@sonordev/site-kit 3.3.1 → 3.5.0

package/dist/layout/client.js

@@ -1,22 +1,25 @@
 'use client';
 'use strict';
 
-var chunk4JMXBIUC_js = require('../chunk-4JMXBIUC.js');
-require('../chunk-QRIGY6EM.js');
+var chunkPE2A3ON5_js = require('../chunk-PE2A3ON5.js');
+require('../chunk-TRTT4PND.js');
+require('../chunk-T3RPPS25.js');
 require('../chunk-HGNSJXWT.js');
 require('../chunk-Q2NBD54V.js');
-require('../chunk-WZHWWOUC.js');
-require('../chunk-FMQHK6MM.js');
-require('../chunk-3BNFUMLL.js');
-require('../chunk-KPKZBIAQ.js');
-require('../chunk-3X2YPJU5.js');
+require('../chunk-NB4MK2Q5.js');
+require('../chunk-Y4U3OCKH.js');
+require('../chunk-XB57AM6T.js');
+require('../chunk-VJMPIRSD.js');
+require('../chunk-XY4NJJEX.js');
+require('../chunk-UXEB6UAR.js');
+require('../chunk-NME3SQCB.js');
 require('../chunk-ZSMWDLMK.js');
 
 
 
 Object.defineProperty(exports, "SiteKitClientProviders", {
   enumerable: true,
-  get: function () { return chunk4JMXBIUC_js.SiteKitClientProviders; }
+  get: function () { return chunkPE2A3ON5_js.SiteKitClientProviders; }
 });
 //# sourceMappingURL=client.js.map
 //# sourceMappingURL=client.js.map

package/dist/layout/client.mjs

@@ -1,13 +1,16 @@
 'use client';
-export { SiteKitClientProviders } from '../chunk-NQ3K4NWX.mjs';
-import '../chunk-ZFF3BKNE.mjs';
+export { SiteKitClientProviders } from '../chunk-5WQHWBCW.mjs';
+import '../chunk-DWVF7SEK.mjs';
+import '../chunk-6JVDIW5L.mjs';
 import '../chunk-ZVBLXXNJ.mjs';
 import '../chunk-ZPLN537Q.mjs';
-import '../chunk-X4OPM3SK.mjs';
-import '../chunk-QFWBAGBT.mjs';
-import '../chunk-EE6SFAZP.mjs';
-import '../chunk-GUU3AEFM.mjs';
-import '../chunk-K6YGF2KJ.mjs';
+import '../chunk-NI7OY4FW.mjs';
+import '../chunk-UFOOVODL.mjs';
+import '../chunk-AX4AROLH.mjs';
+import '../chunk-6EDVCUAG.mjs';
+import '../chunk-VX3WK77I.mjs';
+import '../chunk-BNJH2RFU.mjs';
+import '../chunk-QGPYFC6G.mjs';
 import '../chunk-4XPGGLVP.mjs';
 //# sourceMappingURL=client.mjs.map
 //# sourceMappingURL=client.mjs.map

package/dist/layout/index.js

@@ -1,65 +1,24 @@
 'use strict';
 
-var chunk4JMXBIUC_js = require('../chunk-4JMXBIUC.js');
-require('../chunk-QRIGY6EM.js');
+var chunkPE2A3ON5_js = require('../chunk-PE2A3ON5.js');
+require('../chunk-TRTT4PND.js');
+require('../chunk-T3RPPS25.js');
 require('../chunk-HGNSJXWT.js');
 require('../chunk-Q2NBD54V.js');
-require('../chunk-WZHWWOUC.js');
+require('../chunk-NB4MK2Q5.js');
 var chunkGCPPXUAI_js = require('../chunk-GCPPXUAI.js');
-require('../chunk-FMQHK6MM.js');
+require('../chunk-Y4U3OCKH.js');
+var chunkCXDIWBIQ_js = require('../chunk-CXDIWBIQ.js');
 var chunkDV2LJYFD_js = require('../chunk-DV2LJYFD.js');
 var chunkQPIKPWAZ_js = require('../chunk-QPIKPWAZ.js');
-require('../chunk-3BNFUMLL.js');
-require('../chunk-KPKZBIAQ.js');
-var chunk3X2YPJU5_js = require('../chunk-3X2YPJU5.js');
+require('../chunk-XB57AM6T.js');
+require('../chunk-VJMPIRSD.js');
+require('../chunk-XY4NJJEX.js');
+require('../chunk-UXEB6UAR.js');
+require('../chunk-NME3SQCB.js');
 require('../chunk-ZSMWDLMK.js');
-require('server-only');
 var jsxRuntime = require('react/jsx-runtime');
 
-var MINT_PATH = "/api/public/site-token";
-var MINT_TIMEOUT_MS = 4e3;
-var SITE_TOKEN_PREFIX = "st1.";
-var cache = /* @__PURE__ */ new Map();
-async function resolveClientCredential(rawKey, apiUrl) {
-  if (!rawKey) return "";
-  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey;
-  const now = Date.now();
-  const cached = cache.get(rawKey);
-  if (cached && cached.expiresAt > now) return cached.credential;
-  const base = (apiUrl || "https://api.sonor.io").replace(/\/+$/, "");
-  try {
-    const res = await fetch(`${base}${MINT_PATH}`, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        "x-api-key": rawKey,
-        "x-sitekit-version": chunk3X2YPJU5_js.SITE_KIT_VERSION
-      },
-      cache: "no-store",
-      signal: typeof AbortSignal !== "undefined" && AbortSignal.timeout ? AbortSignal.timeout(MINT_TIMEOUT_MS) : void 0
-    });
-    if (res.ok) {
-      const data = await res.json().catch(() => null);
-      const token = data?.token;
-      const expiresIn = typeof data?.expiresIn === "number" ? data.expiresIn : 3600;
-      if (typeof token === "string" && token.startsWith(SITE_TOKEN_PREFIX)) {
-        cache.set(rawKey, {
-          credential: token,
-          expiresAt: now + Math.min(expiresIn * 1e3 / 2, 30 * 6e4)
-        });
-        return token;
-      }
-    } else if (res.status !== 404) {
-      console.warn(
-        `[SiteKitLayout] Token mint returned ${res.status}; injecting raw key for this render.`
-      );
-    }
-  } catch {
-    console.warn("[SiteKitLayout] Token mint unavailable; injecting raw key for this render.");
-  }
-  cache.set(rawKey, { credential: rawKey, expiresAt: now + 6e4 });
-  return rawKey;
-}
 async function SiteKitLayout({
   children,
   apiKey,
@@ -84,14 +43,14 @@ async function SiteKitLayout({
     );
   }
   const apiOrigin = chunkQPIKPWAZ_js.resolveApiOrigin(resolvedApiUrl);
-  const clientCredential = await resolveClientCredential(resolvedApiKey, resolvedApiUrl);
+  const clientCredential = await chunkCXDIWBIQ_js.resolveClientCredential(resolvedApiKey, resolvedApiUrl);
   return /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
     /* @__PURE__ */ jsxRuntime.jsx("link", { rel: "preconnect", href: apiOrigin, crossOrigin: "anonymous" }),
     /* @__PURE__ */ jsxRuntime.jsx("link", { rel: "dns-prefetch", href: apiOrigin }),
     favicon && /* @__PURE__ */ jsxRuntime.jsx(chunkGCPPXUAI_js.ManagedFavicon, { apiKey: resolvedApiKey, apiUrl: resolvedApiUrl }),
     managedScripts && /* @__PURE__ */ jsxRuntime.jsx(chunkDV2LJYFD_js.ManagedScripts, { position: "head" }),
     /* @__PURE__ */ jsxRuntime.jsxs(
-      chunk4JMXBIUC_js.SiteKitClientProviders,
+      chunkPE2A3ON5_js.SiteKitClientProviders,
       {
         apiKey: clientCredential,
         apiUrl: resolvedApiUrl,

package/dist/layout/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/mint-site-token.ts","../../src/layout/SiteKitLayout.tsx"],"names":["SITE_KIT_VERSION","resolveApiOrigin","jsxs","Fragment","jsx","ManagedFavicon","ManagedScripts","SiteKitClientProviders"],"mappings":";;;;;;;;;;;;;;;;;;AAqBA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAM1B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAE1C,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,MAAA,IAAU,MAAA,CAAO,SAAA,GAAY,GAAA,SAAY,MAAA,CAAO,UAAA;AAEpD,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,GAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,MAC7C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,WAAA,EAAa,MAAA;AAAA,QACb,mBAAA,EAAqBA;AAAA,OACvB;AAAA,MACA,KAAA,EAAO,UAAA;AAAA,MACP,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,KACP,CAAA;AAED,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,MAAM,IAAA,CAAK,GAAA,CAAK,YAAY,GAAA,GAAQ,CAAA,EAAG,KAAK,GAAM;AAAA,SAC9D,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AAAA,IACF,CAAA,MAAA,IAAW,GAAA,CAAI,MAAA,KAAW,GAAA,EAAK;AAG7B,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA,oCAAA;AAAA,OACnD;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAA,CAAQ,KAAK,4EAA4E,CAAA;AAAA,EAC3F;AAIA,EAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,EAAA,OAAO,MAAA;AACT;ACaA,eAAsB,aAAA,CAAc;AAAA,EAClC,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA,GAAY,IAAA;AAAA,EACZ,MAAA,GAAS,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EACT,WAAA,GAAc,IAAA;AAAA,EACd,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR,OAAA,GAAU,IAAA;AAAA,EACV,cAAA,GAAiB,IAAA;AAAA,EACjB,KAAA,GAAQ,KAAA;AAAA,EACR,qBAAA,GAAwB;AAC1B,CAAA,EAAuB;AAErB,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,EAAA;AACF,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,sBAAA;AAEF,EAAA,IAAI,CAAC,kBAAkB,KAAA,EAAO;AAC5B,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAYC,kCAAiB,cAAc,CAAA;AAKjD,EAAA,MAAM,gBAAA,GAAmB,MAAM,uBAAA,CAAwB,cAAA,EAAgB,cAAc,CAAA;AAErF,EAAA,uBACEC,eAAA,CAAAC,mBAAA,EAAA,EACE,QAAA,EAAA;AAAA,oBAAAC,cAAA,CAAC,UAAK,GAAA,EAAI,YAAA,EAAa,IAAA,EAAM,SAAA,EAAW,aAAY,WAAA,EAAY,CAAA;AAAA,oBAChEA,cAAA,CAAC,MAAA,EAAA,EAAK,GAAA,EAAI,cAAA,EAAe,MAAM,SAAA,EAAW,CAAA;AAAA,IAEzC,2BAAWA,cAAA,CAACC,+BAAA,EAAA,EAAe,MAAA,EAAQ,cAAA,EAAgB,QAAQ,cAAA,EAAgB,CAAA;AAAA,IAC3E,cAAA,oBAAkBD,cAAA,CAACE,+BAAA,EAAA,EAAe,QAAA,EAAS,MAAA,EAAO,CAAA;AAAA,oBAInDJ,eAAA;AAAA,MAACK,uCAAA;AAAA,MAAA;AAAA,QACC,MAAA,EAAQ,gBAAA;AAAA,QACR,MAAA,EAAQ,cAAA;AAAA,QACR,SAAA;AAAA,QACA,SAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,WAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QAEC,QAAA,EAAA;AAAA,UAAA,QAAA;AAAA,UACA,qBAAA,mBACCH,cAAA,CAAC,QAAA,EAAA,EAAO,SAAA,EAAU,SAAA,EAAU,aAAA,EAAY,MAAA,EACtC,QAAA,kBAAAA,cAAA,CAAC,GAAA,EAAA,EAAE,IAAA,EAAK,WAAA,EAAY,QAAA,EAAA,UAAA,EAAQ,GAC9B,CAAA,GACE;AAAA;AAAA;AAAA,KACN;AAAA,IAGC,cAAA,oBAAkBA,cAAA,CAACE,+BAAA,EAAA,EAAe,QAAA,EAAS,UAAA,EAAW;AAAA,GAAA,EACzD,CAAA;AAEJ","file":"index.js","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * Resilience: if minting is unavailable (older API without the endpoint, token\n * auth not configured, transient outage) it returns the RAW KEY, so a build never\n * breaks. Domain-binding is log-only by default, so the raw key still works —\n * worst case is exactly pre-3.2 behavior. Memoized per raw key for the process,\n * so an entire `next build` mints ~once and every static page reuses one seed\n * (the client refreshes on the far side as needed).\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const now = Date.now()\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > now) return cached.credential\n\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  try {\n    const res = await fetch(`${base}${MINT_PATH}`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-api-key': rawKey,\n        'x-sitekit-version': SITE_KIT_VERSION,\n      },\n      cache: 'no-store',\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n          : undefined,\n    })\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: now + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n    } else if (res.status !== 404) {\n      // 404 = older API without the endpoint (expected during rollout). Anything\n      // else is worth a server-side note. Never logs the key value.\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; injecting raw key for this render.`,\n      )\n    }\n  } catch {\n    console.warn('[SiteKitLayout] Token mint unavailable; injecting raw key for this render.')\n  }\n\n  // Fallback: the raw key (pre-3.2 behavior). Short cache so a transient outage\n  // retries soon rather than pinning the raw key for the whole build.\n  cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n  return rawKey\n}\n","/**\n * @sonordev/site-kit/layout — SiteKitLayout\n *\n * The master layout component. A single RSC that auto-composes every\n * site-kit feature your layout needs:\n *\n * Server-side (RSC):\n *   - ManagedFavicon (link tags from Portal logo)\n *   - ManagedScripts position=\"head\" (tracking pixels, analytics tags)\n *   - ManagedScripts position=\"body-end\"\n *\n * Client-side (island):\n *   - AnalyticsProvider (page views, scroll depth, heatmap, web vitals)\n *   - EngageWidget (popups, nudges, chat)\n *   - SignalBridge (A/B experiments, behavior tracking)\n *   - SitemapSync (keeps Portal seo_pages in sync)\n *\n * @example\n * ```tsx\n * // app/layout.tsx\n * import { SiteKitLayout } from '@sonordev/site-kit/layout'\n *\n * export default function RootLayout({ children }) {\n *   return (\n *     <html lang=\"en\">\n *       <body>\n *         <SiteKitLayout>\n *           <Header />\n *           <main>{children}</main>\n *           <Footer />\n *         </SiteKitLayout>\n *       </body>\n *     </html>\n *   )\n * }\n * ```\n *\n * @example Opt out of specific features:\n * ```tsx\n * <SiteKitLayout engage={false} signal={false}>\n *   {children}\n * </SiteKitLayout>\n * ```\n */\n\nimport * as React from 'react'\nimport { ManagedFavicon } from '../images/ManagedFavicon'\nimport { ManagedScripts } from '../seo/ManagedScripts'\nimport { resolveApiOrigin } from '../server/server-fetch'\nimport { resolveClientCredential } from '../server/mint-site-token'\nimport { SiteKitClientProviders } from './SiteKitClientProviders'\nimport type { AnalyticsConfig, EngageConfig, SignalConfig } from './types'\n\nexport interface SiteKitLayoutProps {\n  children: React.ReactNode\n\n  /** Portal API key. Defaults to SONOR_API_KEY env var. */\n  apiKey?: string\n  /** Portal API URL. Defaults to env or https://api.sonor.io */\n  apiUrl?: string\n  /** Project ID (for Engage chat room routing). Auto-resolved if not provided. */\n  projectId?: string\n\n  /** Analytics tracking. true (default) | false | config object */\n  analytics?: boolean | AnalyticsConfig\n  /** Engage widgets (popups, chat). true (default) | false | config object */\n  engage?: boolean | EngageConfig\n  /** Signal AI (experiments, behavior). false (default) | true | config object */\n  signal?: boolean | SignalConfig\n  /** SitemapSync client component. Default: true */\n  sitemapSync?: boolean\n  /**\n   * Fleet heartbeat — reports this site's kit version + active modules to Sonor\n   * once per session so the platform can track version drift. Default: true.\n   * Deferred like Analytics; never in the hydration path.\n   */\n  fleet?: boolean\n  /**\n   * Defer client modules (Analytics, Engage, SitemapSync) until window load +\n   * idle or the first user interaction, keeping their JS and mount work out of\n   * the critical hydration path. Default: true. Pass false to restore legacy\n   * eager mounting. SignalBridge is never deferred.\n   */\n  defer?: boolean\n  /** ManagedFavicon in <head>. Default: true */\n  favicon?: boolean\n  /** ManagedScripts (head + body-end). Default: true */\n  managedScripts?: boolean\n\n  /** Debug mode — logs to console. Default: false */\n  debug?: boolean\n  /**\n   * When true, append a screen-reader-only link to `/llms.txt` after main content.\n   * Default false — prefer `buildAiDiscoveryHeaders()` for discovery.\n   */\n  showLlmsTxtFooterLink?: boolean\n}\n\nexport async function SiteKitLayout({\n  children,\n  apiKey,\n  apiUrl,\n  projectId,\n  analytics = true,\n  engage = true,\n  signal = false,\n  sitemapSync = true,\n  fleet = true,\n  defer = true,\n  favicon = true,\n  managedScripts = true,\n  debug = false,\n  showLlmsTxtFooterLink = false,\n}: SiteKitLayoutProps) {\n  // Resolve API config from env (server-side, safe)\n  const resolvedApiKey =\n    apiKey ??\n    process.env.SONOR_API_KEY ??\n    ''\n  const resolvedApiUrl =\n    apiUrl ??\n    process.env.SONOR_API_URL ??\n    'https://api.sonor.io'\n\n  if (!resolvedApiKey && debug) {\n    console.warn(\n      '[SiteKitLayout] No API key found. Set SONOR_API_KEY.',\n    )\n  }\n\n  const apiOrigin = resolveApiOrigin(resolvedApiUrl)\n\n  // Mint a short-lived client token so the raw key never reaches the browser.\n  // Falls back to the raw key if minting is unavailable (older API / transient\n  // outage) — the build never breaks. The client refreshes the token as needed.\n  const clientCredential = await resolveClientCredential(resolvedApiKey, resolvedApiUrl)\n\n  return (\n    <>\n      <link rel=\"preconnect\" href={apiOrigin} crossOrigin=\"anonymous\" />\n      <link rel=\"dns-prefetch\" href={apiOrigin} />\n      {/* Server-rendered head components */}\n      {favicon && <ManagedFavicon apiKey={resolvedApiKey} apiUrl={resolvedApiUrl} />}\n      {managedScripts && <ManagedScripts position=\"head\" />}\n\n      {/* Client-side providers island — receives the minted token (or raw-key\n          fallback), never the raw key when minting succeeds. */}\n      <SiteKitClientProviders\n        apiKey={clientCredential}\n        apiUrl={resolvedApiUrl}\n        projectId={projectId}\n        analytics={analytics}\n        engage={engage}\n        signal={signal}\n        sitemapSync={sitemapSync}\n        fleet={fleet}\n        defer={defer}\n        debug={debug}\n      >\n        {children}\n        {showLlmsTxtFooterLink ? (\n          <footer className=\"sr-only\" aria-hidden=\"true\">\n            <a href=\"/llms.txt\">llms.txt</a>\n          </footer>\n        ) : null}\n      </SiteKitClientProviders>\n\n      {/* Server-rendered body-end scripts */}\n      {managedScripts && <ManagedScripts position=\"body-end\" />}\n    </>\n  )\n}\n"]}
+{"version":3,"sources":["../../src/layout/SiteKitLayout.tsx"],"names":["resolveApiOrigin","resolveClientCredential","jsxs","Fragment","jsx","ManagedFavicon","ManagedScripts","SiteKitClientProviders"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAkGA,eAAsB,aAAA,CAAc;AAAA,EAClC,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA,GAAY,IAAA;AAAA,EACZ,MAAA,GAAS,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EACT,WAAA,GAAc,IAAA;AAAA,EACd,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR,OAAA,GAAU,IAAA;AAAA,EACV,cAAA,GAAiB,IAAA;AAAA,EACjB,KAAA,GAAQ,KAAA;AAAA,EACR,qBAAA,GAAwB;AAC1B,CAAA,EAAuB;AAErB,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,EAAA;AACF,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,sBAAA;AAEF,EAAA,IAAI,CAAC,kBAAkB,KAAA,EAAO;AAC5B,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAYA,kCAAiB,cAAc,CAAA;AAKjD,EAAA,MAAM,gBAAA,GAAmB,MAAMC,wCAAA,CAAwB,cAAA,EAAgB,cAAc,CAAA;AAErF,EAAA,uBACEC,eAAA,CAAAC,mBAAA,EAAA,EACE,QAAA,EAAA;AAAA,oBAAAC,cAAA,CAAC,UAAK,GAAA,EAAI,YAAA,EAAa,IAAA,EAAM,SAAA,EAAW,aAAY,WAAA,EAAY,CAAA;AAAA,oBAChEA,cAAA,CAAC,MAAA,EAAA,EAAK,GAAA,EAAI,cAAA,EAAe,MAAM,SAAA,EAAW,CAAA;AAAA,IAEzC,2BAAWA,cAAA,CAACC,+BAAA,EAAA,EAAe,MAAA,EAAQ,cAAA,EAAgB,QAAQ,cAAA,EAAgB,CAAA;AAAA,IAC3E,cAAA,oBAAkBD,cAAA,CAACE,+BAAA,EAAA,EAAe,QAAA,EAAS,MAAA,EAAO,CAAA;AAAA,oBAInDJ,eAAA;AAAA,MAACK,uCAAA;AAAA,MAAA;AAAA,QACC,MAAA,EAAQ,gBAAA;AAAA,QACR,MAAA,EAAQ,cAAA;AAAA,QACR,SAAA;AAAA,QACA,SAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,WAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QAEC,QAAA,EAAA;AAAA,UAAA,QAAA;AAAA,UACA,qBAAA,mBACCH,cAAA,CAAC,QAAA,EAAA,EAAO,SAAA,EAAU,SAAA,EAAU,aAAA,EAAY,MAAA,EACtC,QAAA,kBAAAA,cAAA,CAAC,GAAA,EAAA,EAAE,IAAA,EAAK,WAAA,EAAY,QAAA,EAAA,UAAA,EAAQ,GAC9B,CAAA,GACE;AAAA;AAAA;AAAA,KACN;AAAA,IAGC,cAAA,oBAAkBA,cAAA,CAACE,+BAAA,EAAA,EAAe,QAAA,EAAS,UAAA,EAAW;AAAA,GAAA,EACzD,CAAA;AAEJ","file":"index.js","sourcesContent":["/**\n * @sonordev/site-kit/layout — SiteKitLayout\n *\n * The master layout component. A single RSC that auto-composes every\n * site-kit feature your layout needs:\n *\n * Server-side (RSC):\n *   - ManagedFavicon (link tags from Portal logo)\n *   - ManagedScripts position=\"head\" (tracking pixels, analytics tags)\n *   - ManagedScripts position=\"body-end\"\n *\n * Client-side (island):\n *   - AnalyticsProvider (page views, scroll depth, heatmap, web vitals)\n *   - EngageWidget (popups, nudges, chat)\n *   - SignalBridge (A/B experiments, behavior tracking)\n *   - SitemapSync (keeps Portal seo_pages in sync)\n *\n * @example\n * ```tsx\n * // app/layout.tsx\n * import { SiteKitLayout } from '@sonordev/site-kit/layout'\n *\n * export default function RootLayout({ children }) {\n *   return (\n *     <html lang=\"en\">\n *       <body>\n *         <SiteKitLayout>\n *           <Header />\n *           <main>{children}</main>\n *           <Footer />\n *         </SiteKitLayout>\n *       </body>\n *     </html>\n *   )\n * }\n * ```\n *\n * @example Opt out of specific features:\n * ```tsx\n * <SiteKitLayout engage={false} signal={false}>\n *   {children}\n * </SiteKitLayout>\n * ```\n */\n\nimport * as React from 'react'\nimport { ManagedFavicon } from '../images/ManagedFavicon'\nimport { ManagedScripts } from '../seo/ManagedScripts'\nimport { resolveApiOrigin } from '../server/server-fetch'\nimport { resolveClientCredential } from '../server/mint-site-token'\nimport { SiteKitClientProviders } from './SiteKitClientProviders'\nimport type { AnalyticsConfig, EngageConfig, SignalConfig } from './types'\n\nexport interface SiteKitLayoutProps {\n  children: React.ReactNode\n\n  /** Portal API key. Defaults to SONOR_API_KEY env var. */\n  apiKey?: string\n  /** Portal API URL. Defaults to env or https://api.sonor.io */\n  apiUrl?: string\n  /** Project ID (for Engage chat room routing). Auto-resolved if not provided. */\n  projectId?: string\n\n  /** Analytics tracking. true (default) | false | config object */\n  analytics?: boolean | AnalyticsConfig\n  /** Engage widgets (popups, chat). true (default) | false | config object */\n  engage?: boolean | EngageConfig\n  /** Signal AI (experiments, behavior). false (default) | true | config object */\n  signal?: boolean | SignalConfig\n  /** SitemapSync client component. Default: true */\n  sitemapSync?: boolean\n  /**\n   * Fleet heartbeat — reports this site's kit version + active modules to Sonor\n   * once per session so the platform can track version drift. Default: true.\n   * Deferred like Analytics; never in the hydration path.\n   */\n  fleet?: boolean\n  /**\n   * Defer client modules (Analytics, Engage, SitemapSync) until window load +\n   * idle or the first user interaction, keeping their JS and mount work out of\n   * the critical hydration path. Default: true. Pass false to restore legacy\n   * eager mounting. SignalBridge is never deferred.\n   */\n  defer?: boolean\n  /** ManagedFavicon in <head>. Default: true */\n  favicon?: boolean\n  /** ManagedScripts (head + body-end). Default: true */\n  managedScripts?: boolean\n\n  /** Debug mode — logs to console. Default: false */\n  debug?: boolean\n  /**\n   * When true, append a screen-reader-only link to `/llms.txt` after main content.\n   * Default false — prefer `buildAiDiscoveryHeaders()` for discovery.\n   */\n  showLlmsTxtFooterLink?: boolean\n}\n\nexport async function SiteKitLayout({\n  children,\n  apiKey,\n  apiUrl,\n  projectId,\n  analytics = true,\n  engage = true,\n  signal = false,\n  sitemapSync = true,\n  fleet = true,\n  defer = true,\n  favicon = true,\n  managedScripts = true,\n  debug = false,\n  showLlmsTxtFooterLink = false,\n}: SiteKitLayoutProps) {\n  // Resolve API config from env (server-side, safe)\n  const resolvedApiKey =\n    apiKey ??\n    process.env.SONOR_API_KEY ??\n    ''\n  const resolvedApiUrl =\n    apiUrl ??\n    process.env.SONOR_API_URL ??\n    'https://api.sonor.io'\n\n  if (!resolvedApiKey && debug) {\n    console.warn(\n      '[SiteKitLayout] No API key found. Set SONOR_API_KEY.',\n    )\n  }\n\n  const apiOrigin = resolveApiOrigin(resolvedApiUrl)\n\n  // Mint a short-lived client token so the raw key never reaches the browser.\n  // Falls back to the raw key if minting is unavailable (older API / transient\n  // outage) — the build never breaks. The client refreshes the token as needed.\n  const clientCredential = await resolveClientCredential(resolvedApiKey, resolvedApiUrl)\n\n  return (\n    <>\n      <link rel=\"preconnect\" href={apiOrigin} crossOrigin=\"anonymous\" />\n      <link rel=\"dns-prefetch\" href={apiOrigin} />\n      {/* Server-rendered head components */}\n      {favicon && <ManagedFavicon apiKey={resolvedApiKey} apiUrl={resolvedApiUrl} />}\n      {managedScripts && <ManagedScripts position=\"head\" />}\n\n      {/* Client-side providers island — receives the minted token (or raw-key\n          fallback), never the raw key when minting succeeds. */}\n      <SiteKitClientProviders\n        apiKey={clientCredential}\n        apiUrl={resolvedApiUrl}\n        projectId={projectId}\n        analytics={analytics}\n        engage={engage}\n        signal={signal}\n        sitemapSync={sitemapSync}\n        fleet={fleet}\n        defer={defer}\n        debug={debug}\n      >\n        {children}\n        {showLlmsTxtFooterLink ? (\n          <footer className=\"sr-only\" aria-hidden=\"true\">\n            <a href=\"/llms.txt\">llms.txt</a>\n          </footer>\n        ) : null}\n      </SiteKitClientProviders>\n\n      {/* Server-rendered body-end scripts */}\n      {managedScripts && <ManagedScripts position=\"body-end\" />}\n    </>\n  )\n}\n"]}

package/dist/layout/index.mjs

@@ -1,63 +1,22 @@
-import { SiteKitClientProviders } from '../chunk-NQ3K4NWX.mjs';
-import '../chunk-ZFF3BKNE.mjs';
+import { SiteKitClientProviders } from '../chunk-5WQHWBCW.mjs';
+import '../chunk-DWVF7SEK.mjs';
+import '../chunk-6JVDIW5L.mjs';
 import '../chunk-ZVBLXXNJ.mjs';
 import '../chunk-ZPLN537Q.mjs';
-import '../chunk-X4OPM3SK.mjs';
+import '../chunk-NI7OY4FW.mjs';
 import { ManagedFavicon } from '../chunk-CU6OGBKK.mjs';
-import '../chunk-QFWBAGBT.mjs';
+import '../chunk-UFOOVODL.mjs';
+import { resolveClientCredential } from '../chunk-MJDYY6S3.mjs';
 import { ManagedScripts } from '../chunk-6PJTLBRR.mjs';
 import { resolveApiOrigin } from '../chunk-UDBUK5ZJ.mjs';
-import '../chunk-EE6SFAZP.mjs';
-import '../chunk-GUU3AEFM.mjs';
-import { SITE_KIT_VERSION } from '../chunk-K6YGF2KJ.mjs';
+import '../chunk-AX4AROLH.mjs';
+import '../chunk-6EDVCUAG.mjs';
+import '../chunk-VX3WK77I.mjs';
+import '../chunk-BNJH2RFU.mjs';
+import '../chunk-QGPYFC6G.mjs';
 import '../chunk-4XPGGLVP.mjs';
-import 'server-only';
 import { jsxs, Fragment, jsx } from 'react/jsx-runtime';
 
-var MINT_PATH = "/api/public/site-token";
-var MINT_TIMEOUT_MS = 4e3;
-var SITE_TOKEN_PREFIX = "st1.";
-var cache = /* @__PURE__ */ new Map();
-async function resolveClientCredential(rawKey, apiUrl) {
-  if (!rawKey) return "";
-  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey;
-  const now = Date.now();
-  const cached = cache.get(rawKey);
-  if (cached && cached.expiresAt > now) return cached.credential;
-  const base = (apiUrl || "https://api.sonor.io").replace(/\/+$/, "");
-  try {
-    const res = await fetch(`${base}${MINT_PATH}`, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        "x-api-key": rawKey,
-        "x-sitekit-version": SITE_KIT_VERSION
-      },
-      cache: "no-store",
-      signal: typeof AbortSignal !== "undefined" && AbortSignal.timeout ? AbortSignal.timeout(MINT_TIMEOUT_MS) : void 0
-    });
-    if (res.ok) {
-      const data = await res.json().catch(() => null);
-      const token = data?.token;
-      const expiresIn = typeof data?.expiresIn === "number" ? data.expiresIn : 3600;
-      if (typeof token === "string" && token.startsWith(SITE_TOKEN_PREFIX)) {
-        cache.set(rawKey, {
-          credential: token,
-          expiresAt: now + Math.min(expiresIn * 1e3 / 2, 30 * 6e4)
-        });
-        return token;
-      }
-    } else if (res.status !== 404) {
-      console.warn(
-        `[SiteKitLayout] Token mint returned ${res.status}; injecting raw key for this render.`
-      );
-    }
-  } catch {
-    console.warn("[SiteKitLayout] Token mint unavailable; injecting raw key for this render.");
-  }
-  cache.set(rawKey, { credential: rawKey, expiresAt: now + 6e4 });
-  return rawKey;
-}
 async function SiteKitLayout({
   children,
   apiKey,

package/dist/layout/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/mint-site-token.ts","../../src/layout/SiteKitLayout.tsx"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAqBA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAM1B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAE1C,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,MAAA,IAAU,MAAA,CAAO,SAAA,GAAY,GAAA,SAAY,MAAA,CAAO,UAAA;AAEpD,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,GAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,MAC7C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,WAAA,EAAa,MAAA;AAAA,QACb,mBAAA,EAAqB;AAAA,OACvB;AAAA,MACA,KAAA,EAAO,UAAA;AAAA,MACP,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,KACP,CAAA;AAED,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,MAAM,IAAA,CAAK,GAAA,CAAK,YAAY,GAAA,GAAQ,CAAA,EAAG,KAAK,GAAM;AAAA,SAC9D,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AAAA,IACF,CAAA,MAAA,IAAW,GAAA,CAAI,MAAA,KAAW,GAAA,EAAK;AAG7B,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA,oCAAA;AAAA,OACnD;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAA,CAAQ,KAAK,4EAA4E,CAAA;AAAA,EAC3F;AAIA,EAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,EAAA,OAAO,MAAA;AACT;ACaA,eAAsB,aAAA,CAAc;AAAA,EAClC,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA,GAAY,IAAA;AAAA,EACZ,MAAA,GAAS,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EACT,WAAA,GAAc,IAAA;AAAA,EACd,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR,OAAA,GAAU,IAAA;AAAA,EACV,cAAA,GAAiB,IAAA;AAAA,EACjB,KAAA,GAAQ,KAAA;AAAA,EACR,qBAAA,GAAwB;AAC1B,CAAA,EAAuB;AAErB,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,EAAA;AACF,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,sBAAA;AAEF,EAAA,IAAI,CAAC,kBAAkB,KAAA,EAAO;AAC5B,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAY,iBAAiB,cAAc,CAAA;AAKjD,EAAA,MAAM,gBAAA,GAAmB,MAAM,uBAAA,CAAwB,cAAA,EAAgB,cAAc,CAAA;AAErF,EAAA,uBACE,IAAA,CAAA,QAAA,EAAA,EACE,QAAA,EAAA;AAAA,oBAAA,GAAA,CAAC,UAAK,GAAA,EAAI,YAAA,EAAa,IAAA,EAAM,SAAA,EAAW,aAAY,WAAA,EAAY,CAAA;AAAA,oBAChE,GAAA,CAAC,MAAA,EAAA,EAAK,GAAA,EAAI,cAAA,EAAe,MAAM,SAAA,EAAW,CAAA;AAAA,IAEzC,2BAAW,GAAA,CAAC,cAAA,EAAA,EAAe,MAAA,EAAQ,cAAA,EAAgB,QAAQ,cAAA,EAAgB,CAAA;AAAA,IAC3E,cAAA,oBAAkB,GAAA,CAAC,cAAA,EAAA,EAAe,QAAA,EAAS,MAAA,EAAO,CAAA;AAAA,oBAInD,IAAA;AAAA,MAAC,sBAAA;AAAA,MAAA;AAAA,QACC,MAAA,EAAQ,gBAAA;AAAA,QACR,MAAA,EAAQ,cAAA;AAAA,QACR,SAAA;AAAA,QACA,SAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,WAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QAEC,QAAA,EAAA;AAAA,UAAA,QAAA;AAAA,UACA,qBAAA,mBACC,GAAA,CAAC,QAAA,EAAA,EAAO,SAAA,EAAU,SAAA,EAAU,aAAA,EAAY,MAAA,EACtC,QAAA,kBAAA,GAAA,CAAC,GAAA,EAAA,EAAE,IAAA,EAAK,WAAA,EAAY,QAAA,EAAA,UAAA,EAAQ,GAC9B,CAAA,GACE;AAAA;AAAA;AAAA,KACN;AAAA,IAGC,cAAA,oBAAkB,GAAA,CAAC,cAAA,EAAA,EAAe,QAAA,EAAS,UAAA,EAAW;AAAA,GAAA,EACzD,CAAA;AAEJ","file":"index.mjs","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * Resilience: if minting is unavailable (older API without the endpoint, token\n * auth not configured, transient outage) it returns the RAW KEY, so a build never\n * breaks. Domain-binding is log-only by default, so the raw key still works —\n * worst case is exactly pre-3.2 behavior. Memoized per raw key for the process,\n * so an entire `next build` mints ~once and every static page reuses one seed\n * (the client refreshes on the far side as needed).\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const now = Date.now()\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > now) return cached.credential\n\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  try {\n    const res = await fetch(`${base}${MINT_PATH}`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-api-key': rawKey,\n        'x-sitekit-version': SITE_KIT_VERSION,\n      },\n      cache: 'no-store',\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n          : undefined,\n    })\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: now + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n    } else if (res.status !== 404) {\n      // 404 = older API without the endpoint (expected during rollout). Anything\n      // else is worth a server-side note. Never logs the key value.\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; injecting raw key for this render.`,\n      )\n    }\n  } catch {\n    console.warn('[SiteKitLayout] Token mint unavailable; injecting raw key for this render.')\n  }\n\n  // Fallback: the raw key (pre-3.2 behavior). Short cache so a transient outage\n  // retries soon rather than pinning the raw key for the whole build.\n  cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n  return rawKey\n}\n","/**\n * @sonordev/site-kit/layout — SiteKitLayout\n *\n * The master layout component. A single RSC that auto-composes every\n * site-kit feature your layout needs:\n *\n * Server-side (RSC):\n *   - ManagedFavicon (link tags from Portal logo)\n *   - ManagedScripts position=\"head\" (tracking pixels, analytics tags)\n *   - ManagedScripts position=\"body-end\"\n *\n * Client-side (island):\n *   - AnalyticsProvider (page views, scroll depth, heatmap, web vitals)\n *   - EngageWidget (popups, nudges, chat)\n *   - SignalBridge (A/B experiments, behavior tracking)\n *   - SitemapSync (keeps Portal seo_pages in sync)\n *\n * @example\n * ```tsx\n * // app/layout.tsx\n * import { SiteKitLayout } from '@sonordev/site-kit/layout'\n *\n * export default function RootLayout({ children }) {\n *   return (\n *     <html lang=\"en\">\n *       <body>\n *         <SiteKitLayout>\n *           <Header />\n *           <main>{children}</main>\n *           <Footer />\n *         </SiteKitLayout>\n *       </body>\n *     </html>\n *   )\n * }\n * ```\n *\n * @example Opt out of specific features:\n * ```tsx\n * <SiteKitLayout engage={false} signal={false}>\n *   {children}\n * </SiteKitLayout>\n * ```\n */\n\nimport * as React from 'react'\nimport { ManagedFavicon } from '../images/ManagedFavicon'\nimport { ManagedScripts } from '../seo/ManagedScripts'\nimport { resolveApiOrigin } from '../server/server-fetch'\nimport { resolveClientCredential } from '../server/mint-site-token'\nimport { SiteKitClientProviders } from './SiteKitClientProviders'\nimport type { AnalyticsConfig, EngageConfig, SignalConfig } from './types'\n\nexport interface SiteKitLayoutProps {\n  children: React.ReactNode\n\n  /** Portal API key. Defaults to SONOR_API_KEY env var. */\n  apiKey?: string\n  /** Portal API URL. Defaults to env or https://api.sonor.io */\n  apiUrl?: string\n  /** Project ID (for Engage chat room routing). Auto-resolved if not provided. */\n  projectId?: string\n\n  /** Analytics tracking. true (default) | false | config object */\n  analytics?: boolean | AnalyticsConfig\n  /** Engage widgets (popups, chat). true (default) | false | config object */\n  engage?: boolean | EngageConfig\n  /** Signal AI (experiments, behavior). false (default) | true | config object */\n  signal?: boolean | SignalConfig\n  /** SitemapSync client component. Default: true */\n  sitemapSync?: boolean\n  /**\n   * Fleet heartbeat — reports this site's kit version + active modules to Sonor\n   * once per session so the platform can track version drift. Default: true.\n   * Deferred like Analytics; never in the hydration path.\n   */\n  fleet?: boolean\n  /**\n   * Defer client modules (Analytics, Engage, SitemapSync) until window load +\n   * idle or the first user interaction, keeping their JS and mount work out of\n   * the critical hydration path. Default: true. Pass false to restore legacy\n   * eager mounting. SignalBridge is never deferred.\n   */\n  defer?: boolean\n  /** ManagedFavicon in <head>. Default: true */\n  favicon?: boolean\n  /** ManagedScripts (head + body-end). Default: true */\n  managedScripts?: boolean\n\n  /** Debug mode — logs to console. Default: false */\n  debug?: boolean\n  /**\n   * When true, append a screen-reader-only link to `/llms.txt` after main content.\n   * Default false — prefer `buildAiDiscoveryHeaders()` for discovery.\n   */\n  showLlmsTxtFooterLink?: boolean\n}\n\nexport async function SiteKitLayout({\n  children,\n  apiKey,\n  apiUrl,\n  projectId,\n  analytics = true,\n  engage = true,\n  signal = false,\n  sitemapSync = true,\n  fleet = true,\n  defer = true,\n  favicon = true,\n  managedScripts = true,\n  debug = false,\n  showLlmsTxtFooterLink = false,\n}: SiteKitLayoutProps) {\n  // Resolve API config from env (server-side, safe)\n  const resolvedApiKey =\n    apiKey ??\n    process.env.SONOR_API_KEY ??\n    ''\n  const resolvedApiUrl =\n    apiUrl ??\n    process.env.SONOR_API_URL ??\n    'https://api.sonor.io'\n\n  if (!resolvedApiKey && debug) {\n    console.warn(\n      '[SiteKitLayout] No API key found. Set SONOR_API_KEY.',\n    )\n  }\n\n  const apiOrigin = resolveApiOrigin(resolvedApiUrl)\n\n  // Mint a short-lived client token so the raw key never reaches the browser.\n  // Falls back to the raw key if minting is unavailable (older API / transient\n  // outage) — the build never breaks. The client refreshes the token as needed.\n  const clientCredential = await resolveClientCredential(resolvedApiKey, resolvedApiUrl)\n\n  return (\n    <>\n      <link rel=\"preconnect\" href={apiOrigin} crossOrigin=\"anonymous\" />\n      <link rel=\"dns-prefetch\" href={apiOrigin} />\n      {/* Server-rendered head components */}\n      {favicon && <ManagedFavicon apiKey={resolvedApiKey} apiUrl={resolvedApiUrl} />}\n      {managedScripts && <ManagedScripts position=\"head\" />}\n\n      {/* Client-side providers island — receives the minted token (or raw-key\n          fallback), never the raw key when minting succeeds. */}\n      <SiteKitClientProviders\n        apiKey={clientCredential}\n        apiUrl={resolvedApiUrl}\n        projectId={projectId}\n        analytics={analytics}\n        engage={engage}\n        signal={signal}\n        sitemapSync={sitemapSync}\n        fleet={fleet}\n        defer={defer}\n        debug={debug}\n      >\n        {children}\n        {showLlmsTxtFooterLink ? (\n          <footer className=\"sr-only\" aria-hidden=\"true\">\n            <a href=\"/llms.txt\">llms.txt</a>\n          </footer>\n        ) : null}\n      </SiteKitClientProviders>\n\n      {/* Server-rendered body-end scripts */}\n      {managedScripts && <ManagedScripts position=\"body-end\" />}\n    </>\n  )\n}\n"]}
+{"version":3,"sources":["../../src/layout/SiteKitLayout.tsx"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAkGA,eAAsB,aAAA,CAAc;AAAA,EAClC,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA,GAAY,IAAA;AAAA,EACZ,MAAA,GAAS,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EACT,WAAA,GAAc,IAAA;AAAA,EACd,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR,OAAA,GAAU,IAAA;AAAA,EACV,cAAA,GAAiB,IAAA;AAAA,EACjB,KAAA,GAAQ,KAAA;AAAA,EACR,qBAAA,GAAwB;AAC1B,CAAA,EAAuB;AAErB,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,EAAA;AACF,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,sBAAA;AAEF,EAAA,IAAI,CAAC,kBAAkB,KAAA,EAAO;AAC5B,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAY,iBAAiB,cAAc,CAAA;AAKjD,EAAA,MAAM,gBAAA,GAAmB,MAAM,uBAAA,CAAwB,cAAA,EAAgB,cAAc,CAAA;AAErF,EAAA,uBACE,IAAA,CAAA,QAAA,EAAA,EACE,QAAA,EAAA;AAAA,oBAAA,GAAA,CAAC,UAAK,GAAA,EAAI,YAAA,EAAa,IAAA,EAAM,SAAA,EAAW,aAAY,WAAA,EAAY,CAAA;AAAA,oBAChE,GAAA,CAAC,MAAA,EAAA,EAAK,GAAA,EAAI,cAAA,EAAe,MAAM,SAAA,EAAW,CAAA;AAAA,IAEzC,2BAAW,GAAA,CAAC,cAAA,EAAA,EAAe,MAAA,EAAQ,cAAA,EAAgB,QAAQ,cAAA,EAAgB,CAAA;AAAA,IAC3E,cAAA,oBAAkB,GAAA,CAAC,cAAA,EAAA,EAAe,QAAA,EAAS,MAAA,EAAO,CAAA;AAAA,oBAInD,IAAA;AAAA,MAAC,sBAAA;AAAA,MAAA;AAAA,QACC,MAAA,EAAQ,gBAAA;AAAA,QACR,MAAA,EAAQ,cAAA;AAAA,QACR,SAAA;AAAA,QACA,SAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,WAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QAEC,QAAA,EAAA;AAAA,UAAA,QAAA;AAAA,UACA,qBAAA,mBACC,GAAA,CAAC,QAAA,EAAA,EAAO,SAAA,EAAU,SAAA,EAAU,aAAA,EAAY,MAAA,EACtC,QAAA,kBAAA,GAAA,CAAC,GAAA,EAAA,EAAE,IAAA,EAAK,WAAA,EAAY,QAAA,EAAA,UAAA,EAAQ,GAC9B,CAAA,GACE;AAAA;AAAA;AAAA,KACN;AAAA,IAGC,cAAA,oBAAkB,GAAA,CAAC,cAAA,EAAA,EAAe,QAAA,EAAS,UAAA,EAAW;AAAA,GAAA,EACzD,CAAA;AAEJ","file":"index.mjs","sourcesContent":["/**\n * @sonordev/site-kit/layout — SiteKitLayout\n *\n * The master layout component. A single RSC that auto-composes every\n * site-kit feature your layout needs:\n *\n * Server-side (RSC):\n *   - ManagedFavicon (link tags from Portal logo)\n *   - ManagedScripts position=\"head\" (tracking pixels, analytics tags)\n *   - ManagedScripts position=\"body-end\"\n *\n * Client-side (island):\n *   - AnalyticsProvider (page views, scroll depth, heatmap, web vitals)\n *   - EngageWidget (popups, nudges, chat)\n *   - SignalBridge (A/B experiments, behavior tracking)\n *   - SitemapSync (keeps Portal seo_pages in sync)\n *\n * @example\n * ```tsx\n * // app/layout.tsx\n * import { SiteKitLayout } from '@sonordev/site-kit/layout'\n *\n * export default function RootLayout({ children }) {\n *   return (\n *     <html lang=\"en\">\n *       <body>\n *         <SiteKitLayout>\n *           <Header />\n *           <main>{children}</main>\n *           <Footer />\n *         </SiteKitLayout>\n *       </body>\n *     </html>\n *   )\n * }\n * ```\n *\n * @example Opt out of specific features:\n * ```tsx\n * <SiteKitLayout engage={false} signal={false}>\n *   {children}\n * </SiteKitLayout>\n * ```\n */\n\nimport * as React from 'react'\nimport { ManagedFavicon } from '../images/ManagedFavicon'\nimport { ManagedScripts } from '../seo/ManagedScripts'\nimport { resolveApiOrigin } from '../server/server-fetch'\nimport { resolveClientCredential } from '../server/mint-site-token'\nimport { SiteKitClientProviders } from './SiteKitClientProviders'\nimport type { AnalyticsConfig, EngageConfig, SignalConfig } from './types'\n\nexport interface SiteKitLayoutProps {\n  children: React.ReactNode\n\n  /** Portal API key. Defaults to SONOR_API_KEY env var. */\n  apiKey?: string\n  /** Portal API URL. Defaults to env or https://api.sonor.io */\n  apiUrl?: string\n  /** Project ID (for Engage chat room routing). Auto-resolved if not provided. */\n  projectId?: string\n\n  /** Analytics tracking. true (default) | false | config object */\n  analytics?: boolean | AnalyticsConfig\n  /** Engage widgets (popups, chat). true (default) | false | config object */\n  engage?: boolean | EngageConfig\n  /** Signal AI (experiments, behavior). false (default) | true | config object */\n  signal?: boolean | SignalConfig\n  /** SitemapSync client component. Default: true */\n  sitemapSync?: boolean\n  /**\n   * Fleet heartbeat — reports this site's kit version + active modules to Sonor\n   * once per session so the platform can track version drift. Default: true.\n   * Deferred like Analytics; never in the hydration path.\n   */\n  fleet?: boolean\n  /**\n   * Defer client modules (Analytics, Engage, SitemapSync) until window load +\n   * idle or the first user interaction, keeping their JS and mount work out of\n   * the critical hydration path. Default: true. Pass false to restore legacy\n   * eager mounting. SignalBridge is never deferred.\n   */\n  defer?: boolean\n  /** ManagedFavicon in <head>. Default: true */\n  favicon?: boolean\n  /** ManagedScripts (head + body-end). Default: true */\n  managedScripts?: boolean\n\n  /** Debug mode — logs to console. Default: false */\n  debug?: boolean\n  /**\n   * When true, append a screen-reader-only link to `/llms.txt` after main content.\n   * Default false — prefer `buildAiDiscoveryHeaders()` for discovery.\n   */\n  showLlmsTxtFooterLink?: boolean\n}\n\nexport async function SiteKitLayout({\n  children,\n  apiKey,\n  apiUrl,\n  projectId,\n  analytics = true,\n  engage = true,\n  signal = false,\n  sitemapSync = true,\n  fleet = true,\n  defer = true,\n  favicon = true,\n  managedScripts = true,\n  debug = false,\n  showLlmsTxtFooterLink = false,\n}: SiteKitLayoutProps) {\n  // Resolve API config from env (server-side, safe)\n  const resolvedApiKey =\n    apiKey ??\n    process.env.SONOR_API_KEY ??\n    ''\n  const resolvedApiUrl =\n    apiUrl ??\n    process.env.SONOR_API_URL ??\n    'https://api.sonor.io'\n\n  if (!resolvedApiKey && debug) {\n    console.warn(\n      '[SiteKitLayout] No API key found. Set SONOR_API_KEY.',\n    )\n  }\n\n  const apiOrigin = resolveApiOrigin(resolvedApiUrl)\n\n  // Mint a short-lived client token so the raw key never reaches the browser.\n  // Falls back to the raw key if minting is unavailable (older API / transient\n  // outage) — the build never breaks. The client refreshes the token as needed.\n  const clientCredential = await resolveClientCredential(resolvedApiKey, resolvedApiUrl)\n\n  return (\n    <>\n      <link rel=\"preconnect\" href={apiOrigin} crossOrigin=\"anonymous\" />\n      <link rel=\"dns-prefetch\" href={apiOrigin} />\n      {/* Server-rendered head components */}\n      {favicon && <ManagedFavicon apiKey={resolvedApiKey} apiUrl={resolvedApiUrl} />}\n      {managedScripts && <ManagedScripts position=\"head\" />}\n\n      {/* Client-side providers island — receives the minted token (or raw-key\n          fallback), never the raw key when minting succeeds. */}\n      <SiteKitClientProviders\n        apiKey={clientCredential}\n        apiUrl={resolvedApiUrl}\n        projectId={projectId}\n        analytics={analytics}\n        engage={engage}\n        signal={signal}\n        sitemapSync={sitemapSync}\n        fleet={fleet}\n        defer={defer}\n        debug={debug}\n      >\n        {children}\n        {showLlmsTxtFooterLink ? (\n          <footer className=\"sr-only\" aria-hidden=\"true\">\n            <a href=\"/llms.txt\">llms.txt</a>\n          </footer>\n        ) : null}\n      </SiteKitClientProviders>\n\n      {/* Server-rendered body-end scripts */}\n      {managedScripts && <ManagedScripts position=\"body-end\" />}\n    </>\n  )\n}\n"]}

package/dist/llms/index.js

@@ -1,7 +1,7 @@
 'use strict';
 
 var chunk5B4FABFK_js = require('../chunk-5B4FABFK.js');
-var chunk7TX5BKVA_js = require('../chunk-7TX5BKVA.js');
+var chunk6T4NVCAT_js = require('../chunk-6T4NVCAT.js');
 var chunkATG4FJY6_js = require('../chunk-ATG4FJY6.js');
 var chunkJ7QI3GDX_js = require('../chunk-J7QI3GDX.js');
 require('../chunk-ZSMWDLMK.js');
@@ -37,7 +37,7 @@ function createLLMsTxtHandler(options = {}) {
           });
         }
       }
-      const { markdown, metadata } = await chunk7TX5BKVA_js.generateLLMsTxt(generateOptions);
+      const { markdown, metadata } = await chunk6T4NVCAT_js.generateLLMsTxt(generateOptions);
       return new Response(markdown, {
         status: 200,
         headers: llmsResponseHeaders(markdown, {
@@ -71,7 +71,7 @@ function createLLMsFullTxtHandler(options = {}) {
           });
         }
       }
-      const { markdown, metadata } = await chunk7TX5BKVA_js.generateLLMsFullTxt(generateOptions);
+      const { markdown, metadata } = await chunk6T4NVCAT_js.generateLLMsFullTxt(generateOptions);
       return new Response(markdown, {
         status: 200,
         headers: llmsResponseHeaders(markdown, {
@@ -586,39 +586,39 @@ Object.defineProperty(exports, "buildAiDiscoveryHeaders", {
 });
 Object.defineProperty(exports, "generateLLMsFullTxt", {
   enumerable: true,
-  get: function () { return chunk7TX5BKVA_js.generateLLMsFullTxt; }
+  get: function () { return chunk6T4NVCAT_js.generateLLMsFullTxt; }
 });
 Object.defineProperty(exports, "generateLLMsTxt", {
   enumerable: true,
-  get: function () { return chunk7TX5BKVA_js.generateLLMsTxt; }
+  get: function () { return chunk6T4NVCAT_js.generateLLMsTxt; }
 });
 Object.defineProperty(exports, "getBusinessInfo", {
   enumerable: true,
-  get: function () { return chunk7TX5BKVA_js.getBusinessInfo; }
+  get: function () { return chunk6T4NVCAT_js.getBusinessInfo; }
 });
 Object.defineProperty(exports, "getFAQItems", {
   enumerable: true,
-  get: function () { return chunk7TX5BKVA_js.getFAQItems; }
+  get: function () { return chunk6T4NVCAT_js.getFAQItems; }
 });
 Object.defineProperty(exports, "getLLMsData", {
   enumerable: true,
-  get: function () { return chunk7TX5BKVA_js.getLLMsData; }
+  get: function () { return chunk6T4NVCAT_js.getLLMsData; }
 });
 Object.defineProperty(exports, "getOptimizedLLMsTxt", {
   enumerable: true,
-  get: function () { return chunk7TX5BKVA_js.getOptimizedLLMsTxt; }
+  get: function () { return chunk6T4NVCAT_js.getOptimizedLLMsTxt; }
 });
 Object.defineProperty(exports, "getPageSummaries", {
   enumerable: true,
-  get: function () { return chunk7TX5BKVA_js.getPageSummaries; }
+  get: function () { return chunk6T4NVCAT_js.getPageSummaries; }
 });
 Object.defineProperty(exports, "getServices", {
   enumerable: true,
-  get: function () { return chunk7TX5BKVA_js.getServices; }
+  get: function () { return chunk6T4NVCAT_js.getServices; }
 });
 Object.defineProperty(exports, "writeLLMsTxtToPublic", {
   enumerable: true,
-  get: function () { return chunk7TX5BKVA_js.writeLLMsTxtToPublic; }
+  get: function () { return chunk6T4NVCAT_js.writeLLMsTxtToPublic; }
 });
 Object.defineProperty(exports, "LLMS_DISCLAIMER_MAX_LENGTH", {
   enumerable: true,

package/dist/llms/index.mjs

@@ -1,6 +1,6 @@
 export { buildAiDiscoveryHeaders } from '../chunk-H4OBGC43.mjs';
-import { generateLLMsTxt, generateLLMsFullTxt } from '../chunk-WN5A3KSY.mjs';
-export { generateLLMsFullTxt, generateLLMsTxt, getBusinessInfo, getFAQItems, getLLMsData, getOptimizedLLMsTxt, getPageSummaries, getServices, writeLLMsTxtToPublic } from '../chunk-WN5A3KSY.mjs';
+import { generateLLMsTxt, generateLLMsFullTxt } from '../chunk-34IUDOBC.mjs';
+export { generateLLMsFullTxt, generateLLMsTxt, getBusinessInfo, getFAQItems, getLLMsData, getOptimizedLLMsTxt, getPageSummaries, getServices, writeLLMsTxtToPublic } from '../chunk-34IUDOBC.mjs';
 export { LLMS_DISCLAIMER_MAX_LENGTH, LLMS_PUBLIC_SUMMARY_MAX_LENGTH, LLM_GEO_CONTRACT_VERSION, MANAGED_LLM_SCHEMA_KNOWN_KEYS, pickManagedLlmSchemaForJsonLd, sanitizeLlmsDisclaimerLine, sanitizeLlmsPublicSummary, sanitizePrimaryLanguageTag } from '../chunk-H23ZT2I2.mjs';
 import { safeJsonLd } from '../chunk-662YHKWW.mjs';
 import '../chunk-4XPGGLVP.mjs';

package/dist/maps/index.js

@@ -1,8 +1,9 @@
 'use client';
 'use strict';
 
-var chunkKPKZBIAQ_js = require('../chunk-KPKZBIAQ.js');
-require('../chunk-3X2YPJU5.js');
+var chunkXY4NJJEX_js = require('../chunk-XY4NJJEX.js');
+require('../chunk-UXEB6UAR.js');
+require('../chunk-NME3SQCB.js');
 require('../chunk-ZSMWDLMK.js');
 var react = require('react');
 var reactGoogleMaps = require('@vis.gl/react-google-maps');
@@ -139,7 +140,7 @@ async function fetchMapsConfig() {
   const { apiUrl, apiKey } = getApiConfig();
   if (apiKey) {
     try {
-      const res = await chunkKPKZBIAQ_js.sonorFetch(
+      const res = await chunkXY4NJJEX_js.sonorFetch(
         `${apiUrl}/api/public/maps/config`,
         { headers: { "Content-Type": "application/json" } },
         { apiKey }
@@ -179,7 +180,7 @@ async function fetchNearbyPlaces(params) {
     });
     if (params.radius) searchParams.set("radius", String(params.radius));
     if (params.limit) searchParams.set("limit", String(params.limit));
-    const res = await chunkKPKZBIAQ_js.sonorFetch(
+    const res = await chunkXY4NJJEX_js.sonorFetch(
       `${apiUrl}/api/public/maps/nearby-places?${searchParams}`,
       { headers: { "Content-Type": "application/json" } },
       { apiKey }