@sonordev/site-kit 3.0.5 → 3.2.1

package/dist/layout/client.d.ts

@@ -11,6 +11,13 @@ interface SiteKitClientProvidersProps {
     engage?: boolean | EngageConfig;
     signal?: boolean | SignalConfig;
     sitemapSync?: boolean;
+    /**
+     * Fleet heartbeat — reports kit version + active modules to Sonor once per
+     * session so the platform can track version drift and key state across every
+     * site. Default true. Deferred exactly like Analytics; never in the hydration
+     * path, carries no visitor data.
+     */
+    fleet?: boolean;
     /**
      * Defer Analytics / Engage / SitemapSync until window load + idle or first
      * interaction (default true). Pass false to restore legacy eager mounting
@@ -20,6 +27,6 @@ interface SiteKitClientProvidersProps {
     defer?: boolean;
     debug?: boolean;
 }
-declare function SiteKitClientProviders({ children, apiKey, apiUrl, projectId, analytics, engage, signal, sitemapSync, defer, debug, }: SiteKitClientProvidersProps): react_jsx_runtime.JSX.Element;
+declare function SiteKitClientProviders({ children, apiKey, apiUrl, projectId, analytics, engage, signal, sitemapSync, fleet, defer, debug, }: SiteKitClientProvidersProps): react_jsx_runtime.JSX.Element;
 
 export { SiteKitClientProviders, type SiteKitClientProvidersProps };

package/dist/layout/client.js

@@ -1,17 +1,22 @@
 'use client';
 'use strict';
 
-var chunkNNZDHLXN_js = require('../chunk-NNZDHLXN.js');
+var chunkBNBCSHTK_js = require('../chunk-BNBCSHTK.js');
+require('../chunk-B5YNHSRA.js');
 require('../chunk-HGNSJXWT.js');
-require('../chunk-O7E6QVK3.js');
+require('../chunk-Q2NBD54V.js');
+require('../chunk-WZHWWOUC.js');
+require('../chunk-52VXHSVT.js');
 require('../chunk-3BNFUMLL.js');
+require('../chunk-GMSPDTEV.js');
+require('../chunk-WAAFJPNR.js');
 require('../chunk-ZSMWDLMK.js');
 
 
 
 Object.defineProperty(exports, "SiteKitClientProviders", {
   enumerable: true,
-  get: function () { return chunkNNZDHLXN_js.SiteKitClientProviders; }
+  get: function () { return chunkBNBCSHTK_js.SiteKitClientProviders; }
 });
 //# sourceMappingURL=client.js.map
 //# sourceMappingURL=client.js.map

package/dist/layout/client.mjs

@@ -1,8 +1,13 @@
 'use client';
-export { SiteKitClientProviders } from '../chunk-KMZ527EM.mjs';
+export { SiteKitClientProviders } from '../chunk-VTHCUHMK.mjs';
+import '../chunk-E4TWVVSW.mjs';
 import '../chunk-ZVBLXXNJ.mjs';
-import '../chunk-YFGKIKXA.mjs';
+import '../chunk-ZPLN537Q.mjs';
+import '../chunk-X4OPM3SK.mjs';
+import '../chunk-MKZHVSKL.mjs';
 import '../chunk-EE6SFAZP.mjs';
+import '../chunk-SBT4J733.mjs';
+import '../chunk-QLM7RNQI.mjs';
 import '../chunk-4XPGGLVP.mjs';
 //# sourceMappingURL=client.mjs.map
 //# sourceMappingURL=client.mjs.map

package/dist/layout/index.d.mts

@@ -18,6 +18,12 @@ interface SiteKitLayoutProps {
     signal?: boolean | SignalConfig;
     /** SitemapSync client component. Default: true */
     sitemapSync?: boolean;
+    /**
+     * Fleet heartbeat — reports this site's kit version + active modules to Sonor
+     * once per session so the platform can track version drift. Default: true.
+     * Deferred like Analytics; never in the hydration path.
+     */
+    fleet?: boolean;
     /**
      * Defer client modules (Analytics, Engage, SitemapSync) until window load +
      * idle or the first user interaction, keeping their JS and mount work out of
@@ -37,6 +43,6 @@ interface SiteKitLayoutProps {
      */
     showLlmsTxtFooterLink?: boolean;
 }
-declare function SiteKitLayout({ children, apiKey, apiUrl, projectId, analytics, engage, signal, sitemapSync, defer, favicon, managedScripts, debug, showLlmsTxtFooterLink, }: SiteKitLayoutProps): Promise<react_jsx_runtime.JSX.Element>;
+declare function SiteKitLayout({ children, apiKey, apiUrl, projectId, analytics, engage, signal, sitemapSync, fleet, defer, favicon, managedScripts, debug, showLlmsTxtFooterLink, }: SiteKitLayoutProps): Promise<react_jsx_runtime.JSX.Element>;
 
 export { AnalyticsConfig, EngageConfig, SignalConfig, SiteKitLayout, type SiteKitLayoutProps };

package/dist/layout/index.d.ts

@@ -18,6 +18,12 @@ interface SiteKitLayoutProps {
     signal?: boolean | SignalConfig;
     /** SitemapSync client component. Default: true */
     sitemapSync?: boolean;
+    /**
+     * Fleet heartbeat — reports this site's kit version + active modules to Sonor
+     * once per session so the platform can track version drift. Default: true.
+     * Deferred like Analytics; never in the hydration path.
+     */
+    fleet?: boolean;
     /**
      * Defer client modules (Analytics, Engage, SitemapSync) until window load +
      * idle or the first user interaction, keeping their JS and mount work out of
@@ -37,6 +43,6 @@ interface SiteKitLayoutProps {
      */
     showLlmsTxtFooterLink?: boolean;
 }
-declare function SiteKitLayout({ children, apiKey, apiUrl, projectId, analytics, engage, signal, sitemapSync, defer, favicon, managedScripts, debug, showLlmsTxtFooterLink, }: SiteKitLayoutProps): Promise<react_jsx_runtime.JSX.Element>;
+declare function SiteKitLayout({ children, apiKey, apiUrl, projectId, analytics, engage, signal, sitemapSync, fleet, defer, favicon, managedScripts, debug, showLlmsTxtFooterLink, }: SiteKitLayoutProps): Promise<react_jsx_runtime.JSX.Element>;
 
 export { AnalyticsConfig, EngageConfig, SignalConfig, SiteKitLayout, type SiteKitLayoutProps };

package/dist/layout/index.js

@@ -1,15 +1,65 @@
 'use strict';
 
-var chunkNNZDHLXN_js = require('../chunk-NNZDHLXN.js');
+var chunkBNBCSHTK_js = require('../chunk-BNBCSHTK.js');
+require('../chunk-B5YNHSRA.js');
 require('../chunk-HGNSJXWT.js');
+require('../chunk-Q2NBD54V.js');
+require('../chunk-WZHWWOUC.js');
 var chunkGCPPXUAI_js = require('../chunk-GCPPXUAI.js');
-require('../chunk-O7E6QVK3.js');
+require('../chunk-52VXHSVT.js');
 var chunkDV2LJYFD_js = require('../chunk-DV2LJYFD.js');
 var chunkQPIKPWAZ_js = require('../chunk-QPIKPWAZ.js');
 require('../chunk-3BNFUMLL.js');
+require('../chunk-GMSPDTEV.js');
+var chunkWAAFJPNR_js = require('../chunk-WAAFJPNR.js');
 require('../chunk-ZSMWDLMK.js');
+require('server-only');
 var jsxRuntime = require('react/jsx-runtime');
 
+var MINT_PATH = "/api/public/site-token";
+var MINT_TIMEOUT_MS = 4e3;
+var SITE_TOKEN_PREFIX = "st1.";
+var cache = /* @__PURE__ */ new Map();
+async function resolveClientCredential(rawKey, apiUrl) {
+  if (!rawKey) return "";
+  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey;
+  const now = Date.now();
+  const cached = cache.get(rawKey);
+  if (cached && cached.expiresAt > now) return cached.credential;
+  const base = (apiUrl || "https://api.sonor.io").replace(/\/+$/, "");
+  try {
+    const res = await fetch(`${base}${MINT_PATH}`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-api-key": rawKey,
+        "x-sitekit-version": chunkWAAFJPNR_js.SITE_KIT_VERSION
+      },
+      cache: "no-store",
+      signal: typeof AbortSignal !== "undefined" && AbortSignal.timeout ? AbortSignal.timeout(MINT_TIMEOUT_MS) : void 0
+    });
+    if (res.ok) {
+      const data = await res.json().catch(() => null);
+      const token = data?.token;
+      const expiresIn = typeof data?.expiresIn === "number" ? data.expiresIn : 3600;
+      if (typeof token === "string" && token.startsWith(SITE_TOKEN_PREFIX)) {
+        cache.set(rawKey, {
+          credential: token,
+          expiresAt: now + Math.min(expiresIn * 1e3 / 2, 30 * 6e4)
+        });
+        return token;
+      }
+    } else if (res.status !== 404) {
+      console.warn(
+        `[SiteKitLayout] Token mint returned ${res.status}; injecting raw key for this render.`
+      );
+    }
+  } catch {
+    console.warn("[SiteKitLayout] Token mint unavailable; injecting raw key for this render.");
+  }
+  cache.set(rawKey, { credential: rawKey, expiresAt: now + 6e4 });
+  return rawKey;
+}
 async function SiteKitLayout({
   children,
   apiKey,
@@ -19,6 +69,7 @@ async function SiteKitLayout({
   engage = true,
   signal = false,
   sitemapSync = true,
+  fleet = true,
   defer = true,
   favicon = true,
   managedScripts = true,
@@ -33,21 +84,23 @@ async function SiteKitLayout({
     );
   }
   const apiOrigin = chunkQPIKPWAZ_js.resolveApiOrigin(resolvedApiUrl);
+  const clientCredential = await resolveClientCredential(resolvedApiKey, resolvedApiUrl);
   return /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
     /* @__PURE__ */ jsxRuntime.jsx("link", { rel: "preconnect", href: apiOrigin, crossOrigin: "anonymous" }),
     /* @__PURE__ */ jsxRuntime.jsx("link", { rel: "dns-prefetch", href: apiOrigin }),
     favicon && /* @__PURE__ */ jsxRuntime.jsx(chunkGCPPXUAI_js.ManagedFavicon, { apiKey: resolvedApiKey, apiUrl: resolvedApiUrl }),
     managedScripts && /* @__PURE__ */ jsxRuntime.jsx(chunkDV2LJYFD_js.ManagedScripts, { position: "head" }),
     /* @__PURE__ */ jsxRuntime.jsxs(
-      chunkNNZDHLXN_js.SiteKitClientProviders,
+      chunkBNBCSHTK_js.SiteKitClientProviders,
       {
-        apiKey: resolvedApiKey,
+        apiKey: clientCredential,
         apiUrl: resolvedApiUrl,
         projectId,
         analytics,
         engage,
         signal,
         sitemapSync,
+        fleet,
         defer,
         debug,
         children: [

package/dist/layout/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/layout/SiteKitLayout.tsx"],"names":["resolveApiOrigin","jsxs","Fragment","jsx","ManagedFavicon","ManagedScripts","SiteKitClientProviders"],"mappings":";;;;;;;;;;;;AA2FA,eAAsB,aAAA,CAAc;AAAA,EAClC,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA,GAAY,IAAA;AAAA,EACZ,MAAA,GAAS,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EACT,WAAA,GAAc,IAAA;AAAA,EACd,KAAA,GAAQ,IAAA;AAAA,EACR,OAAA,GAAU,IAAA;AAAA,EACV,cAAA,GAAiB,IAAA;AAAA,EACjB,KAAA,GAAQ,KAAA;AAAA,EACR,qBAAA,GAAwB;AAC1B,CAAA,EAAuB;AAErB,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,EAAA;AACF,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,sBAAA;AAEF,EAAA,IAAI,CAAC,kBAAkB,KAAA,EAAO;AAC5B,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAYA,kCAAiB,cAAc,CAAA;AAEjD,EAAA,uBACEC,eAAA,CAAAC,mBAAA,EAAA,EACE,QAAA,EAAA;AAAA,oBAAAC,cAAA,CAAC,UAAK,GAAA,EAAI,YAAA,EAAa,IAAA,EAAM,SAAA,EAAW,aAAY,WAAA,EAAY,CAAA;AAAA,oBAChEA,cAAA,CAAC,MAAA,EAAA,EAAK,GAAA,EAAI,cAAA,EAAe,MAAM,SAAA,EAAW,CAAA;AAAA,IAEzC,2BAAWA,cAAA,CAACC,+BAAA,EAAA,EAAe,MAAA,EAAQ,cAAA,EAAgB,QAAQ,cAAA,EAAgB,CAAA;AAAA,IAC3E,cAAA,oBAAkBD,cAAA,CAACE,+BAAA,EAAA,EAAe,QAAA,EAAS,MAAA,EAAO,CAAA;AAAA,oBAGnDJ,eAAA;AAAA,MAACK,uCAAA;AAAA,MAAA;AAAA,QACC,MAAA,EAAQ,cAAA;AAAA,QACR,MAAA,EAAQ,cAAA;AAAA,QACR,SAAA;AAAA,QACA,SAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,WAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QAEC,QAAA,EAAA;AAAA,UAAA,QAAA;AAAA,UACA,qBAAA,mBACCH,cAAA,CAAC,QAAA,EAAA,EAAO,SAAA,EAAU,SAAA,EAAU,aAAA,EAAY,MAAA,EACtC,QAAA,kBAAAA,cAAA,CAAC,GAAA,EAAA,EAAE,IAAA,EAAK,WAAA,EAAY,QAAA,EAAA,UAAA,EAAQ,GAC9B,CAAA,GACE;AAAA;AAAA;AAAA,KACN;AAAA,IAGC,cAAA,oBAAkBA,cAAA,CAACE,+BAAA,EAAA,EAAe,QAAA,EAAS,UAAA,EAAW;AAAA,GAAA,EACzD,CAAA;AAEJ","file":"index.js","sourcesContent":["/**\n * @sonordev/site-kit/layout — SiteKitLayout\n *\n * The master layout component. A single RSC that auto-composes every\n * site-kit feature your layout needs:\n *\n * Server-side (RSC):\n *   - ManagedFavicon (link tags from Portal logo)\n *   - ManagedScripts position=\"head\" (tracking pixels, analytics tags)\n *   - ManagedScripts position=\"body-end\"\n *\n * Client-side (island):\n *   - AnalyticsProvider (page views, scroll depth, heatmap, web vitals)\n *   - EngageWidget (popups, nudges, chat)\n *   - SignalBridge (A/B experiments, behavior tracking)\n *   - SitemapSync (keeps Portal seo_pages in sync)\n *\n * @example\n * ```tsx\n * // app/layout.tsx\n * import { SiteKitLayout } from '@sonordev/site-kit/layout'\n *\n * export default function RootLayout({ children }) {\n *   return (\n *     <html lang=\"en\">\n *       <body>\n *         <SiteKitLayout>\n *           <Header />\n *           <main>{children}</main>\n *           <Footer />\n *         </SiteKitLayout>\n *       </body>\n *     </html>\n *   )\n * }\n * ```\n *\n * @example Opt out of specific features:\n * ```tsx\n * <SiteKitLayout engage={false} signal={false}>\n *   {children}\n * </SiteKitLayout>\n * ```\n */\n\nimport * as React from 'react'\nimport { ManagedFavicon } from '../images/ManagedFavicon'\nimport { ManagedScripts } from '../seo/ManagedScripts'\nimport { resolveApiOrigin } from '../server/server-fetch'\nimport { SiteKitClientProviders } from './SiteKitClientProviders'\nimport type { AnalyticsConfig, EngageConfig, SignalConfig } from './types'\n\nexport interface SiteKitLayoutProps {\n  children: React.ReactNode\n\n  /** Portal API key. Defaults to SONOR_API_KEY env var. */\n  apiKey?: string\n  /** Portal API URL. Defaults to env or https://api.sonor.io */\n  apiUrl?: string\n  /** Project ID (for Engage chat room routing). Auto-resolved if not provided. */\n  projectId?: string\n\n  /** Analytics tracking. true (default) | false | config object */\n  analytics?: boolean | AnalyticsConfig\n  /** Engage widgets (popups, chat). true (default) | false | config object */\n  engage?: boolean | EngageConfig\n  /** Signal AI (experiments, behavior). false (default) | true | config object */\n  signal?: boolean | SignalConfig\n  /** SitemapSync client component. Default: true */\n  sitemapSync?: boolean\n  /**\n   * Defer client modules (Analytics, Engage, SitemapSync) until window load +\n   * idle or the first user interaction, keeping their JS and mount work out of\n   * the critical hydration path. Default: true. Pass false to restore legacy\n   * eager mounting. SignalBridge is never deferred.\n   */\n  defer?: boolean\n  /** ManagedFavicon in <head>. Default: true */\n  favicon?: boolean\n  /** ManagedScripts (head + body-end). Default: true */\n  managedScripts?: boolean\n\n  /** Debug mode — logs to console. Default: false */\n  debug?: boolean\n  /**\n   * When true, append a screen-reader-only link to `/llms.txt` after main content.\n   * Default false — prefer `buildAiDiscoveryHeaders()` for discovery.\n   */\n  showLlmsTxtFooterLink?: boolean\n}\n\nexport async function SiteKitLayout({\n  children,\n  apiKey,\n  apiUrl,\n  projectId,\n  analytics = true,\n  engage = true,\n  signal = false,\n  sitemapSync = true,\n  defer = true,\n  favicon = true,\n  managedScripts = true,\n  debug = false,\n  showLlmsTxtFooterLink = false,\n}: SiteKitLayoutProps) {\n  // Resolve API config from env (server-side, safe)\n  const resolvedApiKey =\n    apiKey ??\n    process.env.SONOR_API_KEY ??\n    ''\n  const resolvedApiUrl =\n    apiUrl ??\n    process.env.SONOR_API_URL ??\n    'https://api.sonor.io'\n\n  if (!resolvedApiKey && debug) {\n    console.warn(\n      '[SiteKitLayout] No API key found. Set SONOR_API_KEY.',\n    )\n  }\n\n  const apiOrigin = resolveApiOrigin(resolvedApiUrl)\n\n  return (\n    <>\n      <link rel=\"preconnect\" href={apiOrigin} crossOrigin=\"anonymous\" />\n      <link rel=\"dns-prefetch\" href={apiOrigin} />\n      {/* Server-rendered head components */}\n      {favicon && <ManagedFavicon apiKey={resolvedApiKey} apiUrl={resolvedApiUrl} />}\n      {managedScripts && <ManagedScripts position=\"head\" />}\n\n      {/* Client-side providers island */}\n      <SiteKitClientProviders\n        apiKey={resolvedApiKey}\n        apiUrl={resolvedApiUrl}\n        projectId={projectId}\n        analytics={analytics}\n        engage={engage}\n        signal={signal}\n        sitemapSync={sitemapSync}\n        defer={defer}\n        debug={debug}\n      >\n        {children}\n        {showLlmsTxtFooterLink ? (\n          <footer className=\"sr-only\" aria-hidden=\"true\">\n            <a href=\"/llms.txt\">llms.txt</a>\n          </footer>\n        ) : null}\n      </SiteKitClientProviders>\n\n      {/* Server-rendered body-end scripts */}\n      {managedScripts && <ManagedScripts position=\"body-end\" />}\n    </>\n  )\n}\n"]}
+{"version":3,"sources":["../../src/server/mint-site-token.ts","../../src/layout/SiteKitLayout.tsx"],"names":["SITE_KIT_VERSION","resolveApiOrigin","jsxs","Fragment","jsx","ManagedFavicon","ManagedScripts","SiteKitClientProviders"],"mappings":";;;;;;;;;;;;;;;;;;AAqBA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAM1B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAE1C,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,MAAA,IAAU,MAAA,CAAO,SAAA,GAAY,GAAA,SAAY,MAAA,CAAO,UAAA;AAEpD,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,GAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,MAC7C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,WAAA,EAAa,MAAA;AAAA,QACb,mBAAA,EAAqBA;AAAA,OACvB;AAAA,MACA,KAAA,EAAO,UAAA;AAAA,MACP,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,KACP,CAAA;AAED,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,MAAM,IAAA,CAAK,GAAA,CAAK,YAAY,GAAA,GAAQ,CAAA,EAAG,KAAK,GAAM;AAAA,SAC9D,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AAAA,IACF,CAAA,MAAA,IAAW,GAAA,CAAI,MAAA,KAAW,GAAA,EAAK;AAG7B,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA,oCAAA;AAAA,OACnD;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAA,CAAQ,KAAK,4EAA4E,CAAA;AAAA,EAC3F;AAIA,EAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,EAAA,OAAO,MAAA;AACT;ACaA,eAAsB,aAAA,CAAc;AAAA,EAClC,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA,GAAY,IAAA;AAAA,EACZ,MAAA,GAAS,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EACT,WAAA,GAAc,IAAA;AAAA,EACd,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR,OAAA,GAAU,IAAA;AAAA,EACV,cAAA,GAAiB,IAAA;AAAA,EACjB,KAAA,GAAQ,KAAA;AAAA,EACR,qBAAA,GAAwB;AAC1B,CAAA,EAAuB;AAErB,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,EAAA;AACF,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,sBAAA;AAEF,EAAA,IAAI,CAAC,kBAAkB,KAAA,EAAO;AAC5B,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAYC,kCAAiB,cAAc,CAAA;AAKjD,EAAA,MAAM,gBAAA,GAAmB,MAAM,uBAAA,CAAwB,cAAA,EAAgB,cAAc,CAAA;AAErF,EAAA,uBACEC,eAAA,CAAAC,mBAAA,EAAA,EACE,QAAA,EAAA;AAAA,oBAAAC,cAAA,CAAC,UAAK,GAAA,EAAI,YAAA,EAAa,IAAA,EAAM,SAAA,EAAW,aAAY,WAAA,EAAY,CAAA;AAAA,oBAChEA,cAAA,CAAC,MAAA,EAAA,EAAK,GAAA,EAAI,cAAA,EAAe,MAAM,SAAA,EAAW,CAAA;AAAA,IAEzC,2BAAWA,cAAA,CAACC,+BAAA,EAAA,EAAe,MAAA,EAAQ,cAAA,EAAgB,QAAQ,cAAA,EAAgB,CAAA;AAAA,IAC3E,cAAA,oBAAkBD,cAAA,CAACE,+BAAA,EAAA,EAAe,QAAA,EAAS,MAAA,EAAO,CAAA;AAAA,oBAInDJ,eAAA;AAAA,MAACK,uCAAA;AAAA,MAAA;AAAA,QACC,MAAA,EAAQ,gBAAA;AAAA,QACR,MAAA,EAAQ,cAAA;AAAA,QACR,SAAA;AAAA,QACA,SAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,WAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QAEC,QAAA,EAAA;AAAA,UAAA,QAAA;AAAA,UACA,qBAAA,mBACCH,cAAA,CAAC,QAAA,EAAA,EAAO,SAAA,EAAU,SAAA,EAAU,aAAA,EAAY,MAAA,EACtC,QAAA,kBAAAA,cAAA,CAAC,GAAA,EAAA,EAAE,IAAA,EAAK,WAAA,EAAY,QAAA,EAAA,UAAA,EAAQ,GAC9B,CAAA,GACE;AAAA;AAAA;AAAA,KACN;AAAA,IAGC,cAAA,oBAAkBA,cAAA,CAACE,+BAAA,EAAA,EAAe,QAAA,EAAS,UAAA,EAAW;AAAA,GAAA,EACzD,CAAA;AAEJ","file":"index.js","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * Resilience: if minting is unavailable (older API without the endpoint, token\n * auth not configured, transient outage) it returns the RAW KEY, so a build never\n * breaks. Domain-binding is log-only by default, so the raw key still works —\n * worst case is exactly pre-3.2 behavior. Memoized per raw key for the process,\n * so an entire `next build` mints ~once and every static page reuses one seed\n * (the client refreshes on the far side as needed).\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const now = Date.now()\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > now) return cached.credential\n\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  try {\n    const res = await fetch(`${base}${MINT_PATH}`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-api-key': rawKey,\n        'x-sitekit-version': SITE_KIT_VERSION,\n      },\n      cache: 'no-store',\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n          : undefined,\n    })\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: now + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n    } else if (res.status !== 404) {\n      // 404 = older API without the endpoint (expected during rollout). Anything\n      // else is worth a server-side note. Never logs the key value.\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; injecting raw key for this render.`,\n      )\n    }\n  } catch {\n    console.warn('[SiteKitLayout] Token mint unavailable; injecting raw key for this render.')\n  }\n\n  // Fallback: the raw key (pre-3.2 behavior). Short cache so a transient outage\n  // retries soon rather than pinning the raw key for the whole build.\n  cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n  return rawKey\n}\n","/**\n * @sonordev/site-kit/layout — SiteKitLayout\n *\n * The master layout component. A single RSC that auto-composes every\n * site-kit feature your layout needs:\n *\n * Server-side (RSC):\n *   - ManagedFavicon (link tags from Portal logo)\n *   - ManagedScripts position=\"head\" (tracking pixels, analytics tags)\n *   - ManagedScripts position=\"body-end\"\n *\n * Client-side (island):\n *   - AnalyticsProvider (page views, scroll depth, heatmap, web vitals)\n *   - EngageWidget (popups, nudges, chat)\n *   - SignalBridge (A/B experiments, behavior tracking)\n *   - SitemapSync (keeps Portal seo_pages in sync)\n *\n * @example\n * ```tsx\n * // app/layout.tsx\n * import { SiteKitLayout } from '@sonordev/site-kit/layout'\n *\n * export default function RootLayout({ children }) {\n *   return (\n *     <html lang=\"en\">\n *       <body>\n *         <SiteKitLayout>\n *           <Header />\n *           <main>{children}</main>\n *           <Footer />\n *         </SiteKitLayout>\n *       </body>\n *     </html>\n *   )\n * }\n * ```\n *\n * @example Opt out of specific features:\n * ```tsx\n * <SiteKitLayout engage={false} signal={false}>\n *   {children}\n * </SiteKitLayout>\n * ```\n */\n\nimport * as React from 'react'\nimport { ManagedFavicon } from '../images/ManagedFavicon'\nimport { ManagedScripts } from '../seo/ManagedScripts'\nimport { resolveApiOrigin } from '../server/server-fetch'\nimport { resolveClientCredential } from '../server/mint-site-token'\nimport { SiteKitClientProviders } from './SiteKitClientProviders'\nimport type { AnalyticsConfig, EngageConfig, SignalConfig } from './types'\n\nexport interface SiteKitLayoutProps {\n  children: React.ReactNode\n\n  /** Portal API key. Defaults to SONOR_API_KEY env var. */\n  apiKey?: string\n  /** Portal API URL. Defaults to env or https://api.sonor.io */\n  apiUrl?: string\n  /** Project ID (for Engage chat room routing). Auto-resolved if not provided. */\n  projectId?: string\n\n  /** Analytics tracking. true (default) | false | config object */\n  analytics?: boolean | AnalyticsConfig\n  /** Engage widgets (popups, chat). true (default) | false | config object */\n  engage?: boolean | EngageConfig\n  /** Signal AI (experiments, behavior). false (default) | true | config object */\n  signal?: boolean | SignalConfig\n  /** SitemapSync client component. Default: true */\n  sitemapSync?: boolean\n  /**\n   * Fleet heartbeat — reports this site's kit version + active modules to Sonor\n   * once per session so the platform can track version drift. Default: true.\n   * Deferred like Analytics; never in the hydration path.\n   */\n  fleet?: boolean\n  /**\n   * Defer client modules (Analytics, Engage, SitemapSync) until window load +\n   * idle or the first user interaction, keeping their JS and mount work out of\n   * the critical hydration path. Default: true. Pass false to restore legacy\n   * eager mounting. SignalBridge is never deferred.\n   */\n  defer?: boolean\n  /** ManagedFavicon in <head>. Default: true */\n  favicon?: boolean\n  /** ManagedScripts (head + body-end). Default: true */\n  managedScripts?: boolean\n\n  /** Debug mode — logs to console. Default: false */\n  debug?: boolean\n  /**\n   * When true, append a screen-reader-only link to `/llms.txt` after main content.\n   * Default false — prefer `buildAiDiscoveryHeaders()` for discovery.\n   */\n  showLlmsTxtFooterLink?: boolean\n}\n\nexport async function SiteKitLayout({\n  children,\n  apiKey,\n  apiUrl,\n  projectId,\n  analytics = true,\n  engage = true,\n  signal = false,\n  sitemapSync = true,\n  fleet = true,\n  defer = true,\n  favicon = true,\n  managedScripts = true,\n  debug = false,\n  showLlmsTxtFooterLink = false,\n}: SiteKitLayoutProps) {\n  // Resolve API config from env (server-side, safe)\n  const resolvedApiKey =\n    apiKey ??\n    process.env.SONOR_API_KEY ??\n    ''\n  const resolvedApiUrl =\n    apiUrl ??\n    process.env.SONOR_API_URL ??\n    'https://api.sonor.io'\n\n  if (!resolvedApiKey && debug) {\n    console.warn(\n      '[SiteKitLayout] No API key found. Set SONOR_API_KEY.',\n    )\n  }\n\n  const apiOrigin = resolveApiOrigin(resolvedApiUrl)\n\n  // Mint a short-lived client token so the raw key never reaches the browser.\n  // Falls back to the raw key if minting is unavailable (older API / transient\n  // outage) — the build never breaks. The client refreshes the token as needed.\n  const clientCredential = await resolveClientCredential(resolvedApiKey, resolvedApiUrl)\n\n  return (\n    <>\n      <link rel=\"preconnect\" href={apiOrigin} crossOrigin=\"anonymous\" />\n      <link rel=\"dns-prefetch\" href={apiOrigin} />\n      {/* Server-rendered head components */}\n      {favicon && <ManagedFavicon apiKey={resolvedApiKey} apiUrl={resolvedApiUrl} />}\n      {managedScripts && <ManagedScripts position=\"head\" />}\n\n      {/* Client-side providers island — receives the minted token (or raw-key\n          fallback), never the raw key when minting succeeds. */}\n      <SiteKitClientProviders\n        apiKey={clientCredential}\n        apiUrl={resolvedApiUrl}\n        projectId={projectId}\n        analytics={analytics}\n        engage={engage}\n        signal={signal}\n        sitemapSync={sitemapSync}\n        fleet={fleet}\n        defer={defer}\n        debug={debug}\n      >\n        {children}\n        {showLlmsTxtFooterLink ? (\n          <footer className=\"sr-only\" aria-hidden=\"true\">\n            <a href=\"/llms.txt\">llms.txt</a>\n          </footer>\n        ) : null}\n      </SiteKitClientProviders>\n\n      {/* Server-rendered body-end scripts */}\n      {managedScripts && <ManagedScripts position=\"body-end\" />}\n    </>\n  )\n}\n"]}

package/dist/layout/index.mjs

@@ -1,13 +1,63 @@
-import { SiteKitClientProviders } from '../chunk-KMZ527EM.mjs';
+import { SiteKitClientProviders } from '../chunk-VTHCUHMK.mjs';
+import '../chunk-E4TWVVSW.mjs';
 import '../chunk-ZVBLXXNJ.mjs';
+import '../chunk-ZPLN537Q.mjs';
+import '../chunk-X4OPM3SK.mjs';
 import { ManagedFavicon } from '../chunk-CU6OGBKK.mjs';
-import '../chunk-YFGKIKXA.mjs';
+import '../chunk-MKZHVSKL.mjs';
 import { ManagedScripts } from '../chunk-6PJTLBRR.mjs';
 import { resolveApiOrigin } from '../chunk-UDBUK5ZJ.mjs';
 import '../chunk-EE6SFAZP.mjs';
+import '../chunk-SBT4J733.mjs';
+import { SITE_KIT_VERSION } from '../chunk-QLM7RNQI.mjs';
 import '../chunk-4XPGGLVP.mjs';
+import 'server-only';
 import { jsxs, Fragment, jsx } from 'react/jsx-runtime';
 
+var MINT_PATH = "/api/public/site-token";
+var MINT_TIMEOUT_MS = 4e3;
+var SITE_TOKEN_PREFIX = "st1.";
+var cache = /* @__PURE__ */ new Map();
+async function resolveClientCredential(rawKey, apiUrl) {
+  if (!rawKey) return "";
+  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey;
+  const now = Date.now();
+  const cached = cache.get(rawKey);
+  if (cached && cached.expiresAt > now) return cached.credential;
+  const base = (apiUrl || "https://api.sonor.io").replace(/\/+$/, "");
+  try {
+    const res = await fetch(`${base}${MINT_PATH}`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-api-key": rawKey,
+        "x-sitekit-version": SITE_KIT_VERSION
+      },
+      cache: "no-store",
+      signal: typeof AbortSignal !== "undefined" && AbortSignal.timeout ? AbortSignal.timeout(MINT_TIMEOUT_MS) : void 0
+    });
+    if (res.ok) {
+      const data = await res.json().catch(() => null);
+      const token = data?.token;
+      const expiresIn = typeof data?.expiresIn === "number" ? data.expiresIn : 3600;
+      if (typeof token === "string" && token.startsWith(SITE_TOKEN_PREFIX)) {
+        cache.set(rawKey, {
+          credential: token,
+          expiresAt: now + Math.min(expiresIn * 1e3 / 2, 30 * 6e4)
+        });
+        return token;
+      }
+    } else if (res.status !== 404) {
+      console.warn(
+        `[SiteKitLayout] Token mint returned ${res.status}; injecting raw key for this render.`
+      );
+    }
+  } catch {
+    console.warn("[SiteKitLayout] Token mint unavailable; injecting raw key for this render.");
+  }
+  cache.set(rawKey, { credential: rawKey, expiresAt: now + 6e4 });
+  return rawKey;
+}
 async function SiteKitLayout({
   children,
   apiKey,
@@ -17,6 +67,7 @@ async function SiteKitLayout({
   engage = true,
   signal = false,
   sitemapSync = true,
+  fleet = true,
   defer = true,
   favicon = true,
   managedScripts = true,
@@ -31,6 +82,7 @@ async function SiteKitLayout({
     );
   }
   const apiOrigin = resolveApiOrigin(resolvedApiUrl);
+  const clientCredential = await resolveClientCredential(resolvedApiKey, resolvedApiUrl);
   return /* @__PURE__ */ jsxs(Fragment, { children: [
     /* @__PURE__ */ jsx("link", { rel: "preconnect", href: apiOrigin, crossOrigin: "anonymous" }),
     /* @__PURE__ */ jsx("link", { rel: "dns-prefetch", href: apiOrigin }),
@@ -39,13 +91,14 @@ async function SiteKitLayout({
     /* @__PURE__ */ jsxs(
       SiteKitClientProviders,
       {
-        apiKey: resolvedApiKey,
+        apiKey: clientCredential,
         apiUrl: resolvedApiUrl,
         projectId,
         analytics,
         engage,
         signal,
         sitemapSync,
+        fleet,
         defer,
         debug,
         children: [

package/dist/layout/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/layout/SiteKitLayout.tsx"],"names":[],"mappings":";;;;;;;;;;AA2FA,eAAsB,aAAA,CAAc;AAAA,EAClC,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA,GAAY,IAAA;AAAA,EACZ,MAAA,GAAS,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EACT,WAAA,GAAc,IAAA;AAAA,EACd,KAAA,GAAQ,IAAA;AAAA,EACR,OAAA,GAAU,IAAA;AAAA,EACV,cAAA,GAAiB,IAAA;AAAA,EACjB,KAAA,GAAQ,KAAA;AAAA,EACR,qBAAA,GAAwB;AAC1B,CAAA,EAAuB;AAErB,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,EAAA;AACF,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,sBAAA;AAEF,EAAA,IAAI,CAAC,kBAAkB,KAAA,EAAO;AAC5B,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAY,iBAAiB,cAAc,CAAA;AAEjD,EAAA,uBACE,IAAA,CAAA,QAAA,EAAA,EACE,QAAA,EAAA;AAAA,oBAAA,GAAA,CAAC,UAAK,GAAA,EAAI,YAAA,EAAa,IAAA,EAAM,SAAA,EAAW,aAAY,WAAA,EAAY,CAAA;AAAA,oBAChE,GAAA,CAAC,MAAA,EAAA,EAAK,GAAA,EAAI,cAAA,EAAe,MAAM,SAAA,EAAW,CAAA;AAAA,IAEzC,2BAAW,GAAA,CAAC,cAAA,EAAA,EAAe,MAAA,EAAQ,cAAA,EAAgB,QAAQ,cAAA,EAAgB,CAAA;AAAA,IAC3E,cAAA,oBAAkB,GAAA,CAAC,cAAA,EAAA,EAAe,QAAA,EAAS,MAAA,EAAO,CAAA;AAAA,oBAGnD,IAAA;AAAA,MAAC,sBAAA;AAAA,MAAA;AAAA,QACC,MAAA,EAAQ,cAAA;AAAA,QACR,MAAA,EAAQ,cAAA;AAAA,QACR,SAAA;AAAA,QACA,SAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,WAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QAEC,QAAA,EAAA;AAAA,UAAA,QAAA;AAAA,UACA,qBAAA,mBACC,GAAA,CAAC,QAAA,EAAA,EAAO,SAAA,EAAU,SAAA,EAAU,aAAA,EAAY,MAAA,EACtC,QAAA,kBAAA,GAAA,CAAC,GAAA,EAAA,EAAE,IAAA,EAAK,WAAA,EAAY,QAAA,EAAA,UAAA,EAAQ,GAC9B,CAAA,GACE;AAAA;AAAA;AAAA,KACN;AAAA,IAGC,cAAA,oBAAkB,GAAA,CAAC,cAAA,EAAA,EAAe,QAAA,EAAS,UAAA,EAAW;AAAA,GAAA,EACzD,CAAA;AAEJ","file":"index.mjs","sourcesContent":["/**\n * @sonordev/site-kit/layout — SiteKitLayout\n *\n * The master layout component. A single RSC that auto-composes every\n * site-kit feature your layout needs:\n *\n * Server-side (RSC):\n *   - ManagedFavicon (link tags from Portal logo)\n *   - ManagedScripts position=\"head\" (tracking pixels, analytics tags)\n *   - ManagedScripts position=\"body-end\"\n *\n * Client-side (island):\n *   - AnalyticsProvider (page views, scroll depth, heatmap, web vitals)\n *   - EngageWidget (popups, nudges, chat)\n *   - SignalBridge (A/B experiments, behavior tracking)\n *   - SitemapSync (keeps Portal seo_pages in sync)\n *\n * @example\n * ```tsx\n * // app/layout.tsx\n * import { SiteKitLayout } from '@sonordev/site-kit/layout'\n *\n * export default function RootLayout({ children }) {\n *   return (\n *     <html lang=\"en\">\n *       <body>\n *         <SiteKitLayout>\n *           <Header />\n *           <main>{children}</main>\n *           <Footer />\n *         </SiteKitLayout>\n *       </body>\n *     </html>\n *   )\n * }\n * ```\n *\n * @example Opt out of specific features:\n * ```tsx\n * <SiteKitLayout engage={false} signal={false}>\n *   {children}\n * </SiteKitLayout>\n * ```\n */\n\nimport * as React from 'react'\nimport { ManagedFavicon } from '../images/ManagedFavicon'\nimport { ManagedScripts } from '../seo/ManagedScripts'\nimport { resolveApiOrigin } from '../server/server-fetch'\nimport { SiteKitClientProviders } from './SiteKitClientProviders'\nimport type { AnalyticsConfig, EngageConfig, SignalConfig } from './types'\n\nexport interface SiteKitLayoutProps {\n  children: React.ReactNode\n\n  /** Portal API key. Defaults to SONOR_API_KEY env var. */\n  apiKey?: string\n  /** Portal API URL. Defaults to env or https://api.sonor.io */\n  apiUrl?: string\n  /** Project ID (for Engage chat room routing). Auto-resolved if not provided. */\n  projectId?: string\n\n  /** Analytics tracking. true (default) | false | config object */\n  analytics?: boolean | AnalyticsConfig\n  /** Engage widgets (popups, chat). true (default) | false | config object */\n  engage?: boolean | EngageConfig\n  /** Signal AI (experiments, behavior). false (default) | true | config object */\n  signal?: boolean | SignalConfig\n  /** SitemapSync client component. Default: true */\n  sitemapSync?: boolean\n  /**\n   * Defer client modules (Analytics, Engage, SitemapSync) until window load +\n   * idle or the first user interaction, keeping their JS and mount work out of\n   * the critical hydration path. Default: true. Pass false to restore legacy\n   * eager mounting. SignalBridge is never deferred.\n   */\n  defer?: boolean\n  /** ManagedFavicon in <head>. Default: true */\n  favicon?: boolean\n  /** ManagedScripts (head + body-end). Default: true */\n  managedScripts?: boolean\n\n  /** Debug mode — logs to console. Default: false */\n  debug?: boolean\n  /**\n   * When true, append a screen-reader-only link to `/llms.txt` after main content.\n   * Default false — prefer `buildAiDiscoveryHeaders()` for discovery.\n   */\n  showLlmsTxtFooterLink?: boolean\n}\n\nexport async function SiteKitLayout({\n  children,\n  apiKey,\n  apiUrl,\n  projectId,\n  analytics = true,\n  engage = true,\n  signal = false,\n  sitemapSync = true,\n  defer = true,\n  favicon = true,\n  managedScripts = true,\n  debug = false,\n  showLlmsTxtFooterLink = false,\n}: SiteKitLayoutProps) {\n  // Resolve API config from env (server-side, safe)\n  const resolvedApiKey =\n    apiKey ??\n    process.env.SONOR_API_KEY ??\n    ''\n  const resolvedApiUrl =\n    apiUrl ??\n    process.env.SONOR_API_URL ??\n    'https://api.sonor.io'\n\n  if (!resolvedApiKey && debug) {\n    console.warn(\n      '[SiteKitLayout] No API key found. Set SONOR_API_KEY.',\n    )\n  }\n\n  const apiOrigin = resolveApiOrigin(resolvedApiUrl)\n\n  return (\n    <>\n      <link rel=\"preconnect\" href={apiOrigin} crossOrigin=\"anonymous\" />\n      <link rel=\"dns-prefetch\" href={apiOrigin} />\n      {/* Server-rendered head components */}\n      {favicon && <ManagedFavicon apiKey={resolvedApiKey} apiUrl={resolvedApiUrl} />}\n      {managedScripts && <ManagedScripts position=\"head\" />}\n\n      {/* Client-side providers island */}\n      <SiteKitClientProviders\n        apiKey={resolvedApiKey}\n        apiUrl={resolvedApiUrl}\n        projectId={projectId}\n        analytics={analytics}\n        engage={engage}\n        signal={signal}\n        sitemapSync={sitemapSync}\n        defer={defer}\n        debug={debug}\n      >\n        {children}\n        {showLlmsTxtFooterLink ? (\n          <footer className=\"sr-only\" aria-hidden=\"true\">\n            <a href=\"/llms.txt\">llms.txt</a>\n          </footer>\n        ) : null}\n      </SiteKitClientProviders>\n\n      {/* Server-rendered body-end scripts */}\n      {managedScripts && <ManagedScripts position=\"body-end\" />}\n    </>\n  )\n}\n"]}
+{"version":3,"sources":["../../src/server/mint-site-token.ts","../../src/layout/SiteKitLayout.tsx"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAqBA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAM1B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAE1C,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,MAAA,IAAU,MAAA,CAAO,SAAA,GAAY,GAAA,SAAY,MAAA,CAAO,UAAA;AAEpD,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,GAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,MAC7C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,WAAA,EAAa,MAAA;AAAA,QACb,mBAAA,EAAqB;AAAA,OACvB;AAAA,MACA,KAAA,EAAO,UAAA;AAAA,MACP,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,KACP,CAAA;AAED,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,MAAM,IAAA,CAAK,GAAA,CAAK,YAAY,GAAA,GAAQ,CAAA,EAAG,KAAK,GAAM;AAAA,SAC9D,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AAAA,IACF,CAAA,MAAA,IAAW,GAAA,CAAI,MAAA,KAAW,GAAA,EAAK;AAG7B,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA,oCAAA;AAAA,OACnD;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAA,CAAQ,KAAK,4EAA4E,CAAA;AAAA,EAC3F;AAIA,EAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,EAAA,OAAO,MAAA;AACT;ACaA,eAAsB,aAAA,CAAc;AAAA,EAClC,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA,GAAY,IAAA;AAAA,EACZ,MAAA,GAAS,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EACT,WAAA,GAAc,IAAA;AAAA,EACd,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR,OAAA,GAAU,IAAA;AAAA,EACV,cAAA,GAAiB,IAAA;AAAA,EACjB,KAAA,GAAQ,KAAA;AAAA,EACR,qBAAA,GAAwB;AAC1B,CAAA,EAAuB;AAErB,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,EAAA;AACF,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,sBAAA;AAEF,EAAA,IAAI,CAAC,kBAAkB,KAAA,EAAO;AAC5B,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAY,iBAAiB,cAAc,CAAA;AAKjD,EAAA,MAAM,gBAAA,GAAmB,MAAM,uBAAA,CAAwB,cAAA,EAAgB,cAAc,CAAA;AAErF,EAAA,uBACE,IAAA,CAAA,QAAA,EAAA,EACE,QAAA,EAAA;AAAA,oBAAA,GAAA,CAAC,UAAK,GAAA,EAAI,YAAA,EAAa,IAAA,EAAM,SAAA,EAAW,aAAY,WAAA,EAAY,CAAA;AAAA,oBAChE,GAAA,CAAC,MAAA,EAAA,EAAK,GAAA,EAAI,cAAA,EAAe,MAAM,SAAA,EAAW,CAAA;AAAA,IAEzC,2BAAW,GAAA,CAAC,cAAA,EAAA,EAAe,MAAA,EAAQ,cAAA,EAAgB,QAAQ,cAAA,EAAgB,CAAA;AAAA,IAC3E,cAAA,oBAAkB,GAAA,CAAC,cAAA,EAAA,EAAe,QAAA,EAAS,MAAA,EAAO,CAAA;AAAA,oBAInD,IAAA;AAAA,MAAC,sBAAA;AAAA,MAAA;AAAA,QACC,MAAA,EAAQ,gBAAA;AAAA,QACR,MAAA,EAAQ,cAAA;AAAA,QACR,SAAA;AAAA,QACA,SAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,WAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QAEC,QAAA,EAAA;AAAA,UAAA,QAAA;AAAA,UACA,qBAAA,mBACC,GAAA,CAAC,QAAA,EAAA,EAAO,SAAA,EAAU,SAAA,EAAU,aAAA,EAAY,MAAA,EACtC,QAAA,kBAAA,GAAA,CAAC,GAAA,EAAA,EAAE,IAAA,EAAK,WAAA,EAAY,QAAA,EAAA,UAAA,EAAQ,GAC9B,CAAA,GACE;AAAA;AAAA;AAAA,KACN;AAAA,IAGC,cAAA,oBAAkB,GAAA,CAAC,cAAA,EAAA,EAAe,QAAA,EAAS,UAAA,EAAW;AAAA,GAAA,EACzD,CAAA;AAEJ","file":"index.mjs","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * Resilience: if minting is unavailable (older API without the endpoint, token\n * auth not configured, transient outage) it returns the RAW KEY, so a build never\n * breaks. Domain-binding is log-only by default, so the raw key still works —\n * worst case is exactly pre-3.2 behavior. Memoized per raw key for the process,\n * so an entire `next build` mints ~once and every static page reuses one seed\n * (the client refreshes on the far side as needed).\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const now = Date.now()\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > now) return cached.credential\n\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  try {\n    const res = await fetch(`${base}${MINT_PATH}`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-api-key': rawKey,\n        'x-sitekit-version': SITE_KIT_VERSION,\n      },\n      cache: 'no-store',\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n          : undefined,\n    })\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: now + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n    } else if (res.status !== 404) {\n      // 404 = older API without the endpoint (expected during rollout). Anything\n      // else is worth a server-side note. Never logs the key value.\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; injecting raw key for this render.`,\n      )\n    }\n  } catch {\n    console.warn('[SiteKitLayout] Token mint unavailable; injecting raw key for this render.')\n  }\n\n  // Fallback: the raw key (pre-3.2 behavior). Short cache so a transient outage\n  // retries soon rather than pinning the raw key for the whole build.\n  cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n  return rawKey\n}\n","/**\n * @sonordev/site-kit/layout — SiteKitLayout\n *\n * The master layout component. A single RSC that auto-composes every\n * site-kit feature your layout needs:\n *\n * Server-side (RSC):\n *   - ManagedFavicon (link tags from Portal logo)\n *   - ManagedScripts position=\"head\" (tracking pixels, analytics tags)\n *   - ManagedScripts position=\"body-end\"\n *\n * Client-side (island):\n *   - AnalyticsProvider (page views, scroll depth, heatmap, web vitals)\n *   - EngageWidget (popups, nudges, chat)\n *   - SignalBridge (A/B experiments, behavior tracking)\n *   - SitemapSync (keeps Portal seo_pages in sync)\n *\n * @example\n * ```tsx\n * // app/layout.tsx\n * import { SiteKitLayout } from '@sonordev/site-kit/layout'\n *\n * export default function RootLayout({ children }) {\n *   return (\n *     <html lang=\"en\">\n *       <body>\n *         <SiteKitLayout>\n *           <Header />\n *           <main>{children}</main>\n *           <Footer />\n *         </SiteKitLayout>\n *       </body>\n *     </html>\n *   )\n * }\n * ```\n *\n * @example Opt out of specific features:\n * ```tsx\n * <SiteKitLayout engage={false} signal={false}>\n *   {children}\n * </SiteKitLayout>\n * ```\n */\n\nimport * as React from 'react'\nimport { ManagedFavicon } from '../images/ManagedFavicon'\nimport { ManagedScripts } from '../seo/ManagedScripts'\nimport { resolveApiOrigin } from '../server/server-fetch'\nimport { resolveClientCredential } from '../server/mint-site-token'\nimport { SiteKitClientProviders } from './SiteKitClientProviders'\nimport type { AnalyticsConfig, EngageConfig, SignalConfig } from './types'\n\nexport interface SiteKitLayoutProps {\n  children: React.ReactNode\n\n  /** Portal API key. Defaults to SONOR_API_KEY env var. */\n  apiKey?: string\n  /** Portal API URL. Defaults to env or https://api.sonor.io */\n  apiUrl?: string\n  /** Project ID (for Engage chat room routing). Auto-resolved if not provided. */\n  projectId?: string\n\n  /** Analytics tracking. true (default) | false | config object */\n  analytics?: boolean | AnalyticsConfig\n  /** Engage widgets (popups, chat). true (default) | false | config object */\n  engage?: boolean | EngageConfig\n  /** Signal AI (experiments, behavior). false (default) | true | config object */\n  signal?: boolean | SignalConfig\n  /** SitemapSync client component. Default: true */\n  sitemapSync?: boolean\n  /**\n   * Fleet heartbeat — reports this site's kit version + active modules to Sonor\n   * once per session so the platform can track version drift. Default: true.\n   * Deferred like Analytics; never in the hydration path.\n   */\n  fleet?: boolean\n  /**\n   * Defer client modules (Analytics, Engage, SitemapSync) until window load +\n   * idle or the first user interaction, keeping their JS and mount work out of\n   * the critical hydration path. Default: true. Pass false to restore legacy\n   * eager mounting. SignalBridge is never deferred.\n   */\n  defer?: boolean\n  /** ManagedFavicon in <head>. Default: true */\n  favicon?: boolean\n  /** ManagedScripts (head + body-end). Default: true */\n  managedScripts?: boolean\n\n  /** Debug mode — logs to console. Default: false */\n  debug?: boolean\n  /**\n   * When true, append a screen-reader-only link to `/llms.txt` after main content.\n   * Default false — prefer `buildAiDiscoveryHeaders()` for discovery.\n   */\n  showLlmsTxtFooterLink?: boolean\n}\n\nexport async function SiteKitLayout({\n  children,\n  apiKey,\n  apiUrl,\n  projectId,\n  analytics = true,\n  engage = true,\n  signal = false,\n  sitemapSync = true,\n  fleet = true,\n  defer = true,\n  favicon = true,\n  managedScripts = true,\n  debug = false,\n  showLlmsTxtFooterLink = false,\n}: SiteKitLayoutProps) {\n  // Resolve API config from env (server-side, safe)\n  const resolvedApiKey =\n    apiKey ??\n    process.env.SONOR_API_KEY ??\n    ''\n  const resolvedApiUrl =\n    apiUrl ??\n    process.env.SONOR_API_URL ??\n    'https://api.sonor.io'\n\n  if (!resolvedApiKey && debug) {\n    console.warn(\n      '[SiteKitLayout] No API key found. Set SONOR_API_KEY.',\n    )\n  }\n\n  const apiOrigin = resolveApiOrigin(resolvedApiUrl)\n\n  // Mint a short-lived client token so the raw key never reaches the browser.\n  // Falls back to the raw key if minting is unavailable (older API / transient\n  // outage) — the build never breaks. The client refreshes the token as needed.\n  const clientCredential = await resolveClientCredential(resolvedApiKey, resolvedApiUrl)\n\n  return (\n    <>\n      <link rel=\"preconnect\" href={apiOrigin} crossOrigin=\"anonymous\" />\n      <link rel=\"dns-prefetch\" href={apiOrigin} />\n      {/* Server-rendered head components */}\n      {favicon && <ManagedFavicon apiKey={resolvedApiKey} apiUrl={resolvedApiUrl} />}\n      {managedScripts && <ManagedScripts position=\"head\" />}\n\n      {/* Client-side providers island — receives the minted token (or raw-key\n          fallback), never the raw key when minting succeeds. */}\n      <SiteKitClientProviders\n        apiKey={clientCredential}\n        apiUrl={resolvedApiUrl}\n        projectId={projectId}\n        analytics={analytics}\n        engage={engage}\n        signal={signal}\n        sitemapSync={sitemapSync}\n        fleet={fleet}\n        defer={defer}\n        debug={debug}\n      >\n        {children}\n        {showLlmsTxtFooterLink ? (\n          <footer className=\"sr-only\" aria-hidden=\"true\">\n            <a href=\"/llms.txt\">llms.txt</a>\n          </footer>\n        ) : null}\n      </SiteKitClientProviders>\n\n      {/* Server-rendered body-end scripts */}\n      {managedScripts && <ManagedScripts position=\"body-end\" />}\n    </>\n  )\n}\n"]}

package/dist/maps/index.d.mts

@@ -102,9 +102,11 @@ declare function NeighborhoodMap({ center, propertyName, propertyAddress, classN
  */
 
 /**
- * Fetch Google Maps config (API key + map ID) from Sonor API.
+ * Fetch Google Maps config (public browser key + map ID) from Sonor API.
+ * The returned key is a dedicated, HTTP-referrer + API-restricted browser key —
+ * never Sonor's shared server secret — so it's safe to hand to the Maps SDK.
  * Falls back to NEXT_PUBLIC_GOOGLE_MAPS_API_KEY env var if the API
- * endpoint isn't available yet.
+ * endpoint isn't available or hasn't been provisioned with a browser key yet.
  * Cached for 5 minutes to avoid redundant calls.
  */
 declare function fetchMapsConfig(): Promise<MapsConfig | null>;

package/dist/maps/index.d.ts

@@ -102,9 +102,11 @@ declare function NeighborhoodMap({ center, propertyName, propertyAddress, classN
  */
 
 /**
- * Fetch Google Maps config (API key + map ID) from Sonor API.
+ * Fetch Google Maps config (public browser key + map ID) from Sonor API.
+ * The returned key is a dedicated, HTTP-referrer + API-restricted browser key —
+ * never Sonor's shared server secret — so it's safe to hand to the Maps SDK.
  * Falls back to NEXT_PUBLIC_GOOGLE_MAPS_API_KEY env var if the API
- * endpoint isn't available yet.
+ * endpoint isn't available or hasn't been provisioned with a browser key yet.
  * Cached for 5 minutes to avoid redundant calls.
  */
 declare function fetchMapsConfig(): Promise<MapsConfig | null>;

package/dist/maps/index.js

@@ -1,6 +1,8 @@
 'use client';
 'use strict';
 
+var chunkGMSPDTEV_js = require('../chunk-GMSPDTEV.js');
+require('../chunk-WAAFJPNR.js');
 require('../chunk-ZSMWDLMK.js');
 var react = require('react');
 var reactGoogleMaps = require('@vis.gl/react-google-maps');
@@ -126,19 +128,6 @@ function getApiConfig() {
   const apiKey = typeof window !== "undefined" ? window.__SITE_KIT_API_KEY__ || "" : process.env.SONOR_API_KEY || "";
   return { apiUrl, apiKey };
 }
-async function fetchWithRetry(url, headers, retries = 2) {
-  for (let attempt = 0; attempt <= retries; attempt++) {
-    const response = await fetch(url, { headers });
-    if (response.ok) return response;
-    if (response.status === 429 && attempt < retries) {
-      const delay = Math.pow(2, attempt + 1) * 1e3;
-      await new Promise((r) => setTimeout(r, delay));
-      continue;
-    }
-    return response;
-  }
-  throw new Error("fetchWithRetry exhausted");
-}
 var configCache = null;
 var CONFIG_CACHE_TTL = 3e5;
 var placesCache = /* @__PURE__ */ new Map();
@@ -150,9 +139,10 @@ async function fetchMapsConfig() {
   const { apiUrl, apiKey } = getApiConfig();
   if (apiKey) {
     try {
-      const res = await fetchWithRetry(
+      const res = await chunkGMSPDTEV_js.sonorFetch(
         `${apiUrl}/api/public/maps/config`,
-        { "Content-Type": "application/json", "x-api-key": apiKey }
+        { headers: { "Content-Type": "application/json" } },
+        { apiKey }
       );
       if (res.ok) {
         const data = await res.json();
@@ -189,9 +179,10 @@ async function fetchNearbyPlaces(params) {
     });
     if (params.radius) searchParams.set("radius", String(params.radius));
     if (params.limit) searchParams.set("limit", String(params.limit));
-    const res = await fetchWithRetry(
+    const res = await chunkGMSPDTEV_js.sonorFetch(
       `${apiUrl}/api/public/maps/nearby-places?${searchParams}`,
-      { "Content-Type": "application/json", "x-api-key": apiKey }
+      { headers: { "Content-Type": "application/json" } },
+      { apiKey }
     );
     if (!res.ok) return [];
     const data = await res.json();
@@ -199,7 +190,7 @@ async function fetchNearbyPlaces(params) {
     placesCache.set(cacheKey, { data: places, timestamp: Date.now() });
     return places;
   } catch (err) {
-    console.error("[site-kit/maps] Failed to fetch nearby places:", err);
+    console.warn("[site-kit/maps] Failed to fetch nearby places:", err);
     return [];
   }
 }