@beechcms/api 0.6.0-preview.4 → 0.6.0

package/dist/index.js

@@ -4,7 +4,7 @@ import { cors } from "hono/cors";
 import { getCookie, setCookie, deleteCookie } from "hono/cookie";
 import { sha256hex as sha256hex7, SystemClock as SystemClock6, SystemIdGenerator as SystemIdGenerator4 } from "@beechcms/core";
 
-// src/shared/request-utils.ts
+// src/shared/utils/request-utils.ts
 var CLOUDFLARE_CLIENT_IP_HEADER = "cf-connecting-ip";
 var UNKNOWN_IP = "unknown";
 function getClientIp(request) {
@@ -22,11 +22,12 @@ var AUTH_ERRORS = {
   RATE_LIMIT_EXCEEDED: "Too many requests"
 };
 
-// src/auth/login.ts
+// src/auth/utils/login-helpers.ts
 var EMAIL_REGEX = /^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/;
 var MAX_EMAIL_LENGTH = 254;
 var MIN_PASSWORD_LENGTH = 8;
 var MAX_PASSWORD_LENGTH = 128;
+var MAX_PASSWORD_BYTES = 72;
 var DUMMY_PASSWORD_HASH = "$2a$10$SbkRFOafACxVM2ahxerVDu3tSkCXWm29b62WdB.4WGG02Qjsfzni6";
 function parseLoginBody(body) {
   if (body === null || typeof body !== "object") return null;
@@ -38,20 +39,20 @@ function parseLoginBody(body) {
   return { email: email.trim(), password };
 }
 function validateLoginInput(email, password) {
-  return email.length <= MAX_EMAIL_LENGTH && EMAIL_REGEX.test(email) && password.trim().length >= MIN_PASSWORD_LENGTH && password.length <= MAX_PASSWORD_LENGTH;
+  return email.length <= MAX_EMAIL_LENGTH && EMAIL_REGEX.test(email) && password.trim().length >= MIN_PASSWORD_LENGTH && password.length <= MAX_PASSWORD_LENGTH && new TextEncoder().encode(password).length <= MAX_PASSWORD_BYTES;
 }
 async function verifyPassword(plainPassword, hash, hashProvider) {
   return hashProvider.verify(plainPassword, hash);
 }
 
-// src/auth/refresh.ts
+// src/auth/utils/refresh-token.ts
 function generateRefreshToken() {
   const bytes = new Uint8Array(32);
   crypto.getRandomValues(bytes);
   return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
 
-// src/middleware.ts
+// src/middleware/auth.middleware.ts
 import { HTTPException } from "hono/http-exception";
 var UNAUTHORIZED_JSON = JSON.stringify({ error: "Unauthorized" });
 function unauthorizedResponse() {
@@ -80,9 +81,9 @@ function authMiddleware() {
 }
 
 // src/features/content/index.ts
-import { Hono as Hono2 } from "hono";
+import { Hono } from "hono";
 
-// src/shared/query-utils.ts
+// src/shared/utils/query-utils.ts
 var QUERY_FILTER_OPERATOR_SET = /* @__PURE__ */ new Set([
   "eq",
   "gt",
@@ -163,7 +164,7 @@ function toEngineFilters(groups) {
   }));
 }
 
-// src/shared/apply-policies.ts
+// src/shared/policies/apply-policies.ts
 import { resolvePolicies, sha256hex } from "@beechcms/core";
 var PrivacyPolicyError = class extends Error {
   status = 501;
@@ -277,7 +278,8 @@ function publicProblem(c, input) {
     body.errors = input.errors;
   }
   return c.json(body, input.status, {
-    "Content-Type": "application/problem+json"
+    "Content-Type": "application/problem+json",
+    ...input.headers
   });
 }
 
@@ -296,6 +298,7 @@ var CONTENT_ERRORS = {
 };
 
 // src/features/content/handlers/list.ts
+import { resolveKanbanConfig } from "@beechcms/core";
 async function buildRelationsMap(context, seed, entries) {
   const relationBranches = seed.branches.filter(
     (b) => b.type === "relation"
@@ -374,12 +377,44 @@ async function listHandler(context) {
     const limit = Math.min(parsePositiveInt(query.limit, 25), 100);
     const offset = (page - 1) * limit;
     const orderBy = sortBy ? { column: sortBy, dir: sortDirRaw === "desc" ? "DESC" : "ASC" } : void 0;
+    const kanbanAxis = cleanStr(query.kanbanAxis);
+    let kanbanOrder;
+    if (kanbanAxis) {
+      const compat = resolveKanbanConfig(seed);
+      if (!compat.compatible || !compat.candidates.some((c) => c.branchId === kanbanAxis)) {
+        return publicProblem(context, {
+          type: "content-invalid-kanban-axis",
+          title: "Bad Request",
+          status: 400,
+          detail: "kanbanAxis is not a valid candidate for this seed"
+        });
+      }
+      kanbanOrder = { seedSlug: slug, axisBranchId: kanbanAxis };
+    }
+    let allFilters = engineFilters;
+    if (kanbanOrder) {
+      const rawFilters2 = cleanStr(query.filters);
+      if (rawFilters2) {
+        try {
+          const parsed = JSON.parse(rawFilters2);
+          if (Array.isArray(parsed)) {
+            allFilters = parsed.filter(
+              (g) => g !== null && typeof g === "object" && typeof g.column === "string" && Array.isArray(g.conditions)
+            );
+          }
+        } catch {
+        }
+      } else {
+        allFilters = [];
+      }
+    }
     const repository = context.get("repository");
     const { items, total } = await repository.findMany(seed, {
-      filters: engineFilters,
-      orderBy,
+      filters: allFilters,
+      orderBy: kanbanOrder ? void 0 : orderBy,
       search: search || void 0,
-      pagination: { limit, offset }
+      pagination: { limit, offset },
+      kanbanOrder
     });
     const entries = await Promise.all(items.map(async (item) => {
       let hasPendingDraft = false;
@@ -393,7 +428,7 @@ async function listHandler(context) {
         // Repository returns "pure" data including system fields
       };
     }));
-    const hasQueryParams = Boolean(search) || Boolean(sortBy) || Boolean(query.filters) || query.page !== void 0 || query.limit !== void 0;
+    const hasQueryParams = Boolean(search) || Boolean(sortBy) || Boolean(query.filters) || Boolean(kanbanAxis) || query.page !== void 0 || query.limit !== void 0;
     if (!hasQueryParams) {
       return context.json(entries);
     }
@@ -822,173 +857,47 @@ async function updateHandler(context) {
   }
 }
 
-// src/upload.ts
-import { Hono } from "hono";
-import { isMimeAccepted } from "@beechcms/core";
-var DEFAULT_MAX_UPLOAD_BYTES = 50 * 1024 * 1024;
-var ABSOLUTE_MAX_UPLOAD_BYTES = 500 * 1024 * 1024;
-var PRESIGN_TTL_SECONDS = 900;
-function resolveMaxUploadBytes(env) {
-  const raw = env.MAX_UPLOAD_BYTES;
-  if (!raw) return DEFAULT_MAX_UPLOAD_BYTES;
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_MAX_UPLOAD_BYTES;
-  return Math.min(parsed, ABSOLUTE_MAX_UPLOAD_BYTES);
-}
-function sanitizeFilename(name) {
-  const base = name.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 100);
-  return base || "file";
-}
-function generateObjectKey(originalName) {
-  const timestamp = Math.floor(Date.now() / 1e3);
-  return `${timestamp}-${sanitizeFilename(originalName)}`;
-}
+// src/shared/storage/upload.ts
 async function deleteR2Objects(c, objectKeys) {
   const { bucket, mediaRepository, systemStatsRepository } = c.var;
-  for (const key of objectKeys) {
-    const media = await mediaRepository.getByKey(key).catch(() => null);
-    const size = media?.size_bytes ?? 0;
-    try {
+  await Promise.all(
+    objectKeys.map(async (key) => {
+      const media = await mediaRepository.getByKey(key).catch(() => null);
+      if (!media) {
+        throw new Error(`Media object not found: ${key}`);
+      }
+      const size = media.size_bytes ?? 0;
       await bucket.delete(key);
-    } catch (err) {
-      console.warn(`Failed to delete storage object: ${key}`, err);
-    }
-    try {
-      await mediaRepository.untrack(key);
-      if (size > 0) await systemStatsRepository.decrementStorage(size);
-    } catch (err) {
-      console.warn(`Failed to untrack media object: ${key}`, err);
-    }
-  }
-}
-var uploadRoutes = new Hono();
-uploadRoutes.post("/upload/presign", async (c) => {
-  let body;
-  try {
-    body = await c.req.json();
-  } catch {
-    return c.json({ error: "Invalid JSON body" }, 400);
-  }
-  const { filename, mimeType, sizeBytes } = body;
-  if (typeof filename !== "string" || !filename.trim()) return c.json({ error: "filename is required" }, 400);
-  if (typeof mimeType !== "string" || !mimeType.trim()) return c.json({ error: "mimeType is required" }, 400);
-  if (typeof sizeBytes !== "number" || !Number.isFinite(sizeBytes) || sizeBytes <= 0) {
-    return c.json({ error: "sizeBytes must be a positive number" }, 400);
-  }
-  const maxBytes = resolveMaxUploadBytes(c.env);
-  if (sizeBytes > maxBytes) return c.json({ error: `File too large. Max ${maxBytes} bytes` }, 400);
-  if (!isMimeAccepted(mimeType, "any")) return c.json({ error: "File type not allowed" }, 400);
-  const key = generateObjectKey(filename);
-  const uploadUrl = await c.var.bucket.presignPut(key, {
-    expiresIn: PRESIGN_TTL_SECONDS,
-    contentType: mimeType,
-    contentLength: sizeBytes
-  });
-  return c.json({ uploadUrl, key, expiresIn: PRESIGN_TTL_SECONDS }, 200);
-});
-uploadRoutes.post("/upload/confirm", async (c) => {
-  const { bucket, mediaRepository: mediaRepo, systemStatsRepository: statsRepo } = c.var;
-  let body;
-  try {
-    body = await c.req.json();
-  } catch {
-    return c.json({ error: "Invalid JSON body" }, 400);
-  }
-  const { key } = body;
-  if (typeof key !== "string" || !key.trim()) return c.json({ error: "key is required" }, 400);
-  const existing = await mediaRepo.getByKey(key);
-  if (existing) return c.json({ url: bucket.getUrl(key) }, 200);
-  const head = await bucket.head(key);
-  if (!head) return c.json({ error: "Object not found in storage" }, 404);
-  const uploadedBy = c.var.jwtPayload?.sub ?? "";
-  const size = head.size ?? 0;
-  const mime = head.contentType ?? "application/octet-stream";
-  const filename = key.replace(/^\d+-/, "") || key;
-  await statsRepo.incrementStorage(size);
-  await mediaRepo.trackUpload({
-    key,
-    filename,
-    mime_type: mime,
-    size_bytes: size,
-    uploaded_by: uploadedBy
-  });
-  const jwtPayload = c.get("jwtPayload");
-  if (jwtPayload) {
-    c.get("activityLogger").log({
-      action: "upload",
-      entityType: "media",
-      entityId: key,
-      details: { name: filename, size, type: mime },
-      actor: {
-        id: jwtPayload.sub,
-        email: jwtPayload.email ?? "unknown",
-        name: [jwtPayload.name, jwtPayload.surname].filter(Boolean).join(" ") || null
+      try {
+        await mediaRepository.untrack(key);
+        if (size > 0) {
+          await systemStatsRepository.decrementStorage(size);
+        }
+      } catch (err) {
+        console.warn(`Failed to untrack media object: ${key}`, err);
       }
-    });
-  }
-  return c.json({ url: bucket.getUrl(key) }, 200);
-});
-uploadRoutes.get("/upload/download-url/:key", async (c) => {
-  const key = decodeURIComponent(c.req.param("key") ?? "");
-  if (!key) return c.json({ error: "Missing key" }, 400);
-  const head = await c.var.bucket.head(key);
-  if (!head) return c.json({ error: "Object not found" }, 404);
-  const downloadUrl = await c.var.bucket.presignGet(key, { expiresIn: PRESIGN_TTL_SECONDS });
-  return c.json({ downloadUrl, expiresIn: PRESIGN_TTL_SECONDS }, 200);
-});
-uploadRoutes.delete("/upload/:key", async (c) => {
-  const key = c.req.param("key");
-  if (!key) return c.json({ error: "Missing key" }, 400);
-  await deleteR2Objects(c, [decodeURIComponent(key)]);
-  return c.json({ success: true }, 200);
-});
-var FORCE_DOWNLOAD_MIME_PREFIXES = [
-  "image/svg",
-  // image/svg+xml, image/svg
-  "text/",
-  // text/html, text/xml, text/javascript, …
-  "application/xml",
-  "application/xhtml",
-  "application/javascript",
-  "application/x-javascript"
-];
-function isActiveMimeType(mime) {
-  const lower = mime.toLowerCase();
-  return FORCE_DOWNLOAD_MIME_PREFIXES.some((prefix) => lower.startsWith(prefix));
+    })
+  );
 }
-async function serveMediaHandler(c) {
-  const key = c.req.param("key");
-  if (!key) return new Response("Missing key", { status: 400 });
-  try {
-    const object = await c.var.bucket.get(decodeURIComponent(key));
-    if (!object) return new Response("Not found", { status: 404 });
-    const headers = new Headers();
-    const originalMime = object.contentType ?? "application/octet-stream";
-    if (isActiveMimeType(originalMime)) {
-      headers.set("Content-Type", "application/octet-stream");
-      headers.set("Content-Disposition", "attachment");
-    } else {
-      headers.set("Content-Type", originalMime);
+
+// src/shared/utils/media-utils.ts
+var MEDIA_URL_PATTERN = /\/api\/media\/([^?#]+)/;
+function extractMediaKey(mediaUrl, cdnUrl) {
+  const urlStr = String(mediaUrl);
+  if (cdnUrl) {
+    const normalizedCdn = cdnUrl.replace(/\/$/, "");
+    if (urlStr.startsWith(normalizedCdn)) {
+      const keyPart = urlStr.slice(normalizedCdn.length).replace(/^\//, "");
+      const keyWithoutQuery = keyPart.split(/[?#]/)[0];
+      return keyWithoutQuery ? decodeURIComponent(keyWithoutQuery) : null;
     }
-    headers.set("Content-Security-Policy", "default-src 'none'; sandbox");
-    headers.set("X-Content-Type-Options", "nosniff");
-    headers.set("Cache-Control", "public, max-age=31536000, immutable");
-    return new Response(object.body, { status: 200, headers });
-  } catch (err) {
-    console.error(`[serveMediaHandler] Error serving file ${key}:`, err);
-    return new Response("Internal error", { status: 500 });
   }
-}
-
-// src/media-utils.ts
-var MEDIA_URL_PATTERN = /\/api\/media\/([^/?#]+)/;
-function extractMediaKey(mediaUrl) {
-  const match = MEDIA_URL_PATTERN.exec(String(mediaUrl));
+  const match = MEDIA_URL_PATTERN.exec(urlStr);
   return match ? decodeURIComponent(match[1]) : null;
 }
-function collectMediaKeysRecursive(value, collectedKeys) {
+function collectMediaKeysRecursive(value, collectedKeys, cdnUrl) {
   if (typeof value === "string") {
-    const r2Key = extractMediaKey(value);
+    const r2Key = extractMediaKey(value, cdnUrl);
     if (r2Key) {
       collectedKeys.add(r2Key);
       return;
@@ -996,29 +905,29 @@ function collectMediaKeysRecursive(value, collectedKeys) {
     try {
       const parsed = JSON.parse(value);
       if (parsed !== value) {
-        collectMediaKeysRecursive(parsed, collectedKeys);
+        collectMediaKeysRecursive(parsed, collectedKeys, cdnUrl);
       }
     } catch {
     }
     return;
   }
   if (Array.isArray(value)) {
-    for (const item of value) collectMediaKeysRecursive(item, collectedKeys);
+    for (const item of value) collectMediaKeysRecursive(item, collectedKeys, cdnUrl);
     return;
   }
   if (value != null && typeof value === "object") {
     for (const nestedValue of Object.values(value)) {
-      collectMediaKeysRecursive(nestedValue, collectedKeys);
+      collectMediaKeysRecursive(nestedValue, collectedKeys, cdnUrl);
     }
   }
 }
-function extractMediaKeysFromData(seed, entryData) {
+function extractMediaKeysFromData(seed, entryData, cdnUrl) {
   const r2Keys = /* @__PURE__ */ new Set();
   for (const branch of seed.branches) {
     if (branch.type !== "file" && branch.type !== "json") continue;
     const fieldValue = entryData[branch.alias];
     if (fieldValue == null) continue;
-    collectMediaKeysRecursive(fieldValue, r2Keys);
+    collectMediaKeysRecursive(fieldValue, r2Keys, cdnUrl);
   }
   return [...r2Keys];
 }
@@ -1052,7 +961,8 @@ async function deleteHandler(context) {
     const title = row.title || row.name || entryId;
     logContentActivity(context, "delete", entryId, schemaSlug, String(title));
     dispatchContentAutomation(context, schemaSlug, "delete", { ...row, id: entryId });
-    const r2ObjectKeys = extractMediaKeysFromData(seed, row);
+    const cdnUrl = context.env.MEDIA_CDN_URL;
+    const r2ObjectKeys = extractMediaKeysFromData(seed, row, cdnUrl);
     if (r2ObjectKeys.length > 0) {
       await deleteR2Objects(context, r2ObjectKeys).catch((error) => {
         if (context.env.ENV !== "production") {
@@ -1214,7 +1124,7 @@ async function bulkHandler(context) {
     }
   }
   const repository = context.get("repository");
-  const { updated, failed } = await repository.bulkUpdate(slug, ids, resolvedFields);
+  const { updated, failed } = await repository.bulkUpdate(seed, ids, resolvedFields);
   const jwtPayload = context.get("jwtPayload");
   context.get("activityLogger").log({
     action: "bulk_update",
@@ -1239,8 +1149,156 @@ async function bulkHandler(context) {
   return context.json({ updated, failed: failedProblems });
 }
 
+// src/features/content/handlers/kanban-position.ts
+import { resolveKanbanConfig as resolveKanbanConfig2 } from "@beechcms/core";
+async function kanbanPositionHandler(context) {
+  const slug = context.req.param("slug");
+  const id = context.req.param("id");
+  if (!slug || !id) {
+    return publicProblem(context, { type: "content-invalid-slug-or-id", title: "Bad Request", status: 400, detail: CONTENT_ERRORS.INVALID_SLUG_OR_ID });
+  }
+  const seed = context.get("getSeed")(slug);
+  if (!seed) {
+    return publicProblem(context, { type: "content-seed-not-found", title: "Not Found", status: 404, detail: CONTENT_ERRORS.SEED_NOT_FOUND });
+  }
+  let body;
+  try {
+    body = await context.req.json();
+  } catch {
+    return publicProblem(context, { type: "content-invalid-body", title: "Bad Request", status: 400, detail: "Invalid JSON body" });
+  }
+  const { position, axisBranchId } = body;
+  if (typeof position !== "string" || !position || typeof axisBranchId !== "string" || !axisBranchId) {
+    return publicProblem(context, { type: "content-invalid-body", title: "Bad Request", status: 400, detail: "position and axisBranchId are required strings" });
+  }
+  const compat = resolveKanbanConfig2(seed);
+  if (!compat.compatible || !compat.candidates.some((c) => c.branchId === axisBranchId)) {
+    return publicProblem(context, { type: "content-invalid-kanban-axis", title: "Bad Request", status: 400, detail: "axisBranchId is not a valid kanban candidate for this seed" });
+  }
+  const entry = await context.get("repository").findById(seed, id);
+  if (!entry) {
+    return publicProblem(context, { type: "content-not-found", title: "Not Found", status: 404, detail: CONTENT_ERRORS.NOT_FOUND });
+  }
+  await context.get("kanbanPositionRepository").setPosition(slug, id, axisBranchId, position);
+  return context.json({ success: true });
+}
+
+// src/features/content/handlers/kanban-move.ts
+import {
+  resolveKanbanConfig as resolveKanbanConfig3,
+  validateAndSanitizeSeedPayload as validateAndSanitizeSeedPayload3
+} from "@beechcms/core";
+async function kanbanMoveHandler(context) {
+  const slug = context.req.param("slug");
+  const id = context.req.param("id");
+  if (!slug || !id) {
+    return publicProblem(context, { type: "content-invalid-slug-or-id", title: "Bad Request", status: 400, detail: CONTENT_ERRORS.INVALID_SLUG_OR_ID });
+  }
+  const seed = context.get("getSeed")(slug);
+  if (!seed) {
+    return publicProblem(context, { type: "content-seed-not-found", title: "Not Found", status: 404, detail: CONTENT_ERRORS.SEED_NOT_FOUND });
+  }
+  let body;
+  try {
+    const raw = await context.req.json();
+    if (typeof raw.position !== "string" || !raw.position || typeof raw.axisBranchId !== "string" || !raw.axisBranchId) {
+      throw new Error("invalid");
+    }
+    body = raw;
+  } catch {
+    return publicProblem(context, { type: "content-invalid-body", title: "Bad Request", status: 400, detail: "position and axisBranchId are required strings" });
+  }
+  const compat = resolveKanbanConfig3(seed);
+  const candidate = compat.candidates.find((c) => c.branchId === body.axisBranchId);
+  if (!compat.compatible || !candidate) {
+    return publicProblem(context, { type: "content-invalid-kanban-axis", title: "Bad Request", status: 400, detail: "axisBranchId is not a valid kanban candidate for this seed" });
+  }
+  const axisBranch = seed.branches.find((b) => b.id === body.axisBranchId);
+  const repository = context.get("repository");
+  let current;
+  try {
+    current = await repository.findById(seed, id);
+  } catch {
+    return publicProblem(context, { type: "content-not-found", title: "Not Found", status: 404, detail: CONTENT_ERRORS.NOT_FOUND });
+  }
+  let patch = null;
+  if (body.axis) {
+    if (body.axis.kind === "scalar") {
+      const rawValue = body.axis.value;
+      const coerced = axisBranch.type === "boolean" && rawValue !== null ? rawValue === "true" : rawValue;
+      patch = { [axisBranch.alias]: coerced };
+    } else {
+      const currentTags = current[axisBranch.alias] ?? [];
+      const { oldValue, newValue } = body.axis;
+      const withoutOld = oldValue !== null ? currentTags.filter((t) => t !== oldValue) : currentTags;
+      const nextTags = newValue !== null ? [...withoutOld, newValue] : withoutOld;
+      patch = { [axisBranch.alias]: nextTags };
+    }
+    const validation = validateAndSanitizeSeedPayload3(seed, patch, {
+      operation: "update",
+      allowNull: true,
+      requireAtLeastOneValidField: true,
+      enforceRequiredFields: false,
+      idGenerator: context.get("idGenerator")
+    });
+    if (validation.details.length > 0) {
+      return publicProblem(context, { type: "content-validation-error", title: "Unprocessable Entity", status: 422, detail: validation.details[0].message });
+    }
+    patch = validation.data;
+  }
+  const jwtPayload = context.get("jwtPayload");
+  await repository.updateWithKanbanPosition(seed, id, patch, body.position, body.axisBranchId, { actor: jwtPayload.sub });
+  return context.json({ success: true });
+}
+
+// src/features/content/handlers/view-config.ts
+import { seedViewConfigSchema, validateCardConfigAgainstSeed } from "@beechcms/core";
+async function getViewConfigHandler(context) {
+  const slug = context.req.param("slug");
+  if (!slug) {
+    return publicProblem(context, { type: "content-invalid-slug", title: "Bad Request", status: 400, detail: CONTENT_ERRORS.INVALID_SLUG });
+  }
+  const seed = context.get("getSeed")(slug);
+  if (!seed) {
+    return publicProblem(context, { type: "content-seed-not-found", title: "Not Found", status: 404, detail: CONTENT_ERRORS.SEED_NOT_FOUND });
+  }
+  const config = await context.get("seedLayoutRepository").getViewConfig(slug);
+  return context.json(config ?? {});
+}
+async function putViewConfigHandler(context) {
+  const slug = context.req.param("slug");
+  if (!slug) {
+    return publicProblem(context, { type: "content-invalid-slug", title: "Bad Request", status: 400, detail: CONTENT_ERRORS.INVALID_SLUG });
+  }
+  const seed = context.get("getSeed")(slug);
+  if (!seed) {
+    return publicProblem(context, { type: "content-seed-not-found", title: "Not Found", status: 404, detail: CONTENT_ERRORS.SEED_NOT_FOUND });
+  }
+  let body;
+  try {
+    body = await context.req.json();
+  } catch {
+    return publicProblem(context, { type: "content-invalid-body", title: "Bad Request", status: 400, detail: "Invalid JSON body" });
+  }
+  const parsed = seedViewConfigSchema.safeParse(body);
+  if (!parsed.success) {
+    return publicProblem(context, { type: "content-invalid-view-config", title: "Unprocessable Entity", status: 422, detail: parsed.error.issues[0]?.message ?? "Invalid view config" });
+  }
+  if (parsed.data.card) {
+    const { cleaned } = validateCardConfigAgainstSeed(parsed.data.card, seed);
+    parsed.data = { ...parsed.data, card: cleaned };
+  }
+  const jwtPayload = context.get("jwtPayload");
+  await context.get("seedLayoutRepository").setViewConfig(slug, parsed.data, jwtPayload.sub);
+  return context.json({ ok: true });
+}
+
 // src/features/content/index.ts
-var content = new Hono2();
+var content = new Hono();
+content.patch("/:slug/:id/kanban-move", kanbanMoveHandler);
+content.patch("/:slug/:id/kanban-position", kanbanPositionHandler);
+content.get("/:slug/view-config", getViewConfigHandler);
+content.put("/:slug/view-config", putViewConfigHandler);
 content.get("/:slug", listHandler);
 content.get("/:slug/facets", facetsHandler);
 content.get("/:schema_slug/by-slug/:entry_slug", getBySlugHandler);
@@ -1251,10 +1309,10 @@ content.put("/:slug/:id", updateHandler);
 content.delete("/:slug/:id", deleteHandler);
 var content_default = content;
 
-// src/widget.ts
-import { Hono as Hono3 } from "hono";
+// src/features/widget/widget.ts
+import { Hono as Hono2 } from "hono";
 import { deserializeFromDb } from "@beechcms/core";
-var widgetApp = new Hono3();
+var widgetApp = new Hono2();
 var DEFAULT_LEADERBOARD_LIMIT = 10;
 var MAXIMUM_LEADERBOARD_LIMIT = 100;
 var DEFAULT_LIST_LIMIT = 25;
@@ -1445,8 +1503,8 @@ widgetApp.get("/distribution/:seed", async (context) => {
 });
 
 // src/features/rotate-field/rotate-field.handler.ts
-import { Hono as Hono4 } from "hono";
-import { resolvePolicies as resolvePolicies4, verifyHashField, sha256hex as sha256hex2, validateAndSanitizeSeedPayload as validateAndSanitizeSeedPayload3, EntryNotFoundError as EntryNotFoundError3 } from "@beechcms/core";
+import { Hono as Hono3 } from "hono";
+import { resolvePolicies as resolvePolicies4, verifyHashField, sha256hex as sha256hex2, validateAndSanitizeSeedPayload as validateAndSanitizeSeedPayload4, EntryNotFoundError as EntryNotFoundError3 } from "@beechcms/core";
 
 // src/features/rotate-field/rotate-field.schema.ts
 import { z } from "zod";
@@ -1457,7 +1515,7 @@ var rotateFieldRequestSchema = z.object({
 });
 
 // src/features/rotate-field/rotate-field.handler.ts
-var rotateFieldApp = new Hono4();
+var rotateFieldApp = new Hono3();
 rotateFieldApp.post("/:slug/:id/rotate-field", async (context) => {
   const seedSlug = context.req.param("slug");
   const entryId = context.req.param("id");
@@ -1541,7 +1599,7 @@ rotateFieldApp.post("/:slug/:id/rotate-field", async (context) => {
       detail: "Current value does not match stored value"
     });
   }
-  const fieldValidationResult = validateAndSanitizeSeedPayload3(
+  const fieldValidationResult = validateAndSanitizeSeedPayload4(
     seed,
     { [fieldAlias]: nextValue },
     { operation: "update", allowNull: false, requireAtLeastOneValidField: true, enforceRequiredFields: false }
@@ -1560,9 +1618,9 @@ rotateFieldApp.post("/:slug/:id/rotate-field", async (context) => {
 });
 
 // src/features/password-reset/index.ts
-import { Hono as Hono5 } from "hono";
+import { Hono as Hono4 } from "hono";
 
-// src/features/email/providers/resend.ts
+// src/shared/email/providers/resend.ts
 var RESEND_API_URL = "https://api.resend.com/emails";
 var ResendEmailProvider = class {
   apiKey;
@@ -1598,7 +1656,7 @@ var ResendEmailProvider = class {
   }
 };
 
-// src/features/email/providers/smtp.ts
+// src/shared/email/providers/smtp.ts
 function parseAddress(raw) {
   const match = raw.match(/^\s*(.+?)\s*<([^>]+)>\s*$/);
   if (match) return { Name: match[1], Email: match[2] };
@@ -1628,7 +1686,7 @@ var SmtpEmailProvider = class {
   }
 };
 
-// src/features/email/templates/shell.ts
+// src/shared/email/templates/shell.ts
 function buildEmailShell(locale, slots) {
   const ctaBlock = slots.cta ? `<a href="${slots.cta.href}"
           style="display:inline-block;background:#111;color:#fff;padding:12px 24px;
@@ -1656,7 +1714,7 @@ function buildEmailShell(locale, slots) {
 </html>`;
 }
 
-// src/features/email/templates/password-reset.ts
+// src/shared/email/templates/password-reset.ts
 var COPY = {
   en: {
     subject: "Reset your Beech CMS password",
@@ -1686,7 +1744,7 @@ function buildPasswordResetEmail(resetUrl, locale) {
   };
 }
 
-// src/features/email/templates/password-changed.ts
+// src/shared/email/templates/password-changed.ts
 var COPY2 = {
   en: {
     subject: "Your Beech CMS password has been changed",
@@ -1716,7 +1774,7 @@ function buildPasswordChangedEmail(locale) {
   };
 }
 
-// src/features/email/templates/automation-mail.ts
+// src/shared/email/templates/automation-mail.ts
 function buildAutomationEmail(params) {
   return {
     to: params.to,
@@ -1729,7 +1787,7 @@ function stripHtml(input) {
   return input.replace(/<[^>]+>/g, "").trim();
 }
 
-// src/features/email/email.service.ts
+// src/shared/email/email.service.ts
 var DEFAULT_FROM = "Beech CMS <onboarding@resend.dev>";
 function createProvider(env) {
   if (env.provider === "smtp") {
@@ -1771,7 +1829,7 @@ async function sendPasswordChangedEmail(params) {
 async function sendAutomationMail(params) {
   const provider = createProvider({
     provider: params.provider,
-    apiKey: params.apiKey ?? params.resendApiKey,
+    apiKey: params.apiKey ?? "",
     smtpBaseUrl: params.smtpBaseUrl,
     isDev: false
   });
@@ -1784,7 +1842,7 @@ async function sendAutomationMail(params) {
   });
 }
 
-// src/features/email/email.types.ts
+// src/shared/email/email.types.ts
 var SUPPORTED_EMAIL_LOCALES = ["en", "it"];
 function resolveEmailLocale(raw) {
   if (typeof raw === "string" && SUPPORTED_EMAIL_LOCALES.includes(raw)) {
@@ -1817,7 +1875,11 @@ async function requestPasswordReset(context) {
   const clientIpAddress = getClientIp(req);
   const forgotPasswordRateLimit = await context.get("rateLimiters").getLimiter("forgotPassword").checkLimit(clientIpAddress);
   if (!forgotPasswordRateLimit.isAllowed) {
-    return context.json({ error: "Too many requests" }, 429);
+    const headers = {};
+    if (forgotPasswordRateLimit.retryAfterSeconds !== void 0) {
+      headers["Retry-After"] = String(forgotPasswordRateLimit.retryAfterSeconds);
+    }
+    return context.json({ error: "Too many requests" }, 429, headers);
   }
   const registeredUser = await context.get("userRepository").findByEmail(normalizedEmail);
   if (!registeredUser) {
@@ -1859,6 +1921,7 @@ async function requestPasswordReset(context) {
 import { sha256hex as sha256hex4 } from "@beechcms/core";
 var MIN_PASSWORD_LENGTH2 = 8;
 var MAX_PASSWORD_LENGTH2 = 128;
+var MAX_PASSWORD_BYTES2 = 72;
 async function resetPassword(context) {
   const { env, req, executionCtx } = context;
   const useSmtp = env.EMAIL_PROVIDER === "smtp";
@@ -1868,7 +1931,11 @@ async function resetPassword(context) {
   const clientIpAddress = getClientIp(req);
   const resetPasswordRateLimit = await context.get("rateLimiters").getLimiter("resetPassword").checkLimit(clientIpAddress);
   if (!resetPasswordRateLimit.isAllowed) {
-    return context.json({ error: "Too many requests" }, 429);
+    const headers = {};
+    if (resetPasswordRateLimit.retryAfterSeconds !== void 0) {
+      headers["Retry-After"] = String(resetPasswordRateLimit.retryAfterSeconds);
+    }
+    return context.json({ error: "Too many requests" }, 429, headers);
   }
   let payload;
   try {
@@ -1887,6 +1954,11 @@ async function resetPassword(context) {
       error: `Password must be between ${MIN_PASSWORD_LENGTH2} and ${MAX_PASSWORD_LENGTH2} characters`
     }, 400);
   }
+  if (new TextEncoder().encode(newPassword).length > MAX_PASSWORD_BYTES2) {
+    return context.json({
+      error: `Password must not exceed ${MAX_PASSWORD_BYTES2} bytes when UTF-8 encoded`
+    }, 400);
+  }
   const emailLocale = resolveEmailLocale(payload.locale);
   const tokenHash = await sha256hex4(resetToken);
   const nowTimestamp = Math.floor(Date.now() / 1e3);
@@ -1925,7 +1997,7 @@ async function resetPassword(context) {
 }
 
 // src/features/password-reset/index.ts
-var passwordResetApp = new Hono5();
+var passwordResetApp = new Hono4();
 passwordResetApp.get("/auth/features", (context) => {
   return context.json({ passwordReset: context.env.EMAIL_PROVIDER === "smtp" || Boolean(context.env.RESEND_API_KEY) });
 });
@@ -1933,8 +2005,8 @@ passwordResetApp.post("/auth/forgot-password", requestPasswordReset);
 passwordResetApp.post("/auth/reset-password", resetPassword);
 
 // src/features/setup/index.ts
-import { Hono as Hono6 } from "hono";
-var setupApp = new Hono6();
+import { Hono as Hono5 } from "hono";
+var setupApp = new Hono5();
 setupApp.get("/auth/setup", async (context) => {
   const userCount = await context.get("userRepository").countAll();
   const needsSetup = userCount === 0;
@@ -1996,6 +2068,14 @@ setupApp.post("/auth/setup", async (context) => {
       detail: "Password must be between 8 and 128 characters long."
     });
   }
+  if (new TextEncoder().encode(password).length > 72) {
+    return publicProblem(context, {
+      type: "validation-error",
+      title: "Invalid password",
+      status: 422,
+      detail: "Password must not exceed 72 bytes when UTF-8 encoded."
+    });
+  }
   if (!settings || typeof settings !== "object") {
     return publicProblem(context, {
       type: "validation-error",
@@ -2185,9 +2265,9 @@ setupApp.post("/auth/setup", async (context) => {
 });
 
 // src/features/draft/draft.handler.ts
-import { Hono as Hono7 } from "hono";
+import { Hono as Hono6 } from "hono";
 import {
-  validateAndSanitizeSeedPayload as validateAndSanitizeSeedPayload4,
+  validateAndSanitizeSeedPayload as validateAndSanitizeSeedPayload5,
   resolvePolicies as resolvePolicies5,
   RelationTargetNotFoundError
 } from "@beechcms/core";
@@ -2241,7 +2321,7 @@ var draftGuard = createMiddleware(async (context, next) => {
 });
 
 // src/features/draft/draft.handler.ts
-var draftApp = new Hono7();
+var draftApp = new Hono6();
 draftApp.get("/drafts", async (context) => {
   const seeds = context.get("seedRegistry").draftEnabled();
   const repository = context.get("repository");
@@ -2293,7 +2373,7 @@ draftApp.put("/:slug/:id/draft", draftGuard, async (context) => {
       detail: `${CONTENT_ERRORS.SENSITIVE_FIELD_EDIT}: ${sensitiveAliases.join(", ")}`
     });
   }
-  const validation = validateAndSanitizeSeedPayload4(seed, body, {
+  const validation = validateAndSanitizeSeedPayload5(seed, body, {
     operation: "update",
     allowNull: true,
     requireAtLeastOneValidField: true,
@@ -2381,12 +2461,13 @@ draftApp.delete("/:slug/:id/draft", draftGuard, async (context) => {
 });
 
 // src/features/settings/settings.handler.ts
-import { Hono as Hono8 } from "hono";
+import { Hono as Hono7 } from "hono";
 import { sha256hex as sha256hex5 } from "@beechcms/core";
-var settingsApp = new Hono8();
+var settingsApp = new Hono7();
 var EMAIL_VALIDATION_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 var MIN_PASSWORD_LENGTH3 = 8;
 var MAX_PASSWORD_LENGTH3 = 128;
+var MAX_PASSWORD_BYTES3 = 72;
 var SESSION_LIST_LIMIT = 20;
 var ACTIVITY_LOG_LIMIT = 30;
 settingsApp.get("/", async (context) => {
@@ -2549,6 +2630,9 @@ settingsApp.put("/password", async (context) => {
   if (newPassword.length > MAX_PASSWORD_LENGTH3) {
     return context.json({ error: "Password is too long" }, 400);
   }
+  if (new TextEncoder().encode(newPassword).length > MAX_PASSWORD_BYTES3) {
+    return context.json({ error: `Password must not exceed ${MAX_PASSWORD_BYTES3} bytes when UTF-8 encoded` }, 400);
+  }
   const userRecord = await context.get("userRepository").findById(userId);
   if (!userRecord) {
     return context.json({ error: "User not found" }, 404);
@@ -2659,7 +2743,7 @@ settingsApp.put("/notifications", async (context) => {
 });
 
 // src/features/schema/schema.handler.ts
-import { Hono as Hono9 } from "hono";
+import { Hono as Hono8 } from "hono";
 import { canEditLayout, formLayoutSchema, validateLayoutAgainstSeed } from "@beechcms/core";
 function requireLayoutEditPermission(context) {
   const role = context.get("jwtPayload")?.role;
@@ -2688,7 +2772,7 @@ function requireSeedBySlug(context, slug) {
   }
   return { seed, error: null };
 }
-var schemaApp = new Hono9();
+var schemaApp = new Hono8();
 schemaApp.get("/", async (context) => {
   const registry = context.get("seedRegistry");
   const layouts = await context.get("seedLayoutRepository").getAllAsMap();
@@ -2750,7 +2834,7 @@ schemaApp.delete("/:slug/layout", async (context) => {
 });
 
 // src/features/dashboard-layout/dashboard-layout.handler.ts
-import { Hono as Hono10 } from "hono";
+import { Hono as Hono9 } from "hono";
 import {
   canEditDashboard,
   dashboardLayoutSchema,
@@ -2810,7 +2894,7 @@ async function putLayout(context, scope) {
   await context.get("dashboardLayoutRepository").upsert(scope, result.cleaned, userId);
   return context.json({ ok: true, layout: result.cleaned, warnings: result.warnings });
 }
-var dashboardLayoutApp = new Hono10();
+var dashboardLayoutApp = new Hono9();
 dashboardLayoutApp.get("/", async (context) => {
   const role = context.get("jwtPayload")?.role;
   const chain = resolveDashboardScopeChain(role);
@@ -2885,7 +2969,7 @@ dashboardLayoutApp.delete("/:scope", async (context) => {
 });
 
 // src/features/seeds/seeds.handler.ts
-import { Hono as Hono11 } from "hono";
+import { Hono as Hono10 } from "hono";
 import {
   nextBranchId,
   validateSeedDefinitions,
@@ -3028,16 +3112,17 @@ async function deleteSeedMediaObjects(context, slug, seed, schemaMutator) {
   try {
     const dbCols = await schemaMutator.getColumns(`content_${slug}`);
     if (!dbCols) return;
-    const colList = fileBranches.map((b) => b.alias).filter((a) => dbCols.has(a)).join(", ");
-    if (!colList) return;
-    const rs = await context.env.DB.prepare(`SELECT ${colList} FROM content_${slug}`).all();
-    const rows = rs.results ?? [];
+    const validCols = fileBranches.map((b) => b.alias).filter((a) => dbCols.has(a));
+    if (validCols.length === 0) return;
+    const sql = `SELECT ${validCols.join(", ")} FROM content_${slug}`;
+    const { results: rows } = await context.env.DB.prepare(sql).all();
+    const cdnUrl = context.env.MEDIA_CDN_URL;
     const r2Keys = [];
     for (const row of rows) {
       for (const b of fileBranches) {
         const val = row[b.alias];
         if (!val) continue;
-        const keys = extractMediaKeysFromData(seed, { [b.alias]: val });
+        const keys = extractMediaKeysFromData(seed, { [b.alias]: val }, cdnUrl);
         r2Keys.push(...keys);
       }
     }
@@ -3048,7 +3133,7 @@ async function deleteSeedMediaObjects(context, slug, seed, schemaMutator) {
   } catch {
   }
 }
-var seedsApp = new Hono11();
+var seedsApp = new Hono10();
 seedsApp.use("*", async (context, next) => {
   const denied = requireAdmin(context);
   if (denied) return denied;
@@ -3323,8 +3408,8 @@ seedsApp.patch("/:slug/branches/:branchId/retype", async (context) => {
 });
 
 // src/features/notifications/notifications.handler.ts
-import { Hono as Hono12 } from "hono";
-var notificationsApp = new Hono12();
+import { Hono as Hono11 } from "hono";
+var notificationsApp = new Hono11();
 var NOTIFICATION_LIST_LIMIT = 50;
 notificationsApp.get("/notifications", async (context) => {
   try {
@@ -3384,7 +3469,7 @@ notificationsApp.post("/notifications/mark-all-read", async (context) => {
   }
 });
 
-// src/features/automations/template-grammar.ts
+// src/features/automations/evaluator/template-grammar.ts
 import { AUTOMATION_RESERVED_WORDS } from "@beechcms/core";
 var SLUG_RE2 = /^[a-zA-Z0-9_-]+$/;
 var AGGREGATE_OPS = /* @__PURE__ */ new Set(["count", "sum", "avg", "min", "max", "pluck"]);
@@ -3517,7 +3602,7 @@ function parseTemplateKey(raw) {
   return { kind: "var_access", name: nameToken, steps, conditions };
 }
 
-// src/features/automations/automation-runner.utils.ts
+// src/features/automations/engine/automation-runner.utils.ts
 function interpolate(template, context, defaultValue = "", onMissing) {
   if (!template) return "";
   const replacer = (_, key) => {
@@ -3551,7 +3636,7 @@ function resolvePath(obj, path) {
   return current;
 }
 
-// src/features/automations/context-resolver.ts
+// src/features/automations/evaluator/context-resolver.ts
 var MAX_PLUCK = 100;
 function applyAggregate(op, field, rows, onMissing) {
   switch (op) {
@@ -3666,7 +3751,7 @@ async function resolveAutomationContext(_automation, triggerEntry, batchEntries)
   return { lookup, triggerEntry };
 }
 
-// src/features/automations/action-executors/webhook.executor.ts
+// src/features/automations/executors/webhook.executor.ts
 import { signWebhookBody } from "@beechcms/core/webhook-crypto";
 var WEBHOOK_TIMEOUT_MS = 8e3;
 var warnedNoSecret = false;
@@ -3702,7 +3787,7 @@ async function executeWebhook(action, context, env) {
   }
 }
 
-// src/features/automations/action-executors/send-mail.executor.ts
+// src/features/automations/executors/send-mail.executor.ts
 async function executeSendMail(action, context, env) {
   const missingFields = [];
   const logMissing = (field) => missingFields.push(field);
@@ -3735,7 +3820,7 @@ async function executeSendMail(action, context, env) {
   }
 }
 
-// src/features/automations/action-executors/edit-field.executor.ts
+// src/features/automations/executors/edit-field.executor.ts
 async function executeEditField(action, entry, context, repository, seed) {
   const id = entry.id;
   if (typeof id !== "string") {
@@ -3745,7 +3830,7 @@ async function executeEditField(action, entry, context, repository, seed) {
   await repository.update(seed, id, { [action.field]: resolved });
 }
 
-// src/features/automations/action-executors/create-entry.executor.ts
+// src/features/automations/executors/create-entry.executor.ts
 async function executeCreateEntry(action, entry, repository, getSeed, idGenerator) {
   const targetSeed = getSeed(action.seed_slug);
   if (!targetSeed) throw new Error(`create_entry: unknown seed ${action.seed_slug}`);
@@ -3757,7 +3842,7 @@ async function executeCreateEntry(action, entry, repository, getSeed, idGenerato
   await repository.create(targetSeed, newId, newId, "draft", payload);
 }
 
-// src/features/automations/filter-translation.ts
+// src/features/automations/filters/filter-translation.ts
 var SYSTEM_COLUMNS = /* @__PURE__ */ new Set(["id", "slug", "status", "created_at", "updated_at"]);
 function mapBranchTypeToFilterType(type) {
   switch (type) {
@@ -3795,7 +3880,7 @@ function conditionToFilterGroup(c, seed) {
   };
 }
 
-// src/features/automations/action-executors/set-variable.executor.ts
+// src/features/automations/executors/set-variable.executor.ts
 async function executeSetVariable(action, ctx) {
   const seedSlug = action.seed_slug ?? ctx.seed.slug;
   const targetSeed = ctx.getSeed(seedSlug);
@@ -3908,7 +3993,7 @@ function calculateGeneralStats(seed, items) {
   return { count: items.length, sum, avg, min, max, pluck };
 }
 
-// src/features/automations/action-executors/index.ts
+// src/features/automations/executors/index.ts
 async function executeAction(action, ctx) {
   switch (action.type) {
     case "set_variable":
@@ -3928,7 +4013,7 @@ async function executeAction(action, ctx) {
   }
 }
 
-// src/features/automations/when-evaluator.ts
+// src/features/automations/filters/when-evaluator.ts
 function evaluateWhen(node, context) {
   if (!node) return true;
   if (node.kind === "predicate") return evalPredicate(node, context);
@@ -4008,7 +4093,7 @@ function coerceEqual(a, b) {
   return a === b;
 }
 
-// src/features/automations/var-access-resolver.ts
+// src/features/automations/evaluator/var-access-resolver.ts
 function toNumeric(v) {
   const n = Number(v);
   if (Number.isFinite(n)) return n;
@@ -4111,7 +4196,7 @@ function resolveVarAccess(parsed, variables, onMissing) {
   return current;
 }
 
-// src/features/automations/automation-runner.ts
+// src/features/automations/engine/automation-runner.ts
 function withVariables(base, variables) {
   return {
     triggerEntry: base.triggerEntry,
@@ -4164,10 +4249,10 @@ var AutomationRunner = class {
   }
 };
 
-// src/features/automations/automations.handler.ts
-import { Hono as Hono13 } from "hono";
+// src/features/automations/api/automations.handler.ts
+import { Hono as Hono12 } from "hono";
 
-// src/features/automations/automations.schema.ts
+// src/features/automations/api/automations.schema.ts
 import { z as z2 } from "zod";
 import { isPrivateHost } from "@beechcms/core";
 var whenOperandSchema = z2.union([
@@ -4298,8 +4383,8 @@ var toggleAutomationSchema = z2.object({
   enabled: z2.boolean()
 });
 
-// src/features/automations/automations.handler.ts
-var automationsApp = new Hono13();
+// src/features/automations/api/automations.handler.ts
+var automationsApp = new Hono12();
 automationsApp.get("/", async (context) => {
   const seedSlug = context.req.query("seed");
   if (!seedSlug) {
@@ -4445,7 +4530,7 @@ automationsApp.delete("/:id", async (context) => {
 });
 
 // src/features/stats/stats.handler.ts
-import { Hono as Hono14 } from "hono";
+import { Hono as Hono13 } from "hono";
 import { SystemClock } from "@beechcms/core";
 var DATABASE_ERROR = "Database error";
 var INTERNAL_SERVER_ERROR = "Internal Server Error";
@@ -4467,7 +4552,7 @@ function getMimeType(extension) {
   const type = extension === "jpg" ? "jpeg" : extension || "jpeg";
   return `image/${type}`;
 }
-var statsApp = new Hono14();
+var statsApp = new Hono13();
 statsApp.get("/stats/media-library", async (context) => {
   try {
     const mediaRepository = context.get("mediaRepository");
@@ -4763,7 +4848,7 @@ statsApp.post("/stats/storage/sync", async (context) => {
 });
 
 // src/features/backrefs/backrefs.handler.ts
-import { Hono as Hono15 } from "hono";
+import { Hono as Hono14 } from "hono";
 import { resolvePolicies as resolvePolicies6 } from "@beechcms/core";
 
 // src/features/backrefs/d1-backref.repository.ts
@@ -4815,7 +4900,7 @@ var D1BackrefRepository = class {
 var PREVIEW_LIMIT = 3;
 var DEFAULT_PAGE_LIMIT = 20;
 var MAX_PAGE_LIMIT = 100;
-var backrefsApp = new Hono15();
+var backrefsApp = new Hono14();
 backrefsApp.get("/:targetSlug/:targetId/backrefs", async (c) => {
   const targetSlug = c.req.param("targetSlug");
   const targetId = c.req.param("targetId");
@@ -4925,61 +5010,234 @@ function filterVisibility(items, sourceSeed) {
   if (visibility === "hidden") {
     return items.map((item) => ({ ...item, displayName: null }));
   }
-  if (visibility === "masked") {
-    return items.map((item) => ({
-      ...item,
-      displayName: item.displayName ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" : null
-    }));
+  if (visibility === "masked") {
+    return items.map((item) => ({
+      ...item,
+      displayName: item.displayName ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" : null
+    }));
+  }
+  return items;
+}
+
+// src/features/webhooks/index.ts
+import { Hono as Hono15 } from "hono";
+import { Receiver } from "@upstash/qstash";
+var webhooksApp = new Hono15();
+webhooksApp.post("/qstash", async (context) => {
+  const currentSigningKey = context.env.QSTASH_CURRENT_SIGNING_KEY;
+  const nextSigningKey = context.env.QSTASH_NEXT_SIGNING_KEY;
+  if (!currentSigningKey || !nextSigningKey) {
+    console.error("QStash webhook called but signing keys are not configured");
+    return context.text("Configuration error", 500);
+  }
+  const receiver = new Receiver({
+    currentSigningKey,
+    nextSigningKey
+  });
+  const body = await context.req.text();
+  const signature = context.req.header("Upstash-Signature");
+  if (!signature) {
+    return context.text("Missing signature", 401);
+  }
+  try {
+    const isValid = await receiver.verify({
+      signature,
+      body
+    });
+    if (!isValid) {
+      return context.text("Invalid signature", 401);
+    }
+  } catch (err) {
+    console.error("QStash signature verification failed", err);
+    return context.text("Invalid signature", 401);
+  }
+  try {
+    const input = JSON.parse(body);
+    const notificationRepository = context.get("notificationRepository");
+    await notificationRepository.create({
+      title: input.title,
+      message: input.message,
+      type: input.type ?? "info"
+    });
+    return context.text("OK", 200);
+  } catch (error) {
+    console.error("Failed to process QStash webhook payload", error);
+    return context.text("Internal server error", 500);
+  }
+});
+
+// src/features/upload/index.ts
+import { Hono as Hono16 } from "hono";
+import { isMimeAccepted } from "@beechcms/core";
+var DEFAULT_MAX_UPLOAD_BYTES = 50 * 1024 * 1024;
+var ABSOLUTE_MAX_UPLOAD_BYTES = 500 * 1024 * 1024;
+var PRESIGN_TTL_SECONDS = 900;
+function resolveMaxUploadBytes(env) {
+  const raw = env.MAX_UPLOAD_BYTES;
+  if (!raw) return DEFAULT_MAX_UPLOAD_BYTES;
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_MAX_UPLOAD_BYTES;
+  return Math.min(parsed, ABSOLUTE_MAX_UPLOAD_BYTES);
+}
+function sanitizeFilename(name) {
+  const base = name.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 100);
+  return base || "file";
+}
+function generateObjectKey(originalName) {
+  const timestamp = Math.floor(Date.now() / 1e3);
+  return `${timestamp}-${sanitizeFilename(originalName)}`;
+}
+var FORCE_DOWNLOAD_MIME_PREFIXES = [
+  "image/svg",
+  "text/",
+  "application/xml",
+  "application/xhtml",
+  "application/javascript",
+  "application/x-javascript"
+];
+function isActiveMimeType(mime) {
+  const lower = mime.toLowerCase();
+  return FORCE_DOWNLOAD_MIME_PREFIXES.some((prefix) => lower.startsWith(prefix));
+}
+var uploadRoutes = new Hono16();
+uploadRoutes.post("/upload/presign", async (c) => {
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "Invalid JSON body" }, 400);
+  }
+  const { filename, mimeType, sizeBytes } = body;
+  if (typeof filename !== "string" || !filename.trim()) return c.json({ error: "filename is required" }, 400);
+  if (typeof mimeType !== "string" || !mimeType.trim()) return c.json({ error: "mimeType is required" }, 400);
+  if (typeof sizeBytes !== "number" || !Number.isFinite(sizeBytes) || sizeBytes <= 0) {
+    return c.json({ error: "sizeBytes must be a positive number" }, 400);
+  }
+  const maxBytes = resolveMaxUploadBytes(c.env);
+  if (sizeBytes > maxBytes) return c.json({ error: `File too large. Max ${maxBytes} bytes` }, 400);
+  if (!isMimeAccepted(mimeType, "any")) return c.json({ error: "File type not allowed" }, 400);
+  const key = generateObjectKey(filename);
+  const uploadUrl = await c.var.bucket.presignPut(key, {
+    expiresIn: PRESIGN_TTL_SECONDS,
+    contentType: mimeType,
+    contentLength: sizeBytes
+  });
+  return c.json({ uploadUrl, key, expiresIn: PRESIGN_TTL_SECONDS }, 200);
+});
+uploadRoutes.post("/upload/confirm", async (c) => {
+  const { bucket, mediaRepository: mediaRepo, systemStatsRepository: statsRepo } = c.var;
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "Invalid JSON body" }, 400);
+  }
+  const { key } = body;
+  if (typeof key !== "string" || !key.trim()) return c.json({ error: "key is required" }, 400);
+  const sanitizedKey = decodeURIComponent(key).replace(/\.\.[/\\]/g, "").replace(/[^a-zA-Z0-9._\-/]/g, "");
+  if (!sanitizedKey || !/^\d+-[a-zA-Z0-9._-]+$/.test(sanitizedKey)) {
+    return c.json({ error: "Invalid key format" }, 400);
   }
-  return items;
-}
-
-// src/features/webhooks/index.ts
-import { Hono as Hono16 } from "hono";
-import { Receiver } from "@upstash/qstash";
-var webhooksApp = new Hono16();
-webhooksApp.post("/qstash", async (context) => {
-  const currentSigningKey = context.env.QSTASH_CURRENT_SIGNING_KEY;
-  const nextSigningKey = context.env.QSTASH_NEXT_SIGNING_KEY;
-  if (!currentSigningKey || !nextSigningKey) {
-    console.error("QStash webhook called but signing keys are not configured");
-    return context.text("Configuration error", 500);
+  const existing = await mediaRepo.getByKey(sanitizedKey);
+  if (existing) return c.json({ url: bucket.getUrl(sanitizedKey) }, 200);
+  const head = await bucket.head(sanitizedKey);
+  if (!head) return c.json({ error: "Object not found in storage" }, 404);
+  const size = head.size ?? 0;
+  const maxBytes = resolveMaxUploadBytes(c.env);
+  if (size > maxBytes) {
+    return c.json({ error: `File too large. Max ${maxBytes} bytes` }, 400);
   }
-  const receiver = new Receiver({
-    currentSigningKey,
-    nextSigningKey
+  const uploadedBy = c.var.jwtPayload?.sub ?? "";
+  const mime = head.contentType ?? "application/octet-stream";
+  const filename = sanitizedKey.replace(/^\d+-/, "") || sanitizedKey;
+  await statsRepo.incrementStorage(size);
+  await mediaRepo.trackUpload({
+    key: sanitizedKey,
+    filename,
+    mime_type: mime,
+    size_bytes: size,
+    uploaded_by: uploadedBy
   });
-  const body = await context.req.text();
-  const signature = context.req.header("Upstash-Signature");
-  if (!signature) {
-    return context.text("Missing signature", 401);
+  const jwtPayload = c.get("jwtPayload");
+  if (jwtPayload) {
+    c.get("activityLogger").log({
+      action: "upload",
+      entityType: "media",
+      entityId: sanitizedKey,
+      details: { name: filename, size, type: mime },
+      actor: {
+        id: jwtPayload.sub,
+        email: jwtPayload.email ?? "unknown",
+        name: [jwtPayload.name, jwtPayload.surname].filter(Boolean).join(" ") || null
+      }
+    });
+  }
+  return c.json({ url: bucket.getUrl(sanitizedKey) }, 200);
+});
+uploadRoutes.get("/upload/download-url/:key", async (c) => {
+  let key = c.req.param("key");
+  if (!key) return c.json({ error: "Missing key" }, 400);
+  key = decodeURIComponent(key);
+  key = key.replace(/\.\.[/\\]/g, "");
+  key = key.replace(/[^a-zA-Z0-9._\-/]/g, "");
+  if (!key) return c.json({ error: "Invalid key" }, 400);
+  const media = await c.var.mediaRepository.getByKey(key).catch(() => null);
+  if (!media) {
+    return c.json({ error: "Media not found" }, 404);
+  }
+  const jwtPayload = c.var.jwtPayload;
+  const userId = jwtPayload?.sub;
+  const isAdmin = jwtPayload?.role === "admin";
+  if (!isAdmin && userId !== media.uploaded_by) {
+    return c.json({ error: "Forbidden" }, 403);
   }
+  const head = await c.var.bucket.head(key);
+  if (!head) return c.json({ error: "Object not found" }, 404);
+  const downloadUrl = await c.var.bucket.presignGet(key, { expiresIn: PRESIGN_TTL_SECONDS });
+  return c.json({ downloadUrl, expiresIn: PRESIGN_TTL_SECONDS }, 200);
+});
+uploadRoutes.delete("/upload/:key", async (c) => {
+  let key = c.req.param("key");
+  if (!key) return c.json({ error: "Missing key" }, 400);
+  key = key.replace(/\.\.[/\\]/g, "");
+  key = key.replace(/[^a-zA-Z0-9._\-/]/g, "");
+  if (!key) return c.json({ error: "Invalid key" }, 400);
+  const media = await c.var.mediaRepository.getByKey(key).catch(() => null);
+  if (!media) {
+    return c.json({ error: "Media not found" }, 404);
+  }
+  const jwtPayload = c.var.jwtPayload;
+  const userId = jwtPayload?.sub;
+  const isAdmin = jwtPayload?.role === "admin";
+  if (!isAdmin && userId !== media.uploaded_by) {
+    return c.json({ error: "Forbidden" }, 403);
+  }
+  await deleteR2Objects(c, [key]);
+  return c.json({ success: true }, 200);
+});
+async function serveMediaHandler(c) {
+  const key = c.req.param("key");
+  if (!key) return new Response("Missing key", { status: 400 });
   try {
-    const isValid = await receiver.verify({
-      signature,
-      body
-    });
-    if (!isValid) {
-      return context.text("Invalid signature", 401);
+    const object = await c.var.bucket.get(key);
+    if (!object) return new Response("Not found", { status: 404 });
+    const headers = new Headers();
+    const originalMime = object.contentType ?? "application/octet-stream";
+    if (isActiveMimeType(originalMime)) {
+      headers.set("Content-Type", "application/octet-stream");
+      headers.set("Content-Disposition", "attachment");
+    } else {
+      headers.set("Content-Type", originalMime);
     }
+    headers.set("Content-Security-Policy", "default-src 'none'; sandbox");
+    headers.set("X-Content-Type-Options", "nosniff");
+    headers.set("Cache-Control", "public, max-age=31536000, immutable");
+    return new Response(object.body, { status: 200, headers });
   } catch (err) {
-    console.error("QStash signature verification failed", err);
-    return context.text("Invalid signature", 401);
-  }
-  try {
-    const input = JSON.parse(body);
-    const notificationRepository = context.get("notificationRepository");
-    await notificationRepository.create({
-      title: input.title,
-      message: input.message,
-      type: input.type ?? "info"
-    });
-    return context.text("OK", 200);
-  } catch (error) {
-    console.error("Failed to process QStash webhook payload", error);
-    return context.text("Internal server error", 500);
+    console.error(`[serveMediaHandler] Error serving file ${key}:`, err);
+    return new Response("Internal error", { status: 500 });
   }
-});
+}
 
 // src/public/public-errors.ts
 var PUBLIC_ERRORS = {
@@ -5040,11 +5298,16 @@ function publicRateLimitMiddleware() {
     const key = `${getClientIp(c.req)}:${seed}:${limiterName}`;
     const result = await c.get("rateLimiters").getLimiter(limiterName).checkLimit(key);
     if (!result.isAllowed) {
+      const headers = {};
+      if (result.retryAfterSeconds !== void 0) {
+        headers["Retry-After"] = String(result.retryAfterSeconds);
+      }
       return publicProblem(c, {
         type: "rate-limit-exceeded",
         title: "Too Many Requests",
         status: 429,
-        detail: "Too many requests"
+        detail: "Too many requests",
+        headers
       });
     }
     await next();
@@ -5363,10 +5626,10 @@ import { isValidContentStatus as isValidContentStatus3, SlugConflictError as Slu
 import { slugify as slugify3, generateEntrySlug } from "@beechcms/core";
 
 // src/public/sanitize.ts
-import { validateAndSanitizeSeedPayload as validateAndSanitizeSeedPayload5 } from "@beechcms/core";
+import { validateAndSanitizeSeedPayload as validateAndSanitizeSeedPayload6 } from "@beechcms/core";
 function sanitizePublicPayload(seed, payload, options = {}) {
   const operation = options.operation ?? "create";
-  const result = validateAndSanitizeSeedPayload5(seed, payload, {
+  const result = validateAndSanitizeSeedPayload6(seed, payload, {
     allowNull: options.allowNull ?? false,
     operation,
     requireAtLeastOneValidField: options.requireAtLeastOneValidField ?? true,
@@ -5678,10 +5941,10 @@ publicApp.post("/:seed/add", publicAddHandler);
 publicApp.put("/:seed/edit/:id", publicEditHandler);
 var publicRoutes = publicApp;
 
-// src/search.ts
+// src/features/search/search.ts
 import { Hono as Hono18 } from "hono";
 
-// src/search-utils.ts
+// src/features/search/search-utils.ts
 function encodeCursor(rank, entryId) {
   return btoa(`${rank}:${entryId}`);
 }
@@ -5786,7 +6049,7 @@ function mapSearchResultRow(row) {
   };
 }
 
-// src/search.ts
+// src/features/search/search.ts
 var searchRouter = new Hono18();
 searchRouter.use("*", authMiddleware());
 searchRouter.get("/", async (c) => {
@@ -5827,19 +6090,19 @@ searchRouter.get("/", async (c) => {
 // src/middleware/repository.middleware.ts
 import { createMiddleware as createMiddleware2 } from "hono/factory";
 
-// src/shared/content.repository.d1.ts
+// src/shared/db/repositories/content.repository.d1.ts
 import {
   EntryNotFoundError as EntryNotFoundError7,
   RepositoryError as RepositoryError2,
-  SlugConflictError as SlugConflictError3,
+  SlugConflictError as SlugConflictError4,
   RelationTargetNotFoundError as RelationTargetNotFoundError2,
   buildSelectQuery,
   deserializeFromDb as deserializeFromDb2,
   serializeForDb
 } from "@beechcms/core";
 
-// src/shared/base.repository.d1.ts
-import { RepositoryError } from "@beechcms/core";
+// src/shared/db/repositories/base.repository.d1.ts
+import { RepositoryError, SlugConflictError as SlugConflictError3 } from "@beechcms/core";
 var BaseD1Repository = class {
   constructor(database) {
     this.database = database;
@@ -5857,11 +6120,14 @@ var BaseD1Repository = class {
    */
   mapError(error, context) {
     const message = error?.message || "Unknown database error";
+    if (message.includes("UNIQUE constraint failed:") && message.includes(".slug")) {
+      return new SlugConflictError3(`${context}: ${message}`);
+    }
     return new RepositoryError(`${context}: ${message}`, error);
   }
 };
 
-// src/shared/content.repository.d1.ts
+// src/shared/db/repositories/content.repository.d1.ts
 function multiRelBranches(seed) {
   return seed.branches.filter((b) => b.type === "relation" && b.multiple === true);
 }
@@ -5880,6 +6146,7 @@ var D1ContentRepository = class extends BaseD1Repository {
     this.hooks = hooks;
   }
   hooks;
+  /** Assembles the {@link HookContext} passed to every lifecycle hook invocation. */
   hookCtx(seed, actor) {
     return { seed, repository: this, actor, db: this.database };
   }
@@ -5901,10 +6168,15 @@ var D1ContentRepository = class extends BaseD1Repository {
         data[branch.alias] = deserializeFromDb2(branch, row[branch.alias]);
       }
     }
+    if (row.position !== void 0) data.position = row.position;
     return data;
   }
   /**
    * Fetches multi-relation arrays for a single entry and attaches them to `data`.
+   *
+   * @param seed The seed schema definition.
+   * @param entryId Id of the entry to fetch relation targets for.
+   * @param data Mutated in place: one array property per multi-relation branch alias.
    */
   async attachMultiRelations(seed, entryId, data) {
     const branches = multiRelBranches(seed);
@@ -5918,51 +6190,85 @@ var D1ContentRepository = class extends BaseD1Repository {
     }
   }
   /**
-   * Fetches multi-relation arrays for a list of entries and attaches them.
-   * One query per multi-relation branch (O(R) queries, R = branch count).
+   * Builds one junction-table statement per multi-relation branch, selecting the rows whose
+   * `parent_id` falls within the page defined by `idQuery` (the page selection re-projected to
+   * ids only). Using a subquery instead of a bound `IN (?, ...)` id list keeps the statements
+   * eligible for the same batch as the page query and avoids D1's bound-parameter limit.
+   *
+   * The subquery is wrapped in `SELECT id FROM (...)` because `kanbanOrder` projections carry an
+   * extra `kp.position` column, and `IN` requires a single-column subselect.
    */
-  async attachMultiRelationsMany(seed, entries) {
-    const branches = multiRelBranches(seed);
-    if (branches.length === 0 || entries.length === 0) return;
-    const ids = entries.map((e) => e.id);
-    const placeholders = ids.map(() => "?").join(", ");
-    const stmts = branches.map(
+  multiRelStatements(seed, branches, idQuery) {
+    return branches.map(
       (b) => this.database.prepare(
-        `SELECT parent_id, target_id FROM ${jTable(seed.slug, b.alias)} WHERE parent_id IN (${placeholders}) ORDER BY parent_id, position ASC`
-      ).bind(...ids)
+        `SELECT parent_id, target_id FROM ${jTable(seed.slug, b.alias)} WHERE parent_id IN (SELECT id FROM (${idQuery.sql})) ORDER BY position ASC`
+      ).bind(...idQuery.bindings)
     );
-    const results = await this.database.batch(stmts);
+  }
+  /**
+   * Groups junction rows by parent and attaches them to the entries: one array property per
+   * multi-relation branch alias, per entry. `relResults[i]` must correspond to `branches[i]`.
+   *
+   * @param entries Mutated in place.
+   */
+  attachMultiRelationRows(branches, relResults, entries) {
     for (let i = 0; i < branches.length; i++) {
       const branch = branches[i];
       const byParent = /* @__PURE__ */ new Map();
-      for (const row of results[i].results ?? []) {
+      for (const row of relResults[i].results ?? []) {
         const r = row;
         const pid = r.parent_id;
-        if (!byParent.has(pid)) byParent.set(pid, []);
-        byParent.get(pid).push(r.target_id);
+        let targets = byParent.get(pid);
+        if (!targets) {
+          targets = [];
+          byParent.set(pid, targets);
+        }
+        targets.push(r.target_id);
       }
       for (const entry of entries) {
         entry[branch.alias] = byParent.get(entry.id) ?? [];
       }
     }
   }
+  /**
+   * Finds multiple entries for a given seed table based on the provided query options.
+   * Executes a single batch (one D1 round-trip) containing:
+   * 1. A selection query to retrieve the items for the current page (with columns, limits, offsets, and ordering).
+   * 2. A count query (using `isCount: true`) to retrieve the total number of matched items matching the same filters.
+   * 3. One junction-table query per multi-relation branch, scoped to the page via an id subquery.
+   *
+   * @param seed The seed schema definition.
+   * @param options Filtering, search, ordering, and pagination options.
+   * @returns An object containing the list of serialized entries and the total count of matched items.
+   * @throws RepositoryError if the database batch execution fails.
+   */
   async findMany(seed, options) {
     try {
       const { sql, bindings } = buildSelectQuery(seed, options);
-      const countSql = sql.replace(/SELECT .* FROM/, "SELECT COUNT(*) as total FROM").replace(/ ORDER BY .*$/, "").replace(/ LIMIT \? OFFSET \?$/, "");
-      const countBindings = bindings.slice(0, bindings.length - (options.pagination ? 2 : 0));
-      const [batchResults, totalCountResult] = await this.database.batch([
+      const { sql: countSql, bindings: countBindings } = buildSelectQuery(seed, {
+        ...options,
+        isCount: true
+      });
+      const branches = multiRelBranches(seed);
+      const relStmts = branches.length > 0 ? this.multiRelStatements(seed, branches, buildSelectQuery(seed, { ...options, fields: ["id"] })) : [];
+      const [batchResults, totalCountResult, ...relResults] = await this.database.batch([
         this.database.prepare(sql).bind(...bindings),
-        this.database.prepare(countSql).bind(...countBindings)
+        this.database.prepare(countSql).bind(...countBindings),
+        ...relStmts
       ]);
       const contentEntries = (batchResults.results || []).map((row) => this.rowToData(seed, row));
       const totalEntriesCount = totalCountResult.results?.[0]?.total || 0;
-      await this.attachMultiRelationsMany(seed, contentEntries);
+      this.attachMultiRelationRows(branches, relResults, contentEntries);
       return { items: contentEntries, total: totalEntriesCount };
     } catch (error) {
       throw this.mapError(error, `findMany(${seed.slug})`);
     }
   }
+  /**
+   * Fetches a single entry by id, including its multi-relation arrays.
+   * @throws EntryNotFoundError if no row with `id` exists in the seed's table.
+   * @throws RepositoryError on any other database failure.
+   */
   async findById(seed, id) {
     try {
       const tableName = this.getTableName(seed.slug);
@@ -5978,6 +6284,11 @@ var D1ContentRepository = class extends BaseD1Repository {
       throw this.mapError(error, `findById(${seed.slug}, ${id})`);
     }
   }
+  /**
+   * Fetches a single entry by its unique `slug`, including its multi-relation arrays.
+   * @throws EntryNotFoundError if no row with `slug` exists in the seed's table.
+   * @throws RepositoryError on any other database failure.
+   */
   async findBySlug(seed, slug) {
     try {
       const tableName = this.getTableName(seed.slug);
@@ -5993,6 +6304,11 @@ var D1ContentRepository = class extends BaseD1Repository {
       throw this.mapError(error, `findBySlug(${seed.slug}, ${slug})`);
     }
   }
+  /**
+   * Computes aggregate facets for a seed: entry counts per `status`, and the distinct set
+   * of tag values present across all entries for each `tags`-typed branch (via `json_each`
+   * over the JSON-serialized tag column).
+   */
   async getFacets(seed) {
     try {
       const tableName = this.getTableName(seed.slug);
@@ -6012,6 +6328,10 @@ var D1ContentRepository = class extends BaseD1Repository {
       throw this.mapError(error, `getFacets(${seed.slug})`);
     }
   }
+  /**
+   * Checks whether `slug` is already taken in the seed's table.
+   * @param excludeId When provided (e.g. during an update), excludes that entry's own row from the check.
+   */
   async existsSlug(seed, slug, excludeId) {
     try {
       const tableName = this.getTableName(seed.slug);
@@ -6027,6 +6347,10 @@ var D1ContentRepository = class extends BaseD1Repository {
       throw this.mapError(error, `existsSlug(${seed.slug}, ${slug})`);
     }
   }
+  /**
+   * Builds the `INSERT` statement for an entry's main table row. Multi-relation branch
+   * values are skipped (they're written as separate junction-table inserts by the caller).
+   */
   buildCreateMainStmt(seed, id, slug, status, data) {
     const tableName = this.getTableName(seed.slug);
     const columnNames = ["id", "slug", "status"];
@@ -6044,6 +6368,15 @@ var D1ContentRepository = class extends BaseD1Repository {
     const mainSql = `INSERT INTO ${tableName} (${columnNames.join(", ")}) VALUES (${placeholders.join(", ")})`;
     return this.database.prepare(mainSql).bind(...queryBindings);
   }
+  /**
+   * Builds the `UPDATE` statement for an entry's main table row from whichever branch
+   * aliases are present in `data` (partial update — absent keys are left untouched).
+   * Multi-relation branches present in `data` are returned as `junctionUpdates` instead
+   * of being included in the SQL, since they require separate delete+insert statements.
+   *
+   * @returns `stmt: null` when there is nothing to update on the main row (no scalar
+   *   fields and no `status` change) even if junction updates are still needed.
+   */
   buildUpdateMainStmt(seed, id, data, status) {
     const tableName = this.getTableName(seed.slug);
     const updateClauses = [];
@@ -6054,6 +6387,10 @@ var D1ContentRepository = class extends BaseD1Repository {
       updateClauses.push("status = ?");
       queryBindings.push(status);
     }
+    if (data.slug) {
+      updateClauses.push("slug = ?");
+      queryBindings.push(data.slug);
+    }
     for (const branch of seed.branches) {
       if (mRelAliases.has(branch.alias)) continue;
       if (Object.hasOwn(data, branch.alias)) {
@@ -6073,18 +6410,28 @@ var D1ContentRepository = class extends BaseD1Repository {
       junctionUpdates
     };
   }
+  /** Builds one `INSERT` per target id into a live multi-relation junction table, preserving array order via `position`. */
   buildJunctionInserts(seedSlug, parentId, branchAlias, targetIds) {
     const jt = jTable(seedSlug, branchAlias);
     return targetIds.map(
       (targetId, i) => this.database.prepare(`INSERT INTO ${jt} (parent_id, target_id, position) VALUES (?, ?, ?)`).bind(parentId, targetId, i)
     );
   }
+  /** Builds one `INSERT` per target id into a draft multi-relation junction table, preserving array order via `position`. */
   buildDraftJunctionInserts(seedSlug, entryId, branchAlias, targetIds) {
     const jdt = jDraftTable(seedSlug, branchAlias);
     return targetIds.map(
       (targetId, i) => this.database.prepare(`INSERT INTO ${jdt} (entry_id, target_id, position) VALUES (?, ?, ?)`).bind(entryId, targetId, i)
     );
   }
+  /**
+   * Validates that every relation target referenced by a draft still exists before publish,
+   * for both single-relation columns and multi-relation draft junction rows.
+   *
+   * @throws RelationTargetNotFoundError if any referenced target id is missing from its target seed's table.
+   * @returns The multi-relation branches and their resolved (validated) draft target ids,
+   *   so the caller can reuse them without re-querying the draft junction tables.
+   */
   async validatePublishDraftRelations(seed, draftRow, entryId) {
     for (const branch of singleRelBranches(seed)) {
       const value = draftRow[branch.alias];
@@ -6118,6 +6465,12 @@ var D1ContentRepository = class extends BaseD1Repository {
     }
     return { mRelBranches, mRelDraftIds };
   }
+  /**
+   * Builds the junction-table statements for one array-typed {@link BulkFieldUpdate}:
+   * `array_replace` (delete-all + reinsert), `array_add` (append via `INSERT OR IGNORE`
+   * with position computed from current max), or `array_remove` (targeted delete).
+   * Returns an empty array for a no-op (e.g. `array_remove` with an empty value list).
+   */
   getBulkArrayUpdateStmts(seedSlug, id, alias, update) {
     const jt = jTable(seedSlug, alias);
     const stmts = [];
@@ -6143,16 +6496,23 @@ var D1ContentRepository = class extends BaseD1Repository {
     }
     return stmts;
   }
-  async processBulkUpdateSingle(seedSlug, id, fields, tableName) {
+  /**
+   * Applies a bulk field update to a single entry as one batch: a main-table `UPDATE` for
+   * `set`-kind fields plus any junction statements for array-kind fields.
+   * @throws Error('not-found') if the main `UPDATE` affects zero rows (id doesn't exist).
+   */
+  async processBulkUpdateSingle(seed, id, fields, tableName) {
     const stmts = [];
     const setClauses = ["updated_at = (unixepoch())"];
     const setBindings = [];
     for (const [alias, update] of Object.entries(fields)) {
       if (update.kind === "set") {
-        setClauses.unshift(`${alias} = ?`);
-        setBindings.push(update.value);
+        const branch = seed.branches.find((b) => b.alias === alias);
+        const serializedValue = branch ? serializeForDb(branch, update.value) : update.value;
+        setClauses.push(`${alias} = ?`);
+        setBindings.push(serializedValue);
       } else {
-        stmts.push(...this.getBulkArrayUpdateStmts(seedSlug, id, alias, update));
+        stmts.push(...this.getBulkArrayUpdateStmts(seed.slug, id, alias, update));
       }
     }
     stmts.unshift(
@@ -6163,12 +6523,17 @@ var D1ContentRepository = class extends BaseD1Repository {
       throw new Error("not-found");
     }
   }
-  async processBulkUpdateChunk(seedSlug, chunk, fields, tableName) {
+  /**
+   * Sequentially applies a bulk field update to each id in `chunk`, isolating per-id
+   * failures (not-found, FK violation, or other error) into the `failed` list rather than
+   * aborting the whole chunk.
+   */
+  async processBulkUpdateChunk(seed, chunk, fields, tableName) {
     let updated = 0;
     const failed = [];
     for (const id of chunk) {
       try {
-        await this.processBulkUpdateSingle(seedSlug, id, fields, tableName);
+        await this.processBulkUpdateSingle(seed, id, fields, tableName);
         updated++;
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -6182,6 +6547,14 @@ var D1ContentRepository = class extends BaseD1Repository {
     }
     return { updated, failed };
   }
+  /**
+   * Creates a new entry: runs `beforeCreate` (which may transform the payload), inserts the
+   * main row plus any multi-relation junction rows as a single batch, then runs `afterCreate`.
+   *
+   * @throws SlugConflictError if `slug` already exists for this seed.
+   * @throws RepositoryError on any other database failure.
+   * @remarks `afterCreate` runs after the batch has committed, so it cannot roll back the write.
+   */
   async create(seed, id, slug, status, data, options) {
     let payload = data;
     if (this.hooks?.beforeCreate) {
@@ -6190,7 +6563,7 @@ var D1ContentRepository = class extends BaseD1Repository {
     }
     try {
       if (await this.existsSlug(seed, slug)) {
-        throw new SlugConflictError3(`Slug "${slug}" already exists for ${seed.slug}`);
+        throw new SlugConflictError4(`Slug "${slug}" already exists for ${seed.slug}`);
       }
       const batchStmts = [
         this.buildCreateMainStmt(seed, id, slug, status, payload)
@@ -6206,7 +6579,7 @@ var D1ContentRepository = class extends BaseD1Repository {
         await this.database.batch(batchStmts);
       }
     } catch (error) {
-      if (error instanceof SlugConflictError3) throw error;
+      if (error instanceof SlugConflictError4) throw error;
       throw this.mapError(error, `create(${seed.slug})`);
     }
     if (this.hooks?.afterCreate) {
@@ -6214,6 +6587,15 @@ var D1ContentRepository = class extends BaseD1Repository {
       await this.hooks.afterCreate(entry, this.hookCtx(seed, options?.actor));
     }
   }
+  /**
+   * Partially updates an existing entry: runs `beforeUpdate`, applies main-row and
+   * junction-table changes as a batch, then runs `afterUpdate`. A no-op payload (no scalar
+   * fields, no multi-relation fields, no status change) returns without touching the database.
+   *
+   * @throws EntryNotFoundError if the main-row `UPDATE` affects zero rows.
+   * @throws RepositoryError on any other database failure.
+   * @remarks `afterUpdate` runs after the batch has committed, so it cannot roll back the write.
+   */
   async update(seed, id, data, status, options) {
     let payload = data;
     if (this.hooks?.beforeUpdate) {
@@ -6251,6 +6633,14 @@ var D1ContentRepository = class extends BaseD1Repository {
       await this.hooks.afterUpdate(entry, this.hookCtx(seed, options?.actor));
     }
   }
+  /**
+   * Deletes an entry: runs `beforeDelete`, reads the row (for the return value), deletes it,
+   * then runs `afterDelete`. Relies on database-level `ON DELETE CASCADE` for junction rows.
+   *
+   * @returns The deserialized row as it existed immediately before deletion.
+   * @throws EntryNotFoundError if no row with `id` exists.
+   * @remarks `afterDelete` runs after the delete has committed, so it cannot roll back the write.
+   */
   async delete(seed, id, options) {
     if (this.hooks?.beforeDelete) {
       await this.hooks.beforeDelete(id, this.hookCtx(seed, options?.actor));
@@ -6273,6 +6663,14 @@ var D1ContentRepository = class extends BaseD1Repository {
     }
     return { row };
   }
+  /**
+   * Atomically increments/decrements a numeric field in a single conditional `UPDATE`
+   * (guarded by optional `min`/`max` bounds evaluated against the new value), avoiding
+   * read-modify-write races.
+   *
+   * @throws RepositoryError if `fieldName` isn't a `number`-typed branch on `seed`, or if
+   *   the conditional `UPDATE` affects zero rows (entry not found, or bound exceeded).
+   */
   async mutateField(seed, id, fieldName, operation, options) {
     try {
       const branch = seed.branches.find((b) => b.alias === fieldName);
@@ -6302,6 +6700,14 @@ var D1ContentRepository = class extends BaseD1Repository {
       throw this.mapError(error, `mutateField(${seed.slug}, ${id}, ${fieldName})`);
     }
   }
+  /**
+   * Executes a heterogeneous list of {@link BatchWrite} operations (create/update/mutateField)
+   * as a single atomic `database.batch` call. Does not invoke lifecycle hooks — callers needing
+   * hook side effects should use {@link create}/{@link update}/{@link mutateField} instead.
+   *
+   * @throws RepositoryError if any operation references a non-numeric field for `mutateField`,
+   *   or on any other database failure.
+   */
   async runBatch(operations) {
     if (operations.length === 0) return;
     try {
@@ -6350,6 +6756,11 @@ var D1ContentRepository = class extends BaseD1Repository {
       throw this.mapError(error, "runBatch");
     }
   }
+  /**
+   * Upserts a draft row for `entryId` (`INSERT ... ON CONFLICT DO UPDATE` keyed on `entry_id`)
+   * plus a full delete+reinsert of each multi-relation branch's draft junction rows.
+   * @throws RepositoryError if `seed.allowDrafts` is false, or on any database failure.
+   */
   async saveDraft(seed, entryId, data) {
     try {
       if (!seed.allowDrafts) {
@@ -6358,6 +6769,21 @@ var D1ContentRepository = class extends BaseD1Repository {
       const draftTableName = this.getTableName(seed.slug, true);
       const mRelBranches = multiRelBranches(seed);
       const mRelAliases = new Set(mRelBranches.map((b) => b.alias));
+      let existingTouched = [];
+      try {
+        const existing = await this.database.prepare(`SELECT _touched_fields FROM ${draftTableName} WHERE entry_id = ?`).bind(entryId).first();
+        if (existing && existing._touched_fields) {
+          existingTouched = JSON.parse(existing._touched_fields);
+        }
+      } catch {
+      }
+      const currentTouched = new Set(existingTouched);
+      for (const branch of seed.branches) {
+        if (Object.hasOwn(data, branch.alias)) {
+          currentTouched.add(branch.alias);
+        }
+      }
+      const updatedTouchedFields = Array.from(currentTouched);
       const columnNames = ["entry_id"];
       const placeholders = ["?"];
       const queryBindings = [entryId];
@@ -6372,6 +6798,10 @@ var D1ContentRepository = class extends BaseD1Repository {
           updateClauses.push(`${branch.alias} = EXCLUDED.${branch.alias}`);
         }
       }
+      columnNames.push("_touched_fields");
+      placeholders.push("?");
+      queryBindings.push(JSON.stringify(updatedTouchedFields));
+      updateClauses.push(`_touched_fields = EXCLUDED._touched_fields`);
       updateClauses.push("updated_at = (unixepoch())");
       const sql = `
         INSERT INTO ${draftTableName} (${columnNames.join(", ")})
@@ -6403,6 +6833,10 @@ var D1ContentRepository = class extends BaseD1Repository {
       throw this.mapError(error, `saveDraft(${seed.slug}, ${entryId})`);
     }
   }
+  /**
+   * Fetches the draft row for `entryId`, if any, merged with its multi-relation draft arrays.
+   * @returns `null` if `seed.allowDrafts` is false or no draft row exists.
+   */
   async getDraft(seed, entryId) {
     try {
       if (!seed.allowDrafts) return null;
@@ -6411,10 +6845,20 @@ var D1ContentRepository = class extends BaseD1Repository {
       if (!draftRow) return null;
       const mRelBranches = multiRelBranches(seed);
       const mRelAliases = new Set(mRelBranches.map((b) => b.alias));
+      let touchedFields = [];
+      if (draftRow && typeof draftRow["_touched_fields"] === "string") {
+        try {
+          touchedFields = JSON.parse(draftRow["_touched_fields"]);
+        } catch {
+        }
+      }
+      const touchedSet = new Set(touchedFields);
       const draftData = {};
       for (const branch of seed.branches) {
         if (mRelAliases.has(branch.alias)) continue;
-        if (draftRow[branch.alias] !== null) {
+        if (touchedSet.has(branch.alias)) {
+          draftData[branch.alias] = draftRow[branch.alias] !== null ? deserializeFromDb2(branch, draftRow[branch.alias]) : null;
+        } else if (draftRow[branch.alias] !== null) {
           draftData[branch.alias] = deserializeFromDb2(branch, draftRow[branch.alias]);
         }
       }
@@ -6424,9 +6868,12 @@ var D1ContentRepository = class extends BaseD1Repository {
         );
         const results = await this.database.batch(stmts);
         for (let i = 0; i < mRelBranches.length; i++) {
+          const alias = mRelBranches[i].alias;
           const ids = (results[i].results ?? []).map((r) => r.target_id);
-          if (ids.length > 0) {
-            draftData[mRelBranches[i].alias] = ids;
+          if (touchedSet.has(alias)) {
+            draftData[alias] = ids;
+          } else if (ids.length > 0) {
+            draftData[alias] = ids;
           }
         }
       }
@@ -6435,6 +6882,7 @@ var D1ContentRepository = class extends BaseD1Repository {
       throw this.mapError(error, `getDraft(${seed.slug}, ${entryId})`);
     }
   }
+  /** Checks whether a draft row exists for `entryId`. Always `false` if `seed.allowDrafts` is false. */
   async hasDraft(seed, entryId) {
     try {
       if (!seed.allowDrafts) return false;
@@ -6445,6 +6893,15 @@ var D1ContentRepository = class extends BaseD1Repository {
       throw this.mapError(error, `hasDraft(${seed.slug}, ${entryId})`);
     }
   }
+  /**
+   * Promotes a draft to the live entry: validates all relation targets referenced by the
+   * draft still exist, copies the draft's scalar fields into the live row, replaces the
+   * live junction rows with the draft's, and deletes the draft — all as one batch.
+   * A no-op if `seed.allowDrafts` is false.
+   *
+   * @throws EntryNotFoundError if no draft row exists for `entryId`.
+   * @throws RelationTargetNotFoundError if any relation the draft references no longer exists.
+   */
   async publishDraft(seed, entryId) {
     try {
       if (!seed.allowDrafts) return;
@@ -6454,33 +6911,56 @@ var D1ContentRepository = class extends BaseD1Repository {
       if (!draftRow) {
         throw new EntryNotFoundError7(`No draft found for ${entryId} in ${seed.slug}`);
       }
+      let touchedFields = [];
+      if (draftRow && typeof draftRow["_touched_fields"] === "string") {
+        try {
+          touchedFields = JSON.parse(draftRow["_touched_fields"]);
+        } catch {
+        }
+      }
+      const touchedSet = new Set(touchedFields);
       const { mRelBranches, mRelDraftIds } = await this.validatePublishDraftRelations(seed, draftRow, entryId);
       const mRelAliases = new Set(mRelBranches.map((b) => b.alias));
       const updateClauses = [];
       const queryBindings = [];
       for (const branch of seed.branches) {
         if (mRelAliases.has(branch.alias)) continue;
-        if (draftRow[branch.alias] !== null) {
+        if (touchedSet.has(branch.alias)) {
+          updateClauses.push(`${branch.alias} = ?`);
+          queryBindings.push(draftRow[branch.alias]);
+        } else if (draftRow[branch.alias] !== null) {
           updateClauses.push(`${branch.alias} = ?`);
           queryBindings.push(draftRow[branch.alias]);
         }
       }
-      updateClauses.push("updated_at = (unixepoch())");
-      const updateSql = `UPDATE ${liveTableName} SET ${updateClauses.join(", ")} WHERE id = ?`;
-      queryBindings.push(entryId);
+      let updateSql = "";
+      if (updateClauses.length > 0) {
+        updateClauses.push("updated_at = (unixepoch())");
+        updateSql = `UPDATE ${liveTableName} SET ${updateClauses.join(", ")} WHERE id = ?`;
+        queryBindings.push(entryId);
+      } else {
+        updateSql = `UPDATE ${liveTableName} SET updated_at = (unixepoch()) WHERE id = ?`;
+        queryBindings.push(entryId);
+      }
       const batchStmts = [
         this.database.prepare(updateSql).bind(...queryBindings),
         this.database.prepare(`DELETE FROM ${draftTableName} WHERE entry_id = ?`).bind(entryId)
       ];
       for (const branch of mRelBranches) {
-        const lt = jTable(seed.slug, branch.alias);
         const jdt = jDraftTable(seed.slug, branch.alias);
-        const targetIds = mRelDraftIds.get(branch.alias) ?? [];
-        batchStmts.push(
-          this.database.prepare(`DELETE FROM ${lt} WHERE parent_id = ?`).bind(entryId),
-          this.database.prepare(`DELETE FROM ${jdt} WHERE entry_id = ?`).bind(entryId),
-          ...this.buildJunctionInserts(seed.slug, entryId, branch.alias, targetIds)
-        );
+        if (touchedSet.has(branch.alias)) {
+          const lt = jTable(seed.slug, branch.alias);
+          const targetIds = mRelDraftIds.get(branch.alias) ?? [];
+          batchStmts.push(
+            this.database.prepare(`DELETE FROM ${lt} WHERE parent_id = ?`).bind(entryId),
+            this.database.prepare(`DELETE FROM ${jdt} WHERE entry_id = ?`).bind(entryId),
+            ...this.buildJunctionInserts(seed.slug, entryId, branch.alias, targetIds)
+          );
+        } else {
+          batchStmts.push(
+            this.database.prepare(`DELETE FROM ${jdt} WHERE entry_id = ?`).bind(entryId)
+          );
+        }
       }
       await this.database.batch(batchStmts);
     } catch (error) {
@@ -6489,19 +6969,25 @@ var D1ContentRepository = class extends BaseD1Repository {
       throw this.mapError(error, `publishDraft(${seed.slug}, ${entryId})`);
     }
   }
-  async bulkUpdate(seedSlug, ids, fields) {
+  /**
+   * Applies the same set of field updates across many entries, chunked at 50 ids per batch
+   * to bound per-call payload size. Per-id failures are collected rather than aborting the
+   * whole operation — see {@link processBulkUpdateSingle} for failure classification.
+   */
+  async bulkUpdate(seed, ids, fields) {
     const CHUNK = 50;
-    const tableName = this.getTableName(seedSlug);
+    const tableName = this.getTableName(seed.slug);
     let updated = 0;
     const failed = [];
     for (let offset = 0; offset < ids.length; offset += CHUNK) {
       const chunk = ids.slice(offset, offset + CHUNK);
-      const res = await this.processBulkUpdateChunk(seedSlug, chunk, fields, tableName);
+      const res = await this.processBulkUpdateChunk(seed, chunk, fields, tableName);
       updated += res.updated;
       failed.push(...res.failed);
     }
     return { updated, failed };
   }
+  /** Deletes the draft row for `entryId`, if any. A no-op if `seed.allowDrafts` is false. */
   async deleteDraft(seed, entryId) {
     try {
       if (!seed.allowDrafts) return;
@@ -6511,6 +6997,15 @@ var D1ContentRepository = class extends BaseD1Repository {
       throw this.mapError(error, `deleteDraft(${seed.slug}, ${entryId})`);
     }
   }
+  /**
+   * Finds every pending draft across the given seeds, `UNION ALL`-ing one query per seed
+   * so results span heterogeneous `content_{slug}_drafts` tables, then left-joins each
+   * against `activity_logs` to attribute the most recent "draft saved" action.
+   *
+   * @param seeds Seeds to search; drafts are looked up per-seed since draft tables aren't unified.
+   * @returns Draft summaries ordered by most-recently-updated first. `title` falls back to the
+   *   draft's own `id` if the display-name column is blank on both the draft and its live counterpart.
+   */
   async findPendingDrafts(seeds) {
     try {
       if (seeds.length === 0) return [];
@@ -6520,6 +7015,8 @@ var D1ContentRepository = class extends BaseD1Repository {
         const draftTable = `content_${seed.slug}_drafts`;
         const liveTable = `content_${seed.slug}`;
         const titleCol = seed.displayNameAlias;
+        const isScalar = seed.branches.some((b) => b.alias === titleCol && !(b.type === "relation" && b.multiple === true));
+        const titleExpr = isScalar ? `COALESCE(d.${titleCol}, l.${titleCol})` : `COALESCE(l.slug, d.entry_id)`;
         const seedLabel = seed.labelPlural ?? seed.label;
         unionSelects.push(`
           SELECT
@@ -6527,7 +7024,7 @@ var D1ContentRepository = class extends BaseD1Repository {
             ? AS seed_label,
             d.entry_id AS id,
             d.updated_at AS updated_at,
-            COALESCE(d.${titleCol}, l.${titleCol}) AS title
+            ${titleExpr} AS title
           FROM ${draftTable} d
           LEFT JOIN ${liveTable} l ON l.id = d.entry_id
         `);
@@ -6574,9 +7071,48 @@ var D1ContentRepository = class extends BaseD1Repository {
       throw this.mapError(error, "findPendingDrafts");
     }
   }
+  /**
+   * Updates an entry's field values (optional) and its kanban board position atomically in one
+   * batch: an optional main-row/junction update via {@link buildUpdateMainStmt}, plus an upsert
+   * into `kanban_positions` keyed on `(seed_slug, entry_id, axis_branch_id)`.
+   *
+   * @param patch Field changes to apply alongside the drag/drop, or `null` if only position changed.
+   * @param position Opaque fractional-index (or similar) position value used for ordering within the axis bucket.
+   * @param axisBranchId Identifies which branch/column axis this position is relative to (e.g. status column).
+   * @remarks Unlike {@link create}/{@link update}, this method does not invoke `beforeUpdate`/`afterUpdate`
+   *   lifecycle hooks — the `_ctx.actor` parameter is currently unused. Kanban drag-and-drop writes
+   *   therefore bypass hook-based side effects (e.g. audit logging) that `update()` would trigger.
+   */
+  async updateWithKanbanPosition(seed, id, patch, position, axisBranchId, _ctx) {
+    try {
+      const stmts = [];
+      if (patch) {
+        const { stmt, junctionUpdates } = this.buildUpdateMainStmt(seed, id, patch);
+        if (stmt) stmts.push(stmt);
+        for (const branch of junctionUpdates) {
+          const jt = jTable(seed.slug, branch.alias);
+          const value = patch[branch.alias] ?? [];
+          stmts.push(this.database.prepare(`DELETE FROM ${jt} WHERE parent_id = ?`).bind(id));
+          stmts.push(...this.buildJunctionInserts(seed.slug, id, branch.alias, value));
+        }
+      }
+      stmts.push(
+        this.database.prepare(`
+          INSERT INTO kanban_positions (seed_slug, entry_id, axis_branch_id, position, updated_at)
+          VALUES (?, ?, ?, ?, unixepoch())
+          ON CONFLICT(seed_slug, entry_id, axis_branch_id)
+            DO UPDATE SET position = excluded.position, updated_at = excluded.updated_at
+        `).bind(seed.slug, id, axisBranchId, position)
+      );
+      await this.database.batch(stmts);
+      return { success: true };
+    } catch (error) {
+      throw this.mapError(error, `updateWithKanbanPosition(${seed.slug}, ${id})`);
+    }
+  }
 };
 
-// src/shared/idempotency.repository.d1.ts
+// src/shared/db/repositories/idempotency.repository.d1.ts
 var D1IdempotencyRepository = class extends BaseD1Repository {
   /**
    * Looks up an idempotency record by its key.
@@ -6627,7 +7163,7 @@ var D1IdempotencyRepository = class extends BaseD1Repository {
   }
 };
 
-// src/shared/media.repository.d1.ts
+// src/shared/db/repositories/media.repository.d1.ts
 var D1MediaRepository = class {
   constructor(database) {
     this.database = database;
@@ -6683,7 +7219,7 @@ var D1MediaRepository = class {
   }
 };
 
-// src/shared/system-stats.repository.d1.ts
+// src/shared/db/repositories/system-stats.repository.d1.ts
 var D1SystemStatsRepository = class {
   constructor(database) {
     this.database = database;
@@ -6722,7 +7258,7 @@ var D1SystemStatsRepository = class {
   }
 };
 
-// src/shared/d1-user.repository.ts
+// src/shared/db/repositories/d1-user.repository.ts
 function rowToRecord(row) {
   return {
     id: row.id,
@@ -6789,7 +7325,7 @@ var D1UserRepository = class {
   }
 };
 
-// src/shared/d1-session.repository.ts
+// src/shared/db/repositories/d1-session.repository.ts
 function rowToRecord2(row) {
   return {
     id: row.id,
@@ -6848,7 +7384,7 @@ var D1SessionRepository = class {
   }
 };
 
-// src/shared/d1-password-reset-token.repository.ts
+// src/shared/db/repositories/d1-password-reset-token.repository.ts
 var D1PasswordResetTokenRepository = class {
   constructor(db, idGenerator) {
     this.db = db;
@@ -6878,7 +7414,7 @@ var D1PasswordResetTokenRepository = class {
   }
 };
 
-// src/shared/d1-activity-log.repository.ts
+// src/shared/db/repositories/d1-activity-log.repository.ts
 var D1ActivityLogRepository = class {
   constructor(database) {
     this.database = database;
@@ -6941,7 +7477,7 @@ function parseDetails(raw) {
   }
 }
 
-// src/shared/d1-notification.repository.ts
+// src/shared/db/repositories/d1-notification.repository.ts
 var D1NotificationRepository = class {
   constructor(database, clock, idGenerator) {
     this.database = database;
@@ -7005,7 +7541,7 @@ function mapRowToRecord2(row) {
   };
 }
 
-// src/shared/d1-widget.repository.ts
+// src/shared/db/repositories/d1-widget.repository.ts
 import {
   isDateRange
 } from "@beechcms/core";
@@ -7079,9 +7615,10 @@ var D1WidgetRepository = class {
     const bindings = [];
     const trimmedSearch = options.search?.trim() ?? "";
     if (trimmedSearch.length > 0) {
+      const escapedSearch = trimmedSearch.replace(/\\/g, "\\\\").replace(/%/g, "\\%").replace(/_/g, "\\_");
       const displayColumn = this.resolveColumnExpression(seed, seed.displayNameAlias);
-      conditions.push(`${displayColumn} LIKE ?`);
-      bindings.push(`%${trimmedSearch}%`);
+      conditions.push(`${displayColumn} LIKE ? ESCAPE '\\'`);
+      bindings.push(`%${escapedSearch}%`);
     }
     for (const filter of options.filters ?? []) {
       this.appendFilterCondition(seed, filter, conditions, bindings);
@@ -7282,7 +7819,7 @@ var D1WidgetRepository = class {
   }
 };
 
-// src/shared/d1-search.repository.ts
+// src/shared/db/repositories/d1-search.repository.ts
 var EMPTY_QUERY_ERROR = "EMPTY_QUERY";
 var D1SearchRepository = class {
   constructor(database) {
@@ -7342,7 +7879,7 @@ function mapFtsRowToResultRow(row) {
   };
 }
 
-// src/shared/d1-analytics.repository.ts
+// src/shared/db/repositories/d1-analytics.repository.ts
 var SECONDS_PER_DAY2 = 86400;
 var D1AnalyticsRepository = class {
   constructor(database, clock) {
@@ -7394,7 +7931,7 @@ var D1AnalyticsRepository = class {
   }
 };
 
-// src/shared/d1-content-scan.repository.ts
+// src/shared/db/repositories/d1-content-scan.repository.ts
 var D1ContentScanRepository = class {
   constructor(db) {
     this.db = db;
@@ -7423,7 +7960,7 @@ var D1ContentScanRepository = class {
   }
 };
 
-// src/shared/site-settings.repository.d1.ts
+// src/shared/db/repositories/site-settings.repository.d1.ts
 var DEFAULTS = {
   siteTitle: "Beech CMS",
   defaultLanguage: "en",
@@ -7463,7 +8000,7 @@ var D1SiteSettingsRepository = class {
   }
 };
 
-// src/shared/demo-data-sql.ts
+// src/shared/db/migrations/demo-data-sql.ts
 var DEMO_DATA_SQL = `
 INSERT OR IGNORE INTO content_clienti (id, slug, status, name, email, company, tier, account_status, mrr, created_at, updated_at)
 VALUES
@@ -8442,7 +8979,7 @@ VALUES
 
 `;
 
-// src/shared/demo-data.repository.d1.ts
+// src/shared/db/repositories/demo-data.repository.d1.ts
 var D1DemoDataRepository = class {
   constructor(db) {
     this.db = db;
@@ -8454,7 +8991,7 @@ var D1DemoDataRepository = class {
   }
 };
 
-// src/shared/d1-setup-checklist.repository.ts
+// src/shared/db/repositories/d1-setup-checklist.repository.ts
 var D1SetupChecklistRepository = class {
   constructor(db) {
     this.db = db;
@@ -8474,7 +9011,8 @@ var D1SetupChecklistRepository = class {
   }
 };
 
-// src/shared/seed-layout.repository.d1.ts
+// src/shared/db/repositories/seed-layout.repository.d1.ts
+import { seedViewConfigSchema as seedViewConfigSchema2 } from "@beechcms/core";
 var D1SeedLayoutRepository = class {
   constructor(db) {
     this.db = db;
@@ -8516,9 +9054,25 @@ var D1SeedLayoutRepository = class {
   async remove(slug) {
     await this.db.prepare("DELETE FROM seed_layouts WHERE slug = ?").bind(slug).run();
   }
+  async getViewConfig(slug) {
+    const row = await this.db.prepare("SELECT view_config FROM seed_layouts WHERE slug = ?").bind(slug).first();
+    if (!row?.view_config) return null;
+    return seedViewConfigSchema2.parse(JSON.parse(row.view_config));
+  }
+  async setViewConfig(slug, config, updatedBy) {
+    const json = JSON.stringify(config);
+    await this.db.prepare(`
+      INSERT INTO seed_layouts (slug, layout, view_config, updated_at, updated_by)
+      VALUES (?, '{}', ?, unixepoch(), ?)
+      ON CONFLICT(slug) DO UPDATE SET
+        view_config = excluded.view_config,
+        updated_at  = excluded.updated_at,
+        updated_by  = excluded.updated_by
+    `).bind(slug, json, updatedBy).run();
+  }
 };
 
-// src/shared/dashboard-layout.repository.d1.ts
+// src/shared/db/repositories/dashboard-layout.repository.d1.ts
 var D1DashboardLayoutRepository = class {
   constructor(db) {
     this.db = db;
@@ -8559,7 +9113,7 @@ var D1DashboardLayoutRepository = class {
   }
 };
 
-// src/shared/seed.repository.d1.ts
+// src/shared/db/repositories/seed.repository.d1.ts
 var D1SeedRepository = class {
   constructor(db) {
     this.db = db;
@@ -8634,7 +9188,7 @@ var D1SeedRepository = class {
   }
 };
 
-// src/shared/schema-mutator.d1.ts
+// src/shared/db/migrations/schema-mutator.d1.ts
 var D1SchemaMutator = class _D1SchemaMutator {
   constructor(db) {
     this.db = db;
@@ -8677,13 +9231,59 @@ var D1SchemaMutator = class _D1SchemaMutator {
     if (statements.length === 0) return;
     await this.db.batch(statements.map((s) => this.db.prepare(s)));
   }
+  async fetchRows(table, columns) {
+    _D1SchemaMutator.assertIdentifier(table);
+    for (const col of columns) _D1SchemaMutator.assertIdentifier(col);
+    const colList = columns.join(", ");
+    const rs = await this.db.prepare(`SELECT ${colList} FROM ${table}`).all();
+    return rs.results ?? [];
+  }
+};
+
+// src/shared/db/repositories/kanban-position.repository.d1.ts
+var D1KanbanPositionRepository = class {
+  constructor(db) {
+    this.db = db;
+  }
+  db;
+  async getColumn(seedSlug, axisBranchId) {
+    const rs = await this.db.prepare("SELECT entry_id, position FROM kanban_positions WHERE seed_slug = ? AND axis_branch_id = ?").bind(seedSlug, axisBranchId).all();
+    const map = /* @__PURE__ */ new Map();
+    for (const row of rs.results ?? []) {
+      map.set(row.entry_id, row.position);
+    }
+    return map;
+  }
+  async setPosition(seedSlug, entryId, axisBranchId, position) {
+    await this.db.prepare(`
+      INSERT INTO kanban_positions (seed_slug, entry_id, axis_branch_id, position, updated_at)
+      VALUES (?, ?, ?, ?, unixepoch())
+      ON CONFLICT(seed_slug, entry_id, axis_branch_id)
+        DO UPDATE SET position = excluded.position, updated_at = excluded.updated_at
+    `).bind(seedSlug, entryId, axisBranchId, position).run();
+  }
+  async remove(seedSlug, entryId, axisBranchId) {
+    await this.db.prepare("DELETE FROM kanban_positions WHERE seed_slug = ? AND entry_id = ? AND axis_branch_id = ?").bind(seedSlug, entryId, axisBranchId).run();
+  }
+  async rebalance(seedSlug, axisBranchId, ordered) {
+    if (ordered.length === 0) return;
+    const stmts = ordered.map(
+      (r) => this.db.prepare(`
+        INSERT INTO kanban_positions (seed_slug, entry_id, axis_branch_id, position, updated_at)
+        VALUES (?, ?, ?, ?, unixepoch())
+        ON CONFLICT(seed_slug, entry_id, axis_branch_id)
+          DO UPDATE SET position = excluded.position, updated_at = excluded.updated_at
+      `).bind(seedSlug, r.entryId, axisBranchId, r.position)
+    );
+    await this.db.batch(stmts);
+  }
 };
 
 // src/middleware/repository.middleware.ts
 import { SystemClock as SystemClock2, SystemIdGenerator } from "@beechcms/core";
 import { NoOpScheduler } from "@beechcms/core";
 
-// src/shared/automations.repository.d1.ts
+// src/shared/db/repositories/automations.repository.d1.ts
 var D1AutomationRepository = class {
   constructor(db) {
     this.db = db;
@@ -8769,7 +9369,7 @@ function rowToAutomation(row) {
   };
 }
 
-// src/shared/execution-context-scheduler.ts
+// src/shared/services/scheduler/execution-context-scheduler.ts
 var ExecutionContextScheduler = class {
   constructor(ctx) {
     this.ctx = ctx;
@@ -8828,6 +9428,7 @@ var repositoryMiddleware = (overrides) => {
     context.set("seedRepository", overrides?.seedRepository ?? new D1SeedRepository(database));
     context.set("schemaMutator", overrides?.schemaMutator ?? new D1SchemaMutator(database));
     context.set("dashboardLayoutRepository", overrides?.dashboardLayoutRepository ?? new D1DashboardLayoutRepository(database));
+    context.set("kanbanPositionRepository", overrides?.kanbanPositionRepository ?? new D1KanbanPositionRepository(database));
     await next();
   });
 };
@@ -8835,7 +9436,7 @@ var repositoryMiddleware = (overrides) => {
 // src/middleware/seed-registry.middleware.ts
 import { createMiddleware as createMiddleware3 } from "hono/factory";
 
-// src/shared/seed-registry-cache.ts
+// src/shared/services/cache/seed-registry-cache.ts
 import { SeedRegistry, buildBackrefMap } from "@beechcms/core";
 var cache = null;
 var TTL_MS = 5e3;
@@ -8895,30 +9496,12 @@ var S3Bucket = class {
     const command = new PutObjectCommand({
       Bucket: this.bucketName,
       Key: key,
-      Body: body instanceof ReadableStream ? await this.streamToUint8Array(body) : new Uint8Array(body),
+      Body: body instanceof ReadableStream ? body : new Uint8Array(body),
       ContentType: options?.contentType,
       Metadata: options?.metadata
     });
     await this.client.send(command);
   }
-  async streamToUint8Array(stream) {
-    const reader = stream.getReader();
-    const chunks = [];
-    let totalLength = 0;
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      chunks.push(value);
-      totalLength += value.length;
-    }
-    const result = new Uint8Array(totalLength);
-    let offset = 0;
-    for (const chunk of chunks) {
-      result.set(chunk, offset);
-      offset += chunk.length;
-    }
-    return result;
-  }
   async get(key) {
     try {
       const command = new GetObjectCommand({
@@ -8967,10 +9550,11 @@ var S3Bucket = class {
     }
   }
   getUrl(key) {
+    const encodedKey = key.split("/").map(encodeURIComponent).join("/");
     if (this.cdnUrl) {
-      return `${this.cdnUrl}/${encodeURIComponent(key)}`;
+      return `${this.cdnUrl}/${encodedKey}`;
     }
-    return `${this.baseUrl}/api/media/${encodeURIComponent(key)}`;
+    return `${this.baseUrl}/api/media/${encodedKey}`;
   }
   async getTotalSize() {
     let total = 0;
@@ -8992,7 +9576,8 @@ var S3Bucket = class {
     const command = new PutObjectCommand({
       Bucket: this.bucketName,
       Key: key,
-      ContentType: options.contentType
+      ContentType: options.contentType,
+      ContentLength: options.contentLength
     });
     return getSignedUrl(this.client, command, { expiresIn: options.expiresIn });
   }
@@ -9022,9 +9607,21 @@ var S3Bucket = class {
 };
 
 // src/shared/storage/factory.ts
+import { HTTPException as HTTPException2 } from "hono/http-exception";
 var NullBucket = class {
   fail() {
-    throw new Error("Storage not configured. Set R2_ENDPOINT, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, R2_BUCKET_NAME.");
+    throw new HTTPException2(503, {
+      res: new Response(
+        JSON.stringify({
+          error: "storage_not_configured",
+          message: "Storage is not configured. Please set R2 credentials or run MinIO."
+        }),
+        {
+          status: 503,
+          headers: { "Content-Type": "application/json" }
+        }
+      )
+    });
   }
   put() {
     return this.fail();
@@ -9081,7 +9678,7 @@ var storageMiddleware = (overrides) => {
   });
 };
 
-// src/shared/in-memory-seed.repository.ts
+// src/shared/db/repositories/in-memory-seed.repository.ts
 var InMemorySeedRepository = class {
   seeds;
   version = 1;
@@ -9127,7 +9724,7 @@ var InMemorySeedRepository = class {
 import { createMiddleware as createMiddleware5 } from "hono/factory";
 import { SystemClock as SystemClock3 } from "@beechcms/core";
 
-// src/auth/bcrypt-hash-provider.ts
+// src/auth/providers/hash.provider.ts
 import bcrypt from "bcryptjs";
 var BCRYPT_SALT_ROUNDS = 10;
 var BcryptHashProvider = class {
@@ -9143,7 +9740,7 @@ var BcryptHashProvider = class {
   }
 };
 
-// src/auth/jose-token-service.ts
+// src/auth/providers/jwt-token.service.ts
 import { SignJWT, jwtVerify } from "jose";
 var DEFAULT_TOKEN_TTL_SECONDS = 900;
 var DEFAULT_ALGORITHM = "HS256";
@@ -9175,8 +9772,12 @@ var JoseTokenService = class {
       const { payload } = await jwtVerify(token, this.secretBytes, {
         algorithms: [algorithm],
         issuer: this.config.issuer,
-        audience: this.config.audience
+        audience: this.config.audience,
+        currentDate: new Date(this.clock.nowSeconds() * 1e3)
       });
+      if (typeof payload.sub !== "string" || payload.sub === "") {
+        return null;
+      }
       return payload;
     } catch {
       return null;
@@ -9214,13 +9815,23 @@ import { createMiddleware as createMiddleware6 } from "hono/factory";
 
 // src/rate-limit/cloudflare-rate-limiter.ts
 var CloudflareRateLimiter = class {
-  constructor(binding) {
+  constructor(binding, options = {}) {
     this.binding = binding;
+    this.options = options;
   }
   binding;
+  options;
   async checkLimit(key) {
-    const { success } = await this.binding.limit({ key });
-    return { isAllowed: success };
+    try {
+      const res = await this.binding.limit({ key });
+      return {
+        isAllowed: res.success,
+        retryAfterSeconds: res.retryAfterSeconds ?? res.retryAfter
+      };
+    } catch (error) {
+      console.warn(`Rate limiter binding error for key "${key}":`, error);
+      return { isAllowed: !this.options.failClosed };
+    }
   }
 };
 
@@ -9235,13 +9846,20 @@ var NoOpRateLimiter = class {
 var NO_OP = new NoOpRateLimiter();
 function buildDefaultRegistry(env) {
   const isDev = env.ENV === "development" && !(typeof globalThis.process !== "undefined" && globalThis.process.env?.VITEST);
+  const isProd = env.ENV === "production";
+  const getLimiter = (bindingName, binding, options) => {
+    if (isProd && !binding) {
+      throw new Error(`Missing rate limiter binding: ${bindingName} is required in production environment.`);
+    }
+    return !isDev && binding ? new CloudflareRateLimiter(binding, options) : NO_OP;
+  };
   const limiters = {
-    login: !isDev && env.LOGIN_RATE_LIMITER ? new CloudflareRateLimiter(env.LOGIN_RATE_LIMITER) : NO_OP,
-    tokenRefresh: !isDev && env.REFRESH_RATE_LIMITER ? new CloudflareRateLimiter(env.REFRESH_RATE_LIMITER) : NO_OP,
-    forgotPassword: !isDev && env.FORGOT_PASSWORD_RATE_LIMITER ? new CloudflareRateLimiter(env.FORGOT_PASSWORD_RATE_LIMITER) : NO_OP,
-    resetPassword: !isDev && env.RESET_PASSWORD_RATE_LIMITER ? new CloudflareRateLimiter(env.RESET_PASSWORD_RATE_LIMITER) : NO_OP,
-    publicApiRead: !isDev && env.PUBLIC_READ_RATE_LIMITER ? new CloudflareRateLimiter(env.PUBLIC_READ_RATE_LIMITER) : NO_OP,
-    publicApiWrite: !isDev && env.PUBLIC_WRITE_RATE_LIMITER ? new CloudflareRateLimiter(env.PUBLIC_WRITE_RATE_LIMITER) : NO_OP
+    login: getLimiter("LOGIN_RATE_LIMITER", env.LOGIN_RATE_LIMITER, { failClosed: true }),
+    tokenRefresh: getLimiter("REFRESH_RATE_LIMITER", env.REFRESH_RATE_LIMITER, { failClosed: true }),
+    forgotPassword: getLimiter("FORGOT_PASSWORD_RATE_LIMITER", env.FORGOT_PASSWORD_RATE_LIMITER, { failClosed: true }),
+    resetPassword: getLimiter("RESET_PASSWORD_RATE_LIMITER", env.RESET_PASSWORD_RATE_LIMITER, { failClosed: true }),
+    publicApiRead: getLimiter("PUBLIC_READ_RATE_LIMITER", env.PUBLIC_READ_RATE_LIMITER, { failClosed: false }),
+    publicApiWrite: getLimiter("PUBLIC_WRITE_RATE_LIMITER", env.PUBLIC_WRITE_RATE_LIMITER, { failClosed: false })
   };
   return { getLimiter: (name) => limiters[name] };
 }
@@ -9257,7 +9875,7 @@ var rateLimiterMiddleware = (overrides) => {
 import { createMiddleware as createMiddleware7 } from "hono/factory";
 import { SystemClock as SystemClock4, SystemIdGenerator as SystemIdGenerator2 } from "@beechcms/core";
 
-// src/shared/d1-activity-logger.ts
+// src/shared/services/activity-log/d1-activity-logger.ts
 var ACTIVITY_LOG_INSERT_SQL = `INSERT INTO activity_logs
      (id, user_id, user_email, user_name, action, entity_type, entity_id, entity_slug, details)
    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`;
@@ -9302,7 +9920,7 @@ var D1ActivityLogger = class {
   }
 };
 
-// src/shared/background-notification-service.ts
+// src/shared/services/notification/background-notification-service.ts
 var DEFAULT_NOTIFICATION_TYPE = "info";
 var BackgroundNotificationService = class {
   constructor(notificationRepository, scheduleBackgroundTask) {
@@ -9332,7 +9950,7 @@ var BackgroundNotificationService = class {
   }
 };
 
-// src/shared/qstash-notification-service.ts
+// src/shared/services/notification/qstash-notification-service.ts
 import { Client } from "@upstash/qstash";
 var QStashNotificationService = class {
   constructor(token, appUrl, scheduleBackgroundTask, qstashUrl) {
@@ -9405,7 +10023,7 @@ var observabilityMiddleware = (overrides) => {
 import { createMiddleware as createMiddleware8 } from "hono/factory";
 import { SystemClock as SystemClock5, SystemIdGenerator as SystemIdGenerator3 } from "@beechcms/core";
 
-// src/shared/cloudflare-queue-service.ts
+// src/shared/services/queue/cloudflare-queue-service.ts
 var CloudflareQueueService = class {
   constructor(queue) {
     this.queue = queue;
@@ -9420,7 +10038,7 @@ var CloudflareQueueService = class {
   }
 };
 
-// src/shared/in-memory-queue-service.ts
+// src/shared/services/queue/in-memory-queue-service.ts
 var InMemoryQueueService = class {
   constructor(jobs, context, scheduleBackgroundTask) {
     this.jobs = jobs;
@@ -9547,7 +10165,7 @@ function createBeechApp(config) {
         try {
           const originUrl = new URL(origin);
           const requestUrl = new URL(context.req.url);
-          if (originUrl.hostname === requestUrl.hostname && originUrl.port === requestUrl.port) {
+          if (originUrl.protocol === requestUrl.protocol && originUrl.hostname === requestUrl.hostname && originUrl.port === requestUrl.port) {
             return origin;
           }
         } catch {
@@ -9601,7 +10219,13 @@ function createBeechApp(config) {
       if (!validateLoginInput(email, password)) return context.json({ error: AUTH_ERRORS.INVALID_REQUEST }, 400);
       const clientIp = getClientIp(context.req);
       const loginRateLimit = await context.get("rateLimiters").getLimiter("login").checkLimit(clientIp);
-      if (!loginRateLimit.isAllowed) return context.json({ error: AUTH_ERRORS.RATE_LIMIT_EXCEEDED }, 429);
+      if (!loginRateLimit.isAllowed) {
+        const headers = {};
+        if (loginRateLimit.retryAfterSeconds !== void 0) {
+          headers["Retry-After"] = String(loginRateLimit.retryAfterSeconds);
+        }
+        return context.json({ error: AUTH_ERRORS.RATE_LIMIT_EXCEEDED }, 429, headers);
+      }
       const user = await context.get("userRepository").findByEmail(email);
       const hashToCompare = user?.passwordHash ?? DUMMY_PASSWORD_HASH;
       const isValid = await verifyPassword(password, hashToCompare, context.get("hashProvider"));
@@ -9626,7 +10250,13 @@ function createBeechApp(config) {
     try {
       const refreshClientIp = getClientIp(context.req);
       const refreshRateLimit = await context.get("rateLimiters").getLimiter("tokenRefresh").checkLimit(refreshClientIp);
-      if (!refreshRateLimit.isAllowed) return context.json({ error: AUTH_ERRORS.RATE_LIMIT_EXCEEDED }, 429);
+      if (!refreshRateLimit.isAllowed) {
+        const headers = {};
+        if (refreshRateLimit.retryAfterSeconds !== void 0) {
+          headers["Retry-After"] = String(refreshRateLimit.retryAfterSeconds);
+        }
+        return context.json({ error: AUTH_ERRORS.RATE_LIMIT_EXCEEDED }, 429, headers);
+      }
       const refreshToken = getCookie(context, "refresh_token");
       if (!refreshToken) return context.json({ error: "Refresh token missing" }, 401);
       const nowSeconds = SystemClock6.nowSeconds();
@@ -9647,10 +10277,19 @@ function createBeechApp(config) {
         tokenHash: newRefreshTokenHash,
         expiresAt: nowSeconds + REFRESH_TOKEN_EXPIRY_DAYS * SECONDS_PER_DAY3
       });
-      const revoked = await context.get("sessionRepository").revokeByHash(tokenHash, nowSeconds);
-      if (!revoked) return context.json({ error: "Invalid refresh token" }, 401);
-      setCookie(context, "refresh_token", newRefreshToken, getRefreshTokenCookieOptions(isRequestSecure(context.req.url)));
-      return context.json({ token: newAccessToken, expiresIn: "15m" }, 200);
+      try {
+        const revoked = await context.get("sessionRepository").revokeByHash(tokenHash, nowSeconds);
+        if (!revoked) {
+          await context.get("sessionRepository").revokeByHash(newRefreshTokenHash, nowSeconds);
+          return context.json({ error: "Invalid refresh token" }, 401);
+        }
+        setCookie(context, "refresh_token", newRefreshToken, getRefreshTokenCookieOptions(isRequestSecure(context.req.url)));
+        return context.json({ token: newAccessToken, expiresIn: "15m" }, 200);
+      } catch (error) {
+        await context.get("sessionRepository").revokeByHash(newRefreshTokenHash, nowSeconds).catch(() => {
+        });
+        throw error;
+      }
     } catch (error) {
       return handleAuthError(context, error, "Refresh");
     }
@@ -9692,7 +10331,7 @@ function createBeechApp(config) {
   apiPublic.route("/", publicRoutes);
   app.route("/api/v1/public", apiPublic);
   app.route("/api/webhooks", webhooksApp);
-  app.get("/api/media/:key", (context) => serveMediaHandler(context));
+  app.get("/api/media/:key{.+}", (context) => serveMediaHandler(context));
   if (config.customRoutes) {
     const publicRouter = new Hono19();
     const protectedRouter = new Hono19();