@beechcms/api 0.4.3 → 0.6.0-preview.1

package/src/factory.ts

@@ -1,9 +1,13 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 /// <reference types="@cloudflare/workers-types" />
 import { Hono } from 'hono'
 import { cors } from 'hono/cors'
 import { getCookie, setCookie, deleteCookie } from 'hono/cookie'
 import type { Seed, ContentRepository, IdempotencyRepository, BeechBucket, MediaRepository, SystemStatsRepository } from '@beechcms/core'
-import { sha256hex, SystemClock, SystemIdGenerator, SeedRegistry } from '@beechcms/core'
+import { sha256hex, SystemClock, SystemIdGenerator } from '@beechcms/core'
 import type { Env, Variables } from './types'
 import { getClientIp } from './shared/request-utils'
 
@@ -25,14 +29,20 @@ import { setupApp } from './features/setup'
 import { draftApp } from './features/draft'
 import { settingsApp } from './features/settings/settings.handler'
 import { schemaApp } from './features/schema/schema.handler'
+import { seedsApp } from './features/seeds'
 import { notificationsApp } from './features/notifications'
 import { automationsApp } from './features/automations'
 import { statsApp } from './features/stats'
+import { backrefsApp } from './features/backrefs'
+import { webhooksApp } from './features/webhooks'
 import { uploadRoutes, serveMediaHandler } from './upload'
 import { publicRoutes, apiKeyMiddleware, publicRateLimitMiddleware } from './public'
 import { searchRouter } from "./search"
+import type { ISeedRepository } from '@beechcms/core'
 import { repositoryMiddleware } from './middleware/repository.middleware'
+import { seedRegistryMiddleware } from './middleware/seed-registry.middleware'
 import { storageMiddleware } from './middleware/storage.middleware'
+import { InMemorySeedRepository } from './shared/in-memory-seed.repository'
 import { authProvidersMiddleware } from './middleware/auth-providers.middleware'
 import { rateLimiterMiddleware } from './middleware/rate-limit.middleware'
 import { observabilityMiddleware } from './middleware/observability.middleware'
@@ -44,6 +54,10 @@ export interface BeechConfig {
   bucket?: BeechBucket
   mediaRepository?: MediaRepository
   systemStatsRepository?: SystemStatsRepository
+  // Optional override: inject a custom ISeedRepository (e.g. InMemorySeedRepository for tests).
+  // When omitted and seeds is non-empty, an InMemorySeedRepository is created automatically
+  // for backward compatibility.
+  seedRepository?: ISeedRepository
 }
 
 // --- Costanti e helper ---
@@ -86,32 +100,34 @@ function extractPublicSeed(path: string): string {
 }
 
 /**
- * Builds a fully configured Hono app with the given seeds injected into context.
- * This is the main entry point for a BeechCMS project.
+ * Builds a fully configured Hono app. Seeds are hydrated from D1 at runtime via
+ * seedRegistryMiddleware; config.seeds is retained for back-compat but no longer
+ * drives request handling.
  */
 export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Variables: Variables }> {
+  // Back-compat shim: when callers (e.g. existing tests) pass seeds without a custom
+  // seedRepository, wrap them in an InMemorySeedRepository so the middleware can serve
+  // them without touching D1. Production index.ts passes seeds:[] so D1SeedRepository
+  // is used as the live path.
   const seedsArray = Array.isArray(config.seeds) ? config.seeds : Object.values(config.seeds)
-  // Filter out any invalid objects that might have leaked into the registry (e.g. module exports)
-  const validSeeds = seedsArray.filter(s => s && typeof s === 'object' && 'slug' in s)
-  const seedRegistry = new SeedRegistry(validSeeds)
+  const seedRepository = config.seedRepository
+    ?? (seedsArray.length > 0 ? new InMemorySeedRepository(seedsArray) : undefined)
 
   const app = new Hono<{ Bindings: Env; Variables: Variables }>()
 
-  // 1. Core Middleware (Seeds, CORS, Security)
-  app.use('*', async (context, next) => {
-    context.set('getSeed', (slug: string) => seedRegistry.get(slug))
-    context.set('seedRegistry', seedRegistry)
-    await next()
-  })
-
-  // 1.1 Repository Injection
+  // 1. Repository Injection (must be first — seedRegistryMiddleware depends on seedRepository)
   app.use('*', repositoryMiddleware({
     repository: config.repository,
     idempotencyRepository: config.idempotencyRepository,
     mediaRepository: config.mediaRepository,
     systemStatsRepository: config.systemStatsRepository,
+    seedRepository,
   }))
 
+  // 2. Seed Registry Hydration (D1-backed, version-token-cached per isolate)
+  app.use('*', seedRegistryMiddleware())
+
+  // 3. Storage / Auth / Rate Limiting / Observability
   app.use('*', storageMiddleware({
     bucket: config.bucket,
   }))
@@ -211,7 +227,7 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
 
       if (!user || !isValid) return context.json({ error: AUTH_ERRORS.INVALID_CREDENTIALS }, 401)
 
-      const accessToken = await context.get('tokenService').issue({ sub: user.id, email: user.email, name: user.name ?? undefined })
+      const accessToken = await context.get('tokenService').issue({ sub: user.id, email: user.email, name: user.name ?? undefined, surname: user.surname ?? undefined, role: user.role })
       const refreshToken = generateRefreshToken()
       const refreshTokenHash = await sha256hex(refreshToken)
       const nowSeconds = SystemClock.nowSeconds()
@@ -251,7 +267,7 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
 
       // Issue new tokens before revoking the old one: if saveRefreshToken fails,
       // the old token stays valid and the user is not locked out.
-      const newAccessToken = await context.get('tokenService').issue({ sub: user.id, email: user.email, name: user.name ?? undefined })
+      const newAccessToken = await context.get('tokenService').issue({ sub: user.id, email: user.email, name: user.name ?? undefined, surname: user.surname ?? undefined, role: user.role })
       const newRefreshToken = generateRefreshToken()
       const newRefreshTokenHash = await sha256hex(newRefreshToken)
 
@@ -297,10 +313,12 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
 
   apiProtected.route('/settings', settingsApp)
   apiProtected.route('/schema', schemaApp)
+  apiProtected.route('/seeds', seedsApp)
   apiProtected.route('/content', notificationsApp)
   apiProtected.route('/content', statsApp)
   apiProtected.route('/content', rotateFieldApp)
   apiProtected.route('/content', draftApp)
+  apiProtected.route('/content', backrefsApp)
   apiProtected.route('/content', contentFeature)
   apiProtected.route('/widget', widgetApp)
   apiProtected.route('/automations', automationsApp)
@@ -313,6 +331,9 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
   apiPublic.route('/', publicRoutes)
   app.route('/api/v1/public', apiPublic)
 
+  // Webhooks API (public, verified via signature)
+  app.route('/api/webhooks', webhooksApp)
+
   app.get('/api/media/:key', (context) => serveMediaHandler(context))
   app.route('/api', apiProtected)
   app.route('/api/search', searchRouter)

package/src/features/automations/__tests__/action-executors.test.ts

@@ -1,7 +1,13 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 import { executeAction } from '../action-executors'
 import type { ActionContext } from '../action-executors'
 import type { ContentRepository, Seed, IIdGenerator } from '@beechcms/core'
+import { deleteAllMessages, listMessages, waitForMessage, getMessageHtml } from '../../../../test/helpers/mailpit-client'
+import { newBucket, waitForRequest } from '../../../../test/helpers/webhook-tester-client'
 
 // ── Shared mock context factory ───────────────────────────────────────────────
 
@@ -41,74 +47,55 @@ function makeCtx(overrides: Partial<ActionContext> = {}): ActionContext {
 // ── webhook ───────────────────────────────────────────────────────────────────
 
 describe('webhook executor', () => {
-  beforeEach(() => { vi.restoreAllMocks() })
-
-  it('POSTs to URL with JSON body derived from entry when no body_template', async () => {
-    const fetchMock = vi.fn().mockResolvedValue({ ok: true, status: 200 })
-    vi.stubGlobal('fetch', fetchMock)
-
+  it('POSTs to URL with interpolated body_template', async () => {
+    const { url, uuid } = await newBucket()
     const ctx = makeCtx()
-    await executeAction({ type: 'webhook', url: 'https://example.com/hook' }, ctx)
-
-    expect(fetchMock).toHaveBeenCalledOnce()
-    const [url, init] = fetchMock.mock.calls[0]
-    expect(url).toBe('https://example.com/hook')
-    expect(init.method).toBe('POST')
-    expect(JSON.parse(init.body)).toMatchObject({ id: 'entry-1', title: 'Test Entry' })
+    await executeAction({ type: 'webhook', url, body_template: '{"id":"{{id}}","title":"{{title}}"}' }, ctx)
+    const req = await waitForRequest(uuid)
+    expect(req.method).toBe('POST')
+    expect(JSON.parse(req.body)).toMatchObject({ id: 'entry-1', title: 'Test Entry' })
   })
 
   it('interpolates body_template with entry values', async () => {
-    const fetchMock = vi.fn().mockResolvedValue({ ok: true })
-    vi.stubGlobal('fetch', fetchMock)
-
+    const { url, uuid } = await newBucket()
     const ctx = makeCtx()
-    await executeAction({ type: 'webhook', url: 'https://example.com/hook', body_template: '{"t":"{{title}}"}' }, ctx)
-
-    const [, init] = fetchMock.mock.calls[0]
-    expect(init.body).toBe('{"t":"Test Entry"}')
+    await executeAction({ type: 'webhook', url, body_template: '{"t":"{{title}}"}' }, ctx)
+    const req = await waitForRequest(uuid)
+    expect(req.body).toBe('{"t":"Test Entry"}')
   })
 
   it('merges custom headers', async () => {
-    const fetchMock = vi.fn().mockResolvedValue({ ok: true })
-    vi.stubGlobal('fetch', fetchMock)
-
+    const { url, uuid } = await newBucket()
     const ctx = makeCtx()
-    await executeAction({ type: 'webhook', url: 'https://x.com', headers: { 'X-Token': 'abc' } }, ctx)
-
-    const [, init] = fetchMock.mock.calls[0]
-    expect(init.headers['X-Token']).toBe('abc')
+    await executeAction({ type: 'webhook', url, headers: { 'X-Token': 'abc' } }, ctx)
+    const req = await waitForRequest(uuid)
+    expect(req.headers['x-token']).toBe('abc')
   })
 
-  it('throws when response is not ok', async () => {
-    vi.stubGlobal('fetch', vi.fn().mockResolvedValue({ ok: false, status: 500 }))
+  it('throws when webhook endpoint is unreachable', async () => {
     const ctx = makeCtx()
-    await expect(executeAction({ type: 'webhook', url: 'https://x.com' }, ctx)).rejects.toThrow('500')
+    await expect(executeAction({ type: 'webhook', url: 'http://localhost:19999/nope' }, ctx)).rejects.toThrow()
   })
 
   it('uses custom HTTP method', async () => {
-    const fetchMock = vi.fn().mockResolvedValue({ ok: true })
-    vi.stubGlobal('fetch', fetchMock)
+    const { url, uuid } = await newBucket()
     const ctx = makeCtx()
-    await executeAction({ type: 'webhook', url: 'https://x.com', method: 'PUT' }, ctx)
-    expect(fetchMock.mock.calls[0][1].method).toBe('PUT')
+    await executeAction({ type: 'webhook', url, method: 'PUT' }, ctx)
+    const req = await waitForRequest(uuid)
+    expect(req.method).toBe('PUT')
   })
 })
 
 // ── send_mail ─────────────────────────────────────────────────────────────────
 
-vi.mock('../../email', () => ({
-  sendAutomationMail: vi.fn().mockResolvedValue(undefined),
-}))
-
 describe('send_mail executor', () => {
-  beforeEach(async () => {
-    const { sendAutomationMail } = await import('../../email')
-    vi.mocked(sendAutomationMail).mockClear()
-  })
+  beforeEach(() => deleteAllMessages())
 
-  it('interpolates to/subject/body and calls sendAutomationMail', async () => {
-    const { sendAutomationMail } = await import('../../email')
-    const ctx = makeCtx({ entry: { id: '1', email: 'user@example.com', title: 'Hello' } })
+  it('interpolates to/subject/body and delivers to Mailpit', async () => {
+    const ctx = makeCtx({
+      entry: { id: '1', email: 'user@example.com', title: 'Hello' },
+      env: { EMAIL_PROVIDER: 'smtp', SMTP_HOST: 'localhost', SMTP_PORT: '8025', EMAIL_FROM: 'Beech <test@beech.local>' },
+    })
 
     await executeAction(
       {
@@ -120,19 +107,19 @@ describe('send_mail executor', () => {
       ctx,
     )
 
-    expect(sendAutomationMail).toHaveBeenCalledWith(
-      expect.objectContaining({
-        to: 'user@example.com',
-        subject: 'Re: Hello',
-        body: 'Your entry Hello was created.',
-      }),
-    )
+    const msg = await waitForMessage(m => m.To.some(t => t.Address === 'user@example.com'))
+    expect(msg.Subject).toBe('Re: Hello')
+    const html = await getMessageHtml(msg.ID)
+    expect(html).toContain('Hello')
   })
 
-  it('substitutes default value [missing] and logs a warning when concrete data is absent', async () => {
-    const { sendAutomationMail } = await import('../../email')
+  it('substitutes [missing] for absent fields and logs a warning', async () => {
     const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    const ctx = makeCtx({ entry: { id: '1' } })
+    // email is present (needed for a valid To address) but title and desc are absent
+    const ctx = makeCtx({
+      entry: { id: '1', email: 'warn-test@example.com' },
+      env: { EMAIL_PROVIDER: 'smtp', SMTP_HOST: 'localhost', SMTP_PORT: '8025', EMAIL_FROM: 'Beech <test@beech.local>' },
+    })
 
     await executeAction(
       {
@@ -144,23 +131,20 @@ describe('send_mail executor', () => {
       ctx,
     )
 
-    expect(sendAutomationMail).toHaveBeenCalledWith(
-      expect.objectContaining({
-        to: '[missing]',
-        subject: 'Re: [missing]',
-        body: 'Content: [missing]',
-      }),
-    )
     expect(warnSpy).toHaveBeenCalledWith(
       expect.stringContaining('missing concrete data'),
-      ['email', 'title', 'desc'],
+      expect.arrayContaining(['title', 'desc']),
     )
+    const msg = await waitForMessage(m => m.Subject === 'Re: [missing]')
+    expect(msg.Subject).toBe('Re: [missing]')
+    const html = await getMessageHtml(msg.ID)
+    expect(html).toContain('[missing]')
+    warnSpy.mockRestore()
   })
 
-  it('skips execution gracefully and logs an error without calling sendAutomationMail if apiKey is missing', async () => {
-    const { sendAutomationMail } = await import('../../email')
+  it('skips execution and logs an error when provider is resend and apiKey is missing', async () => {
     const errSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
-    const ctx = makeCtx({ env: {} }) // missing email/resend api keys
+    const ctx = makeCtx({ env: {} })
 
     await executeAction(
       {
@@ -172,15 +156,17 @@ describe('send_mail executor', () => {
       ctx,
     )
 
-    expect(sendAutomationMail).not.toHaveBeenCalled()
     expect(errSpy).toHaveBeenCalledWith(expect.stringContaining('Execution skipped'))
+    const msgs = await listMessages()
+    expect(msgs).toHaveLength(0)
+    errSpy.mockRestore()
   })
 
-  it('logs error and rethrows when sendAutomationMail fails', async () => {
-    const { sendAutomationMail } = await import('../../email')
-    vi.mocked(sendAutomationMail).mockRejectedValueOnce(new Error('provider error'))
+  it('logs error and rethrows when SMTP provider is unreachable', async () => {
     const errSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
-    const ctx = makeCtx()
+    const ctx = makeCtx({
+      env: { EMAIL_PROVIDER: 'smtp', SMTP_HOST: 'localhost', SMTP_PORT: '19999', EMAIL_FROM: 'Beech <test@beech.local>' },
+    })
 
     await expect(
       executeAction(
@@ -192,12 +178,13 @@ describe('send_mail executor', () => {
         },
         ctx,
       ),
-    ).rejects.toThrow('provider error')
+    ).rejects.toThrow()
 
     expect(errSpy).toHaveBeenCalledWith(
       expect.stringContaining('failed to send automation email'),
       expect.any(Error),
     )
+    errSpy.mockRestore()
   })
 })
 

package/src/features/automations/__tests__/automation-runner.test.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 import { AutomationRunner } from '../automation-runner'
 import type { AutomationRunnerDeps } from '../automation-runner'

package/src/features/automations/__tests__/automation-runner.utils.test.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect } from 'vitest'
 import { interpolate } from '../automation-runner.utils'
 import { resolveAutomationContext } from '../context-resolver'

package/src/features/automations/__tests__/automations.handler.test.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 import { Hono } from 'hono'
 import type { IAutomationRepository, Automation } from '@beechcms/core'
@@ -10,7 +14,7 @@ const baseAutomation: Automation = {
   enabled: true,
   triggers: [{ event: 'create' }],
   trigger_conditions: null,
-  actions: [{ type: 'webhook', url: 'https://example.com' }],
+  actions: [{ type: 'webhook', url: 'https://example.com', body_template: '{}' }],
   created_at: 1000,
   updated_at: 1000,
 }
@@ -99,7 +103,7 @@ describe('POST /', () => {
             { kind: 'predicate', left: { kind: 'ref', key: 'this.status' }, op: 'eq', right: { kind: 'literal', value: 'draft' } },
           ],
         },
-        actions: [{ type: 'webhook', url: 'https://example.com' }],
+        actions: [{ type: 'webhook', url: 'https://example.com', body_template: '{}' }],
       }),
     })
     expect(res.status).toBe(201)
@@ -116,7 +120,7 @@ describe('POST /', () => {
         seed_slug: 'posts',
         name: 'test-create-automation',
         triggers: [{ event: 'create' }],
-        actions: [{ type: 'webhook', url: 'https://example.com' }],
+        actions: [{ type: 'webhook', url: 'https://example.com', body_template: '{}' }],
       }),
     })
     expect(res.status).toBe(201)

package/src/features/automations/__tests__/automations.repository.test.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect, vi } from 'vitest'
 import { D1AutomationRepository } from '../../../shared/automations.repository.d1'
 

package/src/features/automations/__tests__/automations.schema.test.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect } from 'vitest'
 import {
   createAutomationSchema,
@@ -5,7 +9,7 @@ import {
   toggleAutomationSchema,
 } from '../automations.schema'
 
-const validWebhookAction = { type: 'webhook' as const, url: 'https://example.com/hook' }
+const validWebhookAction = { type: 'webhook' as const, url: 'https://example.com/hook', body_template: '{}' }
 
 const minimalValid = {
   seed_slug: 'posts',
@@ -67,11 +71,97 @@ describe('createAutomationSchema', () => {
   it('rejects webhook with non-url', () => {
     const result = createAutomationSchema.safeParse({
       ...minimalValid,
-      actions: [{ type: 'webhook', url: 'not-a-url' }],
+      actions: [{ type: 'webhook', url: 'not-a-url', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('rejects webhook with HTTP url (not HTTPS)', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'http://example.com', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+    const issues = result.error?.issues ?? []
+    expect(issues.some((i) => i.message === 'automations.editor.errors.webhookHttpsRequired')).toBe(true)
+  })
+
+  it('rejects webhook with localhost url', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://localhost/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+    const issues = result.error?.issues ?? []
+    expect(issues.some((i) => i.message === 'automations.editor.errors.webhookPrivateHostBlocked')).toBe(true)
+  })
+
+  it('rejects webhook with 127.0.0.1', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://127.0.0.1/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('rejects webhook with AWS metadata IP (169.254.169.254)', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://169.254.169.254/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('rejects webhook with 10.x.x.x private IP', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://10.0.0.5/x', body_template: '{}' }],
     })
     expect(result.success).toBe(false)
   })
 
+  it('rejects webhook with 192.168.x.x private IP', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://192.168.1.1/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('rejects webhook with 172.16.x.x private IP', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://172.16.0.1/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('accepts webhook with 172.32.x.x (outside private range)', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://172.32.0.1/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(true)
+  })
+
+  it('rejects webhook without body_template', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://example.com/x' }],
+    })
+    expect(result.success).toBe(false)
+    const issues = result.error?.issues ?? []
+    expect(issues.some((i) => i.message === 'automations.editor.errors.bodyRequired')).toBe(true)
+  })
+
+  it('accepts webhook with valid HTTPS public url and body_template', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://example.com/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(true)
+  })
+
   it('rejects send_mail with invalid email', () => {
     const result = createAutomationSchema.safeParse({
       ...minimalValid,

package/src/features/automations/__tests__/context-resolver.test.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect } from 'vitest'
 import type { Automation } from '@beechcms/core'
 import { resolveAutomationContext, deriveEntryContext } from '../context-resolver'

package/src/features/automations/__tests__/cron-runner.test.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 import type { Automation, IAutomationRepository, ContentRepository, Seed, IIdGenerator } from '@beechcms/core'
 import { runCronAutomations } from '../cron-runner'
@@ -18,13 +22,13 @@ const SEED: Seed = {
   label: 'Post',
   displayNameAlias: 'title',
   branches: [
-    { alias: 'title', type: 'text', label: 'Title' },
-    { alias: 'count', type: 'number', label: 'Count' },
-    { alias: 'published', type: 'boolean', label: 'Published' },
-    { alias: 'publish_date', type: 'date', label: 'Publish Date' },
-    { alias: 'tags_list', type: 'tags', label: 'Tags' },
-    { alias: 'meta_json', type: 'json', label: 'Meta JSON' },
-    { alias: 'body_rich', type: 'richtext', label: 'Body' },
+    { id: 'br_01', alias: 'title', type: 'text', label: 'Title' },
+    { id: 'br_02', alias: 'count', type: 'number', label: 'Count' },
+    { id: 'br_03', alias: 'published', type: 'boolean', label: 'Published' },
+    { id: 'br_04', alias: 'publish_date', type: 'date', label: 'Publish Date' },
+    { id: 'br_05', alias: 'tags_list', type: 'tags', label: 'Tags' },
+    { id: 'br_06', alias: 'meta_json', type: 'json', label: 'Meta JSON' },
+    { id: 'br_07', alias: 'body_rich', type: 'richtext', label: 'Body' },
   ],
 }
 

package/src/features/automations/__tests__/cron-runner.utils.test.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect } from 'vitest'
 import { cronMatches } from '../cron-runner.utils'
 

package/src/features/automations/__tests__/set-variable.executor.test.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect, vi } from 'vitest'
 import { executeSetVariable } from '../action-executors/set-variable.executor'
 import { resolveAutomationContext } from '../context-resolver'
@@ -304,3 +308,76 @@ describe('collection mode', () => {
     expect(result._items).toEqual(items)
   })
 })
+
+// ── Sprint 07: backward-compatibility with legacy load_type field ──────────────
+
+describe('legacy load_type backward compatibility', () => {
+  it('L1 — load_type: fruit + single id-eq filter → upgraded to fixed_id path', async () => {
+    const item = { id: 'c_1', name: 'Mario', email: 'mario@x.com', total: 99 }
+    const findMany = vi.fn().mockResolvedValue({ items: [item] })
+    const ctx = await makeCtx({ repository: { findMany } as unknown as ContentRepository })
+
+    await executeSetVariable(
+      {
+        type: 'set_variable',
+        name: 'cliente',
+        seed_slug: 'clienti',
+        load_type: 'fruit',
+        filters: [{ field: 'id', op: 'eq', value: 'c_1' }],
+      } as any,
+      ctx,
+    )
+
+    // Should use fixed_id path: pagination.limit = 1, filter on id column
+    const [, opts] = findMany.mock.calls[0]
+    expect(opts.filters[0].column).toBe('id')
+    expect(opts.filters[0].conditions[0].value).toBe('c_1')
+    expect(opts.pagination.limit).toBe(1)
+    expect(ctx.variables.cliente).toEqual(item)
+  })
+
+  it('L2 — load_type: fruit + non-id filter → collection path (degraded)', async () => {
+    const items = [{ id: '1', name: 'Mario', email: 'mario@x.com', total: 10, created_at: 1 }]
+    const findMany = vi.fn().mockResolvedValue({ items })
+    const ctx = await makeCtx({ repository: { findMany } as unknown as ContentRepository })
+
+    await executeSetVariable(
+      {
+        type: 'set_variable',
+        name: 'clienti',
+        seed_slug: 'clienti',
+        load_type: 'fruit',
+        filters: [{ field: 'name', op: 'eq', value: 'Mario' }],
+      } as any,
+      ctx,
+    )
+
+    // Non-id filter: falls through to collection path
+    const result = ctx.variables.clienti as any
+    expect(result.count).toBe(1)
+  })
+
+  it('L3 — load_type: branch → collection path', async () => {
+    const items = [
+      { id: '1', name: 'A', email: 'a@x.com', total: 10, created_at: 1 },
+      { id: '2', name: 'B', email: 'b@x.com', total: 20, created_at: 2 },
+    ]
+    const findMany = vi.fn().mockResolvedValue({ items })
+    const ctx = await makeCtx({ repository: { findMany } as unknown as ContentRepository })
+
+    await executeSetVariable(
+      {
+        type: 'set_variable',
+        name: 'ordini',
+        seed_slug: 'clienti',
+        load_type: 'branch',
+      } as any,
+      ctx,
+    )
+
+    const result = ctx.variables.ordini as any
+    expect(result.count).toBe(2)
+    expect(result.sum).toBeDefined()
+    expect(result.pluck).toBeDefined()
+  })
+})