@drawnagency/primitives 0.1.104 → 0.1.106

package/dist/auth/cookies.d.ts

@@ -5,7 +5,27 @@ export declare const SESSION_MAX_AGE_SECONDS: number;
 export declare const AUDIENCE_MAX_AGE_SECONDS: number;
 export declare function signSessionToken(session: Session): Promise<string>;
 export declare function verifySessionToken(token: string): Promise<Session | null>;
-export declare function signAudienceToken(audience: string): Promise<string>;
+export declare function signAudienceToken(audience: string, isDefault?: boolean, username?: string | null): Promise<string>;
+export interface AudienceClaims {
+    audience: string;
+    /** Is this the site's default audience? Gates the Audience Details page. */
+    isDefault: boolean;
+    /**
+     * The named sign-in used, in credential mode. Null in `.env`/audience mode,
+     * and on any cookie issued before credentials shipped. Drives the sidebar's
+     * "Logged in as" label and the reveal audit log — NOT any access decision,
+     * which stays keyed on the audience.
+     */
+    username: string | null;
+}
+/**
+ * Full audience claims. The `isDefault` claim exists so a viewer page can gate
+ * the Audience Details link without a per-render lookup of the audience list.
+ * A cookie issued before the claim shipped reads as `false` — the viewer sees
+ * the link after their next login, which is at most AUDIENCE_MAX_AGE_SECONDS
+ * away, so no compatibility path is needed.
+ */
+export declare function verifyAudienceClaims(token: string): Promise<AudienceClaims | null>;
 export declare function verifyAudienceToken(token: string): Promise<string | null>;
 export declare function setSessionCookie(cookies: CookieLike, token: string, isProduction: boolean): void;
 //# sourceMappingURL=cookies.d.ts.map

package/dist/auth/cookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/auth/cookies.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAGnD,eAAO,MAAM,cAAc,eAAe,CAAC;AAC3C,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAC7C,eAAO,MAAM,uBAAuB,QAAe,CAAC;AAMpD,eAAO,MAAM,wBAAwB,QAAe,CAAC;AAErD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAWxE;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAe/E;AAMD,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMzE;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAS/E;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,OAAO,GACpB,IAAI,CAQN"}
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/auth/cookies.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAGnD,eAAO,MAAM,cAAc,eAAe,CAAC;AAC3C,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAC7C,eAAO,MAAM,uBAAuB,QAAe,CAAC;AAMpD,eAAO,MAAM,wBAAwB,QAAe,CAAC;AAErD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAWxE;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAe/E;AAMD,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,SAAS,UAAQ,EACjB,QAAQ,GAAE,MAAM,GAAG,IAAW,GAC7B,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAcxF;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE/E;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,OAAO,GACpB,IAAI,CAQN"}

package/dist/auth/index.d.ts

@@ -2,6 +2,7 @@ export type { Role, Session, SiteUser, Audience, SignInMethod, SignInResult, Tok
 export type { UiCapabilities } from "./capabilities";
 export { deriveUiCapabilities } from "./capabilities";
 export { requireSessionSecret, isSameOriginRequest, safeNextPath } from "./security";
-export { signSessionToken, verifySessionToken, signAudienceToken, verifyAudienceToken, setSessionCookie, SESSION_COOKIE, AUDIENCE_COOKIE, SESSION_MAX_AGE_SECONDS, AUDIENCE_MAX_AGE_SECONDS } from "./cookies";
+export { signSessionToken, verifySessionToken, signAudienceToken, verifyAudienceToken, verifyAudienceClaims, setSessionCookie, SESSION_COOKIE, AUDIENCE_COOKIE, SESSION_MAX_AGE_SECONDS, AUDIENCE_MAX_AGE_SECONDS } from "./cookies";
+export type { AudienceClaims } from "./cookies";
 export { LastOwnerError, SessionExpiredError } from "./errors";
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,IAAI,EACJ,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,WAAW,GACZ,MAAM,SAAS,CAAC;AAEjB,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAC/M,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,IAAI,EACJ,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,WAAW,GACZ,MAAM,SAAS,CAAC;AAEjB,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AACrO,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC"}

package/dist/auth/index.js

@@ -9,9 +9,10 @@ import {
   setSessionCookie,
   signAudienceToken,
   signSessionToken,
+  verifyAudienceClaims,
   verifyAudienceToken,
   verifySessionToken
-} from "../chunk-EM5DFHDZ.js";
+} from "../chunk-GEENI3OC.js";
 import {
   isSameOriginRequest,
   requireSessionSecret,
@@ -33,6 +34,7 @@ export {
   setSessionCookie,
   signAudienceToken,
   signSessionToken,
+  verifyAudienceClaims,
   verifyAudienceToken,
   verifySessionToken
 };

package/dist/auth/types.d.ts

@@ -1,5 +1,7 @@
 export type { Role, Session, SiteUser, Audience } from "../schemas/auth";
 import type { Role, Session, SiteUser, Audience } from "../schemas/auth";
+export type { ViewerCredential } from "../schemas/audience";
+import type { ViewerCredential } from "../schemas/audience";
 export type SignInMethod = {
     type: "oauth";
     provider: "google" | "github";
@@ -44,6 +46,32 @@ export interface AuthProvider {
         list(): Promise<Audience[]>;
         verify(name: string, password: string): Promise<boolean>;
         get?(name: string): Promise<Audience | null>;
+        credentials?: {
+            /** Every credential on the site, each carrying the audience it grants. */
+            list(): Promise<ViewerCredential[]>;
+            /**
+             * Authenticate a viewer login. Returns the audience to put in the cookie,
+             * or ONE uniform null for both an unknown username and a wrong password —
+             * the login page must not become a username oracle.
+             */
+            verify(username: string, password: string): Promise<{
+                audienceName: string;
+                isDefault: boolean;
+            } | null>;
+            /**
+             * Show an existing password. Returns null for "not revealable": no sealed
+             * copy (predates the feature, or a writer skipped it), an unopenable seal
+             * (rotated SESSION_SECRET), or a seal that no longer matches
+             * `password_hash`. That last check is what stops a stale seal being shown
+             * as the live password — any implementation MUST verify against the hash
+             * before returning.
+             */
+            reveal(username: string): Promise<string | null>;
+            create(audienceName: string, username: string, label: string | null, password: string): Promise<void>;
+            setPassword(username: string, password: string): Promise<void>;
+            setLabel(username: string, label: string | null): Promise<void>;
+            delete(username: string): Promise<void>;
+        };
         manage?: {
             create(displayName: string, color: string | null, password: string): Promise<void>;
             setPassword(name: string, password: string): Promise<void>;

package/dist/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEzE,MAAM,MAAM,YAAY,GAIpB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C,MAAM,MAAM,YAAY,GACpB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC;AAEhE,MAAM,MAAM,mBAAmB,GAC3B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC,MAAM,WAAW,YAAY;IAE3B,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC1D,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAKzC,aAAa,EAAE;QACb,KAAK,CAAC,EAAE,CAAC,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC;QAChC,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,YAAY,CAAC,EAAE,OAAO,CAAC;KACxB,CAAC;IAGF,SAAS,EAAE;QACT,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACzD,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;QAE7C,MAAM,CAAC,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YACnF,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3D,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5D,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YACjE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;SACrC,CAAC;KACH,CAAC;IAIF,eAAe,EAAE;QACf,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;QACxB,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACvC,CAAC;IAGF,cAAc,CAAC,EAAE;QACf,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACvC,CAAC;IAGF,cAAc,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,mBAAmB,CAAC,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACrJ,cAAc,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,aAAa,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IACjD,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1E,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,UAAU,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACzE,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,MAAM,MAAM,YAAY,GAIpB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C,MAAM,MAAM,YAAY,GACpB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC;AAEhE,MAAM,MAAM,mBAAmB,GAC3B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC,MAAM,WAAW,YAAY;IAE3B,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC1D,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAKzC,aAAa,EAAE;QACb,KAAK,CAAC,EAAE,CAAC,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC;QAChC,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,YAAY,CAAC,EAAE,OAAO,CAAC;KACxB,CAAC;IAGF,SAAS,EAAE;QACT,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACzD,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;QAQ7C,WAAW,CAAC,EAAE;YACZ,0EAA0E;YAC1E,IAAI,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACpC;;;;eAIG;YACH,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;gBAAE,YAAY,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,OAAO,CAAA;aAAE,GAAG,IAAI,CAAC,CAAC;YACzG;;;;;;;eAOG;YACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;YACjD,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YACtG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAChE,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;SACzC,CAAC;QAEF,MAAM,CAAC,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YACnF,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3D,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5D,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YACjE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;SACrC,CAAC;KACH,CAAC;IAIF,eAAe,EAAE;QACf,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;QACxB,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACvC,CAAC;IAGF,cAAc,CAAC,EAAE;QACf,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACvC,CAAC;IAGF,cAAc,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,mBAAmB,CAAC,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACrJ,cAAc,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,aAAa,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IACjD,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1E,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,UAAU,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB"}

package/dist/{chunk-PTOLUMGV.js → chunk-4RNF2DRG.js}

@@ -21,6 +21,7 @@ var historyRestoreFailedEvent = createEvent("history-restore-failed");
 var editorDirtyEvent = createEvent("editor-dirty");
 var siteNavChangeEvent = createEvent("sitenavchange-v2");
 var pageSelectEvent = createEvent("pageselect");
+var audienceDetailsEvent = createEvent("audiencedetailsopen");
 
 export {
   createEvent,

package/dist/{chunk-MUTHF2GT.js → chunk-5IZ2KTMU.js}

@@ -6,10 +6,10 @@ import {
   SettingsIcon,
   useMediaLibrary,
   useResolvedMedia
-} from "./chunk-26ALJO4K.js";
+} from "./chunk-D6TLUVOP.js";
 import {
   rebindImageRef
-} from "./chunk-3COSXTOY.js";
+} from "./chunk-XBYJQ5RS.js";
 import {
   cn
 } from "./chunk-7EOSDFS3.js";

package/dist/{chunk-LZKVV4K2.js → chunk-6P4CJCXB.js}

@@ -18,8 +18,14 @@ var AudienceSchema = z.object({
   displayName: z.string(),
   color: z.string().nullable(),
   readonly: z.boolean(),
+  /** Some way in exists: a credential in credential mode, an audience-level
+   *  password in `.env` mode. Consumers that only ask "is this gated?" (admin
+   *  dashboard, MCP) keep using this and need no knowledge of credentials. */
   hasPassword: z.boolean(),
-  isDefault: z.boolean()
+  isDefault: z.boolean(),
+  /** Named sign-ins pointing at this audience. Always 0 in `.env` mode, which
+   *  has no credentials — use `hasPassword` there. */
+  credentialCount: z.number().int().nonnegative().default(0)
 });
 
 export {

package/dist/{chunk-CZLYECHC.js → chunk-AB3XVXI3.js}

@@ -1,9 +1,9 @@
-import {
-  safeNextPath
-} from "./chunk-S2L3BPLS.js";
 import {
   upgradeLegacySection
 } from "./chunk-5BM2Y3NJ.js";
+import {
+  safeNextPath
+} from "./chunk-S2L3BPLS.js";
 import {
   NavEntrySchema
 } from "./chunk-REDDTTGJ.js";
@@ -15,7 +15,7 @@ import {
 } from "./chunk-VKAGMEKE.js";
 import {
   IndexSchema
-} from "./chunk-BGHWUJFV.js";
+} from "./chunk-BOZUEKWL.js";
 import {
   MAX_BLOCK_DEPTH,
   blockDepth

package/dist/chunk-B7VBSE5X.js

@@ -0,0 +1,12 @@
+// src/schemas/media-grid-options.ts
+import { z } from "zod";
+var MediaGridOptionsSchema = z.object({
+  square: z.boolean().optional(),
+  border: z.boolean().optional(),
+  crop: z.boolean().optional(),
+  showCaptions: z.boolean().optional()
+}).default({});
+
+export {
+  MediaGridOptionsSchema
+};

package/dist/{chunk-BGHWUJFV.js → chunk-BOZUEKWL.js}

@@ -1,159 +1,100 @@
 import {
   documentOptionsSchema
 } from "./chunk-FM4M4Q2W.js";
-
-// src/schemas/shared.ts
-import { z } from "zod";
-var TextHeadingLine = z.object({
-  type: z.literal("heading"),
-  text: z.string()
-});
-var TextParagraphLine = z.object({
-  type: z.enum(["paragraph", "paragraph_large"]),
-  text: z.string()
-});
-var TextLabelValueLine = z.object({
-  type: z.literal("label_value"),
-  label: z.string(),
-  text: z.string()
-});
-var TextListItemLine = z.object({
-  type: z.enum(["list_item_unordered", "list_item_ordered"]),
-  text: z.string()
-});
-var TextLineSchema = z.discriminatedUnion("type", [
-  TextHeadingLine,
-  TextParagraphLine,
-  TextLabelValueLine,
-  TextListItemLine
-]);
-var BaseMediaRef = z.object({
-  imageId: z.string().default("").describe("Media-library id of the image/video asset."),
-  caption: z.union([z.string(), z.array(z.string())]).optional().describe("Optional caption: a single string, or multiple lines as an array of strings."),
-  background: z.string().optional().describe("Optional CSS background color/value shown behind a transparent image."),
-  invertFrom: z.string().optional().describe("Optional CSS color; the image inverts when the page background matches it (e.g. for dark-mode logo swaps)."),
-  border: z.boolean().optional().describe("When true, draw a border around the media."),
-  objectFit: z.enum(["cover", "contain"]).optional().describe("How the image fills its box: 'contain' (fit whole image) or 'cover' (fill and crop).")
-});
-var ImageRef = BaseMediaRef.extend({
-  type: z.literal("image")
-});
-var VideoRef = BaseMediaRef.extend({
-  type: z.literal("video"),
-  poster: z.string().optional().describe("Optional poster-image URL shown before playback starts."),
-  autoplay: z.boolean().optional().describe("When true, the video starts playing automatically."),
-  loop: z.boolean().optional().describe("When true, the video repeats when it finishes."),
-  muted: z.boolean().optional().describe("When true, the video plays without sound.")
-});
-var DoDontImageRef = BaseMediaRef.extend({
-  type: z.literal("doDontImage"),
-  doDont: z.enum(["do", "dont"]).describe("Whether this is a 'do' (correct) or 'dont' (incorrect) example.")
-});
-var LinkedImageRef = BaseMediaRef.extend({
-  type: z.literal("linkedImage"),
-  href: z.string().describe("URL the image links to."),
-  target: z.string().optional().describe("Link target, e.g. '_self' or '_blank'."),
-  linkText: z.string().optional().describe("Optional accessible link text/label.")
-});
-var MediaReferenceSchema = z.discriminatedUnion("type", [
-  ImageRef,
-  VideoRef,
-  DoDontImageRef,
-  LinkedImageRef
-]);
-var SingleMediaReferenceSchema = z.discriminatedUnion("type", [ImageRef, VideoRef]);
-var HexColorSchema = z.string().regex(/^#[0-9a-fA-F]{6}$/, "must be a 6-digit hex color");
-var FontNameSchema = z.string().max(120).regex(/^[a-zA-Z0-9 ,'"-]+$/, "contains invalid font-name characters");
+import {
+  FontNameSchema,
+  HexColorSchema
+} from "./chunk-GGXZZ77Z.js";
 
 // src/schemas/media.ts
-import { z as z2 } from "zod";
-var VariantSchema = z2.object({
-  width: z2.number().int().positive(),
-  height: z2.number().int().positive(),
-  size: z2.number().int().nonnegative()
+import { z } from "zod";
+var VariantSchema = z.object({
+  width: z.number().int().positive(),
+  height: z.number().int().positive(),
+  size: z.number().int().nonnegative()
 });
-var MediaFolderSchema = z2.object({
-  name: z2.string().min(1),
-  parentId: z2.string().nullable()
+var MediaFolderSchema = z.object({
+  name: z.string().min(1),
+  parentId: z.string().nullable()
   // null = root
 });
-var MediaItemSchema = z2.object({
-  id: z2.string(),
-  hash: z2.string(),
-  kind: z2.enum(["image", "animated", "video"]),
-  originalName: z2.string(),
-  width: z2.number().int().positive(),
-  height: z2.number().int().positive(),
-  mimeType: z2.string(),
-  size: z2.number().int().nonnegative(),
-  folder: z2.string(),
-  variants: z2.array(VariantSchema),
-  alt: z2.string().default(""),
+var MediaItemSchema = z.object({
+  id: z.string(),
+  hash: z.string(),
+  kind: z.enum(["image", "animated", "video"]),
+  originalName: z.string(),
+  width: z.number().int().positive(),
+  height: z.number().int().positive(),
+  mimeType: z.string(),
+  size: z.number().int().nonnegative(),
+  folder: z.string(),
+  variants: z.array(VariantSchema),
+  alt: z.string().default(""),
   // Where the original bytes live. "github" = committed to the repo (images,
   // small loops); "assets" = large original in the AssetStore bucket. Legacy
   // manifests have no field — default keeps them on the git path.
-  storage: z2.enum(["github", "assets"]).default("github"),
+  storage: z.enum(["github", "assets"]).default("github"),
   // Public CDN URL for assets-backed originals, baked at upload time so
   // resolution needs no env access in the browser or at SSR.
-  url: z2.string().optional(),
+  url: z.string().optional(),
   // Seconds; videos only. Informational (library UI).
-  duration: z2.number().positive().optional(),
+  duration: z.number().positive().optional(),
   // Display folder (MediaFolderSchema key). Absent = root/unfiled. NOT the
   // git storage dir — that's `folder` above, which never changes.
-  folderId: z2.string().optional(),
+  folderId: z.string().optional(),
   // System-generated assets (e.g. the Phase 3 social-preview raster) set this
   // so the media-library UI can exclude them. Absent on all user uploads.
-  hidden: z2.boolean().optional()
+  hidden: z.boolean().optional()
 });
-var ImageManifestSchema = z2.object({
-  images: z2.record(z2.string(), MediaItemSchema),
-  folders: z2.record(z2.string(), MediaFolderSchema).default({})
+var ImageManifestSchema = z.object({
+  images: z.record(z.string(), MediaItemSchema),
+  folders: z.record(z.string(), MediaFolderSchema).default({})
 });
-var MediaConfigSchema = z2.object({
-  sizes: z2.array(z2.number()).default([640, 1080, 1920]),
-  maxFileSize: z2.number().default(5242880),
-  quality: z2.number().min(1).max(100).default(85),
+var MediaConfigSchema = z.object({
+  sizes: z.array(z.number()).default([640, 1080, 1920]),
+  maxFileSize: z.number().default(5242880),
+  quality: z.number().min(1).max(100).default(85),
   // Per-file cap for bucket-backed video uploads (bytes). The git-path cap is
   // maxFileSize; anything between the two routes to the AssetStore.
-  maxAssetSize: z2.number().default(209715200)
+  maxAssetSize: z.number().default(209715200)
 });
 
 // src/schemas/site-config.ts
-import { z as z3 } from "zod";
+import { z as z2 } from "zod";
 
 // src/lib/corner-radius.ts
 var CORNER_RADIUS_OPTIONS = ["none", "small", "medium", "large"];
 
 // src/schemas/site-config.ts
-var StatusSchema = z3.enum(["draft", "live", "archived", "published"]).transform(
+var StatusSchema = z2.enum(["draft", "live", "archived", "published"]).transform(
   (val) => val === "published" ? "live" : val
 );
-var SectionMetaSchema = z3.object({
-  type: z3.string(),
+var SectionMetaSchema = z2.object({
+  type: z2.string(),
   status: StatusSchema,
-  access: z3.array(z3.string())
+  access: z2.array(z2.string())
 });
-var RESERVED_SLUGS = ["edit", "api", "login", "set-password", "404", "present", "print"];
+var RESERVED_SLUGS = ["edit", "api", "login", "set-password", "404", "present", "print", "audiences"];
 var PARSE_REJECTED_SLUGS = ["edit", "api", "login", "set-password", "404"];
-var PageStatusSchema = z3.enum(["live", "archived"]);
-var PageSchema = z3.object({
-  id: z3.string().min(1),
-  title: z3.string(),
-  slug: z3.string(),
-  isHome: z3.boolean(),
-  showInNav: z3.boolean(),
+var PageStatusSchema = z2.enum(["live", "archived"]);
+var PageSchema = z2.object({
+  id: z2.string().min(1),
+  title: z2.string(),
+  slug: z2.string(),
+  isHome: z2.boolean(),
+  showInNav: z2.boolean(),
   status: PageStatusSchema,
-  access: z3.array(z3.string()),
-  order: z3.array(z3.string()),
+  access: z2.array(z2.string()),
+  order: z2.array(z2.string()),
   document: documentOptionsSchema.optional()
 });
 var SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-var RawIndexSchema = z3.object({
-  siteId: z3.string(),
-  order: z3.array(z3.string()).optional(),
-  pages: z3.array(PageSchema).optional(),
-  sections: z3.record(z3.string(), SectionMetaSchema),
-  lastModified: z3.string().nullable().optional()
+var RawIndexSchema = z2.object({
+  siteId: z2.string(),
+  order: z2.array(z2.string()).optional(),
+  pages: z2.array(PageSchema).optional(),
+  sections: z2.record(z2.string(), SectionMetaSchema),
+  lastModified: z2.string().nullable().optional()
 });
 function normalizeRawIndex(data) {
   if (data.pages && data.pages.length > 0) {
@@ -183,34 +124,34 @@ function normalizeRawIndex(data) {
     lastModified: data.lastModified ?? null
   };
 }
-var CanonicalIndexSchema = z3.object({
-  siteId: z3.string(),
-  pages: z3.array(PageSchema),
-  sections: z3.record(z3.string(), SectionMetaSchema),
-  lastModified: z3.string().nullable().optional()
+var CanonicalIndexSchema = z2.object({
+  siteId: z2.string(),
+  pages: z2.array(PageSchema),
+  sections: z2.record(z2.string(), SectionMetaSchema),
+  lastModified: z2.string().nullable().optional()
 }).superRefine((data, ctx) => {
   const homes = data.pages.filter((p) => p.isHome);
   if (homes.length !== 1) {
-    ctx.addIssue({ code: z3.ZodIssueCode.custom, message: "Exactly one page must be the home page" });
+    ctx.addIssue({ code: z2.ZodIssueCode.custom, message: "Exactly one page must be the home page" });
   }
   if (homes[0]?.status === "archived") {
-    ctx.addIssue({ code: z3.ZodIssueCode.custom, message: "The home page cannot be archived" });
+    ctx.addIssue({ code: z2.ZodIssueCode.custom, message: "The home page cannot be archived" });
   }
   if (homes[0] && homes[0].slug !== "") {
-    ctx.addIssue({ code: z3.ZodIssueCode.custom, message: "The home page slug must be empty" });
+    ctx.addIssue({ code: z2.ZodIssueCode.custom, message: "The home page slug must be empty" });
   }
   const seenSlugs = /* @__PURE__ */ new Set();
   for (const p of data.pages) {
     if (!p.isHome) {
       if (!SLUG_RE.test(p.slug)) {
-        ctx.addIssue({ code: z3.ZodIssueCode.custom, message: `Invalid slug "${p.slug}"` });
+        ctx.addIssue({ code: z2.ZodIssueCode.custom, message: `Invalid slug "${p.slug}"` });
       }
       if (PARSE_REJECTED_SLUGS.includes(p.slug)) {
-        ctx.addIssue({ code: z3.ZodIssueCode.custom, message: `Slug "${p.slug}" is reserved` });
+        ctx.addIssue({ code: z2.ZodIssueCode.custom, message: `Slug "${p.slug}" is reserved` });
       }
     }
     if (seenSlugs.has(p.slug)) {
-      ctx.addIssue({ code: z3.ZodIssueCode.custom, message: `Duplicate slug "${p.slug}"` });
+      ctx.addIssue({ code: z2.ZodIssueCode.custom, message: `Duplicate slug "${p.slug}"` });
     }
     seenSlugs.add(p.slug);
   }
@@ -225,21 +166,21 @@ var CanonicalIndexSchema = z3.object({
   const duplicated = [...counts].filter(([, n]) => n > 1).map(([id]) => id);
   if (duplicated.length > 0) {
     ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       message: `Section id(s) appear in more than one page order: ${fmtIds(duplicated)}`
     });
   }
   const orderedNotInSections = [...fromPagesSet].filter((id) => !sectionSet.has(id));
   if (orderedNotInSections.length > 0) {
     ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       message: `Section id(s) in a page order but missing from sections{}: ${fmtIds(orderedNotInSections)}`
     });
   }
   const sectionsNotOrdered = sectionKeys.filter((id) => !fromPagesSet.has(id));
   if (sectionsNotOrdered.length > 0) {
     ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       message: `Section id(s) in sections{} but not in any page order: ${fmtIds(sectionsNotOrdered)}`
     });
   }
@@ -248,51 +189,51 @@ var IndexSchema = RawIndexSchema.transform(normalizeRawIndex).pipe(CanonicalInde
 function normalizeSiteIndex(raw) {
   return IndexSchema.parse(raw);
 }
-var ChatbotTaskIdSchema = z3.string().min(1).max(32).regex(
+var ChatbotTaskIdSchema = z2.string().min(1).max(32).regex(
   /^[a-z0-9](?:[a-z0-9_-]*[a-z0-9])?$/,
   "Task id must be lowercase letters, numbers, dashes, or underscores"
 );
-var ChatbotTaskSchema = z3.object({
+var ChatbotTaskSchema = z2.object({
   id: ChatbotTaskIdSchema,
-  label: z3.string().min(1).max(60),
-  prompt: z3.string().max(4e3),
+  label: z2.string().min(1).max(60),
+  prompt: z2.string().max(4e3),
   // Audience names allowed to see this task; [] = all — same semantics as SectionMeta.access.
-  access: z3.array(z3.string()).default([])
+  access: z2.array(z2.string()).default([])
 });
-var ChatbotConfigSchema = z3.object({
-  enabled: z3.boolean().default(false),
+var ChatbotConfigSchema = z2.object({
+  enabled: z2.boolean().default(false),
   // Assistant display name shown in the widget header and used in the system
   // prompt. Blank falls back to "Portal Assistant" (resolveChatbotName).
-  name: z3.string().max(60).default("Portal Assistant"),
+  name: z2.string().max(60).default("Portal Assistant"),
   // Per-audience name overrides, keyed by audience name — same inert-when-
   // deselected semantics as audiencePrompts.
-  audienceNames: z3.record(z3.string(), z3.string().max(60)).default({}),
+  audienceNames: z2.record(z2.string(), z2.string().max(60)).default({}),
   // Brand-flavored waiting phrases, shown (with "…" appended) while the
   // assistant streams no text yet. Empty = the widget's "Thinking…" default.
-  thinkingPhrases: z3.array(z3.string().max(80)).max(30).default([]),
-  systemPrompt: z3.string().max(8e3).default(""),
+  thinkingPhrases: z2.array(z2.string().max(80)).max(30).default([]),
+  systemPrompt: z2.string().max(8e3).default(""),
   // Audience names the widget is shown to — strict opt-in: [] = no viewer
   // sees it (editors always can via /edit). Gates: [...slug].astro + /api/chat.
-  audiences: z3.array(z3.string()).default([]),
+  audiences: z2.array(z2.string()).default([]),
   // Per-audience prompt overlays, keyed by audience name. Appended AFTER the
   // base systemPrompt, and ONLY for requests whose session audience matches
   // (or an editor's explicit test-panel simulation) — enforced in
   // assembleBrandChat. Keys are not validated against the audience list:
   // entries for deselected/renamed audiences are inert (strict opt-in means
   // those audiences cannot chat at all).
-  audiencePrompts: z3.record(z3.string(), z3.string().max(8e3)).default({}),
-  tasks: z3.array(ChatbotTaskSchema).max(20).default([])
+  audiencePrompts: z2.record(z2.string(), z2.string().max(8e3)).default({}),
+  tasks: z2.array(ChatbotTaskSchema).max(20).default([])
 }).superRefine((cfg, ctx) => {
   const seen = /* @__PURE__ */ new Set();
   for (const t of cfg.tasks) {
     if (seen.has(t.id)) {
-      ctx.addIssue({ code: z3.ZodIssueCode.custom, message: `Duplicate task id "${t.id}"` });
+      ctx.addIssue({ code: z2.ZodIssueCode.custom, message: `Duplicate task id "${t.id}"` });
     }
     seen.add(t.id);
   }
 });
-var SiteConfigSchema = z3.object({
-  siteName: z3.string().default("Brand Portal"),
+var SiteConfigSchema = z2.object({
+  siteName: z2.string().default("Brand Portal"),
   primaryColor: HexColorSchema.default("#009ca6"),
   primaryContrast: HexColorSchema.default("#f0f0f0"),
   // Dark-mode overrides for the brand primary / accent. Only applied when
@@ -301,28 +242,28 @@ var SiteConfigSchema = z3.object({
   // CSS light-dark() function (see lib/theme-vars.ts).
   primaryColorDark: HexColorSchema.nullable().default(null),
   primaryContrastDark: HexColorSchema.nullable().default(null),
-  darkMode: z3.enum(["light", "dark", "optional"]).default("light"),
+  darkMode: z2.enum(["light", "dark", "optional"]).default("light"),
   // Maps to the --radius-outer design token (see lib/corner-radius.ts);
   // defaults so pre-existing site-config.json files keep parsing.
-  cornerRadius: z3.enum(CORNER_RADIUS_OPTIONS).default("medium"),
+  cornerRadius: z2.enum(CORNER_RADIUS_OPTIONS).default("medium"),
   headingFont: FontNameSchema.default("system-ui"),
   bodyFont: FontNameSchema.default("system-ui"),
-  uppercaseHeadings: z3.boolean().default(true),
-  uppercaseSubheadings: z3.boolean().default(true),
-  uppercaseNavHeadings: z3.boolean().default(true),
-  googleFontsUrl: z3.string().refine((url) => url.startsWith("https://fonts.googleapis.com/"), "Must be a Google Fonts URL").nullable().default(null),
+  uppercaseHeadings: z2.boolean().default(true),
+  uppercaseSubheadings: z2.boolean().default(true),
+  uppercaseNavHeadings: z2.boolean().default(true),
+  googleFontsUrl: z2.string().refine((url) => url.startsWith("https://fonts.googleapis.com/"), "Must be a Google Fonts URL").nullable().default(null),
   // Favicon stored as a data URL (SVG/PNG, small) so it travels with
   // site-config.json — no media manifest or CDN round-trip needed.
-  favicon: z3.string().refine((v) => v.startsWith("data:image/"), "Favicon must be an image data URL").nullable().default(null),
+  favicon: z2.string().refine((v) => v.startsWith("data:image/"), "Favicon must be an image data URL").nullable().default(null),
   // Optional site logo, stored as media-library references (so it participates
   // in usage tracking + GC protection, and its resolved URL is reusable for the
   // Phase 3 social-preview image). Every field defaults so pre-existing
   // site-config.json files keep parsing.
-  logo: z3.object({
-    light: z3.object({ imageId: z3.string() }),
-    dark: z3.object({ imageId: z3.string() }).nullable().default(null),
-    invertInDark: z3.boolean().default(false),
-    showInNav: z3.boolean().default(true)
+  logo: z2.object({
+    light: z2.object({ imageId: z2.string() }),
+    dark: z2.object({ imageId: z2.string() }).nullable().default(null),
+    invertInDark: z2.boolean().default(false),
+    showInNav: z2.boolean().default(true)
   }).nullable().default(null),
   media: MediaConfigSchema.default(MediaConfigSchema.parse({})),
   // Composed social-preview raster, stored as a media-library reference so it
@@ -331,17 +272,17 @@ var SiteConfigSchema = z3.object({
   // (the /api/media route only serves exact generated-variant widths), so the
   // og:image URL + dimensions are correct. Defaults null so pre-existing
   // configs keep parsing and sites without a preview emit no og:image tags.
-  previewImage: z3.object({
-    imageId: z3.string(),
-    width: z3.number().int().positive(),
-    height: z3.number().int().positive(),
+  previewImage: z2.object({
+    imageId: z2.string(),
+    width: z2.number().int().positive(),
+    height: z2.number().int().positive(),
     // Compose-logic version that produced this raster. Pre-existing rasters
     // (and manifests written before this field) default to 0, which is below
     // any current PREVIEW_COMPOSE_VERSION, so the editor regenerates them.
-    version: z3.number().int().nonnegative().default(0)
+    version: z2.number().int().nonnegative().default(0)
   }).nullable().default(null),
   // Optional site description → og:description + <meta name="description">.
-  description: z3.string().max(300).nullable().default(null),
+  description: z2.string().max(300).nullable().default(null),
   // Brand chatbot config (editor-owned; the platform kill switch lives in the
   // sites table, not here). Every field defaults so pre-existing
   // site-config.json files keep parsing.
@@ -349,11 +290,6 @@ var SiteConfigSchema = z3.object({
 });
 
 export {
-  TextLineSchema,
-  MediaReferenceSchema,
-  SingleMediaReferenceSchema,
-  HexColorSchema,
-  FontNameSchema,
   VariantSchema,
   MediaFolderSchema,
   MediaItemSchema,