@sonordev/site-kit 3.0.4 → 3.2.0

package/dist/fleet/index.d.mts

@@ -0,0 +1,89 @@
+import { FleetModule, FleetHeartbeatSource } from './contract.mjs';
+export { FLEET_CONTRACT_VERSION, FLEET_MODULES, FLEET_MODULES_MAX, FLEET_SITE_MAX_LENGTH, FLEET_VERSION_MAX_LENGTH, FLEET_VERSION_PATTERN, FleetHeartbeatPayload, FleetHeartbeatResponse, buildFleetHeartbeatPayload, isFleetModule, normalizeFleetModules, normalizeFleetSite, sanitizeFleetVersion } from './contract.mjs';
+
+/**
+ * @sonordev/site-kit/fleet — FleetHeartbeat
+ *
+ * A childless, effect-only client component that reports this site's build
+ * fingerprint (kit version, Next.js version, active modules, host) to Sonor
+ * exactly once per browser session. It exists so the platform can answer
+ * "which version / modules / key state is each site running" without shelling
+ * into every client repo.
+ *
+ * It is mounted as a deferred, CHILDLESS SIBLING — never a wrapper — by
+ * SiteKitClientProviders, behind the same idle/first-interaction gate as
+ * Analytics and Engage, so it never enters the critical hydration path (see
+ * CLAUDE.md "the page must server-render"). It renders null and carries no
+ * visitor data.
+ */
+
+interface FleetHeartbeatProps {
+    /** Sonor API origin. Falls back to `window.__SITE_KIT_API_URL__` then api.sonor.io. */
+    apiUrl?: string;
+    /** Project API key. Falls back to `window.__SITE_KIT_API_KEY__`. */
+    apiKey?: string;
+    /** Host for the multi-site sub-dimension. Falls back to `__SITE_KIT_SITE__` then location.host. */
+    site?: string | null;
+    /** Client-observable active modules (SiteKitClientProviders passes the enabled set). */
+    modules?: FleetModule[];
+    /** Installed Next.js version if known; otherwise best-effort runtime detection. */
+    nextVersion?: string | null;
+    /**
+     * Self-defer to idle / first interaction. Default true so standalone use is
+     * safe. SiteKitClientProviders already gates the mount and passes false.
+     */
+    defer?: boolean;
+    /** Send at most once per browser session per (version, host). Default true. */
+    oncePerSession?: boolean;
+    debug?: boolean;
+}
+declare function FleetHeartbeat({ apiUrl, apiKey, site, modules, nextVersion, defer, oncePerSession, debug, }: FleetHeartbeatProps): null;
+
+/**
+ * @sonordev/site-kit/fleet — heartbeat sender (single source of truth for the POST)
+ *
+ * One place that turns fleet inputs into a validated payload and ships it to
+ * `/api/public/fleet/heartbeat`. Used by BOTH the client component
+ * (FleetHeartbeat) and any build-time caller, so the send path never forks.
+ *
+ * It routes through the canonical `sonorFetch` transport, which already stamps
+ * the x-sitekit-version header, attaches x-api-key, and honors the auth
+ * circuit breaker — a site on a stale/canceled key will not spam the API.
+ */
+
+/** Canonical ingest path — resolved against the site's Sonor API origin. */
+declare const FLEET_HEARTBEAT_PATH = "/api/public/fleet/heartbeat";
+interface SendFleetHeartbeatOptions {
+    /** Sonor API origin (e.g. https://api.sonor.io). Trailing slash tolerated. */
+    apiUrl: string;
+    /** Project API key — scopes the request; the project is resolved server-side. */
+    apiKey: string;
+    /** Client-observable active modules (validated/deduped by the contract). */
+    modules?: FleetModule[] | string[];
+    /** Normalized host for the multi-site sub-dimension (server re-normalizes). */
+    site?: string | null;
+    /** Installed Next.js version, if the caller can resolve it. */
+    nextVersion?: string | null;
+    /** 'client' (runtime boot) or 'build' (CI). Default 'client'. */
+    source?: FleetHeartbeatSource;
+    /** Override the reported kit version. Defaults to the runtime SITE_KIT_VERSION. */
+    kitVersion?: string;
+    /** Log one info line with the result. Never logs at error level. */
+    debug?: boolean;
+}
+/**
+ * Best-effort runtime detection of the host Next.js version. Unreliable by
+ * design — Next does not expose its version consistently across app/pages
+ * router — so it returns null unless a site injects `__SITE_KIT_NEXT_VERSION__`
+ * or `window.next.version` is present. Build-time callers should pass
+ * `nextVersion` explicitly (resolvable from `next/package.json`).
+ */
+declare function detectNextVersion(): string | null;
+/**
+ * Fire one heartbeat. Fire-and-forget by contract: it never throws — a
+ * telemetry POST must never break a visitor's page or a site's build. Returns
+ * true only when the POST was accepted (2xx).
+ */
+declare function sendFleetHeartbeat(opts: SendFleetHeartbeatOptions): Promise<boolean>;
+
+export { FLEET_HEARTBEAT_PATH, FleetHeartbeat, type FleetHeartbeatProps, FleetHeartbeatSource, FleetModule, type SendFleetHeartbeatOptions, detectNextVersion, sendFleetHeartbeat };

package/dist/fleet/index.d.ts

@@ -0,0 +1,89 @@
+import { FleetModule, FleetHeartbeatSource } from './contract.js';
+export { FLEET_CONTRACT_VERSION, FLEET_MODULES, FLEET_MODULES_MAX, FLEET_SITE_MAX_LENGTH, FLEET_VERSION_MAX_LENGTH, FLEET_VERSION_PATTERN, FleetHeartbeatPayload, FleetHeartbeatResponse, buildFleetHeartbeatPayload, isFleetModule, normalizeFleetModules, normalizeFleetSite, sanitizeFleetVersion } from './contract.js';
+
+/**
+ * @sonordev/site-kit/fleet — FleetHeartbeat
+ *
+ * A childless, effect-only client component that reports this site's build
+ * fingerprint (kit version, Next.js version, active modules, host) to Sonor
+ * exactly once per browser session. It exists so the platform can answer
+ * "which version / modules / key state is each site running" without shelling
+ * into every client repo.
+ *
+ * It is mounted as a deferred, CHILDLESS SIBLING — never a wrapper — by
+ * SiteKitClientProviders, behind the same idle/first-interaction gate as
+ * Analytics and Engage, so it never enters the critical hydration path (see
+ * CLAUDE.md "the page must server-render"). It renders null and carries no
+ * visitor data.
+ */
+
+interface FleetHeartbeatProps {
+    /** Sonor API origin. Falls back to `window.__SITE_KIT_API_URL__` then api.sonor.io. */
+    apiUrl?: string;
+    /** Project API key. Falls back to `window.__SITE_KIT_API_KEY__`. */
+    apiKey?: string;
+    /** Host for the multi-site sub-dimension. Falls back to `__SITE_KIT_SITE__` then location.host. */
+    site?: string | null;
+    /** Client-observable active modules (SiteKitClientProviders passes the enabled set). */
+    modules?: FleetModule[];
+    /** Installed Next.js version if known; otherwise best-effort runtime detection. */
+    nextVersion?: string | null;
+    /**
+     * Self-defer to idle / first interaction. Default true so standalone use is
+     * safe. SiteKitClientProviders already gates the mount and passes false.
+     */
+    defer?: boolean;
+    /** Send at most once per browser session per (version, host). Default true. */
+    oncePerSession?: boolean;
+    debug?: boolean;
+}
+declare function FleetHeartbeat({ apiUrl, apiKey, site, modules, nextVersion, defer, oncePerSession, debug, }: FleetHeartbeatProps): null;
+
+/**
+ * @sonordev/site-kit/fleet — heartbeat sender (single source of truth for the POST)
+ *
+ * One place that turns fleet inputs into a validated payload and ships it to
+ * `/api/public/fleet/heartbeat`. Used by BOTH the client component
+ * (FleetHeartbeat) and any build-time caller, so the send path never forks.
+ *
+ * It routes through the canonical `sonorFetch` transport, which already stamps
+ * the x-sitekit-version header, attaches x-api-key, and honors the auth
+ * circuit breaker — a site on a stale/canceled key will not spam the API.
+ */
+
+/** Canonical ingest path — resolved against the site's Sonor API origin. */
+declare const FLEET_HEARTBEAT_PATH = "/api/public/fleet/heartbeat";
+interface SendFleetHeartbeatOptions {
+    /** Sonor API origin (e.g. https://api.sonor.io). Trailing slash tolerated. */
+    apiUrl: string;
+    /** Project API key — scopes the request; the project is resolved server-side. */
+    apiKey: string;
+    /** Client-observable active modules (validated/deduped by the contract). */
+    modules?: FleetModule[] | string[];
+    /** Normalized host for the multi-site sub-dimension (server re-normalizes). */
+    site?: string | null;
+    /** Installed Next.js version, if the caller can resolve it. */
+    nextVersion?: string | null;
+    /** 'client' (runtime boot) or 'build' (CI). Default 'client'. */
+    source?: FleetHeartbeatSource;
+    /** Override the reported kit version. Defaults to the runtime SITE_KIT_VERSION. */
+    kitVersion?: string;
+    /** Log one info line with the result. Never logs at error level. */
+    debug?: boolean;
+}
+/**
+ * Best-effort runtime detection of the host Next.js version. Unreliable by
+ * design — Next does not expose its version consistently across app/pages
+ * router — so it returns null unless a site injects `__SITE_KIT_NEXT_VERSION__`
+ * or `window.next.version` is present. Build-time callers should pass
+ * `nextVersion` explicitly (resolvable from `next/package.json`).
+ */
+declare function detectNextVersion(): string | null;
+/**
+ * Fire one heartbeat. Fire-and-forget by contract: it never throws — a
+ * telemetry POST must never break a visitor's page or a site's build. Returns
+ * true only when the POST was accepted (2xx).
+ */
+declare function sendFleetHeartbeat(opts: SendFleetHeartbeatOptions): Promise<boolean>;
+
+export { FLEET_HEARTBEAT_PATH, FleetHeartbeat, type FleetHeartbeatProps, FleetHeartbeatSource, FleetModule, type SendFleetHeartbeatOptions, detectNextVersion, sendFleetHeartbeat };

package/dist/fleet/index.js

@@ -0,0 +1,74 @@
+'use client';
+'use strict';
+
+var chunk5OWZUNNE_js = require('../chunk-5OWZUNNE.js');
+require('../chunk-HGNSJXWT.js');
+var chunkQ2NBD54V_js = require('../chunk-Q2NBD54V.js');
+require('../chunk-EAASMIWX.js');
+require('../chunk-WRZQS7O4.js');
+require('../chunk-ZSMWDLMK.js');
+
+
+
+Object.defineProperty(exports, "FLEET_HEARTBEAT_PATH", {
+  enumerable: true,
+  get: function () { return chunk5OWZUNNE_js.FLEET_HEARTBEAT_PATH; }
+});
+Object.defineProperty(exports, "FleetHeartbeat", {
+  enumerable: true,
+  get: function () { return chunk5OWZUNNE_js.FleetHeartbeat; }
+});
+Object.defineProperty(exports, "detectNextVersion", {
+  enumerable: true,
+  get: function () { return chunk5OWZUNNE_js.detectNextVersion; }
+});
+Object.defineProperty(exports, "sendFleetHeartbeat", {
+  enumerable: true,
+  get: function () { return chunk5OWZUNNE_js.sendFleetHeartbeat; }
+});
+Object.defineProperty(exports, "FLEET_CONTRACT_VERSION", {
+  enumerable: true,
+  get: function () { return chunkQ2NBD54V_js.FLEET_CONTRACT_VERSION; }
+});
+Object.defineProperty(exports, "FLEET_MODULES", {
+  enumerable: true,
+  get: function () { return chunkQ2NBD54V_js.FLEET_MODULES; }
+});
+Object.defineProperty(exports, "FLEET_MODULES_MAX", {
+  enumerable: true,
+  get: function () { return chunkQ2NBD54V_js.FLEET_MODULES_MAX; }
+});
+Object.defineProperty(exports, "FLEET_SITE_MAX_LENGTH", {
+  enumerable: true,
+  get: function () { return chunkQ2NBD54V_js.FLEET_SITE_MAX_LENGTH; }
+});
+Object.defineProperty(exports, "FLEET_VERSION_MAX_LENGTH", {
+  enumerable: true,
+  get: function () { return chunkQ2NBD54V_js.FLEET_VERSION_MAX_LENGTH; }
+});
+Object.defineProperty(exports, "FLEET_VERSION_PATTERN", {
+  enumerable: true,
+  get: function () { return chunkQ2NBD54V_js.FLEET_VERSION_PATTERN; }
+});
+Object.defineProperty(exports, "buildFleetHeartbeatPayload", {
+  enumerable: true,
+  get: function () { return chunkQ2NBD54V_js.buildFleetHeartbeatPayload; }
+});
+Object.defineProperty(exports, "isFleetModule", {
+  enumerable: true,
+  get: function () { return chunkQ2NBD54V_js.isFleetModule; }
+});
+Object.defineProperty(exports, "normalizeFleetModules", {
+  enumerable: true,
+  get: function () { return chunkQ2NBD54V_js.normalizeFleetModules; }
+});
+Object.defineProperty(exports, "normalizeFleetSite", {
+  enumerable: true,
+  get: function () { return chunkQ2NBD54V_js.normalizeFleetSite; }
+});
+Object.defineProperty(exports, "sanitizeFleetVersion", {
+  enumerable: true,
+  get: function () { return chunkQ2NBD54V_js.sanitizeFleetVersion; }
+});
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/fleet/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}

package/dist/fleet/index.mjs

@@ -0,0 +1,9 @@
+'use client';
+export { FLEET_HEARTBEAT_PATH, FleetHeartbeat, detectNextVersion, sendFleetHeartbeat } from '../chunk-NDHFU4HV.mjs';
+import '../chunk-ZVBLXXNJ.mjs';
+export { FLEET_CONTRACT_VERSION, FLEET_MODULES, FLEET_MODULES_MAX, FLEET_SITE_MAX_LENGTH, FLEET_VERSION_MAX_LENGTH, FLEET_VERSION_PATTERN, buildFleetHeartbeatPayload, isFleetModule, normalizeFleetModules, normalizeFleetSite, sanitizeFleetVersion } from '../chunk-ZPLN537Q.mjs';
+import '../chunk-LZSCCJ4O.mjs';
+import '../chunk-SN2O72UF.mjs';
+import '../chunk-4XPGGLVP.mjs';
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/dist/fleet/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.mjs"}

package/dist/forms/contract.d.mts

@@ -0,0 +1,69 @@
+/**
+ * @sonordev/site-kit/forms/contract — managed-form honeypot policy (v1)
+ *
+ * Single source of truth for the honeypot trap-field naming + server-side
+ * detection policy, shared by the client (site-kit emits the trap field) and
+ * the server (sonor-api names the trap in the form config it returns AND
+ * detects hits on intake). Same pattern as the other site-kit contracts:
+ * sonor-api keeps a byte-identical inline mirror
+ * (`src/modules/forms/honeypot-contract.ts`) guarded by the shared drift-test
+ * vectors in `contract.test.ts`.
+ *
+ * The default field name (`_sk_hp_url`) is deliberately obscure: a common name
+ * like "website" collides with real form fields and flags genuine submissions
+ * as spam, so generic names are only trusted when they DON'T match a real
+ * field of the form (see `resolveHoneypotFieldNames`).
+ */
+/** Bump on breaking changes to the honeypot policy. */
+declare const FORMS_HONEYPOT_CONTRACT_VERSION: 1;
+/**
+ * Default honeypot field name emitted by site-kit and used by the server as the
+ * fallback trap name when a form has no explicitly configured `honeypot_field`.
+ * Deliberately obscure to avoid colliding with real form fields.
+ */
+declare const DEFAULT_HONEYPOT_FIELD = "_sk_hp_url";
+/**
+ * Generic trap names the server also watches on intake — the canonical default
+ * plus legacy names still emitted by older deployed forms. Each is only trusted
+ * when it doesn't collide with a real configured field of the form.
+ */
+declare const GENERIC_HONEYPOT_FIELDS: readonly string[];
+/**
+ * Build the set of field names the server treats as honeypot traps for one form.
+ * Generic names that collide with a real field slug are dropped (or every real
+ * lead using that field would be flagged); the form's dedicated
+ * `honeypot_field` is always honored. Returns an empty set when disabled.
+ */
+declare function resolveHoneypotFieldNames(opts: {
+    enabled: boolean;
+    formHoneypotField?: string | null;
+    realFieldSlugs?: Iterable<string>;
+}): Set<string>;
+/**
+ * True when any watched trap field carries a non-empty value — the marker of an
+ * automated submission (real users never see or fill the trap).
+ */
+declare function isHoneypotTriggered(data: Record<string, unknown> | null | undefined, fieldNames: Iterable<string>): boolean;
+/**
+ * Agent-native contract: JSON Schema for the honeypot slice of the public form
+ * config, so services and agents can validate it mechanically.
+ */
+declare const HONEYPOT_CONFIG_JSON_SCHEMA: {
+    readonly $schema: "http://json-schema.org/draft-07/schema#";
+    readonly $id: "https://sonor.io/schemas/honeypot-config.v1.json";
+    readonly title: "HoneypotConfig";
+    readonly description: "The honeypot slice of a public managed-form config.";
+    readonly type: "object";
+    readonly properties: {
+        readonly honeypot_enabled: {
+            readonly type: "boolean";
+        };
+        readonly honeypot_field: {
+            readonly description: "Trap field name; defaults to \"_sk_hp_url\" when unset.";
+            readonly type: "string";
+        };
+    };
+    readonly additionalProperties: true;
+};
+
+export { DEFAULT_HONEYPOT_FIELD, FORMS_HONEYPOT_CONTRACT_VERSION, GENERIC_HONEYPOT_FIELDS, HONEYPOT_CONFIG_JSON_SCHEMA, isHoneypotTriggered, resolveHoneypotFieldNames };

package/dist/forms/contract.d.ts

@@ -0,0 +1,69 @@
+/**
+ * @sonordev/site-kit/forms/contract — managed-form honeypot policy (v1)
+ *
+ * Single source of truth for the honeypot trap-field naming + server-side
+ * detection policy, shared by the client (site-kit emits the trap field) and
+ * the server (sonor-api names the trap in the form config it returns AND
+ * detects hits on intake). Same pattern as the other site-kit contracts:
+ * sonor-api keeps a byte-identical inline mirror
+ * (`src/modules/forms/honeypot-contract.ts`) guarded by the shared drift-test
+ * vectors in `contract.test.ts`.
+ *
+ * The default field name (`_sk_hp_url`) is deliberately obscure: a common name
+ * like "website" collides with real form fields and flags genuine submissions
+ * as spam, so generic names are only trusted when they DON'T match a real
+ * field of the form (see `resolveHoneypotFieldNames`).
+ */
+/** Bump on breaking changes to the honeypot policy. */
+declare const FORMS_HONEYPOT_CONTRACT_VERSION: 1;
+/**
+ * Default honeypot field name emitted by site-kit and used by the server as the
+ * fallback trap name when a form has no explicitly configured `honeypot_field`.
+ * Deliberately obscure to avoid colliding with real form fields.
+ */
+declare const DEFAULT_HONEYPOT_FIELD = "_sk_hp_url";
+/**
+ * Generic trap names the server also watches on intake — the canonical default
+ * plus legacy names still emitted by older deployed forms. Each is only trusted
+ * when it doesn't collide with a real configured field of the form.
+ */
+declare const GENERIC_HONEYPOT_FIELDS: readonly string[];
+/**
+ * Build the set of field names the server treats as honeypot traps for one form.
+ * Generic names that collide with a real field slug are dropped (or every real
+ * lead using that field would be flagged); the form's dedicated
+ * `honeypot_field` is always honored. Returns an empty set when disabled.
+ */
+declare function resolveHoneypotFieldNames(opts: {
+    enabled: boolean;
+    formHoneypotField?: string | null;
+    realFieldSlugs?: Iterable<string>;
+}): Set<string>;
+/**
+ * True when any watched trap field carries a non-empty value — the marker of an
+ * automated submission (real users never see or fill the trap).
+ */
+declare function isHoneypotTriggered(data: Record<string, unknown> | null | undefined, fieldNames: Iterable<string>): boolean;
+/**
+ * Agent-native contract: JSON Schema for the honeypot slice of the public form
+ * config, so services and agents can validate it mechanically.
+ */
+declare const HONEYPOT_CONFIG_JSON_SCHEMA: {
+    readonly $schema: "http://json-schema.org/draft-07/schema#";
+    readonly $id: "https://sonor.io/schemas/honeypot-config.v1.json";
+    readonly title: "HoneypotConfig";
+    readonly description: "The honeypot slice of a public managed-form config.";
+    readonly type: "object";
+    readonly properties: {
+        readonly honeypot_enabled: {
+            readonly type: "boolean";
+        };
+        readonly honeypot_field: {
+            readonly description: "Trap field name; defaults to \"_sk_hp_url\" when unset.";
+            readonly type: "string";
+        };
+    };
+    readonly additionalProperties: true;
+};
+
+export { DEFAULT_HONEYPOT_FIELD, FORMS_HONEYPOT_CONTRACT_VERSION, GENERIC_HONEYPOT_FIELDS, HONEYPOT_CONFIG_JSON_SCHEMA, isHoneypotTriggered, resolveHoneypotFieldNames };

package/dist/forms/contract.js

@@ -0,0 +1,33 @@
+'use strict';
+
+var chunkV6NVBFEP_js = require('../chunk-V6NVBFEP.js');
+require('../chunk-ZSMWDLMK.js');
+
+
+
+Object.defineProperty(exports, "DEFAULT_HONEYPOT_FIELD", {
+  enumerable: true,
+  get: function () { return chunkV6NVBFEP_js.DEFAULT_HONEYPOT_FIELD; }
+});
+Object.defineProperty(exports, "FORMS_HONEYPOT_CONTRACT_VERSION", {
+  enumerable: true,
+  get: function () { return chunkV6NVBFEP_js.FORMS_HONEYPOT_CONTRACT_VERSION; }
+});
+Object.defineProperty(exports, "GENERIC_HONEYPOT_FIELDS", {
+  enumerable: true,
+  get: function () { return chunkV6NVBFEP_js.GENERIC_HONEYPOT_FIELDS; }
+});
+Object.defineProperty(exports, "HONEYPOT_CONFIG_JSON_SCHEMA", {
+  enumerable: true,
+  get: function () { return chunkV6NVBFEP_js.HONEYPOT_CONFIG_JSON_SCHEMA; }
+});
+Object.defineProperty(exports, "isHoneypotTriggered", {
+  enumerable: true,
+  get: function () { return chunkV6NVBFEP_js.isHoneypotTriggered; }
+});
+Object.defineProperty(exports, "resolveHoneypotFieldNames", {
+  enumerable: true,
+  get: function () { return chunkV6NVBFEP_js.resolveHoneypotFieldNames; }
+});
+//# sourceMappingURL=contract.js.map
+//# sourceMappingURL=contract.js.map

package/dist/forms/contract.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"contract.js"}

package/dist/forms/contract.mjs

@@ -0,0 +1,4 @@
+export { DEFAULT_HONEYPOT_FIELD, FORMS_HONEYPOT_CONTRACT_VERSION, GENERIC_HONEYPOT_FIELDS, HONEYPOT_CONFIG_JSON_SCHEMA, isHoneypotTriggered, resolveHoneypotFieldNames } from '../chunk-X3S6KXAP.mjs';
+import '../chunk-4XPGGLVP.mjs';
+//# sourceMappingURL=contract.mjs.map
+//# sourceMappingURL=contract.mjs.map

package/dist/forms/contract.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"contract.mjs"}

package/dist/forms/index.js

@@ -1,7 +1,10 @@
 'use client';
 'use strict';
 
-var chunkMLJXELPA_js = require('../chunk-MLJXELPA.js');
+var chunkHAZN43I6_js = require('../chunk-HAZN43I6.js');
+var chunkV6NVBFEP_js = require('../chunk-V6NVBFEP.js');
+var chunkEAASMIWX_js = require('../chunk-EAASMIWX.js');
+require('../chunk-WRZQS7O4.js');
 require('../chunk-ZSMWDLMK.js');
 var React2 = require('react');
 var jsxRuntime = require('react/jsx-runtime');
@@ -39,11 +42,11 @@ async function apiRequest(method, path, body) {
     const token = await getAuthToken();
     headers["Authorization"] = `Bearer ${token}`;
   }
-  const response = await fetch(`${baseUrl}${path}`, {
+  const response = await chunkEAASMIWX_js.sonorFetch(`${baseUrl}${path}`, {
     method,
     headers,
     body: body ? JSON.stringify(body) : void 0
-  });
+  }, { retries: 0 });
   if (!response.ok) {
     const error = await response.json().catch(() => ({ message: response.statusText }));
     throw new Error(error.message || `API error: ${response.status}`);
@@ -449,7 +452,7 @@ function DatePicker({
           width: "100%",
           padding: "var(--sk-input-padding, 10px 12px)",
           backgroundColor: "var(--sk-input-bg, #fff)",
-          border: `1px solid ${open ? "var(--sk-input-border-focus, #3b82f6)" : "var(--sk-input-border, #d1d5db)"}`,
+          border: `1px solid ${open ? "var(--sk-input-border-focus, #2563eb)" : "var(--sk-input-border, #d1d5db)"}`,
           borderRadius: "var(--sk-input-radius, 0.375rem)",
           fontSize: "var(--sk-font-size, 14px)",
           color: value ? "var(--sk-form-success-text, #111)" : "var(--sk-text-tertiary, #9ca3af)",
@@ -533,8 +536,8 @@ function DatePicker({
                   fontSize: "13px",
                   fontWeight: selected ? 700 : todayMark ? 600 : 400,
                   borderRadius: "6px",
-                  border: todayMark && !selected ? "1px solid var(--sk-primary, #3b82f6)" : "1px solid transparent",
-                  background: selected ? "var(--sk-primary, #3b82f6)" : "transparent",
+                  border: todayMark && !selected ? "1px solid var(--sk-primary, #2563eb)" : "1px solid transparent",
+                  background: selected ? "var(--sk-primary, #2563eb)" : "transparent",
                   color: disabled ? "var(--sk-text-tertiary, #9ca3af)" : selected ? "#fff" : "var(--sk-form-success-text, #111)",
                   cursor: disabled ? "not-allowed" : "pointer",
                   opacity: disabled ? 0.4 : 1,
@@ -571,7 +574,7 @@ function DatePicker({
                 cursor: "pointer",
                 fontSize: "12px",
                 fontWeight: 600,
-                color: "var(--sk-primary, #3b82f6)",
+                color: "var(--sk-primary, #2563eb)",
                 padding: "4px 8px"
               },
               children: "Today"
@@ -892,7 +895,7 @@ async function uploadFormFile(file) {
   }
   const body = new FormData();
   body.append("file", file);
-  const response = await chunkMLJXELPA_js.fetchWithRetry(
+  const response = await chunkEAASMIWX_js.sonorFetch(
     `${apiUrl}/api/public/forms/upload`,
     {
       method: "POST",
@@ -924,10 +927,10 @@ function FormClient({
   const [isComplete, setIsComplete] = React2.useState(false);
   const [submitError, setSubmitError] = React2.useState(null);
   const [honeypotValue, setHoneypotValue] = React2.useState("");
-  const honeypotFieldName = config2.honeypot_field || chunkMLJXELPA_js.DEFAULT_HONEYPOT_FIELD;
+  const honeypotFieldName = config2.honeypot_field || chunkV6NVBFEP_js.DEFAULT_HONEYPOT_FIELD;
   const formLoadedAt = React2.useRef(Date.now());
   const isSubmittingRef = React2.useRef(false);
-  const { trackStepChange, trackComplete } = chunkMLJXELPA_js.useFormTracking({
+  const { trackStepChange, trackComplete } = chunkHAZN43I6_js.useFormTracking({
     formId: config2.id,
     totalSteps: config2.total_steps
   });
@@ -1086,7 +1089,7 @@ function FormClient({
     setIsSubmitting(true);
     setSubmitError(null);
     try {
-      const data = await chunkMLJXELPA_js.submitForm({
+      const data = await chunkHAZN43I6_js.submitForm({
         config: config2,
         values: buildVisibleValues(),
         honeypotValue: config2.honeypot_enabled ? honeypotValue : "",
@@ -1128,7 +1131,7 @@ function FormClient({
   };
   if (isComplete) {
     const raw = config2.success_message;
-    const message = typeof raw === "string" && raw.trim().length > 0 ? raw.trim() : chunkMLJXELPA_js.DEFAULT_FORM_SUCCESS_MESSAGE;
+    const message = typeof raw === "string" && raw.trim().length > 0 ? raw.trim() : chunkHAZN43I6_js.DEFAULT_FORM_SUCCESS_MESSAGE;
     return /* @__PURE__ */ jsxRuntime.jsx(
       "div",
       {
@@ -1180,7 +1183,7 @@ function FormClient({
           }, children: /* @__PURE__ */ jsxRuntime.jsx("div", { className: "sk-form__progress-bar", style: {
             width: `${progress}%`,
             height: "100%",
-            backgroundColor: "var(--sk-progress-fill, #3b82f6)",
+            backgroundColor: "var(--sk-progress-fill, #2563eb)",
             transition: "width 0.3s ease"
           } }) })
         ] }),
@@ -1220,6 +1223,7 @@ function FormClient({
             name: honeypotFieldName,
             tabIndex: -1,
             autoComplete: "off",
+            "aria-hidden": "true",
             style: {
               position: "absolute",
               left: -9999,
@@ -1251,7 +1255,7 @@ function ManagedForm({
     form,
     isLoading,
     fetchError
-  } = chunkMLJXELPA_js.useForm(formId, {
+  } = chunkHAZN43I6_js.useForm(formId, {
     projectId,
     onSuccess,
     onError
@@ -1276,15 +1280,15 @@ function ManagedForm({
 
 Object.defineProperty(exports, "DEFAULT_FORM_SUCCESS_MESSAGE", {
   enumerable: true,
-  get: function () { return chunkMLJXELPA_js.DEFAULT_FORM_SUCCESS_MESSAGE; }
+  get: function () { return chunkHAZN43I6_js.DEFAULT_FORM_SUCCESS_MESSAGE; }
 });
 Object.defineProperty(exports, "useForm", {
   enumerable: true,
-  get: function () { return chunkMLJXELPA_js.useForm; }
+  get: function () { return chunkHAZN43I6_js.useForm; }
 });
 Object.defineProperty(exports, "useFormTracking", {
   enumerable: true,
-  get: function () { return chunkMLJXELPA_js.useFormTracking; }
+  get: function () { return chunkHAZN43I6_js.useFormTracking; }
 });
 exports.DatePicker = DatePicker;
 exports.FormClient = FormClient;