@sonordev/site-kit 5.5.0 → 5.6.0

package/dist/{chunk-MNYM2XU4.js.map → chunk-R3KTBKSW.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/mint-site-token.ts"],"names":["SITE_KIT_VERSION"],"mappings":";;;;;AA4CA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAO1B,IAAM,iBAAA,GAAoB,CAAA;AAC1B,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,mBAAA,GAAsB,GAAA;AAM5B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAO1C,IAAM,QAAA,uBAAe,GAAA,EAA6B;AAElD,IAAM,KAAA,GAAQ,CAAC,EAAA,KAAe,IAAI,OAAA,CAAc,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAOxE,SAAS,YAAA,CAAa,KAAsB,OAAA,EAAyB;AACnE,EAAA,MAAM,MAAA,GAAS,GAAA,EAAK,OAAA,EAAS,GAAA,GAAM,aAAa,CAAA;AAChD,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,OAAA,GAAU,OAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GAC9B,OAAA,GAAU,GAAA,GACV,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,GAAI,IAAA,CAAK,GAAA,EAAI;AAClC,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,EAAE,CAAA,IAAK,EAAA,GAAK,GAAG,OAAO,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,mBAAmB,CAAA;AAAA,EAC5E;AACA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,oBAAA,GAAuB,CAAA,IAAK,SAAS,mBAAmB,CAAA;AAC1E;AAGA,IAAM,iBAAA,GAAoB,CAAC,MAAA,KAAmB,MAAA,KAAW,OAAO,MAAA,IAAU,GAAA;AAM1E,SAAS,kBAAA,GAA8B;AACrC,EAAA,OACE,OAAO,OAAA,KAAY,WAAA,IACnB,OAAA,CAAQ,KAAK,yBAAA,KAA8B,KAAA;AAE/C;AAEA,SAAS,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAgB,GAAA,EAAqB;AACvE,EAAA,IAAI,oBAAmB,EAAG;AACxB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,sCAAsC,MAAM,CAAA,uMAAA;AAAA,KAG9C;AACA,IAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,0CAA0C,MAAM,CAAA,uRAAA;AAAA,GAIlD;AACF;AA8BO,SAAS,YAAA,GAAsD;AACpE,EAAA,MAAM,UAAU,UAAA,CAAW,KAAA;AAG3B,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,uCAAuC,CAAA;AACrE,EAAA,MAAM,WAAW,OAAA,CAAQ,kBAAA;AACzB,EAAA,IAAI,OAAO,aAAa,UAAA,EAAY,OAAO,EAAE,EAAA,EAAI,QAAA,EAAU,WAAW,IAAA,EAAK;AAC3E,EAAA,OAAO,EAAE,EAAA,EAAI,OAAA,EAAS,SAAA,EAAW,KAAA,EAAM;AACzC;AAYO,SAAS,kBAAkB,GAAA,EAAuB;AACvD,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AAC5C,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,sBAAA,EAAwB,OAAO,IAAA;AAChD,EAAA,IAAI,CAAA,CAAE,IAAA,KAAS,yBAAA,EAA2B,OAAO,IAAA;AACjD,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,EAAE,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,EAAG,OAAO,IAAA;AACzE,EAAA,IAAI,EAAE,QAAA,qBAAa,MAAA,CAAO,GAAA,CAAI,gBAAgB,GAAG,OAAO,IAAA;AACxD,EAAA,OAAO,KAAA;AACT;AAEA,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,UAAU,MAAA,CAAO,SAAA,GAAY,KAAK,GAAA,EAAI,SAAU,MAAA,CAAO,UAAA;AAG3D,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,SAAS,OAAO,OAAA;AAEpB,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AAC5C,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,OAAO,CAAA;AAC5B,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAA;AAAA,EACf,CAAA,SAAE;AACA,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,EACxB;AACF;AAEA,eAAe,aAAA,CAAc,QAAgB,MAAA,EAAiC;AAC5E,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI,UAAA,GAAa,eAAA;AAEjB,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,iBAAA,EAAmB,OAAA,EAAA,EAAW;AAC5D,IAAA,IAAI,GAAA,GAAuB,IAAA;AAC3B,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,EAAA,EAAI,OAAA,EAAS,SAAA,KAAc,YAAA,EAAa;AAChD,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,QACzC,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,WAAA,EAAa,MAAA;AAAA,UACb,mBAAA,EAAqBA;AAAA,SACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMA,GAAI,YAAY,EAAC,GAAK,EAAE,IAAA,EAAM,EAAE,UAAA,EAAY,KAAA,EAAM,EAAE;AAAA,QACpD,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,OACP,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAI,iBAAA,CAAkB,GAAG,CAAA,EAAG,MAAM,GAAA;AAClC,MAAA,UAAA,GAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,eAAA;AAClD,MAAA,IAAI,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACnC,QAAA,MAAM,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AACvC,QAAA;AAAA,MACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,IAAK,SAAA,GAAY,GAAA,GAAQ,CAAA,EAAG,EAAA,GAAK,GAAM;AAAA,SACrE,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,UAAA,GAAa,+BAAA;AACb,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,MAAA,KAAA,CAAM,GAAA,CAAI,MAAA,EAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,WAAW,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,EAAQ,CAAA;AACxE,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,UAAA,GAAa,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAC/B,IAAA,IAAI,kBAAkB,GAAA,CAAI,MAAM,CAAA,IAAK,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACpE,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,EAAK,OAAO,CAAA;AACvC,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,GAAA,CAAI,MAAM,CAAA,cAAA,EAAiB,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA,YAAA,EACrE,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,iBAAiB,CAAA,EAAA;AAAA,OAChD;AACA,MAAA,MAAM,MAAM,KAAK,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA;AAAA,EACF;AAEA,EAAA,OAAO,UAAA,CAAW,UAAA,EAAY,MAAA,EAAQ,IAAA,CAAK,KAAK,CAAA;AAClD","file":"chunk-MNYM2XU4.js","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * FAILS CLOSED. If minting genuinely fails, this throws and the build fails —\n * it does NOT publish the raw key. A failed deploy is loud and recoverable; a\n * leaked project secret in public HTML is neither. The only paths that still\n * return the raw key are a 404 (an older API that predates the endpoint, an\n * expected state during rollout) and the explicit `SONOR_SITE_TOKEN_FALLBACK=raw`\n * escape hatch, for when shipping beats being blocked.\n *\n * That posture is not academic. Through 3.5.0 a throttled mint (HTTP 429)\n * returned the raw key AND cached it for 60s, so every page rendered in that\n * window shipped the secret: one real build came out with 180 of 272 prerendered\n * pages carrying it. The build \"succeeded\" and nothing downstream noticed.\n * Rate limiting is transient by definition — the fix is to wait and retry, not\n * to downgrade to publishing the key.\n *\n * Two things keep the request count low enough that throttling is rare:\n *  - a module-level memo, so a worker mints once and every page reuses the seed;\n *  - an in-flight map, because that memo is only populated AFTER the await. Next\n *    renders pages concurrently, so without coalescing the first N concurrent\n *    renders in a process all miss the cache and all fire a request — a\n *    stampede per worker, multiplied by one worker per core. That is how a\n *    single site exhausted a 60/min budget.\n *\n * SEED FRESHNESS: a static page's seed carries `iat` = build time, and the API\n * refuses to refresh a seed older than SITE_TOKEN_MAX_REFRESH_AGE_SECONDS\n * (sonor-api common/site-auth/site-token.util.ts — currently 400 days, raised\n * from 30 alongside this fix). A site not rebuilt within that window serves a\n * seed the client cannot refresh, and its forms/analytics/engage start failing\n * for new visitors. Keep that limit comfortably longer than the fleet's\n * realistic redeploy gap; marketing sites routinely go many months untouched.\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\n/**\n * Retry budget for transient failures (429 / 5xx / network). Rate limiting is\n * measured per minute, so a few seconds of backoff clears it; the whole ladder\n * costs at most ~20s once per build worker, and only when something is wrong.\n */\nconst MINT_MAX_ATTEMPTS = 4\nconst MINT_BACKOFF_BASE_MS = 500\nconst MINT_BACKOFF_CAP_MS = 8_000\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\n/**\n * Requests already in flight, keyed by raw key. The `cache` above is only\n * written after the response lands, so concurrent renders would otherwise each\n * start their own mint. See the module header.\n */\nconst inflight = new Map<string, Promise<string>>()\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\n/**\n * Honour `Retry-After` when the server sends it (delta-seconds or HTTP date),\n * otherwise exponential backoff. Capped so a misconfigured server cannot stall\n * a build indefinitely.\n */\nfunction retryDelayMs(res: Response | null, attempt: number): number {\n  const header = res?.headers?.get?.('retry-after')\n  if (header) {\n    const seconds = Number(header)\n    const ms = Number.isFinite(seconds)\n      ? seconds * 1000\n      : Date.parse(header) - Date.now()\n    if (Number.isFinite(ms) && ms > 0) return Math.min(ms, MINT_BACKOFF_CAP_MS)\n  }\n  return Math.min(MINT_BACKOFF_BASE_MS * 2 ** attempt, MINT_BACKOFF_CAP_MS)\n}\n\n/** 429 and 5xx are transient; waiting is the correct response to both. */\nconst isRetryableStatus = (status: number) => status === 429 || status >= 500\n\n/**\n * The escape hatch, for when a broken mint must not block a release. Opt-in and\n * loud: it re-enables publishing the project secret in page HTML.\n */\nfunction rawFallbackAllowed(): boolean {\n  return (\n    typeof process !== 'undefined' &&\n    process.env?.SONOR_SITE_TOKEN_FALLBACK === 'raw'\n  )\n}\n\nfunction failClosed(reason: string, rawKey: string, now: number): string {\n  if (rawFallbackAllowed()) {\n    console.warn(\n      `[SiteKitLayout] Token mint failed (${reason}) and SONOR_SITE_TOKEN_FALLBACK=raw is set; ` +\n        'injecting the RAW API KEY into page HTML. The key is publicly readable wherever ' +\n        'this page is served — unset the escape hatch once the mint is healthy.',\n    )\n    cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n    return rawKey\n  }\n  throw new Error(\n    `site-kit: could not mint a site token (${reason}). Refusing to publish the raw ` +\n      'SONOR_API_KEY in page HTML, so this build fails instead. Check that the mint ' +\n      'endpoint is reachable and the key is valid, then rebuild. To ship anyway — ' +\n      'which publishes the project secret in public HTML — set SONOR_SITE_TOKEN_FALLBACK=raw.',\n  )\n}\n\ntype FetchLike = typeof fetch\n\n/**\n * Next.js monkey-patches `globalThis.fetch` so every call participates in its\n * Data Cache and static-generation tracking. This mint must NOT participate.\n *\n * `cache: 'no-store'` marks the calling scope dynamic, so during `next build`\n * Next throws DynamicServerError *before the request goes out*. On a statically\n * prerendered route the mint therefore never ran at all — the catch below\n * swallowed the bailout and every page shipped the raw key. (Verified against\n * Next 16.2.9: the mint endpoint received zero requests for a static build.)\n *\n * The two obvious repairs are both wrong:\n *   - `next: { revalidate: N }` LOWERS the route's revalidate window\n *     (patch-fetch.js: `finalRevalidate < revalidateStore.revalidate`), quietly\n *     converting fully-static pages into ISR across the whole fleet.\n *   - `next: { revalidate: false }` keeps pages static but writes the token into\n *     the Data Cache, which hosts persist across builds — a fresh deploy could\n *     re-bake a months-old seed, which is the exact failure we're removing.\n *\n * A credential mint is not page data and has no business in the page data cache.\n * So we call the original fetch Next saves on the patched one and stay invisible\n * to the framework: no bailout, no cache entry, no effect on staticness. The\n * module-level memo above is the only cache we want — one mint per build\n * process, and a build-fresh seed on every deploy.\n *\n * @internal Exported for unit tests; not part of the package's public API.\n */\nexport function resolveFetch(): { fn: FetchLike; unpatched: boolean } {\n  const current = globalThis.fetch as\n    | (FetchLike & { _nextOriginalFetch?: FetchLike })\n    | undefined\n  if (!current) throw new Error('site-kit: global fetch is unavailable')\n  const original = current._nextOriginalFetch\n  if (typeof original === 'function') return { fn: original, unpatched: true }\n  return { fn: current, unpatched: false }\n}\n\n/**\n * Next signals \"this render must go dynamic\" by THROWING (DynamicServerError,\n * static-gen bailout, redirect/notFound digests, React's postpone). Those are\n * the framework's control flow, not a mint failure. Swallowing one makes Next\n * believe the render succeeded statically — which is precisely how the raw key\n * ended up stranded in prerendered HTML with no error anywhere. Let them\n * propagate; only real network/HTTP failures fall back to the raw key.\n *\n * @internal Exported for unit tests; not part of the package's public API.\n */\nexport function isFrameworkSignal(err: unknown): boolean {\n  if (!err || typeof err !== 'object') return false\n  const e = err as { digest?: unknown; code?: unknown; $$typeof?: unknown }\n  if (e.digest === 'DYNAMIC_SERVER_USAGE') return true\n  if (e.code === 'NEXT_STATIC_GEN_BAILOUT') return true\n  if (typeof e.digest === 'string' && e.digest.startsWith('NEXT_')) return true\n  if (e.$$typeof === Symbol.for('react.postpone')) return true\n  return false\n}\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > Date.now()) return cached.credential\n\n  // Collapse concurrent renders onto one request rather than a stampede.\n  const pending = inflight.get(rawKey)\n  if (pending) return pending\n\n  const request = mintWithRetry(rawKey, apiUrl)\n  inflight.set(rawKey, request)\n  try {\n    return await request\n  } finally {\n    inflight.delete(rawKey)\n  }\n}\n\nasync function mintWithRetry(rawKey: string, apiUrl: string): Promise<string> {\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  let lastReason = 'unknown error'\n\n  for (let attempt = 0; attempt < MINT_MAX_ATTEMPTS; attempt++) {\n    let res: Response | null = null\n    try {\n      const { fn: fetchFn, unpatched } = resolveFetch()\n      res = await fetchFn(`${base}${MINT_PATH}`, {\n        method: 'POST',\n        headers: {\n          'content-type': 'application/json',\n          'x-api-key': rawKey,\n          'x-sitekit-version': SITE_KIT_VERSION,\n        },\n        // Only meaningful on the fallback path, where a future Next stopped\n        // exposing `_nextOriginalFetch` and we're back on the patched fetch.\n        // `revalidate: false` is the one setting that neither bails out of static\n        // generation nor downgrades the route to ISR; a Data Cache entry is the\n        // lesser evil versus shipping the raw key again.\n        ...(unpatched ? {} : ({ next: { revalidate: false } } as RequestInit)),\n        signal:\n          typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n            ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n            : undefined,\n      })\n    } catch (err) {\n      // Never swallow the framework's own control flow — see isFrameworkSignal.\n      if (isFrameworkSignal(err)) throw err\n      lastReason = err instanceof Error ? err.message : 'network error'\n      if (attempt < MINT_MAX_ATTEMPTS - 1) {\n        await sleep(retryDelayMs(null, attempt))\n        continue\n      }\n      break\n    }\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: Date.now() + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n      lastReason = 'mint returned no usable token'\n      break\n    }\n\n    // 404 = an API older than the endpoint. Expected during rollout, and the raw\n    // key is exactly what such an API still expects, so this stays a fallback\n    // rather than a build failure.\n    if (res.status === 404) {\n      cache.set(rawKey, { credential: rawKey, expiresAt: Date.now() + 60_000 })\n      return rawKey\n    }\n\n    lastReason = `HTTP ${res.status}`\n    if (isRetryableStatus(res.status) && attempt < MINT_MAX_ATTEMPTS - 1) {\n      const delay = retryDelayMs(res, attempt)\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; retrying in ${Math.round(delay)}ms ` +\n          `(attempt ${attempt + 2}/${MINT_MAX_ATTEMPTS}).`,\n      )\n      await sleep(delay)\n      continue\n    }\n    break\n  }\n\n  return failClosed(lastReason, rawKey, Date.now())\n}\n"]}
+{"version":3,"sources":["../src/server/mint-site-token.ts"],"names":["SITE_KIT_VERSION"],"mappings":";;;;;AA4CA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAO1B,IAAM,iBAAA,GAAoB,CAAA;AAC1B,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,mBAAA,GAAsB,GAAA;AAM5B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAO1C,IAAM,QAAA,uBAAe,GAAA,EAA6B;AAElD,IAAM,KAAA,GAAQ,CAAC,EAAA,KAAe,IAAI,OAAA,CAAc,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAOxE,SAAS,YAAA,CAAa,KAAsB,OAAA,EAAyB;AACnE,EAAA,MAAM,MAAA,GAAS,GAAA,EAAK,OAAA,EAAS,GAAA,GAAM,aAAa,CAAA;AAChD,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,OAAA,GAAU,OAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GAC9B,OAAA,GAAU,GAAA,GACV,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,GAAI,IAAA,CAAK,GAAA,EAAI;AAClC,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,EAAE,CAAA,IAAK,EAAA,GAAK,GAAG,OAAO,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,mBAAmB,CAAA;AAAA,EAC5E;AACA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,oBAAA,GAAuB,CAAA,IAAK,SAAS,mBAAmB,CAAA;AAC1E;AAGA,IAAM,iBAAA,GAAoB,CAAC,MAAA,KAAmB,MAAA,KAAW,OAAO,MAAA,IAAU,GAAA;AAM1E,SAAS,kBAAA,GAA8B;AACrC,EAAA,OACE,OAAO,OAAA,KAAY,WAAA,IACnB,OAAA,CAAQ,KAAK,yBAAA,KAA8B,KAAA;AAE/C;AAEA,SAAS,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAgB,GAAA,EAAqB;AACvE,EAAA,IAAI,oBAAmB,EAAG;AACxB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,sCAAsC,MAAM,CAAA,uMAAA;AAAA,KAG9C;AACA,IAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,0CAA0C,MAAM,CAAA,uRAAA;AAAA,GAIlD;AACF;AA8BO,SAAS,YAAA,GAAsD;AACpE,EAAA,MAAM,UAAU,UAAA,CAAW,KAAA;AAG3B,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,uCAAuC,CAAA;AACrE,EAAA,MAAM,WAAW,OAAA,CAAQ,kBAAA;AACzB,EAAA,IAAI,OAAO,aAAa,UAAA,EAAY,OAAO,EAAE,EAAA,EAAI,QAAA,EAAU,WAAW,IAAA,EAAK;AAC3E,EAAA,OAAO,EAAE,EAAA,EAAI,OAAA,EAAS,SAAA,EAAW,KAAA,EAAM;AACzC;AAYO,SAAS,kBAAkB,GAAA,EAAuB;AACvD,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AAC5C,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,sBAAA,EAAwB,OAAO,IAAA;AAChD,EAAA,IAAI,CAAA,CAAE,IAAA,KAAS,yBAAA,EAA2B,OAAO,IAAA;AACjD,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,EAAE,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,EAAG,OAAO,IAAA;AACzE,EAAA,IAAI,EAAE,QAAA,qBAAa,MAAA,CAAO,GAAA,CAAI,gBAAgB,GAAG,OAAO,IAAA;AACxD,EAAA,OAAO,KAAA;AACT;AAEA,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,UAAU,MAAA,CAAO,SAAA,GAAY,KAAK,GAAA,EAAI,SAAU,MAAA,CAAO,UAAA;AAG3D,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,SAAS,OAAO,OAAA;AAEpB,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AAC5C,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,OAAO,CAAA;AAC5B,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAA;AAAA,EACf,CAAA,SAAE;AACA,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,EACxB;AACF;AAEA,eAAe,aAAA,CAAc,QAAgB,MAAA,EAAiC;AAC5E,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI,UAAA,GAAa,eAAA;AAEjB,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,iBAAA,EAAmB,OAAA,EAAA,EAAW;AAC5D,IAAA,IAAI,GAAA,GAAuB,IAAA;AAC3B,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,EAAA,EAAI,OAAA,EAAS,SAAA,KAAc,YAAA,EAAa;AAChD,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,QACzC,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,WAAA,EAAa,MAAA;AAAA,UACb,mBAAA,EAAqBA;AAAA,SACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMA,GAAI,YAAY,EAAC,GAAK,EAAE,IAAA,EAAM,EAAE,UAAA,EAAY,KAAA,EAAM,EAAE;AAAA,QACpD,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,OACP,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAI,iBAAA,CAAkB,GAAG,CAAA,EAAG,MAAM,GAAA;AAClC,MAAA,UAAA,GAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,eAAA;AAClD,MAAA,IAAI,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACnC,QAAA,MAAM,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AACvC,QAAA;AAAA,MACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,IAAK,SAAA,GAAY,GAAA,GAAQ,CAAA,EAAG,EAAA,GAAK,GAAM;AAAA,SACrE,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,UAAA,GAAa,+BAAA;AACb,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,MAAA,KAAA,CAAM,GAAA,CAAI,MAAA,EAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,WAAW,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,EAAQ,CAAA;AACxE,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,UAAA,GAAa,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAC/B,IAAA,IAAI,kBAAkB,GAAA,CAAI,MAAM,CAAA,IAAK,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACpE,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,EAAK,OAAO,CAAA;AACvC,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,GAAA,CAAI,MAAM,CAAA,cAAA,EAAiB,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA,YAAA,EACrE,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,iBAAiB,CAAA,EAAA;AAAA,OAChD;AACA,MAAA,MAAM,MAAM,KAAK,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA;AAAA,EACF;AAEA,EAAA,OAAO,UAAA,CAAW,UAAA,EAAY,MAAA,EAAQ,IAAA,CAAK,KAAK,CAAA;AAClD","file":"chunk-R3KTBKSW.js","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * FAILS CLOSED. If minting genuinely fails, this throws and the build fails —\n * it does NOT publish the raw key. A failed deploy is loud and recoverable; a\n * leaked project secret in public HTML is neither. The only paths that still\n * return the raw key are a 404 (an older API that predates the endpoint, an\n * expected state during rollout) and the explicit `SONOR_SITE_TOKEN_FALLBACK=raw`\n * escape hatch, for when shipping beats being blocked.\n *\n * That posture is not academic. Through 3.5.0 a throttled mint (HTTP 429)\n * returned the raw key AND cached it for 60s, so every page rendered in that\n * window shipped the secret: one real build came out with 180 of 272 prerendered\n * pages carrying it. The build \"succeeded\" and nothing downstream noticed.\n * Rate limiting is transient by definition — the fix is to wait and retry, not\n * to downgrade to publishing the key.\n *\n * Two things keep the request count low enough that throttling is rare:\n *  - a module-level memo, so a worker mints once and every page reuses the seed;\n *  - an in-flight map, because that memo is only populated AFTER the await. Next\n *    renders pages concurrently, so without coalescing the first N concurrent\n *    renders in a process all miss the cache and all fire a request — a\n *    stampede per worker, multiplied by one worker per core. That is how a\n *    single site exhausted a 60/min budget.\n *\n * SEED FRESHNESS: a static page's seed carries `iat` = build time, and the API\n * refuses to refresh a seed older than SITE_TOKEN_MAX_REFRESH_AGE_SECONDS\n * (sonor-api common/site-auth/site-token.util.ts — currently 400 days, raised\n * from 30 alongside this fix). A site not rebuilt within that window serves a\n * seed the client cannot refresh, and its forms/analytics/engage start failing\n * for new visitors. Keep that limit comfortably longer than the fleet's\n * realistic redeploy gap; marketing sites routinely go many months untouched.\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\n/**\n * Retry budget for transient failures (429 / 5xx / network). Rate limiting is\n * measured per minute, so a few seconds of backoff clears it; the whole ladder\n * costs at most ~20s once per build worker, and only when something is wrong.\n */\nconst MINT_MAX_ATTEMPTS = 4\nconst MINT_BACKOFF_BASE_MS = 500\nconst MINT_BACKOFF_CAP_MS = 8_000\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\n/**\n * Requests already in flight, keyed by raw key. The `cache` above is only\n * written after the response lands, so concurrent renders would otherwise each\n * start their own mint. See the module header.\n */\nconst inflight = new Map<string, Promise<string>>()\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\n/**\n * Honour `Retry-After` when the server sends it (delta-seconds or HTTP date),\n * otherwise exponential backoff. Capped so a misconfigured server cannot stall\n * a build indefinitely.\n */\nfunction retryDelayMs(res: Response | null, attempt: number): number {\n  const header = res?.headers?.get?.('retry-after')\n  if (header) {\n    const seconds = Number(header)\n    const ms = Number.isFinite(seconds)\n      ? seconds * 1000\n      : Date.parse(header) - Date.now()\n    if (Number.isFinite(ms) && ms > 0) return Math.min(ms, MINT_BACKOFF_CAP_MS)\n  }\n  return Math.min(MINT_BACKOFF_BASE_MS * 2 ** attempt, MINT_BACKOFF_CAP_MS)\n}\n\n/** 429 and 5xx are transient; waiting is the correct response to both. */\nconst isRetryableStatus = (status: number) => status === 429 || status >= 500\n\n/**\n * The escape hatch, for when a broken mint must not block a release. Opt-in and\n * loud: it re-enables publishing the project secret in page HTML.\n */\nfunction rawFallbackAllowed(): boolean {\n  return (\n    typeof process !== 'undefined' &&\n    process.env?.SONOR_SITE_TOKEN_FALLBACK === 'raw'\n  )\n}\n\nfunction failClosed(reason: string, rawKey: string, now: number): string {\n  if (rawFallbackAllowed()) {\n    console.warn(\n      `[SiteKitLayout] Token mint failed (${reason}) and SONOR_SITE_TOKEN_FALLBACK=raw is set; ` +\n        'injecting the RAW API KEY into page HTML. The key is publicly readable wherever ' +\n        'this page is served — unset the escape hatch once the mint is healthy.',\n    )\n    cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n    return rawKey\n  }\n  throw new Error(\n    `site-kit: could not mint a site token (${reason}). Refusing to publish the raw ` +\n      'SONOR_API_KEY in page HTML, so this build fails instead. Check that the mint ' +\n      'endpoint is reachable and the key is valid, then rebuild. To ship anyway — ' +\n      'which publishes the project secret in public HTML — set SONOR_SITE_TOKEN_FALLBACK=raw.',\n  )\n}\n\ntype FetchLike = typeof fetch\n\n/**\n * Next.js monkey-patches `globalThis.fetch` so every call participates in its\n * Data Cache and static-generation tracking. This mint must NOT participate.\n *\n * `cache: 'no-store'` marks the calling scope dynamic, so during `next build`\n * Next throws DynamicServerError *before the request goes out*. On a statically\n * prerendered route the mint therefore never ran at all — the catch below\n * swallowed the bailout and every page shipped the raw key. (Verified against\n * Next 16.2.9: the mint endpoint received zero requests for a static build.)\n *\n * The two obvious repairs are both wrong:\n *   - `next: { revalidate: N }` LOWERS the route's revalidate window\n *     (patch-fetch.js: `finalRevalidate < revalidateStore.revalidate`), quietly\n *     converting fully-static pages into ISR across the whole fleet.\n *   - `next: { revalidate: false }` keeps pages static but writes the token into\n *     the Data Cache, which hosts persist across builds — a fresh deploy could\n *     re-bake a months-old seed, which is the exact failure we're removing.\n *\n * A credential mint is not page data and has no business in the page data cache.\n * So we call the original fetch Next saves on the patched one and stay invisible\n * to the framework: no bailout, no cache entry, no effect on staticness. The\n * module-level memo above is the only cache we want — one mint per build\n * process, and a build-fresh seed on every deploy.\n *\n * @internal Exported for unit tests; not part of the package's public API.\n */\nexport function resolveFetch(): { fn: FetchLike; unpatched: boolean } {\n  const current = globalThis.fetch as\n    | (FetchLike & { _nextOriginalFetch?: FetchLike })\n    | undefined\n  if (!current) throw new Error('site-kit: global fetch is unavailable')\n  const original = current._nextOriginalFetch\n  if (typeof original === 'function') return { fn: original, unpatched: true }\n  return { fn: current, unpatched: false }\n}\n\n/**\n * Next signals \"this render must go dynamic\" by THROWING (DynamicServerError,\n * static-gen bailout, redirect/notFound digests, React's postpone). Those are\n * the framework's control flow, not a mint failure. Swallowing one makes Next\n * believe the render succeeded statically — which is precisely how the raw key\n * ended up stranded in prerendered HTML with no error anywhere. Let them\n * propagate; only real network/HTTP failures fall back to the raw key.\n *\n * @internal Exported for unit tests; not part of the package's public API.\n */\nexport function isFrameworkSignal(err: unknown): boolean {\n  if (!err || typeof err !== 'object') return false\n  const e = err as { digest?: unknown; code?: unknown; $$typeof?: unknown }\n  if (e.digest === 'DYNAMIC_SERVER_USAGE') return true\n  if (e.code === 'NEXT_STATIC_GEN_BAILOUT') return true\n  if (typeof e.digest === 'string' && e.digest.startsWith('NEXT_')) return true\n  if (e.$$typeof === Symbol.for('react.postpone')) return true\n  return false\n}\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > Date.now()) return cached.credential\n\n  // Collapse concurrent renders onto one request rather than a stampede.\n  const pending = inflight.get(rawKey)\n  if (pending) return pending\n\n  const request = mintWithRetry(rawKey, apiUrl)\n  inflight.set(rawKey, request)\n  try {\n    return await request\n  } finally {\n    inflight.delete(rawKey)\n  }\n}\n\nasync function mintWithRetry(rawKey: string, apiUrl: string): Promise<string> {\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  let lastReason = 'unknown error'\n\n  for (let attempt = 0; attempt < MINT_MAX_ATTEMPTS; attempt++) {\n    let res: Response | null = null\n    try {\n      const { fn: fetchFn, unpatched } = resolveFetch()\n      res = await fetchFn(`${base}${MINT_PATH}`, {\n        method: 'POST',\n        headers: {\n          'content-type': 'application/json',\n          'x-api-key': rawKey,\n          'x-sitekit-version': SITE_KIT_VERSION,\n        },\n        // Only meaningful on the fallback path, where a future Next stopped\n        // exposing `_nextOriginalFetch` and we're back on the patched fetch.\n        // `revalidate: false` is the one setting that neither bails out of static\n        // generation nor downgrades the route to ISR; a Data Cache entry is the\n        // lesser evil versus shipping the raw key again.\n        ...(unpatched ? {} : ({ next: { revalidate: false } } as RequestInit)),\n        signal:\n          typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n            ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n            : undefined,\n      })\n    } catch (err) {\n      // Never swallow the framework's own control flow — see isFrameworkSignal.\n      if (isFrameworkSignal(err)) throw err\n      lastReason = err instanceof Error ? err.message : 'network error'\n      if (attempt < MINT_MAX_ATTEMPTS - 1) {\n        await sleep(retryDelayMs(null, attempt))\n        continue\n      }\n      break\n    }\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: Date.now() + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n      lastReason = 'mint returned no usable token'\n      break\n    }\n\n    // 404 = an API older than the endpoint. Expected during rollout, and the raw\n    // key is exactly what such an API still expects, so this stays a fallback\n    // rather than a build failure.\n    if (res.status === 404) {\n      cache.set(rawKey, { credential: rawKey, expiresAt: Date.now() + 60_000 })\n      return rawKey\n    }\n\n    lastReason = `HTTP ${res.status}`\n    if (isRetryableStatus(res.status) && attempt < MINT_MAX_ATTEMPTS - 1) {\n      const delay = retryDelayMs(res, attempt)\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; retrying in ${Math.round(delay)}ms ` +\n          `(attempt ${attempt + 2}/${MINT_MAX_ATTEMPTS}).`,\n      )\n      await sleep(delay)\n      continue\n    }\n    break\n  }\n\n  return failClosed(lastReason, rawKey, Date.now())\n}\n"]}

package/dist/{chunk-WIZRCI6J.mjs → chunk-RIYAMYLV.mjs}

@@ -1,4 +1,4 @@
-import { SITE_KIT_VERSION } from './chunk-WDBCXRTT.mjs';
+import { SITE_KIT_VERSION } from './chunk-DQUBETXH.mjs';
 import 'server-only';
 
 var MINT_PATH = "/api/public/site-token";
@@ -130,5 +130,5 @@ async function mintWithRetry(rawKey, apiUrl) {
 }
 
 export { resolveClientCredential };
-//# sourceMappingURL=chunk-WIZRCI6J.mjs.map
-//# sourceMappingURL=chunk-WIZRCI6J.mjs.map
+//# sourceMappingURL=chunk-RIYAMYLV.mjs.map
+//# sourceMappingURL=chunk-RIYAMYLV.mjs.map

package/dist/{chunk-WIZRCI6J.mjs.map → chunk-RIYAMYLV.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/mint-site-token.ts"],"names":[],"mappings":";;;AA4CA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAO1B,IAAM,iBAAA,GAAoB,CAAA;AAC1B,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,mBAAA,GAAsB,GAAA;AAM5B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAO1C,IAAM,QAAA,uBAAe,GAAA,EAA6B;AAElD,IAAM,KAAA,GAAQ,CAAC,EAAA,KAAe,IAAI,OAAA,CAAc,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAOxE,SAAS,YAAA,CAAa,KAAsB,OAAA,EAAyB;AACnE,EAAA,MAAM,MAAA,GAAS,GAAA,EAAK,OAAA,EAAS,GAAA,GAAM,aAAa,CAAA;AAChD,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,OAAA,GAAU,OAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GAC9B,OAAA,GAAU,GAAA,GACV,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,GAAI,IAAA,CAAK,GAAA,EAAI;AAClC,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,EAAE,CAAA,IAAK,EAAA,GAAK,GAAG,OAAO,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,mBAAmB,CAAA;AAAA,EAC5E;AACA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,oBAAA,GAAuB,CAAA,IAAK,SAAS,mBAAmB,CAAA;AAC1E;AAGA,IAAM,iBAAA,GAAoB,CAAC,MAAA,KAAmB,MAAA,KAAW,OAAO,MAAA,IAAU,GAAA;AAM1E,SAAS,kBAAA,GAA8B;AACrC,EAAA,OACE,OAAO,OAAA,KAAY,WAAA,IACnB,OAAA,CAAQ,KAAK,yBAAA,KAA8B,KAAA;AAE/C;AAEA,SAAS,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAgB,GAAA,EAAqB;AACvE,EAAA,IAAI,oBAAmB,EAAG;AACxB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,sCAAsC,MAAM,CAAA,uMAAA;AAAA,KAG9C;AACA,IAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,0CAA0C,MAAM,CAAA,uRAAA;AAAA,GAIlD;AACF;AA8BO,SAAS,YAAA,GAAsD;AACpE,EAAA,MAAM,UAAU,UAAA,CAAW,KAAA;AAG3B,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,uCAAuC,CAAA;AACrE,EAAA,MAAM,WAAW,OAAA,CAAQ,kBAAA;AACzB,EAAA,IAAI,OAAO,aAAa,UAAA,EAAY,OAAO,EAAE,EAAA,EAAI,QAAA,EAAU,WAAW,IAAA,EAAK;AAC3E,EAAA,OAAO,EAAE,EAAA,EAAI,OAAA,EAAS,SAAA,EAAW,KAAA,EAAM;AACzC;AAYO,SAAS,kBAAkB,GAAA,EAAuB;AACvD,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AAC5C,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,sBAAA,EAAwB,OAAO,IAAA;AAChD,EAAA,IAAI,CAAA,CAAE,IAAA,KAAS,yBAAA,EAA2B,OAAO,IAAA;AACjD,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,EAAE,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,EAAG,OAAO,IAAA;AACzE,EAAA,IAAI,EAAE,QAAA,qBAAa,MAAA,CAAO,GAAA,CAAI,gBAAgB,GAAG,OAAO,IAAA;AACxD,EAAA,OAAO,KAAA;AACT;AAEA,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,UAAU,MAAA,CAAO,SAAA,GAAY,KAAK,GAAA,EAAI,SAAU,MAAA,CAAO,UAAA;AAG3D,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,SAAS,OAAO,OAAA;AAEpB,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AAC5C,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,OAAO,CAAA;AAC5B,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAA;AAAA,EACf,CAAA,SAAE;AACA,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,EACxB;AACF;AAEA,eAAe,aAAA,CAAc,QAAgB,MAAA,EAAiC;AAC5E,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI,UAAA,GAAa,eAAA;AAEjB,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,iBAAA,EAAmB,OAAA,EAAA,EAAW;AAC5D,IAAA,IAAI,GAAA,GAAuB,IAAA;AAC3B,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,EAAA,EAAI,OAAA,EAAS,SAAA,KAAc,YAAA,EAAa;AAChD,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,QACzC,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,WAAA,EAAa,MAAA;AAAA,UACb,mBAAA,EAAqB;AAAA,SACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMA,GAAI,YAAY,EAAC,GAAK,EAAE,IAAA,EAAM,EAAE,UAAA,EAAY,KAAA,EAAM,EAAE;AAAA,QACpD,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,OACP,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAI,iBAAA,CAAkB,GAAG,CAAA,EAAG,MAAM,GAAA;AAClC,MAAA,UAAA,GAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,eAAA;AAClD,MAAA,IAAI,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACnC,QAAA,MAAM,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AACvC,QAAA;AAAA,MACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,IAAK,SAAA,GAAY,GAAA,GAAQ,CAAA,EAAG,EAAA,GAAK,GAAM;AAAA,SACrE,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,UAAA,GAAa,+BAAA;AACb,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,MAAA,KAAA,CAAM,GAAA,CAAI,MAAA,EAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,WAAW,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,EAAQ,CAAA;AACxE,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,UAAA,GAAa,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAC/B,IAAA,IAAI,kBAAkB,GAAA,CAAI,MAAM,CAAA,IAAK,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACpE,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,EAAK,OAAO,CAAA;AACvC,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,GAAA,CAAI,MAAM,CAAA,cAAA,EAAiB,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA,YAAA,EACrE,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,iBAAiB,CAAA,EAAA;AAAA,OAChD;AACA,MAAA,MAAM,MAAM,KAAK,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA;AAAA,EACF;AAEA,EAAA,OAAO,UAAA,CAAW,UAAA,EAAY,MAAA,EAAQ,IAAA,CAAK,KAAK,CAAA;AAClD","file":"chunk-WIZRCI6J.mjs","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * FAILS CLOSED. If minting genuinely fails, this throws and the build fails —\n * it does NOT publish the raw key. A failed deploy is loud and recoverable; a\n * leaked project secret in public HTML is neither. The only paths that still\n * return the raw key are a 404 (an older API that predates the endpoint, an\n * expected state during rollout) and the explicit `SONOR_SITE_TOKEN_FALLBACK=raw`\n * escape hatch, for when shipping beats being blocked.\n *\n * That posture is not academic. Through 3.5.0 a throttled mint (HTTP 429)\n * returned the raw key AND cached it for 60s, so every page rendered in that\n * window shipped the secret: one real build came out with 180 of 272 prerendered\n * pages carrying it. The build \"succeeded\" and nothing downstream noticed.\n * Rate limiting is transient by definition — the fix is to wait and retry, not\n * to downgrade to publishing the key.\n *\n * Two things keep the request count low enough that throttling is rare:\n *  - a module-level memo, so a worker mints once and every page reuses the seed;\n *  - an in-flight map, because that memo is only populated AFTER the await. Next\n *    renders pages concurrently, so without coalescing the first N concurrent\n *    renders in a process all miss the cache and all fire a request — a\n *    stampede per worker, multiplied by one worker per core. That is how a\n *    single site exhausted a 60/min budget.\n *\n * SEED FRESHNESS: a static page's seed carries `iat` = build time, and the API\n * refuses to refresh a seed older than SITE_TOKEN_MAX_REFRESH_AGE_SECONDS\n * (sonor-api common/site-auth/site-token.util.ts — currently 400 days, raised\n * from 30 alongside this fix). A site not rebuilt within that window serves a\n * seed the client cannot refresh, and its forms/analytics/engage start failing\n * for new visitors. Keep that limit comfortably longer than the fleet's\n * realistic redeploy gap; marketing sites routinely go many months untouched.\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\n/**\n * Retry budget for transient failures (429 / 5xx / network). Rate limiting is\n * measured per minute, so a few seconds of backoff clears it; the whole ladder\n * costs at most ~20s once per build worker, and only when something is wrong.\n */\nconst MINT_MAX_ATTEMPTS = 4\nconst MINT_BACKOFF_BASE_MS = 500\nconst MINT_BACKOFF_CAP_MS = 8_000\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\n/**\n * Requests already in flight, keyed by raw key. The `cache` above is only\n * written after the response lands, so concurrent renders would otherwise each\n * start their own mint. See the module header.\n */\nconst inflight = new Map<string, Promise<string>>()\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\n/**\n * Honour `Retry-After` when the server sends it (delta-seconds or HTTP date),\n * otherwise exponential backoff. Capped so a misconfigured server cannot stall\n * a build indefinitely.\n */\nfunction retryDelayMs(res: Response | null, attempt: number): number {\n  const header = res?.headers?.get?.('retry-after')\n  if (header) {\n    const seconds = Number(header)\n    const ms = Number.isFinite(seconds)\n      ? seconds * 1000\n      : Date.parse(header) - Date.now()\n    if (Number.isFinite(ms) && ms > 0) return Math.min(ms, MINT_BACKOFF_CAP_MS)\n  }\n  return Math.min(MINT_BACKOFF_BASE_MS * 2 ** attempt, MINT_BACKOFF_CAP_MS)\n}\n\n/** 429 and 5xx are transient; waiting is the correct response to both. */\nconst isRetryableStatus = (status: number) => status === 429 || status >= 500\n\n/**\n * The escape hatch, for when a broken mint must not block a release. Opt-in and\n * loud: it re-enables publishing the project secret in page HTML.\n */\nfunction rawFallbackAllowed(): boolean {\n  return (\n    typeof process !== 'undefined' &&\n    process.env?.SONOR_SITE_TOKEN_FALLBACK === 'raw'\n  )\n}\n\nfunction failClosed(reason: string, rawKey: string, now: number): string {\n  if (rawFallbackAllowed()) {\n    console.warn(\n      `[SiteKitLayout] Token mint failed (${reason}) and SONOR_SITE_TOKEN_FALLBACK=raw is set; ` +\n        'injecting the RAW API KEY into page HTML. The key is publicly readable wherever ' +\n        'this page is served — unset the escape hatch once the mint is healthy.',\n    )\n    cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n    return rawKey\n  }\n  throw new Error(\n    `site-kit: could not mint a site token (${reason}). Refusing to publish the raw ` +\n      'SONOR_API_KEY in page HTML, so this build fails instead. Check that the mint ' +\n      'endpoint is reachable and the key is valid, then rebuild. To ship anyway — ' +\n      'which publishes the project secret in public HTML — set SONOR_SITE_TOKEN_FALLBACK=raw.',\n  )\n}\n\ntype FetchLike = typeof fetch\n\n/**\n * Next.js monkey-patches `globalThis.fetch` so every call participates in its\n * Data Cache and static-generation tracking. This mint must NOT participate.\n *\n * `cache: 'no-store'` marks the calling scope dynamic, so during `next build`\n * Next throws DynamicServerError *before the request goes out*. On a statically\n * prerendered route the mint therefore never ran at all — the catch below\n * swallowed the bailout and every page shipped the raw key. (Verified against\n * Next 16.2.9: the mint endpoint received zero requests for a static build.)\n *\n * The two obvious repairs are both wrong:\n *   - `next: { revalidate: N }` LOWERS the route's revalidate window\n *     (patch-fetch.js: `finalRevalidate < revalidateStore.revalidate`), quietly\n *     converting fully-static pages into ISR across the whole fleet.\n *   - `next: { revalidate: false }` keeps pages static but writes the token into\n *     the Data Cache, which hosts persist across builds — a fresh deploy could\n *     re-bake a months-old seed, which is the exact failure we're removing.\n *\n * A credential mint is not page data and has no business in the page data cache.\n * So we call the original fetch Next saves on the patched one and stay invisible\n * to the framework: no bailout, no cache entry, no effect on staticness. The\n * module-level memo above is the only cache we want — one mint per build\n * process, and a build-fresh seed on every deploy.\n *\n * @internal Exported for unit tests; not part of the package's public API.\n */\nexport function resolveFetch(): { fn: FetchLike; unpatched: boolean } {\n  const current = globalThis.fetch as\n    | (FetchLike & { _nextOriginalFetch?: FetchLike })\n    | undefined\n  if (!current) throw new Error('site-kit: global fetch is unavailable')\n  const original = current._nextOriginalFetch\n  if (typeof original === 'function') return { fn: original, unpatched: true }\n  return { fn: current, unpatched: false }\n}\n\n/**\n * Next signals \"this render must go dynamic\" by THROWING (DynamicServerError,\n * static-gen bailout, redirect/notFound digests, React's postpone). Those are\n * the framework's control flow, not a mint failure. Swallowing one makes Next\n * believe the render succeeded statically — which is precisely how the raw key\n * ended up stranded in prerendered HTML with no error anywhere. Let them\n * propagate; only real network/HTTP failures fall back to the raw key.\n *\n * @internal Exported for unit tests; not part of the package's public API.\n */\nexport function isFrameworkSignal(err: unknown): boolean {\n  if (!err || typeof err !== 'object') return false\n  const e = err as { digest?: unknown; code?: unknown; $$typeof?: unknown }\n  if (e.digest === 'DYNAMIC_SERVER_USAGE') return true\n  if (e.code === 'NEXT_STATIC_GEN_BAILOUT') return true\n  if (typeof e.digest === 'string' && e.digest.startsWith('NEXT_')) return true\n  if (e.$$typeof === Symbol.for('react.postpone')) return true\n  return false\n}\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > Date.now()) return cached.credential\n\n  // Collapse concurrent renders onto one request rather than a stampede.\n  const pending = inflight.get(rawKey)\n  if (pending) return pending\n\n  const request = mintWithRetry(rawKey, apiUrl)\n  inflight.set(rawKey, request)\n  try {\n    return await request\n  } finally {\n    inflight.delete(rawKey)\n  }\n}\n\nasync function mintWithRetry(rawKey: string, apiUrl: string): Promise<string> {\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  let lastReason = 'unknown error'\n\n  for (let attempt = 0; attempt < MINT_MAX_ATTEMPTS; attempt++) {\n    let res: Response | null = null\n    try {\n      const { fn: fetchFn, unpatched } = resolveFetch()\n      res = await fetchFn(`${base}${MINT_PATH}`, {\n        method: 'POST',\n        headers: {\n          'content-type': 'application/json',\n          'x-api-key': rawKey,\n          'x-sitekit-version': SITE_KIT_VERSION,\n        },\n        // Only meaningful on the fallback path, where a future Next stopped\n        // exposing `_nextOriginalFetch` and we're back on the patched fetch.\n        // `revalidate: false` is the one setting that neither bails out of static\n        // generation nor downgrades the route to ISR; a Data Cache entry is the\n        // lesser evil versus shipping the raw key again.\n        ...(unpatched ? {} : ({ next: { revalidate: false } } as RequestInit)),\n        signal:\n          typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n            ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n            : undefined,\n      })\n    } catch (err) {\n      // Never swallow the framework's own control flow — see isFrameworkSignal.\n      if (isFrameworkSignal(err)) throw err\n      lastReason = err instanceof Error ? err.message : 'network error'\n      if (attempt < MINT_MAX_ATTEMPTS - 1) {\n        await sleep(retryDelayMs(null, attempt))\n        continue\n      }\n      break\n    }\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: Date.now() + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n      lastReason = 'mint returned no usable token'\n      break\n    }\n\n    // 404 = an API older than the endpoint. Expected during rollout, and the raw\n    // key is exactly what such an API still expects, so this stays a fallback\n    // rather than a build failure.\n    if (res.status === 404) {\n      cache.set(rawKey, { credential: rawKey, expiresAt: Date.now() + 60_000 })\n      return rawKey\n    }\n\n    lastReason = `HTTP ${res.status}`\n    if (isRetryableStatus(res.status) && attempt < MINT_MAX_ATTEMPTS - 1) {\n      const delay = retryDelayMs(res, attempt)\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; retrying in ${Math.round(delay)}ms ` +\n          `(attempt ${attempt + 2}/${MINT_MAX_ATTEMPTS}).`,\n      )\n      await sleep(delay)\n      continue\n    }\n    break\n  }\n\n  return failClosed(lastReason, rawKey, Date.now())\n}\n"]}
+{"version":3,"sources":["../src/server/mint-site-token.ts"],"names":[],"mappings":";;;AA4CA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAO1B,IAAM,iBAAA,GAAoB,CAAA;AAC1B,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,mBAAA,GAAsB,GAAA;AAM5B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAO1C,IAAM,QAAA,uBAAe,GAAA,EAA6B;AAElD,IAAM,KAAA,GAAQ,CAAC,EAAA,KAAe,IAAI,OAAA,CAAc,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAOxE,SAAS,YAAA,CAAa,KAAsB,OAAA,EAAyB;AACnE,EAAA,MAAM,MAAA,GAAS,GAAA,EAAK,OAAA,EAAS,GAAA,GAAM,aAAa,CAAA;AAChD,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,OAAA,GAAU,OAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GAC9B,OAAA,GAAU,GAAA,GACV,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,GAAI,IAAA,CAAK,GAAA,EAAI;AAClC,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,EAAE,CAAA,IAAK,EAAA,GAAK,GAAG,OAAO,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,mBAAmB,CAAA;AAAA,EAC5E;AACA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,oBAAA,GAAuB,CAAA,IAAK,SAAS,mBAAmB,CAAA;AAC1E;AAGA,IAAM,iBAAA,GAAoB,CAAC,MAAA,KAAmB,MAAA,KAAW,OAAO,MAAA,IAAU,GAAA;AAM1E,SAAS,kBAAA,GAA8B;AACrC,EAAA,OACE,OAAO,OAAA,KAAY,WAAA,IACnB,OAAA,CAAQ,KAAK,yBAAA,KAA8B,KAAA;AAE/C;AAEA,SAAS,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAgB,GAAA,EAAqB;AACvE,EAAA,IAAI,oBAAmB,EAAG;AACxB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,sCAAsC,MAAM,CAAA,uMAAA;AAAA,KAG9C;AACA,IAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,0CAA0C,MAAM,CAAA,uRAAA;AAAA,GAIlD;AACF;AA8BO,SAAS,YAAA,GAAsD;AACpE,EAAA,MAAM,UAAU,UAAA,CAAW,KAAA;AAG3B,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,uCAAuC,CAAA;AACrE,EAAA,MAAM,WAAW,OAAA,CAAQ,kBAAA;AACzB,EAAA,IAAI,OAAO,aAAa,UAAA,EAAY,OAAO,EAAE,EAAA,EAAI,QAAA,EAAU,WAAW,IAAA,EAAK;AAC3E,EAAA,OAAO,EAAE,EAAA,EAAI,OAAA,EAAS,SAAA,EAAW,KAAA,EAAM;AACzC;AAYO,SAAS,kBAAkB,GAAA,EAAuB;AACvD,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AAC5C,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,sBAAA,EAAwB,OAAO,IAAA;AAChD,EAAA,IAAI,CAAA,CAAE,IAAA,KAAS,yBAAA,EAA2B,OAAO,IAAA;AACjD,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,EAAE,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,EAAG,OAAO,IAAA;AACzE,EAAA,IAAI,EAAE,QAAA,qBAAa,MAAA,CAAO,GAAA,CAAI,gBAAgB,GAAG,OAAO,IAAA;AACxD,EAAA,OAAO,KAAA;AACT;AAEA,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,UAAU,MAAA,CAAO,SAAA,GAAY,KAAK,GAAA,EAAI,SAAU,MAAA,CAAO,UAAA;AAG3D,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,SAAS,OAAO,OAAA;AAEpB,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AAC5C,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,OAAO,CAAA;AAC5B,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAA;AAAA,EACf,CAAA,SAAE;AACA,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,EACxB;AACF;AAEA,eAAe,aAAA,CAAc,QAAgB,MAAA,EAAiC;AAC5E,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI,UAAA,GAAa,eAAA;AAEjB,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,iBAAA,EAAmB,OAAA,EAAA,EAAW;AAC5D,IAAA,IAAI,GAAA,GAAuB,IAAA;AAC3B,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,EAAA,EAAI,OAAA,EAAS,SAAA,KAAc,YAAA,EAAa;AAChD,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,QACzC,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,WAAA,EAAa,MAAA;AAAA,UACb,mBAAA,EAAqB;AAAA,SACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMA,GAAI,YAAY,EAAC,GAAK,EAAE,IAAA,EAAM,EAAE,UAAA,EAAY,KAAA,EAAM,EAAE;AAAA,QACpD,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,OACP,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAI,iBAAA,CAAkB,GAAG,CAAA,EAAG,MAAM,GAAA;AAClC,MAAA,UAAA,GAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,eAAA;AAClD,MAAA,IAAI,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACnC,QAAA,MAAM,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AACvC,QAAA;AAAA,MACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,IAAK,SAAA,GAAY,GAAA,GAAQ,CAAA,EAAG,EAAA,GAAK,GAAM;AAAA,SACrE,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,UAAA,GAAa,+BAAA;AACb,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,MAAA,KAAA,CAAM,GAAA,CAAI,MAAA,EAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,WAAW,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,EAAQ,CAAA;AACxE,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,UAAA,GAAa,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAC/B,IAAA,IAAI,kBAAkB,GAAA,CAAI,MAAM,CAAA,IAAK,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACpE,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,EAAK,OAAO,CAAA;AACvC,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,GAAA,CAAI,MAAM,CAAA,cAAA,EAAiB,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA,YAAA,EACrE,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,iBAAiB,CAAA,EAAA;AAAA,OAChD;AACA,MAAA,MAAM,MAAM,KAAK,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA;AAAA,EACF;AAEA,EAAA,OAAO,UAAA,CAAW,UAAA,EAAY,MAAA,EAAQ,IAAA,CAAK,KAAK,CAAA;AAClD","file":"chunk-RIYAMYLV.mjs","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * FAILS CLOSED. If minting genuinely fails, this throws and the build fails —\n * it does NOT publish the raw key. A failed deploy is loud and recoverable; a\n * leaked project secret in public HTML is neither. The only paths that still\n * return the raw key are a 404 (an older API that predates the endpoint, an\n * expected state during rollout) and the explicit `SONOR_SITE_TOKEN_FALLBACK=raw`\n * escape hatch, for when shipping beats being blocked.\n *\n * That posture is not academic. Through 3.5.0 a throttled mint (HTTP 429)\n * returned the raw key AND cached it for 60s, so every page rendered in that\n * window shipped the secret: one real build came out with 180 of 272 prerendered\n * pages carrying it. The build \"succeeded\" and nothing downstream noticed.\n * Rate limiting is transient by definition — the fix is to wait and retry, not\n * to downgrade to publishing the key.\n *\n * Two things keep the request count low enough that throttling is rare:\n *  - a module-level memo, so a worker mints once and every page reuses the seed;\n *  - an in-flight map, because that memo is only populated AFTER the await. Next\n *    renders pages concurrently, so without coalescing the first N concurrent\n *    renders in a process all miss the cache and all fire a request — a\n *    stampede per worker, multiplied by one worker per core. That is how a\n *    single site exhausted a 60/min budget.\n *\n * SEED FRESHNESS: a static page's seed carries `iat` = build time, and the API\n * refuses to refresh a seed older than SITE_TOKEN_MAX_REFRESH_AGE_SECONDS\n * (sonor-api common/site-auth/site-token.util.ts — currently 400 days, raised\n * from 30 alongside this fix). A site not rebuilt within that window serves a\n * seed the client cannot refresh, and its forms/analytics/engage start failing\n * for new visitors. Keep that limit comfortably longer than the fleet's\n * realistic redeploy gap; marketing sites routinely go many months untouched.\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\n/**\n * Retry budget for transient failures (429 / 5xx / network). Rate limiting is\n * measured per minute, so a few seconds of backoff clears it; the whole ladder\n * costs at most ~20s once per build worker, and only when something is wrong.\n */\nconst MINT_MAX_ATTEMPTS = 4\nconst MINT_BACKOFF_BASE_MS = 500\nconst MINT_BACKOFF_CAP_MS = 8_000\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\n/**\n * Requests already in flight, keyed by raw key. The `cache` above is only\n * written after the response lands, so concurrent renders would otherwise each\n * start their own mint. See the module header.\n */\nconst inflight = new Map<string, Promise<string>>()\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\n/**\n * Honour `Retry-After` when the server sends it (delta-seconds or HTTP date),\n * otherwise exponential backoff. Capped so a misconfigured server cannot stall\n * a build indefinitely.\n */\nfunction retryDelayMs(res: Response | null, attempt: number): number {\n  const header = res?.headers?.get?.('retry-after')\n  if (header) {\n    const seconds = Number(header)\n    const ms = Number.isFinite(seconds)\n      ? seconds * 1000\n      : Date.parse(header) - Date.now()\n    if (Number.isFinite(ms) && ms > 0) return Math.min(ms, MINT_BACKOFF_CAP_MS)\n  }\n  return Math.min(MINT_BACKOFF_BASE_MS * 2 ** attempt, MINT_BACKOFF_CAP_MS)\n}\n\n/** 429 and 5xx are transient; waiting is the correct response to both. */\nconst isRetryableStatus = (status: number) => status === 429 || status >= 500\n\n/**\n * The escape hatch, for when a broken mint must not block a release. Opt-in and\n * loud: it re-enables publishing the project secret in page HTML.\n */\nfunction rawFallbackAllowed(): boolean {\n  return (\n    typeof process !== 'undefined' &&\n    process.env?.SONOR_SITE_TOKEN_FALLBACK === 'raw'\n  )\n}\n\nfunction failClosed(reason: string, rawKey: string, now: number): string {\n  if (rawFallbackAllowed()) {\n    console.warn(\n      `[SiteKitLayout] Token mint failed (${reason}) and SONOR_SITE_TOKEN_FALLBACK=raw is set; ` +\n        'injecting the RAW API KEY into page HTML. The key is publicly readable wherever ' +\n        'this page is served — unset the escape hatch once the mint is healthy.',\n    )\n    cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n    return rawKey\n  }\n  throw new Error(\n    `site-kit: could not mint a site token (${reason}). Refusing to publish the raw ` +\n      'SONOR_API_KEY in page HTML, so this build fails instead. Check that the mint ' +\n      'endpoint is reachable and the key is valid, then rebuild. To ship anyway — ' +\n      'which publishes the project secret in public HTML — set SONOR_SITE_TOKEN_FALLBACK=raw.',\n  )\n}\n\ntype FetchLike = typeof fetch\n\n/**\n * Next.js monkey-patches `globalThis.fetch` so every call participates in its\n * Data Cache and static-generation tracking. This mint must NOT participate.\n *\n * `cache: 'no-store'` marks the calling scope dynamic, so during `next build`\n * Next throws DynamicServerError *before the request goes out*. On a statically\n * prerendered route the mint therefore never ran at all — the catch below\n * swallowed the bailout and every page shipped the raw key. (Verified against\n * Next 16.2.9: the mint endpoint received zero requests for a static build.)\n *\n * The two obvious repairs are both wrong:\n *   - `next: { revalidate: N }` LOWERS the route's revalidate window\n *     (patch-fetch.js: `finalRevalidate < revalidateStore.revalidate`), quietly\n *     converting fully-static pages into ISR across the whole fleet.\n *   - `next: { revalidate: false }` keeps pages static but writes the token into\n *     the Data Cache, which hosts persist across builds — a fresh deploy could\n *     re-bake a months-old seed, which is the exact failure we're removing.\n *\n * A credential mint is not page data and has no business in the page data cache.\n * So we call the original fetch Next saves on the patched one and stay invisible\n * to the framework: no bailout, no cache entry, no effect on staticness. The\n * module-level memo above is the only cache we want — one mint per build\n * process, and a build-fresh seed on every deploy.\n *\n * @internal Exported for unit tests; not part of the package's public API.\n */\nexport function resolveFetch(): { fn: FetchLike; unpatched: boolean } {\n  const current = globalThis.fetch as\n    | (FetchLike & { _nextOriginalFetch?: FetchLike })\n    | undefined\n  if (!current) throw new Error('site-kit: global fetch is unavailable')\n  const original = current._nextOriginalFetch\n  if (typeof original === 'function') return { fn: original, unpatched: true }\n  return { fn: current, unpatched: false }\n}\n\n/**\n * Next signals \"this render must go dynamic\" by THROWING (DynamicServerError,\n * static-gen bailout, redirect/notFound digests, React's postpone). Those are\n * the framework's control flow, not a mint failure. Swallowing one makes Next\n * believe the render succeeded statically — which is precisely how the raw key\n * ended up stranded in prerendered HTML with no error anywhere. Let them\n * propagate; only real network/HTTP failures fall back to the raw key.\n *\n * @internal Exported for unit tests; not part of the package's public API.\n */\nexport function isFrameworkSignal(err: unknown): boolean {\n  if (!err || typeof err !== 'object') return false\n  const e = err as { digest?: unknown; code?: unknown; $$typeof?: unknown }\n  if (e.digest === 'DYNAMIC_SERVER_USAGE') return true\n  if (e.code === 'NEXT_STATIC_GEN_BAILOUT') return true\n  if (typeof e.digest === 'string' && e.digest.startsWith('NEXT_')) return true\n  if (e.$$typeof === Symbol.for('react.postpone')) return true\n  return false\n}\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > Date.now()) return cached.credential\n\n  // Collapse concurrent renders onto one request rather than a stampede.\n  const pending = inflight.get(rawKey)\n  if (pending) return pending\n\n  const request = mintWithRetry(rawKey, apiUrl)\n  inflight.set(rawKey, request)\n  try {\n    return await request\n  } finally {\n    inflight.delete(rawKey)\n  }\n}\n\nasync function mintWithRetry(rawKey: string, apiUrl: string): Promise<string> {\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  let lastReason = 'unknown error'\n\n  for (let attempt = 0; attempt < MINT_MAX_ATTEMPTS; attempt++) {\n    let res: Response | null = null\n    try {\n      const { fn: fetchFn, unpatched } = resolveFetch()\n      res = await fetchFn(`${base}${MINT_PATH}`, {\n        method: 'POST',\n        headers: {\n          'content-type': 'application/json',\n          'x-api-key': rawKey,\n          'x-sitekit-version': SITE_KIT_VERSION,\n        },\n        // Only meaningful on the fallback path, where a future Next stopped\n        // exposing `_nextOriginalFetch` and we're back on the patched fetch.\n        // `revalidate: false` is the one setting that neither bails out of static\n        // generation nor downgrades the route to ISR; a Data Cache entry is the\n        // lesser evil versus shipping the raw key again.\n        ...(unpatched ? {} : ({ next: { revalidate: false } } as RequestInit)),\n        signal:\n          typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n            ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n            : undefined,\n      })\n    } catch (err) {\n      // Never swallow the framework's own control flow — see isFrameworkSignal.\n      if (isFrameworkSignal(err)) throw err\n      lastReason = err instanceof Error ? err.message : 'network error'\n      if (attempt < MINT_MAX_ATTEMPTS - 1) {\n        await sleep(retryDelayMs(null, attempt))\n        continue\n      }\n      break\n    }\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: Date.now() + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n      lastReason = 'mint returned no usable token'\n      break\n    }\n\n    // 404 = an API older than the endpoint. Expected during rollout, and the raw\n    // key is exactly what such an API still expects, so this stays a fallback\n    // rather than a build failure.\n    if (res.status === 404) {\n      cache.set(rawKey, { credential: rawKey, expiresAt: Date.now() + 60_000 })\n      return rawKey\n    }\n\n    lastReason = `HTTP ${res.status}`\n    if (isRetryableStatus(res.status) && attempt < MINT_MAX_ATTEMPTS - 1) {\n      const delay = retryDelayMs(res, attempt)\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; retrying in ${Math.round(delay)}ms ` +\n          `(attempt ${attempt + 2}/${MINT_MAX_ATTEMPTS}).`,\n      )\n      await sleep(delay)\n      continue\n    }\n    break\n  }\n\n  return failClosed(lastReason, rawKey, Date.now())\n}\n"]}

package/dist/{chunk-SQVYLIIN.js → chunk-S4RC6VAQ.js}

@@ -3,7 +3,8 @@
 
 var chunkESP5RMB7_js = require('./chunk-ESP5RMB7.js');
 var chunkRC4WWQXR_js = require('./chunk-RC4WWQXR.js');
-var chunkQEGUI2Q2_js = require('./chunk-QEGUI2Q2.js');
+var chunk5RNAUYWE_js = require('./chunk-5RNAUYWE.js');
+var chunkOC7AO7XS_js = require('./chunk-OC7AO7XS.js');
 var React = require('react');
 var ReactDOM = require('react-dom');
 var dynamic = require('next/dynamic');
@@ -276,17 +277,15 @@ function DesignRenderer({
   )) });
 }
 var LazyChatWidget = dynamic__default.default(
-  () => import('./ChatWidget-2ZYPYIMQ.js').then((m) => ({ default: m.ChatWidget })),
+  () => import('./ChatWidget-2TQWCXWP.js').then((m) => ({ default: m.ChatWidget })),
   { ssr: false }
 );
-function getApiConfig() {
-  const isDev = typeof process !== "undefined" && process.env?.NODE_ENV === "development";
-  const defaultApiUrl = isDev && process.env?.SONOR_API_URL ? process.env.SONOR_API_URL : "https://api.sonor.io";
-  const apiUrl = typeof window !== "undefined" ? window.__SITE_KIT_API_URL__ || defaultApiUrl : defaultApiUrl;
-  const apiKey = typeof window !== "undefined" ? window.__SITE_KIT_API_KEY__ : void 0;
-  return { apiUrl, apiKey };
+function EngageWidget(props) {
+  const target = chunk5RNAUYWE_js.resolveAnalyticsTarget(props);
+  if (!target) return null;
+  return /* @__PURE__ */ jsxRuntime.jsx(AllowedEngageWidget, { ...props, ...target });
 }
-function EngageWidget({
+function AllowedEngageWidget({
   apiUrl: propApiUrl,
   apiKey: propApiKey,
   projectId: propProjectId,
@@ -303,9 +302,8 @@ function EngageWidget({
   const [chatReady, setChatReady] = React.useState(false);
   React.useEffect(() => {
     async function loadElements() {
-      const { apiUrl: globalApiUrl, apiKey: globalApiKey } = getApiConfig();
-      const apiUrl = propApiUrl || globalApiUrl;
-      const apiKey = propApiKey || globalApiKey;
+      const apiUrl = propApiUrl;
+      const apiKey = propApiKey;
       if (!apiKey) {
         if (debug) console.warn("[Engage] No API key configured");
         return;
@@ -313,7 +311,7 @@ function EngageWidget({
       const visitorId = chunkRC4WWQXR_js.getOrCreateVisitorId();
       const url = typeof window !== "undefined" ? window.location.href : "";
       try {
-        const response = await chunkQEGUI2Q2_js.sonorFetch(
+        const response = await chunkOC7AO7XS_js.sonorFetch(
           `${apiUrl.replace(/\/$/, "")}/engage/widget/elements?url=${encodeURIComponent(url)}&visitorId=${encodeURIComponent(visitorId)}`,
           {},
           { apiKey }
@@ -426,15 +424,14 @@ function EngageWidget({
       activeElements.map((elementId) => {
         const element = elements.find((e) => e.id === elementId);
         if (!element) return null;
-        const { apiUrl: globalApiUrl, apiKey: globalApiKey } = getApiConfig();
         return /* @__PURE__ */ jsxRuntime.jsx(
           EngageElementRenderer,
           {
             element,
             onDismiss: () => handleDismiss(element.id),
             zIndex,
-            apiUrl: propApiUrl || globalApiUrl,
-            apiKey: propApiKey || globalApiKey
+            apiUrl: propApiUrl,
+            apiKey: propApiKey
           },
           element.id
         );
@@ -459,7 +456,7 @@ function EngageWidget({
 function trackEngageEvent(apiUrl, apiKey, endpoint, data) {
   if (!apiKey) return;
   const visitorId = typeof localStorage !== "undefined" ? localStorage.getItem("_sk_vid") : null;
-  chunkQEGUI2Q2_js.sonorFetch(`${apiUrl.replace(/\/$/, "")}/engage/widget/${endpoint}`, {
+  chunkOC7AO7XS_js.sonorFetch(`${apiUrl.replace(/\/$/, "")}/engage/widget/${endpoint}`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({ ...data, visitorId, pageUrl: window.location.href }),
@@ -730,5 +727,5 @@ function getDeviceType() {
 
 exports.DesignRenderer = DesignRenderer;
 exports.EngageWidget = EngageWidget;
-//# sourceMappingURL=chunk-SQVYLIIN.js.map
-//# sourceMappingURL=chunk-SQVYLIIN.js.map
+//# sourceMappingURL=chunk-S4RC6VAQ.js.map
+//# sourceMappingURL=chunk-S4RC6VAQ.js.map

package/dist/chunk-S4RC6VAQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/engage/DesignRenderer.tsx","../src/engage/EngageWidget.tsx"],"names":["useState","jsx","createElement","jsxs","React","dynamic","resolveAnalyticsTarget","DEFAULT_ENGAGE_Z_INDEX","usePathname","useEffect","getOrCreateVisitorId","sonorFetch","useCallback","ReactDOM","Fragment","useRef"],"mappings":";;;;;;;;;;;;;;;;;;AA0EA,SAAS,YAAA,CACP,MAAA,EACA,IAAA,EACA,OAAA,EACA,QAAA,EACM;AACN,EAAA,IAAI,CAAC,MAAA,EAAQ,MAAA,IAAU,MAAA,CAAO,WAAW,MAAA,EAAQ;AAGjD,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,QAAA,CAAS,QAAQ,IAAI,CAAA;AAAA,EACvB;AAEA,EAAA,QAAQ,OAAO,MAAA;AAAQ,IACrB,KAAK,MAAA;AACH,MAAA,IAAI,OAAO,GAAA,EAAK;AACd,QAAA,IAAI,OAAO,MAAA,EAAQ;AACjB,UAAA,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,GAAA,EAAK,QAAA,EAAU,qBAAqB,CAAA;AAAA,QACzD,CAAA,MAAO;AACL,UAAA,MAAA,CAAO,QAAA,CAAS,OAAO,MAAA,CAAO,GAAA;AAAA,QAChC;AAAA,MACF;AACA,MAAA;AAAA,IAEF,KAAK,QAAA;AACH,MAAA,IAAI,OAAO,MAAA,EAAQ;AACjB,QAAA,MAAM,OAAA,GAAU,QAAA,CAAS,aAAA,CAAc,MAAA,CAAO,MAAM,CAAA;AACpD,QAAA,OAAA,EAAS,cAAA,CAAe,EAAE,QAAA,EAAU,QAAA,EAAU,CAAA;AAAA,MAChD;AACA,MAAA;AAAA,IAEF,KAAK,OAAA;AACH,MAAA,OAAA,IAAU;AACV,MAAA;AAAA,IAEF,KAAK,MAAA;AACH,MAAA,IAAI,OAAO,IAAA,EAAM;AACf,QAAA,SAAA,CAAU,UAAU,SAAA,CAAU,MAAA,CAAO,IAAI,CAAA,CAAE,KAAA,CAAM,QAAQ,KAAK,CAAA;AAAA,MAChE;AACA,MAAA;AAAA,IAEF,KAAK,OAAA;AACH,MAAA,IAAI,UAAU,KAAA,EAAO;AACnB,QAAA,SAAA,CAAU,KAAA,CAAM;AAAA,UACd,OAAO,QAAA,CAAS,KAAA;AAAA,UAChB,GAAA,EAAK,OAAO,QAAA,CAAS;AAAA,SACtB,CAAA,CAAE,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AAAA,MACxB;AACA,MAAA;AAAA,IAEF,KAAK,UAAA;AACH,MAAA,IAAI,OAAO,GAAA,EAAK;AACd,QAAA,MAAM,CAAA,GAAI,QAAA,CAAS,aAAA,CAAc,GAAG,CAAA;AACpC,QAAA,CAAA,CAAE,OAAO,MAAA,CAAO,GAAA;AAChB,QAAA,CAAA,CAAE,QAAA,GAAW,EAAA;AACb,QAAA,CAAA,CAAE,KAAA,EAAM;AAAA,MACV;AACA,MAAA;AASA;AAEN;AAMA,IAAM,kBAAA,GAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAW3B,SAAS,iBAAA,CAAkB,SAAA,EAAoB,KAAA,EAAgB,QAAA,EAAkC;AAC/F,EAAA,IAAI,CAAC,SAAA,IAAa,SAAA,KAAc,MAAA,SAAe,EAAC;AAEhD,EAAA,MAAM,YAAA,GAAuC;AAAA,IAC3C,MAAA,EAAQ,cAAA;AAAA,IACR,QAAA,EAAU,gBAAA;AAAA,IACV,UAAA,EAAY,kBAAA;AAAA,IACZ,WAAA,EAAa,mBAAA;AAAA,IACb,YAAA,EAAc,oBAAA;AAAA,IACd,SAAA,EAAW,iBAAA;AAAA,IACX,OAAA,EAAS,eAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACZ;AAEA,EAAA,MAAM,aAAA,GAAgB,aAAa,SAAS,CAAA;AAC5C,EAAA,IAAI,CAAC,aAAA,EAAe,OAAO,EAAC;AAE5B,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,GAAG,aAAa,CAAA,CAAA,EAAI,YAAY,GAAG,CAAA,YAAA,EAAe,SAAS,CAAC,CAAA,WAAA,CAAA;AAAA,IACvE,OAAA,EAAS;AAAA;AAAA,GACX;AACF;AAaA,SAAS,aAAa,EAAE,IAAA,EAAM,OAAA,EAAS,QAAA,EAAU,SAAQ,EAAiD;AACxG,EAAA,MAAM,CAAC,SAAA,EAAW,YAAY,CAAA,GAAIA,eAAS,KAAK,CAAA;AAChD,EAAA,MAAM,EAAE,MAAM,KAAA,GAAQ,IAAI,KAAA,GAAQ,EAAC,EAAG,QAAA,EAAS,GAAI,IAAA;AAGnD,EAAA,MAAM,aAAA,GAA+B,EAAE,GAAG,KAAA,EAAM;AAGhD,EAAA,IAAI,MAAM,SAAA,EAAW;AACnB,IAAA,MAAA,CAAO,OAAO,aAAA,EAAe,iBAAA;AAAA,MAC3B,KAAA,CAAM,SAAA;AAAA,MACN,KAAA,CAAM,cAAA;AAAA,MACN,KAAA,CAAM;AAAA,KACP,CAAA;AAAA,EACH;AAGA,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,IAAI,KAAA,CAAM,UAAA,IAAc,KAAA,CAAM,UAAA,KAAe,MAAA,EAAQ;AACnD,MAAA,aAAA,CAAc,SAAA,GAAY,CAAA,MAAA,EAAS,KAAA,CAAM,UAAU,CAAA,CAAA,CAAA;AACnD,MAAA,aAAA,CAAc,UAAA,GAAa,qBAAA;AAAA,IAC7B;AACA,IAAA,IAAI,KAAA,CAAM,WAAA,IAAe,KAAA,CAAM,WAAA,KAAgB,MAAA,EAAQ;AACrD,MAAA,MAAM,SAAA,GAAoC;AAAA,QACxC,EAAA,EAAI,+BAAA;AAAA,QACJ,EAAA,EAAI,iCAAA;AAAA,QACJ,EAAA,EAAI;AAAA,OACN;AACA,MAAA,aAAA,CAAc,SAAA,GAAY,SAAA,CAAU,KAAA,CAAM,WAAW,CAAA;AAAA,IACvD;AAAA,EACF;AAGA,EAAA,MAAM,aAAA,GAAyD;AAAA,IAC7D,YAAA,EAAc,MAAM,YAAA,CAAa,IAAI,CAAA;AAAA,IACrC,YAAA,EAAc,MAAM,YAAA,CAAa,KAAK;AAAA,GACxC;AAGA,EAAA,IAAI,MAAM,OAAA,EAAS;AACjB,IAAA,aAAA,CAAc,OAAA,GAAU,CAAC,CAAA,KAAkB;AACzC,MAAA,CAAA,CAAE,cAAA,EAAe;AACjB,MAAA,YAAA,CAAa,KAAA,CAAM,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,QAAQ,CAAA;AAAA,IACrD,CAAA;AACA,IAAA,aAAA,CAAc,MAAA,GAAS,SAAA;AAAA,EACzB;AAGA,EAAA,MAAM,gBAAA,GAAmB,QAAA,EAAU,GAAA,CAAI,CAAC,KAAA,qBACtCC,cAAA;AAAA,IAAC,YAAA;AAAA,IAAA;AAAA,MAEC,IAAA,EAAM,KAAA;AAAA,MACN,OAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KAAA;AAAA,IAJK,KAAA,CAAM;AAAA,GAMd,CAAA;AAGD,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,WAAA;AAAA,IACL,KAAK,KAAA;AAAA,IACL,KAAK,SAAA;AACH,MAAA,sCACG,KAAA,EAAA,EAAI,KAAA,EAAO,aAAA,EAAgB,GAAG,eAC5B,QAAA,EAAA,gBAAA,EACH,CAAA;AAAA,IAGJ,KAAK,MAAA;AACH,MAAA,uBACEA,cAAA,CAAC,GAAA,EAAA,EAAE,KAAA,EAAO,aAAA,EAAgB,GAAG,eAC1B,QAAA,EAAA,WAAA,CAAY,KAAA,CAAM,IAAA,EAAM,OAAO,CAAA,EAClC,CAAA;AAAA,IAGJ,KAAK,SAAA;AACH,MAAA,MAAM,UAAA,GAAa,CAAA,CAAA,EAAI,KAAA,CAAM,KAAA,IAAS,CAAC,CAAA,CAAA;AACvC,MAAA,OAAOC,mBAAA;AAAA,QACL,UAAA;AAAA,QACA,EAAE,KAAA,EAAO,aAAA,EAAe,GAAG,aAAA,EAAc;AAAA,QACzC,WAAA,CAAY,KAAA,CAAM,IAAA,EAAM,OAAO;AAAA,OACjC;AAAA,IAEF,KAAK,QAAA;AAAA,IACL,KAAK,eAAA;AAAA,IACL,KAAK,QAAA;AAAA,IACL,KAAK,WAAA;AAAA,IACL,KAAK,WAAA;AACH,MAAA,uBACED,cAAA;AAAA,QAAC,QAAA;AAAA,QAAA;AAAA,UACC,KAAA,EAAO,aAAA;AAAA,UACN,GAAG,aAAA;AAAA,UACJ,IAAA,EAAK,QAAA;AAAA,UAEJ,sBAAY,KAAA,CAAM,IAAA,IAAQ,KAAA,CAAM,KAAA,EAAO,OAAO,CAAA,IAAK;AAAA;AAAA,OACtD;AAAA,IAGJ,KAAK,OAAA;AACH,MAAA,uBACEA,cAAA;AAAA,QAAC,KAAA;AAAA,QAAA;AAAA,UACC,KAAK,KAAA,CAAM,GAAA;AAAA,UACX,GAAA,EAAK,MAAM,GAAA,IAAO,EAAA;AAAA,UAClB,KAAA,EAAO,aAAA;AAAA,UACN,GAAG;AAAA;AAAA,OACN;AAAA,IAGJ,KAAK,MAAA;AACH,MAAA,uBACEA,cAAA;AAAA,QAAC,GAAA;AAAA,QAAA;AAAA,UACC,IAAA,EAAM,MAAM,IAAA,IAAQ,GAAA;AAAA,UACpB,MAAA,EAAQ,KAAA,CAAM,MAAA,GAAS,QAAA,GAAW,MAAA;AAAA,UAClC,GAAA,EAAK,KAAA,CAAM,MAAA,GAAS,qBAAA,GAAwB,MAAA;AAAA,UAC5C,KAAA,EAAO,aAAA;AAAA,UACN,GAAG,aAAA;AAAA,UAEH,QAAA,EAAA,WAAA,CAAY,KAAA,CAAM,IAAA,EAAM,OAAO,CAAA,IAAK;AAAA;AAAA,OACvC;AAAA,IAGJ,KAAK,OAAA;AACH,MAAA,uBACEA,cAAA;AAAA,QAAC,OAAA;AAAA,QAAA;AAAA,UACC,IAAA,EAAM,MAAM,SAAA,IAAa,MAAA;AAAA,UACzB,aAAa,KAAA,CAAM,WAAA;AAAA,UACnB,KAAA,EAAO,aAAA;AAAA,UACN,GAAG;AAAA;AAAA,OACN;AAAA,IAGJ,KAAK,SAAA;AACH,MAAA,uBAAOA,cAAA,CAAC,IAAA,EAAA,EAAG,KAAA,EAAO,EAAE,MAAA,EAAQ,QAAQ,SAAA,EAAW,qCAAA,EAAuC,GAAG,aAAA,EAAc,EAAG,CAAA;AAAA,IAE5G,KAAK,QAAA;AACH,MAAA,uBAAOA,cAAA,CAAC,KAAA,EAAA,EAAI,KAAA,EAAO,EAAE,GAAG,aAAA,EAAe,KAAA,EAAO,KAAA,CAAM,KAAA,EAAO,MAAA,EAAQ,KAAA,CAAM,MAAA,EAAO,EAAG,CAAA;AAAA,IAErF,KAAK,MAAA;AAEH,MAAA,uBACEA,cAAA,CAAC,UAAK,KAAA,EAAO,aAAA,EAAgB,GAAG,aAAA,EAC7B,QAAA,EAAA,KAAA,CAAM,QAAQ,QAAA,EACjB,CAAA;AAAA,IAGJ,KAAK,WAAA;AAGH,MAAA,uBACEA,cAAA;AAAA,QAAC,KAAA;AAAA,QAAA;AAAA,UACC,KAAA,EAAO,aAAA;AAAA,UACP,oBAAkB,KAAA,CAAM,OAAA;AAAA,UACvB,GAAG,aAAA;AAAA,UAGJ,QAAA,kBAAAE,eAAA,CAAC,KAAA,EAAA,EAAI,KAAA,EAAO,EAAE,OAAA,EAAS,MAAA,EAAQ,UAAA,EAAY,gCAAA,EAAkC,YAAA,EAAc,KAAA,EAAO,SAAA,EAAW,QAAA,EAAS,EAAG,QAAA,EAAA;AAAA,YAAA,QAAA;AAAA,YAChH,MAAM,OAAA,IAAW;AAAA,WAAA,EAC1B;AAAA;AAAA,OACF;AAAA,IAGJ,KAAK,aAAA;AAAA,IACL,KAAK,WAAA;AAEH,MAAA,uBACEF,cAAA;AAAA,QAAC,KAAA;AAAA,QAAA;AAAA,UACC,KAAA,EAAO,aAAA;AAAA,UACP,wBAAsB,KAAA,CAAM,WAAA;AAAA,UAC3B,GAAG,aAAA;AAAA,UAEH,QAAA,EAAA;AAAA;AAAA,OACH;AAAA,IAGJ;AAEE,MAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,oCAAA,EAAuC,IAAI,CAAA,CAAE,CAAA;AAC1D,MAAA,sCACG,KAAA,EAAA,EAAI,KAAA,EAAO,aAAA,EAAgB,GAAG,eAC5B,QAAA,EAAA,gBAAA,EACH,CAAA;AAAA;AAGR;AAMA,SAAS,WAAA,CAAY,MAA0B,OAAA,EAAiC;AAC9E,EAAA,IAAI,CAAC,MAAM,OAAO,EAAA;AAClB,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AAGrB,EAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,0BAAA,EAA4B,CAAC,OAAO,IAAA,KAAS;AAC/D,IAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,OAAA,EAAS,IAAI,CAAA;AAC1C,IAAA,OAAO,KAAA,KAAU,MAAA,GAAY,MAAA,CAAO,KAAK,CAAA,GAAI,KAAA;AAAA,EAC/C,CAAC,CAAA;AACH;AAEA,SAAS,cAAA,CAAe,KAA0B,IAAA,EAAmB;AACnE,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,CAAE,MAAA,CAAO,CAAC,GAAA,EAAK,GAAA,KAAQ,GAAA,GAAM,GAAG,CAAA,EAAG,GAAG,CAAA;AAC7D;AAMO,SAAS,cAAA,CAAe;AAAA,EAC7B,MAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAA,EAA4C;AAE1C,EAAAG,sBAAA,CAAM,UAAU,MAAM;AACpB,IAAA,IAAI,OAAO,aAAa,WAAA,EAAa;AAErC,IAAA,MAAM,OAAA,GAAU,mCAAA;AAChB,IAAA,IAAI,CAAC,QAAA,CAAS,cAAA,CAAe,OAAO,CAAA,EAAG;AACrC,MAAA,MAAM,UAAA,GAAa,QAAA,CAAS,aAAA,CAAc,OAAO,CAAA;AACjD,MAAA,UAAA,CAAW,EAAA,GAAK,OAAA;AAChB,MAAA,UAAA,CAAW,WAAA,GAAc,kBAAA;AACzB,MAAA,QAAA,CAAS,IAAA,CAAK,YAAY,UAAU,CAAA;AAAA,IACtC;AAAA,EACF,CAAA,EAAG,EAAE,CAAA;AAGL,EAAA,MAAM,SAAA,GAA2B;AAAA,IAC/B,GAAG,MAAA,CAAO;AAAA,GACZ;AAEA,EAAA,uBACEH,cAAA,CAAC,KAAA,EAAA,EAAI,KAAA,EAAO,SAAA,EAAW,oBAAA,EAAoB,MAAA,CAAO,EAAA,EAC/C,QAAA,EAAA,MAAA,CAAO,QAAA,EAAU,GAAA,CAAI,CAAC,IAAA,qBACrBA,cAAA;AAAA,IAAC,YAAA;AAAA,IAAA;AAAA,MAEC,IAAA;AAAA,MACA,OAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KAAA;AAAA,IAJK,IAAA,CAAK;AAAA,GAMb,CAAA,EACH,CAAA;AAEJ;AC3ZA,IAAM,cAAA,GAAiBI,wBAAA;AAAA,EACrB,MAAM,OAAO,0BAAc,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,UAAA,EAAW,CAAE,CAAA;AAAA,EAClE,EAAE,KAAK,KAAA;AACT,CAAA;AAYO,SAAS,aAAa,KAAA,EAA0B;AACrD,EAAA,MAAM,MAAA,GAASC,wCAAuB,KAAK,CAAA;AAC3C,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,EAAA,uBAAOL,cAAAA,CAAC,mBAAA,EAAA,EAAqB,GAAG,KAAA,EAAQ,GAAG,MAAA,EAAQ,CAAA;AACrD;AAEA,SAAS,mBAAA,CAAoB;AAAA,EAC3B,MAAA,EAAQ,UAAA;AAAA,EACR,MAAA,EAAQ,UAAA;AAAA,EACR,SAAA,EAAW,aAAA;AAAA,EACX,QAAA,GAAW,cAAA;AAAA,EACX,YAAA;AAAA,EACA,MAAA,GAASM,uCAAA;AAAA,EACT,WAAA,GAAc,IAAA;AAAA,EACd,KAAA,GAAQ;AACV,CAAA,EAA2D;AACzD,EAAA,MAAM,WAAWC,sBAAA,EAAY;AAC7B,EAAA,MAAM,CAAC,QAAA,EAAU,WAAW,CAAA,GAAIR,cAAAA,CAA0B,EAAE,CAAA;AAC5D,EAAA,MAAM,CAAC,cAAA,EAAgB,iBAAiB,CAAA,GAAIA,cAAAA,CAAmB,EAAE,CAAA;AACjE,EAAA,MAAM,CAAC,iBAAA,EAAmB,oBAAoB,IAAIA,cAAAA,iBAAsB,IAAI,KAAK,CAAA;AACjF,EAAA,MAAM,CAAC,SAAA,EAAW,YAAY,CAAA,GAAIA,eAAS,KAAK,CAAA;AAGhD,EAAAS,eAAA,CAAU,MAAM;AACd,IAAA,eAAe,YAAA,GAAe;AAC5B,MAAA,MAAM,MAAA,GAAS,UAAA;AACf,MAAA,MAAM,MAAA,GAAS,UAAA;AAEf,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,gCAAgC,CAAA;AACxD,QAAA;AAAA,MACF;AAGA,MAAA,MAAM,YAAYC,qCAAA,EAAqB;AACvC,MAAA,MAAM,MAAM,OAAO,MAAA,KAAW,WAAA,GAAc,MAAA,CAAO,SAAS,IAAA,GAAO,EAAA;AAEnE,MAAA,IAAI;AACF,QAAA,MAAM,WAAW,MAAMC,2BAAA;AAAA,UACrB,CAAA,EAAG,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,4BAAA,EAA+B,kBAAA,CAAmB,GAAG,CAAC,CAAA,WAAA,EAAc,kBAAA,CAAmB,SAAS,CAAC,CAAA,CAAA;AAAA,UAC7H,EAAC;AAAA,UACD,EAAE,MAAA;AAAO,SACX;AAEA,QAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,UAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,kCAAA,EAAoC,SAAS,UAAU,CAAA;AAChF,UAAA;AAAA,QACF;AAEA,QAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,QAAA,MAAM,eAAe,IAAA,CAAK,IAAA,EAAM,QAAA,IAAY,IAAA,CAAK,YAAY,EAAC;AAC9D,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,2BAAA,EAA6B,YAAY,CAAA;AAChE,QAAA,WAAA,CAAY,YAAY,CAAA;AAAA,MAC1B,SAAS,KAAA,EAAO;AACd,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,kCAAA,EAAoC,KAAK,CAAA;AAAA,MACpE;AAAA,IACF;AAEA,IAAA,YAAA,EAAa;AAAA,EACf,CAAA,EAAG,CAAC,UAAA,EAAY,UAAA,EAAY,KAAK,CAAC,CAAA;AAGlC,EAAAF,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,WAAA,EAAa;AAClB,IAAA,MAAM,KACJ,OAAO,mBAAA,KAAwB,cAC3B,mBAAA,CAAoB,MAAM,aAAa,IAAI,CAAA,EAAG,EAAE,OAAA,EAAS,GAAA,EAAM,CAAA,GAC/D,UAAA,CAAW,MAAM,YAAA,CAAa,IAAI,GAAG,CAAC,CAAA;AAC5C,IAAA,OAAO,MAAM;AACX,MAAA,OAAO,uBAAuB,WAAA,GAAc,kBAAA,CAAmB,EAAY,CAAA,GAAI,aAAa,EAAE,CAAA;AAAA,IAChG,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,WAAW,CAAC,CAAA;AAGhB,EAAAA,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,SAAS,MAAA,EAAQ;AAEtB,IAAA,MAAM,YAAA,GAAe,CAAC,OAAA,KAAoC;AAExD,MAAA,IAAI,iBAAA,CAAkB,GAAA,CAAI,OAAA,CAAQ,EAAE,GAAG,OAAO,KAAA;AAG9C,MAAA,IAAI,OAAA,CAAQ,WAAW,KAAA,EAAO;AAC5B,QAAA,MAAM,EAAE,OAAA,EAAS,OAAA,EAAQ,GAAI,QAAQ,SAAA,CAAU,KAAA;AAE/C,QAAA,IAAI,OAAA,EAAS,KAAK,CAAA,CAAA,KAAK,SAAA,CAAU,UAAU,CAAC,CAAC,GAAG,OAAO,KAAA;AACvD,QAAA,IAAI,OAAA,IAAW,CAAC,OAAA,CAAQ,IAAA,CAAK,CAAA,CAAA,KAAK,UAAU,QAAA,EAAU,CAAC,CAAC,CAAA,EAAG,OAAO,KAAA;AAAA,MACpE;AAGA,MAAA,IAAI,OAAA,CAAQ,WAAW,OAAA,EAAS;AAC9B,QAAA,MAAM,SAAS,aAAA,EAAc;AAC7B,QAAA,IAAI,CAAC,OAAA,CAAQ,SAAA,CAAU,QAAQ,QAAA,CAAS,MAAM,GAAG,OAAO,KAAA;AAAA,MAC1D;AAGA,MAAA,IAAI,OAAA,CAAQ,SAAS,SAAA,EAAW;AAC9B,QAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAK,GAAI,QAAQ,OAAA,CAAQ,SAAA;AACvC,QAAA,MAAM,GAAA,GAAM,CAAA,QAAA,EAAW,OAAA,CAAQ,EAAE,CAAA,CAAA;AAEjC,QAAA,IAAI,SAAS,MAAA,EAAQ;AACnB,UAAA,IAAI,YAAA,CAAa,OAAA,CAAQ,GAAG,CAAA,EAAG,OAAO,KAAA;AAAA,QACxC,CAAA,MAAA,IAAW,SAAS,kBAAA,EAAoB;AACtC,UAAA,IAAI,cAAA,CAAe,OAAA,CAAQ,GAAG,CAAA,EAAG,OAAO,KAAA;AAAA,QAC1C,CAAA,MAAA,IAAW,IAAA,KAAS,cAAA,IAAkB,IAAA,EAAM;AAC1C,UAAA,MAAM,SAAA,GAAY,YAAA,CAAa,OAAA,CAAQ,GAAG,CAAA;AAC1C,UAAA,IAAI,SAAA,EAAW;AACb,YAAA,MAAM,UAAU,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,CAAS,WAAW,EAAE,CAAA;AACnD,YAAA,IAAI,UAAU,IAAA,GAAO,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,KAAM,OAAO,KAAA;AAAA,UACnD;AAAA,QACF;AAAA,MACF;AAEA,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAGA,IAAA,MAAM,QAAA,GAAW,QAAA,CAAS,MAAA,CAAO,YAAY,CAAA;AAE7C,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,6BAAA,EAA+B,QAAQ,CAAA;AAK9D,IAAA,MAAM,QAAA,GAAW,CAAC,EAAA,KAAe;AAC/B,MAAA,iBAAA,CAAkB,CAAA,IAAA,KAAS,IAAA,CAAK,QAAA,CAAS,EAAE,CAAA,GAAI,OAAO,CAAC,GAAG,IAAA,EAAM,EAAE,CAAE,CAAA;AAAA,IACtE,CAAA;AAKA,IAAA,MAAM,WAA8B,EAAC;AAErC,IAAA,QAAA,CAAS,QAAQ,CAAA,OAAA,KAAW;AAC1B,MAAA,MAAM,UAAU,OAAA,CAAQ,OAAA;AAExB,MAAA,IAAI,OAAA,EAAS,IAAA,KAAS,WAAA,IAAe,CAAC,SAAS,IAAA,EAAM;AACnD,QAAA,QAAA,CAAS,QAAQ,EAAE,CAAA;AAAA,MACrB,CAAA,MAAA,IAAW,OAAA,EAAS,IAAA,KAAS,OAAA,IAAW,QAAQ,KAAA,EAAO;AACrD,QAAA,MAAM,KAAA,GAAQ,WAAW,MAAM,QAAA,CAAS,QAAQ,EAAE,CAAA,EAAG,OAAA,CAAQ,KAAA,GAAQ,GAAI,CAAA;AACzE,QAAA,QAAA,CAAS,IAAA,CAAK,MAAM,YAAA,CAAa,KAAK,CAAC,CAAA;AAAA,MACzC,CAAA,MAAA,IAAW,OAAA,EAAS,IAAA,KAAS,aAAA,EAAe;AAC1C,QAAA,MAAM,gBAAA,GAAmB,CAAC,CAAA,KAAkB;AAC1C,UAAA,IAAI,CAAA,CAAE,UAAU,EAAA,EAAI;AAClB,YAAA,QAAA,CAAS,QAAQ,EAAE,CAAA;AACnB,YAAA,QAAA,CAAS,mBAAA,CAAoB,cAAc,gBAAgB,CAAA;AAAA,UAC7D;AAAA,QACF,CAAA;AACA,QAAA,QAAA,CAAS,gBAAA,CAAiB,cAAc,gBAAgB,CAAA;AACxD,QAAA,QAAA,CAAS,KAAK,MAAM,QAAA,CAAS,mBAAA,CAAoB,YAAA,EAAc,gBAAgB,CAAC,CAAA;AAAA,MAClF,CAAA,MAAA,IAAW,OAAA,EAAS,IAAA,KAAS,QAAA,IAAY,QAAQ,gBAAA,EAAkB;AACjE,QAAA,MAAM,eAAe,MAAM;AACzB,UAAA,MAAM,gBAAiB,MAAA,CAAO,OAAA,IAAW,SAAS,IAAA,CAAK,YAAA,GAAe,OAAO,WAAA,CAAA,GAAgB,GAAA;AAC7F,UAAA,IAAI,aAAA,KAAkB,OAAA,CAAQ,gBAAA,IAAoB,EAAA,CAAA,EAAK;AACrD,YAAA,QAAA,CAAS,QAAQ,EAAE,CAAA;AACnB,YAAA,MAAA,CAAO,mBAAA,CAAoB,UAAU,YAAY,CAAA;AAAA,UACnD;AAAA,QACF,CAAA;AACA,QAAA,MAAA,CAAO,iBAAiB,QAAA,EAAU,YAAA,EAAc,EAAE,OAAA,EAAS,MAAM,CAAA;AACjE,QAAA,QAAA,CAAS,KAAK,MAAM,MAAA,CAAO,mBAAA,CAAoB,QAAA,EAAU,YAAY,CAAC,CAAA;AAAA,MACxE;AAAA,IACF,CAAC,CAAA;AAED,IAAA,OAAO,MAAM;AACX,MAAA,QAAA,CAAS,OAAA,CAAQ,CAAA,EAAA,KAAM,EAAA,EAAI,CAAA;AAAA,IAC7B,CAAA;AAAA,EACF,GAAG,CAAC,QAAA,EAAU,QAAA,EAAU,iBAAA,EAAmB,KAAK,CAAC,CAAA;AAEjD,EAAA,MAAM,aAAA,GAAgBG,iBAAA,CAAY,CAAC,SAAA,KAAsB;AACvD,IAAA,oBAAA,CAAqB,CAAA,IAAA,yBAAY,GAAA,CAAI,CAAC,GAAG,IAAA,EAAM,SAAS,CAAC,CAAC,CAAA;AAC1D,IAAA,iBAAA,CAAkB,UAAQ,IAAA,CAAK,MAAA,CAAO,CAAA,EAAA,KAAM,EAAA,KAAO,SAAS,CAAC,CAAA;AAG7D,IAAA,MAAM,UAAU,QAAA,CAAS,IAAA,CAAK,CAAA,CAAA,KAAK,CAAA,CAAE,OAAO,SAAS,CAAA;AACrD,IAAA,IAAI,OAAA,EAAS,SAAS,SAAA,EAAW;AAC/B,MAAA,MAAM,GAAA,GAAM,WAAW,SAAS,CAAA,CAAA;AAChC,MAAA,IAAI,OAAA,CAAQ,OAAA,CAAQ,SAAA,CAAU,IAAA,KAAS,kBAAA,EAAoB;AACzD,QAAA,cAAA,CAAe,OAAA,CAAQ,KAAK,MAAM,CAAA;AAAA,MACpC,CAAA,MAAO;AACL,QAAA,YAAA,CAAa,QAAQ,GAAA,EAAK,IAAA,CAAK,GAAA,EAAI,CAAE,UAAU,CAAA;AAAA,MACjD;AAAA,IACF;AAAA,EACF,CAAA,EAAG,CAAC,QAAQ,CAAC,CAAA;AAKb,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA,EAAa,OAAO,IAAA;AAE5C,EAAA,OAAOC,yBAAA,CAAS,YAAA;AAAA,oBACdV,gBAAAW,mBAAA,EAAA,EACG,QAAA,EAAA;AAAA,MAAA,cAAA,CAAe,IAAI,CAAA,SAAA,KAAa;AAC/B,QAAA,MAAM,UAAU,QAAA,CAAS,IAAA,CAAK,CAAA,CAAA,KAAK,CAAA,CAAE,OAAO,SAAS,CAAA;AACrD,QAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AAErB,QAAA,uBACEb,cAAAA;AAAA,UAAC,qBAAA;AAAA,UAAA;AAAA,YAEC,OAAA;AAAA,YACA,SAAA,EAAW,MAAM,aAAA,CAAc,OAAA,CAAQ,EAAE,CAAA;AAAA,YACzC,MAAA;AAAA,YACA,MAAA,EAAQ,UAAA;AAAA,YACR,MAAA,EAAQ;AAAA,WAAA;AAAA,UALH,OAAA,CAAQ;AAAA,SAMf;AAAA,MAEJ,CAAC,CAAA;AAAA,MAGA,WAAA,IAAe,6BACdA,cAAAA;AAAA,QAAC,cAAA;AAAA,QAAA;AAAA,UACC,WAAW,aAAA,IAAiB,MAAA;AAAA,UAC5B,MAAA,EAAQ;AAAA,YACN,QAAA;AAAA,YACA,YAAA;AAAA,YACA,MAAA;AAAA,YACA,WAAA,EAAa;AAAA;AAAA;AACf;AAAA;AACF,KAAA,EAEJ,CAAA;AAAA,IACA,QAAA,CAAS;AAAA,GACX;AACF;AAMA,SAAS,gBAAA,CACP,MAAA,EACA,MAAA,EACA,QAAA,EACA,IAAA,EACA;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ;AACb,EAAA,MAAM,YAAY,OAAO,YAAA,KAAiB,cACtC,YAAA,CAAa,OAAA,CAAQ,SAAS,CAAA,GAC9B,IAAA;AACJ,EAAAU,2BAAA,CAAW,CAAA,EAAG,OAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,eAAA,EAAkB,QAAQ,CAAA,CAAA,EAAI;AAAA,IACnE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,IAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,GAAG,IAAA,EAAM,SAAA,EAAW,OAAA,EAAS,MAAA,CAAO,QAAA,CAAS,IAAA,EAAM,CAAA;AAAA,IAC1E,SAAA,EAAW;AAAA,GACb,EAAG,EAAE,MAAA,EAAQ,OAAA,EAAS,GAAG,CAAA,CAAE,MAAM,MAAM;AAAA,EAAC,CAAC,CAAA;AAC3C;AAEA,SAAS,kBAAA,CACP,MAAA,EACA,KAAA,EACA,OAAA,EACA,QACA,MAAA,EACA;AAEA,EAAA,gBAAA,CAAiB,MAAA,EAAQ,QAAQ,OAAA,EAAS;AAAA,IACxC,WAAW,OAAA,CAAQ,EAAA;AAAA,IACnB,QAAQ,MAAA,CAAO;AAAA,GAChB,CAAA;AAED,EAAA,QAAQ,OAAO,MAAA;AAAQ,IACrB,KAAK,UAAA;AACH,MAAA,IAAI,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,QAAA,CAAS,OAAO,MAAA,CAAO,GAAA;AAC9C,MAAA;AAAA,IACF,KAAK,UAAA;AACH,MAAA,IAAI,OAAO,GAAA,EAAK,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,KAAK,QAAQ,CAAA;AAChD,MAAA;AAAA,IACF,KAAK,aAAA;AAAA,IACL,KAAK,aAAA;AACH,MAAA,MAAA,CAAO,aAAA,CAAc,IAAI,WAAA,CAAY,oBAAA,EAAsB;AAAA,QACzD,MAAA,EAAQ,EAAE,MAAA,EAAQ,MAAA,CAAO,UAAU,MAAA,CAAO,GAAA,EAAK,SAAA,EAAW,OAAA,CAAQ,EAAA;AAAG,OACtE,CAAC,CAAA;AACF,MAAA;AAAA,IACF,KAAK,kBAAA;AACH,MAAA,MAAA,CAAO,aAAA,CAAc,IAAI,WAAA,CAAY,mBAAA,EAAqB;AAAA,QACxD,MAAA,EAAQ,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAQ,EAAA;AAAG,OACzC,CAAC,CAAA;AACF,MAAA;AAAA,IACF;AACE,MAAA,MAAA,CAAO,aAAA,CAAc,IAAI,WAAA,CAAY,eAAA,EAAiB;AAAA,QACpD,MAAA,EAAQ,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAQ,EAAA;AAAG,OACzC,CAAC,CAAA;AACF,MAAA;AAAA;AAEN;AAGA,SAAS,qBAAA,CAAsB;AAAA,EAC7B,OAAA;AAAA,EACA,SAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAA,EAMG;AAED,EAAA,MAAM,YAAA,GAAeI,aAAuB,IAAI,CAAA;AAChD,EAAA,MAAM,oBAAA,GAAuBA,aAAO,KAAK,CAAA;AAEzC,EAAAN,eAAA,CAAU,MAAM;AACd,IAAA,MAAM,KAAK,YAAA,CAAa,OAAA;AACxB,IAAA,IAAI,CAAC,EAAA,IAAM,oBAAA,CAAqB,OAAA,EAAS;AAEzC,IAAA,MAAM,WAAW,IAAI,oBAAA;AAAA,MACnB,CAAC,CAAC,KAAK,CAAA,KAAM;AACX,QAAA,IAAI,KAAA,CAAM,cAAA,IAAkB,CAAC,oBAAA,CAAqB,OAAA,EAAS;AACzD,UAAA,oBAAA,CAAqB,OAAA,GAAU,IAAA;AAC/B,UAAA,gBAAA,CAAiB,QAAQ,MAAA,EAAQ,YAAA,EAAc,EAAE,SAAA,EAAW,OAAA,CAAQ,IAAI,CAAA;AACxE,UAAA,QAAA,CAAS,UAAA,EAAW;AAAA,QACtB;AAAA,MACF,CAAA;AAAA,MACA,EAAE,WAAW,GAAA;AAAI,KACnB;AACA,IAAA,QAAA,CAAS,QAAQ,EAAE,CAAA;AACnB,IAAA,OAAO,MAAM,SAAS,UAAA,EAAW;AAAA,EACnC,GAAG,CAAC,MAAA,EAAQ,MAAA,EAAQ,OAAA,CAAQ,EAAE,CAAC,CAAA;AAE/B,EAAA,MAAM,QAAA,GAAWG,iBAAA;AAAA,IACf,CAAC,QAAsB,IAAA,KAAkB;AACvC,MAAA,kBAAA,CAAmB,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,MAAA,EAAQ,MAAM,CAAA;AAAA,IAC1D,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,MAAA,EAAQ,MAAM;AAAA,GAC1B;AAGA,EAAA,IAAI,QAAQ,WAAA,EAAa;AAEvB,IAAA,IAAI,OAAA,CAAQ,SAAS,OAAA,EAAS;AAC5B,MAAA,uBACEX,cAAAA;AAAA,QAAC,KAAA;AAAA,QAAA;AAAA,UACC,GAAA,EAAK,YAAA;AAAA,UACL,uBAAqB,OAAA,CAAQ,EAAA;AAAA,UAC7B,KAAA,EAAO;AAAA,YACL,QAAA,EAAU,OAAA;AAAA,YACV,GAAA,EAAK,CAAA;AAAA,YACL,IAAA,EAAM,CAAA;AAAA,YACN,KAAA,EAAO,CAAA;AAAA,YACP,MAAA,EAAQ,CAAA;AAAA,YACR,eAAA,EAAiB,iBAAA;AAAA,YACjB,OAAA,EAAS,MAAA;AAAA,YACT,UAAA,EAAY,QAAA;AAAA,YACZ,cAAA,EAAgB,QAAA;AAAA,YAChB;AAAA,WACF;AAAA,UACA,OAAA,EAAS,SAAA;AAAA,UAET,QAAA,kBAAAA,eAAC,KAAA,EAAA,EAAI,OAAA,EAAS,OAAK,CAAA,CAAE,eAAA,IACnB,QAAA,kBAAAA,cAAAA;AAAA,YAAC,cAAA;AAAA,YAAA;AAAA,cACC,QAAQ,OAAA,CAAQ,WAAA;AAAA,cAChB,OAAA,EAAS,SAAA;AAAA,cACT;AAAA;AAAA,WACF,EACF;AAAA;AAAA,OACF;AAAA,IAEJ;AAEA,IAAA,IAAI,OAAA,CAAQ,SAAS,KAAA,EAAO;AAC1B,MAAA,uBACEA,cAAAA;AAAA,QAAC,KAAA;AAAA,QAAA;AAAA,UACC,GAAA,EAAK,YAAA;AAAA,UACL,uBAAqB,OAAA,CAAQ,EAAA;AAAA,UAC7B,KAAA,EAAO;AAAA,YACL,QAAA,EAAU,OAAA;AAAA,YACV,GAAA,EAAK,CAAA;AAAA,YACL,IAAA,EAAM,CAAA;AAAA,YACN,KAAA,EAAO,CAAA;AAAA,YACP;AAAA,WACF;AAAA,UAEA,QAAA,kBAAAA,cAAAA;AAAA,YAAC,cAAA;AAAA,YAAA;AAAA,cACC,QAAQ,OAAA,CAAQ,WAAA;AAAA,cAChB,OAAA,EAAS,SAAA;AAAA,cACT;AAAA;AAAA;AACF;AAAA,OACF;AAAA,IAEJ;AAEA,IAAA,IAAI,OAAA,CAAQ,IAAA,KAAS,OAAA,IAAW,OAAA,CAAQ,SAAS,UAAA,EAAY;AAC3D,MAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,MAAA,EAAQ,QAAA,IAAY,cAAA;AAC7C,MAAA,MAAM,cAAA,GAAsD;AAAA,QAC1D,cAAA,EAAgB,EAAE,MAAA,EAAQ,EAAA,EAAI,OAAO,EAAA,EAAG;AAAA,QACxC,aAAA,EAAe,EAAE,MAAA,EAAQ,EAAA,EAAI,MAAM,EAAA,EAAG;AAAA,QACtC,WAAA,EAAa,EAAE,GAAA,EAAK,EAAA,EAAI,OAAO,EAAA,EAAG;AAAA,QAClC,UAAA,EAAY,EAAE,GAAA,EAAK,EAAA,EAAI,MAAM,EAAA;AAAG,OAClC;AAEA,MAAA,uBACEA,cAAAA;AAAA,QAAC,KAAA;AAAA,QAAA;AAAA,UACC,GAAA,EAAK,YAAA;AAAA,UACL,uBAAqB,OAAA,CAAQ,EAAA;AAAA,UAC7B,KAAA,EAAO;AAAA,YACL,QAAA,EAAU,OAAA;AAAA,YACV,MAAA;AAAA,YACA,GAAG,eAAe,QAAQ;AAAA,WAC5B;AAAA,UAEA,QAAA,kBAAAA,cAAAA;AAAA,YAAC,cAAA;AAAA,YAAA;AAAA,cACC,QAAQ,OAAA,CAAQ,WAAA;AAAA,cAChB,OAAA,EAAS,SAAA;AAAA,cACT;AAAA;AAAA;AACF;AAAA,OACF;AAAA,IAEJ;AAGA,IAAA,uBACEA,eAAC,KAAA,EAAA,EAAI,GAAA,EAAK,cAAc,qBAAA,EAAqB,OAAA,CAAQ,IACnD,QAAA,kBAAAA,cAAAA;AAAA,MAAC,cAAA;AAAA,MAAA;AAAA,QACC,QAAQ,OAAA,CAAQ,WAAA;AAAA,QAChB,OAAA,EAAS,SAAA;AAAA,QACT;AAAA;AAAA,KACF,EACF,CAAA;AAAA,EAEJ;AAGA,EAAA,IAAI,OAAA,CAAQ,SAAS,OAAA,EAAS;AAC5B,IAAA,uBACEA,cAAAA;AAAA,MAAC,KAAA;AAAA,MAAA;AAAA,QACC,KAAA,EAAO;AAAA,UACL,QAAA,EAAU,OAAA;AAAA,UACV,GAAA,EAAK,CAAA;AAAA,UACL,IAAA,EAAM,CAAA;AAAA,UACN,KAAA,EAAO,CAAA;AAAA,UACP,MAAA,EAAQ,CAAA;AAAA,UACR,eAAA,EAAiB,iBAAA;AAAA,UACjB,OAAA,EAAS,MAAA;AAAA,UACT,UAAA,EAAY,QAAA;AAAA,UACZ,cAAA,EAAgB,QAAA;AAAA,UAChB;AAAA,SACF;AAAA,QACA,OAAA,EAAS,SAAA;AAAA,QAET,QAAA,kBAAAE,eAAAA;AAAA,UAAC,KAAA;AAAA,UAAA;AAAA,YACC,KAAA,EAAO;AAAA,cACL,eAAA,EAAiB,uBAAA;AAAA,cACjB,OAAA,EAAS,EAAA;AAAA,cACT,YAAA,EAAc,CAAA;AAAA,cACd,QAAA,EAAU,GAAA;AAAA,cACV,KAAA,EAAO;AAAA,aACT;AAAA,YACA,OAAA,EAAS,CAAA,CAAA,KAAK,CAAA,CAAE,eAAA,EAAgB;AAAA,YAEhC,QAAA,EAAA;AAAA,8BAAAF,cAAAA;AAAA,gBAAC,QAAA;AAAA,gBAAA;AAAA,kBACC,OAAA,EAAS,SAAA;AAAA,kBACT,KAAA,EAAO;AAAA,oBACL,QAAA,EAAU,UAAA;AAAA,oBACV,GAAA,EAAK,CAAA;AAAA,oBACL,KAAA,EAAO,CAAA;AAAA,oBACP,UAAA,EAAY,MAAA;AAAA,oBACZ,MAAA,EAAQ,MAAA;AAAA,oBACR,QAAA,EAAU,EAAA;AAAA,oBACV,MAAA,EAAQ;AAAA,mBACV;AAAA,kBACD,QAAA,EAAA;AAAA;AAAA,eAED;AAAA,cACC,OAAA,CAAQ,QAAQ,KAAA,oBAASA,eAAC,IAAA,EAAA,EAAI,QAAA,EAAA,OAAA,CAAQ,OAAO,KAAA,EAAM,CAAA;AAAA,cACnD,OAAA,CAAQ,QAAQ,OAAA,oBAAWA,eAAC,GAAA,EAAA,EAAG,QAAA,EAAA,OAAA,CAAQ,OAAO,OAAA,EAAQ;AAAA;AAAA;AAAA;AACzD;AAAA,KACF;AAAA,EAEJ;AAGA,EAAA,IAAI,OAAA,CAAQ,SAAS,KAAA,EAAO;AAC1B,IAAA,uBACEE,eAAAA;AAAA,MAAC,KAAA;AAAA,MAAA;AAAA,QACC,KAAA,EAAO;AAAA,UACL,QAAA,EAAU,OAAA;AAAA,UACV,GAAA,EAAK,CAAA;AAAA,UACL,IAAA,EAAM,CAAA;AAAA,UACN,KAAA,EAAO,CAAA;AAAA,UACP,eAAA,EAAiB,OAAA,CAAQ,MAAA,EAAQ,eAAA,IAAmB,4BAAA;AAAA,UACpD,KAAA,EAAO,OAAA,CAAQ,MAAA,EAAQ,SAAA,IAAa,uBAAA;AAAA,UACpC,OAAA,EAAS,WAAA;AAAA,UACT,OAAA,EAAS,MAAA;AAAA,UACT,UAAA,EAAY,QAAA;AAAA,UACZ,cAAA,EAAgB,QAAA;AAAA,UAChB,GAAA,EAAK,EAAA;AAAA,UACL;AAAA,SACF;AAAA,QAEA,QAAA,EAAA;AAAA,0BAAAF,cAAAA,CAAC,MAAA,EAAA,EAAM,QAAA,EAAA,OAAA,CAAQ,MAAA,EAAQ,OAAA,EAAQ,CAAA;AAAA,0BAC/BA,cAAAA;AAAA,YAAC,QAAA;AAAA,YAAA;AAAA,cACC,OAAA,EAAS,SAAA;AAAA,cACT,KAAA,EAAO;AAAA,gBACL,UAAA,EAAY,MAAA;AAAA,gBACZ,MAAA,EAAQ,MAAA;AAAA,gBACR,KAAA,EAAO,SAAA;AAAA,gBACP,QAAA,EAAU,EAAA;AAAA,gBACV,MAAA,EAAQ;AAAA,eACV;AAAA,cACD,QAAA,EAAA;AAAA;AAAA;AAED;AAAA;AAAA,KACF;AAAA,EAEJ;AAEA,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,SAAA,CAAU,UAAkB,OAAA,EAA0B;AAC7D,EAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA,EAAG;AACzB,IAAA,OAAO,SAAS,UAAA,CAAW,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAAA,EACjD;AACA,EAAA,OAAO,QAAA,KAAa,OAAA;AACtB;AAEA,SAAS,aAAA,GAAiD;AACxD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,SAAA;AAC1C,EAAA,MAAM,KAAK,SAAA,CAAU,SAAA;AACrB,EAAA,IAAI,4BAAA,CAA6B,IAAA,CAAK,EAAE,CAAA,EAAG,OAAO,QAAA;AAClD,EAAA,IAAI,4DAAA,CAA6D,IAAA,CAAK,EAAE,CAAA,EAAG,OAAO,QAAA;AAClF,EAAA,OAAO,SAAA;AACT","file":"chunk-S4RC6VAQ.js","sourcesContent":["/**\n * @sonordev/site-kit/engage - Design Renderer\n * \n * Renders design_json from Engage Studio as React components.\n * This is the runtime renderer that converts the visual builder's\n * JSON structure into actual React elements.\n */\n\n'use client'\n\nimport React, { createElement, CSSProperties, MouseEvent, useState } from 'react'\n\n// ============================================\n// Types\n// ============================================\n\nexport interface DesignNode {\n  id: string\n  type: string\n  name: string\n  children?: DesignNode[]\n  props?: Record<string, any>\n  style?: CSSProperties\n}\n\nexport interface DesignDocument {\n  id: string\n  type: string\n  name: string\n  children: DesignNode[]\n  style?: CSSProperties\n  props?: Record<string, any>\n}\n\nexport interface DesignRendererProps {\n  design: DesignDocument\n  onClose?: () => void\n  onAction?: (action: ActionConfig, node: DesignNode) => void\n  context?: EngageContext\n}\n\nexport interface ActionConfig {\n  action: string\n  url?: string\n  newTab?: boolean\n  target?: string\n  text?: string\n  productId?: string\n  formId?: string\n}\n\nexport interface EngageContext {\n  // Site-Kit context data that can be bound to elements\n  user?: {\n    name?: string\n    email?: string\n    isLoggedIn?: boolean\n  }\n  cart?: {\n    itemCount?: number\n    total?: number\n  }\n  page?: {\n    url?: string\n    title?: string\n  }\n  // Custom data from the page\n  [key: string]: any\n}\n\n// ============================================\n// Action Handlers\n// ============================================\n\nfunction handleAction(\n  action: ActionConfig,\n  node: DesignNode,\n  onClose?: () => void,\n  onAction?: (action: ActionConfig, node: DesignNode) => void,\n): void {\n  if (!action?.action || action.action === 'none') return\n\n  // Let parent handle custom actions\n  if (onAction) {\n    onAction(action, node)\n  }\n\n  switch (action.action) {\n    case 'link':\n      if (action.url) {\n        if (action.newTab) {\n          window.open(action.url, '_blank', 'noopener,noreferrer')\n        } else {\n          window.location.href = action.url\n        }\n      }\n      break\n\n    case 'scroll':\n      if (action.target) {\n        const element = document.querySelector(action.target)\n        element?.scrollIntoView({ behavior: 'smooth' })\n      }\n      break\n\n    case 'close':\n      onClose?.()\n      break\n\n    case 'copy':\n      if (action.text) {\n        navigator.clipboard.writeText(action.text).catch(console.error)\n      }\n      break\n\n    case 'share':\n      if (navigator.share) {\n        navigator.share({\n          title: document.title,\n          url: window.location.href,\n        }).catch(console.error)\n      }\n      break\n\n    case 'download':\n      if (action.url) {\n        const a = document.createElement('a')\n        a.href = action.url\n        a.download = ''\n        a.click()\n      }\n      break\n\n    // Commerce actions - these should be handled by onAction callback\n    case 'add_to_cart':\n    case 'checkout':\n    case 'book':\n    case 'submit_form':\n    case 'open_form':\n      // Handled by parent via onAction\n      break\n  }\n}\n\n// ============================================\n// Animation Styles\n// ============================================\n\nconst animationKeyframes = `\n@keyframes engageFadeIn { from { opacity: 0; } to { opacity: 1; } }\n@keyframes engageFadeInUp { from { opacity: 0; transform: translateY(20px); } to { opacity: 1; transform: translateY(0); } }\n@keyframes engageFadeInDown { from { opacity: 0; transform: translateY(-20px); } to { opacity: 1; transform: translateY(0); } }\n@keyframes engageSlideInLeft { from { opacity: 0; transform: translateX(-20px); } to { opacity: 1; transform: translateX(0); } }\n@keyframes engageSlideInRight { from { opacity: 0; transform: translateX(20px); } to { opacity: 1; transform: translateX(0); } }\n@keyframes engageSlideInUp { from { opacity: 0; transform: translateY(100%); } to { opacity: 1; transform: translateY(0); } }\n@keyframes engageScaleIn { from { opacity: 0; transform: scale(0.9); } to { opacity: 1; transform: scale(1); } }\n@keyframes engageBounceIn { 0% { opacity: 0; transform: scale(0.3); } 50% { transform: scale(1.05); } 70% { transform: scale(0.9); } 100% { opacity: 1; transform: scale(1); } }\n`\n\nfunction getAnimationStyle(animation?: string, delay?: number, duration?: number): CSSProperties {\n  if (!animation || animation === 'none') return {}\n  \n  const animationMap: Record<string, string> = {\n    fadeIn: 'engageFadeIn',\n    fadeInUp: 'engageFadeInUp',\n    fadeInDown: 'engageFadeInDown',\n    slideInLeft: 'engageSlideInLeft',\n    slideInRight: 'engageSlideInRight',\n    slideInUp: 'engageSlideInUp',\n    scaleIn: 'engageScaleIn',\n    bounceIn: 'engageBounceIn',\n  }\n  \n  const animationName = animationMap[animation]\n  if (!animationName) return {}\n  \n  return {\n    animation: `${animationName} ${duration || 300}ms ease-out ${delay || 0}ms forwards`,\n    opacity: 0, // Start invisible, animation will show it\n  }\n}\n\n// ============================================\n// Node Renderer\n// ============================================\n\ninterface NodeRendererProps {\n  node: DesignNode\n  onClose?: () => void\n  onAction?: (action: ActionConfig, node: DesignNode) => void\n  context?: EngageContext\n}\n\nfunction NodeRenderer({ node, onClose, onAction, context }: NodeRendererProps): React.ReactElement | null {\n  const [isHovered, setIsHovered] = useState(false)\n  const { type, props = {}, style = {}, children } = node\n\n  // Build styles with hover effects\n  const computedStyle: CSSProperties = { ...style }\n  \n  // Apply animation\n  if (props.animation) {\n    Object.assign(computedStyle, getAnimationStyle(\n      props.animation,\n      props.animationDelay,\n      props.animationDuration\n    ))\n  }\n  \n  // Apply hover effects\n  if (isHovered) {\n    if (props.hoverScale && props.hoverScale !== 'none') {\n      computedStyle.transform = `scale(${props.hoverScale})`\n      computedStyle.transition = 'transform 0.2s ease'\n    }\n    if (props.hoverShadow && props.hoverShadow !== 'none') {\n      const shadowMap: Record<string, string> = {\n        sm: '0 1px 2px 0 rgb(0 0 0 / 0.05)',\n        md: '0 4px 6px -1px rgb(0 0 0 / 0.1)',\n        lg: '0 10px 15px -3px rgb(0 0 0 / 0.1)',\n      }\n      computedStyle.boxShadow = shadowMap[props.hoverShadow]\n    }\n  }\n\n  // Event handlers\n  const eventHandlers: Record<string, (e: MouseEvent) => void> = {\n    onMouseEnter: () => setIsHovered(true),\n    onMouseLeave: () => setIsHovered(false),\n  }\n  \n  // Click handler\n  if (props.onClick) {\n    eventHandlers.onClick = (e: MouseEvent) => {\n      e.preventDefault()\n      handleAction(props.onClick, node, onClose, onAction)\n    }\n    computedStyle.cursor = 'pointer'\n  }\n\n  // Render children recursively\n  const renderedChildren = children?.map((child) => (\n    <NodeRenderer\n      key={child.id}\n      node={child}\n      onClose={onClose}\n      onAction={onAction}\n      context={context}\n    />\n  ))\n\n  // Render based on type\n  switch (type) {\n    case 'Container':\n    case 'Box':\n    case 'Section':\n      return (\n        <div style={computedStyle} {...eventHandlers}>\n          {renderedChildren}\n        </div>\n      )\n\n    case 'Text':\n      return (\n        <p style={computedStyle} {...eventHandlers}>\n          {resolveText(props.text, context)}\n        </p>\n      )\n\n    case 'Heading':\n      const HeadingTag = `h${props.level || 2}` as keyof React.JSX.IntrinsicElements\n      return createElement(\n        HeadingTag,\n        { style: computedStyle, ...eventHandlers },\n        resolveText(props.text, context)\n      )\n\n    case 'Button':\n    case 'BookingButton':\n    case 'BuyNow':\n    case 'AddToCart':\n    case 'EventRSVP':\n      return (\n        <button\n          style={computedStyle}\n          {...eventHandlers}\n          type=\"button\"\n        >\n          {resolveText(props.text || props.label, context) || 'Button'}\n        </button>\n      )\n\n    case 'Image':\n      return (\n        <img\n          src={props.src}\n          alt={props.alt || ''}\n          style={computedStyle}\n          {...eventHandlers}\n        />\n      )\n\n    case 'Link':\n      return (\n        <a\n          href={props.href || '#'}\n          target={props.newTab ? '_blank' : undefined}\n          rel={props.newTab ? 'noopener noreferrer' : undefined}\n          style={computedStyle}\n          {...eventHandlers}\n        >\n          {resolveText(props.text, context) || renderedChildren}\n        </a>\n      )\n\n    case 'Input':\n      return (\n        <input\n          type={props.inputType || 'text'}\n          placeholder={props.placeholder}\n          style={computedStyle}\n          {...eventHandlers}\n        />\n      )\n\n    case 'Divider':\n      return <hr style={{ border: 'none', borderTop: '1px solid var(--sk-border, #e5e7eb)', ...computedStyle }} />\n\n    case 'Spacer':\n      return <div style={{ ...computedStyle, width: props.width, height: props.height }} />\n\n    case 'Icon':\n      // Simple emoji/text icon rendering\n      return (\n        <span style={computedStyle} {...eventHandlers}>\n          {props.icon || '★'}\n        </span>\n      )\n\n    case 'FormEmbed':\n      // For form embeds, we need to render the form from Forms module\n      // This would integrate with the ManagedForm component\n      return (\n        <div \n          style={computedStyle} \n          data-engage-form={props.form_id}\n          {...eventHandlers}\n        >\n          {/* ManagedForm would be rendered here by the parent */}\n          <div style={{ padding: '16px', background: 'var(--sk-bg-elevated, #f5f5f5)', borderRadius: '8px', textAlign: 'center' }}>\n            Form: {props.form_id || 'Not configured'}\n          </div>\n        </div>\n      )\n\n    case 'ProductCard':\n    case 'EventCard':\n      // Product/event cards need data binding from Commerce\n      return (\n        <div \n          style={computedStyle} \n          data-engage-offering={props.offering_id}\n          {...eventHandlers}\n        >\n          {renderedChildren}\n        </div>\n      )\n\n    default:\n      // Unknown type - render as div with children\n      console.warn(`[DesignRenderer] Unknown node type: ${type}`)\n      return (\n        <div style={computedStyle} {...eventHandlers}>\n          {renderedChildren}\n        </div>\n      )\n  }\n}\n\n// ============================================\n// Text Resolution (Data Bindings)\n// ============================================\n\nfunction resolveText(text: string | undefined, context?: EngageContext): string {\n  if (!text) return ''\n  if (!context) return text\n  \n  // Replace {{variable}} patterns with context values\n  return text.replace(/\\{\\{(\\w+(?:\\.\\w+)*)\\}\\}/g, (match, path) => {\n    const value = getNestedValue(context, path)\n    return value !== undefined ? String(value) : match\n  })\n}\n\nfunction getNestedValue(obj: Record<string, any>, path: string): any {\n  return path.split('.').reduce((acc, key) => acc?.[key], obj)\n}\n\n// ============================================\n// Main Component\n// ============================================\n\nexport function DesignRenderer({\n  design,\n  onClose,\n  onAction,\n  context,\n}: DesignRendererProps): React.ReactElement {\n  // Inject animation keyframes\n  React.useEffect(() => {\n    if (typeof document === 'undefined') return\n    \n    const styleId = 'engage-design-renderer-animations'\n    if (!document.getElementById(styleId)) {\n      const styleSheet = document.createElement('style')\n      styleSheet.id = styleId\n      styleSheet.textContent = animationKeyframes\n      document.head.appendChild(styleSheet)\n    }\n  }, [])\n\n  // Render the root container\n  const rootStyle: CSSProperties = {\n    ...design.style,\n  }\n\n  return (\n    <div style={rootStyle} data-engage-design={design.id}>\n      {design.children?.map((node) => (\n        <NodeRenderer\n          key={node.id}\n          node={node}\n          onClose={onClose}\n          onAction={onAction}\n          context={context}\n        />\n      ))}\n    </div>\n  )\n}\n\nexport default DesignRenderer\n","/**\n * @sonordev/site-kit/engage - Engage Widget\n * \n * Loads and renders engagement widgets (popups, nudges, bars, chat) via Portal API\n * Supports both legacy config-based rendering and new design_json from Engage Studio\n */\n\n'use client'\n\nimport React, { useEffect, useRef, useState, useCallback } from 'react'\nimport ReactDOM from 'react-dom'\nimport dynamic from 'next/dynamic'\nimport { usePathname } from 'next/navigation'\nimport type { ChatLauncherPlacement, EngageElement } from './types'\nimport { DEFAULT_ENGAGE_Z_INDEX } from './launcher-placement'\nimport { getOrCreateVisitorId } from '../shared/identity'\nimport { resolveAnalyticsTarget, type AnalyticsGateOptions } from '../shared/reporting-gate'\nimport { sonorFetch } from '../shared/sonorFetch'\nimport { DesignRenderer, type ActionConfig, type DesignDocument } from './DesignRenderer'\n\n// ChatWidget pulls react-markdown (and lazily socket.io) — keep it out of the\n// engage chunk entirely and only download it when the idle-gated `chatReady`\n// flips and the widget actually renders.\n//\n// react-markdown cannot be made an optional peer dependency: bundlers resolve\n// even a DYNAMIC import at build time, so a site without it installed fails\n// with \"Module not found\" before any runtime fallback can catch it. Verified\n// against Next 16 / Turbopack, 2026-08-14. See CHANGELOG 4.0.3.\nconst LazyChatWidget = dynamic(\n  () => import('./ChatWidget').then(m => ({ default: m.ChatWidget })),\n  { ssr: false },\n)\n\ninterface EngageWidgetProps extends ChatLauncherPlacement, AnalyticsGateOptions {\n  apiUrl?: string\n  apiKey?: string\n  projectId?: string\n  chatEnabled?: boolean\n  debug?: boolean\n}\n\n// Gate before mounting any effects, element telemetry, or the chat transport.\n// Standalone use and SiteKitLayout share the analytics send decision.\nexport function EngageWidget(props: EngageWidgetProps) {\n  const target = resolveAnalyticsTarget(props)\n  if (!target) return null\n  return <AllowedEngageWidget {...props} {...target} />\n}\n\nfunction AllowedEngageWidget({\n  apiUrl: propApiUrl,\n  apiKey: propApiKey,\n  projectId: propProjectId,\n  position = 'bottom-right',\n  offsetBottom,\n  zIndex = DEFAULT_ENGAGE_Z_INDEX,\n  chatEnabled = true,\n  debug = false,\n}: EngageWidgetProps & { apiUrl: string; apiKey: string }) {\n  const pathname = usePathname()\n  const [elements, setElements] = useState<EngageElement[]>([])\n  const [activeElements, setActiveElements] = useState<string[]>([])\n  const [dismissedElements, setDismissedElements] = useState<Set<string>>(new Set())\n  const [chatReady, setChatReady] = useState(false)\n  \n  // Load elements from API (GET /engage/widget/elements)\n  useEffect(() => {\n    async function loadElements() {\n      const apiUrl = propApiUrl\n      const apiKey = propApiKey\n      \n      if (!apiKey) {\n        if (debug) console.warn('[Engage] No API key configured')\n        return\n      }\n      \n      // Shared identity (_sk_vid) — same visitor ID as Analytics & Signal\n      const visitorId = getOrCreateVisitorId()\n      const url = typeof window !== 'undefined' ? window.location.href : ''\n      \n      try {\n        const response = await sonorFetch(\n          `${apiUrl.replace(/\\/$/, '')}/engage/widget/elements?url=${encodeURIComponent(url)}&visitorId=${encodeURIComponent(visitorId)}`,\n          {},\n          { apiKey },\n        )\n        \n        if (!response.ok) {\n          if (debug) console.error('[Engage] Error loading elements:', response.statusText)\n          return\n        }\n        \n        const json = await response.json()\n        const elementsList = json.data?.elements ?? json.elements ?? []\n        if (debug) console.log('[Engage] Loaded elements:', elementsList)\n        setElements(elementsList)\n      } catch (error) {\n        if (debug) console.error('[Engage] Error loading elements:', error)\n      }\n    }\n    \n    loadElements()\n  }, [propApiUrl, propApiKey, debug])\n\n  // Defer ChatWidget until the browser is idle (reduces main-thread blocking)\n  useEffect(() => {\n    if (!chatEnabled) return\n    const id =\n      typeof requestIdleCallback !== 'undefined'\n        ? requestIdleCallback(() => setChatReady(true), { timeout: 3000 })\n        : setTimeout(() => setChatReady(true), 1)\n    return () => {\n      typeof cancelIdleCallback !== 'undefined' ? cancelIdleCallback(id as number) : clearTimeout(id)\n    }\n  }, [chatEnabled])\n  \n  // Check targeting and trigger for each element\n  useEffect(() => {\n    if (!elements.length) return\n    \n    const checkElement = (element: EngageElement): boolean => {\n      // Check if dismissed\n      if (dismissedElements.has(element.id)) return false\n      \n      // Check page targeting\n      if (element.targeting?.pages) {\n        const { include, exclude } = element.targeting.pages\n        \n        if (exclude?.some(p => matchPath(pathname, p))) return false\n        if (include && !include.some(p => matchPath(pathname, p))) return false\n      }\n      \n      // Check device targeting\n      if (element.targeting?.devices) {\n        const device = getDeviceType()\n        if (!element.targeting.devices.includes(device)) return false\n      }\n      \n      // Check frequency capping\n      if (element.trigger?.frequency) {\n        const { type, days } = element.trigger.frequency\n        const key = `_engage_${element.id}`\n        \n        if (type === 'once') {\n          if (localStorage.getItem(key)) return false\n        } else if (type === 'once-per-session') {\n          if (sessionStorage.getItem(key)) return false\n        } else if (type === 'every-n-days' && days) {\n          const lastShown = localStorage.getItem(key)\n          if (lastShown) {\n            const elapsed = Date.now() - parseInt(lastShown, 10)\n            if (elapsed < days * 24 * 60 * 60 * 1000) return false\n          }\n        }\n      }\n      \n      return true\n    }\n    \n    // Filter elements that pass targeting\n    const eligible = elements.filter(checkElement)\n\n    if (debug) console.log('[Engage] Eligible elements:', eligible)\n\n    // Dedupe on add: this effect re-runs when dismissedElements changes, so a\n    // still-eligible immediate element would otherwise be pushed again\n    // (duplicate ids → duplicate keys → double render).\n    const activate = (id: string) => {\n      setActiveElements(prev => (prev.includes(id) ? prev : [...prev, id]))\n    }\n\n    // Every timer/listener registered here is torn down on cleanup — the old\n    // version leaked delay timeouts and exit-intent/scroll listeners on each\n    // effect re-run and on unmount.\n    const cleanups: Array<() => void> = []\n\n    eligible.forEach(element => {\n      const trigger = element.trigger\n\n      if (trigger?.type === 'immediate' || !trigger?.type) {\n        activate(element.id)\n      } else if (trigger?.type === 'delay' && trigger.delay) {\n        const timer = setTimeout(() => activate(element.id), trigger.delay * 1000)\n        cleanups.push(() => clearTimeout(timer))\n      } else if (trigger?.type === 'exit-intent') {\n        const handleMouseLeave = (e: MouseEvent) => {\n          if (e.clientY < 10) {\n            activate(element.id)\n            document.removeEventListener('mouseleave', handleMouseLeave)\n          }\n        }\n        document.addEventListener('mouseleave', handleMouseLeave)\n        cleanups.push(() => document.removeEventListener('mouseleave', handleMouseLeave))\n      } else if (trigger?.type === 'scroll' && trigger.scrollPercentage) {\n        const handleScroll = () => {\n          const scrollPercent = (window.scrollY / (document.body.scrollHeight - window.innerHeight)) * 100\n          if (scrollPercent >= (trigger.scrollPercentage || 50)) {\n            activate(element.id)\n            window.removeEventListener('scroll', handleScroll)\n          }\n        }\n        window.addEventListener('scroll', handleScroll, { passive: true })\n        cleanups.push(() => window.removeEventListener('scroll', handleScroll))\n      }\n    })\n\n    return () => {\n      cleanups.forEach(fn => fn())\n    }\n  }, [elements, pathname, dismissedElements, debug])\n  \n  const handleDismiss = useCallback((elementId: string) => {\n    setDismissedElements(prev => new Set([...prev, elementId]))\n    setActiveElements(prev => prev.filter(id => id !== elementId))\n    \n    // Record dismissal in storage\n    const element = elements.find(e => e.id === elementId)\n    if (element?.trigger?.frequency) {\n      const key = `_engage_${elementId}`\n      if (element.trigger.frequency.type === 'once-per-session') {\n        sessionStorage.setItem(key, 'true')\n      } else {\n        localStorage.setItem(key, Date.now().toString())\n      }\n    }\n  }, [elements])\n  \n  // Render active elements + chat widget\n  // Use portal to document.body so widgets always land inside <body>,\n  // even when SiteKitLayout wraps <body> (common in root layouts)\n  if (typeof document === 'undefined') return null\n\n  return ReactDOM.createPortal(\n    <>\n      {activeElements.map(elementId => {\n        const element = elements.find(e => e.id === elementId)\n        if (!element) return null\n\n        return (\n          <EngageElementRenderer\n            key={element.id}\n            element={element}\n            onDismiss={() => handleDismiss(element.id)}\n            zIndex={zIndex}\n            apiUrl={propApiUrl}\n            apiKey={propApiKey}\n          />\n        )\n      })}\n\n      {/* Chat Widget - deferred until idle; chunk downloads on first render */}\n      {chatEnabled && chatReady && (\n        <LazyChatWidget\n          projectId={propProjectId ?? undefined}\n          config={{\n            position,\n            offsetBottom,\n            zIndex,\n            buttonColor: '#2563eb', // Default blue-600 (AA on white), overridden by --sk-primary CSS var or API brand_primary\n          }}\n        />\n      )}\n    </>,\n    document.body,\n  )\n}\n\n// ============================================\n// Action Handler + Tracking\n// ============================================\n\nfunction trackEngageEvent(\n  apiUrl: string,\n  apiKey: string | undefined,\n  endpoint: 'impression' | 'click',\n  data: Record<string, unknown>\n) {\n  if (!apiKey) return\n  const visitorId = typeof localStorage !== 'undefined'\n    ? localStorage.getItem('_sk_vid')\n    : null\n  sonorFetch(`${apiUrl.replace(/\\/$/, '')}/engage/widget/${endpoint}`, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({ ...data, visitorId, pageUrl: window.location.href }),\n    keepalive: true,\n  }, { apiKey, retries: 0 }).catch(() => {})\n}\n\nfunction handleEngageAction(\n  action: ActionConfig,\n  _node: unknown,\n  element: EngageElement,\n  apiUrl: string,\n  apiKey: string | undefined\n) {\n  // Track click\n  trackEngageEvent(apiUrl, apiKey, 'click', {\n    elementId: element.id,\n    action: action.action,\n  })\n\n  switch (action.action) {\n    case 'navigate':\n      if (action.url) window.location.href = action.url\n      break\n    case 'open-url':\n      if (action.url) window.open(action.url, '_blank')\n      break\n    case 'submit-form':\n    case 'submit_form':\n      window.dispatchEvent(new CustomEvent('engage:submit-form', {\n        detail: { formId: action.formId || action.url, elementId: element.id },\n      }))\n      break\n    case 'track-conversion':\n      window.dispatchEvent(new CustomEvent('engage:conversion', {\n        detail: { action, elementId: element.id },\n      }))\n      break\n    default:\n      window.dispatchEvent(new CustomEvent('engage:action', {\n        detail: { action, elementId: element.id },\n      }))\n      break\n  }\n}\n\n// Helper components\nfunction EngageElementRenderer({\n  element,\n  onDismiss,\n  zIndex,\n  apiUrl,\n  apiKey,\n}: {\n  element: EngageElement\n  onDismiss: () => void\n  zIndex: number\n  apiUrl: string\n  apiKey: string | undefined\n}) {\n  // Impression tracking via IntersectionObserver\n  const containerRef = useRef<HTMLDivElement>(null)\n  const impressionTrackedRef = useRef(false)\n\n  useEffect(() => {\n    const el = containerRef.current\n    if (!el || impressionTrackedRef.current) return\n\n    const observer = new IntersectionObserver(\n      ([entry]) => {\n        if (entry.isIntersecting && !impressionTrackedRef.current) {\n          impressionTrackedRef.current = true\n          trackEngageEvent(apiUrl, apiKey, 'impression', { elementId: element.id })\n          observer.disconnect()\n        }\n      },\n      { threshold: 0.5 }\n    )\n    observer.observe(el)\n    return () => observer.disconnect()\n  }, [apiUrl, apiKey, element.id])\n\n  const onAction = useCallback(\n    (action: ActionConfig, node: unknown) => {\n      handleEngageAction(action, node, element, apiUrl, apiKey)\n    },\n    [element, apiUrl, apiKey]\n  )\n\n  // If element has design_json from Engage Studio, use DesignRenderer\n  if (element.design_json) {\n    // Wrap in appropriate container based on element type\n    if (element.type === 'popup') {\n      return (\n        <div\n          ref={containerRef}\n          data-engage-element={element.id}\n          style={{\n            position: 'fixed',\n            top: 0,\n            left: 0,\n            right: 0,\n            bottom: 0,\n            backgroundColor: 'rgba(0,0,0,0.5)',\n            display: 'flex',\n            alignItems: 'center',\n            justifyContent: 'center',\n            zIndex,\n          }}\n          onClick={onDismiss}\n        >\n          <div onClick={e => e.stopPropagation()}>\n            <DesignRenderer\n              design={element.design_json}\n              onClose={onDismiss}\n              onAction={onAction}\n            />\n          </div>\n        </div>\n      )\n    }\n\n    if (element.type === 'bar') {\n      return (\n        <div\n          ref={containerRef}\n          data-engage-element={element.id}\n          style={{\n            position: 'fixed',\n            top: 0,\n            left: 0,\n            right: 0,\n            zIndex,\n          }}\n        >\n          <DesignRenderer\n            design={element.design_json}\n            onClose={onDismiss}\n            onAction={onAction}\n          />\n        </div>\n      )\n    }\n\n    if (element.type === 'nudge' || element.type === 'slide-in') {\n      const position = element.config?.position || 'bottom-right'\n      const positionStyles: Record<string, React.CSSProperties> = {\n        'bottom-right': { bottom: 20, right: 20 },\n        'bottom-left': { bottom: 20, left: 20 },\n        'top-right': { top: 20, right: 20 },\n        'top-left': { top: 20, left: 20 },\n      }\n\n      return (\n        <div\n          ref={containerRef}\n          data-engage-element={element.id}\n          style={{\n            position: 'fixed',\n            zIndex,\n            ...positionStyles[position],\n          }}\n        >\n          <DesignRenderer\n            design={element.design_json}\n            onClose={onDismiss}\n            onAction={onAction}\n          />\n        </div>\n      )\n    }\n\n    // Default: render design_json directly\n    return (\n      <div ref={containerRef} data-engage-element={element.id}>\n        <DesignRenderer\n          design={element.design_json}\n          onClose={onDismiss}\n          onAction={onAction}\n        />\n      </div>\n    )\n  }\n\n  // Legacy: Simple popup rendering for elements without design_json\n  if (element.type === 'popup') {\n    return (\n      <div\n        style={{\n          position: 'fixed',\n          top: 0,\n          left: 0,\n          right: 0,\n          bottom: 0,\n          backgroundColor: 'rgba(0,0,0,0.5)',\n          display: 'flex',\n          alignItems: 'center',\n          justifyContent: 'center',\n          zIndex,\n        }}\n        onClick={onDismiss}\n      >\n        <div\n          style={{\n            backgroundColor: 'var(--sk-bg, #ffffff)',\n            padding: 24,\n            borderRadius: 8,\n            maxWidth: 500,\n            width: '90%',\n          }}\n          onClick={e => e.stopPropagation()}\n        >\n          <button\n            onClick={onDismiss}\n            style={{\n              position: 'absolute',\n              top: 8,\n              right: 8,\n              background: 'none',\n              border: 'none',\n              fontSize: 24,\n              cursor: 'pointer',\n            }}\n          >\n            ×\n          </button>\n          {element.config?.title && <h2>{element.config.title}</h2>}\n          {element.config?.message && <p>{element.config.message}</p>}\n        </div>\n      </div>\n    )\n  }\n  \n  // Bar/banner rendering\n  if (element.type === 'bar') {\n    return (\n      <div\n        style={{\n          position: 'fixed',\n          top: 0,\n          left: 0,\n          right: 0,\n          backgroundColor: element.config?.backgroundColor || 'var(--sk-primary, #2563eb)',\n          color: element.config?.textColor || 'var(--sk-bg, #ffffff)',\n          padding: '12px 24px',\n          display: 'flex',\n          alignItems: 'center',\n          justifyContent: 'center',\n          gap: 16,\n          zIndex,\n        }}\n      >\n        <span>{element.config?.message}</span>\n        <button\n          onClick={onDismiss}\n          style={{\n            background: 'none',\n            border: 'none',\n            color: 'inherit',\n            fontSize: 20,\n            cursor: 'pointer',\n          }}\n        >\n          ×\n        </button>\n      </div>\n    )\n  }\n  \n  return null\n}\n\n// Utilities\nfunction matchPath(pathname: string, pattern: string): boolean {\n  if (pattern.endsWith('*')) {\n    return pathname.startsWith(pattern.slice(0, -1))\n  }\n  return pathname === pattern\n}\n\nfunction getDeviceType(): 'desktop' | 'mobile' | 'tablet' {\n  if (typeof window === 'undefined') return 'desktop'\n  const ua = navigator.userAgent\n  if (/tablet|ipad|playbook|silk/i.test(ua)) return 'tablet'\n  if (/mobile|iphone|ipod|android|blackberry|opera mini|iemobile/i.test(ua)) return 'mobile'\n  return 'desktop'\n}\n"]}

package/dist/{chunk-Z6S4MWSR.js → chunk-SYGGZZMU.js}

@@ -3,8 +3,9 @@
 
 var chunkQ2NBD54V_js = require('./chunk-Q2NBD54V.js');
 var chunkHGNSJXWT_js = require('./chunk-HGNSJXWT.js');
-var chunkQEGUI2Q2_js = require('./chunk-QEGUI2Q2.js');
-var chunkSUZ3ZLB2_js = require('./chunk-SUZ3ZLB2.js');
+var chunk5RNAUYWE_js = require('./chunk-5RNAUYWE.js');
+var chunkOC7AO7XS_js = require('./chunk-OC7AO7XS.js');
+var chunkKSL3WA2I_js = require('./chunk-KSL3WA2I.js');
 var react = require('react');
 
 // src/fleet/heartbeat.ts
@@ -17,25 +18,24 @@ function detectNextVersion() {
 async function sendFleetHeartbeat(opts) {
   const { apiUrl, apiKey } = opts;
   if (!apiUrl || !apiKey) return false;
+  const target = chunk5RNAUYWE_js.resolveAnalyticsTarget(opts);
+  if (!target) return false;
   const payload = chunkQ2NBD54V_js.buildFleetHeartbeatPayload({
-    kitVersion: opts.kitVersion || chunkSUZ3ZLB2_js.SITE_KIT_VERSION,
+    kitVersion: opts.kitVersion || chunkKSL3WA2I_js.SITE_KIT_VERSION,
     nextVersion: opts.nextVersion,
     modules: opts.modules,
     site: opts.site,
     source: opts.source
   });
   try {
-    const res = await chunkQEGUI2Q2_js.sonorFetch(
-      `${apiUrl.replace(/\/$/, "")}${FLEET_HEARTBEAT_PATH}`,
+    const res = await chunkOC7AO7XS_js.sonorFetch(
+      `${target.apiUrl.replace(/\/$/, "")}${FLEET_HEARTBEAT_PATH}`,
       {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify(payload)
       },
-      // retries: 0 — the once-per-session guard already bounds volume, and a
-      // missed heartbeat is harmless (the next page load or passive
-      // x-sitekit-version capture re-registers the site).
-      { apiKey, retries: 0 }
+      { apiKey: target.apiKey, retries: 0 }
     );
     if (opts.debug) {
       console.info(
@@ -57,7 +57,9 @@ function FleetHeartbeat({
   nextVersion,
   defer = true,
   oncePerSession = true,
-  debug = false
+  debug = false,
+  allowInFrame = false,
+  allowLocalhost = false
 }) {
   const ready = chunkHGNSJXWT_js.useDeferredActivation(defer);
   const sentRef = react.useRef(false);
@@ -65,12 +67,12 @@ function FleetHeartbeat({
     if (!ready || sentRef.current) return;
     if (typeof window === "undefined") return;
     const w = window;
-    const url = apiUrl || w.__SITE_KIT_API_URL__ || "https://api.sonor.io";
-    const key = apiKey || w.__SITE_KIT_API_KEY__;
-    if (!key) return;
+    const target = chunk5RNAUYWE_js.resolveAnalyticsTarget({ apiUrl, apiKey, allowInFrame, allowLocalhost, debug });
+    if (!target) return;
+    const { apiUrl: url, apiKey: key } = target;
     const resolvedSite = site ?? w.__SITE_KIT_SITE__ ?? window.location.host ?? "";
     if (oncePerSession) {
-      const stamp = `${chunkSUZ3ZLB2_js.SITE_KIT_VERSION}:${resolvedSite}`;
+      const stamp = `${chunkKSL3WA2I_js.SITE_KIT_VERSION}:${resolvedSite}`;
       try {
         if (sessionStorage.getItem(SESSION_GUARD_KEY) === stamp) {
           sentRef.current = true;
@@ -88,9 +90,11 @@ function FleetHeartbeat({
       modules,
       nextVersion: nextVersion ?? detectNextVersion(),
       source: "client",
+      allowInFrame,
+      allowLocalhost,
       debug
     });
-  }, [ready, apiUrl, apiKey, site, modules, nextVersion, oncePerSession, debug]);
+  }, [ready, apiUrl, apiKey, site, modules, nextVersion, oncePerSession, debug, allowInFrame, allowLocalhost]);
   return null;
 }
 
@@ -98,5 +102,5 @@ exports.FLEET_HEARTBEAT_PATH = FLEET_HEARTBEAT_PATH;
 exports.FleetHeartbeat = FleetHeartbeat;
 exports.detectNextVersion = detectNextVersion;
 exports.sendFleetHeartbeat = sendFleetHeartbeat;
-//# sourceMappingURL=chunk-Z6S4MWSR.js.map
-//# sourceMappingURL=chunk-Z6S4MWSR.js.map
+//# sourceMappingURL=chunk-SYGGZZMU.js.map
+//# sourceMappingURL=chunk-SYGGZZMU.js.map

package/dist/chunk-SYGGZZMU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/fleet/heartbeat.ts","../src/fleet/FleetHeartbeat.tsx"],"names":["sanitizeFleetVersion","resolveAnalyticsTarget","buildFleetHeartbeatPayload","SITE_KIT_VERSION","sonorFetch","useDeferredActivation","useRef","useEffect"],"mappings":";;;;;;;;;;AAwBO,IAAM,oBAAA,GAAuB;AA4B7B,SAAS,iBAAA,GAAmC;AACjD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,MAAM,CAAA,GAAI,MAAA;AAIV,EAAA,OAAOA,sCAAqB,CAAA,CAAE,yBAAA,IAA6B,CAAA,CAAE,IAAA,EAAM,WAAW,IAAI,CAAA;AACpF;AAOA,eAAsB,mBAAmB,IAAA,EAAmD;AAC1F,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,IAAA;AAC3B,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,MAAA,EAAQ,OAAO,KAAA;AAC/B,EAAA,MAAM,MAAA,GAASC,wCAAuB,IAAI,CAAA;AAC1C,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AAEpB,EAAA,MAAM,UAAiCC,2CAAA,CAA2B;AAAA,IAChE,UAAA,EAAY,KAAK,UAAA,IAAcC,iCAAA;AAAA,IAC/B,aAAa,IAAA,CAAK,WAAA;AAAA,IAClB,SAAS,IAAA,CAAK,OAAA;AAAA,IACd,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,QAAQ,IAAA,CAAK;AAAA,GACd,CAAA;AAED,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAMC,2BAAA;AAAA,MAChB,CAAA,EAAG,OAAO,MAAA,CAAO,OAAA,CAAQ,OAAO,EAAE,CAAC,GAAG,oBAAoB,CAAA,CAAA;AAAA,MAC1D;AAAA,QACE,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,QAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAO;AAAA,OAC9B;AAAA,MACA,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAQ,SAAS,CAAA;AAAE,KACtC;AACA,IAAA,IAAI,KAAK,KAAA,EAAO;AAEd,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,wBAAA,EAA2B,GAAA,CAAI,MAAM,CAAA,EAAA,EAAK,OAAA,CAAQ,WAAW,CAAA,EAAA,EAAK,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA,IAAK,MAAM,CAAA,CAAA;AAAA,OACvG;AAAA,IACF;AACA,IAAA,OAAO,GAAA,CAAI,EAAA;AAAA,EACb,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,IAAA,CAAK,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,6CAA6C,GAAG,CAAA;AAC7E,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AC3EA,IAAM,iBAAA,GAAoB,cAAA;AAuBnB,SAAS,cAAA,CAAe;AAAA,EAC7B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,IAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,KAAA,GAAQ,IAAA;AAAA,EACR,cAAA,GAAiB,IAAA;AAAA,EACjB,KAAA,GAAQ,KAAA;AAAA,EACR,YAAA,GAAe,KAAA;AAAA,EACf,cAAA,GAAiB;AACnB,CAAA,EAAwB;AACtB,EAAA,MAAM,KAAA,GAAQC,uCAAsB,KAAK,CAAA;AACzC,EAAA,MAAM,OAAA,GAAUC,aAAO,KAAK,CAAA;AAE5B,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,KAAA,IAAS,OAAA,CAAQ,OAAA,EAAS;AAC/B,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAEnC,IAAA,MAAM,CAAA,GAAI,MAAA;AAKV,IAAA,MAAM,MAAA,GAASN,wCAAuB,EAAE,MAAA,EAAQ,QAAQ,YAAA,EAAc,cAAA,EAAgB,OAAO,CAAA;AAC7F,IAAA,IAAI,CAAC,MAAA,EAAQ;AACb,IAAA,MAAM,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAA,EAAQ,KAAI,GAAI,MAAA;AAErC,IAAA,MAAM,eAAe,IAAA,IAAQ,CAAA,CAAE,iBAAA,IAAqB,MAAA,CAAO,SAAS,IAAA,IAAQ,EAAA;AAK5E,IAAA,IAAI,cAAA,EAAgB;AAClB,MAAA,MAAM,KAAA,GAAQ,CAAA,EAAGE,iCAAgB,CAAA,CAAA,EAAI,YAAY,CAAA,CAAA;AACjD,MAAA,IAAI;AACF,QAAA,IAAI,cAAA,CAAe,OAAA,CAAQ,iBAAiB,CAAA,KAAM,KAAA,EAAO;AACvD,UAAA,OAAA,CAAQ,OAAA,GAAU,IAAA;AAClB,UAAA;AAAA,QACF;AACA,QAAA,cAAA,CAAe,OAAA,CAAQ,mBAAmB,KAAK,CAAA;AAAA,MACjD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAEA,IAAA,OAAA,CAAQ,OAAA,GAAU,IAAA;AAClB,IAAA,KAAK,kBAAA,CAAmB;AAAA,MACtB,MAAA,EAAQ,GAAA;AAAA,MACR,MAAA,EAAQ,GAAA;AAAA,MACR,IAAA,EAAM,YAAA;AAAA,MACN,OAAA;AAAA,MACA,WAAA,EAAa,eAAe,iBAAA,EAAkB;AAAA,MAC9C,MAAA,EAAQ,QAAA;AAAA,MACR,YAAA;AAAA,MACA,cAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH,CAAA,EAAG,CAAC,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,WAAA,EAAa,cAAA,EAAgB,KAAA,EAAO,YAAA,EAAc,cAAc,CAAC,CAAA;AAE3G,EAAA,OAAO,IAAA;AACT","file":"chunk-SYGGZZMU.js","sourcesContent":["/**\n * @sonordev/site-kit/fleet — heartbeat sender (single source of truth for the POST)\n *\n * One place that turns fleet inputs into a validated payload and ships it to\n * `/api/public/fleet/heartbeat`. Used by BOTH the client component\n * (FleetHeartbeat) and any build-time caller, so the send path never forks.\n *\n * It routes through the shared analytics send gate and `sonorFetch`, which stamps\n * the x-sitekit-version header, attaches x-api-key, and honors the auth\n * circuit breaker — a site on a stale/canceled key will not spam the API.\n */\n\nimport { resolveAnalyticsTarget, type AnalyticsGateOptions } from '../shared/reporting-gate'\nimport { sonorFetch } from '../shared/sonorFetch'\nimport { SITE_KIT_VERSION } from '../shared/version'\nimport {\n  buildFleetHeartbeatPayload,\n  sanitizeFleetVersion,\n  type FleetHeartbeatPayload,\n  type FleetHeartbeatSource,\n  type FleetModule,\n} from './contract'\n\n/** Canonical ingest path — resolved against the site's Sonor API origin. */\nexport const FLEET_HEARTBEAT_PATH = '/api/public/fleet/heartbeat'\n\nexport interface SendFleetHeartbeatOptions extends AnalyticsGateOptions {\n  /** Sonor API origin (e.g. https://api.sonor.io). Trailing slash tolerated. */\n  apiUrl: string\n  /** Project API key — scopes the request; the project is resolved server-side. */\n  apiKey: string\n  /** Client-observable active modules (validated/deduped by the contract). */\n  modules?: FleetModule[] | string[]\n  /** Normalized host for the multi-site sub-dimension (server re-normalizes). */\n  site?: string | null\n  /** Installed Next.js version, if the caller can resolve it. */\n  nextVersion?: string | null\n  /** 'client' (runtime boot) or 'build' (CI). Default 'client'. */\n  source?: FleetHeartbeatSource\n  /** Override the reported kit version. Defaults to the runtime SITE_KIT_VERSION. */\n  kitVersion?: string\n  /** Log one info line with the result. Never logs at error level. */\n  debug?: boolean\n}\n\n/**\n * Best-effort runtime detection of the host Next.js version. Unreliable by\n * design — Next does not expose its version consistently across app/pages\n * router — so it returns null unless a site injects `__SITE_KIT_NEXT_VERSION__`\n * or `window.next.version` is present. Build-time callers should pass\n * `nextVersion` explicitly (resolvable from `next/package.json`).\n */\nexport function detectNextVersion(): string | null {\n  if (typeof window === 'undefined') return null\n  const w = window as unknown as {\n    __SITE_KIT_NEXT_VERSION__?: string\n    next?: { version?: string }\n  }\n  return sanitizeFleetVersion(w.__SITE_KIT_NEXT_VERSION__ ?? w.next?.version ?? null)\n}\n\n/**\n * Fire one heartbeat. Fire-and-forget by contract: it never throws — a\n * telemetry POST must never break a visitor's page or a site's build. Returns\n * true only when the POST was accepted (2xx).\n */\nexport async function sendFleetHeartbeat(opts: SendFleetHeartbeatOptions): Promise<boolean> {\n  const { apiUrl, apiKey } = opts\n  if (!apiUrl || !apiKey) return false\n  const target = resolveAnalyticsTarget(opts)\n  if (!target) return false\n\n  const payload: FleetHeartbeatPayload = buildFleetHeartbeatPayload({\n    kitVersion: opts.kitVersion || SITE_KIT_VERSION,\n    nextVersion: opts.nextVersion,\n    modules: opts.modules,\n    site: opts.site,\n    source: opts.source,\n  })\n\n  try {\n    const res = await sonorFetch(\n      `${target.apiUrl.replace(/\\/$/, '')}${FLEET_HEARTBEAT_PATH}`,\n      {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(payload),\n      },\n      { apiKey: target.apiKey, retries: 0 },\n    )\n    if (opts.debug) {\n      // info, never error: a visitor's console must stay clean (Lighthouse).\n      console.info(\n        `[Sonor fleet] heartbeat ${res.status} v${payload.kit_version} [${payload.modules.join(',') || 'none'}]`,\n      )\n    }\n    return res.ok\n  } catch (err) {\n    if (opts.debug) console.info('[Sonor fleet] heartbeat skipped (network)', err)\n    return false\n  }\n}\n","/**\n * @sonordev/site-kit/fleet — FleetHeartbeat\n *\n * A childless, effect-only client component that reports this site's build\n * fingerprint (kit version, Next.js version, active modules, host) to Sonor\n * exactly once per browser session. It exists so the platform can answer\n * \"which version / modules / key state is each site running\" without shelling\n * into every client repo.\n *\n * It is mounted as a deferred, CHILDLESS SIBLING — never a wrapper — by\n * SiteKitClientProviders, behind the same idle/first-interaction gate as\n * Analytics and Engage, so it never enters the critical hydration path (see\n * CLAUDE.md \"the page must server-render\"). It renders null and carries no\n * visitor data.\n */\n\n'use client'\n\nimport { useEffect, useRef } from 'react'\nimport { useDeferredActivation } from '../shared/defer'\nimport { SITE_KIT_VERSION } from '../shared/version'\nimport { detectNextVersion, sendFleetHeartbeat } from './heartbeat'\nimport { resolveAnalyticsTarget, type AnalyticsGateOptions } from '../shared/reporting-gate'\nimport type { FleetModule } from './contract'\n\n/** Session guard key — one heartbeat per session, re-sent when version/host changes. */\nconst SESSION_GUARD_KEY = '_sk_fleet_hb'\n\nexport interface FleetHeartbeatProps extends AnalyticsGateOptions {\n  /** Sonor API origin. Falls back to `window.__SITE_KIT_API_URL__` then api.sonor.io. */\n  apiUrl?: string\n  /** Project API key. Falls back to `window.__SITE_KIT_API_KEY__`. */\n  apiKey?: string\n  /** Host for the multi-site sub-dimension. Falls back to `__SITE_KIT_SITE__` then location.host. */\n  site?: string | null\n  /** Client-observable active modules (SiteKitClientProviders passes the enabled set). */\n  modules?: FleetModule[]\n  /** Installed Next.js version if known; otherwise best-effort runtime detection. */\n  nextVersion?: string | null\n  /**\n   * Self-defer to idle / first interaction. Default true so standalone use is\n   * safe. SiteKitClientProviders already gates the mount and passes false.\n   */\n  defer?: boolean\n  /** Send at most once per browser session per (version, host). Default true. */\n  oncePerSession?: boolean\n  debug?: boolean\n}\n\nexport function FleetHeartbeat({\n  apiUrl,\n  apiKey,\n  site,\n  modules,\n  nextVersion,\n  defer = true,\n  oncePerSession = true,\n  debug = false,\n  allowInFrame = false,\n  allowLocalhost = false,\n}: FleetHeartbeatProps) {\n  const ready = useDeferredActivation(defer)\n  const sentRef = useRef(false)\n\n  useEffect(() => {\n    if (!ready || sentRef.current) return\n    if (typeof window === 'undefined') return\n\n    const w = window as unknown as {\n      __SITE_KIT_API_URL__?: string\n      __SITE_KIT_API_KEY__?: string\n      __SITE_KIT_SITE__?: string\n    }\n    const target = resolveAnalyticsTarget({ apiUrl, apiKey, allowInFrame, allowLocalhost, debug })\n    if (!target) return // Gate before stamping session storage.\n    const { apiUrl: url, apiKey: key } = target\n\n    const resolvedSite = site ?? w.__SITE_KIT_SITE__ ?? window.location.host ?? ''\n\n    // Once-per-session-per-(version,host): keeps heartbeat volume to one POST\n    // per visitor session while still re-reporting after an upgrade or on a\n    // different sub-site. Storage-disabled browsers simply send once per load.\n    if (oncePerSession) {\n      const stamp = `${SITE_KIT_VERSION}:${resolvedSite}`\n      try {\n        if (sessionStorage.getItem(SESSION_GUARD_KEY) === stamp) {\n          sentRef.current = true\n          return\n        }\n        sessionStorage.setItem(SESSION_GUARD_KEY, stamp)\n      } catch {\n        /* storage unavailable — fall through and send this load */\n      }\n    }\n\n    sentRef.current = true\n    void sendFleetHeartbeat({\n      apiUrl: url,\n      apiKey: key,\n      site: resolvedSite,\n      modules,\n      nextVersion: nextVersion ?? detectNextVersion(),\n      source: 'client',\n      allowInFrame,\n      allowLocalhost,\n      debug,\n    })\n  }, [ready, apiUrl, apiKey, site, modules, nextVersion, oncePerSession, debug, allowInFrame, allowLocalhost])\n\n  return null\n}\n"]}

package/dist/{chunk-FF5N5D3D.js → chunk-T5VTQUNF.js}

@@ -1,8 +1,8 @@
 'use strict';
 
-var chunkW5NVW23S_js = require('./chunk-W5NVW23S.js');
+var chunkDHIWR7CG_js = require('./chunk-DHIWR7CG.js');
 var chunkIPV2TUAT_js = require('./chunk-IPV2TUAT.js');
-var chunkBNOQXDPJ_js = require('./chunk-BNOQXDPJ.js');
+var chunkJE5DWAE6_js = require('./chunk-JE5DWAE6.js');
 var chunkKHPJ3CEL_js = require('./chunk-KHPJ3CEL.js');
 var jsxRuntime = require('react/jsx-runtime');
 
@@ -14,7 +14,7 @@ function visibleStaticFields(config) {
 }
 function StaticForm({ config: raw, className, nativeReturnTo }) {
   if (!raw) return null;
-  const config = chunkBNOQXDPJ_js.normalizeFormConfig(raw);
+  const config = chunkJE5DWAE6_js.normalizeFormConfig(raw);
   const fields = visibleStaticFields(config);
   const honeypotFieldName = config.honeypot_field || chunkKHPJ3CEL_js.DEFAULT_HONEYPOT_FIELD;
   return /* @__PURE__ */ jsxRuntime.jsxs(
@@ -23,7 +23,7 @@ function StaticForm({ config: raw, className, nativeReturnTo }) {
       "data-sk-state": "idle",
       "data-sk-mount": "shell",
       className: `sk-form ${className || ""}`,
-      ...chunkW5NVW23S_js.nativeFormProps(config),
+      ...chunkDHIWR7CG_js.nativeFormProps(config),
       children: [
         /* @__PURE__ */ jsxRuntime.jsx("div", { className: "sk-form__step", children: /* @__PURE__ */ jsxRuntime.jsx("div", { className: "sk-form__fields", children: fields.map((field) => /* @__PURE__ */ jsxRuntime.jsx(
           "div",
@@ -34,13 +34,13 @@ function StaticForm({ config: raw, className, nativeReturnTo }) {
           field.id || field.slug
         )) }) }),
         /* @__PURE__ */ jsxRuntime.jsx("div", { className: "sk-form__actions", style: { justifyContent: "flex-end" }, children: /* @__PURE__ */ jsxRuntime.jsx("button", { type: "submit", className: "sk-form__btn sk-form__btn--submit", children: config.submit_button_text || "Submit" }) }),
-        config.honeypot_enabled && /* @__PURE__ */ jsxRuntime.jsx(chunkW5NVW23S_js.HoneypotField, { name: honeypotFieldName }),
-        /* @__PURE__ */ jsxRuntime.jsx(chunkW5NVW23S_js.NativeFallbackFields, { config, returnTo: nativeReturnTo })
+        config.honeypot_enabled && /* @__PURE__ */ jsxRuntime.jsx(chunkDHIWR7CG_js.HoneypotField, { name: honeypotFieldName }),
+        /* @__PURE__ */ jsxRuntime.jsx(chunkDHIWR7CG_js.NativeFallbackFields, { config, returnTo: nativeReturnTo })
       ]
     }
   );
 }
 
 exports.StaticForm = StaticForm;
-//# sourceMappingURL=chunk-FF5N5D3D.js.map
-//# sourceMappingURL=chunk-FF5N5D3D.js.map
+//# sourceMappingURL=chunk-T5VTQUNF.js.map
+//# sourceMappingURL=chunk-T5VTQUNF.js.map