@beechcms/api 0.6.0-preview.1 → 0.6.0-preview.3

package/src/factory.ts

@@ -1,368 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-/// <reference types="@cloudflare/workers-types" />
-import { Hono } from 'hono'
-import { cors } from 'hono/cors'
-import { getCookie, setCookie, deleteCookie } from 'hono/cookie'
-import type { Seed, ContentRepository, IdempotencyRepository, BeechBucket, MediaRepository, SystemStatsRepository } from '@beechcms/core'
-import { sha256hex, SystemClock, SystemIdGenerator } from '@beechcms/core'
-import type { Env, Variables } from './types'
-import { getClientIp } from './shared/request-utils'
-
-// Imports delle rotte e middleware
-import { AUTH_ERRORS } from './auth/constants'
-import {
-  parseLoginBody,
-  validateLoginInput,
-  verifyPassword,
-  DUMMY_PASSWORD_HASH,
-} from './auth/login'
-import { generateRefreshToken } from './auth/refresh'
-import { authMiddleware } from './middleware'
-import contentFeature from './features/content'
-import { widgetApp } from './widget'
-import { rotateFieldApp } from './features/rotate-field'
-import { passwordResetApp } from './features/password-reset'
-import { setupApp } from './features/setup'
-import { draftApp } from './features/draft'
-import { settingsApp } from './features/settings/settings.handler'
-import { schemaApp } from './features/schema/schema.handler'
-import { seedsApp } from './features/seeds'
-import { notificationsApp } from './features/notifications'
-import { automationsApp } from './features/automations'
-import { statsApp } from './features/stats'
-import { backrefsApp } from './features/backrefs'
-import { webhooksApp } from './features/webhooks'
-import { uploadRoutes, serveMediaHandler } from './upload'
-import { publicRoutes, apiKeyMiddleware, publicRateLimitMiddleware } from './public'
-import { searchRouter } from "./search"
-import type { ISeedRepository } from '@beechcms/core'
-import { repositoryMiddleware } from './middleware/repository.middleware'
-import { seedRegistryMiddleware } from './middleware/seed-registry.middleware'
-import { storageMiddleware } from './middleware/storage.middleware'
-import { InMemorySeedRepository } from './shared/in-memory-seed.repository'
-import { authProvidersMiddleware } from './middleware/auth-providers.middleware'
-import { rateLimiterMiddleware } from './middleware/rate-limit.middleware'
-import { observabilityMiddleware } from './middleware/observability.middleware'
-
-export interface BeechConfig {
-  seeds: Seed[] | Record<string, Seed>
-  repository?: ContentRepository
-  idempotencyRepository?: IdempotencyRepository
-  bucket?: BeechBucket
-  mediaRepository?: MediaRepository
-  systemStatsRepository?: SystemStatsRepository
-  // Optional override: inject a custom ISeedRepository (e.g. InMemorySeedRepository for tests).
-  // When omitted and seeds is non-empty, an InMemorySeedRepository is created automatically
-  // for backward compatibility.
-  seedRepository?: ISeedRepository
-}
-
-// --- Costanti e helper ---
-const REFRESH_TOKEN_EXPIRY_DAYS = 7
-const SECONDS_PER_DAY = 24 * 60 * 60
-
-function isRequestSecure(url: string): boolean {
-  return new URL(url).protocol === 'https:'
-}
-
-function getRefreshTokenCookieOptions(secure: boolean) {
-  return {
-    httpOnly: true,
-    secure,
-    sameSite: 'Strict' as const,
-    maxAge: REFRESH_TOKEN_EXPIRY_DAYS * SECONDS_PER_DAY,
-    path: '/auth',
-  }
-}
-
-function getRefreshTokenDeleteCookieOptions(secure: boolean) {
-  return {
-    httpOnly: true,
-    secure,
-    sameSite: 'Strict' as const,
-    path: '/auth',
-  }
-}
-
-function handleAuthError(context: any, error: unknown, operationName: string): Response {
-  if (context.env.ENV !== 'production') {
-    console.error(`${operationName} error:`, error)
-  }
-  return context.json({ error: AUTH_ERRORS.GENERIC_ERROR }, 500)
-}
-
-function extractPublicSeed(path: string): string {
-  const match = path.match(/^\/api\/v1\/public\/([^/?]+)/)
-  return match ? match[1] : ''
-}
-
-/**
- * Builds a fully configured Hono app. Seeds are hydrated from D1 at runtime via
- * seedRegistryMiddleware; config.seeds is retained for back-compat but no longer
- * drives request handling.
- */
-export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Variables: Variables }> {
-  // Back-compat shim: when callers (e.g. existing tests) pass seeds without a custom
-  // seedRepository, wrap them in an InMemorySeedRepository so the middleware can serve
-  // them without touching D1. Production index.ts passes seeds:[] so D1SeedRepository
-  // is used as the live path.
-  const seedsArray = Array.isArray(config.seeds) ? config.seeds : Object.values(config.seeds)
-  const seedRepository = config.seedRepository
-    ?? (seedsArray.length > 0 ? new InMemorySeedRepository(seedsArray) : undefined)
-
-  const app = new Hono<{ Bindings: Env; Variables: Variables }>()
-
-  // 1. Repository Injection (must be first — seedRegistryMiddleware depends on seedRepository)
-  app.use('*', repositoryMiddleware({
-    repository: config.repository,
-    idempotencyRepository: config.idempotencyRepository,
-    mediaRepository: config.mediaRepository,
-    systemStatsRepository: config.systemStatsRepository,
-    seedRepository,
-  }))
-
-  // 2. Seed Registry Hydration (D1-backed, version-token-cached per isolate)
-  app.use('*', seedRegistryMiddleware())
-
-  // 3. Storage / Auth / Rate Limiting / Observability
-  app.use('*', storageMiddleware({
-    bucket: config.bucket,
-  }))
-
-  app.use('*', authProvidersMiddleware())
-  app.use('*', rateLimiterMiddleware())
-  app.use('*', observabilityMiddleware())
-
-  app.use('*', async (context, next) => {
-    const isDev = context.env.ENV !== 'production'
-
-    return cors({
-      origin: (origin) => {
-        if (!origin) return origin ?? ''
-
-        // In dev, allow all localhost/127.0.0.1 origins regardless of port
-        if (isDev) {
-          try {
-            const { hostname } = new URL(origin)
-            if (hostname === 'localhost' || hostname === '127.0.0.1') return origin
-          } catch {}
-        }
-
-        const origins = (context.env.CORS_ORIGINS ?? 'http://localhost:5173')
-          .split(',')
-          .map((o) => o.trim())
-          .filter(Boolean)
-
-        if (origins.includes(origin)) return origin
-
-        // Allow same-origin requests
-        try {
-          const originUrl = new URL(origin)
-          const requestUrl = new URL(context.req.url)
-          if (originUrl.hostname === requestUrl.hostname && originUrl.port === requestUrl.port) {
-            return origin
-          }
-        } catch {}
-
-        return null
-      },
-      allowMethods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
-      allowHeaders: ['Content-Type', 'Authorization', 'X-API-Key'],
-      credentials: true,
-    })(context, next)
-  })
-
-  app.use('*', async (context, next) => {
-    await next()
-    if (context.req.path.startsWith('/admin')) return
-    context.header('X-Frame-Options', 'DENY')
-    context.header('X-Content-Type-Options', 'nosniff')
-    context.header('Referrer-Policy', 'strict-origin-when-cross-origin')
-    context.header('Permissions-Policy', 'geolocation=(), microphone=(), camera=()')
-    context.header('Content-Security-Policy', "default-src 'self'; frame-ancestors 'none'")
-  })
-
-  // 2. Analytics Middleware
-  app.use('/api/*', async (context, next) => {
-    await next()
-    if (context.req.method === 'OPTIONS') return
-    if (context.res.status < 200 || context.res.status >= 300) return
-
-    let executionCtx: any
-    try { executionCtx = context.executionCtx } catch {}
-    if (!executionCtx) return
-
-    const analyticsRepository = context.get('analyticsRepository')
-    if (!analyticsRepository) return
-
-    const seedSlug = extractPublicSeed(context.req.path)
-
-    executionCtx.waitUntil(
-      analyticsRepository.recordRequest(seedSlug).catch((error: unknown) => {
-        console.error('Analytics middleware error:', error)
-      })
-    )
-  })
-
-  // 3. Auth Routes
-  app.post('/auth/login', async (context) => {
-    try {
-      let body: any
-      try { body = await context.req.json() } catch { return context.json({ error: AUTH_ERRORS.INVALID_REQUEST }, 400) }
-      const credentials = parseLoginBody(body)
-      if (!credentials) return context.json({ error: AUTH_ERRORS.INVALID_REQUEST }, 400)
-      const { email, password } = credentials
-      if (!validateLoginInput(email, password)) return context.json({ error: AUTH_ERRORS.INVALID_REQUEST }, 400)
-
-      const clientIp = getClientIp(context.req)
-      const loginRateLimit = await context.get('rateLimiters').getLimiter('login').checkLimit(clientIp)
-      if (!loginRateLimit.isAllowed) return context.json({ error: AUTH_ERRORS.RATE_LIMIT_EXCEEDED }, 429)
-
-      const user = await context.get('userRepository').findByEmail(email)
-      const hashToCompare = user?.passwordHash ?? DUMMY_PASSWORD_HASH
-      const isValid = await verifyPassword(password, hashToCompare, context.get('hashProvider'))
-
-      if (!user || !isValid) return context.json({ error: AUTH_ERRORS.INVALID_CREDENTIALS }, 401)
-
-      const accessToken = await context.get('tokenService').issue({ sub: user.id, email: user.email, name: user.name ?? undefined, surname: user.surname ?? undefined, role: user.role })
-      const refreshToken = generateRefreshToken()
-      const refreshTokenHash = await sha256hex(refreshToken)
-      const nowSeconds = SystemClock.nowSeconds()
-
-      await context.get('sessionRepository').saveRefreshToken({
-        id: SystemIdGenerator.uuid(),
-        userId: user.id,
-        tokenHash: refreshTokenHash,
-        expiresAt: nowSeconds + REFRESH_TOKEN_EXPIRY_DAYS * SECONDS_PER_DAY,
-      })
-      setCookie(context, 'refresh_token', refreshToken, getRefreshTokenCookieOptions(isRequestSecure(context.req.url)))
-      return context.json({ token: accessToken, expiresIn: '15m' }, 200)
-    } catch (error) {
-      return handleAuthError(context, error, 'Login')
-    }
-  })
-
-  app.post('/auth/refresh', async (context) => {
-    try {
-      const refreshClientIp = getClientIp(context.req)
-      const refreshRateLimit = await context.get('rateLimiters').getLimiter('tokenRefresh').checkLimit(refreshClientIp)
-      if (!refreshRateLimit.isAllowed) return context.json({ error: AUTH_ERRORS.RATE_LIMIT_EXCEEDED }, 429)
-
-      const refreshToken = getCookie(context, 'refresh_token')
-      if (!refreshToken) return context.json({ error: 'Refresh token missing' }, 401)
-
-      const nowSeconds = SystemClock.nowSeconds()
-      const tokenHash = await sha256hex(refreshToken)
-      const activeSession = await context.get('sessionRepository').findActiveByHash(tokenHash, nowSeconds)
-      if (!activeSession) return context.json({ error: 'Invalid refresh token' }, 401)
-
-      const user = await context.get('userRepository').findById(activeSession.userId)
-      if (!user) {
-        await context.get('sessionRepository').revokeByHash(tokenHash, nowSeconds)
-        return context.json({ error: 'User not found' }, 401)
-      }
-
-      // Issue new tokens before revoking the old one: if saveRefreshToken fails,
-      // the old token stays valid and the user is not locked out.
-      const newAccessToken = await context.get('tokenService').issue({ sub: user.id, email: user.email, name: user.name ?? undefined, surname: user.surname ?? undefined, role: user.role })
-      const newRefreshToken = generateRefreshToken()
-      const newRefreshTokenHash = await sha256hex(newRefreshToken)
-
-      await context.get('sessionRepository').saveRefreshToken({
-        id: SystemIdGenerator.uuid(),
-        userId: user.id,
-        tokenHash: newRefreshTokenHash,
-        expiresAt: nowSeconds + REFRESH_TOKEN_EXPIRY_DAYS * SECONDS_PER_DAY,
-      })
-
-      const revoked = await context.get('sessionRepository').revokeByHash(tokenHash, nowSeconds)
-      if (!revoked) return context.json({ error: 'Invalid refresh token' }, 401)
-
-      setCookie(context, 'refresh_token', newRefreshToken, getRefreshTokenCookieOptions(isRequestSecure(context.req.url)))
-      return context.json({ token: newAccessToken, expiresIn: '15m' }, 200)
-    } catch (error) {
-      return handleAuthError(context, error, 'Refresh')
-    }
-  })
-
-  app.post('/auth/logout', async (context) => {
-    try {
-      const refreshToken = getCookie(context, 'refresh_token')
-      if (refreshToken) {
-        const nowSeconds = SystemClock.nowSeconds()
-        const tokenHash = await sha256hex(refreshToken)
-        await context.get('sessionRepository').revokeByHash(tokenHash, nowSeconds)
-      }
-      deleteCookie(context, 'refresh_token', getRefreshTokenDeleteCookieOptions(isRequestSecure(context.req.url)))
-      return context.json({ message: 'Logged out' }, 200)
-    } catch (error) {
-      return handleAuthError(context, error, 'Logout')
-    }
-  })
-
-  // 4. Setup & Password Reset
-  app.route('/', setupApp)
-  app.route('/', passwordResetApp)
-
-  // 5. Protected CMS API
-  const apiProtected = new Hono<{ Bindings: Env; Variables: Variables }>()
-  apiProtected.use('*', authMiddleware())
-
-  apiProtected.route('/settings', settingsApp)
-  apiProtected.route('/schema', schemaApp)
-  apiProtected.route('/seeds', seedsApp)
-  apiProtected.route('/content', notificationsApp)
-  apiProtected.route('/content', statsApp)
-  apiProtected.route('/content', rotateFieldApp)
-  apiProtected.route('/content', draftApp)
-  apiProtected.route('/content', backrefsApp)
-  apiProtected.route('/content', contentFeature)
-  apiProtected.route('/widget', widgetApp)
-  apiProtected.route('/automations', automationsApp)
-  apiProtected.route('/', uploadRoutes)
-  
-  // 6. Public API (must be registered before apiProtected to avoid auth middleware interception)
-  const apiPublic = new Hono<{ Bindings: Env; Variables: Variables }>()
-  apiPublic.use('*', publicRateLimitMiddleware())
-  apiPublic.use('*', apiKeyMiddleware())
-  apiPublic.route('/', publicRoutes)
-  app.route('/api/v1/public', apiPublic)
-
-  // Webhooks API (public, verified via signature)
-  app.route('/api/webhooks', webhooksApp)
-
-  app.get('/api/media/:key', (context) => serveMediaHandler(context))
-  app.route('/api', apiProtected)
-  app.route('/api/search', searchRouter)
-
-  // 7. Dashboard SPA — serve static assets from Workers Assets binding
-  app.get('/admin', (context) => context.redirect('/admin/', 301))
-  app.get('/admin/*', async (context) => {
-    if (!context.env.ASSETS) {
-      return context.text('Dashboard not configured. Set up the ASSETS binding in wrangler.toml pointing to node_modules/@beechcms/api/assets/dashboard', 503)
-    }
-    const url = new URL(context.req.url)
-    const originalPath = url.pathname
-    url.pathname = originalPath.replace(/^\/admin/, '') || '/'
-    
-    let assetResponse = await context.env.ASSETS.fetch(new Request(url.toString(), context.req.raw))
-    if (assetResponse.status === 404) {
-      // SPA fallback: any unmatched /admin/* route serves index.html
-      assetResponse = await context.env.ASSETS.fetch(new Request(new URL('/index.html', context.req.url)))
-    }
-    // ASSETS returns an immutable Response — wrap it to inject security headers
-    const headers = new Headers(assetResponse.headers)
-    headers.set('Content-Security-Policy',
-      "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; connect-src 'self'; frame-ancestors 'none'"
-    )
-    headers.set('X-Frame-Options', 'DENY')
-    headers.set('X-Content-Type-Options', 'nosniff')
-    headers.set('Referrer-Policy', 'strict-origin-when-cross-origin')
-    return new Response(assetResponse.body, { status: assetResponse.status, headers })
-  })
-
-  return app
-}

package/src/features/automations/__tests__/action-executors.test.ts

@@ -1,255 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { describe, it, expect, vi, beforeEach } from 'vitest'
-import { executeAction } from '../action-executors'
-import type { ActionContext } from '../action-executors'
-import type { ContentRepository, Seed, IIdGenerator } from '@beechcms/core'
-import { deleteAllMessages, listMessages, waitForMessage, getMessageHtml } from '../../../../test/helpers/mailpit-client'
-import { newBucket, waitForRequest } from '../../../../test/helpers/webhook-tester-client'
-
-// ── Shared mock context factory ───────────────────────────────────────────────
-
-function makeCtx(overrides: Partial<ActionContext> = {}): ActionContext {
-  const { entry: entryOverride, context: contextOverride, ...rest } = overrides
-  const entry: Record<string, unknown> = entryOverride ?? { id: 'entry-1', title: 'Test Entry', status: 'published' }
-  const context = contextOverride ?? {
-    triggerEntry: entry,
-    lookup(parsed: import('../template-grammar').ParsedKey, onMissing?: (f: string) => void) {
-      if (parsed.kind === 'simple') {
-        const val = entry[parsed.path]
-        if (val == null && onMissing) onMissing(parsed.path)
-        return val
-      }
-      if (parsed.kind === 'scoped' && parsed.scope === 'this' && parsed.field) {
-        return entry[parsed.field]
-      }
-      return undefined
-    },
-  }
-  return {
-    entry,
-    env: { RESEND_API_KEY: 'test-key', EMAIL_FROM: 'test@example.com' },
-    repository: {
-      update: vi.fn().mockResolvedValue(undefined),
-      create: vi.fn().mockResolvedValue(undefined),
-    } as unknown as ContentRepository,
-    getSeed: vi.fn().mockReturnValue({ branches: [] } as unknown as Seed),
-    seed: { slug: 'posts', branches: [] } as unknown as Seed,
-    idGenerator: { uuid: vi.fn().mockReturnValue('new-id-123') } as unknown as IIdGenerator,
-    context,
-    variables: {},
-    ...rest,
-  }
-}
-
-// ── webhook ───────────────────────────────────────────────────────────────────
-
-describe('webhook executor', () => {
-  it('POSTs to URL with interpolated body_template', async () => {
-    const { url, uuid } = await newBucket()
-    const ctx = makeCtx()
-    await executeAction({ type: 'webhook', url, body_template: '{"id":"{{id}}","title":"{{title}}"}' }, ctx)
-    const req = await waitForRequest(uuid)
-    expect(req.method).toBe('POST')
-    expect(JSON.parse(req.body)).toMatchObject({ id: 'entry-1', title: 'Test Entry' })
-  })
-
-  it('interpolates body_template with entry values', async () => {
-    const { url, uuid } = await newBucket()
-    const ctx = makeCtx()
-    await executeAction({ type: 'webhook', url, body_template: '{"t":"{{title}}"}' }, ctx)
-    const req = await waitForRequest(uuid)
-    expect(req.body).toBe('{"t":"Test Entry"}')
-  })
-
-  it('merges custom headers', async () => {
-    const { url, uuid } = await newBucket()
-    const ctx = makeCtx()
-    await executeAction({ type: 'webhook', url, headers: { 'X-Token': 'abc' } }, ctx)
-    const req = await waitForRequest(uuid)
-    expect(req.headers['x-token']).toBe('abc')
-  })
-
-  it('throws when webhook endpoint is unreachable', async () => {
-    const ctx = makeCtx()
-    await expect(executeAction({ type: 'webhook', url: 'http://localhost:19999/nope' }, ctx)).rejects.toThrow()
-  })
-
-  it('uses custom HTTP method', async () => {
-    const { url, uuid } = await newBucket()
-    const ctx = makeCtx()
-    await executeAction({ type: 'webhook', url, method: 'PUT' }, ctx)
-    const req = await waitForRequest(uuid)
-    expect(req.method).toBe('PUT')
-  })
-})
-
-// ── send_mail ─────────────────────────────────────────────────────────────────
-
-describe('send_mail executor', () => {
-  beforeEach(() => deleteAllMessages())
-
-  it('interpolates to/subject/body and delivers to Mailpit', async () => {
-    const ctx = makeCtx({
-      entry: { id: '1', email: 'user@example.com', title: 'Hello' },
-      env: { EMAIL_PROVIDER: 'smtp', SMTP_HOST: 'localhost', SMTP_PORT: '8025', EMAIL_FROM: 'Beech <test@beech.local>' },
-    })
-
-    await executeAction(
-      {
-        type: 'send_mail',
-        to: '{{email}}',
-        subject_template: 'Re: {{title}}',
-        body_template: 'Your entry {{title}} was created.',
-      },
-      ctx,
-    )
-
-    const msg = await waitForMessage(m => m.To.some(t => t.Address === 'user@example.com'))
-    expect(msg.Subject).toBe('Re: Hello')
-    const html = await getMessageHtml(msg.ID)
-    expect(html).toContain('Hello')
-  })
-
-  it('substitutes [missing] for absent fields and logs a warning', async () => {
-    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    // email is present (needed for a valid To address) but title and desc are absent
-    const ctx = makeCtx({
-      entry: { id: '1', email: 'warn-test@example.com' },
-      env: { EMAIL_PROVIDER: 'smtp', SMTP_HOST: 'localhost', SMTP_PORT: '8025', EMAIL_FROM: 'Beech <test@beech.local>' },
-    })
-
-    await executeAction(
-      {
-        type: 'send_mail',
-        to: '{{email}}',
-        subject_template: 'Re: {{title}}',
-        body_template: 'Content: {{desc}}',
-      },
-      ctx,
-    )
-
-    expect(warnSpy).toHaveBeenCalledWith(
-      expect.stringContaining('missing concrete data'),
-      expect.arrayContaining(['title', 'desc']),
-    )
-    const msg = await waitForMessage(m => m.Subject === 'Re: [missing]')
-    expect(msg.Subject).toBe('Re: [missing]')
-    const html = await getMessageHtml(msg.ID)
-    expect(html).toContain('[missing]')
-    warnSpy.mockRestore()
-  })
-
-  it('skips execution and logs an error when provider is resend and apiKey is missing', async () => {
-    const errSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
-    const ctx = makeCtx({ env: {} })
-
-    await executeAction(
-      {
-        type: 'send_mail',
-        to: 'user@beech.io',
-        subject_template: 'Hello',
-        body_template: 'World',
-      },
-      ctx,
-    )
-
-    expect(errSpy).toHaveBeenCalledWith(expect.stringContaining('Execution skipped'))
-    const msgs = await listMessages()
-    expect(msgs).toHaveLength(0)
-    errSpy.mockRestore()
-  })
-
-  it('logs error and rethrows when SMTP provider is unreachable', async () => {
-    const errSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
-    const ctx = makeCtx({
-      env: { EMAIL_PROVIDER: 'smtp', SMTP_HOST: 'localhost', SMTP_PORT: '19999', EMAIL_FROM: 'Beech <test@beech.local>' },
-    })
-
-    await expect(
-      executeAction(
-        {
-          type: 'send_mail',
-          to: 'test@beech.io',
-          subject_template: 'Hello',
-          body_template: 'World',
-        },
-        ctx,
-      ),
-    ).rejects.toThrow()
-
-    expect(errSpy).toHaveBeenCalledWith(
-      expect.stringContaining('failed to send automation email'),
-      expect.any(Error),
-    )
-    errSpy.mockRestore()
-  })
-})
-
-// ── edit_field ────────────────────────────────────────────────────────────────
-
-describe('edit_field executor', () => {
-  it('calls repository.update with interpolated string value', async () => {
-    const ctx = makeCtx({ entry: { id: 'entry-1', title: 'Old Title' } })
-    await executeAction({ type: 'edit_field', field: 'summary', value: 'Based on {{title}}' }, ctx)
-    expect(ctx.repository.update).toHaveBeenCalledWith(ctx.seed, 'entry-1', { summary: 'Based on Old Title' })
-  })
-
-  it('calls repository.update with raw non-string value', async () => {
-    const ctx = makeCtx({ entry: { id: 'entry-1', title: 'T' } })
-    await executeAction({ type: 'edit_field', field: 'count', value: 42 }, ctx)
-    expect(ctx.repository.update).toHaveBeenCalledWith(ctx.seed, 'entry-1', { count: 42 })
-  })
-
-  it('throws when entry.id is missing', async () => {
-    const ctx = makeCtx({ entry: { title: 'No ID' } })
-    await expect(executeAction({ type: 'edit_field', field: 'x', value: 'y' }, ctx)).rejects.toThrow('entry.id missing')
-  })
-})
-
-// ── create_entry ──────────────────────────────────────────────────────────────
-
-describe('create_entry executor', () => {
-  it('creates a new entry with field_map values from trigger entry', async () => {
-    const ctx = makeCtx({ entry: { id: 'e1', author: 'Alice' } })
-    await executeAction(
-      { type: 'create_entry', seed_slug: 'comments', field_map: { writer: 'author', fixed: 'literal-value' } },
-      ctx,
-    )
-    expect(ctx.idGenerator.uuid).toHaveBeenCalled()
-    expect(ctx.repository.create).toHaveBeenCalledWith(
-      expect.anything(),
-      'new-id-123',
-      'new-id-123',
-      'draft',
-      { writer: 'Alice', fixed: 'literal-value' },
-    )
-  })
-
-  it('uses literal string when source field is not in entry', async () => {
-    const ctx = makeCtx({ entry: { id: 'e1' } })
-    await executeAction(
-      { type: 'create_entry', seed_slug: 'comments', field_map: { tag: 'missing-field' } },
-      ctx,
-    )
-    expect(ctx.repository.create).toHaveBeenCalledWith(
-      expect.anything(), 'new-id-123', 'new-id-123', 'draft',
-      { tag: 'missing-field' },
-    )
-  })
-
-  it('throws when seed not found', async () => {
-    const ctx = makeCtx({ getSeed: vi.fn().mockReturnValue(null) })
-    await expect(
-      executeAction({ type: 'create_entry', seed_slug: 'unknown', field_map: {} }, ctx),
-    ).rejects.toThrow('unknown seed unknown')
-  })
-
-  it('throws error for unknown action type to cover exhaustive default check', async () => {
-    const ctx = makeCtx()
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    await expect(executeAction({ type: 'unknown_custom_action' } as any, ctx)).rejects.toThrow('unknown action type')
-  })
-})