@sonordev/site-kit 5.8.2 → 6.0.0

package/dist/{chunk-FVW6FT6L.js → chunk-OSU4QA5M.js}

@@ -1,8 +1,8 @@
 'use strict';
 
-var chunkYN7QHLWF_js = require('./chunk-YN7QHLWF.js');
+var chunkBBBJHYPH_js = require('./chunk-BBBJHYPH.js');
 var chunkO5GHP7UO_js = require('./chunk-O5GHP7UO.js');
-var chunkXBX2K3GA_js = require('./chunk-XBX2K3GA.js');
+var chunkIBJOGXQI_js = require('./chunk-IBJOGXQI.js');
 var react = require('react');
 require('server-only');
 
@@ -99,13 +99,13 @@ var getSchemaMarkups = react.cache(async (path, options) => {
   return filterSchemaRows(ctx?.schemas ?? [], options);
 });
 var getFAQData = react.cache(async (path, site) => {
-  const result = await secureApiPost("/api/public/seo/faq", chunkYN7QHLWF_js.withSiteBody({ path }, site));
+  const result = await secureApiPost("/api/public/seo/faq", chunkBBBJHYPH_js.withSiteBody({ path }, site));
   return result?.faq || null;
 });
 var getInternalLinks = react.cache(async (sourcePath, options) => {
   const result = await secureApiPost(
     "/api/public/seo/internal-links",
-    chunkYN7QHLWF_js.withSiteBody(
+    chunkBBBJHYPH_js.withSiteBody(
       {
         sourcePath,
         position: options?.position,
@@ -117,7 +117,7 @@ var getInternalLinks = react.cache(async (sourcePath, options) => {
   return result?.links || [];
 });
 var getContentBlock = react.cache(async (path, section, site) => {
-  const result = await secureApiPost("/api/public/seo/content", chunkYN7QHLWF_js.withSiteBody({ path, section }, site));
+  const result = await secureApiPost("/api/public/seo/content", chunkBBBJHYPH_js.withSiteBody({ path, section }, site));
   return result?.content || null;
 });
 var getABTest = react.cache(async (path, field) => {
@@ -152,7 +152,7 @@ async function registerSitemap(entries, options) {
   const { apiUrl, apiKey } = getSecureApiConfig();
   const mode = options?.mode ?? "full-replace";
   try {
-    const response = await chunkXBX2K3GA_js.postRegisterSitemap({ apiUrl, apiKey, entries, mode, site: chunkXBX2K3GA_js.resolveSyncSite(options?.site) });
+    const response = await chunkIBJOGXQI_js.postRegisterSitemap({ apiUrl, apiKey, entries, mode, site: chunkIBJOGXQI_js.resolveSyncSite(options?.site) });
     if (!response.ok) {
       console.error(`@sonordev/seo: Sitemap registration failed: ${response.statusText}`);
       return { success: false, created: 0, updated: 0 };
@@ -256,5 +256,5 @@ exports.getVisibilitySummary = getVisibilitySummary;
 exports.pruneSchemaTypes = pruneSchemaTypes;
 exports.recordABImpression = recordABImpression;
 exports.registerSitemap = registerSitemap;
-//# sourceMappingURL=chunk-FVW6FT6L.js.map
-//# sourceMappingURL=chunk-FVW6FT6L.js.map
+//# sourceMappingURL=chunk-OSU4QA5M.js.map
+//# sourceMappingURL=chunk-OSU4QA5M.js.map

package/dist/{chunk-FVW6FT6L.js.map → chunk-OSU4QA5M.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/seo/schema-filter.ts","../src/seo/server-api.ts"],"names":["requireServerApiConfig","serverApiFetch","cache","withSiteBody","postRegisterSitemap","resolveSyncSite"],"mappings":";;;;;;;;;AAyBA,SAAS,QAAQ,IAAA,EAAyC;AACxD,EAAA,MAAM,CAAA,GAAI,KAAK,OAAO,CAAA;AACtB,EAAA,OAAO,MAAM,OAAA,CAAQ,CAAC,IAAI,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAmB,OAAO,CAAA,KAAM,QAAQ,IAAI,OAAO,CAAA,KAAM,WAAW,CAAC,CAAC,IAAI,EAAC;AACjH;AAEA,SAAS,cAAc,KAAA,EAA+C;AACpE,EAAA,OAAO,CAAC,CAAC,KAAA,IAAS,OAAO,UAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AACrE;AAGA,SAAS,YAAY,IAAA,EAAwC;AAC3D,EAAA,MAAM,IAAA,GAAO,OAAO,IAAA,CAAK,IAAI,EAAE,MAAA,CAAO,CAAA,CAAA,KAAK,MAAM,UAAU,CAAA;AAC3D,EAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,OAAO,IAAA;AACzB,EAAA,OAAO,KAAK,MAAA,KAAW,CAAA,IAAK,IAAA,CAAK,CAAC,MAAM,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,QAAQ,CAAC,CAAA,IAAK,IAAA,CAAK,QAAQ,EAAE,MAAA,KAAW,CAAA;AACjH;AAOO,SAAS,gBAAA,CAAiB,OAAa,IAAA,EAAwC;AACpF,EAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,OAAO,KAAA;AACvB,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,GAAA,CAAI,CAAA,CAAA,KAAK,gBAAA,CAAiB,CAAA,EAAG,IAAI,CAAC,CAAA,CAAE,MAAA,CAAO,CAAA,CAAA,KAAK,CAAA,KAAM,IAAI,CAAA;AAC7E,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAC,aAAA,CAAc,KAAK,CAAA,EAAG,OAAO,KAAA;AAClC,EAAA,IAAI,OAAA,CAAQ,KAAK,CAAA,CAAE,IAAA,CAAK,CAAA,CAAA,KAAK,KAAK,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,OAAO,IAAA;AAElD,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAChD,IAAA,MAAM,IAAA,GAAO,gBAAA,CAAiB,KAAA,EAAO,IAAI,CAAA;AACzC,IAAA,IAAI,SAAS,IAAA,EAAM;AAEnB,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,IAAK,KAAK,MAAA,KAAW,CAAA,IAAK,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,MAAA,GAAS,CAAA,IAAK,QAAQ,QAAA,EAAU;AAC5G,MAAA;AAAA,IACF;AACA,IAAA,GAAA,CAAI,GAAG,CAAA,GAAI,IAAA;AAAA,EACb;AACA,EAAA,OAAO,YAAY,GAAG,CAAA,IAAK,CAAC,WAAA,CAAY,KAAK,IAAI,IAAA,GAAO,GAAA;AAC1D;AAYO,SAAS,iBACd,IAAA,EACA,EAAE,cAAc,YAAA,EAAa,GAAsB,EAAC,EAC/C;AACL,EAAA,IAAI,GAAA,GAAM,IAAA;AACV,EAAA,IAAI,cAAc,MAAA,EAAQ;AACxB,IAAA,MAAM,KAAA,GAAQ,IAAI,GAAA,CAAI,YAAY,CAAA;AAClC,IAAA,GAAA,GAAM,GAAA,CAAI,OAAO,CAAA,CAAA,KAAK,CAAA,EAAG,eAAe,KAAA,CAAM,GAAA,CAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAClE;AACA,EAAA,IAAI,cAAc,MAAA,EAAQ;AACxB,IAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAI,YAAY,CAAA;AACjC,IAAA,GAAA,GAAM,GAAA,CAAI,QAAQ,CAAA,CAAA,KAAK;AACrB,MAAA,IAAI,CAAA,EAAG,eAAe,IAAA,CAAK,GAAA,CAAI,EAAE,WAAW,CAAA,SAAU,EAAC;AACvD,MAAA,IAAI,CAAA,EAAG,WAAA,KAAgB,MAAA,EAAW,OAAO,CAAC,CAAC,CAAA;AAC3C,MAAA,MAAM,IAAA,GAAO,gBAAA,CAAiB,CAAA,CAAE,WAAA,EAAa,IAAI,CAAA;AACjD,MAAA,OAAO,IAAA,KAAS,IAAA,GAAO,EAAC,GAAI,CAAC,EAAE,GAAG,CAAA,EAAG,WAAA,EAAa,IAAA,EAAM,CAAA;AAAA,IAC1D,CAAC,CAAA;AAAA,EACH;AACA,EAAA,OAAO,GAAA;AACT;;;AC7EA,IAAM,cAAA,GAAiB,eAAA;AASvB,SAAS,kBAAA,GAAqB;AAC5B,EAAA,OAAOA,uCAAA;AAAA,IACL,EAAC;AAAA,IACD;AAAA,GACF;AACF;AAGA,SAAS,oBAAoB,MAAA,EAA+B;AAC1D,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,yBAAyB,CAAA;AACpD,EAAA,OAAO,KAAA,GAAQ,KAAA,CAAM,CAAC,CAAA,GAAI,IAAA;AAC5B;AAUA,SAAS,cAAiB,QAAA,EAAkB,IAAA,GAA4B,EAAC,EAAG,aAAa,KAAA,EAA0B;AACjH,EAAA,OAAOC,gCAAkB,QAAA,EAAU;AAAA,IACjC,MAAA,EAAQ,MAAA;AAAA,IACR,IAAA;AAAA,IACA,UAAA;AAAA,IACA,UAAA,EAAY,IAAA;AAAA,IACZ,KAAA,EAAO,IAAA;AAAA,IACP,SAAA,EAAW;AAAA,GACZ,CAAA;AACH;AAqCA,IAAM,kBAAA,GAAqBC,WAAA,CAAM,OAAO,IAAA,KAAiD;AACvF,EAAA,MAAM,SAAS,MAAM,aAAA,CAA8B,8BAAA,EAAgC,EAAE,MAAM,CAAA;AAC3F,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAO,IAAA,IAAQ,IAAA;AAAA,IACrB,OAAA,EAAS,MAAM,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA,GAAI,MAAA,CAAO,UAAU,EAAC;AAAA,IAC3D,OAAA,EAAS,OAAO,OAAA,IAAW;AAAA,GAC7B;AACF,CAAC,CAAA;AAMM,IAAM,cAAA,GAAiBA,WAAA,CAAM,OAAO,IAAA,KAAiB;AAC1D,EAAA,MAAM,GAAA,GAAM,MAAM,kBAAA,CAAmB,IAAI,CAAA;AACzC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,KAAK,IAAA,IAAQ,IAAA;AAAA,IACnB,OAAA,EAAS,KAAK,OAAA,IAAW;AAAA,GAC3B;AACF,CAAC;AAMM,IAAM,gBAAA,GAAmBA,WAAA,CAAM,OACpC,IAAA,EACA,OAAA,KACG;AACH,EAAA,MAAM,GAAA,GAAM,MAAM,kBAAA,CAAmB,IAAI,CAAA;AAIzC,EAAA,OAAO,gBAAA,CAAiB,GAAA,EAAK,OAAA,IAAW,IAAI,OAAO,CAAA;AACrD,CAAC;AAcM,IAAM,UAAA,GAAaA,WAAA,CAAM,OAAO,IAAA,EAAc,IAAA,KAAkB;AACrE,EAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAA4B,qBAAA,EAAuBC,8BAAa,EAAE,IAAA,EAAK,EAAG,IAAI,CAAC,CAAA;AACpG,EAAA,OAAO,QAAQ,GAAA,IAAO,IAAA;AACxB,CAAC;AAOM,IAAM,gBAAA,GAAmBD,WAAA,CAAM,OACpC,UAAA,EACA,OAAA,KACG;AACH,EAAA,MAAM,SAAS,MAAM,aAAA;AAAA,IACnB,gCAAA;AAAA,IACAC,6BAAA;AAAA,MACE;AAAA,QACE,UAAA;AAAA,QACA,UAAU,OAAA,EAAS,QAAA;AAAA,QACnB,OAAO,OAAA,EAAS;AAAA,OAClB;AAAA,MACA,OAAA,EAAS;AAAA;AACX,GACF;AACA,EAAA,OAAO,MAAA,EAAQ,SAAS,EAAC;AAC3B,CAAC;AAOM,IAAM,eAAA,GAAkBD,WAAA,CAAM,OAAO,IAAA,EAAc,SAAiB,IAAA,KAAkB;AAC3F,EAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAgC,yBAAA,EAA2BC,6BAAA,CAAa,EAAE,IAAA,EAAM,OAAA,EAAQ,EAAG,IAAI,CAAC,CAAA;AACrH,EAAA,OAAO,QAAQ,OAAA,IAAW,IAAA;AAC5B,CAAC;AAMM,IAAM,SAAA,GAAYD,WAAA,CAAM,OAAO,IAAA,EAAc,KAAA,KAAkB;AACpE,EAAA,MAAM,SAAS,MAAM,aAAA,CAA6B,2BAA2B,EAAE,IAAA,EAAM,OAAO,CAAA;AAC5F,EAAA,OAAO,QAAQ,IAAA,IAAQ,IAAA;AACzB,CAAC;AAMD,eAAsB,kBAAA,CACpB,MAAA,EACA,OAAA,EACA,SAAA,EACe;AACf,EAAA,MAAM,cAAc,+BAAA,EAAiC,EAAE,MAAA,EAAQ,OAAA,EAAS,WAAW,CAAA;AACrF;AAMO,IAAM,eAAA,GAAkBA,WAAA,CAAM,OAAO,IAAA,KAAiB;AAC3D,EAAA,MAAM,SAAS,MAAM,aAAA,CAAiC,0BAAA,EAA4B,EAAE,MAAM,CAAA;AAC1F,EAAA,OAAO,QAAQ,QAAA,IAAY,IAAA;AAC7B,CAAC;AAMM,IAAM,iBAAA,GAAoBA,WAAA,CAAM,OAAO,QAAA,EAAkB,WAAA,KAAyB;AACvF,EAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAkC,yBAAA,EAA2B;AAAA,IAChF,QAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,OAAO,MAAA,EAAQ,WAAW,EAAC;AAC7B,CAAC;AAMM,IAAM,aAAA,GAAgBA,WAAA,CAAM,OAAO,IAAA,KAAiB;AACzD,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,eAAe,IAAI,CAAA;AAC1C,EAAA,OAAO,MAAM,cAAA,IAAkB,IAAA;AACjC,CAAC;AAMM,IAAM,iBAAA,GAAoBA,WAAA,CAAM,OAAO,OAAA,KAA0C;AACtF,EAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAkC,yBAAA,EAA2B;AAAA,IAChF,eAAe,OAAA,EAAS;AAAA,GACzB,CAAA;AACD,EAAA,OAAO,MAAA,EAAQ,WAAW,EAAC;AAC7B,CAAC;AAwBD,eAAsB,eAAA,CACpB,SAMA,OAAA,EAaiE;AACjE,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,kBAAA,EAAmB;AAC9C,EAAA,MAAM,IAAA,GAAO,SAAS,IAAA,IAAQ,cAAA;AAE9B,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAME,oCAAA,CAAoB,EAAE,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,IAAA,EAAMC,gCAAA,CAAgB,OAAA,EAAS,IAAI,GAAG,CAAA;AAElH,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,4CAAA,EAA+C,QAAA,CAAS,UAAU,CAAA,CAAE,CAAA;AAClF,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,IAClD;AAEA,IAAA,OAAO,MAAM,SAAS,IAAA,EAAK;AAAA,EAC7B,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,8CAA8C,KAAK,CAAA;AACjE,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AACF;AAcO,IAAM,cAAA,GAAiBH,WAAA,CAAM,OAAO,IAAA,KAK9B;AACX,EAAA,OAAO,aAAA,CAAc,iCAAA,EAAmC,EAAE,IAAA,EAAM,CAAA;AAClE,CAAC;AAMD,SAAS,kBAAA,GAAqB;AAC5B,EAAA,MAAM,MAAA,GAAS,QAAQ,GAAA,CAAI,gBAAA,IAAoB,QAAQ,GAAA,CAAI,cAAA,IAAkB,OAAA,CAAQ,GAAA,CAAI,0BAAA,IAA8B,yBAAA;AACvH,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,aAAA,IAAiB,EAAA;AAC5C,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC1B;AAEA,eAAe,aAAgB,QAAA,EAAqC;AAClE,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,kBAAA,EAAmB;AAE9C,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,WAAW,MAAM,KAAA,CAAM,GAAG,MAAM,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI;AAAA,MACnD,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,IAAA,EAAM,EAAE,UAAA,EAAY,GAAA;AAAI;AAAA,KACzB,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AACnC,IAAA,OAAO,QAAQ,IAAA,IAAQ,MAAA;AAAA,EACzB,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,oCAAoC,KAAK,CAAA;AACvD,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAmCO,IAAM,WAAA,GAAcA,WAAA,CAAM,OAC/B,OAAA,KACyB;AACzB,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,kBAAA,EAAmB;AACtC,EAAA,MAAM,SAAA,GAAY,oBAAoB,MAAM,CAAA;AAC5C,EAAA,IAAI,CAAC,SAAA,EAAW,OAAO,EAAC;AACxB,EAAA,IAAI,QAAA,GAAW,wBAAwB,SAAS,CAAA,CAAA;AAChD,EAAA,IAAI,SAAS,IAAA,EAAM;AACjB,IAAA,QAAA,IAAY,CAAA,MAAA,EAAS,QAAQ,IAAI,CAAA,CAAA;AAAA,EACnC;AACA,EAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAA0B,QAAQ,CAAA;AACvD,EAAA,OAAO,UAAU,EAAC;AACpB,CAAC;AAMM,IAAM,gBAAA,GAAmBA,YAAM,YAAuC;AAC3E,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,kBAAA,EAAmB;AACtC,EAAA,MAAM,SAAA,GAAY,oBAAoB,MAAM,CAAA;AAC5C,EAAA,IAAI,CAAC,WAAW,OAAO,IAAA;AACvB,EAAA,OAAO,YAAA,CAAwB,CAAA,qBAAA,EAAwB,SAAS,CAAA,QAAA,CAAU,CAAA;AAC5E,CAAC;AAOM,IAAM,uBAAA,GAA0BA,WAAA,CAAM,OAAO,QAAA,KAAwC;AAC1F,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,kBAAA,EAAmB;AACtC,EAAA,MAAM,SAAA,GAAY,oBAAoB,MAAM,CAAA;AAC5C,EAAA,IAAI,CAAC,SAAA,EAAW,OAAO,EAAC;AACxB,EAAA,MAAM,SAAS,MAAM,YAAA;AAAA,IACnB,CAAA,mBAAA,EAAsB,SAAS,CAAA,0BAAA,EAA6B,kBAAA,CAAmB,QAAQ,CAAC,CAAA;AAAA,GAC1F;AACA,EAAA,OAAO,MAAA,EAAQ,WAAW,EAAC;AAC7B,CAAC;AAMM,IAAM,kBAAA,GAAqBA,WAAA,CAAM,OACtC,QAAA,KAQW;AACX,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,kBAAA,EAAmB;AACtC,EAAA,MAAM,SAAA,GAAY,oBAAoB,MAAM,CAAA;AAC5C,EAAA,IAAI,CAAC,WAAW,OAAO,IAAA;AACvB,EAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAoB,CAAA,uBAAA,EAA0B,SAAS,CAAA,CAAE,CAAA;AAC9E,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,EAAA,OAAO,OAAO,IAAA,CAAK,CAAA,CAAA,KAAK,CAAA,CAAE,SAAA,KAAc,QAAQ,CAAA,IAAK,IAAA;AACvD,CAAC;AAMM,IAAM,oBAAA,GAAuBA,YAAM,YAK7B;AACX,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,kBAAA,EAAmB;AACtC,EAAA,MAAM,SAAA,GAAY,oBAAoB,MAAM,CAAA;AAC5C,EAAA,IAAI,CAAC,WAAW,OAAO,IAAA;AACvB,EAAA,OAAO,YAAA,CAAa,CAAA,uBAAA,EAA0B,SAAS,CAAA,QAAA,CAAU,CAAA;AACnE,CAAC","file":"chunk-FVW6FT6L.js","sourcesContent":["/**\n * @sonordev/site-kit/seo — `includeTypes` / `excludeTypes` for JSON-LD.\n *\n * SINGLE SOURCE OF TRUTH for the ManagedSchema type filter, used for Sonor's\n * schema-markup rows (`getSchemaMarkups`) and for the page's\n * `managed_schema` and entity-graph nodes (`ManagedSchema`).\n *\n * `excludeTypes` used to drop a row only when its `schema_type` matched\n * exactly, so a node of that type nested INSIDE a row got through. Found\n * 2026-09-15 on the MDG Green Bay site: the Georgetown and Westbrooke pages\n * carry a page-level row whose JSON-LD embeds a FAQPage for questions the\n * page doesn't show, and structured data has to describe visible content.\n * `excludeTypes: ['FAQPage']` couldn't touch it; the site template dropped\n * FAQPage nodes by hand and re-added the rows. Now an excluded type goes\n * wherever it sits: a whole row, an `@graph` member, or a nested value\n * (`mainEntity`, `hasPart`). A row left with nothing in it is dropped.\n *\n * `includeTypes` stays a row-level allow list on `schema_type`.\n *\n * Pure: no I/O.\n */\n\ntype Json = unknown\n\n/** A node's `@type`, as a list (`@type` may be a string or an array). */\nfunction typesOf(node: Record<string, unknown>): string[] {\n  const t = node['@type']\n  return Array.isArray(t) ? t.filter((x): x is string => typeof x === 'string') : typeof t === 'string' ? [t] : []\n}\n\nfunction isPlainObject(value: Json): value is Record<string, unknown> {\n  return !!value && typeof value === 'object' && !Array.isArray(value)\n}\n\n/** Nothing left worth emitting: no keys but `@context`, and an empty or missing `@graph`. */\nfunction isEmptyNode(node: Record<string, unknown>): boolean {\n  const keys = Object.keys(node).filter(k => k !== '@context')\n  if (!keys.length) return true\n  return keys.length === 1 && keys[0] === '@graph' && Array.isArray(node['@graph']) && node['@graph'].length === 0\n}\n\n/**\n * The same JSON-LD with every node whose `@type` is in `deny` removed, at any\n * depth. Returns null when the value itself is removed or nothing is left.\n * Doesn't mutate its input.\n */\nexport function pruneSchemaTypes(value: Json, deny: ReadonlySet<string>): Json | null {\n  if (!deny.size) return value\n  if (Array.isArray(value)) {\n    const kept = value.map(v => pruneSchemaTypes(v, deny)).filter(v => v !== null)\n    return kept\n  }\n  if (!isPlainObject(value)) return value\n  if (typesOf(value).some(t => deny.has(t))) return null\n\n  const out: Record<string, unknown> = {}\n  for (const [key, child] of Object.entries(value)) {\n    const next = pruneSchemaTypes(child, deny)\n    if (next === null) continue\n    // A property whose every node was excluded goes, rather than shipping [].\n    if (Array.isArray(next) && next.length === 0 && Array.isArray(child) && child.length > 0 && key !== '@graph') {\n      continue\n    }\n    out[key] = next\n  }\n  return isEmptyNode(out) && !isEmptyNode(value) ? null : out\n}\n\nexport interface SchemaTypeFilter {\n  includeTypes?: string[]\n  excludeTypes?: string[]\n}\n\n/**\n * Apply the filter to Sonor's schema-markup rows: `includeTypes` keeps rows\n * whose `schema_type` it names; `excludeTypes` drops matching rows and prunes\n * matching nodes out of the rest.\n */\nexport function filterSchemaRows<T extends { schema_type?: string; schema_json?: unknown }>(\n  rows: T[],\n  { includeTypes, excludeTypes }: SchemaTypeFilter = {},\n): T[] {\n  let out = rows\n  if (includeTypes?.length) {\n    const allow = new Set(includeTypes)\n    out = out.filter(r => r?.schema_type && allow.has(r.schema_type))\n  }\n  if (excludeTypes?.length) {\n    const deny = new Set(excludeTypes)\n    out = out.flatMap(r => {\n      if (r?.schema_type && deny.has(r.schema_type)) return []\n      if (r?.schema_json === undefined) return [r]\n      const json = pruneSchemaTypes(r.schema_json, deny)\n      return json === null ? [] : [{ ...r, schema_json: json }]\n    })\n  }\n  return out\n}\n","/**\n * @sonordev/site-kit/seo - Server-Only API Functions\n * \n * SECURITY: These functions use private environment variables\n * and should ONLY be imported in server-side code (RSC, API routes, server actions).\n * \n * DO NOT import this file in client components or it will expose API keys.\n */\n\nimport { cache } from 'react'\nimport 'server-only' // This ensures the module can only be imported server-side\nimport { requireServerApiConfig, serverApiFetch } from '../server/server-fetch'\nimport { withSiteBody } from '../sites/site-param'\nimport { filterSchemaRows } from './schema-filter'\nimport { postRegisterSitemap, resolveSyncSite } from './register-sitemap-request'\n\n// ============================================\n// Server-Only API Config\n// ============================================\n\nconst SEO_LOG_PREFIX = '@sonordev/seo'\n\n/**\n * Config for portal API calls. Project is resolved by the portal from the API key;\n * sites never send or read project ID.\n *\n * Delegates to the shared `requireServerApiConfig` (single source of truth for\n * server API config — see `../server/server-fetch`) with an SEO-specific message.\n */\nfunction getSecureApiConfig() {\n  return requireServerApiConfig(\n    {},\n    '@sonordev/seo: SONOR_API_KEY environment variable is required for server-side SEO functions',\n  )\n}\n\n/** Derive project ID from API key for Signal API only (format: sonor_{uuid}_{secret}). Not used for portal. */\nfunction getProjectIdFromKey(apiKey: string): string | null {\n  const match = apiKey.match(/^sonor_([0-9a-f-]{36})_/)\n  return match ? match[1] : null\n}\n\n/**\n * POST to the Portal public API. Retries transient 429/502/503 with backoff\n * (parallel SSG workers behind one egress IP). 24h default revalidate — SEO data\n * rarely changes; Portal can on-demand revalidate. Throws if no API key is set.\n *\n * Thin wrapper over the shared `serverApiFetch` so the retry/backoff lives in one\n * place (see `../server/server-fetch`).\n */\nfunction secureApiPost<T>(endpoint: string, body: Record<string, any> = {}, revalidate = 86400): Promise<T | null> {\n  return serverApiFetch<T>(endpoint, {\n    method: 'POST',\n    body,\n    revalidate,\n    requireKey: true,\n    retry: true,\n    logPrefix: SEO_LOG_PREFIX,\n  })\n}\n\n/** GET from the Portal public API (single attempt, 24h revalidate). Throws if no API key is set. */\nfunction secureApiGet<T>(endpoint: string): Promise<T | null> {\n  return serverApiFetch<T>(endpoint, {\n    method: 'GET',\n    revalidate: 86400,\n    requireKey: true,\n    retry: false,\n    logPrefix: SEO_LOG_PREFIX,\n  })\n}\n\n// ============================================\n// Secure Cached Data Fetchers\n// ============================================\n\n/** Response shape for POST /api/public/seo/page-context */\nexport type PageSeoContext = {\n  page: any | null\n  schemas: any[]\n  project: {\n    id: string\n    title?: string | null\n    /** Resolved site brand (settings.business_name → title/org name). Grounds the managed-title quality gate. */\n    brand?: string | null\n    domain?: string | null\n    logo_url?: string | null\n    site_url?: string | null\n  } | null\n}\n\n/**\n * One Portal round-trip per path (page row + schemas + project).\n * React cache() dedupes when getSEOPageData + getSchemaMarkups run in the same render (e.g. metadata + ManagedSchema).\n * @server-only\n */\nconst loadPageSeoContext = cache(async (path: string): Promise<PageSeoContext | null> => {\n  const result = await secureApiPost<PageSeoContext>('/api/public/seo/page-context', { path })\n  if (!result) return null\n  return {\n    page: result.page ?? null,\n    schemas: Array.isArray(result.schemas) ? result.schemas : [],\n    project: result.project ?? null,\n  }\n})\n\n/**\n * Fetch SEO page data - cached per request\n * @server-only\n */\nexport const getSEOPageData = cache(async (path: string) => {\n  const ctx = await loadPageSeoContext(path)\n  return {\n    page: ctx?.page ?? null,\n    project: ctx?.project ?? null,\n  }\n})\n\n/**\n * Fetch schema markups for a page - cached per request (shares loadPageSeoContext with getSEOPageData)\n * @server-only\n */\nexport const getSchemaMarkups = cache(async (\n  path: string,\n  options?: { includeTypes?: string[]; excludeTypes?: string[] }\n) => {\n  const ctx = await loadPageSeoContext(path)\n  // Single source of truth for the type filter (also applied to\n  // managed_schema in ManagedSchema): an excluded type is pruned wherever it\n  // sits in a row, not only when it's the row's schema_type.\n  return filterSchemaRows(ctx?.schemas ?? [], options)\n})\n\n// Managed FAQs, internal links and content blocks are site-scoped on\n// multi-site projects: a row with no site applies to every host, a row tagged\n// with a host applies only there. So these three reads send `site` in the body\n// via the shared `withSiteBody` (explicit → NEXT_PUBLIC_SITE_URL host →\n// window.location.host, omitted when nothing resolves). The API treats a\n// request with no site as the project's primary domain.\n\n/**\n * Fetch FAQ data for a page - cached per request\n * @param site Sub-site host override; resolves from NEXT_PUBLIC_SITE_URL when omitted\n * @server-only\n */\nexport const getFAQData = cache(async (path: string, site?: string) => {\n  const result = await secureApiPost<{ faq: any }>('/api/public/seo/faq', withSiteBody({ path }, site))\n  return result?.faq || null\n})\n\n/**\n * Fetch internal links for a page - cached per request\n * `options.site`: sub-site host override; resolves from NEXT_PUBLIC_SITE_URL when omitted\n * @server-only\n */\nexport const getInternalLinks = cache(async (\n  sourcePath: string,\n  options?: { position?: string; limit?: number; site?: string }\n) => {\n  const result = await secureApiPost<{ links: any[] }>(\n    '/api/public/seo/internal-links',\n    withSiteBody(\n      {\n        sourcePath,\n        position: options?.position,\n        limit: options?.limit,\n      },\n      options?.site,\n    ),\n  )\n  return result?.links || []\n})\n\n/**\n * Fetch content block - cached per request\n * @param site Sub-site host override; resolves from NEXT_PUBLIC_SITE_URL when omitted\n * @server-only\n */\nexport const getContentBlock = cache(async (path: string, section: string, site?: string) => {\n  const result = await secureApiPost<{ content: any }>('/api/public/seo/content', withSiteBody({ path, section }, site))\n  return result?.content || null\n})\n\n/**\n * Fetch A/B test and determine variant - cached per request\n * @server-only\n */\nexport const getABTest = cache(async (path: string, field: string) => {\n  const result = await secureApiPost<{ test: any }>('/api/public/seo/ab-test', { path, field })\n  return result?.test || null\n})\n\n/**\n * Record A/B test impression\n * @server-only\n */\nexport async function recordABImpression(\n  testId: string,\n  variant: 'a' | 'b',\n  sessionId?: string\n): Promise<void> {\n  await secureApiPost('/api/public/seo/ab-impression', { testId, variant, sessionId })\n}\n\n/**\n * Fetch redirect for a path - cached per request\n * @server-only\n */\nexport const getRedirectData = cache(async (path: string) => {\n  const result = await secureApiPost<{ redirect: any }>('/api/public/seo/redirect', { path })\n  return result?.redirect || null\n})\n\n/**\n * Fetch managed scripts - cached per request\n * @server-only\n */\nexport const getManagedScripts = cache(async (position: string, currentPath?: string) => {\n  const result = await secureApiPost<{ scripts: any[] }>('/api/public/seo/scripts', {\n    position,\n    currentPath,\n  })\n  return result?.scripts || []\n})\n\n/**\n * Fetch robots directive for a page - cached per request\n * @server-only\n */\nexport const getRobotsData = cache(async (path: string) => {\n  const { page } = await getSEOPageData(path)\n  return page?.managed_robots || null\n})\n\n/**\n * Fetch sitemap entries - cached per request\n * @server-only\n */\nexport const getSitemapEntries = cache(async (options?: { publishedOnly?: boolean }) => {\n  const result = await secureApiPost<{ entries: any[] }>('/api/public/seo/sitemap', {\n    publishedOnly: options?.publishedOnly,\n  })\n  return result?.entries || []\n})\n\n/**\n * Register/sync sitemap entries from the client site\n * Call this at build time to populate seo_pages from your sitemap.xml\n * @server-only\n *\n * Defaults to mode 'full-replace', which PRUNES every page missing from\n * `entries`. Pass `{ mode: 'additive' }` unless the list is the whole site.\n *\n * @example\n * ```ts\n * // scripts/register-sitemap.ts (run at build time)\n * import { registerSitemap } from '@sonordev/site-kit/seo/server'\n *\n * await registerSitemap(\n *   [\n *     { path: '/', priority: 1.0, changefreq: 'daily' },\n *     { path: '/about', priority: 0.8, changefreq: 'weekly' },\n *   ],\n *   { mode: 'additive' },\n * )\n * ```\n */\nexport async function registerSitemap(\n  entries: Array<{\n    path: string\n    title?: string\n    priority?: number\n    changefreq?: 'always' | 'hourly' | 'daily' | 'weekly' | 'monthly' | 'yearly' | 'never'\n  }>,\n  options?: {\n    /**\n     * Sync mode:\n     * - 'full-replace': replaces the entire page set (default for build-time sync)\n     * - 'additive': adds/updates pages but never deletes existing ones\n     */\n    mode?: 'additive' | 'full-replace'\n    /**\n     * Sub-site host these pages belong to, on a multi-site project. Defaults\n     * to NEXT_PUBLIC_SITE_URL's host; left off when nothing resolves.\n     */\n    site?: string\n  }\n): Promise<{ success: boolean; created: number; updated: number }> {\n  const { apiUrl, apiKey } = getSecureApiConfig()\n  const mode = options?.mode ?? 'full-replace'\n\n  try {\n    const response = await postRegisterSitemap({ apiUrl, apiKey, entries, mode, site: resolveSyncSite(options?.site) })\n    \n    if (!response.ok) {\n      console.error(`@sonordev/seo: Sitemap registration failed: ${response.statusText}`)\n      return { success: false, created: 0, updated: 0 }\n    }\n    \n    return await response.json()\n  } catch (error) {\n    console.error('@sonordev/seo: Sitemap registration error:', error)\n    return { success: false, created: 0, updated: 0 }\n  }\n}\n\n// ============================================\n// Signal-Powered Metadata Fallback\n// ============================================\n\n/**\n * Ensure metadata exists for a page by triggering Signal AI optimization.\n * If the page has no managed_title or managed_meta_description, Signal will\n * generate them and save to the database via Portal proxy.\n *\n * Idempotent — returns existing metadata if already populated.\n * @server-only\n */\nexport const ensureMetadata = cache(async (path: string): Promise<{\n  managed_title?: string\n  managed_meta_description?: string\n  managed_keywords?: string[]\n  managed_schema?: Record<string, unknown>\n} | null> => {\n  return secureApiPost('/api/public/seo/ensure-metadata', { path })\n})\n\n// ============================================\n// AI Visibility & Entity Graph API (Signal)\n// ============================================\n\nfunction getSignalApiConfig() {\n  const apiUrl = process.env.SONOR_SIGNAL_URL || process.env.SIGNAL_API_URL || process.env.NEXT_PUBLIC_SIGNAL_API_URL || 'https://signal.sonor.io'\n  const apiKey = process.env.SONOR_API_KEY || ''\n  return { apiUrl, apiKey }\n}\n\nasync function signalApiGet<T>(endpoint: string): Promise<T | null> {\n  const { apiUrl, apiKey } = getSignalApiConfig()\n  \n  if (!apiKey) {\n    return null\n  }\n  \n  try {\n    const response = await fetch(`${apiUrl}${endpoint}`, {\n      method: 'GET',\n      headers: {\n        'Content-Type': 'application/json',\n        'x-api-key': apiKey,\n      },\n      next: { revalidate: 300 }, // Cache for 5 minutes\n    })\n    \n    if (!response.ok) {\n      return null\n    }\n    \n    const result = await response.json()\n    return result?.data || result\n  } catch (error) {\n    console.error('@sonordev/seo: Signal API error:', error)\n    return null\n  }\n}\n\n/**\n * Entity types for the knowledge graph\n */\nexport type EntityType = \n  | 'organization'\n  | 'person'\n  | 'service'\n  | 'product'\n  | 'location'\n  | 'concept'\n  | 'credential'\n\n/**\n * Entity from the knowledge graph\n */\nexport interface SEOEntity {\n  id: string\n  project_id: string\n  entity_type: EntityType\n  name: string\n  slug: string\n  properties: Record<string, unknown>\n  knows_about: string[]\n  same_as: string[]\n  schema_type?: string\n  is_primary: boolean\n}\n\n/**\n * Fetch entities for a project - cached per request\n * Returns the entity graph for enhanced schema markup\n * @server-only\n */\nexport const getEntities = cache(async (\n  options?: { type?: EntityType }\n): Promise<SEOEntity[]> => {\n  const { apiKey } = getSecureApiConfig()\n  const projectId = getProjectIdFromKey(apiKey)\n  if (!projectId) return []\n  let endpoint = `/skills/seo/entities/${projectId}`\n  if (options?.type) {\n    endpoint += `?type=${options.type}`\n  }\n  const result = await signalApiGet<SEOEntity[]>(endpoint)\n  return result || []\n})\n\n/**\n * Fetch primary entity (the business) - cached per request\n * @server-only\n */\nexport const getPrimaryEntity = cache(async (): Promise<SEOEntity | null> => {\n  const { apiKey } = getSecureApiConfig()\n  const projectId = getProjectIdFromKey(apiKey)\n  if (!projectId) return null\n  return signalApiGet<SEOEntity>(`/skills/seo/entities/${projectId}/primary`)\n})\n\n/**\n * Fetch entity-enhanced schema for a page\n * Returns Organization schema with knowsAbout, areaServed, employee, etc.\n * @server-only\n */\nexport const getEntityEnhancedSchema = cache(async (pagePath: string): Promise<object[]> => {\n  const { apiKey } = getSecureApiConfig()\n  const projectId = getProjectIdFromKey(apiKey)\n  if (!projectId) return []\n  const result = await signalApiGet<{ schemas: object[] }>(\n    `/skills/seo/schema/${projectId}/entity-enhanced?pagePath=${encodeURIComponent(pagePath)}`\n  )\n  return result?.schemas || []\n})\n\n/**\n * Get AI visibility score for a page\n * @server-only\n */\nexport const getVisibilityScore = cache(async (\n  pagePath: string\n): Promise<{\n  overall_score: number\n  entity_coverage: number\n  answer_density: number\n  chunk_readability: number\n  authority_signals: number\n  schema_completeness: number\n} | null> => {\n  const { apiKey } = getSecureApiConfig()\n  const projectId = getProjectIdFromKey(apiKey)\n  if (!projectId) return null\n  const result = await signalApiGet<any[]>(`/skills/seo/visibility/${projectId}`)\n  if (!result) return null\n  return result.find(s => s.page_path === pagePath) || null\n})\n\n/**\n * Get AI visibility summary for project\n * @server-only\n */\nexport const getVisibilitySummary = cache(async (): Promise<{\n  overall_score: number\n  total_entities: number\n  pages_analyzed: number\n  top_recommendations: Array<{ priority: string; type: string; message: string }>\n} | null> => {\n  const { apiKey } = getSecureApiConfig()\n  const projectId = getProjectIdFromKey(apiKey)\n  if (!projectId) return null\n  return signalApiGet(`/skills/seo/visibility/${projectId}/summary`)\n})\n"]}
+{"version":3,"sources":["../src/seo/schema-filter.ts","../src/seo/server-api.ts"],"names":["requireServerApiConfig","serverApiFetch","cache","withSiteBody","postRegisterSitemap","resolveSyncSite"],"mappings":";;;;;;;;;AAyBA,SAAS,QAAQ,IAAA,EAAyC;AACxD,EAAA,MAAM,CAAA,GAAI,KAAK,OAAO,CAAA;AACtB,EAAA,OAAO,MAAM,OAAA,CAAQ,CAAC,IAAI,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAmB,OAAO,CAAA,KAAM,QAAQ,IAAI,OAAO,CAAA,KAAM,WAAW,CAAC,CAAC,IAAI,EAAC;AACjH;AAEA,SAAS,cAAc,KAAA,EAA+C;AACpE,EAAA,OAAO,CAAC,CAAC,KAAA,IAAS,OAAO,UAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AACrE;AAGA,SAAS,YAAY,IAAA,EAAwC;AAC3D,EAAA,MAAM,IAAA,GAAO,OAAO,IAAA,CAAK,IAAI,EAAE,MAAA,CAAO,CAAA,CAAA,KAAK,MAAM,UAAU,CAAA;AAC3D,EAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,OAAO,IAAA;AACzB,EAAA,OAAO,KAAK,MAAA,KAAW,CAAA,IAAK,IAAA,CAAK,CAAC,MAAM,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,QAAQ,CAAC,CAAA,IAAK,IAAA,CAAK,QAAQ,EAAE,MAAA,KAAW,CAAA;AACjH;AAOO,SAAS,gBAAA,CAAiB,OAAa,IAAA,EAAwC;AACpF,EAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,OAAO,KAAA;AACvB,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,GAAA,CAAI,CAAA,CAAA,KAAK,gBAAA,CAAiB,CAAA,EAAG,IAAI,CAAC,CAAA,CAAE,MAAA,CAAO,CAAA,CAAA,KAAK,CAAA,KAAM,IAAI,CAAA;AAC7E,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAC,aAAA,CAAc,KAAK,CAAA,EAAG,OAAO,KAAA;AAClC,EAAA,IAAI,OAAA,CAAQ,KAAK,CAAA,CAAE,IAAA,CAAK,CAAA,CAAA,KAAK,KAAK,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,OAAO,IAAA;AAElD,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAChD,IAAA,MAAM,IAAA,GAAO,gBAAA,CAAiB,KAAA,EAAO,IAAI,CAAA;AACzC,IAAA,IAAI,SAAS,IAAA,EAAM;AAEnB,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,IAAK,KAAK,MAAA,KAAW,CAAA,IAAK,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,MAAA,GAAS,CAAA,IAAK,QAAQ,QAAA,EAAU;AAC5G,MAAA;AAAA,IACF;AACA,IAAA,GAAA,CAAI,GAAG,CAAA,GAAI,IAAA;AAAA,EACb;AACA,EAAA,OAAO,YAAY,GAAG,CAAA,IAAK,CAAC,WAAA,CAAY,KAAK,IAAI,IAAA,GAAO,GAAA;AAC1D;AAYO,SAAS,iBACd,IAAA,EACA,EAAE,cAAc,YAAA,EAAa,GAAsB,EAAC,EAC/C;AACL,EAAA,IAAI,GAAA,GAAM,IAAA;AACV,EAAA,IAAI,cAAc,MAAA,EAAQ;AACxB,IAAA,MAAM,KAAA,GAAQ,IAAI,GAAA,CAAI,YAAY,CAAA;AAClC,IAAA,GAAA,GAAM,GAAA,CAAI,OAAO,CAAA,CAAA,KAAK,CAAA,EAAG,eAAe,KAAA,CAAM,GAAA,CAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAClE;AACA,EAAA,IAAI,cAAc,MAAA,EAAQ;AACxB,IAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAI,YAAY,CAAA;AACjC,IAAA,GAAA,GAAM,GAAA,CAAI,QAAQ,CAAA,CAAA,KAAK;AACrB,MAAA,IAAI,CAAA,EAAG,eAAe,IAAA,CAAK,GAAA,CAAI,EAAE,WAAW,CAAA,SAAU,EAAC;AACvD,MAAA,IAAI,CAAA,EAAG,WAAA,KAAgB,MAAA,EAAW,OAAO,CAAC,CAAC,CAAA;AAC3C,MAAA,MAAM,IAAA,GAAO,gBAAA,CAAiB,CAAA,CAAE,WAAA,EAAa,IAAI,CAAA;AACjD,MAAA,OAAO,IAAA,KAAS,IAAA,GAAO,EAAC,GAAI,CAAC,EAAE,GAAG,CAAA,EAAG,WAAA,EAAa,IAAA,EAAM,CAAA;AAAA,IAC1D,CAAC,CAAA;AAAA,EACH;AACA,EAAA,OAAO,GAAA;AACT;;;AC7EA,IAAM,cAAA,GAAiB,eAAA;AASvB,SAAS,kBAAA,GAAqB;AAC5B,EAAA,OAAOA,uCAAA;AAAA,IACL,EAAC;AAAA,IACD;AAAA,GACF;AACF;AAGA,SAAS,oBAAoB,MAAA,EAA+B;AAC1D,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,yBAAyB,CAAA;AACpD,EAAA,OAAO,KAAA,GAAQ,KAAA,CAAM,CAAC,CAAA,GAAI,IAAA;AAC5B;AAUA,SAAS,cAAiB,QAAA,EAAkB,IAAA,GAA4B,EAAC,EAAG,aAAa,KAAA,EAA0B;AACjH,EAAA,OAAOC,gCAAkB,QAAA,EAAU;AAAA,IACjC,MAAA,EAAQ,MAAA;AAAA,IACR,IAAA;AAAA,IACA,UAAA;AAAA,IACA,UAAA,EAAY,IAAA;AAAA,IACZ,KAAA,EAAO,IAAA;AAAA,IACP,SAAA,EAAW;AAAA,GACZ,CAAA;AACH;AAqCA,IAAM,kBAAA,GAAqBC,WAAA,CAAM,OAAO,IAAA,KAAiD;AACvF,EAAA,MAAM,SAAS,MAAM,aAAA,CAA8B,8BAAA,EAAgC,EAAE,MAAM,CAAA;AAC3F,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAO,IAAA,IAAQ,IAAA;AAAA,IACrB,OAAA,EAAS,MAAM,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA,GAAI,MAAA,CAAO,UAAU,EAAC;AAAA,IAC3D,OAAA,EAAS,OAAO,OAAA,IAAW;AAAA,GAC7B;AACF,CAAC,CAAA;AAMM,IAAM,cAAA,GAAiBA,WAAA,CAAM,OAAO,IAAA,KAAiB;AAC1D,EAAA,MAAM,GAAA,GAAM,MAAM,kBAAA,CAAmB,IAAI,CAAA;AACzC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,KAAK,IAAA,IAAQ,IAAA;AAAA,IACnB,OAAA,EAAS,KAAK,OAAA,IAAW;AAAA,GAC3B;AACF,CAAC;AAMM,IAAM,gBAAA,GAAmBA,WAAA,CAAM,OACpC,IAAA,EACA,OAAA,KACG;AACH,EAAA,MAAM,GAAA,GAAM,MAAM,kBAAA,CAAmB,IAAI,CAAA;AAIzC,EAAA,OAAO,gBAAA,CAAiB,GAAA,EAAK,OAAA,IAAW,IAAI,OAAO,CAAA;AACrD,CAAC;AAcM,IAAM,UAAA,GAAaA,WAAA,CAAM,OAAO,IAAA,EAAc,IAAA,KAAkB;AACrE,EAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAA4B,qBAAA,EAAuBC,8BAAa,EAAE,IAAA,EAAK,EAAG,IAAI,CAAC,CAAA;AACpG,EAAA,OAAO,QAAQ,GAAA,IAAO,IAAA;AACxB,CAAC;AAOM,IAAM,gBAAA,GAAmBD,WAAA,CAAM,OACpC,UAAA,EACA,OAAA,KACG;AACH,EAAA,MAAM,SAAS,MAAM,aAAA;AAAA,IACnB,gCAAA;AAAA,IACAC,6BAAA;AAAA,MACE;AAAA,QACE,UAAA;AAAA,QACA,UAAU,OAAA,EAAS,QAAA;AAAA,QACnB,OAAO,OAAA,EAAS;AAAA,OAClB;AAAA,MACA,OAAA,EAAS;AAAA;AACX,GACF;AACA,EAAA,OAAO,MAAA,EAAQ,SAAS,EAAC;AAC3B,CAAC;AAOM,IAAM,eAAA,GAAkBD,WAAA,CAAM,OAAO,IAAA,EAAc,SAAiB,IAAA,KAAkB;AAC3F,EAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAgC,yBAAA,EAA2BC,6BAAA,CAAa,EAAE,IAAA,EAAM,OAAA,EAAQ,EAAG,IAAI,CAAC,CAAA;AACrH,EAAA,OAAO,QAAQ,OAAA,IAAW,IAAA;AAC5B,CAAC;AAMM,IAAM,SAAA,GAAYD,WAAA,CAAM,OAAO,IAAA,EAAc,KAAA,KAAkB;AACpE,EAAA,MAAM,SAAS,MAAM,aAAA,CAA6B,2BAA2B,EAAE,IAAA,EAAM,OAAO,CAAA;AAC5F,EAAA,OAAO,QAAQ,IAAA,IAAQ,IAAA;AACzB,CAAC;AAMD,eAAsB,kBAAA,CACpB,MAAA,EACA,OAAA,EACA,SAAA,EACe;AACf,EAAA,MAAM,cAAc,+BAAA,EAAiC,EAAE,MAAA,EAAQ,OAAA,EAAS,WAAW,CAAA;AACrF;AAMO,IAAM,eAAA,GAAkBA,WAAA,CAAM,OAAO,IAAA,KAAiB;AAC3D,EAAA,MAAM,SAAS,MAAM,aAAA,CAAiC,0BAAA,EAA4B,EAAE,MAAM,CAAA;AAC1F,EAAA,OAAO,QAAQ,QAAA,IAAY,IAAA;AAC7B,CAAC;AAMM,IAAM,iBAAA,GAAoBA,WAAA,CAAM,OAAO,QAAA,EAAkB,WAAA,KAAyB;AACvF,EAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAkC,yBAAA,EAA2B;AAAA,IAChF,QAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,OAAO,MAAA,EAAQ,WAAW,EAAC;AAC7B,CAAC;AAMM,IAAM,aAAA,GAAgBA,WAAA,CAAM,OAAO,IAAA,KAAiB;AACzD,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,eAAe,IAAI,CAAA;AAC1C,EAAA,OAAO,MAAM,cAAA,IAAkB,IAAA;AACjC,CAAC;AAMM,IAAM,iBAAA,GAAoBA,WAAA,CAAM,OAAO,OAAA,KAA0C;AACtF,EAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAkC,yBAAA,EAA2B;AAAA,IAChF,eAAe,OAAA,EAAS;AAAA,GACzB,CAAA;AACD,EAAA,OAAO,MAAA,EAAQ,WAAW,EAAC;AAC7B,CAAC;AAwBD,eAAsB,eAAA,CACpB,SAMA,OAAA,EAaiE;AACjE,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,kBAAA,EAAmB;AAC9C,EAAA,MAAM,IAAA,GAAO,SAAS,IAAA,IAAQ,cAAA;AAE9B,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAME,oCAAA,CAAoB,EAAE,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,IAAA,EAAMC,gCAAA,CAAgB,OAAA,EAAS,IAAI,GAAG,CAAA;AAElH,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,4CAAA,EAA+C,QAAA,CAAS,UAAU,CAAA,CAAE,CAAA;AAClF,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,IAClD;AAEA,IAAA,OAAO,MAAM,SAAS,IAAA,EAAK;AAAA,EAC7B,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,8CAA8C,KAAK,CAAA;AACjE,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AACF;AAcO,IAAM,cAAA,GAAiBH,WAAA,CAAM,OAAO,IAAA,KAK9B;AACX,EAAA,OAAO,aAAA,CAAc,iCAAA,EAAmC,EAAE,IAAA,EAAM,CAAA;AAClE,CAAC;AAMD,SAAS,kBAAA,GAAqB;AAC5B,EAAA,MAAM,MAAA,GAAS,QAAQ,GAAA,CAAI,gBAAA,IAAoB,QAAQ,GAAA,CAAI,cAAA,IAAkB,OAAA,CAAQ,GAAA,CAAI,0BAAA,IAA8B,yBAAA;AACvH,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,aAAA,IAAiB,EAAA;AAC5C,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC1B;AAEA,eAAe,aAAgB,QAAA,EAAqC;AAClE,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,kBAAA,EAAmB;AAE9C,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,WAAW,MAAM,KAAA,CAAM,GAAG,MAAM,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI;AAAA,MACnD,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,IAAA,EAAM,EAAE,UAAA,EAAY,GAAA;AAAI;AAAA,KACzB,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AACnC,IAAA,OAAO,QAAQ,IAAA,IAAQ,MAAA;AAAA,EACzB,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,oCAAoC,KAAK,CAAA;AACvD,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAmCO,IAAM,WAAA,GAAcA,WAAA,CAAM,OAC/B,OAAA,KACyB;AACzB,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,kBAAA,EAAmB;AACtC,EAAA,MAAM,SAAA,GAAY,oBAAoB,MAAM,CAAA;AAC5C,EAAA,IAAI,CAAC,SAAA,EAAW,OAAO,EAAC;AACxB,EAAA,IAAI,QAAA,GAAW,wBAAwB,SAAS,CAAA,CAAA;AAChD,EAAA,IAAI,SAAS,IAAA,EAAM;AACjB,IAAA,QAAA,IAAY,CAAA,MAAA,EAAS,QAAQ,IAAI,CAAA,CAAA;AAAA,EACnC;AACA,EAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAA0B,QAAQ,CAAA;AACvD,EAAA,OAAO,UAAU,EAAC;AACpB,CAAC;AAMM,IAAM,gBAAA,GAAmBA,YAAM,YAAuC;AAC3E,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,kBAAA,EAAmB;AACtC,EAAA,MAAM,SAAA,GAAY,oBAAoB,MAAM,CAAA;AAC5C,EAAA,IAAI,CAAC,WAAW,OAAO,IAAA;AACvB,EAAA,OAAO,YAAA,CAAwB,CAAA,qBAAA,EAAwB,SAAS,CAAA,QAAA,CAAU,CAAA;AAC5E,CAAC;AAOM,IAAM,uBAAA,GAA0BA,WAAA,CAAM,OAAO,QAAA,KAAwC;AAC1F,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,kBAAA,EAAmB;AACtC,EAAA,MAAM,SAAA,GAAY,oBAAoB,MAAM,CAAA;AAC5C,EAAA,IAAI,CAAC,SAAA,EAAW,OAAO,EAAC;AACxB,EAAA,MAAM,SAAS,MAAM,YAAA;AAAA,IACnB,CAAA,mBAAA,EAAsB,SAAS,CAAA,0BAAA,EAA6B,kBAAA,CAAmB,QAAQ,CAAC,CAAA;AAAA,GAC1F;AACA,EAAA,OAAO,MAAA,EAAQ,WAAW,EAAC;AAC7B,CAAC;AAMM,IAAM,kBAAA,GAAqBA,WAAA,CAAM,OACtC,QAAA,KAQW;AACX,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,kBAAA,EAAmB;AACtC,EAAA,MAAM,SAAA,GAAY,oBAAoB,MAAM,CAAA;AAC5C,EAAA,IAAI,CAAC,WAAW,OAAO,IAAA;AACvB,EAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAoB,CAAA,uBAAA,EAA0B,SAAS,CAAA,CAAE,CAAA;AAC9E,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,EAAA,OAAO,OAAO,IAAA,CAAK,CAAA,CAAA,KAAK,CAAA,CAAE,SAAA,KAAc,QAAQ,CAAA,IAAK,IAAA;AACvD,CAAC;AAMM,IAAM,oBAAA,GAAuBA,YAAM,YAK7B;AACX,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,kBAAA,EAAmB;AACtC,EAAA,MAAM,SAAA,GAAY,oBAAoB,MAAM,CAAA;AAC5C,EAAA,IAAI,CAAC,WAAW,OAAO,IAAA;AACvB,EAAA,OAAO,YAAA,CAAa,CAAA,uBAAA,EAA0B,SAAS,CAAA,QAAA,CAAU,CAAA;AACnE,CAAC","file":"chunk-OSU4QA5M.js","sourcesContent":["/**\n * @sonordev/site-kit/seo — `includeTypes` / `excludeTypes` for JSON-LD.\n *\n * SINGLE SOURCE OF TRUTH for the ManagedSchema type filter, used for Sonor's\n * schema-markup rows (`getSchemaMarkups`) and for the page's\n * `managed_schema` and entity-graph nodes (`ManagedSchema`).\n *\n * `excludeTypes` used to drop a row only when its `schema_type` matched\n * exactly, so a node of that type nested INSIDE a row got through. Found\n * 2026-09-15 on the MDG Green Bay site: the Georgetown and Westbrooke pages\n * carry a page-level row whose JSON-LD embeds a FAQPage for questions the\n * page doesn't show, and structured data has to describe visible content.\n * `excludeTypes: ['FAQPage']` couldn't touch it; the site template dropped\n * FAQPage nodes by hand and re-added the rows. Now an excluded type goes\n * wherever it sits: a whole row, an `@graph` member, or a nested value\n * (`mainEntity`, `hasPart`). A row left with nothing in it is dropped.\n *\n * `includeTypes` stays a row-level allow list on `schema_type`.\n *\n * Pure: no I/O.\n */\n\ntype Json = unknown\n\n/** A node's `@type`, as a list (`@type` may be a string or an array). */\nfunction typesOf(node: Record<string, unknown>): string[] {\n  const t = node['@type']\n  return Array.isArray(t) ? t.filter((x): x is string => typeof x === 'string') : typeof t === 'string' ? [t] : []\n}\n\nfunction isPlainObject(value: Json): value is Record<string, unknown> {\n  return !!value && typeof value === 'object' && !Array.isArray(value)\n}\n\n/** Nothing left worth emitting: no keys but `@context`, and an empty or missing `@graph`. */\nfunction isEmptyNode(node: Record<string, unknown>): boolean {\n  const keys = Object.keys(node).filter(k => k !== '@context')\n  if (!keys.length) return true\n  return keys.length === 1 && keys[0] === '@graph' && Array.isArray(node['@graph']) && node['@graph'].length === 0\n}\n\n/**\n * The same JSON-LD with every node whose `@type` is in `deny` removed, at any\n * depth. Returns null when the value itself is removed or nothing is left.\n * Doesn't mutate its input.\n */\nexport function pruneSchemaTypes(value: Json, deny: ReadonlySet<string>): Json | null {\n  if (!deny.size) return value\n  if (Array.isArray(value)) {\n    const kept = value.map(v => pruneSchemaTypes(v, deny)).filter(v => v !== null)\n    return kept\n  }\n  if (!isPlainObject(value)) return value\n  if (typesOf(value).some(t => deny.has(t))) return null\n\n  const out: Record<string, unknown> = {}\n  for (const [key, child] of Object.entries(value)) {\n    const next = pruneSchemaTypes(child, deny)\n    if (next === null) continue\n    // A property whose every node was excluded goes, rather than shipping [].\n    if (Array.isArray(next) && next.length === 0 && Array.isArray(child) && child.length > 0 && key !== '@graph') {\n      continue\n    }\n    out[key] = next\n  }\n  return isEmptyNode(out) && !isEmptyNode(value) ? null : out\n}\n\nexport interface SchemaTypeFilter {\n  includeTypes?: string[]\n  excludeTypes?: string[]\n}\n\n/**\n * Apply the filter to Sonor's schema-markup rows: `includeTypes` keeps rows\n * whose `schema_type` it names; `excludeTypes` drops matching rows and prunes\n * matching nodes out of the rest.\n */\nexport function filterSchemaRows<T extends { schema_type?: string; schema_json?: unknown }>(\n  rows: T[],\n  { includeTypes, excludeTypes }: SchemaTypeFilter = {},\n): T[] {\n  let out = rows\n  if (includeTypes?.length) {\n    const allow = new Set(includeTypes)\n    out = out.filter(r => r?.schema_type && allow.has(r.schema_type))\n  }\n  if (excludeTypes?.length) {\n    const deny = new Set(excludeTypes)\n    out = out.flatMap(r => {\n      if (r?.schema_type && deny.has(r.schema_type)) return []\n      if (r?.schema_json === undefined) return [r]\n      const json = pruneSchemaTypes(r.schema_json, deny)\n      return json === null ? [] : [{ ...r, schema_json: json }]\n    })\n  }\n  return out\n}\n","/**\n * @sonordev/site-kit/seo - Server-Only API Functions\n * \n * SECURITY: These functions use private environment variables\n * and should ONLY be imported in server-side code (RSC, API routes, server actions).\n * \n * DO NOT import this file in client components or it will expose API keys.\n */\n\nimport { cache } from 'react'\nimport 'server-only' // This ensures the module can only be imported server-side\nimport { requireServerApiConfig, serverApiFetch } from '../server/server-fetch'\nimport { withSiteBody } from '../sites/site-param'\nimport { filterSchemaRows } from './schema-filter'\nimport { postRegisterSitemap, resolveSyncSite } from './register-sitemap-request'\n\n// ============================================\n// Server-Only API Config\n// ============================================\n\nconst SEO_LOG_PREFIX = '@sonordev/seo'\n\n/**\n * Config for portal API calls. Project is resolved by the portal from the API key;\n * sites never send or read project ID.\n *\n * Delegates to the shared `requireServerApiConfig` (single source of truth for\n * server API config — see `../server/server-fetch`) with an SEO-specific message.\n */\nfunction getSecureApiConfig() {\n  return requireServerApiConfig(\n    {},\n    '@sonordev/seo: SONOR_API_KEY environment variable is required for server-side SEO functions',\n  )\n}\n\n/** Derive project ID from API key for Signal API only (format: sonor_{uuid}_{secret}). Not used for portal. */\nfunction getProjectIdFromKey(apiKey: string): string | null {\n  const match = apiKey.match(/^sonor_([0-9a-f-]{36})_/)\n  return match ? match[1] : null\n}\n\n/**\n * POST to the Portal public API. Retries transient 429/502/503 with backoff\n * (parallel SSG workers behind one egress IP). 24h default revalidate — SEO data\n * rarely changes; Portal can on-demand revalidate. Throws if no API key is set.\n *\n * Thin wrapper over the shared `serverApiFetch` so the retry/backoff lives in one\n * place (see `../server/server-fetch`).\n */\nfunction secureApiPost<T>(endpoint: string, body: Record<string, any> = {}, revalidate = 86400): Promise<T | null> {\n  return serverApiFetch<T>(endpoint, {\n    method: 'POST',\n    body,\n    revalidate,\n    requireKey: true,\n    retry: true,\n    logPrefix: SEO_LOG_PREFIX,\n  })\n}\n\n/** GET from the Portal public API (single attempt, 24h revalidate). Throws if no API key is set. */\nfunction secureApiGet<T>(endpoint: string): Promise<T | null> {\n  return serverApiFetch<T>(endpoint, {\n    method: 'GET',\n    revalidate: 86400,\n    requireKey: true,\n    retry: false,\n    logPrefix: SEO_LOG_PREFIX,\n  })\n}\n\n// ============================================\n// Secure Cached Data Fetchers\n// ============================================\n\n/** Response shape for POST /api/public/seo/page-context */\nexport type PageSeoContext = {\n  page: any | null\n  schemas: any[]\n  project: {\n    id: string\n    title?: string | null\n    /** Resolved site brand (settings.business_name → title/org name). Grounds the managed-title quality gate. */\n    brand?: string | null\n    domain?: string | null\n    logo_url?: string | null\n    site_url?: string | null\n  } | null\n}\n\n/**\n * One Portal round-trip per path (page row + schemas + project).\n * React cache() dedupes when getSEOPageData + getSchemaMarkups run in the same render (e.g. metadata + ManagedSchema).\n * @server-only\n */\nconst loadPageSeoContext = cache(async (path: string): Promise<PageSeoContext | null> => {\n  const result = await secureApiPost<PageSeoContext>('/api/public/seo/page-context', { path })\n  if (!result) return null\n  return {\n    page: result.page ?? null,\n    schemas: Array.isArray(result.schemas) ? result.schemas : [],\n    project: result.project ?? null,\n  }\n})\n\n/**\n * Fetch SEO page data - cached per request\n * @server-only\n */\nexport const getSEOPageData = cache(async (path: string) => {\n  const ctx = await loadPageSeoContext(path)\n  return {\n    page: ctx?.page ?? null,\n    project: ctx?.project ?? null,\n  }\n})\n\n/**\n * Fetch schema markups for a page - cached per request (shares loadPageSeoContext with getSEOPageData)\n * @server-only\n */\nexport const getSchemaMarkups = cache(async (\n  path: string,\n  options?: { includeTypes?: string[]; excludeTypes?: string[] }\n) => {\n  const ctx = await loadPageSeoContext(path)\n  // Single source of truth for the type filter (also applied to\n  // managed_schema in ManagedSchema): an excluded type is pruned wherever it\n  // sits in a row, not only when it's the row's schema_type.\n  return filterSchemaRows(ctx?.schemas ?? [], options)\n})\n\n// Managed FAQs, internal links and content blocks are site-scoped on\n// multi-site projects: a row with no site applies to every host, a row tagged\n// with a host applies only there. So these three reads send `site` in the body\n// via the shared `withSiteBody` (explicit → NEXT_PUBLIC_SITE_URL host →\n// window.location.host, omitted when nothing resolves). The API treats a\n// request with no site as the project's primary domain.\n\n/**\n * Fetch FAQ data for a page - cached per request\n * @param site Sub-site host override; resolves from NEXT_PUBLIC_SITE_URL when omitted\n * @server-only\n */\nexport const getFAQData = cache(async (path: string, site?: string) => {\n  const result = await secureApiPost<{ faq: any }>('/api/public/seo/faq', withSiteBody({ path }, site))\n  return result?.faq || null\n})\n\n/**\n * Fetch internal links for a page - cached per request\n * `options.site`: sub-site host override; resolves from NEXT_PUBLIC_SITE_URL when omitted\n * @server-only\n */\nexport const getInternalLinks = cache(async (\n  sourcePath: string,\n  options?: { position?: string; limit?: number; site?: string }\n) => {\n  const result = await secureApiPost<{ links: any[] }>(\n    '/api/public/seo/internal-links',\n    withSiteBody(\n      {\n        sourcePath,\n        position: options?.position,\n        limit: options?.limit,\n      },\n      options?.site,\n    ),\n  )\n  return result?.links || []\n})\n\n/**\n * Fetch content block - cached per request\n * @param site Sub-site host override; resolves from NEXT_PUBLIC_SITE_URL when omitted\n * @server-only\n */\nexport const getContentBlock = cache(async (path: string, section: string, site?: string) => {\n  const result = await secureApiPost<{ content: any }>('/api/public/seo/content', withSiteBody({ path, section }, site))\n  return result?.content || null\n})\n\n/**\n * Fetch A/B test and determine variant - cached per request\n * @server-only\n */\nexport const getABTest = cache(async (path: string, field: string) => {\n  const result = await secureApiPost<{ test: any }>('/api/public/seo/ab-test', { path, field })\n  return result?.test || null\n})\n\n/**\n * Record A/B test impression\n * @server-only\n */\nexport async function recordABImpression(\n  testId: string,\n  variant: 'a' | 'b',\n  sessionId?: string\n): Promise<void> {\n  await secureApiPost('/api/public/seo/ab-impression', { testId, variant, sessionId })\n}\n\n/**\n * Fetch redirect for a path - cached per request\n * @server-only\n */\nexport const getRedirectData = cache(async (path: string) => {\n  const result = await secureApiPost<{ redirect: any }>('/api/public/seo/redirect', { path })\n  return result?.redirect || null\n})\n\n/**\n * Fetch managed scripts - cached per request\n * @server-only\n */\nexport const getManagedScripts = cache(async (position: string, currentPath?: string) => {\n  const result = await secureApiPost<{ scripts: any[] }>('/api/public/seo/scripts', {\n    position,\n    currentPath,\n  })\n  return result?.scripts || []\n})\n\n/**\n * Fetch robots directive for a page - cached per request\n * @server-only\n */\nexport const getRobotsData = cache(async (path: string) => {\n  const { page } = await getSEOPageData(path)\n  return page?.managed_robots || null\n})\n\n/**\n * Fetch sitemap entries - cached per request\n * @server-only\n */\nexport const getSitemapEntries = cache(async (options?: { publishedOnly?: boolean }) => {\n  const result = await secureApiPost<{ entries: any[] }>('/api/public/seo/sitemap', {\n    publishedOnly: options?.publishedOnly,\n  })\n  return result?.entries || []\n})\n\n/**\n * Register/sync sitemap entries from the client site\n * Call this at build time to populate seo_pages from your sitemap.xml\n * @server-only\n *\n * Defaults to mode 'full-replace', which PRUNES every page missing from\n * `entries`. Pass `{ mode: 'additive' }` unless the list is the whole site.\n *\n * @example\n * ```ts\n * // scripts/register-sitemap.ts (run at build time)\n * import { registerSitemap } from '@sonordev/site-kit/seo/server'\n *\n * await registerSitemap(\n *   [\n *     { path: '/', priority: 1.0, changefreq: 'daily' },\n *     { path: '/about', priority: 0.8, changefreq: 'weekly' },\n *   ],\n *   { mode: 'additive' },\n * )\n * ```\n */\nexport async function registerSitemap(\n  entries: Array<{\n    path: string\n    title?: string\n    priority?: number\n    changefreq?: 'always' | 'hourly' | 'daily' | 'weekly' | 'monthly' | 'yearly' | 'never'\n  }>,\n  options?: {\n    /**\n     * Sync mode:\n     * - 'full-replace': replaces the entire page set (default for build-time sync)\n     * - 'additive': adds/updates pages but never deletes existing ones\n     */\n    mode?: 'additive' | 'full-replace'\n    /**\n     * Sub-site host these pages belong to, on a multi-site project. Defaults\n     * to NEXT_PUBLIC_SITE_URL's host; left off when nothing resolves.\n     */\n    site?: string\n  }\n): Promise<{ success: boolean; created: number; updated: number }> {\n  const { apiUrl, apiKey } = getSecureApiConfig()\n  const mode = options?.mode ?? 'full-replace'\n\n  try {\n    const response = await postRegisterSitemap({ apiUrl, apiKey, entries, mode, site: resolveSyncSite(options?.site) })\n    \n    if (!response.ok) {\n      console.error(`@sonordev/seo: Sitemap registration failed: ${response.statusText}`)\n      return { success: false, created: 0, updated: 0 }\n    }\n    \n    return await response.json()\n  } catch (error) {\n    console.error('@sonordev/seo: Sitemap registration error:', error)\n    return { success: false, created: 0, updated: 0 }\n  }\n}\n\n// ============================================\n// Signal-Powered Metadata Fallback\n// ============================================\n\n/**\n * Ensure metadata exists for a page by triggering Signal AI optimization.\n * If the page has no managed_title or managed_meta_description, Signal will\n * generate them and save to the database via Portal proxy.\n *\n * Idempotent — returns existing metadata if already populated.\n * @server-only\n */\nexport const ensureMetadata = cache(async (path: string): Promise<{\n  managed_title?: string\n  managed_meta_description?: string\n  managed_keywords?: string[]\n  managed_schema?: Record<string, unknown>\n} | null> => {\n  return secureApiPost('/api/public/seo/ensure-metadata', { path })\n})\n\n// ============================================\n// AI Visibility & Entity Graph API (Signal)\n// ============================================\n\nfunction getSignalApiConfig() {\n  const apiUrl = process.env.SONOR_SIGNAL_URL || process.env.SIGNAL_API_URL || process.env.NEXT_PUBLIC_SIGNAL_API_URL || 'https://signal.sonor.io'\n  const apiKey = process.env.SONOR_API_KEY || ''\n  return { apiUrl, apiKey }\n}\n\nasync function signalApiGet<T>(endpoint: string): Promise<T | null> {\n  const { apiUrl, apiKey } = getSignalApiConfig()\n  \n  if (!apiKey) {\n    return null\n  }\n  \n  try {\n    const response = await fetch(`${apiUrl}${endpoint}`, {\n      method: 'GET',\n      headers: {\n        'Content-Type': 'application/json',\n        'x-api-key': apiKey,\n      },\n      next: { revalidate: 300 }, // Cache for 5 minutes\n    })\n    \n    if (!response.ok) {\n      return null\n    }\n    \n    const result = await response.json()\n    return result?.data || result\n  } catch (error) {\n    console.error('@sonordev/seo: Signal API error:', error)\n    return null\n  }\n}\n\n/**\n * Entity types for the knowledge graph\n */\nexport type EntityType = \n  | 'organization'\n  | 'person'\n  | 'service'\n  | 'product'\n  | 'location'\n  | 'concept'\n  | 'credential'\n\n/**\n * Entity from the knowledge graph\n */\nexport interface SEOEntity {\n  id: string\n  project_id: string\n  entity_type: EntityType\n  name: string\n  slug: string\n  properties: Record<string, unknown>\n  knows_about: string[]\n  same_as: string[]\n  schema_type?: string\n  is_primary: boolean\n}\n\n/**\n * Fetch entities for a project - cached per request\n * Returns the entity graph for enhanced schema markup\n * @server-only\n */\nexport const getEntities = cache(async (\n  options?: { type?: EntityType }\n): Promise<SEOEntity[]> => {\n  const { apiKey } = getSecureApiConfig()\n  const projectId = getProjectIdFromKey(apiKey)\n  if (!projectId) return []\n  let endpoint = `/skills/seo/entities/${projectId}`\n  if (options?.type) {\n    endpoint += `?type=${options.type}`\n  }\n  const result = await signalApiGet<SEOEntity[]>(endpoint)\n  return result || []\n})\n\n/**\n * Fetch primary entity (the business) - cached per request\n * @server-only\n */\nexport const getPrimaryEntity = cache(async (): Promise<SEOEntity | null> => {\n  const { apiKey } = getSecureApiConfig()\n  const projectId = getProjectIdFromKey(apiKey)\n  if (!projectId) return null\n  return signalApiGet<SEOEntity>(`/skills/seo/entities/${projectId}/primary`)\n})\n\n/**\n * Fetch entity-enhanced schema for a page\n * Returns Organization schema with knowsAbout, areaServed, employee, etc.\n * @server-only\n */\nexport const getEntityEnhancedSchema = cache(async (pagePath: string): Promise<object[]> => {\n  const { apiKey } = getSecureApiConfig()\n  const projectId = getProjectIdFromKey(apiKey)\n  if (!projectId) return []\n  const result = await signalApiGet<{ schemas: object[] }>(\n    `/skills/seo/schema/${projectId}/entity-enhanced?pagePath=${encodeURIComponent(pagePath)}`\n  )\n  return result?.schemas || []\n})\n\n/**\n * Get AI visibility score for a page\n * @server-only\n */\nexport const getVisibilityScore = cache(async (\n  pagePath: string\n): Promise<{\n  overall_score: number\n  entity_coverage: number\n  answer_density: number\n  chunk_readability: number\n  authority_signals: number\n  schema_completeness: number\n} | null> => {\n  const { apiKey } = getSecureApiConfig()\n  const projectId = getProjectIdFromKey(apiKey)\n  if (!projectId) return null\n  const result = await signalApiGet<any[]>(`/skills/seo/visibility/${projectId}`)\n  if (!result) return null\n  return result.find(s => s.page_path === pagePath) || null\n})\n\n/**\n * Get AI visibility summary for project\n * @server-only\n */\nexport const getVisibilitySummary = cache(async (): Promise<{\n  overall_score: number\n  total_entities: number\n  pages_analyzed: number\n  top_recommendations: Array<{ priority: string; type: string; message: string }>\n} | null> => {\n  const { apiKey } = getSecureApiConfig()\n  const projectId = getProjectIdFromKey(apiKey)\n  if (!projectId) return null\n  return signalApiGet(`/skills/seo/visibility/${projectId}/summary`)\n})\n"]}

package/dist/{chunk-RI25UGHE.mjs → chunk-PJYTYM5G.mjs}

@@ -1,5 +1,5 @@
 import { resolveFetch } from './chunk-BQP6JIE2.mjs';
-import { SITE_KIT_VERSION } from './chunk-TAPCWMBV.mjs';
+import { SITE_KIT_VERSION } from './chunk-2KRAY5NC.mjs';
 import 'server-only';
 
 var MINT_PATH = "/api/public/site-token";
@@ -124,5 +124,5 @@ async function mintWithRetry(rawKey, apiUrl) {
 }
 
 export { resolveClientCredential };
-//# sourceMappingURL=chunk-RI25UGHE.mjs.map
-//# sourceMappingURL=chunk-RI25UGHE.mjs.map
+//# sourceMappingURL=chunk-PJYTYM5G.mjs.map
+//# sourceMappingURL=chunk-PJYTYM5G.mjs.map

package/dist/{chunk-RI25UGHE.mjs.map → chunk-PJYTYM5G.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/mint-site-token.ts"],"names":[],"mappings":";;;;AAgDA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAO1B,IAAM,iBAAA,GAAoB,CAAA;AAC1B,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,mBAAA,GAAsB,GAAA;AAM5B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAO1C,IAAM,QAAA,uBAAe,GAAA,EAA6B;AAElD,IAAM,KAAA,GAAQ,CAAC,EAAA,KAAe,IAAI,OAAA,CAAc,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAOxE,SAAS,YAAA,CAAa,KAAsB,OAAA,EAAyB;AACnE,EAAA,MAAM,MAAA,GAAS,GAAA,EAAK,OAAA,EAAS,GAAA,GAAM,aAAa,CAAA;AAChD,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,OAAA,GAAU,OAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GAC9B,OAAA,GAAU,GAAA,GACV,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,GAAI,IAAA,CAAK,GAAA,EAAI;AAClC,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,EAAE,CAAA,IAAK,EAAA,GAAK,GAAG,OAAO,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,mBAAmB,CAAA;AAAA,EAC5E;AACA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,oBAAA,GAAuB,CAAA,IAAK,SAAS,mBAAmB,CAAA;AAC1E;AAGA,IAAM,iBAAA,GAAoB,CAAC,MAAA,KAAmB,MAAA,KAAW,OAAO,MAAA,IAAU,GAAA;AAM1E,SAAS,kBAAA,GAA8B;AACrC,EAAA,OACE,OAAO,OAAA,KAAY,WAAA,IACnB,OAAA,CAAQ,KAAK,yBAAA,KAA8B,KAAA;AAE/C;AAEA,SAAS,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAgB,GAAA,EAAqB;AACvE,EAAA,IAAI,oBAAmB,EAAG;AACxB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,sCAAsC,MAAM,CAAA,uMAAA;AAAA,KAG9C;AACA,IAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,0CAA0C,MAAM,CAAA,uRAAA;AAAA,GAIlD;AACF;AAsBO,SAAS,kBAAkB,GAAA,EAAuB;AACvD,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AAC5C,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,sBAAA,EAAwB,OAAO,IAAA;AAChD,EAAA,IAAI,CAAA,CAAE,IAAA,KAAS,yBAAA,EAA2B,OAAO,IAAA;AACjD,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,EAAE,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,EAAG,OAAO,IAAA;AACzE,EAAA,IAAI,EAAE,QAAA,qBAAa,MAAA,CAAO,GAAA,CAAI,gBAAgB,GAAG,OAAO,IAAA;AACxD,EAAA,OAAO,KAAA;AACT;AAEA,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,UAAU,MAAA,CAAO,SAAA,GAAY,KAAK,GAAA,EAAI,SAAU,MAAA,CAAO,UAAA;AAG3D,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,SAAS,OAAO,OAAA;AAEpB,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AAC5C,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,OAAO,CAAA;AAC5B,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAA;AAAA,EACf,CAAA,SAAE;AACA,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,EACxB;AACF;AAEA,eAAe,aAAA,CAAc,QAAgB,MAAA,EAAiC;AAC5E,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI,UAAA,GAAa,eAAA;AAEjB,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,iBAAA,EAAmB,OAAA,EAAA,EAAW;AAC5D,IAAA,IAAI,GAAA,GAAuB,IAAA;AAC3B,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,EAAA,EAAI,OAAA,EAAS,SAAA,KAAc,YAAA,EAAa;AAChD,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,QACzC,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,WAAA,EAAa,MAAA;AAAA,UACb,mBAAA,EAAqB;AAAA,SACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMA,GAAI,YAAY,EAAC,GAAK,EAAE,IAAA,EAAM,EAAE,UAAA,EAAY,KAAA,EAAM,EAAE;AAAA,QACpD,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,OACP,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAI,iBAAA,CAAkB,GAAG,CAAA,EAAG,MAAM,GAAA;AAClC,MAAA,UAAA,GAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,eAAA;AAClD,MAAA,IAAI,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACnC,QAAA,MAAM,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AACvC,QAAA;AAAA,MACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,IAAK,SAAA,GAAY,GAAA,GAAQ,CAAA,EAAG,EAAA,GAAK,GAAM;AAAA,SACrE,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,UAAA,GAAa,+BAAA;AACb,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,MAAA,KAAA,CAAM,GAAA,CAAI,MAAA,EAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,WAAW,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,EAAQ,CAAA;AACxE,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,UAAA,GAAa,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAC/B,IAAA,IAAI,kBAAkB,GAAA,CAAI,MAAM,CAAA,IAAK,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACpE,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,EAAK,OAAO,CAAA;AACvC,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,GAAA,CAAI,MAAM,CAAA,cAAA,EAAiB,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA,YAAA,EACrE,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,iBAAiB,CAAA,EAAA;AAAA,OAChD;AACA,MAAA,MAAM,MAAM,KAAK,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA;AAAA,EACF;AAEA,EAAA,OAAO,UAAA,CAAW,UAAA,EAAY,MAAA,EAAQ,IAAA,CAAK,KAAK,CAAA;AAClD","file":"chunk-RI25UGHE.mjs","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * FAILS CLOSED. If minting genuinely fails, this throws and the build fails —\n * it does NOT publish the raw key. A failed deploy is loud and recoverable; a\n * leaked project secret in public HTML is neither. The only paths that still\n * return the raw key are a 404 (an older API that predates the endpoint, an\n * expected state during rollout) and the explicit `SONOR_SITE_TOKEN_FALLBACK=raw`\n * escape hatch, for when shipping beats being blocked.\n *\n * That posture is not academic. Through 3.5.0 a throttled mint (HTTP 429)\n * returned the raw key AND cached it for 60s, so every page rendered in that\n * window shipped the secret: one real build came out with 180 of 272 prerendered\n * pages carrying it. The build \"succeeded\" and nothing downstream noticed.\n * Rate limiting is transient by definition — the fix is to wait and retry, not\n * to downgrade to publishing the key.\n *\n * Two things keep the request count low enough that throttling is rare:\n *  - a module-level memo, so a worker mints once and every page reuses the seed;\n *  - an in-flight map, because that memo is only populated AFTER the await. Next\n *    renders pages concurrently, so without coalescing the first N concurrent\n *    renders in a process all miss the cache and all fire a request — a\n *    stampede per worker, multiplied by one worker per core. That is how a\n *    single site exhausted a 60/min budget.\n *\n * SEED FRESHNESS: a static page's seed carries `iat` = build time, and the API\n * refuses to refresh a seed older than SITE_TOKEN_MAX_REFRESH_AGE_SECONDS\n * (sonor-api common/site-auth/site-token.util.ts — currently 400 days, raised\n * from 30 alongside this fix). A site not rebuilt within that window serves a\n * seed the client cannot refresh, and its forms/analytics/engage start failing\n * for new visitors. Keep that limit comfortably longer than the fleet's\n * realistic redeploy gap; marketing sites routinely go many months untouched.\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\nimport { resolveFetch } from '../shared/fresh-fetch'\n\n// Re-exported for this module's unit tests; the helper lives in shared/fresh-fetch.\nexport { resolveFetch }\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\n/**\n * Retry budget for transient failures (429 / 5xx / network). Rate limiting is\n * measured per minute, so a few seconds of backoff clears it; the whole ladder\n * costs at most ~20s once per build worker, and only when something is wrong.\n */\nconst MINT_MAX_ATTEMPTS = 4\nconst MINT_BACKOFF_BASE_MS = 500\nconst MINT_BACKOFF_CAP_MS = 8_000\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\n/**\n * Requests already in flight, keyed by raw key. The `cache` above is only\n * written after the response lands, so concurrent renders would otherwise each\n * start their own mint. See the module header.\n */\nconst inflight = new Map<string, Promise<string>>()\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\n/**\n * Honour `Retry-After` when the server sends it (delta-seconds or HTTP date),\n * otherwise exponential backoff. Capped so a misconfigured server cannot stall\n * a build indefinitely.\n */\nfunction retryDelayMs(res: Response | null, attempt: number): number {\n  const header = res?.headers?.get?.('retry-after')\n  if (header) {\n    const seconds = Number(header)\n    const ms = Number.isFinite(seconds)\n      ? seconds * 1000\n      : Date.parse(header) - Date.now()\n    if (Number.isFinite(ms) && ms > 0) return Math.min(ms, MINT_BACKOFF_CAP_MS)\n  }\n  return Math.min(MINT_BACKOFF_BASE_MS * 2 ** attempt, MINT_BACKOFF_CAP_MS)\n}\n\n/** 429 and 5xx are transient; waiting is the correct response to both. */\nconst isRetryableStatus = (status: number) => status === 429 || status >= 500\n\n/**\n * The escape hatch, for when a broken mint must not block a release. Opt-in and\n * loud: it re-enables publishing the project secret in page HTML.\n */\nfunction rawFallbackAllowed(): boolean {\n  return (\n    typeof process !== 'undefined' &&\n    process.env?.SONOR_SITE_TOKEN_FALLBACK === 'raw'\n  )\n}\n\nfunction failClosed(reason: string, rawKey: string, now: number): string {\n  if (rawFallbackAllowed()) {\n    console.warn(\n      `[SiteKitLayout] Token mint failed (${reason}) and SONOR_SITE_TOKEN_FALLBACK=raw is set; ` +\n        'injecting the RAW API KEY into page HTML. The key is publicly readable wherever ' +\n        'this page is served — unset the escape hatch once the mint is healthy.',\n    )\n    cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n    return rawKey\n  }\n  throw new Error(\n    `site-kit: could not mint a site token (${reason}). Refusing to publish the raw ` +\n      'SONOR_API_KEY in page HTML, so this build fails instead. Check that the mint ' +\n      'endpoint is reachable and the key is valid, then rebuild. To ship anyway — ' +\n      'which publishes the project secret in public HTML — set SONOR_SITE_TOKEN_FALLBACK=raw.',\n  )\n}\n\n/*\n * The mint uses Next's saved original fetch (resolveFetch, shared/fresh-fetch.ts,\n * which documents why). A credential is not page data: `cache: 'no-store'` would\n * bail a static route before the request goes out (verified on Next 16.2.9: the\n * mint endpoint received zero requests for a static build, and every page\n * shipped the raw key), and a Data Cache entry would let a fresh deploy re-bake a\n * months-old seed. The module-level memo above is the only cache we want: one\n * mint per build process, and a build-fresh seed on every deploy.\n */\n\n/**\n * Next signals \"this render must go dynamic\" by THROWING (DynamicServerError,\n * static-gen bailout, redirect/notFound digests, React's postpone). Those are\n * the framework's control flow, not a mint failure. Swallowing one makes Next\n * believe the render succeeded statically — which is precisely how the raw key\n * ended up stranded in prerendered HTML with no error anywhere. Let them\n * propagate; only real network/HTTP failures fall back to the raw key.\n *\n * @internal Exported for unit tests; not part of the package's public API.\n */\nexport function isFrameworkSignal(err: unknown): boolean {\n  if (!err || typeof err !== 'object') return false\n  const e = err as { digest?: unknown; code?: unknown; $$typeof?: unknown }\n  if (e.digest === 'DYNAMIC_SERVER_USAGE') return true\n  if (e.code === 'NEXT_STATIC_GEN_BAILOUT') return true\n  if (typeof e.digest === 'string' && e.digest.startsWith('NEXT_')) return true\n  if (e.$$typeof === Symbol.for('react.postpone')) return true\n  return false\n}\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > Date.now()) return cached.credential\n\n  // Collapse concurrent renders onto one request rather than a stampede.\n  const pending = inflight.get(rawKey)\n  if (pending) return pending\n\n  const request = mintWithRetry(rawKey, apiUrl)\n  inflight.set(rawKey, request)\n  try {\n    return await request\n  } finally {\n    inflight.delete(rawKey)\n  }\n}\n\nasync function mintWithRetry(rawKey: string, apiUrl: string): Promise<string> {\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  let lastReason = 'unknown error'\n\n  for (let attempt = 0; attempt < MINT_MAX_ATTEMPTS; attempt++) {\n    let res: Response | null = null\n    try {\n      const { fn: fetchFn, unpatched } = resolveFetch()\n      res = await fetchFn(`${base}${MINT_PATH}`, {\n        method: 'POST',\n        headers: {\n          'content-type': 'application/json',\n          'x-api-key': rawKey,\n          'x-sitekit-version': SITE_KIT_VERSION,\n        },\n        // Only meaningful on the fallback path, where a future Next stopped\n        // exposing `_nextOriginalFetch` and we're back on the patched fetch.\n        // `revalidate: false` is the one setting that neither bails out of static\n        // generation nor downgrades the route to ISR; a Data Cache entry is the\n        // lesser evil versus shipping the raw key again.\n        ...(unpatched ? {} : ({ next: { revalidate: false } } as RequestInit)),\n        signal:\n          typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n            ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n            : undefined,\n      })\n    } catch (err) {\n      // Never swallow the framework's own control flow — see isFrameworkSignal.\n      if (isFrameworkSignal(err)) throw err\n      lastReason = err instanceof Error ? err.message : 'network error'\n      if (attempt < MINT_MAX_ATTEMPTS - 1) {\n        await sleep(retryDelayMs(null, attempt))\n        continue\n      }\n      break\n    }\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: Date.now() + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n      lastReason = 'mint returned no usable token'\n      break\n    }\n\n    // 404 = an API older than the endpoint. Expected during rollout, and the raw\n    // key is exactly what such an API still expects, so this stays a fallback\n    // rather than a build failure.\n    if (res.status === 404) {\n      cache.set(rawKey, { credential: rawKey, expiresAt: Date.now() + 60_000 })\n      return rawKey\n    }\n\n    lastReason = `HTTP ${res.status}`\n    if (isRetryableStatus(res.status) && attempt < MINT_MAX_ATTEMPTS - 1) {\n      const delay = retryDelayMs(res, attempt)\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; retrying in ${Math.round(delay)}ms ` +\n          `(attempt ${attempt + 2}/${MINT_MAX_ATTEMPTS}).`,\n      )\n      await sleep(delay)\n      continue\n    }\n    break\n  }\n\n  return failClosed(lastReason, rawKey, Date.now())\n}\n"]}
+{"version":3,"sources":["../src/server/mint-site-token.ts"],"names":[],"mappings":";;;;AAgDA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAO1B,IAAM,iBAAA,GAAoB,CAAA;AAC1B,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,mBAAA,GAAsB,GAAA;AAM5B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAO1C,IAAM,QAAA,uBAAe,GAAA,EAA6B;AAElD,IAAM,KAAA,GAAQ,CAAC,EAAA,KAAe,IAAI,OAAA,CAAc,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAOxE,SAAS,YAAA,CAAa,KAAsB,OAAA,EAAyB;AACnE,EAAA,MAAM,MAAA,GAAS,GAAA,EAAK,OAAA,EAAS,GAAA,GAAM,aAAa,CAAA;AAChD,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,OAAA,GAAU,OAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GAC9B,OAAA,GAAU,GAAA,GACV,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,GAAI,IAAA,CAAK,GAAA,EAAI;AAClC,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,EAAE,CAAA,IAAK,EAAA,GAAK,GAAG,OAAO,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,mBAAmB,CAAA;AAAA,EAC5E;AACA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,oBAAA,GAAuB,CAAA,IAAK,SAAS,mBAAmB,CAAA;AAC1E;AAGA,IAAM,iBAAA,GAAoB,CAAC,MAAA,KAAmB,MAAA,KAAW,OAAO,MAAA,IAAU,GAAA;AAM1E,SAAS,kBAAA,GAA8B;AACrC,EAAA,OACE,OAAO,OAAA,KAAY,WAAA,IACnB,OAAA,CAAQ,KAAK,yBAAA,KAA8B,KAAA;AAE/C;AAEA,SAAS,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAgB,GAAA,EAAqB;AACvE,EAAA,IAAI,oBAAmB,EAAG;AACxB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,sCAAsC,MAAM,CAAA,uMAAA;AAAA,KAG9C;AACA,IAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,0CAA0C,MAAM,CAAA,uRAAA;AAAA,GAIlD;AACF;AAsBO,SAAS,kBAAkB,GAAA,EAAuB;AACvD,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AAC5C,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,sBAAA,EAAwB,OAAO,IAAA;AAChD,EAAA,IAAI,CAAA,CAAE,IAAA,KAAS,yBAAA,EAA2B,OAAO,IAAA;AACjD,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,EAAE,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,EAAG,OAAO,IAAA;AACzE,EAAA,IAAI,EAAE,QAAA,qBAAa,MAAA,CAAO,GAAA,CAAI,gBAAgB,GAAG,OAAO,IAAA;AACxD,EAAA,OAAO,KAAA;AACT;AAEA,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,UAAU,MAAA,CAAO,SAAA,GAAY,KAAK,GAAA,EAAI,SAAU,MAAA,CAAO,UAAA;AAG3D,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,SAAS,OAAO,OAAA;AAEpB,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AAC5C,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,OAAO,CAAA;AAC5B,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAA;AAAA,EACf,CAAA,SAAE;AACA,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,EACxB;AACF;AAEA,eAAe,aAAA,CAAc,QAAgB,MAAA,EAAiC;AAC5E,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI,UAAA,GAAa,eAAA;AAEjB,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,iBAAA,EAAmB,OAAA,EAAA,EAAW;AAC5D,IAAA,IAAI,GAAA,GAAuB,IAAA;AAC3B,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,EAAA,EAAI,OAAA,EAAS,SAAA,KAAc,YAAA,EAAa;AAChD,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,QACzC,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,WAAA,EAAa,MAAA;AAAA,UACb,mBAAA,EAAqB;AAAA,SACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMA,GAAI,YAAY,EAAC,GAAK,EAAE,IAAA,EAAM,EAAE,UAAA,EAAY,KAAA,EAAM,EAAE;AAAA,QACpD,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,OACP,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAI,iBAAA,CAAkB,GAAG,CAAA,EAAG,MAAM,GAAA;AAClC,MAAA,UAAA,GAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,eAAA;AAClD,MAAA,IAAI,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACnC,QAAA,MAAM,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AACvC,QAAA;AAAA,MACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,IAAK,SAAA,GAAY,GAAA,GAAQ,CAAA,EAAG,EAAA,GAAK,GAAM;AAAA,SACrE,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,UAAA,GAAa,+BAAA;AACb,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,MAAA,KAAA,CAAM,GAAA,CAAI,MAAA,EAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,WAAW,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,EAAQ,CAAA;AACxE,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,UAAA,GAAa,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAC/B,IAAA,IAAI,kBAAkB,GAAA,CAAI,MAAM,CAAA,IAAK,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACpE,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,EAAK,OAAO,CAAA;AACvC,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,GAAA,CAAI,MAAM,CAAA,cAAA,EAAiB,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA,YAAA,EACrE,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,iBAAiB,CAAA,EAAA;AAAA,OAChD;AACA,MAAA,MAAM,MAAM,KAAK,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA;AAAA,EACF;AAEA,EAAA,OAAO,UAAA,CAAW,UAAA,EAAY,MAAA,EAAQ,IAAA,CAAK,KAAK,CAAA;AAClD","file":"chunk-PJYTYM5G.mjs","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * FAILS CLOSED. If minting genuinely fails, this throws and the build fails —\n * it does NOT publish the raw key. A failed deploy is loud and recoverable; a\n * leaked project secret in public HTML is neither. The only paths that still\n * return the raw key are a 404 (an older API that predates the endpoint, an\n * expected state during rollout) and the explicit `SONOR_SITE_TOKEN_FALLBACK=raw`\n * escape hatch, for when shipping beats being blocked.\n *\n * That posture is not academic. Through 3.5.0 a throttled mint (HTTP 429)\n * returned the raw key AND cached it for 60s, so every page rendered in that\n * window shipped the secret: one real build came out with 180 of 272 prerendered\n * pages carrying it. The build \"succeeded\" and nothing downstream noticed.\n * Rate limiting is transient by definition — the fix is to wait and retry, not\n * to downgrade to publishing the key.\n *\n * Two things keep the request count low enough that throttling is rare:\n *  - a module-level memo, so a worker mints once and every page reuses the seed;\n *  - an in-flight map, because that memo is only populated AFTER the await. Next\n *    renders pages concurrently, so without coalescing the first N concurrent\n *    renders in a process all miss the cache and all fire a request — a\n *    stampede per worker, multiplied by one worker per core. That is how a\n *    single site exhausted a 60/min budget.\n *\n * SEED FRESHNESS: a static page's seed carries `iat` = build time, and the API\n * refuses to refresh a seed older than SITE_TOKEN_MAX_REFRESH_AGE_SECONDS\n * (sonor-api common/site-auth/site-token.util.ts — currently 400 days, raised\n * from 30 alongside this fix). A site not rebuilt within that window serves a\n * seed the client cannot refresh, and its forms/analytics/engage start failing\n * for new visitors. Keep that limit comfortably longer than the fleet's\n * realistic redeploy gap; marketing sites routinely go many months untouched.\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\nimport { resolveFetch } from '../shared/fresh-fetch'\n\n// Re-exported for this module's unit tests; the helper lives in shared/fresh-fetch.\nexport { resolveFetch }\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\n/**\n * Retry budget for transient failures (429 / 5xx / network). Rate limiting is\n * measured per minute, so a few seconds of backoff clears it; the whole ladder\n * costs at most ~20s once per build worker, and only when something is wrong.\n */\nconst MINT_MAX_ATTEMPTS = 4\nconst MINT_BACKOFF_BASE_MS = 500\nconst MINT_BACKOFF_CAP_MS = 8_000\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\n/**\n * Requests already in flight, keyed by raw key. The `cache` above is only\n * written after the response lands, so concurrent renders would otherwise each\n * start their own mint. See the module header.\n */\nconst inflight = new Map<string, Promise<string>>()\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\n/**\n * Honour `Retry-After` when the server sends it (delta-seconds or HTTP date),\n * otherwise exponential backoff. Capped so a misconfigured server cannot stall\n * a build indefinitely.\n */\nfunction retryDelayMs(res: Response | null, attempt: number): number {\n  const header = res?.headers?.get?.('retry-after')\n  if (header) {\n    const seconds = Number(header)\n    const ms = Number.isFinite(seconds)\n      ? seconds * 1000\n      : Date.parse(header) - Date.now()\n    if (Number.isFinite(ms) && ms > 0) return Math.min(ms, MINT_BACKOFF_CAP_MS)\n  }\n  return Math.min(MINT_BACKOFF_BASE_MS * 2 ** attempt, MINT_BACKOFF_CAP_MS)\n}\n\n/** 429 and 5xx are transient; waiting is the correct response to both. */\nconst isRetryableStatus = (status: number) => status === 429 || status >= 500\n\n/**\n * The escape hatch, for when a broken mint must not block a release. Opt-in and\n * loud: it re-enables publishing the project secret in page HTML.\n */\nfunction rawFallbackAllowed(): boolean {\n  return (\n    typeof process !== 'undefined' &&\n    process.env?.SONOR_SITE_TOKEN_FALLBACK === 'raw'\n  )\n}\n\nfunction failClosed(reason: string, rawKey: string, now: number): string {\n  if (rawFallbackAllowed()) {\n    console.warn(\n      `[SiteKitLayout] Token mint failed (${reason}) and SONOR_SITE_TOKEN_FALLBACK=raw is set; ` +\n        'injecting the RAW API KEY into page HTML. The key is publicly readable wherever ' +\n        'this page is served — unset the escape hatch once the mint is healthy.',\n    )\n    cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n    return rawKey\n  }\n  throw new Error(\n    `site-kit: could not mint a site token (${reason}). Refusing to publish the raw ` +\n      'SONOR_API_KEY in page HTML, so this build fails instead. Check that the mint ' +\n      'endpoint is reachable and the key is valid, then rebuild. To ship anyway — ' +\n      'which publishes the project secret in public HTML — set SONOR_SITE_TOKEN_FALLBACK=raw.',\n  )\n}\n\n/*\n * The mint uses Next's saved original fetch (resolveFetch, shared/fresh-fetch.ts,\n * which documents why). A credential is not page data: `cache: 'no-store'` would\n * bail a static route before the request goes out (verified on Next 16.2.9: the\n * mint endpoint received zero requests for a static build, and every page\n * shipped the raw key), and a Data Cache entry would let a fresh deploy re-bake a\n * months-old seed. The module-level memo above is the only cache we want: one\n * mint per build process, and a build-fresh seed on every deploy.\n */\n\n/**\n * Next signals \"this render must go dynamic\" by THROWING (DynamicServerError,\n * static-gen bailout, redirect/notFound digests, React's postpone). Those are\n * the framework's control flow, not a mint failure. Swallowing one makes Next\n * believe the render succeeded statically — which is precisely how the raw key\n * ended up stranded in prerendered HTML with no error anywhere. Let them\n * propagate; only real network/HTTP failures fall back to the raw key.\n *\n * @internal Exported for unit tests; not part of the package's public API.\n */\nexport function isFrameworkSignal(err: unknown): boolean {\n  if (!err || typeof err !== 'object') return false\n  const e = err as { digest?: unknown; code?: unknown; $$typeof?: unknown }\n  if (e.digest === 'DYNAMIC_SERVER_USAGE') return true\n  if (e.code === 'NEXT_STATIC_GEN_BAILOUT') return true\n  if (typeof e.digest === 'string' && e.digest.startsWith('NEXT_')) return true\n  if (e.$$typeof === Symbol.for('react.postpone')) return true\n  return false\n}\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > Date.now()) return cached.credential\n\n  // Collapse concurrent renders onto one request rather than a stampede.\n  const pending = inflight.get(rawKey)\n  if (pending) return pending\n\n  const request = mintWithRetry(rawKey, apiUrl)\n  inflight.set(rawKey, request)\n  try {\n    return await request\n  } finally {\n    inflight.delete(rawKey)\n  }\n}\n\nasync function mintWithRetry(rawKey: string, apiUrl: string): Promise<string> {\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  let lastReason = 'unknown error'\n\n  for (let attempt = 0; attempt < MINT_MAX_ATTEMPTS; attempt++) {\n    let res: Response | null = null\n    try {\n      const { fn: fetchFn, unpatched } = resolveFetch()\n      res = await fetchFn(`${base}${MINT_PATH}`, {\n        method: 'POST',\n        headers: {\n          'content-type': 'application/json',\n          'x-api-key': rawKey,\n          'x-sitekit-version': SITE_KIT_VERSION,\n        },\n        // Only meaningful on the fallback path, where a future Next stopped\n        // exposing `_nextOriginalFetch` and we're back on the patched fetch.\n        // `revalidate: false` is the one setting that neither bails out of static\n        // generation nor downgrades the route to ISR; a Data Cache entry is the\n        // lesser evil versus shipping the raw key again.\n        ...(unpatched ? {} : ({ next: { revalidate: false } } as RequestInit)),\n        signal:\n          typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n            ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n            : undefined,\n      })\n    } catch (err) {\n      // Never swallow the framework's own control flow — see isFrameworkSignal.\n      if (isFrameworkSignal(err)) throw err\n      lastReason = err instanceof Error ? err.message : 'network error'\n      if (attempt < MINT_MAX_ATTEMPTS - 1) {\n        await sleep(retryDelayMs(null, attempt))\n        continue\n      }\n      break\n    }\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: Date.now() + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n      lastReason = 'mint returned no usable token'\n      break\n    }\n\n    // 404 = an API older than the endpoint. Expected during rollout, and the raw\n    // key is exactly what such an API still expects, so this stays a fallback\n    // rather than a build failure.\n    if (res.status === 404) {\n      cache.set(rawKey, { credential: rawKey, expiresAt: Date.now() + 60_000 })\n      return rawKey\n    }\n\n    lastReason = `HTTP ${res.status}`\n    if (isRetryableStatus(res.status) && attempt < MINT_MAX_ATTEMPTS - 1) {\n      const delay = retryDelayMs(res, attempt)\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; retrying in ${Math.round(delay)}ms ` +\n          `(attempt ${attempt + 2}/${MINT_MAX_ATTEMPTS}).`,\n      )\n      await sleep(delay)\n      continue\n    }\n    break\n  }\n\n  return failClosed(lastReason, rawKey, Date.now())\n}\n"]}

package/dist/{chunk-DO6ATNLN.js → chunk-PRAHDLKT.js}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkHX6ZG3PP_js = require('./chunk-HX6ZG3PP.js');
+var chunkEMHSHAVW_js = require('./chunk-EMHSHAVW.js');
 var jsxRuntime = require('react/jsx-runtime');
 
 function NewsletterShell({
@@ -14,8 +14,8 @@ function NewsletterShell({
   successMessage,
   errorMessage
 }) {
-  return /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { ...chunkHX6ZG3PP_js.widgetStyle, backgroundColor: "rgba(var(--sk-primary-rgb), 0.1)" }, children: [
-    /* @__PURE__ */ jsxRuntime.jsx("h4", { style: { ...chunkHX6ZG3PP_js.widgetTitleStyle, color: "var(--sk-primary)" }, children: title }),
+  return /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { ...chunkEMHSHAVW_js.widgetStyle, backgroundColor: "rgba(var(--sk-primary-rgb), 0.1)" }, children: [
+    /* @__PURE__ */ jsxRuntime.jsx("h4", { style: { ...chunkEMHSHAVW_js.widgetTitleStyle, color: "var(--sk-primary)" }, children: title }),
     status === "success" ? /* @__PURE__ */ jsxRuntime.jsx("p", { style: { fontSize: 14, color: "var(--sk-text-secondary)", margin: 0 }, children: successMessage }) : /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
       /* @__PURE__ */ jsxRuntime.jsx("p", { style: { fontSize: 14, color: "var(--sk-text-secondary)", marginBottom: 16 }, children: description }),
       /* @__PURE__ */ jsxRuntime.jsxs("form", { onSubmit: onFormSubmit, style: { display: "flex", gap: 8 }, children: [
@@ -63,5 +63,5 @@ function NewsletterShell({
 }
 
 exports.NewsletterShell = NewsletterShell;
-//# sourceMappingURL=chunk-DO6ATNLN.js.map
-//# sourceMappingURL=chunk-DO6ATNLN.js.map
+//# sourceMappingURL=chunk-PRAHDLKT.js.map
+//# sourceMappingURL=chunk-PRAHDLKT.js.map

package/dist/chunk-PRAHDLKT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/articles/NewsletterShell.tsx"],"names":["jsxs","widgetStyle","jsx","widgetTitleStyle","Fragment"],"mappings":";;;;;AAsBO,SAAS,eAAA,CAAgB;AAAA,EAC9B,KAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,KAAA;AAAA,EACA,aAAA;AAAA,EACA,YAAA;AAAA,EACA,MAAA;AAAA,EACA,cAAA;AAAA,EACA;AACF,CAAA,EAAyB;AACvB,EAAA,uBACEA,eAAA,CAAC,SAAI,KAAA,EAAO,EAAE,GAAGC,4BAAA,EAAa,eAAA,EAAiB,oCAAmC,EAChF,QAAA,EAAA;AAAA,oBAAAC,cAAA,CAAC,IAAA,EAAA,EAAG,OAAO,EAAE,GAAGC,mCAAkB,KAAA,EAAO,mBAAA,IAAwB,QAAA,EAAA,KAAA,EAAM,CAAA;AAAA,IACtE,MAAA,KAAW,SAAA,mBACVD,cAAA,CAAC,GAAA,EAAA,EAAE,OAAO,EAAE,QAAA,EAAU,EAAA,EAAI,KAAA,EAAO,4BAA4B,MAAA,EAAQ,CAAA,EAAE,EACpE,QAAA,EAAA,cAAA,EACH,oBAEAF,eAAA,CAAAI,mBAAA,EAAA,EACE,QAAA,EAAA;AAAA,sBAAAF,cAAA,CAAC,GAAA,EAAA,EAAE,KAAA,EAAO,EAAE,QAAA,EAAU,EAAA,EAAI,OAAO,0BAAA,EAA4B,YAAA,EAAc,EAAA,EAAG,EAC3E,QAAA,EAAA,WAAA,EACH,CAAA;AAAA,sBACAF,eAAA,CAAC,MAAA,EAAA,EAAK,QAAA,EAAU,YAAA,EAAc,KAAA,EAAO,EAAE,OAAA,EAAS,MAAA,EAAQ,GAAA,EAAK,CAAA,EAAE,EAC7D,QAAA,EAAA;AAAA,wBAAAE,cAAA;AAAA,UAAC,OAAA;AAAA,UAAA;AAAA,YACC,IAAA,EAAK,OAAA;AAAA,YACL,IAAA,EAAK,OAAA;AAAA,YACL,WAAA,EAAY,kBAAA;AAAA,YACZ,QAAA,EAAQ,IAAA;AAAA,YACR,KAAA,EAAO,KAAA;AAAA,YACP,UAAU,CAAC,CAAA,KAAM,aAAA,CAAc,CAAA,CAAE,OAAO,KAAK,CAAA;AAAA,YAC7C,UAAU,MAAA,KAAW,YAAA;AAAA,YACrB,KAAA,EAAO;AAAA,cACL,IAAA,EAAM,CAAA;AAAA,cACN,OAAA,EAAS,WAAA;AAAA,cACT,MAAA,EAAQ,4BAAA;AAAA,cACR,YAAA,EAAc,CAAA;AAAA,cACd,QAAA,EAAU;AAAA;AACZ;AAAA,SACF;AAAA,wBACAA,cAAA;AAAA,UAAC,QAAA;AAAA,UAAA;AAAA,YACC,IAAA,EAAK,QAAA;AAAA,YACL,UAAU,MAAA,KAAW,YAAA;AAAA,YACrB,KAAA,EAAO;AAAA,cACL,OAAA,EAAS,WAAA;AAAA,cACT,eAAA,EAAiB,mBAAA;AAAA,cACjB,KAAA,EAAO,cAAA;AAAA,cACP,MAAA,EAAQ,MAAA;AAAA,cACR,YAAA,EAAc,CAAA;AAAA,cACd,QAAA,EAAU,EAAA;AAAA,cACV,UAAA,EAAY,GAAA;AAAA,cACZ,MAAA,EAAQ,MAAA,KAAW,YAAA,GAAe,MAAA,GAAS;AAAA,aAC7C;AAAA,YAEC,QAAA,EAAA,MAAA,KAAW,eAAe,QAAA,GAAM;AAAA;AAAA;AACnC,OAAA,EACF,CAAA;AAAA,MACC,MAAA,KAAW,OAAA,oBACVA,cAAA,CAAC,GAAA,EAAA,EAAE,OAAO,EAAE,QAAA,EAAU,EAAA,EAAI,KAAA,EAAO,0BAAA,EAA4B,MAAA,EAAQ,SAAA,EAAU,EAC5E,0BAAgB,yCAAA,EACnB;AAAA,KAAA,EAEJ;AAAA,GAAA,EAEJ,CAAA;AAEJ","file":"chunk-PRAHDLKT.js","sourcesContent":["'use client'\n\n/**\n * Presentational shell shared by NewsletterWidget's two modes. No data\n * imports — keep it that way, it renders in the eager article bundle.\n */\n\nimport React from 'react'\nimport { widgetStyle, widgetTitleStyle } from './widget-styles'\n\nexport interface NewsletterShellProps {\n  title: string\n  description: string\n  buttonText: string\n  email: string\n  onEmailChange: (value: string) => void\n  onFormSubmit: (e: React.FormEvent) => void\n  status: 'idle' | 'submitting' | 'success' | 'error'\n  successMessage: string\n  errorMessage?: string | null\n}\n\nexport function NewsletterShell({\n  title,\n  description,\n  buttonText,\n  email,\n  onEmailChange,\n  onFormSubmit,\n  status,\n  successMessage,\n  errorMessage,\n}: NewsletterShellProps) {\n  return (\n    <div style={{ ...widgetStyle, backgroundColor: 'rgba(var(--sk-primary-rgb), 0.1)' }}>\n      <h4 style={{ ...widgetTitleStyle, color: 'var(--sk-primary)' }}>{title}</h4>\n      {status === 'success' ? (\n        <p style={{ fontSize: 14, color: 'var(--sk-text-secondary)', margin: 0 }}>\n          {successMessage}\n        </p>\n      ) : (\n        <>\n          <p style={{ fontSize: 14, color: 'var(--sk-text-secondary)', marginBottom: 16 }}>\n            {description}\n          </p>\n          <form onSubmit={onFormSubmit} style={{ display: 'flex', gap: 8 }}>\n            <input\n              type=\"email\"\n              name=\"email\"\n              placeholder=\"Enter your email\"\n              required\n              value={email}\n              onChange={(e) => onEmailChange(e.target.value)}\n              disabled={status === 'submitting'}\n              style={{\n                flex: 1,\n                padding: '10px 12px',\n                border: '1px solid var(--sk-border)',\n                borderRadius: 8,\n                fontSize: 14,\n              }}\n            />\n            <button\n              type=\"submit\"\n              disabled={status === 'submitting'}\n              style={{\n                padding: '10px 16px',\n                backgroundColor: 'var(--sk-primary)',\n                color: 'var(--sk-bg)',\n                border: 'none',\n                borderRadius: 8,\n                fontSize: 14,\n                fontWeight: 500,\n                cursor: status === 'submitting' ? 'wait' : 'pointer',\n              }}\n            >\n              {status === 'submitting' ? '…' : buttonText}\n            </button>\n          </form>\n          {status === 'error' && (\n            <p style={{ fontSize: 13, color: 'var(--sk-error, #dc2626)', margin: '8px 0 0' }}>\n              {errorMessage || 'Something went wrong. Please try again.'}\n            </p>\n          )}\n        </>\n      )}\n    </div>\n  )\n}\n"]}

package/dist/{chunk-RQOKQC7J.mjs → chunk-QEM2F2DC.mjs}

@@ -1,5 +1,5 @@
 'use client';
-import { sonorFetch } from './chunk-3EXBBFXX.mjs';
+import { sonorFetch } from './chunk-2YSB4FIC.mjs';
 import { useState, useRef, useMemo, useCallback, useEffect, useId } from 'react';
 import { jsxs, jsx, Fragment } from 'react/jsx-runtime';
 
@@ -1412,5 +1412,5 @@ var WIDGET_CSS = `
 `;
 
 export { BookingWidget, createBooking, createSlotHold, detectTimezone, fetchAvailability, fetchAvailableDates, fetchBookingTypeDetails, fetchBookingTypes, formatDate, formatDuration, formatTime, prepareMeeting, releaseSlotHold };
-//# sourceMappingURL=chunk-RQOKQC7J.mjs.map
-//# sourceMappingURL=chunk-RQOKQC7J.mjs.map
+//# sourceMappingURL=chunk-QEM2F2DC.mjs.map
+//# sourceMappingURL=chunk-QEM2F2DC.mjs.map