@beechcms/core 0.9.0 → 0.9.1

package/dist/file-types.d.ts

@@ -1,13 +0,0 @@
-export type FileAccept = 'image' | 'document' | 'any';
-export declare const IMAGE_EXTENSIONS: Set<string>;
-export declare const BLOCKED_IMAGE_EXTENSIONS: Set<string>;
-export declare const DOCUMENT_EXTENSIONS: Set<string>;
-export declare const ARCHIVE_EXTENSIONS: Set<string>;
-export declare const IMAGE_MIME_TYPES: readonly ["image/jpeg", "image/png", "image/gif", "image/webp", "image/avif", "image/bmp", "image/x-icon", "image/vnd.microsoft.icon"];
-export declare const BLOCKED_IMAGE_MIME_TYPES: readonly ["image/svg+xml", "image/svg"];
-export declare const DOCUMENT_MIME_TYPES: readonly ["application/pdf", "application/msword", "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "application/vnd.ms-excel", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "application/vnd.ms-powerpoint", "application/vnd.openxmlformats-officedocument.presentationml.presentation", "text/plain", "text/csv", "text/markdown"];
-export declare const ARCHIVE_MIME_TYPES: readonly ["application/zip", "application/x-zip-compressed", "application/x-7z-compressed", "application/x-tar", "application/gzip", "application/json"];
-export declare function extensionFromUrl(url: string): string | null;
-export declare function isExtensionAccepted(ext: string | null, accept: FileAccept): boolean;
-export declare function isMimeAccepted(mime: string, accept: FileAccept): boolean;
-//# sourceMappingURL=file-types.d.ts.map

package/dist/file-types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"file-types.d.ts","sourceRoot":"","sources":["../src/file-types.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,UAAU,GAAG,KAAK,CAAA;AAKrD,eAAO,MAAM,gBAAgB,aAAuE,CAAA;AACpG,eAAO,MAAM,wBAAwB,aAA2B,CAAA;AAChE,eAAO,MAAM,mBAAmB,aAAoF,CAAA;AACpH,eAAO,MAAM,kBAAkB,aAA8C,CAAA;AAI7E,eAAO,MAAM,gBAAgB,wIASnB,CAAA;AAGV,eAAO,MAAM,wBAAwB,yCAA0C,CAAA;AAC/E,eAAO,MAAM,mBAAmB,yXAWtB,CAAA;AACV,eAAO,MAAM,kBAAkB,0JAOrB,CAAA;AAEV,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS3D;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAMnF;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAcxE"}

package/dist/file-types.js

@@ -1,85 +0,0 @@
-// SPDX-License-Identifier: MIT
-// Copyright (c) 2024–2026 Flavio De Musso
-// SVG is intentionally excluded: SVG can embed <script> tags and is rendered
-// inline by browsers when served as image/svg+xml on a same-origin route,
-// creating a stored XSS vector (see security audit finding #4).
-export const IMAGE_EXTENSIONS = new Set(['jpg', 'jpeg', 'png', 'gif', 'webp', 'avif', 'bmp', 'ico']);
-export const BLOCKED_IMAGE_EXTENSIONS = new Set(['svg', 'svgz']);
-export const DOCUMENT_EXTENSIONS = new Set(['pdf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'txt', 'csv', 'md']);
-export const ARCHIVE_EXTENSIONS = new Set(['zip', '7z', 'tar', 'gz', 'json']);
-// Explicitly enumerate safe image MIME types instead of using the wildcard
-// `image/*` prefix, which would permit `image/svg+xml` and other XSS vectors.
-export const IMAGE_MIME_TYPES = [
-    'image/jpeg',
-    'image/png',
-    'image/gif',
-    'image/webp',
-    'image/avif',
-    'image/bmp',
-    'image/x-icon',
-    'image/vnd.microsoft.icon',
-];
-// Blocked image MIME types — listed explicitly so upload code can reject them
-// with a clear error rather than a generic "file type not allowed".
-export const BLOCKED_IMAGE_MIME_TYPES = ['image/svg+xml', 'image/svg'];
-export const DOCUMENT_MIME_TYPES = [
-    'application/pdf',
-    'application/msword',
-    'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
-    'application/vnd.ms-excel',
-    'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
-    'application/vnd.ms-powerpoint',
-    'application/vnd.openxmlformats-officedocument.presentationml.presentation',
-    'text/plain',
-    'text/csv',
-    'text/markdown',
-];
-export const ARCHIVE_MIME_TYPES = [
-    'application/zip',
-    'application/x-zip-compressed',
-    'application/x-7z-compressed',
-    'application/x-tar',
-    'application/gzip',
-    'application/json',
-];
-export function extensionFromUrl(url) {
-    try {
-        const path = new URL(url).pathname;
-        const dot = path.lastIndexOf('.');
-        if (dot < 0 || dot === path.length - 1)
-            return null;
-        return path.slice(dot + 1).toLowerCase();
-    }
-    catch {
-        return null;
-    }
-}
-export function isExtensionAccepted(ext, accept) {
-    if (accept === 'any')
-        return true;
-    if (ext == null)
-        return false;
-    if (accept === 'image')
-        return IMAGE_EXTENSIONS.has(ext);
-    if (accept === 'document')
-        return DOCUMENT_EXTENSIONS.has(ext);
-    return false;
-}
-export function isMimeAccepted(mime, accept) {
-    // Normalise: strip parameters (e.g. "image/jpeg; charset=utf-8" → "image/jpeg")
-    const normalised = mime.split(';')[0].trim().toLowerCase();
-    // Unconditionally reject SVG regardless of accept mode — SVG can carry
-    // embedded scripts and is rendered by browsers when served inline.
-    if (BLOCKED_IMAGE_MIME_TYPES.includes(normalised))
-        return false;
-    if (accept === 'any') {
-        return IMAGE_MIME_TYPES.includes(normalised)
-            || DOCUMENT_MIME_TYPES.includes(normalised)
-            || ARCHIVE_MIME_TYPES.includes(normalised);
-    }
-    if (accept === 'image')
-        return IMAGE_MIME_TYPES.includes(normalised);
-    if (accept === 'document')
-        return DOCUMENT_MIME_TYPES.includes(normalised);
-    return false;
-}

package/dist/hooks.d.ts

@@ -1,29 +0,0 @@
-import type { ContentRepository } from './content.repository.js';
-import type { Seed } from './types.js';
-export interface HookActor {
-    id: string;
-    role?: string;
-    email?: string;
-}
-export interface HookContext {
-    seed: Seed;
-    /** Canale lecito per side-effect sui contenuti dagli hook (rispetta la Botanical Engine). */
-    repository: ContentRepository;
-    /** Utente che esegue l'operazione, estratto dal JWT. Assente per operazioni di sistema/cron. */
-    actor?: HookActor;
-    /**
-     * Escape hatch per la connessione nativa (D1Database in prod, better-sqlite3 nei test).
-     * Tipizzato `unknown` per non accoppiare @beechcms/core a Cloudflare. Usare con cautela:
-     * scrivere qui bypassa la Botanical Engine.
-     */
-    db: unknown;
-}
-export interface BeechHooks {
-    beforeCreate?: (data: Record<string, any>, ctx: HookContext) => Promise<Record<string, any> | void> | Record<string, any> | void;
-    beforeUpdate?: (id: string, patches: Record<string, any>, ctx: HookContext) => Promise<Record<string, any> | void> | Record<string, any> | void;
-    beforeDelete?: (id: string, ctx: HookContext) => Promise<void> | void;
-    afterCreate?: (entry: Record<string, any>, ctx: HookContext) => Promise<void> | void;
-    afterUpdate?: (entry: Record<string, any>, ctx: HookContext) => Promise<void> | void;
-    afterDelete?: (id: string, ctx: HookContext) => Promise<void> | void;
-}
-//# sourceMappingURL=hooks.d.ts.map

package/dist/hooks.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,IAAI,CAAA;IACV,6FAA6F;IAC7F,UAAU,EAAE,iBAAiB,CAAA;IAC7B,gGAAgG;IAChG,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB;;;;OAIG;IACH,EAAE,EAAE,OAAO,CAAA;CACZ;AAED,MAAM,WAAW,UAAU;IAGzB,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAA;IAChI,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAA;IAC/I,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAGrE,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACpF,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACpF,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CACrE"}

package/dist/hooks.js

@@ -1,3 +0,0 @@
-// SPDX-License-Identifier: MIT
-// Copyright (c) 2024–2026 Flavio De Musso
-export {};

package/dist/id-generator.d.ts

@@ -1,26 +0,0 @@
-/**
- * Identifier abstraction. Hides direct calls to {@link crypto.randomUUID}
- * so callers can swap in deterministic generators during tests for stable
- * snapshot assertions and predictable insert ordering.
- */
-export interface IIdGenerator {
-    /**
-     * Generates a new universally unique identifier.
-     * Production implementation delegates to crypto.randomUUID().
-     * Test implementations return deterministic values for snapshot assertions.
-     */
-    uuid(): string;
-    /**
-     * Returns true when `value` has the exact shape produced by `uuid()`.
-     * The ONLY place in the codebase that knows the id format. Never inline
-     * a regex; always go through this method when validating a relation id,
-     * a route param, or any user-supplied id.
-     */
-    isValid(value: unknown): value is string;
-}
-/**
- * Production singleton. Delegates to the host runtime CSPRNG-backed UUID
- * generator. Stateless and therefore safe to share across requests.
- */
-export declare const SystemIdGenerator: IIdGenerator;
-//# sourceMappingURL=id-generator.d.ts.map

package/dist/id-generator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"id-generator.d.ts","sourceRoot":"","sources":["../src/id-generator.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,IAAI,IAAI,MAAM,CAAA;IAEd;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAA;CACzC;AAMD;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,YAI/B,CAAA"}

package/dist/id-generator.js

@@ -1,12 +0,0 @@
-// SPDX-License-Identifier: MIT
-// Copyright (c) 2024–2026 Flavio De Musso
-// Internal — never exported. Callers depend on the interface, not the shape.
-const SYSTEM_ID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-/**
- * Production singleton. Delegates to the host runtime CSPRNG-backed UUID
- * generator. Stateless and therefore safe to share across requests.
- */
-export const SystemIdGenerator = {
-    uuid: () => crypto.randomUUID(),
-    isValid: (value) => typeof value === 'string' && SYSTEM_ID_REGEX.test(value),
-};

package/dist/idempotency.repository.d.ts

@@ -1,13 +0,0 @@
-export interface IdempotencyRecord {
-    key: string;
-    fingerprint: string;
-    responseStatus: number;
-    responseBody: string;
-    expiresAt: number;
-}
-export interface IdempotencyRepository {
-    lookup(key: string): Promise<IdempotencyRecord | null>;
-    store(record: IdempotencyRecord): Promise<void>;
-    cleanup(now: number): Promise<void>;
-}
-//# sourceMappingURL=idempotency.repository.d.ts.map

package/dist/idempotency.repository.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"idempotency.repository.d.ts","sourceRoot":"","sources":["../src/idempotency.repository.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;IACtD,KAAK,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpC"}

package/dist/idempotency.repository.js

@@ -1,3 +0,0 @@
-// SPDX-License-Identifier: MIT
-// Copyright (c) 2024–2026 Flavio De Musso
-export {};

package/dist/kanban-position.repository.d.ts

@@ -1,19 +0,0 @@
-export interface KanbanPositionRecord {
-    entryId: string;
-    position: string;
-}
-/**
- * Persistence contract for card ordering. The ONLY gateway to `kanban_positions`.
- * Handlers and the dashboard never touch the table directly (Botanical invariant).
- */
-export interface IKanbanPositionRepository {
-    /** entryId → position for one column axis (entries without a row are omitted). */
-    getColumn(seedSlug: string, axisBranchId: string): Promise<Map<string, string>>;
-    /** Single-row upsert — exactly one write per drag (KB-S04b). */
-    setPosition(seedSlug: string, entryId: string, axisBranchId: string, position: string): Promise<void>;
-    /** Remove an entry's position row (e.g. entry deleted). */
-    remove(seedSlug: string, entryId: string, axisBranchId: string): Promise<void>;
-    /** Async rebalance (KB-S04f): rewrite a whole column's positions in one batch. */
-    rebalance(seedSlug: string, axisBranchId: string, ordered: KanbanPositionRecord[]): Promise<void>;
-}
-//# sourceMappingURL=kanban-position.repository.d.ts.map

package/dist/kanban-position.repository.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"kanban-position.repository.d.ts","sourceRoot":"","sources":["../src/kanban-position.repository.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,kFAAkF;IAClF,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC/E,gEAAgE;IAChE,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrG,2DAA2D;IAC3D,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9E,kFAAkF;IAClF,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClG"}

package/dist/kanban-position.repository.js

@@ -1,3 +0,0 @@
-// SPDX-License-Identifier: MIT
-// Copyright (c) 2024–2026 Flavio De Musso
-export {};

package/dist/kanban.d.ts

@@ -1,75 +0,0 @@
-import type { Seed, Branch, FilterGroup } from './types.js';
-/** Branch types that can form a discrete, finite set of columns (KB §2). */
-export type KanbanAxisBranchType = 'text' | 'tags' | 'boolean';
-/** A branch eligible to be the kanban axis. */
-export interface KanbanAxisCandidate {
-    /** Stable branch id (br_XX) — persisted as the axis key. Never the alias. */
-    branchId: string;
-    alias: string;
-    label: string;
-    type: KanbanAxisBranchType;
-}
-/** A single column on the board, in deterministic display order (Q2). */
-export interface KanbanColumnDescriptor {
-    /** The discrete axis value. `null` ⇒ the always-last "Senza valore" column. */
-    value: string | null;
-    label: string;
-}
-/** Per-seed, dashboard-side kanban view preferences. Persisted in
- *  seed_layouts.view_config (KB-S02). NOT part of FormLayout. */
-export interface KanbanConfig {
-    /** Chosen axis branch id, or null when the user has not configured one (KB-U02). */
-    axisBranchId: string | null;
-    /** Card sort inside columns. null ⇒ manual order via kanban_positions (KB-U22b). */
-    sort: {
-        branchId: string;
-        dir: 'ASC' | 'DESC';
-    } | null;
-    /** Axis values the user chose to hide when columns exceed the cap (KB-U06c). */
-    hiddenColumnValues?: string[];
-}
-export type KanbanIncompatibleReason = 'drafts-enabled' | 'no-candidate-branch';
-export interface KanbanCompatibility {
-    compatible: boolean;
-    reason?: KanbanIncompatibleReason;
-    candidates: KanbanAxisCandidate[];
-}
-/**
- * Determines whether a seed can be displayed as a Kanban board, and which
- * branches may serve as the column axis. Pure — no I/O. (KB-S01)
- *
- * Q3: seeds with `allowDrafts: true` are NOT kanban-compatible.
- */
-export declare function resolveKanbanConfig(seed: Seed): KanbanCompatibility;
-/**
- * Deterministic, stable column order for a chosen axis (Q2). The "Senza valore"
- * (value: null) column is always appended last. Values out of `options` are NOT
- * given their own column (KB-U25) — the board folds them into "Senza valore".
- *
- * @param distinctTagValues unique tag values observed in data (tags axis without options).
- */
-export declare function resolveKanbanColumns(branch: Branch, distinctTagValues?: string[]): KanbanColumnDescriptor[];
-/**
- * Pure: the FilterGroup selecting one kanban column's entries for a given axis branch.
- * `value: null` ⇒ "Senza valore" — entries where the axis field is NULL or empty (KB-U25).
- * Boolean descriptor values 'true'/'false' are coerced to actual booleans for the engine.
- */
-/** Body of PATCH /:slug/:id/kanban-move. The server applies the axis change (if any)
- *  AND the position upsert atomically (KB-S04e). */
-export interface KanbanMoveBody {
-    /** Axis branch id (br_XX). Identifies which kanban_positions row + which branch to patch. */
-    axisBranchId: string;
-    /** New fractional-index key for this entry in the destination column (KB-S04b/d). */
-    position: string;
-    /** Present only on a cross-column move (axis value changed). Omit for same-column reorder. */
-    axis?: {
-        kind: 'scalar';
-        value: string | null;
-    } | {
-        kind: 'tags';
-        oldValue: string | null;
-        newValue: string | null;
-    };
-}
-export declare function kanbanColumnFilter(branch: Branch, value: string | null): FilterGroup;
-//# sourceMappingURL=kanban.d.ts.map

package/dist/kanban.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"kanban.d.ts","sourceRoot":"","sources":["../src/kanban.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE3D,4EAA4E;AAC5E,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;AAE9D,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,oBAAoB,CAAA;CAC3B;AAED,yEAAyE;AACzE,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;iEACiE;AACjE,MAAM,WAAW,YAAY;IAC3B,oFAAoF;IACpF,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,oFAAoF;IACpF,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IACtD,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC9B;AAED,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,GAAG,qBAAqB,CAAA;AAE/E,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,CAAC,EAAE,wBAAwB,CAAA;IACjC,UAAU,EAAE,mBAAmB,EAAE,CAAA;CAClC;AAgBD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,mBAAmB,CAanE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,iBAAiB,GAAE,MAAM,EAAO,GAC/B,sBAAsB,EAAE,CAiB1B;AAED;;;;GAIG;AACH;oDACoD;AACpD,MAAM,WAAW,cAAc;IAC7B,6FAA6F;IAC7F,YAAY,EAAE,MAAM,CAAA;IACpB,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAA;IAChB,8FAA8F;IAC9F,IAAI,CAAC,EACD;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GACxC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CACvE;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,CAYpF"}

package/dist/kanban.js

@@ -1,82 +0,0 @@
-// SPDX-License-Identifier: MIT
-// Copyright (c) 2024–2026 Flavio De Musso
-/** Branch types that are explicitly never an axis (KB §2). */
-const NON_AXIS_TYPES = new Set([
-    'richtext', 'file', 'number', 'date', 'json', 'relation', 'repeater',
-]);
-function isAxisCandidate(b) {
-    if (b.alias === 'status')
-        return null; // system status excluded (KB §2)
-    if (NON_AXIS_TYPES.has(b.type))
-        return null;
-    if (b.type === 'text')
-        return (b.options && b.options.length > 0) ? 'text' : null;
-    if (b.type === 'tags')
-        return 'tags';
-    if (b.type === 'boolean')
-        return 'boolean';
-    return null;
-}
-/**
- * Determines whether a seed can be displayed as a Kanban board, and which
- * branches may serve as the column axis. Pure — no I/O. (KB-S01)
- *
- * Q3: seeds with `allowDrafts: true` are NOT kanban-compatible.
- */
-export function resolveKanbanConfig(seed) {
-    if (seed.allowDrafts) {
-        return { compatible: false, reason: 'drafts-enabled', candidates: [] };
-    }
-    const candidates = [];
-    for (const b of seed.branches) {
-        const type = isAxisCandidate(b);
-        if (type)
-            candidates.push({ branchId: b.id, alias: b.alias, label: b.label, type });
-    }
-    if (candidates.length === 0) {
-        return { compatible: false, reason: 'no-candidate-branch', candidates: [] };
-    }
-    return { compatible: true, candidates };
-}
-/**
- * Deterministic, stable column order for a chosen axis (Q2). The "Senza valore"
- * (value: null) column is always appended last. Values out of `options` are NOT
- * given their own column (KB-U25) — the board folds them into "Senza valore".
- *
- * @param distinctTagValues unique tag values observed in data (tags axis without options).
- */
-export function resolveKanbanColumns(branch, distinctTagValues = []) {
-    const cols = [];
-    if (branch.type === 'boolean') {
-        cols.push({ value: 'false', label: 'No' }, { value: 'true', label: 'Sì' }); // [false, true]
-    }
-    else if (branch.type === 'text' && branch.options?.length) {
-        for (const o of branch.options)
-            cols.push({ value: o, label: o }); // options order
-    }
-    else if (branch.type === 'tags') {
-        const ordered = branch.options?.length
-            ? branch.options
-            : [...distinctTagValues].sort((a, b) => a.localeCompare(b)); // alphabetical
-        for (const o of ordered)
-            cols.push({ value: o, label: o });
-    }
-    const isRequired = Boolean(branch.requiredOnCreate || branch.requiredOnUpdate);
-    if (!isRequired) {
-        cols.push({ value: null, label: `Senza ${branch.label}` }); // always last if not required
-    }
-    return cols;
-}
-export function kanbanColumnFilter(branch, value) {
-    if (value === null) {
-        const type = branch.type === 'boolean' ? 'boolean' : branch.type === 'tags' ? 'tags' : 'text';
-        return { column: branch.alias, type, conditions: [{ op: 'is_empty', value: null }] };
-    }
-    if (branch.type === 'boolean') {
-        return { column: branch.alias, type: 'boolean', conditions: [{ op: 'eq', value: value === 'true' }] };
-    }
-    if (branch.type === 'tags') {
-        return { column: branch.alias, type: 'tags', conditions: [{ op: 'has_tag', value }] };
-    }
-    return { column: branch.alias, type: 'select', conditions: [{ op: 'eq', value }] };
-}

package/dist/layout-permissions.d.ts

@@ -1,3 +0,0 @@
-export declare const ROLES_ALLOWED_TO_EDIT_LAYOUT: ReadonlyArray<string>;
-export declare function canEditLayout(role: string | undefined | null): boolean;
-//# sourceMappingURL=layout-permissions.d.ts.map

package/dist/layout-permissions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"layout-permissions.d.ts","sourceRoot":"","sources":["../src/layout-permissions.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,4BAA4B,EAAE,aAAa,CAAC,MAAM,CAAa,CAAA;AAE5E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAGtE"}

package/dist/layout-permissions.js

@@ -1,11 +0,0 @@
-// SPDX-License-Identifier: MIT
-// Copyright (c) 2024–2026 Flavio De Musso
-// NOTE: change this list to extend write-access to other roles
-// (e.g. add 'editor', or introduce a fine-grained 'layout:edit' permission).
-// Single source of truth — used by both API guards and dashboard buttons.
-export const ROLES_ALLOWED_TO_EDIT_LAYOUT = ['admin'];
-export function canEditLayout(role) {
-    if (!role)
-        return false;
-    return ROLES_ALLOWED_TO_EDIT_LAYOUT.includes(role);
-}

package/dist/media.repository.d.ts

@@ -1,61 +0,0 @@
-/**
- * MediaRepository - Interface for tracking media assets in the database.
- */
-export interface MediaObject {
-    key: string;
-    filename: string;
-    mime_type: string;
-    size_bytes: number;
-    uploaded_by: string;
-    created_at: number;
-}
-export interface MediaRepository {
-    /**
-     * Tracks a new file upload in the database.
-     */
-    trackUpload(media: Omit<MediaObject, 'created_at'>): Promise<void>;
-    /**
-     * Retrieves tracking info for a file by its key.
-     */
-    getByKey(key: string): Promise<MediaObject | null>;
-    /**
-     * Removes tracking info for a file.
-     */
-    untrack(key: string): Promise<void>;
-    /**
-     * Lists all tracked media with pagination.
-     */
-    list(options: {
-        limit: number;
-        offset: number;
-    }): Promise<{
-        items: MediaObject[];
-        total: number;
-    }>;
-    /**
-     * Gets the total number of tracked media objects.
-     */
-    count(): Promise<number>;
-}
-/**
- * SystemStatsRepository - Interface for managing global system metrics.
- */
-export interface SystemStatsRepository {
-    /**
-     * Increments the total storage counter.
-     */
-    incrementStorage(bytes: number): Promise<void>;
-    /**
-     * Decrements the total storage counter.
-     */
-    decrementStorage(bytes: number): Promise<void>;
-    /**
-     * Sets a specific value for a storage stat (e.g. after a full sync).
-     */
-    setStorage(bytes: number): Promise<void>;
-    /**
-     * Gets the current total storage usage in bytes.
-     */
-    getStorageUsage(): Promise<number>;
-}
-//# sourceMappingURL=media.repository.d.ts.map

package/dist/media.repository.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"media.repository.d.ts","sourceRoot":"","sources":["../src/media.repository.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnE;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAEnD;;OAEG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpC;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEnG;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzC;;OAEG;IACH,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACpC"}

package/dist/media.repository.js

@@ -1,3 +0,0 @@
-// SPDX-License-Identifier: MIT
-// Copyright (c) 2024–2026 Flavio De Musso
-export {};

package/dist/policies.d.ts

@@ -1,10 +0,0 @@
-import type { Branch } from './types.js';
-export declare function sha256hex(value: string): Promise<string>;
-export declare function verifyHashField(stored: string, candidate: string): Promise<boolean>;
-/**
- * Risolve le policy di un branch applicando i valori di default.
- * Tutta la logica di accesso ai campi deve passare per questa funzione,
- * mai con inline `branch.policies?.x ?? default`.
- */
-export declare function resolvePolicies(branch: Branch): Required<NonNullable<Branch['policies']>>;
-//# sourceMappingURL=policies.d.ts.map

package/dist/policies.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"policies.d.ts","sourceRoot":"","sources":["../src/policies.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAExC,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAK9D;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEzF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAgBzF"}

package/dist/policies.js

@@ -1,33 +0,0 @@
-// SPDX-License-Identifier: MIT
-// Copyright (c) 2024–2026 Flavio De Musso
-export async function sha256hex(value) {
-    const buf = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value));
-    return Array.from(new Uint8Array(buf))
-        .map((b) => b.toString(16).padStart(2, '0'))
-        .join('');
-}
-export async function verifyHashField(stored, candidate) {
-    return stored === (await sha256hex(candidate));
-}
-/**
- * Risolve le policy di un branch applicando i valori di default.
- * Tutta la logica di accesso ai campi deve passare per questa funzione,
- * mai con inline `branch.policies?.x ?? default`.
- */
-export function resolvePolicies(branch) {
-    const privacy = branch.policies?.privacy ?? 'plain';
-    // Non-plain privacy implies hidden by default: the CMS hashes/encrypts on write,
-    // so returning the stored value would leak the digest to readers.
-    const defaultVisibility = privacy !== 'plain' ? 'hidden' : 'full';
-    // Repeaters live in a single JSON column — never filterable, sortable, or
-    // searchable/facetable in v1, regardless of what's set on the branch.
-    const isRepeater = branch.type === 'repeater';
-    return {
-        privacy,
-        visibility: branch.policies?.visibility ?? defaultVisibility,
-        search: isRepeater ? false : branch.policies?.search ?? true,
-        filter: isRepeater ? false : branch.policies?.filter ?? true,
-        sort: isRepeater ? false : branch.policies?.sort ?? true,
-        public: branch.policies?.public ?? true,
-    };
-}

package/dist/queue.interface.d.ts

@@ -1,39 +0,0 @@
-import type { ContentRepository } from './content.repository.js';
-import type { BeechBucket } from './storage.js';
-import type { IClock } from './clock.js';
-import type { IIdGenerator } from './id-generator.js';
-/**
- * The envelope put on the wire / queue. `name` selects the handler from the
- * JobRegistry; `payload` is the developer-supplied, JSON-serializable body.
- */
-export interface QueueMessage<T = unknown> {
-    name: string;
-    payload: T;
-}
-/**
- * Execution context handed to every job. Botanical Invariant: jobs receive the
- * engine-mediated repository, NEVER a raw D1Database. `env` is a read-only,
- * stringly-typed view of bindings/secrets for things like fetch targets — it
- * deliberately does not expose `DB`.
- */
-export interface JobContext {
-    repository: ContentRepository;
-    bucket: BeechBucket;
-    clock: IClock;
-    idGenerator: IIdGenerator;
-    env: Record<string, string | undefined>;
-}
-/** A single background worker. Receives the decoded payload + context. */
-export type JobHandler<T = unknown> = (payload: T, context: JobContext) => Promise<void>;
-/** Name -> handler map, supplied via BeechConfig.jobs. */
-export type JobRegistry = Record<string, JobHandler<any>>;
-/**
- * Producer port. `enqueue` schedules deferred work and returns once the message
- * is accepted by the transport. Like INotificationService, implementations MUST
- * decide their own fire-and-forget vs inline semantics and MUST NOT let a
- * transport failure crash the request that called enqueue.
- */
-export interface IQueueService {
-    enqueue<T>(name: string, payload: T): Promise<void>;
-}
-//# sourceMappingURL=queue.interface.d.ts.map

package/dist/queue.interface.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"queue.interface.d.ts","sourceRoot":"","sources":["../src/queue.interface.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAErD;;;GAGG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,CAAC,CAAA;CACX;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,iBAAiB,CAAA;IAC7B,MAAM,EAAE,WAAW,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,YAAY,CAAA;IACzB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CACxC;AAED,0EAA0E;AAC1E,MAAM,MAAM,UAAU,CAAC,CAAC,GAAG,OAAO,IAAI,CACpC,OAAO,EAAE,CAAC,EACV,OAAO,EAAE,UAAU,KAChB,OAAO,CAAC,IAAI,CAAC,CAAA;AAElB,0DAA0D;AAC1D,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;AAEzD;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpD"}

package/dist/queue.interface.js

@@ -1,3 +0,0 @@
-// SPDX-License-Identifier: MIT
-// Copyright (c) 2024–2026 Flavio De Musso
-export {};

package/dist/queue.stub.d.ts

@@ -1,6 +0,0 @@
-import type { IQueueService } from './queue.interface.js';
-/** Safe no-op producer (e.g. unit tests that don't assert on enqueue). */
-export declare class NoOpQueueService implements IQueueService {
-    enqueue<T>(_name: string, _payload: T): Promise<void>;
-}
-//# sourceMappingURL=queue.stub.d.ts.map

package/dist/queue.stub.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"queue.stub.d.ts","sourceRoot":"","sources":["../src/queue.stub.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEzD,0EAA0E;AAC1E,qBAAa,gBAAiB,YAAW,aAAa;IAC9C,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAG5D"}

package/dist/queue.stub.js

@@ -1,8 +0,0 @@
-// SPDX-License-Identifier: MIT
-// Copyright (c) 2024–2026 Flavio De Musso
-/** Safe no-op producer (e.g. unit tests that don't assert on enqueue). */
-export class NoOpQueueService {
-    async enqueue(_name, _payload) {
-        // intentionally empty
-    }
-}