@sonordev/site-kit 3.3.1 → 3.4.0

package/dist/{chunk-QFWBAGBT.mjs.map → chunk-VNQFKBKF.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/signal/SignalBridge.tsx"],"names":[],"mappings":";;;;;AAoCA,IAAM,cAAA,GAAiB,OAAA;AAAA,EACrB,MAAM,OAAO,2BAAc,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,UAAA,EAAW,CAAE,CAAA;AAAA,EAClE,EAAE,KAAK,KAAA;AACT,CAAA;AAMA,IAAM,aAAA,GAAgB,cAAyC,IAAI,CAAA;AAE5D,SAAS,SAAA,GAAgC;AAC9C,EAAA,MAAM,OAAA,GAAU,WAAW,aAAa,CAAA;AACxC,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,MAAM,8CAA8C,CAAA;AAAA,EAChE;AACA,EAAA,OAAO,OAAA;AACT;AAMO,SAAS,YAAA,CAAa;AAAA,EAC3B,OAAA,GAAU,IAAA;AAAA,EACV,QAAA,GAAW,IAAA;AAAA,EACX,WAAA,GAAc,IAAA;AAAA,EACd,gBAAA,GAAmB,IAAA;AAAA,EACnB,SAAA,EAAW,iBAAA;AAAA,EACX,SAAA,EAAW,iBAAA;AAAA,EACX,eAAA;AAAA,EACA;AACF,CAAA,EAAsB;AACpB,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAI,SAA8B,IAAI,CAAA;AAC9D,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAI,SAAS,IAAI,CAAA;AAC3C,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAI,SAAuB,IAAI,CAAA;AAErD,EAAA,MAAM,OAAA,GAAU,OAA6B,IAAI,CAAA;AAGjD,EAAA,MAAM,gBAAA,GAAmB,MAAA,CAA+B,EAAE,CAAA;AAC1D,EAAA,MAAM,kBAAA,GAAqB,MAAA,CAAwB,EAAE,CAAA;AAErD,EAAA,MAAM,WAAA,GAAc,WAAA,CAAY,CAAC,KAAA,KAA2B;AAC1D,IAAA,SAAA,CAAU,MAAM,MAAM,CAAA;AACtB,IAAA,UAAA,CAAW,MAAM,OAAO,CAAA;AACxB,IAAA,QAAA,CAAS,MAAM,KAAK,CAAA;AAAA,EACtB,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,cAAA,GAAiB,WAAA,CAAY,CAAC,GAAA,KAA8B;AAChE,IAAA,OAAA,CAAQ,OAAA,GAAU,GAAA;AAClB,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,gBAAA,CAAiB,OAAA,CAAQ,OAAO,CAAC,CAAA,CAAE,QAAQ,CAAA,KAAA,KAAS,GAAA,CAAI,UAAA,CAAW,KAAK,CAAC,CAAA;AACzE,MAAA,kBAAA,CAAmB,OAAA,CAAQ,OAAO,CAAC,CAAA,CAAE,QAAQ,CAAA,OAAA,KAAW,GAAA,CAAI,YAAA,CAAa,OAAO,CAAC,CAAA;AAAA,IACnF;AAAA,EACF,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,UAAA,GAAa,WAAA,CAAY,CAAC,KAAA,KAAgC;AAC9D,IAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,MAAA,OAAA,CAAQ,OAAA,CAAQ,WAAW,KAAK,CAAA;AAAA,IAClC,CAAA,MAAO;AACL,MAAA,gBAAA,CAAiB,OAAA,CAAQ,KAAK,KAAK,CAAA;AAAA,IACrC;AAAA,EACF,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,YAAA,GAAe,WAAA,CAAY,CAAC,OAAA,KAA2B;AAC3D,IAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,MAAA,OAAA,CAAQ,OAAA,CAAQ,aAAa,OAAO,CAAA;AAAA,IACtC,CAAA,MAAO;AACL,MAAA,kBAAA,CAAmB,OAAA,CAAQ,KAAK,OAAO,CAAA;AAAA,IACzC;AAAA,EACF,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,aAAA,GAAgB,WAAA,CAAY,CAAC,YAAA,KAAsD;AAGvF,IAAA,OAAO,OAAA,CAAQ,OAAA,EAAS,aAAA,CAAc,YAAY,CAAA,IAAK,IAAA;AAAA,EACzD,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,aAAA,GAAgB,YAAY,YAAY;AAC5C,IAAA,MAAM,OAAA,CAAQ,SAAS,aAAA,EAAc;AAAA,EACvC,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,YAAA,GAAe,QAA4B,OAAO;AAAA,IACtD,MAAA;AAAA,IACA,OAAA;AAAA,IACA,KAAA;AAAA,IACA,UAAA;AAAA,IACA,YAAA;AAAA,IACA,aAAA;AAAA,IACA;AAAA,GACF,CAAA,EAAI,CAAC,MAAA,EAAQ,OAAA,EAAS,OAAO,UAAA,EAAY,YAAA,EAAc,aAAA,EAAe,aAAa,CAAC,CAAA;AAEpF,EAAA,uBACE,IAAA,CAAC,aAAA,CAAc,QAAA,EAAd,EAAuB,OAAO,YAAA,EAC5B,QAAA,EAAA;AAAA,IAAA,QAAA;AAAA,IACA,OAAA,oBACC,GAAA;AAAA,MAAC,cAAA;AAAA,MAAA;AAAA,QACC,OAAA;AAAA,QACA,QAAA;AAAA,QACA,WAAA;AAAA,QACA,gBAAA;AAAA,QACA,iBAAA;AAAA,QACA,iBAAA;AAAA,QACA,eAAA;AAAA,QACA,UAAA,EAAY,cAAA;AAAA,QACZ,OAAA,EAAS;AAAA;AAAA;AACX,GAAA,EAEJ,CAAA;AAEJ;AASO,SAAS,eAAA,GAAuC;AACrD,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,SAAA,EAAU;AAC7B,EAAA,OAAO,MAAA;AACT;AAKO,SAAS,cAAA,GAAiB;AAC/B,EAAA,MAAM,EAAE,UAAA,EAAW,GAAI,SAAA,EAAU;AACjC,EAAA,OAAO,UAAA;AACT;AAKO,SAAS,gBAAA,GAAmB;AACjC,EAAA,MAAM,EAAE,YAAA,EAAa,GAAI,SAAA,EAAU;AACnC,EAAA,OAAO,EAAE,YAAA,EAAa;AACxB;AAKO,SAAS,oBAAoB,YAAA,EAIlC;AACA,EAAA,MAAM,EAAE,aAAA,EAAe,MAAA,EAAO,GAAI,SAAA,EAAU;AAC5C,EAAA,MAAM,UAAA,GAAa,cAAc,YAAY,CAAA;AAG7C,EAAA,MAAM,aAAa,MAAA,EAAQ,WAAA,EAAa,KAAK,CAAA,CAAA,KAAK,CAAA,CAAE,OAAO,YAAY,CAAA;AACvE,EAAA,MAAM,SAAA,GAAY,YAAY,MAAA,KAAW,SAAA;AAEzC,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,YAAY,UAAA,GAAa,IAAA;AAAA,IACrC,OAAA,EAAS,SAAA,IAAa,UAAA,GAAa,UAAA,CAAW,WAAA,GAAc,IAAA;AAAA,IAC5D,SAAA,EAAW,CAAC,UAAA,IAAc,UAAA,CAAW,WAAA,KAAgB;AAAA,GACvD;AACF","file":"chunk-QFWBAGBT.mjs","sourcesContent":["/**\n * @sonordev/site-kit/signal - SignalBridge\n *\n * Central coordination layer for Signal AI integration.\n *\n * Architecture (2026-07 perf release): SignalBridge is a tiny SSR-SAFE context shell. It\n * renders {children} immediately — children server-render and hydrate\n * normally, no ssr:false wrapper — and lazy-loads the heavy machinery\n * (SignalCore: config fetch, SSE streaming, experiment assignment, event\n * queue, behavior tracking) as a CHILDLESS sibling. The core registers its\n * imperative API into the shell on mount; `trackEvent`/`trackOutcome` calls\n * made before the core is ready are buffered and drained on registration.\n *\n * This removes the old failure mode where enabling `signal` de-opted the\n * whole route to client rendering (the same SSR bailout the analytics\n * sibling-mount fixed) — the #1 recommendation of the 2026-07 perf audit.\n *\n * The core is NOT idle-deferred: experiment variants must apply as early as\n * possible, so it starts loading on hydration.\n */\n\n'use client'\n\nimport React, { createContext, useCallback, useContext, useMemo, useRef, useState } from 'react'\nimport dynamic from 'next/dynamic'\nimport type { SignalCoreApi, SignalCoreState } from './SignalCore'\nimport type {\n  SignalConfig,\n  SignalContextValue,\n  SignalBridgeProps,\n  SignalEvent,\n  SignalOutcome,\n  ExperimentAssignment,\n} from './types'\n\n// Heavy machinery — loaded client-side only, never wraps content.\nconst LazySignalCore = dynamic(\n  () => import('./SignalCore').then(m => ({ default: m.SignalCore })),\n  { ssr: false },\n)\n\n// ============================================\n// Context\n// ============================================\n\nconst SignalContext = createContext<SignalContextValue | null>(null)\n\nexport function useSignal(): SignalContextValue {\n  const context = useContext(SignalContext)\n  if (!context) {\n    throw new Error('useSignal must be used within a SignalBridge')\n  }\n  return context\n}\n\n// ============================================\n// SignalBridge Component (shell)\n// ============================================\n\nexport function SignalBridge({\n  enabled = true,\n  realtime = true,\n  experiments = true,\n  behaviorTracking = true,\n  visitorId: externalVisitorId,\n  sessionId: externalSessionId,\n  pageMetadataRef,\n  children,\n}: SignalBridgeProps) {\n  const [config, setConfig] = useState<SignalConfig | null>(null)\n  const [loading, setLoading] = useState(true)\n  const [error, setError] = useState<Error | null>(null)\n\n  const coreRef = useRef<SignalCoreApi | null>(null)\n  // Calls made before the core chunk loads are buffered here and drained on\n  // registration — consumers can call trackEvent/trackOutcome from first render.\n  const pendingEventsRef = useRef<Partial<SignalEvent>[]>([])\n  const pendingOutcomesRef = useRef<SignalOutcome[]>([])\n\n  const handleState = useCallback((state: SignalCoreState) => {\n    setConfig(state.config)\n    setLoading(state.loading)\n    setError(state.error)\n  }, [])\n\n  const handleRegister = useCallback((api: SignalCoreApi | null) => {\n    coreRef.current = api\n    if (api) {\n      pendingEventsRef.current.splice(0).forEach(event => api.trackEvent(event))\n      pendingOutcomesRef.current.splice(0).forEach(outcome => api.trackOutcome(outcome))\n    }\n  }, [])\n\n  const trackEvent = useCallback((event: Partial<SignalEvent>) => {\n    if (coreRef.current) {\n      coreRef.current.trackEvent(event)\n    } else {\n      pendingEventsRef.current.push(event)\n    }\n  }, [])\n\n  const trackOutcome = useCallback((outcome: SignalOutcome) => {\n    if (coreRef.current) {\n      coreRef.current.trackOutcome(outcome)\n    } else {\n      pendingOutcomesRef.current.push(outcome)\n    }\n  }, [])\n\n  const getExperiment = useCallback((experimentId: string): ExperimentAssignment | null => {\n    // null before the core loads — identical to the pre-config-fetch behavior\n    // consumers already handle via `loading`.\n    return coreRef.current?.getExperiment(experimentId) ?? null\n  }, [])\n\n  const refreshConfig = useCallback(async () => {\n    await coreRef.current?.refreshConfig()\n  }, [])\n\n  const contextValue = useMemo<SignalContextValue>(() => ({\n    config,\n    loading,\n    error,\n    trackEvent,\n    trackOutcome,\n    getExperiment,\n    refreshConfig,\n  }), [config, loading, error, trackEvent, trackOutcome, getExperiment, refreshConfig])\n\n  return (\n    <SignalContext.Provider value={contextValue}>\n      {children}\n      {enabled && (\n        <LazySignalCore\n          enabled={enabled}\n          realtime={realtime}\n          experiments={experiments}\n          behaviorTracking={behaviorTracking}\n          externalVisitorId={externalVisitorId}\n          externalSessionId={externalSessionId}\n          pageMetadataRef={pageMetadataRef}\n          onRegister={handleRegister}\n          onState={handleState}\n        />\n      )}\n    </SignalContext.Provider>\n  )\n}\n\n// ============================================\n// Convenience Hooks\n// ============================================\n\n/**\n * Hook to access Signal config\n */\nexport function useSignalConfig(): SignalConfig | null {\n  const { config } = useSignal()\n  return config\n}\n\n/**\n * Hook for tracking events\n */\nexport function useSignalEvent() {\n  const { trackEvent } = useSignal()\n  return trackEvent\n}\n\n/**\n * Hook for tracking outcomes/conversions\n */\nexport function useSignalOutcome() {\n  const { trackOutcome } = useSignal()\n  return { trackOutcome }\n}\n\n/**\n * Hook for experiment assignment\n */\nexport function useSignalExperiment(experimentId: string): {\n  assignment: ExperimentAssignment | null\n  variant: string | null\n  isControl: boolean\n} {\n  const { getExperiment, config } = useSignal()\n  const assignment = getExperiment(experimentId)\n\n  // Check if experiment is running\n  const experiment = config?.experiments?.find(e => e.id === experimentId)\n  const isRunning = experiment?.status === 'running'\n\n  return {\n    assignment: isRunning ? assignment : null,\n    variant: isRunning && assignment ? assignment.variant_key : null,\n    isControl: !assignment || assignment.variant_key === 'control',\n  }\n}\n"]}
+{"version":3,"sources":["../src/signal/SignalBridge.tsx"],"names":[],"mappings":";;;;;AAoCA,IAAM,cAAA,GAAiB,OAAA;AAAA,EACrB,MAAM,OAAO,2BAAc,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,UAAA,EAAW,CAAE,CAAA;AAAA,EAClE,EAAE,KAAK,KAAA;AACT,CAAA;AAMA,IAAM,aAAA,GAAgB,cAAyC,IAAI,CAAA;AAE5D,SAAS,SAAA,GAAgC;AAC9C,EAAA,MAAM,OAAA,GAAU,WAAW,aAAa,CAAA;AACxC,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,MAAM,8CAA8C,CAAA;AAAA,EAChE;AACA,EAAA,OAAO,OAAA;AACT;AAMO,SAAS,YAAA,CAAa;AAAA,EAC3B,OAAA,GAAU,IAAA;AAAA,EACV,QAAA,GAAW,IAAA;AAAA,EACX,WAAA,GAAc,IAAA;AAAA,EACd,gBAAA,GAAmB,IAAA;AAAA,EACnB,SAAA,EAAW,iBAAA;AAAA,EACX,SAAA,EAAW,iBAAA;AAAA,EACX,eAAA;AAAA,EACA;AACF,CAAA,EAAsB;AACpB,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAI,SAA8B,IAAI,CAAA;AAC9D,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAI,SAAS,IAAI,CAAA;AAC3C,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAI,SAAuB,IAAI,CAAA;AAErD,EAAA,MAAM,OAAA,GAAU,OAA6B,IAAI,CAAA;AAGjD,EAAA,MAAM,gBAAA,GAAmB,MAAA,CAA+B,EAAE,CAAA;AAC1D,EAAA,MAAM,kBAAA,GAAqB,MAAA,CAAwB,EAAE,CAAA;AAErD,EAAA,MAAM,WAAA,GAAc,WAAA,CAAY,CAAC,KAAA,KAA2B;AAC1D,IAAA,SAAA,CAAU,MAAM,MAAM,CAAA;AACtB,IAAA,UAAA,CAAW,MAAM,OAAO,CAAA;AACxB,IAAA,QAAA,CAAS,MAAM,KAAK,CAAA;AAAA,EACtB,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,cAAA,GAAiB,WAAA,CAAY,CAAC,GAAA,KAA8B;AAChE,IAAA,OAAA,CAAQ,OAAA,GAAU,GAAA;AAClB,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,gBAAA,CAAiB,OAAA,CAAQ,OAAO,CAAC,CAAA,CAAE,QAAQ,CAAA,KAAA,KAAS,GAAA,CAAI,UAAA,CAAW,KAAK,CAAC,CAAA;AACzE,MAAA,kBAAA,CAAmB,OAAA,CAAQ,OAAO,CAAC,CAAA,CAAE,QAAQ,CAAA,OAAA,KAAW,GAAA,CAAI,YAAA,CAAa,OAAO,CAAC,CAAA;AAAA,IACnF;AAAA,EACF,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,UAAA,GAAa,WAAA,CAAY,CAAC,KAAA,KAAgC;AAC9D,IAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,MAAA,OAAA,CAAQ,OAAA,CAAQ,WAAW,KAAK,CAAA;AAAA,IAClC,CAAA,MAAO;AACL,MAAA,gBAAA,CAAiB,OAAA,CAAQ,KAAK,KAAK,CAAA;AAAA,IACrC;AAAA,EACF,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,YAAA,GAAe,WAAA,CAAY,CAAC,OAAA,KAA2B;AAC3D,IAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,MAAA,OAAA,CAAQ,OAAA,CAAQ,aAAa,OAAO,CAAA;AAAA,IACtC,CAAA,MAAO;AACL,MAAA,kBAAA,CAAmB,OAAA,CAAQ,KAAK,OAAO,CAAA;AAAA,IACzC;AAAA,EACF,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,aAAA,GAAgB,WAAA,CAAY,CAAC,YAAA,KAAsD;AAGvF,IAAA,OAAO,OAAA,CAAQ,OAAA,EAAS,aAAA,CAAc,YAAY,CAAA,IAAK,IAAA;AAAA,EACzD,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,aAAA,GAAgB,YAAY,YAAY;AAC5C,IAAA,MAAM,OAAA,CAAQ,SAAS,aAAA,EAAc;AAAA,EACvC,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,YAAA,GAAe,QAA4B,OAAO;AAAA,IACtD,MAAA;AAAA,IACA,OAAA;AAAA,IACA,KAAA;AAAA,IACA,UAAA;AAAA,IACA,YAAA;AAAA,IACA,aAAA;AAAA,IACA;AAAA,GACF,CAAA,EAAI,CAAC,MAAA,EAAQ,OAAA,EAAS,OAAO,UAAA,EAAY,YAAA,EAAc,aAAA,EAAe,aAAa,CAAC,CAAA;AAEpF,EAAA,uBACE,IAAA,CAAC,aAAA,CAAc,QAAA,EAAd,EAAuB,OAAO,YAAA,EAC5B,QAAA,EAAA;AAAA,IAAA,QAAA;AAAA,IACA,OAAA,oBACC,GAAA;AAAA,MAAC,cAAA;AAAA,MAAA;AAAA,QACC,OAAA;AAAA,QACA,QAAA;AAAA,QACA,WAAA;AAAA,QACA,gBAAA;AAAA,QACA,iBAAA;AAAA,QACA,iBAAA;AAAA,QACA,eAAA;AAAA,QACA,UAAA,EAAY,cAAA;AAAA,QACZ,OAAA,EAAS;AAAA;AAAA;AACX,GAAA,EAEJ,CAAA;AAEJ;AASO,SAAS,eAAA,GAAuC;AACrD,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,SAAA,EAAU;AAC7B,EAAA,OAAO,MAAA;AACT;AAKO,SAAS,cAAA,GAAiB;AAC/B,EAAA,MAAM,EAAE,UAAA,EAAW,GAAI,SAAA,EAAU;AACjC,EAAA,OAAO,UAAA;AACT;AAKO,SAAS,gBAAA,GAAmB;AACjC,EAAA,MAAM,EAAE,YAAA,EAAa,GAAI,SAAA,EAAU;AACnC,EAAA,OAAO,EAAE,YAAA,EAAa;AACxB;AAKO,SAAS,oBAAoB,YAAA,EAIlC;AACA,EAAA,MAAM,EAAE,aAAA,EAAe,MAAA,EAAO,GAAI,SAAA,EAAU;AAC5C,EAAA,MAAM,UAAA,GAAa,cAAc,YAAY,CAAA;AAG7C,EAAA,MAAM,aAAa,MAAA,EAAQ,WAAA,EAAa,KAAK,CAAA,CAAA,KAAK,CAAA,CAAE,OAAO,YAAY,CAAA;AACvE,EAAA,MAAM,SAAA,GAAY,YAAY,MAAA,KAAW,SAAA;AAEzC,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,YAAY,UAAA,GAAa,IAAA;AAAA,IACrC,OAAA,EAAS,SAAA,IAAa,UAAA,GAAa,UAAA,CAAW,WAAA,GAAc,IAAA;AAAA,IAC5D,SAAA,EAAW,CAAC,UAAA,IAAc,UAAA,CAAW,WAAA,KAAgB;AAAA,GACvD;AACF","file":"chunk-VNQFKBKF.mjs","sourcesContent":["/**\n * @sonordev/site-kit/signal - SignalBridge\n *\n * Central coordination layer for Signal AI integration.\n *\n * Architecture (2026-07 perf release): SignalBridge is a tiny SSR-SAFE context shell. It\n * renders {children} immediately — children server-render and hydrate\n * normally, no ssr:false wrapper — and lazy-loads the heavy machinery\n * (SignalCore: config fetch, SSE streaming, experiment assignment, event\n * queue, behavior tracking) as a CHILDLESS sibling. The core registers its\n * imperative API into the shell on mount; `trackEvent`/`trackOutcome` calls\n * made before the core is ready are buffered and drained on registration.\n *\n * This removes the old failure mode where enabling `signal` de-opted the\n * whole route to client rendering (the same SSR bailout the analytics\n * sibling-mount fixed) — the #1 recommendation of the 2026-07 perf audit.\n *\n * The core is NOT idle-deferred: experiment variants must apply as early as\n * possible, so it starts loading on hydration.\n */\n\n'use client'\n\nimport React, { createContext, useCallback, useContext, useMemo, useRef, useState } from 'react'\nimport dynamic from 'next/dynamic'\nimport type { SignalCoreApi, SignalCoreState } from './SignalCore'\nimport type {\n  SignalConfig,\n  SignalContextValue,\n  SignalBridgeProps,\n  SignalEvent,\n  SignalOutcome,\n  ExperimentAssignment,\n} from './types'\n\n// Heavy machinery — loaded client-side only, never wraps content.\nconst LazySignalCore = dynamic(\n  () => import('./SignalCore').then(m => ({ default: m.SignalCore })),\n  { ssr: false },\n)\n\n// ============================================\n// Context\n// ============================================\n\nconst SignalContext = createContext<SignalContextValue | null>(null)\n\nexport function useSignal(): SignalContextValue {\n  const context = useContext(SignalContext)\n  if (!context) {\n    throw new Error('useSignal must be used within a SignalBridge')\n  }\n  return context\n}\n\n// ============================================\n// SignalBridge Component (shell)\n// ============================================\n\nexport function SignalBridge({\n  enabled = true,\n  realtime = true,\n  experiments = true,\n  behaviorTracking = true,\n  visitorId: externalVisitorId,\n  sessionId: externalSessionId,\n  pageMetadataRef,\n  children,\n}: SignalBridgeProps) {\n  const [config, setConfig] = useState<SignalConfig | null>(null)\n  const [loading, setLoading] = useState(true)\n  const [error, setError] = useState<Error | null>(null)\n\n  const coreRef = useRef<SignalCoreApi | null>(null)\n  // Calls made before the core chunk loads are buffered here and drained on\n  // registration — consumers can call trackEvent/trackOutcome from first render.\n  const pendingEventsRef = useRef<Partial<SignalEvent>[]>([])\n  const pendingOutcomesRef = useRef<SignalOutcome[]>([])\n\n  const handleState = useCallback((state: SignalCoreState) => {\n    setConfig(state.config)\n    setLoading(state.loading)\n    setError(state.error)\n  }, [])\n\n  const handleRegister = useCallback((api: SignalCoreApi | null) => {\n    coreRef.current = api\n    if (api) {\n      pendingEventsRef.current.splice(0).forEach(event => api.trackEvent(event))\n      pendingOutcomesRef.current.splice(0).forEach(outcome => api.trackOutcome(outcome))\n    }\n  }, [])\n\n  const trackEvent = useCallback((event: Partial<SignalEvent>) => {\n    if (coreRef.current) {\n      coreRef.current.trackEvent(event)\n    } else {\n      pendingEventsRef.current.push(event)\n    }\n  }, [])\n\n  const trackOutcome = useCallback((outcome: SignalOutcome) => {\n    if (coreRef.current) {\n      coreRef.current.trackOutcome(outcome)\n    } else {\n      pendingOutcomesRef.current.push(outcome)\n    }\n  }, [])\n\n  const getExperiment = useCallback((experimentId: string): ExperimentAssignment | null => {\n    // null before the core loads — identical to the pre-config-fetch behavior\n    // consumers already handle via `loading`.\n    return coreRef.current?.getExperiment(experimentId) ?? null\n  }, [])\n\n  const refreshConfig = useCallback(async () => {\n    await coreRef.current?.refreshConfig()\n  }, [])\n\n  const contextValue = useMemo<SignalContextValue>(() => ({\n    config,\n    loading,\n    error,\n    trackEvent,\n    trackOutcome,\n    getExperiment,\n    refreshConfig,\n  }), [config, loading, error, trackEvent, trackOutcome, getExperiment, refreshConfig])\n\n  return (\n    <SignalContext.Provider value={contextValue}>\n      {children}\n      {enabled && (\n        <LazySignalCore\n          enabled={enabled}\n          realtime={realtime}\n          experiments={experiments}\n          behaviorTracking={behaviorTracking}\n          externalVisitorId={externalVisitorId}\n          externalSessionId={externalSessionId}\n          pageMetadataRef={pageMetadataRef}\n          onRegister={handleRegister}\n          onState={handleState}\n        />\n      )}\n    </SignalContext.Provider>\n  )\n}\n\n// ============================================\n// Convenience Hooks\n// ============================================\n\n/**\n * Hook to access Signal config\n */\nexport function useSignalConfig(): SignalConfig | null {\n  const { config } = useSignal()\n  return config\n}\n\n/**\n * Hook for tracking events\n */\nexport function useSignalEvent() {\n  const { trackEvent } = useSignal()\n  return trackEvent\n}\n\n/**\n * Hook for tracking outcomes/conversions\n */\nexport function useSignalOutcome() {\n  const { trackOutcome } = useSignal()\n  return { trackOutcome }\n}\n\n/**\n * Hook for experiment assignment\n */\nexport function useSignalExperiment(experimentId: string): {\n  assignment: ExperimentAssignment | null\n  variant: string | null\n  isControl: boolean\n} {\n  const { getExperiment, config } = useSignal()\n  const assignment = getExperiment(experimentId)\n\n  // Check if experiment is running\n  const experiment = config?.experiments?.find(e => e.id === experimentId)\n  const isRunning = experiment?.status === 'running'\n\n  return {\n    assignment: isRunning ? assignment : null,\n    variant: isRunning && assignment ? assignment.variant_key : null,\n    isControl: !assignment || assignment.variant_key === 'control',\n  }\n}\n"]}

package/dist/{chunk-GUU3AEFM.mjs → chunk-WS4GNH3F.mjs}

@@ -1,4 +1,4 @@
-import { SITE_KIT_VERSION } from './chunk-K6YGF2KJ.mjs';
+import { SITE_KIT_VERSION } from './chunk-YCQHE2XT.mjs';
 
 // src/shared/siteToken.ts
 var SITE_TOKEN_PREFIX = "st1.";
@@ -254,6 +254,6 @@ function sonorBeacon(url, payload, apiKey) {
   }
 }
 
-export { configureSiteCredential, currentCredential, sonorBeacon, sonorFetch };
-//# sourceMappingURL=chunk-GUU3AEFM.mjs.map
-//# sourceMappingURL=chunk-GUU3AEFM.mjs.map
+export { configureSiteCredential, currentCredential, getFreshCredential, isSiteToken, sonorBeacon, sonorFetch };
+//# sourceMappingURL=chunk-WS4GNH3F.mjs.map
+//# sourceMappingURL=chunk-WS4GNH3F.mjs.map

package/dist/{chunk-GUU3AEFM.mjs.map → chunk-WS4GNH3F.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/siteToken.ts","../src/shared/fetchWithRetry.ts","../src/shared/sonorFetch.ts"],"names":[],"mappings":";;;AAuBO,IAAM,iBAAA,GAAoB,MAAA;AAGjC,IAAM,kBAAkB,CAAA,GAAI,GAAA;AAC5B,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,WAAA,GAAc,sBAAA;AAEb,SAAS,YAAY,UAAA,EAAqC;AAC/D,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,IAAY,UAAA,CAAW,WAAW,iBAAiB,CAAA;AAClF;AASO,SAAS,sBAAsB,KAAA,EAA6C;AACjF,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,MAAM,GAAA,GAAO,KAAA,CAAiB,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC1C,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,IAAI;AAEF,IAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACpD,IAAA,MAAM,IAAA,GACJ,OAAO,IAAA,KAAS,UAAA,GACZ,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACnD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,IAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,GAAS,MAAA,GAAS,IAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOO,SAAS,oBAAoB,UAAA,EAAoC;AACtE,EAAA,IAAI,CAAC,YAAY,OAAO,aAAA;AACxB,EAAA,MAAM,MAAA,GAAS,sBAAsB,UAAU,CAAA;AAC/C,EAAA,IAAI,MAAA,EAAQ,GAAA,EAAK,OAAO,CAAA,IAAA,EAAO,OAAO,GAAG,CAAA,CAAA;AACzC,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B;AAeA,IAAM,KAAA,GAAoB;AAAA,EACxB,IAAA,EAAM,MAAA;AAAA,EACN,OAAA,EAAS,KAAA;AAAA,EACT,MAAA,EAAQ,sBAAA;AAAA,EACR,KAAA,EAAO,IAAA;AAAA,EACP,UAAA,EAAY;AACd,CAAA;AAEA,SAAS,eAAA,GAAiC;AACxC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AACrD,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,OAAO,MAAA,EAAQ,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ,IAAA;AAAA,EAC5D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAW,KAAA,EAAqB;AACvC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACnC,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,cAAA,CAAe,QAAQ,WAAA,EAAa,IAAA,CAAK,UAAU,EAAE,KAAA,EAAO,CAAC,CAAA;AAAA,EACtE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA;AAAC,IAAC,OAAe,oBAAA,GAAuB,KAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,SAAS,KAAA,EAA8B;AAC9C,EAAA,MAAM,MAAA,GAAS,sBAAsB,KAAK,CAAA;AAC1C,EAAA,OAAO,OAAO,MAAA,EAAQ,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,MAAM,GAAA,GAAO,CAAA;AAC/D;AAMO,SAAS,wBAAwB,IAAA,EAG/B;AACP,EAAA,KAAA,CAAM,OAAO,IAAA,CAAK,UAAA;AAClB,EAAA,KAAA,CAAM,OAAA,GAAU,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,QAAQ,KAAA,CAAM,MAAA,GAAS,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAE9D,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,IAAA;AAAA,EACF;AAKA,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,EAAA,IAAI,IAAA,GAAO,KAAK,UAAA,IAAc,IAAA;AAC9B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,IAAI,UAAU,QAAA,CAAS,MAAM,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,MAAA;AACxD,EAAA,IAAI,SAAS,QAAA,CAAS,KAAK,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,KAAA;AACtD,EAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AAChB;AAEA,SAAS,YAAA,GAAwB;AAC/B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,KAAA;AAC3B,EAAA,IAAI,CAAC,KAAA,CAAM,KAAA,EAAO,OAAO,IAAA;AACzB,EAAA,OAAO,KAAK,GAAA,EAAI,IAAK,QAAA,CAAS,KAAA,CAAM,KAAK,CAAA,GAAI,eAAA;AAC/C;AAEA,eAAe,SAAA,GAAoC;AACjD,EAAA,MAAM,UAAU,KAAA,CAAM,KAAA;AACtB,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,8BAAA,CAAA,EAAkC;AAAA,MACvE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqB,gBAAA;AAAA;AAAA;AAAA,QAGrB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACvC,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,kBAAkB,CAAA,GACtC,KAAA;AAAA,KACP,CAAA;AACD,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,OAAO,IAAA;AACpB,IAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC9C,IAAA,MAAM,OAAO,IAAA,EAAM,KAAA;AACnB,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,WAAA,CAAY,IAAI,CAAA,EAAG;AACjD,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,UAAA,CAAW,IAAI,CAAA;AACf,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,gBAAA,GAA2C;AACzD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,UAAA,EAAY,OAAO,KAAA,CAAM,UAAA;AACnC,EAAA,KAAA,CAAM,UAAA,GAAa,SAAA,EAAU,CAAE,OAAA,CAAQ,MAAM;AAC3C,IAAA,KAAA,CAAM,UAAA,GAAa,IAAA;AAAA,EACrB,CAAC,CAAA;AACD,EAAA,OAAO,KAAA,CAAM,UAAA;AACf;AAMA,eAAsB,mBACpB,IAAA,EAC6B;AAE7B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,IAAI,cAAa,EAAG;AAClB,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,WAAW,OAAO,SAAA;AAAA,EAGxB;AACA,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC;AAGO,SAAS,WAAA,GAAuB;AACrC,EAAA,OAAO,KAAA,CAAM,OAAA;AACf;AAOO,SAAS,kBAAkB,IAAA,EAAmC;AACnE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC;;;ACjNA,SAAS,YAAA,CAAa,SAAiB,QAAA,EAA6B;AAElE,EAAA,IAAI,QAAA,EAAU,WAAW,GAAA,EAAK;AAC5B,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,MAAA,GAAS,QAAA,CAAS,MAAA,EAAQ,EAAE,CAAA,GAAI,GAAA;AAChD,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,IAAK,OAAA,GAAU,CAAA,EAAG,OAAO,IAAA,CAAK,GAAA,CAAI,OAAA,GAAU,GAAA,EAAM,GAAK,CAAA;AAAA,EAClF;AAEA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,GAAA,EAAM,GAAA,GAAM,KAAK,OAAO,CAAA;AAC1C;AASA,eAAsB,cAAA,CACpB,GAAA,EACA,IAAA,EACA,OAAA,GAA6B,EAAC,EACX;AACnB,EAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,IAAA;AACvC,EAAA,IAAI,SAAA;AAEJ,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,OAAA,EAAS,OAAA,EAAA,EAAW;AACnD,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,MAAA,YAAA,CAAa,KAAK,CAAA;AAElB,MAAA,IAAA,CAAK,SAAS,MAAA,KAAW,GAAA,IAAO,SAAS,MAAA,IAAU,GAAA,KAAQ,UAAU,OAAA,EAAS;AAC5E,QAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY,UAAA,CAAW,SAAS,YAAA,CAAa,OAAA,EAAS,QAAQ,CAAC,CAAC,CAAA;AACnF,QAAA;AAAA,MACF;AACA,MAAA,OAAO,QAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,SAAA,GAAY,KAAA;AAEZ,MAAA,IAAI,UAAU,OAAA,EAAS;AACrB,QAAA,MAAM,IAAI,QAAQ,CAAC,OAAA,KAAY,WAAW,OAAA,EAAS,YAAA,CAAa,OAAO,CAAC,CAAC,CAAA;AACzE,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,YAAqB,KAAA,GACvB,SAAA,GACA,IAAI,MAAM,mEAAmE,CAAA;AACnF;;;AC7BA,IAAM,gBAAgB,CAAA,GAAI,GAAA;AAI1B,IAAM,UAAA,uBAAiB,GAAA,EAAoB;AAC3C,IAAI,cAAA,GAAiB,KAAA;AAGd,SAAS,aAAa,UAAA,EAA8B;AACzD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,MAAM,EAAA,GAAK,oBAAoB,UAAU,CAAA;AACzC,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,EAAE,CAAA;AAC/B,EAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,EAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,KAAA,EAAO;AACvB,IAAA,UAAA,CAAW,OAAO,EAAE,CAAA;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,YAAY,UAAA,EAA2B;AAC9C,EAAA,UAAA,CAAW,IAAI,mBAAA,CAAoB,UAAU,GAAG,IAAA,CAAK,GAAA,KAAQ,aAAa,CAAA;AAC1E,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,cAAA,GAAiB,IAAA;AAGjB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AACF;AAEA,eAAsB,WACpB,GAAA,EACA,IAAA,GAAoB,EAAC,EACrB,OAAA,GAA6B,EAAC,EACX;AAGnB,EAAA,IAAI,aAAa,OAAA,CAAQ,MAAA;AACzB,EAAA,IAAI,UAAA,KAAe,MAAA,IAAa,WAAA,EAAY,EAAG;AAC7C,IAAA,UAAA,GAAa,MAAM,kBAAA,CAAmB,OAAA,CAAQ,MAAM,CAAA;AAAA,EACtD;AAEA,EAAA,MAAM,UAAU,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAC9C,EAAA,OAAA,CAAQ,GAAA,CAAI,qBAAqB,gBAAgB,CAAA;AACjD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,IAAI,aAAY,EAAG;AASjB,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AACnC,MAAA,OAAA,CAAQ,OAAO,eAAe,CAAA;AAAA,IAChC,CAAA,MAAA,IAAW,CAAC,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG;AAEpC,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AAAA,IACrC;AAAA,EACF;AAEA,EAAA,IAAI,YAAA,CAAa,UAAU,CAAA,EAAG;AAG5B,IAAA,OAAO,IAAI,SAAS,IAAA,EAAM,EAAE,QAAQ,GAAA,EAAK,UAAA,EAAY,qBAAqB,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,QAAA,GAAW,MAAM,cAAA,CAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAQ,EAAG,OAAO,CAAA;AAKtE,EAAA,IAAA,CACG,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,QAAA,CAAS,MAAA,KAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClB,WAAA,CAAY,UAAU,CAAA,EACtB;AACA,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,SAAA,IAAa,cAAc,UAAA,EAAY;AACzC,MAAA,MAAM,eAAe,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AACnD,MAAA,YAAA,CAAa,GAAA,CAAI,qBAAqB,gBAAgB,CAAA;AACtD,MAAA,YAAA,CAAa,GAAA,CAAI,aAAa,SAAS,CAAA;AAGvC,MAAA,YAAA,CAAa,OAAO,eAAe,CAAA;AACnC,MAAA,UAAA,GAAa,SAAA;AACb,MAAA,QAAA,GAAW,MAAM,eAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,YAAA,EAAa,EAAG,OAAO,CAAA;AAAA,IAClF;AAAA,EACF;AAEA,EAAA,IAAA,CACG,QAAA,CAAS,WAAW,GAAA,IAAO,QAAA,CAAS,WAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClB,UAAA,EACA;AACA,IAAA,WAAA,CAAY,UAAU,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,QAAA;AACT;AAYO,SAAS,WAAA,CAAY,GAAA,EAAa,OAAA,EAAkB,MAAA,EAAuB;AAChF,EAAA,MAAM,UAAA,GAAa,kBAAkB,MAAM,CAAA;AAC3C,EAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,IAAA,CAAK,UAAU,OAAO,CAAA;AAC3E,EAAA,IAAI;AACF,IAAA,KAAK,MAAM,GAAA,EAAK;AAAA,MACd,MAAA,EAAQ,MAAA;AAAA,MACR,SAAA,EAAW,IAAA;AAAA,MACX,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqB,gBAAA;AAAA,QACrB,GAAI,UAAA,GAAa,EAAE,WAAA,EAAa,UAAA,KAAe;AAAC,OAClD;AAAA,MACA;AAAA,KACD,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAEf,CAAC,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AACN,IAAA,IAAI;AACF,MAAA,IAAI,OAAO,SAAA,KAAc,WAAA,IAAe,SAAA,CAAU,UAAA,EAAY;AAC5D,QAAA,SAAA,CAAU,UAAA,CAAW,GAAA,EAAK,IAAI,IAAA,CAAK,CAAC,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,kBAAA,EAAoB,CAAC,CAAA;AAAA,MAC1E;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACF","file":"chunk-GUU3AEFM.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared — Client token manager\n *\n * SiteKitLayout (a server component) no longer ships the raw `sonor_` API key to\n * the browser. Instead it mints a short-lived, project-scoped token server-side\n * and injects THAT. This module is the browser-side lifecycle for that token:\n *\n *   - holds the current token (seeded from the injected value)\n *   - a static page's seed can be days old and already expired on first view, so\n *     it transparently REFRESHES via the public endpoint before first use\n *   - dedupes concurrent refreshes (one in-flight request, awaited by all)\n *   - persists the freshest token in sessionStorage so navigations within a\n *     session don't each re-refresh\n *\n * Everything here is a no-op passthrough when the injected credential is a raw\n * key (a 2.x kit, or the mint-failed fallback) — legacy behavior is unchanged.\n * Fully SSR-safe: on the server there is no refresh, just the seed.\n *\n * The token payload is NOT secret (only its HMAC is unforgeable), so decoding it\n * client-side to read `exp`/`pid` is fine and needs no crypto.\n */\nimport { SITE_KIT_VERSION } from './version'\n\nexport const SITE_TOKEN_PREFIX = 'st1.'\n\n/** Refresh this many ms before expiry, so a request never races the deadline. */\nconst REFRESH_SKEW_MS = 5 * 60_000\nconst REFRESH_TIMEOUT_MS = 6_000\nconst STORAGE_KEY = '__sonor_site_token__'\n\nexport function isSiteToken(credential?: string | null): boolean {\n  return typeof credential === 'string' && credential.startsWith(SITE_TOKEN_PREFIX)\n}\n\ninterface DecodedClaims {\n  pid?: string\n  iat?: number\n  exp?: number\n}\n\n/** Decode the (non-secret) token payload. Returns null if not a token / malformed. */\nexport function decodeSiteTokenClaims(token?: string | null): DecodedClaims | null {\n  if (!isSiteToken(token)) return null\n  const seg = (token as string).split('.')[1]\n  if (!seg) return null\n  try {\n    // base64url → JSON. atob handles standard base64; restore url-safe chars.\n    const b64 = seg.replace(/-/g, '+').replace(/_/g, '/')\n    const json =\n      typeof atob === 'function'\n        ? atob(b64)\n        : Buffer.from(seg, 'base64url').toString('utf8')\n    const claims = JSON.parse(json)\n    return typeof claims === 'object' && claims ? claims : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Stable id for the auth circuit breaker. Tokens rotate, so keying the breaker\n * by the raw value would reset it every refresh — key by the project id encoded\n * in the token instead. Raw keys use a safe prefix.\n */\nexport function credentialBreakerId(credential?: string | null): string {\n  if (!credential) return '(anonymous)'\n  const claims = decodeSiteTokenClaims(credential)\n  if (claims?.pid) return `pid:${claims.pid}`\n  return credential.slice(0, 16)\n}\n\ninterface TokenState {\n  /** The credential injected by the layout (token or raw key). */\n  seed: string | undefined\n  /** Whether we're in token mode (seed is a token). */\n  isToken: boolean\n  /** Base API URL for the refresh endpoint. */\n  apiUrl: string\n  /** The freshest known token (>= seed). Null in raw-key mode. */\n  token: string | null\n  /** In-flight refresh, deduped. */\n  refreshing: Promise<string | null> | null\n}\n\nconst state: TokenState = {\n  seed: undefined,\n  isToken: false,\n  apiUrl: 'https://api.sonor.io',\n  token: null,\n  refreshing: null,\n}\n\nfunction readStoredToken(): string | null {\n  if (typeof window === 'undefined') return null\n  try {\n    const raw = window.sessionStorage.getItem(STORAGE_KEY)\n    if (!raw) return null\n    const parsed = JSON.parse(raw)\n    return typeof parsed?.token === 'string' ? parsed.token : null\n  } catch {\n    return null\n  }\n}\n\nfunction storeToken(token: string): void {\n  if (typeof window === 'undefined') return\n  try {\n    window.sessionStorage.setItem(STORAGE_KEY, JSON.stringify({ token }))\n  } catch {\n    /* private mode / disabled storage — memory-only is fine */\n  }\n  try {\n    ;(window as any).__SITE_KIT_API_KEY__ = token\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction tokenExp(token: string | null): number {\n  const claims = decodeSiteTokenClaims(token)\n  return typeof claims?.exp === 'number' ? claims.exp * 1000 : 0\n}\n\n/**\n * Configure the manager from the layout-injected values. Adopts a fresher token\n * from sessionStorage if a prior page in this session already refreshed.\n */\nexport function configureSiteCredential(opts: {\n  credential?: string\n  apiUrl?: string\n}): void {\n  state.seed = opts.credential\n  state.isToken = isSiteToken(opts.credential)\n  if (opts.apiUrl) state.apiUrl = opts.apiUrl.replace(/\\/+$/, '')\n\n  if (!state.isToken) {\n    state.token = null\n    return\n  }\n\n  // configure runs on every render — never downgrade. Keep the freshest of the\n  // injected seed, a token stored by an earlier page this session, and whatever\n  // an in-flight/prior refresh already put in memory.\n  const prior = state.token\n  let best = opts.credential ?? null\n  const stored = readStoredToken()\n  if (stored && tokenExp(stored) > tokenExp(best)) best = stored\n  if (prior && tokenExp(prior) > tokenExp(best)) best = prior\n  state.token = best\n}\n\nfunction needsRefresh(): boolean {\n  if (!state.isToken) return false\n  if (!state.token) return true\n  return Date.now() >= tokenExp(state.token) - REFRESH_SKEW_MS\n}\n\nasync function doRefresh(): Promise<string | null> {\n  const current = state.token\n  if (!current) return null\n  try {\n    const res = await fetch(`${state.apiUrl}/api/public/site-token/refresh`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        // Send the current token as x-api-key too, so the server's key-scoped\n        // throttler buckets refreshes by token rather than by shared CDN IP.\n        'x-api-key': current,\n      },\n      body: JSON.stringify({ token: current }),\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(REFRESH_TIMEOUT_MS)\n          : undefined,\n    })\n    if (!res.ok) return null\n    const data = await res.json().catch(() => null)\n    const next = data?.token\n    if (typeof next === 'string' && isSiteToken(next)) {\n      state.token = next\n      storeToken(next)\n      return next\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\n/** Refresh now (deduped). Returns the new token, or null on failure. */\nexport function refreshSiteToken(): Promise<string | null> {\n  if (!state.isToken) return Promise.resolve(null)\n  if (state.refreshing) return state.refreshing\n  state.refreshing = doRefresh().finally(() => {\n    state.refreshing = null\n  })\n  return state.refreshing\n}\n\n/**\n * The credential to put on the next request. In token mode, refreshes a stale\n * seed first. In raw-key mode, returns the seed unchanged (legacy passthrough).\n */\nexport async function getFreshCredential(\n  seed?: string,\n): Promise<string | undefined> {\n  // A raw key (or nothing configured) — no token machinery.\n  if (!state.isToken) return seed ?? state.seed\n  if (needsRefresh()) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed) return refreshed\n    // Refresh failed — fall through to whatever we have; the request may 401 and\n    // trip the breaker with friendly copy.\n  }\n  return state.token ?? seed ?? state.seed\n}\n\n/** Whether the given credential is being managed as a token. */\nexport function isTokenMode(): boolean {\n  return state.isToken\n}\n\n/**\n * Best-known credential WITHOUT refreshing — for synchronous unload paths\n * (sonorBeacon) that can't await. In token mode returns the freshest token held;\n * in raw-key mode returns the seed.\n */\nexport function currentCredential(seed?: string): string | undefined {\n  if (!state.isToken) return seed ?? state.seed\n  return state.token ?? seed ?? state.seed\n}\n","/**\n * @sonordev/site-kit shared - Resilient fetch\n *\n * Single source of truth for client-side resilient fetch (forms, SitemapSync).\n * Adds a per-attempt timeout and retries transient failures (network errors,\n * request timeouts, HTTP 429, and 5xx) with exponential backoff.\n *\n * A form submission must survive a brief API blip — a deploy, a cold start, a\n * dropped packet. A single un-retried fetch turning into \"Something went wrong\"\n * is how leads get lost. The explicit abort also matters on its own: a request\n * left to hang until the browser's own network timeout logs a console error\n * (net::ERR_TIMED_OUT) that fails Lighthouse best-practices; an aborted fetch\n * logs nothing.\n */\n\nexport interface FetchRetryOptions {\n  /** Number of retries AFTER the first attempt (default 2 → up to 3 tries total). */\n  retries?: number\n  /** Per-attempt timeout in milliseconds (default 15000). */\n  timeoutMs?: number\n}\n\nfunction backoffDelay(attempt: number, response?: Response): number {\n  // Honor a Retry-After header on 429 responses when present.\n  if (response?.status === 429) {\n    const header = response.headers.get('retry-after')\n    const seconds = header ? parseInt(header, 10) : NaN\n    if (!Number.isNaN(seconds) && seconds > 0) return Math.min(seconds * 1000, 10000)\n  }\n  // Exponential backoff: 500ms, 1s, 2s, ... capped at 8s.\n  return Math.min(8000, 500 * 2 ** attempt)\n}\n\n/**\n * fetch() with a timeout and automatic retries for transient failures.\n *\n * Non-transient responses (2xx, 3xx, and 4xx other than 429) are returned to\n * the caller as-is — only 429/5xx and thrown network/timeout errors are retried.\n * If every attempt fails with a thrown error, the last error is re-thrown.\n */\nexport async function fetchWithRetry(\n  url: string,\n  init: RequestInit,\n  options: FetchRetryOptions = {},\n): Promise<Response> {\n  const retries = options.retries ?? 2\n  const timeoutMs = options.timeoutMs ?? 15000\n  let lastError: unknown\n\n  for (let attempt = 0; attempt <= retries; attempt++) {\n    const controller = new AbortController()\n    const timer = setTimeout(() => controller.abort(), timeoutMs)\n    try {\n      const response = await fetch(url, { ...init, signal: controller.signal })\n      clearTimeout(timer)\n\n      if ((response.status === 429 || response.status >= 500) && attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt, response)))\n        continue\n      }\n      return response\n    } catch (error) {\n      clearTimeout(timer)\n      lastError = error\n      // Network failure or timeout (AbortController) — retry while attempts remain.\n      if (attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt)))\n        continue\n      }\n    }\n  }\n\n  throw lastError instanceof Error\n    ? lastError\n    : new Error('Network request failed after multiple attempts. Please try again.')\n}\n","/**\n * @sonordev/site-kit shared - Canonical client transport\n *\n * Single source of truth for how site-kit talks to Sonor from the browser.\n * Every client-side module (analytics, forms, commerce, engage, maps, images,\n * SitemapSync) routes through here instead of bare fetch(), which gives the\n * whole kit, in one place:\n *\n *  - per-attempt timeout + retry with backoff (via fetchWithRetry) — a hung\n *    request left to the browser's own network timeout logs a console error\n *    (net::ERR_TIMED_OUT) that fails Lighthouse best-practices\n *  - the x-sitekit-version header on every request, so the platform can see\n *    which kit version each site actually runs from live traffic\n *  - CREDENTIAL LIFECYCLE: sites on 3.2+ ship a short-lived minted token instead\n *    of the raw key. This transport resolves the freshest token (refreshing a\n *    stale seed transparently), and on a 401/403 for a token it refreshes once\n *    and retries before giving up. A raw key (2.x kit, or the mint-failed\n *    fallback) is a pure passthrough — legacy behavior is unchanged.\n *  - an auth circuit breaker: after a 401/403 the credential is paused for a few\n *    minutes and ONE friendly console.info is emitted — a site on a stale or\n *    canceled key must not spam the API or the visitor's console. Keyed by the\n *    project (from the token) so it survives token rotation.\n *  - sonorBeacon for unload-time telemetry that keeps the credential in headers;\n *    navigator.sendBeacon can't set headers and forced the key into the URL,\n *    where server and CDN access logs capture it\n *\n * Non-idempotent endpoints (checkout, payment intents, uploads) must pass\n * { retries: 0 } — they still get the timeout, but never an automatic retry.\n */\nimport { fetchWithRetry, type FetchRetryOptions } from './fetchWithRetry'\nimport { SITE_KIT_VERSION } from './version'\nimport {\n  credentialBreakerId,\n  currentCredential,\n  getFreshCredential,\n  isSiteToken,\n  isTokenMode,\n  refreshSiteToken,\n} from './siteToken'\n\nexport interface SonorFetchOptions extends FetchRetryOptions {\n  /** Project credential — the minted token (3.2+) or raw key. Sent as x-api-key. */\n  apiKey?: string\n}\n\n/** How long a credential stays paused after an auth failure. */\nconst AUTH_BREAK_MS = 5 * 60_000\n\n// breaker id → epoch ms until which requests are paused. Module-scoped: the\n// breaker lives for the page's lifetime and never applies on the server.\nconst pausedKeys = new Map<string, number>()\nlet warnedThisPage = false\n\n/** True when a previous 401/403 has paused this credential (browser only). */\nexport function isAuthPaused(credential?: string): boolean {\n  if (typeof window === 'undefined') return false\n  const id = credentialBreakerId(credential)\n  const until = pausedKeys.get(id)\n  if (!until) return false\n  if (Date.now() >= until) {\n    pausedKeys.delete(id)\n    return false\n  }\n  return true\n}\n\nfunction tripBreaker(credential?: string): void {\n  pausedKeys.set(credentialBreakerId(credential), Date.now() + AUTH_BREAK_MS)\n  if (!warnedThisPage) {\n    warnedThisPage = true\n    // info, not error: a visitor's console must stay clean (Lighthouse\n    // errors-in-console), and copy never names env vars or key formats.\n    console.info(\n      \"[Sonor] This site couldn't authenticate with Sonor, so data features are paused for a few minutes. If this keeps happening, the site is likely running an outdated API key.\",\n    )\n  }\n}\n\nexport async function sonorFetch(\n  url: string,\n  init: RequestInit = {},\n  options: SonorFetchOptions = {},\n): Promise<Response> {\n  // Resolve the credential to send. In token mode this may transparently refresh\n  // a stale seed before the first request; in raw-key mode it's a passthrough.\n  let credential = options.apiKey\n  if (credential !== undefined || isTokenMode()) {\n    credential = await getFreshCredential(options.apiKey)\n  }\n\n  const headers = new Headers(init.headers || {})\n  headers.set('x-sitekit-version', SITE_KIT_VERSION)\n  if (credential) {\n    if (isTokenMode()) {\n      // Token mode: `credential` is the freshest token (refreshed just above if\n      // the seed was stale). It MUST override any x-api-key a caller hand-set — a\n      // stale build-time seed passed as a header would otherwise pin the request\n      // and defeat refresh entirely. Also drop a caller-set Authorization:\n      // extractApiKey() server-side prefers `Authorization: Bearer` over\n      // x-api-key, so a stale Bearer seed would win even once we set a fresh\n      // x-api-key. This is the single place the client credential is chosen — do\n      // not re-attach it as a header at call sites.\n      headers.set('x-api-key', credential)\n      headers.delete('authorization')\n    } else if (!headers.has('x-api-key')) {\n      // Raw-key mode: legacy passthrough — respect a caller-supplied header.\n      headers.set('x-api-key', credential)\n    }\n  }\n\n  if (isAuthPaused(credential)) {\n    // Synthetic response keeps every caller's !response.ok path working\n    // without a network round trip while the breaker is open.\n    return new Response(null, { status: 401, statusText: 'sonor-auth-paused' })\n  }\n\n  let response = await fetchWithRetry(url, { ...init, headers }, options)\n\n  // A token can rotate or expire mid-session. On the first auth failure, try ONE\n  // refresh + retry before tripping the breaker — only for token credentials\n  // (raw keys have nothing to refresh).\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    isSiteToken(credential)\n  ) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed && refreshed !== credential) {\n      const retryHeaders = new Headers(init.headers || {})\n      retryHeaders.set('x-sitekit-version', SITE_KIT_VERSION)\n      retryHeaders.set('x-api-key', refreshed)\n      // Same reason as the initial request: a caller-set stale Bearer would win\n      // over our fresh x-api-key server-side, so strip it on the retry too.\n      retryHeaders.delete('authorization')\n      credential = refreshed\n      response = await fetchWithRetry(url, { ...init, headers: retryHeaders }, options)\n    }\n  }\n\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    credential\n  ) {\n    tripBreaker(credential)\n  }\n\n  return response\n}\n\n/**\n * Fire-and-forget telemetry that survives page unload.\n *\n * Uses fetch({ keepalive: true }) so auth travels in headers. Falls back to\n * navigator.sendBeacon (no auth headers possible — the server may reject it,\n * but we never put the key in the URL) only when keepalive fetch is missing.\n *\n * Cannot await a refresh at unload time, so it sends the freshest token already\n * held (currentCredential) rather than the possibly-stale seed the caller passed.\n */\nexport function sonorBeacon(url: string, payload: unknown, apiKey?: string): void {\n  const credential = currentCredential(apiKey)\n  const body = typeof payload === 'string' ? payload : JSON.stringify(payload)\n  try {\n    void fetch(url, {\n      method: 'POST',\n      keepalive: true,\n      headers: {\n        'Content-Type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        ...(credential ? { 'x-api-key': credential } : {}),\n      },\n      body,\n    }).catch(() => {\n      /* page is closing — best effort */\n    })\n  } catch {\n    try {\n      if (typeof navigator !== 'undefined' && navigator.sendBeacon) {\n        navigator.sendBeacon(url, new Blob([body], { type: 'application/json' }))\n      }\n    } catch {\n      /* nothing left to try */\n    }\n  }\n}\n"]}
+{"version":3,"sources":["../src/shared/siteToken.ts","../src/shared/fetchWithRetry.ts","../src/shared/sonorFetch.ts"],"names":[],"mappings":";;;AAuBO,IAAM,iBAAA,GAAoB,MAAA;AAGjC,IAAM,kBAAkB,CAAA,GAAI,GAAA;AAC5B,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,WAAA,GAAc,sBAAA;AAEb,SAAS,YAAY,UAAA,EAAqC;AAC/D,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,IAAY,UAAA,CAAW,WAAW,iBAAiB,CAAA;AAClF;AASO,SAAS,sBAAsB,KAAA,EAA6C;AACjF,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,MAAM,GAAA,GAAO,KAAA,CAAiB,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC1C,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,IAAI;AAEF,IAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACpD,IAAA,MAAM,IAAA,GACJ,OAAO,IAAA,KAAS,UAAA,GACZ,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACnD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,IAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,GAAS,MAAA,GAAS,IAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOO,SAAS,oBAAoB,UAAA,EAAoC;AACtE,EAAA,IAAI,CAAC,YAAY,OAAO,aAAA;AACxB,EAAA,MAAM,MAAA,GAAS,sBAAsB,UAAU,CAAA;AAC/C,EAAA,IAAI,MAAA,EAAQ,GAAA,EAAK,OAAO,CAAA,IAAA,EAAO,OAAO,GAAG,CAAA,CAAA;AACzC,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B;AAeA,IAAM,KAAA,GAAoB;AAAA,EACxB,IAAA,EAAM,MAAA;AAAA,EACN,OAAA,EAAS,KAAA;AAAA,EACT,MAAA,EAAQ,sBAAA;AAAA,EACR,KAAA,EAAO,IAAA;AAAA,EACP,UAAA,EAAY;AACd,CAAA;AAEA,SAAS,eAAA,GAAiC;AACxC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AACrD,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,OAAO,MAAA,EAAQ,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ,IAAA;AAAA,EAC5D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAW,KAAA,EAAqB;AACvC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACnC,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,cAAA,CAAe,QAAQ,WAAA,EAAa,IAAA,CAAK,UAAU,EAAE,KAAA,EAAO,CAAC,CAAA;AAAA,EACtE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA;AAAC,IAAC,OAAe,oBAAA,GAAuB,KAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,SAAS,KAAA,EAA8B;AAC9C,EAAA,MAAM,MAAA,GAAS,sBAAsB,KAAK,CAAA;AAC1C,EAAA,OAAO,OAAO,MAAA,EAAQ,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,MAAM,GAAA,GAAO,CAAA;AAC/D;AAMO,SAAS,wBAAwB,IAAA,EAG/B;AACP,EAAA,KAAA,CAAM,OAAO,IAAA,CAAK,UAAA;AAClB,EAAA,KAAA,CAAM,OAAA,GAAU,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,QAAQ,KAAA,CAAM,MAAA,GAAS,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAE9D,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,IAAA;AAAA,EACF;AAKA,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,EAAA,IAAI,IAAA,GAAO,KAAK,UAAA,IAAc,IAAA;AAC9B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,IAAI,UAAU,QAAA,CAAS,MAAM,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,MAAA;AACxD,EAAA,IAAI,SAAS,QAAA,CAAS,KAAK,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,KAAA;AACtD,EAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AAChB;AAEA,SAAS,YAAA,GAAwB;AAC/B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,KAAA;AAC3B,EAAA,IAAI,CAAC,KAAA,CAAM,KAAA,EAAO,OAAO,IAAA;AACzB,EAAA,OAAO,KAAK,GAAA,EAAI,IAAK,QAAA,CAAS,KAAA,CAAM,KAAK,CAAA,GAAI,eAAA;AAC/C;AAEA,eAAe,SAAA,GAAoC;AACjD,EAAA,MAAM,UAAU,KAAA,CAAM,KAAA;AACtB,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,8BAAA,CAAA,EAAkC;AAAA,MACvE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqB,gBAAA;AAAA;AAAA;AAAA,QAGrB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACvC,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,kBAAkB,CAAA,GACtC,KAAA;AAAA,KACP,CAAA;AACD,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,OAAO,IAAA;AACpB,IAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC9C,IAAA,MAAM,OAAO,IAAA,EAAM,KAAA;AACnB,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,WAAA,CAAY,IAAI,CAAA,EAAG;AACjD,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,UAAA,CAAW,IAAI,CAAA;AACf,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,gBAAA,GAA2C;AACzD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,UAAA,EAAY,OAAO,KAAA,CAAM,UAAA;AACnC,EAAA,KAAA,CAAM,UAAA,GAAa,SAAA,EAAU,CAAE,OAAA,CAAQ,MAAM;AAC3C,IAAA,KAAA,CAAM,UAAA,GAAa,IAAA;AAAA,EACrB,CAAC,CAAA;AACD,EAAA,OAAO,KAAA,CAAM,UAAA;AACf;AAMA,eAAsB,mBACpB,IAAA,EAC6B;AAE7B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,IAAI,cAAa,EAAG;AAClB,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,WAAW,OAAO,SAAA;AAAA,EAGxB;AACA,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC;AAGO,SAAS,WAAA,GAAuB;AACrC,EAAA,OAAO,KAAA,CAAM,OAAA;AACf;AAOO,SAAS,kBAAkB,IAAA,EAAmC;AACnE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC;;;ACjNA,SAAS,YAAA,CAAa,SAAiB,QAAA,EAA6B;AAElE,EAAA,IAAI,QAAA,EAAU,WAAW,GAAA,EAAK;AAC5B,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,MAAA,GAAS,QAAA,CAAS,MAAA,EAAQ,EAAE,CAAA,GAAI,GAAA;AAChD,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,IAAK,OAAA,GAAU,CAAA,EAAG,OAAO,IAAA,CAAK,GAAA,CAAI,OAAA,GAAU,GAAA,EAAM,GAAK,CAAA;AAAA,EAClF;AAEA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,GAAA,EAAM,GAAA,GAAM,KAAK,OAAO,CAAA;AAC1C;AASA,eAAsB,cAAA,CACpB,GAAA,EACA,IAAA,EACA,OAAA,GAA6B,EAAC,EACX;AACnB,EAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,IAAA;AACvC,EAAA,IAAI,SAAA;AAEJ,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,OAAA,EAAS,OAAA,EAAA,EAAW;AACnD,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,MAAA,YAAA,CAAa,KAAK,CAAA;AAElB,MAAA,IAAA,CAAK,SAAS,MAAA,KAAW,GAAA,IAAO,SAAS,MAAA,IAAU,GAAA,KAAQ,UAAU,OAAA,EAAS;AAC5E,QAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY,UAAA,CAAW,SAAS,YAAA,CAAa,OAAA,EAAS,QAAQ,CAAC,CAAC,CAAA;AACnF,QAAA;AAAA,MACF;AACA,MAAA,OAAO,QAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,SAAA,GAAY,KAAA;AAEZ,MAAA,IAAI,UAAU,OAAA,EAAS;AACrB,QAAA,MAAM,IAAI,QAAQ,CAAC,OAAA,KAAY,WAAW,OAAA,EAAS,YAAA,CAAa,OAAO,CAAC,CAAC,CAAA;AACzE,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,YAAqB,KAAA,GACvB,SAAA,GACA,IAAI,MAAM,mEAAmE,CAAA;AACnF;;;AC7BA,IAAM,gBAAgB,CAAA,GAAI,GAAA;AAI1B,IAAM,UAAA,uBAAiB,GAAA,EAAoB;AAC3C,IAAI,cAAA,GAAiB,KAAA;AAGd,SAAS,aAAa,UAAA,EAA8B;AACzD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,MAAM,EAAA,GAAK,oBAAoB,UAAU,CAAA;AACzC,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,EAAE,CAAA;AAC/B,EAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,EAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,KAAA,EAAO;AACvB,IAAA,UAAA,CAAW,OAAO,EAAE,CAAA;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,YAAY,UAAA,EAA2B;AAC9C,EAAA,UAAA,CAAW,IAAI,mBAAA,CAAoB,UAAU,GAAG,IAAA,CAAK,GAAA,KAAQ,aAAa,CAAA;AAC1E,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,cAAA,GAAiB,IAAA;AAGjB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AACF;AAEA,eAAsB,WACpB,GAAA,EACA,IAAA,GAAoB,EAAC,EACrB,OAAA,GAA6B,EAAC,EACX;AAGnB,EAAA,IAAI,aAAa,OAAA,CAAQ,MAAA;AACzB,EAAA,IAAI,UAAA,KAAe,MAAA,IAAa,WAAA,EAAY,EAAG;AAC7C,IAAA,UAAA,GAAa,MAAM,kBAAA,CAAmB,OAAA,CAAQ,MAAM,CAAA;AAAA,EACtD;AAEA,EAAA,MAAM,UAAU,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAC9C,EAAA,OAAA,CAAQ,GAAA,CAAI,qBAAqB,gBAAgB,CAAA;AACjD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,IAAI,aAAY,EAAG;AASjB,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AACnC,MAAA,OAAA,CAAQ,OAAO,eAAe,CAAA;AAAA,IAChC,CAAA,MAAA,IAAW,CAAC,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG;AAEpC,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AAAA,IACrC;AAAA,EACF;AAEA,EAAA,IAAI,YAAA,CAAa,UAAU,CAAA,EAAG;AAG5B,IAAA,OAAO,IAAI,SAAS,IAAA,EAAM,EAAE,QAAQ,GAAA,EAAK,UAAA,EAAY,qBAAqB,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,QAAA,GAAW,MAAM,cAAA,CAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAQ,EAAG,OAAO,CAAA;AAKtE,EAAA,IAAA,CACG,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,QAAA,CAAS,MAAA,KAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClB,WAAA,CAAY,UAAU,CAAA,EACtB;AACA,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,SAAA,IAAa,cAAc,UAAA,EAAY;AACzC,MAAA,MAAM,eAAe,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AACnD,MAAA,YAAA,CAAa,GAAA,CAAI,qBAAqB,gBAAgB,CAAA;AACtD,MAAA,YAAA,CAAa,GAAA,CAAI,aAAa,SAAS,CAAA;AAGvC,MAAA,YAAA,CAAa,OAAO,eAAe,CAAA;AACnC,MAAA,UAAA,GAAa,SAAA;AACb,MAAA,QAAA,GAAW,MAAM,eAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,YAAA,EAAa,EAAG,OAAO,CAAA;AAAA,IAClF;AAAA,EACF;AAEA,EAAA,IAAA,CACG,QAAA,CAAS,WAAW,GAAA,IAAO,QAAA,CAAS,WAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClB,UAAA,EACA;AACA,IAAA,WAAA,CAAY,UAAU,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,QAAA;AACT;AAYO,SAAS,WAAA,CAAY,GAAA,EAAa,OAAA,EAAkB,MAAA,EAAuB;AAChF,EAAA,MAAM,UAAA,GAAa,kBAAkB,MAAM,CAAA;AAC3C,EAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,IAAA,CAAK,UAAU,OAAO,CAAA;AAC3E,EAAA,IAAI;AACF,IAAA,KAAK,MAAM,GAAA,EAAK;AAAA,MACd,MAAA,EAAQ,MAAA;AAAA,MACR,SAAA,EAAW,IAAA;AAAA,MACX,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqB,gBAAA;AAAA,QACrB,GAAI,UAAA,GAAa,EAAE,WAAA,EAAa,UAAA,KAAe;AAAC,OAClD;AAAA,MACA;AAAA,KACD,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAEf,CAAC,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AACN,IAAA,IAAI;AACF,MAAA,IAAI,OAAO,SAAA,KAAc,WAAA,IAAe,SAAA,CAAU,UAAA,EAAY;AAC5D,QAAA,SAAA,CAAU,UAAA,CAAW,GAAA,EAAK,IAAI,IAAA,CAAK,CAAC,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,kBAAA,EAAoB,CAAC,CAAA;AAAA,MAC1E;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACF","file":"chunk-WS4GNH3F.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared — Client token manager\n *\n * SiteKitLayout (a server component) no longer ships the raw `sonor_` API key to\n * the browser. Instead it mints a short-lived, project-scoped token server-side\n * and injects THAT. This module is the browser-side lifecycle for that token:\n *\n *   - holds the current token (seeded from the injected value)\n *   - a static page's seed can be days old and already expired on first view, so\n *     it transparently REFRESHES via the public endpoint before first use\n *   - dedupes concurrent refreshes (one in-flight request, awaited by all)\n *   - persists the freshest token in sessionStorage so navigations within a\n *     session don't each re-refresh\n *\n * Everything here is a no-op passthrough when the injected credential is a raw\n * key (a 2.x kit, or the mint-failed fallback) — legacy behavior is unchanged.\n * Fully SSR-safe: on the server there is no refresh, just the seed.\n *\n * The token payload is NOT secret (only its HMAC is unforgeable), so decoding it\n * client-side to read `exp`/`pid` is fine and needs no crypto.\n */\nimport { SITE_KIT_VERSION } from './version'\n\nexport const SITE_TOKEN_PREFIX = 'st1.'\n\n/** Refresh this many ms before expiry, so a request never races the deadline. */\nconst REFRESH_SKEW_MS = 5 * 60_000\nconst REFRESH_TIMEOUT_MS = 6_000\nconst STORAGE_KEY = '__sonor_site_token__'\n\nexport function isSiteToken(credential?: string | null): boolean {\n  return typeof credential === 'string' && credential.startsWith(SITE_TOKEN_PREFIX)\n}\n\ninterface DecodedClaims {\n  pid?: string\n  iat?: number\n  exp?: number\n}\n\n/** Decode the (non-secret) token payload. Returns null if not a token / malformed. */\nexport function decodeSiteTokenClaims(token?: string | null): DecodedClaims | null {\n  if (!isSiteToken(token)) return null\n  const seg = (token as string).split('.')[1]\n  if (!seg) return null\n  try {\n    // base64url → JSON. atob handles standard base64; restore url-safe chars.\n    const b64 = seg.replace(/-/g, '+').replace(/_/g, '/')\n    const json =\n      typeof atob === 'function'\n        ? atob(b64)\n        : Buffer.from(seg, 'base64url').toString('utf8')\n    const claims = JSON.parse(json)\n    return typeof claims === 'object' && claims ? claims : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Stable id for the auth circuit breaker. Tokens rotate, so keying the breaker\n * by the raw value would reset it every refresh — key by the project id encoded\n * in the token instead. Raw keys use a safe prefix.\n */\nexport function credentialBreakerId(credential?: string | null): string {\n  if (!credential) return '(anonymous)'\n  const claims = decodeSiteTokenClaims(credential)\n  if (claims?.pid) return `pid:${claims.pid}`\n  return credential.slice(0, 16)\n}\n\ninterface TokenState {\n  /** The credential injected by the layout (token or raw key). */\n  seed: string | undefined\n  /** Whether we're in token mode (seed is a token). */\n  isToken: boolean\n  /** Base API URL for the refresh endpoint. */\n  apiUrl: string\n  /** The freshest known token (>= seed). Null in raw-key mode. */\n  token: string | null\n  /** In-flight refresh, deduped. */\n  refreshing: Promise<string | null> | null\n}\n\nconst state: TokenState = {\n  seed: undefined,\n  isToken: false,\n  apiUrl: 'https://api.sonor.io',\n  token: null,\n  refreshing: null,\n}\n\nfunction readStoredToken(): string | null {\n  if (typeof window === 'undefined') return null\n  try {\n    const raw = window.sessionStorage.getItem(STORAGE_KEY)\n    if (!raw) return null\n    const parsed = JSON.parse(raw)\n    return typeof parsed?.token === 'string' ? parsed.token : null\n  } catch {\n    return null\n  }\n}\n\nfunction storeToken(token: string): void {\n  if (typeof window === 'undefined') return\n  try {\n    window.sessionStorage.setItem(STORAGE_KEY, JSON.stringify({ token }))\n  } catch {\n    /* private mode / disabled storage — memory-only is fine */\n  }\n  try {\n    ;(window as any).__SITE_KIT_API_KEY__ = token\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction tokenExp(token: string | null): number {\n  const claims = decodeSiteTokenClaims(token)\n  return typeof claims?.exp === 'number' ? claims.exp * 1000 : 0\n}\n\n/**\n * Configure the manager from the layout-injected values. Adopts a fresher token\n * from sessionStorage if a prior page in this session already refreshed.\n */\nexport function configureSiteCredential(opts: {\n  credential?: string\n  apiUrl?: string\n}): void {\n  state.seed = opts.credential\n  state.isToken = isSiteToken(opts.credential)\n  if (opts.apiUrl) state.apiUrl = opts.apiUrl.replace(/\\/+$/, '')\n\n  if (!state.isToken) {\n    state.token = null\n    return\n  }\n\n  // configure runs on every render — never downgrade. Keep the freshest of the\n  // injected seed, a token stored by an earlier page this session, and whatever\n  // an in-flight/prior refresh already put in memory.\n  const prior = state.token\n  let best = opts.credential ?? null\n  const stored = readStoredToken()\n  if (stored && tokenExp(stored) > tokenExp(best)) best = stored\n  if (prior && tokenExp(prior) > tokenExp(best)) best = prior\n  state.token = best\n}\n\nfunction needsRefresh(): boolean {\n  if (!state.isToken) return false\n  if (!state.token) return true\n  return Date.now() >= tokenExp(state.token) - REFRESH_SKEW_MS\n}\n\nasync function doRefresh(): Promise<string | null> {\n  const current = state.token\n  if (!current) return null\n  try {\n    const res = await fetch(`${state.apiUrl}/api/public/site-token/refresh`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        // Send the current token as x-api-key too, so the server's key-scoped\n        // throttler buckets refreshes by token rather than by shared CDN IP.\n        'x-api-key': current,\n      },\n      body: JSON.stringify({ token: current }),\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(REFRESH_TIMEOUT_MS)\n          : undefined,\n    })\n    if (!res.ok) return null\n    const data = await res.json().catch(() => null)\n    const next = data?.token\n    if (typeof next === 'string' && isSiteToken(next)) {\n      state.token = next\n      storeToken(next)\n      return next\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\n/** Refresh now (deduped). Returns the new token, or null on failure. */\nexport function refreshSiteToken(): Promise<string | null> {\n  if (!state.isToken) return Promise.resolve(null)\n  if (state.refreshing) return state.refreshing\n  state.refreshing = doRefresh().finally(() => {\n    state.refreshing = null\n  })\n  return state.refreshing\n}\n\n/**\n * The credential to put on the next request. In token mode, refreshes a stale\n * seed first. In raw-key mode, returns the seed unchanged (legacy passthrough).\n */\nexport async function getFreshCredential(\n  seed?: string,\n): Promise<string | undefined> {\n  // A raw key (or nothing configured) — no token machinery.\n  if (!state.isToken) return seed ?? state.seed\n  if (needsRefresh()) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed) return refreshed\n    // Refresh failed — fall through to whatever we have; the request may 401 and\n    // trip the breaker with friendly copy.\n  }\n  return state.token ?? seed ?? state.seed\n}\n\n/** Whether the given credential is being managed as a token. */\nexport function isTokenMode(): boolean {\n  return state.isToken\n}\n\n/**\n * Best-known credential WITHOUT refreshing — for synchronous unload paths\n * (sonorBeacon) that can't await. In token mode returns the freshest token held;\n * in raw-key mode returns the seed.\n */\nexport function currentCredential(seed?: string): string | undefined {\n  if (!state.isToken) return seed ?? state.seed\n  return state.token ?? seed ?? state.seed\n}\n","/**\n * @sonordev/site-kit shared - Resilient fetch\n *\n * Single source of truth for client-side resilient fetch (forms, SitemapSync).\n * Adds a per-attempt timeout and retries transient failures (network errors,\n * request timeouts, HTTP 429, and 5xx) with exponential backoff.\n *\n * A form submission must survive a brief API blip — a deploy, a cold start, a\n * dropped packet. A single un-retried fetch turning into \"Something went wrong\"\n * is how leads get lost. The explicit abort also matters on its own: a request\n * left to hang until the browser's own network timeout logs a console error\n * (net::ERR_TIMED_OUT) that fails Lighthouse best-practices; an aborted fetch\n * logs nothing.\n */\n\nexport interface FetchRetryOptions {\n  /** Number of retries AFTER the first attempt (default 2 → up to 3 tries total). */\n  retries?: number\n  /** Per-attempt timeout in milliseconds (default 15000). */\n  timeoutMs?: number\n}\n\nfunction backoffDelay(attempt: number, response?: Response): number {\n  // Honor a Retry-After header on 429 responses when present.\n  if (response?.status === 429) {\n    const header = response.headers.get('retry-after')\n    const seconds = header ? parseInt(header, 10) : NaN\n    if (!Number.isNaN(seconds) && seconds > 0) return Math.min(seconds * 1000, 10000)\n  }\n  // Exponential backoff: 500ms, 1s, 2s, ... capped at 8s.\n  return Math.min(8000, 500 * 2 ** attempt)\n}\n\n/**\n * fetch() with a timeout and automatic retries for transient failures.\n *\n * Non-transient responses (2xx, 3xx, and 4xx other than 429) are returned to\n * the caller as-is — only 429/5xx and thrown network/timeout errors are retried.\n * If every attempt fails with a thrown error, the last error is re-thrown.\n */\nexport async function fetchWithRetry(\n  url: string,\n  init: RequestInit,\n  options: FetchRetryOptions = {},\n): Promise<Response> {\n  const retries = options.retries ?? 2\n  const timeoutMs = options.timeoutMs ?? 15000\n  let lastError: unknown\n\n  for (let attempt = 0; attempt <= retries; attempt++) {\n    const controller = new AbortController()\n    const timer = setTimeout(() => controller.abort(), timeoutMs)\n    try {\n      const response = await fetch(url, { ...init, signal: controller.signal })\n      clearTimeout(timer)\n\n      if ((response.status === 429 || response.status >= 500) && attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt, response)))\n        continue\n      }\n      return response\n    } catch (error) {\n      clearTimeout(timer)\n      lastError = error\n      // Network failure or timeout (AbortController) — retry while attempts remain.\n      if (attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt)))\n        continue\n      }\n    }\n  }\n\n  throw lastError instanceof Error\n    ? lastError\n    : new Error('Network request failed after multiple attempts. Please try again.')\n}\n","/**\n * @sonordev/site-kit shared - Canonical client transport\n *\n * Single source of truth for how site-kit talks to Sonor from the browser.\n * Every client-side module (analytics, forms, commerce, engage, maps, images,\n * SitemapSync) routes through here instead of bare fetch(), which gives the\n * whole kit, in one place:\n *\n *  - per-attempt timeout + retry with backoff (via fetchWithRetry) — a hung\n *    request left to the browser's own network timeout logs a console error\n *    (net::ERR_TIMED_OUT) that fails Lighthouse best-practices\n *  - the x-sitekit-version header on every request, so the platform can see\n *    which kit version each site actually runs from live traffic\n *  - CREDENTIAL LIFECYCLE: sites on 3.2+ ship a short-lived minted token instead\n *    of the raw key. This transport resolves the freshest token (refreshing a\n *    stale seed transparently), and on a 401/403 for a token it refreshes once\n *    and retries before giving up. A raw key (2.x kit, or the mint-failed\n *    fallback) is a pure passthrough — legacy behavior is unchanged.\n *  - an auth circuit breaker: after a 401/403 the credential is paused for a few\n *    minutes and ONE friendly console.info is emitted — a site on a stale or\n *    canceled key must not spam the API or the visitor's console. Keyed by the\n *    project (from the token) so it survives token rotation.\n *  - sonorBeacon for unload-time telemetry that keeps the credential in headers;\n *    navigator.sendBeacon can't set headers and forced the key into the URL,\n *    where server and CDN access logs capture it\n *\n * Non-idempotent endpoints (checkout, payment intents, uploads) must pass\n * { retries: 0 } — they still get the timeout, but never an automatic retry.\n */\nimport { fetchWithRetry, type FetchRetryOptions } from './fetchWithRetry'\nimport { SITE_KIT_VERSION } from './version'\nimport {\n  credentialBreakerId,\n  currentCredential,\n  getFreshCredential,\n  isSiteToken,\n  isTokenMode,\n  refreshSiteToken,\n} from './siteToken'\n\nexport interface SonorFetchOptions extends FetchRetryOptions {\n  /** Project credential — the minted token (3.2+) or raw key. Sent as x-api-key. */\n  apiKey?: string\n}\n\n/** How long a credential stays paused after an auth failure. */\nconst AUTH_BREAK_MS = 5 * 60_000\n\n// breaker id → epoch ms until which requests are paused. Module-scoped: the\n// breaker lives for the page's lifetime and never applies on the server.\nconst pausedKeys = new Map<string, number>()\nlet warnedThisPage = false\n\n/** True when a previous 401/403 has paused this credential (browser only). */\nexport function isAuthPaused(credential?: string): boolean {\n  if (typeof window === 'undefined') return false\n  const id = credentialBreakerId(credential)\n  const until = pausedKeys.get(id)\n  if (!until) return false\n  if (Date.now() >= until) {\n    pausedKeys.delete(id)\n    return false\n  }\n  return true\n}\n\nfunction tripBreaker(credential?: string): void {\n  pausedKeys.set(credentialBreakerId(credential), Date.now() + AUTH_BREAK_MS)\n  if (!warnedThisPage) {\n    warnedThisPage = true\n    // info, not error: a visitor's console must stay clean (Lighthouse\n    // errors-in-console), and copy never names env vars or key formats.\n    console.info(\n      \"[Sonor] This site couldn't authenticate with Sonor, so data features are paused for a few minutes. If this keeps happening, the site is likely running an outdated API key.\",\n    )\n  }\n}\n\nexport async function sonorFetch(\n  url: string,\n  init: RequestInit = {},\n  options: SonorFetchOptions = {},\n): Promise<Response> {\n  // Resolve the credential to send. In token mode this may transparently refresh\n  // a stale seed before the first request; in raw-key mode it's a passthrough.\n  let credential = options.apiKey\n  if (credential !== undefined || isTokenMode()) {\n    credential = await getFreshCredential(options.apiKey)\n  }\n\n  const headers = new Headers(init.headers || {})\n  headers.set('x-sitekit-version', SITE_KIT_VERSION)\n  if (credential) {\n    if (isTokenMode()) {\n      // Token mode: `credential` is the freshest token (refreshed just above if\n      // the seed was stale). It MUST override any x-api-key a caller hand-set — a\n      // stale build-time seed passed as a header would otherwise pin the request\n      // and defeat refresh entirely. Also drop a caller-set Authorization:\n      // extractApiKey() server-side prefers `Authorization: Bearer` over\n      // x-api-key, so a stale Bearer seed would win even once we set a fresh\n      // x-api-key. This is the single place the client credential is chosen — do\n      // not re-attach it as a header at call sites.\n      headers.set('x-api-key', credential)\n      headers.delete('authorization')\n    } else if (!headers.has('x-api-key')) {\n      // Raw-key mode: legacy passthrough — respect a caller-supplied header.\n      headers.set('x-api-key', credential)\n    }\n  }\n\n  if (isAuthPaused(credential)) {\n    // Synthetic response keeps every caller's !response.ok path working\n    // without a network round trip while the breaker is open.\n    return new Response(null, { status: 401, statusText: 'sonor-auth-paused' })\n  }\n\n  let response = await fetchWithRetry(url, { ...init, headers }, options)\n\n  // A token can rotate or expire mid-session. On the first auth failure, try ONE\n  // refresh + retry before tripping the breaker — only for token credentials\n  // (raw keys have nothing to refresh).\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    isSiteToken(credential)\n  ) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed && refreshed !== credential) {\n      const retryHeaders = new Headers(init.headers || {})\n      retryHeaders.set('x-sitekit-version', SITE_KIT_VERSION)\n      retryHeaders.set('x-api-key', refreshed)\n      // Same reason as the initial request: a caller-set stale Bearer would win\n      // over our fresh x-api-key server-side, so strip it on the retry too.\n      retryHeaders.delete('authorization')\n      credential = refreshed\n      response = await fetchWithRetry(url, { ...init, headers: retryHeaders }, options)\n    }\n  }\n\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    credential\n  ) {\n    tripBreaker(credential)\n  }\n\n  return response\n}\n\n/**\n * Fire-and-forget telemetry that survives page unload.\n *\n * Uses fetch({ keepalive: true }) so auth travels in headers. Falls back to\n * navigator.sendBeacon (no auth headers possible — the server may reject it,\n * but we never put the key in the URL) only when keepalive fetch is missing.\n *\n * Cannot await a refresh at unload time, so it sends the freshest token already\n * held (currentCredential) rather than the possibly-stale seed the caller passed.\n */\nexport function sonorBeacon(url: string, payload: unknown, apiKey?: string): void {\n  const credential = currentCredential(apiKey)\n  const body = typeof payload === 'string' ? payload : JSON.stringify(payload)\n  try {\n    void fetch(url, {\n      method: 'POST',\n      keepalive: true,\n      headers: {\n        'Content-Type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        ...(credential ? { 'x-api-key': credential } : {}),\n      },\n      body,\n    }).catch(() => {\n      /* page is closing — best effort */\n    })\n  } catch {\n    try {\n      if (typeof navigator !== 'undefined' && navigator.sendBeacon) {\n        navigator.sendBeacon(url, new Blob([body], { type: 'application/json' }))\n      }\n    } catch {\n      /* nothing left to try */\n    }\n  }\n}\n"]}

package/dist/{chunk-NQ3K4NWX.mjs → chunk-WVAY4ZWC.mjs}

@@ -1,24 +1,24 @@
 'use client';
-import { FleetHeartbeat } from './chunk-ZFF3BKNE.mjs';
+import { FleetHeartbeat } from './chunk-QE53WRXW.mjs';
 import { useDeferredActivation } from './chunk-ZVBLXXNJ.mjs';
 import { normalizeSiteHost } from './chunk-X4OPM3SK.mjs';
-import { SignalBridge } from './chunk-QFWBAGBT.mjs';
-import { getOrCreateVisitorId, getOrCreateSessionId, SiteKitIdentityProvider } from './chunk-EE6SFAZP.mjs';
-import { configureSiteCredential, currentCredential } from './chunk-GUU3AEFM.mjs';
+import { SignalBridge } from './chunk-VNQFKBKF.mjs';
+import { getOrCreateVisitorId, getOrCreateSessionId, SiteKitIdentityProvider } from './chunk-AX4AROLH.mjs';
+import { configureSiteCredential, currentCredential } from './chunk-WS4GNH3F.mjs';
 import { useState, useRef, useCallback, Suspense } from 'react';
 import dynamic from 'next/dynamic';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
 
 var LazyAnalyticsProvider = dynamic(
-  () => import('./AnalyticsProvider-3MZ3O5OB.mjs').then((m) => ({ default: m.AnalyticsProvider })),
+  () => import('./AnalyticsProvider-HIGSPNRA.mjs').then((m) => ({ default: m.AnalyticsProvider })),
   { ssr: false }
 );
 var LazyEngageWidget = dynamic(
-  () => import('./EngageWidget-VXQOZOYA.mjs').then((m) => ({ default: m.EngageWidget })),
+  () => import('./EngageWidget-HPZAI6SU.mjs').then((m) => ({ default: m.EngageWidget })),
   { ssr: false }
 );
 var LazySitemapSync = dynamic(
-  () => import('./SitemapSync-IO2VOR23.mjs').then((m) => ({ default: m.SitemapSync })),
+  () => import('./SitemapSync-OQPRGBG3.mjs').then((m) => ({ default: m.SitemapSync })),
   { ssr: false }
 );
 function SiteKitClientProviders({
@@ -150,5 +150,5 @@ function SiteKitClientProviders({
 }
 
 export { SiteKitClientProviders };
-//# sourceMappingURL=chunk-NQ3K4NWX.mjs.map
-//# sourceMappingURL=chunk-NQ3K4NWX.mjs.map
+//# sourceMappingURL=chunk-WVAY4ZWC.mjs.map
+//# sourceMappingURL=chunk-WVAY4ZWC.mjs.map

package/dist/{chunk-NQ3K4NWX.mjs.map → chunk-WVAY4ZWC.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/layout/SiteKitClientProviders.tsx"],"names":[],"mappings":";;;;;;;;;;AAyCA,IAAM,qBAAA,GAAwB,OAAA;AAAA,EAC5B,MAAM,OAAO,kCAAgC,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,iBAAA,EAAkB,CAAE,CAAA;AAAA,EAC3F,EAAE,KAAK,KAAA;AACT,CAAA;AACA,IAAM,gBAAA,GAAmB,OAAA;AAAA,EACvB,MAAM,OAAO,6BAAwB,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,YAAA,EAAa,CAAE,CAAA;AAAA,EAC9E,EAAE,KAAK,KAAA;AACT,CAAA;AACA,IAAM,eAAA,GAAkB,OAAA;AAAA,EACtB,MAAM,OAAO,4BAAgB,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,WAAA,EAAY,CAAE,CAAA;AAAA,EACrE,EAAE,KAAK,KAAA;AACT,CAAA;AAwCO,SAAS,sBAAA,CAAuB;AAAA,EACrC,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA,GAAY,IAAA;AAAA,EACZ,MAAA,GAAS,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EACT,WAAA,GAAc,IAAA;AAAA,EACd,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ;AACV,CAAA,EAAgC;AAG9B,EAAA,MAAM,YAAA,GAAe,sBAAsB,KAAK,CAAA;AAEhD,EAAA,MAAM,eAAA,GACJ,OAAO,SAAA,KAAc,QAAA,GAAW,YAAY,EAAC;AAM/C,EAAA,MAAM,eAAe,eAAA,CAAgB,IAAA;AACrC,EAAA,MAAM,aACJ,OAAO,OAAA,KAAY,WAAA,GACf,OAAA,CAAQ,IAAI,oBAAA,GACZ,MAAA;AACN,EAAA,IAAI,eAAe,YAAA,IAAgB,EAAA;AACnC,EAAA,IAAI,CAAC,gBAAgB,UAAA,EAAY;AAC/B,IAAA,IAAI;AACF,MAAA,YAAA,GAAe,IAAI,GAAA,CAAI,UAAU,CAAA,CAAE,IAAA;AAAA,IACrC,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,IAAI,CAAC,YAAA,IAAgB,OAAO,MAAA,KAAW,WAAA,EAAa;AAClD,IAAA,YAAA,GAAe,OAAO,QAAA,CAAS,IAAA;AAAA,EACjC;AAKA,EAAA,MAAM,IAAA,GAAO,iBAAA,CAAkB,YAAY,CAAA,IAAK,EAAA;AAGhD,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAKjC,IAAA,uBAAA,CAAwB,EAAE,UAAA,EAAY,MAAA,EAAQ,MAAA,EAAQ,CAAA;AACrD,IAAC,OAAe,oBAAA,GAAuB,MAAA;AACvC,IAAC,MAAA,CAAe,oBAAA,GAAuB,iBAAA,CAAkB,MAAM,CAAA;AAC/D,IAAC,OAAe,kBAAA,GAAqB,KAAA;AACrC,IAAC,OAAe,iBAAA,GAAoB,IAAA;AAAA,EACvC;AAGA,EAAA,MAAM,CAAC,SAAS,CAAA,GAAI,QAAA,CAAS,MAAM,sBAAsB,CAAA;AACzD,EAAA,MAAM,CAAC,SAAS,CAAA,GAAI,QAAA,CAAS,MAAM,sBAAsB,CAAA;AAGzD,EAAA,MAAM,eAAA,GAAkB,OAAuC,IAAI,CAAA;AACnE,EAAA,MAAM,cAAA,GAAiB,WAAA,CAAY,CAAC,QAAA,KAAsC;AACxE,IAAA,eAAA,CAAgB,OAAA,GAAU,QAAA;AAAA,EAC5B,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,IAAI,OAAA,mCAAa,QAAA,EAAS,CAAA;AAM1B,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,YAAA,GACJ,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,EAAC;AACzC,IAAA,OAAA,mBACE,GAAA;AAAA,MAAC,YAAA;AAAA,MAAA;AAAA,QACC,OAAA,EAAO,IAAA;AAAA,QACP,QAAA,EAAU,aAAa,QAAA,KAAa,KAAA;AAAA,QACpC,WAAA,EAAa,aAAa,WAAA,KAAgB,KAAA;AAAA,QAC1C,gBAAA,EAAkB,aAAa,gBAAA,KAAqB,KAAA;AAAA,QACpD,SAAA;AAAA,QACA,SAAA;AAAA,QACA,eAAA;AAAA,QAEC,QAAA,EAAA;AAAA;AAAA,KACH;AAAA,EAEJ;AAaA,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,OAAA,mBACE,IAAA,CAAA,QAAA,EAAA,EACG,QAAA,EAAA;AAAA,MAAA,OAAA;AAAA,MACA,YAAA,oBACC,GAAA,CAAC,QAAA,EAAA,EAAS,QAAA,EAAU,IAAA,EAClB,QAAA,kBAAA,GAAA;AAAA,QAAC,qBAAA;AAAA,QAAA;AAAA,UACC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,IAAA;AAAA,UACA,cAAA,EAAgB,gBAAgB,cAAA,KAAmB,KAAA;AAAA,UACnD,cAAA,EAAgB,gBAAgB,cAAA,KAAmB,KAAA;AAAA,UACnD,gBAAA,EAAkB,gBAAgB,gBAAA,KAAqB,KAAA;AAAA,UACvD,WAAA,EAAa,gBAAgB,WAAA,KAAgB,KAAA;AAAA,UAC7C,gBAAgB,eAAA,CAAgB,eAAA;AAAA,UAChC,cAAc,eAAA,CAAgB,YAAA;AAAA,UAC9B,KAAA;AAAA,UACA,iBAAA,EAAmB,SAAA;AAAA,UACnB,iBAAA,EAAmB,SAAA;AAAA,UACnB;AAAA;AAAA,OACF,EACF;AAAA,KAAA,EAEJ,CAAA;AAAA,EAEJ;AAGA,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,YAAA,GACJ,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,EAAC;AACzC,IAAA,OAAA,mBACE,IAAA,CAAA,QAAA,EAAA,EACG,QAAA,EAAA;AAAA,MAAA,OAAA;AAAA,MACA,YAAA,oBACC,GAAA;AAAA,QAAC,gBAAA;AAAA,QAAA;AAAA,UACC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,SAAA;AAAA,UACA,QAAA,EAAU,aAAa,QAAA,IAAY,cAAA;AAAA,UACnC,QAAQ,YAAA,CAAa,MAAA;AAAA,UACrB,WAAA,EAAa,aAAa,WAAA,KAAgB;AAAA;AAAA;AAC5C,KAAA,EAEJ,CAAA;AAAA,EAEJ;AAGA,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,OAAA,mBACE,IAAA,CAAA,QAAA,EAAA,EACG,QAAA,EAAA;AAAA,MAAA,OAAA;AAAA,MACA,YAAA,oBAAgB,GAAA,CAAC,eAAA,EAAA,EAAgB,KAAA,EAAc;AAAA,KAAA,EAClD,CAAA;AAAA,EAEJ;AAOA,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,MAAM,gBAA+B,EAAC;AACtC,IAAA,IAAI,SAAA,EAAW,aAAA,CAAc,IAAA,CAAK,WAAW,CAAA;AAC7C,IAAA,IAAI,MAAA,EAAQ,aAAA,CAAc,IAAA,CAAK,QAAQ,CAAA;AACvC,IAAA,IAAI,MAAA,EAAQ,aAAA,CAAc,IAAA,CAAK,QAAQ,CAAA;AACvC,IAAA,IAAI,WAAA,EAAa,aAAA,CAAc,IAAA,CAAK,aAAa,CAAA;AACjD,IAAA,OAAA,mBACE,IAAA,CAAA,QAAA,EAAA,EACG,QAAA,EAAA;AAAA,MAAA,OAAA;AAAA,MACA,YAAA,oBACC,GAAA;AAAA,QAAC,cAAA;AAAA,QAAA;AAAA,UACC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,IAAA;AAAA,UACA,OAAA,EAAS,aAAA;AAAA,UACT,KAAA,EAAO,KAAA;AAAA,UACP;AAAA;AAAA;AACF,KAAA,EAEJ,CAAA;AAAA,EAEJ;AAEA,EAAA,uBACE,GAAA,CAAC,uBAAA,EAAA,EAAwB,SAAA,EAAsB,SAAA,EAC5C,QAAA,EAAA,OAAA,EACH,CAAA;AAEJ","file":"chunk-NQ3K4NWX.mjs","sourcesContent":["'use client'\n\n/**\n * SiteKitClientProviders — Client Island\n *\n * This is the 'use client' boundary for SiteKitLayout.\n * It composes the client-only providers (Analytics, Engage, Signal, SitemapSync)\n * that require React context or browser APIs.\n *\n * All modules are lazy-loaded via next/dynamic so their JS is only downloaded\n * when the feature is enabled — keeping the initial bundle lightweight.\n *\n * All modules share a unified identity (visitor ID + session ID) via\n * SiteKitIdentityProvider, ensuring consistent tracking across Analytics,\n * Signal, and Engage.\n *\n * Props are passed down from the server-side SiteKitLayout component,\n * which reads env vars at render time.\n */\n\nimport React, { Suspense, useCallback, useRef, useState, type ReactNode } from 'react'\nimport dynamic from 'next/dynamic'\nimport {\n  SiteKitIdentityProvider,\n  getOrCreateVisitorId,\n  getOrCreateSessionId,\n} from '../shared/identity'\nimport { normalizeSiteHost } from '../sites/contract'\n// Defer non-critical module mounting until the page is quiet: the lazy\n// modules below are dynamic(ssr:false) and never render on the server, but\n// rendering them during hydration still kicks off their chunk downloads +\n// mount effects inside the critical startup window. useDeferredActivation\n// holds them until window.load + idle or first interaction — the same\n// strategy as the hand-rolled per-site deferrals this replaces (upforge\n// `deferred-analytics.tsx`, TPS `DeferredAnalytics.tsx`). The hook is public\n// (`@sonordev/site-kit/client`) so sites can reuse it for their own scripts.\nimport { useDeferredActivation } from '../shared/defer'\nimport { configureSiteCredential, currentCredential } from '../shared/siteToken'\nimport type { AnalyticsConfig, EngageConfig, SignalConfig } from './types'\n\n// Lazy-load feature modules — JS only downloaded when feature is enabled\nconst LazyAnalyticsProvider = dynamic(\n  () => import('../analytics/AnalyticsProvider').then(m => ({ default: m.AnalyticsProvider })),\n  { ssr: false },\n)\nconst LazyEngageWidget = dynamic(\n  () => import('../engage/EngageWidget').then(m => ({ default: m.EngageWidget })),\n  { ssr: false },\n)\nconst LazySitemapSync = dynamic(\n  () => import('../SitemapSync').then(m => ({ default: m.SitemapSync })),\n  { ssr: false },\n)\n// SignalBridge is imported STATICALLY, not via dynamic(ssr:false): it is a\n// tiny SSR-safe context shell that renders children immediately and\n// lazy-loads its machinery (SignalCore) as a childless sibling internally.\n// Wrapping children in a dynamic(ssr:false) component was the old SSR-bailout\n// failure mode — do not reintroduce it.\nimport { SignalBridge } from '../signal/SignalBridge'\n// Fleet heartbeat: a deferred, CHILDLESS SIBLING (like Analytics/Engage) that\n// reports this site's kit version + active modules once per session, so the\n// platform can see version drift across the fleet. Tiny and SSR-safe — renders\n// null until the shared idle gate fires; never wraps page content.\nimport { FleetHeartbeat } from '../fleet/FleetHeartbeat'\nimport type { FleetModule } from '../fleet/contract'\n\nexport interface SiteKitClientProvidersProps {\n  children: ReactNode\n  apiKey: string\n  apiUrl: string\n  projectId?: string\n  analytics?: boolean | AnalyticsConfig\n  engage?: boolean | EngageConfig\n  signal?: boolean | SignalConfig\n  sitemapSync?: boolean\n  /**\n   * Fleet heartbeat — reports kit version + active modules to Sonor once per\n   * session so the platform can track version drift and key state across every\n   * site. Default true. Deferred exactly like Analytics; never in the hydration\n   * path, carries no visitor data.\n   */\n  fleet?: boolean\n  /**\n   * Defer Analytics / Engage / SitemapSync until window load + idle or first\n   * interaction (default true). Pass false to restore legacy eager mounting\n   * on hydration. SignalBridge is never deferred — it must apply experiment\n   * variants as early as possible.\n   */\n  defer?: boolean\n  debug?: boolean\n}\n\nexport function SiteKitClientProviders({\n  children,\n  apiKey,\n  apiUrl,\n  projectId,\n  analytics = true,\n  engage = true,\n  signal = false,\n  sitemapSync = true,\n  fleet = true,\n  defer = true,\n  debug = false,\n}: SiteKitClientProvidersProps) {\n  // One shared activation gate for all deferred siblings, so they mount in a\n  // single commit instead of staggered re-renders.\n  const modulesReady = useDeferredActivation(defer)\n  // Hoist analytics config so the `site` dimension is resolvable up here.\n  const analyticsConfig: AnalyticsConfig =\n    typeof analytics === 'object' ? analytics : {}\n\n  // Resolve the sub-site identifier — the dimension that lets one Sonor project\n  // host many sites (e.g. truepowersystems.com + ohiopowerstudies.com under one\n  // TPS project). Precedence: explicit `analytics.site` > NEXT_PUBLIC_SITE_URL\n  // host > window.location.host. Always a string (possibly empty).\n  const explicitSite = analyticsConfig.site\n  const envSiteUrl =\n    typeof process !== 'undefined'\n      ? process.env.NEXT_PUBLIC_SITE_URL\n      : undefined\n  let resolvedSite = explicitSite ?? ''\n  if (!resolvedSite && envSiteUrl) {\n    try {\n      resolvedSite = new URL(envSiteUrl).host\n    } catch {\n      /* malformed URL — fall through to client-side host */\n    }\n  }\n  if (!resolvedSite && typeof window !== 'undefined') {\n    resolvedSite = window.location.host\n  }\n  // Normalize with the shared site contract (lowercase host, no protocol/path/\n  // port) so `__SITE_KIT_SITE__` matches exactly what the Sonor API stores —\n  // servers re-normalize with the same rule, so this only makes the client\n  // emit the canonical value. Always a string (possibly empty).\n  const site = normalizeSiteHost(resolvedSite) ?? ''\n\n  // Set window globals for modules that still read from them.\n  if (typeof window !== 'undefined') {\n    // Seed the client token manager. In 3.2+ `apiKey` is a short-lived minted\n    // token that sonorFetch refreshes transparently; the window global is set to\n    // the freshest token held (a prior page this session may have refreshed).\n    // In raw-key mode (2.x kit or mint-failed fallback) this is a passthrough.\n    configureSiteCredential({ credential: apiKey, apiUrl })\n    ;(window as any).__SITE_KIT_API_URL__ = apiUrl\n    ;(window as any).__SITE_KIT_API_KEY__ = currentCredential(apiKey)\n    ;(window as any).__SITE_KIT_DEBUG__ = debug\n    ;(window as any).__SITE_KIT_SITE__ = site\n  }\n\n  // Unified identity — single source of truth for all modules\n  const [visitorId] = useState(() => getOrCreateVisitorId())\n  const [sessionId] = useState(() => getOrCreateSessionId())\n\n  // Page metadata bridge: Analytics writes, Signal reads\n  const pageMetadataRef = useRef<Record<string, unknown> | null>(null)\n  const onPageMetadata = useCallback((metadata: Record<string, unknown>) => {\n    pageMetadataRef.current = metadata\n  }, [])\n\n  let content = <>{children}</>\n\n  // Wrap with SignalBridge if enabled. Safe to wrap: the shell is SSR-safe\n  // and renders children straight through — the heavy machinery mounts as a\n  // childless sibling inside it. Not gated on modulesReady: experiment\n  // variants must apply as early as possible.\n  if (signal) {\n    const signalConfig: SignalConfig =\n      typeof signal === 'object' ? signal : {}\n    content = (\n      <SignalBridge\n        enabled\n        realtime={signalConfig.realtime !== false}\n        experiments={signalConfig.experiments !== false}\n        behaviorTracking={signalConfig.behaviorTracking !== false}\n        visitorId={visitorId}\n        sessionId={sessionId}\n        pageMetadataRef={pageMetadataRef}\n      >\n        {content}\n      </SignalBridge>\n    )\n  }\n\n  // Add Analytics if enabled (renders alongside, doesn't wrap).\n  //\n  // CRITICAL: LazyAnalyticsProvider is dynamic(..., { ssr: false }). Wrapping\n  // {content} inside an ssr:false component makes the entire page tree skip\n  // server rendering — the route de-opts to 100% client rendering and the\n  // hero / LCP element only paints after hydration (mobile LCP ~4s, Lighthouse\n  // ~85). Analytics tracks via effects + a metadata ref, so it never needs to\n  // wrap page content — mount it as a childless sibling, exactly like Engage.\n  // Each deferred sibling is appended as `{modulesReady && <Module/>}` so the\n  // children slot never moves in the tree — flipping ready only mounts the\n  // sibling, it never remounts page content.\n  if (analytics) {\n    content = (\n      <>\n        {content}\n        {modulesReady && (\n          <Suspense fallback={null}>\n            <LazyAnalyticsProvider\n              apiUrl={apiUrl}\n              apiKey={apiKey}\n              site={site}\n              trackPageViews={analyticsConfig.trackPageViews !== false}\n              trackWebVitals={analyticsConfig.trackWebVitals !== false}\n              trackScrollDepth={analyticsConfig.trackScrollDepth !== false}\n              trackClicks={analyticsConfig.trackClicks !== false}\n              sessionTimeout={analyticsConfig.sessionDuration}\n              excludePaths={analyticsConfig.excludePaths}\n              debug={debug}\n              externalVisitorId={visitorId}\n              externalSessionId={sessionId}\n              onPageMetadata={onPageMetadata}\n            />\n          </Suspense>\n        )}\n      </>\n    )\n  }\n\n  // Add Engage widget if enabled (renders alongside, doesn't wrap)\n  if (engage) {\n    const engageConfig: EngageConfig =\n      typeof engage === 'object' ? engage : {}\n    content = (\n      <>\n        {content}\n        {modulesReady && (\n          <LazyEngageWidget\n            apiUrl={apiUrl}\n            apiKey={apiKey}\n            projectId={projectId}\n            position={engageConfig.position || 'bottom-right'}\n            zIndex={engageConfig.zIndex}\n            chatEnabled={engageConfig.chatEnabled !== false}\n          />\n        )}\n      </>\n    )\n  }\n\n  // Add SitemapSync if enabled\n  if (sitemapSync) {\n    content = (\n      <>\n        {content}\n        {modulesReady && <LazySitemapSync debug={debug} />}\n      </>\n    )\n  }\n\n  // Fleet heartbeat — childless sibling on the same modulesReady idle gate.\n  // Reports the modules actually enabled on THIS layout (honest client-observable\n  // set) so the platform can answer \"which version / modules is each site\n  // running\". defer={false}: the modulesReady gate already handled deferral, so\n  // the heartbeat fires on mount (still bounded to once per session internally).\n  if (fleet) {\n    const activeModules: FleetModule[] = []\n    if (analytics) activeModules.push('analytics')\n    if (engage) activeModules.push('engage')\n    if (signal) activeModules.push('signal')\n    if (sitemapSync) activeModules.push('sitemapSync')\n    content = (\n      <>\n        {content}\n        {modulesReady && (\n          <FleetHeartbeat\n            apiUrl={apiUrl}\n            apiKey={apiKey}\n            site={site}\n            modules={activeModules}\n            defer={false}\n            debug={debug}\n          />\n        )}\n      </>\n    )\n  }\n\n  return (\n    <SiteKitIdentityProvider visitorId={visitorId} sessionId={sessionId}>\n      {content}\n    </SiteKitIdentityProvider>\n  )\n}\n"]}
+{"version":3,"sources":["../src/layout/SiteKitClientProviders.tsx"],"names":[],"mappings":";;;;;;;;;;AAyCA,IAAM,qBAAA,GAAwB,OAAA;AAAA,EAC5B,MAAM,OAAO,kCAAgC,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,iBAAA,EAAkB,CAAE,CAAA;AAAA,EAC3F,EAAE,KAAK,KAAA;AACT,CAAA;AACA,IAAM,gBAAA,GAAmB,OAAA;AAAA,EACvB,MAAM,OAAO,6BAAwB,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,YAAA,EAAa,CAAE,CAAA;AAAA,EAC9E,EAAE,KAAK,KAAA;AACT,CAAA;AACA,IAAM,eAAA,GAAkB,OAAA;AAAA,EACtB,MAAM,OAAO,4BAAgB,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,WAAA,EAAY,CAAE,CAAA;AAAA,EACrE,EAAE,KAAK,KAAA;AACT,CAAA;AAwCO,SAAS,sBAAA,CAAuB;AAAA,EACrC,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA,GAAY,IAAA;AAAA,EACZ,MAAA,GAAS,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EACT,WAAA,GAAc,IAAA;AAAA,EACd,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ;AACV,CAAA,EAAgC;AAG9B,EAAA,MAAM,YAAA,GAAe,sBAAsB,KAAK,CAAA;AAEhD,EAAA,MAAM,eAAA,GACJ,OAAO,SAAA,KAAc,QAAA,GAAW,YAAY,EAAC;AAM/C,EAAA,MAAM,eAAe,eAAA,CAAgB,IAAA;AACrC,EAAA,MAAM,aACJ,OAAO,OAAA,KAAY,WAAA,GACf,OAAA,CAAQ,IAAI,oBAAA,GACZ,MAAA;AACN,EAAA,IAAI,eAAe,YAAA,IAAgB,EAAA;AACnC,EAAA,IAAI,CAAC,gBAAgB,UAAA,EAAY;AAC/B,IAAA,IAAI;AACF,MAAA,YAAA,GAAe,IAAI,GAAA,CAAI,UAAU,CAAA,CAAE,IAAA;AAAA,IACrC,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,IAAI,CAAC,YAAA,IAAgB,OAAO,MAAA,KAAW,WAAA,EAAa;AAClD,IAAA,YAAA,GAAe,OAAO,QAAA,CAAS,IAAA;AAAA,EACjC;AAKA,EAAA,MAAM,IAAA,GAAO,iBAAA,CAAkB,YAAY,CAAA,IAAK,EAAA;AAGhD,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAKjC,IAAA,uBAAA,CAAwB,EAAE,UAAA,EAAY,MAAA,EAAQ,MAAA,EAAQ,CAAA;AACrD,IAAC,OAAe,oBAAA,GAAuB,MAAA;AACvC,IAAC,MAAA,CAAe,oBAAA,GAAuB,iBAAA,CAAkB,MAAM,CAAA;AAC/D,IAAC,OAAe,kBAAA,GAAqB,KAAA;AACrC,IAAC,OAAe,iBAAA,GAAoB,IAAA;AAAA,EACvC;AAGA,EAAA,MAAM,CAAC,SAAS,CAAA,GAAI,QAAA,CAAS,MAAM,sBAAsB,CAAA;AACzD,EAAA,MAAM,CAAC,SAAS,CAAA,GAAI,QAAA,CAAS,MAAM,sBAAsB,CAAA;AAGzD,EAAA,MAAM,eAAA,GAAkB,OAAuC,IAAI,CAAA;AACnE,EAAA,MAAM,cAAA,GAAiB,WAAA,CAAY,CAAC,QAAA,KAAsC;AACxE,IAAA,eAAA,CAAgB,OAAA,GAAU,QAAA;AAAA,EAC5B,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,IAAI,OAAA,mCAAa,QAAA,EAAS,CAAA;AAM1B,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,YAAA,GACJ,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,EAAC;AACzC,IAAA,OAAA,mBACE,GAAA;AAAA,MAAC,YAAA;AAAA,MAAA;AAAA,QACC,OAAA,EAAO,IAAA;AAAA,QACP,QAAA,EAAU,aAAa,QAAA,KAAa,KAAA;AAAA,QACpC,WAAA,EAAa,aAAa,WAAA,KAAgB,KAAA;AAAA,QAC1C,gBAAA,EAAkB,aAAa,gBAAA,KAAqB,KAAA;AAAA,QACpD,SAAA;AAAA,QACA,SAAA;AAAA,QACA,eAAA;AAAA,QAEC,QAAA,EAAA;AAAA;AAAA,KACH;AAAA,EAEJ;AAaA,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,OAAA,mBACE,IAAA,CAAA,QAAA,EAAA,EACG,QAAA,EAAA;AAAA,MAAA,OAAA;AAAA,MACA,YAAA,oBACC,GAAA,CAAC,QAAA,EAAA,EAAS,QAAA,EAAU,IAAA,EAClB,QAAA,kBAAA,GAAA;AAAA,QAAC,qBAAA;AAAA,QAAA;AAAA,UACC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,IAAA;AAAA,UACA,cAAA,EAAgB,gBAAgB,cAAA,KAAmB,KAAA;AAAA,UACnD,cAAA,EAAgB,gBAAgB,cAAA,KAAmB,KAAA;AAAA,UACnD,gBAAA,EAAkB,gBAAgB,gBAAA,KAAqB,KAAA;AAAA,UACvD,WAAA,EAAa,gBAAgB,WAAA,KAAgB,KAAA;AAAA,UAC7C,gBAAgB,eAAA,CAAgB,eAAA;AAAA,UAChC,cAAc,eAAA,CAAgB,YAAA;AAAA,UAC9B,KAAA;AAAA,UACA,iBAAA,EAAmB,SAAA;AAAA,UACnB,iBAAA,EAAmB,SAAA;AAAA,UACnB;AAAA;AAAA,OACF,EACF;AAAA,KAAA,EAEJ,CAAA;AAAA,EAEJ;AAGA,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,YAAA,GACJ,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,EAAC;AACzC,IAAA,OAAA,mBACE,IAAA,CAAA,QAAA,EAAA,EACG,QAAA,EAAA;AAAA,MAAA,OAAA;AAAA,MACA,YAAA,oBACC,GAAA;AAAA,QAAC,gBAAA;AAAA,QAAA;AAAA,UACC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,SAAA;AAAA,UACA,QAAA,EAAU,aAAa,QAAA,IAAY,cAAA;AAAA,UACnC,QAAQ,YAAA,CAAa,MAAA;AAAA,UACrB,WAAA,EAAa,aAAa,WAAA,KAAgB;AAAA;AAAA;AAC5C,KAAA,EAEJ,CAAA;AAAA,EAEJ;AAGA,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,OAAA,mBACE,IAAA,CAAA,QAAA,EAAA,EACG,QAAA,EAAA;AAAA,MAAA,OAAA;AAAA,MACA,YAAA,oBAAgB,GAAA,CAAC,eAAA,EAAA,EAAgB,KAAA,EAAc;AAAA,KAAA,EAClD,CAAA;AAAA,EAEJ;AAOA,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,MAAM,gBAA+B,EAAC;AACtC,IAAA,IAAI,SAAA,EAAW,aAAA,CAAc,IAAA,CAAK,WAAW,CAAA;AAC7C,IAAA,IAAI,MAAA,EAAQ,aAAA,CAAc,IAAA,CAAK,QAAQ,CAAA;AACvC,IAAA,IAAI,MAAA,EAAQ,aAAA,CAAc,IAAA,CAAK,QAAQ,CAAA;AACvC,IAAA,IAAI,WAAA,EAAa,aAAA,CAAc,IAAA,CAAK,aAAa,CAAA;AACjD,IAAA,OAAA,mBACE,IAAA,CAAA,QAAA,EAAA,EACG,QAAA,EAAA;AAAA,MAAA,OAAA;AAAA,MACA,YAAA,oBACC,GAAA;AAAA,QAAC,cAAA;AAAA,QAAA;AAAA,UACC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,IAAA;AAAA,UACA,OAAA,EAAS,aAAA;AAAA,UACT,KAAA,EAAO,KAAA;AAAA,UACP;AAAA;AAAA;AACF,KAAA,EAEJ,CAAA;AAAA,EAEJ;AAEA,EAAA,uBACE,GAAA,CAAC,uBAAA,EAAA,EAAwB,SAAA,EAAsB,SAAA,EAC5C,QAAA,EAAA,OAAA,EACH,CAAA;AAEJ","file":"chunk-WVAY4ZWC.mjs","sourcesContent":["'use client'\n\n/**\n * SiteKitClientProviders — Client Island\n *\n * This is the 'use client' boundary for SiteKitLayout.\n * It composes the client-only providers (Analytics, Engage, Signal, SitemapSync)\n * that require React context or browser APIs.\n *\n * All modules are lazy-loaded via next/dynamic so their JS is only downloaded\n * when the feature is enabled — keeping the initial bundle lightweight.\n *\n * All modules share a unified identity (visitor ID + session ID) via\n * SiteKitIdentityProvider, ensuring consistent tracking across Analytics,\n * Signal, and Engage.\n *\n * Props are passed down from the server-side SiteKitLayout component,\n * which reads env vars at render time.\n */\n\nimport React, { Suspense, useCallback, useRef, useState, type ReactNode } from 'react'\nimport dynamic from 'next/dynamic'\nimport {\n  SiteKitIdentityProvider,\n  getOrCreateVisitorId,\n  getOrCreateSessionId,\n} from '../shared/identity'\nimport { normalizeSiteHost } from '../sites/contract'\n// Defer non-critical module mounting until the page is quiet: the lazy\n// modules below are dynamic(ssr:false) and never render on the server, but\n// rendering them during hydration still kicks off their chunk downloads +\n// mount effects inside the critical startup window. useDeferredActivation\n// holds them until window.load + idle or first interaction — the same\n// strategy as the hand-rolled per-site deferrals this replaces (upforge\n// `deferred-analytics.tsx`, TPS `DeferredAnalytics.tsx`). The hook is public\n// (`@sonordev/site-kit/client`) so sites can reuse it for their own scripts.\nimport { useDeferredActivation } from '../shared/defer'\nimport { configureSiteCredential, currentCredential } from '../shared/siteToken'\nimport type { AnalyticsConfig, EngageConfig, SignalConfig } from './types'\n\n// Lazy-load feature modules — JS only downloaded when feature is enabled\nconst LazyAnalyticsProvider = dynamic(\n  () => import('../analytics/AnalyticsProvider').then(m => ({ default: m.AnalyticsProvider })),\n  { ssr: false },\n)\nconst LazyEngageWidget = dynamic(\n  () => import('../engage/EngageWidget').then(m => ({ default: m.EngageWidget })),\n  { ssr: false },\n)\nconst LazySitemapSync = dynamic(\n  () => import('../SitemapSync').then(m => ({ default: m.SitemapSync })),\n  { ssr: false },\n)\n// SignalBridge is imported STATICALLY, not via dynamic(ssr:false): it is a\n// tiny SSR-safe context shell that renders children immediately and\n// lazy-loads its machinery (SignalCore) as a childless sibling internally.\n// Wrapping children in a dynamic(ssr:false) component was the old SSR-bailout\n// failure mode — do not reintroduce it.\nimport { SignalBridge } from '../signal/SignalBridge'\n// Fleet heartbeat: a deferred, CHILDLESS SIBLING (like Analytics/Engage) that\n// reports this site's kit version + active modules once per session, so the\n// platform can see version drift across the fleet. Tiny and SSR-safe — renders\n// null until the shared idle gate fires; never wraps page content.\nimport { FleetHeartbeat } from '../fleet/FleetHeartbeat'\nimport type { FleetModule } from '../fleet/contract'\n\nexport interface SiteKitClientProvidersProps {\n  children: ReactNode\n  apiKey: string\n  apiUrl: string\n  projectId?: string\n  analytics?: boolean | AnalyticsConfig\n  engage?: boolean | EngageConfig\n  signal?: boolean | SignalConfig\n  sitemapSync?: boolean\n  /**\n   * Fleet heartbeat — reports kit version + active modules to Sonor once per\n   * session so the platform can track version drift and key state across every\n   * site. Default true. Deferred exactly like Analytics; never in the hydration\n   * path, carries no visitor data.\n   */\n  fleet?: boolean\n  /**\n   * Defer Analytics / Engage / SitemapSync until window load + idle or first\n   * interaction (default true). Pass false to restore legacy eager mounting\n   * on hydration. SignalBridge is never deferred — it must apply experiment\n   * variants as early as possible.\n   */\n  defer?: boolean\n  debug?: boolean\n}\n\nexport function SiteKitClientProviders({\n  children,\n  apiKey,\n  apiUrl,\n  projectId,\n  analytics = true,\n  engage = true,\n  signal = false,\n  sitemapSync = true,\n  fleet = true,\n  defer = true,\n  debug = false,\n}: SiteKitClientProvidersProps) {\n  // One shared activation gate for all deferred siblings, so they mount in a\n  // single commit instead of staggered re-renders.\n  const modulesReady = useDeferredActivation(defer)\n  // Hoist analytics config so the `site` dimension is resolvable up here.\n  const analyticsConfig: AnalyticsConfig =\n    typeof analytics === 'object' ? analytics : {}\n\n  // Resolve the sub-site identifier — the dimension that lets one Sonor project\n  // host many sites (e.g. truepowersystems.com + ohiopowerstudies.com under one\n  // TPS project). Precedence: explicit `analytics.site` > NEXT_PUBLIC_SITE_URL\n  // host > window.location.host. Always a string (possibly empty).\n  const explicitSite = analyticsConfig.site\n  const envSiteUrl =\n    typeof process !== 'undefined'\n      ? process.env.NEXT_PUBLIC_SITE_URL\n      : undefined\n  let resolvedSite = explicitSite ?? ''\n  if (!resolvedSite && envSiteUrl) {\n    try {\n      resolvedSite = new URL(envSiteUrl).host\n    } catch {\n      /* malformed URL — fall through to client-side host */\n    }\n  }\n  if (!resolvedSite && typeof window !== 'undefined') {\n    resolvedSite = window.location.host\n  }\n  // Normalize with the shared site contract (lowercase host, no protocol/path/\n  // port) so `__SITE_KIT_SITE__` matches exactly what the Sonor API stores —\n  // servers re-normalize with the same rule, so this only makes the client\n  // emit the canonical value. Always a string (possibly empty).\n  const site = normalizeSiteHost(resolvedSite) ?? ''\n\n  // Set window globals for modules that still read from them.\n  if (typeof window !== 'undefined') {\n    // Seed the client token manager. In 3.2+ `apiKey` is a short-lived minted\n    // token that sonorFetch refreshes transparently; the window global is set to\n    // the freshest token held (a prior page this session may have refreshed).\n    // In raw-key mode (2.x kit or mint-failed fallback) this is a passthrough.\n    configureSiteCredential({ credential: apiKey, apiUrl })\n    ;(window as any).__SITE_KIT_API_URL__ = apiUrl\n    ;(window as any).__SITE_KIT_API_KEY__ = currentCredential(apiKey)\n    ;(window as any).__SITE_KIT_DEBUG__ = debug\n    ;(window as any).__SITE_KIT_SITE__ = site\n  }\n\n  // Unified identity — single source of truth for all modules\n  const [visitorId] = useState(() => getOrCreateVisitorId())\n  const [sessionId] = useState(() => getOrCreateSessionId())\n\n  // Page metadata bridge: Analytics writes, Signal reads\n  const pageMetadataRef = useRef<Record<string, unknown> | null>(null)\n  const onPageMetadata = useCallback((metadata: Record<string, unknown>) => {\n    pageMetadataRef.current = metadata\n  }, [])\n\n  let content = <>{children}</>\n\n  // Wrap with SignalBridge if enabled. Safe to wrap: the shell is SSR-safe\n  // and renders children straight through — the heavy machinery mounts as a\n  // childless sibling inside it. Not gated on modulesReady: experiment\n  // variants must apply as early as possible.\n  if (signal) {\n    const signalConfig: SignalConfig =\n      typeof signal === 'object' ? signal : {}\n    content = (\n      <SignalBridge\n        enabled\n        realtime={signalConfig.realtime !== false}\n        experiments={signalConfig.experiments !== false}\n        behaviorTracking={signalConfig.behaviorTracking !== false}\n        visitorId={visitorId}\n        sessionId={sessionId}\n        pageMetadataRef={pageMetadataRef}\n      >\n        {content}\n      </SignalBridge>\n    )\n  }\n\n  // Add Analytics if enabled (renders alongside, doesn't wrap).\n  //\n  // CRITICAL: LazyAnalyticsProvider is dynamic(..., { ssr: false }). Wrapping\n  // {content} inside an ssr:false component makes the entire page tree skip\n  // server rendering — the route de-opts to 100% client rendering and the\n  // hero / LCP element only paints after hydration (mobile LCP ~4s, Lighthouse\n  // ~85). Analytics tracks via effects + a metadata ref, so it never needs to\n  // wrap page content — mount it as a childless sibling, exactly like Engage.\n  // Each deferred sibling is appended as `{modulesReady && <Module/>}` so the\n  // children slot never moves in the tree — flipping ready only mounts the\n  // sibling, it never remounts page content.\n  if (analytics) {\n    content = (\n      <>\n        {content}\n        {modulesReady && (\n          <Suspense fallback={null}>\n            <LazyAnalyticsProvider\n              apiUrl={apiUrl}\n              apiKey={apiKey}\n              site={site}\n              trackPageViews={analyticsConfig.trackPageViews !== false}\n              trackWebVitals={analyticsConfig.trackWebVitals !== false}\n              trackScrollDepth={analyticsConfig.trackScrollDepth !== false}\n              trackClicks={analyticsConfig.trackClicks !== false}\n              sessionTimeout={analyticsConfig.sessionDuration}\n              excludePaths={analyticsConfig.excludePaths}\n              debug={debug}\n              externalVisitorId={visitorId}\n              externalSessionId={sessionId}\n              onPageMetadata={onPageMetadata}\n            />\n          </Suspense>\n        )}\n      </>\n    )\n  }\n\n  // Add Engage widget if enabled (renders alongside, doesn't wrap)\n  if (engage) {\n    const engageConfig: EngageConfig =\n      typeof engage === 'object' ? engage : {}\n    content = (\n      <>\n        {content}\n        {modulesReady && (\n          <LazyEngageWidget\n            apiUrl={apiUrl}\n            apiKey={apiKey}\n            projectId={projectId}\n            position={engageConfig.position || 'bottom-right'}\n            zIndex={engageConfig.zIndex}\n            chatEnabled={engageConfig.chatEnabled !== false}\n          />\n        )}\n      </>\n    )\n  }\n\n  // Add SitemapSync if enabled\n  if (sitemapSync) {\n    content = (\n      <>\n        {content}\n        {modulesReady && <LazySitemapSync debug={debug} />}\n      </>\n    )\n  }\n\n  // Fleet heartbeat — childless sibling on the same modulesReady idle gate.\n  // Reports the modules actually enabled on THIS layout (honest client-observable\n  // set) so the platform can answer \"which version / modules is each site\n  // running\". defer={false}: the modulesReady gate already handled deferral, so\n  // the heartbeat fires on mount (still bounded to once per session internally).\n  if (fleet) {\n    const activeModules: FleetModule[] = []\n    if (analytics) activeModules.push('analytics')\n    if (engage) activeModules.push('engage')\n    if (signal) activeModules.push('signal')\n    if (sitemapSync) activeModules.push('sitemapSync')\n    content = (\n      <>\n        {content}\n        {modulesReady && (\n          <FleetHeartbeat\n            apiUrl={apiUrl}\n            apiKey={apiKey}\n            site={site}\n            modules={activeModules}\n            defer={false}\n            debug={debug}\n          />\n        )}\n      </>\n    )\n  }\n\n  return (\n    <SiteKitIdentityProvider visitorId={visitorId} sessionId={sessionId}>\n      {content}\n    </SiteKitIdentityProvider>\n  )\n}\n"]}

package/dist/{chunk-3BNFUMLL.js → chunk-XB57AM6T.js}

@@ -1,24 +1,15 @@
 'use client';
 'use strict';
 
+var chunkVJMPIRSD_js = require('./chunk-VJMPIRSD.js');
 var react = require('react');
 var jsxRuntime = require('react/jsx-runtime');
 
-// src/shared/identity.tsx
-function generateId() {
-  if (typeof crypto !== "undefined" && crypto.randomUUID) {
-    return crypto.randomUUID();
-  }
-  return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (c) => {
-    const r = Math.random() * 16 | 0;
-    return (c === "x" ? r : r & 3 | 8).toString(16);
-  });
-}
 function getOrCreateVisitorId() {
   if (typeof window === "undefined") return "";
   let visitorId = localStorage.getItem("_sk_vid");
   if (!visitorId) {
-    visitorId = generateId();
+    visitorId = chunkVJMPIRSD_js.uuid();
   }
   localStorage.setItem("_sk_vid", visitorId);
   return visitorId;
@@ -37,7 +28,7 @@ function getOrCreateSessionId(timeoutMinutes = 30) {
       return existingSession;
     }
   }
-  const newSession = generateId();
+  const newSession = chunkVJMPIRSD_js.uuid();
   sessionStorage.setItem("_sk_sid", newSession);
   sessionStorage.setItem("_sk_stime", now.toString());
   return newSession;
@@ -64,5 +55,5 @@ exports.SiteKitIdentityProvider = SiteKitIdentityProvider;
 exports.getOrCreateSessionId = getOrCreateSessionId;
 exports.getOrCreateVisitorId = getOrCreateVisitorId;
 exports.useSiteKitIdentity = useSiteKitIdentity;
-//# sourceMappingURL=chunk-3BNFUMLL.js.map
-//# sourceMappingURL=chunk-3BNFUMLL.js.map
+//# sourceMappingURL=chunk-XB57AM6T.js.map
+//# sourceMappingURL=chunk-XB57AM6T.js.map

package/dist/chunk-XB57AM6T.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared/identity.tsx"],"names":["uuid","createContext","useMemo","jsx","useContext"],"mappings":";;;;;;AAyBO,SAAS,oBAAA,GAA+B;AAC7C,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,EAAA;AAE1C,EAAA,IAAI,SAAA,GAAY,YAAA,CAAa,OAAA,CAAQ,SAAS,CAAA;AAE9C,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,SAAA,GAAYA,qBAAA,EAAK;AAAA,EACnB;AAEA,EAAA,YAAA,CAAa,OAAA,CAAQ,WAAW,SAAS,CAAA;AACzC,EAAA,OAAO,SAAA;AACT;AAOO,SAAS,oBAAA,CAAqB,iBAAiB,EAAA,EAAY;AAChE,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,EAAA;AAE1C,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,SAAA,GAAY,iBAAiB,EAAA,GAAK,GAAA;AAExC,EAAA,MAAM,eAAA,GAAkB,cAAA,CAAe,OAAA,CAAQ,SAAS,CAAA;AACxD,EAAA,MAAM,YAAA,GAAe,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AAEvD,EAAA,IAAI,mBAAmB,YAAA,EAAc;AACnC,IAAA,MAAM,OAAA,GAAU,GAAA,GAAM,QAAA,CAAS,YAAA,EAAc,EAAE,CAAA;AAC/C,IAAA,IAAI,UAAU,SAAA,EAAW;AAEvB,MAAA,cAAA,CAAe,OAAA,CAAQ,WAAA,EAAa,GAAA,CAAI,QAAA,EAAU,CAAA;AAClD,MAAA,cAAA,CAAe,OAAA,CAAQ,WAAW,eAAe,CAAA;AACjD,MAAA,OAAO,eAAA;AAAA,IACT;AAAA,EACF;AAGA,EAAA,MAAM,aAAaA,qBAAA,EAAK;AACxB,EAAA,cAAA,CAAe,OAAA,CAAQ,WAAW,UAAU,CAAA;AAC5C,EAAA,cAAA,CAAe,OAAA,CAAQ,WAAA,EAAa,GAAA,CAAI,QAAA,EAAU,CAAA;AAClD,EAAA,OAAO,UAAA;AACT;AAWA,IAAM,sBAAA,GAAyBC,oBAAsC,IAAI,CAAA;AAQlE,SAAS,uBAAA,CAAwB;AAAA,EACtC,SAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF,CAAA,EAAiC;AAC/B,EAAA,MAAM,KAAA,GAAQC,aAAA,CAAQ,OAAO,EAAE,SAAA,EAAW,WAAU,CAAA,EAAI,CAAC,SAAA,EAAW,SAAS,CAAC,CAAA;AAE9E,EAAA,uBACEC,cAAA,CAAC,sBAAA,CAAuB,QAAA,EAAvB,EAAgC,OAC9B,QAAA,EACH,CAAA;AAEJ;AAMO,SAAS,kBAAA,GAAsC;AACpD,EAAA,MAAM,OAAA,GAAUC,iBAAW,sBAAsB,CAAA;AACjD,EAAA,IAAI,SAAS,OAAO,OAAA;AAGpB,EAAA,OAAO;AAAA,IACL,WAAW,oBAAA,EAAqB;AAAA,IAChC,WAAW,oBAAA;AAAqB,GAClC;AACF","file":"chunk-XB57AM6T.js","sourcesContent":["/**\n * @sonordev/site-kit/shared — Unified Identity Management\n *\n * Single source of truth for visitor and session IDs across\n * Analytics, Signal, and Engage modules.\n *\n * Storage keys:\n *   localStorage:    _sk_vid   (visitor ID, persists ~forever)\n *   sessionStorage:  _sk_sid   (session ID, per-tab)\n *   sessionStorage:  _sk_stime (last activity timestamp for timeout)\n *\n * Storage keys are prefixed with `_sk_*`.\n */\n\n'use client'\n\nimport React, { createContext, useContext, useMemo } from 'react'\n// Single source of truth for v4 UUIDs — safe on plain HTTP and older Safari,\n// where crypto.randomUUID is undefined. Do NOT re-fork ID generation here.\nimport { uuid } from './uuid'\n\n/**\n * Get or create a persistent visitor ID.\n * Stored in localStorage under `_sk_vid`.\n */\nexport function getOrCreateVisitorId(): string {\n  if (typeof window === 'undefined') return ''\n\n  let visitorId = localStorage.getItem('_sk_vid')\n\n  if (!visitorId) {\n    visitorId = uuid()\n  }\n\n  localStorage.setItem('_sk_vid', visitorId)\n  return visitorId\n}\n\n/**\n * Get or create a session ID with inactivity timeout.\n * Stored in sessionStorage under `_sk_sid`.\n * Session expires after `timeoutMinutes` of inactivity (default 30).\n */\nexport function getOrCreateSessionId(timeoutMinutes = 30): string {\n  if (typeof window === 'undefined') return ''\n\n  const now = Date.now()\n  const timeoutMs = timeoutMinutes * 60 * 1000\n\n  const existingSession = sessionStorage.getItem('_sk_sid')\n  const lastActivity = sessionStorage.getItem('_sk_stime')\n\n  if (existingSession && lastActivity) {\n    const elapsed = now - parseInt(lastActivity, 10)\n    if (elapsed < timeoutMs) {\n      // Session still active — refresh timestamp\n      sessionStorage.setItem('_sk_stime', now.toString())\n      sessionStorage.setItem('_sk_sid', existingSession)\n      return existingSession\n    }\n  }\n\n  // New session (first visit or timeout expired)\n  const newSession = uuid()\n  sessionStorage.setItem('_sk_sid', newSession)\n  sessionStorage.setItem('_sk_stime', now.toString())\n  return newSession\n}\n\n// ============================================\n// React Context\n// ============================================\n\nexport interface SiteKitIdentity {\n  visitorId: string\n  sessionId: string\n}\n\nconst SiteKitIdentityContext = createContext<SiteKitIdentity | null>(null)\n\nexport interface SiteKitIdentityProviderProps {\n  visitorId: string\n  sessionId: string\n  children: React.ReactNode\n}\n\nexport function SiteKitIdentityProvider({\n  visitorId,\n  sessionId,\n  children,\n}: SiteKitIdentityProviderProps) {\n  const value = useMemo(() => ({ visitorId, sessionId }), [visitorId, sessionId])\n\n  return (\n    <SiteKitIdentityContext.Provider value={value}>\n      {children}\n    </SiteKitIdentityContext.Provider>\n  )\n}\n\n/**\n * Access the shared visitor/session identity.\n * Falls back to generating IDs directly if used outside of SiteKitIdentityProvider.\n */\nexport function useSiteKitIdentity(): SiteKitIdentity {\n  const context = useContext(SiteKitIdentityContext)\n  if (context) return context\n\n  // Fallback for standalone usage outside SiteKitLayout\n  return {\n    visitorId: getOrCreateVisitorId(),\n    sessionId: getOrCreateSessionId(),\n  }\n}\n"]}

package/dist/{chunk-KPKZBIAQ.js → chunk-XKV73RDH.js}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunk3X2YPJU5_js = require('./chunk-3X2YPJU5.js');
+var chunkCDETOO5W_js = require('./chunk-CDETOO5W.js');
 
 // src/shared/siteToken.ts
 var SITE_TOKEN_PREFIX = "st1.";
@@ -91,7 +91,7 @@ async function doRefresh() {
       method: "POST",
       headers: {
         "content-type": "application/json",
-        "x-sitekit-version": chunk3X2YPJU5_js.SITE_KIT_VERSION,
+        "x-sitekit-version": chunkCDETOO5W_js.SITE_KIT_VERSION,
         // Send the current token as x-api-key too, so the server's key-scoped
         // throttler buckets refreshes by token rather than by shared CDN IP.
         "x-api-key": current
@@ -202,7 +202,7 @@ async function sonorFetch(url, init = {}, options = {}) {
     credential = await getFreshCredential(options.apiKey);
   }
   const headers = new Headers(init.headers || {});
-  headers.set("x-sitekit-version", chunk3X2YPJU5_js.SITE_KIT_VERSION);
+  headers.set("x-sitekit-version", chunkCDETOO5W_js.SITE_KIT_VERSION);
   if (credential) {
     if (isTokenMode()) {
       headers.set("x-api-key", credential);
@@ -219,7 +219,7 @@ async function sonorFetch(url, init = {}, options = {}) {
     const refreshed = await refreshSiteToken();
     if (refreshed && refreshed !== credential) {
       const retryHeaders = new Headers(init.headers || {});
-      retryHeaders.set("x-sitekit-version", chunk3X2YPJU5_js.SITE_KIT_VERSION);
+      retryHeaders.set("x-sitekit-version", chunkCDETOO5W_js.SITE_KIT_VERSION);
       retryHeaders.set("x-api-key", refreshed);
       retryHeaders.delete("authorization");
       credential = refreshed;
@@ -240,7 +240,7 @@ function sonorBeacon(url, payload, apiKey) {
       keepalive: true,
       headers: {
         "Content-Type": "application/json",
-        "x-sitekit-version": chunk3X2YPJU5_js.SITE_KIT_VERSION,
+        "x-sitekit-version": chunkCDETOO5W_js.SITE_KIT_VERSION,
         ...credential ? { "x-api-key": credential } : {}
       },
       body
@@ -258,7 +258,9 @@ function sonorBeacon(url, payload, apiKey) {
 
 exports.configureSiteCredential = configureSiteCredential;
 exports.currentCredential = currentCredential;
+exports.getFreshCredential = getFreshCredential;
+exports.isSiteToken = isSiteToken;
 exports.sonorBeacon = sonorBeacon;
 exports.sonorFetch = sonorFetch;
-//# sourceMappingURL=chunk-KPKZBIAQ.js.map
-//# sourceMappingURL=chunk-KPKZBIAQ.js.map
+//# sourceMappingURL=chunk-XKV73RDH.js.map
+//# sourceMappingURL=chunk-XKV73RDH.js.map

package/dist/{chunk-KPKZBIAQ.js.map → chunk-XKV73RDH.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/siteToken.ts","../src/shared/fetchWithRetry.ts","../src/shared/sonorFetch.ts"],"names":["SITE_KIT_VERSION"],"mappings":";;;;;AAuBO,IAAM,iBAAA,GAAoB,MAAA;AAGjC,IAAM,kBAAkB,CAAA,GAAI,GAAA;AAC5B,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,WAAA,GAAc,sBAAA;AAEb,SAAS,YAAY,UAAA,EAAqC;AAC/D,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,IAAY,UAAA,CAAW,WAAW,iBAAiB,CAAA;AAClF;AASO,SAAS,sBAAsB,KAAA,EAA6C;AACjF,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,MAAM,GAAA,GAAO,KAAA,CAAiB,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC1C,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,IAAI;AAEF,IAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACpD,IAAA,MAAM,IAAA,GACJ,OAAO,IAAA,KAAS,UAAA,GACZ,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACnD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,IAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,GAAS,MAAA,GAAS,IAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOO,SAAS,oBAAoB,UAAA,EAAoC;AACtE,EAAA,IAAI,CAAC,YAAY,OAAO,aAAA;AACxB,EAAA,MAAM,MAAA,GAAS,sBAAsB,UAAU,CAAA;AAC/C,EAAA,IAAI,MAAA,EAAQ,GAAA,EAAK,OAAO,CAAA,IAAA,EAAO,OAAO,GAAG,CAAA,CAAA;AACzC,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B;AAeA,IAAM,KAAA,GAAoB;AAAA,EACxB,IAAA,EAAM,MAAA;AAAA,EACN,OAAA,EAAS,KAAA;AAAA,EACT,MAAA,EAAQ,sBAAA;AAAA,EACR,KAAA,EAAO,IAAA;AAAA,EACP,UAAA,EAAY;AACd,CAAA;AAEA,SAAS,eAAA,GAAiC;AACxC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AACrD,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,OAAO,MAAA,EAAQ,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ,IAAA;AAAA,EAC5D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAW,KAAA,EAAqB;AACvC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACnC,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,cAAA,CAAe,QAAQ,WAAA,EAAa,IAAA,CAAK,UAAU,EAAE,KAAA,EAAO,CAAC,CAAA;AAAA,EACtE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA;AAAC,IAAC,OAAe,oBAAA,GAAuB,KAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,SAAS,KAAA,EAA8B;AAC9C,EAAA,MAAM,MAAA,GAAS,sBAAsB,KAAK,CAAA;AAC1C,EAAA,OAAO,OAAO,MAAA,EAAQ,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,MAAM,GAAA,GAAO,CAAA;AAC/D;AAMO,SAAS,wBAAwB,IAAA,EAG/B;AACP,EAAA,KAAA,CAAM,OAAO,IAAA,CAAK,UAAA;AAClB,EAAA,KAAA,CAAM,OAAA,GAAU,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,QAAQ,KAAA,CAAM,MAAA,GAAS,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAE9D,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,IAAA;AAAA,EACF;AAKA,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,EAAA,IAAI,IAAA,GAAO,KAAK,UAAA,IAAc,IAAA;AAC9B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,IAAI,UAAU,QAAA,CAAS,MAAM,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,MAAA;AACxD,EAAA,IAAI,SAAS,QAAA,CAAS,KAAK,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,KAAA;AACtD,EAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AAChB;AAEA,SAAS,YAAA,GAAwB;AAC/B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,KAAA;AAC3B,EAAA,IAAI,CAAC,KAAA,CAAM,KAAA,EAAO,OAAO,IAAA;AACzB,EAAA,OAAO,KAAK,GAAA,EAAI,IAAK,QAAA,CAAS,KAAA,CAAM,KAAK,CAAA,GAAI,eAAA;AAC/C;AAEA,eAAe,SAAA,GAAoC;AACjD,EAAA,MAAM,UAAU,KAAA,CAAM,KAAA;AACtB,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,8BAAA,CAAA,EAAkC;AAAA,MACvE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqBA,iCAAA;AAAA;AAAA;AAAA,QAGrB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACvC,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,kBAAkB,CAAA,GACtC,KAAA;AAAA,KACP,CAAA;AACD,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,OAAO,IAAA;AACpB,IAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC9C,IAAA,MAAM,OAAO,IAAA,EAAM,KAAA;AACnB,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,WAAA,CAAY,IAAI,CAAA,EAAG;AACjD,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,UAAA,CAAW,IAAI,CAAA;AACf,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,gBAAA,GAA2C;AACzD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,UAAA,EAAY,OAAO,KAAA,CAAM,UAAA;AACnC,EAAA,KAAA,CAAM,UAAA,GAAa,SAAA,EAAU,CAAE,OAAA,CAAQ,MAAM;AAC3C,IAAA,KAAA,CAAM,UAAA,GAAa,IAAA;AAAA,EACrB,CAAC,CAAA;AACD,EAAA,OAAO,KAAA,CAAM,UAAA;AACf;AAMA,eAAsB,mBACpB,IAAA,EAC6B;AAE7B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,IAAI,cAAa,EAAG;AAClB,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,WAAW,OAAO,SAAA;AAAA,EAGxB;AACA,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC;AAGO,SAAS,WAAA,GAAuB;AACrC,EAAA,OAAO,KAAA,CAAM,OAAA;AACf;AAOO,SAAS,kBAAkB,IAAA,EAAmC;AACnE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC;;;ACjNA,SAAS,YAAA,CAAa,SAAiB,QAAA,EAA6B;AAElE,EAAA,IAAI,QAAA,EAAU,WAAW,GAAA,EAAK;AAC5B,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,MAAA,GAAS,QAAA,CAAS,MAAA,EAAQ,EAAE,CAAA,GAAI,GAAA;AAChD,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,IAAK,OAAA,GAAU,CAAA,EAAG,OAAO,IAAA,CAAK,GAAA,CAAI,OAAA,GAAU,GAAA,EAAM,GAAK,CAAA;AAAA,EAClF;AAEA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,GAAA,EAAM,GAAA,GAAM,KAAK,OAAO,CAAA;AAC1C;AASA,eAAsB,cAAA,CACpB,GAAA,EACA,IAAA,EACA,OAAA,GAA6B,EAAC,EACX;AACnB,EAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,IAAA;AACvC,EAAA,IAAI,SAAA;AAEJ,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,OAAA,EAAS,OAAA,EAAA,EAAW;AACnD,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,MAAA,YAAA,CAAa,KAAK,CAAA;AAElB,MAAA,IAAA,CAAK,SAAS,MAAA,KAAW,GAAA,IAAO,SAAS,MAAA,IAAU,GAAA,KAAQ,UAAU,OAAA,EAAS;AAC5E,QAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY,UAAA,CAAW,SAAS,YAAA,CAAa,OAAA,EAAS,QAAQ,CAAC,CAAC,CAAA;AACnF,QAAA;AAAA,MACF;AACA,MAAA,OAAO,QAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,SAAA,GAAY,KAAA;AAEZ,MAAA,IAAI,UAAU,OAAA,EAAS;AACrB,QAAA,MAAM,IAAI,QAAQ,CAAC,OAAA,KAAY,WAAW,OAAA,EAAS,YAAA,CAAa,OAAO,CAAC,CAAC,CAAA;AACzE,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,YAAqB,KAAA,GACvB,SAAA,GACA,IAAI,MAAM,mEAAmE,CAAA;AACnF;;;AC7BA,IAAM,gBAAgB,CAAA,GAAI,GAAA;AAI1B,IAAM,UAAA,uBAAiB,GAAA,EAAoB;AAC3C,IAAI,cAAA,GAAiB,KAAA;AAGd,SAAS,aAAa,UAAA,EAA8B;AACzD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,MAAM,EAAA,GAAK,oBAAoB,UAAU,CAAA;AACzC,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,EAAE,CAAA;AAC/B,EAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,EAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,KAAA,EAAO;AACvB,IAAA,UAAA,CAAW,OAAO,EAAE,CAAA;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,YAAY,UAAA,EAA2B;AAC9C,EAAA,UAAA,CAAW,IAAI,mBAAA,CAAoB,UAAU,GAAG,IAAA,CAAK,GAAA,KAAQ,aAAa,CAAA;AAC1E,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,cAAA,GAAiB,IAAA;AAGjB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AACF;AAEA,eAAsB,WACpB,GAAA,EACA,IAAA,GAAoB,EAAC,EACrB,OAAA,GAA6B,EAAC,EACX;AAGnB,EAAA,IAAI,aAAa,OAAA,CAAQ,MAAA;AACzB,EAAA,IAAI,UAAA,KAAe,MAAA,IAAa,WAAA,EAAY,EAAG;AAC7C,IAAA,UAAA,GAAa,MAAM,kBAAA,CAAmB,OAAA,CAAQ,MAAM,CAAA;AAAA,EACtD;AAEA,EAAA,MAAM,UAAU,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAC9C,EAAA,OAAA,CAAQ,GAAA,CAAI,qBAAqBA,iCAAgB,CAAA;AACjD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,IAAI,aAAY,EAAG;AASjB,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AACnC,MAAA,OAAA,CAAQ,OAAO,eAAe,CAAA;AAAA,IAChC,CAAA,MAAA,IAAW,CAAC,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG;AAEpC,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AAAA,IACrC;AAAA,EACF;AAEA,EAAA,IAAI,YAAA,CAAa,UAAU,CAAA,EAAG;AAG5B,IAAA,OAAO,IAAI,SAAS,IAAA,EAAM,EAAE,QAAQ,GAAA,EAAK,UAAA,EAAY,qBAAqB,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,QAAA,GAAW,MAAM,cAAA,CAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAQ,EAAG,OAAO,CAAA;AAKtE,EAAA,IAAA,CACG,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,QAAA,CAAS,MAAA,KAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClB,WAAA,CAAY,UAAU,CAAA,EACtB;AACA,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,SAAA,IAAa,cAAc,UAAA,EAAY;AACzC,MAAA,MAAM,eAAe,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AACnD,MAAA,YAAA,CAAa,GAAA,CAAI,qBAAqBA,iCAAgB,CAAA;AACtD,MAAA,YAAA,CAAa,GAAA,CAAI,aAAa,SAAS,CAAA;AAGvC,MAAA,YAAA,CAAa,OAAO,eAAe,CAAA;AACnC,MAAA,UAAA,GAAa,SAAA;AACb,MAAA,QAAA,GAAW,MAAM,eAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,YAAA,EAAa,EAAG,OAAO,CAAA;AAAA,IAClF;AAAA,EACF;AAEA,EAAA,IAAA,CACG,QAAA,CAAS,WAAW,GAAA,IAAO,QAAA,CAAS,WAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClB,UAAA,EACA;AACA,IAAA,WAAA,CAAY,UAAU,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,QAAA;AACT;AAYO,SAAS,WAAA,CAAY,GAAA,EAAa,OAAA,EAAkB,MAAA,EAAuB;AAChF,EAAA,MAAM,UAAA,GAAa,kBAAkB,MAAM,CAAA;AAC3C,EAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,IAAA,CAAK,UAAU,OAAO,CAAA;AAC3E,EAAA,IAAI;AACF,IAAA,KAAK,MAAM,GAAA,EAAK;AAAA,MACd,MAAA,EAAQ,MAAA;AAAA,MACR,SAAA,EAAW,IAAA;AAAA,MACX,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqBA,iCAAA;AAAA,QACrB,GAAI,UAAA,GAAa,EAAE,WAAA,EAAa,UAAA,KAAe;AAAC,OAClD;AAAA,MACA;AAAA,KACD,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAEf,CAAC,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AACN,IAAA,IAAI;AACF,MAAA,IAAI,OAAO,SAAA,KAAc,WAAA,IAAe,SAAA,CAAU,UAAA,EAAY;AAC5D,QAAA,SAAA,CAAU,UAAA,CAAW,GAAA,EAAK,IAAI,IAAA,CAAK,CAAC,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,kBAAA,EAAoB,CAAC,CAAA;AAAA,MAC1E;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACF","file":"chunk-KPKZBIAQ.js","sourcesContent":["/**\n * @sonordev/site-kit shared — Client token manager\n *\n * SiteKitLayout (a server component) no longer ships the raw `sonor_` API key to\n * the browser. Instead it mints a short-lived, project-scoped token server-side\n * and injects THAT. This module is the browser-side lifecycle for that token:\n *\n *   - holds the current token (seeded from the injected value)\n *   - a static page's seed can be days old and already expired on first view, so\n *     it transparently REFRESHES via the public endpoint before first use\n *   - dedupes concurrent refreshes (one in-flight request, awaited by all)\n *   - persists the freshest token in sessionStorage so navigations within a\n *     session don't each re-refresh\n *\n * Everything here is a no-op passthrough when the injected credential is a raw\n * key (a 2.x kit, or the mint-failed fallback) — legacy behavior is unchanged.\n * Fully SSR-safe: on the server there is no refresh, just the seed.\n *\n * The token payload is NOT secret (only its HMAC is unforgeable), so decoding it\n * client-side to read `exp`/`pid` is fine and needs no crypto.\n */\nimport { SITE_KIT_VERSION } from './version'\n\nexport const SITE_TOKEN_PREFIX = 'st1.'\n\n/** Refresh this many ms before expiry, so a request never races the deadline. */\nconst REFRESH_SKEW_MS = 5 * 60_000\nconst REFRESH_TIMEOUT_MS = 6_000\nconst STORAGE_KEY = '__sonor_site_token__'\n\nexport function isSiteToken(credential?: string | null): boolean {\n  return typeof credential === 'string' && credential.startsWith(SITE_TOKEN_PREFIX)\n}\n\ninterface DecodedClaims {\n  pid?: string\n  iat?: number\n  exp?: number\n}\n\n/** Decode the (non-secret) token payload. Returns null if not a token / malformed. */\nexport function decodeSiteTokenClaims(token?: string | null): DecodedClaims | null {\n  if (!isSiteToken(token)) return null\n  const seg = (token as string).split('.')[1]\n  if (!seg) return null\n  try {\n    // base64url → JSON. atob handles standard base64; restore url-safe chars.\n    const b64 = seg.replace(/-/g, '+').replace(/_/g, '/')\n    const json =\n      typeof atob === 'function'\n        ? atob(b64)\n        : Buffer.from(seg, 'base64url').toString('utf8')\n    const claims = JSON.parse(json)\n    return typeof claims === 'object' && claims ? claims : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Stable id for the auth circuit breaker. Tokens rotate, so keying the breaker\n * by the raw value would reset it every refresh — key by the project id encoded\n * in the token instead. Raw keys use a safe prefix.\n */\nexport function credentialBreakerId(credential?: string | null): string {\n  if (!credential) return '(anonymous)'\n  const claims = decodeSiteTokenClaims(credential)\n  if (claims?.pid) return `pid:${claims.pid}`\n  return credential.slice(0, 16)\n}\n\ninterface TokenState {\n  /** The credential injected by the layout (token or raw key). */\n  seed: string | undefined\n  /** Whether we're in token mode (seed is a token). */\n  isToken: boolean\n  /** Base API URL for the refresh endpoint. */\n  apiUrl: string\n  /** The freshest known token (>= seed). Null in raw-key mode. */\n  token: string | null\n  /** In-flight refresh, deduped. */\n  refreshing: Promise<string | null> | null\n}\n\nconst state: TokenState = {\n  seed: undefined,\n  isToken: false,\n  apiUrl: 'https://api.sonor.io',\n  token: null,\n  refreshing: null,\n}\n\nfunction readStoredToken(): string | null {\n  if (typeof window === 'undefined') return null\n  try {\n    const raw = window.sessionStorage.getItem(STORAGE_KEY)\n    if (!raw) return null\n    const parsed = JSON.parse(raw)\n    return typeof parsed?.token === 'string' ? parsed.token : null\n  } catch {\n    return null\n  }\n}\n\nfunction storeToken(token: string): void {\n  if (typeof window === 'undefined') return\n  try {\n    window.sessionStorage.setItem(STORAGE_KEY, JSON.stringify({ token }))\n  } catch {\n    /* private mode / disabled storage — memory-only is fine */\n  }\n  try {\n    ;(window as any).__SITE_KIT_API_KEY__ = token\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction tokenExp(token: string | null): number {\n  const claims = decodeSiteTokenClaims(token)\n  return typeof claims?.exp === 'number' ? claims.exp * 1000 : 0\n}\n\n/**\n * Configure the manager from the layout-injected values. Adopts a fresher token\n * from sessionStorage if a prior page in this session already refreshed.\n */\nexport function configureSiteCredential(opts: {\n  credential?: string\n  apiUrl?: string\n}): void {\n  state.seed = opts.credential\n  state.isToken = isSiteToken(opts.credential)\n  if (opts.apiUrl) state.apiUrl = opts.apiUrl.replace(/\\/+$/, '')\n\n  if (!state.isToken) {\n    state.token = null\n    return\n  }\n\n  // configure runs on every render — never downgrade. Keep the freshest of the\n  // injected seed, a token stored by an earlier page this session, and whatever\n  // an in-flight/prior refresh already put in memory.\n  const prior = state.token\n  let best = opts.credential ?? null\n  const stored = readStoredToken()\n  if (stored && tokenExp(stored) > tokenExp(best)) best = stored\n  if (prior && tokenExp(prior) > tokenExp(best)) best = prior\n  state.token = best\n}\n\nfunction needsRefresh(): boolean {\n  if (!state.isToken) return false\n  if (!state.token) return true\n  return Date.now() >= tokenExp(state.token) - REFRESH_SKEW_MS\n}\n\nasync function doRefresh(): Promise<string | null> {\n  const current = state.token\n  if (!current) return null\n  try {\n    const res = await fetch(`${state.apiUrl}/api/public/site-token/refresh`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        // Send the current token as x-api-key too, so the server's key-scoped\n        // throttler buckets refreshes by token rather than by shared CDN IP.\n        'x-api-key': current,\n      },\n      body: JSON.stringify({ token: current }),\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(REFRESH_TIMEOUT_MS)\n          : undefined,\n    })\n    if (!res.ok) return null\n    const data = await res.json().catch(() => null)\n    const next = data?.token\n    if (typeof next === 'string' && isSiteToken(next)) {\n      state.token = next\n      storeToken(next)\n      return next\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\n/** Refresh now (deduped). Returns the new token, or null on failure. */\nexport function refreshSiteToken(): Promise<string | null> {\n  if (!state.isToken) return Promise.resolve(null)\n  if (state.refreshing) return state.refreshing\n  state.refreshing = doRefresh().finally(() => {\n    state.refreshing = null\n  })\n  return state.refreshing\n}\n\n/**\n * The credential to put on the next request. In token mode, refreshes a stale\n * seed first. In raw-key mode, returns the seed unchanged (legacy passthrough).\n */\nexport async function getFreshCredential(\n  seed?: string,\n): Promise<string | undefined> {\n  // A raw key (or nothing configured) — no token machinery.\n  if (!state.isToken) return seed ?? state.seed\n  if (needsRefresh()) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed) return refreshed\n    // Refresh failed — fall through to whatever we have; the request may 401 and\n    // trip the breaker with friendly copy.\n  }\n  return state.token ?? seed ?? state.seed\n}\n\n/** Whether the given credential is being managed as a token. */\nexport function isTokenMode(): boolean {\n  return state.isToken\n}\n\n/**\n * Best-known credential WITHOUT refreshing — for synchronous unload paths\n * (sonorBeacon) that can't await. In token mode returns the freshest token held;\n * in raw-key mode returns the seed.\n */\nexport function currentCredential(seed?: string): string | undefined {\n  if (!state.isToken) return seed ?? state.seed\n  return state.token ?? seed ?? state.seed\n}\n","/**\n * @sonordev/site-kit shared - Resilient fetch\n *\n * Single source of truth for client-side resilient fetch (forms, SitemapSync).\n * Adds a per-attempt timeout and retries transient failures (network errors,\n * request timeouts, HTTP 429, and 5xx) with exponential backoff.\n *\n * A form submission must survive a brief API blip — a deploy, a cold start, a\n * dropped packet. A single un-retried fetch turning into \"Something went wrong\"\n * is how leads get lost. The explicit abort also matters on its own: a request\n * left to hang until the browser's own network timeout logs a console error\n * (net::ERR_TIMED_OUT) that fails Lighthouse best-practices; an aborted fetch\n * logs nothing.\n */\n\nexport interface FetchRetryOptions {\n  /** Number of retries AFTER the first attempt (default 2 → up to 3 tries total). */\n  retries?: number\n  /** Per-attempt timeout in milliseconds (default 15000). */\n  timeoutMs?: number\n}\n\nfunction backoffDelay(attempt: number, response?: Response): number {\n  // Honor a Retry-After header on 429 responses when present.\n  if (response?.status === 429) {\n    const header = response.headers.get('retry-after')\n    const seconds = header ? parseInt(header, 10) : NaN\n    if (!Number.isNaN(seconds) && seconds > 0) return Math.min(seconds * 1000, 10000)\n  }\n  // Exponential backoff: 500ms, 1s, 2s, ... capped at 8s.\n  return Math.min(8000, 500 * 2 ** attempt)\n}\n\n/**\n * fetch() with a timeout and automatic retries for transient failures.\n *\n * Non-transient responses (2xx, 3xx, and 4xx other than 429) are returned to\n * the caller as-is — only 429/5xx and thrown network/timeout errors are retried.\n * If every attempt fails with a thrown error, the last error is re-thrown.\n */\nexport async function fetchWithRetry(\n  url: string,\n  init: RequestInit,\n  options: FetchRetryOptions = {},\n): Promise<Response> {\n  const retries = options.retries ?? 2\n  const timeoutMs = options.timeoutMs ?? 15000\n  let lastError: unknown\n\n  for (let attempt = 0; attempt <= retries; attempt++) {\n    const controller = new AbortController()\n    const timer = setTimeout(() => controller.abort(), timeoutMs)\n    try {\n      const response = await fetch(url, { ...init, signal: controller.signal })\n      clearTimeout(timer)\n\n      if ((response.status === 429 || response.status >= 500) && attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt, response)))\n        continue\n      }\n      return response\n    } catch (error) {\n      clearTimeout(timer)\n      lastError = error\n      // Network failure or timeout (AbortController) — retry while attempts remain.\n      if (attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt)))\n        continue\n      }\n    }\n  }\n\n  throw lastError instanceof Error\n    ? lastError\n    : new Error('Network request failed after multiple attempts. Please try again.')\n}\n","/**\n * @sonordev/site-kit shared - Canonical client transport\n *\n * Single source of truth for how site-kit talks to Sonor from the browser.\n * Every client-side module (analytics, forms, commerce, engage, maps, images,\n * SitemapSync) routes through here instead of bare fetch(), which gives the\n * whole kit, in one place:\n *\n *  - per-attempt timeout + retry with backoff (via fetchWithRetry) — a hung\n *    request left to the browser's own network timeout logs a console error\n *    (net::ERR_TIMED_OUT) that fails Lighthouse best-practices\n *  - the x-sitekit-version header on every request, so the platform can see\n *    which kit version each site actually runs from live traffic\n *  - CREDENTIAL LIFECYCLE: sites on 3.2+ ship a short-lived minted token instead\n *    of the raw key. This transport resolves the freshest token (refreshing a\n *    stale seed transparently), and on a 401/403 for a token it refreshes once\n *    and retries before giving up. A raw key (2.x kit, or the mint-failed\n *    fallback) is a pure passthrough — legacy behavior is unchanged.\n *  - an auth circuit breaker: after a 401/403 the credential is paused for a few\n *    minutes and ONE friendly console.info is emitted — a site on a stale or\n *    canceled key must not spam the API or the visitor's console. Keyed by the\n *    project (from the token) so it survives token rotation.\n *  - sonorBeacon for unload-time telemetry that keeps the credential in headers;\n *    navigator.sendBeacon can't set headers and forced the key into the URL,\n *    where server and CDN access logs capture it\n *\n * Non-idempotent endpoints (checkout, payment intents, uploads) must pass\n * { retries: 0 } — they still get the timeout, but never an automatic retry.\n */\nimport { fetchWithRetry, type FetchRetryOptions } from './fetchWithRetry'\nimport { SITE_KIT_VERSION } from './version'\nimport {\n  credentialBreakerId,\n  currentCredential,\n  getFreshCredential,\n  isSiteToken,\n  isTokenMode,\n  refreshSiteToken,\n} from './siteToken'\n\nexport interface SonorFetchOptions extends FetchRetryOptions {\n  /** Project credential — the minted token (3.2+) or raw key. Sent as x-api-key. */\n  apiKey?: string\n}\n\n/** How long a credential stays paused after an auth failure. */\nconst AUTH_BREAK_MS = 5 * 60_000\n\n// breaker id → epoch ms until which requests are paused. Module-scoped: the\n// breaker lives for the page's lifetime and never applies on the server.\nconst pausedKeys = new Map<string, number>()\nlet warnedThisPage = false\n\n/** True when a previous 401/403 has paused this credential (browser only). */\nexport function isAuthPaused(credential?: string): boolean {\n  if (typeof window === 'undefined') return false\n  const id = credentialBreakerId(credential)\n  const until = pausedKeys.get(id)\n  if (!until) return false\n  if (Date.now() >= until) {\n    pausedKeys.delete(id)\n    return false\n  }\n  return true\n}\n\nfunction tripBreaker(credential?: string): void {\n  pausedKeys.set(credentialBreakerId(credential), Date.now() + AUTH_BREAK_MS)\n  if (!warnedThisPage) {\n    warnedThisPage = true\n    // info, not error: a visitor's console must stay clean (Lighthouse\n    // errors-in-console), and copy never names env vars or key formats.\n    console.info(\n      \"[Sonor] This site couldn't authenticate with Sonor, so data features are paused for a few minutes. If this keeps happening, the site is likely running an outdated API key.\",\n    )\n  }\n}\n\nexport async function sonorFetch(\n  url: string,\n  init: RequestInit = {},\n  options: SonorFetchOptions = {},\n): Promise<Response> {\n  // Resolve the credential to send. In token mode this may transparently refresh\n  // a stale seed before the first request; in raw-key mode it's a passthrough.\n  let credential = options.apiKey\n  if (credential !== undefined || isTokenMode()) {\n    credential = await getFreshCredential(options.apiKey)\n  }\n\n  const headers = new Headers(init.headers || {})\n  headers.set('x-sitekit-version', SITE_KIT_VERSION)\n  if (credential) {\n    if (isTokenMode()) {\n      // Token mode: `credential` is the freshest token (refreshed just above if\n      // the seed was stale). It MUST override any x-api-key a caller hand-set — a\n      // stale build-time seed passed as a header would otherwise pin the request\n      // and defeat refresh entirely. Also drop a caller-set Authorization:\n      // extractApiKey() server-side prefers `Authorization: Bearer` over\n      // x-api-key, so a stale Bearer seed would win even once we set a fresh\n      // x-api-key. This is the single place the client credential is chosen — do\n      // not re-attach it as a header at call sites.\n      headers.set('x-api-key', credential)\n      headers.delete('authorization')\n    } else if (!headers.has('x-api-key')) {\n      // Raw-key mode: legacy passthrough — respect a caller-supplied header.\n      headers.set('x-api-key', credential)\n    }\n  }\n\n  if (isAuthPaused(credential)) {\n    // Synthetic response keeps every caller's !response.ok path working\n    // without a network round trip while the breaker is open.\n    return new Response(null, { status: 401, statusText: 'sonor-auth-paused' })\n  }\n\n  let response = await fetchWithRetry(url, { ...init, headers }, options)\n\n  // A token can rotate or expire mid-session. On the first auth failure, try ONE\n  // refresh + retry before tripping the breaker — only for token credentials\n  // (raw keys have nothing to refresh).\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    isSiteToken(credential)\n  ) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed && refreshed !== credential) {\n      const retryHeaders = new Headers(init.headers || {})\n      retryHeaders.set('x-sitekit-version', SITE_KIT_VERSION)\n      retryHeaders.set('x-api-key', refreshed)\n      // Same reason as the initial request: a caller-set stale Bearer would win\n      // over our fresh x-api-key server-side, so strip it on the retry too.\n      retryHeaders.delete('authorization')\n      credential = refreshed\n      response = await fetchWithRetry(url, { ...init, headers: retryHeaders }, options)\n    }\n  }\n\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    credential\n  ) {\n    tripBreaker(credential)\n  }\n\n  return response\n}\n\n/**\n * Fire-and-forget telemetry that survives page unload.\n *\n * Uses fetch({ keepalive: true }) so auth travels in headers. Falls back to\n * navigator.sendBeacon (no auth headers possible — the server may reject it,\n * but we never put the key in the URL) only when keepalive fetch is missing.\n *\n * Cannot await a refresh at unload time, so it sends the freshest token already\n * held (currentCredential) rather than the possibly-stale seed the caller passed.\n */\nexport function sonorBeacon(url: string, payload: unknown, apiKey?: string): void {\n  const credential = currentCredential(apiKey)\n  const body = typeof payload === 'string' ? payload : JSON.stringify(payload)\n  try {\n    void fetch(url, {\n      method: 'POST',\n      keepalive: true,\n      headers: {\n        'Content-Type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        ...(credential ? { 'x-api-key': credential } : {}),\n      },\n      body,\n    }).catch(() => {\n      /* page is closing — best effort */\n    })\n  } catch {\n    try {\n      if (typeof navigator !== 'undefined' && navigator.sendBeacon) {\n        navigator.sendBeacon(url, new Blob([body], { type: 'application/json' }))\n      }\n    } catch {\n      /* nothing left to try */\n    }\n  }\n}\n"]}
+{"version":3,"sources":["../src/shared/siteToken.ts","../src/shared/fetchWithRetry.ts","../src/shared/sonorFetch.ts"],"names":["SITE_KIT_VERSION"],"mappings":";;;;;AAuBO,IAAM,iBAAA,GAAoB,MAAA;AAGjC,IAAM,kBAAkB,CAAA,GAAI,GAAA;AAC5B,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,WAAA,GAAc,sBAAA;AAEb,SAAS,YAAY,UAAA,EAAqC;AAC/D,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,IAAY,UAAA,CAAW,WAAW,iBAAiB,CAAA;AAClF;AASO,SAAS,sBAAsB,KAAA,EAA6C;AACjF,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,MAAM,GAAA,GAAO,KAAA,CAAiB,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC1C,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,IAAI;AAEF,IAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACpD,IAAA,MAAM,IAAA,GACJ,OAAO,IAAA,KAAS,UAAA,GACZ,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACnD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,IAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,GAAS,MAAA,GAAS,IAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOO,SAAS,oBAAoB,UAAA,EAAoC;AACtE,EAAA,IAAI,CAAC,YAAY,OAAO,aAAA;AACxB,EAAA,MAAM,MAAA,GAAS,sBAAsB,UAAU,CAAA;AAC/C,EAAA,IAAI,MAAA,EAAQ,GAAA,EAAK,OAAO,CAAA,IAAA,EAAO,OAAO,GAAG,CAAA,CAAA;AACzC,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B;AAeA,IAAM,KAAA,GAAoB;AAAA,EACxB,IAAA,EAAM,MAAA;AAAA,EACN,OAAA,EAAS,KAAA;AAAA,EACT,MAAA,EAAQ,sBAAA;AAAA,EACR,KAAA,EAAO,IAAA;AAAA,EACP,UAAA,EAAY;AACd,CAAA;AAEA,SAAS,eAAA,GAAiC;AACxC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AACrD,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,OAAO,MAAA,EAAQ,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ,IAAA;AAAA,EAC5D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAW,KAAA,EAAqB;AACvC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACnC,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,cAAA,CAAe,QAAQ,WAAA,EAAa,IAAA,CAAK,UAAU,EAAE,KAAA,EAAO,CAAC,CAAA;AAAA,EACtE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA;AAAC,IAAC,OAAe,oBAAA,GAAuB,KAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,SAAS,KAAA,EAA8B;AAC9C,EAAA,MAAM,MAAA,GAAS,sBAAsB,KAAK,CAAA;AAC1C,EAAA,OAAO,OAAO,MAAA,EAAQ,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,MAAM,GAAA,GAAO,CAAA;AAC/D;AAMO,SAAS,wBAAwB,IAAA,EAG/B;AACP,EAAA,KAAA,CAAM,OAAO,IAAA,CAAK,UAAA;AAClB,EAAA,KAAA,CAAM,OAAA,GAAU,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,QAAQ,KAAA,CAAM,MAAA,GAAS,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAE9D,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,IAAA;AAAA,EACF;AAKA,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,EAAA,IAAI,IAAA,GAAO,KAAK,UAAA,IAAc,IAAA;AAC9B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,IAAI,UAAU,QAAA,CAAS,MAAM,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,MAAA;AACxD,EAAA,IAAI,SAAS,QAAA,CAAS,KAAK,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,KAAA;AACtD,EAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AAChB;AAEA,SAAS,YAAA,GAAwB;AAC/B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,KAAA;AAC3B,EAAA,IAAI,CAAC,KAAA,CAAM,KAAA,EAAO,OAAO,IAAA;AACzB,EAAA,OAAO,KAAK,GAAA,EAAI,IAAK,QAAA,CAAS,KAAA,CAAM,KAAK,CAAA,GAAI,eAAA;AAC/C;AAEA,eAAe,SAAA,GAAoC;AACjD,EAAA,MAAM,UAAU,KAAA,CAAM,KAAA;AACtB,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,8BAAA,CAAA,EAAkC;AAAA,MACvE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqBA,iCAAA;AAAA;AAAA;AAAA,QAGrB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACvC,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,kBAAkB,CAAA,GACtC,KAAA;AAAA,KACP,CAAA;AACD,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,OAAO,IAAA;AACpB,IAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC9C,IAAA,MAAM,OAAO,IAAA,EAAM,KAAA;AACnB,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,WAAA,CAAY,IAAI,CAAA,EAAG;AACjD,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,UAAA,CAAW,IAAI,CAAA;AACf,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,gBAAA,GAA2C;AACzD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,UAAA,EAAY,OAAO,KAAA,CAAM,UAAA;AACnC,EAAA,KAAA,CAAM,UAAA,GAAa,SAAA,EAAU,CAAE,OAAA,CAAQ,MAAM;AAC3C,IAAA,KAAA,CAAM,UAAA,GAAa,IAAA;AAAA,EACrB,CAAC,CAAA;AACD,EAAA,OAAO,KAAA,CAAM,UAAA;AACf;AAMA,eAAsB,mBACpB,IAAA,EAC6B;AAE7B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,IAAI,cAAa,EAAG;AAClB,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,WAAW,OAAO,SAAA;AAAA,EAGxB;AACA,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC;AAGO,SAAS,WAAA,GAAuB;AACrC,EAAA,OAAO,KAAA,CAAM,OAAA;AACf;AAOO,SAAS,kBAAkB,IAAA,EAAmC;AACnE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC;;;ACjNA,SAAS,YAAA,CAAa,SAAiB,QAAA,EAA6B;AAElE,EAAA,IAAI,QAAA,EAAU,WAAW,GAAA,EAAK;AAC5B,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,MAAA,GAAS,QAAA,CAAS,MAAA,EAAQ,EAAE,CAAA,GAAI,GAAA;AAChD,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,IAAK,OAAA,GAAU,CAAA,EAAG,OAAO,IAAA,CAAK,GAAA,CAAI,OAAA,GAAU,GAAA,EAAM,GAAK,CAAA;AAAA,EAClF;AAEA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,GAAA,EAAM,GAAA,GAAM,KAAK,OAAO,CAAA;AAC1C;AASA,eAAsB,cAAA,CACpB,GAAA,EACA,IAAA,EACA,OAAA,GAA6B,EAAC,EACX;AACnB,EAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,IAAA;AACvC,EAAA,IAAI,SAAA;AAEJ,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,OAAA,EAAS,OAAA,EAAA,EAAW;AACnD,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,MAAA,YAAA,CAAa,KAAK,CAAA;AAElB,MAAA,IAAA,CAAK,SAAS,MAAA,KAAW,GAAA,IAAO,SAAS,MAAA,IAAU,GAAA,KAAQ,UAAU,OAAA,EAAS;AAC5E,QAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY,UAAA,CAAW,SAAS,YAAA,CAAa,OAAA,EAAS,QAAQ,CAAC,CAAC,CAAA;AACnF,QAAA;AAAA,MACF;AACA,MAAA,OAAO,QAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,SAAA,GAAY,KAAA;AAEZ,MAAA,IAAI,UAAU,OAAA,EAAS;AACrB,QAAA,MAAM,IAAI,QAAQ,CAAC,OAAA,KAAY,WAAW,OAAA,EAAS,YAAA,CAAa,OAAO,CAAC,CAAC,CAAA;AACzE,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,YAAqB,KAAA,GACvB,SAAA,GACA,IAAI,MAAM,mEAAmE,CAAA;AACnF;;;AC7BA,IAAM,gBAAgB,CAAA,GAAI,GAAA;AAI1B,IAAM,UAAA,uBAAiB,GAAA,EAAoB;AAC3C,IAAI,cAAA,GAAiB,KAAA;AAGd,SAAS,aAAa,UAAA,EAA8B;AACzD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,MAAM,EAAA,GAAK,oBAAoB,UAAU,CAAA;AACzC,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,EAAE,CAAA;AAC/B,EAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,EAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,KAAA,EAAO;AACvB,IAAA,UAAA,CAAW,OAAO,EAAE,CAAA;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,YAAY,UAAA,EAA2B;AAC9C,EAAA,UAAA,CAAW,IAAI,mBAAA,CAAoB,UAAU,GAAG,IAAA,CAAK,GAAA,KAAQ,aAAa,CAAA;AAC1E,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,cAAA,GAAiB,IAAA;AAGjB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AACF;AAEA,eAAsB,WACpB,GAAA,EACA,IAAA,GAAoB,EAAC,EACrB,OAAA,GAA6B,EAAC,EACX;AAGnB,EAAA,IAAI,aAAa,OAAA,CAAQ,MAAA;AACzB,EAAA,IAAI,UAAA,KAAe,MAAA,IAAa,WAAA,EAAY,EAAG;AAC7C,IAAA,UAAA,GAAa,MAAM,kBAAA,CAAmB,OAAA,CAAQ,MAAM,CAAA;AAAA,EACtD;AAEA,EAAA,MAAM,UAAU,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAC9C,EAAA,OAAA,CAAQ,GAAA,CAAI,qBAAqBA,iCAAgB,CAAA;AACjD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,IAAI,aAAY,EAAG;AASjB,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AACnC,MAAA,OAAA,CAAQ,OAAO,eAAe,CAAA;AAAA,IAChC,CAAA,MAAA,IAAW,CAAC,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG;AAEpC,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AAAA,IACrC;AAAA,EACF;AAEA,EAAA,IAAI,YAAA,CAAa,UAAU,CAAA,EAAG;AAG5B,IAAA,OAAO,IAAI,SAAS,IAAA,EAAM,EAAE,QAAQ,GAAA,EAAK,UAAA,EAAY,qBAAqB,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,QAAA,GAAW,MAAM,cAAA,CAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAQ,EAAG,OAAO,CAAA;AAKtE,EAAA,IAAA,CACG,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,QAAA,CAAS,MAAA,KAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClB,WAAA,CAAY,UAAU,CAAA,EACtB;AACA,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,SAAA,IAAa,cAAc,UAAA,EAAY;AACzC,MAAA,MAAM,eAAe,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AACnD,MAAA,YAAA,CAAa,GAAA,CAAI,qBAAqBA,iCAAgB,CAAA;AACtD,MAAA,YAAA,CAAa,GAAA,CAAI,aAAa,SAAS,CAAA;AAGvC,MAAA,YAAA,CAAa,OAAO,eAAe,CAAA;AACnC,MAAA,UAAA,GAAa,SAAA;AACb,MAAA,QAAA,GAAW,MAAM,eAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,YAAA,EAAa,EAAG,OAAO,CAAA;AAAA,IAClF;AAAA,EACF;AAEA,EAAA,IAAA,CACG,QAAA,CAAS,WAAW,GAAA,IAAO,QAAA,CAAS,WAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClB,UAAA,EACA;AACA,IAAA,WAAA,CAAY,UAAU,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,QAAA;AACT;AAYO,SAAS,WAAA,CAAY,GAAA,EAAa,OAAA,EAAkB,MAAA,EAAuB;AAChF,EAAA,MAAM,UAAA,GAAa,kBAAkB,MAAM,CAAA;AAC3C,EAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,IAAA,CAAK,UAAU,OAAO,CAAA;AAC3E,EAAA,IAAI;AACF,IAAA,KAAK,MAAM,GAAA,EAAK;AAAA,MACd,MAAA,EAAQ,MAAA;AAAA,MACR,SAAA,EAAW,IAAA;AAAA,MACX,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqBA,iCAAA;AAAA,QACrB,GAAI,UAAA,GAAa,EAAE,WAAA,EAAa,UAAA,KAAe;AAAC,OAClD;AAAA,MACA;AAAA,KACD,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAEf,CAAC,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AACN,IAAA,IAAI;AACF,MAAA,IAAI,OAAO,SAAA,KAAc,WAAA,IAAe,SAAA,CAAU,UAAA,EAAY;AAC5D,QAAA,SAAA,CAAU,UAAA,CAAW,GAAA,EAAK,IAAI,IAAA,CAAK,CAAC,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,kBAAA,EAAoB,CAAC,CAAA;AAAA,MAC1E;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACF","file":"chunk-XKV73RDH.js","sourcesContent":["/**\n * @sonordev/site-kit shared — Client token manager\n *\n * SiteKitLayout (a server component) no longer ships the raw `sonor_` API key to\n * the browser. Instead it mints a short-lived, project-scoped token server-side\n * and injects THAT. This module is the browser-side lifecycle for that token:\n *\n *   - holds the current token (seeded from the injected value)\n *   - a static page's seed can be days old and already expired on first view, so\n *     it transparently REFRESHES via the public endpoint before first use\n *   - dedupes concurrent refreshes (one in-flight request, awaited by all)\n *   - persists the freshest token in sessionStorage so navigations within a\n *     session don't each re-refresh\n *\n * Everything here is a no-op passthrough when the injected credential is a raw\n * key (a 2.x kit, or the mint-failed fallback) — legacy behavior is unchanged.\n * Fully SSR-safe: on the server there is no refresh, just the seed.\n *\n * The token payload is NOT secret (only its HMAC is unforgeable), so decoding it\n * client-side to read `exp`/`pid` is fine and needs no crypto.\n */\nimport { SITE_KIT_VERSION } from './version'\n\nexport const SITE_TOKEN_PREFIX = 'st1.'\n\n/** Refresh this many ms before expiry, so a request never races the deadline. */\nconst REFRESH_SKEW_MS = 5 * 60_000\nconst REFRESH_TIMEOUT_MS = 6_000\nconst STORAGE_KEY = '__sonor_site_token__'\n\nexport function isSiteToken(credential?: string | null): boolean {\n  return typeof credential === 'string' && credential.startsWith(SITE_TOKEN_PREFIX)\n}\n\ninterface DecodedClaims {\n  pid?: string\n  iat?: number\n  exp?: number\n}\n\n/** Decode the (non-secret) token payload. Returns null if not a token / malformed. */\nexport function decodeSiteTokenClaims(token?: string | null): DecodedClaims | null {\n  if (!isSiteToken(token)) return null\n  const seg = (token as string).split('.')[1]\n  if (!seg) return null\n  try {\n    // base64url → JSON. atob handles standard base64; restore url-safe chars.\n    const b64 = seg.replace(/-/g, '+').replace(/_/g, '/')\n    const json =\n      typeof atob === 'function'\n        ? atob(b64)\n        : Buffer.from(seg, 'base64url').toString('utf8')\n    const claims = JSON.parse(json)\n    return typeof claims === 'object' && claims ? claims : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Stable id for the auth circuit breaker. Tokens rotate, so keying the breaker\n * by the raw value would reset it every refresh — key by the project id encoded\n * in the token instead. Raw keys use a safe prefix.\n */\nexport function credentialBreakerId(credential?: string | null): string {\n  if (!credential) return '(anonymous)'\n  const claims = decodeSiteTokenClaims(credential)\n  if (claims?.pid) return `pid:${claims.pid}`\n  return credential.slice(0, 16)\n}\n\ninterface TokenState {\n  /** The credential injected by the layout (token or raw key). */\n  seed: string | undefined\n  /** Whether we're in token mode (seed is a token). */\n  isToken: boolean\n  /** Base API URL for the refresh endpoint. */\n  apiUrl: string\n  /** The freshest known token (>= seed). Null in raw-key mode. */\n  token: string | null\n  /** In-flight refresh, deduped. */\n  refreshing: Promise<string | null> | null\n}\n\nconst state: TokenState = {\n  seed: undefined,\n  isToken: false,\n  apiUrl: 'https://api.sonor.io',\n  token: null,\n  refreshing: null,\n}\n\nfunction readStoredToken(): string | null {\n  if (typeof window === 'undefined') return null\n  try {\n    const raw = window.sessionStorage.getItem(STORAGE_KEY)\n    if (!raw) return null\n    const parsed = JSON.parse(raw)\n    return typeof parsed?.token === 'string' ? parsed.token : null\n  } catch {\n    return null\n  }\n}\n\nfunction storeToken(token: string): void {\n  if (typeof window === 'undefined') return\n  try {\n    window.sessionStorage.setItem(STORAGE_KEY, JSON.stringify({ token }))\n  } catch {\n    /* private mode / disabled storage — memory-only is fine */\n  }\n  try {\n    ;(window as any).__SITE_KIT_API_KEY__ = token\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction tokenExp(token: string | null): number {\n  const claims = decodeSiteTokenClaims(token)\n  return typeof claims?.exp === 'number' ? claims.exp * 1000 : 0\n}\n\n/**\n * Configure the manager from the layout-injected values. Adopts a fresher token\n * from sessionStorage if a prior page in this session already refreshed.\n */\nexport function configureSiteCredential(opts: {\n  credential?: string\n  apiUrl?: string\n}): void {\n  state.seed = opts.credential\n  state.isToken = isSiteToken(opts.credential)\n  if (opts.apiUrl) state.apiUrl = opts.apiUrl.replace(/\\/+$/, '')\n\n  if (!state.isToken) {\n    state.token = null\n    return\n  }\n\n  // configure runs on every render — never downgrade. Keep the freshest of the\n  // injected seed, a token stored by an earlier page this session, and whatever\n  // an in-flight/prior refresh already put in memory.\n  const prior = state.token\n  let best = opts.credential ?? null\n  const stored = readStoredToken()\n  if (stored && tokenExp(stored) > tokenExp(best)) best = stored\n  if (prior && tokenExp(prior) > tokenExp(best)) best = prior\n  state.token = best\n}\n\nfunction needsRefresh(): boolean {\n  if (!state.isToken) return false\n  if (!state.token) return true\n  return Date.now() >= tokenExp(state.token) - REFRESH_SKEW_MS\n}\n\nasync function doRefresh(): Promise<string | null> {\n  const current = state.token\n  if (!current) return null\n  try {\n    const res = await fetch(`${state.apiUrl}/api/public/site-token/refresh`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        // Send the current token as x-api-key too, so the server's key-scoped\n        // throttler buckets refreshes by token rather than by shared CDN IP.\n        'x-api-key': current,\n      },\n      body: JSON.stringify({ token: current }),\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(REFRESH_TIMEOUT_MS)\n          : undefined,\n    })\n    if (!res.ok) return null\n    const data = await res.json().catch(() => null)\n    const next = data?.token\n    if (typeof next === 'string' && isSiteToken(next)) {\n      state.token = next\n      storeToken(next)\n      return next\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\n/** Refresh now (deduped). Returns the new token, or null on failure. */\nexport function refreshSiteToken(): Promise<string | null> {\n  if (!state.isToken) return Promise.resolve(null)\n  if (state.refreshing) return state.refreshing\n  state.refreshing = doRefresh().finally(() => {\n    state.refreshing = null\n  })\n  return state.refreshing\n}\n\n/**\n * The credential to put on the next request. In token mode, refreshes a stale\n * seed first. In raw-key mode, returns the seed unchanged (legacy passthrough).\n */\nexport async function getFreshCredential(\n  seed?: string,\n): Promise<string | undefined> {\n  // A raw key (or nothing configured) — no token machinery.\n  if (!state.isToken) return seed ?? state.seed\n  if (needsRefresh()) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed) return refreshed\n    // Refresh failed — fall through to whatever we have; the request may 401 and\n    // trip the breaker with friendly copy.\n  }\n  return state.token ?? seed ?? state.seed\n}\n\n/** Whether the given credential is being managed as a token. */\nexport function isTokenMode(): boolean {\n  return state.isToken\n}\n\n/**\n * Best-known credential WITHOUT refreshing — for synchronous unload paths\n * (sonorBeacon) that can't await. In token mode returns the freshest token held;\n * in raw-key mode returns the seed.\n */\nexport function currentCredential(seed?: string): string | undefined {\n  if (!state.isToken) return seed ?? state.seed\n  return state.token ?? seed ?? state.seed\n}\n","/**\n * @sonordev/site-kit shared - Resilient fetch\n *\n * Single source of truth for client-side resilient fetch (forms, SitemapSync).\n * Adds a per-attempt timeout and retries transient failures (network errors,\n * request timeouts, HTTP 429, and 5xx) with exponential backoff.\n *\n * A form submission must survive a brief API blip — a deploy, a cold start, a\n * dropped packet. A single un-retried fetch turning into \"Something went wrong\"\n * is how leads get lost. The explicit abort also matters on its own: a request\n * left to hang until the browser's own network timeout logs a console error\n * (net::ERR_TIMED_OUT) that fails Lighthouse best-practices; an aborted fetch\n * logs nothing.\n */\n\nexport interface FetchRetryOptions {\n  /** Number of retries AFTER the first attempt (default 2 → up to 3 tries total). */\n  retries?: number\n  /** Per-attempt timeout in milliseconds (default 15000). */\n  timeoutMs?: number\n}\n\nfunction backoffDelay(attempt: number, response?: Response): number {\n  // Honor a Retry-After header on 429 responses when present.\n  if (response?.status === 429) {\n    const header = response.headers.get('retry-after')\n    const seconds = header ? parseInt(header, 10) : NaN\n    if (!Number.isNaN(seconds) && seconds > 0) return Math.min(seconds * 1000, 10000)\n  }\n  // Exponential backoff: 500ms, 1s, 2s, ... capped at 8s.\n  return Math.min(8000, 500 * 2 ** attempt)\n}\n\n/**\n * fetch() with a timeout and automatic retries for transient failures.\n *\n * Non-transient responses (2xx, 3xx, and 4xx other than 429) are returned to\n * the caller as-is — only 429/5xx and thrown network/timeout errors are retried.\n * If every attempt fails with a thrown error, the last error is re-thrown.\n */\nexport async function fetchWithRetry(\n  url: string,\n  init: RequestInit,\n  options: FetchRetryOptions = {},\n): Promise<Response> {\n  const retries = options.retries ?? 2\n  const timeoutMs = options.timeoutMs ?? 15000\n  let lastError: unknown\n\n  for (let attempt = 0; attempt <= retries; attempt++) {\n    const controller = new AbortController()\n    const timer = setTimeout(() => controller.abort(), timeoutMs)\n    try {\n      const response = await fetch(url, { ...init, signal: controller.signal })\n      clearTimeout(timer)\n\n      if ((response.status === 429 || response.status >= 500) && attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt, response)))\n        continue\n      }\n      return response\n    } catch (error) {\n      clearTimeout(timer)\n      lastError = error\n      // Network failure or timeout (AbortController) — retry while attempts remain.\n      if (attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt)))\n        continue\n      }\n    }\n  }\n\n  throw lastError instanceof Error\n    ? lastError\n    : new Error('Network request failed after multiple attempts. Please try again.')\n}\n","/**\n * @sonordev/site-kit shared - Canonical client transport\n *\n * Single source of truth for how site-kit talks to Sonor from the browser.\n * Every client-side module (analytics, forms, commerce, engage, maps, images,\n * SitemapSync) routes through here instead of bare fetch(), which gives the\n * whole kit, in one place:\n *\n *  - per-attempt timeout + retry with backoff (via fetchWithRetry) — a hung\n *    request left to the browser's own network timeout logs a console error\n *    (net::ERR_TIMED_OUT) that fails Lighthouse best-practices\n *  - the x-sitekit-version header on every request, so the platform can see\n *    which kit version each site actually runs from live traffic\n *  - CREDENTIAL LIFECYCLE: sites on 3.2+ ship a short-lived minted token instead\n *    of the raw key. This transport resolves the freshest token (refreshing a\n *    stale seed transparently), and on a 401/403 for a token it refreshes once\n *    and retries before giving up. A raw key (2.x kit, or the mint-failed\n *    fallback) is a pure passthrough — legacy behavior is unchanged.\n *  - an auth circuit breaker: after a 401/403 the credential is paused for a few\n *    minutes and ONE friendly console.info is emitted — a site on a stale or\n *    canceled key must not spam the API or the visitor's console. Keyed by the\n *    project (from the token) so it survives token rotation.\n *  - sonorBeacon for unload-time telemetry that keeps the credential in headers;\n *    navigator.sendBeacon can't set headers and forced the key into the URL,\n *    where server and CDN access logs capture it\n *\n * Non-idempotent endpoints (checkout, payment intents, uploads) must pass\n * { retries: 0 } — they still get the timeout, but never an automatic retry.\n */\nimport { fetchWithRetry, type FetchRetryOptions } from './fetchWithRetry'\nimport { SITE_KIT_VERSION } from './version'\nimport {\n  credentialBreakerId,\n  currentCredential,\n  getFreshCredential,\n  isSiteToken,\n  isTokenMode,\n  refreshSiteToken,\n} from './siteToken'\n\nexport interface SonorFetchOptions extends FetchRetryOptions {\n  /** Project credential — the minted token (3.2+) or raw key. Sent as x-api-key. */\n  apiKey?: string\n}\n\n/** How long a credential stays paused after an auth failure. */\nconst AUTH_BREAK_MS = 5 * 60_000\n\n// breaker id → epoch ms until which requests are paused. Module-scoped: the\n// breaker lives for the page's lifetime and never applies on the server.\nconst pausedKeys = new Map<string, number>()\nlet warnedThisPage = false\n\n/** True when a previous 401/403 has paused this credential (browser only). */\nexport function isAuthPaused(credential?: string): boolean {\n  if (typeof window === 'undefined') return false\n  const id = credentialBreakerId(credential)\n  const until = pausedKeys.get(id)\n  if (!until) return false\n  if (Date.now() >= until) {\n    pausedKeys.delete(id)\n    return false\n  }\n  return true\n}\n\nfunction tripBreaker(credential?: string): void {\n  pausedKeys.set(credentialBreakerId(credential), Date.now() + AUTH_BREAK_MS)\n  if (!warnedThisPage) {\n    warnedThisPage = true\n    // info, not error: a visitor's console must stay clean (Lighthouse\n    // errors-in-console), and copy never names env vars or key formats.\n    console.info(\n      \"[Sonor] This site couldn't authenticate with Sonor, so data features are paused for a few minutes. If this keeps happening, the site is likely running an outdated API key.\",\n    )\n  }\n}\n\nexport async function sonorFetch(\n  url: string,\n  init: RequestInit = {},\n  options: SonorFetchOptions = {},\n): Promise<Response> {\n  // Resolve the credential to send. In token mode this may transparently refresh\n  // a stale seed before the first request; in raw-key mode it's a passthrough.\n  let credential = options.apiKey\n  if (credential !== undefined || isTokenMode()) {\n    credential = await getFreshCredential(options.apiKey)\n  }\n\n  const headers = new Headers(init.headers || {})\n  headers.set('x-sitekit-version', SITE_KIT_VERSION)\n  if (credential) {\n    if (isTokenMode()) {\n      // Token mode: `credential` is the freshest token (refreshed just above if\n      // the seed was stale). It MUST override any x-api-key a caller hand-set — a\n      // stale build-time seed passed as a header would otherwise pin the request\n      // and defeat refresh entirely. Also drop a caller-set Authorization:\n      // extractApiKey() server-side prefers `Authorization: Bearer` over\n      // x-api-key, so a stale Bearer seed would win even once we set a fresh\n      // x-api-key. This is the single place the client credential is chosen — do\n      // not re-attach it as a header at call sites.\n      headers.set('x-api-key', credential)\n      headers.delete('authorization')\n    } else if (!headers.has('x-api-key')) {\n      // Raw-key mode: legacy passthrough — respect a caller-supplied header.\n      headers.set('x-api-key', credential)\n    }\n  }\n\n  if (isAuthPaused(credential)) {\n    // Synthetic response keeps every caller's !response.ok path working\n    // without a network round trip while the breaker is open.\n    return new Response(null, { status: 401, statusText: 'sonor-auth-paused' })\n  }\n\n  let response = await fetchWithRetry(url, { ...init, headers }, options)\n\n  // A token can rotate or expire mid-session. On the first auth failure, try ONE\n  // refresh + retry before tripping the breaker — only for token credentials\n  // (raw keys have nothing to refresh).\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    isSiteToken(credential)\n  ) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed && refreshed !== credential) {\n      const retryHeaders = new Headers(init.headers || {})\n      retryHeaders.set('x-sitekit-version', SITE_KIT_VERSION)\n      retryHeaders.set('x-api-key', refreshed)\n      // Same reason as the initial request: a caller-set stale Bearer would win\n      // over our fresh x-api-key server-side, so strip it on the retry too.\n      retryHeaders.delete('authorization')\n      credential = refreshed\n      response = await fetchWithRetry(url, { ...init, headers: retryHeaders }, options)\n    }\n  }\n\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    credential\n  ) {\n    tripBreaker(credential)\n  }\n\n  return response\n}\n\n/**\n * Fire-and-forget telemetry that survives page unload.\n *\n * Uses fetch({ keepalive: true }) so auth travels in headers. Falls back to\n * navigator.sendBeacon (no auth headers possible — the server may reject it,\n * but we never put the key in the URL) only when keepalive fetch is missing.\n *\n * Cannot await a refresh at unload time, so it sends the freshest token already\n * held (currentCredential) rather than the possibly-stale seed the caller passed.\n */\nexport function sonorBeacon(url: string, payload: unknown, apiKey?: string): void {\n  const credential = currentCredential(apiKey)\n  const body = typeof payload === 'string' ? payload : JSON.stringify(payload)\n  try {\n    void fetch(url, {\n      method: 'POST',\n      keepalive: true,\n      headers: {\n        'Content-Type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        ...(credential ? { 'x-api-key': credential } : {}),\n      },\n      body,\n    }).catch(() => {\n      /* page is closing — best effort */\n    })\n  } catch {\n    try {\n      if (typeof navigator !== 'undefined' && navigator.sendBeacon) {\n        navigator.sendBeacon(url, new Blob([body], { type: 'application/json' }))\n      }\n    } catch {\n      /* nothing left to try */\n    }\n  }\n}\n"]}

package/dist/chunk-YCQHE2XT.mjs

@@ -0,0 +1,6 @@
+// src/shared/version.ts
+var SITE_KIT_VERSION = "3.4.0";
+
+export { SITE_KIT_VERSION };
+//# sourceMappingURL=chunk-YCQHE2XT.mjs.map
+//# sourceMappingURL=chunk-YCQHE2XT.mjs.map

package/dist/{chunk-K6YGF2KJ.mjs.map → chunk-YCQHE2XT.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";AASO,IAAM,gBAAA,GAAmB","file":"chunk-K6YGF2KJ.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared - Package version constant\n *\n * Single source of truth for the version the kit reports at runtime (the\n * x-sitekit-version request header set by sonorFetch). Kept as a plain const\n * so client bundles don't need JSON imports; scripts/verify-dts.cjs asserts\n * it matches package.json at publish time, and version.test.ts asserts it in\n * dev, so it can't silently drift.\n */\nexport const SITE_KIT_VERSION = '3.3.1'\n"]}
+{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";AASO,IAAM,gBAAA,GAAmB","file":"chunk-YCQHE2XT.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared - Package version constant\n *\n * Single source of truth for the version the kit reports at runtime (the\n * x-sitekit-version request header set by sonorFetch). Kept as a plain const\n * so client bundles don't need JSON imports; scripts/verify-dts.cjs asserts\n * it matches package.json at publish time, and version.test.ts asserts it in\n * dev, so it can't silently drift.\n */\nexport const SITE_KIT_VERSION = '3.4.0'\n"]}