@sonordev/site-kit 6.1.0 → 6.1.3

package/dist/{chunk-AQUWWATH.js.map → chunk-IZRVSIOK.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/forms/defaultSuccessMessage.ts","../src/forms/normalize-config.ts","../src/forms/recaptcha.ts","../src/forms/ga4-identity.ts","../src/forms/submitForm.ts"],"names":["DEFAULT_HONEYPOT_FIELD","sonorFetch"],"mappings":";;;;;;AACO,IAAM,4BAAA,GACX;;;ACiBK,SAAS,oBAAoB,IAAA,EAA8B;AAChE,EAAA,IAAI,KAAK,KAAA,EAAO;AACd,IAAA,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,EAAQ,CAAA,KAAA,CAAY,EAAE,WAAA,IAAe,CAAA,KAAM,CAAA,CAAE,WAAA,IAAe,CAAA,CAAE,CAAA;AAAA,EACjF;AACA,EAAA,IAAI,KAAK,MAAA,EAAQ;AACf,IAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,EAAQ,CAAA,KAAA,CAAY,EAAE,UAAA,IAAc,CAAA,KAAM,CAAA,CAAE,UAAA,IAAc,CAAA,CAAE,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,EAAO,MAAA,IAAU,CAAA;AAC1C,EAAA,MAAM,gBAAgB,WAAA,GAAc,CAAA;AAEpC,EAAA,MAAM,UAAA,GACJ,OAAO,IAAA,CAAK,eAAA,KAAoB,WAAW,IAAA,CAAK,eAAA,CAAgB,MAAK,GAAI,EAAA;AAC3E,EAAA,MAAM,eAAA,GACJ,UAAA,KACC,OAAQ,IAAA,CAAqC,cAAA,KAAmB,QAAA,GAC7D,MAAA,CAAQ,IAAA,CAAqC,cAAc,CAAA,CAAE,IAAA,EAAK,GAClE,EAAA,CAAA,IACJ,4BAAA;AAEF,EAAA,OAAO;AAAA,IACL,GAAG,IAAA;AAAA,IACH,eAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF;AACF;;;ACrCA,SAAS,WAAW,eAAA,EAA8C;AAChE,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,MAAA;AAC1C,EAAA,IAAI,iBAAiB,OAAO,eAAA;AAC5B,EAAA,MAAM,GAAA,GAAM,MAAA;AACZ,EAAA,OAAO,GAAA,CAAI,+BAAA,IAAmC,OAAA,CAAQ,GAAA,CAAI,8BAAA;AAC5D;AAGA,IAAM,yBAAA,GAA4B,GAAA;AAElC,SAAS,WAAW,OAAA,EAA+B;AACjD,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC9B,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,MAAA;AACZ,IAAA,IAAI,GAAA,CAAI,YAAY,UAAA,EAAY;AAC9B,MAAA,OAAA,CAAQ,IAAI,UAAU,CAAA;AACtB,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,MAAM,MAAA,GAAS,CAAC,KAAA,KAAe;AAC7B,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,IACf,CAAA;AACA,IAAA,MAAM,SAAS,UAAA,CAAW,MAAM,MAAA,CAAO,IAAI,GAAG,yBAAyB,CAAA;AAEvE,IAAA,MAAM,eAAe,MAAM;AACzB,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,IAAI,GAAA,CAAI,YAAY,UAAA,EAAY;AAC9B,QAAA,YAAA,CAAa,MAAM,CAAA;AACnB,QAAA,MAAA,CAAO,IAAI,UAAU,CAAA;AACrB,QAAA;AAAA,MACF;AACA,MAAA,UAAA,CAAW,cAAc,EAAE,CAAA;AAAA,IAC7B,CAAA;AAEA,IAAA,MAAM,QAAA,GAAW,QAAA,CAAS,aAAA,CAAc,qCAAqC,CAAA;AAC7E,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,YAAA,EAAa;AACb,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,IAAA,MAAA,CAAO,GAAA,GAAM,yDAAyD,OAAO,CAAA,CAAA;AAC7E,IAAA,MAAA,CAAO,KAAA,GAAQ,IAAA;AACf,IAAA,MAAA,CAAO,MAAA,GAAS,MAAM,YAAA,EAAa;AACnC,IAAA,MAAA,CAAO,UAAU,MAAM;AACrB,MAAA,YAAA,CAAa,MAAM,CAAA;AACnB,MAAA,MAAA,CAAO,IAAI,CAAA;AAAA,IACb,CAAA;AACA,IAAA,QAAA,CAAS,IAAA,CAAK,YAAY,MAAM,CAAA;AAAA,EAClC,CAAC,CAAA;AACH;AAMA,eAAsB,kBAAkB,eAAA,EAAkD;AACxF,EAAA,MAAM,OAAA,GAAU,WAAW,eAAe,CAAA;AAC1C,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,MAAA,KAAW,aAAa,OAAO,IAAA;AACtD,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,MAAM,UAAA,CAAW,OAAO,CAAA;AAC3C,IAAA,IAAI,CAAC,UAAA,EAAY,UAAA,EAAY,OAAA,EAAS,OAAO,IAAA;AAK7C,IAAA,MAAM,IAAI,QAAc,CAAC,OAAA,KAAY,WAAW,UAAA,CAAW,KAAA,CAAM,OAAO,CAAC,CAAA;AACzE,IAAA,MAAM,KAAA,GAAQ,MAAM,UAAA,CAAW,UAAA,CAAW,QAAQ,OAAA,EAAS,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AAC/E,IAAA,OAAO,KAAA,IAAS,IAAA;AAAA,EAClB,SAAS,GAAA,EAAK;AAGZ,IAAA,IAAI;AACF,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,GAAG,CAAC,CAAA;AACvD,MAAA,MAAM,GAAA,GAAM,MAAA;AACZ,MAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,UAAA,CAAW,UAAA,CAAW,QAAQ,OAAA,EAAS,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AACnF,MAAA,OAAO,KAAA,IAAS,IAAA;AAAA,IAClB,SAAS,QAAA,EAAU;AACjB,MAAA,OAAA,CAAQ,IAAA,CAAK,wBAAwB,QAAQ,CAAA;AAC7C,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACF;;;ACpEA,SAAS,UAAA,CAAW,KAAa,IAAA,EAAkC;AACjE,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAC1D,EAAA,MAAM,KAAA,GAAQ,IAAI,KAAA,CAAM,IAAI,OAAO,CAAA,WAAA,EAAc,OAAO,UAAU,CAAC,CAAA;AACnE,EAAA,OAAO,KAAA,GAAQ,kBAAA,CAAmB,KAAA,CAAM,CAAC,CAAC,CAAA,GAAI,MAAA;AAChD;AAEO,SAAS,eAAA,GAA+B;AAC7C,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA,EAAa,OAAO,EAAC;AAC7C,EAAA,MAAM,GAAA,GAAM,SAAS,MAAA,IAAU,EAAA;AAC/B,EAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAC;AAElB,EAAA,MAAM,WAAwB,EAAC;AAK/B,EAAA,MAAM,EAAA,GAAK,UAAA,CAAW,GAAA,EAAK,KAAK,CAAA;AAChC,EAAA,IAAI,EAAA,EAAI;AACN,IAAA,MAAM,KAAA,GAAQ,EAAA,CAAG,KAAA,CAAM,GAAG,CAAA;AAC1B,IAAA,IAAI,KAAA,CAAM,UAAU,CAAA,EAAG;AACrB,MAAA,MAAM,QAAA,GAAW,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAC,CAAA,CAAA;AACtE,MAAA,IAAI,YAAA,CAAa,IAAA,CAAK,QAAQ,CAAA,WAAY,UAAA,GAAa,QAAA;AAAA,IACzD;AAAA,EACF;AAGA,EAAA,MAAM,WAAmC,EAAC;AAC1C,EAAA,KAAA,MAAW,GAAA,IAAO,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,MAAA,GAAS,IAAI,IAAA,EAAK;AACxB,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA;AAC7B,IAAA,IAAI,KAAK,CAAA,EAAG;AACZ,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B,IAAA,MAAM,SAAA,GAAY,oBAAA,CAAqB,IAAA,CAAK,IAAI,IAAI,CAAC,CAAA;AACrD,IAAA,IAAI,CAAC,SAAA,EAAW;AAChB,IAAA,MAAM,KAAA,GAAQ,mBAAmB,MAAA,CAAO,KAAA,CAAM,KAAK,CAAC,CAAC,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA;AAChE,IAAA,IAAI,KAAA,CAAM,MAAA,IAAU,CAAA,IAAK,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,CAAC,CAAC,CAAA,EAAG,QAAA,CAAS,SAAS,CAAA,GAAI,MAAM,CAAC,CAAA;AAAA,EAChF;AACA,EAAA,IAAI,OAAO,IAAA,CAAK,QAAQ,EAAE,MAAA,GAAS,CAAA,WAAY,UAAA,GAAa,QAAA;AAE5D,EAAA,OAAO,QAAA;AACT;;;ACnDO,SAAS,YAAA,GAA+D;AAI7E,EAAA,MAAM,MAAA,GACJ,OAAO,MAAA,KAAW,WAAA,GACb,MAAA,CAAe,oBAAA,IAAwB,sBAAA,GACxC,OAAA,CAAQ,GAAA,CAAI,aAAA,IAAiB,OAAA,CAAQ,GAAA,CAAI,yBAAA,IAA6B,sBAAA;AAC5E,EAAA,MAAM,MAAA,GACJ,OAAO,MAAA,KAAW,WAAA,GAAe,OAAe,oBAAA,GAAuB,MAAA;AACzE,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC1B;AAEA,SAAS,YAAA,GAA8C;AACrD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,EAAC;AAC3C,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAA,CAAO,SAAS,MAAM,CAAA;AACzD,EAAA,MAAM,MAAqC,EAAC;AAC5C,EAAA,KAAA,MAAW,OAAO,CAAC,YAAA,EAAc,cAAc,cAAA,EAAgB,UAAA,EAAY,aAAa,CAAA,EAAG;AACzF,IAAA,GAAA,CAAI,GAAG,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAAA,EAC3B;AACA,EAAA,OAAO,GAAA;AACT;AAoBA,eAAsB,UAAA,CAAW;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA,EAAqC;AACnC,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,YAAA,EAAa;AACxC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,MAAM,6DAA6D,CAAA;AAAA,EAC/E;AAGA,EAAA,MAAM,iBAAiB,MAAA,CAAO,iBAAA,GAC1B,MAAM,iBAAA,CAAkB,MAAA,CAAO,kBAAkB,CAAA,GACjD,IAAA;AACJ,EAAA,IAAI,MAAA,CAAO,iBAAA,IAAqB,CAAC,cAAA,EAAgB;AAC/C,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC1E;AAEA,EAAA,MAAM,iBAAA,GAAoB,OAAO,cAAA,IAAkBA,uCAAA;AACnD,EAAA,MAAM,MAAM,YAAA,EAAa;AAIzB,EAAA,MAAM,MAAM,eAAA,EAAgB;AAE5B,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,QAAQ,MAAA,CAAO,EAAA;AAAA,IACf,SAAS,MAAA,CAAO,EAAA;AAAA,IAChB,IAAA,EAAM;AAAA,MACJ,GAAG,MAAA;AAAA,MACH,GAAI,OAAO,gBAAA,GAAmB,EAAE,CAAC,iBAAiB,GAAG,aAAA,EAAc,GAAI;AAAC,KAC1E;AAAA,IACA,QAAA,EAAU;AAAA,MACR,SAAS,OAAO,MAAA,KAAW,WAAA,GAAc,MAAA,CAAO,SAAS,IAAA,GAAO,IAAA;AAAA,MAChE,UAAU,OAAO,QAAA,KAAa,WAAA,GAAc,QAAA,CAAS,YAAY,IAAA,GAAO,IAAA;AAAA,MACxE,SAAA,EAAW,OAAO,SAAA,KAAc,WAAA,GAAc,UAAU,SAAA,GAAY,IAAA;AAAA,MACpE,WACE,OAAO,cAAA,KAAmB,cAAc,cAAA,CAAe,OAAA,CAAQ,SAAS,CAAA,GAAI,IAAA;AAAA;AAAA;AAAA;AAAA,MAI9E,WACE,OAAO,YAAA,KAAiB,cAAc,YAAA,CAAa,OAAA,CAAQ,SAAS,CAAA,GAAI,IAAA;AAAA,MAC1E,gBAAgB,cAAA,IAAkB,MAAA;AAAA,MAClC,WAAW,GAAA,CAAI,UAAA;AAAA,MACf,WAAW,GAAA,CAAI,UAAA;AAAA,MACf,aAAa,GAAA,CAAI,YAAA;AAAA,MACjB,SAAS,GAAA,CAAI,QAAA;AAAA,MACb,YAAY,GAAA,CAAI,WAAA;AAAA,MAChB,GAAG,GAAA;AAAA;AAAA;AAAA,MAGH,IAAA,EACE,OAAO,MAAA,KAAW,WAAA,GACb,OAA0C,iBAAA,IAC3C,MAAA,CAAO,SAAS,IAAA,GAChB,MAAA;AAAA,MACN,aAAA,EAAe;AAAA;AACjB,GACF;AAEA,EAAA,MAAM,WAAW,MAAMC,2BAAA;AAAA,IACrB,GAAG,MAAM,CAAA,wBAAA,CAAA;AAAA,IACT;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,aAAA,EAAe,UAAU,MAAM,CAAA;AAAA,OACjC;AAAA,MACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAO;AAAA,KAC9B;AAAA,IACA,EAAE,OAAA,EAAS,CAAA,EAAG,SAAA,EAAW,GAAA;AAAM,GACjC;AAEA,EAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAEnD,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,GAAA,GAAA,CACJ,IAAA,EAAM,OAAA,IACN,IAAA,EAAM,KAAA,KACL,QAAA,CAAS,UAAA,IAAc,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA,CAAA,EAE9C,QAAA,GACA,IAAA,EAAK;AACR,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,MAAM,CAAA,uBAAA,EAA0B,GAAG,CAAA,CAAA,GAAK,CAAA,uBAAA,EAA0B,SAAS,MAAM,CAAA,CAAA;AAAA,KACnF;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT","file":"chunk-AQUWWATH.js","sourcesContent":["/** Shown when the API omits or returns an empty `success_message`. */\nexport const DEFAULT_FORM_SUCCESS_MESSAGE =\n  'Thank you for your submission! We will be in touch soon.'\n","/**\n * Shared form-config normalizer — the ONE place a raw\n * /api/public/forms/config payload becomes a ManagedFormConfig.\n *\n * Deliberately has no `'use client'` directive and no hooks, so it is usable\n * from a Server Component (StaticForm) as well as from useForm's client\n * fetch. Both the server shell and the hydrated enhancement must agree on\n * field order, step count and success copy or the swap visibly jumps, so\n * there must never be a second copy of this.\n */\n\nimport type { ManagedFormConfig } from './types'\nimport { DEFAULT_FORM_SUCCESS_MESSAGE } from './defaultSuccessMessage'\n\n/**\n * Normalize a raw /api/public/forms/config payload into ManagedFormConfig.\n * Single source of truth — used for both the client fetch and server-provided\n * `initialForm`, so the two paths can never drift.\n */\nexport function normalizeFormConfig(data: any): ManagedFormConfig {\n  if (data.steps) {\n    data.steps.sort((a: any, b: any) => (a.step_number || 0) - (b.step_number || 0))\n  }\n  if (data.fields) {\n    data.fields.sort((a: any, b: any) => (a.sort_order || 0) - (b.sort_order || 0))\n  }\n\n  const total_steps = data.steps?.length || 1\n  const is_multi_step = total_steps > 1\n\n  const apiSuccess =\n    typeof data.success_message === 'string' ? data.success_message.trim() : ''\n  const success_message =\n    apiSuccess ||\n    (typeof (data as { successMessage?: string }).successMessage === 'string'\n      ? String((data as { successMessage?: string }).successMessage).trim()\n      : '') ||\n    DEFAULT_FORM_SUCCESS_MESSAGE\n\n  return {\n    ...data,\n    success_message,\n    total_steps,\n    is_multi_step,\n  }\n}\n","/**\n * reCAPTCHA Enterprise - Client-side token generation for site-kit forms\n *\n * Site key is read from:\n * - window.__SITE_KIT_RECAPTCHA_SITE_KEY__ (set by SiteKitLayout)\n * - process.env.NEXT_PUBLIC_RECAPTCHA_SITE_KEY (when bundled in Next.js app)\n */\n\nfunction getSiteKey(explicitSiteKey?: string): string | undefined {\n  if (typeof window === 'undefined') return undefined\n  if (explicitSiteKey) return explicitSiteKey\n  const win = window as any\n  return win.__SITE_KIT_RECAPTCHA_SITE_KEY__ ?? process.env.NEXT_PUBLIC_RECAPTCHA_SITE_KEY\n}\n\n/** Max time to wait for reCAPTCHA Enterprise to become usable before giving up. */\nconst RECAPTCHA_LOAD_TIMEOUT_MS = 10000\n\nfunction loadScript(siteKey: string): Promise<any> {\n  return new Promise((resolve) => {\n    if (typeof window === 'undefined') {\n      resolve(null)\n      return\n    }\n    const win = window as any\n    if (win.grecaptcha?.enterprise) {\n      resolve(win.grecaptcha)\n      return\n    }\n\n    // Never hang the form: if the script is blocked (ad-blocker), stalls, or\n    // never initializes `grecaptcha.enterprise`, resolve null after a timeout.\n    // The caller treats a null result as \"no token\" rather than waiting forever.\n    let settled = false\n    const finish = (value: any) => {\n      if (settled) return\n      settled = true\n      resolve(value)\n    }\n    const giveUp = setTimeout(() => finish(null), RECAPTCHA_LOAD_TIMEOUT_MS)\n\n    const waitForReady = () => {\n      if (settled) return\n      if (win.grecaptcha?.enterprise) {\n        clearTimeout(giveUp)\n        finish(win.grecaptcha)\n        return\n      }\n      setTimeout(waitForReady, 50)\n    }\n\n    const existing = document.querySelector('script[src*=\"recaptcha/enterprise\"]')\n    if (existing) {\n      waitForReady()\n      return\n    }\n\n    const script = document.createElement('script')\n    script.src = `https://www.google.com/recaptcha/enterprise.js?render=${siteKey}`\n    script.async = true\n    script.onload = () => waitForReady()\n    script.onerror = () => {\n      clearTimeout(giveUp)\n      finish(null)\n    }\n    document.head.appendChild(script)\n  })\n}\n\n/**\n * Get a reCAPTCHA Enterprise token for form submission.\n * Returns null if not configured or in SSR.\n */\nexport async function getRecaptchaToken(explicitSiteKey?: string): Promise<string | null> {\n  const siteKey = getSiteKey(explicitSiteKey)\n  if (!siteKey || typeof window === 'undefined') return null\n  try {\n    const grecaptcha = await loadScript(siteKey)\n    if (!grecaptcha?.enterprise?.execute) return null\n    // loadScript only waits for grecaptcha.enterprise to EXIST — execute()\n    // before enterprise.ready() rejects while the widget initializes (cold\n    // page load = every first-visit submitter). A swallowed rejection here\n    // means no token, and a requireRecaptcha project hard-rejects the lead.\n    await new Promise<void>((resolve) => grecaptcha.enterprise.ready(resolve))\n    const token = await grecaptcha.enterprise.execute(siteKey, { action: 'submit' })\n    return token || null\n  } catch (err) {\n    // One retry after a beat — first-execute flakes persist on slow devices\n    // even post-ready, and a dropped token is a dropped lead.\n    try {\n      await new Promise((resolve) => setTimeout(resolve, 800))\n      const win = window as any\n      const token = await win.grecaptcha.enterprise.execute(siteKey, { action: 'submit' })\n      return token || null\n    } catch (retryErr) {\n      console.warn('[site-kit reCAPTCHA]', retryErr)\n      return null\n    }\n  }\n}\n","/**\n * Reads the visitor's GA4 identity out of their own first-party cookies so a\n * lead conversion can be reported SERVER-side.\n *\n * Why the server has to do the reporting: Sonor's form-submit endpoint answers\n * with a byte-identical success payload whether it accepted a submission or\n * quarantined it as spam (deliberately — a bot must never learn it was\n * caught). So the browser cannot tell a real lead from a filtered one, and a\n * site firing its own ad conversion bills both. The accept/reject verdict only\n * exists on the server, so the conversion has to be sent from there — and to\n * send it, the server needs the GA4 identity that only the browser can see.\n *\n * Nothing here is a new identifier: these are cookies Google's own tag already\n * set on this visitor. We read them, we never write them.\n */\n\nexport interface Ga4Identity {\n  /** GA4 client id, from `_ga`. Without it a server-sent event has no identity. */\n  gaClientId?: string\n  /**\n   * GA4 session ids keyed by container id (the measurement id minus `G-`), from\n   * the `_ga_<CONTAINER>` cookies.\n   *\n   * A map rather than one value because a page may carry more than one GA4\n   * property, and picking the wrong one would silently attach the lead to the\n   * wrong session — the sender knows which measurement id it is configured for,\n   * this side does not.\n   */\n  gaSessions?: Record<string, string>\n}\n\nfunction readCookie(jar: string, name: string): string | undefined {\n  const escaped = name.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')\n  const match = jar.match(new RegExp(`(?:^|;\\\\s*)${escaped}=([^;]*)`))\n  return match ? decodeURIComponent(match[1]) : undefined\n}\n\nexport function readGa4Identity(): Ga4Identity {\n  if (typeof document === 'undefined') return {}\n  const jar = document.cookie || ''\n  if (!jar) return {}\n\n  const identity: Ga4Identity = {}\n\n  // `_ga` is `GA1.<depth>.<id1>.<id2>`; the client id is the last two parts\n  // joined. Reading the raw cookie rather than the trailing two segments\n  // blindly keeps it correct when the depth prefix varies by domain scope.\n  const ga = readCookie(jar, '_ga')\n  if (ga) {\n    const parts = ga.split('.')\n    if (parts.length >= 4) {\n      const clientId = `${parts[parts.length - 2]}.${parts[parts.length - 1]}`\n      if (/^\\d+\\.\\d+$/.test(clientId)) identity.gaClientId = clientId\n    }\n  }\n\n  // `_ga_<CONTAINER>` is `GS<v>.<depth>.<session_id>.<session_number>....`\n  const sessions: Record<string, string> = {}\n  for (const raw of jar.split(';')) {\n    const cookie = raw.trim()\n    const eq = cookie.indexOf('=')\n    if (eq < 0) continue\n    const name = cookie.slice(0, eq)\n    const container = /^_ga_([A-Z0-9]+)$/i.exec(name)?.[1]\n    if (!container) continue\n    const parts = decodeURIComponent(cookie.slice(eq + 1)).split('.')\n    if (parts.length >= 3 && /^\\d+$/.test(parts[2])) sessions[container] = parts[2]\n  }\n  if (Object.keys(sessions).length > 0) identity.gaSessions = sessions\n\n  return identity\n}\n","/**\n * @sonordev/site-kit/forms - Shared submission logic\n *\n * Single source of truth for sending a managed form to the Sonor API. Both\n * <ManagedForm> (via FormClient) and the headless useForm() hook submit through\n * here, so the request shape, retry behaviour, reCAPTCHA handling, and error\n * parsing can never drift between the two paths.\n */\n\nimport { sonorFetch } from '../shared/sonorFetch'\nimport { getRecaptchaToken } from './recaptcha'\nimport { DEFAULT_HONEYPOT_FIELD } from './contract'\nimport { readGa4Identity } from './ga4-identity'\nimport type { ManagedFormConfig } from './types'\n\n// The honeypot trap-field name lives once in the shared forms contract\n// (single source of truth for site-kit's client + sonor-api's intake).\n// Re-exported so existing importers of this path keep resolving it.\nexport { DEFAULT_HONEYPOT_FIELD }\n\nexport function getApiConfig(): { apiUrl: string; apiKey: string | undefined } {\n  // Server branch must honor the same env override SiteKitLayout feeds into\n  // __SITE_KIT_API_URL__, or SSR-rendered absolute URLs (the native form\n  // action) would point at prod from a staging site.\n  const apiUrl =\n    typeof window !== 'undefined'\n      ? (window as any).__SITE_KIT_API_URL__ || 'https://api.sonor.io'\n      : process.env.SONOR_API_URL || process.env.NEXT_PUBLIC_SONOR_API_URL || 'https://api.sonor.io'\n  const apiKey =\n    typeof window !== 'undefined' ? (window as any).__SITE_KIT_API_KEY__ : undefined\n  return { apiUrl, apiKey }\n}\n\nfunction getUTMParams(): Record<string, string | null> {\n  if (typeof window === 'undefined') return {}\n  const params = new URLSearchParams(window.location.search)\n  const out: Record<string, string | null> = {}\n  for (const key of ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content']) {\n    out[key] = params.get(key)\n  }\n  return out\n}\n\nexport interface SubmitFormArgs {\n  config: ManagedFormConfig\n  /**\n   * Field values to submit. The caller must pass VISIBLE values only —\n   * conditionally-hidden fields should be excluded so stale values are not sent.\n   */\n  values: Record<string, unknown>\n  /** Honeypot input value (empty string for the headless hook, which has no honeypot UI). */\n  honeypotValue: string\n  /** Timestamp (ms) the form was first rendered — a weak anti-bot timing signal. */\n  formLoadedAt: number\n}\n\n/**\n * Submit a managed form. Throws on failure (network, timeout, or a non-2xx\n * response) with a human-readable message; resolves with the parsed API\n * response on success.\n */\nexport async function submitForm({\n  config,\n  values,\n  honeypotValue,\n  formLoadedAt,\n}: SubmitFormArgs): Promise<unknown> {\n  const { apiUrl, apiKey } = getApiConfig()\n  if (!apiKey) {\n    throw new Error('API key is required. Set SONOR_API_KEY in your environment.')\n  }\n\n  // reCAPTCHA token is fetched right before the POST so it cannot expire.\n  const recaptchaToken = config.recaptcha_enabled\n    ? await getRecaptchaToken(config.recaptcha_site_key)\n    : null\n  if (config.recaptcha_enabled && !recaptchaToken) {\n    throw new Error('Verification could not be completed. Please try again.')\n  }\n\n  const honeypotFieldName = config.honeypot_field || DEFAULT_HONEYPOT_FIELD\n  const utm = getUTMParams()\n  // The visitor's existing GA4 cookies, so Sonor can report an accepted lead\n  // as a conversion server-side. Nothing is written or created here — see\n  // ga4-identity.ts for why the server, not this browser, has to do it.\n  const ga4 = readGa4Identity()\n\n  const payload = {\n    formId: config.id,\n    form_id: config.id,\n    data: {\n      ...values,\n      ...(config.honeypot_enabled ? { [honeypotFieldName]: honeypotValue } : {}),\n    },\n    metadata: {\n      pageUrl: typeof window !== 'undefined' ? window.location.href : null,\n      referrer: typeof document !== 'undefined' ? document.referrer || null : null,\n      userAgent: typeof navigator !== 'undefined' ? navigator.userAgent : null,\n      sessionId:\n        typeof sessionStorage !== 'undefined' ? sessionStorage.getItem('_sk_sid') : null,\n      // Anonymous visitor id (_sk_vid) — the same id Analytics/Signal stamp on\n      // page views, so the Sonor side can bind this lead to its browsing session\n      // (page -> lead attribution). Sent on every submission; null pre-hydration.\n      visitorId:\n        typeof localStorage !== 'undefined' ? localStorage.getItem('_sk_vid') : null,\n      recaptchaToken: recaptchaToken || undefined,\n      utmSource: utm.utm_source,\n      utmMedium: utm.utm_medium,\n      utmCampaign: utm.utm_campaign,\n      utmTerm: utm.utm_term,\n      utmContent: utm.utm_content,\n      ...ga4,\n      // Sub-site host — preserved on form_submissions for lead attribution\n      // across multi-site projects. Resolved by SiteKitClientProviders.\n      site:\n        typeof window !== 'undefined'\n          ? (window as { __SITE_KIT_SITE__?: string }).__SITE_KIT_SITE__ ||\n            window.location.host\n          : undefined,\n      _formLoadedAt: formLoadedAt,\n    },\n  }\n\n  const response = await sonorFetch(\n    `${apiUrl}/api/public/forms/submit`,\n    {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${apiKey}`,\n      },\n      body: JSON.stringify(payload),\n    },\n    { retries: 2, timeoutMs: 20000 },\n  )\n\n  const data = await response.json().catch(() => null)\n\n  if (!response.ok) {\n    const msg = (\n      data?.message ??\n      data?.error ??\n      (response.statusText || `HTTP ${response.status}`)\n    )\n      .toString()\n      .trim()\n    throw new Error(\n      msg ? `Failed to submit form: ${msg}` : `Failed to submit form (${response.status})`,\n    )\n  }\n\n  return data\n}\n"]}
+{"version":3,"sources":["../src/forms/defaultSuccessMessage.ts","../src/forms/normalize-config.ts","../src/forms/recaptcha.ts","../src/forms/ga4-identity.ts","../src/forms/submitForm.ts"],"names":["DEFAULT_HONEYPOT_FIELD","sonorFetch"],"mappings":";;;;;;AACO,IAAM,4BAAA,GACX;;;ACiBK,SAAS,oBAAoB,IAAA,EAA8B;AAChE,EAAA,IAAI,KAAK,KAAA,EAAO;AACd,IAAA,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,EAAQ,CAAA,KAAA,CAAY,EAAE,WAAA,IAAe,CAAA,KAAM,CAAA,CAAE,WAAA,IAAe,CAAA,CAAE,CAAA;AAAA,EACjF;AACA,EAAA,IAAI,KAAK,MAAA,EAAQ;AACf,IAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,EAAQ,CAAA,KAAA,CAAY,EAAE,UAAA,IAAc,CAAA,KAAM,CAAA,CAAE,UAAA,IAAc,CAAA,CAAE,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,EAAO,MAAA,IAAU,CAAA;AAC1C,EAAA,MAAM,gBAAgB,WAAA,GAAc,CAAA;AAEpC,EAAA,MAAM,UAAA,GACJ,OAAO,IAAA,CAAK,eAAA,KAAoB,WAAW,IAAA,CAAK,eAAA,CAAgB,MAAK,GAAI,EAAA;AAC3E,EAAA,MAAM,eAAA,GACJ,UAAA,KACC,OAAQ,IAAA,CAAqC,cAAA,KAAmB,QAAA,GAC7D,MAAA,CAAQ,IAAA,CAAqC,cAAc,CAAA,CAAE,IAAA,EAAK,GAClE,EAAA,CAAA,IACJ,4BAAA;AAEF,EAAA,OAAO;AAAA,IACL,GAAG,IAAA;AAAA,IACH,eAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF;AACF;;;ACrCA,SAAS,WAAW,eAAA,EAA8C;AAChE,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,MAAA;AAC1C,EAAA,IAAI,iBAAiB,OAAO,eAAA;AAC5B,EAAA,MAAM,GAAA,GAAM,MAAA;AACZ,EAAA,OAAO,GAAA,CAAI,+BAAA,IAAmC,OAAA,CAAQ,GAAA,CAAI,8BAAA;AAC5D;AAGA,IAAM,yBAAA,GAA4B,GAAA;AAElC,SAAS,WAAW,OAAA,EAA+B;AACjD,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC9B,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,MAAA;AACZ,IAAA,IAAI,GAAA,CAAI,YAAY,UAAA,EAAY;AAC9B,MAAA,OAAA,CAAQ,IAAI,UAAU,CAAA;AACtB,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,MAAM,MAAA,GAAS,CAAC,KAAA,KAAe;AAC7B,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,IACf,CAAA;AACA,IAAA,MAAM,SAAS,UAAA,CAAW,MAAM,MAAA,CAAO,IAAI,GAAG,yBAAyB,CAAA;AAEvE,IAAA,MAAM,eAAe,MAAM;AACzB,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,IAAI,GAAA,CAAI,YAAY,UAAA,EAAY;AAC9B,QAAA,YAAA,CAAa,MAAM,CAAA;AACnB,QAAA,MAAA,CAAO,IAAI,UAAU,CAAA;AACrB,QAAA;AAAA,MACF;AACA,MAAA,UAAA,CAAW,cAAc,EAAE,CAAA;AAAA,IAC7B,CAAA;AAEA,IAAA,MAAM,QAAA,GAAW,QAAA,CAAS,aAAA,CAAc,qCAAqC,CAAA;AAC7E,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,YAAA,EAAa;AACb,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,IAAA,MAAA,CAAO,GAAA,GAAM,yDAAyD,OAAO,CAAA,CAAA;AAC7E,IAAA,MAAA,CAAO,KAAA,GAAQ,IAAA;AACf,IAAA,MAAA,CAAO,MAAA,GAAS,MAAM,YAAA,EAAa;AACnC,IAAA,MAAA,CAAO,UAAU,MAAM;AACrB,MAAA,YAAA,CAAa,MAAM,CAAA;AACnB,MAAA,MAAA,CAAO,IAAI,CAAA;AAAA,IACb,CAAA;AACA,IAAA,QAAA,CAAS,IAAA,CAAK,YAAY,MAAM,CAAA;AAAA,EAClC,CAAC,CAAA;AACH;AAMA,eAAsB,kBAAkB,eAAA,EAAkD;AACxF,EAAA,MAAM,OAAA,GAAU,WAAW,eAAe,CAAA;AAC1C,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,MAAA,KAAW,aAAa,OAAO,IAAA;AACtD,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,MAAM,UAAA,CAAW,OAAO,CAAA;AAC3C,IAAA,IAAI,CAAC,UAAA,EAAY,UAAA,EAAY,OAAA,EAAS,OAAO,IAAA;AAK7C,IAAA,MAAM,IAAI,QAAc,CAAC,OAAA,KAAY,WAAW,UAAA,CAAW,KAAA,CAAM,OAAO,CAAC,CAAA;AACzE,IAAA,MAAM,KAAA,GAAQ,MAAM,UAAA,CAAW,UAAA,CAAW,QAAQ,OAAA,EAAS,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AAC/E,IAAA,OAAO,KAAA,IAAS,IAAA;AAAA,EAClB,SAAS,GAAA,EAAK;AAGZ,IAAA,IAAI;AACF,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,GAAG,CAAC,CAAA;AACvD,MAAA,MAAM,GAAA,GAAM,MAAA;AACZ,MAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,UAAA,CAAW,UAAA,CAAW,QAAQ,OAAA,EAAS,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AACnF,MAAA,OAAO,KAAA,IAAS,IAAA;AAAA,IAClB,SAAS,QAAA,EAAU;AACjB,MAAA,OAAA,CAAQ,IAAA,CAAK,wBAAwB,QAAQ,CAAA;AAC7C,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACF;;;ACpEA,SAAS,UAAA,CAAW,KAAa,IAAA,EAAkC;AACjE,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAC1D,EAAA,MAAM,KAAA,GAAQ,IAAI,KAAA,CAAM,IAAI,OAAO,CAAA,WAAA,EAAc,OAAO,UAAU,CAAC,CAAA;AACnE,EAAA,OAAO,KAAA,GAAQ,kBAAA,CAAmB,KAAA,CAAM,CAAC,CAAC,CAAA,GAAI,MAAA;AAChD;AAEO,SAAS,eAAA,GAA+B;AAC7C,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA,EAAa,OAAO,EAAC;AAC7C,EAAA,MAAM,GAAA,GAAM,SAAS,MAAA,IAAU,EAAA;AAC/B,EAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAC;AAElB,EAAA,MAAM,WAAwB,EAAC;AAK/B,EAAA,MAAM,EAAA,GAAK,UAAA,CAAW,GAAA,EAAK,KAAK,CAAA;AAChC,EAAA,IAAI,EAAA,EAAI;AACN,IAAA,MAAM,KAAA,GAAQ,EAAA,CAAG,KAAA,CAAM,GAAG,CAAA;AAC1B,IAAA,IAAI,KAAA,CAAM,UAAU,CAAA,EAAG;AACrB,MAAA,MAAM,QAAA,GAAW,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAC,CAAA,CAAA;AACtE,MAAA,IAAI,YAAA,CAAa,IAAA,CAAK,QAAQ,CAAA,WAAY,UAAA,GAAa,QAAA;AAAA,IACzD;AAAA,EACF;AAGA,EAAA,MAAM,WAAmC,EAAC;AAC1C,EAAA,KAAA,MAAW,GAAA,IAAO,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,MAAA,GAAS,IAAI,IAAA,EAAK;AACxB,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA;AAC7B,IAAA,IAAI,KAAK,CAAA,EAAG;AACZ,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B,IAAA,MAAM,SAAA,GAAY,oBAAA,CAAqB,IAAA,CAAK,IAAI,IAAI,CAAC,CAAA;AACrD,IAAA,IAAI,CAAC,SAAA,EAAW;AAChB,IAAA,MAAM,KAAA,GAAQ,mBAAmB,MAAA,CAAO,KAAA,CAAM,KAAK,CAAC,CAAC,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA;AAChE,IAAA,IAAI,KAAA,CAAM,MAAA,IAAU,CAAA,IAAK,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,CAAC,CAAC,CAAA,EAAG,QAAA,CAAS,SAAS,CAAA,GAAI,MAAM,CAAC,CAAA;AAAA,EAChF;AACA,EAAA,IAAI,OAAO,IAAA,CAAK,QAAQ,EAAE,MAAA,GAAS,CAAA,WAAY,UAAA,GAAa,QAAA;AAE5D,EAAA,OAAO,QAAA;AACT;;;ACnDO,SAAS,YAAA,GAA+D;AAI7E,EAAA,MAAM,MAAA,GACJ,OAAO,MAAA,KAAW,WAAA,GACb,MAAA,CAAe,oBAAA,IAAwB,sBAAA,GACxC,OAAA,CAAQ,GAAA,CAAI,aAAA,IAAiB,OAAA,CAAQ,GAAA,CAAI,yBAAA,IAA6B,sBAAA;AAC5E,EAAA,MAAM,MAAA,GACJ,OAAO,MAAA,KAAW,WAAA,GAAe,OAAe,oBAAA,GAAuB,MAAA;AACzE,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC1B;AAEA,SAAS,YAAA,GAA8C;AACrD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,EAAC;AAC3C,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAA,CAAO,SAAS,MAAM,CAAA;AACzD,EAAA,MAAM,MAAqC,EAAC;AAC5C,EAAA,KAAA,MAAW,OAAO,CAAC,YAAA,EAAc,cAAc,cAAA,EAAgB,UAAA,EAAY,aAAa,CAAA,EAAG;AACzF,IAAA,GAAA,CAAI,GAAG,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAAA,EAC3B;AACA,EAAA,OAAO,GAAA;AACT;AAoBA,eAAsB,UAAA,CAAW;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA,EAAqC;AACnC,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,YAAA,EAAa;AACxC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,MAAM,6DAA6D,CAAA;AAAA,EAC/E;AAGA,EAAA,MAAM,iBAAiB,MAAA,CAAO,iBAAA,GAC1B,MAAM,iBAAA,CAAkB,MAAA,CAAO,kBAAkB,CAAA,GACjD,IAAA;AACJ,EAAA,IAAI,MAAA,CAAO,iBAAA,IAAqB,CAAC,cAAA,EAAgB;AAC/C,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC1E;AAEA,EAAA,MAAM,iBAAA,GAAoB,OAAO,cAAA,IAAkBA,uCAAA;AACnD,EAAA,MAAM,MAAM,YAAA,EAAa;AAIzB,EAAA,MAAM,MAAM,eAAA,EAAgB;AAE5B,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,QAAQ,MAAA,CAAO,EAAA;AAAA,IACf,SAAS,MAAA,CAAO,EAAA;AAAA,IAChB,IAAA,EAAM;AAAA,MACJ,GAAG,MAAA;AAAA,MACH,GAAI,OAAO,gBAAA,GAAmB,EAAE,CAAC,iBAAiB,GAAG,aAAA,EAAc,GAAI;AAAC,KAC1E;AAAA,IACA,QAAA,EAAU;AAAA,MACR,SAAS,OAAO,MAAA,KAAW,WAAA,GAAc,MAAA,CAAO,SAAS,IAAA,GAAO,IAAA;AAAA,MAChE,UAAU,OAAO,QAAA,KAAa,WAAA,GAAc,QAAA,CAAS,YAAY,IAAA,GAAO,IAAA;AAAA,MACxE,SAAA,EAAW,OAAO,SAAA,KAAc,WAAA,GAAc,UAAU,SAAA,GAAY,IAAA;AAAA,MACpE,WACE,OAAO,cAAA,KAAmB,cAAc,cAAA,CAAe,OAAA,CAAQ,SAAS,CAAA,GAAI,IAAA;AAAA;AAAA;AAAA;AAAA,MAI9E,WACE,OAAO,YAAA,KAAiB,cAAc,YAAA,CAAa,OAAA,CAAQ,SAAS,CAAA,GAAI,IAAA;AAAA,MAC1E,gBAAgB,cAAA,IAAkB,MAAA;AAAA,MAClC,WAAW,GAAA,CAAI,UAAA;AAAA,MACf,WAAW,GAAA,CAAI,UAAA;AAAA,MACf,aAAa,GAAA,CAAI,YAAA;AAAA,MACjB,SAAS,GAAA,CAAI,QAAA;AAAA,MACb,YAAY,GAAA,CAAI,WAAA;AAAA,MAChB,GAAG,GAAA;AAAA;AAAA;AAAA,MAGH,IAAA,EACE,OAAO,MAAA,KAAW,WAAA,GACb,OAA0C,iBAAA,IAC3C,MAAA,CAAO,SAAS,IAAA,GAChB,MAAA;AAAA,MACN,aAAA,EAAe;AAAA;AACjB,GACF;AAEA,EAAA,MAAM,WAAW,MAAMC,2BAAA;AAAA,IACrB,GAAG,MAAM,CAAA,wBAAA,CAAA;AAAA,IACT;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,aAAA,EAAe,UAAU,MAAM,CAAA;AAAA,OACjC;AAAA,MACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAO;AAAA,KAC9B;AAAA,IACA,EAAE,OAAA,EAAS,CAAA,EAAG,SAAA,EAAW,GAAA;AAAM,GACjC;AAEA,EAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAEnD,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,GAAA,GAAA,CACJ,IAAA,EAAM,OAAA,IACN,IAAA,EAAM,KAAA,KACL,QAAA,CAAS,UAAA,IAAc,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA,CAAA,EAE9C,QAAA,GACA,IAAA,EAAK;AACR,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,MAAM,CAAA,uBAAA,EAA0B,GAAG,CAAA,CAAA,GAAK,CAAA,uBAAA,EAA0B,SAAS,MAAM,CAAA,CAAA;AAAA,KACnF;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT","file":"chunk-IZRVSIOK.js","sourcesContent":["/** Shown when the API omits or returns an empty `success_message`. */\nexport const DEFAULT_FORM_SUCCESS_MESSAGE =\n  'Thank you for your submission! We will be in touch soon.'\n","/**\n * Shared form-config normalizer — the ONE place a raw\n * /api/public/forms/config payload becomes a ManagedFormConfig.\n *\n * Deliberately has no `'use client'` directive and no hooks, so it is usable\n * from a Server Component (StaticForm) as well as from useForm's client\n * fetch. Both the server shell and the hydrated enhancement must agree on\n * field order, step count and success copy or the swap visibly jumps, so\n * there must never be a second copy of this.\n */\n\nimport type { ManagedFormConfig } from './types'\nimport { DEFAULT_FORM_SUCCESS_MESSAGE } from './defaultSuccessMessage'\n\n/**\n * Normalize a raw /api/public/forms/config payload into ManagedFormConfig.\n * Single source of truth — used for both the client fetch and server-provided\n * `initialForm`, so the two paths can never drift.\n */\nexport function normalizeFormConfig(data: any): ManagedFormConfig {\n  if (data.steps) {\n    data.steps.sort((a: any, b: any) => (a.step_number || 0) - (b.step_number || 0))\n  }\n  if (data.fields) {\n    data.fields.sort((a: any, b: any) => (a.sort_order || 0) - (b.sort_order || 0))\n  }\n\n  const total_steps = data.steps?.length || 1\n  const is_multi_step = total_steps > 1\n\n  const apiSuccess =\n    typeof data.success_message === 'string' ? data.success_message.trim() : ''\n  const success_message =\n    apiSuccess ||\n    (typeof (data as { successMessage?: string }).successMessage === 'string'\n      ? String((data as { successMessage?: string }).successMessage).trim()\n      : '') ||\n    DEFAULT_FORM_SUCCESS_MESSAGE\n\n  return {\n    ...data,\n    success_message,\n    total_steps,\n    is_multi_step,\n  }\n}\n","/**\n * reCAPTCHA Enterprise - Client-side token generation for site-kit forms\n *\n * Site key is read from:\n * - window.__SITE_KIT_RECAPTCHA_SITE_KEY__ (set by SiteKitLayout)\n * - process.env.NEXT_PUBLIC_RECAPTCHA_SITE_KEY (when bundled in Next.js app)\n */\n\nfunction getSiteKey(explicitSiteKey?: string): string | undefined {\n  if (typeof window === 'undefined') return undefined\n  if (explicitSiteKey) return explicitSiteKey\n  const win = window as any\n  return win.__SITE_KIT_RECAPTCHA_SITE_KEY__ ?? process.env.NEXT_PUBLIC_RECAPTCHA_SITE_KEY\n}\n\n/** Max time to wait for reCAPTCHA Enterprise to become usable before giving up. */\nconst RECAPTCHA_LOAD_TIMEOUT_MS = 10000\n\nfunction loadScript(siteKey: string): Promise<any> {\n  return new Promise((resolve) => {\n    if (typeof window === 'undefined') {\n      resolve(null)\n      return\n    }\n    const win = window as any\n    if (win.grecaptcha?.enterprise) {\n      resolve(win.grecaptcha)\n      return\n    }\n\n    // Never hang the form: if the script is blocked (ad-blocker), stalls, or\n    // never initializes `grecaptcha.enterprise`, resolve null after a timeout.\n    // The caller treats a null result as \"no token\" rather than waiting forever.\n    let settled = false\n    const finish = (value: any) => {\n      if (settled) return\n      settled = true\n      resolve(value)\n    }\n    const giveUp = setTimeout(() => finish(null), RECAPTCHA_LOAD_TIMEOUT_MS)\n\n    const waitForReady = () => {\n      if (settled) return\n      if (win.grecaptcha?.enterprise) {\n        clearTimeout(giveUp)\n        finish(win.grecaptcha)\n        return\n      }\n      setTimeout(waitForReady, 50)\n    }\n\n    const existing = document.querySelector('script[src*=\"recaptcha/enterprise\"]')\n    if (existing) {\n      waitForReady()\n      return\n    }\n\n    const script = document.createElement('script')\n    script.src = `https://www.google.com/recaptcha/enterprise.js?render=${siteKey}`\n    script.async = true\n    script.onload = () => waitForReady()\n    script.onerror = () => {\n      clearTimeout(giveUp)\n      finish(null)\n    }\n    document.head.appendChild(script)\n  })\n}\n\n/**\n * Get a reCAPTCHA Enterprise token for form submission.\n * Returns null if not configured or in SSR.\n */\nexport async function getRecaptchaToken(explicitSiteKey?: string): Promise<string | null> {\n  const siteKey = getSiteKey(explicitSiteKey)\n  if (!siteKey || typeof window === 'undefined') return null\n  try {\n    const grecaptcha = await loadScript(siteKey)\n    if (!grecaptcha?.enterprise?.execute) return null\n    // loadScript only waits for grecaptcha.enterprise to EXIST — execute()\n    // before enterprise.ready() rejects while the widget initializes (cold\n    // page load = every first-visit submitter). A swallowed rejection here\n    // means no token, and a requireRecaptcha project hard-rejects the lead.\n    await new Promise<void>((resolve) => grecaptcha.enterprise.ready(resolve))\n    const token = await grecaptcha.enterprise.execute(siteKey, { action: 'submit' })\n    return token || null\n  } catch (err) {\n    // One retry after a beat — first-execute flakes persist on slow devices\n    // even post-ready, and a dropped token is a dropped lead.\n    try {\n      await new Promise((resolve) => setTimeout(resolve, 800))\n      const win = window as any\n      const token = await win.grecaptcha.enterprise.execute(siteKey, { action: 'submit' })\n      return token || null\n    } catch (retryErr) {\n      console.warn('[site-kit reCAPTCHA]', retryErr)\n      return null\n    }\n  }\n}\n","/**\n * Reads the visitor's GA4 identity out of their own first-party cookies so a\n * lead conversion can be reported SERVER-side.\n *\n * Why the server has to do the reporting: Sonor's form-submit endpoint answers\n * with a byte-identical success payload whether it accepted a submission or\n * quarantined it as spam (deliberately — a bot must never learn it was\n * caught). So the browser cannot tell a real lead from a filtered one, and a\n * site firing its own ad conversion bills both. The accept/reject verdict only\n * exists on the server, so the conversion has to be sent from there — and to\n * send it, the server needs the GA4 identity that only the browser can see.\n *\n * Nothing here is a new identifier: these are cookies Google's own tag already\n * set on this visitor. We read them, we never write them.\n */\n\nexport interface Ga4Identity {\n  /** GA4 client id, from `_ga`. Without it a server-sent event has no identity. */\n  gaClientId?: string\n  /**\n   * GA4 session ids keyed by container id (the measurement id minus `G-`), from\n   * the `_ga_<CONTAINER>` cookies.\n   *\n   * A map rather than one value because a page may carry more than one GA4\n   * property, and picking the wrong one would silently attach the lead to the\n   * wrong session — the sender knows which measurement id it is configured for,\n   * this side does not.\n   */\n  gaSessions?: Record<string, string>\n}\n\nfunction readCookie(jar: string, name: string): string | undefined {\n  const escaped = name.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')\n  const match = jar.match(new RegExp(`(?:^|;\\\\s*)${escaped}=([^;]*)`))\n  return match ? decodeURIComponent(match[1]) : undefined\n}\n\nexport function readGa4Identity(): Ga4Identity {\n  if (typeof document === 'undefined') return {}\n  const jar = document.cookie || ''\n  if (!jar) return {}\n\n  const identity: Ga4Identity = {}\n\n  // `_ga` is `GA1.<depth>.<id1>.<id2>`; the client id is the last two parts\n  // joined. Reading the raw cookie rather than the trailing two segments\n  // blindly keeps it correct when the depth prefix varies by domain scope.\n  const ga = readCookie(jar, '_ga')\n  if (ga) {\n    const parts = ga.split('.')\n    if (parts.length >= 4) {\n      const clientId = `${parts[parts.length - 2]}.${parts[parts.length - 1]}`\n      if (/^\\d+\\.\\d+$/.test(clientId)) identity.gaClientId = clientId\n    }\n  }\n\n  // `_ga_<CONTAINER>` is `GS<v>.<depth>.<session_id>.<session_number>....`\n  const sessions: Record<string, string> = {}\n  for (const raw of jar.split(';')) {\n    const cookie = raw.trim()\n    const eq = cookie.indexOf('=')\n    if (eq < 0) continue\n    const name = cookie.slice(0, eq)\n    const container = /^_ga_([A-Z0-9]+)$/i.exec(name)?.[1]\n    if (!container) continue\n    const parts = decodeURIComponent(cookie.slice(eq + 1)).split('.')\n    if (parts.length >= 3 && /^\\d+$/.test(parts[2])) sessions[container] = parts[2]\n  }\n  if (Object.keys(sessions).length > 0) identity.gaSessions = sessions\n\n  return identity\n}\n","/**\n * @sonordev/site-kit/forms - Shared submission logic\n *\n * Single source of truth for sending a managed form to the Sonor API. Both\n * <ManagedForm> (via FormClient) and the headless useForm() hook submit through\n * here, so the request shape, retry behaviour, reCAPTCHA handling, and error\n * parsing can never drift between the two paths.\n */\n\nimport { sonorFetch } from '../shared/sonorFetch'\nimport { getRecaptchaToken } from './recaptcha'\nimport { DEFAULT_HONEYPOT_FIELD } from './contract'\nimport { readGa4Identity } from './ga4-identity'\nimport type { ManagedFormConfig } from './types'\n\n// The honeypot trap-field name lives once in the shared forms contract\n// (single source of truth for site-kit's client + sonor-api's intake).\n// Re-exported so existing importers of this path keep resolving it.\nexport { DEFAULT_HONEYPOT_FIELD }\n\nexport function getApiConfig(): { apiUrl: string; apiKey: string | undefined } {\n  // Server branch must honor the same env override SiteKitLayout feeds into\n  // __SITE_KIT_API_URL__, or SSR-rendered absolute URLs (the native form\n  // action) would point at prod from a staging site.\n  const apiUrl =\n    typeof window !== 'undefined'\n      ? (window as any).__SITE_KIT_API_URL__ || 'https://api.sonor.io'\n      : process.env.SONOR_API_URL || process.env.NEXT_PUBLIC_SONOR_API_URL || 'https://api.sonor.io'\n  const apiKey =\n    typeof window !== 'undefined' ? (window as any).__SITE_KIT_API_KEY__ : undefined\n  return { apiUrl, apiKey }\n}\n\nfunction getUTMParams(): Record<string, string | null> {\n  if (typeof window === 'undefined') return {}\n  const params = new URLSearchParams(window.location.search)\n  const out: Record<string, string | null> = {}\n  for (const key of ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content']) {\n    out[key] = params.get(key)\n  }\n  return out\n}\n\nexport interface SubmitFormArgs {\n  config: ManagedFormConfig\n  /**\n   * Field values to submit. The caller must pass VISIBLE values only —\n   * conditionally-hidden fields should be excluded so stale values are not sent.\n   */\n  values: Record<string, unknown>\n  /** Honeypot input value (empty string for the headless hook, which has no honeypot UI). */\n  honeypotValue: string\n  /** Timestamp (ms) the form was first rendered — a weak anti-bot timing signal. */\n  formLoadedAt: number\n}\n\n/**\n * Submit a managed form. Throws on failure (network, timeout, or a non-2xx\n * response) with a human-readable message; resolves with the parsed API\n * response on success.\n */\nexport async function submitForm({\n  config,\n  values,\n  honeypotValue,\n  formLoadedAt,\n}: SubmitFormArgs): Promise<unknown> {\n  const { apiUrl, apiKey } = getApiConfig()\n  if (!apiKey) {\n    throw new Error('API key is required. Set SONOR_API_KEY in your environment.')\n  }\n\n  // reCAPTCHA token is fetched right before the POST so it cannot expire.\n  const recaptchaToken = config.recaptcha_enabled\n    ? await getRecaptchaToken(config.recaptcha_site_key)\n    : null\n  if (config.recaptcha_enabled && !recaptchaToken) {\n    throw new Error('Verification could not be completed. Please try again.')\n  }\n\n  const honeypotFieldName = config.honeypot_field || DEFAULT_HONEYPOT_FIELD\n  const utm = getUTMParams()\n  // The visitor's existing GA4 cookies, so Sonor can report an accepted lead\n  // as a conversion server-side. Nothing is written or created here — see\n  // ga4-identity.ts for why the server, not this browser, has to do it.\n  const ga4 = readGa4Identity()\n\n  const payload = {\n    formId: config.id,\n    form_id: config.id,\n    data: {\n      ...values,\n      ...(config.honeypot_enabled ? { [honeypotFieldName]: honeypotValue } : {}),\n    },\n    metadata: {\n      pageUrl: typeof window !== 'undefined' ? window.location.href : null,\n      referrer: typeof document !== 'undefined' ? document.referrer || null : null,\n      userAgent: typeof navigator !== 'undefined' ? navigator.userAgent : null,\n      sessionId:\n        typeof sessionStorage !== 'undefined' ? sessionStorage.getItem('_sk_sid') : null,\n      // Anonymous visitor id (_sk_vid) — the same id Analytics/Signal stamp on\n      // page views, so the Sonor side can bind this lead to its browsing session\n      // (page -> lead attribution). Sent on every submission; null pre-hydration.\n      visitorId:\n        typeof localStorage !== 'undefined' ? localStorage.getItem('_sk_vid') : null,\n      recaptchaToken: recaptchaToken || undefined,\n      utmSource: utm.utm_source,\n      utmMedium: utm.utm_medium,\n      utmCampaign: utm.utm_campaign,\n      utmTerm: utm.utm_term,\n      utmContent: utm.utm_content,\n      ...ga4,\n      // Sub-site host — preserved on form_submissions for lead attribution\n      // across multi-site projects. Resolved by SiteKitClientProviders.\n      site:\n        typeof window !== 'undefined'\n          ? (window as { __SITE_KIT_SITE__?: string }).__SITE_KIT_SITE__ ||\n            window.location.host\n          : undefined,\n      _formLoadedAt: formLoadedAt,\n    },\n  }\n\n  const response = await sonorFetch(\n    `${apiUrl}/api/public/forms/submit`,\n    {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${apiKey}`,\n      },\n      body: JSON.stringify(payload),\n    },\n    { retries: 2, timeoutMs: 20000 },\n  )\n\n  const data = await response.json().catch(() => null)\n\n  if (!response.ok) {\n    const msg = (\n      data?.message ??\n      data?.error ??\n      (response.statusText || `HTTP ${response.status}`)\n    )\n      .toString()\n      .trim()\n    throw new Error(\n      msg ? `Failed to submit form: ${msg}` : `Failed to submit form (${response.status})`,\n    )\n  }\n\n  return data\n}\n"]}

package/dist/{chunk-TMNFPVK5.js → chunk-JAA42HR7.js}

@@ -4,8 +4,8 @@
 var chunk7THQ4UW3_js = require('./chunk-7THQ4UW3.js');
 var chunkHGNSJXWT_js = require('./chunk-HGNSJXWT.js');
 var chunk5RNAUYWE_js = require('./chunk-5RNAUYWE.js');
-var chunkZQJGCQHC_js = require('./chunk-ZQJGCQHC.js');
-var chunkOXA4ZSX2_js = require('./chunk-OXA4ZSX2.js');
+var chunkIWHAJBYL_js = require('./chunk-IWHAJBYL.js');
+var chunkOI3FCJSP_js = require('./chunk-OI3FCJSP.js');
 var react = require('react');
 
 // src/fleet/heartbeat.ts
@@ -21,14 +21,14 @@ async function sendFleetHeartbeat(opts) {
   const target = chunk5RNAUYWE_js.resolveAnalyticsTarget(opts);
   if (!target) return false;
   const payload = chunk7THQ4UW3_js.buildFleetHeartbeatPayload({
-    kitVersion: opts.kitVersion || chunkOXA4ZSX2_js.SITE_KIT_VERSION,
+    kitVersion: opts.kitVersion || chunkOI3FCJSP_js.SITE_KIT_VERSION,
     nextVersion: opts.nextVersion,
     modules: opts.modules,
     site: opts.site,
     source: opts.source
   });
   try {
-    const res = await chunkZQJGCQHC_js.sonorFetch(
+    const res = await chunkIWHAJBYL_js.sonorFetch(
       `${target.apiUrl.replace(/\/$/, "")}${FLEET_HEARTBEAT_PATH}`,
       {
         method: "POST",
@@ -72,7 +72,7 @@ function FleetHeartbeat({
     const { apiUrl: url, apiKey: key } = target;
     const resolvedSite = site ?? w.__SITE_KIT_SITE__ ?? window.location.host ?? "";
     if (oncePerSession) {
-      const stamp = `${chunkOXA4ZSX2_js.SITE_KIT_VERSION}:${resolvedSite}`;
+      const stamp = `${chunkOI3FCJSP_js.SITE_KIT_VERSION}:${resolvedSite}`;
       try {
         if (sessionStorage.getItem(SESSION_GUARD_KEY) === stamp) {
           sentRef.current = true;
@@ -102,5 +102,5 @@ exports.FLEET_HEARTBEAT_PATH = FLEET_HEARTBEAT_PATH;
 exports.FleetHeartbeat = FleetHeartbeat;
 exports.detectNextVersion = detectNextVersion;
 exports.sendFleetHeartbeat = sendFleetHeartbeat;
-//# sourceMappingURL=chunk-TMNFPVK5.js.map
-//# sourceMappingURL=chunk-TMNFPVK5.js.map
+//# sourceMappingURL=chunk-JAA42HR7.js.map
+//# sourceMappingURL=chunk-JAA42HR7.js.map

package/dist/{chunk-TMNFPVK5.js.map → chunk-JAA42HR7.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/fleet/heartbeat.ts","../src/fleet/FleetHeartbeat.tsx"],"names":["sanitizeFleetVersion","resolveAnalyticsTarget","buildFleetHeartbeatPayload","SITE_KIT_VERSION","sonorFetch","useDeferredActivation","useRef","useEffect"],"mappings":";;;;;;;;;;AAwBO,IAAM,oBAAA,GAAuB;AA4B7B,SAAS,iBAAA,GAAmC;AACjD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,MAAM,CAAA,GAAI,MAAA;AAIV,EAAA,OAAOA,sCAAqB,CAAA,CAAE,yBAAA,IAA6B,CAAA,CAAE,IAAA,EAAM,WAAW,IAAI,CAAA;AACpF;AAOA,eAAsB,mBAAmB,IAAA,EAAmD;AAC1F,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,IAAA;AAC3B,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,MAAA,EAAQ,OAAO,KAAA;AAC/B,EAAA,MAAM,MAAA,GAASC,wCAAuB,IAAI,CAAA;AAC1C,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AAEpB,EAAA,MAAM,UAAiCC,2CAAA,CAA2B;AAAA,IAChE,UAAA,EAAY,KAAK,UAAA,IAAcC,iCAAA;AAAA,IAC/B,aAAa,IAAA,CAAK,WAAA;AAAA,IAClB,SAAS,IAAA,CAAK,OAAA;AAAA,IACd,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,QAAQ,IAAA,CAAK;AAAA,GACd,CAAA;AAED,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAMC,2BAAA;AAAA,MAChB,CAAA,EAAG,OAAO,MAAA,CAAO,OAAA,CAAQ,OAAO,EAAE,CAAC,GAAG,oBAAoB,CAAA,CAAA;AAAA,MAC1D;AAAA,QACE,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,QAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAO;AAAA,OAC9B;AAAA,MACA,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAQ,SAAS,CAAA;AAAE,KACtC;AACA,IAAA,IAAI,KAAK,KAAA,EAAO;AAEd,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,wBAAA,EAA2B,GAAA,CAAI,MAAM,CAAA,EAAA,EAAK,OAAA,CAAQ,WAAW,CAAA,EAAA,EAAK,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA,IAAK,MAAM,CAAA,CAAA;AAAA,OACvG;AAAA,IACF;AACA,IAAA,OAAO,GAAA,CAAI,EAAA;AAAA,EACb,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,IAAA,CAAK,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,6CAA6C,GAAG,CAAA;AAC7E,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AC3EA,IAAM,iBAAA,GAAoB,cAAA;AAuBnB,SAAS,cAAA,CAAe;AAAA,EAC7B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,IAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,KAAA,GAAQ,IAAA;AAAA,EACR,cAAA,GAAiB,IAAA;AAAA,EACjB,KAAA,GAAQ,KAAA;AAAA,EACR,YAAA,GAAe,KAAA;AAAA,EACf,cAAA,GAAiB;AACnB,CAAA,EAAwB;AACtB,EAAA,MAAM,KAAA,GAAQC,uCAAsB,KAAK,CAAA;AACzC,EAAA,MAAM,OAAA,GAAUC,aAAO,KAAK,CAAA;AAE5B,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,KAAA,IAAS,OAAA,CAAQ,OAAA,EAAS;AAC/B,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAEnC,IAAA,MAAM,CAAA,GAAI,MAAA;AAKV,IAAA,MAAM,MAAA,GAASN,wCAAuB,EAAE,MAAA,EAAQ,QAAQ,YAAA,EAAc,cAAA,EAAgB,OAAO,CAAA;AAC7F,IAAA,IAAI,CAAC,MAAA,EAAQ;AACb,IAAA,MAAM,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAA,EAAQ,KAAI,GAAI,MAAA;AAErC,IAAA,MAAM,eAAe,IAAA,IAAQ,CAAA,CAAE,iBAAA,IAAqB,MAAA,CAAO,SAAS,IAAA,IAAQ,EAAA;AAK5E,IAAA,IAAI,cAAA,EAAgB;AAClB,MAAA,MAAM,KAAA,GAAQ,CAAA,EAAGE,iCAAgB,CAAA,CAAA,EAAI,YAAY,CAAA,CAAA;AACjD,MAAA,IAAI;AACF,QAAA,IAAI,cAAA,CAAe,OAAA,CAAQ,iBAAiB,CAAA,KAAM,KAAA,EAAO;AACvD,UAAA,OAAA,CAAQ,OAAA,GAAU,IAAA;AAClB,UAAA;AAAA,QACF;AACA,QAAA,cAAA,CAAe,OAAA,CAAQ,mBAAmB,KAAK,CAAA;AAAA,MACjD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAEA,IAAA,OAAA,CAAQ,OAAA,GAAU,IAAA;AAClB,IAAA,KAAK,kBAAA,CAAmB;AAAA,MACtB,MAAA,EAAQ,GAAA;AAAA,MACR,MAAA,EAAQ,GAAA;AAAA,MACR,IAAA,EAAM,YAAA;AAAA,MACN,OAAA;AAAA,MACA,WAAA,EAAa,eAAe,iBAAA,EAAkB;AAAA,MAC9C,MAAA,EAAQ,QAAA;AAAA,MACR,YAAA;AAAA,MACA,cAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH,CAAA,EAAG,CAAC,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,WAAA,EAAa,cAAA,EAAgB,KAAA,EAAO,YAAA,EAAc,cAAc,CAAC,CAAA;AAE3G,EAAA,OAAO,IAAA;AACT","file":"chunk-TMNFPVK5.js","sourcesContent":["/**\n * @sonordev/site-kit/fleet — heartbeat sender (single source of truth for the POST)\n *\n * One place that turns fleet inputs into a validated payload and ships it to\n * `/api/public/fleet/heartbeat`. Used by BOTH the client component\n * (FleetHeartbeat) and any build-time caller, so the send path never forks.\n *\n * It routes through the shared analytics send gate and `sonorFetch`, which stamps\n * the x-sitekit-version header, attaches x-api-key, and honors the auth\n * circuit breaker — a site on a stale/canceled key will not spam the API.\n */\n\nimport { resolveAnalyticsTarget, type AnalyticsGateOptions } from '../shared/reporting-gate'\nimport { sonorFetch } from '../shared/sonorFetch'\nimport { SITE_KIT_VERSION } from '../shared/version'\nimport {\n  buildFleetHeartbeatPayload,\n  sanitizeFleetVersion,\n  type FleetHeartbeatPayload,\n  type FleetHeartbeatSource,\n  type FleetModule,\n} from './contract'\n\n/** Canonical ingest path — resolved against the site's Sonor API origin. */\nexport const FLEET_HEARTBEAT_PATH = '/api/public/fleet/heartbeat'\n\nexport interface SendFleetHeartbeatOptions extends AnalyticsGateOptions {\n  /** Sonor API origin (e.g. https://api.sonor.io). Trailing slash tolerated. */\n  apiUrl: string\n  /** Project API key — scopes the request; the project is resolved server-side. */\n  apiKey: string\n  /** Client-observable active modules (validated/deduped by the contract). */\n  modules?: FleetModule[] | string[]\n  /** Normalized host for the multi-site sub-dimension (server re-normalizes). */\n  site?: string | null\n  /** Installed Next.js version, if the caller can resolve it. */\n  nextVersion?: string | null\n  /** 'client' (runtime boot) or 'build' (CI). Default 'client'. */\n  source?: FleetHeartbeatSource\n  /** Override the reported kit version. Defaults to the runtime SITE_KIT_VERSION. */\n  kitVersion?: string\n  /** Log one info line with the result. Never logs at error level. */\n  debug?: boolean\n}\n\n/**\n * Best-effort runtime detection of the host Next.js version. Unreliable by\n * design — Next does not expose its version consistently across app/pages\n * router — so it returns null unless a site injects `__SITE_KIT_NEXT_VERSION__`\n * or `window.next.version` is present. Build-time callers should pass\n * `nextVersion` explicitly (resolvable from `next/package.json`).\n */\nexport function detectNextVersion(): string | null {\n  if (typeof window === 'undefined') return null\n  const w = window as unknown as {\n    __SITE_KIT_NEXT_VERSION__?: string\n    next?: { version?: string }\n  }\n  return sanitizeFleetVersion(w.__SITE_KIT_NEXT_VERSION__ ?? w.next?.version ?? null)\n}\n\n/**\n * Fire one heartbeat. Fire-and-forget by contract: it never throws — a\n * telemetry POST must never break a visitor's page or a site's build. Returns\n * true only when the POST was accepted (2xx).\n */\nexport async function sendFleetHeartbeat(opts: SendFleetHeartbeatOptions): Promise<boolean> {\n  const { apiUrl, apiKey } = opts\n  if (!apiUrl || !apiKey) return false\n  const target = resolveAnalyticsTarget(opts)\n  if (!target) return false\n\n  const payload: FleetHeartbeatPayload = buildFleetHeartbeatPayload({\n    kitVersion: opts.kitVersion || SITE_KIT_VERSION,\n    nextVersion: opts.nextVersion,\n    modules: opts.modules,\n    site: opts.site,\n    source: opts.source,\n  })\n\n  try {\n    const res = await sonorFetch(\n      `${target.apiUrl.replace(/\\/$/, '')}${FLEET_HEARTBEAT_PATH}`,\n      {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(payload),\n      },\n      { apiKey: target.apiKey, retries: 0 },\n    )\n    if (opts.debug) {\n      // info, never error: a visitor's console must stay clean (Lighthouse).\n      console.info(\n        `[Sonor fleet] heartbeat ${res.status} v${payload.kit_version} [${payload.modules.join(',') || 'none'}]`,\n      )\n    }\n    return res.ok\n  } catch (err) {\n    if (opts.debug) console.info('[Sonor fleet] heartbeat skipped (network)', err)\n    return false\n  }\n}\n","/**\n * @sonordev/site-kit/fleet — FleetHeartbeat\n *\n * A childless, effect-only client component that reports this site's build\n * fingerprint (kit version, Next.js version, active modules, host) to Sonor\n * exactly once per browser session. It exists so the platform can answer\n * \"which version / modules / key state is each site running\" without shelling\n * into every client repo.\n *\n * It is mounted as a deferred, CHILDLESS SIBLING — never a wrapper — by\n * SiteKitClientProviders, behind the same idle/first-interaction gate as\n * Analytics and Engage, so it never enters the critical hydration path (see\n * CLAUDE.md \"the page must server-render\"). It renders null and carries no\n * visitor data.\n */\n\n'use client'\n\nimport { useEffect, useRef } from 'react'\nimport { useDeferredActivation } from '../shared/defer'\nimport { SITE_KIT_VERSION } from '../shared/version'\nimport { detectNextVersion, sendFleetHeartbeat } from './heartbeat'\nimport { resolveAnalyticsTarget, type AnalyticsGateOptions } from '../shared/reporting-gate'\nimport type { FleetModule } from './contract'\n\n/** Session guard key — one heartbeat per session, re-sent when version/host changes. */\nconst SESSION_GUARD_KEY = '_sk_fleet_hb'\n\nexport interface FleetHeartbeatProps extends AnalyticsGateOptions {\n  /** Sonor API origin. Falls back to `window.__SITE_KIT_API_URL__` then api.sonor.io. */\n  apiUrl?: string\n  /** Project API key. Falls back to `window.__SITE_KIT_API_KEY__`. */\n  apiKey?: string\n  /** Host for the multi-site sub-dimension. Falls back to `__SITE_KIT_SITE__` then location.host. */\n  site?: string | null\n  /** Client-observable active modules (SiteKitClientProviders passes the enabled set). */\n  modules?: FleetModule[]\n  /** Installed Next.js version if known; otherwise best-effort runtime detection. */\n  nextVersion?: string | null\n  /**\n   * Self-defer to idle / first interaction. Default true so standalone use is\n   * safe. SiteKitClientProviders already gates the mount and passes false.\n   */\n  defer?: boolean\n  /** Send at most once per browser session per (version, host). Default true. */\n  oncePerSession?: boolean\n  debug?: boolean\n}\n\nexport function FleetHeartbeat({\n  apiUrl,\n  apiKey,\n  site,\n  modules,\n  nextVersion,\n  defer = true,\n  oncePerSession = true,\n  debug = false,\n  allowInFrame = false,\n  allowLocalhost = false,\n}: FleetHeartbeatProps) {\n  const ready = useDeferredActivation(defer)\n  const sentRef = useRef(false)\n\n  useEffect(() => {\n    if (!ready || sentRef.current) return\n    if (typeof window === 'undefined') return\n\n    const w = window as unknown as {\n      __SITE_KIT_API_URL__?: string\n      __SITE_KIT_API_KEY__?: string\n      __SITE_KIT_SITE__?: string\n    }\n    const target = resolveAnalyticsTarget({ apiUrl, apiKey, allowInFrame, allowLocalhost, debug })\n    if (!target) return // Gate before stamping session storage.\n    const { apiUrl: url, apiKey: key } = target\n\n    const resolvedSite = site ?? w.__SITE_KIT_SITE__ ?? window.location.host ?? ''\n\n    // Once-per-session-per-(version,host): keeps heartbeat volume to one POST\n    // per visitor session while still re-reporting after an upgrade or on a\n    // different sub-site. Storage-disabled browsers simply send once per load.\n    if (oncePerSession) {\n      const stamp = `${SITE_KIT_VERSION}:${resolvedSite}`\n      try {\n        if (sessionStorage.getItem(SESSION_GUARD_KEY) === stamp) {\n          sentRef.current = true\n          return\n        }\n        sessionStorage.setItem(SESSION_GUARD_KEY, stamp)\n      } catch {\n        /* storage unavailable — fall through and send this load */\n      }\n    }\n\n    sentRef.current = true\n    void sendFleetHeartbeat({\n      apiUrl: url,\n      apiKey: key,\n      site: resolvedSite,\n      modules,\n      nextVersion: nextVersion ?? detectNextVersion(),\n      source: 'client',\n      allowInFrame,\n      allowLocalhost,\n      debug,\n    })\n  }, [ready, apiUrl, apiKey, site, modules, nextVersion, oncePerSession, debug, allowInFrame, allowLocalhost])\n\n  return null\n}\n"]}
+{"version":3,"sources":["../src/fleet/heartbeat.ts","../src/fleet/FleetHeartbeat.tsx"],"names":["sanitizeFleetVersion","resolveAnalyticsTarget","buildFleetHeartbeatPayload","SITE_KIT_VERSION","sonorFetch","useDeferredActivation","useRef","useEffect"],"mappings":";;;;;;;;;;AAwBO,IAAM,oBAAA,GAAuB;AA4B7B,SAAS,iBAAA,GAAmC;AACjD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,MAAM,CAAA,GAAI,MAAA;AAIV,EAAA,OAAOA,sCAAqB,CAAA,CAAE,yBAAA,IAA6B,CAAA,CAAE,IAAA,EAAM,WAAW,IAAI,CAAA;AACpF;AAOA,eAAsB,mBAAmB,IAAA,EAAmD;AAC1F,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,IAAA;AAC3B,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,MAAA,EAAQ,OAAO,KAAA;AAC/B,EAAA,MAAM,MAAA,GAASC,wCAAuB,IAAI,CAAA;AAC1C,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AAEpB,EAAA,MAAM,UAAiCC,2CAAA,CAA2B;AAAA,IAChE,UAAA,EAAY,KAAK,UAAA,IAAcC,iCAAA;AAAA,IAC/B,aAAa,IAAA,CAAK,WAAA;AAAA,IAClB,SAAS,IAAA,CAAK,OAAA;AAAA,IACd,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,QAAQ,IAAA,CAAK;AAAA,GACd,CAAA;AAED,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAMC,2BAAA;AAAA,MAChB,CAAA,EAAG,OAAO,MAAA,CAAO,OAAA,CAAQ,OAAO,EAAE,CAAC,GAAG,oBAAoB,CAAA,CAAA;AAAA,MAC1D;AAAA,QACE,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,QAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAO;AAAA,OAC9B;AAAA,MACA,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAQ,SAAS,CAAA;AAAE,KACtC;AACA,IAAA,IAAI,KAAK,KAAA,EAAO;AAEd,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,wBAAA,EAA2B,GAAA,CAAI,MAAM,CAAA,EAAA,EAAK,OAAA,CAAQ,WAAW,CAAA,EAAA,EAAK,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA,IAAK,MAAM,CAAA,CAAA;AAAA,OACvG;AAAA,IACF;AACA,IAAA,OAAO,GAAA,CAAI,EAAA;AAAA,EACb,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,IAAA,CAAK,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,6CAA6C,GAAG,CAAA;AAC7E,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AC3EA,IAAM,iBAAA,GAAoB,cAAA;AAuBnB,SAAS,cAAA,CAAe;AAAA,EAC7B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,IAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,KAAA,GAAQ,IAAA;AAAA,EACR,cAAA,GAAiB,IAAA;AAAA,EACjB,KAAA,GAAQ,KAAA;AAAA,EACR,YAAA,GAAe,KAAA;AAAA,EACf,cAAA,GAAiB;AACnB,CAAA,EAAwB;AACtB,EAAA,MAAM,KAAA,GAAQC,uCAAsB,KAAK,CAAA;AACzC,EAAA,MAAM,OAAA,GAAUC,aAAO,KAAK,CAAA;AAE5B,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,KAAA,IAAS,OAAA,CAAQ,OAAA,EAAS;AAC/B,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAEnC,IAAA,MAAM,CAAA,GAAI,MAAA;AAKV,IAAA,MAAM,MAAA,GAASN,wCAAuB,EAAE,MAAA,EAAQ,QAAQ,YAAA,EAAc,cAAA,EAAgB,OAAO,CAAA;AAC7F,IAAA,IAAI,CAAC,MAAA,EAAQ;AACb,IAAA,MAAM,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAA,EAAQ,KAAI,GAAI,MAAA;AAErC,IAAA,MAAM,eAAe,IAAA,IAAQ,CAAA,CAAE,iBAAA,IAAqB,MAAA,CAAO,SAAS,IAAA,IAAQ,EAAA;AAK5E,IAAA,IAAI,cAAA,EAAgB;AAClB,MAAA,MAAM,KAAA,GAAQ,CAAA,EAAGE,iCAAgB,CAAA,CAAA,EAAI,YAAY,CAAA,CAAA;AACjD,MAAA,IAAI;AACF,QAAA,IAAI,cAAA,CAAe,OAAA,CAAQ,iBAAiB,CAAA,KAAM,KAAA,EAAO;AACvD,UAAA,OAAA,CAAQ,OAAA,GAAU,IAAA;AAClB,UAAA;AAAA,QACF;AACA,QAAA,cAAA,CAAe,OAAA,CAAQ,mBAAmB,KAAK,CAAA;AAAA,MACjD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAEA,IAAA,OAAA,CAAQ,OAAA,GAAU,IAAA;AAClB,IAAA,KAAK,kBAAA,CAAmB;AAAA,MACtB,MAAA,EAAQ,GAAA;AAAA,MACR,MAAA,EAAQ,GAAA;AAAA,MACR,IAAA,EAAM,YAAA;AAAA,MACN,OAAA;AAAA,MACA,WAAA,EAAa,eAAe,iBAAA,EAAkB;AAAA,MAC9C,MAAA,EAAQ,QAAA;AAAA,MACR,YAAA;AAAA,MACA,cAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH,CAAA,EAAG,CAAC,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,WAAA,EAAa,cAAA,EAAgB,KAAA,EAAO,YAAA,EAAc,cAAc,CAAC,CAAA;AAE3G,EAAA,OAAO,IAAA;AACT","file":"chunk-JAA42HR7.js","sourcesContent":["/**\n * @sonordev/site-kit/fleet — heartbeat sender (single source of truth for the POST)\n *\n * One place that turns fleet inputs into a validated payload and ships it to\n * `/api/public/fleet/heartbeat`. Used by BOTH the client component\n * (FleetHeartbeat) and any build-time caller, so the send path never forks.\n *\n * It routes through the shared analytics send gate and `sonorFetch`, which stamps\n * the x-sitekit-version header, attaches x-api-key, and honors the auth\n * circuit breaker — a site on a stale/canceled key will not spam the API.\n */\n\nimport { resolveAnalyticsTarget, type AnalyticsGateOptions } from '../shared/reporting-gate'\nimport { sonorFetch } from '../shared/sonorFetch'\nimport { SITE_KIT_VERSION } from '../shared/version'\nimport {\n  buildFleetHeartbeatPayload,\n  sanitizeFleetVersion,\n  type FleetHeartbeatPayload,\n  type FleetHeartbeatSource,\n  type FleetModule,\n} from './contract'\n\n/** Canonical ingest path — resolved against the site's Sonor API origin. */\nexport const FLEET_HEARTBEAT_PATH = '/api/public/fleet/heartbeat'\n\nexport interface SendFleetHeartbeatOptions extends AnalyticsGateOptions {\n  /** Sonor API origin (e.g. https://api.sonor.io). Trailing slash tolerated. */\n  apiUrl: string\n  /** Project API key — scopes the request; the project is resolved server-side. */\n  apiKey: string\n  /** Client-observable active modules (validated/deduped by the contract). */\n  modules?: FleetModule[] | string[]\n  /** Normalized host for the multi-site sub-dimension (server re-normalizes). */\n  site?: string | null\n  /** Installed Next.js version, if the caller can resolve it. */\n  nextVersion?: string | null\n  /** 'client' (runtime boot) or 'build' (CI). Default 'client'. */\n  source?: FleetHeartbeatSource\n  /** Override the reported kit version. Defaults to the runtime SITE_KIT_VERSION. */\n  kitVersion?: string\n  /** Log one info line with the result. Never logs at error level. */\n  debug?: boolean\n}\n\n/**\n * Best-effort runtime detection of the host Next.js version. Unreliable by\n * design — Next does not expose its version consistently across app/pages\n * router — so it returns null unless a site injects `__SITE_KIT_NEXT_VERSION__`\n * or `window.next.version` is present. Build-time callers should pass\n * `nextVersion` explicitly (resolvable from `next/package.json`).\n */\nexport function detectNextVersion(): string | null {\n  if (typeof window === 'undefined') return null\n  const w = window as unknown as {\n    __SITE_KIT_NEXT_VERSION__?: string\n    next?: { version?: string }\n  }\n  return sanitizeFleetVersion(w.__SITE_KIT_NEXT_VERSION__ ?? w.next?.version ?? null)\n}\n\n/**\n * Fire one heartbeat. Fire-and-forget by contract: it never throws — a\n * telemetry POST must never break a visitor's page or a site's build. Returns\n * true only when the POST was accepted (2xx).\n */\nexport async function sendFleetHeartbeat(opts: SendFleetHeartbeatOptions): Promise<boolean> {\n  const { apiUrl, apiKey } = opts\n  if (!apiUrl || !apiKey) return false\n  const target = resolveAnalyticsTarget(opts)\n  if (!target) return false\n\n  const payload: FleetHeartbeatPayload = buildFleetHeartbeatPayload({\n    kitVersion: opts.kitVersion || SITE_KIT_VERSION,\n    nextVersion: opts.nextVersion,\n    modules: opts.modules,\n    site: opts.site,\n    source: opts.source,\n  })\n\n  try {\n    const res = await sonorFetch(\n      `${target.apiUrl.replace(/\\/$/, '')}${FLEET_HEARTBEAT_PATH}`,\n      {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(payload),\n      },\n      { apiKey: target.apiKey, retries: 0 },\n    )\n    if (opts.debug) {\n      // info, never error: a visitor's console must stay clean (Lighthouse).\n      console.info(\n        `[Sonor fleet] heartbeat ${res.status} v${payload.kit_version} [${payload.modules.join(',') || 'none'}]`,\n      )\n    }\n    return res.ok\n  } catch (err) {\n    if (opts.debug) console.info('[Sonor fleet] heartbeat skipped (network)', err)\n    return false\n  }\n}\n","/**\n * @sonordev/site-kit/fleet — FleetHeartbeat\n *\n * A childless, effect-only client component that reports this site's build\n * fingerprint (kit version, Next.js version, active modules, host) to Sonor\n * exactly once per browser session. It exists so the platform can answer\n * \"which version / modules / key state is each site running\" without shelling\n * into every client repo.\n *\n * It is mounted as a deferred, CHILDLESS SIBLING — never a wrapper — by\n * SiteKitClientProviders, behind the same idle/first-interaction gate as\n * Analytics and Engage, so it never enters the critical hydration path (see\n * CLAUDE.md \"the page must server-render\"). It renders null and carries no\n * visitor data.\n */\n\n'use client'\n\nimport { useEffect, useRef } from 'react'\nimport { useDeferredActivation } from '../shared/defer'\nimport { SITE_KIT_VERSION } from '../shared/version'\nimport { detectNextVersion, sendFleetHeartbeat } from './heartbeat'\nimport { resolveAnalyticsTarget, type AnalyticsGateOptions } from '../shared/reporting-gate'\nimport type { FleetModule } from './contract'\n\n/** Session guard key — one heartbeat per session, re-sent when version/host changes. */\nconst SESSION_GUARD_KEY = '_sk_fleet_hb'\n\nexport interface FleetHeartbeatProps extends AnalyticsGateOptions {\n  /** Sonor API origin. Falls back to `window.__SITE_KIT_API_URL__` then api.sonor.io. */\n  apiUrl?: string\n  /** Project API key. Falls back to `window.__SITE_KIT_API_KEY__`. */\n  apiKey?: string\n  /** Host for the multi-site sub-dimension. Falls back to `__SITE_KIT_SITE__` then location.host. */\n  site?: string | null\n  /** Client-observable active modules (SiteKitClientProviders passes the enabled set). */\n  modules?: FleetModule[]\n  /** Installed Next.js version if known; otherwise best-effort runtime detection. */\n  nextVersion?: string | null\n  /**\n   * Self-defer to idle / first interaction. Default true so standalone use is\n   * safe. SiteKitClientProviders already gates the mount and passes false.\n   */\n  defer?: boolean\n  /** Send at most once per browser session per (version, host). Default true. */\n  oncePerSession?: boolean\n  debug?: boolean\n}\n\nexport function FleetHeartbeat({\n  apiUrl,\n  apiKey,\n  site,\n  modules,\n  nextVersion,\n  defer = true,\n  oncePerSession = true,\n  debug = false,\n  allowInFrame = false,\n  allowLocalhost = false,\n}: FleetHeartbeatProps) {\n  const ready = useDeferredActivation(defer)\n  const sentRef = useRef(false)\n\n  useEffect(() => {\n    if (!ready || sentRef.current) return\n    if (typeof window === 'undefined') return\n\n    const w = window as unknown as {\n      __SITE_KIT_API_URL__?: string\n      __SITE_KIT_API_KEY__?: string\n      __SITE_KIT_SITE__?: string\n    }\n    const target = resolveAnalyticsTarget({ apiUrl, apiKey, allowInFrame, allowLocalhost, debug })\n    if (!target) return // Gate before stamping session storage.\n    const { apiUrl: url, apiKey: key } = target\n\n    const resolvedSite = site ?? w.__SITE_KIT_SITE__ ?? window.location.host ?? ''\n\n    // Once-per-session-per-(version,host): keeps heartbeat volume to one POST\n    // per visitor session while still re-reporting after an upgrade or on a\n    // different sub-site. Storage-disabled browsers simply send once per load.\n    if (oncePerSession) {\n      const stamp = `${SITE_KIT_VERSION}:${resolvedSite}`\n      try {\n        if (sessionStorage.getItem(SESSION_GUARD_KEY) === stamp) {\n          sentRef.current = true\n          return\n        }\n        sessionStorage.setItem(SESSION_GUARD_KEY, stamp)\n      } catch {\n        /* storage unavailable — fall through and send this load */\n      }\n    }\n\n    sentRef.current = true\n    void sendFleetHeartbeat({\n      apiUrl: url,\n      apiKey: key,\n      site: resolvedSite,\n      modules,\n      nextVersion: nextVersion ?? detectNextVersion(),\n      source: 'client',\n      allowInFrame,\n      allowLocalhost,\n      debug,\n    })\n  }, [ready, apiUrl, apiKey, site, modules, nextVersion, oncePerSession, debug, allowInFrame, allowLocalhost])\n\n  return null\n}\n"]}

package/dist/{chunk-Y53BIB7A.js → chunk-JSM4AYSZ.js}

@@ -1,8 +1,8 @@
 'use client';
 'use strict';
 
-var chunkDXBSBWSS_js = require('./chunk-DXBSBWSS.js');
-var chunkZQJGCQHC_js = require('./chunk-ZQJGCQHC.js');
+var chunkMTHMOXZF_js = require('./chunk-MTHMOXZF.js');
+var chunkIWHAJBYL_js = require('./chunk-IWHAJBYL.js');
 var jsxRuntime = require('react/jsx-runtime');
 var React5 = require('react');
 
@@ -112,7 +112,7 @@ async function apiPost(endpoint, body = {}) {
     return null;
   }
   try {
-    const response = await chunkZQJGCQHC_js.sonorFetch(`${apiUrl}${endpoint}`, {
+    const response = await chunkIWHAJBYL_js.sonorFetch(`${apiUrl}${endpoint}`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(body)
@@ -279,7 +279,7 @@ async function fetchActiveProcessor() {
   const { apiUrl, apiKey } = getApiConfig();
   if (!apiKey) return null;
   try {
-    const response = await chunkZQJGCQHC_js.sonorFetch(`${apiUrl}/api/public/commerce/processor`, {
+    const response = await chunkIWHAJBYL_js.sonorFetch(`${apiUrl}/api/public/commerce/processor`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({})
@@ -295,7 +295,7 @@ async function registerForEvent(eventId, scheduleId, customer) {
   const { apiUrl, apiKey } = getApiConfig();
   const analyticsSessionId = typeof sessionStorage !== "undefined" ? sessionStorage.getItem("_sk_sid") : null;
   try {
-    const response = await chunkZQJGCQHC_js.sonorFetch(`${apiUrl}/api/public/commerce/register`, {
+    const response = await chunkIWHAJBYL_js.sonorFetch(`${apiUrl}/api/public/commerce/register`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -345,7 +345,7 @@ function toCheckoutBody(options) {
 async function validateDiscountCode(code, subtotal, offeringIds = []) {
   const { apiUrl, apiKey } = getApiConfig();
   try {
-    const response = await chunkZQJGCQHC_js.sonorFetch(`${apiUrl}/api/public/commerce/discount/validate`, {
+    const response = await chunkIWHAJBYL_js.sonorFetch(`${apiUrl}/api/public/commerce/discount/validate`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       // offering_ids is the API's name. Older APIs read only that, so
@@ -365,7 +365,7 @@ async function fetchProcessorConfig() {
   const { apiUrl, apiKey } = getApiConfig();
   if (!apiKey) return null;
   try {
-    const response = await chunkZQJGCQHC_js.sonorFetch(`${apiUrl}/api/public/commerce/processor-config`, {
+    const response = await chunkIWHAJBYL_js.sonorFetch(`${apiUrl}/api/public/commerce/processor-config`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({})
@@ -381,7 +381,7 @@ async function createPaymentIntent(options) {
   const apiKey = getApiKey();
   const sessionId = typeof sessionStorage !== "undefined" ? sessionStorage.getItem("_sk_sid") : null;
   try {
-    const response = await chunkZQJGCQHC_js.sonorFetch(`${apiUrl}/api/public/commerce/create-payment-intent`, {
+    const response = await chunkIWHAJBYL_js.sonorFetch(`${apiUrl}/api/public/commerce/create-payment-intent`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -401,7 +401,7 @@ async function createCheckoutSession(optionsOrOfferingId, legacyOptions) {
   const options = typeof optionsOrOfferingId === "string" ? { offeringId: optionsOrOfferingId, ...legacyOptions } : optionsOrOfferingId;
   const analyticsSessionId = typeof sessionStorage !== "undefined" ? sessionStorage.getItem("_sk_sid") : null;
   try {
-    const response = await chunkZQJGCQHC_js.sonorFetch(`${apiUrl}/api/public/commerce/checkout`, {
+    const response = await chunkIWHAJBYL_js.sonorFetch(`${apiUrl}/api/public/commerce/checkout`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -3123,7 +3123,7 @@ function ProductDetail({
   const [checkoutError, setCheckoutError] = React5.useState(null);
   const [showStickyBar, setShowStickyBar] = React5.useState(false);
   const buyButtonRef = React5.useRef(null);
-  const analytics = chunkDXBSBWSS_js.useAnalyticsOptional();
+  const analytics = chunkMTHMOXZF_js.useAnalyticsOptional();
   React5.useEffect(() => {
     if (propProduct) {
       setProduct(propProduct);
@@ -4494,7 +4494,7 @@ function CheckoutForm({
   const [discountResult, setDiscountResult] = React5.useState(null);
   const [applyingDiscount, setApplyingDiscount] = React5.useState(false);
   const isProduct = offering.type === "product";
-  const analytics = chunkDXBSBWSS_js.useAnalyticsOptional();
+  const analytics = chunkMTHMOXZF_js.useAnalyticsOptional();
   React5.useEffect(() => {
     fetchProcessorConfig().then((config) => {
       if (config?.processor) setProcessor(config.processor);
@@ -7270,7 +7270,7 @@ function EventsWidget({
       setLoading(true);
       setError(null);
       try {
-        const response = await chunkZQJGCQHC_js.sonorFetch(`${apiUrl}/api/public/commerce/events`, {
+        const response = await chunkIWHAJBYL_js.sonorFetch(`${apiUrl}/api/public/commerce/events`, {
           method: "POST",
           headers: { "Content-Type": "application/json" },
           body: JSON.stringify({
@@ -8067,5 +8067,5 @@ exports.shippingSelection = shippingSelection;
 exports.useEventModal = useEventModal;
 exports.validateAddress = validateAddress;
 exports.validateDiscountCode = validateDiscountCode;
-//# sourceMappingURL=chunk-Y53BIB7A.js.map
-//# sourceMappingURL=chunk-Y53BIB7A.js.map
+//# sourceMappingURL=chunk-JSM4AYSZ.js.map
+//# sourceMappingURL=chunk-JSM4AYSZ.js.map