@sonordev/site-kit 3.0.5 → 3.2.0

package/dist/chunk-X4OPM3SK.mjs

@@ -0,0 +1,43 @@
+// src/sites/contract.ts
+var SITE_HOST_CONTRACT_VERSION = 1;
+function normalizeSiteHost(site) {
+  if (!site || typeof site !== "string") return null;
+  let s = site.trim().toLowerCase();
+  if (!s) return null;
+  s = s.replace(/^https?:\/\//, "");
+  const slash = s.indexOf("/");
+  if (slash >= 0) s = s.slice(0, slash);
+  const colon = s.indexOf(":");
+  if (colon >= 0) s = s.slice(0, colon);
+  return s || null;
+}
+function stripWww(host) {
+  return host.startsWith("www.") ? host.slice(4) : host;
+}
+function sameSite(a, b) {
+  if (!a || !b) return false;
+  return stripWww(a) === stripWww(b);
+}
+function hostFromUrl(value) {
+  if (!value || !value.startsWith("http://") && !value.startsWith("https://")) return null;
+  try {
+    return normalizeSiteHost(new URL(value).host);
+  } catch {
+    return null;
+  }
+}
+function isNormalizedSiteHost(value) {
+  return typeof value === "string" && value.length > 0 && normalizeSiteHost(value) === value;
+}
+var SITE_HOST_JSON_SCHEMA = {
+  $schema: "http://json-schema.org/draft-07/schema#",
+  $id: "https://sonor.io/schemas/site-host.v1.json",
+  title: "NormalizedSiteHost",
+  description: "A normalized sub-site host (the multi-site `site` dimension): lowercase, no protocol, no path, no port. null denotes a project-wide (unattributed) row.",
+  type: ["string", "null"],
+  pattern: "^[a-z0-9.-]+$"
+};
+
+export { SITE_HOST_CONTRACT_VERSION, SITE_HOST_JSON_SCHEMA, hostFromUrl, isNormalizedSiteHost, normalizeSiteHost, sameSite, stripWww };
+//# sourceMappingURL=chunk-X4OPM3SK.mjs.map
+//# sourceMappingURL=chunk-X4OPM3SK.mjs.map

package/dist/chunk-X4OPM3SK.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sites/contract.ts"],"names":[],"mappings":";AAgBO,IAAM,0BAAA,GAA6B;AAanC,SAAS,kBAAkB,IAAA,EAAqC;AACrE,EAAA,IAAI,CAAC,IAAA,IAAQ,OAAO,IAAA,KAAS,UAAU,OAAO,IAAA;AAC9C,EAAA,IAAI,CAAA,GAAI,IAAA,CAAK,IAAA,EAAK,CAAE,WAAA,EAAY;AAChC,EAAA,IAAI,CAAC,GAAG,OAAO,IAAA;AAEf,EAAA,CAAA,GAAI,CAAA,CAAE,OAAA,CAAQ,cAAA,EAAgB,EAAE,CAAA;AAEhC,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AAC3B,EAAA,IAAI,SAAS,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,KAAA,CAAM,GAAG,KAAK,CAAA;AAEpC,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AAC3B,EAAA,IAAI,SAAS,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,KAAA,CAAM,GAAG,KAAK,CAAA;AACpC,EAAA,OAAO,CAAA,IAAK,IAAA;AACd;AAGO,SAAS,SAAS,IAAA,EAAsB;AAC7C,EAAA,OAAO,KAAK,UAAA,CAAW,MAAM,IAAI,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,GAAI,IAAA;AACnD;AAOO,SAAS,QAAA,CAAS,GAA8B,CAAA,EAAuC;AAC5F,EAAA,IAAI,CAAC,CAAA,IAAK,CAAC,CAAA,EAAG,OAAO,KAAA;AACrB,EAAA,OAAO,QAAA,CAAS,CAAC,CAAA,KAAM,QAAA,CAAS,CAAC,CAAA;AACnC;AAMO,SAAS,YAAY,KAAA,EAAiD;AAC3E,EAAA,IAAI,CAAC,KAAA,IAAU,CAAC,KAAA,CAAM,UAAA,CAAW,SAAS,CAAA,IAAK,CAAC,KAAA,CAAM,UAAA,CAAW,UAAU,CAAA,EAAI,OAAO,IAAA;AACtF,EAAA,IAAI;AACF,IAAA,OAAO,iBAAA,CAAkB,IAAI,GAAA,CAAI,KAAK,EAAE,IAAI,CAAA;AAAA,EAC9C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,qBAAqB,KAAA,EAAiC;AACpE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,CAAM,SAAS,CAAA,IAAK,iBAAA,CAAkB,KAAK,CAAA,KAAM,KAAA;AACvF;AAMO,IAAM,qBAAA,GAAwB;AAAA,EACnC,OAAA,EAAS,yCAAA;AAAA,EACT,GAAA,EAAK,4CAAA;AAAA,EACL,KAAA,EAAO,oBAAA;AAAA,EACP,WAAA,EACE,yJAAA;AAAA,EACF,IAAA,EAAM,CAAC,QAAA,EAAU,MAAM,CAAA;AAAA,EACvB,OAAA,EAAS;AACX","file":"chunk-X4OPM3SK.mjs","sourcesContent":["/**\n * @sonordev/site-kit/sites/contract — Multi-site \"site\" dimension host contract (v1)\n *\n * Single source of truth for normalizing and comparing sub-site host values\n * (the multi-site `site` dimension, see CLAUDE.md). Same pattern as\n * `@sonordev/site-kit/llms/contract` and `@sonordev/site-kit/slots/contract`:\n * site-kit owns the canonical logic; the Nest APIs keep byte-identical inline\n * mirrors (sonor-api `src/common/utils/site-host.ts`, signal-api\n * `src/shared/utils/seo-page-pick.util.ts`) guarded by the shared drift-test\n * vectors in `contract.test.ts` — so a divergent copy fails CI on either side.\n *\n * Pure string logic only (no Node built-ins) so it is safe in the browser:\n * site-kit itself normalizes `__SITE_KIT_SITE__` with `normalizeSiteHost`.\n */\n\n/** Bump on breaking changes to the normalized host shape. */\nexport const SITE_HOST_CONTRACT_VERSION = 1 as const\n\n/**\n * normalizeSiteHost — canonical normalizer for a sub-site host value before it\n * is persisted or used as a filter.\n *\n *   `https://OhioPowerStudies.com:3000/path` → `ohiopowerstudies.com`\n *\n * Lowercases, strips protocol, keeps host only (drops path + query), strips\n * port (rollups span dev/prod). Returns null for empty/non-string input.\n * Note: `www.` is intentionally preserved here — use `sameSite`/`stripWww`\n * for www-insensitive equality.\n */\nexport function normalizeSiteHost(site?: string | null): string | null {\n  if (!site || typeof site !== 'string') return null\n  let s = site.trim().toLowerCase()\n  if (!s) return null\n  // Strip protocol if present\n  s = s.replace(/^https?:\\/\\//, '')\n  // Keep host only — drop everything from first slash onward\n  const slash = s.indexOf('/')\n  if (slash >= 0) s = s.slice(0, slash)\n  // Strip port (rollups span dev/prod)\n  const colon = s.indexOf(':')\n  if (colon >= 0) s = s.slice(0, colon)\n  return s || null\n}\n\n/** Strip a leading `www.` from a host (\"www.tps.com\" → \"tps.com\"). */\nexport function stripWww(host: string): string {\n  return host.startsWith('www.') ? host.slice(4) : host\n}\n\n/**\n * www-insensitive sub-site host equality — `www.a.com` and `a.com` are the\n * same site. Operands are expected already-normalized (lowercase host);\n * returns false if either side is missing.\n */\nexport function sameSite(a: string | null | undefined, b: string | null | undefined): boolean {\n  if (!a || !b) return false\n  return stripWww(a) === stripWww(b)\n}\n\n/**\n * Host of a full URL (\"https://ohiopowerstudies.com/x\" → \"ohiopowerstudies.com\"),\n * null for site-relative paths (\"/services\") and unparseable input.\n */\nexport function hostFromUrl(value: string | null | undefined): string | null {\n  if (!value || (!value.startsWith('http://') && !value.startsWith('https://'))) return null\n  try {\n    return normalizeSiteHost(new URL(value).host)\n  } catch {\n    return null\n  }\n}\n\n/** True when `value` is a non-empty normalized host (lowercase, no protocol/path/port). */\nexport function isNormalizedSiteHost(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0 && normalizeSiteHost(value) === value\n}\n\n/**\n * Agent-native contract: JSON Schema for a normalized `site` value, so services\n * and agents can validate the dimension mechanically without importing the code.\n */\nexport const SITE_HOST_JSON_SCHEMA = {\n  $schema: 'http://json-schema.org/draft-07/schema#',\n  $id: 'https://sonor.io/schemas/site-host.v1.json',\n  title: 'NormalizedSiteHost',\n  description:\n    'A normalized sub-site host (the multi-site `site` dimension): lowercase, no protocol, no path, no port. null denotes a project-wide (unattributed) row.',\n  type: ['string', 'null'],\n  pattern: '^[a-z0-9.-]+$',\n} as const\n"]}

package/dist/chunk-ZPLN537Q.mjs

@@ -0,0 +1,57 @@
+// src/fleet/contract.ts
+var FLEET_CONTRACT_VERSION = 1;
+var FLEET_MODULES = [
+  "analytics",
+  "engage",
+  "signal",
+  "sitemapSync",
+  "forms",
+  "commerce",
+  "sync",
+  "maps",
+  "slots"
+];
+var FLEET_MODULES_MAX = 32;
+var FLEET_VERSION_MAX_LENGTH = 40;
+var FLEET_VERSION_PATTERN = /^[0-9]+\.[0-9]+\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?$/;
+var FLEET_SITE_MAX_LENGTH = 253;
+function isFleetModule(x) {
+  return typeof x === "string" && FLEET_MODULES.includes(x);
+}
+function normalizeFleetModules(input) {
+  if (!Array.isArray(input)) return [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of input) {
+    if (isFleetModule(item)) seen.add(item);
+    if (seen.size >= FLEET_MODULES_MAX) break;
+  }
+  return FLEET_MODULES.filter((m) => seen.has(m));
+}
+function sanitizeFleetVersion(raw) {
+  if (typeof raw !== "string") return null;
+  const s = raw.trim();
+  if (!s || s.length > FLEET_VERSION_MAX_LENGTH) return null;
+  return FLEET_VERSION_PATTERN.test(s) ? s : null;
+}
+function normalizeFleetSite(raw) {
+  if (typeof raw !== "string") return null;
+  let s = raw.trim().toLowerCase();
+  if (!s) return null;
+  s = s.replace(/^https?:\/\//, "").replace(/\/.*$/, "").replace(/:\d+$/, "");
+  if (!s || s.length > FLEET_SITE_MAX_LENGTH) return null;
+  return s;
+}
+function buildFleetHeartbeatPayload(input) {
+  return {
+    contract_version: FLEET_CONTRACT_VERSION,
+    kit_version: input.kitVersion,
+    next_version: sanitizeFleetVersion(input.nextVersion ?? null),
+    modules: normalizeFleetModules(input.modules),
+    site: normalizeFleetSite(input.site ?? null),
+    source: input.source === "build" ? "build" : "client"
+  };
+}
+
+export { FLEET_CONTRACT_VERSION, FLEET_MODULES, FLEET_MODULES_MAX, FLEET_SITE_MAX_LENGTH, FLEET_VERSION_MAX_LENGTH, FLEET_VERSION_PATTERN, buildFleetHeartbeatPayload, isFleetModule, normalizeFleetModules, normalizeFleetSite, sanitizeFleetVersion };
+//# sourceMappingURL=chunk-ZPLN537Q.mjs.map
+//# sourceMappingURL=chunk-ZPLN537Q.mjs.map

package/dist/chunk-ZPLN537Q.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/fleet/contract.ts"],"names":[],"mappings":";AAwBO,IAAM,sBAAA,GAAyB;AAuB/B,IAAM,aAAA,GAAwC;AAAA,EACnD,WAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,aAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF;AAMO,IAAM,iBAAA,GAAoB;AAE1B,IAAM,wBAAA,GAA2B;AAEjC,IAAM,qBAAA,GAAwB;AAE9B,IAAM,qBAAA,GAAwB;AA4B9B,SAAS,cAAc,CAAA,EAA8B;AAC1D,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,IAAa,aAAA,CAAoC,SAAS,CAAC,CAAA;AACjF;AAMO,SAAS,sBAAsB,KAAA,EAA+B;AACnE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,SAAU,EAAC;AACnC,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAiB;AAClC,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,IAAI,aAAA,CAAc,IAAI,CAAA,EAAG,IAAA,CAAK,IAAI,IAAI,CAAA;AACtC,IAAA,IAAI,IAAA,CAAK,QAAQ,iBAAA,EAAmB;AAAA,EACtC;AACA,EAAA,OAAO,cAAc,MAAA,CAAO,CAAC,MAAM,IAAA,CAAK,GAAA,CAAI,CAAC,CAAC,CAAA;AAChD;AAGO,SAAS,qBAAqB,GAAA,EAA6B;AAChE,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,IAAA;AACpC,EAAA,MAAM,CAAA,GAAI,IAAI,IAAA,EAAK;AACnB,EAAA,IAAI,CAAC,CAAA,IAAK,CAAA,CAAE,MAAA,GAAS,0BAA0B,OAAO,IAAA;AACtD,EAAA,OAAO,qBAAA,CAAsB,IAAA,CAAK,CAAC,CAAA,GAAI,CAAA,GAAI,IAAA;AAC7C;AAQO,SAAS,mBAAmB,GAAA,EAA6B;AAC9D,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,IAAA;AACpC,EAAA,IAAI,CAAA,GAAI,GAAA,CAAI,IAAA,EAAK,CAAE,WAAA,EAAY;AAC/B,EAAA,IAAI,CAAC,GAAG,OAAO,IAAA;AACf,EAAA,CAAA,GAAI,CAAA,CACD,OAAA,CAAQ,cAAA,EAAgB,EAAE,CAAA,CAC1B,OAAA,CAAQ,OAAA,EAAS,EAAE,CAAA,CACnB,OAAA,CAAQ,OAAA,EAAS,EAAE,CAAA;AACtB,EAAA,IAAI,CAAC,CAAA,IAAK,CAAA,CAAE,MAAA,GAAS,uBAAuB,OAAO,IAAA;AACnD,EAAA,OAAO,CAAA;AACT;AAOO,SAAS,2BAA2B,KAAA,EAMjB;AACxB,EAAA,OAAO;AAAA,IACL,gBAAA,EAAkB,sBAAA;AAAA,IAClB,aAAa,KAAA,CAAM,UAAA;AAAA,IACnB,YAAA,EAAc,oBAAA,CAAqB,KAAA,CAAM,WAAA,IAAe,IAAI,CAAA;AAAA,IAC5D,OAAA,EAAS,qBAAA,CAAsB,KAAA,CAAM,OAAO,CAAA;AAAA,IAC5C,IAAA,EAAM,kBAAA,CAAmB,KAAA,CAAM,IAAA,IAAQ,IAAI,CAAA;AAAA,IAC3C,MAAA,EAAQ,KAAA,CAAM,MAAA,KAAW,OAAA,GAAU,OAAA,GAAU;AAAA,GAC/C;AACF","file":"chunk-ZPLN537Q.mjs","sourcesContent":["/**\n * @sonordev/site-kit/fleet/contract — Fleet heartbeat wire contract (v1)\n *\n * Single source of truth for the heartbeat payload shape, shared by site-kit\n * (send side) and sonor-api (ingest side) — the same pattern as\n * `@sonordev/site-kit/llms/contract` and `@sonordev/site-kit/slots/contract`.\n * Import THIS module (never the React component) from the Nest APIs.\n *\n * Why it exists: ~24+ client sites run site-kit at wildly drifted versions and\n * the platform could not answer \"which version / modules / key state is each\n * site running\" without shelling into every local repo. The heartbeat answers\n * that from live traffic. It is fire-and-forget, deferred to idle (never in the\n * hydration path), and carries NO visitor data — only the site's own build\n * fingerprint. Project identity is resolved server-side from the x-api-key\n * header, exactly like every other /api/public/* endpoint; sites never send\n * project IDs.\n *\n * The x-sitekit-version header (set by shared/sonorFetch on every request)\n * already gives the platform a passive \"last seen version\" for ALL traffic,\n * including server-only module fetches. The heartbeat adds the things a header\n * can't carry: the active module set and the host Next.js version.\n */\n\n/** Bump on breaking payload changes. Ingest accepts the current version. */\nexport const FLEET_CONTRACT_VERSION = 1\n\n/**\n * Client-observable site-kit modules — the set a site can honestly self-report\n * from a client boot, because SiteKitClientProviders actually mounts them.\n *\n * Server-only modules (seo, blog, images, reputation, redirects, llms) are\n * intentionally absent: they render on the server and cannot be observed from\n * the browser. Their usage still surfaces passively through the\n * x-sitekit-version header on their own server fetches.\n */\nexport type FleetModule =\n  | 'analytics'\n  | 'engage'\n  | 'signal'\n  | 'sitemapSync'\n  | 'forms'\n  | 'commerce'\n  | 'sync'\n  | 'maps'\n  | 'slots'\n\n/** Canonical order — used to serialize equal module sets identically. */\nexport const FLEET_MODULES: readonly FleetModule[] = [\n  'analytics',\n  'engage',\n  'signal',\n  'sitemapSync',\n  'forms',\n  'commerce',\n  'sync',\n  'maps',\n  'slots',\n] as const\n\n/** Where a heartbeat originated. */\nexport type FleetHeartbeatSource = 'client' | 'build'\n\n/** Hard cap on modules accepted in one payload (junk guard). */\nexport const FLEET_MODULES_MAX = 32\n/** Hard cap on the free-form version strings we accept. */\nexport const FLEET_VERSION_MAX_LENGTH = 40\n/** Semver-ish shape. Non-matching values are stored as null, never rejected. */\nexport const FLEET_VERSION_PATTERN = /^[0-9]+\\.[0-9]+\\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?$/\n/** Max host length per RFC 1035. */\nexport const FLEET_SITE_MAX_LENGTH = 253\n\n/**\n * The heartbeat body a site POSTs to `/api/public/fleet/heartbeat`.\n * All wire fields are snake_case to match the other contract modules and the\n * agent-facing read endpoints.\n */\nexport interface FleetHeartbeatPayload {\n  contract_version: number\n  /** SITE_KIT_VERSION at runtime, e.g. \"3.2.0\". */\n  kit_version: string\n  /** Installed Next.js version if detectable, else null. */\n  next_version?: string | null\n  /** Client-observable active modules — deduped, validated, canonical order. */\n  modules: FleetModule[]\n  /** Normalized lowercase host (multi-site sub-dimension; see CLAUDE.md). */\n  site?: string | null\n  /** 'client' (runtime boot) or 'build' (CI/build step). Default 'client'. */\n  source?: FleetHeartbeatSource\n}\n\n/** The ingest endpoint's response. `received_at` is server-stamped ISO 8601. */\nexport interface FleetHeartbeatResponse {\n  ok: boolean\n  contract_version: number\n  received_at: string\n}\n\nexport function isFleetModule(x: unknown): x is FleetModule {\n  return typeof x === 'string' && (FLEET_MODULES as readonly string[]).includes(x)\n}\n\n/**\n * Dedupe + validate a modules array: drop unknowns, cap length, emit in the\n * canonical FLEET_MODULES order so equal sets always serialize identically.\n */\nexport function normalizeFleetModules(input: unknown): FleetModule[] {\n  if (!Array.isArray(input)) return []\n  const seen = new Set<FleetModule>()\n  for (const item of input) {\n    if (isFleetModule(item)) seen.add(item)\n    if (seen.size >= FLEET_MODULES_MAX) break\n  }\n  return FLEET_MODULES.filter((m) => seen.has(m))\n}\n\n/** Coerce a version-ish string to a clean value or null (never throws). */\nexport function sanitizeFleetVersion(raw: unknown): string | null {\n  if (typeof raw !== 'string') return null\n  const s = raw.trim()\n  if (!s || s.length > FLEET_VERSION_MAX_LENGTH) return null\n  return FLEET_VERSION_PATTERN.test(s) ? s : null\n}\n\n/**\n * Light client-side site normalization to the canonical host shape (lowercase,\n * no protocol/path/port). sonor-api's IngestService.normalizeSite is the\n * AUTHORITATIVE normalizer and re-runs on ingest — this just avoids sending\n * obvious noise. Keep the two shapes aligned (see CLAUDE.md \"site\" convention).\n */\nexport function normalizeFleetSite(raw: unknown): string | null {\n  if (typeof raw !== 'string') return null\n  let s = raw.trim().toLowerCase()\n  if (!s) return null\n  s = s\n    .replace(/^https?:\\/\\//, '')\n    .replace(/\\/.*$/, '')\n    .replace(/:\\d+$/, '')\n  if (!s || s.length > FLEET_SITE_MAX_LENGTH) return null\n  return s\n}\n\n/**\n * Build a validated heartbeat payload from loose inputs. Used by BOTH the\n * client component and the build-time sender so the wire shape is produced in\n * exactly one place (single source of truth for the heartbeat body).\n */\nexport function buildFleetHeartbeatPayload(input: {\n  kitVersion: string\n  nextVersion?: string | null\n  modules?: unknown\n  site?: string | null\n  source?: FleetHeartbeatSource\n}): FleetHeartbeatPayload {\n  return {\n    contract_version: FLEET_CONTRACT_VERSION,\n    kit_version: input.kitVersion,\n    next_version: sanitizeFleetVersion(input.nextVersion ?? null),\n    modules: normalizeFleetModules(input.modules),\n    site: normalizeFleetSite(input.site ?? null),\n    source: input.source === 'build' ? 'build' : 'client',\n  }\n}\n"]}