@reblu/site-next 1.4.0 → 1.5.1

package/dist/analytics.cjs

@@ -0,0 +1,122 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/analytics.tsx
+var analytics_exports = {};
+__export(analytics_exports, {
+  AnalyticsScripts: () => AnalyticsScripts,
+  CLARITY_PROJECT_ID_PATTERN: () => CLARITY_PROJECT_ID_PATTERN,
+  GA_MEASUREMENT_ID_PATTERN: () => GA_MEASUREMENT_ID_PATTERN,
+  analyticsScriptLiteral: () => analyticsScriptLiteral,
+  clarityInitScript: () => clarityInitScript,
+  gaInitScript: () => gaInitScript,
+  isValidClarityProjectId: () => isValidClarityProjectId,
+  isValidGaMeasurementId: () => isValidGaMeasurementId
+});
+module.exports = __toCommonJS(analytics_exports);
+var import_script = __toESM(require("next/script"), 1);
+
+// src/json-ld.tsx
+var import_jsx_runtime = require("react/jsx-runtime");
+var SCRIPT_BOUNDARY_UNSAFE = /[<>&\u2028\u2029]/g;
+var ESCAPES = {
+  "<": "\\u003c",
+  ">": "\\u003e",
+  "&": "\\u0026",
+  "\u2028": "\\u2028",
+  "\u2029": "\\u2029"
+};
+function jsonLdScriptContent(value) {
+  const json = JSON.stringify(value) ?? "null";
+  return json.replace(SCRIPT_BOUNDARY_UNSAFE, (char) => ESCAPES[char]);
+}
+
+// src/analytics.tsx
+var import_jsx_runtime2 = require("react/jsx-runtime");
+var GA_MEASUREMENT_ID_PATTERN = /^G-[A-Z0-9]{1,32}$/;
+var CLARITY_PROJECT_ID_PATTERN = /^[a-z0-9]{1,32}$/;
+function isValidGaMeasurementId(value) {
+  return typeof value === "string" && GA_MEASUREMENT_ID_PATTERN.test(value);
+}
+function isValidClarityProjectId(value) {
+  return typeof value === "string" && CLARITY_PROJECT_ID_PATTERN.test(value);
+}
+function analyticsScriptLiteral(id) {
+  return jsonLdScriptContent(id);
+}
+function gaInitScript(gaId) {
+  return `window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}gtag('js',new Date());gtag('config',${analyticsScriptLiteral(gaId)});`;
+}
+function clarityInitScript(clarityId) {
+  return `(function(c,l,a,r,i,t,y){c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};t=l.createElement(r);t.async=1;t.src="https://www.clarity.ms/tag/"+i;y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y)})(window,document,"clarity","script",${analyticsScriptLiteral(clarityId)});`;
+}
+function AnalyticsScripts({ gaId, clarityId }) {
+  const safeGaId = isValidGaMeasurementId(gaId) ? gaId : null;
+  const safeClarityId = isValidClarityProjectId(clarityId) ? clarityId : null;
+  if (!safeGaId && !safeClarityId) return null;
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(import_jsx_runtime2.Fragment, { children: [
+    safeGaId && /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(import_jsx_runtime2.Fragment, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(
+        import_script.default,
+        {
+          src: `https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(safeGaId)}`,
+          strategy: "afterInteractive"
+        }
+      ),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(
+        import_script.default,
+        {
+          id: "ga-init",
+          strategy: "afterInteractive",
+          dangerouslySetInnerHTML: { __html: gaInitScript(safeGaId) }
+        }
+      )
+    ] }),
+    safeClarityId && /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(
+      import_script.default,
+      {
+        id: "clarity-init",
+        strategy: "afterInteractive",
+        dangerouslySetInnerHTML: { __html: clarityInitScript(safeClarityId) }
+      }
+    )
+  ] });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AnalyticsScripts,
+  CLARITY_PROJECT_ID_PATTERN,
+  GA_MEASUREMENT_ID_PATTERN,
+  analyticsScriptLiteral,
+  clarityInitScript,
+  gaInitScript,
+  isValidClarityProjectId,
+  isValidGaMeasurementId
+});
+//# sourceMappingURL=analytics.cjs.map

package/dist/analytics.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/analytics.tsx","../src/json-ld.tsx"],"sourcesContent":["import Script from 'next/script'\n\nimport { jsonLdScriptContent } from './json-ld'\n\n/**\n * `<AnalyticsScripts>` — safe rendering of tenant-configured analytics tags (REB-617).\n *\n * THE HOLE THIS CLOSES. Every SITE built on this SDK interpolated the tenant's\n * analytics ids straight into the body of an executing `<script>`:\n *\n *   gtag('config','${analytics.gaId}');\n *   …\"clarity\",\"script\",\"${analytics.clarityId}\");\n *\n * No validation, no escaping. A `gaId` of `x');alert(document.cookie);//` closes\n * the string literal, closes the call, comments out the rest, and runs arbitrary\n * JS on the TENANT'S OWN ORIGIN — on every page including checkout, same origin\n * as the portal session cookie. For a medical tenant that is patient-session\n * territory. It is the same trust boundary as the nexus-authored HTML that\n * REB-613 closed on the sink next door, except this one reached the JS\n * interpreter with no sanitiser anywhere in the path.\n *\n * TWO INDEPENDENT LAYERS, because either alone is one refactor away from failing:\n *\n *   1. VALIDATION — an id that does not match its vendor-documented shape is\n *      dropped and NO script renders. Analytics silently does not load; the site\n *      keeps working. Failing closed matters more than failing loud here: the\n *      value is cosmetic, the sink is not.\n *   2. ESCAPING — `analyticsScriptLiteral` emits the id as a JSON string literal\n *      with the `<script>` boundary neutralised, so even a value that skipped\n *      layer 1 (a future field with a looser shape, a caller that reaches for the\n *      builders directly) is inert DATA rather than code.\n *\n * WHY VALIDATION ALONE IS NOT ENOUGH, and escaping alone is not either: layer 1\n * is a policy that a product decision can widen (someone adds `GT-` ids, or a\n * Meta Pixel field whose shape is numeric-but-unbounded), and layer 2 is a\n * mechanism that cannot express \"this is not a usable analytics id\". Keeping both\n * means widening the policy never reopens the sink.\n *\n * This lives in the SDK, not in `apps/demo-site`, because every external SITE repo\n * consuming `@reblu/site-contracts` carries the identical snippet — publishing the\n * safe component is the only way the fix reaches them.\n */\n\n/**\n * GA4 measurement id: `G-` followed by alphanumeric characters.\n *\n * Vendor source: Google Analytics Help 12270356 (\"formatted as 'G-' followed by\n * alphanumeric characters\", example `G-PSW1MY7HB4`).\n *\n * NO MINIMUM LENGTH, deliberately. The familiar id is ten characters, but Google\n * documents no length at all and its own docs print `gtag('config', 'G-12345')`\n * (Help 11259997) — inventing a floor here would reject an id Google itself\n * publishes. The upper bound is sanity, not security: the `[A-Z0-9]` class already\n * excludes every character that could leave a JS string literal, so length adds\n * nothing to the guarantee.\n *\n * Uppercase only — every documented example is uppercase, and a lowercase variant\n * is not a Google-issued id. Google tag ids also exist as `GT-` and `AW-`\n * (Help 12326985), but this field is specifically the GA4 *measurement id*\n * (the nexus form labels it so, and the SITE reads it as `gaId`); accepting the\n * other prefixes is a product decision, not a security one, and is deliberately\n * left out of this fix.\n */\nexport const GA_MEASUREMENT_ID_PATTERN = /^G-[A-Z0-9]{1,32}$/\n\n/**\n * Microsoft Clarity project id: lowercase alphanumeric.\n *\n * Vendor source: Microsoft Learn `clarity-setup` publishes a live demo project\n * under id `3t0wlogvdz`; every id Microsoft prints is lowercase alphanumeric of\n * about ten characters. Microsoft documents no formal grammar, so — as with GA —\n * the bound is generous and the character class carries the guarantee.\n *\n * RESIDUAL RISK, stated plainly: no vendor page enumerates the legal Clarity\n * alphabet, so this is inferred from published examples. If some tenant holds an\n * id containing a character outside `[a-z0-9]`, this rejects it. That is why the\n * API coerces a non-matching id to `null` instead of erroring — analytics stops\n * loading for that tenant, the site keeps serving, and the misconfiguration is\n * visible and fixable rather than an outage.\n */\nexport const CLARITY_PROJECT_ID_PATTERN = /^[a-z0-9]{1,32}$/\n\n/** True only for a string matching the vendor-documented GA4 measurement id shape. */\nexport function isValidGaMeasurementId(value: unknown): value is string {\n  return typeof value === 'string' && GA_MEASUREMENT_ID_PATTERN.test(value)\n}\n\n/** True only for a string matching the vendor-documented Clarity project id shape. */\nexport function isValidClarityProjectId(value: unknown): value is string {\n  return typeof value === 'string' && CLARITY_PROJECT_ID_PATTERN.test(value)\n}\n\n/**\n * Serialises `id` as a JS string literal safe to embed in a `<script>` body.\n *\n * Reuses `jsonLdScriptContent` rather than growing a second escaper: a JSON string\n * literal IS a valid JS string literal, and that helper already does the two things\n * required here — `JSON.stringify` for the quote/backslash/newline boundary, plus\n * `<` `>` `&` U+2028 U+2029 escaping for the HTML raw-text boundary that\n * `JSON.stringify` leaves wide open. One audited primitive, one place to fix.\n */\nexport function analyticsScriptLiteral(id: string): string {\n  return jsonLdScriptContent(id)\n}\n\n/** Body of the GA4 bootstrap script. Always escapes; never trusts its caller. */\nexport function gaInitScript(gaId: string): string {\n  return `window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}gtag('js',new Date());gtag('config',${analyticsScriptLiteral(gaId)});`\n}\n\n/** Body of the Microsoft Clarity bootstrap script. Always escapes; never trusts its caller. */\nexport function clarityInitScript(clarityId: string): string {\n  return `(function(c,l,a,r,i,t,y){c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};t=l.createElement(r);t.async=1;t.src=\"https://www.clarity.ms/tag/\"+i;y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y)})(window,document,\"clarity\",\"script\",${analyticsScriptLiteral(clarityId)});`\n}\n\nexport interface AnalyticsScriptsProps {\n  /** GA4 measurement id from the SITE analytics contract. Ignored unless it matches `G-…`. */\n  gaId?: string | null\n  /** Microsoft Clarity project id from the SITE analytics contract. Ignored unless lowercase alphanumeric. */\n  clarityId?: string | null\n}\n\n/**\n * Renders the Google Analytics and Microsoft Clarity tags for a tenant, dropping\n * any id that does not match its vendor-documented shape.\n */\nexport function AnalyticsScripts({ gaId, clarityId }: AnalyticsScriptsProps) {\n  const safeGaId = isValidGaMeasurementId(gaId) ? gaId : null\n  const safeClarityId = isValidClarityProjectId(clarityId) ? clarityId : null\n\n  if (!safeGaId && !safeClarityId) return null\n\n  return (\n    <>\n      {safeGaId && (\n        <>\n          <Script\n            src={`https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(safeGaId)}`}\n            strategy='afterInteractive'\n          />\n          <Script\n            id='ga-init'\n            strategy='afterInteractive'\n            dangerouslySetInnerHTML={{ __html: gaInitScript(safeGaId) }}\n          />\n        </>\n      )}\n\n      {safeClarityId && (\n        <Script\n          id='clarity-init'\n          strategy='afterInteractive'\n          dangerouslySetInnerHTML={{ __html: clarityInitScript(safeClarityId) }}\n        />\n      )}\n    </>\n  )\n}\n","/**\n * `<JsonLd>` — safe `application/ld+json` script renderer (REB-622).\n *\n * A `<script>` element is HTML's \"raw text\" context: the parser closes it on the\n * first case-insensitive `</script` byte sequence it sees, no matter whether\n * that sequence sits inside a JSON string. `JSON.stringify` escapes for JSON\n * syntax, not for this HTML boundary, so it leaves `<` verbatim — turning any\n * JSON-LD payload built from tenant-authored data (page title, description,\n * FAQ copy, …) into a stored-XSS sink: a value containing\n * `</script><img src=x onerror=alert(1)>` breaks out of the element and runs.\n *\n * `jsonLdScriptContent` neutralises exactly that boundary while staying\n * byte-for-byte valid JSON: `<` / `>` / `&` are standard JSON\n * character escapes, so `JSON.parse` recovers the original value unchanged —\n * this is an ESCAPER, not a strip/allowlist sanitiser (see `sanitizeHtml` in\n * `@reblu/site-blocks` for that job, at the HTML boundary rather than the\n * script boundary). U+2028/U+2029 are escaped too: both are valid inside a\n * JSON string but are raw JS line terminators, and some `<script>` consumers\n * (older JS parsers, some static analysers) choke on them unescaped.\n *\n * This package, not `@reblu/site-blocks`, is the home for it: `site-blocks`'s\n * main entry bundles `parse5` + the `hast-util-*` chain + `marked` for\n * `sanitizeHtml` with `treeshake: false` — dist/index.js is ~463 KB, and PR #848\n * spent a full round removing exactly that weight (89 KB gzipped) from a client\n * bundle that only needed one HTML-escaping helper. `<JsonLd>` is Next-specific\n * (App Router's `suppressHydrationWarning` pattern) and this 40-line escaper has\n * zero dependencies of its own, so it ships as its OWN tsup entry\n * (`@reblu/site-next/json-ld`) rather than folding into the root `index` barrel\n * — importing it must never drag in `CtaButtons`/`EditableCta`'s `next/link` +\n * `@reblu/site-ui` graph, the same isolation `./cache` and `./route-handlers`\n * already use for the same reason.\n *\n * @see https://nextjs.org/docs/app/guides/json-ld\n */\n\nconst SCRIPT_BOUNDARY_UNSAFE = /[<>&\\u2028\\u2029]/g\n\nconst ESCAPES: Record<string, string> = {\n  '<': '\\\\u003c',\n  '>': '\\\\u003e',\n  '&': '\\\\u0026',\n  '\\u2028': '\\\\u2028',\n  '\\u2029': '\\\\u2029',\n}\n\n/**\n * Serialises `value` for embedding inside `<script type=\"application/ld+json\">`.\n * Escapes `<`, `>`, `&`, U+2028 and U+2029 — every escape is a standard JSON\n * character escape, so `JSON.parse(jsonLdScriptContent(value))` always recovers\n * `value` unchanged. This only ever ADDS escaping; it never strips or rewrites\n * data, unlike an HTML sanitiser.\n *\n * `JSON.stringify(undefined)` returns the JS value `undefined`, not a string\n * (`undefined` has no JSON representation), which would otherwise throw here.\n * `data` is typed `unknown` with zero friction toward `undefined`, so this\n * falls back to the JSON literal `'null'` rather than crashing an entire page\n * render over one missing field.\n */\nexport function jsonLdScriptContent(value: unknown): string {\n  const json = JSON.stringify(value) ?? 'null'\n  return json.replace(SCRIPT_BOUNDARY_UNSAFE, (char) => ESCAPES[char])\n}\n\nexport interface JsonLdProps {\n  /** Suffix for the rendered `<script>` id: `json-ld-${id}`. */\n  id: string\n  /** Structured data to serialise. Any JSON-serialisable value. */\n  data: unknown\n}\n\n/**\n * Renders one `application/ld+json` `<script>` tag using the official Next.js\n * App Router pattern. `suppressHydrationWarning` is required here: React warns\n * on a server/client `textContent` mismatch for this element even though there\n * is no real divergence — `dangerouslySetInnerHTML` content is opaque to React's\n * hydration diff.\n */\nexport function JsonLd({ id, data }: JsonLdProps) {\n  return (\n    <script\n      id={`json-ld-${id}`}\n      type='application/ld+json'\n      suppressHydrationWarning\n      dangerouslySetInnerHTML={{ __html: jsonLdScriptContent(data) }}\n    />\n  )\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAmB;;;AC+Ef;AA5CJ,IAAM,yBAAyB;AAE/B,IAAM,UAAkC;AAAA,EACtC,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,UAAU;AAAA,EACV,UAAU;AACZ;AAeO,SAAS,oBAAoB,OAAwB;AAC1D,QAAM,OAAO,KAAK,UAAU,KAAK,KAAK;AACtC,SAAO,KAAK,QAAQ,wBAAwB,CAAC,SAAS,QAAQ,IAAI,CAAC;AACrE;;;AD0EQ,IAAAA,sBAAA;AAxED,IAAM,4BAA4B;AAiBlC,IAAM,6BAA6B;AAGnC,SAAS,uBAAuB,OAAiC;AACtE,SAAO,OAAO,UAAU,YAAY,0BAA0B,KAAK,KAAK;AAC1E;AAGO,SAAS,wBAAwB,OAAiC;AACvE,SAAO,OAAO,UAAU,YAAY,2BAA2B,KAAK,KAAK;AAC3E;AAWO,SAAS,uBAAuB,IAAoB;AACzD,SAAO,oBAAoB,EAAE;AAC/B;AAGO,SAAS,aAAa,MAAsB;AACjD,SAAO,wHAAwH,uBAAuB,IAAI,CAAC;AAC7J;AAGO,SAAS,kBAAkB,WAA2B;AAC3D,SAAO,+PAA+P,uBAAuB,SAAS,CAAC;AACzS;AAaO,SAAS,iBAAiB,EAAE,MAAM,UAAU,GAA0B;AAC3E,QAAM,WAAW,uBAAuB,IAAI,IAAI,OAAO;AACvD,QAAM,gBAAgB,wBAAwB,SAAS,IAAI,YAAY;AAEvE,MAAI,CAAC,YAAY,CAAC,cAAe,QAAO;AAExC,SACE,8EACG;AAAA,gBACC,8EACE;AAAA;AAAA,QAAC,cAAAC;AAAA,QAAA;AAAA,UACC,KAAK,+CAA+C,mBAAmB,QAAQ,CAAC;AAAA,UAChF,UAAS;AAAA;AAAA,MACX;AAAA,MACA;AAAA,QAAC,cAAAA;AAAA,QAAA;AAAA,UACC,IAAG;AAAA,UACH,UAAS;AAAA,UACT,yBAAyB,EAAE,QAAQ,aAAa,QAAQ,EAAE;AAAA;AAAA,MAC5D;AAAA,OACF;AAAA,IAGD,iBACC;AAAA,MAAC,cAAAA;AAAA,MAAA;AAAA,QACC,IAAG;AAAA,QACH,UAAS;AAAA,QACT,yBAAyB,EAAE,QAAQ,kBAAkB,aAAa,EAAE;AAAA;AAAA,IACtE;AAAA,KAEJ;AAEJ;","names":["import_jsx_runtime","Script"]}

package/dist/analytics.d.cts

@@ -0,0 +1,108 @@
+import * as react_jsx_runtime from 'react/jsx-runtime';
+
+/**
+ * `<AnalyticsScripts>` — safe rendering of tenant-configured analytics tags (REB-617).
+ *
+ * THE HOLE THIS CLOSES. Every SITE built on this SDK interpolated the tenant's
+ * analytics ids straight into the body of an executing `<script>`:
+ *
+ *   gtag('config','${analytics.gaId}');
+ *   …"clarity","script","${analytics.clarityId}");
+ *
+ * No validation, no escaping. A `gaId` of `x');alert(document.cookie);//` closes
+ * the string literal, closes the call, comments out the rest, and runs arbitrary
+ * JS on the TENANT'S OWN ORIGIN — on every page including checkout, same origin
+ * as the portal session cookie. For a medical tenant that is patient-session
+ * territory. It is the same trust boundary as the nexus-authored HTML that
+ * REB-613 closed on the sink next door, except this one reached the JS
+ * interpreter with no sanitiser anywhere in the path.
+ *
+ * TWO INDEPENDENT LAYERS, because either alone is one refactor away from failing:
+ *
+ *   1. VALIDATION — an id that does not match its vendor-documented shape is
+ *      dropped and NO script renders. Analytics silently does not load; the site
+ *      keeps working. Failing closed matters more than failing loud here: the
+ *      value is cosmetic, the sink is not.
+ *   2. ESCAPING — `analyticsScriptLiteral` emits the id as a JSON string literal
+ *      with the `<script>` boundary neutralised, so even a value that skipped
+ *      layer 1 (a future field with a looser shape, a caller that reaches for the
+ *      builders directly) is inert DATA rather than code.
+ *
+ * WHY VALIDATION ALONE IS NOT ENOUGH, and escaping alone is not either: layer 1
+ * is a policy that a product decision can widen (someone adds `GT-` ids, or a
+ * Meta Pixel field whose shape is numeric-but-unbounded), and layer 2 is a
+ * mechanism that cannot express "this is not a usable analytics id". Keeping both
+ * means widening the policy never reopens the sink.
+ *
+ * This lives in the SDK, not in `apps/demo-site`, because every external SITE repo
+ * consuming `@reblu/site-contracts` carries the identical snippet — publishing the
+ * safe component is the only way the fix reaches them.
+ */
+/**
+ * GA4 measurement id: `G-` followed by alphanumeric characters.
+ *
+ * Vendor source: Google Analytics Help 12270356 ("formatted as 'G-' followed by
+ * alphanumeric characters", example `G-PSW1MY7HB4`).
+ *
+ * NO MINIMUM LENGTH, deliberately. The familiar id is ten characters, but Google
+ * documents no length at all and its own docs print `gtag('config', 'G-12345')`
+ * (Help 11259997) — inventing a floor here would reject an id Google itself
+ * publishes. The upper bound is sanity, not security: the `[A-Z0-9]` class already
+ * excludes every character that could leave a JS string literal, so length adds
+ * nothing to the guarantee.
+ *
+ * Uppercase only — every documented example is uppercase, and a lowercase variant
+ * is not a Google-issued id. Google tag ids also exist as `GT-` and `AW-`
+ * (Help 12326985), but this field is specifically the GA4 *measurement id*
+ * (the nexus form labels it so, and the SITE reads it as `gaId`); accepting the
+ * other prefixes is a product decision, not a security one, and is deliberately
+ * left out of this fix.
+ */
+declare const GA_MEASUREMENT_ID_PATTERN: RegExp;
+/**
+ * Microsoft Clarity project id: lowercase alphanumeric.
+ *
+ * Vendor source: Microsoft Learn `clarity-setup` publishes a live demo project
+ * under id `3t0wlogvdz`; every id Microsoft prints is lowercase alphanumeric of
+ * about ten characters. Microsoft documents no formal grammar, so — as with GA —
+ * the bound is generous and the character class carries the guarantee.
+ *
+ * RESIDUAL RISK, stated plainly: no vendor page enumerates the legal Clarity
+ * alphabet, so this is inferred from published examples. If some tenant holds an
+ * id containing a character outside `[a-z0-9]`, this rejects it. That is why the
+ * API coerces a non-matching id to `null` instead of erroring — analytics stops
+ * loading for that tenant, the site keeps serving, and the misconfiguration is
+ * visible and fixable rather than an outage.
+ */
+declare const CLARITY_PROJECT_ID_PATTERN: RegExp;
+/** True only for a string matching the vendor-documented GA4 measurement id shape. */
+declare function isValidGaMeasurementId(value: unknown): value is string;
+/** True only for a string matching the vendor-documented Clarity project id shape. */
+declare function isValidClarityProjectId(value: unknown): value is string;
+/**
+ * Serialises `id` as a JS string literal safe to embed in a `<script>` body.
+ *
+ * Reuses `jsonLdScriptContent` rather than growing a second escaper: a JSON string
+ * literal IS a valid JS string literal, and that helper already does the two things
+ * required here — `JSON.stringify` for the quote/backslash/newline boundary, plus
+ * `<` `>` `&` U+2028 U+2029 escaping for the HTML raw-text boundary that
+ * `JSON.stringify` leaves wide open. One audited primitive, one place to fix.
+ */
+declare function analyticsScriptLiteral(id: string): string;
+/** Body of the GA4 bootstrap script. Always escapes; never trusts its caller. */
+declare function gaInitScript(gaId: string): string;
+/** Body of the Microsoft Clarity bootstrap script. Always escapes; never trusts its caller. */
+declare function clarityInitScript(clarityId: string): string;
+interface AnalyticsScriptsProps {
+    /** GA4 measurement id from the SITE analytics contract. Ignored unless it matches `G-…`. */
+    gaId?: string | null;
+    /** Microsoft Clarity project id from the SITE analytics contract. Ignored unless lowercase alphanumeric. */
+    clarityId?: string | null;
+}
+/**
+ * Renders the Google Analytics and Microsoft Clarity tags for a tenant, dropping
+ * any id that does not match its vendor-documented shape.
+ */
+declare function AnalyticsScripts({ gaId, clarityId }: AnalyticsScriptsProps): react_jsx_runtime.JSX.Element | null;
+
+export { AnalyticsScripts, type AnalyticsScriptsProps, CLARITY_PROJECT_ID_PATTERN, GA_MEASUREMENT_ID_PATTERN, analyticsScriptLiteral, clarityInitScript, gaInitScript, isValidClarityProjectId, isValidGaMeasurementId };

package/dist/analytics.d.ts

@@ -0,0 +1,108 @@
+import * as react_jsx_runtime from 'react/jsx-runtime';
+
+/**
+ * `<AnalyticsScripts>` — safe rendering of tenant-configured analytics tags (REB-617).
+ *
+ * THE HOLE THIS CLOSES. Every SITE built on this SDK interpolated the tenant's
+ * analytics ids straight into the body of an executing `<script>`:
+ *
+ *   gtag('config','${analytics.gaId}');
+ *   …"clarity","script","${analytics.clarityId}");
+ *
+ * No validation, no escaping. A `gaId` of `x');alert(document.cookie);//` closes
+ * the string literal, closes the call, comments out the rest, and runs arbitrary
+ * JS on the TENANT'S OWN ORIGIN — on every page including checkout, same origin
+ * as the portal session cookie. For a medical tenant that is patient-session
+ * territory. It is the same trust boundary as the nexus-authored HTML that
+ * REB-613 closed on the sink next door, except this one reached the JS
+ * interpreter with no sanitiser anywhere in the path.
+ *
+ * TWO INDEPENDENT LAYERS, because either alone is one refactor away from failing:
+ *
+ *   1. VALIDATION — an id that does not match its vendor-documented shape is
+ *      dropped and NO script renders. Analytics silently does not load; the site
+ *      keeps working. Failing closed matters more than failing loud here: the
+ *      value is cosmetic, the sink is not.
+ *   2. ESCAPING — `analyticsScriptLiteral` emits the id as a JSON string literal
+ *      with the `<script>` boundary neutralised, so even a value that skipped
+ *      layer 1 (a future field with a looser shape, a caller that reaches for the
+ *      builders directly) is inert DATA rather than code.
+ *
+ * WHY VALIDATION ALONE IS NOT ENOUGH, and escaping alone is not either: layer 1
+ * is a policy that a product decision can widen (someone adds `GT-` ids, or a
+ * Meta Pixel field whose shape is numeric-but-unbounded), and layer 2 is a
+ * mechanism that cannot express "this is not a usable analytics id". Keeping both
+ * means widening the policy never reopens the sink.
+ *
+ * This lives in the SDK, not in `apps/demo-site`, because every external SITE repo
+ * consuming `@reblu/site-contracts` carries the identical snippet — publishing the
+ * safe component is the only way the fix reaches them.
+ */
+/**
+ * GA4 measurement id: `G-` followed by alphanumeric characters.
+ *
+ * Vendor source: Google Analytics Help 12270356 ("formatted as 'G-' followed by
+ * alphanumeric characters", example `G-PSW1MY7HB4`).
+ *
+ * NO MINIMUM LENGTH, deliberately. The familiar id is ten characters, but Google
+ * documents no length at all and its own docs print `gtag('config', 'G-12345')`
+ * (Help 11259997) — inventing a floor here would reject an id Google itself
+ * publishes. The upper bound is sanity, not security: the `[A-Z0-9]` class already
+ * excludes every character that could leave a JS string literal, so length adds
+ * nothing to the guarantee.
+ *
+ * Uppercase only — every documented example is uppercase, and a lowercase variant
+ * is not a Google-issued id. Google tag ids also exist as `GT-` and `AW-`
+ * (Help 12326985), but this field is specifically the GA4 *measurement id*
+ * (the nexus form labels it so, and the SITE reads it as `gaId`); accepting the
+ * other prefixes is a product decision, not a security one, and is deliberately
+ * left out of this fix.
+ */
+declare const GA_MEASUREMENT_ID_PATTERN: RegExp;
+/**
+ * Microsoft Clarity project id: lowercase alphanumeric.
+ *
+ * Vendor source: Microsoft Learn `clarity-setup` publishes a live demo project
+ * under id `3t0wlogvdz`; every id Microsoft prints is lowercase alphanumeric of
+ * about ten characters. Microsoft documents no formal grammar, so — as with GA —
+ * the bound is generous and the character class carries the guarantee.
+ *
+ * RESIDUAL RISK, stated plainly: no vendor page enumerates the legal Clarity
+ * alphabet, so this is inferred from published examples. If some tenant holds an
+ * id containing a character outside `[a-z0-9]`, this rejects it. That is why the
+ * API coerces a non-matching id to `null` instead of erroring — analytics stops
+ * loading for that tenant, the site keeps serving, and the misconfiguration is
+ * visible and fixable rather than an outage.
+ */
+declare const CLARITY_PROJECT_ID_PATTERN: RegExp;
+/** True only for a string matching the vendor-documented GA4 measurement id shape. */
+declare function isValidGaMeasurementId(value: unknown): value is string;
+/** True only for a string matching the vendor-documented Clarity project id shape. */
+declare function isValidClarityProjectId(value: unknown): value is string;
+/**
+ * Serialises `id` as a JS string literal safe to embed in a `<script>` body.
+ *
+ * Reuses `jsonLdScriptContent` rather than growing a second escaper: a JSON string
+ * literal IS a valid JS string literal, and that helper already does the two things
+ * required here — `JSON.stringify` for the quote/backslash/newline boundary, plus
+ * `<` `>` `&` U+2028 U+2029 escaping for the HTML raw-text boundary that
+ * `JSON.stringify` leaves wide open. One audited primitive, one place to fix.
+ */
+declare function analyticsScriptLiteral(id: string): string;
+/** Body of the GA4 bootstrap script. Always escapes; never trusts its caller. */
+declare function gaInitScript(gaId: string): string;
+/** Body of the Microsoft Clarity bootstrap script. Always escapes; never trusts its caller. */
+declare function clarityInitScript(clarityId: string): string;
+interface AnalyticsScriptsProps {
+    /** GA4 measurement id from the SITE analytics contract. Ignored unless it matches `G-…`. */
+    gaId?: string | null;
+    /** Microsoft Clarity project id from the SITE analytics contract. Ignored unless lowercase alphanumeric. */
+    clarityId?: string | null;
+}
+/**
+ * Renders the Google Analytics and Microsoft Clarity tags for a tenant, dropping
+ * any id that does not match its vendor-documented shape.
+ */
+declare function AnalyticsScripts({ gaId, clarityId }: AnalyticsScriptsProps): react_jsx_runtime.JSX.Element | null;
+
+export { AnalyticsScripts, type AnalyticsScriptsProps, CLARITY_PROJECT_ID_PATTERN, GA_MEASUREMENT_ID_PATTERN, analyticsScriptLiteral, clarityInitScript, gaInitScript, isValidClarityProjectId, isValidGaMeasurementId };

package/dist/analytics.js

@@ -0,0 +1,80 @@
+// src/analytics.tsx
+import Script from "next/script";
+
+// src/json-ld.tsx
+import { jsx } from "react/jsx-runtime";
+var SCRIPT_BOUNDARY_UNSAFE = /[<>&\u2028\u2029]/g;
+var ESCAPES = {
+  "<": "\\u003c",
+  ">": "\\u003e",
+  "&": "\\u0026",
+  "\u2028": "\\u2028",
+  "\u2029": "\\u2029"
+};
+function jsonLdScriptContent(value) {
+  const json = JSON.stringify(value) ?? "null";
+  return json.replace(SCRIPT_BOUNDARY_UNSAFE, (char) => ESCAPES[char]);
+}
+
+// src/analytics.tsx
+import { Fragment, jsx as jsx2, jsxs } from "react/jsx-runtime";
+var GA_MEASUREMENT_ID_PATTERN = /^G-[A-Z0-9]{1,32}$/;
+var CLARITY_PROJECT_ID_PATTERN = /^[a-z0-9]{1,32}$/;
+function isValidGaMeasurementId(value) {
+  return typeof value === "string" && GA_MEASUREMENT_ID_PATTERN.test(value);
+}
+function isValidClarityProjectId(value) {
+  return typeof value === "string" && CLARITY_PROJECT_ID_PATTERN.test(value);
+}
+function analyticsScriptLiteral(id) {
+  return jsonLdScriptContent(id);
+}
+function gaInitScript(gaId) {
+  return `window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}gtag('js',new Date());gtag('config',${analyticsScriptLiteral(gaId)});`;
+}
+function clarityInitScript(clarityId) {
+  return `(function(c,l,a,r,i,t,y){c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};t=l.createElement(r);t.async=1;t.src="https://www.clarity.ms/tag/"+i;y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y)})(window,document,"clarity","script",${analyticsScriptLiteral(clarityId)});`;
+}
+function AnalyticsScripts({ gaId, clarityId }) {
+  const safeGaId = isValidGaMeasurementId(gaId) ? gaId : null;
+  const safeClarityId = isValidClarityProjectId(clarityId) ? clarityId : null;
+  if (!safeGaId && !safeClarityId) return null;
+  return /* @__PURE__ */ jsxs(Fragment, { children: [
+    safeGaId && /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsx2(
+        Script,
+        {
+          src: `https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(safeGaId)}`,
+          strategy: "afterInteractive"
+        }
+      ),
+      /* @__PURE__ */ jsx2(
+        Script,
+        {
+          id: "ga-init",
+          strategy: "afterInteractive",
+          dangerouslySetInnerHTML: { __html: gaInitScript(safeGaId) }
+        }
+      )
+    ] }),
+    safeClarityId && /* @__PURE__ */ jsx2(
+      Script,
+      {
+        id: "clarity-init",
+        strategy: "afterInteractive",
+        dangerouslySetInnerHTML: { __html: clarityInitScript(safeClarityId) }
+      }
+    )
+  ] });
+}
+export {
+  AnalyticsScripts,
+  CLARITY_PROJECT_ID_PATTERN,
+  GA_MEASUREMENT_ID_PATTERN,
+  analyticsScriptLiteral,
+  clarityInitScript,
+  gaInitScript,
+  isValidClarityProjectId,
+  isValidGaMeasurementId
+};
+//# sourceMappingURL=analytics.js.map

package/dist/analytics.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/analytics.tsx","../src/json-ld.tsx"],"sourcesContent":["import Script from 'next/script'\n\nimport { jsonLdScriptContent } from './json-ld'\n\n/**\n * `<AnalyticsScripts>` — safe rendering of tenant-configured analytics tags (REB-617).\n *\n * THE HOLE THIS CLOSES. Every SITE built on this SDK interpolated the tenant's\n * analytics ids straight into the body of an executing `<script>`:\n *\n *   gtag('config','${analytics.gaId}');\n *   …\"clarity\",\"script\",\"${analytics.clarityId}\");\n *\n * No validation, no escaping. A `gaId` of `x');alert(document.cookie);//` closes\n * the string literal, closes the call, comments out the rest, and runs arbitrary\n * JS on the TENANT'S OWN ORIGIN — on every page including checkout, same origin\n * as the portal session cookie. For a medical tenant that is patient-session\n * territory. It is the same trust boundary as the nexus-authored HTML that\n * REB-613 closed on the sink next door, except this one reached the JS\n * interpreter with no sanitiser anywhere in the path.\n *\n * TWO INDEPENDENT LAYERS, because either alone is one refactor away from failing:\n *\n *   1. VALIDATION — an id that does not match its vendor-documented shape is\n *      dropped and NO script renders. Analytics silently does not load; the site\n *      keeps working. Failing closed matters more than failing loud here: the\n *      value is cosmetic, the sink is not.\n *   2. ESCAPING — `analyticsScriptLiteral` emits the id as a JSON string literal\n *      with the `<script>` boundary neutralised, so even a value that skipped\n *      layer 1 (a future field with a looser shape, a caller that reaches for the\n *      builders directly) is inert DATA rather than code.\n *\n * WHY VALIDATION ALONE IS NOT ENOUGH, and escaping alone is not either: layer 1\n * is a policy that a product decision can widen (someone adds `GT-` ids, or a\n * Meta Pixel field whose shape is numeric-but-unbounded), and layer 2 is a\n * mechanism that cannot express \"this is not a usable analytics id\". Keeping both\n * means widening the policy never reopens the sink.\n *\n * This lives in the SDK, not in `apps/demo-site`, because every external SITE repo\n * consuming `@reblu/site-contracts` carries the identical snippet — publishing the\n * safe component is the only way the fix reaches them.\n */\n\n/**\n * GA4 measurement id: `G-` followed by alphanumeric characters.\n *\n * Vendor source: Google Analytics Help 12270356 (\"formatted as 'G-' followed by\n * alphanumeric characters\", example `G-PSW1MY7HB4`).\n *\n * NO MINIMUM LENGTH, deliberately. The familiar id is ten characters, but Google\n * documents no length at all and its own docs print `gtag('config', 'G-12345')`\n * (Help 11259997) — inventing a floor here would reject an id Google itself\n * publishes. The upper bound is sanity, not security: the `[A-Z0-9]` class already\n * excludes every character that could leave a JS string literal, so length adds\n * nothing to the guarantee.\n *\n * Uppercase only — every documented example is uppercase, and a lowercase variant\n * is not a Google-issued id. Google tag ids also exist as `GT-` and `AW-`\n * (Help 12326985), but this field is specifically the GA4 *measurement id*\n * (the nexus form labels it so, and the SITE reads it as `gaId`); accepting the\n * other prefixes is a product decision, not a security one, and is deliberately\n * left out of this fix.\n */\nexport const GA_MEASUREMENT_ID_PATTERN = /^G-[A-Z0-9]{1,32}$/\n\n/**\n * Microsoft Clarity project id: lowercase alphanumeric.\n *\n * Vendor source: Microsoft Learn `clarity-setup` publishes a live demo project\n * under id `3t0wlogvdz`; every id Microsoft prints is lowercase alphanumeric of\n * about ten characters. Microsoft documents no formal grammar, so — as with GA —\n * the bound is generous and the character class carries the guarantee.\n *\n * RESIDUAL RISK, stated plainly: no vendor page enumerates the legal Clarity\n * alphabet, so this is inferred from published examples. If some tenant holds an\n * id containing a character outside `[a-z0-9]`, this rejects it. That is why the\n * API coerces a non-matching id to `null` instead of erroring — analytics stops\n * loading for that tenant, the site keeps serving, and the misconfiguration is\n * visible and fixable rather than an outage.\n */\nexport const CLARITY_PROJECT_ID_PATTERN = /^[a-z0-9]{1,32}$/\n\n/** True only for a string matching the vendor-documented GA4 measurement id shape. */\nexport function isValidGaMeasurementId(value: unknown): value is string {\n  return typeof value === 'string' && GA_MEASUREMENT_ID_PATTERN.test(value)\n}\n\n/** True only for a string matching the vendor-documented Clarity project id shape. */\nexport function isValidClarityProjectId(value: unknown): value is string {\n  return typeof value === 'string' && CLARITY_PROJECT_ID_PATTERN.test(value)\n}\n\n/**\n * Serialises `id` as a JS string literal safe to embed in a `<script>` body.\n *\n * Reuses `jsonLdScriptContent` rather than growing a second escaper: a JSON string\n * literal IS a valid JS string literal, and that helper already does the two things\n * required here — `JSON.stringify` for the quote/backslash/newline boundary, plus\n * `<` `>` `&` U+2028 U+2029 escaping for the HTML raw-text boundary that\n * `JSON.stringify` leaves wide open. One audited primitive, one place to fix.\n */\nexport function analyticsScriptLiteral(id: string): string {\n  return jsonLdScriptContent(id)\n}\n\n/** Body of the GA4 bootstrap script. Always escapes; never trusts its caller. */\nexport function gaInitScript(gaId: string): string {\n  return `window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}gtag('js',new Date());gtag('config',${analyticsScriptLiteral(gaId)});`\n}\n\n/** Body of the Microsoft Clarity bootstrap script. Always escapes; never trusts its caller. */\nexport function clarityInitScript(clarityId: string): string {\n  return `(function(c,l,a,r,i,t,y){c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};t=l.createElement(r);t.async=1;t.src=\"https://www.clarity.ms/tag/\"+i;y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y)})(window,document,\"clarity\",\"script\",${analyticsScriptLiteral(clarityId)});`\n}\n\nexport interface AnalyticsScriptsProps {\n  /** GA4 measurement id from the SITE analytics contract. Ignored unless it matches `G-…`. */\n  gaId?: string | null\n  /** Microsoft Clarity project id from the SITE analytics contract. Ignored unless lowercase alphanumeric. */\n  clarityId?: string | null\n}\n\n/**\n * Renders the Google Analytics and Microsoft Clarity tags for a tenant, dropping\n * any id that does not match its vendor-documented shape.\n */\nexport function AnalyticsScripts({ gaId, clarityId }: AnalyticsScriptsProps) {\n  const safeGaId = isValidGaMeasurementId(gaId) ? gaId : null\n  const safeClarityId = isValidClarityProjectId(clarityId) ? clarityId : null\n\n  if (!safeGaId && !safeClarityId) return null\n\n  return (\n    <>\n      {safeGaId && (\n        <>\n          <Script\n            src={`https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(safeGaId)}`}\n            strategy='afterInteractive'\n          />\n          <Script\n            id='ga-init'\n            strategy='afterInteractive'\n            dangerouslySetInnerHTML={{ __html: gaInitScript(safeGaId) }}\n          />\n        </>\n      )}\n\n      {safeClarityId && (\n        <Script\n          id='clarity-init'\n          strategy='afterInteractive'\n          dangerouslySetInnerHTML={{ __html: clarityInitScript(safeClarityId) }}\n        />\n      )}\n    </>\n  )\n}\n","/**\n * `<JsonLd>` — safe `application/ld+json` script renderer (REB-622).\n *\n * A `<script>` element is HTML's \"raw text\" context: the parser closes it on the\n * first case-insensitive `</script` byte sequence it sees, no matter whether\n * that sequence sits inside a JSON string. `JSON.stringify` escapes for JSON\n * syntax, not for this HTML boundary, so it leaves `<` verbatim — turning any\n * JSON-LD payload built from tenant-authored data (page title, description,\n * FAQ copy, …) into a stored-XSS sink: a value containing\n * `</script><img src=x onerror=alert(1)>` breaks out of the element and runs.\n *\n * `jsonLdScriptContent` neutralises exactly that boundary while staying\n * byte-for-byte valid JSON: `<` / `>` / `&` are standard JSON\n * character escapes, so `JSON.parse` recovers the original value unchanged —\n * this is an ESCAPER, not a strip/allowlist sanitiser (see `sanitizeHtml` in\n * `@reblu/site-blocks` for that job, at the HTML boundary rather than the\n * script boundary). U+2028/U+2029 are escaped too: both are valid inside a\n * JSON string but are raw JS line terminators, and some `<script>` consumers\n * (older JS parsers, some static analysers) choke on them unescaped.\n *\n * This package, not `@reblu/site-blocks`, is the home for it: `site-blocks`'s\n * main entry bundles `parse5` + the `hast-util-*` chain + `marked` for\n * `sanitizeHtml` with `treeshake: false` — dist/index.js is ~463 KB, and PR #848\n * spent a full round removing exactly that weight (89 KB gzipped) from a client\n * bundle that only needed one HTML-escaping helper. `<JsonLd>` is Next-specific\n * (App Router's `suppressHydrationWarning` pattern) and this 40-line escaper has\n * zero dependencies of its own, so it ships as its OWN tsup entry\n * (`@reblu/site-next/json-ld`) rather than folding into the root `index` barrel\n * — importing it must never drag in `CtaButtons`/`EditableCta`'s `next/link` +\n * `@reblu/site-ui` graph, the same isolation `./cache` and `./route-handlers`\n * already use for the same reason.\n *\n * @see https://nextjs.org/docs/app/guides/json-ld\n */\n\nconst SCRIPT_BOUNDARY_UNSAFE = /[<>&\\u2028\\u2029]/g\n\nconst ESCAPES: Record<string, string> = {\n  '<': '\\\\u003c',\n  '>': '\\\\u003e',\n  '&': '\\\\u0026',\n  '\\u2028': '\\\\u2028',\n  '\\u2029': '\\\\u2029',\n}\n\n/**\n * Serialises `value` for embedding inside `<script type=\"application/ld+json\">`.\n * Escapes `<`, `>`, `&`, U+2028 and U+2029 — every escape is a standard JSON\n * character escape, so `JSON.parse(jsonLdScriptContent(value))` always recovers\n * `value` unchanged. This only ever ADDS escaping; it never strips or rewrites\n * data, unlike an HTML sanitiser.\n *\n * `JSON.stringify(undefined)` returns the JS value `undefined`, not a string\n * (`undefined` has no JSON representation), which would otherwise throw here.\n * `data` is typed `unknown` with zero friction toward `undefined`, so this\n * falls back to the JSON literal `'null'` rather than crashing an entire page\n * render over one missing field.\n */\nexport function jsonLdScriptContent(value: unknown): string {\n  const json = JSON.stringify(value) ?? 'null'\n  return json.replace(SCRIPT_BOUNDARY_UNSAFE, (char) => ESCAPES[char])\n}\n\nexport interface JsonLdProps {\n  /** Suffix for the rendered `<script>` id: `json-ld-${id}`. */\n  id: string\n  /** Structured data to serialise. Any JSON-serialisable value. */\n  data: unknown\n}\n\n/**\n * Renders one `application/ld+json` `<script>` tag using the official Next.js\n * App Router pattern. `suppressHydrationWarning` is required here: React warns\n * on a server/client `textContent` mismatch for this element even though there\n * is no real divergence — `dangerouslySetInnerHTML` content is opaque to React's\n * hydration diff.\n */\nexport function JsonLd({ id, data }: JsonLdProps) {\n  return (\n    <script\n      id={`json-ld-${id}`}\n      type='application/ld+json'\n      suppressHydrationWarning\n      dangerouslySetInnerHTML={{ __html: jsonLdScriptContent(data) }}\n    />\n  )\n}\n"],"mappings":";AAAA,OAAO,YAAY;;;AC+Ef;AA5CJ,IAAM,yBAAyB;AAE/B,IAAM,UAAkC;AAAA,EACtC,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,UAAU;AAAA,EACV,UAAU;AACZ;AAeO,SAAS,oBAAoB,OAAwB;AAC1D,QAAM,OAAO,KAAK,UAAU,KAAK,KAAK;AACtC,SAAO,KAAK,QAAQ,wBAAwB,CAAC,SAAS,QAAQ,IAAI,CAAC;AACrE;;;AD0EQ,mBACE,OAAAA,MADF;AAxED,IAAM,4BAA4B;AAiBlC,IAAM,6BAA6B;AAGnC,SAAS,uBAAuB,OAAiC;AACtE,SAAO,OAAO,UAAU,YAAY,0BAA0B,KAAK,KAAK;AAC1E;AAGO,SAAS,wBAAwB,OAAiC;AACvE,SAAO,OAAO,UAAU,YAAY,2BAA2B,KAAK,KAAK;AAC3E;AAWO,SAAS,uBAAuB,IAAoB;AACzD,SAAO,oBAAoB,EAAE;AAC/B;AAGO,SAAS,aAAa,MAAsB;AACjD,SAAO,wHAAwH,uBAAuB,IAAI,CAAC;AAC7J;AAGO,SAAS,kBAAkB,WAA2B;AAC3D,SAAO,+PAA+P,uBAAuB,SAAS,CAAC;AACzS;AAaO,SAAS,iBAAiB,EAAE,MAAM,UAAU,GAA0B;AAC3E,QAAM,WAAW,uBAAuB,IAAI,IAAI,OAAO;AACvD,QAAM,gBAAgB,wBAAwB,SAAS,IAAI,YAAY;AAEvE,MAAI,CAAC,YAAY,CAAC,cAAe,QAAO;AAExC,SACE,iCACG;AAAA,gBACC,iCACE;AAAA,sBAAAA;AAAA,QAAC;AAAA;AAAA,UACC,KAAK,+CAA+C,mBAAmB,QAAQ,CAAC;AAAA,UAChF,UAAS;AAAA;AAAA,MACX;AAAA,MACA,gBAAAA;AAAA,QAAC;AAAA;AAAA,UACC,IAAG;AAAA,UACH,UAAS;AAAA,UACT,yBAAyB,EAAE,QAAQ,aAAa,QAAQ,EAAE;AAAA;AAAA,MAC5D;AAAA,OACF;AAAA,IAGD,iBACC,gBAAAA;AAAA,MAAC;AAAA;AAAA,QACC,IAAG;AAAA,QACH,UAAS;AAAA,QACT,yBAAyB,EAAE,QAAQ,kBAAkB,aAAa,EAAE;AAAA;AAAA,IACtE;AAAA,KAEJ;AAEJ;","names":["jsx"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reblu/site-next",
-  "version": "1.4.0",
+  "version": "1.5.1",
   "description": "Next.js RSC glue for Reblu SITEs — cache + CTA + auth server/client components.",
   "license": "Apache-2.0",
   "author": "Reblu — Adolfo Unturbe",
@@ -90,6 +90,16 @@
         "types": "./dist/json-ld.d.cts",
         "default": "./dist/json-ld.cjs"
       }
+    },
+    "./analytics": {
+      "import": {
+        "types": "./dist/analytics.d.ts",
+        "default": "./dist/analytics.js"
+      },
+      "require": {
+        "types": "./dist/analytics.d.cts",
+        "default": "./dist/analytics.cjs"
+      }
     }
   },
   "publishConfig": {
@@ -101,9 +111,9 @@
     "react": ">=19"
   },
   "dependencies": {
-    "@reblu/site-client": "^3.0.0",
-    "@reblu/site-ui": "^0.3.1",
-    "@reblu/site-contracts": "^0.4.0"
+    "@reblu/site-client": "^4.0.0",
+    "@reblu/site-contracts": "^0.5.0",
+    "@reblu/site-ui": "^0.4.0"
   },
   "devDependencies": {
     "@testing-library/jest-dom": "^6.9.1",