@sonordev/site-kit 4.3.0 → 4.3.1

package/dist/{chunk-L4FHGCQ2.mjs → chunk-PK43IK7S.mjs}

@@ -1,4 +1,4 @@
-import { getApiConfig } from './chunk-DYDJ6NCM.mjs';
+import { getApiConfig } from './chunk-JEEWKAAY.mjs';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
 
 function HoneypotField({ name, value, onChange }) {
@@ -56,5 +56,5 @@ function NativeFallbackFields({ config, returnTo }) {
 }
 
 export { HoneypotField, NativeFallbackFields, nativeFormProps };
-//# sourceMappingURL=chunk-L4FHGCQ2.mjs.map
-//# sourceMappingURL=chunk-L4FHGCQ2.mjs.map
+//# sourceMappingURL=chunk-PK43IK7S.mjs.map
+//# sourceMappingURL=chunk-PK43IK7S.mjs.map

package/dist/{chunk-L4FHGCQ2.mjs.map → chunk-PK43IK7S.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/forms/HoneypotField.tsx","../src/forms/native-fallback.tsx"],"names":["jsx"],"mappings":";;;AAqCO,SAAS,aAAA,CAAc,EAAE,IAAA,EAAM,KAAA,EAAO,UAAS,EAAuB;AAC3E,EAAA,MAAM,WAAA,GAAc,OAAO,QAAA,KAAa,UAAA;AACxC,EAAA,uBACE,GAAA;AAAA,IAAC,OAAA;AAAA,IAAA;AAAA,MACC,IAAA,EAAK,MAAA;AAAA,MACL,IAAA;AAAA,MACA,QAAA,EAAU,EAAA;AAAA,MACV,YAAA,EAAa,cAAA;AAAA,MACb,aAAA,EAAY,MAAA;AAAA,MACZ,KAAA,EAAK,IAAA;AAAA,MACL,kBAAA,EAAiB,EAAA;AAAA,MAGjB,gBAAA,EAAe,EAAA;AAAA,MACf,eAAA,EAAc,MAAA;AAAA,MACd,gBAAA,EAAe,OAAA;AAAA,MACf,eAAA,EAAc,EAAA;AAAA,MACd,KAAA,EAAO;AAAA,QACL,QAAA,EAAU,UAAA;AAAA,QACV,IAAA,EAAM,KAAA;AAAA,QACN,KAAA,EAAO,CAAA;AAAA,QACP,MAAA,EAAQ,CAAA;AAAA,QACR,QAAA,EAAU,QAAA;AAAA,QACV,OAAA,EAAS,CAAA;AAAA,QACT,UAAA,EAAY,QAAA;AAAA,QACZ,aAAA,EAAe;AAAA,OACjB;AAAA,MACC,GAAI,WAAA,GACD;AAAA,QACE,OAAO,KAAA,IAAS,EAAA;AAAA,QAChB,QAAA,EAAU,CAAC,CAAA,KAA2C;AACpD,UAAA,QAAA,CAAU,CAAA,CAAE,OAAO,KAAK,CAAA;AACxB,UAAA,IAAI,CAAA,CAAE,OAAO,KAAA,EAAO;AAElB,YAAA,OAAA,CAAQ,KAAK,4BAA4B,CAAA;AAAA,UAC3C;AAAA,QACF;AAAA,OACF,GACA,EAAE,YAAA,EAAc,EAAA;AAAG;AAAA,GACzB;AAEJ;ACjDA,SAAS,eAAe,MAAA,EAAuD;AAC7E,EAAA,OAAO,CAAC,CAAC,MAAA,EAAQ,YAAA,IAAgB,CAAC,MAAA,CAAO,aAAA;AAC3C;AAGO,SAAS,gBACd,MAAA,EACsC;AACtC,EAAA,IAAI,CAAC,cAAA,CAAe,MAAM,CAAA,SAAU,EAAC;AACrC,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,YAAA,EAAa;AAChC,EAAA,OAAO,EAAE,MAAA,EAAQ,CAAA,EAAG,MAAM,CAAA,+BAAA,CAAA,EAAmC,QAAQ,MAAA,EAAO;AAC9E;AAaO,SAAS,oBAAA,CAAqB,EAAE,MAAA,EAAQ,QAAA,EAAS,EAA8B;AACpF,EAAA,IAAI,CAAC,cAAA,CAAe,MAAM,CAAA,EAAG,OAAO,IAAA;AACpC,EAAA,uBACE,IAAA,CAAA,QAAA,EAAA,EACE,QAAA,EAAA;AAAA,oBAAAA,GAAAA,CAAC,OAAA,EAAA,EAAM,IAAA,EAAK,QAAA,EAAS,IAAA,EAAK,aAAY,KAAA,EAAO,MAAA,CAAQ,YAAA,EAAc,QAAA,EAAQ,IAAA,EAAC,CAAA;AAAA,IAC3E,QAAA,mBAAWA,GAAAA,CAAC,OAAA,EAAA,EAAM,IAAA,EAAK,QAAA,EAAS,IAAA,EAAK,YAAA,EAAa,KAAA,EAAO,QAAA,EAAU,QAAA,EAAQ,IAAA,EAAC,CAAA,GAAK;AAAA,GAAA,EACpF,CAAA;AAEJ","file":"chunk-L4FHGCQ2.mjs","sourcesContent":["/**\n * Single source of truth for the honeypot input — rendered by BOTH form\n * experiences (classic and stage) inside their <form>. The customRender path\n * deliberately gets none (documented limitation: custom renders lose the\n * honeypot, which is why alternate experiences must be render branches).\n *\n * Invariants (do not weaken any of these):\n * - `inert` blocks focus/interaction at the browser level, surviving hostile\n *   site CSS that could defeat the inline styles.\n * - data-sk-honeypot gives site CSS a stable opt-OUT hook.\n * - Controlled input: bots filling via JS still fire React onChange, so the\n *   value reaches submitForm's data payload.\n * - Name comes from config (`honeypot_field || DEFAULT_HONEYPOT_FIELD` from\n *   the shared contract) — resolved by the caller, never forked here.\n * - The trap must be invisible to AUTOFILL as well as to people. A browser or\n *   password manager filling a hidden input flags a real visitor as a bot, and\n *   because the value is stripped server-side the mistake is undiagnosable\n *   after the fact. `autocomplete=\"off\"` does not achieve this — it is the one\n *   value Chrome deliberately ignores for contact/address autofill — so the\n *   trap declares `new-password` (never offered saved contact data) plus the\n *   documented per-manager opt-outs.\n */\n\nimport React from 'react'\n\nexport interface HoneypotFieldProps {\n  name: string\n  value?: string\n  /**\n   * Omit for STATIC mode — an uncontrolled trap a Server Component can render.\n   * The trap's whole job is server-side (the value is read off the submission\n   * and stripped), so it needs no client state to work; the controlled form is\n   * only so the hydrated JSON path can read it back out of React state.\n   */\n  onChange?: (value: string) => void\n}\n\nexport function HoneypotField({ name, value, onChange }: HoneypotFieldProps) {\n  const interactive = typeof onChange === 'function'\n  return (\n    <input\n      type=\"text\"\n      name={name}\n      tabIndex={-1}\n      autoComplete=\"new-password\"\n      aria-hidden=\"true\"\n      inert\n      data-sk-honeypot=\"\"\n      // Password-manager opt-outs: 1Password, LastPass, Dashlane, Bitwarden.\n      // Each ignores its own attribute; none respects autocomplete alone.\n      data-1p-ignore=\"\"\n      data-lpignore=\"true\"\n      data-form-type=\"other\"\n      data-bwignore=\"\"\n      style={{\n        position: 'absolute',\n        left: -9999,\n        width: 1,\n        height: 1,\n        overflow: 'hidden',\n        opacity: 0,\n        visibility: 'hidden',\n        pointerEvents: 'none',\n      }}\n      {...(interactive\n        ? {\n            value: value ?? '',\n            onChange: (e: React.ChangeEvent<HTMLInputElement>) => {\n              onChange!(e.target.value)\n              if (e.target.value) {\n                // Bot detected\n                console.warn('[Forms] Honeypot triggered')\n              }\n            },\n          }\n        : { defaultValue: '' })}\n    />\n  )\n}\n","'use client'\n\n/**\n * No-JS native submission fallback — the floor under every managed form.\n *\n * The classic form is the SSR/no-JS surface (experiences are post-hydration\n * chunks), so it alone carries a real `action`/`method` pointing at\n * sonor-api's POST /api/public/forms/submit-native. With JS running, the\n * form's onSubmit preventDefault()s and the JSON path wins; without JS the\n * browser performs an ordinary form-encoded POST and the lead still lands.\n *\n * Auth rides in the hidden `_sk_token` field: a signed, single-purpose\n * credential minted by the api-key-authenticated forms/config endpoint\n * (`native_token` in the response). No token in the config (older API, or no\n * signing secret) means no fallback — the form keeps its historical behavior\n * rather than pointing at an endpoint that will reject it.\n *\n * Multi-step forms are excluded: step navigation is JS, and a native POST of\n * step-1 fields alone fails whole-form validation server-side. Single-step\n * forms are the overwhelming lead-capture case.\n *\n * Single source of truth for the gating — the form attrs and the hidden\n * fields must always agree, so both read the same predicate.\n */\n\nimport React from 'react'\nimport type { ManagedFormConfig } from './types'\nimport { getApiConfig } from './submitForm'\n\nfunction nativeEligible(config: ManagedFormConfig | null | undefined): boolean {\n  return !!config?.native_token && !config.is_multi_step\n}\n\n/** `action`/`method` for the classic <form> — empty when ineligible. */\nexport function nativeFormProps(\n  config: ManagedFormConfig | null | undefined,\n): { action?: string; method?: 'post' } {\n  if (!nativeEligible(config)) return {}\n  const { apiUrl } = getApiConfig()\n  return { action: `${apiUrl}/api/public/forms/submit-native`, method: 'post' }\n}\n\nexport interface NativeFallbackFieldsProps {\n  config: ManagedFormConfig | null | undefined\n  /**\n   * Absolute URL the native 303 should land on (usually the page hosting the\n   * form). Optional — without it the server falls back to the Referer origin,\n   * which loses the path but still returns the visitor to the right site.\n   */\n  returnTo?: string\n}\n\n/** Hidden control fields the native endpoint reads (`_sk_*` namespace). */\nexport function NativeFallbackFields({ config, returnTo }: NativeFallbackFieldsProps) {\n  if (!nativeEligible(config)) return null\n  return (\n    <>\n      <input type=\"hidden\" name=\"_sk_token\" value={config!.native_token} readOnly />\n      {returnTo ? <input type=\"hidden\" name=\"_sk_return\" value={returnTo} readOnly /> : null}\n    </>\n  )\n}\n"]}
+{"version":3,"sources":["../src/forms/HoneypotField.tsx","../src/forms/native-fallback.tsx"],"names":["jsx"],"mappings":";;;AAqCO,SAAS,aAAA,CAAc,EAAE,IAAA,EAAM,KAAA,EAAO,UAAS,EAAuB;AAC3E,EAAA,MAAM,WAAA,GAAc,OAAO,QAAA,KAAa,UAAA;AACxC,EAAA,uBACE,GAAA;AAAA,IAAC,OAAA;AAAA,IAAA;AAAA,MACC,IAAA,EAAK,MAAA;AAAA,MACL,IAAA;AAAA,MACA,QAAA,EAAU,EAAA;AAAA,MACV,YAAA,EAAa,cAAA;AAAA,MACb,aAAA,EAAY,MAAA;AAAA,MACZ,KAAA,EAAK,IAAA;AAAA,MACL,kBAAA,EAAiB,EAAA;AAAA,MAGjB,gBAAA,EAAe,EAAA;AAAA,MACf,eAAA,EAAc,MAAA;AAAA,MACd,gBAAA,EAAe,OAAA;AAAA,MACf,eAAA,EAAc,EAAA;AAAA,MACd,KAAA,EAAO;AAAA,QACL,QAAA,EAAU,UAAA;AAAA,QACV,IAAA,EAAM,KAAA;AAAA,QACN,KAAA,EAAO,CAAA;AAAA,QACP,MAAA,EAAQ,CAAA;AAAA,QACR,QAAA,EAAU,QAAA;AAAA,QACV,OAAA,EAAS,CAAA;AAAA,QACT,UAAA,EAAY,QAAA;AAAA,QACZ,aAAA,EAAe;AAAA,OACjB;AAAA,MACC,GAAI,WAAA,GACD;AAAA,QACE,OAAO,KAAA,IAAS,EAAA;AAAA,QAChB,QAAA,EAAU,CAAC,CAAA,KAA2C;AACpD,UAAA,QAAA,CAAU,CAAA,CAAE,OAAO,KAAK,CAAA;AACxB,UAAA,IAAI,CAAA,CAAE,OAAO,KAAA,EAAO;AAElB,YAAA,OAAA,CAAQ,KAAK,4BAA4B,CAAA;AAAA,UAC3C;AAAA,QACF;AAAA,OACF,GACA,EAAE,YAAA,EAAc,EAAA;AAAG;AAAA,GACzB;AAEJ;ACjDA,SAAS,eAAe,MAAA,EAAuD;AAC7E,EAAA,OAAO,CAAC,CAAC,MAAA,EAAQ,YAAA,IAAgB,CAAC,MAAA,CAAO,aAAA;AAC3C;AAGO,SAAS,gBACd,MAAA,EACsC;AACtC,EAAA,IAAI,CAAC,cAAA,CAAe,MAAM,CAAA,SAAU,EAAC;AACrC,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,YAAA,EAAa;AAChC,EAAA,OAAO,EAAE,MAAA,EAAQ,CAAA,EAAG,MAAM,CAAA,+BAAA,CAAA,EAAmC,QAAQ,MAAA,EAAO;AAC9E;AAaO,SAAS,oBAAA,CAAqB,EAAE,MAAA,EAAQ,QAAA,EAAS,EAA8B;AACpF,EAAA,IAAI,CAAC,cAAA,CAAe,MAAM,CAAA,EAAG,OAAO,IAAA;AACpC,EAAA,uBACE,IAAA,CAAA,QAAA,EAAA,EACE,QAAA,EAAA;AAAA,oBAAAA,GAAAA,CAAC,OAAA,EAAA,EAAM,IAAA,EAAK,QAAA,EAAS,IAAA,EAAK,aAAY,KAAA,EAAO,MAAA,CAAQ,YAAA,EAAc,QAAA,EAAQ,IAAA,EAAC,CAAA;AAAA,IAC3E,QAAA,mBAAWA,GAAAA,CAAC,OAAA,EAAA,EAAM,IAAA,EAAK,QAAA,EAAS,IAAA,EAAK,YAAA,EAAa,KAAA,EAAO,QAAA,EAAU,QAAA,EAAQ,IAAA,EAAC,CAAA,GAAK;AAAA,GAAA,EACpF,CAAA;AAEJ","file":"chunk-PK43IK7S.mjs","sourcesContent":["/**\n * Single source of truth for the honeypot input — rendered by BOTH form\n * experiences (classic and stage) inside their <form>. The customRender path\n * deliberately gets none (documented limitation: custom renders lose the\n * honeypot, which is why alternate experiences must be render branches).\n *\n * Invariants (do not weaken any of these):\n * - `inert` blocks focus/interaction at the browser level, surviving hostile\n *   site CSS that could defeat the inline styles.\n * - data-sk-honeypot gives site CSS a stable opt-OUT hook.\n * - Controlled input: bots filling via JS still fire React onChange, so the\n *   value reaches submitForm's data payload.\n * - Name comes from config (`honeypot_field || DEFAULT_HONEYPOT_FIELD` from\n *   the shared contract) — resolved by the caller, never forked here.\n * - The trap must be invisible to AUTOFILL as well as to people. A browser or\n *   password manager filling a hidden input flags a real visitor as a bot, and\n *   because the value is stripped server-side the mistake is undiagnosable\n *   after the fact. `autocomplete=\"off\"` does not achieve this — it is the one\n *   value Chrome deliberately ignores for contact/address autofill — so the\n *   trap declares `new-password` (never offered saved contact data) plus the\n *   documented per-manager opt-outs.\n */\n\nimport React from 'react'\n\nexport interface HoneypotFieldProps {\n  name: string\n  value?: string\n  /**\n   * Omit for STATIC mode — an uncontrolled trap a Server Component can render.\n   * The trap's whole job is server-side (the value is read off the submission\n   * and stripped), so it needs no client state to work; the controlled form is\n   * only so the hydrated JSON path can read it back out of React state.\n   */\n  onChange?: (value: string) => void\n}\n\nexport function HoneypotField({ name, value, onChange }: HoneypotFieldProps) {\n  const interactive = typeof onChange === 'function'\n  return (\n    <input\n      type=\"text\"\n      name={name}\n      tabIndex={-1}\n      autoComplete=\"new-password\"\n      aria-hidden=\"true\"\n      inert\n      data-sk-honeypot=\"\"\n      // Password-manager opt-outs: 1Password, LastPass, Dashlane, Bitwarden.\n      // Each ignores its own attribute; none respects autocomplete alone.\n      data-1p-ignore=\"\"\n      data-lpignore=\"true\"\n      data-form-type=\"other\"\n      data-bwignore=\"\"\n      style={{\n        position: 'absolute',\n        left: -9999,\n        width: 1,\n        height: 1,\n        overflow: 'hidden',\n        opacity: 0,\n        visibility: 'hidden',\n        pointerEvents: 'none',\n      }}\n      {...(interactive\n        ? {\n            value: value ?? '',\n            onChange: (e: React.ChangeEvent<HTMLInputElement>) => {\n              onChange!(e.target.value)\n              if (e.target.value) {\n                // Bot detected\n                console.warn('[Forms] Honeypot triggered')\n              }\n            },\n          }\n        : { defaultValue: '' })}\n    />\n  )\n}\n","'use client'\n\n/**\n * No-JS native submission fallback — the floor under every managed form.\n *\n * The classic form is the SSR/no-JS surface (experiences are post-hydration\n * chunks), so it alone carries a real `action`/`method` pointing at\n * sonor-api's POST /api/public/forms/submit-native. With JS running, the\n * form's onSubmit preventDefault()s and the JSON path wins; without JS the\n * browser performs an ordinary form-encoded POST and the lead still lands.\n *\n * Auth rides in the hidden `_sk_token` field: a signed, single-purpose\n * credential minted by the api-key-authenticated forms/config endpoint\n * (`native_token` in the response). No token in the config (older API, or no\n * signing secret) means no fallback — the form keeps its historical behavior\n * rather than pointing at an endpoint that will reject it.\n *\n * Multi-step forms are excluded: step navigation is JS, and a native POST of\n * step-1 fields alone fails whole-form validation server-side. Single-step\n * forms are the overwhelming lead-capture case.\n *\n * Single source of truth for the gating — the form attrs and the hidden\n * fields must always agree, so both read the same predicate.\n */\n\nimport React from 'react'\nimport type { ManagedFormConfig } from './types'\nimport { getApiConfig } from './submitForm'\n\nfunction nativeEligible(config: ManagedFormConfig | null | undefined): boolean {\n  return !!config?.native_token && !config.is_multi_step\n}\n\n/** `action`/`method` for the classic <form> — empty when ineligible. */\nexport function nativeFormProps(\n  config: ManagedFormConfig | null | undefined,\n): { action?: string; method?: 'post' } {\n  if (!nativeEligible(config)) return {}\n  const { apiUrl } = getApiConfig()\n  return { action: `${apiUrl}/api/public/forms/submit-native`, method: 'post' }\n}\n\nexport interface NativeFallbackFieldsProps {\n  config: ManagedFormConfig | null | undefined\n  /**\n   * Absolute URL the native 303 should land on (usually the page hosting the\n   * form). Optional — without it the server falls back to the Referer origin,\n   * which loses the path but still returns the visitor to the right site.\n   */\n  returnTo?: string\n}\n\n/** Hidden control fields the native endpoint reads (`_sk_*` namespace). */\nexport function NativeFallbackFields({ config, returnTo }: NativeFallbackFieldsProps) {\n  if (!nativeEligible(config)) return null\n  return (\n    <>\n      <input type=\"hidden\" name=\"_sk_token\" value={config!.native_token} readOnly />\n      {returnTo ? <input type=\"hidden\" name=\"_sk_return\" value={returnTo} readOnly /> : null}\n    </>\n  )\n}\n"]}

package/dist/{chunk-77CIIDE6.js → chunk-PXAALKTP.js}

@@ -1,6 +1,6 @@
 'use strict';
 
-// src/middleware/securityHeaders.ts
+// src/proxy/securityHeaders.ts
 var DEFAULT_FRAME_ANCESTORS = [
   "'self'",
   "https://upforge.io",
@@ -38,5 +38,5 @@ function buildSecurityHeaders(config) {
 
 exports.DEFAULT_FRAME_ANCESTORS = DEFAULT_FRAME_ANCESTORS;
 exports.buildSecurityHeaders = buildSecurityHeaders;
-//# sourceMappingURL=chunk-77CIIDE6.js.map
-//# sourceMappingURL=chunk-77CIIDE6.js.map
+//# sourceMappingURL=chunk-PXAALKTP.js.map
+//# sourceMappingURL=chunk-PXAALKTP.js.map

package/dist/chunk-PXAALKTP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/proxy/securityHeaders.ts"],"names":[],"mappings":";;;AAoBO,IAAM,uBAAA,GAA0B;AAAA,EACrC,QAAA;AAAA,EACA,oBAAA;AAAA,EACA;AACF;AAiCO,SAAS,qBACd,MAAA,EACwB;AACxB,EAAA,IAAI,MAAA,KAAW,KAAA,EAAO,OAAO,EAAC;AAE9B,EAAA,MAAM,CAAA,GACJ,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,EAAC;AAEzC,EAAA,MAAM,UAAkC,EAAC;AAGzC,EAAA,IAAI,CAAA,CAAE,uBAAuB,KAAA,EAAO;AAClC,IAAA,OAAA,CAAQ,wBAAwB,CAAA,GAAI,IAAA;AAAA,EACtC;AAUA,EAAA,MAAM,cAAA,GACJ,CAAA,CAAE,cAAA,KAAmB,KAAA,GACjB,IAAA,GACA,CAAA,CAAE,cAAA,IAAkB,CAAA,CAAE,cAAA,CAAe,MAAA,GAAS,CAAA,GAC5C,CAAA,CAAE,cAAA,GACF,uBAAA;AAER,EAAA,IAAI,cAAA,EAAgB;AAClB,IAAA,OAAA,CAAQ,yBAAyB,CAAA,GAC/B,CAAA,gBAAA,EAAmB,cAAA,CAAe,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA;AAE7C,IAAA,IAAI,EAAE,YAAA,EAAc;AAClB,MAAA,OAAA,CAAQ,iBAAiB,IAAI,CAAA,CAAE,YAAA;AAAA,IACjC;AAAA,EACF,CAAA,MAAA,IAAW,CAAA,CAAE,YAAA,KAAiB,KAAA,EAAO;AACnC,IAAA,OAAA,CAAQ,iBAAiB,CAAA,GAAI,CAAA,CAAE,YAAA,IAAgB,MAAA;AAAA,EACjD;AAGA,EAAA,IAAI,CAAA,CAAE,uBAAuB,KAAA,EAAO;AAClC,IAAA,OAAA,CAAQ,wBAAwB,CAAA,GAAI,SAAA;AAAA,EACtC;AAGA,EAAA,IAAI,CAAA,CAAE,kBAAkB,KAAA,EAAO;AAC7B,IAAA,OAAA,CAAQ,kBAAkB,CAAA,GAAI,eAAA;AAAA,EAChC;AAGA,EAAA,OAAA,CAAQ,iBAAiB,CAAA,GACvB,CAAA,CAAE,cAAA,IAAkB,iCAAA;AAGtB,EAAA,OAAA,CAAQ,oBAAoB,CAAA,GAC1B,CAAA,CAAE,iBAAA,IAAqB,0CAAA;AAGzB,EAAA,IAAI,EAAE,aAAA,EAAe;AACnB,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,EAAS,CAAA,CAAE,aAAa,CAAA;AAAA,EACxC;AAEA,EAAA,OAAO,OAAA;AACT","file":"chunk-PXAALKTP.js","sourcesContent":["/**\n * Default security headers applied by site-kit middleware.\n *\n * These match industry best practices and are the same headers\n * recommended by Next.js documentation. All are opt-out.\n */\n\n/**\n * Single source of truth for who may frame a site-kit site.\n *\n * Upforge showcases live client work inside iframes on its portfolio /\n * area pages, so every managed marketing site has to be embeddable from\n * upforge.io. `X-Frame-Options` cannot express an allowlist (`ALLOW-FROM`\n * is dead and ignored by every current browser), so the CSP\n * `frame-ancestors` directive is the only way to say \"these origins and\n * nobody else\". Everything not listed here is still blocked.\n *\n * Do NOT re-fork this list into individual sites' middleware/next.config —\n * add origins here and let the fleet inherit them.\n */\nexport const DEFAULT_FRAME_ANCESTORS = [\n  \"'self'\",\n  'https://upforge.io',\n  'https://*.upforge.io',\n]\n\nexport interface SecurityHeadersConfig {\n  /** X-Frame-Options value. false to disable. Default: omitted when\n   * `frameAncestors` is active (the two conflict), otherwise 'DENY'. */\n  frameOptions?: 'DENY' | 'SAMEORIGIN' | false\n  /**\n   * Origins allowed to frame this site, emitted as a CSP `frame-ancestors`\n   * directive. Defaults to {@link DEFAULT_FRAME_ANCESTORS} ('self' + upforge.io)\n   * so Upforge can showcase the site. Pass an array to extend/replace, or\n   * `false` to opt out entirely and fall back to X-Frame-Options.\n   *\n   * Ignored if a `Content-Security-Policy` is supplied via `customHeaders` —\n   * that CSP wins, and must carry its own frame-ancestors directive.\n   */\n  frameAncestors?: string[] | false\n  /** X-Content-Type-Options: nosniff. Default: true */\n  contentTypeOptions?: boolean\n  /** X-XSS-Protection header. Default: true */\n  xssProtection?: boolean\n  /** Referrer-Policy value. Default: 'strict-origin-when-cross-origin' */\n  referrerPolicy?: string\n  /** Permissions-Policy value. Default restricts camera, microphone, geolocation */\n  permissionsPolicy?: string\n  /** X-DNS-Prefetch-Control. Default: true (on) */\n  dnsPrefetchControl?: boolean\n  /** Additional custom headers */\n  customHeaders?: Record<string, string>\n}\n\n/**\n * Build a flat Record of header name → value from the config.\n */\nexport function buildSecurityHeaders(\n  config?: SecurityHeadersConfig | boolean,\n): Record<string, string> {\n  if (config === false) return {}\n\n  const c: SecurityHeadersConfig =\n    typeof config === 'object' ? config : {}\n\n  const headers: Record<string, string> = {}\n\n  // X-DNS-Prefetch-Control\n  if (c.dnsPrefetchControl !== false) {\n    headers['X-DNS-Prefetch-Control'] = 'on'\n  }\n\n  // Framing policy — CSP frame-ancestors is the allowlist mechanism;\n  // X-Frame-Options is only a fallback for the opted-out case.\n  //\n  // These two headers MUST NOT both be emitted: X-Frame-Options has no\n  // allowlist form, so a stray `DENY`/`SAMEORIGIN` alongside a permissive\n  // frame-ancestors is honoured by some browsers and silently re-blocks the\n  // embed. So when frame-ancestors is active we drop XFO unless the site\n  // explicitly asked for a value.\n  const frameAncestors =\n    c.frameAncestors === false\n      ? null\n      : c.frameAncestors && c.frameAncestors.length > 0\n        ? c.frameAncestors\n        : DEFAULT_FRAME_ANCESTORS\n\n  if (frameAncestors) {\n    headers['Content-Security-Policy'] =\n      `frame-ancestors ${frameAncestors.join(' ')}`\n    // Only honour an explicitly-requested XFO value here.\n    if (c.frameOptions) {\n      headers['X-Frame-Options'] = c.frameOptions\n    }\n  } else if (c.frameOptions !== false) {\n    headers['X-Frame-Options'] = c.frameOptions || 'DENY'\n  }\n\n  // X-Content-Type-Options\n  if (c.contentTypeOptions !== false) {\n    headers['X-Content-Type-Options'] = 'nosniff'\n  }\n\n  // X-XSS-Protection\n  if (c.xssProtection !== false) {\n    headers['X-XSS-Protection'] = '1; mode=block'\n  }\n\n  // Referrer-Policy\n  headers['Referrer-Policy'] =\n    c.referrerPolicy || 'strict-origin-when-cross-origin'\n\n  // Permissions-Policy\n  headers['Permissions-Policy'] =\n    c.permissionsPolicy || 'camera=(), microphone=(), geolocation=()'\n\n  // Custom headers\n  if (c.customHeaders) {\n    Object.assign(headers, c.customHeaders)\n  }\n\n  return headers\n}\n"]}

package/dist/chunk-Q3VBSR4M.mjs

@@ -0,0 +1,6 @@
+// src/shared/version.ts
+var SITE_KIT_VERSION = "4.3.1";
+
+export { SITE_KIT_VERSION };
+//# sourceMappingURL=chunk-Q3VBSR4M.mjs.map
+//# sourceMappingURL=chunk-Q3VBSR4M.mjs.map

package/dist/{chunk-2X5ZB5D7.mjs.map → chunk-Q3VBSR4M.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";AASO,IAAM,gBAAA,GAAmB","file":"chunk-2X5ZB5D7.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared - Package version constant\n *\n * Single source of truth for the version the kit reports at runtime (the\n * x-sitekit-version request header set by sonorFetch). Kept as a plain const\n * so client bundles don't need JSON imports; scripts/verify-dts.cjs asserts\n * it matches package.json at publish time, and version.test.ts asserts it in\n * dev, so it can't silently drift.\n */\nexport const SITE_KIT_VERSION = '4.3.0'\n"]}
+{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";AASO,IAAM,gBAAA,GAAmB","file":"chunk-Q3VBSR4M.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared - Package version constant\n *\n * Single source of truth for the version the kit reports at runtime (the\n * x-sitekit-version request header set by sonorFetch). Kept as a plain const\n * so client bundles don't need JSON imports; scripts/verify-dts.cjs asserts\n * it matches package.json at publish time, and version.test.ts asserts it in\n * dev, so it can't silently drift.\n */\nexport const SITE_KIT_VERSION = '4.3.1'\n"]}

package/dist/{chunk-O4TMBV54.js → chunk-QC6EOISZ.js}

@@ -1,8 +1,8 @@
 'use strict';
 
-var chunkUDXWBLBH_js = require('./chunk-UDXWBLBH.js');
+var chunkMIYP7WFZ_js = require('./chunk-MIYP7WFZ.js');
 var chunk2ACKOMAL_js = require('./chunk-2ACKOMAL.js');
-var chunkT6YDAJ5F_js = require('./chunk-T6YDAJ5F.js');
+var chunkQIJIOKNT_js = require('./chunk-QIJIOKNT.js');
 var chunkKHPJ3CEL_js = require('./chunk-KHPJ3CEL.js');
 var jsxRuntime = require('react/jsx-runtime');
 
@@ -14,7 +14,7 @@ function visibleStaticFields(config) {
 }
 function StaticForm({ config: raw, className, nativeReturnTo }) {
   if (!raw) return null;
-  const config = chunkT6YDAJ5F_js.normalizeFormConfig(raw);
+  const config = chunkQIJIOKNT_js.normalizeFormConfig(raw);
   const fields = visibleStaticFields(config);
   const honeypotFieldName = config.honeypot_field || chunkKHPJ3CEL_js.DEFAULT_HONEYPOT_FIELD;
   return /* @__PURE__ */ jsxRuntime.jsxs(
@@ -23,7 +23,7 @@ function StaticForm({ config: raw, className, nativeReturnTo }) {
       "data-sk-state": "idle",
       "data-sk-mount": "shell",
       className: `sk-form ${className || ""}`,
-      ...chunkUDXWBLBH_js.nativeFormProps(config),
+      ...chunkMIYP7WFZ_js.nativeFormProps(config),
       children: [
         /* @__PURE__ */ jsxRuntime.jsx("div", { className: "sk-form__step", children: /* @__PURE__ */ jsxRuntime.jsx("div", { className: "sk-form__fields", children: fields.map((field) => /* @__PURE__ */ jsxRuntime.jsx(
           "div",
@@ -34,13 +34,13 @@ function StaticForm({ config: raw, className, nativeReturnTo }) {
           field.id || field.slug
         )) }) }),
         /* @__PURE__ */ jsxRuntime.jsx("div", { className: "sk-form__actions", style: { justifyContent: "flex-end" }, children: /* @__PURE__ */ jsxRuntime.jsx("button", { type: "submit", className: "sk-form__btn sk-form__btn--submit", children: config.submit_button_text || "Submit" }) }),
-        config.honeypot_enabled && /* @__PURE__ */ jsxRuntime.jsx(chunkUDXWBLBH_js.HoneypotField, { name: honeypotFieldName }),
-        /* @__PURE__ */ jsxRuntime.jsx(chunkUDXWBLBH_js.NativeFallbackFields, { config, returnTo: nativeReturnTo })
+        config.honeypot_enabled && /* @__PURE__ */ jsxRuntime.jsx(chunkMIYP7WFZ_js.HoneypotField, { name: honeypotFieldName }),
+        /* @__PURE__ */ jsxRuntime.jsx(chunkMIYP7WFZ_js.NativeFallbackFields, { config, returnTo: nativeReturnTo })
       ]
     }
   );
 }
 
 exports.StaticForm = StaticForm;
-//# sourceMappingURL=chunk-O4TMBV54.js.map
-//# sourceMappingURL=chunk-O4TMBV54.js.map
+//# sourceMappingURL=chunk-QC6EOISZ.js.map
+//# sourceMappingURL=chunk-QC6EOISZ.js.map

package/dist/{chunk-O4TMBV54.js.map → chunk-QC6EOISZ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/forms/StaticForm.tsx"],"names":["normalizeFormConfig","DEFAULT_HONEYPOT_FIELD","jsxs","nativeFormProps","jsx","FormField","HoneypotField","NativeFallbackFields"],"mappings":";;;;;;;;AA6DA,SAAS,oBAAoB,MAAA,EAA2B;AACtD,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,MAAA,IAAU,EAAC;AAC9B,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,EAAe,OAAO,GAAA;AAGlC,EAAA,MAAM,WAAA,GAAc,MAAA,CAAO,KAAA,GAAQ,CAAC,CAAA,EAAG,EAAA;AACvC,EAAA,OAAO,GAAA,CAAI,OAAO,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,OAAA,IAAW,CAAA,CAAE,OAAA,KAAY,WAAW,CAAA;AAClE;AAEO,SAAS,WAAW,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAA,EAAW,gBAAe,EAAoB;AACtF,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,MAAM,MAAA,GAASA,qCAAoB,GAAU,CAAA;AAC7C,EAAA,MAAM,MAAA,GAAS,oBAAoB,MAAM,CAAA;AACzC,EAAA,MAAM,iBAAA,GAAoB,OAAO,cAAA,IAAkBC,uCAAA;AAEnD,EAAA,uBACEC,eAAA;AAAA,IAAC,MAAA;AAAA,IAAA;AAAA,MAGC,eAAA,EAAc,MAAA;AAAA,MACd,eAAA,EAAc,OAAA;AAAA,MACd,SAAA,EAAW,CAAA,QAAA,EAAW,SAAA,IAAa,EAAE,CAAA,CAAA;AAAA,MACpC,GAAGC,iCAAgB,MAAM,CAAA;AAAA,MAE1B,QAAA,EAAA;AAAA,wBAAAC,cAAA,CAAC,KAAA,EAAA,EAAI,SAAA,EAAU,eAAA,EACb,QAAA,kBAAAA,cAAA,CAAC,KAAA,EAAA,EAAI,WAAU,iBAAA,EACZ,QAAA,EAAA,MAAA,CAAO,GAAA,CAAI,CAAC,KAAA,qBACXA,cAAA;AAAA,UAAC,KAAA;AAAA,UAAA;AAAA,YAEC,SAAA,EAAW,CAAA,+CAAA,EAAkD,KAAA,CAAM,KAAA,IAAS,MAAM,CAAA,CAAA;AAAA,YAGlF,yCAACC,0BAAA,EAAA,EAAU,KAAA,EAAc,KAAA,EAAO,KAAA,CAAM,iBAAiB,EAAA,EAAI;AAAA,WAAA;AAAA,UAJtD,KAAA,CAAM,MAAM,KAAA,CAAM;AAAA,SAM1B,GACH,CAAA,EACF,CAAA;AAAA,uCAEC,KAAA,EAAA,EAAI,SAAA,EAAU,oBAAmB,KAAA,EAAO,EAAE,gBAAgB,UAAA,EAAW,EACpE,QAAA,kBAAAD,cAAA,CAAC,QAAA,EAAA,EAAO,MAAK,QAAA,EAAS,SAAA,EAAU,qCAC7B,QAAA,EAAA,MAAA,CAAO,kBAAA,IAAsB,UAChC,CAAA,EACF,CAAA;AAAA,QAIC,MAAA,CAAO,gBAAA,oBAAoBA,cAAA,CAACE,8BAAA,EAAA,EAAc,MAAM,iBAAA,EAAmB,CAAA;AAAA,wBAGpEF,cAAA,CAACG,qCAAA,EAAA,EAAqB,MAAA,EAAgB,QAAA,EAAU,cAAA,EAAgB;AAAA;AAAA;AAAA,GAClE;AAEJ","file":"chunk-O4TMBV54.js","sourcesContent":["/**\n * StaticForm — a complete, submittable managed form with ZERO client JavaScript.\n *\n * No `'use client'`. This renders in a Server Component, and what it emits is\n * a real `<form>`: every field, the honeypot, the signed native token, and a\n * submit button. With JavaScript disabled, off, or still downloading, the\n * browser performs an ordinary form-encoded POST to\n * `/api/public/forms/submit-native`, sonor-api runs the honeypot +\n * render-timestamp + quarantine stack, and the lead lands. 4.0.1 built that\n * endpoint; this is what finally puts it under every form by default.\n *\n * ── Why this exists ─────────────────────────────────────────────────────\n *\n * ManagedForm was a client component for historical reasons that no longer\n * hold: it used to fetch its own config (getFormConfig removed that) and it\n * could only submit via JSON (the native endpoint removed that). Nobody moved\n * the boundary afterward, so every site that rendered a form paid for the\n * whole forms runtime — validation, spotlight, celebration, momentum — as an\n * INITIAL script, on the LCP-critical path.\n *\n * Measured on upforge.io's homepage: 48 KB of form code in the initial chunk\n * set cost 6 Lighthouse points (88 -> 82, LCP 3.8s -> 4.7s). Deferring the\n * client component recovered the score but deleted the form from the HTML,\n * taking the no-JS floor and crawlable fields with it. Neither half was\n * acceptable; a server-rendered form is what makes both true at once.\n *\n * Pair it with <FormEnhancer> to upgrade this markup at idle. Alone, it is\n * still a working form — that is the point. Never make this file `'use\n * client'`, and never import a hook into it.\n */\n\nimport React from 'react'\nimport { DEFAULT_HONEYPOT_FIELD } from './contract'\nimport { FormField } from './FormField'\nimport { HoneypotField } from './HoneypotField'\nimport { nativeFormProps, NativeFallbackFields } from './native-fallback'\nimport { normalizeFormConfig } from './normalize-config'\nimport type { ManagedFormConfig } from './types'\n\nexport interface StaticFormProps {\n  /**\n   * RAW /api/public/forms/config payload from `getFormConfig`, or an\n   * already-normalized config. Normalized here through the SAME function the\n   * client fetch uses, so the shell and the enhancement cannot disagree about\n   * field order, step count, or success copy.\n   */\n  config: Record<string, unknown> | ManagedFormConfig | null | undefined\n  className?: string\n  /**\n   * Absolute URL the no-JS 303 should return to (usually the page hosting the\n   * form). Without it the API falls back to the Referer origin — right site,\n   * wrong page.\n   */\n  nativeReturnTo?: string\n}\n\n/**\n * Fields the static shell can render meaningfully. Conditional logic is a\n * runtime concern (it depends on values the visitor has not entered yet), so\n * a conditional field renders here and the enhancement takes over hiding it.\n */\nfunction visibleStaticFields(config: ManagedFormConfig) {\n  const all = config.fields || []\n  if (!config.is_multi_step) return all\n  // Multi-step is JS-only navigation and is excluded from native POST, so the\n  // shell shows step one as a preview of what the form asks for.\n  const firstStepId = config.steps?.[0]?.id\n  return all.filter((f) => !f.step_id || f.step_id === firstStepId)\n}\n\nexport function StaticForm({ config: raw, className, nativeReturnTo }: StaticFormProps) {\n  if (!raw) return null\n  const config = normalizeFormConfig(raw as any)\n  const fields = visibleStaticFields(config)\n  const honeypotFieldName = config.honeypot_field || DEFAULT_HONEYPOT_FIELD\n\n  return (\n    <form\n      // Matches FormClient's classic branch attribute-for-attribute so the\n      // enhancement swap is invisible. Change one, change the other.\n      data-sk-state=\"idle\"\n      data-sk-mount=\"shell\"\n      className={`sk-form ${className || ''}`}\n      {...nativeFormProps(config)}\n    >\n      <div className=\"sk-form__step\">\n        <div className=\"sk-form__fields\">\n          {fields.map((field) => (\n            <div\n              key={field.id || field.slug}\n              className={`sk-form__field-wrapper sk-form__field-wrapper--${field.width || 'full'}`}\n            >\n              {/* No onChange — FormField renders native uncontrolled controls. */}\n              <FormField field={field} value={field.default_value ?? ''} />\n            </div>\n          ))}\n        </div>\n      </div>\n\n      <div className=\"sk-form__actions\" style={{ justifyContent: 'flex-end' }}>\n        <button type=\"submit\" className=\"sk-form__btn sk-form__btn--submit\">\n          {config.submit_button_text || 'Submit'}\n        </button>\n      </div>\n\n      {/* Same trap the hydrated form uses; no state needed because the value\n          is read and stripped server-side. */}\n      {config.honeypot_enabled && <HoneypotField name={honeypotFieldName} />}\n\n      {/* _sk_token auth + _sk_return destination for the native POST. */}\n      <NativeFallbackFields config={config} returnTo={nativeReturnTo} />\n    </form>\n  )\n}\n"]}
+{"version":3,"sources":["../src/forms/StaticForm.tsx"],"names":["normalizeFormConfig","DEFAULT_HONEYPOT_FIELD","jsxs","nativeFormProps","jsx","FormField","HoneypotField","NativeFallbackFields"],"mappings":";;;;;;;;AA6DA,SAAS,oBAAoB,MAAA,EAA2B;AACtD,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,MAAA,IAAU,EAAC;AAC9B,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,EAAe,OAAO,GAAA;AAGlC,EAAA,MAAM,WAAA,GAAc,MAAA,CAAO,KAAA,GAAQ,CAAC,CAAA,EAAG,EAAA;AACvC,EAAA,OAAO,GAAA,CAAI,OAAO,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,OAAA,IAAW,CAAA,CAAE,OAAA,KAAY,WAAW,CAAA;AAClE;AAEO,SAAS,WAAW,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAA,EAAW,gBAAe,EAAoB;AACtF,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,MAAM,MAAA,GAASA,qCAAoB,GAAU,CAAA;AAC7C,EAAA,MAAM,MAAA,GAAS,oBAAoB,MAAM,CAAA;AACzC,EAAA,MAAM,iBAAA,GAAoB,OAAO,cAAA,IAAkBC,uCAAA;AAEnD,EAAA,uBACEC,eAAA;AAAA,IAAC,MAAA;AAAA,IAAA;AAAA,MAGC,eAAA,EAAc,MAAA;AAAA,MACd,eAAA,EAAc,OAAA;AAAA,MACd,SAAA,EAAW,CAAA,QAAA,EAAW,SAAA,IAAa,EAAE,CAAA,CAAA;AAAA,MACpC,GAAGC,iCAAgB,MAAM,CAAA;AAAA,MAE1B,QAAA,EAAA;AAAA,wBAAAC,cAAA,CAAC,KAAA,EAAA,EAAI,SAAA,EAAU,eAAA,EACb,QAAA,kBAAAA,cAAA,CAAC,KAAA,EAAA,EAAI,WAAU,iBAAA,EACZ,QAAA,EAAA,MAAA,CAAO,GAAA,CAAI,CAAC,KAAA,qBACXA,cAAA;AAAA,UAAC,KAAA;AAAA,UAAA;AAAA,YAEC,SAAA,EAAW,CAAA,+CAAA,EAAkD,KAAA,CAAM,KAAA,IAAS,MAAM,CAAA,CAAA;AAAA,YAGlF,yCAACC,0BAAA,EAAA,EAAU,KAAA,EAAc,KAAA,EAAO,KAAA,CAAM,iBAAiB,EAAA,EAAI;AAAA,WAAA;AAAA,UAJtD,KAAA,CAAM,MAAM,KAAA,CAAM;AAAA,SAM1B,GACH,CAAA,EACF,CAAA;AAAA,uCAEC,KAAA,EAAA,EAAI,SAAA,EAAU,oBAAmB,KAAA,EAAO,EAAE,gBAAgB,UAAA,EAAW,EACpE,QAAA,kBAAAD,cAAA,CAAC,QAAA,EAAA,EAAO,MAAK,QAAA,EAAS,SAAA,EAAU,qCAC7B,QAAA,EAAA,MAAA,CAAO,kBAAA,IAAsB,UAChC,CAAA,EACF,CAAA;AAAA,QAIC,MAAA,CAAO,gBAAA,oBAAoBA,cAAA,CAACE,8BAAA,EAAA,EAAc,MAAM,iBAAA,EAAmB,CAAA;AAAA,wBAGpEF,cAAA,CAACG,qCAAA,EAAA,EAAqB,MAAA,EAAgB,QAAA,EAAU,cAAA,EAAgB;AAAA;AAAA;AAAA,GAClE;AAEJ","file":"chunk-QC6EOISZ.js","sourcesContent":["/**\n * StaticForm — a complete, submittable managed form with ZERO client JavaScript.\n *\n * No `'use client'`. This renders in a Server Component, and what it emits is\n * a real `<form>`: every field, the honeypot, the signed native token, and a\n * submit button. With JavaScript disabled, off, or still downloading, the\n * browser performs an ordinary form-encoded POST to\n * `/api/public/forms/submit-native`, sonor-api runs the honeypot +\n * render-timestamp + quarantine stack, and the lead lands. 4.0.1 built that\n * endpoint; this is what finally puts it under every form by default.\n *\n * ── Why this exists ─────────────────────────────────────────────────────\n *\n * ManagedForm was a client component for historical reasons that no longer\n * hold: it used to fetch its own config (getFormConfig removed that) and it\n * could only submit via JSON (the native endpoint removed that). Nobody moved\n * the boundary afterward, so every site that rendered a form paid for the\n * whole forms runtime — validation, spotlight, celebration, momentum — as an\n * INITIAL script, on the LCP-critical path.\n *\n * Measured on upforge.io's homepage: 48 KB of form code in the initial chunk\n * set cost 6 Lighthouse points (88 -> 82, LCP 3.8s -> 4.7s). Deferring the\n * client component recovered the score but deleted the form from the HTML,\n * taking the no-JS floor and crawlable fields with it. Neither half was\n * acceptable; a server-rendered form is what makes both true at once.\n *\n * Pair it with <FormEnhancer> to upgrade this markup at idle. Alone, it is\n * still a working form — that is the point. Never make this file `'use\n * client'`, and never import a hook into it.\n */\n\nimport React from 'react'\nimport { DEFAULT_HONEYPOT_FIELD } from './contract'\nimport { FormField } from './FormField'\nimport { HoneypotField } from './HoneypotField'\nimport { nativeFormProps, NativeFallbackFields } from './native-fallback'\nimport { normalizeFormConfig } from './normalize-config'\nimport type { ManagedFormConfig } from './types'\n\nexport interface StaticFormProps {\n  /**\n   * RAW /api/public/forms/config payload from `getFormConfig`, or an\n   * already-normalized config. Normalized here through the SAME function the\n   * client fetch uses, so the shell and the enhancement cannot disagree about\n   * field order, step count, or success copy.\n   */\n  config: Record<string, unknown> | ManagedFormConfig | null | undefined\n  className?: string\n  /**\n   * Absolute URL the no-JS 303 should return to (usually the page hosting the\n   * form). Without it the API falls back to the Referer origin — right site,\n   * wrong page.\n   */\n  nativeReturnTo?: string\n}\n\n/**\n * Fields the static shell can render meaningfully. Conditional logic is a\n * runtime concern (it depends on values the visitor has not entered yet), so\n * a conditional field renders here and the enhancement takes over hiding it.\n */\nfunction visibleStaticFields(config: ManagedFormConfig) {\n  const all = config.fields || []\n  if (!config.is_multi_step) return all\n  // Multi-step is JS-only navigation and is excluded from native POST, so the\n  // shell shows step one as a preview of what the form asks for.\n  const firstStepId = config.steps?.[0]?.id\n  return all.filter((f) => !f.step_id || f.step_id === firstStepId)\n}\n\nexport function StaticForm({ config: raw, className, nativeReturnTo }: StaticFormProps) {\n  if (!raw) return null\n  const config = normalizeFormConfig(raw as any)\n  const fields = visibleStaticFields(config)\n  const honeypotFieldName = config.honeypot_field || DEFAULT_HONEYPOT_FIELD\n\n  return (\n    <form\n      // Matches FormClient's classic branch attribute-for-attribute so the\n      // enhancement swap is invisible. Change one, change the other.\n      data-sk-state=\"idle\"\n      data-sk-mount=\"shell\"\n      className={`sk-form ${className || ''}`}\n      {...nativeFormProps(config)}\n    >\n      <div className=\"sk-form__step\">\n        <div className=\"sk-form__fields\">\n          {fields.map((field) => (\n            <div\n              key={field.id || field.slug}\n              className={`sk-form__field-wrapper sk-form__field-wrapper--${field.width || 'full'}`}\n            >\n              {/* No onChange — FormField renders native uncontrolled controls. */}\n              <FormField field={field} value={field.default_value ?? ''} />\n            </div>\n          ))}\n        </div>\n      </div>\n\n      <div className=\"sk-form__actions\" style={{ justifyContent: 'flex-end' }}>\n        <button type=\"submit\" className=\"sk-form__btn sk-form__btn--submit\">\n          {config.submit_button_text || 'Submit'}\n        </button>\n      </div>\n\n      {/* Same trap the hydrated form uses; no state needed because the value\n          is read and stripped server-side. */}\n      {config.honeypot_enabled && <HoneypotField name={honeypotFieldName} />}\n\n      {/* _sk_token auth + _sk_return destination for the native POST. */}\n      <NativeFallbackFields config={config} returnTo={nativeReturnTo} />\n    </form>\n  )\n}\n"]}

package/dist/{chunk-T6YDAJ5F.js → chunk-QIJIOKNT.js}

@@ -1,7 +1,7 @@
 'use strict';
 
 var chunkKHPJ3CEL_js = require('./chunk-KHPJ3CEL.js');
-var chunkTBIWQQVF_js = require('./chunk-TBIWQQVF.js');
+var chunk3ZWY6S4V_js = require('./chunk-3ZWY6S4V.js');
 
 // src/forms/defaultSuccessMessage.ts
 var DEFAULT_FORM_SUCCESS_MESSAGE = "Thank you for your submission! We will be in touch soon.";
@@ -158,7 +158,7 @@ async function submitForm({
       _formLoadedAt: formLoadedAt
     }
   };
-  const response = await chunkTBIWQQVF_js.sonorFetch(
+  const response = await chunk3ZWY6S4V_js.sonorFetch(
     `${apiUrl}/api/public/forms/submit`,
     {
       method: "POST",
@@ -184,5 +184,5 @@ exports.DEFAULT_FORM_SUCCESS_MESSAGE = DEFAULT_FORM_SUCCESS_MESSAGE;
 exports.getApiConfig = getApiConfig;
 exports.normalizeFormConfig = normalizeFormConfig;
 exports.submitForm = submitForm;
-//# sourceMappingURL=chunk-T6YDAJ5F.js.map
-//# sourceMappingURL=chunk-T6YDAJ5F.js.map
+//# sourceMappingURL=chunk-QIJIOKNT.js.map
+//# sourceMappingURL=chunk-QIJIOKNT.js.map

package/dist/{chunk-T6YDAJ5F.js.map → chunk-QIJIOKNT.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/forms/defaultSuccessMessage.ts","../src/forms/normalize-config.ts","../src/forms/recaptcha.ts","../src/forms/submitForm.ts"],"names":["DEFAULT_HONEYPOT_FIELD","sonorFetch"],"mappings":";;;;;;AACO,IAAM,4BAAA,GACX;;;ACiBK,SAAS,oBAAoB,IAAA,EAA8B;AAChE,EAAA,IAAI,KAAK,KAAA,EAAO;AACd,IAAA,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,EAAQ,CAAA,KAAA,CAAY,EAAE,WAAA,IAAe,CAAA,KAAM,CAAA,CAAE,WAAA,IAAe,CAAA,CAAE,CAAA;AAAA,EACjF;AACA,EAAA,IAAI,KAAK,MAAA,EAAQ;AACf,IAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,EAAQ,CAAA,KAAA,CAAY,EAAE,UAAA,IAAc,CAAA,KAAM,CAAA,CAAE,UAAA,IAAc,CAAA,CAAE,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,EAAO,MAAA,IAAU,CAAA;AAC1C,EAAA,MAAM,gBAAgB,WAAA,GAAc,CAAA;AAEpC,EAAA,MAAM,UAAA,GACJ,OAAO,IAAA,CAAK,eAAA,KAAoB,WAAW,IAAA,CAAK,eAAA,CAAgB,MAAK,GAAI,EAAA;AAC3E,EAAA,MAAM,eAAA,GACJ,UAAA,KACC,OAAQ,IAAA,CAAqC,cAAA,KAAmB,QAAA,GAC7D,MAAA,CAAQ,IAAA,CAAqC,cAAc,CAAA,CAAE,IAAA,EAAK,GAClE,EAAA,CAAA,IACJ,4BAAA;AAEF,EAAA,OAAO;AAAA,IACL,GAAG,IAAA;AAAA,IACH,eAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF;AACF;;;ACrCA,SAAS,WAAW,eAAA,EAA8C;AAChE,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,MAAA;AAC1C,EAAA,IAAI,iBAAiB,OAAO,eAAA;AAC5B,EAAA,MAAM,GAAA,GAAM,MAAA;AACZ,EAAA,OAAO,GAAA,CAAI,+BAAA,IAAmC,OAAA,CAAQ,GAAA,CAAI,8BAAA;AAC5D;AAGA,IAAM,yBAAA,GAA4B,GAAA;AAElC,SAAS,WAAW,OAAA,EAA+B;AACjD,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC9B,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,MAAA;AACZ,IAAA,IAAI,GAAA,CAAI,YAAY,UAAA,EAAY;AAC9B,MAAA,OAAA,CAAQ,IAAI,UAAU,CAAA;AACtB,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,MAAM,MAAA,GAAS,CAAC,KAAA,KAAe;AAC7B,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,IACf,CAAA;AACA,IAAA,MAAM,SAAS,UAAA,CAAW,MAAM,MAAA,CAAO,IAAI,GAAG,yBAAyB,CAAA;AAEvE,IAAA,MAAM,eAAe,MAAM;AACzB,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,IAAI,GAAA,CAAI,YAAY,UAAA,EAAY;AAC9B,QAAA,YAAA,CAAa,MAAM,CAAA;AACnB,QAAA,MAAA,CAAO,IAAI,UAAU,CAAA;AACrB,QAAA;AAAA,MACF;AACA,MAAA,UAAA,CAAW,cAAc,EAAE,CAAA;AAAA,IAC7B,CAAA;AAEA,IAAA,MAAM,QAAA,GAAW,QAAA,CAAS,aAAA,CAAc,qCAAqC,CAAA;AAC7E,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,YAAA,EAAa;AACb,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,IAAA,MAAA,CAAO,GAAA,GAAM,yDAAyD,OAAO,CAAA,CAAA;AAC7E,IAAA,MAAA,CAAO,KAAA,GAAQ,IAAA;AACf,IAAA,MAAA,CAAO,MAAA,GAAS,MAAM,YAAA,EAAa;AACnC,IAAA,MAAA,CAAO,UAAU,MAAM;AACrB,MAAA,YAAA,CAAa,MAAM,CAAA;AACnB,MAAA,MAAA,CAAO,IAAI,CAAA;AAAA,IACb,CAAA;AACA,IAAA,QAAA,CAAS,IAAA,CAAK,YAAY,MAAM,CAAA;AAAA,EAClC,CAAC,CAAA;AACH;AAMA,eAAsB,kBAAkB,eAAA,EAAkD;AACxF,EAAA,MAAM,OAAA,GAAU,WAAW,eAAe,CAAA;AAC1C,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,MAAA,KAAW,aAAa,OAAO,IAAA;AACtD,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,MAAM,UAAA,CAAW,OAAO,CAAA;AAC3C,IAAA,IAAI,CAAC,UAAA,EAAY,UAAA,EAAY,OAAA,EAAS,OAAO,IAAA;AAK7C,IAAA,MAAM,IAAI,QAAc,CAAC,OAAA,KAAY,WAAW,UAAA,CAAW,KAAA,CAAM,OAAO,CAAC,CAAA;AACzE,IAAA,MAAM,KAAA,GAAQ,MAAM,UAAA,CAAW,UAAA,CAAW,QAAQ,OAAA,EAAS,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AAC/E,IAAA,OAAO,KAAA,IAAS,IAAA;AAAA,EAClB,SAAS,GAAA,EAAK;AAGZ,IAAA,IAAI;AACF,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,GAAG,CAAC,CAAA;AACvD,MAAA,MAAM,GAAA,GAAM,MAAA;AACZ,MAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,UAAA,CAAW,UAAA,CAAW,QAAQ,OAAA,EAAS,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AACnF,MAAA,OAAO,KAAA,IAAS,IAAA;AAAA,IAClB,SAAS,QAAA,EAAU;AACjB,MAAA,OAAA,CAAQ,IAAA,CAAK,wBAAwB,QAAQ,CAAA;AAC7C,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACF;;;AChFO,SAAS,YAAA,GAA+D;AAI7E,EAAA,MAAM,MAAA,GACJ,OAAO,MAAA,KAAW,WAAA,GACb,MAAA,CAAe,oBAAA,IAAwB,sBAAA,GACxC,OAAA,CAAQ,GAAA,CAAI,aAAA,IAAiB,OAAA,CAAQ,GAAA,CAAI,yBAAA,IAA6B,sBAAA;AAC5E,EAAA,MAAM,MAAA,GACJ,OAAO,MAAA,KAAW,WAAA,GAAe,OAAe,oBAAA,GAAuB,MAAA;AACzE,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC1B;AAEA,SAAS,YAAA,GAA8C;AACrD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,EAAC;AAC3C,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAA,CAAO,SAAS,MAAM,CAAA;AACzD,EAAA,MAAM,MAAqC,EAAC;AAC5C,EAAA,KAAA,MAAW,OAAO,CAAC,YAAA,EAAc,cAAc,cAAA,EAAgB,UAAA,EAAY,aAAa,CAAA,EAAG;AACzF,IAAA,GAAA,CAAI,GAAG,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAAA,EAC3B;AACA,EAAA,OAAO,GAAA;AACT;AAoBA,eAAsB,UAAA,CAAW;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA,EAAqC;AACnC,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,YAAA,EAAa;AACxC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,MAAM,6DAA6D,CAAA;AAAA,EAC/E;AAGA,EAAA,MAAM,iBAAiB,MAAA,CAAO,iBAAA,GAC1B,MAAM,iBAAA,CAAkB,MAAA,CAAO,kBAAkB,CAAA,GACjD,IAAA;AACJ,EAAA,IAAI,MAAA,CAAO,iBAAA,IAAqB,CAAC,cAAA,EAAgB;AAC/C,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC1E;AAEA,EAAA,MAAM,iBAAA,GAAoB,OAAO,cAAA,IAAkBA,uCAAA;AACnD,EAAA,MAAM,MAAM,YAAA,EAAa;AAEzB,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,QAAQ,MAAA,CAAO,EAAA;AAAA,IACf,SAAS,MAAA,CAAO,EAAA;AAAA,IAChB,IAAA,EAAM;AAAA,MACJ,GAAG,MAAA;AAAA,MACH,GAAI,OAAO,gBAAA,GAAmB,EAAE,CAAC,iBAAiB,GAAG,aAAA,EAAc,GAAI;AAAC,KAC1E;AAAA,IACA,QAAA,EAAU;AAAA,MACR,SAAS,OAAO,MAAA,KAAW,WAAA,GAAc,MAAA,CAAO,SAAS,IAAA,GAAO,IAAA;AAAA,MAChE,UAAU,OAAO,QAAA,KAAa,WAAA,GAAc,QAAA,CAAS,YAAY,IAAA,GAAO,IAAA;AAAA,MACxE,SAAA,EAAW,OAAO,SAAA,KAAc,WAAA,GAAc,UAAU,SAAA,GAAY,IAAA;AAAA,MACpE,WACE,OAAO,cAAA,KAAmB,cAAc,cAAA,CAAe,OAAA,CAAQ,SAAS,CAAA,GAAI,IAAA;AAAA;AAAA;AAAA;AAAA,MAI9E,WACE,OAAO,YAAA,KAAiB,cAAc,YAAA,CAAa,OAAA,CAAQ,SAAS,CAAA,GAAI,IAAA;AAAA,MAC1E,gBAAgB,cAAA,IAAkB,MAAA;AAAA,MAClC,WAAW,GAAA,CAAI,UAAA;AAAA,MACf,WAAW,GAAA,CAAI,UAAA;AAAA,MACf,aAAa,GAAA,CAAI,YAAA;AAAA,MACjB,SAAS,GAAA,CAAI,QAAA;AAAA,MACb,YAAY,GAAA,CAAI,WAAA;AAAA;AAAA;AAAA,MAGhB,IAAA,EACE,OAAO,MAAA,KAAW,WAAA,GACb,OAA0C,iBAAA,IAC3C,MAAA,CAAO,SAAS,IAAA,GAChB,MAAA;AAAA,MACN,aAAA,EAAe;AAAA;AACjB,GACF;AAEA,EAAA,MAAM,WAAW,MAAMC,2BAAA;AAAA,IACrB,GAAG,MAAM,CAAA,wBAAA,CAAA;AAAA,IACT;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,aAAA,EAAe,UAAU,MAAM,CAAA;AAAA,OACjC;AAAA,MACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAO;AAAA,KAC9B;AAAA,IACA,EAAE,OAAA,EAAS,CAAA,EAAG,SAAA,EAAW,GAAA;AAAM,GACjC;AAEA,EAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAEnD,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,GAAA,GAAA,CACJ,IAAA,EAAM,OAAA,IACN,IAAA,EAAM,KAAA,KACL,QAAA,CAAS,UAAA,IAAc,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA,CAAA,EAE9C,QAAA,GACA,IAAA,EAAK;AACR,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,MAAM,CAAA,uBAAA,EAA0B,GAAG,CAAA,CAAA,GAAK,CAAA,uBAAA,EAA0B,SAAS,MAAM,CAAA,CAAA;AAAA,KACnF;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT","file":"chunk-T6YDAJ5F.js","sourcesContent":["/** Shown when the API omits or returns an empty `success_message`. */\nexport const DEFAULT_FORM_SUCCESS_MESSAGE =\n  'Thank you for your submission! We will be in touch soon.'\n","/**\n * Shared form-config normalizer — the ONE place a raw\n * /api/public/forms/config payload becomes a ManagedFormConfig.\n *\n * Deliberately has no `'use client'` directive and no hooks, so it is usable\n * from a Server Component (StaticForm) as well as from useForm's client\n * fetch. Both the server shell and the hydrated enhancement must agree on\n * field order, step count and success copy or the swap visibly jumps, so\n * there must never be a second copy of this.\n */\n\nimport type { ManagedFormConfig } from './types'\nimport { DEFAULT_FORM_SUCCESS_MESSAGE } from './defaultSuccessMessage'\n\n/**\n * Normalize a raw /api/public/forms/config payload into ManagedFormConfig.\n * Single source of truth — used for both the client fetch and server-provided\n * `initialForm`, so the two paths can never drift.\n */\nexport function normalizeFormConfig(data: any): ManagedFormConfig {\n  if (data.steps) {\n    data.steps.sort((a: any, b: any) => (a.step_number || 0) - (b.step_number || 0))\n  }\n  if (data.fields) {\n    data.fields.sort((a: any, b: any) => (a.sort_order || 0) - (b.sort_order || 0))\n  }\n\n  const total_steps = data.steps?.length || 1\n  const is_multi_step = total_steps > 1\n\n  const apiSuccess =\n    typeof data.success_message === 'string' ? data.success_message.trim() : ''\n  const success_message =\n    apiSuccess ||\n    (typeof (data as { successMessage?: string }).successMessage === 'string'\n      ? String((data as { successMessage?: string }).successMessage).trim()\n      : '') ||\n    DEFAULT_FORM_SUCCESS_MESSAGE\n\n  return {\n    ...data,\n    success_message,\n    total_steps,\n    is_multi_step,\n  }\n}\n","/**\n * reCAPTCHA Enterprise - Client-side token generation for site-kit forms\n *\n * Site key is read from:\n * - window.__SITE_KIT_RECAPTCHA_SITE_KEY__ (set by SiteKitLayout)\n * - process.env.NEXT_PUBLIC_RECAPTCHA_SITE_KEY (when bundled in Next.js app)\n */\n\nfunction getSiteKey(explicitSiteKey?: string): string | undefined {\n  if (typeof window === 'undefined') return undefined\n  if (explicitSiteKey) return explicitSiteKey\n  const win = window as any\n  return win.__SITE_KIT_RECAPTCHA_SITE_KEY__ ?? process.env.NEXT_PUBLIC_RECAPTCHA_SITE_KEY\n}\n\n/** Max time to wait for reCAPTCHA Enterprise to become usable before giving up. */\nconst RECAPTCHA_LOAD_TIMEOUT_MS = 10000\n\nfunction loadScript(siteKey: string): Promise<any> {\n  return new Promise((resolve) => {\n    if (typeof window === 'undefined') {\n      resolve(null)\n      return\n    }\n    const win = window as any\n    if (win.grecaptcha?.enterprise) {\n      resolve(win.grecaptcha)\n      return\n    }\n\n    // Never hang the form: if the script is blocked (ad-blocker), stalls, or\n    // never initializes `grecaptcha.enterprise`, resolve null after a timeout.\n    // The caller treats a null result as \"no token\" rather than waiting forever.\n    let settled = false\n    const finish = (value: any) => {\n      if (settled) return\n      settled = true\n      resolve(value)\n    }\n    const giveUp = setTimeout(() => finish(null), RECAPTCHA_LOAD_TIMEOUT_MS)\n\n    const waitForReady = () => {\n      if (settled) return\n      if (win.grecaptcha?.enterprise) {\n        clearTimeout(giveUp)\n        finish(win.grecaptcha)\n        return\n      }\n      setTimeout(waitForReady, 50)\n    }\n\n    const existing = document.querySelector('script[src*=\"recaptcha/enterprise\"]')\n    if (existing) {\n      waitForReady()\n      return\n    }\n\n    const script = document.createElement('script')\n    script.src = `https://www.google.com/recaptcha/enterprise.js?render=${siteKey}`\n    script.async = true\n    script.onload = () => waitForReady()\n    script.onerror = () => {\n      clearTimeout(giveUp)\n      finish(null)\n    }\n    document.head.appendChild(script)\n  })\n}\n\n/**\n * Get a reCAPTCHA Enterprise token for form submission.\n * Returns null if not configured or in SSR.\n */\nexport async function getRecaptchaToken(explicitSiteKey?: string): Promise<string | null> {\n  const siteKey = getSiteKey(explicitSiteKey)\n  if (!siteKey || typeof window === 'undefined') return null\n  try {\n    const grecaptcha = await loadScript(siteKey)\n    if (!grecaptcha?.enterprise?.execute) return null\n    // loadScript only waits for grecaptcha.enterprise to EXIST — execute()\n    // before enterprise.ready() rejects while the widget initializes (cold\n    // page load = every first-visit submitter). A swallowed rejection here\n    // means no token, and a requireRecaptcha project hard-rejects the lead.\n    await new Promise<void>((resolve) => grecaptcha.enterprise.ready(resolve))\n    const token = await grecaptcha.enterprise.execute(siteKey, { action: 'submit' })\n    return token || null\n  } catch (err) {\n    // One retry after a beat — first-execute flakes persist on slow devices\n    // even post-ready, and a dropped token is a dropped lead.\n    try {\n      await new Promise((resolve) => setTimeout(resolve, 800))\n      const win = window as any\n      const token = await win.grecaptcha.enterprise.execute(siteKey, { action: 'submit' })\n      return token || null\n    } catch (retryErr) {\n      console.warn('[site-kit reCAPTCHA]', retryErr)\n      return null\n    }\n  }\n}\n","/**\n * @sonordev/site-kit/forms - Shared submission logic\n *\n * Single source of truth for sending a managed form to the Sonor API. Both\n * <ManagedForm> (via FormClient) and the headless useForm() hook submit through\n * here, so the request shape, retry behaviour, reCAPTCHA handling, and error\n * parsing can never drift between the two paths.\n */\n\nimport { sonorFetch } from '../shared/sonorFetch'\nimport { getRecaptchaToken } from './recaptcha'\nimport { DEFAULT_HONEYPOT_FIELD } from './contract'\nimport type { ManagedFormConfig } from './types'\n\n// The honeypot trap-field name lives once in the shared forms contract\n// (single source of truth for site-kit's client + sonor-api's intake).\n// Re-exported so existing importers of this path keep resolving it.\nexport { DEFAULT_HONEYPOT_FIELD }\n\nexport function getApiConfig(): { apiUrl: string; apiKey: string | undefined } {\n  // Server branch must honor the same env override SiteKitLayout feeds into\n  // __SITE_KIT_API_URL__, or SSR-rendered absolute URLs (the native form\n  // action) would point at prod from a staging site.\n  const apiUrl =\n    typeof window !== 'undefined'\n      ? (window as any).__SITE_KIT_API_URL__ || 'https://api.sonor.io'\n      : process.env.SONOR_API_URL || process.env.NEXT_PUBLIC_SONOR_API_URL || 'https://api.sonor.io'\n  const apiKey =\n    typeof window !== 'undefined' ? (window as any).__SITE_KIT_API_KEY__ : undefined\n  return { apiUrl, apiKey }\n}\n\nfunction getUTMParams(): Record<string, string | null> {\n  if (typeof window === 'undefined') return {}\n  const params = new URLSearchParams(window.location.search)\n  const out: Record<string, string | null> = {}\n  for (const key of ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content']) {\n    out[key] = params.get(key)\n  }\n  return out\n}\n\nexport interface SubmitFormArgs {\n  config: ManagedFormConfig\n  /**\n   * Field values to submit. The caller must pass VISIBLE values only —\n   * conditionally-hidden fields should be excluded so stale values are not sent.\n   */\n  values: Record<string, unknown>\n  /** Honeypot input value (empty string for the headless hook, which has no honeypot UI). */\n  honeypotValue: string\n  /** Timestamp (ms) the form was first rendered — a weak anti-bot timing signal. */\n  formLoadedAt: number\n}\n\n/**\n * Submit a managed form. Throws on failure (network, timeout, or a non-2xx\n * response) with a human-readable message; resolves with the parsed API\n * response on success.\n */\nexport async function submitForm({\n  config,\n  values,\n  honeypotValue,\n  formLoadedAt,\n}: SubmitFormArgs): Promise<unknown> {\n  const { apiUrl, apiKey } = getApiConfig()\n  if (!apiKey) {\n    throw new Error('API key is required. Set SONOR_API_KEY in your environment.')\n  }\n\n  // reCAPTCHA token is fetched right before the POST so it cannot expire.\n  const recaptchaToken = config.recaptcha_enabled\n    ? await getRecaptchaToken(config.recaptcha_site_key)\n    : null\n  if (config.recaptcha_enabled && !recaptchaToken) {\n    throw new Error('Verification could not be completed. Please try again.')\n  }\n\n  const honeypotFieldName = config.honeypot_field || DEFAULT_HONEYPOT_FIELD\n  const utm = getUTMParams()\n\n  const payload = {\n    formId: config.id,\n    form_id: config.id,\n    data: {\n      ...values,\n      ...(config.honeypot_enabled ? { [honeypotFieldName]: honeypotValue } : {}),\n    },\n    metadata: {\n      pageUrl: typeof window !== 'undefined' ? window.location.href : null,\n      referrer: typeof document !== 'undefined' ? document.referrer || null : null,\n      userAgent: typeof navigator !== 'undefined' ? navigator.userAgent : null,\n      sessionId:\n        typeof sessionStorage !== 'undefined' ? sessionStorage.getItem('_sk_sid') : null,\n      // Anonymous visitor id (_sk_vid) — the same id Analytics/Signal stamp on\n      // page views, so the Sonor side can bind this lead to its browsing session\n      // (page -> lead attribution). Sent on every submission; null pre-hydration.\n      visitorId:\n        typeof localStorage !== 'undefined' ? localStorage.getItem('_sk_vid') : null,\n      recaptchaToken: recaptchaToken || undefined,\n      utmSource: utm.utm_source,\n      utmMedium: utm.utm_medium,\n      utmCampaign: utm.utm_campaign,\n      utmTerm: utm.utm_term,\n      utmContent: utm.utm_content,\n      // Sub-site host — preserved on form_submissions for lead attribution\n      // across multi-site projects. Resolved by SiteKitClientProviders.\n      site:\n        typeof window !== 'undefined'\n          ? (window as { __SITE_KIT_SITE__?: string }).__SITE_KIT_SITE__ ||\n            window.location.host\n          : undefined,\n      _formLoadedAt: formLoadedAt,\n    },\n  }\n\n  const response = await sonorFetch(\n    `${apiUrl}/api/public/forms/submit`,\n    {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${apiKey}`,\n      },\n      body: JSON.stringify(payload),\n    },\n    { retries: 2, timeoutMs: 20000 },\n  )\n\n  const data = await response.json().catch(() => null)\n\n  if (!response.ok) {\n    const msg = (\n      data?.message ??\n      data?.error ??\n      (response.statusText || `HTTP ${response.status}`)\n    )\n      .toString()\n      .trim()\n    throw new Error(\n      msg ? `Failed to submit form: ${msg}` : `Failed to submit form (${response.status})`,\n    )\n  }\n\n  return data\n}\n"]}
+{"version":3,"sources":["../src/forms/defaultSuccessMessage.ts","../src/forms/normalize-config.ts","../src/forms/recaptcha.ts","../src/forms/submitForm.ts"],"names":["DEFAULT_HONEYPOT_FIELD","sonorFetch"],"mappings":";;;;;;AACO,IAAM,4BAAA,GACX;;;ACiBK,SAAS,oBAAoB,IAAA,EAA8B;AAChE,EAAA,IAAI,KAAK,KAAA,EAAO;AACd,IAAA,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,EAAQ,CAAA,KAAA,CAAY,EAAE,WAAA,IAAe,CAAA,KAAM,CAAA,CAAE,WAAA,IAAe,CAAA,CAAE,CAAA;AAAA,EACjF;AACA,EAAA,IAAI,KAAK,MAAA,EAAQ;AACf,IAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,EAAQ,CAAA,KAAA,CAAY,EAAE,UAAA,IAAc,CAAA,KAAM,CAAA,CAAE,UAAA,IAAc,CAAA,CAAE,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,EAAO,MAAA,IAAU,CAAA;AAC1C,EAAA,MAAM,gBAAgB,WAAA,GAAc,CAAA;AAEpC,EAAA,MAAM,UAAA,GACJ,OAAO,IAAA,CAAK,eAAA,KAAoB,WAAW,IAAA,CAAK,eAAA,CAAgB,MAAK,GAAI,EAAA;AAC3E,EAAA,MAAM,eAAA,GACJ,UAAA,KACC,OAAQ,IAAA,CAAqC,cAAA,KAAmB,QAAA,GAC7D,MAAA,CAAQ,IAAA,CAAqC,cAAc,CAAA,CAAE,IAAA,EAAK,GAClE,EAAA,CAAA,IACJ,4BAAA;AAEF,EAAA,OAAO;AAAA,IACL,GAAG,IAAA;AAAA,IACH,eAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF;AACF;;;ACrCA,SAAS,WAAW,eAAA,EAA8C;AAChE,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,MAAA;AAC1C,EAAA,IAAI,iBAAiB,OAAO,eAAA;AAC5B,EAAA,MAAM,GAAA,GAAM,MAAA;AACZ,EAAA,OAAO,GAAA,CAAI,+BAAA,IAAmC,OAAA,CAAQ,GAAA,CAAI,8BAAA;AAC5D;AAGA,IAAM,yBAAA,GAA4B,GAAA;AAElC,SAAS,WAAW,OAAA,EAA+B;AACjD,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC9B,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,MAAA;AACZ,IAAA,IAAI,GAAA,CAAI,YAAY,UAAA,EAAY;AAC9B,MAAA,OAAA,CAAQ,IAAI,UAAU,CAAA;AACtB,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,MAAM,MAAA,GAAS,CAAC,KAAA,KAAe;AAC7B,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,IACf,CAAA;AACA,IAAA,MAAM,SAAS,UAAA,CAAW,MAAM,MAAA,CAAO,IAAI,GAAG,yBAAyB,CAAA;AAEvE,IAAA,MAAM,eAAe,MAAM;AACzB,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,IAAI,GAAA,CAAI,YAAY,UAAA,EAAY;AAC9B,QAAA,YAAA,CAAa,MAAM,CAAA;AACnB,QAAA,MAAA,CAAO,IAAI,UAAU,CAAA;AACrB,QAAA;AAAA,MACF;AACA,MAAA,UAAA,CAAW,cAAc,EAAE,CAAA;AAAA,IAC7B,CAAA;AAEA,IAAA,MAAM,QAAA,GAAW,QAAA,CAAS,aAAA,CAAc,qCAAqC,CAAA;AAC7E,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,YAAA,EAAa;AACb,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,IAAA,MAAA,CAAO,GAAA,GAAM,yDAAyD,OAAO,CAAA,CAAA;AAC7E,IAAA,MAAA,CAAO,KAAA,GAAQ,IAAA;AACf,IAAA,MAAA,CAAO,MAAA,GAAS,MAAM,YAAA,EAAa;AACnC,IAAA,MAAA,CAAO,UAAU,MAAM;AACrB,MAAA,YAAA,CAAa,MAAM,CAAA;AACnB,MAAA,MAAA,CAAO,IAAI,CAAA;AAAA,IACb,CAAA;AACA,IAAA,QAAA,CAAS,IAAA,CAAK,YAAY,MAAM,CAAA;AAAA,EAClC,CAAC,CAAA;AACH;AAMA,eAAsB,kBAAkB,eAAA,EAAkD;AACxF,EAAA,MAAM,OAAA,GAAU,WAAW,eAAe,CAAA;AAC1C,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,MAAA,KAAW,aAAa,OAAO,IAAA;AACtD,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,MAAM,UAAA,CAAW,OAAO,CAAA;AAC3C,IAAA,IAAI,CAAC,UAAA,EAAY,UAAA,EAAY,OAAA,EAAS,OAAO,IAAA;AAK7C,IAAA,MAAM,IAAI,QAAc,CAAC,OAAA,KAAY,WAAW,UAAA,CAAW,KAAA,CAAM,OAAO,CAAC,CAAA;AACzE,IAAA,MAAM,KAAA,GAAQ,MAAM,UAAA,CAAW,UAAA,CAAW,QAAQ,OAAA,EAAS,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AAC/E,IAAA,OAAO,KAAA,IAAS,IAAA;AAAA,EAClB,SAAS,GAAA,EAAK;AAGZ,IAAA,IAAI;AACF,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,GAAG,CAAC,CAAA;AACvD,MAAA,MAAM,GAAA,GAAM,MAAA;AACZ,MAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,UAAA,CAAW,UAAA,CAAW,QAAQ,OAAA,EAAS,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AACnF,MAAA,OAAO,KAAA,IAAS,IAAA;AAAA,IAClB,SAAS,QAAA,EAAU;AACjB,MAAA,OAAA,CAAQ,IAAA,CAAK,wBAAwB,QAAQ,CAAA;AAC7C,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACF;;;AChFO,SAAS,YAAA,GAA+D;AAI7E,EAAA,MAAM,MAAA,GACJ,OAAO,MAAA,KAAW,WAAA,GACb,MAAA,CAAe,oBAAA,IAAwB,sBAAA,GACxC,OAAA,CAAQ,GAAA,CAAI,aAAA,IAAiB,OAAA,CAAQ,GAAA,CAAI,yBAAA,IAA6B,sBAAA;AAC5E,EAAA,MAAM,MAAA,GACJ,OAAO,MAAA,KAAW,WAAA,GAAe,OAAe,oBAAA,GAAuB,MAAA;AACzE,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC1B;AAEA,SAAS,YAAA,GAA8C;AACrD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,EAAC;AAC3C,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAA,CAAO,SAAS,MAAM,CAAA;AACzD,EAAA,MAAM,MAAqC,EAAC;AAC5C,EAAA,KAAA,MAAW,OAAO,CAAC,YAAA,EAAc,cAAc,cAAA,EAAgB,UAAA,EAAY,aAAa,CAAA,EAAG;AACzF,IAAA,GAAA,CAAI,GAAG,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAAA,EAC3B;AACA,EAAA,OAAO,GAAA;AACT;AAoBA,eAAsB,UAAA,CAAW;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA,EAAqC;AACnC,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,YAAA,EAAa;AACxC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,MAAM,6DAA6D,CAAA;AAAA,EAC/E;AAGA,EAAA,MAAM,iBAAiB,MAAA,CAAO,iBAAA,GAC1B,MAAM,iBAAA,CAAkB,MAAA,CAAO,kBAAkB,CAAA,GACjD,IAAA;AACJ,EAAA,IAAI,MAAA,CAAO,iBAAA,IAAqB,CAAC,cAAA,EAAgB;AAC/C,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC1E;AAEA,EAAA,MAAM,iBAAA,GAAoB,OAAO,cAAA,IAAkBA,uCAAA;AACnD,EAAA,MAAM,MAAM,YAAA,EAAa;AAEzB,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,QAAQ,MAAA,CAAO,EAAA;AAAA,IACf,SAAS,MAAA,CAAO,EAAA;AAAA,IAChB,IAAA,EAAM;AAAA,MACJ,GAAG,MAAA;AAAA,MACH,GAAI,OAAO,gBAAA,GAAmB,EAAE,CAAC,iBAAiB,GAAG,aAAA,EAAc,GAAI;AAAC,KAC1E;AAAA,IACA,QAAA,EAAU;AAAA,MACR,SAAS,OAAO,MAAA,KAAW,WAAA,GAAc,MAAA,CAAO,SAAS,IAAA,GAAO,IAAA;AAAA,MAChE,UAAU,OAAO,QAAA,KAAa,WAAA,GAAc,QAAA,CAAS,YAAY,IAAA,GAAO,IAAA;AAAA,MACxE,SAAA,EAAW,OAAO,SAAA,KAAc,WAAA,GAAc,UAAU,SAAA,GAAY,IAAA;AAAA,MACpE,WACE,OAAO,cAAA,KAAmB,cAAc,cAAA,CAAe,OAAA,CAAQ,SAAS,CAAA,GAAI,IAAA;AAAA;AAAA;AAAA;AAAA,MAI9E,WACE,OAAO,YAAA,KAAiB,cAAc,YAAA,CAAa,OAAA,CAAQ,SAAS,CAAA,GAAI,IAAA;AAAA,MAC1E,gBAAgB,cAAA,IAAkB,MAAA;AAAA,MAClC,WAAW,GAAA,CAAI,UAAA;AAAA,MACf,WAAW,GAAA,CAAI,UAAA;AAAA,MACf,aAAa,GAAA,CAAI,YAAA;AAAA,MACjB,SAAS,GAAA,CAAI,QAAA;AAAA,MACb,YAAY,GAAA,CAAI,WAAA;AAAA;AAAA;AAAA,MAGhB,IAAA,EACE,OAAO,MAAA,KAAW,WAAA,GACb,OAA0C,iBAAA,IAC3C,MAAA,CAAO,SAAS,IAAA,GAChB,MAAA;AAAA,MACN,aAAA,EAAe;AAAA;AACjB,GACF;AAEA,EAAA,MAAM,WAAW,MAAMC,2BAAA;AAAA,IACrB,GAAG,MAAM,CAAA,wBAAA,CAAA;AAAA,IACT;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,aAAA,EAAe,UAAU,MAAM,CAAA;AAAA,OACjC;AAAA,MACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAO;AAAA,KAC9B;AAAA,IACA,EAAE,OAAA,EAAS,CAAA,EAAG,SAAA,EAAW,GAAA;AAAM,GACjC;AAEA,EAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAEnD,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,GAAA,GAAA,CACJ,IAAA,EAAM,OAAA,IACN,IAAA,EAAM,KAAA,KACL,QAAA,CAAS,UAAA,IAAc,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA,CAAA,EAE9C,QAAA,GACA,IAAA,EAAK;AACR,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,MAAM,CAAA,uBAAA,EAA0B,GAAG,CAAA,CAAA,GAAK,CAAA,uBAAA,EAA0B,SAAS,MAAM,CAAA,CAAA;AAAA,KACnF;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT","file":"chunk-QIJIOKNT.js","sourcesContent":["/** Shown when the API omits or returns an empty `success_message`. */\nexport const DEFAULT_FORM_SUCCESS_MESSAGE =\n  'Thank you for your submission! We will be in touch soon.'\n","/**\n * Shared form-config normalizer — the ONE place a raw\n * /api/public/forms/config payload becomes a ManagedFormConfig.\n *\n * Deliberately has no `'use client'` directive and no hooks, so it is usable\n * from a Server Component (StaticForm) as well as from useForm's client\n * fetch. Both the server shell and the hydrated enhancement must agree on\n * field order, step count and success copy or the swap visibly jumps, so\n * there must never be a second copy of this.\n */\n\nimport type { ManagedFormConfig } from './types'\nimport { DEFAULT_FORM_SUCCESS_MESSAGE } from './defaultSuccessMessage'\n\n/**\n * Normalize a raw /api/public/forms/config payload into ManagedFormConfig.\n * Single source of truth — used for both the client fetch and server-provided\n * `initialForm`, so the two paths can never drift.\n */\nexport function normalizeFormConfig(data: any): ManagedFormConfig {\n  if (data.steps) {\n    data.steps.sort((a: any, b: any) => (a.step_number || 0) - (b.step_number || 0))\n  }\n  if (data.fields) {\n    data.fields.sort((a: any, b: any) => (a.sort_order || 0) - (b.sort_order || 0))\n  }\n\n  const total_steps = data.steps?.length || 1\n  const is_multi_step = total_steps > 1\n\n  const apiSuccess =\n    typeof data.success_message === 'string' ? data.success_message.trim() : ''\n  const success_message =\n    apiSuccess ||\n    (typeof (data as { successMessage?: string }).successMessage === 'string'\n      ? String((data as { successMessage?: string }).successMessage).trim()\n      : '') ||\n    DEFAULT_FORM_SUCCESS_MESSAGE\n\n  return {\n    ...data,\n    success_message,\n    total_steps,\n    is_multi_step,\n  }\n}\n","/**\n * reCAPTCHA Enterprise - Client-side token generation for site-kit forms\n *\n * Site key is read from:\n * - window.__SITE_KIT_RECAPTCHA_SITE_KEY__ (set by SiteKitLayout)\n * - process.env.NEXT_PUBLIC_RECAPTCHA_SITE_KEY (when bundled in Next.js app)\n */\n\nfunction getSiteKey(explicitSiteKey?: string): string | undefined {\n  if (typeof window === 'undefined') return undefined\n  if (explicitSiteKey) return explicitSiteKey\n  const win = window as any\n  return win.__SITE_KIT_RECAPTCHA_SITE_KEY__ ?? process.env.NEXT_PUBLIC_RECAPTCHA_SITE_KEY\n}\n\n/** Max time to wait for reCAPTCHA Enterprise to become usable before giving up. */\nconst RECAPTCHA_LOAD_TIMEOUT_MS = 10000\n\nfunction loadScript(siteKey: string): Promise<any> {\n  return new Promise((resolve) => {\n    if (typeof window === 'undefined') {\n      resolve(null)\n      return\n    }\n    const win = window as any\n    if (win.grecaptcha?.enterprise) {\n      resolve(win.grecaptcha)\n      return\n    }\n\n    // Never hang the form: if the script is blocked (ad-blocker), stalls, or\n    // never initializes `grecaptcha.enterprise`, resolve null after a timeout.\n    // The caller treats a null result as \"no token\" rather than waiting forever.\n    let settled = false\n    const finish = (value: any) => {\n      if (settled) return\n      settled = true\n      resolve(value)\n    }\n    const giveUp = setTimeout(() => finish(null), RECAPTCHA_LOAD_TIMEOUT_MS)\n\n    const waitForReady = () => {\n      if (settled) return\n      if (win.grecaptcha?.enterprise) {\n        clearTimeout(giveUp)\n        finish(win.grecaptcha)\n        return\n      }\n      setTimeout(waitForReady, 50)\n    }\n\n    const existing = document.querySelector('script[src*=\"recaptcha/enterprise\"]')\n    if (existing) {\n      waitForReady()\n      return\n    }\n\n    const script = document.createElement('script')\n    script.src = `https://www.google.com/recaptcha/enterprise.js?render=${siteKey}`\n    script.async = true\n    script.onload = () => waitForReady()\n    script.onerror = () => {\n      clearTimeout(giveUp)\n      finish(null)\n    }\n    document.head.appendChild(script)\n  })\n}\n\n/**\n * Get a reCAPTCHA Enterprise token for form submission.\n * Returns null if not configured or in SSR.\n */\nexport async function getRecaptchaToken(explicitSiteKey?: string): Promise<string | null> {\n  const siteKey = getSiteKey(explicitSiteKey)\n  if (!siteKey || typeof window === 'undefined') return null\n  try {\n    const grecaptcha = await loadScript(siteKey)\n    if (!grecaptcha?.enterprise?.execute) return null\n    // loadScript only waits for grecaptcha.enterprise to EXIST — execute()\n    // before enterprise.ready() rejects while the widget initializes (cold\n    // page load = every first-visit submitter). A swallowed rejection here\n    // means no token, and a requireRecaptcha project hard-rejects the lead.\n    await new Promise<void>((resolve) => grecaptcha.enterprise.ready(resolve))\n    const token = await grecaptcha.enterprise.execute(siteKey, { action: 'submit' })\n    return token || null\n  } catch (err) {\n    // One retry after a beat — first-execute flakes persist on slow devices\n    // even post-ready, and a dropped token is a dropped lead.\n    try {\n      await new Promise((resolve) => setTimeout(resolve, 800))\n      const win = window as any\n      const token = await win.grecaptcha.enterprise.execute(siteKey, { action: 'submit' })\n      return token || null\n    } catch (retryErr) {\n      console.warn('[site-kit reCAPTCHA]', retryErr)\n      return null\n    }\n  }\n}\n","/**\n * @sonordev/site-kit/forms - Shared submission logic\n *\n * Single source of truth for sending a managed form to the Sonor API. Both\n * <ManagedForm> (via FormClient) and the headless useForm() hook submit through\n * here, so the request shape, retry behaviour, reCAPTCHA handling, and error\n * parsing can never drift between the two paths.\n */\n\nimport { sonorFetch } from '../shared/sonorFetch'\nimport { getRecaptchaToken } from './recaptcha'\nimport { DEFAULT_HONEYPOT_FIELD } from './contract'\nimport type { ManagedFormConfig } from './types'\n\n// The honeypot trap-field name lives once in the shared forms contract\n// (single source of truth for site-kit's client + sonor-api's intake).\n// Re-exported so existing importers of this path keep resolving it.\nexport { DEFAULT_HONEYPOT_FIELD }\n\nexport function getApiConfig(): { apiUrl: string; apiKey: string | undefined } {\n  // Server branch must honor the same env override SiteKitLayout feeds into\n  // __SITE_KIT_API_URL__, or SSR-rendered absolute URLs (the native form\n  // action) would point at prod from a staging site.\n  const apiUrl =\n    typeof window !== 'undefined'\n      ? (window as any).__SITE_KIT_API_URL__ || 'https://api.sonor.io'\n      : process.env.SONOR_API_URL || process.env.NEXT_PUBLIC_SONOR_API_URL || 'https://api.sonor.io'\n  const apiKey =\n    typeof window !== 'undefined' ? (window as any).__SITE_KIT_API_KEY__ : undefined\n  return { apiUrl, apiKey }\n}\n\nfunction getUTMParams(): Record<string, string | null> {\n  if (typeof window === 'undefined') return {}\n  const params = new URLSearchParams(window.location.search)\n  const out: Record<string, string | null> = {}\n  for (const key of ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content']) {\n    out[key] = params.get(key)\n  }\n  return out\n}\n\nexport interface SubmitFormArgs {\n  config: ManagedFormConfig\n  /**\n   * Field values to submit. The caller must pass VISIBLE values only —\n   * conditionally-hidden fields should be excluded so stale values are not sent.\n   */\n  values: Record<string, unknown>\n  /** Honeypot input value (empty string for the headless hook, which has no honeypot UI). */\n  honeypotValue: string\n  /** Timestamp (ms) the form was first rendered — a weak anti-bot timing signal. */\n  formLoadedAt: number\n}\n\n/**\n * Submit a managed form. Throws on failure (network, timeout, or a non-2xx\n * response) with a human-readable message; resolves with the parsed API\n * response on success.\n */\nexport async function submitForm({\n  config,\n  values,\n  honeypotValue,\n  formLoadedAt,\n}: SubmitFormArgs): Promise<unknown> {\n  const { apiUrl, apiKey } = getApiConfig()\n  if (!apiKey) {\n    throw new Error('API key is required. Set SONOR_API_KEY in your environment.')\n  }\n\n  // reCAPTCHA token is fetched right before the POST so it cannot expire.\n  const recaptchaToken = config.recaptcha_enabled\n    ? await getRecaptchaToken(config.recaptcha_site_key)\n    : null\n  if (config.recaptcha_enabled && !recaptchaToken) {\n    throw new Error('Verification could not be completed. Please try again.')\n  }\n\n  const honeypotFieldName = config.honeypot_field || DEFAULT_HONEYPOT_FIELD\n  const utm = getUTMParams()\n\n  const payload = {\n    formId: config.id,\n    form_id: config.id,\n    data: {\n      ...values,\n      ...(config.honeypot_enabled ? { [honeypotFieldName]: honeypotValue } : {}),\n    },\n    metadata: {\n      pageUrl: typeof window !== 'undefined' ? window.location.href : null,\n      referrer: typeof document !== 'undefined' ? document.referrer || null : null,\n      userAgent: typeof navigator !== 'undefined' ? navigator.userAgent : null,\n      sessionId:\n        typeof sessionStorage !== 'undefined' ? sessionStorage.getItem('_sk_sid') : null,\n      // Anonymous visitor id (_sk_vid) — the same id Analytics/Signal stamp on\n      // page views, so the Sonor side can bind this lead to its browsing session\n      // (page -> lead attribution). Sent on every submission; null pre-hydration.\n      visitorId:\n        typeof localStorage !== 'undefined' ? localStorage.getItem('_sk_vid') : null,\n      recaptchaToken: recaptchaToken || undefined,\n      utmSource: utm.utm_source,\n      utmMedium: utm.utm_medium,\n      utmCampaign: utm.utm_campaign,\n      utmTerm: utm.utm_term,\n      utmContent: utm.utm_content,\n      // Sub-site host — preserved on form_submissions for lead attribution\n      // across multi-site projects. Resolved by SiteKitClientProviders.\n      site:\n        typeof window !== 'undefined'\n          ? (window as { __SITE_KIT_SITE__?: string }).__SITE_KIT_SITE__ ||\n            window.location.host\n          : undefined,\n      _formLoadedAt: formLoadedAt,\n    },\n  }\n\n  const response = await sonorFetch(\n    `${apiUrl}/api/public/forms/submit`,\n    {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${apiKey}`,\n      },\n      body: JSON.stringify(payload),\n    },\n    { retries: 2, timeoutMs: 20000 },\n  )\n\n  const data = await response.json().catch(() => null)\n\n  if (!response.ok) {\n    const msg = (\n      data?.message ??\n      data?.error ??\n      (response.statusText || `HTTP ${response.status}`)\n    )\n      .toString()\n      .trim()\n    throw new Error(\n      msg ? `Failed to submit form: ${msg}` : `Failed to submit form (${response.status})`,\n    )\n  }\n\n  return data\n}\n"]}

package/dist/{chunk-QEHPIQYN.mjs → chunk-RJBW2JFO.mjs}

@@ -1,6 +1,6 @@
 'use client';
 import { locToPath, isMalformedSitemapPath, inferPageType } from './chunk-QJU6HBSK.mjs';
-import { sonorFetch } from './chunk-5PBJ42NC.mjs';
+import { sonorFetch } from './chunk-AVFXLKIP.mjs';
 import { useRef, useEffect } from 'react';
 
 var SYNC_STAMP_KEY = "_sk_sitemap_synced_at";
@@ -190,5 +190,5 @@ function SitemapSync({
 }
 
 export { SitemapSync };
-//# sourceMappingURL=chunk-QEHPIQYN.mjs.map
-//# sourceMappingURL=chunk-QEHPIQYN.mjs.map
+//# sourceMappingURL=chunk-RJBW2JFO.mjs.map
+//# sourceMappingURL=chunk-RJBW2JFO.mjs.map

package/dist/{chunk-QEHPIQYN.mjs.map → chunk-RJBW2JFO.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/SitemapSync.tsx"],"names":[],"mappings":";;;;AAuDA,IAAM,cAAA,GAAiB,uBAAA;AACvB,IAAM,aAAA,GAAgB,kBAAA;AAEtB,SAAS,iBAAiB,eAAA,EAAkC;AAC1D,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,OAAA,CAAQ,cAAc,CAAA;AACnD,IAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,IAAA,MAAM,UAAU,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,CAAS,OAAO,EAAE,CAAA;AAC/C,IAAA,OAAO,OAAA,IAAW,CAAA,IAAK,OAAA,GAAU,eAAA,GAAkB,EAAA,GAAK,GAAA;AAAA,EAC1D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAA,GAAoB;AAC3B,EAAA,IAAI;AACF,IAAA,cAAA,CAAe,QAAQ,cAAA,EAAgB,IAAA,CAAK,GAAA,EAAI,CAAE,UAAU,CAAA;AAAA,EAC9D,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AASA,SAAS,WAAA,CAAY,YAAoB,OAAA,EAAiC;AACxE,EAAA,MAAM,IAAA,GAAO,QACV,GAAA,CAAI,CAAA,CAAA,KAAK,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAA,IAAW,EAAE,IAAI,CAAA,CAAE,UAAA,IAAc,EAAE,CAAA,CAAA,EAAI,CAAA,CAAE,YAAY,EAAE,CAAA,CAAE,CAAA,CACjF,IAAA,CAAK,IAAI,CAAA;AACZ,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,QAAQ,CAAA,EAAA,EAAK;AACpC,IAAA,IAAA,GAAA,CAAS,QAAQ,CAAA,IAAK,IAAA,GAAO,IAAA,CAAK,UAAA,CAAW,CAAC,CAAA,GAAK,CAAA;AAAA,EACrD;AACA,EAAA,OAAO,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,OAAA,CAAQ,MAAM,CAAA,CAAA,EAAI,IAAA,CAAK,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA;AAC7D;AAEA,SAAS,oBAAoB,IAAA,EAAuB;AAClD,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,OAAA,CAAQ,aAAa,CAAA,KAAM,IAAA;AAAA,EACjD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB,IAAA,EAAoB;AAC3C,EAAA,IAAI;AACF,IAAA,YAAA,CAAa,OAAA,CAAQ,eAAe,IAAI,CAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,YAAA,GAAe;AACtB,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,EAAE,QAAQ,EAAA,EAAI,MAAA,EAAQ,EAAA,EAAI,IAAA,EAAM,EAAA,EAAG;AAE7E,EAAA,MAAM,MAAA,GAAU,OAAe,oBAAA,IAAwB,sBAAA;AACvD,EAAA,MAAM,MAAA,GAAU,OAAe,oBAAA,IAAwB,EAAA;AAKvD,EAAA,MAAM,IAAA,GAAQ,MAAA,CAAe,iBAAA,IAAqB,MAAA,CAAO,SAAS,IAAA,IAAQ,EAAA;AAC1E,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAK;AAChC;AAEA,eAAe,YAAA,CAAa,YAAoB,KAAA,EAAyC;AACvF,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAM,UAAA,CAAW,UAAU,CAAA;AAC5C,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,wCAAA,EAA0C,SAAS,MAAM,CAAA;AACjF,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,MAAM,MAAA,GAAS,IAAI,SAAA,EAAU;AAC7B,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,eAAA,CAAgB,IAAA,EAAM,iBAAiB,CAAA;AAE1D,IAAA,MAAM,UAAA,GAAa,GAAA,CAAI,aAAA,CAAc,aAAa,CAAA;AAClD,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,oCAAA,EAAsC,WAAW,WAAW,CAAA;AACpF,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,gBAAA,CAAiB,KAAK,CAAA;AACvC,IAAA,MAAM,UAA0B,EAAC;AAEjC,IAAA,IAAA,CAAK,QAAQ,CAAA,GAAA,KAAO;AAClB,MAAA,MAAM,MAAM,GAAA,CAAI,aAAA,CAAc,KAAK,CAAA,EAAG,aAAa,IAAA,EAAK;AACxD,MAAA,IAAI,CAAC,GAAA,EAAK;AAEV,MAAA,MAAM,IAAA,GAAO,UAAU,GAAG,CAAA;AAG1B,MAAA,IAAI,sBAAA,CAAuB,IAAI,CAAA,EAAG;AAChC,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,CAAA,uCAAA,EAA0C,IAAI,CAAA,CAAE,CAAA;AACxE,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,GAAA,CAAI,aAAA,CAAc,SAAS,GAAG,WAAA,IAAe,KAAA,CAAA;AAC7D,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,aAAA,CAAc,YAAY,GAAG,WAAA,IAAe,KAAA,CAAA;AACnE,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,aAAA,CAAc,UAAU,CAAA,EAAG,WAAA;AACnD,MAAA,MAAM,QAAA,GAAW,WAAA,GAAc,UAAA,CAAW,WAAW,CAAA,GAAI,KAAA,CAAA;AAEzD,MAAA,OAAA,CAAQ,KAAK,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,UAAU,CAAA;AAAA,IACtD,CAAC,CAAA;AAED,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,qBAAA,EAAwB,OAAA,CAAQ,MAAM,CAAA,qBAAA,CAAuB,CAAA;AAAA,IAC3E;AAEA,IAAA,OAAO,OAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,sCAAA,EAAwC,KAAK,CAAA;AACtE,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAEA,eAAe,aACb,OAAA,EACA,MAAA,EACA,QACA,IAAA,EACA,KAAA,EACA,OAAoC,UAAA,EAC6B;AACjE,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,qCAAqC,CAAA;AAC7D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AAEA,EAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,kCAAkC,CAAA;AACzD,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EACjD;AAEA,EAAA,IAAI;AAGF,IAAA,MAAM,QAAA,GAAW,MAAM,UAAA,CAAW,CAAA,EAAG,MAAM,CAAA,gCAAA,CAAA,EAAoC;AAAA,MAC7E,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB;AAAA,OAClB;AAAA,MACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,OAAA,EAAS,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,MAAM;AAAA,UACzB,MAAM,CAAA,CAAE,IAAA;AAAA,UACR,UAAU,CAAA,CAAE,QAAA;AAAA,UACZ,YAAY,CAAA,CAAE,UAAA;AAAA,UACd,QAAA,EAAU,aAAA,CAAc,CAAA,CAAE,IAAI;AAAA,SAChC,CAAE,CAAA;AAAA,QACF,IAAA;AAAA;AAAA;AAAA;AAAA,QAIA,GAAI,IAAA,GAAO,EAAE,IAAA,KAAS;AAAC,OACxB;AAAA,KACH,EAAG,EAAE,MAAA,EAAQ,CAAA;AAEb,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,IAAI,OAAO,OAAA,CAAQ,KAAA,CAAM,4BAA4B,QAAA,CAAS,MAAA,EAAQ,SAAS,UAAU,CAAA;AACzF,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,IAClD;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AAEnC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,IAAI,CAAA,sBAAA,EAAyB,MAAA,CAAO,OAAO,CAAA,UAAA,EAAa,MAAA,CAAO,OAAO,CAAA,QAAA,CAAU,CAAA;AAAA,IAC1F;AAEA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAA;AAAA,MACT,OAAA,EAAS,OAAO,OAAA,IAAW,CAAA;AAAA,MAC3B,OAAA,EAAS,OAAO,OAAA,IAAW;AAAA,KAC7B;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,2BAAA,EAA6B,KAAK,CAAA;AAC3D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AACF;AAEO,SAAS,WAAA,CAAY;AAAA,EAC1B,UAAA,GAAa,cAAA;AAAA,EACb,YAAA,GAAe,EAAA;AAAA,EACf,KAAA,GAAQ,KAAA;AAAA,EACR,IAAA,GAAO;AACT,CAAA,EAAqB;AACnB,EAAA,MAAM,YAAA,GAAe,OAAO,KAAK,CAAA;AACjC,EAAA,MAAM,WAAA,GAAc,OAA8C,IAAI,CAAA;AAEtE,EAAA,SAAA,CAAU,MAAM;AAMd,IAAA,MAAM,aAAA,GAA6C,UAAA;AAInD,IAAA,MAAM,eAAA,GAAkB,YAAA,GAAe,CAAA,GAAI,YAAA,GAAe,EAAA;AAE1D,IAAA,MAAM,SAAS,YAAY;AACzB,MAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,KAAS,YAAA,EAAa;AAE9C,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,gCAAgC,CAAA;AACxD,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,gBAAA,CAAiB,eAAe,CAAA,EAAG;AACrC,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,qDAAA,EAAkD,iBAAiB,kBAAkB,CAAA;AAC5G,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,KAAA,UAAe,GAAA,CAAI,wCAAA,EAA0C,OAAO,CAAA,OAAA,EAAU,IAAI,MAAM,EAAE,CAAA;AAE9F,MAAA,MAAM,OAAA,GAAU,MAAM,YAAA,CAAa,UAAA,EAAY,KAAK,CAAA;AAEpD,MAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,UAAA,EAAY,OAAO,CAAA;AAC5C,QAAA,IAAI,mBAAA,CAAoB,IAAI,CAAA,EAAG;AAI7B,UAAA,WAAA,EAAY;AACZ,UAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,gFAA2E,CAAA;AAClG,UAAA;AAAA,QACF;AACA,QAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,OAAA,EAAS,QAAQ,MAAA,EAAQ,IAAA,EAAM,OAAO,aAAa,CAAA;AACrF,QAAA,IAAI,OAAO,OAAA,EAAS;AAClB,UAAA,WAAA,EAAY;AACZ,UAAA,eAAA,CAAgB,IAAI,CAAA;AAAA,QACtB;AAAA,MACF;AAAA,IACF,CAAA;AAEA,IAAA,IAAI,CAAC,aAAa,OAAA,EAAS;AACzB,MAAA,YAAA,CAAa,OAAA,GAAU,IAAA;AACvB,MAAA,MAAA,EAAO;AAAA,IACT;AAEA,IAAA,IAAI,eAAe,CAAA,EAAG;AACpB,MAAA,WAAA,CAAY,OAAA,GAAU,WAAA,CAAY,MAAA,EAAQ,YAAA,GAAe,KAAK,GAAI,CAAA;AAAA,IACpE;AAEA,IAAA,OAAO,MAAM;AACX,MAAA,IAAI,YAAY,OAAA,EAAS;AACvB,QAAA,aAAA,CAAc,YAAY,OAAO,CAAA;AAAA,MACnC;AAAA,IACF,CAAA;AAAA,EACF,GAAG,CAAC,UAAA,EAAY,YAAA,EAAc,KAAA,EAAO,IAAI,CAAC,CAAA;AAE1C,EAAA,OAAO,IAAA;AACT","file":"chunk-QEHPIQYN.mjs","sourcesContent":["/**\n * SitemapSync - Automatically sync sitemap.xml to Portal API\n *\n * Client-only component. Lives at package root so the main entry does not\n * pull in seo/ (and server-only code). For use in SiteKitLayout and\n * from @sonordev/site-kit/seo.\n *\n * @example\n * ```tsx\n * import { SitemapSync } from '@sonordev/site-kit'\n * // or\n * import { SitemapSync } from '@sonordev/site-kit/seo'\n * ```\n */\n\n'use client'\n\nimport { useEffect, useRef } from 'react'\nimport { sonorFetch } from './shared/sonorFetch'\n// Single source of truth for page-type inference + path normalization, shared\n// with createSitemap (build) and the register-sitemap CLI. Pure string logic,\n// safe in the browser.\nimport { inferPageType, locToPath, isMalformedSitemapPath } from './sitemap/shared'\n\ninterface SitemapSyncProps {\n  /** Custom sitemap URL (defaults to /sitemap.xml) */\n  sitemapUrl?: string\n  /** How often to re-sync in minutes (0 = only on mount, default: 60) */\n  syncInterval?: number\n  /** Enable debug logging */\n  debug?: boolean\n  /**\n   * Sync mode:\n   * - 'additive' (default for runtime): adds/updates pages but never deletes existing ones\n   * - 'full-replace': replaces the entire page set (use only for build-time sync via createSitemap)\n   */\n  mode?: 'additive' | 'full-replace'\n}\n\ninterface SitemapEntry {\n  path: string\n  lastmod?: string\n  changefreq?: string\n  priority?: number\n  pageType?: string\n}\n\n/**\n * Per-browser-session sync throttle. Build-time sync (createSitemap) is the\n * canonical source of truth; runtime SitemapSync is only a safety net — so\n * re-registering the sitemap on every full page load of every visitor is pure\n * waste (fetch + DOMParser on the visitor's main thread, plus a write per\n * pageview against the API). Stamp the last successful sync in sessionStorage\n * and skip while inside the throttle window.\n */\nconst SYNC_STAMP_KEY = '_sk_sitemap_synced_at'\nconst SYNC_HASH_KEY = '_sk_sitemap_hash'\n\nfunction isRecentlySynced(throttleMinutes: number): boolean {\n  try {\n    const stamp = sessionStorage.getItem(SYNC_STAMP_KEY)\n    if (!stamp) return false\n    const elapsed = Date.now() - parseInt(stamp, 10)\n    return elapsed >= 0 && elapsed < throttleMinutes * 60 * 1000\n  } catch {\n    return false // storage unavailable (private mode) — sync as before\n  }\n}\n\nfunction stampSynced(): void {\n  try {\n    sessionStorage.setItem(SYNC_STAMP_KEY, Date.now().toString())\n  } catch {\n    /* storage unavailable — throttle simply won't apply */\n  }\n}\n\n/**\n * Content-hash guard (localStorage, so it survives across sessions): the\n * sitemap of a static site only changes at deploy, so once ONE sync of a given\n * sitemap succeeded from this browser, re-POSTing the identical entry set is\n * pure API load. Hash the parsed entries; skip the POST when unchanged.\n * Keyed by sitemap URL so multiple SitemapSync instances don't collide.\n */\nfunction hashEntries(sitemapUrl: string, entries: SitemapEntry[]): string {\n  const text = entries\n    .map(e => `${e.path}|${e.lastmod ?? ''}|${e.changefreq ?? ''}|${e.priority ?? ''}`)\n    .join('\\n')\n  let hash = 0\n  for (let i = 0; i < text.length; i++) {\n    hash = ((hash << 5) - hash + text.charCodeAt(i)) | 0\n  }\n  return `${sitemapUrl}:${entries.length}:${hash.toString(16)}`\n}\n\nfunction isAlreadySyncedHash(hash: string): boolean {\n  try {\n    return localStorage.getItem(SYNC_HASH_KEY) === hash\n  } catch {\n    return false\n  }\n}\n\nfunction storeSyncedHash(hash: string): void {\n  try {\n    localStorage.setItem(SYNC_HASH_KEY, hash)\n  } catch {\n    /* storage unavailable — guard simply won't apply */\n  }\n}\n\nfunction getApiConfig() {\n  if (typeof window === 'undefined') return { apiUrl: '', apiKey: '', site: '' }\n\n  const apiUrl = (window as any).__SITE_KIT_API_URL__ || 'https://api.sonor.io'\n  const apiKey = (window as any).__SITE_KIT_API_KEY__ || ''\n  // Sub-site host — set by SiteKitClientProviders from analytics.site config,\n  // NEXT_PUBLIC_SITE_URL host, or window.location.host. Tagged on every\n  // seo_pages row from this sitemap so the dashboard can scope the page tree\n  // when one Sonor project hosts many sites.\n  const site = (window as any).__SITE_KIT_SITE__ || window.location.host || ''\n  return { apiUrl, apiKey, site }\n}\n\nasync function parseSitemap(sitemapUrl: string, debug: boolean): Promise<SitemapEntry[]> {\n  try {\n    const response = await sonorFetch(sitemapUrl)\n    if (!response.ok) {\n      if (debug) console.warn('[SitemapSync] Failed to fetch sitemap:', response.status)\n      return []\n    }\n\n    const text = await response.text()\n    const parser = new DOMParser()\n    const doc = parser.parseFromString(text, 'application/xml')\n\n    const parseError = doc.querySelector('parsererror')\n    if (parseError) {\n      if (debug) console.warn('[SitemapSync] Sitemap parse error:', parseError.textContent)\n      return []\n    }\n\n    const urls = doc.querySelectorAll('url')\n    const entries: SitemapEntry[] = []\n\n    urls.forEach(url => {\n      const loc = url.querySelector('loc')?.textContent?.trim()\n      if (!loc) return\n\n      const path = locToPath(loc)\n\n      // Reject malformed paths (embedded domains, double protocols, etc.)\n      if (isMalformedSitemapPath(path)) {\n        if (debug) console.warn(`[SitemapSync] Skipping malformed path: ${path}`)\n        return\n      }\n\n      const lastmod = url.querySelector('lastmod')?.textContent || undefined\n      const changefreq = url.querySelector('changefreq')?.textContent || undefined\n      const priorityStr = url.querySelector('priority')?.textContent\n      const priority = priorityStr ? parseFloat(priorityStr) : undefined\n\n      entries.push({ path, lastmod, changefreq, priority })\n    })\n\n    if (debug) {\n      console.log(`[SitemapSync] Parsed ${entries.length} entries from sitemap`)\n    }\n\n    return entries\n  } catch (error) {\n    if (debug) console.error('[SitemapSync] Error parsing sitemap:', error)\n    return []\n  }\n}\n\nasync function syncToPortal(\n  entries: SitemapEntry[],\n  apiUrl: string,\n  apiKey: string,\n  site: string,\n  debug: boolean,\n  mode: 'additive' | 'full-replace' = 'additive'\n): Promise<{ success: boolean; created: number; updated: number }> {\n  if (!apiKey) {\n    if (debug) console.warn('[SitemapSync] No API key configured')\n    return { success: false, created: 0, updated: 0 }\n  }\n\n  if (entries.length === 0) {\n    if (debug) console.log('[SitemapSync] No entries to sync')\n    return { success: true, created: 0, updated: 0 }\n  }\n\n  try {\n    // Registration is idempotent in both modes (same payload → same final\n    // state), so retrying a timed-out attempt is safe.\n    const response = await sonorFetch(`${apiUrl}/api/public/seo/register-sitemap`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n      },\n      body: JSON.stringify({\n        entries: entries.map(e => ({\n          path: e.path,\n          priority: e.priority,\n          changefreq: e.changefreq,\n          pageType: inferPageType(e.path),\n        })),\n        mode,\n        // Sub-site host — tagged on every seo_pages row so the dashboard\n        // can scope the page tree to one microsite. Resolved by\n        // SiteKitClientProviders (see __SITE_KIT_SITE__).\n        ...(site ? { site } : {}),\n      }),\n    }, { apiKey })\n\n    if (!response.ok) {\n      if (debug) console.error('[SitemapSync] API error:', response.status, response.statusText)\n      return { success: false, created: 0, updated: 0 }\n    }\n\n    const result = await response.json()\n\n    if (debug) {\n      console.log(`[SitemapSync] Synced: ${result.created} created, ${result.updated} updated`)\n    }\n\n    return {\n      success: true,\n      created: result.created || 0,\n      updated: result.updated || 0,\n    }\n  } catch (error) {\n    if (debug) console.error('[SitemapSync] Sync error:', error)\n    return { success: false, created: 0, updated: 0 }\n  }\n}\n\nexport function SitemapSync({\n  sitemapUrl = '/sitemap.xml',\n  syncInterval = 60,\n  debug = false,\n  mode = 'additive',\n}: SitemapSyncProps) {\n  const hasSyncedRef = useRef(false)\n  const intervalRef = useRef<ReturnType<typeof setInterval> | null>(null)\n\n  useEffect(() => {\n    // Build-time sync via createSitemap is the canonical source of truth, but\n    // it can fail during ISR revalidation (app/ dir unavailable on serverless).\n    // Runtime SitemapSync in additive mode is a safe fallback — it adds/updates\n    // pages that may be missing without ever deleting existing ones.\n    // Full-replace is never safe at runtime — always force additive.\n    const effectiveMode: 'additive' | 'full-replace' = 'additive'\n\n    // Throttle window: reuse syncInterval when periodic syncing is on,\n    // otherwise default to 60 minutes for the on-mount sync.\n    const throttleMinutes = syncInterval > 0 ? syncInterval : 60\n\n    const doSync = async () => {\n      const { apiUrl, apiKey, site } = getApiConfig()\n\n      if (!apiKey) {\n        if (debug) console.warn('[SitemapSync] No API key found')\n        return\n      }\n\n      if (isRecentlySynced(throttleMinutes)) {\n        if (debug) console.log('[SitemapSync] Skipped — synced within the last', throttleMinutes, 'min this session')\n        return\n      }\n\n      if (debug) console.log('[SitemapSync] Starting sitemap sync...', site ? `(site: ${site})` : '')\n\n      const entries = await parseSitemap(sitemapUrl, debug)\n\n      if (entries.length > 0) {\n        const hash = hashEntries(sitemapUrl, entries)\n        if (isAlreadySyncedHash(hash)) {\n          // This exact sitemap already synced from this browser — the server\n          // state can't be improved by re-POSTing it. Stamp the session so we\n          // don't even re-fetch/parse for the rest of the throttle window.\n          stampSynced()\n          if (debug) console.log('[SitemapSync] Skipped POST — sitemap unchanged since last successful sync')\n          return\n        }\n        const result = await syncToPortal(entries, apiUrl, apiKey, site, debug, effectiveMode)\n        if (result.success) {\n          stampSynced()\n          storeSyncedHash(hash)\n        }\n      }\n    }\n\n    if (!hasSyncedRef.current) {\n      hasSyncedRef.current = true\n      doSync()\n    }\n\n    if (syncInterval > 0) {\n      intervalRef.current = setInterval(doSync, syncInterval * 60 * 1000)\n    }\n\n    return () => {\n      if (intervalRef.current) {\n        clearInterval(intervalRef.current)\n      }\n    }\n  }, [sitemapUrl, syncInterval, debug, mode])\n\n  return null\n}\n"]}
+{"version":3,"sources":["../src/SitemapSync.tsx"],"names":[],"mappings":";;;;AAuDA,IAAM,cAAA,GAAiB,uBAAA;AACvB,IAAM,aAAA,GAAgB,kBAAA;AAEtB,SAAS,iBAAiB,eAAA,EAAkC;AAC1D,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,OAAA,CAAQ,cAAc,CAAA;AACnD,IAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,IAAA,MAAM,UAAU,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,CAAS,OAAO,EAAE,CAAA;AAC/C,IAAA,OAAO,OAAA,IAAW,CAAA,IAAK,OAAA,GAAU,eAAA,GAAkB,EAAA,GAAK,GAAA;AAAA,EAC1D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAA,GAAoB;AAC3B,EAAA,IAAI;AACF,IAAA,cAAA,CAAe,QAAQ,cAAA,EAAgB,IAAA,CAAK,GAAA,EAAI,CAAE,UAAU,CAAA;AAAA,EAC9D,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AASA,SAAS,WAAA,CAAY,YAAoB,OAAA,EAAiC;AACxE,EAAA,MAAM,IAAA,GAAO,QACV,GAAA,CAAI,CAAA,CAAA,KAAK,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAA,IAAW,EAAE,IAAI,CAAA,CAAE,UAAA,IAAc,EAAE,CAAA,CAAA,EAAI,CAAA,CAAE,YAAY,EAAE,CAAA,CAAE,CAAA,CACjF,IAAA,CAAK,IAAI,CAAA;AACZ,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,QAAQ,CAAA,EAAA,EAAK;AACpC,IAAA,IAAA,GAAA,CAAS,QAAQ,CAAA,IAAK,IAAA,GAAO,IAAA,CAAK,UAAA,CAAW,CAAC,CAAA,GAAK,CAAA;AAAA,EACrD;AACA,EAAA,OAAO,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,OAAA,CAAQ,MAAM,CAAA,CAAA,EAAI,IAAA,CAAK,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA;AAC7D;AAEA,SAAS,oBAAoB,IAAA,EAAuB;AAClD,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,OAAA,CAAQ,aAAa,CAAA,KAAM,IAAA;AAAA,EACjD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB,IAAA,EAAoB;AAC3C,EAAA,IAAI;AACF,IAAA,YAAA,CAAa,OAAA,CAAQ,eAAe,IAAI,CAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,YAAA,GAAe;AACtB,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,EAAE,QAAQ,EAAA,EAAI,MAAA,EAAQ,EAAA,EAAI,IAAA,EAAM,EAAA,EAAG;AAE7E,EAAA,MAAM,MAAA,GAAU,OAAe,oBAAA,IAAwB,sBAAA;AACvD,EAAA,MAAM,MAAA,GAAU,OAAe,oBAAA,IAAwB,EAAA;AAKvD,EAAA,MAAM,IAAA,GAAQ,MAAA,CAAe,iBAAA,IAAqB,MAAA,CAAO,SAAS,IAAA,IAAQ,EAAA;AAC1E,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAK;AAChC;AAEA,eAAe,YAAA,CAAa,YAAoB,KAAA,EAAyC;AACvF,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAM,UAAA,CAAW,UAAU,CAAA;AAC5C,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,wCAAA,EAA0C,SAAS,MAAM,CAAA;AACjF,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,MAAM,MAAA,GAAS,IAAI,SAAA,EAAU;AAC7B,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,eAAA,CAAgB,IAAA,EAAM,iBAAiB,CAAA;AAE1D,IAAA,MAAM,UAAA,GAAa,GAAA,CAAI,aAAA,CAAc,aAAa,CAAA;AAClD,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,oCAAA,EAAsC,WAAW,WAAW,CAAA;AACpF,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,gBAAA,CAAiB,KAAK,CAAA;AACvC,IAAA,MAAM,UAA0B,EAAC;AAEjC,IAAA,IAAA,CAAK,QAAQ,CAAA,GAAA,KAAO;AAClB,MAAA,MAAM,MAAM,GAAA,CAAI,aAAA,CAAc,KAAK,CAAA,EAAG,aAAa,IAAA,EAAK;AACxD,MAAA,IAAI,CAAC,GAAA,EAAK;AAEV,MAAA,MAAM,IAAA,GAAO,UAAU,GAAG,CAAA;AAG1B,MAAA,IAAI,sBAAA,CAAuB,IAAI,CAAA,EAAG;AAChC,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,CAAA,uCAAA,EAA0C,IAAI,CAAA,CAAE,CAAA;AACxE,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,GAAA,CAAI,aAAA,CAAc,SAAS,GAAG,WAAA,IAAe,KAAA,CAAA;AAC7D,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,aAAA,CAAc,YAAY,GAAG,WAAA,IAAe,KAAA,CAAA;AACnE,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,aAAA,CAAc,UAAU,CAAA,EAAG,WAAA;AACnD,MAAA,MAAM,QAAA,GAAW,WAAA,GAAc,UAAA,CAAW,WAAW,CAAA,GAAI,KAAA,CAAA;AAEzD,MAAA,OAAA,CAAQ,KAAK,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,UAAU,CAAA;AAAA,IACtD,CAAC,CAAA;AAED,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,qBAAA,EAAwB,OAAA,CAAQ,MAAM,CAAA,qBAAA,CAAuB,CAAA;AAAA,IAC3E;AAEA,IAAA,OAAO,OAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,sCAAA,EAAwC,KAAK,CAAA;AACtE,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAEA,eAAe,aACb,OAAA,EACA,MAAA,EACA,QACA,IAAA,EACA,KAAA,EACA,OAAoC,UAAA,EAC6B;AACjE,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,qCAAqC,CAAA;AAC7D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AAEA,EAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,kCAAkC,CAAA;AACzD,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EACjD;AAEA,EAAA,IAAI;AAGF,IAAA,MAAM,QAAA,GAAW,MAAM,UAAA,CAAW,CAAA,EAAG,MAAM,CAAA,gCAAA,CAAA,EAAoC;AAAA,MAC7E,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB;AAAA,OAClB;AAAA,MACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,OAAA,EAAS,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,MAAM;AAAA,UACzB,MAAM,CAAA,CAAE,IAAA;AAAA,UACR,UAAU,CAAA,CAAE,QAAA;AAAA,UACZ,YAAY,CAAA,CAAE,UAAA;AAAA,UACd,QAAA,EAAU,aAAA,CAAc,CAAA,CAAE,IAAI;AAAA,SAChC,CAAE,CAAA;AAAA,QACF,IAAA;AAAA;AAAA;AAAA;AAAA,QAIA,GAAI,IAAA,GAAO,EAAE,IAAA,KAAS;AAAC,OACxB;AAAA,KACH,EAAG,EAAE,MAAA,EAAQ,CAAA;AAEb,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,IAAI,OAAO,OAAA,CAAQ,KAAA,CAAM,4BAA4B,QAAA,CAAS,MAAA,EAAQ,SAAS,UAAU,CAAA;AACzF,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,IAClD;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AAEnC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,IAAI,CAAA,sBAAA,EAAyB,MAAA,CAAO,OAAO,CAAA,UAAA,EAAa,MAAA,CAAO,OAAO,CAAA,QAAA,CAAU,CAAA;AAAA,IAC1F;AAEA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAA;AAAA,MACT,OAAA,EAAS,OAAO,OAAA,IAAW,CAAA;AAAA,MAC3B,OAAA,EAAS,OAAO,OAAA,IAAW;AAAA,KAC7B;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,2BAAA,EAA6B,KAAK,CAAA;AAC3D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AACF;AAEO,SAAS,WAAA,CAAY;AAAA,EAC1B,UAAA,GAAa,cAAA;AAAA,EACb,YAAA,GAAe,EAAA;AAAA,EACf,KAAA,GAAQ,KAAA;AAAA,EACR,IAAA,GAAO;AACT,CAAA,EAAqB;AACnB,EAAA,MAAM,YAAA,GAAe,OAAO,KAAK,CAAA;AACjC,EAAA,MAAM,WAAA,GAAc,OAA8C,IAAI,CAAA;AAEtE,EAAA,SAAA,CAAU,MAAM;AAMd,IAAA,MAAM,aAAA,GAA6C,UAAA;AAInD,IAAA,MAAM,eAAA,GAAkB,YAAA,GAAe,CAAA,GAAI,YAAA,GAAe,EAAA;AAE1D,IAAA,MAAM,SAAS,YAAY;AACzB,MAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,KAAS,YAAA,EAAa;AAE9C,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,gCAAgC,CAAA;AACxD,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,gBAAA,CAAiB,eAAe,CAAA,EAAG;AACrC,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,qDAAA,EAAkD,iBAAiB,kBAAkB,CAAA;AAC5G,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,KAAA,UAAe,GAAA,CAAI,wCAAA,EAA0C,OAAO,CAAA,OAAA,EAAU,IAAI,MAAM,EAAE,CAAA;AAE9F,MAAA,MAAM,OAAA,GAAU,MAAM,YAAA,CAAa,UAAA,EAAY,KAAK,CAAA;AAEpD,MAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,UAAA,EAAY,OAAO,CAAA;AAC5C,QAAA,IAAI,mBAAA,CAAoB,IAAI,CAAA,EAAG;AAI7B,UAAA,WAAA,EAAY;AACZ,UAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,gFAA2E,CAAA;AAClG,UAAA;AAAA,QACF;AACA,QAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,OAAA,EAAS,QAAQ,MAAA,EAAQ,IAAA,EAAM,OAAO,aAAa,CAAA;AACrF,QAAA,IAAI,OAAO,OAAA,EAAS;AAClB,UAAA,WAAA,EAAY;AACZ,UAAA,eAAA,CAAgB,IAAI,CAAA;AAAA,QACtB;AAAA,MACF;AAAA,IACF,CAAA;AAEA,IAAA,IAAI,CAAC,aAAa,OAAA,EAAS;AACzB,MAAA,YAAA,CAAa,OAAA,GAAU,IAAA;AACvB,MAAA,MAAA,EAAO;AAAA,IACT;AAEA,IAAA,IAAI,eAAe,CAAA,EAAG;AACpB,MAAA,WAAA,CAAY,OAAA,GAAU,WAAA,CAAY,MAAA,EAAQ,YAAA,GAAe,KAAK,GAAI,CAAA;AAAA,IACpE;AAEA,IAAA,OAAO,MAAM;AACX,MAAA,IAAI,YAAY,OAAA,EAAS;AACvB,QAAA,aAAA,CAAc,YAAY,OAAO,CAAA;AAAA,MACnC;AAAA,IACF,CAAA;AAAA,EACF,GAAG,CAAC,UAAA,EAAY,YAAA,EAAc,KAAA,EAAO,IAAI,CAAC,CAAA;AAE1C,EAAA,OAAO,IAAA;AACT","file":"chunk-RJBW2JFO.mjs","sourcesContent":["/**\n * SitemapSync - Automatically sync sitemap.xml to Portal API\n *\n * Client-only component. Lives at package root so the main entry does not\n * pull in seo/ (and server-only code). For use in SiteKitLayout and\n * from @sonordev/site-kit/seo.\n *\n * @example\n * ```tsx\n * import { SitemapSync } from '@sonordev/site-kit'\n * // or\n * import { SitemapSync } from '@sonordev/site-kit/seo'\n * ```\n */\n\n'use client'\n\nimport { useEffect, useRef } from 'react'\nimport { sonorFetch } from './shared/sonorFetch'\n// Single source of truth for page-type inference + path normalization, shared\n// with createSitemap (build) and the register-sitemap CLI. Pure string logic,\n// safe in the browser.\nimport { inferPageType, locToPath, isMalformedSitemapPath } from './sitemap/shared'\n\ninterface SitemapSyncProps {\n  /** Custom sitemap URL (defaults to /sitemap.xml) */\n  sitemapUrl?: string\n  /** How often to re-sync in minutes (0 = only on mount, default: 60) */\n  syncInterval?: number\n  /** Enable debug logging */\n  debug?: boolean\n  /**\n   * Sync mode:\n   * - 'additive' (default for runtime): adds/updates pages but never deletes existing ones\n   * - 'full-replace': replaces the entire page set (use only for build-time sync via createSitemap)\n   */\n  mode?: 'additive' | 'full-replace'\n}\n\ninterface SitemapEntry {\n  path: string\n  lastmod?: string\n  changefreq?: string\n  priority?: number\n  pageType?: string\n}\n\n/**\n * Per-browser-session sync throttle. Build-time sync (createSitemap) is the\n * canonical source of truth; runtime SitemapSync is only a safety net — so\n * re-registering the sitemap on every full page load of every visitor is pure\n * waste (fetch + DOMParser on the visitor's main thread, plus a write per\n * pageview against the API). Stamp the last successful sync in sessionStorage\n * and skip while inside the throttle window.\n */\nconst SYNC_STAMP_KEY = '_sk_sitemap_synced_at'\nconst SYNC_HASH_KEY = '_sk_sitemap_hash'\n\nfunction isRecentlySynced(throttleMinutes: number): boolean {\n  try {\n    const stamp = sessionStorage.getItem(SYNC_STAMP_KEY)\n    if (!stamp) return false\n    const elapsed = Date.now() - parseInt(stamp, 10)\n    return elapsed >= 0 && elapsed < throttleMinutes * 60 * 1000\n  } catch {\n    return false // storage unavailable (private mode) — sync as before\n  }\n}\n\nfunction stampSynced(): void {\n  try {\n    sessionStorage.setItem(SYNC_STAMP_KEY, Date.now().toString())\n  } catch {\n    /* storage unavailable — throttle simply won't apply */\n  }\n}\n\n/**\n * Content-hash guard (localStorage, so it survives across sessions): the\n * sitemap of a static site only changes at deploy, so once ONE sync of a given\n * sitemap succeeded from this browser, re-POSTing the identical entry set is\n * pure API load. Hash the parsed entries; skip the POST when unchanged.\n * Keyed by sitemap URL so multiple SitemapSync instances don't collide.\n */\nfunction hashEntries(sitemapUrl: string, entries: SitemapEntry[]): string {\n  const text = entries\n    .map(e => `${e.path}|${e.lastmod ?? ''}|${e.changefreq ?? ''}|${e.priority ?? ''}`)\n    .join('\\n')\n  let hash = 0\n  for (let i = 0; i < text.length; i++) {\n    hash = ((hash << 5) - hash + text.charCodeAt(i)) | 0\n  }\n  return `${sitemapUrl}:${entries.length}:${hash.toString(16)}`\n}\n\nfunction isAlreadySyncedHash(hash: string): boolean {\n  try {\n    return localStorage.getItem(SYNC_HASH_KEY) === hash\n  } catch {\n    return false\n  }\n}\n\nfunction storeSyncedHash(hash: string): void {\n  try {\n    localStorage.setItem(SYNC_HASH_KEY, hash)\n  } catch {\n    /* storage unavailable — guard simply won't apply */\n  }\n}\n\nfunction getApiConfig() {\n  if (typeof window === 'undefined') return { apiUrl: '', apiKey: '', site: '' }\n\n  const apiUrl = (window as any).__SITE_KIT_API_URL__ || 'https://api.sonor.io'\n  const apiKey = (window as any).__SITE_KIT_API_KEY__ || ''\n  // Sub-site host — set by SiteKitClientProviders from analytics.site config,\n  // NEXT_PUBLIC_SITE_URL host, or window.location.host. Tagged on every\n  // seo_pages row from this sitemap so the dashboard can scope the page tree\n  // when one Sonor project hosts many sites.\n  const site = (window as any).__SITE_KIT_SITE__ || window.location.host || ''\n  return { apiUrl, apiKey, site }\n}\n\nasync function parseSitemap(sitemapUrl: string, debug: boolean): Promise<SitemapEntry[]> {\n  try {\n    const response = await sonorFetch(sitemapUrl)\n    if (!response.ok) {\n      if (debug) console.warn('[SitemapSync] Failed to fetch sitemap:', response.status)\n      return []\n    }\n\n    const text = await response.text()\n    const parser = new DOMParser()\n    const doc = parser.parseFromString(text, 'application/xml')\n\n    const parseError = doc.querySelector('parsererror')\n    if (parseError) {\n      if (debug) console.warn('[SitemapSync] Sitemap parse error:', parseError.textContent)\n      return []\n    }\n\n    const urls = doc.querySelectorAll('url')\n    const entries: SitemapEntry[] = []\n\n    urls.forEach(url => {\n      const loc = url.querySelector('loc')?.textContent?.trim()\n      if (!loc) return\n\n      const path = locToPath(loc)\n\n      // Reject malformed paths (embedded domains, double protocols, etc.)\n      if (isMalformedSitemapPath(path)) {\n        if (debug) console.warn(`[SitemapSync] Skipping malformed path: ${path}`)\n        return\n      }\n\n      const lastmod = url.querySelector('lastmod')?.textContent || undefined\n      const changefreq = url.querySelector('changefreq')?.textContent || undefined\n      const priorityStr = url.querySelector('priority')?.textContent\n      const priority = priorityStr ? parseFloat(priorityStr) : undefined\n\n      entries.push({ path, lastmod, changefreq, priority })\n    })\n\n    if (debug) {\n      console.log(`[SitemapSync] Parsed ${entries.length} entries from sitemap`)\n    }\n\n    return entries\n  } catch (error) {\n    if (debug) console.error('[SitemapSync] Error parsing sitemap:', error)\n    return []\n  }\n}\n\nasync function syncToPortal(\n  entries: SitemapEntry[],\n  apiUrl: string,\n  apiKey: string,\n  site: string,\n  debug: boolean,\n  mode: 'additive' | 'full-replace' = 'additive'\n): Promise<{ success: boolean; created: number; updated: number }> {\n  if (!apiKey) {\n    if (debug) console.warn('[SitemapSync] No API key configured')\n    return { success: false, created: 0, updated: 0 }\n  }\n\n  if (entries.length === 0) {\n    if (debug) console.log('[SitemapSync] No entries to sync')\n    return { success: true, created: 0, updated: 0 }\n  }\n\n  try {\n    // Registration is idempotent in both modes (same payload → same final\n    // state), so retrying a timed-out attempt is safe.\n    const response = await sonorFetch(`${apiUrl}/api/public/seo/register-sitemap`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n      },\n      body: JSON.stringify({\n        entries: entries.map(e => ({\n          path: e.path,\n          priority: e.priority,\n          changefreq: e.changefreq,\n          pageType: inferPageType(e.path),\n        })),\n        mode,\n        // Sub-site host — tagged on every seo_pages row so the dashboard\n        // can scope the page tree to one microsite. Resolved by\n        // SiteKitClientProviders (see __SITE_KIT_SITE__).\n        ...(site ? { site } : {}),\n      }),\n    }, { apiKey })\n\n    if (!response.ok) {\n      if (debug) console.error('[SitemapSync] API error:', response.status, response.statusText)\n      return { success: false, created: 0, updated: 0 }\n    }\n\n    const result = await response.json()\n\n    if (debug) {\n      console.log(`[SitemapSync] Synced: ${result.created} created, ${result.updated} updated`)\n    }\n\n    return {\n      success: true,\n      created: result.created || 0,\n      updated: result.updated || 0,\n    }\n  } catch (error) {\n    if (debug) console.error('[SitemapSync] Sync error:', error)\n    return { success: false, created: 0, updated: 0 }\n  }\n}\n\nexport function SitemapSync({\n  sitemapUrl = '/sitemap.xml',\n  syncInterval = 60,\n  debug = false,\n  mode = 'additive',\n}: SitemapSyncProps) {\n  const hasSyncedRef = useRef(false)\n  const intervalRef = useRef<ReturnType<typeof setInterval> | null>(null)\n\n  useEffect(() => {\n    // Build-time sync via createSitemap is the canonical source of truth, but\n    // it can fail during ISR revalidation (app/ dir unavailable on serverless).\n    // Runtime SitemapSync in additive mode is a safe fallback — it adds/updates\n    // pages that may be missing without ever deleting existing ones.\n    // Full-replace is never safe at runtime — always force additive.\n    const effectiveMode: 'additive' | 'full-replace' = 'additive'\n\n    // Throttle window: reuse syncInterval when periodic syncing is on,\n    // otherwise default to 60 minutes for the on-mount sync.\n    const throttleMinutes = syncInterval > 0 ? syncInterval : 60\n\n    const doSync = async () => {\n      const { apiUrl, apiKey, site } = getApiConfig()\n\n      if (!apiKey) {\n        if (debug) console.warn('[SitemapSync] No API key found')\n        return\n      }\n\n      if (isRecentlySynced(throttleMinutes)) {\n        if (debug) console.log('[SitemapSync] Skipped — synced within the last', throttleMinutes, 'min this session')\n        return\n      }\n\n      if (debug) console.log('[SitemapSync] Starting sitemap sync...', site ? `(site: ${site})` : '')\n\n      const entries = await parseSitemap(sitemapUrl, debug)\n\n      if (entries.length > 0) {\n        const hash = hashEntries(sitemapUrl, entries)\n        if (isAlreadySyncedHash(hash)) {\n          // This exact sitemap already synced from this browser — the server\n          // state can't be improved by re-POSTing it. Stamp the session so we\n          // don't even re-fetch/parse for the rest of the throttle window.\n          stampSynced()\n          if (debug) console.log('[SitemapSync] Skipped POST — sitemap unchanged since last successful sync')\n          return\n        }\n        const result = await syncToPortal(entries, apiUrl, apiKey, site, debug, effectiveMode)\n        if (result.success) {\n          stampSynced()\n          storeSyncedHash(hash)\n        }\n      }\n    }\n\n    if (!hasSyncedRef.current) {\n      hasSyncedRef.current = true\n      doSync()\n    }\n\n    if (syncInterval > 0) {\n      intervalRef.current = setInterval(doSync, syncInterval * 60 * 1000)\n    }\n\n    return () => {\n      if (intervalRef.current) {\n        clearInterval(intervalRef.current)\n      }\n    }\n  }, [sitemapUrl, syncInterval, debug, mode])\n\n  return null\n}\n"]}

package/dist/{chunk-OBRGUSGB.mjs → chunk-RPLZIPTB.mjs}

@@ -1,4 +1,4 @@
-import { SITE_KIT_VERSION } from './chunk-2X5ZB5D7.mjs';
+import { SITE_KIT_VERSION } from './chunk-Q3VBSR4M.mjs';
 
 // src/shared/siteToken.ts
 var SITE_TOKEN_PREFIX = "st1.";
@@ -146,5 +146,5 @@ function currentCredential(seed) {
 }
 
 export { configureSiteCredential, credentialBreakerId, currentCredential, getFreshCredential, isSiteToken, isTokenMode, refreshSiteToken };
-//# sourceMappingURL=chunk-OBRGUSGB.mjs.map
-//# sourceMappingURL=chunk-OBRGUSGB.mjs.map
+//# sourceMappingURL=chunk-RPLZIPTB.mjs.map
+//# sourceMappingURL=chunk-RPLZIPTB.mjs.map

package/dist/{chunk-OBRGUSGB.mjs.map → chunk-RPLZIPTB.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/siteToken.ts"],"names":[],"mappings":";;;AAuBO,IAAM,iBAAA,GAAoB,MAAA;AAGjC,IAAM,kBAAkB,CAAA,GAAI,GAAA;AAC5B,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,WAAA,GAAc,sBAAA;AAEb,SAAS,YAAY,UAAA,EAAqC;AAC/D,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,IAAY,UAAA,CAAW,WAAW,iBAAiB,CAAA;AAClF;AASO,SAAS,sBAAsB,KAAA,EAA6C;AACjF,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,MAAM,GAAA,GAAO,KAAA,CAAiB,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC1C,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,IAAI;AAEF,IAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACpD,IAAA,MAAM,IAAA,GACJ,OAAO,IAAA,KAAS,UAAA,GACZ,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACnD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,IAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,GAAS,MAAA,GAAS,IAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOO,SAAS,oBAAoB,UAAA,EAAoC;AACtE,EAAA,IAAI,CAAC,YAAY,OAAO,aAAA;AACxB,EAAA,MAAM,MAAA,GAAS,sBAAsB,UAAU,CAAA;AAC/C,EAAA,IAAI,MAAA,EAAQ,GAAA,EAAK,OAAO,CAAA,IAAA,EAAO,OAAO,GAAG,CAAA,CAAA;AACzC,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B;AAeA,SAAS,iBAAA,GAAgC;AACvC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,MAAA;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,MAAA,EAAQ,sBAAA;AAAA,IACR,KAAA,EAAO,IAAA;AAAA,IACP,UAAA,EAAY;AAAA,GACd;AACF;AAcA,IAAM,eAAA,GAAkB,4BAAA;AAExB,IAAM,SAAqB,MAAM;AAC/B,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,iBAAA,EAAkB;AAC5D,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,4CAAuB,iBAAA,EAAkB,CAAA;AACnD,CAAA,GAAG;AAEH,SAAS,eAAA,GAAiC;AACxC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AACrD,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,OAAO,MAAA,EAAQ,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ,IAAA;AAAA,EAC5D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAW,KAAA,EAAqB;AACvC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACnC,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,cAAA,CAAe,QAAQ,WAAA,EAAa,IAAA,CAAK,UAAU,EAAE,KAAA,EAAO,CAAC,CAAA;AAAA,EACtE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA;AAAC,IAAC,OAAe,oBAAA,GAAuB,KAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,SAAS,KAAA,EAA8B;AAC9C,EAAA,MAAM,MAAA,GAAS,sBAAsB,KAAK,CAAA;AAC1C,EAAA,OAAO,OAAO,MAAA,EAAQ,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,MAAM,GAAA,GAAO,CAAA;AAC/D;AAMO,SAAS,wBAAwB,IAAA,EAG/B;AACP,EAAA,KAAA,CAAM,OAAO,IAAA,CAAK,UAAA;AAClB,EAAA,KAAA,CAAM,OAAA,GAAU,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,QAAQ,KAAA,CAAM,MAAA,GAAS,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAE9D,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,IAAA;AAAA,EACF;AAKA,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,EAAA,IAAI,IAAA,GAAO,KAAK,UAAA,IAAc,IAAA;AAC9B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,IAAI,UAAU,QAAA,CAAS,MAAM,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,MAAA;AACxD,EAAA,IAAI,SAAS,QAAA,CAAS,KAAK,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,KAAA;AACtD,EAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AAChB;AAEA,SAAS,YAAA,GAAwB;AAC/B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,KAAA;AAC3B,EAAA,IAAI,CAAC,KAAA,CAAM,KAAA,EAAO,OAAO,IAAA;AACzB,EAAA,OAAO,KAAK,GAAA,EAAI,IAAK,QAAA,CAAS,KAAA,CAAM,KAAK,CAAA,GAAI,eAAA;AAC/C;AAEA,eAAe,SAAA,GAAoC;AACjD,EAAA,MAAM,UAAU,KAAA,CAAM,KAAA;AACtB,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,8BAAA,CAAA,EAAkC;AAAA,MACvE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqB,gBAAA;AAAA;AAAA;AAAA,QAGrB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACvC,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,kBAAkB,CAAA,GACtC,KAAA;AAAA,KACP,CAAA;AACD,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,OAAO,IAAA;AACpB,IAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC9C,IAAA,MAAM,OAAO,IAAA,EAAM,KAAA;AACnB,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,WAAA,CAAY,IAAI,CAAA,EAAG;AACjD,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,UAAA,CAAW,IAAI,CAAA;AACf,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,gBAAA,GAA2C;AACzD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,UAAA,EAAY,OAAO,KAAA,CAAM,UAAA;AACnC,EAAA,KAAA,CAAM,UAAA,GAAa,SAAA,EAAU,CAAE,OAAA,CAAQ,MAAM;AAC3C,IAAA,KAAA,CAAM,UAAA,GAAa,IAAA;AAAA,EACrB,CAAC,CAAA;AACD,EAAA,OAAO,KAAA,CAAM,UAAA;AACf;AAMA,eAAsB,mBACpB,IAAA,EAC6B;AAI7B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,IAAW,WAAA,CAAY,IAAI,CAAA,EAAG;AACvC,IAAA,uBAAA,CAAwB,EAAE,UAAA,EAAY,IAAA,EAAM,CAAA;AAAA,EAC9C;AAEA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,IAAI,cAAa,EAAG;AAClB,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,WAAW,OAAO,SAAA;AAAA,EAGxB;AACA,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC;AAGO,SAAS,WAAA,GAAuB;AACrC,EAAA,OAAO,KAAA,CAAM,OAAA;AACf;AAOO,SAAS,kBAAkB,IAAA,EAAmC;AACnE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC","file":"chunk-OBRGUSGB.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared — Client token manager\n *\n * SiteKitLayout (a server component) no longer ships the raw `sonor_` API key to\n * the browser. Instead it mints a short-lived, project-scoped token server-side\n * and injects THAT. This module is the browser-side lifecycle for that token:\n *\n *   - holds the current token (seeded from the injected value)\n *   - a static page's seed can be days old and already expired on first view, so\n *     it transparently REFRESHES via the public endpoint before first use\n *   - dedupes concurrent refreshes (one in-flight request, awaited by all)\n *   - persists the freshest token in sessionStorage so navigations within a\n *     session don't each re-refresh\n *\n * Everything here is a no-op passthrough when the injected credential is a raw\n * key (a 2.x kit, or the mint-failed fallback) — legacy behavior is unchanged.\n * Fully SSR-safe: on the server there is no refresh, just the seed.\n *\n * The token payload is NOT secret (only its HMAC is unforgeable), so decoding it\n * client-side to read `exp`/`pid` is fine and needs no crypto.\n */\nimport { SITE_KIT_VERSION } from './version'\n\nexport const SITE_TOKEN_PREFIX = 'st1.'\n\n/** Refresh this many ms before expiry, so a request never races the deadline. */\nconst REFRESH_SKEW_MS = 5 * 60_000\nconst REFRESH_TIMEOUT_MS = 6_000\nconst STORAGE_KEY = '__sonor_site_token__'\n\nexport function isSiteToken(credential?: string | null): boolean {\n  return typeof credential === 'string' && credential.startsWith(SITE_TOKEN_PREFIX)\n}\n\ninterface DecodedClaims {\n  pid?: string\n  iat?: number\n  exp?: number\n}\n\n/** Decode the (non-secret) token payload. Returns null if not a token / malformed. */\nexport function decodeSiteTokenClaims(token?: string | null): DecodedClaims | null {\n  if (!isSiteToken(token)) return null\n  const seg = (token as string).split('.')[1]\n  if (!seg) return null\n  try {\n    // base64url → JSON. atob handles standard base64; restore url-safe chars.\n    const b64 = seg.replace(/-/g, '+').replace(/_/g, '/')\n    const json =\n      typeof atob === 'function'\n        ? atob(b64)\n        : Buffer.from(seg, 'base64url').toString('utf8')\n    const claims = JSON.parse(json)\n    return typeof claims === 'object' && claims ? claims : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Stable id for the auth circuit breaker. Tokens rotate, so keying the breaker\n * by the raw value would reset it every refresh — key by the project id encoded\n * in the token instead. Raw keys use a safe prefix.\n */\nexport function credentialBreakerId(credential?: string | null): string {\n  if (!credential) return '(anonymous)'\n  const claims = decodeSiteTokenClaims(credential)\n  if (claims?.pid) return `pid:${claims.pid}`\n  return credential.slice(0, 16)\n}\n\ninterface TokenState {\n  /** The credential injected by the layout (token or raw key). */\n  seed: string | undefined\n  /** Whether we're in token mode (seed is a token). */\n  isToken: boolean\n  /** Base API URL for the refresh endpoint. */\n  apiUrl: string\n  /** The freshest known token (>= seed). Null in raw-key mode. */\n  token: string | null\n  /** In-flight refresh, deduped. */\n  refreshing: Promise<string | null> | null\n}\n\nfunction initialTokenState(): TokenState {\n  return {\n    seed: undefined,\n    isToken: false,\n    apiUrl: 'https://api.sonor.io',\n    token: null,\n    refreshing: null,\n  }\n}\n\n/**\n * Page-wide singleton, keyed on window. Bundlers can (and in the field, do)\n * inline more than one copy of this module into a page — e.g. an app importing\n * site-kit directly while a transpiled component library bundles its own copy.\n * Module-scoped state then splits into per-copy brains: one copy gets\n * configured and refreshes fine while the other keeps sending the stale\n * prerendered seed, 401s, and trips its breaker (\"sonor-auth-paused\" with a\n * working network). Sharing the state object on window gives every copy the\n * same token, the same deduped refresh, and the same breaker. On the server\n * (no window) each module instance keeps private state — there's no refresh\n * lifecycle there anyway.\n */\nconst TOKEN_STATE_KEY = '__SONOR_SITE_TOKEN_STATE__'\n\nconst state: TokenState = (() => {\n  if (typeof window === 'undefined') return initialTokenState()\n  const w = window as unknown as Record<string, TokenState | undefined>\n  return (w[TOKEN_STATE_KEY] ??= initialTokenState())\n})()\n\nfunction readStoredToken(): string | null {\n  if (typeof window === 'undefined') return null\n  try {\n    const raw = window.sessionStorage.getItem(STORAGE_KEY)\n    if (!raw) return null\n    const parsed = JSON.parse(raw)\n    return typeof parsed?.token === 'string' ? parsed.token : null\n  } catch {\n    return null\n  }\n}\n\nfunction storeToken(token: string): void {\n  if (typeof window === 'undefined') return\n  try {\n    window.sessionStorage.setItem(STORAGE_KEY, JSON.stringify({ token }))\n  } catch {\n    /* private mode / disabled storage — memory-only is fine */\n  }\n  try {\n    ;(window as any).__SITE_KIT_API_KEY__ = token\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction tokenExp(token: string | null): number {\n  const claims = decodeSiteTokenClaims(token)\n  return typeof claims?.exp === 'number' ? claims.exp * 1000 : 0\n}\n\n/**\n * Configure the manager from the layout-injected values. Adopts a fresher token\n * from sessionStorage if a prior page in this session already refreshed.\n */\nexport function configureSiteCredential(opts: {\n  credential?: string\n  apiUrl?: string\n}): void {\n  state.seed = opts.credential\n  state.isToken = isSiteToken(opts.credential)\n  if (opts.apiUrl) state.apiUrl = opts.apiUrl.replace(/\\/+$/, '')\n\n  if (!state.isToken) {\n    state.token = null\n    return\n  }\n\n  // configure runs on every render — never downgrade. Keep the freshest of the\n  // injected seed, a token stored by an earlier page this session, and whatever\n  // an in-flight/prior refresh already put in memory.\n  const prior = state.token\n  let best = opts.credential ?? null\n  const stored = readStoredToken()\n  if (stored && tokenExp(stored) > tokenExp(best)) best = stored\n  if (prior && tokenExp(prior) > tokenExp(best)) best = prior\n  state.token = best\n}\n\nfunction needsRefresh(): boolean {\n  if (!state.isToken) return false\n  if (!state.token) return true\n  return Date.now() >= tokenExp(state.token) - REFRESH_SKEW_MS\n}\n\nasync function doRefresh(): Promise<string | null> {\n  const current = state.token\n  if (!current) return null\n  try {\n    const res = await fetch(`${state.apiUrl}/api/public/site-token/refresh`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        // Send the current token as x-api-key too, so the server's key-scoped\n        // throttler buckets refreshes by token rather than by shared CDN IP.\n        'x-api-key': current,\n      },\n      body: JSON.stringify({ token: current }),\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(REFRESH_TIMEOUT_MS)\n          : undefined,\n    })\n    if (!res.ok) return null\n    const data = await res.json().catch(() => null)\n    const next = data?.token\n    if (typeof next === 'string' && isSiteToken(next)) {\n      state.token = next\n      storeToken(next)\n      return next\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\n/** Refresh now (deduped). Returns the new token, or null on failure. */\nexport function refreshSiteToken(): Promise<string | null> {\n  if (!state.isToken) return Promise.resolve(null)\n  if (state.refreshing) return state.refreshing\n  state.refreshing = doRefresh().finally(() => {\n    state.refreshing = null\n  })\n  return state.refreshing\n}\n\n/**\n * The credential to put on the next request. In token mode, refreshes a stale\n * seed first. In raw-key mode, returns the seed unchanged (legacy passthrough).\n */\nexport async function getFreshCredential(\n  seed?: string,\n): Promise<string | undefined> {\n  // Unconfigured but handed a token (a component received the prerendered seed\n  // as a prop before any provider configured the manager): adopt it so the\n  // refresh machinery works instead of replaying a possibly-expired seed.\n  if (!state.isToken && isSiteToken(seed)) {\n    configureSiteCredential({ credential: seed })\n  }\n  // A raw key (or nothing configured) — no token machinery.\n  if (!state.isToken) return seed ?? state.seed\n  if (needsRefresh()) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed) return refreshed\n    // Refresh failed — fall through to whatever we have; the request may 401 and\n    // trip the breaker with friendly copy.\n  }\n  return state.token ?? seed ?? state.seed\n}\n\n/** Whether the given credential is being managed as a token. */\nexport function isTokenMode(): boolean {\n  return state.isToken\n}\n\n/**\n * Best-known credential WITHOUT refreshing — for synchronous unload paths\n * (sonorBeacon) that can't await. In token mode returns the freshest token held;\n * in raw-key mode returns the seed.\n */\nexport function currentCredential(seed?: string): string | undefined {\n  if (!state.isToken) return seed ?? state.seed\n  return state.token ?? seed ?? state.seed\n}\n"]}
+{"version":3,"sources":["../src/shared/siteToken.ts"],"names":[],"mappings":";;;AAuBO,IAAM,iBAAA,GAAoB,MAAA;AAGjC,IAAM,kBAAkB,CAAA,GAAI,GAAA;AAC5B,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,WAAA,GAAc,sBAAA;AAEb,SAAS,YAAY,UAAA,EAAqC;AAC/D,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,IAAY,UAAA,CAAW,WAAW,iBAAiB,CAAA;AAClF;AASO,SAAS,sBAAsB,KAAA,EAA6C;AACjF,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,MAAM,GAAA,GAAO,KAAA,CAAiB,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC1C,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,IAAI;AAEF,IAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACpD,IAAA,MAAM,IAAA,GACJ,OAAO,IAAA,KAAS,UAAA,GACZ,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACnD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,IAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,GAAS,MAAA,GAAS,IAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOO,SAAS,oBAAoB,UAAA,EAAoC;AACtE,EAAA,IAAI,CAAC,YAAY,OAAO,aAAA;AACxB,EAAA,MAAM,MAAA,GAAS,sBAAsB,UAAU,CAAA;AAC/C,EAAA,IAAI,MAAA,EAAQ,GAAA,EAAK,OAAO,CAAA,IAAA,EAAO,OAAO,GAAG,CAAA,CAAA;AACzC,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B;AAeA,SAAS,iBAAA,GAAgC;AACvC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,MAAA;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,MAAA,EAAQ,sBAAA;AAAA,IACR,KAAA,EAAO,IAAA;AAAA,IACP,UAAA,EAAY;AAAA,GACd;AACF;AAcA,IAAM,eAAA,GAAkB,4BAAA;AAExB,IAAM,SAAqB,MAAM;AAC/B,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,iBAAA,EAAkB;AAC5D,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,4CAAuB,iBAAA,EAAkB,CAAA;AACnD,CAAA,GAAG;AAEH,SAAS,eAAA,GAAiC;AACxC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AACrD,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,OAAO,MAAA,EAAQ,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ,IAAA;AAAA,EAC5D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAW,KAAA,EAAqB;AACvC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACnC,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,cAAA,CAAe,QAAQ,WAAA,EAAa,IAAA,CAAK,UAAU,EAAE,KAAA,EAAO,CAAC,CAAA;AAAA,EACtE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA;AAAC,IAAC,OAAe,oBAAA,GAAuB,KAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,SAAS,KAAA,EAA8B;AAC9C,EAAA,MAAM,MAAA,GAAS,sBAAsB,KAAK,CAAA;AAC1C,EAAA,OAAO,OAAO,MAAA,EAAQ,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,MAAM,GAAA,GAAO,CAAA;AAC/D;AAMO,SAAS,wBAAwB,IAAA,EAG/B;AACP,EAAA,KAAA,CAAM,OAAO,IAAA,CAAK,UAAA;AAClB,EAAA,KAAA,CAAM,OAAA,GAAU,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,QAAQ,KAAA,CAAM,MAAA,GAAS,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAE9D,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,IAAA;AAAA,EACF;AAKA,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,EAAA,IAAI,IAAA,GAAO,KAAK,UAAA,IAAc,IAAA;AAC9B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,IAAI,UAAU,QAAA,CAAS,MAAM,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,MAAA;AACxD,EAAA,IAAI,SAAS,QAAA,CAAS,KAAK,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,KAAA;AACtD,EAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AAChB;AAEA,SAAS,YAAA,GAAwB;AAC/B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,KAAA;AAC3B,EAAA,IAAI,CAAC,KAAA,CAAM,KAAA,EAAO,OAAO,IAAA;AACzB,EAAA,OAAO,KAAK,GAAA,EAAI,IAAK,QAAA,CAAS,KAAA,CAAM,KAAK,CAAA,GAAI,eAAA;AAC/C;AAEA,eAAe,SAAA,GAAoC;AACjD,EAAA,MAAM,UAAU,KAAA,CAAM,KAAA;AACtB,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,8BAAA,CAAA,EAAkC;AAAA,MACvE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqB,gBAAA;AAAA;AAAA;AAAA,QAGrB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACvC,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,kBAAkB,CAAA,GACtC,KAAA;AAAA,KACP,CAAA;AACD,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,OAAO,IAAA;AACpB,IAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC9C,IAAA,MAAM,OAAO,IAAA,EAAM,KAAA;AACnB,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,WAAA,CAAY,IAAI,CAAA,EAAG;AACjD,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,UAAA,CAAW,IAAI,CAAA;AACf,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,gBAAA,GAA2C;AACzD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,UAAA,EAAY,OAAO,KAAA,CAAM,UAAA;AACnC,EAAA,KAAA,CAAM,UAAA,GAAa,SAAA,EAAU,CAAE,OAAA,CAAQ,MAAM;AAC3C,IAAA,KAAA,CAAM,UAAA,GAAa,IAAA;AAAA,EACrB,CAAC,CAAA;AACD,EAAA,OAAO,KAAA,CAAM,UAAA;AACf;AAMA,eAAsB,mBACpB,IAAA,EAC6B;AAI7B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,IAAW,WAAA,CAAY,IAAI,CAAA,EAAG;AACvC,IAAA,uBAAA,CAAwB,EAAE,UAAA,EAAY,IAAA,EAAM,CAAA;AAAA,EAC9C;AAEA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,IAAI,cAAa,EAAG;AAClB,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,WAAW,OAAO,SAAA;AAAA,EAGxB;AACA,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC;AAGO,SAAS,WAAA,GAAuB;AACrC,EAAA,OAAO,KAAA,CAAM,OAAA;AACf;AAOO,SAAS,kBAAkB,IAAA,EAAmC;AACnE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC","file":"chunk-RPLZIPTB.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared — Client token manager\n *\n * SiteKitLayout (a server component) no longer ships the raw `sonor_` API key to\n * the browser. Instead it mints a short-lived, project-scoped token server-side\n * and injects THAT. This module is the browser-side lifecycle for that token:\n *\n *   - holds the current token (seeded from the injected value)\n *   - a static page's seed can be days old and already expired on first view, so\n *     it transparently REFRESHES via the public endpoint before first use\n *   - dedupes concurrent refreshes (one in-flight request, awaited by all)\n *   - persists the freshest token in sessionStorage so navigations within a\n *     session don't each re-refresh\n *\n * Everything here is a no-op passthrough when the injected credential is a raw\n * key (a 2.x kit, or the mint-failed fallback) — legacy behavior is unchanged.\n * Fully SSR-safe: on the server there is no refresh, just the seed.\n *\n * The token payload is NOT secret (only its HMAC is unforgeable), so decoding it\n * client-side to read `exp`/`pid` is fine and needs no crypto.\n */\nimport { SITE_KIT_VERSION } from './version'\n\nexport const SITE_TOKEN_PREFIX = 'st1.'\n\n/** Refresh this many ms before expiry, so a request never races the deadline. */\nconst REFRESH_SKEW_MS = 5 * 60_000\nconst REFRESH_TIMEOUT_MS = 6_000\nconst STORAGE_KEY = '__sonor_site_token__'\n\nexport function isSiteToken(credential?: string | null): boolean {\n  return typeof credential === 'string' && credential.startsWith(SITE_TOKEN_PREFIX)\n}\n\ninterface DecodedClaims {\n  pid?: string\n  iat?: number\n  exp?: number\n}\n\n/** Decode the (non-secret) token payload. Returns null if not a token / malformed. */\nexport function decodeSiteTokenClaims(token?: string | null): DecodedClaims | null {\n  if (!isSiteToken(token)) return null\n  const seg = (token as string).split('.')[1]\n  if (!seg) return null\n  try {\n    // base64url → JSON. atob handles standard base64; restore url-safe chars.\n    const b64 = seg.replace(/-/g, '+').replace(/_/g, '/')\n    const json =\n      typeof atob === 'function'\n        ? atob(b64)\n        : Buffer.from(seg, 'base64url').toString('utf8')\n    const claims = JSON.parse(json)\n    return typeof claims === 'object' && claims ? claims : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Stable id for the auth circuit breaker. Tokens rotate, so keying the breaker\n * by the raw value would reset it every refresh — key by the project id encoded\n * in the token instead. Raw keys use a safe prefix.\n */\nexport function credentialBreakerId(credential?: string | null): string {\n  if (!credential) return '(anonymous)'\n  const claims = decodeSiteTokenClaims(credential)\n  if (claims?.pid) return `pid:${claims.pid}`\n  return credential.slice(0, 16)\n}\n\ninterface TokenState {\n  /** The credential injected by the layout (token or raw key). */\n  seed: string | undefined\n  /** Whether we're in token mode (seed is a token). */\n  isToken: boolean\n  /** Base API URL for the refresh endpoint. */\n  apiUrl: string\n  /** The freshest known token (>= seed). Null in raw-key mode. */\n  token: string | null\n  /** In-flight refresh, deduped. */\n  refreshing: Promise<string | null> | null\n}\n\nfunction initialTokenState(): TokenState {\n  return {\n    seed: undefined,\n    isToken: false,\n    apiUrl: 'https://api.sonor.io',\n    token: null,\n    refreshing: null,\n  }\n}\n\n/**\n * Page-wide singleton, keyed on window. Bundlers can (and in the field, do)\n * inline more than one copy of this module into a page — e.g. an app importing\n * site-kit directly while a transpiled component library bundles its own copy.\n * Module-scoped state then splits into per-copy brains: one copy gets\n * configured and refreshes fine while the other keeps sending the stale\n * prerendered seed, 401s, and trips its breaker (\"sonor-auth-paused\" with a\n * working network). Sharing the state object on window gives every copy the\n * same token, the same deduped refresh, and the same breaker. On the server\n * (no window) each module instance keeps private state — there's no refresh\n * lifecycle there anyway.\n */\nconst TOKEN_STATE_KEY = '__SONOR_SITE_TOKEN_STATE__'\n\nconst state: TokenState = (() => {\n  if (typeof window === 'undefined') return initialTokenState()\n  const w = window as unknown as Record<string, TokenState | undefined>\n  return (w[TOKEN_STATE_KEY] ??= initialTokenState())\n})()\n\nfunction readStoredToken(): string | null {\n  if (typeof window === 'undefined') return null\n  try {\n    const raw = window.sessionStorage.getItem(STORAGE_KEY)\n    if (!raw) return null\n    const parsed = JSON.parse(raw)\n    return typeof parsed?.token === 'string' ? parsed.token : null\n  } catch {\n    return null\n  }\n}\n\nfunction storeToken(token: string): void {\n  if (typeof window === 'undefined') return\n  try {\n    window.sessionStorage.setItem(STORAGE_KEY, JSON.stringify({ token }))\n  } catch {\n    /* private mode / disabled storage — memory-only is fine */\n  }\n  try {\n    ;(window as any).__SITE_KIT_API_KEY__ = token\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction tokenExp(token: string | null): number {\n  const claims = decodeSiteTokenClaims(token)\n  return typeof claims?.exp === 'number' ? claims.exp * 1000 : 0\n}\n\n/**\n * Configure the manager from the layout-injected values. Adopts a fresher token\n * from sessionStorage if a prior page in this session already refreshed.\n */\nexport function configureSiteCredential(opts: {\n  credential?: string\n  apiUrl?: string\n}): void {\n  state.seed = opts.credential\n  state.isToken = isSiteToken(opts.credential)\n  if (opts.apiUrl) state.apiUrl = opts.apiUrl.replace(/\\/+$/, '')\n\n  if (!state.isToken) {\n    state.token = null\n    return\n  }\n\n  // configure runs on every render — never downgrade. Keep the freshest of the\n  // injected seed, a token stored by an earlier page this session, and whatever\n  // an in-flight/prior refresh already put in memory.\n  const prior = state.token\n  let best = opts.credential ?? null\n  const stored = readStoredToken()\n  if (stored && tokenExp(stored) > tokenExp(best)) best = stored\n  if (prior && tokenExp(prior) > tokenExp(best)) best = prior\n  state.token = best\n}\n\nfunction needsRefresh(): boolean {\n  if (!state.isToken) return false\n  if (!state.token) return true\n  return Date.now() >= tokenExp(state.token) - REFRESH_SKEW_MS\n}\n\nasync function doRefresh(): Promise<string | null> {\n  const current = state.token\n  if (!current) return null\n  try {\n    const res = await fetch(`${state.apiUrl}/api/public/site-token/refresh`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        // Send the current token as x-api-key too, so the server's key-scoped\n        // throttler buckets refreshes by token rather than by shared CDN IP.\n        'x-api-key': current,\n      },\n      body: JSON.stringify({ token: current }),\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(REFRESH_TIMEOUT_MS)\n          : undefined,\n    })\n    if (!res.ok) return null\n    const data = await res.json().catch(() => null)\n    const next = data?.token\n    if (typeof next === 'string' && isSiteToken(next)) {\n      state.token = next\n      storeToken(next)\n      return next\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\n/** Refresh now (deduped). Returns the new token, or null on failure. */\nexport function refreshSiteToken(): Promise<string | null> {\n  if (!state.isToken) return Promise.resolve(null)\n  if (state.refreshing) return state.refreshing\n  state.refreshing = doRefresh().finally(() => {\n    state.refreshing = null\n  })\n  return state.refreshing\n}\n\n/**\n * The credential to put on the next request. In token mode, refreshes a stale\n * seed first. In raw-key mode, returns the seed unchanged (legacy passthrough).\n */\nexport async function getFreshCredential(\n  seed?: string,\n): Promise<string | undefined> {\n  // Unconfigured but handed a token (a component received the prerendered seed\n  // as a prop before any provider configured the manager): adopt it so the\n  // refresh machinery works instead of replaying a possibly-expired seed.\n  if (!state.isToken && isSiteToken(seed)) {\n    configureSiteCredential({ credential: seed })\n  }\n  // A raw key (or nothing configured) — no token machinery.\n  if (!state.isToken) return seed ?? state.seed\n  if (needsRefresh()) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed) return refreshed\n    // Refresh failed — fall through to whatever we have; the request may 401 and\n    // trip the breaker with friendly copy.\n  }\n  return state.token ?? seed ?? state.seed\n}\n\n/** Whether the given credential is being managed as a token. */\nexport function isTokenMode(): boolean {\n  return state.isToken\n}\n\n/**\n * Best-known credential WITHOUT refreshing — for synchronous unload paths\n * (sonorBeacon) that can't await. In token mode returns the freshest token held;\n * in raw-key mode returns the seed.\n */\nexport function currentCredential(seed?: string): string | undefined {\n  if (!state.isToken) return seed ?? state.seed\n  return state.token ?? seed ?? state.seed\n}\n"]}

package/dist/{chunk-ANJBOE46.mjs → chunk-RRAUM373.mjs}

@@ -1,6 +1,6 @@
 'use client';
-import { useAnalyticsOptional } from './chunk-6SN3ABID.mjs';
-import { sonorFetch } from './chunk-5PBJ42NC.mjs';
+import { useAnalyticsOptional } from './chunk-ACAMCJJQ.mjs';
+import { sonorFetch } from './chunk-AVFXLKIP.mjs';
 import { jsxs, jsx, Fragment } from 'react/jsx-runtime';
 import React5, { useState, useEffect, useMemo, useRef, useCallback } from 'react';
 
@@ -7986,5 +7986,5 @@ function CapacityBadge({
 }
 
 export { CalendarView, CapacityBadge, CheckoutForm, EventCalendar, EventCheckout, EventEmbed, EventJsonLd, EventModal, EventTile, EventsAgenda, EventsWidget, OfferingCard, OfferingList, ProductDetail, ProductEmbed, ProductGrid, ProductPage, RegistrationForm, SizeChart, UpcomingEvents, createCheckoutSession, createPaymentIntent, fetchActiveProcessor, fetchCategories, fetchLatestOffering, fetchNextEvent, fetchOffering, fetchOfferings, fetchProcessorConfig, fetchProductBySlug, fetchProducts, fetchProductsPublic, fetchServices, fetchShippingRates, fetchUpcomingEvents, formatDate, formatDateRange, formatDateTime, formatPrice, formatTime, getOfferingUrl, getRelativeTimeUntil, getSpotsRemaining, googleCalendarUrl, icsForEvent, icsResponse, isEventSoldOut, registerForEvent, useEventModal, validateAddress, validateDiscountCode };
-//# sourceMappingURL=chunk-ANJBOE46.mjs.map
-//# sourceMappingURL=chunk-ANJBOE46.mjs.map
+//# sourceMappingURL=chunk-RRAUM373.mjs.map
+//# sourceMappingURL=chunk-RRAUM373.mjs.map