@beechcms/api 0.6.0-preview.2 → 0.6.0-preview.3

package/src/features/email/templates/password-reset.ts

@@ -1,68 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import type { EmailLocale } from '../email.types'
-import { buildEmailShell } from './shell'
-
-/**
- * Localized texts for the password reset email.
- *
- * ─── ADDING A NEW LANGUAGE ──────────────────────────────────────────────────
- * 1. Add the ISO code in `SUPPORTED_EMAIL_LOCALES` (`email.types.ts`).
- * 2. Add a corresponding key in this object with all fields.
- *    TypeScript immediately reports missing keys thanks to
- *    `Record<EmailLocale, …>`.
- * ─────────────────────────────────────────────────────────────────────────────
- */
-const COPY: Record<EmailLocale, {
-  subject: string
-  title: string
-  body: string
-  ctaLabel: string
-  footer: string
-}> = {
-  en: {
-    subject: 'Reset your Beech CMS password',
-    title: 'Reset your password',
-    body: 'You requested a password reset for your Beech CMS account. Click the button below to set a new password. This link expires in 30 minutes.',
-    ctaLabel: 'Reset password',
-    footer: "If you didn't request this, you can safely ignore this email.",
-  },
-  it: {
-    subject: 'Reimposta la tua password Beech CMS',
-    title: 'Reimposta la tua password',
-    body: 'Hai richiesto il reset della password per il tuo account Beech CMS. Clicca il pulsante qui sotto per impostare una nuova password. Questo link scade tra 30 minuti.',
-    ctaLabel: 'Reimposta password',
-    footer: 'Se non hai richiesto questo, puoi ignorare questa email in tutta sicurezza.',
-  },
-}
-
-/**
- * Builds the email with the password reset link.
- *
- * Composes the localized content with the base layout (`buildEmailShell`)
- * injecting the CTA button pointing to the reset URL.
- *
- * @param resetUrl - Complete URL with the token in plain text, e.g.
- *                   `https://dashboard.beechcms.dev/reset-password?token=<uuid>`.
- *                   It is directly embedded in the CTA button — do not sanitize
- *                   further: the token is an internally generated UUID.
- * @param locale   - Language for the email subject and body.
- * @returns Object with `subject` (string) and `html` (complete HTML document).
- */
-export function buildPasswordResetEmail(
-  resetUrl: string,
-  locale: EmailLocale,
-): { subject: string; html: string } {
-  const c = COPY[locale]
-  return {
-    subject: c.subject,
-    html: buildEmailShell(locale, {
-      title: c.title,
-      body: c.body,
-      cta: { label: c.ctaLabel, href: resetUrl },
-      footer: c.footer,
-    }),
-  }
-}

package/src/features/email/templates/shell.ts

@@ -1,96 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import type { EmailLocale } from '../email.types'
-
-/**
- * Content slots that every template must provide to compose a complete email.
- * Each slot corresponds to a visual block in the email card layout.
- */
-export interface EmailShellSlots {
-  /**
-   * H2 heading shown at the top of the card. Keep it under ~50 characters
-   * to ensure good readability on mobile clients.
-   */
-  title: string
-
-  /**
-   * Main body text. Rendered as a paragraph.
-   * Safe inline HTML is allowed (e.g., `<strong>`, `<a href="...">`),
-   * but avoid block elements (`<p>`, `<div>`) that could break
-   * the layout structure in rigid email clients (Outlook, Gmail).
-   */
-  body: string
-
-  /**
-   * Optional call-to-action button, rendered as a dark link-button.
-   * Omit for notification-only emails that do not require user action.
-   */
-  cta?: { label: string; href: string }
-
-  /**
-   * Optional warning paragraph. Rendered in red (#ef4444) to attract
-   * attention. Use it for security alerts
-   * ("if it wasn't you, act immediately").
-   */
-  warning?: string
-
-  /**
-   * Small gray text at the bottom of the card.
-   * Used for notes like "automated notification, do not reply".
-   */
-  footer: string
-}
-
-/**
- * Builds the base HTML layout shared by all Beech CMS transactional emails.
- *
- * ─── SINGLE SOURCE OF TRUTH FOR BRANDING ─────────────────────────────────────
- * Modifying this function changes the visual appearance of ALL outgoing emails
- * simultaneously:
- *   - background and card color
- *   - border style and border-radius
- *   - typographic scale and spacing
- *   - CTA button style
- *
- * To change the text or structure of a specific email, instead modify
- * the corresponding template file (`templates/password-reset.ts`, etc.).
- * ─────────────────────────────────────────────────────────────────────────────
- *
- * @param locale - Used for the `lang` attribute of the `<html>` tag.
- * @param slots  - Content blocks injected into the layout.
- * @returns A complete and self-contained HTML document ready to be sent.
- */
-export function buildEmailShell(locale: EmailLocale, slots: EmailShellSlots): string {
-  const ctaBlock = slots.cta
-    ? `<a href="${slots.cta.href}"
-          style="display:inline-block;background:#111;color:#fff;padding:12px 24px;
-                 border-radius:6px;text-decoration:none;font-size:15px;font-weight:500;
-                 margin-bottom:24px">
-         ${slots.cta.label}
-       </a>`
-    : ''
-
-  const warningBlock = slots.warning
-    ? `<p style="margin:0 0 24px;color:#ef4444;font-size:15px;line-height:1.5;font-weight:500">
-         ${slots.warning}
-       </p>`
-    : ''
-
-  return `<!DOCTYPE html>
-<html lang="${locale}">
-<head>
-  <meta charset="UTF-8">
-  <meta name="viewport" content="width=device-width,initial-scale=1">
-</head>
-<body style="font-family:sans-serif;background:#f9f9f9;margin:0;padding:32px">
-  <div style="max-width:480px;margin:0 auto;background:#fff;border-radius:8px;
-              padding:32px;border:1px solid #e5e5e5">
-    <h2 style="margin:0 0 16px;font-size:20px;color:#111">${slots.title}</h2>
-    <p style="margin:0 0 24px;color:#555;font-size:15px;line-height:1.5">${slots.body}</p>
-    ${ctaBlock}${warningBlock}<p style="margin:0;color:#999;font-size:13px">${slots.footer}</p>
-  </div>
-</body>
-</html>`
-}

package/src/features/notifications/index.ts

@@ -1,5 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-export { notificationsApp } from './notifications.handler'

package/src/features/notifications/notifications.handler.ts

@@ -1,105 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-/// <reference types="@cloudflare/workers-types" />
-import { Hono } from 'hono'
-import type { Env, Variables } from '../../types'
-
-/**
- * Notifications Feature Handler.
- *
- * Manages retrieval, mark read/unread, and deletion of system notifications.
- * All persistence goes through the {@link INotificationRepository} injected
- * by `repositoryMiddleware`. The handler owns the HTTP concerns only:
- * ETag negotiation, status codes, error mapping.
- */
-const notificationsApp = new Hono<{ Bindings: Env; Variables: Variables }>()
-
-const NOTIFICATION_LIST_LIMIT = 50
-
-/**
- * GET /notifications
- *
- * Returns the most recent notifications. The ETag is built from aggregate
- * stats so unchanged inboxes return 304 without serialising the full list.
- */
-notificationsApp.get('/notifications', async (context) => {
-  try {
-    const notificationRepository = context.get('notificationRepository')
-    const notificationStats = await notificationRepository.stats()
-    const etagValue = `W/"${notificationStats.totalCount}-${notificationStats.latestCreatedAt}-${notificationStats.readCount}"`
-
-    const ifNoneMatch = context.req.header('If-None-Match')
-    if (ifNoneMatch === etagValue) {
-      return new Response(null, { status: 304 })
-    }
-
-    const notifications = await notificationRepository.list(NOTIFICATION_LIST_LIMIT)
-
-    context.header('ETag', etagValue)
-    context.header('Cache-Control', 'no-cache, must-revalidate')
-
-    return context.json(notifications)
-  } catch (error) {
-    console.error('[Notifications] Fetch error:', error)
-    return context.json({ error: 'Failed to fetch notifications' }, 500)
-  }
-})
-
-/**
- * PATCH /notifications/:id/read — mark a single notification as read.
- */
-notificationsApp.patch('/notifications/:id/read', async (context) => {
-  try {
-    const notificationId = context.req.param('id')
-    await context.get('notificationRepository').markRead(notificationId)
-    return context.json({ success: true })
-  } catch (error) {
-    console.error('[Notifications] Mark read error:', error)
-    return context.json({ error: 'Failed to update notification' }, 500)
-  }
-})
-
-/**
- * PATCH /notifications/:id/unread — mark a single notification as unread.
- */
-notificationsApp.patch('/notifications/:id/unread', async (context) => {
-  try {
-    const notificationId = context.req.param('id')
-    await context.get('notificationRepository').markUnread(notificationId)
-    return context.json({ success: true })
-  } catch (error) {
-    console.error('[Notifications] Mark unread error:', error)
-    return context.json({ error: 'Failed to update notification' }, 500)
-  }
-})
-
-/**
- * DELETE /notifications/:id — permanently remove a notification.
- */
-notificationsApp.delete('/notifications/:id', async (context) => {
-  try {
-    const notificationId = context.req.param('id')
-    await context.get('notificationRepository').delete(notificationId)
-    return context.json({ success: true })
-  } catch (error) {
-    console.error('[Notifications] Delete error:', error)
-    return context.json({ error: 'Failed to delete notification' }, 500)
-  }
-})
-
-/**
- * POST /notifications/mark-all-read — mark every notification as read.
- */
-notificationsApp.post('/notifications/mark-all-read', async (context) => {
-  try {
-    await context.get('notificationRepository').markAllRead()
-    return context.json({ success: true })
-  } catch (error) {
-    console.error('[Notifications] Mark all read error:', error)
-    return context.json({ error: 'Failed to update notifications' }, 500)
-  }
-})
-
-export { notificationsApp }

package/src/features/password-reset/index.ts

@@ -1,19 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-/// <reference types="@cloudflare/workers-types" />
-import { Hono } from 'hono'
-import type { Env, Variables } from '../../types'
-import { requestPasswordReset } from './request'
-import { resetPassword } from './reset'
-
-export const passwordResetApp = new Hono<{ Bindings: Env; Variables: Variables }>()
-
-// Feature flag: lets the dashboard know whether to show the forgot-password link
-passwordResetApp.get('/auth/features', (context) => {
-  return context.json({ passwordReset: context.env.EMAIL_PROVIDER === 'smtp' || Boolean(context.env.RESEND_API_KEY) })
-})
-
-passwordResetApp.post('/auth/forgot-password', requestPasswordReset)
-passwordResetApp.post('/auth/reset-password', resetPassword)

package/src/features/password-reset/request.ts

@@ -1,92 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-/// <reference types="@cloudflare/workers-types" />
-import type { Context } from 'hono'
-import type { Env, Variables } from '../../types'
-import { sendPasswordResetEmail, resolveEmailLocale } from '../email'
-import { sha256hex } from '@beechcms/core'
-import { getClientIp } from '../../shared/request-utils'
-
-const PASSWORD_RESET_TOKEN_EXPIRY_SECONDS = 30 * 60
-
-/**
- * Handles the password reset request.
- * Generates a reset token, stores its hash in the database, and sends an email to the user.
- */
-export async function requestPasswordReset(
-  context: Context<{ Bindings: Env; Variables: Variables }>
-): Promise<Response> {
-  const { env, req } = context
-
-  const useSmtp = env.EMAIL_PROVIDER === 'smtp'
-  if (!useSmtp && !env.RESEND_API_KEY) {
-    return context.json({ error: 'Service not available' }, 503)
-  }
-
-  let payload: Record<string, unknown>
-  try {
-    payload = await req.json()
-  } catch {
-    return context.json({ error: 'Invalid request body' }, 400)
-  }
-
-  const emailInput = payload.email
-  if (typeof emailInput !== 'string' || !emailInput.trim()) {
-    return context.json({ error: 'Invalid request' }, 400)
-  }
-
-  const normalizedEmail = emailInput.trim().toLowerCase()
-  const emailLocale = resolveEmailLocale(payload.locale)
-
-  const clientIpAddress = getClientIp(req)
-  const forgotPasswordRateLimit = await context.get('rateLimiters').getLimiter('forgotPassword').checkLimit(clientIpAddress)
-  if (!forgotPasswordRateLimit.isAllowed) {
-    return context.json({ error: 'Too many requests' }, 429)
-  }
-
-  // Always return 200 even when the user is not found to prevent user enumeration.
-  const registeredUser = await context.get('userRepository').findByEmail(normalizedEmail)
-  if (!registeredUser) {
-    return context.json({ success: true })
-  }
-
-  const nowTimestamp = Math.floor(Date.now() / 1000)
-  await context.get('passwordResetTokenRepository').invalidatePending(registeredUser.id, nowTimestamp)
-
-  const resetToken = crypto.randomUUID()
-  const tokenHash = await sha256hex(resetToken)
-  const expiresAt = nowTimestamp + PASSWORD_RESET_TOKEN_EXPIRY_SECONDS
-
-  await context.get('passwordResetTokenRepository').create({
-    userId: registeredUser.id,
-    tokenHash,
-    expiresAt,
-  })
-
-  const baseUrl = (env.APP_URL ?? new URL(req.url).origin).replace(/\/$/, '')
-  const resetUrl = `${baseUrl}/admin/reset-password?token=${resetToken}`
-
-  const smtpBaseUrl = env.SMTP_HOST
-    ? `http://${env.SMTP_HOST}:${env.SMTP_PORT ?? '8025'}`
-    : undefined
-  try {
-    await sendPasswordResetEmail({
-      to: normalizedEmail,
-      resetUrl,
-      locale: emailLocale,
-      apiKey: env.RESEND_API_KEY ?? '',
-      from: env.EMAIL_FROM,
-      isDev: env.ENV !== 'production',
-      provider: env.EMAIL_PROVIDER as 'smtp' | 'resend' | undefined,
-      smtpBaseUrl,
-    })
-  } catch (error) {
-    if (env.ENV !== 'production') {
-      console.error('[password-reset] Failed to send email:', error)
-    }
-  }
-
-  return context.json({ success: true })
-}

package/src/features/password-reset/reset.ts

@@ -1,102 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-/// <reference types="@cloudflare/workers-types" />
-import type { Context } from 'hono'
-import type { Env, Variables } from '../../types'
-import { sendPasswordChangedEmail, resolveEmailLocale } from '../email'
-import { sha256hex } from '@beechcms/core'
-import { getClientIp } from '../../shared/request-utils'
-
-const MIN_PASSWORD_LENGTH = 8
-const MAX_PASSWORD_LENGTH = 128
-
-/**
- * Handles the actual password reset process using a valid token.
- */
-export async function resetPassword(
-  context: Context<{ Bindings: Env; Variables: Variables }>
-): Promise<Response> {
-  const { env, req, executionCtx } = context
-
-  const useSmtp = env.EMAIL_PROVIDER === 'smtp'
-  if (!useSmtp && !env.RESEND_API_KEY) {
-    return context.json({ error: 'Service not available' }, 503)
-  }
-
-  const clientIpAddress = getClientIp(req)
-  const resetPasswordRateLimit = await context.get('rateLimiters').getLimiter('resetPassword').checkLimit(clientIpAddress)
-  if (!resetPasswordRateLimit.isAllowed) {
-    return context.json({ error: 'Too many requests' }, 429)
-  }
-
-  let payload: Record<string, unknown>
-  try {
-    payload = await req.json()
-  } catch {
-    return context.json({ error: 'Invalid request body' }, 400)
-  }
-
-  const resetToken = payload.token
-  if (typeof resetToken !== 'string' || !resetToken) {
-    return context.json({ error: 'Invalid or expired token' }, 400)
-  }
-
-  const newPassword = payload.password
-  const isPasswordInvalid =
-    typeof newPassword !== 'string' ||
-    newPassword.length < MIN_PASSWORD_LENGTH ||
-    newPassword.length > MAX_PASSWORD_LENGTH
-
-  if (isPasswordInvalid) {
-    return context.json({
-      error: `Password must be between ${MIN_PASSWORD_LENGTH} and ${MAX_PASSWORD_LENGTH} characters`,
-    }, 400)
-  }
-
-  const emailLocale = resolveEmailLocale(payload.locale)
-  const tokenHash = await sha256hex(resetToken as string)
-  const nowTimestamp = Math.floor(Date.now() / 1000)
-
-  const tokenRecord = await context.get('passwordResetTokenRepository').findValidByHashWithEmail(tokenHash, nowTimestamp)
-  if (!tokenRecord) {
-    return context.json({ error: 'Invalid or expired token' }, 400)
-  }
-
-  const hashedNewPassword = await context.get('hashProvider').hash(newPassword as string)
-
-  await context.get('passwordResetTokenRepository').markUsed(tokenRecord.id, nowTimestamp)
-  await context.get('userRepository').updatePasswordHash(tokenRecord.userId, hashedNewPassword)
-  await context.get('sessionRepository').revokeAllForUser(tokenRecord.userId, nowTimestamp)
-
-  const smtpBaseUrl = env.SMTP_HOST
-    ? `http://${env.SMTP_HOST}:${env.SMTP_PORT ?? '8025'}`
-    : undefined
-  const sendNotification = async () => {
-    try {
-      await sendPasswordChangedEmail({
-        to: tokenRecord.email,
-        locale: emailLocale,
-        apiKey: env.RESEND_API_KEY ?? '',
-        from: env.EMAIL_FROM,
-        isDev: env.ENV !== 'production',
-        provider: env.EMAIL_PROVIDER as 'smtp' | 'resend' | undefined,
-        smtpBaseUrl,
-      })
-    } catch (error) {
-      if (env.ENV !== 'production') {
-        console.error('[password-reset] Failed to send password change notification:', error)
-      }
-    }
-  }
-
-  try {
-    executionCtx.waitUntil(sendNotification())
-  } catch {
-    // executionCtx might not be available in some testing environments
-    void sendNotification()
-  }
-
-  return context.json({ success: true })
-}

package/src/features/rotate-field/index.ts

@@ -1,5 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-export { rotateFieldApp } from './rotate-field.handler'

package/src/features/rotate-field/rotate-field.handler.ts

@@ -1,132 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-/// <reference types="@cloudflare/workers-types" />
-import { Hono } from 'hono'
-import { resolvePolicies, verifyHashField, sha256hex, validateAndSanitizeSeedPayload, EntryNotFoundError } from '@beechcms/core'
-import { publicProblem } from '../../public/problem-details'
-import { rotateFieldRequestSchema } from './rotate-field.schema'
-import type { Env, Variables } from '../../types'
-
-const rotateFieldApp = new Hono<{ Bindings: Env; Variables: Variables }>()
-
-rotateFieldApp.post('/:slug/:id/rotate-field', async (context) => {
-  const seedSlug = context.req.param('slug')
-  const entryId = context.req.param('id')
-
-  const seed = context.get('getSeed')(seedSlug)
-  if (!seed) {
-    return publicProblem(context, { 
-      type: 'content-seed-not-found', 
-      title: 'Not Found', 
-      status: 404, 
-      detail: `Seed '${seedSlug}' not found` 
-    })
-  }
-
-  let requestBody: unknown
-  try {
-    requestBody = await context.req.json()
-  } catch {
-    return publicProblem(context, { 
-      type: 'rotate-field-invalid-json', 
-      title: 'Bad Request', 
-      status: 400, 
-      detail: 'Invalid JSON body' 
-    })
-  }
-
-  const parsedRequestBody = rotateFieldRequestSchema.safeParse(requestBody)
-  if (!parsedRequestBody.success) {
-    return publicProblem(context, { 
-      type: 'rotate-field-invalid-body', 
-      title: 'Bad Request', 
-      status: 400, 
-      detail: parsedRequestBody.error.issues[0]?.message ?? 'Invalid body' 
-    })
-  }
-
-  const { fieldAlias, currentValue, nextValue } = parsedRequestBody.data
-
-  const targetFieldBranch = seed.branches.find((branch) => branch.alias === fieldAlias)
-  if (!targetFieldBranch) {
-    return publicProblem(context, { 
-      type: 'rotate-field-unknown-field', 
-      title: 'Bad Request', 
-      status: 400, 
-      detail: `Field '${fieldAlias}' does not exist in seed '${seedSlug}'` 
-    })
-  }
-
-  const { privacy } = resolvePolicies(targetFieldBranch)
-  if (privacy !== 'hash') {
-    return publicProblem(context, { 
-      type: 'rotate-field-not-hashable', 
-      title: 'Unprocessable Entity', 
-      status: 422, 
-      detail: `Field '${fieldAlias}' does not use hash privacy and cannot be rotated with this endpoint` 
-    })
-  }
-
-  let contentRecord: Record<string, unknown>
-  try {
-    contentRecord = await context.get('repository').findById(seed, entryId)
-  } catch (error) {
-    if (error instanceof EntryNotFoundError) {
-      return publicProblem(context, {
-        type: 'content-not-found',
-        title: 'Not Found',
-        status: 404,
-        detail: `Entry '${entryId}' not found`
-      })
-    }
-    throw error
-  }
-
-  const storedFieldValueHash = contentRecord[targetFieldBranch.alias]
-
-  if (typeof storedFieldValueHash !== 'string' || storedFieldValueHash.length === 0) {
-    return publicProblem(context, { 
-      type: 'rotate-field-not-set', 
-      title: 'Unprocessable Entity', 
-      status: 422, 
-      detail: `Field '${fieldAlias}' has no stored value to rotate` 
-    })
-  }
-
-  const isCurrentValueValid = await verifyHashField(storedFieldValueHash, currentValue)
-  if (!isCurrentValueValid) {
-    return publicProblem(context, { 
-      type: 'rotate-field-current-mismatch', 
-      title: 'Forbidden', 
-      status: 403, 
-      detail: 'Current value does not match stored value' 
-    })
-  }
-
-  const fieldValidationResult = validateAndSanitizeSeedPayload(
-    seed, 
-    { [fieldAlias]: nextValue },
-    { operation: 'update', allowNull: false, requireAtLeastOneValidField: true, enforceRequiredFields: false }
-  )
-
-  if (fieldValidationResult.details.length > 0) {
-    return publicProblem(context, { 
-      type: 'rotate-field-invalid-next', 
-      title: 'Bad Request', 
-      status: 400, 
-      detail: `Invalid value for field '${fieldAlias}': ${fieldValidationResult.details[0]?.message ?? 'validation failed'}` 
-    })
-  }
-
-  const newFieldValueHash = await sha256hex(nextValue)
-
-  await context.get('repository').update(seed, entryId, { [targetFieldBranch.alias]: newFieldValueHash })
-
-  return context.json({ success: true })
-})
-
-
-export { rotateFieldApp }
-

package/src/features/rotate-field/rotate-field.schema.ts

@@ -1,17 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { z } from 'zod'
-
-/**
- * Schema for rotating a hashed field value.
- * Used to update fields that have 'hash' privacy (e.g., passwords, PINs).
- */
-export const rotateFieldRequestSchema = z.object({
-  fieldAlias: z.string().min(1, "The field alias is required"),
-  currentValue: z.string().min(1, "The current value is required"),
-  nextValue: z.string().min(1, "The new value is required"),
-})
-
-export type RotateFieldRequest = z.infer<typeof rotateFieldRequestSchema>