@beechcms/core 0.4.3 → 0.6.0-preview.1

package/dist/engine.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
 const BRANCH_TYPE_SQL = {
     text: { sqlType: 'TEXT' },
     number: { sqlType: 'REAL' },
@@ -7,6 +9,7 @@ const BRANCH_TYPE_SQL = {
     richtext: { sqlType: 'TEXT' },
     file: { sqlType: 'TEXT' }, // URL singolo o JSON array di URL
     tags: { sqlType: 'TEXT' }, // JSON array di stringhe
+    relation: { sqlType: 'TEXT' }, // FK reference stored as TEXT (id of the target row)
 };
 const SYSTEM_COLUMNS = new Set(['id', 'slug', 'status', 'created_at', 'updated_at']);
 // ---- Private helpers ----
@@ -21,7 +24,7 @@ function isValidColumn(seed, col) {
         return true;
     return seed.branches.some(b => b.alias === col);
 }
-function indexableSearchBranches(seed) {
+export function indexableSearchBranches(seed) {
     return seed.branches.filter(b => (b.type === 'text' || b.type === 'richtext') && b.policies?.search !== false);
 }
 function isAssetListBranch(branch) {
@@ -69,6 +72,29 @@ function normalizeAssetListValue(rawValue) {
     }
     return [...new Set(normalized)];
 }
+// ---- FK helpers ----
+const DEFAULT_ON_DELETE_RULE = 'SET NULL';
+/**
+ * Returns the trailing FK fragment for a single-value relation branch, or ''
+ * if the branch is not a relation. Throws when a single-value relation branch
+ * is missing `targetSeed` — that is a programmer error that must surface at
+ * DDL time rather than producing silently invalid SQL.
+ *
+ * Multi-relation branches (multiple: true) produce NO column on the parent
+ * table; they live in a dedicated junction table. Returns '' for them.
+ */
+function buildForeignKeyClause(branch) {
+    if (branch.type !== 'relation')
+        return '';
+    // Many-to-many branches: no column on parent table — see generateJunctionTable()
+    if (branch.multiple === true)
+        return '';
+    if (!branch.targetSeed) {
+        throw new Error(`Branch "${branch.alias}" is of type 'relation' but has no targetSeed`);
+    }
+    const onDeleteRule = branch.onDelete ?? DEFAULT_ON_DELETE_RULE;
+    return ` REFERENCES content_${branch.targetSeed}(id) ON DELETE ${onDeleteRule}`;
+}
 // ---- DDL Generators ----
 /**
  * Generates `CREATE TABLE IF NOT EXISTS content_{slug}` with system columns
@@ -83,12 +109,17 @@ export function generateCreateTable(seed) {
         `  status     TEXT    NOT NULL DEFAULT 'draft' CHECK (status IN ('draft', 'review', 'published', 'archived')),`,
     ];
     for (const branch of seed.branches) {
+        // Many-to-many relation branches produce no column on the parent table;
+        // they are represented by a dedicated junction table. See generateJunctionTable().
+        if (branch.type === 'relation' && branch.multiple === true)
+            continue;
         const { sqlType } = BRANCH_TYPE_SQL[branch.type];
         let col = `  ${branch.alias}  ${sqlType}`;
         if (branch.requiredOnCreate)
             col += ' NOT NULL';
         if (branch.type === 'boolean')
             col += ` CHECK (${branch.alias} IN (0, 1))`;
+        col += buildForeignKeyClause(branch);
         lines.push(col + ',');
     }
     lines.push(`  created_at INTEGER NOT NULL DEFAULT (unixepoch()),`);
@@ -112,6 +143,9 @@ export function generateDraftTable(seed) {
         `            REFERENCES ${mainTable}(id) ON DELETE CASCADE,`,
     ];
     for (const branch of seed.branches) {
+        // Many-to-many relation branches mirror in their own junction drafts table.
+        if (branch.type === 'relation' && branch.multiple === true)
+            continue;
         const { sqlType } = BRANCH_TYPE_SQL[branch.type];
         let col = `  ${branch.alias}  ${sqlType}`;
         // boolean CHECK: in SQLite, NULL IN (0,1) → NULL, which passes the CHECK (only FALSE fails it)
@@ -129,7 +163,7 @@ export function generateDraftTable(seed) {
  */
 export function generateAddColumn(seed, branch) {
     const { sqlType } = BRANCH_TYPE_SQL[branch.type];
-    return `ALTER TABLE ${tableName(seed)} ADD COLUMN ${branch.alias} ${sqlType};`;
+    return `ALTER TABLE ${tableName(seed)} ADD COLUMN ${branch.alias} ${sqlType}${buildForeignKeyClause(branch)};`;
 }
 /**
  * Generates B-tree indexes for status, created_at and every filterable Branch
@@ -143,9 +177,15 @@ export function generateIndexes(seed) {
         `CREATE INDEX IF NOT EXISTS idx_${slug}_created_at ON ${table}(created_at);`,
     ];
     for (const branch of seed.branches) {
-        if (branch.policies?.filter === false)
+        // Multi-relation branches have no column on the parent table; their indexes
+        // live on the junction table. See generateJunctionIndexes().
+        if (branch.type === 'relation' && branch.multiple === true)
             continue;
-        if (['text', 'number', 'date', 'boolean'].includes(branch.type)) {
+        const isRelation = branch.type === 'relation';
+        // Relation indexes are a system concern (JOIN performance) — bypass editorial filter policy
+        if (!isRelation && branch.policies?.filter === false)
+            continue;
+        if (['text', 'number', 'date', 'boolean', 'relation'].includes(branch.type)) {
             indexes.push(`CREATE INDEX IF NOT EXISTS idx_${slug}_${branch.alias} ON ${table}(${branch.alias});`);
         }
     }
@@ -212,6 +252,7 @@ export function generateFtsTriggers(seed) {
  * Never uses json_extract — every column is a real column.
  * Unknown columns in filters/orderBy are ignored (fail-closed).
  */
+//TODO: buildSelectQuery ha troppe responsabilità, va suddiviso in più funzioni
 export function buildSelectQuery(seed, options = {}) {
     const table = tableName(seed);
     const { filters = [], orderBy, pagination, status, search, fields } = options;
@@ -278,6 +319,7 @@ export function buildSelectQuery(seed, options = {}) {
     }
     return { sql, bindings };
 }
+//TODO: normalizeFilterValue ha troppe responsabilità, va suddiviso in più funzioni
 function normalizeFilterValue(type, value) {
     if (value === null || value === undefined)
         return null;
@@ -286,7 +328,7 @@ function normalizeFilterValue(type, value) {
             return value;
         if (typeof value === 'string' && value.trim() !== '') {
             const d = new Date(value);
-            return isNaN(d.getTime()) ? null : Math.floor(d.getTime() / 1000);
+            return Number.isNaN(d.getTime()) ? null : Math.floor(d.getTime() / 1000);
         }
         return null;
     }
@@ -298,12 +340,13 @@ function normalizeFilterValue(type, value) {
             return value;
         if (typeof value === 'string' && value.trim() !== '') {
             const n = Number(value);
-            return isNaN(n) ? null : n;
+            return Number.isNaN(n) ? null : n;
         }
         return null;
     }
     return value;
 }
+//TODO: buildFilterCondition ha troppe responsabilità, va suddiviso in più funzioni
 function buildFilterCondition(col, type, cond, bindings) {
     const { op, value } = cond;
     if (op === 'is_empty') {
@@ -377,7 +420,10 @@ export function getExpectedColumns(seed) {
         { name: 'id', sqlType: 'TEXT', notNull: true, isPk: true },
         { name: 'slug', sqlType: 'TEXT', notNull: true, isPk: false },
         { name: 'status', sqlType: 'TEXT', notNull: true, isPk: false },
-        ...seed.branches.map(b => ({
+        // Multi-relation branches produce no column on the parent table.
+        ...seed.branches
+            .filter(b => !(b.type === 'relation' && b.multiple === true))
+            .map(b => ({
             name: b.alias,
             sqlType: BRANCH_TYPE_SQL[b.type].sqlType,
             notNull: b.requiredOnCreate ?? false,
@@ -392,6 +438,7 @@ export function getExpectedColumns(seed) {
  * Serializes a value for writing to the DB.
  * boolean → 0/1 | date → Unix timestamp | json/asset-list → JSON string
  */
+//TODO: serializeForDb ha troppe responsabilità, va suddiviso in più funzioni
 export function serializeForDb(branch, value) {
     if (value === null || value === undefined)
         return null;
@@ -407,7 +454,7 @@ export function serializeForDb(branch, value) {
                 return value;
             if (typeof value === 'string') {
                 const d = new Date(value);
-                if (isNaN(d.getTime()))
+                if (Number.isNaN(d.getTime()))
                     return null;
                 if (branch.format === 'date') {
                     const midnight = Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate());
@@ -426,6 +473,204 @@ export function serializeForDb(branch, value) {
             return typeof value === 'string' ? value : typeof value === 'number' ? value : null;
     }
 }
+// ---- Junction table DDL (many-to-many relations, Sprint 5) ----
+/**
+ * Returns the junction table name for a many-to-many relation branch.
+ * Format: `rel_<seedSlug>_<branchAlias>`.
+ */
+export function junctionTableName(seedSlug, branchAlias) {
+    return `rel_${seedSlug}_${branchAlias}`;
+}
+/**
+ * Generates `CREATE TABLE IF NOT EXISTS rel_<seed>_<alias>` for a multi-relation
+ * branch. The parent FK always cascades (parent lifecycle owns the edge);
+ * the target FK uses `branch.onDelete` (default CASCADE).
+ *
+ * @throws {Error} when called on a non-multi-relation branch
+ * @throws {Error} when `branch.targetSeed` is missing
+ */
+export function generateJunctionTable(seed, branch) {
+    if (branch.type !== 'relation' || branch.multiple !== true) {
+        throw new Error(`Branch "${branch.alias}" is not a multi-relation`);
+    }
+    if (!branch.targetSeed) {
+        throw new Error(`Branch "${branch.alias}" has no targetSeed`);
+    }
+    const onDeleteRule = branch.onDelete ?? 'CASCADE';
+    const table = junctionTableName(seed.slug, branch.alias);
+    return [
+        `CREATE TABLE IF NOT EXISTS ${table} (`,
+        `  parent_id  TEXT NOT NULL REFERENCES content_${seed.slug}(id)    ON DELETE CASCADE,`,
+        `  target_id  TEXT NOT NULL REFERENCES content_${branch.targetSeed}(id) ON DELETE ${onDeleteRule},`,
+        `  position   INTEGER NOT NULL DEFAULT 0,`,
+        `  created_at INTEGER NOT NULL DEFAULT (unixepoch()),`,
+        `  PRIMARY KEY (parent_id, target_id)`,
+        `);`,
+    ].join('\n');
+}
+/**
+ * Generates the two B-tree indexes for a junction table:
+ * one on `parent_id` (list entries by parent) and one on `target_id`
+ * (cascade checks from target side).
+ */
+export function generateJunctionIndexes(seed, branch) {
+    const table = junctionTableName(seed.slug, branch.alias);
+    return [
+        `CREATE INDEX IF NOT EXISTS idx_${table}_parent ON ${table}(parent_id);`,
+        `CREATE INDEX IF NOT EXISTS idx_${table}_target ON ${table}(target_id);`,
+    ];
+}
+/**
+ * Generates the drafts junction table `rel_<seed>_<alias>_drafts` for a
+ * many-to-many relation branch. Note: no FK on `target_id` — targets may be
+ * deleted between draft save and publish; the FK would be wrong here.
+ * Returns null when `seed.allowDrafts` is falsy.
+ */
+export function generateJunctionDraftTable(seed, branch) {
+    if (!seed.allowDrafts)
+        return null;
+    if (branch.type !== 'relation' || branch.multiple !== true)
+        return null;
+    const table = `${junctionTableName(seed.slug, branch.alias)}_drafts`;
+    const mainDraftTable = `content_${seed.slug}_drafts`;
+    return [
+        `CREATE TABLE IF NOT EXISTS ${table} (`,
+        `  entry_id   TEXT NOT NULL REFERENCES ${mainDraftTable}(entry_id) ON DELETE CASCADE,`,
+        `  target_id  TEXT NOT NULL,`,
+        `  position   INTEGER NOT NULL DEFAULT 0,`,
+        `  PRIMARY KEY (entry_id, target_id)`,
+        `);`,
+    ].join('\n');
+}
+// ---- Destructive DDL Generators (Sprint 06 — Danger Zone) ----
+//
+// Every generator below emits IRREVERSIBLE, data-destroying SQL. They are pure
+// string builders (no DB access); the actual execution goes through
+// ISchemaMutator's dedicated destructive methods (dropTable/dropColumn/
+// renameColumn/execDestructive), which re-validate every identifier before
+// interpolation. These statements MUST NEVER be passed to execDdl (additive-only).
+function draftTableName(seed) {
+    return `content_${seed.slug}_drafts`;
+}
+/**
+ * Returns every `DROP TABLE IF EXISTS` needed to fully remove a content type:
+ * the main `content_{slug}` table, its `fts_{slug}` virtual table, the
+ * `content_{slug}_drafts` mirror (when drafts are enabled), and each
+ * multi-relation junction table `rel_{slug}_{alias}` (+ its `_drafts` mirror).
+ *
+ * FTS triggers reference the main table; dropping the main table also drops
+ * its triggers in SQLite, but we drop the FTS table explicitly so no orphaned
+ * virtual table survives. Order: junction (children) → drafts → fts → main.
+ */
+export function generateDropTable(seed) {
+    const stmts = [];
+    // Junction tables first (they FK-reference the main/draft tables).
+    for (const branch of seed.branches) {
+        if (branch.type !== 'relation' || branch.multiple !== true)
+            continue;
+        const jt = junctionTableName(seed.slug, branch.alias);
+        stmts.push(`DROP TABLE IF EXISTS ${jt}_drafts;`);
+        stmts.push(`DROP TABLE IF EXISTS ${jt};`);
+    }
+    if (seed.allowDrafts) {
+        stmts.push(`DROP TABLE IF EXISTS ${draftTableName(seed)};`);
+    }
+    // FTS triggers + virtual table.
+    if (indexableSearchBranches(seed).length > 0) {
+        const slug = seed.slug;
+        stmts.push(`DROP TRIGGER IF EXISTS fts_${slug}_insert;`);
+        stmts.push(`DROP TRIGGER IF EXISTS fts_${slug}_update;`);
+        stmts.push(`DROP TRIGGER IF EXISTS fts_${slug}_delete;`);
+        stmts.push(`DROP TABLE IF EXISTS ${ftsTableName(seed)};`);
+    }
+    stmts.push(`DROP TABLE IF EXISTS ${tableName(seed)};`);
+    return stmts;
+}
+/**
+ * Returns the `DROP COLUMN` statements for removing a single field.
+ *
+ * - For a multi-relation branch (no column on the parent table) it drops the
+ *   junction table `rel_{slug}_{alias}` (+ `_drafts`) instead.
+ * - For a normal branch it drops the column from `content_{slug}` and, when
+ *   drafts are enabled, the mirror column from `content_{slug}_drafts`.
+ * - For an orphan column (no matching branch in the definition) it falls back
+ *   to a plain `ALTER TABLE … DROP COLUMN`, never touching drafts.
+ *
+ * Callers must rebuild FTS separately (planFtsRebuild) when the dropped column
+ * was searchable, since SQLite cannot ALTER an fts5 table's columns.
+ */
+export function generateDropColumn(seed, alias) {
+    const branch = seed.branches.find(b => b.alias === alias);
+    if (branch && branch.type === 'relation' && branch.multiple === true) {
+        const jt = junctionTableName(seed.slug, alias);
+        return [
+            `DROP TABLE IF EXISTS ${jt}_drafts;`,
+            `DROP TABLE IF EXISTS ${jt};`,
+        ];
+    }
+    const stmts = [`ALTER TABLE ${tableName(seed)} DROP COLUMN ${alias};`];
+    // Drop the mirror column from the drafts table when the branch lives there.
+    if (branch && seed.allowDrafts) {
+        stmts.push(`ALTER TABLE ${draftTableName(seed)} DROP COLUMN ${alias};`);
+    }
+    return stmts;
+}
+/**
+ * Returns the `RENAME COLUMN` statements for renaming a field's alias while
+ * keeping the stable `branch.id`. Renames the column on `content_{slug}` and,
+ * when drafts are enabled, the mirror column on `content_{slug}_drafts`.
+ *
+ * For a multi-relation branch the alias is part of the junction table name, so
+ * the junction table (+ `_drafts`) is renamed instead of a column.
+ *
+ * Callers must rebuild FTS separately (planFtsRebuild) when the renamed column
+ * was searchable.
+ */
+export function generateRenameColumn(seed, from, to) {
+    const branch = seed.branches.find(b => b.alias === from);
+    if (branch && branch.type === 'relation' && branch.multiple === true) {
+        const oldJt = junctionTableName(seed.slug, from);
+        const newJt = junctionTableName(seed.slug, to);
+        const stmts = [`ALTER TABLE ${oldJt} RENAME TO ${newJt};`];
+        if (seed.allowDrafts) {
+            stmts.push(`ALTER TABLE ${oldJt}_drafts RENAME TO ${newJt}_drafts;`);
+        }
+        return stmts;
+    }
+    const stmts = [`ALTER TABLE ${tableName(seed)} RENAME COLUMN ${from} TO ${to};`];
+    if (branch && seed.allowDrafts) {
+        stmts.push(`ALTER TABLE ${draftTableName(seed)} RENAME COLUMN ${from} TO ${to};`);
+    }
+    return stmts;
+}
+/**
+ * Returns the add/copy/drop/rename statements that change a column's SQL type
+ * in place, preserving data via `CAST`. This is the documented simpler
+ * alternative to SQLite's full 12-step table rebuild.
+ *
+ * The `branch` passed in is the *target* definition (already carrying the new
+ * `type`); its SQL type is read from BRANCH_TYPE_SQL. Multi-relation branches
+ * have no column to retype and are rejected. Mirrors the change onto the drafts
+ * table when drafts are enabled. Callers rebuild FTS separately when needed.
+ */
+export function generateRetypeColumn(seed, branch) {
+    if (branch.type === 'relation' && branch.multiple === true) {
+        throw new Error(`Branch "${branch.alias}" is a multi-relation and has no column to retype`);
+    }
+    const { sqlType } = BRANCH_TYPE_SQL[branch.type];
+    const alias = branch.alias;
+    const tmp = `__retype_${alias}`;
+    const rebuild = (table) => [
+        `ALTER TABLE ${table} ADD COLUMN ${tmp} ${sqlType};`,
+        `UPDATE ${table} SET ${tmp} = CAST(${alias} AS ${sqlType});`,
+        `ALTER TABLE ${table} DROP COLUMN ${alias};`,
+        `ALTER TABLE ${table} RENAME COLUMN ${tmp} TO ${alias};`,
+    ];
+    const stmts = rebuild(tableName(seed));
+    if (seed.allowDrafts)
+        stmts.push(...rebuild(draftTableName(seed)));
+    return stmts;
+}
 /**
  * Deserializes a value read from the DB for the API response.
  * 0/1 → boolean | Unix timestamp → ISO 8601 | JSON string → object

package/dist/file-types.d.ts

@@ -0,0 +1,13 @@
+export type FileAccept = 'image' | 'document' | 'any';
+export declare const IMAGE_EXTENSIONS: Set<string>;
+export declare const BLOCKED_IMAGE_EXTENSIONS: Set<string>;
+export declare const DOCUMENT_EXTENSIONS: Set<string>;
+export declare const ARCHIVE_EXTENSIONS: Set<string>;
+export declare const IMAGE_MIME_TYPES: readonly ["image/jpeg", "image/png", "image/gif", "image/webp", "image/avif", "image/bmp", "image/x-icon", "image/vnd.microsoft.icon"];
+export declare const BLOCKED_IMAGE_MIME_TYPES: readonly ["image/svg+xml", "image/svg"];
+export declare const DOCUMENT_MIME_TYPES: readonly ["application/pdf", "application/msword", "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "application/vnd.ms-excel", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "application/vnd.ms-powerpoint", "application/vnd.openxmlformats-officedocument.presentationml.presentation", "text/plain", "text/csv", "text/markdown"];
+export declare const ARCHIVE_MIME_TYPES: readonly ["application/zip", "application/x-zip-compressed", "application/x-7z-compressed", "application/x-tar", "application/gzip", "application/json"];
+export declare function extensionFromUrl(url: string): string | null;
+export declare function isExtensionAccepted(ext: string | null, accept: FileAccept): boolean;
+export declare function isMimeAccepted(mime: string, accept: FileAccept): boolean;
+//# sourceMappingURL=file-types.d.ts.map

package/dist/file-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-types.d.ts","sourceRoot":"","sources":["../src/file-types.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,UAAU,GAAG,KAAK,CAAA;AAKrD,eAAO,MAAM,gBAAgB,aAAuE,CAAA;AACpG,eAAO,MAAM,wBAAwB,aAA2B,CAAA;AAChE,eAAO,MAAM,mBAAmB,aAAoF,CAAA;AACpH,eAAO,MAAM,kBAAkB,aAA8C,CAAA;AAI7E,eAAO,MAAM,gBAAgB,wIASnB,CAAA;AAGV,eAAO,MAAM,wBAAwB,yCAA0C,CAAA;AAC/E,eAAO,MAAM,mBAAmB,yXAWtB,CAAA;AACV,eAAO,MAAM,kBAAkB,0JAOrB,CAAA;AAEV,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS3D;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAMnF;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAcxE"}

package/dist/file-types.js

@@ -0,0 +1,85 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+// SVG is intentionally excluded: SVG can embed <script> tags and is rendered
+// inline by browsers when served as image/svg+xml on a same-origin route,
+// creating a stored XSS vector (see security audit finding #4).
+export const IMAGE_EXTENSIONS = new Set(['jpg', 'jpeg', 'png', 'gif', 'webp', 'avif', 'bmp', 'ico']);
+export const BLOCKED_IMAGE_EXTENSIONS = new Set(['svg', 'svgz']);
+export const DOCUMENT_EXTENSIONS = new Set(['pdf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'txt', 'csv', 'md']);
+export const ARCHIVE_EXTENSIONS = new Set(['zip', '7z', 'tar', 'gz', 'json']);
+// Explicitly enumerate safe image MIME types instead of using the wildcard
+// `image/*` prefix, which would permit `image/svg+xml` and other XSS vectors.
+export const IMAGE_MIME_TYPES = [
+    'image/jpeg',
+    'image/png',
+    'image/gif',
+    'image/webp',
+    'image/avif',
+    'image/bmp',
+    'image/x-icon',
+    'image/vnd.microsoft.icon',
+];
+// Blocked image MIME types — listed explicitly so upload code can reject them
+// with a clear error rather than a generic "file type not allowed".
+export const BLOCKED_IMAGE_MIME_TYPES = ['image/svg+xml', 'image/svg'];
+export const DOCUMENT_MIME_TYPES = [
+    'application/pdf',
+    'application/msword',
+    'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    'application/vnd.ms-excel',
+    'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    'application/vnd.ms-powerpoint',
+    'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+    'text/plain',
+    'text/csv',
+    'text/markdown',
+];
+export const ARCHIVE_MIME_TYPES = [
+    'application/zip',
+    'application/x-zip-compressed',
+    'application/x-7z-compressed',
+    'application/x-tar',
+    'application/gzip',
+    'application/json',
+];
+export function extensionFromUrl(url) {
+    try {
+        const path = new URL(url).pathname;
+        const dot = path.lastIndexOf('.');
+        if (dot < 0 || dot === path.length - 1)
+            return null;
+        return path.slice(dot + 1).toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+export function isExtensionAccepted(ext, accept) {
+    if (accept === 'any')
+        return true;
+    if (ext == null)
+        return false;
+    if (accept === 'image')
+        return IMAGE_EXTENSIONS.has(ext);
+    if (accept === 'document')
+        return DOCUMENT_EXTENSIONS.has(ext);
+    return false;
+}
+export function isMimeAccepted(mime, accept) {
+    // Normalise: strip parameters (e.g. "image/jpeg; charset=utf-8" → "image/jpeg")
+    const normalised = mime.split(';')[0].trim().toLowerCase();
+    // Unconditionally reject SVG regardless of accept mode — SVG can carry
+    // embedded scripts and is rendered by browsers when served inline.
+    if (BLOCKED_IMAGE_MIME_TYPES.includes(normalised))
+        return false;
+    if (accept === 'any') {
+        return IMAGE_MIME_TYPES.includes(normalised)
+            || DOCUMENT_MIME_TYPES.includes(normalised)
+            || ARCHIVE_MIME_TYPES.includes(normalised);
+    }
+    if (accept === 'image')
+        return IMAGE_MIME_TYPES.includes(normalised);
+    if (accept === 'document')
+        return DOCUMENT_MIME_TYPES.includes(normalised);
+    return false;
+}

package/dist/id-generator.d.ts

@@ -10,6 +10,13 @@ export interface IIdGenerator {
      * Test implementations return deterministic values for snapshot assertions.
      */
     uuid(): string;
+    /**
+     * Returns true when `value` has the exact shape produced by `uuid()`.
+     * The ONLY place in the codebase that knows the id format. Never inline
+     * a regex; always go through this method when validating a relation id,
+     * a route param, or any user-supplied id.
+     */
+    isValid(value: unknown): value is string;
 }
 /**
  * Production singleton. Delegates to the host runtime CSPRNG-backed UUID

package/dist/id-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"id-generator.d.ts","sourceRoot":"","sources":["../src/id-generator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,IAAI,IAAI,MAAM,CAAA;CACf;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,YAE/B,CAAA"}
+{"version":3,"file":"id-generator.d.ts","sourceRoot":"","sources":["../src/id-generator.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,IAAI,IAAI,MAAM,CAAA;IAEd;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAA;CACzC;AAMD;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,YAI/B,CAAA"}

package/dist/id-generator.js

@@ -1,7 +1,12 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+// Internal — never exported. Callers depend on the interface, not the shape.
+const SYSTEM_ID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 /**
  * Production singleton. Delegates to the host runtime CSPRNG-backed UUID
  * generator. Stateless and therefore safe to share across requests.
  */
 export const SystemIdGenerator = {
     uuid: () => crypto.randomUUID(),
+    isValid: (value) => typeof value === 'string' && SYSTEM_ID_REGEX.test(value),
 };

package/dist/idempotency.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency.repository.d.ts","sourceRoot":"","sources":["../src/idempotency.repository.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;IACtD,KAAK,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpC"}
+{"version":3,"file":"idempotency.repository.d.ts","sourceRoot":"","sources":["../src/idempotency.repository.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;IACtD,KAAK,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpC"}

package/dist/idempotency.repository.js

@@ -1 +1,3 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
 export {};

package/dist/index.d.ts

@@ -8,6 +8,7 @@
  * @module @beechcms/core
  */
 export * from './types.js';
+export * from './file-types.js';
 export * from './define-seed.js';
 export * from './seeds.js';
 export * from './engine.js';
@@ -41,7 +42,17 @@ export * from './automations.types.js';
 export * from './automations-grammar-words.js';
 export * from './automations.runner.interface.js';
 export * from './automations.repository.interface.js';
-export * from './automations.runner.stub.js';
 export * from './scheduler.interface.js';
 export * from './scheduler.stub.js';
+export * from './webhook-validation.js';
+export * from './relations.js';
+export * from './site-settings.repository.js';
+export * from './demo-data.repository.js';
+export * from './seed-layout.js';
+export * from './seed-layout.repository.js';
+export * from './layout-permissions.js';
+export * from './seed.repository.js';
+export * from './seed-validation.js';
+export * from './seed-ddl.js';
+export * from './schema-mutator.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,cAAc,YAAY,CAAA;AAC1B,cAAc,kBAAkB,CAAA;AAChC,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,yBAAyB,CAAA;AACvC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,uBAAuB,CAAA;AACrC,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,yBAAyB,CAAA;AACvC,cAAc,yBAAyB,CAAA;AACvC,cAAc,2BAA2B,CAAA;AACzC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,2CAA2C,CAAA;AACzD,cAAc,8BAA8B,CAAA;AAC5C,cAAc,oCAAoC,CAAA;AAClD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,yCAAyC,CAAA;AACvD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,yCAAyC,CAAA;AACvD,cAAc,+BAA+B,CAAA;AAC7C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,8BAA8B,CAAA;AAC5C,cAAc,YAAY,CAAA;AAC1B,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,wBAAwB,CAAA;AACtC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,mCAAmC,CAAA;AACjD,cAAc,uCAAuC,CAAA;AACrD,cAAc,8BAA8B,CAAA;AAC5C,cAAc,0BAA0B,CAAA;AACxC,cAAc,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH,cAAc,YAAY,CAAA;AAC1B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,yBAAyB,CAAA;AACvC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,uBAAuB,CAAA;AACrC,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,yBAAyB,CAAA;AACvC,cAAc,yBAAyB,CAAA;AACvC,cAAc,2BAA2B,CAAA;AACzC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,2CAA2C,CAAA;AACzD,cAAc,8BAA8B,CAAA;AAC5C,cAAc,oCAAoC,CAAA;AAClD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,yCAAyC,CAAA;AACvD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,yCAAyC,CAAA;AACvD,cAAc,+BAA+B,CAAA;AAC7C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,8BAA8B,CAAA;AAC5C,cAAc,YAAY,CAAA;AAC1B,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,wBAAwB,CAAA;AACtC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,mCAAmC,CAAA;AACjD,cAAc,uCAAuC,CAAA;AACrD,cAAc,0BAA0B,CAAA;AACxC,cAAc,qBAAqB,CAAA;AACnC,cAAc,yBAAyB,CAAA;AACvC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,+BAA+B,CAAA;AAC7C,cAAc,2BAA2B,CAAA;AACzC,cAAc,kBAAkB,CAAA;AAChC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,yBAAyB,CAAA;AACvC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,eAAe,CAAA;AAC7B,cAAc,qBAAqB,CAAA"}

package/dist/index.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
 /**
  * @beechcms/core - Botanical Engine
  *
@@ -8,6 +10,7 @@
  * @module @beechcms/core
  */
 export * from './types.js';
+export * from './file-types.js';
 export * from './define-seed.js';
 export * from './seeds.js';
 export * from './engine.js';
@@ -41,6 +44,16 @@ export * from './automations.types.js';
 export * from './automations-grammar-words.js';
 export * from './automations.runner.interface.js';
 export * from './automations.repository.interface.js';
-export * from './automations.runner.stub.js';
 export * from './scheduler.interface.js';
 export * from './scheduler.stub.js';
+export * from './webhook-validation.js';
+export * from './relations.js';
+export * from './site-settings.repository.js';
+export * from './demo-data.repository.js';
+export * from './seed-layout.js';
+export * from './seed-layout.repository.js';
+export * from './layout-permissions.js';
+export * from './seed.repository.js';
+export * from './seed-validation.js';
+export * from './seed-ddl.js';
+export * from './schema-mutator.js';

package/dist/layout-permissions.d.ts

@@ -0,0 +1,3 @@
+export declare const ROLES_ALLOWED_TO_EDIT_LAYOUT: ReadonlyArray<string>;
+export declare function canEditLayout(role: string | undefined | null): boolean;
+//# sourceMappingURL=layout-permissions.d.ts.map

package/dist/layout-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"layout-permissions.d.ts","sourceRoot":"","sources":["../src/layout-permissions.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,4BAA4B,EAAE,aAAa,CAAC,MAAM,CAAa,CAAA;AAE5E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAGtE"}

package/dist/layout-permissions.js

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+// NOTE: change this list to extend write-access to other roles
+// (e.g. add 'editor', or introduce a fine-grained 'layout:edit' permission).
+// Single source of truth — used by both API guards and dashboard buttons.
+export const ROLES_ALLOWED_TO_EDIT_LAYOUT = ['admin'];
+export function canEditLayout(role) {
+    if (!role)
+        return false;
+    return ROLES_ALLOWED_TO_EDIT_LAYOUT.includes(role);
+}

package/dist/media.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"media.repository.d.ts","sourceRoot":"","sources":["../src/media.repository.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnE;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAEnD;;OAEG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpC;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEnG;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzC;;OAEG;IACH,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACpC"}
+{"version":3,"file":"media.repository.d.ts","sourceRoot":"","sources":["../src/media.repository.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnE;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAEnD;;OAEG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpC;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEnG;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzC;;OAEG;IACH,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACpC"}

package/dist/media.repository.js

@@ -1 +1,3 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
 export {};

package/dist/notifications/notification-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notification-service.d.ts","sourceRoot":"","sources":["../../src/notifications/notification-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAEpE,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,gBAAgB,CAAA;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CAC7D"}
+{"version":3,"file":"notification-service.d.ts","sourceRoot":"","sources":["../../src/notifications/notification-service.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAEpE,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,gBAAgB,CAAA;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CAC7D"}

package/dist/notifications/notification-service.js

@@ -1 +1,3 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
 export {};

package/dist/notifications/notification.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notification.repository.d.ts","sourceRoot":"","sources":["../../src/notifications/notification.repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAA;AAEvE,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,gBAAgB,CAAA;IACtB,MAAM,EAAE,OAAO,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAA;IAElD;;;;;;OAMG;IACH,KAAK,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAEnC;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,GAAG,WAAW,GAAG,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAExF,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjD,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5B,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9C"}
+{"version":3,"file":"notification.repository.d.ts","sourceRoot":"","sources":["../../src/notifications/notification.repository.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAA;AAEvE,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,gBAAgB,CAAA;IACtB,MAAM,EAAE,OAAO,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAA;IAElD;;;;;;OAMG;IACH,KAAK,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAEnC;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,GAAG,WAAW,GAAG,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAExF,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjD,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5B,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9C"}