auth

The auth block lives INSIDE cms (cms.auth), in the site’s settings.json: users, sessions and roles are PER SITE — each site has its own users table and its own admin. Sign-in exists only for the admin zone. No cms block — no users table, no /cms/login, no authenticated zone at all. Sign-in uses OPAQUE: the password never reaches the server, so there is nothing to leak or seed — an empty users table bootstraps a fresh admin with a generated password printed once to the console.

Sign-in rate limits and flood caps are NOT configurable on purpose — they are fixed in the engine, a config typo cannot weaken them.

This site's block:

"cms": {
  "auth": { "session_ttl_minutes": 120, "cookie_name": "cms_session" },
  ...
}

New users are created via invite links (admin → Users; the link is valid 24 hours, single use). Any signed-in user can change their password from the admin index page.