@sonordev/site-kit 5.4.0 → 5.5.0

package/dist/{chunk-I4PDSDVE.mjs → chunk-4XGACM7D.mjs}

@@ -1,4 +1,4 @@
-import { SITE_KIT_VERSION } from './chunk-7U7C6XRI.mjs';
+import { SITE_KIT_VERSION } from './chunk-WDBCXRTT.mjs';
 
 // src/shared/siteToken.ts
 var SITE_TOKEN_PREFIX = "st1.";
@@ -146,5 +146,5 @@ function currentCredential(seed) {
 }
 
 export { configureSiteCredential, credentialBreakerId, currentCredential, getFreshCredential, isSiteToken, isTokenMode, refreshSiteToken };
-//# sourceMappingURL=chunk-I4PDSDVE.mjs.map
-//# sourceMappingURL=chunk-I4PDSDVE.mjs.map
+//# sourceMappingURL=chunk-4XGACM7D.mjs.map
+//# sourceMappingURL=chunk-4XGACM7D.mjs.map

package/dist/{chunk-I4PDSDVE.mjs.map → chunk-4XGACM7D.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/siteToken.ts"],"names":[],"mappings":";;;AAuBO,IAAM,iBAAA,GAAoB,MAAA;AAGjC,IAAM,kBAAkB,CAAA,GAAI,GAAA;AAC5B,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,WAAA,GAAc,sBAAA;AAEb,SAAS,YAAY,UAAA,EAAqC;AAC/D,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,IAAY,UAAA,CAAW,WAAW,iBAAiB,CAAA;AAClF;AASO,SAAS,sBAAsB,KAAA,EAA6C;AACjF,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,MAAM,GAAA,GAAO,KAAA,CAAiB,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC1C,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,IAAI;AAEF,IAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACpD,IAAA,MAAM,IAAA,GACJ,OAAO,IAAA,KAAS,UAAA,GACZ,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACnD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,IAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,GAAS,MAAA,GAAS,IAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOO,SAAS,oBAAoB,UAAA,EAAoC;AACtE,EAAA,IAAI,CAAC,YAAY,OAAO,aAAA;AACxB,EAAA,MAAM,MAAA,GAAS,sBAAsB,UAAU,CAAA;AAC/C,EAAA,IAAI,MAAA,EAAQ,GAAA,EAAK,OAAO,CAAA,IAAA,EAAO,OAAO,GAAG,CAAA,CAAA;AACzC,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B;AAeA,SAAS,iBAAA,GAAgC;AACvC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,MAAA;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,MAAA,EAAQ,sBAAA;AAAA,IACR,KAAA,EAAO,IAAA;AAAA,IACP,UAAA,EAAY;AAAA,GACd;AACF;AAcA,IAAM,eAAA,GAAkB,4BAAA;AAExB,IAAM,SAAqB,MAAM;AAC/B,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,iBAAA,EAAkB;AAC5D,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,4CAAuB,iBAAA,EAAkB,CAAA;AACnD,CAAA,GAAG;AAEH,SAAS,eAAA,GAAiC;AACxC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AACrD,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,OAAO,MAAA,EAAQ,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ,IAAA;AAAA,EAC5D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAW,KAAA,EAAqB;AACvC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACnC,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,cAAA,CAAe,QAAQ,WAAA,EAAa,IAAA,CAAK,UAAU,EAAE,KAAA,EAAO,CAAC,CAAA;AAAA,EACtE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA;AAAC,IAAC,OAAe,oBAAA,GAAuB,KAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,SAAS,KAAA,EAA8B;AAC9C,EAAA,MAAM,MAAA,GAAS,sBAAsB,KAAK,CAAA;AAC1C,EAAA,OAAO,OAAO,MAAA,EAAQ,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,MAAM,GAAA,GAAO,CAAA;AAC/D;AAMO,SAAS,wBAAwB,IAAA,EAG/B;AACP,EAAA,KAAA,CAAM,OAAO,IAAA,CAAK,UAAA;AAClB,EAAA,KAAA,CAAM,OAAA,GAAU,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,QAAQ,KAAA,CAAM,MAAA,GAAS,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAE9D,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,IAAA;AAAA,EACF;AAKA,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,EAAA,IAAI,IAAA,GAAO,KAAK,UAAA,IAAc,IAAA;AAC9B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,IAAI,UAAU,QAAA,CAAS,MAAM,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,MAAA;AACxD,EAAA,IAAI,SAAS,QAAA,CAAS,KAAK,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,KAAA;AACtD,EAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AAChB;AAEA,SAAS,YAAA,GAAwB;AAC/B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,KAAA;AAC3B,EAAA,IAAI,CAAC,KAAA,CAAM,KAAA,EAAO,OAAO,IAAA;AACzB,EAAA,OAAO,KAAK,GAAA,EAAI,IAAK,QAAA,CAAS,KAAA,CAAM,KAAK,CAAA,GAAI,eAAA;AAC/C;AAEA,eAAe,SAAA,GAAoC;AACjD,EAAA,MAAM,UAAU,KAAA,CAAM,KAAA;AACtB,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,8BAAA,CAAA,EAAkC;AAAA,MACvE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqB,gBAAA;AAAA;AAAA;AAAA,QAGrB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACvC,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,kBAAkB,CAAA,GACtC,KAAA;AAAA,KACP,CAAA;AACD,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,OAAO,IAAA;AACpB,IAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC9C,IAAA,MAAM,OAAO,IAAA,EAAM,KAAA;AACnB,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,WAAA,CAAY,IAAI,CAAA,EAAG;AACjD,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,UAAA,CAAW,IAAI,CAAA;AACf,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,gBAAA,GAA2C;AACzD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,UAAA,EAAY,OAAO,KAAA,CAAM,UAAA;AACnC,EAAA,KAAA,CAAM,UAAA,GAAa,SAAA,EAAU,CAAE,OAAA,CAAQ,MAAM;AAC3C,IAAA,KAAA,CAAM,UAAA,GAAa,IAAA;AAAA,EACrB,CAAC,CAAA;AACD,EAAA,OAAO,KAAA,CAAM,UAAA;AACf;AAMA,eAAsB,mBACpB,IAAA,EAC6B;AAI7B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,IAAW,WAAA,CAAY,IAAI,CAAA,EAAG;AACvC,IAAA,uBAAA,CAAwB,EAAE,UAAA,EAAY,IAAA,EAAM,CAAA;AAAA,EAC9C;AAEA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,IAAI,cAAa,EAAG;AAClB,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,WAAW,OAAO,SAAA;AAAA,EAGxB;AACA,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC;AAGO,SAAS,WAAA,GAAuB;AACrC,EAAA,OAAO,KAAA,CAAM,OAAA;AACf;AAOO,SAAS,kBAAkB,IAAA,EAAmC;AACnE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC","file":"chunk-I4PDSDVE.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared — Client token manager\n *\n * SiteKitLayout (a server component) no longer ships the raw `sonor_` API key to\n * the browser. Instead it mints a short-lived, project-scoped token server-side\n * and injects THAT. This module is the browser-side lifecycle for that token:\n *\n *   - holds the current token (seeded from the injected value)\n *   - a static page's seed can be days old and already expired on first view, so\n *     it transparently REFRESHES via the public endpoint before first use\n *   - dedupes concurrent refreshes (one in-flight request, awaited by all)\n *   - persists the freshest token in sessionStorage so navigations within a\n *     session don't each re-refresh\n *\n * Everything here is a no-op passthrough when the injected credential is a raw\n * key (a 2.x kit, or the mint-failed fallback) — legacy behavior is unchanged.\n * Fully SSR-safe: on the server there is no refresh, just the seed.\n *\n * The token payload is NOT secret (only its HMAC is unforgeable), so decoding it\n * client-side to read `exp`/`pid` is fine and needs no crypto.\n */\nimport { SITE_KIT_VERSION } from './version'\n\nexport const SITE_TOKEN_PREFIX = 'st1.'\n\n/** Refresh this many ms before expiry, so a request never races the deadline. */\nconst REFRESH_SKEW_MS = 5 * 60_000\nconst REFRESH_TIMEOUT_MS = 6_000\nconst STORAGE_KEY = '__sonor_site_token__'\n\nexport function isSiteToken(credential?: string | null): boolean {\n  return typeof credential === 'string' && credential.startsWith(SITE_TOKEN_PREFIX)\n}\n\ninterface DecodedClaims {\n  pid?: string\n  iat?: number\n  exp?: number\n}\n\n/** Decode the (non-secret) token payload. Returns null if not a token / malformed. */\nexport function decodeSiteTokenClaims(token?: string | null): DecodedClaims | null {\n  if (!isSiteToken(token)) return null\n  const seg = (token as string).split('.')[1]\n  if (!seg) return null\n  try {\n    // base64url → JSON. atob handles standard base64; restore url-safe chars.\n    const b64 = seg.replace(/-/g, '+').replace(/_/g, '/')\n    const json =\n      typeof atob === 'function'\n        ? atob(b64)\n        : Buffer.from(seg, 'base64url').toString('utf8')\n    const claims = JSON.parse(json)\n    return typeof claims === 'object' && claims ? claims : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Stable id for the auth circuit breaker. Tokens rotate, so keying the breaker\n * by the raw value would reset it every refresh — key by the project id encoded\n * in the token instead. Raw keys use a safe prefix.\n */\nexport function credentialBreakerId(credential?: string | null): string {\n  if (!credential) return '(anonymous)'\n  const claims = decodeSiteTokenClaims(credential)\n  if (claims?.pid) return `pid:${claims.pid}`\n  return credential.slice(0, 16)\n}\n\ninterface TokenState {\n  /** The credential injected by the layout (token or raw key). */\n  seed: string | undefined\n  /** Whether we're in token mode (seed is a token). */\n  isToken: boolean\n  /** Base API URL for the refresh endpoint. */\n  apiUrl: string\n  /** The freshest known token (>= seed). Null in raw-key mode. */\n  token: string | null\n  /** In-flight refresh, deduped. */\n  refreshing: Promise<string | null> | null\n}\n\nfunction initialTokenState(): TokenState {\n  return {\n    seed: undefined,\n    isToken: false,\n    apiUrl: 'https://api.sonor.io',\n    token: null,\n    refreshing: null,\n  }\n}\n\n/**\n * Page-wide singleton, keyed on window. Bundlers can (and in the field, do)\n * inline more than one copy of this module into a page — e.g. an app importing\n * site-kit directly while a transpiled component library bundles its own copy.\n * Module-scoped state then splits into per-copy brains: one copy gets\n * configured and refreshes fine while the other keeps sending the stale\n * prerendered seed, 401s, and trips its breaker (\"sonor-auth-paused\" with a\n * working network). Sharing the state object on window gives every copy the\n * same token, the same deduped refresh, and the same breaker. On the server\n * (no window) each module instance keeps private state — there's no refresh\n * lifecycle there anyway.\n */\nconst TOKEN_STATE_KEY = '__SONOR_SITE_TOKEN_STATE__'\n\nconst state: TokenState = (() => {\n  if (typeof window === 'undefined') return initialTokenState()\n  const w = window as unknown as Record<string, TokenState | undefined>\n  return (w[TOKEN_STATE_KEY] ??= initialTokenState())\n})()\n\nfunction readStoredToken(): string | null {\n  if (typeof window === 'undefined') return null\n  try {\n    const raw = window.sessionStorage.getItem(STORAGE_KEY)\n    if (!raw) return null\n    const parsed = JSON.parse(raw)\n    return typeof parsed?.token === 'string' ? parsed.token : null\n  } catch {\n    return null\n  }\n}\n\nfunction storeToken(token: string): void {\n  if (typeof window === 'undefined') return\n  try {\n    window.sessionStorage.setItem(STORAGE_KEY, JSON.stringify({ token }))\n  } catch {\n    /* private mode / disabled storage — memory-only is fine */\n  }\n  try {\n    ;(window as any).__SITE_KIT_API_KEY__ = token\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction tokenExp(token: string | null): number {\n  const claims = decodeSiteTokenClaims(token)\n  return typeof claims?.exp === 'number' ? claims.exp * 1000 : 0\n}\n\n/**\n * Configure the manager from the layout-injected values. Adopts a fresher token\n * from sessionStorage if a prior page in this session already refreshed.\n */\nexport function configureSiteCredential(opts: {\n  credential?: string\n  apiUrl?: string\n}): void {\n  state.seed = opts.credential\n  state.isToken = isSiteToken(opts.credential)\n  if (opts.apiUrl) state.apiUrl = opts.apiUrl.replace(/\\/+$/, '')\n\n  if (!state.isToken) {\n    state.token = null\n    return\n  }\n\n  // configure runs on every render — never downgrade. Keep the freshest of the\n  // injected seed, a token stored by an earlier page this session, and whatever\n  // an in-flight/prior refresh already put in memory.\n  const prior = state.token\n  let best = opts.credential ?? null\n  const stored = readStoredToken()\n  if (stored && tokenExp(stored) > tokenExp(best)) best = stored\n  if (prior && tokenExp(prior) > tokenExp(best)) best = prior\n  state.token = best\n}\n\nfunction needsRefresh(): boolean {\n  if (!state.isToken) return false\n  if (!state.token) return true\n  return Date.now() >= tokenExp(state.token) - REFRESH_SKEW_MS\n}\n\nasync function doRefresh(): Promise<string | null> {\n  const current = state.token\n  if (!current) return null\n  try {\n    const res = await fetch(`${state.apiUrl}/api/public/site-token/refresh`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        // Send the current token as x-api-key too, so the server's key-scoped\n        // throttler buckets refreshes by token rather than by shared CDN IP.\n        'x-api-key': current,\n      },\n      body: JSON.stringify({ token: current }),\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(REFRESH_TIMEOUT_MS)\n          : undefined,\n    })\n    if (!res.ok) return null\n    const data = await res.json().catch(() => null)\n    const next = data?.token\n    if (typeof next === 'string' && isSiteToken(next)) {\n      state.token = next\n      storeToken(next)\n      return next\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\n/** Refresh now (deduped). Returns the new token, or null on failure. */\nexport function refreshSiteToken(): Promise<string | null> {\n  if (!state.isToken) return Promise.resolve(null)\n  if (state.refreshing) return state.refreshing\n  state.refreshing = doRefresh().finally(() => {\n    state.refreshing = null\n  })\n  return state.refreshing\n}\n\n/**\n * The credential to put on the next request. In token mode, refreshes a stale\n * seed first. In raw-key mode, returns the seed unchanged (legacy passthrough).\n */\nexport async function getFreshCredential(\n  seed?: string,\n): Promise<string | undefined> {\n  // Unconfigured but handed a token (a component received the prerendered seed\n  // as a prop before any provider configured the manager): adopt it so the\n  // refresh machinery works instead of replaying a possibly-expired seed.\n  if (!state.isToken && isSiteToken(seed)) {\n    configureSiteCredential({ credential: seed })\n  }\n  // A raw key (or nothing configured) — no token machinery.\n  if (!state.isToken) return seed ?? state.seed\n  if (needsRefresh()) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed) return refreshed\n    // Refresh failed — fall through to whatever we have; the request may 401 and\n    // trip the breaker with friendly copy.\n  }\n  return state.token ?? seed ?? state.seed\n}\n\n/** Whether the given credential is being managed as a token. */\nexport function isTokenMode(): boolean {\n  return state.isToken\n}\n\n/**\n * Best-known credential WITHOUT refreshing — for synchronous unload paths\n * (sonorBeacon) that can't await. In token mode returns the freshest token held;\n * in raw-key mode returns the seed.\n */\nexport function currentCredential(seed?: string): string | undefined {\n  if (!state.isToken) return seed ?? state.seed\n  return state.token ?? seed ?? state.seed\n}\n"]}
+{"version":3,"sources":["../src/shared/siteToken.ts"],"names":[],"mappings":";;;AAuBO,IAAM,iBAAA,GAAoB,MAAA;AAGjC,IAAM,kBAAkB,CAAA,GAAI,GAAA;AAC5B,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,WAAA,GAAc,sBAAA;AAEb,SAAS,YAAY,UAAA,EAAqC;AAC/D,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,IAAY,UAAA,CAAW,WAAW,iBAAiB,CAAA;AAClF;AASO,SAAS,sBAAsB,KAAA,EAA6C;AACjF,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,MAAM,GAAA,GAAO,KAAA,CAAiB,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC1C,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,IAAI;AAEF,IAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACpD,IAAA,MAAM,IAAA,GACJ,OAAO,IAAA,KAAS,UAAA,GACZ,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACnD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,IAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,GAAS,MAAA,GAAS,IAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOO,SAAS,oBAAoB,UAAA,EAAoC;AACtE,EAAA,IAAI,CAAC,YAAY,OAAO,aAAA;AACxB,EAAA,MAAM,MAAA,GAAS,sBAAsB,UAAU,CAAA;AAC/C,EAAA,IAAI,MAAA,EAAQ,GAAA,EAAK,OAAO,CAAA,IAAA,EAAO,OAAO,GAAG,CAAA,CAAA;AACzC,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B;AAeA,SAAS,iBAAA,GAAgC;AACvC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,MAAA;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,MAAA,EAAQ,sBAAA;AAAA,IACR,KAAA,EAAO,IAAA;AAAA,IACP,UAAA,EAAY;AAAA,GACd;AACF;AAcA,IAAM,eAAA,GAAkB,4BAAA;AAExB,IAAM,SAAqB,MAAM;AAC/B,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,iBAAA,EAAkB;AAC5D,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,4CAAuB,iBAAA,EAAkB,CAAA;AACnD,CAAA,GAAG;AAEH,SAAS,eAAA,GAAiC;AACxC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AACrD,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,OAAO,MAAA,EAAQ,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ,IAAA;AAAA,EAC5D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAW,KAAA,EAAqB;AACvC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACnC,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,cAAA,CAAe,QAAQ,WAAA,EAAa,IAAA,CAAK,UAAU,EAAE,KAAA,EAAO,CAAC,CAAA;AAAA,EACtE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA;AAAC,IAAC,OAAe,oBAAA,GAAuB,KAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,SAAS,KAAA,EAA8B;AAC9C,EAAA,MAAM,MAAA,GAAS,sBAAsB,KAAK,CAAA;AAC1C,EAAA,OAAO,OAAO,MAAA,EAAQ,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,MAAM,GAAA,GAAO,CAAA;AAC/D;AAMO,SAAS,wBAAwB,IAAA,EAG/B;AACP,EAAA,KAAA,CAAM,OAAO,IAAA,CAAK,UAAA;AAClB,EAAA,KAAA,CAAM,OAAA,GAAU,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,QAAQ,KAAA,CAAM,MAAA,GAAS,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAE9D,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,IAAA;AAAA,EACF;AAKA,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,EAAA,IAAI,IAAA,GAAO,KAAK,UAAA,IAAc,IAAA;AAC9B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,IAAI,UAAU,QAAA,CAAS,MAAM,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,MAAA;AACxD,EAAA,IAAI,SAAS,QAAA,CAAS,KAAK,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,KAAA;AACtD,EAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AAChB;AAEA,SAAS,YAAA,GAAwB;AAC/B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,KAAA;AAC3B,EAAA,IAAI,CAAC,KAAA,CAAM,KAAA,EAAO,OAAO,IAAA;AACzB,EAAA,OAAO,KAAK,GAAA,EAAI,IAAK,QAAA,CAAS,KAAA,CAAM,KAAK,CAAA,GAAI,eAAA;AAC/C;AAEA,eAAe,SAAA,GAAoC;AACjD,EAAA,MAAM,UAAU,KAAA,CAAM,KAAA;AACtB,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,8BAAA,CAAA,EAAkC;AAAA,MACvE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqB,gBAAA;AAAA;AAAA;AAAA,QAGrB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACvC,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,kBAAkB,CAAA,GACtC,KAAA;AAAA,KACP,CAAA;AACD,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,OAAO,IAAA;AACpB,IAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC9C,IAAA,MAAM,OAAO,IAAA,EAAM,KAAA;AACnB,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,WAAA,CAAY,IAAI,CAAA,EAAG;AACjD,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,UAAA,CAAW,IAAI,CAAA;AACf,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,gBAAA,GAA2C;AACzD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,UAAA,EAAY,OAAO,KAAA,CAAM,UAAA;AACnC,EAAA,KAAA,CAAM,UAAA,GAAa,SAAA,EAAU,CAAE,OAAA,CAAQ,MAAM;AAC3C,IAAA,KAAA,CAAM,UAAA,GAAa,IAAA;AAAA,EACrB,CAAC,CAAA;AACD,EAAA,OAAO,KAAA,CAAM,UAAA;AACf;AAMA,eAAsB,mBACpB,IAAA,EAC6B;AAI7B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,IAAW,WAAA,CAAY,IAAI,CAAA,EAAG;AACvC,IAAA,uBAAA,CAAwB,EAAE,UAAA,EAAY,IAAA,EAAM,CAAA;AAAA,EAC9C;AAEA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,IAAI,cAAa,EAAG;AAClB,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,WAAW,OAAO,SAAA;AAAA,EAGxB;AACA,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC;AAGO,SAAS,WAAA,GAAuB;AACrC,EAAA,OAAO,KAAA,CAAM,OAAA;AACf;AAOO,SAAS,kBAAkB,IAAA,EAAmC;AACnE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC","file":"chunk-4XGACM7D.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared — Client token manager\n *\n * SiteKitLayout (a server component) no longer ships the raw `sonor_` API key to\n * the browser. Instead it mints a short-lived, project-scoped token server-side\n * and injects THAT. This module is the browser-side lifecycle for that token:\n *\n *   - holds the current token (seeded from the injected value)\n *   - a static page's seed can be days old and already expired on first view, so\n *     it transparently REFRESHES via the public endpoint before first use\n *   - dedupes concurrent refreshes (one in-flight request, awaited by all)\n *   - persists the freshest token in sessionStorage so navigations within a\n *     session don't each re-refresh\n *\n * Everything here is a no-op passthrough when the injected credential is a raw\n * key (a 2.x kit, or the mint-failed fallback) — legacy behavior is unchanged.\n * Fully SSR-safe: on the server there is no refresh, just the seed.\n *\n * The token payload is NOT secret (only its HMAC is unforgeable), so decoding it\n * client-side to read `exp`/`pid` is fine and needs no crypto.\n */\nimport { SITE_KIT_VERSION } from './version'\n\nexport const SITE_TOKEN_PREFIX = 'st1.'\n\n/** Refresh this many ms before expiry, so a request never races the deadline. */\nconst REFRESH_SKEW_MS = 5 * 60_000\nconst REFRESH_TIMEOUT_MS = 6_000\nconst STORAGE_KEY = '__sonor_site_token__'\n\nexport function isSiteToken(credential?: string | null): boolean {\n  return typeof credential === 'string' && credential.startsWith(SITE_TOKEN_PREFIX)\n}\n\ninterface DecodedClaims {\n  pid?: string\n  iat?: number\n  exp?: number\n}\n\n/** Decode the (non-secret) token payload. Returns null if not a token / malformed. */\nexport function decodeSiteTokenClaims(token?: string | null): DecodedClaims | null {\n  if (!isSiteToken(token)) return null\n  const seg = (token as string).split('.')[1]\n  if (!seg) return null\n  try {\n    // base64url → JSON. atob handles standard base64; restore url-safe chars.\n    const b64 = seg.replace(/-/g, '+').replace(/_/g, '/')\n    const json =\n      typeof atob === 'function'\n        ? atob(b64)\n        : Buffer.from(seg, 'base64url').toString('utf8')\n    const claims = JSON.parse(json)\n    return typeof claims === 'object' && claims ? claims : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Stable id for the auth circuit breaker. Tokens rotate, so keying the breaker\n * by the raw value would reset it every refresh — key by the project id encoded\n * in the token instead. Raw keys use a safe prefix.\n */\nexport function credentialBreakerId(credential?: string | null): string {\n  if (!credential) return '(anonymous)'\n  const claims = decodeSiteTokenClaims(credential)\n  if (claims?.pid) return `pid:${claims.pid}`\n  return credential.slice(0, 16)\n}\n\ninterface TokenState {\n  /** The credential injected by the layout (token or raw key). */\n  seed: string | undefined\n  /** Whether we're in token mode (seed is a token). */\n  isToken: boolean\n  /** Base API URL for the refresh endpoint. */\n  apiUrl: string\n  /** The freshest known token (>= seed). Null in raw-key mode. */\n  token: string | null\n  /** In-flight refresh, deduped. */\n  refreshing: Promise<string | null> | null\n}\n\nfunction initialTokenState(): TokenState {\n  return {\n    seed: undefined,\n    isToken: false,\n    apiUrl: 'https://api.sonor.io',\n    token: null,\n    refreshing: null,\n  }\n}\n\n/**\n * Page-wide singleton, keyed on window. Bundlers can (and in the field, do)\n * inline more than one copy of this module into a page — e.g. an app importing\n * site-kit directly while a transpiled component library bundles its own copy.\n * Module-scoped state then splits into per-copy brains: one copy gets\n * configured and refreshes fine while the other keeps sending the stale\n * prerendered seed, 401s, and trips its breaker (\"sonor-auth-paused\" with a\n * working network). Sharing the state object on window gives every copy the\n * same token, the same deduped refresh, and the same breaker. On the server\n * (no window) each module instance keeps private state — there's no refresh\n * lifecycle there anyway.\n */\nconst TOKEN_STATE_KEY = '__SONOR_SITE_TOKEN_STATE__'\n\nconst state: TokenState = (() => {\n  if (typeof window === 'undefined') return initialTokenState()\n  const w = window as unknown as Record<string, TokenState | undefined>\n  return (w[TOKEN_STATE_KEY] ??= initialTokenState())\n})()\n\nfunction readStoredToken(): string | null {\n  if (typeof window === 'undefined') return null\n  try {\n    const raw = window.sessionStorage.getItem(STORAGE_KEY)\n    if (!raw) return null\n    const parsed = JSON.parse(raw)\n    return typeof parsed?.token === 'string' ? parsed.token : null\n  } catch {\n    return null\n  }\n}\n\nfunction storeToken(token: string): void {\n  if (typeof window === 'undefined') return\n  try {\n    window.sessionStorage.setItem(STORAGE_KEY, JSON.stringify({ token }))\n  } catch {\n    /* private mode / disabled storage — memory-only is fine */\n  }\n  try {\n    ;(window as any).__SITE_KIT_API_KEY__ = token\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction tokenExp(token: string | null): number {\n  const claims = decodeSiteTokenClaims(token)\n  return typeof claims?.exp === 'number' ? claims.exp * 1000 : 0\n}\n\n/**\n * Configure the manager from the layout-injected values. Adopts a fresher token\n * from sessionStorage if a prior page in this session already refreshed.\n */\nexport function configureSiteCredential(opts: {\n  credential?: string\n  apiUrl?: string\n}): void {\n  state.seed = opts.credential\n  state.isToken = isSiteToken(opts.credential)\n  if (opts.apiUrl) state.apiUrl = opts.apiUrl.replace(/\\/+$/, '')\n\n  if (!state.isToken) {\n    state.token = null\n    return\n  }\n\n  // configure runs on every render — never downgrade. Keep the freshest of the\n  // injected seed, a token stored by an earlier page this session, and whatever\n  // an in-flight/prior refresh already put in memory.\n  const prior = state.token\n  let best = opts.credential ?? null\n  const stored = readStoredToken()\n  if (stored && tokenExp(stored) > tokenExp(best)) best = stored\n  if (prior && tokenExp(prior) > tokenExp(best)) best = prior\n  state.token = best\n}\n\nfunction needsRefresh(): boolean {\n  if (!state.isToken) return false\n  if (!state.token) return true\n  return Date.now() >= tokenExp(state.token) - REFRESH_SKEW_MS\n}\n\nasync function doRefresh(): Promise<string | null> {\n  const current = state.token\n  if (!current) return null\n  try {\n    const res = await fetch(`${state.apiUrl}/api/public/site-token/refresh`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        // Send the current token as x-api-key too, so the server's key-scoped\n        // throttler buckets refreshes by token rather than by shared CDN IP.\n        'x-api-key': current,\n      },\n      body: JSON.stringify({ token: current }),\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(REFRESH_TIMEOUT_MS)\n          : undefined,\n    })\n    if (!res.ok) return null\n    const data = await res.json().catch(() => null)\n    const next = data?.token\n    if (typeof next === 'string' && isSiteToken(next)) {\n      state.token = next\n      storeToken(next)\n      return next\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\n/** Refresh now (deduped). Returns the new token, or null on failure. */\nexport function refreshSiteToken(): Promise<string | null> {\n  if (!state.isToken) return Promise.resolve(null)\n  if (state.refreshing) return state.refreshing\n  state.refreshing = doRefresh().finally(() => {\n    state.refreshing = null\n  })\n  return state.refreshing\n}\n\n/**\n * The credential to put on the next request. In token mode, refreshes a stale\n * seed first. In raw-key mode, returns the seed unchanged (legacy passthrough).\n */\nexport async function getFreshCredential(\n  seed?: string,\n): Promise<string | undefined> {\n  // Unconfigured but handed a token (a component received the prerendered seed\n  // as a prop before any provider configured the manager): adopt it so the\n  // refresh machinery works instead of replaying a possibly-expired seed.\n  if (!state.isToken && isSiteToken(seed)) {\n    configureSiteCredential({ credential: seed })\n  }\n  // A raw key (or nothing configured) — no token machinery.\n  if (!state.isToken) return seed ?? state.seed\n  if (needsRefresh()) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed) return refreshed\n    // Refresh failed — fall through to whatever we have; the request may 401 and\n    // trip the breaker with friendly copy.\n  }\n  return state.token ?? seed ?? state.seed\n}\n\n/** Whether the given credential is being managed as a token. */\nexport function isTokenMode(): boolean {\n  return state.isToken\n}\n\n/**\n * Best-known credential WITHOUT refreshing — for synchronous unload paths\n * (sonorBeacon) that can't await. In token mode returns the freshest token held;\n * in raw-key mode returns the seed.\n */\nexport function currentCredential(seed?: string): string | undefined {\n  if (!state.isToken) return seed ?? state.seed\n  return state.token ?? seed ?? state.seed\n}\n"]}

package/dist/{chunk-HDDV63XJ.mjs → chunk-5TGAUWNO.mjs}

@@ -1,5 +1,5 @@
 import { resolveSiteHost } from './chunk-GZJE23Y5.mjs';
-import { configureSiteCredential, currentCredential } from './chunk-I4PDSDVE.mjs';
+import { configureSiteCredential, currentCredential } from './chunk-4XGACM7D.mjs';
 
 // src/shared/publishCredential.ts
 function publishSiteCredential({
@@ -19,5 +19,5 @@ function publishSiteCredential({
 }
 
 export { publishSiteCredential };
-//# sourceMappingURL=chunk-HDDV63XJ.mjs.map
-//# sourceMappingURL=chunk-HDDV63XJ.mjs.map
+//# sourceMappingURL=chunk-5TGAUWNO.mjs.map
+//# sourceMappingURL=chunk-5TGAUWNO.mjs.map

package/dist/{chunk-HDDV63XJ.mjs.map → chunk-5TGAUWNO.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/publishCredential.ts"],"names":[],"mappings":";;;;AAkEO,SAAS,qBAAA,CAAsB;AAAA,EACpC,MAAA;AAAA,EACA,MAAA,GAAS,sBAAA;AAAA,EACT,IAAA;AAAA,EACA,KAAA,GAAQ,KAAA;AAAA,EACR;AACF,CAAA,EAAuC;AACrC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAKnC,EAAA,uBAAA,CAAwB,EAAE,UAAA,EAAY,MAAA,EAAQ,MAAA,EAAQ,CAAA;AACrD,EAAC,OAAe,oBAAA,GAAuB,MAAA;AACvC,EAAC,MAAA,CAAe,oBAAA,GAAuB,iBAAA,CAAkB,MAAM,CAAA;AAC/D,EAAC,OAAe,kBAAA,GAAqB,KAAA;AACrC,EAAC,MAAA,CAAe,iBAAA,GAAoB,IAAA,IAAQ,eAAA,EAAgB;AAG7D,EAAA,IAAI,cAAA,EAAiB,MAAA,CAAe,uBAAA,GAA0B,cAAA;AAChE","file":"chunk-HDDV63XJ.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared — Client credential + window-global publishing\n *\n * SINGLE SOURCE OF TRUTH for seeding the browser-side token manager and the\n * `window.__SITE_KIT_*` globals that every client module reads. Used by:\n *\n *   - `SiteKitClientProviders` (core `SiteKitLayout`)\n *   - `SiteKitCredential` (`@sonordev/site-kit/client`) — the public component\n *     for layouts that are NOT core `SiteKitLayout`, e.g.\n *     `@sonordev/agency-site-kit`'s `AgencySiteKitLayout`.\n *\n * Do not re-fork this. Before it existed, agency sites hand-rolled their own\n * \"set the globals on mount\" component (upforge's `UptradeSiteKitInit`), and\n * because those copies had no access to the token manager they published the\n * RAW `sonor_` key into the client bundle — the exact exposure the mint exists\n * to prevent. Any layout that puts a credential on `window` goes through here.\n *\n * Client-safe: no `server-only` guard, SSR-safe (every write is window-gated).\n * The minting half is server-only and lives in `../server/mint-site-token`.\n */\n// Leaf modules, NOT '../sites/contract' — see sites/normalize.ts. Importing the\n// full contract here shipped its JSON schema to every browser that loads a\n// credential-publishing entry.\nimport { resolveSiteHost } from '../sites/resolve'\nimport { configureSiteCredential, currentCredential } from './siteToken'\n\n/**\n * Re-exported so the client-side callers below and every existing importer keep\n * a single name for this. The implementation lives in `../sites/resolve` — the\n * ONE resolver shared by the browser (this file) and the build-time sitemap /\n * llms.txt path, so both tag the same host.\n */\nexport { resolveSiteHost }\n\nexport interface PublishSiteCredentialOptions {\n  /**\n   * The credential the layout minted server-side. In 3.2+ this is a short-lived\n   * `st1.` token that `sonorFetch` refreshes transparently. A raw `sonor_` key\n   * still works (2.x kit, or the mint-failed fallback) but should never be\n   * routed here from a client component — it would ship the secret to the\n   * browser.\n   */\n  apiKey?: string\n  apiUrl?: string\n  /** Pre-resolved sub-site host. Omit to resolve via `resolveSiteHost`. */\n  site?: string\n  debug?: boolean\n  /**\n   * Referrer-restricted Google Maps BROWSER key for client map components.\n   * Resolved server-side by SiteKitLayout (NEXT_PUBLIC_GOOGLE_MAPS_API_KEY /\n   * GOOGLE_MAPS_BROWSER_KEY) because maps/api.ts runs client-side, where a bare\n   * process.env read is dead code unless the app's bundler happens to inline it.\n   * Never route a server secret here.\n   */\n  mapsBrowserKey?: string\n}\n\n/**\n * Seed the token manager and publish the `window.__SITE_KIT_*` globals.\n *\n * Called during RENDER, not in an effect: client modules read these globals in\n * their own mount effects, and effects run child-first, so an effect-based\n * publish would land after the modules that need it.\n *\n * No-op on the server.\n */\nexport function publishSiteCredential({\n  apiKey,\n  apiUrl = 'https://api.sonor.io',\n  site,\n  debug = false,\n  mapsBrowserKey,\n}: PublishSiteCredentialOptions): void {\n  if (typeof window === 'undefined') return\n\n  // Seed the client token manager. The window global is set to the freshest\n  // token held — a prior page this session may already have refreshed past the\n  // seed the layout injected. In raw-key mode this is a passthrough.\n  configureSiteCredential({ credential: apiKey, apiUrl })\n  ;(window as any).__SITE_KIT_API_URL__ = apiUrl\n  ;(window as any).__SITE_KIT_API_KEY__ = currentCredential(apiKey)\n  ;(window as any).__SITE_KIT_DEBUG__ = debug\n  ;(window as any).__SITE_KIT_SITE__ = site ?? resolveSiteHost()\n  // maps/api.ts falls back to this global when the Sonor platform hasn't\n  // provisioned a browser key. Don't clobber a value another layout already set.\n  if (mapsBrowserKey) (window as any).__GOOGLE_MAPS_API_KEY__ = mapsBrowserKey\n}\n"]}
+{"version":3,"sources":["../src/shared/publishCredential.ts"],"names":[],"mappings":";;;;AAkEO,SAAS,qBAAA,CAAsB;AAAA,EACpC,MAAA;AAAA,EACA,MAAA,GAAS,sBAAA;AAAA,EACT,IAAA;AAAA,EACA,KAAA,GAAQ,KAAA;AAAA,EACR;AACF,CAAA,EAAuC;AACrC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAKnC,EAAA,uBAAA,CAAwB,EAAE,UAAA,EAAY,MAAA,EAAQ,MAAA,EAAQ,CAAA;AACrD,EAAC,OAAe,oBAAA,GAAuB,MAAA;AACvC,EAAC,MAAA,CAAe,oBAAA,GAAuB,iBAAA,CAAkB,MAAM,CAAA;AAC/D,EAAC,OAAe,kBAAA,GAAqB,KAAA;AACrC,EAAC,MAAA,CAAe,iBAAA,GAAoB,IAAA,IAAQ,eAAA,EAAgB;AAG7D,EAAA,IAAI,cAAA,EAAiB,MAAA,CAAe,uBAAA,GAA0B,cAAA;AAChE","file":"chunk-5TGAUWNO.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared — Client credential + window-global publishing\n *\n * SINGLE SOURCE OF TRUTH for seeding the browser-side token manager and the\n * `window.__SITE_KIT_*` globals that every client module reads. Used by:\n *\n *   - `SiteKitClientProviders` (core `SiteKitLayout`)\n *   - `SiteKitCredential` (`@sonordev/site-kit/client`) — the public component\n *     for layouts that are NOT core `SiteKitLayout`, e.g.\n *     `@sonordev/agency-site-kit`'s `AgencySiteKitLayout`.\n *\n * Do not re-fork this. Before it existed, agency sites hand-rolled their own\n * \"set the globals on mount\" component (upforge's `UptradeSiteKitInit`), and\n * because those copies had no access to the token manager they published the\n * RAW `sonor_` key into the client bundle — the exact exposure the mint exists\n * to prevent. Any layout that puts a credential on `window` goes through here.\n *\n * Client-safe: no `server-only` guard, SSR-safe (every write is window-gated).\n * The minting half is server-only and lives in `../server/mint-site-token`.\n */\n// Leaf modules, NOT '../sites/contract' — see sites/normalize.ts. Importing the\n// full contract here shipped its JSON schema to every browser that loads a\n// credential-publishing entry.\nimport { resolveSiteHost } from '../sites/resolve'\nimport { configureSiteCredential, currentCredential } from './siteToken'\n\n/**\n * Re-exported so the client-side callers below and every existing importer keep\n * a single name for this. The implementation lives in `../sites/resolve` — the\n * ONE resolver shared by the browser (this file) and the build-time sitemap /\n * llms.txt path, so both tag the same host.\n */\nexport { resolveSiteHost }\n\nexport interface PublishSiteCredentialOptions {\n  /**\n   * The credential the layout minted server-side. In 3.2+ this is a short-lived\n   * `st1.` token that `sonorFetch` refreshes transparently. A raw `sonor_` key\n   * still works (2.x kit, or the mint-failed fallback) but should never be\n   * routed here from a client component — it would ship the secret to the\n   * browser.\n   */\n  apiKey?: string\n  apiUrl?: string\n  /** Pre-resolved sub-site host. Omit to resolve via `resolveSiteHost`. */\n  site?: string\n  debug?: boolean\n  /**\n   * Referrer-restricted Google Maps BROWSER key for client map components.\n   * Resolved server-side by SiteKitLayout (NEXT_PUBLIC_GOOGLE_MAPS_API_KEY /\n   * GOOGLE_MAPS_BROWSER_KEY) because maps/api.ts runs client-side, where a bare\n   * process.env read is dead code unless the app's bundler happens to inline it.\n   * Never route a server secret here.\n   */\n  mapsBrowserKey?: string\n}\n\n/**\n * Seed the token manager and publish the `window.__SITE_KIT_*` globals.\n *\n * Called during RENDER, not in an effect: client modules read these globals in\n * their own mount effects, and effects run child-first, so an effect-based\n * publish would land after the modules that need it.\n *\n * No-op on the server.\n */\nexport function publishSiteCredential({\n  apiKey,\n  apiUrl = 'https://api.sonor.io',\n  site,\n  debug = false,\n  mapsBrowserKey,\n}: PublishSiteCredentialOptions): void {\n  if (typeof window === 'undefined') return\n\n  // Seed the client token manager. The window global is set to the freshest\n  // token held — a prior page this session may already have refreshed past the\n  // seed the layout injected. In raw-key mode this is a passthrough.\n  configureSiteCredential({ credential: apiKey, apiUrl })\n  ;(window as any).__SITE_KIT_API_URL__ = apiUrl\n  ;(window as any).__SITE_KIT_API_KEY__ = currentCredential(apiKey)\n  ;(window as any).__SITE_KIT_DEBUG__ = debug\n  ;(window as any).__SITE_KIT_SITE__ = site ?? resolveSiteHost()\n  // maps/api.ts falls back to this global when the Sonor platform hasn't\n  // provisioned a browser key. Don't clobber a value another layout already set.\n  if (mapsBrowserKey) (window as any).__GOOGLE_MAPS_API_KEY__ = mapsBrowserKey\n}\n"]}

package/dist/{chunk-RO55G3OA.mjs → chunk-64BOVMXG.mjs}

@@ -1,5 +1,5 @@
 'use client';
-import { trackConversion } from './chunk-3DPXOZAU.mjs';
+import { trackConversion } from './chunk-SHLWA6JY.mjs';
 import { useCallback, useEffect } from 'react';
 
 function useContactTracking(options = {}) {
@@ -64,5 +64,5 @@ function ContactTracking({ debug = false }) {
 }
 
 export { ContactTracking, useContactTracking };
-//# sourceMappingURL=chunk-RO55G3OA.mjs.map
-//# sourceMappingURL=chunk-RO55G3OA.mjs.map
+//# sourceMappingURL=chunk-64BOVMXG.mjs.map
+//# sourceMappingURL=chunk-64BOVMXG.mjs.map

package/dist/{chunk-RO55G3OA.mjs.map → chunk-64BOVMXG.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/analytics/useContactTracking.ts"],"names":[],"mappings":";;;AAoDO,SAAS,kBAAA,CAAmB,OAAA,GAAqC,EAAC,EAA0B;AACjG,EAAA,MAAM,EAAE,SAAA,GAAY,IAAA,EAAM,KAAA,GAAQ,OAAM,GAAI,OAAA;AAE5C,EAAA,MAAM,eAAA,GAAkB,WAAA,CAAY,CAAC,WAAA,EAAqB,QAAA,KAAuC;AAC/F,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,0BAAA,EAA4B,WAAW,CAAA;AAE9D,IAAA,eAAA,CAAgB;AAAA,MACd,IAAA,EAAM,YAAA;AAAA,MACN,QAAA,EAAU;AAAA,QACR,WAAA,EAAa,WAAA,CAAY,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAAA;AAAA,QAC1C,SAAA,EAAW,WAAA;AAAA,QACX,GAAG;AAAA;AACL,KACD,CAAA;AAAA,EACH,CAAA,EAAG,CAAC,KAAK,CAAC,CAAA;AAEV,EAAA,MAAM,eAAA,GAAkB,WAAA,CAAY,CAAC,KAAA,EAAe,QAAA,KAAuC;AACzF,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,0BAAA,EAA4B,KAAK,CAAA;AAExD,IAAA,eAAA,CAAgB;AAAA,MACd,IAAA,EAAM,aAAA;AAAA,MACN,QAAA,EAAU;AAAA,QACR,KAAA;AAAA,QACA,GAAG;AAAA;AACL,KACD,CAAA;AAAA,EACH,CAAA,EAAG,CAAC,KAAK,CAAC,CAAA;AAGV,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,SAAA,IAAa,OAAO,QAAA,KAAa,WAAA,EAAa;AAEnD,IAAA,MAAM,WAAA,GAAc,CAAC,CAAA,KAAkB;AACrC,MAAA,MAAM,SAAS,CAAA,CAAE,MAAA;AACjB,MAAA,MAAM,MAAA,GAAS,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA;AACjC,MAAA,IAAI,CAAC,MAAA,EAAQ;AAEb,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,YAAA,CAAa,MAAM,CAAA;AACvC,MAAA,IAAI,CAAC,IAAA,EAAM;AAEX,MAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,QAAA,MAAM,QAAQ,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,EAAE,EAAE,IAAA,EAAK;AAC5C,QAAA,eAAA,CAAgB,KAAA,EAAO;AAAA,UACrB,QAAA,EAAU,MAAA,CAAO,WAAA,EAAa,IAAA,EAAK;AAAA,UACnC,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH,CAAA,MAAA,IAAW,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA,EAAG;AACrC,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,EAAE,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,CAAE,IAAA,EAAK;AAC7D,QAAA,eAAA,CAAgB,KAAA,EAAO;AAAA,UACrB,QAAA,EAAU,MAAA,CAAO,WAAA,EAAa,IAAA,EAAK;AAAA,UACnC,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AAAA,IACF,CAAA;AAEA,IAAA,QAAA,CAAS,iBAAiB,OAAA,EAAS,WAAA,EAAa,EAAE,OAAA,EAAS,MAAM,CAAA;AAEjE,IAAA,OAAO,MAAM;AACX,MAAA,QAAA,CAAS,oBAAoB,OAAA,EAAS,WAAA,EAAa,EAAE,OAAA,EAAS,MAAM,CAAA;AAAA,IACtE,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,SAAA,EAAW,eAAA,EAAiB,eAAe,CAAC,CAAA;AAEhD,EAAA,OAAO;AAAA,IACL,eAAA;AAAA,IACA;AAAA,GACF;AACF;AAWO,SAAS,eAAA,CAAgB,EAAE,KAAA,GAAQ,KAAA,EAAM,EAAwB;AACtE,EAAA,kBAAA,CAAmB,EAAE,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,CAAA;AAC7C,EAAA,OAAO,IAAA;AACT","file":"chunk-RO55G3OA.mjs","sourcesContent":["/**\n * @sonordev/site-kit/analytics - Contact Tracking Hook\n * \n * Tracks phone calls and email clicks as conversions.\n * Use this hook to automatically track tel: and mailto: links,\n * or manually track contact interactions.\n */\n\n'use client'\n\nimport { useCallback, useEffect } from 'react'\n// Deliberately the standalone dispatch bridge, NOT useAnalytics().\n//\n// SiteKitLayout mounts AnalyticsProvider as a childless deferred SIBLING of\n// the page tree (wrapping children in a dynamic ssr:false provider de-opts the\n// whole route to client rendering - see SiteKitClientProviders). That means no\n// component a site can actually place is ever inside the provider, so the hook\n// form threw \"useAnalytics must be used within an AnalyticsProvider\" and this\n// component could not be used with the documented layout at all.\n//\n// dispatch queues until the deferred provider registers itself, so calls made\n// before analytics is ready still land.\nimport { trackConversion } from './dispatch'\n\nexport interface UseContactTrackingOptions {\n  /** Automatically track all tel: and mailto: links (default: true) */\n  autoTrack?: boolean\n  /** Debug mode - logs events to console */\n  debug?: boolean\n}\n\nexport interface ContactTrackingReturn {\n  /** Manually track a phone call click */\n  trackPhoneClick: (phoneNumber: string, metadata?: Record<string, unknown>) => void\n  /** Manually track an email click */\n  trackEmailClick: (email: string, metadata?: Record<string, unknown>) => void\n}\n\n/**\n * Hook for tracking phone and email contact interactions as conversions.\n * \n * @example\n * ```tsx\n * // Auto-track all tel: and mailto: links\n * useContactTracking()\n * \n * // Manual tracking\n * const { trackPhoneClick, trackEmailClick } = useContactTracking()\n * trackPhoneClick('513-555-1234')\n * trackEmailClick('hello@example.com')\n * ```\n */\nexport function useContactTracking(options: UseContactTrackingOptions = {}): ContactTrackingReturn {\n  const { autoTrack = true, debug = false } = options\n\n  const trackPhoneClick = useCallback((phoneNumber: string, metadata?: Record<string, unknown>) => {\n    if (debug) console.log('[Analytics] Phone click:', phoneNumber)\n    \n    trackConversion({\n      type: 'phone_call',\n      metadata: {\n        phoneNumber: phoneNumber.replace(/\\D/g, ''), // Normalize to digits\n        rawNumber: phoneNumber,\n        ...metadata,\n      },\n    })\n  }, [debug])\n  \n  const trackEmailClick = useCallback((email: string, metadata?: Record<string, unknown>) => {\n    if (debug) console.log('[Analytics] Email click:', email)\n    \n    trackConversion({\n      type: 'email_click',\n      metadata: {\n        email,\n        ...metadata,\n      },\n    })\n  }, [debug])\n  \n  // Auto-track tel: and mailto: links\n  useEffect(() => {\n    if (!autoTrack || typeof document === 'undefined') return\n    \n    const handleClick = (e: MouseEvent) => {\n      const target = e.target as HTMLElement\n      const anchor = target.closest('a')\n      if (!anchor) return\n      \n      const href = anchor.getAttribute('href')\n      if (!href) return\n      \n      if (href.startsWith('tel:')) {\n        const phone = href.replace('tel:', '').trim()\n        trackPhoneClick(phone, {\n          linkText: anchor.textContent?.trim(),\n          source: 'auto',\n        })\n      } else if (href.startsWith('mailto:')) {\n        const email = href.replace('mailto:', '').split('?')[0].trim()\n        trackEmailClick(email, {\n          linkText: anchor.textContent?.trim(),\n          source: 'auto',\n        })\n      }\n    }\n    \n    document.addEventListener('click', handleClick, { capture: true })\n    \n    return () => {\n      document.removeEventListener('click', handleClick, { capture: true })\n    }\n  }, [autoTrack, trackPhoneClick, trackEmailClick])\n  \n  return {\n    trackPhoneClick,\n    trackEmailClick,\n  }\n}\n\n/**\n * Component wrapper for contact tracking\n * Simply include this component to auto-track all tel: and mailto: links\n * \n * @example\n * ```tsx\n * <ContactTracking />\n * ```\n */\nexport function ContactTracking({ debug = false }: { debug?: boolean }) {\n  useContactTracking({ autoTrack: true, debug })\n  return null\n}\n"]}
+{"version":3,"sources":["../src/analytics/useContactTracking.ts"],"names":[],"mappings":";;;AAoDO,SAAS,kBAAA,CAAmB,OAAA,GAAqC,EAAC,EAA0B;AACjG,EAAA,MAAM,EAAE,SAAA,GAAY,IAAA,EAAM,KAAA,GAAQ,OAAM,GAAI,OAAA;AAE5C,EAAA,MAAM,eAAA,GAAkB,WAAA,CAAY,CAAC,WAAA,EAAqB,QAAA,KAAuC;AAC/F,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,0BAAA,EAA4B,WAAW,CAAA;AAE9D,IAAA,eAAA,CAAgB;AAAA,MACd,IAAA,EAAM,YAAA;AAAA,MACN,QAAA,EAAU;AAAA,QACR,WAAA,EAAa,WAAA,CAAY,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAAA;AAAA,QAC1C,SAAA,EAAW,WAAA;AAAA,QACX,GAAG;AAAA;AACL,KACD,CAAA;AAAA,EACH,CAAA,EAAG,CAAC,KAAK,CAAC,CAAA;AAEV,EAAA,MAAM,eAAA,GAAkB,WAAA,CAAY,CAAC,KAAA,EAAe,QAAA,KAAuC;AACzF,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,0BAAA,EAA4B,KAAK,CAAA;AAExD,IAAA,eAAA,CAAgB;AAAA,MACd,IAAA,EAAM,aAAA;AAAA,MACN,QAAA,EAAU;AAAA,QACR,KAAA;AAAA,QACA,GAAG;AAAA;AACL,KACD,CAAA;AAAA,EACH,CAAA,EAAG,CAAC,KAAK,CAAC,CAAA;AAGV,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,SAAA,IAAa,OAAO,QAAA,KAAa,WAAA,EAAa;AAEnD,IAAA,MAAM,WAAA,GAAc,CAAC,CAAA,KAAkB;AACrC,MAAA,MAAM,SAAS,CAAA,CAAE,MAAA;AACjB,MAAA,MAAM,MAAA,GAAS,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA;AACjC,MAAA,IAAI,CAAC,MAAA,EAAQ;AAEb,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,YAAA,CAAa,MAAM,CAAA;AACvC,MAAA,IAAI,CAAC,IAAA,EAAM;AAEX,MAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,QAAA,MAAM,QAAQ,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,EAAE,EAAE,IAAA,EAAK;AAC5C,QAAA,eAAA,CAAgB,KAAA,EAAO;AAAA,UACrB,QAAA,EAAU,MAAA,CAAO,WAAA,EAAa,IAAA,EAAK;AAAA,UACnC,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH,CAAA,MAAA,IAAW,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA,EAAG;AACrC,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,EAAE,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,CAAE,IAAA,EAAK;AAC7D,QAAA,eAAA,CAAgB,KAAA,EAAO;AAAA,UACrB,QAAA,EAAU,MAAA,CAAO,WAAA,EAAa,IAAA,EAAK;AAAA,UACnC,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AAAA,IACF,CAAA;AAEA,IAAA,QAAA,CAAS,iBAAiB,OAAA,EAAS,WAAA,EAAa,EAAE,OAAA,EAAS,MAAM,CAAA;AAEjE,IAAA,OAAO,MAAM;AACX,MAAA,QAAA,CAAS,oBAAoB,OAAA,EAAS,WAAA,EAAa,EAAE,OAAA,EAAS,MAAM,CAAA;AAAA,IACtE,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,SAAA,EAAW,eAAA,EAAiB,eAAe,CAAC,CAAA;AAEhD,EAAA,OAAO;AAAA,IACL,eAAA;AAAA,IACA;AAAA,GACF;AACF;AAWO,SAAS,eAAA,CAAgB,EAAE,KAAA,GAAQ,KAAA,EAAM,EAAwB;AACtE,EAAA,kBAAA,CAAmB,EAAE,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,CAAA;AAC7C,EAAA,OAAO,IAAA;AACT","file":"chunk-64BOVMXG.mjs","sourcesContent":["/**\n * @sonordev/site-kit/analytics - Contact Tracking Hook\n * \n * Tracks phone calls and email clicks as conversions.\n * Use this hook to automatically track tel: and mailto: links,\n * or manually track contact interactions.\n */\n\n'use client'\n\nimport { useCallback, useEffect } from 'react'\n// Deliberately the standalone dispatch bridge, NOT useAnalytics().\n//\n// SiteKitLayout mounts AnalyticsProvider as a childless deferred SIBLING of\n// the page tree (wrapping children in a dynamic ssr:false provider de-opts the\n// whole route to client rendering - see SiteKitClientProviders). That means no\n// component a site can actually place is ever inside the provider, so the hook\n// form threw \"useAnalytics must be used within an AnalyticsProvider\" and this\n// component could not be used with the documented layout at all.\n//\n// dispatch queues until the deferred provider registers itself, so calls made\n// before analytics is ready still land.\nimport { trackConversion } from './dispatch'\n\nexport interface UseContactTrackingOptions {\n  /** Automatically track all tel: and mailto: links (default: true) */\n  autoTrack?: boolean\n  /** Debug mode - logs events to console */\n  debug?: boolean\n}\n\nexport interface ContactTrackingReturn {\n  /** Manually track a phone call click */\n  trackPhoneClick: (phoneNumber: string, metadata?: Record<string, unknown>) => void\n  /** Manually track an email click */\n  trackEmailClick: (email: string, metadata?: Record<string, unknown>) => void\n}\n\n/**\n * Hook for tracking phone and email contact interactions as conversions.\n * \n * @example\n * ```tsx\n * // Auto-track all tel: and mailto: links\n * useContactTracking()\n * \n * // Manual tracking\n * const { trackPhoneClick, trackEmailClick } = useContactTracking()\n * trackPhoneClick('513-555-1234')\n * trackEmailClick('hello@example.com')\n * ```\n */\nexport function useContactTracking(options: UseContactTrackingOptions = {}): ContactTrackingReturn {\n  const { autoTrack = true, debug = false } = options\n\n  const trackPhoneClick = useCallback((phoneNumber: string, metadata?: Record<string, unknown>) => {\n    if (debug) console.log('[Analytics] Phone click:', phoneNumber)\n    \n    trackConversion({\n      type: 'phone_call',\n      metadata: {\n        phoneNumber: phoneNumber.replace(/\\D/g, ''), // Normalize to digits\n        rawNumber: phoneNumber,\n        ...metadata,\n      },\n    })\n  }, [debug])\n  \n  const trackEmailClick = useCallback((email: string, metadata?: Record<string, unknown>) => {\n    if (debug) console.log('[Analytics] Email click:', email)\n    \n    trackConversion({\n      type: 'email_click',\n      metadata: {\n        email,\n        ...metadata,\n      },\n    })\n  }, [debug])\n  \n  // Auto-track tel: and mailto: links\n  useEffect(() => {\n    if (!autoTrack || typeof document === 'undefined') return\n    \n    const handleClick = (e: MouseEvent) => {\n      const target = e.target as HTMLElement\n      const anchor = target.closest('a')\n      if (!anchor) return\n      \n      const href = anchor.getAttribute('href')\n      if (!href) return\n      \n      if (href.startsWith('tel:')) {\n        const phone = href.replace('tel:', '').trim()\n        trackPhoneClick(phone, {\n          linkText: anchor.textContent?.trim(),\n          source: 'auto',\n        })\n      } else if (href.startsWith('mailto:')) {\n        const email = href.replace('mailto:', '').split('?')[0].trim()\n        trackEmailClick(email, {\n          linkText: anchor.textContent?.trim(),\n          source: 'auto',\n        })\n      }\n    }\n    \n    document.addEventListener('click', handleClick, { capture: true })\n    \n    return () => {\n      document.removeEventListener('click', handleClick, { capture: true })\n    }\n  }, [autoTrack, trackPhoneClick, trackEmailClick])\n  \n  return {\n    trackPhoneClick,\n    trackEmailClick,\n  }\n}\n\n/**\n * Component wrapper for contact tracking\n * Simply include this component to auto-track all tel: and mailto: links\n * \n * @example\n * ```tsx\n * <ContactTracking />\n * ```\n */\nexport function ContactTracking({ debug = false }: { debug?: boolean }) {\n  useContactTracking({ autoTrack: true, debug })\n  return null\n}\n"]}

package/dist/{chunk-JJ26JKBJ.mjs → chunk-7PPNXORV.mjs}

@@ -1,7 +1,7 @@
 'use client';
 import { locToPath, isMalformedSitemapPath, inferPageType } from './chunk-QJU6HBSK.mjs';
 import { isCrossOriginFrame } from './chunk-NVSWTDWU.mjs';
-import { sonorFetch } from './chunk-MIFP6QEQ.mjs';
+import { sonorFetch } from './chunk-OFSA7LUH.mjs';
 import { useRef, useEffect } from 'react';
 
 var SYNC_STAMP_KEY = "_sk_sitemap_synced_at";
@@ -195,5 +195,5 @@ function SitemapSync({
 }
 
 export { SitemapSync };
-//# sourceMappingURL=chunk-JJ26JKBJ.mjs.map
-//# sourceMappingURL=chunk-JJ26JKBJ.mjs.map
+//# sourceMappingURL=chunk-7PPNXORV.mjs.map
+//# sourceMappingURL=chunk-7PPNXORV.mjs.map

package/dist/{chunk-JJ26JKBJ.mjs.map → chunk-7PPNXORV.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/SitemapSync.tsx"],"names":[],"mappings":";;;;;AAyDA,IAAM,cAAA,GAAiB,uBAAA;AACvB,IAAM,aAAA,GAAgB,kBAAA;AAEtB,SAAS,iBAAiB,eAAA,EAAkC;AAC1D,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,OAAA,CAAQ,cAAc,CAAA;AACnD,IAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,IAAA,MAAM,UAAU,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,CAAS,OAAO,EAAE,CAAA;AAC/C,IAAA,OAAO,OAAA,IAAW,CAAA,IAAK,OAAA,GAAU,eAAA,GAAkB,EAAA,GAAK,GAAA;AAAA,EAC1D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAA,GAAoB;AAC3B,EAAA,IAAI;AACF,IAAA,cAAA,CAAe,QAAQ,cAAA,EAAgB,IAAA,CAAK,GAAA,EAAI,CAAE,UAAU,CAAA;AAAA,EAC9D,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AASA,SAAS,WAAA,CAAY,YAAoB,OAAA,EAAiC;AACxE,EAAA,MAAM,IAAA,GAAO,QACV,GAAA,CAAI,CAAA,CAAA,KAAK,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAA,IAAW,EAAE,IAAI,CAAA,CAAE,UAAA,IAAc,EAAE,CAAA,CAAA,EAAI,CAAA,CAAE,YAAY,EAAE,CAAA,CAAE,CAAA,CACjF,IAAA,CAAK,IAAI,CAAA;AACZ,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,QAAQ,CAAA,EAAA,EAAK;AACpC,IAAA,IAAA,GAAA,CAAS,QAAQ,CAAA,IAAK,IAAA,GAAO,IAAA,CAAK,UAAA,CAAW,CAAC,CAAA,GAAK,CAAA;AAAA,EACrD;AACA,EAAA,OAAO,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,OAAA,CAAQ,MAAM,CAAA,CAAA,EAAI,IAAA,CAAK,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA;AAC7D;AAEA,SAAS,oBAAoB,IAAA,EAAuB;AAClD,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,OAAA,CAAQ,aAAa,CAAA,KAAM,IAAA;AAAA,EACjD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB,IAAA,EAAoB;AAC3C,EAAA,IAAI;AACF,IAAA,YAAA,CAAa,OAAA,CAAQ,eAAe,IAAI,CAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,YAAA,GAAe;AACtB,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,EAAE,QAAQ,EAAA,EAAI,MAAA,EAAQ,EAAA,EAAI,IAAA,EAAM,EAAA,EAAG;AAE7E,EAAA,MAAM,MAAA,GAAU,OAAe,oBAAA,IAAwB,sBAAA;AACvD,EAAA,MAAM,MAAA,GAAU,OAAe,oBAAA,IAAwB,EAAA;AAKvD,EAAA,MAAM,IAAA,GAAQ,MAAA,CAAe,iBAAA,IAAqB,MAAA,CAAO,SAAS,IAAA,IAAQ,EAAA;AAC1E,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAK;AAChC;AAEA,eAAe,YAAA,CAAa,YAAoB,KAAA,EAAyC;AACvF,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAM,UAAA,CAAW,UAAU,CAAA;AAC5C,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,wCAAA,EAA0C,SAAS,MAAM,CAAA;AACjF,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,MAAM,MAAA,GAAS,IAAI,SAAA,EAAU;AAC7B,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,eAAA,CAAgB,IAAA,EAAM,iBAAiB,CAAA;AAE1D,IAAA,MAAM,UAAA,GAAa,GAAA,CAAI,aAAA,CAAc,aAAa,CAAA;AAClD,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,oCAAA,EAAsC,WAAW,WAAW,CAAA;AACpF,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,gBAAA,CAAiB,KAAK,CAAA;AACvC,IAAA,MAAM,UAA0B,EAAC;AAEjC,IAAA,IAAA,CAAK,QAAQ,CAAA,GAAA,KAAO;AAClB,MAAA,MAAM,MAAM,GAAA,CAAI,aAAA,CAAc,KAAK,CAAA,EAAG,aAAa,IAAA,EAAK;AACxD,MAAA,IAAI,CAAC,GAAA,EAAK;AAEV,MAAA,MAAM,IAAA,GAAO,UAAU,GAAG,CAAA;AAG1B,MAAA,IAAI,sBAAA,CAAuB,IAAI,CAAA,EAAG;AAChC,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,CAAA,uCAAA,EAA0C,IAAI,CAAA,CAAE,CAAA;AACxE,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,GAAA,CAAI,aAAA,CAAc,SAAS,GAAG,WAAA,IAAe,KAAA,CAAA;AAC7D,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,aAAA,CAAc,YAAY,GAAG,WAAA,IAAe,KAAA,CAAA;AACnE,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,aAAA,CAAc,UAAU,CAAA,EAAG,WAAA;AACnD,MAAA,MAAM,QAAA,GAAW,WAAA,GAAc,UAAA,CAAW,WAAW,CAAA,GAAI,KAAA,CAAA;AAEzD,MAAA,OAAA,CAAQ,KAAK,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,UAAU,CAAA;AAAA,IACtD,CAAC,CAAA;AAED,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,qBAAA,EAAwB,OAAA,CAAQ,MAAM,CAAA,qBAAA,CAAuB,CAAA;AAAA,IAC3E;AAEA,IAAA,OAAO,OAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,sCAAA,EAAwC,KAAK,CAAA;AACtE,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAEA,eAAe,aACb,OAAA,EACA,MAAA,EACA,QACA,IAAA,EACA,KAAA,EACA,OAAoC,UAAA,EAC6B;AACjE,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,qCAAqC,CAAA;AAC7D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AAEA,EAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,kCAAkC,CAAA;AACzD,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EACjD;AAEA,EAAA,IAAI;AAGF,IAAA,MAAM,QAAA,GAAW,MAAM,UAAA,CAAW,CAAA,EAAG,MAAM,CAAA,gCAAA,CAAA,EAAoC;AAAA,MAC7E,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB;AAAA,OAClB;AAAA,MACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,OAAA,EAAS,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,MAAM;AAAA,UACzB,MAAM,CAAA,CAAE,IAAA;AAAA,UACR,UAAU,CAAA,CAAE,QAAA;AAAA,UACZ,YAAY,CAAA,CAAE,UAAA;AAAA,UACd,QAAA,EAAU,aAAA,CAAc,CAAA,CAAE,IAAI;AAAA,SAChC,CAAE,CAAA;AAAA,QACF,IAAA;AAAA;AAAA;AAAA;AAAA,QAIA,GAAI,IAAA,GAAO,EAAE,IAAA,KAAS;AAAC,OACxB;AAAA,KACH,EAAG,EAAE,MAAA,EAAQ,CAAA;AAEb,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,IAAI,OAAO,OAAA,CAAQ,KAAA,CAAM,4BAA4B,QAAA,CAAS,MAAA,EAAQ,SAAS,UAAU,CAAA;AACzF,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,IAClD;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AAEnC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,IAAI,CAAA,sBAAA,EAAyB,MAAA,CAAO,OAAO,CAAA,UAAA,EAAa,MAAA,CAAO,OAAO,CAAA,QAAA,CAAU,CAAA;AAAA,IAC1F;AAEA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAA;AAAA,MACT,OAAA,EAAS,OAAO,OAAA,IAAW,CAAA;AAAA,MAC3B,OAAA,EAAS,OAAO,OAAA,IAAW;AAAA,KAC7B;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,2BAAA,EAA6B,KAAK,CAAA;AAC3D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AACF;AAEO,SAAS,WAAA,CAAY;AAAA,EAC1B,UAAA,GAAa,cAAA;AAAA,EACb,YAAA,GAAe,EAAA;AAAA,EACf,KAAA,GAAQ,KAAA;AAAA,EACR,IAAA,GAAO;AACT,CAAA,EAAqB;AACnB,EAAA,MAAM,YAAA,GAAe,OAAO,KAAK,CAAA;AACjC,EAAA,MAAM,WAAA,GAAc,OAA8C,IAAI,CAAA;AAEtE,EAAA,SAAA,CAAU,MAAM;AAMd,IAAA,MAAM,aAAA,GAA6C,UAAA;AAInD,IAAA,MAAM,eAAA,GAAkB,YAAA,GAAe,CAAA,GAAI,YAAA,GAAe,EAAA;AAE1D,IAAA,MAAM,SAAS,YAAY;AAezB,MAAA,IAAI,oBAAmB,EAAG;AACxB,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,2DAAsD,CAAA;AAC7E,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,KAAS,YAAA,EAAa;AAE9C,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,gCAAgC,CAAA;AACxD,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,gBAAA,CAAiB,eAAe,CAAA,EAAG;AACrC,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,qDAAA,EAAkD,iBAAiB,kBAAkB,CAAA;AAC5G,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,KAAA,UAAe,GAAA,CAAI,wCAAA,EAA0C,OAAO,CAAA,OAAA,EAAU,IAAI,MAAM,EAAE,CAAA;AAE9F,MAAA,MAAM,OAAA,GAAU,MAAM,YAAA,CAAa,UAAA,EAAY,KAAK,CAAA;AAEpD,MAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,UAAA,EAAY,OAAO,CAAA;AAC5C,QAAA,IAAI,mBAAA,CAAoB,IAAI,CAAA,EAAG;AAI7B,UAAA,WAAA,EAAY;AACZ,UAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,gFAA2E,CAAA;AAClG,UAAA;AAAA,QACF;AACA,QAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,OAAA,EAAS,QAAQ,MAAA,EAAQ,IAAA,EAAM,OAAO,aAAa,CAAA;AACrF,QAAA,IAAI,OAAO,OAAA,EAAS;AAClB,UAAA,WAAA,EAAY;AACZ,UAAA,eAAA,CAAgB,IAAI,CAAA;AAAA,QACtB;AAAA,MACF;AAAA,IACF,CAAA;AAEA,IAAA,IAAI,CAAC,aAAa,OAAA,EAAS;AACzB,MAAA,YAAA,CAAa,OAAA,GAAU,IAAA;AACvB,MAAA,MAAA,EAAO;AAAA,IACT;AAEA,IAAA,IAAI,eAAe,CAAA,EAAG;AACpB,MAAA,WAAA,CAAY,OAAA,GAAU,WAAA,CAAY,MAAA,EAAQ,YAAA,GAAe,KAAK,GAAI,CAAA;AAAA,IACpE;AAEA,IAAA,OAAO,MAAM;AACX,MAAA,IAAI,YAAY,OAAA,EAAS;AACvB,QAAA,aAAA,CAAc,YAAY,OAAO,CAAA;AAAA,MACnC;AAAA,IACF,CAAA;AAAA,EACF,GAAG,CAAC,UAAA,EAAY,YAAA,EAAc,KAAA,EAAO,IAAI,CAAC,CAAA;AAE1C,EAAA,OAAO,IAAA;AACT","file":"chunk-JJ26JKBJ.mjs","sourcesContent":["/**\n * SitemapSync - Automatically sync sitemap.xml to Portal API\n *\n * Client-only component. Lives at package root so the main entry does not\n * pull in seo/ (and server-only code). For use in SiteKitLayout and\n * from @sonordev/site-kit/seo.\n *\n * @example\n * ```tsx\n * import { SitemapSync } from '@sonordev/site-kit'\n * // or\n * import { SitemapSync } from '@sonordev/site-kit/seo'\n * ```\n */\n\n'use client'\n\nimport { useEffect, useRef } from 'react'\nimport { sonorFetch } from './shared/sonorFetch'\n// Same frame fact the analytics send gate uses — see shared/frame.ts.\nimport { isCrossOriginFrame } from './shared/frame'\n// Single source of truth for page-type inference + path normalization, shared\n// with createSitemap (build) and the register-sitemap CLI. Pure string logic,\n// safe in the browser.\nimport { inferPageType, locToPath, isMalformedSitemapPath } from './sitemap/shared'\n\ninterface SitemapSyncProps {\n  /** Custom sitemap URL (defaults to /sitemap.xml) */\n  sitemapUrl?: string\n  /** How often to re-sync in minutes (0 = only on mount, default: 60) */\n  syncInterval?: number\n  /** Enable debug logging */\n  debug?: boolean\n  /**\n   * Sync mode:\n   * - 'additive' (default for runtime): adds/updates pages but never deletes existing ones\n   * - 'full-replace': replaces the entire page set (use only for build-time sync via createSitemap)\n   */\n  mode?: 'additive' | 'full-replace'\n}\n\ninterface SitemapEntry {\n  path: string\n  lastmod?: string\n  changefreq?: string\n  priority?: number\n  pageType?: string\n}\n\n/**\n * Per-browser-session sync throttle. Build-time sync (createSitemap) is the\n * canonical source of truth; runtime SitemapSync is only a safety net — so\n * re-registering the sitemap on every full page load of every visitor is pure\n * waste (fetch + DOMParser on the visitor's main thread, plus a write per\n * pageview against the API). Stamp the last successful sync in sessionStorage\n * and skip while inside the throttle window.\n */\nconst SYNC_STAMP_KEY = '_sk_sitemap_synced_at'\nconst SYNC_HASH_KEY = '_sk_sitemap_hash'\n\nfunction isRecentlySynced(throttleMinutes: number): boolean {\n  try {\n    const stamp = sessionStorage.getItem(SYNC_STAMP_KEY)\n    if (!stamp) return false\n    const elapsed = Date.now() - parseInt(stamp, 10)\n    return elapsed >= 0 && elapsed < throttleMinutes * 60 * 1000\n  } catch {\n    return false // storage unavailable (private mode) — sync as before\n  }\n}\n\nfunction stampSynced(): void {\n  try {\n    sessionStorage.setItem(SYNC_STAMP_KEY, Date.now().toString())\n  } catch {\n    /* storage unavailable — throttle simply won't apply */\n  }\n}\n\n/**\n * Content-hash guard (localStorage, so it survives across sessions): the\n * sitemap of a static site only changes at deploy, so once ONE sync of a given\n * sitemap succeeded from this browser, re-POSTing the identical entry set is\n * pure API load. Hash the parsed entries; skip the POST when unchanged.\n * Keyed by sitemap URL so multiple SitemapSync instances don't collide.\n */\nfunction hashEntries(sitemapUrl: string, entries: SitemapEntry[]): string {\n  const text = entries\n    .map(e => `${e.path}|${e.lastmod ?? ''}|${e.changefreq ?? ''}|${e.priority ?? ''}`)\n    .join('\\n')\n  let hash = 0\n  for (let i = 0; i < text.length; i++) {\n    hash = ((hash << 5) - hash + text.charCodeAt(i)) | 0\n  }\n  return `${sitemapUrl}:${entries.length}:${hash.toString(16)}`\n}\n\nfunction isAlreadySyncedHash(hash: string): boolean {\n  try {\n    return localStorage.getItem(SYNC_HASH_KEY) === hash\n  } catch {\n    return false\n  }\n}\n\nfunction storeSyncedHash(hash: string): void {\n  try {\n    localStorage.setItem(SYNC_HASH_KEY, hash)\n  } catch {\n    /* storage unavailable — guard simply won't apply */\n  }\n}\n\nfunction getApiConfig() {\n  if (typeof window === 'undefined') return { apiUrl: '', apiKey: '', site: '' }\n\n  const apiUrl = (window as any).__SITE_KIT_API_URL__ || 'https://api.sonor.io'\n  const apiKey = (window as any).__SITE_KIT_API_KEY__ || ''\n  // Sub-site host — set by SiteKitClientProviders from analytics.site config,\n  // NEXT_PUBLIC_SITE_URL host, or window.location.host. Tagged on every\n  // seo_pages row from this sitemap so the dashboard can scope the page tree\n  // when one Sonor project hosts many sites.\n  const site = (window as any).__SITE_KIT_SITE__ || window.location.host || ''\n  return { apiUrl, apiKey, site }\n}\n\nasync function parseSitemap(sitemapUrl: string, debug: boolean): Promise<SitemapEntry[]> {\n  try {\n    const response = await sonorFetch(sitemapUrl)\n    if (!response.ok) {\n      if (debug) console.warn('[SitemapSync] Failed to fetch sitemap:', response.status)\n      return []\n    }\n\n    const text = await response.text()\n    const parser = new DOMParser()\n    const doc = parser.parseFromString(text, 'application/xml')\n\n    const parseError = doc.querySelector('parsererror')\n    if (parseError) {\n      if (debug) console.warn('[SitemapSync] Sitemap parse error:', parseError.textContent)\n      return []\n    }\n\n    const urls = doc.querySelectorAll('url')\n    const entries: SitemapEntry[] = []\n\n    urls.forEach(url => {\n      const loc = url.querySelector('loc')?.textContent?.trim()\n      if (!loc) return\n\n      const path = locToPath(loc)\n\n      // Reject malformed paths (embedded domains, double protocols, etc.)\n      if (isMalformedSitemapPath(path)) {\n        if (debug) console.warn(`[SitemapSync] Skipping malformed path: ${path}`)\n        return\n      }\n\n      const lastmod = url.querySelector('lastmod')?.textContent || undefined\n      const changefreq = url.querySelector('changefreq')?.textContent || undefined\n      const priorityStr = url.querySelector('priority')?.textContent\n      const priority = priorityStr ? parseFloat(priorityStr) : undefined\n\n      entries.push({ path, lastmod, changefreq, priority })\n    })\n\n    if (debug) {\n      console.log(`[SitemapSync] Parsed ${entries.length} entries from sitemap`)\n    }\n\n    return entries\n  } catch (error) {\n    if (debug) console.error('[SitemapSync] Error parsing sitemap:', error)\n    return []\n  }\n}\n\nasync function syncToPortal(\n  entries: SitemapEntry[],\n  apiUrl: string,\n  apiKey: string,\n  site: string,\n  debug: boolean,\n  mode: 'additive' | 'full-replace' = 'additive'\n): Promise<{ success: boolean; created: number; updated: number }> {\n  if (!apiKey) {\n    if (debug) console.warn('[SitemapSync] No API key configured')\n    return { success: false, created: 0, updated: 0 }\n  }\n\n  if (entries.length === 0) {\n    if (debug) console.log('[SitemapSync] No entries to sync')\n    return { success: true, created: 0, updated: 0 }\n  }\n\n  try {\n    // Registration is idempotent in both modes (same payload → same final\n    // state), so retrying a timed-out attempt is safe.\n    const response = await sonorFetch(`${apiUrl}/api/public/seo/register-sitemap`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n      },\n      body: JSON.stringify({\n        entries: entries.map(e => ({\n          path: e.path,\n          priority: e.priority,\n          changefreq: e.changefreq,\n          pageType: inferPageType(e.path),\n        })),\n        mode,\n        // Sub-site host — tagged on every seo_pages row so the dashboard\n        // can scope the page tree to one microsite. Resolved by\n        // SiteKitClientProviders (see __SITE_KIT_SITE__).\n        ...(site ? { site } : {}),\n      }),\n    }, { apiKey })\n\n    if (!response.ok) {\n      if (debug) console.error('[SitemapSync] API error:', response.status, response.statusText)\n      return { success: false, created: 0, updated: 0 }\n    }\n\n    const result = await response.json()\n\n    if (debug) {\n      console.log(`[SitemapSync] Synced: ${result.created} created, ${result.updated} updated`)\n    }\n\n    return {\n      success: true,\n      created: result.created || 0,\n      updated: result.updated || 0,\n    }\n  } catch (error) {\n    if (debug) console.error('[SitemapSync] Sync error:', error)\n    return { success: false, created: 0, updated: 0 }\n  }\n}\n\nexport function SitemapSync({\n  sitemapUrl = '/sitemap.xml',\n  syncInterval = 60,\n  debug = false,\n  mode = 'additive',\n}: SitemapSyncProps) {\n  const hasSyncedRef = useRef(false)\n  const intervalRef = useRef<ReturnType<typeof setInterval> | null>(null)\n\n  useEffect(() => {\n    // Build-time sync via createSitemap is the canonical source of truth, but\n    // it can fail during ISR revalidation (app/ dir unavailable on serverless).\n    // Runtime SitemapSync in additive mode is a safe fallback — it adds/updates\n    // pages that may be missing without ever deleting existing ones.\n    // Full-replace is never safe at runtime — always force additive.\n    const effectiveMode: 'additive' | 'full-replace' = 'additive'\n\n    // Throttle window: reuse syncInterval when periodic syncing is on,\n    // otherwise default to 60 minutes for the on-mount sync.\n    const throttleMinutes = syncInterval > 0 ? syncInterval : 60\n\n    const doSync = async () => {\n      // Never register a sitemap from inside someone else's page.\n      //\n      // The rows would not be mis-attributed — inside the frame this document\n      // still resolves the framed site's own host and its own sitemap — but a\n      // WRITE that a third party's page view triggers is wrong for two\n      // reasons. It runs a fetch + DOMParser on a visitor's main thread in a\n      // page that gets nothing from it; and it bumps `seo_pages.updated_at`,\n      // which is a tiebreaker in `pickSeoPageRow`'s \"most recent\" fallback.\n      // On a multi-site project that is how a shared path like `/` starts\n      // resolving to a different host's row (see CLAUDE.md, the BD-AEC\n      // llms.txt contamination) — a third party's traffic should not be able\n      // to move which row wins.\n      //\n      // Same-origin frames sync as before; they are the site itself.\n      if (isCrossOriginFrame()) {\n        if (debug) console.log('[SitemapSync] Skipped — page is a cross-origin embed')\n        return\n      }\n\n      const { apiUrl, apiKey, site } = getApiConfig()\n\n      if (!apiKey) {\n        if (debug) console.warn('[SitemapSync] No API key found')\n        return\n      }\n\n      if (isRecentlySynced(throttleMinutes)) {\n        if (debug) console.log('[SitemapSync] Skipped — synced within the last', throttleMinutes, 'min this session')\n        return\n      }\n\n      if (debug) console.log('[SitemapSync] Starting sitemap sync...', site ? `(site: ${site})` : '')\n\n      const entries = await parseSitemap(sitemapUrl, debug)\n\n      if (entries.length > 0) {\n        const hash = hashEntries(sitemapUrl, entries)\n        if (isAlreadySyncedHash(hash)) {\n          // This exact sitemap already synced from this browser — the server\n          // state can't be improved by re-POSTing it. Stamp the session so we\n          // don't even re-fetch/parse for the rest of the throttle window.\n          stampSynced()\n          if (debug) console.log('[SitemapSync] Skipped POST — sitemap unchanged since last successful sync')\n          return\n        }\n        const result = await syncToPortal(entries, apiUrl, apiKey, site, debug, effectiveMode)\n        if (result.success) {\n          stampSynced()\n          storeSyncedHash(hash)\n        }\n      }\n    }\n\n    if (!hasSyncedRef.current) {\n      hasSyncedRef.current = true\n      doSync()\n    }\n\n    if (syncInterval > 0) {\n      intervalRef.current = setInterval(doSync, syncInterval * 60 * 1000)\n    }\n\n    return () => {\n      if (intervalRef.current) {\n        clearInterval(intervalRef.current)\n      }\n    }\n  }, [sitemapUrl, syncInterval, debug, mode])\n\n  return null\n}\n"]}
+{"version":3,"sources":["../src/SitemapSync.tsx"],"names":[],"mappings":";;;;;AAyDA,IAAM,cAAA,GAAiB,uBAAA;AACvB,IAAM,aAAA,GAAgB,kBAAA;AAEtB,SAAS,iBAAiB,eAAA,EAAkC;AAC1D,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,OAAA,CAAQ,cAAc,CAAA;AACnD,IAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,IAAA,MAAM,UAAU,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,CAAS,OAAO,EAAE,CAAA;AAC/C,IAAA,OAAO,OAAA,IAAW,CAAA,IAAK,OAAA,GAAU,eAAA,GAAkB,EAAA,GAAK,GAAA;AAAA,EAC1D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAA,GAAoB;AAC3B,EAAA,IAAI;AACF,IAAA,cAAA,CAAe,QAAQ,cAAA,EAAgB,IAAA,CAAK,GAAA,EAAI,CAAE,UAAU,CAAA;AAAA,EAC9D,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AASA,SAAS,WAAA,CAAY,YAAoB,OAAA,EAAiC;AACxE,EAAA,MAAM,IAAA,GAAO,QACV,GAAA,CAAI,CAAA,CAAA,KAAK,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAA,IAAW,EAAE,IAAI,CAAA,CAAE,UAAA,IAAc,EAAE,CAAA,CAAA,EAAI,CAAA,CAAE,YAAY,EAAE,CAAA,CAAE,CAAA,CACjF,IAAA,CAAK,IAAI,CAAA;AACZ,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,QAAQ,CAAA,EAAA,EAAK;AACpC,IAAA,IAAA,GAAA,CAAS,QAAQ,CAAA,IAAK,IAAA,GAAO,IAAA,CAAK,UAAA,CAAW,CAAC,CAAA,GAAK,CAAA;AAAA,EACrD;AACA,EAAA,OAAO,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,OAAA,CAAQ,MAAM,CAAA,CAAA,EAAI,IAAA,CAAK,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA;AAC7D;AAEA,SAAS,oBAAoB,IAAA,EAAuB;AAClD,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,OAAA,CAAQ,aAAa,CAAA,KAAM,IAAA;AAAA,EACjD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB,IAAA,EAAoB;AAC3C,EAAA,IAAI;AACF,IAAA,YAAA,CAAa,OAAA,CAAQ,eAAe,IAAI,CAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,YAAA,GAAe;AACtB,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,EAAE,QAAQ,EAAA,EAAI,MAAA,EAAQ,EAAA,EAAI,IAAA,EAAM,EAAA,EAAG;AAE7E,EAAA,MAAM,MAAA,GAAU,OAAe,oBAAA,IAAwB,sBAAA;AACvD,EAAA,MAAM,MAAA,GAAU,OAAe,oBAAA,IAAwB,EAAA;AAKvD,EAAA,MAAM,IAAA,GAAQ,MAAA,CAAe,iBAAA,IAAqB,MAAA,CAAO,SAAS,IAAA,IAAQ,EAAA;AAC1E,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAK;AAChC;AAEA,eAAe,YAAA,CAAa,YAAoB,KAAA,EAAyC;AACvF,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAM,UAAA,CAAW,UAAU,CAAA;AAC5C,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,wCAAA,EAA0C,SAAS,MAAM,CAAA;AACjF,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,MAAM,MAAA,GAAS,IAAI,SAAA,EAAU;AAC7B,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,eAAA,CAAgB,IAAA,EAAM,iBAAiB,CAAA;AAE1D,IAAA,MAAM,UAAA,GAAa,GAAA,CAAI,aAAA,CAAc,aAAa,CAAA;AAClD,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,oCAAA,EAAsC,WAAW,WAAW,CAAA;AACpF,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,gBAAA,CAAiB,KAAK,CAAA;AACvC,IAAA,MAAM,UAA0B,EAAC;AAEjC,IAAA,IAAA,CAAK,QAAQ,CAAA,GAAA,KAAO;AAClB,MAAA,MAAM,MAAM,GAAA,CAAI,aAAA,CAAc,KAAK,CAAA,EAAG,aAAa,IAAA,EAAK;AACxD,MAAA,IAAI,CAAC,GAAA,EAAK;AAEV,MAAA,MAAM,IAAA,GAAO,UAAU,GAAG,CAAA;AAG1B,MAAA,IAAI,sBAAA,CAAuB,IAAI,CAAA,EAAG;AAChC,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,CAAA,uCAAA,EAA0C,IAAI,CAAA,CAAE,CAAA;AACxE,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,GAAA,CAAI,aAAA,CAAc,SAAS,GAAG,WAAA,IAAe,KAAA,CAAA;AAC7D,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,aAAA,CAAc,YAAY,GAAG,WAAA,IAAe,KAAA,CAAA;AACnE,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,aAAA,CAAc,UAAU,CAAA,EAAG,WAAA;AACnD,MAAA,MAAM,QAAA,GAAW,WAAA,GAAc,UAAA,CAAW,WAAW,CAAA,GAAI,KAAA,CAAA;AAEzD,MAAA,OAAA,CAAQ,KAAK,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,UAAU,CAAA;AAAA,IACtD,CAAC,CAAA;AAED,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,qBAAA,EAAwB,OAAA,CAAQ,MAAM,CAAA,qBAAA,CAAuB,CAAA;AAAA,IAC3E;AAEA,IAAA,OAAO,OAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,sCAAA,EAAwC,KAAK,CAAA;AACtE,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAEA,eAAe,aACb,OAAA,EACA,MAAA,EACA,QACA,IAAA,EACA,KAAA,EACA,OAAoC,UAAA,EAC6B;AACjE,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,qCAAqC,CAAA;AAC7D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AAEA,EAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,kCAAkC,CAAA;AACzD,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EACjD;AAEA,EAAA,IAAI;AAGF,IAAA,MAAM,QAAA,GAAW,MAAM,UAAA,CAAW,CAAA,EAAG,MAAM,CAAA,gCAAA,CAAA,EAAoC;AAAA,MAC7E,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB;AAAA,OAClB;AAAA,MACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,OAAA,EAAS,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,MAAM;AAAA,UACzB,MAAM,CAAA,CAAE,IAAA;AAAA,UACR,UAAU,CAAA,CAAE,QAAA;AAAA,UACZ,YAAY,CAAA,CAAE,UAAA;AAAA,UACd,QAAA,EAAU,aAAA,CAAc,CAAA,CAAE,IAAI;AAAA,SAChC,CAAE,CAAA;AAAA,QACF,IAAA;AAAA;AAAA;AAAA;AAAA,QAIA,GAAI,IAAA,GAAO,EAAE,IAAA,KAAS;AAAC,OACxB;AAAA,KACH,EAAG,EAAE,MAAA,EAAQ,CAAA;AAEb,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,IAAI,OAAO,OAAA,CAAQ,KAAA,CAAM,4BAA4B,QAAA,CAAS,MAAA,EAAQ,SAAS,UAAU,CAAA;AACzF,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,IAClD;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AAEnC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,IAAI,CAAA,sBAAA,EAAyB,MAAA,CAAO,OAAO,CAAA,UAAA,EAAa,MAAA,CAAO,OAAO,CAAA,QAAA,CAAU,CAAA;AAAA,IAC1F;AAEA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAA;AAAA,MACT,OAAA,EAAS,OAAO,OAAA,IAAW,CAAA;AAAA,MAC3B,OAAA,EAAS,OAAO,OAAA,IAAW;AAAA,KAC7B;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,2BAAA,EAA6B,KAAK,CAAA;AAC3D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AACF;AAEO,SAAS,WAAA,CAAY;AAAA,EAC1B,UAAA,GAAa,cAAA;AAAA,EACb,YAAA,GAAe,EAAA;AAAA,EACf,KAAA,GAAQ,KAAA;AAAA,EACR,IAAA,GAAO;AACT,CAAA,EAAqB;AACnB,EAAA,MAAM,YAAA,GAAe,OAAO,KAAK,CAAA;AACjC,EAAA,MAAM,WAAA,GAAc,OAA8C,IAAI,CAAA;AAEtE,EAAA,SAAA,CAAU,MAAM;AAMd,IAAA,MAAM,aAAA,GAA6C,UAAA;AAInD,IAAA,MAAM,eAAA,GAAkB,YAAA,GAAe,CAAA,GAAI,YAAA,GAAe,EAAA;AAE1D,IAAA,MAAM,SAAS,YAAY;AAezB,MAAA,IAAI,oBAAmB,EAAG;AACxB,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,2DAAsD,CAAA;AAC7E,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,KAAS,YAAA,EAAa;AAE9C,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,gCAAgC,CAAA;AACxD,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,gBAAA,CAAiB,eAAe,CAAA,EAAG;AACrC,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,qDAAA,EAAkD,iBAAiB,kBAAkB,CAAA;AAC5G,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,KAAA,UAAe,GAAA,CAAI,wCAAA,EAA0C,OAAO,CAAA,OAAA,EAAU,IAAI,MAAM,EAAE,CAAA;AAE9F,MAAA,MAAM,OAAA,GAAU,MAAM,YAAA,CAAa,UAAA,EAAY,KAAK,CAAA;AAEpD,MAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,UAAA,EAAY,OAAO,CAAA;AAC5C,QAAA,IAAI,mBAAA,CAAoB,IAAI,CAAA,EAAG;AAI7B,UAAA,WAAA,EAAY;AACZ,UAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,gFAA2E,CAAA;AAClG,UAAA;AAAA,QACF;AACA,QAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,OAAA,EAAS,QAAQ,MAAA,EAAQ,IAAA,EAAM,OAAO,aAAa,CAAA;AACrF,QAAA,IAAI,OAAO,OAAA,EAAS;AAClB,UAAA,WAAA,EAAY;AACZ,UAAA,eAAA,CAAgB,IAAI,CAAA;AAAA,QACtB;AAAA,MACF;AAAA,IACF,CAAA;AAEA,IAAA,IAAI,CAAC,aAAa,OAAA,EAAS;AACzB,MAAA,YAAA,CAAa,OAAA,GAAU,IAAA;AACvB,MAAA,MAAA,EAAO;AAAA,IACT;AAEA,IAAA,IAAI,eAAe,CAAA,EAAG;AACpB,MAAA,WAAA,CAAY,OAAA,GAAU,WAAA,CAAY,MAAA,EAAQ,YAAA,GAAe,KAAK,GAAI,CAAA;AAAA,IACpE;AAEA,IAAA,OAAO,MAAM;AACX,MAAA,IAAI,YAAY,OAAA,EAAS;AACvB,QAAA,aAAA,CAAc,YAAY,OAAO,CAAA;AAAA,MACnC;AAAA,IACF,CAAA;AAAA,EACF,GAAG,CAAC,UAAA,EAAY,YAAA,EAAc,KAAA,EAAO,IAAI,CAAC,CAAA;AAE1C,EAAA,OAAO,IAAA;AACT","file":"chunk-7PPNXORV.mjs","sourcesContent":["/**\n * SitemapSync - Automatically sync sitemap.xml to Portal API\n *\n * Client-only component. Lives at package root so the main entry does not\n * pull in seo/ (and server-only code). For use in SiteKitLayout and\n * from @sonordev/site-kit/seo.\n *\n * @example\n * ```tsx\n * import { SitemapSync } from '@sonordev/site-kit'\n * // or\n * import { SitemapSync } from '@sonordev/site-kit/seo'\n * ```\n */\n\n'use client'\n\nimport { useEffect, useRef } from 'react'\nimport { sonorFetch } from './shared/sonorFetch'\n// Same frame fact the analytics send gate uses — see shared/frame.ts.\nimport { isCrossOriginFrame } from './shared/frame'\n// Single source of truth for page-type inference + path normalization, shared\n// with createSitemap (build) and the register-sitemap CLI. Pure string logic,\n// safe in the browser.\nimport { inferPageType, locToPath, isMalformedSitemapPath } from './sitemap/shared'\n\ninterface SitemapSyncProps {\n  /** Custom sitemap URL (defaults to /sitemap.xml) */\n  sitemapUrl?: string\n  /** How often to re-sync in minutes (0 = only on mount, default: 60) */\n  syncInterval?: number\n  /** Enable debug logging */\n  debug?: boolean\n  /**\n   * Sync mode:\n   * - 'additive' (default for runtime): adds/updates pages but never deletes existing ones\n   * - 'full-replace': replaces the entire page set (use only for build-time sync via createSitemap)\n   */\n  mode?: 'additive' | 'full-replace'\n}\n\ninterface SitemapEntry {\n  path: string\n  lastmod?: string\n  changefreq?: string\n  priority?: number\n  pageType?: string\n}\n\n/**\n * Per-browser-session sync throttle. Build-time sync (createSitemap) is the\n * canonical source of truth; runtime SitemapSync is only a safety net — so\n * re-registering the sitemap on every full page load of every visitor is pure\n * waste (fetch + DOMParser on the visitor's main thread, plus a write per\n * pageview against the API). Stamp the last successful sync in sessionStorage\n * and skip while inside the throttle window.\n */\nconst SYNC_STAMP_KEY = '_sk_sitemap_synced_at'\nconst SYNC_HASH_KEY = '_sk_sitemap_hash'\n\nfunction isRecentlySynced(throttleMinutes: number): boolean {\n  try {\n    const stamp = sessionStorage.getItem(SYNC_STAMP_KEY)\n    if (!stamp) return false\n    const elapsed = Date.now() - parseInt(stamp, 10)\n    return elapsed >= 0 && elapsed < throttleMinutes * 60 * 1000\n  } catch {\n    return false // storage unavailable (private mode) — sync as before\n  }\n}\n\nfunction stampSynced(): void {\n  try {\n    sessionStorage.setItem(SYNC_STAMP_KEY, Date.now().toString())\n  } catch {\n    /* storage unavailable — throttle simply won't apply */\n  }\n}\n\n/**\n * Content-hash guard (localStorage, so it survives across sessions): the\n * sitemap of a static site only changes at deploy, so once ONE sync of a given\n * sitemap succeeded from this browser, re-POSTing the identical entry set is\n * pure API load. Hash the parsed entries; skip the POST when unchanged.\n * Keyed by sitemap URL so multiple SitemapSync instances don't collide.\n */\nfunction hashEntries(sitemapUrl: string, entries: SitemapEntry[]): string {\n  const text = entries\n    .map(e => `${e.path}|${e.lastmod ?? ''}|${e.changefreq ?? ''}|${e.priority ?? ''}`)\n    .join('\\n')\n  let hash = 0\n  for (let i = 0; i < text.length; i++) {\n    hash = ((hash << 5) - hash + text.charCodeAt(i)) | 0\n  }\n  return `${sitemapUrl}:${entries.length}:${hash.toString(16)}`\n}\n\nfunction isAlreadySyncedHash(hash: string): boolean {\n  try {\n    return localStorage.getItem(SYNC_HASH_KEY) === hash\n  } catch {\n    return false\n  }\n}\n\nfunction storeSyncedHash(hash: string): void {\n  try {\n    localStorage.setItem(SYNC_HASH_KEY, hash)\n  } catch {\n    /* storage unavailable — guard simply won't apply */\n  }\n}\n\nfunction getApiConfig() {\n  if (typeof window === 'undefined') return { apiUrl: '', apiKey: '', site: '' }\n\n  const apiUrl = (window as any).__SITE_KIT_API_URL__ || 'https://api.sonor.io'\n  const apiKey = (window as any).__SITE_KIT_API_KEY__ || ''\n  // Sub-site host — set by SiteKitClientProviders from analytics.site config,\n  // NEXT_PUBLIC_SITE_URL host, or window.location.host. Tagged on every\n  // seo_pages row from this sitemap so the dashboard can scope the page tree\n  // when one Sonor project hosts many sites.\n  const site = (window as any).__SITE_KIT_SITE__ || window.location.host || ''\n  return { apiUrl, apiKey, site }\n}\n\nasync function parseSitemap(sitemapUrl: string, debug: boolean): Promise<SitemapEntry[]> {\n  try {\n    const response = await sonorFetch(sitemapUrl)\n    if (!response.ok) {\n      if (debug) console.warn('[SitemapSync] Failed to fetch sitemap:', response.status)\n      return []\n    }\n\n    const text = await response.text()\n    const parser = new DOMParser()\n    const doc = parser.parseFromString(text, 'application/xml')\n\n    const parseError = doc.querySelector('parsererror')\n    if (parseError) {\n      if (debug) console.warn('[SitemapSync] Sitemap parse error:', parseError.textContent)\n      return []\n    }\n\n    const urls = doc.querySelectorAll('url')\n    const entries: SitemapEntry[] = []\n\n    urls.forEach(url => {\n      const loc = url.querySelector('loc')?.textContent?.trim()\n      if (!loc) return\n\n      const path = locToPath(loc)\n\n      // Reject malformed paths (embedded domains, double protocols, etc.)\n      if (isMalformedSitemapPath(path)) {\n        if (debug) console.warn(`[SitemapSync] Skipping malformed path: ${path}`)\n        return\n      }\n\n      const lastmod = url.querySelector('lastmod')?.textContent || undefined\n      const changefreq = url.querySelector('changefreq')?.textContent || undefined\n      const priorityStr = url.querySelector('priority')?.textContent\n      const priority = priorityStr ? parseFloat(priorityStr) : undefined\n\n      entries.push({ path, lastmod, changefreq, priority })\n    })\n\n    if (debug) {\n      console.log(`[SitemapSync] Parsed ${entries.length} entries from sitemap`)\n    }\n\n    return entries\n  } catch (error) {\n    if (debug) console.error('[SitemapSync] Error parsing sitemap:', error)\n    return []\n  }\n}\n\nasync function syncToPortal(\n  entries: SitemapEntry[],\n  apiUrl: string,\n  apiKey: string,\n  site: string,\n  debug: boolean,\n  mode: 'additive' | 'full-replace' = 'additive'\n): Promise<{ success: boolean; created: number; updated: number }> {\n  if (!apiKey) {\n    if (debug) console.warn('[SitemapSync] No API key configured')\n    return { success: false, created: 0, updated: 0 }\n  }\n\n  if (entries.length === 0) {\n    if (debug) console.log('[SitemapSync] No entries to sync')\n    return { success: true, created: 0, updated: 0 }\n  }\n\n  try {\n    // Registration is idempotent in both modes (same payload → same final\n    // state), so retrying a timed-out attempt is safe.\n    const response = await sonorFetch(`${apiUrl}/api/public/seo/register-sitemap`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n      },\n      body: JSON.stringify({\n        entries: entries.map(e => ({\n          path: e.path,\n          priority: e.priority,\n          changefreq: e.changefreq,\n          pageType: inferPageType(e.path),\n        })),\n        mode,\n        // Sub-site host — tagged on every seo_pages row so the dashboard\n        // can scope the page tree to one microsite. Resolved by\n        // SiteKitClientProviders (see __SITE_KIT_SITE__).\n        ...(site ? { site } : {}),\n      }),\n    }, { apiKey })\n\n    if (!response.ok) {\n      if (debug) console.error('[SitemapSync] API error:', response.status, response.statusText)\n      return { success: false, created: 0, updated: 0 }\n    }\n\n    const result = await response.json()\n\n    if (debug) {\n      console.log(`[SitemapSync] Synced: ${result.created} created, ${result.updated} updated`)\n    }\n\n    return {\n      success: true,\n      created: result.created || 0,\n      updated: result.updated || 0,\n    }\n  } catch (error) {\n    if (debug) console.error('[SitemapSync] Sync error:', error)\n    return { success: false, created: 0, updated: 0 }\n  }\n}\n\nexport function SitemapSync({\n  sitemapUrl = '/sitemap.xml',\n  syncInterval = 60,\n  debug = false,\n  mode = 'additive',\n}: SitemapSyncProps) {\n  const hasSyncedRef = useRef(false)\n  const intervalRef = useRef<ReturnType<typeof setInterval> | null>(null)\n\n  useEffect(() => {\n    // Build-time sync via createSitemap is the canonical source of truth, but\n    // it can fail during ISR revalidation (app/ dir unavailable on serverless).\n    // Runtime SitemapSync in additive mode is a safe fallback — it adds/updates\n    // pages that may be missing without ever deleting existing ones.\n    // Full-replace is never safe at runtime — always force additive.\n    const effectiveMode: 'additive' | 'full-replace' = 'additive'\n\n    // Throttle window: reuse syncInterval when periodic syncing is on,\n    // otherwise default to 60 minutes for the on-mount sync.\n    const throttleMinutes = syncInterval > 0 ? syncInterval : 60\n\n    const doSync = async () => {\n      // Never register a sitemap from inside someone else's page.\n      //\n      // The rows would not be mis-attributed — inside the frame this document\n      // still resolves the framed site's own host and its own sitemap — but a\n      // WRITE that a third party's page view triggers is wrong for two\n      // reasons. It runs a fetch + DOMParser on a visitor's main thread in a\n      // page that gets nothing from it; and it bumps `seo_pages.updated_at`,\n      // which is a tiebreaker in `pickSeoPageRow`'s \"most recent\" fallback.\n      // On a multi-site project that is how a shared path like `/` starts\n      // resolving to a different host's row (see CLAUDE.md, the BD-AEC\n      // llms.txt contamination) — a third party's traffic should not be able\n      // to move which row wins.\n      //\n      // Same-origin frames sync as before; they are the site itself.\n      if (isCrossOriginFrame()) {\n        if (debug) console.log('[SitemapSync] Skipped — page is a cross-origin embed')\n        return\n      }\n\n      const { apiUrl, apiKey, site } = getApiConfig()\n\n      if (!apiKey) {\n        if (debug) console.warn('[SitemapSync] No API key found')\n        return\n      }\n\n      if (isRecentlySynced(throttleMinutes)) {\n        if (debug) console.log('[SitemapSync] Skipped — synced within the last', throttleMinutes, 'min this session')\n        return\n      }\n\n      if (debug) console.log('[SitemapSync] Starting sitemap sync...', site ? `(site: ${site})` : '')\n\n      const entries = await parseSitemap(sitemapUrl, debug)\n\n      if (entries.length > 0) {\n        const hash = hashEntries(sitemapUrl, entries)\n        if (isAlreadySyncedHash(hash)) {\n          // This exact sitemap already synced from this browser — the server\n          // state can't be improved by re-POSTing it. Stamp the session so we\n          // don't even re-fetch/parse for the rest of the throttle window.\n          stampSynced()\n          if (debug) console.log('[SitemapSync] Skipped POST — sitemap unchanged since last successful sync')\n          return\n        }\n        const result = await syncToPortal(entries, apiUrl, apiKey, site, debug, effectiveMode)\n        if (result.success) {\n          stampSynced()\n          storeSyncedHash(hash)\n        }\n      }\n    }\n\n    if (!hasSyncedRef.current) {\n      hasSyncedRef.current = true\n      doSync()\n    }\n\n    if (syncInterval > 0) {\n      intervalRef.current = setInterval(doSync, syncInterval * 60 * 1000)\n    }\n\n    return () => {\n      if (intervalRef.current) {\n        clearInterval(intervalRef.current)\n      }\n    }\n  }, [sitemapUrl, syncInterval, debug, mode])\n\n  return null\n}\n"]}

package/dist/{chunk-LHYVFWHL.js → chunk-A3F5GRNJ.js}

@@ -1,7 +1,7 @@
 'use client';
 'use strict';
 
-var chunkLBS4PRC7_js = require('./chunk-LBS4PRC7.js');
+var chunkQFNSM77X_js = require('./chunk-QFNSM77X.js');
 var React = require('react');
 var jsxRuntime = require('react/jsx-runtime');
 
@@ -16,8 +16,8 @@ function SignalExperiment({
   trackImpression = true,
   children
 }) {
-  const { assignment, variant, isControl } = chunkLBS4PRC7_js.useSignalExperiment(experimentId);
-  const trackEvent = chunkLBS4PRC7_js.useSignalEvent();
+  const { assignment, variant, isControl } = chunkQFNSM77X_js.useSignalExperiment(experimentId);
+  const trackEvent = chunkQFNSM77X_js.useSignalEvent();
   React.useEffect(() => {
     if (trackImpression && variant) {
       trackEvent({
@@ -44,7 +44,7 @@ function SignalExperiment({
   return /* @__PURE__ */ jsxRuntime.jsx(jsxRuntime.Fragment, { children: variants.control || null });
 }
 function useExperimentVariant(experimentId) {
-  return chunkLBS4PRC7_js.useSignalExperiment(experimentId);
+  return chunkQFNSM77X_js.useSignalExperiment(experimentId);
 }
 function ExperimentConversion({
   experimentId,
@@ -52,8 +52,8 @@ function ExperimentConversion({
   value,
   children
 }) {
-  const trackEvent = chunkLBS4PRC7_js.useSignalEvent();
-  const { variant } = chunkLBS4PRC7_js.useSignalExperiment(experimentId);
+  const trackEvent = chunkQFNSM77X_js.useSignalEvent();
+  const { variant } = chunkQFNSM77X_js.useSignalExperiment(experimentId);
   const handleInteraction = () => {
     trackEvent({
       event_type: "experiment",
@@ -79,5 +79,5 @@ function ExperimentConversion({
 exports.ExperimentConversion = ExperimentConversion;
 exports.SignalExperiment = SignalExperiment;
 exports.useExperimentVariant = useExperimentVariant;
-//# sourceMappingURL=chunk-LHYVFWHL.js.map
-//# sourceMappingURL=chunk-LHYVFWHL.js.map
+//# sourceMappingURL=chunk-A3F5GRNJ.js.map
+//# sourceMappingURL=chunk-A3F5GRNJ.js.map

package/dist/{chunk-LHYVFWHL.js.map → chunk-A3F5GRNJ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/signal/SignalExperiment.tsx"],"names":["useSignalExperiment","useSignalEvent","useEffect","jsx","Fragment","React"],"mappings":";;;;;;;;;;AAgDO,SAAS,gBAAA,CAAiB;AAAA,EAC/B,YAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,eAAA,GAAkB,IAAA;AAAA,EAClB;AACF,CAAA,EAA0B;AACxB,EAAA,MAAM,EAAE,UAAA,EAAY,OAAA,EAAS,SAAA,EAAU,GAAIA,qCAAoB,YAAY,CAAA;AAC3E,EAAA,MAAM,aAAaC,+BAAA,EAAe;AAGlC,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,mBAAmB,OAAA,EAAS;AAC9B,MAAA,UAAA,CAAW;AAAA,QACT,UAAA,EAAY,YAAA;AAAA,QACZ,UAAA,EAAY,YAAA;AAAA,QACZ,UAAA,EAAY;AAAA,UACV,aAAA,EAAe,YAAA;AAAA,UACf,WAAA,EAAa;AAAA;AACf,OACD,CAAA;AAAA,IACH;AAAA,EACF,GAAG,CAAC,YAAA,EAAc,OAAA,EAAS,eAAA,EAAiB,UAAU,CAAC,CAAA;AAGvD,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,uBAAOC,cAAA,CAAAC,mBAAA,EAAA,EAAG,mBAAS,EAAE,OAAA,EAAS,WAAW,SAAA,EAAW,SAAA,EAAW,CAAA,EAAE,CAAA;AAAA,EACnE;AAGA,EAAA,MAAM,kBAAkB,OAAA,IAAW,SAAA;AACnC,EAAA,MAAM,OAAA,GAAU,SAAS,eAAe,CAAA;AAExC,EAAA,IAAI,YAAY,MAAA,EAAW;AACzB,IAAA,6DAAU,QAAA,EAAA,OAAA,EAAQ,CAAA;AAAA,EACpB;AAGA,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,6DAAU,QAAA,EAAA,QAAA,EAAS,CAAA;AAAA,EACrB;AAEA,EAAA,uBAAOD,cAAA,CAAAC,mBAAA,EAAA,EAAG,QAAA,EAAA,QAAA,CAAS,OAAA,IAAW,IAAA,EAAK,CAAA;AACrC;AAYO,SAAS,qBAAqB,YAAA,EAAsB;AACzD,EAAA,OAAOJ,qCAAoB,YAAY,CAAA;AACzC;AAoBO,SAAS,oBAAA,CAAqB;AAAA,EACnC,YAAA;AAAA,EACA,WAAA,GAAc,OAAA;AAAA,EACd,KAAA;AAAA,EACA;AACF,CAAA,EAKG;AACD,EAAA,MAAM,aAAaC,+BAAA,EAAe;AAClC,EAAA,MAAM,EAAE,OAAA,EAAQ,GAAID,oCAAA,CAAoB,YAAY,CAAA;AAEpD,EAAA,MAAM,oBAAoB,MAAM;AAC9B,IAAA,UAAA,CAAW;AAAA,MACT,UAAA,EAAY,YAAA;AAAA,MACZ,UAAA,EAAY,YAAA;AAAA,MACZ,UAAA,EAAY;AAAA,QACV,aAAA,EAAe,YAAA;AAAA,QACf,WAAA,EAAa,OAAA;AAAA,QACb,YAAA,EAAc,WAAA;AAAA,QACd;AAAA;AACF,KACD,CAAA;AAAA,EACH,CAAA;AAEA,EAAA,OAAOK,sBAAA,CAAM,aAAa,QAAA,EAAU;AAAA,IAClC,OAAA,EAAS,CAAC,CAAA,KAAwB;AAChC,MAAA,iBAAA,EAAkB;AAElB,MAAA,IAAK,QAAA,CAAS,MAAsD,OAAA,EAAS;AAC3E,QAAC,QAAA,CAAS,KAAA,CAAsD,OAAA,CAAS,CAAC,CAAA;AAAA,MAC5E;AAAA,IACF;AAAA,GACD,CAAA;AACH","file":"chunk-LHYVFWHL.js","sourcesContent":["/**\n * @sonordev/site-kit/signal - SignalExperiment\n * \n * A/B test component that renders different variants based on Signal assignment.\n * Uses Thompson Sampling (Bayesian bandit) for optimization.\n */\n\n'use client'\n\nimport React, { useMemo, useEffect } from 'react'\nimport { useSignalExperiment, useSignalEvent } from './SignalBridge'\n\ninterface SignalExperimentProps {\n  /** Unique experiment ID */\n  experimentId: string\n  \n  /** Variants to test - keys are variant names, values are React nodes */\n  variants: Record<string, React.ReactNode>\n  \n  /** Fallback content if no assignment (defaults to 'control' variant) */\n  fallback?: React.ReactNode\n  \n  /** Track impression automatically */\n  trackImpression?: boolean\n  \n  /** Children function for more control */\n  children?: (props: { variant: string; isControl: boolean }) => React.ReactNode\n}\n\n/**\n * Renders different content variants based on Signal's A/B assignment.\n * \n * @example\n * // Simple variant switching\n * <SignalExperiment experimentId=\"hero-cta\" variants={{\n *   control: <Button>Get Started</Button>,\n *   variant_a: <Button variant=\"primary\">Start Free Trial</Button>,\n *   variant_b: <Button variant=\"secondary\">Book a Demo</Button>,\n * }} />\n * \n * @example\n * // With render prop for more control\n * <SignalExperiment experimentId=\"pricing-layout\">\n *   {({ variant, isControl }) => (\n *     <PricingSection layout={isControl ? 'cards' : 'table'} />\n *   )}\n * </SignalExperiment>\n */\nexport function SignalExperiment({\n  experimentId,\n  variants,\n  fallback,\n  trackImpression = true,\n  children,\n}: SignalExperimentProps) {\n  const { assignment, variant, isControl } = useSignalExperiment(experimentId)\n  const trackEvent = useSignalEvent()\n  \n  // Track impression when variant is rendered\n  useEffect(() => {\n    if (trackImpression && variant) {\n      trackEvent({\n        event_type: 'experiment',\n        event_name: 'impression',\n        event_data: {\n          experiment_id: experimentId,\n          variant_key: variant,\n        },\n      })\n    }\n  }, [experimentId, variant, trackImpression, trackEvent])\n  \n  // If using render prop\n  if (children) {\n    return <>{children({ variant: variant || 'control', isControl })}</>\n  }\n  \n  // Determine what to render\n  const selectedVariant = variant || 'control'\n  const content = variants[selectedVariant]\n  \n  if (content !== undefined) {\n    return <>{content}</>\n  }\n  \n  // Fallback to provided fallback or control\n  if (fallback) {\n    return <>{fallback}</>\n  }\n  \n  return <>{variants.control || null}</>\n}\n\n/**\n * Hook for conditional experiment logic\n * \n * @example\n * const { variant, isControl } = useExperimentVariant('pricing-test')\n * \n * return isControl \n *   ? <OldPricing />\n *   : <NewPricing showAnnual={variant === 'annual_first'} />\n */\nexport function useExperimentVariant(experimentId: string) {\n  return useSignalExperiment(experimentId)\n}\n\n/**\n * Component for tracking experiment conversions\n * Wraps interactive elements to track when they convert\n * \n * @example\n * <SignalExperiment experimentId=\"signup-button\" variants={{\n *   control: (\n *     <ExperimentConversion experimentId=\"signup-button\" outcomeType=\"click\">\n *       <Button>Sign Up</Button>\n *     </ExperimentConversion>\n *   ),\n *   variant_a: (\n *     <ExperimentConversion experimentId=\"signup-button\" outcomeType=\"click\">\n *       <Button variant=\"large\">Join Now - It's Free!</Button>\n *     </ExperimentConversion>\n *   ),\n * }} />\n */\nexport function ExperimentConversion({\n  experimentId,\n  outcomeType = 'click',\n  value,\n  children,\n}: {\n  experimentId: string\n  outcomeType?: string\n  value?: number\n  children: React.ReactElement<{ onClick?: (e: React.MouseEvent) => void }>\n}) {\n  const trackEvent = useSignalEvent()\n  const { variant } = useSignalExperiment(experimentId)\n\n  const handleInteraction = () => {\n    trackEvent({\n      event_type: 'experiment',\n      event_name: 'conversion',\n      event_data: {\n        experiment_id: experimentId,\n        variant_key: variant,\n        outcome_type: outcomeType,\n        value,\n      },\n    })\n  }\n\n  return React.cloneElement(children, {\n    onClick: (e: React.MouseEvent) => {\n      handleInteraction()\n      // Call original onClick if exists\n      if ((children.props as { onClick?: (e: React.MouseEvent) => void }).onClick) {\n        (children.props as { onClick?: (e: React.MouseEvent) => void }).onClick!(e)\n      }\n    },\n  })\n}\n"]}
+{"version":3,"sources":["../src/signal/SignalExperiment.tsx"],"names":["useSignalExperiment","useSignalEvent","useEffect","jsx","Fragment","React"],"mappings":";;;;;;;;;;AAgDO,SAAS,gBAAA,CAAiB;AAAA,EAC/B,YAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,eAAA,GAAkB,IAAA;AAAA,EAClB;AACF,CAAA,EAA0B;AACxB,EAAA,MAAM,EAAE,UAAA,EAAY,OAAA,EAAS,SAAA,EAAU,GAAIA,qCAAoB,YAAY,CAAA;AAC3E,EAAA,MAAM,aAAaC,+BAAA,EAAe;AAGlC,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,mBAAmB,OAAA,EAAS;AAC9B,MAAA,UAAA,CAAW;AAAA,QACT,UAAA,EAAY,YAAA;AAAA,QACZ,UAAA,EAAY,YAAA;AAAA,QACZ,UAAA,EAAY;AAAA,UACV,aAAA,EAAe,YAAA;AAAA,UACf,WAAA,EAAa;AAAA;AACf,OACD,CAAA;AAAA,IACH;AAAA,EACF,GAAG,CAAC,YAAA,EAAc,OAAA,EAAS,eAAA,EAAiB,UAAU,CAAC,CAAA;AAGvD,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,uBAAOC,cAAA,CAAAC,mBAAA,EAAA,EAAG,mBAAS,EAAE,OAAA,EAAS,WAAW,SAAA,EAAW,SAAA,EAAW,CAAA,EAAE,CAAA;AAAA,EACnE;AAGA,EAAA,MAAM,kBAAkB,OAAA,IAAW,SAAA;AACnC,EAAA,MAAM,OAAA,GAAU,SAAS,eAAe,CAAA;AAExC,EAAA,IAAI,YAAY,MAAA,EAAW;AACzB,IAAA,6DAAU,QAAA,EAAA,OAAA,EAAQ,CAAA;AAAA,EACpB;AAGA,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,6DAAU,QAAA,EAAA,QAAA,EAAS,CAAA;AAAA,EACrB;AAEA,EAAA,uBAAOD,cAAA,CAAAC,mBAAA,EAAA,EAAG,QAAA,EAAA,QAAA,CAAS,OAAA,IAAW,IAAA,EAAK,CAAA;AACrC;AAYO,SAAS,qBAAqB,YAAA,EAAsB;AACzD,EAAA,OAAOJ,qCAAoB,YAAY,CAAA;AACzC;AAoBO,SAAS,oBAAA,CAAqB;AAAA,EACnC,YAAA;AAAA,EACA,WAAA,GAAc,OAAA;AAAA,EACd,KAAA;AAAA,EACA;AACF,CAAA,EAKG;AACD,EAAA,MAAM,aAAaC,+BAAA,EAAe;AAClC,EAAA,MAAM,EAAE,OAAA,EAAQ,GAAID,oCAAA,CAAoB,YAAY,CAAA;AAEpD,EAAA,MAAM,oBAAoB,MAAM;AAC9B,IAAA,UAAA,CAAW;AAAA,MACT,UAAA,EAAY,YAAA;AAAA,MACZ,UAAA,EAAY,YAAA;AAAA,MACZ,UAAA,EAAY;AAAA,QACV,aAAA,EAAe,YAAA;AAAA,QACf,WAAA,EAAa,OAAA;AAAA,QACb,YAAA,EAAc,WAAA;AAAA,QACd;AAAA;AACF,KACD,CAAA;AAAA,EACH,CAAA;AAEA,EAAA,OAAOK,sBAAA,CAAM,aAAa,QAAA,EAAU;AAAA,IAClC,OAAA,EAAS,CAAC,CAAA,KAAwB;AAChC,MAAA,iBAAA,EAAkB;AAElB,MAAA,IAAK,QAAA,CAAS,MAAsD,OAAA,EAAS;AAC3E,QAAC,QAAA,CAAS,KAAA,CAAsD,OAAA,CAAS,CAAC,CAAA;AAAA,MAC5E;AAAA,IACF;AAAA,GACD,CAAA;AACH","file":"chunk-A3F5GRNJ.js","sourcesContent":["/**\n * @sonordev/site-kit/signal - SignalExperiment\n * \n * A/B test component that renders different variants based on Signal assignment.\n * Uses Thompson Sampling (Bayesian bandit) for optimization.\n */\n\n'use client'\n\nimport React, { useMemo, useEffect } from 'react'\nimport { useSignalExperiment, useSignalEvent } from './SignalBridge'\n\ninterface SignalExperimentProps {\n  /** Unique experiment ID */\n  experimentId: string\n  \n  /** Variants to test - keys are variant names, values are React nodes */\n  variants: Record<string, React.ReactNode>\n  \n  /** Fallback content if no assignment (defaults to 'control' variant) */\n  fallback?: React.ReactNode\n  \n  /** Track impression automatically */\n  trackImpression?: boolean\n  \n  /** Children function for more control */\n  children?: (props: { variant: string; isControl: boolean }) => React.ReactNode\n}\n\n/**\n * Renders different content variants based on Signal's A/B assignment.\n * \n * @example\n * // Simple variant switching\n * <SignalExperiment experimentId=\"hero-cta\" variants={{\n *   control: <Button>Get Started</Button>,\n *   variant_a: <Button variant=\"primary\">Start Free Trial</Button>,\n *   variant_b: <Button variant=\"secondary\">Book a Demo</Button>,\n * }} />\n * \n * @example\n * // With render prop for more control\n * <SignalExperiment experimentId=\"pricing-layout\">\n *   {({ variant, isControl }) => (\n *     <PricingSection layout={isControl ? 'cards' : 'table'} />\n *   )}\n * </SignalExperiment>\n */\nexport function SignalExperiment({\n  experimentId,\n  variants,\n  fallback,\n  trackImpression = true,\n  children,\n}: SignalExperimentProps) {\n  const { assignment, variant, isControl } = useSignalExperiment(experimentId)\n  const trackEvent = useSignalEvent()\n  \n  // Track impression when variant is rendered\n  useEffect(() => {\n    if (trackImpression && variant) {\n      trackEvent({\n        event_type: 'experiment',\n        event_name: 'impression',\n        event_data: {\n          experiment_id: experimentId,\n          variant_key: variant,\n        },\n      })\n    }\n  }, [experimentId, variant, trackImpression, trackEvent])\n  \n  // If using render prop\n  if (children) {\n    return <>{children({ variant: variant || 'control', isControl })}</>\n  }\n  \n  // Determine what to render\n  const selectedVariant = variant || 'control'\n  const content = variants[selectedVariant]\n  \n  if (content !== undefined) {\n    return <>{content}</>\n  }\n  \n  // Fallback to provided fallback or control\n  if (fallback) {\n    return <>{fallback}</>\n  }\n  \n  return <>{variants.control || null}</>\n}\n\n/**\n * Hook for conditional experiment logic\n * \n * @example\n * const { variant, isControl } = useExperimentVariant('pricing-test')\n * \n * return isControl \n *   ? <OldPricing />\n *   : <NewPricing showAnnual={variant === 'annual_first'} />\n */\nexport function useExperimentVariant(experimentId: string) {\n  return useSignalExperiment(experimentId)\n}\n\n/**\n * Component for tracking experiment conversions\n * Wraps interactive elements to track when they convert\n * \n * @example\n * <SignalExperiment experimentId=\"signup-button\" variants={{\n *   control: (\n *     <ExperimentConversion experimentId=\"signup-button\" outcomeType=\"click\">\n *       <Button>Sign Up</Button>\n *     </ExperimentConversion>\n *   ),\n *   variant_a: (\n *     <ExperimentConversion experimentId=\"signup-button\" outcomeType=\"click\">\n *       <Button variant=\"large\">Join Now - It's Free!</Button>\n *     </ExperimentConversion>\n *   ),\n * }} />\n */\nexport function ExperimentConversion({\n  experimentId,\n  outcomeType = 'click',\n  value,\n  children,\n}: {\n  experimentId: string\n  outcomeType?: string\n  value?: number\n  children: React.ReactElement<{ onClick?: (e: React.MouseEvent) => void }>\n}) {\n  const trackEvent = useSignalEvent()\n  const { variant } = useSignalExperiment(experimentId)\n\n  const handleInteraction = () => {\n    trackEvent({\n      event_type: 'experiment',\n      event_name: 'conversion',\n      event_data: {\n        experiment_id: experimentId,\n        variant_key: variant,\n        outcome_type: outcomeType,\n        value,\n      },\n    })\n  }\n\n  return React.cloneElement(children, {\n    onClick: (e: React.MouseEvent) => {\n      handleInteraction()\n      // Call original onClick if exists\n      if ((children.props as { onClick?: (e: React.MouseEvent) => void }).onClick) {\n        (children.props as { onClick?: (e: React.MouseEvent) => void }).onClick!(e)\n      }\n    },\n  })\n}\n"]}

package/dist/{chunk-SZHKNGNR.mjs → chunk-AEARU24Q.mjs}

@@ -253,20 +253,24 @@ async function generateLLMsTxt(options) {
     sections.push(faq);
     sectionNames.push("faq");
   }
-  if (includePages && data.pages?.length > 0) {
+  const renderOptional = optionalPagePaths.length > 0 && Boolean(baseUrl);
+  const optionalKeys = renderOptional ? new Set(optionalPagePaths.map(normalizeLlmsPagePath)) : null;
+  const indexPages = optionalKeys ? (data.pages ?? []).filter((p) => !optionalKeys.has(normalizeLlmsPagePath(p.path))) : data.pages ?? [];
+  if (includePages && indexPages.length > 0) {
     const pages = generatePagesSection(
-      data.pages.slice(0, maxPages),
+      indexPages.slice(0, maxPages),
       baseUrl,
       pageListNotesFromPublicSummaryOnly
     );
     sections.push(pages);
     sectionNames.push("pages");
   }
-  if (optionalPagePaths.length > 0 && baseUrl) {
+  if (renderOptional) {
     const opt = generateOptionalPagesSection(
       optionalPagePaths,
       data.pages || [],
-      baseUrl
+      baseUrl,
+      pageListNotesFromPublicSummaryOnly
     );
     if (opt) {
       sections.push(opt);
@@ -288,7 +292,7 @@ async function generateLLMsTxt(options) {
     if (includeEntities) {
       attemptedSections.push("knowledge-graph");
       optionalFetches.push(
-        import('./server-api-HW4PL2L2.mjs').then(async ({ getEntities, getPrimaryEntity }) => {
+        import('./server-api-RG3ZL3DV.mjs').then(async ({ getEntities, getPrimaryEntity }) => {
           const [entities, primaryEntity] = await Promise.all([
             getEntities().then((e) => e.slice(0, maxEntities)),
             getPrimaryEntity()
@@ -535,36 +539,46 @@ function pageListNote(page, publicSummaryOnly) {
   if (page.description) return page.description.replace(/[\[\]\r\n]/g, " ").trim();
   return void 0;
 }
+function normalizeLlmsPagePath(path) {
+  const withLeading = path.startsWith("/") ? path : `/${path}`;
+  return withLeading.replace(/\/$/, "") || "/";
+}
+function formatPageLine(page, baseUrl, publicSummaryOnly) {
+  const url = page.path.startsWith("http") ? page.path : `${baseUrl}${page.path}`;
+  const note = pageListNote(page, publicSummaryOnly);
+  return note ? `- [${page.title}](${url}): ${note}` : `- [${page.title}](${url})`;
+}
 function generatePagesSection(pages, baseUrl, publicSummaryOnly) {
   const lines = [];
   lines.push("## Site Pages");
   lines.push("");
   for (const page of pages) {
-    const url = page.path.startsWith("http") ? page.path : `${baseUrl}${page.path}`;
-    const note = pageListNote(page, publicSummaryOnly);
-    if (note) {
-      lines.push(`- [${page.title}](${url}): ${note}`);
-    } else {
-      lines.push(`- [${page.title}](${url})`);
-    }
+    lines.push(formatPageLine(page, baseUrl, publicSummaryOnly));
   }
   return lines.join("\n");
 }
-function generateOptionalPagesSection(paths, pages, baseUrl) {
-  const normalizedBase = baseUrl.replace(/\/$/, "");
-  const byPath = new Map(pages.map((p) => [p.path.replace(/\/$/, "") || "/", p]));
+function generateOptionalPagesSection(paths, pages, baseUrl, publicSummaryOnly) {
+  const byPath = /* @__PURE__ */ new Map();
+  for (const page of pages) {
+    const key = normalizeLlmsPagePath(page.path);
+    if (!byPath.has(key)) byPath.set(key, page);
+  }
   const lines = ["## Optional", ""];
-  let any = false;
+  const seen = /* @__PURE__ */ new Set();
   for (const raw of paths) {
+    const key = normalizeLlmsPagePath(raw);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const match = byPath.get(key);
+    if (match) {
+      lines.push(formatPageLine(match, baseUrl, publicSummaryOnly));
+      continue;
+    }
     const p = raw.startsWith("/") ? raw : `/${raw}`;
-    const norm = p.replace(/\/$/, "") || "/";
-    const match = byPath.get(norm) || byPath.get(`${norm}/`);
-    const title = match?.title || norm.split("/").filter(Boolean).pop() || norm;
-    const url = `${normalizedBase}${p.endsWith("/") ? p : `${p}/`}`;
-    lines.push(`- [${title}](${url})`);
-    any = true;
-  }
-  return any ? lines.join("\n") : null;
+    const title = key.split("/").filter(Boolean).pop() || key;
+    lines.push(`- [${title}](${baseUrl}${p.endsWith("/") ? p : `${p}/`})`);
+  }
+  return seen.size > 0 ? lines.join("\n") : null;
 }
 function generateEntitySection(entities, primaryEntity, detailed) {
   const lines = [];
@@ -704,5 +718,5 @@ function atomicWriteSync(filePath, content) {
 }
 
 export { generateLLMsFullTxt, generateLLMsTxt, getBusinessInfo, getFAQItems, getLLMsData, getOptimizedLLMsTxt, getPageSummaries, getServices, writeLLMsTxtToPublic };
-//# sourceMappingURL=chunk-SZHKNGNR.mjs.map
-//# sourceMappingURL=chunk-SZHKNGNR.mjs.map
+//# sourceMappingURL=chunk-AEARU24Q.mjs.map
+//# sourceMappingURL=chunk-AEARU24Q.mjs.map