@kywi-software/core 0.13.0 → 0.15.0

package/dist/audiences/engine.js

@@ -17,7 +17,10 @@ function mergeSignals(base, partial) {
 export function createAudienceEngine(config) {
     return {
         async evaluate(context) {
-            const serverSignals = runServerCollectors(context.request);
+            // Built conditionally: under `exactOptionalPropertyTypes` an explicit
+            // `undefined` is not the same as an absent key.
+            const gate = config.requireConsent === undefined ? {} : { requireConsent: config.requireConsent };
+            const serverSignals = runServerCollectors(context.request, gate);
             let signals = mergeSignals(createEmptySignals(), serverSignals);
             if (context.partialSignals) {
                 signals = mergeSignals(signals, context.partialSignals);
@@ -29,7 +32,8 @@ export function createAudienceEngine(config) {
             // (behavioral / self-ID) into the server render. Opt-out still wins below,
             // and `allMatchedIds` stays signal-derived (the pin overrides the winner,
             // not the set of audiences the current signals matched).
-            const pinnedAudienceId = collectPinnedAudience(parseCookies(context.request.headers.get('cookie') ?? ''), config.audiences);
+            const cookieHeader = context.request.headers.get('cookie');
+            const pinnedAudienceId = collectPinnedAudience(parseCookies(cookieHeader ?? ''), config.audiences, { ...gate, cookieHeader });
             const resolvedWinner = pinnedAudienceId ?? winningAudienceId;
             return {
                 winningAudienceId: isOptedOut ? null : resolvedWinner,

package/dist/audiences/engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/audiences/engine.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAK3C,SAAS,YAAY,CAAC,IAAoB,EAAE,OAAgC;IAC1E,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;QAC3C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU;QACjD,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE;QAC7C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;QAC3C,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE;QACnD,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE;KACxC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAA4B;IAC/D,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,OAAuB;YACpC,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YAC1D,IAAI,OAAO,GAAG,YAAY,CAAC,kBAAkB,EAAE,EAAE,aAAa,CAAC,CAAA;YAC/D,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC3B,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;YACzD,CAAC;YACD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAA;YAC1C,MAAM,EAAE,iBAAiB,EAAE,aAAa,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;YACxF,yEAAyE;YACzE,oEAAoE;YACpE,2EAA2E;YAC3E,0EAA0E;YAC1E,yDAAyD;YACzD,MAAM,gBAAgB,GAAG,qBAAqB,CAC5C,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EACzD,MAAM,CAAC,SAAS,CACjB,CAAA;YACD,MAAM,cAAc,GAAG,gBAAgB,IAAI,iBAAiB,CAAA;YAC5D,OAAO;gBACL,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc;gBACrD,aAAa;gBACb,OAAO;gBACP,UAAU;aACX,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/audiences/engine.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAc3C,SAAS,YAAY,CAAC,IAAoB,EAAE,OAAgC;IAC1E,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;QAC3C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU;QACjD,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE;QAC7C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;QAC3C,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE;QACnD,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE;KACxC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAA4B;IAC/D,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,OAAuB;YACpC,sEAAsE;YACtE,gDAAgD;YAChD,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAA;YACjG,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAChE,IAAI,OAAO,GAAG,YAAY,CAAC,kBAAkB,EAAE,EAAE,aAAa,CAAC,CAAA;YAC/D,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC3B,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;YACzD,CAAC;YACD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAA;YAC1C,MAAM,EAAE,iBAAiB,EAAE,aAAa,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;YACxF,yEAAyE;YACzE,oEAAoE;YACpE,2EAA2E;YAC3E,0EAA0E;YAC1E,yDAAyD;YACzD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC1D,MAAM,gBAAgB,GAAG,qBAAqB,CAC5C,YAAY,CAAC,YAAY,IAAI,EAAE,CAAC,EAChC,MAAM,CAAC,SAAS,EAChB,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,CAC1B,CAAA;YACD,MAAM,cAAc,GAAG,gBAAgB,IAAI,iBAAiB,CAAA;YAC5D,OAAO;gBACL,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc;gBACrD,aAAa;gBACb,OAAO;gBACP,UAAU;aACX,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/audiences/index.d.ts

@@ -1,6 +1,9 @@
 export * from './types.js';
 export * from './schema.js';
 export * from './cookies.js';
+export * from './consent.js';
+export { personalizationRequiresConsent } from './consent-config.js';
+export { REQUIRE_CONSENT_ENV, requireConsentFromEnv, assertConsentEnvAgreement, createConsentBannerCheck, } from './consent-startup.js';
 export { utmCookieValue, UTM_COOKIE } from './utm-persistence.js';
 export * from './engine.js';
 export * from './hmac.js';

package/dist/audiences/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audiences/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAI5B,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjE,cAAc,aAAa,CAAA;AAC3B,cAAc,WAAW,CAAA;AACzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACzH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,KAAK,aAAa,EAAE,KAAK,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACxI,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAC1I,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AACzE,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAC1F,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,KAAK,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACxG,OAAO,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,KAAK,4BAA4B,EAAE,MAAM,cAAc,CAAA;AACnH,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAC3H,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACtE,OAAO,EAAE,uBAAuB,EAAE,KAAK,wBAAwB,EAAE,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audiences/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAI5B,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AAI7B,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjE,cAAc,aAAa,CAAA;AAC3B,cAAc,WAAW,CAAA;AACzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACzH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,KAAK,aAAa,EAAE,KAAK,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACxI,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAC1I,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AACzE,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAC1F,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,KAAK,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACxG,OAAO,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,KAAK,4BAA4B,EAAE,MAAM,cAAc,CAAA;AACnH,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAC3H,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACtE,OAAO,EAAE,uBAAuB,EAAE,KAAK,wBAAwB,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/audiences/index.js

@@ -1,6 +1,12 @@
 export * from './types.js';
 export * from './schema.js';
 export * from './cookies.js';
+// The cookie-consent category map + gate (kywi-cms#91). Also published as a
+// dependency-free leaf entry (`@kywi-software/core/audiences/consent`) so edge
+// middleware can gate its own cookie writes without pulling in this barrel.
+export * from './consent.js';
+export { personalizationRequiresConsent } from './consent-config.js';
+export { REQUIRE_CONSENT_ENV, requireConsentFromEnv, assertConsentEnvAgreement, createConsentBannerCheck, } from './consent-startup.js';
 // Writer for the kywi_utm cookie collectUtm reads. Also published as a
 // dependency-free leaf entry (`@kywi-software/core/audiences/utm-persistence`)
 // for edge middleware that must not pull in this DB-backed barrel.

package/dist/audiences/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audiences/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,uEAAuE;AACvE,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjE,cAAc,aAAa,CAAA;AAC3B,cAAc,WAAW,CAAA;AACzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,gBAAgB,EAAiE,MAAM,yBAAyB,CAAA;AACzH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,eAAe,EAAsE,MAAM,qBAAqB,CAAA;AACxI,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,gBAAgB,EAA2C,MAAM,oBAAoB,CAAA;AAC1I,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AACzE,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAC1F,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAA8B,MAAM,gBAAgB,CAAA;AACxG,OAAO,EAAE,2BAA2B,EAAE,oBAAoB,EAAqC,MAAM,cAAc,CAAA;AACnH,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAA4B,MAAM,cAAc,CAAA;AAC3H,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACtE,OAAO,EAAE,uBAAuB,EAAiC,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audiences/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,4EAA4E;AAC5E,+EAA+E;AAC/E,4EAA4E;AAC5E,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AAC7B,uEAAuE;AACvE,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjE,cAAc,aAAa,CAAA;AAC3B,cAAc,WAAW,CAAA;AACzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,gBAAgB,EAAiE,MAAM,yBAAyB,CAAA;AACzH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,eAAe,EAAsE,MAAM,qBAAqB,CAAA;AACxI,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,gBAAgB,EAA2C,MAAM,oBAAoB,CAAA;AAC1I,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AACzE,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAC1F,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAA8B,MAAM,gBAAgB,CAAA;AACxG,OAAO,EAAE,2BAA2B,EAAE,oBAAoB,EAAqC,MAAM,cAAc,CAAA;AACnH,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAA4B,MAAM,cAAc,CAAA;AAC3H,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACtE,OAAO,EAAE,uBAAuB,EAAiC,MAAM,kBAAkB,CAAA"}

package/dist/audiences/server-eval.d.ts

@@ -1,4 +1,5 @@
 import type { KywiDb } from '../db/client.js';
+import type { ConsentGateOptions } from './consent.js';
 import type { Audience, AudienceResult } from './types.js';
 /**
  * The result of evaluating a site's *active* audiences against one request.
@@ -24,6 +25,17 @@ export interface ServerAudienceEvaluation {
  *
  * This is the single server seam the public rendering path calls, so audience
  * evaluation happens exactly once per page render.
+ *
+ * `opts.requireConsent` is `theme.personalization.requireConsent` (kywi-cms#91),
+ * and it MUST be passed by any host whose theme might set it — omitted, the gate
+ * defaults on, which is right for a site relying on Kywi's own banner and wrong
+ * for one that turned the gate off. This seam used to drop the flag entirely, so
+ * an external-CMP site had its server collectors ignoring `kywi_utm`,
+ * `kywi_visitor`, `kywi_known` and `kywi_audience` while the middleware and the
+ * runtime routes read them: personalization that worked on the client and
+ * reverted on the next server render. `kywi_optout` is `essential` and is
+ * unaffected either way — turning the consent gate off never turns off a
+ * visitor's suppression preference.
  */
-export declare function evaluateActiveAudiences(db: KywiDb, siteId: string, request: Request): Promise<ServerAudienceEvaluation>;
+export declare function evaluateActiveAudiences(db: KywiDb, siteId: string, request: Request, opts?: ConsentGateOptions): Promise<ServerAudienceEvaluation>;
 //# sourceMappingURL=server-eval.d.ts.map

package/dist/audiences/server-eval.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-eval.d.ts","sourceRoot":"","sources":["../../src/audiences/server-eval.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAG7C,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE1D;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,cAAc,CAAA;IACtB,8DAA8D;IAC9D,SAAS,EAAE,QAAQ,EAAE,CAAA;IACrB,qEAAqE;IACrE,eAAe,EAAE,QAAQ,GAAG,IAAI,CAAA;CACjC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,wBAAwB,CAAC,CAOnC"}
+{"version":3,"file":"server-eval.d.ts","sourceRoot":"","sources":["../../src/audiences/server-eval.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAG7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE1D;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,cAAc,CAAA;IACtB,8DAA8D;IAC9D,SAAS,EAAE,QAAQ,EAAE,CAAA;IACrB,qEAAqE;IACrE,eAAe,EAAE,QAAQ,GAAG,IAAI,CAAA;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,wBAAwB,CAAC,CAanC"}

package/dist/audiences/server-eval.js

@@ -11,10 +11,26 @@ import { createAudienceEngine } from './engine.js';
  *
  * This is the single server seam the public rendering path calls, so audience
  * evaluation happens exactly once per page render.
+ *
+ * `opts.requireConsent` is `theme.personalization.requireConsent` (kywi-cms#91),
+ * and it MUST be passed by any host whose theme might set it — omitted, the gate
+ * defaults on, which is right for a site relying on Kywi's own banner and wrong
+ * for one that turned the gate off. This seam used to drop the flag entirely, so
+ * an external-CMP site had its server collectors ignoring `kywi_utm`,
+ * `kywi_visitor`, `kywi_known` and `kywi_audience` while the middleware and the
+ * runtime routes read them: personalization that worked on the client and
+ * reverted on the next server render. `kywi_optout` is `essential` and is
+ * unaffected either way — turning the consent gate off never turns off a
+ * visitor's suppression preference.
  */
-export async function evaluateActiveAudiences(db, siteId, request) {
+export async function evaluateActiveAudiences(db, siteId, request, opts = {}) {
     const audiences = await getActiveAudiences(db, siteId);
-    const result = await createAudienceEngine({ audiences }).evaluate({ request });
+    // Built conditionally: under `exactOptionalPropertyTypes` an explicit
+    // `undefined` is not the same as an absent key.
+    const engineConfig = opts.requireConsent === undefined
+        ? { audiences }
+        : { audiences, requireConsent: opts.requireConsent };
+    const result = await createAudienceEngine(engineConfig).evaluate({ request });
     const winningAudience = result.winningAudienceId
         ? (audiences.find((a) => a.id === result.winningAudienceId) ?? null)
         : null;

package/dist/audiences/server-eval.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-eval.js","sourceRoot":"","sources":["../../src/audiences/server-eval.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAiBlD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,EAAU,EACV,MAAc,EACd,OAAgB;IAEhB,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IACtD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAC9E,MAAM,eAAe,GAAG,MAAM,CAAC,iBAAiB;QAC9C,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;QACpE,CAAC,CAAC,IAAI,CAAA;IACR,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,CAAA;AAC/C,CAAC"}
+{"version":3,"file":"server-eval.js","sourceRoot":"","sources":["../../src/audiences/server-eval.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAkBlD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,EAAU,EACV,MAAc,EACd,OAAgB,EAChB,OAA2B,EAAE;IAE7B,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IACtD,sEAAsE;IACtE,gDAAgD;IAChD,MAAM,YAAY,GAChB,IAAI,CAAC,cAAc,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,SAAS,EAAE;QACf,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAA;IACxD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAC7E,MAAM,eAAe,GAAG,MAAM,CAAC,iBAAiB;QAC9C,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;QACpE,CAAC,CAAC,IAAI,CAAA;IACR,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,CAAA;AAC/C,CAAC"}

package/dist/audiences/ssr.d.ts

@@ -1,4 +1,21 @@
+import { type ConsentGateOptions } from './consent.js';
 import type { VisitorSignals } from './types.js';
 export declare function readSignalsFromRequest(cookieHeader: string | null, secret: string): Promise<VisitorSignals | null>;
-export declare function writeSignalsToResponse(signals: VisitorSignals, secret: string): Promise<string>;
+/**
+ * Build the `Set-Cookie` header that persists this request's resolved signals,
+ * or `null` when the visitor has not consented to personalization.
+ *
+ * `kywi_signals` is a `personalization` cookie (`audiences/consent.ts` owns the
+ * category map), so the caller must hand over the request's `Cookie` header for
+ * the gate to read the decision from — kywi-cms#91. Omitting it fails closed,
+ * as does an undecided visitor: nothing breaks, the request still resolves its
+ * audiences and renders, the resolution simply is not carried to the next one,
+ * so the visitor keeps getting the default content until they accept.
+ *
+ * Pass `requireConsent: false` (from `theme.personalization.requireConsent`) to
+ * turn the gate off for a site whose consent lives in external tooling.
+ */
+export declare function writeSignalsToResponse(signals: VisitorSignals, secret: string, options?: {
+    cookieHeader?: string | null;
+} & ConsentGateOptions): Promise<string | null>;
 //# sourceMappingURL=ssr.d.ts.map

package/dist/audiences/ssr.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr.d.ts","sourceRoot":"","sources":["../../src/audiences/ssr.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAOhC;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAGjB"}
+{"version":3,"file":"ssr.d.ts","sourceRoot":"","sources":["../../src/audiences/ssr.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAOhC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,kBAAuB,GAClE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIxB"}

package/dist/audiences/ssr.js

@@ -1,4 +1,5 @@
 import { signSignals, verifySignals, parseCookies, buildSetCookieHeader, COOKIE_NAMES, COOKIE_MAX_AGE } from './cookies.js';
+import { cookieAllowedByHeader } from './consent.js';
 export async function readSignalsFromRequest(cookieHeader, secret) {
     if (!cookieHeader)
         return null;
@@ -9,7 +10,23 @@ export async function readSignalsFromRequest(cookieHeader, secret) {
     const payload = await verifySignals(token, secret);
     return payload;
 }
-export async function writeSignalsToResponse(signals, secret) {
+/**
+ * Build the `Set-Cookie` header that persists this request's resolved signals,
+ * or `null` when the visitor has not consented to personalization.
+ *
+ * `kywi_signals` is a `personalization` cookie (`audiences/consent.ts` owns the
+ * category map), so the caller must hand over the request's `Cookie` header for
+ * the gate to read the decision from — kywi-cms#91. Omitting it fails closed,
+ * as does an undecided visitor: nothing breaks, the request still resolves its
+ * audiences and renders, the resolution simply is not carried to the next one,
+ * so the visitor keeps getting the default content until they accept.
+ *
+ * Pass `requireConsent: false` (from `theme.personalization.requireConsent`) to
+ * turn the gate off for a site whose consent lives in external tooling.
+ */
+export async function writeSignalsToResponse(signals, secret, options = {}) {
+    if (!cookieAllowedByHeader(COOKIE_NAMES.SIGNALS, options.cookieHeader, options))
+        return null;
     const token = await signSignals(signals, secret);
     return buildSetCookieHeader(COOKIE_NAMES.SIGNALS, token, COOKIE_MAX_AGE.SIGNALS);
 }

package/dist/audiences/ssr.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssr.js","sourceRoot":"","sources":["../../src/audiences/ssr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,oBAAoB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAG3H,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,YAA2B,EAC3B,MAAc;IAEd,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAA;IAC9B,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IAClD,OAAO,OAAgC,CAAA;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAuB,EACvB,MAAc;IAEd,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAChD,OAAO,oBAAoB,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,CAAA;AAClF,CAAC"}
+{"version":3,"file":"ssr.js","sourceRoot":"","sources":["../../src/audiences/ssr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,oBAAoB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC3H,OAAO,EAAE,qBAAqB,EAA2B,MAAM,cAAc,CAAA;AAG7E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,YAA2B,EAC3B,MAAc;IAEd,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAA;IAC9B,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IAClD,OAAO,OAAgC,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAuB,EACvB,MAAc,EACd,UAAiE,EAAE;IAEnE,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5F,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAChD,OAAO,oBAAoB,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,CAAA;AAClF,CAAC"}

package/dist/audiences/utm-persistence.d.ts

@@ -20,13 +20,14 @@
  * leaves any existing cookie untouched — ordinary navigation never clobbers a
  * persisted campaign.
  *
- * EDGE-SAFE LEAF MODULE: this file has NO imports (and therefore no transitive
- * DB dependency), because it is imported from Next.js edge middleware — where
- * core's DB-backed code (drizzle/postgres) cannot run. Keep it dependency-free.
- * It is published as its own export entry (`@kywi-software/core/audiences/
- * utm-persistence`) so importing it never drags in the DB-backed `audiences`
- * barrel.
+ * EDGE-SAFE LEAF MODULE: this file's only import is `./consent.js`, which is
+ * itself a zero-import leaf, because it is imported from Next.js edge
+ * middleware — where core's DB-backed code (drizzle/postgres) cannot run. Keep
+ * it dependency-free beyond that. It is published as its own export entry
+ * (`@kywi-software/core/audiences/utm-persistence`) so importing it never drags
+ * in the DB-backed `audiences` barrel.
  */
+import { type ConsentGateOptions } from './consent.js';
 /**
  * Cookie name `collectUtm` reads (mirrors `COOKIE_NAMES.UTM` in
  * `audiences/cookies.ts`). Kept as a literal here so this leaf module imports
@@ -41,6 +42,18 @@ export declare const UTM_COOKIE = "kywi_utm";
  * The JSON shape mirrors what `collectUtm` parses: `{ source, medium, campaign,
  * term, content }` with only the present keys. Empty `utm_*` values are treated
  * as absent, and a malformed URL yields `null`.
+ *
+ * Also `null` when the visitor has not consented to personalization
+ * (kywi-cms#91): `kywi_utm` is a `personalization` cookie in the category map
+ * `./consent.js` owns. Pass the request's `Cookie` header so the gate can read
+ * the decision; omitting it fails closed, as does an undecided visitor. The
+ * campaign then simply does not survive the visitor's next navigation — the
+ * landing request itself still matches on its own `utm_*` params, so a campaign
+ * page still renders its campaign content. Pass `requireConsent: false` (from
+ * `theme.personalization.requireConsent`) to turn the gate off for a site whose
+ * consent lives in external tooling.
  */
-export declare function utmCookieValue(url: string): string | null;
+export declare function utmCookieValue(url: string, options?: {
+    cookieHeader?: string | null;
+} & ConsentGateOptions): string | null;
 //# sourceMappingURL=utm-persistence.d.ts.map

package/dist/audiences/utm-persistence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utm-persistence.d.ts","sourceRoot":"","sources":["../../src/audiences/utm-persistence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,aAAa,CAAA;AAUpC;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAazD"}
+{"version":3,"file":"utm-persistence.d.ts","sourceRoot":"","sources":["../../src/audiences/utm-persistence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAyB,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,aAAa,CAAA;AAUpC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,kBAAuB,GAClE,MAAM,GAAG,IAAI,CAcf"}

package/dist/audiences/utm-persistence.js

@@ -20,13 +20,14 @@
  * leaves any existing cookie untouched — ordinary navigation never clobbers a
  * persisted campaign.
  *
- * EDGE-SAFE LEAF MODULE: this file has NO imports (and therefore no transitive
- * DB dependency), because it is imported from Next.js edge middleware — where
- * core's DB-backed code (drizzle/postgres) cannot run. Keep it dependency-free.
- * It is published as its own export entry (`@kywi-software/core/audiences/
- * utm-persistence`) so importing it never drags in the DB-backed `audiences`
- * barrel.
+ * EDGE-SAFE LEAF MODULE: this file's only import is `./consent.js`, which is
+ * itself a zero-import leaf, because it is imported from Next.js edge
+ * middleware — where core's DB-backed code (drizzle/postgres) cannot run. Keep
+ * it dependency-free beyond that. It is published as its own export entry
+ * (`@kywi-software/core/audiences/utm-persistence`) so importing it never drags
+ * in the DB-backed `audiences` barrel.
  */
+import { cookieAllowedByHeader } from './consent.js';
 /**
  * Cookie name `collectUtm` reads (mirrors `COOKIE_NAMES.UTM` in
  * `audiences/cookies.ts`). Kept as a literal here so this leaf module imports
@@ -48,8 +49,20 @@ const UTM_KEYS = [
  * The JSON shape mirrors what `collectUtm` parses: `{ source, medium, campaign,
  * term, content }` with only the present keys. Empty `utm_*` values are treated
  * as absent, and a malformed URL yields `null`.
+ *
+ * Also `null` when the visitor has not consented to personalization
+ * (kywi-cms#91): `kywi_utm` is a `personalization` cookie in the category map
+ * `./consent.js` owns. Pass the request's `Cookie` header so the gate can read
+ * the decision; omitting it fails closed, as does an undecided visitor. The
+ * campaign then simply does not survive the visitor's next navigation — the
+ * landing request itself still matches on its own `utm_*` params, so a campaign
+ * page still renders its campaign content. Pass `requireConsent: false` (from
+ * `theme.personalization.requireConsent`) to turn the gate off for a site whose
+ * consent lives in external tooling.
  */
-export function utmCookieValue(url) {
+export function utmCookieValue(url, options = {}) {
+    if (!cookieAllowedByHeader(UTM_COOKIE, options.cookieHeader, options))
+        return null;
     let params;
     try {
         params = new URL(url).searchParams;

package/dist/audiences/utm-persistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"utm-persistence.js","sourceRoot":"","sources":["../../src/audiences/utm-persistence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,UAAU,CAAA;AAEpC,MAAM,QAAQ,GAAG;IACf,CAAC,YAAY,EAAE,QAAQ,CAAC;IACxB,CAAC,YAAY,EAAE,QAAQ,CAAC;IACxB,CAAC,cAAc,EAAE,UAAU,CAAC;IAC5B,CAAC,UAAU,EAAE,MAAM,CAAC;IACpB,CAAC,aAAa,EAAE,SAAS,CAAC;CAClB,CAAA;AAEV;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,MAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACtD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACjE,CAAC"}
+{"version":3,"file":"utm-persistence.js","sourceRoot":"","sources":["../../src/audiences/utm-persistence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,qBAAqB,EAA2B,MAAM,cAAc,CAAA;AAE7E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,UAAU,CAAA;AAEpC,MAAM,QAAQ,GAAG;IACf,CAAC,YAAY,EAAE,QAAQ,CAAC;IACxB,CAAC,YAAY,EAAE,QAAQ,CAAC;IACxB,CAAC,cAAc,EAAE,UAAU,CAAC;IAC5B,CAAC,UAAU,EAAE,MAAM,CAAC;IACpB,CAAC,aAAa,EAAE,SAAS,CAAC;CAClB,CAAA;AAEV;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,UAAiE,EAAE;IAEnE,IAAI,CAAC,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IAClF,IAAI,MAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACtD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACjE,CAAC"}

package/dist/auth/roles.d.ts

@@ -2,6 +2,17 @@ export declare const KYWI_ROLES: readonly ["superAdmin", "siteAdmin", "editor",
 export type KywiRole = (typeof KYWI_ROLES)[number];
 export type ContentAction = 'read' | 'write' | 'publish' | 'delete';
 export declare function hasMinRole(userRole: string, requiredRole: string): boolean;
+/**
+ * True when `callerRole` sits STRICTLY ABOVE `targetRole` in the ladder — the
+ * strict counterpart of {@link hasMinRole}, which is inclusive of equal rank.
+ *
+ * The two express different rails (kywi-cms#175). Forcing a password reset on a
+ * peer is a temporary, self-serviceable nudge, so `hasMinRole` (equal-or-lower)
+ * is the right gate; SETTING a peer's password is a lateral account takeover,
+ * so that one needs this strict form. Unknown roles fall to level 0 on both
+ * sides, which fails closed here (0 > 0 is false).
+ */
+export declare function outranks(callerRole: string, targetRole: string): boolean;
 export declare function canAccessContent(role: string, action: ContentAction): boolean;
 /**
  * API-key scope → the MAXIMUM role that scope grants. A key's scopes act as a

package/dist/auth/roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,UAAU,4EAA6E,CAAA;AACpG,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAA;AAClD,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAA;AAkBnE,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAE7E;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAM1D,CAAA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAc/E"}
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,UAAU,4EAA6E,CAAA;AACpG,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAA;AAClD,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAA;AAkBnE,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAE7E;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAM1D,CAAA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAc/E"}

package/dist/auth/roles.js

@@ -16,6 +16,19 @@ const ACTION_MIN_ROLE = {
 export function hasMinRole(userRole, requiredRole) {
     return (ROLE_LEVEL[userRole] ?? 0) >= (ROLE_LEVEL[requiredRole] ?? 0);
 }
+/**
+ * True when `callerRole` sits STRICTLY ABOVE `targetRole` in the ladder — the
+ * strict counterpart of {@link hasMinRole}, which is inclusive of equal rank.
+ *
+ * The two express different rails (kywi-cms#175). Forcing a password reset on a
+ * peer is a temporary, self-serviceable nudge, so `hasMinRole` (equal-or-lower)
+ * is the right gate; SETTING a peer's password is a lateral account takeover,
+ * so that one needs this strict form. Unknown roles fall to level 0 on both
+ * sides, which fails closed here (0 > 0 is false).
+ */
+export function outranks(callerRole, targetRole) {
+    return (ROLE_LEVEL[callerRole] ?? 0) > (ROLE_LEVEL[targetRole] ?? 0);
+}
 export function canAccessContent(role, action) {
     return hasMinRole(role, ACTION_MIN_ROLE[action]);
 }

package/dist/auth/roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAA;AAIpG,MAAM,UAAU,GAA2B;IACzC,UAAU,EAAE,GAAG;IACf,SAAS,EAAE,EAAE;IACb,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,IAAI,EAAE,CAAC;CACR,CAAA;AAED,MAAM,eAAe,GAAkC;IACrD,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,QAAQ;IACjB,MAAM,EAAE,WAAW;CACpB,CAAA;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,YAAoB;IAC/D,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;AACvE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAAqB;IAClE,OAAO,UAAU,CAAC,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAA;AAClD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B;IAC7D,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,QAAQ;IACjB,KAAK,EAAE,WAAW;IAClB,SAAS,EAAE,WAAW;CACvB,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAgB;IACrE,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,IAAI,WAAW,GAAG,MAAM,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;YACzB,YAAY,GAAG,KAAK,CAAA;YACpB,WAAW,GAAG,IAAI,CAAA;QACpB,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAC7C,OAAO,UAAU,IAAI,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAA;AAC7D,CAAC"}
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAA;AAIpG,MAAM,UAAU,GAA2B;IACzC,UAAU,EAAE,GAAG;IACf,SAAS,EAAE,EAAE;IACb,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,IAAI,EAAE,CAAC;CACR,CAAA;AAED,MAAM,eAAe,GAAkC;IACrD,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,QAAQ;IACjB,MAAM,EAAE,WAAW;CACpB,CAAA;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,YAAoB;IAC/D,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;AACvE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CAAC,UAAkB,EAAE,UAAkB;IAC7D,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AACtE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAAqB;IAClE,OAAO,UAAU,CAAC,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAA;AAClD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B;IAC7D,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,QAAQ;IACjB,KAAK,EAAE,WAAW;IAClB,SAAS,EAAE,WAAW;CACvB,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAgB;IACrE,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,IAAI,WAAW,GAAG,MAAM,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;YACzB,YAAY,GAAG,KAAK,CAAA;YACpB,WAAW,GAAG,IAAI,CAAA;QACpB,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAC7C,OAAO,UAAU,IAAI,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAA;AAC7D,CAAC"}

package/dist/auth/tokens.d.ts

@@ -1,4 +1,11 @@
 import type { UserContext } from '../config/types.js';
+/**
+ * Maximum number of site UUIDs embedded in an access token's `sites` claim
+ * (kywi-cms#74). Beyond this the claim is dropped and the token carries a
+ * `sitesOverflow` marker instead; `resolveAuth` then resolves the real list
+ * from the DB, once per request.
+ */
+export declare const SITES_CLAIM_MAX = 50;
 export declare function issueAccessToken(user: UserContext, secret: string): Promise<string>;
 export declare function issueRefreshToken(userId: string, secret: string): Promise<string>;
 //# sourceMappingURL=tokens.d.ts.map

package/dist/auth/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAErD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBzF;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOvF"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAErD;;;;;GAKG;AACH,eAAO,MAAM,eAAe,KAAK,CAAA;AAEjC,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiCzF;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOvF"}

package/dist/auth/tokens.js

@@ -1,4 +1,11 @@
 import { SignJWT } from 'jose';
+/**
+ * Maximum number of site UUIDs embedded in an access token's `sites` claim
+ * (kywi-cms#74). Beyond this the claim is dropped and the token carries a
+ * `sitesOverflow` marker instead; `resolveAuth` then resolves the real list
+ * from the DB, once per request.
+ */
+export const SITES_CLAIM_MAX = 50;
 export async function issueAccessToken(user, secret) {
     const key = new TextEncoder().encode(secret);
     // Embed per-site membership (#73) as the `sites` claim so authorization needs
@@ -12,8 +19,23 @@ export async function issueAccessToken(user, secret) {
         groups: user.groups,
         type: 'access',
     };
-    if (user.siteMemberships !== undefined)
-        claims.sites = user.siteMemberships;
+    // kywi-cms#74 — cap the claim. A site UUID costs ~37 bytes before base64, so
+    // a user in hundreds of sites would inflate the Authorization header of every
+    // request they ever make. Past SITES_CLAIM_MAX, drop the list and set a
+    // `sitesOverflow` marker instead: `resolveAuth` reads the marker and resolves
+    // the real memberships from the DB (memoized per request), which is the same
+    // lookup API-key auth already does on every call. Tokens at or under the cap
+    // are unchanged, so the common install never pays for the DB round-trip.
+    //
+    // The marker is deliberately NOT "unknown memberships": an absent `sites`
+    // claim already means that. It exists so an overflowed token is
+    // distinguishable from a pre-#73 token in logs and in future readers.
+    if (user.siteMemberships !== undefined) {
+        if (user.siteMemberships.length > SITES_CLAIM_MAX)
+            claims.sitesOverflow = true;
+        else
+            claims.sites = user.siteMemberships;
+    }
     return new SignJWT(claims)
         .setProtectedHeader({ alg: 'HS256' })
         .setIssuedAt()

package/dist/auth/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAG9B,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAiB,EAAE,MAAc;IACtE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5C,8EAA8E;IAC9E,8EAA8E;IAC9E,yEAAyE;IACzE,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,MAAM,GAA4B;QACtC,GAAG,EAAE,IAAI,CAAC,EAAE;QACZ,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,QAAQ;KACf,CAAA;IACD,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,eAAe,CAAA;IAC3E,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;SACvB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,EAAE;SACb,iBAAiB,CAAC,KAAK,CAAC;SACxB,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IACpE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5C,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;SACjD,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,EAAE;SACb,iBAAiB,CAAC,IAAI,CAAC;SACvB,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC"}
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAG9B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAA;AAEjC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAiB,EAAE,MAAc;IACtE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5C,8EAA8E;IAC9E,8EAA8E;IAC9E,yEAAyE;IACzE,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,MAAM,GAA4B;QACtC,GAAG,EAAE,IAAI,CAAC,EAAE;QACZ,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,QAAQ;KACf,CAAA;IACD,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,EAAE;IACF,0EAA0E;IAC1E,gEAAgE;IAChE,sEAAsE;IACtE,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,eAAe;YAAE,MAAM,CAAC,aAAa,GAAG,IAAI,CAAA;;YACzE,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,eAAe,CAAA;IAC1C,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;SACvB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,EAAE;SACb,iBAAiB,CAAC,KAAK,CAAC;SACxB,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IACpE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5C,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;SACjD,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,EAAE;SACb,iBAAiB,CAAC,IAAI,CAAC;SACvB,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC"}

package/dist/config/types.d.ts

@@ -95,6 +95,13 @@ export interface UserContext {
      * `superAdmin` bypasses this scoping regardless of the value.
      */
     siteMemberships?: string[];
+    /**
+     * Forced-reset flag (kywi-cms#173), surfaced on the login/refresh response's
+     * `user` object so the admin login page can route straight to the set-password
+     * screen. NOT a JWT claim — the hard gate always re-reads the DB, so a token
+     * minted before the flag was set can never bypass it.
+     */
+    passwordResetRequired?: boolean;
 }
 export interface KywiContext {
     cache: {
@@ -326,6 +333,25 @@ export interface PersonalizationConfig {
      * Defaults to false.
      */
     clientRuntime?: boolean;
+    /**
+     * Require the visitor's consent before writing any `personalization` cookie —
+     * `kywi_visitor`, `kywi_signals`, `kywi_utm`, `kywi_audience`, `kywi_known`
+     * (kywi-cms#91). **Defaults to true.**
+     *
+     * Leave it alone unless this site collects consent with EXTERNAL tooling (a
+     * third-party CMP) that suppresses cookies its own way. Setting it to `false`
+     * turns Kywi's gate off completely — every category reads as allowed, whatever
+     * the visitor answered — and hands compliance to that tooling. On a site with
+     * no other consent mechanism, `false` is simply the non-compliant setting.
+     *
+     * The authoritative cookie→category map is
+     * `audiences/consent.ts` (`COOKIE_CONSENT_CATEGORY`); this flag only decides
+     * whether the map is consulted. Next.js edge middleware cannot read this
+     * config, so it mirrors the flag with the `KYWI_REQUIRE_CONSENT=false` env var
+     * — set both, or neither. `createKywiApiHandler` throws at startup when the
+     * two disagree, so a mismatch fails the deploy rather than going unnoticed.
+     */
+    requireConsent?: boolean;
     /**
      * Signal adapters registered for this theme. Each adapter's declared `fields`
      * become available in the audience rule builder and, at runtime, its
@@ -522,6 +548,30 @@ export interface DbConfig {
 export interface AuthConfig {
     secret: string;
     providers: AuthProvider[];
+    /**
+     * Deny-by-default per-site authorization (kywi-cms#74). Opt-in; default
+     * `false`.
+     *
+     * `false` (default): a non-`superAdmin` user with ZERO membership rows is
+     * unrestricted — the upgrade-safe reading, since installs that predate
+     * `kywi_site_memberships` never seeded any rows.
+     *
+     * `true`: only an explicit membership grants site access. Zero rows, and an
+     * unresolvable membership list, are both denied everywhere `hasSiteAccess` /
+     * `assertSiteAccess` is consulted. Removing a user's last membership then
+     * narrows their access to nothing rather than widening it back to
+     * unrestricted. `superAdmin` is unaffected either way.
+     *
+     * Turn it on only after every human user has real membership rows —
+     * otherwise they lose access to every site.
+     *
+     * Note on timing: site access is authorized from the access token's `sites`
+     * claim, a snapshot taken when the token was minted. A membership change
+     * (including a revoke) therefore takes effect within the 15-minute access-
+     * token TTL, not instantly. This flag changes WHAT counts as access, not how
+     * fast a change propagates.
+     */
+    strictSiteMembership?: boolean;
 }
 export interface CacheConfig {
     provider: CacheProvider;

package/dist/config/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAIrD,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,UAAU,GACV,UAAU,GACV,QAAQ,GACR,aAAa,GACb,cAAc,GACd,OAAO,GACP,OAAO,GACP,MAAM,GACN,MAAM,GACN,SAAS,GACT,QAAQ,GACR,MAAM,GACN,OAAO,GACP,MAAM,GACN,KAAK,GACL,OAAO,GACP,MAAM,CAAA;AAEV;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,CAAA;AAErF,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAA;IACrD,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAA;CACvD;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,SAAS,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sCAAsC;IACtC,MAAM,CAAC,EAAE,eAAe,EAAE,CAAA;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,eAAe,CAAA;IAC5B,iCAAiC;IACjC,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,oGAAoG;IACpG,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;CAC5B;AAID,MAAM,MAAM,QAAQ,GAChB,SAAS,GACT,QAAQ,GACR,OAAO,GACP,OAAO,GACP,SAAS,GACT,MAAM,GACN,MAAM,GACN,WAAW,CAAA;AAIf,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,UAAU,CAAA;IACnE,QAAQ,EAAE,QAAQ,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;IAEd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAID,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE;QACL,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QAC1C,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACtD,CAAA;IACD,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAA;IACrD,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAA;IACtD,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAA;IACxD,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAA;CACxD;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE;QACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC7B,IAAI,EAAE,WAAW,CAAA;KAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE;QACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC7B,IAAI,EAAE,WAAW,CAAA;KAClB,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACtC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE;QAClB,OAAO,EAAE,eAAe,CAAA;QACxB,IAAI,EAAE,WAAW,CAAA;KAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE;QACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC7B,OAAO,EAAE,eAAe,CAAA;QACxB,IAAI,EAAE,WAAW,CAAA;KAClB,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACtC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE;QAClB,OAAO,EAAE,eAAe,CAAA;QACxB,IAAI,EAAE,WAAW,CAAA;KAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE;QACnB,OAAO,EAAE,eAAe,CAAA;QACxB,IAAI,EAAE,WAAW,CAAA;KAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE;QAClB,OAAO,EAAE,eAAe,CAAA;QACxB,IAAI,EAAE,WAAW,CAAA;KAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE;QACnB,OAAO,EAAE,eAAe,CAAA;QACxB,IAAI,EAAE,WAAW,CAAA;KAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE;QACrB,OAAO,EAAE,eAAe,CAAA;QACxB,IAAI,EAAE,WAAW,CAAA;KAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACpB;AAID,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAA;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,mBAAmB,CAAA;IAC5B,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,uGAAuG;IACvG,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;IAC3B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,kDAAkD;IAClD,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,wDAAwD;IACxD,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,iDAAiD;IACjD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gDAAgD;IAChD,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,6CAA6C;IAC7C,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,6CAA6C;AAC7C,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,CAAA;IACnD,YAAY,CAAC,EAAE,iBAAiB,EAAE,CAAA;IAClC,OAAO,CAAC,EAAE,YAAY,EAAE,CAAA;IACxB,4EAA4E;IAC5E,eAAe,CAAC,EACZ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACvB,CAAC,CAAC,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC3E,eAAe,CAAC,EAAE;QAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAA;KAAE,CAAA;IACpD,uEAAuE;IACvE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1E;AAKD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC,CAAA;AAEjE;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAExE;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,cAAc,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAA;CAC7B;AAED,iFAAiF;AACjF,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,gBAAgB,EAAE,GAAG,SAAS,GACtC,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAIzC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAC5C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,kBAAkB,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IAC1C,YAAY,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;KAAE,CAAA;IAClE,oBAAoB,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;KAAE,CAAA;IAC1E;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAA;CAC3B;AAED;;oFAEoF;AACpF,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAC3B,OAAO,GACP,OAAO,CAAC,MAAM,CAAC,MAAM,WAAW,EAAE,OAAO,CAAC,CAAC,CAAA;AAE/C,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC3B,eAAe,CAAC,EAAE,qBAAqB,CAAA;IACvC,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,aAAa,CAAC,EAAE,mBAAmB,CAAA;CACpC;AAID,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;IACzC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE;QACL,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,IAAI,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KACtC,CAAA;IACD,QAAQ,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;CAC9B;AAID;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,4DAA4D;IAC5D,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACxB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,eAAe,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnF;AAED;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,oCAAoC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,oDAAoD;QACpD,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,4DAA4D;QAC5D,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;QACvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;QACvB,yEAAyE;QACzE,QAAQ,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KACvE,CAAA;IACD,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;QACvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,+DAA+D;QAC/D,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,sEAAsE;QACtE,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KACxB,CAAA;IACD,MAAM,CAAC,EAAE;QACP,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,QAAQ,CAAC,EAAE,KAAK,CAAC;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;QAC9E,8DAA8D;QAC9D,gBAAgB,CAAC,EAAE,OAAO,CAAA;QAC1B,yEAAyE;QACzE,gBAAgB,CAAC,EAAE,OAAO,CAAA;QAC1B,2EAA2E;QAC3E,QAAQ,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAA;KAC5C,CAAA;IACD,MAAM,CAAC,EAAE;QACP,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,4EAA4E;QAC5E,QAAQ,CAAC,EAAE,OAAO,CAAA;QAClB,gCAAgC;QAChC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;KAC1C,CAAA;IACD,qFAAqF;IACrF,QAAQ,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CACjC;AAID;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gGAAgG;IAChG,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IAC9C,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACpC,eAAe,EAAE,MAAM,EAAE,CAAA;CAC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yBAAyB,2BAA2B,CAAA;AAIjE,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,CAAA;AACjE,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,OAAO,CAAA;AAC/C,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAA;AAC9C,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAA;AAE3E,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,UAAU,CAAA;IACpB,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,YAAY,EAAE,CAAA;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,aAAa,CAAA;IACvB,KAAK,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,cAAc,CAAA;IACpB,EAAE,EAAE,QAAQ,CAAA;IACZ,IAAI,EAAE,UAAU,CAAA;IAChB,KAAK,EAAE,UAAU,EAAE,CAAA;IACnB,YAAY,CAAC,EAAE,iBAAiB,EAAE,CAAA;IAClC,OAAO,CAAC,EAAE,YAAY,EAAE,CAAA;IACxB,OAAO,CAAC,EAAE,YAAY,EAAE,CAAA;IACxB,MAAM,CAAC,EAAE,WAAW,EAAE,CAAA;IACtB,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,EAAE,CAAC,EAAE,QAAQ,CAAA;IACb,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B,QAAQ,CAAC,EAAE,cAAc,CAAA;IACzB,KAAK,CAAC,EAAE,gBAAgB,CAAA;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,IAAI,GAAG,WAAW,GAAG,UAAU,GAAG,OAAO,CAAC,CAAC;IACtH,YAAY,EAAE,iBAAiB,EAAE,CAAA;IACjC,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,KAAK,EAAE,WAAW,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,mFAAmF;IACnF,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B,qFAAqF;IACrF,QAAQ,CAAC,EAAE,cAAc,CAAA;IACzB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB;;;;;OAKG;IACH,EAAE,CAAC,EAAE,QAAQ,CAAA;CACd"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAIrD,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,UAAU,GACV,UAAU,GACV,QAAQ,GACR,aAAa,GACb,cAAc,GACd,OAAO,GACP,OAAO,GACP,MAAM,GACN,MAAM,GACN,SAAS,GACT,QAAQ,GACR,MAAM,GACN,OAAO,GACP,MAAM,GACN,KAAK,GACL,OAAO,GACP,MAAM,CAAA;AAEV;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,CAAA;AAErF,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAA;IACrD,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAA;CACvD;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,SAAS,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sCAAsC;IACtC,MAAM,CAAC,EAAE,eAAe,EAAE,CAAA;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,eAAe,CAAA;IAC5B,iCAAiC;IACjC,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,oGAAoG;IACpG,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;CAC5B;AAID,MAAM,MAAM,QAAQ,GAChB,SAAS,GACT,QAAQ,GACR,OAAO,GACP,OAAO,GACP,SAAS,GACT,MAAM,GACN,MAAM,GACN,WAAW,CAAA;AAIf,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,UAAU,CAAA;IACnE,QAAQ,EAAE,QAAQ,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;IAEd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAID,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAChC;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE;QACL,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QAC1C,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACtD,CAAA;IACD,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAA;IACrD,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAA;IACtD,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAA;IACxD,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAA;CACxD;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE;QACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC7B,IAAI,EAAE,WAAW,CAAA;KAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE;QACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC7B,IAAI,EAAE,WAAW,CAAA;KAClB,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACtC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE;QAClB,OAAO,EAAE,eAAe,CAAA;QACxB,IAAI,EAAE,WAAW,CAAA;KAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE;QACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC7B,OAAO,EAAE,eAAe,CAAA;QACxB,IAAI,EAAE,WAAW,CAAA;KAClB,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACtC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE;QAClB,OAAO,EAAE,eAAe,CAAA;QACxB,IAAI,EAAE,WAAW,CAAA;KAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE;QACnB,OAAO,EAAE,eAAe,CAAA;QACxB,IAAI,EAAE,WAAW,CAAA;KAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE;QAClB,OAAO,EAAE,eAAe,CAAA;QACxB,IAAI,EAAE,WAAW,CAAA;KAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE;QACnB,OAAO,EAAE,eAAe,CAAA;QACxB,IAAI,EAAE,WAAW,CAAA;KAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE;QACrB,OAAO,EAAE,eAAe,CAAA;QACxB,IAAI,EAAE,WAAW,CAAA;KAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACpB;AAID,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAA;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,mBAAmB,CAAA;IAC5B,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,uGAAuG;IACvG,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;IAC3B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,kDAAkD;IAClD,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,wDAAwD;IACxD,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,iDAAiD;IACjD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gDAAgD;IAChD,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,6CAA6C;IAC7C,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,6CAA6C;AAC7C,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,CAAA;IACnD,YAAY,CAAC,EAAE,iBAAiB,EAAE,CAAA;IAClC,OAAO,CAAC,EAAE,YAAY,EAAE,CAAA;IACxB,4EAA4E;IAC5E,eAAe,CAAC,EACZ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACvB,CAAC,CAAC,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC3E,eAAe,CAAC,EAAE;QAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAA;KAAE,CAAA;IACpD,uEAAuE;IACvE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1E;AAKD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC,CAAA;AAEjE;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAExE;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,cAAc,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAA;CAC7B;AAED,iFAAiF;AACjF,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,gBAAgB,EAAE,GAAG,SAAS,GACtC,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAIzC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAC5C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,kBAAkB,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IAC1C,YAAY,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;KAAE,CAAA;IAClE,oBAAoB,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;KAAE,CAAA;IAC1E;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;;;;;;;;;;;;;;OAiBG;IACH,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAA;CAC3B;AAED;;oFAEoF;AACpF,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAC3B,OAAO,GACP,OAAO,CAAC,MAAM,CAAC,MAAM,WAAW,EAAE,OAAO,CAAC,CAAC,CAAA;AAE/C,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC3B,eAAe,CAAC,EAAE,qBAAqB,CAAA;IACvC,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,aAAa,CAAC,EAAE,mBAAmB,CAAA;CACpC;AAID,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;IACzC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE;QACL,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,IAAI,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KACtC,CAAA;IACD,QAAQ,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;CAC9B;AAID;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,4DAA4D;IAC5D,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACxB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,eAAe,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnF;AAED;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,oCAAoC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,oDAAoD;QACpD,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,4DAA4D;QAC5D,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;QACvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;QACvB,yEAAyE;QACzE,QAAQ,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KACvE,CAAA;IACD,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;QACvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,+DAA+D;QAC/D,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,sEAAsE;QACtE,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KACxB,CAAA;IACD,MAAM,CAAC,EAAE;QACP,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,QAAQ,CAAC,EAAE,KAAK,CAAC;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;QAC9E,8DAA8D;QAC9D,gBAAgB,CAAC,EAAE,OAAO,CAAA;QAC1B,yEAAyE;QACzE,gBAAgB,CAAC,EAAE,OAAO,CAAA;QAC1B,2EAA2E;QAC3E,QAAQ,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAA;KAC5C,CAAA;IACD,MAAM,CAAC,EAAE;QACP,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,4EAA4E;QAC5E,QAAQ,CAAC,EAAE,OAAO,CAAA;QAClB,gCAAgC;QAChC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;KAC1C,CAAA;IACD,qFAAqF;IACrF,QAAQ,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CACjC;AAID;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gGAAgG;IAChG,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IAC9C,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACpC,eAAe,EAAE,MAAM,EAAE,CAAA;CAC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yBAAyB,2BAA2B,CAAA;AAIjE,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,CAAA;AACjE,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,OAAO,CAAA;AAC/C,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAA;AAC9C,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAA;AAE3E,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,UAAU,CAAA;IACpB,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,YAAY,EAAE,CAAA;IACzB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,aAAa,CAAA;IACvB,KAAK,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,cAAc,CAAA;IACpB,EAAE,EAAE,QAAQ,CAAA;IACZ,IAAI,EAAE,UAAU,CAAA;IAChB,KAAK,EAAE,UAAU,EAAE,CAAA;IACnB,YAAY,CAAC,EAAE,iBAAiB,EAAE,CAAA;IAClC,OAAO,CAAC,EAAE,YAAY,EAAE,CAAA;IACxB,OAAO,CAAC,EAAE,YAAY,EAAE,CAAA;IACxB,MAAM,CAAC,EAAE,WAAW,EAAE,CAAA;IACtB,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,EAAE,CAAC,EAAE,QAAQ,CAAA;IACb,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B,QAAQ,CAAC,EAAE,cAAc,CAAA;IACzB,KAAK,CAAC,EAAE,gBAAgB,CAAA;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,IAAI,GAAG,WAAW,GAAG,UAAU,GAAG,OAAO,CAAC,CAAC;IACtH,YAAY,EAAE,iBAAiB,EAAE,CAAA;IACjC,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,KAAK,EAAE,WAAW,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,mFAAmF;IACnF,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B,qFAAqF;IACrF,QAAQ,CAAC,EAAE,cAAc,CAAA;IACzB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB;;;;;OAKG;IACH,EAAE,CAAC,EAAE,QAAQ,CAAA;CACd"}

package/dist/config/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AA4UA,iFAAiF;AACjF,MAAM,UAAU,0BAA0B,CACxC,OAAuC;IAEvC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAC/B,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAC3D,CAAA;AACH,CAAC;AAkMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,wBAAwB,CAAA"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAmVA,iFAAiF;AACjF,MAAM,UAAU,0BAA0B,CACxC,OAAuC;IAEvC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAC/B,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAC3D,CAAA;AACH,CAAC;AAqND;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,wBAAwB,CAAA"}

package/dist/config/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/config/validate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAmT5C,MAAM,MAAM,gBAAgB,GACxB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GACrC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAA;AAExC,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAS/D"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/config/validate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAsT5C,MAAM,MAAM,gBAAgB,GACxB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GACrC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAA;AAExC,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAS/D"}

package/dist/config/validate.js

@@ -139,6 +139,9 @@ const kywiConfigSchema = z.object({
     auth: z.object({
         secret: z.string().min(1),
         providers: z.array(z.enum(['credentials', 'google', 'github', 'facebook'])),
+        // kywi-cms#74 — opt-in deny-by-default per-site authorization. Absent means
+        // false (the legacy-safe reading); see AuthConfig for the full contract.
+        strictSiteMembership: z.boolean().optional(),
     }),
     sites: z.array(z.object({
         id: z.string().min(1),