@reblu/site-next 1.3.1 → 1.4.0

package/README.md

@@ -1,6 +1,6 @@
 # @reblu/site-next
 
-Next.js glue for Reblu SITEs (REB-418, REB-510). Three responsibilities, all
+Next.js glue for Reblu SITEs (REB-418, REB-510). Four responsibilities, all
 intentionally Next-coupled so the lower SDK layers —
 [`@reblu/site-client`](../site-client), [`@reblu/site-contracts`](../site-contracts),
 [`@reblu/site-ui`](../site-ui) — stay framework-agnostic:
@@ -13,6 +13,8 @@ intentionally Next-coupled so the lower SDK layers —
    client auth components (`LoginForm`, password reset, set-password,
    email confirm, MFA step-up, `AuthLogo`) and the server-only Route Handler
    factory that proxies them to base-api's `/api/site/auth/*`.
+4. **`<JsonLd>`** (`./json-ld`) — safe `application/ld+json` `<script>`
+   rendering; see "Structured data (JSON-LD)" below.
 
 ## Install
 
@@ -123,6 +125,39 @@ export const POST = createProxyRoute('/api/site/auth/login')
 `REBLU_API_BASE_URL`/`REBLU_API_KEY` env vars — read lazily per request, not at
 module load.
 
+## Structured data (JSON-LD)
+
+`@reblu/site-next/json-ld` (REB-622, server-only, dependency-free) renders one
+`application/ld+json` `<script>` tag the safe way:
+
+```tsx
+import { JsonLd } from '@reblu/site-next/json-ld'
+
+<JsonLd id='page' data={page.jsonLd} />
+```
+
+A `<script>` body is HTML's **raw-text** context: the parser ends it on the
+first `</script` byte sequence it sees, no matter whether that sequence sits
+inside a JSON string. `JSON.stringify(data)` alone leaves `<` verbatim, so
+tenant-authored data serialised straight into a JSON-LD `<script>` is a
+stored-XSS sink — a title containing `</script><img src=x onerror=alert(1)>`
+breaks out of the element and runs. `jsonLdScriptContent(value)`, which
+`<JsonLd>` wraps, escapes `<`, `>`, `&`, U+2028 and U+2029 to their `\uXXXX`
+JSON form: every escape is a standard JSON character escape, so
+`JSON.parse(jsonLdScriptContent(value))` always recovers `value` unchanged.
+This is an **escaper**, not the strip/allowlist **sanitiser**
+[`sanitizeHtml`](../site-blocks#security-boundaries) in `@reblu/site-blocks`
+covers — that one guards HTML rendered via `dangerouslySetInnerHTML`; this one
+guards the JSON-LD script boundary, a different sink `sanitizeHtml` was never
+built to handle.
+
+`<JsonLd>` ships from its own tsup entry, isolated from the root `index`
+barrel the same way `./cache` and `./route-handlers` are: it has zero
+dependencies of its own (no `@reblu/site-ui`, no `next/link`), so importing it
+must never drag in `CtaButtons`/`EditableCta`'s client-component graph.
+Measured: `dist/json-ld.js` is 701 B (451 B gzipped) and its only runtime
+import is `react/jsx-runtime` — no parser, no sanitiser chain.
+
 ## Build
 
 `tsup` → dual ESM/CJS + `.d.ts`. Code-splitting is **off** so each entry keeps its

package/dist/json-ld.cjs

@@ -0,0 +1,56 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/json-ld.tsx
+var json_ld_exports = {};
+__export(json_ld_exports, {
+  JsonLd: () => JsonLd,
+  jsonLdScriptContent: () => jsonLdScriptContent
+});
+module.exports = __toCommonJS(json_ld_exports);
+var import_jsx_runtime = require("react/jsx-runtime");
+var SCRIPT_BOUNDARY_UNSAFE = /[<>&\u2028\u2029]/g;
+var ESCAPES = {
+  "<": "\\u003c",
+  ">": "\\u003e",
+  "&": "\\u0026",
+  "\u2028": "\\u2028",
+  "\u2029": "\\u2029"
+};
+function jsonLdScriptContent(value) {
+  const json = JSON.stringify(value) ?? "null";
+  return json.replace(SCRIPT_BOUNDARY_UNSAFE, (char) => ESCAPES[char]);
+}
+function JsonLd({ id, data }) {
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+    "script",
+    {
+      id: `json-ld-${id}`,
+      type: "application/ld+json",
+      suppressHydrationWarning: true,
+      dangerouslySetInnerHTML: { __html: jsonLdScriptContent(data) }
+    }
+  );
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  JsonLd,
+  jsonLdScriptContent
+});
+//# sourceMappingURL=json-ld.cjs.map

package/dist/json-ld.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/json-ld.tsx"],"sourcesContent":["/**\n * `<JsonLd>` — safe `application/ld+json` script renderer (REB-622).\n *\n * A `<script>` element is HTML's \"raw text\" context: the parser closes it on the\n * first case-insensitive `</script` byte sequence it sees, no matter whether\n * that sequence sits inside a JSON string. `JSON.stringify` escapes for JSON\n * syntax, not for this HTML boundary, so it leaves `<` verbatim — turning any\n * JSON-LD payload built from tenant-authored data (page title, description,\n * FAQ copy, …) into a stored-XSS sink: a value containing\n * `</script><img src=x onerror=alert(1)>` breaks out of the element and runs.\n *\n * `jsonLdScriptContent` neutralises exactly that boundary while staying\n * byte-for-byte valid JSON: `<` / `>` / `&` are standard JSON\n * character escapes, so `JSON.parse` recovers the original value unchanged —\n * this is an ESCAPER, not a strip/allowlist sanitiser (see `sanitizeHtml` in\n * `@reblu/site-blocks` for that job, at the HTML boundary rather than the\n * script boundary). U+2028/U+2029 are escaped too: both are valid inside a\n * JSON string but are raw JS line terminators, and some `<script>` consumers\n * (older JS parsers, some static analysers) choke on them unescaped.\n *\n * This package, not `@reblu/site-blocks`, is the home for it: `site-blocks`'s\n * main entry bundles `parse5` + the `hast-util-*` chain + `marked` for\n * `sanitizeHtml` with `treeshake: false` — dist/index.js is ~463 KB, and PR #848\n * spent a full round removing exactly that weight (89 KB gzipped) from a client\n * bundle that only needed one HTML-escaping helper. `<JsonLd>` is Next-specific\n * (App Router's `suppressHydrationWarning` pattern) and this 40-line escaper has\n * zero dependencies of its own, so it ships as its OWN tsup entry\n * (`@reblu/site-next/json-ld`) rather than folding into the root `index` barrel\n * — importing it must never drag in `CtaButtons`/`EditableCta`'s `next/link` +\n * `@reblu/site-ui` graph, the same isolation `./cache` and `./route-handlers`\n * already use for the same reason.\n *\n * @see https://nextjs.org/docs/app/guides/json-ld\n */\n\nconst SCRIPT_BOUNDARY_UNSAFE = /[<>&\\u2028\\u2029]/g\n\nconst ESCAPES: Record<string, string> = {\n  '<': '\\\\u003c',\n  '>': '\\\\u003e',\n  '&': '\\\\u0026',\n  '\\u2028': '\\\\u2028',\n  '\\u2029': '\\\\u2029',\n}\n\n/**\n * Serialises `value` for embedding inside `<script type=\"application/ld+json\">`.\n * Escapes `<`, `>`, `&`, U+2028 and U+2029 — every escape is a standard JSON\n * character escape, so `JSON.parse(jsonLdScriptContent(value))` always recovers\n * `value` unchanged. This only ever ADDS escaping; it never strips or rewrites\n * data, unlike an HTML sanitiser.\n *\n * `JSON.stringify(undefined)` returns the JS value `undefined`, not a string\n * (`undefined` has no JSON representation), which would otherwise throw here.\n * `data` is typed `unknown` with zero friction toward `undefined`, so this\n * falls back to the JSON literal `'null'` rather than crashing an entire page\n * render over one missing field.\n */\nexport function jsonLdScriptContent(value: unknown): string {\n  const json = JSON.stringify(value) ?? 'null'\n  return json.replace(SCRIPT_BOUNDARY_UNSAFE, (char) => ESCAPES[char])\n}\n\nexport interface JsonLdProps {\n  /** Suffix for the rendered `<script>` id: `json-ld-${id}`. */\n  id: string\n  /** Structured data to serialise. Any JSON-serialisable value. */\n  data: unknown\n}\n\n/**\n * Renders one `application/ld+json` `<script>` tag using the official Next.js\n * App Router pattern. `suppressHydrationWarning` is required here: React warns\n * on a server/client `textContent` mismatch for this element even though there\n * is no real divergence — `dangerouslySetInnerHTML` content is opaque to React's\n * hydration diff.\n */\nexport function JsonLd({ id, data }: JsonLdProps) {\n  return (\n    <script\n      id={`json-ld-${id}`}\n      type='application/ld+json'\n      suppressHydrationWarning\n      dangerouslySetInnerHTML={{ __html: jsonLdScriptContent(data) }}\n    />\n  )\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+EI;AA5CJ,IAAM,yBAAyB;AAE/B,IAAM,UAAkC;AAAA,EACtC,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,UAAU;AAAA,EACV,UAAU;AACZ;AAeO,SAAS,oBAAoB,OAAwB;AAC1D,QAAM,OAAO,KAAK,UAAU,KAAK,KAAK;AACtC,SAAO,KAAK,QAAQ,wBAAwB,CAAC,SAAS,QAAQ,IAAI,CAAC;AACrE;AAgBO,SAAS,OAAO,EAAE,IAAI,KAAK,GAAgB;AAChD,SACE;AAAA,IAAC;AAAA;AAAA,MACC,IAAI,WAAW,EAAE;AAAA,MACjB,MAAK;AAAA,MACL,0BAAwB;AAAA,MACxB,yBAAyB,EAAE,QAAQ,oBAAoB,IAAI,EAAE;AAAA;AAAA,EAC/D;AAEJ;","names":[]}

package/dist/json-ld.d.cts

@@ -0,0 +1,66 @@
+import * as react_jsx_runtime from 'react/jsx-runtime';
+
+/**
+ * `<JsonLd>` — safe `application/ld+json` script renderer (REB-622).
+ *
+ * A `<script>` element is HTML's "raw text" context: the parser closes it on the
+ * first case-insensitive `</script` byte sequence it sees, no matter whether
+ * that sequence sits inside a JSON string. `JSON.stringify` escapes for JSON
+ * syntax, not for this HTML boundary, so it leaves `<` verbatim — turning any
+ * JSON-LD payload built from tenant-authored data (page title, description,
+ * FAQ copy, …) into a stored-XSS sink: a value containing
+ * `</script><img src=x onerror=alert(1)>` breaks out of the element and runs.
+ *
+ * `jsonLdScriptContent` neutralises exactly that boundary while staying
+ * byte-for-byte valid JSON: `<` / `>` / `&` are standard JSON
+ * character escapes, so `JSON.parse` recovers the original value unchanged —
+ * this is an ESCAPER, not a strip/allowlist sanitiser (see `sanitizeHtml` in
+ * `@reblu/site-blocks` for that job, at the HTML boundary rather than the
+ * script boundary). U+2028/U+2029 are escaped too: both are valid inside a
+ * JSON string but are raw JS line terminators, and some `<script>` consumers
+ * (older JS parsers, some static analysers) choke on them unescaped.
+ *
+ * This package, not `@reblu/site-blocks`, is the home for it: `site-blocks`'s
+ * main entry bundles `parse5` + the `hast-util-*` chain + `marked` for
+ * `sanitizeHtml` with `treeshake: false` — dist/index.js is ~463 KB, and PR #848
+ * spent a full round removing exactly that weight (89 KB gzipped) from a client
+ * bundle that only needed one HTML-escaping helper. `<JsonLd>` is Next-specific
+ * (App Router's `suppressHydrationWarning` pattern) and this 40-line escaper has
+ * zero dependencies of its own, so it ships as its OWN tsup entry
+ * (`@reblu/site-next/json-ld`) rather than folding into the root `index` barrel
+ * — importing it must never drag in `CtaButtons`/`EditableCta`'s `next/link` +
+ * `@reblu/site-ui` graph, the same isolation `./cache` and `./route-handlers`
+ * already use for the same reason.
+ *
+ * @see https://nextjs.org/docs/app/guides/json-ld
+ */
+/**
+ * Serialises `value` for embedding inside `<script type="application/ld+json">`.
+ * Escapes `<`, `>`, `&`, U+2028 and U+2029 — every escape is a standard JSON
+ * character escape, so `JSON.parse(jsonLdScriptContent(value))` always recovers
+ * `value` unchanged. This only ever ADDS escaping; it never strips or rewrites
+ * data, unlike an HTML sanitiser.
+ *
+ * `JSON.stringify(undefined)` returns the JS value `undefined`, not a string
+ * (`undefined` has no JSON representation), which would otherwise throw here.
+ * `data` is typed `unknown` with zero friction toward `undefined`, so this
+ * falls back to the JSON literal `'null'` rather than crashing an entire page
+ * render over one missing field.
+ */
+declare function jsonLdScriptContent(value: unknown): string;
+interface JsonLdProps {
+    /** Suffix for the rendered `<script>` id: `json-ld-${id}`. */
+    id: string;
+    /** Structured data to serialise. Any JSON-serialisable value. */
+    data: unknown;
+}
+/**
+ * Renders one `application/ld+json` `<script>` tag using the official Next.js
+ * App Router pattern. `suppressHydrationWarning` is required here: React warns
+ * on a server/client `textContent` mismatch for this element even though there
+ * is no real divergence — `dangerouslySetInnerHTML` content is opaque to React's
+ * hydration diff.
+ */
+declare function JsonLd({ id, data }: JsonLdProps): react_jsx_runtime.JSX.Element;
+
+export { JsonLd, type JsonLdProps, jsonLdScriptContent };

package/dist/json-ld.d.ts

@@ -0,0 +1,66 @@
+import * as react_jsx_runtime from 'react/jsx-runtime';
+
+/**
+ * `<JsonLd>` — safe `application/ld+json` script renderer (REB-622).
+ *
+ * A `<script>` element is HTML's "raw text" context: the parser closes it on the
+ * first case-insensitive `</script` byte sequence it sees, no matter whether
+ * that sequence sits inside a JSON string. `JSON.stringify` escapes for JSON
+ * syntax, not for this HTML boundary, so it leaves `<` verbatim — turning any
+ * JSON-LD payload built from tenant-authored data (page title, description,
+ * FAQ copy, …) into a stored-XSS sink: a value containing
+ * `</script><img src=x onerror=alert(1)>` breaks out of the element and runs.
+ *
+ * `jsonLdScriptContent` neutralises exactly that boundary while staying
+ * byte-for-byte valid JSON: `<` / `>` / `&` are standard JSON
+ * character escapes, so `JSON.parse` recovers the original value unchanged —
+ * this is an ESCAPER, not a strip/allowlist sanitiser (see `sanitizeHtml` in
+ * `@reblu/site-blocks` for that job, at the HTML boundary rather than the
+ * script boundary). U+2028/U+2029 are escaped too: both are valid inside a
+ * JSON string but are raw JS line terminators, and some `<script>` consumers
+ * (older JS parsers, some static analysers) choke on them unescaped.
+ *
+ * This package, not `@reblu/site-blocks`, is the home for it: `site-blocks`'s
+ * main entry bundles `parse5` + the `hast-util-*` chain + `marked` for
+ * `sanitizeHtml` with `treeshake: false` — dist/index.js is ~463 KB, and PR #848
+ * spent a full round removing exactly that weight (89 KB gzipped) from a client
+ * bundle that only needed one HTML-escaping helper. `<JsonLd>` is Next-specific
+ * (App Router's `suppressHydrationWarning` pattern) and this 40-line escaper has
+ * zero dependencies of its own, so it ships as its OWN tsup entry
+ * (`@reblu/site-next/json-ld`) rather than folding into the root `index` barrel
+ * — importing it must never drag in `CtaButtons`/`EditableCta`'s `next/link` +
+ * `@reblu/site-ui` graph, the same isolation `./cache` and `./route-handlers`
+ * already use for the same reason.
+ *
+ * @see https://nextjs.org/docs/app/guides/json-ld
+ */
+/**
+ * Serialises `value` for embedding inside `<script type="application/ld+json">`.
+ * Escapes `<`, `>`, `&`, U+2028 and U+2029 — every escape is a standard JSON
+ * character escape, so `JSON.parse(jsonLdScriptContent(value))` always recovers
+ * `value` unchanged. This only ever ADDS escaping; it never strips or rewrites
+ * data, unlike an HTML sanitiser.
+ *
+ * `JSON.stringify(undefined)` returns the JS value `undefined`, not a string
+ * (`undefined` has no JSON representation), which would otherwise throw here.
+ * `data` is typed `unknown` with zero friction toward `undefined`, so this
+ * falls back to the JSON literal `'null'` rather than crashing an entire page
+ * render over one missing field.
+ */
+declare function jsonLdScriptContent(value: unknown): string;
+interface JsonLdProps {
+    /** Suffix for the rendered `<script>` id: `json-ld-${id}`. */
+    id: string;
+    /** Structured data to serialise. Any JSON-serialisable value. */
+    data: unknown;
+}
+/**
+ * Renders one `application/ld+json` `<script>` tag using the official Next.js
+ * App Router pattern. `suppressHydrationWarning` is required here: React warns
+ * on a server/client `textContent` mismatch for this element even though there
+ * is no real divergence — `dangerouslySetInnerHTML` content is opaque to React's
+ * hydration diff.
+ */
+declare function JsonLd({ id, data }: JsonLdProps): react_jsx_runtime.JSX.Element;
+
+export { JsonLd, type JsonLdProps, jsonLdScriptContent };

package/dist/json-ld.js

@@ -0,0 +1,30 @@
+// src/json-ld.tsx
+import { jsx } from "react/jsx-runtime";
+var SCRIPT_BOUNDARY_UNSAFE = /[<>&\u2028\u2029]/g;
+var ESCAPES = {
+  "<": "\\u003c",
+  ">": "\\u003e",
+  "&": "\\u0026",
+  "\u2028": "\\u2028",
+  "\u2029": "\\u2029"
+};
+function jsonLdScriptContent(value) {
+  const json = JSON.stringify(value) ?? "null";
+  return json.replace(SCRIPT_BOUNDARY_UNSAFE, (char) => ESCAPES[char]);
+}
+function JsonLd({ id, data }) {
+  return /* @__PURE__ */ jsx(
+    "script",
+    {
+      id: `json-ld-${id}`,
+      type: "application/ld+json",
+      suppressHydrationWarning: true,
+      dangerouslySetInnerHTML: { __html: jsonLdScriptContent(data) }
+    }
+  );
+}
+export {
+  JsonLd,
+  jsonLdScriptContent
+};
+//# sourceMappingURL=json-ld.js.map

package/dist/json-ld.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/json-ld.tsx"],"sourcesContent":["/**\n * `<JsonLd>` — safe `application/ld+json` script renderer (REB-622).\n *\n * A `<script>` element is HTML's \"raw text\" context: the parser closes it on the\n * first case-insensitive `</script` byte sequence it sees, no matter whether\n * that sequence sits inside a JSON string. `JSON.stringify` escapes for JSON\n * syntax, not for this HTML boundary, so it leaves `<` verbatim — turning any\n * JSON-LD payload built from tenant-authored data (page title, description,\n * FAQ copy, …) into a stored-XSS sink: a value containing\n * `</script><img src=x onerror=alert(1)>` breaks out of the element and runs.\n *\n * `jsonLdScriptContent` neutralises exactly that boundary while staying\n * byte-for-byte valid JSON: `<` / `>` / `&` are standard JSON\n * character escapes, so `JSON.parse` recovers the original value unchanged —\n * this is an ESCAPER, not a strip/allowlist sanitiser (see `sanitizeHtml` in\n * `@reblu/site-blocks` for that job, at the HTML boundary rather than the\n * script boundary). U+2028/U+2029 are escaped too: both are valid inside a\n * JSON string but are raw JS line terminators, and some `<script>` consumers\n * (older JS parsers, some static analysers) choke on them unescaped.\n *\n * This package, not `@reblu/site-blocks`, is the home for it: `site-blocks`'s\n * main entry bundles `parse5` + the `hast-util-*` chain + `marked` for\n * `sanitizeHtml` with `treeshake: false` — dist/index.js is ~463 KB, and PR #848\n * spent a full round removing exactly that weight (89 KB gzipped) from a client\n * bundle that only needed one HTML-escaping helper. `<JsonLd>` is Next-specific\n * (App Router's `suppressHydrationWarning` pattern) and this 40-line escaper has\n * zero dependencies of its own, so it ships as its OWN tsup entry\n * (`@reblu/site-next/json-ld`) rather than folding into the root `index` barrel\n * — importing it must never drag in `CtaButtons`/`EditableCta`'s `next/link` +\n * `@reblu/site-ui` graph, the same isolation `./cache` and `./route-handlers`\n * already use for the same reason.\n *\n * @see https://nextjs.org/docs/app/guides/json-ld\n */\n\nconst SCRIPT_BOUNDARY_UNSAFE = /[<>&\\u2028\\u2029]/g\n\nconst ESCAPES: Record<string, string> = {\n  '<': '\\\\u003c',\n  '>': '\\\\u003e',\n  '&': '\\\\u0026',\n  '\\u2028': '\\\\u2028',\n  '\\u2029': '\\\\u2029',\n}\n\n/**\n * Serialises `value` for embedding inside `<script type=\"application/ld+json\">`.\n * Escapes `<`, `>`, `&`, U+2028 and U+2029 — every escape is a standard JSON\n * character escape, so `JSON.parse(jsonLdScriptContent(value))` always recovers\n * `value` unchanged. This only ever ADDS escaping; it never strips or rewrites\n * data, unlike an HTML sanitiser.\n *\n * `JSON.stringify(undefined)` returns the JS value `undefined`, not a string\n * (`undefined` has no JSON representation), which would otherwise throw here.\n * `data` is typed `unknown` with zero friction toward `undefined`, so this\n * falls back to the JSON literal `'null'` rather than crashing an entire page\n * render over one missing field.\n */\nexport function jsonLdScriptContent(value: unknown): string {\n  const json = JSON.stringify(value) ?? 'null'\n  return json.replace(SCRIPT_BOUNDARY_UNSAFE, (char) => ESCAPES[char])\n}\n\nexport interface JsonLdProps {\n  /** Suffix for the rendered `<script>` id: `json-ld-${id}`. */\n  id: string\n  /** Structured data to serialise. Any JSON-serialisable value. */\n  data: unknown\n}\n\n/**\n * Renders one `application/ld+json` `<script>` tag using the official Next.js\n * App Router pattern. `suppressHydrationWarning` is required here: React warns\n * on a server/client `textContent` mismatch for this element even though there\n * is no real divergence — `dangerouslySetInnerHTML` content is opaque to React's\n * hydration diff.\n */\nexport function JsonLd({ id, data }: JsonLdProps) {\n  return (\n    <script\n      id={`json-ld-${id}`}\n      type='application/ld+json'\n      suppressHydrationWarning\n      dangerouslySetInnerHTML={{ __html: jsonLdScriptContent(data) }}\n    />\n  )\n}\n"],"mappings":";AA+EI;AA5CJ,IAAM,yBAAyB;AAE/B,IAAM,UAAkC;AAAA,EACtC,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,UAAU;AAAA,EACV,UAAU;AACZ;AAeO,SAAS,oBAAoB,OAAwB;AAC1D,QAAM,OAAO,KAAK,UAAU,KAAK,KAAK;AACtC,SAAO,KAAK,QAAQ,wBAAwB,CAAC,SAAS,QAAQ,IAAI,CAAC;AACrE;AAgBO,SAAS,OAAO,EAAE,IAAI,KAAK,GAAgB;AAChD,SACE;AAAA,IAAC;AAAA;AAAA,MACC,IAAI,WAAW,EAAE;AAAA,MACjB,MAAK;AAAA,MACL,0BAAwB;AAAA,MACxB,yBAAyB,EAAE,QAAQ,oBAAoB,IAAI,EAAE;AAAA;AAAA,EAC/D;AAEJ;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reblu/site-next",
-  "version": "1.3.1",
+  "version": "1.4.0",
   "description": "Next.js RSC glue for Reblu SITEs — cache + CTA + auth server/client components.",
   "license": "Apache-2.0",
   "author": "Reblu — Adolfo Unturbe",
@@ -80,6 +80,16 @@
         "types": "./dist/route-handlers.d.cts",
         "default": "./dist/route-handlers.cjs"
       }
+    },
+    "./json-ld": {
+      "import": {
+        "types": "./dist/json-ld.d.ts",
+        "default": "./dist/json-ld.js"
+      },
+      "require": {
+        "types": "./dist/json-ld.d.cts",
+        "default": "./dist/json-ld.cjs"
+      }
     }
   },
   "publishConfig": {
@@ -91,9 +101,9 @@
     "react": ">=19"
   },
   "dependencies": {
-    "@reblu/site-client": "^1.0.0",
+    "@reblu/site-client": "^3.0.0",
     "@reblu/site-ui": "^0.3.1",
-    "@reblu/site-contracts": "^0.2.0"
+    "@reblu/site-contracts": "^0.4.0"
   },
   "devDependencies": {
     "@testing-library/jest-dom": "^6.9.1",