@sarimarcus/content-sites-ui 0.22.0 → 0.22.1

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All packages in the platform release in lockstep; entries are per release version.
 
+## 0.22.1 (2026-10-04)
+
+- `./affiliate` `resources.ts` declares each widget kind's `connect-src` hosts and the hotel widget's `script-src 'unsafe-eval'`, which the CSP coverage gate now requires. A site rendering a hotel widget needs `'unsafe-eval'` in script-src and `https://suggest.apistp.com` in connect-src; a train widget needs `https://api.omio.com`; activity, train and car need `https://tpo.gg` (SLA-2920).
+
 ## 0.22.0 (2026-10-04)
 
 - `./affiliate`: `widgetLoaders` in `resources.ts` declares each Travelpayouts widget kind's loader URL, promo id and campaign id (the CSP coverage gate reads the promo ids from it); `widgetSrc(account, options)` builds a widget loader URL from it; `gygCardItem` and `gygCardLocale` turn a cached GYG activity into an `AffiliateCardItem`. `pageTypeOf` is re-exported from core, unchanged (SLA-2919).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sarimarcus/content-sites-ui",
-  "version": "0.22.0",
+  "version": "0.22.1",
   "description": "Universal Astro UI components, layout shell and design tokens shared by the content sites.",
   "type": "module",
   "license": "MIT",
@@ -49,6 +49,6 @@
     "@lucide/astro": "^1.23.0",
     "astro": "^7.0.6",
     "tailwindcss": "^4.1.18",
-    "@sarimarcus/content-sites-core": "0.22.0"
+    "@sarimarcus/content-sites-core": "0.22.1"
   }
 }

package/src/affiliate/resources.ts

@@ -1,32 +1,36 @@
 // The third-party hosts each TravelpayoutsWidget kind loads, per CSP directive. A site rendering a kind must allow
 // these in its Content-Security-Policy (scripts/validate-csp-coverage.mjs checks the built site against this list).
 // Read from each loader's own code: the tpwdg.com/c91 loader script, then what it injects (scripts, frames,
-// stylesheets). The loaders also call analytics endpoints (connect-src: tpo.gg, brand.travelpayouts.com, and
-// suggest.apistp.com for the hotel autocomplete); those are not declared here.
+// stylesheets), and the hosts they fetch from (connect-src), traced in a browser (SLA-2920). A quoted CSP keyword
+// ('unsafe-eval') is a requirement too: the hotel loader evals, and without it renders a static fallback card.
 // Every other component in this folder loads nothing: its outbound links are caller data, not resources.
 // Plain data and erasable types only: the gate imports this file under Node.
 
 import type { WidgetLoader } from '@sarimarcus/content-sites-core/affiliate';
 
 export type WidgetKind = 'hotel' | 'activity' | 'train' | 'car';
-export type CspDirective = 'script-src' | 'frame-src' | 'style-src';
+export type CspDirective = 'script-src' | 'frame-src' | 'style-src' | 'connect-src';
 export type WidgetResources = Partial<Record<CspDirective, readonly string[]>>;
 
 export const externalResources: Record<WidgetKind, WidgetResources> = {
   hotel: {
-    'script-src': ['https://tpwdg.com'],
+    'script-src': ['https://tpwdg.com', "'unsafe-eval'"],
+    'connect-src': ['https://suggest.apistp.com', 'https://avsplow.com', 'https://sentry.avs.io'],
   },
   activity: {
     'script-src': ['https://tpwdg.com', 'https://widget.getyourguide.com'],
     'frame-src': ['https://widget.getyourguide.com'],
+    'connect-src': ['https://tpo.gg', 'https://widget.getyourguide.com'],
   },
   train: {
     'script-src': ['https://c91.travelpayouts.com', 'https://www.omio.com'],
     'style-src': ['https://www.omio.com'],
+    'connect-src': ['https://tpo.gg', 'https://api.omio.com'],
   },
   car: {
     'script-src': ['https://tpwdg.com', 'https://www.discovercars.com'],
     'frame-src': ['https://widget.discovercars.com'],
+    'connect-src': ['https://tpo.gg'],
   },
 };
 
@@ -47,4 +51,5 @@ export const EMERALD_ORIGIN = 'https://emrldtp.com';
 
 export const emeraldResources: Partial<Record<CspDirective, readonly string[]>> = {
   'script-src': [EMERALD_ORIGIN],
+  'connect-src': [EMERALD_ORIGIN],
 };