@soloworks/smking-next 0.18.0 → 0.20.0

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @soloworks/smking-next
 
+## 0.20.0 — 2026-06-02
+
+**`<SmkingCms>` now emits the structured-data engine's JSON-LD `@graph` inline.**
+
+CMS pages get a full multi-entity `@graph` (BlogPosting / Organization /
+WebSite / BreadcrumbList / FAQPage, `@id`-linked) generated by the smking
+structured-data engine and served via `/api/v1/public/page`. `<SmkingCms>`
+inlines it as `<script type="application/ld+json">` — JSON-LD is valid in
+`<body>`, so no head hoisting needed (unlike `<title>`/`<meta>`, which
+React 19 still hoists for you). The `safeJson` escaper (`</` + U+2028/U+2029)
+is extracted into a shared `lib/safe-json.ts` that `<SmkingAEO>` imports too.
+
+No customer code change — `<SmkingCms>` picks up the new `jsonLd` field
+automatically once a page is republished under the engine. Bump your
+constraint to `^0.20`.
+
+## 0.19.0 — 2026-05-29
+
+**CMS base path reported via heartbeat — dashboard "View page" resolves real URLs without per-page visits.**
+
+`getAeoContent()`'s heartbeat (`sdk_meta`) now sends `cms_base_path` from
+`SMKING_CMS_PATH` (default `/blog`). smking stores it site-level and builds
+"View page" links as `domain + base path + slug` — a page resolves the
+moment any page on the site is crawled, instead of waiting for that specific
+page to be visited (supersedes 0.18.0's per-slug URL reporting). Set
+`SMKING_CMS_PATH` if your CMS catch-all is mounted somewhere other than
+`/blog`.
+
 ## 0.18.0 — 2026-05-28
 
 **CMS live-URL reporting — `<SmkingCms>` now tells the dashboard each page's real public URL.**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soloworks/smking-next",
-  "version": "0.18.0",
+  "version": "0.20.0",
   "description": "AI-native SEO (AEO) for Next.js — auto-inject JSON-LD, FAQ, AI summary, and SEO metadata so AI crawlers (ChatGPT, Perplexity, Google AI) can cite your pages.",
   "license": "MIT",
   "homepage": "https://github.com/sillyleo/smking/tree/main/packages/smking-next",

package/src/components/smking-aeo.tsx

@@ -1,5 +1,6 @@
 import type { DiscoverParams } from "../types";
 import { getAeoContent } from "../lib/client";
+import { safeJson } from "../lib/safe-json";
 
 const SR_ONLY_STYLE: React.CSSProperties = {
   position: "absolute",
@@ -118,17 +119,3 @@ export async function SmkingAEO(props: SmkingAEOProps) {
     </>
   );
 }
-
-/**
- * Escape JSON for safe `<script>` embedding. Covers the three values
- * that can break out:
- *   - `</` (any `</script>`-like sequence)
- *   - U+2028 / U+2029 (treated as line terminators inside a JS string
- *     literal, which would corrupt the embedded JSON)
- */
-function safeJson(value: Record<string, unknown>): string {
-  return JSON.stringify(value)
-    .replace(/<\//g, "<\\/")
-    .replace(/\u2028/g, "\\u2028")
-    .replace(/\u2029/g, "\\u2029");
-}

package/src/components/smking-cms.tsx

@@ -1,4 +1,5 @@
 import { getCmsPage } from "../lib/cms-client";
+import { safeJson } from "../lib/safe-json";
 import type { CmsParams } from "../types";
 
 /**
@@ -72,6 +73,17 @@ export async function SmkingCms(props: CmsParams) {
         <link rel="canonical" href={seo.canonicalUrl} data-smking="cms" />
       )}
 
+      {/* Engine-precomputed @graph. JSON-LD is valid in <body>, so no
+          head hoisting needed (unlike title/meta above). */}
+      {data.page.jsonLd && (
+        <script
+          type="application/ld+json"
+          data-smking="cms"
+          // eslint-disable-next-line react/no-danger -- escaped via safeJson; engine output is schema-bounded
+          dangerouslySetInnerHTML={{ __html: safeJson(data.page.jsonLd) }}
+        />
+      )}
+
       {/* Raw passthrough — bodyHtml is SaaS-emitted Plate output (Tailwind
           utility + slate-* hooks + data-slate-* attrs all intact). No
           article shell, no canonical CSS injection: what the dashboard

package/src/lib/client.ts

@@ -110,7 +110,11 @@ export async function getAeoContent(
           sdk_version: SDK_VERSION,
           app_env: process.env.NODE_ENV ?? null,
           host: safeHostname(url),
+          // Site-level CMS base path → smking dashboard "View page" URLs.
+          // Default "/blog"; override with SMKING_CMS_PATH (wizard sets it).
+          cms_base_path: process.env.SMKING_CMS_PATH ?? "/blog",
         },
+
       }),
       signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
       next: {

package/src/lib/safe-json.ts

@@ -0,0 +1,21 @@
+/**
+ * Escape an object for safe `<script type="application/ld+json">`
+ * embedding. Covers the sequences that can break out of / corrupt the
+ * script:
+ *   - `</` (any `</script>`-like sequence)
+ *   - U+2028 / U+2029 (JS string-literal line terminators)
+ *
+ * The U+2028 / U+2029 patterns are built via `new RegExp("\\u2028", ...)`
+ * (escaped-backslash strings) so this source file stays pure ASCII — no
+ * invisible line-separator characters to corrupt on edit.
+ *
+ * Shared by `<SmkingAEO>` and `<SmkingCms>`. Engine output is
+ * schema-bounded, but this guard is mandatory defence-in-depth — never
+ * inline JSON-LD without it.
+ */
+export function safeJson(value: Record<string, unknown>): string {
+  return JSON.stringify(value)
+    .replace(/<\//g, "<\\/")
+    .replace(new RegExp("\\u2028", "g"), "\\u2028")
+    .replace(new RegExp("\\u2029", "g"), "\\u2029");
+}

package/src/types.ts

@@ -191,6 +191,12 @@ export interface CmsPage {
   excerpt?: string | null;
   featuredImageUrl?: string | null;
   publishedAt: string | null;
+  /**
+   * v0.M1+ engine-precomputed schema.org @graph. `<SmkingCms>` inlines it
+   * as `<script type="application/ld+json">`. Null until the page is
+   * republished under the structured-data engine.
+   */
+  jsonLd?: Record<string, unknown> | null;
 }
 
 /**