@beechcms/api 0.5.0 → 0.6.0-preview.1

package/assets/dashboard/working.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="800" height="673.818" viewBox="0 0 800 673.818" xmlns:xlink="http://www.w3.org/1999/xlink" role="img" artist="Katerina Limpitsouni" source="https://undraw.co/"><g transform="translate(-826.017 -264.531)"><g transform="matrix(0.946, -0.326, 0.326, 0.946, 826.017, 424.075)"><path d="M114.77,145.533H13.015A13.03,13.03,0,0,1,0,132.514V13.015A13.03,13.03,0,0,1,13.015,0h94.666l20.1,16.024v116.49A13.03,13.03,0,0,1,114.77,145.533Z" transform="translate(0 0)" fill="#e6e6e6"/><path d="M9.269,0A9.284,9.284,0,0,0,0,9.269v119.5a9.284,9.284,0,0,0,9.269,9.269H111.023a9.284,9.284,0,0,0,9.269-9.269V14.082L102.624,0Z" transform="translate(3.746 3.746)" fill="#fff"/><path d="M48.495,4.335H2.168A2.168,2.168,0,1,1,2.168,0H48.495a2.168,2.168,0,0,1,0,4.335Z" transform="translate(46.483 34.16)" fill="#FF6584"/><path d="M57.435,4.335H2.168A2.168,2.168,0,1,1,2.168,0H57.435a2.168,2.168,0,1,1,0,4.335Z" transform="translate(46.483 41.475)" fill="#FF6584"/><path d="M48.493,0H2.167a2.167,2.167,0,0,0,0,4.334H48.493a2.167,2.167,0,1,0,0-4.334Z" transform="translate(46.486 66.94)" fill="#ccc"/><path d="M57.434,0H2.167a2.167,2.167,0,0,0,0,4.334H57.434a2.167,2.167,0,1,0,0-4.334Z" transform="translate(46.486 74.257)" fill="#ccc"/><path d="M48.494,4.334H2.167A2.167,2.167,0,0,1,2.167,0H48.494a2.168,2.168,0,1,1,0,4.335Z" transform="translate(46.483 99.722)" fill="#ccc"/><path d="M57.435,4.335H2.168A2.168,2.168,0,1,1,2.168,0H57.435a2.168,2.168,0,1,1,0,4.335Z" transform="translate(46.483 107.037)" fill="#ccc"/><circle cx="7.661" cy="7.661" r="7.661" transform="translate(21.698 32.325)" fill="#FF6584"/><path d="M15.32,7.661a7.661,7.661,0,0,1-7.66,7.663,1.645,1.645,0,0,1-.2-.007,7.66,7.66,0,1,1,7.856-7.655Z" transform="translate(22.486 65.103)" fill="#FF6584"/><circle cx="7.661" cy="7.661" r="7.661" transform="translate(21.698 97.887)" fill="#FF6584"/><path d="M20.083,16.235H4.334A4.335,4.335,0,0,1,0,11.9V.269A.271.271,0,0,1,.439.058L20.251,15.752a.271.271,0,0,1-.168.483Z" transform="translate(107.31 0.305)" fill="#e6e6e6"/></g><circle cx="1.547" cy="1.547" r="1.547" transform="translate(991.127 861.128)" opacity="0.2"/><g transform="matrix(0.998, 0.07, -0.07, 0.998, 1403.442, 449.522)"><rect width="223.119" height="45.534" rx="16" fill="#e6e6e6"/><path d="M0,22.773V.006H8.061a8.379,8.379,0,0,1,3.931.817A5.449,5.449,0,0,1,14.3,3.008a6.165,6.165,0,0,1,.756,3.033,5.036,5.036,0,0,1-.519,2.422,4.2,4.2,0,0,1-1.366,1.521,6.345,6.345,0,0,1-1.84.84v.214a4.44,4.44,0,0,1,2.13.733,5.359,5.359,0,0,1,1.771,1.91,5.993,5.993,0,0,1,.71,3.026,6.107,6.107,0,0,1-.787,3.086,5.417,5.417,0,0,1-2.466,2.178,10.177,10.177,0,0,1-4.366.8Zm2.9-2.567H8.244a5.564,5.564,0,0,0,3.778-1.025,3.263,3.263,0,0,0,1.122-2.5,4.009,4.009,0,0,0-.581-2.108,4.249,4.249,0,0,0-1.646-1.545,5.188,5.188,0,0,0-2.526-.581H2.9ZM2.9,10H7.909a4.641,4.641,0,0,0,3.1-1.07A3.516,3.516,0,0,0,12.275,6.1a3.4,3.4,0,0,0-1.03-2.5A4.451,4.451,0,0,0,8,2.574H2.9Z" transform="translate(27.321 11.378)" fill="#090814"/><g transform="translate(86.515 11.333)"><path d="M1.29,10.6a1.275,1.275,0,0,1-.911-.388,1.347,1.347,0,0,1,0-1.874L8.144.388a1.273,1.273,0,0,1,1.83,0,1.347,1.347,0,0,1,0,1.874L2.205,10.21a1.275,1.275,0,0,1-.915.388Z" transform="translate(6.475 6.136)"/><path d="M10.353,15.412a1.278,1.278,0,0,1-.978-.455A1.347,1.347,0,0,1,9.5,13.087l.655-.583C12.3,10.278,13.3,5.638,11.422,3.716s-6.407-.9-8.583,1.292l-.569.672a1.274,1.274,0,0,1-1.821.137A1.347,1.347,0,0,1,.315,3.948l.6-.717q.031-.036.064-.071A11.089,11.089,0,0,1,6.907.192,6.98,6.98,0,0,1,13.253,1.84a7.386,7.386,0,0,1,1.61,6.5,11.558,11.558,0,0,1-2.905,6.069q-.032.033-.066.064l-.691.615A1.272,1.272,0,0,1,10.353,15.412Z" transform="translate(7.765 0)"/><path d="M7.015,15.355a6.455,6.455,0,0,1-4.72-1.785A8.057,8.057,0,0,1,0,7.945C0,5.6,2.337,2.262,3.588,1L3.643.943,4.326.33A1.274,1.274,0,0,1,6.147.444a1.347,1.347,0,0,1-.114,1.87l-.65.587c-1.228,1.252-2.8,3.91-2.8,5.042a5.359,5.359,0,0,0,1.527,3.742c1.884,1.907,6.42.911,8.63-1.258L13.2,9.8a1.275,1.275,0,0,1,1.811-.273,1.346,1.346,0,0,1,.263,1.851l-.513.707a1.317,1.317,0,0,1-.129.151,11.217,11.217,0,0,1-5.96,2.968,10.1,10.1,0,0,1-1.656.147Z" transform="translate(0 7.463)"/></g><rect width="2.277" height="45.534" transform="translate(122.943 0)" fill="#fff"/><path d="M0,22.775,2.786,6.235H5.495L2.71,22.775ZM4.608,3.528a1.582,1.582,0,0,1-1.235-.521,1.417,1.417,0,0,1-.342-1.243A1.961,1.961,0,0,1,3.8.512,2.237,2.237,0,0,1,5.215,0a1.611,1.611,0,0,1,1.252.51,1.42,1.42,0,0,1,.342,1.252,1.982,1.982,0,0,1-.771,1.243A2.237,2.237,0,0,1,4.608,3.528Z" transform="translate(61.471 11.376)"/><g transform="translate(138.88 11.384)"><path d="M2.277,0A2.277,2.277,0,1,1,0,2.277,2.277,2.277,0,0,1,2.277,0Z" transform="translate(11.384 4.553)" fill="#090814"/><path d="M4.553,0h13.66a4.553,4.553,0,0,1,4.553,4.553v13.66a4.553,4.553,0,0,1-4.553,4.553H4.553A4.553,4.553,0,0,1,0,18.214V4.553A4.553,4.553,0,0,1,4.553,0Zm13.66,20.491a2.277,2.277,0,0,0,2.277-2.277V4.553a2.277,2.277,0,0,0-2.277-2.277H4.553A2.277,2.277,0,0,0,2.277,4.553v13.66a2.277,2.277,0,0,0,2.277,2.277Z" transform="translate(0 0)"/><path d="M15.937,8.728a1.138,1.138,0,0,1-.8-.333L9.448,2.71a1.165,1.165,0,0,0-1.821,0L1.943,8.394a1.138,1.138,0,1,1-1.61-1.61L6.025,1.093l.016-.015a3.431,3.431,0,0,1,4.994,0l.016.015,5.692,5.692a1.138,1.138,0,0,1-.806,1.943Z" transform="translate(0 8.348)"/><path d="M9.107,6.451a1.138,1.138,0,0,1-.8-.333L4.895,2.71a1.165,1.165,0,0,0-1.821,0l-1.13,1.13a1.138,1.138,0,1,1-1.61-1.61L1.472,1.093l.016-.015a3.431,3.431,0,0,1,4.994,0l.016.015L9.913,4.508a1.138,1.138,0,0,1-.806,1.943Z" transform="translate(12.522 10.624)"/></g><g transform="translate(179.86 11.387)"><path d="M3.131,22.763A3.193,3.193,0,0,1,0,19.511V9.754C0,4.664,2.584,1.309,7.447.045a1.562,1.562,0,0,1,1.9,1.183A1.631,1.631,0,0,1,8.207,3.2c-3.486.911-5.076,2.971-5.076,6.554V11.38h4.7a3.187,3.187,0,0,1,3.123,3.009l.008.244v4.879a3.193,3.193,0,0,1-3.13,3.252Z" transform="translate(14.087 0)"/><path d="M3.131,22.762A3.193,3.193,0,0,1,0,19.51V9.753C0,4.664,2.584,1.309,7.447.045a1.562,1.562,0,0,1,1.9,1.183A1.631,1.631,0,0,1,8.207,3.2c-3.486.911-5.076,2.971-5.076,6.554v1.624h4.7a3.187,3.187,0,0,1,3.123,3.009l.008.244V19.51a3.193,3.193,0,0,1-3.13,3.252Z" transform="translate(0 0.001)"/></g></g><path d="M843.21,705.353H432.577A28.17,28.17,0,0,0,404.44,733.49a27.852,27.852,0,0,0,2.03,10.467,28.139,28.139,0,0,0,26.107,17.679H843.21A28.139,28.139,0,0,0,867.493,747.7a27.17,27.17,0,0,0,1.834-3.742,27.856,27.856,0,0,0,2.03-10.467,28.178,28.178,0,0,0-28.146-28.137Z" transform="translate(576.882 171.013)" fill="#d6d6e3"/><rect width="59.815" height="70.309" transform="translate(1186.541 620.026)" fill="#ed9da0"/><path d="M422.732,358.755h6.253a11.464,11.464,0,0,1,11.461,11.464H411.268a11.464,11.464,0,0,1,11.464-11.464Z" transform="translate(784.75 215.89)" fill="#ccc"/><path d="M64.587,0c27.538,0,60.456,41.809,60.456,41.809s4.131,14.646,4.131,22.779A64.587,64.587,0,1,1,64.587,0Z" transform="translate(1152.034 510.51)" fill="#ed9da0"/><path d="M461.292,766.982H818.543c-2.391-27.251-3.948-131.421-3.948-138.276,0-30.239-24.743-63.238-24.743-63.238l-8.856-4.895L707.032,537.5l-19.141-24.865a21.287,21.287,0,0,0-17.047-8.324l-60.464.455a21.349,21.349,0,0,0-14.343,5.683L558.595,545.18,503.682,571.4l-.093-.093-.569.427-8.15,5.87-5.236,3.788s-13.762,16.5-24.754,65.986C463.226,654.823,462.066,751.175,461.292,766.982Z" transform="translate(579.69 161.084)" fill="#f2f2f2"/><path d="M905.823,742.141c-.86.785-1.73,1.562-2.6,2.338q-4.939,4.392-10.018,8.633-7.675,6.4-15.668,12.408H396.608q-14.685-11.028-28.3-23.385Z" transform="translate(575.098 172.829)" fill="#d6d6e3"/><path d="M523.094,689.248H346.3l3.741-17.772H519.349Z" transform="translate(781.541 231.335)" fill="#090814"/><path d="M867.982,674.4h-46a7.106,7.106,0,0,0-5.454,2.526,10.3,10.3,0,0,0-1.945-.187,10.911,10.911,0,1,0,0,21.822,10.783,10.783,0,0,0,4.749-1.1l.77,9.427,3.05,37.266a6.81,6.81,0,0,0,.579,1.338,7.172,7.172,0,0,0,6.3,3.742H859.94a7.2,7.2,0,0,0,6.3-3.742,7.389,7.389,0,0,0,.569-1.338l8.045-60.447a7.193,7.193,0,0,0-6.876-9.307Zm-53.4,21.047a7.8,7.8,0,0,1,0-15.6c.14,0,.271.038.412.047a7.141,7.141,0,0,0,.114,3.807l3.292,10.7a7.671,7.671,0,0,1-3.817,1.038Z" transform="translate(596.598 169.485)" fill="#FF6584"/><path d="M789.056,485.931H489.161a9.73,9.73,0,0,0-9.72,9.72V698.02a9.73,9.73,0,0,0,9.72,9.72H789.056a9.73,9.73,0,0,0,9.72-9.72V495.651A9.73,9.73,0,0,0,789.056,485.931Z" transform="translate(574.701 153.388)" fill="#3f3d56"/><path d="M661.816,635.978H593.691a3.635,3.635,0,0,0-3.629,3.643V747.239h75.394V639.616a3.637,3.637,0,0,0-3.643-3.643Zm-33.833,61.147a8.082,8.082,0,0,1-8.045-8.045V676.672a8.045,8.045,0,1,1,16.089,0V689.08a8.082,8.082,0,0,1-8.045,8.045Z" transform="translate(586.049 167.586)" fill="#090814"/><path d="M589.839,738.717V749.1a2.034,2.034,0,0,0,2.03,2.03h71.806a2.04,2.04,0,0,0,2.03-2.03V738.717Z" transform="translate(586.038 172.661)" fill="#3f3d56"/><circle cx="4.598" cy="4.598" r="4.598" transform="translate(1349.885 840.806)" fill="#2f2e41"/><path d="M523.543,669.493a1.609,1.609,0,0,0-1.609,1.609v8.278a1.609,1.609,0,0,0,3.218,0V671.1a1.609,1.609,0,0,0-1.609-1.609Z" transform="translate(582.685 169.242)" fill="#2f2e41"/><path d="M531.868,669.493a1.609,1.609,0,0,0-1.609,1.609v8.278a1.609,1.609,0,0,0,3.218,0V671.1a1.608,1.608,0,0,0-1.608-1.609Z" transform="translate(583.095 169.242)" fill="#2f2e41"/><path d="M540.2,669.493a1.609,1.609,0,0,0-1.609,1.609v8.278a1.609,1.609,0,0,0,3.218,0V671.1a1.609,1.609,0,0,0-1.61-1.609Z" transform="translate(583.508 169.242)" fill="#2f2e41"/><path d="M548.519,669.493a1.609,1.609,0,0,0-1.609,1.609v8.278a1.609,1.609,0,0,0,3.218,0V671.1a1.609,1.609,0,0,0-1.609-1.609Z" transform="translate(583.918 169.242)" fill="#2f2e41"/><path d="M24.32,0C37.751,0,53.8,20.726,53.8,34.158S37.751,48.64,24.32,48.64A24.32,24.32,0,0,1,24.32,0Z" transform="translate(1115.087 867.265)" fill="#ed9da0"/><path d="M25.434,0a24.32,24.32,0,1,1,0,48.64C12,48.64-8.048,37.751-8.048,24.32S12,0,25.434,0Z" transform="translate(1283.879 871.942)" fill="#ed9da0"/><path d="M974.16,446.985l1.3-7-17.507-3.249s-24.762-22.707-53.171-6.247S863.917,455.5,863.917,455.5l-13.1,12.056,9.854,5.451-12.454,8.554,10.5,1.95-8.953,9.2,14.752,29.9s2.755-26.654,23.763-22.755S939,480.3,939,480.3l45.373,48.265s.38-21.56,12.644-19.334C997.015,509.232,1012.025,457.635,974.16,446.985Z" transform="translate(284.224 63.235)" fill="#090814"/><g transform="translate(1130.828 265.531)"><path d="M220.083,139.917H3.6a2.608,2.608,0,0,1-2.6-2.6V3.6A2.608,2.608,0,0,1,3.6,1H220.083a2.608,2.608,0,0,1,2.6,2.6V137.312A2.608,2.608,0,0,1,220.083,139.917Z" transform="translate(-1 -1)" fill="#fff"/><path d="M220.083,139.917H3.6a2.608,2.608,0,0,1-2.6-2.6V3.6A2.608,2.608,0,0,1,3.6,1H220.083a2.608,2.608,0,0,1,2.6,2.6V137.312A2.608,2.608,0,0,1,220.083,139.917Z" transform="translate(-1 -1)" fill="none" stroke="#d7d7d7" stroke-miterlimit="10" stroke-width="2"/><path d="M154.417,132.04H20.131a2.442,2.442,0,0,1-2.6-2.231V56.941a2.442,2.442,0,0,1,2.6-2.231H154.417a2.442,2.442,0,0,1,2.6,2.231V129.81a2.442,2.442,0,0,1-2.6,2.231Z" transform="translate(-11.415 -38.09)" fill="#FF6584"/><g transform="translate(4.382 5.21)"><path d="M29.971,25.959h-9.84a2.608,2.608,0,0,1-2.6-2.6V22.2a2.608,2.608,0,0,1,2.6-2.6h9.84a2.608,2.608,0,0,1,2.6,2.6v1.158a2.608,2.608,0,0,1-2.6,2.6Z" transform="translate(-17.278 -19.592)" fill="#e6e6e6"/><path d="M662.185,25.959H656.4a2.608,2.608,0,0,1-2.6-2.6V22.2a2.608,2.608,0,0,1,2.6-2.6h5.788a2.608,2.608,0,0,1,2.6,2.6v1.158a2.608,2.608,0,0,1-2.6,2.6Z" transform="translate(-475.267 -19.592)" fill="#e6e6e6"/><path d="M342.355,412.772H280.422a2.607,2.607,0,0,1-2.6-2.6V389.909a2.607,2.607,0,0,1,2.6-2.6h61.934a2.607,2.607,0,0,1,2.6,2.6v20.259A2.608,2.608,0,0,1,342.355,412.772Z" transform="translate(-204.637 -284.275)" fill="#e6e6e6"/><path d="M81.177,412.266H19.243a2.608,2.608,0,0,1-2.6-2.6V389.4a2.608,2.608,0,0,1,2.6-2.6H81.177a2.608,2.608,0,0,1,2.6,2.6v20.259a2.608,2.608,0,0,1-2.6,2.6Z" transform="translate(-16.639 -283.91)" fill="#e6e6e6"/><path d="M600.58,387.3a2.608,2.608,0,0,1,2.6,2.6v20.259a2.608,2.608,0,0,1-2.6,2.6H538.647a2.607,2.607,0,0,1-2.6-2.6V389.909a2.607,2.607,0,0,1,2.6-2.6" transform="translate(-390.509 -284.275)" fill="#e6e6e6"/><g transform="translate(146.69 39.555)"><path d="M541.62,166.264a1.449,1.449,0,0,0-1.447,1.447v1.158a1.449,1.449,0,0,0,1.447,1.447h33.572a1.449,1.449,0,0,0,1.447-1.447v-1.158a1.449,1.449,0,0,0-1.447-1.447Z" transform="translate(-540.174 -166.264)" fill="#e6e6e6"/><path d="M541.62,199.317a1.447,1.447,0,0,0,0,2.894h51.515a1.447,1.447,0,0,0,0-2.894Z" transform="translate(-540.174 -190.056)" fill="#e6e6e6"/><path d="M541.62,228.238a1.447,1.447,0,0,0,0,2.894h51.515a1.447,1.447,0,0,0,0-2.894Z" transform="translate(-540.174 -210.873)" fill="#e6e6e6"/></g><path d="M703.5,25.959h-5.788a2.608,2.608,0,0,1-2.6-2.6V22.2a2.608,2.608,0,0,1,2.6-2.6H703.5a2.607,2.607,0,0,1,2.6,2.6v1.158A2.607,2.607,0,0,1,703.5,25.959Z" transform="translate(-505.007 -19.592)" fill="#e6e6e6"/><path d="M744.817,25.959h-5.788a2.608,2.608,0,0,1-2.6-2.6V22.2a2.608,2.608,0,0,1,2.6-2.6h5.788a2.608,2.608,0,0,1,2.6,2.6v1.158a2.608,2.608,0,0,1-2.6,2.6Z" transform="translate(-534.746 -19.592)" fill="#e6e6e6"/></g></g></g></svg>

package/migrations/0000_v040_base.sql

@@ -30,6 +30,7 @@ CREATE TABLE IF NOT EXISTS users (
     password_hash       TEXT    NOT NULL,
     role                TEXT    NOT NULL DEFAULT 'editor' CHECK (role IN ('admin', 'editor')),
     name                TEXT,
+    surname             TEXT,
     avatar_url          TEXT,
     notification_prefs  TEXT    NOT NULL DEFAULT '{}',
     created_at          INTEGER NOT NULL DEFAULT (unixepoch())
@@ -236,3 +237,29 @@ CREATE TABLE IF NOT EXISTS automations (
 
 CREATE INDEX IF NOT EXISTS idx_automations_seed_slug ON automations(seed_slug);
 CREATE INDEX IF NOT EXISTS idx_automations_enabled   ON automations(enabled);
+
+
+-- =============================================================================
+-- 12. SITE SETTINGS
+--     Key-value store for site-level configuration (title, locale, timezone…).
+-- =============================================================================
+
+CREATE TABLE IF NOT EXISTS site_settings (
+    key   TEXT NOT NULL PRIMARY KEY,
+    value TEXT NOT NULL
+);
+
+
+-- =============================================================================
+-- 13. SEED LAYOUTS
+--     Persists per-Seed custom editor form layouts (sprint 04a).
+--     layout column stores a FormLayout JSON blob.
+--     Reset = DELETE the row; client recomputes the generated default.
+-- =============================================================================
+
+CREATE TABLE IF NOT EXISTS seed_layouts (
+    slug       TEXT    NOT NULL PRIMARY KEY,
+    layout     TEXT    NOT NULL,           -- JSON of FormLayout
+    updated_at INTEGER NOT NULL DEFAULT (unixepoch()),
+    updated_by TEXT    NOT NULL            -- users.id of the writer
+);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beechcms/api",
-  "version": "0.5.0",
+  "version": "0.6.0-preview.1",
   "type": "module",
   "exports": {
     ".": "./src/factory.ts"
@@ -15,8 +15,8 @@
   "scripts": {
     "dev": "wrangler dev --port 8789",
     "build": "tsc -p tsconfig.build.json --noEmit",
-    "db:migrate:local": "wrangler d1 execute beech-db --local --file=./migrations/0000_v040_base.sql && wrangler d1 execute beech-db --local --file=./migrations/0029_automations.sql && wrangler d1 execute beech-db --local --file=./migrations/0030_test_seeds.sql",
-    "db:reset:local": "node -e \"require('fs').rmSync('.wrangler/state', {recursive:true,force:true})\" && npm run db:migrate:local && cd ../.. && node bin/cli.mjs seed:load --local && cd apps/api && wrangler d1 execute beech-db --local --file=./migrations/0028_v040_seed_data.sql",
+    "db:migrate:local": "node ./scripts/bootstrap-d1.mjs",
+    "db:reset:local": "node -e \"require('fs').rmSync('.wrangler/state', {recursive:true,force:true})\" && node ./scripts/bootstrap-d1.mjs",
     "deploy": "wrangler deploy --minify",
     "cf-typegen": "wrangler types --env-interface CloudflareBindings",
     "test": "vitest run",
@@ -24,16 +24,20 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.995.0",
-    "@beechcms/core": "^0.5.0",
+    "@aws-sdk/s3-request-presigner": "^3.995.0",
+    "@beechcms/core": "^0.6.0-preview.1",
+    "@upstash/qstash": "^2.11.0",
     "bcryptjs": "^2.4.3",
-    "hono": "^4.11.9",
+    "hono": "^4.12.21",
     "jose": "^6.1.3"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20260213.0",
     "@types/bcryptjs": "^2.4.6",
-    "@vitest/coverage-v8": "^3.2.4",
-    "vitest": "^3.2.4",
-    "wrangler": "^4.4.0"
-  }
+    "@vitest/coverage-v8": "^4.1.0",
+    "vitest": "^4.1.0",
+    "wrangler": "^4.98.0"
+  },
+  "license": "BUSL-1.1",
+  "licenseFile": "../../LICENSE"
 }

package/src/auth/{in-memory-hash-provider.ts → __fixtures__/in-memory-hash-provider.ts}

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import type { IHashProvider } from '@beechcms/core'
 
 const HASH_PREFIX = 'HASH:'

package/src/auth/{static-token-service.ts → __fixtures__/static-token-service.ts}

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import type { ITokenService, IssueTokenOptions, JwtClaims } from '@beechcms/core'
 
 const TEST_TOKEN_PREFIX = 'test:'

package/src/auth/bcrypt-hash-provider.ts

@@ -1,12 +1,16 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import bcrypt from 'bcryptjs'
 import type { IHashProvider } from '@beechcms/core'
 
-const DEFAULT_BCRYPT_ROUNDS = 10
+export const BCRYPT_SALT_ROUNDS = 10
 
 export class BcryptHashProvider implements IHashProvider {
   private readonly saltRounds: number
 
-  constructor(saltRounds: number = DEFAULT_BCRYPT_ROUNDS) {
+  constructor(saltRounds: number = BCRYPT_SALT_ROUNDS) {
     this.saltRounds = saltRounds
   }
 

package/src/auth/constants.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 /** API auth error messages - used by handlers and tests */
 export const AUTH_ERRORS = {
   INVALID_REQUEST: 'Invalid request',

package/src/auth/generate-refresh-token.test.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect } from 'vitest'
 import { generateRefreshToken } from './refresh'
 
@@ -6,10 +10,10 @@ describe('generateRefreshToken', () => {
     expect(generateRefreshToken().length).toBeGreaterThan(0)
   })
 
-  it('returns a UUID-shaped value (8-4-4-4-12 hex groups)', () => {
-    expect(generateRefreshToken()).toMatch(
-      /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
-    )
+  it('returns a 64-character hex string (256-bit / 32 bytes of entropy)', () => {
+    const token = generateRefreshToken()
+    expect(token).toHaveLength(64)
+    expect(token).toMatch(/^[0-9a-f]+$/)
   })
 
   it('returns a different token on every call', () => {

package/src/auth/hash-provider.test.ts

@@ -1,6 +1,11 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect } from 'vitest'
-import { InMemoryHashProvider } from './in-memory-hash-provider'
-import { BcryptHashProvider } from './bcrypt-hash-provider'
+import { InMemoryHashProvider } from './__fixtures__/in-memory-hash-provider'
+import { BcryptHashProvider, BCRYPT_SALT_ROUNDS } from './bcrypt-hash-provider'
+import { DUMMY_PASSWORD_HASH } from './login'
 
 describe('InMemoryHashProvider', () => {
   const provider = new InMemoryHashProvider()
@@ -39,8 +44,12 @@ describe('BcryptHashProvider', () => {
   })
 
   it('verify returns false against the DUMMY_PASSWORD_HASH for any plaintext', async () => {
-    // The dummy hash is used for timing-attack mitigation; it must not match real passwords.
-    const dummyHash = '$2a$10$SbkRFOafACxVM2ahxerVDu3tSkCXWm29b62WdB.4WGG02Qjsfzni6'
-    expect(await provider.verify('password123', dummyHash)).toBe(false)
+    expect(await provider.verify('password123', DUMMY_PASSWORD_HASH)).toBe(false)
+  })
+
+  it('DUMMY_PASSWORD_HASH bcrypt cost matches BCRYPT_SALT_ROUNDS — timing oracle invariant', () => {
+    const match = DUMMY_PASSWORD_HASH.match(/^\$2[aby]\$(\d+)\$/)
+    expect(match).not.toBeNull()
+    expect(Number(match![1])).toBe(BCRYPT_SALT_ROUNDS)
   })
 })

package/src/auth/jose-token-service.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { SignJWT, jwtVerify } from 'jose'
 import type { ITokenService, IssueTokenOptions, JwtClaims, IClock } from '@beechcms/core'
 
@@ -17,6 +21,9 @@ export class JoseTokenService implements ITokenService {
 
   constructor(secret: string, config: JoseTokenServiceConfig, clock: IClock) {
     this.secretBytes = new TextEncoder().encode(secret)
+    if (this.secretBytes.length < 32) {
+      throw new Error('JWT secret must be at least 32 bytes (256-bit)')
+    }
     this.config = config
     this.clock = clock
   }

package/src/auth/jwt-claims-passthrough.test.ts

@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+/**
+ * Sprint 04-pre Part B5 — JWT claims pass-through test.
+ *
+ * Verifies that `role` and `surname` claims issued in a JWT token are
+ * preserved end-to-end through the authMiddleware and available on
+ * `context.get('jwtPayload')`. Without the JwtClaims unification these
+ * fields would be type-erased and come back undefined.
+ */
+
+import { describe, it, expect } from 'vitest'
+import { Hono } from 'hono'
+import { SystemClock } from '@beechcms/core'
+import type { JwtClaims } from '@beechcms/core'
+import { JoseTokenService } from './jose-token-service'
+import { authMiddleware } from '../middleware'
+import type { Env, Variables } from '../types'
+
+const TEST_SECRET = 'super-secret-key-used-only-in-the-vitest-suite-min-length'
+
+describe('JWT claims pass-through (sprint 04-pre)', () => {
+  const tokenService = new JoseTokenService(TEST_SECRET, {}, SystemClock)
+
+  async function buildApp() {
+    const app = new Hono<{ Bindings: Env; Variables: Variables }>()
+
+    app.use('*', async (c, next) => {
+      c.set('tokenService', tokenService)
+      await next()
+    })
+
+    app.use('/protected', authMiddleware())
+
+    app.get('/protected', (c) => {
+      const payload = c.get('jwtPayload')
+      return c.json(payload)
+    })
+
+    return app
+  }
+
+  it('role and surname claims survive the authMiddleware round-trip', async () => {
+    const app = await buildApp()
+
+    const claims: JwtClaims = {
+      sub: 'user-123',
+      email: 'admin@example.com',
+      name: 'Admin',
+      surname: 'User',
+      role: 'admin',
+    }
+
+    const token = await tokenService.issue(claims)
+
+    const res = await app.request('/protected', {
+      method: 'GET',
+      headers: { Authorization: `Bearer ${token}` },
+    })
+
+    expect(res.status).toBe(200)
+    const body = await res.json<JwtClaims>()
+    expect(body.sub).toBe('user-123')
+    expect(body.role).toBe('admin')
+    expect(body.surname).toBe('User')
+    expect(body.email).toBe('admin@example.com')
+  })
+
+  it('a token without role/surname returns undefined for those fields', async () => {
+    const app = await buildApp()
+
+    const token = await tokenService.issue({ sub: 'user-456', email: 'plain@example.com' })
+
+    const res = await app.request('/protected', {
+      method: 'GET',
+      headers: { Authorization: `Bearer ${token}` },
+    })
+
+    expect(res.status).toBe(200)
+    const body = await res.json<JwtClaims>()
+    expect(body.sub).toBe('user-456')
+    expect(body.role).toBeUndefined()
+    expect(body.surname).toBeUndefined()
+  })
+})

package/src/auth/login.test.ts

@@ -1,6 +1,10 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect } from 'vitest'
 import { parseLoginBody, validateLoginInput, verifyPassword, DUMMY_PASSWORD_HASH } from './login'
-import { InMemoryHashProvider } from './in-memory-hash-provider'
+import { InMemoryHashProvider } from './__fixtures__/in-memory-hash-provider'
 
 describe('parseLoginBody', () => {
   it('returns credentials for a valid object body', () => {
@@ -69,6 +73,10 @@ describe('validateLoginInput', () => {
   it('accepts passwords at the upper boundary (exactly 128 characters)', () => {
     expect(validateLoginInput('user@test.com', 'a'.repeat(128))).toBe(true)
   })
+
+  it('rejects a password made only of whitespace', () => {
+    expect(validateLoginInput('user@test.com', ' '.repeat(8))).toBe(false)
+  })
 })
 
 describe('verifyPassword', () => {

package/src/auth/login.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 /// <reference types="@cloudflare/workers-types" />
 import type { IHashProvider } from '@beechcms/core'
 
@@ -53,7 +57,7 @@ export function validateLoginInput(email: string, password: string): boolean {
   return (
     email.length <= MAX_EMAIL_LENGTH &&
     EMAIL_REGEX.test(email) &&
-    password.length >= MIN_PASSWORD_LENGTH &&
+    password.trim().length >= MIN_PASSWORD_LENGTH &&
     password.length <= MAX_PASSWORD_LENGTH
   )
 }

package/src/auth/refresh.ts

@@ -1,5 +1,11 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 /// <reference types="@cloudflare/workers-types" />
 
 export function generateRefreshToken(): string {
-  return crypto.randomUUID()
+  const bytes = new Uint8Array(32)
+  crypto.getRandomValues(bytes)
+  return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('')
 }

package/src/auth/token-service.test.ts

@@ -1,7 +1,11 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect } from 'vitest'
 import { SystemClock } from '@beechcms/core'
 import { JoseTokenService } from './jose-token-service'
-import { StaticTokenService } from './static-token-service'
+import { StaticTokenService } from './__fixtures__/static-token-service'
 
 const TEST_SECRET = 'super-secret-key-used-only-in-the-vitest-suite-min-length'
 
@@ -47,6 +51,10 @@ describe('JoseTokenService', () => {
     const claims = await service.verify(token)
     expect(claims?.sub).toBe('user-1')
   })
+
+  it('throws if the secret is shorter than 32 bytes', () => {
+    expect(() => new JoseTokenService('short-secret', {}, SystemClock)).toThrow('JWT secret must be at least 32 bytes')
+  })
 })
 
 describe('StaticTokenService', () => {

package/src/factory.ts

@@ -1,9 +1,13 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 /// <reference types="@cloudflare/workers-types" />
 import { Hono } from 'hono'
 import { cors } from 'hono/cors'
 import { getCookie, setCookie, deleteCookie } from 'hono/cookie'
 import type { Seed, ContentRepository, IdempotencyRepository, BeechBucket, MediaRepository, SystemStatsRepository } from '@beechcms/core'
-import { sha256hex, SystemClock, SystemIdGenerator, SeedRegistry } from '@beechcms/core'
+import { sha256hex, SystemClock, SystemIdGenerator } from '@beechcms/core'
 import type { Env, Variables } from './types'
 import { getClientIp } from './shared/request-utils'
 
@@ -25,14 +29,20 @@ import { setupApp } from './features/setup'
 import { draftApp } from './features/draft'
 import { settingsApp } from './features/settings/settings.handler'
 import { schemaApp } from './features/schema/schema.handler'
+import { seedsApp } from './features/seeds'
 import { notificationsApp } from './features/notifications'
 import { automationsApp } from './features/automations'
 import { statsApp } from './features/stats'
+import { backrefsApp } from './features/backrefs'
+import { webhooksApp } from './features/webhooks'
 import { uploadRoutes, serveMediaHandler } from './upload'
 import { publicRoutes, apiKeyMiddleware, publicRateLimitMiddleware } from './public'
 import { searchRouter } from "./search"
+import type { ISeedRepository } from '@beechcms/core'
 import { repositoryMiddleware } from './middleware/repository.middleware'
+import { seedRegistryMiddleware } from './middleware/seed-registry.middleware'
 import { storageMiddleware } from './middleware/storage.middleware'
+import { InMemorySeedRepository } from './shared/in-memory-seed.repository'
 import { authProvidersMiddleware } from './middleware/auth-providers.middleware'
 import { rateLimiterMiddleware } from './middleware/rate-limit.middleware'
 import { observabilityMiddleware } from './middleware/observability.middleware'
@@ -44,6 +54,10 @@ export interface BeechConfig {
   bucket?: BeechBucket
   mediaRepository?: MediaRepository
   systemStatsRepository?: SystemStatsRepository
+  // Optional override: inject a custom ISeedRepository (e.g. InMemorySeedRepository for tests).
+  // When omitted and seeds is non-empty, an InMemorySeedRepository is created automatically
+  // for backward compatibility.
+  seedRepository?: ISeedRepository
 }
 
 // --- Costanti e helper ---
@@ -86,32 +100,34 @@ function extractPublicSeed(path: string): string {
 }
 
 /**
- * Builds a fully configured Hono app with the given seeds injected into context.
- * This is the main entry point for a BeechCMS project.
+ * Builds a fully configured Hono app. Seeds are hydrated from D1 at runtime via
+ * seedRegistryMiddleware; config.seeds is retained for back-compat but no longer
+ * drives request handling.
  */
 export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Variables: Variables }> {
+  // Back-compat shim: when callers (e.g. existing tests) pass seeds without a custom
+  // seedRepository, wrap them in an InMemorySeedRepository so the middleware can serve
+  // them without touching D1. Production index.ts passes seeds:[] so D1SeedRepository
+  // is used as the live path.
   const seedsArray = Array.isArray(config.seeds) ? config.seeds : Object.values(config.seeds)
-  // Filter out any invalid objects that might have leaked into the registry (e.g. module exports)
-  const validSeeds = seedsArray.filter(s => s && typeof s === 'object' && 'slug' in s)
-  const seedRegistry = new SeedRegistry(validSeeds)
+  const seedRepository = config.seedRepository
+    ?? (seedsArray.length > 0 ? new InMemorySeedRepository(seedsArray) : undefined)
 
   const app = new Hono<{ Bindings: Env; Variables: Variables }>()
 
-  // 1. Core Middleware (Seeds, CORS, Security)
-  app.use('*', async (context, next) => {
-    context.set('getSeed', (slug: string) => seedRegistry.get(slug))
-    context.set('seedRegistry', seedRegistry)
-    await next()
-  })
-
-  // 1.1 Repository Injection
+  // 1. Repository Injection (must be first — seedRegistryMiddleware depends on seedRepository)
   app.use('*', repositoryMiddleware({
     repository: config.repository,
     idempotencyRepository: config.idempotencyRepository,
     mediaRepository: config.mediaRepository,
     systemStatsRepository: config.systemStatsRepository,
+    seedRepository,
   }))
 
+  // 2. Seed Registry Hydration (D1-backed, version-token-cached per isolate)
+  app.use('*', seedRegistryMiddleware())
+
+  // 3. Storage / Auth / Rate Limiting / Observability
   app.use('*', storageMiddleware({
     bucket: config.bucket,
   }))
@@ -211,7 +227,7 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
 
       if (!user || !isValid) return context.json({ error: AUTH_ERRORS.INVALID_CREDENTIALS }, 401)
 
-      const accessToken = await context.get('tokenService').issue({ sub: user.id, email: user.email, name: user.name ?? undefined })
+      const accessToken = await context.get('tokenService').issue({ sub: user.id, email: user.email, name: user.name ?? undefined, surname: user.surname ?? undefined, role: user.role })
       const refreshToken = generateRefreshToken()
       const refreshTokenHash = await sha256hex(refreshToken)
       const nowSeconds = SystemClock.nowSeconds()
@@ -251,7 +267,7 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
 
       // Issue new tokens before revoking the old one: if saveRefreshToken fails,
       // the old token stays valid and the user is not locked out.
-      const newAccessToken = await context.get('tokenService').issue({ sub: user.id, email: user.email, name: user.name ?? undefined })
+      const newAccessToken = await context.get('tokenService').issue({ sub: user.id, email: user.email, name: user.name ?? undefined, surname: user.surname ?? undefined, role: user.role })
       const newRefreshToken = generateRefreshToken()
       const newRefreshTokenHash = await sha256hex(newRefreshToken)
 
@@ -297,10 +313,12 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
 
   apiProtected.route('/settings', settingsApp)
   apiProtected.route('/schema', schemaApp)
+  apiProtected.route('/seeds', seedsApp)
   apiProtected.route('/content', notificationsApp)
   apiProtected.route('/content', statsApp)
   apiProtected.route('/content', rotateFieldApp)
   apiProtected.route('/content', draftApp)
+  apiProtected.route('/content', backrefsApp)
   apiProtected.route('/content', contentFeature)
   apiProtected.route('/widget', widgetApp)
   apiProtected.route('/automations', automationsApp)
@@ -313,6 +331,9 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
   apiPublic.route('/', publicRoutes)
   app.route('/api/v1/public', apiPublic)
 
+  // Webhooks API (public, verified via signature)
+  app.route('/api/webhooks', webhooksApp)
+
   app.get('/api/media/:key', (context) => serveMediaHandler(context))
   app.route('/api', apiProtected)
   app.route('/api/search', searchRouter)