@drawnagency/primitives 0.1.0

package/dist/schemas/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,cAAc,sBAAsB,CAAC;AACrC,cAAc,QAAQ,CAAC"}

package/dist/schemas/index.js

@@ -0,0 +1,7 @@
+export * from "./shared";
+export * from "./sections";
+export * from "./site-config";
+export * from "./media";
+export * from "./audience";
+export * from "./media-grid-options";
+export * from "./auth";

package/dist/schemas/media-grid-options.d.ts

@@ -0,0 +1,8 @@
+import { z } from "zod";
+export declare const MediaGridOptionsSchema: z.ZodDefault<z.ZodObject<{
+    square: z.ZodOptional<z.ZodBoolean>;
+    border: z.ZodOptional<z.ZodBoolean>;
+    crop: z.ZodOptional<z.ZodBoolean>;
+    showCaptions: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>>;
+//# sourceMappingURL=media-grid-options.d.ts.map

package/dist/schemas/media-grid-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-grid-options.d.ts","sourceRoot":"","sources":["../../src/schemas/media-grid-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,sBAAsB;;;;;kBAKrB,CAAC"}

package/dist/schemas/media-grid-options.js

@@ -0,0 +1,7 @@
+import { z } from "zod";
+export const MediaGridOptionsSchema = z.object({
+    square: z.boolean().optional(),
+    border: z.boolean().optional(),
+    crop: z.boolean().optional(),
+    showCaptions: z.boolean().optional(),
+}).default({});

package/dist/schemas/media.d.ts

@@ -0,0 +1,63 @@
+import { z } from "zod";
+export declare const VariantSchema: z.ZodObject<{
+    width: z.ZodNumber;
+    height: z.ZodNumber;
+    size: z.ZodNumber;
+}, z.core.$strip>;
+export type Variant = z.infer<typeof VariantSchema>;
+export declare const MediaItemSchema: z.ZodObject<{
+    id: z.ZodString;
+    hash: z.ZodString;
+    kind: z.ZodEnum<{
+        image: "image";
+        video: "video";
+        animated: "animated";
+    }>;
+    originalName: z.ZodString;
+    width: z.ZodNumber;
+    height: z.ZodNumber;
+    mimeType: z.ZodString;
+    size: z.ZodNumber;
+    folder: z.ZodString;
+    variants: z.ZodArray<z.ZodObject<{
+        width: z.ZodNumber;
+        height: z.ZodNumber;
+        size: z.ZodNumber;
+    }, z.core.$strip>>;
+    alt: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>;
+export type MediaItem = z.infer<typeof MediaItemSchema>;
+export declare const ImageManifestSchema: z.ZodObject<{
+    images: z.ZodRecord<z.ZodString, z.ZodObject<{
+        id: z.ZodString;
+        hash: z.ZodString;
+        kind: z.ZodEnum<{
+            image: "image";
+            video: "video";
+            animated: "animated";
+        }>;
+        originalName: z.ZodString;
+        width: z.ZodNumber;
+        height: z.ZodNumber;
+        mimeType: z.ZodString;
+        size: z.ZodNumber;
+        folder: z.ZodString;
+        variants: z.ZodArray<z.ZodObject<{
+            width: z.ZodNumber;
+            height: z.ZodNumber;
+            size: z.ZodNumber;
+        }, z.core.$strip>>;
+        alt: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type MediaManifest = z.infer<typeof ImageManifestSchema>;
+export declare const MediaConfigSchema: z.ZodObject<{
+    adapter: z.ZodDefault<z.ZodEnum<{
+        github: "github";
+    }>>;
+    sizes: z.ZodDefault<z.ZodArray<z.ZodNumber>>;
+    maxFileSize: z.ZodDefault<z.ZodNumber>;
+    quality: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+export type MediaConfig = z.infer<typeof MediaConfigSchema>;
+//# sourceMappingURL=media.d.ts.map

package/dist/schemas/media.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.d.ts","sourceRoot":"","sources":["../../src/schemas/media.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,aAAa;;;;iBAIxB,CAAC;AAEH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;iBAY1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;iBAE9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB;;;;;;;iBAK5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/schemas/media.js

@@ -0,0 +1,28 @@
+import { z } from "zod";
+export const VariantSchema = z.object({
+    width: z.number().int().positive(),
+    height: z.number().int().positive(),
+    size: z.number().int().nonnegative(),
+});
+export const MediaItemSchema = z.object({
+    id: z.string(),
+    hash: z.string(),
+    kind: z.enum(["image", "animated", "video"]),
+    originalName: z.string(),
+    width: z.number().int().positive(),
+    height: z.number().int().positive(),
+    mimeType: z.string(),
+    size: z.number().int().nonnegative(),
+    folder: z.string(),
+    variants: z.array(VariantSchema),
+    alt: z.string().default(""),
+});
+export const ImageManifestSchema = z.object({
+    images: z.record(z.string(), MediaItemSchema),
+});
+export const MediaConfigSchema = z.object({
+    adapter: z.enum(["github"]).default("github"),
+    sizes: z.array(z.number()).default([640, 1080, 1920]),
+    maxFileSize: z.number().default(5242880),
+    quality: z.number().min(1).max(100).default(85),
+});

package/dist/schemas/sections.d.ts

@@ -0,0 +1,12 @@
+import { z } from "zod";
+export interface SectionContent<C = Record<string, unknown>> {
+    type: string;
+    content: C;
+    options?: Record<string, unknown>;
+}
+export interface Section<C = Record<string, unknown>> extends SectionContent<C> {
+    id: string;
+}
+export declare function getSectionContentSchema(): z.ZodType<SectionContent>;
+export declare function getSectionSchema(): z.ZodType<Section>;
+//# sourceMappingURL=sections.d.ts.map

package/dist/schemas/sections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sections.d.ts","sourceRoot":"","sources":["../../src/schemas/sections.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAE,SAAQ,cAAc,CAAC,CAAC,CAAC;IAC7E,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,wBAAgB,uBAAuB,IAAI,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAMnE;AAED,wBAAgB,gBAAgB,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAErD"}

package/dist/schemas/sections.js

@@ -0,0 +1,12 @@
+import { z } from "zod";
+import { getAllSchemas } from "../lib/registry";
+export function getSectionContentSchema() {
+    const schemas = getAllSchemas();
+    if (schemas.length < 2) {
+        throw new Error("At least 2 section schemas must be registered before validation");
+    }
+    return z.union(schemas);
+}
+export function getSectionSchema() {
+    return z.object({ id: z.string() }).and(getSectionContentSchema());
+}

package/dist/schemas/shared.d.ts

@@ -0,0 +1,98 @@
+import { z } from "zod";
+export declare const TextLineSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"heading">;
+    text: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodEnum<{
+        paragraph: "paragraph";
+        paragraph_large: "paragraph_large";
+    }>;
+    text: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"label_value">;
+    label: z.ZodString;
+    text: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodEnum<{
+        list_item_unordered: "list_item_unordered";
+        list_item_ordered: "list_item_ordered";
+    }>;
+    text: z.ZodString;
+}, z.core.$strip>], "type">;
+export type TextLine = z.infer<typeof TextLineSchema>;
+export declare const MediaReferenceSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    imageId: z.ZodDefault<z.ZodString>;
+    caption: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+    background: z.ZodOptional<z.ZodString>;
+    invertFrom: z.ZodOptional<z.ZodString>;
+    border: z.ZodOptional<z.ZodBoolean>;
+    objectFit: z.ZodOptional<z.ZodEnum<{
+        cover: "cover";
+        contain: "contain";
+    }>>;
+    type: z.ZodLiteral<"image">;
+}, z.core.$strip>, z.ZodObject<{
+    imageId: z.ZodDefault<z.ZodString>;
+    caption: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+    background: z.ZodOptional<z.ZodString>;
+    invertFrom: z.ZodOptional<z.ZodString>;
+    border: z.ZodOptional<z.ZodBoolean>;
+    objectFit: z.ZodOptional<z.ZodEnum<{
+        cover: "cover";
+        contain: "contain";
+    }>>;
+    type: z.ZodLiteral<"video">;
+    poster: z.ZodOptional<z.ZodString>;
+    autoplay: z.ZodOptional<z.ZodBoolean>;
+    loop: z.ZodOptional<z.ZodBoolean>;
+    muted: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>, z.ZodObject<{
+    imageId: z.ZodDefault<z.ZodString>;
+    caption: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+    background: z.ZodOptional<z.ZodString>;
+    invertFrom: z.ZodOptional<z.ZodString>;
+    border: z.ZodOptional<z.ZodBoolean>;
+    objectFit: z.ZodOptional<z.ZodEnum<{
+        cover: "cover";
+        contain: "contain";
+    }>>;
+    type: z.ZodLiteral<"doDontImage">;
+    doDont: z.ZodEnum<{
+        do: "do";
+        dont: "dont";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    imageId: z.ZodDefault<z.ZodString>;
+    caption: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+    background: z.ZodOptional<z.ZodString>;
+    invertFrom: z.ZodOptional<z.ZodString>;
+    border: z.ZodOptional<z.ZodBoolean>;
+    objectFit: z.ZodOptional<z.ZodEnum<{
+        cover: "cover";
+        contain: "contain";
+    }>>;
+    type: z.ZodLiteral<"linkedImage">;
+    href: z.ZodString;
+    target: z.ZodOptional<z.ZodString>;
+    linkText: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "type">;
+export type MediaReference = z.infer<typeof MediaReferenceSchema>;
+export declare const HexColorSchema: z.ZodString;
+export declare const ColorSpaceSchema: z.ZodObject<{
+    hex: z.ZodOptional<z.ZodString>;
+    rgb: z.ZodOptional<z.ZodString>;
+    cmyk: z.ZodOptional<z.ZodString>;
+    pantone: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ColorSpace = z.infer<typeof ColorSpaceSchema>;
+export declare const ColorItemSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    spaces: z.ZodArray<z.ZodObject<{
+        hex: z.ZodOptional<z.ZodString>;
+        rgb: z.ZodOptional<z.ZodString>;
+        cmyk: z.ZodOptional<z.ZodString>;
+        pantone: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ColorItem = z.infer<typeof ColorItemSchema>;
+//# sourceMappingURL=shared.d.ts.map

package/dist/schemas/shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../src/schemas/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAwBxB,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;2BAKzB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAoCtD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAE/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAGlE,eAAO,MAAM,cAAc,aAEiC,CAAC;AAE7D,eAAO,MAAM,gBAAgB;;;;;iBAQ5B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,eAAe;;;;;;;;iBAG1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/schemas/shared.js

@@ -0,0 +1,71 @@
+import { z } from "zod";
+// --- Text ---
+const TextHeadingLine = z.object({
+    type: z.literal("heading"),
+    text: z.string(),
+});
+const TextParagraphLine = z.object({
+    type: z.enum(["paragraph", "paragraph_large"]),
+    text: z.string(),
+});
+const TextLabelValueLine = z.object({
+    type: z.literal("label_value"),
+    label: z.string(),
+    text: z.string(),
+});
+const TextListItemLine = z.object({
+    type: z.enum(["list_item_unordered", "list_item_ordered"]),
+    text: z.string(),
+});
+export const TextLineSchema = z.discriminatedUnion("type", [
+    TextHeadingLine,
+    TextParagraphLine,
+    TextLabelValueLine,
+    TextListItemLine,
+]);
+// --- Media References ---
+const BaseMediaRef = z.object({
+    imageId: z.string().default(""),
+    caption: z.union([z.string(), z.array(z.string())]).optional(),
+    background: z.string().optional(),
+    invertFrom: z.string().optional(),
+    border: z.boolean().optional(),
+    objectFit: z.enum(["cover", "contain"]).optional(),
+});
+const ImageRef = BaseMediaRef.extend({
+    type: z.literal("image"),
+});
+const VideoRef = BaseMediaRef.extend({
+    type: z.literal("video"),
+    poster: z.string().optional(),
+    autoplay: z.boolean().optional(),
+    loop: z.boolean().optional(),
+    muted: z.boolean().optional(),
+});
+const DoDontImageRef = BaseMediaRef.extend({
+    type: z.literal("doDontImage"),
+    doDont: z.enum(["do", "dont"]),
+});
+const LinkedImageRef = BaseMediaRef.extend({
+    type: z.literal("linkedImage"),
+    href: z.string(),
+    target: z.string().optional(),
+    linkText: z.string().optional(),
+});
+export const MediaReferenceSchema = z.discriminatedUnion("type", [
+    ImageRef, VideoRef, DoDontImageRef, LinkedImageRef,
+]);
+// --- Colors ---
+export const HexColorSchema = z
+    .string()
+    .regex(/^#[0-9a-fA-F]{6}$/, "must be a 6-digit hex color");
+export const ColorSpaceSchema = z.object({
+    hex: HexColorSchema.optional(),
+    rgb: z.string().optional(),
+    cmyk: z.string().optional(),
+    pantone: z.string().optional(),
+}).refine((data) => data.hex !== undefined || data.rgb !== undefined || data.cmyk !== undefined || data.pantone !== undefined, { message: "At least one color space must be defined" });
+export const ColorItemSchema = z.object({
+    name: z.string().optional(),
+    spaces: z.array(ColorSpaceSchema).min(1),
+});

package/dist/schemas/site-config.d.ts

@@ -0,0 +1,48 @@
+import { z } from "zod";
+export declare const SectionMetaSchema: z.ZodObject<{
+    type: z.ZodString;
+    status: z.ZodEnum<{
+        draft: "draft";
+        published: "published";
+        archived: "archived";
+    }>;
+    access: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type SectionMeta = z.infer<typeof SectionMetaSchema>;
+export declare const IndexSchema: z.ZodObject<{
+    siteId: z.ZodString;
+    order: z.ZodArray<z.ZodString>;
+    sections: z.ZodRecord<z.ZodString, z.ZodObject<{
+        type: z.ZodString;
+        status: z.ZodEnum<{
+            draft: "draft";
+            published: "published";
+            archived: "archived";
+        }>;
+        access: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type SiteIndex = z.infer<typeof IndexSchema>;
+export declare const SiteConfigSchema: z.ZodObject<{
+    siteName: z.ZodDefault<z.ZodString>;
+    primaryColor: z.ZodDefault<z.ZodString>;
+    primaryContrast: z.ZodDefault<z.ZodString>;
+    darkMode: z.ZodDefault<z.ZodEnum<{
+        optional: "optional";
+        light: "light";
+        dark: "dark";
+    }>>;
+    headingFont: z.ZodDefault<z.ZodString>;
+    bodyFont: z.ZodDefault<z.ZodString>;
+    googleFontsUrl: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    media: z.ZodDefault<z.ZodObject<{
+        adapter: z.ZodDefault<z.ZodEnum<{
+            github: "github";
+        }>>;
+        sizes: z.ZodDefault<z.ZodArray<z.ZodNumber>>;
+        maxFileSize: z.ZodDefault<z.ZodNumber>;
+        quality: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type SiteConfig = z.infer<typeof SiteConfigSchema>;
+//# sourceMappingURL=site-config.d.ts.map

package/dist/schemas/site-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-config.d.ts","sourceRoot":"","sources":["../../src/schemas/site-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,iBAAiB;;;;;;;;iBAI5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,WAAW;;;;;;;;;;;;iBAOvB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEpD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;iBAY3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}

package/dist/schemas/site-config.js

@@ -0,0 +1,26 @@
+import { z } from "zod";
+import { MediaConfigSchema } from "./media";
+import { HexColorSchema } from "./shared";
+export const SectionMetaSchema = z.object({
+    type: z.string(),
+    status: z.enum(["draft", "published", "archived"]),
+    access: z.array(z.string()),
+});
+export const IndexSchema = z.object({
+    siteId: z.string(),
+    order: z.array(z.string()),
+    sections: z.record(z.string(), SectionMetaSchema),
+}).refine((data) => data.order.every((id) => id in data.sections), { message: "All order entries must have a corresponding section in sections" });
+export const SiteConfigSchema = z.object({
+    siteName: z.string().default("Brand Portal"),
+    primaryColor: HexColorSchema.default("#009ca6"),
+    primaryContrast: HexColorSchema.default("#f0f0f0"),
+    darkMode: z.enum(["light", "dark", "optional"]).default("light"),
+    headingFont: z.string().default("system-ui"),
+    bodyFont: z.string().default("system-ui"),
+    googleFontsUrl: z.string()
+        .refine(url => url.startsWith("https://fonts.googleapis.com/"), "Must be a Google Fonts URL")
+        .nullable()
+        .default(null),
+    media: MediaConfigSchema.default(MediaConfigSchema.parse({})),
+});

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@drawnagency/primitives",
+  "version": "0.1.0",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./schemas": {
+      "types": "./dist/schemas/index.d.ts",
+      "default": "./dist/schemas/index.js"
+    },
+    "./lib": {
+      "types": "./dist/lib/index.d.ts",
+      "default": "./dist/lib/index.js"
+    },
+    "./auth": {
+      "types": "./dist/auth/index.d.ts",
+      "default": "./dist/auth/index.js"
+    },
+    "./media": {
+      "types": "./dist/media/index.d.ts",
+      "default": "./dist/media/index.js"
+    }
+  },
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "src"
+  ],
+  "peerDependencies": {
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
+  },
+  "dependencies": {
+    "zod": "^4.3.6",
+    "clsx": "^2.1.1",
+    "tailwind-merge": "^3.5.0",
+    "isomorphic-dompurify": "^3.10.0",
+    "lucide-react": "^1.7.0",
+    "jose": "^6.2.2",
+    "dexie": "^4.4.2",
+    "@tiptap/core": "^3.20.4",
+    "@tiptap/extension-link": "^3.20.4",
+    "@tiptap/extension-underline": "^3.20.4",
+    "@tiptap/pm": "^3.20.4",
+    "@tiptap/react": "^3.20.4",
+    "@tiptap/starter-kit": "^3.20.4",
+    "@atlaskit/pragmatic-drag-and-drop": "^1.7.10",
+    "@atlaskit/pragmatic-drag-and-drop-hitbox": "^1.1.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch"
+  }
+}

package/src/auth/cookies.ts

@@ -0,0 +1,51 @@
+import * as jose from "jose";
+import type { Session, CookieLike } from "./types";
+import { requireSessionSecret } from "./security";
+
+export const SESSION_COOKIE = "bp-session";
+export const AUDIENCE_COOKIE = "bp-audience";
+export const SESSION_MAX_AGE_SECONDS = 60 * 60 * 24;
+
+export async function signSessionToken(session: Session): Promise<string> {
+  return new jose.SignJWT({
+    userId: session.userId,
+    email: session.email,
+    role: session.role,
+    siteId: session.siteId,
+  })
+    .setProtectedHeader({ alg: "HS256" })
+    .setExpirationTime(`${SESSION_MAX_AGE_SECONDS}s`)
+    .setIssuedAt()
+    .sign(requireSessionSecret());
+}
+
+export async function verifySessionToken(token: string): Promise<Session | null> {
+  const secret = requireSessionSecret();  // throws on misconfiguration, before try
+  try {
+    const { payload } = await jose.jwtVerify(token, secret);
+    const role = payload.role;
+    if (role !== "owner" && role !== "editor") return null;
+    return {
+      userId: (payload.userId as string) ?? null,
+      email: (payload.email as string) ?? null,
+      role,
+      siteId: payload.siteId as string,
+    };
+  } catch {
+    return null;
+  }
+}
+
+export function setSessionCookie(
+  cookies: CookieLike,
+  token: string,
+  isProduction: boolean,
+): void {
+  cookies.set(SESSION_COOKIE, token, {
+    httpOnly: true,
+    secure: isProduction,
+    sameSite: "lax",
+    path: "/",
+    maxAge: SESSION_MAX_AGE_SECONDS,
+  });
+}

package/src/auth/errors.ts

@@ -0,0 +1,10 @@
+/**
+ * Thrown when a mutation would leave a site with zero owners.
+ * API routes should translate this to HTTP 409 Conflict with the message.
+ */
+export class LastOwnerError extends Error {
+  constructor(message = "Cannot remove the last owner") {
+    super(message);
+    this.name = "LastOwnerError";
+  }
+}

package/src/auth/index.ts

@@ -0,0 +1,15 @@
+export type {
+  Role,
+  Session,
+  SiteUser,
+  Audience,
+  SignInMethod,
+  SignInResult,
+  AuthProvider,
+  CookieLike,
+  AuthContext,
+} from "./types";
+
+export { requireSessionSecret, isSameOriginRequest, safeNextPath } from "./security";
+export { signSessionToken, verifySessionToken, setSessionCookie, SESSION_COOKIE, AUDIENCE_COOKIE, SESSION_MAX_AGE_SECONDS } from "./cookies";
+export { LastOwnerError } from "./errors";

package/src/auth/security.ts

@@ -0,0 +1,44 @@
+/**
+ * Shared auth security primitives: session secret loader, same-origin check,
+ * redirect-path validator. Imported by cookies.ts, middleware, and auth API routes.
+ */
+
+export function requireSessionSecret(): Uint8Array {
+  const secret = import.meta.env.SESSION_SECRET;
+  if (!secret) {
+    throw new Error("SESSION_SECRET is required but not set");
+  }
+  const bytes = new TextEncoder().encode(secret);
+  if (bytes.byteLength < 32) {
+    throw new Error("SESSION_SECRET must be at least 32 bytes");
+  }
+  return bytes;
+}
+
+/**
+ * Same-origin check for CSRF protection on state-changing requests.
+ * Combine with an HTTP-method guard at the call site — this does not
+ * discriminate between safe (GET/HEAD) and unsafe methods.
+ */
+export function isSameOriginRequest(request: Request): boolean {
+  const origin = request.headers.get("Origin");
+  const referer = request.headers.get("Referer");
+  const source = origin ?? referer;
+  if (!source) return false;
+  try {
+    const sourceOrigin = new URL(source).origin;
+    const requestOrigin = new URL(request.url).origin;
+    return sourceOrigin === requestOrigin;
+  } catch {
+    return false;
+  }
+}
+
+export function safeNextPath(next: string | null | undefined): string | null {
+  if (!next) return null;
+  if (!next.startsWith("/")) return null;
+  if (next.startsWith("//")) return null;
+  if (next.includes("\\")) return null;
+  if (/[\x00-\x1f]/.test(next)) return null;
+  return next;
+}

package/src/auth/types.ts

@@ -0,0 +1,61 @@
+export type { Role, Session, SiteUser, Audience } from "../schemas/auth";
+import type { Role, Session, SiteUser, Audience } from "../schemas/auth";
+
+export type SignInMethod =
+  | { type: "oauth"; provider: "google" | "github" }
+  | { type: "email"; email: string; password: string }
+  | { type: "password"; password: string };
+
+export type SignInResult =
+  | { success: true; session: Session; token: string }
+  | { success: true; redirectUrl: string }
+  | { success: false; error: string };
+
+export interface AuthProvider {
+  capabilities: {
+    oauth: boolean;
+    emailPassword: boolean;
+    passwordOnly: boolean;
+    userManagement: boolean;
+    audienceManagement: boolean;
+    passwordToggle: boolean;
+  };
+  oauthProviders?: ("google" | "github")[];
+
+  resolveSession(ctx: AuthContext): Promise<Session | null>;
+  signIn(method: SignInMethod, ctx: AuthContext): Promise<SignInResult>;
+  signOut(ctx: AuthContext): Promise<void>;
+
+  listSiteUsers?(): Promise<SiteUser[]>;
+  inviteUser?(email: string, role: Role): Promise<void>;
+  revokeUser?(userId: string): Promise<void>;
+
+  listAudiences(): Promise<Audience[]>;
+  verifyAudiencePassword(name: string, password: string): Promise<boolean>;
+
+  // Optional — single-row lookup (present when the adapter can efficiently query one audience).
+  getAudience?(name: string): Promise<Audience | null>;
+
+  // Optional — present only when capabilities.audienceManagement === true
+  createAudience?(displayName: string, color: string | null, password: string): Promise<void>;
+  setAudiencePassword?(name: string, password: string): Promise<void>;
+  setAudienceColor?(name: string, color: string | null): Promise<void>;
+  setAudienceDisplayName?(name: string, displayName: string): Promise<void>;
+  deleteAudience?(name: string): Promise<void>;
+
+  getPasswordEnabled(): Promise<boolean>;
+  setPasswordEnabled?(enabled: boolean): Promise<void>;
+
+  handleCallback?(request: Request, ctx: AuthContext): Promise<Response>;
+}
+
+export interface CookieLike {
+  get(name: string): { value: string } | undefined;
+  set(name: string, value: string, options?: Record<string, unknown>): void;
+  delete(name: string): void;
+}
+
+export interface AuthContext {
+  cookies: CookieLike;
+  cookieHeader: string;
+}