@sonordev/site-kit 5.8.3 → 6.0.1

package/dist/{chunk-I3ND4XYW.js.map → chunk-4BEGKFMN.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/redirects/index.ts"],"names":["getSiteConfig","resolveSiteHost","withSiteParam","NextResponse","withSiteBody"],"mappings":";;;;;;;AAqEA,IAAM,kBAAA,GAAqB,sBAAA;AAO3B,SAAS,SAAA,GAAgC;AACvC,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,KAAY,WAAA,IAAe,QAAQ,GAAA,GAAM,OAAA,CAAQ,IAAI,aAAA,GAAgB,MAAA;AACxF,EAAA,OAAO,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,GAAM,GAAA,GAAM,MAAA;AAChD;AACA,IAAM,wBAAA,GAA2B,GAAA;AAKjC,IAAM,mBAAA,GAAsB,GAAA;AAQrB,IAAM,cAAA,GAAiB;AAG9B,IAAM,UAAA,uBAAiB,GAAA,EAAuD;AAO9E,SAAS,mBAAA,CAAoB,MAAA,EAA4B,MAAA,EAA4B,IAAA,EAAsB;AACzG,EAAA,MAAM,QAAQ,MAAA,GAAS,CAAA,IAAA,EAAO,MAAM,CAAA,CAAA,GAAK,CAAA,OAAA,EAAU,UAAU,EAAE,CAAA,CAAA;AAC/D,EAAA,OAAO,CAAA,EAAG,KAAK,CAAA,MAAA,EAAS,IAAI,CAAA,CAAA;AAC9B;AAQA,eAAsB,mBAAmB,MAAA,EAAiD;AACxF,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,YAAA,GAAe,OAAO,YAAA,IAAgB,GAAA;AAC5C,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,YAAA,IAAgB,SAAA,EAAU,IAAK,kBAAA;AAEtD,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,KAAW,OAAO,OAAA,KAAY,eAAe,OAAA,CAAQ,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,aAAA,GAAgB,MAAA,CAAA;AAC7G,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,KAAW,QAAA,GAAW,MAAA,GAAS,MAAA;AACrD,EAAA,IAAI,SAAS,MAAA,CAAO,MAAA;AAEpB,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,MAAA,EAAQ;AACtB,IAAA,MAAM,aAAa,MAAMA,8BAAA,CAAc,EAAE,MAAA,EAAQ,SAAS,CAAA;AAC1D,IAAA,MAAA,GAAS,UAAA,EAAY,MAAA;AAAA,EACvB;AAIA,EAAA,MAAM,IAAA,GAAOC,gCAAA,CAAgB,MAAA,CAAO,IAAI,CAAA;AACxC,EAAA,MAAM,QAAA,GAAW,mBAAA,CAAoB,MAAA,EAAQ,MAAA,EAAQ,IAAI,CAAA;AACzD,EAAA,MAAM,MAAA,GAAS,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA;AACtC,EAAA,IAAI,MAAA,IAAU,GAAA,GAAM,MAAA,CAAO,MAAA,EAAQ;AACjC,IAAA,OAAO,MAAA,CAAO,KAAA;AAAA,EAChB;AAEA,EAAA,IAAI;AACF,IAAA,IAAI,GAAA;AACJ,IAAA,MAAM,OAAA,GAAkC,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAE7E,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,GAAA,GAAMC,8BAAA,CAAc,CAAA,EAAG,OAAO,CAAA,yBAAA,CAAA,EAA6B,IAAI,CAAA;AAC/D,MAAA,OAAA,CAAQ,WAAW,CAAA,GAAI,MAAA;AAAA,IACzB,WAAW,MAAA,EAAQ;AACjB,MAAA,GAAA,GAAMA,8BAAA,CAAc,GAAG,OAAO,CAAA,iCAAA,EAAoC,mBAAmB,MAAM,CAAC,IAAI,IAAI,CAAA;AAAA,IACtG,CAAA,MAAO;AACL,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,SAAA,GAAY,OAAO,cAAA,IAAkB,wBAAA;AAG3C,IAAA,MAAM,MAAA,GACJ,OAAO,WAAA,KAAgB,WAAA,IAAe,OAAO,WAAA,CAAY,OAAA,KAAY,UAAA,GACjE,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA,GAC7B,KAAA,CAAA;AAEN,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,MAC3B,OAAA;AAAA,MACA,MAAA;AAAA;AAAA;AAAA,MAGA,IAAA,EAAM,EAAE,UAAA,EAAY,YAAA;AAAa,KAClC,CAAA;AAED,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,sCAAA,EAAyC,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AACnE,MAAA,UAAA,CAAW,GAAA,CAAI,QAAA,EAAU,EAAE,KAAA,EAAO,MAAA,EAAQ,KAAA,IAAS,EAAC,EAAG,MAAA,EAAQ,GAAA,GAAM,mBAAA,EAAqB,CAAA;AAC1F,MAAA,OAAO,MAAA,EAAQ,SAAS,EAAC;AAAA,IAC3B;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,MAAM,KAAA,GAAA,CAAS,KAAK,SAAA,IAAa,IAAI,MAAA,CAAO,CAAC,CAAA,KAAoB,CAAA,CAAE,UAAU,CAAA;AAC7E,IAAA,UAAA,CAAW,GAAA,CAAI,UAAU,EAAE,KAAA,EAAO,QAAQ,GAAA,GAAM,YAAA,GAAe,KAAM,CAAA;AACrE,IAAA,OAAO,KAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,wCAAwC,KAAK,CAAA;AAC3D,IAAA,UAAA,CAAW,GAAA,CAAI,QAAA,EAAU,EAAE,KAAA,EAAO,MAAA,EAAQ,KAAA,IAAS,EAAC,EAAG,MAAA,EAAQ,GAAA,GAAM,mBAAA,EAAqB,CAAA;AAC1F,IAAA,OAAO,MAAA,EAAQ,SAAS,EAAC;AAAA,EAC3B;AACF;AAOO,SAAS,iBAAA,CACd,UACA,KAAA,EAC0B;AAC1B,EAAA,OAAO,KAAA,CAAM,KAAK,CAAA,CAAA,KAAK;AACrB,IAAA,IAAI,CAAA,CAAE,SAAA,KAAc,QAAA,EAAU,OAAO,IAAA;AACrC,IAAA,MAAM,cAAA,GAAiB,CAAA,CAAE,SAAA,CAAU,QAAA,CAAS,GAAG,CAAA,GAAI,CAAA,CAAE,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,CAAA,CAAE,SAAA;AAChF,IAAA,MAAM,cAAA,GAAiB,SAAS,QAAA,CAAS,GAAG,IAAI,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,QAAA;AACxE,IAAA,OAAO,cAAA,KAAmB,cAAA;AAAA,EAC5B,CAAC,CAAA;AACH;AAMA,eAAsB,sBAAA,CACpB,SACA,MAAA,EACmC;AACnC,EAAA,MAAM,QAAA,GAAW,QAAQ,OAAA,CAAQ,QAAA;AAGjC,EAAA,IACE,QAAA,CAAS,UAAA,CAAW,QAAQ,CAAA,IAC5B,QAAA,CAAS,UAAA,CAAW,MAAM,CAAA,IAC1B,QAAA,CAAS,QAAA,CAAS,GAAG,CAAA,EACrB;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAM,kBAAA,CAAmB,MAAM,CAAA;AAC7C,EAAA,MAAM,KAAA,GAAQ,iBAAA,CAAkB,QAAA,EAAU,KAAK,CAAA;AAE/C,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,MAAA;AAAA,EACT;AAGA,EAAA,MAAM,cAAc,IAAI,GAAA,CAAI,KAAA,CAAM,OAAA,EAAS,QAAQ,GAAG,CAAA;AAGtD,EAAA,OAAA,CAAQ,OAAA,CAAQ,YAAA,CAAa,OAAA,CAAQ,CAAC,OAAO,GAAA,KAAQ;AACnD,IAAA,WAAA,CAAY,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,EACzC,CAAC,CAAA;AAGD,EAAA,gBAAA,CAAiB,QAAQ,KAAA,CAAM,SAAA,EAAW,OAAO,MAAM,CAAA,CAAE,MAAM,MAAM;AAAA,EAAC,CAAC,CAAA;AAGvE,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,KAAA,CAAM,aAAa,CAAA;AAC/C,EAAA,OAAOC,mBAAA,CAAa,QAAA,CAAS,WAAA,EAAa,UAAU,CAAA;AACtD;AAQA,eAAsB,gBAAA,CAAiB,MAAA,EAAwB,QAAA,EAAkB,YAAA,EAAsC;AACrH,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,YAAA,IAAgB,SAAA,EAAU,IAAK,kBAAA;AACtD,IAAA,MAAM,MAAA,GAAS,YAAA,IAAgB,MAAA,CAAO,MAAA,IAAA,CAAW,MAAMH,8BAAA,CAAc,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,CAAA,GAAI,MAAA;AACnH,IAAA,IAAI,CAAC,MAAA,EAAQ;AACb,IAAA,MAAM,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA,6BAAA,CAAA,EAAiC;AAAA,MACrD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAUI,6BAAA,CAAa,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAS,EAAG,MAAA,CAAO,IAAI,CAAC;AAAA,KAChF,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAwBA,eAAsB,sBAAsB,MAAA,EAIxC;AAGF,EAAA,MAAM,KAAA,GAAQ,MAAM,kBAAA,CAAmB,EAAE,cAAA,EAAgB,KAAQ,GAAG,MAAA,EAAQ,YAAA,EAAc,CAAA,EAAG,CAAA;AAE7F,EAAA,OAAO,KAAA,CAAM,IAAI,CAAA,CAAA,MAAM;AAAA,IACrB,QAAQ,CAAA,CAAE,SAAA;AAAA,IACV,aAAa,CAAA,CAAE,OAAA;AAAA,IACf,SAAA,EAAW,CAAA,CAAE,aAAA,KAAkB,KAAA,IAAS,EAAE,aAAA,KAAkB;AAAA,GAC9D,CAAE,CAAA;AACJ;AAKO,SAAS,kBAAA,GAA2B;AACzC,EAAA,UAAA,CAAW,KAAA,EAAM;AACnB","file":"chunk-I3ND4XYW.js","sourcesContent":["/**\n * Managed Redirects - Next.js Middleware Helper\n * \n * Fetches redirect rules from Portal and applies them.\n * Supports API key only (domain resolved from Portal) or domain-based lookup.\n *\n * On a multi-site project (one Sonor project, many domains) rules are per\n * host: a rule with no site applies everywhere, and one tagged\n * 'bd-charlotte.com' applies only there. The list read and the hit both name\n * the host through `sites/site-param` (explicit `site` > NEXT_PUBLIC_SITE_URL\n * host), and the in-memory cache key carries it too. Keyed by API key alone,\n * two hosts served by one process would share whichever list was fetched\n * first, for the whole cache window.\n *\n * Usage in proxy.ts (API key only):\n * \n * import { handleManagedRedirects } from '@sonordev/site-kit/redirects'\n * \n * export default async function proxy(request: NextRequest) {\n *   const redirect = await handleManagedRedirects(request, {\n *     apiKey: process.env.SONOR_API_KEY,\n *     portalApiUrl: process.env.SONOR_API_URL,\n *   })\n *   if (redirect) return redirect\n *   return NextResponse.next()\n * }\n * \n * Or with domain (legacy):\n *   const redirect = await handleManagedRedirects(request, { domain: 'example.com' })\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { getSiteConfig } from '../site-config'\nimport { resolveSiteHost } from '../sites/resolve'\nimport { withSiteBody, withSiteParam } from '../sites/site-param'\n\nexport interface RedirectRule {\n  from_path: string\n  to_path: string\n  redirect_type: '301' | '302' | '307' | '308'\n  is_enabled: boolean\n}\n\nexport interface RedirectConfig {\n  /** Domain to fetch redirects for (optional when apiKey is set) */\n  domain?: string\n  /** Project API key; when set, redirects are fetched by key (no domain needed) */\n  apiKey?: string\n  /**\n   * Sub-site host on a multi-site project (e.g. 'bd-charlotte.com'). Same\n   * meaning as the `site` argument of withSiteParam: when unset it comes from\n   * the NEXT_PUBLIC_SITE_URL host. The API returns this host's rules plus the\n   * project-wide ones. When nothing resolves no site is sent, and the API\n   * answers for the project's primary domain.\n   */\n  site?: string\n  portalApiUrl?: string\n  cacheSeconds?: number\n  /**\n   * Hard ceiling on the rules fetch, in ms. Default 300.\n   *\n   * This fetch can sit in front of HTML (proxy hot path / not-found render),\n   * and without a bound a *slow* Portal becomes every page's TTFB — the\n   * try/catch only fails open on error, not on slow. Build-time callers\n   * (generateNextRedirects) pass a larger value.\n   */\n  fetchTimeoutMs?: number\n}\n\nconst DEFAULT_PORTAL_URL = 'https://api.sonor.io'\n\n/**\n * Env parity with the API key: SONOR_API_URL was honored for the key's\n * sibling everywhere else in the kit but ignored here, so sites overriding\n * the API URL by env silently fetched redirect rules from production.\n */\nfunction envApiUrl(): string | undefined {\n  const raw = typeof process !== 'undefined' && process.env ? process.env.SONOR_API_URL : undefined\n  return typeof raw === 'string' && raw ? raw : undefined\n}\nconst DEFAULT_FETCH_TIMEOUT_MS = 300\n/**\n * After a failed fetch, don't re-hit the API for this long. Without this a\n * cold instance with a down Portal pays the full timeout on EVERY request.\n */\nconst FAILURE_COOLDOWN_MS = 30_000\n\n/**\n * Request header the site-kit proxy stamps with `pathname + search` so the\n * not-found boundary (which receives no URL from Next) can know what was\n * requested. Single source of truth — used by createProxy and the deprecated\n * resolveManagedRedirect.\n */\nexport const SK_PATH_HEADER = 'x-sk-path'\n\n// Cache for redirect rules keyed by apiKey or 'domain:'+domain, plus the site host\nconst rulesCache = new Map<string, { rules: RedirectRule[]; expiry: number }>()\n\n/**\n * The host is part of the key because rules are per host. One process can\n * serve several hosts of a multi-site project (a `site` passed per call), and\n * a key without it would hand every host the first host's list.\n */\nfunction getRedirectCacheKey(apiKey: string | undefined, domain: string | undefined, site: string): string {\n  const scope = apiKey ? `key:${apiKey}` : `domain:${domain || ''}`\n  return `${scope}|site:${site}`\n}\n\n/**\n * Fetch redirect rules from Portal API.\n * When apiKey is set (or from env), uses key-based endpoint (no domain required).\n * Otherwise uses domain query (or domain from getSiteConfig when only env API key is set).\n * Either way the site host goes along as `?site=`, left off when it resolves empty.\n */\nexport async function fetchRedirectRules(config: RedirectConfig): Promise<RedirectRule[]> {\n  const now = Date.now()\n  const cacheSeconds = config.cacheSeconds ?? 300\n  const baseUrl = config.portalApiUrl || envApiUrl() || DEFAULT_PORTAL_URL\n\n  const rawKey = config.apiKey ?? (typeof process !== 'undefined' && process.env ? process.env.SONOR_API_KEY : undefined)\n  const apiKey = typeof rawKey === 'string' ? rawKey : undefined\n  let domain = config.domain\n\n  if (!apiKey && !domain) {\n    const siteConfig = await getSiteConfig({ apiUrl: baseUrl })\n    domain = siteConfig?.domain\n  }\n\n  // Resolved once, so the cache key and the ?site= param always name the same\n  // host: the entry a host reads is the list fetched for that host.\n  const site = resolveSiteHost(config.site)\n  const cacheKey = getRedirectCacheKey(apiKey, domain, site)\n  const cached = rulesCache.get(cacheKey)\n  if (cached && now < cached.expiry) {\n    return cached.rules\n  }\n\n  try {\n    let url: string\n    const headers: Record<string, string> = { 'Content-Type': 'application/json' }\n\n    if (apiKey) {\n      url = withSiteParam(`${baseUrl}/api/public/seo/redirects`, site)\n      headers['x-api-key'] = apiKey\n    } else if (domain) {\n      url = withSiteParam(`${baseUrl}/api/public/seo/redirects?domain=${encodeURIComponent(domain)}`, site)\n    } else {\n      return []\n    }\n\n    const timeoutMs = config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS\n    // Guarded like every other web API here (see shared/identity): AbortSignal\n    // .timeout is Node 17.3+/modern edge; when absent we just fetch unbounded.\n    const signal =\n      typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function'\n        ? AbortSignal.timeout(timeoutMs)\n        : undefined\n\n    const res = await fetch(url, {\n      headers,\n      signal,\n      // No-op in proxy (outside the data cache) but real in RSC renders,\n      // where the not-found resolver runs.\n      next: { revalidate: cacheSeconds },\n    })\n\n    if (!res.ok) {\n      console.error(`[site-kit] Failed to fetch redirects: ${res.status}`)\n      rulesCache.set(cacheKey, { rules: cached?.rules ?? [], expiry: now + FAILURE_COOLDOWN_MS })\n      return cached?.rules ?? []\n    }\n\n    const data = await res.json()\n    const rules = (data.redirects || []).filter((r: RedirectRule) => r.is_enabled)\n    rulesCache.set(cacheKey, { rules, expiry: now + cacheSeconds * 1000 })\n    return rules\n  } catch (error) {\n    console.error('[site-kit] Error fetching redirects:', error)\n    rulesCache.set(cacheKey, { rules: cached?.rules ?? [], expiry: now + FAILURE_COOLDOWN_MS })\n    return cached?.rules ?? []\n  }\n}\n\n/**\n * Find the rule matching a pathname (exact, tolerating trailing-slash\n * variance). Single source of truth for match semantics — used by the proxy\n * hot path and the not-found resolver. Do not re-fork.\n */\nexport function findRedirectMatch(\n  pathname: string,\n  rules: RedirectRule[],\n): RedirectRule | undefined {\n  return rules.find(r => {\n    if (r.from_path === pathname) return true\n    const normalizedFrom = r.from_path.endsWith('/') ? r.from_path.slice(0, -1) : r.from_path\n    const normalizedPath = pathname.endsWith('/') ? pathname.slice(0, -1) : pathname\n    return normalizedFrom === normalizedPath\n  })\n}\n\n/**\n * Handle managed redirects in middleware\n * Returns a NextResponse.redirect if a match is found, otherwise undefined\n */\nexport async function handleManagedRedirects(\n  request: NextRequest,\n  config: RedirectConfig,\n): Promise<NextResponse | undefined> {\n  const pathname = request.nextUrl.pathname\n  \n  // Skip for static assets and API routes\n  if (\n    pathname.startsWith('/_next') ||\n    pathname.startsWith('/api') ||\n    pathname.includes('.') // Has file extension\n  ) {\n    return undefined\n  }\n\n  const rules = await fetchRedirectRules(config)\n  const match = findRedirectMatch(pathname, rules)\n\n  if (!match) {\n    return undefined\n  }\n\n  // Build redirect URL\n  const redirectUrl = new URL(match.to_path, request.url)\n  \n  // Preserve query params\n  request.nextUrl.searchParams.forEach((value, key) => {\n    redirectUrl.searchParams.set(key, value)\n  })\n\n  // Track hit (fire and forget); domain may be from config or resolved by apiKey\n  trackRedirectHit(config, match.from_path, config.domain).catch(() => {})\n\n  // Return redirect response\n  const statusCode = parseInt(match.redirect_type) as 301 | 302 | 307 | 308\n  return NextResponse.redirect(redirectUrl, statusCode)\n}\n\n/**\n * Track redirect hit for analytics (needs domain; resolved from config or getSiteConfig when using apiKey)\n * Exported for the not-found resolver — fire-and-forget, never throws.\n * The site host goes in the body so a multi-site project counts the hit on\n * that host's rule, not the project-wide one.\n */\nexport async function trackRedirectHit(config: RedirectConfig, fromPath: string, domainForHit?: string): Promise<void> {\n  try {\n    const baseUrl = config.portalApiUrl || envApiUrl() || DEFAULT_PORTAL_URL\n    const domain = domainForHit ?? config.domain ?? (await getSiteConfig({ apiKey: config.apiKey, apiUrl: baseUrl }))?.domain\n    if (!domain) return\n    await fetch(`${baseUrl}/api/public/seo/redirects/hit`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify(withSiteBody({ domain, from_path: fromPath }, config.site)),\n    })\n  } catch {\n    // Ignore tracking errors\n  }\n}\n\n/**\n * Generate Next.js redirects config from Portal\n * Use this in next.config.js for build-time redirects\n *\n * The site host resolves as it does everywhere else. Next loads .env files\n * before it evaluates next.config, so a NEXT_PUBLIC_SITE_URL from .env.local\n * or the host's env is already visible here, and each build of a multi-site\n * project bakes in its own host's rules.\n *\n * Usage in next.config.js:\n * \n * const { generateNextRedirects } = require('@sonordev/site-kit/redirects')\n * \n * module.exports = {\n *   async redirects() {\n *     return generateNextRedirects({\n *       domain: 'example.com',\n *       portalApiUrl: process.env.PORTAL_API_URL,\n *     })\n *   }\n * }\n */\nexport async function generateNextRedirects(config: RedirectConfig): Promise<Array<{\n  source: string\n  destination: string\n  permanent: boolean\n}>> {\n  // Build-time: nothing is waiting on this response, so allow a generous\n  // timeout instead of the request-path default.\n  const rules = await fetchRedirectRules({ fetchTimeoutMs: 10_000, ...config, cacheSeconds: 0 })\n  \n  return rules.map(r => ({\n    source: r.from_path,\n    destination: r.to_path,\n    permanent: r.redirect_type === '301' || r.redirect_type === '308',\n  }))\n}\n\n/**\n * Clear redirect cache (useful for development)\n */\nexport function clearRedirectCache(): void {\n  rulesCache.clear()\n}\n"]}
+{"version":3,"sources":["../src/redirects/index.ts"],"names":["getSiteConfig","resolveSiteHost","withSiteParam","NextResponse","withSiteBody"],"mappings":";;;;;;;AAqEA,IAAM,kBAAA,GAAqB,sBAAA;AAO3B,SAAS,SAAA,GAAgC;AACvC,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,KAAY,WAAA,IAAe,QAAQ,GAAA,GAAM,OAAA,CAAQ,IAAI,aAAA,GAAgB,MAAA;AACxF,EAAA,OAAO,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,GAAM,GAAA,GAAM,MAAA;AAChD;AACA,IAAM,wBAAA,GAA2B,GAAA;AAKjC,IAAM,mBAAA,GAAsB,GAAA;AAQrB,IAAM,cAAA,GAAiB;AAG9B,IAAM,UAAA,uBAAiB,GAAA,EAAuD;AAO9E,SAAS,mBAAA,CAAoB,MAAA,EAA4B,MAAA,EAA4B,IAAA,EAAsB;AACzG,EAAA,MAAM,QAAQ,MAAA,GAAS,CAAA,IAAA,EAAO,MAAM,CAAA,CAAA,GAAK,CAAA,OAAA,EAAU,UAAU,EAAE,CAAA,CAAA;AAC/D,EAAA,OAAO,CAAA,EAAG,KAAK,CAAA,MAAA,EAAS,IAAI,CAAA,CAAA;AAC9B;AAQA,eAAsB,mBAAmB,MAAA,EAAiD;AACxF,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,YAAA,GAAe,OAAO,YAAA,IAAgB,GAAA;AAC5C,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,YAAA,IAAgB,SAAA,EAAU,IAAK,kBAAA;AAEtD,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,KAAW,OAAO,OAAA,KAAY,eAAe,OAAA,CAAQ,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,aAAA,GAAgB,MAAA,CAAA;AAC7G,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,KAAW,QAAA,GAAW,MAAA,GAAS,MAAA;AACrD,EAAA,IAAI,SAAS,MAAA,CAAO,MAAA;AAEpB,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,MAAA,EAAQ;AACtB,IAAA,MAAM,aAAa,MAAMA,8BAAA,CAAc,EAAE,MAAA,EAAQ,SAAS,CAAA;AAC1D,IAAA,MAAA,GAAS,UAAA,EAAY,MAAA;AAAA,EACvB;AAIA,EAAA,MAAM,IAAA,GAAOC,gCAAA,CAAgB,MAAA,CAAO,IAAI,CAAA;AACxC,EAAA,MAAM,QAAA,GAAW,mBAAA,CAAoB,MAAA,EAAQ,MAAA,EAAQ,IAAI,CAAA;AACzD,EAAA,MAAM,MAAA,GAAS,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA;AACtC,EAAA,IAAI,MAAA,IAAU,GAAA,GAAM,MAAA,CAAO,MAAA,EAAQ;AACjC,IAAA,OAAO,MAAA,CAAO,KAAA;AAAA,EAChB;AAEA,EAAA,IAAI;AACF,IAAA,IAAI,GAAA;AACJ,IAAA,MAAM,OAAA,GAAkC,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAE7E,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,GAAA,GAAMC,8BAAA,CAAc,CAAA,EAAG,OAAO,CAAA,yBAAA,CAAA,EAA6B,IAAI,CAAA;AAC/D,MAAA,OAAA,CAAQ,WAAW,CAAA,GAAI,MAAA;AAAA,IACzB,WAAW,MAAA,EAAQ;AACjB,MAAA,GAAA,GAAMA,8BAAA,CAAc,GAAG,OAAO,CAAA,iCAAA,EAAoC,mBAAmB,MAAM,CAAC,IAAI,IAAI,CAAA;AAAA,IACtG,CAAA,MAAO;AACL,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,SAAA,GAAY,OAAO,cAAA,IAAkB,wBAAA;AAG3C,IAAA,MAAM,MAAA,GACJ,OAAO,WAAA,KAAgB,WAAA,IAAe,OAAO,WAAA,CAAY,OAAA,KAAY,UAAA,GACjE,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA,GAC7B,KAAA,CAAA;AAEN,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,MAC3B,OAAA;AAAA,MACA,MAAA;AAAA;AAAA;AAAA,MAGA,IAAA,EAAM,EAAE,UAAA,EAAY,YAAA;AAAa,KAClC,CAAA;AAED,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,sCAAA,EAAyC,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AACnE,MAAA,UAAA,CAAW,GAAA,CAAI,QAAA,EAAU,EAAE,KAAA,EAAO,MAAA,EAAQ,KAAA,IAAS,EAAC,EAAG,MAAA,EAAQ,GAAA,GAAM,mBAAA,EAAqB,CAAA;AAC1F,MAAA,OAAO,MAAA,EAAQ,SAAS,EAAC;AAAA,IAC3B;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,MAAM,KAAA,GAAA,CAAS,KAAK,SAAA,IAAa,IAAI,MAAA,CAAO,CAAC,CAAA,KAAoB,CAAA,CAAE,UAAU,CAAA;AAC7E,IAAA,UAAA,CAAW,GAAA,CAAI,UAAU,EAAE,KAAA,EAAO,QAAQ,GAAA,GAAM,YAAA,GAAe,KAAM,CAAA;AACrE,IAAA,OAAO,KAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,wCAAwC,KAAK,CAAA;AAC3D,IAAA,UAAA,CAAW,GAAA,CAAI,QAAA,EAAU,EAAE,KAAA,EAAO,MAAA,EAAQ,KAAA,IAAS,EAAC,EAAG,MAAA,EAAQ,GAAA,GAAM,mBAAA,EAAqB,CAAA;AAC1F,IAAA,OAAO,MAAA,EAAQ,SAAS,EAAC;AAAA,EAC3B;AACF;AAOO,SAAS,iBAAA,CACd,UACA,KAAA,EAC0B;AAC1B,EAAA,OAAO,KAAA,CAAM,KAAK,CAAA,CAAA,KAAK;AACrB,IAAA,IAAI,CAAA,CAAE,SAAA,KAAc,QAAA,EAAU,OAAO,IAAA;AACrC,IAAA,MAAM,cAAA,GAAiB,CAAA,CAAE,SAAA,CAAU,QAAA,CAAS,GAAG,CAAA,GAAI,CAAA,CAAE,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,CAAA,CAAE,SAAA;AAChF,IAAA,MAAM,cAAA,GAAiB,SAAS,QAAA,CAAS,GAAG,IAAI,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,QAAA;AACxE,IAAA,OAAO,cAAA,KAAmB,cAAA;AAAA,EAC5B,CAAC,CAAA;AACH;AAMA,eAAsB,sBAAA,CACpB,SACA,MAAA,EACmC;AACnC,EAAA,MAAM,QAAA,GAAW,QAAQ,OAAA,CAAQ,QAAA;AAGjC,EAAA,IACE,QAAA,CAAS,UAAA,CAAW,QAAQ,CAAA,IAC5B,QAAA,CAAS,UAAA,CAAW,MAAM,CAAA,IAC1B,QAAA,CAAS,QAAA,CAAS,GAAG,CAAA,EACrB;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAM,kBAAA,CAAmB,MAAM,CAAA;AAC7C,EAAA,MAAM,KAAA,GAAQ,iBAAA,CAAkB,QAAA,EAAU,KAAK,CAAA;AAE/C,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,MAAA;AAAA,EACT;AAGA,EAAA,MAAM,cAAc,IAAI,GAAA,CAAI,KAAA,CAAM,OAAA,EAAS,QAAQ,GAAG,CAAA;AAGtD,EAAA,OAAA,CAAQ,OAAA,CAAQ,YAAA,CAAa,OAAA,CAAQ,CAAC,OAAO,GAAA,KAAQ;AACnD,IAAA,WAAA,CAAY,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,EACzC,CAAC,CAAA;AAGD,EAAA,gBAAA,CAAiB,QAAQ,KAAA,CAAM,SAAA,EAAW,OAAO,MAAM,CAAA,CAAE,MAAM,MAAM;AAAA,EAAC,CAAC,CAAA;AAGvE,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,KAAA,CAAM,aAAa,CAAA;AAC/C,EAAA,OAAOC,mBAAA,CAAa,QAAA,CAAS,WAAA,EAAa,UAAU,CAAA;AACtD;AAQA,eAAsB,gBAAA,CAAiB,MAAA,EAAwB,QAAA,EAAkB,YAAA,EAAsC;AACrH,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,YAAA,IAAgB,SAAA,EAAU,IAAK,kBAAA;AACtD,IAAA,MAAM,MAAA,GAAS,YAAA,IAAgB,MAAA,CAAO,MAAA,IAAA,CAAW,MAAMH,8BAAA,CAAc,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,CAAA,GAAI,MAAA;AACnH,IAAA,IAAI,CAAC,MAAA,EAAQ;AACb,IAAA,MAAM,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA,6BAAA,CAAA,EAAiC;AAAA,MACrD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAUI,6BAAA,CAAa,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAS,EAAG,MAAA,CAAO,IAAI,CAAC;AAAA,KAChF,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAwBA,eAAsB,sBAAsB,MAAA,EAIxC;AAGF,EAAA,MAAM,KAAA,GAAQ,MAAM,kBAAA,CAAmB,EAAE,cAAA,EAAgB,KAAQ,GAAG,MAAA,EAAQ,YAAA,EAAc,CAAA,EAAG,CAAA;AAE7F,EAAA,OAAO,KAAA,CAAM,IAAI,CAAA,CAAA,MAAM;AAAA,IACrB,QAAQ,CAAA,CAAE,SAAA;AAAA,IACV,aAAa,CAAA,CAAE,OAAA;AAAA,IACf,SAAA,EAAW,CAAA,CAAE,aAAA,KAAkB,KAAA,IAAS,EAAE,aAAA,KAAkB;AAAA,GAC9D,CAAE,CAAA;AACJ;AAKO,SAAS,kBAAA,GAA2B;AACzC,EAAA,UAAA,CAAW,KAAA,EAAM;AACnB","file":"chunk-4BEGKFMN.js","sourcesContent":["/**\n * Managed Redirects - Next.js Middleware Helper\n * \n * Fetches redirect rules from Portal and applies them.\n * Supports API key only (domain resolved from Portal) or domain-based lookup.\n *\n * On a multi-site project (one Sonor project, many domains) rules are per\n * host: a rule with no site applies everywhere, and one tagged\n * 'bd-charlotte.com' applies only there. The list read and the hit both name\n * the host through `sites/site-param` (explicit `site` > NEXT_PUBLIC_SITE_URL\n * host), and the in-memory cache key carries it too. Keyed by API key alone,\n * two hosts served by one process would share whichever list was fetched\n * first, for the whole cache window.\n *\n * Usage in proxy.ts (API key only):\n * \n * import { handleManagedRedirects } from '@sonordev/site-kit/redirects'\n * \n * export default async function proxy(request: NextRequest) {\n *   const redirect = await handleManagedRedirects(request, {\n *     apiKey: process.env.SONOR_API_KEY,\n *     portalApiUrl: process.env.SONOR_API_URL,\n *   })\n *   if (redirect) return redirect\n *   return NextResponse.next()\n * }\n * \n * Or with domain (legacy):\n *   const redirect = await handleManagedRedirects(request, { domain: 'example.com' })\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { getSiteConfig } from '../site-config'\nimport { resolveSiteHost } from '../sites/resolve'\nimport { withSiteBody, withSiteParam } from '../sites/site-param'\n\nexport interface RedirectRule {\n  from_path: string\n  to_path: string\n  redirect_type: '301' | '302' | '307' | '308'\n  is_enabled: boolean\n}\n\nexport interface RedirectConfig {\n  /** Domain to fetch redirects for (optional when apiKey is set) */\n  domain?: string\n  /** Project API key; when set, redirects are fetched by key (no domain needed) */\n  apiKey?: string\n  /**\n   * Sub-site host on a multi-site project (e.g. 'bd-charlotte.com'). Same\n   * meaning as the `site` argument of withSiteParam: when unset it comes from\n   * the NEXT_PUBLIC_SITE_URL host. The API returns this host's rules plus the\n   * project-wide ones. When nothing resolves no site is sent, and the API\n   * answers for the project's primary domain.\n   */\n  site?: string\n  portalApiUrl?: string\n  cacheSeconds?: number\n  /**\n   * Hard ceiling on the rules fetch, in ms. Default 300.\n   *\n   * This fetch can sit in front of HTML (proxy hot path / not-found render),\n   * and without a bound a *slow* Portal becomes every page's TTFB — the\n   * try/catch only fails open on error, not on slow. Build-time callers\n   * (generateNextRedirects) pass a larger value.\n   */\n  fetchTimeoutMs?: number\n}\n\nconst DEFAULT_PORTAL_URL = 'https://api.sonor.io'\n\n/**\n * Env parity with the API key: SONOR_API_URL was honored for the key's\n * sibling everywhere else in the kit but ignored here, so sites overriding\n * the API URL by env silently fetched redirect rules from production.\n */\nfunction envApiUrl(): string | undefined {\n  const raw = typeof process !== 'undefined' && process.env ? process.env.SONOR_API_URL : undefined\n  return typeof raw === 'string' && raw ? raw : undefined\n}\nconst DEFAULT_FETCH_TIMEOUT_MS = 300\n/**\n * After a failed fetch, don't re-hit the API for this long. Without this a\n * cold instance with a down Portal pays the full timeout on EVERY request.\n */\nconst FAILURE_COOLDOWN_MS = 30_000\n\n/**\n * Request header the site-kit proxy stamps with `pathname + search` so the\n * not-found boundary (which receives no URL from Next) can know what was\n * requested. Single source of truth — used by createProxy and the deprecated\n * resolveManagedRedirect.\n */\nexport const SK_PATH_HEADER = 'x-sk-path'\n\n// Cache for redirect rules keyed by apiKey or 'domain:'+domain, plus the site host\nconst rulesCache = new Map<string, { rules: RedirectRule[]; expiry: number }>()\n\n/**\n * The host is part of the key because rules are per host. One process can\n * serve several hosts of a multi-site project (a `site` passed per call), and\n * a key without it would hand every host the first host's list.\n */\nfunction getRedirectCacheKey(apiKey: string | undefined, domain: string | undefined, site: string): string {\n  const scope = apiKey ? `key:${apiKey}` : `domain:${domain || ''}`\n  return `${scope}|site:${site}`\n}\n\n/**\n * Fetch redirect rules from Portal API.\n * When apiKey is set (or from env), uses key-based endpoint (no domain required).\n * Otherwise uses domain query (or domain from getSiteConfig when only env API key is set).\n * Either way the site host goes along as `?site=`, left off when it resolves empty.\n */\nexport async function fetchRedirectRules(config: RedirectConfig): Promise<RedirectRule[]> {\n  const now = Date.now()\n  const cacheSeconds = config.cacheSeconds ?? 300\n  const baseUrl = config.portalApiUrl || envApiUrl() || DEFAULT_PORTAL_URL\n\n  const rawKey = config.apiKey ?? (typeof process !== 'undefined' && process.env ? process.env.SONOR_API_KEY : undefined)\n  const apiKey = typeof rawKey === 'string' ? rawKey : undefined\n  let domain = config.domain\n\n  if (!apiKey && !domain) {\n    const siteConfig = await getSiteConfig({ apiUrl: baseUrl })\n    domain = siteConfig?.domain\n  }\n\n  // Resolved once, so the cache key and the ?site= param always name the same\n  // host: the entry a host reads is the list fetched for that host.\n  const site = resolveSiteHost(config.site)\n  const cacheKey = getRedirectCacheKey(apiKey, domain, site)\n  const cached = rulesCache.get(cacheKey)\n  if (cached && now < cached.expiry) {\n    return cached.rules\n  }\n\n  try {\n    let url: string\n    const headers: Record<string, string> = { 'Content-Type': 'application/json' }\n\n    if (apiKey) {\n      url = withSiteParam(`${baseUrl}/api/public/seo/redirects`, site)\n      headers['x-api-key'] = apiKey\n    } else if (domain) {\n      url = withSiteParam(`${baseUrl}/api/public/seo/redirects?domain=${encodeURIComponent(domain)}`, site)\n    } else {\n      return []\n    }\n\n    const timeoutMs = config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS\n    // Guarded like every other web API here (see shared/identity): AbortSignal\n    // .timeout is Node 17.3+/modern edge; when absent we just fetch unbounded.\n    const signal =\n      typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function'\n        ? AbortSignal.timeout(timeoutMs)\n        : undefined\n\n    const res = await fetch(url, {\n      headers,\n      signal,\n      // No-op in proxy (outside the data cache) but real in RSC renders,\n      // where the not-found resolver runs.\n      next: { revalidate: cacheSeconds },\n    })\n\n    if (!res.ok) {\n      console.error(`[site-kit] Failed to fetch redirects: ${res.status}`)\n      rulesCache.set(cacheKey, { rules: cached?.rules ?? [], expiry: now + FAILURE_COOLDOWN_MS })\n      return cached?.rules ?? []\n    }\n\n    const data = await res.json()\n    const rules = (data.redirects || []).filter((r: RedirectRule) => r.is_enabled)\n    rulesCache.set(cacheKey, { rules, expiry: now + cacheSeconds * 1000 })\n    return rules\n  } catch (error) {\n    console.error('[site-kit] Error fetching redirects:', error)\n    rulesCache.set(cacheKey, { rules: cached?.rules ?? [], expiry: now + FAILURE_COOLDOWN_MS })\n    return cached?.rules ?? []\n  }\n}\n\n/**\n * Find the rule matching a pathname (exact, tolerating trailing-slash\n * variance). Single source of truth for match semantics — used by the proxy\n * hot path and the not-found resolver. Do not re-fork.\n */\nexport function findRedirectMatch(\n  pathname: string,\n  rules: RedirectRule[],\n): RedirectRule | undefined {\n  return rules.find(r => {\n    if (r.from_path === pathname) return true\n    const normalizedFrom = r.from_path.endsWith('/') ? r.from_path.slice(0, -1) : r.from_path\n    const normalizedPath = pathname.endsWith('/') ? pathname.slice(0, -1) : pathname\n    return normalizedFrom === normalizedPath\n  })\n}\n\n/**\n * Handle managed redirects in middleware\n * Returns a NextResponse.redirect if a match is found, otherwise undefined\n */\nexport async function handleManagedRedirects(\n  request: NextRequest,\n  config: RedirectConfig,\n): Promise<NextResponse | undefined> {\n  const pathname = request.nextUrl.pathname\n  \n  // Skip for static assets and API routes\n  if (\n    pathname.startsWith('/_next') ||\n    pathname.startsWith('/api') ||\n    pathname.includes('.') // Has file extension\n  ) {\n    return undefined\n  }\n\n  const rules = await fetchRedirectRules(config)\n  const match = findRedirectMatch(pathname, rules)\n\n  if (!match) {\n    return undefined\n  }\n\n  // Build redirect URL\n  const redirectUrl = new URL(match.to_path, request.url)\n  \n  // Preserve query params\n  request.nextUrl.searchParams.forEach((value, key) => {\n    redirectUrl.searchParams.set(key, value)\n  })\n\n  // Track hit (fire and forget); domain may be from config or resolved by apiKey\n  trackRedirectHit(config, match.from_path, config.domain).catch(() => {})\n\n  // Return redirect response\n  const statusCode = parseInt(match.redirect_type) as 301 | 302 | 307 | 308\n  return NextResponse.redirect(redirectUrl, statusCode)\n}\n\n/**\n * Track redirect hit for analytics (needs domain; resolved from config or getSiteConfig when using apiKey)\n * Exported for the not-found resolver — fire-and-forget, never throws.\n * The site host goes in the body so a multi-site project counts the hit on\n * that host's rule, not the project-wide one.\n */\nexport async function trackRedirectHit(config: RedirectConfig, fromPath: string, domainForHit?: string): Promise<void> {\n  try {\n    const baseUrl = config.portalApiUrl || envApiUrl() || DEFAULT_PORTAL_URL\n    const domain = domainForHit ?? config.domain ?? (await getSiteConfig({ apiKey: config.apiKey, apiUrl: baseUrl }))?.domain\n    if (!domain) return\n    await fetch(`${baseUrl}/api/public/seo/redirects/hit`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify(withSiteBody({ domain, from_path: fromPath }, config.site)),\n    })\n  } catch {\n    // Ignore tracking errors\n  }\n}\n\n/**\n * Generate Next.js redirects config from Portal\n * Use this in next.config.js for build-time redirects\n *\n * The site host resolves as it does everywhere else. Next loads .env files\n * before it evaluates next.config, so a NEXT_PUBLIC_SITE_URL from .env.local\n * or the host's env is already visible here, and each build of a multi-site\n * project bakes in its own host's rules.\n *\n * Usage in next.config.js:\n * \n * const { generateNextRedirects } = require('@sonordev/site-kit/redirects')\n * \n * module.exports = {\n *   async redirects() {\n *     return generateNextRedirects({\n *       domain: 'example.com',\n *       portalApiUrl: process.env.PORTAL_API_URL,\n *     })\n *   }\n * }\n */\nexport async function generateNextRedirects(config: RedirectConfig): Promise<Array<{\n  source: string\n  destination: string\n  permanent: boolean\n}>> {\n  // Build-time: nothing is waiting on this response, so allow a generous\n  // timeout instead of the request-path default.\n  const rules = await fetchRedirectRules({ fetchTimeoutMs: 10_000, ...config, cacheSeconds: 0 })\n  \n  return rules.map(r => ({\n    source: r.from_path,\n    destination: r.to_path,\n    permanent: r.redirect_type === '301' || r.redirect_type === '308',\n  }))\n}\n\n/**\n * Clear redirect cache (useful for development)\n */\nexport function clearRedirectCache(): void {\n  rulesCache.clear()\n}\n"]}

package/dist/{chunk-YFX3Q56O.mjs → chunk-4KAMU5HD.mjs}

@@ -1,4 +1,4 @@
-// src/blog/widget-styles.ts
+// src/articles/widget-styles.ts
 var widgetStyle = {
   padding: 20,
   backgroundColor: "var(--sk-bg-elevated)",
@@ -12,5 +12,5 @@ var widgetTitleStyle = {
 };
 
 export { widgetStyle, widgetTitleStyle };
-//# sourceMappingURL=chunk-YFX3Q56O.mjs.map
-//# sourceMappingURL=chunk-YFX3Q56O.mjs.map
+//# sourceMappingURL=chunk-4KAMU5HD.mjs.map
+//# sourceMappingURL=chunk-4KAMU5HD.mjs.map

package/dist/chunk-4KAMU5HD.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/articles/widget-styles.ts"],"names":[],"mappings":";AAOO,IAAM,WAAA,GAAmC;AAAA,EAC9C,OAAA,EAAS,EAAA;AAAA,EACT,eAAA,EAAiB,uBAAA;AAAA,EACjB,YAAA,EAAc;AAChB;AAEO,IAAM,gBAAA,GAAwC;AAAA,EACnD,MAAA,EAAQ,UAAA;AAAA,EACR,QAAA,EAAU,EAAA;AAAA,EACV,UAAA,EAAY,GAAA;AAAA,EACZ,KAAA,EAAO;AACT","file":"chunk-4KAMU5HD.mjs","sourcesContent":["import type React from 'react'\n\n/**\n * Shared sidebar-widget chrome, extracted from PublicationSidebar so the client-side\n * NewsletterWidget (its own module — it needs hooks, and PublicationSidebar is also\n * bundled into the un-stamped server entry articles/server-ui) can reuse it.\n */\nexport const widgetStyle: React.CSSProperties = {\n  padding: 20,\n  backgroundColor: 'var(--sk-bg-elevated)',\n  borderRadius: 12,\n}\n\nexport const widgetTitleStyle: React.CSSProperties = {\n  margin: '0 0 16px',\n  fontSize: 16,\n  fontWeight: 600,\n  color: 'var(--sk-text-primary)',\n}\n"]}

package/dist/{chunk-CNTDV7HM.js → chunk-4NBJDP6Y.js}

@@ -1,7 +1,7 @@
 'use strict';
 
 var chunkKHPJ3CEL_js = require('./chunk-KHPJ3CEL.js');
-var chunkI7HOMMIK_js = require('./chunk-I7HOMMIK.js');
+var chunk5ABTBPPK_js = require('./chunk-5ABTBPPK.js');
 
 // src/forms/defaultSuccessMessage.ts
 var DEFAULT_FORM_SUCCESS_MESSAGE = "Thank you for your submission! We will be in touch soon.";
@@ -194,7 +194,7 @@ async function submitForm({
       _formLoadedAt: formLoadedAt
     }
   };
-  const response = await chunkI7HOMMIK_js.sonorFetch(
+  const response = await chunk5ABTBPPK_js.sonorFetch(
     `${apiUrl}/api/public/forms/submit`,
     {
       method: "POST",
@@ -220,5 +220,5 @@ exports.DEFAULT_FORM_SUCCESS_MESSAGE = DEFAULT_FORM_SUCCESS_MESSAGE;
 exports.getApiConfig = getApiConfig;
 exports.normalizeFormConfig = normalizeFormConfig;
 exports.submitForm = submitForm;
-//# sourceMappingURL=chunk-CNTDV7HM.js.map
-//# sourceMappingURL=chunk-CNTDV7HM.js.map
+//# sourceMappingURL=chunk-4NBJDP6Y.js.map
+//# sourceMappingURL=chunk-4NBJDP6Y.js.map

package/dist/{chunk-CNTDV7HM.js.map → chunk-4NBJDP6Y.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/forms/defaultSuccessMessage.ts","../src/forms/normalize-config.ts","../src/forms/recaptcha.ts","../src/forms/ga4-identity.ts","../src/forms/submitForm.ts"],"names":["DEFAULT_HONEYPOT_FIELD","sonorFetch"],"mappings":";;;;;;AACO,IAAM,4BAAA,GACX;;;ACiBK,SAAS,oBAAoB,IAAA,EAA8B;AAChE,EAAA,IAAI,KAAK,KAAA,EAAO;AACd,IAAA,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,EAAQ,CAAA,KAAA,CAAY,EAAE,WAAA,IAAe,CAAA,KAAM,CAAA,CAAE,WAAA,IAAe,CAAA,CAAE,CAAA;AAAA,EACjF;AACA,EAAA,IAAI,KAAK,MAAA,EAAQ;AACf,IAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,EAAQ,CAAA,KAAA,CAAY,EAAE,UAAA,IAAc,CAAA,KAAM,CAAA,CAAE,UAAA,IAAc,CAAA,CAAE,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,EAAO,MAAA,IAAU,CAAA;AAC1C,EAAA,MAAM,gBAAgB,WAAA,GAAc,CAAA;AAEpC,EAAA,MAAM,UAAA,GACJ,OAAO,IAAA,CAAK,eAAA,KAAoB,WAAW,IAAA,CAAK,eAAA,CAAgB,MAAK,GAAI,EAAA;AAC3E,EAAA,MAAM,eAAA,GACJ,UAAA,KACC,OAAQ,IAAA,CAAqC,cAAA,KAAmB,QAAA,GAC7D,MAAA,CAAQ,IAAA,CAAqC,cAAc,CAAA,CAAE,IAAA,EAAK,GAClE,EAAA,CAAA,IACJ,4BAAA;AAEF,EAAA,OAAO;AAAA,IACL,GAAG,IAAA;AAAA,IACH,eAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF;AACF;;;ACrCA,SAAS,WAAW,eAAA,EAA8C;AAChE,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,MAAA;AAC1C,EAAA,IAAI,iBAAiB,OAAO,eAAA;AAC5B,EAAA,MAAM,GAAA,GAAM,MAAA;AACZ,EAAA,OAAO,GAAA,CAAI,+BAAA,IAAmC,OAAA,CAAQ,GAAA,CAAI,8BAAA;AAC5D;AAGA,IAAM,yBAAA,GAA4B,GAAA;AAElC,SAAS,WAAW,OAAA,EAA+B;AACjD,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC9B,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,MAAA;AACZ,IAAA,IAAI,GAAA,CAAI,YAAY,UAAA,EAAY;AAC9B,MAAA,OAAA,CAAQ,IAAI,UAAU,CAAA;AACtB,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,MAAM,MAAA,GAAS,CAAC,KAAA,KAAe;AAC7B,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,IACf,CAAA;AACA,IAAA,MAAM,SAAS,UAAA,CAAW,MAAM,MAAA,CAAO,IAAI,GAAG,yBAAyB,CAAA;AAEvE,IAAA,MAAM,eAAe,MAAM;AACzB,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,IAAI,GAAA,CAAI,YAAY,UAAA,EAAY;AAC9B,QAAA,YAAA,CAAa,MAAM,CAAA;AACnB,QAAA,MAAA,CAAO,IAAI,UAAU,CAAA;AACrB,QAAA;AAAA,MACF;AACA,MAAA,UAAA,CAAW,cAAc,EAAE,CAAA;AAAA,IAC7B,CAAA;AAEA,IAAA,MAAM,QAAA,GAAW,QAAA,CAAS,aAAA,CAAc,qCAAqC,CAAA;AAC7E,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,YAAA,EAAa;AACb,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,IAAA,MAAA,CAAO,GAAA,GAAM,yDAAyD,OAAO,CAAA,CAAA;AAC7E,IAAA,MAAA,CAAO,KAAA,GAAQ,IAAA;AACf,IAAA,MAAA,CAAO,MAAA,GAAS,MAAM,YAAA,EAAa;AACnC,IAAA,MAAA,CAAO,UAAU,MAAM;AACrB,MAAA,YAAA,CAAa,MAAM,CAAA;AACnB,MAAA,MAAA,CAAO,IAAI,CAAA;AAAA,IACb,CAAA;AACA,IAAA,QAAA,CAAS,IAAA,CAAK,YAAY,MAAM,CAAA;AAAA,EAClC,CAAC,CAAA;AACH;AAMA,eAAsB,kBAAkB,eAAA,EAAkD;AACxF,EAAA,MAAM,OAAA,GAAU,WAAW,eAAe,CAAA;AAC1C,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,MAAA,KAAW,aAAa,OAAO,IAAA;AACtD,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,MAAM,UAAA,CAAW,OAAO,CAAA;AAC3C,IAAA,IAAI,CAAC,UAAA,EAAY,UAAA,EAAY,OAAA,EAAS,OAAO,IAAA;AAK7C,IAAA,MAAM,IAAI,QAAc,CAAC,OAAA,KAAY,WAAW,UAAA,CAAW,KAAA,CAAM,OAAO,CAAC,CAAA;AACzE,IAAA,MAAM,KAAA,GAAQ,MAAM,UAAA,CAAW,UAAA,CAAW,QAAQ,OAAA,EAAS,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AAC/E,IAAA,OAAO,KAAA,IAAS,IAAA;AAAA,EAClB,SAAS,GAAA,EAAK;AAGZ,IAAA,IAAI;AACF,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,GAAG,CAAC,CAAA;AACvD,MAAA,MAAM,GAAA,GAAM,MAAA;AACZ,MAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,UAAA,CAAW,UAAA,CAAW,QAAQ,OAAA,EAAS,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AACnF,MAAA,OAAO,KAAA,IAAS,IAAA;AAAA,IAClB,SAAS,QAAA,EAAU;AACjB,MAAA,OAAA,CAAQ,IAAA,CAAK,wBAAwB,QAAQ,CAAA;AAC7C,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACF;;;ACpEA,SAAS,UAAA,CAAW,KAAa,IAAA,EAAkC;AACjE,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAC1D,EAAA,MAAM,KAAA,GAAQ,IAAI,KAAA,CAAM,IAAI,OAAO,CAAA,WAAA,EAAc,OAAO,UAAU,CAAC,CAAA;AACnE,EAAA,OAAO,KAAA,GAAQ,kBAAA,CAAmB,KAAA,CAAM,CAAC,CAAC,CAAA,GAAI,MAAA;AAChD;AAEO,SAAS,eAAA,GAA+B;AAC7C,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA,EAAa,OAAO,EAAC;AAC7C,EAAA,MAAM,GAAA,GAAM,SAAS,MAAA,IAAU,EAAA;AAC/B,EAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAC;AAElB,EAAA,MAAM,WAAwB,EAAC;AAK/B,EAAA,MAAM,EAAA,GAAK,UAAA,CAAW,GAAA,EAAK,KAAK,CAAA;AAChC,EAAA,IAAI,EAAA,EAAI;AACN,IAAA,MAAM,KAAA,GAAQ,EAAA,CAAG,KAAA,CAAM,GAAG,CAAA;AAC1B,IAAA,IAAI,KAAA,CAAM,UAAU,CAAA,EAAG;AACrB,MAAA,MAAM,QAAA,GAAW,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAC,CAAA,CAAA;AACtE,MAAA,IAAI,YAAA,CAAa,IAAA,CAAK,QAAQ,CAAA,WAAY,UAAA,GAAa,QAAA;AAAA,IACzD;AAAA,EACF;AAGA,EAAA,MAAM,WAAmC,EAAC;AAC1C,EAAA,KAAA,MAAW,GAAA,IAAO,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,MAAA,GAAS,IAAI,IAAA,EAAK;AACxB,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA;AAC7B,IAAA,IAAI,KAAK,CAAA,EAAG;AACZ,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B,IAAA,MAAM,SAAA,GAAY,oBAAA,CAAqB,IAAA,CAAK,IAAI,IAAI,CAAC,CAAA;AACrD,IAAA,IAAI,CAAC,SAAA,EAAW;AAChB,IAAA,MAAM,KAAA,GAAQ,mBAAmB,MAAA,CAAO,KAAA,CAAM,KAAK,CAAC,CAAC,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA;AAChE,IAAA,IAAI,KAAA,CAAM,MAAA,IAAU,CAAA,IAAK,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,CAAC,CAAC,CAAA,EAAG,QAAA,CAAS,SAAS,CAAA,GAAI,MAAM,CAAC,CAAA;AAAA,EAChF;AACA,EAAA,IAAI,OAAO,IAAA,CAAK,QAAQ,EAAE,MAAA,GAAS,CAAA,WAAY,UAAA,GAAa,QAAA;AAE5D,EAAA,OAAO,QAAA;AACT;;;ACnDO,SAAS,YAAA,GAA+D;AAI7E,EAAA,MAAM,MAAA,GACJ,OAAO,MAAA,KAAW,WAAA,GACb,MAAA,CAAe,oBAAA,IAAwB,sBAAA,GACxC,OAAA,CAAQ,GAAA,CAAI,aAAA,IAAiB,OAAA,CAAQ,GAAA,CAAI,yBAAA,IAA6B,sBAAA;AAC5E,EAAA,MAAM,MAAA,GACJ,OAAO,MAAA,KAAW,WAAA,GAAe,OAAe,oBAAA,GAAuB,MAAA;AACzE,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC1B;AAEA,SAAS,YAAA,GAA8C;AACrD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,EAAC;AAC3C,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAA,CAAO,SAAS,MAAM,CAAA;AACzD,EAAA,MAAM,MAAqC,EAAC;AAC5C,EAAA,KAAA,MAAW,OAAO,CAAC,YAAA,EAAc,cAAc,cAAA,EAAgB,UAAA,EAAY,aAAa,CAAA,EAAG;AACzF,IAAA,GAAA,CAAI,GAAG,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAAA,EAC3B;AACA,EAAA,OAAO,GAAA;AACT;AAoBA,eAAsB,UAAA,CAAW;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA,EAAqC;AACnC,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,YAAA,EAAa;AACxC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,MAAM,6DAA6D,CAAA;AAAA,EAC/E;AAGA,EAAA,MAAM,iBAAiB,MAAA,CAAO,iBAAA,GAC1B,MAAM,iBAAA,CAAkB,MAAA,CAAO,kBAAkB,CAAA,GACjD,IAAA;AACJ,EAAA,IAAI,MAAA,CAAO,iBAAA,IAAqB,CAAC,cAAA,EAAgB;AAC/C,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC1E;AAEA,EAAA,MAAM,iBAAA,GAAoB,OAAO,cAAA,IAAkBA,uCAAA;AACnD,EAAA,MAAM,MAAM,YAAA,EAAa;AAIzB,EAAA,MAAM,MAAM,eAAA,EAAgB;AAE5B,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,QAAQ,MAAA,CAAO,EAAA;AAAA,IACf,SAAS,MAAA,CAAO,EAAA;AAAA,IAChB,IAAA,EAAM;AAAA,MACJ,GAAG,MAAA;AAAA,MACH,GAAI,OAAO,gBAAA,GAAmB,EAAE,CAAC,iBAAiB,GAAG,aAAA,EAAc,GAAI;AAAC,KAC1E;AAAA,IACA,QAAA,EAAU;AAAA,MACR,SAAS,OAAO,MAAA,KAAW,WAAA,GAAc,MAAA,CAAO,SAAS,IAAA,GAAO,IAAA;AAAA,MAChE,UAAU,OAAO,QAAA,KAAa,WAAA,GAAc,QAAA,CAAS,YAAY,IAAA,GAAO,IAAA;AAAA,MACxE,SAAA,EAAW,OAAO,SAAA,KAAc,WAAA,GAAc,UAAU,SAAA,GAAY,IAAA;AAAA,MACpE,WACE,OAAO,cAAA,KAAmB,cAAc,cAAA,CAAe,OAAA,CAAQ,SAAS,CAAA,GAAI,IAAA;AAAA;AAAA;AAAA;AAAA,MAI9E,WACE,OAAO,YAAA,KAAiB,cAAc,YAAA,CAAa,OAAA,CAAQ,SAAS,CAAA,GAAI,IAAA;AAAA,MAC1E,gBAAgB,cAAA,IAAkB,MAAA;AAAA,MAClC,WAAW,GAAA,CAAI,UAAA;AAAA,MACf,WAAW,GAAA,CAAI,UAAA;AAAA,MACf,aAAa,GAAA,CAAI,YAAA;AAAA,MACjB,SAAS,GAAA,CAAI,QAAA;AAAA,MACb,YAAY,GAAA,CAAI,WAAA;AAAA,MAChB,GAAG,GAAA;AAAA;AAAA;AAAA,MAGH,IAAA,EACE,OAAO,MAAA,KAAW,WAAA,GACb,OAA0C,iBAAA,IAC3C,MAAA,CAAO,SAAS,IAAA,GAChB,MAAA;AAAA,MACN,aAAA,EAAe;AAAA;AACjB,GACF;AAEA,EAAA,MAAM,WAAW,MAAMC,2BAAA;AAAA,IACrB,GAAG,MAAM,CAAA,wBAAA,CAAA;AAAA,IACT;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,aAAA,EAAe,UAAU,MAAM,CAAA;AAAA,OACjC;AAAA,MACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAO;AAAA,KAC9B;AAAA,IACA,EAAE,OAAA,EAAS,CAAA,EAAG,SAAA,EAAW,GAAA;AAAM,GACjC;AAEA,EAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAEnD,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,GAAA,GAAA,CACJ,IAAA,EAAM,OAAA,IACN,IAAA,EAAM,KAAA,KACL,QAAA,CAAS,UAAA,IAAc,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA,CAAA,EAE9C,QAAA,GACA,IAAA,EAAK;AACR,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,MAAM,CAAA,uBAAA,EAA0B,GAAG,CAAA,CAAA,GAAK,CAAA,uBAAA,EAA0B,SAAS,MAAM,CAAA,CAAA;AAAA,KACnF;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT","file":"chunk-CNTDV7HM.js","sourcesContent":["/** Shown when the API omits or returns an empty `success_message`. */\nexport const DEFAULT_FORM_SUCCESS_MESSAGE =\n  'Thank you for your submission! We will be in touch soon.'\n","/**\n * Shared form-config normalizer — the ONE place a raw\n * /api/public/forms/config payload becomes a ManagedFormConfig.\n *\n * Deliberately has no `'use client'` directive and no hooks, so it is usable\n * from a Server Component (StaticForm) as well as from useForm's client\n * fetch. Both the server shell and the hydrated enhancement must agree on\n * field order, step count and success copy or the swap visibly jumps, so\n * there must never be a second copy of this.\n */\n\nimport type { ManagedFormConfig } from './types'\nimport { DEFAULT_FORM_SUCCESS_MESSAGE } from './defaultSuccessMessage'\n\n/**\n * Normalize a raw /api/public/forms/config payload into ManagedFormConfig.\n * Single source of truth — used for both the client fetch and server-provided\n * `initialForm`, so the two paths can never drift.\n */\nexport function normalizeFormConfig(data: any): ManagedFormConfig {\n  if (data.steps) {\n    data.steps.sort((a: any, b: any) => (a.step_number || 0) - (b.step_number || 0))\n  }\n  if (data.fields) {\n    data.fields.sort((a: any, b: any) => (a.sort_order || 0) - (b.sort_order || 0))\n  }\n\n  const total_steps = data.steps?.length || 1\n  const is_multi_step = total_steps > 1\n\n  const apiSuccess =\n    typeof data.success_message === 'string' ? data.success_message.trim() : ''\n  const success_message =\n    apiSuccess ||\n    (typeof (data as { successMessage?: string }).successMessage === 'string'\n      ? String((data as { successMessage?: string }).successMessage).trim()\n      : '') ||\n    DEFAULT_FORM_SUCCESS_MESSAGE\n\n  return {\n    ...data,\n    success_message,\n    total_steps,\n    is_multi_step,\n  }\n}\n","/**\n * reCAPTCHA Enterprise - Client-side token generation for site-kit forms\n *\n * Site key is read from:\n * - window.__SITE_KIT_RECAPTCHA_SITE_KEY__ (set by SiteKitLayout)\n * - process.env.NEXT_PUBLIC_RECAPTCHA_SITE_KEY (when bundled in Next.js app)\n */\n\nfunction getSiteKey(explicitSiteKey?: string): string | undefined {\n  if (typeof window === 'undefined') return undefined\n  if (explicitSiteKey) return explicitSiteKey\n  const win = window as any\n  return win.__SITE_KIT_RECAPTCHA_SITE_KEY__ ?? process.env.NEXT_PUBLIC_RECAPTCHA_SITE_KEY\n}\n\n/** Max time to wait for reCAPTCHA Enterprise to become usable before giving up. */\nconst RECAPTCHA_LOAD_TIMEOUT_MS = 10000\n\nfunction loadScript(siteKey: string): Promise<any> {\n  return new Promise((resolve) => {\n    if (typeof window === 'undefined') {\n      resolve(null)\n      return\n    }\n    const win = window as any\n    if (win.grecaptcha?.enterprise) {\n      resolve(win.grecaptcha)\n      return\n    }\n\n    // Never hang the form: if the script is blocked (ad-blocker), stalls, or\n    // never initializes `grecaptcha.enterprise`, resolve null after a timeout.\n    // The caller treats a null result as \"no token\" rather than waiting forever.\n    let settled = false\n    const finish = (value: any) => {\n      if (settled) return\n      settled = true\n      resolve(value)\n    }\n    const giveUp = setTimeout(() => finish(null), RECAPTCHA_LOAD_TIMEOUT_MS)\n\n    const waitForReady = () => {\n      if (settled) return\n      if (win.grecaptcha?.enterprise) {\n        clearTimeout(giveUp)\n        finish(win.grecaptcha)\n        return\n      }\n      setTimeout(waitForReady, 50)\n    }\n\n    const existing = document.querySelector('script[src*=\"recaptcha/enterprise\"]')\n    if (existing) {\n      waitForReady()\n      return\n    }\n\n    const script = document.createElement('script')\n    script.src = `https://www.google.com/recaptcha/enterprise.js?render=${siteKey}`\n    script.async = true\n    script.onload = () => waitForReady()\n    script.onerror = () => {\n      clearTimeout(giveUp)\n      finish(null)\n    }\n    document.head.appendChild(script)\n  })\n}\n\n/**\n * Get a reCAPTCHA Enterprise token for form submission.\n * Returns null if not configured or in SSR.\n */\nexport async function getRecaptchaToken(explicitSiteKey?: string): Promise<string | null> {\n  const siteKey = getSiteKey(explicitSiteKey)\n  if (!siteKey || typeof window === 'undefined') return null\n  try {\n    const grecaptcha = await loadScript(siteKey)\n    if (!grecaptcha?.enterprise?.execute) return null\n    // loadScript only waits for grecaptcha.enterprise to EXIST — execute()\n    // before enterprise.ready() rejects while the widget initializes (cold\n    // page load = every first-visit submitter). A swallowed rejection here\n    // means no token, and a requireRecaptcha project hard-rejects the lead.\n    await new Promise<void>((resolve) => grecaptcha.enterprise.ready(resolve))\n    const token = await grecaptcha.enterprise.execute(siteKey, { action: 'submit' })\n    return token || null\n  } catch (err) {\n    // One retry after a beat — first-execute flakes persist on slow devices\n    // even post-ready, and a dropped token is a dropped lead.\n    try {\n      await new Promise((resolve) => setTimeout(resolve, 800))\n      const win = window as any\n      const token = await win.grecaptcha.enterprise.execute(siteKey, { action: 'submit' })\n      return token || null\n    } catch (retryErr) {\n      console.warn('[site-kit reCAPTCHA]', retryErr)\n      return null\n    }\n  }\n}\n","/**\n * Reads the visitor's GA4 identity out of their own first-party cookies so a\n * lead conversion can be reported SERVER-side.\n *\n * Why the server has to do the reporting: Sonor's form-submit endpoint answers\n * with a byte-identical success payload whether it accepted a submission or\n * quarantined it as spam (deliberately — a bot must never learn it was\n * caught). So the browser cannot tell a real lead from a filtered one, and a\n * site firing its own ad conversion bills both. The accept/reject verdict only\n * exists on the server, so the conversion has to be sent from there — and to\n * send it, the server needs the GA4 identity that only the browser can see.\n *\n * Nothing here is a new identifier: these are cookies Google's own tag already\n * set on this visitor. We read them, we never write them.\n */\n\nexport interface Ga4Identity {\n  /** GA4 client id, from `_ga`. Without it a server-sent event has no identity. */\n  gaClientId?: string\n  /**\n   * GA4 session ids keyed by container id (the measurement id minus `G-`), from\n   * the `_ga_<CONTAINER>` cookies.\n   *\n   * A map rather than one value because a page may carry more than one GA4\n   * property, and picking the wrong one would silently attach the lead to the\n   * wrong session — the sender knows which measurement id it is configured for,\n   * this side does not.\n   */\n  gaSessions?: Record<string, string>\n}\n\nfunction readCookie(jar: string, name: string): string | undefined {\n  const escaped = name.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')\n  const match = jar.match(new RegExp(`(?:^|;\\\\s*)${escaped}=([^;]*)`))\n  return match ? decodeURIComponent(match[1]) : undefined\n}\n\nexport function readGa4Identity(): Ga4Identity {\n  if (typeof document === 'undefined') return {}\n  const jar = document.cookie || ''\n  if (!jar) return {}\n\n  const identity: Ga4Identity = {}\n\n  // `_ga` is `GA1.<depth>.<id1>.<id2>`; the client id is the last two parts\n  // joined. Reading the raw cookie rather than the trailing two segments\n  // blindly keeps it correct when the depth prefix varies by domain scope.\n  const ga = readCookie(jar, '_ga')\n  if (ga) {\n    const parts = ga.split('.')\n    if (parts.length >= 4) {\n      const clientId = `${parts[parts.length - 2]}.${parts[parts.length - 1]}`\n      if (/^\\d+\\.\\d+$/.test(clientId)) identity.gaClientId = clientId\n    }\n  }\n\n  // `_ga_<CONTAINER>` is `GS<v>.<depth>.<session_id>.<session_number>....`\n  const sessions: Record<string, string> = {}\n  for (const raw of jar.split(';')) {\n    const cookie = raw.trim()\n    const eq = cookie.indexOf('=')\n    if (eq < 0) continue\n    const name = cookie.slice(0, eq)\n    const container = /^_ga_([A-Z0-9]+)$/i.exec(name)?.[1]\n    if (!container) continue\n    const parts = decodeURIComponent(cookie.slice(eq + 1)).split('.')\n    if (parts.length >= 3 && /^\\d+$/.test(parts[2])) sessions[container] = parts[2]\n  }\n  if (Object.keys(sessions).length > 0) identity.gaSessions = sessions\n\n  return identity\n}\n","/**\n * @sonordev/site-kit/forms - Shared submission logic\n *\n * Single source of truth for sending a managed form to the Sonor API. Both\n * <ManagedForm> (via FormClient) and the headless useForm() hook submit through\n * here, so the request shape, retry behaviour, reCAPTCHA handling, and error\n * parsing can never drift between the two paths.\n */\n\nimport { sonorFetch } from '../shared/sonorFetch'\nimport { getRecaptchaToken } from './recaptcha'\nimport { DEFAULT_HONEYPOT_FIELD } from './contract'\nimport { readGa4Identity } from './ga4-identity'\nimport type { ManagedFormConfig } from './types'\n\n// The honeypot trap-field name lives once in the shared forms contract\n// (single source of truth for site-kit's client + sonor-api's intake).\n// Re-exported so existing importers of this path keep resolving it.\nexport { DEFAULT_HONEYPOT_FIELD }\n\nexport function getApiConfig(): { apiUrl: string; apiKey: string | undefined } {\n  // Server branch must honor the same env override SiteKitLayout feeds into\n  // __SITE_KIT_API_URL__, or SSR-rendered absolute URLs (the native form\n  // action) would point at prod from a staging site.\n  const apiUrl =\n    typeof window !== 'undefined'\n      ? (window as any).__SITE_KIT_API_URL__ || 'https://api.sonor.io'\n      : process.env.SONOR_API_URL || process.env.NEXT_PUBLIC_SONOR_API_URL || 'https://api.sonor.io'\n  const apiKey =\n    typeof window !== 'undefined' ? (window as any).__SITE_KIT_API_KEY__ : undefined\n  return { apiUrl, apiKey }\n}\n\nfunction getUTMParams(): Record<string, string | null> {\n  if (typeof window === 'undefined') return {}\n  const params = new URLSearchParams(window.location.search)\n  const out: Record<string, string | null> = {}\n  for (const key of ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content']) {\n    out[key] = params.get(key)\n  }\n  return out\n}\n\nexport interface SubmitFormArgs {\n  config: ManagedFormConfig\n  /**\n   * Field values to submit. The caller must pass VISIBLE values only —\n   * conditionally-hidden fields should be excluded so stale values are not sent.\n   */\n  values: Record<string, unknown>\n  /** Honeypot input value (empty string for the headless hook, which has no honeypot UI). */\n  honeypotValue: string\n  /** Timestamp (ms) the form was first rendered — a weak anti-bot timing signal. */\n  formLoadedAt: number\n}\n\n/**\n * Submit a managed form. Throws on failure (network, timeout, or a non-2xx\n * response) with a human-readable message; resolves with the parsed API\n * response on success.\n */\nexport async function submitForm({\n  config,\n  values,\n  honeypotValue,\n  formLoadedAt,\n}: SubmitFormArgs): Promise<unknown> {\n  const { apiUrl, apiKey } = getApiConfig()\n  if (!apiKey) {\n    throw new Error('API key is required. Set SONOR_API_KEY in your environment.')\n  }\n\n  // reCAPTCHA token is fetched right before the POST so it cannot expire.\n  const recaptchaToken = config.recaptcha_enabled\n    ? await getRecaptchaToken(config.recaptcha_site_key)\n    : null\n  if (config.recaptcha_enabled && !recaptchaToken) {\n    throw new Error('Verification could not be completed. Please try again.')\n  }\n\n  const honeypotFieldName = config.honeypot_field || DEFAULT_HONEYPOT_FIELD\n  const utm = getUTMParams()\n  // The visitor's existing GA4 cookies, so Sonor can report an accepted lead\n  // as a conversion server-side. Nothing is written or created here — see\n  // ga4-identity.ts for why the server, not this browser, has to do it.\n  const ga4 = readGa4Identity()\n\n  const payload = {\n    formId: config.id,\n    form_id: config.id,\n    data: {\n      ...values,\n      ...(config.honeypot_enabled ? { [honeypotFieldName]: honeypotValue } : {}),\n    },\n    metadata: {\n      pageUrl: typeof window !== 'undefined' ? window.location.href : null,\n      referrer: typeof document !== 'undefined' ? document.referrer || null : null,\n      userAgent: typeof navigator !== 'undefined' ? navigator.userAgent : null,\n      sessionId:\n        typeof sessionStorage !== 'undefined' ? sessionStorage.getItem('_sk_sid') : null,\n      // Anonymous visitor id (_sk_vid) — the same id Analytics/Signal stamp on\n      // page views, so the Sonor side can bind this lead to its browsing session\n      // (page -> lead attribution). Sent on every submission; null pre-hydration.\n      visitorId:\n        typeof localStorage !== 'undefined' ? localStorage.getItem('_sk_vid') : null,\n      recaptchaToken: recaptchaToken || undefined,\n      utmSource: utm.utm_source,\n      utmMedium: utm.utm_medium,\n      utmCampaign: utm.utm_campaign,\n      utmTerm: utm.utm_term,\n      utmContent: utm.utm_content,\n      ...ga4,\n      // Sub-site host — preserved on form_submissions for lead attribution\n      // across multi-site projects. Resolved by SiteKitClientProviders.\n      site:\n        typeof window !== 'undefined'\n          ? (window as { __SITE_KIT_SITE__?: string }).__SITE_KIT_SITE__ ||\n            window.location.host\n          : undefined,\n      _formLoadedAt: formLoadedAt,\n    },\n  }\n\n  const response = await sonorFetch(\n    `${apiUrl}/api/public/forms/submit`,\n    {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${apiKey}`,\n      },\n      body: JSON.stringify(payload),\n    },\n    { retries: 2, timeoutMs: 20000 },\n  )\n\n  const data = await response.json().catch(() => null)\n\n  if (!response.ok) {\n    const msg = (\n      data?.message ??\n      data?.error ??\n      (response.statusText || `HTTP ${response.status}`)\n    )\n      .toString()\n      .trim()\n    throw new Error(\n      msg ? `Failed to submit form: ${msg}` : `Failed to submit form (${response.status})`,\n    )\n  }\n\n  return data\n}\n"]}
+{"version":3,"sources":["../src/forms/defaultSuccessMessage.ts","../src/forms/normalize-config.ts","../src/forms/recaptcha.ts","../src/forms/ga4-identity.ts","../src/forms/submitForm.ts"],"names":["DEFAULT_HONEYPOT_FIELD","sonorFetch"],"mappings":";;;;;;AACO,IAAM,4BAAA,GACX;;;ACiBK,SAAS,oBAAoB,IAAA,EAA8B;AAChE,EAAA,IAAI,KAAK,KAAA,EAAO;AACd,IAAA,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,EAAQ,CAAA,KAAA,CAAY,EAAE,WAAA,IAAe,CAAA,KAAM,CAAA,CAAE,WAAA,IAAe,CAAA,CAAE,CAAA;AAAA,EACjF;AACA,EAAA,IAAI,KAAK,MAAA,EAAQ;AACf,IAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,EAAQ,CAAA,KAAA,CAAY,EAAE,UAAA,IAAc,CAAA,KAAM,CAAA,CAAE,UAAA,IAAc,CAAA,CAAE,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,EAAO,MAAA,IAAU,CAAA;AAC1C,EAAA,MAAM,gBAAgB,WAAA,GAAc,CAAA;AAEpC,EAAA,MAAM,UAAA,GACJ,OAAO,IAAA,CAAK,eAAA,KAAoB,WAAW,IAAA,CAAK,eAAA,CAAgB,MAAK,GAAI,EAAA;AAC3E,EAAA,MAAM,eAAA,GACJ,UAAA,KACC,OAAQ,IAAA,CAAqC,cAAA,KAAmB,QAAA,GAC7D,MAAA,CAAQ,IAAA,CAAqC,cAAc,CAAA,CAAE,IAAA,EAAK,GAClE,EAAA,CAAA,IACJ,4BAAA;AAEF,EAAA,OAAO;AAAA,IACL,GAAG,IAAA;AAAA,IACH,eAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF;AACF;;;ACrCA,SAAS,WAAW,eAAA,EAA8C;AAChE,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,MAAA;AAC1C,EAAA,IAAI,iBAAiB,OAAO,eAAA;AAC5B,EAAA,MAAM,GAAA,GAAM,MAAA;AACZ,EAAA,OAAO,GAAA,CAAI,+BAAA,IAAmC,OAAA,CAAQ,GAAA,CAAI,8BAAA;AAC5D;AAGA,IAAM,yBAAA,GAA4B,GAAA;AAElC,SAAS,WAAW,OAAA,EAA+B;AACjD,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC9B,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,MAAA;AACZ,IAAA,IAAI,GAAA,CAAI,YAAY,UAAA,EAAY;AAC9B,MAAA,OAAA,CAAQ,IAAI,UAAU,CAAA;AACtB,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,MAAM,MAAA,GAAS,CAAC,KAAA,KAAe;AAC7B,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,IACf,CAAA;AACA,IAAA,MAAM,SAAS,UAAA,CAAW,MAAM,MAAA,CAAO,IAAI,GAAG,yBAAyB,CAAA;AAEvE,IAAA,MAAM,eAAe,MAAM;AACzB,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,IAAI,GAAA,CAAI,YAAY,UAAA,EAAY;AAC9B,QAAA,YAAA,CAAa,MAAM,CAAA;AACnB,QAAA,MAAA,CAAO,IAAI,UAAU,CAAA;AACrB,QAAA;AAAA,MACF;AACA,MAAA,UAAA,CAAW,cAAc,EAAE,CAAA;AAAA,IAC7B,CAAA;AAEA,IAAA,MAAM,QAAA,GAAW,QAAA,CAAS,aAAA,CAAc,qCAAqC,CAAA;AAC7E,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,YAAA,EAAa;AACb,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,IAAA,MAAA,CAAO,GAAA,GAAM,yDAAyD,OAAO,CAAA,CAAA;AAC7E,IAAA,MAAA,CAAO,KAAA,GAAQ,IAAA;AACf,IAAA,MAAA,CAAO,MAAA,GAAS,MAAM,YAAA,EAAa;AACnC,IAAA,MAAA,CAAO,UAAU,MAAM;AACrB,MAAA,YAAA,CAAa,MAAM,CAAA;AACnB,MAAA,MAAA,CAAO,IAAI,CAAA;AAAA,IACb,CAAA;AACA,IAAA,QAAA,CAAS,IAAA,CAAK,YAAY,MAAM,CAAA;AAAA,EAClC,CAAC,CAAA;AACH;AAMA,eAAsB,kBAAkB,eAAA,EAAkD;AACxF,EAAA,MAAM,OAAA,GAAU,WAAW,eAAe,CAAA;AAC1C,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,MAAA,KAAW,aAAa,OAAO,IAAA;AACtD,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,MAAM,UAAA,CAAW,OAAO,CAAA;AAC3C,IAAA,IAAI,CAAC,UAAA,EAAY,UAAA,EAAY,OAAA,EAAS,OAAO,IAAA;AAK7C,IAAA,MAAM,IAAI,QAAc,CAAC,OAAA,KAAY,WAAW,UAAA,CAAW,KAAA,CAAM,OAAO,CAAC,CAAA;AACzE,IAAA,MAAM,KAAA,GAAQ,MAAM,UAAA,CAAW,UAAA,CAAW,QAAQ,OAAA,EAAS,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AAC/E,IAAA,OAAO,KAAA,IAAS,IAAA;AAAA,EAClB,SAAS,GAAA,EAAK;AAGZ,IAAA,IAAI;AACF,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,GAAG,CAAC,CAAA;AACvD,MAAA,MAAM,GAAA,GAAM,MAAA;AACZ,MAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,UAAA,CAAW,UAAA,CAAW,QAAQ,OAAA,EAAS,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AACnF,MAAA,OAAO,KAAA,IAAS,IAAA;AAAA,IAClB,SAAS,QAAA,EAAU;AACjB,MAAA,OAAA,CAAQ,IAAA,CAAK,wBAAwB,QAAQ,CAAA;AAC7C,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACF;;;ACpEA,SAAS,UAAA,CAAW,KAAa,IAAA,EAAkC;AACjE,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAC1D,EAAA,MAAM,KAAA,GAAQ,IAAI,KAAA,CAAM,IAAI,OAAO,CAAA,WAAA,EAAc,OAAO,UAAU,CAAC,CAAA;AACnE,EAAA,OAAO,KAAA,GAAQ,kBAAA,CAAmB,KAAA,CAAM,CAAC,CAAC,CAAA,GAAI,MAAA;AAChD;AAEO,SAAS,eAAA,GAA+B;AAC7C,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA,EAAa,OAAO,EAAC;AAC7C,EAAA,MAAM,GAAA,GAAM,SAAS,MAAA,IAAU,EAAA;AAC/B,EAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAC;AAElB,EAAA,MAAM,WAAwB,EAAC;AAK/B,EAAA,MAAM,EAAA,GAAK,UAAA,CAAW,GAAA,EAAK,KAAK,CAAA;AAChC,EAAA,IAAI,EAAA,EAAI;AACN,IAAA,MAAM,KAAA,GAAQ,EAAA,CAAG,KAAA,CAAM,GAAG,CAAA;AAC1B,IAAA,IAAI,KAAA,CAAM,UAAU,CAAA,EAAG;AACrB,MAAA,MAAM,QAAA,GAAW,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAC,CAAA,CAAA;AACtE,MAAA,IAAI,YAAA,CAAa,IAAA,CAAK,QAAQ,CAAA,WAAY,UAAA,GAAa,QAAA;AAAA,IACzD;AAAA,EACF;AAGA,EAAA,MAAM,WAAmC,EAAC;AAC1C,EAAA,KAAA,MAAW,GAAA,IAAO,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,MAAA,GAAS,IAAI,IAAA,EAAK;AACxB,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA;AAC7B,IAAA,IAAI,KAAK,CAAA,EAAG;AACZ,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B,IAAA,MAAM,SAAA,GAAY,oBAAA,CAAqB,IAAA,CAAK,IAAI,IAAI,CAAC,CAAA;AACrD,IAAA,IAAI,CAAC,SAAA,EAAW;AAChB,IAAA,MAAM,KAAA,GAAQ,mBAAmB,MAAA,CAAO,KAAA,CAAM,KAAK,CAAC,CAAC,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA;AAChE,IAAA,IAAI,KAAA,CAAM,MAAA,IAAU,CAAA,IAAK,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,CAAC,CAAC,CAAA,EAAG,QAAA,CAAS,SAAS,CAAA,GAAI,MAAM,CAAC,CAAA;AAAA,EAChF;AACA,EAAA,IAAI,OAAO,IAAA,CAAK,QAAQ,EAAE,MAAA,GAAS,CAAA,WAAY,UAAA,GAAa,QAAA;AAE5D,EAAA,OAAO,QAAA;AACT;;;ACnDO,SAAS,YAAA,GAA+D;AAI7E,EAAA,MAAM,MAAA,GACJ,OAAO,MAAA,KAAW,WAAA,GACb,MAAA,CAAe,oBAAA,IAAwB,sBAAA,GACxC,OAAA,CAAQ,GAAA,CAAI,aAAA,IAAiB,OAAA,CAAQ,GAAA,CAAI,yBAAA,IAA6B,sBAAA;AAC5E,EAAA,MAAM,MAAA,GACJ,OAAO,MAAA,KAAW,WAAA,GAAe,OAAe,oBAAA,GAAuB,MAAA;AACzE,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC1B;AAEA,SAAS,YAAA,GAA8C;AACrD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,EAAC;AAC3C,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAA,CAAO,SAAS,MAAM,CAAA;AACzD,EAAA,MAAM,MAAqC,EAAC;AAC5C,EAAA,KAAA,MAAW,OAAO,CAAC,YAAA,EAAc,cAAc,cAAA,EAAgB,UAAA,EAAY,aAAa,CAAA,EAAG;AACzF,IAAA,GAAA,CAAI,GAAG,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAAA,EAC3B;AACA,EAAA,OAAO,GAAA;AACT;AAoBA,eAAsB,UAAA,CAAW;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA,EAAqC;AACnC,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,YAAA,EAAa;AACxC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,MAAM,6DAA6D,CAAA;AAAA,EAC/E;AAGA,EAAA,MAAM,iBAAiB,MAAA,CAAO,iBAAA,GAC1B,MAAM,iBAAA,CAAkB,MAAA,CAAO,kBAAkB,CAAA,GACjD,IAAA;AACJ,EAAA,IAAI,MAAA,CAAO,iBAAA,IAAqB,CAAC,cAAA,EAAgB;AAC/C,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC1E;AAEA,EAAA,MAAM,iBAAA,GAAoB,OAAO,cAAA,IAAkBA,uCAAA;AACnD,EAAA,MAAM,MAAM,YAAA,EAAa;AAIzB,EAAA,MAAM,MAAM,eAAA,EAAgB;AAE5B,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,QAAQ,MAAA,CAAO,EAAA;AAAA,IACf,SAAS,MAAA,CAAO,EAAA;AAAA,IAChB,IAAA,EAAM;AAAA,MACJ,GAAG,MAAA;AAAA,MACH,GAAI,OAAO,gBAAA,GAAmB,EAAE,CAAC,iBAAiB,GAAG,aAAA,EAAc,GAAI;AAAC,KAC1E;AAAA,IACA,QAAA,EAAU;AAAA,MACR,SAAS,OAAO,MAAA,KAAW,WAAA,GAAc,MAAA,CAAO,SAAS,IAAA,GAAO,IAAA;AAAA,MAChE,UAAU,OAAO,QAAA,KAAa,WAAA,GAAc,QAAA,CAAS,YAAY,IAAA,GAAO,IAAA;AAAA,MACxE,SAAA,EAAW,OAAO,SAAA,KAAc,WAAA,GAAc,UAAU,SAAA,GAAY,IAAA;AAAA,MACpE,WACE,OAAO,cAAA,KAAmB,cAAc,cAAA,CAAe,OAAA,CAAQ,SAAS,CAAA,GAAI,IAAA;AAAA;AAAA;AAAA;AAAA,MAI9E,WACE,OAAO,YAAA,KAAiB,cAAc,YAAA,CAAa,OAAA,CAAQ,SAAS,CAAA,GAAI,IAAA;AAAA,MAC1E,gBAAgB,cAAA,IAAkB,MAAA;AAAA,MAClC,WAAW,GAAA,CAAI,UAAA;AAAA,MACf,WAAW,GAAA,CAAI,UAAA;AAAA,MACf,aAAa,GAAA,CAAI,YAAA;AAAA,MACjB,SAAS,GAAA,CAAI,QAAA;AAAA,MACb,YAAY,GAAA,CAAI,WAAA;AAAA,MAChB,GAAG,GAAA;AAAA;AAAA;AAAA,MAGH,IAAA,EACE,OAAO,MAAA,KAAW,WAAA,GACb,OAA0C,iBAAA,IAC3C,MAAA,CAAO,SAAS,IAAA,GAChB,MAAA;AAAA,MACN,aAAA,EAAe;AAAA;AACjB,GACF;AAEA,EAAA,MAAM,WAAW,MAAMC,2BAAA;AAAA,IACrB,GAAG,MAAM,CAAA,wBAAA,CAAA;AAAA,IACT;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,aAAA,EAAe,UAAU,MAAM,CAAA;AAAA,OACjC;AAAA,MACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAO;AAAA,KAC9B;AAAA,IACA,EAAE,OAAA,EAAS,CAAA,EAAG,SAAA,EAAW,GAAA;AAAM,GACjC;AAEA,EAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAEnD,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,GAAA,GAAA,CACJ,IAAA,EAAM,OAAA,IACN,IAAA,EAAM,KAAA,KACL,QAAA,CAAS,UAAA,IAAc,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA,CAAA,EAE9C,QAAA,GACA,IAAA,EAAK;AACR,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,MAAM,CAAA,uBAAA,EAA0B,GAAG,CAAA,CAAA,GAAK,CAAA,uBAAA,EAA0B,SAAS,MAAM,CAAA,CAAA;AAAA,KACnF;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT","file":"chunk-4NBJDP6Y.js","sourcesContent":["/** Shown when the API omits or returns an empty `success_message`. */\nexport const DEFAULT_FORM_SUCCESS_MESSAGE =\n  'Thank you for your submission! We will be in touch soon.'\n","/**\n * Shared form-config normalizer — the ONE place a raw\n * /api/public/forms/config payload becomes a ManagedFormConfig.\n *\n * Deliberately has no `'use client'` directive and no hooks, so it is usable\n * from a Server Component (StaticForm) as well as from useForm's client\n * fetch. Both the server shell and the hydrated enhancement must agree on\n * field order, step count and success copy or the swap visibly jumps, so\n * there must never be a second copy of this.\n */\n\nimport type { ManagedFormConfig } from './types'\nimport { DEFAULT_FORM_SUCCESS_MESSAGE } from './defaultSuccessMessage'\n\n/**\n * Normalize a raw /api/public/forms/config payload into ManagedFormConfig.\n * Single source of truth — used for both the client fetch and server-provided\n * `initialForm`, so the two paths can never drift.\n */\nexport function normalizeFormConfig(data: any): ManagedFormConfig {\n  if (data.steps) {\n    data.steps.sort((a: any, b: any) => (a.step_number || 0) - (b.step_number || 0))\n  }\n  if (data.fields) {\n    data.fields.sort((a: any, b: any) => (a.sort_order || 0) - (b.sort_order || 0))\n  }\n\n  const total_steps = data.steps?.length || 1\n  const is_multi_step = total_steps > 1\n\n  const apiSuccess =\n    typeof data.success_message === 'string' ? data.success_message.trim() : ''\n  const success_message =\n    apiSuccess ||\n    (typeof (data as { successMessage?: string }).successMessage === 'string'\n      ? String((data as { successMessage?: string }).successMessage).trim()\n      : '') ||\n    DEFAULT_FORM_SUCCESS_MESSAGE\n\n  return {\n    ...data,\n    success_message,\n    total_steps,\n    is_multi_step,\n  }\n}\n","/**\n * reCAPTCHA Enterprise - Client-side token generation for site-kit forms\n *\n * Site key is read from:\n * - window.__SITE_KIT_RECAPTCHA_SITE_KEY__ (set by SiteKitLayout)\n * - process.env.NEXT_PUBLIC_RECAPTCHA_SITE_KEY (when bundled in Next.js app)\n */\n\nfunction getSiteKey(explicitSiteKey?: string): string | undefined {\n  if (typeof window === 'undefined') return undefined\n  if (explicitSiteKey) return explicitSiteKey\n  const win = window as any\n  return win.__SITE_KIT_RECAPTCHA_SITE_KEY__ ?? process.env.NEXT_PUBLIC_RECAPTCHA_SITE_KEY\n}\n\n/** Max time to wait for reCAPTCHA Enterprise to become usable before giving up. */\nconst RECAPTCHA_LOAD_TIMEOUT_MS = 10000\n\nfunction loadScript(siteKey: string): Promise<any> {\n  return new Promise((resolve) => {\n    if (typeof window === 'undefined') {\n      resolve(null)\n      return\n    }\n    const win = window as any\n    if (win.grecaptcha?.enterprise) {\n      resolve(win.grecaptcha)\n      return\n    }\n\n    // Never hang the form: if the script is blocked (ad-blocker), stalls, or\n    // never initializes `grecaptcha.enterprise`, resolve null after a timeout.\n    // The caller treats a null result as \"no token\" rather than waiting forever.\n    let settled = false\n    const finish = (value: any) => {\n      if (settled) return\n      settled = true\n      resolve(value)\n    }\n    const giveUp = setTimeout(() => finish(null), RECAPTCHA_LOAD_TIMEOUT_MS)\n\n    const waitForReady = () => {\n      if (settled) return\n      if (win.grecaptcha?.enterprise) {\n        clearTimeout(giveUp)\n        finish(win.grecaptcha)\n        return\n      }\n      setTimeout(waitForReady, 50)\n    }\n\n    const existing = document.querySelector('script[src*=\"recaptcha/enterprise\"]')\n    if (existing) {\n      waitForReady()\n      return\n    }\n\n    const script = document.createElement('script')\n    script.src = `https://www.google.com/recaptcha/enterprise.js?render=${siteKey}`\n    script.async = true\n    script.onload = () => waitForReady()\n    script.onerror = () => {\n      clearTimeout(giveUp)\n      finish(null)\n    }\n    document.head.appendChild(script)\n  })\n}\n\n/**\n * Get a reCAPTCHA Enterprise token for form submission.\n * Returns null if not configured or in SSR.\n */\nexport async function getRecaptchaToken(explicitSiteKey?: string): Promise<string | null> {\n  const siteKey = getSiteKey(explicitSiteKey)\n  if (!siteKey || typeof window === 'undefined') return null\n  try {\n    const grecaptcha = await loadScript(siteKey)\n    if (!grecaptcha?.enterprise?.execute) return null\n    // loadScript only waits for grecaptcha.enterprise to EXIST — execute()\n    // before enterprise.ready() rejects while the widget initializes (cold\n    // page load = every first-visit submitter). A swallowed rejection here\n    // means no token, and a requireRecaptcha project hard-rejects the lead.\n    await new Promise<void>((resolve) => grecaptcha.enterprise.ready(resolve))\n    const token = await grecaptcha.enterprise.execute(siteKey, { action: 'submit' })\n    return token || null\n  } catch (err) {\n    // One retry after a beat — first-execute flakes persist on slow devices\n    // even post-ready, and a dropped token is a dropped lead.\n    try {\n      await new Promise((resolve) => setTimeout(resolve, 800))\n      const win = window as any\n      const token = await win.grecaptcha.enterprise.execute(siteKey, { action: 'submit' })\n      return token || null\n    } catch (retryErr) {\n      console.warn('[site-kit reCAPTCHA]', retryErr)\n      return null\n    }\n  }\n}\n","/**\n * Reads the visitor's GA4 identity out of their own first-party cookies so a\n * lead conversion can be reported SERVER-side.\n *\n * Why the server has to do the reporting: Sonor's form-submit endpoint answers\n * with a byte-identical success payload whether it accepted a submission or\n * quarantined it as spam (deliberately — a bot must never learn it was\n * caught). So the browser cannot tell a real lead from a filtered one, and a\n * site firing its own ad conversion bills both. The accept/reject verdict only\n * exists on the server, so the conversion has to be sent from there — and to\n * send it, the server needs the GA4 identity that only the browser can see.\n *\n * Nothing here is a new identifier: these are cookies Google's own tag already\n * set on this visitor. We read them, we never write them.\n */\n\nexport interface Ga4Identity {\n  /** GA4 client id, from `_ga`. Without it a server-sent event has no identity. */\n  gaClientId?: string\n  /**\n   * GA4 session ids keyed by container id (the measurement id minus `G-`), from\n   * the `_ga_<CONTAINER>` cookies.\n   *\n   * A map rather than one value because a page may carry more than one GA4\n   * property, and picking the wrong one would silently attach the lead to the\n   * wrong session — the sender knows which measurement id it is configured for,\n   * this side does not.\n   */\n  gaSessions?: Record<string, string>\n}\n\nfunction readCookie(jar: string, name: string): string | undefined {\n  const escaped = name.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')\n  const match = jar.match(new RegExp(`(?:^|;\\\\s*)${escaped}=([^;]*)`))\n  return match ? decodeURIComponent(match[1]) : undefined\n}\n\nexport function readGa4Identity(): Ga4Identity {\n  if (typeof document === 'undefined') return {}\n  const jar = document.cookie || ''\n  if (!jar) return {}\n\n  const identity: Ga4Identity = {}\n\n  // `_ga` is `GA1.<depth>.<id1>.<id2>`; the client id is the last two parts\n  // joined. Reading the raw cookie rather than the trailing two segments\n  // blindly keeps it correct when the depth prefix varies by domain scope.\n  const ga = readCookie(jar, '_ga')\n  if (ga) {\n    const parts = ga.split('.')\n    if (parts.length >= 4) {\n      const clientId = `${parts[parts.length - 2]}.${parts[parts.length - 1]}`\n      if (/^\\d+\\.\\d+$/.test(clientId)) identity.gaClientId = clientId\n    }\n  }\n\n  // `_ga_<CONTAINER>` is `GS<v>.<depth>.<session_id>.<session_number>....`\n  const sessions: Record<string, string> = {}\n  for (const raw of jar.split(';')) {\n    const cookie = raw.trim()\n    const eq = cookie.indexOf('=')\n    if (eq < 0) continue\n    const name = cookie.slice(0, eq)\n    const container = /^_ga_([A-Z0-9]+)$/i.exec(name)?.[1]\n    if (!container) continue\n    const parts = decodeURIComponent(cookie.slice(eq + 1)).split('.')\n    if (parts.length >= 3 && /^\\d+$/.test(parts[2])) sessions[container] = parts[2]\n  }\n  if (Object.keys(sessions).length > 0) identity.gaSessions = sessions\n\n  return identity\n}\n","/**\n * @sonordev/site-kit/forms - Shared submission logic\n *\n * Single source of truth for sending a managed form to the Sonor API. Both\n * <ManagedForm> (via FormClient) and the headless useForm() hook submit through\n * here, so the request shape, retry behaviour, reCAPTCHA handling, and error\n * parsing can never drift between the two paths.\n */\n\nimport { sonorFetch } from '../shared/sonorFetch'\nimport { getRecaptchaToken } from './recaptcha'\nimport { DEFAULT_HONEYPOT_FIELD } from './contract'\nimport { readGa4Identity } from './ga4-identity'\nimport type { ManagedFormConfig } from './types'\n\n// The honeypot trap-field name lives once in the shared forms contract\n// (single source of truth for site-kit's client + sonor-api's intake).\n// Re-exported so existing importers of this path keep resolving it.\nexport { DEFAULT_HONEYPOT_FIELD }\n\nexport function getApiConfig(): { apiUrl: string; apiKey: string | undefined } {\n  // Server branch must honor the same env override SiteKitLayout feeds into\n  // __SITE_KIT_API_URL__, or SSR-rendered absolute URLs (the native form\n  // action) would point at prod from a staging site.\n  const apiUrl =\n    typeof window !== 'undefined'\n      ? (window as any).__SITE_KIT_API_URL__ || 'https://api.sonor.io'\n      : process.env.SONOR_API_URL || process.env.NEXT_PUBLIC_SONOR_API_URL || 'https://api.sonor.io'\n  const apiKey =\n    typeof window !== 'undefined' ? (window as any).__SITE_KIT_API_KEY__ : undefined\n  return { apiUrl, apiKey }\n}\n\nfunction getUTMParams(): Record<string, string | null> {\n  if (typeof window === 'undefined') return {}\n  const params = new URLSearchParams(window.location.search)\n  const out: Record<string, string | null> = {}\n  for (const key of ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content']) {\n    out[key] = params.get(key)\n  }\n  return out\n}\n\nexport interface SubmitFormArgs {\n  config: ManagedFormConfig\n  /**\n   * Field values to submit. The caller must pass VISIBLE values only —\n   * conditionally-hidden fields should be excluded so stale values are not sent.\n   */\n  values: Record<string, unknown>\n  /** Honeypot input value (empty string for the headless hook, which has no honeypot UI). */\n  honeypotValue: string\n  /** Timestamp (ms) the form was first rendered — a weak anti-bot timing signal. */\n  formLoadedAt: number\n}\n\n/**\n * Submit a managed form. Throws on failure (network, timeout, or a non-2xx\n * response) with a human-readable message; resolves with the parsed API\n * response on success.\n */\nexport async function submitForm({\n  config,\n  values,\n  honeypotValue,\n  formLoadedAt,\n}: SubmitFormArgs): Promise<unknown> {\n  const { apiUrl, apiKey } = getApiConfig()\n  if (!apiKey) {\n    throw new Error('API key is required. Set SONOR_API_KEY in your environment.')\n  }\n\n  // reCAPTCHA token is fetched right before the POST so it cannot expire.\n  const recaptchaToken = config.recaptcha_enabled\n    ? await getRecaptchaToken(config.recaptcha_site_key)\n    : null\n  if (config.recaptcha_enabled && !recaptchaToken) {\n    throw new Error('Verification could not be completed. Please try again.')\n  }\n\n  const honeypotFieldName = config.honeypot_field || DEFAULT_HONEYPOT_FIELD\n  const utm = getUTMParams()\n  // The visitor's existing GA4 cookies, so Sonor can report an accepted lead\n  // as a conversion server-side. Nothing is written or created here — see\n  // ga4-identity.ts for why the server, not this browser, has to do it.\n  const ga4 = readGa4Identity()\n\n  const payload = {\n    formId: config.id,\n    form_id: config.id,\n    data: {\n      ...values,\n      ...(config.honeypot_enabled ? { [honeypotFieldName]: honeypotValue } : {}),\n    },\n    metadata: {\n      pageUrl: typeof window !== 'undefined' ? window.location.href : null,\n      referrer: typeof document !== 'undefined' ? document.referrer || null : null,\n      userAgent: typeof navigator !== 'undefined' ? navigator.userAgent : null,\n      sessionId:\n        typeof sessionStorage !== 'undefined' ? sessionStorage.getItem('_sk_sid') : null,\n      // Anonymous visitor id (_sk_vid) — the same id Analytics/Signal stamp on\n      // page views, so the Sonor side can bind this lead to its browsing session\n      // (page -> lead attribution). Sent on every submission; null pre-hydration.\n      visitorId:\n        typeof localStorage !== 'undefined' ? localStorage.getItem('_sk_vid') : null,\n      recaptchaToken: recaptchaToken || undefined,\n      utmSource: utm.utm_source,\n      utmMedium: utm.utm_medium,\n      utmCampaign: utm.utm_campaign,\n      utmTerm: utm.utm_term,\n      utmContent: utm.utm_content,\n      ...ga4,\n      // Sub-site host — preserved on form_submissions for lead attribution\n      // across multi-site projects. Resolved by SiteKitClientProviders.\n      site:\n        typeof window !== 'undefined'\n          ? (window as { __SITE_KIT_SITE__?: string }).__SITE_KIT_SITE__ ||\n            window.location.host\n          : undefined,\n      _formLoadedAt: formLoadedAt,\n    },\n  }\n\n  const response = await sonorFetch(\n    `${apiUrl}/api/public/forms/submit`,\n    {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${apiKey}`,\n      },\n      body: JSON.stringify(payload),\n    },\n    { retries: 2, timeoutMs: 20000 },\n  )\n\n  const data = await response.json().catch(() => null)\n\n  if (!response.ok) {\n    const msg = (\n      data?.message ??\n      data?.error ??\n      (response.statusText || `HTTP ${response.status}`)\n    )\n      .toString()\n      .trim()\n    throw new Error(\n      msg ? `Failed to submit form: ${msg}` : `Failed to submit form (${response.status})`,\n    )\n  }\n\n  return data\n}\n"]}

package/dist/{chunk-PIEHBSCN.js → chunk-4VCR6TXK.js}

@@ -1,9 +1,9 @@
 'use client';
 'use strict';
 
-var chunkR7GHP3FY_js = require('./chunk-R7GHP3FY.js');
+var chunkJONWE26J_js = require('./chunk-JONWE26J.js');
 var chunk5RNAUYWE_js = require('./chunk-5RNAUYWE.js');
-var chunkI7HOMMIK_js = require('./chunk-I7HOMMIK.js');
+var chunk5ABTBPPK_js = require('./chunk-5ABTBPPK.js');
 var react = require('react');
 
 var SYNC_STAMP_KEY = "_sk_sitemap_synced_at";
@@ -47,7 +47,7 @@ function storeSyncedHash(hash) {
 }
 async function parseSitemap(sitemapUrl, debug) {
   try {
-    const response = await chunkI7HOMMIK_js.sonorFetch(sitemapUrl);
+    const response = await chunk5ABTBPPK_js.sonorFetch(sitemapUrl);
     if (!response.ok) {
       if (debug) console.warn("[SitemapSync] Failed to fetch sitemap:", response.status);
       return [];
@@ -65,8 +65,8 @@ async function parseSitemap(sitemapUrl, debug) {
     urls.forEach((url) => {
       const loc = url.querySelector("loc")?.textContent?.trim();
       if (!loc) return;
-      const path = chunkR7GHP3FY_js.locToPath(loc);
-      if (chunkR7GHP3FY_js.isMalformedSitemapPath(path)) {
+      const path = chunkJONWE26J_js.locToPath(loc);
+      if (chunkJONWE26J_js.isMalformedSitemapPath(path)) {
         if (debug) console.warn(`[SitemapSync] Skipping malformed path: ${path}`);
         return;
       }
@@ -97,7 +97,7 @@ async function syncToPortal(entries, apiUrl, apiKey, site, debug, mode = "additi
   try {
     const target = chunk5RNAUYWE_js.resolveAnalyticsTarget({ ...gate, apiUrl, apiKey });
     if (!target) return { success: false, created: 0, updated: 0 };
-    const response = await chunkI7HOMMIK_js.sonorFetch(`${target.apiUrl}/api/public/seo/register-sitemap`, {
+    const response = await chunk5ABTBPPK_js.sonorFetch(`${target.apiUrl}/api/public/seo/register-sitemap`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -105,7 +105,7 @@ async function syncToPortal(entries, apiUrl, apiKey, site, debug, mode = "additi
           path: e.path,
           priority: e.priority,
           changefreq: e.changefreq,
-          pageType: chunkR7GHP3FY_js.inferPageType(e.path)
+          pageType: chunkJONWE26J_js.inferPageType(e.path)
         })),
         mode,
         // Sub-site host — tagged on every seo_pages row so the dashboard
@@ -191,5 +191,5 @@ function SitemapSync({
 }
 
 exports.SitemapSync = SitemapSync;
-//# sourceMappingURL=chunk-PIEHBSCN.js.map
-//# sourceMappingURL=chunk-PIEHBSCN.js.map
+//# sourceMappingURL=chunk-4VCR6TXK.js.map
+//# sourceMappingURL=chunk-4VCR6TXK.js.map

package/dist/{chunk-PIEHBSCN.js.map → chunk-4VCR6TXK.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/SitemapSync.tsx"],"names":["sonorFetch","locToPath","isMalformedSitemapPath","resolveAnalyticsTarget","inferPageType","useRef","useEffect"],"mappings":";;;;;;;AAwDA,IAAM,cAAA,GAAiB,uBAAA;AACvB,IAAM,aAAA,GAAgB,kBAAA;AAEtB,SAAS,iBAAiB,eAAA,EAAkC;AAC1D,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,OAAA,CAAQ,cAAc,CAAA;AACnD,IAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,IAAA,MAAM,UAAU,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,CAAS,OAAO,EAAE,CAAA;AAC/C,IAAA,OAAO,OAAA,IAAW,CAAA,IAAK,OAAA,GAAU,eAAA,GAAkB,EAAA,GAAK,GAAA;AAAA,EAC1D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAA,GAAoB;AAC3B,EAAA,IAAI;AACF,IAAA,cAAA,CAAe,QAAQ,cAAA,EAAgB,IAAA,CAAK,GAAA,EAAI,CAAE,UAAU,CAAA;AAAA,EAC9D,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AASA,SAAS,WAAA,CAAY,YAAoB,OAAA,EAAiC;AACxE,EAAA,MAAM,IAAA,GAAO,QACV,GAAA,CAAI,CAAA,CAAA,KAAK,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAA,IAAW,EAAE,IAAI,CAAA,CAAE,UAAA,IAAc,EAAE,CAAA,CAAA,EAAI,CAAA,CAAE,YAAY,EAAE,CAAA,CAAE,CAAA,CACjF,IAAA,CAAK,IAAI,CAAA;AACZ,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,QAAQ,CAAA,EAAA,EAAK;AACpC,IAAA,IAAA,GAAA,CAAS,QAAQ,CAAA,IAAK,IAAA,GAAO,IAAA,CAAK,UAAA,CAAW,CAAC,CAAA,GAAK,CAAA;AAAA,EACrD;AACA,EAAA,OAAO,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,OAAA,CAAQ,MAAM,CAAA,CAAA,EAAI,IAAA,CAAK,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA;AAC7D;AAEA,SAAS,oBAAoB,IAAA,EAAuB;AAClD,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,OAAA,CAAQ,aAAa,CAAA,KAAM,IAAA;AAAA,EACjD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB,IAAA,EAAoB;AAC3C,EAAA,IAAI;AACF,IAAA,YAAA,CAAa,OAAA,CAAQ,eAAe,IAAI,CAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,eAAe,YAAA,CAAa,YAAoB,KAAA,EAAyC;AACvF,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAMA,2BAAA,CAAW,UAAU,CAAA;AAC5C,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,wCAAA,EAA0C,SAAS,MAAM,CAAA;AACjF,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,MAAM,MAAA,GAAS,IAAI,SAAA,EAAU;AAC7B,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,eAAA,CAAgB,IAAA,EAAM,iBAAiB,CAAA;AAE1D,IAAA,MAAM,UAAA,GAAa,GAAA,CAAI,aAAA,CAAc,aAAa,CAAA;AAClD,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,oCAAA,EAAsC,WAAW,WAAW,CAAA;AACpF,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,gBAAA,CAAiB,KAAK,CAAA;AACvC,IAAA,MAAM,UAA0B,EAAC;AAEjC,IAAA,IAAA,CAAK,QAAQ,CAAA,GAAA,KAAO;AAClB,MAAA,MAAM,MAAM,GAAA,CAAI,aAAA,CAAc,KAAK,CAAA,EAAG,aAAa,IAAA,EAAK;AACxD,MAAA,IAAI,CAAC,GAAA,EAAK;AAEV,MAAA,MAAM,IAAA,GAAOC,2BAAU,GAAG,CAAA;AAG1B,MAAA,IAAIC,uCAAA,CAAuB,IAAI,CAAA,EAAG;AAChC,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,CAAA,uCAAA,EAA0C,IAAI,CAAA,CAAE,CAAA;AACxE,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,GAAA,CAAI,aAAA,CAAc,SAAS,GAAG,WAAA,IAAe,KAAA,CAAA;AAC7D,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,aAAA,CAAc,YAAY,GAAG,WAAA,IAAe,KAAA,CAAA;AACnE,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,aAAA,CAAc,UAAU,CAAA,EAAG,WAAA;AACnD,MAAA,MAAM,QAAA,GAAW,WAAA,GAAc,UAAA,CAAW,WAAW,CAAA,GAAI,KAAA,CAAA;AAEzD,MAAA,OAAA,CAAQ,KAAK,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,UAAU,CAAA;AAAA,IACtD,CAAC,CAAA;AAED,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,qBAAA,EAAwB,OAAA,CAAQ,MAAM,CAAA,qBAAA,CAAuB,CAAA;AAAA,IAC3E;AAEA,IAAA,OAAO,OAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,sCAAA,EAAwC,KAAK,CAAA;AACtE,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAEA,eAAe,YAAA,CACb,OAAA,EACA,MAAA,EACA,MAAA,EACA,IAAA,EACA,OACA,IAAA,GAAoC,UAAA,EACpC,IAAA,GAA6B,EAAC,EACmC;AACjE,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,qCAAqC,CAAA;AAC7D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AAEA,EAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,kCAAkC,CAAA;AACzD,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EACjD;AAEA,EAAA,IAAI;AAGF,IAAA,MAAM,SAASC,uCAAA,CAAuB,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,QAAQ,CAAA;AACjE,IAAA,IAAI,CAAC,QAAQ,OAAO,EAAE,SAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,OAAA,EAAS,CAAA,EAAE;AAC7D,IAAA,MAAM,WAAW,MAAMH,2BAAA,CAAW,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,gCAAA,CAAA,EAAoC;AAAA,MACpF,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,OAAA,EAAS,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,MAAM;AAAA,UACzB,MAAM,CAAA,CAAE,IAAA;AAAA,UACR,UAAU,CAAA,CAAE,QAAA;AAAA,UACZ,YAAY,CAAA,CAAE,UAAA;AAAA,UACd,QAAA,EAAUI,8BAAA,CAAc,CAAA,CAAE,IAAI;AAAA,SAChC,CAAE,CAAA;AAAA,QACF,IAAA;AAAA;AAAA;AAAA;AAAA,QAIA,GAAI,IAAA,GAAO,EAAE,IAAA,KAAS;AAAC,OACxB;AAAA,OACA,EAAE,MAAA,EAAQ,OAAO,MAAA,EAAQ,OAAA,EAAS,GAAG,CAAA;AAExC,IAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,MAAA,IAAI,OAAO,OAAA,CAAQ,KAAA,CAAM,4BAA4B,QAAA,EAAU,MAAA,EAAQ,UAAU,UAAU,CAAA;AAC3F,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,IAClD;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AAEnC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,IAAI,CAAA,sBAAA,EAAyB,MAAA,CAAO,OAAO,CAAA,UAAA,EAAa,MAAA,CAAO,OAAO,CAAA,QAAA,CAAU,CAAA;AAAA,IAC1F;AAEA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAA;AAAA,MACT,OAAA,EAAS,OAAO,OAAA,IAAW,CAAA;AAAA,MAC3B,OAAA,EAAS,OAAO,OAAA,IAAW;AAAA,KAC7B;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,2BAAA,EAA6B,KAAK,CAAA;AAC3D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AACF;AAEO,SAAS,WAAA,CAAY;AAAA,EAC1B,UAAA,GAAa,cAAA;AAAA,EACb,YAAA,GAAe,EAAA;AAAA,EACf,KAAA,GAAQ,KAAA;AAAA,EACR,IAAA,GAAO,UAAA;AAAA,EACP,MAAA,EAAQ,UAAA;AAAA,EACR,MAAA,EAAQ,UAAA;AAAA,EACR,YAAA,GAAe,KAAA;AAAA,EACf,cAAA,GAAiB;AACnB,CAAA,EAAqB;AACnB,EAAA,MAAM,YAAA,GAAeC,aAAO,KAAK,CAAA;AACjC,EAAA,MAAM,WAAA,GAAcA,aAA8C,IAAI,CAAA;AAEtE,EAAAC,eAAA,CAAU,MAAM;AAMd,IAAA,MAAM,aAAA,GAA6C,UAAA;AAInD,IAAA,MAAM,eAAA,GAAkB,YAAA,GAAe,CAAA,GAAI,YAAA,GAAe,EAAA;AAE1D,IAAA,MAAM,SAAS,YAAY;AACzB,MAAA,MAAM,IAAA,GAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,QAAQ,UAAA,EAAY,YAAA,EAAc,gBAAgB,KAAA,EAAM;AAC3F,MAAA,MAAM,MAAA,GAASH,wCAAuB,IAAI,CAAA;AAC1C,MAAA,IAAI,CAAC,MAAA,EAAQ;AACb,MAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,MAAA;AAC3B,MAAA,MAAM,IAAA,GAAQ,MAAA,CAAe,iBAAA,IAAqB,MAAA,CAAO,SAAS,IAAA,IAAQ,EAAA;AAE1E,MAAA,IAAI,gBAAA,CAAiB,eAAe,CAAA,EAAG;AACrC,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,qDAAA,EAAkD,iBAAiB,kBAAkB,CAAA;AAC5G,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,KAAA,UAAe,GAAA,CAAI,wCAAA,EAA0C,OAAO,CAAA,OAAA,EAAU,IAAI,MAAM,EAAE,CAAA;AAE9F,MAAA,MAAM,OAAA,GAAU,MAAM,YAAA,CAAa,UAAA,EAAY,KAAK,CAAA;AAEpD,MAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,UAAA,EAAY,OAAO,CAAA;AAC5C,QAAA,IAAI,mBAAA,CAAoB,IAAI,CAAA,EAAG;AAI7B,UAAA,WAAA,EAAY;AACZ,UAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,gFAA2E,CAAA;AAClG,UAAA;AAAA,QACF;AACA,QAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,OAAA,EAAS,QAAQ,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAO,aAAA,EAAe,IAAI,CAAA;AAC3F,QAAA,IAAI,OAAO,OAAA,EAAS;AAClB,UAAA,WAAA,EAAY;AACZ,UAAA,eAAA,CAAgB,IAAI,CAAA;AAAA,QACtB;AAAA,MACF;AAAA,IACF,CAAA;AAEA,IAAA,IAAI,CAACA,uCAAA,CAAuB,EAAE,MAAA,EAAQ,UAAA,EAAY,MAAA,EAAQ,UAAA,EAAY,YAAA,EAAc,cAAA,EAAgB,KAAA,EAAO,CAAA,EAAG;AAE9G,IAAA,IAAI,CAAC,aAAa,OAAA,EAAS;AACzB,MAAA,YAAA,CAAa,OAAA,GAAU,IAAA;AACvB,MAAA,MAAA,EAAO;AAAA,IACT;AAEA,IAAA,IAAI,eAAe,CAAA,EAAG;AACpB,MAAA,WAAA,CAAY,OAAA,GAAU,WAAA,CAAY,MAAA,EAAQ,YAAA,GAAe,KAAK,GAAI,CAAA;AAAA,IACpE;AAEA,IAAA,OAAO,MAAM;AACX,MAAA,IAAI,YAAY,OAAA,EAAS;AACvB,QAAA,aAAA,CAAc,YAAY,OAAO,CAAA;AAAA,MACnC;AAAA,IACF,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,UAAA,EAAY,YAAA,EAAc,KAAA,EAAO,MAAM,UAAA,EAAY,UAAA,EAAY,YAAA,EAAc,cAAc,CAAC,CAAA;AAEhG,EAAA,OAAO,IAAA;AACT","file":"chunk-PIEHBSCN.js","sourcesContent":["/**\n * SitemapSync - Automatically sync sitemap.xml to Portal API\n *\n * Client-only component. Lives at package root so the main entry does not\n * pull in seo/ (and server-only code). For use in SiteKitLayout and\n * from @sonordev/site-kit/seo.\n *\n * @example\n * ```tsx\n * import { SitemapSync } from '@sonordev/site-kit'\n * // or\n * import { SitemapSync } from '@sonordev/site-kit/seo'\n * ```\n */\n\n'use client'\n\nimport { useEffect, useRef } from 'react'\nimport { sonorFetch } from './shared/sonorFetch'\nimport { resolveAnalyticsTarget, type AnalyticsGateOptions } from './shared/reporting-gate'\n// Single source of truth for page-type inference + path normalization, shared\n// with createSitemap (build) and the register-sitemap CLI. Pure string logic,\n// safe in the browser.\nimport { inferPageType, locToPath, isMalformedSitemapPath } from './sitemap/shared'\n\ninterface SitemapSyncProps extends AnalyticsGateOptions {\n  /** Custom sitemap URL (defaults to /sitemap.xml) */\n  sitemapUrl?: string\n  /** How often to re-sync in minutes (0 = only on mount, default: 60) */\n  syncInterval?: number\n  /** Enable debug logging */\n  debug?: boolean\n  /**\n   * Sync mode:\n   * - 'additive' (default for runtime): adds/updates pages but never deletes existing ones\n   * - 'full-replace': replaces the entire page set (use only for build-time sync via createSitemap)\n   */\n  mode?: 'additive' | 'full-replace'\n}\n\ninterface SitemapEntry {\n  path: string\n  lastmod?: string\n  changefreq?: string\n  priority?: number\n  pageType?: string\n}\n\n/**\n * Per-browser-session sync throttle. Build-time sync (createSitemap) is the\n * canonical source of truth; runtime SitemapSync is only a safety net — so\n * re-registering the sitemap on every full page load of every visitor is pure\n * waste (fetch + DOMParser on the visitor's main thread, plus a write per\n * pageview against the API). Stamp the last successful sync in sessionStorage\n * and skip while inside the throttle window.\n */\nconst SYNC_STAMP_KEY = '_sk_sitemap_synced_at'\nconst SYNC_HASH_KEY = '_sk_sitemap_hash'\n\nfunction isRecentlySynced(throttleMinutes: number): boolean {\n  try {\n    const stamp = sessionStorage.getItem(SYNC_STAMP_KEY)\n    if (!stamp) return false\n    const elapsed = Date.now() - parseInt(stamp, 10)\n    return elapsed >= 0 && elapsed < throttleMinutes * 60 * 1000\n  } catch {\n    return false // storage unavailable (private mode) — sync as before\n  }\n}\n\nfunction stampSynced(): void {\n  try {\n    sessionStorage.setItem(SYNC_STAMP_KEY, Date.now().toString())\n  } catch {\n    /* storage unavailable — throttle simply won't apply */\n  }\n}\n\n/**\n * Content-hash guard (localStorage, so it survives across sessions): the\n * sitemap of a static site only changes at deploy, so once ONE sync of a given\n * sitemap succeeded from this browser, re-POSTing the identical entry set is\n * pure API load. Hash the parsed entries; skip the POST when unchanged.\n * Keyed by sitemap URL so multiple SitemapSync instances don't collide.\n */\nfunction hashEntries(sitemapUrl: string, entries: SitemapEntry[]): string {\n  const text = entries\n    .map(e => `${e.path}|${e.lastmod ?? ''}|${e.changefreq ?? ''}|${e.priority ?? ''}`)\n    .join('\\n')\n  let hash = 0\n  for (let i = 0; i < text.length; i++) {\n    hash = ((hash << 5) - hash + text.charCodeAt(i)) | 0\n  }\n  return `${sitemapUrl}:${entries.length}:${hash.toString(16)}`\n}\n\nfunction isAlreadySyncedHash(hash: string): boolean {\n  try {\n    return localStorage.getItem(SYNC_HASH_KEY) === hash\n  } catch {\n    return false\n  }\n}\n\nfunction storeSyncedHash(hash: string): void {\n  try {\n    localStorage.setItem(SYNC_HASH_KEY, hash)\n  } catch {\n    /* storage unavailable — guard simply won't apply */\n  }\n}\n\nasync function parseSitemap(sitemapUrl: string, debug: boolean): Promise<SitemapEntry[]> {\n  try {\n    const response = await sonorFetch(sitemapUrl)\n    if (!response.ok) {\n      if (debug) console.warn('[SitemapSync] Failed to fetch sitemap:', response.status)\n      return []\n    }\n\n    const text = await response.text()\n    const parser = new DOMParser()\n    const doc = parser.parseFromString(text, 'application/xml')\n\n    const parseError = doc.querySelector('parsererror')\n    if (parseError) {\n      if (debug) console.warn('[SitemapSync] Sitemap parse error:', parseError.textContent)\n      return []\n    }\n\n    const urls = doc.querySelectorAll('url')\n    const entries: SitemapEntry[] = []\n\n    urls.forEach(url => {\n      const loc = url.querySelector('loc')?.textContent?.trim()\n      if (!loc) return\n\n      const path = locToPath(loc)\n\n      // Reject malformed paths (embedded domains, double protocols, etc.)\n      if (isMalformedSitemapPath(path)) {\n        if (debug) console.warn(`[SitemapSync] Skipping malformed path: ${path}`)\n        return\n      }\n\n      const lastmod = url.querySelector('lastmod')?.textContent || undefined\n      const changefreq = url.querySelector('changefreq')?.textContent || undefined\n      const priorityStr = url.querySelector('priority')?.textContent\n      const priority = priorityStr ? parseFloat(priorityStr) : undefined\n\n      entries.push({ path, lastmod, changefreq, priority })\n    })\n\n    if (debug) {\n      console.log(`[SitemapSync] Parsed ${entries.length} entries from sitemap`)\n    }\n\n    return entries\n  } catch (error) {\n    if (debug) console.error('[SitemapSync] Error parsing sitemap:', error)\n    return []\n  }\n}\n\nasync function syncToPortal(\n  entries: SitemapEntry[],\n  apiUrl: string,\n  apiKey: string,\n  site: string,\n  debug: boolean,\n  mode: 'additive' | 'full-replace' = 'additive',\n  gate: AnalyticsGateOptions = {},\n): Promise<{ success: boolean; created: number; updated: number }> {\n  if (!apiKey) {\n    if (debug) console.warn('[SitemapSync] No API key configured')\n    return { success: false, created: 0, updated: 0 }\n  }\n\n  if (entries.length === 0) {\n    if (debug) console.log('[SitemapSync] No entries to sync')\n    return { success: true, created: 0, updated: 0 }\n  }\n\n  try {\n    // Registration is idempotent in both modes (same payload → same final\n    // state), so retrying a timed-out attempt is safe.\n    const target = resolveAnalyticsTarget({ ...gate, apiUrl, apiKey })\n    if (!target) return { success: false, created: 0, updated: 0 }\n    const response = await sonorFetch(`${target.apiUrl}/api/public/seo/register-sitemap`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        entries: entries.map(e => ({\n          path: e.path,\n          priority: e.priority,\n          changefreq: e.changefreq,\n          pageType: inferPageType(e.path),\n        })),\n        mode,\n        // Sub-site host — tagged on every seo_pages row so the dashboard\n        // can scope the page tree to one microsite. Resolved by\n        // SiteKitClientProviders (see __SITE_KIT_SITE__).\n        ...(site ? { site } : {}),\n      }),\n    }, { apiKey: target.apiKey, retries: 2 })\n\n    if (!response?.ok) {\n      if (debug) console.error('[SitemapSync] API error:', response?.status, response?.statusText)\n      return { success: false, created: 0, updated: 0 }\n    }\n\n    const result = await response.json()\n\n    if (debug) {\n      console.log(`[SitemapSync] Synced: ${result.created} created, ${result.updated} updated`)\n    }\n\n    return {\n      success: true,\n      created: result.created || 0,\n      updated: result.updated || 0,\n    }\n  } catch (error) {\n    if (debug) console.error('[SitemapSync] Sync error:', error)\n    return { success: false, created: 0, updated: 0 }\n  }\n}\n\nexport function SitemapSync({\n  sitemapUrl = '/sitemap.xml',\n  syncInterval = 60,\n  debug = false,\n  mode = 'additive',\n  apiUrl: propApiUrl,\n  apiKey: propApiKey,\n  allowInFrame = false,\n  allowLocalhost = false,\n}: SitemapSyncProps) {\n  const hasSyncedRef = useRef(false)\n  const intervalRef = useRef<ReturnType<typeof setInterval> | null>(null)\n\n  useEffect(() => {\n    // Build-time sync via createSitemap is the canonical source of truth, but\n    // it can fail during ISR revalidation (app/ dir unavailable on serverless).\n    // Runtime SitemapSync in additive mode is a safe fallback — it adds/updates\n    // pages that may be missing without ever deleting existing ones.\n    // Full-replace is never safe at runtime — always force additive.\n    const effectiveMode: 'additive' | 'full-replace' = 'additive'\n\n    // Throttle window: reuse syncInterval when periodic syncing is on,\n    // otherwise default to 60 minutes for the on-mount sync.\n    const throttleMinutes = syncInterval > 0 ? syncInterval : 60\n\n    const doSync = async () => {\n      const gate = { apiUrl: propApiUrl, apiKey: propApiKey, allowInFrame, allowLocalhost, debug }\n      const target = resolveAnalyticsTarget(gate)\n      if (!target) return\n      const { apiUrl, apiKey } = target\n      const site = (window as any).__SITE_KIT_SITE__ || window.location.host || ''\n\n      if (isRecentlySynced(throttleMinutes)) {\n        if (debug) console.log('[SitemapSync] Skipped — synced within the last', throttleMinutes, 'min this session')\n        return\n      }\n\n      if (debug) console.log('[SitemapSync] Starting sitemap sync...', site ? `(site: ${site})` : '')\n\n      const entries = await parseSitemap(sitemapUrl, debug)\n\n      if (entries.length > 0) {\n        const hash = hashEntries(sitemapUrl, entries)\n        if (isAlreadySyncedHash(hash)) {\n          // This exact sitemap already synced from this browser — the server\n          // state can't be improved by re-POSTing it. Stamp the session so we\n          // don't even re-fetch/parse for the rest of the throttle window.\n          stampSynced()\n          if (debug) console.log('[SitemapSync] Skipped POST — sitemap unchanged since last successful sync')\n          return\n        }\n        const result = await syncToPortal(entries, apiUrl, apiKey, site, debug, effectiveMode, gate)\n        if (result.success) {\n          stampSynced()\n          storeSyncedHash(hash)\n        }\n      }\n    }\n\n    if (!resolveAnalyticsTarget({ apiUrl: propApiUrl, apiKey: propApiKey, allowInFrame, allowLocalhost, debug })) return\n\n    if (!hasSyncedRef.current) {\n      hasSyncedRef.current = true\n      doSync()\n    }\n\n    if (syncInterval > 0) {\n      intervalRef.current = setInterval(doSync, syncInterval * 60 * 1000)\n    }\n\n    return () => {\n      if (intervalRef.current) {\n        clearInterval(intervalRef.current)\n      }\n    }\n  }, [sitemapUrl, syncInterval, debug, mode, propApiUrl, propApiKey, allowInFrame, allowLocalhost])\n\n  return null\n}\n"]}
+{"version":3,"sources":["../src/SitemapSync.tsx"],"names":["sonorFetch","locToPath","isMalformedSitemapPath","resolveAnalyticsTarget","inferPageType","useRef","useEffect"],"mappings":";;;;;;;AAwDA,IAAM,cAAA,GAAiB,uBAAA;AACvB,IAAM,aAAA,GAAgB,kBAAA;AAEtB,SAAS,iBAAiB,eAAA,EAAkC;AAC1D,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,OAAA,CAAQ,cAAc,CAAA;AACnD,IAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,IAAA,MAAM,UAAU,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,CAAS,OAAO,EAAE,CAAA;AAC/C,IAAA,OAAO,OAAA,IAAW,CAAA,IAAK,OAAA,GAAU,eAAA,GAAkB,EAAA,GAAK,GAAA;AAAA,EAC1D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAA,GAAoB;AAC3B,EAAA,IAAI;AACF,IAAA,cAAA,CAAe,QAAQ,cAAA,EAAgB,IAAA,CAAK,GAAA,EAAI,CAAE,UAAU,CAAA;AAAA,EAC9D,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AASA,SAAS,WAAA,CAAY,YAAoB,OAAA,EAAiC;AACxE,EAAA,MAAM,IAAA,GAAO,QACV,GAAA,CAAI,CAAA,CAAA,KAAK,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAA,IAAW,EAAE,IAAI,CAAA,CAAE,UAAA,IAAc,EAAE,CAAA,CAAA,EAAI,CAAA,CAAE,YAAY,EAAE,CAAA,CAAE,CAAA,CACjF,IAAA,CAAK,IAAI,CAAA;AACZ,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,QAAQ,CAAA,EAAA,EAAK;AACpC,IAAA,IAAA,GAAA,CAAS,QAAQ,CAAA,IAAK,IAAA,GAAO,IAAA,CAAK,UAAA,CAAW,CAAC,CAAA,GAAK,CAAA;AAAA,EACrD;AACA,EAAA,OAAO,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,OAAA,CAAQ,MAAM,CAAA,CAAA,EAAI,IAAA,CAAK,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA;AAC7D;AAEA,SAAS,oBAAoB,IAAA,EAAuB;AAClD,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,OAAA,CAAQ,aAAa,CAAA,KAAM,IAAA;AAAA,EACjD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB,IAAA,EAAoB;AAC3C,EAAA,IAAI;AACF,IAAA,YAAA,CAAa,OAAA,CAAQ,eAAe,IAAI,CAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,eAAe,YAAA,CAAa,YAAoB,KAAA,EAAyC;AACvF,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAMA,2BAAA,CAAW,UAAU,CAAA;AAC5C,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,wCAAA,EAA0C,SAAS,MAAM,CAAA;AACjF,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,MAAM,MAAA,GAAS,IAAI,SAAA,EAAU;AAC7B,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,eAAA,CAAgB,IAAA,EAAM,iBAAiB,CAAA;AAE1D,IAAA,MAAM,UAAA,GAAa,GAAA,CAAI,aAAA,CAAc,aAAa,CAAA;AAClD,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,oCAAA,EAAsC,WAAW,WAAW,CAAA;AACpF,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,gBAAA,CAAiB,KAAK,CAAA;AACvC,IAAA,MAAM,UAA0B,EAAC;AAEjC,IAAA,IAAA,CAAK,QAAQ,CAAA,GAAA,KAAO;AAClB,MAAA,MAAM,MAAM,GAAA,CAAI,aAAA,CAAc,KAAK,CAAA,EAAG,aAAa,IAAA,EAAK;AACxD,MAAA,IAAI,CAAC,GAAA,EAAK;AAEV,MAAA,MAAM,IAAA,GAAOC,2BAAU,GAAG,CAAA;AAG1B,MAAA,IAAIC,uCAAA,CAAuB,IAAI,CAAA,EAAG;AAChC,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,CAAA,uCAAA,EAA0C,IAAI,CAAA,CAAE,CAAA;AACxE,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,GAAA,CAAI,aAAA,CAAc,SAAS,GAAG,WAAA,IAAe,KAAA,CAAA;AAC7D,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,aAAA,CAAc,YAAY,GAAG,WAAA,IAAe,KAAA,CAAA;AACnE,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,aAAA,CAAc,UAAU,CAAA,EAAG,WAAA;AACnD,MAAA,MAAM,QAAA,GAAW,WAAA,GAAc,UAAA,CAAW,WAAW,CAAA,GAAI,KAAA,CAAA;AAEzD,MAAA,OAAA,CAAQ,KAAK,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,UAAU,CAAA;AAAA,IACtD,CAAC,CAAA;AAED,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,qBAAA,EAAwB,OAAA,CAAQ,MAAM,CAAA,qBAAA,CAAuB,CAAA;AAAA,IAC3E;AAEA,IAAA,OAAO,OAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,sCAAA,EAAwC,KAAK,CAAA;AACtE,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAEA,eAAe,YAAA,CACb,OAAA,EACA,MAAA,EACA,MAAA,EACA,IAAA,EACA,OACA,IAAA,GAAoC,UAAA,EACpC,IAAA,GAA6B,EAAC,EACmC;AACjE,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,qCAAqC,CAAA;AAC7D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AAEA,EAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,kCAAkC,CAAA;AACzD,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EACjD;AAEA,EAAA,IAAI;AAGF,IAAA,MAAM,SAASC,uCAAA,CAAuB,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,QAAQ,CAAA;AACjE,IAAA,IAAI,CAAC,QAAQ,OAAO,EAAE,SAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,OAAA,EAAS,CAAA,EAAE;AAC7D,IAAA,MAAM,WAAW,MAAMH,2BAAA,CAAW,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,gCAAA,CAAA,EAAoC;AAAA,MACpF,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,OAAA,EAAS,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,MAAM;AAAA,UACzB,MAAM,CAAA,CAAE,IAAA;AAAA,UACR,UAAU,CAAA,CAAE,QAAA;AAAA,UACZ,YAAY,CAAA,CAAE,UAAA;AAAA,UACd,QAAA,EAAUI,8BAAA,CAAc,CAAA,CAAE,IAAI;AAAA,SAChC,CAAE,CAAA;AAAA,QACF,IAAA;AAAA;AAAA;AAAA;AAAA,QAIA,GAAI,IAAA,GAAO,EAAE,IAAA,KAAS;AAAC,OACxB;AAAA,OACA,EAAE,MAAA,EAAQ,OAAO,MAAA,EAAQ,OAAA,EAAS,GAAG,CAAA;AAExC,IAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,MAAA,IAAI,OAAO,OAAA,CAAQ,KAAA,CAAM,4BAA4B,QAAA,EAAU,MAAA,EAAQ,UAAU,UAAU,CAAA;AAC3F,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,IAClD;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AAEnC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,IAAI,CAAA,sBAAA,EAAyB,MAAA,CAAO,OAAO,CAAA,UAAA,EAAa,MAAA,CAAO,OAAO,CAAA,QAAA,CAAU,CAAA;AAAA,IAC1F;AAEA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAA;AAAA,MACT,OAAA,EAAS,OAAO,OAAA,IAAW,CAAA;AAAA,MAC3B,OAAA,EAAS,OAAO,OAAA,IAAW;AAAA,KAC7B;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,2BAAA,EAA6B,KAAK,CAAA;AAC3D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AACF;AAEO,SAAS,WAAA,CAAY;AAAA,EAC1B,UAAA,GAAa,cAAA;AAAA,EACb,YAAA,GAAe,EAAA;AAAA,EACf,KAAA,GAAQ,KAAA;AAAA,EACR,IAAA,GAAO,UAAA;AAAA,EACP,MAAA,EAAQ,UAAA;AAAA,EACR,MAAA,EAAQ,UAAA;AAAA,EACR,YAAA,GAAe,KAAA;AAAA,EACf,cAAA,GAAiB;AACnB,CAAA,EAAqB;AACnB,EAAA,MAAM,YAAA,GAAeC,aAAO,KAAK,CAAA;AACjC,EAAA,MAAM,WAAA,GAAcA,aAA8C,IAAI,CAAA;AAEtE,EAAAC,eAAA,CAAU,MAAM;AAMd,IAAA,MAAM,aAAA,GAA6C,UAAA;AAInD,IAAA,MAAM,eAAA,GAAkB,YAAA,GAAe,CAAA,GAAI,YAAA,GAAe,EAAA;AAE1D,IAAA,MAAM,SAAS,YAAY;AACzB,MAAA,MAAM,IAAA,GAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,QAAQ,UAAA,EAAY,YAAA,EAAc,gBAAgB,KAAA,EAAM;AAC3F,MAAA,MAAM,MAAA,GAASH,wCAAuB,IAAI,CAAA;AAC1C,MAAA,IAAI,CAAC,MAAA,EAAQ;AACb,MAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,MAAA;AAC3B,MAAA,MAAM,IAAA,GAAQ,MAAA,CAAe,iBAAA,IAAqB,MAAA,CAAO,SAAS,IAAA,IAAQ,EAAA;AAE1E,MAAA,IAAI,gBAAA,CAAiB,eAAe,CAAA,EAAG;AACrC,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,qDAAA,EAAkD,iBAAiB,kBAAkB,CAAA;AAC5G,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,KAAA,UAAe,GAAA,CAAI,wCAAA,EAA0C,OAAO,CAAA,OAAA,EAAU,IAAI,MAAM,EAAE,CAAA;AAE9F,MAAA,MAAM,OAAA,GAAU,MAAM,YAAA,CAAa,UAAA,EAAY,KAAK,CAAA;AAEpD,MAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,UAAA,EAAY,OAAO,CAAA;AAC5C,QAAA,IAAI,mBAAA,CAAoB,IAAI,CAAA,EAAG;AAI7B,UAAA,WAAA,EAAY;AACZ,UAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,gFAA2E,CAAA;AAClG,UAAA;AAAA,QACF;AACA,QAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,OAAA,EAAS,QAAQ,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAO,aAAA,EAAe,IAAI,CAAA;AAC3F,QAAA,IAAI,OAAO,OAAA,EAAS;AAClB,UAAA,WAAA,EAAY;AACZ,UAAA,eAAA,CAAgB,IAAI,CAAA;AAAA,QACtB;AAAA,MACF;AAAA,IACF,CAAA;AAEA,IAAA,IAAI,CAACA,uCAAA,CAAuB,EAAE,MAAA,EAAQ,UAAA,EAAY,MAAA,EAAQ,UAAA,EAAY,YAAA,EAAc,cAAA,EAAgB,KAAA,EAAO,CAAA,EAAG;AAE9G,IAAA,IAAI,CAAC,aAAa,OAAA,EAAS;AACzB,MAAA,YAAA,CAAa,OAAA,GAAU,IAAA;AACvB,MAAA,MAAA,EAAO;AAAA,IACT;AAEA,IAAA,IAAI,eAAe,CAAA,EAAG;AACpB,MAAA,WAAA,CAAY,OAAA,GAAU,WAAA,CAAY,MAAA,EAAQ,YAAA,GAAe,KAAK,GAAI,CAAA;AAAA,IACpE;AAEA,IAAA,OAAO,MAAM;AACX,MAAA,IAAI,YAAY,OAAA,EAAS;AACvB,QAAA,aAAA,CAAc,YAAY,OAAO,CAAA;AAAA,MACnC;AAAA,IACF,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,UAAA,EAAY,YAAA,EAAc,KAAA,EAAO,MAAM,UAAA,EAAY,UAAA,EAAY,YAAA,EAAc,cAAc,CAAC,CAAA;AAEhG,EAAA,OAAO,IAAA;AACT","file":"chunk-4VCR6TXK.js","sourcesContent":["/**\n * SitemapSync - Automatically sync sitemap.xml to Portal API\n *\n * Client-only component. Lives at package root so the main entry does not\n * pull in seo/ (and server-only code). For use in SiteKitLayout and\n * from @sonordev/site-kit/seo.\n *\n * @example\n * ```tsx\n * import { SitemapSync } from '@sonordev/site-kit'\n * // or\n * import { SitemapSync } from '@sonordev/site-kit/seo'\n * ```\n */\n\n'use client'\n\nimport { useEffect, useRef } from 'react'\nimport { sonorFetch } from './shared/sonorFetch'\nimport { resolveAnalyticsTarget, type AnalyticsGateOptions } from './shared/reporting-gate'\n// Single source of truth for page-type inference + path normalization, shared\n// with createSitemap (build) and the register-sitemap CLI. Pure string logic,\n// safe in the browser.\nimport { inferPageType, locToPath, isMalformedSitemapPath } from './sitemap/shared'\n\ninterface SitemapSyncProps extends AnalyticsGateOptions {\n  /** Custom sitemap URL (defaults to /sitemap.xml) */\n  sitemapUrl?: string\n  /** How often to re-sync in minutes (0 = only on mount, default: 60) */\n  syncInterval?: number\n  /** Enable debug logging */\n  debug?: boolean\n  /**\n   * Sync mode:\n   * - 'additive' (default for runtime): adds/updates pages but never deletes existing ones\n   * - 'full-replace': replaces the entire page set (use only for build-time sync via createSitemap)\n   */\n  mode?: 'additive' | 'full-replace'\n}\n\ninterface SitemapEntry {\n  path: string\n  lastmod?: string\n  changefreq?: string\n  priority?: number\n  pageType?: string\n}\n\n/**\n * Per-browser-session sync throttle. Build-time sync (createSitemap) is the\n * canonical source of truth; runtime SitemapSync is only a safety net — so\n * re-registering the sitemap on every full page load of every visitor is pure\n * waste (fetch + DOMParser on the visitor's main thread, plus a write per\n * pageview against the API). Stamp the last successful sync in sessionStorage\n * and skip while inside the throttle window.\n */\nconst SYNC_STAMP_KEY = '_sk_sitemap_synced_at'\nconst SYNC_HASH_KEY = '_sk_sitemap_hash'\n\nfunction isRecentlySynced(throttleMinutes: number): boolean {\n  try {\n    const stamp = sessionStorage.getItem(SYNC_STAMP_KEY)\n    if (!stamp) return false\n    const elapsed = Date.now() - parseInt(stamp, 10)\n    return elapsed >= 0 && elapsed < throttleMinutes * 60 * 1000\n  } catch {\n    return false // storage unavailable (private mode) — sync as before\n  }\n}\n\nfunction stampSynced(): void {\n  try {\n    sessionStorage.setItem(SYNC_STAMP_KEY, Date.now().toString())\n  } catch {\n    /* storage unavailable — throttle simply won't apply */\n  }\n}\n\n/**\n * Content-hash guard (localStorage, so it survives across sessions): the\n * sitemap of a static site only changes at deploy, so once ONE sync of a given\n * sitemap succeeded from this browser, re-POSTing the identical entry set is\n * pure API load. Hash the parsed entries; skip the POST when unchanged.\n * Keyed by sitemap URL so multiple SitemapSync instances don't collide.\n */\nfunction hashEntries(sitemapUrl: string, entries: SitemapEntry[]): string {\n  const text = entries\n    .map(e => `${e.path}|${e.lastmod ?? ''}|${e.changefreq ?? ''}|${e.priority ?? ''}`)\n    .join('\\n')\n  let hash = 0\n  for (let i = 0; i < text.length; i++) {\n    hash = ((hash << 5) - hash + text.charCodeAt(i)) | 0\n  }\n  return `${sitemapUrl}:${entries.length}:${hash.toString(16)}`\n}\n\nfunction isAlreadySyncedHash(hash: string): boolean {\n  try {\n    return localStorage.getItem(SYNC_HASH_KEY) === hash\n  } catch {\n    return false\n  }\n}\n\nfunction storeSyncedHash(hash: string): void {\n  try {\n    localStorage.setItem(SYNC_HASH_KEY, hash)\n  } catch {\n    /* storage unavailable — guard simply won't apply */\n  }\n}\n\nasync function parseSitemap(sitemapUrl: string, debug: boolean): Promise<SitemapEntry[]> {\n  try {\n    const response = await sonorFetch(sitemapUrl)\n    if (!response.ok) {\n      if (debug) console.warn('[SitemapSync] Failed to fetch sitemap:', response.status)\n      return []\n    }\n\n    const text = await response.text()\n    const parser = new DOMParser()\n    const doc = parser.parseFromString(text, 'application/xml')\n\n    const parseError = doc.querySelector('parsererror')\n    if (parseError) {\n      if (debug) console.warn('[SitemapSync] Sitemap parse error:', parseError.textContent)\n      return []\n    }\n\n    const urls = doc.querySelectorAll('url')\n    const entries: SitemapEntry[] = []\n\n    urls.forEach(url => {\n      const loc = url.querySelector('loc')?.textContent?.trim()\n      if (!loc) return\n\n      const path = locToPath(loc)\n\n      // Reject malformed paths (embedded domains, double protocols, etc.)\n      if (isMalformedSitemapPath(path)) {\n        if (debug) console.warn(`[SitemapSync] Skipping malformed path: ${path}`)\n        return\n      }\n\n      const lastmod = url.querySelector('lastmod')?.textContent || undefined\n      const changefreq = url.querySelector('changefreq')?.textContent || undefined\n      const priorityStr = url.querySelector('priority')?.textContent\n      const priority = priorityStr ? parseFloat(priorityStr) : undefined\n\n      entries.push({ path, lastmod, changefreq, priority })\n    })\n\n    if (debug) {\n      console.log(`[SitemapSync] Parsed ${entries.length} entries from sitemap`)\n    }\n\n    return entries\n  } catch (error) {\n    if (debug) console.error('[SitemapSync] Error parsing sitemap:', error)\n    return []\n  }\n}\n\nasync function syncToPortal(\n  entries: SitemapEntry[],\n  apiUrl: string,\n  apiKey: string,\n  site: string,\n  debug: boolean,\n  mode: 'additive' | 'full-replace' = 'additive',\n  gate: AnalyticsGateOptions = {},\n): Promise<{ success: boolean; created: number; updated: number }> {\n  if (!apiKey) {\n    if (debug) console.warn('[SitemapSync] No API key configured')\n    return { success: false, created: 0, updated: 0 }\n  }\n\n  if (entries.length === 0) {\n    if (debug) console.log('[SitemapSync] No entries to sync')\n    return { success: true, created: 0, updated: 0 }\n  }\n\n  try {\n    // Registration is idempotent in both modes (same payload → same final\n    // state), so retrying a timed-out attempt is safe.\n    const target = resolveAnalyticsTarget({ ...gate, apiUrl, apiKey })\n    if (!target) return { success: false, created: 0, updated: 0 }\n    const response = await sonorFetch(`${target.apiUrl}/api/public/seo/register-sitemap`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        entries: entries.map(e => ({\n          path: e.path,\n          priority: e.priority,\n          changefreq: e.changefreq,\n          pageType: inferPageType(e.path),\n        })),\n        mode,\n        // Sub-site host — tagged on every seo_pages row so the dashboard\n        // can scope the page tree to one microsite. Resolved by\n        // SiteKitClientProviders (see __SITE_KIT_SITE__).\n        ...(site ? { site } : {}),\n      }),\n    }, { apiKey: target.apiKey, retries: 2 })\n\n    if (!response?.ok) {\n      if (debug) console.error('[SitemapSync] API error:', response?.status, response?.statusText)\n      return { success: false, created: 0, updated: 0 }\n    }\n\n    const result = await response.json()\n\n    if (debug) {\n      console.log(`[SitemapSync] Synced: ${result.created} created, ${result.updated} updated`)\n    }\n\n    return {\n      success: true,\n      created: result.created || 0,\n      updated: result.updated || 0,\n    }\n  } catch (error) {\n    if (debug) console.error('[SitemapSync] Sync error:', error)\n    return { success: false, created: 0, updated: 0 }\n  }\n}\n\nexport function SitemapSync({\n  sitemapUrl = '/sitemap.xml',\n  syncInterval = 60,\n  debug = false,\n  mode = 'additive',\n  apiUrl: propApiUrl,\n  apiKey: propApiKey,\n  allowInFrame = false,\n  allowLocalhost = false,\n}: SitemapSyncProps) {\n  const hasSyncedRef = useRef(false)\n  const intervalRef = useRef<ReturnType<typeof setInterval> | null>(null)\n\n  useEffect(() => {\n    // Build-time sync via createSitemap is the canonical source of truth, but\n    // it can fail during ISR revalidation (app/ dir unavailable on serverless).\n    // Runtime SitemapSync in additive mode is a safe fallback — it adds/updates\n    // pages that may be missing without ever deleting existing ones.\n    // Full-replace is never safe at runtime — always force additive.\n    const effectiveMode: 'additive' | 'full-replace' = 'additive'\n\n    // Throttle window: reuse syncInterval when periodic syncing is on,\n    // otherwise default to 60 minutes for the on-mount sync.\n    const throttleMinutes = syncInterval > 0 ? syncInterval : 60\n\n    const doSync = async () => {\n      const gate = { apiUrl: propApiUrl, apiKey: propApiKey, allowInFrame, allowLocalhost, debug }\n      const target = resolveAnalyticsTarget(gate)\n      if (!target) return\n      const { apiUrl, apiKey } = target\n      const site = (window as any).__SITE_KIT_SITE__ || window.location.host || ''\n\n      if (isRecentlySynced(throttleMinutes)) {\n        if (debug) console.log('[SitemapSync] Skipped — synced within the last', throttleMinutes, 'min this session')\n        return\n      }\n\n      if (debug) console.log('[SitemapSync] Starting sitemap sync...', site ? `(site: ${site})` : '')\n\n      const entries = await parseSitemap(sitemapUrl, debug)\n\n      if (entries.length > 0) {\n        const hash = hashEntries(sitemapUrl, entries)\n        if (isAlreadySyncedHash(hash)) {\n          // This exact sitemap already synced from this browser — the server\n          // state can't be improved by re-POSTing it. Stamp the session so we\n          // don't even re-fetch/parse for the rest of the throttle window.\n          stampSynced()\n          if (debug) console.log('[SitemapSync] Skipped POST — sitemap unchanged since last successful sync')\n          return\n        }\n        const result = await syncToPortal(entries, apiUrl, apiKey, site, debug, effectiveMode, gate)\n        if (result.success) {\n          stampSynced()\n          storeSyncedHash(hash)\n        }\n      }\n    }\n\n    if (!resolveAnalyticsTarget({ apiUrl: propApiUrl, apiKey: propApiKey, allowInFrame, allowLocalhost, debug })) return\n\n    if (!hasSyncedRef.current) {\n      hasSyncedRef.current = true\n      doSync()\n    }\n\n    if (syncInterval > 0) {\n      intervalRef.current = setInterval(doSync, syncInterval * 60 * 1000)\n    }\n\n    return () => {\n      if (intervalRef.current) {\n        clearInterval(intervalRef.current)\n      }\n    }\n  }, [sitemapUrl, syncInterval, debug, mode, propApiUrl, propApiKey, allowInFrame, allowLocalhost])\n\n  return null\n}\n"]}

package/dist/{chunk-ZPLN537Q.mjs → chunk-4WCA2HM6.mjs}

@@ -53,5 +53,5 @@ function buildFleetHeartbeatPayload(input) {
 }
 
 export { FLEET_CONTRACT_VERSION, FLEET_MODULES, FLEET_MODULES_MAX, FLEET_SITE_MAX_LENGTH, FLEET_VERSION_MAX_LENGTH, FLEET_VERSION_PATTERN, buildFleetHeartbeatPayload, isFleetModule, normalizeFleetModules, normalizeFleetSite, sanitizeFleetVersion };
-//# sourceMappingURL=chunk-ZPLN537Q.mjs.map
-//# sourceMappingURL=chunk-ZPLN537Q.mjs.map
+//# sourceMappingURL=chunk-4WCA2HM6.mjs.map
+//# sourceMappingURL=chunk-4WCA2HM6.mjs.map

package/dist/chunk-4WCA2HM6.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/fleet/contract.ts"],"names":[],"mappings":";AAwBO,IAAM,sBAAA,GAAyB;AAuB/B,IAAM,aAAA,GAAwC;AAAA,EACnD,WAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,aAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF;AAMO,IAAM,iBAAA,GAAoB;AAE1B,IAAM,wBAAA,GAA2B;AAEjC,IAAM,qBAAA,GAAwB;AAE9B,IAAM,qBAAA,GAAwB;AA4B9B,SAAS,cAAc,CAAA,EAA8B;AAC1D,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,IAAa,aAAA,CAAoC,SAAS,CAAC,CAAA;AACjF;AAMO,SAAS,sBAAsB,KAAA,EAA+B;AACnE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,SAAU,EAAC;AACnC,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAiB;AAClC,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,IAAI,aAAA,CAAc,IAAI,CAAA,EAAG,IAAA,CAAK,IAAI,IAAI,CAAA;AACtC,IAAA,IAAI,IAAA,CAAK,QAAQ,iBAAA,EAAmB;AAAA,EACtC;AACA,EAAA,OAAO,cAAc,MAAA,CAAO,CAAC,MAAM,IAAA,CAAK,GAAA,CAAI,CAAC,CAAC,CAAA;AAChD;AAGO,SAAS,qBAAqB,GAAA,EAA6B;AAChE,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,IAAA;AACpC,EAAA,MAAM,CAAA,GAAI,IAAI,IAAA,EAAK;AACnB,EAAA,IAAI,CAAC,CAAA,IAAK,CAAA,CAAE,MAAA,GAAS,0BAA0B,OAAO,IAAA;AACtD,EAAA,OAAO,qBAAA,CAAsB,IAAA,CAAK,CAAC,CAAA,GAAI,CAAA,GAAI,IAAA;AAC7C;AAQO,SAAS,mBAAmB,GAAA,EAA6B;AAC9D,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,IAAA;AACpC,EAAA,IAAI,CAAA,GAAI,GAAA,CAAI,IAAA,EAAK,CAAE,WAAA,EAAY;AAC/B,EAAA,IAAI,CAAC,GAAG,OAAO,IAAA;AACf,EAAA,CAAA,GAAI,CAAA,CACD,OAAA,CAAQ,cAAA,EAAgB,EAAE,CAAA,CAC1B,OAAA,CAAQ,OAAA,EAAS,EAAE,CAAA,CACnB,OAAA,CAAQ,OAAA,EAAS,EAAE,CAAA;AACtB,EAAA,IAAI,CAAC,CAAA,IAAK,CAAA,CAAE,MAAA,GAAS,uBAAuB,OAAO,IAAA;AACnD,EAAA,OAAO,CAAA;AACT;AAOO,SAAS,2BAA2B,KAAA,EAMjB;AACxB,EAAA,OAAO;AAAA,IACL,gBAAA,EAAkB,sBAAA;AAAA,IAClB,aAAa,KAAA,CAAM,UAAA;AAAA,IACnB,YAAA,EAAc,oBAAA,CAAqB,KAAA,CAAM,WAAA,IAAe,IAAI,CAAA;AAAA,IAC5D,OAAA,EAAS,qBAAA,CAAsB,KAAA,CAAM,OAAO,CAAA;AAAA,IAC5C,IAAA,EAAM,kBAAA,CAAmB,KAAA,CAAM,IAAA,IAAQ,IAAI,CAAA;AAAA,IAC3C,MAAA,EAAQ,KAAA,CAAM,MAAA,KAAW,OAAA,GAAU,OAAA,GAAU;AAAA,GAC/C;AACF","file":"chunk-4WCA2HM6.mjs","sourcesContent":["/**\n * @sonordev/site-kit/fleet/contract — Fleet heartbeat wire contract (v1)\n *\n * Single source of truth for the heartbeat payload shape, shared by site-kit\n * (send side) and sonor-api (ingest side) — the same pattern as\n * `@sonordev/site-kit/llms/contract` and `@sonordev/site-kit/slots/contract`.\n * Import THIS module (never the React component) from the Nest APIs.\n *\n * Why it exists: ~24+ client sites run site-kit at wildly drifted versions and\n * the platform could not answer \"which version / modules / key state is each\n * site running\" without shelling into every local repo. The heartbeat answers\n * that from live traffic. It is fire-and-forget, deferred to idle (never in the\n * hydration path), and carries NO visitor data — only the site's own build\n * fingerprint. Project identity is resolved server-side from the x-api-key\n * header, exactly like every other /api/public/* endpoint; sites never send\n * project IDs.\n *\n * The x-sitekit-version header (set by shared/sonorFetch on every request)\n * already gives the platform a passive \"last seen version\" for ALL traffic,\n * including server-only module fetches. The heartbeat adds the things a header\n * can't carry: the active module set and the host Next.js version.\n */\n\n/** Bump on breaking payload changes. Ingest accepts the current version. */\nexport const FLEET_CONTRACT_VERSION = 1\n\n/**\n * Client-observable site-kit modules — the set a site can honestly self-report\n * from a client boot, because SiteKitClientProviders actually mounts them.\n *\n * Server-only modules (seo, article, images, reputation, redirects, llms) are\n * intentionally absent: they render on the server and cannot be observed from\n * the browser. Their usage still surfaces passively through the\n * x-sitekit-version header on their own server fetches.\n */\nexport type FleetModule =\n  | 'analytics'\n  | 'engage'\n  | 'signal'\n  | 'sitemapSync'\n  | 'forms'\n  | 'commerce'\n  | 'sync'\n  | 'maps'\n  | 'slots'\n\n/** Canonical order — used to serialize equal module sets identically. */\nexport const FLEET_MODULES: readonly FleetModule[] = [\n  'analytics',\n  'engage',\n  'signal',\n  'sitemapSync',\n  'forms',\n  'commerce',\n  'sync',\n  'maps',\n  'slots',\n] as const\n\n/** Where a heartbeat originated. */\nexport type FleetHeartbeatSource = 'client' | 'build'\n\n/** Hard cap on modules accepted in one payload (junk guard). */\nexport const FLEET_MODULES_MAX = 32\n/** Hard cap on the free-form version strings we accept. */\nexport const FLEET_VERSION_MAX_LENGTH = 40\n/** Semver-ish shape. Non-matching values are stored as null, never rejected. */\nexport const FLEET_VERSION_PATTERN = /^[0-9]+\\.[0-9]+\\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?$/\n/** Max host length per RFC 1035. */\nexport const FLEET_SITE_MAX_LENGTH = 253\n\n/**\n * The heartbeat body a site POSTs to `/api/public/fleet/heartbeat`.\n * All wire fields are snake_case to match the other contract modules and the\n * agent-facing read endpoints.\n */\nexport interface FleetHeartbeatPayload {\n  contract_version: number\n  /** SITE_KIT_VERSION at runtime, e.g. \"3.2.0\". */\n  kit_version: string\n  /** Installed Next.js version if detectable, else null. */\n  next_version?: string | null\n  /** Client-observable active modules — deduped, validated, canonical order. */\n  modules: FleetModule[]\n  /** Normalized lowercase host (multi-site sub-dimension; see CLAUDE.md). */\n  site?: string | null\n  /** 'client' (runtime boot) or 'build' (CI/build step). Default 'client'. */\n  source?: FleetHeartbeatSource\n}\n\n/** The ingest endpoint's response. `received_at` is server-stamped ISO 8601. */\nexport interface FleetHeartbeatResponse {\n  ok: boolean\n  contract_version: number\n  received_at: string\n}\n\nexport function isFleetModule(x: unknown): x is FleetModule {\n  return typeof x === 'string' && (FLEET_MODULES as readonly string[]).includes(x)\n}\n\n/**\n * Dedupe + validate a modules array: drop unknowns, cap length, emit in the\n * canonical FLEET_MODULES order so equal sets always serialize identically.\n */\nexport function normalizeFleetModules(input: unknown): FleetModule[] {\n  if (!Array.isArray(input)) return []\n  const seen = new Set<FleetModule>()\n  for (const item of input) {\n    if (isFleetModule(item)) seen.add(item)\n    if (seen.size >= FLEET_MODULES_MAX) break\n  }\n  return FLEET_MODULES.filter((m) => seen.has(m))\n}\n\n/** Coerce a version-ish string to a clean value or null (never throws). */\nexport function sanitizeFleetVersion(raw: unknown): string | null {\n  if (typeof raw !== 'string') return null\n  const s = raw.trim()\n  if (!s || s.length > FLEET_VERSION_MAX_LENGTH) return null\n  return FLEET_VERSION_PATTERN.test(s) ? s : null\n}\n\n/**\n * Light client-side site normalization to the canonical host shape (lowercase,\n * no protocol/path/port). sonor-api's IngestService.normalizeSite is the\n * AUTHORITATIVE normalizer and re-runs on ingest — this just avoids sending\n * obvious noise. Keep the two shapes aligned (see CLAUDE.md \"site\" convention).\n */\nexport function normalizeFleetSite(raw: unknown): string | null {\n  if (typeof raw !== 'string') return null\n  let s = raw.trim().toLowerCase()\n  if (!s) return null\n  s = s\n    .replace(/^https?:\\/\\//, '')\n    .replace(/\\/.*$/, '')\n    .replace(/:\\d+$/, '')\n  if (!s || s.length > FLEET_SITE_MAX_LENGTH) return null\n  return s\n}\n\n/**\n * Build a validated heartbeat payload from loose inputs. Used by BOTH the\n * client component and the build-time sender so the wire shape is produced in\n * exactly one place (single source of truth for the heartbeat body).\n */\nexport function buildFleetHeartbeatPayload(input: {\n  kitVersion: string\n  nextVersion?: string | null\n  modules?: unknown\n  site?: string | null\n  source?: FleetHeartbeatSource\n}): FleetHeartbeatPayload {\n  return {\n    contract_version: FLEET_CONTRACT_VERSION,\n    kit_version: input.kitVersion,\n    next_version: sanitizeFleetVersion(input.nextVersion ?? null),\n    modules: normalizeFleetModules(input.modules),\n    site: normalizeFleetSite(input.site ?? null),\n    source: input.source === 'build' ? 'build' : 'client',\n  }\n}\n"]}

package/dist/{chunk-I7HOMMIK.js → chunk-5ABTBPPK.js}

@@ -1,7 +1,7 @@
 'use strict';
 
-var chunkCZEIHFLW_js = require('./chunk-CZEIHFLW.js');
-var chunk7R6H3GQ4_js = require('./chunk-7R6H3GQ4.js');
+var chunkTC3JSQUS_js = require('./chunk-TC3JSQUS.js');
+var chunkF3EAAAZ3_js = require('./chunk-F3EAAAZ3.js');
 
 // src/shared/fetchWithRetry.ts
 function backoffDelay(attempt, response) {
@@ -50,7 +50,7 @@ var pausedKeys = (() => {
 var warnedThisPage = false;
 function isAuthPaused(credential) {
   if (typeof window === "undefined") return false;
-  const id = chunkCZEIHFLW_js.credentialBreakerId(credential);
+  const id = chunkTC3JSQUS_js.credentialBreakerId(credential);
   const until = pausedKeys.get(id);
   if (!until) return false;
   if (Date.now() >= until) {
@@ -60,7 +60,7 @@ function isAuthPaused(credential) {
   return true;
 }
 function tripBreaker(credential) {
-  pausedKeys.set(chunkCZEIHFLW_js.credentialBreakerId(credential), Date.now() + AUTH_BREAK_MS);
+  pausedKeys.set(chunkTC3JSQUS_js.credentialBreakerId(credential), Date.now() + AUTH_BREAK_MS);
   if (!warnedThisPage) {
     warnedThisPage = true;
     console.info(
@@ -70,13 +70,13 @@ function tripBreaker(credential) {
 }
 async function sonorFetch(url, init = {}, options = {}) {
   let credential = options.apiKey;
-  if (credential !== void 0 || chunkCZEIHFLW_js.isTokenMode()) {
-    credential = await chunkCZEIHFLW_js.getFreshCredential(options.apiKey);
+  if (credential !== void 0 || chunkTC3JSQUS_js.isTokenMode()) {
+    credential = await chunkTC3JSQUS_js.getFreshCredential(options.apiKey);
   }
   const headers = new Headers(init.headers || {});
-  headers.set("x-sitekit-version", chunk7R6H3GQ4_js.SITE_KIT_VERSION);
+  headers.set("x-sitekit-version", chunkF3EAAAZ3_js.SITE_KIT_VERSION);
   if (credential) {
-    if (chunkCZEIHFLW_js.isTokenMode()) {
+    if (chunkTC3JSQUS_js.isTokenMode()) {
       headers.set("x-api-key", credential);
       headers.delete("authorization");
     } else if (!headers.has("x-api-key")) {
@@ -87,11 +87,11 @@ async function sonorFetch(url, init = {}, options = {}) {
     return new Response(null, { status: 401, statusText: "sonor-auth-paused" });
   }
   let response = await fetchWithRetry(url, { ...init, headers }, options);
-  if ((response.status === 401 || response.status === 403) && typeof window !== "undefined" && chunkCZEIHFLW_js.isSiteToken(credential)) {
-    const refreshed = await chunkCZEIHFLW_js.refreshSiteToken();
+  if ((response.status === 401 || response.status === 403) && typeof window !== "undefined" && chunkTC3JSQUS_js.isSiteToken(credential)) {
+    const refreshed = await chunkTC3JSQUS_js.refreshSiteToken();
     if (refreshed && refreshed !== credential) {
       const retryHeaders = new Headers(init.headers || {});
-      retryHeaders.set("x-sitekit-version", chunk7R6H3GQ4_js.SITE_KIT_VERSION);
+      retryHeaders.set("x-sitekit-version", chunkF3EAAAZ3_js.SITE_KIT_VERSION);
       retryHeaders.set("x-api-key", refreshed);
       retryHeaders.delete("authorization");
       credential = refreshed;
@@ -104,7 +104,7 @@ async function sonorFetch(url, init = {}, options = {}) {
   return response;
 }
 function sonorBeacon(url, payload, apiKey) {
-  const credential = chunkCZEIHFLW_js.currentCredential(apiKey);
+  const credential = chunkTC3JSQUS_js.currentCredential(apiKey);
   const body = typeof payload === "string" ? payload : JSON.stringify(payload);
   try {
     void fetch(url, {
@@ -112,7 +112,7 @@ function sonorBeacon(url, payload, apiKey) {
       keepalive: true,
       headers: {
         "Content-Type": "application/json",
-        "x-sitekit-version": chunk7R6H3GQ4_js.SITE_KIT_VERSION,
+        "x-sitekit-version": chunkF3EAAAZ3_js.SITE_KIT_VERSION,
         ...credential ? { "x-api-key": credential } : {}
       },
       body
@@ -130,5 +130,5 @@ function sonorBeacon(url, payload, apiKey) {
 
 exports.sonorBeacon = sonorBeacon;
 exports.sonorFetch = sonorFetch;
-//# sourceMappingURL=chunk-I7HOMMIK.js.map
-//# sourceMappingURL=chunk-I7HOMMIK.js.map
+//# sourceMappingURL=chunk-5ABTBPPK.js.map
+//# sourceMappingURL=chunk-5ABTBPPK.js.map

package/dist/{chunk-I7HOMMIK.js.map → chunk-5ABTBPPK.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/fetchWithRetry.ts","../src/shared/sonorFetch.ts"],"names":["credentialBreakerId","isTokenMode","getFreshCredential","SITE_KIT_VERSION","isSiteToken","refreshSiteToken","currentCredential"],"mappings":";;;;;;AAsBA,SAAS,YAAA,CAAa,SAAiB,QAAA,EAA6B;AAElE,EAAA,IAAI,QAAA,EAAU,WAAW,GAAA,EAAK;AAC5B,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,MAAA,GAAS,QAAA,CAAS,MAAA,EAAQ,EAAE,CAAA,GAAI,GAAA;AAChD,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,IAAK,OAAA,GAAU,CAAA,EAAG,OAAO,IAAA,CAAK,GAAA,CAAI,OAAA,GAAU,GAAA,EAAM,GAAK,CAAA;AAAA,EAClF;AAEA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,GAAA,EAAM,GAAA,GAAM,KAAK,OAAO,CAAA;AAC1C;AASA,eAAsB,cAAA,CACpB,GAAA,EACA,IAAA,EACA,OAAA,GAA6B,EAAC,EACX;AACnB,EAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,IAAA;AACvC,EAAA,IAAI,SAAA;AAEJ,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,OAAA,EAAS,OAAA,EAAA,EAAW;AACnD,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,MAAA,YAAA,CAAa,KAAK,CAAA;AAElB,MAAA,IAAA,CAAK,SAAS,MAAA,KAAW,GAAA,IAAO,SAAS,MAAA,IAAU,GAAA,KAAQ,UAAU,OAAA,EAAS;AAC5E,QAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY,UAAA,CAAW,SAAS,YAAA,CAAa,OAAA,EAAS,QAAQ,CAAC,CAAC,CAAA;AACnF,QAAA;AAAA,MACF;AACA,MAAA,OAAO,QAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,SAAA,GAAY,KAAA;AAEZ,MAAA,IAAI,UAAU,OAAA,EAAS;AACrB,QAAA,MAAM,IAAI,QAAQ,CAAC,OAAA,KAAY,WAAW,OAAA,EAAS,YAAA,CAAa,OAAO,CAAC,CAAC,CAAA;AACzE,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,YAAqB,KAAA,GACvB,SAAA,GACA,IAAI,MAAM,mEAAmE,CAAA;AACnF;;;AC7BA,IAAM,gBAAgB,CAAA,GAAI,GAAA;AAM1B,IAAM,iBAAA,GAAoB,wBAAA;AAC1B,IAAM,cAAmC,MAAM;AAC7C,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,2BAAW,GAAA,EAAI;AAClD,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,CAAA,CAAA,iBAAA,CAAA,KAAA,CAAA,CAAA,iBAAA,CAAA,uBAA6B,GAAA,EAAI,CAAA;AAC3C,CAAA,GAAG;AACH,IAAI,cAAA,GAAiB,KAAA;AAGd,SAAS,aAAa,UAAA,EAA8B;AACzD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,MAAM,EAAA,GAAKA,qCAAoB,UAAU,CAAA;AACzC,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,EAAE,CAAA;AAC/B,EAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,EAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,KAAA,EAAO;AACvB,IAAA,UAAA,CAAW,OAAO,EAAE,CAAA;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,YAAY,UAAA,EAA2B;AAC9C,EAAA,UAAA,CAAW,IAAIA,oCAAA,CAAoB,UAAU,GAAG,IAAA,CAAK,GAAA,KAAQ,aAAa,CAAA;AAC1E,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,cAAA,GAAiB,IAAA;AAGjB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AACF;AAEA,eAAsB,WACpB,GAAA,EACA,IAAA,GAAoB,EAAC,EACrB,OAAA,GAA6B,EAAC,EACX;AAGnB,EAAA,IAAI,aAAa,OAAA,CAAQ,MAAA;AACzB,EAAA,IAAI,UAAA,KAAe,MAAA,IAAaC,4BAAA,EAAY,EAAG;AAC7C,IAAA,UAAA,GAAa,MAAMC,mCAAA,CAAmB,OAAA,CAAQ,MAAM,CAAA;AAAA,EACtD;AAEA,EAAA,MAAM,UAAU,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAC9C,EAAA,OAAA,CAAQ,GAAA,CAAI,qBAAqBC,iCAAgB,CAAA;AACjD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,IAAIF,8BAAY,EAAG;AASjB,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AACnC,MAAA,OAAA,CAAQ,OAAO,eAAe,CAAA;AAAA,IAChC,CAAA,MAAA,IAAW,CAAC,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG;AAEpC,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AAAA,IACrC;AAAA,EACF;AAEA,EAAA,IAAI,YAAA,CAAa,UAAU,CAAA,EAAG;AAG5B,IAAA,OAAO,IAAI,SAAS,IAAA,EAAM,EAAE,QAAQ,GAAA,EAAK,UAAA,EAAY,qBAAqB,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,QAAA,GAAW,MAAM,cAAA,CAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAQ,EAAG,OAAO,CAAA;AAKtE,EAAA,IAAA,CACG,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,QAAA,CAAS,MAAA,KAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClBG,4BAAA,CAAY,UAAU,CAAA,EACtB;AACA,IAAA,MAAM,SAAA,GAAY,MAAMC,iCAAA,EAAiB;AACzC,IAAA,IAAI,SAAA,IAAa,cAAc,UAAA,EAAY;AACzC,MAAA,MAAM,eAAe,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AACnD,MAAA,YAAA,CAAa,GAAA,CAAI,qBAAqBF,iCAAgB,CAAA;AACtD,MAAA,YAAA,CAAa,GAAA,CAAI,aAAa,SAAS,CAAA;AAGvC,MAAA,YAAA,CAAa,OAAO,eAAe,CAAA;AACnC,MAAA,UAAA,GAAa,SAAA;AACb,MAAA,QAAA,GAAW,MAAM,eAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,YAAA,EAAa,EAAG,OAAO,CAAA;AAAA,IAClF;AAAA,EACF;AAEA,EAAA,IAAA,CACG,QAAA,CAAS,WAAW,GAAA,IAAO,QAAA,CAAS,WAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClB,UAAA,EACA;AACA,IAAA,WAAA,CAAY,UAAU,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,QAAA;AACT;AAYO,SAAS,WAAA,CAAY,GAAA,EAAa,OAAA,EAAkB,MAAA,EAAuB;AAChF,EAAA,MAAM,UAAA,GAAaG,mCAAkB,MAAM,CAAA;AAC3C,EAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,IAAA,CAAK,UAAU,OAAO,CAAA;AAC3E,EAAA,IAAI;AACF,IAAA,KAAK,MAAM,GAAA,EAAK;AAAA,MACd,MAAA,EAAQ,MAAA;AAAA,MACR,SAAA,EAAW,IAAA;AAAA,MACX,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqBH,iCAAA;AAAA,QACrB,GAAI,UAAA,GAAa,EAAE,WAAA,EAAa,UAAA,KAAe;AAAC,OAClD;AAAA,MACA;AAAA,KACD,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAEf,CAAC,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AACN,IAAA,IAAI;AACF,MAAA,IAAI,OAAO,SAAA,KAAc,WAAA,IAAe,SAAA,CAAU,UAAA,EAAY;AAC5D,QAAA,SAAA,CAAU,UAAA,CAAW,GAAA,EAAK,IAAI,IAAA,CAAK,CAAC,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,kBAAA,EAAoB,CAAC,CAAA;AAAA,MAC1E;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACF","file":"chunk-I7HOMMIK.js","sourcesContent":["/**\n * @sonordev/site-kit shared - Resilient fetch\n *\n * Single source of truth for client-side resilient fetch (forms, SitemapSync).\n * Adds a per-attempt timeout and retries transient failures (network errors,\n * request timeouts, HTTP 429, and 5xx) with exponential backoff.\n *\n * A form submission must survive a brief API blip — a deploy, a cold start, a\n * dropped packet. A single un-retried fetch turning into \"Something went wrong\"\n * is how leads get lost. The explicit abort also matters on its own: a request\n * left to hang until the browser's own network timeout logs a console error\n * (net::ERR_TIMED_OUT) that fails Lighthouse best-practices; an aborted fetch\n * logs nothing.\n */\n\nexport interface FetchRetryOptions {\n  /** Number of retries AFTER the first attempt (default 2 → up to 3 tries total). */\n  retries?: number\n  /** Per-attempt timeout in milliseconds (default 15000). */\n  timeoutMs?: number\n}\n\nfunction backoffDelay(attempt: number, response?: Response): number {\n  // Honor a Retry-After header on 429 responses when present.\n  if (response?.status === 429) {\n    const header = response.headers.get('retry-after')\n    const seconds = header ? parseInt(header, 10) : NaN\n    if (!Number.isNaN(seconds) && seconds > 0) return Math.min(seconds * 1000, 10000)\n  }\n  // Exponential backoff: 500ms, 1s, 2s, ... capped at 8s.\n  return Math.min(8000, 500 * 2 ** attempt)\n}\n\n/**\n * fetch() with a timeout and automatic retries for transient failures.\n *\n * Non-transient responses (2xx, 3xx, and 4xx other than 429) are returned to\n * the caller as-is — only 429/5xx and thrown network/timeout errors are retried.\n * If every attempt fails with a thrown error, the last error is re-thrown.\n */\nexport async function fetchWithRetry(\n  url: string,\n  init: RequestInit,\n  options: FetchRetryOptions = {},\n): Promise<Response> {\n  const retries = options.retries ?? 2\n  const timeoutMs = options.timeoutMs ?? 15000\n  let lastError: unknown\n\n  for (let attempt = 0; attempt <= retries; attempt++) {\n    const controller = new AbortController()\n    const timer = setTimeout(() => controller.abort(), timeoutMs)\n    try {\n      const response = await fetch(url, { ...init, signal: controller.signal })\n      clearTimeout(timer)\n\n      if ((response.status === 429 || response.status >= 500) && attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt, response)))\n        continue\n      }\n      return response\n    } catch (error) {\n      clearTimeout(timer)\n      lastError = error\n      // Network failure or timeout (AbortController) — retry while attempts remain.\n      if (attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt)))\n        continue\n      }\n    }\n  }\n\n  throw lastError instanceof Error\n    ? lastError\n    : new Error('Network request failed after multiple attempts. Please try again.')\n}\n","/**\n * @sonordev/site-kit shared - Canonical client transport\n *\n * Single source of truth for how site-kit talks to Sonor from the browser.\n * Every client-side module (analytics, forms, commerce, engage, maps, images,\n * SitemapSync) routes through here instead of bare fetch(), which gives the\n * whole kit, in one place:\n *\n *  - per-attempt timeout + retry with backoff (via fetchWithRetry) — a hung\n *    request left to the browser's own network timeout logs a console error\n *    (net::ERR_TIMED_OUT) that fails Lighthouse best-practices\n *  - the x-sitekit-version header on every request, so the platform can see\n *    which kit version each site actually runs from live traffic\n *  - CREDENTIAL LIFECYCLE: sites on 3.2+ ship a short-lived minted token instead\n *    of the raw key. This transport resolves the freshest token (refreshing a\n *    stale seed transparently), and on a 401/403 for a token it refreshes once\n *    and retries before giving up. A raw key (2.x kit, or the mint-failed\n *    fallback) is a pure passthrough — legacy behavior is unchanged.\n *  - an auth circuit breaker: after a 401/403 the credential is paused for a few\n *    minutes and ONE friendly console.info is emitted — a site on a stale or\n *    canceled key must not spam the API or the visitor's console. Keyed by the\n *    project (from the token) so it survives token rotation.\n *  - sonorBeacon for unload-time telemetry that keeps the credential in headers;\n *    navigator.sendBeacon can't set headers and forced the key into the URL,\n *    where server and CDN access logs capture it\n *\n * Non-idempotent endpoints (checkout, payment intents, uploads) must pass\n * { retries: 0 } — they still get the timeout, but never an automatic retry.\n */\nimport { fetchWithRetry, type FetchRetryOptions } from './fetchWithRetry'\nimport { SITE_KIT_VERSION } from './version'\nimport {\n  credentialBreakerId,\n  currentCredential,\n  getFreshCredential,\n  isSiteToken,\n  isTokenMode,\n  refreshSiteToken,\n} from './siteToken'\n\nexport interface SonorFetchOptions extends FetchRetryOptions {\n  /** Project credential — the minted token (3.2+) or raw key. Sent as x-api-key. */\n  apiKey?: string\n}\n\n/** How long a credential stays paused after an auth failure. */\nconst AUTH_BREAK_MS = 5 * 60_000\n\n// breaker id → epoch ms until which requests are paused. Shared on window for\n// the same reason as the token state (see siteToken.ts): duplicated module\n// copies must trip and observe ONE breaker, not one each. Never applies on the\n// server, so a per-module Map there is fine.\nconst BREAKER_STATE_KEY = '__SONOR_AUTH_BREAKER__'\nconst pausedKeys: Map<string, number> = (() => {\n  if (typeof window === 'undefined') return new Map()\n  const w = window as unknown as Record<string, Map<string, number> | undefined>\n  return (w[BREAKER_STATE_KEY] ??= new Map())\n})()\nlet warnedThisPage = false\n\n/** True when a previous 401/403 has paused this credential (browser only). */\nexport function isAuthPaused(credential?: string): boolean {\n  if (typeof window === 'undefined') return false\n  const id = credentialBreakerId(credential)\n  const until = pausedKeys.get(id)\n  if (!until) return false\n  if (Date.now() >= until) {\n    pausedKeys.delete(id)\n    return false\n  }\n  return true\n}\n\nfunction tripBreaker(credential?: string): void {\n  pausedKeys.set(credentialBreakerId(credential), Date.now() + AUTH_BREAK_MS)\n  if (!warnedThisPage) {\n    warnedThisPage = true\n    // info, not error: a visitor's console must stay clean (Lighthouse\n    // errors-in-console), and copy never names env vars or key formats.\n    console.info(\n      \"[Sonor] This site couldn't authenticate with Sonor, so data features are paused for a few minutes. If this keeps happening, the site is likely running an outdated API key.\",\n    )\n  }\n}\n\nexport async function sonorFetch(\n  url: string,\n  init: RequestInit = {},\n  options: SonorFetchOptions = {},\n): Promise<Response> {\n  // Resolve the credential to send. In token mode this may transparently refresh\n  // a stale seed before the first request; in raw-key mode it's a passthrough.\n  let credential = options.apiKey\n  if (credential !== undefined || isTokenMode()) {\n    credential = await getFreshCredential(options.apiKey)\n  }\n\n  const headers = new Headers(init.headers || {})\n  headers.set('x-sitekit-version', SITE_KIT_VERSION)\n  if (credential) {\n    if (isTokenMode()) {\n      // Token mode: `credential` is the freshest token (refreshed just above if\n      // the seed was stale). It MUST override any x-api-key a caller hand-set — a\n      // stale build-time seed passed as a header would otherwise pin the request\n      // and defeat refresh entirely. Also drop a caller-set Authorization:\n      // extractApiKey() server-side prefers `Authorization: Bearer` over\n      // x-api-key, so a stale Bearer seed would win even once we set a fresh\n      // x-api-key. This is the single place the client credential is chosen — do\n      // not re-attach it as a header at call sites.\n      headers.set('x-api-key', credential)\n      headers.delete('authorization')\n    } else if (!headers.has('x-api-key')) {\n      // Raw-key mode: legacy passthrough — respect a caller-supplied header.\n      headers.set('x-api-key', credential)\n    }\n  }\n\n  if (isAuthPaused(credential)) {\n    // Synthetic response keeps every caller's !response.ok path working\n    // without a network round trip while the breaker is open.\n    return new Response(null, { status: 401, statusText: 'sonor-auth-paused' })\n  }\n\n  let response = await fetchWithRetry(url, { ...init, headers }, options)\n\n  // A token can rotate or expire mid-session. On the first auth failure, try ONE\n  // refresh + retry before tripping the breaker — only for token credentials\n  // (raw keys have nothing to refresh).\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    isSiteToken(credential)\n  ) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed && refreshed !== credential) {\n      const retryHeaders = new Headers(init.headers || {})\n      retryHeaders.set('x-sitekit-version', SITE_KIT_VERSION)\n      retryHeaders.set('x-api-key', refreshed)\n      // Same reason as the initial request: a caller-set stale Bearer would win\n      // over our fresh x-api-key server-side, so strip it on the retry too.\n      retryHeaders.delete('authorization')\n      credential = refreshed\n      response = await fetchWithRetry(url, { ...init, headers: retryHeaders }, options)\n    }\n  }\n\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    credential\n  ) {\n    tripBreaker(credential)\n  }\n\n  return response\n}\n\n/**\n * Fire-and-forget telemetry that survives page unload.\n *\n * Uses fetch({ keepalive: true }) so auth travels in headers. Falls back to\n * navigator.sendBeacon (no auth headers possible — the server may reject it,\n * but we never put the key in the URL) only when keepalive fetch is missing.\n *\n * Cannot await a refresh at unload time, so it sends the freshest token already\n * held (currentCredential) rather than the possibly-stale seed the caller passed.\n */\nexport function sonorBeacon(url: string, payload: unknown, apiKey?: string): void {\n  const credential = currentCredential(apiKey)\n  const body = typeof payload === 'string' ? payload : JSON.stringify(payload)\n  try {\n    void fetch(url, {\n      method: 'POST',\n      keepalive: true,\n      headers: {\n        'Content-Type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        ...(credential ? { 'x-api-key': credential } : {}),\n      },\n      body,\n    }).catch(() => {\n      /* page is closing — best effort */\n    })\n  } catch {\n    try {\n      if (typeof navigator !== 'undefined' && navigator.sendBeacon) {\n        navigator.sendBeacon(url, new Blob([body], { type: 'application/json' }))\n      }\n    } catch {\n      /* nothing left to try */\n    }\n  }\n}\n"]}
+{"version":3,"sources":["../src/shared/fetchWithRetry.ts","../src/shared/sonorFetch.ts"],"names":["credentialBreakerId","isTokenMode","getFreshCredential","SITE_KIT_VERSION","isSiteToken","refreshSiteToken","currentCredential"],"mappings":";;;;;;AAsBA,SAAS,YAAA,CAAa,SAAiB,QAAA,EAA6B;AAElE,EAAA,IAAI,QAAA,EAAU,WAAW,GAAA,EAAK;AAC5B,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,MAAA,GAAS,QAAA,CAAS,MAAA,EAAQ,EAAE,CAAA,GAAI,GAAA;AAChD,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,IAAK,OAAA,GAAU,CAAA,EAAG,OAAO,IAAA,CAAK,GAAA,CAAI,OAAA,GAAU,GAAA,EAAM,GAAK,CAAA;AAAA,EAClF;AAEA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,GAAA,EAAM,GAAA,GAAM,KAAK,OAAO,CAAA;AAC1C;AASA,eAAsB,cAAA,CACpB,GAAA,EACA,IAAA,EACA,OAAA,GAA6B,EAAC,EACX;AACnB,EAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,IAAA;AACvC,EAAA,IAAI,SAAA;AAEJ,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,OAAA,EAAS,OAAA,EAAA,EAAW;AACnD,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,MAAA,YAAA,CAAa,KAAK,CAAA;AAElB,MAAA,IAAA,CAAK,SAAS,MAAA,KAAW,GAAA,IAAO,SAAS,MAAA,IAAU,GAAA,KAAQ,UAAU,OAAA,EAAS;AAC5E,QAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY,UAAA,CAAW,SAAS,YAAA,CAAa,OAAA,EAAS,QAAQ,CAAC,CAAC,CAAA;AACnF,QAAA;AAAA,MACF;AACA,MAAA,OAAO,QAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,SAAA,GAAY,KAAA;AAEZ,MAAA,IAAI,UAAU,OAAA,EAAS;AACrB,QAAA,MAAM,IAAI,QAAQ,CAAC,OAAA,KAAY,WAAW,OAAA,EAAS,YAAA,CAAa,OAAO,CAAC,CAAC,CAAA;AACzE,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,YAAqB,KAAA,GACvB,SAAA,GACA,IAAI,MAAM,mEAAmE,CAAA;AACnF;;;AC7BA,IAAM,gBAAgB,CAAA,GAAI,GAAA;AAM1B,IAAM,iBAAA,GAAoB,wBAAA;AAC1B,IAAM,cAAmC,MAAM;AAC7C,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,2BAAW,GAAA,EAAI;AAClD,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,CAAA,CAAA,iBAAA,CAAA,KAAA,CAAA,CAAA,iBAAA,CAAA,uBAA6B,GAAA,EAAI,CAAA;AAC3C,CAAA,GAAG;AACH,IAAI,cAAA,GAAiB,KAAA;AAGd,SAAS,aAAa,UAAA,EAA8B;AACzD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,MAAM,EAAA,GAAKA,qCAAoB,UAAU,CAAA;AACzC,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,EAAE,CAAA;AAC/B,EAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,EAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,KAAA,EAAO;AACvB,IAAA,UAAA,CAAW,OAAO,EAAE,CAAA;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,YAAY,UAAA,EAA2B;AAC9C,EAAA,UAAA,CAAW,IAAIA,oCAAA,CAAoB,UAAU,GAAG,IAAA,CAAK,GAAA,KAAQ,aAAa,CAAA;AAC1E,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,cAAA,GAAiB,IAAA;AAGjB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AACF;AAEA,eAAsB,WACpB,GAAA,EACA,IAAA,GAAoB,EAAC,EACrB,OAAA,GAA6B,EAAC,EACX;AAGnB,EAAA,IAAI,aAAa,OAAA,CAAQ,MAAA;AACzB,EAAA,IAAI,UAAA,KAAe,MAAA,IAAaC,4BAAA,EAAY,EAAG;AAC7C,IAAA,UAAA,GAAa,MAAMC,mCAAA,CAAmB,OAAA,CAAQ,MAAM,CAAA;AAAA,EACtD;AAEA,EAAA,MAAM,UAAU,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAC9C,EAAA,OAAA,CAAQ,GAAA,CAAI,qBAAqBC,iCAAgB,CAAA;AACjD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,IAAIF,8BAAY,EAAG;AASjB,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AACnC,MAAA,OAAA,CAAQ,OAAO,eAAe,CAAA;AAAA,IAChC,CAAA,MAAA,IAAW,CAAC,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG;AAEpC,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AAAA,IACrC;AAAA,EACF;AAEA,EAAA,IAAI,YAAA,CAAa,UAAU,CAAA,EAAG;AAG5B,IAAA,OAAO,IAAI,SAAS,IAAA,EAAM,EAAE,QAAQ,GAAA,EAAK,UAAA,EAAY,qBAAqB,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,QAAA,GAAW,MAAM,cAAA,CAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAQ,EAAG,OAAO,CAAA;AAKtE,EAAA,IAAA,CACG,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,QAAA,CAAS,MAAA,KAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClBG,4BAAA,CAAY,UAAU,CAAA,EACtB;AACA,IAAA,MAAM,SAAA,GAAY,MAAMC,iCAAA,EAAiB;AACzC,IAAA,IAAI,SAAA,IAAa,cAAc,UAAA,EAAY;AACzC,MAAA,MAAM,eAAe,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AACnD,MAAA,YAAA,CAAa,GAAA,CAAI,qBAAqBF,iCAAgB,CAAA;AACtD,MAAA,YAAA,CAAa,GAAA,CAAI,aAAa,SAAS,CAAA;AAGvC,MAAA,YAAA,CAAa,OAAO,eAAe,CAAA;AACnC,MAAA,UAAA,GAAa,SAAA;AACb,MAAA,QAAA,GAAW,MAAM,eAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,YAAA,EAAa,EAAG,OAAO,CAAA;AAAA,IAClF;AAAA,EACF;AAEA,EAAA,IAAA,CACG,QAAA,CAAS,WAAW,GAAA,IAAO,QAAA,CAAS,WAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClB,UAAA,EACA;AACA,IAAA,WAAA,CAAY,UAAU,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,QAAA;AACT;AAYO,SAAS,WAAA,CAAY,GAAA,EAAa,OAAA,EAAkB,MAAA,EAAuB;AAChF,EAAA,MAAM,UAAA,GAAaG,mCAAkB,MAAM,CAAA;AAC3C,EAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,IAAA,CAAK,UAAU,OAAO,CAAA;AAC3E,EAAA,IAAI;AACF,IAAA,KAAK,MAAM,GAAA,EAAK;AAAA,MACd,MAAA,EAAQ,MAAA;AAAA,MACR,SAAA,EAAW,IAAA;AAAA,MACX,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqBH,iCAAA;AAAA,QACrB,GAAI,UAAA,GAAa,EAAE,WAAA,EAAa,UAAA,KAAe;AAAC,OAClD;AAAA,MACA;AAAA,KACD,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAEf,CAAC,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AACN,IAAA,IAAI;AACF,MAAA,IAAI,OAAO,SAAA,KAAc,WAAA,IAAe,SAAA,CAAU,UAAA,EAAY;AAC5D,QAAA,SAAA,CAAU,UAAA,CAAW,GAAA,EAAK,IAAI,IAAA,CAAK,CAAC,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,kBAAA,EAAoB,CAAC,CAAA;AAAA,MAC1E;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACF","file":"chunk-5ABTBPPK.js","sourcesContent":["/**\n * @sonordev/site-kit shared - Resilient fetch\n *\n * Single source of truth for client-side resilient fetch (forms, SitemapSync).\n * Adds a per-attempt timeout and retries transient failures (network errors,\n * request timeouts, HTTP 429, and 5xx) with exponential backoff.\n *\n * A form submission must survive a brief API blip — a deploy, a cold start, a\n * dropped packet. A single un-retried fetch turning into \"Something went wrong\"\n * is how leads get lost. The explicit abort also matters on its own: a request\n * left to hang until the browser's own network timeout logs a console error\n * (net::ERR_TIMED_OUT) that fails Lighthouse best-practices; an aborted fetch\n * logs nothing.\n */\n\nexport interface FetchRetryOptions {\n  /** Number of retries AFTER the first attempt (default 2 → up to 3 tries total). */\n  retries?: number\n  /** Per-attempt timeout in milliseconds (default 15000). */\n  timeoutMs?: number\n}\n\nfunction backoffDelay(attempt: number, response?: Response): number {\n  // Honor a Retry-After header on 429 responses when present.\n  if (response?.status === 429) {\n    const header = response.headers.get('retry-after')\n    const seconds = header ? parseInt(header, 10) : NaN\n    if (!Number.isNaN(seconds) && seconds > 0) return Math.min(seconds * 1000, 10000)\n  }\n  // Exponential backoff: 500ms, 1s, 2s, ... capped at 8s.\n  return Math.min(8000, 500 * 2 ** attempt)\n}\n\n/**\n * fetch() with a timeout and automatic retries for transient failures.\n *\n * Non-transient responses (2xx, 3xx, and 4xx other than 429) are returned to\n * the caller as-is — only 429/5xx and thrown network/timeout errors are retried.\n * If every attempt fails with a thrown error, the last error is re-thrown.\n */\nexport async function fetchWithRetry(\n  url: string,\n  init: RequestInit,\n  options: FetchRetryOptions = {},\n): Promise<Response> {\n  const retries = options.retries ?? 2\n  const timeoutMs = options.timeoutMs ?? 15000\n  let lastError: unknown\n\n  for (let attempt = 0; attempt <= retries; attempt++) {\n    const controller = new AbortController()\n    const timer = setTimeout(() => controller.abort(), timeoutMs)\n    try {\n      const response = await fetch(url, { ...init, signal: controller.signal })\n      clearTimeout(timer)\n\n      if ((response.status === 429 || response.status >= 500) && attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt, response)))\n        continue\n      }\n      return response\n    } catch (error) {\n      clearTimeout(timer)\n      lastError = error\n      // Network failure or timeout (AbortController) — retry while attempts remain.\n      if (attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt)))\n        continue\n      }\n    }\n  }\n\n  throw lastError instanceof Error\n    ? lastError\n    : new Error('Network request failed after multiple attempts. Please try again.')\n}\n","/**\n * @sonordev/site-kit shared - Canonical client transport\n *\n * Single source of truth for how site-kit talks to Sonor from the browser.\n * Every client-side module (analytics, forms, commerce, engage, maps, images,\n * SitemapSync) routes through here instead of bare fetch(), which gives the\n * whole kit, in one place:\n *\n *  - per-attempt timeout + retry with backoff (via fetchWithRetry) — a hung\n *    request left to the browser's own network timeout logs a console error\n *    (net::ERR_TIMED_OUT) that fails Lighthouse best-practices\n *  - the x-sitekit-version header on every request, so the platform can see\n *    which kit version each site actually runs from live traffic\n *  - CREDENTIAL LIFECYCLE: sites on 3.2+ ship a short-lived minted token instead\n *    of the raw key. This transport resolves the freshest token (refreshing a\n *    stale seed transparently), and on a 401/403 for a token it refreshes once\n *    and retries before giving up. A raw key (2.x kit, or the mint-failed\n *    fallback) is a pure passthrough — legacy behavior is unchanged.\n *  - an auth circuit breaker: after a 401/403 the credential is paused for a few\n *    minutes and ONE friendly console.info is emitted — a site on a stale or\n *    canceled key must not spam the API or the visitor's console. Keyed by the\n *    project (from the token) so it survives token rotation.\n *  - sonorBeacon for unload-time telemetry that keeps the credential in headers;\n *    navigator.sendBeacon can't set headers and forced the key into the URL,\n *    where server and CDN access logs capture it\n *\n * Non-idempotent endpoints (checkout, payment intents, uploads) must pass\n * { retries: 0 } — they still get the timeout, but never an automatic retry.\n */\nimport { fetchWithRetry, type FetchRetryOptions } from './fetchWithRetry'\nimport { SITE_KIT_VERSION } from './version'\nimport {\n  credentialBreakerId,\n  currentCredential,\n  getFreshCredential,\n  isSiteToken,\n  isTokenMode,\n  refreshSiteToken,\n} from './siteToken'\n\nexport interface SonorFetchOptions extends FetchRetryOptions {\n  /** Project credential — the minted token (3.2+) or raw key. Sent as x-api-key. */\n  apiKey?: string\n}\n\n/** How long a credential stays paused after an auth failure. */\nconst AUTH_BREAK_MS = 5 * 60_000\n\n// breaker id → epoch ms until which requests are paused. Shared on window for\n// the same reason as the token state (see siteToken.ts): duplicated module\n// copies must trip and observe ONE breaker, not one each. Never applies on the\n// server, so a per-module Map there is fine.\nconst BREAKER_STATE_KEY = '__SONOR_AUTH_BREAKER__'\nconst pausedKeys: Map<string, number> = (() => {\n  if (typeof window === 'undefined') return new Map()\n  const w = window as unknown as Record<string, Map<string, number> | undefined>\n  return (w[BREAKER_STATE_KEY] ??= new Map())\n})()\nlet warnedThisPage = false\n\n/** True when a previous 401/403 has paused this credential (browser only). */\nexport function isAuthPaused(credential?: string): boolean {\n  if (typeof window === 'undefined') return false\n  const id = credentialBreakerId(credential)\n  const until = pausedKeys.get(id)\n  if (!until) return false\n  if (Date.now() >= until) {\n    pausedKeys.delete(id)\n    return false\n  }\n  return true\n}\n\nfunction tripBreaker(credential?: string): void {\n  pausedKeys.set(credentialBreakerId(credential), Date.now() + AUTH_BREAK_MS)\n  if (!warnedThisPage) {\n    warnedThisPage = true\n    // info, not error: a visitor's console must stay clean (Lighthouse\n    // errors-in-console), and copy never names env vars or key formats.\n    console.info(\n      \"[Sonor] This site couldn't authenticate with Sonor, so data features are paused for a few minutes. If this keeps happening, the site is likely running an outdated API key.\",\n    )\n  }\n}\n\nexport async function sonorFetch(\n  url: string,\n  init: RequestInit = {},\n  options: SonorFetchOptions = {},\n): Promise<Response> {\n  // Resolve the credential to send. In token mode this may transparently refresh\n  // a stale seed before the first request; in raw-key mode it's a passthrough.\n  let credential = options.apiKey\n  if (credential !== undefined || isTokenMode()) {\n    credential = await getFreshCredential(options.apiKey)\n  }\n\n  const headers = new Headers(init.headers || {})\n  headers.set('x-sitekit-version', SITE_KIT_VERSION)\n  if (credential) {\n    if (isTokenMode()) {\n      // Token mode: `credential` is the freshest token (refreshed just above if\n      // the seed was stale). It MUST override any x-api-key a caller hand-set — a\n      // stale build-time seed passed as a header would otherwise pin the request\n      // and defeat refresh entirely. Also drop a caller-set Authorization:\n      // extractApiKey() server-side prefers `Authorization: Bearer` over\n      // x-api-key, so a stale Bearer seed would win even once we set a fresh\n      // x-api-key. This is the single place the client credential is chosen — do\n      // not re-attach it as a header at call sites.\n      headers.set('x-api-key', credential)\n      headers.delete('authorization')\n    } else if (!headers.has('x-api-key')) {\n      // Raw-key mode: legacy passthrough — respect a caller-supplied header.\n      headers.set('x-api-key', credential)\n    }\n  }\n\n  if (isAuthPaused(credential)) {\n    // Synthetic response keeps every caller's !response.ok path working\n    // without a network round trip while the breaker is open.\n    return new Response(null, { status: 401, statusText: 'sonor-auth-paused' })\n  }\n\n  let response = await fetchWithRetry(url, { ...init, headers }, options)\n\n  // A token can rotate or expire mid-session. On the first auth failure, try ONE\n  // refresh + retry before tripping the breaker — only for token credentials\n  // (raw keys have nothing to refresh).\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    isSiteToken(credential)\n  ) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed && refreshed !== credential) {\n      const retryHeaders = new Headers(init.headers || {})\n      retryHeaders.set('x-sitekit-version', SITE_KIT_VERSION)\n      retryHeaders.set('x-api-key', refreshed)\n      // Same reason as the initial request: a caller-set stale Bearer would win\n      // over our fresh x-api-key server-side, so strip it on the retry too.\n      retryHeaders.delete('authorization')\n      credential = refreshed\n      response = await fetchWithRetry(url, { ...init, headers: retryHeaders }, options)\n    }\n  }\n\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    credential\n  ) {\n    tripBreaker(credential)\n  }\n\n  return response\n}\n\n/**\n * Fire-and-forget telemetry that survives page unload.\n *\n * Uses fetch({ keepalive: true }) so auth travels in headers. Falls back to\n * navigator.sendBeacon (no auth headers possible — the server may reject it,\n * but we never put the key in the URL) only when keepalive fetch is missing.\n *\n * Cannot await a refresh at unload time, so it sends the freshest token already\n * held (currentCredential) rather than the possibly-stale seed the caller passed.\n */\nexport function sonorBeacon(url: string, payload: unknown, apiKey?: string): void {\n  const credential = currentCredential(apiKey)\n  const body = typeof payload === 'string' ? payload : JSON.stringify(payload)\n  try {\n    void fetch(url, {\n      method: 'POST',\n      keepalive: true,\n      headers: {\n        'Content-Type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        ...(credential ? { 'x-api-key': credential } : {}),\n      },\n      body,\n    }).catch(() => {\n      /* page is closing — best effort */\n    })\n  } catch {\n    try {\n      if (typeof navigator !== 'undefined' && navigator.sendBeacon) {\n        navigator.sendBeacon(url, new Blob([body], { type: 'application/json' }))\n      }\n    } catch {\n      /* nothing left to try */\n    }\n  }\n}\n"]}