@beechcms/core 0.4.0 → 0.4.1

package/dist/auth/password-reset-token.repository.d.ts

@@ -1,5 +1,4 @@
 export interface NewPasswordResetToken {
-    id: string;
     userId: string;
     tokenHash: string;
     expiresAt: number;

package/dist/auth/password-reset-token.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset-token.repository.d.ts","sourceRoot":"","sources":["../../src/auth/password-reset-token.repository.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C;;;OAGG;IACH,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEtE,0FAA0F;IAC1F,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEpD;;;;OAIG;IACH,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAA;IAEtG,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/D"}
+{"version":3,"file":"password-reset-token.repository.d.ts","sourceRoot":"","sources":["../../src/auth/password-reset-token.repository.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C;;;OAGG;IACH,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEtE,0FAA0F;IAC1F,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEpD;;;;OAIG;IACH,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAA;IAEtG,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/D"}

package/dist/clock.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Time abstraction. Hides direct calls to {@link Date.now} so callers can
+ * swap in deterministic clocks during tests without resorting to global
+ * timer mocks (e.g. vi.useFakeTimers, sinon, monkey-patching Date).
+ */
+export interface IClock {
+    /**
+     * Returns the current Unix timestamp in milliseconds.
+     * Equivalent to Date.now() in production.
+     * Overridable in tests for deterministic time-sensitive assertions.
+     */
+    now(): number;
+    /**
+     * Returns the current Unix timestamp in whole seconds.
+     * Equivalent to Math.floor(Date.now() / 1000) in production.
+     * Used by JWT issuance, session expiry, and analytics day-bucket computations.
+     */
+    nowSeconds(): number;
+}
+/**
+ * Production singleton. Delegates to the host runtime clock. Stateless and
+ * therefore safe to share across requests.
+ */
+export declare const SystemClock: IClock;
+//# sourceMappingURL=clock.d.ts.map

package/dist/clock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clock.d.ts","sourceRoot":"","sources":["../src/clock.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,MAAM;IACrB;;;;OAIG;IACH,GAAG,IAAI,MAAM,CAAA;IAEb;;;;OAIG;IACH,UAAU,IAAI,MAAM,CAAA;CACrB;AAID;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,MAGzB,CAAA"}

package/dist/clock.js

@@ -0,0 +1,9 @@
+const MILLISECONDS_PER_SECOND = 1000;
+/**
+ * Production singleton. Delegates to the host runtime clock. Stateless and
+ * therefore safe to share across requests.
+ */
+export const SystemClock = {
+    now: () => Date.now(),
+    nowSeconds: () => Math.floor(Date.now() / MILLISECONDS_PER_SECOND),
+};

package/dist/content-scan.repository.d.ts

@@ -0,0 +1,9 @@
+import type { Seed } from './types.js';
+export interface IContentScanRepository {
+    /**
+     * Scans across all registered seeds to identify media keys that are currently referenced
+     * by any content entry. Used for orphaned media detection and storage analytics.
+     */
+    getReferencedMediaKeys(seeds: Seed[]): Promise<Set<string>>;
+}
+//# sourceMappingURL=content-scan.repository.d.ts.map

package/dist/content-scan.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-scan.repository.d.ts","sourceRoot":"","sources":["../src/content-scan.repository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,sBAAsB,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;CAC5D"}

package/dist/content-scan.repository.js

@@ -0,0 +1 @@
+export {};

package/dist/engine.d.ts

@@ -1,47 +1,47 @@
 /**
  * Botanical Engine: Schema Compiler + Query Builder.
  *
- * In v0.4.0 ogni Seed ha una tabella SQL dedicata (`content_{slug}`) con colonne
- * reali tipizzate. Questo modulo genera il DDL e costruisce query parametrizzate.
- * Non conosce HTTP, auth o UI — è una libreria Node.js pura (C6).
+ * In v0.4.0 each Seed has a dedicated SQL table (`content_{slug}`) with
+ * real typed columns. This module generates the DDL and builds parameterized queries.
+ * It does not know about HTTP, auth, or UI — it's a pure TypeScript library.
  */
 import type { Seed, Branch, SelectOptions, ParameterizedQuery } from './types.js';
 /**
- * Genera `CREATE TABLE IF NOT EXISTS content_{slug}` con colonne di sistema
- * + una colonna per ogni Branch. Funzione pura: stesso Seed → stesso SQL.
+ * Generates `CREATE TABLE IF NOT EXISTS content_{slug}` with system columns
+ * + one column per Branch. Pure function: same Seed → same SQL.
  */
 export declare function generateCreateTable(seed: Seed): string;
 /**
- * Genera la tabella bozze `content_{slug}_drafts` per i Seed con `allowDrafts: true`.
- * Tutte le colonne branch sono nullable (le bozze sono parziali).
- * Ritorna null se il Seed non ha `allowDrafts: true`.
+ * Generates the drafts table `content_{slug}_drafts` for Seeds with `allowDrafts: true`.
+ * All branch columns are nullable (drafts are partial).
+ * Returns null if the Seed does not have `allowDrafts: true`.
  */
 export declare function generateDraftTable(seed: Seed): string | null;
 /**
- * Genera `ALTER TABLE content_{slug} ADD COLUMN {alias} {type}`.
- * Nuove colonne sono sempre nullable (limite SQLite su ALTER TABLE).
+ * Generates `ALTER TABLE content_{slug} ADD COLUMN {alias} {type}`.
+ * New columns are always nullable (SQLite limit on ALTER TABLE).
  */
 export declare function generateAddColumn(seed: Seed, branch: Branch): string;
 /**
- * Genera indici B-tree per status, created_at e ogni Branch filtrabile
- * con tipo indicizzabile (text, number, date, boolean).
+ * Generates B-tree indexes for status, created_at and every filterable Branch
+ * with an indexable type (text, number, date, boolean).
  */
 export declare function generateIndexes(seed: Seed): string[];
 /**
- * Genera la virtual table FTS5 per i Branch text/richtext indicizzabili.
- * Ritorna null se il Seed non ha branch con search abilitato.
+ * Generates the FTS5 virtual table for indexable text/richtext Branches.
+ * Returns null if the Seed has no branches with search enabled.
  */
 export declare function generateFtsTable(seed: Seed): string | null;
 /**
- * Genera i 3 trigger SQLite (insert/update/delete) che mantengono la FTS
- * sincronizzata automaticamente — elimina la necessità di syncFts manuale.
- * Ritorna array vuoto se il Seed non ha branch indicizzabili.
+ * Generates the 3 SQLite triggers (insert/update/delete) that keep the FTS
+ * automatically synchronized — eliminates the need for manual syncFts.
+ * Returns an empty array if the Seed has no indexable branches.
  */
 export declare function generateFtsTriggers(seed: Seed): string[];
 /**
- * Costruisce una SELECT parametrizzata su `content_{slug}`.
- * Non usa mai json_extract — ogni colonna è una colonna reale.
- * Colonne sconosciute nei filtri/orderBy vengono ignorate (fail-closed).
+ * Builds a parameterized SELECT on `content_{slug}`.
+ * Never uses json_extract — every column is a real column.
+ * Unknown columns in filters/orderBy are ignored (fail-closed).
  */
 export declare function buildSelectQuery(seed: Seed, options?: SelectOptions): ParameterizedQuery;
 export interface SchemaColumn {
@@ -51,17 +51,17 @@ export interface SchemaColumn {
     isPk: boolean;
 }
 /**
- * Ritorna la lista di colonne attese per la tabella di un Seed.
- * Usato da `beech seed:load --diff` per confrontare schema attuale vs atteso.
+ * Returns the list of expected columns for a Seed's table.
+ * Used by `beech seed:load --diff` to compare current vs expected schema.
  */
 export declare function getExpectedColumns(seed: Seed): SchemaColumn[];
 /**
- * Serializza un valore per la scrittura nel DB.
+ * Serializes a value for writing to the DB.
  * boolean → 0/1 | date → Unix timestamp | json/asset-list → JSON string
  */
 export declare function serializeForDb(branch: Branch, value: unknown): string | number | null;
 /**
- * Deserializza un valore letto dal DB per la risposta API.
+ * Deserializes a value read from the DB for the API response.
  * 0/1 → boolean | Unix timestamp → ISO 8601 | JSON string → object
  */
 export declare function deserializeFromDb(branch: Branch, value: unknown): unknown;

package/dist/engine.js

@@ -71,8 +71,8 @@ function normalizeAssetListValue(rawValue) {
 }
 // ---- DDL Generators ----
 /**
- * Genera `CREATE TABLE IF NOT EXISTS content_{slug}` con colonne di sistema
- * + una colonna per ogni Branch. Funzione pura: stesso Seed → stesso SQL.
+ * Generates `CREATE TABLE IF NOT EXISTS content_{slug}` with system columns
+ * + one column per Branch. Pure function: same Seed → same SQL.
  */
 export function generateCreateTable(seed) {
     const table = tableName(seed);
@@ -97,9 +97,9 @@ export function generateCreateTable(seed) {
     return lines.join('\n');
 }
 /**
- * Genera la tabella bozze `content_{slug}_drafts` per i Seed con `allowDrafts: true`.
- * Tutte le colonne branch sono nullable (le bozze sono parziali).
- * Ritorna null se il Seed non ha `allowDrafts: true`.
+ * Generates the drafts table `content_{slug}_drafts` for Seeds with `allowDrafts: true`.
+ * All branch columns are nullable (drafts are partial).
+ * Returns null if the Seed does not have `allowDrafts: true`.
  */
 export function generateDraftTable(seed) {
     if (!seed.allowDrafts)
@@ -114,7 +114,7 @@ export function generateDraftTable(seed) {
     for (const branch of seed.branches) {
         const { sqlType } = BRANCH_TYPE_SQL[branch.type];
         let col = `  ${branch.alias}  ${sqlType}`;
-        // boolean CHECK: in SQLite, NULL IN (0,1) → NULL, che passa il CHECK (solo FALSE lo fallisce)
+        // boolean CHECK: in SQLite, NULL IN (0,1) → NULL, which passes the CHECK (only FALSE fails it)
         if (branch.type === 'boolean')
             col += ` CHECK (${branch.alias} IN (0, 1))`;
         lines.push(col + ',');
@@ -124,16 +124,16 @@ export function generateDraftTable(seed) {
     return lines.join('\n');
 }
 /**
- * Genera `ALTER TABLE content_{slug} ADD COLUMN {alias} {type}`.
- * Nuove colonne sono sempre nullable (limite SQLite su ALTER TABLE).
+ * Generates `ALTER TABLE content_{slug} ADD COLUMN {alias} {type}`.
+ * New columns are always nullable (SQLite limit on ALTER TABLE).
  */
 export function generateAddColumn(seed, branch) {
     const { sqlType } = BRANCH_TYPE_SQL[branch.type];
     return `ALTER TABLE ${tableName(seed)} ADD COLUMN ${branch.alias} ${sqlType};`;
 }
 /**
- * Genera indici B-tree per status, created_at e ogni Branch filtrabile
- * con tipo indicizzabile (text, number, date, boolean).
+ * Generates B-tree indexes for status, created_at and every filterable Branch
+ * with an indexable type (text, number, date, boolean).
  */
 export function generateIndexes(seed) {
     const table = tableName(seed);
@@ -152,8 +152,8 @@ export function generateIndexes(seed) {
     return indexes;
 }
 /**
- * Genera la virtual table FTS5 per i Branch text/richtext indicizzabili.
- * Ritorna null se il Seed non ha branch con search abilitato.
+ * Generates the FTS5 virtual table for indexable text/richtext Branches.
+ * Returns null if the Seed has no branches with search enabled.
  */
 export function generateFtsTable(seed) {
     const rtBranches = indexableSearchBranches(seed);
@@ -170,9 +170,9 @@ export function generateFtsTable(seed) {
     ].join('\n');
 }
 /**
- * Genera i 3 trigger SQLite (insert/update/delete) che mantengono la FTS
- * sincronizzata automaticamente — elimina la necessità di syncFts manuale.
- * Ritorna array vuoto se il Seed non ha branch indicizzabili.
+ * Generates the 3 SQLite triggers (insert/update/delete) that keep the FTS
+ * automatically synchronized — eliminates the need for manual syncFts.
+ * Returns an empty array if the Seed has no indexable branches.
  */
 export function generateFtsTriggers(seed) {
     const rtBranches = indexableSearchBranches(seed);
@@ -208,9 +208,9 @@ export function generateFtsTriggers(seed) {
 }
 // ---- Query Builder ----
 /**
- * Costruisce una SELECT parametrizzata su `content_{slug}`.
- * Non usa mai json_extract — ogni colonna è una colonna reale.
- * Colonne sconosciute nei filtri/orderBy vengono ignorate (fail-closed).
+ * Builds a parameterized SELECT on `content_{slug}`.
+ * Never uses json_extract — every column is a real column.
+ * Unknown columns in filters/orderBy are ignored (fail-closed).
  */
 export function buildSelectQuery(seed, options = {}) {
     const table = tableName(seed);
@@ -369,8 +369,8 @@ function buildFilterCondition(col, type, cond, bindings) {
     return null;
 }
 /**
- * Ritorna la lista di colonne attese per la tabella di un Seed.
- * Usato da `beech seed:load --diff` per confrontare schema attuale vs atteso.
+ * Returns the list of expected columns for a Seed's table.
+ * Used by `beech seed:load --diff` to compare current vs expected schema.
  */
 export function getExpectedColumns(seed) {
     return [
@@ -389,7 +389,7 @@ export function getExpectedColumns(seed) {
 }
 // ---- Serialization / Deserialization ----
 /**
- * Serializza un valore per la scrittura nel DB.
+ * Serializes a value for writing to the DB.
  * boolean → 0/1 | date → Unix timestamp | json/asset-list → JSON string
  */
 export function serializeForDb(branch, value) {
@@ -427,7 +427,7 @@ export function serializeForDb(branch, value) {
     }
 }
 /**
- * Deserializza un valore letto dal DB per la risposta API.
+ * Deserializes a value read from the DB for the API response.
  * 0/1 → boolean | Unix timestamp → ISO 8601 | JSON string → object
  */
 export function deserializeFromDb(branch, value) {

package/dist/id-generator.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Identifier abstraction. Hides direct calls to {@link crypto.randomUUID}
+ * so callers can swap in deterministic generators during tests for stable
+ * snapshot assertions and predictable insert ordering.
+ */
+export interface IIdGenerator {
+    /**
+     * Generates a new universally unique identifier.
+     * Production implementation delegates to crypto.randomUUID().
+     * Test implementations return deterministic values for snapshot assertions.
+     */
+    uuid(): string;
+}
+/**
+ * Production singleton. Delegates to the host runtime CSPRNG-backed UUID
+ * generator. Stateless and therefore safe to share across requests.
+ */
+export declare const SystemIdGenerator: IIdGenerator;
+//# sourceMappingURL=id-generator.d.ts.map

package/dist/id-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-generator.d.ts","sourceRoot":"","sources":["../src/id-generator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,IAAI,IAAI,MAAM,CAAA;CACf;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,YAE/B,CAAA"}

package/dist/id-generator.js

@@ -0,0 +1,7 @@
+/**
+ * Production singleton. Delegates to the host runtime CSPRNG-backed UUID
+ * generator. Stateless and therefore safe to share across requests.
+ */
+export const SystemIdGenerator = {
+    uuid: () => crypto.randomUUID(),
+};

package/dist/index.d.ts

@@ -1,9 +1,9 @@
 /**
  * @beechcms/core - Botanical Engine
  *
- * Pacchetto condiviso del monorepo Beech CMS.
- * In v0.4.0 il Botanical Engine è un compilatore di schema SQL: legge i Seed
- * TypeScript e genera DDL deterministico + query parametrizzate.
+ * Shared package of the Beech CMS monorepo.
+ * In v0.4.0 the Botanical Engine is a SQL schema compiler: it reads TypeScript
+ * Seeds and generates deterministic DDL + parameterized queries.
  *
  * @module @beechcms/core
  */
@@ -20,4 +20,21 @@ export * from './idempotency.repository.js';
 export * from './media.repository.js';
 export * from './storage.js';
 export * from './policies.js';
+export * from './auth/hash-provider.js';
+export * from './auth/token-service.js';
+export * from './auth/user.repository.js';
+export * from './auth/session.repository.js';
+export * from './auth/password-reset-token.repository.js';
+export * from './rate-limit/rate-limiter.js';
+export * from './observability/activity-logger.js';
+export * from './observability/activity-log.repository.js';
+export * from './observability/analytics.repository.js';
+export * from './notifications/notification.repository.js';
+export * from './notifications/notification-service.js';
+export * from './widget/widget.repository.js';
+export * from './search/search.repository.js';
+export * from './content-scan.repository.js';
+export * from './clock.js';
+export * from './id-generator.js';
+export * from './seed-registry.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,cAAc,YAAY,CAAA;AAC1B,cAAc,kBAAkB,CAAA;AAChC,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,yBAAyB,CAAA;AACvC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,uBAAuB,CAAA;AACrC,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,cAAc,YAAY,CAAA;AAC1B,cAAc,kBAAkB,CAAA;AAChC,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,yBAAyB,CAAA;AACvC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,uBAAuB,CAAA;AACrC,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,yBAAyB,CAAA;AACvC,cAAc,yBAAyB,CAAA;AACvC,cAAc,2BAA2B,CAAA;AACzC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,2CAA2C,CAAA;AACzD,cAAc,8BAA8B,CAAA;AAC5C,cAAc,oCAAoC,CAAA;AAClD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,yCAAyC,CAAA;AACvD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,yCAAyC,CAAA;AACvD,cAAc,+BAA+B,CAAA;AAC7C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,8BAA8B,CAAA;AAC5C,cAAc,YAAY,CAAA;AAC1B,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA"}

package/dist/index.js

@@ -1,9 +1,9 @@
 /**
  * @beechcms/core - Botanical Engine
  *
- * Pacchetto condiviso del monorepo Beech CMS.
- * In v0.4.0 il Botanical Engine è un compilatore di schema SQL: legge i Seed
- * TypeScript e genera DDL deterministico + query parametrizzate.
+ * Shared package of the Beech CMS monorepo.
+ * In v0.4.0 the Botanical Engine is a SQL schema compiler: it reads TypeScript
+ * Seeds and generates deterministic DDL + parameterized queries.
  *
  * @module @beechcms/core
  */
@@ -20,3 +20,20 @@ export * from './idempotency.repository.js';
 export * from './media.repository.js';
 export * from './storage.js';
 export * from './policies.js';
+export * from './auth/hash-provider.js';
+export * from './auth/token-service.js';
+export * from './auth/user.repository.js';
+export * from './auth/session.repository.js';
+export * from './auth/password-reset-token.repository.js';
+export * from './rate-limit/rate-limiter.js';
+export * from './observability/activity-logger.js';
+export * from './observability/activity-log.repository.js';
+export * from './observability/analytics.repository.js';
+export * from './notifications/notification.repository.js';
+export * from './notifications/notification-service.js';
+export * from './widget/widget.repository.js';
+export * from './search/search.repository.js';
+export * from './content-scan.repository.js';
+export * from './clock.js';
+export * from './id-generator.js';
+export * from './seed-registry.js';

package/dist/notifications/notification-service.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Notification service contract.
+ *
+ * High-level port that callers use to emit a notification without knowing
+ * about the underlying repository, the database, or background scheduling.
+ * Mirrors the email module pattern: handlers depend on the service, the
+ * service depends on the repository, the repository depends on D1.
+ *
+ * @module @beechcms/core/notifications/notification-service
+ */
+import type { NotificationType } from './notification.repository.js';
+export interface CreateNotificationInput {
+    title: string;
+    message: string;
+    type?: NotificationType;
+}
+export interface INotificationService {
+    /**
+     * Emit a notification.
+     *
+     * Implementations decide whether to fire-and-forget (production: schedules
+     * the underlying repository write through `executionCtx.waitUntil`) or to
+     * wait inline (tests). Like the activity logger, this method MUST NOT
+     * throw to the caller: a failed notification must never break the public
+     * request that triggered it.
+     */
+    notify(input: CreateNotificationInput): Promise<void> | void;
+}
+//# sourceMappingURL=notification-service.d.ts.map

package/dist/notifications/notification-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification-service.d.ts","sourceRoot":"","sources":["../../src/notifications/notification-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAEpE,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,gBAAgB,CAAA;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CAC7D"}

package/dist/notifications/notification-service.js

@@ -0,0 +1 @@
+export {};

package/dist/notifications/notification.repository.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Notification repository contract.
+ *
+ * Persists in-app notifications (admin inbox) and exposes the aggregate stats
+ * the GET /notifications handler needs to build a strong ETag without reading
+ * every row.
+ *
+ * @module @beechcms/core/notifications/notification.repository
+ */
+export type NotificationType = 'info' | 'success' | 'warning' | 'error';
+export interface NotificationRecord {
+    id: string;
+    title: string;
+    message: string;
+    type: NotificationType;
+    isRead: boolean;
+    createdAt: number;
+}
+export interface NotificationStats {
+    totalCount: number;
+    latestCreatedAt: number;
+    readCount: number;
+}
+export interface INotificationRepository {
+    /**
+     * Return the most recent notifications, newest first.
+     *
+     * The `limit` parameter is required to prevent unbounded reads — the inbox
+     * could grow large over time and clients only ever render a window.
+     */
+    list(limit: number): Promise<NotificationRecord[]>;
+    /**
+     * Return aggregate counters used to build the GET /notifications ETag.
+     *
+     * Computing `totalCount`, `latestCreatedAt` and `readCount` on the database
+     * side lets the handler skip serialising the full list when nothing has
+     * changed since the client's last poll, saving bandwidth on the dashboard.
+     */
+    stats(): Promise<NotificationStats>;
+    /**
+     * Insert a new notification and return its generated id so callers (e.g.
+     * the public form submission flow) can correlate the notification with the
+     * triggering request.
+     */
+    create(record: Omit<NotificationRecord, 'id' | 'createdAt' | 'isRead'>): Promise<string>;
+    markRead(notificationId: string): Promise<void>;
+    markUnread(notificationId: string): Promise<void>;
+    markAllRead(): Promise<void>;
+    delete(notificationId: string): Promise<void>;
+}
+//# sourceMappingURL=notification.repository.d.ts.map

package/dist/notifications/notification.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification.repository.d.ts","sourceRoot":"","sources":["../../src/notifications/notification.repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAA;AAEvE,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,gBAAgB,CAAA;IACtB,MAAM,EAAE,OAAO,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAA;IAElD;;;;;;OAMG;IACH,KAAK,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAEnC;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,GAAG,WAAW,GAAG,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAExF,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjD,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5B,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9C"}

package/dist/notifications/notification.repository.js

@@ -0,0 +1,10 @@
+/**
+ * Notification repository contract.
+ *
+ * Persists in-app notifications (admin inbox) and exposes the aggregate stats
+ * the GET /notifications handler needs to build a strong ETag without reading
+ * every row.
+ *
+ * @module @beechcms/core/notifications/notification.repository
+ */
+export {};

package/dist/observability/activity-log.repository.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Activity Log read-side repository contract.
+ *
+ * Used by handlers that surface the audit trail back to the user (settings
+ * activity tab, recent activity feed on the dashboard). Kept separate from
+ * {@link IActivityLogger} because writers and readers have different
+ * lifecycles: writes are fire-and-forget background tasks; reads are blocking
+ * request paths that need filters and pagination.
+ *
+ * @module @beechcms/core/observability/activity-log.repository
+ */
+import type { ActivityAction, EntityType } from './activity-logger.js';
+export interface ActivityLogRecord {
+    id: string;
+    userId: string;
+    userEmail: string;
+    userName: string | null;
+    action: ActivityAction;
+    entityType: EntityType;
+    entityId: string;
+    entitySlug: string | null;
+    details: Record<string, unknown> | null;
+    createdAt: number;
+}
+export interface ActivityLogListOptions {
+    /** Restrict the result to a specific user. Used by the per-user activity tab. */
+    userId?: string;
+    /** Restrict the result to a specific content seed. Used by per-seed feeds. */
+    entitySlug?: string;
+    /** Hard upper bound on the number of rows returned. */
+    limit: number;
+}
+export interface CountSinceOptions {
+    action: ActivityAction;
+    entityType: EntityType;
+    /** Lower bound (inclusive) for `createdAt` in seconds since epoch. */
+    sinceTimestamp: number;
+}
+export interface IActivityLogRepository {
+    /**
+     * Return the most recent activity entries matching the given filters.
+     *
+     * The list is always ordered by `createdAt` DESC so callers get newest-first
+     * data without paying extra sort costs in TypeScript. Used by the settings
+     * activity tab (per-user) and by the stats recent-activity feed (global).
+     */
+    list(options: ActivityLogListOptions): Promise<ActivityLogRecord[]>;
+    /**
+     * Count entries with the given `action` and `entityType` whose `createdAt`
+     * is greater-than-or-equal to `sinceTimestamp`.
+     *
+     * Used by the dashboard `/stats/total` widget to surface today/week/month
+     * create-event counts without hardcoding SQL in the handler. Each period
+     * is one call so the repository contract stays narrow and deterministic.
+     */
+    countSince(options: CountSinceOptions): Promise<number>;
+}
+//# sourceMappingURL=activity-log.repository.d.ts.map

package/dist/observability/activity-log.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-log.repository.d.ts","sourceRoot":"","sources":["../../src/observability/activity-log.repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEtE,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,EAAE,cAAc,CAAA;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACvC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,cAAc,CAAA;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,IAAI,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAA;IAEnE;;;;;;;OAOG;IACH,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACxD"}

package/dist/observability/activity-log.repository.js

@@ -0,0 +1 @@
+export {};

package/dist/observability/activity-logger.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Activity Logger contract.
+ *
+ * Records side-effect events ("a user did X to entity Y") for the audit trail
+ * displayed in the dashboard's settings activity tab and the recent activity
+ * feed. The interface is intentionally framework-agnostic so it can be
+ * fulfilled in production by a D1-backed implementation, in tests by an
+ * in-memory implementation, and in the future by remote sinks.
+ *
+ * @module @beechcms/core/observability/activity-logger
+ */
+export type ActivityAction = 'create' | 'update' | 'delete' | 'upload';
+export type EntityType = 'content' | 'media';
+/**
+ * Identifies the human (or machine) actor that triggered the event.
+ *
+ * The actor MUST be assembled by the caller (typically a Hono handler that has
+ * already authenticated the request). The logger never reaches into a
+ * framework-specific context to discover who is acting — this avoids hidden
+ * coupling and lets the same logger run inside CLI scripts and background
+ * jobs.
+ */
+export interface ActivityActor {
+    id: string;
+    email: string;
+    name?: string | null;
+}
+export interface ActivityLogEntry {
+    action: ActivityAction;
+    entityType: EntityType;
+    entityId: string;
+    entitySlug?: string;
+    details?: Record<string, unknown>;
+    actor: ActivityActor;
+}
+export interface IActivityLogger {
+    /**
+     * Persist a single activity entry.
+     *
+     * Implementations decide whether to fire-and-forget (Cloudflare
+     * `executionCtx.waitUntil`) or to wait inline (test environments).
+     * In either case the call MUST NOT throw to the caller: logging is
+     * observability, never a hard dependency of the request being served.
+     * Internal errors must be swallowed and logged via `console.error` so the
+     * mainline response path is never disturbed by audit-trail failures.
+     */
+    log(entry: ActivityLogEntry): Promise<void> | void;
+}
+//# sourceMappingURL=activity-logger.d.ts.map

package/dist/observability/activity-logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-logger.d.ts","sourceRoot":"","sources":["../../src/observability/activity-logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAA;AACtE,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,OAAO,CAAA;AAE5C;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,cAAc,CAAA;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,KAAK,EAAE,aAAa,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;;;;OASG;IACH,GAAG,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CACnD"}

package/dist/observability/activity-logger.js

@@ -0,0 +1,12 @@
+/**
+ * Activity Logger contract.
+ *
+ * Records side-effect events ("a user did X to entity Y") for the audit trail
+ * displayed in the dashboard's settings activity tab and the recent activity
+ * feed. The interface is intentionally framework-agnostic so it can be
+ * fulfilled in production by a D1-backed implementation, in tests by an
+ * in-memory implementation, and in the future by remote sinks.
+ *
+ * @module @beechcms/core/observability/activity-logger
+ */
+export {};

package/dist/observability/analytics.repository.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Metric tracked by the analytics table. Today only request counts and
+ * unique-visitor counts are recorded; new metric names should be appended
+ * to this union and to the implementation's switch statement.
+ */
+export type AnalyticsMetric = 'requests' | 'visitors';
+/**
+ * Read/write contract for the analytics counters that power the dashboard
+ * widgets (per-day request totals, sparklines, system health proxy).
+ *
+ * Implementations must use idempotent upserts so the recording middleware
+ * can be invoked once per request without producing duplicates when the
+ * same day/seed/metric tuple is touched repeatedly.
+ */
+export interface IAnalyticsRepository {
+    /**
+     * Upserts a request counter for the given seed at the current day bucket.
+     * The day bucket (Unix timestamp truncated to midnight UTC) is computed
+     * internally from the implementation's clock so callers never need to
+     * pass a timestamp. Implementations must use INSERT ... ON CONFLICT DO
+     * UPDATE to remain idempotent under concurrent calls within the same day.
+     */
+    recordRequest(seedSlug: string): Promise<void>;
+    /**
+     * Returns the total count for the given metric since sinceTimestamp.
+     * Used by the stats handler for total request counts and visitor counts.
+     * The aggregation sums the stored counter values, not row counts.
+     */
+    sumByMetric(metric: AnalyticsMetric, seedSlug: string, sinceTimestamp: number): Promise<number>;
+    /**
+     * Returns a map of date strings (YYYY-MM-DD) to request counts since
+     * sinceTimestamp, suitable for chart rendering without further
+     * transformation by the caller.
+     */
+    groupByMetric(seedSlug: string, sinceTimestamp: number): Promise<Record<string, number>>;
+}
+//# sourceMappingURL=analytics.repository.d.ts.map

package/dist/observability/analytics.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analytics.repository.d.ts","sourceRoot":"","sources":["../../src/observability/analytics.repository.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,UAAU,CAAA;AAErD;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;OAMG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE9C;;;;OAIG;IACH,WAAW,CACT,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,CAAA;IAElB;;;;OAIG;IACH,aAAa,CACX,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACnC"}

package/dist/observability/analytics.repository.js

@@ -0,0 +1 @@
+export {};

package/dist/search/search.repository.d.ts

@@ -0,0 +1,45 @@
+import type { Seed } from '../types.js';
+export interface SearchQueryOptions {
+    queryText: string;
+    schemaSlug: string | null;
+    statusFilter: string | null;
+    limit: number;
+    cursor: string | null;
+}
+export interface SearchResultRow {
+    entryId: string;
+    schemaSlug: string;
+    slug: string | null;
+    status: string;
+    title: string | null;
+    excerpt: string;
+    rank: number;
+}
+export interface SearchCountResult {
+    total: number;
+}
+/**
+ * Read-only contract for the global FTS5 search route.
+ *
+ * Implementations encapsulate the UNION ALL query that fans out across all
+ * `fts_<seed>` virtual tables. The route handler stays free of D1 and only
+ * shapes the final response.
+ */
+export interface ISearchRepository {
+    /**
+     * Executes a UNION ALL full-text search across all FTS-enabled seed tables.
+     * Returns at most options.limit + 1 rows so the caller can detect hasMore
+     * without a separate count query for the cursor case.
+     * Implementations must propagate the EMPTY_QUERY error thrown by
+     * buildFtsQuery so the route handler can return an empty result set rather
+     * than a 500.
+     */
+    search(options: SearchQueryOptions, seeds: Seed[]): Promise<SearchResultRow[]>;
+    /**
+     * Runs the count variant of the FTS query to support the `total` field in
+     * the search response. Called in parallel with search() by the route handler
+     * with the same filter inputs but without limit/cursor.
+     */
+    count(options: Omit<SearchQueryOptions, 'limit' | 'cursor'>, seeds: Seed[]): Promise<SearchCountResult>;
+}
+//# sourceMappingURL=search.repository.d.ts.map

package/dist/search/search.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.repository.d.ts","sourceRoot":"","sources":["../../src/search/search.repository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAEvC,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;;OAOG;IACH,MAAM,CAAC,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAA;IAE9E;;;;OAIG;IACH,KAAK,CACH,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,QAAQ,CAAC,EACrD,KAAK,EAAE,IAAI,EAAE,GACZ,OAAO,CAAC,iBAAiB,CAAC,CAAA;CAC9B"}

package/dist/search/search.repository.js

@@ -0,0 +1 @@
+export {};

package/dist/seed-registry.d.ts

@@ -0,0 +1,49 @@
+import type { Seed } from './types.js';
+export interface ISeedRegistry {
+    /**
+     * Returns all seeds as a flat array, preserving insertion order.
+     * Decouples callers from the internal storage shape so the registry
+     * implementation can change without touching every route handler.
+     */
+    all(): Seed[];
+    /**
+     * Returns the seed with the given slug, or null if not found.
+     * Provides a single lookup point that can be overridden in tests
+     * without rebuilding the full registry object.
+     */
+    get(slug: string): Seed | null;
+    /**
+     * Returns seeds that are visible in the dashboard sidebar.
+     * A seed is visible when dashboard.hidden is not explicitly true.
+     * Eliminates the seeds.filter(s => !s.dashboard?.hidden) pattern
+     * that would otherwise be duplicated across route handlers.
+     */
+    visibleInDashboard(): Seed[];
+    /**
+     * Returns seeds that have allowPublicRead enabled.
+     * Eliminates the seeds.filter(s => s.allowPublicRead) pattern.
+     */
+    publicReadable(): Seed[];
+    /**
+     * Returns seeds that have the draft workflow enabled.
+     * Eliminates the seeds.filter(s => s.allowDrafts) pattern.
+     */
+    draftEnabled(): Seed[];
+}
+export declare class SeedRegistry implements ISeedRegistry {
+    private readonly seedMap;
+    private readonly orderedSeeds;
+    constructor(seeds: Seed[]);
+    all(): Seed[];
+    get(slug: string): Seed | null;
+    visibleInDashboard(): Seed[];
+    publicReadable(): Seed[];
+    draftEnabled(): Seed[];
+}
+/**
+ * Named subclass of SeedRegistry for use in test suites.
+ * Gives tests a semantic name without requiring any dependency on factory.ts.
+ */
+export declare class InMemorySeedRegistry extends SeedRegistry {
+}
+//# sourceMappingURL=seed-registry.d.ts.map

package/dist/seed-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed-registry.d.ts","sourceRoot":"","sources":["../src/seed-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,GAAG,IAAI,IAAI,EAAE,CAAA;IAEb;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAE9B;;;;;OAKG;IACH,kBAAkB,IAAI,IAAI,EAAE,CAAA;IAE5B;;;OAGG;IACH,cAAc,IAAI,IAAI,EAAE,CAAA;IAExB;;;OAGG;IACH,YAAY,IAAI,IAAI,EAAE,CAAA;CACvB;AAED,qBAAa,YAAa,YAAW,aAAa;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;gBAEzB,KAAK,EAAE,IAAI,EAAE;IAKzB,GAAG,IAAI,IAAI,EAAE;IAIb,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAI9B,kBAAkB,IAAI,IAAI,EAAE;IAI5B,cAAc,IAAI,IAAI,EAAE;IAIxB,YAAY,IAAI,IAAI,EAAE;CAGvB;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,YAAY;CAAG"}

package/dist/seed-registry.js

@@ -0,0 +1,29 @@
+export class SeedRegistry {
+    seedMap;
+    orderedSeeds;
+    constructor(seeds) {
+        this.orderedSeeds = seeds;
+        this.seedMap = new Map(seeds.map(seed => [seed.slug, seed]));
+    }
+    all() {
+        return this.orderedSeeds;
+    }
+    get(slug) {
+        return this.seedMap.get(slug) ?? null;
+    }
+    visibleInDashboard() {
+        return this.orderedSeeds.filter(seed => seed.dashboard?.hidden !== true);
+    }
+    publicReadable() {
+        return this.orderedSeeds.filter(seed => seed.allowPublicRead === true);
+    }
+    draftEnabled() {
+        return this.orderedSeeds.filter(seed => seed.allowDrafts === true);
+    }
+}
+/**
+ * Named subclass of SeedRegistry for use in test suites.
+ * Gives tests a semantic name without requiring any dependency on factory.ts.
+ */
+export class InMemorySeedRegistry extends SeedRegistry {
+}

package/dist/validation.d.ts

@@ -21,18 +21,18 @@ export interface ValidateSeedPayloadResult {
     hasAnyValidField: boolean;
 }
 /**
- * Foundation comune per validazione e sanitizzazione payload schema-driven.
- * Usata da Public API e riusabile nel Botanical Engine.
+ * Common foundation for schema-driven validation and sanitization of payloads.
+ * Used by the Public API and reusable in the Botanical Engine.
  *
- * Ordine di esecuzione obbligatorio al momento della scrittura:
+ * Mandatory execution order at the time of writing:
  *   validate raw → hash (privacy policy) → store
- * L'hashing avviene DOPO la validazione, non prima.
- * Questo garantisce che il valore validato sia il valore raw originale,
- * non il digest — evitando false failure su campi con formato (es. email).
+ * Hashing occurs AFTER validation, not before.
+ * This ensures that the validated value is the original raw value,
+ * not the digest — avoiding false failures on fields with formats (e.g., email).
  */
 export declare function validateAndSanitizeSeedPayload(seed: Seed, payload: Record<string, unknown>, options?: ValidateSeedPayloadOptions): ValidateSeedPayloadResult;
 /**
- * Valida status content supportati dal CMS.
+ * Validates content status supported by the CMS.
  */
 export declare function isValidContentStatus(value: unknown): value is 'draft' | 'review' | 'published';
 /**

package/dist/validation.js

@@ -452,14 +452,14 @@ function validateBranchValue(branch, alias, rawValue, options) {
     }
 }
 /**
- * Foundation comune per validazione e sanitizzazione payload schema-driven.
- * Usata da Public API e riusabile nel Botanical Engine.
+ * Common foundation for schema-driven validation and sanitization of payloads.
+ * Used by the Public API and reusable in the Botanical Engine.
  *
- * Ordine di esecuzione obbligatorio al momento della scrittura:
+ * Mandatory execution order at the time of writing:
  *   validate raw → hash (privacy policy) → store
- * L'hashing avviene DOPO la validazione, non prima.
- * Questo garantisce che il valore validato sia il valore raw originale,
- * non il digest — evitando false failure su campi con formato (es. email).
+ * Hashing occurs AFTER validation, not before.
+ * This ensures that the validated value is the original raw value,
+ * not the digest — avoiding false failures on fields with formats (e.g., email).
  */
 export function validateAndSanitizeSeedPayload(seed, payload, options = {}) {
     const normalizedOptions = {
@@ -564,7 +564,7 @@ export function validateAndSanitizeSeedPayload(seed, payload, options = {}) {
     };
 }
 /**
- * Valida status content supportati dal CMS.
+ * Validates content status supported by the CMS.
  */
 export function isValidContentStatus(value) {
     return statusSchema.safeParse(value).success;

package/dist/widget/widget.repository.d.ts

@@ -0,0 +1,113 @@
+import type { Seed } from '../types.js';
+/**
+ * Discriminated union describing the aggregate to compute over a content table.
+ *
+ * The widget routes accept this shape from the dashboard. Implementations are
+ * responsible for translating each variant into a safe SQL expression and must
+ * never interpolate the column or value fields without prior validation.
+ */
+export type AggregateFormula = {
+    op: 'count';
+} | {
+    op: 'sum';
+    column: string;
+} | {
+    op: 'avg';
+    column: string;
+} | {
+    op: 'min';
+    column: string;
+} | {
+    op: 'max';
+    column: string;
+} | {
+    op: 'countWhere';
+    column: string;
+    value: unknown;
+} | {
+    op: 'percentageOf';
+    numeratorColumn: string;
+    denominatorColumn: string;
+};
+/**
+ * Time range applied as a WHERE filter for widget queries.
+ *
+ * "all" means no temporal restriction. The other values bracket the most recent
+ * 7 days, 1 month, and 1 year respectively, anchored on `created_at`.
+ */
+export type TimeWindow = 'week' | 'month' | 'year' | 'all';
+export interface LeaderboardEntry {
+    id: string;
+    label: string;
+    score: number | string;
+}
+export interface LeaderboardOptions {
+    scoreColumn: string;
+    limit: number;
+    orderDirection: 'ASC' | 'DESC';
+}
+export interface TimeseriesPoint {
+    label: string;
+    value: number;
+}
+export interface WidgetListFilter {
+    column: string;
+    op: string;
+    value: unknown;
+}
+export interface WidgetListOptions {
+    limit: number;
+    offset: number;
+    search?: string;
+    filters?: WidgetListFilter[];
+    orderByColumn?: string;
+    orderDirection?: 'ASC' | 'DESC';
+}
+export interface WidgetListResult {
+    entries: Array<Record<string, unknown>>;
+    totalCount: number;
+}
+export interface GrowthResult {
+    currentValue: number;
+    previousValue: number;
+}
+/**
+ * Read-only data access contract for widget routes.
+ *
+ * Implementations must validate every column alias derived from user input
+ * against the seed before composing SQL, and must bind every user-supplied
+ * value via parameterised statements. SQL keywords (ORDER direction, aggregate
+ * function names) must be selected via hardcoded branches, never interpolated.
+ */
+export interface IWidgetRepository {
+    /**
+     * Returns the formula result for the given time window. Always returns a
+     * number; implementations must return 0 when the query produces no rows.
+     */
+    aggregate(seed: Seed, formula: AggregateFormula, window: TimeWindow): Promise<number>;
+    /**
+     * Evaluates the formula twice — once for the current window period and once
+     * for the equivalent previous period — to support trend calculations.
+     * Implementations must return { currentValue: 0, previousValue: 0 } on
+     * empty results.
+     */
+    growth(seed: Seed, formula: AggregateFormula, window: TimeWindow): Promise<GrowthResult>;
+    /**
+     * Returns entries sorted by scoreColumn, excluding nulls. label resolves
+     * from seed.displayNameAlias; falls back to id when not set.
+     */
+    leaderboard(seed: Seed, options: LeaderboardOptions): Promise<LeaderboardEntry[]>;
+    /**
+     * Paginated read of content entries. Filters and search are applied
+     * server-side. The caller is responsible for deserialising branch values
+     * from the raw Record.
+     */
+    list(seed: Seed, options: WidgetListOptions): Promise<WidgetListResult>;
+    /**
+     * Groups entries by a date bucket derived from groupColumn and aggregates
+     * the formula. Days with no entries are omitted (no zero-fill). Points are
+     * ordered ascending by label.
+     */
+    timeseries(seed: Seed, formula: AggregateFormula, window: TimeWindow, groupColumn: string): Promise<TimeseriesPoint[]>;
+}
+//# sourceMappingURL=widget.repository.d.ts.map

package/dist/widget/widget.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"widget.repository.d.ts","sourceRoot":"","sources":["../../src/widget/widget.repository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAEvC;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,OAAO,CAAA;CAAE,GACf;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,cAAc,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAA;AAE9E;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;AAE1D,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,GAAG,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,EAAE,KAAK,GAAG,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,OAAO,CAAA;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAA;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACvC,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAErF;;;;;OAKG;IACH,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAExF;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IAEjF;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAEvE;;;;OAIG;IACH,UAAU,CACR,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,eAAe,EAAE,CAAC,CAAA;CAC9B"}

package/dist/widget/widget.repository.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beechcms/core",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -18,18 +18,24 @@
     "build": "tsc",
     "dev": "tsc -w --preserveWatchOutput",
     "lint": "eslint .",
-    "type-check": "tsc --noEmit"
+    "type-check": "tsc --noEmit",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage"
+  },
+  "devDependencies": {
+    "@vitest/coverage-v8": "^3.2.4",
+    "vitest": "^3.2.4"
   },
   "dependencies": {
     "@tiptap/core": "^3.22.3",
     "@tiptap/extension-highlight": "^3.22.3",
     "@tiptap/extension-image": "^3.22.3",
     "@tiptap/extension-link": "^3.22.3",
+    "@tiptap/extension-mathematics": "^3.22.3",
     "@tiptap/extension-subscript": "^3.22.3",
     "@tiptap/extension-superscript": "^3.22.3",
     "@tiptap/extension-table": "^3.22.3",
     "@tiptap/extension-text-align": "^3.22.3",
-    "@tiptap/extension-mathematics": "^3.22.3",
     "@tiptap/html": "^3.22.3",
     "@tiptap/starter-kit": "^3.22.3",
     "katex": "^0.16.11",