@beechcms/core 0.8.0 → 0.9.0

package/dist/auth/account-email.d.ts

@@ -0,0 +1,3 @@
+/** Validates the trimmed, lowercased account identifier used by login and account writes. */
+export declare function isValidAccountEmail(email: string): boolean;
+//# sourceMappingURL=account-email.d.ts.map

package/dist/auth/account-email.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-email.d.ts","sourceRoot":"","sources":["../../src/auth/account-email.ts"],"names":[],"mappings":"AAMA,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAG1D"}

package/dist/auth/account-email.js

@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+const ACCOUNT_EMAIL_REGEX = /^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/;
+const MAX_ACCOUNT_EMAIL_LENGTH = 254;
+/** Validates the trimmed, lowercased account identifier used by login and account writes. */
+export function isValidAccountEmail(email) {
+    const normalizedEmail = email.trim().toLowerCase();
+    return normalizedEmail.length <= MAX_ACCOUNT_EMAIL_LENGTH && ACCOUNT_EMAIL_REGEX.test(normalizedEmail);
+}

package/dist/auth/password-reset-token.repository.d.ts

@@ -8,6 +8,12 @@ export interface ValidatedResetToken {
     userId: string;
     email: string;
 }
+export interface RedeemPasswordResetInput {
+    tokenId: string;
+    userId: string;
+    newPasswordHash: string;
+    nowTimestamp: number;
+}
 export interface IPasswordResetTokenRepository {
     /**
      * Marks all pending (unused) tokens for the user as consumed before issuing a new one.
@@ -22,7 +28,12 @@ export interface IPasswordResetTokenRepository {
      * Returns null if the token is expired, already used, or not found.
      */
     findValidByHashWithEmail(tokenHash: string, nowTimestamp: number): Promise<ValidatedResetToken | null>;
-    /** Marks a token as consumed so it cannot be used again. */
-    markUsed(tokenId: string, nowTimestamp: number): Promise<void>;
+    /**
+     * Redeems a token in one atomic unit: burns it, replaces the user's password hash and revokes
+     * every refresh token. Either all three land or none do.
+     * Returns `true` for the single caller that burned the token, `false` (writing nothing) when it
+     * was already redeemed by a concurrent request.
+     */
+    redeem(input: RedeemPasswordResetInput): Promise<boolean>;
 }
 //# sourceMappingURL=password-reset-token.repository.d.ts.map

package/dist/auth/password-reset-token.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset-token.repository.d.ts","sourceRoot":"","sources":["../../src/auth/password-reset-token.repository.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C;;;OAGG;IACH,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEtE,0FAA0F;IAC1F,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEpD;;;;OAIG;IACH,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAA;IAEtG,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/D"}
+{"version":3,"file":"password-reset-token.repository.d.ts","sourceRoot":"","sources":["../../src/auth/password-reset-token.repository.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,6BAA6B;IAC5C;;;OAGG;IACH,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEtE,0FAA0F;IAC1F,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEpD;;;;OAIG;IACH,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAA;IAEtG;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC1D"}

package/dist/auth/user.repository.d.ts

@@ -1,12 +1,43 @@
+import type { AdminGuardedResult, PageRequest } from '../rbac/types.js';
 export interface UserRecord {
     id: string;
     email: string;
     name: string | null;
     surname: string | null;
     passwordHash: string;
+    /**
+     * System-level account type ('admin' | 'editor').
+     * - 'admin': Developer / instance owner with full system access and Seed Builder control.
+     * - 'editor': Generic Beech CMS user whose permissions are managed via RBAC assignments.
+     *   (Note: 'editor' is retained as technical debt for DB CHECK constraint and backwards compatibility).
+     */
     role: string;
     avatarUrl: string | null;
     notificationPreferences: string;
+    /**
+     * Reversible deactivation (`users.is_active`). A deactivated account keeps its rows,
+     * its assignments and its refresh tokens, but is refused at every authorization
+     * boundary — which is what makes revocation instant despite 15-minute access JWTs.
+     */
+    isActive: boolean;
+}
+/**
+ * Administrative projection of an account. Deliberately carries NO `passwordHash`:
+ * account listings must never put credential material on the wire.
+ */
+export interface AccountSummary {
+    id: string;
+    email: string;
+    name: string | null;
+    surname: string | null;
+    /**
+     * Developer/owner axis ('admin' | 'editor'), orthogonal to RBAC permissions.
+     * - 'admin' = Developer / Owner
+     * - 'editor' = Generic Beech user (RBAC-gated)
+     */
+    role: string;
+    isActive: boolean;
+    createdAt: number;
 }
 export interface NewUserInput {
     id: string;
@@ -16,6 +47,15 @@ export interface NewUserInput {
     name: string | null;
     surname: string | null;
 }
+/**
+ * The (role, scope) grant `createInitialAdmin` writes in the same transaction as the
+ * account itself, so the first administrator can never exist without one.
+ */
+export interface InitialRoleGrant {
+    id: string;
+    roleId: string;
+    scope: string;
+}
 export interface IUserRepository {
     /**
      * Returns the total number of registered users.
@@ -29,11 +69,15 @@ export interface IUserRepository {
     /** Inserts a new user record. */
     create(user: NewUserInput): Promise<void>;
     /**
-     * Atomically creates the first administrator account, guarded by a
-     * setup-completed marker row inserted in the same transaction. Returns
-     * false instead of throwing when setup was already completed concurrently.
+     * Atomically creates the first administrator account AND its `roleGrant`,
+     * guarded by a setup-completed marker row inserted in the same transaction.
+     * The account can never exist without its role: callers must resolve the
+     * grant before calling this, so a missing or unresolvable role aborts setup
+     * with nothing written instead of leaving a stranded, unrecoverable admin.
+     * Returns false instead of throwing when setup was already completed
+     * concurrently.
      */
-    createInitialAdmin(user: NewUserInput): Promise<boolean>;
+    createInitialAdmin(user: NewUserInput, roleGrant: InitialRoleGrant): Promise<boolean>;
     /** Updates the user's display name, surname, and/or email address. */
     updateProfile(userId: string, fields: {
         name?: string;
@@ -42,6 +86,11 @@ export interface IUserRepository {
     }): Promise<void>;
     /** Replaces the user's stored password hash after a successful password change. */
     updatePasswordHash(userId: string, newPasswordHash: string): Promise<void>;
+    /**
+     * Replaces the password hash and revokes every active refresh token of the user in one
+     * atomic write, so a password change can never leave old sessions valid.
+     */
+    changePasswordAndRevokeSessions(userId: string, newPasswordHash: string, nowTimestamp: number): Promise<void>;
     /** Sets or clears the user's avatar URL. */
     updateAvatarUrl(userId: string, avatarUrl: string | null): Promise<void>;
     /** Persists the user's notification preferences as a JSON string. */
@@ -52,5 +101,21 @@ export interface IUserRepository {
      * an unrelated account exists.
      */
     emailBelongsToAnotherUser(email: string, currentUserId: string): Promise<boolean>;
+    /** One page of accounts, oldest first, without credential material. */
+    listAccounts(page: PageRequest): Promise<AccountSummary[]>;
+    /** One account by id, without credential material. Null when absent. */
+    findAccountById(userId: string): Promise<AccountSummary | null>;
+    /**
+     * Flips `users.is_active`. `not-found` when the user does not exist.
+     * Reversible by design (brief §4): rows, assignments and tokens are all preserved.
+     * Deactivation returns `last-global-admin` and changes nothing when the account is the
+     * last active global administrator.
+     */
+    setActive(userId: string, isActive: boolean): Promise<AdminGuardedResult>;
+    /**
+     * Read-only twin of the deactivation guard in {@link setActive}: is this account the last
+     * active global administrator? ADVISORY — see `IRoleAssignmentRepository.isLastGlobalAdminAssignment`.
+     */
+    isLastGlobalAdmin(userId: string): Promise<boolean>;
 }
 //# sourceMappingURL=user.repository.d.ts.map

package/dist/auth/user.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.repository.d.ts","sourceRoot":"","sources":["../../src/auth/user.repository.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,uBAAuB,EAAE,MAAM,CAAA;CAChC;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;IAE3B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IAEpD,qEAAqE;IACrE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IAEtD,iCAAiC;IACjC,MAAM,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEzC;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAExD,sEAAsE;IACtE,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEzG,mFAAmF;IACnF,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE1E,4CAA4C;IAC5C,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAExE,qEAAqE;IACrE,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAErF;;;;OAIG;IACH,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAClF"}
+{"version":3,"file":"user.repository.d.ts","sourceRoot":"","sources":["../../src/auth/user.repository.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAEvE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,uBAAuB,EAAE,MAAM,CAAA;IAC/B;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,OAAO,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;IAE3B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IAEpD,qEAAqE;IACrE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IAEtD,iCAAiC;IACjC,MAAM,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEzC;;;;;;;;OAQG;IACH,kBAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAErF,sEAAsE;IACtE,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEzG,mFAAmF;IACnF,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE1E;;;OAGG;IACH,+BAA+B,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE7G,4CAA4C;IAC5C,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAExE,qEAAqE;IACrE,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAErF;;;;OAIG;IACH,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAEjF,uEAAuE;IACvE,YAAY,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAA;IAE1D,wEAAwE;IACxE,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAA;IAE/D;;;;;OAKG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAEzE;;;OAGG;IACH,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACpD"}

package/dist/automations-grammar-words.d.ts

@@ -0,0 +1,2 @@
+export declare const AUTOMATION_RESERVED_WORDS: Set<string>;
+//# sourceMappingURL=automations-grammar-words.d.ts.map

package/dist/automations-grammar-words.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"automations-grammar-words.d.ts","sourceRoot":"","sources":["../src/automations-grammar-words.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,yBAAyB,aAKpC,CAAA"}

package/dist/automations-grammar-words.js

@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+export const AUTOMATION_RESERVED_WORDS = new Set([
+    'this', 'batch', 'all', 'firstone', 'lastone', 'byid', 'where',
+    'array',
+    'count', 'sum', 'avg', 'min', 'max', 'pluck',
+    'true', 'false', 'null',
+]);

package/dist/automations.repository.interface.d.ts

@@ -0,0 +1,19 @@
+import type { Automation, AutomationAction, AutomationTrigger, AutomationTriggerEvent, WhenNode } from './automations.types.js';
+export interface CreateAutomationInput {
+    seed_slug: string;
+    name: string;
+    triggers: AutomationTrigger[];
+    trigger_conditions: WhenNode | null;
+    actions: AutomationAction[];
+}
+export type UpdateAutomationInput = Partial<CreateAutomationInput>;
+export interface IAutomationRepository {
+    list(seedSlug: string): Promise<Automation[]>;
+    findById(id: string): Promise<Automation | null>;
+    create(input: CreateAutomationInput): Promise<string>;
+    update(id: string, input: UpdateAutomationInput): Promise<void>;
+    toggle(id: string, enabled: boolean): Promise<void>;
+    delete(id: string): Promise<void>;
+    findActive(seedSlug: string, event: AutomationTriggerEvent): Promise<Automation[]>;
+}
+//# sourceMappingURL=automations.repository.interface.d.ts.map

package/dist/automations.repository.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"automations.repository.interface.d.ts","sourceRoot":"","sources":["../src/automations.repository.interface.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAE/H,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,iBAAiB,EAAE,CAAA;IAC7B,kBAAkB,EAAE,QAAQ,GAAG,IAAI,CAAA;IACnC,OAAO,EAAE,gBAAgB,EAAE,CAAA;CAC5B;AAED,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAA;AAElE,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IAChD,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACrD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/D,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjC,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;CACnF"}

package/dist/automations.repository.interface.js

@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+export {};

package/dist/automations.runner.interface.d.ts

@@ -0,0 +1,10 @@
+import type { AutomationTriggerEvent } from './automations.types.js';
+export interface AutomationEventPayload {
+    seedSlug: string;
+    event: AutomationTriggerEvent;
+    entry: Record<string, unknown>;
+}
+export interface IAutomationRunner {
+    run(payload: AutomationEventPayload): Promise<void>;
+}
+//# sourceMappingURL=automations.runner.interface.d.ts.map

package/dist/automations.runner.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"automations.runner.interface.d.ts","sourceRoot":"","sources":["../src/automations.runner.interface.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAEpE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,sBAAsB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpD"}

package/dist/automations.runner.interface.js

@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+export {};

package/dist/automations.runner.stub.d.ts

@@ -0,0 +1,5 @@
+import type { IAutomationRunner, AutomationEventPayload } from './automations.runner.interface.js';
+export declare class NoOpAutomationRunner implements IAutomationRunner {
+    run(_payload: AutomationEventPayload): Promise<void>;
+}
+//# sourceMappingURL=automations.runner.stub.d.ts.map

package/dist/automations.runner.stub.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"automations.runner.stub.d.ts","sourceRoot":"","sources":["../src/automations.runner.stub.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAElG,qBAAa,oBAAqB,YAAW,iBAAiB;IACtD,GAAG,CAAC,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3D"}

package/dist/automations.runner.stub.js

@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+export class NoOpAutomationRunner {
+    async run(_payload) {
+        // intentionally empty
+    }
+}

package/dist/automations.types.d.ts

@@ -0,0 +1,75 @@
+export type AutomationTriggerEvent = 'create' | 'update' | 'delete' | 'cron';
+export interface AutomationTrigger {
+    event: AutomationTriggerEvent;
+    cron?: string | null;
+}
+export interface TriggerCondition {
+    field: string;
+    op: 'eq' | 'neq' | 'contains' | 'gt' | 'lt' | 'isempty' | 'isnotempty';
+    value: unknown;
+}
+export type WhenOperand = {
+    kind: 'literal';
+    value: unknown;
+} | {
+    kind: 'ref';
+    key: string;
+};
+export type WhenOp = 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte' | 'contains' | 'startswith' | 'endswith' | 'in' | 'notin' | 'isempty' | 'isnotempty' | 'matches';
+export interface WhenPredicate {
+    kind: 'predicate';
+    left: WhenOperand;
+    op: WhenOp;
+    right?: WhenOperand;
+}
+export interface WhenGroup {
+    kind: 'group';
+    op: 'AND' | 'OR';
+    children: WhenNode[];
+    negate?: boolean;
+}
+export type WhenNode = WhenPredicate | WhenGroup;
+export interface SetVariableAction {
+    type: 'set_variable';
+    name: string;
+    seed_slug?: string;
+    fixed_id?: string;
+    column?: string;
+    filters?: TriggerCondition[];
+    order_by?: string;
+    order?: 'asc' | 'desc';
+    /** @deprecated Read but ignored at runtime. Removed on next save. */
+    load_type?: 'fruit' | 'branch';
+}
+export type AutomationAction = {
+    type: 'webhook';
+    url: string;
+    method?: 'POST' | 'GET' | 'PUT';
+    headers?: Record<string, string>;
+    body_template?: string;
+} | {
+    type: 'send_mail';
+    to: string;
+    subject_template: string;
+    body_template: string;
+} | {
+    type: 'edit_field';
+    field: string;
+    value: unknown;
+} | {
+    type: 'create_entry';
+    seed_slug: string;
+    field_map: Record<string, string>;
+} | SetVariableAction;
+export interface Automation {
+    id: string;
+    seed_slug: string;
+    name: string;
+    enabled: boolean;
+    triggers: AutomationTrigger[];
+    trigger_conditions: WhenNode | null;
+    actions: AutomationAction[];
+    created_at: number;
+    updated_at: number;
+}
+//# sourceMappingURL=automations.types.d.ts.map

package/dist/automations.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"automations.types.d.ts","sourceRoot":"","sources":["../src/automations.types.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAA;AAE5E,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,sBAAsB,CAAA;IAC7B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,EAAE,IAAI,GAAG,KAAK,GAAG,UAAU,GAAG,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,CAAA;IACtE,KAAK,EAAE,OAAO,CAAA;CACf;AAMD,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAA;AAEhC,MAAM,MAAM,MAAM,GACd,IAAI,GAAG,KAAK,GACZ,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAC3B,UAAU,GAAG,YAAY,GAAG,UAAU,GACtC,IAAI,GAAG,OAAO,GACd,SAAS,GAAG,YAAY,GACxB,SAAS,CAAA;AAEb,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,WAAW,CAAA;IACjB,IAAI,EAAE,WAAW,CAAA;IACjB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,OAAO,CAAA;IACb,EAAE,EAAE,KAAK,GAAG,IAAI,CAAA;IAChB,QAAQ,EAAE,QAAQ,EAAE,CAAA;IACpB,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,MAAM,QAAQ,GAAG,aAAa,GAAG,SAAS,CAAA;AAEhD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,cAAc,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAA;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IACtB,qEAAqE;IACrE,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAA;CAC/B;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAM,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAChI;IAAE,IAAI,EAAE,WAAW,CAAC;IAAI,EAAE,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACrF;IAAE,IAAI,EAAE,YAAY,CAAC;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAC9E,iBAAiB,CAAA;AAErB,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,iBAAiB,EAAE,CAAA;IAC7B,kBAAkB,EAAE,QAAQ,GAAG,IAAI,CAAA;IACnC,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB"}

package/dist/automations.types.js

@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+export {};

package/dist/clock.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Time abstraction. Hides direct calls to {@link Date.now} so callers can
+ * swap in deterministic clocks during tests without resorting to global
+ * timer mocks (e.g. vi.useFakeTimers, sinon, monkey-patching Date).
+ */
+export interface IClock {
+    /**
+     * Returns the current Unix timestamp in milliseconds.
+     * Equivalent to Date.now() in production.
+     * Overridable in tests for deterministic time-sensitive assertions.
+     */
+    now(): number;
+    /**
+     * Returns the current Unix timestamp in whole seconds.
+     * Equivalent to Math.floor(Date.now() / 1000) in production.
+     * Used by JWT issuance, session expiry, and analytics day-bucket computations.
+     */
+    nowSeconds(): number;
+}
+/**
+ * Production singleton. Delegates to the host runtime clock. Stateless and
+ * therefore safe to share across requests.
+ */
+export declare const SystemClock: IClock;
+//# sourceMappingURL=clock.d.ts.map

package/dist/clock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clock.d.ts","sourceRoot":"","sources":["../src/clock.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,MAAM,WAAW,MAAM;IACrB;;;;OAIG;IACH,GAAG,IAAI,MAAM,CAAA;IAEb;;;;OAIG;IACH,UAAU,IAAI,MAAM,CAAA;CACrB;AAID;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,MAGzB,CAAA"}

package/dist/clock.js

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+const MILLISECONDS_PER_SECOND = 1000;
+/**
+ * Production singleton. Delegates to the host runtime clock. Stateless and
+ * therefore safe to share across requests.
+ */
+export const SystemClock = {
+    now: () => Date.now(),
+    nowSeconds: () => Math.floor(Date.now() / MILLISECONDS_PER_SECOND),
+};

package/dist/common/canonical-json.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @module common/canonical-json
+ * Deterministic JSON serialization, shared by two callers that must never disagree:
+ * the manifest writer (`schema/canonical.ts`, authoring-side) and the schema fingerprint
+ * (`engine/schema-fingerprint.ts`, runtime-side). The public API's Idempotency-Key request
+ * fingerprint also hashes it, so equivalent payloads with reordered JSON keys match.
+ *
+ * Moved here in sprint 2 because the fingerprint runs inside the Worker and `schema/` is the one
+ * module the Worker must never import. The BYTES ARE FROZEN — sprint 1 declared this format a
+ * compatibility surface, and a published client's fingerprint is only comparable as long as it
+ * stays byte-stable. Changing key ordering, indentation or the trailing newline invalidates every
+ * already-published client and requires a `SCHEMA_FINGERPRINT_VERSION` bump.
+ */
+/** Thrown when a value cannot survive a JSON round-trip. */
+export declare class CanonicalSerializationError extends Error {
+    /** Dotted path to the offending value, e.g. `seeds[0].branches[2].validate`. */
+    readonly path: string;
+    /** What was found there, e.g. `function`. */
+    readonly found: string;
+    constructor(
+    /** Dotted path to the offending value, e.g. `seeds[0].branches[2].validate`. */
+    path: string, 
+    /** What was found there, e.g. `function`. */
+    found: string);
+}
+/**
+ * Serializes any value to its canonical form: keys sorted, two-space indentation, trailing newline.
+ * Stable across key insertion order and across authoring order.
+ */
+export declare function canonicalStringify(value: unknown): string;
+//# sourceMappingURL=canonical-json.d.ts.map

package/dist/common/canonical-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.d.ts","sourceRoot":"","sources":["../../src/common/canonical-json.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;GAYG;AAEH,4DAA4D;AAC5D,qBAAa,2BAA4B,SAAQ,KAAK;IAElD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM;;IAHtB,gFAAgF;IACvE,IAAI,EAAE,MAAM;IACrB,6CAA6C;IACpC,KAAK,EAAE,MAAM;CAQzB;AA+CD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEzD"}

package/dist/common/canonical-json.js

@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+/**
+ * @module common/canonical-json
+ * Deterministic JSON serialization, shared by two callers that must never disagree:
+ * the manifest writer (`schema/canonical.ts`, authoring-side) and the schema fingerprint
+ * (`engine/schema-fingerprint.ts`, runtime-side). The public API's Idempotency-Key request
+ * fingerprint also hashes it, so equivalent payloads with reordered JSON keys match.
+ *
+ * Moved here in sprint 2 because the fingerprint runs inside the Worker and `schema/` is the one
+ * module the Worker must never import. The BYTES ARE FROZEN — sprint 1 declared this format a
+ * compatibility surface, and a published client's fingerprint is only comparable as long as it
+ * stays byte-stable. Changing key ordering, indentation or the trailing newline invalidates every
+ * already-published client and requires a `SCHEMA_FINGERPRINT_VERSION` bump.
+ */
+/** Thrown when a value cannot survive a JSON round-trip. */
+export class CanonicalSerializationError extends Error {
+    path;
+    found;
+    constructor(
+    /** Dotted path to the offending value, e.g. `seeds[0].branches[2].validate`. */
+    path, 
+    /** What was found there, e.g. `function`. */
+    found) {
+        super(`Manifest value at '${path}' is a ${found}, which cannot be persisted. ` +
+            `A manifest holds serializable JSON only — no callbacks, class instances, Date, Map, Set or RegExp.`);
+        this.path = path;
+        this.found = found;
+        this.name = 'CanonicalSerializationError';
+    }
+}
+function describe(value) {
+    if (value === null)
+        return null;
+    const type = typeof value;
+    if (type === 'function')
+        return 'function';
+    if (type === 'symbol')
+        return 'symbol';
+    if (type === 'bigint')
+        return 'bigint';
+    if (type === 'undefined')
+        return 'undefined';
+    if (type === 'number' && !Number.isFinite(value))
+        return 'non-finite number';
+    if (type !== 'object')
+        return null;
+    if (Array.isArray(value))
+        return null;
+    const proto = Object.getPrototypeOf(value);
+    if (proto !== Object.prototype && proto !== null)
+        return value.constructor?.name ?? 'class instance';
+    return null;
+}
+/**
+ * Canonicalizes one value: object keys sorted lexicographically, `undefined` properties dropped,
+ * array ORDER preserved (branch order is the physical column order — it is data, not formatting).
+ */
+function canonicalize(value, path) {
+    const offence = describe(value);
+    if (offence)
+        throw new CanonicalSerializationError(path, offence);
+    if (value === null)
+        return null;
+    if (Array.isArray(value)) {
+        return Array.from({ length: value.length }, (_, index) => {
+            const item = Object.hasOwn(value, index) ? value[index] : undefined;
+            if (item === undefined)
+                throw new CanonicalSerializationError(`${path}[${index}]`, 'undefined');
+            return canonicalize(item, `${path}[${index}]`);
+        });
+    }
+    if (typeof value === 'object') {
+        const out = Object.create(null);
+        for (const key of Object.keys(value).sort()) {
+            const child = value[key];
+            if (child === undefined)
+                continue;
+            out[key] = canonicalize(child, path ? `${path}.${key}` : key);
+        }
+        return out;
+    }
+    return value;
+}
+/**
+ * Serializes any value to its canonical form: keys sorted, two-space indentation, trailing newline.
+ * Stable across key insertion order and across authoring order.
+ */
+export function canonicalStringify(value) {
+    return `${JSON.stringify(canonicalize(value, ''), null, 2)}\n`;
+}

package/dist/content/content-scan.repository.d.ts

@@ -2,7 +2,7 @@ import type { Seed } from '../engine/types.js';
 export interface IContentScanRepository {
     /**
      * Scans across all registered seeds to identify media keys that are currently referenced
-     * by any content entry. Used for orphaned media detection and storage analytics.
+     * by any content entry, live or draft. Used for orphaned media detection and storage analytics.
      */
     getReferencedMediaKeys(seeds: Seed[]): Promise<Set<string>>;
 }