@beechcms/core 0.8.0 → 0.9.0

package/dist/file-types.d.ts

@@ -0,0 +1,13 @@
+export type FileAccept = 'image' | 'document' | 'any';
+export declare const IMAGE_EXTENSIONS: Set<string>;
+export declare const BLOCKED_IMAGE_EXTENSIONS: Set<string>;
+export declare const DOCUMENT_EXTENSIONS: Set<string>;
+export declare const ARCHIVE_EXTENSIONS: Set<string>;
+export declare const IMAGE_MIME_TYPES: readonly ["image/jpeg", "image/png", "image/gif", "image/webp", "image/avif", "image/bmp", "image/x-icon", "image/vnd.microsoft.icon"];
+export declare const BLOCKED_IMAGE_MIME_TYPES: readonly ["image/svg+xml", "image/svg"];
+export declare const DOCUMENT_MIME_TYPES: readonly ["application/pdf", "application/msword", "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "application/vnd.ms-excel", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "application/vnd.ms-powerpoint", "application/vnd.openxmlformats-officedocument.presentationml.presentation", "text/plain", "text/csv", "text/markdown"];
+export declare const ARCHIVE_MIME_TYPES: readonly ["application/zip", "application/x-zip-compressed", "application/x-7z-compressed", "application/x-tar", "application/gzip", "application/json"];
+export declare function extensionFromUrl(url: string): string | null;
+export declare function isExtensionAccepted(ext: string | null, accept: FileAccept): boolean;
+export declare function isMimeAccepted(mime: string, accept: FileAccept): boolean;
+//# sourceMappingURL=file-types.d.ts.map

package/dist/file-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-types.d.ts","sourceRoot":"","sources":["../src/file-types.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,UAAU,GAAG,KAAK,CAAA;AAKrD,eAAO,MAAM,gBAAgB,aAAuE,CAAA;AACpG,eAAO,MAAM,wBAAwB,aAA2B,CAAA;AAChE,eAAO,MAAM,mBAAmB,aAAoF,CAAA;AACpH,eAAO,MAAM,kBAAkB,aAA8C,CAAA;AAI7E,eAAO,MAAM,gBAAgB,wIASnB,CAAA;AAGV,eAAO,MAAM,wBAAwB,yCAA0C,CAAA;AAC/E,eAAO,MAAM,mBAAmB,yXAWtB,CAAA;AACV,eAAO,MAAM,kBAAkB,0JAOrB,CAAA;AAEV,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS3D;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAMnF;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAcxE"}

package/dist/file-types.js

@@ -0,0 +1,85 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+// SVG is intentionally excluded: SVG can embed <script> tags and is rendered
+// inline by browsers when served as image/svg+xml on a same-origin route,
+// creating a stored XSS vector (see security audit finding #4).
+export const IMAGE_EXTENSIONS = new Set(['jpg', 'jpeg', 'png', 'gif', 'webp', 'avif', 'bmp', 'ico']);
+export const BLOCKED_IMAGE_EXTENSIONS = new Set(['svg', 'svgz']);
+export const DOCUMENT_EXTENSIONS = new Set(['pdf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'txt', 'csv', 'md']);
+export const ARCHIVE_EXTENSIONS = new Set(['zip', '7z', 'tar', 'gz', 'json']);
+// Explicitly enumerate safe image MIME types instead of using the wildcard
+// `image/*` prefix, which would permit `image/svg+xml` and other XSS vectors.
+export const IMAGE_MIME_TYPES = [
+    'image/jpeg',
+    'image/png',
+    'image/gif',
+    'image/webp',
+    'image/avif',
+    'image/bmp',
+    'image/x-icon',
+    'image/vnd.microsoft.icon',
+];
+// Blocked image MIME types — listed explicitly so upload code can reject them
+// with a clear error rather than a generic "file type not allowed".
+export const BLOCKED_IMAGE_MIME_TYPES = ['image/svg+xml', 'image/svg'];
+export const DOCUMENT_MIME_TYPES = [
+    'application/pdf',
+    'application/msword',
+    'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    'application/vnd.ms-excel',
+    'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    'application/vnd.ms-powerpoint',
+    'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+    'text/plain',
+    'text/csv',
+    'text/markdown',
+];
+export const ARCHIVE_MIME_TYPES = [
+    'application/zip',
+    'application/x-zip-compressed',
+    'application/x-7z-compressed',
+    'application/x-tar',
+    'application/gzip',
+    'application/json',
+];
+export function extensionFromUrl(url) {
+    try {
+        const path = new URL(url).pathname;
+        const dot = path.lastIndexOf('.');
+        if (dot < 0 || dot === path.length - 1)
+            return null;
+        return path.slice(dot + 1).toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+export function isExtensionAccepted(ext, accept) {
+    if (accept === 'any')
+        return true;
+    if (ext == null)
+        return false;
+    if (accept === 'image')
+        return IMAGE_EXTENSIONS.has(ext);
+    if (accept === 'document')
+        return DOCUMENT_EXTENSIONS.has(ext);
+    return false;
+}
+export function isMimeAccepted(mime, accept) {
+    // Normalise: strip parameters (e.g. "image/jpeg; charset=utf-8" → "image/jpeg")
+    const normalised = mime.split(';')[0].trim().toLowerCase();
+    // Unconditionally reject SVG regardless of accept mode — SVG can carry
+    // embedded scripts and is rendered by browsers when served inline.
+    if (BLOCKED_IMAGE_MIME_TYPES.includes(normalised))
+        return false;
+    if (accept === 'any') {
+        return IMAGE_MIME_TYPES.includes(normalised)
+            || DOCUMENT_MIME_TYPES.includes(normalised)
+            || ARCHIVE_MIME_TYPES.includes(normalised);
+    }
+    if (accept === 'image')
+        return IMAGE_MIME_TYPES.includes(normalised);
+    if (accept === 'document')
+        return DOCUMENT_MIME_TYPES.includes(normalised);
+    return false;
+}

package/dist/hooks.d.ts

@@ -0,0 +1,29 @@
+import type { ContentRepository } from './content.repository.js';
+import type { Seed } from './types.js';
+export interface HookActor {
+    id: string;
+    role?: string;
+    email?: string;
+}
+export interface HookContext {
+    seed: Seed;
+    /** Canale lecito per side-effect sui contenuti dagli hook (rispetta la Botanical Engine). */
+    repository: ContentRepository;
+    /** Utente che esegue l'operazione, estratto dal JWT. Assente per operazioni di sistema/cron. */
+    actor?: HookActor;
+    /**
+     * Escape hatch per la connessione nativa (D1Database in prod, better-sqlite3 nei test).
+     * Tipizzato `unknown` per non accoppiare @beechcms/core a Cloudflare. Usare con cautela:
+     * scrivere qui bypassa la Botanical Engine.
+     */
+    db: unknown;
+}
+export interface BeechHooks {
+    beforeCreate?: (data: Record<string, any>, ctx: HookContext) => Promise<Record<string, any> | void> | Record<string, any> | void;
+    beforeUpdate?: (id: string, patches: Record<string, any>, ctx: HookContext) => Promise<Record<string, any> | void> | Record<string, any> | void;
+    beforeDelete?: (id: string, ctx: HookContext) => Promise<void> | void;
+    afterCreate?: (entry: Record<string, any>, ctx: HookContext) => Promise<void> | void;
+    afterUpdate?: (entry: Record<string, any>, ctx: HookContext) => Promise<void> | void;
+    afterDelete?: (id: string, ctx: HookContext) => Promise<void> | void;
+}
+//# sourceMappingURL=hooks.d.ts.map

package/dist/hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,IAAI,CAAA;IACV,6FAA6F;IAC7F,UAAU,EAAE,iBAAiB,CAAA;IAC7B,gGAAgG;IAChG,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB;;;;OAIG;IACH,EAAE,EAAE,OAAO,CAAA;CACZ;AAED,MAAM,WAAW,UAAU;IAGzB,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAA;IAChI,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAA;IAC/I,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAGrE,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACpF,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACpF,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CACrE"}

package/dist/hooks.js

@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+export {};

package/dist/id-generator.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Identifier abstraction. Hides direct calls to {@link crypto.randomUUID}
+ * so callers can swap in deterministic generators during tests for stable
+ * snapshot assertions and predictable insert ordering.
+ */
+export interface IIdGenerator {
+    /**
+     * Generates a new universally unique identifier.
+     * Production implementation delegates to crypto.randomUUID().
+     * Test implementations return deterministic values for snapshot assertions.
+     */
+    uuid(): string;
+    /**
+     * Returns true when `value` has the exact shape produced by `uuid()`.
+     * The ONLY place in the codebase that knows the id format. Never inline
+     * a regex; always go through this method when validating a relation id,
+     * a route param, or any user-supplied id.
+     */
+    isValid(value: unknown): value is string;
+}
+/**
+ * Production singleton. Delegates to the host runtime CSPRNG-backed UUID
+ * generator. Stateless and therefore safe to share across requests.
+ */
+export declare const SystemIdGenerator: IIdGenerator;
+//# sourceMappingURL=id-generator.d.ts.map

package/dist/id-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-generator.d.ts","sourceRoot":"","sources":["../src/id-generator.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,IAAI,IAAI,MAAM,CAAA;IAEd;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAA;CACzC;AAMD;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,YAI/B,CAAA"}

package/dist/id-generator.js

@@ -0,0 +1,12 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+// Internal — never exported. Callers depend on the interface, not the shape.
+const SYSTEM_ID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+/**
+ * Production singleton. Delegates to the host runtime CSPRNG-backed UUID
+ * generator. Stateless and therefore safe to share across requests.
+ */
+export const SystemIdGenerator = {
+    uuid: () => crypto.randomUUID(),
+    isValid: (value) => typeof value === 'string' && SYSTEM_ID_REGEX.test(value),
+};

package/dist/idempotency.repository.d.ts

@@ -0,0 +1,13 @@
+export interface IdempotencyRecord {
+    key: string;
+    fingerprint: string;
+    responseStatus: number;
+    responseBody: string;
+    expiresAt: number;
+}
+export interface IdempotencyRepository {
+    lookup(key: string): Promise<IdempotencyRecord | null>;
+    store(record: IdempotencyRecord): Promise<void>;
+    cleanup(now: number): Promise<void>;
+}
+//# sourceMappingURL=idempotency.repository.d.ts.map

package/dist/idempotency.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.repository.d.ts","sourceRoot":"","sources":["../src/idempotency.repository.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;IACtD,KAAK,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpC"}

package/dist/idempotency.repository.js

@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+export {};

package/dist/index.d.ts

@@ -9,19 +9,23 @@
  */
 export * from './engine/types.js';
 export * from './media/file-types.js';
-export * from './engine/define-seed.js';
-export * from './engine/seeds.js';
+export * from './engine/seeds/define-seed.js';
+export * from './engine/seeds/seeds.js';
 export * from './engine/engine.js';
 export * from './engine/validation/index.js';
+export * from './engine/localization/localization.js';
 export * from './content/richtext/richtext.js';
 export * from './content/slug-utils.js';
 export * from './content/content.repository.js';
+export * from './content/deletion-ledger.js';
 export * from './common/hooks.js';
+export { canonicalStringify } from './common/canonical-json.js';
 export * from './content/idempotency.repository.js';
 export * from './media/media.repository.js';
 export * from './common/storage.js';
-export * from './engine/policies.js';
-export * from './engine/privacy.service.js';
+export * from './engine/privacy/policies.js';
+export * from './engine/privacy/privacy.service.js';
+export * from './auth/account-email.js';
 export * from './auth/hash-provider.js';
 export * from './auth/token-service.js';
 export * from './auth/user.repository.js';
@@ -34,6 +38,10 @@ export * from './oauth/client.repository.js';
 export * from './oauth/authorization-code.repository.js';
 export * from './oauth/token.repository.js';
 export * from './oauth/consent.repository.js';
+export * from './rbac/permissions.js';
+export * from './rbac/types.js';
+export * from './rbac/evaluate.js';
+export * from './rbac/invitation.repository.js';
 export * from './rate-limit/rate-limiter.js';
 export * from './observability/activity-logger.js';
 export * from './observability/activity-log.repository.js';
@@ -47,7 +55,11 @@ export * from './search/vector.repository.js';
 export * from './content/content-scan.repository.js';
 export * from './common/clock.js';
 export * from './common/id-generator.js';
-export * from './engine/seed-registry.js';
+export * from './engine/seeds/seed-registry.js';
+export * from './engine/seeds/candidate-ids.js';
+export * from './engine/introspection/introspection.js';
+export * from './engine/introspection/relation-audit.js';
+export * from './engine/introspection/schema-fingerprint.js';
 export * from './automations/automations.types.js';
 export * from './automations/automations-grammar-words.js';
 export * from './automations/automations.runner.interface.js';
@@ -56,8 +68,9 @@ export * from './queue/scheduler.interface.js';
 export * from './queue/scheduler.stub.js';
 export * from './queue/queue.interface.js';
 export * from './queue/queue.stub.js';
+export * from './transfer/index.js';
 export * from './webhooks/webhook-validation.js';
-export * from './engine/relations.js';
+export * from './engine/query/relations.js';
 export * from './settings/site-settings.repository.js';
 export * from './content/demo-data.repository.js';
 export * from './dashboard-layout/seed-layout.js';
@@ -68,16 +81,26 @@ export * from './dashboard-layout/dashboard-scopes.js';
 export * from './dashboard-layout/dashboard-permissions.js';
 export * from './dashboard-layout/dashboard-layout.repository.js';
 export * from './content/seed.repository.js';
-export * from './engine/seed-validation.js';
-export * from './engine/seed-ddl.js';
-export * from './engine/schema-mutator.js';
-export * from './engine/seed-types-generator.js';
+export * from './content/seed-media-purge.repository.js';
+export * from './engine/seeds/seed-validation.js';
+export * from './engine/seeds/tag-options.js';
+export * from './engine/seeds/tag-migration.js';
+export * from './engine/seeds/tag-value.js';
+export * from './engine/seeds/seed-definition-diff.js';
+export { SQL_RESERVED_WORDS } from './engine/sql-reserved-words.js';
+export * from './engine/ddl/seed-ddl.js';
+export * from './engine/ddl/schema-mutator.js';
+export * from './engine/ddl/seed-purge-guards.js';
+export * from './engine/seeds/seed-types-generator.js';
 export * from './webhooks/webhook-crypto.js';
 export * from './dashboard-layout/kanban/kanban.js';
 export * from './dashboard-layout/view-authorization.js';
-export * from './dashboard-layout/kanban/kanban-position.repository.js';
+export * from './dashboard-layout/content-view.js';
+export * from './dashboard-layout/content-view.repository.js';
 export * from './common/email.provider.js';
 export * from './media/magic-bytes.js';
+export * from './media/image-transformer.js';
+export * from './media/media-transform.js';
 export * from './security/time-trap.js';
 export * from './antivirus/antivirus.interface.js';
 export * from './antivirus/virustotal-antivirus.provider.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH,cAAc,mBAAmB,CAAA;AACjC,cAAc,uBAAuB,CAAA;AACrC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,gCAAgC,CAAA;AAE9C,cAAc,yBAAyB,CAAA;AACvC,cAAc,iCAAiC,CAAA;AAC/C,cAAc,mBAAmB,CAAA;AACjC,cAAc,qCAAqC,CAAA;AACnD,cAAc,6BAA6B,CAAA;AAC3C,cAAc,qBAAqB,CAAA;AACnC,cAAc,sBAAsB,CAAA;AACpC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,yBAAyB,CAAA;AACvC,cAAc,yBAAyB,CAAA;AACvC,cAAc,2BAA2B,CAAA;AACzC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,2CAA2C,CAAA;AACzD,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,0CAA0C,CAAA;AACxD,cAAc,6BAA6B,CAAA;AAC3C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,8BAA8B,CAAA;AAC5C,cAAc,oCAAoC,CAAA;AAClD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,yCAAyC,CAAA;AACvD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,yCAAyC,CAAA;AACvD,cAAc,+BAA+B,CAAA;AAC7C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,8BAA8B,CAAA;AAC5C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,sCAAsC,CAAA;AACpD,cAAc,mBAAmB,CAAA;AACjC,cAAc,0BAA0B,CAAA;AACxC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oCAAoC,CAAA;AAClD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,+CAA+C,CAAA;AAC7D,cAAc,mDAAmD,CAAA;AACjE,cAAc,gCAAgC,CAAA;AAC9C,cAAc,2BAA2B,CAAA;AACzC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,uBAAuB,CAAA;AACrC,cAAc,kCAAkC,CAAA;AAChD,cAAc,uBAAuB,CAAA;AACrC,cAAc,wCAAwC,CAAA;AACtD,cAAc,mCAAmC,CAAA;AACjD,cAAc,mCAAmC,CAAA;AACjD,cAAc,8CAA8C,CAAA;AAC5D,cAAc,0CAA0C,CAAA;AACxD,cAAc,wCAAwC,CAAA;AACtD,cAAc,wCAAwC,CAAA;AACtD,cAAc,6CAA6C,CAAA;AAC3D,cAAc,mDAAmD,CAAA;AACjE,cAAc,8BAA8B,CAAA;AAC5C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,sBAAsB,CAAA;AACpC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,kCAAkC,CAAA;AAChD,cAAc,8BAA8B,CAAA;AAC5C,cAAc,qCAAqC,CAAA;AACnD,cAAc,0CAA0C,CAAA;AACxD,cAAc,yDAAyD,CAAA;AACvE,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,yBAAyB,CAAA;AACvC,cAAc,oCAAoC,CAAA;AAClD,cAAc,8CAA8C,CAAA;AAC5D,cAAc,wCAAwC,CAAA;AACtD,cAAc,2CAA2C,CAAA;AACzD,cAAc,0CAA0C,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH,cAAc,mBAAmB,CAAA;AACjC,cAAc,uBAAuB,CAAA;AACrC,cAAc,+BAA+B,CAAA;AAC7C,cAAc,yBAAyB,CAAA;AACvC,cAAc,oBAAoB,CAAA;AAClC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,uCAAuC,CAAA;AACrD,cAAc,gCAAgC,CAAA;AAE9C,cAAc,yBAAyB,CAAA;AACvC,cAAc,iCAAiC,CAAA;AAC/C,cAAc,8BAA8B,CAAA;AAC5C,cAAc,mBAAmB,CAAA;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAC/D,cAAc,qCAAqC,CAAA;AACnD,cAAc,6BAA6B,CAAA;AAC3C,cAAc,qBAAqB,CAAA;AACnC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,qCAAqC,CAAA;AACnD,cAAc,yBAAyB,CAAA;AACvC,cAAc,yBAAyB,CAAA;AACvC,cAAc,yBAAyB,CAAA;AACvC,cAAc,2BAA2B,CAAA;AACzC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,2CAA2C,CAAA;AACzD,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,0CAA0C,CAAA;AACxD,cAAc,6BAA6B,CAAA;AAC3C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,uBAAuB,CAAA;AACrC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,iCAAiC,CAAA;AAC/C,cAAc,8BAA8B,CAAA;AAC5C,cAAc,oCAAoC,CAAA;AAClD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,yCAAyC,CAAA;AACvD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,yCAAyC,CAAA;AACvD,cAAc,+BAA+B,CAAA;AAC7C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,8BAA8B,CAAA;AAC5C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,sCAAsC,CAAA;AACpD,cAAc,mBAAmB,CAAA;AACjC,cAAc,0BAA0B,CAAA;AACxC,cAAc,iCAAiC,CAAA;AAC/C,cAAc,iCAAiC,CAAA;AAC/C,cAAc,yCAAyC,CAAA;AACvD,cAAc,0CAA0C,CAAA;AACxD,cAAc,8CAA8C,CAAA;AAC5D,cAAc,oCAAoC,CAAA;AAClD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,+CAA+C,CAAA;AAC7D,cAAc,mDAAmD,CAAA;AACjE,cAAc,gCAAgC,CAAA;AAC9C,cAAc,2BAA2B,CAAA;AACzC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kCAAkC,CAAA;AAChD,cAAc,6BAA6B,CAAA;AAC3C,cAAc,wCAAwC,CAAA;AACtD,cAAc,mCAAmC,CAAA;AACjD,cAAc,mCAAmC,CAAA;AACjD,cAAc,8CAA8C,CAAA;AAC5D,cAAc,0CAA0C,CAAA;AACxD,cAAc,wCAAwC,CAAA;AACtD,cAAc,wCAAwC,CAAA;AACtD,cAAc,6CAA6C,CAAA;AAC3D,cAAc,mDAAmD,CAAA;AACjE,cAAc,8BAA8B,CAAA;AAC5C,cAAc,0CAA0C,CAAA;AACxD,cAAc,mCAAmC,CAAA;AACjD,cAAc,+BAA+B,CAAA;AAC7C,cAAc,iCAAiC,CAAA;AAC/C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,wCAAwC,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAA;AACnE,cAAc,0BAA0B,CAAA;AACxC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,mCAAmC,CAAA;AACjD,cAAc,wCAAwC,CAAA;AACtD,cAAc,8BAA8B,CAAA;AAC5C,cAAc,qCAAqC,CAAA;AACnD,cAAc,0CAA0C,CAAA;AACxD,cAAc,oCAAoC,CAAA;AAClD,cAAc,+CAA+C,CAAA;AAC7D,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,yBAAyB,CAAA;AACvC,cAAc,oCAAoC,CAAA;AAClD,cAAc,8CAA8C,CAAA;AAC5D,cAAc,wCAAwC,CAAA;AACtD,cAAc,2CAA2C,CAAA;AACzD,cAAc,0CAA0C,CAAA"}

package/dist/index.js

@@ -11,19 +11,23 @@
  */
 export * from './engine/types.js';
 export * from './media/file-types.js';
-export * from './engine/define-seed.js';
-export * from './engine/seeds.js';
+export * from './engine/seeds/define-seed.js';
+export * from './engine/seeds/seeds.js';
 export * from './engine/engine.js';
 export * from './engine/validation/index.js';
+export * from './engine/localization/localization.js';
 export * from './content/richtext/richtext.js';
 export * from './content/slug-utils.js';
 export * from './content/content.repository.js';
+export * from './content/deletion-ledger.js';
 export * from './common/hooks.js';
+export { canonicalStringify } from './common/canonical-json.js';
 export * from './content/idempotency.repository.js';
 export * from './media/media.repository.js';
 export * from './common/storage.js';
-export * from './engine/policies.js';
-export * from './engine/privacy.service.js';
+export * from './engine/privacy/policies.js';
+export * from './engine/privacy/privacy.service.js';
+export * from './auth/account-email.js';
 export * from './auth/hash-provider.js';
 export * from './auth/token-service.js';
 export * from './auth/user.repository.js';
@@ -36,6 +40,10 @@ export * from './oauth/client.repository.js';
 export * from './oauth/authorization-code.repository.js';
 export * from './oauth/token.repository.js';
 export * from './oauth/consent.repository.js';
+export * from './rbac/permissions.js';
+export * from './rbac/types.js';
+export * from './rbac/evaluate.js';
+export * from './rbac/invitation.repository.js';
 export * from './rate-limit/rate-limiter.js';
 export * from './observability/activity-logger.js';
 export * from './observability/activity-log.repository.js';
@@ -49,7 +57,11 @@ export * from './search/vector.repository.js';
 export * from './content/content-scan.repository.js';
 export * from './common/clock.js';
 export * from './common/id-generator.js';
-export * from './engine/seed-registry.js';
+export * from './engine/seeds/seed-registry.js';
+export * from './engine/seeds/candidate-ids.js';
+export * from './engine/introspection/introspection.js';
+export * from './engine/introspection/relation-audit.js';
+export * from './engine/introspection/schema-fingerprint.js';
 export * from './automations/automations.types.js';
 export * from './automations/automations-grammar-words.js';
 export * from './automations/automations.runner.interface.js';
@@ -58,8 +70,9 @@ export * from './queue/scheduler.interface.js';
 export * from './queue/scheduler.stub.js';
 export * from './queue/queue.interface.js';
 export * from './queue/queue.stub.js';
+export * from './transfer/index.js';
 export * from './webhooks/webhook-validation.js';
-export * from './engine/relations.js';
+export * from './engine/query/relations.js';
 export * from './settings/site-settings.repository.js';
 export * from './content/demo-data.repository.js';
 export * from './dashboard-layout/seed-layout.js';
@@ -70,16 +83,26 @@ export * from './dashboard-layout/dashboard-scopes.js';
 export * from './dashboard-layout/dashboard-permissions.js';
 export * from './dashboard-layout/dashboard-layout.repository.js';
 export * from './content/seed.repository.js';
-export * from './engine/seed-validation.js';
-export * from './engine/seed-ddl.js';
-export * from './engine/schema-mutator.js';
-export * from './engine/seed-types-generator.js';
+export * from './content/seed-media-purge.repository.js';
+export * from './engine/seeds/seed-validation.js';
+export * from './engine/seeds/tag-options.js';
+export * from './engine/seeds/tag-migration.js';
+export * from './engine/seeds/tag-value.js';
+export * from './engine/seeds/seed-definition-diff.js';
+export { SQL_RESERVED_WORDS } from './engine/sql-reserved-words.js';
+export * from './engine/ddl/seed-ddl.js';
+export * from './engine/ddl/schema-mutator.js';
+export * from './engine/ddl/seed-purge-guards.js';
+export * from './engine/seeds/seed-types-generator.js';
 export * from './webhooks/webhook-crypto.js';
 export * from './dashboard-layout/kanban/kanban.js';
 export * from './dashboard-layout/view-authorization.js';
-export * from './dashboard-layout/kanban/kanban-position.repository.js';
+export * from './dashboard-layout/content-view.js';
+export * from './dashboard-layout/content-view.repository.js';
 export * from './common/email.provider.js';
 export * from './media/magic-bytes.js';
+export * from './media/image-transformer.js';
+export * from './media/media-transform.js';
 export * from './security/time-trap.js';
 export * from './antivirus/antivirus.interface.js';
 export * from './antivirus/virustotal-antivirus.provider.js';

package/dist/kanban-position.repository.d.ts

@@ -0,0 +1,19 @@
+export interface KanbanPositionRecord {
+    entryId: string;
+    position: string;
+}
+/**
+ * Persistence contract for card ordering. The ONLY gateway to `kanban_positions`.
+ * Handlers and the dashboard never touch the table directly (Botanical invariant).
+ */
+export interface IKanbanPositionRepository {
+    /** entryId → position for one column axis (entries without a row are omitted). */
+    getColumn(seedSlug: string, axisBranchId: string): Promise<Map<string, string>>;
+    /** Single-row upsert — exactly one write per drag (KB-S04b). */
+    setPosition(seedSlug: string, entryId: string, axisBranchId: string, position: string): Promise<void>;
+    /** Remove an entry's position row (e.g. entry deleted). */
+    remove(seedSlug: string, entryId: string, axisBranchId: string): Promise<void>;
+    /** Async rebalance (KB-S04f): rewrite a whole column's positions in one batch. */
+    rebalance(seedSlug: string, axisBranchId: string, ordered: KanbanPositionRecord[]): Promise<void>;
+}
+//# sourceMappingURL=kanban-position.repository.d.ts.map

package/dist/kanban-position.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kanban-position.repository.d.ts","sourceRoot":"","sources":["../src/kanban-position.repository.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,kFAAkF;IAClF,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC/E,gEAAgE;IAChE,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrG,2DAA2D;IAC3D,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9E,kFAAkF;IAClF,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClG"}

package/dist/kanban-position.repository.js

@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+export {};

package/dist/kanban.d.ts

@@ -0,0 +1,75 @@
+import type { Seed, Branch, FilterGroup } from './types.js';
+/** Branch types that can form a discrete, finite set of columns (KB §2). */
+export type KanbanAxisBranchType = 'text' | 'tags' | 'boolean';
+/** A branch eligible to be the kanban axis. */
+export interface KanbanAxisCandidate {
+    /** Stable branch id (br_XX) — persisted as the axis key. Never the alias. */
+    branchId: string;
+    alias: string;
+    label: string;
+    type: KanbanAxisBranchType;
+}
+/** A single column on the board, in deterministic display order (Q2). */
+export interface KanbanColumnDescriptor {
+    /** The discrete axis value. `null` ⇒ the always-last "Senza valore" column. */
+    value: string | null;
+    label: string;
+}
+/** Per-seed, dashboard-side kanban view preferences. Persisted in
+ *  seed_layouts.view_config (KB-S02). NOT part of FormLayout. */
+export interface KanbanConfig {
+    /** Chosen axis branch id, or null when the user has not configured one (KB-U02). */
+    axisBranchId: string | null;
+    /** Card sort inside columns. null ⇒ manual order via kanban_positions (KB-U22b). */
+    sort: {
+        branchId: string;
+        dir: 'ASC' | 'DESC';
+    } | null;
+    /** Axis values the user chose to hide when columns exceed the cap (KB-U06c). */
+    hiddenColumnValues?: string[];
+}
+export type KanbanIncompatibleReason = 'drafts-enabled' | 'no-candidate-branch';
+export interface KanbanCompatibility {
+    compatible: boolean;
+    reason?: KanbanIncompatibleReason;
+    candidates: KanbanAxisCandidate[];
+}
+/**
+ * Determines whether a seed can be displayed as a Kanban board, and which
+ * branches may serve as the column axis. Pure — no I/O. (KB-S01)
+ *
+ * Q3: seeds with `allowDrafts: true` are NOT kanban-compatible.
+ */
+export declare function resolveKanbanConfig(seed: Seed): KanbanCompatibility;
+/**
+ * Deterministic, stable column order for a chosen axis (Q2). The "Senza valore"
+ * (value: null) column is always appended last. Values out of `options` are NOT
+ * given their own column (KB-U25) — the board folds them into "Senza valore".
+ *
+ * @param distinctTagValues unique tag values observed in data (tags axis without options).
+ */
+export declare function resolveKanbanColumns(branch: Branch, distinctTagValues?: string[]): KanbanColumnDescriptor[];
+/**
+ * Pure: the FilterGroup selecting one kanban column's entries for a given axis branch.
+ * `value: null` ⇒ "Senza valore" — entries where the axis field is NULL or empty (KB-U25).
+ * Boolean descriptor values 'true'/'false' are coerced to actual booleans for the engine.
+ */
+/** Body of PATCH /:slug/:id/kanban-move. The server applies the axis change (if any)
+ *  AND the position upsert atomically (KB-S04e). */
+export interface KanbanMoveBody {
+    /** Axis branch id (br_XX). Identifies which kanban_positions row + which branch to patch. */
+    axisBranchId: string;
+    /** New fractional-index key for this entry in the destination column (KB-S04b/d). */
+    position: string;
+    /** Present only on a cross-column move (axis value changed). Omit for same-column reorder. */
+    axis?: {
+        kind: 'scalar';
+        value: string | null;
+    } | {
+        kind: 'tags';
+        oldValue: string | null;
+        newValue: string | null;
+    };
+}
+export declare function kanbanColumnFilter(branch: Branch, value: string | null): FilterGroup;
+//# sourceMappingURL=kanban.d.ts.map

package/dist/kanban.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kanban.d.ts","sourceRoot":"","sources":["../src/kanban.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE3D,4EAA4E;AAC5E,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;AAE9D,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,oBAAoB,CAAA;CAC3B;AAED,yEAAyE;AACzE,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;iEACiE;AACjE,MAAM,WAAW,YAAY;IAC3B,oFAAoF;IACpF,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,oFAAoF;IACpF,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IACtD,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC9B;AAED,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,GAAG,qBAAqB,CAAA;AAE/E,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,CAAC,EAAE,wBAAwB,CAAA;IACjC,UAAU,EAAE,mBAAmB,EAAE,CAAA;CAClC;AAgBD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,mBAAmB,CAanE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,iBAAiB,GAAE,MAAM,EAAO,GAC/B,sBAAsB,EAAE,CAiB1B;AAED;;;;GAIG;AACH;oDACoD;AACpD,MAAM,WAAW,cAAc;IAC7B,6FAA6F;IAC7F,YAAY,EAAE,MAAM,CAAA;IACpB,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAA;IAChB,8FAA8F;IAC9F,IAAI,CAAC,EACD;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GACxC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CACvE;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,CAYpF"}

package/dist/kanban.js

@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+/** Branch types that are explicitly never an axis (KB §2). */
+const NON_AXIS_TYPES = new Set([
+    'richtext', 'file', 'number', 'date', 'json', 'relation', 'repeater',
+]);
+function isAxisCandidate(b) {
+    if (b.alias === 'status')
+        return null; // system status excluded (KB §2)
+    if (NON_AXIS_TYPES.has(b.type))
+        return null;
+    if (b.type === 'text')
+        return (b.options && b.options.length > 0) ? 'text' : null;
+    if (b.type === 'tags')
+        return 'tags';
+    if (b.type === 'boolean')
+        return 'boolean';
+    return null;
+}
+/**
+ * Determines whether a seed can be displayed as a Kanban board, and which
+ * branches may serve as the column axis. Pure — no I/O. (KB-S01)
+ *
+ * Q3: seeds with `allowDrafts: true` are NOT kanban-compatible.
+ */
+export function resolveKanbanConfig(seed) {
+    if (seed.allowDrafts) {
+        return { compatible: false, reason: 'drafts-enabled', candidates: [] };
+    }
+    const candidates = [];
+    for (const b of seed.branches) {
+        const type = isAxisCandidate(b);
+        if (type)
+            candidates.push({ branchId: b.id, alias: b.alias, label: b.label, type });
+    }
+    if (candidates.length === 0) {
+        return { compatible: false, reason: 'no-candidate-branch', candidates: [] };
+    }
+    return { compatible: true, candidates };
+}
+/**
+ * Deterministic, stable column order for a chosen axis (Q2). The "Senza valore"
+ * (value: null) column is always appended last. Values out of `options` are NOT
+ * given their own column (KB-U25) — the board folds them into "Senza valore".
+ *
+ * @param distinctTagValues unique tag values observed in data (tags axis without options).
+ */
+export function resolveKanbanColumns(branch, distinctTagValues = []) {
+    const cols = [];
+    if (branch.type === 'boolean') {
+        cols.push({ value: 'false', label: 'No' }, { value: 'true', label: 'Sì' }); // [false, true]
+    }
+    else if (branch.type === 'text' && branch.options?.length) {
+        for (const o of branch.options)
+            cols.push({ value: o, label: o }); // options order
+    }
+    else if (branch.type === 'tags') {
+        const ordered = branch.options?.length
+            ? branch.options
+            : [...distinctTagValues].sort((a, b) => a.localeCompare(b)); // alphabetical
+        for (const o of ordered)
+            cols.push({ value: o, label: o });
+    }
+    const isRequired = Boolean(branch.requiredOnCreate || branch.requiredOnUpdate);
+    if (!isRequired) {
+        cols.push({ value: null, label: `Senza ${branch.label}` }); // always last if not required
+    }
+    return cols;
+}
+export function kanbanColumnFilter(branch, value) {
+    if (value === null) {
+        const type = branch.type === 'boolean' ? 'boolean' : branch.type === 'tags' ? 'tags' : 'text';
+        return { column: branch.alias, type, conditions: [{ op: 'is_empty', value: null }] };
+    }
+    if (branch.type === 'boolean') {
+        return { column: branch.alias, type: 'boolean', conditions: [{ op: 'eq', value: value === 'true' }] };
+    }
+    if (branch.type === 'tags') {
+        return { column: branch.alias, type: 'tags', conditions: [{ op: 'has_tag', value }] };
+    }
+    return { column: branch.alias, type: 'select', conditions: [{ op: 'eq', value }] };
+}

package/dist/layout-permissions.d.ts

@@ -0,0 +1,3 @@
+export declare const ROLES_ALLOWED_TO_EDIT_LAYOUT: ReadonlyArray<string>;
+export declare function canEditLayout(role: string | undefined | null): boolean;
+//# sourceMappingURL=layout-permissions.d.ts.map

package/dist/layout-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"layout-permissions.d.ts","sourceRoot":"","sources":["../src/layout-permissions.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,4BAA4B,EAAE,aAAa,CAAC,MAAM,CAAa,CAAA;AAE5E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAGtE"}

package/dist/layout-permissions.js

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+// NOTE: change this list to extend write-access to other roles
+// (e.g. add 'editor', or introduce a fine-grained 'layout:edit' permission).
+// Single source of truth — used by both API guards and dashboard buttons.
+export const ROLES_ALLOWED_TO_EDIT_LAYOUT = ['admin'];
+export function canEditLayout(role) {
+    if (!role)
+        return false;
+    return ROLES_ALLOWED_TO_EDIT_LAYOUT.includes(role);
+}