@sonordev/site-kit 4.2.4 → 4.3.0

package/dist/{chunk-JHOMOLZA.js.map → chunk-SM27DPML.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/layout/SiteKitClientProviders.tsx"],"names":["dynamic","useDeferredActivation","resolveSiteHost","publishSiteCredential","useState","getOrCreateVisitorId","getOrCreateSessionId","useRef","useCallback","jsx","SignalBridge","React","Suspense","FleetHeartbeat","jsxs","Fragment"],"mappings":";;;;;;;;;;;;;;;;AA+CA,IAAM,qBAAA,GAAwBA,wBAAA;AAAA,EAC5B,MAAM,OAAO,iCAAgC,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,iBAAA,EAAkB,CAAE,CAAA;AAAA,EAC3F,EAAE,KAAK,KAAA;AACT,CAAA;AACA,IAAM,gBAAA,GAAmBA,wBAAA;AAAA,EACvB,MAAM,OAAO,4BAAwB,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,YAAA,EAAa,CAAE,CAAA;AAAA,EAC9E,EAAE,KAAK,KAAA;AACT,CAAA;AACA,IAAM,eAAA,GAAkBA,wBAAA;AAAA,EACtB,MAAM,OAAO,2BAAgB,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,WAAA,EAAY,CAAE,CAAA;AAAA,EACrE,EAAE,KAAK,KAAA;AACT,CAAA;AAiDO,SAAS,sBAAA,CAAuB;AAAA,EACrC,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA,GAAY,IAAA;AAAA,EACZ,MAAA,GAAS,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EACT,WAAA,GAAc,KAAA;AAAA,EACd,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ,KAAA;AAAA,EACR;AACF,CAAA,EAAgC;AAG9B,EAAA,MAAM,YAAA,GAAeC,uCAAsB,KAAK,CAAA;AAEhD,EAAA,MAAM,eAAA,GACJ,OAAO,SAAA,KAAc,QAAA,GAAW,YAAY,EAAC;AAO/C,EAAA,MAAM,IAAA,GAAOC,gCAAA,CAAgB,eAAA,CAAgB,IAAI,CAAA;AAIjD,EAAAC,sCAAA,CAAsB,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAO,gBAAgB,CAAA;AAGrE,EAAA,MAAM,CAAC,SAAS,CAAA,GAAIC,cAAA,CAAS,MAAMC,uCAAsB,CAAA;AACzD,EAAA,MAAM,CAAC,SAAS,CAAA,GAAID,cAAA,CAAS,MAAME,uCAAsB,CAAA;AAGzD,EAAA,MAAM,eAAA,GAAkBC,aAAuC,IAAI,CAAA;AACnE,EAAA,MAAM,cAAA,GAAiBC,iBAAA,CAAY,CAAC,QAAA,KAAsC;AACxE,IAAA,eAAA,CAAgB,OAAA,GAAU,QAAA;AAAA,EAC5B,CAAA,EAAG,EAAE,CAAA;AAGL,EAAA,MAAM,WAAwB,EAAC;AAK/B,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,YAAA,GACJ,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,EAAC;AACzC,IAAA,QAAA,CAAS,IAAA;AAAA,sBACPC,cAAA;AAAA,QAACC,6BAAA;AAAA,QAAA;AAAA,UAEC,OAAA,EAAO,IAAA;AAAA,UACP,QAAA,EAAU,aAAa,QAAA,KAAa,KAAA;AAAA,UACpC,WAAA,EAAa,aAAa,WAAA,KAAgB,KAAA;AAAA,UAC1C,gBAAA,EAAkB,aAAa,gBAAA,KAAqB,KAAA;AAAA,UACpD,SAAA;AAAA,UACA,SAAA;AAAA,UACA;AAAA,SAAA;AAAA,QAPI;AAAA;AAQN,KACF;AAAA,EACF;AAaA,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,QAAA,CAAS,IAAA;AAAA,sBACPD,cAAA,CAACE,uBAAM,QAAA,EAAN,EACE,0CACCF,cAAA,CAACG,cAAA,EAAA,EAAS,UAAU,IAAA,EAClB,QAAA,kBAAAH,cAAA;AAAA,QAAC,qBAAA;AAAA,QAAA;AAAA,UACC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,IAAA;AAAA,UACA,cAAA,EAAgB,gBAAgB,cAAA,KAAmB,KAAA;AAAA,UACnD,cAAA,EAAgB,gBAAgB,cAAA,KAAmB,KAAA;AAAA,UACnD,gBAAA,EAAkB,gBAAgB,gBAAA,KAAqB,KAAA;AAAA,UACvD,WAAA,EAAa,gBAAgB,WAAA,KAAgB,KAAA;AAAA,UAC7C,gBAAgB,eAAA,CAAgB,eAAA;AAAA,UAChC,cAAc,eAAA,CAAgB,YAAA;AAAA,UAC9B,KAAA;AAAA,UACA,iBAAA,EAAmB,SAAA;AAAA,UACnB,iBAAA,EAAmB,SAAA;AAAA,UACnB;AAAA;AAAA,OACF,EACF,KAlBgB,cAoBpB;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,YAAA,GACJ,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,EAAC;AACzC,IAAA,QAAA,CAAS,IAAA;AAAA,sBACPA,cAAA,CAACE,sBAAA,CAAM,QAAA,EAAN,EACE,QAAA,EAAA,YAAA,oBACCF,cAAA;AAAA,QAAC,gBAAA;AAAA,QAAA;AAAA,UACC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,SAAA;AAAA,UACA,QAAA,EAAU,aAAa,QAAA,IAAY,cAAA;AAAA,UACnC,QAAQ,YAAA,CAAa,MAAA;AAAA,UACrB,WAAA,EAAa,aAAa,WAAA,KAAgB;AAAA;AAAA,WAR5B,WAWpB;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,QAAA,CAAS,IAAA;AAAA,sBACPA,cAAA,CAACE,uBAAM,QAAA,EAAN,EACE,0CAAgBF,cAAA,CAAC,eAAA,EAAA,EAAgB,KAAA,EAAc,CAAA,EAAA,EAD9B,YAEpB;AAAA,KACF;AAAA,EACF;AAOA,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,MAAM,gBAA+B,EAAC;AACtC,IAAA,IAAI,SAAA,EAAW,aAAA,CAAc,IAAA,CAAK,WAAW,CAAA;AAC7C,IAAA,IAAI,MAAA,EAAQ,aAAA,CAAc,IAAA,CAAK,QAAQ,CAAA;AACvC,IAAA,IAAI,MAAA,EAAQ,aAAA,CAAc,IAAA,CAAK,QAAQ,CAAA;AACvC,IAAA,IAAI,WAAA,EAAa,aAAA,CAAc,IAAA,CAAK,aAAa,CAAA;AACjD,IAAA,QAAA,CAAS,IAAA;AAAA,sBACPA,cAAA,CAACE,sBAAA,CAAM,QAAA,EAAN,EACE,QAAA,EAAA,YAAA,oBACCF,cAAA;AAAA,QAACI,+BAAA;AAAA,QAAA;AAAA,UACC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,IAAA;AAAA,UACA,OAAA,EAAS,aAAA;AAAA,UACT,KAAA,EAAO,KAAA;AAAA,UACP;AAAA;AAAA,WARc,UAWpB;AAAA,KACF;AAAA,EACF;AAEA,EAAA,uBACEC,eAAA,CAAAC,mBAAA,EAAA,EACG,QAAA,EAAA;AAAA,IAAA,QAAA;AAAA,IACA;AAAA,GAAA,EACH,CAAA;AAEJ","file":"chunk-JHOMOLZA.js","sourcesContent":["'use client'\n\n/**\n * SiteKitClientProviders — Client Island\n *\n * This is the 'use client' boundary for SiteKitLayout.\n * It composes the client-only providers (Analytics, Engage, Signal, SitemapSync)\n * that require React context or browser APIs.\n *\n * All modules are lazy-loaded via next/dynamic so their JS is only downloaded\n * when the feature is enabled — keeping the initial bundle lightweight.\n *\n * All modules share a unified identity (visitor ID + session ID) read from\n * the storage-backed singleton (shared/identity), ensuring consistent\n * tracking across Analytics, Signal, and Engage.\n *\n * 4.0 INVARIANT — CHILDREN ARE NEVER WRAPPED. Every module here renders as a\n * childless sibling AFTER {children}; nothing provides context around page\n * content. That makes the prerender-bailout / remount-flash class of bug\n * structurally impossible. Do not reintroduce a wrapper.\n *\n * Props are passed down from the server-side SiteKitLayout component,\n * which reads env vars at render time.\n */\n\nimport React, { Suspense, useCallback, useRef, useState, type ReactNode } from 'react'\nimport dynamic from 'next/dynamic'\nimport {\n  getOrCreateVisitorId,\n  getOrCreateSessionId,\n} from '../shared/identity'\n// Defer non-critical module mounting until the page is quiet: the lazy\n// modules below are dynamic(ssr:false) and never render on the server, but\n// rendering them during hydration still kicks off their chunk downloads +\n// mount effects inside the critical startup window. useDeferredActivation\n// holds them until window.load + idle or first interaction — the same\n// strategy as the hand-rolled per-site deferrals this replaces (upforge\n// `deferred-analytics.tsx`, TPS `DeferredAnalytics.tsx`). The hook is public\n// (`@sonordev/site-kit/client`) so sites can reuse it for their own scripts.\nimport { useDeferredActivation } from '../shared/defer'\n// Single source of truth for seeding the token manager + the __SITE_KIT_*\n// globals — shared with the public `SiteKitCredential` component that\n// non-core layouts (agency-site-kit) use. Do not re-inline it here.\nimport { publishSiteCredential, resolveSiteHost } from '../shared/publishCredential'\nimport type { AnalyticsConfig, EngageConfig, SignalConfig } from './types'\n\n// Lazy-load feature modules — JS only downloaded when feature is enabled\nconst LazyAnalyticsProvider = dynamic(\n  () => import('../analytics/AnalyticsProvider').then(m => ({ default: m.AnalyticsProvider })),\n  { ssr: false },\n)\nconst LazyEngageWidget = dynamic(\n  () => import('../engage/EngageWidget').then(m => ({ default: m.EngageWidget })),\n  { ssr: false },\n)\nconst LazySitemapSync = dynamic(\n  () => import('../SitemapSync').then(m => ({ default: m.SitemapSync })),\n  { ssr: false },\n)\n// SignalBridge is imported STATICALLY, not via dynamic(ssr:false): it is a\n// tiny SSR-safe context shell that renders children immediately and\n// lazy-loads its machinery (SignalCore) as a childless sibling internally.\n// Wrapping children in a dynamic(ssr:false) component was the old SSR-bailout\n// failure mode — do not reintroduce it.\nimport { SignalBridge } from '../signal/SignalBridge'\n// Fleet heartbeat: a deferred, CHILDLESS SIBLING (like Analytics/Engage) that\n// reports this site's kit version + active modules once per session, so the\n// platform can see version drift across the fleet. Tiny and SSR-safe — renders\n// null until the shared idle gate fires; never wraps page content.\nimport { FleetHeartbeat } from '../fleet/FleetHeartbeat'\nimport type { FleetModule } from '../fleet/contract'\n\nexport interface SiteKitClientProvidersProps {\n  children: ReactNode\n  apiKey: string\n  apiUrl: string\n  projectId?: string\n  analytics?: boolean | AnalyticsConfig\n  engage?: boolean | EngageConfig\n  signal?: boolean | SignalConfig\n  /**\n   * Runtime SitemapSync from the visitor's browser. Default FALSE — sitemap\n   * registration belongs to build time and to sonor-api's nightly reconciler,\n   * not to whoever happens to load the page. See SiteKitLayout for the full\n   * reasoning; in short, its guards live in session/localStorage, so every new\n   * visitor missed them and re-POSTed the whole sitemap.\n   */\n  sitemapSync?: boolean\n  /**\n   * Fleet heartbeat — reports kit version + active modules to Sonor once per\n   * session so the platform can track version drift and key state across every\n   * site. Default true. Deferred exactly like Analytics; never in the hydration\n   * path, carries no visitor data.\n   */\n  fleet?: boolean\n  /**\n   * Defer Analytics / Engage / SitemapSync until window load + idle or first\n   * interaction (default true). Pass false to restore legacy eager mounting\n   * on hydration. SignalBridge is never deferred — it must apply experiment\n   * variants as early as possible.\n   */\n  defer?: boolean\n  debug?: boolean\n  /** Browser-safe Google Maps key, resolved server-side by SiteKitLayout. */\n  mapsBrowserKey?: string\n}\n\nexport function SiteKitClientProviders({\n  children,\n  apiKey,\n  apiUrl,\n  projectId,\n  analytics = true,\n  engage = true,\n  signal = false,\n  sitemapSync = false,\n  fleet = true,\n  defer = true,\n  debug = false,\n  mapsBrowserKey,\n}: SiteKitClientProvidersProps) {\n  // One shared activation gate for all deferred siblings, so they mount in a\n  // single commit instead of staggered re-renders.\n  const modulesReady = useDeferredActivation(defer)\n  // Hoist analytics config so the `site` dimension is resolvable up here.\n  const analyticsConfig: AnalyticsConfig =\n    typeof analytics === 'object' ? analytics : {}\n\n  // Resolve the sub-site identifier — the dimension that lets one Sonor project\n  // host many sites (e.g. truepowersystems.com + ohiopowerstudies.com under one\n  // TPS project). Precedence lives in resolveSiteHost (shared contract):\n  // explicit `analytics.site` > NEXT_PUBLIC_SITE_URL host > window.location.host.\n  // Needed as a local too — SignalBridge and the analytics config read it below.\n  const site = resolveSiteHost(analyticsConfig.site)\n\n  // Seed the token manager + publish the window globals modules read from.\n  // No-op on the server; runs during render so it lands before child effects.\n  publishSiteCredential({ apiKey, apiUrl, site, debug, mapsBrowserKey })\n\n  // Unified identity — single source of truth for all modules\n  const [visitorId] = useState(() => getOrCreateVisitorId())\n  const [sessionId] = useState(() => getOrCreateSessionId())\n\n  // Page metadata bridge: Analytics writes, Signal reads\n  const pageMetadataRef = useRef<Record<string, unknown> | null>(null)\n  const onPageMetadata = useCallback((metadata: Record<string, unknown>) => {\n    pageMetadataRef.current = metadata\n  }, [])\n\n  // Children render FIRST and are never re-parented. Siblings accumulate after.\n  const siblings: ReactNode[] = []\n\n  // SignalBridge — childless sibling (4.0: useSignal reads the module store,\n  // so it no longer needs to wrap anything). Not gated on modulesReady:\n  // experiment variants must apply as early as possible.\n  if (signal) {\n    const signalConfig: SignalConfig =\n      typeof signal === 'object' ? signal : {}\n    siblings.push(\n      <SignalBridge\n        key=\"sk-signal\"\n        enabled\n        realtime={signalConfig.realtime !== false}\n        experiments={signalConfig.experiments !== false}\n        behaviorTracking={signalConfig.behaviorTracking !== false}\n        visitorId={visitorId}\n        sessionId={sessionId}\n        pageMetadataRef={pageMetadataRef}\n      />,\n    )\n  }\n\n  // Add Analytics if enabled (renders alongside, doesn't wrap).\n  //\n  // CRITICAL: LazyAnalyticsProvider is dynamic(..., { ssr: false }). Wrapping\n  // {content} inside an ssr:false component makes the entire page tree skip\n  // server rendering — the route de-opts to 100% client rendering and the\n  // hero / LCP element only paints after hydration (mobile LCP ~4s, Lighthouse\n  // ~85). Analytics tracks via effects + a metadata ref, so it never needs to\n  // wrap page content — mount it as a childless sibling, exactly like Engage.\n  // Each deferred sibling is appended as `{modulesReady && <Module/>}` so the\n  // children slot never moves in the tree — flipping ready only mounts the\n  // sibling, it never remounts page content.\n  if (analytics) {\n    siblings.push(\n      <React.Fragment key=\"sk-analytics\">\n        {modulesReady && (\n          <Suspense fallback={null}>\n            <LazyAnalyticsProvider\n              apiUrl={apiUrl}\n              apiKey={apiKey}\n              site={site}\n              trackPageViews={analyticsConfig.trackPageViews !== false}\n              trackWebVitals={analyticsConfig.trackWebVitals !== false}\n              trackScrollDepth={analyticsConfig.trackScrollDepth !== false}\n              trackClicks={analyticsConfig.trackClicks !== false}\n              sessionTimeout={analyticsConfig.sessionDuration}\n              excludePaths={analyticsConfig.excludePaths}\n              debug={debug}\n              externalVisitorId={visitorId}\n              externalSessionId={sessionId}\n              onPageMetadata={onPageMetadata}\n            />\n          </Suspense>\n        )}\n      </React.Fragment>,\n    )\n  }\n\n  // Engage widget — childless sibling\n  if (engage) {\n    const engageConfig: EngageConfig =\n      typeof engage === 'object' ? engage : {}\n    siblings.push(\n      <React.Fragment key=\"sk-engage\">\n        {modulesReady && (\n          <LazyEngageWidget\n            apiUrl={apiUrl}\n            apiKey={apiKey}\n            projectId={projectId}\n            position={engageConfig.position || 'bottom-right'}\n            zIndex={engageConfig.zIndex}\n            chatEnabled={engageConfig.chatEnabled !== false}\n          />\n        )}\n      </React.Fragment>,\n    )\n  }\n\n  // SitemapSync — childless sibling\n  if (sitemapSync) {\n    siblings.push(\n      <React.Fragment key=\"sk-sitemap\">\n        {modulesReady && <LazySitemapSync debug={debug} />}\n      </React.Fragment>,\n    )\n  }\n\n  // Fleet heartbeat — childless sibling on the same modulesReady idle gate.\n  // Reports the modules actually enabled on THIS layout (honest client-observable\n  // set) so the platform can answer \"which version / modules is each site\n  // running\". defer={false}: the modulesReady gate already handled deferral, so\n  // the heartbeat fires on mount (still bounded to once per session internally).\n  if (fleet) {\n    const activeModules: FleetModule[] = []\n    if (analytics) activeModules.push('analytics')\n    if (engage) activeModules.push('engage')\n    if (signal) activeModules.push('signal')\n    if (sitemapSync) activeModules.push('sitemapSync')\n    siblings.push(\n      <React.Fragment key=\"sk-fleet\">\n        {modulesReady && (\n          <FleetHeartbeat\n            apiUrl={apiUrl}\n            apiKey={apiKey}\n            site={site}\n            modules={activeModules}\n            defer={false}\n            debug={debug}\n          />\n        )}\n      </React.Fragment>,\n    )\n  }\n\n  return (\n    <>\n      {children}\n      {siblings}\n    </>\n  )\n}\n"]}
+{"version":3,"sources":["../src/layout/SiteKitClientProviders.tsx"],"names":["dynamic","useDeferredActivation","resolveSiteHost","publishSiteCredential","useState","getOrCreateVisitorId","getOrCreateSessionId","useRef","useCallback","jsx","SignalBridge","React","Suspense","FleetHeartbeat","jsxs","Fragment"],"mappings":";;;;;;;;;;;;;;;;AA+CA,IAAM,qBAAA,GAAwBA,wBAAA;AAAA,EAC5B,MAAM,OAAO,iCAAgC,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,iBAAA,EAAkB,CAAE,CAAA;AAAA,EAC3F,EAAE,KAAK,KAAA;AACT,CAAA;AACA,IAAM,gBAAA,GAAmBA,wBAAA;AAAA,EACvB,MAAM,OAAO,4BAAwB,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,YAAA,EAAa,CAAE,CAAA;AAAA,EAC9E,EAAE,KAAK,KAAA;AACT,CAAA;AACA,IAAM,eAAA,GAAkBA,wBAAA;AAAA,EACtB,MAAM,OAAO,2BAAgB,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,WAAA,EAAY,CAAE,CAAA;AAAA,EACrE,EAAE,KAAK,KAAA;AACT,CAAA;AAiDO,SAAS,sBAAA,CAAuB;AAAA,EACrC,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA,GAAY,IAAA;AAAA,EACZ,MAAA,GAAS,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EACT,WAAA,GAAc,KAAA;AAAA,EACd,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ,KAAA;AAAA,EACR;AACF,CAAA,EAAgC;AAG9B,EAAA,MAAM,YAAA,GAAeC,uCAAsB,KAAK,CAAA;AAEhD,EAAA,MAAM,eAAA,GACJ,OAAO,SAAA,KAAc,QAAA,GAAW,YAAY,EAAC;AAO/C,EAAA,MAAM,IAAA,GAAOC,gCAAA,CAAgB,eAAA,CAAgB,IAAI,CAAA;AAIjD,EAAAC,sCAAA,CAAsB,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAO,gBAAgB,CAAA;AAGrE,EAAA,MAAM,CAAC,SAAS,CAAA,GAAIC,cAAA,CAAS,MAAMC,uCAAsB,CAAA;AACzD,EAAA,MAAM,CAAC,SAAS,CAAA,GAAID,cAAA,CAAS,MAAME,uCAAsB,CAAA;AAGzD,EAAA,MAAM,eAAA,GAAkBC,aAAuC,IAAI,CAAA;AACnE,EAAA,MAAM,cAAA,GAAiBC,iBAAA,CAAY,CAAC,QAAA,KAAsC;AACxE,IAAA,eAAA,CAAgB,OAAA,GAAU,QAAA;AAAA,EAC5B,CAAA,EAAG,EAAE,CAAA;AAGL,EAAA,MAAM,WAAwB,EAAC;AAK/B,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,YAAA,GACJ,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,EAAC;AACzC,IAAA,QAAA,CAAS,IAAA;AAAA,sBACPC,cAAA;AAAA,QAACC,6BAAA;AAAA,QAAA;AAAA,UAEC,OAAA,EAAO,IAAA;AAAA,UACP,QAAA,EAAU,aAAa,QAAA,KAAa,KAAA;AAAA,UACpC,WAAA,EAAa,aAAa,WAAA,KAAgB,KAAA;AAAA,UAC1C,gBAAA,EAAkB,aAAa,gBAAA,KAAqB,KAAA;AAAA,UACpD,SAAA;AAAA,UACA,SAAA;AAAA,UACA;AAAA,SAAA;AAAA,QAPI;AAAA;AAQN,KACF;AAAA,EACF;AAaA,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,QAAA,CAAS,IAAA;AAAA,sBACPD,cAAA,CAACE,uBAAM,QAAA,EAAN,EACE,0CACCF,cAAA,CAACG,cAAA,EAAA,EAAS,UAAU,IAAA,EAClB,QAAA,kBAAAH,cAAA;AAAA,QAAC,qBAAA;AAAA,QAAA;AAAA,UACC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,IAAA;AAAA,UACA,cAAA,EAAgB,gBAAgB,cAAA,KAAmB,KAAA;AAAA,UACnD,cAAA,EAAgB,gBAAgB,cAAA,KAAmB,KAAA;AAAA,UACnD,gBAAA,EAAkB,gBAAgB,gBAAA,KAAqB,KAAA;AAAA,UACvD,WAAA,EAAa,gBAAgB,WAAA,KAAgB,KAAA;AAAA,UAC7C,gBAAgB,eAAA,CAAgB,eAAA;AAAA,UAChC,cAAc,eAAA,CAAgB,YAAA;AAAA,UAC9B,KAAA;AAAA,UACA,iBAAA,EAAmB,SAAA;AAAA,UACnB,iBAAA,EAAmB,SAAA;AAAA,UACnB;AAAA;AAAA,OACF,EACF,KAlBgB,cAoBpB;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,YAAA,GACJ,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,EAAC;AACzC,IAAA,QAAA,CAAS,IAAA;AAAA,sBACPA,cAAA,CAACE,sBAAA,CAAM,QAAA,EAAN,EACE,QAAA,EAAA,YAAA,oBACCF,cAAA;AAAA,QAAC,gBAAA;AAAA,QAAA;AAAA,UACC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,SAAA;AAAA,UACA,QAAA,EAAU,aAAa,QAAA,IAAY,cAAA;AAAA,UACnC,QAAQ,YAAA,CAAa,MAAA;AAAA,UACrB,WAAA,EAAa,aAAa,WAAA,KAAgB;AAAA;AAAA,WAR5B,WAWpB;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,QAAA,CAAS,IAAA;AAAA,sBACPA,cAAA,CAACE,uBAAM,QAAA,EAAN,EACE,0CAAgBF,cAAA,CAAC,eAAA,EAAA,EAAgB,KAAA,EAAc,CAAA,EAAA,EAD9B,YAEpB;AAAA,KACF;AAAA,EACF;AAOA,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,MAAM,gBAA+B,EAAC;AACtC,IAAA,IAAI,SAAA,EAAW,aAAA,CAAc,IAAA,CAAK,WAAW,CAAA;AAC7C,IAAA,IAAI,MAAA,EAAQ,aAAA,CAAc,IAAA,CAAK,QAAQ,CAAA;AACvC,IAAA,IAAI,MAAA,EAAQ,aAAA,CAAc,IAAA,CAAK,QAAQ,CAAA;AACvC,IAAA,IAAI,WAAA,EAAa,aAAA,CAAc,IAAA,CAAK,aAAa,CAAA;AACjD,IAAA,QAAA,CAAS,IAAA;AAAA,sBACPA,cAAA,CAACE,sBAAA,CAAM,QAAA,EAAN,EACE,QAAA,EAAA,YAAA,oBACCF,cAAA;AAAA,QAACI,+BAAA;AAAA,QAAA;AAAA,UACC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,IAAA;AAAA,UACA,OAAA,EAAS,aAAA;AAAA,UACT,KAAA,EAAO,KAAA;AAAA,UACP;AAAA;AAAA,WARc,UAWpB;AAAA,KACF;AAAA,EACF;AAEA,EAAA,uBACEC,eAAA,CAAAC,mBAAA,EAAA,EACG,QAAA,EAAA;AAAA,IAAA,QAAA;AAAA,IACA;AAAA,GAAA,EACH,CAAA;AAEJ","file":"chunk-SM27DPML.js","sourcesContent":["'use client'\n\n/**\n * SiteKitClientProviders — Client Island\n *\n * This is the 'use client' boundary for SiteKitLayout.\n * It composes the client-only providers (Analytics, Engage, Signal, SitemapSync)\n * that require React context or browser APIs.\n *\n * All modules are lazy-loaded via next/dynamic so their JS is only downloaded\n * when the feature is enabled — keeping the initial bundle lightweight.\n *\n * All modules share a unified identity (visitor ID + session ID) read from\n * the storage-backed singleton (shared/identity), ensuring consistent\n * tracking across Analytics, Signal, and Engage.\n *\n * 4.0 INVARIANT — CHILDREN ARE NEVER WRAPPED. Every module here renders as a\n * childless sibling AFTER {children}; nothing provides context around page\n * content. That makes the prerender-bailout / remount-flash class of bug\n * structurally impossible. Do not reintroduce a wrapper.\n *\n * Props are passed down from the server-side SiteKitLayout component,\n * which reads env vars at render time.\n */\n\nimport React, { Suspense, useCallback, useRef, useState, type ReactNode } from 'react'\nimport dynamic from 'next/dynamic'\nimport {\n  getOrCreateVisitorId,\n  getOrCreateSessionId,\n} from '../shared/identity'\n// Defer non-critical module mounting until the page is quiet: the lazy\n// modules below are dynamic(ssr:false) and never render on the server, but\n// rendering them during hydration still kicks off their chunk downloads +\n// mount effects inside the critical startup window. useDeferredActivation\n// holds them until window.load + idle or first interaction — the same\n// strategy as the hand-rolled per-site deferrals this replaces (upforge\n// `deferred-analytics.tsx`, TPS `DeferredAnalytics.tsx`). The hook is public\n// (`@sonordev/site-kit/client`) so sites can reuse it for their own scripts.\nimport { useDeferredActivation } from '../shared/defer'\n// Single source of truth for seeding the token manager + the __SITE_KIT_*\n// globals — shared with the public `SiteKitCredential` component that\n// non-core layouts (agency-site-kit) use. Do not re-inline it here.\nimport { publishSiteCredential, resolveSiteHost } from '../shared/publishCredential'\nimport type { AnalyticsConfig, EngageConfig, SignalConfig } from './types'\n\n// Lazy-load feature modules — JS only downloaded when feature is enabled\nconst LazyAnalyticsProvider = dynamic(\n  () => import('../analytics/AnalyticsProvider').then(m => ({ default: m.AnalyticsProvider })),\n  { ssr: false },\n)\nconst LazyEngageWidget = dynamic(\n  () => import('../engage/EngageWidget').then(m => ({ default: m.EngageWidget })),\n  { ssr: false },\n)\nconst LazySitemapSync = dynamic(\n  () => import('../SitemapSync').then(m => ({ default: m.SitemapSync })),\n  { ssr: false },\n)\n// SignalBridge is imported STATICALLY, not via dynamic(ssr:false): it is a\n// tiny SSR-safe context shell that renders children immediately and\n// lazy-loads its machinery (SignalCore) as a childless sibling internally.\n// Wrapping children in a dynamic(ssr:false) component was the old SSR-bailout\n// failure mode — do not reintroduce it.\nimport { SignalBridge } from '../signal/SignalBridge'\n// Fleet heartbeat: a deferred, CHILDLESS SIBLING (like Analytics/Engage) that\n// reports this site's kit version + active modules once per session, so the\n// platform can see version drift across the fleet. Tiny and SSR-safe — renders\n// null until the shared idle gate fires; never wraps page content.\nimport { FleetHeartbeat } from '../fleet/FleetHeartbeat'\nimport type { FleetModule } from '../fleet/contract'\n\nexport interface SiteKitClientProvidersProps {\n  children: ReactNode\n  apiKey: string\n  apiUrl: string\n  projectId?: string\n  analytics?: boolean | AnalyticsConfig\n  engage?: boolean | EngageConfig\n  signal?: boolean | SignalConfig\n  /**\n   * Runtime SitemapSync from the visitor's browser. Default FALSE — sitemap\n   * registration belongs to build time and to sonor-api's nightly reconciler,\n   * not to whoever happens to load the page. See SiteKitLayout for the full\n   * reasoning; in short, its guards live in session/localStorage, so every new\n   * visitor missed them and re-POSTed the whole sitemap.\n   */\n  sitemapSync?: boolean\n  /**\n   * Fleet heartbeat — reports kit version + active modules to Sonor once per\n   * session so the platform can track version drift and key state across every\n   * site. Default true. Deferred exactly like Analytics; never in the hydration\n   * path, carries no visitor data.\n   */\n  fleet?: boolean\n  /**\n   * Defer Analytics / Engage / SitemapSync until window load + idle or first\n   * interaction (default true). Pass false to restore legacy eager mounting\n   * on hydration. SignalBridge is never deferred — it must apply experiment\n   * variants as early as possible.\n   */\n  defer?: boolean\n  debug?: boolean\n  /** Browser-safe Google Maps key, resolved server-side by SiteKitLayout. */\n  mapsBrowserKey?: string\n}\n\nexport function SiteKitClientProviders({\n  children,\n  apiKey,\n  apiUrl,\n  projectId,\n  analytics = true,\n  engage = true,\n  signal = false,\n  sitemapSync = false,\n  fleet = true,\n  defer = true,\n  debug = false,\n  mapsBrowserKey,\n}: SiteKitClientProvidersProps) {\n  // One shared activation gate for all deferred siblings, so they mount in a\n  // single commit instead of staggered re-renders.\n  const modulesReady = useDeferredActivation(defer)\n  // Hoist analytics config so the `site` dimension is resolvable up here.\n  const analyticsConfig: AnalyticsConfig =\n    typeof analytics === 'object' ? analytics : {}\n\n  // Resolve the sub-site identifier — the dimension that lets one Sonor project\n  // host many sites (e.g. truepowersystems.com + ohiopowerstudies.com under one\n  // TPS project). Precedence lives in resolveSiteHost (shared contract):\n  // explicit `analytics.site` > NEXT_PUBLIC_SITE_URL host > window.location.host.\n  // Needed as a local too — SignalBridge and the analytics config read it below.\n  const site = resolveSiteHost(analyticsConfig.site)\n\n  // Seed the token manager + publish the window globals modules read from.\n  // No-op on the server; runs during render so it lands before child effects.\n  publishSiteCredential({ apiKey, apiUrl, site, debug, mapsBrowserKey })\n\n  // Unified identity — single source of truth for all modules\n  const [visitorId] = useState(() => getOrCreateVisitorId())\n  const [sessionId] = useState(() => getOrCreateSessionId())\n\n  // Page metadata bridge: Analytics writes, Signal reads\n  const pageMetadataRef = useRef<Record<string, unknown> | null>(null)\n  const onPageMetadata = useCallback((metadata: Record<string, unknown>) => {\n    pageMetadataRef.current = metadata\n  }, [])\n\n  // Children render FIRST and are never re-parented. Siblings accumulate after.\n  const siblings: ReactNode[] = []\n\n  // SignalBridge — childless sibling (4.0: useSignal reads the module store,\n  // so it no longer needs to wrap anything). Not gated on modulesReady:\n  // experiment variants must apply as early as possible.\n  if (signal) {\n    const signalConfig: SignalConfig =\n      typeof signal === 'object' ? signal : {}\n    siblings.push(\n      <SignalBridge\n        key=\"sk-signal\"\n        enabled\n        realtime={signalConfig.realtime !== false}\n        experiments={signalConfig.experiments !== false}\n        behaviorTracking={signalConfig.behaviorTracking !== false}\n        visitorId={visitorId}\n        sessionId={sessionId}\n        pageMetadataRef={pageMetadataRef}\n      />,\n    )\n  }\n\n  // Add Analytics if enabled (renders alongside, doesn't wrap).\n  //\n  // CRITICAL: LazyAnalyticsProvider is dynamic(..., { ssr: false }). Wrapping\n  // {content} inside an ssr:false component makes the entire page tree skip\n  // server rendering — the route de-opts to 100% client rendering and the\n  // hero / LCP element only paints after hydration (mobile LCP ~4s, Lighthouse\n  // ~85). Analytics tracks via effects + a metadata ref, so it never needs to\n  // wrap page content — mount it as a childless sibling, exactly like Engage.\n  // Each deferred sibling is appended as `{modulesReady && <Module/>}` so the\n  // children slot never moves in the tree — flipping ready only mounts the\n  // sibling, it never remounts page content.\n  if (analytics) {\n    siblings.push(\n      <React.Fragment key=\"sk-analytics\">\n        {modulesReady && (\n          <Suspense fallback={null}>\n            <LazyAnalyticsProvider\n              apiUrl={apiUrl}\n              apiKey={apiKey}\n              site={site}\n              trackPageViews={analyticsConfig.trackPageViews !== false}\n              trackWebVitals={analyticsConfig.trackWebVitals !== false}\n              trackScrollDepth={analyticsConfig.trackScrollDepth !== false}\n              trackClicks={analyticsConfig.trackClicks !== false}\n              sessionTimeout={analyticsConfig.sessionDuration}\n              excludePaths={analyticsConfig.excludePaths}\n              debug={debug}\n              externalVisitorId={visitorId}\n              externalSessionId={sessionId}\n              onPageMetadata={onPageMetadata}\n            />\n          </Suspense>\n        )}\n      </React.Fragment>,\n    )\n  }\n\n  // Engage widget — childless sibling\n  if (engage) {\n    const engageConfig: EngageConfig =\n      typeof engage === 'object' ? engage : {}\n    siblings.push(\n      <React.Fragment key=\"sk-engage\">\n        {modulesReady && (\n          <LazyEngageWidget\n            apiUrl={apiUrl}\n            apiKey={apiKey}\n            projectId={projectId}\n            position={engageConfig.position || 'bottom-right'}\n            zIndex={engageConfig.zIndex}\n            chatEnabled={engageConfig.chatEnabled !== false}\n          />\n        )}\n      </React.Fragment>,\n    )\n  }\n\n  // SitemapSync — childless sibling\n  if (sitemapSync) {\n    siblings.push(\n      <React.Fragment key=\"sk-sitemap\">\n        {modulesReady && <LazySitemapSync debug={debug} />}\n      </React.Fragment>,\n    )\n  }\n\n  // Fleet heartbeat — childless sibling on the same modulesReady idle gate.\n  // Reports the modules actually enabled on THIS layout (honest client-observable\n  // set) so the platform can answer \"which version / modules is each site\n  // running\". defer={false}: the modulesReady gate already handled deferral, so\n  // the heartbeat fires on mount (still bounded to once per session internally).\n  if (fleet) {\n    const activeModules: FleetModule[] = []\n    if (analytics) activeModules.push('analytics')\n    if (engage) activeModules.push('engage')\n    if (signal) activeModules.push('signal')\n    if (sitemapSync) activeModules.push('sitemapSync')\n    siblings.push(\n      <React.Fragment key=\"sk-fleet\">\n        {modulesReady && (\n          <FleetHeartbeat\n            apiUrl={apiUrl}\n            apiKey={apiKey}\n            site={site}\n            modules={activeModules}\n            defer={false}\n            debug={debug}\n          />\n        )}\n      </React.Fragment>,\n    )\n  }\n\n  return (\n    <>\n      {children}\n      {siblings}\n    </>\n  )\n}\n"]}

package/dist/{chunk-NB4MK2Q5.js → chunk-SWIKKSKL.js}

@@ -10,9 +10,10 @@ function normalizeSiteHost(site) {
   if (slash >= 0) s = s.slice(0, slash);
   const colon = s.indexOf(":");
   if (colon >= 0) s = s.slice(0, colon);
+  s = s.replace(/\.+$/, "");
   return s || null;
 }
 
 exports.normalizeSiteHost = normalizeSiteHost;
-//# sourceMappingURL=chunk-NB4MK2Q5.js.map
-//# sourceMappingURL=chunk-NB4MK2Q5.js.map
+//# sourceMappingURL=chunk-SWIKKSKL.js.map
+//# sourceMappingURL=chunk-SWIKKSKL.js.map

package/dist/chunk-SWIKKSKL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sites/normalize.ts"],"names":[],"mappings":";;;AAmCO,SAAS,kBAAkB,IAAA,EAAqC;AACrE,EAAA,IAAI,CAAC,IAAA,IAAQ,OAAO,IAAA,KAAS,UAAU,OAAO,IAAA;AAC9C,EAAA,IAAI,CAAA,GAAI,IAAA,CAAK,IAAA,EAAK,CAAE,WAAA,EAAY;AAChC,EAAA,IAAI,CAAC,GAAG,OAAO,IAAA;AAEf,EAAA,CAAA,GAAI,CAAA,CAAE,OAAA,CAAQ,cAAA,EAAgB,EAAE,CAAA;AAEhC,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AAC3B,EAAA,IAAI,SAAS,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,KAAA,CAAM,GAAG,KAAK,CAAA;AAEpC,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AAC3B,EAAA,IAAI,SAAS,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,KAAA,CAAM,GAAG,KAAK,CAAA;AAIpC,EAAA,CAAA,GAAI,CAAA,CAAE,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACxB,EAAA,OAAO,CAAA,IAAK,IAAA;AACd","file":"chunk-SWIKKSKL.js","sourcesContent":["/**\n * @sonordev/site-kit/sites — normalizeSiteHost (leaf module)\n *\n * Deliberately its own file, not part of `./contract`, so browser code can pull\n * in the normalizer WITHOUT the rest of the contract surface.\n *\n * `publishCredential` (which every client entry that publishes a credential\n * imports) needs exactly this one function. When it lived in `./contract`, the\n * bundler emitted that whole module as one shared chunk — `SITE_HOST_JSON_SCHEMA`,\n * `SITE_HOST_CONTRACT_VERSION`, `stripWww`, `sameSite`, `hostFromUrl`,\n * `isNormalizedSiteHost` and all — into `client`, `layout/client` and every\n * other entry that touched it. That was ~750B gzipped of agent-facing contract\n * metadata shipped to browsers for a 14-line string normalizer, and it is what\n * pushed those entries over their bundle budgets.\n *\n * `./contract` re-exports this, so the public `@sonordev/site-kit/sites/contract`\n * surface and the cross-repo drift tests are unchanged. Keep the implementation\n * HERE — the Nest APIs mirror this exact logic (sonor-api\n * `src/common/utils/site-host.ts`, signal-api `src/shared/utils/seo-page-pick.util.ts`).\n *\n * Pure string logic only (no Node built-ins) so it is safe in the browser.\n */\n\n/**\n * normalizeSiteHost — canonical normalizer for a sub-site host value before it\n * is persisted or used as a filter.\n *\n *   `https://OhioPowerStudies.com:3000/path` → `ohiopowerstudies.com`\n *\n * Lowercases, strips protocol, keeps host only (drops path + query), strips\n * port (rollups span dev/prod) and the FQDN root dot. Returns null for\n * empty/non-string input.\n * Note: `www.` is intentionally preserved here — use `sameSite`/`stripWww`\n * for www-insensitive equality.\n */\nexport function normalizeSiteHost(site?: string | null): string | null {\n  if (!site || typeof site !== 'string') return null\n  let s = site.trim().toLowerCase()\n  if (!s) return null\n  // Strip protocol if present\n  s = s.replace(/^https?:\\/\\//, '')\n  // Keep host only — drop everything from first slash onward\n  const slash = s.indexOf('/')\n  if (slash >= 0) s = s.slice(0, slash)\n  // Strip port (rollups span dev/prod)\n  const colon = s.indexOf(':')\n  if (colon >= 0) s = s.slice(0, colon)\n  // Strip the FQDN root dot — \"spademade.com.\" is the same host as\n  // \"spademade.com\". Because `site` is part of seo_pages identity, leaving the\n  // dot on spells one site as two and mints a full duplicate page set.\n  s = s.replace(/\\.+$/, '')\n  return s || null\n}\n"]}

package/dist/{chunk-BDDTZJKC.js → chunk-T6YDAJ5F.js}

@@ -1,7 +1,7 @@
 'use strict';
 
 var chunkKHPJ3CEL_js = require('./chunk-KHPJ3CEL.js');
-var chunkZJNIM4GQ_js = require('./chunk-ZJNIM4GQ.js');
+var chunkTBIWQQVF_js = require('./chunk-TBIWQQVF.js');
 
 // src/forms/defaultSuccessMessage.ts
 var DEFAULT_FORM_SUCCESS_MESSAGE = "Thank you for your submission! We will be in touch soon.";
@@ -158,7 +158,7 @@ async function submitForm({
       _formLoadedAt: formLoadedAt
     }
   };
-  const response = await chunkZJNIM4GQ_js.sonorFetch(
+  const response = await chunkTBIWQQVF_js.sonorFetch(
     `${apiUrl}/api/public/forms/submit`,
     {
       method: "POST",
@@ -184,5 +184,5 @@ exports.DEFAULT_FORM_SUCCESS_MESSAGE = DEFAULT_FORM_SUCCESS_MESSAGE;
 exports.getApiConfig = getApiConfig;
 exports.normalizeFormConfig = normalizeFormConfig;
 exports.submitForm = submitForm;
-//# sourceMappingURL=chunk-BDDTZJKC.js.map
-//# sourceMappingURL=chunk-BDDTZJKC.js.map
+//# sourceMappingURL=chunk-T6YDAJ5F.js.map
+//# sourceMappingURL=chunk-T6YDAJ5F.js.map

package/dist/{chunk-BDDTZJKC.js.map → chunk-T6YDAJ5F.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/forms/defaultSuccessMessage.ts","../src/forms/normalize-config.ts","../src/forms/recaptcha.ts","../src/forms/submitForm.ts"],"names":["DEFAULT_HONEYPOT_FIELD","sonorFetch"],"mappings":";;;;;;AACO,IAAM,4BAAA,GACX;;;ACiBK,SAAS,oBAAoB,IAAA,EAA8B;AAChE,EAAA,IAAI,KAAK,KAAA,EAAO;AACd,IAAA,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,EAAQ,CAAA,KAAA,CAAY,EAAE,WAAA,IAAe,CAAA,KAAM,CAAA,CAAE,WAAA,IAAe,CAAA,CAAE,CAAA;AAAA,EACjF;AACA,EAAA,IAAI,KAAK,MAAA,EAAQ;AACf,IAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,EAAQ,CAAA,KAAA,CAAY,EAAE,UAAA,IAAc,CAAA,KAAM,CAAA,CAAE,UAAA,IAAc,CAAA,CAAE,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,EAAO,MAAA,IAAU,CAAA;AAC1C,EAAA,MAAM,gBAAgB,WAAA,GAAc,CAAA;AAEpC,EAAA,MAAM,UAAA,GACJ,OAAO,IAAA,CAAK,eAAA,KAAoB,WAAW,IAAA,CAAK,eAAA,CAAgB,MAAK,GAAI,EAAA;AAC3E,EAAA,MAAM,eAAA,GACJ,UAAA,KACC,OAAQ,IAAA,CAAqC,cAAA,KAAmB,QAAA,GAC7D,MAAA,CAAQ,IAAA,CAAqC,cAAc,CAAA,CAAE,IAAA,EAAK,GAClE,EAAA,CAAA,IACJ,4BAAA;AAEF,EAAA,OAAO;AAAA,IACL,GAAG,IAAA;AAAA,IACH,eAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF;AACF;;;ACrCA,SAAS,WAAW,eAAA,EAA8C;AAChE,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,MAAA;AAC1C,EAAA,IAAI,iBAAiB,OAAO,eAAA;AAC5B,EAAA,MAAM,GAAA,GAAM,MAAA;AACZ,EAAA,OAAO,GAAA,CAAI,+BAAA,IAAmC,OAAA,CAAQ,GAAA,CAAI,8BAAA;AAC5D;AAGA,IAAM,yBAAA,GAA4B,GAAA;AAElC,SAAS,WAAW,OAAA,EAA+B;AACjD,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC9B,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,MAAA;AACZ,IAAA,IAAI,GAAA,CAAI,YAAY,UAAA,EAAY;AAC9B,MAAA,OAAA,CAAQ,IAAI,UAAU,CAAA;AACtB,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,MAAM,MAAA,GAAS,CAAC,KAAA,KAAe;AAC7B,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,IACf,CAAA;AACA,IAAA,MAAM,SAAS,UAAA,CAAW,MAAM,MAAA,CAAO,IAAI,GAAG,yBAAyB,CAAA;AAEvE,IAAA,MAAM,eAAe,MAAM;AACzB,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,IAAI,GAAA,CAAI,YAAY,UAAA,EAAY;AAC9B,QAAA,YAAA,CAAa,MAAM,CAAA;AACnB,QAAA,MAAA,CAAO,IAAI,UAAU,CAAA;AACrB,QAAA;AAAA,MACF;AACA,MAAA,UAAA,CAAW,cAAc,EAAE,CAAA;AAAA,IAC7B,CAAA;AAEA,IAAA,MAAM,QAAA,GAAW,QAAA,CAAS,aAAA,CAAc,qCAAqC,CAAA;AAC7E,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,YAAA,EAAa;AACb,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,IAAA,MAAA,CAAO,GAAA,GAAM,yDAAyD,OAAO,CAAA,CAAA;AAC7E,IAAA,MAAA,CAAO,KAAA,GAAQ,IAAA;AACf,IAAA,MAAA,CAAO,MAAA,GAAS,MAAM,YAAA,EAAa;AACnC,IAAA,MAAA,CAAO,UAAU,MAAM;AACrB,MAAA,YAAA,CAAa,MAAM,CAAA;AACnB,MAAA,MAAA,CAAO,IAAI,CAAA;AAAA,IACb,CAAA;AACA,IAAA,QAAA,CAAS,IAAA,CAAK,YAAY,MAAM,CAAA;AAAA,EAClC,CAAC,CAAA;AACH;AAMA,eAAsB,kBAAkB,eAAA,EAAkD;AACxF,EAAA,MAAM,OAAA,GAAU,WAAW,eAAe,CAAA;AAC1C,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,MAAA,KAAW,aAAa,OAAO,IAAA;AACtD,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,MAAM,UAAA,CAAW,OAAO,CAAA;AAC3C,IAAA,IAAI,CAAC,UAAA,EAAY,UAAA,EAAY,OAAA,EAAS,OAAO,IAAA;AAK7C,IAAA,MAAM,IAAI,QAAc,CAAC,OAAA,KAAY,WAAW,UAAA,CAAW,KAAA,CAAM,OAAO,CAAC,CAAA;AACzE,IAAA,MAAM,KAAA,GAAQ,MAAM,UAAA,CAAW,UAAA,CAAW,QAAQ,OAAA,EAAS,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AAC/E,IAAA,OAAO,KAAA,IAAS,IAAA;AAAA,EAClB,SAAS,GAAA,EAAK;AAGZ,IAAA,IAAI;AACF,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,GAAG,CAAC,CAAA;AACvD,MAAA,MAAM,GAAA,GAAM,MAAA;AACZ,MAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,UAAA,CAAW,UAAA,CAAW,QAAQ,OAAA,EAAS,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AACnF,MAAA,OAAO,KAAA,IAAS,IAAA;AAAA,IAClB,SAAS,QAAA,EAAU;AACjB,MAAA,OAAA,CAAQ,IAAA,CAAK,wBAAwB,QAAQ,CAAA;AAC7C,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACF;;;AChFO,SAAS,YAAA,GAA+D;AAI7E,EAAA,MAAM,MAAA,GACJ,OAAO,MAAA,KAAW,WAAA,GACb,MAAA,CAAe,oBAAA,IAAwB,sBAAA,GACxC,OAAA,CAAQ,GAAA,CAAI,aAAA,IAAiB,OAAA,CAAQ,GAAA,CAAI,yBAAA,IAA6B,sBAAA;AAC5E,EAAA,MAAM,MAAA,GACJ,OAAO,MAAA,KAAW,WAAA,GAAe,OAAe,oBAAA,GAAuB,MAAA;AACzE,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC1B;AAEA,SAAS,YAAA,GAA8C;AACrD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,EAAC;AAC3C,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAA,CAAO,SAAS,MAAM,CAAA;AACzD,EAAA,MAAM,MAAqC,EAAC;AAC5C,EAAA,KAAA,MAAW,OAAO,CAAC,YAAA,EAAc,cAAc,cAAA,EAAgB,UAAA,EAAY,aAAa,CAAA,EAAG;AACzF,IAAA,GAAA,CAAI,GAAG,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAAA,EAC3B;AACA,EAAA,OAAO,GAAA;AACT;AAoBA,eAAsB,UAAA,CAAW;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA,EAAqC;AACnC,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,YAAA,EAAa;AACxC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,MAAM,6DAA6D,CAAA;AAAA,EAC/E;AAGA,EAAA,MAAM,iBAAiB,MAAA,CAAO,iBAAA,GAC1B,MAAM,iBAAA,CAAkB,MAAA,CAAO,kBAAkB,CAAA,GACjD,IAAA;AACJ,EAAA,IAAI,MAAA,CAAO,iBAAA,IAAqB,CAAC,cAAA,EAAgB;AAC/C,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC1E;AAEA,EAAA,MAAM,iBAAA,GAAoB,OAAO,cAAA,IAAkBA,uCAAA;AACnD,EAAA,MAAM,MAAM,YAAA,EAAa;AAEzB,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,QAAQ,MAAA,CAAO,EAAA;AAAA,IACf,SAAS,MAAA,CAAO,EAAA;AAAA,IAChB,IAAA,EAAM;AAAA,MACJ,GAAG,MAAA;AAAA,MACH,GAAI,OAAO,gBAAA,GAAmB,EAAE,CAAC,iBAAiB,GAAG,aAAA,EAAc,GAAI;AAAC,KAC1E;AAAA,IACA,QAAA,EAAU;AAAA,MACR,SAAS,OAAO,MAAA,KAAW,WAAA,GAAc,MAAA,CAAO,SAAS,IAAA,GAAO,IAAA;AAAA,MAChE,UAAU,OAAO,QAAA,KAAa,WAAA,GAAc,QAAA,CAAS,YAAY,IAAA,GAAO,IAAA;AAAA,MACxE,SAAA,EAAW,OAAO,SAAA,KAAc,WAAA,GAAc,UAAU,SAAA,GAAY,IAAA;AAAA,MACpE,WACE,OAAO,cAAA,KAAmB,cAAc,cAAA,CAAe,OAAA,CAAQ,SAAS,CAAA,GAAI,IAAA;AAAA;AAAA;AAAA;AAAA,MAI9E,WACE,OAAO,YAAA,KAAiB,cAAc,YAAA,CAAa,OAAA,CAAQ,SAAS,CAAA,GAAI,IAAA;AAAA,MAC1E,gBAAgB,cAAA,IAAkB,MAAA;AAAA,MAClC,WAAW,GAAA,CAAI,UAAA;AAAA,MACf,WAAW,GAAA,CAAI,UAAA;AAAA,MACf,aAAa,GAAA,CAAI,YAAA;AAAA,MACjB,SAAS,GAAA,CAAI,QAAA;AAAA,MACb,YAAY,GAAA,CAAI,WAAA;AAAA;AAAA;AAAA,MAGhB,IAAA,EACE,OAAO,MAAA,KAAW,WAAA,GACb,OAA0C,iBAAA,IAC3C,MAAA,CAAO,SAAS,IAAA,GAChB,MAAA;AAAA,MACN,aAAA,EAAe;AAAA;AACjB,GACF;AAEA,EAAA,MAAM,WAAW,MAAMC,2BAAA;AAAA,IACrB,GAAG,MAAM,CAAA,wBAAA,CAAA;AAAA,IACT;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,aAAA,EAAe,UAAU,MAAM,CAAA;AAAA,OACjC;AAAA,MACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAO;AAAA,KAC9B;AAAA,IACA,EAAE,OAAA,EAAS,CAAA,EAAG,SAAA,EAAW,GAAA;AAAM,GACjC;AAEA,EAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAEnD,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,GAAA,GAAA,CACJ,IAAA,EAAM,OAAA,IACN,IAAA,EAAM,KAAA,KACL,QAAA,CAAS,UAAA,IAAc,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA,CAAA,EAE9C,QAAA,GACA,IAAA,EAAK;AACR,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,MAAM,CAAA,uBAAA,EAA0B,GAAG,CAAA,CAAA,GAAK,CAAA,uBAAA,EAA0B,SAAS,MAAM,CAAA,CAAA;AAAA,KACnF;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT","file":"chunk-BDDTZJKC.js","sourcesContent":["/** Shown when the API omits or returns an empty `success_message`. */\nexport const DEFAULT_FORM_SUCCESS_MESSAGE =\n  'Thank you for your submission! We will be in touch soon.'\n","/**\n * Shared form-config normalizer — the ONE place a raw\n * /api/public/forms/config payload becomes a ManagedFormConfig.\n *\n * Deliberately has no `'use client'` directive and no hooks, so it is usable\n * from a Server Component (StaticForm) as well as from useForm's client\n * fetch. Both the server shell and the hydrated enhancement must agree on\n * field order, step count and success copy or the swap visibly jumps, so\n * there must never be a second copy of this.\n */\n\nimport type { ManagedFormConfig } from './types'\nimport { DEFAULT_FORM_SUCCESS_MESSAGE } from './defaultSuccessMessage'\n\n/**\n * Normalize a raw /api/public/forms/config payload into ManagedFormConfig.\n * Single source of truth — used for both the client fetch and server-provided\n * `initialForm`, so the two paths can never drift.\n */\nexport function normalizeFormConfig(data: any): ManagedFormConfig {\n  if (data.steps) {\n    data.steps.sort((a: any, b: any) => (a.step_number || 0) - (b.step_number || 0))\n  }\n  if (data.fields) {\n    data.fields.sort((a: any, b: any) => (a.sort_order || 0) - (b.sort_order || 0))\n  }\n\n  const total_steps = data.steps?.length || 1\n  const is_multi_step = total_steps > 1\n\n  const apiSuccess =\n    typeof data.success_message === 'string' ? data.success_message.trim() : ''\n  const success_message =\n    apiSuccess ||\n    (typeof (data as { successMessage?: string }).successMessage === 'string'\n      ? String((data as { successMessage?: string }).successMessage).trim()\n      : '') ||\n    DEFAULT_FORM_SUCCESS_MESSAGE\n\n  return {\n    ...data,\n    success_message,\n    total_steps,\n    is_multi_step,\n  }\n}\n","/**\n * reCAPTCHA Enterprise - Client-side token generation for site-kit forms\n *\n * Site key is read from:\n * - window.__SITE_KIT_RECAPTCHA_SITE_KEY__ (set by SiteKitLayout)\n * - process.env.NEXT_PUBLIC_RECAPTCHA_SITE_KEY (when bundled in Next.js app)\n */\n\nfunction getSiteKey(explicitSiteKey?: string): string | undefined {\n  if (typeof window === 'undefined') return undefined\n  if (explicitSiteKey) return explicitSiteKey\n  const win = window as any\n  return win.__SITE_KIT_RECAPTCHA_SITE_KEY__ ?? process.env.NEXT_PUBLIC_RECAPTCHA_SITE_KEY\n}\n\n/** Max time to wait for reCAPTCHA Enterprise to become usable before giving up. */\nconst RECAPTCHA_LOAD_TIMEOUT_MS = 10000\n\nfunction loadScript(siteKey: string): Promise<any> {\n  return new Promise((resolve) => {\n    if (typeof window === 'undefined') {\n      resolve(null)\n      return\n    }\n    const win = window as any\n    if (win.grecaptcha?.enterprise) {\n      resolve(win.grecaptcha)\n      return\n    }\n\n    // Never hang the form: if the script is blocked (ad-blocker), stalls, or\n    // never initializes `grecaptcha.enterprise`, resolve null after a timeout.\n    // The caller treats a null result as \"no token\" rather than waiting forever.\n    let settled = false\n    const finish = (value: any) => {\n      if (settled) return\n      settled = true\n      resolve(value)\n    }\n    const giveUp = setTimeout(() => finish(null), RECAPTCHA_LOAD_TIMEOUT_MS)\n\n    const waitForReady = () => {\n      if (settled) return\n      if (win.grecaptcha?.enterprise) {\n        clearTimeout(giveUp)\n        finish(win.grecaptcha)\n        return\n      }\n      setTimeout(waitForReady, 50)\n    }\n\n    const existing = document.querySelector('script[src*=\"recaptcha/enterprise\"]')\n    if (existing) {\n      waitForReady()\n      return\n    }\n\n    const script = document.createElement('script')\n    script.src = `https://www.google.com/recaptcha/enterprise.js?render=${siteKey}`\n    script.async = true\n    script.onload = () => waitForReady()\n    script.onerror = () => {\n      clearTimeout(giveUp)\n      finish(null)\n    }\n    document.head.appendChild(script)\n  })\n}\n\n/**\n * Get a reCAPTCHA Enterprise token for form submission.\n * Returns null if not configured or in SSR.\n */\nexport async function getRecaptchaToken(explicitSiteKey?: string): Promise<string | null> {\n  const siteKey = getSiteKey(explicitSiteKey)\n  if (!siteKey || typeof window === 'undefined') return null\n  try {\n    const grecaptcha = await loadScript(siteKey)\n    if (!grecaptcha?.enterprise?.execute) return null\n    // loadScript only waits for grecaptcha.enterprise to EXIST — execute()\n    // before enterprise.ready() rejects while the widget initializes (cold\n    // page load = every first-visit submitter). A swallowed rejection here\n    // means no token, and a requireRecaptcha project hard-rejects the lead.\n    await new Promise<void>((resolve) => grecaptcha.enterprise.ready(resolve))\n    const token = await grecaptcha.enterprise.execute(siteKey, { action: 'submit' })\n    return token || null\n  } catch (err) {\n    // One retry after a beat — first-execute flakes persist on slow devices\n    // even post-ready, and a dropped token is a dropped lead.\n    try {\n      await new Promise((resolve) => setTimeout(resolve, 800))\n      const win = window as any\n      const token = await win.grecaptcha.enterprise.execute(siteKey, { action: 'submit' })\n      return token || null\n    } catch (retryErr) {\n      console.warn('[site-kit reCAPTCHA]', retryErr)\n      return null\n    }\n  }\n}\n","/**\n * @sonordev/site-kit/forms - Shared submission logic\n *\n * Single source of truth for sending a managed form to the Sonor API. Both\n * <ManagedForm> (via FormClient) and the headless useForm() hook submit through\n * here, so the request shape, retry behaviour, reCAPTCHA handling, and error\n * parsing can never drift between the two paths.\n */\n\nimport { sonorFetch } from '../shared/sonorFetch'\nimport { getRecaptchaToken } from './recaptcha'\nimport { DEFAULT_HONEYPOT_FIELD } from './contract'\nimport type { ManagedFormConfig } from './types'\n\n// The honeypot trap-field name lives once in the shared forms contract\n// (single source of truth for site-kit's client + sonor-api's intake).\n// Re-exported so existing importers of this path keep resolving it.\nexport { DEFAULT_HONEYPOT_FIELD }\n\nexport function getApiConfig(): { apiUrl: string; apiKey: string | undefined } {\n  // Server branch must honor the same env override SiteKitLayout feeds into\n  // __SITE_KIT_API_URL__, or SSR-rendered absolute URLs (the native form\n  // action) would point at prod from a staging site.\n  const apiUrl =\n    typeof window !== 'undefined'\n      ? (window as any).__SITE_KIT_API_URL__ || 'https://api.sonor.io'\n      : process.env.SONOR_API_URL || process.env.NEXT_PUBLIC_SONOR_API_URL || 'https://api.sonor.io'\n  const apiKey =\n    typeof window !== 'undefined' ? (window as any).__SITE_KIT_API_KEY__ : undefined\n  return { apiUrl, apiKey }\n}\n\nfunction getUTMParams(): Record<string, string | null> {\n  if (typeof window === 'undefined') return {}\n  const params = new URLSearchParams(window.location.search)\n  const out: Record<string, string | null> = {}\n  for (const key of ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content']) {\n    out[key] = params.get(key)\n  }\n  return out\n}\n\nexport interface SubmitFormArgs {\n  config: ManagedFormConfig\n  /**\n   * Field values to submit. The caller must pass VISIBLE values only —\n   * conditionally-hidden fields should be excluded so stale values are not sent.\n   */\n  values: Record<string, unknown>\n  /** Honeypot input value (empty string for the headless hook, which has no honeypot UI). */\n  honeypotValue: string\n  /** Timestamp (ms) the form was first rendered — a weak anti-bot timing signal. */\n  formLoadedAt: number\n}\n\n/**\n * Submit a managed form. Throws on failure (network, timeout, or a non-2xx\n * response) with a human-readable message; resolves with the parsed API\n * response on success.\n */\nexport async function submitForm({\n  config,\n  values,\n  honeypotValue,\n  formLoadedAt,\n}: SubmitFormArgs): Promise<unknown> {\n  const { apiUrl, apiKey } = getApiConfig()\n  if (!apiKey) {\n    throw new Error('API key is required. Set SONOR_API_KEY in your environment.')\n  }\n\n  // reCAPTCHA token is fetched right before the POST so it cannot expire.\n  const recaptchaToken = config.recaptcha_enabled\n    ? await getRecaptchaToken(config.recaptcha_site_key)\n    : null\n  if (config.recaptcha_enabled && !recaptchaToken) {\n    throw new Error('Verification could not be completed. Please try again.')\n  }\n\n  const honeypotFieldName = config.honeypot_field || DEFAULT_HONEYPOT_FIELD\n  const utm = getUTMParams()\n\n  const payload = {\n    formId: config.id,\n    form_id: config.id,\n    data: {\n      ...values,\n      ...(config.honeypot_enabled ? { [honeypotFieldName]: honeypotValue } : {}),\n    },\n    metadata: {\n      pageUrl: typeof window !== 'undefined' ? window.location.href : null,\n      referrer: typeof document !== 'undefined' ? document.referrer || null : null,\n      userAgent: typeof navigator !== 'undefined' ? navigator.userAgent : null,\n      sessionId:\n        typeof sessionStorage !== 'undefined' ? sessionStorage.getItem('_sk_sid') : null,\n      // Anonymous visitor id (_sk_vid) — the same id Analytics/Signal stamp on\n      // page views, so the Sonor side can bind this lead to its browsing session\n      // (page -> lead attribution). Sent on every submission; null pre-hydration.\n      visitorId:\n        typeof localStorage !== 'undefined' ? localStorage.getItem('_sk_vid') : null,\n      recaptchaToken: recaptchaToken || undefined,\n      utmSource: utm.utm_source,\n      utmMedium: utm.utm_medium,\n      utmCampaign: utm.utm_campaign,\n      utmTerm: utm.utm_term,\n      utmContent: utm.utm_content,\n      // Sub-site host — preserved on form_submissions for lead attribution\n      // across multi-site projects. Resolved by SiteKitClientProviders.\n      site:\n        typeof window !== 'undefined'\n          ? (window as { __SITE_KIT_SITE__?: string }).__SITE_KIT_SITE__ ||\n            window.location.host\n          : undefined,\n      _formLoadedAt: formLoadedAt,\n    },\n  }\n\n  const response = await sonorFetch(\n    `${apiUrl}/api/public/forms/submit`,\n    {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${apiKey}`,\n      },\n      body: JSON.stringify(payload),\n    },\n    { retries: 2, timeoutMs: 20000 },\n  )\n\n  const data = await response.json().catch(() => null)\n\n  if (!response.ok) {\n    const msg = (\n      data?.message ??\n      data?.error ??\n      (response.statusText || `HTTP ${response.status}`)\n    )\n      .toString()\n      .trim()\n    throw new Error(\n      msg ? `Failed to submit form: ${msg}` : `Failed to submit form (${response.status})`,\n    )\n  }\n\n  return data\n}\n"]}
+{"version":3,"sources":["../src/forms/defaultSuccessMessage.ts","../src/forms/normalize-config.ts","../src/forms/recaptcha.ts","../src/forms/submitForm.ts"],"names":["DEFAULT_HONEYPOT_FIELD","sonorFetch"],"mappings":";;;;;;AACO,IAAM,4BAAA,GACX;;;ACiBK,SAAS,oBAAoB,IAAA,EAA8B;AAChE,EAAA,IAAI,KAAK,KAAA,EAAO;AACd,IAAA,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,EAAQ,CAAA,KAAA,CAAY,EAAE,WAAA,IAAe,CAAA,KAAM,CAAA,CAAE,WAAA,IAAe,CAAA,CAAE,CAAA;AAAA,EACjF;AACA,EAAA,IAAI,KAAK,MAAA,EAAQ;AACf,IAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,EAAQ,CAAA,KAAA,CAAY,EAAE,UAAA,IAAc,CAAA,KAAM,CAAA,CAAE,UAAA,IAAc,CAAA,CAAE,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,EAAO,MAAA,IAAU,CAAA;AAC1C,EAAA,MAAM,gBAAgB,WAAA,GAAc,CAAA;AAEpC,EAAA,MAAM,UAAA,GACJ,OAAO,IAAA,CAAK,eAAA,KAAoB,WAAW,IAAA,CAAK,eAAA,CAAgB,MAAK,GAAI,EAAA;AAC3E,EAAA,MAAM,eAAA,GACJ,UAAA,KACC,OAAQ,IAAA,CAAqC,cAAA,KAAmB,QAAA,GAC7D,MAAA,CAAQ,IAAA,CAAqC,cAAc,CAAA,CAAE,IAAA,EAAK,GAClE,EAAA,CAAA,IACJ,4BAAA;AAEF,EAAA,OAAO;AAAA,IACL,GAAG,IAAA;AAAA,IACH,eAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF;AACF;;;ACrCA,SAAS,WAAW,eAAA,EAA8C;AAChE,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,MAAA;AAC1C,EAAA,IAAI,iBAAiB,OAAO,eAAA;AAC5B,EAAA,MAAM,GAAA,GAAM,MAAA;AACZ,EAAA,OAAO,GAAA,CAAI,+BAAA,IAAmC,OAAA,CAAQ,GAAA,CAAI,8BAAA;AAC5D;AAGA,IAAM,yBAAA,GAA4B,GAAA;AAElC,SAAS,WAAW,OAAA,EAA+B;AACjD,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC9B,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,MAAA;AACZ,IAAA,IAAI,GAAA,CAAI,YAAY,UAAA,EAAY;AAC9B,MAAA,OAAA,CAAQ,IAAI,UAAU,CAAA;AACtB,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,MAAM,MAAA,GAAS,CAAC,KAAA,KAAe;AAC7B,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,IACf,CAAA;AACA,IAAA,MAAM,SAAS,UAAA,CAAW,MAAM,MAAA,CAAO,IAAI,GAAG,yBAAyB,CAAA;AAEvE,IAAA,MAAM,eAAe,MAAM;AACzB,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,IAAI,GAAA,CAAI,YAAY,UAAA,EAAY;AAC9B,QAAA,YAAA,CAAa,MAAM,CAAA;AACnB,QAAA,MAAA,CAAO,IAAI,UAAU,CAAA;AACrB,QAAA;AAAA,MACF;AACA,MAAA,UAAA,CAAW,cAAc,EAAE,CAAA;AAAA,IAC7B,CAAA;AAEA,IAAA,MAAM,QAAA,GAAW,QAAA,CAAS,aAAA,CAAc,qCAAqC,CAAA;AAC7E,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,YAAA,EAAa;AACb,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,IAAA,MAAA,CAAO,GAAA,GAAM,yDAAyD,OAAO,CAAA,CAAA;AAC7E,IAAA,MAAA,CAAO,KAAA,GAAQ,IAAA;AACf,IAAA,MAAA,CAAO,MAAA,GAAS,MAAM,YAAA,EAAa;AACnC,IAAA,MAAA,CAAO,UAAU,MAAM;AACrB,MAAA,YAAA,CAAa,MAAM,CAAA;AACnB,MAAA,MAAA,CAAO,IAAI,CAAA;AAAA,IACb,CAAA;AACA,IAAA,QAAA,CAAS,IAAA,CAAK,YAAY,MAAM,CAAA;AAAA,EAClC,CAAC,CAAA;AACH;AAMA,eAAsB,kBAAkB,eAAA,EAAkD;AACxF,EAAA,MAAM,OAAA,GAAU,WAAW,eAAe,CAAA;AAC1C,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,MAAA,KAAW,aAAa,OAAO,IAAA;AACtD,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,MAAM,UAAA,CAAW,OAAO,CAAA;AAC3C,IAAA,IAAI,CAAC,UAAA,EAAY,UAAA,EAAY,OAAA,EAAS,OAAO,IAAA;AAK7C,IAAA,MAAM,IAAI,QAAc,CAAC,OAAA,KAAY,WAAW,UAAA,CAAW,KAAA,CAAM,OAAO,CAAC,CAAA;AACzE,IAAA,MAAM,KAAA,GAAQ,MAAM,UAAA,CAAW,UAAA,CAAW,QAAQ,OAAA,EAAS,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AAC/E,IAAA,OAAO,KAAA,IAAS,IAAA;AAAA,EAClB,SAAS,GAAA,EAAK;AAGZ,IAAA,IAAI;AACF,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,GAAG,CAAC,CAAA;AACvD,MAAA,MAAM,GAAA,GAAM,MAAA;AACZ,MAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,UAAA,CAAW,UAAA,CAAW,QAAQ,OAAA,EAAS,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AACnF,MAAA,OAAO,KAAA,IAAS,IAAA;AAAA,IAClB,SAAS,QAAA,EAAU;AACjB,MAAA,OAAA,CAAQ,IAAA,CAAK,wBAAwB,QAAQ,CAAA;AAC7C,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACF;;;AChFO,SAAS,YAAA,GAA+D;AAI7E,EAAA,MAAM,MAAA,GACJ,OAAO,MAAA,KAAW,WAAA,GACb,MAAA,CAAe,oBAAA,IAAwB,sBAAA,GACxC,OAAA,CAAQ,GAAA,CAAI,aAAA,IAAiB,OAAA,CAAQ,GAAA,CAAI,yBAAA,IAA6B,sBAAA;AAC5E,EAAA,MAAM,MAAA,GACJ,OAAO,MAAA,KAAW,WAAA,GAAe,OAAe,oBAAA,GAAuB,MAAA;AACzE,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC1B;AAEA,SAAS,YAAA,GAA8C;AACrD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,EAAC;AAC3C,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAA,CAAO,SAAS,MAAM,CAAA;AACzD,EAAA,MAAM,MAAqC,EAAC;AAC5C,EAAA,KAAA,MAAW,OAAO,CAAC,YAAA,EAAc,cAAc,cAAA,EAAgB,UAAA,EAAY,aAAa,CAAA,EAAG;AACzF,IAAA,GAAA,CAAI,GAAG,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAAA,EAC3B;AACA,EAAA,OAAO,GAAA;AACT;AAoBA,eAAsB,UAAA,CAAW;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA,EAAqC;AACnC,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,YAAA,EAAa;AACxC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,MAAM,6DAA6D,CAAA;AAAA,EAC/E;AAGA,EAAA,MAAM,iBAAiB,MAAA,CAAO,iBAAA,GAC1B,MAAM,iBAAA,CAAkB,MAAA,CAAO,kBAAkB,CAAA,GACjD,IAAA;AACJ,EAAA,IAAI,MAAA,CAAO,iBAAA,IAAqB,CAAC,cAAA,EAAgB;AAC/C,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC1E;AAEA,EAAA,MAAM,iBAAA,GAAoB,OAAO,cAAA,IAAkBA,uCAAA;AACnD,EAAA,MAAM,MAAM,YAAA,EAAa;AAEzB,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,QAAQ,MAAA,CAAO,EAAA;AAAA,IACf,SAAS,MAAA,CAAO,EAAA;AAAA,IAChB,IAAA,EAAM;AAAA,MACJ,GAAG,MAAA;AAAA,MACH,GAAI,OAAO,gBAAA,GAAmB,EAAE,CAAC,iBAAiB,GAAG,aAAA,EAAc,GAAI;AAAC,KAC1E;AAAA,IACA,QAAA,EAAU;AAAA,MACR,SAAS,OAAO,MAAA,KAAW,WAAA,GAAc,MAAA,CAAO,SAAS,IAAA,GAAO,IAAA;AAAA,MAChE,UAAU,OAAO,QAAA,KAAa,WAAA,GAAc,QAAA,CAAS,YAAY,IAAA,GAAO,IAAA;AAAA,MACxE,SAAA,EAAW,OAAO,SAAA,KAAc,WAAA,GAAc,UAAU,SAAA,GAAY,IAAA;AAAA,MACpE,WACE,OAAO,cAAA,KAAmB,cAAc,cAAA,CAAe,OAAA,CAAQ,SAAS,CAAA,GAAI,IAAA;AAAA;AAAA;AAAA;AAAA,MAI9E,WACE,OAAO,YAAA,KAAiB,cAAc,YAAA,CAAa,OAAA,CAAQ,SAAS,CAAA,GAAI,IAAA;AAAA,MAC1E,gBAAgB,cAAA,IAAkB,MAAA;AAAA,MAClC,WAAW,GAAA,CAAI,UAAA;AAAA,MACf,WAAW,GAAA,CAAI,UAAA;AAAA,MACf,aAAa,GAAA,CAAI,YAAA;AAAA,MACjB,SAAS,GAAA,CAAI,QAAA;AAAA,MACb,YAAY,GAAA,CAAI,WAAA;AAAA;AAAA;AAAA,MAGhB,IAAA,EACE,OAAO,MAAA,KAAW,WAAA,GACb,OAA0C,iBAAA,IAC3C,MAAA,CAAO,SAAS,IAAA,GAChB,MAAA;AAAA,MACN,aAAA,EAAe;AAAA;AACjB,GACF;AAEA,EAAA,MAAM,WAAW,MAAMC,2BAAA;AAAA,IACrB,GAAG,MAAM,CAAA,wBAAA,CAAA;AAAA,IACT;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,aAAA,EAAe,UAAU,MAAM,CAAA;AAAA,OACjC;AAAA,MACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAO;AAAA,KAC9B;AAAA,IACA,EAAE,OAAA,EAAS,CAAA,EAAG,SAAA,EAAW,GAAA;AAAM,GACjC;AAEA,EAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAEnD,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,GAAA,GAAA,CACJ,IAAA,EAAM,OAAA,IACN,IAAA,EAAM,KAAA,KACL,QAAA,CAAS,UAAA,IAAc,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA,CAAA,EAE9C,QAAA,GACA,IAAA,EAAK;AACR,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,MAAM,CAAA,uBAAA,EAA0B,GAAG,CAAA,CAAA,GAAK,CAAA,uBAAA,EAA0B,SAAS,MAAM,CAAA,CAAA;AAAA,KACnF;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT","file":"chunk-T6YDAJ5F.js","sourcesContent":["/** Shown when the API omits or returns an empty `success_message`. */\nexport const DEFAULT_FORM_SUCCESS_MESSAGE =\n  'Thank you for your submission! We will be in touch soon.'\n","/**\n * Shared form-config normalizer — the ONE place a raw\n * /api/public/forms/config payload becomes a ManagedFormConfig.\n *\n * Deliberately has no `'use client'` directive and no hooks, so it is usable\n * from a Server Component (StaticForm) as well as from useForm's client\n * fetch. Both the server shell and the hydrated enhancement must agree on\n * field order, step count and success copy or the swap visibly jumps, so\n * there must never be a second copy of this.\n */\n\nimport type { ManagedFormConfig } from './types'\nimport { DEFAULT_FORM_SUCCESS_MESSAGE } from './defaultSuccessMessage'\n\n/**\n * Normalize a raw /api/public/forms/config payload into ManagedFormConfig.\n * Single source of truth — used for both the client fetch and server-provided\n * `initialForm`, so the two paths can never drift.\n */\nexport function normalizeFormConfig(data: any): ManagedFormConfig {\n  if (data.steps) {\n    data.steps.sort((a: any, b: any) => (a.step_number || 0) - (b.step_number || 0))\n  }\n  if (data.fields) {\n    data.fields.sort((a: any, b: any) => (a.sort_order || 0) - (b.sort_order || 0))\n  }\n\n  const total_steps = data.steps?.length || 1\n  const is_multi_step = total_steps > 1\n\n  const apiSuccess =\n    typeof data.success_message === 'string' ? data.success_message.trim() : ''\n  const success_message =\n    apiSuccess ||\n    (typeof (data as { successMessage?: string }).successMessage === 'string'\n      ? String((data as { successMessage?: string }).successMessage).trim()\n      : '') ||\n    DEFAULT_FORM_SUCCESS_MESSAGE\n\n  return {\n    ...data,\n    success_message,\n    total_steps,\n    is_multi_step,\n  }\n}\n","/**\n * reCAPTCHA Enterprise - Client-side token generation for site-kit forms\n *\n * Site key is read from:\n * - window.__SITE_KIT_RECAPTCHA_SITE_KEY__ (set by SiteKitLayout)\n * - process.env.NEXT_PUBLIC_RECAPTCHA_SITE_KEY (when bundled in Next.js app)\n */\n\nfunction getSiteKey(explicitSiteKey?: string): string | undefined {\n  if (typeof window === 'undefined') return undefined\n  if (explicitSiteKey) return explicitSiteKey\n  const win = window as any\n  return win.__SITE_KIT_RECAPTCHA_SITE_KEY__ ?? process.env.NEXT_PUBLIC_RECAPTCHA_SITE_KEY\n}\n\n/** Max time to wait for reCAPTCHA Enterprise to become usable before giving up. */\nconst RECAPTCHA_LOAD_TIMEOUT_MS = 10000\n\nfunction loadScript(siteKey: string): Promise<any> {\n  return new Promise((resolve) => {\n    if (typeof window === 'undefined') {\n      resolve(null)\n      return\n    }\n    const win = window as any\n    if (win.grecaptcha?.enterprise) {\n      resolve(win.grecaptcha)\n      return\n    }\n\n    // Never hang the form: if the script is blocked (ad-blocker), stalls, or\n    // never initializes `grecaptcha.enterprise`, resolve null after a timeout.\n    // The caller treats a null result as \"no token\" rather than waiting forever.\n    let settled = false\n    const finish = (value: any) => {\n      if (settled) return\n      settled = true\n      resolve(value)\n    }\n    const giveUp = setTimeout(() => finish(null), RECAPTCHA_LOAD_TIMEOUT_MS)\n\n    const waitForReady = () => {\n      if (settled) return\n      if (win.grecaptcha?.enterprise) {\n        clearTimeout(giveUp)\n        finish(win.grecaptcha)\n        return\n      }\n      setTimeout(waitForReady, 50)\n    }\n\n    const existing = document.querySelector('script[src*=\"recaptcha/enterprise\"]')\n    if (existing) {\n      waitForReady()\n      return\n    }\n\n    const script = document.createElement('script')\n    script.src = `https://www.google.com/recaptcha/enterprise.js?render=${siteKey}`\n    script.async = true\n    script.onload = () => waitForReady()\n    script.onerror = () => {\n      clearTimeout(giveUp)\n      finish(null)\n    }\n    document.head.appendChild(script)\n  })\n}\n\n/**\n * Get a reCAPTCHA Enterprise token for form submission.\n * Returns null if not configured or in SSR.\n */\nexport async function getRecaptchaToken(explicitSiteKey?: string): Promise<string | null> {\n  const siteKey = getSiteKey(explicitSiteKey)\n  if (!siteKey || typeof window === 'undefined') return null\n  try {\n    const grecaptcha = await loadScript(siteKey)\n    if (!grecaptcha?.enterprise?.execute) return null\n    // loadScript only waits for grecaptcha.enterprise to EXIST — execute()\n    // before enterprise.ready() rejects while the widget initializes (cold\n    // page load = every first-visit submitter). A swallowed rejection here\n    // means no token, and a requireRecaptcha project hard-rejects the lead.\n    await new Promise<void>((resolve) => grecaptcha.enterprise.ready(resolve))\n    const token = await grecaptcha.enterprise.execute(siteKey, { action: 'submit' })\n    return token || null\n  } catch (err) {\n    // One retry after a beat — first-execute flakes persist on slow devices\n    // even post-ready, and a dropped token is a dropped lead.\n    try {\n      await new Promise((resolve) => setTimeout(resolve, 800))\n      const win = window as any\n      const token = await win.grecaptcha.enterprise.execute(siteKey, { action: 'submit' })\n      return token || null\n    } catch (retryErr) {\n      console.warn('[site-kit reCAPTCHA]', retryErr)\n      return null\n    }\n  }\n}\n","/**\n * @sonordev/site-kit/forms - Shared submission logic\n *\n * Single source of truth for sending a managed form to the Sonor API. Both\n * <ManagedForm> (via FormClient) and the headless useForm() hook submit through\n * here, so the request shape, retry behaviour, reCAPTCHA handling, and error\n * parsing can never drift between the two paths.\n */\n\nimport { sonorFetch } from '../shared/sonorFetch'\nimport { getRecaptchaToken } from './recaptcha'\nimport { DEFAULT_HONEYPOT_FIELD } from './contract'\nimport type { ManagedFormConfig } from './types'\n\n// The honeypot trap-field name lives once in the shared forms contract\n// (single source of truth for site-kit's client + sonor-api's intake).\n// Re-exported so existing importers of this path keep resolving it.\nexport { DEFAULT_HONEYPOT_FIELD }\n\nexport function getApiConfig(): { apiUrl: string; apiKey: string | undefined } {\n  // Server branch must honor the same env override SiteKitLayout feeds into\n  // __SITE_KIT_API_URL__, or SSR-rendered absolute URLs (the native form\n  // action) would point at prod from a staging site.\n  const apiUrl =\n    typeof window !== 'undefined'\n      ? (window as any).__SITE_KIT_API_URL__ || 'https://api.sonor.io'\n      : process.env.SONOR_API_URL || process.env.NEXT_PUBLIC_SONOR_API_URL || 'https://api.sonor.io'\n  const apiKey =\n    typeof window !== 'undefined' ? (window as any).__SITE_KIT_API_KEY__ : undefined\n  return { apiUrl, apiKey }\n}\n\nfunction getUTMParams(): Record<string, string | null> {\n  if (typeof window === 'undefined') return {}\n  const params = new URLSearchParams(window.location.search)\n  const out: Record<string, string | null> = {}\n  for (const key of ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content']) {\n    out[key] = params.get(key)\n  }\n  return out\n}\n\nexport interface SubmitFormArgs {\n  config: ManagedFormConfig\n  /**\n   * Field values to submit. The caller must pass VISIBLE values only —\n   * conditionally-hidden fields should be excluded so stale values are not sent.\n   */\n  values: Record<string, unknown>\n  /** Honeypot input value (empty string for the headless hook, which has no honeypot UI). */\n  honeypotValue: string\n  /** Timestamp (ms) the form was first rendered — a weak anti-bot timing signal. */\n  formLoadedAt: number\n}\n\n/**\n * Submit a managed form. Throws on failure (network, timeout, or a non-2xx\n * response) with a human-readable message; resolves with the parsed API\n * response on success.\n */\nexport async function submitForm({\n  config,\n  values,\n  honeypotValue,\n  formLoadedAt,\n}: SubmitFormArgs): Promise<unknown> {\n  const { apiUrl, apiKey } = getApiConfig()\n  if (!apiKey) {\n    throw new Error('API key is required. Set SONOR_API_KEY in your environment.')\n  }\n\n  // reCAPTCHA token is fetched right before the POST so it cannot expire.\n  const recaptchaToken = config.recaptcha_enabled\n    ? await getRecaptchaToken(config.recaptcha_site_key)\n    : null\n  if (config.recaptcha_enabled && !recaptchaToken) {\n    throw new Error('Verification could not be completed. Please try again.')\n  }\n\n  const honeypotFieldName = config.honeypot_field || DEFAULT_HONEYPOT_FIELD\n  const utm = getUTMParams()\n\n  const payload = {\n    formId: config.id,\n    form_id: config.id,\n    data: {\n      ...values,\n      ...(config.honeypot_enabled ? { [honeypotFieldName]: honeypotValue } : {}),\n    },\n    metadata: {\n      pageUrl: typeof window !== 'undefined' ? window.location.href : null,\n      referrer: typeof document !== 'undefined' ? document.referrer || null : null,\n      userAgent: typeof navigator !== 'undefined' ? navigator.userAgent : null,\n      sessionId:\n        typeof sessionStorage !== 'undefined' ? sessionStorage.getItem('_sk_sid') : null,\n      // Anonymous visitor id (_sk_vid) — the same id Analytics/Signal stamp on\n      // page views, so the Sonor side can bind this lead to its browsing session\n      // (page -> lead attribution). Sent on every submission; null pre-hydration.\n      visitorId:\n        typeof localStorage !== 'undefined' ? localStorage.getItem('_sk_vid') : null,\n      recaptchaToken: recaptchaToken || undefined,\n      utmSource: utm.utm_source,\n      utmMedium: utm.utm_medium,\n      utmCampaign: utm.utm_campaign,\n      utmTerm: utm.utm_term,\n      utmContent: utm.utm_content,\n      // Sub-site host — preserved on form_submissions for lead attribution\n      // across multi-site projects. Resolved by SiteKitClientProviders.\n      site:\n        typeof window !== 'undefined'\n          ? (window as { __SITE_KIT_SITE__?: string }).__SITE_KIT_SITE__ ||\n            window.location.host\n          : undefined,\n      _formLoadedAt: formLoadedAt,\n    },\n  }\n\n  const response = await sonorFetch(\n    `${apiUrl}/api/public/forms/submit`,\n    {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${apiKey}`,\n      },\n      body: JSON.stringify(payload),\n    },\n    { retries: 2, timeoutMs: 20000 },\n  )\n\n  const data = await response.json().catch(() => null)\n\n  if (!response.ok) {\n    const msg = (\n      data?.message ??\n      data?.error ??\n      (response.statusText || `HTTP ${response.status}`)\n    )\n      .toString()\n      .trim()\n    throw new Error(\n      msg ? `Failed to submit form: ${msg}` : `Failed to submit form (${response.status})`,\n    )\n  }\n\n  return data\n}\n"]}

package/dist/{chunk-ZJNIM4GQ.js → chunk-TBIWQQVF.js}

@@ -1,7 +1,7 @@
 'use strict';
 
-var chunkNK6K4VHD_js = require('./chunk-NK6K4VHD.js');
-var chunk4JVFWTER_js = require('./chunk-4JVFWTER.js');
+var chunkFIVPS4Z6_js = require('./chunk-FIVPS4Z6.js');
+var chunkU3P4WF2A_js = require('./chunk-U3P4WF2A.js');
 
 // src/shared/fetchWithRetry.ts
 function backoffDelay(attempt, response) {
@@ -50,7 +50,7 @@ var pausedKeys = (() => {
 var warnedThisPage = false;
 function isAuthPaused(credential) {
   if (typeof window === "undefined") return false;
-  const id = chunkNK6K4VHD_js.credentialBreakerId(credential);
+  const id = chunkFIVPS4Z6_js.credentialBreakerId(credential);
   const until = pausedKeys.get(id);
   if (!until) return false;
   if (Date.now() >= until) {
@@ -60,7 +60,7 @@ function isAuthPaused(credential) {
   return true;
 }
 function tripBreaker(credential) {
-  pausedKeys.set(chunkNK6K4VHD_js.credentialBreakerId(credential), Date.now() + AUTH_BREAK_MS);
+  pausedKeys.set(chunkFIVPS4Z6_js.credentialBreakerId(credential), Date.now() + AUTH_BREAK_MS);
   if (!warnedThisPage) {
     warnedThisPage = true;
     console.info(
@@ -70,13 +70,13 @@ function tripBreaker(credential) {
 }
 async function sonorFetch(url, init = {}, options = {}) {
   let credential = options.apiKey;
-  if (credential !== void 0 || chunkNK6K4VHD_js.isTokenMode()) {
-    credential = await chunkNK6K4VHD_js.getFreshCredential(options.apiKey);
+  if (credential !== void 0 || chunkFIVPS4Z6_js.isTokenMode()) {
+    credential = await chunkFIVPS4Z6_js.getFreshCredential(options.apiKey);
   }
   const headers = new Headers(init.headers || {});
-  headers.set("x-sitekit-version", chunk4JVFWTER_js.SITE_KIT_VERSION);
+  headers.set("x-sitekit-version", chunkU3P4WF2A_js.SITE_KIT_VERSION);
   if (credential) {
-    if (chunkNK6K4VHD_js.isTokenMode()) {
+    if (chunkFIVPS4Z6_js.isTokenMode()) {
       headers.set("x-api-key", credential);
       headers.delete("authorization");
     } else if (!headers.has("x-api-key")) {
@@ -87,11 +87,11 @@ async function sonorFetch(url, init = {}, options = {}) {
     return new Response(null, { status: 401, statusText: "sonor-auth-paused" });
   }
   let response = await fetchWithRetry(url, { ...init, headers }, options);
-  if ((response.status === 401 || response.status === 403) && typeof window !== "undefined" && chunkNK6K4VHD_js.isSiteToken(credential)) {
-    const refreshed = await chunkNK6K4VHD_js.refreshSiteToken();
+  if ((response.status === 401 || response.status === 403) && typeof window !== "undefined" && chunkFIVPS4Z6_js.isSiteToken(credential)) {
+    const refreshed = await chunkFIVPS4Z6_js.refreshSiteToken();
     if (refreshed && refreshed !== credential) {
       const retryHeaders = new Headers(init.headers || {});
-      retryHeaders.set("x-sitekit-version", chunk4JVFWTER_js.SITE_KIT_VERSION);
+      retryHeaders.set("x-sitekit-version", chunkU3P4WF2A_js.SITE_KIT_VERSION);
       retryHeaders.set("x-api-key", refreshed);
       retryHeaders.delete("authorization");
       credential = refreshed;
@@ -104,7 +104,7 @@ async function sonorFetch(url, init = {}, options = {}) {
   return response;
 }
 function sonorBeacon(url, payload, apiKey) {
-  const credential = chunkNK6K4VHD_js.currentCredential(apiKey);
+  const credential = chunkFIVPS4Z6_js.currentCredential(apiKey);
   const body = typeof payload === "string" ? payload : JSON.stringify(payload);
   try {
     void fetch(url, {
@@ -112,7 +112,7 @@ function sonorBeacon(url, payload, apiKey) {
       keepalive: true,
       headers: {
         "Content-Type": "application/json",
-        "x-sitekit-version": chunk4JVFWTER_js.SITE_KIT_VERSION,
+        "x-sitekit-version": chunkU3P4WF2A_js.SITE_KIT_VERSION,
         ...credential ? { "x-api-key": credential } : {}
       },
       body
@@ -130,5 +130,5 @@ function sonorBeacon(url, payload, apiKey) {
 
 exports.sonorBeacon = sonorBeacon;
 exports.sonorFetch = sonorFetch;
-//# sourceMappingURL=chunk-ZJNIM4GQ.js.map
-//# sourceMappingURL=chunk-ZJNIM4GQ.js.map
+//# sourceMappingURL=chunk-TBIWQQVF.js.map
+//# sourceMappingURL=chunk-TBIWQQVF.js.map

package/dist/{chunk-ZJNIM4GQ.js.map → chunk-TBIWQQVF.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/fetchWithRetry.ts","../src/shared/sonorFetch.ts"],"names":["credentialBreakerId","isTokenMode","getFreshCredential","SITE_KIT_VERSION","isSiteToken","refreshSiteToken","currentCredential"],"mappings":";;;;;;AAsBA,SAAS,YAAA,CAAa,SAAiB,QAAA,EAA6B;AAElE,EAAA,IAAI,QAAA,EAAU,WAAW,GAAA,EAAK;AAC5B,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,MAAA,GAAS,QAAA,CAAS,MAAA,EAAQ,EAAE,CAAA,GAAI,GAAA;AAChD,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,IAAK,OAAA,GAAU,CAAA,EAAG,OAAO,IAAA,CAAK,GAAA,CAAI,OAAA,GAAU,GAAA,EAAM,GAAK,CAAA;AAAA,EAClF;AAEA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,GAAA,EAAM,GAAA,GAAM,KAAK,OAAO,CAAA;AAC1C;AASA,eAAsB,cAAA,CACpB,GAAA,EACA,IAAA,EACA,OAAA,GAA6B,EAAC,EACX;AACnB,EAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,IAAA;AACvC,EAAA,IAAI,SAAA;AAEJ,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,OAAA,EAAS,OAAA,EAAA,EAAW;AACnD,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,MAAA,YAAA,CAAa,KAAK,CAAA;AAElB,MAAA,IAAA,CAAK,SAAS,MAAA,KAAW,GAAA,IAAO,SAAS,MAAA,IAAU,GAAA,KAAQ,UAAU,OAAA,EAAS;AAC5E,QAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY,UAAA,CAAW,SAAS,YAAA,CAAa,OAAA,EAAS,QAAQ,CAAC,CAAC,CAAA;AACnF,QAAA;AAAA,MACF;AACA,MAAA,OAAO,QAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,SAAA,GAAY,KAAA;AAEZ,MAAA,IAAI,UAAU,OAAA,EAAS;AACrB,QAAA,MAAM,IAAI,QAAQ,CAAC,OAAA,KAAY,WAAW,OAAA,EAAS,YAAA,CAAa,OAAO,CAAC,CAAC,CAAA;AACzE,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,YAAqB,KAAA,GACvB,SAAA,GACA,IAAI,MAAM,mEAAmE,CAAA;AACnF;;;AC7BA,IAAM,gBAAgB,CAAA,GAAI,GAAA;AAM1B,IAAM,iBAAA,GAAoB,wBAAA;AAC1B,IAAM,cAAmC,MAAM;AAC7C,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,2BAAW,GAAA,EAAI;AAClD,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,CAAA,CAAA,iBAAA,CAAA,KAAA,CAAA,CAAA,iBAAA,CAAA,uBAA6B,GAAA,EAAI,CAAA;AAC3C,CAAA,GAAG;AACH,IAAI,cAAA,GAAiB,KAAA;AAGd,SAAS,aAAa,UAAA,EAA8B;AACzD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,MAAM,EAAA,GAAKA,qCAAoB,UAAU,CAAA;AACzC,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,EAAE,CAAA;AAC/B,EAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,EAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,KAAA,EAAO;AACvB,IAAA,UAAA,CAAW,OAAO,EAAE,CAAA;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,YAAY,UAAA,EAA2B;AAC9C,EAAA,UAAA,CAAW,IAAIA,oCAAA,CAAoB,UAAU,GAAG,IAAA,CAAK,GAAA,KAAQ,aAAa,CAAA;AAC1E,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,cAAA,GAAiB,IAAA;AAGjB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AACF;AAEA,eAAsB,WACpB,GAAA,EACA,IAAA,GAAoB,EAAC,EACrB,OAAA,GAA6B,EAAC,EACX;AAGnB,EAAA,IAAI,aAAa,OAAA,CAAQ,MAAA;AACzB,EAAA,IAAI,UAAA,KAAe,MAAA,IAAaC,4BAAA,EAAY,EAAG;AAC7C,IAAA,UAAA,GAAa,MAAMC,mCAAA,CAAmB,OAAA,CAAQ,MAAM,CAAA;AAAA,EACtD;AAEA,EAAA,MAAM,UAAU,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAC9C,EAAA,OAAA,CAAQ,GAAA,CAAI,qBAAqBC,iCAAgB,CAAA;AACjD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,IAAIF,8BAAY,EAAG;AASjB,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AACnC,MAAA,OAAA,CAAQ,OAAO,eAAe,CAAA;AAAA,IAChC,CAAA,MAAA,IAAW,CAAC,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG;AAEpC,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AAAA,IACrC;AAAA,EACF;AAEA,EAAA,IAAI,YAAA,CAAa,UAAU,CAAA,EAAG;AAG5B,IAAA,OAAO,IAAI,SAAS,IAAA,EAAM,EAAE,QAAQ,GAAA,EAAK,UAAA,EAAY,qBAAqB,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,QAAA,GAAW,MAAM,cAAA,CAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAQ,EAAG,OAAO,CAAA;AAKtE,EAAA,IAAA,CACG,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,QAAA,CAAS,MAAA,KAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClBG,4BAAA,CAAY,UAAU,CAAA,EACtB;AACA,IAAA,MAAM,SAAA,GAAY,MAAMC,iCAAA,EAAiB;AACzC,IAAA,IAAI,SAAA,IAAa,cAAc,UAAA,EAAY;AACzC,MAAA,MAAM,eAAe,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AACnD,MAAA,YAAA,CAAa,GAAA,CAAI,qBAAqBF,iCAAgB,CAAA;AACtD,MAAA,YAAA,CAAa,GAAA,CAAI,aAAa,SAAS,CAAA;AAGvC,MAAA,YAAA,CAAa,OAAO,eAAe,CAAA;AACnC,MAAA,UAAA,GAAa,SAAA;AACb,MAAA,QAAA,GAAW,MAAM,eAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,YAAA,EAAa,EAAG,OAAO,CAAA;AAAA,IAClF;AAAA,EACF;AAEA,EAAA,IAAA,CACG,QAAA,CAAS,WAAW,GAAA,IAAO,QAAA,CAAS,WAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClB,UAAA,EACA;AACA,IAAA,WAAA,CAAY,UAAU,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,QAAA;AACT;AAYO,SAAS,WAAA,CAAY,GAAA,EAAa,OAAA,EAAkB,MAAA,EAAuB;AAChF,EAAA,MAAM,UAAA,GAAaG,mCAAkB,MAAM,CAAA;AAC3C,EAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,IAAA,CAAK,UAAU,OAAO,CAAA;AAC3E,EAAA,IAAI;AACF,IAAA,KAAK,MAAM,GAAA,EAAK;AAAA,MACd,MAAA,EAAQ,MAAA;AAAA,MACR,SAAA,EAAW,IAAA;AAAA,MACX,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqBH,iCAAA;AAAA,QACrB,GAAI,UAAA,GAAa,EAAE,WAAA,EAAa,UAAA,KAAe;AAAC,OAClD;AAAA,MACA;AAAA,KACD,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAEf,CAAC,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AACN,IAAA,IAAI;AACF,MAAA,IAAI,OAAO,SAAA,KAAc,WAAA,IAAe,SAAA,CAAU,UAAA,EAAY;AAC5D,QAAA,SAAA,CAAU,UAAA,CAAW,GAAA,EAAK,IAAI,IAAA,CAAK,CAAC,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,kBAAA,EAAoB,CAAC,CAAA;AAAA,MAC1E;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACF","file":"chunk-ZJNIM4GQ.js","sourcesContent":["/**\n * @sonordev/site-kit shared - Resilient fetch\n *\n * Single source of truth for client-side resilient fetch (forms, SitemapSync).\n * Adds a per-attempt timeout and retries transient failures (network errors,\n * request timeouts, HTTP 429, and 5xx) with exponential backoff.\n *\n * A form submission must survive a brief API blip — a deploy, a cold start, a\n * dropped packet. A single un-retried fetch turning into \"Something went wrong\"\n * is how leads get lost. The explicit abort also matters on its own: a request\n * left to hang until the browser's own network timeout logs a console error\n * (net::ERR_TIMED_OUT) that fails Lighthouse best-practices; an aborted fetch\n * logs nothing.\n */\n\nexport interface FetchRetryOptions {\n  /** Number of retries AFTER the first attempt (default 2 → up to 3 tries total). */\n  retries?: number\n  /** Per-attempt timeout in milliseconds (default 15000). */\n  timeoutMs?: number\n}\n\nfunction backoffDelay(attempt: number, response?: Response): number {\n  // Honor a Retry-After header on 429 responses when present.\n  if (response?.status === 429) {\n    const header = response.headers.get('retry-after')\n    const seconds = header ? parseInt(header, 10) : NaN\n    if (!Number.isNaN(seconds) && seconds > 0) return Math.min(seconds * 1000, 10000)\n  }\n  // Exponential backoff: 500ms, 1s, 2s, ... capped at 8s.\n  return Math.min(8000, 500 * 2 ** attempt)\n}\n\n/**\n * fetch() with a timeout and automatic retries for transient failures.\n *\n * Non-transient responses (2xx, 3xx, and 4xx other than 429) are returned to\n * the caller as-is — only 429/5xx and thrown network/timeout errors are retried.\n * If every attempt fails with a thrown error, the last error is re-thrown.\n */\nexport async function fetchWithRetry(\n  url: string,\n  init: RequestInit,\n  options: FetchRetryOptions = {},\n): Promise<Response> {\n  const retries = options.retries ?? 2\n  const timeoutMs = options.timeoutMs ?? 15000\n  let lastError: unknown\n\n  for (let attempt = 0; attempt <= retries; attempt++) {\n    const controller = new AbortController()\n    const timer = setTimeout(() => controller.abort(), timeoutMs)\n    try {\n      const response = await fetch(url, { ...init, signal: controller.signal })\n      clearTimeout(timer)\n\n      if ((response.status === 429 || response.status >= 500) && attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt, response)))\n        continue\n      }\n      return response\n    } catch (error) {\n      clearTimeout(timer)\n      lastError = error\n      // Network failure or timeout (AbortController) — retry while attempts remain.\n      if (attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt)))\n        continue\n      }\n    }\n  }\n\n  throw lastError instanceof Error\n    ? lastError\n    : new Error('Network request failed after multiple attempts. Please try again.')\n}\n","/**\n * @sonordev/site-kit shared - Canonical client transport\n *\n * Single source of truth for how site-kit talks to Sonor from the browser.\n * Every client-side module (analytics, forms, commerce, engage, maps, images,\n * SitemapSync) routes through here instead of bare fetch(), which gives the\n * whole kit, in one place:\n *\n *  - per-attempt timeout + retry with backoff (via fetchWithRetry) — a hung\n *    request left to the browser's own network timeout logs a console error\n *    (net::ERR_TIMED_OUT) that fails Lighthouse best-practices\n *  - the x-sitekit-version header on every request, so the platform can see\n *    which kit version each site actually runs from live traffic\n *  - CREDENTIAL LIFECYCLE: sites on 3.2+ ship a short-lived minted token instead\n *    of the raw key. This transport resolves the freshest token (refreshing a\n *    stale seed transparently), and on a 401/403 for a token it refreshes once\n *    and retries before giving up. A raw key (2.x kit, or the mint-failed\n *    fallback) is a pure passthrough — legacy behavior is unchanged.\n *  - an auth circuit breaker: after a 401/403 the credential is paused for a few\n *    minutes and ONE friendly console.info is emitted — a site on a stale or\n *    canceled key must not spam the API or the visitor's console. Keyed by the\n *    project (from the token) so it survives token rotation.\n *  - sonorBeacon for unload-time telemetry that keeps the credential in headers;\n *    navigator.sendBeacon can't set headers and forced the key into the URL,\n *    where server and CDN access logs capture it\n *\n * Non-idempotent endpoints (checkout, payment intents, uploads) must pass\n * { retries: 0 } — they still get the timeout, but never an automatic retry.\n */\nimport { fetchWithRetry, type FetchRetryOptions } from './fetchWithRetry'\nimport { SITE_KIT_VERSION } from './version'\nimport {\n  credentialBreakerId,\n  currentCredential,\n  getFreshCredential,\n  isSiteToken,\n  isTokenMode,\n  refreshSiteToken,\n} from './siteToken'\n\nexport interface SonorFetchOptions extends FetchRetryOptions {\n  /** Project credential — the minted token (3.2+) or raw key. Sent as x-api-key. */\n  apiKey?: string\n}\n\n/** How long a credential stays paused after an auth failure. */\nconst AUTH_BREAK_MS = 5 * 60_000\n\n// breaker id → epoch ms until which requests are paused. Shared on window for\n// the same reason as the token state (see siteToken.ts): duplicated module\n// copies must trip and observe ONE breaker, not one each. Never applies on the\n// server, so a per-module Map there is fine.\nconst BREAKER_STATE_KEY = '__SONOR_AUTH_BREAKER__'\nconst pausedKeys: Map<string, number> = (() => {\n  if (typeof window === 'undefined') return new Map()\n  const w = window as unknown as Record<string, Map<string, number> | undefined>\n  return (w[BREAKER_STATE_KEY] ??= new Map())\n})()\nlet warnedThisPage = false\n\n/** True when a previous 401/403 has paused this credential (browser only). */\nexport function isAuthPaused(credential?: string): boolean {\n  if (typeof window === 'undefined') return false\n  const id = credentialBreakerId(credential)\n  const until = pausedKeys.get(id)\n  if (!until) return false\n  if (Date.now() >= until) {\n    pausedKeys.delete(id)\n    return false\n  }\n  return true\n}\n\nfunction tripBreaker(credential?: string): void {\n  pausedKeys.set(credentialBreakerId(credential), Date.now() + AUTH_BREAK_MS)\n  if (!warnedThisPage) {\n    warnedThisPage = true\n    // info, not error: a visitor's console must stay clean (Lighthouse\n    // errors-in-console), and copy never names env vars or key formats.\n    console.info(\n      \"[Sonor] This site couldn't authenticate with Sonor, so data features are paused for a few minutes. If this keeps happening, the site is likely running an outdated API key.\",\n    )\n  }\n}\n\nexport async function sonorFetch(\n  url: string,\n  init: RequestInit = {},\n  options: SonorFetchOptions = {},\n): Promise<Response> {\n  // Resolve the credential to send. In token mode this may transparently refresh\n  // a stale seed before the first request; in raw-key mode it's a passthrough.\n  let credential = options.apiKey\n  if (credential !== undefined || isTokenMode()) {\n    credential = await getFreshCredential(options.apiKey)\n  }\n\n  const headers = new Headers(init.headers || {})\n  headers.set('x-sitekit-version', SITE_KIT_VERSION)\n  if (credential) {\n    if (isTokenMode()) {\n      // Token mode: `credential` is the freshest token (refreshed just above if\n      // the seed was stale). It MUST override any x-api-key a caller hand-set — a\n      // stale build-time seed passed as a header would otherwise pin the request\n      // and defeat refresh entirely. Also drop a caller-set Authorization:\n      // extractApiKey() server-side prefers `Authorization: Bearer` over\n      // x-api-key, so a stale Bearer seed would win even once we set a fresh\n      // x-api-key. This is the single place the client credential is chosen — do\n      // not re-attach it as a header at call sites.\n      headers.set('x-api-key', credential)\n      headers.delete('authorization')\n    } else if (!headers.has('x-api-key')) {\n      // Raw-key mode: legacy passthrough — respect a caller-supplied header.\n      headers.set('x-api-key', credential)\n    }\n  }\n\n  if (isAuthPaused(credential)) {\n    // Synthetic response keeps every caller's !response.ok path working\n    // without a network round trip while the breaker is open.\n    return new Response(null, { status: 401, statusText: 'sonor-auth-paused' })\n  }\n\n  let response = await fetchWithRetry(url, { ...init, headers }, options)\n\n  // A token can rotate or expire mid-session. On the first auth failure, try ONE\n  // refresh + retry before tripping the breaker — only for token credentials\n  // (raw keys have nothing to refresh).\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    isSiteToken(credential)\n  ) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed && refreshed !== credential) {\n      const retryHeaders = new Headers(init.headers || {})\n      retryHeaders.set('x-sitekit-version', SITE_KIT_VERSION)\n      retryHeaders.set('x-api-key', refreshed)\n      // Same reason as the initial request: a caller-set stale Bearer would win\n      // over our fresh x-api-key server-side, so strip it on the retry too.\n      retryHeaders.delete('authorization')\n      credential = refreshed\n      response = await fetchWithRetry(url, { ...init, headers: retryHeaders }, options)\n    }\n  }\n\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    credential\n  ) {\n    tripBreaker(credential)\n  }\n\n  return response\n}\n\n/**\n * Fire-and-forget telemetry that survives page unload.\n *\n * Uses fetch({ keepalive: true }) so auth travels in headers. Falls back to\n * navigator.sendBeacon (no auth headers possible — the server may reject it,\n * but we never put the key in the URL) only when keepalive fetch is missing.\n *\n * Cannot await a refresh at unload time, so it sends the freshest token already\n * held (currentCredential) rather than the possibly-stale seed the caller passed.\n */\nexport function sonorBeacon(url: string, payload: unknown, apiKey?: string): void {\n  const credential = currentCredential(apiKey)\n  const body = typeof payload === 'string' ? payload : JSON.stringify(payload)\n  try {\n    void fetch(url, {\n      method: 'POST',\n      keepalive: true,\n      headers: {\n        'Content-Type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        ...(credential ? { 'x-api-key': credential } : {}),\n      },\n      body,\n    }).catch(() => {\n      /* page is closing — best effort */\n    })\n  } catch {\n    try {\n      if (typeof navigator !== 'undefined' && navigator.sendBeacon) {\n        navigator.sendBeacon(url, new Blob([body], { type: 'application/json' }))\n      }\n    } catch {\n      /* nothing left to try */\n    }\n  }\n}\n"]}
+{"version":3,"sources":["../src/shared/fetchWithRetry.ts","../src/shared/sonorFetch.ts"],"names":["credentialBreakerId","isTokenMode","getFreshCredential","SITE_KIT_VERSION","isSiteToken","refreshSiteToken","currentCredential"],"mappings":";;;;;;AAsBA,SAAS,YAAA,CAAa,SAAiB,QAAA,EAA6B;AAElE,EAAA,IAAI,QAAA,EAAU,WAAW,GAAA,EAAK;AAC5B,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,MAAA,GAAS,QAAA,CAAS,MAAA,EAAQ,EAAE,CAAA,GAAI,GAAA;AAChD,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,IAAK,OAAA,GAAU,CAAA,EAAG,OAAO,IAAA,CAAK,GAAA,CAAI,OAAA,GAAU,GAAA,EAAM,GAAK,CAAA;AAAA,EAClF;AAEA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,GAAA,EAAM,GAAA,GAAM,KAAK,OAAO,CAAA;AAC1C;AASA,eAAsB,cAAA,CACpB,GAAA,EACA,IAAA,EACA,OAAA,GAA6B,EAAC,EACX;AACnB,EAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,IAAA;AACvC,EAAA,IAAI,SAAA;AAEJ,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,OAAA,EAAS,OAAA,EAAA,EAAW;AACnD,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,MAAA,YAAA,CAAa,KAAK,CAAA;AAElB,MAAA,IAAA,CAAK,SAAS,MAAA,KAAW,GAAA,IAAO,SAAS,MAAA,IAAU,GAAA,KAAQ,UAAU,OAAA,EAAS;AAC5E,QAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY,UAAA,CAAW,SAAS,YAAA,CAAa,OAAA,EAAS,QAAQ,CAAC,CAAC,CAAA;AACnF,QAAA;AAAA,MACF;AACA,MAAA,OAAO,QAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,SAAA,GAAY,KAAA;AAEZ,MAAA,IAAI,UAAU,OAAA,EAAS;AACrB,QAAA,MAAM,IAAI,QAAQ,CAAC,OAAA,KAAY,WAAW,OAAA,EAAS,YAAA,CAAa,OAAO,CAAC,CAAC,CAAA;AACzE,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,YAAqB,KAAA,GACvB,SAAA,GACA,IAAI,MAAM,mEAAmE,CAAA;AACnF;;;AC7BA,IAAM,gBAAgB,CAAA,GAAI,GAAA;AAM1B,IAAM,iBAAA,GAAoB,wBAAA;AAC1B,IAAM,cAAmC,MAAM;AAC7C,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,2BAAW,GAAA,EAAI;AAClD,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,CAAA,CAAA,iBAAA,CAAA,KAAA,CAAA,CAAA,iBAAA,CAAA,uBAA6B,GAAA,EAAI,CAAA;AAC3C,CAAA,GAAG;AACH,IAAI,cAAA,GAAiB,KAAA;AAGd,SAAS,aAAa,UAAA,EAA8B;AACzD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,MAAM,EAAA,GAAKA,qCAAoB,UAAU,CAAA;AACzC,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,EAAE,CAAA;AAC/B,EAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,EAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,KAAA,EAAO;AACvB,IAAA,UAAA,CAAW,OAAO,EAAE,CAAA;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,YAAY,UAAA,EAA2B;AAC9C,EAAA,UAAA,CAAW,IAAIA,oCAAA,CAAoB,UAAU,GAAG,IAAA,CAAK,GAAA,KAAQ,aAAa,CAAA;AAC1E,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,cAAA,GAAiB,IAAA;AAGjB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AACF;AAEA,eAAsB,WACpB,GAAA,EACA,IAAA,GAAoB,EAAC,EACrB,OAAA,GAA6B,EAAC,EACX;AAGnB,EAAA,IAAI,aAAa,OAAA,CAAQ,MAAA;AACzB,EAAA,IAAI,UAAA,KAAe,MAAA,IAAaC,4BAAA,EAAY,EAAG;AAC7C,IAAA,UAAA,GAAa,MAAMC,mCAAA,CAAmB,OAAA,CAAQ,MAAM,CAAA;AAAA,EACtD;AAEA,EAAA,MAAM,UAAU,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAC9C,EAAA,OAAA,CAAQ,GAAA,CAAI,qBAAqBC,iCAAgB,CAAA;AACjD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,IAAIF,8BAAY,EAAG;AASjB,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AACnC,MAAA,OAAA,CAAQ,OAAO,eAAe,CAAA;AAAA,IAChC,CAAA,MAAA,IAAW,CAAC,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG;AAEpC,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AAAA,IACrC;AAAA,EACF;AAEA,EAAA,IAAI,YAAA,CAAa,UAAU,CAAA,EAAG;AAG5B,IAAA,OAAO,IAAI,SAAS,IAAA,EAAM,EAAE,QAAQ,GAAA,EAAK,UAAA,EAAY,qBAAqB,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,QAAA,GAAW,MAAM,cAAA,CAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAQ,EAAG,OAAO,CAAA;AAKtE,EAAA,IAAA,CACG,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,QAAA,CAAS,MAAA,KAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClBG,4BAAA,CAAY,UAAU,CAAA,EACtB;AACA,IAAA,MAAM,SAAA,GAAY,MAAMC,iCAAA,EAAiB;AACzC,IAAA,IAAI,SAAA,IAAa,cAAc,UAAA,EAAY;AACzC,MAAA,MAAM,eAAe,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AACnD,MAAA,YAAA,CAAa,GAAA,CAAI,qBAAqBF,iCAAgB,CAAA;AACtD,MAAA,YAAA,CAAa,GAAA,CAAI,aAAa,SAAS,CAAA;AAGvC,MAAA,YAAA,CAAa,OAAO,eAAe,CAAA;AACnC,MAAA,UAAA,GAAa,SAAA;AACb,MAAA,QAAA,GAAW,MAAM,eAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,YAAA,EAAa,EAAG,OAAO,CAAA;AAAA,IAClF;AAAA,EACF;AAEA,EAAA,IAAA,CACG,QAAA,CAAS,WAAW,GAAA,IAAO,QAAA,CAAS,WAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClB,UAAA,EACA;AACA,IAAA,WAAA,CAAY,UAAU,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,QAAA;AACT;AAYO,SAAS,WAAA,CAAY,GAAA,EAAa,OAAA,EAAkB,MAAA,EAAuB;AAChF,EAAA,MAAM,UAAA,GAAaG,mCAAkB,MAAM,CAAA;AAC3C,EAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,IAAA,CAAK,UAAU,OAAO,CAAA;AAC3E,EAAA,IAAI;AACF,IAAA,KAAK,MAAM,GAAA,EAAK;AAAA,MACd,MAAA,EAAQ,MAAA;AAAA,MACR,SAAA,EAAW,IAAA;AAAA,MACX,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqBH,iCAAA;AAAA,QACrB,GAAI,UAAA,GAAa,EAAE,WAAA,EAAa,UAAA,KAAe;AAAC,OAClD;AAAA,MACA;AAAA,KACD,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAEf,CAAC,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AACN,IAAA,IAAI;AACF,MAAA,IAAI,OAAO,SAAA,KAAc,WAAA,IAAe,SAAA,CAAU,UAAA,EAAY;AAC5D,QAAA,SAAA,CAAU,UAAA,CAAW,GAAA,EAAK,IAAI,IAAA,CAAK,CAAC,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,kBAAA,EAAoB,CAAC,CAAA;AAAA,MAC1E;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACF","file":"chunk-TBIWQQVF.js","sourcesContent":["/**\n * @sonordev/site-kit shared - Resilient fetch\n *\n * Single source of truth for client-side resilient fetch (forms, SitemapSync).\n * Adds a per-attempt timeout and retries transient failures (network errors,\n * request timeouts, HTTP 429, and 5xx) with exponential backoff.\n *\n * A form submission must survive a brief API blip — a deploy, a cold start, a\n * dropped packet. A single un-retried fetch turning into \"Something went wrong\"\n * is how leads get lost. The explicit abort also matters on its own: a request\n * left to hang until the browser's own network timeout logs a console error\n * (net::ERR_TIMED_OUT) that fails Lighthouse best-practices; an aborted fetch\n * logs nothing.\n */\n\nexport interface FetchRetryOptions {\n  /** Number of retries AFTER the first attempt (default 2 → up to 3 tries total). */\n  retries?: number\n  /** Per-attempt timeout in milliseconds (default 15000). */\n  timeoutMs?: number\n}\n\nfunction backoffDelay(attempt: number, response?: Response): number {\n  // Honor a Retry-After header on 429 responses when present.\n  if (response?.status === 429) {\n    const header = response.headers.get('retry-after')\n    const seconds = header ? parseInt(header, 10) : NaN\n    if (!Number.isNaN(seconds) && seconds > 0) return Math.min(seconds * 1000, 10000)\n  }\n  // Exponential backoff: 500ms, 1s, 2s, ... capped at 8s.\n  return Math.min(8000, 500 * 2 ** attempt)\n}\n\n/**\n * fetch() with a timeout and automatic retries for transient failures.\n *\n * Non-transient responses (2xx, 3xx, and 4xx other than 429) are returned to\n * the caller as-is — only 429/5xx and thrown network/timeout errors are retried.\n * If every attempt fails with a thrown error, the last error is re-thrown.\n */\nexport async function fetchWithRetry(\n  url: string,\n  init: RequestInit,\n  options: FetchRetryOptions = {},\n): Promise<Response> {\n  const retries = options.retries ?? 2\n  const timeoutMs = options.timeoutMs ?? 15000\n  let lastError: unknown\n\n  for (let attempt = 0; attempt <= retries; attempt++) {\n    const controller = new AbortController()\n    const timer = setTimeout(() => controller.abort(), timeoutMs)\n    try {\n      const response = await fetch(url, { ...init, signal: controller.signal })\n      clearTimeout(timer)\n\n      if ((response.status === 429 || response.status >= 500) && attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt, response)))\n        continue\n      }\n      return response\n    } catch (error) {\n      clearTimeout(timer)\n      lastError = error\n      // Network failure or timeout (AbortController) — retry while attempts remain.\n      if (attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt)))\n        continue\n      }\n    }\n  }\n\n  throw lastError instanceof Error\n    ? lastError\n    : new Error('Network request failed after multiple attempts. Please try again.')\n}\n","/**\n * @sonordev/site-kit shared - Canonical client transport\n *\n * Single source of truth for how site-kit talks to Sonor from the browser.\n * Every client-side module (analytics, forms, commerce, engage, maps, images,\n * SitemapSync) routes through here instead of bare fetch(), which gives the\n * whole kit, in one place:\n *\n *  - per-attempt timeout + retry with backoff (via fetchWithRetry) — a hung\n *    request left to the browser's own network timeout logs a console error\n *    (net::ERR_TIMED_OUT) that fails Lighthouse best-practices\n *  - the x-sitekit-version header on every request, so the platform can see\n *    which kit version each site actually runs from live traffic\n *  - CREDENTIAL LIFECYCLE: sites on 3.2+ ship a short-lived minted token instead\n *    of the raw key. This transport resolves the freshest token (refreshing a\n *    stale seed transparently), and on a 401/403 for a token it refreshes once\n *    and retries before giving up. A raw key (2.x kit, or the mint-failed\n *    fallback) is a pure passthrough — legacy behavior is unchanged.\n *  - an auth circuit breaker: after a 401/403 the credential is paused for a few\n *    minutes and ONE friendly console.info is emitted — a site on a stale or\n *    canceled key must not spam the API or the visitor's console. Keyed by the\n *    project (from the token) so it survives token rotation.\n *  - sonorBeacon for unload-time telemetry that keeps the credential in headers;\n *    navigator.sendBeacon can't set headers and forced the key into the URL,\n *    where server and CDN access logs capture it\n *\n * Non-idempotent endpoints (checkout, payment intents, uploads) must pass\n * { retries: 0 } — they still get the timeout, but never an automatic retry.\n */\nimport { fetchWithRetry, type FetchRetryOptions } from './fetchWithRetry'\nimport { SITE_KIT_VERSION } from './version'\nimport {\n  credentialBreakerId,\n  currentCredential,\n  getFreshCredential,\n  isSiteToken,\n  isTokenMode,\n  refreshSiteToken,\n} from './siteToken'\n\nexport interface SonorFetchOptions extends FetchRetryOptions {\n  /** Project credential — the minted token (3.2+) or raw key. Sent as x-api-key. */\n  apiKey?: string\n}\n\n/** How long a credential stays paused after an auth failure. */\nconst AUTH_BREAK_MS = 5 * 60_000\n\n// breaker id → epoch ms until which requests are paused. Shared on window for\n// the same reason as the token state (see siteToken.ts): duplicated module\n// copies must trip and observe ONE breaker, not one each. Never applies on the\n// server, so a per-module Map there is fine.\nconst BREAKER_STATE_KEY = '__SONOR_AUTH_BREAKER__'\nconst pausedKeys: Map<string, number> = (() => {\n  if (typeof window === 'undefined') return new Map()\n  const w = window as unknown as Record<string, Map<string, number> | undefined>\n  return (w[BREAKER_STATE_KEY] ??= new Map())\n})()\nlet warnedThisPage = false\n\n/** True when a previous 401/403 has paused this credential (browser only). */\nexport function isAuthPaused(credential?: string): boolean {\n  if (typeof window === 'undefined') return false\n  const id = credentialBreakerId(credential)\n  const until = pausedKeys.get(id)\n  if (!until) return false\n  if (Date.now() >= until) {\n    pausedKeys.delete(id)\n    return false\n  }\n  return true\n}\n\nfunction tripBreaker(credential?: string): void {\n  pausedKeys.set(credentialBreakerId(credential), Date.now() + AUTH_BREAK_MS)\n  if (!warnedThisPage) {\n    warnedThisPage = true\n    // info, not error: a visitor's console must stay clean (Lighthouse\n    // errors-in-console), and copy never names env vars or key formats.\n    console.info(\n      \"[Sonor] This site couldn't authenticate with Sonor, so data features are paused for a few minutes. If this keeps happening, the site is likely running an outdated API key.\",\n    )\n  }\n}\n\nexport async function sonorFetch(\n  url: string,\n  init: RequestInit = {},\n  options: SonorFetchOptions = {},\n): Promise<Response> {\n  // Resolve the credential to send. In token mode this may transparently refresh\n  // a stale seed before the first request; in raw-key mode it's a passthrough.\n  let credential = options.apiKey\n  if (credential !== undefined || isTokenMode()) {\n    credential = await getFreshCredential(options.apiKey)\n  }\n\n  const headers = new Headers(init.headers || {})\n  headers.set('x-sitekit-version', SITE_KIT_VERSION)\n  if (credential) {\n    if (isTokenMode()) {\n      // Token mode: `credential` is the freshest token (refreshed just above if\n      // the seed was stale). It MUST override any x-api-key a caller hand-set — a\n      // stale build-time seed passed as a header would otherwise pin the request\n      // and defeat refresh entirely. Also drop a caller-set Authorization:\n      // extractApiKey() server-side prefers `Authorization: Bearer` over\n      // x-api-key, so a stale Bearer seed would win even once we set a fresh\n      // x-api-key. This is the single place the client credential is chosen — do\n      // not re-attach it as a header at call sites.\n      headers.set('x-api-key', credential)\n      headers.delete('authorization')\n    } else if (!headers.has('x-api-key')) {\n      // Raw-key mode: legacy passthrough — respect a caller-supplied header.\n      headers.set('x-api-key', credential)\n    }\n  }\n\n  if (isAuthPaused(credential)) {\n    // Synthetic response keeps every caller's !response.ok path working\n    // without a network round trip while the breaker is open.\n    return new Response(null, { status: 401, statusText: 'sonor-auth-paused' })\n  }\n\n  let response = await fetchWithRetry(url, { ...init, headers }, options)\n\n  // A token can rotate or expire mid-session. On the first auth failure, try ONE\n  // refresh + retry before tripping the breaker — only for token credentials\n  // (raw keys have nothing to refresh).\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    isSiteToken(credential)\n  ) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed && refreshed !== credential) {\n      const retryHeaders = new Headers(init.headers || {})\n      retryHeaders.set('x-sitekit-version', SITE_KIT_VERSION)\n      retryHeaders.set('x-api-key', refreshed)\n      // Same reason as the initial request: a caller-set stale Bearer would win\n      // over our fresh x-api-key server-side, so strip it on the retry too.\n      retryHeaders.delete('authorization')\n      credential = refreshed\n      response = await fetchWithRetry(url, { ...init, headers: retryHeaders }, options)\n    }\n  }\n\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    credential\n  ) {\n    tripBreaker(credential)\n  }\n\n  return response\n}\n\n/**\n * Fire-and-forget telemetry that survives page unload.\n *\n * Uses fetch({ keepalive: true }) so auth travels in headers. Falls back to\n * navigator.sendBeacon (no auth headers possible — the server may reject it,\n * but we never put the key in the URL) only when keepalive fetch is missing.\n *\n * Cannot await a refresh at unload time, so it sends the freshest token already\n * held (currentCredential) rather than the possibly-stale seed the caller passed.\n */\nexport function sonorBeacon(url: string, payload: unknown, apiKey?: string): void {\n  const credential = currentCredential(apiKey)\n  const body = typeof payload === 'string' ? payload : JSON.stringify(payload)\n  try {\n    void fetch(url, {\n      method: 'POST',\n      keepalive: true,\n      headers: {\n        'Content-Type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        ...(credential ? { 'x-api-key': credential } : {}),\n      },\n      body,\n    }).catch(() => {\n      /* page is closing — best effort */\n    })\n  } catch {\n    try {\n      if (typeof navigator !== 'undefined' && navigator.sendBeacon) {\n        navigator.sendBeacon(url, new Blob([body], { type: 'application/json' }))\n      }\n    } catch {\n      /* nothing left to try */\n    }\n  }\n}\n"]}

package/dist/chunk-U3P4WF2A.js

@@ -0,0 +1,8 @@
+'use strict';
+
+// src/shared/version.ts
+var SITE_KIT_VERSION = "4.3.0";
+
+exports.SITE_KIT_VERSION = SITE_KIT_VERSION;
+//# sourceMappingURL=chunk-U3P4WF2A.js.map
+//# sourceMappingURL=chunk-U3P4WF2A.js.map

package/dist/{chunk-4JVFWTER.js.map → chunk-U3P4WF2A.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";;;AASO,IAAM,gBAAA,GAAmB","file":"chunk-4JVFWTER.js","sourcesContent":["/**\n * @sonordev/site-kit shared - Package version constant\n *\n * Single source of truth for the version the kit reports at runtime (the\n * x-sitekit-version request header set by sonorFetch). Kept as a plain const\n * so client bundles don't need JSON imports; scripts/verify-dts.cjs asserts\n * it matches package.json at publish time, and version.test.ts asserts it in\n * dev, so it can't silently drift.\n */\nexport const SITE_KIT_VERSION = '4.2.4'\n"]}
+{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";;;AASO,IAAM,gBAAA,GAAmB","file":"chunk-U3P4WF2A.js","sourcesContent":["/**\n * @sonordev/site-kit shared - Package version constant\n *\n * Single source of truth for the version the kit reports at runtime (the\n * x-sitekit-version request header set by sonorFetch). Kept as a plain const\n * so client bundles don't need JSON imports; scripts/verify-dts.cjs asserts\n * it matches package.json at publish time, and version.test.ts asserts it in\n * dev, so it can't silently drift.\n */\nexport const SITE_KIT_VERSION = '4.3.0'\n"]}

package/dist/{chunk-LUXCT2NU.js → chunk-UDXWBLBH.js}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkBDDTZJKC_js = require('./chunk-BDDTZJKC.js');
+var chunkT6YDAJ5F_js = require('./chunk-T6YDAJ5F.js');
 var jsxRuntime = require('react/jsx-runtime');
 
 function HoneypotField({ name, value, onChange }) {
@@ -46,7 +46,7 @@ function nativeEligible(config) {
 }
 function nativeFormProps(config) {
   if (!nativeEligible(config)) return {};
-  const { apiUrl } = chunkBDDTZJKC_js.getApiConfig();
+  const { apiUrl } = chunkT6YDAJ5F_js.getApiConfig();
   return { action: `${apiUrl}/api/public/forms/submit-native`, method: "post" };
 }
 function NativeFallbackFields({ config, returnTo }) {
@@ -60,5 +60,5 @@ function NativeFallbackFields({ config, returnTo }) {
 exports.HoneypotField = HoneypotField;
 exports.NativeFallbackFields = NativeFallbackFields;
 exports.nativeFormProps = nativeFormProps;
-//# sourceMappingURL=chunk-LUXCT2NU.js.map
-//# sourceMappingURL=chunk-LUXCT2NU.js.map
+//# sourceMappingURL=chunk-UDXWBLBH.js.map
+//# sourceMappingURL=chunk-UDXWBLBH.js.map

package/dist/{chunk-LUXCT2NU.js.map → chunk-UDXWBLBH.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/forms/HoneypotField.tsx","../src/forms/native-fallback.tsx"],"names":["jsx","getApiConfig","jsxs","Fragment"],"mappings":";;;;;AAqCO,SAAS,aAAA,CAAc,EAAE,IAAA,EAAM,KAAA,EAAO,UAAS,EAAuB;AAC3E,EAAA,MAAM,WAAA,GAAc,OAAO,QAAA,KAAa,UAAA;AACxC,EAAA,uBACEA,cAAA;AAAA,IAAC,OAAA;AAAA,IAAA;AAAA,MACC,IAAA,EAAK,MAAA;AAAA,MACL,IAAA;AAAA,MACA,QAAA,EAAU,EAAA;AAAA,MACV,YAAA,EAAa,cAAA;AAAA,MACb,aAAA,EAAY,MAAA;AAAA,MACZ,KAAA,EAAK,IAAA;AAAA,MACL,kBAAA,EAAiB,EAAA;AAAA,MAGjB,gBAAA,EAAe,EAAA;AAAA,MACf,eAAA,EAAc,MAAA;AAAA,MACd,gBAAA,EAAe,OAAA;AAAA,MACf,eAAA,EAAc,EAAA;AAAA,MACd,KAAA,EAAO;AAAA,QACL,QAAA,EAAU,UAAA;AAAA,QACV,IAAA,EAAM,KAAA;AAAA,QACN,KAAA,EAAO,CAAA;AAAA,QACP,MAAA,EAAQ,CAAA;AAAA,QACR,QAAA,EAAU,QAAA;AAAA,QACV,OAAA,EAAS,CAAA;AAAA,QACT,UAAA,EAAY,QAAA;AAAA,QACZ,aAAA,EAAe;AAAA,OACjB;AAAA,MACC,GAAI,WAAA,GACD;AAAA,QACE,OAAO,KAAA,IAAS,EAAA;AAAA,QAChB,QAAA,EAAU,CAAC,CAAA,KAA2C;AACpD,UAAA,QAAA,CAAU,CAAA,CAAE,OAAO,KAAK,CAAA;AACxB,UAAA,IAAI,CAAA,CAAE,OAAO,KAAA,EAAO;AAElB,YAAA,OAAA,CAAQ,KAAK,4BAA4B,CAAA;AAAA,UAC3C;AAAA,QACF;AAAA,OACF,GACA,EAAE,YAAA,EAAc,EAAA;AAAG;AAAA,GACzB;AAEJ;ACjDA,SAAS,eAAe,MAAA,EAAuD;AAC7E,EAAA,OAAO,CAAC,CAAC,MAAA,EAAQ,YAAA,IAAgB,CAAC,MAAA,CAAO,aAAA;AAC3C;AAGO,SAAS,gBACd,MAAA,EACsC;AACtC,EAAA,IAAI,CAAC,cAAA,CAAe,MAAM,CAAA,SAAU,EAAC;AACrC,EAAA,MAAM,EAAE,MAAA,EAAO,GAAIC,6BAAA,EAAa;AAChC,EAAA,OAAO,EAAE,MAAA,EAAQ,CAAA,EAAG,MAAM,CAAA,+BAAA,CAAA,EAAmC,QAAQ,MAAA,EAAO;AAC9E;AAaO,SAAS,oBAAA,CAAqB,EAAE,MAAA,EAAQ,QAAA,EAAS,EAA8B;AACpF,EAAA,IAAI,CAAC,cAAA,CAAe,MAAM,CAAA,EAAG,OAAO,IAAA;AACpC,EAAA,uBACEC,eAAA,CAAAC,mBAAA,EAAA,EACE,QAAA,EAAA;AAAA,oBAAAH,cAAAA,CAAC,OAAA,EAAA,EAAM,IAAA,EAAK,QAAA,EAAS,IAAA,EAAK,aAAY,KAAA,EAAO,MAAA,CAAQ,YAAA,EAAc,QAAA,EAAQ,IAAA,EAAC,CAAA;AAAA,IAC3E,QAAA,mBAAWA,cAAAA,CAAC,OAAA,EAAA,EAAM,IAAA,EAAK,QAAA,EAAS,IAAA,EAAK,YAAA,EAAa,KAAA,EAAO,QAAA,EAAU,QAAA,EAAQ,IAAA,EAAC,CAAA,GAAK;AAAA,GAAA,EACpF,CAAA;AAEJ","file":"chunk-LUXCT2NU.js","sourcesContent":["/**\n * Single source of truth for the honeypot input — rendered by BOTH form\n * experiences (classic and stage) inside their <form>. The customRender path\n * deliberately gets none (documented limitation: custom renders lose the\n * honeypot, which is why alternate experiences must be render branches).\n *\n * Invariants (do not weaken any of these):\n * - `inert` blocks focus/interaction at the browser level, surviving hostile\n *   site CSS that could defeat the inline styles.\n * - data-sk-honeypot gives site CSS a stable opt-OUT hook.\n * - Controlled input: bots filling via JS still fire React onChange, so the\n *   value reaches submitForm's data payload.\n * - Name comes from config (`honeypot_field || DEFAULT_HONEYPOT_FIELD` from\n *   the shared contract) — resolved by the caller, never forked here.\n * - The trap must be invisible to AUTOFILL as well as to people. A browser or\n *   password manager filling a hidden input flags a real visitor as a bot, and\n *   because the value is stripped server-side the mistake is undiagnosable\n *   after the fact. `autocomplete=\"off\"` does not achieve this — it is the one\n *   value Chrome deliberately ignores for contact/address autofill — so the\n *   trap declares `new-password` (never offered saved contact data) plus the\n *   documented per-manager opt-outs.\n */\n\nimport React from 'react'\n\nexport interface HoneypotFieldProps {\n  name: string\n  value?: string\n  /**\n   * Omit for STATIC mode — an uncontrolled trap a Server Component can render.\n   * The trap's whole job is server-side (the value is read off the submission\n   * and stripped), so it needs no client state to work; the controlled form is\n   * only so the hydrated JSON path can read it back out of React state.\n   */\n  onChange?: (value: string) => void\n}\n\nexport function HoneypotField({ name, value, onChange }: HoneypotFieldProps) {\n  const interactive = typeof onChange === 'function'\n  return (\n    <input\n      type=\"text\"\n      name={name}\n      tabIndex={-1}\n      autoComplete=\"new-password\"\n      aria-hidden=\"true\"\n      inert\n      data-sk-honeypot=\"\"\n      // Password-manager opt-outs: 1Password, LastPass, Dashlane, Bitwarden.\n      // Each ignores its own attribute; none respects autocomplete alone.\n      data-1p-ignore=\"\"\n      data-lpignore=\"true\"\n      data-form-type=\"other\"\n      data-bwignore=\"\"\n      style={{\n        position: 'absolute',\n        left: -9999,\n        width: 1,\n        height: 1,\n        overflow: 'hidden',\n        opacity: 0,\n        visibility: 'hidden',\n        pointerEvents: 'none',\n      }}\n      {...(interactive\n        ? {\n            value: value ?? '',\n            onChange: (e: React.ChangeEvent<HTMLInputElement>) => {\n              onChange!(e.target.value)\n              if (e.target.value) {\n                // Bot detected\n                console.warn('[Forms] Honeypot triggered')\n              }\n            },\n          }\n        : { defaultValue: '' })}\n    />\n  )\n}\n","'use client'\n\n/**\n * No-JS native submission fallback — the floor under every managed form.\n *\n * The classic form is the SSR/no-JS surface (experiences are post-hydration\n * chunks), so it alone carries a real `action`/`method` pointing at\n * sonor-api's POST /api/public/forms/submit-native. With JS running, the\n * form's onSubmit preventDefault()s and the JSON path wins; without JS the\n * browser performs an ordinary form-encoded POST and the lead still lands.\n *\n * Auth rides in the hidden `_sk_token` field: a signed, single-purpose\n * credential minted by the api-key-authenticated forms/config endpoint\n * (`native_token` in the response). No token in the config (older API, or no\n * signing secret) means no fallback — the form keeps its historical behavior\n * rather than pointing at an endpoint that will reject it.\n *\n * Multi-step forms are excluded: step navigation is JS, and a native POST of\n * step-1 fields alone fails whole-form validation server-side. Single-step\n * forms are the overwhelming lead-capture case.\n *\n * Single source of truth for the gating — the form attrs and the hidden\n * fields must always agree, so both read the same predicate.\n */\n\nimport React from 'react'\nimport type { ManagedFormConfig } from './types'\nimport { getApiConfig } from './submitForm'\n\nfunction nativeEligible(config: ManagedFormConfig | null | undefined): boolean {\n  return !!config?.native_token && !config.is_multi_step\n}\n\n/** `action`/`method` for the classic <form> — empty when ineligible. */\nexport function nativeFormProps(\n  config: ManagedFormConfig | null | undefined,\n): { action?: string; method?: 'post' } {\n  if (!nativeEligible(config)) return {}\n  const { apiUrl } = getApiConfig()\n  return { action: `${apiUrl}/api/public/forms/submit-native`, method: 'post' }\n}\n\nexport interface NativeFallbackFieldsProps {\n  config: ManagedFormConfig | null | undefined\n  /**\n   * Absolute URL the native 303 should land on (usually the page hosting the\n   * form). Optional — without it the server falls back to the Referer origin,\n   * which loses the path but still returns the visitor to the right site.\n   */\n  returnTo?: string\n}\n\n/** Hidden control fields the native endpoint reads (`_sk_*` namespace). */\nexport function NativeFallbackFields({ config, returnTo }: NativeFallbackFieldsProps) {\n  if (!nativeEligible(config)) return null\n  return (\n    <>\n      <input type=\"hidden\" name=\"_sk_token\" value={config!.native_token} readOnly />\n      {returnTo ? <input type=\"hidden\" name=\"_sk_return\" value={returnTo} readOnly /> : null}\n    </>\n  )\n}\n"]}
+{"version":3,"sources":["../src/forms/HoneypotField.tsx","../src/forms/native-fallback.tsx"],"names":["jsx","getApiConfig","jsxs","Fragment"],"mappings":";;;;;AAqCO,SAAS,aAAA,CAAc,EAAE,IAAA,EAAM,KAAA,EAAO,UAAS,EAAuB;AAC3E,EAAA,MAAM,WAAA,GAAc,OAAO,QAAA,KAAa,UAAA;AACxC,EAAA,uBACEA,cAAA;AAAA,IAAC,OAAA;AAAA,IAAA;AAAA,MACC,IAAA,EAAK,MAAA;AAAA,MACL,IAAA;AAAA,MACA,QAAA,EAAU,EAAA;AAAA,MACV,YAAA,EAAa,cAAA;AAAA,MACb,aAAA,EAAY,MAAA;AAAA,MACZ,KAAA,EAAK,IAAA;AAAA,MACL,kBAAA,EAAiB,EAAA;AAAA,MAGjB,gBAAA,EAAe,EAAA;AAAA,MACf,eAAA,EAAc,MAAA;AAAA,MACd,gBAAA,EAAe,OAAA;AAAA,MACf,eAAA,EAAc,EAAA;AAAA,MACd,KAAA,EAAO;AAAA,QACL,QAAA,EAAU,UAAA;AAAA,QACV,IAAA,EAAM,KAAA;AAAA,QACN,KAAA,EAAO,CAAA;AAAA,QACP,MAAA,EAAQ,CAAA;AAAA,QACR,QAAA,EAAU,QAAA;AAAA,QACV,OAAA,EAAS,CAAA;AAAA,QACT,UAAA,EAAY,QAAA;AAAA,QACZ,aAAA,EAAe;AAAA,OACjB;AAAA,MACC,GAAI,WAAA,GACD;AAAA,QACE,OAAO,KAAA,IAAS,EAAA;AAAA,QAChB,QAAA,EAAU,CAAC,CAAA,KAA2C;AACpD,UAAA,QAAA,CAAU,CAAA,CAAE,OAAO,KAAK,CAAA;AACxB,UAAA,IAAI,CAAA,CAAE,OAAO,KAAA,EAAO;AAElB,YAAA,OAAA,CAAQ,KAAK,4BAA4B,CAAA;AAAA,UAC3C;AAAA,QACF;AAAA,OACF,GACA,EAAE,YAAA,EAAc,EAAA;AAAG;AAAA,GACzB;AAEJ;ACjDA,SAAS,eAAe,MAAA,EAAuD;AAC7E,EAAA,OAAO,CAAC,CAAC,MAAA,EAAQ,YAAA,IAAgB,CAAC,MAAA,CAAO,aAAA;AAC3C;AAGO,SAAS,gBACd,MAAA,EACsC;AACtC,EAAA,IAAI,CAAC,cAAA,CAAe,MAAM,CAAA,SAAU,EAAC;AACrC,EAAA,MAAM,EAAE,MAAA,EAAO,GAAIC,6BAAA,EAAa;AAChC,EAAA,OAAO,EAAE,MAAA,EAAQ,CAAA,EAAG,MAAM,CAAA,+BAAA,CAAA,EAAmC,QAAQ,MAAA,EAAO;AAC9E;AAaO,SAAS,oBAAA,CAAqB,EAAE,MAAA,EAAQ,QAAA,EAAS,EAA8B;AACpF,EAAA,IAAI,CAAC,cAAA,CAAe,MAAM,CAAA,EAAG,OAAO,IAAA;AACpC,EAAA,uBACEC,eAAA,CAAAC,mBAAA,EAAA,EACE,QAAA,EAAA;AAAA,oBAAAH,cAAAA,CAAC,OAAA,EAAA,EAAM,IAAA,EAAK,QAAA,EAAS,IAAA,EAAK,aAAY,KAAA,EAAO,MAAA,CAAQ,YAAA,EAAc,QAAA,EAAQ,IAAA,EAAC,CAAA;AAAA,IAC3E,QAAA,mBAAWA,cAAAA,CAAC,OAAA,EAAA,EAAM,IAAA,EAAK,QAAA,EAAS,IAAA,EAAK,YAAA,EAAa,KAAA,EAAO,QAAA,EAAU,QAAA,EAAQ,IAAA,EAAC,CAAA,GAAK;AAAA,GAAA,EACpF,CAAA;AAEJ","file":"chunk-UDXWBLBH.js","sourcesContent":["/**\n * Single source of truth for the honeypot input — rendered by BOTH form\n * experiences (classic and stage) inside their <form>. The customRender path\n * deliberately gets none (documented limitation: custom renders lose the\n * honeypot, which is why alternate experiences must be render branches).\n *\n * Invariants (do not weaken any of these):\n * - `inert` blocks focus/interaction at the browser level, surviving hostile\n *   site CSS that could defeat the inline styles.\n * - data-sk-honeypot gives site CSS a stable opt-OUT hook.\n * - Controlled input: bots filling via JS still fire React onChange, so the\n *   value reaches submitForm's data payload.\n * - Name comes from config (`honeypot_field || DEFAULT_HONEYPOT_FIELD` from\n *   the shared contract) — resolved by the caller, never forked here.\n * - The trap must be invisible to AUTOFILL as well as to people. A browser or\n *   password manager filling a hidden input flags a real visitor as a bot, and\n *   because the value is stripped server-side the mistake is undiagnosable\n *   after the fact. `autocomplete=\"off\"` does not achieve this — it is the one\n *   value Chrome deliberately ignores for contact/address autofill — so the\n *   trap declares `new-password` (never offered saved contact data) plus the\n *   documented per-manager opt-outs.\n */\n\nimport React from 'react'\n\nexport interface HoneypotFieldProps {\n  name: string\n  value?: string\n  /**\n   * Omit for STATIC mode — an uncontrolled trap a Server Component can render.\n   * The trap's whole job is server-side (the value is read off the submission\n   * and stripped), so it needs no client state to work; the controlled form is\n   * only so the hydrated JSON path can read it back out of React state.\n   */\n  onChange?: (value: string) => void\n}\n\nexport function HoneypotField({ name, value, onChange }: HoneypotFieldProps) {\n  const interactive = typeof onChange === 'function'\n  return (\n    <input\n      type=\"text\"\n      name={name}\n      tabIndex={-1}\n      autoComplete=\"new-password\"\n      aria-hidden=\"true\"\n      inert\n      data-sk-honeypot=\"\"\n      // Password-manager opt-outs: 1Password, LastPass, Dashlane, Bitwarden.\n      // Each ignores its own attribute; none respects autocomplete alone.\n      data-1p-ignore=\"\"\n      data-lpignore=\"true\"\n      data-form-type=\"other\"\n      data-bwignore=\"\"\n      style={{\n        position: 'absolute',\n        left: -9999,\n        width: 1,\n        height: 1,\n        overflow: 'hidden',\n        opacity: 0,\n        visibility: 'hidden',\n        pointerEvents: 'none',\n      }}\n      {...(interactive\n        ? {\n            value: value ?? '',\n            onChange: (e: React.ChangeEvent<HTMLInputElement>) => {\n              onChange!(e.target.value)\n              if (e.target.value) {\n                // Bot detected\n                console.warn('[Forms] Honeypot triggered')\n              }\n            },\n          }\n        : { defaultValue: '' })}\n    />\n  )\n}\n","'use client'\n\n/**\n * No-JS native submission fallback — the floor under every managed form.\n *\n * The classic form is the SSR/no-JS surface (experiences are post-hydration\n * chunks), so it alone carries a real `action`/`method` pointing at\n * sonor-api's POST /api/public/forms/submit-native. With JS running, the\n * form's onSubmit preventDefault()s and the JSON path wins; without JS the\n * browser performs an ordinary form-encoded POST and the lead still lands.\n *\n * Auth rides in the hidden `_sk_token` field: a signed, single-purpose\n * credential minted by the api-key-authenticated forms/config endpoint\n * (`native_token` in the response). No token in the config (older API, or no\n * signing secret) means no fallback — the form keeps its historical behavior\n * rather than pointing at an endpoint that will reject it.\n *\n * Multi-step forms are excluded: step navigation is JS, and a native POST of\n * step-1 fields alone fails whole-form validation server-side. Single-step\n * forms are the overwhelming lead-capture case.\n *\n * Single source of truth for the gating — the form attrs and the hidden\n * fields must always agree, so both read the same predicate.\n */\n\nimport React from 'react'\nimport type { ManagedFormConfig } from './types'\nimport { getApiConfig } from './submitForm'\n\nfunction nativeEligible(config: ManagedFormConfig | null | undefined): boolean {\n  return !!config?.native_token && !config.is_multi_step\n}\n\n/** `action`/`method` for the classic <form> — empty when ineligible. */\nexport function nativeFormProps(\n  config: ManagedFormConfig | null | undefined,\n): { action?: string; method?: 'post' } {\n  if (!nativeEligible(config)) return {}\n  const { apiUrl } = getApiConfig()\n  return { action: `${apiUrl}/api/public/forms/submit-native`, method: 'post' }\n}\n\nexport interface NativeFallbackFieldsProps {\n  config: ManagedFormConfig | null | undefined\n  /**\n   * Absolute URL the native 303 should land on (usually the page hosting the\n   * form). Optional — without it the server falls back to the Referer origin,\n   * which loses the path but still returns the visitor to the right site.\n   */\n  returnTo?: string\n}\n\n/** Hidden control fields the native endpoint reads (`_sk_*` namespace). */\nexport function NativeFallbackFields({ config, returnTo }: NativeFallbackFieldsProps) {\n  if (!nativeEligible(config)) return null\n  return (\n    <>\n      <input type=\"hidden\" name=\"_sk_token\" value={config!.native_token} readOnly />\n      {returnTo ? <input type=\"hidden\" name=\"_sk_return\" value={returnTo} readOnly /> : null}\n    </>\n  )\n}\n"]}

package/dist/{chunk-HP7V2DI3.mjs → chunk-UFT7IKDN.mjs}

@@ -1,5 +1,5 @@
-import { normalizeSiteHost } from './chunk-NI7OY4FW.mjs';
-import { configureSiteCredential, currentCredential } from './chunk-FSSVIYQ7.mjs';
+import { normalizeSiteHost } from './chunk-ZN4HBK5C.mjs';
+import { configureSiteCredential, currentCredential } from './chunk-OBRGUSGB.mjs';
 
 // src/shared/publishCredential.ts
 function resolveSiteHost(explicitSite) {
@@ -33,5 +33,5 @@ function publishSiteCredential({
 }
 
 export { publishSiteCredential, resolveSiteHost };
-//# sourceMappingURL=chunk-HP7V2DI3.mjs.map
-//# sourceMappingURL=chunk-HP7V2DI3.mjs.map
+//# sourceMappingURL=chunk-UFT7IKDN.mjs.map
+//# sourceMappingURL=chunk-UFT7IKDN.mjs.map

package/dist/{chunk-HP7V2DI3.mjs.map → chunk-UFT7IKDN.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/publishCredential.ts"],"names":[],"mappings":";;;;AAqCO,SAAS,gBAAgB,YAAA,EAA+B;AAC7D,EAAA,MAAM,aACJ,OAAO,OAAA,KAAY,WAAA,GAAc,OAAA,CAAQ,IAAI,oBAAA,GAAuB,MAAA;AAEtE,EAAA,IAAI,WAAW,YAAA,IAAgB,EAAA;AAC/B,EAAA,IAAI,CAAC,YAAY,UAAA,EAAY;AAC3B,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,IAAI,GAAA,CAAI,UAAU,CAAA,CAAE,IAAA;AAAA,IACjC,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,IAAI,CAAC,QAAA,IAAY,OAAO,MAAA,KAAW,WAAA,EAAa;AAC9C,IAAA,QAAA,GAAW,OAAO,QAAA,CAAS,IAAA;AAAA,EAC7B;AACA,EAAA,OAAO,iBAAA,CAAkB,QAAQ,CAAA,IAAK,EAAA;AACxC;AAkCO,SAAS,qBAAA,CAAsB;AAAA,EACpC,MAAA;AAAA,EACA,MAAA,GAAS,sBAAA;AAAA,EACT,IAAA;AAAA,EACA,KAAA,GAAQ,KAAA;AAAA,EACR;AACF,CAAA,EAAuC;AACrC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAKnC,EAAA,uBAAA,CAAwB,EAAE,UAAA,EAAY,MAAA,EAAQ,MAAA,EAAQ,CAAA;AACrD,EAAC,OAAe,oBAAA,GAAuB,MAAA;AACvC,EAAC,MAAA,CAAe,oBAAA,GAAuB,iBAAA,CAAkB,MAAM,CAAA;AAC/D,EAAC,OAAe,kBAAA,GAAqB,KAAA;AACrC,EAAC,MAAA,CAAe,iBAAA,GAAoB,IAAA,IAAQ,eAAA,EAAgB;AAG7D,EAAA,IAAI,cAAA,EAAiB,MAAA,CAAe,uBAAA,GAA0B,cAAA;AAChE","file":"chunk-HP7V2DI3.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared — Client credential + window-global publishing\n *\n * SINGLE SOURCE OF TRUTH for seeding the browser-side token manager and the\n * `window.__SITE_KIT_*` globals that every client module reads. Used by:\n *\n *   - `SiteKitClientProviders` (core `SiteKitLayout`)\n *   - `SiteKitCredential` (`@sonordev/site-kit/client`) — the public component\n *     for layouts that are NOT core `SiteKitLayout`, e.g.\n *     `@sonordev/agency-site-kit`'s `AgencySiteKitLayout`.\n *\n * Do not re-fork this. Before it existed, agency sites hand-rolled their own\n * \"set the globals on mount\" component (upforge's `UptradeSiteKitInit`), and\n * because those copies had no access to the token manager they published the\n * RAW `sonor_` key into the client bundle — the exact exposure the mint exists\n * to prevent. Any layout that puts a credential on `window` goes through here.\n *\n * Client-safe: no `server-only` guard, SSR-safe (every write is window-gated).\n * The minting half is server-only and lives in `../server/mint-site-token`.\n */\n// Leaf module, NOT '../sites/contract' — see sites/normalize.ts. Importing the\n// full contract here shipped its JSON schema to every browser that loads a\n// credential-publishing entry.\nimport { normalizeSiteHost } from '../sites/normalize'\nimport { configureSiteCredential, currentCredential } from './siteToken'\n\n/**\n * Resolve the sub-site identifier — the dimension that lets one Sonor project\n * host many sites (e.g. truepowersystems.com + ohiopowerstudies.com under one\n * TPS project). Precedence, per the platform site contract:\n *   explicit `site` > NEXT_PUBLIC_SITE_URL host > window.location.host\n *\n * Normalized with the shared contract (lowercase host, no protocol/path/port)\n * so `__SITE_KIT_SITE__` matches exactly what the Sonor API stores — servers\n * re-normalize with the same rule, so this only makes the client emit the\n * canonical value. Always returns a string (possibly empty).\n */\nexport function resolveSiteHost(explicitSite?: string): string {\n  const envSiteUrl =\n    typeof process !== 'undefined' ? process.env.NEXT_PUBLIC_SITE_URL : undefined\n\n  let resolved = explicitSite ?? ''\n  if (!resolved && envSiteUrl) {\n    try {\n      resolved = new URL(envSiteUrl).host\n    } catch {\n      /* malformed URL — fall through to client-side host */\n    }\n  }\n  if (!resolved && typeof window !== 'undefined') {\n    resolved = window.location.host\n  }\n  return normalizeSiteHost(resolved) ?? ''\n}\n\nexport interface PublishSiteCredentialOptions {\n  /**\n   * The credential the layout minted server-side. In 3.2+ this is a short-lived\n   * `st1.` token that `sonorFetch` refreshes transparently. A raw `sonor_` key\n   * still works (2.x kit, or the mint-failed fallback) but should never be\n   * routed here from a client component — it would ship the secret to the\n   * browser.\n   */\n  apiKey?: string\n  apiUrl?: string\n  /** Pre-resolved sub-site host. Omit to resolve via `resolveSiteHost`. */\n  site?: string\n  debug?: boolean\n  /**\n   * Referrer-restricted Google Maps BROWSER key for client map components.\n   * Resolved server-side by SiteKitLayout (NEXT_PUBLIC_GOOGLE_MAPS_API_KEY /\n   * GOOGLE_MAPS_BROWSER_KEY) because maps/api.ts runs client-side, where a bare\n   * process.env read is dead code unless the app's bundler happens to inline it.\n   * Never route a server secret here.\n   */\n  mapsBrowserKey?: string\n}\n\n/**\n * Seed the token manager and publish the `window.__SITE_KIT_*` globals.\n *\n * Called during RENDER, not in an effect: client modules read these globals in\n * their own mount effects, and effects run child-first, so an effect-based\n * publish would land after the modules that need it.\n *\n * No-op on the server.\n */\nexport function publishSiteCredential({\n  apiKey,\n  apiUrl = 'https://api.sonor.io',\n  site,\n  debug = false,\n  mapsBrowserKey,\n}: PublishSiteCredentialOptions): void {\n  if (typeof window === 'undefined') return\n\n  // Seed the client token manager. The window global is set to the freshest\n  // token held — a prior page this session may already have refreshed past the\n  // seed the layout injected. In raw-key mode this is a passthrough.\n  configureSiteCredential({ credential: apiKey, apiUrl })\n  ;(window as any).__SITE_KIT_API_URL__ = apiUrl\n  ;(window as any).__SITE_KIT_API_KEY__ = currentCredential(apiKey)\n  ;(window as any).__SITE_KIT_DEBUG__ = debug\n  ;(window as any).__SITE_KIT_SITE__ = site ?? resolveSiteHost()\n  // maps/api.ts falls back to this global when the Sonor platform hasn't\n  // provisioned a browser key. Don't clobber a value another layout already set.\n  if (mapsBrowserKey) (window as any).__GOOGLE_MAPS_API_KEY__ = mapsBrowserKey\n}\n"]}
+{"version":3,"sources":["../src/shared/publishCredential.ts"],"names":[],"mappings":";;;;AAqCO,SAAS,gBAAgB,YAAA,EAA+B;AAC7D,EAAA,MAAM,aACJ,OAAO,OAAA,KAAY,WAAA,GAAc,OAAA,CAAQ,IAAI,oBAAA,GAAuB,MAAA;AAEtE,EAAA,IAAI,WAAW,YAAA,IAAgB,EAAA;AAC/B,EAAA,IAAI,CAAC,YAAY,UAAA,EAAY;AAC3B,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,IAAI,GAAA,CAAI,UAAU,CAAA,CAAE,IAAA;AAAA,IACjC,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,IAAI,CAAC,QAAA,IAAY,OAAO,MAAA,KAAW,WAAA,EAAa;AAC9C,IAAA,QAAA,GAAW,OAAO,QAAA,CAAS,IAAA;AAAA,EAC7B;AACA,EAAA,OAAO,iBAAA,CAAkB,QAAQ,CAAA,IAAK,EAAA;AACxC;AAkCO,SAAS,qBAAA,CAAsB;AAAA,EACpC,MAAA;AAAA,EACA,MAAA,GAAS,sBAAA;AAAA,EACT,IAAA;AAAA,EACA,KAAA,GAAQ,KAAA;AAAA,EACR;AACF,CAAA,EAAuC;AACrC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAKnC,EAAA,uBAAA,CAAwB,EAAE,UAAA,EAAY,MAAA,EAAQ,MAAA,EAAQ,CAAA;AACrD,EAAC,OAAe,oBAAA,GAAuB,MAAA;AACvC,EAAC,MAAA,CAAe,oBAAA,GAAuB,iBAAA,CAAkB,MAAM,CAAA;AAC/D,EAAC,OAAe,kBAAA,GAAqB,KAAA;AACrC,EAAC,MAAA,CAAe,iBAAA,GAAoB,IAAA,IAAQ,eAAA,EAAgB;AAG7D,EAAA,IAAI,cAAA,EAAiB,MAAA,CAAe,uBAAA,GAA0B,cAAA;AAChE","file":"chunk-UFT7IKDN.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared — Client credential + window-global publishing\n *\n * SINGLE SOURCE OF TRUTH for seeding the browser-side token manager and the\n * `window.__SITE_KIT_*` globals that every client module reads. Used by:\n *\n *   - `SiteKitClientProviders` (core `SiteKitLayout`)\n *   - `SiteKitCredential` (`@sonordev/site-kit/client`) — the public component\n *     for layouts that are NOT core `SiteKitLayout`, e.g.\n *     `@sonordev/agency-site-kit`'s `AgencySiteKitLayout`.\n *\n * Do not re-fork this. Before it existed, agency sites hand-rolled their own\n * \"set the globals on mount\" component (upforge's `UptradeSiteKitInit`), and\n * because those copies had no access to the token manager they published the\n * RAW `sonor_` key into the client bundle — the exact exposure the mint exists\n * to prevent. Any layout that puts a credential on `window` goes through here.\n *\n * Client-safe: no `server-only` guard, SSR-safe (every write is window-gated).\n * The minting half is server-only and lives in `../server/mint-site-token`.\n */\n// Leaf module, NOT '../sites/contract' — see sites/normalize.ts. Importing the\n// full contract here shipped its JSON schema to every browser that loads a\n// credential-publishing entry.\nimport { normalizeSiteHost } from '../sites/normalize'\nimport { configureSiteCredential, currentCredential } from './siteToken'\n\n/**\n * Resolve the sub-site identifier — the dimension that lets one Sonor project\n * host many sites (e.g. truepowersystems.com + ohiopowerstudies.com under one\n * TPS project). Precedence, per the platform site contract:\n *   explicit `site` > NEXT_PUBLIC_SITE_URL host > window.location.host\n *\n * Normalized with the shared contract (lowercase host, no protocol/path/port)\n * so `__SITE_KIT_SITE__` matches exactly what the Sonor API stores — servers\n * re-normalize with the same rule, so this only makes the client emit the\n * canonical value. Always returns a string (possibly empty).\n */\nexport function resolveSiteHost(explicitSite?: string): string {\n  const envSiteUrl =\n    typeof process !== 'undefined' ? process.env.NEXT_PUBLIC_SITE_URL : undefined\n\n  let resolved = explicitSite ?? ''\n  if (!resolved && envSiteUrl) {\n    try {\n      resolved = new URL(envSiteUrl).host\n    } catch {\n      /* malformed URL — fall through to client-side host */\n    }\n  }\n  if (!resolved && typeof window !== 'undefined') {\n    resolved = window.location.host\n  }\n  return normalizeSiteHost(resolved) ?? ''\n}\n\nexport interface PublishSiteCredentialOptions {\n  /**\n   * The credential the layout minted server-side. In 3.2+ this is a short-lived\n   * `st1.` token that `sonorFetch` refreshes transparently. A raw `sonor_` key\n   * still works (2.x kit, or the mint-failed fallback) but should never be\n   * routed here from a client component — it would ship the secret to the\n   * browser.\n   */\n  apiKey?: string\n  apiUrl?: string\n  /** Pre-resolved sub-site host. Omit to resolve via `resolveSiteHost`. */\n  site?: string\n  debug?: boolean\n  /**\n   * Referrer-restricted Google Maps BROWSER key for client map components.\n   * Resolved server-side by SiteKitLayout (NEXT_PUBLIC_GOOGLE_MAPS_API_KEY /\n   * GOOGLE_MAPS_BROWSER_KEY) because maps/api.ts runs client-side, where a bare\n   * process.env read is dead code unless the app's bundler happens to inline it.\n   * Never route a server secret here.\n   */\n  mapsBrowserKey?: string\n}\n\n/**\n * Seed the token manager and publish the `window.__SITE_KIT_*` globals.\n *\n * Called during RENDER, not in an effect: client modules read these globals in\n * their own mount effects, and effects run child-first, so an effect-based\n * publish would land after the modules that need it.\n *\n * No-op on the server.\n */\nexport function publishSiteCredential({\n  apiKey,\n  apiUrl = 'https://api.sonor.io',\n  site,\n  debug = false,\n  mapsBrowserKey,\n}: PublishSiteCredentialOptions): void {\n  if (typeof window === 'undefined') return\n\n  // Seed the client token manager. The window global is set to the freshest\n  // token held — a prior page this session may already have refreshed past the\n  // seed the layout injected. In raw-key mode this is a passthrough.\n  configureSiteCredential({ credential: apiKey, apiUrl })\n  ;(window as any).__SITE_KIT_API_URL__ = apiUrl\n  ;(window as any).__SITE_KIT_API_KEY__ = currentCredential(apiKey)\n  ;(window as any).__SITE_KIT_DEBUG__ = debug\n  ;(window as any).__SITE_KIT_SITE__ = site ?? resolveSiteHost()\n  // maps/api.ts falls back to this global when the Sonor platform hasn't\n  // provisioned a browser key. Don't clobber a value another layout already set.\n  if (mapsBrowserKey) (window as any).__GOOGLE_MAPS_API_KEY__ = mapsBrowserKey\n}\n"]}

package/dist/{chunk-GU5OTUQS.mjs → chunk-VS67QHNX.mjs}

@@ -1,4 +1,4 @@
-import { normalizeSiteHost } from './chunk-NI7OY4FW.mjs';
+import { normalizeSiteHost } from './chunk-ZN4HBK5C.mjs';
 
 // src/sites/contract.ts
 var SITE_HOST_CONTRACT_VERSION = 1;
@@ -30,5 +30,5 @@ var SITE_HOST_JSON_SCHEMA = {
 };
 
 export { SITE_HOST_CONTRACT_VERSION, SITE_HOST_JSON_SCHEMA, hostFromUrl, isNormalizedSiteHost, sameSite, stripWww };
-//# sourceMappingURL=chunk-GU5OTUQS.mjs.map
-//# sourceMappingURL=chunk-GU5OTUQS.mjs.map
+//# sourceMappingURL=chunk-VS67QHNX.mjs.map
+//# sourceMappingURL=chunk-VS67QHNX.mjs.map

package/dist/{chunk-GU5OTUQS.mjs.map → chunk-VS67QHNX.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/sites/contract.ts"],"names":[],"mappings":";;;AAgBO,IAAM,0BAAA,GAA6B;AAYnC,SAAS,SAAS,IAAA,EAAsB;AAC7C,EAAA,OAAO,KAAK,UAAA,CAAW,MAAM,IAAI,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,GAAI,IAAA;AACnD;AAOO,SAAS,QAAA,CAAS,GAA8B,CAAA,EAAuC;AAC5F,EAAA,IAAI,CAAC,CAAA,IAAK,CAAC,CAAA,EAAG,OAAO,KAAA;AACrB,EAAA,OAAO,QAAA,CAAS,CAAC,CAAA,KAAM,QAAA,CAAS,CAAC,CAAA;AACnC;AAMO,SAAS,YAAY,KAAA,EAAiD;AAC3E,EAAA,IAAI,CAAC,KAAA,IAAU,CAAC,KAAA,CAAM,UAAA,CAAW,SAAS,CAAA,IAAK,CAAC,KAAA,CAAM,UAAA,CAAW,UAAU,CAAA,EAAI,OAAO,IAAA;AACtF,EAAA,IAAI;AACF,IAAA,OAAO,iBAAA,CAAkB,IAAI,GAAA,CAAI,KAAK,EAAE,IAAI,CAAA;AAAA,EAC9C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,qBAAqB,KAAA,EAAiC;AACpE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,CAAM,SAAS,CAAA,IAAK,iBAAA,CAAkB,KAAK,CAAA,KAAM,KAAA;AACvF;AAMO,IAAM,qBAAA,GAAwB;AAAA,EACnC,OAAA,EAAS,yCAAA;AAAA,EACT,GAAA,EAAK,4CAAA;AAAA,EACL,KAAA,EAAO,oBAAA;AAAA,EACP,WAAA,EACE,yJAAA;AAAA,EACF,IAAA,EAAM,CAAC,QAAA,EAAU,MAAM,CAAA;AAAA,EACvB,OAAA,EAAS;AACX","file":"chunk-GU5OTUQS.mjs","sourcesContent":["/**\n * @sonordev/site-kit/sites/contract — Multi-site \"site\" dimension host contract (v1)\n *\n * Single source of truth for normalizing and comparing sub-site host values\n * (the multi-site `site` dimension, see CLAUDE.md). Same pattern as\n * `@sonordev/site-kit/llms/contract` and `@sonordev/site-kit/slots/contract`:\n * site-kit owns the canonical logic; the Nest APIs keep byte-identical inline\n * mirrors (sonor-api `src/common/utils/site-host.ts`, signal-api\n * `src/shared/utils/seo-page-pick.util.ts`) guarded by the shared drift-test\n * vectors in `contract.test.ts` — so a divergent copy fails CI on either side.\n *\n * Pure string logic only (no Node built-ins) so it is safe in the browser:\n * site-kit itself normalizes `__SITE_KIT_SITE__` with `normalizeSiteHost`.\n */\n\n/** Bump on breaking changes to the normalized host shape. */\nexport const SITE_HOST_CONTRACT_VERSION = 1 as const\n\n/**\n * The normalizer itself lives in `./normalize`, a leaf module, so browser code\n * (`shared/publishCredential`) can import it without dragging this whole module\n * — JSON schema included — into client bundles. Re-exported here so the public\n * contract surface and the cross-repo drift tests are unchanged.\n */\nexport { normalizeSiteHost } from './normalize'\nimport { normalizeSiteHost } from './normalize'\n\n/** Strip a leading `www.` from a host (\"www.tps.com\" → \"tps.com\"). */\nexport function stripWww(host: string): string {\n  return host.startsWith('www.') ? host.slice(4) : host\n}\n\n/**\n * www-insensitive sub-site host equality — `www.a.com` and `a.com` are the\n * same site. Operands are expected already-normalized (lowercase host);\n * returns false if either side is missing.\n */\nexport function sameSite(a: string | null | undefined, b: string | null | undefined): boolean {\n  if (!a || !b) return false\n  return stripWww(a) === stripWww(b)\n}\n\n/**\n * Host of a full URL (\"https://ohiopowerstudies.com/x\" → \"ohiopowerstudies.com\"),\n * null for site-relative paths (\"/services\") and unparseable input.\n */\nexport function hostFromUrl(value: string | null | undefined): string | null {\n  if (!value || (!value.startsWith('http://') && !value.startsWith('https://'))) return null\n  try {\n    return normalizeSiteHost(new URL(value).host)\n  } catch {\n    return null\n  }\n}\n\n/** True when `value` is a non-empty normalized host (lowercase, no protocol/path/port). */\nexport function isNormalizedSiteHost(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0 && normalizeSiteHost(value) === value\n}\n\n/**\n * Agent-native contract: JSON Schema for a normalized `site` value, so services\n * and agents can validate the dimension mechanically without importing the code.\n */\nexport const SITE_HOST_JSON_SCHEMA = {\n  $schema: 'http://json-schema.org/draft-07/schema#',\n  $id: 'https://sonor.io/schemas/site-host.v1.json',\n  title: 'NormalizedSiteHost',\n  description:\n    'A normalized sub-site host (the multi-site `site` dimension): lowercase, no protocol, no path, no port. null denotes a project-wide (unattributed) row.',\n  type: ['string', 'null'],\n  pattern: '^[a-z0-9.-]+$',\n} as const\n"]}
+{"version":3,"sources":["../src/sites/contract.ts"],"names":[],"mappings":";;;AAgBO,IAAM,0BAAA,GAA6B;AAYnC,SAAS,SAAS,IAAA,EAAsB;AAC7C,EAAA,OAAO,KAAK,UAAA,CAAW,MAAM,IAAI,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,GAAI,IAAA;AACnD;AAOO,SAAS,QAAA,CAAS,GAA8B,CAAA,EAAuC;AAC5F,EAAA,IAAI,CAAC,CAAA,IAAK,CAAC,CAAA,EAAG,OAAO,KAAA;AACrB,EAAA,OAAO,QAAA,CAAS,CAAC,CAAA,KAAM,QAAA,CAAS,CAAC,CAAA;AACnC;AAMO,SAAS,YAAY,KAAA,EAAiD;AAC3E,EAAA,IAAI,CAAC,KAAA,IAAU,CAAC,KAAA,CAAM,UAAA,CAAW,SAAS,CAAA,IAAK,CAAC,KAAA,CAAM,UAAA,CAAW,UAAU,CAAA,EAAI,OAAO,IAAA;AACtF,EAAA,IAAI;AACF,IAAA,OAAO,iBAAA,CAAkB,IAAI,GAAA,CAAI,KAAK,EAAE,IAAI,CAAA;AAAA,EAC9C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,qBAAqB,KAAA,EAAiC;AACpE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,CAAM,SAAS,CAAA,IAAK,iBAAA,CAAkB,KAAK,CAAA,KAAM,KAAA;AACvF;AAMO,IAAM,qBAAA,GAAwB;AAAA,EACnC,OAAA,EAAS,yCAAA;AAAA,EACT,GAAA,EAAK,4CAAA;AAAA,EACL,KAAA,EAAO,oBAAA;AAAA,EACP,WAAA,EACE,yJAAA;AAAA,EACF,IAAA,EAAM,CAAC,QAAA,EAAU,MAAM,CAAA;AAAA,EACvB,OAAA,EAAS;AACX","file":"chunk-VS67QHNX.mjs","sourcesContent":["/**\n * @sonordev/site-kit/sites/contract — Multi-site \"site\" dimension host contract (v1)\n *\n * Single source of truth for normalizing and comparing sub-site host values\n * (the multi-site `site` dimension, see CLAUDE.md). Same pattern as\n * `@sonordev/site-kit/llms/contract` and `@sonordev/site-kit/slots/contract`:\n * site-kit owns the canonical logic; the Nest APIs keep byte-identical inline\n * mirrors (sonor-api `src/common/utils/site-host.ts`, signal-api\n * `src/shared/utils/seo-page-pick.util.ts`) guarded by the shared drift-test\n * vectors in `contract.test.ts` — so a divergent copy fails CI on either side.\n *\n * Pure string logic only (no Node built-ins) so it is safe in the browser:\n * site-kit itself normalizes `__SITE_KIT_SITE__` with `normalizeSiteHost`.\n */\n\n/** Bump on breaking changes to the normalized host shape. */\nexport const SITE_HOST_CONTRACT_VERSION = 1 as const\n\n/**\n * The normalizer itself lives in `./normalize`, a leaf module, so browser code\n * (`shared/publishCredential`) can import it without dragging this whole module\n * — JSON schema included — into client bundles. Re-exported here so the public\n * contract surface and the cross-repo drift tests are unchanged.\n */\nexport { normalizeSiteHost } from './normalize'\nimport { normalizeSiteHost } from './normalize'\n\n/** Strip a leading `www.` from a host (\"www.tps.com\" → \"tps.com\"). */\nexport function stripWww(host: string): string {\n  return host.startsWith('www.') ? host.slice(4) : host\n}\n\n/**\n * www-insensitive sub-site host equality — `www.a.com` and `a.com` are the\n * same site. Operands are expected already-normalized (lowercase host);\n * returns false if either side is missing.\n */\nexport function sameSite(a: string | null | undefined, b: string | null | undefined): boolean {\n  if (!a || !b) return false\n  return stripWww(a) === stripWww(b)\n}\n\n/**\n * Host of a full URL (\"https://ohiopowerstudies.com/x\" → \"ohiopowerstudies.com\"),\n * null for site-relative paths (\"/services\") and unparseable input.\n */\nexport function hostFromUrl(value: string | null | undefined): string | null {\n  if (!value || (!value.startsWith('http://') && !value.startsWith('https://'))) return null\n  try {\n    return normalizeSiteHost(new URL(value).host)\n  } catch {\n    return null\n  }\n}\n\n/** True when `value` is a non-empty normalized host (lowercase, no protocol/path/port). */\nexport function isNormalizedSiteHost(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0 && normalizeSiteHost(value) === value\n}\n\n/**\n * Agent-native contract: JSON Schema for a normalized `site` value, so services\n * and agents can validate the dimension mechanically without importing the code.\n */\nexport const SITE_HOST_JSON_SCHEMA = {\n  $schema: 'http://json-schema.org/draft-07/schema#',\n  $id: 'https://sonor.io/schemas/site-host.v1.json',\n  title: 'NormalizedSiteHost',\n  description:\n    'A normalized sub-site host (the multi-site `site` dimension): lowercase, no protocol, no path, no port. null denotes a project-wide (unattributed) row.',\n  type: ['string', 'null'],\n  pattern: '^[a-z0-9.-]+$',\n} as const\n"]}

package/dist/{chunk-SYR7YSB2.mjs → chunk-XPNOM353.mjs}

@@ -1,5 +1,5 @@
 'use client';
-import { sonorFetch } from './chunk-XWBQLPTZ.mjs';
+import { sonorFetch } from './chunk-5PBJ42NC.mjs';
 import { useState, useCallback, useEffect } from 'react';
 import { jsx, Fragment, jsxs } from 'react/jsx-runtime';
 
@@ -521,5 +521,5 @@ async function clearImageSlot(config, slotId, pagePath) {
 }
 
 export { ManagedImage, assignImageToSlot, clearImageSlot, fetchManagedImage, fetchManagedImages, listImageFiles, uploadImage };
-//# sourceMappingURL=chunk-SYR7YSB2.mjs.map
-//# sourceMappingURL=chunk-SYR7YSB2.mjs.map
+//# sourceMappingURL=chunk-XPNOM353.mjs.map
+//# sourceMappingURL=chunk-XPNOM353.mjs.map