@sarimarcus/content-sites-ui 0.22.0 → 0.22.2

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All packages in the platform release in lockstep; entries are per release version.
 
+## 0.22.2 (2026-10-04)
+
+- `./seo`: `toArticleAuthor` (a byline name to ArticleMetadata's author), `astroSchemaInput` (the Astro half of core `createSchemaContext`'s input) and `COMMON_SOURCE_LABELS` (SLA-2918).
+- `./seo` `AuthoritativeSources`: `domainClass` also accepts the synced outbound-domains store, and classifies through core `outboundClassifier`; output unchanged (SLA-2918).
+
+## 0.22.1 (2026-10-04)
+
+- `./affiliate` `resources.ts` declares each widget kind's `connect-src` hosts and the hotel widget's `script-src 'unsafe-eval'`, which the CSP coverage gate now requires. A site rendering a hotel widget needs `'unsafe-eval'` in script-src and `https://suggest.apistp.com` in connect-src; a train widget needs `https://api.omio.com`; activity, train and car need `https://tpo.gg` (SLA-2920).
+
 ## 0.22.0 (2026-10-04)
 
 - `./affiliate`: `widgetLoaders` in `resources.ts` declares each Travelpayouts widget kind's loader URL, promo id and campaign id (the CSP coverage gate reads the promo ids from it); `widgetSrc(account, options)` builds a widget loader URL from it; `gygCardItem` and `gygCardLocale` turn a cached GYG activity into an `AffiliateCardItem`. `pageTypeOf` is re-exported from core, unchanged (SLA-2919).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sarimarcus/content-sites-ui",
-  "version": "0.22.0",
+  "version": "0.22.2",
   "description": "Universal Astro UI components, layout shell and design tokens shared by the content sites.",
   "type": "module",
   "license": "MIT",
@@ -49,6 +49,6 @@
     "@lucide/astro": "^1.23.0",
     "astro": "^7.0.6",
     "tailwindcss": "^4.1.18",
-    "@sarimarcus/content-sites-core": "0.22.0"
+    "@sarimarcus/content-sites-core": "0.22.2"
   }
 }

package/src/affiliate/resources.ts

@@ -1,32 +1,36 @@
 // The third-party hosts each TravelpayoutsWidget kind loads, per CSP directive. A site rendering a kind must allow
 // these in its Content-Security-Policy (scripts/validate-csp-coverage.mjs checks the built site against this list).
 // Read from each loader's own code: the tpwdg.com/c91 loader script, then what it injects (scripts, frames,
-// stylesheets). The loaders also call analytics endpoints (connect-src: tpo.gg, brand.travelpayouts.com, and
-// suggest.apistp.com for the hotel autocomplete); those are not declared here.
+// stylesheets), and the hosts they fetch from (connect-src), traced in a browser (SLA-2920). A quoted CSP keyword
+// ('unsafe-eval') is a requirement too: the hotel loader evals, and without it renders a static fallback card.
 // Every other component in this folder loads nothing: its outbound links are caller data, not resources.
 // Plain data and erasable types only: the gate imports this file under Node.
 
 import type { WidgetLoader } from '@sarimarcus/content-sites-core/affiliate';
 
 export type WidgetKind = 'hotel' | 'activity' | 'train' | 'car';
-export type CspDirective = 'script-src' | 'frame-src' | 'style-src';
+export type CspDirective = 'script-src' | 'frame-src' | 'style-src' | 'connect-src';
 export type WidgetResources = Partial<Record<CspDirective, readonly string[]>>;
 
 export const externalResources: Record<WidgetKind, WidgetResources> = {
   hotel: {
-    'script-src': ['https://tpwdg.com'],
+    'script-src': ['https://tpwdg.com', "'unsafe-eval'"],
+    'connect-src': ['https://suggest.apistp.com', 'https://avsplow.com', 'https://sentry.avs.io'],
   },
   activity: {
     'script-src': ['https://tpwdg.com', 'https://widget.getyourguide.com'],
     'frame-src': ['https://widget.getyourguide.com'],
+    'connect-src': ['https://tpo.gg', 'https://widget.getyourguide.com'],
   },
   train: {
     'script-src': ['https://c91.travelpayouts.com', 'https://www.omio.com'],
     'style-src': ['https://www.omio.com'],
+    'connect-src': ['https://tpo.gg', 'https://api.omio.com'],
   },
   car: {
     'script-src': ['https://tpwdg.com', 'https://www.discovercars.com'],
     'frame-src': ['https://widget.discovercars.com'],
+    'connect-src': ['https://tpo.gg'],
   },
 };
 
@@ -47,4 +51,5 @@ export const EMERALD_ORIGIN = 'https://emrldtp.com';
 
 export const emeraldResources: Partial<Record<CspDirective, readonly string[]>> = {
   'script-src': [EMERALD_ORIGIN],
+  'connect-src': [EMERALD_ORIGIN],
 };

package/src/seo/AuthoritativeSources.astro

@@ -7,7 +7,7 @@
  * A source is a URL string, labelled from `domainLabels` (by host, without `www.`) or else by its host, or an object
  * { url, name?, description?, quote? }: `description` is a curated blurb, `quote` the verbatim cited sentence.
  *
- * Link policy (Rule 38), from `domainClass` (host → class, or a function of the URL): a competitor renders its label
+ * Link policy (Rule 38), from `domainClass` (host → class, the outbound-domains store, or a function of the URL): a competitor renders its label
  * unlinked (the item stays, so footnote numbers hold), an affiliate link carries rel="noopener sponsored", any other
  * rel="noopener".
  *
@@ -15,6 +15,7 @@
  * ("Host — Prices"), so two pages of one domain stay distinguishable. Explicit names, repeat citations of one URL and
  * domain-root URLs keep their label.
  */
+import { outboundClassifier } from '@sarimarcus/content-sites-core/url';
 import type { SourceInput, DomainClassifier } from './types';
 
 interface Props {
@@ -55,19 +56,7 @@ const {
 
 if (!sources || sources.length === 0) return null;
 
-const hostKey = (host: string) => host.toLowerCase().replace(/^www\./, '');
-const classMap = typeof domainClass === 'function'
-  ? null
-  : new Map(Object.entries(domainClass).map(([d, c]) => [hostKey(d), c]));
-
-function classify(url: string): string {
-  if (typeof domainClass === 'function') return domainClass(url);
-  try {
-    return classMap?.get(hostKey(new URL(url).hostname)) ?? 'other';
-  } catch {
-    return 'other';
-  }
-}
+const classify = typeof domainClass === 'function' ? domainClass : outboundClassifier(domainClass);
 
 function domainLabel(url: string): string {
   try {

package/src/seo/author.ts

@@ -0,0 +1,30 @@
+import type { ImageMetadata } from 'astro';
+import { url } from '@sarimarcus/content-sites-core/url';
+import type { ArticleAuthor } from './types';
+
+/** The fields of a site's author profile that a byline uses. */
+export interface ArticleAuthorProfile {
+  slug: string;
+  photo?: string;
+  credentials?: string;
+}
+
+/**
+ * A byline name as ArticleMetadata's author: its profile (from `findProfile`) URL, portrait (from `portrait(slug)`),
+ * photo URL and credentials. An unknown name keeps only the name; no name gives no author.
+ */
+export function toArticleAuthor(
+  name: string | undefined,
+  findProfile: (name: string) => ArticleAuthorProfile | undefined,
+  portrait: (slug: string) => ImageMetadata | null,
+): ArticleAuthor | undefined {
+  if (!name) return undefined;
+  const profile = findProfile(name);
+  return {
+    name,
+    href: profile ? url(`/author/${profile.slug}`) : null,
+    image: profile?.slug ? portrait(profile.slug) : null,
+    photoUrl: profile?.photo ? url(profile.photo) : null,
+    credentials: profile?.credentials ?? null,
+  };
+}

package/src/seo/index.ts

@@ -5,4 +5,8 @@ export { default as Breadcrumb } from './Breadcrumb.astro';
 export { default as ArticleMetadata } from './ArticleMetadata.astro';
 export { default as AuthoritativeSources } from './AuthoritativeSources.astro';
 export { escapeJsonLd } from './jsonLd';
+export { toArticleAuthor } from './author';
+export type { ArticleAuthorProfile } from './author';
+export { astroSchemaInput } from './schemaContext';
+export { COMMON_SOURCE_LABELS } from './sourceLabels';
 export type { BreadcrumbItem, ArticleAuthor, SourceInput, DomainClassifier } from './types';

package/src/seo/schemaContext.ts

@@ -0,0 +1,15 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+/**
+ * The page half of core `createSchemaContext`'s input, from Astro: site URL (else `fallbackSiteUrl`), base path,
+ * page path, and `fileExists` on `public/`.
+ */
+export function astroSchemaInput(astro: { site?: URL; url: URL }, fallbackSiteUrl: string) {
+  return {
+    siteUrl: astro.site?.href || fallbackSiteUrl,
+    basePath: import.meta.env.BASE_URL.replace(/\/$/, ''),
+    pagePath: astro.url.pathname,
+    fileExists: (p: string) => fs.existsSync(path.join(process.cwd(), 'public', p)),
+  };
+}

package/src/seo/sourceLabels.ts

@@ -0,0 +1,12 @@
+/** Labels (by host, without `www.`) for the reference sources every site cites; a site spreads its own over these. */
+export const COMMON_SOURCE_LABELS: Readonly<Record<string, string>> = {
+  'wikipedia.org': 'Wikipedia',
+  'en.wikipedia.org': 'Wikipedia',
+  'britannica.com': 'Britannica',
+  'unesco.org': 'UNESCO',
+  'whc.unesco.org': 'UNESCO World Heritage',
+  'tripadvisor.com': 'TripAdvisor',
+  'booking.com': 'Booking.com',
+  'getyourguide.com': 'GetYourGuide',
+  'viator.com': 'Viator',
+};

package/src/seo/types.ts

@@ -1,4 +1,5 @@
 import type { ImageMetadata } from 'astro';
+import type { OutboundDomainStore } from '@sarimarcus/content-sites-core/url';
 
 export interface BreadcrumbItem {
   name: string;
@@ -16,5 +17,5 @@ export interface ArticleAuthor {
 
 export type SourceInput = string | { name?: string; url: string; description?: string; quote?: string };
 
-/** Host → outbound class (`competitor`, `affiliate`, …), or a function of the URL. */
-export type DomainClassifier = Record<string, string> | ((url: string) => string);
+/** Host → outbound class (`competitor`, `affiliate`, …), the synced outbound-domains store, or a function of the URL. */
+export type DomainClassifier = Record<string, string> | OutboundDomainStore | ((url: string) => string);