@sonordev/site-kit 7.1.1 → 7.2.0

package/dist/website/popup-types.d.ts

@@ -0,0 +1,113 @@
+/**
+ * @sonordev/site-kit/website/popups: what a published popup looks like.
+ *
+ * Sonor → Website → Popups & Banners. The API serves them from
+ * `GET /engage/widget/elements` (its route keeps the retired module's name).
+ */
+import type { PopupBlock } from './contract';
+/** What Sonor says a popup is. A blocks popup's `layout` says where it actually sits. */
+export type SitePopupType = 'popup' | 'nudge' | 'bar' | 'chat' | 'slide-in';
+/** A popup, banner or toast published for this site (Sonor → Website → Popups & Banners). */
+export interface SitePopup {
+    id: string;
+    project_id: string;
+    name: string;
+    type: SitePopupType;
+    config: SitePopupConfig;
+    targeting: SitePopupTargeting;
+    trigger: SitePopupTrigger;
+    is_active: boolean;
+    priority: number;
+    created_at: string;
+    updated_at: string;
+    /**
+     * The popup as blocks, drawn in the site's own design by PopupBlocks. A
+     * popup without blocks isn't drawn: Sonor's older `design_json` (Engage
+     * Studio) is for site-kits before 7.2.0, and is ignored here.
+     */
+    blocks?: PopupBlock[];
+    /**
+     * Where a blocks popup sits. `type`/`config` describe it for older kits
+     * (which can't pin a bar to the bottom); this says what it actually is.
+     */
+    layout?: {
+        placement: 'popup' | 'bar' | 'slide-in';
+        edge?: 'top' | 'bottom';
+        corner?: 'bottom-left' | 'bottom-right' | 'top-left' | 'top-right';
+        /** The popup's own accent, over the site's. */
+        accent?: string;
+    };
+    status?: 'draft' | 'published' | 'archived' | 'paused';
+}
+export interface SitePopupConfig {
+    /** Visual style */
+    theme?: 'light' | 'dark' | 'custom';
+    position?: 'center' | 'top' | 'bottom' | 'left' | 'right' | 'bottom-left' | 'bottom-right' | 'top-left' | 'top-right';
+    /** Content */
+    title?: string;
+    message?: string;
+    imageUrl?: string;
+    /** CTA */
+    ctaText?: string;
+    ctaUrl?: string;
+    ctaAction?: 'link' | 'close' | 'form' | 'chat';
+    /** Form (if ctaAction is 'form') */
+    formId?: string;
+    /** Styling */
+    backgroundColor?: string;
+    textColor?: string;
+    ctaBackgroundColor?: string;
+    ctaTextColor?: string;
+    borderRadius?: number;
+    /** Behavior */
+    closable?: boolean;
+    showOverlay?: boolean;
+    overlayOpacity?: number;
+}
+export interface SitePopupTargeting {
+    /** Page targeting */
+    pages?: {
+        include?: string[];
+        exclude?: string[];
+    };
+    /** Device targeting */
+    devices?: ('desktop' | 'mobile' | 'tablet')[];
+    /** Visitor targeting */
+    visitor?: {
+        type?: 'new' | 'returning' | 'all';
+        minSessions?: number;
+        maxSessions?: number;
+    };
+    /** Source targeting */
+    source?: {
+        utm_source?: string[];
+        utm_medium?: string[];
+        utm_campaign?: string[];
+        referrer?: string[];
+    };
+    /** Time targeting */
+    schedule?: {
+        startDate?: string;
+        endDate?: string;
+        daysOfWeek?: number[];
+        startTime?: string;
+        endTime?: string;
+        timezone?: string;
+    };
+}
+export interface SitePopupTrigger {
+    type: 'immediate' | 'delay' | 'scroll' | 'exit-intent' | 'click' | 'custom';
+    /** Delay in seconds (for 'delay' type) */
+    delay?: number;
+    /** Scroll percentage (for 'scroll' type) */
+    scrollPercentage?: number;
+    /** CSS selector (for 'click' type) */
+    clickSelector?: string;
+    /** Custom event name (for 'custom' type) */
+    customEvent?: string;
+    /** Frequency capping */
+    frequency?: {
+        type: 'always' | 'once' | 'once-per-session' | 'every-n-days';
+        days?: number;
+    };
+}

package/dist/website/popups.d.ts

@@ -7,11 +7,7 @@
  * import it to place it yourself. `PopupBlocks` is the renderer, for drawing
  * one popup from its blocks.
  */
-import React from 'react';
-import { EngageWidget } from '../engage/EngageWidget';
-export type SitePopupsProps = Omit<React.ComponentProps<typeof EngageWidget>, 'chatEnabled'>;
-/** The site's published popups, banners and toasts. No chat launcher (that's `./chat`). */
-export declare function SitePopups(props: SitePopupsProps): React.JSX.Element;
+export { SitePopups, type SitePopupsProps } from './SitePopups';
 export { PopupBlocks, DEFAULT_POPUP_TOKENS, type PopupBlocksProps, type PopupPlacement } from './PopupBlocks';
-export type { EngageElement as SitePopup } from '../engage/types';
+export type { SitePopup, SitePopupConfig, SitePopupTargeting, SitePopupTrigger, SitePopupType, } from './popup-types';
 export type { PopupBlock, SiteDesignTokens } from './contract';

package/dist/website/popups.js

@@ -1,22 +1,14 @@
 'use client';
-export { DEFAULT_POPUP_TOKENS, PopupBlocks } from '../chunk-JSZN6LDZ.js';
+export { DEFAULT_POPUP_TOKENS, PopupBlocks } from '../chunk-BF7TZYC3.js';
 import '../chunk-IHG36STL.js';
-import { EngageWidget } from '../chunk-B73QPZPH.js';
-import '../chunk-NDF4A5JM.js';
-import '../chunk-6T6CQVNL.js';
+export { SitePopups } from '../chunk-EJVQJCG5.js';
+import '../chunk-27FISYK4.js';
 import '../chunk-S22FSH7C.js';
 import '../chunk-24QZEO3Q.js';
 import '../chunk-GJWI74ZZ.js';
 import '../chunk-43OCZ3JA.js';
 import '../chunk-EKBEOXTH.js';
-import '../chunk-PXZ7LAOY.js';
-import '../chunk-OUNRFXDC.js';
-import '../chunk-6OL23QYD.js';
+import '../chunk-D6ZC7XKZ.js';
+import '../chunk-K4ZHAURD.js';
+import '../chunk-F24FNCTK.js';
 import '../chunk-PKBMQBKP.js';
-import { jsx } from 'react/jsx-runtime';
-
-function SitePopups(props) {
-  return /* @__PURE__ */ jsx(EngageWidget, { ...props, chatEnabled: false });
-}
-
-export { SitePopups };

package/dist/{writeLLMsTxt-QR23OQUE.js → writeLLMsTxt-OV24LQVL.js}

@@ -1,9 +1,9 @@
-export { writeLLMsTxtToPublic } from './chunk-J4D6ZXRW.js';
-import './chunk-GLHQ3LRO.js';
+export { writeLLMsTxtToPublic } from './chunk-QL6XNPSD.js';
+import './chunk-6U3VLV2C.js';
 import './chunk-L5UOHS6E.js';
 import './chunk-WMVK77ND.js';
 import './chunk-VX5CMNMM.js';
-import './chunk-4Y5FWDPM.js';
+import './chunk-NZ4RXN3G.js';
 import './chunk-MJP63SSS.js';
 import './chunk-YVKRYQRG.js';
 import './chunk-FESKKJAS.js';

package/docs/MIGRATING-TO-7.md

@@ -1,8 +1,8 @@
 # Moving a site to site-kit 7
 
 site-kit 7 is organised the way Sonor's dashboard is: one entry per module.
-Most sites need no changes at all. Move a site when you next touch it
-("touch a site, update its deps"); nothing forces it before then, because a
+Most sites need no changes at all. Move a site when you next touch it;
+nothing forces it before then, because a
 site's `^6` range never picks up 7.
 
 ## The short version
@@ -20,7 +20,14 @@ idempotent: running it twice changes nothing the second time. It works from
 any 2.x-6.x site: copies of sites on 4.2, 5.8 and 6.5 were migrated with it
 and built.
 
-Requirements: Next 16 (every fleet site is on it) and Node 20.19+ or 22.12+
+It leaves nothing in the project but the change. Since sonor-setup 7.1.2 the
+originals of the files it writes go to a folder in your OS temp directory
+(it prints where, and git has them too), not `.bak` files beside them, and
+it never creates or edits `.env.example`: `.env.local` is the one env file.
+An old fallback such as `process.env.SONOR_API_KEY || process.env.UPTRADE_API_KEY`
+becomes `process.env.SONOR_API_KEY`.
+
+Requirements: Next 16 and Node 20.19+ or 22.12+
 (Netlify's default is 22).
 
 ## What changed, and what the codemod does about it
@@ -48,9 +55,6 @@ keeps type imports on the root. It flags, rather than rewrites, a namespace
 import (`import * as SK`), a `require`, or a re-export from the root. The full
 list is `src/shared/module-map.json` (`rootRuntime`).
 
-Across our own sites on 2026-09-26 this touched three repos: one for
-`affiliates`, two for `BookingWidget`.
-
 ### 2. The setup CLI is its own package: `sonor-setup`
 
 The CLI (init, scaffold, codemods, OG cards, GEO wiring, verify) was 3 MB of
@@ -58,10 +62,10 @@ every site's install and forced a site-kit release for every setup-only fix.
 It's now [`sonor-setup`](../packages/sonor-setup).
 
 - **`npx sonor-setup …` keeps working unchanged:** npx fetches the package.
-- **A site whose package.json scripts run `sonor-setup`** (wirsch-law's OG
-  step, `sonor-setup og`) needs it as a dev dependency. The codemod adds
+- **A site whose package.json scripts run `sonor-setup`** (an OG step that
+  runs `sonor-setup og`, say) needs it as a dev dependency. The codemod adds
   `"sonor-setup": "^7.0.0"` for you.
-- **`sonor-register-sitemap` stays in site-kit**, since 11 sites run it from
+- **`sonor-register-sitemap` stays in site-kit**, since sites run it from
   their postbuild. Nothing to change.
 - The `site-kit` bin alias for the CLI is gone (no site used it).
 
@@ -71,30 +75,46 @@ New homes, each the same module as before:
 
 - Website: `./website/{popups,images,slots,cms,landing,cta-bar}`
 - SEO: `./seo/{sitemap,robots,indexnow,redirects,og,og/route,llms,llms/client,llms/contract,meta/contract,pages/contract}`
-- Website chat: `./chat` (out of `./engage`)
+- Website chat: `./chat`, and popups: `./website/popups` (both out of
+  `./engage`, which Sonor retired with the Engage module)
 
 **The old paths keep working through 7.x** and are removed in 8.0. The
-codemod moves them anyway, so a touched site is done in one pass.
-`SiteKitLayout` gains `chat` and `popups` props; `engage` is an alias
-(`engage={false}` still turns both off).
+codemod moves them anyway, so a touched site is done in one pass: chat
+imports go to `./chat`, popup types to `./website/popups` under their new
+names (`EngageElement` is `SitePopup`). It flags `EngageWidget`, which draws
+both and which `SiteKitLayout` already mounts. `SiteKitLayout` gains `chat`
+and `popups` props; `engage` is an alias (`engage={false}` still turns both
+off). Since 7.2.0, popups render only from blocks: one made in Engage Studio
+isn't drawn, so make it again in Sonor (Website → Popups & Banners).
 
 ### 4. ESM only, Next 16 only
 
 site-kit ships ES modules alone (`"type": "module"`). Next, Turbopack and the
 kits don't notice. Node 20.19+/22.12+ can `require()` it too, so a
 `next.config.ts` that imports `@sonordev/site-kit/config` keeps working. A
-site-side script that `require()`s site-kit on an older Node would break; none
-in the fleet does.
+site-side script that `require()`s site-kit on an older Node would break.
 
 The `next` peer is `^16`. Next 16 renamed `middleware.ts` to `proxy.ts`, and
 **the codemod moves it**: the file, a named `middleware` export (to `proxy`),
 and `createMiddleware` from `@sonordev/site-kit/middleware` (to `createProxy`
-from `/proxy`). The old names work through 7.x. It won't move a file that
-sets `runtime` (a proxy file can't; the build throws), and says so: remove
-the export, check the logic still runs on your host, rerun. It never moves
-onto an existing `proxy.ts`. `npx sonor-setup next16` runs just this part.
+from `/proxy`). The old names work through 7.x.
+
+**The proxy goes beside the app directory.** Next reads it from the project
+root, or from `src/` when the app is `src/app`, and silently ignores one
+anywhere else: the build passes, but the site sends no security headers and
+runs no managed redirects. So on a `src/app` site the codemod writes
+`src/proxy.ts`, with the file's relative imports re-pointed. Before
+sonor-setup 7.1.2 it renamed the file in place, which left a root `proxy.ts`
+on those sites; rerunning the codemod moves it, and `npx sonor-setup doctor`
+warns about any proxy Next doesn't read.
+
+It won't move a file that sets `runtime` (a proxy file can't; the build
+throws), and says so: remove the export, check the logic still runs on your
+host, rerun. It never moves onto a proxy Next already runs: with one in each
+place, it reports both and changes neither. `npx sonor-setup next16` runs
+just this part.
 
-### 5. Removed (no site in the fleet used them)
+### 5. Removed (nothing used them)
 
 - `@sonordev/site-kit/search` and `/search/contract`
 - `@sonordev/site-kit/redirects/not-found` (`resolveManagedRedirect`), and
@@ -123,7 +143,7 @@ Still accepted and ignored until 8.0, because sites pass them:
   `.env.local`, `.env.production`, `.env`. It used to let `.env.local` beat
   the host.
 
-## Optional, and new in 7.0
+## Optional, and new in 7.x
 
 - **Cache Components.** `cacheComponents: true` in next.config works with
   site-kit now (it failed every page through 6.x). Remove route segment
@@ -133,11 +153,19 @@ Still accepted and ignored until 8.0, because sites pass them:
   reviews; inquiries, availability and offerings when you ask), the server
   card, and on Netlify the rate-limited relay. Sonor's AI Visibility tab then
   shows which agents used them. A site that already runs its own MCP server
-  (upforge.io and the other hand-written ones) is left exactly as it is:
+  (a hand-written one) is left exactly as it is:
   nothing in 7.0 turns anything on for it. To have Sonor see its calls, add
   `onToolCall: reportToolCallsToSonor()` to its `createMcpHandler`.
 - **`@sonordev/contracts`** is for the APIs and the dashboard; sites keep
   importing `@sonordev/site-kit/*/contract`, which is the same code.
+- **Live updates (7.1).** `npx sonor-setup scaffold` writes the route Sonor
+  calls when content changes, `app/api/seo-revalidate/route.ts`, and
+  `npx sonor-setup doctor` checks for it. A site with articles gets
+  `createRevalidateRoute({ publicationBasePath: '/insights' })` with its own
+  path, read from the app directory (a dynamic page that renders site-kit
+  articles, or a `[slug]` route under a folder like `/blog` or `/news`).
+  When more than one folder looks like the publication, it writes the
+  one-line route and lists them.
 
 ## Kits built on site-kit
 

package/docs.json

@@ -38,7 +38,8 @@
       "title": "Engagement",
       "pages": [
         { "slug": "forms", "title": "Forms", "file": "src/forms/README.md" },
-        { "slug": "chat", "title": "Website chat", "file": "src/engage/README.md" },
+        { "slug": "chat", "title": "Website chat", "file": "src/chat/README.md" },
+        { "slug": "popups", "title": "Popups and banners", "file": "src/website/README.md" },
         { "slug": "cta-bar", "title": "CTA bar", "file": "src/cta-bar/README.md" },
         { "slug": "signal", "title": "Signal (A/B)", "file": "src/signal/README.md" }
       ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sonordev/site-kit",
-  "version": "7.1.1",
+  "version": "7.2.0",
   "type": "module",
   "packageManager": "pnpm@11.5.3",
   "description": "Complete client-side integration kit for Sonor - SEO, Analytics, Engage, Forms, Blog",
@@ -461,7 +461,7 @@
     "gsap": "^3.15.0",
     "happy-dom": "^20.14.5",
     "inquirer": "^14.0.2",
-    "next": "16.3.6",
+    "next": "16.3.8",
     "open": "11.0.0",
     "ora": "^9.4.1",
     "playwright": "^1.62.1",

package/src/admin-auth/README.md

@@ -11,7 +11,7 @@ admins) can sign in; nobody else can. There are no passwords on the site.
 import { createSonorSso } from '@sonordev/site-kit/admin-auth'
 
 export const sso = createSonorSso({
-  paths: '/admin',            // or ['/bid', '/route'] for several areas
+  paths: '/admin',            // or ['/admin', '/staff'] for several areas
   // loginPath: '/admin/login' (default: `${paths[0]}/login`)
   // adminEmails: process.env.ADMIN_EMAILS,
 })
@@ -62,8 +62,8 @@ const session = await sso.getSession()
 if (!session) return new Response('Unauthorized', { status: 401 })
 ```
 
-Designer APIs or other JSON endpoints can be guarded in the middleware too:
-pass `apiPaths: ['/api/studio']` and include them in the matcher. They get a
+JSON endpoints can be guarded in the middleware too: pass
+`apiPaths: ['/api/admin']` and include them in the matcher. They get a
 401 JSON response instead of a redirect.
 
 ## Env

package/src/analytics/README.md

@@ -178,14 +178,12 @@ events or conversions. The visitor is on whoever framed the page, not on this
 site, so every metric the frame produces is phantom traffic in the analytics
 its owner reads.
 
-This is not hypothetical. Upforge case studies embed each client's whole
-production site in three eager iframes, and `securityHeaders`'
-`DEFAULT_FRAME_ANCESTORS` permits that. Before the guard landed, 23 client
-sites carried the signature in `analytics_page_views`: three views of `/`
-sharing one session and visitor id, 21-80ms apart, referrer
-`https://upforge.io/` — the desktop, tablet and mobile frames of one case
-study. The screenshot overlay in those frames hides the pixels, not the
-JavaScript.
+A portfolio page that shows a live site in desktop, tablet and mobile frames
+is the common case, and `securityHeaders`' `DEFAULT_FRAME_ANCESTORS` permits
+it. Without the guard, one visit to that page would record three views of `/`
+on the framed site, milliseconds apart, sharing one session and visitor id,
+with the portfolio as the referrer. A screenshot laid over the frames hides
+the pixels, not the JavaScript.
 
 **Same-origin frames still report.** A site embedding itself (a preview pane,
 a print view, an on-domain booking frame) has a real visitor really on that
@@ -214,7 +212,7 @@ with `analytics.site` or `NEXT_PUBLIC_SITE_URL` set to a production domain.
 `localhost`, its subdomains, `127.0.0.1`, `[::1]`, and `0.0.0.0` report nothing
 by default: page views, events, conversions, sessions, vitals, scroll and
 heatmap data, fleet heartbeats, and client-side sitemap registrations all use
-`resolveAnalyticsTarget`. Engage doesn't mount its widgets or chat transport.
+`resolveAnalyticsTarget`. Website chat and popups don't mount at all.
 Public hosts and same-origin frames on public hosts still report normally.
 
 For intentional local reporting:
@@ -224,7 +222,7 @@ For intentional local reporting:
 ```
 
 The layout passes this option to AnalyticsProvider, WebVitals, FleetHeartbeat,
-SitemapSync and EngageWidget. Standalone components and `sendFleetHeartbeat`
+SitemapSync, SiteChat and SitePopups. Standalone components and `sendFleetHeartbeat`
 accept it too; standalone `trackEvent`/`trackConversion` use their mounted
 AnalyticsProvider's options. A local cross-origin frame needs **both** opt-ins.
 Neither option bypasses authentication. No environment variable or global
@@ -241,7 +239,7 @@ Uses `SONOR_API_KEY` (injected by `SiteKitLayout`) or `window.__SITE_KIT_API_KEY
 ## Multi-site projects (`analytics.site`)
 
 A single Sonor project can host many sub-sites (e.g. one project hosting
-example.com + 16 state microsites). Every analytics event is
+example.com + a dozen regional microsites). Every analytics event is
 tagged with the sub-site host so the dashboard can roll up + filter per
 site without forcing each microsite into its own Sonor project.
 

package/src/articles/README.md

@@ -17,12 +17,12 @@ import type { PublicationRoutingOptions } from '@sonordev/site-kit/articles/serv
 
 const siteUrl = 'https://example.com'
 const routing = {
-  basePath: '/theforge',
+  basePath: '/journal',
   includeCategoryInPath: true,
-  categoryPath: (slug: string) => `/theforge?category=${encodeURIComponent(slug)}`,
+  categoryPath: (slug: string) => `/journal?category=${encodeURIComponent(slug)}`,
 } satisfies PublicationRoutingOptions
 
-// Cards, related stories and cluster links now use /theforge/category/slug.
+// Cards, related stories and cluster links now use /journal/category/slug.
 const article = <Article slug="build-first" routing={routing} />
 const archive = <ArticleList routing={routing} />
 
@@ -30,7 +30,7 @@ const archive = <ArticleList routing={routing} />
 const metadata = await generateArticleMetadata('build-first', { siteUrl, ...routing })
 const post = await getArticle('build-first')
 const schema = post ? generateArticleSchema(post, { siteUrl, ...routing }) : null
-// In app/theforge/[category]/[slug]/page.tsx, wrap it to pass the routing:
+// In app/journal/[category]/[slug]/page.tsx, wrap it to pass the routing:
 // export function generateStaticParams() { return generateArticleStaticParams(routing) }
 const params = await generateArticleStaticParams(routing) // { category, slug }[]
 const sitemap = await generateArticleSitemap(siteUrl, {
@@ -38,7 +38,7 @@ const sitemap = await generateArticleSitemap(siteUrl, {
   includeCategories: false, // category filters don't need separate sitemap entries
   includeClusters: false, // enable when your site implements cluster routes
 })
-const rss = await generateRssFeed({ siteUrl, siteName: 'The Forge', ...routing })
+const rss = await generateRssFeed({ siteUrl, siteName: 'The Journal', ...routing })
 const href = createPublicationRoutes(routing).post({ slug: 'build-first', category: 'guides' })
 ```
 
@@ -47,7 +47,10 @@ const href = createPublicationRoutes(routing).post({ slug: 'build-first', catego
 provide `postPath: post => '/articles/' + encodeURIComponent(post.slug)`.
 Callbacks return local paths; generated metadata, feeds, and sitemaps separately
 honor a valid `canonical_url`. The same routes apply to Atom and generated
-breadcrumb/cluster schemas. Supplied `schema`/`schema_json` objects stay intact.
+breadcrumb/cluster schemas. Supplied `schema`/`schema_json` objects stay intact, apart
+from template placeholders (an `Organization` named "Example", `example.com` URLs,
+`{post.title}`), which `generateAllArticleSchemas` drops. When nothing real is left,
+it generates the article's schema from its own fields instead.
 
 For custom layouts, `resolveArticleArtwork(post, 'article')` prefers
 `editorial_image`, preserving an empty decorative `editorial_image_alt`.
@@ -107,7 +110,7 @@ export async function generateMetadata() {
 
 export default function PublicationPage() {
   return (
-    <PublicationLayout hero={{ title: 'The Forge', subtitle: 'Latest articles' }}>
+    <PublicationLayout hero={{ title: 'The Journal', subtitle: 'Latest articles' }}>
       <ArticleList showCategoryFilter showPagination />
     </PublicationLayout>
   )