeof surname === 'string' ? surname.trim() : null
 
   await context.get('userRepository').create({
     id: context.get('idGenerator').uuid(),
@@ -81,11 +179,26 @@ setupApp.post('/auth/setup', async (context) => {
     passwordHash,
     role: 'admin',
     name: normalizedName,
+    surname: normalizedSurname,
   })
 
+  if (track === 'normal' && company && typeof company === 'object') {
+    const c = company as Record<string, unknown>
+    const companyName = (c.name as string).trim()
+    await context.get('siteSettingsRepository').setMany({
+      defaultLanguage: language,
+      timezone,
+      currency,
+      companyName,
+      companyWebsite: (c.website as string).trim(),
+      companyAbbreviation: typeof c.abbreviation === 'string' ? c.abbreviation.trim() || null : null,
+      siteTitle: companyName,
+    })
+  } else {
+    await context.get('siteSettingsRepository').setMany({ defaultLanguage: language, timezone, currency })
+  }
+
   return context.json({ success: true }, 201)
 })
 
 export { setupApp }
-
-

package/src/features/stats/index.ts

@@ -1 +1,5 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 export { statsApp } from './stats.handler'

package/src/features/stats/stats.handler.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 /// <reference types="@cloudflare/workers-types" />
 import { Hono } from 'hono'
 import { SystemClock } from '@beechcms/core'
@@ -118,46 +122,32 @@ statsApp.get('/stats/unused-media', async (context) => {
  */
 statsApp.get('/stats/setup-checklist', async (context) => {
     try {
-        const { DB } = context.env
+        const setupChecklistRepository = context.get('setupChecklistRepository')
         const seeds = context.get('seedRegistry').all()
 
-        // 1. System tables present
+        const existingTables = await setupChecklistRepository.getExistingTableNames()
+
         const systemTableNames = [
             'users', 'refresh_tokens', 'media_objects',
             'analytics', 'system_stats', 'activity_logs',
         ]
-        const tablesResult = await DB.prepare(
-            `SELECT name FROM sqlite_master WHERE type='table'`
-        ).all<{ name: string }>()
-        const existingTables = new Set((tablesResult.results ?? []).map(row => row.name))
-        const systemTablesOk = systemTableNames.every(tableName => existingTables.has(tableName))
+        const systemTablesOk = systemTableNames.every(name => existingTables.has(name))
 
-        // 2. Seeds defined
         const seedsCount = seeds.length
-
-        // 3. Content tables created (seed:load was run)
         const contentTablesOk = seedsCount > 0 && seeds.every(seed => existingTables.has(`content_${seed.slug}`))
 
-        // 4. Admin account exists
         let adminExists = false
         try {
-            const adminCountResult = await DB.prepare(
-                `SELECT COUNT(*) as count FROM users WHERE role = 'admin'`
-            ).first<{ count: number }>()
-            adminExists = (adminCountResult?.count ?? 0) > 0
+            adminExists = (await setupChecklistRepository.countAdmins()) > 0
         } catch {
-            // table may not exist yet
+            // users table may not exist yet
         }
 
-        // 5. At least one content entry in the first seed's table
         let hasContent = false
         const firstSeedSlug = seeds[0]?.slug ?? null
         if (firstSeedSlug && existingTables.has(`content_${firstSeedSlug}`)) {
             try {
-                const contentCountResult = await DB.prepare(
-                    `SELECT COUNT(*) as count FROM content_${firstSeedSlug}`
-                ).first<{ count: number }>()
-                hasContent = (contentCountResult?.count ?? 0) > 0
+                hasContent = (await setupChecklistRepository.countEntriesInSeed(firstSeedSlug)) > 0
             } catch {
                 // ignore
             }

package/src/features/webhooks/index.ts

@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { Hono } from 'hono'
+import { Receiver } from '@upstash/qstash'
+import type { AppEnv } from '../../types'
+import type { CreateNotificationInput } from '@beechcms/core'
+
+export const webhooksApp = new Hono<AppEnv>()
+
+webhooksApp.post('/qstash', async (context) => {
+  const currentSigningKey = context.env.QSTASH_CURRENT_SIGNING_KEY
+  const nextSigningKey = context.env.QSTASH_NEXT_SIGNING_KEY
+
+  if (!currentSigningKey || !nextSigningKey) {
+    console.error('QStash webhook called but signing keys are not configured')
+    return context.text('Configuration error', 500)
+  }
+
+  const receiver = new Receiver({
+    currentSigningKey,
+    nextSigningKey,
+  })
+
+  const body = await context.req.text()
+  const signature = context.req.header('Upstash-Signature')
+
+  if (!signature) {
+    return context.text('Missing signature', 401)
+  }
+
+  try {
+    const isValid = await receiver.verify({
+      signature,
+      body,
+    })
+
+    if (!isValid) {
+      return context.text('Invalid signature', 401)
+    }
+  } catch (err) {
+    console.error('QStash signature verification failed', err)
+    return context.text('Invalid signature', 401)
+  }
+
+  try {
+    const input = JSON.parse(body) as CreateNotificationInput
+    
+    const notificationRepository = context.get('notificationRepository')
+    
+    await notificationRepository.create({
+      title: input.title,
+      message: input.message,
+      type: input.type ?? 'info',
+    })
+
+    return context.text('OK', 200)
+  } catch (error) {
+    console.error('Failed to process QStash webhook payload', error)
+    return context.text('Internal server error', 500)
+  }
+})

package/src/index.ts

@@ -1,31 +1,38 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { createBeechApp } from './factory'
 import { SeedRegistry, SystemIdGenerator } from '@beechcms/core'
 import { runCronAutomations } from './features/automations'
 import { D1AutomationRepository } from './shared/automations.repository.d1'
 import { D1ContentRepository } from './shared/content.repository.d1'
+import { D1SeedRepository } from './shared/seed.repository.d1'
 import type { Env } from './types'
 
-let seeds: any[] = []
-
-try {
-  // @ts-ignore
-  const mod = await import('../seed.ts')
-  const registry = mod.default || mod.SEED_REGISTRY || mod
-  seeds = (typeof registry === 'object' && !Array.isArray(registry))
-    ? Object.values(registry)
-    : registry
-} catch (e) {
-  // Fallback se seed.ts non esiste
-}
-
-const app = createBeechApp({ seeds })
+const app = createBeechApp({ seeds: [] })
 
-app.get('/', (c) => c.text('Beech API is running (Local Dev Mode)'))
-
-const validSeeds = seeds.filter((s: any) => s && typeof s === 'object' && 'slug' in s)
+app.get('/', (c) => c.text('Beech API is running'))
 
 export default {
-  fetch: app.fetch,
+  fetch(request: Request, env: Env, ctx: ExecutionContext) {
+    if (env.ENV === 'development') {
+      const checks: Array<{ name: string; url: string }> = [
+        { name: 'MinIO',   url: (env.R2_ENDPOINT ?? 'http://localhost:9000') + '/minio/health/live' },
+        { name: 'Mailpit', url: `http://${env.SMTP_HOST ?? 'localhost'}:${env.SMTP_PORT ?? '8025'}/livez` },
+      ]
+      for (const c of checks) {
+        fetch(c.url).catch(() => {
+          console.warn(
+            `\n⚠️  ${c.name} non raggiungibile su ${c.url}\n` +
+            `   Beech in dev richiede lo stack Docker completo.\n` +
+            `   Avvialo con: npm run dev:full\n`
+          )
+        })
+      }
+    }
+    return app.fetch(request, env, ctx)
+  },
 
   async scheduled(controller: ScheduledController, env: Env, ctx: ExecutionContext) {
     const scheduledTime = controller?.scheduledTime ?? Date.now()
@@ -37,7 +44,9 @@ export default {
 
     const automationRepository = new D1AutomationRepository(env.DB)
     const contentRepository = new D1ContentRepository(env.DB)
-    const registry = new SeedRegistry(validSeeds)
+    const seedRepository = new D1SeedRepository(env.DB)
+    const seeds = await seedRepository.listActive()
+    const registry = new SeedRegistry(seeds)
     const getSeed = (slug: string) => registry.get(slug) ?? null
 
     ctx.waitUntil(

package/src/media-utils.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 /**
  * Media utils: estrazione chiavi R2 dal data di un'entry.
  * Usato alla cancellazione entry per eliminare i file associati da R2.

package/src/middleware/auth-providers.middleware.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { createMiddleware } from 'hono/factory'
 import type { IHashProvider, ITokenService, IClock } from '@beechcms/core'
 import { SystemClock } from '@beechcms/core'
@@ -11,8 +15,17 @@ export interface AuthProviderOverrides {
   clock?: IClock
 }
 
+// Valore di default presente in .dev.vars.example: mai accettabile in produzione.
+const DEV_JWT_SECRET = 'sviluppo-secret-cambiami-almeno-32-byte-per-sicurezza-hono'
+
 export const authProvidersMiddleware = (overrides?: AuthProviderOverrides) => {
   return createMiddleware<AppEnv>(async (context, next) => {
+    if (context.env.ENV === 'production' && context.env.JWT_SECRET === DEV_JWT_SECRET) {
+      throw new Error(
+        'JWT_SECRET non configurato: in produzione impostare un segreto univoco con `wrangler secret put JWT_SECRET`',
+      )
+    }
+
     const resolvedClock = overrides?.clock ?? SystemClock
     const hashProvider = overrides?.hashProvider ?? new BcryptHashProvider()
     const tokenService = overrides?.tokenService ?? new JoseTokenService(

package/src/middleware/observability.middleware.ts

@@ -1,9 +1,14 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { createMiddleware } from 'hono/factory'
 import type { IActivityLogger, INotificationService, IClock, IIdGenerator } from '@beechcms/core'
 import { SystemClock, SystemIdGenerator } from '@beechcms/core'
 import type { AppEnv } from '../types'
 import { D1ActivityLogger } from '../shared/d1-activity-logger'
 import { BackgroundNotificationService } from '../shared/background-notification-service'
+import { QStashNotificationService } from '../shared/qstash-notification-service'
 
 export interface ObservabilityOverrides {
   activityLogger?: IActivityLogger
@@ -40,9 +45,22 @@ export const observabilityMiddleware = (overrides?: ObservabilityOverrides) => {
       overrides?.activityLogger ??
       new D1ActivityLogger(context.env.DB, resolvedClock, resolvedIdGenerator, scheduleBackgroundTask)
 
-    const notificationService =
-      overrides?.notificationService ??
-      new BackgroundNotificationService(context.get('notificationRepository'), scheduleBackgroundTask)
+    let notificationService: INotificationService
+    if (overrides?.notificationService) {
+      notificationService = overrides.notificationService
+    } else if (context.env.QSTASH_TOKEN && context.env.APP_URL) {
+      notificationService = new QStashNotificationService(
+        context.env.QSTASH_TOKEN,
+        context.env.APP_URL,
+        scheduleBackgroundTask,
+        context.env.QSTASH_URL
+      )
+    } else {
+      notificationService = new BackgroundNotificationService(
+        context.get('notificationRepository'),
+        scheduleBackgroundTask
+      )
+    }
 
     context.set('activityLogger', activityLogger)
     context.set('notificationService', notificationService)

package/src/middleware/rate-limit.middleware.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 /// <reference types="@cloudflare/workers-types" />
 import { createMiddleware } from 'hono/factory'
 import type { IRateLimiter } from '@beechcms/core'