@beechcms/core 0.6.0-preview.2 → 0.6.0-preview.4

package/dist/content.repository.d.ts

@@ -48,6 +48,20 @@ export declare class RelationTargetNotFoundError extends RepositoryError {
         value: string;
     });
 }
+/**
+ * Thrown by lifecycle `before*` hooks to signal a business validation failure.
+ * Mapped to 422 Unprocessable Entity by the API problem-mapper.
+ */
+export declare class HookValidationError extends RepositoryError {
+    readonly fields?: Array<{
+        field: string;
+        message: string;
+    }>;
+    constructor(message: string, fields?: Array<{
+        field: string;
+        message: string;
+    }>);
+}
 export type BulkFieldUpdate = {
     kind: 'set';
     value: unknown;
@@ -61,6 +75,52 @@ export type BulkFieldUpdate = {
     kind: 'array_remove';
     value: string[];
 };
+/**
+ * Options passed to write operations. Currently carries the acting user
+ * (extracted from the JWT) so lifecycle hooks can attribute changes.
+ */
+export interface RepositoryOptions {
+    actor?: {
+        id: string;
+        role?: string;
+        email?: string;
+    };
+}
+/**
+ * Declarative multi-write operation translated into a single `db.batch` call.
+ * Used for coordinated writes across one or more seeds when D1's lack of
+ * interactive transactions makes a callback-based API impossible.
+ *
+ * NOTE: document-level lifecycle hooks do NOT run for operations inside a
+ * `runBatch` call — they would be non-atomic side-effects.
+ */
+export type BatchWrite = {
+    kind: 'create';
+    seed: Seed;
+    id: string;
+    slug: string;
+    status: string;
+    data: Record<string, any>;
+} | {
+    kind: 'update';
+    seed: Seed;
+    id: string;
+    data: Record<string, any>;
+    status?: string;
+} | {
+    kind: 'mutateField';
+    seed: Seed;
+    id: string;
+    fieldName: string;
+    operation: {
+        type: 'increment' | 'decrement';
+        value: number;
+    };
+    options?: {
+        min?: number;
+        max?: number;
+    };
+};
 /**
  * Interface defining the standard operations for content persistence.
  * This is platform-agnostic and should be implemented for specific databases (e.g., D1).
@@ -94,20 +154,41 @@ export interface ContentRepository {
      * Creates a new content entry in the live table.
      * Throws SlugConflictError if the slug is already taken.
      */
-    create(seed: Seed, id: string, slug: string, status: string, data: Record<string, any>): Promise<void>;
+    create(seed: Seed, id: string, slug: string, status: string, data: Record<string, any>, options?: RepositoryOptions): Promise<void>;
     /**
      * Partially updates an existing entry in the live table.
      * Throws EntryNotFoundError if the ID does not exist.
      */
-    update(seed: Seed, id: string, data: Record<string, any>, status?: string): Promise<void>;
+    update(seed: Seed, id: string, data: Record<string, any>, status?: string, options?: RepositoryOptions): Promise<void>;
     /**
      * Deletes an entry from the live table.
      * Returns the deleted row data (useful for media cleanup).
      * Throws EntryNotFoundError if the ID does not exist.
      */
-    delete(seed: Seed, id: string): Promise<{
+    delete(seed: Seed, id: string, options?: RepositoryOptions): Promise<{
         row: Record<string, any>;
     }>;
+    /**
+     * Atomically increments/decrements a numeric field with optional min/max guards.
+     * Bypasses document-level lifecycle hooks — it's a single UPDATE statement,
+     * used to prevent race conditions on counters (stock, balances).
+     * Throws RepositoryError if `fieldName` is not a numeric branch of `seed`, or
+     * if the guard conditions fail / the row does not exist.
+     */
+    mutateField(seed: Seed, id: string, fieldName: string, operation: {
+        type: 'increment' | 'decrement';
+        value: number;
+    }, options?: {
+        min?: number;
+        max?: number;
+    }): Promise<{
+        newValue: number;
+    }>;
+    /**
+     * Executes a list of write operations atomically via a single `db.batch`.
+     * Document-level lifecycle hooks do NOT run for operations inside this call.
+     */
+    runBatch(operations: BatchWrite[]): Promise<void>;
     /**
      * Saves or updates a pending draft in the mirror table.
      */

package/dist/content.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"content.repository.d.ts","sourceRoot":"","sources":["../src/content.repository.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAEhD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE;QACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;QACnB,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;CACF;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACJ,KAAK,CAAC,EAAE,OAAO;gBAAvC,OAAO,EAAE,MAAM,EAAS,KAAK,CAAC,EAAE,OAAO,YAAA;CAIpD;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,eAAe;gBACzC,OAAO,EAAE,MAAM;CAI5B;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,eAAe;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,eAAe;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;gBAEV,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;CASzE;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAA;AAE7C;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAEtG;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;IAE9D;;;OAGG;IACH,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;IAElE;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC;QAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KACvC,CAAC,CAAA;IAEF;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEtG;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEzF;;;;OAIG;IACH,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KAAE,CAAC,CAAA;IAErE;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEhF;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,CAAA;IAE1E;;;OAGG;IACH,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAExD;;OAEG;IACH,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEvD;;OAEG;IACH,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAE1E;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAEvD;;;;;OAKG;IACH,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IAEzD;;;;OAIG;IACH,UAAU,CACR,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EAAE,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GACtC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAA;CAC/E"}
+{"version":3,"file":"content.repository.d.ts","sourceRoot":"","sources":["../src/content.repository.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAEhD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE;QACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;QACnB,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;CACF;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACJ,KAAK,CAAC,EAAE,OAAO;gBAAvC,OAAO,EAAE,MAAM,EAAS,KAAK,CAAC,EAAE,OAAO,YAAA;CAIpD;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,eAAe;gBACzC,OAAO,EAAE,MAAM;CAI5B;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,eAAe;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,eAAe;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;gBAEV,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;CASzE;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,eAAe;IACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;gBAE/C,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAKhF;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAA;AAE7C;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CACtD;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,GACnG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACtF;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE;QAAE,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAA;AAE/K;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAEtG;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;IAE9D;;;OAGG;IACH,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;IAElE;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC;QAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KACvC,CAAC,CAAA;IAEF;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEnI;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEtH;;;;OAIG;IACH,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KAAE,CAAC,CAAA;IAElG;;;;;;OAMG;IACH,WAAW,CACT,IAAI,EAAE,IAAI,EACV,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE;QAAE,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAC7D,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAEhC;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjD;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEhF;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,CAAA;IAE1E;;;OAGG;IACH,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAExD;;OAEG;IACH,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEvD;;OAEG;IACH,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAE1E;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAEvD;;;;;OAKG;IACH,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IAEzD;;;;OAIG;IACH,UAAU,CACR,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EAAE,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GACtC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAA;CAC/E"}

package/dist/content.repository.js

@@ -45,3 +45,15 @@ export class RelationTargetNotFoundError extends RepositoryError {
         this.value = params.value;
     }
 }
+/**
+ * Thrown by lifecycle `before*` hooks to signal a business validation failure.
+ * Mapped to 422 Unprocessable Entity by the API problem-mapper.
+ */
+export class HookValidationError extends RepositoryError {
+    fields;
+    constructor(message, fields) {
+        super(message);
+        this.name = 'HookValidationError';
+        this.fields = fields;
+    }
+}

package/dist/hooks.d.ts

@@ -0,0 +1,29 @@
+import type { ContentRepository } from './content.repository.js';
+import type { Seed } from './types.js';
+export interface HookActor {
+    id: string;
+    role?: string;
+    email?: string;
+}
+export interface HookContext {
+    seed: Seed;
+    /** Canale lecito per side-effect sui contenuti dagli hook (rispetta la Botanical Engine). */
+    repository: ContentRepository;
+    /** Utente che esegue l'operazione, estratto dal JWT. Assente per operazioni di sistema/cron. */
+    actor?: HookActor;
+    /**
+     * Escape hatch per la connessione nativa (D1Database in prod, better-sqlite3 nei test).
+     * Tipizzato `unknown` per non accoppiare @beechcms/core a Cloudflare. Usare con cautela:
+     * scrivere qui bypassa la Botanical Engine.
+     */
+    db: unknown;
+}
+export interface BeechHooks {
+    beforeCreate?: (data: Record<string, any>, ctx: HookContext) => Promise<Record<string, any> | void> | Record<string, any> | void;
+    beforeUpdate?: (id: string, patches: Record<string, any>, ctx: HookContext) => Promise<Record<string, any> | void> | Record<string, any> | void;
+    beforeDelete?: (id: string, ctx: HookContext) => Promise<void> | void;
+    afterCreate?: (entry: Record<string, any>, ctx: HookContext) => Promise<void> | void;
+    afterUpdate?: (entry: Record<string, any>, ctx: HookContext) => Promise<void> | void;
+    afterDelete?: (id: string, ctx: HookContext) => Promise<void> | void;
+}
+//# sourceMappingURL=hooks.d.ts.map

package/dist/hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,IAAI,CAAA;IACV,6FAA6F;IAC7F,UAAU,EAAE,iBAAiB,CAAA;IAC7B,gGAAgG;IAChG,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB;;;;OAIG;IACH,EAAE,EAAE,OAAO,CAAA;CACZ;AAED,MAAM,WAAW,UAAU;IAGzB,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAA;IAChI,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAA;IAC/I,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAGrE,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACpF,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACpF,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CACrE"}

package/dist/hooks.js

@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+export {};

package/dist/index.d.ts

@@ -17,6 +17,7 @@ export * from './richtext.js';
 export * from './richtext-render.js';
 export * from './slug-utils.js';
 export * from './content.repository.js';
+export * from './hooks.js';
 export * from './idempotency.repository.js';
 export * from './media.repository.js';
 export * from './storage.js';
@@ -44,6 +45,8 @@ export * from './automations.runner.interface.js';
 export * from './automations.repository.interface.js';
 export * from './scheduler.interface.js';
 export * from './scheduler.stub.js';
+export * from './queue.interface.js';
+export * from './queue.stub.js';
 export * from './webhook-validation.js';
 export * from './relations.js';
 export * from './site-settings.repository.js';
@@ -59,4 +62,6 @@ export * from './seed.repository.js';
 export * from './seed-validation.js';
 export * from './seed-ddl.js';
 export * from './schema-mutator.js';
+export * from './seed-types-generator.js';
+export * from './webhook-crypto.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH,cAAc,YAAY,CAAA;AAC1B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,yBAAyB,CAAA;AACvC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,uBAAuB,CAAA;AACrC,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,yBAAyB,CAAA;AACvC,cAAc,yBAAyB,CAAA;AACvC,cAAc,2BAA2B,CAAA;AACzC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,2CAA2C,CAAA;AACzD,cAAc,8BAA8B,CAAA;AAC5C,cAAc,oCAAoC,CAAA;AAClD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,yCAAyC,CAAA;AACvD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,yCAAyC,CAAA;AACvD,cAAc,+BAA+B,CAAA;AAC7C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,8BAA8B,CAAA;AAC5C,cAAc,YAAY,CAAA;AAC1B,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,wBAAwB,CAAA;AACtC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,mCAAmC,CAAA;AACjD,cAAc,uCAAuC,CAAA;AACrD,cAAc,0BAA0B,CAAA;AACxC,cAAc,qBAAqB,CAAA;AACnC,cAAc,yBAAyB,CAAA;AACvC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,+BAA+B,CAAA;AAC7C,cAAc,2BAA2B,CAAA;AACzC,cAAc,kBAAkB,CAAA;AAChC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,yBAAyB,CAAA;AACvC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,kCAAkC,CAAA;AAChD,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,eAAe,CAAA;AAC7B,cAAc,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH,cAAc,YAAY,CAAA;AAC1B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,yBAAyB,CAAA;AACvC,cAAc,YAAY,CAAA;AAC1B,cAAc,6BAA6B,CAAA;AAC3C,cAAc,uBAAuB,CAAA;AACrC,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,yBAAyB,CAAA;AACvC,cAAc,yBAAyB,CAAA;AACvC,cAAc,2BAA2B,CAAA;AACzC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,2CAA2C,CAAA;AACzD,cAAc,8BAA8B,CAAA;AAC5C,cAAc,oCAAoC,CAAA;AAClD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,yCAAyC,CAAA;AACvD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,yCAAyC,CAAA;AACvD,cAAc,+BAA+B,CAAA;AAC7C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,8BAA8B,CAAA;AAC5C,cAAc,YAAY,CAAA;AAC1B,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,wBAAwB,CAAA;AACtC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,mCAAmC,CAAA;AACjD,cAAc,uCAAuC,CAAA;AACrD,cAAc,0BAA0B,CAAA;AACxC,cAAc,qBAAqB,CAAA;AACnC,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,yBAAyB,CAAA;AACvC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,+BAA+B,CAAA;AAC7C,cAAc,2BAA2B,CAAA;AACzC,cAAc,kBAAkB,CAAA;AAChC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,yBAAyB,CAAA;AACvC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,kCAAkC,CAAA;AAChD,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,eAAe,CAAA;AAC7B,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,qBAAqB,CAAA"}

package/dist/index.js

@@ -19,6 +19,7 @@ export * from './richtext.js';
 export * from './richtext-render.js';
 export * from './slug-utils.js';
 export * from './content.repository.js';
+export * from './hooks.js';
 export * from './idempotency.repository.js';
 export * from './media.repository.js';
 export * from './storage.js';
@@ -46,6 +47,8 @@ export * from './automations.runner.interface.js';
 export * from './automations.repository.interface.js';
 export * from './scheduler.interface.js';
 export * from './scheduler.stub.js';
+export * from './queue.interface.js';
+export * from './queue.stub.js';
 export * from './webhook-validation.js';
 export * from './relations.js';
 export * from './site-settings.repository.js';
@@ -61,3 +64,5 @@ export * from './seed.repository.js';
 export * from './seed-validation.js';
 export * from './seed-ddl.js';
 export * from './schema-mutator.js';
+export * from './seed-types-generator.js';
+export * from './webhook-crypto.js';

package/dist/queue.interface.d.ts

@@ -0,0 +1,39 @@
+import type { ContentRepository } from './content.repository.js';
+import type { BeechBucket } from './storage.js';
+import type { IClock } from './clock.js';
+import type { IIdGenerator } from './id-generator.js';
+/**
+ * The envelope put on the wire / queue. `name` selects the handler from the
+ * JobRegistry; `payload` is the developer-supplied, JSON-serializable body.
+ */
+export interface QueueMessage<T = unknown> {
+    name: string;
+    payload: T;
+}
+/**
+ * Execution context handed to every job. Botanical Invariant: jobs receive the
+ * engine-mediated repository, NEVER a raw D1Database. `env` is a read-only,
+ * stringly-typed view of bindings/secrets for things like fetch targets — it
+ * deliberately does not expose `DB`.
+ */
+export interface JobContext {
+    repository: ContentRepository;
+    bucket: BeechBucket;
+    clock: IClock;
+    idGenerator: IIdGenerator;
+    env: Record<string, string | undefined>;
+}
+/** A single background worker. Receives the decoded payload + context. */
+export type JobHandler<T = unknown> = (payload: T, context: JobContext) => Promise<void>;
+/** Name -> handler map, supplied via BeechConfig.jobs. */
+export type JobRegistry = Record<string, JobHandler<any>>;
+/**
+ * Producer port. `enqueue` schedules deferred work and returns once the message
+ * is accepted by the transport. Like INotificationService, implementations MUST
+ * decide their own fire-and-forget vs inline semantics and MUST NOT let a
+ * transport failure crash the request that called enqueue.
+ */
+export interface IQueueService {
+    enqueue<T>(name: string, payload: T): Promise<void>;
+}
+//# sourceMappingURL=queue.interface.d.ts.map

package/dist/queue.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue.interface.d.ts","sourceRoot":"","sources":["../src/queue.interface.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAErD;;;GAGG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,CAAC,CAAA;CACX;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,iBAAiB,CAAA;IAC7B,MAAM,EAAE,WAAW,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,YAAY,CAAA;IACzB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CACxC;AAED,0EAA0E;AAC1E,MAAM,MAAM,UAAU,CAAC,CAAC,GAAG,OAAO,IAAI,CACpC,OAAO,EAAE,CAAC,EACV,OAAO,EAAE,UAAU,KAChB,OAAO,CAAC,IAAI,CAAC,CAAA;AAElB,0DAA0D;AAC1D,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;AAEzD;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpD"}

package/dist/queue.interface.js

@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+export {};

package/dist/queue.stub.d.ts

@@ -0,0 +1,6 @@
+import type { IQueueService } from './queue.interface.js';
+/** Safe no-op producer (e.g. unit tests that don't assert on enqueue). */
+export declare class NoOpQueueService implements IQueueService {
+    enqueue<T>(_name: string, _payload: T): Promise<void>;
+}
+//# sourceMappingURL=queue.stub.d.ts.map

package/dist/queue.stub.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue.stub.d.ts","sourceRoot":"","sources":["../src/queue.stub.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEzD,0EAA0E;AAC1E,qBAAa,gBAAiB,YAAW,aAAa;IAC9C,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAG5D"}

package/dist/queue.stub.js

@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+/** Safe no-op producer (e.g. unit tests that don't assert on enqueue). */
+export class NoOpQueueService {
+    async enqueue(_name, _payload) {
+        // intentionally empty
+    }
+}

package/dist/seed-types-generator.d.ts

@@ -0,0 +1,10 @@
+import type { Seed, Branch } from './types.js';
+/** slug/alias → PascalCase identifier. 'blog-posts' → 'BlogPosts'. */
+export declare function pascalCase(input: string): string;
+/** Maps a single Branch to its TypeScript type expression (no optional marker). */
+export declare function tsTypeForBranch(branch: Branch): string;
+/** Emits one exported interface for a single Seed. */
+export declare function interfaceForSeed(seed: Seed): string;
+/** Pure entry point. Deterministic: sorts seeds by slug for stable diffs. */
+export declare function generateSeedTypes(seeds: Seed[]): string;
+//# sourceMappingURL=seed-types-generator.d.ts.map

package/dist/seed-types-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed-types-generator.d.ts","sourceRoot":"","sources":["../src/seed-types-generator.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAe9C,sEAAsE;AACtE,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMhD;AAMD,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAoCtD;AAWD,sDAAsD;AACtD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAYnD;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CASvD"}

package/dist/seed-types-generator.js

@@ -0,0 +1,86 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+const HEADER = '// Questo file è generato automaticamente da BeechCMS CLI. Non modificarlo direttamente.\n';
+/** System columns emitted by generateCreateTable — always present, never optional. */
+const SYSTEM_FIELDS = `  id: string\n` +
+    `  slug: string\n` +
+    `  status: 'draft' | 'review' | 'published' | 'archived'\n`;
+const SYSTEM_TIMESTAMPS = `  created_at: number\n` +
+    `  updated_at: number\n`;
+/** slug/alias → PascalCase identifier. 'blog-posts' → 'BlogPosts'. */
+export function pascalCase(input) {
+    return input
+        .split(/[^A-Za-z0-9]+/)
+        .filter(Boolean)
+        .map(w => w.charAt(0).toUpperCase() + w.slice(1))
+        .join('');
+}
+function literalUnion(options) {
+    return options.map(o => `'${o.replace(/'/g, "\\'")}'`).join(' | ');
+}
+/** Maps a single Branch to its TypeScript type expression (no optional marker). */
+export function tsTypeForBranch(branch) {
+    switch (branch.type) {
+        case 'number':
+        case 'date':
+            return 'number';
+        case 'boolean':
+            return 'boolean';
+        case 'json':
+            return 'unknown';
+        case 'text':
+        case 'richtext':
+        case 'file': {
+            const base = branch.type === 'text' && branch.options?.length
+                ? literalUnion(branch.options)
+                : 'string';
+            return branch.type === 'file' && branch.multiple ? `${base}[]` : base;
+        }
+        case 'tags': {
+            const base = branch.options?.length ? `(${literalUnion(branch.options)})` : 'string';
+            return `${base}[]`;
+        }
+        case 'relation':
+            return branch.multiple ? 'string[]' : 'string';
+        case 'repeater': {
+            const inner = (branch.fields ?? [])
+                .map(f => `${propName(f)}${optional(f)}: ${tsTypeForBranch(f)}`)
+                .join('; ');
+            return `Array<{ ${inner} }>`;
+        }
+        default: {
+            // Exhaustiveness guard — fails the build if BranchType gains a member.
+            const _never = branch.type;
+            return _never;
+        }
+    }
+}
+function optional(branch) {
+    return branch.requiredOnCreate ? '' : '?';
+}
+function propName(branch) {
+    // alias is a valid SQL column; quote only if not a plain identifier.
+    return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(branch.alias) ? branch.alias : `'${branch.alias}'`;
+}
+/** Emits one exported interface for a single Seed. */
+export function interfaceForSeed(seed) {
+    const name = pascalCase(seed.slug);
+    const props = seed.branches
+        .map(b => `  ${propName(b)}${optional(b)}: ${tsTypeForBranch(b)}`)
+        .join('\n');
+    return (`export interface ${name} {\n` +
+        SYSTEM_FIELDS +
+        (props ? props + '\n' : '') +
+        SYSTEM_TIMESTAMPS +
+        `}\n`);
+}
+/** Pure entry point. Deterministic: sorts seeds by slug for stable diffs. */
+export function generateSeedTypes(seeds) {
+    const sorted = [...seeds].sort((a, b) => a.slug.localeCompare(b.slug));
+    const interfaces = sorted.map(interfaceForSeed).join('\n');
+    const registry = `export interface SeedRegistryTypes {\n` +
+        sorted.map(s => `  ${propName({ alias: s.slug })}: ${pascalCase(s.slug)}`).join('\n') +
+        (sorted.length ? '\n' : '') +
+        `}\n`;
+    return `${HEADER}\n${interfaces}\n${registry}`;
+}

package/dist/webhook-crypto.d.ts

@@ -0,0 +1,8 @@
+/** Signs a raw request body. Returns `sha256=<hex>`. */
+export declare function signWebhookBody(body: string, secret: string): Promise<string>;
+/**
+ * Verifies an inbound signature against the recomputed HMAC.
+ * Accepts the `sha256=` prefix on the provided signature (optional).
+ */
+export declare function verifyWebhookSignature(body: string, signature: string | null | undefined, secret: string): Promise<boolean>;
+//# sourceMappingURL=webhook-crypto.d.ts.map

package/dist/webhook-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-crypto.d.ts","sourceRoot":"","sources":["../src/webhook-crypto.ts"],"names":[],"mappings":"AAqBA,wDAAwD;AACxD,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAInF;AAUD;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAKlB"}

package/dist/webhook-crypto.js

@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+const SIG_PREFIX = 'sha256=';
+function toHex(buf) {
+    return Array.from(new Uint8Array(buf))
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+async function hmacKey(secret) {
+    return crypto.subtle.importKey('raw', new TextEncoder().encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+}
+/** Signs a raw request body. Returns `sha256=<hex>`. */
+export async function signWebhookBody(body, secret) {
+    const key = await hmacKey(secret);
+    const sig = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(body));
+    return SIG_PREFIX + toHex(sig);
+}
+/** Constant-time comparison of two equal-or-unequal-length hex strings. */
+function timingSafeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let mismatch = 0;
+    for (let i = 0; i < a.length; i++)
+        mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return mismatch === 0;
+}
+/**
+ * Verifies an inbound signature against the recomputed HMAC.
+ * Accepts the `sha256=` prefix on the provided signature (optional).
+ */
+export async function verifyWebhookSignature(body, signature, secret) {
+    if (!signature || !secret)
+        return false;
+    const expected = await signWebhookBody(body, secret);
+    const provided = signature.startsWith(SIG_PREFIX) ? signature : SIG_PREFIX + signature;
+    return timingSafeEqual(expected, provided);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beechcms/core",
-  "version": "0.6.0-preview.2",
+  "version": "0.6.0-preview.4",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -12,16 +12,12 @@
     ".": {
       "import": "./dist/index.js",
       "types": "./dist/index.d.ts"
+    },
+    "./webhook-crypto": {
+      "import": "./dist/webhook-crypto.js",
+      "types": "./dist/webhook-crypto.d.ts"
     }
   },
-  "scripts": {
-    "build": "tsc",
-    "dev": "tsc -w --preserveWatchOutput",
-    "lint": "eslint .",
-    "type-check": "tsc --noEmit",
-    "test": "vitest run",
-    "test:coverage": "vitest run --coverage"
-  },
   "devDependencies": {
     "@vitest/coverage-v8": "^4.1.0",
     "vitest": "^4.1.0"
@@ -41,5 +37,13 @@
     "katex": "^0.16.11",
     "zod": "^4.3.6"
   },
-  "license": "MIT"
-}
+  "license": "MIT",
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc -w --preserveWatchOutput",
+    "lint": "eslint .",
+    "type-check": "tsc --noEmit",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage"
+  }
+}