@sonordev/site-kit 5.3.2 → 5.4.0

package/dist/{chunk-ZOJ3TLO5.mjs → chunk-6CUBSQMD.mjs}

@@ -1,4 +1,4 @@
-import { SITE_KIT_VERSION } from './chunk-OUERH2T4.mjs';
+import { SITE_KIT_VERSION } from './chunk-7U7C6XRI.mjs';
 import 'server-only';
 
 var MINT_PATH = "/api/public/site-token";
@@ -130,5 +130,5 @@ async function mintWithRetry(rawKey, apiUrl) {
 }
 
 export { resolveClientCredential };
-//# sourceMappingURL=chunk-ZOJ3TLO5.mjs.map
-//# sourceMappingURL=chunk-ZOJ3TLO5.mjs.map
+//# sourceMappingURL=chunk-6CUBSQMD.mjs.map
+//# sourceMappingURL=chunk-6CUBSQMD.mjs.map

package/dist/{chunk-ZOJ3TLO5.mjs.map → chunk-6CUBSQMD.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/mint-site-token.ts"],"names":[],"mappings":";;;AA4CA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAO1B,IAAM,iBAAA,GAAoB,CAAA;AAC1B,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,mBAAA,GAAsB,GAAA;AAM5B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAO1C,IAAM,QAAA,uBAAe,GAAA,EAA6B;AAElD,IAAM,KAAA,GAAQ,CAAC,EAAA,KAAe,IAAI,OAAA,CAAc,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAOxE,SAAS,YAAA,CAAa,KAAsB,OAAA,EAAyB;AACnE,EAAA,MAAM,MAAA,GAAS,GAAA,EAAK,OAAA,EAAS,GAAA,GAAM,aAAa,CAAA;AAChD,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,OAAA,GAAU,OAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GAC9B,OAAA,GAAU,GAAA,GACV,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,GAAI,IAAA,CAAK,GAAA,EAAI;AAClC,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,EAAE,CAAA,IAAK,EAAA,GAAK,GAAG,OAAO,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,mBAAmB,CAAA;AAAA,EAC5E;AACA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,oBAAA,GAAuB,CAAA,IAAK,SAAS,mBAAmB,CAAA;AAC1E;AAGA,IAAM,iBAAA,GAAoB,CAAC,MAAA,KAAmB,MAAA,KAAW,OAAO,MAAA,IAAU,GAAA;AAM1E,SAAS,kBAAA,GAA8B;AACrC,EAAA,OACE,OAAO,OAAA,KAAY,WAAA,IACnB,OAAA,CAAQ,KAAK,yBAAA,KAA8B,KAAA;AAE/C;AAEA,SAAS,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAgB,GAAA,EAAqB;AACvE,EAAA,IAAI,oBAAmB,EAAG;AACxB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,sCAAsC,MAAM,CAAA,uMAAA;AAAA,KAG9C;AACA,IAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,0CAA0C,MAAM,CAAA,uRAAA;AAAA,GAIlD;AACF;AA8BO,SAAS,YAAA,GAAsD;AACpE,EAAA,MAAM,UAAU,UAAA,CAAW,KAAA;AAG3B,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,uCAAuC,CAAA;AACrE,EAAA,MAAM,WAAW,OAAA,CAAQ,kBAAA;AACzB,EAAA,IAAI,OAAO,aAAa,UAAA,EAAY,OAAO,EAAE,EAAA,EAAI,QAAA,EAAU,WAAW,IAAA,EAAK;AAC3E,EAAA,OAAO,EAAE,EAAA,EAAI,OAAA,EAAS,SAAA,EAAW,KAAA,EAAM;AACzC;AAYO,SAAS,kBAAkB,GAAA,EAAuB;AACvD,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AAC5C,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,sBAAA,EAAwB,OAAO,IAAA;AAChD,EAAA,IAAI,CAAA,CAAE,IAAA,KAAS,yBAAA,EAA2B,OAAO,IAAA;AACjD,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,EAAE,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,EAAG,OAAO,IAAA;AACzE,EAAA,IAAI,EAAE,QAAA,qBAAa,MAAA,CAAO,GAAA,CAAI,gBAAgB,GAAG,OAAO,IAAA;AACxD,EAAA,OAAO,KAAA;AACT;AAEA,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,UAAU,MAAA,CAAO,SAAA,GAAY,KAAK,GAAA,EAAI,SAAU,MAAA,CAAO,UAAA;AAG3D,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,SAAS,OAAO,OAAA;AAEpB,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AAC5C,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,OAAO,CAAA;AAC5B,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAA;AAAA,EACf,CAAA,SAAE;AACA,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,EACxB;AACF;AAEA,eAAe,aAAA,CAAc,QAAgB,MAAA,EAAiC;AAC5E,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI,UAAA,GAAa,eAAA;AAEjB,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,iBAAA,EAAmB,OAAA,EAAA,EAAW;AAC5D,IAAA,IAAI,GAAA,GAAuB,IAAA;AAC3B,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,EAAA,EAAI,OAAA,EAAS,SAAA,KAAc,YAAA,EAAa;AAChD,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,QACzC,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,WAAA,EAAa,MAAA;AAAA,UACb,mBAAA,EAAqB;AAAA,SACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMA,GAAI,YAAY,EAAC,GAAK,EAAE,IAAA,EAAM,EAAE,UAAA,EAAY,KAAA,EAAM,EAAE;AAAA,QACpD,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,OACP,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAI,iBAAA,CAAkB,GAAG,CAAA,EAAG,MAAM,GAAA;AAClC,MAAA,UAAA,GAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,eAAA;AAClD,MAAA,IAAI,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACnC,QAAA,MAAM,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AACvC,QAAA;AAAA,MACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,IAAK,SAAA,GAAY,GAAA,GAAQ,CAAA,EAAG,EAAA,GAAK,GAAM;AAAA,SACrE,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,UAAA,GAAa,+BAAA;AACb,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,MAAA,KAAA,CAAM,GAAA,CAAI,MAAA,EAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,WAAW,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,EAAQ,CAAA;AACxE,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,UAAA,GAAa,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAC/B,IAAA,IAAI,kBAAkB,GAAA,CAAI,MAAM,CAAA,IAAK,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACpE,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,EAAK,OAAO,CAAA;AACvC,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,GAAA,CAAI,MAAM,CAAA,cAAA,EAAiB,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA,YAAA,EACrE,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,iBAAiB,CAAA,EAAA;AAAA,OAChD;AACA,MAAA,MAAM,MAAM,KAAK,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA;AAAA,EACF;AAEA,EAAA,OAAO,UAAA,CAAW,UAAA,EAAY,MAAA,EAAQ,IAAA,CAAK,KAAK,CAAA;AAClD","file":"chunk-ZOJ3TLO5.mjs","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * FAILS CLOSED. If minting genuinely fails, this throws and the build fails —\n * it does NOT publish the raw key. A failed deploy is loud and recoverable; a\n * leaked project secret in public HTML is neither. The only paths that still\n * return the raw key are a 404 (an older API that predates the endpoint, an\n * expected state during rollout) and the explicit `SONOR_SITE_TOKEN_FALLBACK=raw`\n * escape hatch, for when shipping beats being blocked.\n *\n * That posture is not academic. Through 3.5.0 a throttled mint (HTTP 429)\n * returned the raw key AND cached it for 60s, so every page rendered in that\n * window shipped the secret: one real build came out with 180 of 272 prerendered\n * pages carrying it. The build \"succeeded\" and nothing downstream noticed.\n * Rate limiting is transient by definition — the fix is to wait and retry, not\n * to downgrade to publishing the key.\n *\n * Two things keep the request count low enough that throttling is rare:\n *  - a module-level memo, so a worker mints once and every page reuses the seed;\n *  - an in-flight map, because that memo is only populated AFTER the await. Next\n *    renders pages concurrently, so without coalescing the first N concurrent\n *    renders in a process all miss the cache and all fire a request — a\n *    stampede per worker, multiplied by one worker per core. That is how a\n *    single site exhausted a 60/min budget.\n *\n * SEED FRESHNESS: a static page's seed carries `iat` = build time, and the API\n * refuses to refresh a seed older than SITE_TOKEN_MAX_REFRESH_AGE_SECONDS\n * (sonor-api common/site-auth/site-token.util.ts — currently 400 days, raised\n * from 30 alongside this fix). A site not rebuilt within that window serves a\n * seed the client cannot refresh, and its forms/analytics/engage start failing\n * for new visitors. Keep that limit comfortably longer than the fleet's\n * realistic redeploy gap; marketing sites routinely go many months untouched.\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\n/**\n * Retry budget for transient failures (429 / 5xx / network). Rate limiting is\n * measured per minute, so a few seconds of backoff clears it; the whole ladder\n * costs at most ~20s once per build worker, and only when something is wrong.\n */\nconst MINT_MAX_ATTEMPTS = 4\nconst MINT_BACKOFF_BASE_MS = 500\nconst MINT_BACKOFF_CAP_MS = 8_000\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\n/**\n * Requests already in flight, keyed by raw key. The `cache` above is only\n * written after the response lands, so concurrent renders would otherwise each\n * start their own mint. See the module header.\n */\nconst inflight = new Map<string, Promise<string>>()\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\n/**\n * Honour `Retry-After` when the server sends it (delta-seconds or HTTP date),\n * otherwise exponential backoff. Capped so a misconfigured server cannot stall\n * a build indefinitely.\n */\nfunction retryDelayMs(res: Response | null, attempt: number): number {\n  const header = res?.headers?.get?.('retry-after')\n  if (header) {\n    const seconds = Number(header)\n    const ms = Number.isFinite(seconds)\n      ? seconds * 1000\n      : Date.parse(header) - Date.now()\n    if (Number.isFinite(ms) && ms > 0) return Math.min(ms, MINT_BACKOFF_CAP_MS)\n  }\n  return Math.min(MINT_BACKOFF_BASE_MS * 2 ** attempt, MINT_BACKOFF_CAP_MS)\n}\n\n/** 429 and 5xx are transient; waiting is the correct response to both. */\nconst isRetryableStatus = (status: number) => status === 429 || status >= 500\n\n/**\n * The escape hatch, for when a broken mint must not block a release. Opt-in and\n * loud: it re-enables publishing the project secret in page HTML.\n */\nfunction rawFallbackAllowed(): boolean {\n  return (\n    typeof process !== 'undefined' &&\n    process.env?.SONOR_SITE_TOKEN_FALLBACK === 'raw'\n  )\n}\n\nfunction failClosed(reason: string, rawKey: string, now: number): string {\n  if (rawFallbackAllowed()) {\n    console.warn(\n      `[SiteKitLayout] Token mint failed (${reason}) and SONOR_SITE_TOKEN_FALLBACK=raw is set; ` +\n        'injecting the RAW API KEY into page HTML. The key is publicly readable wherever ' +\n        'this page is served — unset the escape hatch once the mint is healthy.',\n    )\n    cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n    return rawKey\n  }\n  throw new Error(\n    `site-kit: could not mint a site token (${reason}). Refusing to publish the raw ` +\n      'SONOR_API_KEY in page HTML, so this build fails instead. Check that the mint ' +\n      'endpoint is reachable and the key is valid, then rebuild. To ship anyway — ' +\n      'which publishes the project secret in public HTML — set SONOR_SITE_TOKEN_FALLBACK=raw.',\n  )\n}\n\ntype FetchLike = typeof fetch\n\n/**\n * Next.js monkey-patches `globalThis.fetch` so every call participates in its\n * Data Cache and static-generation tracking. This mint must NOT participate.\n *\n * `cache: 'no-store'` marks the calling scope dynamic, so during `next build`\n * Next throws DynamicServerError *before the request goes out*. On a statically\n * prerendered route the mint therefore never ran at all — the catch below\n * swallowed the bailout and every page shipped the raw key. (Verified against\n * Next 16.2.9: the mint endpoint received zero requests for a static build.)\n *\n * The two obvious repairs are both wrong:\n *   - `next: { revalidate: N }` LOWERS the route's revalidate window\n *     (patch-fetch.js: `finalRevalidate < revalidateStore.revalidate`), quietly\n *     converting fully-static pages into ISR across the whole fleet.\n *   - `next: { revalidate: false }` keeps pages static but writes the token into\n *     the Data Cache, which hosts persist across builds — a fresh deploy could\n *     re-bake a months-old seed, which is the exact failure we're removing.\n *\n * A credential mint is not page data and has no business in the page data cache.\n * So we call the original fetch Next saves on the patched one and stay invisible\n * to the framework: no bailout, no cache entry, no effect on staticness. The\n * module-level memo above is the only cache we want — one mint per build\n * process, and a build-fresh seed on every deploy.\n *\n * @internal Exported for unit tests; not part of the package's public API.\n */\nexport function resolveFetch(): { fn: FetchLike; unpatched: boolean } {\n  const current = globalThis.fetch as\n    | (FetchLike & { _nextOriginalFetch?: FetchLike })\n    | undefined\n  if (!current) throw new Error('site-kit: global fetch is unavailable')\n  const original = current._nextOriginalFetch\n  if (typeof original === 'function') return { fn: original, unpatched: true }\n  return { fn: current, unpatched: false }\n}\n\n/**\n * Next signals \"this render must go dynamic\" by THROWING (DynamicServerError,\n * static-gen bailout, redirect/notFound digests, React's postpone). Those are\n * the framework's control flow, not a mint failure. Swallowing one makes Next\n * believe the render succeeded statically — which is precisely how the raw key\n * ended up stranded in prerendered HTML with no error anywhere. Let them\n * propagate; only real network/HTTP failures fall back to the raw key.\n *\n * @internal Exported for unit tests; not part of the package's public API.\n */\nexport function isFrameworkSignal(err: unknown): boolean {\n  if (!err || typeof err !== 'object') return false\n  const e = err as { digest?: unknown; code?: unknown; $$typeof?: unknown }\n  if (e.digest === 'DYNAMIC_SERVER_USAGE') return true\n  if (e.code === 'NEXT_STATIC_GEN_BAILOUT') return true\n  if (typeof e.digest === 'string' && e.digest.startsWith('NEXT_')) return true\n  if (e.$$typeof === Symbol.for('react.postpone')) return true\n  return false\n}\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > Date.now()) return cached.credential\n\n  // Collapse concurrent renders onto one request rather than a stampede.\n  const pending = inflight.get(rawKey)\n  if (pending) return pending\n\n  const request = mintWithRetry(rawKey, apiUrl)\n  inflight.set(rawKey, request)\n  try {\n    return await request\n  } finally {\n    inflight.delete(rawKey)\n  }\n}\n\nasync function mintWithRetry(rawKey: string, apiUrl: string): Promise<string> {\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  let lastReason = 'unknown error'\n\n  for (let attempt = 0; attempt < MINT_MAX_ATTEMPTS; attempt++) {\n    let res: Response | null = null\n    try {\n      const { fn: fetchFn, unpatched } = resolveFetch()\n      res = await fetchFn(`${base}${MINT_PATH}`, {\n        method: 'POST',\n        headers: {\n          'content-type': 'application/json',\n          'x-api-key': rawKey,\n          'x-sitekit-version': SITE_KIT_VERSION,\n        },\n        // Only meaningful on the fallback path, where a future Next stopped\n        // exposing `_nextOriginalFetch` and we're back on the patched fetch.\n        // `revalidate: false` is the one setting that neither bails out of static\n        // generation nor downgrades the route to ISR; a Data Cache entry is the\n        // lesser evil versus shipping the raw key again.\n        ...(unpatched ? {} : ({ next: { revalidate: false } } as RequestInit)),\n        signal:\n          typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n            ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n            : undefined,\n      })\n    } catch (err) {\n      // Never swallow the framework's own control flow — see isFrameworkSignal.\n      if (isFrameworkSignal(err)) throw err\n      lastReason = err instanceof Error ? err.message : 'network error'\n      if (attempt < MINT_MAX_ATTEMPTS - 1) {\n        await sleep(retryDelayMs(null, attempt))\n        continue\n      }\n      break\n    }\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: Date.now() + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n      lastReason = 'mint returned no usable token'\n      break\n    }\n\n    // 404 = an API older than the endpoint. Expected during rollout, and the raw\n    // key is exactly what such an API still expects, so this stays a fallback\n    // rather than a build failure.\n    if (res.status === 404) {\n      cache.set(rawKey, { credential: rawKey, expiresAt: Date.now() + 60_000 })\n      return rawKey\n    }\n\n    lastReason = `HTTP ${res.status}`\n    if (isRetryableStatus(res.status) && attempt < MINT_MAX_ATTEMPTS - 1) {\n      const delay = retryDelayMs(res, attempt)\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; retrying in ${Math.round(delay)}ms ` +\n          `(attempt ${attempt + 2}/${MINT_MAX_ATTEMPTS}).`,\n      )\n      await sleep(delay)\n      continue\n    }\n    break\n  }\n\n  return failClosed(lastReason, rawKey, Date.now())\n}\n"]}
+{"version":3,"sources":["../src/server/mint-site-token.ts"],"names":[],"mappings":";;;AA4CA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAO1B,IAAM,iBAAA,GAAoB,CAAA;AAC1B,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,mBAAA,GAAsB,GAAA;AAM5B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAO1C,IAAM,QAAA,uBAAe,GAAA,EAA6B;AAElD,IAAM,KAAA,GAAQ,CAAC,EAAA,KAAe,IAAI,OAAA,CAAc,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAOxE,SAAS,YAAA,CAAa,KAAsB,OAAA,EAAyB;AACnE,EAAA,MAAM,MAAA,GAAS,GAAA,EAAK,OAAA,EAAS,GAAA,GAAM,aAAa,CAAA;AAChD,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,OAAA,GAAU,OAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GAC9B,OAAA,GAAU,GAAA,GACV,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,GAAI,IAAA,CAAK,GAAA,EAAI;AAClC,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,EAAE,CAAA,IAAK,EAAA,GAAK,GAAG,OAAO,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,mBAAmB,CAAA;AAAA,EAC5E;AACA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,oBAAA,GAAuB,CAAA,IAAK,SAAS,mBAAmB,CAAA;AAC1E;AAGA,IAAM,iBAAA,GAAoB,CAAC,MAAA,KAAmB,MAAA,KAAW,OAAO,MAAA,IAAU,GAAA;AAM1E,SAAS,kBAAA,GAA8B;AACrC,EAAA,OACE,OAAO,OAAA,KAAY,WAAA,IACnB,OAAA,CAAQ,KAAK,yBAAA,KAA8B,KAAA;AAE/C;AAEA,SAAS,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAgB,GAAA,EAAqB;AACvE,EAAA,IAAI,oBAAmB,EAAG;AACxB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,sCAAsC,MAAM,CAAA,uMAAA;AAAA,KAG9C;AACA,IAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,0CAA0C,MAAM,CAAA,uRAAA;AAAA,GAIlD;AACF;AA8BO,SAAS,YAAA,GAAsD;AACpE,EAAA,MAAM,UAAU,UAAA,CAAW,KAAA;AAG3B,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,uCAAuC,CAAA;AACrE,EAAA,MAAM,WAAW,OAAA,CAAQ,kBAAA;AACzB,EAAA,IAAI,OAAO,aAAa,UAAA,EAAY,OAAO,EAAE,EAAA,EAAI,QAAA,EAAU,WAAW,IAAA,EAAK;AAC3E,EAAA,OAAO,EAAE,EAAA,EAAI,OAAA,EAAS,SAAA,EAAW,KAAA,EAAM;AACzC;AAYO,SAAS,kBAAkB,GAAA,EAAuB;AACvD,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AAC5C,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,sBAAA,EAAwB,OAAO,IAAA;AAChD,EAAA,IAAI,CAAA,CAAE,IAAA,KAAS,yBAAA,EAA2B,OAAO,IAAA;AACjD,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,EAAE,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,EAAG,OAAO,IAAA;AACzE,EAAA,IAAI,EAAE,QAAA,qBAAa,MAAA,CAAO,GAAA,CAAI,gBAAgB,GAAG,OAAO,IAAA;AACxD,EAAA,OAAO,KAAA;AACT;AAEA,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,UAAU,MAAA,CAAO,SAAA,GAAY,KAAK,GAAA,EAAI,SAAU,MAAA,CAAO,UAAA;AAG3D,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,SAAS,OAAO,OAAA;AAEpB,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AAC5C,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,OAAO,CAAA;AAC5B,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAA;AAAA,EACf,CAAA,SAAE;AACA,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,EACxB;AACF;AAEA,eAAe,aAAA,CAAc,QAAgB,MAAA,EAAiC;AAC5E,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI,UAAA,GAAa,eAAA;AAEjB,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,iBAAA,EAAmB,OAAA,EAAA,EAAW;AAC5D,IAAA,IAAI,GAAA,GAAuB,IAAA;AAC3B,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,EAAA,EAAI,OAAA,EAAS,SAAA,KAAc,YAAA,EAAa;AAChD,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,QACzC,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,WAAA,EAAa,MAAA;AAAA,UACb,mBAAA,EAAqB;AAAA,SACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMA,GAAI,YAAY,EAAC,GAAK,EAAE,IAAA,EAAM,EAAE,UAAA,EAAY,KAAA,EAAM,EAAE;AAAA,QACpD,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,OACP,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAI,iBAAA,CAAkB,GAAG,CAAA,EAAG,MAAM,GAAA;AAClC,MAAA,UAAA,GAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,eAAA;AAClD,MAAA,IAAI,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACnC,QAAA,MAAM,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AACvC,QAAA;AAAA,MACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,IAAK,SAAA,GAAY,GAAA,GAAQ,CAAA,EAAG,EAAA,GAAK,GAAM;AAAA,SACrE,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,UAAA,GAAa,+BAAA;AACb,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,MAAA,KAAA,CAAM,GAAA,CAAI,MAAA,EAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,WAAW,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,EAAQ,CAAA;AACxE,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,UAAA,GAAa,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAC/B,IAAA,IAAI,kBAAkB,GAAA,CAAI,MAAM,CAAA,IAAK,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACpE,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,EAAK,OAAO,CAAA;AACvC,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,GAAA,CAAI,MAAM,CAAA,cAAA,EAAiB,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA,YAAA,EACrE,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,iBAAiB,CAAA,EAAA;AAAA,OAChD;AACA,MAAA,MAAM,MAAM,KAAK,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA;AAAA,EACF;AAEA,EAAA,OAAO,UAAA,CAAW,UAAA,EAAY,MAAA,EAAQ,IAAA,CAAK,KAAK,CAAA;AAClD","file":"chunk-6CUBSQMD.mjs","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * FAILS CLOSED. If minting genuinely fails, this throws and the build fails —\n * it does NOT publish the raw key. A failed deploy is loud and recoverable; a\n * leaked project secret in public HTML is neither. The only paths that still\n * return the raw key are a 404 (an older API that predates the endpoint, an\n * expected state during rollout) and the explicit `SONOR_SITE_TOKEN_FALLBACK=raw`\n * escape hatch, for when shipping beats being blocked.\n *\n * That posture is not academic. Through 3.5.0 a throttled mint (HTTP 429)\n * returned the raw key AND cached it for 60s, so every page rendered in that\n * window shipped the secret: one real build came out with 180 of 272 prerendered\n * pages carrying it. The build \"succeeded\" and nothing downstream noticed.\n * Rate limiting is transient by definition — the fix is to wait and retry, not\n * to downgrade to publishing the key.\n *\n * Two things keep the request count low enough that throttling is rare:\n *  - a module-level memo, so a worker mints once and every page reuses the seed;\n *  - an in-flight map, because that memo is only populated AFTER the await. Next\n *    renders pages concurrently, so without coalescing the first N concurrent\n *    renders in a process all miss the cache and all fire a request — a\n *    stampede per worker, multiplied by one worker per core. That is how a\n *    single site exhausted a 60/min budget.\n *\n * SEED FRESHNESS: a static page's seed carries `iat` = build time, and the API\n * refuses to refresh a seed older than SITE_TOKEN_MAX_REFRESH_AGE_SECONDS\n * (sonor-api common/site-auth/site-token.util.ts — currently 400 days, raised\n * from 30 alongside this fix). A site not rebuilt within that window serves a\n * seed the client cannot refresh, and its forms/analytics/engage start failing\n * for new visitors. Keep that limit comfortably longer than the fleet's\n * realistic redeploy gap; marketing sites routinely go many months untouched.\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\n/**\n * Retry budget for transient failures (429 / 5xx / network). Rate limiting is\n * measured per minute, so a few seconds of backoff clears it; the whole ladder\n * costs at most ~20s once per build worker, and only when something is wrong.\n */\nconst MINT_MAX_ATTEMPTS = 4\nconst MINT_BACKOFF_BASE_MS = 500\nconst MINT_BACKOFF_CAP_MS = 8_000\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\n/**\n * Requests already in flight, keyed by raw key. The `cache` above is only\n * written after the response lands, so concurrent renders would otherwise each\n * start their own mint. See the module header.\n */\nconst inflight = new Map<string, Promise<string>>()\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\n/**\n * Honour `Retry-After` when the server sends it (delta-seconds or HTTP date),\n * otherwise exponential backoff. Capped so a misconfigured server cannot stall\n * a build indefinitely.\n */\nfunction retryDelayMs(res: Response | null, attempt: number): number {\n  const header = res?.headers?.get?.('retry-after')\n  if (header) {\n    const seconds = Number(header)\n    const ms = Number.isFinite(seconds)\n      ? seconds * 1000\n      : Date.parse(header) - Date.now()\n    if (Number.isFinite(ms) && ms > 0) return Math.min(ms, MINT_BACKOFF_CAP_MS)\n  }\n  return Math.min(MINT_BACKOFF_BASE_MS * 2 ** attempt, MINT_BACKOFF_CAP_MS)\n}\n\n/** 429 and 5xx are transient; waiting is the correct response to both. */\nconst isRetryableStatus = (status: number) => status === 429 || status >= 500\n\n/**\n * The escape hatch, for when a broken mint must not block a release. Opt-in and\n * loud: it re-enables publishing the project secret in page HTML.\n */\nfunction rawFallbackAllowed(): boolean {\n  return (\n    typeof process !== 'undefined' &&\n    process.env?.SONOR_SITE_TOKEN_FALLBACK === 'raw'\n  )\n}\n\nfunction failClosed(reason: string, rawKey: string, now: number): string {\n  if (rawFallbackAllowed()) {\n    console.warn(\n      `[SiteKitLayout] Token mint failed (${reason}) and SONOR_SITE_TOKEN_FALLBACK=raw is set; ` +\n        'injecting the RAW API KEY into page HTML. The key is publicly readable wherever ' +\n        'this page is served — unset the escape hatch once the mint is healthy.',\n    )\n    cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n    return rawKey\n  }\n  throw new Error(\n    `site-kit: could not mint a site token (${reason}). Refusing to publish the raw ` +\n      'SONOR_API_KEY in page HTML, so this build fails instead. Check that the mint ' +\n      'endpoint is reachable and the key is valid, then rebuild. To ship anyway — ' +\n      'which publishes the project secret in public HTML — set SONOR_SITE_TOKEN_FALLBACK=raw.',\n  )\n}\n\ntype FetchLike = typeof fetch\n\n/**\n * Next.js monkey-patches `globalThis.fetch` so every call participates in its\n * Data Cache and static-generation tracking. This mint must NOT participate.\n *\n * `cache: 'no-store'` marks the calling scope dynamic, so during `next build`\n * Next throws DynamicServerError *before the request goes out*. On a statically\n * prerendered route the mint therefore never ran at all — the catch below\n * swallowed the bailout and every page shipped the raw key. (Verified against\n * Next 16.2.9: the mint endpoint received zero requests for a static build.)\n *\n * The two obvious repairs are both wrong:\n *   - `next: { revalidate: N }` LOWERS the route's revalidate window\n *     (patch-fetch.js: `finalRevalidate < revalidateStore.revalidate`), quietly\n *     converting fully-static pages into ISR across the whole fleet.\n *   - `next: { revalidate: false }` keeps pages static but writes the token into\n *     the Data Cache, which hosts persist across builds — a fresh deploy could\n *     re-bake a months-old seed, which is the exact failure we're removing.\n *\n * A credential mint is not page data and has no business in the page data cache.\n * So we call the original fetch Next saves on the patched one and stay invisible\n * to the framework: no bailout, no cache entry, no effect on staticness. The\n * module-level memo above is the only cache we want — one mint per build\n * process, and a build-fresh seed on every deploy.\n *\n * @internal Exported for unit tests; not part of the package's public API.\n */\nexport function resolveFetch(): { fn: FetchLike; unpatched: boolean } {\n  const current = globalThis.fetch as\n    | (FetchLike & { _nextOriginalFetch?: FetchLike })\n    | undefined\n  if (!current) throw new Error('site-kit: global fetch is unavailable')\n  const original = current._nextOriginalFetch\n  if (typeof original === 'function') return { fn: original, unpatched: true }\n  return { fn: current, unpatched: false }\n}\n\n/**\n * Next signals \"this render must go dynamic\" by THROWING (DynamicServerError,\n * static-gen bailout, redirect/notFound digests, React's postpone). Those are\n * the framework's control flow, not a mint failure. Swallowing one makes Next\n * believe the render succeeded statically — which is precisely how the raw key\n * ended up stranded in prerendered HTML with no error anywhere. Let them\n * propagate; only real network/HTTP failures fall back to the raw key.\n *\n * @internal Exported for unit tests; not part of the package's public API.\n */\nexport function isFrameworkSignal(err: unknown): boolean {\n  if (!err || typeof err !== 'object') return false\n  const e = err as { digest?: unknown; code?: unknown; $$typeof?: unknown }\n  if (e.digest === 'DYNAMIC_SERVER_USAGE') return true\n  if (e.code === 'NEXT_STATIC_GEN_BAILOUT') return true\n  if (typeof e.digest === 'string' && e.digest.startsWith('NEXT_')) return true\n  if (e.$$typeof === Symbol.for('react.postpone')) return true\n  return false\n}\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > Date.now()) return cached.credential\n\n  // Collapse concurrent renders onto one request rather than a stampede.\n  const pending = inflight.get(rawKey)\n  if (pending) return pending\n\n  const request = mintWithRetry(rawKey, apiUrl)\n  inflight.set(rawKey, request)\n  try {\n    return await request\n  } finally {\n    inflight.delete(rawKey)\n  }\n}\n\nasync function mintWithRetry(rawKey: string, apiUrl: string): Promise<string> {\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  let lastReason = 'unknown error'\n\n  for (let attempt = 0; attempt < MINT_MAX_ATTEMPTS; attempt++) {\n    let res: Response | null = null\n    try {\n      const { fn: fetchFn, unpatched } = resolveFetch()\n      res = await fetchFn(`${base}${MINT_PATH}`, {\n        method: 'POST',\n        headers: {\n          'content-type': 'application/json',\n          'x-api-key': rawKey,\n          'x-sitekit-version': SITE_KIT_VERSION,\n        },\n        // Only meaningful on the fallback path, where a future Next stopped\n        // exposing `_nextOriginalFetch` and we're back on the patched fetch.\n        // `revalidate: false` is the one setting that neither bails out of static\n        // generation nor downgrades the route to ISR; a Data Cache entry is the\n        // lesser evil versus shipping the raw key again.\n        ...(unpatched ? {} : ({ next: { revalidate: false } } as RequestInit)),\n        signal:\n          typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n            ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n            : undefined,\n      })\n    } catch (err) {\n      // Never swallow the framework's own control flow — see isFrameworkSignal.\n      if (isFrameworkSignal(err)) throw err\n      lastReason = err instanceof Error ? err.message : 'network error'\n      if (attempt < MINT_MAX_ATTEMPTS - 1) {\n        await sleep(retryDelayMs(null, attempt))\n        continue\n      }\n      break\n    }\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: Date.now() + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n      lastReason = 'mint returned no usable token'\n      break\n    }\n\n    // 404 = an API older than the endpoint. Expected during rollout, and the raw\n    // key is exactly what such an API still expects, so this stays a fallback\n    // rather than a build failure.\n    if (res.status === 404) {\n      cache.set(rawKey, { credential: rawKey, expiresAt: Date.now() + 60_000 })\n      return rawKey\n    }\n\n    lastReason = `HTTP ${res.status}`\n    if (isRetryableStatus(res.status) && attempt < MINT_MAX_ATTEMPTS - 1) {\n      const delay = retryDelayMs(res, attempt)\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; retrying in ${Math.round(delay)}ms ` +\n          `(attempt ${attempt + 2}/${MINT_MAX_ATTEMPTS}).`,\n      )\n      await sleep(delay)\n      continue\n    }\n    break\n  }\n\n  return failClosed(lastReason, rawKey, Date.now())\n}\n"]}

package/dist/{chunk-JBGRXICL.js → chunk-746RKQHA.js}

@@ -1,5 +1,6 @@
 'use strict';
 
+var chunkLC7AM4J5_js = require('./chunk-LC7AM4J5.js');
 var chunkO5GHP7UO_js = require('./chunk-O5GHP7UO.js');
 
 // src/blog/excerpt.ts
@@ -181,15 +182,9 @@ async function getBlogCategories() {
     return [];
   }
 }
-function blogPathPrefix(options) {
-  const raw = (options.blogBasePath ?? "/blog").trim() || "/blog";
-  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
-  return withSlash.replace(/\/$/, "") || "/blog";
-}
 async function generateBlogPostMetadata(slug, options = {}) {
   const post = await getBlogPost(slug);
   const { siteName, siteUrl = "", defaultImage, twitterHandle } = options;
-  const base = blogPathPrefix(options);
   if (!post) {
     return {
       title: "Post Not Found",
@@ -199,7 +194,7 @@ async function generateBlogPostMetadata(slug, options = {}) {
   const title = post.meta_title || post.title;
   const description = sanitizeExcerpt(post.meta_description || post.excerpt);
   const image = post.featured_image || defaultImage;
-  const url = `${siteUrl}${base}/${post.slug}`;
+  const url = chunkLC7AM4J5_js.resolveBlogPostUrl(post, options);
   return {
     title,
     description,
@@ -228,7 +223,7 @@ async function generateBlogPostMetadata(slug, options = {}) {
       creator: twitterHandle
     },
     alternates: {
-      canonical: post.canonical_url || url
+      canonical: url
     },
     other: {
       "article:published_time": post.published_at || "",
@@ -245,14 +240,14 @@ function generateBlogIndexMetadata(options) {
     defaultImage,
     twitterHandle
   } = options;
-  const base = blogPathPrefix(options);
+  const base = chunkLC7AM4J5_js.createBlogRoutes(options).index;
   return {
     title,
     description,
     openGraph: {
       title,
       description,
-      url: `${siteUrl}${base}`,
+      url: chunkLC7AM4J5_js.resolveBlogUrl(base, siteUrl),
       siteName,
       type: "website",
       images: defaultImage ? [{ url: defaultImage }] : void 0
@@ -267,7 +262,7 @@ function generateBlogIndexMetadata(options) {
   };
 }
 function generateBlogCategoryMetadata(categoryName, options = {}) {
-  const { siteName, siteUrl = "", defaultImage, blogBasePath = "/blog" } = options;
+  const { siteName, siteUrl = "", defaultImage } = options;
   const title = `${categoryName} - Blog`;
   const description = `Browse all posts in ${categoryName}.`;
   const slug = options.categorySlug ?? categoryName.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
@@ -277,43 +272,52 @@ function generateBlogCategoryMetadata(categoryName, options = {}) {
     openGraph: {
       title,
       description,
-      url: `${siteUrl}${blogBasePath}/category/${slug}`,
+      url: chunkLC7AM4J5_js.resolveBlogUrl(chunkLC7AM4J5_js.createBlogRoutes(options).category(slug), siteUrl),
       siteName,
       type: "website",
       images: defaultImage ? [{ url: defaultImage }] : void 0
     }
   };
 }
-async function generateBlogStaticParams() {
-  const slugs = await getAllBlogSlugs();
-  return slugs.map((s) => ({ slug: s.slug }));
+async function generateBlogStaticParams(options = {}) {
+  const posts = await getBlogRouteEntries(options);
+  return posts.map((post) => {
+    const category = chunkLC7AM4J5_js.blogCategorySlug(post.category || options.category);
+    return { slug: post.slug, ...options.includeCategoryInPath && category ? { category } : {} };
+  });
 }
 async function generateCategoryStaticParams() {
   const categories = await getBlogCategories();
   return categories.map((c) => ({ category: c.slug }));
 }
-async function generateBlogSitemap(siteUrl) {
-  const slugs = await getAllBlogSlugs();
-  const categories = await getBlogCategories();
-  const clusters = await getTopicClusters();
+async function getBlogRouteEntries(options, withCanonicals = false) {
+  if (withCanonicals || options.includeCategoryInPath || options.postPath) {
+    return (await getAllBlogPosts({ maxPosts: Infinity })).map((post) => ({ ...post, last_modified: post.updated_at }));
+  }
+  return getAllBlogSlugs();
+}
+async function generateBlogSitemap(siteUrl, options = {}) {
+  const slugs = await getBlogRouteEntries(options, true);
+  const categories = options.includeCategories === false ? [] : await getBlogCategories();
+  const clusters = options.includeClusters === false ? [] : await getTopicClusters();
   const entries = [
     // Blog index
     {
-      url: `${siteUrl}/blog`,
+      url: chunkLC7AM4J5_js.resolveBlogUrl(chunkLC7AM4J5_js.createBlogRoutes(options).index, siteUrl),
       changeFrequency: "daily",
       priority: 0.8
     }
   ];
   clusters.forEach((cluster) => {
     entries.push({
-      url: `${siteUrl}/blog/cluster/${cluster.cluster_slug}`,
+      url: chunkLC7AM4J5_js.resolveBlogUrl(chunkLC7AM4J5_js.createBlogRoutes(options).cluster(cluster.cluster_slug), siteUrl),
       changeFrequency: "weekly",
       priority: 0.8
     });
   });
   categories.forEach((cat) => {
     entries.push({
-      url: `${siteUrl}/blog/category/${cat.slug}`,
+      url: chunkLC7AM4J5_js.resolveBlogUrl(chunkLC7AM4J5_js.createBlogRoutes(options).category(cat.slug), siteUrl),
       changeFrequency: "weekly",
       priority: 0.6
     });
@@ -321,7 +325,7 @@ async function generateBlogSitemap(siteUrl) {
   slugs.forEach((post) => {
     const isPillar = post.article_type === "pillar";
     entries.push({
-      url: `${siteUrl}/blog/${post.slug}`,
+      url: chunkLC7AM4J5_js.resolveBlogPostUrl(post, { ...options, siteUrl }),
       lastModified: post.last_modified ? new Date(post.last_modified) : void 0,
       changeFrequency: isPillar ? "weekly" : "monthly",
       priority: isPillar ? 0.9 : 0.7
@@ -336,7 +340,7 @@ function generateBlogPostSchema(post, options = {}) {
     "@type": "BlogPosting",
     headline: post.title,
     description: sanitizeExcerpt(post.excerpt || post.meta_description),
-    url: `${siteUrl}/blog/${post.slug}`,
+    url: chunkLC7AM4J5_js.resolveBlogPostUrl(post, { ...options, siteUrl }),
     datePublished: post.published_at,
     dateModified: post.updated_at,
     author: {
@@ -344,9 +348,8 @@ function generateBlogPostSchema(post, options = {}) {
       name: typeof post.author === "string" ? post.author : post.author?.name
     }
   };
-  if (post.featured_image) {
-    schema.image = post.featured_image;
-  }
+  const articleImage = chunkLC7AM4J5_js.resolveBlogArtwork(post, "article").src;
+  if (articleImage) schema.image = articleImage;
   if (siteName || logoUrl) {
     schema.publisher = {
       "@type": "Organization",
@@ -379,7 +382,7 @@ function generateBlogListSchema(options = {}) {
     "@type": "Blog",
     name: siteName ? `${siteName} Blog` : "Blog",
     description: description || "Our latest articles and insights.",
-    url: `${siteUrl}/blog`
+    url: chunkLC7AM4J5_js.resolveBlogUrl(chunkLC7AM4J5_js.createBlogRoutes(options).index, siteUrl)
   };
 }
 function generateFaqSchema(faqItems) {
@@ -404,7 +407,7 @@ function generateHowToSchema(post, steps, options = {}) {
     "@type": "HowTo",
     name: post.title,
     description: sanitizeExcerpt(post.excerpt || post.meta_description),
-    image: post.featured_image,
+    image: chunkLC7AM4J5_js.resolveBlogArtwork(post, "article").src,
     totalTime: post.reading_time ? `PT${post.reading_time}M` : void 0,
     step: steps.map((step, index) => ({
       "@type": "HowToStep",
@@ -412,12 +415,14 @@ function generateHowToSchema(post, steps, options = {}) {
       name: step.name,
       text: step.text,
       image: step.image,
-      url: step.url || `${siteUrl}/blog/${post.slug}#step-${index + 1}`
+      url: step.url || `${chunkLC7AM4J5_js.resolveBlogPostUrl(post, { ...options, siteUrl }).split("#")[0]}#step-${index + 1}`
     }))
   };
 }
 var FEED_MAX_POSTS = 100;
-async function getAllBlogPosts() {
+async function getAllBlogPosts(options = {}) {
+  const maxPosts = options.maxPosts ?? FEED_MAX_POSTS;
+  if (!(maxPosts > 0)) return [];
   const config = chunkO5GHP7UO_js.resolveServerApiConfig();
   if (!config) {
     console.warn("[Blog] No API key configured");
@@ -427,7 +432,7 @@ async function getAllBlogPosts() {
   const posts = [];
   let page = 1;
   try {
-    while (posts.length < FEED_MAX_POSTS) {
+    while (posts.length < maxPosts) {
       const response = await fetch(
         `${apiUrl}/public/blog/posts?per_page=50&page=${page}`,
         {
@@ -437,14 +442,15 @@ async function getAllBlogPosts() {
       );
       if (!response.ok) break;
       const data = await response.json();
-      posts.push(...data.posts || []);
-      if (!data.pagination?.has_next) break;
+      const batch = data.posts || [];
+      posts.push(...batch);
+      if (!batch.length || !data.pagination?.has_next) break;
       page += 1;
     }
   } catch (error) {
     console.error("[Blog] Error fetching posts for RSS:", error);
   }
-  return posts.slice(0, FEED_MAX_POSTS);
+  return posts.slice(0, maxPosts);
 }
 function escapeXml(text) {
   return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
@@ -476,7 +482,7 @@ async function generateRssFeed(options) {
     <lastBuildDate>${now}</lastBuildDate>
     <pubDate>${now}</pubDate>
     <ttl>${ttl}</ttl>
-    <atom:link href="${siteUrl}/blog/rss.xml" rel="self" type="application/rss+xml"/>
+    <atom:link href="${escapeXml(chunkLC7AM4J5_js.resolveBlogUrl(chunkLC7AM4J5_js.createBlogRoutes(options).rss, siteUrl))}" rel="self" type="application/rss+xml"/>
 `;
   if (copyright) {
     rss += `    <copyright>${escapeXml(copyright)}</copyright>
@@ -499,15 +505,15 @@ async function generateRssFeed(options) {
 `;
   }
   for (const post of posts) {
-    const postUrl = `${siteUrl}/blog/${post.slug}`;
+    const postUrl = chunkLC7AM4J5_js.resolveBlogPostUrl(post, { ...options, siteUrl });
     const pubDate = post.published_at ? new Date(post.published_at).toUTCString() : now;
     const author = typeof post.author === "string" ? post.author : post.author?.name || "Unknown";
     const fullContent = post.content_html || post.content || "";
     const description2 = sanitizeExcerpt(post.excerpt, 300) || stripHtml(fullContent).substring(0, 300) + "...";
     rss += `    <item>
       <title>${escapeXml(post.title)}</title>
-      <link>${postUrl}</link>
-      <guid isPermaLink="true">${postUrl}</guid>
+      <link>${escapeXml(postUrl)}</link>
+      <guid isPermaLink="true">${escapeXml(postUrl)}</guid>
       <description>${escapeXml(description2)}</description>
       <content:encoded><![CDATA[${fullContent}]]></content:encoded>
       <pubDate>${pubDate}</pubDate>
@@ -549,9 +555,9 @@ async function generateAtomFeed(options) {
 <feed xmlns="http://www.w3.org/2005/Atom">
   <title>${escapeXml(siteName)}</title>
   <subtitle>${escapeXml(description)}</subtitle>
-  <link href="${siteUrl}/blog/feed.xml" rel="self"/>
+  <link href="${escapeXml(chunkLC7AM4J5_js.resolveBlogUrl(chunkLC7AM4J5_js.createBlogRoutes(options).atom, siteUrl))}" rel="self"/>
   <link href="${siteUrl}"/>
-  <id>${siteUrl}/blog</id>
+  <id>${escapeXml(chunkLC7AM4J5_js.resolveBlogUrl(chunkLC7AM4J5_js.createBlogRoutes(options).index, siteUrl))}</id>
   <updated>${now}</updated>
 `;
   if (managingEditor) {
@@ -561,15 +567,15 @@ async function generateAtomFeed(options) {
 `;
   }
   for (const post of posts) {
-    const postUrl = `${siteUrl}/blog/${post.slug}`;
+    const postUrl = chunkLC7AM4J5_js.resolveBlogPostUrl(post, { ...options, siteUrl });
     const updated = post.updated_at || post.published_at || now;
     const published = post.published_at || now;
     const author = typeof post.author === "string" ? post.author : post.author?.name || "Unknown";
     const fullContent = post.content_html || post.content || "";
     atom += `  <entry>
     <title>${escapeXml(post.title)}</title>
-    <link href="${postUrl}"/>
-    <id>${postUrl}</id>
+    <link href="${escapeXml(postUrl)}"/>
+    <id>${escapeXml(postUrl)}</id>
     <updated>${new Date(updated).toISOString()}</updated>
     <published>${new Date(published).toISOString()}</published>
     <author>
@@ -700,7 +706,7 @@ async function getPostsByCategory(categorySlug) {
   }
 }
 function generateClusterItemListSchema(cluster, options = {}) {
-  const { siteUrl = "", basePath = "/blog" } = options;
+  const { siteUrl = "" } = options;
   return {
     "@context": "https://schema.org",
     "@type": "ItemList",
@@ -711,19 +717,19 @@ function generateClusterItemListSchema(cluster, options = {}) {
       "@type": "ListItem",
       position: i + 1,
       name: post.title,
-      url: `${siteUrl}${basePath}/${post.slug}`
+      url: chunkLC7AM4J5_js.resolveBlogPostUrl(post, { ...options, siteUrl })
     }))
   };
 }
 function generateClusterArticleSchema(post, cluster, options = {}) {
-  const { siteUrl = "", basePath = "/blog", siteName, logoUrl } = options;
+  const { siteUrl = "", siteName, logoUrl } = options;
   const isPillar = post.article_type === "pillar";
   const schema = {
     "@context": "https://schema.org",
     "@type": "Article",
     headline: post.title,
     description: sanitizeExcerpt(post.excerpt || post.meta_description),
-    url: `${siteUrl}${basePath}/${post.slug}`,
+    url: chunkLC7AM4J5_js.resolveBlogPostUrl(post, { ...options, siteUrl }),
     datePublished: post.published_at,
     dateModified: post.updated_at,
     author: {
@@ -732,9 +738,8 @@ function generateClusterArticleSchema(post, cluster, options = {}) {
     },
     keywords: post.focus_keyphrase || post.keywords
   };
-  if (post.featured_image) {
-    schema.image = post.featured_image;
-  }
+  const articleImage = chunkLC7AM4J5_js.resolveBlogArtwork(post, "article").src;
+  if (articleImage) schema.image = articleImage;
   if (siteName || logoUrl) {
     schema.publisher = {
       "@type": "Organization",
@@ -746,13 +751,13 @@ function generateClusterArticleSchema(post, cluster, options = {}) {
     schema.hasPart = cluster.supports.map((s) => ({
       "@type": "Article",
       headline: s.title,
-      url: `${siteUrl}${basePath}/${s.slug}`
+      url: chunkLC7AM4J5_js.resolveBlogPostUrl(s, { ...options, siteUrl })
     }));
   } else if (!isPillar && cluster.pillar) {
     schema.isPartOf = {
       "@type": "Article",
       headline: cluster.pillar.title,
-      url: `${siteUrl}${basePath}/${cluster.pillar.slug}`
+      url: chunkLC7AM4J5_js.resolveBlogPostUrl(cluster.pillar, { ...options, siteUrl })
     };
   }
   if (cluster.geo_target) {
@@ -764,21 +769,21 @@ function generateClusterArticleSchema(post, cluster, options = {}) {
   return schema;
 }
 function generateClusterBreadcrumbSchema(post, cluster, options = {}) {
-  const { siteUrl = "", siteName = "Home", basePath = "/blog" } = options;
+  const { siteUrl = "", siteName = "Home" } = options;
   const items = [
     { "@type": "ListItem", position: 1, name: siteName, item: siteUrl },
-    { "@type": "ListItem", position: 2, name: "Blog", item: `${siteUrl}${basePath}` },
+    { "@type": "ListItem", position: 2, name: "Blog", item: chunkLC7AM4J5_js.resolveBlogUrl(chunkLC7AM4J5_js.createBlogRoutes(options).index, siteUrl) },
     {
       "@type": "ListItem",
       position: 3,
       name: cluster.cluster_name,
-      item: `${siteUrl}${basePath}/cluster/${cluster.cluster_slug}`
+      item: chunkLC7AM4J5_js.resolveBlogUrl(chunkLC7AM4J5_js.createBlogRoutes(options).cluster(cluster.cluster_slug), siteUrl)
     },
     {
       "@type": "ListItem",
       position: 4,
       name: post.title,
-      item: `${siteUrl}${basePath}/${post.slug}`
+      item: chunkLC7AM4J5_js.resolveBlogPostUrl(post, { ...options, siteUrl })
     }
   ];
   return {
@@ -788,32 +793,32 @@ function generateClusterBreadcrumbSchema(post, cluster, options = {}) {
   };
 }
 function generateClusterLandingSchema(cluster, options = {}) {
-  const { siteUrl = "", basePath = "/blog", siteName } = options;
+  const { siteUrl = "", siteName } = options;
   return {
     "@context": "https://schema.org",
     "@type": "CollectionPage",
     name: cluster.cluster_name,
     description: `Comprehensive guide to ${cluster.core_topic}`,
-    url: `${siteUrl}${basePath}/cluster/${cluster.cluster_slug}`,
+    url: chunkLC7AM4J5_js.resolveBlogUrl(chunkLC7AM4J5_js.createBlogRoutes(options).cluster(cluster.cluster_slug), siteUrl),
     ...siteName && {
       isPartOf: { "@type": "WebSite", name: siteName, url: siteUrl }
     },
     mainEntity: cluster.pillar ? {
       "@type": "Article",
       headline: cluster.pillar.title,
-      url: `${siteUrl}${basePath}/${cluster.pillar.slug}`
+      url: chunkLC7AM4J5_js.resolveBlogPostUrl(cluster.pillar, { ...options, siteUrl })
     } : void 0,
     hasPart: cluster.supports.map((s) => ({
       "@type": "Article",
       headline: s.title,
-      url: `${siteUrl}${basePath}/${s.slug}`
+      url: chunkLC7AM4J5_js.resolveBlogPostUrl(s, { ...options, siteUrl })
     }))
   };
 }
 async function generateClusterPageMetadata(clusterSlug, options = {}) {
   const cluster = await getTopicCluster(clusterSlug);
   if (!cluster) return {};
-  const { siteName = "", siteUrl = "", basePath = "/blog" } = options;
+  const { siteName = "", siteUrl = "" } = options;
   const title = `${cluster.cluster_name}${siteName ? ` | ${siteName}` : ""}`;
   const description = `Comprehensive guide to ${cluster.core_topic}. ${cluster.article_count} articles covering everything you need to know.`;
   return {
@@ -822,7 +827,7 @@ async function generateClusterPageMetadata(clusterSlug, options = {}) {
     openGraph: {
       title,
       description,
-      url: `${siteUrl}${basePath}/cluster/${cluster.cluster_slug}`,
+      url: chunkLC7AM4J5_js.resolveBlogUrl(chunkLC7AM4J5_js.createBlogRoutes(options).cluster(cluster.cluster_slug), siteUrl),
       type: "website"
     }
   };
@@ -868,7 +873,7 @@ function generateBreadcrumbSchema(post, options = {}) {
       "@type": "ListItem",
       position: 2,
       name: "Blog",
-      item: `${siteUrl}/blog`
+      item: chunkLC7AM4J5_js.resolveBlogUrl(chunkLC7AM4J5_js.createBlogRoutes(options).index, siteUrl)
     }
   ];
   if (post.category) {
@@ -878,20 +883,20 @@ function generateBreadcrumbSchema(post, options = {}) {
       "@type": "ListItem",
       position: 3,
       name: categoryName,
-      item: `${siteUrl}/blog/category/${categorySlug}`
+      item: chunkLC7AM4J5_js.resolveBlogUrl(chunkLC7AM4J5_js.createBlogRoutes(options).category(categorySlug), siteUrl)
     });
     items.push({
       "@type": "ListItem",
       position: 4,
       name: post.title,
-      item: `${siteUrl}/blog/${post.slug}`
+      item: chunkLC7AM4J5_js.resolveBlogPostUrl(post, { ...options, siteUrl })
     });
   } else {
     items.push({
       "@type": "ListItem",
       position: 3,
       name: post.title,
-      item: `${siteUrl}/blog/${post.slug}`
+      item: chunkLC7AM4J5_js.resolveBlogPostUrl(post, { ...options, siteUrl })
     });
   }
   return {
@@ -1000,7 +1005,7 @@ function generateAuthorPageMetadata(author, options = {}) {
   const { siteUrl = "", siteName } = options;
   const title = `${author.name}${author.title ? ` - ${author.title}` : ""}`;
   const description = author.short_bio || author.bio || `Articles by ${author.name}`;
-  const url = `${siteUrl}/blog/author/${author.slug}`;
+  const url = chunkLC7AM4J5_js.resolveBlogUrl(chunkLC7AM4J5_js.createBlogRoutes(options).author(author.slug), siteUrl);
   return {
     title,
     description,
@@ -1063,5 +1068,5 @@ exports.sanitizeExcerpt = sanitizeExcerpt;
 exports.validateBlogPostSeo = validateBlogPostSeo;
 exports.validateMetaDescription = validateMetaDescription;
 exports.validateSeoTitle = validateSeoTitle;
-//# sourceMappingURL=chunk-JBGRXICL.js.map
-//# sourceMappingURL=chunk-JBGRXICL.js.map
+//# sourceMappingURL=chunk-746RKQHA.js.map
+//# sourceMappingURL=chunk-746RKQHA.js.map