@beechcms/core 0.6.3 → 0.6.5

package/dist/engine/policies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policies.d.ts","sourceRoot":"","sources":["../../src/engine/policies.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAExC,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAK9D;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEzF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAgBzF"}
+{"version":3,"file":"policies.d.ts","sourceRoot":"","sources":["../../src/engine/policies.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEhF;;;;;GAKG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAK9D;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEzF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,0CAA0C;IAC1C,cAAc,EAAE,kBAAkB,CAAA;IAClC,6FAA6F;IAC7F,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;IACrC,6FAA6F;IAC7F,gBAAgB,EAAE,MAAM,GAAG,QAAQ,CAAA;IACnC,oFAAoF;IACpF,cAAc,EAAE,MAAM,GAAG,QAAQ,CAAA;CAClC;AAED,0EAA0E;AAC1E,wBAAgB,uBAAuB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,kBAAkB,CAQxE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,sBAAsB,CAmC5E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAqBzF;AAID;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,EAAE,IAAI,EACV,KAAK,GAAE,YAAwC,GAC9C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgDzB"}

package/dist/engine/policies.js

@@ -1,33 +1,163 @@
 // SPDX-License-Identifier: MIT
 // Copyright (c) 2024–2026 Flavio De Musso
+/**
+ * Computes an un-salted SHA-256 hex digest of a string value.
+ * Used for basic digest operations.
+ * @param value - The raw string value to hash.
+ * @returns A Promise resolving to a 64-character hex string.
+ */
 export async function sha256hex(value) {
     const buf = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value));
     return Array.from(new Uint8Array(buf))
         .map((b) => b.toString(16).padStart(2, '0'))
         .join('');
 }
+/**
+ * Verifies if a candidate string matches a stored SHA-256 hash digest.
+ * @param stored - The expected 64-character SHA-256 hex digest.
+ * @param candidate - The raw candidate string to verify.
+ * @returns A Promise resolving to true if candidate matches stored digest, false otherwise.
+ */
 export async function verifyHashField(stored, candidate) {
     return stored === (await sha256hex(candidate));
 }
+/** Normalizes raw policy strings to canonical DataClassification enum. */
+export function normalizeClassification(raw) {
+    if (!raw)
+        return 'public';
+    const lower = raw.toLowerCase();
+    if (lower === 'confidential')
+        return 'confidential';
+    if (lower === 'restricted' || lower === 'hash')
+        return 'restricted';
+    if (lower === 'encrypt')
+        return 'confidential';
+    if (lower === 'internal')
+        return 'internal';
+    return 'public';
+}
 /**
- * Risolve le policy di un branch applicando i valori di default.
- * Tutta la logica di accesso ai campi deve passare per questa funzione,
- * mai con inline `branch.policies?.x ?? default`.
+ * Resolves the 4-tier DataClassification for a branch, bundling its storage
+ * strategy at rest and its API visibility rules (public vs auth context).
+ * @param branch - The seed branch definition to inspect.
+ * @returns The resolved classification details and visibility rules.
+ */
+export function resolveClassification(branch) {
+    const rawClassification = branch.policies?.classification ?? branch.policies?.privacy;
+    const classification = normalizeClassification(rawClassification);
+    switch (classification) {
+        case 'confidential':
+            return {
+                classification: 'confidential',
+                storage: 'encrypt',
+                publicVisibility: 'hidden',
+                authVisibility: 'full',
+            };
+        case 'restricted':
+            return {
+                classification: 'restricted',
+                storage: 'hash',
+                publicVisibility: 'hidden',
+                authVisibility: 'hidden',
+            };
+        case 'internal':
+            return {
+                classification: 'internal',
+                storage: 'plain',
+                publicVisibility: 'hidden',
+                authVisibility: 'full',
+            };
+        case 'public':
+        default:
+            return {
+                classification: 'public',
+                storage: 'plain',
+                publicVisibility: 'full',
+                authVisibility: 'full',
+            };
+    }
+}
+/**
+ * Resolves branch policies applying all defaults and classification rules.
+ * @param branch - The seed branch definition to inspect.
+ * @returns Complete required policies object for the branch.
  */
 export function resolvePolicies(branch) {
-    const privacy = branch.policies?.privacy ?? 'plain';
-    // Non-plain privacy implies hidden by default: the CMS hashes/encrypts on write,
-    // so returning the stored value would leak the digest to readers.
-    const defaultVisibility = privacy !== 'plain' ? 'hidden' : 'full';
-    // Repeaters live in a single JSON column — never filterable, sortable, or
-    // searchable/facetable in v1, regardless of what's set on the branch.
+    const resolved = resolveClassification(branch);
     const isRepeater = branch.type === 'repeater';
+    const isEncryptedOrHashed = resolved.storage !== 'plain';
+    const defaultVisibility = resolved.authVisibility;
+    const isPublicAllowed = branch.policies?.public ?? (resolved.publicVisibility === 'full');
+    const defaultFilter = isRepeater || resolved.storage === 'hash' ? false : branch.policies?.filter ?? true;
+    const defaultSort = isRepeater || isEncryptedOrHashed ? false : branch.policies?.sort ?? true;
+    const defaultSearch = isRepeater || isEncryptedOrHashed ? false : branch.policies?.search ?? true;
     return {
-        privacy,
+        classification: resolved.classification,
+        privacy: resolved.storage,
         visibility: branch.policies?.visibility ?? defaultVisibility,
-        search: isRepeater ? false : branch.policies?.search ?? true,
-        filter: isRepeater ? false : branch.policies?.filter ?? true,
-        sort: isRepeater ? false : branch.policies?.sort ?? true,
-        public: branch.policies?.public ?? true,
+        search: defaultSearch,
+        filter: defaultFilter,
+        sort: defaultSort,
+        public: isPublicAllowed,
     };
 }
+const SYSTEM_FIELDS = new Set(['id', 'slug', 'status', 'created_at', 'updated_at', 'version', 'has_pending_draft']);
+/**
+ * Filters entry payload fields based on the caller's {@link ActorContext} and branch classification tier.
+ *
+ * Rules:
+ * - Public actor: receives `public` fields; `internal`, `confidential`, and `restricted` fields are omitted.
+ * - Authenticated actor: receives `public`, `internal`, and `confidential` fields; `restricted` fields are ALWAYS omitted.
+ * - System actor: receives all fields including `restricted` (used for internal worker/automation orchestration).
+ *
+ * @param data - Raw record fields object.
+ * @param seed - Content type seed definition containing branch definitions.
+ * @param actor - Context of the caller requesting the entry payload (defaults to authenticated).
+ * @returns Filtered data record containing only authorized fields for the given actor context.
+ */
+export function filterEntryForActor(data, seed, actor = { type: 'authenticated' }) {
+    const result = {};
+    for (const [key, value] of Object.entries(data)) {
+        if (SYSTEM_FIELDS.has(key)) {
+            result[key] = value;
+            continue;
+        }
+        const branch = seed.branches.find((b) => b.alias === key);
+        if (!branch) {
+            // Pass through unknown/extra fields unless actor is public
+            if (actor.type !== 'public') {
+                result[key] = value;
+            }
+            continue;
+        }
+        const resolved = resolveClassification(branch);
+        const isPublicActor = actor.type === 'public';
+        const isSystemActor = actor.type === 'system';
+        // System actor sees all fields including restricted
+        if (isSystemActor) {
+            result[key] = value;
+            continue;
+        }
+        // Public actor check
+        if (isPublicActor) {
+            if (resolved.publicVisibility === 'hidden')
+                continue;
+        }
+        else {
+            // Authenticated actor check
+            if (resolved.authVisibility === 'hidden')
+                continue;
+        }
+        // Explicit visibility override check
+        if (branch.policies?.visibility === 'hidden')
+            continue;
+        // Masking rule check
+        if (branch.policies?.visibility === 'masked') {
+            result[key] = typeof value === 'string' && value.length > 0 ? '••••••••' : null;
+        }
+        else {
+            result[key] = value;
+        }
+    }
+    return result;
+}

package/dist/engine/privacy.service.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Contract for the Application-Level Encryption (ALE) and hashing privacy service.
+ * Used by the Botanical Engine to secure fields classified as `confidential` or `restricted`.
+ */
+export interface IPrivacyService {
+    /**
+     * Symmetrically encrypts a plaintext string using AES-256-GCM.
+     * @param plaintext - The raw string value to encrypt.
+     * @returns A Promise resolving to formatted ciphertext (`v1:<iv_base64>:<ciphertext_base64>`).
+     */
+    encrypt(plaintext: string): Promise<string>;
+    /**
+     * Decrypts a formatted AES-256-GCM ciphertext payload.
+     * @param ciphertext - The formatted ciphertext string (`v1:<iv_base64>:<ciphertext_base64>`).
+     * @returns A Promise resolving to the original plaintext string.
+     * @throws Error if the ciphertext format is invalid or decryption fails (authentication tag mismatch).
+     */
+    decrypt(ciphertext: string): Promise<string>;
+    /**
+     * Computes a deterministic HMAC SHA-256 digest of a plaintext string.
+     * Used for blind-indexing and one-way field digests (`restricted` classification).
+     * @param plaintext - The raw string value to hash.
+     * @returns A Promise resolving to a 64-character hexadecimal digest string.
+     */
+    hash(plaintext: string): Promise<string>;
+}
+/**
+ * Concrete Edge-native implementation of {@link IPrivacyService}.
+ * Employs Web Crypto API (`crypto.subtle`) for zero-dependency execution in Cloudflare Workers.
+ */
+export declare class PrivacyService implements IPrivacyService {
+    private readonly masterKey;
+    private aesKeyPromise?;
+    private hmacKeyPromise?;
+    /**
+     * Initializes the PrivacyService with a Master Encryption Key.
+     * @param masterKey - Secret key used to derive cryptographic keys for AES-GCM and HMAC.
+     * @throws Error if `masterKey` is empty or undefined.
+     */
+    constructor(masterKey: string);
+    /**
+     * Lazy-loads and caches the derived AES-256-GCM {@link CryptoKey}.
+     * Derives a 256-bit key from `masterKey` via SHA-256 digest.
+     */
+    private getAesKey;
+    /**
+     * Lazy-loads and caches the derived HMAC SHA-256 {@link CryptoKey}.
+     */
+    private getHmacKey;
+    /**
+     * Encrypts a plaintext string with AES-256-GCM and a fresh 96-bit (12-byte) IV.
+     * Output is formatted as `v1:<iv_base64>:<ciphertext_base64>`.
+     */
+    encrypt(plaintext: string): Promise<string>;
+    /**
+     * Decrypts a `v1:<iv_base64>:<ciphertext_base64>` string back to its plaintext value.
+     * If the input string is not prefixed with `v1:`, returns the raw string as unencrypted legacy data.
+     */
+    decrypt(ciphertext: string): Promise<string>;
+    /**
+     * Computes a deterministic HMAC SHA-256 hex digest for blind index generation.
+     */
+    hash(plaintext: string): Promise<string>;
+}
+//# sourceMappingURL=privacy.service.d.ts.map

package/dist/engine/privacy.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy.service.d.ts","sourceRoot":"","sources":["../../src/engine/privacy.service.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAE3C;;;;;OAKG;IACH,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAE5C;;;;;OAKG;IACH,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACzC;AA4BD;;;GAGG;AACH,qBAAa,cAAe,YAAW,eAAe;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,aAAa,CAAC,CAAoB;IAC1C,OAAO,CAAC,cAAc,CAAC,CAAoB;IAE3C;;;;OAIG;IACH,YAAY,SAAS,EAAE,MAAM,EAK5B;IAED;;;OAGG;YACW,SAAS;IAmBvB;;OAEG;YACW,UAAU;IAexB;;;OAGG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAYhD;IAED;;;OAGG;IACG,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBjD;IAED;;OAEG;IACG,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY7C;CACF"}

package/dist/engine/privacy.service.js

@@ -0,0 +1,114 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+/**
+ * Converts a Uint8Array byte sequence to a Base64-encoded string.
+ * Native Edge-compatible implementation without Node.js Buffer dependencies.
+ */
+function bytesToBase64(bytes) {
+    let binary = '';
+    const len = bytes.byteLength;
+    for (let i = 0; i < len; i++) {
+        binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary);
+}
+/**
+ * Converts a Base64-encoded string back to a Uint8Array byte sequence.
+ * Native Edge-compatible implementation without Node.js Buffer dependencies.
+ */
+function base64ToBytes(base64) {
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+/**
+ * Concrete Edge-native implementation of {@link IPrivacyService}.
+ * Employs Web Crypto API (`crypto.subtle`) for zero-dependency execution in Cloudflare Workers.
+ */
+export class PrivacyService {
+    masterKey;
+    aesKeyPromise;
+    hmacKeyPromise;
+    /**
+     * Initializes the PrivacyService with a Master Encryption Key.
+     * @param masterKey - Secret key used to derive cryptographic keys for AES-GCM and HMAC.
+     * @throws Error if `masterKey` is empty or undefined.
+     */
+    constructor(masterKey) {
+        if (!masterKey) {
+            throw new Error('PrivacyService requires a non-empty masterKey');
+        }
+        this.masterKey = masterKey;
+    }
+    /**
+     * Lazy-loads and caches the derived AES-256-GCM {@link CryptoKey}.
+     * Derives a 256-bit key from `masterKey` via SHA-256 digest.
+     */
+    async getAesKey() {
+        if (!this.aesKeyPromise) {
+            this.aesKeyPromise = (async () => {
+                const keyData = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(this.masterKey));
+                return crypto.subtle.importKey('raw', keyData, { name: 'AES-GCM' }, false, ['encrypt', 'decrypt']);
+            })();
+        }
+        return this.aesKeyPromise;
+    }
+    /**
+     * Lazy-loads and caches the derived HMAC SHA-256 {@link CryptoKey}.
+     */
+    async getHmacKey() {
+        if (!this.hmacKeyPromise) {
+            this.hmacKeyPromise = (async () => {
+                return crypto.subtle.importKey('raw', new TextEncoder().encode(this.masterKey), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+            })();
+        }
+        return this.hmacKeyPromise;
+    }
+    /**
+     * Encrypts a plaintext string with AES-256-GCM and a fresh 96-bit (12-byte) IV.
+     * Output is formatted as `v1:<iv_base64>:<ciphertext_base64>`.
+     */
+    async encrypt(plaintext) {
+        const key = await this.getAesKey();
+        const iv = crypto.getRandomValues(new Uint8Array(12));
+        const encodedText = new TextEncoder().encode(plaintext);
+        const encryptedBuffer = await crypto.subtle.encrypt({ name: 'AES-GCM', iv: iv }, key, encodedText);
+        const ivBase64 = bytesToBase64(iv);
+        const ciphertextBase64 = bytesToBase64(new Uint8Array(encryptedBuffer));
+        return `v1:${ivBase64}:${ciphertextBase64}`;
+    }
+    /**
+     * Decrypts a `v1:<iv_base64>:<ciphertext_base64>` string back to its plaintext value.
+     * If the input string is not prefixed with `v1:`, returns the raw string as unencrypted legacy data.
+     */
+    async decrypt(ciphertext) {
+        if (!ciphertext || !ciphertext.startsWith('v1:')) {
+            return ciphertext;
+        }
+        const parts = ciphertext.split(':');
+        if (parts.length !== 3) {
+            throw new Error('Invalid ciphertext format');
+        }
+        const [, ivBase64, cipherBase64] = parts;
+        const iv = base64ToBytes(ivBase64);
+        const cipherBytes = base64ToBytes(cipherBase64);
+        const key = await this.getAesKey();
+        const decryptedBuffer = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: iv }, key, cipherBytes);
+        return new TextDecoder().decode(decryptedBuffer);
+    }
+    /**
+     * Computes a deterministic HMAC SHA-256 hex digest for blind index generation.
+     */
+    async hash(plaintext) {
+        const key = await this.getHmacKey();
+        const encodedText = new TextEncoder().encode(plaintext);
+        const signatureBuffer = await crypto.subtle.sign('HMAC', key, encodedText);
+        const hashBytes = new Uint8Array(signatureBuffer);
+        return Array.from(hashBytes)
+            .map((b) => b.toString(16).padStart(2, '0'))
+            .join('');
+    }
+}

package/dist/engine/query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../src/engine/query.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,IAAI,EAMJ,aAAa,EACb,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAIpB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,GAAE,aAAkB,GAAG,kBAAkB,CAoF5F"}
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../src/engine/query.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,IAAI,EAMJ,aAAa,EACb,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAKpB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,GAAE,aAAkB,GAAG,kBAAkB,CAoG5F"}

package/dist/engine/query.js

@@ -1,4 +1,5 @@
 import { tableName, ftsTableName, isValidColumn, indexableSearchBranches, SYSTEM_COLUMNS } from './ddl.js';
+import { resolveClassification } from './policies.js';
 /**
  * Builds a parameterized SQL SELECT query and bindings for a given Seed based on search, filtering, status, and ordering options.
  *
@@ -47,14 +48,32 @@ export function buildSelectQuery(seed, options = {}) {
     for (const group of filters) {
         if (!isValidColumn(seed, group.column))
             continue;
+        const branch = seed.branches.find(b => b.alias === group.column);
+        const isEncrypted = branch ? resolveClassification(branch).storage === 'encrypt' : false;
         const col = SYSTEM_COLUMNS.has(group.column)
             ? `${table}.${group.column}`
             : group.column;
         const condClauses = [];
         for (const cond of group.conditions) {
-            const clause = buildFilterCondition(col, group.type, cond, bindings);
-            if (clause)
-                condClauses.push(clause);
+            if (isEncrypted) {
+                const { op } = cond;
+                if (op === 'eq' || op === 'neq' || op === 'in' || op === 'not_in') {
+                    const targetCol = `${table}.${group.column}_bidx`;
+                    const clause = buildFilterCondition(targetCol, group.type, cond, bindings);
+                    if (clause)
+                        condClauses.push(clause);
+                }
+                else if (op === 'is_empty' || op === 'is_not_empty') {
+                    const clause = buildFilterCondition(col, group.type, cond, bindings);
+                    if (clause)
+                        condClauses.push(clause);
+                }
+            }
+            else {
+                const clause = buildFilterCondition(col, group.type, cond, bindings);
+                if (clause)
+                    condClauses.push(clause);
+            }
         }
         if (condClauses.length > 0) {
             groupClauses.push(condClauses.length > 1 ? `(${condClauses.join(' AND ')})` : condClauses[0]);

package/dist/engine/seed-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seed-registry.d.ts","sourceRoot":"","sources":["../../src/engine/seed-registry.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAG9C,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,GAAG,IAAI,IAAI,EAAE,CAAA;IAEb;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAE9B;;;;;OAKG;IACH,kBAAkB,IAAI,IAAI,EAAE,CAAA;IAE5B;;;OAGG;IACH,cAAc,IAAI,IAAI,EAAE,CAAA;IAExB;;;OAGG;IACH,YAAY,IAAI,IAAI,EAAE,CAAA;CACvB;AAID,qBAAa,YAAa,YAAW,aAAa;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IAErC,YAAY,KAAK,EAAE,IAAI,EAAE,EA0BxB;IAED,GAAG,IAAI,IAAI,EAAE,CAEZ;IAED,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAE7B;IAED,kBAAkB,IAAI,IAAI,EAAE,CAE3B;IAED,cAAc,IAAI,IAAI,EAAE,CAEvB;IAED,YAAY,IAAI,IAAI,EAAE,CAErB;CACF;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,YAAY;CAAG;AAEzD,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEpE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,MAAM,CAQjE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAsE1E"}
+{"version":3,"file":"seed-registry.d.ts","sourceRoot":"","sources":["../../src/engine/seed-registry.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAI9C,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,GAAG,IAAI,IAAI,EAAE,CAAA;IAEb;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAE9B;;;;;OAKG;IACH,kBAAkB,IAAI,IAAI,EAAE,CAAA;IAE5B;;;OAGG;IACH,cAAc,IAAI,IAAI,EAAE,CAAA;IAExB;;;OAGG;IACH,YAAY,IAAI,IAAI,EAAE,CAAA;CACvB;AAID,qBAAa,YAAa,YAAW,aAAa;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IAErC,YAAY,KAAK,EAAE,IAAI,EAAE,EAgCxB;IAED,GAAG,IAAI,IAAI,EAAE,CAEZ;IAED,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAE7B;IAED,kBAAkB,IAAI,IAAI,EAAE,CAE3B;IAED,cAAc,IAAI,IAAI,EAAE,CAEvB;IAED,YAAY,IAAI,IAAI,EAAE,CAErB;CACF;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,YAAY;CAAG;AAEzD,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEpE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,MAAM,CAQjE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAsE1E"}

package/dist/engine/seed-registry.js

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: MIT
 // Copyright (c) 2024–2026 Flavio De Musso
 import { AUTOMATION_RESERVED_WORDS } from '../automations/automations-grammar-words.js';
+import { SQL_RESERVED_WORDS } from './sql-reserved-words.js';
 const BRANCH_ID_RE = /^br_[A-Za-z0-9]+$/;
 export class SeedRegistry {
     seedMap;
@@ -13,6 +14,10 @@ export class SeedRegistry {
                     throw new Error(`Seed "${seed.slug}" uses reserved alias "${branch.alias}". `
                         + `Pick a different alias — this word is used by the automation template grammar.`);
                 }
+                if (SQL_RESERVED_WORDS.has(branch.alias.toLowerCase())) {
+                    throw new Error(`Seed "${seed.slug}" uses SQL reserved keyword "${branch.alias}". `
+                        + `Please pick a different alias to prevent database errors.`);
+                }
                 if (!branch.id || !BRANCH_ID_RE.test(branch.id)) {
                     throw new Error(`Seed "${seed.slug}" branch "${branch.alias}" has invalid id "${branch.id}". `
                         + `Expected format ^br_[A-Za-z0-9]+$.`);

package/dist/engine/seed-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seed-validation.d.ts","sourceRoot":"","sources":["../../src/engine/seed-validation.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAMtC;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,QAAyB,CAAA;AAErD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,KAAK,EAAE,OAAO,CAAA;CACf;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,mBAAmB,EAAE,CAwO5E;AAED,6CAA6C;AAC7C,wBAAgB,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAErD"}
+{"version":3,"file":"seed-validation.d.ts","sourceRoot":"","sources":["../../src/engine/seed-validation.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAOtC;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,QAAyB,CAAA;AAErD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,KAAK,EAAE,OAAO,CAAA;CACf;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,mBAAmB,EAAE,CA8P5E;AAED,6CAA6C;AAC7C,wBAAgB,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAErD"}

package/dist/engine/seed-validation.js

@@ -2,6 +2,7 @@
 // Copyright (c) 2024–2026 Flavio De Musso
 import { AUTOMATION_RESERVED_WORDS } from '../automations/automations-grammar-words.js';
 import { sortSeedsByDependencies } from './seed-registry.js';
+import { SQL_RESERVED_WORDS } from './sql-reserved-words.js';
 const BRANCH_ID_RE = /^br_[A-Za-z0-9]+$/;
 /**
  * Allowed charset for a branch alias. An alias becomes a raw SQL column name in
@@ -73,7 +74,16 @@ export function validateSeedDefinitions(seeds) {
         }
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
-            result.push({ slug: '<graph>', messages: [msg], fatal: true });
+            const cycleMatch = msg.match(/Cyclic dependency detected among seeds: (.*)/);
+            if (cycleMatch) {
+                const cycleSlugs = cycleMatch[1].split(', ');
+                for (const slug of cycleSlugs) {
+                    result.push({ slug, messages: [msg], fatal: true });
+                }
+            }
+            else {
+                result.push({ slug: '<graph>', messages: [msg], fatal: true });
+            }
         }
     }
     // ── Fatal 5: branch id format / uniqueness ───────────────────────────────
@@ -107,6 +117,10 @@ export function validateSeedDefinitions(seeds) {
                 messages.push(`branch '${branch.alias}' uses reserved alias. ` +
                     `This word is used by the automation template grammar.`);
             }
+            else if (SQL_RESERVED_WORDS.has(branch.alias.toLowerCase())) {
+                messages.push(`branch '${branch.alias}' uses SQL reserved keyword. ` +
+                    `Please pick a different alias to prevent database errors.`);
+            }
         }
         if (messages.length > 0)
             result.push({ slug: seed.slug, messages, fatal: true });
@@ -228,6 +242,16 @@ export function validateSeedDefinitions(seeds) {
                 fatal: true,
             });
         }
+        else if (SQL_RESERVED_WORDS.has(seed.displayNameAlias.toLowerCase())) {
+            result.push({
+                slug: seed.slug,
+                messages: [
+                    `displayNameAlias '${seed.displayNameAlias}' uses SQL reserved keyword. ` +
+                        `Please pick a different alias to prevent database errors.`,
+                ],
+                fatal: true,
+            });
+        }
     }
     return result;
 }

package/dist/engine/sql-reserved-words.d.ts

@@ -0,0 +1,2 @@
+export declare const SQL_RESERVED_WORDS: Set<string>;
+//# sourceMappingURL=sql-reserved-words.d.ts.map

package/dist/engine/sql-reserved-words.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-reserved-words.d.ts","sourceRoot":"","sources":["../../src/engine/sql-reserved-words.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,kBAAkB,aAkB7B,CAAA"}

package/dist/engine/sql-reserved-words.js

@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+export const SQL_RESERVED_WORDS = new Set([
+    'abort', 'action', 'add', 'after', 'all', 'alter', 'always', 'analyze', 'and', 'anti',
+    'any', 'as', 'asc', 'attach', 'autoincrement', 'before', 'begin', 'between', 'by', 'cascade',
+    'case', 'cast', 'check', 'collate', 'column', 'commit', 'conflict', 'constraint', 'create',
+    'cross', 'current', 'current_date', 'current_time', 'current_timestamp', 'database', 'default',
+    'deferrable', 'deferred', 'delete', 'desc', 'detach', 'distinct', 'do', 'drop', 'each',
+    'else', 'end', 'escape', 'except', 'exclude', 'exclusive', 'exists', 'explain', 'fail',
+    'filter', 'first', 'following', 'for', 'foreign', 'from', 'full', 'generated', 'glob',
+    'group', 'groups', 'having', 'if', 'ignore', 'immediate', 'in', 'index', 'indexed',
+    'initially', 'inner', 'insert', 'instead', 'intersect', 'into', 'is', 'isnull', 'join',
+    'key', 'last', 'left', 'like', 'limit', 'match', 'materialized', 'natural', 'no', 'not',
+    'nothing', 'notnull', 'null', 'nulls', 'of', 'offset', 'on', 'or', 'order', 'others',
+    'outer', 'over', 'partition', 'plan', 'pragma', 'preceding', 'primary', 'query', 'raise',
+    'range', 'recursive', 'references', 'regexp', 'reindex', 'release', 'rename', 'replace',
+    'restrict', 'returning', 'right', 'rollback', 'row', 'rows', 'savepoint', 'select', 'set',
+    'table', 'temp', 'temporary', 'then', 'ties', 'to', 'transaction', 'trigger', 'unbounded',
+    'union', 'unique', 'update', 'using', 'vacuum', 'values', 'view', 'virtual', 'when', 'where',
+    'window', 'with', 'without'
+]);

package/dist/engine/types.d.ts

@@ -49,6 +49,14 @@ export interface FileFieldOptions {
      */
     maxSize?: number;
 }
+/** 4-tier Data Classification matrix (Public, Internal, Confidential, Restricted). */
+export type DataClassification = 'public' | 'internal' | 'confidential' | 'restricted';
+/** Context representing the caller/actor executing an operation or reading API data. */
+export interface ActorContext {
+    type: 'public' | 'authenticated' | 'system';
+    userId?: string;
+    role?: string;
+}
 /** Branch: definition of a single field. `alias` is the SQL column name. */
 export interface Branch {
     /**
@@ -94,8 +102,10 @@ export interface Branch {
      * All values are optional — `resolvePolicies(branch)` supplies the defaults.
      */
     policies?: {
+        /** 4-tier data classification level. Default: 'public'. */
+        classification?: DataClassification | 'Public' | 'Internal' | 'Confidential' | 'Restricted';
         /** How the value is stored. Default: 'plain'. */
-        privacy?: 'plain' | 'hash' | 'encrypt';
+        privacy?: 'plain' | 'hash' | 'encrypt' | DataClassification | 'Public' | 'Internal' | 'Confidential' | 'Restricted';
         /** How the value is returned in API responses. Default: 'full'. */
         visibility?: 'full' | 'masked' | 'hidden';
         /** Whether the field is included in full-text search queries. Default: true. */

package/dist/engine/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/engine/types.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAA;AAE9E,oDAAoD;AACpD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CAAA;AAEjI,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IAEjC,gDAAgD;IAChD,MAAM,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,CAAA;IAC1D,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAA;IAGlB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAA;IAGnD,6BAA6B;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,6BAA6B;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,6DAA6D;AAC7D,MAAM,WAAW,gBAAgB;IAC/B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,4EAA4E;AAC5E,MAAM,WAAW,MAAM;IACrB;;;;;;;;OAQG;IACH,EAAE,EAAE,MAAM,CAAA;IACV,uGAAuG;IACvG,KAAK,EAAE,MAAM,CAAA;IACb,wBAAwB;IACxB,KAAK,EAAE,MAAM,CAAA;IACb,2GAA2G;IAC3G,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kBAAkB;IAClB,IAAI,EAAE,UAAU,CAAA;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,YAAY,CAAA;IAC3E;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,0BAA0B;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE;QACT,iDAAiD;QACjD,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAA;QACtC,mEAAmE;QACnE,UAAU,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAA;QACzC,gFAAgF;QAChF,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,yFAAyF;QACzF,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,uFAAuF;QACvF,IAAI,CAAC,EAAE,OAAO,CAAA;QACd,4EAA4E;QAC5E,MAAM,CAAC,EAAE,OAAO,CAAA;KACjB,CAAA;IACD,wEAAwE;IACxE,aAAa,CAAC,EAAE,kBAAkB,CAAA;IAClC,oEAAoE;IACpE,WAAW,CAAC,EAAE,gBAAgB,CAAA;IAE9B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,CAAA;IAE9C;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IAEjB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,6GAA6G;AAC7G,MAAM,WAAW,mBAAmB;IAClC,uFAAuF;IACvF,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oDAAoD;IACpD,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,gEAAgE;IAChE,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,UAAU,CAAC,EAAE,OAAO,CAAA;KACrB,CAAA;IACD;;;;OAIG;IACH,KAAK,CAAC,EAAE,aAAa,EAAE,CAAA;CACxB;AAED,iDAAiD;AACjD,MAAM,WAAW,IAAI;IACnB,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAA;IACZ,yBAAyB;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,qFAAqF;IACrF,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,6FAA6F;IAC7F,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,8FAA8F;IAC9F,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAA;IACxB,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,mBAAmB,CAAA;IAC/B;;wGAEoG;IACpG,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAID,kEAAkE;AAClE,MAAM,MAAM,cAAc,GACtB,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,GACL,UAAU,GACV,cAAc,GACd,aAAa,GACb,WAAW,GACX,UAAU,GACV,cAAc,GACd,IAAI,GACJ,QAAQ,GACR,SAAS,GACT,aAAa,GACb,cAAc,CAAA;AAElB,uGAAuG;AACvG,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAA;AAEvG,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,yBAAyB;IACzB,EAAE,EAAE,cAAc,CAAA;IAClB,sGAAsG;IACtG,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,CAAA;CAC9D;AAED,MAAM,WAAW,WAAW;IAC1B,yFAAyF;IACzF,MAAM,EAAE,MAAM,CAAA;IACd,uEAAuE;IACvE,IAAI,EAAE,UAAU,CAAA;IAChB,yDAAyD;IACzD,UAAU,EAAE,eAAe,EAAE,CAAA;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,wGAAwG;IACxG,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;IACvB,sEAAsE;IACtE,WAAW,CAAC,EAAE,KAAK,GAAG,IAAI,CAAA;IAC1B,oEAAoE;IACpE,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,CAAA;IACjD,+BAA+B;IAC/B,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IAC9C,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB;kFAC8E;IAC9E,WAAW,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;IACxD;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IACjC,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAA;IACX,sDAAsD;IACtD,QAAQ,EAAE,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,EAAE,CAAA;CAC/C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/engine/types.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAA;AAE9E,oDAAoD;AACpD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CAAA;AAEjI,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IAEjC,gDAAgD;IAChD,MAAM,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,CAAA;IAC1D,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAA;IAGlB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAA;IAGnD,6BAA6B;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,6BAA6B;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,6DAA6D;AAC7D,MAAM,WAAW,gBAAgB;IAC/B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,sFAAsF;AACtF,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,UAAU,GAAG,cAAc,GAAG,YAAY,CAAA;AAEtF,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,QAAQ,GAAG,eAAe,GAAG,QAAQ,CAAA;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,4EAA4E;AAC5E,MAAM,WAAW,MAAM;IACrB;;;;;;;;OAQG;IACH,EAAE,EAAE,MAAM,CAAA;IACV,uGAAuG;IACvG,KAAK,EAAE,MAAM,CAAA;IACb,wBAAwB;IACxB,KAAK,EAAE,MAAM,CAAA;IACb,2GAA2G;IAC3G,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kBAAkB;IAClB,IAAI,EAAE,UAAU,CAAA;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,YAAY,CAAA;IAC3E;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,0BAA0B;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE;QACT,2DAA2D;QAC3D,cAAc,CAAC,EAAE,kBAAkB,GAAG,QAAQ,GAAG,UAAU,GAAG,cAAc,GAAG,YAAY,CAAA;QAC3F,iDAAiD;QACjD,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,kBAAkB,GAAG,QAAQ,GAAG,UAAU,GAAG,cAAc,GAAG,YAAY,CAAA;QACnH,mEAAmE;QACnE,UAAU,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAA;QACzC,gFAAgF;QAChF,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,yFAAyF;QACzF,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,uFAAuF;QACvF,IAAI,CAAC,EAAE,OAAO,CAAA;QACd,4EAA4E;QAC5E,MAAM,CAAC,EAAE,OAAO,CAAA;KACjB,CAAA;IACD,wEAAwE;IACxE,aAAa,CAAC,EAAE,kBAAkB,CAAA;IAClC,oEAAoE;IACpE,WAAW,CAAC,EAAE,gBAAgB,CAAA;IAE9B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,CAAA;IAE9C;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IAEjB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,6GAA6G;AAC7G,MAAM,WAAW,mBAAmB;IAClC,uFAAuF;IACvF,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oDAAoD;IACpD,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,gEAAgE;IAChE,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,UAAU,CAAC,EAAE,OAAO,CAAA;KACrB,CAAA;IACD;;;;OAIG;IACH,KAAK,CAAC,EAAE,aAAa,EAAE,CAAA;CACxB;AAED,iDAAiD;AACjD,MAAM,WAAW,IAAI;IACnB,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAA;IACZ,yBAAyB;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,qFAAqF;IACrF,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,6FAA6F;IAC7F,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,8FAA8F;IAC9F,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAA;IACxB,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,mBAAmB,CAAA;IAC/B;;wGAEoG;IACpG,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAID,kEAAkE;AAClE,MAAM,MAAM,cAAc,GACtB,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,GACL,UAAU,GACV,cAAc,GACd,aAAa,GACb,WAAW,GACX,UAAU,GACV,cAAc,GACd,IAAI,GACJ,QAAQ,GACR,SAAS,GACT,aAAa,GACb,cAAc,CAAA;AAElB,uGAAuG;AACvG,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAA;AAEvG,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,yBAAyB;IACzB,EAAE,EAAE,cAAc,CAAA;IAClB,sGAAsG;IACtG,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,CAAA;CAC9D;AAED,MAAM,WAAW,WAAW;IAC1B,yFAAyF;IACzF,MAAM,EAAE,MAAM,CAAA;IACd,uEAAuE;IACvE,IAAI,EAAE,UAAU,CAAA;IAChB,yDAAyD;IACzD,UAAU,EAAE,eAAe,EAAE,CAAA;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,wGAAwG;IACxG,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;IACvB,sEAAsE;IACtE,WAAW,CAAC,EAAE,KAAK,GAAG,IAAI,CAAA;IAC1B,oEAAoE;IACpE,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,CAAA;IACjD,+BAA+B;IAC/B,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IAC9C,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB;kFAC8E;IAC9E,WAAW,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;IACxD;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IACjC,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAA;IACX,sDAAsD;IACtD,QAAQ,EAAE,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,EAAE,CAAA;CAC/C"}

package/dist/engine/validation/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/engine/validation/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAOhE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAErD;;;;;;GAMG;AAEH;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAA;IACb,0GAA0G;IAC1G,QAAQ,EAAE,MAAM,CAAA;IAChB,kGAAkG;IAClG,QAAQ,EAAE,MAAM,CAAA;IAChB,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC/B;;;OAGG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAA;IACrC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,YAAY,CAAA;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,+EAA+E;IAC/E,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC3B,8FAA8F;IAC9F,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,4FAA4F;IAC5F,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,sEAAsE;IACtE,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,uFAAuF;IACvF,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAED;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,OAAO,CAAA;IAClB,SAAS,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC9B,2BAA2B,EAAE,OAAO,CAAA;IACpC,qBAAqB,EAAE,OAAO,CAAA;IAC9B,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,YAAY,GAAG,SAAS,CAAA;CACtC,CAAA;AAKD,0CAA0C;AAC1C,QAAA,MAAM,aAAa,YAAI,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAU,CAAA;AAqR/D;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,GAAE,0BAA+B,GACvC,yBAAyB,CAqD3B;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAE5F"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/engine/validation/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAOhE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAErD;;;;;;GAMG;AAEH;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAA;IACb,0GAA0G;IAC1G,QAAQ,EAAE,MAAM,CAAA;IAChB,kGAAkG;IAClG,QAAQ,EAAE,MAAM,CAAA;IAChB,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC/B;;;OAGG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAA;IACrC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,YAAY,CAAA;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,+EAA+E;IAC/E,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC3B,8FAA8F;IAC9F,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,4FAA4F;IAC5F,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,sEAAsE;IACtE,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,uFAAuF;IACvF,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAED;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,OAAO,CAAA;IAClB,SAAS,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC9B,2BAA2B,EAAE,OAAO,CAAA;IACpC,qBAAqB,EAAE,OAAO,CAAA;IAC9B,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,YAAY,GAAG,SAAS,CAAA;CACtC,CAAA;AAKD,0CAA0C;AAC1C,QAAA,MAAM,aAAa,YAAI,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAU,CAAA;AA+R/D;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,GAAE,0BAA+B,GACvC,yBAAyB,CAqD3B;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAE5F"}

package/dist/engine/validation/index.js

@@ -147,9 +147,9 @@ function expectedFromIssue(issue) {
     if (issue.code === 'invalid_type')
         return issue.expected;
     const message = issue.message;
-    if (typeof message !== 'string')
+    if (typeof message !== 'string' || message.trim() === '')
         return 'valid-field-value';
-    return message.startsWith('Expected ') ? message.slice('Expected '.length) : 'valid-field-value';
+    return message.startsWith('Expected ') ? message.slice('Expected '.length) : message;
 }
 /**
  * Separates known fields (present in seed definition) from unknown fields in a raw payload.
@@ -233,12 +233,19 @@ function processZodIssues(seed, issues, filtered, options) {
             continue;
         }
         const issuePath = issue.path;
+        const valByPath = resolveByPath(filtered, issuePath);
+        // Skip dummy invalid_type (expected: null) issues produced by Zod union when input is not null
+        if (issue.code === 'invalid_type' &&
+            issue.expected === 'null' &&
+            valByPath !== null) {
+            continue;
+        }
         // detectMissingRequired() already reports top-level required-and-missing branches;
         // skip the redundant native invalid_type/undefined issue Zod v4 raises for the same field.
         if (issue.code === 'invalid_type' &&
             options.enforceRequiredFields &&
             issuePath.length === 1 &&
-            resolveByPath(filtered, issuePath) === undefined) {
+            valByPath === undefined) {
             continue;
         }
         const field = buildFieldPath(issuePath);

package/dist/engine/validation/richtext-sanitizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"richtext-sanitizer.d.ts","sourceRoot":"","sources":["../../../src/engine/validation/richtext-sanitizer.ts"],"names":[],"mappings":"AA0BA,+DAA+D;AAC/D,UAAU,sBAAsB;IAC9B,2CAA2C;IAC3C,KAAK,EAAE,OAAO,CAAA;IACd,6DAA6D;IAC7D,SAAS,EAAE,OAAO,CAAA;IAClB,mEAAmE;IACnE,KAAK,EAAE,OAAO,CAAA;IACd,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AA4GD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAgCvF;AA2BD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAS1D"}
+{"version":3,"file":"richtext-sanitizer.d.ts","sourceRoot":"","sources":["../../../src/engine/validation/richtext-sanitizer.ts"],"names":[],"mappings":"AA0BA,+DAA+D;AAC/D,UAAU,sBAAsB;IAC9B,2CAA2C;IAC3C,KAAK,EAAE,OAAO,CAAA;IACd,6DAA6D;IAC7D,SAAS,EAAE,OAAO,CAAA;IAClB,mEAAmE;IACnE,KAAK,EAAE,OAAO,CAAA;IACd,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAoID;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAgCvF;AA2BD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAS1D"}