@sonordev/site-kit 8.6.0 → 8.8.0

package/dist/{chunk-URJN75ZG.js → chunk-XIDWNXZN.js}

@@ -1,5 +1,5 @@
-import { getSEOPageData, ensureMetadata, getABTest, recordABImpression, getRedirectData, getRobotsData, getSitemapEntries } from './chunk-Y35BWW2C.js';
-import { titleProblem, descriptionProblem } from './chunk-BQR4IPBW.js';
+import { getSEOPageData, ensureMetadata, getABTest, recordABImpression, getRedirectData, getRobotsData, getSitemapEntries } from './chunk-ODOV76VW.js';
+import { titleProblem, descriptionProblem } from './chunk-ISRBSTB7.js';
 import { resolveSiteHost } from './chunk-FESKKJAS.js';
 
 // src/seo/getManagedMetadata.ts
@@ -232,7 +232,7 @@ async function generateSitemap(options) {
   }));
 }
 async function registerLocalSitemap(options) {
-  const { registerSitemap } = await import('./server-api-EGOKC7Q3.js');
+  const { registerSitemap } = await import('./server-api-XIKDWSNO.js');
   let entries = options.entries || [];
   if (options.autoDiscover && entries.length === 0) {
     try {

package/dist/chunk-XLAHRN4B.js

@@ -0,0 +1 @@
+

package/dist/chunk-XS2ORMUG.js

@@ -0,0 +1,32 @@
+// src/contracts/public-url-host.ts
+function isPrivateIpv4(a, b) {
+  return a === 127 || a === 10 || a === 0 || a === 192 && b === 168 || a === 172 && b >= 16 && b <= 31 || a === 169 && b === 254 || a === 100 && b >= 64 && b <= 127 || a >= 224;
+}
+function ipv6Words(host) {
+  if (!host.includes(":") || !/^[a-f\d:.]+$/.test(host)) return null;
+  let canonical;
+  try {
+    canonical = new URL(`http://[${host}]/`).hostname.slice(1, -1);
+  } catch {
+    return null;
+  }
+  const sides = canonical.split("::");
+  const left = sides[0] ? sides[0].split(":") : [];
+  const right = sides.length > 1 && sides[1] ? sides[1].split(":") : [];
+  return [...left, ...Array(sides.length > 1 ? 8 - left.length - right.length : 0).fill("0"), ...right].map((word) => parseInt(word, 16));
+}
+function isBlockedPublicUrlHost(rawHost) {
+  const host = rawHost.toLowerCase().replace(/^\[|\]$/g, "");
+  const blockedName = host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local") || host.endsWith(".internal");
+  if (host.includes(":") && host.includes("%")) return true;
+  const ipv4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  const blockedIp = !!ipv4 && isPrivateIpv4(Number(ipv4[1]), Number(ipv4[2]));
+  const words = ipv6Words(host);
+  const blockedIpv6 = !!words && // Unspecified/loopback, unique-local, link-local, deprecated site-local
+  // and multicast destinations aren't public logo/webhook endpoints.
+  (words.every((word) => word === 0) || words.slice(0, 7).every((word) => word === 0) && words[7] === 1 || (words[0] & 65024) === 64512 || (words[0] & 65472) === 65152 || (words[0] & 65472) === 65216 || (words[0] & 65280) === 65280 || // IPv4-mapped and older IPv4-compatible forms carry an IPv4 destination.
+  words.slice(0, 5).every((word) => word === 0) && [0, 65535].includes(words[5]) && isPrivateIpv4(words[6] >> 8, words[6] & 255));
+  return blockedName || blockedIp || blockedIpv6;
+}
+
+export { isBlockedPublicUrlHost };

package/dist/{chunk-6AWIUO2Z.js → chunk-Y6SHFILE.js}

@@ -1,4 +1,4 @@
-import { publishSiteCredential } from './chunk-VA6IJ55K.js';
+import { publishSiteCredential } from './chunk-OPUY4RS6.js';
 
 // src/client/SiteKitCredential.tsx
 function SiteKitCredential({

package/dist/{chunk-FTSEP7Q3.js → chunk-YEX5RAEU.js}

@@ -2,8 +2,8 @@
 import { DEFAULT_WIDGET_Z_INDEX } from './chunk-27FISYK4.js';
 import { readAnalyticsIdentity } from './chunk-5ROTTMBL.js';
 import { getOrCreateVisitorId } from './chunk-IPQKQEWI.js';
-import { resolveAnalyticsTarget } from './chunk-DLM4FFNH.js';
-import { sonorFetch } from './chunk-IYCSDFPN.js';
+import { resolveAnalyticsTarget } from './chunk-ZQSCMYZO.js';
+import { sonorFetch } from './chunk-FLOJUMFR.js';
 import { useState, useEffect, useCallback, useRef } from 'react';
 import ReactDOM from 'react-dom';
 import dynamic from 'next/dynamic';
@@ -161,7 +161,7 @@ function activatePopup(active, id, popups) {
   return [...active, id];
 }
 var LazyBlocksPopup = dynamic(
-  () => import('./BlocksPopup-AJ3CKVQG.js').then((m) => ({ default: m.BlocksPopup })),
+  () => import('./BlocksPopup-NEEFV2L3.js').then((m) => ({ default: m.BlocksPopup })),
   { ssr: false }
 );
 function SitePopups(props) {

package/dist/{chunk-AJG74ZZV.js → chunk-YRQS7VAH.js}

@@ -1,4 +1,4 @@
-import { FormEnhancer } from './chunk-OWO3RFEX.js';
+import { FormEnhancer } from './chunk-SLFYTELD.js';
 import { StaticForm } from './chunk-VPZJ7ZTL.js';
 import { serverApiFetch } from './chunk-C7TLGL3R.js';
 import { jsx } from 'react/jsx-runtime';

package/dist/{chunk-DLM4FFNH.js → chunk-ZQSCMYZO.js}

@@ -1,4 +1,4 @@
-import { FRAME_READY_MESSAGE } from './chunk-EKBEOXTH.js';
+import { FRAME_READY_MESSAGE } from './chunk-64XODP7M.js';
 import { readPublishedApiConfig, DEFAULT_SONOR_API_URL } from './chunk-W7OPEMGJ.js';
 
 // src/shared/frame.ts

package/dist/client/index.js

@@ -1,6 +1,6 @@
 'use client';
-export { SiteKitCredential } from '../chunk-6AWIUO2Z.js';
-import '../chunk-VA6IJ55K.js';
+export { SiteKitCredential } from '../chunk-Y6SHFILE.js';
+import '../chunk-OPUY4RS6.js';
 export { VISUAL_VIEWPORT_GAP_PROPERTY, VisualViewportGap, useVisualViewportGap } from '../chunk-6T6CQVNL.js';
 export { useDeferredActivation } from '../chunk-YC7ELZS3.js';
 import '../chunk-FESKKJAS.js';
@@ -9,6 +9,6 @@ export { trackConversion, trackEvent } from '../chunk-LCDVPAMR.js';
 export { getOrCreateSessionId, getOrCreateVisitorId, useSiteKitIdentity } from '../chunk-IPQKQEWI.js';
 import '../chunk-GJWI74ZZ.js';
 import '../chunk-5TM3WPCI.js';
-import '../chunk-QQT2T6JQ.js';
-import '../chunk-BUE3Z32O.js';
+import '../chunk-7HW4TZB5.js';
+import '../chunk-F6WLHVMQ.js';
 import '../chunk-PKBMQBKP.js';

package/dist/contracts/campaign-normalize.d.ts

@@ -0,0 +1,2 @@
+/** Single source of truth for campaign identities across sites, APIs and funnels. */
+export declare function normalizeCampaignSlug(input?: string | null): string | null;

package/dist/contracts/entries.d.ts

@@ -4,5 +4,5 @@
  * tsup config, its package.json check and the boundary test, so a new
  * contract is added in one place.
  */
-export declare const CONTRACT_ENTRIES: readonly ['forms', 'llms', 'slots', 'slot-content', 'site-cache', 'site-edit', 'website', 'color', 'fleet', 'sites', 'seo-pages', 'seo-meta', 'portfolio', 'voice', 'proposal-sitemap', 'error-page', 'schema-placeholders', 'sentences', 'knowledge', 'editorial-media', 'business-claims', 'outreach', 'page-titles', 'broadcast-layouts', 'publication-branding', 'public-url-host'];
+export declare const CONTRACT_ENTRIES: readonly ['forms', 'llms', 'slots', 'slot-content', 'site-cache', 'site-edit', 'website', 'color', 'fleet', 'sites', 'seo-pages', 'seo-meta', 'portfolio', 'voice', 'proposal-sitemap', 'error-page', 'schema-placeholders', 'sentences', 'knowledge', 'editorial-media', 'business-claims', 'outreach', 'page-titles', 'broadcast-layouts', 'publication-branding', 'public-url-host', 'inbox', 'funnels'];
 export type ContractEntry = (typeof CONTRACT_ENTRIES)[number];

package/dist/contracts/frame-ready.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The live-frame handshake, on its own so it stays small.
+ *
+ * A site-kit page framed by another origin posts FRAME_READY_MESSAGE to its
+ * embedder once it has painted (shared/frame.ts, announceFrameReady); a case
+ * study's device frames (the portfolio renderers) are the ones listening.
+ *
+ * This is a leaf module on purpose. shared/frame.ts runs in every page's
+ * analytics and layout graph, and `./portfolio` is a large module of case
+ * study rules: importing the message from there put all of it in every
+ * page's eager bundle. Single source of truth for the message: `./portfolio`
+ * re-exports it (so `@sonordev/contracts/portfolio` and
+ * `@sonordev/site-kit/portfolio/contract` still carry it) and shared/frame.ts
+ * imports it from here. Keep it free of other imports.
+ */
+/** The message a cross-origin-framed site-kit page posts to its embedder once it has painted. */
+export declare const FRAME_READY_MESSAGE: 'sonor:frame-ready';
+export interface FrameReadyMessage {
+    type: typeof FRAME_READY_MESSAGE;
+    v: 1;
+}
+/** True for a {@link FrameReadyMessage}, for the embedder's message handler. */
+export declare function isFrameReadyMessage(data: unknown): data is FrameReadyMessage;