@sonordev/site-kit 7.1.0 → 7.1.2

package/dist/website/index.js

@@ -1,13 +1,13 @@
 'use client';
-export { SiteDesignReporter } from '../chunk-GIAOPEN6.js';
-export { SITE_DESIGN_PATH, cleanFontStack, colorToHex, getSiteDesignTokens, measureSiteDesign, readDeclaredDesign, sendSiteDesign } from '../chunk-W2CL2DB3.js';
+export { SiteDesignReporter } from '../chunk-Q4W23JYM.js';
+export { SITE_DESIGN_PATH, cleanFontStack, colorToHex, getSiteDesignTokens, measureSiteDesign, readDeclaredDesign, sendSiteDesign } from '../chunk-PGMVL4AB.js';
 export { DEFAULT_POPUP_TOKENS, PopupBlocks } from '../chunk-JSZN6LDZ.js';
 import '../chunk-IHG36STL.js';
 import '../chunk-YC7ELZS3.js';
 import '../chunk-S22FSH7C.js';
 import '../chunk-43OCZ3JA.js';
 import '../chunk-EKBEOXTH.js';
-import '../chunk-U35H2JIQ.js';
-import '../chunk-EVFZ7KEW.js';
-import '../chunk-4JQQDCMO.js';
+import '../chunk-3SDOQUUF.js';
+import '../chunk-VDF5DFWT.js';
+import '../chunk-AH5Q262S.js';
 import '../chunk-PKBMQBKP.js';

package/dist/website/popups.js

@@ -1,7 +1,7 @@
 'use client';
 export { DEFAULT_POPUP_TOKENS, PopupBlocks } from '../chunk-JSZN6LDZ.js';
 import '../chunk-IHG36STL.js';
-import { EngageWidget } from '../chunk-ZIMFQWGJ.js';
+import { EngageWidget } from '../chunk-YCJT4JJG.js';
 import '../chunk-NDF4A5JM.js';
 import '../chunk-6T6CQVNL.js';
 import '../chunk-S22FSH7C.js';
@@ -9,9 +9,9 @@ import '../chunk-24QZEO3Q.js';
 import '../chunk-GJWI74ZZ.js';
 import '../chunk-43OCZ3JA.js';
 import '../chunk-EKBEOXTH.js';
-import '../chunk-U35H2JIQ.js';
-import '../chunk-EVFZ7KEW.js';
-import '../chunk-4JQQDCMO.js';
+import '../chunk-3SDOQUUF.js';
+import '../chunk-VDF5DFWT.js';
+import '../chunk-AH5Q262S.js';
 import '../chunk-PKBMQBKP.js';
 import { jsx } from 'react/jsx-runtime';
 

package/dist/{writeLLMsTxt-QR23OQUE.js → writeLLMsTxt-G3JBNBC5.js}

@@ -1,4 +1,4 @@
-export { writeLLMsTxtToPublic } from './chunk-J4D6ZXRW.js';
+export { writeLLMsTxtToPublic } from './chunk-QEDHRBAT.js';
 import './chunk-GLHQ3LRO.js';
 import './chunk-L5UOHS6E.js';
 import './chunk-WMVK77ND.js';

package/docs/MIGRATING-TO-7.md

@@ -1,8 +1,8 @@
 # Moving a site to site-kit 7
 
 site-kit 7 is organised the way Sonor's dashboard is: one entry per module.
-Most sites need no changes at all. Move a site when you next touch it
-("touch a site, update its deps"); nothing forces it before then, because a
+Most sites need no changes at all. Move a site when you next touch it;
+nothing forces it before then, because a
 site's `^6` range never picks up 7.
 
 ## The short version
@@ -20,7 +20,7 @@ idempotent: running it twice changes nothing the second time. It works from
 any 2.x-6.x site: copies of sites on 4.2, 5.8 and 6.5 were migrated with it
 and built.
 
-Requirements: Next 16 (every fleet site is on it) and Node 20.19+ or 22.12+
+Requirements: Next 16 and Node 20.19+ or 22.12+
 (Netlify's default is 22).
 
 ## What changed, and what the codemod does about it
@@ -48,9 +48,6 @@ keeps type imports on the root. It flags, rather than rewrites, a namespace
 import (`import * as SK`), a `require`, or a re-export from the root. The full
 list is `src/shared/module-map.json` (`rootRuntime`).
 
-Across our own sites on 2026-09-26 this touched three repos: one for
-`affiliates`, two for `BookingWidget`.
-
 ### 2. The setup CLI is its own package: `sonor-setup`
 
 The CLI (init, scaffold, codemods, OG cards, GEO wiring, verify) was 3 MB of
@@ -58,10 +55,10 @@ every site's install and forced a site-kit release for every setup-only fix.
 It's now [`sonor-setup`](../packages/sonor-setup).
 
 - **`npx sonor-setup …` keeps working unchanged:** npx fetches the package.
-- **A site whose package.json scripts run `sonor-setup`** (wirsch-law's OG
-  step, `sonor-setup og`) needs it as a dev dependency. The codemod adds
+- **A site whose package.json scripts run `sonor-setup`** (an OG step that
+  runs `sonor-setup og`, say) needs it as a dev dependency. The codemod adds
   `"sonor-setup": "^7.0.0"` for you.
-- **`sonor-register-sitemap` stays in site-kit**, since 11 sites run it from
+- **`sonor-register-sitemap` stays in site-kit**, since sites run it from
   their postbuild. Nothing to change.
 - The `site-kit` bin alias for the CLI is gone (no site used it).
 
@@ -83,8 +80,7 @@ codemod moves them anyway, so a touched site is done in one pass.
 site-kit ships ES modules alone (`"type": "module"`). Next, Turbopack and the
 kits don't notice. Node 20.19+/22.12+ can `require()` it too, so a
 `next.config.ts` that imports `@sonordev/site-kit/config` keeps working. A
-site-side script that `require()`s site-kit on an older Node would break; none
-in the fleet does.
+site-side script that `require()`s site-kit on an older Node would break.
 
 The `next` peer is `^16`. Next 16 renamed `middleware.ts` to `proxy.ts`, and
 **the codemod moves it**: the file, a named `middleware` export (to `proxy`),
@@ -94,7 +90,7 @@ sets `runtime` (a proxy file can't; the build throws), and says so: remove
 the export, check the logic still runs on your host, rerun. It never moves
 onto an existing `proxy.ts`. `npx sonor-setup next16` runs just this part.
 
-### 5. Removed (no site in the fleet used them)
+### 5. Removed (nothing used them)
 
 - `@sonordev/site-kit/search` and `/search/contract`
 - `@sonordev/site-kit/redirects/not-found` (`resolveManagedRedirect`), and
@@ -133,7 +129,7 @@ Still accepted and ignored until 8.0, because sites pass them:
   reviews; inquiries, availability and offerings when you ask), the server
   card, and on Netlify the rate-limited relay. Sonor's AI Visibility tab then
   shows which agents used them. A site that already runs its own MCP server
-  (upforge.io and the other hand-written ones) is left exactly as it is:
+  (a hand-written one) is left exactly as it is:
   nothing in 7.0 turns anything on for it. To have Sonor see its calls, add
   `onToolCall: reportToolCallsToSonor()` to its `createMcpHandler`.
 - **`@sonordev/contracts`** is for the APIs and the dashboard; sites keep

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sonordev/site-kit",
-  "version": "7.1.0",
+  "version": "7.1.2",
   "type": "module",
   "packageManager": "pnpm@11.5.3",
   "description": "Complete client-side integration kit for Sonor - SEO, Analytics, Engage, Forms, Blog",

package/src/admin-auth/README.md

@@ -11,7 +11,7 @@ admins) can sign in; nobody else can. There are no passwords on the site.
 import { createSonorSso } from '@sonordev/site-kit/admin-auth'
 
 export const sso = createSonorSso({
-  paths: '/admin',            // or ['/bid', '/route'] for several areas
+  paths: '/admin',            // or ['/admin', '/staff'] for several areas
   // loginPath: '/admin/login' (default: `${paths[0]}/login`)
   // adminEmails: process.env.ADMIN_EMAILS,
 })
@@ -62,8 +62,8 @@ const session = await sso.getSession()
 if (!session) return new Response('Unauthorized', { status: 401 })
 ```
 
-Designer APIs or other JSON endpoints can be guarded in the middleware too:
-pass `apiPaths: ['/api/studio']` and include them in the matcher. They get a
+JSON endpoints can be guarded in the middleware too: pass
+`apiPaths: ['/api/admin']` and include them in the matcher. They get a
 401 JSON response instead of a redirect.
 
 ## Env

package/src/analytics/README.md

@@ -178,14 +178,12 @@ events or conversions. The visitor is on whoever framed the page, not on this
 site, so every metric the frame produces is phantom traffic in the analytics
 its owner reads.
 
-This is not hypothetical. Upforge case studies embed each client's whole
-production site in three eager iframes, and `securityHeaders`'
-`DEFAULT_FRAME_ANCESTORS` permits that. Before the guard landed, 23 client
-sites carried the signature in `analytics_page_views`: three views of `/`
-sharing one session and visitor id, 21-80ms apart, referrer
-`https://upforge.io/` — the desktop, tablet and mobile frames of one case
-study. The screenshot overlay in those frames hides the pixels, not the
-JavaScript.
+A portfolio page that shows a live site in desktop, tablet and mobile frames
+is the common case, and `securityHeaders`' `DEFAULT_FRAME_ANCESTORS` permits
+it. Without the guard, one visit to that page would record three views of `/`
+on the framed site, milliseconds apart, sharing one session and visitor id,
+with the portfolio as the referrer. A screenshot laid over the frames hides
+the pixels, not the JavaScript.
 
 **Same-origin frames still report.** A site embedding itself (a preview pane,
 a print view, an on-domain booking frame) has a real visitor really on that
@@ -241,7 +239,7 @@ Uses `SONOR_API_KEY` (injected by `SiteKitLayout`) or `window.__SITE_KIT_API_KEY
 ## Multi-site projects (`analytics.site`)
 
 A single Sonor project can host many sub-sites (e.g. one project hosting
-example.com + 16 state microsites). Every analytics event is
+example.com + a dozen regional microsites). Every analytics event is
 tagged with the sub-site host so the dashboard can roll up + filter per
 site without forcing each microsite into its own Sonor project.
 

package/src/articles/README.md

@@ -17,12 +17,12 @@ import type { PublicationRoutingOptions } from '@sonordev/site-kit/articles/serv
 
 const siteUrl = 'https://example.com'
 const routing = {
-  basePath: '/theforge',
+  basePath: '/journal',
   includeCategoryInPath: true,
-  categoryPath: (slug: string) => `/theforge?category=${encodeURIComponent(slug)}`,
+  categoryPath: (slug: string) => `/journal?category=${encodeURIComponent(slug)}`,
 } satisfies PublicationRoutingOptions
 
-// Cards, related stories and cluster links now use /theforge/category/slug.
+// Cards, related stories and cluster links now use /journal/category/slug.
 const article = <Article slug="build-first" routing={routing} />
 const archive = <ArticleList routing={routing} />
 
@@ -30,7 +30,7 @@ const archive = <ArticleList routing={routing} />
 const metadata = await generateArticleMetadata('build-first', { siteUrl, ...routing })
 const post = await getArticle('build-first')
 const schema = post ? generateArticleSchema(post, { siteUrl, ...routing }) : null
-// In app/theforge/[category]/[slug]/page.tsx, wrap it to pass the routing:
+// In app/journal/[category]/[slug]/page.tsx, wrap it to pass the routing:
 // export function generateStaticParams() { return generateArticleStaticParams(routing) }
 const params = await generateArticleStaticParams(routing) // { category, slug }[]
 const sitemap = await generateArticleSitemap(siteUrl, {
@@ -38,7 +38,7 @@ const sitemap = await generateArticleSitemap(siteUrl, {
   includeCategories: false, // category filters don't need separate sitemap entries
   includeClusters: false, // enable when your site implements cluster routes
 })
-const rss = await generateRssFeed({ siteUrl, siteName: 'The Forge', ...routing })
+const rss = await generateRssFeed({ siteUrl, siteName: 'The Journal', ...routing })
 const href = createPublicationRoutes(routing).post({ slug: 'build-first', category: 'guides' })
 ```
 
@@ -107,7 +107,7 @@ export async function generateMetadata() {
 
 export default function PublicationPage() {
   return (
-    <PublicationLayout hero={{ title: 'The Forge', subtitle: 'Latest articles' }}>
+    <PublicationLayout hero={{ title: 'The Journal', subtitle: 'Latest articles' }}>
       <ArticleList showCategoryFilter showPagination />
     </PublicationLayout>
   )

package/src/cta-bar/README.md

@@ -3,17 +3,17 @@
 The Liquid Glass mobile CTA bar (6.1.0). A floating frosted capsule that
 keeps a site's one or two highest-intent actions a thumb away on phones.
 
-It replaces every hand-rolled sticky mobile bar in the fleet. Those eleven
-copies had each solved part of the same problem set; this one does all of it:
+It replaces a hand-rolled sticky mobile bar, and handles what each of those
+ends up solving on its own:
 
-| Behaviour | Before | Here |
-|---|---|---|
-| Hide while the form it points at is on screen | two sites, hand-built | `hideOver` |
-| Stay off the hero until the hero CTA scrolls away | one site | `showAfter` |
-| Get out from under the Echo launcher | two sites (`body:has`, a 72px dead corner) | automatic |
-| Ride out the iOS toolbar collapsing | one site (a GSAP tween) | `--sk-vv-layout-gap` |
-| Get out of the way of the keyboard | nobody | `hideWhileTyping` |
-| Tell Sonor which action converts | one site (hand-wired) | `cta_click` event |
+| Behaviour | How |
+|---|---|
+| Hide while the form it points at is on screen | `hideOver` |
+| Stay off the hero until the hero CTA scrolls away | `showAfter` |
+| Get out from under the Echo launcher | automatic |
+| Ride out the iOS toolbar collapsing | `--sk-vv-layout-gap` |
+| Get out of the way of the keyboard | `hideWhileTyping` |
+| Tell Sonor which action converts | `cta_click` event |
 
 ## Use it
 
@@ -28,7 +28,7 @@ import { CtaBar, CtaBarAction } from '@sonordev/site-kit/cta-bar'
   <main>{children}</main>
   <Footer />
   <CtaBar label="Call or request a quote" hideOver="#quote">
-    <CtaBarAction href="tel:+15135550100" variant="secondary" icon={<Phone />}>
+    <CtaBarAction href="tel:+15555550100" variant="secondary" icon={<Phone />}>
       Call now
     </CtaBarAction>
     <CtaBarAction as={Link} href="/quote" icon={<ClipboardCheck />}>

package/src/forms/README.md

@@ -47,8 +47,8 @@ Three things hold for every experience:
   the form still works and still submits.
 - **Nobody pays for what they don't use.** Experience code is loaded on
   demand, so a `classic` form downloads none of it.
-- **Same engine.** Identical validation, honeypot, reCAPTCHA, and CRM routing
-  — an experience is a rendering, not a fork.
+- **Same engine.** Identical validation, spam protection and CRM routing.
+  An experience is a rendering, not a fork.
 
 ### Editing what the form says back
 
@@ -202,13 +202,15 @@ Submissions auto-route based on `form_type`:
 | `newsletter` | Email Subscribers | Newsletter signups |
 | `custom` | Form Submissions only | Custom handling |
 
-## Anti-Bot Protection
+## Spam protection
 
-- **Honeypot fields** — hidden fields that bots fill (server-side rejection)
-- **reCAPTCHA Enterprise** — optional Google reCAPTCHA v3 scoring
-- **Submission timing** — forms that submit in < 3 seconds are flagged
-- **Composite spam scoring** — name patterns, email domain, user-agent, IP rate, message content
-- **NestJS ThrottlerGuard** — 10 requests/minute per IP at HTTP level
+Sonor screens every submission on its side, and there's nothing to configure.
+It only accepts a submission with evidence that a real browser rendered the
+page, which `<ManagedForm>` and `useForm` send automatically. A hand-rolled
+`fetch` to the forms API, or a proxy through your own API route, can't send
+it, so Sonor refuses those before anything is written: the visitor sees an
+error and you get no lead. Submit through site-kit, and define the form's
+fields in Sonor so both can render and validate them.
 
 ## Styles
 

package/src/llms/README.md

@@ -315,7 +315,7 @@ Business description...
 
 ## Portfolio & Case Studies
 
-### [Project Title](https://live-url.com)
+### [Project Title](https://example.com/work/project)
 
 Description of the project.
 
@@ -355,7 +355,7 @@ We follow a proven process...
 
 ### Family Law Basics
 Topic: Family Law
-Area: Cincinnati, OH
+Area: Springfield
 Articles: 8
 Service page: https://example.com/services/family-law
 Pillar: [Complete Guide to Family Law](/article/family-law-guide)
@@ -515,7 +515,7 @@ export default function DivorcePage() {
         title="Key Facts"
         points={[
           '25+ years of family law experience',
-          'Serving Northern Kentucky and Cincinnati',
+          'Serving Springfield and the surrounding counties',
           'Free initial consultation available',
         ]}
         speakable

package/src/mcp/README.md

@@ -82,11 +82,11 @@ endpoint and card (automatic in the build-time file once `/api/mcp` exists),
 and `createProxy({ llmsDiscovery: { siteUrl, mcpServerCard: true } })` adds
 `Link: <.../.well-known/mcp-server-card>; rel="service-desc"`.
 
-### A custom MCP server (upforge.io) is left alone
+### A custom MCP server is left alone
 
 The built-in tools are opt-in, never automatic. A site that runs its own MCP
-server (its own tools, transport names or llms.txt section, like upforge.io
-or a re-site-kit site) is a **custom implementation**, and site-kit keeps its
+server (its own tools, transport names or llms.txt section, like a
+re-site-kit site) is a **custom implementation**, and site-kit keeps its
 hands off:
 
 | What | Built-in server | Custom server |
@@ -257,8 +257,8 @@ What the relay does, so you don't have to re-derive it:
 
 The header and label default to `x-site-mcp-transport` and
 `site-mcp-transport-v1`. A site with names already live passes the same
-`{ header, label }` to all three factories (upforge.io uses
-`x-upforge-mcp-transport` / `upforge-mcp-transport-v1`). This entry is Node
+`{ header, label }` to all three factories (for example
+`x-example-mcp-transport` / `example-mcp-transport-v1`). This entry is Node
 only and imports no `server-only`, so the plain-Node function can load it. It
 is not re-exported from `@sonordev/site-kit/mcp`, which stays runtime-neutral.
 
@@ -333,8 +333,8 @@ single property check — not a request, and not a byte of page weight.
 `<WebMcpTools>` registers thin wrappers that POST `tools/call` to this site's
 own endpoint, so the in-page tool and the remote tool run the same server-side
 handler. It also keeps `SONOR_API_KEY` out of the client bundle — registering
-real handlers client-side would pull server code into a `'use client'` graph,
-which is how a raw `sonor_` key once shipped in a public chunk.
+real handlers client-side would pull server code, and the key with it, into a
+`'use client'` graph and a public chunk.
 
 Tools that genuinely need live DOM state go in `localTools` and run in-page.
 

package/src/motion/README.md

@@ -348,7 +348,7 @@ Per-site components map onto `<Reveal>` almost one to one:
 | Site prop | `<Reveal>` |
 |-----------|-----------|
 | `from="up"`, `direction="up"` | `from="up"` |
-| `y={30}` (upforge.io) | `distance={30}` |
+| `y={30}` | `distance={30}` |
 | `stagger` (boolean) | `stagger` |
 | `delay`, `duration` | same, in seconds |
 | `threshold`, `rootMargin` | `threshold` |

package/src/og/README.md

@@ -47,8 +47,8 @@ to child segments.** A card at `services/` is not inherited by
 param), which the generator does automatically.
 
 `sonor-setup og` and `sonor-setup doctor` both check this through one shared
-rule (`og/wiring.ts`). Do not re-implement it — there were two copies once and
-both told sites to do the wrong thing. The rule reads the site's code through
+rule (`og/wiring.ts`), so the two never disagree. The rule reads the site's
+code through
 `shared/source-graph.ts`, which follows imports into `lib/` helpers and monorepo
 workspace packages, so `twitter.card` set in a metadata helper counts. It used
 to read the root layout alone.
@@ -62,16 +62,16 @@ zero-config seed for sites that have no config yet.
 import { defineOgCard } from '@sonordev/site-kit/og'
 
 export default defineOgCard({
-  theme: { bg: '#0A0A0A', text: '#f5f5f7', accent: '#C41E3A', surface: '#141418' },
-  fonts: [{ family: 'Playfair Display', weights: [800] }],
+  theme: { bg: '#0F172A', text: '#F8FAFC', accent: '#F59E0B', surface: '#1E293B' },
+  fonts: [{ family: 'Fraunces', weights: [800] }],
   logo: '/logo-white.svg',
   layout: 'split',
-  photo: { src: '/team.jpg' },
+  photo: { src: '/crew.jpg' },
   content: {
-    kicker: 'Custom Closets · Cincinnati',
-    title: 'Built by\nbrothers',
-    subtitle: 'Designed, built, and installed by the same two people.',
-    bar: ['Free design', 'example.com'],
+    kicker: 'Remodeling · Springfield',
+    title: 'Built by\nneighbors',
+    subtitle: 'Designed, built and installed by one local crew.',
+    bar: ['Free estimate', 'example.com'],
   },
 })
 ```
@@ -86,10 +86,10 @@ The title opens at 104px and the renderer steps it down until it fits **both**
 axes, stopping at a 56px legibility floor — below that a headline stops reading
 at the ~300px thumbnail width platforms actually show.
 
-If copy still does not fit at the floor, the command **fails** and names the
-element and the overflow in pixels. That is deliberate: the failure it exists to
-catch was a card that shipped with the kicker off-canvas and the subtitle buried
-under the bottom bar, while the CLI printed a tick.
+If copy still doesn't fit at the floor, the command **fails** and names the
+element and the overflow in pixels. That's deliberate: otherwise a card can ship
+with the kicker off-canvas and the subtitle buried under the bottom bar while
+the CLI prints a tick.
 
 Rules of thumb: about 10 uppercase characters per title line, and about 29 for
 the kicker. `\n` in a title is a hard break, so choose the wrap yourself rather
@@ -106,8 +106,8 @@ Hand-write the few that deserve it:
 
 ```ts
 cards: {
-  '/free-3d-design': {
-    content: { kicker: 'Free 3D design', title: 'See it\nfirst' },
+  '/free-estimate': {
+    content: { kicker: 'Free estimate', title: 'Know the\ncost first' },
     photo: { src: '/lp/hero.jpg' },
   },
 },
@@ -119,8 +119,8 @@ so an entry only states what differs.
 Managed titles carry the brand for the SERP (`About Us | Acme`); the card drops
 it. It also drops the two broken suffixes managed titles turn up with: a dangling
 separator with no brand after it (`About Us |`) and a domain after a comma
-(`Privacy Policy, abbeyglenapts.com`). A hyphen inside a word is never a
-separator (`Walk-In Closets` stays whole).
+(`Privacy Policy, example.com`). A hyphen inside a word is never a
+separator (`Walk-In Showers` stays whole).
 
 ### Dynamic routes are keyed by pattern, one `*` per level
 
@@ -141,23 +141,22 @@ cards: {
 },
 ```
 
-This was a real bug: both directories keyed to `/services/*`, so 120
-service-by-metro pages shipped the service pages' card and the `/services/*/*`
-override matched nothing — silently. A `cards` key that matches no rendered
-route is now reported by `sonor-setup og` (`og.cards`, a warning).
+The generator keys each depth separately, so a `/services/*/*` entry reaches
+the service-by-metro pages and nothing else. A `cards` key that matches no
+rendered route is reported by `sonor-setup og` (`og.cards`, a warning), since
+otherwise it would match nothing, silently.
 
 > **Writing a nested pattern in a comment.** `/services/*/*` contains `*/`,
 > which **closes a `/* */` block comment early**. In TypeScript put it in a
-> string, a `//` line comment, or spell the depth out in prose — this bit the
-> fix for the bug above, inside the comment explaining the bug.
+> string, a `//` line comment, or spell the depth out in prose. It's an easy
+> slip in exactly the comment that explains the pattern.
 
 ### Static routes under a dynamic segment get a card too
 
 `properties/[slug]/about` is a static route under a dynamic one. It gets its
 own card, keyed `/properties/*/about` and titled from its own name ("About",
 kicker "properties"). The generator used to stop at the first dynamic segment,
-so these pages shipped with no og:image at all, 30 of them on two
-property sites.
+which left these pages with no og:image at all.
 
 ### Per-URL cards: one per floor plan, one per community
 
@@ -213,7 +212,7 @@ The URL ends in `.jpg`, so a `trailingSlash: true` site never redirects it.
 Per-URL cards need `sharp` (they have to be `.jpg`); without it the command
 fails those cards and says so. Their copy comes from Sonor's managed title for
 that URL, like any route card. A per-URL key matches a pattern one segment per
-`*`, so `/properties/tall-pines/about` falls under `/properties/*/about`.
+`*`, so `/properties/maple-court/about` falls under `/properties/*/about`.
 
 Cards are re-encoded to JPEG when `sharp` resolves — on a real 18-card site that
 was 5.6 MB → 1.4 MB. Without sharp they stay PNG, which is correct, just heavier.
@@ -249,7 +248,7 @@ export default createOgImage<{ slug: string }>(async ({ slug }) => {
     kicker: 'From the publication',
     title: post.title,
     photoUrl: post.featured_image, // must be absolute
-    bar: 'acme.com',
+    bar: 'example.com',
   }
 })
 ```

package/src/proxy/README.md

@@ -114,7 +114,7 @@ into a dynamic one. The resolver is deprecated.
 | Header | Value |
 |--------|-------|
 | X-DNS-Prefetch-Control | `on` |
-| Content-Security-Policy | `frame-ancestors 'self' https://upforge.io https://*.upforge.io` |
+| Content-Security-Policy | `frame-ancestors` from `DEFAULT_FRAME_ANCESTORS` (below) |
 | X-Content-Type-Options | `nosniff` |
 | X-XSS-Protection | `1; mode=block` |
 | Referrer-Policy | `strict-origin-when-cross-origin` |
@@ -124,23 +124,23 @@ Note there is no `X-Frame-Options` row — that is deliberate, see below.
 
 ### Framing / `frame-ancestors`
 
-Upforge showcases live client work in iframes on its portfolio and area
-pages, so managed sites ship a CSP `frame-ancestors` allowlist instead of
-`X-Frame-Options`. XFO has no allowlist form (`ALLOW-FROM` is dead), and
-emitting both would let a stray `DENY` silently re-block the embed — so
-`X-Frame-Options` is **omitted** whenever `frameAncestors` is active.
-Every origin not on the list is still blocked.
+Managed sites ship a CSP `frame-ancestors` allowlist instead of
+`X-Frame-Options`. The default, `DEFAULT_FRAME_ANCESTORS`, is `'self'`,
+Sonor's dashboard (`https://app.sonor.io`, for Edit on page) and the Upforge
+showcase origins (`upforge.io`, `upforgelabs.com` and their subdomains), where
+live client sites appear in portfolio frames. XFO has no allowlist form
+(`ALLOW-FROM` is dead), and emitting both would let a stray `DENY` silently
+re-block the embed, so `X-Frame-Options` is **omitted** whenever
+`frameAncestors` is active. Every origin not on the list is still blocked.
+
+`frameAncestors` replaces the default, so spread it to add an origin:
 
 ```ts
+import { createProxy, DEFAULT_FRAME_ANCESTORS } from '@sonordev/site-kit/proxy'
+
 createProxy({
-  // extend the allowlist
   securityHeaders: {
-    frameAncestors: [
-      "'self'",
-      'https://upforge.io',
-      'https://*.upforge.io',
-      'https://partner.example.com',
-    ],
+    frameAncestors: [...DEFAULT_FRAME_ANCESTORS, 'https://partner.example.com'],
   },
 })
 

package/src/seo/README.md

@@ -268,7 +268,7 @@ The SEO module keeps a few lower-level helpers:
 
 It skips itself when an `app/sitemap` route exists, and it only adds or updates pages unless you pass `--full-replace`.
 
-On a multi-site project, each page is tagged with the host it belongs to. The CLI takes it from `NEXT_PUBLIC_SITE_URL` (it loads `.env` and `.env.local`), or from `--site ohiopowerstudies.com`. It used to send no host at all, so a microsite's pages synced as unattributed.
+On a multi-site project, each page is tagged with the host it belongs to. The CLI takes it from `NEXT_PUBLIC_SITE_URL` (it loads `.env` and `.env.local`), or from `--site ohio.example.com`. It used to send no host at all, so a microsite's pages synced as unattributed.
 
 From code, `registerLocalSitemap({ entries?, autoDiscover?, mode?, site? })` on `@sonordev/site-kit/seo/server` does the same and is additive by default.
 

package/src/slots/README.md

@@ -10,7 +10,7 @@ import { ManagedSlot, ManagedRichText, ManagedLink, ManagedList } from '@sonorde
 
 <h1 className="hero-title">
   <ManagedSlot id="home-hero-headline" page="/">
-    New homes in Cincinnati and Northern Kentucky
+    New homes in Springfield and beyond
   </ManagedSlot>
 </h1>
 ```

package/src/sync/README.md

@@ -50,7 +50,7 @@ interface BookingWidgetProps {
 1. **Type selector:** choose a booking type, unless a specific `bookingTypeSlug` is provided.
 2. **Meeting format:** when the booking type enables meeting options, choose virtual, office, or a visit to the guest's location. Travel meetings validate the address before showing availability.
 3. **Calendar and times:** choose an available time and reserve it while completing contact details.
-4. **Guest info:** name, email, phone, and notes. Travel meetings require a phone number.
+4. **Guest info:** name, email, phone, and notes. Every booking requires a phone number.
 5. **Result:** a confirmed booking shows calendar links when Sonor sends the guest's invitation. When the host's Google Calendar sends it, the widget says who the invite is coming from instead (see [Calendar invitations](#calendar-invitations)). Meetings that require review show a pending request without calendar links.
 
 Changing a meeting format restores the selected format, address, and access notes. Guests can return to the service selector when it's available. Contact details survive changes to the format or reserved time.

package/dist/ManagedForm-Z3PKOPIZ.js

@@ -1,14 +0,0 @@
-export { ManagedForm } from './chunk-EIULXXUJ.js';
-import './chunk-YLSEB32F.js';
-import './chunk-DXO6SBMD.js';
-import './chunk-QPEEKFCA.js';
-import './chunk-XD3ZQET6.js';
-import './chunk-AQSNPZY4.js';
-import './chunk-5SQK3D53.js';
-import './chunk-NJCTQH2P.js';
-import './chunk-L2V5PUFN.js';
-import './chunk-GJWI74ZZ.js';
-import './chunk-U35H2JIQ.js';
-import './chunk-EVFZ7KEW.js';
-import './chunk-4JQQDCMO.js';
-import './chunk-PKBMQBKP.js';

package/dist/SitemapSync-XVMGKCF3.js

@@ -1,8 +0,0 @@
-export { SitemapSync } from './chunk-LFXVE32I.js';
-import './chunk-YVKRYQRG.js';
-import './chunk-43OCZ3JA.js';
-import './chunk-EKBEOXTH.js';
-import './chunk-U35H2JIQ.js';
-import './chunk-EVFZ7KEW.js';
-import './chunk-4JQQDCMO.js';
-import './chunk-PKBMQBKP.js';