@getvitops/generator 8.0.1 → 8.2.0-alpha.0

package/dist/index.mjs

@@ -1,2253 +1,15 @@
-import { createRequire } from "node:module";
+import { _ as SYSTEM_DARK_SEL, a as expandPalette, b as roleHue, c as monotonicityErrors, d as tokenVar, f as validateColorContract, g as ROLE_TOKEN_KEYS, h as REQUIRED_ROLES, i as checkContrast, l as patchToOverrideCss, m as DARK_SEL, n as NUMERIC_STEPS, o as functionalRole, p as BASE_HOOK, r as buildReverseIndex, s as ladderWarnings, t as CONTRAST, u as tokenClass, v as TW_CLASH, x as roleKind, y as TYPO_KEYMAP } from "./tokens-zi594IZ3.mjs";
+import { A as jsonSchema, C as resolveTheme, D as DesignSystemSchema, E as validateConfig, M as movedTokens, O as SCHEMA_LOCAL_PATH, S as resolvePrivacyContact, T as stripNulls, _ as getAt, a as CONFIG_VERSION, b as resolveConfig, c as JURISDICTIONS, d as SiteFontSchema, f as configJsonSchema, g as formatConfig, h as experimentDimensionWarnings, i as CONFIG_SCHEMA_URL, j as validate, k as SCHEMA_URL, l as JURISDICTION_COUNTRIES, m as designSystemPath, n as BIGIN_DATA_CENTERS, o as CRM_PROVIDERS, p as deepMerge, r as CONFIG_SCHEMA_LOCAL_PATH, s as ConfigSchema, t as AD_PROVIDERS, u as PLAN_CAPABILITIES, v as isConfig, w as setAt, x as resolveInput, y as mergePatch } from "./config-DvbYx3Gi.mjs";
+import { buildIconSprite, loadIconSvg, spriteId } from "./icons-sprite.mjs";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
 import { createHash } from "node:crypto";
 import { transform } from "lightningcss";
-import * as z from "zod/mini";
-import { LIGHTNESS_LADDER, contrastLc, generateOklchPalette, hexToOklch, oklchStringToHex, pickOn, tintedEndpoints } from "@getvitops/utils/color";
 import { AD_PLATFORMS, AD_PROVIDER_KEYS } from "@getvitops/utils/ads";
 import { generateIconInclude, nodesToHtml, resolveIcon, t } from "@getvitops/utils";
-import { getIconData, iconToSVG, replaceIDs } from "@iconify/utils";
 import { resolveSitemapUrl } from "@getvitops/utils/indexing";
 
-//#region src/shared.ts
-/**
-* Data shared between the generator (`generate.ts`) and the docs bundle
-* (`docs.ts`). Lives in its own module because `generate.ts` imports `docs.ts` —
-* importing back the other way would be a cycle.
-*/
-/**
-* Selector the dark functional-token flip hangs off.
-*
-* `data-brx-theme` is Bricks' own attribute — Bricks sets it, so it's what the
-* WordPress target needs. Nothing sets it anywhere else, which meant the dark
-* flip was unreachable outside Bricks: the shipped `<wc-color-scheme-toggle>` web
-* component writes `documentElement.dataset.theme` (i.e. `data-theme`), so
-* clicking "Dark" changed an attribute no rule matched. Matching both makes the
-* component work on every target without changing what Bricks already does.
-*
-* This covers the EXPLICIT choice. The OS preference is a second, opt-in block —
-* see `SYSTEM_DARK_SEL` — because turning it on flips a site dark for dark-OS
-* users, which is the site's decision rather than the design system's.
-*
-* Shared so the docs quote the selector the generator actually emits.
-*/
-const DARK_SEL = ":root[data-brx-theme=\"dark\"], :root[data-theme=\"dark\"]";
-/**
-* Selector for the OS-preference dark block, emitted inside
-* `@media (prefers-color-scheme: dark)` when a site opts in.
-*
-* Derived from `DARK_SEL`'s attributes rather than written out a third time, and
-* inverted: this must apply when NO explicit choice has been made. That is
-* exactly what `<wc-color-scheme-toggle>`'s "System" position produces — it removes
-* `data-theme` entirely — so with this block present System resolves to the OS
-* instead of silently falling through to light, and needs no JS to do it.
-*
-* The `:not()`s are what keep an explicit *light* choice winning over a dark OS.
-*/
-const SYSTEM_DARK_SEL = `:root${DARK_SEL.split(", ").map((s) => s.replace(/^:root\[([\w-]+)="dark"\]$/, "[$1=\"light\"]")).map((attr) => `:not(${attr})`).join("")}`;
-/**
-* Roles the shipped CSS partials reference with NO fallback, so a config that
-* omits one leaves those rules resolving to nothing — an invalid declaration,
-* not a graceful degrade.
-*
-* `colors.roles` is an open record: any name works and generates a full token
-* set, utilities and dark flip. But the framework's own component CSS is
-* written against these six, so "roles are arbitrary" is only half true — they
-* are *extensible*, over a required core. `validate()` warns when one is
-* missing; `required-roles.test.ts` re-derives this list from the partials so
-* it cannot drift as components are added.
-*
-* Kept as a constant rather than scanned at call time because `validate()` is
-* a pure function — the CLI, the Vite plugin and `toJSONSchema` all import it,
-* and none of them should touch the filesystem to answer "is this config ok?".
-*/
-const REQUIRED_ROLES = [
-	"brand-primary",
-	"danger",
-	"neutral",
-	"surface",
-	"ui-primary",
-	"warning"
-];
-/**
-* Every token key a role can resolve to, across both role kinds. Shared so the
-* required-roles drift test greps for exactly what the generator emits.
-*
-* These are *keys*, not var names: the role sits in the middle of the property
-* (`--color-bg-danger-muted`), so compose them with `tokenVar()` from `tokens.ts`
-* rather than concatenating by hand.
-*/
-const ROLE_TOKEN_KEYS = [
-	"bg",
-	"bg-muted",
-	"bg-x-muted",
-	"bg-bold",
-	"bg-x-bold",
-	"bg-solid",
-	"bg-solid-bold",
-	"bg-solid-x-bold",
-	"text",
-	"text-bold",
-	"text-muted",
-	"text-x-muted",
-	"text-xx-muted",
-	"text-on",
-	"text-on-bold",
-	"icon",
-	"icon-muted",
-	"border",
-	"border-muted",
-	"border-bold"
-];
-/** The palette hue a role points at, through either authoring form. */
-const roleHue = (spec) => typeof spec === "string" ? spec : spec.hue;
-/**
-* A role's kind. The bare-string shorthand means `chromatic`, because signal
-* colours are the common case and surfaces are the two or three you name once.
-*/
-const roleKind = (spec) => typeof spec === "string" ? "chromatic" : spec.kind ?? "chromatic";
-/**
-* Pattern base geometry props → per-pattern override-hook shorthand. Each hook
-* wraps the authored value (`padding: var(--p-btn, 0.4em 0.8em)`) so a
-* consumer restyles one pattern by setting one variable. The hook is named after
-* the pattern's key, not its class.
-*/
-const BASE_HOOK = {
-	padding: "p",
-	"border-radius": "br",
-	border: "b",
-	"box-shadow": "ds",
-	"font-size": "fs",
-	background: "bg",
-	"background-color": "bg"
-};
-/**
-* Framework utility classes whose names collide with Tailwind's own defaults.
-* The `tailwind` format strips any rule targeting these — Tailwind provides
-* them, so consumers use Tailwind's utilities for these names instead.
-*/
-const TW_CLASH = new Set([
-	"block",
-	"inline",
-	"inline-block",
-	"flow-root",
-	"flex",
-	"inline-flex",
-	"grid",
-	"inline-grid",
-	"table",
-	"inline-table",
-	"table-caption",
-	"table-cell",
-	"table-row",
-	"contents",
-	"hidden",
-	"list-item",
-	"static",
-	"fixed",
-	"absolute",
-	"relative",
-	"sticky",
-	"isolate",
-	"visible",
-	"invisible",
-	"collapse",
-	"sr-only",
-	"not-sr-only",
-	"flex-row",
-	"flex-row-reverse",
-	"flex-col",
-	"flex-col-reverse",
-	"flex-wrap",
-	"flex-nowrap",
-	"items-start",
-	"items-end",
-	"items-center",
-	"items-baseline",
-	"items-stretch",
-	"justify-start",
-	"justify-end",
-	"justify-center",
-	"justify-between",
-	"justify-around",
-	"justify-evenly",
-	"content-start",
-	"content-end",
-	"content-center",
-	"content-between",
-	"content-around",
-	"content-evenly",
-	"text-left",
-	"text-center",
-	"text-right",
-	"text-justify",
-	"text-start",
-	"text-end",
-	"text-wrap",
-	"text-nowrap",
-	"text-balance",
-	"text-pretty",
-	"rounded-none",
-	"rounded-full"
-]);
-
-//#endregion
-//#region src/tokens.ts
-/**
-* Palette expansion + semantic colour tokens.
-*
-* A palette hue is authored one of two ways:
-*   • `{ seed, anchors? }` — an 11-step numeric scale (50…950) generated in
-*     OKLCH via @getvitops/utils/color. Lightness comes from the shared
-*     `LIGHTNESS_LADDER`; the seed (and any anchors) are reproduced verbatim at
-*     their steps.
-*   • `{ tones }` — a fixed brand kit: authored tones placed verbatim at their
-*     nearest steps + tinted endpoints; nothing else is invented (strict kits).
-*
-* **The grammar.** Every role gets tokens named `--color-<target>-<role>[-<variant>]`,
-* where target ∈ bg | text | icon | border. Putting the target *inside* the name is
-* the point: `--color-bg-danger-muted` and `--color-text-danger-muted` are distinct
-* tokens, so the two axes that used to collide over one `<family>-<role>-<modifier>
-* ` namespace cannot any more. The utility class is the token name minus `--color-`.
-*
-* Variants are ordinal — xx-muted < x-muted < muted < (bare) < bold < x-bold —
-* and the tables are **sparse**: a target only emits the cells that are actually
-* viable. `bold` means "more emphatic than the role's default in the current
-* appearance", not "darker"; the appearance decides polarity.
-*
-* Roles come in two kinds (declared in `colors.roles`):
-*   • `surface` — a page/panel colour. Has a bare `bg-<role>` plus the full
-*     emphasis range and the complete text scale.
-*   • `chromatic` (default) — a signal colour. Backgrounds split into *tints*
-*     (`bg-<role>-x-muted` / `-muted`) and *solids* (`bg-<role>-solid[-bold|-x-bold]`);
-*     there is deliberately **no bare `bg-<role>`**, because "how loud?" is a
-*     question the author has to answer.
-*
-* Dark mode re-points which step each token reads; the solid family and the
-* `text-on-<role>` foreground computed against it stay mode-stable, so a filled
-* button keeps its identity across appearances.
-*/
-const NUMERIC_STEPS = [
-	"50",
-	"100",
-	"200",
-	"300",
-	"400",
-	"500",
-	"600",
-	"700",
-	"800",
-	"900",
-	"950"
-];
-/**
-* Lightness of each numeric step. Re-exported from the engine's ladder rather
-* than restated — there used to be three copies of this curve (here, the engine,
-* and the linter) and they were free to drift.
-*/
-const STEP_L = Object.fromEntries(NUMERIC_STEPS.map((s) => [s, LIGHTNESS_LADDER[Number(s)]]));
-const isHex = (v) => v.startsWith("#");
-const toOklchStr = (v) => {
-	if (!isHex(v)) return v;
-	const { l, c, h } = hexToOklch(v);
-	return `oklch(${(l * 100).toFixed(2)}% ${c.toFixed(4)} ${h.toFixed(2)})`;
-};
-const nearestStep = (l) => NUMERIC_STEPS.reduce((best, s) => Math.abs(l - STEP_L[s]) < Math.abs(l - STEP_L[best]) ? s : best);
-/**
-* Claim `step` for `value`, refusing to overwrite a step another colour already
-* took.
-*
-* Silently dropping one of two colliding tones is the worst outcome: the palette
-* still builds, and the tone the author cared about is simply gone. The record
-* form (`tones: { "600": "#…", "700": "#…" }`) is the escape hatch, so the error
-* points at it.
-*/
-function claim(into, step, value, hueLabel, what) {
-	const taken = into[step];
-	if (taken != null && taken !== value) throw new Error(`palette hue "${hueLabel}": ${what} ${value} and ${taken} both map to step ${step}. Key them explicitly, e.g. { "${step}": "${taken}", "${Number(step) + 100}": "${value}" }.`);
-	into[step] = value;
-}
-function expandSeeded(input, hueLabel) {
-	const anchors = {};
-	for (const [key, value] of Object.entries(input.anchors ?? {})) claim(anchors, NUMERIC_STEPS.includes(key) ? key : nearestStep(hexToOklch(value).l), toOklchStr(value), hueLabel, "anchors");
-	const seedStep = nearestStep(hexToOklch(input.seed).l);
-	anchors[seedStep] ??= toOklchStr(input.seed);
-	const scale = generateOklchPalette(anchors);
-	const numeric = {};
-	for (const s of NUMERIC_STEPS) if (scale[s] != null) numeric[s] = oklchStringToHex(scale[s]);
-	return {
-		numeric,
-		deviations: deviationsFor(anchors)
-	};
-}
-function expandTones(input, hueLabel) {
-	const entries = Array.isArray(input.tones) ? input.tones.map((hex) => [null, hex]) : Object.entries(input.tones).map(([k, hex]) => [k, hex]);
-	const placed = {};
-	for (const [key, hex] of entries) claim(placed, key != null && NUMERIC_STEPS.includes(key) ? key : nearestStep(hexToOklch(hex).l), hex, hueLabel, "tones");
-	const numeric = {};
-	for (const [step, hex] of Object.entries(placed)) numeric[step] = hex;
-	const ends = tintedEndpoints(hexToOklch(entries[0]?.[1] ?? "#808080").h);
-	numeric["50"] ??= ends.light;
-	numeric["950"] ??= ends.dark;
-	return {
-		numeric,
-		sparse: true,
-		deviations: deviationsFor(placed)
-	};
-}
-/** How far each pinned colour sits from its step's ladder lightness. */
-function deviationsFor(pinned) {
-	const out = {};
-	for (const [step, value] of Object.entries(pinned)) out[step] = (isHex(value) ? hexToOklch(value).l : hexToOklch(oklchStringToHex(value)).l) - STEP_L[step];
-	return out;
-}
-/** Snap to the nearest AVAILABLE numeric step (sparse kits). */
-function snap(numeric, want) {
-	if (numeric[want] != null) return want;
-	return NUMERIC_STEPS.filter((s) => numeric[s] != null).reduce((best, s) => Math.abs(STEP_L[s] - STEP_L[want]) < Math.abs(STEP_L[best] - STEP_L[want]) ? s : best);
-}
-/** Expand every palette hue into its numeric scale. */
-function expandPalette(raw) {
-	const out = {};
-	for (const [name, entry] of Object.entries(raw)) {
-		const e = entry;
-		if (typeof e?.seed === "string") out[name] = expandSeeded(e, name);
-		else if (e?.tones != null) out[name] = expandTones(e, name);
-		else throw new Error(`palette hue "${name}" must have a "seed" or "tones"`);
-	}
-	return out;
-}
-/**
-* Warn about pinned colours that sit noticeably off the ladder. Not an error:
-* the author asked for that exact colour and gets it. But at ~0.03 L the hue
-* starts reading visibly heavier or lighter than its siblings at that step, and
-* that is the class of drift the fixed ladder exists to prevent.
-*/
-const LADDER_TOLERANCE = .03;
-function ladderWarnings(palette) {
-	const warnings = [];
-	for (const [hue, expanded] of Object.entries(palette)) for (const [step, deviation] of Object.entries(expanded.deviations ?? {})) {
-		if (Math.abs(deviation) <= LADDER_TOLERANCE) continue;
-		const dir = deviation > 0 ? "lighter" : "darker";
-		warnings.push(`colors.palette.${hue}: the colour pinned at step ${step} is ${Math.abs(deviation).toFixed(3)} ${dir} than the shared lightness ladder — this hue will read ${dir} than others at ${step}. Legal, but move it to a neighbouring step if that wasn't intended.`);
-	}
-	return warnings;
-}
-/**
-* Gamut mapping nudges lightness by a hair, so an exact `<` comparison would
-* report rounding as an inversion. Well below any deviation a person could see.
-*/
-const MONOTONIC_EPSILON = .001;
-/**
-* Ramps whose lightness does not fall monotonically from 50 to 950.
-*
-* A ramp built from the ladder alone cannot invert — only pinned colours (a seed,
-* an `anchor`, a `tones` entry) can, because they are the one thing allowed off
-* it. `ladderWarnings` will not catch it: it compares each pinned step against
-* *its own* ladder rung, never against its neighbours, so it reports the wrong
-* defect ("reads darker than others at 600") while the real problem is that 600
-* is darker than 700. And since `LADDER_TOLERANCE` is 0.03 — the same size as the
-* ladder's own 50→100 gap — two anchors can each sit within tolerance and still
-* invert, with no warning at all.
-*
-* This is an error rather than a warning because the rest of the system assumes
-* the order: `snap` picks the nearest step by ladder lightness, the mode-stable
-* solid family hard-codes 600/700/800 as increasingly dark, and both dark tables
-* re-point steps on the same assumption. An inverted ramp therefore runs hover
-* states backwards — the failure the fixed ladder was introduced to eliminate.
-*/
-function monotonicityErrors(palette) {
-	const errors = [];
-	for (const [hue, expanded] of Object.entries(palette)) {
-		const numeric = expanded.numeric ?? {};
-		const steps = NUMERIC_STEPS.filter((s) => numeric[s] != null);
-		for (let i = 1; i < steps.length; i++) {
-			const [prev, step] = [steps[i - 1], steps[i]];
-			const lPrev = hexToOklch(numeric[prev]).l;
-			const lStep = hexToOklch(numeric[step]).l;
-			if (lStep < lPrev + MONOTONIC_EPSILON) continue;
-			const pinned = expanded.deviations ?? {};
-			const culprits = [prev, step].filter((s) => pinned[s] != null);
-			const fix = culprits.length ? culprits.map((s) => {
-				const l = hexToOklch(numeric[s]).l;
-				return `${numeric[s]} (pinned at ${s}) sits at L ${l.toFixed(3)}, nearest step ${nearestStep(l)}`;
-			}).join("; ") : `no step here is pinned, so this is a bug in the generator rather than in your config`;
-			errors.push(`colors.palette.${hue}: step ${step} (${numeric[step]}, L ${lStep.toFixed(3)}) is LIGHTER than step ${prev} (${numeric[prev]}, L ${lPrev.toFixed(3)}). A ramp must darken from 50 to 950 — inverted, a hover from \`bg-<role>-solid\` to \`-solid-bold\` gets lighter, and the dark-mode tables re-point steps assuming the order. ${fix}.`);
-		}
-	}
-	return errors;
-}
-/**
-* Surface roles: a bare `bg` (cards, panels, inputs), `bg-muted` for the page
-* behind them, `bg-x-muted` for wells, and `bg-bold`/`-x-bold` for the inverse
-* surface a tooltip sits on. Elevation is expressed by *which* token you reach
-* for — page `bg-muted`, card `bg` — rather than by a raised/sunken pair. That
-* is what lets a future `data-surfaces` axis flatten it without touching markup.
-*/
-const SURFACE_LIGHT = {
-	bg: "50",
-	"bg-muted": "100",
-	"bg-x-muted": "200",
-	"bg-bold": "800",
-	"bg-x-bold": "950",
-	text: "900",
-	"text-bold": "950",
-	"text-muted": "700",
-	"text-x-muted": "500",
-	"text-xx-muted": "400",
-	"text-on-bold": "50",
-	icon: "600",
-	"icon-muted": "500",
-	"border-muted": "200",
-	border: "300",
-	"border-bold": "600"
-};
-const SURFACE_DARK = {
-	bg: "900",
-	"bg-muted": "950",
-	"bg-x-muted": "950",
-	"bg-bold": "200",
-	"bg-x-bold": "50",
-	text: "100",
-	"text-bold": "50",
-	"text-muted": "300",
-	"text-x-muted": "500",
-	"text-xx-muted": "600",
-	"text-on-bold": "950",
-	icon: "400",
-	"icon-muted": "500",
-	"border-muted": "800",
-	border: "700",
-	"border-bold": "400"
-};
-/**
-* Chromatic roles: tints for alert/badge backgrounds, solids for fills. No bare
-* `bg` — see the module docblock. No `text-muted` either: a de-emphasised
-* coloured text could not hold its contrast target off a white surface, so the
-* way to soften coloured text is weight/size, not another colour.
-*/
-const CHROMATIC_LIGHT = {
-	"bg-x-muted": "50",
-	"bg-muted": "100",
-	text: "700",
-	"text-bold": "900",
-	icon: "600",
-	border: "200",
-	"border-bold": "300"
-};
-const CHROMATIC_DARK = {
-	"bg-x-muted": "950",
-	"bg-muted": "900",
-	text: "300",
-	"text-bold": "200",
-	icon: "400",
-	border: "800",
-	"border-bold": "700"
-};
-/**
-* The solid family — mode-stable, so a filled button keeps its identity when the
-* appearance flips. Fixed steps rather than the old scan-and-clamp: with a shared
-* lightness ladder every hue's 600 already sits at the same lightness, so there
-* is nothing left to search for. `text-on-<role>` is computed against `bg-solid`.
-*/
-const SOLID = {
-	"bg-solid": "600",
-	"bg-solid-bold": "700",
-	"bg-solid-x-bold": "800"
-};
-/**
-* Map a token key to its CSS custom property for a given role.
-*
-* `on` is the one irregular case: the foreground for a filled surface reads
-* `--color-text-on-<role>`, with the role *after* `on`, because it names what it
-* sits on rather than what it is.
-*
-* The utility class name is this minus the `--color-` prefix, which is why the
-* emitter and the linter can both derive their vocabulary from one function.
-*/
-function tokenVar(role, key) {
-	const dash = key.indexOf("-");
-	const target = dash === -1 ? key : key.slice(0, dash);
-	const variant = dash === -1 ? "" : key.slice(dash + 1);
-	if (variant === "on") return `--color-${target}-on-${role}`;
-	if (variant.startsWith("on-")) return `--color-${target}-on-${role}-${variant.slice(3)}`;
-	return variant ? `--color-${target}-${role}-${variant}` : `--color-${target}-${role}`;
-}
-/** The class name a token key produces for a role (`bg-danger-solid`, …). */
-const tokenClass = (role, key) => tokenVar(role, key).slice(8);
-/** Resolve the token set for one role over its hue. */
-function functionalRole(role, hueName, hue, kind = "chromatic") {
-	const numeric = hue.numeric;
-	const v = (n) => `var(--color-${hueName}-${snap(numeric, n)})`;
-	const hex = (n) => numeric[snap(numeric, n)];
-	const map = (table) => {
-		const out = {};
-		for (const [token, step] of Object.entries(table)) out[token] = v(step);
-		return out;
-	};
-	const solids = map(SOLID);
-	const onSolid = pickOn(hex(SOLID["bg-solid"]));
-	return {
-		role,
-		hue: hueName,
-		kind,
-		light: {
-			...map(kind === "surface" ? SURFACE_LIGHT : CHROMATIC_LIGHT),
-			...solids,
-			"text-on": onSolid
-		},
-		dark: {
-			...map(kind === "surface" ? SURFACE_DARK : CHROMATIC_DARK),
-			...solids,
-			"text-on": onSolid
-		}
-	};
-}
-/**
-* APCA targets. `TEXT` is the body-text bar; `SECONDARY` covers text on a
-* non-primary surface and de-emphasised text. `NON_TEXT` is the icon/boundary
-* tier — the APCA analogue of WCAG's 3:1, where a glyph may run more vivid than
-* text because shape carries meaning alongside contrast.
-*/
-const CONTRAST = {
-	TEXT: 75,
-	SECONDARY: 60,
-	NON_TEXT: 45
-};
-/**
-* Text tokens deliberately exempt from the contract. Placeholders and disabled
-* text are required to look unavailable; holding them to the body-text bar would
-* defeat the affordance. Nothing else may be exempt.
-*/
-const EXEMPT_TEXT = new Set(["text-x-muted", "text-xx-muted"]);
-/**
-* Verify a role's contrast targets. Returns human-readable failures.
-*
-* Chromatic roles are checked against the surface planes they actually sit on
-* (`surfaceBg`) as well as their own tints — coloured text almost never appears
-* over its own solid, it appears over the page. Checking only within the role
-* would have missed the pairing that matters most.
-*/
-function checkContrast(fr, numericOf, surfaceBg) {
-	const failures = [];
-	const resolve = (val) => {
-		const m = /^var\(--color-([a-z0-9-]+)-(\d+)\)$/.exec(val);
-		if (!m) return val;
-		return numericOf(m[1])[m[2]] ?? val;
-	};
-	const fail = (appearance, msg) => failures.push(`${fr.role}/${appearance}: ${msg}`);
-	for (const [appearance, tokens] of [["light", fr.light], ["dark", fr.dark]]) {
-		const ownBg = Object.keys(tokens).filter((k) => k === "bg" || k.startsWith("bg-")).filter((k) => !k.startsWith("bg-solid")).filter((k) => !k.startsWith("bg-bold") && !k.startsWith("bg-x-bold"));
-		const planes = fr.kind === "surface" ? ownBg.map((k) => [k, resolve(tokens[k])]) : [...(surfaceBg?.[appearance] ?? []).map((h, i) => [`surface#${i}`, h]), ...ownBg.map((k) => [k, resolve(tokens[k])])];
-		for (const [planeName, bg] of planes) {
-			const textMin = planeName === "bg" ? CONTRAST.TEXT : CONTRAST.SECONDARY;
-			for (const key of [
-				"text",
-				"text-bold",
-				"text-muted"
-			]) {
-				if (tokens[key] == null || EXEMPT_TEXT.has(key)) continue;
-				const min = key === "text-muted" ? CONTRAST.SECONDARY : textMin;
-				const lc = contrastLc(resolve(tokens[key]), bg);
-				if (lc < min) fail(appearance, `${key} Lc ${lc.toFixed(1)} < ${min} on ${planeName} ${bg}`);
-			}
-			const nonText = fr.kind === "surface" ? ["icon", "border-bold"] : ["icon"];
-			for (const key of nonText) {
-				if (tokens[key] == null) continue;
-				const lc = contrastLc(resolve(tokens[key]), bg);
-				if (lc < CONTRAST.NON_TEXT) fail(appearance, `${key} Lc ${lc.toFixed(1)} < ${CONTRAST.NON_TEXT} on ${planeName} ${bg}`);
-			}
-		}
-		const solid = resolve(tokens["bg-solid"]);
-		const onLc = contrastLc(tokens["text-on"], solid);
-		if (onLc < CONTRAST.SECONDARY) fail(appearance, `text-on Lc ${onLc.toFixed(1)} < ${CONTRAST.SECONDARY} on bg-solid`);
-		if (tokens["bg-bold"] != null && tokens["text-on-bold"] != null) {
-			const lc = contrastLc(resolve(tokens["text-on-bold"]), resolve(tokens["bg-bold"]));
-			if (lc < CONTRAST.TEXT) fail(appearance, `text-on-bold Lc ${lc.toFixed(1)} < ${CONTRAST.TEXT} on bg-bold`);
-		}
-	}
-	return failures;
-}
-
-//#endregion
-//#region src/token-refs.ts
-/**
-* Cross-layer check: does every `var(--…)` a config authors resolve to a token
-* the generator actually emits?
-*
-* A `patterns` value is a string the schema deliberately does not interpret
-* (see `CssDecls` in `schema.ts`), so a reference to a token that does not exist
-* parses, generates, minifies and ships. The declaration then resolves to
-* `inherit`/`unset` in the browser and nothing anywhere says so. Downstream this
-* shipped a `.cta` whose `color` fell back to `inherit` on a brand fill —
-* unreadable text on every filled button — and two of the four dead references
-* in that config had been dead for several versions.
-*
-* **The check is anchored to namespaces the generator owns**, exactly as
-* `vitops lint` is anchored to classes derived from the consumer's own config.
-* A pattern may legitimately reference a framework token defined in
-* `@getvitops/core`'s hand-written CSS (`--icon-size`, `--animation-duration`,
-* a consumer's own hook), and `validate()` is a pure function that must not read
-* the filesystem to find out. Enumerating "every valid token" would therefore
-* turn every such reference into a false positive. Enumerating only what the
-* generator emits — the colour layer, shadows, z-tiers — is a set it can compute
-* from the config alone, and it is where the dangling references actually occur.
-*
-* `FRAMEWORK_OWNED` is the one leak in that reasoning: a token that sits inside
-* an owned prefix but is defined by core's CSS instead. `token-refs.test.ts`
-* greps the shipped partials and fails if a new one appears, so the allowlist
-* cannot silently go stale.
-*
-* A reference carrying a fallback (`var(--x, 0.25rem)`) is **never** flagged: the
-* fallback is the author stating what happens when the token is absent, which is
-* the whole difference between a considered default and an accident.
-*/
-/**
-* Prefixes whose entire contents the generator emits. A `var()` inside one of
-* these either resolves to something the colour/shadow/z layer defines, or it
-* resolves to nothing — there is no third possibility, which is what makes an
-* error (rather than a warning) the right severity.
-*/
-const OWNED_PREFIXES = [
-	"--color-",
-	"--shadow-",
-	"--z-tier-"
-];
-/** Singleton tokens the colour layer emits, checked by exact name. */
-const OWNED_EXACT = new Set(["--surface-glass", "--overlay"]);
-/**
-* Tokens inside an owned prefix that `@getvitops/core`'s hand-written CSS
-* defines rather than the generator. Drift-guarded by `token-refs.test.ts`.
-*/
-const FRAMEWORK_OWNED = new Set(["--color-swatch-size"]);
-/**
-* Roles whose name says "this is a surface" while the bare-string shorthand
-* says `chromatic`. The two kinds emit *different token sets* — a chromatic role
-* has no bare `bg`, so `--color-bg-surface` and every `.bg-surface` utility
-* simply cease to exist, taking 36 references in the framework's own CSS with
-* them. Naming one of these and getting the chromatic set is almost always a
-* mistake, and it is the exact one a downstream config made.
-*/
-const SURFACE_SHAPED = new Set([
-	"surface",
-	"neutral",
-	"background",
-	"page",
-	"canvas"
-]);
-/**
-* The 1.0 colour-grammar rename, as data.
-*
-* Old suffix (on `--<role>-<suffix>`) → new token key (fed through `tokenVar`).
-* Transcribed from the migration table in the 1.0 changelog; `surface` rotates
-* separately below because its rename is value-preserving rather than
-* mechanical. `--color-<role>-<variant>` "stops" are deliberately absent — the
-* changelog says to judge those by use, and they already land in the owned
-* `--color-` namespace, so the generic check catches them with a near-miss hint.
-*/
-const MOVED_SUFFIXES = {
-	bg: "bg-x-muted",
-	"bg-muted": "bg-muted",
-	solid: "bg-solid",
-	"solid-bold": "bg-solid-bold",
-	"solid-x-bold": "bg-solid-x-bold",
-	"on-solid": "text-on",
-	"on-solid-bold": "text-on-bold",
-	text: "text",
-	"text-muted": "text-muted",
-	"text-x-muted": "text-x-muted",
-	"text-xx-muted": "text-xx-muted",
-	"text-bold": "text-bold",
-	icon: "icon",
-	"icon-muted": "icon-muted",
-	border: "border",
-	"border-muted": "border-muted",
-	"border-bold": "border-bold"
-};
-/**
-* `surface`'s background names rotate rather than map: what was `--surface-bg`
-* (the page) is now `--color-bg-surface-muted`, and what was `--surface-bg-bold`
-* (raised) is now `--color-bg-surface`. Applying the chromatic rule to it would
-* silently move the page background two rungs.
-*/
-const SURFACE_BG_ROTATION = {
-	bg: "bg-muted",
-	"bg-bold": "bg",
-	"bg-muted": "bg-x-muted"
-};
-/**
-* Old-grammar token name → its 1.0 replacement, for the roles this config
-* declares.
-*
-* Built per-config rather than as a static table because the old names embed
-* the *consumer's own* role names — there is no fixed list to hard-code, which
-* is why nothing detected these before.
-*/
-function movedTokens(roles) {
-	const out = {};
-	for (const [role, spec] of Object.entries(roles)) {
-		const rotate = roleKind(spec) === "surface";
-		for (const [old, key] of Object.entries(MOVED_SUFFIXES)) out[`--${role}-${old}`] = tokenVar(role, rotate && SURFACE_BG_ROTATION[old] || key);
-		if (rotate) for (const [old, key] of Object.entries(SURFACE_BG_ROTATION)) out[`--${role}-${old}`] = tokenVar(role, key);
-	}
-	return out;
-}
-/**
-* Extract every `var(--name[, fallback])` from a CSS value.
-*
-* Hand-rolled rather than a regex because the fallback has to be detected at the
-* reference's *own* paren depth: in `var(--a, var(--b))` the outer reference has
-* a fallback and the inner one does not, and a regex that stops at the first `)`
-* gets both wrong.
-*/
-function extractVarRefs(value, path) {
-	const out = [];
-	for (let i = value.indexOf("var("); i !== -1; i = value.indexOf("var(", i + 1)) {
-		let j = i + 4;
-		while (j < value.length && /\s/.test(value[j])) j++;
-		const start = j;
-		while (j < value.length && /[\w-]/.test(value[j])) j++;
-		const name = value.slice(start, j);
-		if (!name.startsWith("--")) continue;
-		let depth = 0;
-		let fallback = false;
-		for (let k = j; k < value.length; k++) {
-			const c = value[k];
-			if (c === "(") depth++;
-			else if (c === ")") {
-				if (depth === 0) break;
-				depth--;
-			} else if (c === "," && depth === 0) fallback = true;
-		}
-		out.push({
-			path,
-			name,
-			fallback
-		});
-	}
-	return out;
-}
-/** Recursively collect refs from a value that may be a string or a nested map. */
-const walkValue = (value, path, out) => {
-	if (typeof value === "string") out.push(...extractVarRefs(value, path));
-	else if (value != null && typeof value === "object" && !Array.isArray(value)) for (const [k, v] of Object.entries(value)) walkValue(v, `${path}.${k}`, out);
-};
-/**
-* Every authored declaration that can hold a `var()`.
-*
-* `patterns` is where the reported failures were, but `typography.roles.*.color`
-* and a `shadows` entry are authored the same way and fail the same way, so the
-* same walk covers them. `patterns.items.*.states` is walked recursively — a
-* state's `css` shortcut is a nested declaration map.
-*/
-function collectVarRefs(ds) {
-	const out = [];
-	const p = ds.patterns ?? {};
-	walkValue(p["defaults"], "patterns.defaults", out);
-	walkValue(p["radii"], "patterns.radii", out);
-	walkValue(p["groups"], "patterns.groups", out);
-	for (const [name, item] of Object.entries(p["items"] ?? {})) {
-		const it = item ?? {};
-		walkValue(it["base"], `patterns.items.${name}.base`, out);
-		walkValue(it["overrides"], `patterns.items.${name}.overrides`, out);
-		walkValue(it["states"], `patterns.items.${name}.states`, out);
-	}
-	walkValue(ds.typography?.["roles"], "typography.roles", out);
-	walkValue(ds.shadows, "shadows", out);
-	return out;
-}
-/**
-* The custom properties the generator emits, as names.
-*
-* Derived from the same functions the emitter uses — `expandPalette` for the
-* ramps and `functionalRole` + `tokenVar` for the role set — so the check cannot
-* disagree with the output about what exists. Both appearances are unioned: a
-* token that only appears in the dark block is still defined.
-*/
-function emittedTokens(ds) {
-	const defined = /* @__PURE__ */ new Set();
-	const palette = expandPalette(ds.colors.palette);
-	for (const [hueName, hue] of Object.entries(palette)) for (const n of Object.keys(hue.numeric)) defined.add(`--color-${hueName}-${n}`);
-	let hasSurface = false;
-	for (const [role, spec] of Object.entries(ds.colors.roles)) {
-		const hueName = roleHue(spec);
-		const hue = palette[hueName];
-		if (hue == null) continue;
-		const kind = roleKind(spec);
-		if (role === "surface" && kind === "surface") hasSurface = true;
-		const fr = functionalRole(role, hueName, hue, kind);
-		for (const key of new Set([...Object.keys(fr.light), ...Object.keys(fr.dark)])) defined.add(tokenVar(role, key));
-	}
-	if (Object.keys(ds.colors.roles).length) defined.add("--color-border-focus");
-	if (hasSurface) {
-		defined.add("--surface-glass");
-		defined.add("--overlay");
-	}
-	for (const name of Object.keys(ds.shadows ?? {})) defined.add(`--shadow-${name}`);
-	for (const name of Object.keys(ds.patterns?.z ?? {})) defined.add(`--z-tier-${name}`);
-	return defined;
-}
-/** Whether this check has an opinion about a given custom property. */
-const isOwned = (name) => !FRAMEWORK_OWNED.has(name) && (OWNED_EXACT.has(name) || OWNED_PREFIXES.some((p) => name.startsWith(p)));
-/**
-* Suggest a near-miss from the emitted set, so the message names the fix rather
-* than only the failure. Cheap edit-distance-ish heuristic: same prefix, or a
-* one-segment difference.
-*/
-const nearest = (name, defined) => {
-	const segs = name.split("-").filter(Boolean);
-	let best;
-	let bestScore = 0;
-	for (const cand of defined) {
-		const cs = cand.split("-").filter(Boolean);
-		const score = cs.filter((s) => segs.includes(s)).length - Math.abs(cs.length - segs.length) * .5;
-		if (score > bestScore) {
-			bestScore = score;
-			best = cand;
-		}
-	}
-	return bestScore >= Math.max(2, segs.length - 1) ? best : void 0;
-};
-/**
-* Check a parsed design system's authored `var()` references, plus the
-* role-kind heuristic that produces most of them.
-*
-* Returns messages rather than issues so `validate()` owns the `$ZodIssue`
-* shaping, and so the same check can be reported by `generate()` without
-* inventing a second vocabulary.
-*/
-function tokenRefIssues(ds) {
-	const errors = [];
-	const warnings = [];
-	for (const [role, spec] of Object.entries(ds.colors.roles)) if (SURFACE_SHAPED.has(role) && roleKind(spec) === "chromatic") warnings.push(`colors.roles.${role} is declared chromatic (a bare hue string is shorthand for \`kind: "chromatic"\`), but the name reads as a surface. A chromatic role emits no bare \`--color-bg-${role}\` and no \`.bg-${role}\` utility` + (REQUIRED_ROLES.includes(role) ? `, and the framework's own component CSS references those with no fallback` : "") + `. Write \`"${role}": { "hue": "${roleHue(spec)}", "kind": "surface" }\` if you meant a surface.`);
-	let defined;
-	try {
-		defined = emittedTokens(ds);
-	} catch {
-		return {
-			errors,
-			warnings
-		};
-	}
-	const seen = /* @__PURE__ */ new Set();
-	const renames = movedTokens(ds.colors.roles);
-	const moved = /* @__PURE__ */ new Map();
-	const excused = /* @__PURE__ */ new Set();
-	for (const role of REQUIRED_ROLES) if (ds.colors.roles[role] == null) for (const key of ROLE_TOKEN_KEYS) excused.add(tokenVar(role, key));
-	for (const ref of collectVarRefs(ds)) {
-		if (ref.fallback || defined.has(ref.name) || excused.has(ref.name)) continue;
-		const moveTo = renames[ref.name];
-		if (moveTo != null) {
-			moved.set(ref.name, moveTo);
-			continue;
-		}
-		if (!isOwned(ref.name)) continue;
-		const key = `${ref.name} ${ref.path}`;
-		if (seen.has(key)) continue;
-		seen.add(key);
-		const hint = nearest(ref.name, defined);
-		errors.push({
-			path: ref.path.split("."),
-			message: `${ref.path} references \`var(${ref.name})\`, which this config emits no token for — the declaration will resolve to nothing at runtime.` + (hint ? ` Did you mean \`var(${hint})\`?` : "") + ` (Give it a fallback — \`var(${ref.name}, <value>)\` — if the absence is intentional.)`
-		});
-	}
-	if (moved.size) errors.unshift({
-		path: ["colors"],
-		message: `${moved.size} token reference${moved.size === 1 ? " uses" : "s use"} the pre-1.0 colour grammar. The role moved into the middle of the property name, after its target (\`--color-<target>-<role>[-<variant>]\`):\n` + [...moved].map(([old, next]) => `  ${old} → ${next}`).join("\n") + "\n\nApply these simultaneously, not one at a time — several renames are cyclic (a surface role's backgrounds rotate), so sequential replacement compounds them. `vitops lint <src> --fix` does this for markup and CSS."
-	});
-	return {
-		errors,
-		warnings
-	};
-}
-
-//#endregion
-//#region src/schema.ts
-/**
-* Canonical `design-system.json` schema — the single source of truth.
-*
-* Authored with `zod/mini` (tree-shakeable Zod v4). Everything else derives from it:
-*   • the `DesignSystem` TS type (`z.infer`), used throughout the generator,
-*   • the published JSON Schema (`toJSONSchema`), emitted to `schema.json` for `$schema` refs,
-*   • runtime validation (`validate`) for the CLI and to gate `generate`,
-*   • the generated `authoring.md` reference doc (walks `jsonSchema`'s descriptions).
-*/
-/**
-* Attach a JSON-Schema `description`. zod/mini has no `.describe()` method; the
-* mini-API equivalent is `.check(z.describe(…))`, and `.check()` clones — so a
-* shared sub-schema (`Scale`, `CssDecls`, …) can carry a different description
-* per use-site without mutating the original.
-*/
-const desc = (schema, text) => schema.check(z.describe(text));
-const CssDecls = desc(z.record(z.string(), z.string()), "A CSS declaration block: property → value. Values stay strings (they can be hex, var(), clamp(), keywords, …); the generator, not the schema, interprets them.");
-const Scalar = z.union([z.string(), z.number()]);
-const VarMap = z.record(z.string(), Scalar);
-const SeededRamp = desc(z.strictObject({
-	seed: desc(z.string(), "Seed colour (hex or oklch()). An 11-step numeric scale (50…950, tinted near-white → tinted near-black) is generated in OKLCH from it; the seed is preserved at its natural step."),
-	anchors: z.optional(desc(z.record(z.string(), z.string()), "Step → colour overrides (hex or oklch()) pinned VERBATIM at those steps. Every other step takes its lightness from the shared ladder, with chroma and hue interpolated between the anchors — so an anchor is reproduced exactly and is the only step allowed off the ladder. An explicit anchor overrides the seed at that step; two anchors that resolve to the same step are an error."))
-}), "Seeded hue: the 11-step scale is GENERATED in OKLCH from `seed` (anchors pin specific steps).");
-const FixedRamp = desc(z.strictObject({ tones: desc(z.union([z.array(z.string()), z.record(z.string(), z.string())]), "Fixed brand kit: authored tones placed verbatim at their nearest steps plus tinted off-white/off-black endpoints; no interpolation. Either an ordered light → dark array or a step → colour map.") }), "Fixed hue: authored brand tones used verbatim; no generation.");
-const Ramp = desc(z.union([SeededRamp, FixedRamp]), "A palette hue, authored one of two ways: `{ seed, anchors? }` generates an 11-step numeric OKLCH scale (50…950) from the seed, or `{ tones }` supplies a fixed brand kit used verbatim.");
-/**
-* A role points at a hue, and optionally declares its kind. The bare-string form
-* is the shorthand for a chromatic role — signal colours are the common case,
-* and the two or three surfaces are worth naming explicitly.
-*/
-const RoleSpecSchema = z.union([desc(z.string(), "A palette hue name. Shorthand for `{ hue, kind: \"chromatic\" }`."), z.strictObject({
-	hue: desc(z.string(), "The palette hue this role resolves to."),
-	kind: z.optional(desc(z.enum(["surface", "chromatic"]), "`surface` — a page/panel colour: gets a bare `bg-<role>` plus the full emphasis range and text scale. `chromatic` (default) — a signal colour: tints and solids only, no bare `bg-<role>`."))
-})]);
-const UtilityName = z.enum([
-	"bg",
-	"text",
-	"icon",
-	"border",
-	"outline",
-	"fill",
-	"stroke"
-]);
-const Colors = desc(z.strictObject({
-	palette: desc(z.record(z.string(), Ramp), "Palette hues by name. Each becomes an 11-step numeric OKLCH scale (`--color-<hue>-50…950`). Every ramp shares one fixed lightness ladder, so a step means the same lightness in every hue; only chroma and hue vary. Beyond the outermost authored colour the chroma decays towards a small endpoint value (0.008 light / 0.015 dark) so the near-white and near-black ends keep a whisper of the hue — but that is a **ceiling**, not a target, so a low-chroma seed stays low and **a chroma-0 seed gives a true neutral** rather than a tinted one. The ladder is also enforced: if pinned colours leave a ramp non-monotonic (some step darker than the one below it), the build fails rather than shipping a scale whose hover states run backwards."),
-	roles: desc(z.record(z.string(), RoleSpecSchema), `Maps semantic role names onto palette hues. Role names are ARBITRARY — add a key and the generator emits that role's token set (\`--color-<target>-<role>[-<variant>]\` for target bg/text/icon/border), its dark-mode flip and its utility classes.\n\nA value is either a hue name (\`"danger": "rust"\`) or \`{ "hue": …, "kind": "surface" | "chromatic" }\`. **The kind decides the shape of the token set.** \`chromatic\` (the default, and what the bare-string form means) is a signal colour: its backgrounds split into tints (\`bg-<role>-x-muted\`/\`-muted\`) and solids (\`bg-<role>-solid[-bold|-x-bold]\`), with deliberately **no bare \`bg-<role>\`** — "how loud?" is a question the author answers. \`surface\` is a page/panel colour: it has a bare \`bg-<role>\` plus the full emphasis range and text scale.\n\nDark mode flips automatically; there is no per-appearance scheme grammar. The solid family and its computed \`text-on-<role>\` foreground stay mode-stable so a filled button keeps its identity. Six roles are a required core, because the shipped framework CSS references them with no fallback: ${REQUIRED_ROLES.join(", ")}. Conventional additions are ui-secondary/accent, brand-secondary, info and success.`),
-	utilities: z.optional(desc(z.array(UtilityName), "Which colour utility-class families to emit (`bg-*`, `text-*`, `icon-*`, `border-*`, `outline-*`, `fill-*`, `stroke-*`). Defaults to bg, text, icon, border. `icon` is a separate non-text tier (a glyph may run more vivid than text); `outline`/`fill`/`stroke` have no tokens of their own and alias the border and icon tiers."))
-}), "The colour system (the only required section): `palette` hues become generated OKLCH scales; `roles` map semantic roles onto those hues, from which all role tokens and dark mode derive.");
-const Scale = z.strictObject({
-	base: desc(z.string(), "Anchor size (a CSS length, e.g. \"1rem\") — the value at `baseStep`."),
-	ratio: desc(z.number(), "Modular ratio between adjacent steps at large viewports."),
-	steps: desc(z.optional(z.number()), "Token count when `names` is absent (steps are then named 1..steps)."),
-	names: desc(z.optional(z.array(z.string())), "Step names, smallest → largest (e.g. [\"xs\",\"sm\",\"md\",…]); each becomes a token suffix."),
-	baseStep: desc(z.optional(z.number()), "1-based index of the step whose value is `base`."),
-	baseline: desc(z.optional(z.string()), "Named step used as the fluid pivot / GUI scale centre (defaults to `baseStep`)."),
-	fluid: desc(z.optional(z.strictObject({
-		minVw: desc(z.string(), "Viewport width (CSS length) where fluid scaling bottoms out."),
-		maxVw: desc(z.string(), "Viewport width (CSS length) where fluid scaling tops out."),
-		minRatio: desc(z.number(), "Modular ratio at/below `minVw` (usually < `ratio`).")
-	})), "Makes the scale fluid: each step compiles to a clamp() that interpolates from `minRatio` at `minVw` to `ratio` at `maxVw`.")
-});
-const Pattern = desc(z.strictObject({
-	group: desc(z.optional(z.string()), "Token-cascade group this pattern belongs to (e.g. tag / control / panel); base declarations resolve through `--<prop>-<group>` before `--<prop>-default`."),
-	overrides: z.optional(desc(CssDecls, "Per-pattern token overrides, emitted as `--<prop>-<name>-group` values.")),
-	element: desc(z.optional(z.string()), "Style at element level via zero-specificity `:where(<element>)` (instead of, or alongside, a class)."),
-	class: desc(z.optional(z.string()), "Class name to emit (defaults to the pattern's key when no `element` is set). Combined with `element`, the pattern emits one zero-specificity `:where(<element>, .<class>)` rule so the class works on any tag and any explicit class overrides it."),
-	fill: desc(z.optional(z.boolean()), "Whether this pattern is colour-filled (states/roles drive `background-color` + `on-solid` text) or text-coloured (they drive `color`). Defaults to true when `base` declares a background."),
-	default_role: desc(z.optional(z.string()), "Semantic colour role applied to the bare/default variant."),
-	base: z.optional(desc(CssDecls, "Base CSS declarations. Geometry properties (padding, border-radius, border, box-shadow, font-size) are wrapped in per-pattern override hooks (`--p-<name>`, `--br-<name>`, `--b-<name>`, `--ds-<name>`, `--fs-<name>`) so consumers can restyle one pattern by setting one variable.")),
-	states: desc(z.optional(z.record(z.string(), z.record(z.string(), z.unknown()))), "Interaction states (hover / active / focus-visible), each a map of shortcuts: `step` (intensify the fill or text by n rungs — `bg-<role>-solid` → `-solid-bold`, `text-<role>` → `-bold`), `scale` (transform scale), `lift` (translateY + shadow), `shadow` (a shadow name → drop-shadow(var(--shadow-<name>)), or true → lift shadow), `ring` (focus ring), or raw `css` declarations. Hover rules are wrapped in `@media (hover: hover)`."),
-	roles: desc(z.optional(z.array(z.string())), "Semantic colour role variants to emit as `<pattern>-<role>` classes (fills use the role solid / on-solid tokens).")
-}), "One component pattern (button, link, badge, card, …): base declarations + interaction states + semantic role variants, resolved through the pattern token cascade.");
-const Patterns = desc(z.strictObject({
-	defaults: z.optional(desc(CssDecls, "Cascade-wide fallback tokens, emitted as `--<prop>-default`.")),
-	radii: z.optional(desc(CssDecls, "Shape primitives, emitted as `--br-<name>` (referenced by pattern bases).")),
-	groups: desc(z.optional(z.record(z.string(), CssDecls)), "Group-level tokens, emitted as `--<prop>-<group>`; patterns opt in via their `group` key."),
-	z: desc(z.optional(z.record(z.string(), z.number())), "Z-index tiers → `--z-tier-<name>`."),
-	items: desc(z.optional(z.record(z.string(), Pattern)), "The component patterns to emit, keyed by name.")
-}), "Component patterns and their token cascade: `defaults` → `groups` → per-pattern `overrides`, plus shape (`radii`) and z-index primitives.");
-const TypographyRole = desc(z.record(z.string(), Scalar), "A bag of CSS-ish keys, each mapped to a declaration plus a `--<role>-<sfx>` override hook. The recognised set is **closed**: `family`, `size`, `weight`, `style`, `line-height`, `tracking` (→ `letter-spacing`), `text-transform`, `text-decoration`, `text-wrap`, `color`. Note the last four are spelled with their full CSS property names — `transform` and `decoration` are NOT accepted. Anything unrecognised is **ignored**, not passed through, so the generator warns rather than emitting it: a silently-dropped `transform: uppercase` is how title-case navigation reaches production. Note also that `style`, `text-transform`, `text-decoration` and `text-wrap` are emitted on **every** role at their identity value (`normal`/`none`/`none`/`wrap`) whether declared or not, so applying one role class over another fully resets it — which means **omitting `text-wrap` is not \"inherit\"**: it emits `text-wrap: wrap` and cancels the `pretty` the role would otherwise inherit from a `pretty` ancestor such as a `body`-mapped role. Declare it on every role — `balance` for heading-like roles, `pretty` for copy, `wrap` for short single-line labels.");
-const Typography = desc(z.strictObject({
-	families: desc(z.optional(z.record(z.string(), z.string())), "Role-facing family aliases → CSS font values, usually referencing the top-level `fonts` tokens (e.g. \"var(--font-display)\")."),
-	roles: desc(z.optional(z.record(z.string(), TypographyRole)), "Semantic type roles (display, title, heading, body, quote, caption, eyebrow, code, lead, footnote, tag, …), each emitted as a `font-<role>` class."),
-	headings: desc(z.optional(z.record(z.string(), z.string())), "Maps bare elements to type roles so unclassed markup picks up role styling — `{ \"h1\": \"display\", \"h2\": \"heading\" }`. The key is used verbatim as a selector, so it is not limited to h1…h6: **map `\"body\"` to your prose role** to bind base page typography to the role rather than hand-writing it. That binding is what makes the role editable — a stylesheet that re-states `font-family`/`line-height` as literals on `body` shadows `--<role>-ff`/`--<role>-lh`, and the live theme editor then appears to do nothing.")
-}), "Typography: family aliases, semantic type roles (→ `font-<role>` classes), and the bare-element → role mapping.");
-const AnimEffect = desc(z.strictObject({
-	kf: desc(z.string(), "Keyframe family driving the effect: composite (transform/opacity), paint, or layout."),
-	css: z.optional(desc(VarMap, "Extra literal declarations merged into the effect class as-is.")),
-	vars: z.optional(desc(VarMap, "Effect endpoint variables (`--<key>: <value>`, e.g. opacity-from, translate-y-to) that override the keyframe defaults."))
-}), "A named animation effect class — a pure value layer (`--_anim` + `--<prop>-from/-to`) over the static keyframe engine.");
-const Animations = desc(z.strictObject({
-	effects: desc(z.optional(z.record(z.string(), AnimEffect)), "Effect classes to emit (`.fade-in`, `.reveal-left`, …), keyed by class name."),
-	journeys: desc(z.optional(z.strictObject({
-		base: desc(z.optional(z.record(z.string(), VarMap)), "Named journey building blocks: part name → var map."),
-		compose: desc(z.optional(z.array(z.array(z.string()))), "Combinations of base parts, each emitted as a `.<parts>-journey` class.")
-	})), "Multi-part journey classes composed from `base` building blocks.")
-}), "Animation effect + journey classes (pure value layers). The animation engine itself — keyframes, drivers, floats, utilities — is static framework CSS, not configured here.");
-const DesignSystemSchema = z.strictObject({
-	$schema: desc(z.optional(z.string()), "URL of the published JSON Schema (stamped by `vitops init`) so editors provide autocomplete + validation."),
-	meta: desc(z.optional(z.strictObject({
-		name: desc(z.optional(z.string()), "Brand/system name. Used as the `name` field and `<h1>` of the `design` format's `DESIGN.md`. Defaults to \"Design System\"."),
-		description: desc(z.optional(z.string()), "One or two sentences on the brand personality and the feeling the UI should evoke — what an agent needs when no token answers the question. Becomes the DESIGN.md `description` field and opens its Overview section; if omitted, a generic description of the system's mechanics is used instead.")
-	})), "Brand identity for agent-facing output. Consumed only by the `design` format (`DESIGN.md`); it emits no CSS and no tokens."),
-	colors: Colors,
-	shadows: desc(z.optional(z.record(z.string(), z.string())), "Named shadows → `--shadow-<name>` tokens and `.drop-shadow-<name>` utilities. Values are shadow parameter lists (offset/blur/colour). Each token feeds two consumers with different grammars — `box-shadow` (pattern geometry, via the `--ds-*` group aliases) and `filter: drop-shadow(…)` (the utilities and the `shadow:` state shortcut) — so values must stay in the intersection: **one layer, no spread radius, no `inset`**. `drop-shadow()` rejects all three, and rejecting them invalidates the whole filter, so the shadow vanishes rather than degrading."),
-	fonts: desc(z.optional(z.record(z.string(), z.string())), "Raw font stacks by name, emitted as `--font-<name>` tokens (referenced by `typography.families`). **Stacks only — vitops does not load webfonts.** A value here is a `font-family` list and nothing more: it emits no `@font-face`, no preload, and no metrics-matched fallback. If a family needs loading, declare it in Astro's `fonts:` config (`astro.config`, or the site config's `fonts` array) and point the token at the family's `cssVariable` — `\"display\": \"var(--font-league-spartan), sans-serif\"`. Installing a `@fontsource*` package and importing its CSS also works but gives up subsetting, preload and `size-adjust`/`ascent-override` fallbacks, so it regresses CLS."),
-	typeScale: desc(z.optional(Scale), "Fluid modular TYPE scale → `--text-<name>` tokens, consumed by typography roles and text-size utilities."),
-	spaceScale: desc(z.optional(Scale), "Fluid modular SPACE scale → `--space-<name>` tokens, consumed by spacing/gap utilities and vertical rhythm."),
-	patterns: z.optional(Patterns),
-	typography: z.optional(Typography),
-	animations: z.optional(Animations)
-});
-const ColorsPatch = z.strictObject({
-	palette: z.optional(z.record(z.string(), Ramp)),
-	roles: z.optional(z.record(z.string(), RoleSpecSchema)),
-	utilities: z.optional(z.array(UtilityName))
-});
-const DesignSystemPatchSchema = z.extend(z.partial(DesignSystemSchema), { colors: z.optional(ColorsPatch) });
-/**
-* Stable URL of the published JSON Schema. Resolves once `@getvitops/generator` is on
-* npm (unpkg serves the packaged `schema.json`); `vitops init` stamps this into a
-* scaffolded config's `$schema` so editors light up autocomplete + validation.
-*/
-const SCHEMA_URL = "https://unpkg.com/@getvitops/generator/schema.json";
-/**
-* What `vitops init` actually stamps into a scaffolded config's `$schema`.
-*
-* A **local** path, following wrangler's `node_modules/wrangler/config-schema.json`.
-* `SCHEMA_URL` has no version in it, so unpkg resolves it to whatever is newest
-* — an editor validating a project pinned to generator 2.x silently checks it
-* against the 3.x schema, reporting errors for valid config and accepting
-* fields that do not exist yet. The installed copy is by definition the one
-* that matches the toolchain doing the building.
-*
-* `SCHEMA_URL` remains the schema's `$id`, which is what it is for.
-*/
-const SCHEMA_LOCAL_PATH = "./node_modules/@getvitops/generator/schema.json";
-/** The published JSON Schema (draft-2020-12), derived from the zod schema. */
-const jsonSchema = {
-	$id: SCHEMA_URL,
-	...z.toJSONSchema(DesignSystemSchema, { target: "draft-2020-12" })
-};
-/** Split a CSS value on top-level commas, ignoring commas nested in `rgba(…)` etc. */
-const splitLayers = (value) => {
-	const out = [];
-	let depth = 0;
-	let start = 0;
-	for (let i = 0; i < value.length; i++) {
-		const c = value[i];
-		if (c === "(") depth++;
-		else if (c === ")") depth--;
-		else if (c === "," && depth === 0) {
-			out.push(value.slice(start, i));
-			start = i + 1;
-		}
-	}
-	out.push(value.slice(start));
-	return out.map((s) => s.trim()).filter(Boolean);
-};
-const LENGTH = /^[+-]?(\d+\.?\d*|\.\d+)(px|rem|em|ch|ex|vh|vw|vmin|vmax|cm|mm|in|pt|pc|q)?$/i;
-/**
-* Why a shadow can be *valid CSS* and still render nothing: a `--shadow-<name>`
-* token is consumed both as a `box-shadow` (pattern geometry) and inside
-* `filter: drop-shadow(…)` (the `.drop-shadow-<name>` utilities, the `shadow:`
-* state shortcut). `drop-shadow()` accepts a *single* layer of at most three
-* lengths and no `inset` — a spread radius, a second comma-separated layer or an
-* inset keyword makes the function invalid, which drops the entire `filter`
-* declaration. `box-shadow` accepts all three happily, so the value looks fine
-* everywhere it is authored and only the utility silently goes blank.
-*/
-const dropShadowIssue = (value) => {
-	const layers = splitLayers(value);
-	if (layers.length > 1) return `${layers.length} comma-separated layers`;
-	const layer = layers[0] ?? "";
-	if (/(^|\s)inset(\s|$)/i.test(layer)) return "an `inset` keyword";
-	const lengths = layer.replaceAll(/[\w-]*\([^()]*\)/g, " ").split(/\s+/).filter((t) => LENGTH.test(t));
-	if (lengths.length > 3) return `a spread radius (${lengths.length} lengths)`;
-};
-const RAMP_KEYS = new Set([
-	"seed",
-	"anchors",
-	"tones"
-]);
-/**
-* Replace the bare "Invalid input" a failed union produces with the reason.
-*
-* `Ramp` is `SeededRamp | FixedRamp`, and both branches are closed — so `{ seed,
-* tones }` or a stray key fails *both* and zod reports only that the union didn't
-* match. That message sends you reading the schema rather than looking at the two
-* keys in front of you, and the config that produced it is one whose `tones` were
-* being silently discarded at generate time.
-*/
-const explainRamp = (input) => (issue) => {
-	if (issue.code === "unrecognized_keys") {
-		const keys = issue.keys ?? [];
-		if (keys.length) return {
-			...issue,
-			message: `unknown key${keys.length > 1 ? "s" : ""} ${keys.map((k) => `"${k}"`).join(", ")} — not part of the schema, so ignored at generate time.`
-		};
-	}
-	if (issue.path.length !== 3 || issue.path[0] !== "colors" || issue.path[1] !== "palette") return issue;
-	const hue = input?.colors?.palette?.[String(issue.path[2])];
-	if (hue == null || typeof hue !== "object") return issue;
-	const keys = Object.keys(hue);
-	const unknown = keys.filter((k) => !RAMP_KEYS.has(k));
-	const message = "seed" in hue && "tones" in hue ? "a hue is either seeded (`seed`, with optional `anchors`) or fixed (`tones`) — not both. Drop one: with both present the `tones` are ignored at generate time." : unknown.length ? `unknown key${unknown.length > 1 ? "s" : ""} ${unknown.map((k) => `"${k}"`).join(", ")}. A hue takes \`seed\` + optional \`anchors\`, or \`tones\`.` : keys.length === 0 ? "a hue needs `seed` (+ optional `anchors`) or `tones`." : null;
-	return message ? {
-		...issue,
-		message
-	} : issue;
-};
-/**
-* Validate an unknown value against the design-system schema.
-*
-* `warnings` are configurations that parse and generate, but produce output that
-* won't behave as authored — currently only the token-namespace collisions the
-* flat `--<prop>-<name>` grammar makes possible.
-*/
-function validate(input) {
-	const result = z.safeParse(DesignSystemSchema, input);
-	if (!result.success) return {
-		ok: false,
-		data: void 0,
-		errors: result.error.issues.map(explainRamp(input)),
-		warnings: []
-	};
-	const { palette, roles } = result.data.colors;
-	for (const [role, spec] of Object.entries(roles)) {
-		const hue = roleHue(spec);
-		if (palette[hue] == null) return {
-			ok: false,
-			data: void 0,
-			errors: [{
-				code: "custom",
-				path: [
-					"colors",
-					"roles",
-					role
-				],
-				message: `role "${role}" references unknown palette hue "${hue}"`
-			}],
-			warnings: []
-		};
-	}
-	const warnings = [];
-	const missing = REQUIRED_ROLES.filter((r) => roles[r] == null);
-	if (missing.length) warnings.push(`colors.roles is missing ${missing.map((r) => `"${r}"`).join(", ")} — the framework's own component CSS references ${missing.length === 1 ? "it" : "them"} with no fallback, so those components will render uncoloured. Add any role you like, but keep these defined.`);
-	const radii = Object.keys(result.data.patterns?.radii ?? {});
-	const items = new Set(Object.keys(result.data.patterns?.items ?? {}));
-	for (const name of radii) if (items.has(name)) warnings.push(`patterns.radii.${name} collides with the "${name}" pattern on --br-${name}; the pattern's override hook wins — rename the radius`);
-	for (const [name, value] of Object.entries(result.data.shadows ?? {})) {
-		const issue = dropShadowIssue(value);
-		if (issue) warnings.push(`shadows.${name} carries ${issue}, which \`filter: drop-shadow()\` rejects — \`.drop-shadow-${name}\` will render no shadow at all (the token still works as a \`box-shadow\`). Use one layer of at most three lengths.`);
-	}
-	const refs = tokenRefIssues(result.data);
-	warnings.push(...refs.warnings);
-	if (refs.errors.length) return {
-		ok: false,
-		data: void 0,
-		errors: refs.errors.map((e) => ({
-			code: "custom",
-			...e
-		})),
-		warnings
-	};
-	return {
-		ok: true,
-		data: result.data,
-		errors: [],
-		warnings
-	};
-}
-
-//#endregion
-//#region src/config.ts
-/**
-* The top-level configuration schema — the umbrella around a
-* `design-system.json`-compliant `designSystem`.
-*
-* **Three sections, one document.** A config is `{ designSystem, organization,
-* site }`:
-*
-*  - `designSystem` — the token set (named themes + which theme/appearance).
-*  - `organization` — the company: who it is, where it is, how to reach it, what
-*    it sells. Facts that stay true if the site is rebuilt from scratch.
-*  - `site` — this published site: locales, domains, environments, SEO,
-*    analytics, legal, icons, deployment. Facts about *a* presentation of the
-*    organization.
-*
-* The split is not cosmetic. The flat predecessor (`SiteConfig`) held the company
-* and the deployment as peers, so no single noun described it — and the
-* multi-site case was inexpressible. With three sections, several sites can share
-* one `organization` and override only `site`.
-*
-* Authored with `zod/mini` (same instance the design-system schema uses), so the
-* two compose: `DesignSystemSchema` is embedded as `designSystem.themes.<theme>` and the
-* whole thing serialises to one JSON Schema via `z.toJSONSchema`. Everything a
-* generator needs derives from here: the `Config` type (`z.infer`), the
-* published JSON Schema (`configJsonSchema`), and runtime validation (`validateConfig`).
-*
-* Pure: no YAML/env/fs. `resolveConfig` takes an already-parsed object; a
-* thin loader (reading YAML, injecting `SITE_ENV`) lives outside this module.
-*/
-const LocalizableSchema = desc(z.union([z.string(), z.record(z.string(), z.string())]), "A string, or a per-locale map of strings (`{ en: \"…\", fr: \"…\" }`).");
-const ImageRefSchema = z.union([z.string(), z.object({
-	src: z.string(),
-	alt: z.string(),
-	width: z.optional(z.number()),
-	height: z.optional(z.number())
-})]);
-const AttrValue = z.union([
-	z.string(),
-	z.number(),
-	z.boolean()
-]);
-const AttrsSchema = z.optional(z.record(z.string(), AttrValue));
-const IsoDate = z.string().check(z.regex(/^\d{4}-\d{2}-\d{2}$/));
-const Iso4217 = z.string().check(z.regex(/^[A-Z]{3}$/));
-const DayOfWeek = z.enum([
-	"Monday",
-	"Tuesday",
-	"Wednesday",
-	"Thursday",
-	"Friday",
-	"Saturday",
-	"Sunday"
-]);
-const DesignSystemEntry = z.extend(DesignSystemPatchSchema, {
-	displayName: desc(z.optional(LocalizableSchema), "Human-readable theme name (localisable). The label a theme picker would show — nothing reads it yet, because nothing builds more than one theme (see `themes`)."),
-	extends: desc(z.optional(z.string()), "Another `themes` key to inherit from; this entry then only supplies what it overrides.")
-});
-/**
-* The design system as a whole: the named themes plus the facts that describe the
-* system rather than any one theme.
-*
-* `themes` is nested rather than being the block itself because the block used to
-* BE the map — every key was a theme name, so there was nowhere to put
-* system-wide metadata without it colliding with a theme of that name.
-*
-* Note the two axes here are independent, and deliberately so. `defaultTheme`
-* picks a *theme* (an authored design system); `defaultColorScheme` picks an
-* *appearance* (light/dark), which every theme already has because the flip is
-* derived from one ramp rather than authored. "Theme `elegant`, appearance
-* follows the OS" has to be sayable, and a single union could not express it.
-*/
-const DesignSystemBlock = desc(z.strictObject({
-	themes: desc(z.record(z.string(), DesignSystemEntry), "Named themes. `default` is the base; others may `extends` another and supply a partial patch. Light/dark is NOT a theme — the functional tokens flip per appearance within each one, so `default` already has both. Only the default theme is built today; multi-theme output and a picker are not wired yet."),
-	defaultTheme: desc(z.optional(z.string()), "Which `themes` entry to use (convention: \"default\"). Validated against the map; selecting a non-default theme is not wired yet."),
-	defaultColorScheme: desc(z.optional(z.enum([
-		"light",
-		"dark",
-		"system"
-	])), "Initial appearance. `\"system\"` follows the OS via `prefers-color-scheme` and is what makes `<wc-color-scheme-toggle>`'s \"System\" position resolve to anything — it removes the theme attribute, so without this the page falls through to light. It also gives a no-JS page the OS appearance. Defaults to `\"light\"`, because switching an existing site to `\"system\"` visibly flips it dark for dark-OS visitors.")
-}), "The design system: named themes plus the system-wide facts (which theme, which appearance). A bare design system, or a bare theme map, is accepted as shorthand for `{ themes: … }`.");
-const LocaleSchema = z.object({
-	name: desc(z.string(), "Display name of the locale (e.g. \"English\")."),
-	tagline: desc(z.optional(z.string()), "Site tagline in this locale."),
-	basePath: desc(z.optional(z.string()), "URL prefix for this locale (e.g. \"/fr\").")
-});
-const HttpRedirect = z.union([
-	z.literal(301),
-	z.literal(302),
-	z.literal(307),
-	z.literal(308)
-]);
-const DomainAliasSchema = z.object({
-	domain: z.string(),
-	redirectType: HttpRedirect,
-	redirectTo: z.string(),
-	environment: z.optional(z.string())
-});
-const PostalAddressSchema = desc(z.object({
-	streetAddress: z.string(),
-	addressLocality: desc(z.string(), "City."),
-	addressRegion: desc(z.optional(z.string()), "State / province."),
-	postalCode: z.optional(z.string()),
-	addressCountry: desc(z.string(), "Country (ISO 3166-1 alpha-2 preferred).")
-}), "schema.org `PostalAddress` field names, so JSON-LD generation is lossless.");
-const ContactObjectSchema = z.object({
-	name: z.optional(z.string()),
-	email: z.optional(z.email()),
-	phone: z.optional(z.string()),
-	address: z.optional(PostalAddressSchema)
-});
-const ContactConfigSchema = z.union([z.string(), ContactObjectSchema]);
-const GeoSchema = z.object({
-	latitude: z.number().check(z.gte(-90), z.lte(90)),
-	longitude: z.number().check(z.gte(-180), z.lte(180))
-});
-/** schema.org `OpeningHoursSpecification` — per-day open/close (24h `HH:MM`). */
-const OpeningHoursSchema = z.object({
-	dayOfWeek: z.array(DayOfWeek),
-	opens: z.string().check(z.regex(/^\d{2}:\d{2}$/)),
-	closes: z.string().check(z.regex(/^\d{2}:\d{2}$/))
-});
-/**
-* A dated deviation from the recurring `hours` — holiday hours, a one-off
-* closure, a temporary schedule. Same schema.org shape
-* (`OpeningHoursSpecification`), distinguished by carrying `validFrom`. A
-* full closure omits `opens`/`closes` rather than encoding an open interval.
-*/
-const SpecialHoursSchema = z.object({
-	validFrom: IsoDate,
-	validThrough: z.optional(IsoDate),
-	opens: z.optional(z.string().check(z.regex(/^\d{2}:\d{2}$/))),
-	closes: z.optional(z.string().check(z.regex(/^\d{2}:\d{2}$/)))
-});
-const LocalBusinessType = z.enum([
-	"LocalBusiness",
-	"Store",
-	"Restaurant",
-	"CafeOrCoffeeShop",
-	"ProfessionalService",
-	"MedicalBusiness",
-	"HealthAndBeautyBusiness",
-	"HomeAndConstructionBusiness",
-	"AutomotiveBusiness",
-	"FinancialService",
-	"LegalService",
-	"RealEstateAgent",
-	"Organization"
-]);
-const ListingPlatform = z.enum([
-	"google",
-	"bing",
-	"apple"
-]);
-const LocationSchema = z.object({
-	slug: z.optional(LocalizableSchema),
-	name: LocalizableSchema,
-	email: z.optional(z.email()),
-	phone: z.optional(z.string()),
-	address: z.optional(PostalAddressSchema),
-	geo: z.optional(GeoSchema),
-	hours: z.optional(z.array(OpeningHoursSchema)),
-	hoursSpecial: desc(z.optional(z.array(SpecialHoursSchema)), "Holiday/temporary hours, as dated deviations from the recurring `hours` — distinct from it because these carry a date range rather than a weekday."),
-	type: z.optional(LocalBusinessType),
-	description: z.optional(LocalizableSchema),
-	areaServed: z.optional(z.array(z.string())),
-	priceRange: z.optional(z.string()),
-	paymentAccepted: z.optional(z.array(z.string())),
-	currenciesAccepted: z.optional(Iso4217),
-	knowsLanguage: z.optional(z.array(z.string())),
-	photos: desc(z.optional(z.array(ImageRefSchema)), "Location photos (logo, storefront, interior, …) → JSON-LD `image`. Every listing platform (GBP, Bing Places, Apple Business Connect) wants these; none can derive them."),
-	sameAs: desc(z.optional(z.array(z.url())), "This location's own profile URLs (its Google Business Profile, Bing Places listing, Apple Business Connect location, Facebook page, …) → JSON-LD `sameAs`. Distinct from `organization.sameAs`, which is the company overall — a multi-location org's locations do not share one GBP listing."),
-	listings: desc(z.optional(z.partialRecord(ListingPlatform, z.string())), "External listing IDs for this location, keyed by platform — the Google Business Profile location id, the Bing Places business id, the Apple Business Connect location id. Not consumed by the generator today; recorded here so a future sync has a stable id to match against instead of risking a duplicate listing.")
-});
-const OrganizationSchema = z.object({
-	name: desc(z.optional(LocalizableSchema), "Trading name, as a reader would recognise it (e.g. \"Acme\"). Localisable."),
-	legalName: desc(z.optional(z.string()), "Registered legal name (e.g. \"Acme Widgets Inc.\"). The generated legal documents prefer this over `name` — a policy is a statement by the legal entity."),
-	foundingDate: desc(z.optional(IsoDate), "Date the organization was founded (YYYY-MM-DD)."),
-	logo: desc(z.optional(ImageRefSchema), "Organization logo → JSON-LD `logo`."),
-	email: desc(z.optional(z.email()), "General contact address. Also the last fallback for privacy requests — see `contact`."),
-	phone: desc(z.optional(z.string()), "General contact telephone number."),
-	address: desc(z.optional(PostalAddressSchema), "Registered/mailing address. Its `addressRegion` and `addressCountry` are what the governing-law clause of the generated terms of service defaults to."),
-	taxID: desc(z.optional(z.string()), "Tax identification number."),
-	vatID: desc(z.optional(z.string()), "VAT identification number."),
-	sameAs: desc(z.optional(z.array(z.url())), "Profile URLs → JSON-LD `sameAs` (mirrors `links`).")
-});
-const DnsRecordType = z.enum([
-	"A",
-	"AAAA",
-	"CNAME",
-	"TXT",
-	"MX",
-	"NS",
-	"SRV",
-	"CAA",
-	"PTR",
-	"SOA"
-]);
-const DnsRecordSchema = z.object({
-	type: DnsRecordType,
-	name: z.optional(z.string()),
-	value: z.string(),
-	ttl: z.optional(z.number().check(z.int(), z.positive())),
-	proxied: z.optional(z.boolean())
-});
-const DnsDomainSchema = z.object({
-	provider: z.optional(z.string()),
-	nameservers: z.optional(z.array(z.string())),
-	records: z.optional(z.array(DnsRecordSchema))
-});
-/**
-* One domain to onboard into Google Search Console via `vitops search setup`.
-*
-* The verification token is fetched live from the Site Verification API at run
-* time and written to DNS — it is never stored here. What the config records is
-* the *intent*: which domains to onboard, and who should co-own them.
-*/
-const SearchConsoleSetupSchema = z.object({
-	delegatedOwners: desc(z.optional(z.array(z.email())), "Emails added as verification owners on the Site Verification web resource. Automated via the API — additive and idempotent, never removes an existing owner."),
-	fullUserGroup: desc(z.optional(z.email()), "A Google Group to grant Full-User access in Search Console. SURFACED AS A REMINDER only: Search Console exposes no user/permission API, so this step stays manual by design.")
-});
-const RobotsSchema = z.string();
-const EnvironmentSchema = z.object({
-	url: desc(z.url(), "Public origin of this environment."),
-	api: desc(z.optional(z.url()), "API origin, when different from `url`."),
-	analytics: desc(z.optional(z.boolean()), "Whether analytics fire in this environment."),
-	ads: desc(z.optional(z.boolean()), "Whether `site.ads` pixels fire in this environment. Defaults to `analytics`, then true — a preview deployment sending pageviews is survivable, one firing conversion pixels is not, so this can be turned off on its own."),
-	robots: desc(z.optional(RobotsSchema), "Robots policy (e.g. \"noindex,nofollow\" for dev)."),
-	variant: desc(z.optional(z.string()), "Active `abTesting.variants` key for this environment.")
-});
-const AbVariantSchema = z.object({
-	environment: z.string(),
-	description: z.optional(z.string()),
-	overrides: z.optional(z.record(z.string(), z.unknown()))
-});
-const FontProvider = z.enum([
-	"google",
-	"fontsource",
-	"adobe",
-	"bunny",
-	"fontshare",
-	"googleicons",
-	"npm",
-	"local"
-]);
-const FontStyle = z.enum(["normal", "italic"]);
-const FontDisplay = z.enum([
-	"auto",
-	"block",
-	"swap",
-	"fallback",
-	"optional"
-]);
-const FontWeight = z.union([z.number(), z.string()]);
-/** A local-font face (`provider: 'local'`). */
-const FontVariantSchema = z.object({
-	src: z.array(z.string()),
-	weight: z.optional(FontWeight),
-	style: z.optional(FontStyle),
-	unicodeRange: z.optional(z.array(z.string())),
-	display: z.optional(FontDisplay)
-});
-const SiteFontSchema = z.object({
-	name: z.string(),
-	provider: FontProvider,
-	cssVariable: z.string().check(z.regex(/^--/)),
-	weights: z.optional(z.array(FontWeight)),
-	styles: z.optional(z.array(FontStyle)),
-	subsets: z.optional(z.array(z.string())),
-	fallbacks: z.optional(z.array(z.string())),
-	optimizedFallbacks: z.optional(z.boolean()),
-	display: z.optional(FontDisplay),
-	formats: z.optional(z.array(z.string())),
-	unicodeRange: z.optional(z.array(z.string())),
-	variants: z.optional(z.array(FontVariantSchema)),
-	preload: desc(z.optional(z.union([z.boolean(), z.array(z.object({
-		weight: FontWeight,
-		style: z.optional(FontStyle)
-	}))])), "Emit `<Font preload />` for this family (true, or a list of weight/style faces).")
-});
-const PresentSchema = z.optional(z.record(z.string(), z.unknown()));
-const NavItemSchema = z.object({
-	label: z.optional(LocalizableSchema),
-	image: z.optional(ImageRefSchema),
-	href: z.optional(z.string()),
-	icon: z.optional(z.string()),
-	attrs: AttrsSchema,
-	itemAttrs: AttrsSchema,
-	submenu: z.optional(z.object({
-		present: PresentSchema,
-		get items() {
-			return z.optional(z.array(NavItemSchema));
-		}
-	}))
-});
-const FormFieldType = z.enum([
-	"text",
-	"email",
-	"tel",
-	"url",
-	"number",
-	"password",
-	"textarea",
-	"select",
-	"checkbox",
-	"radio",
-	"date",
-	"file",
-	"hidden"
-]);
-const FormFieldSchema = z.object({
-	name: z.string(),
-	type: FormFieldType,
-	label: z.optional(LocalizableSchema),
-	required: z.optional(z.boolean()),
-	validation: z.optional(z.string()),
-	options: z.optional(z.union([z.string(), z.array(z.object({
-		label: z.string(),
-		value: z.string()
-	}))])),
-	attrs: AttrsSchema
-});
-const ContentNodeSchema = z.object({
-	tag: z.string(),
-	attrs: AttrsSchema,
-	text: z.optional(z.string()),
-	get children() {
-		return z.optional(z.array(ContentNodeSchema));
-	}
-});
-const TemplateSchema = z.union([
-	z.object({
-		type: z.literal("nav"),
-		tags: z.optional(z.array(z.string())),
-		present: PresentSchema,
-		items: z.optional(z.array(NavItemSchema))
-	}),
-	z.object({
-		type: z.literal("form"),
-		tags: z.optional(z.array(z.string())),
-		present: PresentSchema,
-		action: z.optional(z.string()),
-		method: z.optional(z.enum(["get", "post"])),
-		fields: z.optional(z.array(FormFieldSchema)),
-		submit: z.optional(z.record(z.string(), AttrValue)),
-		honeypot: z.optional(z.boolean())
-	}),
-	z.object({
-		type: z.literal("nodes"),
-		tags: z.optional(z.array(z.string())),
-		nodes: z.optional(z.array(ContentNodeSchema))
-	})
-]);
-const GalleryImageSchema = z.object({
-	src: z.string(),
-	alt: LocalizableSchema,
-	caption: z.optional(LocalizableSchema)
-});
-const GallerySchema = z.object({
-	title: z.optional(LocalizableSchema),
-	tags: z.optional(z.array(z.string())),
-	images: z.array(GalleryImageSchema)
-});
-const TestimonialItemSchema = z.object({
-	quote: LocalizableSchema,
-	name: z.string(),
-	role: z.optional(z.string()),
-	rating: z.optional(z.number().check(z.gte(0), z.lte(5))),
-	date: z.optional(IsoDate)
-});
-const TestimonialGroupSchema = z.object({
-	title: z.optional(LocalizableSchema),
-	items: z.array(TestimonialItemSchema)
-});
-const OfferSchema = z.object({
-	name: z.optional(LocalizableSchema),
-	price: z.optional(z.union([z.string(), z.number()])),
-	priceCurrency: z.optional(Iso4217),
-	availability: z.optional(z.string()),
-	url: z.optional(z.url()),
-	validFrom: z.optional(IsoDate),
-	priceValidUntil: z.optional(IsoDate)
-});
-const ServiceSchema = z.object({
-	name: LocalizableSchema,
-	description: z.optional(LocalizableSchema),
-	slug: z.optional(LocalizableSchema),
-	offers: z.optional(z.array(OfferSchema))
-});
-const OpenGraphSchema = z.object({
-	type: z.optional(z.string()),
-	siteName: z.optional(z.string()),
-	title: z.optional(LocalizableSchema),
-	description: z.optional(LocalizableSchema),
-	image: z.optional(ImageRefSchema),
-	locale: z.optional(z.string())
-});
-const TwitterSchema = z.object({
-	card: z.optional(z.enum([
-		"summary",
-		"summary_large_image",
-		"app",
-		"player"
-	])),
-	site: z.optional(z.string()),
-	creator: z.optional(z.string()),
-	title: z.optional(LocalizableSchema),
-	description: z.optional(LocalizableSchema),
-	image: z.optional(ImageRefSchema)
-});
-/**
-* What `vitops search notify` needs to tell search engines a deploy happened.
-*
-* Scoped by what search engines actually accept, which is narrower than it looks:
-* Google exposes **no** "request indexing" API (the Search Console button is not in
-* its API, and URL Inspection is read-only), and it removed the sitemap ping
-* endpoint in 2023. So the sanctioned set is: an accurate sitemap, a Search Console
-* sitemap resubmit, an IndexNow ping — which Google does *not* honour but Bing,
-* Yandex, Naver, Seznam and Yep do — and a read-only inspection pass to find out
-* what Google actually did.
-*
-* Facts only, the same rule the legal block follows: this records what the site has
-* (a key, a property, which pages matter), never what to say about it.
-*/
-const IndexNowSchema = z.object({
-	key: desc(z.string().check(z.regex(/^[a-zA-Z0-9-]{8,128}$/)), "IndexNow key (8–128 chars, hex is conventional). NOT a secret — it is served publicly at `keyLocation` so the engine can verify you own the host. Generate one with `vitops search notify --new-key`."),
-	keyLocation: desc(z.optional(z.url()), "Absolute URL of the key file. Defaults to `<canonical>/<key>.txt`; set it only when the file lives elsewhere."),
-	endpoint: desc(z.optional(z.url()), "IndexNow endpoint (default `https://api.indexnow.org/indexnow`). Any participating engine shares submissions with the rest, so one is normally enough.")
-});
-const SearchConsoleSchema = z.object({
-	siteUrl: desc(z.string(), "The property exactly as Search Console identifies it — `sc-domain:acme.ca` for a domain property, or the URL-prefix form `https://acme.ca/`. A mismatch here is a 403, not a \"not found\"."),
-	resubmitSitemap: desc(z.optional(z.boolean()), "Re-submit the sitemap through the Search Console API on each notify (default true when `searchConsole` is set). This is the automated equivalent of the manual resubmit in the UI.")
-});
-const IndexingSchema = z.object({
-	sitemapUrl: desc(z.optional(z.url()), "The sitemap to submit and to diff for changed URLs. Defaults to `<canonical>/sitemap-index.xml`."),
-	indexNow: desc(z.optional(IndexNowSchema), "IndexNow submission (Bing, Yandex, Naver, Seznam, Yep — not Google). Omit to skip the channel."),
-	searchConsole: desc(z.optional(SearchConsoleSchema), "Google Search Console property. Needs a credential at run time — either a service account in `VITOPS_GSC_SERVICE_ACCOUNT` / `GOOGLE_APPLICATION_CREDENTIALS`, or the user OAuth credential `vitops search setup` uses (`VITOPS_GOOGLE_CLIENT_ID` / `_CLIENT_SECRET` / `_REFRESH_TOKEN`). The service account wins when both are set. Never put a key in this file."),
-	priorityUrls: desc(z.optional(z.array(z.url())), "The pages whose indexing actually matters. `vitops search notify --check` inspects these and exits non-zero if Google has not indexed one. Kept explicit because URL Inspection is quota-bound (2000/day), so checking every page is neither affordable nor informative.")
-});
-/**
-* The ad platforms `vitops ads` can link a site to.
-*
-* A closed enum, mirroring `AD_PROVIDER_KEYS` in `@getvitops/utils/ads` — that
-* module owns what each platform *can do* (whether it verifies a domain, what its
-* tag is, which click ID it stamps), this owns what a config may *say*. Mirrored
-* rather than derived because a `z.enum` needs literals to reach the published JSON
-* Schema; `config.test.ts` asserts the two lists are the same set, so a provider
-* added to one and not the other fails the build rather than silently getting no
-* verification step and no tag.
-*/
-const AD_PROVIDERS = [
-	"google",
-	"meta",
-	"linkedin",
-	"reddit",
-	"tiktok",
-	"microsoft",
-	"pinterest",
-	"snapchat"
-];
-const AdProviderSchema = z.enum(AD_PROVIDERS);
-/**
-* One ad property this site is linked to.
-*
-* Facts, not prose — the same rule the legal block follows. This records *which*
-* account and *which* tag id, and the platform capability table decides what can be
-* done about them. It is also what finally lets the rest of the toolchain see an ad
-* pixel: the generated cookie notice discloses its cookies, `vitops ads lint`
-* checks its click ID is captured, and the consent gate is handed the cookie names
-* to clear on revoke. A pixel pasted into a template is invisible to all three.
-*/
-const AdPropertySchema = z.object({
-	accountId: desc(z.optional(z.string()), "The advertising account as the platform shows it — Google Ads customer ID, Meta ad account, LinkedIn partner ID, Reddit advertiser ID. For LinkedIn this is also the Insight Tag id; everywhere else the tag id is `pixelId`."),
-	pixelId: desc(z.optional(z.string()), "The tag/pixel ID the browser snippet initialises — Meta pixel, TikTok pixel, Reddit pixel, Microsoft UET tag ID, Pinterest tag ID, Snap pixel, or the Google Ads conversion ID (`AW-…`, which is NOT the customer ID)."),
-	conversionLabel: desc(z.optional(z.string()), "Google Ads only: the conversion action label paired with the `AW-…` conversion ID."),
-	domain: desc(z.optional(z.string()), "Bare hostname to verify with this platform. Defaults to the host of `domains.canonical` — set it only when the ad account is verified against a different domain."),
-	domainVerification: desc(z.optional(z.string()), "The verification token from the platform UI, for the platforms that verify by DNS TXT (Meta, TikTok, Pinterest, Snapchat). `vitops ads setup` prompts for it and writes it here on first run. NOT a secret — it is published in DNS, and the platform fetching it back is the ownership proof, exactly like the IndexNow key. A value containing `=` is used as the whole record, which is the escape hatch if a platform changes its prefix."),
-	category: desc(z.optional(z.enum(["marketing", "analytics"])), "Consent category the tag waits on (default `marketing`). An ad pixel is advertising by default; `analytics` is for a site using one purely for its own measurement."),
-	enabled: desc(z.optional(z.boolean()), "Set false to keep the property on record without emitting its tag.")
-});
-/**
-* How one location's Google reviews are selected and ordered for display.
-*
-* Keyed by `organization.locations` key, mirroring `site.ads`/`site.searchConsole`
-* — `vitops reviews` needs to know which physical location a fetched review set
-* belongs to, and that record already exists.
-*/
-const ReviewLocationSchema = z.object({
-	accountId: desc(z.optional(z.string()), "GBP account resource id (`accounts/…`), overriding `site.reviews.accountId` for this location."),
-	locationId: desc(z.string(), "GBP location resource id (`locations/…`) to fetch reviews for."),
-	featured: desc(z.optional(z.array(z.string())), "Review ids to always include, in this order, ahead of everything else automatically selected."),
-	minRating: desc(z.optional(z.number()), "Drop reviews below this star rating (default 4) from the automatic (non-featured) selection."),
-	limit: desc(z.optional(z.number()), "Keep at most this many reviews after filtering."),
-	sort: desc(z.optional(z.enum(["recent", "rating"])), "Ordering for the non-featured remainder (default `recent`).")
-});
-const ReviewsSchema = z.object({
-	accountId: desc(z.optional(z.string()), "Default GBP account resource id (`accounts/…`) for locations that do not override it."),
-	locations: desc(z.record(z.string(), ReviewLocationSchema), "Which `organization.locations` to fetch Google reviews for, and how each one’s reviews are filtered/ordered. `vitops reviews` writes the result to `.vitops/reviews.json`."),
-	schema: desc(z.optional(z.boolean()), "Emit `Review` JSON-LD for these reviews (default false). Off by default: Google’s structured-data policy treats a business marking up reviews of itself as ineligible for review rich results, and risks a manual action."),
-	avatars: desc(z.optional(z.boolean()), "Render the reviewer’s Google-hosted avatar photo (default false). Off by default: every visitor would otherwise issue a third-party request to googleusercontent.com, and the URLs are not guaranteed to stay live.")
-});
-/**
-* Which template set the generated legal documents are written against. This is
-* a closed enum rather than a free string because an unrecognised value would
-* otherwise silently fall back to the wrong body of law; `validateConfig` rejects
-* anything without a registered template. Add a member here and a matching entry
-* in `legal/templates/index.ts` — the two are checked against each other.
-*/
-const JURISDICTIONS = ["ca"];
-const JurisdictionSchema = z.enum(JURISDICTIONS);
-/**
-* The country each template set frames cross-border transfers as *leaving*.
-*
-* A jurisdiction's own country is not a transfer, so this is what filters the
-* disclosure lists — without it, `country: "Canada"` renders the incoherent
-* "outside of Canada, including Canada".
-*
-* It belongs to the **jurisdiction**, not to `organization.address`: a `ca` policy
-* says "outside of Canada" even for a business incorporated elsewhere. (The
-* address drives a different sentence — the terms' governing-law clause, via
-* `governingCountry`.) `satisfies` makes a new jurisdiction unable to forget it,
-* the same guard style as `TEMPLATES`.
-*/
-const JURISDICTION_COUNTRIES = { ca: "Canada" };
-/**
-* A third party that receives personal information. The generator derives the
-* ones it can see (analytics IDs, Turnstile, the deploy platform); this is for
-* the rest, which no other part of the config implies.
-*
-* Deliberately facts, not prose: the config records *what is true*, the template
-* owns *how it is said*. That keeps a policy correct when the wording changes.
-*/
-const ProcessorStorageSchema = z.object({
-	country: desc(z.string(), "A country or bloc where this provider stores or processes the information, as it should read in a sentence (e.g. \"Canada\", \"the United States\", \"the European Union\"). Naming the jurisdiction the policy is written for is meaningful: it says this information does not leave it."),
-	scope: desc(z.optional(z.string()), "Which information is held there, as a noun phrase that reads after \"in the case of\" (e.g. \"account and sign-in information\", \"mailbox contents\"). Omit when this location holds everything the provider receives — a scoped entry claims LESS than an unscoped one, so omitting it is the safe default.")
-});
-const ProcessorSchema = z.object({
-	name: desc(z.string(), "The provider, as a reader would recognise it (e.g. \"Stripe\")."),
-	purpose: desc(z.string(), "Why they receive it, as a noun phrase that reads after \"for\" (e.g. \"payment processing\")."),
-	country: desc(z.optional(z.string()), "Shorthand for the common case where one country is both where they store it and whose laws reach it: asserts BOTH `storage: [{ country }]` AND `operatorCountry`. Reads inside a sentence (e.g. \"the United States\"). When the two differ — a Canadian region operated by a US company — state `storage` and `operatorCountry` instead; setting this alongside either is rejected."),
-	storage: desc(z.optional(z.array(ProcessorStorageSchema)), "Where the information actually rests. Feeds the \"stored or processed outside of <jurisdiction>\" disclosure and nothing else. Several entries are allowed, each optionally scoped to a category of information — which is what makes a Canadian-region tenant holding identity data in the US expressible."),
-	operatorCountry: desc(z.optional(z.string()), "The jurisdiction that can compel this provider to hand the information over — where it is established, or from which it is controlled. Reads after \"the laws of\" (e.g. \"the United States\"); a bloc is acceptable. A SEPARATE fact from `storage`, because privacy law cares about foreign *access*, not only foreign storage: a Canadian-region service run by a US company is `storage: [{ country: \"Canada\" }]` with `operatorCountry: \"the United States\"`."),
-	privacyUrl: z.optional(z.url())
-});
-const SiteSectionSchema = z.object({
-	defaultLocale: desc(z.string(), "The locale used when none is specified; must be a `locales` key."),
-	locales: desc(z.record(z.string(), LocaleSchema), "Locales the site is published in, keyed by BCP 47 tag (e.g. \"en\", \"fr\")."),
-	domains: desc(z.optional(z.object({
-		canonical: desc(z.url(), "The canonical origin used for absolute URLs and SEO."),
-		aliases: desc(z.optional(z.array(DomainAliasSchema)), "Alias domains and how they redirect to the canonical one.")
-	})), "Canonical domain + redirecting aliases."),
-	dns: desc(z.optional(z.record(z.string(), DnsDomainSchema)), "Desired DNS state per domain (provider, nameservers, records) — declarative reference, not applied automatically."),
-	cloudflare: desc(z.optional(z.record(z.string(), z.unknown())), "Deliberate escape hatch for provider-specific Cloudflare settings — out of scope to model here."),
-	google: desc(z.optional(z.object({ project: desc(z.string(), "Google Cloud project id that API usage is attributed to (quota and billing). One project per site keeps usage separate — Search Console today, Maps and anything else later. Sent as `x-goog-user-project`, which is required when the credential is a *user* one (an ADC login from `gcloud auth application-default login`, or `VITOPS_GOOGLE_*`): those use a shared OAuth client that carries no project of its own. A service-account credential belongs to a project already, so this is not needed for it. The identity must hold `serviceusage.services.use` on the project, and the APIs being called must be enabled there.") })), "This site's Google Cloud project. Not a secret — the credentials stay in the environment."),
-	searchConsole: desc(z.optional(z.record(z.string(), SearchConsoleSetupSchema)), "Domains to onboard as Google Search Console *domain properties* via `vitops search setup`, keyed by bare hostname (mirrors `dns`). Credentials come from the environment (CLOUDFLARE_API_TOKEN + the Google OAuth vars) — never in this file. Set `google.project` when using a user credential."),
-	environments: desc(z.record(z.string(), EnvironmentSchema), "Deploy environments (production, dev, …): URL, API origin, analytics toggle, robots policy, active A/B variant."),
-	abTesting: desc(z.optional(z.object({
-		enabled: z.boolean(),
-		cookieName: z.optional(z.string()),
-		cookieMaxAge: desc(z.optional(z.number().check(z.int(), z.positive())), "Seconds."),
-		splitRatio: desc(z.optional(z.number().check(z.gte(0), z.lte(1))), "Fraction of traffic sent to the variant (0–1)."),
-		variants: desc(z.optional(z.record(z.string(), AbVariantSchema)), "Named variants; each targets an environment and may deep-merge config `overrides`.")
-	})), "A/B testing: cookie-based split plus named variants whose `overrides` patch the config per environment."),
-	fonts: desc(z.optional(z.array(SiteFontSchema)), "Font LOADING (a serialisable projection of the Astro Fonts API: provider, weights, subsets, preload). Font TOKENS live in `designSystem.themes.<theme>.fonts` and reference the same `cssVariable`."),
-	tags: desc(z.optional(z.record(z.string(), z.unknown())), "Free-form content-tag taxonomy (site-specific; not interpreted by the generator)."),
-	postTypes: desc(z.optional(z.record(z.string(), z.unknown())), "Free-form content-type definitions (site-specific; not interpreted by the generator)."),
-	galleries: desc(z.optional(z.record(z.string(), GallerySchema)), "Named image galleries (title, tags, images with localisable alt/caption)."),
-	testimonials: desc(z.optional(z.record(z.string(), TestimonialGroupSchema)), "Named testimonial groups (quote, name, role, rating, date)."),
-	templates: desc(z.optional(z.record(z.string(), TemplateSchema)), "Named content templates rendered at SSR time: `nav` (menu trees), `form` (field lists + submit), or `nodes` (raw element trees)."),
-	navigation: desc(z.optional(z.object({ activeTemplate: desc(z.optional(z.object({
-		default: desc(z.optional(z.string()), "A `templates` key."),
-		breakpoints: desc(z.optional(z.record(z.string(), z.string())), "Breakpoint name → `templates` key overrides.")
-	})), "Which nav template is active, optionally per breakpoint.") })), "Site navigation settings (which nav template renders where)."),
-	seo: desc(z.optional(z.object({
-		titleTemplate: desc(z.optional(z.string()), "Page-title pattern (e.g. \"%s · Acme\")."),
-		descriptionTemplate: z.optional(z.string()),
-		robots: desc(z.optional(RobotsSchema), "e.g. \"index,follow\" / \"noindex,nofollow\"."),
-		googleSiteVerification: z.optional(z.string()),
-		bingSiteVerification: z.optional(z.string()),
-		openGraph: z.optional(OpenGraphSchema),
-		twitter: z.optional(TwitterSchema),
-		indexing: desc(z.optional(IndexingSchema), "How `vitops search notify` tells search engines about a deploy: which sitemap, IndexNow key, Search Console property, and which pages to verify afterwards.")
-	})), "SEO defaults: title/description templates, robots policy, verification tokens, Open Graph + Twitter cards, and post-deploy indexing notification."),
-	analytics: desc(z.optional(z.object({
-		googleAnalyticsId: z.optional(z.string()),
-		plausibleDomain: z.optional(z.string()),
-		googleTagManagerId: z.optional(z.string()),
-		clarityId: desc(z.optional(z.string()), "Microsoft Clarity project ID."),
-		matomo: desc(z.optional(z.object({
-			url: desc(z.string(), "Instance base URL (self-hosted, or `*.matomo.cloud`)."),
-			siteId: desc(z.string(), "Site ID within that instance."),
-			cookies: desc(z.optional(z.boolean()), "Default false — Matomo runs cookieless (`disableCookies`), which is what lets the cookie notice state positively that it sets none.")
-		})), "Matomo instance.")
-	})), "Analytics provider IDs (gated per environment via `environments.<env>.analytics`). Which provider is set is also what the generated privacy policy and cookie notice disclose — see `legal`."),
-	notifications: desc(z.optional(z.object({ email: desc(z.optional(z.union([z.email(), z.object({
-		provider: desc(z.literal("cloudflare"), "Delivery provider. Only Cloudflare Email Sending is implemented; the field is stated so adding another is additive."),
-		to: desc(z.optional(z.email()), "Recipient. Defaults to the primary location’s `email`, then the first location that has one."),
-		from: desc(z.optional(z.email()), "Sender. Defaults to `noreply@<domains.canonical>`. Its domain must be onboarded (`wrangler email sending enable <domain>`) or every send fails."),
-		fromName: desc(z.optional(z.string()), "Display name on the From header. Defaults to `organization.name`."),
-		replyTo: desc(z.optional(z.email()), "Reply-To header."),
-		binding: desc(z.optional(z.string()), "Workers `send_email` binding name (default `EMAIL`). Set it when using a restricted binding.")
-	})])), "Where conversion notifications are e-mailed. A bare address is shorthand for `{ provider: \"cloudflare\", to }`.") })), "Where site notifications (form submissions, tracked calls) are sent. TODO: `sms` and `persist` channels — only `email` is implemented."),
-	tracking: desc(z.optional(z.object({
-		enabled: desc(z.optional(z.boolean()), "Capture ad click IDs and UTMs from the landing URL into the `_ac` cookie, for attributing conversions."),
-		category: desc(z.optional(z.enum(["marketing", "analytics"])), "Consent category the `_ac` cookie waits on (default `marketing`). It is a 90-day identifier tying a visitor to the ad that brought them, so it is only written once this category is granted — and asking for it is what raises the banner."),
-		platforms: desc(z.optional(z.array(z.string())), "Informational list of ad platforms in use. Capture recognises every known click-ID parameter regardless.")
-	})), "Ad-click attribution for conversion tracking."),
-	ads: desc(z.optional(z.partialRecord(AdProviderSchema, AdPropertySchema)), "Ad properties this site is linked to, keyed by platform. Read by `vitops ads setup` (ensure the DNS verification record), `vitops ads tags` (emit the consent-gated pixel), and the generated cookie notice (disclose what each pixel stores). Credentials never live here — the DNS write uses CLOUDFLARE_API_TOKEN from the environment."),
-	reviews: desc(z.optional(ReviewsSchema), "Google Business Profile reviews to cache and display, keyed by `organization.locations`. Read by `vitops reviews`. Credentials never live here — a Google OAuth credential comes from the environment, same as `site.searchConsole`."),
-	security: desc(z.optional(z.object({ turnstile: z.optional(z.object({ siteKey: desc(z.optional(z.string()), "Cloudflare Turnstile site key (public).") })) })), "Security integrations (bot protection)."),
-	legal: desc(z.optional(z.object({
-		jurisdiction: desc(z.optional(JurisdictionSchema), "Which legal template set the generated documents use. Default `ca`."),
-		privacyPolicy: z.optional(z.object({
-			enabled: z.boolean(),
-			url: z.optional(z.url()),
-			lastUpdated: z.optional(IsoDate),
-			privacyOfficer: desc(z.optional(ContactConfigSchema), "Who privacy requests go to. Falls back to `contact`, then `primaryLocation`."),
-			retention: desc(z.optional(z.string()), "How long personal information is kept, in prose (e.g. \"24 months after last contact\")."),
-			processors: desc(z.optional(z.array(ProcessorSchema)), "Third parties that receive personal information and cannot be inferred from the rest of the config (payment processors, CRMs, mail senders). Known providers implied by `analytics`, `security` and `deployment` are added automatically — list only the rest.")
-		})),
-		termsOfService: z.optional(z.object({
-			enabled: z.boolean(),
-			url: z.optional(z.url()),
-			lastUpdated: z.optional(z.nullable(IsoDate)),
-			governingLaw: desc(z.optional(z.string()), "Governing-law clause, in prose (e.g. \"the Province of Ontario\"). Defaults from the contact address.")
-		})),
-		cookieConsent: z.optional(z.object({
-			enabled: z.boolean(),
-			type: desc(z.optional(z.enum(["opt-in", "opt-out"])), "Consent model."),
-			position: z.optional(z.enum([
-				"top",
-				"bottom",
-				"center"
-			])),
-			categories: z.optional(z.array(z.string()))
-		}))
-	})), "Legal pages: which documents exist, where they live, and the facts the generated prose asserts."),
-	icons: desc(z.optional(z.looseObject({
-		ui: desc(z.optional(z.string()), "Icon set used for UI chrome (e.g. \"lucide\", \"ph\")."),
-		brand: desc(z.optional(z.string()), "Icon set used for brand marks."),
-		weight: desc(z.optional(z.string()), "Weight for suffix-weighted sets like Phosphor (\"regular\" | \"bold\" | \"duotone\" | \"fill\" | \"light\" | \"thin\"). Ignored by sets that split weights across collections, e.g. Font Awesome."),
-		sprite: desc(z.optional(z.boolean()), "Emit an SVG sprite (icons.svg) alongside the stylesheet, for consumers that cannot run an icon integration (Bricks/WordPress, EmDash renderers)."),
-		semantic: desc(z.optional(z.array(z.string())), "Named semantic icons to include."),
-		"fa7-solid": z.optional(z.array(z.string())),
-		"fa7-regular": z.optional(z.array(z.string())),
-		"fa7-light": z.optional(z.array(z.string())),
-		"fa7-thin": z.optional(z.array(z.string())),
-		"fa7-brands": z.optional(z.array(z.string())),
-		"simple-icons": z.optional(z.array(z.string())),
-		"material-symbols": z.optional(z.array(z.string())),
-		lucide: z.optional(z.array(z.string())),
-		ph: z.optional(z.array(z.string()))
-	})), "Icon sets and the specific icons to bundle from each (keys are iconify collection names)."),
-	favicon: desc(z.optional(z.object({
-		source: desc(z.string(), "Source image (SVG/PNG) the favicon set is generated from."),
-		lowResSource: desc(z.optional(z.string()), "Alternate source for small raster sizes (16/32px) when the main source scales down poorly."),
-		name: desc(z.optional(z.string()), "App name for the generated web manifest. Setting this AND `themeColor` is what makes the site installable: together they emit `site.webmanifest` (with `display: \"standalone\"`) and link it. Neither alone does anything. A marketing site that does not want a browser offering to install it should leave one of them unset."),
-		themeColor: desc(z.optional(z.string()), "Browser UI colour, emitted as `<meta name=\"theme-color\">` on every page — so it applies with or without a manifest. Note it is also half the manifest switch: see `name`."),
-		backgroundColor: desc(z.optional(z.string()), "Background composited under the OPAQUE generated icons — `apple-touch-icon.png` and the maskable `icon-mask.png` — which are produced whether or not there is a manifest. Defaults to white, so a dark logo on a transparent source needs this set. It is also the manifest `background_color` when one is emitted, but it is not manifest-only.")
-	})), "Favicon/PWA asset generation (consumed by `@getvitops/utils` favicon tooling)."),
-	deployment: desc(z.optional(z.object({
-		platform: z.optional(z.string()),
-		buildCommand: z.optional(z.string()),
-		deployCommand: z.optional(z.string()),
-		outputDirectory: z.optional(z.string()),
-		type: z.optional(z.string())
-	})), "How the site is built and deployed (platform, commands, output directory) — informational for tooling.")
-});
-const OrganizationSectionSchema = z.extend(OrganizationSchema, {
-	contact: desc(z.optional(ContactConfigSchema), "Primary contact: either a `locations` key (string reference) or an inline name/email/phone/address object."),
-	primaryLocation: desc(z.optional(z.string()), "The main `locations` key (for JSON-LD and defaults)."),
-	locations: desc(z.optional(z.record(z.string(), LocationSchema)), "Physical locations (schema.org LocalBusiness): address, geo, opening hours, service area."),
-	services: desc(z.optional(z.record(z.string(), ServiceSchema)), "Services offered (schema.org Service/Offer): name, description, slug, price offers."),
-	links: desc(z.optional(z.object({
-		googleMaps: z.optional(z.url()),
-		instagram: z.optional(z.url()),
-		facebook: z.optional(z.url()),
-		x: z.optional(z.url()),
-		linkedin: z.optional(z.url()),
-		youtube: z.optional(z.url()),
-		github: z.optional(z.url())
-	})), "Public profile URLs (also feed JSON-LD `sameAs` via `organization.sameAs`).")
-});
-const ConfigSchema = z.object({
-	$schema: desc(z.optional(z.string()), "URL of the published config JSON Schema (stamped by `vitops init --site`) so editors provide autocomplete + validation."),
-	designSystem: DesignSystemBlock,
-	organization: desc(z.optional(OrganizationSectionSchema), "The company: schema.org Organization details for JSON-LD (name, legalName, logo, tax IDs, sameAs), plus its contact, physical locations, services and public profiles. These stay true across sites — several sites can share one `organization` and differ only in `site`."),
-	site: desc(SiteSectionSchema, "This published site: locales, domains, environments, content templates, SEO, analytics, legal documents, icons, favicon and deployment. Facts about a *presentation* of the organization rather than the organization itself.")
-});
-const CONFIG_SCHEMA_URL = "https://unpkg.com/@getvitops/generator/config.schema.json";
-/** The installed copy, not the unpinned unpkg URL — see `SCHEMA_LOCAL_PATH`'s twin. */
-const CONFIG_SCHEMA_LOCAL_PATH = "./node_modules/@getvitops/generator/config.schema.json";
-/** The published JSON Schema (draft-2020-12), derived from the zod schema. */
-const configJsonSchema = {
-	$id: CONFIG_SCHEMA_URL,
-	...z.toJSONSchema(ConfigSchema, { target: "draft-2020-12" })
-};
-const issue = (path, message) => ({
-	code: "custom",
-	path,
-	message
-});
-/**
-* Where each key of the old flat config now lives.
-*
-* This exists so the restructure fails with a sentence a reader can act on. Zod
-* reports a flat config as a dozen separate `unrecognized_keys` issues plus a
-* missing required `site` — an accurate description of the document that teaches
-* nobody where anything went. Checked first, and it short-circuits: once we know
-* the document is the old shape, every other error is downstream noise.
-*/
-const MOVED_KEYS = {
-	defaultLocale: "site",
-	locales: "site",
-	domains: "site",
-	dns: "site",
-	cloudflare: "site",
-	environments: "site",
-	abTesting: "site",
-	fonts: "site",
-	tags: "site",
-	postTypes: "site",
-	galleries: "site",
-	testimonials: "site",
-	templates: "site",
-	navigation: "site",
-	seo: "site",
-	analytics: "site",
-	notifications: "site",
-	tracking: "site",
-	security: "site",
-	legal: "site",
-	icons: "site",
-	favicon: "site",
-	deployment: "site",
-	contact: "organization",
-	primaryLocation: "organization",
-	locations: "organization",
-	services: "organization",
-	links: "organization"
-};
-/**
-* Detect the pre-3.0 flat shape and name the moves.
-*
-* Keyed on a moved key sitting at the ROOT, not on the absence of `site` — a
-* config that simply forgot `site` should get the ordinary "required" error, and
-* a partially-migrated one (some keys moved, some not) is exactly the case worth
-* catching loudly.
-*/
-function migrationIssues(raw) {
-	if (typeof raw !== "object" || raw == null || Array.isArray(raw)) return [];
-	const found = Object.keys(raw).filter((k) => k in MOVED_KEYS);
-	if (found.length === 0) return [];
-	return [issue([], `this is the pre-3.0 flat site config. The top level is now three sections — \`designSystem\`, \`organization\`, \`site\` — and these keys moved:
-${found.map((k) => `  ${k} → ${MOVED_KEYS[k]}.${k}`).join("\n")}\n\`designSystem\` and the fields already under \`organization\` stay where they are.`)];
-}
-/**
-* Validate a raw (already parsed) config: shape via zod, then the cross-field
-* integrity that JSON Schema can't express (referential keys, extends acyclicity).
-* These live only here — the published JSON Schema enforces shape, not integrity.
-*/
-function validateConfig(input) {
-	const migration = migrationIssues(input);
-	if (migration.length) return {
-		ok: false,
-		data: void 0,
-		errors: migration
-	};
-	const parsed = z.safeParse(ConfigSchema, input);
-	if (!parsed.success) return {
-		ok: false,
-		data: void 0,
-		errors: parsed.error.issues
-	};
-	const cfg = parsed.data;
-	const site = cfg.site;
-	const org = cfg.organization;
-	const errors = [];
-	const has = (m, k) => !!m && k in m;
-	if (!has(site.locales, site.defaultLocale)) errors.push(issue(["site", "defaultLocale"], `defaultLocale "${site.defaultLocale}" is not in locales`));
-	const themes = cfg.designSystem?.themes ?? {};
-	const defaultTheme = cfg.designSystem?.defaultTheme;
-	if (!has(themes, "default") && defaultTheme == null) errors.push(issue(["designSystem", "themes"], "themes must include a \"default\" entry"));
-	if (defaultTheme != null && !has(themes, defaultTheme)) errors.push(issue(["designSystem", "defaultTheme"], `defaultTheme "${defaultTheme}" is not in designSystem.themes`));
-	for (const [key, entry] of Object.entries(themes)) if (entry.extends != null && !has(themes, entry.extends)) errors.push(issue([
-		"designSystem",
-		"themes",
-		key,
-		"extends"
-	], `extends "${entry.extends}" is not a themes key`));
-	for (const key of Object.keys(themes)) try {
-		resolveTheme(themes, key);
-	} catch (e) {
-		errors.push(issue([
-			"designSystem",
-			"themes",
-			key
-		], e.message));
-	}
-	if (org?.primaryLocation != null && !has(org.locations, org.primaryLocation)) errors.push(issue(["organization", "primaryLocation"], `primaryLocation "${org.primaryLocation}" is not in organization.locations`));
-	if (typeof org?.contact === "string" && !has(org.locations, org.contact)) errors.push(issue(["organization", "contact"], `contact "${org.contact}" is not an organization.locations key`));
-	for (const [name, v] of Object.entries(site.abTesting?.variants ?? {})) if (!has(site.environments, v.environment)) errors.push(issue([
-		"site",
-		"abTesting",
-		"variants",
-		name,
-		"environment"
-	], `environment "${v.environment}" is not in site.environments`));
-	for (const [i, a] of (site.domains?.aliases ?? []).entries()) if (a.environment != null && !has(site.environments, a.environment)) errors.push(issue([
-		"site",
-		"domains",
-		"aliases",
-		i,
-		"environment"
-	], `environment "${a.environment}" is not in site.environments`));
-	const templates = site.templates;
-	const at = site.navigation?.activeTemplate;
-	if (at?.default != null && !has(templates, at.default)) errors.push(issue([
-		"site",
-		"navigation",
-		"activeTemplate",
-		"default"
-	], `template "${at.default}" is not in site.templates`));
-	for (const [bp, tpl] of Object.entries(at?.breakpoints ?? {})) if (!has(templates, tpl)) errors.push(issue([
-		"site",
-		"navigation",
-		"activeTemplate",
-		"breakpoints",
-		bp
-	], `template "${tpl}" is not in site.templates`));
-	const privacy = site.legal?.privacyPolicy;
-	/**
-	* `country` is shorthand for BOTH `storage` and `operatorCountry`, so combining it
-	* with either is genuinely ambiguous — is the shorthand narrowing the explicit
-	* fact, or adding to it? Both readings are plausible and they make *contradictory
-	* legal claims*, so this is rejected rather than resolved by a silent rule.
-	*
-	* Checked unconditionally, not gated on `privacy.enabled`: the fact is wrong
-	* either way, and a document turned on later shouldn't surface it for the first
-	* time. Here rather than as a `z.refine` on the schema because parse-time
-	* rejection would make `resolveConfig` throw on the `vitops legal` path, which
-	* has no formatting for a zod issue — `validateConfig` is where every other
-	* cross-field legal requirement already lives, and it prints `path: message`.
-	*/
-	for (const [i, p] of (privacy?.processors ?? []).entries()) if (p.country != null && (p.storage != null || p.operatorCountry != null)) errors.push(issue([
-		"site",
-		"legal",
-		"privacyPolicy",
-		"processors",
-		i,
-		"country"
-	], `processor "${p.name}": \`country\` is shorthand for BOTH \`storage\` and \`operatorCountry\`, so combining it with either makes the narrower claim ambiguous — drop \`country\` and state the two facts, or drop the two and keep the shorthand`));
-	if (typeof privacy?.privacyOfficer === "string" && !has(org?.locations, privacy.privacyOfficer)) errors.push(issue([
-		"site",
-		"legal",
-		"privacyPolicy",
-		"privacyOfficer"
-	], `privacyOfficer "${privacy.privacyOfficer}" is not an organization.locations key`));
-	if (privacy?.enabled) {
-		if (resolvePrivacyContact(cfg) == null) errors.push(issue([
-			"site",
-			"legal",
-			"privacyPolicy"
-		], "privacyPolicy.enabled requires a contact for privacy requests — set site.legal.privacyPolicy.privacyOfficer, organization.contact, or organization.email/address"));
-		if (site.domains?.canonical == null) errors.push(issue([
-			"site",
-			"legal",
-			"privacyPolicy"
-		], "privacyPolicy.enabled requires site.domains.canonical — the policy states where information is held"));
-	}
-	const indexing = site.seo?.indexing;
-	if (indexing != null && site.domains?.canonical == null) {
-		if (indexing.sitemapUrl == null) errors.push(issue([
-			"site",
-			"seo",
-			"indexing",
-			"sitemapUrl"
-		], "site.seo.indexing needs site.domains.canonical to derive the sitemap URL — set one, or state sitemapUrl explicitly"));
-		if (indexing.indexNow != null && indexing.indexNow.keyLocation == null) errors.push(issue([
-			"site",
-			"seo",
-			"indexing",
-			"indexNow",
-			"keyLocation"
-		], "site.seo.indexing.indexNow needs site.domains.canonical to derive the key location — set one, or state keyLocation explicitly"));
-	}
-	for (const [provider, entry] of Object.entries(site.ads ?? {})) {
-		if (entry == null) continue;
-		const platform = AD_PLATFORMS[provider];
-		const at = [
-			"site",
-			"ads",
-			provider
-		];
-		if (entry.domainVerification != null && platform.verification.method === "none") errors.push(issue([...at, "domainVerification"], `${platform.name} has no domain verification — ${platform.verification.reason ?? "nothing verifies a domain there"}. Remove the token; linking is the tag and the account id.`));
-		if (entry.domainVerification != null && entry.domain == null && site.domains?.canonical == null) errors.push(issue([...at, "domain"], `site.ads.${provider}.domainVerification needs a domain to put the record on — set site.domains.canonical, or state site.ads.${provider}.domain explicitly`));
-		if (entry.accountId == null && entry.pixelId == null) errors.push(issue(at, `site.ads.${provider} identifies nothing — set accountId (the advertising account) and/or pixelId (the tag: ${platform.tag.needs} is what its snippet needs)`));
-	}
-	for (const [key, entry] of Object.entries(site.reviews?.locations ?? {})) {
-		const at = [
-			"site",
-			"reviews",
-			"locations",
-			key
-		];
-		if (!has(org?.locations, key)) errors.push(issue(at, `"${key}" is not an organization.locations key`));
-		else if (org?.locations?.[key]?.listings?.google == null) errors.push(issue(at, `organization.locations.${key} has no listings.google id — record the GBP location id there first`));
-		if (entry.accountId == null && site.reviews?.accountId == null) errors.push(issue([...at, "accountId"], `no accountId — set site.reviews.accountId or site.reviews.locations.${key}.accountId`));
-	}
-	if (errors.length) return {
-		ok: false,
-		data: void 0,
-		errors
-	};
-	return {
-		ok: true,
-		data: cfg,
-		errors: []
-	};
-}
-/**
-* Resolve who privacy requests go to: the explicit privacy officer, else the
-* organization's contact, else its primary location, else the organization itself.
-*
-* Exported because `validateConfig` and the legal-document derivation must agree
-* on it exactly — a config that validates must be one the policy can render, and
-* two copies of this precedence would drift into a policy with a blank address.
-*
-* Note every candidate but the first now lives in `organization`, and the first
-* (`site.legal.privacyPolicy.privacyOfficer`) still dereferences against
-* `organization.locations` — the officer is a person at the company, named by the
-* site because a company may publish more than one policy.
-*/
-function resolvePrivacyContact(cfg) {
-	const org = cfg.organization;
-	const deref = (c) => {
-		if (c == null) return void 0;
-		if (typeof c !== "string") return c;
-		const loc = org?.locations?.[c];
-		return loc && {
-			email: loc.email,
-			phone: loc.phone,
-			address: loc.address
-		};
-	};
-	return [
-		deref(cfg.site.legal?.privacyPolicy?.privacyOfficer),
-		deref(org?.contact),
-		deref(org?.primaryLocation),
-		org && {
-			email: org.email,
-			phone: org.phone,
-			address: org.address
-		}
-	].find((c) => c != null && (c.email != null || c.address != null));
-}
-/**
-* Resolve a design-system theme by following its `extends` chain and deep-merging
-* base → child (child wins; arrays replace wholesale, correct for token overrides).
-* Throws on unknown keys or an `extends` cycle. The result is a plain
-* `DesignSystem` (validate it against `DesignSystemSchema` for completeness).
-*/
-function resolveTheme(designSystem, key) {
-	const chain = [];
-	const seen = /* @__PURE__ */ new Set();
-	let cur = key;
-	while (cur != null) {
-		if (seen.has(cur)) throw new Error(`extends cycle in designSystem at "${cur}"`);
-		seen.add(cur);
-		const entry = designSystem[cur];
-		if (entry == null) throw new Error(`designSystem theme "${cur}" not found`);
-		chain.unshift(entry);
-		cur = entry.extends;
-	}
-	const out = {};
-	for (const entry of chain) {
-		const { extends: _e, displayName: _d, ...ds } = entry;
-		deepMerge(out, ds);
-	}
-	return out;
-}
-/**
-* Normalise the two `designSystem` shorthands to the canonical
-* `{ themes: { … } }` shape.
-*
-* Both are keyed off what CANNOT be a theme name in the other reading:
-*  - `colors` → a bare `DesignSystem` was written inline.
-*  - `themes` → already canonical.
-*  - neither → the legacy bare theme map, from before the block gained
-*    system-wide fields. Every config authored against the old schema takes this
-*    branch, which is what keeps the change forgiving at runtime even though the
-*    published JSON Schema moved.
-*/
-function normaliseDesignSystem(raw) {
-	const ds = raw.designSystem;
-	if (ds == null || typeof ds !== "object") return;
-	if ("themes" in ds) return;
-	raw.designSystem = "colors" in ds ? { themes: { default: ds } } : { themes: ds };
-}
-/**
-* Resolve a raw (already-parsed) config into a validated `Config`:
-*  1. strip YAML nulls,
-*  2. normalise the `designSystem` shorthands to `{ themes: … }`,
-*  3. apply the active A/B variant's `overrides` (by `siteEnv`),
-*  4. validate (shape + cross-field).
-* Pure — no YAML/env access. A loader supplies `siteEnv`.
-*
-* Steps 2 and 3 are in this order deliberately. Normalising first means an
-* `abTesting` override always addresses the canonical shape
-* (`designSystem.themes.<name>`), whatever shorthand the base config used. With
-* the merge first, an override's key path depended on how the base happened to be
-* written — so the same patch hit a different place in two configs that were
-* otherwise equivalent.
-*
-* The A/B lookup reads `site.environments` / `site.abTesting`, and the overrides
-* still deep-merge at the **root** — a variant patches whichever section it names,
-* which is what lets one target `designSystem` and another `site.seo`.
-*/
-function resolveConfig(input, siteEnv = "production") {
-	const raw = stripNulls(input);
-	normaliseDesignSystem(raw);
-	const site = raw.site;
-	const envConfig = (site?.environments)?.[siteEnv];
-	if (envConfig?.variant) {
-		const overrides = (site?.abTesting)?.variants?.[envConfig.variant]?.overrides;
-		if (overrides) {
-			normaliseDesignSystem(overrides);
-			deepMerge(raw, overrides);
-		}
-	}
-	const result = validateConfig(raw);
-	if (!result.ok) {
-		const msg = result.errors.map((e) => `  ${e.path.join(".") || "<root>"}: ${e.message}`).join("\n");
-		throw new Error(`Invalid config:\n${msg}`);
-	}
-	return result.data;
-}
-/**
-* Is this raw config a full `Config` rather than a bare `design-system.json`?
-*
-* The discriminator is **total**, not a heuristic, and both halves are load-
-* bearing: `ConfigSchema` cannot validate without a `designSystem` (it is a
-* required key), and `DesignSystemSchema` is strict, so a `designSystem` key in a
-* design system is an `unrecognized_keys` error. No document can be read as both,
-* and no document that is neither reaches here without failing validation anyway.
-*
-* The restructure did not weaken this: `designSystem` stayed at the root
-* precisely so the discriminator kept working unchanged.
-*
-* Deliberately shape-based rather than filename-based: consumers name this file
-* whatever suits them (`company.json`, `site.json`, `vitops.config.json`), and a
-* rule keyed to a name would silently stop working the moment someone renamed it.
-*/
-function isConfig(raw) {
-	return typeof raw === "object" && raw != null && !Array.isArray(raw) && "designSystem" in raw;
-}
-/**
-* Resolve a raw config of either kind into the design system to build from.
-*
-* Every entry point that used to take a `design-system.json` goes through this,
-* so a consumer who keeps their tokens inside the larger config points the
-* same option at that file instead of maintaining a second one. The config
-* is handed back too, because the parts of generation that depend on site-level
-* facts (`designSystem.defaultColorScheme`, the legal documents, the icon
-* sprite) would otherwise need the same path declared a second time.
-*
-* The returned `designSystem` is **not** validated here — the caller does that,
-* so it can say which file and which theme the errors belong to. Validation of
-* the config itself has already happened (`resolveConfig` throws).
-*/
-function resolveInput(raw, opts = {}) {
-	if (!isConfig(raw)) {
-		if (opts.theme != null) throw new Error(`theme "${opts.theme}" was requested, but this is a design-system.json — it holds one design system and no \`themes\` map. Point at a full config to select a theme.`);
-		return { designSystem: raw };
-	}
-	const config = resolveConfig(raw, opts.siteEnv);
-	const themes = config.designSystem?.themes ?? {};
-	const theme = opts.theme ?? config.designSystem?.defaultTheme ?? "default";
-	if (!(theme in themes)) throw new Error(`designSystem.themes has no "${theme}" entry (found: ${Object.keys(themes).join(", ") || "none"})`);
-	return {
-		designSystem: resolveTheme(themes, theme),
-		config,
-		theme
-	};
-}
-/** Strip nulls (YAML `~`/`null`) → undefined so optional fields validate. */
-function stripNulls(obj) {
-	if (obj === null) return void 0;
-	if (Array.isArray(obj)) return obj.map(stripNulls);
-	if (obj && typeof obj === "object") {
-		const result = {};
-		for (const [key, value] of Object.entries(obj)) {
-			const stripped = stripNulls(value);
-			if (stripped !== void 0) result[key] = stripped;
-		}
-		return result;
-	}
-	return obj;
-}
-/** Deep-merge `source` into `target` (in place). Arrays replace wholesale. */
-function deepMerge(target, source) {
-	for (const key of Object.keys(source)) {
-		const s = source[key];
-		const t = target[key];
-		if (s && typeof s === "object" && !Array.isArray(s) && t && typeof t === "object" && !Array.isArray(t)) deepMerge(t, s);
-		else target[key] = s;
-	}
-}
-
-//#endregion
 //#region src/tiers.ts
 const c = (classes, partial, generated = false) => ({
 	...partial ? { partial } : {},
@@ -3351,7 +1113,8 @@ function renderElementsDoc(elementsDir) {
 		if (ib >= 0) return 1;
 		return a.name.localeCompare(b.name);
 	});
-	return `${ELEMENTS_PREAMBLE}\n${elements.map(renderElement).join("\n---\n\n")}`;
+	const body = elements.map(renderElement).join("\n---\n\n");
+	return `${ELEMENTS_PREAMBLE}\n${body}`;
 }
 const code = (xs) => xs.map((x) => `\`${x}\``).join(", ");
 function renderCssClasses(ds) {
@@ -3831,10 +1594,11 @@ const CODE_SLOT = "\0";
 */
 const renderInlineMarkdown = (s) => {
 	const spans = [];
-	return escapeHtml(s.replace(/`([^`]+)`/g, (_, body) => {
+	const lifted = s.replace(/`([^`]+)`/g, (_, body) => {
 		spans.push(body);
 		return `${CODE_SLOT}${spans.length - 1}${CODE_SLOT}`;
-	})).replace(/\*\*([^*]+)\*\*/g, "<strong>$1</strong>").replace(/\*([^*\n]+)\*/g, "<em>$1</em>").replace(new RegExp(`${CODE_SLOT}(\\d+)${CODE_SLOT}`, "g"), (_, i) => `<code>${escapeHtml(spans[Number(i)] ?? "")}</code>`);
+	});
+	return escapeHtml(lifted).replace(/\*\*([^*]+)\*\*/g, "<strong>$1</strong>").replace(/\*([^*\n]+)\*/g, "<em>$1</em>").replace(new RegExp(`${CODE_SLOT}(\\d+)${CODE_SLOT}`, "g"), (_, i) => `<code>${escapeHtml(spans[Number(i)] ?? "")}</code>`);
 };
 /**
 * Walk a JSON Schema into tree DATA.
@@ -3891,7 +1655,7 @@ function schemaTreeNodes(schema, opts = {}) {
 		};
 	};
 	const required = schema.required ?? [];
-	return Object.entries(schema.properties ?? {}).filter(([key]) => key !== "$schema").map(([key, child]) => build(key, child, required.includes(key), join(idPrefix, key), 0));
+	return Object.entries(schema.properties ?? {}).filter(([key]) => key !== "$schema" && key !== "configVersion").map(([key, child]) => build(key, child, required.includes(key), join(idPrefix, key), 0));
 }
 function renderAuthoring() {
 	const sections = schemaSections(jsonSchema);
@@ -5391,7 +3155,7 @@ function emitDesignMd(ctx) {
 	};
 	const roleTokens = [];
 	for (const fr of scaleRoles) for (const [token, value] of Object.entries(fr.light)) roleTokens.push([tokenClass(fr.role, token), rampRef(value)]);
-	const colorNames = new Set([...rampNames, ...roleTokens.map(([k]) => k)]);
+	const colorNames = /* @__PURE__ */ new Set([...rampNames, ...roleTokens.map(([k]) => k)]);
 	/** Recommended-name alias, emitted only when the role behind it exists. */
 	const aliasAs = (as, token) => colorNames.has(token) ? [[as, `{colors.${token}}`]] : [];
 	const interop = [
@@ -5794,10 +3558,14 @@ across every pattern. Focus rings are never removed, only restyled.
 * (provider identity is implied by which ID is set, not by an enum).
 *
 * This table is deliberately small and covers only what the schema can imply.
-* Everything else — payment processors, CRMs, mail senders — is declared by the
-* consumer in `legal.privacyPolicy.processors`, which flows through the same
-* pipeline. This is not a directory of the web; it's the set of providers the
-* toolchain itself can vouch for.
+* Everything else — payment processors, mail senders, and any CRM outside the
+* three `site.crm` knows about — is declared by the consumer in
+* `legal.privacyPolicy.processors`, which flows through the same pipeline.
+* This is not a directory of the web; it's the set of providers the toolchain
+* itself can vouch for. HubSpot, Zoho Bigin and Jobber moved into that set
+* once `site.crm` existed to make the toolchain the thing deciding whether a
+* submission reaches any of them — the same reasoning `site.ads` already
+* established for ad platforms.
 */
 /**
 * The providers the config can imply. Keyed for testability — a test can assert
@@ -5877,6 +3645,27 @@ const KNOWN_PROCESSORS = {
 		operatorCountry: "the United States",
 		privacyUrl: "https://www.netlify.com/privacy/",
 		cookies: []
+	},
+	hubspot: {
+		name: "HubSpot",
+		purpose: "CRM and marketing automation",
+		operatorCountry: "the United States",
+		privacyUrl: "https://legal.hubspot.com/privacy-policy",
+		cookies: ["hubspotutk"]
+	},
+	zohoBigin: {
+		name: "Zoho Bigin",
+		purpose: "CRM",
+		privacyUrl: "https://www.zoho.com/privacy.html",
+		cookies: []
+	},
+	jobber: {
+		name: "Jobber",
+		purpose: "CRM and field-service management",
+		operatorCountry: "Canada",
+		storage: [{ country: "the United States" }, { country: "Canada" }],
+		privacyUrl: "https://www.getjobber.com/privacy-policy/",
+		cookies: []
 	}
 };
 /** Substring → hosting provider. `deployment.platform` is a free-form string. */
@@ -5902,6 +3691,9 @@ function detectProcessorKeys(cfg) {
 	if (analytics?.clarityId) keys.push("clarity");
 	if (analytics?.matomo) keys.push(analytics.matomo.cookies ? "matomo" : "matomoCookieless");
 	if (site.security?.turnstile?.siteKey) keys.push("turnstile");
+	if (site.crm?.provider === "hubspot") keys.push("hubspot");
+	if (site.crm?.provider === "bigin") keys.push("zohoBigin");
+	if (site.crm?.provider === "jobber") keys.push("jobber");
 	const platform = site.deployment?.platform;
 	const hosting = platform && HOSTING_PATTERNS.find(([re]) => re.test(platform))?.[1];
 	if (hosting && !keys.includes(hosting)) keys.push(hosting);
@@ -5914,8 +3706,16 @@ function detectProcessorKeys(cfg) {
 * Consumer entries come last and are never deduplicated against the built-ins —
 * an explicit declaration is a statement of fact we have no grounds to drop.
 */
+/**
+* Refiners that turn a config field into a processor's actual location,
+* chained by `reduce` rather than hand-nested — adding one is an array entry,
+* not another nesting level. Each refiner checks the processor's own name and
+* passes every other processor through unchanged, so order between them
+* never matters.
+*/
+const LOCATION_REFINERS = [matomoLocation, biginLocation];
 function resolveProcessors(cfg) {
-	const detected = detectProcessorKeys(cfg).map((k) => matomoLocation(KNOWN_PROCESSORS[k], cfg.site));
+	const detected = detectProcessorKeys(cfg).map((k) => LOCATION_REFINERS.reduce((p, refine) => refine(p, cfg.site), KNOWN_PROCESSORS[k]));
 	const declared = cfg.site.legal?.privacyPolicy?.processors ?? [];
 	return [
 		...detected,
@@ -6012,6 +3812,32 @@ function matomoLocation(processor, site) {
 		storage: [{ country: "the European Union" }]
 	} : processor;
 }
+/**
+* Where the self-client's Bigin data actually rests — Zoho's own published
+* data-centre-to-country mapping, derived exactly as `matomoLocation` derives
+* Matomo Cloud's: from a config field, not a guess. `derive.ts`'s `foreign()`
+* then correctly omits a cross-border-transfer sentence when `dataCenter` is
+* `ca`, which is a real win for an Ontario client running Bigin's Canadian
+* data centre. This sets `storage`, never `operatorCountry` — see the note on
+* `zohoBigin` above for why the operator's own jurisdiction stays unset.
+*/
+const BIGIN_DATA_CENTER_COUNTRY = {
+	com: "the United States",
+	ca: "Canada",
+	eu: "the European Union",
+	in: "India",
+	"com.au": "Australia",
+	jp: "Japan"
+};
+function biginLocation(processor, site) {
+	if (processor.name !== "Zoho Bigin") return processor;
+	const dataCenter = site.crm?.bigin?.dataCenter;
+	const country = dataCenter && BIGIN_DATA_CENTER_COUNTRY[dataCenter];
+	return country ? {
+		...processor,
+		storage: [{ country }]
+	} : processor;
+}
 
 //#endregion
 //#region src/legal/derive.ts
@@ -6078,7 +3904,6 @@ function fieldPhrase(name, type) {
 		case "select":
 		case "radio":
 		case "checkbox": return "your answers to the questions we ask";
-		default: break;
 	}
 	if (/name/i.test(name)) return "your name";
 	if (/compan|organi|business/i.test(name)) return "your company or organization name";
@@ -6915,118 +4740,6 @@ function generateLegal(cfg, opts = {}) {
 	return out;
 }
 
-//#endregion
-//#region src/icons-sprite.ts
-/**
-* Build an SVG sprite from an icon `include` map.
-*
-* This is the delivery path for consumers that cannot run an icon integration:
-* Bricks/WordPress, EmDash's renderers, anything rendering HTML outside an Astro
-* build. Markup is `<svg><use href="…/icons.svg#ph--caret-down"/></svg>` — no
-* runtime JS and no network call, which is what keeps it inside the tier rules
-* (a runtime-fetching element would be behaviour JS with no fallback to enhance).
-*
-* The icon DATA comes from the `@iconify-json/*` collections, which stay optional
-* peers loaded dynamically: `@iconify-json/ph` alone is ~4.5 MB and the semantic
-* map spans five sets, so depending on them directly would be indefensible for
-* every consumer who never asks for a sprite.
-*/
-/**
-* `ph:caret-down` → `ph--caret-down`.
-*
-* The one place this grammar lives. `Icon.astro` mirrors it and `icon.test.ts`
-* guards the pair, because a drift here resolves `<use>` to nothing and renders
-* as an empty box rather than an error.
-*/
-function spriteId(qualified) {
-	return qualified.replace(":", "--");
-}
-/**
-* Default loader: the collection JSON shipped by `@iconify-json/<prefix>`.
-*
-* Resolved through a `createRequire` rooted at the consumer's directory, then
-* imported by absolute path — a bare specifier would resolve against this
-* package instead, where the collections deliberately aren't installed.
-*/
-async function loadCollection(prefix, from) {
-	try {
-		const mod = await import(pathToFileURL(createRequire(pathToFileURL(join(from, "noop.js"))).resolve(`@iconify-json/${prefix}/icons.json`)).href, { with: { type: "json" } });
-		return mod.default ?? mod;
-	} catch {
-		return null;
-	}
-}
-async function buildIconSprite(o) {
-	const from = o.resolveFrom ?? process.cwd();
-	const load = o.loadSet ?? ((prefix) => loadCollection(prefix, from));
-	const symbols = [];
-	const ids = [];
-	const missing = [];
-	/** qualified name → its rendered body+viewBox, so an alias can reuse it. */
-	const rendered = /* @__PURE__ */ new Map();
-	for (const [prefix, names] of Object.entries(o.include)) {
-		if (!names?.length) continue;
-		const set = await load(prefix);
-		if (!set) throw new Error(`[vitops icons] Cannot build the sprite: the "${prefix}" icon set is not installed. Run \`pnpm add -D @iconify-json/${prefix}\`, or drop it from your icons config.`);
-		for (const name of names) {
-			const data = getIconData(set, name);
-			if (!data) {
-				missing.push(`${prefix}:${name}`);
-				continue;
-			}
-			const built = iconToSVG(data, { height: "none" });
-			const body = replaceIDs(built.body);
-			const id = spriteId(`${prefix}:${name}`);
-			rendered.set(`${prefix}:${name}`, {
-				viewBox: built.attributes.viewBox,
-				body
-			});
-			ids.push(id);
-			symbols.push(`<symbol id="${id}" viewBox="${built.attributes.viewBox}">${body}</symbol>`);
-		}
-	}
-	for (const [alias, target] of Object.entries(o.aliases ?? {})) {
-		const hit = rendered.get(target);
-		if (!hit) {
-			missing.push(`${target} (aliased as ${alias})`);
-			continue;
-		}
-		ids.push(alias);
-		symbols.push(`<symbol id="${alias}" viewBox="${hit.viewBox}">${hit.body}</symbol>`);
-	}
-	return {
-		svg: `<svg xmlns="http://www.w3.org/2000/svg" style="display:none" aria-hidden="true">` + symbols.join("") + `</svg>\n`,
-		ids,
-		missing
-	};
-}
-/**
-* One icon's renderable parts, for inlining into markup.
-*
-* Exists because `<Icon />` cannot go through astro-icon: its `./components`
-* entry is a TypeScript file that Vite must transform, so it can only be
-* reached by a statically-analysable import — and a static import is exactly
-* what made the optional peer mandatory for anyone rendering Popover, Details
-* or Drawer. Reading the collection directly sidesteps the peer entirely and
-* shares this file's loader with the sprite, so both paths draw the same glyph.
-*/
-async function loadIconSvg(qualified, opts) {
-	const i = qualified.indexOf(":");
-	if (i <= 0) return null;
-	const prefix = qualified.slice(0, i);
-	const name = qualified.slice(i + 1);
-	const from = opts?.resolveFrom ?? process.cwd();
-	const set = await (opts?.loadSet ?? ((p) => loadCollection(p, from)))(prefix);
-	if (!set) return null;
-	const data = getIconData(set, name);
-	if (!data) return null;
-	const built = iconToSVG(data, { height: "none" });
-	return {
-		viewBox: built.attributes.viewBox,
-		body: replaceIDs(built.body)
-	};
-}
-
 //#endregion
 //#region src/generate.ts
 /**
@@ -7042,7 +4755,8 @@ async function loadIconSvg(qualified, opts) {
 * and the pre-built JS bundles) live under `assets/` in this package and are read /
 * copied from there — they are the same for every consumer.
 */
-const DEFAULT_ASSETS = join(dirname(fileURLToPath(import.meta.url)), "..", "assets");
+const HERE = dirname(fileURLToPath(import.meta.url));
+const DEFAULT_ASSETS = join(HERE, "..", "assets");
 const UTILITY_PROPS = {
 	bg: "background-color",
 	text: "color",
@@ -7180,18 +4894,6 @@ const buildScale = (s) => {
 		};
 	});
 };
-const TYPO_KEYMAP = {
-	family: ["font-family", "ff"],
-	size: ["font-size", "fs"],
-	weight: ["font-weight", "fw"],
-	style: ["font-style", "fst"],
-	"line-height": ["line-height", "lh"],
-	tracking: ["letter-spacing", "ls"],
-	"text-decoration": ["text-decoration", "td"],
-	"text-transform": ["text-transform", "tt"],
-	"text-wrap": ["text-wrap", "tw"],
-	color: ["color", "color"]
-};
 /**
 * Wrong spellings worth naming explicitly, because each is a plausible reading of
 * the key it isn't. `transform`/`decoration` were documented in the schema for a
@@ -7292,7 +4994,7 @@ function build(ds, format, assetsDir, buildOpts = {}) {
 	* `TW_CLASH` names.
 	*/
 	const NON_PALETTE_BG = "/* Undo a pattern's fill (Tailwind provides these natively in that format). */\n.bg-transparent { background-color: transparent; }\n.bg-inherit { background-color: inherit; }\n";
-	if (BRICKS) generated["color.css"] = "/* Colours provided by Bricks (palette import generates tokens + utilities). */\n/* Undo a pattern's fill (Tailwind provides these natively in that format). */\n.bg-transparent { background-color: transparent; }\n.bg-inherit { background-color: inherit; }\n";
+	if (BRICKS) generated["color.css"] = "/* Colours provided by Bricks (palette import generates tokens + utilities). */\n" + NON_PALETTE_BG;
 	else {
 		let css = `/* GENERATED from design-system.json — do not edit by hand. */\n:root {\n`;
 		css += `  color-scheme: light;\n`;
@@ -7856,6 +5558,8 @@ function emitTailwind(ctx) {
 	]) util.push(`@utility ${track} {\n  grid-column: ${track};\n}`);
 	util.push(`\n/* Auto-fit grid — column count is content-driven, unlike .split */`);
 	util.push("@utility grid-auto {\n  display: grid;\n  gap: var(--grid-gap, 1rem);\n  grid-template-columns: repeat(auto-fit, minmax(var(--grid-min, 13rem), 1fr));\n  &:is(ul, ol) > li + li { margin-block-start: 0; }\n}");
+	util.push(`\n/* Opt out of ambient .rhythm item spacing (mirrors layout-utilities.css) */`);
+	util.push(`@utility no-rhythm {\n  & > li + li { margin-top: 0; }\n}`);
 	util.push(`\n/* Vertical-rhythm overrides (mirrors layout.css) */`);
 	for (const pair of [
 		"h-p",
@@ -8074,7 +5778,8 @@ body {
 		return kept.join("\n\n");
 	};
 	const componentCss = componentPartialOrder(cssDir).map((rel) => {
-		return `/* ── ${rel} ── */\n${stripForTailwind(readFileSync(join(cssDir, rel), "utf8"))}`;
+		const css = readFileSync(join(cssDir, rel), "utf8");
+		return `/* ── ${rel} ── */\n${stripForTailwind(css)}`;
 	}).join("\n\n");
 	if (componentCss) parts.push(`/* ── Component + structural partials (Tailwind-clashing utilities dropped) ── */\n/* Dropped ${droppedVariantBlocks} pre-expanded breakpoint block(s) — write @sm:/@md:/@lg:/@xl: instead.\n   Dropped ${droppedClashes.size} clashing utilit(ies) Tailwind provides itself:\n   ${[...droppedClashes].sort().join(" ") || "(none)"} */\n@layer components {\n${componentCss}\n}`);
 	return nl(parts) + "\n";
@@ -8112,8 +5817,8 @@ body {
 * prelude is `table,\n.table`, which doesn't start with `.`, so the regex missed
 * it by luck. Listing it makes that explicit rather than accidental.
 */
-const CLASH_KEEP = new Set(["sticky", "table"]);
-const TAILWIND_SKIP = new Set([
+const CLASH_KEEP = /* @__PURE__ */ new Set(["sticky", "table"]);
+const TAILWIND_SKIP = /* @__PURE__ */ new Set([
 	"global.css",
 	"animation.css",
 	"layout.css",
@@ -8219,7 +5924,8 @@ const layerForPartial = (rel) => CHUNK_LAYER[rel] ?? "vitops.components";
 */
 function bundleCss(generated, assetsDir, minify) {
 	const cssDir = join(assetsDir, "css");
-	const index = readFileSync(join(cssDir, "index.css"), "utf8");
+	const indexPath = join(cssDir, "index.css");
+	const index = readFileSync(indexPath, "utf8");
 	const chunks = [];
 	for (const line of index.split("\n")) {
 		const m = /@import\s+['"]\.\/([^'"]+)['"]/.exec(line);
@@ -8253,7 +5959,8 @@ function bundleCss(generated, assetsDir, minify) {
 * is wrong *here*" when the file is a few hundred lines of company facts.
 */
 function loadInput(input, opts) {
-	const resolved = resolveInput(typeof input === "string" ? JSON.parse(readFileSync(input, "utf8")) : input, opts);
+	const raw = typeof input === "string" ? JSON.parse(readFileSync(input, "utf8")) : input;
+	const resolved = resolveInput(raw, opts);
 	const result = validate(resolved.designSystem);
 	if (!result.ok) {
 		const where = resolved.theme != null ? `design system at designSystem.themes.${resolved.theme}` : "design-system.json";
@@ -8346,7 +6053,8 @@ async function generate(options) {
 	};
 }
 function loadConfigFile(input, siteEnv) {
-	return resolveConfig(typeof input === "string" ? JSON.parse(readFileSync(input, "utf8")) : input, siteEnv);
+	const raw = typeof input === "string" ? JSON.parse(readFileSync(input, "utf8")) : input;
+	return resolveConfig(raw, siteEnv);
 }
 
 //#endregion
@@ -8700,6 +6408,7 @@ function defaultSiteConfig(opts) {
 	const url = opts?.url ?? "https://example.com";
 	return {
 		$schema: CONFIG_SCHEMA_LOCAL_PATH,
+		configVersion: 1,
 		designSystem: {
 			themes: { default: defaultConfig() },
 			defaultColorScheme: "light"
@@ -8720,5 +6429,5 @@ function defaultSiteConfig(opts) {
 }
 
 //#endregion
-export { AD_PROVIDERS, BASE_HOOK, CONFIG_SCHEMA_LOCAL_PATH, CONFIG_SCHEMA_URL, CONTRAST, ConfigSchema, DARK_SEL, DOC_ORDER, DOC_SLUGS, DesignSystemSchema, JURISDICTIONS, JURISDICTION_COUNTRIES, KNOWN_PROCESSORS, NUMERIC_STEPS, REQUIRED_ROLES, ROLE_TOKEN_KEYS, SCHEMA_LOCAL_PATH, SCHEMA_URL, SiteFontSchema, TEMPLATES, TIERS, TIER_NAMES, TW_CLASH, buildIconSprite, configJsonSchema, deepMerge, defaultConfig, defaultSiteConfig, derivePolicyVars, detectProcessorKeys, enabledDocs, expandPalette, functionalRole, generate, generateDocs, generateLegal, isConfig, jsonSchema, loadIconSvg, movedTokens, parseMarkdown, processorsMissingLocation, renderInlineMarkdown, renderMarkdown, renderNodes, renderRobotsTxt, resolveConfig, resolveInput, resolvePrivacyContact, resolveProcessors, resolveTheme, roleColorUtilities, roleHue, roleKind, schemaTreeNodes, spriteId, stripNulls, tierPatterns, tierTags, toContentNodes, toHtmlFragment, toPortableText, tokenClass, tokenVar, validate, validateConfig };
+export { AD_PROVIDERS, BASE_HOOK, BIGIN_DATA_CENTERS, CONFIG_SCHEMA_LOCAL_PATH, CONFIG_SCHEMA_URL, CONFIG_VERSION, CONTRAST, CRM_PROVIDERS, ConfigSchema, DARK_SEL, DOC_ORDER, DOC_SLUGS, DesignSystemSchema, JURISDICTIONS, JURISDICTION_COUNTRIES, KNOWN_PROCESSORS, NUMERIC_STEPS, PLAN_CAPABILITIES, REQUIRED_ROLES, ROLE_TOKEN_KEYS, SCHEMA_LOCAL_PATH, SCHEMA_URL, SiteFontSchema, TEMPLATES, TIERS, TIER_NAMES, TW_CLASH, TYPO_KEYMAP, buildIconSprite, buildReverseIndex, checkContrast, configJsonSchema, deepMerge, defaultConfig, defaultSiteConfig, derivePolicyVars, designSystemPath, detectProcessorKeys, enabledDocs, expandPalette, experimentDimensionWarnings, formatConfig, functionalRole, generate, generateDocs, generateLegal, getAt, isConfig, jsonSchema, loadIconSvg, mergePatch, movedTokens, parseMarkdown, patchToOverrideCss, processorsMissingLocation, renderInlineMarkdown, renderMarkdown, renderNodes, renderRobotsTxt, resolveConfig, resolveInput, resolvePrivacyContact, resolveProcessors, resolveTheme, roleColorUtilities, roleHue, roleKind, schemaTreeNodes, setAt, spriteId, stripNulls, tierPatterns, tierTags, toContentNodes, toHtmlFragment, toPortableText, tokenClass, tokenVar, validate, validateColorContract, validateConfig };
 //# sourceMappingURL=index.mjs.map