@sonordev/site-kit 4.0.2 → 4.1.0

package/dist/{chunk-FGN27J35.mjs.map → chunk-UDHQNYBD.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/fetchWithRetry.ts","../src/shared/sonorFetch.ts"],"names":[],"mappings":";;;;AAsBA,SAAS,YAAA,CAAa,SAAiB,QAAA,EAA6B;AAElE,EAAA,IAAI,QAAA,EAAU,WAAW,GAAA,EAAK;AAC5B,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,MAAA,GAAS,QAAA,CAAS,MAAA,EAAQ,EAAE,CAAA,GAAI,GAAA;AAChD,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,IAAK,OAAA,GAAU,CAAA,EAAG,OAAO,IAAA,CAAK,GAAA,CAAI,OAAA,GAAU,GAAA,EAAM,GAAK,CAAA;AAAA,EAClF;AAEA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,GAAA,EAAM,GAAA,GAAM,KAAK,OAAO,CAAA;AAC1C;AASA,eAAsB,cAAA,CACpB,GAAA,EACA,IAAA,EACA,OAAA,GAA6B,EAAC,EACX;AACnB,EAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,IAAA;AACvC,EAAA,IAAI,SAAA;AAEJ,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,OAAA,EAAS,OAAA,EAAA,EAAW;AACnD,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,MAAA,YAAA,CAAa,KAAK,CAAA;AAElB,MAAA,IAAA,CAAK,SAAS,MAAA,KAAW,GAAA,IAAO,SAAS,MAAA,IAAU,GAAA,KAAQ,UAAU,OAAA,EAAS;AAC5E,QAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY,UAAA,CAAW,SAAS,YAAA,CAAa,OAAA,EAAS,QAAQ,CAAC,CAAC,CAAA;AACnF,QAAA;AAAA,MACF;AACA,MAAA,OAAO,QAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,SAAA,GAAY,KAAA;AAEZ,MAAA,IAAI,UAAU,OAAA,EAAS;AACrB,QAAA,MAAM,IAAI,QAAQ,CAAC,OAAA,KAAY,WAAW,OAAA,EAAS,YAAA,CAAa,OAAO,CAAC,CAAC,CAAA;AACzE,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,YAAqB,KAAA,GACvB,SAAA,GACA,IAAI,MAAM,mEAAmE,CAAA;AACnF;;;AC7BA,IAAM,gBAAgB,CAAA,GAAI,GAAA;AAM1B,IAAM,iBAAA,GAAoB,wBAAA;AAC1B,IAAM,cAAmC,MAAM;AAC7C,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,2BAAW,GAAA,EAAI;AAClD,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,CAAA,CAAA,iBAAA,CAAA,KAAA,CAAA,CAAA,iBAAA,CAAA,uBAA6B,GAAA,EAAI,CAAA;AAC3C,CAAA,GAAG;AACH,IAAI,cAAA,GAAiB,KAAA;AAGd,SAAS,aAAa,UAAA,EAA8B;AACzD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,MAAM,EAAA,GAAK,oBAAoB,UAAU,CAAA;AACzC,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,EAAE,CAAA;AAC/B,EAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,EAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,KAAA,EAAO;AACvB,IAAA,UAAA,CAAW,OAAO,EAAE,CAAA;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,YAAY,UAAA,EAA2B;AAC9C,EAAA,UAAA,CAAW,IAAI,mBAAA,CAAoB,UAAU,GAAG,IAAA,CAAK,GAAA,KAAQ,aAAa,CAAA;AAC1E,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,cAAA,GAAiB,IAAA;AAGjB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AACF;AAEA,eAAsB,WACpB,GAAA,EACA,IAAA,GAAoB,EAAC,EACrB,OAAA,GAA6B,EAAC,EACX;AAGnB,EAAA,IAAI,aAAa,OAAA,CAAQ,MAAA;AACzB,EAAA,IAAI,UAAA,KAAe,MAAA,IAAa,WAAA,EAAY,EAAG;AAC7C,IAAA,UAAA,GAAa,MAAM,kBAAA,CAAmB,OAAA,CAAQ,MAAM,CAAA;AAAA,EACtD;AAEA,EAAA,MAAM,UAAU,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAC9C,EAAA,OAAA,CAAQ,GAAA,CAAI,qBAAqB,gBAAgB,CAAA;AACjD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,IAAI,aAAY,EAAG;AASjB,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AACnC,MAAA,OAAA,CAAQ,OAAO,eAAe,CAAA;AAAA,IAChC,CAAA,MAAA,IAAW,CAAC,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG;AAEpC,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AAAA,IACrC;AAAA,EACF;AAEA,EAAA,IAAI,YAAA,CAAa,UAAU,CAAA,EAAG;AAG5B,IAAA,OAAO,IAAI,SAAS,IAAA,EAAM,EAAE,QAAQ,GAAA,EAAK,UAAA,EAAY,qBAAqB,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,QAAA,GAAW,MAAM,cAAA,CAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAQ,EAAG,OAAO,CAAA;AAKtE,EAAA,IAAA,CACG,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,QAAA,CAAS,MAAA,KAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClB,WAAA,CAAY,UAAU,CAAA,EACtB;AACA,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,SAAA,IAAa,cAAc,UAAA,EAAY;AACzC,MAAA,MAAM,eAAe,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AACnD,MAAA,YAAA,CAAa,GAAA,CAAI,qBAAqB,gBAAgB,CAAA;AACtD,MAAA,YAAA,CAAa,GAAA,CAAI,aAAa,SAAS,CAAA;AAGvC,MAAA,YAAA,CAAa,OAAO,eAAe,CAAA;AACnC,MAAA,UAAA,GAAa,SAAA;AACb,MAAA,QAAA,GAAW,MAAM,eAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,YAAA,EAAa,EAAG,OAAO,CAAA;AAAA,IAClF;AAAA,EACF;AAEA,EAAA,IAAA,CACG,QAAA,CAAS,WAAW,GAAA,IAAO,QAAA,CAAS,WAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClB,UAAA,EACA;AACA,IAAA,WAAA,CAAY,UAAU,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,QAAA;AACT;AAYO,SAAS,WAAA,CAAY,GAAA,EAAa,OAAA,EAAkB,MAAA,EAAuB;AAChF,EAAA,MAAM,UAAA,GAAa,kBAAkB,MAAM,CAAA;AAC3C,EAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,IAAA,CAAK,UAAU,OAAO,CAAA;AAC3E,EAAA,IAAI;AACF,IAAA,KAAK,MAAM,GAAA,EAAK;AAAA,MACd,MAAA,EAAQ,MAAA;AAAA,MACR,SAAA,EAAW,IAAA;AAAA,MACX,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqB,gBAAA;AAAA,QACrB,GAAI,UAAA,GAAa,EAAE,WAAA,EAAa,UAAA,KAAe;AAAC,OAClD;AAAA,MACA;AAAA,KACD,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAEf,CAAC,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AACN,IAAA,IAAI;AACF,MAAA,IAAI,OAAO,SAAA,KAAc,WAAA,IAAe,SAAA,CAAU,UAAA,EAAY;AAC5D,QAAA,SAAA,CAAU,UAAA,CAAW,GAAA,EAAK,IAAI,IAAA,CAAK,CAAC,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,kBAAA,EAAoB,CAAC,CAAA;AAAA,MAC1E;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACF","file":"chunk-FGN27J35.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared - Resilient fetch\n *\n * Single source of truth for client-side resilient fetch (forms, SitemapSync).\n * Adds a per-attempt timeout and retries transient failures (network errors,\n * request timeouts, HTTP 429, and 5xx) with exponential backoff.\n *\n * A form submission must survive a brief API blip — a deploy, a cold start, a\n * dropped packet. A single un-retried fetch turning into \"Something went wrong\"\n * is how leads get lost. The explicit abort also matters on its own: a request\n * left to hang until the browser's own network timeout logs a console error\n * (net::ERR_TIMED_OUT) that fails Lighthouse best-practices; an aborted fetch\n * logs nothing.\n */\n\nexport interface FetchRetryOptions {\n  /** Number of retries AFTER the first attempt (default 2 → up to 3 tries total). */\n  retries?: number\n  /** Per-attempt timeout in milliseconds (default 15000). */\n  timeoutMs?: number\n}\n\nfunction backoffDelay(attempt: number, response?: Response): number {\n  // Honor a Retry-After header on 429 responses when present.\n  if (response?.status === 429) {\n    const header = response.headers.get('retry-after')\n    const seconds = header ? parseInt(header, 10) : NaN\n    if (!Number.isNaN(seconds) && seconds > 0) return Math.min(seconds * 1000, 10000)\n  }\n  // Exponential backoff: 500ms, 1s, 2s, ... capped at 8s.\n  return Math.min(8000, 500 * 2 ** attempt)\n}\n\n/**\n * fetch() with a timeout and automatic retries for transient failures.\n *\n * Non-transient responses (2xx, 3xx, and 4xx other than 429) are returned to\n * the caller as-is — only 429/5xx and thrown network/timeout errors are retried.\n * If every attempt fails with a thrown error, the last error is re-thrown.\n */\nexport async function fetchWithRetry(\n  url: string,\n  init: RequestInit,\n  options: FetchRetryOptions = {},\n): Promise<Response> {\n  const retries = options.retries ?? 2\n  const timeoutMs = options.timeoutMs ?? 15000\n  let lastError: unknown\n\n  for (let attempt = 0; attempt <= retries; attempt++) {\n    const controller = new AbortController()\n    const timer = setTimeout(() => controller.abort(), timeoutMs)\n    try {\n      const response = await fetch(url, { ...init, signal: controller.signal })\n      clearTimeout(timer)\n\n      if ((response.status === 429 || response.status >= 500) && attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt, response)))\n        continue\n      }\n      return response\n    } catch (error) {\n      clearTimeout(timer)\n      lastError = error\n      // Network failure or timeout (AbortController) — retry while attempts remain.\n      if (attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt)))\n        continue\n      }\n    }\n  }\n\n  throw lastError instanceof Error\n    ? lastError\n    : new Error('Network request failed after multiple attempts. Please try again.')\n}\n","/**\n * @sonordev/site-kit shared - Canonical client transport\n *\n * Single source of truth for how site-kit talks to Sonor from the browser.\n * Every client-side module (analytics, forms, commerce, engage, maps, images,\n * SitemapSync) routes through here instead of bare fetch(), which gives the\n * whole kit, in one place:\n *\n *  - per-attempt timeout + retry with backoff (via fetchWithRetry) — a hung\n *    request left to the browser's own network timeout logs a console error\n *    (net::ERR_TIMED_OUT) that fails Lighthouse best-practices\n *  - the x-sitekit-version header on every request, so the platform can see\n *    which kit version each site actually runs from live traffic\n *  - CREDENTIAL LIFECYCLE: sites on 3.2+ ship a short-lived minted token instead\n *    of the raw key. This transport resolves the freshest token (refreshing a\n *    stale seed transparently), and on a 401/403 for a token it refreshes once\n *    and retries before giving up. A raw key (2.x kit, or the mint-failed\n *    fallback) is a pure passthrough — legacy behavior is unchanged.\n *  - an auth circuit breaker: after a 401/403 the credential is paused for a few\n *    minutes and ONE friendly console.info is emitted — a site on a stale or\n *    canceled key must not spam the API or the visitor's console. Keyed by the\n *    project (from the token) so it survives token rotation.\n *  - sonorBeacon for unload-time telemetry that keeps the credential in headers;\n *    navigator.sendBeacon can't set headers and forced the key into the URL,\n *    where server and CDN access logs capture it\n *\n * Non-idempotent endpoints (checkout, payment intents, uploads) must pass\n * { retries: 0 } — they still get the timeout, but never an automatic retry.\n */\nimport { fetchWithRetry, type FetchRetryOptions } from './fetchWithRetry'\nimport { SITE_KIT_VERSION } from './version'\nimport {\n  credentialBreakerId,\n  currentCredential,\n  getFreshCredential,\n  isSiteToken,\n  isTokenMode,\n  refreshSiteToken,\n} from './siteToken'\n\nexport interface SonorFetchOptions extends FetchRetryOptions {\n  /** Project credential — the minted token (3.2+) or raw key. Sent as x-api-key. */\n  apiKey?: string\n}\n\n/** How long a credential stays paused after an auth failure. */\nconst AUTH_BREAK_MS = 5 * 60_000\n\n// breaker id → epoch ms until which requests are paused. Shared on window for\n// the same reason as the token state (see siteToken.ts): duplicated module\n// copies must trip and observe ONE breaker, not one each. Never applies on the\n// server, so a per-module Map there is fine.\nconst BREAKER_STATE_KEY = '__SONOR_AUTH_BREAKER__'\nconst pausedKeys: Map<string, number> = (() => {\n  if (typeof window === 'undefined') return new Map()\n  const w = window as unknown as Record<string, Map<string, number> | undefined>\n  return (w[BREAKER_STATE_KEY] ??= new Map())\n})()\nlet warnedThisPage = false\n\n/** True when a previous 401/403 has paused this credential (browser only). */\nexport function isAuthPaused(credential?: string): boolean {\n  if (typeof window === 'undefined') return false\n  const id = credentialBreakerId(credential)\n  const until = pausedKeys.get(id)\n  if (!until) return false\n  if (Date.now() >= until) {\n    pausedKeys.delete(id)\n    return false\n  }\n  return true\n}\n\nfunction tripBreaker(credential?: string): void {\n  pausedKeys.set(credentialBreakerId(credential), Date.now() + AUTH_BREAK_MS)\n  if (!warnedThisPage) {\n    warnedThisPage = true\n    // info, not error: a visitor's console must stay clean (Lighthouse\n    // errors-in-console), and copy never names env vars or key formats.\n    console.info(\n      \"[Sonor] This site couldn't authenticate with Sonor, so data features are paused for a few minutes. If this keeps happening, the site is likely running an outdated API key.\",\n    )\n  }\n}\n\nexport async function sonorFetch(\n  url: string,\n  init: RequestInit = {},\n  options: SonorFetchOptions = {},\n): Promise<Response> {\n  // Resolve the credential to send. In token mode this may transparently refresh\n  // a stale seed before the first request; in raw-key mode it's a passthrough.\n  let credential = options.apiKey\n  if (credential !== undefined || isTokenMode()) {\n    credential = await getFreshCredential(options.apiKey)\n  }\n\n  const headers = new Headers(init.headers || {})\n  headers.set('x-sitekit-version', SITE_KIT_VERSION)\n  if (credential) {\n    if (isTokenMode()) {\n      // Token mode: `credential` is the freshest token (refreshed just above if\n      // the seed was stale). It MUST override any x-api-key a caller hand-set — a\n      // stale build-time seed passed as a header would otherwise pin the request\n      // and defeat refresh entirely. Also drop a caller-set Authorization:\n      // extractApiKey() server-side prefers `Authorization: Bearer` over\n      // x-api-key, so a stale Bearer seed would win even once we set a fresh\n      // x-api-key. This is the single place the client credential is chosen — do\n      // not re-attach it as a header at call sites.\n      headers.set('x-api-key', credential)\n      headers.delete('authorization')\n    } else if (!headers.has('x-api-key')) {\n      // Raw-key mode: legacy passthrough — respect a caller-supplied header.\n      headers.set('x-api-key', credential)\n    }\n  }\n\n  if (isAuthPaused(credential)) {\n    // Synthetic response keeps every caller's !response.ok path working\n    // without a network round trip while the breaker is open.\n    return new Response(null, { status: 401, statusText: 'sonor-auth-paused' })\n  }\n\n  let response = await fetchWithRetry(url, { ...init, headers }, options)\n\n  // A token can rotate or expire mid-session. On the first auth failure, try ONE\n  // refresh + retry before tripping the breaker — only for token credentials\n  // (raw keys have nothing to refresh).\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    isSiteToken(credential)\n  ) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed && refreshed !== credential) {\n      const retryHeaders = new Headers(init.headers || {})\n      retryHeaders.set('x-sitekit-version', SITE_KIT_VERSION)\n      retryHeaders.set('x-api-key', refreshed)\n      // Same reason as the initial request: a caller-set stale Bearer would win\n      // over our fresh x-api-key server-side, so strip it on the retry too.\n      retryHeaders.delete('authorization')\n      credential = refreshed\n      response = await fetchWithRetry(url, { ...init, headers: retryHeaders }, options)\n    }\n  }\n\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    credential\n  ) {\n    tripBreaker(credential)\n  }\n\n  return response\n}\n\n/**\n * Fire-and-forget telemetry that survives page unload.\n *\n * Uses fetch({ keepalive: true }) so auth travels in headers. Falls back to\n * navigator.sendBeacon (no auth headers possible — the server may reject it,\n * but we never put the key in the URL) only when keepalive fetch is missing.\n *\n * Cannot await a refresh at unload time, so it sends the freshest token already\n * held (currentCredential) rather than the possibly-stale seed the caller passed.\n */\nexport function sonorBeacon(url: string, payload: unknown, apiKey?: string): void {\n  const credential = currentCredential(apiKey)\n  const body = typeof payload === 'string' ? payload : JSON.stringify(payload)\n  try {\n    void fetch(url, {\n      method: 'POST',\n      keepalive: true,\n      headers: {\n        'Content-Type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        ...(credential ? { 'x-api-key': credential } : {}),\n      },\n      body,\n    }).catch(() => {\n      /* page is closing — best effort */\n    })\n  } catch {\n    try {\n      if (typeof navigator !== 'undefined' && navigator.sendBeacon) {\n        navigator.sendBeacon(url, new Blob([body], { type: 'application/json' }))\n      }\n    } catch {\n      /* nothing left to try */\n    }\n  }\n}\n"]}
+{"version":3,"sources":["../src/shared/fetchWithRetry.ts","../src/shared/sonorFetch.ts"],"names":[],"mappings":";;;;AAsBA,SAAS,YAAA,CAAa,SAAiB,QAAA,EAA6B;AAElE,EAAA,IAAI,QAAA,EAAU,WAAW,GAAA,EAAK;AAC5B,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,MAAA,GAAS,QAAA,CAAS,MAAA,EAAQ,EAAE,CAAA,GAAI,GAAA;AAChD,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,IAAK,OAAA,GAAU,CAAA,EAAG,OAAO,IAAA,CAAK,GAAA,CAAI,OAAA,GAAU,GAAA,EAAM,GAAK,CAAA;AAAA,EAClF;AAEA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,GAAA,EAAM,GAAA,GAAM,KAAK,OAAO,CAAA;AAC1C;AASA,eAAsB,cAAA,CACpB,GAAA,EACA,IAAA,EACA,OAAA,GAA6B,EAAC,EACX;AACnB,EAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,IAAA;AACvC,EAAA,IAAI,SAAA;AAEJ,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,OAAA,EAAS,OAAA,EAAA,EAAW;AACnD,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,MAAA,YAAA,CAAa,KAAK,CAAA;AAElB,MAAA,IAAA,CAAK,SAAS,MAAA,KAAW,GAAA,IAAO,SAAS,MAAA,IAAU,GAAA,KAAQ,UAAU,OAAA,EAAS;AAC5E,QAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY,UAAA,CAAW,SAAS,YAAA,CAAa,OAAA,EAAS,QAAQ,CAAC,CAAC,CAAA;AACnF,QAAA;AAAA,MACF;AACA,MAAA,OAAO,QAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,SAAA,GAAY,KAAA;AAEZ,MAAA,IAAI,UAAU,OAAA,EAAS;AACrB,QAAA,MAAM,IAAI,QAAQ,CAAC,OAAA,KAAY,WAAW,OAAA,EAAS,YAAA,CAAa,OAAO,CAAC,CAAC,CAAA;AACzE,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,YAAqB,KAAA,GACvB,SAAA,GACA,IAAI,MAAM,mEAAmE,CAAA;AACnF;;;AC7BA,IAAM,gBAAgB,CAAA,GAAI,GAAA;AAM1B,IAAM,iBAAA,GAAoB,wBAAA;AAC1B,IAAM,cAAmC,MAAM;AAC7C,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,2BAAW,GAAA,EAAI;AAClD,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,CAAA,CAAA,iBAAA,CAAA,KAAA,CAAA,CAAA,iBAAA,CAAA,uBAA6B,GAAA,EAAI,CAAA;AAC3C,CAAA,GAAG;AACH,IAAI,cAAA,GAAiB,KAAA;AAGd,SAAS,aAAa,UAAA,EAA8B;AACzD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,MAAM,EAAA,GAAK,oBAAoB,UAAU,CAAA;AACzC,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,EAAE,CAAA;AAC/B,EAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,EAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,KAAA,EAAO;AACvB,IAAA,UAAA,CAAW,OAAO,EAAE,CAAA;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,YAAY,UAAA,EAA2B;AAC9C,EAAA,UAAA,CAAW,IAAI,mBAAA,CAAoB,UAAU,GAAG,IAAA,CAAK,GAAA,KAAQ,aAAa,CAAA;AAC1E,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,cAAA,GAAiB,IAAA;AAGjB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AACF;AAEA,eAAsB,WACpB,GAAA,EACA,IAAA,GAAoB,EAAC,EACrB,OAAA,GAA6B,EAAC,EACX;AAGnB,EAAA,IAAI,aAAa,OAAA,CAAQ,MAAA;AACzB,EAAA,IAAI,UAAA,KAAe,MAAA,IAAa,WAAA,EAAY,EAAG;AAC7C,IAAA,UAAA,GAAa,MAAM,kBAAA,CAAmB,OAAA,CAAQ,MAAM,CAAA;AAAA,EACtD;AAEA,EAAA,MAAM,UAAU,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAC9C,EAAA,OAAA,CAAQ,GAAA,CAAI,qBAAqB,gBAAgB,CAAA;AACjD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,IAAI,aAAY,EAAG;AASjB,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AACnC,MAAA,OAAA,CAAQ,OAAO,eAAe,CAAA;AAAA,IAChC,CAAA,MAAA,IAAW,CAAC,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG;AAEpC,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AAAA,IACrC;AAAA,EACF;AAEA,EAAA,IAAI,YAAA,CAAa,UAAU,CAAA,EAAG;AAG5B,IAAA,OAAO,IAAI,SAAS,IAAA,EAAM,EAAE,QAAQ,GAAA,EAAK,UAAA,EAAY,qBAAqB,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,QAAA,GAAW,MAAM,cAAA,CAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAQ,EAAG,OAAO,CAAA;AAKtE,EAAA,IAAA,CACG,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,QAAA,CAAS,MAAA,KAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClB,WAAA,CAAY,UAAU,CAAA,EACtB;AACA,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,SAAA,IAAa,cAAc,UAAA,EAAY;AACzC,MAAA,MAAM,eAAe,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AACnD,MAAA,YAAA,CAAa,GAAA,CAAI,qBAAqB,gBAAgB,CAAA;AACtD,MAAA,YAAA,CAAa,GAAA,CAAI,aAAa,SAAS,CAAA;AAGvC,MAAA,YAAA,CAAa,OAAO,eAAe,CAAA;AACnC,MAAA,UAAA,GAAa,SAAA;AACb,MAAA,QAAA,GAAW,MAAM,eAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,YAAA,EAAa,EAAG,OAAO,CAAA;AAAA,IAClF;AAAA,EACF;AAEA,EAAA,IAAA,CACG,QAAA,CAAS,WAAW,GAAA,IAAO,QAAA,CAAS,WAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClB,UAAA,EACA;AACA,IAAA,WAAA,CAAY,UAAU,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,QAAA;AACT;AAYO,SAAS,WAAA,CAAY,GAAA,EAAa,OAAA,EAAkB,MAAA,EAAuB;AAChF,EAAA,MAAM,UAAA,GAAa,kBAAkB,MAAM,CAAA;AAC3C,EAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,IAAA,CAAK,UAAU,OAAO,CAAA;AAC3E,EAAA,IAAI;AACF,IAAA,KAAK,MAAM,GAAA,EAAK;AAAA,MACd,MAAA,EAAQ,MAAA;AAAA,MACR,SAAA,EAAW,IAAA;AAAA,MACX,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqB,gBAAA;AAAA,QACrB,GAAI,UAAA,GAAa,EAAE,WAAA,EAAa,UAAA,KAAe;AAAC,OAClD;AAAA,MACA;AAAA,KACD,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAEf,CAAC,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AACN,IAAA,IAAI;AACF,MAAA,IAAI,OAAO,SAAA,KAAc,WAAA,IAAe,SAAA,CAAU,UAAA,EAAY;AAC5D,QAAA,SAAA,CAAU,UAAA,CAAW,GAAA,EAAK,IAAI,IAAA,CAAK,CAAC,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,kBAAA,EAAoB,CAAC,CAAA;AAAA,MAC1E;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACF","file":"chunk-UDHQNYBD.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared - Resilient fetch\n *\n * Single source of truth for client-side resilient fetch (forms, SitemapSync).\n * Adds a per-attempt timeout and retries transient failures (network errors,\n * request timeouts, HTTP 429, and 5xx) with exponential backoff.\n *\n * A form submission must survive a brief API blip — a deploy, a cold start, a\n * dropped packet. A single un-retried fetch turning into \"Something went wrong\"\n * is how leads get lost. The explicit abort also matters on its own: a request\n * left to hang until the browser's own network timeout logs a console error\n * (net::ERR_TIMED_OUT) that fails Lighthouse best-practices; an aborted fetch\n * logs nothing.\n */\n\nexport interface FetchRetryOptions {\n  /** Number of retries AFTER the first attempt (default 2 → up to 3 tries total). */\n  retries?: number\n  /** Per-attempt timeout in milliseconds (default 15000). */\n  timeoutMs?: number\n}\n\nfunction backoffDelay(attempt: number, response?: Response): number {\n  // Honor a Retry-After header on 429 responses when present.\n  if (response?.status === 429) {\n    const header = response.headers.get('retry-after')\n    const seconds = header ? parseInt(header, 10) : NaN\n    if (!Number.isNaN(seconds) && seconds > 0) return Math.min(seconds * 1000, 10000)\n  }\n  // Exponential backoff: 500ms, 1s, 2s, ... capped at 8s.\n  return Math.min(8000, 500 * 2 ** attempt)\n}\n\n/**\n * fetch() with a timeout and automatic retries for transient failures.\n *\n * Non-transient responses (2xx, 3xx, and 4xx other than 429) are returned to\n * the caller as-is — only 429/5xx and thrown network/timeout errors are retried.\n * If every attempt fails with a thrown error, the last error is re-thrown.\n */\nexport async function fetchWithRetry(\n  url: string,\n  init: RequestInit,\n  options: FetchRetryOptions = {},\n): Promise<Response> {\n  const retries = options.retries ?? 2\n  const timeoutMs = options.timeoutMs ?? 15000\n  let lastError: unknown\n\n  for (let attempt = 0; attempt <= retries; attempt++) {\n    const controller = new AbortController()\n    const timer = setTimeout(() => controller.abort(), timeoutMs)\n    try {\n      const response = await fetch(url, { ...init, signal: controller.signal })\n      clearTimeout(timer)\n\n      if ((response.status === 429 || response.status >= 500) && attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt, response)))\n        continue\n      }\n      return response\n    } catch (error) {\n      clearTimeout(timer)\n      lastError = error\n      // Network failure or timeout (AbortController) — retry while attempts remain.\n      if (attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt)))\n        continue\n      }\n    }\n  }\n\n  throw lastError instanceof Error\n    ? lastError\n    : new Error('Network request failed after multiple attempts. Please try again.')\n}\n","/**\n * @sonordev/site-kit shared - Canonical client transport\n *\n * Single source of truth for how site-kit talks to Sonor from the browser.\n * Every client-side module (analytics, forms, commerce, engage, maps, images,\n * SitemapSync) routes through here instead of bare fetch(), which gives the\n * whole kit, in one place:\n *\n *  - per-attempt timeout + retry with backoff (via fetchWithRetry) — a hung\n *    request left to the browser's own network timeout logs a console error\n *    (net::ERR_TIMED_OUT) that fails Lighthouse best-practices\n *  - the x-sitekit-version header on every request, so the platform can see\n *    which kit version each site actually runs from live traffic\n *  - CREDENTIAL LIFECYCLE: sites on 3.2+ ship a short-lived minted token instead\n *    of the raw key. This transport resolves the freshest token (refreshing a\n *    stale seed transparently), and on a 401/403 for a token it refreshes once\n *    and retries before giving up. A raw key (2.x kit, or the mint-failed\n *    fallback) is a pure passthrough — legacy behavior is unchanged.\n *  - an auth circuit breaker: after a 401/403 the credential is paused for a few\n *    minutes and ONE friendly console.info is emitted — a site on a stale or\n *    canceled key must not spam the API or the visitor's console. Keyed by the\n *    project (from the token) so it survives token rotation.\n *  - sonorBeacon for unload-time telemetry that keeps the credential in headers;\n *    navigator.sendBeacon can't set headers and forced the key into the URL,\n *    where server and CDN access logs capture it\n *\n * Non-idempotent endpoints (checkout, payment intents, uploads) must pass\n * { retries: 0 } — they still get the timeout, but never an automatic retry.\n */\nimport { fetchWithRetry, type FetchRetryOptions } from './fetchWithRetry'\nimport { SITE_KIT_VERSION } from './version'\nimport {\n  credentialBreakerId,\n  currentCredential,\n  getFreshCredential,\n  isSiteToken,\n  isTokenMode,\n  refreshSiteToken,\n} from './siteToken'\n\nexport interface SonorFetchOptions extends FetchRetryOptions {\n  /** Project credential — the minted token (3.2+) or raw key. Sent as x-api-key. */\n  apiKey?: string\n}\n\n/** How long a credential stays paused after an auth failure. */\nconst AUTH_BREAK_MS = 5 * 60_000\n\n// breaker id → epoch ms until which requests are paused. Shared on window for\n// the same reason as the token state (see siteToken.ts): duplicated module\n// copies must trip and observe ONE breaker, not one each. Never applies on the\n// server, so a per-module Map there is fine.\nconst BREAKER_STATE_KEY = '__SONOR_AUTH_BREAKER__'\nconst pausedKeys: Map<string, number> = (() => {\n  if (typeof window === 'undefined') return new Map()\n  const w = window as unknown as Record<string, Map<string, number> | undefined>\n  return (w[BREAKER_STATE_KEY] ??= new Map())\n})()\nlet warnedThisPage = false\n\n/** True when a previous 401/403 has paused this credential (browser only). */\nexport function isAuthPaused(credential?: string): boolean {\n  if (typeof window === 'undefined') return false\n  const id = credentialBreakerId(credential)\n  const until = pausedKeys.get(id)\n  if (!until) return false\n  if (Date.now() >= until) {\n    pausedKeys.delete(id)\n    return false\n  }\n  return true\n}\n\nfunction tripBreaker(credential?: string): void {\n  pausedKeys.set(credentialBreakerId(credential), Date.now() + AUTH_BREAK_MS)\n  if (!warnedThisPage) {\n    warnedThisPage = true\n    // info, not error: a visitor's console must stay clean (Lighthouse\n    // errors-in-console), and copy never names env vars or key formats.\n    console.info(\n      \"[Sonor] This site couldn't authenticate with Sonor, so data features are paused for a few minutes. If this keeps happening, the site is likely running an outdated API key.\",\n    )\n  }\n}\n\nexport async function sonorFetch(\n  url: string,\n  init: RequestInit = {},\n  options: SonorFetchOptions = {},\n): Promise<Response> {\n  // Resolve the credential to send. In token mode this may transparently refresh\n  // a stale seed before the first request; in raw-key mode it's a passthrough.\n  let credential = options.apiKey\n  if (credential !== undefined || isTokenMode()) {\n    credential = await getFreshCredential(options.apiKey)\n  }\n\n  const headers = new Headers(init.headers || {})\n  headers.set('x-sitekit-version', SITE_KIT_VERSION)\n  if (credential) {\n    if (isTokenMode()) {\n      // Token mode: `credential` is the freshest token (refreshed just above if\n      // the seed was stale). It MUST override any x-api-key a caller hand-set — a\n      // stale build-time seed passed as a header would otherwise pin the request\n      // and defeat refresh entirely. Also drop a caller-set Authorization:\n      // extractApiKey() server-side prefers `Authorization: Bearer` over\n      // x-api-key, so a stale Bearer seed would win even once we set a fresh\n      // x-api-key. This is the single place the client credential is chosen — do\n      // not re-attach it as a header at call sites.\n      headers.set('x-api-key', credential)\n      headers.delete('authorization')\n    } else if (!headers.has('x-api-key')) {\n      // Raw-key mode: legacy passthrough — respect a caller-supplied header.\n      headers.set('x-api-key', credential)\n    }\n  }\n\n  if (isAuthPaused(credential)) {\n    // Synthetic response keeps every caller's !response.ok path working\n    // without a network round trip while the breaker is open.\n    return new Response(null, { status: 401, statusText: 'sonor-auth-paused' })\n  }\n\n  let response = await fetchWithRetry(url, { ...init, headers }, options)\n\n  // A token can rotate or expire mid-session. On the first auth failure, try ONE\n  // refresh + retry before tripping the breaker — only for token credentials\n  // (raw keys have nothing to refresh).\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    isSiteToken(credential)\n  ) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed && refreshed !== credential) {\n      const retryHeaders = new Headers(init.headers || {})\n      retryHeaders.set('x-sitekit-version', SITE_KIT_VERSION)\n      retryHeaders.set('x-api-key', refreshed)\n      // Same reason as the initial request: a caller-set stale Bearer would win\n      // over our fresh x-api-key server-side, so strip it on the retry too.\n      retryHeaders.delete('authorization')\n      credential = refreshed\n      response = await fetchWithRetry(url, { ...init, headers: retryHeaders }, options)\n    }\n  }\n\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    credential\n  ) {\n    tripBreaker(credential)\n  }\n\n  return response\n}\n\n/**\n * Fire-and-forget telemetry that survives page unload.\n *\n * Uses fetch({ keepalive: true }) so auth travels in headers. Falls back to\n * navigator.sendBeacon (no auth headers possible — the server may reject it,\n * but we never put the key in the URL) only when keepalive fetch is missing.\n *\n * Cannot await a refresh at unload time, so it sends the freshest token already\n * held (currentCredential) rather than the possibly-stale seed the caller passed.\n */\nexport function sonorBeacon(url: string, payload: unknown, apiKey?: string): void {\n  const credential = currentCredential(apiKey)\n  const body = typeof payload === 'string' ? payload : JSON.stringify(payload)\n  try {\n    void fetch(url, {\n      method: 'POST',\n      keepalive: true,\n      headers: {\n        'Content-Type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        ...(credential ? { 'x-api-key': credential } : {}),\n      },\n      body,\n    }).catch(() => {\n      /* page is closing — best effort */\n    })\n  } catch {\n    try {\n      if (typeof navigator !== 'undefined' && navigator.sendBeacon) {\n        navigator.sendBeacon(url, new Blob([body], { type: 'application/json' }))\n      }\n    } catch {\n      /* nothing left to try */\n    }\n  }\n}\n"]}

package/dist/{chunk-WHVUSVHA.js → chunk-UTANIZUO.js}

@@ -10,7 +10,7 @@ function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 var React__default = /*#__PURE__*/_interopDefault(React);
 
 var InteractiveForm = React.lazy(
-  () => import('./ManagedForm-XWN3TVQQ.js').then((m) => ({ default: m.ManagedForm }))
+  () => import('./ManagedForm-D2JT3QV3.js').then((m) => ({ default: m.ManagedForm }))
 );
 function FormEnhancer({
   formId,
@@ -106,5 +106,5 @@ function EnterStyles() {
 }
 
 exports.FormEnhancer = FormEnhancer;
-//# sourceMappingURL=chunk-WHVUSVHA.js.map
-//# sourceMappingURL=chunk-WHVUSVHA.js.map
+//# sourceMappingURL=chunk-UTANIZUO.js.map
+//# sourceMappingURL=chunk-UTANIZUO.js.map

package/dist/{chunk-WHVUSVHA.js.map → chunk-UTANIZUO.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/forms/FormEnhancer.tsx"],"names":["lazy","useDeferredActivation","useState","jsxs","jsx","Suspense","React","useRef","useEffect"],"mappings":";;;;;;;;;;AAkDA,IAAM,eAAA,GAAkBA,UAAA;AAAA,EAAK,MAC3B,OAAO,2BAAe,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,MAAO,EAAE,OAAA,EAAS,CAAA,CAAE,WAAA,EAAY,CAAE;AAClE,CAAA;AA8BO,SAAS,YAAA,CAAa;AAAA,EAC3B,MAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,cAAA;AAAA,EACA,UAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA,GAAQ,MAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR;AACF,CAAA,EAAsB;AACpB,EAAA,MAAM,KAAA,GAAQC,uCAAsB,KAAK,CAAA;AAGzC,EAAA,MAAM,CAAC,QAAA,EAAU,WAAW,CAAA,GAAIC,eAAS,KAAK,CAAA;AAE9C,EAAA,uBACEC,eAAA;AAAA,IAAC,KAAA;AAAA,IAAA;AAAA,MACC,oBAAA,EAAoB,WAAW,UAAA,GAAa,OAAA;AAAA,MAC5C,cAAA,EAAa,YAAA;AAAA,MACb,KAAA,EAAO,KAAA,KAAU,MAAA,GAAS,SAAA,GAAY,MAAA;AAAA,MAErC,QAAA,EAAA;AAAA,QAAA,KAAA,KAAU,MAAA,mCAAW,WAAA,EAAA,EAAY,CAAA;AAAA,QACjC,KAAA,mBACCC,cAAA,CAACC,cAAA,EAAA,EAAS,QAAA,EAAU,QAAA,EAClB,QAAA,kBAAAD,cAAA,CAAC,QAAA,EAAA,EAAS,OAAA,EAAS,MAAM,WAAA,CAAY,IAAI,CAAA,EAAG,UAAU,QAAA,EACpD,QAAA,kBAAAA,cAAA;AAAA,UAAC,eAAA;AAAA,UAAA;AAAA,YACC,MAAA;AAAA,YACA,aAAA;AAAA,YACA,SAAA;AAAA,YACA,cAAA;AAAA,YACA,UAAA;AAAA,YACA,aAAA;AAAA,YACA,SAAA;AAAA,YACA;AAAA;AAAA,SACF,EACF,GACF,CAAA,GAEA;AAAA;AAAA;AAAA,GAEJ;AAEJ;AAOA,IAAM,QAAA,GAAN,cAAuBE,sBAAA,CAAM,SAAA,CAG3B;AAAA,EAHF,WAAA,GAAA;AAAA,IAAA,KAAA,CAAA,GAAA,SAAA,CAAA;AAIE,IAAA,IAAA,CAAA,KAAA,GAAQ,EAAE,QAAQ,KAAA,EAAM;AAAA,EAAA;AAAA,EAExB,OAAO,wBAAA,GAA2B;AAChC,IAAA,OAAO,EAAE,QAAQ,IAAA,EAAK;AAAA,EACxB;AAAA,EAEA,kBAAkB,GAAA,EAAc;AAC9B,IAAA,OAAA,CAAQ,KAAA,CAAM,wDAAwD,GAAG,CAAA;AAAA,EAC3E;AAAA,EAEA,iBAAA,GAAoB;AAClB,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,IAAA,CAAK,MAAM,OAAA,EAAQ;AAAA,EAC7C;AAAA,EAEA,MAAA,GAAS;AACP,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,OAAO,KAAK,KAAA,CAAM,QAAA;AACzC,IAAA,uBAAOF,cAAA,CAAC,QAAA,EAAA,EAAU,QAAA,EAAA,IAAA,CAAK,KAAA,CAAM,QAAA,EAAS,CAAA;AAAA,EACxC;AACF,CAAA;AAGA,SAAS,QAAA,CAAS,EAAE,QAAA,EAAS,EAAkC;AAC7D,EAAA,MAAM,GAAA,GAAMG,aAAuB,IAAI,CAAA;AACvC,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,MAAM,KAAK,GAAA,CAAI,OAAA;AACf,IAAA,IAAI,CAAC,EAAA,EAAI;AACT,IAAA,EAAA,CAAG,YAAA,CAAa,iBAAiB,EAAE,CAAA;AACnC,IAAA,MAAM,KAAK,qBAAA,CAAsB,MAAM,EAAA,CAAG,eAAA,CAAgB,eAAe,CAAC,CAAA;AAC1E,IAAA,OAAO,MAAM,qBAAqB,EAAE,CAAA;AAAA,EACtC,CAAA,EAAG,EAAE,CAAA;AACL,EAAA,uBACEJ,cAAA,CAAC,SAAI,GAAA,EAAU,KAAA,EAAO,EAAE,OAAA,EAAS,UAAA,IAC9B,QAAA,EACH,CAAA;AAEJ;AAEA,IAAM,SAAA,GAAiC;AAAA,EACrC,UAAA,EACE;AACJ,CAAA;AAOA,SAAS,WAAA,GAAc;AACrB,EAAA,uBACEA,cAAA;AAAA,IAAC,OAAA;AAAA,IAAA;AAAA,MAEC,uBAAA,EAAyB;AAAA,QACvB,MAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA;AAUV;AAAA,GACF;AAEJ","file":"chunk-WHVUSVHA.js","sourcesContent":["'use client'\n\n/**\n * FormEnhancer — the only client code a managed form needs up front.\n *\n * Renders the server-rendered shell (<StaticForm>, passed as `children`) until\n * an idle/first-interaction gate fires, then lazy-imports the interactive form\n * and swaps it in. Everything expensive — validation, conditional logic,\n * spotlight/stage, celebration, momentum — lives behind that dynamic import,\n * so a page ships this boundary and nothing else in its initial chunk set.\n *\n * The shell is a REAL form the whole time (native action + signed token), so\n * the progression is:\n *\n *   no JS at all      -> shell, submits natively. Works.\n *   JS, pre-idle      -> shell, submits natively. Works.\n *   JS, post-idle     -> enhanced form, submits over JSON. Works, with delight.\n *   chunk 404s        -> shell stays. Works. (Never left blank.)\n *\n * That last line is the invariant to protect: the shell is only removed once\n * the enhancement has actually rendered. Do not \"hide the shell then load\" —\n * a CDN hiccup would leave a visitor staring at an empty box where the form\n * used to be.\n *\n * ── Entrance animation ──────────────────────────────────────────────────\n *\n * Above-the-fold forms upgrade while the visitor is looking at them, so the\n * swap must not pop. The wrapper carries `data-sk-form-mount=\"shell\"` and\n * flips to `\"enhanced\"`, and the enhanced form gets `data-sk-enter` for one\n * frame, so a site can style the transition entirely in CSS:\n *\n *   [data-sk-form-mount] { transition: opacity .35s ease }\n *   [data-sk-form-mount=\"shell\"] { opacity: .6 }\n *\n * Defaults ship as CSS variables rather than hard-coded values:\n *\n *   --sk-form-enter-duration  (default 320ms)\n *   --sk-form-enter-easing    (default cubic-bezier(.22,1,.36,1))\n *   --sk-form-enter-distance  (default 6px)\n *\n * `enter=\"none\"` opts out entirely; `enter=\"custom\"` emits the data\n * attributes but no site-kit styles, leaving the animation to the site.\n * Every default is collapsed by prefers-reduced-motion.\n */\n\nimport React, { lazy, Suspense, useEffect, useRef, useState } from 'react'\nimport { useDeferredActivation } from '../shared/defer'\nimport type { FormExperience, FormSubmission } from './types'\n\n/** The heavy half. Nothing else in this module may import it statically. */\nconst InteractiveForm = lazy(() =>\n  import('./ManagedForm').then((m) => ({ default: m.ManagedForm })),\n)\n\nexport type FormEnterAnimation = 'fade' | 'none' | 'custom'\n\nexport interface FormEnhancerProps {\n  formId: string\n  /** Server-fetched raw config — hands the enhancement its fields instantly. */\n  initialConfig?: Record<string, unknown> | null\n  className?: string\n  nativeReturnTo?: string\n  experience?: FormExperience\n  /** Pre-fill field values by slug. See ManagedForm.defaultValues. */\n  defaultValues?: Record<string, unknown>\n  onSuccess?: (submission: FormSubmission) => void\n  onError?: (error: Error) => void\n  /**\n   * How the enhanced form arrives. 'fade' (default) crossfades and lifts it\n   * into place; 'none' swaps instantly; 'custom' emits the data attributes\n   * and no styles so the site owns the animation.\n   */\n  enter?: FormEnterAnimation\n  /**\n   * Set false to enhance immediately instead of waiting for idle. Only worth\n   * it for a form that is the entire point of the page AND above the fold.\n   */\n  defer?: boolean\n  /** The server-rendered <StaticForm>. Shown until the enhancement mounts. */\n  children: React.ReactNode\n}\n\nexport function FormEnhancer({\n  formId,\n  initialConfig,\n  className,\n  nativeReturnTo,\n  experience,\n  defaultValues,\n  onSuccess,\n  onError,\n  enter = 'fade',\n  defer = true,\n  children,\n}: FormEnhancerProps) {\n  const ready = useDeferredActivation(defer)\n  // Flipped only after the enhancement has actually committed to the DOM, so\n  // the shell never disappears ahead of its replacement.\n  const [enhanced, setEnhanced] = useState(false)\n\n  return (\n    <div\n      data-sk-form-mount={enhanced ? 'enhanced' : 'shell'}\n      data-sk-part=\"form-mount\"\n      style={enter === 'fade' ? FADE_HOST : undefined}\n    >\n      {enter === 'fade' && <EnterStyles />}\n      {ready ? (\n        <Suspense fallback={children}>\n          <Enhanced onMount={() => setEnhanced(true)} fallback={children}>\n            <InteractiveForm\n              formId={formId}\n              initialConfig={initialConfig}\n              className={className}\n              nativeReturnTo={nativeReturnTo}\n              experience={experience}\n              defaultValues={defaultValues}\n              onSuccess={onSuccess}\n              onError={onError}\n            />\n          </Enhanced>\n        </Suspense>\n      ) : (\n        children\n      )}\n    </div>\n  )\n}\n\n/**\n * Reports the moment the enhancement is on screen, and keeps the shell\n * rendered if it throws. An error boundary is the difference between \"the\n * fancy version failed\" and \"there is no form on this page\".\n */\nclass Enhanced extends React.Component<\n  { onMount: () => void; fallback: React.ReactNode; children: React.ReactNode },\n  { failed: boolean }\n> {\n  state = { failed: false }\n\n  static getDerivedStateFromError() {\n    return { failed: true }\n  }\n\n  componentDidCatch(err: unknown) {\n    console.error('[Forms] Enhancement failed; keeping the native form:', err)\n  }\n\n  componentDidMount() {\n    if (!this.state.failed) this.props.onMount()\n  }\n\n  render() {\n    if (this.state.failed) return this.props.fallback\n    return <FrameTag>{this.props.children}</FrameTag>\n  }\n}\n\n/** Adds data-sk-enter for one frame so a CSS transition has something to run. */\nfunction FrameTag({ children }: { children: React.ReactNode }) {\n  const ref = useRef<HTMLDivElement>(null)\n  useEffect(() => {\n    const el = ref.current\n    if (!el) return\n    el.setAttribute('data-sk-enter', '')\n    const id = requestAnimationFrame(() => el.removeAttribute('data-sk-enter'))\n    return () => cancelAnimationFrame(id)\n  }, [])\n  return (\n    <div ref={ref} style={{ display: 'contents' }}>\n      {children}\n    </div>\n  )\n}\n\nconst FADE_HOST: React.CSSProperties = {\n  transition:\n    'opacity var(--sk-form-enter-duration, 320ms) var(--sk-form-enter-easing, cubic-bezier(.22,1,.36,1))',\n}\n\n/**\n * Scoped to [data-sk-part=\"form-mount\"] so it can never touch a site's own\n * markup. Emitted once per form; identical text dedupes in every browser's\n * style cache and gzips to nothing.\n */\nfunction EnterStyles() {\n  return (\n    <style\n      // biome-ignore lint/security/noDangerouslySetInnerHtml: static string, no interpolation\n      dangerouslySetInnerHTML={{\n        __html: `\n[data-sk-part=\"form-mount\"][data-sk-form-mount=\"shell\"]{opacity:.55}\n[data-sk-part=\"form-mount\"][data-sk-form-mount=\"enhanced\"]{opacity:1}\n[data-sk-part=\"form-mount\"] [data-sk-enter]{opacity:0;transform:translateY(var(--sk-form-enter-distance,6px))}\n[data-sk-part=\"form-mount\"] [data-sk-enter] *{transition:none!important}\n@media (prefers-reduced-motion: reduce){\n[data-sk-part=\"form-mount\"]{transition:none!important}\n[data-sk-part=\"form-mount\"][data-sk-form-mount=\"shell\"]{opacity:1}\n[data-sk-part=\"form-mount\"] [data-sk-enter]{opacity:1;transform:none}\n}`,\n      }}\n    />\n  )\n}\n"]}
+{"version":3,"sources":["../src/forms/FormEnhancer.tsx"],"names":["lazy","useDeferredActivation","useState","jsxs","jsx","Suspense","React","useRef","useEffect"],"mappings":";;;;;;;;;;AAkDA,IAAM,eAAA,GAAkBA,UAAA;AAAA,EAAK,MAC3B,OAAO,2BAAe,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,MAAO,EAAE,OAAA,EAAS,CAAA,CAAE,WAAA,EAAY,CAAE;AAClE,CAAA;AA8BO,SAAS,YAAA,CAAa;AAAA,EAC3B,MAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,cAAA;AAAA,EACA,UAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA,GAAQ,MAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR;AACF,CAAA,EAAsB;AACpB,EAAA,MAAM,KAAA,GAAQC,uCAAsB,KAAK,CAAA;AAGzC,EAAA,MAAM,CAAC,QAAA,EAAU,WAAW,CAAA,GAAIC,eAAS,KAAK,CAAA;AAE9C,EAAA,uBACEC,eAAA;AAAA,IAAC,KAAA;AAAA,IAAA;AAAA,MACC,oBAAA,EAAoB,WAAW,UAAA,GAAa,OAAA;AAAA,MAC5C,cAAA,EAAa,YAAA;AAAA,MACb,KAAA,EAAO,KAAA,KAAU,MAAA,GAAS,SAAA,GAAY,MAAA;AAAA,MAErC,QAAA,EAAA;AAAA,QAAA,KAAA,KAAU,MAAA,mCAAW,WAAA,EAAA,EAAY,CAAA;AAAA,QACjC,KAAA,mBACCC,cAAA,CAACC,cAAA,EAAA,EAAS,QAAA,EAAU,QAAA,EAClB,QAAA,kBAAAD,cAAA,CAAC,QAAA,EAAA,EAAS,OAAA,EAAS,MAAM,WAAA,CAAY,IAAI,CAAA,EAAG,UAAU,QAAA,EACpD,QAAA,kBAAAA,cAAA;AAAA,UAAC,eAAA;AAAA,UAAA;AAAA,YACC,MAAA;AAAA,YACA,aAAA;AAAA,YACA,SAAA;AAAA,YACA,cAAA;AAAA,YACA,UAAA;AAAA,YACA,aAAA;AAAA,YACA,SAAA;AAAA,YACA;AAAA;AAAA,SACF,EACF,GACF,CAAA,GAEA;AAAA;AAAA;AAAA,GAEJ;AAEJ;AAOA,IAAM,QAAA,GAAN,cAAuBE,sBAAA,CAAM,SAAA,CAG3B;AAAA,EAHF,WAAA,GAAA;AAAA,IAAA,KAAA,CAAA,GAAA,SAAA,CAAA;AAIE,IAAA,IAAA,CAAA,KAAA,GAAQ,EAAE,QAAQ,KAAA,EAAM;AAAA,EAAA;AAAA,EAExB,OAAO,wBAAA,GAA2B;AAChC,IAAA,OAAO,EAAE,QAAQ,IAAA,EAAK;AAAA,EACxB;AAAA,EAEA,kBAAkB,GAAA,EAAc;AAC9B,IAAA,OAAA,CAAQ,KAAA,CAAM,wDAAwD,GAAG,CAAA;AAAA,EAC3E;AAAA,EAEA,iBAAA,GAAoB;AAClB,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,IAAA,CAAK,MAAM,OAAA,EAAQ;AAAA,EAC7C;AAAA,EAEA,MAAA,GAAS;AACP,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,OAAO,KAAK,KAAA,CAAM,QAAA;AACzC,IAAA,uBAAOF,cAAA,CAAC,QAAA,EAAA,EAAU,QAAA,EAAA,IAAA,CAAK,KAAA,CAAM,QAAA,EAAS,CAAA;AAAA,EACxC;AACF,CAAA;AAGA,SAAS,QAAA,CAAS,EAAE,QAAA,EAAS,EAAkC;AAC7D,EAAA,MAAM,GAAA,GAAMG,aAAuB,IAAI,CAAA;AACvC,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,MAAM,KAAK,GAAA,CAAI,OAAA;AACf,IAAA,IAAI,CAAC,EAAA,EAAI;AACT,IAAA,EAAA,CAAG,YAAA,CAAa,iBAAiB,EAAE,CAAA;AACnC,IAAA,MAAM,KAAK,qBAAA,CAAsB,MAAM,EAAA,CAAG,eAAA,CAAgB,eAAe,CAAC,CAAA;AAC1E,IAAA,OAAO,MAAM,qBAAqB,EAAE,CAAA;AAAA,EACtC,CAAA,EAAG,EAAE,CAAA;AACL,EAAA,uBACEJ,cAAA,CAAC,SAAI,GAAA,EAAU,KAAA,EAAO,EAAE,OAAA,EAAS,UAAA,IAC9B,QAAA,EACH,CAAA;AAEJ;AAEA,IAAM,SAAA,GAAiC;AAAA,EACrC,UAAA,EACE;AACJ,CAAA;AAOA,SAAS,WAAA,GAAc;AACrB,EAAA,uBACEA,cAAA;AAAA,IAAC,OAAA;AAAA,IAAA;AAAA,MAEC,uBAAA,EAAyB;AAAA,QACvB,MAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA;AAUV;AAAA,GACF;AAEJ","file":"chunk-UTANIZUO.js","sourcesContent":["'use client'\n\n/**\n * FormEnhancer — the only client code a managed form needs up front.\n *\n * Renders the server-rendered shell (<StaticForm>, passed as `children`) until\n * an idle/first-interaction gate fires, then lazy-imports the interactive form\n * and swaps it in. Everything expensive — validation, conditional logic,\n * spotlight/stage, celebration, momentum — lives behind that dynamic import,\n * so a page ships this boundary and nothing else in its initial chunk set.\n *\n * The shell is a REAL form the whole time (native action + signed token), so\n * the progression is:\n *\n *   no JS at all      -> shell, submits natively. Works.\n *   JS, pre-idle      -> shell, submits natively. Works.\n *   JS, post-idle     -> enhanced form, submits over JSON. Works, with delight.\n *   chunk 404s        -> shell stays. Works. (Never left blank.)\n *\n * That last line is the invariant to protect: the shell is only removed once\n * the enhancement has actually rendered. Do not \"hide the shell then load\" —\n * a CDN hiccup would leave a visitor staring at an empty box where the form\n * used to be.\n *\n * ── Entrance animation ──────────────────────────────────────────────────\n *\n * Above-the-fold forms upgrade while the visitor is looking at them, so the\n * swap must not pop. The wrapper carries `data-sk-form-mount=\"shell\"` and\n * flips to `\"enhanced\"`, and the enhanced form gets `data-sk-enter` for one\n * frame, so a site can style the transition entirely in CSS:\n *\n *   [data-sk-form-mount] { transition: opacity .35s ease }\n *   [data-sk-form-mount=\"shell\"] { opacity: .6 }\n *\n * Defaults ship as CSS variables rather than hard-coded values:\n *\n *   --sk-form-enter-duration  (default 320ms)\n *   --sk-form-enter-easing    (default cubic-bezier(.22,1,.36,1))\n *   --sk-form-enter-distance  (default 6px)\n *\n * `enter=\"none\"` opts out entirely; `enter=\"custom\"` emits the data\n * attributes but no site-kit styles, leaving the animation to the site.\n * Every default is collapsed by prefers-reduced-motion.\n */\n\nimport React, { lazy, Suspense, useEffect, useRef, useState } from 'react'\nimport { useDeferredActivation } from '../shared/defer'\nimport type { FormExperience, FormSubmission } from './types'\n\n/** The heavy half. Nothing else in this module may import it statically. */\nconst InteractiveForm = lazy(() =>\n  import('./ManagedForm').then((m) => ({ default: m.ManagedForm })),\n)\n\nexport type FormEnterAnimation = 'fade' | 'none' | 'custom'\n\nexport interface FormEnhancerProps {\n  formId: string\n  /** Server-fetched raw config — hands the enhancement its fields instantly. */\n  initialConfig?: Record<string, unknown> | null\n  className?: string\n  nativeReturnTo?: string\n  experience?: FormExperience\n  /** Pre-fill field values by slug. See ManagedForm.defaultValues. */\n  defaultValues?: Record<string, unknown>\n  onSuccess?: (submission: FormSubmission) => void\n  onError?: (error: Error) => void\n  /**\n   * How the enhanced form arrives. 'fade' (default) crossfades and lifts it\n   * into place; 'none' swaps instantly; 'custom' emits the data attributes\n   * and no styles so the site owns the animation.\n   */\n  enter?: FormEnterAnimation\n  /**\n   * Set false to enhance immediately instead of waiting for idle. Only worth\n   * it for a form that is the entire point of the page AND above the fold.\n   */\n  defer?: boolean\n  /** The server-rendered <StaticForm>. Shown until the enhancement mounts. */\n  children: React.ReactNode\n}\n\nexport function FormEnhancer({\n  formId,\n  initialConfig,\n  className,\n  nativeReturnTo,\n  experience,\n  defaultValues,\n  onSuccess,\n  onError,\n  enter = 'fade',\n  defer = true,\n  children,\n}: FormEnhancerProps) {\n  const ready = useDeferredActivation(defer)\n  // Flipped only after the enhancement has actually committed to the DOM, so\n  // the shell never disappears ahead of its replacement.\n  const [enhanced, setEnhanced] = useState(false)\n\n  return (\n    <div\n      data-sk-form-mount={enhanced ? 'enhanced' : 'shell'}\n      data-sk-part=\"form-mount\"\n      style={enter === 'fade' ? FADE_HOST : undefined}\n    >\n      {enter === 'fade' && <EnterStyles />}\n      {ready ? (\n        <Suspense fallback={children}>\n          <Enhanced onMount={() => setEnhanced(true)} fallback={children}>\n            <InteractiveForm\n              formId={formId}\n              initialConfig={initialConfig}\n              className={className}\n              nativeReturnTo={nativeReturnTo}\n              experience={experience}\n              defaultValues={defaultValues}\n              onSuccess={onSuccess}\n              onError={onError}\n            />\n          </Enhanced>\n        </Suspense>\n      ) : (\n        children\n      )}\n    </div>\n  )\n}\n\n/**\n * Reports the moment the enhancement is on screen, and keeps the shell\n * rendered if it throws. An error boundary is the difference between \"the\n * fancy version failed\" and \"there is no form on this page\".\n */\nclass Enhanced extends React.Component<\n  { onMount: () => void; fallback: React.ReactNode; children: React.ReactNode },\n  { failed: boolean }\n> {\n  state = { failed: false }\n\n  static getDerivedStateFromError() {\n    return { failed: true }\n  }\n\n  componentDidCatch(err: unknown) {\n    console.error('[Forms] Enhancement failed; keeping the native form:', err)\n  }\n\n  componentDidMount() {\n    if (!this.state.failed) this.props.onMount()\n  }\n\n  render() {\n    if (this.state.failed) return this.props.fallback\n    return <FrameTag>{this.props.children}</FrameTag>\n  }\n}\n\n/** Adds data-sk-enter for one frame so a CSS transition has something to run. */\nfunction FrameTag({ children }: { children: React.ReactNode }) {\n  const ref = useRef<HTMLDivElement>(null)\n  useEffect(() => {\n    const el = ref.current\n    if (!el) return\n    el.setAttribute('data-sk-enter', '')\n    const id = requestAnimationFrame(() => el.removeAttribute('data-sk-enter'))\n    return () => cancelAnimationFrame(id)\n  }, [])\n  return (\n    <div ref={ref} style={{ display: 'contents' }}>\n      {children}\n    </div>\n  )\n}\n\nconst FADE_HOST: React.CSSProperties = {\n  transition:\n    'opacity var(--sk-form-enter-duration, 320ms) var(--sk-form-enter-easing, cubic-bezier(.22,1,.36,1))',\n}\n\n/**\n * Scoped to [data-sk-part=\"form-mount\"] so it can never touch a site's own\n * markup. Emitted once per form; identical text dedupes in every browser's\n * style cache and gzips to nothing.\n */\nfunction EnterStyles() {\n  return (\n    <style\n      // biome-ignore lint/security/noDangerouslySetInnerHtml: static string, no interpolation\n      dangerouslySetInnerHTML={{\n        __html: `\n[data-sk-part=\"form-mount\"][data-sk-form-mount=\"shell\"]{opacity:.55}\n[data-sk-part=\"form-mount\"][data-sk-form-mount=\"enhanced\"]{opacity:1}\n[data-sk-part=\"form-mount\"] [data-sk-enter]{opacity:0;transform:translateY(var(--sk-form-enter-distance,6px))}\n[data-sk-part=\"form-mount\"] [data-sk-enter] *{transition:none!important}\n@media (prefers-reduced-motion: reduce){\n[data-sk-part=\"form-mount\"]{transition:none!important}\n[data-sk-part=\"form-mount\"][data-sk-form-mount=\"shell\"]{opacity:1}\n[data-sk-part=\"form-mount\"] [data-sk-enter]{opacity:1;transform:none}\n}`,\n      }}\n    />\n  )\n}\n"]}

package/dist/{chunk-62Z4D3QR.js → chunk-VJAUA77N.js}

@@ -1,7 +1,7 @@
 'use strict';
 
 var chunkNB4MK2Q5_js = require('./chunk-NB4MK2Q5.js');
-var chunkPGND73EV_js = require('./chunk-PGND73EV.js');
+var chunkZDXGB3UC_js = require('./chunk-ZDXGB3UC.js');
 
 // src/shared/publishCredential.ts
 function resolveSiteHost(explicitSite) {
@@ -26,9 +26,9 @@ function publishSiteCredential({
   mapsBrowserKey
 }) {
   if (typeof window === "undefined") return;
-  chunkPGND73EV_js.configureSiteCredential({ credential: apiKey, apiUrl });
+  chunkZDXGB3UC_js.configureSiteCredential({ credential: apiKey, apiUrl });
   window.__SITE_KIT_API_URL__ = apiUrl;
-  window.__SITE_KIT_API_KEY__ = chunkPGND73EV_js.currentCredential(apiKey);
+  window.__SITE_KIT_API_KEY__ = chunkZDXGB3UC_js.currentCredential(apiKey);
   window.__SITE_KIT_DEBUG__ = debug;
   window.__SITE_KIT_SITE__ = site ?? resolveSiteHost();
   if (mapsBrowserKey) window.__GOOGLE_MAPS_API_KEY__ = mapsBrowserKey;
@@ -36,5 +36,5 @@ function publishSiteCredential({
 
 exports.publishSiteCredential = publishSiteCredential;
 exports.resolveSiteHost = resolveSiteHost;
-//# sourceMappingURL=chunk-62Z4D3QR.js.map
-//# sourceMappingURL=chunk-62Z4D3QR.js.map
+//# sourceMappingURL=chunk-VJAUA77N.js.map
+//# sourceMappingURL=chunk-VJAUA77N.js.map

package/dist/{chunk-62Z4D3QR.js.map → chunk-VJAUA77N.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/publishCredential.ts"],"names":["normalizeSiteHost","configureSiteCredential","currentCredential"],"mappings":";;;;;;AAqCO,SAAS,gBAAgB,YAAA,EAA+B;AAC7D,EAAA,MAAM,aACJ,OAAO,OAAA,KAAY,WAAA,GAAc,OAAA,CAAQ,IAAI,oBAAA,GAAuB,MAAA;AAEtE,EAAA,IAAI,WAAW,YAAA,IAAgB,EAAA;AAC/B,EAAA,IAAI,CAAC,YAAY,UAAA,EAAY;AAC3B,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,IAAI,GAAA,CAAI,UAAU,CAAA,CAAE,IAAA;AAAA,IACjC,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,IAAI,CAAC,QAAA,IAAY,OAAO,MAAA,KAAW,WAAA,EAAa;AAC9C,IAAA,QAAA,GAAW,OAAO,QAAA,CAAS,IAAA;AAAA,EAC7B;AACA,EAAA,OAAOA,kCAAA,CAAkB,QAAQ,CAAA,IAAK,EAAA;AACxC;AAkCO,SAAS,qBAAA,CAAsB;AAAA,EACpC,MAAA;AAAA,EACA,MAAA,GAAS,sBAAA;AAAA,EACT,IAAA;AAAA,EACA,KAAA,GAAQ,KAAA;AAAA,EACR;AACF,CAAA,EAAuC;AACrC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAKnC,EAAAC,wCAAA,CAAwB,EAAE,UAAA,EAAY,MAAA,EAAQ,MAAA,EAAQ,CAAA;AACrD,EAAC,OAAe,oBAAA,GAAuB,MAAA;AACvC,EAAC,MAAA,CAAe,oBAAA,GAAuBC,kCAAA,CAAkB,MAAM,CAAA;AAC/D,EAAC,OAAe,kBAAA,GAAqB,KAAA;AACrC,EAAC,MAAA,CAAe,iBAAA,GAAoB,IAAA,IAAQ,eAAA,EAAgB;AAG7D,EAAA,IAAI,cAAA,EAAiB,MAAA,CAAe,uBAAA,GAA0B,cAAA;AAChE","file":"chunk-62Z4D3QR.js","sourcesContent":["/**\n * @sonordev/site-kit shared — Client credential + window-global publishing\n *\n * SINGLE SOURCE OF TRUTH for seeding the browser-side token manager and the\n * `window.__SITE_KIT_*` globals that every client module reads. Used by:\n *\n *   - `SiteKitClientProviders` (core `SiteKitLayout`)\n *   - `SiteKitCredential` (`@sonordev/site-kit/client`) — the public component\n *     for layouts that are NOT core `SiteKitLayout`, e.g.\n *     `@sonordev/agency-site-kit`'s `AgencySiteKitLayout`.\n *\n * Do not re-fork this. Before it existed, agency sites hand-rolled their own\n * \"set the globals on mount\" component (upforge's `UptradeSiteKitInit`), and\n * because those copies had no access to the token manager they published the\n * RAW `sonor_` key into the client bundle — the exact exposure the mint exists\n * to prevent. Any layout that puts a credential on `window` goes through here.\n *\n * Client-safe: no `server-only` guard, SSR-safe (every write is window-gated).\n * The minting half is server-only and lives in `../server/mint-site-token`.\n */\n// Leaf module, NOT '../sites/contract' — see sites/normalize.ts. Importing the\n// full contract here shipped its JSON schema to every browser that loads a\n// credential-publishing entry.\nimport { normalizeSiteHost } from '../sites/normalize'\nimport { configureSiteCredential, currentCredential } from './siteToken'\n\n/**\n * Resolve the sub-site identifier — the dimension that lets one Sonor project\n * host many sites (e.g. truepowersystems.com + ohiopowerstudies.com under one\n * TPS project). Precedence, per the platform site contract:\n *   explicit `site` > NEXT_PUBLIC_SITE_URL host > window.location.host\n *\n * Normalized with the shared contract (lowercase host, no protocol/path/port)\n * so `__SITE_KIT_SITE__` matches exactly what the Sonor API stores — servers\n * re-normalize with the same rule, so this only makes the client emit the\n * canonical value. Always returns a string (possibly empty).\n */\nexport function resolveSiteHost(explicitSite?: string): string {\n  const envSiteUrl =\n    typeof process !== 'undefined' ? process.env.NEXT_PUBLIC_SITE_URL : undefined\n\n  let resolved = explicitSite ?? ''\n  if (!resolved && envSiteUrl) {\n    try {\n      resolved = new URL(envSiteUrl).host\n    } catch {\n      /* malformed URL — fall through to client-side host */\n    }\n  }\n  if (!resolved && typeof window !== 'undefined') {\n    resolved = window.location.host\n  }\n  return normalizeSiteHost(resolved) ?? ''\n}\n\nexport interface PublishSiteCredentialOptions {\n  /**\n   * The credential the layout minted server-side. In 3.2+ this is a short-lived\n   * `st1.` token that `sonorFetch` refreshes transparently. A raw `sonor_` key\n   * still works (2.x kit, or the mint-failed fallback) but should never be\n   * routed here from a client component — it would ship the secret to the\n   * browser.\n   */\n  apiKey?: string\n  apiUrl?: string\n  /** Pre-resolved sub-site host. Omit to resolve via `resolveSiteHost`. */\n  site?: string\n  debug?: boolean\n  /**\n   * Referrer-restricted Google Maps BROWSER key for client map components.\n   * Resolved server-side by SiteKitLayout (NEXT_PUBLIC_GOOGLE_MAPS_API_KEY /\n   * GOOGLE_MAPS_BROWSER_KEY) because maps/api.ts runs client-side, where a bare\n   * process.env read is dead code unless the app's bundler happens to inline it.\n   * Never route a server secret here.\n   */\n  mapsBrowserKey?: string\n}\n\n/**\n * Seed the token manager and publish the `window.__SITE_KIT_*` globals.\n *\n * Called during RENDER, not in an effect: client modules read these globals in\n * their own mount effects, and effects run child-first, so an effect-based\n * publish would land after the modules that need it.\n *\n * No-op on the server.\n */\nexport function publishSiteCredential({\n  apiKey,\n  apiUrl = 'https://api.sonor.io',\n  site,\n  debug = false,\n  mapsBrowserKey,\n}: PublishSiteCredentialOptions): void {\n  if (typeof window === 'undefined') return\n\n  // Seed the client token manager. The window global is set to the freshest\n  // token held — a prior page this session may already have refreshed past the\n  // seed the layout injected. In raw-key mode this is a passthrough.\n  configureSiteCredential({ credential: apiKey, apiUrl })\n  ;(window as any).__SITE_KIT_API_URL__ = apiUrl\n  ;(window as any).__SITE_KIT_API_KEY__ = currentCredential(apiKey)\n  ;(window as any).__SITE_KIT_DEBUG__ = debug\n  ;(window as any).__SITE_KIT_SITE__ = site ?? resolveSiteHost()\n  // maps/api.ts falls back to this global when the Sonor platform hasn't\n  // provisioned a browser key. Don't clobber a value another layout already set.\n  if (mapsBrowserKey) (window as any).__GOOGLE_MAPS_API_KEY__ = mapsBrowserKey\n}\n"]}
+{"version":3,"sources":["../src/shared/publishCredential.ts"],"names":["normalizeSiteHost","configureSiteCredential","currentCredential"],"mappings":";;;;;;AAqCO,SAAS,gBAAgB,YAAA,EAA+B;AAC7D,EAAA,MAAM,aACJ,OAAO,OAAA,KAAY,WAAA,GAAc,OAAA,CAAQ,IAAI,oBAAA,GAAuB,MAAA;AAEtE,EAAA,IAAI,WAAW,YAAA,IAAgB,EAAA;AAC/B,EAAA,IAAI,CAAC,YAAY,UAAA,EAAY;AAC3B,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,IAAI,GAAA,CAAI,UAAU,CAAA,CAAE,IAAA;AAAA,IACjC,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,IAAI,CAAC,QAAA,IAAY,OAAO,MAAA,KAAW,WAAA,EAAa;AAC9C,IAAA,QAAA,GAAW,OAAO,QAAA,CAAS,IAAA;AAAA,EAC7B;AACA,EAAA,OAAOA,kCAAA,CAAkB,QAAQ,CAAA,IAAK,EAAA;AACxC;AAkCO,SAAS,qBAAA,CAAsB;AAAA,EACpC,MAAA;AAAA,EACA,MAAA,GAAS,sBAAA;AAAA,EACT,IAAA;AAAA,EACA,KAAA,GAAQ,KAAA;AAAA,EACR;AACF,CAAA,EAAuC;AACrC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAKnC,EAAAC,wCAAA,CAAwB,EAAE,UAAA,EAAY,MAAA,EAAQ,MAAA,EAAQ,CAAA;AACrD,EAAC,OAAe,oBAAA,GAAuB,MAAA;AACvC,EAAC,MAAA,CAAe,oBAAA,GAAuBC,kCAAA,CAAkB,MAAM,CAAA;AAC/D,EAAC,OAAe,kBAAA,GAAqB,KAAA;AACrC,EAAC,MAAA,CAAe,iBAAA,GAAoB,IAAA,IAAQ,eAAA,EAAgB;AAG7D,EAAA,IAAI,cAAA,EAAiB,MAAA,CAAe,uBAAA,GAA0B,cAAA;AAChE","file":"chunk-VJAUA77N.js","sourcesContent":["/**\n * @sonordev/site-kit shared — Client credential + window-global publishing\n *\n * SINGLE SOURCE OF TRUTH for seeding the browser-side token manager and the\n * `window.__SITE_KIT_*` globals that every client module reads. Used by:\n *\n *   - `SiteKitClientProviders` (core `SiteKitLayout`)\n *   - `SiteKitCredential` (`@sonordev/site-kit/client`) — the public component\n *     for layouts that are NOT core `SiteKitLayout`, e.g.\n *     `@sonordev/agency-site-kit`'s `AgencySiteKitLayout`.\n *\n * Do not re-fork this. Before it existed, agency sites hand-rolled their own\n * \"set the globals on mount\" component (upforge's `UptradeSiteKitInit`), and\n * because those copies had no access to the token manager they published the\n * RAW `sonor_` key into the client bundle — the exact exposure the mint exists\n * to prevent. Any layout that puts a credential on `window` goes through here.\n *\n * Client-safe: no `server-only` guard, SSR-safe (every write is window-gated).\n * The minting half is server-only and lives in `../server/mint-site-token`.\n */\n// Leaf module, NOT '../sites/contract' — see sites/normalize.ts. Importing the\n// full contract here shipped its JSON schema to every browser that loads a\n// credential-publishing entry.\nimport { normalizeSiteHost } from '../sites/normalize'\nimport { configureSiteCredential, currentCredential } from './siteToken'\n\n/**\n * Resolve the sub-site identifier — the dimension that lets one Sonor project\n * host many sites (e.g. truepowersystems.com + ohiopowerstudies.com under one\n * TPS project). Precedence, per the platform site contract:\n *   explicit `site` > NEXT_PUBLIC_SITE_URL host > window.location.host\n *\n * Normalized with the shared contract (lowercase host, no protocol/path/port)\n * so `__SITE_KIT_SITE__` matches exactly what the Sonor API stores — servers\n * re-normalize with the same rule, so this only makes the client emit the\n * canonical value. Always returns a string (possibly empty).\n */\nexport function resolveSiteHost(explicitSite?: string): string {\n  const envSiteUrl =\n    typeof process !== 'undefined' ? process.env.NEXT_PUBLIC_SITE_URL : undefined\n\n  let resolved = explicitSite ?? ''\n  if (!resolved && envSiteUrl) {\n    try {\n      resolved = new URL(envSiteUrl).host\n    } catch {\n      /* malformed URL — fall through to client-side host */\n    }\n  }\n  if (!resolved && typeof window !== 'undefined') {\n    resolved = window.location.host\n  }\n  return normalizeSiteHost(resolved) ?? ''\n}\n\nexport interface PublishSiteCredentialOptions {\n  /**\n   * The credential the layout minted server-side. In 3.2+ this is a short-lived\n   * `st1.` token that `sonorFetch` refreshes transparently. A raw `sonor_` key\n   * still works (2.x kit, or the mint-failed fallback) but should never be\n   * routed here from a client component — it would ship the secret to the\n   * browser.\n   */\n  apiKey?: string\n  apiUrl?: string\n  /** Pre-resolved sub-site host. Omit to resolve via `resolveSiteHost`. */\n  site?: string\n  debug?: boolean\n  /**\n   * Referrer-restricted Google Maps BROWSER key for client map components.\n   * Resolved server-side by SiteKitLayout (NEXT_PUBLIC_GOOGLE_MAPS_API_KEY /\n   * GOOGLE_MAPS_BROWSER_KEY) because maps/api.ts runs client-side, where a bare\n   * process.env read is dead code unless the app's bundler happens to inline it.\n   * Never route a server secret here.\n   */\n  mapsBrowserKey?: string\n}\n\n/**\n * Seed the token manager and publish the `window.__SITE_KIT_*` globals.\n *\n * Called during RENDER, not in an effect: client modules read these globals in\n * their own mount effects, and effects run child-first, so an effect-based\n * publish would land after the modules that need it.\n *\n * No-op on the server.\n */\nexport function publishSiteCredential({\n  apiKey,\n  apiUrl = 'https://api.sonor.io',\n  site,\n  debug = false,\n  mapsBrowserKey,\n}: PublishSiteCredentialOptions): void {\n  if (typeof window === 'undefined') return\n\n  // Seed the client token manager. The window global is set to the freshest\n  // token held — a prior page this session may already have refreshed past the\n  // seed the layout injected. In raw-key mode this is a passthrough.\n  configureSiteCredential({ credential: apiKey, apiUrl })\n  ;(window as any).__SITE_KIT_API_URL__ = apiUrl\n  ;(window as any).__SITE_KIT_API_KEY__ = currentCredential(apiKey)\n  ;(window as any).__SITE_KIT_DEBUG__ = debug\n  ;(window as any).__SITE_KIT_SITE__ = site ?? resolveSiteHost()\n  // maps/api.ts falls back to this global when the Sonor platform hasn't\n  // provisioned a browser key. Don't clobber a value another layout already set.\n  if (mapsBrowserKey) (window as any).__GOOGLE_MAPS_API_KEY__ = mapsBrowserKey\n}\n"]}

package/dist/{chunk-Y26LKDE4.js → chunk-VOYLJCHB.js}

@@ -1,7 +1,7 @@
 'use client';
 'use strict';
 
-var chunkWXKEYKE6_js = require('./chunk-WXKEYKE6.js');
+var chunkFYPA5GLS_js = require('./chunk-FYPA5GLS.js');
 var react = require('react');
 var jsxRuntime = require('react/jsx-runtime');
 
@@ -22,7 +22,7 @@ async function fetchBookingTypes(orgSlug, apiUrl, apiKey) {
   const url = apiUrl || cfg.apiUrl;
   const key = apiKey || cfg.apiKey;
   const endpoint = key ? `${url}/sync/widget/types` : `${url}/sync/public/${orgSlug}/types`;
-  const response = await chunkWXKEYKE6_js.sonorFetch(endpoint, { headers: buildHeaders() }, { apiKey: key, retries: 0 });
+  const response = await chunkFYPA5GLS_js.sonorFetch(endpoint, { headers: buildHeaders() }, { apiKey: key, retries: 0 });
   if (!response.ok) {
     const msg = await response.json().catch(() => ({ message: response.statusText }));
     const detail = msg && typeof msg.message === "string" ? msg.message : response.statusText;
@@ -36,7 +36,7 @@ async function fetchBookingTypeDetails(typeSlug, orgSlug, apiUrl, apiKey) {
   const url = apiUrl || cfg.apiUrl;
   const key = apiKey || cfg.apiKey;
   const endpoint = key ? `${url}/sync/widget/types/${typeSlug}` : `${url}/sync/public/${orgSlug}/types/${typeSlug}`;
-  const response = await chunkWXKEYKE6_js.sonorFetch(endpoint, { headers: buildHeaders() }, { apiKey: key, retries: 0 });
+  const response = await chunkFYPA5GLS_js.sonorFetch(endpoint, { headers: buildHeaders() }, { apiKey: key, retries: 0 });
   if (!response.ok) {
     const msg = await response.json().catch(() => ({ message: response.statusText }));
     const detail = msg && typeof msg.message === "string" ? msg.message : response.statusText;
@@ -52,7 +52,7 @@ async function fetchAvailability(typeSlug, date, orgSlug, apiUrl, apiKey, timezo
   if (timezone) params.append("timezone", timezone);
   if (hostId) params.append("hostId", hostId);
   const endpoint = key ? `${url}/sync/widget/availability/${typeSlug}?${params}` : `${url}/sync/public/${orgSlug}/availability/${typeSlug}?${params}`;
-  const response = await chunkWXKEYKE6_js.sonorFetch(endpoint, { headers: buildHeaders() }, { apiKey: key, retries: 0 });
+  const response = await chunkFYPA5GLS_js.sonorFetch(endpoint, { headers: buildHeaders() }, { apiKey: key, retries: 0 });
   if (!response.ok) {
     const msg = await response.json().catch(() => ({ message: response.statusText }));
     let detail = msg && typeof msg.message === "string" ? String(msg.message).trim() : (response.statusText || "").trim();
@@ -75,7 +75,7 @@ async function createSlotHold(holdData, apiUrl, apiKey) {
   const url = apiUrl || cfg.apiUrl;
   const key = apiKey || cfg.apiKey;
   const endpoint = key ? `${url}/sync/widget/hold` : `${url}/sync/public/hold`;
-  const response = await chunkWXKEYKE6_js.sonorFetch(endpoint, {
+  const response = await chunkFYPA5GLS_js.sonorFetch(endpoint, {
     method: "POST",
     headers: buildHeaders(true),
     body: JSON.stringify(holdData)
@@ -90,7 +90,7 @@ async function releaseSlotHold(holdId, apiUrl, apiKey) {
   const url = apiUrl || cfg.apiUrl;
   const key = apiKey || cfg.apiKey;
   const endpoint = key ? `${url}/sync/widget/hold/${holdId}` : `${url}/sync/public/hold/${holdId}`;
-  await chunkWXKEYKE6_js.sonorFetch(endpoint, {
+  await chunkFYPA5GLS_js.sonorFetch(endpoint, {
     method: "DELETE",
     headers: buildHeaders()
   }, { apiKey: key, retries: 0 });
@@ -100,7 +100,7 @@ async function createBooking(bookingData, apiUrl, apiKey) {
   const url = apiUrl || cfg.apiUrl;
   const key = apiKey || cfg.apiKey;
   const endpoint = key ? `${url}/sync/widget/booking` : `${url}/sync/public/booking`;
-  const response = await chunkWXKEYKE6_js.sonorFetch(endpoint, {
+  const response = await chunkFYPA5GLS_js.sonorFetch(endpoint, {
     method: "POST",
     headers: buildHeaders(true),
     body: JSON.stringify(bookingData)
@@ -1100,5 +1100,5 @@ exports.formatDate = formatDate;
 exports.formatDuration = formatDuration;
 exports.formatTime = formatTime;
 exports.releaseSlotHold = releaseSlotHold;
-//# sourceMappingURL=chunk-Y26LKDE4.js.map
-//# sourceMappingURL=chunk-Y26LKDE4.js.map
+//# sourceMappingURL=chunk-VOYLJCHB.js.map
+//# sourceMappingURL=chunk-VOYLJCHB.js.map