@sonordev/site-kit 7.1.1 → 7.2.0

package/dist/proxy/securityHeaders.d.ts

@@ -23,18 +23,15 @@
  * Content). The page is public anyway, and the overlay it loads there only
  * outlines copy and reports clicks (`slots/edit/overlay.ts`).
  *
- * upforgeapps.com is deliberately NOT here. It is a third Upforge apex,
- * but it only *links* to case studies (`upforge.io/work/<slug>`, see its
- * `lib/proof.ts`) and frames no client site anywhere. An origin earns a
- * place on this list by embedding, not by belonging to Upforge; adding a
- * non-embedder would hand out framing rights nothing needs. Re-check that
- * before adding it.
+ * An origin earns a place on this list by embedding managed sites, not by
+ * belonging to the same company: a site that only links to case studies
+ * frames nothing, and adding it would hand out framing rights nothing needs.
+ * Re-check that before adding one.
  *
  * Do NOT re-fork this list into individual sites' proxy/middleware/
- * next.config/netlify.toml/_headers — a fork is a copy that stops
- * tracking this one, which is exactly how upforgelabs.com came to be
- * missing from ten sites' allowlists at once. Add origins HERE and let
- * the fleet inherit them on its next deploy.
+ * next.config/netlify.toml/_headers: a fork is a copy that stops tracking
+ * this one, so a new origin never reaches it. Add origins HERE and every
+ * site inherits them on its next deploy.
  */
 export declare const DEFAULT_FRAME_ANCESTORS: string[];
 export interface SecurityHeadersConfig {
@@ -43,8 +40,9 @@ export interface SecurityHeadersConfig {
     frameOptions?: 'DENY' | 'SAMEORIGIN' | false;
     /**
      * Origins allowed to frame this site, emitted as a CSP `frame-ancestors`
-     * directive. Defaults to {@link DEFAULT_FRAME_ANCESTORS} ('self' + upforge.io)
-     * so Upforge can showcase the site. Pass an array to extend/replace, or
+     * directive. Defaults to {@link DEFAULT_FRAME_ANCESTORS} ('self', Sonor's
+     * dashboard and the Upforge showcase origins). Pass an array to replace it
+     * (spread the default to extend it), or
      * `false` to opt out entirely and fall back to X-Frame-Options.
      *
      * Ignored if a `Content-Security-Policy` is supplied via `customHeaders` —

package/dist/redirects/index.d.ts

@@ -1,12 +1,12 @@
 /**
  * Managed Redirects - Next.js Middleware Helper
  *
- * Fetches redirect rules from Portal and applies them.
- * Supports API key only (domain resolved from Portal) or domain-based lookup.
+ * Fetches redirect rules from Sonor and applies them.
+ * Supports API key only (domain resolved from Sonor) or domain-based lookup.
  *
  * On a multi-site project (one Sonor project, many domains) rules are per
  * host: a rule with no site applies everywhere, and one tagged
- * 'bd-charlotte.com' applies only there. The list read and the hit both name
+ * 'charlotte.example.com' applies only there. The list read and the hit both name
  * the host through `sites/site-param` (explicit `site` > NEXT_PUBLIC_SITE_URL
  * host), and the in-memory cache key carries it too. Keyed by API key alone,
  * two hosts served by one process would share whichever list was fetched
@@ -41,7 +41,7 @@ export interface RedirectConfig {
     /** Project API key; when set, redirects are fetched by key (no domain needed) */
     apiKey?: string;
     /**
-     * Sub-site host on a multi-site project (e.g. 'bd-charlotte.com'). Same
+     * Sub-site host on a multi-site project (e.g. 'charlotte.example.com'). Same
      * meaning as the `site` argument of withSiteParam: when unset it comes from
      * the NEXT_PUBLIC_SITE_URL host. The API returns this host's rules plus the
      * project-wide ones. When nothing resolves no site is sent, and the API
@@ -54,14 +54,14 @@ export interface RedirectConfig {
      * Hard ceiling on the rules fetch, in ms. Default 300.
      *
      * This fetch can sit in front of HTML (proxy hot path / not-found render),
-     * and without a bound a *slow* Portal becomes every page's TTFB — the
+     * and without a bound a *slow* Sonor becomes every page's TTFB — the
      * try/catch only fails open on error, not on slow. Build-time callers
      * (generateNextRedirects) pass a larger value.
      */
     fetchTimeoutMs?: number;
 }
 /**
- * Fetch redirect rules from Portal API.
+ * Fetch redirect rules from Sonor API.
  * When apiKey is set (or from env), uses key-based endpoint (no domain required).
  * Otherwise uses domain query (or domain from getSiteConfig when only env API key is set).
  * Either way the site host goes along as `?site=`, left off when it resolves empty.
@@ -86,7 +86,7 @@ export declare function handleManagedRedirects(request: NextRequest, config: Red
  */
 export declare function trackRedirectHit(config: RedirectConfig, fromPath: string, domainForHit?: string): Promise<void>;
 /**
- * Generate Next.js redirects config from Portal
+ * Generate Next.js redirects config from Sonor
  * Use this in next.config.js for build-time redirects
  *
  * The site host resolves as it does everywhere else. Next loads .env files

package/dist/reputation/TestimonialSection.d.ts

@@ -2,7 +2,7 @@
  * @sonordev/site-kit/reputation - Testimonial Section
  *
  * Displays client reviews in a rotating carousel
- * Fetches published reviews from Portal API public endpoint
+ * Fetches published reviews from Sonor API public endpoint
  *
  * Minimal styling - let site CSS control appearance
  */

package/dist/reputation/api.d.ts

@@ -1,7 +1,7 @@
 /**
  * @sonordev/site-kit/reputation - API Functions
  *
- * Fetch reviews and stats from Portal API public endpoint.
+ * Fetch reviews and stats from Sonor API public endpoint.
  * Uses API key authentication (x-api-key header) - project is resolved server-side.
  * Includes retry with backoff for rate limiting (429).
  */

package/dist/revalidate/index.js

@@ -1,7 +1,7 @@
-import { createSeoRevalidationHandler } from '../chunk-JIL5VY2R.js';
+import { createSeoRevalidationHandler } from '../chunk-VHKEF5ZB.js';
 import '../chunk-XTRZGXB2.js';
 export { SITE_CACHE_TAGS, SITE_REVALIDATE_PATH, isSiteRevalidatePong } from '../chunk-RYVDGXC2.js';
-import '../chunk-6OL23QYD.js';
+import '../chunk-F24FNCTK.js';
 import '../chunk-PKBMQBKP.js';
 
 // src/revalidate/index.ts

package/dist/robots/index.d.ts

@@ -2,7 +2,7 @@
  * @sonordev/site-kit/robots - robots.txt Generator
  *
  * Generates robots.txt with Sitemap directive.
- * baseUrl can be omitted when apiKey is set (resolved from Portal project-info).
+ * baseUrl can be omitted when apiKey is set (resolved from Sonor project-info).
  *
  * @example
  * // app/robots.txt/route.ts (API key only)
@@ -20,14 +20,14 @@ export { isNextInternalsPath } from './next-internals';
 export { AI_RETRIEVAL_CRAWLERS, AI_TRAINING_CRAWLERS, buildAiCrawlerRules, createRobotsTxtHandler, } from '../llms/aiRobots';
 export type { AiCrawlerRulesOptions, ContentSignalsOptions, RobotsTxtHandlerOptions } from '../llms/aiRobots';
 export interface RobotsConfig {
-    /** Base URL of the site (optional when apiKey is set; then resolved from Portal) */
+    /** Base URL of the site (optional when apiKey is set; then resolved from Sonor) */
     baseUrl?: string;
-    /** Project API key; when set and baseUrl is not, baseUrl is resolved from Portal */
+    /** Project API key; when set and baseUrl is not, baseUrl is resolved from Sonor */
     apiKey?: string;
     apiUrl?: string;
     /** Path to sitemap (default: /sitemap.xml) */
     sitemapPath?: string;
-    /** Pre-built robots content from Portal (overrides default when provided) */
+    /** Pre-built robots content from Sonor (overrides default when provided) */
     managedRobots?: string | null;
     /**
      * Paths to disallow (e.g. ['/admin', '/api']). `/_next` paths are dropped:
@@ -37,6 +37,6 @@ export interface RobotsConfig {
 }
 /**
  * Create a robots.txt handler that returns a Response or Promise<Response>.
- * Use as GET handler for app/robots.txt/route.ts. When baseUrl is omitted, pass apiKey to resolve from Portal.
+ * Use as GET handler for app/robots.txt/route.ts. When baseUrl is omitted, pass apiKey to resolve from Sonor.
  */
 export declare function createRobots(config: RobotsConfig): () => Response | Promise<Response>;

package/dist/robots/indexnow.d.ts

@@ -1,7 +1,6 @@
 /**
- * Where the key is served. Sonor's IndexNowService (sonor-api
- * src/modules/seo/indexnow.service.ts, INDEXNOW_KEY_PATH) submits this path
- * as the keyLocation. Keep the two equal.
+ * Where the key is served. Sonor submits this path as the keyLocation, so
+ * keep the two equal.
  */
 export declare const INDEXNOW_KEY_PATH = "/indexnow.txt";
 /** The project's IndexNow key, or null when Sonor can't be reached. */

package/dist/seo/ManagedScripts.d.ts

@@ -1,8 +1,8 @@
 import type { ManagedScriptsProps } from './types';
 /**
  * @deprecated The managed-scripts feature is retired (2026-06): scripts belong
- * in the site's own code via next/script, not in a Portal-managed table. The
- * Portal admin endpoints are removed and the table is empty; this component
+ * in the site's own code via next/script, not in a Sonor-managed table. The
+ * Sonor admin endpoints are removed and the table is empty; this component
  * now always renders null and is kept only so existing imports keep compiling.
  *
  * Perf note (2026-07): the previous "stub" still fetched

package/dist/seo/client.js

@@ -1,9 +1,9 @@
 'use client';
-export { SitemapSync } from '../chunk-KOPVJQ2P.js';
+export { SitemapSync } from '../chunk-GEXT7BTE.js';
 import '../chunk-YVKRYQRG.js';
 import '../chunk-43OCZ3JA.js';
 import '../chunk-EKBEOXTH.js';
-import '../chunk-PXZ7LAOY.js';
-import '../chunk-OUNRFXDC.js';
-import '../chunk-6OL23QYD.js';
+import '../chunk-D6ZC7XKZ.js';
+import '../chunk-K4ZHAURD.js';
+import '../chunk-F24FNCTK.js';
 import '../chunk-PKBMQBKP.js';

package/dist/seo/getManagedMetadata.d.ts

@@ -2,7 +2,7 @@ import type { GetManagedMetadataOptions, ManagedMetadataResult, GetABVariantOpti
 /**
  * Get managed metadata for a page
  *
- * Use in generateMetadata() to fetch Portal-managed SEO data
+ * Use in generateMetadata() to fetch Sonor-managed SEO data
  *
  * @example
  * ```tsx

package/dist/seo/groundingSchema.d.ts

@@ -1,6 +1,6 @@
 /**
- * Optional JSON-LD stub when Portal does **not** emit Organization/WebSite.
- * Default product stance: Portal owns entity nodes; only use this when confirmed absent.
+ * Optional JSON-LD stub when Sonor does **not** emit Organization/WebSite.
+ * Default product stance: Sonor owns entity nodes; only use this when confirmed absent.
  */
 export interface WebSiteOrganizationStubInput {
     name: string;

package/dist/seo/index.js

@@ -1,7 +1,8 @@
 export { ManagedNoScripts, ManagedScripts } from '../chunk-MVLMXC44.js';
-import { pickManagedLlmSchemaForJsonLd } from '../chunk-4Y5FWDPM.js';
+import { pickManagedLlmSchemaForJsonLd } from '../chunk-NZ4RXN3G.js';
 import { safeJsonLd } from '../chunk-4KZ6W3ZH.js';
-export { SitemapSync } from '../chunk-KOPVJQ2P.js';
+import { withoutSchemaPlaceholders } from '../chunk-VWWITFWM.js';
+export { SitemapSync } from '../chunk-GEXT7BTE.js';
 import { getManagedMetadata } from '../chunk-4YTYGG2C.js';
 export { generateSitemap, getABVariant, getManagedMetadata, getManagedMetadataWithAB, getRedirect, getRobotsDirective, isIndexable } from '../chunk-4YTYGG2C.js';
 import { getContentBlock, getSchemaMarkups, getSEOPageData, getEntityEnhancedSchema, getFAQData, getInternalLinks, getEntities, pruneSchemaTypes } from '../chunk-662ILEZ6.js';
@@ -17,9 +18,9 @@ import '../chunk-FESKKJAS.js';
 import '../chunk-A4CC4ZG3.js';
 import '../chunk-43OCZ3JA.js';
 import '../chunk-EKBEOXTH.js';
-import '../chunk-PXZ7LAOY.js';
-import '../chunk-OUNRFXDC.js';
-import '../chunk-6OL23QYD.js';
+import '../chunk-D6ZC7XKZ.js';
+import '../chunk-K4ZHAURD.js';
+import '../chunk-F24FNCTK.js';
 import '../chunk-PKBMQBKP.js';
 import { Suspense } from 'react';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
@@ -73,10 +74,10 @@ async function ManagedSchemaAsync({
   const page = pageData?.page;
   const siteUrl = pageData?.project?.site_url || "";
   const deny = new Set(excludeTypes ?? []);
-  const fromSonor = (values) => values.map((v) => pruneSchemaTypes(v, deny)).filter((v) => v !== null);
+  const fromSonor = (values) => values.map((v) => withoutPlaceholders(pruneSchemaTypes(v, deny))).filter(isSchemaObject);
   const allSchemas = [
     ...fromSonor(entitySchemas),
-    ...schemas.map((s) => s.schema_json),
+    ...schemas.map((s) => withoutPlaceholders(s.schema_json)).filter(isSchemaObject),
     // Include auto-generated schema from Signal meta optimization
     ...fromSonor(page?.managed_schema ? [page.managed_schema] : []),
     ...additionalSchemas
@@ -127,7 +128,7 @@ async function LLMSchemaAsync({
 }) {
   const { page: pageData, project } = await getSEOPageData(path);
   const raw = pageData?.managed_llm_schema;
-  const picked = pickManagedLlmSchemaForJsonLd(raw);
+  const picked = withoutPlaceholders(pickManagedLlmSchemaForJsonLd(raw));
   if (!picked) {
     return null;
   }
@@ -183,6 +184,12 @@ function createSpeakableWebPageSchema(type, name, url, speakable) {
     speakable: speakableSpec
   };
 }
+function withoutPlaceholders(value) {
+  return withoutSchemaPlaceholders(value).value;
+}
+function isSchemaObject(value) {
+  return value !== null && typeof value === "object";
+}
 function schemaNodeHasType(node, type) {
   if (!node || typeof node !== "object") return false;
   const t = node["@type"];

package/dist/seo/llms/contract.js

@@ -1,2 +1,2 @@
-export { LLMS_DISCLAIMER_MAX_LENGTH, LLMS_PUBLIC_SUMMARY_MAX_LENGTH, LLM_GEO_CONTRACT_VERSION, MANAGED_LLM_SCHEMA_KNOWN_KEYS, isEmittableReviewNode, pickManagedLlmSchemaForJsonLd, sanitizeLlmsDisclaimerLine, sanitizeLlmsPublicSummary, sanitizePrimaryLanguageTag } from '../../chunk-4Y5FWDPM.js';
+export { LLMS_DISCLAIMER_MAX_LENGTH, LLMS_PUBLIC_SUMMARY_MAX_LENGTH, LLM_GEO_CONTRACT_VERSION, MANAGED_LLM_SCHEMA_KNOWN_KEYS, clipAtWordBoundary, isEmittableReviewNode, pickManagedLlmSchemaForJsonLd, sanitizeLlmsDisclaimerLine, sanitizeLlmsPublicSummary, sanitizePrimaryLanguageTag } from '../../chunk-NZ4RXN3G.js';
 import '../../chunk-PKBMQBKP.js';

package/dist/seo/llms.js

@@ -1,19 +1,19 @@
-export { createLLMsFullTxtHandler, createLLMsTxtHandler, formatSourcedFactsSection, llmsResponseHeaders } from '../chunk-ZETJTCMV.js';
+export { createLLMsFullTxtHandler, createLLMsTxtHandler, formatSourcedFactsSection, llmsResponseHeaders } from '../chunk-BC4Y3S3D.js';
 export { buildAiDiscoveryHeaders, wantsLlmsDiscoveryLink } from '../chunk-PO2TRJPY.js';
 export { AI_RETRIEVAL_CRAWLERS, AI_TRAINING_CRAWLERS, buildAiCrawlerRules, createRobotsTxtHandler } from '../chunk-QLTDFUJ7.js';
-export { LEGACY_PUBLICATION_PATH, SEO_REVALIDATION_MAX_BODY_BYTES, SEO_REVALIDATION_MAX_ITEMS, createLlmsRevalidateHandler, createSeoRevalidationHandler, parseSeoRevalidationPayload } from '../chunk-JIL5VY2R.js';
+export { LEGACY_PUBLICATION_PATH, SEO_REVALIDATION_MAX_BODY_BYTES, SEO_REVALIDATION_MAX_ITEMS, createLlmsRevalidateHandler, createSeoRevalidationHandler, parseSeoRevalidationPayload } from '../chunk-VHKEF5ZB.js';
 import '../chunk-XTRZGXB2.js';
 export { AEOBlock, AEOCitedContent, AEOClaim, AEOComparison, AEODefinition, AEOEntity, AEOProvenanceList, AEOStep, AEOSteps, AEOSummary, DEFAULT_SPEAKABLE_SELECTORS, SpeakableSchema, createSpeakableSchema, getSpeakableSelectorsForPage } from '../chunk-PSAG45YF.js';
-export { AGENT_ACCESS_HEADING, appendAgentAccessSection, describesMcp, detectMcpServer, formatAgentAccessSection, generateLLMsFullTxt, generateLLMsTxt, writeLLMsTxtToPublic } from '../chunk-J4D6ZXRW.js';
-export { getBusinessInfo, getFAQItems, getLLMsData, getOptimizedLLMsTxt, getPageSummaries, getServices } from '../chunk-GLHQ3LRO.js';
+export { AGENT_ACCESS_HEADING, appendAgentAccessSection, describesMcp, detectMcpServer, formatAgentAccessSection, generateLLMsFullTxt, generateLLMsTxt, writeLLMsTxtToPublic } from '../chunk-QL6XNPSD.js';
+export { getBusinessInfo, getFAQItems, getLLMsData, getOptimizedLLMsTxt, getPageSummaries, getServices } from '../chunk-6U3VLV2C.js';
 import '../chunk-L5UOHS6E.js';
 import '../chunk-WMVK77ND.js';
 import '../chunk-VX5CMNMM.js';
-export { LLMS_DISCLAIMER_MAX_LENGTH, LLMS_PUBLIC_SUMMARY_MAX_LENGTH, LLM_GEO_CONTRACT_VERSION, MANAGED_LLM_SCHEMA_KNOWN_KEYS, pickManagedLlmSchemaForJsonLd, sanitizeLlmsDisclaimerLine, sanitizeLlmsPublicSummary, sanitizePrimaryLanguageTag } from '../chunk-4Y5FWDPM.js';
+export { LLMS_DISCLAIMER_MAX_LENGTH, LLMS_PUBLIC_SUMMARY_MAX_LENGTH, LLM_GEO_CONTRACT_VERSION, MANAGED_LLM_SCHEMA_KNOWN_KEYS, pickManagedLlmSchemaForJsonLd, sanitizeLlmsDisclaimerLine, sanitizeLlmsPublicSummary, sanitizePrimaryLanguageTag } from '../chunk-NZ4RXN3G.js';
 import '../chunk-4KZ6W3ZH.js';
 import '../chunk-MJP63SSS.js';
 import '../chunk-YVKRYQRG.js';
 import '../chunk-FESKKJAS.js';
 import '../chunk-A4CC4ZG3.js';
-import '../chunk-6OL23QYD.js';
+import '../chunk-F24FNCTK.js';
 import '../chunk-PKBMQBKP.js';

package/dist/seo/register-sitemap-cli-impl.d.ts

@@ -37,7 +37,7 @@ export type RegisterLocalSitemapOptions = {
      */
     brandProfile?: boolean;
     /**
-     * The sub-site host these pages belong to (`--site ohiopowerstudies.com`).
+     * The sub-site host these pages belong to (`--site ohio.example.com`).
      * Omit to resolve it the way every other build-time read does:
      * `NEXT_PUBLIC_SITE_URL`'s host (the CLI loads `.env` / `.env.local`).
      *

package/dist/seo/register-sitemap-cli.d.ts

@@ -12,7 +12,7 @@
  *   npx sonor-register-sitemap --write-llms-full  # ...and public/llms-full.txt
  *   npx sonor-register-sitemap --write-llms --publication /insights  # articles' path, for cluster links
  *   npx sonor-register-sitemap --write-llms --no-agent-access   # never add the MCP "Agent access" section
- *   npx sonor-register-sitemap --auto-discover --site ohiopowerstudies.com  # Tag the pages with a sub-site host
+ *   npx sonor-register-sitemap --auto-discover --site ohio.example.com  # Tag the pages with a sub-site host
  *
  * The sub-site host defaults to NEXT_PUBLIC_SITE_URL's (from .env / .env.local),
  * so a multi-site project's microsites tag their pages with no flag.

package/dist/seo/register-sitemap-cli.js

@@ -458,7 +458,7 @@ async function registerLocalSitemap(options) {
   }
   if (options.writeLlms && result.success) {
     try {
-      const { writeLLMsTxtToPublic } = await import('../writeLLMsTxt-QR23OQUE.js');
+      const { writeLLMsTxtToPublic } = await import('../writeLLMsTxt-OV24LQVL.js');
       const written = await writeLLMsTxtToPublic({
         // Resolved here too: the sync's own `site` is scoped to the branch that
         // posts, and this runs on the skip path as well.
@@ -527,7 +527,7 @@ async function main() {
       }
       if (result.meta_optimization?.triggered) {
         console.log(`[Sonor] \u2713 Signal AI meta optimization triggered for ${result.meta_optimization.pages_queued} pages`);
-        console.log(`[Sonor]   (Running in background - check Portal SEO module for results)`);
+        console.log(`[Sonor]   (Running in background - check Sonor SEO module for results)`);
       }
       process.exit(0);
     } else {

package/dist/seo/schema-filter.d.ts

@@ -6,12 +6,11 @@
  * `managed_schema` and entity-graph nodes (`ManagedSchema`).
  *
  * `excludeTypes` used to drop a row only when its `schema_type` matched
- * exactly, so a node of that type nested INSIDE a row got through. Found
- * 2026-09-15 on the MDG Green Bay site: the Georgetown and Westbrooke pages
- * carry a page-level row whose JSON-LD embeds a FAQPage for questions the
- * page doesn't show, and structured data has to describe visible content.
- * `excludeTypes: ['FAQPage']` couldn't touch it; the site template dropped
- * FAQPage nodes by hand and re-added the rows. Now an excluded type goes
+ * exactly, so a node of that type nested INSIDE a row got through: a
+ * page-level row whose JSON-LD embeds a FAQPage for questions the page
+ * doesn't show (structured data has to describe visible content) was out of
+ * `excludeTypes: ['FAQPage']`'s reach, and sites dropped those nodes by
+ * hand. Now an excluded type goes
  * wherever it sits: a whole row, an `@graph` member, or a nested value
  * (`mainEntity`, `hasPart`). A row left with nothing in it is dropped.
  *

package/dist/seo/server-api.d.ts

@@ -146,7 +146,7 @@ export declare function registerSitemap(entries: Array<{
 /**
  * Ensure metadata exists for a page by triggering Signal AI optimization.
  * If the page has no managed_title or managed_meta_description, Signal will
- * generate them and save to the database via Portal proxy.
+ * generate them and save to the database via Sonor proxy.
  *
  * Idempotent — returns existing metadata if already populated.
  * @server-only

package/dist/seo/sitemap.js

@@ -1,11 +1,11 @@
-export { createSitemap, getPortfolioPaths, syncSitemapToPortal } from '../chunk-HAG4YIZY.js';
+export { createSitemap, getPortfolioPaths, syncSitemapToPortal } from '../chunk-R46IQIGK.js';
 import '../chunk-Z22QVHT4.js';
-import '../chunk-J4D6ZXRW.js';
-import '../chunk-GLHQ3LRO.js';
+import '../chunk-QL6XNPSD.js';
+import '../chunk-6U3VLV2C.js';
 import '../chunk-L5UOHS6E.js';
 import '../chunk-WMVK77ND.js';
 import '../chunk-VX5CMNMM.js';
-import '../chunk-4Y5FWDPM.js';
+import '../chunk-NZ4RXN3G.js';
 import '../chunk-MJP63SSS.js';
 import '../chunk-ZEGVKVD5.js';
 import '../chunk-YVKRYQRG.js';

package/dist/seo/types.d.ts

@@ -26,7 +26,7 @@ export interface SEOPageData {
     managed_schema?: Record<string, unknown>;
     /** LLM-optimized schema for AI visibility (detailed descriptions, keywords, etc.) */
     managed_llm_schema?: Record<string, unknown>;
-    /** Optional locale → URL map for hreflang (Portal expansion track) */
+    /** Optional locale → URL map for hreflang (Sonor expansion track) */
     language_alternates?: Record<string, string> | null;
     updated_at: string;
 }
@@ -108,7 +108,7 @@ export interface ManagedFAQProps {
     /** Show section title */
     showTitle?: boolean;
     /**
-     * Sub-site host for multi-site projects (e.g. `bd-charlotte.com`): shows that
+     * Sub-site host for multi-site projects (e.g. `charlotte.example.com`): shows that
      * host's FAQ, falling back to a project-wide one. Omit to resolve from
      * NEXT_PUBLIC_SITE_URL.
      */
@@ -137,7 +137,7 @@ export interface ManagedInternalLinksProps {
     /** Custom link renderer */
     renderLink?: (link: ManagedLink) => React.ReactNode;
     /**
-     * Sub-site host for multi-site projects (e.g. `bd-charlotte.com`): shows that
+     * Sub-site host for multi-site projects (e.g. `charlotte.example.com`): shows that
      * host's links plus project-wide ones. Omit to resolve from
      * NEXT_PUBLIC_SITE_URL.
      */
@@ -167,7 +167,7 @@ export interface ManagedContentProps {
     /** Inject entity annotations from knowledge graph (data-sonor-entity attributes) */
     injectEntityAnnotations?: boolean;
     /**
-     * Sub-site host for multi-site projects (e.g. `bd-charlotte.com`): shows that
+     * Sub-site host for multi-site projects (e.g. `charlotte.example.com`): shows that
      * host's block, falling back to a project-wide one. Omit to resolve from
      * NEXT_PUBLIC_SITE_URL.
      */

package/dist/seo/withManagedMetadata.d.ts

@@ -2,10 +2,10 @@
  * @sonordev/site-kit/seo - withManagedMetadata
  *
  * Higher-order function that wraps Next.js generateMetadata to auto-merge
- * Portal-managed SEO data. Portal values serve as defaults; page-level
+ * Sonor-managed SEO data. Sonor values serve as defaults; page-level
  * metadata returned by the caller takes priority.
  *
- * @example Zero-config (Portal manages everything):
+ * @example Zero-config (Sonor manages everything):
  * ```ts
  * export const generateMetadata = withManagedMetadata('/about')
  * ```
@@ -32,12 +32,12 @@ type MetadataArgs = {
 type PathResolver = string | ((args: MetadataArgs) => string | Promise<string>);
 type PageMetadataFn = (args: MetadataArgs, parent: ResolvingMetadata) => Promise<Metadata> | Metadata;
 /**
- * Wrap generateMetadata to auto-merge Portal managed metadata.
+ * Wrap generateMetadata to auto-merge Sonor managed metadata.
  *
  * - `path` can be a static string or a function that derives the path
  *   from the page's params.
  * - `pageMetadata` (optional) returns page-specific overrides.
- *   Anything it returns wins over Portal values.
+ *   Anything it returns wins over Sonor values.
  */
 export declare function withManagedMetadata(path: PathResolver, pageMetadata?: PageMetadataFn): (args: MetadataArgs, parent: ResolvingMetadata) => Promise<Metadata>;
 export {};

package/dist/server/index.js

@@ -1,6 +1,6 @@
-export { resolveClientCredential } from '../chunk-R3VKF43H.js';
+export { resolveClientCredential } from '../chunk-RPZ7OQGD.js';
 import '../chunk-VX5CMNMM.js';
 export { requireServerApiConfig, resolveApiOrigin, resolveServerApiConfig, serverApiFetch } from '../chunk-X6F6SO4S.js';
 import '../chunk-MH2DSGC6.js';
-import '../chunk-6OL23QYD.js';
+import '../chunk-F24FNCTK.js';
 import '../chunk-PKBMQBKP.js';

package/dist/server/mint-site-token.d.ts

@@ -33,8 +33,7 @@
  *
  * SEED FRESHNESS: a static page's seed carries `iat` = build time, and the API
  * refuses to refresh a seed older than SITE_TOKEN_MAX_REFRESH_AGE_SECONDS
- * (sonor-api common/site-auth/site-token.util.ts — currently 400 days, raised
- * from 30 alongside this fix). A site not rebuilt within that window serves a
+ * (currently 400 days, raised from 30 alongside this fix). A site not rebuilt within that window serves a
  * seed the client cannot refresh, and its forms/analytics/engage start failing
  * for new visitors. Keep that limit comfortably longer than the fleet's
  * realistic redeploy gap; marketing sites routinely go many months untouched.

package/dist/server/server-fetch.d.ts

@@ -4,7 +4,7 @@
  * SECURITY: Server-only. Reads SONOR_API_KEY from process.env and injects it as
  * `x-api-key`. Importing this module into a client component is a hard build
  * error (see `import 'server-only'` below) — the API key must never reach the
- * browser. Project is resolved by the Portal from the API key; sites never send
+ * browser. Project is resolved by Sonor from the API key; sites never send
  * or read a project ID (x-api-key only).
  *
  * This is the SINGLE SOURCE OF TRUTH for site-kit's server data plane. It is the
@@ -18,7 +18,7 @@
  * sibling package. Import it from `@sonordev/site-kit/server` instead.
  */
 import 'server-only';
-/** Resolved Portal API config. */
+/** Resolved Sonor API config. */
 export interface ServerApiConfig {
     apiUrl: string;
     apiKey: string;
@@ -30,7 +30,7 @@ export interface ResolveServerApiConfigOptions {
     apiUrl?: string;
 }
 /**
- * Resolve Portal API config from overrides → env. Returns null (does NOT throw)
+ * Resolve Sonor API config from overrides → env. Returns null (does NOT throw)
  * when no API key is available, so callers that prefer to degrade gracefully
  * (e.g. portfolio fetchers) can warn-and-skip.
  *
@@ -46,7 +46,7 @@ export declare function resolveServerApiConfig(options?: ResolveServerApiConfigO
  */
 export declare function requireServerApiConfig(options?: ResolveServerApiConfigOptions, errorMessage?: string): ServerApiConfig;
 /**
- * Origin for the Portal API preconnect/dns-prefetch hints (handles a custom
+ * Origin for the Sonor API preconnect/dns-prefetch hints (handles a custom
  * SONOR_API_URL in staging). Shared by SiteKitLayout and AgencySiteKitLayout so
  * the origin-resolution logic lives in one place.
  */
@@ -102,7 +102,7 @@ export interface ServerFetchOptions {
     init?: RequestInit;
 }
 /**
- * The canonical Portal API fetcher.
+ * The canonical Sonor API fetcher.
  *
  * - Injects `x-api-key` automatically (resolved from overrides → env)
  * - JSON request/response

package/dist/shared/build-entries.d.ts

@@ -96,7 +96,7 @@ export declare const entry: {
     readonly '_client/booking-widget': 'src/sync/BookingWidget.tsx';
     readonly '_client/testimonial-section': 'src/reputation/TestimonialSection.tsx';
     readonly 'slots/index': 'src/slots/index.ts';
-    /** Pure contract + HMAC signing (src/contracts; sonor-api imports @sonordev/contracts/slots) */
+    /** Pure contract + HMAC signing (src/contracts; also published as @sonordev/contracts/slots) */
     readonly 'slots/contract': 'src/slots/contract.ts';
     readonly 'revalidate/index': 'src/revalidate/index.ts';
     readonly 'website/index': 'src/website/index.ts';
@@ -127,7 +127,7 @@ export declare const entry: {
     readonly 'seo/meta/contract': 'src/seo/entry-meta-contract.ts';
     readonly 'seo/pages/contract': 'src/seo/entry-pages-contract.ts';
     readonly 'fleet/index': 'src/fleet/index.ts';
-    /** Pure wire contract (src/contracts; sonor-api imports @sonordev/contracts/fleet) */
+    /** Pure wire contract (src/contracts; also published as @sonordev/contracts/fleet) */
     readonly 'fleet/contract': 'src/fleet/contract.ts';
     /** Multi-site `site` host normalization + equality */
     readonly 'sites/contract': 'src/sites/contract.ts';
@@ -175,8 +175,8 @@ export declare const entry: {
  * SECURITY-CRITICAL. A `'use client'` stamp makes every module the entry reaches
  * client code *by declaration*, so anything in that graph ships to visitors and
  * has its `NEXT_PUBLIC_*` reads inlined as literals. `articles/index` (now `articles/index`)
- * reaching `articles/server-core` this way is how a raw `sonor_` project key ended up in a
- * public `.next/static/chunks/` file of a real upforge-nextjs build.
+ * reaching `articles/server-core` this way would put a raw `sonor_` project key in a
+ * public `.next/static/chunks/` file of the site's build.
  *
  * `./client-entry-boundary.test.ts` asserts none of these can reach a
  * `server-only` module. Add new client entries HERE — that keeps the stamp and

package/dist/shared/dialog.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @sonordev/site-kit shared: how a popup behaves as a dialog.
+ *
+ * SINGLE SOURCE OF TRUTH for popup focus and Escape. PopupBlocks (Website →
+ * Popups & Banners) calls usePopupDialog. Don't hand-roll another keydown
+ * listener or focus trap.
+ *
+ * - Escape closes, whatever the placement.
+ * - A modal popup takes focus when it opens (the dialog element itself, so a
+ *   screen reader announces its name first; Tab then reaches its controls),
+ *   keeps Tab inside, and hands focus back to where it was when it closes.
+ * - A non-modal one (a bar, a slide-in) leaves focus where it is.
+ *
+ * React only: no Next imports and no other site-kit imports, because Sonor's
+ * popup builder renders PopupBlocks too, from a copy of these files.
+ */
+import { type RefObject } from 'react';
+export interface PopupDialogOptions {
+    /** False for a render that isn't live on the page (the builder preview). Default true. */
+    enabled?: boolean;
+    /** Takes focus, keeps Tab inside and returns focus on close. */
+    modal: boolean;
+    /** Escape calls it. */
+    onClose?: () => void;
+}
+/** Dialog behavior for the popup whose panel (the role="dialog" element) is `panelRef`. */
+export declare function usePopupDialog(panelRef: RefObject<HTMLElement | null>, { enabled, modal, onClose }: PopupDialogOptions): void;

package/dist/shared/frame.d.ts

@@ -9,14 +9,13 @@
  *
  * ─── Why it exists ─────────────────────────────────────────────────────────
  *
- * Upforge case studies embed each client's whole production site in three
- * eager iframes (agency-site-kit `DeviceTrifolio`), and
- * `proxy/securityHeaders.ts`'s DEFAULT_FRAME_ANCESTORS lets upforge.io and
- * upforgelabs.com frame every managed site. Inside that frame the client's
- * site loads, hydrates and runs its site-kit modules exactly as it would for
- * a real visitor — the screenshot overlay covers the PIXELS, not the
- * JavaScript. Anything that phones home from there is attributing a visit to
- * upforge.io's page to the client's own project. Measured effect, and the
+ * Agency case studies embed a client's whole production site in desktop,
+ * tablet and mobile iframes, and `proxy/securityHeaders.ts`'s
+ * DEFAULT_FRAME_ANCESTORS lets the showcase origins frame every managed site.
+ * Inside that frame the client's site loads, hydrates and runs its site-kit
+ * modules exactly as it would for a real visitor: a screenshot overlay covers
+ * the PIXELS, not the JavaScript. Anything that phones home from there is
+ * attributing a visit to the portfolio page to the client's own project. Measured effect, and the
  * analytics decision built on this: `analytics/send-gate.ts`.
  *
  * ─── Detection ─────────────────────────────────────────────────────────────
@@ -46,7 +45,7 @@
  *
  * Nesting resolves the way you would want, because these compare against
  * `window.top` and not `window.parent`: a same-origin frame nested inside a
- * cross-origin one (upforge.io → client.com → client.com/widget) is still
+ * cross-origin one (portfolio.example → client.com → client.com/widget) is still
  * correctly reported as a cross-origin embed.
  */
 /**