@kywi-software/core 0.14.0 → 0.15.1

package/dist/audiences/server-eval.js

@@ -1,5 +1,7 @@
 import { getActiveAudiences } from './queries.js';
 import { createAudienceEngine } from './engine.js';
+import { buildSetCookieHeader, COOKIE_MAX_AGE, COOKIE_NAMES } from './cookies.js';
+import { entryPageCookieValue } from './entry-page.js';
 /**
  * Server-side audience evaluation for a public request.
  *
@@ -11,13 +13,43 @@ import { createAudienceEngine } from './engine.js';
  *
  * This is the single server seam the public rendering path calls, so audience
  * evaluation happens exactly once per page render.
+ *
+ * `opts.requireConsent` is `theme.personalization.requireConsent` (kywi-cms#91),
+ * and it MUST be passed by any host whose theme might set it — omitted, the gate
+ * defaults on, which is right for a site relying on Kywi's own banner and wrong
+ * for one that turned the gate off. This seam used to drop the flag entirely, so
+ * an external-CMP site had its server collectors ignoring `kywi_utm`,
+ * `kywi_visitor`, `kywi_known` and `kywi_audience` while the middleware and the
+ * runtime routes read them: personalization that worked on the client and
+ * reverted on the next server render. `kywi_optout` is `essential` and is
+ * unaffected either way — turning the consent gate off never turns off a
+ * visitor's suppression preference.
  */
-export async function evaluateActiveAudiences(db, siteId, request) {
+export async function evaluateActiveAudiences(db, siteId, request, opts = {}) {
     const audiences = await getActiveAudiences(db, siteId);
-    const result = await createAudienceEngine({ audiences }).evaluate({ request });
+    // Built conditionally: under `exactOptionalPropertyTypes` an explicit
+    // `undefined` is not the same as an absent key.
+    const engineConfig = opts.requireConsent === undefined
+        ? { audiences }
+        : { audiences, requireConsent: opts.requireConsent };
+    const result = await createAudienceEngine(engineConfig).evaluate({ request });
     const winningAudience = result.winningAudienceId
         ? (audiences.find((a) => a.id === result.winningAudienceId) ?? null)
         : null;
-    return { result, audiences, winningAudience };
+    // The entry page is recorded on the first request of the session only — and
+    // only for a consenting visitor, since `kywi_entry` is a `personalization`
+    // cookie (kywi-cms#91/#196). `entryPageCookieValue` applies both rules.
+    const entryValue = entryPageCookieValue(request.url, {
+        ...opts,
+        cookieHeader: request.headers.get('cookie'),
+        // Only a document request may name the entry page — a subresource that
+        // happens to come first would poison it (kywi-cms#196, review item 6).
+        secFetchDest: request.headers.get('sec-fetch-dest'),
+        accept: request.headers.get('accept'),
+    });
+    const setCookieHeaders = entryValue
+        ? [buildSetCookieHeader(COOKIE_NAMES.ENTRY, entryValue, COOKIE_MAX_AGE.ENTRY, { httpOnly: false })]
+        : [];
+    return { result, audiences, winningAudience, setCookieHeaders };
 }
 //# sourceMappingURL=server-eval.js.map

package/dist/audiences/server-eval.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-eval.js","sourceRoot":"","sources":["../../src/audiences/server-eval.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAiBlD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,EAAU,EACV,MAAc,EACd,OAAgB;IAEhB,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IACtD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAC9E,MAAM,eAAe,GAAG,MAAM,CAAC,iBAAiB;QAC9C,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;QACpE,CAAC,CAAC,IAAI,CAAA;IACR,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,CAAA;AAC/C,CAAC"}
+{"version":3,"file":"server-eval.js","sourceRoot":"","sources":["../../src/audiences/server-eval.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAElD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAoCtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,EAAU,EACV,MAAc,EACd,OAAgB,EAChB,OAA2B,EAAE;IAE7B,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IACtD,sEAAsE;IACtE,gDAAgD;IAChD,MAAM,YAAY,GAChB,IAAI,CAAC,cAAc,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,SAAS,EAAE;QACf,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAA;IACxD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAC7E,MAAM,eAAe,GAAG,MAAM,CAAC,iBAAiB;QAC9C,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;QACpE,CAAC,CAAC,IAAI,CAAA;IACR,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE;QACnD,GAAG,IAAI;QACP,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,uEAAuE;QACvE,uEAAuE;QACvE,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACnD,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;KACtC,CAAC,CAAA;IACF,MAAM,gBAAgB,GAAG,UAAU;QACjC,CAAC,CAAC,CAAC,oBAAoB,CAAC,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,cAAc,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACnG,CAAC,CAAC,EAAE,CAAA;IACN,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAA;AACjE,CAAC"}

package/dist/audiences/ssr.d.ts

@@ -1,4 +1,21 @@
+import { type ConsentGateOptions } from './consent.js';
 import type { VisitorSignals } from './types.js';
 export declare function readSignalsFromRequest(cookieHeader: string | null, secret: string): Promise<VisitorSignals | null>;
-export declare function writeSignalsToResponse(signals: VisitorSignals, secret: string): Promise<string>;
+/**
+ * Build the `Set-Cookie` header that persists this request's resolved signals,
+ * or `null` when the visitor has not consented to personalization.
+ *
+ * `kywi_signals` is a `personalization` cookie (`audiences/consent.ts` owns the
+ * category map), so the caller must hand over the request's `Cookie` header for
+ * the gate to read the decision from — kywi-cms#91. Omitting it fails closed,
+ * as does an undecided visitor: nothing breaks, the request still resolves its
+ * audiences and renders, the resolution simply is not carried to the next one,
+ * so the visitor keeps getting the default content until they accept.
+ *
+ * Pass `requireConsent: false` (from `theme.personalization.requireConsent`) to
+ * turn the gate off for a site whose consent lives in external tooling.
+ */
+export declare function writeSignalsToResponse(signals: VisitorSignals, secret: string, options?: {
+    cookieHeader?: string | null;
+} & ConsentGateOptions): Promise<string | null>;
 //# sourceMappingURL=ssr.d.ts.map

package/dist/audiences/ssr.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr.d.ts","sourceRoot":"","sources":["../../src/audiences/ssr.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAOhC;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAGjB"}
+{"version":3,"file":"ssr.d.ts","sourceRoot":"","sources":["../../src/audiences/ssr.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAOhC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,kBAAuB,GAClE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIxB"}

package/dist/audiences/ssr.js

@@ -1,4 +1,5 @@
 import { signSignals, verifySignals, parseCookies, buildSetCookieHeader, COOKIE_NAMES, COOKIE_MAX_AGE } from './cookies.js';
+import { cookieAllowedByHeader } from './consent.js';
 export async function readSignalsFromRequest(cookieHeader, secret) {
     if (!cookieHeader)
         return null;
@@ -9,7 +10,23 @@ export async function readSignalsFromRequest(cookieHeader, secret) {
     const payload = await verifySignals(token, secret);
     return payload;
 }
-export async function writeSignalsToResponse(signals, secret) {
+/**
+ * Build the `Set-Cookie` header that persists this request's resolved signals,
+ * or `null` when the visitor has not consented to personalization.
+ *
+ * `kywi_signals` is a `personalization` cookie (`audiences/consent.ts` owns the
+ * category map), so the caller must hand over the request's `Cookie` header for
+ * the gate to read the decision from — kywi-cms#91. Omitting it fails closed,
+ * as does an undecided visitor: nothing breaks, the request still resolves its
+ * audiences and renders, the resolution simply is not carried to the next one,
+ * so the visitor keeps getting the default content until they accept.
+ *
+ * Pass `requireConsent: false` (from `theme.personalization.requireConsent`) to
+ * turn the gate off for a site whose consent lives in external tooling.
+ */
+export async function writeSignalsToResponse(signals, secret, options = {}) {
+    if (!cookieAllowedByHeader(COOKIE_NAMES.SIGNALS, options.cookieHeader, options))
+        return null;
     const token = await signSignals(signals, secret);
     return buildSetCookieHeader(COOKIE_NAMES.SIGNALS, token, COOKIE_MAX_AGE.SIGNALS);
 }

package/dist/audiences/ssr.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssr.js","sourceRoot":"","sources":["../../src/audiences/ssr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,oBAAoB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAG3H,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,YAA2B,EAC3B,MAAc;IAEd,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAA;IAC9B,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IAClD,OAAO,OAAgC,CAAA;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAuB,EACvB,MAAc;IAEd,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAChD,OAAO,oBAAoB,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,CAAA;AAClF,CAAC"}
+{"version":3,"file":"ssr.js","sourceRoot":"","sources":["../../src/audiences/ssr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,oBAAoB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC3H,OAAO,EAAE,qBAAqB,EAA2B,MAAM,cAAc,CAAA;AAG7E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,YAA2B,EAC3B,MAAc;IAEd,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAA;IAC9B,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IAClD,OAAO,OAAgC,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAuB,EACvB,MAAc,EACd,UAAiE,EAAE;IAEnE,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5F,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAChD,OAAO,oBAAoB,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,CAAA;AAClF,CAAC"}

package/dist/audiences/types.d.ts

@@ -22,6 +22,14 @@ export interface VisitorSignals {
         categoryScores: Record<string, number>;
         totalScore: number;
     };
+    /**
+     * Every query parameter on the request being served, as the `query.<param>`
+     * signal family (kywi-cms#196). Not stored and never gated — like the URL's
+     * own `utm_*` params these are the content of this request, so a campaign link
+     * (`/developers?from=marketer`) is a one-line rule that fires on the very
+     * request that carries it.
+     */
+    query: Record<string, string>;
     selfId: Record<string, string>;
     identity: {
         visitorId: string;
@@ -56,6 +64,19 @@ export interface Audience {
     status: AudienceStatus;
     conditionGroups: ConditionGroup[];
     scoreThreshold: number | null;
+    /**
+     * The audience's NAME may be listed to the public by
+     * `GET /api/v1/kywi/audiences`, so a page can offer the visitor a choice
+     * ("What brings you here?") without an admin token (kywi-cms#200). Off by
+     * default — an audience is an internal segment definition until someone
+     * deliberately publishes its name.
+     *
+     * Optional because this shape is also parsed from payloads written before the
+     * column existed (an audience list serialized into a page, a fixture); absent
+     * reads as false everywhere, and the public listing filters in SQL rather than
+     * trusting this field.
+     */
+    public?: boolean;
     createdAt: Date;
     updatedAt: Date;
 }
@@ -74,7 +95,7 @@ export interface InstantMatchCondition {
     operator: InstantOperator;
     value: string | string[];
 }
-export type InstantSignalRef = 'utm.source' | 'utm.medium' | 'utm.campaign' | 'utm.term' | 'utm.content' | 'referrer.domain' | 'referrer.sourceType' | `selfId.${string}` | `adapter.${string}` | 'identity.isKnown' | 'session.entryPage' | 'session.pagesVisited';
+export type InstantSignalRef = 'utm.source' | 'utm.medium' | 'utm.campaign' | 'utm.term' | 'utm.content' | 'referrer.domain' | 'referrer.sourceType' | `selfId.${string}` | `adapter.${string}` | 'identity.isKnown' | 'session.entryPage' | 'session.pagesVisited' | `query.${string}`;
 export type InstantOperator = 'equals' | 'not_equals' | 'contains' | 'starts_with' | 'matches_glob' | 'is_one_of' | 'is_true' | 'is_false' | 'gte' | 'lte';
 export interface ScoreContributionCondition {
     type: 'score';

package/dist/audiences/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/audiences/types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE;QACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;QACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;QACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;QACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;QACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KACvB,CAAA;IACD,QAAQ,EAAE;QACR,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;QAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;QACrB,UAAU,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAA;KACzE,CAAA;IACD,OAAO,EAAE;QACP,aAAa,EAAE,MAAM,CAAA;QACrB,cAAc,EAAE,MAAM,CAAA;QACtB,eAAe,EAAE,MAAM,CAAA;QACvB,SAAS,EAAE,MAAM,CAAA;QACjB,YAAY,EAAE,MAAM,EAAE,CAAA;KACvB,CAAA;IACD,UAAU,EAAE;QACV,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACtC,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;IACD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAA;QACjB,OAAO,EAAE,OAAO,CAAA;QAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KACxB,CAAA;IACD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,IAAI,EAAE;QACJ,UAAU,EAAE,OAAO,CAAA;QACnB,SAAS,EAAE,OAAO,CAAA;QAClB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;QAChC,UAAU,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAChC,CAAA;CACF;AAID,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;CACzC;AAED,MAAM,WAAW,cAAc;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,OAAO,CAAA;CACpB;AAID,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAA;AAE5D,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,cAAc,CAAA;IACtB,eAAe,EAAE,cAAc,EAAE,CAAA;IACjC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,SAAS,EAAE,CAAA;CACxB;AAED,MAAM,MAAM,SAAS,GAAG,qBAAqB,GAAG,0BAA0B,CAAA;AAE1E,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,SAAS,CAAA;IACf,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,gBAAgB,CAAA;IACxB,QAAQ,EAAE,eAAe,CAAA;IACzB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CACzB;AAED,MAAM,MAAM,gBAAgB,GACxB,YAAY,GAAG,YAAY,GAAG,cAAc,GAAG,UAAU,GAAG,aAAa,GACzE,iBAAiB,GAAG,qBAAqB,GACzC,UAAU,MAAM,EAAE,GAClB,WAAW,MAAM,EAAE,GACnB,kBAAkB,GAClB,mBAAmB,GACnB,sBAAsB,CAAA;AAE1B,MAAM,MAAM,eAAe,GACvB,QAAQ,GAAG,YAAY,GAAG,UAAU,GAAG,aAAa,GAAG,cAAc,GACrE,WAAW,GAAG,SAAS,GAAG,UAAU,GACpC,KAAK,GAAG,KAAK,CAAA;AAEjB,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,OAAO,CAAA;IACb,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAA;IACzB,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC1B;AAED,MAAM,MAAM,YAAY,GACpB,eAAe,GACf,gBAAgB,GAChB,UAAU,GACV,gBAAgB,GAChB,YAAY,GACZ,aAAa,CAAA;AAIjB,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjD,QAAQ,EAAE,OAAO,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,eAAe,GAAG,kBAAkB,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAA;IAC9F,OAAO,EAAE,aAAa,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,cAAc,GAAG,cAAc,GAAG,QAAQ,CAAA;CACtD;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAA;AAItB,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB;AAID,wBAAgB,kBAAkB,IAAI,cAAc,CAWnD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/audiences/types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE;QACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;QACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;QACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;QACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;QACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KACvB,CAAA;IACD,QAAQ,EAAE;QACR,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;QAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;QACrB,UAAU,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAA;KACzE,CAAA;IACD,OAAO,EAAE;QACP,aAAa,EAAE,MAAM,CAAA;QACrB,cAAc,EAAE,MAAM,CAAA;QACtB,eAAe,EAAE,MAAM,CAAA;QACvB,SAAS,EAAE,MAAM,CAAA;QACjB,YAAY,EAAE,MAAM,EAAE,CAAA;KACvB,CAAA;IACD,UAAU,EAAE;QACV,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACtC,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;IACD;;;;;;OAMG;IACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAA;QACjB,OAAO,EAAE,OAAO,CAAA;QAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KACxB,CAAA;IACD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,IAAI,EAAE;QACJ,UAAU,EAAE,OAAO,CAAA;QACnB,SAAS,EAAE,OAAO,CAAA;QAClB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;QAChC,UAAU,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAChC,CAAA;CACF;AAID,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;CACzC;AAED,MAAM,WAAW,cAAc;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,OAAO,CAAA;CACpB;AAID,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAA;AAE5D,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,cAAc,CAAA;IACtB,eAAe,EAAE,cAAc,EAAE,CAAA;IACjC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,SAAS,EAAE,CAAA;CACxB;AAED,MAAM,MAAM,SAAS,GAAG,qBAAqB,GAAG,0BAA0B,CAAA;AAE1E,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,SAAS,CAAA;IACf,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,gBAAgB,CAAA;IACxB,QAAQ,EAAE,eAAe,CAAA;IACzB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CACzB;AAED,MAAM,MAAM,gBAAgB,GACxB,YAAY,GAAG,YAAY,GAAG,cAAc,GAAG,UAAU,GAAG,aAAa,GACzE,iBAAiB,GAAG,qBAAqB,GACzC,UAAU,MAAM,EAAE,GAClB,WAAW,MAAM,EAAE,GACnB,kBAAkB,GAClB,mBAAmB,GACnB,sBAAsB,GACtB,SAAS,MAAM,EAAE,CAAA;AAErB,MAAM,MAAM,eAAe,GACvB,QAAQ,GAAG,YAAY,GAAG,UAAU,GAAG,aAAa,GAAG,cAAc,GACrE,WAAW,GAAG,SAAS,GAAG,UAAU,GACpC,KAAK,GAAG,KAAK,CAAA;AAEjB,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,OAAO,CAAA;IACb,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAA;IACzB,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC1B;AAED,MAAM,MAAM,YAAY,GACpB,eAAe,GACf,gBAAgB,GAChB,UAAU,GACV,gBAAgB,GAChB,YAAY,GACZ,aAAa,CAAA;AAIjB,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjD,QAAQ,EAAE,OAAO,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,eAAe,GAAG,kBAAkB,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAA;IAC9F,OAAO,EAAE,aAAa,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,cAAc,GAAG,cAAc,GAAG,QAAQ,CAAA;CACtD;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAA;AAItB,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB;AAID,wBAAgB,kBAAkB,IAAI,cAAc,CAYnD"}

package/dist/audiences/types.js

@@ -6,6 +6,7 @@ export function createEmptySignals() {
         referrer: { raw: null, domain: null, sourceType: 'direct' },
         session: { pageViewCount: 0, totalPageViews: 0, sessionDuration: 0, entryPage: '/', pagesVisited: [] },
         behavioral: { categoryScores: {}, totalScore: 0 },
+        query: {},
         selfId: {},
         identity: { visitorId: '', isKnown: false, maLeadId: null },
         adapters: {},

package/dist/audiences/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/audiences/types.ts"],"names":[],"mappings":"AAAA,gFAAgF;AA0KhF,gFAAgF;AAEhF,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;QAC9E,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE;QAC3D,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE;QACtG,UAAU,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;QACjD,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC3D,QAAQ,EAAE,EAAE;QACZ,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE;KAC7F,CAAA;AACH,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/audiences/types.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAgMhF,gFAAgF;AAEhF,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;QAC9E,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE;QAC3D,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE;QACtG,UAAU,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;QACjD,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC3D,QAAQ,EAAE,EAAE;QACZ,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE;KAC7F,CAAA;AACH,CAAC"}

package/dist/audiences/utm-persistence.d.ts

@@ -20,13 +20,14 @@
  * leaves any existing cookie untouched — ordinary navigation never clobbers a
  * persisted campaign.
  *
- * EDGE-SAFE LEAF MODULE: this file has NO imports (and therefore no transitive
- * DB dependency), because it is imported from Next.js edge middleware — where
- * core's DB-backed code (drizzle/postgres) cannot run. Keep it dependency-free.
- * It is published as its own export entry (`@kywi-software/core/audiences/
- * utm-persistence`) so importing it never drags in the DB-backed `audiences`
- * barrel.
+ * EDGE-SAFE LEAF MODULE: this file's only import is `./consent.js`, which is
+ * itself a zero-import leaf, because it is imported from Next.js edge
+ * middleware — where core's DB-backed code (drizzle/postgres) cannot run. Keep
+ * it dependency-free beyond that. It is published as its own export entry
+ * (`@kywi-software/core/audiences/utm-persistence`) so importing it never drags
+ * in the DB-backed `audiences` barrel.
  */
+import { type ConsentGateOptions } from './consent.js';
 /**
  * Cookie name `collectUtm` reads (mirrors `COOKIE_NAMES.UTM` in
  * `audiences/cookies.ts`). Kept as a literal here so this leaf module imports
@@ -41,6 +42,18 @@ export declare const UTM_COOKIE = "kywi_utm";
  * The JSON shape mirrors what `collectUtm` parses: `{ source, medium, campaign,
  * term, content }` with only the present keys. Empty `utm_*` values are treated
  * as absent, and a malformed URL yields `null`.
+ *
+ * Also `null` when the visitor has not consented to personalization
+ * (kywi-cms#91): `kywi_utm` is a `personalization` cookie in the category map
+ * `./consent.js` owns. Pass the request's `Cookie` header so the gate can read
+ * the decision; omitting it fails closed, as does an undecided visitor. The
+ * campaign then simply does not survive the visitor's next navigation — the
+ * landing request itself still matches on its own `utm_*` params, so a campaign
+ * page still renders its campaign content. Pass `requireConsent: false` (from
+ * `theme.personalization.requireConsent`) to turn the gate off for a site whose
+ * consent lives in external tooling.
  */
-export declare function utmCookieValue(url: string): string | null;
+export declare function utmCookieValue(url: string, options?: {
+    cookieHeader?: string | null;
+} & ConsentGateOptions): string | null;
 //# sourceMappingURL=utm-persistence.d.ts.map

package/dist/audiences/utm-persistence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utm-persistence.d.ts","sourceRoot":"","sources":["../../src/audiences/utm-persistence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,aAAa,CAAA;AAUpC;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAazD"}
+{"version":3,"file":"utm-persistence.d.ts","sourceRoot":"","sources":["../../src/audiences/utm-persistence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAyB,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,aAAa,CAAA;AAUpC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,kBAAuB,GAClE,MAAM,GAAG,IAAI,CAcf"}

package/dist/audiences/utm-persistence.js

@@ -20,13 +20,14 @@
  * leaves any existing cookie untouched — ordinary navigation never clobbers a
  * persisted campaign.
  *
- * EDGE-SAFE LEAF MODULE: this file has NO imports (and therefore no transitive
- * DB dependency), because it is imported from Next.js edge middleware — where
- * core's DB-backed code (drizzle/postgres) cannot run. Keep it dependency-free.
- * It is published as its own export entry (`@kywi-software/core/audiences/
- * utm-persistence`) so importing it never drags in the DB-backed `audiences`
- * barrel.
+ * EDGE-SAFE LEAF MODULE: this file's only import is `./consent.js`, which is
+ * itself a zero-import leaf, because it is imported from Next.js edge
+ * middleware — where core's DB-backed code (drizzle/postgres) cannot run. Keep
+ * it dependency-free beyond that. It is published as its own export entry
+ * (`@kywi-software/core/audiences/utm-persistence`) so importing it never drags
+ * in the DB-backed `audiences` barrel.
  */
+import { cookieAllowedByHeader } from './consent.js';
 /**
  * Cookie name `collectUtm` reads (mirrors `COOKIE_NAMES.UTM` in
  * `audiences/cookies.ts`). Kept as a literal here so this leaf module imports
@@ -48,8 +49,20 @@ const UTM_KEYS = [
  * The JSON shape mirrors what `collectUtm` parses: `{ source, medium, campaign,
  * term, content }` with only the present keys. Empty `utm_*` values are treated
  * as absent, and a malformed URL yields `null`.
+ *
+ * Also `null` when the visitor has not consented to personalization
+ * (kywi-cms#91): `kywi_utm` is a `personalization` cookie in the category map
+ * `./consent.js` owns. Pass the request's `Cookie` header so the gate can read
+ * the decision; omitting it fails closed, as does an undecided visitor. The
+ * campaign then simply does not survive the visitor's next navigation — the
+ * landing request itself still matches on its own `utm_*` params, so a campaign
+ * page still renders its campaign content. Pass `requireConsent: false` (from
+ * `theme.personalization.requireConsent`) to turn the gate off for a site whose
+ * consent lives in external tooling.
  */
-export function utmCookieValue(url) {
+export function utmCookieValue(url, options = {}) {
+    if (!cookieAllowedByHeader(UTM_COOKIE, options.cookieHeader, options))
+        return null;
     let params;
     try {
         params = new URL(url).searchParams;

package/dist/audiences/utm-persistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"utm-persistence.js","sourceRoot":"","sources":["../../src/audiences/utm-persistence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,UAAU,CAAA;AAEpC,MAAM,QAAQ,GAAG;IACf,CAAC,YAAY,EAAE,QAAQ,CAAC;IACxB,CAAC,YAAY,EAAE,QAAQ,CAAC;IACxB,CAAC,cAAc,EAAE,UAAU,CAAC;IAC5B,CAAC,UAAU,EAAE,MAAM,CAAC;IACpB,CAAC,aAAa,EAAE,SAAS,CAAC;CAClB,CAAA;AAEV;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,MAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACtD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACjE,CAAC"}
+{"version":3,"file":"utm-persistence.js","sourceRoot":"","sources":["../../src/audiences/utm-persistence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,qBAAqB,EAA2B,MAAM,cAAc,CAAA;AAE7E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,UAAU,CAAA;AAEpC,MAAM,QAAQ,GAAG;IACf,CAAC,YAAY,EAAE,QAAQ,CAAC;IACxB,CAAC,YAAY,EAAE,QAAQ,CAAC;IACxB,CAAC,cAAc,EAAE,UAAU,CAAC;IAC5B,CAAC,UAAU,EAAE,MAAM,CAAC;IACpB,CAAC,aAAa,EAAE,SAAS,CAAC;CAClB,CAAA;AAEV;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,UAAiE,EAAE;IAEnE,IAAI,CAAC,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IAClF,IAAI,MAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACtD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACjE,CAAC"}

package/dist/auth/roles.d.ts

@@ -2,6 +2,17 @@ export declare const KYWI_ROLES: readonly ["superAdmin", "siteAdmin", "editor",
 export type KywiRole = (typeof KYWI_ROLES)[number];
 export type ContentAction = 'read' | 'write' | 'publish' | 'delete';
 export declare function hasMinRole(userRole: string, requiredRole: string): boolean;
+/**
+ * True when `callerRole` sits STRICTLY ABOVE `targetRole` in the ladder — the
+ * strict counterpart of {@link hasMinRole}, which is inclusive of equal rank.
+ *
+ * The two express different rails (kywi-cms#175). Forcing a password reset on a
+ * peer is a temporary, self-serviceable nudge, so `hasMinRole` (equal-or-lower)
+ * is the right gate; SETTING a peer's password is a lateral account takeover,
+ * so that one needs this strict form. Unknown roles fall to level 0 on both
+ * sides, which fails closed here (0 > 0 is false).
+ */
+export declare function outranks(callerRole: string, targetRole: string): boolean;
 export declare function canAccessContent(role: string, action: ContentAction): boolean;
 /**
  * API-key scope → the MAXIMUM role that scope grants. A key's scopes act as a

package/dist/auth/roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,UAAU,4EAA6E,CAAA;AACpG,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAA;AAClD,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAA;AAkBnE,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAE7E;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAM1D,CAAA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAc/E"}
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,UAAU,4EAA6E,CAAA;AACpG,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAA;AAClD,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAA;AAkBnE,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAE7E;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAM1D,CAAA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAc/E"}

package/dist/auth/roles.js

@@ -16,6 +16,19 @@ const ACTION_MIN_ROLE = {
 export function hasMinRole(userRole, requiredRole) {
     return (ROLE_LEVEL[userRole] ?? 0) >= (ROLE_LEVEL[requiredRole] ?? 0);
 }
+/**
+ * True when `callerRole` sits STRICTLY ABOVE `targetRole` in the ladder — the
+ * strict counterpart of {@link hasMinRole}, which is inclusive of equal rank.
+ *
+ * The two express different rails (kywi-cms#175). Forcing a password reset on a
+ * peer is a temporary, self-serviceable nudge, so `hasMinRole` (equal-or-lower)
+ * is the right gate; SETTING a peer's password is a lateral account takeover,
+ * so that one needs this strict form. Unknown roles fall to level 0 on both
+ * sides, which fails closed here (0 > 0 is false).
+ */
+export function outranks(callerRole, targetRole) {
+    return (ROLE_LEVEL[callerRole] ?? 0) > (ROLE_LEVEL[targetRole] ?? 0);
+}
 export function canAccessContent(role, action) {
     return hasMinRole(role, ACTION_MIN_ROLE[action]);
 }

package/dist/auth/roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAA;AAIpG,MAAM,UAAU,GAA2B;IACzC,UAAU,EAAE,GAAG;IACf,SAAS,EAAE,EAAE;IACb,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,IAAI,EAAE,CAAC;CACR,CAAA;AAED,MAAM,eAAe,GAAkC;IACrD,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,QAAQ;IACjB,MAAM,EAAE,WAAW;CACpB,CAAA;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,YAAoB;IAC/D,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;AACvE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAAqB;IAClE,OAAO,UAAU,CAAC,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAA;AAClD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B;IAC7D,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,QAAQ;IACjB,KAAK,EAAE,WAAW;IAClB,SAAS,EAAE,WAAW;CACvB,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAgB;IACrE,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,IAAI,WAAW,GAAG,MAAM,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;YACzB,YAAY,GAAG,KAAK,CAAA;YACpB,WAAW,GAAG,IAAI,CAAA;QACpB,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAC7C,OAAO,UAAU,IAAI,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAA;AAC7D,CAAC"}
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAA;AAIpG,MAAM,UAAU,GAA2B;IACzC,UAAU,EAAE,GAAG;IACf,SAAS,EAAE,EAAE;IACb,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,IAAI,EAAE,CAAC;CACR,CAAA;AAED,MAAM,eAAe,GAAkC;IACrD,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,QAAQ;IACjB,MAAM,EAAE,WAAW;CACpB,CAAA;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,YAAoB;IAC/D,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;AACvE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CAAC,UAAkB,EAAE,UAAkB;IAC7D,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AACtE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAAqB;IAClE,OAAO,UAAU,CAAC,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAA;AAClD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B;IAC7D,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,QAAQ;IACjB,KAAK,EAAE,WAAW;IAClB,SAAS,EAAE,WAAW;CACvB,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAgB;IACrE,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,IAAI,WAAW,GAAG,MAAM,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;YACzB,YAAY,GAAG,KAAK,CAAA;YACpB,WAAW,GAAG,IAAI,CAAA;QACpB,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAC7C,OAAO,UAAU,IAAI,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAA;AAC7D,CAAC"}

package/dist/auth/tokens.d.ts

@@ -1,4 +1,11 @@
 import type { UserContext } from '../config/types.js';
+/**
+ * Maximum number of site UUIDs embedded in an access token's `sites` claim
+ * (kywi-cms#74). Beyond this the claim is dropped and the token carries a
+ * `sitesOverflow` marker instead; `resolveAuth` then resolves the real list
+ * from the DB, once per request.
+ */
+export declare const SITES_CLAIM_MAX = 50;
 export declare function issueAccessToken(user: UserContext, secret: string): Promise<string>;
 export declare function issueRefreshToken(userId: string, secret: string): Promise<string>;
 //# sourceMappingURL=tokens.d.ts.map

package/dist/auth/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAErD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBzF;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOvF"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAErD;;;;;GAKG;AACH,eAAO,MAAM,eAAe,KAAK,CAAA;AAEjC,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiCzF;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOvF"}

package/dist/auth/tokens.js

@@ -1,4 +1,11 @@
 import { SignJWT } from 'jose';
+/**
+ * Maximum number of site UUIDs embedded in an access token's `sites` claim
+ * (kywi-cms#74). Beyond this the claim is dropped and the token carries a
+ * `sitesOverflow` marker instead; `resolveAuth` then resolves the real list
+ * from the DB, once per request.
+ */
+export const SITES_CLAIM_MAX = 50;
 export async function issueAccessToken(user, secret) {
     const key = new TextEncoder().encode(secret);
     // Embed per-site membership (#73) as the `sites` claim so authorization needs
@@ -12,8 +19,23 @@ export async function issueAccessToken(user, secret) {
         groups: user.groups,
         type: 'access',
     };
-    if (user.siteMemberships !== undefined)
-        claims.sites = user.siteMemberships;
+    // kywi-cms#74 — cap the claim. A site UUID costs ~37 bytes before base64, so
+    // a user in hundreds of sites would inflate the Authorization header of every
+    // request they ever make. Past SITES_CLAIM_MAX, drop the list and set a
+    // `sitesOverflow` marker instead: `resolveAuth` reads the marker and resolves
+    // the real memberships from the DB (memoized per request), which is the same
+    // lookup API-key auth already does on every call. Tokens at or under the cap
+    // are unchanged, so the common install never pays for the DB round-trip.
+    //
+    // The marker is deliberately NOT "unknown memberships": an absent `sites`
+    // claim already means that. It exists so an overflowed token is
+    // distinguishable from a pre-#73 token in logs and in future readers.
+    if (user.siteMemberships !== undefined) {
+        if (user.siteMemberships.length > SITES_CLAIM_MAX)
+            claims.sitesOverflow = true;
+        else
+            claims.sites = user.siteMemberships;
+    }
     return new SignJWT(claims)
         .setProtectedHeader({ alg: 'HS256' })
         .setIssuedAt()

package/dist/auth/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAG9B,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAiB,EAAE,MAAc;IACtE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5C,8EAA8E;IAC9E,8EAA8E;IAC9E,yEAAyE;IACzE,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,MAAM,GAA4B;QACtC,GAAG,EAAE,IAAI,CAAC,EAAE;QACZ,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,QAAQ;KACf,CAAA;IACD,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,eAAe,CAAA;IAC3E,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;SACvB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,EAAE;SACb,iBAAiB,CAAC,KAAK,CAAC;SACxB,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IACpE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5C,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;SACjD,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,EAAE;SACb,iBAAiB,CAAC,IAAI,CAAC;SACvB,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC"}
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAG9B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAA;AAEjC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAiB,EAAE,MAAc;IACtE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5C,8EAA8E;IAC9E,8EAA8E;IAC9E,yEAAyE;IACzE,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,MAAM,GAA4B;QACtC,GAAG,EAAE,IAAI,CAAC,EAAE;QACZ,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,QAAQ;KACf,CAAA;IACD,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,EAAE;IACF,0EAA0E;IAC1E,gEAAgE;IAChE,sEAAsE;IACtE,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,eAAe;YAAE,MAAM,CAAC,aAAa,GAAG,IAAI,CAAA;;YACzE,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,eAAe,CAAA;IAC1C,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;SACvB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,EAAE;SACb,iBAAiB,CAAC,KAAK,CAAC;SACxB,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IACpE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5C,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;SACjD,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,EAAE;SACb,iBAAiB,CAAC,IAAI,CAAC;SACvB,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC"}

package/dist/ax/content-source.d.ts

@@ -9,8 +9,16 @@ import type { AxContentSource } from './types.js';
  * generators need. Fixtures implement the same interface for unit tests, so the
  * generators never depend on a database.
  *
- * @param config reserved for future curation the DB source may need; currently
- *   the source derives everything it needs from the DB directly.
+ * It is also where the LAYOUT PROJECTION is computed (kywi-cms#195). A page
+ * built in the layout editor keeps its copy in `layout`, and serializing that
+ * faithfully needs two things only this layer has: the site's module registry
+ * (so CUSTOM modules serialize from their declared prop schema) and its saved
+ * component definitions (so a linked placement projects what it renders). The
+ * result rides on the node as `layoutHtml`, which keeps every generator pure and
+ * synchronous — a fixture that supplies a `body` or a plain `layout` still
+ * exercises the same code.
+ *
+ * @param config supplies `modules` for the registry. Omitted → built-ins only.
  */
 export declare function createDbAxContentSource(db: KywiDb, config?: KywiConfig): AxContentSource;
 //# sourceMappingURL=content-source.d.ts.map

package/dist/ax/content-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"content-source.d.ts","sourceRoot":"","sources":["../../src/ax/content-source.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,KAAK,EAAE,eAAe,EAAc,MAAM,YAAY,CAAA;AAE7D;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,eAAe,CAiBxF"}
+{"version":3,"file":"content-source.d.ts","sourceRoot":"","sources":["../../src/ax/content-source.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,KAAK,EAAiB,eAAe,EAAc,MAAM,YAAY,CAAA;AAE5E;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,eAAe,CA0CxF"}

package/dist/ax/content-source.js

@@ -1,5 +1,9 @@
 import { listPublishedForAx } from '../db/ax-queries.js';
 import { getSiteById } from '../db/site-queries.js';
+import { listComponents } from '../db/component-queries.js';
+import { componentDetachSource } from '../layout/component-refs.js';
+import { createModuleRegistry } from '../layout/registry.js';
+import { withLayoutHtml } from './effective-body.js';
 /**
  * Production `AxContentSource` — the single read path backing every generator.
  *
@@ -8,14 +12,47 @@ import { getSiteById } from '../db/site-queries.js';
  * generators need. Fixtures implement the same interface for unit tests, so the
  * generators never depend on a database.
  *
- * @param config reserved for future curation the DB source may need; currently
- *   the source derives everything it needs from the DB directly.
+ * It is also where the LAYOUT PROJECTION is computed (kywi-cms#195). A page
+ * built in the layout editor keeps its copy in `layout`, and serializing that
+ * faithfully needs two things only this layer has: the site's module registry
+ * (so CUSTOM modules serialize from their declared prop schema) and its saved
+ * component definitions (so a linked placement projects what it renders). The
+ * result rides on the node as `layoutHtml`, which keeps every generator pure and
+ * synchronous — a fixture that supplies a `body` or a plain `layout` still
+ * exercises the same code.
+ *
+ * @param config supplies `modules` for the registry. Omitted → built-ins only.
  */
 export function createDbAxContentSource(db, config) {
-    void config;
+    const registry = createModuleRegistry(config?.modules ?? []);
+    async function projectionOpts(siteId) {
+        return { modules: registry, resolveComponent: await buildComponentResolver(db, siteId) };
+    }
     return {
-        listForSite(siteId) {
-            return listPublishedForAx(db, siteId);
+        async listForSite(siteId) {
+            const nodes = await listPublishedForAx(db, siteId);
+            // Only pay for the components read when something would actually use it.
+            if (!nodes.some(needsLayoutProjection))
+                return nodes;
+            const opts = await projectionOpts(siteId);
+            return nodes.map(node => (needsLayoutProjection(node) ? withLayoutHtml(node, opts) : node));
+        },
+        /**
+         * One node by slug, projecting ONE layout.
+         *
+         * `/<path>.md` used to call `listForSite` and `.find()` the node it wanted,
+         * which projected every page's layout — on an uncached route — to answer for
+         * one (kywi-cms#195 review). The read is still the same single query; only
+         * the projection is narrowed.
+         */
+        async getForSite(siteId, slug) {
+            const nodes = await listPublishedForAx(db, siteId);
+            const node = nodes.find(n => n.slug === slug);
+            if (!node)
+                return null;
+            if (!needsLayoutProjection(node))
+                return node;
+            return withLayoutHtml(node, await projectionOpts(siteId));
         },
         async getSiteMeta(siteId) {
             const site = await getSiteById(db, siteId);
@@ -30,4 +67,43 @@ export function createDbAxContentSource(db, config) {
         },
     };
 }
+function needsLayoutProjection(node) {
+    // A node the editor marked "exclude from search & AX" is filtered out of every
+    // surface that would read the projection, so building it is pure cost — and on
+    // a site that excludes most of its tree, it is the cost that decides whether
+    // the components read happens at all.
+    if (node.excludeFromSearch === true)
+        return false;
+    if (typeof node.body === 'string' && node.body.trim())
+        return false;
+    return Boolean(node['layout']);
+}
+/**
+ * One read of the site's components, indexed by id AND by name, projected
+ * through {@link componentDetachSource} — the same projection the renderer and
+ * detach use, so the AX corpus shows what a placement actually draws.
+ *
+ * Name doubles as the `component` module's `slug` prop: `kywi_components` has no
+ * slug column, and a placement written before ids were stored addresses its
+ * target by name.
+ */
+async function buildComponentResolver(db, siteId) {
+    const byId = new Map();
+    const byName = new Map();
+    const rows = await listComponents(db, siteId);
+    for (const row of rows) {
+        const source = componentDetachSource(row);
+        byId.set(row.id, source);
+        if (row.name && !byName.has(row.name))
+            byName.set(row.name, source);
+    }
+    return ({ componentId, slug }) => {
+        if (componentId) {
+            const byIdHit = byId.get(componentId);
+            if (byIdHit)
+                return byIdHit;
+        }
+        return slug ? byName.get(slug) ?? null : null;
+    };
+}
 //# sourceMappingURL=content-source.js.map

package/dist/ax/content-source.js.map

@@ -1 +1 @@
-{"version":3,"file":"content-source.js","sourceRoot":"","sources":["../../src/ax/content-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAKnD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,EAAU,EAAE,MAAmB;IACrE,KAAK,MAAM,CAAA;IACX,OAAO;QACL,WAAW,CAAC,MAAc;YACxB,OAAO,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACvC,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,MAAc;YAC9B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;YAC1C,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAA;YACtB,OAAO;gBACL,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"content-source.js","sourceRoot":"","sources":["../../src/ax/content-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAEnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAMpD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,uBAAuB,CAAC,EAAU,EAAE,MAAmB;IACrE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,CAAA;IAE5D,KAAK,UAAU,cAAc,CAAC,MAAc;QAC1C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAA;IAC1F,CAAC;IAED,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,MAAc;YAC9B,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;YAClD,yEAAyE;YACzE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC;gBAAE,OAAO,KAAK,CAAA;YACpD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAA;YACzC,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;QAC7F,CAAC;QAED;;;;;;;WAOG;QACH,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,IAAY;YAC3C,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;YAClD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;YAC7C,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAA;YACtB,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAA;YAC7C,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3D,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,MAAc;YAC9B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;YAC1C,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAA;YACtB,OAAO;gBACL,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAmB;IAChD,+EAA+E;IAC/E,+EAA+E;IAC/E,6EAA6E;IAC7E,sCAAsC;IACtC,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACjD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAA;IACnE,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,sBAAsB,CAAC,EAAU,EAAE,MAAc;IAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAiC,CAAA;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAA;IACvD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IAC7C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACxB,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE;QAC/B,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YACrC,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAA;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IAC/C,CAAC,CAAA;AACH,CAAC"}

package/dist/ax/effective-body.d.ts

@@ -0,0 +1,28 @@
+import type { LayoutToHtmlOptions } from './layout-to-html.js';
+import type { AxContentNode } from './types.js';
+/**
+ * THE one answer to "what is this node's body copy", for every AX surface
+ * (kywi-cms#195).
+ *
+ * Resolution order:
+ *   1. the stored `body` column, when it holds anything — an article written in
+ *      the rich-text field is already the whole page;
+ *   2. `layoutHtml`, the layout projection the AX CONTENT SOURCE precomputed
+ *      (it is the only layer that can hand `layoutToHtml` the site's module
+ *      registry and its saved component definitions);
+ *   3. a direct {@link layoutToHtml} of the node's stored `layout`, so a node
+ *      handed straight to a generator — per-page JSON-LD reads the node the
+ *      public page rendered, not one this module's source produced — still
+ *      exports every built-in module's copy.
+ *
+ * Returns `''` when the node has neither, leaving each caller's own fallback
+ * (`summary`, `metaDescription`) exactly where it was.
+ */
+export declare function effectiveBodyHtml(node: AxContentNode, opts?: LayoutToHtmlOptions): string;
+/**
+ * Attach {@link AxContentNode.layoutHtml} to a node whose `body` is empty, using
+ * the registry/component resolver the caller has. A node with a body, or with no
+ * layout, is returned untouched — the projection would never be read.
+ */
+export declare function withLayoutHtml(node: AxContentNode, opts: LayoutToHtmlOptions): AxContentNode;
+//# sourceMappingURL=effective-body.d.ts.map

package/dist/ax/effective-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"effective-body.d.ts","sourceRoot":"","sources":["../../src/ax/effective-body.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,MAAM,CAMzF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,mBAAmB,GAAG,aAAa,CAM5F"}