@beechcms/api 0.6.0-preview.1 → 0.6.0-preview.3

package/src/middleware/observability.middleware.ts

@@ -1,70 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { createMiddleware } from 'hono/factory'
-import type { IActivityLogger, INotificationService, IClock, IIdGenerator } from '@beechcms/core'
-import { SystemClock, SystemIdGenerator } from '@beechcms/core'
-import type { AppEnv } from '../types'
-import { D1ActivityLogger } from '../shared/d1-activity-logger'
-import { BackgroundNotificationService } from '../shared/background-notification-service'
-import { QStashNotificationService } from '../shared/qstash-notification-service'
-
-export interface ObservabilityOverrides {
-  activityLogger?: IActivityLogger
-  notificationService?: INotificationService
-  clock?: IClock
-  idGenerator?: IIdGenerator
-}
-
-/**
- * Observability middleware.
- *
- * Injects the activity logger and the notification service into the Hono
- * context. Both depend on `executionCtx.waitUntil` to fire-and-forget their
- * persistence work in production. The notification service additionally
- * depends on the notification repository — `repositoryMiddleware` MUST run
- * before this middleware in the factory pipeline.
- *
- * Tests can pass their own implementations via `overrides` to bypass D1.
- */
-export const observabilityMiddleware = (overrides?: ObservabilityOverrides) => {
-  return createMiddleware<AppEnv>(async (context, next) => {
-    let scheduleBackgroundTask: ((task: Promise<unknown>) => void) | undefined
-    try {
-      const executionContext = context.executionCtx
-      scheduleBackgroundTask = executionContext.waitUntil.bind(executionContext)
-    } catch {
-      scheduleBackgroundTask = undefined
-    }
-
-    const resolvedClock = overrides?.clock ?? SystemClock
-    const resolvedIdGenerator = overrides?.idGenerator ?? SystemIdGenerator
-
-    const activityLogger =
-      overrides?.activityLogger ??
-      new D1ActivityLogger(context.env.DB, resolvedClock, resolvedIdGenerator, scheduleBackgroundTask)
-
-    let notificationService: INotificationService
-    if (overrides?.notificationService) {
-      notificationService = overrides.notificationService
-    } else if (context.env.QSTASH_TOKEN && context.env.APP_URL) {
-      notificationService = new QStashNotificationService(
-        context.env.QSTASH_TOKEN,
-        context.env.APP_URL,
-        scheduleBackgroundTask,
-        context.env.QSTASH_URL
-      )
-    } else {
-      notificationService = new BackgroundNotificationService(
-        context.get('notificationRepository'),
-        scheduleBackgroundTask
-      )
-    }
-
-    context.set('activityLogger', activityLogger)
-    context.set('notificationService', notificationService)
-
-    await next()
-  })
-}

package/src/middleware/rate-limit.middleware.ts

@@ -1,45 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-/// <reference types="@cloudflare/workers-types" />
-import { createMiddleware } from 'hono/factory'
-import type { IRateLimiter } from '@beechcms/core'
-import type { AppEnv, Env } from '../types'
-import { CloudflareRateLimiter } from '../rate-limit/cloudflare-rate-limiter'
-import { NoOpRateLimiter } from '../rate-limit/no-op-rate-limiter'
-
-export type RateLimiterName =
-  | 'login'
-  | 'tokenRefresh'
-  | 'forgotPassword'
-  | 'resetPassword'
-  | 'publicApiRead'
-  | 'publicApiWrite'
-
-export interface IRateLimiterRegistry {
-  getLimiter(name: RateLimiterName): IRateLimiter
-}
-
-const NO_OP = new NoOpRateLimiter()
-
-function buildDefaultRegistry(env: Env): IRateLimiterRegistry {
-  const limiters: Record<RateLimiterName, IRateLimiter> = {
-    login: env.LOGIN_RATE_LIMITER ? new CloudflareRateLimiter(env.LOGIN_RATE_LIMITER) : NO_OP,
-    tokenRefresh: env.REFRESH_RATE_LIMITER ? new CloudflareRateLimiter(env.REFRESH_RATE_LIMITER) : NO_OP,
-    forgotPassword: env.FORGOT_PASSWORD_RATE_LIMITER ? new CloudflareRateLimiter(env.FORGOT_PASSWORD_RATE_LIMITER) : NO_OP,
-    resetPassword: env.RESET_PASSWORD_RATE_LIMITER ? new CloudflareRateLimiter(env.RESET_PASSWORD_RATE_LIMITER) : NO_OP,
-    publicApiRead: env.PUBLIC_READ_RATE_LIMITER ? new CloudflareRateLimiter(env.PUBLIC_READ_RATE_LIMITER) : NO_OP,
-    publicApiWrite: env.PUBLIC_WRITE_RATE_LIMITER ? new CloudflareRateLimiter(env.PUBLIC_WRITE_RATE_LIMITER) : NO_OP,
-  }
-
-  return { getLimiter: (name) => limiters[name] }
-}
-
-export const rateLimiterMiddleware = (overrides?: { registry?: IRateLimiterRegistry }) => {
-  return createMiddleware<AppEnv>(async (context, next) => {
-    const registry = overrides?.registry ?? buildDefaultRegistry(context.env)
-    context.set('rateLimiters', registry)
-    await next()
-  })
-}

package/src/middleware/repository.middleware.ts

@@ -1,114 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { createMiddleware } from 'hono/factory'
-import type { Context } from 'hono'
-import { D1ContentRepository } from '../shared/content.repository.d1'
-import { D1IdempotencyRepository } from '../shared/idempotency.repository.d1'
-import { D1MediaRepository } from '../shared/media.repository.d1'
-import { D1SystemStatsRepository } from '../shared/system-stats.repository.d1'
-import { D1UserRepository } from '../shared/d1-user.repository'
-import { D1SessionRepository } from '../shared/d1-session.repository'
-import { D1PasswordResetTokenRepository } from '../shared/d1-password-reset-token.repository'
-import { D1ActivityLogRepository } from '../shared/d1-activity-log.repository'
-import { D1NotificationRepository } from '../shared/d1-notification.repository'
-import { D1WidgetRepository } from '../shared/d1-widget.repository'
-import { D1SearchRepository } from '../shared/d1-search.repository'
-import { D1AnalyticsRepository } from '../shared/d1-analytics.repository'
-import { D1ContentScanRepository } from '../shared/d1-content-scan.repository'
-import { D1SiteSettingsRepository } from '../shared/site-settings.repository.d1'
-import { D1DemoDataRepository } from '../shared/demo-data.repository.d1'
-import { D1SetupChecklistRepository } from '../shared/d1-setup-checklist.repository'
-import { D1SeedLayoutRepository } from '../shared/seed-layout.repository.d1'
-import { D1SeedRepository } from '../shared/seed.repository.d1'
-import { D1SchemaMutator } from '../shared/schema-mutator.d1'
-import { SystemClock, SystemIdGenerator } from '@beechcms/core'
-import type { ContentRepository, IdempotencyRepository, MediaRepository, SystemStatsRepository, IUserRepository, ISessionRepository, IPasswordResetTokenRepository, IActivityLogRepository, INotificationRepository, IWidgetRepository, ISearchRepository, IAnalyticsRepository, IContentScanRepository, IClock, IIdGenerator, IAutomationRunner, IAutomationRepository, IScheduler, ISiteSettingsRepository, IDemoDataRepository, ISeedLayoutRepository, ISeedRepository, ISchemaMutator } from '@beechcms/core'
-import { NoOpScheduler } from '@beechcms/core'
-import { AutomationRunner } from '../features/automations'
-import { D1AutomationRepository } from '../shared/automations.repository.d1'
-import { ExecutionContextScheduler } from '../shared/execution-context-scheduler'
-import type { Env, Variables } from '../types'
-
-interface RepositoryOverrides {
-  repository?: ContentRepository
-  idempotencyRepository?: IdempotencyRepository
-  mediaRepository?: MediaRepository
-  systemStatsRepository?: SystemStatsRepository
-  userRepository?: IUserRepository
-  sessionRepository?: ISessionRepository
-  passwordResetTokenRepository?: IPasswordResetTokenRepository
-  activityLogRepository?: IActivityLogRepository
-  notificationRepository?: INotificationRepository
-  widgetRepository?: IWidgetRepository
-  searchRepository?: ISearchRepository
-  analyticsRepository?: IAnalyticsRepository
-  contentScanRepository?: IContentScanRepository
-  clock?: IClock
-  idGenerator?: IIdGenerator
-  automationRepository?: IAutomationRepository
-  automationRunner?: IAutomationRunner
-  scheduler?: IScheduler
-  siteSettingsRepository?: ISiteSettingsRepository
-  demoDataRepository?: IDemoDataRepository
-  seedLayoutRepository?: ISeedLayoutRepository
-  seedRepository?: ISeedRepository
-  schemaMutator?: ISchemaMutator
-}
-
-function buildScheduler(context: Context): IScheduler {
-  try {
-    return new ExecutionContextScheduler(context.executionCtx)
-  } catch {
-    return new NoOpScheduler()
-  }
-}
-
-export const repositoryMiddleware = (overrides?: RepositoryOverrides) => {
-  return createMiddleware<{ Bindings: Env; Variables: Variables }>(async (context, next) => {
-    const resolvedClock = overrides?.clock ?? SystemClock
-    const resolvedIdGenerator = overrides?.idGenerator ?? SystemIdGenerator
-    const database = context.env.DB
-
-    context.set('repository', overrides?.repository ?? new D1ContentRepository(database))
-    context.set('idempotencyRepository', overrides?.idempotencyRepository ?? new D1IdempotencyRepository(database))
-    context.set('mediaRepository', overrides?.mediaRepository ?? new D1MediaRepository(database))
-    context.set('systemStatsRepository', overrides?.systemStatsRepository ?? new D1SystemStatsRepository(database))
-    context.set('userRepository', overrides?.userRepository ?? new D1UserRepository(database))
-    context.set('sessionRepository', overrides?.sessionRepository ?? new D1SessionRepository(database, resolvedClock))
-    context.set('passwordResetTokenRepository', overrides?.passwordResetTokenRepository ?? new D1PasswordResetTokenRepository(database, resolvedIdGenerator))
-    context.set('activityLogRepository', overrides?.activityLogRepository ?? new D1ActivityLogRepository(database))
-    context.set('notificationRepository', overrides?.notificationRepository ?? new D1NotificationRepository(database, resolvedClock, resolvedIdGenerator))
-    context.set('widgetRepository', overrides?.widgetRepository ?? new D1WidgetRepository(database))
-    context.set('searchRepository', overrides?.searchRepository ?? new D1SearchRepository(database))
-    context.set('analyticsRepository', overrides?.analyticsRepository ?? new D1AnalyticsRepository(database, resolvedClock))
-    context.set('contentScanRepository', overrides?.contentScanRepository ?? new D1ContentScanRepository(database))
-    context.set('clock', resolvedClock)
-    context.set('idGenerator', resolvedIdGenerator)
-    const automationRepository = overrides?.automationRepository
-      ?? new D1AutomationRepository(database)
-
-    context.set('automationRepository', automationRepository)
-    // getSeed is set later by seedRegistryMiddleware — capture context by closure so the
-    // runner reads the live value at call time, not at middleware creation time.
-    context.set(
-      'automationRunner',
-      overrides?.automationRunner ?? new AutomationRunner({
-        automationRepository,
-        contentRepository: context.get('repository'),
-        getSeed: (slug: string) => context.get('getSeed')?.(slug) ?? null,
-        idGenerator: resolvedIdGenerator,
-        env: context.env as unknown as Record<string, string | undefined>,
-      }),
-    )
-    context.set('scheduler', overrides?.scheduler ?? buildScheduler(context))
-    context.set('siteSettingsRepository', overrides?.siteSettingsRepository ?? new D1SiteSettingsRepository(database))
-    context.set('demoDataRepository', overrides?.demoDataRepository ?? new D1DemoDataRepository(database))
-    context.set('setupChecklistRepository', new D1SetupChecklistRepository(database))
-    context.set('seedLayoutRepository', overrides?.seedLayoutRepository ?? new D1SeedLayoutRepository(database))
-    context.set('seedRepository', overrides?.seedRepository ?? new D1SeedRepository(database))
-    context.set('schemaMutator', overrides?.schemaMutator ?? new D1SchemaMutator(database))
-    await next()
-  })
-}

package/src/middleware/seed-registry.middleware.test.ts

@@ -1,97 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { describe, it, expect, beforeEach, vi } from 'vitest'
-import { Hono } from 'hono'
-import { seedRegistryMiddleware } from './seed-registry.middleware'
-import { __resetSeedRegistryCache } from '../shared/seed-registry-cache'
-import type { ISeedRepository, Seed } from '@beechcms/core'
-
-const mockSeed: Seed = {
-  slug: 'posts',
-  label: 'Posts',
-  displayNameAlias: 'title',
-  branches: [{ id: 'br_01', alias: 'title', label: 'Title', type: 'text' }],
-}
-
-function makeRepo(seeds: Seed[] = [mockSeed]): ISeedRepository {
-  return {
-    listActive: vi.fn().mockResolvedValue(seeds),
-    listAll: vi.fn().mockResolvedValue([]),
-    get: vi.fn().mockResolvedValue(null),
-    upsert: vi.fn().mockResolvedValue(undefined),
-    softDelete: vi.fn().mockResolvedValue(undefined),
-    getRegistryVersion: vi.fn().mockResolvedValue(1),
-    bumpRegistryVersion: vi.fn().mockResolvedValue(2),
-  }
-}
-
-describe('seedRegistryMiddleware', () => {
-  beforeEach(() => __resetSeedRegistryCache())
-
-  it('injects seedRegistry, getSeed, and backrefMap into context', async () => {
-    const app = new Hono()
-    const repo = makeRepo()
-
-    app.use('*', async (c, next) => {
-      c.set('seedRepository' as never, repo)
-      await next()
-    })
-    app.use('*', seedRegistryMiddleware())
-    app.get('/test', (c) => {
-      const registry = c.get('seedRegistry' as never) as any
-      const getSeed = c.get('getSeed' as never) as any
-      const backrefMap = c.get('backrefMap' as never) as any
-      return c.json({
-        hasRegistry: !!registry,
-        hasSeed: !!getSeed('posts'),
-        hasBackrefMap: !!backrefMap,
-      })
-    })
-
-    const res = await app.request('/test')
-    const body = await res.json() as any
-    expect(body.hasRegistry).toBe(true)
-    expect(body.hasSeed).toBe(true)
-    expect(body.hasBackrefMap).toBe(true)
-  })
-
-  it('getSeed returns null for unknown slug', async () => {
-    const app = new Hono()
-    const repo = makeRepo()
-
-    app.use('*', async (c, next) => {
-      c.set('seedRepository' as never, repo)
-      await next()
-    })
-    app.use('*', seedRegistryMiddleware())
-    app.get('/test', (c) => {
-      const getSeed = c.get('getSeed' as never) as any
-      return c.json({ result: getSeed('no-such-slug') })
-    })
-
-    const res = await app.request('/test')
-    const body = await res.json() as any
-    expect(body.result).toBeNull()
-  })
-
-  it('empty seed list yields empty registry without crashing', async () => {
-    const app = new Hono()
-    const repo = makeRepo([])
-
-    app.use('*', async (c, next) => {
-      c.set('seedRepository' as never, repo)
-      await next()
-    })
-    app.use('*', seedRegistryMiddleware())
-    app.get('/test', (c) => {
-      const registry = c.get('seedRegistry' as never) as any
-      return c.json({ count: registry.all().length })
-    })
-
-    const res = await app.request('/test')
-    const body = await res.json() as any
-    expect(body.count).toBe(0)
-  })
-})

package/src/middleware/seed-registry.middleware.ts

@@ -1,21 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { createMiddleware } from 'hono/factory'
-import type { Env, Variables } from '../types'
-import { getHydratedRegistry } from '../shared/seed-registry-cache'
-
-/**
- * Hydrates the seed registry from D1 and injects seedRegistry, getSeed, and backrefMap
- * into the context. Must run AFTER repositoryMiddleware (needs seedRepository) and
- * BEFORE any handler that reads the registry.
- */
-export const seedRegistryMiddleware = () =>
-  createMiddleware<{ Bindings: Env; Variables: Variables }>(async (context, next) => {
-    const { registry, backrefMap } = await getHydratedRegistry(context.get('seedRepository'))
-    context.set('seedRegistry', registry)
-    context.set('getSeed', (slug: string) => registry.get(slug))
-    context.set('backrefMap', backrefMap)
-    await next()
-  })

package/src/middleware/storage.middleware.ts

@@ -1,25 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { createMiddleware } from 'hono/factory'
-import { BeechBucket } from '@beechcms/core'
-import { AppEnv } from '../types'
-import { createBucketProvider } from '../shared/storage/factory'
-
-interface StorageOverrides {
-  bucket?: BeechBucket
-}
-
-export const storageMiddleware = (overrides?: StorageOverrides) => {
-  return createMiddleware<AppEnv>(async (context, next) => {
-    if (overrides?.bucket) {
-      context.set('bucket', overrides.bucket)
-    } else {
-      // Determine base URL for getUrl() only if we need to create the provider
-      const baseUrl = context.env.MEDIA_BASE_URL?.trim().replace(/\/$/, '') || new URL(context.req.url).origin
-      context.set('bucket', createBucketProvider(context.env, baseUrl))
-    }
-    await next()
-  })
-}

package/src/middleware.ts

@@ -1,45 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-/// <reference types="@cloudflare/workers-types" />
-import type { Context, Next } from 'hono'
-import { HTTPException } from 'hono/http-exception'
-import type { Env, Variables } from './types'
-
-const UNAUTHORIZED_JSON = JSON.stringify({ error: 'Unauthorized' })
-
-function unauthorizedResponse() {
-  return new Response(UNAUTHORIZED_JSON, {
-    status: 401,
-    headers: { 'Content-Type': 'application/json' },
-  })
-}
-
-/**
- * JWT authentication middleware. Reads the Bearer token from the Authorization
- * header and delegates verification to the ITokenService injected in context.
- * Returns 401 on any missing or invalid token; never exposes failure details.
- */
-export function authMiddleware() {
-  return async (c: Context<{ Bindings: Env; Variables: Variables }>, next: Next): Promise<Response | void> => {
-    const authHeader = c.req.header('Authorization')
-    if (!authHeader?.startsWith('Bearer ')) {
-      throw new HTTPException(401, { res: unauthorizedResponse() })
-    }
-
-    const token = authHeader.slice(7)
-    if (!token) {
-      throw new HTTPException(401, { res: unauthorizedResponse() })
-    }
-
-    const claims = await c.get('tokenService').verify(token)
-
-    if (!claims) {
-      throw new HTTPException(401, { res: unauthorizedResponse() })
-    }
-
-    c.set('jwtPayload', claims)
-    await next()
-  }
-}

package/src/public/access-policy.ts

@@ -1,27 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import type { Seed } from '@beechcms/core'
-
-export type PublicOperation = 'read' | 'add' | 'edit'
-
-function isAllowed(seed: Seed, operation: PublicOperation): boolean {
-  if (operation === 'read') return seed.allowPublicRead === true
-  if (operation === 'add') return seed.allowPublicPost === true
-  return seed.allowPublicEdit === true
-}
-
-export function checkPublicOperation(seed: Seed, operation: PublicOperation) {
-  if (isAllowed(seed, operation)) {
-    return { ok: true } as const
-  }
-
-  return {
-    ok: false,
-    error: {
-      error: 'Forbidden',
-      message: `Public ${operation.toUpperCase()} is not allowed for content type '${seed.slug}'.`,
-    },
-  } as const
-}

package/src/public/api-key-middleware.ts

@@ -1,57 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import type { Context, Next } from 'hono'
-import { PUBLIC_ERRORS } from './public-errors'
-import { publicProblem } from './problem-details'
-
-type PublicBindings = {
-  PUBLIC_READ_API_KEY?: string
-  PUBLIC_WRITE_API_KEY?: string
-}
-
-function isReadMethod(method: string): boolean {
-  return method === 'GET' || method === 'HEAD' || method === 'OPTIONS'
-}
-
-function getConfiguredKey(env: PublicBindings, method: string): string | undefined {
-  if (isReadMethod(method)) {
-    return env.PUBLIC_READ_API_KEY
-  }
-  return env.PUBLIC_WRITE_API_KEY
-}
-
-/**
- * API key auth middleware for Public API routes.
- * Uses X-API-Key header only.
- */
-export function apiKeyMiddleware() {
-  return async (c: Context, next: Next): Promise<Response | void> => {
-    const env = c.env as PublicBindings
-    const configuredKey = getConfiguredKey(env, c.req.method)
-
-    if (!configuredKey) {
-      return publicProblem(c, {
-        type: 'public-api-not-configured',
-        title: PUBLIC_ERRORS.API_KEY_FORBIDDEN.error,
-        status: 403,
-        detail: PUBLIC_ERRORS.API_KEY_FORBIDDEN.message,
-      })
-    }
-
-    const providedKey = c.req.header('X-API-Key')
-
-    if (!providedKey || providedKey !== configuredKey) {
-      return publicProblem(c, {
-        type: 'public-api-key-unauthorized',
-        title: PUBLIC_ERRORS.API_KEY_UNAUTHORIZED.error,
-        status: 401,
-        detail: PUBLIC_ERRORS.API_KEY_UNAUTHORIZED.message,
-      })
-    }
-
-    await next()
-  }
-}
-

package/src/public/cache-utils.ts

@@ -1,38 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import type { Context } from 'hono'
-
-type EdgeCache = {
-  cache: Cache
-  executionCtx: { waitUntil: (p: Promise<unknown>) => void }
-} | null
-
-export function resolveEdgeCache(c: Context): EdgeCache {
-  try {
-    const cache = caches.default
-    let executionCtx: any
-    try {
-      executionCtx = c.executionCtx
-    } catch {
-      return null
-    }
-
-    if (!executionCtx?.waitUntil) return null
-    return { cache, executionCtx: executionCtx as { waitUntil: (p: Promise<unknown>) => void } }
-  } catch {
-    return null
-  }
-}
-
-export function withCachedResponse(edgeCache: EdgeCache, cacheKey: Request, response: Response): Response {
-  if (!edgeCache) return response
-  const cloned = response.clone()
-  const headers = new Headers(cloned.headers)
-  headers.set('Cache-Control', 'public, max-age=60')
-  edgeCache.executionCtx.waitUntil(
-    edgeCache.cache.put(cacheKey, new Response(cloned.body, { status: cloned.status, headers }))
-  )
-  return response
-}

package/src/public/entry-projection.ts

@@ -1,46 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { resolvePolicies } from '@beechcms/core'
-import type { Seed } from '@beechcms/core'
-
-const SYSTEM_FIELDS = ['id', 'slug', 'status', 'created_at', 'updated_at']
-const IDENTITY_FIELDS = ['id', 'slug']
-
-function applyPublicPolicies(data: Record<string, unknown>, seed: Seed): Record<string, unknown> {
-  const result: Record<string, unknown> = {}
-
-  for (const key of SYSTEM_FIELDS) {
-    if (key in data) result[key] = data[key]
-  }
-
-  for (const branch of seed.branches) {
-    const value = data[branch.alias]
-    const { public: isPublic, visibility } = resolvePolicies(branch)
-    if (!isPublic) continue
-    if (visibility === 'hidden') continue
-    result[branch.alias] = visibility === 'masked' && typeof value === 'string' && value.length > 0
-      ? '••••••••'
-      : value
-  }
-  return result
-}
-
-export function toFlatPublicEntry(data: Record<string, unknown>, seed: Seed, fieldsParam?: string): Record<string, unknown> {
-  const projected = applyPublicPolicies(data, seed)
-  const requestedFields = (fieldsParam ?? '').split(',').map(f => f.trim()).filter(Boolean)
-
-  if (requestedFields.length === 0) return projected
-
-  const filtered: Record<string, unknown> = {}
-  for (const field of requestedFields) {
-    if (field in projected) filtered[field] = projected[field]
-  }
-
-  for (const key of IDENTITY_FIELDS) {
-    if (key in projected && !filtered[key]) filtered[key] = projected[key]
-  }
-
-  return filtered
-}

package/src/public/idempotency.ts

@@ -1,23 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { sha256hex } from '@beechcms/core'
-
-export function parseIdempotencyKey(rawValue: string | undefined): string | null {
-  if (!rawValue) return null
-  const key = rawValue.trim()
-  if (!key || key.length > 128) return null
-  return key
-}
-
-type FingerprintInput = {
-  seedSlug: string
-  statusValue: unknown
-  slug: string | null
-  data: Record<string, unknown>
-}
-
-export function buildRequestFingerprint(input: FingerprintInput): Promise<string> {
-  return sha256hex(JSON.stringify({ seedSlug: input.seedSlug, statusValue: input.statusValue, slug: input.slug, data: input.data }))
-}

package/src/public/index.ts

@@ -1,16 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-export { apiKeyMiddleware } from './api-key-middleware'
-export { publicRateLimitMiddleware } from './rate-limit-middleware'
-export { publicRoutes } from './public-routes'
-export { PUBLIC_ERRORS } from './public-errors'
-export { sanitizePublicPayload } from './sanitize'
-export { generateEntrySlug, slugify } from './slug-utils'
-export { buildPublicListMeta, buildPublicSingleMeta } from './response-builder'
-export { parseLatestCount, parsePublicPagination } from './query-builder'
-export { publicReadHandler } from './public-read'
-export { publicAddHandler } from './public-add'
-export { publicEditHandler } from './public-edit'
-