@drawnagency/primitives 0.1.104 → 0.1.106

package/dist/components/shell/AudienceAddForm.d.ts

@@ -5,7 +5,10 @@ interface Props {
         password: string;
     }) => Promise<void>;
     onCancel: () => void;
+    /** Credential mode: an audience has no password of its own — access comes from
+     *  the named sign-ins added to it afterwards, so the field is hidden. */
+    requirePassword?: boolean;
 }
-export declare function AudienceAddForm({ onSubmit, onCancel }: Props): import("react/jsx-runtime").JSX.Element;
+export declare function AudienceAddForm({ onSubmit, onCancel, requirePassword }: Props): import("react/jsx-runtime").JSX.Element;
 export {};
 //# sourceMappingURL=AudienceAddForm.d.ts.map

package/dist/components/shell/AudienceAddForm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AudienceAddForm.d.ts","sourceRoot":"","sources":["../../../src/components/shell/AudienceAddForm.tsx"],"names":[],"mappings":"AAOA,UAAU,KAAK;IACb,QAAQ,EAAE,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnG,QAAQ,EAAE,MAAM,IAAI,CAAC;CACtB;AAID,wBAAgB,eAAe,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,KAAK,2CA+E5D"}
+{"version":3,"file":"AudienceAddForm.d.ts","sourceRoot":"","sources":["../../../src/components/shell/AudienceAddForm.tsx"],"names":[],"mappings":"AAOA,UAAU,KAAK;IACb,QAAQ,EAAE,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnG,QAAQ,EAAE,MAAM,IAAI,CAAC;IACrB;6EACyE;IACzE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAID,wBAAgB,eAAe,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAsB,EAAE,EAAE,KAAK,2CAqFpF"}

package/dist/components/shell/AudienceDetailsPanel.d.ts

@@ -0,0 +1,28 @@
+import type { AudienceOverview } from "../../lib/audience-overview";
+/** One audience plus its resolved availability. Built server-side. */
+export interface AudienceDetail {
+    name: string;
+    displayName: string;
+    color: string | null;
+    isDefault: boolean;
+    hasPassword: boolean;
+    /** Named sign-ins that grant this audience. Empty in `.env`/audience mode. */
+    credentials: Array<{
+        username: string;
+        label: string | null;
+    }>;
+    overview: AudienceOverview;
+}
+interface Props {
+    audiences: AudienceDetail[];
+    /** False when the auth provider cannot store a reversible password at all. */
+    revealSupported: boolean;
+}
+/**
+ * The Audience Details page body: who can see what, and what password to share.
+ * Reachable by editors and the site's default audience (the client), so the
+ * client can hand a new partner access without going through us.
+ */
+export declare function AudienceDetailsPanel({ audiences, revealSupported }: Props): import("react/jsx-runtime").JSX.Element;
+export default AudienceDetailsPanel;
+//# sourceMappingURL=AudienceDetailsPanel.d.ts.map

package/dist/components/shell/AudienceDetailsPanel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AudienceDetailsPanel.d.ts","sourceRoot":"","sources":["../../../src/components/shell/AudienceDetailsPanel.tsx"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAgB,MAAM,6BAA6B,CAAC;AAElF,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,8EAA8E;IAC9E,WAAW,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAC/D,QAAQ,EAAE,gBAAgB,CAAC;CAC5B;AAED,UAAU,KAAK;IACb,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,8EAA8E;IAC9E,eAAe,EAAE,OAAO,CAAC;CAC1B;AAwND;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,KAAK,2CAgBzE;AAED,eAAe,oBAAoB,CAAC"}

package/dist/components/shell/AudienceRow.d.ts

@@ -1,4 +1,5 @@
 import type { Audience } from "../../auth/types";
+import type { ViewerCredential } from "../../schemas/audience";
 interface Props {
     audience: Audience;
     isDefault: boolean;
@@ -9,7 +10,20 @@ interface Props {
         password?: string;
     }) => Promise<void>;
     onDelete: () => Promise<void>;
+    /** Named sign-ins for this audience. Undefined in `.env`/audience mode, where
+     *  the row keeps its single audience-level password field. */
+    credentials?: ViewerCredential[];
+    credentialActions?: {
+        create: (data: {
+            username: string;
+            label: string | null;
+            password: string;
+        }) => Promise<void>;
+        setPassword: (username: string, password: string) => Promise<void>;
+        setLabel: (username: string, label: string | null) => Promise<void>;
+        delete: (username: string) => Promise<void>;
+    };
 }
-export declare function AudienceRow({ audience, isDefault, canMutate, onSave, onDelete, }: Props): import("react/jsx-runtime").JSX.Element;
+export declare function AudienceRow({ audience, isDefault, canMutate, onSave, onDelete, credentials, credentialActions, }: Props): import("react/jsx-runtime").JSX.Element;
 export {};
 //# sourceMappingURL=AudienceRow.d.ts.map

package/dist/components/shell/AudienceRow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AudienceRow.d.ts","sourceRoot":"","sources":["../../../src/components/shell/AudienceRow.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAMjD,UAAU,KAAK;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,CAAC,KAAK,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrG,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAID,wBAAgB,WAAW,CAAC,EAC1B,QAAQ,EACR,SAAS,EACT,SAAS,EACT,MAAM,EACN,QAAQ,GACT,EAAE,KAAK,2CAmJP"}
+{"version":3,"file":"AudienceRow.d.ts","sourceRoot":"","sources":["../../../src/components/shell/AudienceRow.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAMjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,UAAU,KAAK;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,CAAC,KAAK,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrG,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B;kEAC8D;IAC9D,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACjC,iBAAiB,CAAC,EAAE;QAClB,MAAM,EAAE,CAAC,IAAI,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9F,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACnE,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC7C,CAAC;CACH;AAID,wBAAgB,WAAW,CAAC,EAC1B,QAAQ,EACR,SAAS,EACT,SAAS,EACT,MAAM,EACN,QAAQ,EACR,WAAW,EACX,iBAAiB,GAClB,EAAE,KAAK,2CAgLP"}

package/dist/components/shell/CredentialList.d.ts

@@ -0,0 +1,18 @@
+import type { ViewerCredential } from "../../schemas/audience";
+interface Props {
+    audienceName: string;
+    credentials: ViewerCredential[];
+    canMutate: boolean;
+    onCreate: (data: {
+        username: string;
+        label: string | null;
+        password: string;
+    }) => Promise<void>;
+    onSetPassword: (username: string, password: string) => Promise<void>;
+    onSetLabel: (username: string, label: string | null) => Promise<void>;
+    onDelete: (username: string) => Promise<void>;
+}
+/** The named sign-ins for one audience, inside its Site Settings row. */
+export declare function CredentialList({ audienceName, credentials, canMutate, onCreate, onSetPassword, onSetLabel, onDelete, }: Props): import("react/jsx-runtime").JSX.Element;
+export {};
+//# sourceMappingURL=CredentialList.d.ts.map

package/dist/components/shell/CredentialList.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialList.d.ts","sourceRoot":"","sources":["../../../src/components/shell/CredentialList.tsx"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,UAAU,KAAK;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChG,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAuOD,yEAAyE;AACzE,wBAAgB,cAAc,CAAC,EAC7B,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,GACpF,EAAE,KAAK,2CA6BP"}

package/dist/components/shell/EditorShell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"EditorShell.d.ts","sourceRoot":"","sources":["../../../src/components/shell/EditorShell.tsx"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAejD,OAAO,EAAoC,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAyDtF,OAAO,KAAK,EAAE,eAAe,EAA2D,MAAM,oBAAoB,CAAC;AA2CnH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA2BxD,UAAU,KAAK;IACb,OAAO,EAAE,MAAM,CAAC;IAIhB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,YAAY,EAAE;QACZ,KAAK,EAAE,OAAO,CAAC;QACf,aAAa,EAAE,OAAO,CAAC;QACvB,YAAY,EAAE,OAAO,CAAC;QACtB,cAAc,EAAE,OAAO,CAAC;QACxB,kBAAkB,EAAE,OAAO,CAAC;QAC5B,cAAc,EAAE,OAAO,CAAC;KACzB,CAAC;IACF,WAAW,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAA;KAAE,GAAG,IAAI,CAAC;IAIhE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAKjC,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;CAC1C;AAED,MAAM,CAAC,OAAO,UAAU,WAAW,CAAC,EAClC,OAAO,EACP,YAAY,EACZ,MAAM,EACN,SAAS,EAAE,gBAAgB,EAC3B,YAAY,EACZ,WAAW,EACX,sBAA8B,EAC9B,eAAe,GAChB,EAAE,KAAK,2CAg3DP;AAwED;6EAC6E;AAC7E,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,WAAW,CAAC,YAAY,CAAC,EACvC,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,eAAe,EAAE,MAAM,GAAG,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAK/B"}
+{"version":3,"file":"EditorShell.d.ts","sourceRoot":"","sources":["../../../src/components/shell/EditorShell.tsx"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAejD,OAAO,EAAoC,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAyDtF,OAAO,KAAK,EAAE,eAAe,EAA2D,MAAM,oBAAoB,CAAC;AA+CnH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA2BxD,UAAU,KAAK;IACb,OAAO,EAAE,MAAM,CAAC;IAIhB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,YAAY,EAAE;QACZ,KAAK,EAAE,OAAO,CAAC;QACf,aAAa,EAAE,OAAO,CAAC;QACvB,YAAY,EAAE,OAAO,CAAC;QACtB,cAAc,EAAE,OAAO,CAAC;QACxB,kBAAkB,EAAE,OAAO,CAAC;QAC5B,cAAc,EAAE,OAAO,CAAC;KACzB,CAAC;IACF,WAAW,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAA;KAAE,GAAG,IAAI,CAAC;IAIhE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAKjC,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;CAC1C;AAED,MAAM,CAAC,OAAO,UAAU,WAAW,CAAC,EAClC,OAAO,EACP,YAAY,EACZ,MAAM,EACN,SAAS,EAAE,gBAAgB,EAC3B,YAAY,EACZ,WAAW,EACX,sBAA8B,EAC9B,eAAe,GAChB,EAAE,KAAK,2CAs8DP;AAwED;6EAC6E;AAC7E,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,WAAW,CAAC,YAAY,CAAC,EACvC,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,eAAe,EAAE,MAAM,GAAG,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAK/B"}

package/dist/components/shell/SiteSettingsViewerAccess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SiteSettingsViewerAccess.d.ts","sourceRoot":"","sources":["../../../src/components/shell/SiteSettingsViewerAccess.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAOjD,UAAU,KAAK;IACb,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,iBAAiB,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,IAAI,CAAC;CACpD;AAED,wBAAgB,wBAAwB,CAAC,EAAE,kBAAkB,EAAE,cAAc,EAAE,iBAAiB,EAAE,EAAE,KAAK,2CA4JxG"}
+{"version":3,"file":"SiteSettingsViewerAccess.d.ts","sourceRoot":"","sources":["../../../src/components/shell/SiteSettingsViewerAccess.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAQjD,UAAU,KAAK;IACb,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,iBAAiB,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,IAAI,CAAC;CACpD;AAQD,wBAAgB,wBAAwB,CAAC,EAAE,kBAAkB,EAAE,cAAc,EAAE,iBAAiB,EAAE,EAAE,KAAK,2CAwMxG"}

package/dist/components/shell/ViewerLoginForm.d.ts

@@ -1,11 +1,15 @@
 interface Props {
+    /** Audience mode only. Empty (and unused) in credential mode — the page must
+     *  not ship an audience list to a login form that doesn't offer the choice. */
     audiences: Array<{
         name: string;
         displayName: string;
         hasPassword?: boolean;
     }>;
+    /** Set by the page from the auth provider's capability, never by the client. */
+    mode?: "audience" | "credentials";
     next?: string | null;
 }
-export declare function ViewerLoginForm({ audiences, next }: Props): import("react/jsx-runtime").JSX.Element;
+export declare function ViewerLoginForm({ audiences, mode, next }: Props): import("react/jsx-runtime").JSX.Element;
 export {};
 //# sourceMappingURL=ViewerLoginForm.d.ts.map

package/dist/components/shell/ViewerLoginForm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ViewerLoginForm.d.ts","sourceRoot":"","sources":["../../../src/components/shell/ViewerLoginForm.tsx"],"names":[],"mappings":"AAMA,UAAU,KAAK;IACb,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,wBAAgB,eAAe,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,2CAuFzD"}
+{"version":3,"file":"ViewerLoginForm.d.ts","sourceRoot":"","sources":["../../../src/components/shell/ViewerLoginForm.tsx"],"names":[],"mappings":"AAOA,UAAU,KAAK;IACb;mFAC+E;IAC/E,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC/E,gFAAgF;IAChF,IAAI,CAAC,EAAE,UAAU,GAAG,aAAa,CAAC;IAClC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,wBAAgB,eAAe,CAAC,EAAE,SAAS,EAAE,IAAiB,EAAE,IAAI,EAAE,EAAE,KAAK,2CAsG5E"}

package/dist/index.js

@@ -9,9 +9,10 @@ import {
   setSessionCookie,
   signAudienceToken,
   signSessionToken,
+  verifyAudienceClaims,
   verifyAudienceToken,
   verifySessionToken
-} from "./chunk-EM5DFHDZ.js";
+} from "./chunk-GEENI3OC.js";
 import {
   ASSET_CACHE_CONTROL,
   DOCUMENT_CACHE_CONTROL,
@@ -54,19 +55,27 @@ import {
   resolveMedia,
   sanitizeMediaName,
   setMediaProvider
-} from "./chunk-3COSXTOY.js";
+} from "./chunk-XBYJQ5RS.js";
 import {
-  AudienceColorSchema,
-  AudienceNameSchema,
-  MediaGridOptionsSchema,
-  slugifyAudienceName
-} from "./chunk-ZDQ3TT47.js";
+  MediaGridOptionsSchema
+} from "./chunk-B7VBSE5X.js";
 import {
   AudienceSchema,
   RoleSchema,
   SessionSchema,
   SiteUserSchema
-} from "./chunk-LZKVV4K2.js";
+} from "./chunk-6P4CJCXB.js";
+import {
+  AudienceColorSchema,
+  AudienceNameSchema,
+  NormalizedUsernameSchema,
+  VIEWER_PASSWORD_MIN_LENGTH,
+  ViewerCredentialSchema,
+  ViewerPasswordSchema,
+  ViewerUsernameSchema,
+  normalizeUsername,
+  slugifyAudienceName
+} from "./chunk-NLQ5F3RQ.js";
 import {
   DEFAULT_LINK,
   LinkTargetSchema,
@@ -105,18 +114,8 @@ import {
   safeRedirect,
   suggestAccessibleOn,
   wcagLevel
-} from "./chunk-CZLYECHC.js";
-import {
-  isSameOriginRequest,
-  requireSessionSecret,
-  safeNextPath
-} from "./chunk-S2L3BPLS.js";
-import {
-  ensureSanitizer,
-  generateNavLinks,
-  sanitizeHtml,
-  toSectionId
-} from "./chunk-72CG6AA2.js";
+} from "./chunk-AB3XVXI3.js";
+import "./chunk-5BM2Y3NJ.js";
 import {
   curatedIcons,
   getIcon
@@ -126,10 +125,21 @@ import {
   darkModeEvent,
   editModeEvent,
   navChangeEvent
-} from "./chunk-PTOLUMGV.js";
+} from "./chunk-4RNF2DRG.js";
+import {
+  ensureSanitizer,
+  generateNavLinks,
+  sanitizeHtml,
+  toSectionId
+} from "./chunk-72CG6AA2.js";
 import {
   cn
 } from "./chunk-7EOSDFS3.js";
+import {
+  isSameOriginRequest,
+  requireSessionSecret,
+  safeNextPath
+} from "./chunk-S2L3BPLS.js";
 import {
   env
 } from "./chunk-WKZ7OENC.js";
@@ -140,8 +150,7 @@ import {
   navEntries,
   pagesInNavOrder,
   reconcileNav
-} from "./chunk-TGNS7D4F.js";
-import "./chunk-5BM2Y3NJ.js";
+} from "./chunk-CPTFFLK2.js";
 import {
   NavEntrySchema,
   NavFileSchema
@@ -164,27 +173,29 @@ import {
 import {
   ChatbotConfigSchema,
   ChatbotTaskSchema,
-  FontNameSchema,
-  HexColorSchema,
   ImageManifestSchema,
   IndexSchema,
   MediaConfigSchema,
   MediaFolderSchema,
   MediaItemSchema,
-  MediaReferenceSchema,
   PageSchema,
   PageStatusSchema,
   RESERVED_SLUGS,
   SLUG_RE,
   SectionMetaSchema,
-  SingleMediaReferenceSchema,
   SiteConfigSchema,
   StatusSchema,
-  TextLineSchema,
   VariantSchema,
   normalizeSiteIndex
-} from "./chunk-BGHWUJFV.js";
+} from "./chunk-BOZUEKWL.js";
 import "./chunk-FM4M4Q2W.js";
+import {
+  FontNameSchema,
+  HexColorSchema,
+  MediaReferenceSchema,
+  SingleMediaReferenceSchema,
+  TextLineSchema
+} from "./chunk-GGXZZ77Z.js";
 import "./chunk-NSCT3AMV.js";
 import "./chunk-JSBRDJBE.js";
 export {
@@ -230,6 +241,7 @@ export {
   MediaReferenceSchema,
   NavEntrySchema,
   NavFileSchema,
+  NormalizedUsernameSchema,
   PageSchema,
   PageStatusSchema,
   ProcessingQueue,
@@ -250,7 +262,11 @@ export {
   StorageConflictError,
   TakeoverMessageSchema,
   TextLineSchema,
+  VIEWER_PASSWORD_MIN_LENGTH,
   VariantSchema,
+  ViewerCredentialSchema,
+  ViewerPasswordSchema,
+  ViewerUsernameSchema,
   accentVarValue,
   audiencePasses,
   buildGoogleFontsUrl,
@@ -301,6 +317,7 @@ export {
   navChangeEvent,
   navEntries,
   normalizeSiteIndex,
+  normalizeUsername,
   onPrimaryVarValue,
   pagesInNavOrder,
   primaryVarValue,
@@ -327,6 +344,7 @@ export {
   slugifyAudienceName,
   suggestAccessibleOn,
   toSectionId,
+  verifyAudienceClaims,
   verifyAudienceToken,
   verifySessionToken,
   wcagLevel,

package/dist/lib/audience-overview.d.ts

@@ -0,0 +1,53 @@
+/**
+ * What each audience can actually see. Powers the Audience Details page, which
+ * answers "if I give a partner this password, what do they get?".
+ *
+ * Pure and view-agnostic: section labels/thumbnails are resolved by the caller
+ * (they need the section registry and the media provider) and passed in, so this
+ * stays trivially testable and ships no registry into viewer JS.
+ */
+import type { SiteIndex } from "../schemas/site-config";
+import type { ThumbView } from "./thumb-views";
+/** Caller-resolved presentation for one section. */
+export interface SectionDisplay {
+    label: string;
+    typeLabel: string;
+    thumbnails: ThumbView[];
+}
+export interface OverviewSection extends SectionDisplay {
+    id: string;
+    available: boolean;
+    /** Live-but-draft sections are invisible to EVERY audience, not just this one. */
+    draft: boolean;
+}
+export interface OverviewPage {
+    id: string;
+    title: string;
+    slug: string;
+    href: string;
+    /** Live but off the sidebar — reachable by URL, so it counts as available. */
+    hiddenFromNav: boolean;
+    /** none = the page itself is gated away; partial = page in, some sections out. */
+    availability: "full" | "partial" | "none";
+    sections: OverviewSection[];
+}
+export interface AudienceOverview {
+    audience: string;
+    pages: OverviewPage[];
+    pagesAvailable: number;
+    pagesTotal: number;
+    sectionsAvailable: number;
+    sectionsTotal: number;
+}
+/**
+ * Availability for one audience across the whole site.
+ *
+ * Archived pages are excluded outright (nobody can reach them). Draft sections
+ * are listed as unavailable but flagged, so a page reading "3 of 8" is not
+ * mistaken for an access problem.
+ *
+ * The cascade matters: a section whose own access allows this audience is still
+ * unavailable inside a page that gates them out. Page access wins.
+ */
+export declare function buildAudienceOverview(index: SiteIndex, display: (sectionId: string) => SectionDisplay, audience: string): AudienceOverview;
+//# sourceMappingURL=audience-overview.d.ts.map

package/dist/lib/audience-overview.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audience-overview.d.ts","sourceRoot":"","sources":["../../src/lib/audience-overview.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,oDAAoD;AACpD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,SAAS,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,eAAgB,SAAQ,cAAc;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,OAAO,CAAC;IACnB,kFAAkF;IAClF,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,aAAa,EAAE,OAAO,CAAC;IACvB,kFAAkF;IAClF,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;IAC1C,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,cAAc,EAC9C,QAAQ,EAAE,MAAM,GACf,gBAAgB,CAgDlB"}

package/dist/lib/audience-secret.d.ts

@@ -0,0 +1,11 @@
+/** Seal a plaintext password into `v1.<iv>.<ciphertext>` (base64url parts). */
+export declare function sealAudiencePassword(password: string): Promise<string>;
+/**
+ * Open a sealed password, or null when it cannot be trusted — unknown version,
+ * malformed parts, tampered ciphertext (GCM auth failure), or a rotated
+ * SESSION_SECRET. Callers treat null as "not revealable" and never as an error;
+ * they must ALSO verify the result against the bcrypt hash, since a valid seal
+ * can still be stale (a password changed by a writer that skipped the cipher).
+ */
+export declare function openAudiencePassword(sealed: string | null | undefined): Promise<string | null>;
+//# sourceMappingURL=audience-secret.d.ts.map

package/dist/lib/audience-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audience-secret.d.ts","sourceRoot":"","sources":["../../src/lib/audience-secret.ts"],"names":[],"mappings":"AAgEA,+EAA+E;AAC/E,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ5E;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBpG"}

package/dist/lib/audience-secret.js

@@ -0,0 +1,70 @@
+import {
+  requireSessionSecret
+} from "../chunk-S2L3BPLS.js";
+import "../chunk-WKZ7OENC.js";
+import "../chunk-JSBRDJBE.js";
+
+// src/lib/audience-secret.ts
+var INFO = "drawnagency:audience-password:v1";
+var VERSION = "v1";
+var IV_BYTES = 12;
+var enc = new TextEncoder();
+var dec = new TextDecoder();
+function toBase64Url(bytes) {
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64Url(value) {
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(padded + "=".repeat((4 - padded.length % 4) % 4));
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+async function deriveKey() {
+  const base = await crypto.subtle.importKey(
+    "raw",
+    requireSessionSecret(),
+    "HKDF",
+    false,
+    ["deriveKey"]
+  );
+  return crypto.subtle.deriveKey(
+    { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: enc.encode(INFO) },
+    base,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function sealAudiencePassword(password) {
+  const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
+  const ciphertext = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv },
+    await deriveKey(),
+    enc.encode(password)
+  );
+  return `${VERSION}.${toBase64Url(iv)}.${toBase64Url(new Uint8Array(ciphertext))}`;
+}
+async function openAudiencePassword(sealed) {
+  if (!sealed) return null;
+  const parts = sealed.split(".");
+  if (parts.length !== 3 || parts[0] !== VERSION) return null;
+  try {
+    const iv = fromBase64Url(parts[1]);
+    if (iv.byteLength !== IV_BYTES) return null;
+    const plain = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv },
+      await deriveKey(),
+      fromBase64Url(parts[2])
+    );
+    return dec.decode(plain);
+  } catch {
+    return null;
+  }
+}
+export {
+  openAudiencePassword,
+  sealAudiencePassword
+};

package/dist/lib/events.d.ts

@@ -34,4 +34,7 @@ export declare const editorDirtyEvent: TypedEvent<{
 }>;
 export declare const siteNavChangeEvent: TypedEvent<SiteNav>;
 export declare const pageSelectEvent: TypedEvent<string>;
+/** Nav → EditorShell: open the Audience Details surface inside the editor, so
+ *  editors keep the toolbar instead of navigating out to the /audiences route. */
+export declare const audienceDetailsEvent: TypedEvent<void>;
 //# sourceMappingURL=events.d.ts.map

package/dist/lib/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/lib/events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAE9C,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CACnD;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAW1D;AAED,eAAO,MAAM,aAAa;gBAA6B,OAAO;EAAqB,CAAC;AACpF,eAAO,MAAM,cAAc,uBAA0C,CAAC;AACtE,eAAO,MAAM,aAAa,oBAAsC,CAAC;AACjE,eAAO,MAAM,mBAAmB,oBAAwC,CAAC;AACzE,eAAO,MAAM,kBAAkB;SAAsB,MAAM;UAAQ,MAAM;EAAqB,CAAC;AAC/F;;2EAE2E;AAC3E,eAAO,MAAM,mBAAmB;SAAsB,MAAM;UAAQ,MAAM;EAAsB,CAAC;AACjG;;4BAE4B;AAC5B,eAAO,MAAM,yBAAyB;aAA0B,MAAM;EAA6B,CAAC;AACpG;8EAC8E;AAC9E,eAAO,MAAM,gBAAgB;uBAAoC,OAAO;EAAmB,CAAC;AAC5F,eAAO,MAAM,kBAAkB,qBAA2C,CAAC;AAC3E,eAAO,MAAM,eAAe,oBAAoC,CAAC"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/lib/events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAE9C,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CACnD;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAW1D;AAED,eAAO,MAAM,aAAa;gBAA6B,OAAO;EAAqB,CAAC;AACpF,eAAO,MAAM,cAAc,uBAA0C,CAAC;AACtE,eAAO,MAAM,aAAa,oBAAsC,CAAC;AACjE,eAAO,MAAM,mBAAmB,oBAAwC,CAAC;AACzE,eAAO,MAAM,kBAAkB;SAAsB,MAAM;UAAQ,MAAM;EAAqB,CAAC;AAC/F;;2EAE2E;AAC3E,eAAO,MAAM,mBAAmB;SAAsB,MAAM;UAAQ,MAAM;EAAsB,CAAC;AACjG;;4BAE4B;AAC5B,eAAO,MAAM,yBAAyB;aAA0B,MAAM;EAA6B,CAAC;AACpG;8EAC8E;AAC9E,eAAO,MAAM,gBAAgB;uBAAoC,OAAO;EAAmB,CAAC;AAC5F,eAAO,MAAM,kBAAkB,qBAA2C,CAAC;AAC3E,eAAO,MAAM,eAAe,oBAAoC,CAAC;AACjE;kFACkF;AAClF,eAAO,MAAM,oBAAoB,kBAA2C,CAAC"}

package/dist/lib/index-ops.js

@@ -11,14 +11,15 @@ import {
   setGroupStartCollapsed,
   slugifyPageSlug,
   uniquePageSlug
-} from "../chunk-TGNS7D4F.js";
+} from "../chunk-CPTFFLK2.js";
 import {
   IndexSchema,
   PageStatusSchema,
   RESERVED_SLUGS,
   SLUG_RE
-} from "../chunk-BGHWUJFV.js";
+} from "../chunk-BOZUEKWL.js";
 import "../chunk-FM4M4Q2W.js";
+import "../chunk-GGXZZ77Z.js";
 import "../chunk-JSBRDJBE.js";
 
 // src/lib/index-ops.ts

package/dist/lib/index.js

@@ -18,14 +18,8 @@ import {
   safeRedirect,
   suggestAccessibleOn,
   wcagLevel
-} from "../chunk-CZLYECHC.js";
-import "../chunk-S2L3BPLS.js";
-import {
-  ensureSanitizer,
-  generateNavLinks,
-  sanitizeHtml,
-  toSectionId
-} from "../chunk-72CG6AA2.js";
+} from "../chunk-AB3XVXI3.js";
+import "../chunk-5BM2Y3NJ.js";
 import {
   curatedIcons,
   getIcon
@@ -35,10 +29,17 @@ import {
   darkModeEvent,
   editModeEvent,
   navChangeEvent
-} from "../chunk-PTOLUMGV.js";
+} from "../chunk-4RNF2DRG.js";
+import {
+  ensureSanitizer,
+  generateNavLinks,
+  sanitizeHtml,
+  toSectionId
+} from "../chunk-72CG6AA2.js";
 import {
   cn
 } from "../chunk-7EOSDFS3.js";
+import "../chunk-S2L3BPLS.js";
 import {
   env
 } from "../chunk-WKZ7OENC.js";
@@ -49,8 +50,7 @@ import {
   navEntries,
   pagesInNavOrder,
   reconcileNav
-} from "../chunk-TGNS7D4F.js";
-import "../chunk-5BM2Y3NJ.js";
+} from "../chunk-CPTFFLK2.js";
 import "../chunk-REDDTTGJ.js";
 import "../chunk-TZQPOR5A.js";
 import {
@@ -64,8 +64,9 @@ import {
   registerSchema,
   registerSection
 } from "../chunk-VKAGMEKE.js";
-import "../chunk-BGHWUJFV.js";
+import "../chunk-BOZUEKWL.js";
 import "../chunk-FM4M4Q2W.js";
+import "../chunk-GGXZZ77Z.js";
 import "../chunk-NSCT3AMV.js";
 import "../chunk-JSBRDJBE.js";
 export {

package/dist/lib/nav.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nav.d.ts","sourceRoot":"","sources":["../../src/lib/nav.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAG9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAchD;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,aAAa,EAAE,EACzB,QAAQ,CAAC,EAAE,eAAe,GACzB,OAAO,EAAE,CAqDX;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AAED;;qBAEqB;AACrB,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,KAAK,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED;iFACiF;AACjF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,UAAU,EAAE,CAAC;CACpB;AAED;2CAC2C;AAC3C,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAElD,MAAM,MAAM,YAAY,GAAG,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAAC,GAAG,YAAY,GAAG,eAAe,CAAC;AAE7F,MAAM,WAAW,OAAO;IACtB,+DAA+D;IAC/D,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,iFAAiF;IACjF,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAMD,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,KAAK,EAAE,SAAS,CAAC;IACjB,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B;;;;;2BAKuB;IACvB,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;CAC5B,GAAG,OAAO,CA8DV"}
+{"version":3,"file":"nav.d.ts","sourceRoot":"","sources":["../../src/lib/nav.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAG9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAchD;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,aAAa,EAAE,EACzB,QAAQ,CAAC,EAAE,eAAe,GACzB,OAAO,EAAE,CAqDX;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AAED;;qBAEqB;AACrB,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,KAAK,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED;iFACiF;AACjF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,UAAU,EAAE,CAAC;CACpB;AAED;2CAC2C;AAC3C,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAElD,MAAM,MAAM,YAAY,GAAG,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAAC,GAAG,YAAY,GAAG,eAAe,CAAC;AAE7F,MAAM,WAAW,OAAO;IACtB,+DAA+D;IAC/D,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,iFAAiF;IACjF,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAMD,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,KAAK,EAAE,SAAS,CAAC;IACjB,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B;;;;;2BAKuB;IACvB,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;CAC5B,GAAG,OAAO,CAkEV"}

package/dist/lib/thumb-views.d.ts

@@ -0,0 +1,17 @@
+import type { Thumbnail } from "./registry";
+import type { MediaManifest } from "../media/types";
+/**
+ * A section thumbnail with its media reference already resolved to a URL, so the
+ * component rendering it needs neither the registry nor the media provider. The
+ * Audience Details page resolves these server-side for exactly that reason.
+ */
+export type ThumbView = {
+    kind: "color";
+    value: string;
+} | {
+    kind: "image";
+    src: string | null;
+    alt: string;
+};
+export declare function toThumbViews(thumbnails: Thumbnail[], manifest: MediaManifest): ThumbView[];
+//# sourceMappingURL=thumb-views.d.ts.map

package/dist/lib/thumb-views.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"thumb-views.d.ts","sourceRoot":"","sources":["../../src/lib/thumb-views.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD;;;;GAIG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAUvD,wBAAgB,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,aAAa,GAAG,SAAS,EAAE,CAM1F"}

package/dist/media/index.js

@@ -18,16 +18,17 @@ import {
   resolveMedia,
   sanitizeMediaName,
   setMediaProvider
-} from "../chunk-3COSXTOY.js";
-import "../chunk-TGNS7D4F.js";
+} from "../chunk-XBYJQ5RS.js";
+import "../chunk-CPTFFLK2.js";
 import {
   ImageManifestSchema,
   MediaConfigSchema,
   MediaFolderSchema,
   MediaItemSchema,
   VariantSchema
-} from "../chunk-BGHWUJFV.js";
+} from "../chunk-BOZUEKWL.js";
 import "../chunk-FM4M4Q2W.js";
+import "../chunk-GGXZZ77Z.js";
 import "../chunk-JSBRDJBE.js";
 export {
   BAKED_MEDIA_KEYS,

package/dist/schemas/audience.d.ts

@@ -3,6 +3,35 @@ export declare const AudienceNameSchema: z.ZodString;
 export declare const AudienceColorSchema: z.ZodNullable<z.ZodString>;
 export type AudienceName = z.infer<typeof AudienceNameSchema>;
 export type AudienceColor = z.infer<typeof AudienceColorSchema>;
+/**
+ * A viewer sign-in name. Looser than an audience slug — dots are allowed, so
+ * `agency.jane` works — but still constrained enough to be typed correctly over
+ * the phone. Always lowercased before storage and lookup, so `Agency2` and
+ * `agency2` are the same login.
+ */
+export declare const ViewerUsernameSchema: z.ZodString;
+/** Normalize a typed username for storage and lookup. */
+export declare function normalizeUsername(input: string): string;
+/**
+ * Wire-facing username: lowercased and trimmed BEFORE validation, so `Agency4`
+ * is accepted and stored as `agency4` rather than 400-ing on a case difference.
+ * Everything else the base schema rejects still fails.
+ */
+export declare const NormalizedUsernameSchema: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+/** Minimum for a NEW credential password. Deliberately stricter than the
+ *  audience passwords it replaces (which allowed a single character). */
+export declare const VIEWER_PASSWORD_MIN_LENGTH = 8;
+export declare const ViewerPasswordSchema: z.ZodString;
+/** A credential as it travels to the editor and the Audience Details page.
+ *  Never carries the hash or the sealed copy. */
+export declare const ViewerCredentialSchema: z.ZodObject<{
+    username: z.ZodString;
+    label: z.ZodNullable<z.ZodString>;
+    audienceName: z.ZodString;
+    createdAt: z.ZodString;
+}, z.core.$strip>;
+export type ViewerUsername = z.infer<typeof ViewerUsernameSchema>;
+export type ViewerCredential = z.infer<typeof ViewerCredentialSchema>;
 /**
  * Convert a friendly display string into an audience slug.
  * Lowercases, replaces non-alphanumeric runs with single dashes,