@sonordev/site-kit 7.2.0 → 7.4.0

package/dist/sync/index.js

@@ -1,6 +1,6 @@
-export { BookingWidget } from '../chunk-GGORNBSC.js';
-export { createBooking, createSlotHold, detectTimezone, fetchAvailability, fetchAvailableDates, fetchBookingTypeDetails, fetchBookingTypes, formatDate, formatDuration, formatTime, prepareMeeting, releaseSlotHold } from '../chunk-BKY2ZNM7.js';
-import '../chunk-D6ZC7XKZ.js';
-import '../chunk-K4ZHAURD.js';
-import '../chunk-F24FNCTK.js';
+export { BookingWidget } from '../chunk-AV4QAK5F.js';
+export { createBooking, createSlotHold, detectTimezone, fetchAvailability, fetchAvailableDates, fetchBookingTypeDetails, fetchBookingTypes, formatDate, formatDuration, formatTime, prepareMeeting, releaseSlotHold } from '../chunk-MHGAZ3LL.js';
+import '../chunk-3E3PPSNR.js';
+import '../chunk-GK7TV7EK.js';
+import '../chunk-KHQ5GD6T.js';
 import '../chunk-PKBMQBKP.js';

package/dist/website/images.js

@@ -1,6 +1,6 @@
-export { ManagedImage, assignImageToSlot, clearImageSlot, fetchManagedImage, fetchManagedImages, listImageFiles, uploadImage } from '../chunk-JMLK6MH7.js';
+export { ManagedImage, assignImageToSlot, clearImageSlot, fetchManagedImage, fetchManagedImages, listImageFiles, uploadImage } from '../chunk-DA5XC7Y6.js';
 export { ManagedFavicon, getManagedFaviconUrl } from '../chunk-GW7GSBO7.js';
-import '../chunk-D6ZC7XKZ.js';
-import '../chunk-K4ZHAURD.js';
-import '../chunk-F24FNCTK.js';
+import '../chunk-3E3PPSNR.js';
+import '../chunk-GK7TV7EK.js';
+import '../chunk-KHQ5GD6T.js';
 import '../chunk-PKBMQBKP.js';

package/dist/website/index.js

@@ -1,13 +1,13 @@
 'use client';
-export { SiteDesignReporter } from '../chunk-5YCEMV2L.js';
-export { SITE_DESIGN_PATH, cleanFontStack, colorToHex, getSiteDesignTokens, measureSiteDesign, readDeclaredDesign, sendSiteDesign } from '../chunk-JJ3DELUL.js';
+export { SiteDesignReporter } from '../chunk-PQDJNIHR.js';
+export { SITE_DESIGN_PATH, cleanFontStack, colorToHex, getSiteDesignTokens, measureSiteDesign, readDeclaredDesign, sendSiteDesign } from '../chunk-CG4ETW5Y.js';
 export { DEFAULT_POPUP_TOKENS, PopupBlocks } from '../chunk-BF7TZYC3.js';
 import '../chunk-IHG36STL.js';
 import '../chunk-YC7ELZS3.js';
 import '../chunk-S22FSH7C.js';
 import '../chunk-43OCZ3JA.js';
 import '../chunk-EKBEOXTH.js';
-import '../chunk-D6ZC7XKZ.js';
-import '../chunk-K4ZHAURD.js';
-import '../chunk-F24FNCTK.js';
+import '../chunk-3E3PPSNR.js';
+import '../chunk-GK7TV7EK.js';
+import '../chunk-KHQ5GD6T.js';
 import '../chunk-PKBMQBKP.js';

package/dist/website/popups.js

@@ -1,14 +1,14 @@
 'use client';
 export { DEFAULT_POPUP_TOKENS, PopupBlocks } from '../chunk-BF7TZYC3.js';
 import '../chunk-IHG36STL.js';
-export { SitePopups } from '../chunk-EJVQJCG5.js';
+export { SitePopups } from '../chunk-6LLTLLEJ.js';
 import '../chunk-27FISYK4.js';
 import '../chunk-S22FSH7C.js';
 import '../chunk-24QZEO3Q.js';
 import '../chunk-GJWI74ZZ.js';
 import '../chunk-43OCZ3JA.js';
 import '../chunk-EKBEOXTH.js';
-import '../chunk-D6ZC7XKZ.js';
-import '../chunk-K4ZHAURD.js';
-import '../chunk-F24FNCTK.js';
+import '../chunk-3E3PPSNR.js';
+import '../chunk-GK7TV7EK.js';
+import '../chunk-KHQ5GD6T.js';
 import '../chunk-PKBMQBKP.js';

package/dist/{writeLLMsTxt-OV24LQVL.js → writeLLMsTxt-OL4KQERZ.js}

@@ -1,8 +1,8 @@
-export { writeLLMsTxtToPublic } from './chunk-QL6XNPSD.js';
-import './chunk-6U3VLV2C.js';
+export { writeLLMsTxtToPublic } from './chunk-ZTLU3BSW.js';
+import './chunk-4BHRA7TI.js';
 import './chunk-L5UOHS6E.js';
 import './chunk-WMVK77ND.js';
-import './chunk-VX5CMNMM.js';
+import './chunk-UAYAJPEP.js';
 import './chunk-NZ4RXN3G.js';
 import './chunk-MJP63SSS.js';
 import './chunk-YVKRYQRG.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sonordev/site-kit",
-  "version": "7.2.0",
+  "version": "7.4.0",
   "type": "module",
   "packageManager": "pnpm@11.5.3",
   "description": "Complete client-side integration kit for Sonor - SEO, Analytics, Engage, Forms, Blog",

package/src/forms/README.md

@@ -242,8 +242,8 @@ nothing to configure.
 - **Agent-sent leads are tagged.** When the browser reports that an agent
   pressed submit (`SubmitEvent.agentInvoked`), the submission carries that
   flag and the lead is tagged in Sonor, so you can see how those leads compare
-  over time. It's the browser's word, so it never changes how a submission is
-  checked. The agent is handed the outcome of its submit (`respondWith`).
+  over time, and Sonor's spam screening takes it into account. The agent is
+  handed the outcome of its submit (`respondWith`).
 - **Nothing typed before the form loads is lost.** `ServerForm` renders the
   form in the page HTML and loads the interactive version at idle. Since
   7.2.0, typing into the server-rendered form starts that upgrade at once and

package/src/llms/README.md

@@ -229,6 +229,75 @@ with `optimizedLLMsTxt: false` in `createSitemap`, so one writer owns the file.
 Reads behind this write always bypass Next's Data Cache — hosts persist it
 between builds, and a cached read is how a site shipped a months-old llms.txt.
 
+#### Agent discovery for a custom MCP server
+
+A custom server stays opt-in. Share the same `mcp` options between the
+build-time writer and both route handlers so the short and full files point
+at the same tools. This adds links to an existing server; it doesn't create
+the endpoint, card, or catalog.
+
+```ts
+// lib/agent-access.ts
+import type { AgentAccessOptions } from '@sonordev/site-kit/seo/llms'
+
+export const agentAccess: AgentAccessOptions = {
+  endpoint: '/api/mcp',
+  card: '/api/mcp/server-card',
+  catalog: '/.well-known/ai-catalog.json', // omit unless this document is served
+  position: 'after-intro',
+}
+```
+
+```ts
+// The site's build-time writer
+import { writeLLMsTxtToPublic } from '@sonordev/site-kit/seo/llms'
+import { agentAccess } from '../lib/agent-access'
+
+await writeLLMsTxtToPublic({
+  full: true,
+  site: 'example.com',
+  mcp: agentAccess,
+})
+```
+
+```ts
+// app/llms.txt/route.ts
+import { createLLMsTxtHandler } from '@sonordev/site-kit/seo/llms'
+import { agentAccess } from '@/lib/agent-access'
+
+export const GET = createLLMsTxtHandler({
+  baseUrl: 'https://example.com',
+  mcp: agentAccess,
+})
+```
+
+```ts
+// app/llms-full.txt/route.ts — use the same options
+import { createLLMsFullTxtHandler } from '@sonordev/site-kit/seo/llms'
+import { agentAccess } from '@/lib/agent-access'
+
+export const GET = createLLMsFullTxtHandler({
+  baseUrl: 'https://example.com',
+  mcp: agentAccess,
+})
+```
+
+`after-intro` preserves the title and introduction and puts Agent access
+before the first content section. `end` places it at the end. Existing
+markdown that already contains Agent access or a recognized server-card link
+is preserved, so update a site's existing discovery section directly when
+its URLs change. The optional catalog is an experimental discovery document,
+not a requirement for using the MCP endpoint.
+
+The writer applies these options to both files, whether Sonor generated the
+content or local data supplied it. It resolves the origin from
+`NEXT_PUBLIC_SITE_URL`, falling back to the `site` host. The handlers apply
+explicit options even when serving an older file through `preferStatic`;
+they use `baseUrl` or the configured site URL and never read the incoming
+request. A CDN serving `public/llms.txt` directly still needs the build-time
+writer to update that file. `mcp: false` disables automatic insertion; it
+doesn't remove a site's existing discovery text.
+
 ### Step 5: On-Demand Revalidation (optional)
 
 When Sonor data changes (page summaries, FAQs, etc.), bust the ISR cache instantly instead of waiting for `s-maxage` to expire:

package/src/mcp/README.md

@@ -9,7 +9,7 @@ definitions:
 | Surface | Who uses it | Entry point |
 |---|---|---|
 | Remote MCP endpoint (Streamable HTTP) | Off-browser agents — Claude, Cursor, any MCP client | `createMcpHandler` |
-| MCP Server Card (SEP-2127) | Crawlers and clients discovering the endpoint | `createMcpServerCardHandler` |
+| Server card and experimental AI catalog | Crawlers and clients discovering the endpoint | `createMcpServerCardHandler`, `createMcpAiCatalogHandler` |
 | In-page WebMCP | Browser-driving agents | `<WebMcpTools>`, `declarativeToolForm` |
 
 One definition feeding all three is the point. The alternative — a tool list for
@@ -163,22 +163,45 @@ export const { POST, GET, DELETE, OPTIONS } = createMcpHandler({
 export const dynamic = 'force-dynamic'
 ```
 
-### 3. Mount the card at BOTH well-known paths
+### 3. Mount the card and optional experimental catalog
+
+The [ext-server-card discovery draft](https://github.com/modelcontextprotocol/ext-server-card/blob/main/docs/discovery.md)
+is experimental. It recommends the card beside the endpoint at
+`<streamable-http-url>/server-card` and a domain catalog at
+`/.well-known/ai-catalog.json`. With the default endpoint, use
+`/api/mcp/server-card` as the site's canonical card URL:
 
 ```ts
-// app/.well-known/mcp-server-card/route.ts   ← canonical (SEP-2127)
-// app/.well-known/mcp.json/route.ts          ← superseded SEP-1649, still probed
-import { createMcpServerCardHandler } from '@sonordev/site-kit/mcp'
+// app/api/mcp/server-card/route.ts
+import { createMcpServerCardHandler, MCP_SERVER_CARD_MEDIA_TYPE } from '@sonordev/site-kit/mcp'
 import { mcpServer } from '@/lib/mcp/server'
 
 export const { GET, OPTIONS } = createMcpServerCardHandler({
   info: mcpServer.info,
   tools: mcpServer.tools,
   baseUrl: 'https://example.com',
+  contentType: MCP_SERVER_CARD_MEDIA_TYPE, // application/mcp-server-card+json
+})
+```
+
+```ts
+// app/.well-known/ai-catalog.json/route.ts
+import { createMcpAiCatalogHandler } from '@sonordev/site-kit/mcp'
+import { mcpServer } from '@/lib/mcp/server'
+
+export const { GET, OPTIONS } = createMcpAiCatalogHandler({
+  info: mcpServer.info,
+  baseUrl: 'https://example.com',
+  serverCardPath: '/api/mcp/server-card',
 })
-export const revalidate = 3600
 ```
 
+The catalog returns `application/ai-catalog+json`. Both handlers use explicit
+configuration and stay statically renderable without reading request data.
+Keep existing `/.well-known/mcp-server-card` and `/.well-known/mcp.json`
+aliases for clients that already use them. The card handler's default remains
+`application/json`; set the vendor content type explicitly on the new path.
+
 ### 4. Register in-page (optional, for browser agents)
 
 ```tsx
@@ -188,10 +211,17 @@ export const revalidate = 3600
 ```
 
 Pass no tool list. The component checks for WebMCP support first and only then
-fetches `tools/list` from the endpoint — so an ordinary visitor does no work
-and the page carries no extra bytes, while an agent gets the same catalog the
-endpoint serves. Handing it descriptors from a server component instead would
-put the whole catalog in every page's RSC payload.
+fetches `tools/list` from the endpoint. In a supported browser it starts when
+the component mounts, without waiting for window load, an idle period, or a
+human interaction. A browser without WebMCP makes no discovery request and
+receives no catalog. Handing it descriptors from a server component instead
+would put the whole catalog in every page's RSC payload.
+
+`defer={true}` preserves the optional load + idle activation. Ordinary parent
+renders keep the current registration; unmounting aborts discovery, remote
+calls, and registrations that support the registration signal. If passing
+`tools` or `localTools` explicitly, keep their arrays stable until the tools
+change.
 
 ### 5. Rate-limit the public endpoint (Netlify)
 
@@ -268,8 +298,8 @@ is not re-exported from `@sonordev/site-kit/mcp`, which stays runtime-neutral.
 
 ### The card does not list tools — on purpose
 
-SEP-2127 deliberately omits primitives from the card: what a server exposes can
-vary with auth state and flags, so the authoritative list is whatever
+The card's discovery shape omits primitives: what a server exposes can
+vary with auth state and configuration, so the authoritative list is whatever
 `tools/list` returns at call time. A card that inlined tools would be a second
 source of truth that goes stale silently.
 
@@ -279,11 +309,15 @@ point and requires a reverse-DNS prefix, so the hint rides along without
 pretending to be standard — useful for crawlers that index the card and never
 connect.
 
-### Two well-known paths
+### Experimental discovery and compatibility paths
 
-SEP-1649 proposed `/.well-known/mcp.json`; the ratified SEP-2127 moved to
-`/.well-known/mcp-server-card`. Deployed validators still probe the old path.
-Serving one document from two URLs costs nothing, so mount both.
+Site-kit keeps `/.well-known/mcp-server-card` and `/.well-known/mcp.json`
+for compatibility with existing integrations. The experimental
+ext-server-card draft adds domain discovery through
+`/.well-known/ai-catalog.json`, which links to the recommended endpoint-local
+card at `/api/mcp/server-card`. These draft conventions aren't a guarantee
+that every agent discovers or uses them. Keep the endpoint and existing card
+URLs working while adding the catalog.
 
 ### Dual-era protocol support
 

package/src/reputation/README.md

@@ -27,6 +27,7 @@ interface TestimonialSectionProps {
   autoplay?: boolean              // Auto-rotate reviews
   autoplayInterval?: number       // ms between rotations
   showRating?: boolean            // Display star ratings
+  showPhoto?: boolean             // Show attached business photo (default true)
   maxReviews?: number             // Limit displayed count
   featuredOnly?: boolean          // Show featured reviews only
   service?: string                // Filter by service tag
@@ -34,6 +35,29 @@ interface TestimonialSectionProps {
 }
 ```
 
+## Visual review cards
+
+Render a photo and its original review together with a responsive, server-rendered gallery:
+
+```tsx
+import { fetchReviews, VisualReviewGallery } from '@sonordev/site-kit/reputation/server'
+
+export default async function ReviewsPage() {
+  const reviews = await fetchReviews({ limit: 12 })
+  return <VisualReviewGallery reviews={reviews} title="What Our Clients Say" />
+}
+```
+
+`VisualReviewCard` accepts one `review`, optional `showRating` and `className`.
+`VisualReviewGallery` accepts `reviews`, optional `title`, `subtitle`, `showRating`
+and `className`. Both use the site's `--sk-*` brand tokens and work in React
+Server Components. Import `@sonordev/site-kit/brand.css` once for token defaults,
+then override them in your site's CSS.
+
+Text-only reviews stay visible while a photo is pending. Adding or removing a
+photo in Sonor updates the public review feed; `image` continues to mean the
+reviewer's avatar. Only HTTPS photo URLs are displayed.
+
 ## API Functions
 
 ```ts
@@ -50,6 +74,7 @@ interface Review {
   id: string; quote: string; name: string; role?: string;
   rating: number; image?: string; date?: string;
   platform?: string; isFeatured?: boolean; serviceTags?: string[];
+  photo?: { fileId: string; url: string; altText: string; caption: string } | null;
 }
 
 interface ReviewStats {

package/dist/SitemapSync-RJTEBINX.js

@@ -1,8 +0,0 @@
-export { SitemapSync } from './chunk-GEXT7BTE.js';
-import './chunk-YVKRYQRG.js';
-import './chunk-43OCZ3JA.js';
-import './chunk-EKBEOXTH.js';
-import './chunk-D6ZC7XKZ.js';
-import './chunk-K4ZHAURD.js';
-import './chunk-F24FNCTK.js';
-import './chunk-PKBMQBKP.js';