@sonordev/site-kit 2.8.2 → 3.0.0

package/dist/sitemap/index.d.mts

@@ -1,4 +1,4 @@
-import { L as LLMsDataResponse } from '../types-J7Z_FqmV.mjs';
+import { L as LLMsDataResponse } from '../types-DhCAWUmd.mjs';
 import '../llms/contract.mjs';
 
 /**

package/dist/sitemap/index.d.ts

@@ -1,4 +1,4 @@
-import { L as LLMsDataResponse } from '../types-0NuBL1Gg.js';
+import { L as LLMsDataResponse } from '../types-xcP_owwn.js';
 import '../llms/contract.js';
 
 /**

package/dist/sitemap/index.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkMWE2HRPU_js = require('../chunk-MWE2HRPU.js');
+var chunkD5XTX5EB_js = require('../chunk-D5XTX5EB.js');
 var chunkJP5WGL75_js = require('../chunk-JP5WGL75.js');
 require('../chunk-ATG4FJY6.js');
 require('../chunk-ZSMWDLMK.js');
@@ -500,7 +500,7 @@ function createSitemap(config) {
           }
           if (config.optimizedLLMsTxt !== false) {
             try {
-              const writeResult = await chunkMWE2HRPU_js.writeLLMsTxtToPublic({
+              const writeResult = await chunkD5XTX5EB_js.writeLLMsTxtToPublic({
                 apiUrl,
                 apiKey,
                 full: config.optimizedLLMsFullTxt ?? false,

package/dist/sitemap/index.mjs

@@ -1,4 +1,4 @@
-import { writeLLMsTxtToPublic } from '../chunk-MNOVPHL6.mjs';
+import { writeLLMsTxtToPublic } from '../chunk-72MRAYAS.mjs';
 import { getSiteConfig } from '../chunk-B22WSN4L.mjs';
 import '../chunk-H23ZT2I2.mjs';
 import '../chunk-4XPGGLVP.mjs';

package/dist/slots/contract.d.mts

@@ -0,0 +1,83 @@
+/**
+ * @sonordev/site-kit/slots/contract — Managed Slots wire contract (v1)
+ *
+ * Single source of truth for the slot payload shape and content signing,
+ * shared by site-kit (verify side) and sonor-api (sign side) — same pattern
+ * as `@sonordev/site-kit/llms/contract`.
+ *
+ * Security model: every SlotContent is HMAC-signed with the project API key.
+ * site-kit verifies before rendering and falls back to the developer's static
+ * content on any mismatch, so platform-originated content carries provenance
+ * end to end. See docs/SITE-KIT-3.0-SPEC-SLOTS.md.
+ */
+/** Bump on breaking payload changes. */
+declare const SLOTS_CONTRACT_VERSION = 1;
+/**
+ * v1 supports plain text only — rendered as React text (escaped), never
+ * dangerouslySetInnerHTML. 'markdown' / 'rich' are reserved for a future
+ * contract version behind a real sanitizer decision.
+ */
+type SlotContentType = 'text';
+declare const SLOT_CONTENT_TYPES: readonly SlotContentType[];
+/** Hard cap on managed content length; longer payloads are rejected → fallback. */
+declare const SLOT_CONTENT_MAX_LENGTH = 10000;
+/** Slot ids: lowercase, page-scoped by convention, e.g. "home-hero-headline". */
+declare const SLOT_ID_PATTERN: RegExp;
+interface SlotContent {
+    slot_id: string;
+    type: SlotContentType;
+    /** The managed text. Rendered escaped — never as HTML. */
+    content: string;
+    /** Forward-compat: experiment/personalization variant that produced this content. */
+    variant_id?: string | null;
+    experiment_id?: string | null;
+    /** ISO timestamp of the last content change. */
+    updated_at?: string | null;
+    /** Hex HMAC-SHA256 over the canonical payload, keyed with the project API key. */
+    signature: string;
+}
+interface SlotResolveRequestEntry {
+    id: string;
+    /**
+     * The developer's current static text for this slot (when statically
+     * extractable). Stored as `fallback_text` on registration so the dashboard
+     * editor shows the live copy instead of a bare slot id. Never rendered by
+     * the API anywhere — display + drafting context only.
+     */
+    fallback?: string;
+    /**
+     * The route this slot renders on (e.g. "/" or "/pricing"). A static literal,
+     * never derived from the request — it feeds the Copy Evidence Loop's
+     * slot↔page mapping so Signal can judge the slot against its page's metrics.
+     */
+    page?: string;
+}
+interface SlotsResolveRequest {
+    contract_version: number;
+    slots: SlotResolveRequestEntry[];
+    /** Multi-site sub-dimension: normalized lowercase host (see CLAUDE.md "site" convention). */
+    site?: string;
+}
+interface SlotsResolveResponse {
+    contract_version: number;
+    slots: Record<string, SlotContent | null>;
+}
+declare function isValidSlotId(id: string): boolean;
+/**
+ * Canonical string both sides sign/verify. Exported separately from the HMAC
+ * helpers so an edge-runtime resolver can reproduce it with WebCrypto.
+ */
+declare function slotSigningPayload(content: Pick<SlotContent, 'slot_id' | 'type' | 'content'>): string;
+/**
+ * Sign slot content with the project API key (sonor-api side).
+ * Returns the hex HMAC-SHA256 signature.
+ */
+declare function signSlotContent(content: Pick<SlotContent, 'slot_id' | 'type' | 'content'>, apiKey: string): string;
+/**
+ * Verify a slot payload's shape + signature (site-kit side).
+ * Returns true only when the payload is well-formed, within limits, and the
+ * signature matches the project API key. Constant-time comparison.
+ */
+declare function verifySlotContent(content: unknown, apiKey: string): content is SlotContent;
+
+export { SLOTS_CONTRACT_VERSION, SLOT_CONTENT_MAX_LENGTH, SLOT_CONTENT_TYPES, SLOT_ID_PATTERN, type SlotContent, type SlotContentType, type SlotResolveRequestEntry, type SlotsResolveRequest, type SlotsResolveResponse, isValidSlotId, signSlotContent, slotSigningPayload, verifySlotContent };

package/dist/slots/contract.d.ts

@@ -0,0 +1,83 @@
+/**
+ * @sonordev/site-kit/slots/contract — Managed Slots wire contract (v1)
+ *
+ * Single source of truth for the slot payload shape and content signing,
+ * shared by site-kit (verify side) and sonor-api (sign side) — same pattern
+ * as `@sonordev/site-kit/llms/contract`.
+ *
+ * Security model: every SlotContent is HMAC-signed with the project API key.
+ * site-kit verifies before rendering and falls back to the developer's static
+ * content on any mismatch, so platform-originated content carries provenance
+ * end to end. See docs/SITE-KIT-3.0-SPEC-SLOTS.md.
+ */
+/** Bump on breaking payload changes. */
+declare const SLOTS_CONTRACT_VERSION = 1;
+/**
+ * v1 supports plain text only — rendered as React text (escaped), never
+ * dangerouslySetInnerHTML. 'markdown' / 'rich' are reserved for a future
+ * contract version behind a real sanitizer decision.
+ */
+type SlotContentType = 'text';
+declare const SLOT_CONTENT_TYPES: readonly SlotContentType[];
+/** Hard cap on managed content length; longer payloads are rejected → fallback. */
+declare const SLOT_CONTENT_MAX_LENGTH = 10000;
+/** Slot ids: lowercase, page-scoped by convention, e.g. "home-hero-headline". */
+declare const SLOT_ID_PATTERN: RegExp;
+interface SlotContent {
+    slot_id: string;
+    type: SlotContentType;
+    /** The managed text. Rendered escaped — never as HTML. */
+    content: string;
+    /** Forward-compat: experiment/personalization variant that produced this content. */
+    variant_id?: string | null;
+    experiment_id?: string | null;
+    /** ISO timestamp of the last content change. */
+    updated_at?: string | null;
+    /** Hex HMAC-SHA256 over the canonical payload, keyed with the project API key. */
+    signature: string;
+}
+interface SlotResolveRequestEntry {
+    id: string;
+    /**
+     * The developer's current static text for this slot (when statically
+     * extractable). Stored as `fallback_text` on registration so the dashboard
+     * editor shows the live copy instead of a bare slot id. Never rendered by
+     * the API anywhere — display + drafting context only.
+     */
+    fallback?: string;
+    /**
+     * The route this slot renders on (e.g. "/" or "/pricing"). A static literal,
+     * never derived from the request — it feeds the Copy Evidence Loop's
+     * slot↔page mapping so Signal can judge the slot against its page's metrics.
+     */
+    page?: string;
+}
+interface SlotsResolveRequest {
+    contract_version: number;
+    slots: SlotResolveRequestEntry[];
+    /** Multi-site sub-dimension: normalized lowercase host (see CLAUDE.md "site" convention). */
+    site?: string;
+}
+interface SlotsResolveResponse {
+    contract_version: number;
+    slots: Record<string, SlotContent | null>;
+}
+declare function isValidSlotId(id: string): boolean;
+/**
+ * Canonical string both sides sign/verify. Exported separately from the HMAC
+ * helpers so an edge-runtime resolver can reproduce it with WebCrypto.
+ */
+declare function slotSigningPayload(content: Pick<SlotContent, 'slot_id' | 'type' | 'content'>): string;
+/**
+ * Sign slot content with the project API key (sonor-api side).
+ * Returns the hex HMAC-SHA256 signature.
+ */
+declare function signSlotContent(content: Pick<SlotContent, 'slot_id' | 'type' | 'content'>, apiKey: string): string;
+/**
+ * Verify a slot payload's shape + signature (site-kit side).
+ * Returns true only when the payload is well-formed, within limits, and the
+ * signature matches the project API key. Constant-time comparison.
+ */
+declare function verifySlotContent(content: unknown, apiKey: string): content is SlotContent;
+
+export { SLOTS_CONTRACT_VERSION, SLOT_CONTENT_MAX_LENGTH, SLOT_CONTENT_TYPES, SLOT_ID_PATTERN, type SlotContent, type SlotContentType, type SlotResolveRequestEntry, type SlotsResolveRequest, type SlotsResolveResponse, isValidSlotId, signSlotContent, slotSigningPayload, verifySlotContent };

package/dist/slots/contract.js

@@ -0,0 +1,41 @@
+'use strict';
+
+var chunkYBKALLBH_js = require('../chunk-YBKALLBH.js');
+require('../chunk-ZSMWDLMK.js');
+
+
+
+Object.defineProperty(exports, "SLOTS_CONTRACT_VERSION", {
+  enumerable: true,
+  get: function () { return chunkYBKALLBH_js.SLOTS_CONTRACT_VERSION; }
+});
+Object.defineProperty(exports, "SLOT_CONTENT_MAX_LENGTH", {
+  enumerable: true,
+  get: function () { return chunkYBKALLBH_js.SLOT_CONTENT_MAX_LENGTH; }
+});
+Object.defineProperty(exports, "SLOT_CONTENT_TYPES", {
+  enumerable: true,
+  get: function () { return chunkYBKALLBH_js.SLOT_CONTENT_TYPES; }
+});
+Object.defineProperty(exports, "SLOT_ID_PATTERN", {
+  enumerable: true,
+  get: function () { return chunkYBKALLBH_js.SLOT_ID_PATTERN; }
+});
+Object.defineProperty(exports, "isValidSlotId", {
+  enumerable: true,
+  get: function () { return chunkYBKALLBH_js.isValidSlotId; }
+});
+Object.defineProperty(exports, "signSlotContent", {
+  enumerable: true,
+  get: function () { return chunkYBKALLBH_js.signSlotContent; }
+});
+Object.defineProperty(exports, "slotSigningPayload", {
+  enumerable: true,
+  get: function () { return chunkYBKALLBH_js.slotSigningPayload; }
+});
+Object.defineProperty(exports, "verifySlotContent", {
+  enumerable: true,
+  get: function () { return chunkYBKALLBH_js.verifySlotContent; }
+});
+//# sourceMappingURL=contract.js.map
+//# sourceMappingURL=contract.js.map

package/dist/slots/contract.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"contract.js"}

package/dist/slots/contract.mjs

@@ -0,0 +1,4 @@
+export { SLOTS_CONTRACT_VERSION, SLOT_CONTENT_MAX_LENGTH, SLOT_CONTENT_TYPES, SLOT_ID_PATTERN, isValidSlotId, signSlotContent, slotSigningPayload, verifySlotContent } from '../chunk-2FEQ6TYD.mjs';
+import '../chunk-4XPGGLVP.mjs';
+//# sourceMappingURL=contract.mjs.map
+//# sourceMappingURL=contract.mjs.map

package/dist/slots/contract.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"contract.mjs"}

package/dist/slots/index.d.mts

@@ -0,0 +1,104 @@
+import * as React from 'react';
+import { SlotContent } from './contract.mjs';
+export { SLOTS_CONTRACT_VERSION, SLOT_CONTENT_MAX_LENGTH, SLOT_CONTENT_TYPES, SLOT_ID_PATTERN, SlotContentType, SlotsResolveRequest, SlotsResolveResponse, isValidSlotId, signSlotContent, slotSigningPayload, verifySlotContent } from './contract.mjs';
+
+/**
+ * @sonordev/site-kit/slots — Server-Only Resolution
+ *
+ * SECURITY: uses the private SONOR_API_KEY. Import only in server code
+ * (RSC, route handlers, server actions).
+ *
+ * Design rules (see docs/SITE-KIT-3.0-SPEC-SLOTS.md):
+ * - Static-safe: plain fetch with ISR caching; never touches request state,
+ *   so pages using slots stay prerenderable.
+ * - Fallback-first: EVERY failure mode resolves to null (component renders
+ *   its children). Slots must never break a build or a page.
+ * - Signed: unsigned/tampered payloads are dropped with a warning.
+ */
+
+interface SlotResolveOptions {
+    /** Multi-site sub-dimension: normalized lowercase host. */
+    site?: string;
+    /** ISR revalidate window in seconds (default 300; instant updates come from the revalidate webhook). */
+    revalidate?: number;
+    /**
+     * The slot's current static text, reported on resolve so the dashboard
+     * editor shows the live copy. ManagedSlot supplies this automatically when
+     * its children are a plain string.
+     */
+    fallback?: string;
+    /**
+     * The route this slot renders on (static literal, e.g. "/pricing") — feeds
+     * the Copy Evidence Loop's slot↔page mapping.
+     */
+    page?: string;
+}
+/** Resolve one slot. Null on any failure → caller renders fallback. */
+declare function getSlot(id: string, options?: SlotResolveOptions): Promise<SlotContent | null>;
+/**
+ * Batch resolution for layout-level prefetch. v1 fans out to the per-slot
+ * cached resolver (one wire shape, no behavioral difference); the batch
+ * endpoint exists in the contract so this can become a single request
+ * without a wire change.
+ */
+declare function resolveSlots(ids: string[], options?: SlotResolveOptions): Promise<Record<string, SlotContent | null>>;
+
+interface ManagedSlotProps extends Omit<SlotResolveOptions, 'fallback'> {
+    /** Stable slot id, lowercase, page-scoped by convention (e.g. "home-hero-headline"). */
+    id: string;
+    /**
+     * The developer-owned static content — exactly what the page ships without
+     * Sonor. Rendered verbatim whenever no managed content resolves.
+     */
+    children: React.ReactNode;
+}
+/**
+ * ManagedSlot — a Sonor-managed text region inside an element the developer
+ * still owns. Renders a fragment: no wrapper tag, no className opinion — put
+ * it INSIDE your element and keep your markup.
+ *
+ * Server component. Resolution is static-safe (ISR-cached fetch, no request
+ * access) and fallback-first: any failure renders the children. Managed
+ * content is signature-verified and rendered as escaped text, never HTML.
+ *
+ * @example
+ * ```tsx
+ * <h1 className="hero-title">
+ *   <ManagedSlot id="home-hero-headline" page="/">
+ *     New Homes in Cincinnati & Northern Kentucky
+ *   </ManagedSlot>
+ * </h1>
+ * ```
+ */
+declare function ManagedSlot({ id, children, site, revalidate, page, }: ManagedSlotProps): Promise<React.ReactElement>;
+
+/**
+ * @sonordev/site-kit/slots — On-demand Revalidation
+ *
+ * Sonor calls this when slot content changes (owner edit or approved Signal
+ * proposal) so the change is live in seconds instead of at the next ISR
+ * window. Mirrors the llms revalidation handler pattern.
+ *
+ * @example
+ * ```ts
+ * // app/api/revalidate-slots/route.ts
+ * import { createSlotsRevalidateHandler } from '@sonordev/site-kit/slots'
+ *
+ * export const POST = createSlotsRevalidateHandler(process.env.REVALIDATION_SECRET!)
+ * ```
+ */
+type RevalidateTagFn = (tag: string) => void;
+declare const SLOTS_CACHE_TAG = "sonor-slots";
+/**
+ * Create a POST handler that busts the slots data cache.
+ * Protected by a shared secret. (POST handlers are never statically
+ * prerendered, so reading the request here is fine.)
+ */
+declare function createSlotsRevalidateHandler(secret: string, options?: {
+    /** Additional cache tags to revalidate alongside slots. */
+    extraTags?: string[];
+    /** Custom revalidateTag (for testing or frameworks other than Next.js). */
+    revalidateTag?: RevalidateTagFn;
+}): (request: Request) => Promise<Response>;
+
+export { ManagedSlot, type ManagedSlotProps, SLOTS_CACHE_TAG, SlotContent, type SlotResolveOptions, createSlotsRevalidateHandler, ManagedSlot as default, getSlot, resolveSlots };

package/dist/slots/index.d.ts

@@ -0,0 +1,104 @@
+import * as React from 'react';
+import { SlotContent } from './contract.js';
+export { SLOTS_CONTRACT_VERSION, SLOT_CONTENT_MAX_LENGTH, SLOT_CONTENT_TYPES, SLOT_ID_PATTERN, SlotContentType, SlotsResolveRequest, SlotsResolveResponse, isValidSlotId, signSlotContent, slotSigningPayload, verifySlotContent } from './contract.js';
+
+/**
+ * @sonordev/site-kit/slots — Server-Only Resolution
+ *
+ * SECURITY: uses the private SONOR_API_KEY. Import only in server code
+ * (RSC, route handlers, server actions).
+ *
+ * Design rules (see docs/SITE-KIT-3.0-SPEC-SLOTS.md):
+ * - Static-safe: plain fetch with ISR caching; never touches request state,
+ *   so pages using slots stay prerenderable.
+ * - Fallback-first: EVERY failure mode resolves to null (component renders
+ *   its children). Slots must never break a build or a page.
+ * - Signed: unsigned/tampered payloads are dropped with a warning.
+ */
+
+interface SlotResolveOptions {
+    /** Multi-site sub-dimension: normalized lowercase host. */
+    site?: string;
+    /** ISR revalidate window in seconds (default 300; instant updates come from the revalidate webhook). */
+    revalidate?: number;
+    /**
+     * The slot's current static text, reported on resolve so the dashboard
+     * editor shows the live copy. ManagedSlot supplies this automatically when
+     * its children are a plain string.
+     */
+    fallback?: string;
+    /**
+     * The route this slot renders on (static literal, e.g. "/pricing") — feeds
+     * the Copy Evidence Loop's slot↔page mapping.
+     */
+    page?: string;
+}
+/** Resolve one slot. Null on any failure → caller renders fallback. */
+declare function getSlot(id: string, options?: SlotResolveOptions): Promise<SlotContent | null>;
+/**
+ * Batch resolution for layout-level prefetch. v1 fans out to the per-slot
+ * cached resolver (one wire shape, no behavioral difference); the batch
+ * endpoint exists in the contract so this can become a single request
+ * without a wire change.
+ */
+declare function resolveSlots(ids: string[], options?: SlotResolveOptions): Promise<Record<string, SlotContent | null>>;
+
+interface ManagedSlotProps extends Omit<SlotResolveOptions, 'fallback'> {
+    /** Stable slot id, lowercase, page-scoped by convention (e.g. "home-hero-headline"). */
+    id: string;
+    /**
+     * The developer-owned static content — exactly what the page ships without
+     * Sonor. Rendered verbatim whenever no managed content resolves.
+     */
+    children: React.ReactNode;
+}
+/**
+ * ManagedSlot — a Sonor-managed text region inside an element the developer
+ * still owns. Renders a fragment: no wrapper tag, no className opinion — put
+ * it INSIDE your element and keep your markup.
+ *
+ * Server component. Resolution is static-safe (ISR-cached fetch, no request
+ * access) and fallback-first: any failure renders the children. Managed
+ * content is signature-verified and rendered as escaped text, never HTML.
+ *
+ * @example
+ * ```tsx
+ * <h1 className="hero-title">
+ *   <ManagedSlot id="home-hero-headline" page="/">
+ *     New Homes in Cincinnati & Northern Kentucky
+ *   </ManagedSlot>
+ * </h1>
+ * ```
+ */
+declare function ManagedSlot({ id, children, site, revalidate, page, }: ManagedSlotProps): Promise<React.ReactElement>;
+
+/**
+ * @sonordev/site-kit/slots — On-demand Revalidation
+ *
+ * Sonor calls this when slot content changes (owner edit or approved Signal
+ * proposal) so the change is live in seconds instead of at the next ISR
+ * window. Mirrors the llms revalidation handler pattern.
+ *
+ * @example
+ * ```ts
+ * // app/api/revalidate-slots/route.ts
+ * import { createSlotsRevalidateHandler } from '@sonordev/site-kit/slots'
+ *
+ * export const POST = createSlotsRevalidateHandler(process.env.REVALIDATION_SECRET!)
+ * ```
+ */
+type RevalidateTagFn = (tag: string) => void;
+declare const SLOTS_CACHE_TAG = "sonor-slots";
+/**
+ * Create a POST handler that busts the slots data cache.
+ * Protected by a shared secret. (POST handlers are never statically
+ * prerendered, so reading the request here is fine.)
+ */
+declare function createSlotsRevalidateHandler(secret: string, options?: {
+    /** Additional cache tags to revalidate alongside slots. */
+    extraTags?: string[];
+    /** Custom revalidateTag (for testing or frameworks other than Next.js). */
+    revalidateTag?: RevalidateTagFn;
+}): (request: Request) => Promise<Response>;
+
+export { ManagedSlot, type ManagedSlotProps, SLOTS_CACHE_TAG, SlotContent, type SlotResolveOptions, createSlotsRevalidateHandler, ManagedSlot as default, getSlot, resolveSlots };

package/dist/slots/index.js

@@ -0,0 +1,186 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var chunkYBKALLBH_js = require('../chunk-YBKALLBH.js');
+require('../chunk-ZSMWDLMK.js');
+require('server-only');
+var react = require('react');
+var jsxRuntime = require('react/jsx-runtime');
+
+function getApiConfig() {
+  const apiUrl = process.env.SONOR_API_URL || "https://api.sonor.io";
+  const apiKey = process.env.SONOR_API_KEY || "";
+  if (!apiKey) return null;
+  return { apiUrl, apiKey };
+}
+var warned = /* @__PURE__ */ new Set();
+function warnOnce(key, message) {
+  if (warned.has(key)) return;
+  warned.add(key);
+  console.warn(message);
+}
+async function fetchSlot(id, site, revalidate, fallback, page) {
+  if (!chunkYBKALLBH_js.isValidSlotId(id)) {
+    warnOnce(`id:${id}`, `[site-kit/slots] Invalid slot id "${id}" (expected ${"`"}[a-z0-9-_.:]${"`"}, lowercase) \u2014 rendering fallback`);
+    return null;
+  }
+  const config = getApiConfig();
+  if (!config) {
+    warnOnce("no-key", "[site-kit/slots] SONOR_API_KEY is not set \u2014 all slots render their fallbacks");
+    return null;
+  }
+  try {
+    const response = await fetch(`${config.apiUrl}/api/public/slots/resolve`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "x-api-key": config.apiKey
+      },
+      body: JSON.stringify({
+        contract_version: chunkYBKALLBH_js.SLOTS_CONTRACT_VERSION,
+        slots: [
+          {
+            id,
+            ...fallback ? { fallback: fallback.slice(0, chunkYBKALLBH_js.SLOT_CONTENT_MAX_LENGTH) } : {},
+            ...page ? { page } : {}
+          }
+        ],
+        ...site ? { site } : {}
+      }),
+      next: { revalidate, tags: ["sonor-slots"] }
+    });
+    if (!response.ok) {
+      if (response.status !== 404) {
+        warnOnce(
+          `http:${response.status}`,
+          `[site-kit/slots] Resolve returned ${response.status} \u2014 rendering fallbacks`
+        );
+      }
+      await response.text().catch(() => {
+      });
+      return null;
+    }
+    const data = await response.json();
+    const payload = data?.slots?.[id];
+    if (!payload) return null;
+    if (!chunkYBKALLBH_js.verifySlotContent(payload, config.apiKey)) {
+      warnOnce(
+        `sig:${id}`,
+        `[site-kit/slots] Dropped slot "${id}": payload failed shape/signature verification \u2014 rendering fallback`
+      );
+      return null;
+    }
+    return payload;
+  } catch (err) {
+    warnOnce("network", `[site-kit/slots] Resolve failed (${err?.message}) \u2014 rendering fallbacks`);
+    return null;
+  }
+}
+var getSlotCached = react.cache(
+  (id, site, revalidate, fallback, page) => fetchSlot(id, site, revalidate, fallback, page)
+);
+function getSlot(id, options = {}) {
+  const fallback = options.fallback?.trim() || void 0;
+  const page = options.page?.trim() || void 0;
+  return getSlotCached(id, options.site, options.revalidate ?? 300, fallback, page);
+}
+async function resolveSlots(ids, options = {}) {
+  const entries = await Promise.all(
+    ids.map(async (id) => [id, await getSlot(id, options)])
+  );
+  return Object.fromEntries(entries);
+}
+async function ManagedSlot({
+  id,
+  children,
+  site,
+  revalidate,
+  page
+}) {
+  const fallback = typeof children === "string" ? children : void 0;
+  const managed = await getSlot(id, { site, revalidate, fallback, page });
+  return /* @__PURE__ */ jsxRuntime.jsx(jsxRuntime.Fragment, { children: managed ? managed.content : children });
+}
+var ManagedSlot_default = ManagedSlot;
+
+// src/slots/revalidate.ts
+var SLOTS_CACHE_TAG = "sonor-slots";
+function createSlotsRevalidateHandler(secret, options) {
+  return async function POST(request) {
+    try {
+      const authHeader = request.headers.get("authorization");
+      const url = new URL(request.url);
+      const tokenFromQuery = url.searchParams.get("secret");
+      const token = authHeader?.replace(/^Bearer\s+/i, "") || tokenFromQuery;
+      if (!secret || token !== secret) {
+        return new Response(JSON.stringify({ error: "Invalid secret" }), {
+          status: 401,
+          headers: { "Content-Type": "application/json" }
+        });
+      }
+      let revalidateTag;
+      if (options?.revalidateTag) {
+        revalidateTag = options.revalidateTag;
+      } else {
+        const nextCache = await import('next/cache');
+        revalidateTag = nextCache.revalidateTag;
+      }
+      const tags = [SLOTS_CACHE_TAG, ...options?.extraTags || []];
+      for (const tag of tags) {
+        revalidateTag(tag);
+      }
+      return new Response(JSON.stringify({ revalidated: true, tags }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" }
+      });
+    } catch (err) {
+      console.error("[site-kit/slots] Revalidation failed:", err);
+      return new Response(JSON.stringify({ error: "Revalidation failed" }), {
+        status: 500,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+  };
+}
+
+Object.defineProperty(exports, "SLOTS_CONTRACT_VERSION", {
+  enumerable: true,
+  get: function () { return chunkYBKALLBH_js.SLOTS_CONTRACT_VERSION; }
+});
+Object.defineProperty(exports, "SLOT_CONTENT_MAX_LENGTH", {
+  enumerable: true,
+  get: function () { return chunkYBKALLBH_js.SLOT_CONTENT_MAX_LENGTH; }
+});
+Object.defineProperty(exports, "SLOT_CONTENT_TYPES", {
+  enumerable: true,
+  get: function () { return chunkYBKALLBH_js.SLOT_CONTENT_TYPES; }
+});
+Object.defineProperty(exports, "SLOT_ID_PATTERN", {
+  enumerable: true,
+  get: function () { return chunkYBKALLBH_js.SLOT_ID_PATTERN; }
+});
+Object.defineProperty(exports, "isValidSlotId", {
+  enumerable: true,
+  get: function () { return chunkYBKALLBH_js.isValidSlotId; }
+});
+Object.defineProperty(exports, "signSlotContent", {
+  enumerable: true,
+  get: function () { return chunkYBKALLBH_js.signSlotContent; }
+});
+Object.defineProperty(exports, "slotSigningPayload", {
+  enumerable: true,
+  get: function () { return chunkYBKALLBH_js.slotSigningPayload; }
+});
+Object.defineProperty(exports, "verifySlotContent", {
+  enumerable: true,
+  get: function () { return chunkYBKALLBH_js.verifySlotContent; }
+});
+exports.ManagedSlot = ManagedSlot;
+exports.SLOTS_CACHE_TAG = SLOTS_CACHE_TAG;
+exports.createSlotsRevalidateHandler = createSlotsRevalidateHandler;
+exports.default = ManagedSlot_default;
+exports.getSlot = getSlot;
+exports.resolveSlots = resolveSlots;
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map