@sonordev/site-kit 3.4.0 → 3.6.0

package/dist/chunk-T3LOHTC6.js

@@ -0,0 +1,136 @@
+'use strict';
+
+var chunkK24NKI35_js = require('./chunk-K24NKI35.js');
+require('server-only');
+
+var MINT_PATH = "/api/public/site-token";
+var MINT_TIMEOUT_MS = 4e3;
+var SITE_TOKEN_PREFIX = "st1.";
+var MINT_MAX_ATTEMPTS = 4;
+var MINT_BACKOFF_BASE_MS = 500;
+var MINT_BACKOFF_CAP_MS = 8e3;
+var cache = /* @__PURE__ */ new Map();
+var inflight = /* @__PURE__ */ new Map();
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function retryDelayMs(res, attempt) {
+  const header = res?.headers?.get?.("retry-after");
+  if (header) {
+    const seconds = Number(header);
+    const ms = Number.isFinite(seconds) ? seconds * 1e3 : Date.parse(header) - Date.now();
+    if (Number.isFinite(ms) && ms > 0) return Math.min(ms, MINT_BACKOFF_CAP_MS);
+  }
+  return Math.min(MINT_BACKOFF_BASE_MS * 2 ** attempt, MINT_BACKOFF_CAP_MS);
+}
+var isRetryableStatus = (status) => status === 429 || status >= 500;
+function rawFallbackAllowed() {
+  return typeof process !== "undefined" && process.env?.SONOR_SITE_TOKEN_FALLBACK === "raw";
+}
+function failClosed(reason, rawKey, now) {
+  if (rawFallbackAllowed()) {
+    console.warn(
+      `[SiteKitLayout] Token mint failed (${reason}) and SONOR_SITE_TOKEN_FALLBACK=raw is set; injecting the RAW API KEY into page HTML. The key is publicly readable wherever this page is served \u2014 unset the escape hatch once the mint is healthy.`
+    );
+    cache.set(rawKey, { credential: rawKey, expiresAt: now + 6e4 });
+    return rawKey;
+  }
+  throw new Error(
+    `site-kit: could not mint a site token (${reason}). Refusing to publish the raw SONOR_API_KEY in page HTML, so this build fails instead. Check that the mint endpoint is reachable and the key is valid, then rebuild. To ship anyway \u2014 which publishes the project secret in public HTML \u2014 set SONOR_SITE_TOKEN_FALLBACK=raw.`
+  );
+}
+function resolveFetch() {
+  const current = globalThis.fetch;
+  if (!current) throw new Error("site-kit: global fetch is unavailable");
+  const original = current._nextOriginalFetch;
+  if (typeof original === "function") return { fn: original, unpatched: true };
+  return { fn: current, unpatched: false };
+}
+function isFrameworkSignal(err) {
+  if (!err || typeof err !== "object") return false;
+  const e = err;
+  if (e.digest === "DYNAMIC_SERVER_USAGE") return true;
+  if (e.code === "NEXT_STATIC_GEN_BAILOUT") return true;
+  if (typeof e.digest === "string" && e.digest.startsWith("NEXT_")) return true;
+  if (e.$$typeof === /* @__PURE__ */ Symbol.for("react.postpone")) return true;
+  return false;
+}
+async function resolveClientCredential(rawKey, apiUrl) {
+  if (!rawKey) return "";
+  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey;
+  const cached = cache.get(rawKey);
+  if (cached && cached.expiresAt > Date.now()) return cached.credential;
+  const pending = inflight.get(rawKey);
+  if (pending) return pending;
+  const request = mintWithRetry(rawKey, apiUrl);
+  inflight.set(rawKey, request);
+  try {
+    return await request;
+  } finally {
+    inflight.delete(rawKey);
+  }
+}
+async function mintWithRetry(rawKey, apiUrl) {
+  const base = (apiUrl || "https://api.sonor.io").replace(/\/+$/, "");
+  let lastReason = "unknown error";
+  for (let attempt = 0; attempt < MINT_MAX_ATTEMPTS; attempt++) {
+    let res = null;
+    try {
+      const { fn: fetchFn, unpatched } = resolveFetch();
+      res = await fetchFn(`${base}${MINT_PATH}`, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          "x-api-key": rawKey,
+          "x-sitekit-version": chunkK24NKI35_js.SITE_KIT_VERSION
+        },
+        // Only meaningful on the fallback path, where a future Next stopped
+        // exposing `_nextOriginalFetch` and we're back on the patched fetch.
+        // `revalidate: false` is the one setting that neither bails out of static
+        // generation nor downgrades the route to ISR; a Data Cache entry is the
+        // lesser evil versus shipping the raw key again.
+        ...unpatched ? {} : { next: { revalidate: false } },
+        signal: typeof AbortSignal !== "undefined" && AbortSignal.timeout ? AbortSignal.timeout(MINT_TIMEOUT_MS) : void 0
+      });
+    } catch (err) {
+      if (isFrameworkSignal(err)) throw err;
+      lastReason = err instanceof Error ? err.message : "network error";
+      if (attempt < MINT_MAX_ATTEMPTS - 1) {
+        await sleep(retryDelayMs(null, attempt));
+        continue;
+      }
+      break;
+    }
+    if (res.ok) {
+      const data = await res.json().catch(() => null);
+      const token = data?.token;
+      const expiresIn = typeof data?.expiresIn === "number" ? data.expiresIn : 3600;
+      if (typeof token === "string" && token.startsWith(SITE_TOKEN_PREFIX)) {
+        cache.set(rawKey, {
+          credential: token,
+          expiresAt: Date.now() + Math.min(expiresIn * 1e3 / 2, 30 * 6e4)
+        });
+        return token;
+      }
+      lastReason = "mint returned no usable token";
+      break;
+    }
+    if (res.status === 404) {
+      cache.set(rawKey, { credential: rawKey, expiresAt: Date.now() + 6e4 });
+      return rawKey;
+    }
+    lastReason = `HTTP ${res.status}`;
+    if (isRetryableStatus(res.status) && attempt < MINT_MAX_ATTEMPTS - 1) {
+      const delay = retryDelayMs(res, attempt);
+      console.warn(
+        `[SiteKitLayout] Token mint returned ${res.status}; retrying in ${Math.round(delay)}ms (attempt ${attempt + 2}/${MINT_MAX_ATTEMPTS}).`
+      );
+      await sleep(delay);
+      continue;
+    }
+    break;
+  }
+  return failClosed(lastReason, rawKey, Date.now());
+}
+
+exports.resolveClientCredential = resolveClientCredential;
+//# sourceMappingURL=chunk-T3LOHTC6.js.map
+//# sourceMappingURL=chunk-T3LOHTC6.js.map

package/dist/chunk-T3LOHTC6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/mint-site-token.ts"],"names":["SITE_KIT_VERSION"],"mappings":";;;;;AA4CA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAO1B,IAAM,iBAAA,GAAoB,CAAA;AAC1B,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,mBAAA,GAAsB,GAAA;AAM5B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAO1C,IAAM,QAAA,uBAAe,GAAA,EAA6B;AAElD,IAAM,KAAA,GAAQ,CAAC,EAAA,KAAe,IAAI,OAAA,CAAc,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAOxE,SAAS,YAAA,CAAa,KAAsB,OAAA,EAAyB;AACnE,EAAA,MAAM,MAAA,GAAS,GAAA,EAAK,OAAA,EAAS,GAAA,GAAM,aAAa,CAAA;AAChD,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,OAAA,GAAU,OAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GAC9B,OAAA,GAAU,GAAA,GACV,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,GAAI,IAAA,CAAK,GAAA,EAAI;AAClC,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,EAAE,CAAA,IAAK,EAAA,GAAK,GAAG,OAAO,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,mBAAmB,CAAA;AAAA,EAC5E;AACA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,oBAAA,GAAuB,CAAA,IAAK,SAAS,mBAAmB,CAAA;AAC1E;AAGA,IAAM,iBAAA,GAAoB,CAAC,MAAA,KAAmB,MAAA,KAAW,OAAO,MAAA,IAAU,GAAA;AAM1E,SAAS,kBAAA,GAA8B;AACrC,EAAA,OACE,OAAO,OAAA,KAAY,WAAA,IACnB,OAAA,CAAQ,KAAK,yBAAA,KAA8B,KAAA;AAE/C;AAEA,SAAS,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAgB,GAAA,EAAqB;AACvE,EAAA,IAAI,oBAAmB,EAAG;AACxB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,sCAAsC,MAAM,CAAA,uMAAA;AAAA,KAG9C;AACA,IAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,0CAA0C,MAAM,CAAA,uRAAA;AAAA,GAIlD;AACF;AA8BO,SAAS,YAAA,GAAsD;AACpE,EAAA,MAAM,UAAU,UAAA,CAAW,KAAA;AAG3B,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,uCAAuC,CAAA;AACrE,EAAA,MAAM,WAAW,OAAA,CAAQ,kBAAA;AACzB,EAAA,IAAI,OAAO,aAAa,UAAA,EAAY,OAAO,EAAE,EAAA,EAAI,QAAA,EAAU,WAAW,IAAA,EAAK;AAC3E,EAAA,OAAO,EAAE,EAAA,EAAI,OAAA,EAAS,SAAA,EAAW,KAAA,EAAM;AACzC;AAYO,SAAS,kBAAkB,GAAA,EAAuB;AACvD,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AAC5C,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,sBAAA,EAAwB,OAAO,IAAA;AAChD,EAAA,IAAI,CAAA,CAAE,IAAA,KAAS,yBAAA,EAA2B,OAAO,IAAA;AACjD,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,EAAE,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,EAAG,OAAO,IAAA;AACzE,EAAA,IAAI,EAAE,QAAA,qBAAa,MAAA,CAAO,GAAA,CAAI,gBAAgB,GAAG,OAAO,IAAA;AACxD,EAAA,OAAO,KAAA;AACT;AAEA,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,UAAU,MAAA,CAAO,SAAA,GAAY,KAAK,GAAA,EAAI,SAAU,MAAA,CAAO,UAAA;AAG3D,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,SAAS,OAAO,OAAA;AAEpB,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AAC5C,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,OAAO,CAAA;AAC5B,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAA;AAAA,EACf,CAAA,SAAE;AACA,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,EACxB;AACF;AAEA,eAAe,aAAA,CAAc,QAAgB,MAAA,EAAiC;AAC5E,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI,UAAA,GAAa,eAAA;AAEjB,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,iBAAA,EAAmB,OAAA,EAAA,EAAW;AAC5D,IAAA,IAAI,GAAA,GAAuB,IAAA;AAC3B,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,EAAA,EAAI,OAAA,EAAS,SAAA,KAAc,YAAA,EAAa;AAChD,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,QACzC,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,WAAA,EAAa,MAAA;AAAA,UACb,mBAAA,EAAqBA;AAAA,SACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMA,GAAI,YAAY,EAAC,GAAK,EAAE,IAAA,EAAM,EAAE,UAAA,EAAY,KAAA,EAAM,EAAE;AAAA,QACpD,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,OACP,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAI,iBAAA,CAAkB,GAAG,CAAA,EAAG,MAAM,GAAA;AAClC,MAAA,UAAA,GAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,eAAA;AAClD,MAAA,IAAI,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACnC,QAAA,MAAM,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AACvC,QAAA;AAAA,MACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,IAAK,SAAA,GAAY,GAAA,GAAQ,CAAA,EAAG,EAAA,GAAK,GAAM;AAAA,SACrE,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,UAAA,GAAa,+BAAA;AACb,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,MAAA,KAAA,CAAM,GAAA,CAAI,MAAA,EAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,WAAW,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,EAAQ,CAAA;AACxE,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,UAAA,GAAa,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAC/B,IAAA,IAAI,kBAAkB,GAAA,CAAI,MAAM,CAAA,IAAK,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACpE,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,EAAK,OAAO,CAAA;AACvC,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,GAAA,CAAI,MAAM,CAAA,cAAA,EAAiB,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA,YAAA,EACrE,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,iBAAiB,CAAA,EAAA;AAAA,OAChD;AACA,MAAA,MAAM,MAAM,KAAK,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA;AAAA,EACF;AAEA,EAAA,OAAO,UAAA,CAAW,UAAA,EAAY,MAAA,EAAQ,IAAA,CAAK,KAAK,CAAA;AAClD","file":"chunk-T3LOHTC6.js","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * FAILS CLOSED. If minting genuinely fails, this throws and the build fails —\n * it does NOT publish the raw key. A failed deploy is loud and recoverable; a\n * leaked project secret in public HTML is neither. The only paths that still\n * return the raw key are a 404 (an older API that predates the endpoint, an\n * expected state during rollout) and the explicit `SONOR_SITE_TOKEN_FALLBACK=raw`\n * escape hatch, for when shipping beats being blocked.\n *\n * That posture is not academic. Through 3.5.0 a throttled mint (HTTP 429)\n * returned the raw key AND cached it for 60s, so every page rendered in that\n * window shipped the secret: one real build came out with 180 of 272 prerendered\n * pages carrying it. The build \"succeeded\" and nothing downstream noticed.\n * Rate limiting is transient by definition — the fix is to wait and retry, not\n * to downgrade to publishing the key.\n *\n * Two things keep the request count low enough that throttling is rare:\n *  - a module-level memo, so a worker mints once and every page reuses the seed;\n *  - an in-flight map, because that memo is only populated AFTER the await. Next\n *    renders pages concurrently, so without coalescing the first N concurrent\n *    renders in a process all miss the cache and all fire a request — a\n *    stampede per worker, multiplied by one worker per core. That is how a\n *    single site exhausted a 60/min budget.\n *\n * SEED FRESHNESS: a static page's seed carries `iat` = build time, and the API\n * refuses to refresh a seed older than SITE_TOKEN_MAX_REFRESH_AGE_SECONDS\n * (sonor-api common/site-auth/site-token.util.ts — currently 400 days, raised\n * from 30 alongside this fix). A site not rebuilt within that window serves a\n * seed the client cannot refresh, and its forms/analytics/engage start failing\n * for new visitors. Keep that limit comfortably longer than the fleet's\n * realistic redeploy gap; marketing sites routinely go many months untouched.\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\n/**\n * Retry budget for transient failures (429 / 5xx / network). Rate limiting is\n * measured per minute, so a few seconds of backoff clears it; the whole ladder\n * costs at most ~20s once per build worker, and only when something is wrong.\n */\nconst MINT_MAX_ATTEMPTS = 4\nconst MINT_BACKOFF_BASE_MS = 500\nconst MINT_BACKOFF_CAP_MS = 8_000\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\n/**\n * Requests already in flight, keyed by raw key. The `cache` above is only\n * written after the response lands, so concurrent renders would otherwise each\n * start their own mint. See the module header.\n */\nconst inflight = new Map<string, Promise<string>>()\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\n/**\n * Honour `Retry-After` when the server sends it (delta-seconds or HTTP date),\n * otherwise exponential backoff. Capped so a misconfigured server cannot stall\n * a build indefinitely.\n */\nfunction retryDelayMs(res: Response | null, attempt: number): number {\n  const header = res?.headers?.get?.('retry-after')\n  if (header) {\n    const seconds = Number(header)\n    const ms = Number.isFinite(seconds)\n      ? seconds * 1000\n      : Date.parse(header) - Date.now()\n    if (Number.isFinite(ms) && ms > 0) return Math.min(ms, MINT_BACKOFF_CAP_MS)\n  }\n  return Math.min(MINT_BACKOFF_BASE_MS * 2 ** attempt, MINT_BACKOFF_CAP_MS)\n}\n\n/** 429 and 5xx are transient; waiting is the correct response to both. */\nconst isRetryableStatus = (status: number) => status === 429 || status >= 500\n\n/**\n * The escape hatch, for when a broken mint must not block a release. Opt-in and\n * loud: it re-enables publishing the project secret in page HTML.\n */\nfunction rawFallbackAllowed(): boolean {\n  return (\n    typeof process !== 'undefined' &&\n    process.env?.SONOR_SITE_TOKEN_FALLBACK === 'raw'\n  )\n}\n\nfunction failClosed(reason: string, rawKey: string, now: number): string {\n  if (rawFallbackAllowed()) {\n    console.warn(\n      `[SiteKitLayout] Token mint failed (${reason}) and SONOR_SITE_TOKEN_FALLBACK=raw is set; ` +\n        'injecting the RAW API KEY into page HTML. The key is publicly readable wherever ' +\n        'this page is served — unset the escape hatch once the mint is healthy.',\n    )\n    cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n    return rawKey\n  }\n  throw new Error(\n    `site-kit: could not mint a site token (${reason}). Refusing to publish the raw ` +\n      'SONOR_API_KEY in page HTML, so this build fails instead. Check that the mint ' +\n      'endpoint is reachable and the key is valid, then rebuild. To ship anyway — ' +\n      'which publishes the project secret in public HTML — set SONOR_SITE_TOKEN_FALLBACK=raw.',\n  )\n}\n\ntype FetchLike = typeof fetch\n\n/**\n * Next.js monkey-patches `globalThis.fetch` so every call participates in its\n * Data Cache and static-generation tracking. This mint must NOT participate.\n *\n * `cache: 'no-store'` marks the calling scope dynamic, so during `next build`\n * Next throws DynamicServerError *before the request goes out*. On a statically\n * prerendered route the mint therefore never ran at all — the catch below\n * swallowed the bailout and every page shipped the raw key. (Verified against\n * Next 16.2.9: the mint endpoint received zero requests for a static build.)\n *\n * The two obvious repairs are both wrong:\n *   - `next: { revalidate: N }` LOWERS the route's revalidate window\n *     (patch-fetch.js: `finalRevalidate < revalidateStore.revalidate`), quietly\n *     converting fully-static pages into ISR across the whole fleet.\n *   - `next: { revalidate: false }` keeps pages static but writes the token into\n *     the Data Cache, which hosts persist across builds — a fresh deploy could\n *     re-bake a months-old seed, which is the exact failure we're removing.\n *\n * A credential mint is not page data and has no business in the page data cache.\n * So we call the original fetch Next saves on the patched one and stay invisible\n * to the framework: no bailout, no cache entry, no effect on staticness. The\n * module-level memo above is the only cache we want — one mint per build\n * process, and a build-fresh seed on every deploy.\n *\n * @internal Exported for unit tests; not part of the package's public API.\n */\nexport function resolveFetch(): { fn: FetchLike; unpatched: boolean } {\n  const current = globalThis.fetch as\n    | (FetchLike & { _nextOriginalFetch?: FetchLike })\n    | undefined\n  if (!current) throw new Error('site-kit: global fetch is unavailable')\n  const original = current._nextOriginalFetch\n  if (typeof original === 'function') return { fn: original, unpatched: true }\n  return { fn: current, unpatched: false }\n}\n\n/**\n * Next signals \"this render must go dynamic\" by THROWING (DynamicServerError,\n * static-gen bailout, redirect/notFound digests, React's postpone). Those are\n * the framework's control flow, not a mint failure. Swallowing one makes Next\n * believe the render succeeded statically — which is precisely how the raw key\n * ended up stranded in prerendered HTML with no error anywhere. Let them\n * propagate; only real network/HTTP failures fall back to the raw key.\n *\n * @internal Exported for unit tests; not part of the package's public API.\n */\nexport function isFrameworkSignal(err: unknown): boolean {\n  if (!err || typeof err !== 'object') return false\n  const e = err as { digest?: unknown; code?: unknown; $$typeof?: unknown }\n  if (e.digest === 'DYNAMIC_SERVER_USAGE') return true\n  if (e.code === 'NEXT_STATIC_GEN_BAILOUT') return true\n  if (typeof e.digest === 'string' && e.digest.startsWith('NEXT_')) return true\n  if (e.$$typeof === Symbol.for('react.postpone')) return true\n  return false\n}\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > Date.now()) return cached.credential\n\n  // Collapse concurrent renders onto one request rather than a stampede.\n  const pending = inflight.get(rawKey)\n  if (pending) return pending\n\n  const request = mintWithRetry(rawKey, apiUrl)\n  inflight.set(rawKey, request)\n  try {\n    return await request\n  } finally {\n    inflight.delete(rawKey)\n  }\n}\n\nasync function mintWithRetry(rawKey: string, apiUrl: string): Promise<string> {\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  let lastReason = 'unknown error'\n\n  for (let attempt = 0; attempt < MINT_MAX_ATTEMPTS; attempt++) {\n    let res: Response | null = null\n    try {\n      const { fn: fetchFn, unpatched } = resolveFetch()\n      res = await fetchFn(`${base}${MINT_PATH}`, {\n        method: 'POST',\n        headers: {\n          'content-type': 'application/json',\n          'x-api-key': rawKey,\n          'x-sitekit-version': SITE_KIT_VERSION,\n        },\n        // Only meaningful on the fallback path, where a future Next stopped\n        // exposing `_nextOriginalFetch` and we're back on the patched fetch.\n        // `revalidate: false` is the one setting that neither bails out of static\n        // generation nor downgrades the route to ISR; a Data Cache entry is the\n        // lesser evil versus shipping the raw key again.\n        ...(unpatched ? {} : ({ next: { revalidate: false } } as RequestInit)),\n        signal:\n          typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n            ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n            : undefined,\n      })\n    } catch (err) {\n      // Never swallow the framework's own control flow — see isFrameworkSignal.\n      if (isFrameworkSignal(err)) throw err\n      lastReason = err instanceof Error ? err.message : 'network error'\n      if (attempt < MINT_MAX_ATTEMPTS - 1) {\n        await sleep(retryDelayMs(null, attempt))\n        continue\n      }\n      break\n    }\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: Date.now() + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n      lastReason = 'mint returned no usable token'\n      break\n    }\n\n    // 404 = an API older than the endpoint. Expected during rollout, and the raw\n    // key is exactly what such an API still expects, so this stays a fallback\n    // rather than a build failure.\n    if (res.status === 404) {\n      cache.set(rawKey, { credential: rawKey, expiresAt: Date.now() + 60_000 })\n      return rawKey\n    }\n\n    lastReason = `HTTP ${res.status}`\n    if (isRetryableStatus(res.status) && attempt < MINT_MAX_ATTEMPTS - 1) {\n      const delay = retryDelayMs(res, attempt)\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; retrying in ${Math.round(delay)}ms ` +\n          `(attempt ${attempt + 2}/${MINT_MAX_ATTEMPTS}).`,\n      )\n      await sleep(delay)\n      continue\n    }\n    break\n  }\n\n  return failClosed(lastReason, rawKey, Date.now())\n}\n"]}

package/dist/chunk-TPL2IHFI.js

@@ -0,0 +1,43 @@
+'use strict';
+
+// src/blog/author-schema.ts
+function generateAuthorSchema(author, options = {}) {
+  const { siteUrl = "", siteName } = options;
+  const sameAs = [...author.same_as || []];
+  if (author.linkedin_url) sameAs.push(author.linkedin_url);
+  if (author.twitter_url) sameAs.push(author.twitter_url);
+  if (author.website_url) sameAs.push(author.website_url);
+  if (author.social_links?.twitter) sameAs.push(`https://twitter.com/${author.social_links.twitter}`);
+  if (author.social_links?.linkedin) sameAs.push(author.social_links.linkedin);
+  if (author.social_links?.github) sameAs.push(`https://github.com/${author.social_links.github}`);
+  const uniqueSameAs = [...new Set(sameAs.filter(Boolean))];
+  const schema = {
+    "@context": "https://schema.org",
+    "@type": "Person",
+    name: author.name,
+    url: author.author_page_url || `${siteUrl}/blog/author/${author.slug}`
+  };
+  if (author.title) schema.jobTitle = author.title;
+  if (author.company || siteName) {
+    schema.worksFor = {
+      "@type": "Organization",
+      name: author.company || siteName,
+      ...siteUrl ? { url: siteUrl } : {}
+    };
+  }
+  if (author.bio || author.short_bio) schema.description = author.short_bio || author.bio;
+  if (author.avatar_url) schema.image = author.avatar_url;
+  if (uniqueSameAs.length > 0) schema.sameAs = uniqueSameAs;
+  if (author.knows_about && author.knows_about.length > 0) schema.knowsAbout = author.knows_about;
+  if (author.credentials && author.credentials.length > 0) {
+    schema.hasCredential = author.credentials.map((c) => ({
+      "@type": "EducationalOccupationalCredential",
+      credentialCategory: c
+    }));
+  }
+  return schema;
+}
+
+exports.generateAuthorSchema = generateAuthorSchema;
+//# sourceMappingURL=chunk-TPL2IHFI.js.map
+//# sourceMappingURL=chunk-TPL2IHFI.js.map

package/dist/chunk-TPL2IHFI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/blog/author-schema.ts"],"names":[],"mappings":";;;AAuBO,SAAS,oBAAA,CACd,MAAA,EACA,OAAA,GAAmD,EAAC,EAC5C;AACR,EAAA,MAAM,EAAE,OAAA,GAAU,EAAA,EAAI,QAAA,EAAS,GAAI,OAAA;AAEnC,EAAA,MAAM,SAAmB,CAAC,GAAI,MAAA,CAAO,OAAA,IAAW,EAAG,CAAA;AACnD,EAAA,IAAI,MAAA,CAAO,YAAA,EAAc,MAAA,CAAO,IAAA,CAAK,OAAO,YAAY,CAAA;AACxD,EAAA,IAAI,MAAA,CAAO,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,OAAO,WAAW,CAAA;AACtD,EAAA,IAAI,MAAA,CAAO,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,OAAO,WAAW,CAAA;AACtD,EAAA,IAAI,MAAA,CAAO,cAAc,OAAA,EAAS,MAAA,CAAO,KAAK,CAAA,oBAAA,EAAuB,MAAA,CAAO,YAAA,CAAa,OAAO,CAAA,CAAE,CAAA;AAClG,EAAA,IAAI,OAAO,YAAA,EAAc,QAAA,SAAiB,IAAA,CAAK,MAAA,CAAO,aAAa,QAAQ,CAAA;AAC3E,EAAA,IAAI,MAAA,CAAO,cAAc,MAAA,EAAQ,MAAA,CAAO,KAAK,CAAA,mBAAA,EAAsB,MAAA,CAAO,YAAA,CAAa,MAAM,CAAA,CAAE,CAAA;AAG/F,EAAA,MAAM,YAAA,GAAe,CAAC,GAAG,IAAI,IAAI,MAAA,CAAO,MAAA,CAAO,OAAO,CAAC,CAAC,CAAA;AAExD,EAAA,MAAM,MAAA,GAA8B;AAAA,IAClC,UAAA,EAAY,oBAAA;AAAA,IACZ,OAAA,EAAS,QAAA;AAAA,IACT,MAAM,MAAA,CAAO,IAAA;AAAA,IACb,KAAK,MAAA,CAAO,eAAA,IAAmB,GAAG,OAAO,CAAA,aAAA,EAAgB,OAAO,IAAI,CAAA;AAAA,GACtE;AAEA,EAAA,IAAI,MAAA,CAAO,KAAA,EAAO,MAAA,CAAO,QAAA,GAAW,MAAA,CAAO,KAAA;AAC3C,EAAA,IAAI,MAAA,CAAO,WAAW,QAAA,EAAU;AAC9B,IAAA,MAAA,CAAO,QAAA,GAAW;AAAA,MAChB,OAAA,EAAS,cAAA;AAAA,MACT,IAAA,EAAM,OAAO,OAAA,IAAW,QAAA;AAAA,MACxB,GAAI,OAAA,GAAU,EAAE,GAAA,EAAK,OAAA,KAAY;AAAC,KACpC;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,OAAO,MAAA,CAAO,SAAA,SAAkB,WAAA,GAAc,MAAA,CAAO,aAAa,MAAA,CAAO,GAAA;AACpF,EAAA,IAAI,MAAA,CAAO,UAAA,EAAY,MAAA,CAAO,KAAA,GAAQ,MAAA,CAAO,UAAA;AAC7C,EAAA,IAAI,YAAA,CAAa,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,MAAA,GAAS,YAAA;AAC7C,EAAA,IAAI,MAAA,CAAO,eAAe,MAAA,CAAO,WAAA,CAAY,SAAS,CAAA,EAAG,MAAA,CAAO,aAAa,MAAA,CAAO,WAAA;AACpF,EAAA,IAAI,MAAA,CAAO,WAAA,IAAe,MAAA,CAAO,WAAA,CAAY,SAAS,CAAA,EAAG;AACvD,IAAA,MAAA,CAAO,aAAA,GAAgB,MAAA,CAAO,WAAA,CAAY,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,MACpD,OAAA,EAAS,mCAAA;AAAA,MACT,kBAAA,EAAoB;AAAA,KACtB,CAAE,CAAA;AAAA,EACJ;AAEA,EAAA,OAAO,MAAA;AACT","file":"chunk-TPL2IHFI.js","sourcesContent":["/**\n * @sonordev/site-kit/blog — Author JSON-LD (pure)\n *\n * Split out of `./server-core` on purpose. `generateAuthorSchema` is a pure\n * function — it maps a `BlogAuthor` to a Person schema object and touches no\n * env, no config, and no network. It only ever lived in `server-core` because\n * the other author helpers there (`getAuthorBySlug`, `getAuthorPosts`) do fetch.\n *\n * `AuthorPage` is exported from the client-stamped `@sonordev/site-kit/blog`\n * barrel (see `./index.ts`), so importing this one function from `server-core`\n * dragged that whole server module — its `x-api-key` fetches included — into\n * the browser bundle. Keeping the pure half here means `AuthorPage` can stay in\n * the barrel without pulling a single line of server code with it.\n *\n * Anything added here must stay pure. If it needs an API key or a fetch, it\n * belongs in `./server-core`, not in this file.\n */\n\nimport type { BlogAuthor } from './types'\n\n/**\n * Generate Person JSON-LD schema for an author page\n */\nexport function generateAuthorSchema(\n  author: BlogAuthor,\n  options: { siteUrl?: string; siteName?: string } = {}\n): object {\n  const { siteUrl = '', siteName } = options\n\n  const sameAs: string[] = [...(author.same_as || [])]\n  if (author.linkedin_url) sameAs.push(author.linkedin_url)\n  if (author.twitter_url) sameAs.push(author.twitter_url)\n  if (author.website_url) sameAs.push(author.website_url)\n  if (author.social_links?.twitter) sameAs.push(`https://twitter.com/${author.social_links.twitter}`)\n  if (author.social_links?.linkedin) sameAs.push(author.social_links.linkedin)\n  if (author.social_links?.github) sameAs.push(`https://github.com/${author.social_links.github}`)\n\n  // Deduplicate\n  const uniqueSameAs = [...new Set(sameAs.filter(Boolean))]\n\n  const schema: Record<string, any> = {\n    '@context': 'https://schema.org',\n    '@type': 'Person',\n    name: author.name,\n    url: author.author_page_url || `${siteUrl}/blog/author/${author.slug}`,\n  }\n\n  if (author.title) schema.jobTitle = author.title\n  if (author.company || siteName) {\n    schema.worksFor = {\n      '@type': 'Organization',\n      name: author.company || siteName,\n      ...(siteUrl ? { url: siteUrl } : {}),\n    }\n  }\n  if (author.bio || author.short_bio) schema.description = author.short_bio || author.bio\n  if (author.avatar_url) schema.image = author.avatar_url\n  if (uniqueSameAs.length > 0) schema.sameAs = uniqueSameAs\n  if (author.knows_about && author.knows_about.length > 0) schema.knowsAbout = author.knows_about\n  if (author.credentials && author.credentials.length > 0) {\n    schema.hasCredential = author.credentials.map((c) => ({\n      '@type': 'EducationalOccupationalCredential',\n      credentialCategory: c,\n    }))\n  }\n\n  return schema\n}\n"]}

package/dist/{chunk-JRUNONG5.mjs → chunk-V4LF47AS.mjs}

@@ -1,5 +1,5 @@
 'use client';
-import { useSignalExperiment, useSignalEvent } from './chunk-VNQFKBKF.mjs';
+import { useSignalExperiment, useSignalEvent } from './chunk-RHKFINCS.mjs';
 import React, { useEffect } from 'react';
 import { jsx, Fragment } from 'react/jsx-runtime';
 
@@ -71,5 +71,5 @@ function ExperimentConversion({
 }
 
 export { ExperimentConversion, SignalExperiment, useExperimentVariant };
-//# sourceMappingURL=chunk-JRUNONG5.mjs.map
-//# sourceMappingURL=chunk-JRUNONG5.mjs.map
+//# sourceMappingURL=chunk-V4LF47AS.mjs.map
+//# sourceMappingURL=chunk-V4LF47AS.mjs.map

package/dist/{chunk-JRUNONG5.mjs.map → chunk-V4LF47AS.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/signal/SignalExperiment.tsx"],"names":[],"mappings":";;;;AAgDO,SAAS,gBAAA,CAAiB;AAAA,EAC/B,YAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,eAAA,GAAkB,IAAA;AAAA,EAClB;AACF,CAAA,EAA0B;AACxB,EAAA,MAAM,EAAE,UAAA,EAAY,OAAA,EAAS,SAAA,EAAU,GAAI,oBAAoB,YAAY,CAAA;AAC3E,EAAA,MAAM,aAAa,cAAA,EAAe;AAGlC,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,mBAAmB,OAAA,EAAS;AAC9B,MAAA,UAAA,CAAW;AAAA,QACT,UAAA,EAAY,YAAA;AAAA,QACZ,UAAA,EAAY,YAAA;AAAA,QACZ,UAAA,EAAY;AAAA,UACV,aAAA,EAAe,YAAA;AAAA,UACf,WAAA,EAAa;AAAA;AACf,OACD,CAAA;AAAA,IACH;AAAA,EACF,GAAG,CAAC,YAAA,EAAc,OAAA,EAAS,eAAA,EAAiB,UAAU,CAAC,CAAA;AAGvD,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,uBAAO,GAAA,CAAA,QAAA,EAAA,EAAG,mBAAS,EAAE,OAAA,EAAS,WAAW,SAAA,EAAW,SAAA,EAAW,CAAA,EAAE,CAAA;AAAA,EACnE;AAGA,EAAA,MAAM,kBAAkB,OAAA,IAAW,SAAA;AACnC,EAAA,MAAM,OAAA,GAAU,SAAS,eAAe,CAAA;AAExC,EAAA,IAAI,YAAY,MAAA,EAAW;AACzB,IAAA,uCAAU,QAAA,EAAA,OAAA,EAAQ,CAAA;AAAA,EACpB;AAGA,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,uCAAU,QAAA,EAAA,QAAA,EAAS,CAAA;AAAA,EACrB;AAEA,EAAA,uBAAO,GAAA,CAAA,QAAA,EAAA,EAAG,QAAA,EAAA,QAAA,CAAS,OAAA,IAAW,IAAA,EAAK,CAAA;AACrC;AAYO,SAAS,qBAAqB,YAAA,EAAsB;AACzD,EAAA,OAAO,oBAAoB,YAAY,CAAA;AACzC;AAoBO,SAAS,oBAAA,CAAqB;AAAA,EACnC,YAAA;AAAA,EACA,WAAA,GAAc,OAAA;AAAA,EACd,KAAA;AAAA,EACA;AACF,CAAA,EAKG;AACD,EAAA,MAAM,aAAa,cAAA,EAAe;AAClC,EAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,mBAAA,CAAoB,YAAY,CAAA;AAEpD,EAAA,MAAM,oBAAoB,MAAM;AAC9B,IAAA,UAAA,CAAW;AAAA,MACT,UAAA,EAAY,YAAA;AAAA,MACZ,UAAA,EAAY,YAAA;AAAA,MACZ,UAAA,EAAY;AAAA,QACV,aAAA,EAAe,YAAA;AAAA,QACf,WAAA,EAAa,OAAA;AAAA,QACb,YAAA,EAAc,WAAA;AAAA,QACd;AAAA;AACF,KACD,CAAA;AAAA,EACH,CAAA;AAEA,EAAA,OAAO,KAAA,CAAM,aAAa,QAAA,EAAU;AAAA,IAClC,OAAA,EAAS,CAAC,CAAA,KAAwB;AAChC,MAAA,iBAAA,EAAkB;AAElB,MAAA,IAAK,QAAA,CAAS,MAAsD,OAAA,EAAS;AAC3E,QAAC,QAAA,CAAS,KAAA,CAAsD,OAAA,CAAS,CAAC,CAAA;AAAA,MAC5E;AAAA,IACF;AAAA,GACD,CAAA;AACH","file":"chunk-JRUNONG5.mjs","sourcesContent":["/**\n * @sonordev/site-kit/signal - SignalExperiment\n * \n * A/B test component that renders different variants based on Signal assignment.\n * Uses Thompson Sampling (Bayesian bandit) for optimization.\n */\n\n'use client'\n\nimport React, { useMemo, useEffect } from 'react'\nimport { useSignalExperiment, useSignalEvent } from './SignalBridge'\n\ninterface SignalExperimentProps {\n  /** Unique experiment ID */\n  experimentId: string\n  \n  /** Variants to test - keys are variant names, values are React nodes */\n  variants: Record<string, React.ReactNode>\n  \n  /** Fallback content if no assignment (defaults to 'control' variant) */\n  fallback?: React.ReactNode\n  \n  /** Track impression automatically */\n  trackImpression?: boolean\n  \n  /** Children function for more control */\n  children?: (props: { variant: string; isControl: boolean }) => React.ReactNode\n}\n\n/**\n * Renders different content variants based on Signal's A/B assignment.\n * \n * @example\n * // Simple variant switching\n * <SignalExperiment experimentId=\"hero-cta\" variants={{\n *   control: <Button>Get Started</Button>,\n *   variant_a: <Button variant=\"primary\">Start Free Trial</Button>,\n *   variant_b: <Button variant=\"secondary\">Book a Demo</Button>,\n * }} />\n * \n * @example\n * // With render prop for more control\n * <SignalExperiment experimentId=\"pricing-layout\">\n *   {({ variant, isControl }) => (\n *     <PricingSection layout={isControl ? 'cards' : 'table'} />\n *   )}\n * </SignalExperiment>\n */\nexport function SignalExperiment({\n  experimentId,\n  variants,\n  fallback,\n  trackImpression = true,\n  children,\n}: SignalExperimentProps) {\n  const { assignment, variant, isControl } = useSignalExperiment(experimentId)\n  const trackEvent = useSignalEvent()\n  \n  // Track impression when variant is rendered\n  useEffect(() => {\n    if (trackImpression && variant) {\n      trackEvent({\n        event_type: 'experiment',\n        event_name: 'impression',\n        event_data: {\n          experiment_id: experimentId,\n          variant_key: variant,\n        },\n      })\n    }\n  }, [experimentId, variant, trackImpression, trackEvent])\n  \n  // If using render prop\n  if (children) {\n    return <>{children({ variant: variant || 'control', isControl })}</>\n  }\n  \n  // Determine what to render\n  const selectedVariant = variant || 'control'\n  const content = variants[selectedVariant]\n  \n  if (content !== undefined) {\n    return <>{content}</>\n  }\n  \n  // Fallback to provided fallback or control\n  if (fallback) {\n    return <>{fallback}</>\n  }\n  \n  return <>{variants.control || null}</>\n}\n\n/**\n * Hook for conditional experiment logic\n * \n * @example\n * const { variant, isControl } = useExperimentVariant('pricing-test')\n * \n * return isControl \n *   ? <OldPricing />\n *   : <NewPricing showAnnual={variant === 'annual_first'} />\n */\nexport function useExperimentVariant(experimentId: string) {\n  return useSignalExperiment(experimentId)\n}\n\n/**\n * Component for tracking experiment conversions\n * Wraps interactive elements to track when they convert\n * \n * @example\n * <SignalExperiment experimentId=\"signup-button\" variants={{\n *   control: (\n *     <ExperimentConversion experimentId=\"signup-button\" outcomeType=\"click\">\n *       <Button>Sign Up</Button>\n *     </ExperimentConversion>\n *   ),\n *   variant_a: (\n *     <ExperimentConversion experimentId=\"signup-button\" outcomeType=\"click\">\n *       <Button variant=\"large\">Join Now - It's Free!</Button>\n *     </ExperimentConversion>\n *   ),\n * }} />\n */\nexport function ExperimentConversion({\n  experimentId,\n  outcomeType = 'click',\n  value,\n  children,\n}: {\n  experimentId: string\n  outcomeType?: string\n  value?: number\n  children: React.ReactElement<{ onClick?: (e: React.MouseEvent) => void }>\n}) {\n  const trackEvent = useSignalEvent()\n  const { variant } = useSignalExperiment(experimentId)\n\n  const handleInteraction = () => {\n    trackEvent({\n      event_type: 'experiment',\n      event_name: 'conversion',\n      event_data: {\n        experiment_id: experimentId,\n        variant_key: variant,\n        outcome_type: outcomeType,\n        value,\n      },\n    })\n  }\n\n  return React.cloneElement(children, {\n    onClick: (e: React.MouseEvent) => {\n      handleInteraction()\n      // Call original onClick if exists\n      if ((children.props as { onClick?: (e: React.MouseEvent) => void }).onClick) {\n        (children.props as { onClick?: (e: React.MouseEvent) => void }).onClick!(e)\n      }\n    },\n  })\n}\n"]}
+{"version":3,"sources":["../src/signal/SignalExperiment.tsx"],"names":[],"mappings":";;;;AAgDO,SAAS,gBAAA,CAAiB;AAAA,EAC/B,YAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,eAAA,GAAkB,IAAA;AAAA,EAClB;AACF,CAAA,EAA0B;AACxB,EAAA,MAAM,EAAE,UAAA,EAAY,OAAA,EAAS,SAAA,EAAU,GAAI,oBAAoB,YAAY,CAAA;AAC3E,EAAA,MAAM,aAAa,cAAA,EAAe;AAGlC,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,mBAAmB,OAAA,EAAS;AAC9B,MAAA,UAAA,CAAW;AAAA,QACT,UAAA,EAAY,YAAA;AAAA,QACZ,UAAA,EAAY,YAAA;AAAA,QACZ,UAAA,EAAY;AAAA,UACV,aAAA,EAAe,YAAA;AAAA,UACf,WAAA,EAAa;AAAA;AACf,OACD,CAAA;AAAA,IACH;AAAA,EACF,GAAG,CAAC,YAAA,EAAc,OAAA,EAAS,eAAA,EAAiB,UAAU,CAAC,CAAA;AAGvD,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,uBAAO,GAAA,CAAA,QAAA,EAAA,EAAG,mBAAS,EAAE,OAAA,EAAS,WAAW,SAAA,EAAW,SAAA,EAAW,CAAA,EAAE,CAAA;AAAA,EACnE;AAGA,EAAA,MAAM,kBAAkB,OAAA,IAAW,SAAA;AACnC,EAAA,MAAM,OAAA,GAAU,SAAS,eAAe,CAAA;AAExC,EAAA,IAAI,YAAY,MAAA,EAAW;AACzB,IAAA,uCAAU,QAAA,EAAA,OAAA,EAAQ,CAAA;AAAA,EACpB;AAGA,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,uCAAU,QAAA,EAAA,QAAA,EAAS,CAAA;AAAA,EACrB;AAEA,EAAA,uBAAO,GAAA,CAAA,QAAA,EAAA,EAAG,QAAA,EAAA,QAAA,CAAS,OAAA,IAAW,IAAA,EAAK,CAAA;AACrC;AAYO,SAAS,qBAAqB,YAAA,EAAsB;AACzD,EAAA,OAAO,oBAAoB,YAAY,CAAA;AACzC;AAoBO,SAAS,oBAAA,CAAqB;AAAA,EACnC,YAAA;AAAA,EACA,WAAA,GAAc,OAAA;AAAA,EACd,KAAA;AAAA,EACA;AACF,CAAA,EAKG;AACD,EAAA,MAAM,aAAa,cAAA,EAAe;AAClC,EAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,mBAAA,CAAoB,YAAY,CAAA;AAEpD,EAAA,MAAM,oBAAoB,MAAM;AAC9B,IAAA,UAAA,CAAW;AAAA,MACT,UAAA,EAAY,YAAA;AAAA,MACZ,UAAA,EAAY,YAAA;AAAA,MACZ,UAAA,EAAY;AAAA,QACV,aAAA,EAAe,YAAA;AAAA,QACf,WAAA,EAAa,OAAA;AAAA,QACb,YAAA,EAAc,WAAA;AAAA,QACd;AAAA;AACF,KACD,CAAA;AAAA,EACH,CAAA;AAEA,EAAA,OAAO,KAAA,CAAM,aAAa,QAAA,EAAU;AAAA,IAClC,OAAA,EAAS,CAAC,CAAA,KAAwB;AAChC,MAAA,iBAAA,EAAkB;AAElB,MAAA,IAAK,QAAA,CAAS,MAAsD,OAAA,EAAS;AAC3E,QAAC,QAAA,CAAS,KAAA,CAAsD,OAAA,CAAS,CAAC,CAAA;AAAA,MAC5E;AAAA,IACF;AAAA,GACD,CAAA;AACH","file":"chunk-V4LF47AS.mjs","sourcesContent":["/**\n * @sonordev/site-kit/signal - SignalExperiment\n * \n * A/B test component that renders different variants based on Signal assignment.\n * Uses Thompson Sampling (Bayesian bandit) for optimization.\n */\n\n'use client'\n\nimport React, { useMemo, useEffect } from 'react'\nimport { useSignalExperiment, useSignalEvent } from './SignalBridge'\n\ninterface SignalExperimentProps {\n  /** Unique experiment ID */\n  experimentId: string\n  \n  /** Variants to test - keys are variant names, values are React nodes */\n  variants: Record<string, React.ReactNode>\n  \n  /** Fallback content if no assignment (defaults to 'control' variant) */\n  fallback?: React.ReactNode\n  \n  /** Track impression automatically */\n  trackImpression?: boolean\n  \n  /** Children function for more control */\n  children?: (props: { variant: string; isControl: boolean }) => React.ReactNode\n}\n\n/**\n * Renders different content variants based on Signal's A/B assignment.\n * \n * @example\n * // Simple variant switching\n * <SignalExperiment experimentId=\"hero-cta\" variants={{\n *   control: <Button>Get Started</Button>,\n *   variant_a: <Button variant=\"primary\">Start Free Trial</Button>,\n *   variant_b: <Button variant=\"secondary\">Book a Demo</Button>,\n * }} />\n * \n * @example\n * // With render prop for more control\n * <SignalExperiment experimentId=\"pricing-layout\">\n *   {({ variant, isControl }) => (\n *     <PricingSection layout={isControl ? 'cards' : 'table'} />\n *   )}\n * </SignalExperiment>\n */\nexport function SignalExperiment({\n  experimentId,\n  variants,\n  fallback,\n  trackImpression = true,\n  children,\n}: SignalExperimentProps) {\n  const { assignment, variant, isControl } = useSignalExperiment(experimentId)\n  const trackEvent = useSignalEvent()\n  \n  // Track impression when variant is rendered\n  useEffect(() => {\n    if (trackImpression && variant) {\n      trackEvent({\n        event_type: 'experiment',\n        event_name: 'impression',\n        event_data: {\n          experiment_id: experimentId,\n          variant_key: variant,\n        },\n      })\n    }\n  }, [experimentId, variant, trackImpression, trackEvent])\n  \n  // If using render prop\n  if (children) {\n    return <>{children({ variant: variant || 'control', isControl })}</>\n  }\n  \n  // Determine what to render\n  const selectedVariant = variant || 'control'\n  const content = variants[selectedVariant]\n  \n  if (content !== undefined) {\n    return <>{content}</>\n  }\n  \n  // Fallback to provided fallback or control\n  if (fallback) {\n    return <>{fallback}</>\n  }\n  \n  return <>{variants.control || null}</>\n}\n\n/**\n * Hook for conditional experiment logic\n * \n * @example\n * const { variant, isControl } = useExperimentVariant('pricing-test')\n * \n * return isControl \n *   ? <OldPricing />\n *   : <NewPricing showAnnual={variant === 'annual_first'} />\n */\nexport function useExperimentVariant(experimentId: string) {\n  return useSignalExperiment(experimentId)\n}\n\n/**\n * Component for tracking experiment conversions\n * Wraps interactive elements to track when they convert\n * \n * @example\n * <SignalExperiment experimentId=\"signup-button\" variants={{\n *   control: (\n *     <ExperimentConversion experimentId=\"signup-button\" outcomeType=\"click\">\n *       <Button>Sign Up</Button>\n *     </ExperimentConversion>\n *   ),\n *   variant_a: (\n *     <ExperimentConversion experimentId=\"signup-button\" outcomeType=\"click\">\n *       <Button variant=\"large\">Join Now - It's Free!</Button>\n *     </ExperimentConversion>\n *   ),\n * }} />\n */\nexport function ExperimentConversion({\n  experimentId,\n  outcomeType = 'click',\n  value,\n  children,\n}: {\n  experimentId: string\n  outcomeType?: string\n  value?: number\n  children: React.ReactElement<{ onClick?: (e: React.MouseEvent) => void }>\n}) {\n  const trackEvent = useSignalEvent()\n  const { variant } = useSignalExperiment(experimentId)\n\n  const handleInteraction = () => {\n    trackEvent({\n      event_type: 'experiment',\n      event_name: 'conversion',\n      event_data: {\n        experiment_id: experimentId,\n        variant_key: variant,\n        outcome_type: outcomeType,\n        value,\n      },\n    })\n  }\n\n  return React.cloneElement(children, {\n    onClick: (e: React.MouseEvent) => {\n      handleInteraction()\n      // Call original onClick if exists\n      if ((children.props as { onClick?: (e: React.MouseEvent) => void }).onClick) {\n        (children.props as { onClick?: (e: React.MouseEvent) => void }).onClick!(e)\n      }\n    },\n  })\n}\n"]}

package/dist/chunk-VELBKUIM.js

@@ -0,0 +1,38 @@
+'use strict';
+
+var chunkNB4MK2Q5_js = require('./chunk-NB4MK2Q5.js');
+var chunkKTHQKVGZ_js = require('./chunk-KTHQKVGZ.js');
+
+// src/shared/publishCredential.ts
+function resolveSiteHost(explicitSite) {
+  const envSiteUrl = typeof process !== "undefined" ? process.env.NEXT_PUBLIC_SITE_URL : void 0;
+  let resolved = explicitSite ?? "";
+  if (!resolved && envSiteUrl) {
+    try {
+      resolved = new URL(envSiteUrl).host;
+    } catch {
+    }
+  }
+  if (!resolved && typeof window !== "undefined") {
+    resolved = window.location.host;
+  }
+  return chunkNB4MK2Q5_js.normalizeSiteHost(resolved) ?? "";
+}
+function publishSiteCredential({
+  apiKey,
+  apiUrl = "https://api.sonor.io",
+  site,
+  debug = false
+}) {
+  if (typeof window === "undefined") return;
+  chunkKTHQKVGZ_js.configureSiteCredential({ credential: apiKey, apiUrl });
+  window.__SITE_KIT_API_URL__ = apiUrl;
+  window.__SITE_KIT_API_KEY__ = chunkKTHQKVGZ_js.currentCredential(apiKey);
+  window.__SITE_KIT_DEBUG__ = debug;
+  window.__SITE_KIT_SITE__ = site ?? resolveSiteHost();
+}
+
+exports.publishSiteCredential = publishSiteCredential;
+exports.resolveSiteHost = resolveSiteHost;
+//# sourceMappingURL=chunk-VELBKUIM.js.map
+//# sourceMappingURL=chunk-VELBKUIM.js.map

package/dist/chunk-VELBKUIM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared/publishCredential.ts"],"names":["normalizeSiteHost","configureSiteCredential","currentCredential"],"mappings":";;;;;;AAqCO,SAAS,gBAAgB,YAAA,EAA+B;AAC7D,EAAA,MAAM,aACJ,OAAO,OAAA,KAAY,WAAA,GAAc,OAAA,CAAQ,IAAI,oBAAA,GAAuB,MAAA;AAEtE,EAAA,IAAI,WAAW,YAAA,IAAgB,EAAA;AAC/B,EAAA,IAAI,CAAC,YAAY,UAAA,EAAY;AAC3B,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,IAAI,GAAA,CAAI,UAAU,CAAA,CAAE,IAAA;AAAA,IACjC,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,IAAI,CAAC,QAAA,IAAY,OAAO,MAAA,KAAW,WAAA,EAAa;AAC9C,IAAA,QAAA,GAAW,OAAO,QAAA,CAAS,IAAA;AAAA,EAC7B;AACA,EAAA,OAAOA,kCAAA,CAAkB,QAAQ,CAAA,IAAK,EAAA;AACxC;AA0BO,SAAS,qBAAA,CAAsB;AAAA,EACpC,MAAA;AAAA,EACA,MAAA,GAAS,sBAAA;AAAA,EACT,IAAA;AAAA,EACA,KAAA,GAAQ;AACV,CAAA,EAAuC;AACrC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAKnC,EAAAC,wCAAA,CAAwB,EAAE,UAAA,EAAY,MAAA,EAAQ,MAAA,EAAQ,CAAA;AACrD,EAAC,OAAe,oBAAA,GAAuB,MAAA;AACvC,EAAC,MAAA,CAAe,oBAAA,GAAuBC,kCAAA,CAAkB,MAAM,CAAA;AAC/D,EAAC,OAAe,kBAAA,GAAqB,KAAA;AACrC,EAAC,MAAA,CAAe,iBAAA,GAAoB,IAAA,IAAQ,eAAA,EAAgB;AAC/D","file":"chunk-VELBKUIM.js","sourcesContent":["/**\n * @sonordev/site-kit shared — Client credential + window-global publishing\n *\n * SINGLE SOURCE OF TRUTH for seeding the browser-side token manager and the\n * `window.__SITE_KIT_*` globals that every client module reads. Used by:\n *\n *   - `SiteKitClientProviders` (core `SiteKitLayout`)\n *   - `SiteKitCredential` (`@sonordev/site-kit/client`) — the public component\n *     for layouts that are NOT core `SiteKitLayout`, e.g.\n *     `@sonordev/agency-site-kit`'s `AgencySiteKitLayout`.\n *\n * Do not re-fork this. Before it existed, agency sites hand-rolled their own\n * \"set the globals on mount\" component (upforge's `UptradeSiteKitInit`), and\n * because those copies had no access to the token manager they published the\n * RAW `sonor_` key into the client bundle — the exact exposure the mint exists\n * to prevent. Any layout that puts a credential on `window` goes through here.\n *\n * Client-safe: no `server-only` guard, SSR-safe (every write is window-gated).\n * The minting half is server-only and lives in `../server/mint-site-token`.\n */\n// Leaf module, NOT '../sites/contract' — see sites/normalize.ts. Importing the\n// full contract here shipped its JSON schema to every browser that loads a\n// credential-publishing entry.\nimport { normalizeSiteHost } from '../sites/normalize'\nimport { configureSiteCredential, currentCredential } from './siteToken'\n\n/**\n * Resolve the sub-site identifier — the dimension that lets one Sonor project\n * host many sites (e.g. truepowersystems.com + ohiopowerstudies.com under one\n * TPS project). Precedence, per the platform site contract:\n *   explicit `site` > NEXT_PUBLIC_SITE_URL host > window.location.host\n *\n * Normalized with the shared contract (lowercase host, no protocol/path/port)\n * so `__SITE_KIT_SITE__` matches exactly what the Sonor API stores — servers\n * re-normalize with the same rule, so this only makes the client emit the\n * canonical value. Always returns a string (possibly empty).\n */\nexport function resolveSiteHost(explicitSite?: string): string {\n  const envSiteUrl =\n    typeof process !== 'undefined' ? process.env.NEXT_PUBLIC_SITE_URL : undefined\n\n  let resolved = explicitSite ?? ''\n  if (!resolved && envSiteUrl) {\n    try {\n      resolved = new URL(envSiteUrl).host\n    } catch {\n      /* malformed URL — fall through to client-side host */\n    }\n  }\n  if (!resolved && typeof window !== 'undefined') {\n    resolved = window.location.host\n  }\n  return normalizeSiteHost(resolved) ?? ''\n}\n\nexport interface PublishSiteCredentialOptions {\n  /**\n   * The credential the layout minted server-side. In 3.2+ this is a short-lived\n   * `st1.` token that `sonorFetch` refreshes transparently. A raw `sonor_` key\n   * still works (2.x kit, or the mint-failed fallback) but should never be\n   * routed here from a client component — it would ship the secret to the\n   * browser.\n   */\n  apiKey?: string\n  apiUrl?: string\n  /** Pre-resolved sub-site host. Omit to resolve via `resolveSiteHost`. */\n  site?: string\n  debug?: boolean\n}\n\n/**\n * Seed the token manager and publish the `window.__SITE_KIT_*` globals.\n *\n * Called during RENDER, not in an effect: client modules read these globals in\n * their own mount effects, and effects run child-first, so an effect-based\n * publish would land after the modules that need it.\n *\n * No-op on the server.\n */\nexport function publishSiteCredential({\n  apiKey,\n  apiUrl = 'https://api.sonor.io',\n  site,\n  debug = false,\n}: PublishSiteCredentialOptions): void {\n  if (typeof window === 'undefined') return\n\n  // Seed the client token manager. The window global is set to the freshest\n  // token held — a prior page this session may already have refreshed past the\n  // seed the layout injected. In raw-key mode this is a passthrough.\n  configureSiteCredential({ credential: apiKey, apiUrl })\n  ;(window as any).__SITE_KIT_API_URL__ = apiUrl\n  ;(window as any).__SITE_KIT_API_KEY__ = currentCredential(apiKey)\n  ;(window as any).__SITE_KIT_DEBUG__ = debug\n  ;(window as any).__SITE_KIT_SITE__ = site ?? resolveSiteHost()\n}\n"]}

package/dist/{chunk-G3G4HQT3.mjs → chunk-VN3TGLT3.mjs}

@@ -1,7 +1,7 @@
 'use client';
 import { registerAnalyticsDispatcher } from './chunk-3DPXOZAU.mjs';
 import { getOrCreateVisitorId, getOrCreateSessionId } from './chunk-AX4AROLH.mjs';
-import { sonorFetch, sonorBeacon } from './chunk-WS4GNH3F.mjs';
+import { sonorFetch, sonorBeacon } from './chunk-S32BEPZM.mjs';
 import { createContext, useRef, useEffect, useState, useCallback, useMemo, useContext } from 'react';
 import { usePathname } from 'next/navigation';
 import { jsxs, jsx } from 'react/jsx-runtime';
@@ -1071,5 +1071,5 @@ function useTrackEvent() {
 }
 
 export { AnalyticsProvider, WebVitals, useAnalytics, useAnalyticsOptional, useTrackEvent };
-//# sourceMappingURL=chunk-G3G4HQT3.mjs.map
-//# sourceMappingURL=chunk-G3G4HQT3.mjs.map
+//# sourceMappingURL=chunk-VN3TGLT3.mjs.map
+//# sourceMappingURL=chunk-VN3TGLT3.mjs.map