@sonordev/site-kit 4.0.0 → 4.0.2

package/dist/chunk-R4PCXP3F.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/forms/HoneypotField.tsx","../src/forms/native-fallback.tsx"],"names":["jsx"],"mappings":";;;AAqCO,SAAS,aAAA,CAAc,EAAE,IAAA,EAAM,KAAA,EAAO,UAAS,EAAuB;AAC3E,EAAA,MAAM,WAAA,GAAc,OAAO,QAAA,KAAa,UAAA;AACxC,EAAA,uBACE,GAAA;AAAA,IAAC,OAAA;AAAA,IAAA;AAAA,MACC,IAAA,EAAK,MAAA;AAAA,MACL,IAAA;AAAA,MACA,QAAA,EAAU,EAAA;AAAA,MACV,YAAA,EAAa,cAAA;AAAA,MACb,aAAA,EAAY,MAAA;AAAA,MACZ,KAAA,EAAK,IAAA;AAAA,MACL,kBAAA,EAAiB,EAAA;AAAA,MAGjB,gBAAA,EAAe,EAAA;AAAA,MACf,eAAA,EAAc,MAAA;AAAA,MACd,gBAAA,EAAe,OAAA;AAAA,MACf,eAAA,EAAc,EAAA;AAAA,MACd,KAAA,EAAO;AAAA,QACL,QAAA,EAAU,UAAA;AAAA,QACV,IAAA,EAAM,KAAA;AAAA,QACN,KAAA,EAAO,CAAA;AAAA,QACP,MAAA,EAAQ,CAAA;AAAA,QACR,QAAA,EAAU,QAAA;AAAA,QACV,OAAA,EAAS,CAAA;AAAA,QACT,UAAA,EAAY,QAAA;AAAA,QACZ,aAAA,EAAe;AAAA,OACjB;AAAA,MACC,GAAI,WAAA,GACD;AAAA,QACE,OAAO,KAAA,IAAS,EAAA;AAAA,QAChB,QAAA,EAAU,CAAC,CAAA,KAA2C;AACpD,UAAA,QAAA,CAAU,CAAA,CAAE,OAAO,KAAK,CAAA;AACxB,UAAA,IAAI,CAAA,CAAE,OAAO,KAAA,EAAO;AAElB,YAAA,OAAA,CAAQ,KAAK,4BAA4B,CAAA;AAAA,UAC3C;AAAA,QACF;AAAA,OACF,GACA,EAAE,YAAA,EAAc,EAAA;AAAG;AAAA,GACzB;AAEJ;ACjDA,SAAS,eAAe,MAAA,EAAuD;AAC7E,EAAA,OAAO,CAAC,CAAC,MAAA,EAAQ,YAAA,IAAgB,CAAC,MAAA,CAAO,aAAA;AAC3C;AAGO,SAAS,gBACd,MAAA,EACsC;AACtC,EAAA,IAAI,CAAC,cAAA,CAAe,MAAM,CAAA,SAAU,EAAC;AACrC,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,YAAA,EAAa;AAChC,EAAA,OAAO,EAAE,MAAA,EAAQ,CAAA,EAAG,MAAM,CAAA,+BAAA,CAAA,EAAmC,QAAQ,MAAA,EAAO;AAC9E;AAaO,SAAS,oBAAA,CAAqB,EAAE,MAAA,EAAQ,QAAA,EAAS,EAA8B;AACpF,EAAA,IAAI,CAAC,cAAA,CAAe,MAAM,CAAA,EAAG,OAAO,IAAA;AACpC,EAAA,uBACE,IAAA,CAAA,QAAA,EAAA,EACE,QAAA,EAAA;AAAA,oBAAAA,GAAAA,CAAC,OAAA,EAAA,EAAM,IAAA,EAAK,QAAA,EAAS,IAAA,EAAK,aAAY,KAAA,EAAO,MAAA,CAAQ,YAAA,EAAc,QAAA,EAAQ,IAAA,EAAC,CAAA;AAAA,IAC3E,QAAA,mBAAWA,GAAAA,CAAC,OAAA,EAAA,EAAM,IAAA,EAAK,QAAA,EAAS,IAAA,EAAK,YAAA,EAAa,KAAA,EAAO,QAAA,EAAU,QAAA,EAAQ,IAAA,EAAC,CAAA,GAAK;AAAA,GAAA,EACpF,CAAA;AAEJ","file":"chunk-R4PCXP3F.mjs","sourcesContent":["/**\n * Single source of truth for the honeypot input — rendered by BOTH form\n * experiences (classic and stage) inside their <form>. The customRender path\n * deliberately gets none (documented limitation: custom renders lose the\n * honeypot, which is why alternate experiences must be render branches).\n *\n * Invariants (do not weaken any of these):\n * - `inert` blocks focus/interaction at the browser level, surviving hostile\n *   site CSS that could defeat the inline styles.\n * - data-sk-honeypot gives site CSS a stable opt-OUT hook.\n * - Controlled input: bots filling via JS still fire React onChange, so the\n *   value reaches submitForm's data payload.\n * - Name comes from config (`honeypot_field || DEFAULT_HONEYPOT_FIELD` from\n *   the shared contract) — resolved by the caller, never forked here.\n * - The trap must be invisible to AUTOFILL as well as to people. A browser or\n *   password manager filling a hidden input flags a real visitor as a bot, and\n *   because the value is stripped server-side the mistake is undiagnosable\n *   after the fact. `autocomplete=\"off\"` does not achieve this — it is the one\n *   value Chrome deliberately ignores for contact/address autofill — so the\n *   trap declares `new-password` (never offered saved contact data) plus the\n *   documented per-manager opt-outs.\n */\n\nimport React from 'react'\n\nexport interface HoneypotFieldProps {\n  name: string\n  value?: string\n  /**\n   * Omit for STATIC mode — an uncontrolled trap a Server Component can render.\n   * The trap's whole job is server-side (the value is read off the submission\n   * and stripped), so it needs no client state to work; the controlled form is\n   * only so the hydrated JSON path can read it back out of React state.\n   */\n  onChange?: (value: string) => void\n}\n\nexport function HoneypotField({ name, value, onChange }: HoneypotFieldProps) {\n  const interactive = typeof onChange === 'function'\n  return (\n    <input\n      type=\"text\"\n      name={name}\n      tabIndex={-1}\n      autoComplete=\"new-password\"\n      aria-hidden=\"true\"\n      inert\n      data-sk-honeypot=\"\"\n      // Password-manager opt-outs: 1Password, LastPass, Dashlane, Bitwarden.\n      // Each ignores its own attribute; none respects autocomplete alone.\n      data-1p-ignore=\"\"\n      data-lpignore=\"true\"\n      data-form-type=\"other\"\n      data-bwignore=\"\"\n      style={{\n        position: 'absolute',\n        left: -9999,\n        width: 1,\n        height: 1,\n        overflow: 'hidden',\n        opacity: 0,\n        visibility: 'hidden',\n        pointerEvents: 'none',\n      }}\n      {...(interactive\n        ? {\n            value: value ?? '',\n            onChange: (e: React.ChangeEvent<HTMLInputElement>) => {\n              onChange!(e.target.value)\n              if (e.target.value) {\n                // Bot detected\n                console.warn('[Forms] Honeypot triggered')\n              }\n            },\n          }\n        : { defaultValue: '' })}\n    />\n  )\n}\n","'use client'\n\n/**\n * No-JS native submission fallback — the floor under every managed form.\n *\n * The classic form is the SSR/no-JS surface (experiences are post-hydration\n * chunks), so it alone carries a real `action`/`method` pointing at\n * sonor-api's POST /api/public/forms/submit-native. With JS running, the\n * form's onSubmit preventDefault()s and the JSON path wins; without JS the\n * browser performs an ordinary form-encoded POST and the lead still lands.\n *\n * Auth rides in the hidden `_sk_token` field: a signed, single-purpose\n * credential minted by the api-key-authenticated forms/config endpoint\n * (`native_token` in the response). No token in the config (older API, or no\n * signing secret) means no fallback — the form keeps its historical behavior\n * rather than pointing at an endpoint that will reject it.\n *\n * Multi-step forms are excluded: step navigation is JS, and a native POST of\n * step-1 fields alone fails whole-form validation server-side. Single-step\n * forms are the overwhelming lead-capture case.\n *\n * Single source of truth for the gating — the form attrs and the hidden\n * fields must always agree, so both read the same predicate.\n */\n\nimport React from 'react'\nimport type { ManagedFormConfig } from './types'\nimport { getApiConfig } from './submitForm'\n\nfunction nativeEligible(config: ManagedFormConfig | null | undefined): boolean {\n  return !!config?.native_token && !config.is_multi_step\n}\n\n/** `action`/`method` for the classic <form> — empty when ineligible. */\nexport function nativeFormProps(\n  config: ManagedFormConfig | null | undefined,\n): { action?: string; method?: 'post' } {\n  if (!nativeEligible(config)) return {}\n  const { apiUrl } = getApiConfig()\n  return { action: `${apiUrl}/api/public/forms/submit-native`, method: 'post' }\n}\n\nexport interface NativeFallbackFieldsProps {\n  config: ManagedFormConfig | null | undefined\n  /**\n   * Absolute URL the native 303 should land on (usually the page hosting the\n   * form). Optional — without it the server falls back to the Referer origin,\n   * which loses the path but still returns the visitor to the right site.\n   */\n  returnTo?: string\n}\n\n/** Hidden control fields the native endpoint reads (`_sk_*` namespace). */\nexport function NativeFallbackFields({ config, returnTo }: NativeFallbackFieldsProps) {\n  if (!nativeEligible(config)) return null\n  return (\n    <>\n      <input type=\"hidden\" name=\"_sk_token\" value={config!.native_token} readOnly />\n      {returnTo ? <input type=\"hidden\" name=\"_sk_return\" value={returnTo} readOnly /> : null}\n    </>\n  )\n}\n"]}

package/dist/{chunk-BOWEGDKJ.js → chunk-RAX3HS4T.js}

@@ -1,8 +1,8 @@
 'use client';
 'use strict';
 
-var chunkP64SKDBS_js = require('./chunk-P64SKDBS.js');
-var chunkZLVZOAJG_js = require('./chunk-ZLVZOAJG.js');
+var chunkOP5FYTWJ_js = require('./chunk-OP5FYTWJ.js');
+var chunkWXKEYKE6_js = require('./chunk-WXKEYKE6.js');
 var react = require('react');
 var ReactMarkdown = require('react-markdown');
 var jsxRuntime = require('react/jsx-runtime');
@@ -37,7 +37,7 @@ function InlineManagedForm({ slug, prefill, primaryColor, primaryRgb }) {
     submit,
     isSubmitting,
     isComplete
-  } = chunkP64SKDBS_js.useForm(slug, { initialValues: prefill || {} });
+  } = chunkOP5FYTWJ_js.useForm(slug, { initialValues: prefill || {} });
   const cardStyle = {
     marginTop: 8,
     padding: 12,
@@ -389,7 +389,7 @@ function ChatWidget({ projectId: propProjectId, config, apiUrl: propApiUrl, sign
     const { apiKey } = getApiConfig();
     if (!apiKey) return;
     let cancelled = false;
-    chunkZLVZOAJG_js.sonorFetch(`${baseUrl}/api/public/seo/project-info`, {}, { apiKey, retries: 0 }).then((res) => res.ok ? res.json() : null).then((data) => {
+    chunkWXKEYKE6_js.sonorFetch(`${baseUrl}/api/public/seo/project-info`, {}, { apiKey, retries: 0 }).then((res) => res.ok ? res.json() : null).then((data) => {
       if (cancelled || !data?.valid || !data?.project_id) return;
       setResolvedProjectId(data.project_id);
     }).catch(() => {
@@ -403,7 +403,7 @@ function ChatWidget({ projectId: propProjectId, config, apiUrl: propApiUrl, sign
     const apiKey = ensureApiKey();
     if (!apiKey) return;
     try {
-      const response = await chunkZLVZOAJG_js.sonorFetch(`${baseUrl}/engage/widget/config?projectId=${projectId}`, {}, { apiKey, retries: 0 });
+      const response = await chunkWXKEYKE6_js.sonorFetch(`${baseUrl}/engage/widget/config?projectId=${projectId}`, {}, { apiKey, retries: 0 });
       if (response.ok) {
         const { data } = await response.json();
         setWidgetConfig(data ?? null);
@@ -419,7 +419,7 @@ function ChatWidget({ projectId: propProjectId, config, apiUrl: propApiUrl, sign
     const apiKey = ensureApiKey();
     if (!apiKey) return null;
     try {
-      const response = await chunkZLVZOAJG_js.sonorFetch(`${baseUrl}/engage/widget/availability?projectId=${projectId}`, {}, { apiKey, retries: 0 });
+      const response = await chunkWXKEYKE6_js.sonorFetch(`${baseUrl}/engage/widget/availability?projectId=${projectId}`, {}, { apiKey, retries: 0 });
       if (response.ok) {
         const { data } = await response.json();
         setAvailability(data);
@@ -436,7 +436,7 @@ function ChatWidget({ projectId: propProjectId, config, apiUrl: propApiUrl, sign
     const apiKey = ensureApiKey();
     if (!apiKey) return null;
     try {
-      const response = await chunkZLVZOAJG_js.sonorFetch(`${baseUrl}/engage/widget/session`, {
+      const response = await chunkWXKEYKE6_js.sonorFetch(`${baseUrl}/engage/widget/session`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
@@ -497,7 +497,7 @@ function ChatWidget({ projectId: propProjectId, config, apiUrl: propApiUrl, sign
         pageUrl: typeof window !== "undefined" ? window.location.href : void 0,
         ...siteContext ? { siteContext } : {}
       };
-      const res = await chunkZLVZOAJG_js.sonorFetch(url, {
+      const res = await chunkWXKEYKE6_js.sonorFetch(url, {
         method: "POST",
         headers: {
           "Content-Type": "application/json"
@@ -608,7 +608,7 @@ function ChatWidget({ projectId: propProjectId, config, apiUrl: propApiUrl, sign
         if (currentSessionId) {
           const apiKey = ensureApiKey();
           if (apiKey) {
-            chunkZLVZOAJG_js.sonorFetch(`${baseUrl}/engage/widget/messages?sessionId=${currentSessionId}`, {}, { apiKey, retries: 0 }).then((res) => res.ok ? res.json() : null).then((json) => {
+            chunkWXKEYKE6_js.sonorFetch(`${baseUrl}/engage/widget/messages?sessionId=${currentSessionId}`, {}, { apiKey, retries: 0 }).then((res) => res.ok ? res.json() : null).then((json) => {
               const data = json?.data ?? json;
               if (Array.isArray(data) && data.length) {
                 setMessages((prev) => {
@@ -671,7 +671,7 @@ function ChatWidget({ projectId: propProjectId, config, apiUrl: propApiUrl, sign
         try {
           const apiKey = ensureApiKey();
           if (!apiKey) return;
-          const response = await chunkZLVZOAJG_js.sonorFetch(`${baseUrl}/engage/widget/messages?sessionId=${currentSessionId}`, {}, { apiKey, retries: 0 });
+          const response = await chunkWXKEYKE6_js.sonorFetch(`${baseUrl}/engage/widget/messages?sessionId=${currentSessionId}`, {}, { apiKey, retries: 0 });
           if (response.ok) {
             const { data } = await response.json();
             setMessages((prev) => {
@@ -824,7 +824,7 @@ function ChatWidget({ projectId: propProjectId, config, apiUrl: propApiUrl, sign
       form.append("file", file);
       form.append("sessionId", sessionId);
       form.append("visitorId", visitorId);
-      const res = await chunkZLVZOAJG_js.sonorFetch(`${baseUrl}/engage/widget/upload`, {
+      const res = await chunkWXKEYKE6_js.sonorFetch(`${baseUrl}/engage/widget/upload`, {
         method: "POST",
         body: form
       }, { apiKey, retries: 0 });
@@ -971,7 +971,7 @@ function ChatWidget({ projectId: propProjectId, config, apiUrl: propApiUrl, sign
     if (!apiKey) return;
     setCheckingHandoff(true);
     try {
-      const res = await chunkZLVZOAJG_js.sonorFetch(`${baseUrl}/engage/widget/handoff`, {
+      const res = await chunkWXKEYKE6_js.sonorFetch(`${baseUrl}/engage/widget/handoff`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ sessionId })
@@ -1010,7 +1010,7 @@ function ChatWidget({ projectId: propProjectId, config, apiUrl: propApiUrl, sign
       setIsLoading(true);
       setOfflineError(null);
       try {
-        const response = await chunkZLVZOAJG_js.sonorFetch(`${baseUrl}/engage/widget/offline-form`, {
+        const response = await chunkWXKEYKE6_js.sonorFetch(`${baseUrl}/engage/widget/offline-form`, {
           method: "POST",
           headers: { "Content-Type": "application/json" },
           body: JSON.stringify({
@@ -1611,5 +1611,5 @@ function ChatWidget({ projectId: propProjectId, config, apiUrl: propApiUrl, sign
 }
 
 exports.ChatWidget = ChatWidget;
-//# sourceMappingURL=chunk-BOWEGDKJ.js.map
-//# sourceMappingURL=chunk-BOWEGDKJ.js.map
+//# sourceMappingURL=chunk-RAX3HS4T.js.map
+//# sourceMappingURL=chunk-RAX3HS4T.js.map