@drawnagency/primitives 0.1.55 → 0.1.57

package/dist/lib/registry.js

@@ -0,0 +1,26 @@
+import {
+  clearRegistry,
+  createRegistry,
+  defineSection,
+  getAllSchemas,
+  getAllSections,
+  getRichTextFields,
+  getSchema,
+  getSection,
+  registerRichText,
+  registerSchema,
+  registerSection
+} from "../chunk-VKAGMEKE.js";
+export {
+  clearRegistry,
+  createRegistry,
+  defineSection,
+  getAllSchemas,
+  getAllSections,
+  getRichTextFields,
+  getSchema,
+  getSection,
+  registerRichText,
+  registerSchema,
+  registerSection
+};

package/dist/lib/sanitize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/lib/sanitize.ts"],"names":[],"mappings":"AAWA;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED;;;GAGG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAGrD"}
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/lib/sanitize.ts"],"names":[],"mappings":"AAmBA;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBjD;AAED;;;GAGG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAGrD"}

package/dist/schemas/block.d.ts

@@ -0,0 +1,20 @@
+import { z } from "zod";
+/**
+ * A block's participation in its parent container's layout — distinct from its
+ * content. Optional, and absent at the page root (the root is an implicit single
+ * column). Intentionally NOT strict so future keys (rowSpan, alignSelf) are
+ * forward-compatible.
+ */
+export declare const LayoutEnvelopeSchema: z.ZodObject<{
+    colSpan: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type LayoutEnvelope = z.infer<typeof LayoutEnvelopeSchema>;
+/** v1 nesting cap: a top-level container (depth 2) may hold leaves but not containers. */
+export declare const MAX_BLOCK_DEPTH = 2;
+/** Content-agnostic: any block whose `content.children` is an array is a container. */
+export declare function getBlockChildren(block: unknown): unknown[];
+/** Depth of a block tree: a leaf is 1; a container is 1 + max(child depths). */
+export declare function blockDepth(block: unknown): number;
+/** Throws if the block tree is deeper than `max`. */
+export declare function assertMaxDepth(block: unknown, max?: number): void;
+//# sourceMappingURL=block.d.ts.map

package/dist/schemas/block.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"block.d.ts","sourceRoot":"","sources":["../../src/schemas/block.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;iBAE/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,0FAA0F;AAC1F,eAAO,MAAM,eAAe,IAAI,CAAC;AAEjC,uFAAuF;AACvF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,EAAE,CAM1D;AAED,gFAAgF;AAChF,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAIjD;AAED,qDAAqD;AACrD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,GAAE,MAAwB,GAAG,IAAI,CAKlF"}

package/dist/schemas/block.js

@@ -0,0 +1,14 @@
+import {
+  LayoutEnvelopeSchema,
+  MAX_BLOCK_DEPTH,
+  assertMaxDepth,
+  blockDepth,
+  getBlockChildren
+} from "../chunk-NSCT3AMV.js";
+export {
+  LayoutEnvelopeSchema,
+  MAX_BLOCK_DEPTH,
+  assertMaxDepth,
+  blockDepth,
+  getBlockChildren
+};

package/dist/schemas/index.js

@@ -5,8 +5,9 @@ import {
   LinkTargetSchema,
   LinkValueSchema,
   MediaGridOptionsSchema,
+  isSafeHref,
   slugifyAudienceName
-} from "../chunk-PUNXQK4M.js";
+} from "../chunk-PYWS3MOJ.js";
 import {
   AudienceSchema,
   RoleSchema,
@@ -16,6 +17,7 @@ import {
 import {
   ColorItemSchema,
   ColorSpaceSchema,
+  FontNameSchema,
   HexColorSchema,
   IndexSchema,
   MediaReferenceSchema,
@@ -23,18 +25,21 @@ import {
   PageStatusSchema,
   RESERVED_SLUGS,
   SectionMetaSchema,
+  SingleMediaReferenceSchema,
   SiteConfigSchema,
   TextLineSchema,
   getSectionContentSchema,
   getSectionSchema,
   normalizeSiteIndex
-} from "../chunk-24SUF2BC.js";
+} from "../chunk-ICLXLWQ5.js";
 import {
   ImageManifestSchema,
   MediaConfigSchema,
   MediaItemSchema,
   VariantSchema
 } from "../chunk-DKOUFIP6.js";
+import "../chunk-NSCT3AMV.js";
+import "../chunk-VKAGMEKE.js";
 export {
   AudienceColorSchema,
   AudienceNameSchema,
@@ -42,6 +47,7 @@ export {
   ColorItemSchema,
   ColorSpaceSchema,
   DEFAULT_LINK,
+  FontNameSchema,
   HexColorSchema,
   ImageManifestSchema,
   IndexSchema,
@@ -57,12 +63,14 @@ export {
   RoleSchema,
   SectionMetaSchema,
   SessionSchema,
+  SingleMediaReferenceSchema,
   SiteConfigSchema,
   SiteUserSchema,
   TextLineSchema,
   VariantSchema,
   getSectionContentSchema,
   getSectionSchema,
+  isSafeHref,
   normalizeSiteIndex,
   slugifyAudienceName
 };

package/dist/schemas/link.d.ts

@@ -3,6 +3,13 @@ export declare const LinkTargetSchema: z.ZodEnum<{
     _self: "_self";
     _blank: "_blank";
 }>;
+/**
+ * Block dangerous href schemes (javascript:, data:, vbscript:) and protocol-
+ * relative URLs at the schema boundary. Allows empty (unset), relative paths /
+ * fragments / queries, and http(s)/mailto absolute URLs. Links are not walked by
+ * the recursive sanitizer, so this is the only XSS guard for stored link hrefs.
+ */
+export declare function isSafeHref(href: string): boolean;
 export declare const LinkValueSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"external">;
     href: z.ZodString;

package/dist/schemas/link.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"link.d.ts","sourceRoot":"","sources":["../../src/schemas/link.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,gBAAgB;;;EAA8B,CAAC;AAE5D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;2BAQ1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,YAAY,EAAE,SAA2D,CAAC"}
+{"version":3,"file":"link.d.ts","sourceRoot":"","sources":["../../src/schemas/link.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,gBAAgB;;;EAA8B,CAAC;AAE5D;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUhD;AAED,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;2BAQ1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,YAAY,EAAE,SAA2D,CAAC"}

package/dist/schemas/rich-text.d.ts

@@ -0,0 +1,9 @@
+import { z } from "zod";
+/**
+ * Marks a schema field as HTML rich text. Readability marker only — the runtime
+ * source of truth for sanitization is each block definition's `richTextFields`
+ * list (see registry). Kept as a helper so schemas read self-documentingly
+ * (`body: richText()`) and a future Zod version could make it introspectable.
+ */
+export declare function richText(): z.ZodString;
+//# sourceMappingURL=rich-text.d.ts.map

package/dist/schemas/rich-text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rich-text.d.ts","sourceRoot":"","sources":["../../src/schemas/rich-text.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AACH,wBAAgB,QAAQ,gBAEvB"}

package/dist/schemas/sections.d.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { type LayoutEnvelope } from "./block";
 export interface SectionContent<C = Record<string, unknown>> {
     type: string;
     content: C;
@@ -6,6 +7,7 @@ export interface SectionContent<C = Record<string, unknown>> {
 }
 export interface Section<C = Record<string, unknown>> extends SectionContent<C> {
     id: string;
+    layout?: LayoutEnvelope;
 }
 export declare function getSectionContentSchema(): z.ZodType<SectionContent>;
 export declare function getSectionSchema(): z.ZodType<Section>;

package/dist/schemas/sections.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sections.d.ts","sourceRoot":"","sources":["../../src/schemas/sections.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAE,SAAQ,cAAc,CAAC,CAAC,CAAC;IAC7E,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,wBAAgB,uBAAuB,IAAI,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAMnE;AAED,wBAAgB,gBAAgB,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAErD"}
+{"version":3,"file":"sections.d.ts","sourceRoot":"","sources":["../../src/schemas/sections.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAEpE,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAE,SAAQ,cAAc,CAAC,CAAC,CAAC;IAC7E,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAED,wBAAgB,uBAAuB,IAAI,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAMnE;AAED,wBAAgB,gBAAgB,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAIrD"}

package/dist/schemas/shared.d.ts

@@ -77,7 +77,38 @@ export declare const MediaReferenceSchema: z.ZodDiscriminatedUnion<[z.ZodObject<
     linkText: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>], "type">;
 export type MediaReference = z.infer<typeof MediaReferenceSchema>;
+/** A single image or video reference — for the standalone `media` block
+ *  (excludes the grid-only doDontImage/linkedImage variants). */
+export declare const SingleMediaReferenceSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    imageId: z.ZodDefault<z.ZodString>;
+    caption: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+    background: z.ZodOptional<z.ZodString>;
+    invertFrom: z.ZodOptional<z.ZodString>;
+    border: z.ZodOptional<z.ZodBoolean>;
+    objectFit: z.ZodOptional<z.ZodEnum<{
+        cover: "cover";
+        contain: "contain";
+    }>>;
+    type: z.ZodLiteral<"image">;
+}, z.core.$strip>, z.ZodObject<{
+    imageId: z.ZodDefault<z.ZodString>;
+    caption: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+    background: z.ZodOptional<z.ZodString>;
+    invertFrom: z.ZodOptional<z.ZodString>;
+    border: z.ZodOptional<z.ZodBoolean>;
+    objectFit: z.ZodOptional<z.ZodEnum<{
+        cover: "cover";
+        contain: "contain";
+    }>>;
+    type: z.ZodLiteral<"video">;
+    poster: z.ZodOptional<z.ZodString>;
+    autoplay: z.ZodOptional<z.ZodBoolean>;
+    loop: z.ZodOptional<z.ZodBoolean>;
+    muted: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>], "type">;
+export type SingleMediaReference = z.infer<typeof SingleMediaReferenceSchema>;
 export declare const HexColorSchema: z.ZodString;
+export declare const FontNameSchema: z.ZodString;
 export declare const ColorSpaceSchema: z.ZodObject<{
     hex: z.ZodOptional<z.ZodString>;
     rgb: z.ZodOptional<z.ZodString>;

package/dist/schemas/shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../src/schemas/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAwBxB,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;2BAKzB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAoCtD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAE/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAGlE,eAAO,MAAM,cAAc,aAEiC,CAAC;AAE7D,eAAO,MAAM,gBAAgB;;;;;iBAQ5B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,eAAe;;;;;;;;iBAG1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../src/schemas/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAwBxB,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;2BAKzB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAoCtD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAE/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;iEACiE;AACjE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;2BAAqD,CAAC;AAE7F,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAG9E,eAAO,MAAM,cAAc,aAEiC,CAAC;AAO7D,eAAO,MAAM,cAAc,aAG6C,CAAC;AAEzE,eAAO,MAAM,gBAAgB;;;;;iBAQ5B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,eAAe;;;;;;;;iBAG1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/storage/index.d.ts

@@ -1,2 +1,3 @@
 export type { StorageProvider, FileWrite } from "./types";
+export { StorageConflictError } from "./types";
 //# sourceMappingURL=index.d.ts.map

package/dist/storage/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC"}

package/dist/storage/types.d.ts

@@ -1,5 +1,17 @@
+/**
+ * Thrown by `writeFiles` when `options.baseVersion` no longer matches the
+ * draft's current version — i.e. another editor (or the same user on another
+ * device) committed since this editor loaded. Callers should surface a 409 and
+ * prompt a reload rather than clobbering the concurrent work (last-write-wins).
+ */
+export declare class StorageConflictError extends Error {
+    readonly currentVersion: string | null;
+    constructor(currentVersion: string | null);
+}
 export interface StorageProvider {
-    writeFiles(files: FileWrite[], message: string): Promise<{
+    writeFiles(files: FileWrite[], message: string, options?: {
+        baseVersion?: string | null;
+    }): Promise<{
         version: string;
     }>;
     readFile(path: string, options?: {

package/dist/storage/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/storage/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC9B,UAAU,CACR,KAAK,EAAE,SAAS,EAAE,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEhC,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC5B,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAE9B,YAAY,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAE7C,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9B,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC/E;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;CAC/B,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/storage/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;aACjB,cAAc,EAAE,MAAM,GAAG,IAAI;gBAA7B,cAAc,EAAE,MAAM,GAAG,IAAI;CAI1D;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,CACR,KAAK,EAAE,SAAS,EAAE,EAClB,OAAO,EAAE,MAAM,EAIf,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GACxC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEhC,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC5B,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAE9B,YAAY,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAE7C,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9B,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC/E;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;CAC/B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drawnagency/primitives",
-  "version": "0.1.55",
+  "version": "0.1.57",
   "type": "module",
   "exports": {
     "./package.json": "./package.json",
@@ -16,6 +16,10 @@
       "types": "./dist/schemas/auth.d.ts",
       "default": "./dist/schemas/auth.js"
     },
+    "./schemas/block": {
+      "types": "./dist/schemas/block.d.ts",
+      "default": "./dist/schemas/block.js"
+    },
     "./schemas/link": {
       "types": "./dist/schemas/link.d.ts",
       "default": "./dist/schemas/link.js"
@@ -32,6 +36,14 @@
       "types": "./dist/lib/env.d.ts",
       "default": "./dist/lib/env.js"
     },
+    "./lib/registry": {
+      "types": "./dist/lib/registry.d.ts",
+      "default": "./dist/lib/registry.js"
+    },
+    "./lib/migrate-sections-transform": {
+      "types": "./dist/lib/migrate-sections-transform.d.ts",
+      "default": "./dist/lib/migrate-sections-transform.js"
+    },
     "./auth": {
       "types": "./dist/auth/index.d.ts",
       "default": "./dist/auth/index.js"

package/src/auth/cookies.ts

@@ -5,7 +5,12 @@ import { requireSessionSecret } from "./security";
 export const SESSION_COOKIE = "bp-session";
 export const AUDIENCE_COOKIE = "bp-audience";
 export const SESSION_MAX_AGE_SECONDS = 60 * 60 * 24;
-export const AUDIENCE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
+// 24h, matching the editor session. A viewer audience JWT carries no rotation
+// token, so rotating a leaked viewer password can't actively revoke an
+// outstanding cookie — a short lifetime bounds the leak window instead of the
+// previous 30 days. (A `token_version` claim checked at verify time would give
+// immediate revocation without forcing daily re-auth; see backlog.)
+export const AUDIENCE_MAX_AGE_SECONDS = 60 * 60 * 24;
 
 export async function signSessionToken(session: Session): Promise<string> {
   return new jose.SignJWT({

package/src/components/brandguide/Colors.tsx

@@ -1,7 +1,7 @@
 import { useState, useEffect } from "react";
 import { Eye, EyeOff } from "lucide-react";
 import { cn } from "../../lib/cn";
-import { gridColsClass } from "../../lib/grid";
+import { containerGridClass } from "../../lib/container-grid";
 import { EditableGrid } from "../primitives/EditableGrid";
 import { EditablePlainText } from "../primitives/EditablePlainText";
 import type { ReactNode } from "react";
@@ -119,40 +119,42 @@ function ColorsView({
         </div>
       )}
 
-      <div className={cn("grid gap-4", gridColsClass[columns] || "grid-cols-3")}>
-        {colors.map((color, i) => {
-          const hex = color.spaces[0]?.hex;
-          const contrast = getContrastClass(hex);
-          return (
-            <div key={i} className="overflow-hidden rounded-md border border-base-200">
-              <div className={cn("relative flex min-h-[80px] items-end p-3", contrast)} style={{ backgroundColor: hex || "#ccc" }}>
-                {color.name && <span className="text-sm font-bold">{color.name}</span>}
-                {copiedIndex === i && (
-                  <span className={cn(
-                    "absolute top-2 right-2 rounded-full px-2.5 py-0.5 text-xs font-medium",
-                    getContrastClass(hex) === "text-black" ? "bg-black/15 text-black" : "bg-white/25 text-white",
-                  )}>
-                    Copied!
-                  </span>
-                )}
-              </div>
-              {expanded && (
-                <div className="space-y-1 bg-base-accent p-3 text-sm">
-                  {color.spaces.map((space, j) =>
-                    Object.entries(space).map(([key, value]) =>
-                      value ? (
-                        <button key={`${j}-${key}`} onClick={() => handleCopy(value, i)} className="cursor-pointer flex w-full justify-between hover:text-primary">
-                          <span className="font-medium uppercase">{key}</span>
-                          <span>{value}</span>
-                        </button>
-                      ) : null
-                    )
+      <div className="@container">
+        <div className={cn("grid gap-4", containerGridClass[columns] || containerGridClass[3])}>
+          {colors.map((color, i) => {
+            const hex = color.spaces[0]?.hex;
+            const contrast = getContrastClass(hex);
+            return (
+              <div key={i} className="overflow-hidden rounded-md border border-base-200">
+                <div className={cn("relative flex min-h-[80px] items-end p-3", contrast)} style={{ backgroundColor: hex || "#ccc" }}>
+                  {color.name && <span className="text-sm font-bold">{color.name}</span>}
+                  {copiedIndex === i && (
+                    <span className={cn(
+                      "absolute top-2 right-2 rounded-full px-2.5 py-0.5 text-xs font-medium",
+                      getContrastClass(hex) === "text-black" ? "bg-black/15 text-black" : "bg-white/25 text-white",
+                    )}>
+                      Copied!
+                    </span>
                   )}
                 </div>
-              )}
-            </div>
-          );
-        })}
+                {expanded && (
+                  <div className="space-y-1 bg-base-accent p-3 text-sm">
+                    {color.spaces.map((space, j) =>
+                      Object.entries(space).map(([key, value]) =>
+                        value ? (
+                          <button key={`${j}-${key}`} onClick={() => handleCopy(value, i)} className="cursor-pointer flex w-full justify-between hover:text-primary">
+                            <span className="font-medium uppercase">{key}</span>
+                            <span>{value}</span>
+                          </button>
+                        ) : null
+                      )
+                    )}
+                  </div>
+                )}
+              </div>
+            );
+          })}
+        </div>
       </div>
     </div>
   );

package/src/components/editor/ChildBlockWrapper.tsx

@@ -0,0 +1,108 @@
+import { forwardRef, type ReactNode, type Ref } from "react";
+import type { Edge } from "@atlaskit/pragmatic-drag-and-drop-hitbox/closest-edge";
+import { CopyPlus } from "lucide-react";
+import { DragHandle } from "./DragHandle";
+import { DeleteButton } from "./DeleteButton";
+import { SettingsButton } from "./SettingsButton";
+import { ColSpanControl } from "./ColSpanControl";
+import { cn } from "../../lib/cn";
+
+export interface ChildBlockWrapperProps {
+  label: string;
+  columns: number;
+  colSpan: number;
+  closestEdge: Edge | null;
+  isDragging: boolean;
+  hasSettings: boolean;
+  /** Forwarded to the drag handle button (pragmatic-dnd dragHandle target). */
+  dragHandleRef?: Ref<HTMLButtonElement>;
+  onDelete: () => void;
+  onDuplicate: () => void;
+  onColSpanChange: (span: number) => void;
+  onOpenSettings?: () => void;
+  children: ReactNode;
+}
+
+export const ChildBlockWrapper = forwardRef<HTMLDivElement, ChildBlockWrapperProps>(
+  function ChildBlockWrapper(
+    {
+      label,
+      columns,
+      colSpan,
+      closestEdge,
+      isDragging,
+      hasSettings,
+      dragHandleRef,
+      onDelete,
+      onDuplicate,
+      onColSpanChange,
+      onOpenSettings,
+      children,
+    },
+    ref,
+  ) {
+    return (
+      <div
+        ref={ref}
+        className={cn(
+          "group/childblock relative h-full rounded-sm",
+          isDragging && "opacity-50",
+          "hover:outline hover:outline-2 hover:outline-primary/30",
+        )}
+      >
+        {/* Controls — vertical rail in the cell's LEFT gutter. Revealed on hover OR
+            focus-within, so an open col-span popover (which traps focus) keeps the rail
+            visible even when the pointer moves off the block to reach an option. */}
+        <div className="absolute top-0 left-0 -translate-x-full z-20 flex flex-col items-center gap-1 opacity-0 transition-opacity group-hover/childblock:opacity-100 group-focus-within/childblock:opacity-100 pointer-events-none">
+          <span className="sr-only">{label}</span>
+          <div className="pointer-events-auto">
+            <DragHandle ref={dragHandleRef} />
+          </div>
+          <div className="pointer-events-auto">
+            <ColSpanControl colSpan={colSpan} columns={columns} onChange={onColSpanChange} />
+          </div>
+          {hasSettings && onOpenSettings && (
+            <div className="pointer-events-auto">
+              <SettingsButton onClick={onOpenSettings} />
+            </div>
+          )}
+          <div className="pointer-events-auto">
+            <button
+              type="button"
+              aria-label="Duplicate block"
+              onClick={onDuplicate}
+              className="cursor-pointer rounded p-1 text-base-contrast-light hover:text-primary"
+            >
+              <CopyPlus size={16} />
+            </button>
+          </div>
+          <div className="pointer-events-auto">
+            <DeleteButton onDelete={onDelete} />
+          </div>
+        </div>
+
+        {/* Drop-edge indicators */}
+        {closestEdge === "left" && (
+          <div
+            data-drop-edge="left"
+            className="absolute bottom-0 left-0 top-0 z-10 w-0.5 -translate-x-1 bg-primary"
+          />
+        )}
+        {closestEdge === "right" && (
+          <div
+            data-drop-edge="right"
+            className="absolute bottom-0 right-0 top-0 z-10 w-0.5 translate-x-1 bg-primary"
+          />
+        )}
+        {closestEdge === "top" && (
+          <div data-drop-edge="top" className="absolute left-0 right-0 top-0 z-10 h-0.5 -translate-y-1 bg-primary" />
+        )}
+        {closestEdge === "bottom" && (
+          <div data-drop-edge="bottom" className="absolute left-0 right-0 bottom-0 z-10 h-0.5 translate-y-1 bg-primary" />
+        )}
+
+        {children}
+      </div>
+    );
+  },
+);

package/src/components/editor/ColSpanControl.tsx

@@ -0,0 +1,56 @@
+import { useRef, useState } from "react";
+import { Columns3 } from "lucide-react";
+import { Popover } from "../shared/Popover";
+import { PopoverItem } from "../shared/PopoverItem";
+import { cn } from "../../lib/cn";
+
+interface ColSpanControlProps {
+  colSpan: number;
+  columns: number;
+  onChange: (span: number) => void;
+}
+
+/** Contextual col-span picker — only meaningful inside a multi-column container. */
+export function ColSpanControl({ colSpan, columns, onChange }: ColSpanControlProps) {
+  const buttonRef = useRef<HTMLButtonElement>(null);
+  const [open, setOpen] = useState(false);
+
+  if (columns <= 1) return null;
+
+  const current = Math.min(Math.max(colSpan, 1), columns);
+
+  return (
+    <div className="relative">
+      <button
+        ref={buttonRef}
+        type="button"
+        aria-label="Column span"
+        aria-haspopup="true"
+        aria-expanded={open}
+        onClick={() => setOpen((v) => !v)}
+        className="pointer-events-auto inline-flex cursor-pointer items-center gap-1 rounded p-1 text-xs text-base-contrast-light hover:text-primary"
+      >
+        <Columns3 size={14} />
+      </button>
+
+      <Popover isOpen={open} onClose={() => setOpen(false)} anchorRef={buttonRef} className="min-w-28">
+        <ul role="list" className="py-1">
+          {Array.from({ length: columns }, (_, i) => i + 1).map((span) => (
+            <li key={span}>
+              <PopoverItem
+                aria-current={span === current}
+                onClick={() => {
+                  onChange(span);
+                  setOpen(false);
+                }}
+                className={cn(span === current && "font-semibold text-primary")}
+              >
+                Span {span}
+              </PopoverItem>
+            </li>
+          ))}
+        </ul>
+      </Popover>
+    </div>
+  );
+}