@sonordev/site-kit 4.3.0 → 4.3.2

package/dist/{chunk-OVIDFJIK.mjs → chunk-5YKMHPJL.mjs}

@@ -1,4 +1,4 @@
-// src/middleware/securityHeaders.ts
+// src/proxy/securityHeaders.ts
 var DEFAULT_FRAME_ANCESTORS = [
   "'self'",
   "https://upforge.io",
@@ -35,5 +35,5 @@ function buildSecurityHeaders(config) {
 }
 
 export { DEFAULT_FRAME_ANCESTORS, buildSecurityHeaders };
-//# sourceMappingURL=chunk-OVIDFJIK.mjs.map
-//# sourceMappingURL=chunk-OVIDFJIK.mjs.map
+//# sourceMappingURL=chunk-5YKMHPJL.mjs.map
+//# sourceMappingURL=chunk-5YKMHPJL.mjs.map

package/dist/chunk-5YKMHPJL.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/proxy/securityHeaders.ts"],"names":[],"mappings":";AAoBO,IAAM,uBAAA,GAA0B;AAAA,EACrC,QAAA;AAAA,EACA,oBAAA;AAAA,EACA;AACF;AAiCO,SAAS,qBACd,MAAA,EACwB;AACxB,EAAA,IAAI,MAAA,KAAW,KAAA,EAAO,OAAO,EAAC;AAE9B,EAAA,MAAM,CAAA,GACJ,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,EAAC;AAEzC,EAAA,MAAM,UAAkC,EAAC;AAGzC,EAAA,IAAI,CAAA,CAAE,uBAAuB,KAAA,EAAO;AAClC,IAAA,OAAA,CAAQ,wBAAwB,CAAA,GAAI,IAAA;AAAA,EACtC;AAUA,EAAA,MAAM,cAAA,GACJ,CAAA,CAAE,cAAA,KAAmB,KAAA,GACjB,IAAA,GACA,CAAA,CAAE,cAAA,IAAkB,CAAA,CAAE,cAAA,CAAe,MAAA,GAAS,CAAA,GAC5C,CAAA,CAAE,cAAA,GACF,uBAAA;AAER,EAAA,IAAI,cAAA,EAAgB;AAClB,IAAA,OAAA,CAAQ,yBAAyB,CAAA,GAC/B,CAAA,gBAAA,EAAmB,cAAA,CAAe,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA;AAE7C,IAAA,IAAI,EAAE,YAAA,EAAc;AAClB,MAAA,OAAA,CAAQ,iBAAiB,IAAI,CAAA,CAAE,YAAA;AAAA,IACjC;AAAA,EACF,CAAA,MAAA,IAAW,CAAA,CAAE,YAAA,KAAiB,KAAA,EAAO;AACnC,IAAA,OAAA,CAAQ,iBAAiB,CAAA,GAAI,CAAA,CAAE,YAAA,IAAgB,MAAA;AAAA,EACjD;AAGA,EAAA,IAAI,CAAA,CAAE,uBAAuB,KAAA,EAAO;AAClC,IAAA,OAAA,CAAQ,wBAAwB,CAAA,GAAI,SAAA;AAAA,EACtC;AAGA,EAAA,IAAI,CAAA,CAAE,kBAAkB,KAAA,EAAO;AAC7B,IAAA,OAAA,CAAQ,kBAAkB,CAAA,GAAI,eAAA;AAAA,EAChC;AAGA,EAAA,OAAA,CAAQ,iBAAiB,CAAA,GACvB,CAAA,CAAE,cAAA,IAAkB,iCAAA;AAGtB,EAAA,OAAA,CAAQ,oBAAoB,CAAA,GAC1B,CAAA,CAAE,iBAAA,IAAqB,0CAAA;AAGzB,EAAA,IAAI,EAAE,aAAA,EAAe;AACnB,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,EAAS,CAAA,CAAE,aAAa,CAAA;AAAA,EACxC;AAEA,EAAA,OAAO,OAAA;AACT","file":"chunk-5YKMHPJL.mjs","sourcesContent":["/**\n * Default security headers applied by site-kit middleware.\n *\n * These match industry best practices and are the same headers\n * recommended by Next.js documentation. All are opt-out.\n */\n\n/**\n * Single source of truth for who may frame a site-kit site.\n *\n * Upforge showcases live client work inside iframes on its portfolio /\n * area pages, so every managed marketing site has to be embeddable from\n * upforge.io. `X-Frame-Options` cannot express an allowlist (`ALLOW-FROM`\n * is dead and ignored by every current browser), so the CSP\n * `frame-ancestors` directive is the only way to say \"these origins and\n * nobody else\". Everything not listed here is still blocked.\n *\n * Do NOT re-fork this list into individual sites' middleware/next.config —\n * add origins here and let the fleet inherit them.\n */\nexport const DEFAULT_FRAME_ANCESTORS = [\n  \"'self'\",\n  'https://upforge.io',\n  'https://*.upforge.io',\n]\n\nexport interface SecurityHeadersConfig {\n  /** X-Frame-Options value. false to disable. Default: omitted when\n   * `frameAncestors` is active (the two conflict), otherwise 'DENY'. */\n  frameOptions?: 'DENY' | 'SAMEORIGIN' | false\n  /**\n   * Origins allowed to frame this site, emitted as a CSP `frame-ancestors`\n   * directive. Defaults to {@link DEFAULT_FRAME_ANCESTORS} ('self' + upforge.io)\n   * so Upforge can showcase the site. Pass an array to extend/replace, or\n   * `false` to opt out entirely and fall back to X-Frame-Options.\n   *\n   * Ignored if a `Content-Security-Policy` is supplied via `customHeaders` —\n   * that CSP wins, and must carry its own frame-ancestors directive.\n   */\n  frameAncestors?: string[] | false\n  /** X-Content-Type-Options: nosniff. Default: true */\n  contentTypeOptions?: boolean\n  /** X-XSS-Protection header. Default: true */\n  xssProtection?: boolean\n  /** Referrer-Policy value. Default: 'strict-origin-when-cross-origin' */\n  referrerPolicy?: string\n  /** Permissions-Policy value. Default restricts camera, microphone, geolocation */\n  permissionsPolicy?: string\n  /** X-DNS-Prefetch-Control. Default: true (on) */\n  dnsPrefetchControl?: boolean\n  /** Additional custom headers */\n  customHeaders?: Record<string, string>\n}\n\n/**\n * Build a flat Record of header name → value from the config.\n */\nexport function buildSecurityHeaders(\n  config?: SecurityHeadersConfig | boolean,\n): Record<string, string> {\n  if (config === false) return {}\n\n  const c: SecurityHeadersConfig =\n    typeof config === 'object' ? config : {}\n\n  const headers: Record<string, string> = {}\n\n  // X-DNS-Prefetch-Control\n  if (c.dnsPrefetchControl !== false) {\n    headers['X-DNS-Prefetch-Control'] = 'on'\n  }\n\n  // Framing policy — CSP frame-ancestors is the allowlist mechanism;\n  // X-Frame-Options is only a fallback for the opted-out case.\n  //\n  // These two headers MUST NOT both be emitted: X-Frame-Options has no\n  // allowlist form, so a stray `DENY`/`SAMEORIGIN` alongside a permissive\n  // frame-ancestors is honoured by some browsers and silently re-blocks the\n  // embed. So when frame-ancestors is active we drop XFO unless the site\n  // explicitly asked for a value.\n  const frameAncestors =\n    c.frameAncestors === false\n      ? null\n      : c.frameAncestors && c.frameAncestors.length > 0\n        ? c.frameAncestors\n        : DEFAULT_FRAME_ANCESTORS\n\n  if (frameAncestors) {\n    headers['Content-Security-Policy'] =\n      `frame-ancestors ${frameAncestors.join(' ')}`\n    // Only honour an explicitly-requested XFO value here.\n    if (c.frameOptions) {\n      headers['X-Frame-Options'] = c.frameOptions\n    }\n  } else if (c.frameOptions !== false) {\n    headers['X-Frame-Options'] = c.frameOptions || 'DENY'\n  }\n\n  // X-Content-Type-Options\n  if (c.contentTypeOptions !== false) {\n    headers['X-Content-Type-Options'] = 'nosniff'\n  }\n\n  // X-XSS-Protection\n  if (c.xssProtection !== false) {\n    headers['X-XSS-Protection'] = '1; mode=block'\n  }\n\n  // Referrer-Policy\n  headers['Referrer-Policy'] =\n    c.referrerPolicy || 'strict-origin-when-cross-origin'\n\n  // Permissions-Policy\n  headers['Permissions-Policy'] =\n    c.permissionsPolicy || 'camera=(), microphone=(), geolocation=()'\n\n  // Custom headers\n  if (c.customHeaders) {\n    Object.assign(headers, c.customHeaders)\n  }\n\n  return headers\n}\n"]}

package/dist/{chunk-SM27DPML.js → chunk-67MTTPJV.js}

@@ -1,10 +1,11 @@
 'use client';
 'use strict';
 
-var chunkF3MOVBEE_js = require('./chunk-F3MOVBEE.js');
-var chunk3KVG2PSJ_js = require('./chunk-3KVG2PSJ.js');
+var chunkC3M5E4YI_js = require('./chunk-C3M5E4YI.js');
+var chunkM52FYLV4_js = require('./chunk-M52FYLV4.js');
+var chunkOZ3FU4BT_js = require('./chunk-OZ3FU4BT.js');
 var chunkHGNSJXWT_js = require('./chunk-HGNSJXWT.js');
-var chunkPJZHIISA_js = require('./chunk-PJZHIISA.js');
+var chunkFIA3WNEM_js = require('./chunk-FIA3WNEM.js');
 var chunkRC4WWQXR_js = require('./chunk-RC4WWQXR.js');
 var React = require('react');
 var dynamic = require('next/dynamic');
@@ -16,15 +17,15 @@ var React__default = /*#__PURE__*/_interopDefault(React);
 var dynamic__default = /*#__PURE__*/_interopDefault(dynamic);
 
 var LazyAnalyticsProvider = dynamic__default.default(
-  () => import('./AnalyticsProvider-WRAJE62B.js').then((m) => ({ default: m.AnalyticsProvider })),
+  () => import('./AnalyticsProvider-DNMYYBKX.js').then((m) => ({ default: m.AnalyticsProvider })),
   { ssr: false }
 );
 var LazyEngageWidget = dynamic__default.default(
-  () => import('./EngageWidget-2U4EN7OP.js').then((m) => ({ default: m.EngageWidget })),
+  () => import('./EngageWidget-VRC7NUG6.js').then((m) => ({ default: m.EngageWidget })),
   { ssr: false }
 );
 var LazySitemapSync = dynamic__default.default(
-  () => import('./SitemapSync-B2CY2JYM.js').then((m) => ({ default: m.SitemapSync })),
+  () => import('./SitemapSync-SR6OJRIA.js').then((m) => ({ default: m.SitemapSync })),
   { ssr: false }
 );
 function SiteKitClientProviders({
@@ -43,8 +44,8 @@ function SiteKitClientProviders({
 }) {
   const modulesReady = chunkHGNSJXWT_js.useDeferredActivation(defer);
   const analyticsConfig = typeof analytics === "object" ? analytics : {};
-  const site = chunkF3MOVBEE_js.resolveSiteHost(analyticsConfig.site);
-  chunkF3MOVBEE_js.publishSiteCredential({ apiKey, apiUrl, site, debug, mapsBrowserKey });
+  const site = chunkOZ3FU4BT_js.resolveSiteHost(analyticsConfig.site);
+  chunkC3M5E4YI_js.publishSiteCredential({ apiKey, apiUrl, site, debug, mapsBrowserKey });
   const [visitorId] = React.useState(() => chunkRC4WWQXR_js.getOrCreateVisitorId());
   const [sessionId] = React.useState(() => chunkRC4WWQXR_js.getOrCreateSessionId());
   const pageMetadataRef = React.useRef(null);
@@ -56,7 +57,7 @@ function SiteKitClientProviders({
     const signalConfig = typeof signal === "object" ? signal : {};
     siblings.push(
       /* @__PURE__ */ jsxRuntime.jsx(
-        chunkPJZHIISA_js.SignalBridge,
+        chunkFIA3WNEM_js.SignalBridge,
         {
           enabled: true,
           realtime: signalConfig.realtime !== false,
@@ -121,7 +122,7 @@ function SiteKitClientProviders({
     if (sitemapSync) activeModules.push("sitemapSync");
     siblings.push(
       /* @__PURE__ */ jsxRuntime.jsx(React__default.default.Fragment, { children: modulesReady && /* @__PURE__ */ jsxRuntime.jsx(
-        chunk3KVG2PSJ_js.FleetHeartbeat,
+        chunkM52FYLV4_js.FleetHeartbeat,
         {
           apiUrl,
           apiKey,
@@ -140,5 +141,5 @@ function SiteKitClientProviders({
 }
 
 exports.SiteKitClientProviders = SiteKitClientProviders;
-//# sourceMappingURL=chunk-SM27DPML.js.map
-//# sourceMappingURL=chunk-SM27DPML.js.map
+//# sourceMappingURL=chunk-67MTTPJV.js.map
+//# sourceMappingURL=chunk-67MTTPJV.js.map

package/dist/chunk-67MTTPJV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/layout/SiteKitClientProviders.tsx"],"names":["dynamic","useDeferredActivation","resolveSiteHost","publishSiteCredential","useState","getOrCreateVisitorId","getOrCreateSessionId","useRef","useCallback","jsx","SignalBridge","React","Suspense","FleetHeartbeat","jsxs","Fragment"],"mappings":";;;;;;;;;;;;;;;;;AA+CA,IAAM,qBAAA,GAAwBA,wBAAA;AAAA,EAC5B,MAAM,OAAO,iCAAgC,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,iBAAA,EAAkB,CAAE,CAAA;AAAA,EAC3F,EAAE,KAAK,KAAA;AACT,CAAA;AACA,IAAM,gBAAA,GAAmBA,wBAAA;AAAA,EACvB,MAAM,OAAO,4BAAwB,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,YAAA,EAAa,CAAE,CAAA;AAAA,EAC9E,EAAE,KAAK,KAAA;AACT,CAAA;AACA,IAAM,eAAA,GAAkBA,wBAAA;AAAA,EACtB,MAAM,OAAO,2BAAgB,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,WAAA,EAAY,CAAE,CAAA;AAAA,EACrE,EAAE,KAAK,KAAA;AACT,CAAA;AAiDO,SAAS,sBAAA,CAAuB;AAAA,EACrC,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA,GAAY,IAAA;AAAA,EACZ,MAAA,GAAS,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EACT,WAAA,GAAc,KAAA;AAAA,EACd,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ,KAAA;AAAA,EACR;AACF,CAAA,EAAgC;AAG9B,EAAA,MAAM,YAAA,GAAeC,uCAAsB,KAAK,CAAA;AAEhD,EAAA,MAAM,eAAA,GACJ,OAAO,SAAA,KAAc,QAAA,GAAW,YAAY,EAAC;AAO/C,EAAA,MAAM,IAAA,GAAOC,gCAAA,CAAgB,eAAA,CAAgB,IAAI,CAAA;AAIjD,EAAAC,sCAAA,CAAsB,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAO,gBAAgB,CAAA;AAGrE,EAAA,MAAM,CAAC,SAAS,CAAA,GAAIC,cAAA,CAAS,MAAMC,uCAAsB,CAAA;AACzD,EAAA,MAAM,CAAC,SAAS,CAAA,GAAID,cAAA,CAAS,MAAME,uCAAsB,CAAA;AAGzD,EAAA,MAAM,eAAA,GAAkBC,aAAuC,IAAI,CAAA;AACnE,EAAA,MAAM,cAAA,GAAiBC,iBAAA,CAAY,CAAC,QAAA,KAAsC;AACxE,IAAA,eAAA,CAAgB,OAAA,GAAU,QAAA;AAAA,EAC5B,CAAA,EAAG,EAAE,CAAA;AAGL,EAAA,MAAM,WAAwB,EAAC;AAK/B,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,YAAA,GACJ,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,EAAC;AACzC,IAAA,QAAA,CAAS,IAAA;AAAA,sBACPC,cAAA;AAAA,QAACC,6BAAA;AAAA,QAAA;AAAA,UAEC,OAAA,EAAO,IAAA;AAAA,UACP,QAAA,EAAU,aAAa,QAAA,KAAa,KAAA;AAAA,UACpC,WAAA,EAAa,aAAa,WAAA,KAAgB,KAAA;AAAA,UAC1C,gBAAA,EAAkB,aAAa,gBAAA,KAAqB,KAAA;AAAA,UACpD,SAAA;AAAA,UACA,SAAA;AAAA,UACA;AAAA,SAAA;AAAA,QAPI;AAAA;AAQN,KACF;AAAA,EACF;AAaA,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,QAAA,CAAS,IAAA;AAAA,sBACPD,cAAA,CAACE,uBAAM,QAAA,EAAN,EACE,0CACCF,cAAA,CAACG,cAAA,EAAA,EAAS,UAAU,IAAA,EAClB,QAAA,kBAAAH,cAAA;AAAA,QAAC,qBAAA;AAAA,QAAA;AAAA,UACC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,IAAA;AAAA,UACA,cAAA,EAAgB,gBAAgB,cAAA,KAAmB,KAAA;AAAA,UACnD,cAAA,EAAgB,gBAAgB,cAAA,KAAmB,KAAA;AAAA,UACnD,gBAAA,EAAkB,gBAAgB,gBAAA,KAAqB,KAAA;AAAA,UACvD,WAAA,EAAa,gBAAgB,WAAA,KAAgB,KAAA;AAAA,UAC7C,gBAAgB,eAAA,CAAgB,eAAA;AAAA,UAChC,cAAc,eAAA,CAAgB,YAAA;AAAA,UAC9B,KAAA;AAAA,UACA,iBAAA,EAAmB,SAAA;AAAA,UACnB,iBAAA,EAAmB,SAAA;AAAA,UACnB;AAAA;AAAA,OACF,EACF,KAlBgB,cAoBpB;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,YAAA,GACJ,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,EAAC;AACzC,IAAA,QAAA,CAAS,IAAA;AAAA,sBACPA,cAAA,CAACE,sBAAA,CAAM,QAAA,EAAN,EACE,QAAA,EAAA,YAAA,oBACCF,cAAA;AAAA,QAAC,gBAAA;AAAA,QAAA;AAAA,UACC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,SAAA;AAAA,UACA,QAAA,EAAU,aAAa,QAAA,IAAY,cAAA;AAAA,UACnC,QAAQ,YAAA,CAAa,MAAA;AAAA,UACrB,WAAA,EAAa,aAAa,WAAA,KAAgB;AAAA;AAAA,WAR5B,WAWpB;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,QAAA,CAAS,IAAA;AAAA,sBACPA,cAAA,CAACE,uBAAM,QAAA,EAAN,EACE,0CAAgBF,cAAA,CAAC,eAAA,EAAA,EAAgB,KAAA,EAAc,CAAA,EAAA,EAD9B,YAEpB;AAAA,KACF;AAAA,EACF;AAOA,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,MAAM,gBAA+B,EAAC;AACtC,IAAA,IAAI,SAAA,EAAW,aAAA,CAAc,IAAA,CAAK,WAAW,CAAA;AAC7C,IAAA,IAAI,MAAA,EAAQ,aAAA,CAAc,IAAA,CAAK,QAAQ,CAAA;AACvC,IAAA,IAAI,MAAA,EAAQ,aAAA,CAAc,IAAA,CAAK,QAAQ,CAAA;AACvC,IAAA,IAAI,WAAA,EAAa,aAAA,CAAc,IAAA,CAAK,aAAa,CAAA;AACjD,IAAA,QAAA,CAAS,IAAA;AAAA,sBACPA,cAAA,CAACE,sBAAA,CAAM,QAAA,EAAN,EACE,QAAA,EAAA,YAAA,oBACCF,cAAA;AAAA,QAACI,+BAAA;AAAA,QAAA;AAAA,UACC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,IAAA;AAAA,UACA,OAAA,EAAS,aAAA;AAAA,UACT,KAAA,EAAO,KAAA;AAAA,UACP;AAAA;AAAA,WARc,UAWpB;AAAA,KACF;AAAA,EACF;AAEA,EAAA,uBACEC,eAAA,CAAAC,mBAAA,EAAA,EACG,QAAA,EAAA;AAAA,IAAA,QAAA;AAAA,IACA;AAAA,GAAA,EACH,CAAA;AAEJ","file":"chunk-67MTTPJV.js","sourcesContent":["'use client'\n\n/**\n * SiteKitClientProviders — Client Island\n *\n * This is the 'use client' boundary for SiteKitLayout.\n * It composes the client-only providers (Analytics, Engage, Signal, SitemapSync)\n * that require React context or browser APIs.\n *\n * All modules are lazy-loaded via next/dynamic so their JS is only downloaded\n * when the feature is enabled — keeping the initial bundle lightweight.\n *\n * All modules share a unified identity (visitor ID + session ID) read from\n * the storage-backed singleton (shared/identity), ensuring consistent\n * tracking across Analytics, Signal, and Engage.\n *\n * 4.0 INVARIANT — CHILDREN ARE NEVER WRAPPED. Every module here renders as a\n * childless sibling AFTER {children}; nothing provides context around page\n * content. That makes the prerender-bailout / remount-flash class of bug\n * structurally impossible. Do not reintroduce a wrapper.\n *\n * Props are passed down from the server-side SiteKitLayout component,\n * which reads env vars at render time.\n */\n\nimport React, { Suspense, useCallback, useRef, useState, type ReactNode } from 'react'\nimport dynamic from 'next/dynamic'\nimport {\n  getOrCreateVisitorId,\n  getOrCreateSessionId,\n} from '../shared/identity'\n// Defer non-critical module mounting until the page is quiet: the lazy\n// modules below are dynamic(ssr:false) and never render on the server, but\n// rendering them during hydration still kicks off their chunk downloads +\n// mount effects inside the critical startup window. useDeferredActivation\n// holds them until window.load + idle or first interaction — the same\n// strategy as the hand-rolled per-site deferrals this replaces (upforge\n// `deferred-analytics.tsx`, TPS `DeferredAnalytics.tsx`). The hook is public\n// (`@sonordev/site-kit/client`) so sites can reuse it for their own scripts.\nimport { useDeferredActivation } from '../shared/defer'\n// Single source of truth for seeding the token manager + the __SITE_KIT_*\n// globals — shared with the public `SiteKitCredential` component that\n// non-core layouts (agency-site-kit) use. Do not re-inline it here.\nimport { publishSiteCredential, resolveSiteHost } from '../shared/publishCredential'\nimport type { AnalyticsConfig, EngageConfig, SignalConfig } from './types'\n\n// Lazy-load feature modules — JS only downloaded when feature is enabled\nconst LazyAnalyticsProvider = dynamic(\n  () => import('../analytics/AnalyticsProvider').then(m => ({ default: m.AnalyticsProvider })),\n  { ssr: false },\n)\nconst LazyEngageWidget = dynamic(\n  () => import('../engage/EngageWidget').then(m => ({ default: m.EngageWidget })),\n  { ssr: false },\n)\nconst LazySitemapSync = dynamic(\n  () => import('../SitemapSync').then(m => ({ default: m.SitemapSync })),\n  { ssr: false },\n)\n// SignalBridge is imported STATICALLY, not via dynamic(ssr:false): it is a\n// tiny SSR-safe context shell that renders children immediately and\n// lazy-loads its machinery (SignalCore) as a childless sibling internally.\n// Wrapping children in a dynamic(ssr:false) component was the old SSR-bailout\n// failure mode — do not reintroduce it.\nimport { SignalBridge } from '../signal/SignalBridge'\n// Fleet heartbeat: a deferred, CHILDLESS SIBLING (like Analytics/Engage) that\n// reports this site's kit version + active modules once per session, so the\n// platform can see version drift across the fleet. Tiny and SSR-safe — renders\n// null until the shared idle gate fires; never wraps page content.\nimport { FleetHeartbeat } from '../fleet/FleetHeartbeat'\nimport type { FleetModule } from '../fleet/contract'\n\nexport interface SiteKitClientProvidersProps {\n  children: ReactNode\n  apiKey: string\n  apiUrl: string\n  projectId?: string\n  analytics?: boolean | AnalyticsConfig\n  engage?: boolean | EngageConfig\n  signal?: boolean | SignalConfig\n  /**\n   * Runtime SitemapSync from the visitor's browser. Default FALSE — sitemap\n   * registration belongs to build time and to sonor-api's nightly reconciler,\n   * not to whoever happens to load the page. See SiteKitLayout for the full\n   * reasoning; in short, its guards live in session/localStorage, so every new\n   * visitor missed them and re-POSTed the whole sitemap.\n   */\n  sitemapSync?: boolean\n  /**\n   * Fleet heartbeat — reports kit version + active modules to Sonor once per\n   * session so the platform can track version drift and key state across every\n   * site. Default true. Deferred exactly like Analytics; never in the hydration\n   * path, carries no visitor data.\n   */\n  fleet?: boolean\n  /**\n   * Defer Analytics / Engage / SitemapSync until window load + idle or first\n   * interaction (default true). Pass false to restore legacy eager mounting\n   * on hydration. SignalBridge is never deferred — it must apply experiment\n   * variants as early as possible.\n   */\n  defer?: boolean\n  debug?: boolean\n  /** Browser-safe Google Maps key, resolved server-side by SiteKitLayout. */\n  mapsBrowserKey?: string\n}\n\nexport function SiteKitClientProviders({\n  children,\n  apiKey,\n  apiUrl,\n  projectId,\n  analytics = true,\n  engage = true,\n  signal = false,\n  sitemapSync = false,\n  fleet = true,\n  defer = true,\n  debug = false,\n  mapsBrowserKey,\n}: SiteKitClientProvidersProps) {\n  // One shared activation gate for all deferred siblings, so they mount in a\n  // single commit instead of staggered re-renders.\n  const modulesReady = useDeferredActivation(defer)\n  // Hoist analytics config so the `site` dimension is resolvable up here.\n  const analyticsConfig: AnalyticsConfig =\n    typeof analytics === 'object' ? analytics : {}\n\n  // Resolve the sub-site identifier — the dimension that lets one Sonor project\n  // host many sites (e.g. truepowersystems.com + ohiopowerstudies.com under one\n  // TPS project). Precedence lives in resolveSiteHost (shared contract):\n  // explicit `analytics.site` > NEXT_PUBLIC_SITE_URL host > window.location.host.\n  // Needed as a local too — SignalBridge and the analytics config read it below.\n  const site = resolveSiteHost(analyticsConfig.site)\n\n  // Seed the token manager + publish the window globals modules read from.\n  // No-op on the server; runs during render so it lands before child effects.\n  publishSiteCredential({ apiKey, apiUrl, site, debug, mapsBrowserKey })\n\n  // Unified identity — single source of truth for all modules\n  const [visitorId] = useState(() => getOrCreateVisitorId())\n  const [sessionId] = useState(() => getOrCreateSessionId())\n\n  // Page metadata bridge: Analytics writes, Signal reads\n  const pageMetadataRef = useRef<Record<string, unknown> | null>(null)\n  const onPageMetadata = useCallback((metadata: Record<string, unknown>) => {\n    pageMetadataRef.current = metadata\n  }, [])\n\n  // Children render FIRST and are never re-parented. Siblings accumulate after.\n  const siblings: ReactNode[] = []\n\n  // SignalBridge — childless sibling (4.0: useSignal reads the module store,\n  // so it no longer needs to wrap anything). Not gated on modulesReady:\n  // experiment variants must apply as early as possible.\n  if (signal) {\n    const signalConfig: SignalConfig =\n      typeof signal === 'object' ? signal : {}\n    siblings.push(\n      <SignalBridge\n        key=\"sk-signal\"\n        enabled\n        realtime={signalConfig.realtime !== false}\n        experiments={signalConfig.experiments !== false}\n        behaviorTracking={signalConfig.behaviorTracking !== false}\n        visitorId={visitorId}\n        sessionId={sessionId}\n        pageMetadataRef={pageMetadataRef}\n      />,\n    )\n  }\n\n  // Add Analytics if enabled (renders alongside, doesn't wrap).\n  //\n  // CRITICAL: LazyAnalyticsProvider is dynamic(..., { ssr: false }). Wrapping\n  // {content} inside an ssr:false component makes the entire page tree skip\n  // server rendering — the route de-opts to 100% client rendering and the\n  // hero / LCP element only paints after hydration (mobile LCP ~4s, Lighthouse\n  // ~85). Analytics tracks via effects + a metadata ref, so it never needs to\n  // wrap page content — mount it as a childless sibling, exactly like Engage.\n  // Each deferred sibling is appended as `{modulesReady && <Module/>}` so the\n  // children slot never moves in the tree — flipping ready only mounts the\n  // sibling, it never remounts page content.\n  if (analytics) {\n    siblings.push(\n      <React.Fragment key=\"sk-analytics\">\n        {modulesReady && (\n          <Suspense fallback={null}>\n            <LazyAnalyticsProvider\n              apiUrl={apiUrl}\n              apiKey={apiKey}\n              site={site}\n              trackPageViews={analyticsConfig.trackPageViews !== false}\n              trackWebVitals={analyticsConfig.trackWebVitals !== false}\n              trackScrollDepth={analyticsConfig.trackScrollDepth !== false}\n              trackClicks={analyticsConfig.trackClicks !== false}\n              sessionTimeout={analyticsConfig.sessionDuration}\n              excludePaths={analyticsConfig.excludePaths}\n              debug={debug}\n              externalVisitorId={visitorId}\n              externalSessionId={sessionId}\n              onPageMetadata={onPageMetadata}\n            />\n          </Suspense>\n        )}\n      </React.Fragment>,\n    )\n  }\n\n  // Engage widget — childless sibling\n  if (engage) {\n    const engageConfig: EngageConfig =\n      typeof engage === 'object' ? engage : {}\n    siblings.push(\n      <React.Fragment key=\"sk-engage\">\n        {modulesReady && (\n          <LazyEngageWidget\n            apiUrl={apiUrl}\n            apiKey={apiKey}\n            projectId={projectId}\n            position={engageConfig.position || 'bottom-right'}\n            zIndex={engageConfig.zIndex}\n            chatEnabled={engageConfig.chatEnabled !== false}\n          />\n        )}\n      </React.Fragment>,\n    )\n  }\n\n  // SitemapSync — childless sibling\n  if (sitemapSync) {\n    siblings.push(\n      <React.Fragment key=\"sk-sitemap\">\n        {modulesReady && <LazySitemapSync debug={debug} />}\n      </React.Fragment>,\n    )\n  }\n\n  // Fleet heartbeat — childless sibling on the same modulesReady idle gate.\n  // Reports the modules actually enabled on THIS layout (honest client-observable\n  // set) so the platform can answer \"which version / modules is each site\n  // running\". defer={false}: the modulesReady gate already handled deferral, so\n  // the heartbeat fires on mount (still bounded to once per session internally).\n  if (fleet) {\n    const activeModules: FleetModule[] = []\n    if (analytics) activeModules.push('analytics')\n    if (engage) activeModules.push('engage')\n    if (signal) activeModules.push('signal')\n    if (sitemapSync) activeModules.push('sitemapSync')\n    siblings.push(\n      <React.Fragment key=\"sk-fleet\">\n        {modulesReady && (\n          <FleetHeartbeat\n            apiUrl={apiUrl}\n            apiKey={apiKey}\n            site={site}\n            modules={activeModules}\n            defer={false}\n            debug={debug}\n          />\n        )}\n      </React.Fragment>,\n    )\n  }\n\n  return (\n    <>\n      {children}\n      {siblings}\n    </>\n  )\n}\n"]}

package/dist/{chunk-UDXWBLBH.js → chunk-6ABCPVJL.js}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkT6YDAJ5F_js = require('./chunk-T6YDAJ5F.js');
+var chunkCQWG5ICB_js = require('./chunk-CQWG5ICB.js');
 var jsxRuntime = require('react/jsx-runtime');
 
 function HoneypotField({ name, value, onChange }) {
@@ -46,7 +46,7 @@ function nativeEligible(config) {
 }
 function nativeFormProps(config) {
   if (!nativeEligible(config)) return {};
-  const { apiUrl } = chunkT6YDAJ5F_js.getApiConfig();
+  const { apiUrl } = chunkCQWG5ICB_js.getApiConfig();
   return { action: `${apiUrl}/api/public/forms/submit-native`, method: "post" };
 }
 function NativeFallbackFields({ config, returnTo }) {
@@ -60,5 +60,5 @@ function NativeFallbackFields({ config, returnTo }) {
 exports.HoneypotField = HoneypotField;
 exports.NativeFallbackFields = NativeFallbackFields;
 exports.nativeFormProps = nativeFormProps;
-//# sourceMappingURL=chunk-UDXWBLBH.js.map
-//# sourceMappingURL=chunk-UDXWBLBH.js.map
+//# sourceMappingURL=chunk-6ABCPVJL.js.map
+//# sourceMappingURL=chunk-6ABCPVJL.js.map

package/dist/{chunk-UDXWBLBH.js.map → chunk-6ABCPVJL.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/forms/HoneypotField.tsx","../src/forms/native-fallback.tsx"],"names":["jsx","getApiConfig","jsxs","Fragment"],"mappings":";;;;;AAqCO,SAAS,aAAA,CAAc,EAAE,IAAA,EAAM,KAAA,EAAO,UAAS,EAAuB;AAC3E,EAAA,MAAM,WAAA,GAAc,OAAO,QAAA,KAAa,UAAA;AACxC,EAAA,uBACEA,cAAA;AAAA,IAAC,OAAA;AAAA,IAAA;AAAA,MACC,IAAA,EAAK,MAAA;AAAA,MACL,IAAA;AAAA,MACA,QAAA,EAAU,EAAA;AAAA,MACV,YAAA,EAAa,cAAA;AAAA,MACb,aAAA,EAAY,MAAA;AAAA,MACZ,KAAA,EAAK,IAAA;AAAA,MACL,kBAAA,EAAiB,EAAA;AAAA,MAGjB,gBAAA,EAAe,EAAA;AAAA,MACf,eAAA,EAAc,MAAA;AAAA,MACd,gBAAA,EAAe,OAAA;AAAA,MACf,eAAA,EAAc,EAAA;AAAA,MACd,KAAA,EAAO;AAAA,QACL,QAAA,EAAU,UAAA;AAAA,QACV,IAAA,EAAM,KAAA;AAAA,QACN,KAAA,EAAO,CAAA;AAAA,QACP,MAAA,EAAQ,CAAA;AAAA,QACR,QAAA,EAAU,QAAA;AAAA,QACV,OAAA,EAAS,CAAA;AAAA,QACT,UAAA,EAAY,QAAA;AAAA,QACZ,aAAA,EAAe;AAAA,OACjB;AAAA,MACC,GAAI,WAAA,GACD;AAAA,QACE,OAAO,KAAA,IAAS,EAAA;AAAA,QAChB,QAAA,EAAU,CAAC,CAAA,KAA2C;AACpD,UAAA,QAAA,CAAU,CAAA,CAAE,OAAO,KAAK,CAAA;AACxB,UAAA,IAAI,CAAA,CAAE,OAAO,KAAA,EAAO;AAElB,YAAA,OAAA,CAAQ,KAAK,4BAA4B,CAAA;AAAA,UAC3C;AAAA,QACF;AAAA,OACF,GACA,EAAE,YAAA,EAAc,EAAA;AAAG;AAAA,GACzB;AAEJ;ACjDA,SAAS,eAAe,MAAA,EAAuD;AAC7E,EAAA,OAAO,CAAC,CAAC,MAAA,EAAQ,YAAA,IAAgB,CAAC,MAAA,CAAO,aAAA;AAC3C;AAGO,SAAS,gBACd,MAAA,EACsC;AACtC,EAAA,IAAI,CAAC,cAAA,CAAe,MAAM,CAAA,SAAU,EAAC;AACrC,EAAA,MAAM,EAAE,MAAA,EAAO,GAAIC,6BAAA,EAAa;AAChC,EAAA,OAAO,EAAE,MAAA,EAAQ,CAAA,EAAG,MAAM,CAAA,+BAAA,CAAA,EAAmC,QAAQ,MAAA,EAAO;AAC9E;AAaO,SAAS,oBAAA,CAAqB,EAAE,MAAA,EAAQ,QAAA,EAAS,EAA8B;AACpF,EAAA,IAAI,CAAC,cAAA,CAAe,MAAM,CAAA,EAAG,OAAO,IAAA;AACpC,EAAA,uBACEC,eAAA,CAAAC,mBAAA,EAAA,EACE,QAAA,EAAA;AAAA,oBAAAH,cAAAA,CAAC,OAAA,EAAA,EAAM,IAAA,EAAK,QAAA,EAAS,IAAA,EAAK,aAAY,KAAA,EAAO,MAAA,CAAQ,YAAA,EAAc,QAAA,EAAQ,IAAA,EAAC,CAAA;AAAA,IAC3E,QAAA,mBAAWA,cAAAA,CAAC,OAAA,EAAA,EAAM,IAAA,EAAK,QAAA,EAAS,IAAA,EAAK,YAAA,EAAa,KAAA,EAAO,QAAA,EAAU,QAAA,EAAQ,IAAA,EAAC,CAAA,GAAK;AAAA,GAAA,EACpF,CAAA;AAEJ","file":"chunk-UDXWBLBH.js","sourcesContent":["/**\n * Single source of truth for the honeypot input — rendered by BOTH form\n * experiences (classic and stage) inside their <form>. The customRender path\n * deliberately gets none (documented limitation: custom renders lose the\n * honeypot, which is why alternate experiences must be render branches).\n *\n * Invariants (do not weaken any of these):\n * - `inert` blocks focus/interaction at the browser level, surviving hostile\n *   site CSS that could defeat the inline styles.\n * - data-sk-honeypot gives site CSS a stable opt-OUT hook.\n * - Controlled input: bots filling via JS still fire React onChange, so the\n *   value reaches submitForm's data payload.\n * - Name comes from config (`honeypot_field || DEFAULT_HONEYPOT_FIELD` from\n *   the shared contract) — resolved by the caller, never forked here.\n * - The trap must be invisible to AUTOFILL as well as to people. A browser or\n *   password manager filling a hidden input flags a real visitor as a bot, and\n *   because the value is stripped server-side the mistake is undiagnosable\n *   after the fact. `autocomplete=\"off\"` does not achieve this — it is the one\n *   value Chrome deliberately ignores for contact/address autofill — so the\n *   trap declares `new-password` (never offered saved contact data) plus the\n *   documented per-manager opt-outs.\n */\n\nimport React from 'react'\n\nexport interface HoneypotFieldProps {\n  name: string\n  value?: string\n  /**\n   * Omit for STATIC mode — an uncontrolled trap a Server Component can render.\n   * The trap's whole job is server-side (the value is read off the submission\n   * and stripped), so it needs no client state to work; the controlled form is\n   * only so the hydrated JSON path can read it back out of React state.\n   */\n  onChange?: (value: string) => void\n}\n\nexport function HoneypotField({ name, value, onChange }: HoneypotFieldProps) {\n  const interactive = typeof onChange === 'function'\n  return (\n    <input\n      type=\"text\"\n      name={name}\n      tabIndex={-1}\n      autoComplete=\"new-password\"\n      aria-hidden=\"true\"\n      inert\n      data-sk-honeypot=\"\"\n      // Password-manager opt-outs: 1Password, LastPass, Dashlane, Bitwarden.\n      // Each ignores its own attribute; none respects autocomplete alone.\n      data-1p-ignore=\"\"\n      data-lpignore=\"true\"\n      data-form-type=\"other\"\n      data-bwignore=\"\"\n      style={{\n        position: 'absolute',\n        left: -9999,\n        width: 1,\n        height: 1,\n        overflow: 'hidden',\n        opacity: 0,\n        visibility: 'hidden',\n        pointerEvents: 'none',\n      }}\n      {...(interactive\n        ? {\n            value: value ?? '',\n            onChange: (e: React.ChangeEvent<HTMLInputElement>) => {\n              onChange!(e.target.value)\n              if (e.target.value) {\n                // Bot detected\n                console.warn('[Forms] Honeypot triggered')\n              }\n            },\n          }\n        : { defaultValue: '' })}\n    />\n  )\n}\n","'use client'\n\n/**\n * No-JS native submission fallback — the floor under every managed form.\n *\n * The classic form is the SSR/no-JS surface (experiences are post-hydration\n * chunks), so it alone carries a real `action`/`method` pointing at\n * sonor-api's POST /api/public/forms/submit-native. With JS running, the\n * form's onSubmit preventDefault()s and the JSON path wins; without JS the\n * browser performs an ordinary form-encoded POST and the lead still lands.\n *\n * Auth rides in the hidden `_sk_token` field: a signed, single-purpose\n * credential minted by the api-key-authenticated forms/config endpoint\n * (`native_token` in the response). No token in the config (older API, or no\n * signing secret) means no fallback — the form keeps its historical behavior\n * rather than pointing at an endpoint that will reject it.\n *\n * Multi-step forms are excluded: step navigation is JS, and a native POST of\n * step-1 fields alone fails whole-form validation server-side. Single-step\n * forms are the overwhelming lead-capture case.\n *\n * Single source of truth for the gating — the form attrs and the hidden\n * fields must always agree, so both read the same predicate.\n */\n\nimport React from 'react'\nimport type { ManagedFormConfig } from './types'\nimport { getApiConfig } from './submitForm'\n\nfunction nativeEligible(config: ManagedFormConfig | null | undefined): boolean {\n  return !!config?.native_token && !config.is_multi_step\n}\n\n/** `action`/`method` for the classic <form> — empty when ineligible. */\nexport function nativeFormProps(\n  config: ManagedFormConfig | null | undefined,\n): { action?: string; method?: 'post' } {\n  if (!nativeEligible(config)) return {}\n  const { apiUrl } = getApiConfig()\n  return { action: `${apiUrl}/api/public/forms/submit-native`, method: 'post' }\n}\n\nexport interface NativeFallbackFieldsProps {\n  config: ManagedFormConfig | null | undefined\n  /**\n   * Absolute URL the native 303 should land on (usually the page hosting the\n   * form). Optional — without it the server falls back to the Referer origin,\n   * which loses the path but still returns the visitor to the right site.\n   */\n  returnTo?: string\n}\n\n/** Hidden control fields the native endpoint reads (`_sk_*` namespace). */\nexport function NativeFallbackFields({ config, returnTo }: NativeFallbackFieldsProps) {\n  if (!nativeEligible(config)) return null\n  return (\n    <>\n      <input type=\"hidden\" name=\"_sk_token\" value={config!.native_token} readOnly />\n      {returnTo ? <input type=\"hidden\" name=\"_sk_return\" value={returnTo} readOnly /> : null}\n    </>\n  )\n}\n"]}
+{"version":3,"sources":["../src/forms/HoneypotField.tsx","../src/forms/native-fallback.tsx"],"names":["jsx","getApiConfig","jsxs","Fragment"],"mappings":";;;;;AAqCO,SAAS,aAAA,CAAc,EAAE,IAAA,EAAM,KAAA,EAAO,UAAS,EAAuB;AAC3E,EAAA,MAAM,WAAA,GAAc,OAAO,QAAA,KAAa,UAAA;AACxC,EAAA,uBACEA,cAAA;AAAA,IAAC,OAAA;AAAA,IAAA;AAAA,MACC,IAAA,EAAK,MAAA;AAAA,MACL,IAAA;AAAA,MACA,QAAA,EAAU,EAAA;AAAA,MACV,YAAA,EAAa,cAAA;AAAA,MACb,aAAA,EAAY,MAAA;AAAA,MACZ,KAAA,EAAK,IAAA;AAAA,MACL,kBAAA,EAAiB,EAAA;AAAA,MAGjB,gBAAA,EAAe,EAAA;AAAA,MACf,eAAA,EAAc,MAAA;AAAA,MACd,gBAAA,EAAe,OAAA;AAAA,MACf,eAAA,EAAc,EAAA;AAAA,MACd,KAAA,EAAO;AAAA,QACL,QAAA,EAAU,UAAA;AAAA,QACV,IAAA,EAAM,KAAA;AAAA,QACN,KAAA,EAAO,CAAA;AAAA,QACP,MAAA,EAAQ,CAAA;AAAA,QACR,QAAA,EAAU,QAAA;AAAA,QACV,OAAA,EAAS,CAAA;AAAA,QACT,UAAA,EAAY,QAAA;AAAA,QACZ,aAAA,EAAe;AAAA,OACjB;AAAA,MACC,GAAI,WAAA,GACD;AAAA,QACE,OAAO,KAAA,IAAS,EAAA;AAAA,QAChB,QAAA,EAAU,CAAC,CAAA,KAA2C;AACpD,UAAA,QAAA,CAAU,CAAA,CAAE,OAAO,KAAK,CAAA;AACxB,UAAA,IAAI,CAAA,CAAE,OAAO,KAAA,EAAO;AAElB,YAAA,OAAA,CAAQ,KAAK,4BAA4B,CAAA;AAAA,UAC3C;AAAA,QACF;AAAA,OACF,GACA,EAAE,YAAA,EAAc,EAAA;AAAG;AAAA,GACzB;AAEJ;ACjDA,SAAS,eAAe,MAAA,EAAuD;AAC7E,EAAA,OAAO,CAAC,CAAC,MAAA,EAAQ,YAAA,IAAgB,CAAC,MAAA,CAAO,aAAA;AAC3C;AAGO,SAAS,gBACd,MAAA,EACsC;AACtC,EAAA,IAAI,CAAC,cAAA,CAAe,MAAM,CAAA,SAAU,EAAC;AACrC,EAAA,MAAM,EAAE,MAAA,EAAO,GAAIC,6BAAA,EAAa;AAChC,EAAA,OAAO,EAAE,MAAA,EAAQ,CAAA,EAAG,MAAM,CAAA,+BAAA,CAAA,EAAmC,QAAQ,MAAA,EAAO;AAC9E;AAaO,SAAS,oBAAA,CAAqB,EAAE,MAAA,EAAQ,QAAA,EAAS,EAA8B;AACpF,EAAA,IAAI,CAAC,cAAA,CAAe,MAAM,CAAA,EAAG,OAAO,IAAA;AACpC,EAAA,uBACEC,eAAA,CAAAC,mBAAA,EAAA,EACE,QAAA,EAAA;AAAA,oBAAAH,cAAAA,CAAC,OAAA,EAAA,EAAM,IAAA,EAAK,QAAA,EAAS,IAAA,EAAK,aAAY,KAAA,EAAO,MAAA,CAAQ,YAAA,EAAc,QAAA,EAAQ,IAAA,EAAC,CAAA;AAAA,IAC3E,QAAA,mBAAWA,cAAAA,CAAC,OAAA,EAAA,EAAM,IAAA,EAAK,QAAA,EAAS,IAAA,EAAK,YAAA,EAAa,KAAA,EAAO,QAAA,EAAU,QAAA,EAAQ,IAAA,EAAC,CAAA,GAAK;AAAA,GAAA,EACpF,CAAA;AAEJ","file":"chunk-6ABCPVJL.js","sourcesContent":["/**\n * Single source of truth for the honeypot input — rendered by BOTH form\n * experiences (classic and stage) inside their <form>. The customRender path\n * deliberately gets none (documented limitation: custom renders lose the\n * honeypot, which is why alternate experiences must be render branches).\n *\n * Invariants (do not weaken any of these):\n * - `inert` blocks focus/interaction at the browser level, surviving hostile\n *   site CSS that could defeat the inline styles.\n * - data-sk-honeypot gives site CSS a stable opt-OUT hook.\n * - Controlled input: bots filling via JS still fire React onChange, so the\n *   value reaches submitForm's data payload.\n * - Name comes from config (`honeypot_field || DEFAULT_HONEYPOT_FIELD` from\n *   the shared contract) — resolved by the caller, never forked here.\n * - The trap must be invisible to AUTOFILL as well as to people. A browser or\n *   password manager filling a hidden input flags a real visitor as a bot, and\n *   because the value is stripped server-side the mistake is undiagnosable\n *   after the fact. `autocomplete=\"off\"` does not achieve this — it is the one\n *   value Chrome deliberately ignores for contact/address autofill — so the\n *   trap declares `new-password` (never offered saved contact data) plus the\n *   documented per-manager opt-outs.\n */\n\nimport React from 'react'\n\nexport interface HoneypotFieldProps {\n  name: string\n  value?: string\n  /**\n   * Omit for STATIC mode — an uncontrolled trap a Server Component can render.\n   * The trap's whole job is server-side (the value is read off the submission\n   * and stripped), so it needs no client state to work; the controlled form is\n   * only so the hydrated JSON path can read it back out of React state.\n   */\n  onChange?: (value: string) => void\n}\n\nexport function HoneypotField({ name, value, onChange }: HoneypotFieldProps) {\n  const interactive = typeof onChange === 'function'\n  return (\n    <input\n      type=\"text\"\n      name={name}\n      tabIndex={-1}\n      autoComplete=\"new-password\"\n      aria-hidden=\"true\"\n      inert\n      data-sk-honeypot=\"\"\n      // Password-manager opt-outs: 1Password, LastPass, Dashlane, Bitwarden.\n      // Each ignores its own attribute; none respects autocomplete alone.\n      data-1p-ignore=\"\"\n      data-lpignore=\"true\"\n      data-form-type=\"other\"\n      data-bwignore=\"\"\n      style={{\n        position: 'absolute',\n        left: -9999,\n        width: 1,\n        height: 1,\n        overflow: 'hidden',\n        opacity: 0,\n        visibility: 'hidden',\n        pointerEvents: 'none',\n      }}\n      {...(interactive\n        ? {\n            value: value ?? '',\n            onChange: (e: React.ChangeEvent<HTMLInputElement>) => {\n              onChange!(e.target.value)\n              if (e.target.value) {\n                // Bot detected\n                console.warn('[Forms] Honeypot triggered')\n              }\n            },\n          }\n        : { defaultValue: '' })}\n    />\n  )\n}\n","'use client'\n\n/**\n * No-JS native submission fallback — the floor under every managed form.\n *\n * The classic form is the SSR/no-JS surface (experiences are post-hydration\n * chunks), so it alone carries a real `action`/`method` pointing at\n * sonor-api's POST /api/public/forms/submit-native. With JS running, the\n * form's onSubmit preventDefault()s and the JSON path wins; without JS the\n * browser performs an ordinary form-encoded POST and the lead still lands.\n *\n * Auth rides in the hidden `_sk_token` field: a signed, single-purpose\n * credential minted by the api-key-authenticated forms/config endpoint\n * (`native_token` in the response). No token in the config (older API, or no\n * signing secret) means no fallback — the form keeps its historical behavior\n * rather than pointing at an endpoint that will reject it.\n *\n * Multi-step forms are excluded: step navigation is JS, and a native POST of\n * step-1 fields alone fails whole-form validation server-side. Single-step\n * forms are the overwhelming lead-capture case.\n *\n * Single source of truth for the gating — the form attrs and the hidden\n * fields must always agree, so both read the same predicate.\n */\n\nimport React from 'react'\nimport type { ManagedFormConfig } from './types'\nimport { getApiConfig } from './submitForm'\n\nfunction nativeEligible(config: ManagedFormConfig | null | undefined): boolean {\n  return !!config?.native_token && !config.is_multi_step\n}\n\n/** `action`/`method` for the classic <form> — empty when ineligible. */\nexport function nativeFormProps(\n  config: ManagedFormConfig | null | undefined,\n): { action?: string; method?: 'post' } {\n  if (!nativeEligible(config)) return {}\n  const { apiUrl } = getApiConfig()\n  return { action: `${apiUrl}/api/public/forms/submit-native`, method: 'post' }\n}\n\nexport interface NativeFallbackFieldsProps {\n  config: ManagedFormConfig | null | undefined\n  /**\n   * Absolute URL the native 303 should land on (usually the page hosting the\n   * form). Optional — without it the server falls back to the Referer origin,\n   * which loses the path but still returns the visitor to the right site.\n   */\n  returnTo?: string\n}\n\n/** Hidden control fields the native endpoint reads (`_sk_*` namespace). */\nexport function NativeFallbackFields({ config, returnTo }: NativeFallbackFieldsProps) {\n  if (!nativeEligible(config)) return null\n  return (\n    <>\n      <input type=\"hidden\" name=\"_sk_token\" value={config!.native_token} readOnly />\n      {returnTo ? <input type=\"hidden\" name=\"_sk_return\" value={returnTo} readOnly /> : null}\n    </>\n  )\n}\n"]}

package/dist/{chunk-SACGTFCK.js → chunk-6CJP7BFM.js}

@@ -195,5 +195,5 @@ exports.OG_WIDTH = OG_WIDTH;
 exports.TITLE_MAX_PX = TITLE_MAX_PX;
 exports.buildOgHtml = buildOgHtml;
 exports.defineOgCard = defineOgCard;
-//# sourceMappingURL=chunk-SACGTFCK.js.map
-//# sourceMappingURL=chunk-SACGTFCK.js.map
+//# sourceMappingURL=chunk-6CJP7BFM.js.map
+//# sourceMappingURL=chunk-6CJP7BFM.js.map

package/dist/chunk-6CJP7BFM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/og/config.ts","../src/og/template.ts"],"names":[],"mappings":";;;AAoIO,SAAS,aAAa,MAAA,EAAoC;AAC/D,EAAA,OAAO,MAAA;AACT;AAEO,IAAM,QAAA,GAAW;AACjB,IAAM,SAAA,GAAY;AAWlB,IAAM,YAAA,GAAe;AACrB,IAAM,YAAA,GAAe,EAAA;AAOrB,IAAM,cAAA,GAAiB;;;ACvH9B,SAAS,SAAA,GAAoB;AAC3B,EAAA,OAAO,CAAA;AAAA;AAAA,sCAAA,EAE+B,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAAA,EAmBjC,YAAY,CAAA;AAAA,oBAAA,EACT,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA,iCAAA,EAQC,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA,4BAAA,EAIjB,YAAY,CAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mCAAA,EA2BL,SAAS,CAAA;AAAA,kDAAA,EACM,SAAS,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yCAAA,EAOlB,cAAc,CAAA;AAAA;AAAA,SAAA,CAAA;AAGzD;AAEA,SAAS,IAAI,CAAA,EAAmB;AAC9B,EAAA,OAAO,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA;AAC5E;AAEA,SAAS,SAAS,MAAA,EAA8B;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,EAAO,MAAA,GACxB,OAAO,KAAA,GACP,CAAC,EAAE,MAAA,EAAQ,kBAAA,EAAoB,OAAA,EAAS,CAAC,GAAG,GAAG,CAAA;AACnD,EAAA,MAAM,QAAA,GAAW,MACd,GAAA,CAAI,CAAA,CAAA,KAAK,UAAU,CAAA,CAAE,MAAA,CAAO,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC,UAAU,CAAA,CAAE,OAAA,IAAW,CAAC,GAAG,CAAA,EAAG,IAAA,CAAK,GAAG,CAAC,CAAA,CAAE,CAAA,CACvF,IAAA,CAAK,GAAG,CAAA;AACX,EAAA,OAAO,iDAAiD,QAAQ,CAAA,iCAAA,CAAA;AAClE;AAEA,SAAS,cAAc,MAAA,EAA8B;AACnD,EAAA,OAAO,MAAA,CAAO,KAAA,GAAQ,CAAC,CAAA,EAAG,MAAA,IAAU,kBAAA;AACtC;AAEA,SAAS,WAAW,MAAA,EAA8B;AAChD,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,IAAS,EAAC;AAC/B,EAAA,OAAO,KAAA,CAAM,MAAA,GAAS,CAAA,GAAI,KAAA,CAAM,KAAA,CAAM,SAAS,CAAC,CAAA,CAAE,MAAA,GAAS,aAAA,CAAc,MAAM,CAAA;AACjF;AAEA,SAAS,MAAM,KAAA,EAAwB;AACrC,EAAA,OAAO,KAAA,CAAM,SAAS,KAAA,CAAM,IAAA;AAC9B;AAEA,SAAS,iBAAiB,MAAA,EAA8B;AACtD,EAAA,IAAI,CAAC,MAAA,CAAO,UAAA,EAAY,OAAO,EAAA;AAC/B,EAAA,MAAM,EAAE,KAAA,EAAO,IAAA,GAAO,CAAA,EAAG,KAAA,KAAU,MAAA,CAAO,UAAA;AAC1C,EAAA,OAAO;AAAA,4BAAA,EACqB,GAAA,CAAI,KAAK,CAAC,CAAA,qBAAA,EAAwB,IAAI,CAAA;AAAA,EAAA,EAChE,QAAQ,CAAA,qCAAA,EAAwC,GAAA,CAAI,KAAK,CAAC,aAAa,EAAE,CAAA,CAAA;AAC7E;AAEA,SAAS,OAAA,CAAQ,SAAoB,KAAA,EAAwB;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,EAAK,MAAA,EAAQ,OAAO,EAAA;AACjC,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAClB,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,MAAA,EAAS,GAAA,CAAI,CAAC,CAAC,CAAA,OAAA,CAAS,CAAA,CACjC,IAAA,CAAK,2BAA2B,CAAA;AACnC,EAAA,OAAO,sCAAsC,GAAA,CAAI,KAAA,CAAM,MAAM,CAAC,KAAK,IAAI,CAAA,MAAA,CAAA;AACzE;AAEA,SAAS,SAAS,MAAA,EAA8B;AAC9C,EAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAM,GAAI,MAAA;AAC3B,EAAA,MAAM,YAAY,GAAA,CAAI,OAAA,CAAQ,KAAK,CAAA,CAAE,OAAA,CAAQ,OAAO,MAAM,CAAA;AAK1D,EAAA,MAAM,IAAA,GACJ,MAAA,CAAO,IAAA,IAAA,CAAS,MAAA,CAAO,WAAW,MAAA,CAAO,IAAA,GAAO,YAAA,GAAe,QAAA,CAAA,MAAe,UAC1E,CAAA,uBAAA,EAA0B,GAAA,CAAI,MAAA,CAAO,IAAI,CAAC,CAAA,EAAA,CAAA,GAC1C,EAAA;AACN,EAAA,OAAO;AAAA;AAAA,MAAA,EAED,IAAI;AAAA,MAAA,EACJ,OAAA,CAAQ,SAAS,CAAA,oBAAA,EAAuB,GAAA,CAAI,QAAQ,MAAM,CAAC,WAAW,EAAE;AAAA,UAAA,EACpE,SAAS,CAAA;AAAA,MAAA,EACb,OAAA,CAAQ,QAAA,GAAW,CAAA,8BAAA,EAAiC,GAAA,CAAI,MAAM,KAAK,CAAC,CAAC,CAAA,EAAA,EAAK,GAAA,CAAI,OAAA,CAAQ,QAAQ,CAAC,WAAW,EAAE;AAAA,MAAA,EAC5G,OAAA,CAAQ,IAAA,GAAO,CAAA,sCAAA,EAAyC,GAAA,CAAI,WAAW,MAAM,CAAC,CAAC,CAAA,WAAA,EAAc,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAC,WAAW,EAAE;AAAA,UAAA,CAAA;AAEnI;AAEO,SAAS,YAAY,MAAA,EAA8B;AACxD,EAAA,IAAI,MAAA,CAAO,IAAA,EAAM,OAAO,MAAA,CAAO,IAAA;AAC/B,EAAA,IAAI,OAAO,QAAA,EAAU;AACnB,IAAA,OAAO,MAAA,CAAO,SAAS,MAAA,EAAQ;AAAA,MAC7B,GAAA;AAAA,MACA,QAAA,EAAU,SAAS,MAAM,CAAA;AAAA,MACzB,KAAA,EAAO,QAAA;AAAA,MACP,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,EAAE,KAAA,EAAO,IAAA,EAAM,SAAS,IAAA,GAAO,YAAA,GAAe,UAAS,GAAI,MAAA;AACjE,EAAA,MAAM,OAAA,GAAU,cAAc,MAAM,CAAA;AAEpC,EAAA,MAAM,KAAA,GAAQ,IAAA,GACV,CAAA,qCAAA,EAAwC,GAAA,CAAI,KAAA,CAAM,OAAO,CAAC,CAAA,YAAA,EAAe,GAAA,CAAI,IAAI,CAAC,CAAA,QAAA,CAAA,GAClF,EAAA;AAEJ,EAAA,MAAM,QAAQ,MAAA,CAAO,KAAA,GACjB,wCAAwC,MAAA,CAAO,KAAA,CAAM,SAAS,GAAG,CAAA,iBAAA,EAAoB,OAAO,KAAA,CAAM,MAAA,IAAU,EAAE,CAAA,cAAA,EAAiB,GAAA,CAAI,OAAO,KAAA,CAAM,GAAG,CAAC,CAAA,QAAA,CAAA,GACpJ,EAAA;AAEJ,EAAA,MAAM,IAAA,GACJ,MAAA,KAAW,UAAA,GACP,CAAA,2BAAA,EAA8B,KAAK,CAAA,EAAG,QAAA,CAAS,MAAM,CAAC,CAAA,MAAA,CAAA,GACtD,MAAA,KAAW,QAAA,GACT,CAAA,yBAAA,EAA4B,SAAS,MAAM,CAAC,CAAA,MAAA,CAAA,GAC5C,MAAA,KAAW,OAAA,GACT,CAAA,kBAAA,EAAqB,QAAA,CAAS,MAAM,CAAC,CAAA,EAAG,KAAK,CAAA,MAAA,CAAA,GAC7C,CAAA,kBAAA,EAAqB,KAAA,IAAS,KAAK,CAAA,EAAG,QAAA,CAAS,MAAM,CAAC,CAAA,MAAA,CAAA;AAEhE,EAAA,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA,EAIP,QAAA,CAAS,MAAM,CAAC;AAAA;AAAA;AAAA,oBAAA,EAGI,QAAQ,cAAc,SAAS,CAAA;AAAA,uCAAA,EACZ,MAAM,EAAE,CAAA,eAAA,EAAkB,OAAO,CAAA,oBAAA,EAAuB,MAAM,IAAI,CAAA;AAAA;AAAA;AAAA;AAAA,qGAAA,EAIJ,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAA,GAAS,SAAS,GAAG,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mGAAA,EAY3C,MAAM,MAAM,CAAA;AAAA;AAAA,4DAAA,EAEnD,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+FAAA,EAKuB,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ5G,gBAAA,CAAiB,MAAM,CAAC;AAAA,EACxB,IAAI;AAAA,EACJ,OAAA,CAAQ,MAAA,CAAO,OAAA,EAAS,KAAK,CAAC;AAAA,EAC9B,WAAW;AAAA,cAAA,CAAA;AAEb","file":"chunk-6CJP7BFM.js","sourcesContent":["/**\n * @sonordev/site-kit/og — OG card config contract.\n *\n * THE SITE OWNS THE THEME. Sonor stores one brand_primary/secondary per\n * project; real sites have full palettes (Ludlow: red, ink, cream, scrim —\n * four tokens where Sonor stores two). So the card's colors, fonts, and\n * layout come from a repo-owned og.config.ts, typically importing the same\n * constants the site itself uses. Sonor brand data is only the zero-config\n * seed used by `sonor-setup og` when no og.config.ts exists.\n *\n * Rendering is BUILD-TIME via headless Chrome (`sonor-setup og`), writing a\n * static public/og.png: full real CSS (no Satori subset), Google Fonts load\n * in the template (no font vendoring), zero runtime cost — the right shape\n * for a force-static fleet. Per-entity runtime cards are a future tier.\n */\n\nexport interface OgTheme {\n  /** Page background behind everything. */\n  bg: string\n  /** Primary text color. */\n  text: string\n  /** Accent (kicker, bar). */\n  accent: string\n  /** Plate/surface color behind the logo. */\n  surface: string\n  /** Muted text (subtitle). Defaults derived from `text` when omitted. */\n  muted?: string\n}\n\nexport interface OgFont {\n  /** Google Fonts family name, e.g. 'Barlow Condensed'. */\n  family: string\n  weights?: number[]\n}\n\nexport interface OgBackground {\n  /** Path under public/, e.g. '/hero-frost.avif'. */\n  image: string\n  /** CSS blur radius in px. */\n  blur?: number\n  /** Overlay color, e.g. 'rgba(17,17,16,.68)'. */\n  scrim?: string\n}\n\nexport interface OgPhoto {\n  /** Path under public/ ('/team.jpg') or an absolute https URL. */\n  src: string\n  /** Pane width in px (default 430). */\n  width?: number\n  /** Corner radius in px (default 24). */\n  radius?: number\n}\n\nexport interface OgContent {\n  /** Small all-caps line above the title. */\n  kicker?: string\n  /** The big line. `\\n` for a manual break. Keep it short — previews truncate. */\n  title: string\n  /** One supporting line. */\n  subtitle?: string\n  /** Handwritten-style accent line (rendered in the last configured font). */\n  hand?: string\n  /** Bottom bar segments, e.g. ['Give an hour', 'ludlowpto.org']. */\n  bar?: string[]\n}\n\n/**\n * A per-route entry in `cards`. Layered over the derived card, so it only\n * states what differs — including inside `content`: a route can override just\n * the subtitle and keep the title Sonor derived. The runtime always merged\n * field by field; this type used to demand a full OgContent, which forced\n * casts in every site that used the documented pattern.\n */\nexport type OgCardOverride = Partial<Omit<OgCardConfig, 'cards' | 'content'>> & {\n  content?: Partial<OgContent>\n}\n\nexport interface OgCardConfig {\n  theme: OgTheme\n  /** First font = display face, second (optional) = hand/accent face. */\n  fonts?: OgFont[]\n  /** Path under public/ to the logo shown on the plate, e.g. '/logo-mark.svg'. */\n  logo?: string\n  background?: OgBackground\n  /**\n   * 'plate-left': logo plate left, copy right (the Ludlow layout).\n   * 'centered': stacked, logo above title.\n   * 'banner': no plate, full-bleed copy.\n   * 'split': copy left, content photo right — for cards that show the page's\n   *   own imagery (a project photo, a product, the storefront).\n   */\n  layout?: 'plate-left' | 'centered' | 'banner' | 'split'\n  /** Content photo for the 'split' layout (also rendered in 'plate-left' when set, replacing the plate). */\n  photo?: OgPhoto\n  content: OgContent\n  /**\n   * Per-page overrides, keyed by route path (`/services/garage`) or its slug\n   * (`services-garage`). Every static route already gets its own card built\n   * from its managed title and description; this is for the handful worth\n   * writing by hand — a campaign landing page, the flagship service.\n   *\n   * A dynamic route is keyed by its pattern, one `*` per dynamic level:\n   * `/services/*` for `[slug]`, plus another star for each nested `[param]`\n   * (slug form `services-any`, `services-any-any`). Nested patterns are worth\n   * writing by hand — they all derive from the same static ancestor otherwise.\n   * `sonor-setup og` warns about any key that matches no route.\n   *\n   * Each entry is layered over the site card, so it only states what differs.\n   * Build-time only: never rendered as part of a card.\n   */\n  cards?: Record<string, OgCardOverride>\n  /**\n   * MIDDLE escape hatch: keep the loader/renderer/verifier pipeline but\n   * produce your own document. Receives the config and the same helpers the\n   * stock template uses (esc, fontLink). Root-relative src attributes are\n   * still rewritten to public/ files automatically.\n   */\n  template?: (config: OgCardConfig, helpers: OgTemplateHelpers) => string\n  /** FULL escape hatch: raw HTML replaces everything, no helpers. */\n  html?: string\n}\n\nexport interface OgTemplateHelpers {\n  /** HTML-escape user text. */\n  esc: (s: string) => string\n  /** <link> tag loading the config's Google Fonts. */\n  fontLink: string\n  width: number\n  height: number\n}\n\n/** Identity helper for typed configs: `export default defineOgCard({...})`. */\nexport function defineOgCard(config: OgCardConfig): OgCardConfig {\n  return config\n}\n\nexport const OG_WIDTH = 1200\nexport const OG_HEIGHT = 630\n\n/**\n * Title type scale. The card opens at TITLE_MAX and the in-page fitter steps\n * down until the copy column fits, stopping at TITLE_MIN.\n *\n * The floor is a legibility floor, not a layout one: below ~56px the headline\n * stops reading at the ~300px thumbnail width platforms actually show. A card\n * that would need to go under it is a card whose copy is too long, so the\n * renderer reports that rather than shrinking into mush.\n */\nexport const TITLE_MAX_PX = 104\nexport const TITLE_MIN_PX = 56\n\n/**\n * The attribute the in-page fitter writes its findings to, read back by\n * `sonor-setup og` via Chrome's --dump-dom. Shared so the template and the CLI\n * cannot drift on the name.\n */\nexport const OG_REPORT_ATTR = 'data-og-report'\n\n/** What the in-page fitter reports back about a rendered card. */\nexport interface OgRenderReport {\n  /** Did everything land inside the frame, at or above the legibility floor? */\n  fits: boolean\n  /** Final title size after fitting. Below TITLE_MAX means the copy ran long. */\n  titlePx: number\n  /** Human-readable problems, each naming the element and the overflow. */\n  issues: string[]\n}\n","/**\n * OG card HTML template builder.\n *\n * Turns an OgCardConfig into a self-contained 1200x630 HTML document rendered\n * by headless Chrome. Layout rules baked in from the Ludlow card:\n * - content held inside the middle ~80% (platforms crop toward 2:1 and the\n *   bottom bar is the first casualty)\n * - script/hand faces never below 40px — under that they turn to mush at\n *   iMessage thumbnail width (~300px)\n * - the plate + title must survive alone if everything else is cropped\n */\n\nimport type { OgCardConfig, OgContent, OgTheme } from './config'\nimport {\n  OG_WIDTH,\n  OG_HEIGHT,\n  TITLE_MAX_PX,\n  TITLE_MIN_PX,\n  OG_REPORT_ATTR,\n} from './config'\n\n/**\n * The in-page fitter. Runs inside the render, after webfonts settle, and does\n * the two things a Node-side template cannot:\n *\n *  1. FITS THE TITLE. The h1 opens at TITLE_MAX_PX and steps down until the\n *     copy column fits the frame. Before this the size was fixed, so title\n *     length silently decided whether a card worked — a long one did not\n *     shrink, it pushed the kicker off the top and the subtitle under the\n *     bottom bar, and the CLI still reported success.\n *  2. MEASURES WHAT IS LEFT. Anything still clipped is written to the report\n *     attribute, which `sonor-setup og` reads back through --dump-dom and\n *     turns into a failure. Real measurement, not a character-count estimate.\n *\n * Fonts matter: measuring before `document.fonts.ready` measures the fallback\n * face and produces a size that is wrong for the face that actually renders.\n */\nfunction fitScript(): string {\n  return `<script>\n(async function () {\n  var report = { fits: true, titlePx: ${TITLE_MAX_PX}, issues: [] };\n  function push(msg) { report.fits = false; report.issues.push(msg); }\n  try {\n    try { await document.fonts.ready; } catch (e) {}\n    var h1 = document.querySelector('h1');\n    var copy = document.querySelector('.copy');\n    var wrap = document.querySelector('.wrap');\n    var bar = document.querySelector('.bar');\n\n    if (h1 && copy && wrap) {\n      var cs = getComputedStyle(wrap);\n      var avail = wrap.clientHeight - parseFloat(cs.paddingTop || '0') - parseFloat(cs.paddingBottom || '0');\n\n      // Fit BOTH axes. Height alone is not enough: a single long word\n      // (\"WORKBENCHES\") cannot wrap, so it keeps overflowing the column\n      // sideways at a size that fits vertically. Shrinking for either\n      // condition is what makes an arbitrary managed title safe to render.\n      var tooTall = function () { return copy.scrollHeight > avail; };\n      var tooWide = function () { return h1.scrollWidth > copy.clientWidth + 1; };\n      var size = ${TITLE_MAX_PX};\n      while (size > ${TITLE_MIN_PX} && (tooTall() || tooWide())) {\n        size -= 2;\n        h1.style.fontSize = size + 'px';\n      }\n      report.titlePx = size;\n\n      if (tooTall()) {\n        push('title/subtitle block overflows the card by ' + Math.ceil(copy.scrollHeight - avail) +\n             'px even at the ' + ${TITLE_MIN_PX} + 'px legibility floor - shorten content.title or content.subtitle');\n      }\n      if (tooWide()) {\n        push('the longest title word still overflows the copy column by ' + Math.ceil(h1.scrollWidth - copy.clientWidth) +\n             'px at the ' + ${TITLE_MIN_PX} + 'px floor - shorten it or add a line break');\n      }\n    }\n\n    // The bar is checked on BOTH axes. Width alone missed a real failure: a\n    // long segment wrapped INSIDE its span, so scrollWidth never exceeded\n    // clientWidth while the text grew past the bar's fixed height and spilled\n    // over the subtitle. Segments are nowrap now, which turns that into\n    // horizontal overflow the width check sees, and the height check is the\n    // belt-and-braces for anything else that grows the bar.\n    if (bar) {\n      if (bar.scrollWidth > bar.clientWidth + 1) {\n        push('bottom bar content overflows by ' + Math.ceil(bar.scrollWidth - bar.clientWidth) +\n             'px - drop a content.bar segment or shorten one');\n      }\n      if (bar.scrollHeight > bar.clientHeight + 1) {\n        push('bottom bar content is ' + Math.ceil(bar.scrollHeight - bar.clientHeight) +\n             'px taller than the bar - a segment is wrapping; shorten it');\n      }\n    }\n\n    // Nothing may sit outside the frame platforms actually crop to.\n    var named = [['kicker', '.kicker'], ['title', 'h1'], ['subtitle', '.sub'], ['hand', '.hand'], ['bar', '.bar']];\n    for (var i = 0; i < named.length; i++) {\n      var el = document.querySelector(named[i][1]);\n      if (!el) continue;\n      var r = el.getBoundingClientRect();\n      if (r.top < -1 || r.bottom > ${OG_HEIGHT} + 1) {\n        push(named[i][0] + ' sits outside the ' + ${OG_HEIGHT} + 'px frame (top ' +\n             Math.round(r.top) + ', bottom ' + Math.round(r.bottom) + ')');\n      }\n    }\n  } catch (e) {\n    push('fitter failed: ' + (e && e.message ? e.message : String(e)));\n  }\n  document.documentElement.setAttribute('${OG_REPORT_ATTR}', JSON.stringify(report));\n})();\n</script>`\n}\n\nfunction esc(s: string): string {\n  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')\n}\n\nfunction fontLink(config: OgCardConfig): string {\n  const fonts = config.fonts?.length\n    ? config.fonts\n    : [{ family: 'Barlow Condensed', weights: [800] }]\n  const families = fonts\n    .map(f => `family=${f.family.replace(/ /g, '+')}:wght@${(f.weights || [700]).join(';')}`)\n    .join('&')\n  return `<link href=\"https://fonts.googleapis.com/css2?${families}&display=block\" rel=\"stylesheet\">`\n}\n\nfunction displayFamily(config: OgCardConfig): string {\n  return config.fonts?.[0]?.family || 'Barlow Condensed'\n}\n\nfunction handFamily(config: OgCardConfig): string {\n  const fonts = config.fonts || []\n  return fonts.length > 1 ? fonts[fonts.length - 1].family : displayFamily(config)\n}\n\nfunction muted(theme: OgTheme): string {\n  return theme.muted || theme.text\n}\n\nfunction backgroundLayers(config: OgCardConfig): string {\n  if (!config.background) return ''\n  const { image, blur = 0, scrim } = config.background\n  return `\n  <div class=\"bg\"><img src=\"${esc(image)}\" style=\"filter:blur(${blur}px)\"></div>\n  ${scrim ? `<div class=\"scrim\" style=\"background:${esc(scrim)}\"></div>` : ''}`\n}\n\nfunction barHtml(content: OgContent, theme: OgTheme): string {\n  if (!content.bar?.length) return ''\n  const segs = content.bar\n    .map(s => `<span>${esc(s)}</span>`)\n    .join('<span class=\"dot\"></span>')\n  return `<div class=\"bar\" style=\"background:${esc(theme.accent)}\">${segs}</div>`\n}\n\nfunction copyHtml(config: OgCardConfig): string {\n  const { content, theme } = config\n  const titleHtml = esc(content.title).replace(/\\n/g, '<br>')\n  // In `split` the photo owns the right pane, so a configured logo has nowhere\n  // to go as a plate. It used to be dropped silently. Render it small above the\n  // kicker instead: the brand mark still appears, and the plate invariant that\n  // split has no `.plate` is preserved.\n  const mark =\n    config.logo && (config.layout ?? (config.logo ? 'plate-left' : 'banner')) === 'split'\n      ? `<img class=\"mark\" src=\"${esc(config.logo)}\">`\n      : ''\n  return `\n    <div class=\"copy\">\n      ${mark}\n      ${content.kicker ? `<div class=\"kicker\">${esc(content.kicker)}</div>` : ''}\n      <h1>${titleHtml}</h1>\n      ${content.subtitle ? `<div class=\"sub\" style=\"color:${esc(muted(theme))}\">${esc(content.subtitle)}</div>` : ''}\n      ${content.hand ? `<div class=\"hand\" style=\"font-family:'${esc(handFamily(config))}',cursive\">${esc(content.hand)}</div>` : ''}\n    </div>`\n}\n\nexport function buildOgHtml(config: OgCardConfig): string {\n  if (config.html) return config.html\n  if (config.template) {\n    return config.template(config, {\n      esc,\n      fontLink: fontLink(config),\n      width: OG_WIDTH,\n      height: OG_HEIGHT,\n    })\n  }\n\n  const { theme, logo, layout = logo ? 'plate-left' : 'banner' } = config\n  const display = displayFamily(config)\n\n  const plate = logo\n    ? `<div class=\"plate\" style=\"background:${esc(theme.surface)}\"><img src=\"${esc(logo)}\"></div>`\n    : ''\n\n  const photo = config.photo\n    ? `<div class=\"photo\" style=\"flex-basis:${config.photo.width ?? 430}px;border-radius:${config.photo.radius ?? 24}px\"><img src=\"${esc(config.photo.src)}\"></div>`\n    : ''\n\n  const body =\n    layout === 'centered'\n      ? `<div class=\"wrap centered\">${plate}${copyHtml(config)}</div>`\n      : layout === 'banner'\n        ? `<div class=\"wrap banner\">${copyHtml(config)}</div>`\n        : layout === 'split'\n          ? `<div class=\"wrap\">${copyHtml(config)}${photo}</div>`\n          : `<div class=\"wrap\">${photo || plate}${copyHtml(config)}</div>`\n\n  return `<!doctype html>\n<html><head><meta charset=\"utf-8\">\n<link rel=\"preconnect\" href=\"https://fonts.googleapis.com\">\n<link rel=\"preconnect\" href=\"https://fonts.gstatic.com\" crossorigin>\n${fontLink(config)}\n<style>\n  * { margin:0; padding:0; box-sizing:border-box; }\n  html,body { width:${OG_WIDTH}px; height:${OG_HEIGHT}px; overflow:hidden; }\n  body { position:relative; background:${theme.bg}; font-family:'${display}',sans-serif; color:${theme.text}; }\n  .bg { position:absolute; inset:0; }\n  .bg img { width:100%; height:100%; object-fit:cover; transform:scale(1.05); }\n  .scrim { position:absolute; inset:0; }\n  .wrap { position:relative; height:100%; display:flex; align-items:center; gap:52px; padding:0 68px ${config.content.bar?.length ? '74px' : '0'}; }\n  .wrap.centered { flex-direction:column; justify-content:center; text-align:center; gap:28px; }\n  .wrap.banner { padding-left:90px; }\n  .plate { border-radius:28px; padding:26px; flex:0 0 auto; }\n  .plate img { display:block; width:250px; height:auto; }\n  .centered .plate img { width:180px; }\n  .photo { flex:0 0 auto; height:76%; overflow:hidden; box-shadow:0 8px 40px rgba(0,0,0,.25); }\n  .photo img { width:100%; height:100%; object-fit:cover; display:block; }\n  .copy { flex:1 1 auto; min-width:0; }\n  /* split-layout brand mark: the photo owns the right pane, so the logo rides\n     above the kicker rather than being dropped. */\n  .mark { display:block; height:44px; width:auto; margin-bottom:20px; }\n  .kicker { font-weight:800; text-transform:uppercase; letter-spacing:.22em; font-size:24px; color:${theme.accent}; margin-bottom:14px; }\n  /* Opening size only — the in-page fitter steps this down to fit the frame. */\n  h1 { font-weight:800; text-transform:uppercase; font-size:${TITLE_MAX_PX}px; line-height:.9; letter-spacing:-.01em; }\n  .sub { margin-top:22px; font-size:29px; font-weight:500; line-height:1.32; }\n  /* Never below 40px: script faces are illegible at thumbnail width under that. */\n  .hand { font-size:42px; margin-top:14px; transform:rotate(-1.5deg); display:inline-block; }\n  .bar { position:absolute; left:0; right:0; bottom:0; height:74px; display:flex; align-items:center; justify-content:center; gap:26px;\n         font-weight:800; text-transform:uppercase; letter-spacing:.1em; font-size:31px; color:${theme.surface}; }\n  /* nowrap so an over-long segment overflows the bar sideways, where the\n     fitter's width check sees it, instead of silently wrapping to a second\n     line and spilling over the copy above. */\n  .bar > span { white-space:nowrap; }\n  .bar .dot { width:10px; height:10px; border-radius:50%; background:currentColor; opacity:.55; flex:0 0 auto; }\n</style></head>\n<body>\n${backgroundLayers(config)}\n${body}\n${barHtml(config.content, theme)}\n${fitScript()}\n</body></html>`\n}\n"]}

package/dist/{chunk-PA7ENTUZ.mjs → chunk-6VHVIBLQ.mjs}

@@ -1,4 +1,4 @@
-import { resolveServerApiConfig } from './chunk-UDBUK5ZJ.mjs';
+import { resolveServerApiConfig } from './chunk-6XNEGG5B.mjs';
 
 // src/blog/excerpt.ts
 function sanitizeExcerpt(raw, maxLength = 160) {
@@ -1002,5 +1002,5 @@ function generateAuthorPageMetadata(author, options = {}) {
 }
 
 export { SEO_LIMITS, generateAllBlogSchemas, generateAtomFeed, generateAuthorPageMetadata, generateAuthorStaticParams, generateBlogCategoryMetadata, generateBlogIndexMetadata, generateBlogListSchema, generateBlogPostMetadata, generateBlogPostSchema, generateBlogSitemap, generateBlogStaticParams, generateBreadcrumbSchema, generateCategoryStaticParams, generateClusterArticleSchema, generateClusterBreadcrumbSchema, generateClusterItemListSchema, generateClusterLandingSchema, generateClusterPageMetadata, generateFaqSchema, generateHowToSchema, generateRssFeed, getAllAuthorSlugs, getAllBlogPosts, getAllBlogSlugs, getAuthorBySlug, getAuthorPosts, getBlogCategories, getBlogPost, getClusterNavigation, getPostsByCategory, getRelatedInsights, getTopicCluster, getTopicClusters, identifyTopicClusters, sanitizeExcerpt, validateBlogPostSeo, validateMetaDescription, validateSeoTitle };
-//# sourceMappingURL=chunk-PA7ENTUZ.mjs.map
-//# sourceMappingURL=chunk-PA7ENTUZ.mjs.map
+//# sourceMappingURL=chunk-6VHVIBLQ.mjs.map
+//# sourceMappingURL=chunk-6VHVIBLQ.mjs.map