@jini-ai/admin 0.6.15-rc.1 → 0.6.15-rc.2

package/dist/forms/html-rules.js

@@ -1,4 +1,4 @@
-import { FIELD_TYPE_REGISTRY } from "@jini-ai/cms/forms";
+import { FIELD_TYPE_REGISTRY, escapeFormHtml } from "@jini-ai/cms/forms";
 /** Persisted descriptors, including those derived from HTML, supply column headers, choice labels and field types. */
 export function formAnswerColumns({ fields }, display = {}) {
     return fields.map((field) => {
@@ -85,9 +85,6 @@ export function formSubmissionRows({ data, answerColumns }, { unknownFieldLabel
         return { key, label: column?.header.trim() || unknownFieldLabel, value: formatted, file: formAnswerFile({ value }) };
     });
 }
-function escapeHtml(value) {
-    return value.replace(/[&<>"']/g, (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[char]);
-}
 const kindOf = (type) => Object.hasOwn(FIELD_TYPE_REGISTRY, type) ? FIELD_TYPE_REGISTRY[type] : { control: "input", htmlType: "text" };
 const isDefault = (field, value) => Array.isArray(field.default) ? field.default.includes(value) : field.default === value;
 /** Name, required and the stored constraints, as authored HTML attributes the CMS reads back. */
@@ -97,13 +94,13 @@ function starterAttributes(field, kind) {
         ["pattern", field.pattern], ["min", field.min], ["max", field.max], ["step", field.step], ["accept", field.accept?.join(",")],
         ...Object.entries(kind.attributes ?? {}),
     ];
-    return `name="${escapeHtml(field.id)}"${field.required ? " required" : ""}` +
-        constraints.filter(([, value]) => value != null && value !== "").map(([name, value]) => ` ${name}="${escapeHtml(String(value))}"`).join("");
+    return `name="${escapeFormHtml({ value: field.id })}"${field.required ? " required" : ""}` +
+        constraints.filter(([, value]) => value != null && value !== "").map(([name, value]) => ` ${name}="${escapeFormHtml({ value: String(value) })}"`).join("");
 }
 /** One field's starter markup; every control comes from the registry kind, as the public render does. */
 function starterField(field) {
     const kind = kindOf(field.type);
-    return starterRendererFor({ kind })({ field, kind, label: escapeHtml(field.label), attrs: starterAttributes(field, kind) });
+    return starterRendererFor({ kind })({ field, kind, label: escapeFormHtml({ value: field.label }), attrs: starterAttributes(field, kind) });
 }
 function starterRendererFor({ kind }) {
     if (kind.control === "group")
@@ -113,7 +110,7 @@ function starterRendererFor({ kind }) {
     if (kind.control === "textarea")
         return ({ label, attrs }) => `<label>${label}\n  <textarea ${attrs}></textarea>\n</label>`;
     if (kind.htmlType === "hidden")
-        return ({ field, label, attrs }) => `<input type="hidden" ${attrs} value="${escapeHtml(String(field.default ?? ""))}" aria-label="${label}">`;
+        return ({ field, label, attrs }) => `<input type="hidden" ${attrs} value="${escapeFormHtml({ value: String(field.default ?? "") })}" aria-label="${label}">`;
     if (kind.htmlType === "checkbox")
         return starterCheckbox;
     return ({ label, attrs }) => `<label>${label}\n  <input type="${kind.htmlType}" ${attrs}>\n</label>`;
@@ -123,16 +120,16 @@ function starterGroup({ field, kind, label, attrs }) {
     // Native `required` on every checkbox would demand ALL of them, so a checkbox group leaves it
     // off (the server still enforces one-or-more); a radio group's `required` means "pick one".
     const boxAttrs = kind.multiple ? starterAttributes({ ...field, required: false }, kind) : attrs;
-    const boxes = (field.options ?? []).map((option) => `  <label><input type="${kind.htmlType}" ${boxAttrs} value="${escapeHtml(option.value)}"${isDefault(field, option.value) ? " checked" : ""}> ${escapeHtml(option.label)}</label>`);
+    const boxes = (field.options ?? []).map((option) => `  <label><input type="${kind.htmlType}" ${boxAttrs} value="${escapeFormHtml({ value: option.value })}"${isDefault(field, option.value) ? " checked" : ""}> ${escapeFormHtml({ value: option.label })}</label>`);
     return `<fieldset>\n  <legend>${label}</legend>\n${boxes.join("\n")}\n</fieldset>`;
 }
 function starterSelect({ field, kind, label, attrs }) {
-    const empty = kind.multiple ? [] : [`    <option value="">${escapeHtml(field.placeholder ?? "Choose an option")}</option>`];
-    const choices = (field.options ?? []).map((option) => `    <option value="${escapeHtml(option.value)}"${isDefault(field, option.value) ? " selected" : ""}>${escapeHtml(option.label)}</option>`);
+    const empty = kind.multiple ? [] : [`    <option value="">${escapeFormHtml({ value: field.placeholder ?? "Choose an option" })}</option>`];
+    const choices = (field.options ?? []).map((option) => `    <option value="${escapeFormHtml({ value: option.value })}"${isDefault(field, option.value) ? " selected" : ""}>${escapeFormHtml({ value: option.label })}</option>`);
     return `<label>${label}\n  <select ${attrs}${kind.multiple ? " multiple" : ""}>\n${[...empty, ...choices].join("\n")}\n  </select>\n</label>`;
 }
 function starterCheckbox({ field, label, attrs }) {
-    const value = field.checkboxValue !== undefined ? ` value="${escapeHtml(field.checkboxValue)}"` : "";
+    const value = field.checkboxValue !== undefined ? ` value="${escapeFormHtml({ value: field.checkboxValue })}"` : "";
     const checked = field.default === true || (field.checkboxValue !== undefined && field.default === field.checkboxValue) ? " checked" : "";
     return `<label><input type="checkbox"${field.type === "toggle" ? ' role="switch"' : ""} ${attrs}${value}${checked}> ${label}</label>`;
 }
@@ -144,7 +141,7 @@ function starterCheckbox({ field, label, attrs }) {
  * @complexity O(f + o) for fields and their options; no I/O.
  */
 export function formHtmlStarter({ fields }, { submitLabel = "Send" } = {}) {
-    return fields.map(starterField).join("\n\n") + `\n\n<button type="submit">${escapeHtml(submitLabel)}</button>`;
+    return fields.map(starterField).join("\n\n") + `\n\n<button type="submit">${escapeFormHtml({ value: submitLabel })}</button>`;
 }
 export function formHtmlEmbed({ slug }, _optional = {}) {
     const config = JSON.stringify({ type: "form", id: slug, mode: "html" }).replace(/'/g, "&#39;");

package/dist/media/html-attributes.d.ts

@@ -1,13 +1,6 @@
-/** Browser-only live metadata hint, separate from server validation across the browser/Node
- * boundary. The server must enforce the same policy on writes and rendering independently.
- * Hints never gate Save: an invalid attribute once silently blocked saving unrelated title/alt/
- * caption/credit/class changes. Rejections must instead reach the authoritative atomic write.
- * One flat allowlist includes global and image/video extras: per-element name filtering is
- * unnecessary because an unused loading attribute on a wrapper is harmless. Extend the list,
- * not the tokenizer, when adding an allowed name. data-/aria- families remain open-ended. */
 export declare const MEDIA_HTML_ATTRIBUTE_ALLOWED_NAMES: readonly ["class", "id", "style", "title", "role", "tabindex", "lang", "dir", "hidden", "translate", "draggable", "loading", "decoding", "playsinline", "muted", "loop", "autoplay", "poster"];
 /** Whether `name` is on the allowlist — a well-formed attribute name
- *  ({@link MEDIA_HTML_ATTRIBUTE_NAME_PATTERN}) that is either an exact match against
+ *  (`/^[a-z][a-z0-9-]*$/`) that is either an exact match against
  *  {@link MEDIA_HTML_ATTRIBUTE_ALLOWED_NAMES} or carries a `data-`/`aria-` prefix (both open-ended
  *  families with no fixed suffix list). Case-insensitive: HTML attribute names are themselves
  *  case-insensitive, and an operator typing `DATA-FOO` should not slip past a lowercase-only check.

package/dist/media/html-attributes.js

@@ -5,44 +5,10 @@
  * One flat allowlist includes global and image/video extras: per-element name filtering is
  * unnecessary because an unused loading attribute on a wrapper is harmless. Extend the list,
  * not the tokenizer, when adding an allowed name. data-/aria- families remain open-ended. */
-export const MEDIA_HTML_ATTRIBUTE_ALLOWED_NAMES = [
-    // Global attributes (2026-09-23).
-    "class",
-    "id",
-    "style",
-    "title",
-    "role",
-    "tabindex",
-    "lang",
-    "dir",
-    "hidden",
-    "translate",
-    "draggable",
-    // Pre-existing <img>/<video> extras, kept everywhere (one list, not one per element).
-    "loading",
-    "decoding",
-    "playsinline",
-    "muted",
-    "loop",
-    "autoplay",
-    "poster",
-];
-/**
- * The shape EVERY accepted attribute name must have, checked before allowlist membership
- * (2026-09-07 stored-XSS fix; keep identical in `@jini-ai/cms/media`'s `html-attributes.ts` — see
- * that file's copy of this comment for the full incident).
- *
- * The `data-`/`aria-` families below are open-ended by design — no fixed suffix list — so the
- * prefix check alone accepted whatever characters {@link HTML_ATTRIBUTE_TOKEN}'s name class
- * (`[^\s="']+`, which excludes only whitespace, `=` and quotes) let through. `<`, `>` and `/` are
- * all legal in that class, and the server renderer templating a name into ` name="value"` escapes
- * only the VALUE — so a stored `data-x><svg/onload=alert(1)` closed the `<img>` and opened a live
- * `<svg onload>` on the public page. Constraining the NAME to the characters a real HTML attribute
- * name can contain is what makes "the value is escaped" sufficient.
- */
-const MEDIA_HTML_ATTRIBUTE_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
+import { EMBED_HTML_ATTRIBUTE_ALLOWED_NAMES, isAllowedEmbedHtmlAttributeName, parseEmbedHtmlAttributes, } from "@jini-ai/cms/widgets/markers";
+export const MEDIA_HTML_ATTRIBUTE_ALLOWED_NAMES = EMBED_HTML_ATTRIBUTE_ALLOWED_NAMES;
 /** Whether `name` is on the allowlist — a well-formed attribute name
- *  ({@link MEDIA_HTML_ATTRIBUTE_NAME_PATTERN}) that is either an exact match against
+ *  (`/^[a-z][a-z0-9-]*$/`) that is either an exact match against
  *  {@link MEDIA_HTML_ATTRIBUTE_ALLOWED_NAMES} or carries a `data-`/`aria-` prefix (both open-ended
  *  families with no fixed suffix list). Case-insensitive: HTML attribute names are themselves
  *  case-insensitive, and an operator typing `DATA-FOO` should not slip past a lowercase-only check.
@@ -51,82 +17,7 @@ const MEDIA_HTML_ATTRIBUTE_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
  * one fixed-length array lookup.
  */
 export function isAllowedMediaHtmlAttributeName({ name }, _optional = {}) {
-    const lower = name.toLowerCase();
-    if (!MEDIA_HTML_ATTRIBUTE_NAME_PATTERN.test(lower))
-        return false;
-    if (lower.startsWith("data-") || lower.startsWith("aria-"))
-        return true;
-    return MEDIA_HTML_ATTRIBUTE_ALLOWED_NAMES.includes(lower);
-}
-/** Matches one `name`, or one `name="value"`/`name='value'`/`name=value` pair — the same loose
- *  shape real HTML attribute syntax allows, since that is the syntax an operator typing this field
- *  would naturally reach for. */
-const HTML_ATTRIBUTE_TOKEN = /([^\s="']+)(?:=(?:"([^"]*)"|'([^']*)'|([^\s"']+)))?/g;
-/** The highest ASCII code point {@link isUnsafeMediaUrlValue} strips: every C0 control character
- *  plus the ordinary space, i.e. code points `0`-`32` inclusive. Named rather than written as an
- *  inline regex control-character range so the linter never has to reason about a literal control
- *  character inside a pattern. Ported from the shared server parser, `html-attributes.ts`. */
-const ASCII_WHITESPACE_OR_CONTROL_MAX_CODE_POINT = 0x20;
-/**
- * Whether `value`'s scheme, once every ASCII whitespace/control character (code points `0`-`32`) is
- * stripped and the result lowercased, starts with `javascript:`, `vbscript:` or `data:` — the three
- * schemes a browser will still execute or navigate to even when the URL carries interior whitespace
- * a naive end-trim (the old `.trim()`-only check) would miss, e.g. `java\tscript:x`: browsers strip
- * tabs and newlines from inside a URL before parsing its scheme, so this check must too. Ported
- * 2026-09-23 from the shared server parser's `isUnsafeUrlValue` (`html-attributes.ts`).
- *
- * @complexity O(n) in the value's length (one filter pass, one prefix test).
- */
-function isUnsafeMediaUrlValue(value) {
-    let stripped = "";
-    for (const char of value) {
-        // `char` is never empty, so `charCodeAt(0)` is always a number; for an astral character it is
-        // the high surrogate (>= 0xD800), which is kept exactly as the full code point would be.
-        if (char.charCodeAt(0) > ASCII_WHITESPACE_OR_CONTROL_MAX_CODE_POINT)
-            stripped += char;
-    }
-    stripped = stripped.toLowerCase();
-    return stripped.startsWith("javascript:") || stripped.startsWith("vbscript:") || stripped.startsWith("data:");
-}
-/**
- * Whether a `style` value carries a known CSS injection or CSS-escape-bypass vector:
- * `expression(...)` (legacy IE script-in-CSS), a `javascript:`/`vbscript:` value inside a CSS
- * `url(...)`, `-moz-binding`/`behavior:` (XBL/HTC script bindings), `@import` (pulls in a second,
- * unvetted stylesheet), or ANY backslash — a CSS escape sequence (`\65` is `e`) can respell any of
- * the above past a plain substring check, so a backslash anywhere in the value is rejected outright.
- * Plain `url(...)` values (background images) are otherwise allowed. Ported 2026-09-23 from the
- * shared server parser's `isUnsafeStyleValue` (`html-attributes.ts`).
- *
- * @complexity O(n) in the value's length (one regex test).
- */
-const UNSAFE_MEDIA_STYLE_PATTERN = /expression\(|javascript:|vbscript:|-moz-binding|behavior:|@import|\\/i;
-function isUnsafeMediaStyleValue(value) {
-    return UNSAFE_MEDIA_STYLE_PATTERN.test(value);
-}
-/** Classifies one already-tokenized `name`/`value` pair. Split out of {@link parseMediaHtmlAttributes}
- *  so each rejection reason is its own directly testable branch, and so the loop below reads as
- *  "tokenize, then classify" rather than one function doing both.
- *
- * Order matters (ported 2026-09-23 from the shared server parser's `classifyEmbedHtmlAttributeToken`):
- * `on*` is checked FIRST (so an `onerror` always reports as `event-handler`, the more actionable
- * reason, never the generic `disallowed-name`), then the URL-scheme check runs against EVERY value
- * regardless of name (matching the pre-existing `javascript:` check this is ported from), then
- * allowlist membership, then — only for an already-allowed `style` — the CSS-specific unsafe-value
- * check.
- *
- * @complexity O(1) — four fixed checks against one already-extracted token; each check's own O(n) in
- * the token's length is linear, not nested.
- */
-function classifyMediaHtmlAttributeToken(name, value) {
-    if (name.startsWith("on"))
-        return { reason: "event-handler", attribute: name };
-    if (isUnsafeMediaUrlValue(value))
-        return { reason: "unsafe-url", attribute: name };
-    if (!isAllowedMediaHtmlAttributeName({ name }))
-        return { reason: "disallowed-name", attribute: name };
-    if (name === "style" && isUnsafeMediaStyleValue(value))
-        return { reason: "unsafe-style", attribute: name };
-    return null;
+    return isAllowedEmbedHtmlAttributeName({ name });
 }
 /**
  * Parses the `HTML attributes` field's free text (`name="value" name2="value2"`, or a bare
@@ -154,54 +45,8 @@ function classifyMediaHtmlAttributeToken(name, value) {
  *   attributes plus O(e) for e rejected tokens.
  */
 export function parseMediaHtmlAttributes({ text }, _optional = {}) {
-    const trimmed = text.trim();
-    if (trimmed === "")
-        return { attributes: {}, errors: [], error: null };
-    const attributes = {};
-    const errors = [];
-    HTML_ATTRIBUTE_TOKEN.lastIndex = 0;
-    let consumed = 0;
-    // A `for` loop (rather than `while ((match = …exec(trimmed)) !== null)`) keeps every assignment
-    // to `match` in statement position, never inside the loop's own test expression.
-    for (let match = HTML_ATTRIBUTE_TOKEN.exec(trimmed); match !== null; match = HTML_ATTRIBUTE_TOKEN.exec(trimmed)) {
-        // Non-whitespace text between the previous match and this one is a fragment the token pattern
-        // could not parse as a name (e.g. a stray quote) — the tokenizer has lost sync, so everything
-        // parsed so far is discarded rather than trusted.
-        const skipped = trimmed.slice(consumed, match.index).trim();
-        if (skipped !== "")
-            return malformedMediaHtmlAttributes({ errors, fragment: skipped });
-        consumed = match.index + match[0].length;
-        const { name, value } = readMediaHtmlAttributeToken({ match });
-        const rejection = classifyMediaHtmlAttributeToken(name, value);
-        if (rejection) {
-            errors.push(rejection);
-            continue;
-        }
-        attributes[name] = value;
-    }
-    const trailing = trimmed.slice(consumed).trim();
-    if (trailing !== "")
-        return malformedMediaHtmlAttributes({ errors, fragment: trailing });
-    return { attributes, errors, error: errors[0] ?? null };
-}
-/** The lowercased name and the value of one {@link HTML_ATTRIBUTE_TOKEN} match: whichever of the
- *  double-quoted, single-quoted or unquoted value groups matched, or `""` for a bare boolean name.
- *
- * @complexity O(n) in the name's length (one lowercase pass).
- */
-function readMediaHtmlAttributeToken({ match }, _optional = {}) {
-    return { name: match[1].toLowerCase(), value: match[2] ?? match[3] ?? match[4] ?? "" };
-}
-/** The fail-closed result once the tokenizer loses sync: `fragment` (already trimmed) is appended
- *  to `errors` as the final `malformed` entry, and every accepted attribute is discarded — see
- *  {@link parseMediaHtmlAttributes}'s header for why. Mutates `errors` (the caller's own list).
- *
- * @complexity O(1).
- */
-function malformedMediaHtmlAttributes({ errors, fragment }, _optional = {}) {
-    const malformed = { reason: "malformed", attribute: fragment };
-    errors.push(malformed);
-    return { attributes: {}, errors, error: malformed };
+    // Media hints always use inline-attribute policy; stylesheet escape allowances do not apply.
+    return parseEmbedHtmlAttributes({ text });
 }
 /** The hint names the rejected token so operators can distinguish a typo from a hard no.
  * This is client feedback only; the server must independently enforce write/render policy. */

package/dist/seo/react/hooks/SeoPage.hooks.d.ts

@@ -1,4 +1,4 @@
-import type { FormEvent, ComponentType } from 'react';
+import type { FormEvent } from 'react';
 import type { TabBarTab } from '@jini-ai/ui/tab-strip';
 import type { SeoTranslator, SeoSettingsPatch, SeoSettings, SeoEntryAnalysis } from '../../models.js';
 export { buildSeoSettingsPatch, resolveSeoTabId } from '../../rules.js';
@@ -47,24 +47,4 @@ export interface SeoTabController {
     regenerateSitemap: () => void;
     openSitemapModal: () => void;
 }
-/** Panel selection is presentation dispatch; this never changes the defaults form's field set. */
-export declare function seoTabPanel({ activeTabId, controller, components }: {
-    activeTabId: import('../../rules.js').SeoTabId;
-    controller: SeoTabController;
-    components: {
-        SeoDefaultsTab: ComponentType<{
-            controller: SeoTabController;
-        }>;
-        SeoSitemapTab: ComponentType<{
-            controller: SeoTabController;
-        }>;
-        SeoEntrySection: ComponentType<{
-            locale: string;
-        }>;
-    };
-}, _optional?: Record<string, never>): import("react").ReactElement<{
-    controller: SeoTabController;
-}, string | import("react").JSXElementConstructor<any>> | import("react").ReactElement<{
-    locale: string;
-}, string | import("react").JSXElementConstructor<any>>;
 //# sourceMappingURL=SeoPage.hooks.d.ts.map

package/dist/seo/react/hooks/SeoPage.hooks.js

@@ -26,12 +26,4 @@ export function useAnalyzePanel({ analysis }, _optional = {}) {
 export function useSeoDefaults({ save }, _optional = {}) {
     return { submit: (event) => { event.preventDefault(); void save(buildSeoSettingsPatch({ form: new FormData(event.currentTarget) })); } };
 }
-/** Panel selection is presentation dispatch; this never changes the defaults form's field set. */
-export function seoTabPanel({ activeTabId, controller, components }, _optional = {}) {
-    if (activeTabId === 'sitemap')
-        return createElement(components.SeoSitemapTab, { controller });
-    if (activeTabId === 'entries')
-        return createElement(components.SeoEntrySection, { locale: controller.locale });
-    return createElement(components.SeoDefaultsTab, { controller });
-}
 //# sourceMappingURL=SeoPage.hooks.js.map

package/dist/seo/react/pages/SeoPage.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
-import { useAnalyzePanel, useSeoDefaults, useSeoTabs, seoTabPanel } from "../hooks/SeoPage.hooks.js";
+import { useAnalyzePanel, useSeoDefaults, useSeoTabs } from "../hooks/SeoPage.hooks.js";
 import { agentHandle } from "@jini-ai/agentic";
 import { TabBar } from "@jini-ai/ui/tab-strip";
 import { InfoTip, Select } from "@jini-ai/ui/admin-widgets";
@@ -230,7 +230,15 @@ export function Seo({ tabId, onTabChange, useSeoHook = useWiredSeo } = {}) {
         regenerateSitemap,
         openSitemapModal,
     };
-    return (_jsxs("div", { className: "jini-page jini-seo-page", children: [_jsxs("div", { className: "jini-page-header", children: [_jsxs("div", { className: "jini-page-header-text", children: [_jsx("p", { className: "jini-page-kicker", children: t({ locale: locale, key: "Marketing" }) }), _jsx("h1", { className: "jini-page-title", children: "SEO" }), _jsx("p", { className: "jini-page-description", children: t({ locale: locale, key: "Site-wide defaults for meta titles, descriptions, social previews, and robots directives." }) })] }), _jsx("div", { className: "jini-page-actions", children: headerActions })] }), error ? _jsx("div", { className: "jini-notice jini-notice-error", children: error }) : null, notice ? _jsx("div", { className: "jini-notice", children: notice }) : null, _jsx(TabBar, { ariaLabel: "SEO", tabs: tabs, activeId: activeTabId, onChange: changeTab, containerHandle: "seo-tab-bar" }), seoTabPanel({ activeTabId, controller, components: { SeoDefaultsTab, SeoSitemapTab, SeoEntrySection } }), sitemapModalOpen ? (_jsx(SitemapModal, { locale: locale, sitemapEnabled: settings.sitemapEnabled, regenerating: saving, onRegenerate: regenerateSitemap, onClose: closeSitemapModal })) : null] }));
+    return (_jsxs("div", { className: "jini-page jini-seo-page", children: [_jsxs("div", { className: "jini-page-header", children: [_jsxs("div", { className: "jini-page-header-text", children: [_jsx("p", { className: "jini-page-kicker", children: t({ locale: locale, key: "Marketing" }) }), _jsx("h1", { className: "jini-page-title", children: "SEO" }), _jsx("p", { className: "jini-page-description", children: t({ locale: locale, key: "Site-wide defaults for meta titles, descriptions, social previews, and robots directives." }) })] }), _jsx("div", { className: "jini-page-actions", children: headerActions })] }), error ? _jsx("div", { className: "jini-notice jini-notice-error", children: error }) : null, notice ? _jsx("div", { className: "jini-notice", children: notice }) : null, _jsx(TabBar, { ariaLabel: "SEO", tabs: tabs, activeId: activeTabId, onChange: changeTab, containerHandle: "seo-tab-bar" }), seoTabPanel({ activeTabId, controller }), sitemapModalOpen ? (_jsx(SitemapModal, { locale: locale, sitemapEnabled: settings.sitemapEnabled, regenerating: saving, onRegenerate: regenerateSitemap, onClose: closeSitemapModal })) : null] }));
+}
+/** Panel selection is presentation dispatch; this never changes the defaults form's field set. */
+function seoTabPanel({ activeTabId, controller }, _optional = {}) {
+    if (activeTabId === 'sitemap')
+        return _jsx(SeoSitemapTab, { controller: controller });
+    if (activeTabId === 'entries')
+        return _jsx(SeoEntrySection, { locale: controller.locale });
+    return _jsx(SeoDefaultsTab, { controller: controller });
 }
 export { Seo as SeoPage };
 export default Seo;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/admin",
-  "version": "0.6.15-rc.1",
+  "version": "0.6.15-rc.2",
   "description": "Composable admin surface for Jini-hosted products: framework-free contracts, panel registry, and route model in `/core`; React shell and panels in `/react`. Import only the layers you need.",
   "license": "Apache-2.0",
   "repository": {
@@ -448,12 +448,12 @@
   "peerDependencies": {
     "react": "^18.3.0 || ^19.0.0",
     "react-dom": "^18.3.0 || ^19.0.0",
-    "@jini-ai/agentic": "^0.6.15-rc.1",
-    "@jini-ai/ui": "^0.6.15-rc.1",
-    "@jini-ai/ui-kit": "^0.6.15-rc.1",
-    "@jini-ai/agent-plugins": "^0.6.15-rc.1",
-    "@jini-ai/cms": "^0.6.15-rc.1",
-    "@jini-ai/core": "^0.6.15-rc.1"
+    "@jini-ai/agentic": "^0.6.15-rc.2",
+    "@jini-ai/ui": "^0.6.15-rc.2",
+    "@jini-ai/ui-kit": "^0.6.15-rc.2",
+    "@jini-ai/agent-plugins": "^0.6.15-rc.2",
+    "@jini-ai/cms": "^0.6.15-rc.2",
+    "@jini-ai/core": "^0.6.15-rc.2"
   },
   "peerDependenciesMeta": {
     "react": {
@@ -491,12 +491,12 @@
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
     "@testing-library/user-event": "^14.6.1",
-    "@jini-ai/ui": "^0.6.15-rc.1",
-    "@jini-ai/ui-kit": "^0.6.15-rc.1",
-    "@jini-ai/core": "^0.6.15-rc.1",
-    "@jini-ai/agentic": "^0.6.15-rc.1",
-    "@jini-ai/cms": "^0.6.15-rc.1",
-    "@jini-ai/agent-plugins": "^0.6.15-rc.1"
+    "@jini-ai/agentic": "^0.6.15-rc.2",
+    "@jini-ai/core": "^0.6.15-rc.2",
+    "@jini-ai/agent-plugins": "^0.6.15-rc.2",
+    "@jini-ai/cms": "^0.6.15-rc.2",
+    "@jini-ai/ui": "^0.6.15-rc.2",
+    "@jini-ai/ui-kit": "^0.6.15-rc.2"
   },
   "typesVersions": {
     "*": {