@sonordev/site-kit 6.3.1 → 6.3.3

package/dist/{chunk-YCE6HRWW.js → chunk-DV5KVNA7.js}

@@ -1,8 +1,8 @@
 'use strict';
 
-var chunkQRL3QDUE_js = require('./chunk-QRL3QDUE.js');
-var chunkXA2GJFVM_js = require('./chunk-XA2GJFVM.js');
-var chunk6FASIYCV_js = require('./chunk-6FASIYCV.js');
+var chunk7RLL67F3_js = require('./chunk-7RLL67F3.js');
+var chunkRI6DFQCA_js = require('./chunk-RI6DFQCA.js');
+var chunkTULCHQX2_js = require('./chunk-TULCHQX2.js');
 var chunkKHPJ3CEL_js = require('./chunk-KHPJ3CEL.js');
 var jsxRuntime = require('react/jsx-runtime');
 
@@ -12,9 +12,9 @@ function visibleStaticFields(config) {
   const firstStepId = config.steps?.[0]?.id;
   return all.filter((f) => !f.step_id || f.step_id === firstStepId);
 }
-function StaticForm({ config: raw, className, nativeReturnTo }) {
+function StaticForm({ config: raw, className }) {
   if (!raw) return null;
-  const config = chunk6FASIYCV_js.normalizeFormConfig(raw);
+  const config = chunkTULCHQX2_js.normalizeFormConfig(raw);
   const fields = visibleStaticFields(config);
   const honeypotFieldName = config.honeypot_field || chunkKHPJ3CEL_js.DEFAULT_HONEYPOT_FIELD;
   return /* @__PURE__ */ jsxRuntime.jsxs(
@@ -23,24 +23,23 @@ function StaticForm({ config: raw, className, nativeReturnTo }) {
       "data-sk-state": "idle",
       "data-sk-mount": "shell",
       className: `sk-form ${className || ""}`,
-      ...chunkQRL3QDUE_js.nativeFormProps(config),
+      method: "post",
       children: [
         /* @__PURE__ */ jsxRuntime.jsx("div", { className: "sk-form__step", children: /* @__PURE__ */ jsxRuntime.jsx("div", { className: "sk-form__fields", children: fields.map((field) => /* @__PURE__ */ jsxRuntime.jsx(
           "div",
           {
             className: `sk-form__field-wrapper sk-form__field-wrapper--${field.width || "full"}`,
-            children: /* @__PURE__ */ jsxRuntime.jsx(chunkXA2GJFVM_js.FormField, { field, value: field.default_value ?? "" })
+            children: /* @__PURE__ */ jsxRuntime.jsx(chunkRI6DFQCA_js.FormField, { field, value: field.default_value ?? "" })
           },
           field.id || field.slug
         )) }) }),
         /* @__PURE__ */ jsxRuntime.jsx("div", { className: "sk-form__actions", style: { justifyContent: "flex-end" }, children: /* @__PURE__ */ jsxRuntime.jsx("button", { type: "submit", className: "sk-form__btn sk-form__btn--submit", children: config.submit_button_text || "Submit" }) }),
-        config.honeypot_enabled && /* @__PURE__ */ jsxRuntime.jsx(chunkQRL3QDUE_js.HoneypotField, { name: honeypotFieldName }),
-        /* @__PURE__ */ jsxRuntime.jsx(chunkQRL3QDUE_js.NativeFallbackFields, { config, returnTo: nativeReturnTo })
+        config.honeypot_enabled && /* @__PURE__ */ jsxRuntime.jsx(chunk7RLL67F3_js.HoneypotField, { name: honeypotFieldName })
       ]
     }
   );
 }
 
 exports.StaticForm = StaticForm;
-//# sourceMappingURL=chunk-YCE6HRWW.js.map
-//# sourceMappingURL=chunk-YCE6HRWW.js.map
+//# sourceMappingURL=chunk-DV5KVNA7.js.map
+//# sourceMappingURL=chunk-DV5KVNA7.js.map

package/dist/chunk-DV5KVNA7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/forms/StaticForm.tsx"],"names":["normalizeFormConfig","DEFAULT_HONEYPOT_FIELD","jsxs","jsx","FormField","HoneypotField"],"mappings":";;;;;;;;AA2DA,SAAS,oBAAoB,MAAA,EAA2B;AACtD,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,MAAA,IAAU,EAAC;AAC9B,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,EAAe,OAAO,GAAA;AAGlC,EAAA,MAAM,WAAA,GAAc,MAAA,CAAO,KAAA,GAAQ,CAAC,CAAA,EAAG,EAAA;AACvC,EAAA,OAAO,GAAA,CAAI,OAAO,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,OAAA,IAAW,CAAA,CAAE,OAAA,KAAY,WAAW,CAAA;AAClE;AAEO,SAAS,UAAA,CAAW,EAAE,MAAA,EAAQ,GAAA,EAAK,WAAU,EAAoB;AACtE,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,MAAM,MAAA,GAASA,qCAAoB,GAAU,CAAA;AAC7C,EAAA,MAAM,MAAA,GAAS,oBAAoB,MAAM,CAAA;AACzC,EAAA,MAAM,iBAAA,GAAoB,OAAO,cAAA,IAAkBC,uCAAA;AAEnD,EAAA,uBACEC,eAAA;AAAA,IAAC,MAAA;AAAA,IAAA;AAAA,MAGC,eAAA,EAAc,MAAA;AAAA,MACd,eAAA,EAAc,OAAA;AAAA,MACd,SAAA,EAAW,CAAA,QAAA,EAAW,SAAA,IAAa,EAAE,CAAA,CAAA;AAAA,MACrC,MAAA,EAAO,MAAA;AAAA,MAEP,QAAA,EAAA;AAAA,wBAAAC,cAAA,CAAC,KAAA,EAAA,EAAI,SAAA,EAAU,eAAA,EACb,QAAA,kBAAAA,cAAA,CAAC,KAAA,EAAA,EAAI,WAAU,iBAAA,EACZ,QAAA,EAAA,MAAA,CAAO,GAAA,CAAI,CAAC,KAAA,qBACXA,cAAA;AAAA,UAAC,KAAA;AAAA,UAAA;AAAA,YAEC,SAAA,EAAW,CAAA,+CAAA,EAAkD,KAAA,CAAM,KAAA,IAAS,MAAM,CAAA,CAAA;AAAA,YAGlF,yCAACC,0BAAA,EAAA,EAAU,KAAA,EAAc,KAAA,EAAO,KAAA,CAAM,iBAAiB,EAAA,EAAI;AAAA,WAAA;AAAA,UAJtD,KAAA,CAAM,MAAM,KAAA,CAAM;AAAA,SAM1B,GACH,CAAA,EACF,CAAA;AAAA,uCAEC,KAAA,EAAA,EAAI,SAAA,EAAU,oBAAmB,KAAA,EAAO,EAAE,gBAAgB,UAAA,EAAW,EACpE,QAAA,kBAAAD,cAAA,CAAC,QAAA,EAAA,EAAO,MAAK,QAAA,EAAS,SAAA,EAAU,qCAC7B,QAAA,EAAA,MAAA,CAAO,kBAAA,IAAsB,UAChC,CAAA,EACF,CAAA;AAAA,QAIC,MAAA,CAAO,gBAAA,oBAAoBA,cAAA,CAACE,8BAAA,EAAA,EAAc,MAAM,iBAAA,EAAmB;AAAA;AAAA;AAAA,GAEtE;AAEJ","file":"chunk-DV5KVNA7.js","sourcesContent":["/**\n * StaticForm — a complete, submittable managed form with ZERO client JavaScript.\n *\n * No `'use client'`. This renders in a Server Component, and what it emits is\n * a real `<form>`: every field, the honeypot and a submit button, in the HTML\n * where people and crawlers can read it. Submitting takes the enhancement\n * (<FormEnhancer>): since 6.3.2 there is no no-JavaScript POST. That path\n * (/api/public/forms/submit-native, a signed token in the page HTML) took\n * 10,500 bot submissions across the fleet and not one real lead, because a bot\n * only had to download the page to borrow the token. `method=\"post\"` stays so\n * a click before hydration never puts the visitor's details in a URL.\n *\n * ── Why this exists ─────────────────────────────────────────────────────\n *\n * ManagedForm was a client component for historical reasons that no longer\n * hold: it used to fetch its own config (getFormConfig removed that). Nobody\n * moved the boundary afterward, so every site that rendered a form paid for the\n * whole forms runtime — validation, spotlight, celebration, momentum — as an\n * INITIAL script, on the LCP-critical path.\n *\n * Measured on upforge.io's homepage: 48 KB of form code in the initial chunk\n * set cost 6 Lighthouse points (88 -> 82, LCP 3.8s -> 4.7s). Deferring the\n * client component recovered the score but deleted the form from the HTML,\n * taking the crawlable fields with it. Neither half was acceptable; a\n * server-rendered form is what makes both true at once.\n *\n * Pair it with <FormEnhancer> to upgrade this markup at idle. Never make this\n * file `'use client'`, and never import a hook into it.\n */\n\nimport React from 'react'\nimport { DEFAULT_HONEYPOT_FIELD } from './contract'\nimport { FormField } from './FormField'\nimport { HoneypotField } from './HoneypotField'\nimport { normalizeFormConfig } from './normalize-config'\nimport type { ManagedFormConfig } from './types'\n\nexport interface StaticFormProps {\n  /**\n   * RAW /api/public/forms/config payload from `getFormConfig`, or an\n   * already-normalized config. Normalized here through the SAME function the\n   * client fetch uses, so the shell and the enhancement cannot disagree about\n   * field order, step count, or success copy.\n   */\n  config: Record<string, unknown> | ManagedFormConfig | null | undefined\n  className?: string\n  /**\n   * @deprecated Ignored since 6.3.2. It set where the no-JavaScript form POST\n   * returned to, and that path was removed (bots used it; no person ever did).\n   * Kept so existing call sites still type-check.\n   */\n  nativeReturnTo?: string\n}\n\n/**\n * Fields the static shell can render meaningfully. Conditional logic is a\n * runtime concern (it depends on values the visitor has not entered yet), so\n * a conditional field renders here and the enhancement takes over hiding it.\n */\nfunction visibleStaticFields(config: ManagedFormConfig) {\n  const all = config.fields || []\n  if (!config.is_multi_step) return all\n  // Multi-step is JS-only navigation, so the shell shows step one as a\n  // preview of what the form asks for.\n  const firstStepId = config.steps?.[0]?.id\n  return all.filter((f) => !f.step_id || f.step_id === firstStepId)\n}\n\nexport function StaticForm({ config: raw, className }: StaticFormProps) {\n  if (!raw) return null\n  const config = normalizeFormConfig(raw as any)\n  const fields = visibleStaticFields(config)\n  const honeypotFieldName = config.honeypot_field || DEFAULT_HONEYPOT_FIELD\n\n  return (\n    <form\n      // Matches FormClient's classic branch attribute-for-attribute so the\n      // enhancement swap is invisible. Change one, change the other.\n      data-sk-state=\"idle\"\n      data-sk-mount=\"shell\"\n      className={`sk-form ${className || ''}`}\n      method=\"post\"\n    >\n      <div className=\"sk-form__step\">\n        <div className=\"sk-form__fields\">\n          {fields.map((field) => (\n            <div\n              key={field.id || field.slug}\n              className={`sk-form__field-wrapper sk-form__field-wrapper--${field.width || 'full'}`}\n            >\n              {/* No onChange — FormField renders native uncontrolled controls. */}\n              <FormField field={field} value={field.default_value ?? ''} />\n            </div>\n          ))}\n        </div>\n      </div>\n\n      <div className=\"sk-form__actions\" style={{ justifyContent: 'flex-end' }}>\n        <button type=\"submit\" className=\"sk-form__btn sk-form__btn--submit\">\n          {config.submit_button_text || 'Submit'}\n        </button>\n      </div>\n\n      {/* Same trap the hydrated form uses; no state needed because the value\n          is read and stripped server-side. */}\n      {config.honeypot_enabled && <HoneypotField name={honeypotFieldName} />}\n\n    </form>\n  )\n}\n"]}

package/dist/{chunk-JS265UKZ.mjs → chunk-EE7D6BSA.mjs}

@@ -1,5 +1,5 @@
 import { resolveFetch } from './chunk-BQP6JIE2.mjs';
-import { SITE_KIT_VERSION } from './chunk-C654VCWV.mjs';
+import { SITE_KIT_VERSION } from './chunk-GBMVAKX3.mjs';
 import 'server-only';
 
 var MINT_PATH = "/api/public/site-token";
@@ -124,5 +124,5 @@ async function mintWithRetry(rawKey, apiUrl) {
 }
 
 export { resolveClientCredential };
-//# sourceMappingURL=chunk-JS265UKZ.mjs.map
-//# sourceMappingURL=chunk-JS265UKZ.mjs.map
+//# sourceMappingURL=chunk-EE7D6BSA.mjs.map
+//# sourceMappingURL=chunk-EE7D6BSA.mjs.map

package/dist/{chunk-JS265UKZ.mjs.map → chunk-EE7D6BSA.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/mint-site-token.ts"],"names":[],"mappings":";;;;AAgDA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAO1B,IAAM,iBAAA,GAAoB,CAAA;AAC1B,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,mBAAA,GAAsB,GAAA;AAM5B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAO1C,IAAM,QAAA,uBAAe,GAAA,EAA6B;AAElD,IAAM,KAAA,GAAQ,CAAC,EAAA,KAAe,IAAI,OAAA,CAAc,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAOxE,SAAS,YAAA,CAAa,KAAsB,OAAA,EAAyB;AACnE,EAAA,MAAM,MAAA,GAAS,GAAA,EAAK,OAAA,EAAS,GAAA,GAAM,aAAa,CAAA;AAChD,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,OAAA,GAAU,OAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GAC9B,OAAA,GAAU,GAAA,GACV,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,GAAI,IAAA,CAAK,GAAA,EAAI;AAClC,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,EAAE,CAAA,IAAK,EAAA,GAAK,GAAG,OAAO,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,mBAAmB,CAAA;AAAA,EAC5E;AACA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,oBAAA,GAAuB,CAAA,IAAK,SAAS,mBAAmB,CAAA;AAC1E;AAGA,IAAM,iBAAA,GAAoB,CAAC,MAAA,KAAmB,MAAA,KAAW,OAAO,MAAA,IAAU,GAAA;AAM1E,SAAS,kBAAA,GAA8B;AACrC,EAAA,OACE,OAAO,OAAA,KAAY,WAAA,IACnB,OAAA,CAAQ,KAAK,yBAAA,KAA8B,KAAA;AAE/C;AAEA,SAAS,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAgB,GAAA,EAAqB;AACvE,EAAA,IAAI,oBAAmB,EAAG;AACxB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,sCAAsC,MAAM,CAAA,uMAAA;AAAA,KAG9C;AACA,IAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,0CAA0C,MAAM,CAAA,uRAAA;AAAA,GAIlD;AACF;AAsBO,SAAS,kBAAkB,GAAA,EAAuB;AACvD,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AAC5C,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,sBAAA,EAAwB,OAAO,IAAA;AAChD,EAAA,IAAI,CAAA,CAAE,IAAA,KAAS,yBAAA,EAA2B,OAAO,IAAA;AACjD,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,EAAE,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,EAAG,OAAO,IAAA;AACzE,EAAA,IAAI,EAAE,QAAA,qBAAa,MAAA,CAAO,GAAA,CAAI,gBAAgB,GAAG,OAAO,IAAA;AACxD,EAAA,OAAO,KAAA;AACT;AAEA,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,UAAU,MAAA,CAAO,SAAA,GAAY,KAAK,GAAA,EAAI,SAAU,MAAA,CAAO,UAAA;AAG3D,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,SAAS,OAAO,OAAA;AAEpB,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AAC5C,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,OAAO,CAAA;AAC5B,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAA;AAAA,EACf,CAAA,SAAE;AACA,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,EACxB;AACF;AAEA,eAAe,aAAA,CAAc,QAAgB,MAAA,EAAiC;AAC5E,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI,UAAA,GAAa,eAAA;AAEjB,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,iBAAA,EAAmB,OAAA,EAAA,EAAW;AAC5D,IAAA,IAAI,GAAA,GAAuB,IAAA;AAC3B,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,EAAA,EAAI,OAAA,EAAS,SAAA,KAAc,YAAA,EAAa;AAChD,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,QACzC,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,WAAA,EAAa,MAAA;AAAA,UACb,mBAAA,EAAqB;AAAA,SACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMA,GAAI,YAAY,EAAC,GAAK,EAAE,IAAA,EAAM,EAAE,UAAA,EAAY,KAAA,EAAM,EAAE;AAAA,QACpD,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,OACP,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAI,iBAAA,CAAkB,GAAG,CAAA,EAAG,MAAM,GAAA;AAClC,MAAA,UAAA,GAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,eAAA;AAClD,MAAA,IAAI,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACnC,QAAA,MAAM,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AACvC,QAAA;AAAA,MACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,IAAK,SAAA,GAAY,GAAA,GAAQ,CAAA,EAAG,EAAA,GAAK,GAAM;AAAA,SACrE,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,UAAA,GAAa,+BAAA;AACb,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,MAAA,KAAA,CAAM,GAAA,CAAI,MAAA,EAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,WAAW,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,EAAQ,CAAA;AACxE,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,UAAA,GAAa,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAC/B,IAAA,IAAI,kBAAkB,GAAA,CAAI,MAAM,CAAA,IAAK,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACpE,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,EAAK,OAAO,CAAA;AACvC,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,GAAA,CAAI,MAAM,CAAA,cAAA,EAAiB,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA,YAAA,EACrE,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,iBAAiB,CAAA,EAAA;AAAA,OAChD;AACA,MAAA,MAAM,MAAM,KAAK,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA;AAAA,EACF;AAEA,EAAA,OAAO,UAAA,CAAW,UAAA,EAAY,MAAA,EAAQ,IAAA,CAAK,KAAK,CAAA;AAClD","file":"chunk-JS265UKZ.mjs","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * FAILS CLOSED. If minting genuinely fails, this throws and the build fails —\n * it does NOT publish the raw key. A failed deploy is loud and recoverable; a\n * leaked project secret in public HTML is neither. The only paths that still\n * return the raw key are a 404 (an older API that predates the endpoint, an\n * expected state during rollout) and the explicit `SONOR_SITE_TOKEN_FALLBACK=raw`\n * escape hatch, for when shipping beats being blocked.\n *\n * That posture is not academic. Through 3.5.0 a throttled mint (HTTP 429)\n * returned the raw key AND cached it for 60s, so every page rendered in that\n * window shipped the secret: one real build came out with 180 of 272 prerendered\n * pages carrying it. The build \"succeeded\" and nothing downstream noticed.\n * Rate limiting is transient by definition — the fix is to wait and retry, not\n * to downgrade to publishing the key.\n *\n * Two things keep the request count low enough that throttling is rare:\n *  - a module-level memo, so a worker mints once and every page reuses the seed;\n *  - an in-flight map, because that memo is only populated AFTER the await. Next\n *    renders pages concurrently, so without coalescing the first N concurrent\n *    renders in a process all miss the cache and all fire a request — a\n *    stampede per worker, multiplied by one worker per core. That is how a\n *    single site exhausted a 60/min budget.\n *\n * SEED FRESHNESS: a static page's seed carries `iat` = build time, and the API\n * refuses to refresh a seed older than SITE_TOKEN_MAX_REFRESH_AGE_SECONDS\n * (sonor-api common/site-auth/site-token.util.ts — currently 400 days, raised\n * from 30 alongside this fix). A site not rebuilt within that window serves a\n * seed the client cannot refresh, and its forms/analytics/engage start failing\n * for new visitors. Keep that limit comfortably longer than the fleet's\n * realistic redeploy gap; marketing sites routinely go many months untouched.\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\nimport { resolveFetch } from '../shared/fresh-fetch'\n\n// Re-exported for this module's unit tests; the helper lives in shared/fresh-fetch.\nexport { resolveFetch }\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\n/**\n * Retry budget for transient failures (429 / 5xx / network). Rate limiting is\n * measured per minute, so a few seconds of backoff clears it; the whole ladder\n * costs at most ~20s once per build worker, and only when something is wrong.\n */\nconst MINT_MAX_ATTEMPTS = 4\nconst MINT_BACKOFF_BASE_MS = 500\nconst MINT_BACKOFF_CAP_MS = 8_000\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\n/**\n * Requests already in flight, keyed by raw key. The `cache` above is only\n * written after the response lands, so concurrent renders would otherwise each\n * start their own mint. See the module header.\n */\nconst inflight = new Map<string, Promise<string>>()\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\n/**\n * Honour `Retry-After` when the server sends it (delta-seconds or HTTP date),\n * otherwise exponential backoff. Capped so a misconfigured server cannot stall\n * a build indefinitely.\n */\nfunction retryDelayMs(res: Response | null, attempt: number): number {\n  const header = res?.headers?.get?.('retry-after')\n  if (header) {\n    const seconds = Number(header)\n    const ms = Number.isFinite(seconds)\n      ? seconds * 1000\n      : Date.parse(header) - Date.now()\n    if (Number.isFinite(ms) && ms > 0) return Math.min(ms, MINT_BACKOFF_CAP_MS)\n  }\n  return Math.min(MINT_BACKOFF_BASE_MS * 2 ** attempt, MINT_BACKOFF_CAP_MS)\n}\n\n/** 429 and 5xx are transient; waiting is the correct response to both. */\nconst isRetryableStatus = (status: number) => status === 429 || status >= 500\n\n/**\n * The escape hatch, for when a broken mint must not block a release. Opt-in and\n * loud: it re-enables publishing the project secret in page HTML.\n */\nfunction rawFallbackAllowed(): boolean {\n  return (\n    typeof process !== 'undefined' &&\n    process.env?.SONOR_SITE_TOKEN_FALLBACK === 'raw'\n  )\n}\n\nfunction failClosed(reason: string, rawKey: string, now: number): string {\n  if (rawFallbackAllowed()) {\n    console.warn(\n      `[SiteKitLayout] Token mint failed (${reason}) and SONOR_SITE_TOKEN_FALLBACK=raw is set; ` +\n        'injecting the RAW API KEY into page HTML. The key is publicly readable wherever ' +\n        'this page is served — unset the escape hatch once the mint is healthy.',\n    )\n    cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n    return rawKey\n  }\n  throw new Error(\n    `site-kit: could not mint a site token (${reason}). Refusing to publish the raw ` +\n      'SONOR_API_KEY in page HTML, so this build fails instead. Check that the mint ' +\n      'endpoint is reachable and the key is valid, then rebuild. To ship anyway — ' +\n      'which publishes the project secret in public HTML — set SONOR_SITE_TOKEN_FALLBACK=raw.',\n  )\n}\n\n/*\n * The mint uses Next's saved original fetch (resolveFetch, shared/fresh-fetch.ts,\n * which documents why). A credential is not page data: `cache: 'no-store'` would\n * bail a static route before the request goes out (verified on Next 16.2.9: the\n * mint endpoint received zero requests for a static build, and every page\n * shipped the raw key), and a Data Cache entry would let a fresh deploy re-bake a\n * months-old seed. The module-level memo above is the only cache we want: one\n * mint per build process, and a build-fresh seed on every deploy.\n */\n\n/**\n * Next signals \"this render must go dynamic\" by THROWING (DynamicServerError,\n * static-gen bailout, redirect/notFound digests, React's postpone). Those are\n * the framework's control flow, not a mint failure. Swallowing one makes Next\n * believe the render succeeded statically — which is precisely how the raw key\n * ended up stranded in prerendered HTML with no error anywhere. Let them\n * propagate; only real network/HTTP failures fall back to the raw key.\n *\n * @internal Exported for unit tests; not part of the package's public API.\n */\nexport function isFrameworkSignal(err: unknown): boolean {\n  if (!err || typeof err !== 'object') return false\n  const e = err as { digest?: unknown; code?: unknown; $$typeof?: unknown }\n  if (e.digest === 'DYNAMIC_SERVER_USAGE') return true\n  if (e.code === 'NEXT_STATIC_GEN_BAILOUT') return true\n  if (typeof e.digest === 'string' && e.digest.startsWith('NEXT_')) return true\n  if (e.$$typeof === Symbol.for('react.postpone')) return true\n  return false\n}\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > Date.now()) return cached.credential\n\n  // Collapse concurrent renders onto one request rather than a stampede.\n  const pending = inflight.get(rawKey)\n  if (pending) return pending\n\n  const request = mintWithRetry(rawKey, apiUrl)\n  inflight.set(rawKey, request)\n  try {\n    return await request\n  } finally {\n    inflight.delete(rawKey)\n  }\n}\n\nasync function mintWithRetry(rawKey: string, apiUrl: string): Promise<string> {\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  let lastReason = 'unknown error'\n\n  for (let attempt = 0; attempt < MINT_MAX_ATTEMPTS; attempt++) {\n    let res: Response | null = null\n    try {\n      const { fn: fetchFn, unpatched } = resolveFetch()\n      res = await fetchFn(`${base}${MINT_PATH}`, {\n        method: 'POST',\n        headers: {\n          'content-type': 'application/json',\n          'x-api-key': rawKey,\n          'x-sitekit-version': SITE_KIT_VERSION,\n        },\n        // Only meaningful on the fallback path, where a future Next stopped\n        // exposing `_nextOriginalFetch` and we're back on the patched fetch.\n        // `revalidate: false` is the one setting that neither bails out of static\n        // generation nor downgrades the route to ISR; a Data Cache entry is the\n        // lesser evil versus shipping the raw key again.\n        ...(unpatched ? {} : ({ next: { revalidate: false } } as RequestInit)),\n        signal:\n          typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n            ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n            : undefined,\n      })\n    } catch (err) {\n      // Never swallow the framework's own control flow — see isFrameworkSignal.\n      if (isFrameworkSignal(err)) throw err\n      lastReason = err instanceof Error ? err.message : 'network error'\n      if (attempt < MINT_MAX_ATTEMPTS - 1) {\n        await sleep(retryDelayMs(null, attempt))\n        continue\n      }\n      break\n    }\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: Date.now() + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n      lastReason = 'mint returned no usable token'\n      break\n    }\n\n    // 404 = an API older than the endpoint. Expected during rollout, and the raw\n    // key is exactly what such an API still expects, so this stays a fallback\n    // rather than a build failure.\n    if (res.status === 404) {\n      cache.set(rawKey, { credential: rawKey, expiresAt: Date.now() + 60_000 })\n      return rawKey\n    }\n\n    lastReason = `HTTP ${res.status}`\n    if (isRetryableStatus(res.status) && attempt < MINT_MAX_ATTEMPTS - 1) {\n      const delay = retryDelayMs(res, attempt)\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; retrying in ${Math.round(delay)}ms ` +\n          `(attempt ${attempt + 2}/${MINT_MAX_ATTEMPTS}).`,\n      )\n      await sleep(delay)\n      continue\n    }\n    break\n  }\n\n  return failClosed(lastReason, rawKey, Date.now())\n}\n"]}
+{"version":3,"sources":["../src/server/mint-site-token.ts"],"names":[],"mappings":";;;;AAgDA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAO1B,IAAM,iBAAA,GAAoB,CAAA;AAC1B,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,mBAAA,GAAsB,GAAA;AAM5B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAO1C,IAAM,QAAA,uBAAe,GAAA,EAA6B;AAElD,IAAM,KAAA,GAAQ,CAAC,EAAA,KAAe,IAAI,OAAA,CAAc,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAOxE,SAAS,YAAA,CAAa,KAAsB,OAAA,EAAyB;AACnE,EAAA,MAAM,MAAA,GAAS,GAAA,EAAK,OAAA,EAAS,GAAA,GAAM,aAAa,CAAA;AAChD,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,OAAA,GAAU,OAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GAC9B,OAAA,GAAU,GAAA,GACV,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,GAAI,IAAA,CAAK,GAAA,EAAI;AAClC,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,EAAE,CAAA,IAAK,EAAA,GAAK,GAAG,OAAO,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,mBAAmB,CAAA;AAAA,EAC5E;AACA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,oBAAA,GAAuB,CAAA,IAAK,SAAS,mBAAmB,CAAA;AAC1E;AAGA,IAAM,iBAAA,GAAoB,CAAC,MAAA,KAAmB,MAAA,KAAW,OAAO,MAAA,IAAU,GAAA;AAM1E,SAAS,kBAAA,GAA8B;AACrC,EAAA,OACE,OAAO,OAAA,KAAY,WAAA,IACnB,OAAA,CAAQ,KAAK,yBAAA,KAA8B,KAAA;AAE/C;AAEA,SAAS,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAgB,GAAA,EAAqB;AACvE,EAAA,IAAI,oBAAmB,EAAG;AACxB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,sCAAsC,MAAM,CAAA,uMAAA;AAAA,KAG9C;AACA,IAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,0CAA0C,MAAM,CAAA,uRAAA;AAAA,GAIlD;AACF;AAsBO,SAAS,kBAAkB,GAAA,EAAuB;AACvD,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AAC5C,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,sBAAA,EAAwB,OAAO,IAAA;AAChD,EAAA,IAAI,CAAA,CAAE,IAAA,KAAS,yBAAA,EAA2B,OAAO,IAAA;AACjD,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,EAAE,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,EAAG,OAAO,IAAA;AACzE,EAAA,IAAI,EAAE,QAAA,qBAAa,MAAA,CAAO,GAAA,CAAI,gBAAgB,GAAG,OAAO,IAAA;AACxD,EAAA,OAAO,KAAA;AACT;AAEA,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,UAAU,MAAA,CAAO,SAAA,GAAY,KAAK,GAAA,EAAI,SAAU,MAAA,CAAO,UAAA;AAG3D,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,SAAS,OAAO,OAAA;AAEpB,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AAC5C,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,OAAO,CAAA;AAC5B,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAA;AAAA,EACf,CAAA,SAAE;AACA,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,EACxB;AACF;AAEA,eAAe,aAAA,CAAc,QAAgB,MAAA,EAAiC;AAC5E,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI,UAAA,GAAa,eAAA;AAEjB,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,iBAAA,EAAmB,OAAA,EAAA,EAAW;AAC5D,IAAA,IAAI,GAAA,GAAuB,IAAA;AAC3B,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,EAAA,EAAI,OAAA,EAAS,SAAA,KAAc,YAAA,EAAa;AAChD,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,QACzC,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,WAAA,EAAa,MAAA;AAAA,UACb,mBAAA,EAAqB;AAAA,SACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMA,GAAI,YAAY,EAAC,GAAK,EAAE,IAAA,EAAM,EAAE,UAAA,EAAY,KAAA,EAAM,EAAE;AAAA,QACpD,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,OACP,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAI,iBAAA,CAAkB,GAAG,CAAA,EAAG,MAAM,GAAA;AAClC,MAAA,UAAA,GAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,eAAA;AAClD,MAAA,IAAI,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACnC,QAAA,MAAM,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AACvC,QAAA;AAAA,MACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,IAAK,SAAA,GAAY,GAAA,GAAQ,CAAA,EAAG,EAAA,GAAK,GAAM;AAAA,SACrE,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,UAAA,GAAa,+BAAA;AACb,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,MAAA,KAAA,CAAM,GAAA,CAAI,MAAA,EAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,WAAW,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,EAAQ,CAAA;AACxE,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,UAAA,GAAa,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAC/B,IAAA,IAAI,kBAAkB,GAAA,CAAI,MAAM,CAAA,IAAK,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACpE,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,EAAK,OAAO,CAAA;AACvC,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,GAAA,CAAI,MAAM,CAAA,cAAA,EAAiB,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA,YAAA,EACrE,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,iBAAiB,CAAA,EAAA;AAAA,OAChD;AACA,MAAA,MAAM,MAAM,KAAK,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA;AAAA,EACF;AAEA,EAAA,OAAO,UAAA,CAAW,UAAA,EAAY,MAAA,EAAQ,IAAA,CAAK,KAAK,CAAA;AAClD","file":"chunk-EE7D6BSA.mjs","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * FAILS CLOSED. If minting genuinely fails, this throws and the build fails —\n * it does NOT publish the raw key. A failed deploy is loud and recoverable; a\n * leaked project secret in public HTML is neither. The only paths that still\n * return the raw key are a 404 (an older API that predates the endpoint, an\n * expected state during rollout) and the explicit `SONOR_SITE_TOKEN_FALLBACK=raw`\n * escape hatch, for when shipping beats being blocked.\n *\n * That posture is not academic. Through 3.5.0 a throttled mint (HTTP 429)\n * returned the raw key AND cached it for 60s, so every page rendered in that\n * window shipped the secret: one real build came out with 180 of 272 prerendered\n * pages carrying it. The build \"succeeded\" and nothing downstream noticed.\n * Rate limiting is transient by definition — the fix is to wait and retry, not\n * to downgrade to publishing the key.\n *\n * Two things keep the request count low enough that throttling is rare:\n *  - a module-level memo, so a worker mints once and every page reuses the seed;\n *  - an in-flight map, because that memo is only populated AFTER the await. Next\n *    renders pages concurrently, so without coalescing the first N concurrent\n *    renders in a process all miss the cache and all fire a request — a\n *    stampede per worker, multiplied by one worker per core. That is how a\n *    single site exhausted a 60/min budget.\n *\n * SEED FRESHNESS: a static page's seed carries `iat` = build time, and the API\n * refuses to refresh a seed older than SITE_TOKEN_MAX_REFRESH_AGE_SECONDS\n * (sonor-api common/site-auth/site-token.util.ts — currently 400 days, raised\n * from 30 alongside this fix). A site not rebuilt within that window serves a\n * seed the client cannot refresh, and its forms/analytics/engage start failing\n * for new visitors. Keep that limit comfortably longer than the fleet's\n * realistic redeploy gap; marketing sites routinely go many months untouched.\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\nimport { resolveFetch } from '../shared/fresh-fetch'\n\n// Re-exported for this module's unit tests; the helper lives in shared/fresh-fetch.\nexport { resolveFetch }\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\n/**\n * Retry budget for transient failures (429 / 5xx / network). Rate limiting is\n * measured per minute, so a few seconds of backoff clears it; the whole ladder\n * costs at most ~20s once per build worker, and only when something is wrong.\n */\nconst MINT_MAX_ATTEMPTS = 4\nconst MINT_BACKOFF_BASE_MS = 500\nconst MINT_BACKOFF_CAP_MS = 8_000\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\n/**\n * Requests already in flight, keyed by raw key. The `cache` above is only\n * written after the response lands, so concurrent renders would otherwise each\n * start their own mint. See the module header.\n */\nconst inflight = new Map<string, Promise<string>>()\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\n/**\n * Honour `Retry-After` when the server sends it (delta-seconds or HTTP date),\n * otherwise exponential backoff. Capped so a misconfigured server cannot stall\n * a build indefinitely.\n */\nfunction retryDelayMs(res: Response | null, attempt: number): number {\n  const header = res?.headers?.get?.('retry-after')\n  if (header) {\n    const seconds = Number(header)\n    const ms = Number.isFinite(seconds)\n      ? seconds * 1000\n      : Date.parse(header) - Date.now()\n    if (Number.isFinite(ms) && ms > 0) return Math.min(ms, MINT_BACKOFF_CAP_MS)\n  }\n  return Math.min(MINT_BACKOFF_BASE_MS * 2 ** attempt, MINT_BACKOFF_CAP_MS)\n}\n\n/** 429 and 5xx are transient; waiting is the correct response to both. */\nconst isRetryableStatus = (status: number) => status === 429 || status >= 500\n\n/**\n * The escape hatch, for when a broken mint must not block a release. Opt-in and\n * loud: it re-enables publishing the project secret in page HTML.\n */\nfunction rawFallbackAllowed(): boolean {\n  return (\n    typeof process !== 'undefined' &&\n    process.env?.SONOR_SITE_TOKEN_FALLBACK === 'raw'\n  )\n}\n\nfunction failClosed(reason: string, rawKey: string, now: number): string {\n  if (rawFallbackAllowed()) {\n    console.warn(\n      `[SiteKitLayout] Token mint failed (${reason}) and SONOR_SITE_TOKEN_FALLBACK=raw is set; ` +\n        'injecting the RAW API KEY into page HTML. The key is publicly readable wherever ' +\n        'this page is served — unset the escape hatch once the mint is healthy.',\n    )\n    cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n    return rawKey\n  }\n  throw new Error(\n    `site-kit: could not mint a site token (${reason}). Refusing to publish the raw ` +\n      'SONOR_API_KEY in page HTML, so this build fails instead. Check that the mint ' +\n      'endpoint is reachable and the key is valid, then rebuild. To ship anyway — ' +\n      'which publishes the project secret in public HTML — set SONOR_SITE_TOKEN_FALLBACK=raw.',\n  )\n}\n\n/*\n * The mint uses Next's saved original fetch (resolveFetch, shared/fresh-fetch.ts,\n * which documents why). A credential is not page data: `cache: 'no-store'` would\n * bail a static route before the request goes out (verified on Next 16.2.9: the\n * mint endpoint received zero requests for a static build, and every page\n * shipped the raw key), and a Data Cache entry would let a fresh deploy re-bake a\n * months-old seed. The module-level memo above is the only cache we want: one\n * mint per build process, and a build-fresh seed on every deploy.\n */\n\n/**\n * Next signals \"this render must go dynamic\" by THROWING (DynamicServerError,\n * static-gen bailout, redirect/notFound digests, React's postpone). Those are\n * the framework's control flow, not a mint failure. Swallowing one makes Next\n * believe the render succeeded statically — which is precisely how the raw key\n * ended up stranded in prerendered HTML with no error anywhere. Let them\n * propagate; only real network/HTTP failures fall back to the raw key.\n *\n * @internal Exported for unit tests; not part of the package's public API.\n */\nexport function isFrameworkSignal(err: unknown): boolean {\n  if (!err || typeof err !== 'object') return false\n  const e = err as { digest?: unknown; code?: unknown; $$typeof?: unknown }\n  if (e.digest === 'DYNAMIC_SERVER_USAGE') return true\n  if (e.code === 'NEXT_STATIC_GEN_BAILOUT') return true\n  if (typeof e.digest === 'string' && e.digest.startsWith('NEXT_')) return true\n  if (e.$$typeof === Symbol.for('react.postpone')) return true\n  return false\n}\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > Date.now()) return cached.credential\n\n  // Collapse concurrent renders onto one request rather than a stampede.\n  const pending = inflight.get(rawKey)\n  if (pending) return pending\n\n  const request = mintWithRetry(rawKey, apiUrl)\n  inflight.set(rawKey, request)\n  try {\n    return await request\n  } finally {\n    inflight.delete(rawKey)\n  }\n}\n\nasync function mintWithRetry(rawKey: string, apiUrl: string): Promise<string> {\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  let lastReason = 'unknown error'\n\n  for (let attempt = 0; attempt < MINT_MAX_ATTEMPTS; attempt++) {\n    let res: Response | null = null\n    try {\n      const { fn: fetchFn, unpatched } = resolveFetch()\n      res = await fetchFn(`${base}${MINT_PATH}`, {\n        method: 'POST',\n        headers: {\n          'content-type': 'application/json',\n          'x-api-key': rawKey,\n          'x-sitekit-version': SITE_KIT_VERSION,\n        },\n        // Only meaningful on the fallback path, where a future Next stopped\n        // exposing `_nextOriginalFetch` and we're back on the patched fetch.\n        // `revalidate: false` is the one setting that neither bails out of static\n        // generation nor downgrades the route to ISR; a Data Cache entry is the\n        // lesser evil versus shipping the raw key again.\n        ...(unpatched ? {} : ({ next: { revalidate: false } } as RequestInit)),\n        signal:\n          typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n            ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n            : undefined,\n      })\n    } catch (err) {\n      // Never swallow the framework's own control flow — see isFrameworkSignal.\n      if (isFrameworkSignal(err)) throw err\n      lastReason = err instanceof Error ? err.message : 'network error'\n      if (attempt < MINT_MAX_ATTEMPTS - 1) {\n        await sleep(retryDelayMs(null, attempt))\n        continue\n      }\n      break\n    }\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: Date.now() + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n      lastReason = 'mint returned no usable token'\n      break\n    }\n\n    // 404 = an API older than the endpoint. Expected during rollout, and the raw\n    // key is exactly what such an API still expects, so this stays a fallback\n    // rather than a build failure.\n    if (res.status === 404) {\n      cache.set(rawKey, { credential: rawKey, expiresAt: Date.now() + 60_000 })\n      return rawKey\n    }\n\n    lastReason = `HTTP ${res.status}`\n    if (isRetryableStatus(res.status) && attempt < MINT_MAX_ATTEMPTS - 1) {\n      const delay = retryDelayMs(res, attempt)\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; retrying in ${Math.round(delay)}ms ` +\n          `(attempt ${attempt + 2}/${MINT_MAX_ATTEMPTS}).`,\n      )\n      await sleep(delay)\n      continue\n    }\n    break\n  }\n\n  return failClosed(lastReason, rawKey, Date.now())\n}\n"]}

package/dist/{chunk-OUM77VZ4.mjs → chunk-EE7J66MJ.mjs}

@@ -1,4 +1,4 @@
-import { SITE_KIT_VERSION } from './chunk-C654VCWV.mjs';
+import { SITE_KIT_VERSION } from './chunk-GBMVAKX3.mjs';
 
 // src/shared/siteToken.ts
 var SITE_TOKEN_PREFIX = "st1.";
@@ -146,5 +146,5 @@ function currentCredential(seed) {
 }
 
 export { configureSiteCredential, credentialBreakerId, currentCredential, getFreshCredential, isSiteToken, isTokenMode, refreshSiteToken };
-//# sourceMappingURL=chunk-OUM77VZ4.mjs.map
-//# sourceMappingURL=chunk-OUM77VZ4.mjs.map
+//# sourceMappingURL=chunk-EE7J66MJ.mjs.map
+//# sourceMappingURL=chunk-EE7J66MJ.mjs.map

package/dist/{chunk-OUM77VZ4.mjs.map → chunk-EE7J66MJ.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/siteToken.ts"],"names":[],"mappings":";;;AAuBO,IAAM,iBAAA,GAAoB,MAAA;AAGjC,IAAM,kBAAkB,CAAA,GAAI,GAAA;AAC5B,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,WAAA,GAAc,sBAAA;AAEb,SAAS,YAAY,UAAA,EAAqC;AAC/D,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,IAAY,UAAA,CAAW,WAAW,iBAAiB,CAAA;AAClF;AASO,SAAS,sBAAsB,KAAA,EAA6C;AACjF,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,MAAM,GAAA,GAAO,KAAA,CAAiB,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC1C,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,IAAI;AAEF,IAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACpD,IAAA,MAAM,IAAA,GACJ,OAAO,IAAA,KAAS,UAAA,GACZ,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACnD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,IAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,GAAS,MAAA,GAAS,IAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOO,SAAS,oBAAoB,UAAA,EAAoC;AACtE,EAAA,IAAI,CAAC,YAAY,OAAO,aAAA;AACxB,EAAA,MAAM,MAAA,GAAS,sBAAsB,UAAU,CAAA;AAC/C,EAAA,IAAI,MAAA,EAAQ,GAAA,EAAK,OAAO,CAAA,IAAA,EAAO,OAAO,GAAG,CAAA,CAAA;AACzC,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B;AAeA,SAAS,iBAAA,GAAgC;AACvC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,MAAA;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,MAAA,EAAQ,sBAAA;AAAA,IACR,KAAA,EAAO,IAAA;AAAA,IACP,UAAA,EAAY;AAAA,GACd;AACF;AAcA,IAAM,eAAA,GAAkB,4BAAA;AAExB,IAAM,SAAqB,MAAM;AAC/B,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,iBAAA,EAAkB;AAC5D,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,4CAAuB,iBAAA,EAAkB,CAAA;AACnD,CAAA,GAAG;AAEH,SAAS,eAAA,GAAiC;AACxC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AACrD,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,OAAO,MAAA,EAAQ,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ,IAAA;AAAA,EAC5D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAW,KAAA,EAAqB;AACvC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACnC,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,cAAA,CAAe,QAAQ,WAAA,EAAa,IAAA,CAAK,UAAU,EAAE,KAAA,EAAO,CAAC,CAAA;AAAA,EACtE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA;AAAC,IAAC,OAAe,oBAAA,GAAuB,KAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,SAAS,KAAA,EAA8B;AAC9C,EAAA,MAAM,MAAA,GAAS,sBAAsB,KAAK,CAAA;AAC1C,EAAA,OAAO,OAAO,MAAA,EAAQ,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,MAAM,GAAA,GAAO,CAAA;AAC/D;AAMO,SAAS,wBAAwB,IAAA,EAG/B;AACP,EAAA,KAAA,CAAM,OAAO,IAAA,CAAK,UAAA;AAClB,EAAA,KAAA,CAAM,OAAA,GAAU,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,QAAQ,KAAA,CAAM,MAAA,GAAS,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAE9D,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,IAAA;AAAA,EACF;AAKA,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,EAAA,IAAI,IAAA,GAAO,KAAK,UAAA,IAAc,IAAA;AAC9B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,IAAI,UAAU,QAAA,CAAS,MAAM,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,MAAA;AACxD,EAAA,IAAI,SAAS,QAAA,CAAS,KAAK,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,KAAA;AACtD,EAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AAChB;AAEA,SAAS,YAAA,GAAwB;AAC/B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,KAAA;AAC3B,EAAA,IAAI,CAAC,KAAA,CAAM,KAAA,EAAO,OAAO,IAAA;AACzB,EAAA,OAAO,KAAK,GAAA,EAAI,IAAK,QAAA,CAAS,KAAA,CAAM,KAAK,CAAA,GAAI,eAAA;AAC/C;AAEA,eAAe,SAAA,GAAoC;AACjD,EAAA,MAAM,UAAU,KAAA,CAAM,KAAA;AACtB,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,8BAAA,CAAA,EAAkC;AAAA,MACvE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqB,gBAAA;AAAA;AAAA;AAAA,QAGrB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACvC,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,kBAAkB,CAAA,GACtC,KAAA;AAAA,KACP,CAAA;AACD,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,OAAO,IAAA;AACpB,IAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC9C,IAAA,MAAM,OAAO,IAAA,EAAM,KAAA;AACnB,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,WAAA,CAAY,IAAI,CAAA,EAAG;AACjD,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,UAAA,CAAW,IAAI,CAAA;AACf,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,gBAAA,GAA2C;AACzD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,UAAA,EAAY,OAAO,KAAA,CAAM,UAAA;AACnC,EAAA,KAAA,CAAM,UAAA,GAAa,SAAA,EAAU,CAAE,OAAA,CAAQ,MAAM;AAC3C,IAAA,KAAA,CAAM,UAAA,GAAa,IAAA;AAAA,EACrB,CAAC,CAAA;AACD,EAAA,OAAO,KAAA,CAAM,UAAA;AACf;AAMA,eAAsB,mBACpB,IAAA,EAC6B;AAI7B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,IAAW,WAAA,CAAY,IAAI,CAAA,EAAG;AACvC,IAAA,uBAAA,CAAwB,EAAE,UAAA,EAAY,IAAA,EAAM,CAAA;AAAA,EAC9C;AAEA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,IAAI,cAAa,EAAG;AAClB,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,WAAW,OAAO,SAAA;AAAA,EAGxB;AACA,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC;AAGO,SAAS,WAAA,GAAuB;AACrC,EAAA,OAAO,KAAA,CAAM,OAAA;AACf;AAOO,SAAS,kBAAkB,IAAA,EAAmC;AACnE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC","file":"chunk-OUM77VZ4.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared — Client token manager\n *\n * SiteKitLayout (a server component) no longer ships the raw `sonor_` API key to\n * the browser. Instead it mints a short-lived, project-scoped token server-side\n * and injects THAT. This module is the browser-side lifecycle for that token:\n *\n *   - holds the current token (seeded from the injected value)\n *   - a static page's seed can be days old and already expired on first view, so\n *     it transparently REFRESHES via the public endpoint before first use\n *   - dedupes concurrent refreshes (one in-flight request, awaited by all)\n *   - persists the freshest token in sessionStorage so navigations within a\n *     session don't each re-refresh\n *\n * Everything here is a no-op passthrough when the injected credential is a raw\n * key (a 2.x kit, or the mint-failed fallback) — legacy behavior is unchanged.\n * Fully SSR-safe: on the server there is no refresh, just the seed.\n *\n * The token payload is NOT secret (only its HMAC is unforgeable), so decoding it\n * client-side to read `exp`/`pid` is fine and needs no crypto.\n */\nimport { SITE_KIT_VERSION } from './version'\n\nexport const SITE_TOKEN_PREFIX = 'st1.'\n\n/** Refresh this many ms before expiry, so a request never races the deadline. */\nconst REFRESH_SKEW_MS = 5 * 60_000\nconst REFRESH_TIMEOUT_MS = 6_000\nconst STORAGE_KEY = '__sonor_site_token__'\n\nexport function isSiteToken(credential?: string | null): boolean {\n  return typeof credential === 'string' && credential.startsWith(SITE_TOKEN_PREFIX)\n}\n\ninterface DecodedClaims {\n  pid?: string\n  iat?: number\n  exp?: number\n}\n\n/** Decode the (non-secret) token payload. Returns null if not a token / malformed. */\nexport function decodeSiteTokenClaims(token?: string | null): DecodedClaims | null {\n  if (!isSiteToken(token)) return null\n  const seg = (token as string).split('.')[1]\n  if (!seg) return null\n  try {\n    // base64url → JSON. atob handles standard base64; restore url-safe chars.\n    const b64 = seg.replace(/-/g, '+').replace(/_/g, '/')\n    const json =\n      typeof atob === 'function'\n        ? atob(b64)\n        : Buffer.from(seg, 'base64url').toString('utf8')\n    const claims = JSON.parse(json)\n    return typeof claims === 'object' && claims ? claims : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Stable id for the auth circuit breaker. Tokens rotate, so keying the breaker\n * by the raw value would reset it every refresh — key by the project id encoded\n * in the token instead. Raw keys use a safe prefix.\n */\nexport function credentialBreakerId(credential?: string | null): string {\n  if (!credential) return '(anonymous)'\n  const claims = decodeSiteTokenClaims(credential)\n  if (claims?.pid) return `pid:${claims.pid}`\n  return credential.slice(0, 16)\n}\n\ninterface TokenState {\n  /** The credential injected by the layout (token or raw key). */\n  seed: string | undefined\n  /** Whether we're in token mode (seed is a token). */\n  isToken: boolean\n  /** Base API URL for the refresh endpoint. */\n  apiUrl: string\n  /** The freshest known token (>= seed). Null in raw-key mode. */\n  token: string | null\n  /** In-flight refresh, deduped. */\n  refreshing: Promise<string | null> | null\n}\n\nfunction initialTokenState(): TokenState {\n  return {\n    seed: undefined,\n    isToken: false,\n    apiUrl: 'https://api.sonor.io',\n    token: null,\n    refreshing: null,\n  }\n}\n\n/**\n * Page-wide singleton, keyed on window. Bundlers can (and in the field, do)\n * inline more than one copy of this module into a page — e.g. an app importing\n * site-kit directly while a transpiled component library bundles its own copy.\n * Module-scoped state then splits into per-copy brains: one copy gets\n * configured and refreshes fine while the other keeps sending the stale\n * prerendered seed, 401s, and trips its breaker (\"sonor-auth-paused\" with a\n * working network). Sharing the state object on window gives every copy the\n * same token, the same deduped refresh, and the same breaker. On the server\n * (no window) each module instance keeps private state — there's no refresh\n * lifecycle there anyway.\n */\nconst TOKEN_STATE_KEY = '__SONOR_SITE_TOKEN_STATE__'\n\nconst state: TokenState = (() => {\n  if (typeof window === 'undefined') return initialTokenState()\n  const w = window as unknown as Record<string, TokenState | undefined>\n  return (w[TOKEN_STATE_KEY] ??= initialTokenState())\n})()\n\nfunction readStoredToken(): string | null {\n  if (typeof window === 'undefined') return null\n  try {\n    const raw = window.sessionStorage.getItem(STORAGE_KEY)\n    if (!raw) return null\n    const parsed = JSON.parse(raw)\n    return typeof parsed?.token === 'string' ? parsed.token : null\n  } catch {\n    return null\n  }\n}\n\nfunction storeToken(token: string): void {\n  if (typeof window === 'undefined') return\n  try {\n    window.sessionStorage.setItem(STORAGE_KEY, JSON.stringify({ token }))\n  } catch {\n    /* private mode / disabled storage — memory-only is fine */\n  }\n  try {\n    ;(window as any).__SITE_KIT_API_KEY__ = token\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction tokenExp(token: string | null): number {\n  const claims = decodeSiteTokenClaims(token)\n  return typeof claims?.exp === 'number' ? claims.exp * 1000 : 0\n}\n\n/**\n * Configure the manager from the layout-injected values. Adopts a fresher token\n * from sessionStorage if a prior page in this session already refreshed.\n */\nexport function configureSiteCredential(opts: {\n  credential?: string\n  apiUrl?: string\n}): void {\n  state.seed = opts.credential\n  state.isToken = isSiteToken(opts.credential)\n  if (opts.apiUrl) state.apiUrl = opts.apiUrl.replace(/\\/+$/, '')\n\n  if (!state.isToken) {\n    state.token = null\n    return\n  }\n\n  // configure runs on every render — never downgrade. Keep the freshest of the\n  // injected seed, a token stored by an earlier page this session, and whatever\n  // an in-flight/prior refresh already put in memory.\n  const prior = state.token\n  let best = opts.credential ?? null\n  const stored = readStoredToken()\n  if (stored && tokenExp(stored) > tokenExp(best)) best = stored\n  if (prior && tokenExp(prior) > tokenExp(best)) best = prior\n  state.token = best\n}\n\nfunction needsRefresh(): boolean {\n  if (!state.isToken) return false\n  if (!state.token) return true\n  return Date.now() >= tokenExp(state.token) - REFRESH_SKEW_MS\n}\n\nasync function doRefresh(): Promise<string | null> {\n  const current = state.token\n  if (!current) return null\n  try {\n    const res = await fetch(`${state.apiUrl}/api/public/site-token/refresh`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        // Send the current token as x-api-key too, so the server's key-scoped\n        // throttler buckets refreshes by token rather than by shared CDN IP.\n        'x-api-key': current,\n      },\n      body: JSON.stringify({ token: current }),\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(REFRESH_TIMEOUT_MS)\n          : undefined,\n    })\n    if (!res.ok) return null\n    const data = await res.json().catch(() => null)\n    const next = data?.token\n    if (typeof next === 'string' && isSiteToken(next)) {\n      state.token = next\n      storeToken(next)\n      return next\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\n/** Refresh now (deduped). Returns the new token, or null on failure. */\nexport function refreshSiteToken(): Promise<string | null> {\n  if (!state.isToken) return Promise.resolve(null)\n  if (state.refreshing) return state.refreshing\n  state.refreshing = doRefresh().finally(() => {\n    state.refreshing = null\n  })\n  return state.refreshing\n}\n\n/**\n * The credential to put on the next request. In token mode, refreshes a stale\n * seed first. In raw-key mode, returns the seed unchanged (legacy passthrough).\n */\nexport async function getFreshCredential(\n  seed?: string,\n): Promise<string | undefined> {\n  // Unconfigured but handed a token (a component received the prerendered seed\n  // as a prop before any provider configured the manager): adopt it so the\n  // refresh machinery works instead of replaying a possibly-expired seed.\n  if (!state.isToken && isSiteToken(seed)) {\n    configureSiteCredential({ credential: seed })\n  }\n  // A raw key (or nothing configured) — no token machinery.\n  if (!state.isToken) return seed ?? state.seed\n  if (needsRefresh()) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed) return refreshed\n    // Refresh failed — fall through to whatever we have; the request may 401 and\n    // trip the breaker with friendly copy.\n  }\n  return state.token ?? seed ?? state.seed\n}\n\n/** Whether the given credential is being managed as a token. */\nexport function isTokenMode(): boolean {\n  return state.isToken\n}\n\n/**\n * Best-known credential WITHOUT refreshing — for synchronous unload paths\n * (sonorBeacon) that can't await. In token mode returns the freshest token held;\n * in raw-key mode returns the seed.\n */\nexport function currentCredential(seed?: string): string | undefined {\n  if (!state.isToken) return seed ?? state.seed\n  return state.token ?? seed ?? state.seed\n}\n"]}
+{"version":3,"sources":["../src/shared/siteToken.ts"],"names":[],"mappings":";;;AAuBO,IAAM,iBAAA,GAAoB,MAAA;AAGjC,IAAM,kBAAkB,CAAA,GAAI,GAAA;AAC5B,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,WAAA,GAAc,sBAAA;AAEb,SAAS,YAAY,UAAA,EAAqC;AAC/D,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,IAAY,UAAA,CAAW,WAAW,iBAAiB,CAAA;AAClF;AASO,SAAS,sBAAsB,KAAA,EAA6C;AACjF,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,MAAM,GAAA,GAAO,KAAA,CAAiB,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC1C,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,IAAI;AAEF,IAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACpD,IAAA,MAAM,IAAA,GACJ,OAAO,IAAA,KAAS,UAAA,GACZ,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACnD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,IAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,GAAS,MAAA,GAAS,IAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOO,SAAS,oBAAoB,UAAA,EAAoC;AACtE,EAAA,IAAI,CAAC,YAAY,OAAO,aAAA;AACxB,EAAA,MAAM,MAAA,GAAS,sBAAsB,UAAU,CAAA;AAC/C,EAAA,IAAI,MAAA,EAAQ,GAAA,EAAK,OAAO,CAAA,IAAA,EAAO,OAAO,GAAG,CAAA,CAAA;AACzC,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B;AAeA,SAAS,iBAAA,GAAgC;AACvC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,MAAA;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,MAAA,EAAQ,sBAAA;AAAA,IACR,KAAA,EAAO,IAAA;AAAA,IACP,UAAA,EAAY;AAAA,GACd;AACF;AAcA,IAAM,eAAA,GAAkB,4BAAA;AAExB,IAAM,SAAqB,MAAM;AAC/B,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,iBAAA,EAAkB;AAC5D,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,4CAAuB,iBAAA,EAAkB,CAAA;AACnD,CAAA,GAAG;AAEH,SAAS,eAAA,GAAiC;AACxC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AACrD,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,OAAO,MAAA,EAAQ,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ,IAAA;AAAA,EAC5D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAW,KAAA,EAAqB;AACvC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACnC,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,cAAA,CAAe,QAAQ,WAAA,EAAa,IAAA,CAAK,UAAU,EAAE,KAAA,EAAO,CAAC,CAAA;AAAA,EACtE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA;AAAC,IAAC,OAAe,oBAAA,GAAuB,KAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,SAAS,KAAA,EAA8B;AAC9C,EAAA,MAAM,MAAA,GAAS,sBAAsB,KAAK,CAAA;AAC1C,EAAA,OAAO,OAAO,MAAA,EAAQ,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,MAAM,GAAA,GAAO,CAAA;AAC/D;AAMO,SAAS,wBAAwB,IAAA,EAG/B;AACP,EAAA,KAAA,CAAM,OAAO,IAAA,CAAK,UAAA;AAClB,EAAA,KAAA,CAAM,OAAA,GAAU,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,QAAQ,KAAA,CAAM,MAAA,GAAS,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAE9D,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,IAAA;AAAA,EACF;AAKA,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,EAAA,IAAI,IAAA,GAAO,KAAK,UAAA,IAAc,IAAA;AAC9B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,IAAI,UAAU,QAAA,CAAS,MAAM,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,MAAA;AACxD,EAAA,IAAI,SAAS,QAAA,CAAS,KAAK,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,KAAA;AACtD,EAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AAChB;AAEA,SAAS,YAAA,GAAwB;AAC/B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,KAAA;AAC3B,EAAA,IAAI,CAAC,KAAA,CAAM,KAAA,EAAO,OAAO,IAAA;AACzB,EAAA,OAAO,KAAK,GAAA,EAAI,IAAK,QAAA,CAAS,KAAA,CAAM,KAAK,CAAA,GAAI,eAAA;AAC/C;AAEA,eAAe,SAAA,GAAoC;AACjD,EAAA,MAAM,UAAU,KAAA,CAAM,KAAA;AACtB,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,8BAAA,CAAA,EAAkC;AAAA,MACvE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqB,gBAAA;AAAA;AAAA;AAAA,QAGrB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACvC,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,kBAAkB,CAAA,GACtC,KAAA;AAAA,KACP,CAAA;AACD,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,OAAO,IAAA;AACpB,IAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC9C,IAAA,MAAM,OAAO,IAAA,EAAM,KAAA;AACnB,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,WAAA,CAAY,IAAI,CAAA,EAAG;AACjD,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,UAAA,CAAW,IAAI,CAAA;AACf,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,gBAAA,GAA2C;AACzD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,UAAA,EAAY,OAAO,KAAA,CAAM,UAAA;AACnC,EAAA,KAAA,CAAM,UAAA,GAAa,SAAA,EAAU,CAAE,OAAA,CAAQ,MAAM;AAC3C,IAAA,KAAA,CAAM,UAAA,GAAa,IAAA;AAAA,EACrB,CAAC,CAAA;AACD,EAAA,OAAO,KAAA,CAAM,UAAA;AACf;AAMA,eAAsB,mBACpB,IAAA,EAC6B;AAI7B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,IAAW,WAAA,CAAY,IAAI,CAAA,EAAG;AACvC,IAAA,uBAAA,CAAwB,EAAE,UAAA,EAAY,IAAA,EAAM,CAAA;AAAA,EAC9C;AAEA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,IAAI,cAAa,EAAG;AAClB,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,WAAW,OAAO,SAAA;AAAA,EAGxB;AACA,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC;AAGO,SAAS,WAAA,GAAuB;AACrC,EAAA,OAAO,KAAA,CAAM,OAAA;AACf;AAOO,SAAS,kBAAkB,IAAA,EAAmC;AACnE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC","file":"chunk-EE7J66MJ.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared — Client token manager\n *\n * SiteKitLayout (a server component) no longer ships the raw `sonor_` API key to\n * the browser. Instead it mints a short-lived, project-scoped token server-side\n * and injects THAT. This module is the browser-side lifecycle for that token:\n *\n *   - holds the current token (seeded from the injected value)\n *   - a static page's seed can be days old and already expired on first view, so\n *     it transparently REFRESHES via the public endpoint before first use\n *   - dedupes concurrent refreshes (one in-flight request, awaited by all)\n *   - persists the freshest token in sessionStorage so navigations within a\n *     session don't each re-refresh\n *\n * Everything here is a no-op passthrough when the injected credential is a raw\n * key (a 2.x kit, or the mint-failed fallback) — legacy behavior is unchanged.\n * Fully SSR-safe: on the server there is no refresh, just the seed.\n *\n * The token payload is NOT secret (only its HMAC is unforgeable), so decoding it\n * client-side to read `exp`/`pid` is fine and needs no crypto.\n */\nimport { SITE_KIT_VERSION } from './version'\n\nexport const SITE_TOKEN_PREFIX = 'st1.'\n\n/** Refresh this many ms before expiry, so a request never races the deadline. */\nconst REFRESH_SKEW_MS = 5 * 60_000\nconst REFRESH_TIMEOUT_MS = 6_000\nconst STORAGE_KEY = '__sonor_site_token__'\n\nexport function isSiteToken(credential?: string | null): boolean {\n  return typeof credential === 'string' && credential.startsWith(SITE_TOKEN_PREFIX)\n}\n\ninterface DecodedClaims {\n  pid?: string\n  iat?: number\n  exp?: number\n}\n\n/** Decode the (non-secret) token payload. Returns null if not a token / malformed. */\nexport function decodeSiteTokenClaims(token?: string | null): DecodedClaims | null {\n  if (!isSiteToken(token)) return null\n  const seg = (token as string).split('.')[1]\n  if (!seg) return null\n  try {\n    // base64url → JSON. atob handles standard base64; restore url-safe chars.\n    const b64 = seg.replace(/-/g, '+').replace(/_/g, '/')\n    const json =\n      typeof atob === 'function'\n        ? atob(b64)\n        : Buffer.from(seg, 'base64url').toString('utf8')\n    const claims = JSON.parse(json)\n    return typeof claims === 'object' && claims ? claims : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Stable id for the auth circuit breaker. Tokens rotate, so keying the breaker\n * by the raw value would reset it every refresh — key by the project id encoded\n * in the token instead. Raw keys use a safe prefix.\n */\nexport function credentialBreakerId(credential?: string | null): string {\n  if (!credential) return '(anonymous)'\n  const claims = decodeSiteTokenClaims(credential)\n  if (claims?.pid) return `pid:${claims.pid}`\n  return credential.slice(0, 16)\n}\n\ninterface TokenState {\n  /** The credential injected by the layout (token or raw key). */\n  seed: string | undefined\n  /** Whether we're in token mode (seed is a token). */\n  isToken: boolean\n  /** Base API URL for the refresh endpoint. */\n  apiUrl: string\n  /** The freshest known token (>= seed). Null in raw-key mode. */\n  token: string | null\n  /** In-flight refresh, deduped. */\n  refreshing: Promise<string | null> | null\n}\n\nfunction initialTokenState(): TokenState {\n  return {\n    seed: undefined,\n    isToken: false,\n    apiUrl: 'https://api.sonor.io',\n    token: null,\n    refreshing: null,\n  }\n}\n\n/**\n * Page-wide singleton, keyed on window. Bundlers can (and in the field, do)\n * inline more than one copy of this module into a page — e.g. an app importing\n * site-kit directly while a transpiled component library bundles its own copy.\n * Module-scoped state then splits into per-copy brains: one copy gets\n * configured and refreshes fine while the other keeps sending the stale\n * prerendered seed, 401s, and trips its breaker (\"sonor-auth-paused\" with a\n * working network). Sharing the state object on window gives every copy the\n * same token, the same deduped refresh, and the same breaker. On the server\n * (no window) each module instance keeps private state — there's no refresh\n * lifecycle there anyway.\n */\nconst TOKEN_STATE_KEY = '__SONOR_SITE_TOKEN_STATE__'\n\nconst state: TokenState = (() => {\n  if (typeof window === 'undefined') return initialTokenState()\n  const w = window as unknown as Record<string, TokenState | undefined>\n  return (w[TOKEN_STATE_KEY] ??= initialTokenState())\n})()\n\nfunction readStoredToken(): string | null {\n  if (typeof window === 'undefined') return null\n  try {\n    const raw = window.sessionStorage.getItem(STORAGE_KEY)\n    if (!raw) return null\n    const parsed = JSON.parse(raw)\n    return typeof parsed?.token === 'string' ? parsed.token : null\n  } catch {\n    return null\n  }\n}\n\nfunction storeToken(token: string): void {\n  if (typeof window === 'undefined') return\n  try {\n    window.sessionStorage.setItem(STORAGE_KEY, JSON.stringify({ token }))\n  } catch {\n    /* private mode / disabled storage — memory-only is fine */\n  }\n  try {\n    ;(window as any).__SITE_KIT_API_KEY__ = token\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction tokenExp(token: string | null): number {\n  const claims = decodeSiteTokenClaims(token)\n  return typeof claims?.exp === 'number' ? claims.exp * 1000 : 0\n}\n\n/**\n * Configure the manager from the layout-injected values. Adopts a fresher token\n * from sessionStorage if a prior page in this session already refreshed.\n */\nexport function configureSiteCredential(opts: {\n  credential?: string\n  apiUrl?: string\n}): void {\n  state.seed = opts.credential\n  state.isToken = isSiteToken(opts.credential)\n  if (opts.apiUrl) state.apiUrl = opts.apiUrl.replace(/\\/+$/, '')\n\n  if (!state.isToken) {\n    state.token = null\n    return\n  }\n\n  // configure runs on every render — never downgrade. Keep the freshest of the\n  // injected seed, a token stored by an earlier page this session, and whatever\n  // an in-flight/prior refresh already put in memory.\n  const prior = state.token\n  let best = opts.credential ?? null\n  const stored = readStoredToken()\n  if (stored && tokenExp(stored) > tokenExp(best)) best = stored\n  if (prior && tokenExp(prior) > tokenExp(best)) best = prior\n  state.token = best\n}\n\nfunction needsRefresh(): boolean {\n  if (!state.isToken) return false\n  if (!state.token) return true\n  return Date.now() >= tokenExp(state.token) - REFRESH_SKEW_MS\n}\n\nasync function doRefresh(): Promise<string | null> {\n  const current = state.token\n  if (!current) return null\n  try {\n    const res = await fetch(`${state.apiUrl}/api/public/site-token/refresh`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        // Send the current token as x-api-key too, so the server's key-scoped\n        // throttler buckets refreshes by token rather than by shared CDN IP.\n        'x-api-key': current,\n      },\n      body: JSON.stringify({ token: current }),\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(REFRESH_TIMEOUT_MS)\n          : undefined,\n    })\n    if (!res.ok) return null\n    const data = await res.json().catch(() => null)\n    const next = data?.token\n    if (typeof next === 'string' && isSiteToken(next)) {\n      state.token = next\n      storeToken(next)\n      return next\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\n/** Refresh now (deduped). Returns the new token, or null on failure. */\nexport function refreshSiteToken(): Promise<string | null> {\n  if (!state.isToken) return Promise.resolve(null)\n  if (state.refreshing) return state.refreshing\n  state.refreshing = doRefresh().finally(() => {\n    state.refreshing = null\n  })\n  return state.refreshing\n}\n\n/**\n * The credential to put on the next request. In token mode, refreshes a stale\n * seed first. In raw-key mode, returns the seed unchanged (legacy passthrough).\n */\nexport async function getFreshCredential(\n  seed?: string,\n): Promise<string | undefined> {\n  // Unconfigured but handed a token (a component received the prerendered seed\n  // as a prop before any provider configured the manager): adopt it so the\n  // refresh machinery works instead of replaying a possibly-expired seed.\n  if (!state.isToken && isSiteToken(seed)) {\n    configureSiteCredential({ credential: seed })\n  }\n  // A raw key (or nothing configured) — no token machinery.\n  if (!state.isToken) return seed ?? state.seed\n  if (needsRefresh()) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed) return refreshed\n    // Refresh failed — fall through to whatever we have; the request may 401 and\n    // trip the breaker with friendly copy.\n  }\n  return state.token ?? seed ?? state.seed\n}\n\n/** Whether the given credential is being managed as a token. */\nexport function isTokenMode(): boolean {\n  return state.isToken\n}\n\n/**\n * Best-known credential WITHOUT refreshing — for synchronous unload paths\n * (sonorBeacon) that can't await. In token mode returns the freshest token held;\n * in raw-key mode returns the seed.\n */\nexport function currentCredential(seed?: string): string | undefined {\n  if (!state.isToken) return seed ?? state.seed\n  return state.token ?? seed ?? state.seed\n}\n"]}

package/dist/{chunk-6TSYWYYR.js → chunk-F5RO6HVF.js}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkZKOQCKOR_js = require('./chunk-ZKOQCKOR.js');
+var chunk6PQJH6YR_js = require('./chunk-6PQJH6YR.js');
 
 // src/shared/siteToken.ts
 var SITE_TOKEN_PREFIX = "st1.";
@@ -99,7 +99,7 @@ async function doRefresh() {
       method: "POST",
       headers: {
         "content-type": "application/json",
-        "x-sitekit-version": chunkZKOQCKOR_js.SITE_KIT_VERSION,
+        "x-sitekit-version": chunk6PQJH6YR_js.SITE_KIT_VERSION,
         // Send the current token as x-api-key too, so the server's key-scoped
         // throttler buckets refreshes by token rather than by shared CDN IP.
         "x-api-key": current
@@ -154,5 +154,5 @@ exports.getFreshCredential = getFreshCredential;
 exports.isSiteToken = isSiteToken;
 exports.isTokenMode = isTokenMode;
 exports.refreshSiteToken = refreshSiteToken;
-//# sourceMappingURL=chunk-6TSYWYYR.js.map
-//# sourceMappingURL=chunk-6TSYWYYR.js.map
+//# sourceMappingURL=chunk-F5RO6HVF.js.map
+//# sourceMappingURL=chunk-F5RO6HVF.js.map

package/dist/{chunk-6TSYWYYR.js.map → chunk-F5RO6HVF.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/siteToken.ts"],"names":["SITE_KIT_VERSION"],"mappings":";;;;;AAuBO,IAAM,iBAAA,GAAoB,MAAA;AAGjC,IAAM,kBAAkB,CAAA,GAAI,GAAA;AAC5B,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,WAAA,GAAc,sBAAA;AAEb,SAAS,YAAY,UAAA,EAAqC;AAC/D,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,IAAY,UAAA,CAAW,WAAW,iBAAiB,CAAA;AAClF;AASO,SAAS,sBAAsB,KAAA,EAA6C;AACjF,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,MAAM,GAAA,GAAO,KAAA,CAAiB,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC1C,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,IAAI;AAEF,IAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACpD,IAAA,MAAM,IAAA,GACJ,OAAO,IAAA,KAAS,UAAA,GACZ,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACnD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,IAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,GAAS,MAAA,GAAS,IAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOO,SAAS,oBAAoB,UAAA,EAAoC;AACtE,EAAA,IAAI,CAAC,YAAY,OAAO,aAAA;AACxB,EAAA,MAAM,MAAA,GAAS,sBAAsB,UAAU,CAAA;AAC/C,EAAA,IAAI,MAAA,EAAQ,GAAA,EAAK,OAAO,CAAA,IAAA,EAAO,OAAO,GAAG,CAAA,CAAA;AACzC,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B;AAeA,SAAS,iBAAA,GAAgC;AACvC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,MAAA;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,MAAA,EAAQ,sBAAA;AAAA,IACR,KAAA,EAAO,IAAA;AAAA,IACP,UAAA,EAAY;AAAA,GACd;AACF;AAcA,IAAM,eAAA,GAAkB,4BAAA;AAExB,IAAM,SAAqB,MAAM;AAC/B,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,iBAAA,EAAkB;AAC5D,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,4CAAuB,iBAAA,EAAkB,CAAA;AACnD,CAAA,GAAG;AAEH,SAAS,eAAA,GAAiC;AACxC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AACrD,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,OAAO,MAAA,EAAQ,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ,IAAA;AAAA,EAC5D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAW,KAAA,EAAqB;AACvC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACnC,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,cAAA,CAAe,QAAQ,WAAA,EAAa,IAAA,CAAK,UAAU,EAAE,KAAA,EAAO,CAAC,CAAA;AAAA,EACtE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA;AAAC,IAAC,OAAe,oBAAA,GAAuB,KAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,SAAS,KAAA,EAA8B;AAC9C,EAAA,MAAM,MAAA,GAAS,sBAAsB,KAAK,CAAA;AAC1C,EAAA,OAAO,OAAO,MAAA,EAAQ,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,MAAM,GAAA,GAAO,CAAA;AAC/D;AAMO,SAAS,wBAAwB,IAAA,EAG/B;AACP,EAAA,KAAA,CAAM,OAAO,IAAA,CAAK,UAAA;AAClB,EAAA,KAAA,CAAM,OAAA,GAAU,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,QAAQ,KAAA,CAAM,MAAA,GAAS,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAE9D,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,IAAA;AAAA,EACF;AAKA,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,EAAA,IAAI,IAAA,GAAO,KAAK,UAAA,IAAc,IAAA;AAC9B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,IAAI,UAAU,QAAA,CAAS,MAAM,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,MAAA;AACxD,EAAA,IAAI,SAAS,QAAA,CAAS,KAAK,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,KAAA;AACtD,EAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AAChB;AAEA,SAAS,YAAA,GAAwB;AAC/B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,KAAA;AAC3B,EAAA,IAAI,CAAC,KAAA,CAAM,KAAA,EAAO,OAAO,IAAA;AACzB,EAAA,OAAO,KAAK,GAAA,EAAI,IAAK,QAAA,CAAS,KAAA,CAAM,KAAK,CAAA,GAAI,eAAA;AAC/C;AAEA,eAAe,SAAA,GAAoC;AACjD,EAAA,MAAM,UAAU,KAAA,CAAM,KAAA;AACtB,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,8BAAA,CAAA,EAAkC;AAAA,MACvE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqBA,iCAAA;AAAA;AAAA;AAAA,QAGrB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACvC,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,kBAAkB,CAAA,GACtC,KAAA;AAAA,KACP,CAAA;AACD,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,OAAO,IAAA;AACpB,IAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC9C,IAAA,MAAM,OAAO,IAAA,EAAM,KAAA;AACnB,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,WAAA,CAAY,IAAI,CAAA,EAAG;AACjD,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,UAAA,CAAW,IAAI,CAAA;AACf,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,gBAAA,GAA2C;AACzD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,UAAA,EAAY,OAAO,KAAA,CAAM,UAAA;AACnC,EAAA,KAAA,CAAM,UAAA,GAAa,SAAA,EAAU,CAAE,OAAA,CAAQ,MAAM;AAC3C,IAAA,KAAA,CAAM,UAAA,GAAa,IAAA;AAAA,EACrB,CAAC,CAAA;AACD,EAAA,OAAO,KAAA,CAAM,UAAA;AACf;AAMA,eAAsB,mBACpB,IAAA,EAC6B;AAI7B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,IAAW,WAAA,CAAY,IAAI,CAAA,EAAG;AACvC,IAAA,uBAAA,CAAwB,EAAE,UAAA,EAAY,IAAA,EAAM,CAAA;AAAA,EAC9C;AAEA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,IAAI,cAAa,EAAG;AAClB,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,WAAW,OAAO,SAAA;AAAA,EAGxB;AACA,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC;AAGO,SAAS,WAAA,GAAuB;AACrC,EAAA,OAAO,KAAA,CAAM,OAAA;AACf;AAOO,SAAS,kBAAkB,IAAA,EAAmC;AACnE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC","file":"chunk-6TSYWYYR.js","sourcesContent":["/**\n * @sonordev/site-kit shared — Client token manager\n *\n * SiteKitLayout (a server component) no longer ships the raw `sonor_` API key to\n * the browser. Instead it mints a short-lived, project-scoped token server-side\n * and injects THAT. This module is the browser-side lifecycle for that token:\n *\n *   - holds the current token (seeded from the injected value)\n *   - a static page's seed can be days old and already expired on first view, so\n *     it transparently REFRESHES via the public endpoint before first use\n *   - dedupes concurrent refreshes (one in-flight request, awaited by all)\n *   - persists the freshest token in sessionStorage so navigations within a\n *     session don't each re-refresh\n *\n * Everything here is a no-op passthrough when the injected credential is a raw\n * key (a 2.x kit, or the mint-failed fallback) — legacy behavior is unchanged.\n * Fully SSR-safe: on the server there is no refresh, just the seed.\n *\n * The token payload is NOT secret (only its HMAC is unforgeable), so decoding it\n * client-side to read `exp`/`pid` is fine and needs no crypto.\n */\nimport { SITE_KIT_VERSION } from './version'\n\nexport const SITE_TOKEN_PREFIX = 'st1.'\n\n/** Refresh this many ms before expiry, so a request never races the deadline. */\nconst REFRESH_SKEW_MS = 5 * 60_000\nconst REFRESH_TIMEOUT_MS = 6_000\nconst STORAGE_KEY = '__sonor_site_token__'\n\nexport function isSiteToken(credential?: string | null): boolean {\n  return typeof credential === 'string' && credential.startsWith(SITE_TOKEN_PREFIX)\n}\n\ninterface DecodedClaims {\n  pid?: string\n  iat?: number\n  exp?: number\n}\n\n/** Decode the (non-secret) token payload. Returns null if not a token / malformed. */\nexport function decodeSiteTokenClaims(token?: string | null): DecodedClaims | null {\n  if (!isSiteToken(token)) return null\n  const seg = (token as string).split('.')[1]\n  if (!seg) return null\n  try {\n    // base64url → JSON. atob handles standard base64; restore url-safe chars.\n    const b64 = seg.replace(/-/g, '+').replace(/_/g, '/')\n    const json =\n      typeof atob === 'function'\n        ? atob(b64)\n        : Buffer.from(seg, 'base64url').toString('utf8')\n    const claims = JSON.parse(json)\n    return typeof claims === 'object' && claims ? claims : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Stable id for the auth circuit breaker. Tokens rotate, so keying the breaker\n * by the raw value would reset it every refresh — key by the project id encoded\n * in the token instead. Raw keys use a safe prefix.\n */\nexport function credentialBreakerId(credential?: string | null): string {\n  if (!credential) return '(anonymous)'\n  const claims = decodeSiteTokenClaims(credential)\n  if (claims?.pid) return `pid:${claims.pid}`\n  return credential.slice(0, 16)\n}\n\ninterface TokenState {\n  /** The credential injected by the layout (token or raw key). */\n  seed: string | undefined\n  /** Whether we're in token mode (seed is a token). */\n  isToken: boolean\n  /** Base API URL for the refresh endpoint. */\n  apiUrl: string\n  /** The freshest known token (>= seed). Null in raw-key mode. */\n  token: string | null\n  /** In-flight refresh, deduped. */\n  refreshing: Promise<string | null> | null\n}\n\nfunction initialTokenState(): TokenState {\n  return {\n    seed: undefined,\n    isToken: false,\n    apiUrl: 'https://api.sonor.io',\n    token: null,\n    refreshing: null,\n  }\n}\n\n/**\n * Page-wide singleton, keyed on window. Bundlers can (and in the field, do)\n * inline more than one copy of this module into a page — e.g. an app importing\n * site-kit directly while a transpiled component library bundles its own copy.\n * Module-scoped state then splits into per-copy brains: one copy gets\n * configured and refreshes fine while the other keeps sending the stale\n * prerendered seed, 401s, and trips its breaker (\"sonor-auth-paused\" with a\n * working network). Sharing the state object on window gives every copy the\n * same token, the same deduped refresh, and the same breaker. On the server\n * (no window) each module instance keeps private state — there's no refresh\n * lifecycle there anyway.\n */\nconst TOKEN_STATE_KEY = '__SONOR_SITE_TOKEN_STATE__'\n\nconst state: TokenState = (() => {\n  if (typeof window === 'undefined') return initialTokenState()\n  const w = window as unknown as Record<string, TokenState | undefined>\n  return (w[TOKEN_STATE_KEY] ??= initialTokenState())\n})()\n\nfunction readStoredToken(): string | null {\n  if (typeof window === 'undefined') return null\n  try {\n    const raw = window.sessionStorage.getItem(STORAGE_KEY)\n    if (!raw) return null\n    const parsed = JSON.parse(raw)\n    return typeof parsed?.token === 'string' ? parsed.token : null\n  } catch {\n    return null\n  }\n}\n\nfunction storeToken(token: string): void {\n  if (typeof window === 'undefined') return\n  try {\n    window.sessionStorage.setItem(STORAGE_KEY, JSON.stringify({ token }))\n  } catch {\n    /* private mode / disabled storage — memory-only is fine */\n  }\n  try {\n    ;(window as any).__SITE_KIT_API_KEY__ = token\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction tokenExp(token: string | null): number {\n  const claims = decodeSiteTokenClaims(token)\n  return typeof claims?.exp === 'number' ? claims.exp * 1000 : 0\n}\n\n/**\n * Configure the manager from the layout-injected values. Adopts a fresher token\n * from sessionStorage if a prior page in this session already refreshed.\n */\nexport function configureSiteCredential(opts: {\n  credential?: string\n  apiUrl?: string\n}): void {\n  state.seed = opts.credential\n  state.isToken = isSiteToken(opts.credential)\n  if (opts.apiUrl) state.apiUrl = opts.apiUrl.replace(/\\/+$/, '')\n\n  if (!state.isToken) {\n    state.token = null\n    return\n  }\n\n  // configure runs on every render — never downgrade. Keep the freshest of the\n  // injected seed, a token stored by an earlier page this session, and whatever\n  // an in-flight/prior refresh already put in memory.\n  const prior = state.token\n  let best = opts.credential ?? null\n  const stored = readStoredToken()\n  if (stored && tokenExp(stored) > tokenExp(best)) best = stored\n  if (prior && tokenExp(prior) > tokenExp(best)) best = prior\n  state.token = best\n}\n\nfunction needsRefresh(): boolean {\n  if (!state.isToken) return false\n  if (!state.token) return true\n  return Date.now() >= tokenExp(state.token) - REFRESH_SKEW_MS\n}\n\nasync function doRefresh(): Promise<string | null> {\n  const current = state.token\n  if (!current) return null\n  try {\n    const res = await fetch(`${state.apiUrl}/api/public/site-token/refresh`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        // Send the current token as x-api-key too, so the server's key-scoped\n        // throttler buckets refreshes by token rather than by shared CDN IP.\n        'x-api-key': current,\n      },\n      body: JSON.stringify({ token: current }),\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(REFRESH_TIMEOUT_MS)\n          : undefined,\n    })\n    if (!res.ok) return null\n    const data = await res.json().catch(() => null)\n    const next = data?.token\n    if (typeof next === 'string' && isSiteToken(next)) {\n      state.token = next\n      storeToken(next)\n      return next\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\n/** Refresh now (deduped). Returns the new token, or null on failure. */\nexport function refreshSiteToken(): Promise<string | null> {\n  if (!state.isToken) return Promise.resolve(null)\n  if (state.refreshing) return state.refreshing\n  state.refreshing = doRefresh().finally(() => {\n    state.refreshing = null\n  })\n  return state.refreshing\n}\n\n/**\n * The credential to put on the next request. In token mode, refreshes a stale\n * seed first. In raw-key mode, returns the seed unchanged (legacy passthrough).\n */\nexport async function getFreshCredential(\n  seed?: string,\n): Promise<string | undefined> {\n  // Unconfigured but handed a token (a component received the prerendered seed\n  // as a prop before any provider configured the manager): adopt it so the\n  // refresh machinery works instead of replaying a possibly-expired seed.\n  if (!state.isToken && isSiteToken(seed)) {\n    configureSiteCredential({ credential: seed })\n  }\n  // A raw key (or nothing configured) — no token machinery.\n  if (!state.isToken) return seed ?? state.seed\n  if (needsRefresh()) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed) return refreshed\n    // Refresh failed — fall through to whatever we have; the request may 401 and\n    // trip the breaker with friendly copy.\n  }\n  return state.token ?? seed ?? state.seed\n}\n\n/** Whether the given credential is being managed as a token. */\nexport function isTokenMode(): boolean {\n  return state.isToken\n}\n\n/**\n * Best-known credential WITHOUT refreshing — for synchronous unload paths\n * (sonorBeacon) that can't await. In token mode returns the freshest token held;\n * in raw-key mode returns the seed.\n */\nexport function currentCredential(seed?: string): string | undefined {\n  if (!state.isToken) return seed ?? state.seed\n  return state.token ?? seed ?? state.seed\n}\n"]}
+{"version":3,"sources":["../src/shared/siteToken.ts"],"names":["SITE_KIT_VERSION"],"mappings":";;;;;AAuBO,IAAM,iBAAA,GAAoB,MAAA;AAGjC,IAAM,kBAAkB,CAAA,GAAI,GAAA;AAC5B,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,WAAA,GAAc,sBAAA;AAEb,SAAS,YAAY,UAAA,EAAqC;AAC/D,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,IAAY,UAAA,CAAW,WAAW,iBAAiB,CAAA;AAClF;AASO,SAAS,sBAAsB,KAAA,EAA6C;AACjF,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,MAAM,GAAA,GAAO,KAAA,CAAiB,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC1C,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,IAAI;AAEF,IAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACpD,IAAA,MAAM,IAAA,GACJ,OAAO,IAAA,KAAS,UAAA,GACZ,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACnD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,IAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,GAAS,MAAA,GAAS,IAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOO,SAAS,oBAAoB,UAAA,EAAoC;AACtE,EAAA,IAAI,CAAC,YAAY,OAAO,aAAA;AACxB,EAAA,MAAM,MAAA,GAAS,sBAAsB,UAAU,CAAA;AAC/C,EAAA,IAAI,MAAA,EAAQ,GAAA,EAAK,OAAO,CAAA,IAAA,EAAO,OAAO,GAAG,CAAA,CAAA;AACzC,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B;AAeA,SAAS,iBAAA,GAAgC;AACvC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,MAAA;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,MAAA,EAAQ,sBAAA;AAAA,IACR,KAAA,EAAO,IAAA;AAAA,IACP,UAAA,EAAY;AAAA,GACd;AACF;AAcA,IAAM,eAAA,GAAkB,4BAAA;AAExB,IAAM,SAAqB,MAAM;AAC/B,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,iBAAA,EAAkB;AAC5D,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,4CAAuB,iBAAA,EAAkB,CAAA;AACnD,CAAA,GAAG;AAEH,SAAS,eAAA,GAAiC;AACxC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AACrD,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,OAAO,MAAA,EAAQ,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ,IAAA;AAAA,EAC5D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAW,KAAA,EAAqB;AACvC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACnC,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,cAAA,CAAe,QAAQ,WAAA,EAAa,IAAA,CAAK,UAAU,EAAE,KAAA,EAAO,CAAC,CAAA;AAAA,EACtE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA;AAAC,IAAC,OAAe,oBAAA,GAAuB,KAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,SAAS,KAAA,EAA8B;AAC9C,EAAA,MAAM,MAAA,GAAS,sBAAsB,KAAK,CAAA;AAC1C,EAAA,OAAO,OAAO,MAAA,EAAQ,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,MAAM,GAAA,GAAO,CAAA;AAC/D;AAMO,SAAS,wBAAwB,IAAA,EAG/B;AACP,EAAA,KAAA,CAAM,OAAO,IAAA,CAAK,UAAA;AAClB,EAAA,KAAA,CAAM,OAAA,GAAU,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,QAAQ,KAAA,CAAM,MAAA,GAAS,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAE9D,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,IAAA;AAAA,EACF;AAKA,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,EAAA,IAAI,IAAA,GAAO,KAAK,UAAA,IAAc,IAAA;AAC9B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,IAAI,UAAU,QAAA,CAAS,MAAM,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,MAAA;AACxD,EAAA,IAAI,SAAS,QAAA,CAAS,KAAK,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,KAAA;AACtD,EAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AAChB;AAEA,SAAS,YAAA,GAAwB;AAC/B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,KAAA;AAC3B,EAAA,IAAI,CAAC,KAAA,CAAM,KAAA,EAAO,OAAO,IAAA;AACzB,EAAA,OAAO,KAAK,GAAA,EAAI,IAAK,QAAA,CAAS,KAAA,CAAM,KAAK,CAAA,GAAI,eAAA;AAC/C;AAEA,eAAe,SAAA,GAAoC;AACjD,EAAA,MAAM,UAAU,KAAA,CAAM,KAAA;AACtB,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,8BAAA,CAAA,EAAkC;AAAA,MACvE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqBA,iCAAA;AAAA;AAAA;AAAA,QAGrB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACvC,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,kBAAkB,CAAA,GACtC,KAAA;AAAA,KACP,CAAA;AACD,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,OAAO,IAAA;AACpB,IAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC9C,IAAA,MAAM,OAAO,IAAA,EAAM,KAAA;AACnB,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,WAAA,CAAY,IAAI,CAAA,EAAG;AACjD,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,UAAA,CAAW,IAAI,CAAA;AACf,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,gBAAA,GAA2C;AACzD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,UAAA,EAAY,OAAO,KAAA,CAAM,UAAA;AACnC,EAAA,KAAA,CAAM,UAAA,GAAa,SAAA,EAAU,CAAE,OAAA,CAAQ,MAAM;AAC3C,IAAA,KAAA,CAAM,UAAA,GAAa,IAAA;AAAA,EACrB,CAAC,CAAA;AACD,EAAA,OAAO,KAAA,CAAM,UAAA;AACf;AAMA,eAAsB,mBACpB,IAAA,EAC6B;AAI7B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,IAAW,WAAA,CAAY,IAAI,CAAA,EAAG;AACvC,IAAA,uBAAA,CAAwB,EAAE,UAAA,EAAY,IAAA,EAAM,CAAA;AAAA,EAC9C;AAEA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,IAAI,cAAa,EAAG;AAClB,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,WAAW,OAAO,SAAA;AAAA,EAGxB;AACA,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC;AAGO,SAAS,WAAA,GAAuB;AACrC,EAAA,OAAO,KAAA,CAAM,OAAA;AACf;AAOO,SAAS,kBAAkB,IAAA,EAAmC;AACnE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC","file":"chunk-F5RO6HVF.js","sourcesContent":["/**\n * @sonordev/site-kit shared — Client token manager\n *\n * SiteKitLayout (a server component) no longer ships the raw `sonor_` API key to\n * the browser. Instead it mints a short-lived, project-scoped token server-side\n * and injects THAT. This module is the browser-side lifecycle for that token:\n *\n *   - holds the current token (seeded from the injected value)\n *   - a static page's seed can be days old and already expired on first view, so\n *     it transparently REFRESHES via the public endpoint before first use\n *   - dedupes concurrent refreshes (one in-flight request, awaited by all)\n *   - persists the freshest token in sessionStorage so navigations within a\n *     session don't each re-refresh\n *\n * Everything here is a no-op passthrough when the injected credential is a raw\n * key (a 2.x kit, or the mint-failed fallback) — legacy behavior is unchanged.\n * Fully SSR-safe: on the server there is no refresh, just the seed.\n *\n * The token payload is NOT secret (only its HMAC is unforgeable), so decoding it\n * client-side to read `exp`/`pid` is fine and needs no crypto.\n */\nimport { SITE_KIT_VERSION } from './version'\n\nexport const SITE_TOKEN_PREFIX = 'st1.'\n\n/** Refresh this many ms before expiry, so a request never races the deadline. */\nconst REFRESH_SKEW_MS = 5 * 60_000\nconst REFRESH_TIMEOUT_MS = 6_000\nconst STORAGE_KEY = '__sonor_site_token__'\n\nexport function isSiteToken(credential?: string | null): boolean {\n  return typeof credential === 'string' && credential.startsWith(SITE_TOKEN_PREFIX)\n}\n\ninterface DecodedClaims {\n  pid?: string\n  iat?: number\n  exp?: number\n}\n\n/** Decode the (non-secret) token payload. Returns null if not a token / malformed. */\nexport function decodeSiteTokenClaims(token?: string | null): DecodedClaims | null {\n  if (!isSiteToken(token)) return null\n  const seg = (token as string).split('.')[1]\n  if (!seg) return null\n  try {\n    // base64url → JSON. atob handles standard base64; restore url-safe chars.\n    const b64 = seg.replace(/-/g, '+').replace(/_/g, '/')\n    const json =\n      typeof atob === 'function'\n        ? atob(b64)\n        : Buffer.from(seg, 'base64url').toString('utf8')\n    const claims = JSON.parse(json)\n    return typeof claims === 'object' && claims ? claims : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Stable id for the auth circuit breaker. Tokens rotate, so keying the breaker\n * by the raw value would reset it every refresh — key by the project id encoded\n * in the token instead. Raw keys use a safe prefix.\n */\nexport function credentialBreakerId(credential?: string | null): string {\n  if (!credential) return '(anonymous)'\n  const claims = decodeSiteTokenClaims(credential)\n  if (claims?.pid) return `pid:${claims.pid}`\n  return credential.slice(0, 16)\n}\n\ninterface TokenState {\n  /** The credential injected by the layout (token or raw key). */\n  seed: string | undefined\n  /** Whether we're in token mode (seed is a token). */\n  isToken: boolean\n  /** Base API URL for the refresh endpoint. */\n  apiUrl: string\n  /** The freshest known token (>= seed). Null in raw-key mode. */\n  token: string | null\n  /** In-flight refresh, deduped. */\n  refreshing: Promise<string | null> | null\n}\n\nfunction initialTokenState(): TokenState {\n  return {\n    seed: undefined,\n    isToken: false,\n    apiUrl: 'https://api.sonor.io',\n    token: null,\n    refreshing: null,\n  }\n}\n\n/**\n * Page-wide singleton, keyed on window. Bundlers can (and in the field, do)\n * inline more than one copy of this module into a page — e.g. an app importing\n * site-kit directly while a transpiled component library bundles its own copy.\n * Module-scoped state then splits into per-copy brains: one copy gets\n * configured and refreshes fine while the other keeps sending the stale\n * prerendered seed, 401s, and trips its breaker (\"sonor-auth-paused\" with a\n * working network). Sharing the state object on window gives every copy the\n * same token, the same deduped refresh, and the same breaker. On the server\n * (no window) each module instance keeps private state — there's no refresh\n * lifecycle there anyway.\n */\nconst TOKEN_STATE_KEY = '__SONOR_SITE_TOKEN_STATE__'\n\nconst state: TokenState = (() => {\n  if (typeof window === 'undefined') return initialTokenState()\n  const w = window as unknown as Record<string, TokenState | undefined>\n  return (w[TOKEN_STATE_KEY] ??= initialTokenState())\n})()\n\nfunction readStoredToken(): string | null {\n  if (typeof window === 'undefined') return null\n  try {\n    const raw = window.sessionStorage.getItem(STORAGE_KEY)\n    if (!raw) return null\n    const parsed = JSON.parse(raw)\n    return typeof parsed?.token === 'string' ? parsed.token : null\n  } catch {\n    return null\n  }\n}\n\nfunction storeToken(token: string): void {\n  if (typeof window === 'undefined') return\n  try {\n    window.sessionStorage.setItem(STORAGE_KEY, JSON.stringify({ token }))\n  } catch {\n    /* private mode / disabled storage — memory-only is fine */\n  }\n  try {\n    ;(window as any).__SITE_KIT_API_KEY__ = token\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction tokenExp(token: string | null): number {\n  const claims = decodeSiteTokenClaims(token)\n  return typeof claims?.exp === 'number' ? claims.exp * 1000 : 0\n}\n\n/**\n * Configure the manager from the layout-injected values. Adopts a fresher token\n * from sessionStorage if a prior page in this session already refreshed.\n */\nexport function configureSiteCredential(opts: {\n  credential?: string\n  apiUrl?: string\n}): void {\n  state.seed = opts.credential\n  state.isToken = isSiteToken(opts.credential)\n  if (opts.apiUrl) state.apiUrl = opts.apiUrl.replace(/\\/+$/, '')\n\n  if (!state.isToken) {\n    state.token = null\n    return\n  }\n\n  // configure runs on every render — never downgrade. Keep the freshest of the\n  // injected seed, a token stored by an earlier page this session, and whatever\n  // an in-flight/prior refresh already put in memory.\n  const prior = state.token\n  let best = opts.credential ?? null\n  const stored = readStoredToken()\n  if (stored && tokenExp(stored) > tokenExp(best)) best = stored\n  if (prior && tokenExp(prior) > tokenExp(best)) best = prior\n  state.token = best\n}\n\nfunction needsRefresh(): boolean {\n  if (!state.isToken) return false\n  if (!state.token) return true\n  return Date.now() >= tokenExp(state.token) - REFRESH_SKEW_MS\n}\n\nasync function doRefresh(): Promise<string | null> {\n  const current = state.token\n  if (!current) return null\n  try {\n    const res = await fetch(`${state.apiUrl}/api/public/site-token/refresh`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        // Send the current token as x-api-key too, so the server's key-scoped\n        // throttler buckets refreshes by token rather than by shared CDN IP.\n        'x-api-key': current,\n      },\n      body: JSON.stringify({ token: current }),\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(REFRESH_TIMEOUT_MS)\n          : undefined,\n    })\n    if (!res.ok) return null\n    const data = await res.json().catch(() => null)\n    const next = data?.token\n    if (typeof next === 'string' && isSiteToken(next)) {\n      state.token = next\n      storeToken(next)\n      return next\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\n/** Refresh now (deduped). Returns the new token, or null on failure. */\nexport function refreshSiteToken(): Promise<string | null> {\n  if (!state.isToken) return Promise.resolve(null)\n  if (state.refreshing) return state.refreshing\n  state.refreshing = doRefresh().finally(() => {\n    state.refreshing = null\n  })\n  return state.refreshing\n}\n\n/**\n * The credential to put on the next request. In token mode, refreshes a stale\n * seed first. In raw-key mode, returns the seed unchanged (legacy passthrough).\n */\nexport async function getFreshCredential(\n  seed?: string,\n): Promise<string | undefined> {\n  // Unconfigured but handed a token (a component received the prerendered seed\n  // as a prop before any provider configured the manager): adopt it so the\n  // refresh machinery works instead of replaying a possibly-expired seed.\n  if (!state.isToken && isSiteToken(seed)) {\n    configureSiteCredential({ credential: seed })\n  }\n  // A raw key (or nothing configured) — no token machinery.\n  if (!state.isToken) return seed ?? state.seed\n  if (needsRefresh()) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed) return refreshed\n    // Refresh failed — fall through to whatever we have; the request may 401 and\n    // trip the breaker with friendly copy.\n  }\n  return state.token ?? seed ?? state.seed\n}\n\n/** Whether the given credential is being managed as a token. */\nexport function isTokenMode(): boolean {\n  return state.isToken\n}\n\n/**\n * Best-known credential WITHOUT refreshing — for synchronous unload paths\n * (sonorBeacon) that can't await. In token mode returns the freshest token held;\n * in raw-key mode returns the seed.\n */\nexport function currentCredential(seed?: string): string | undefined {\n  if (!state.isToken) return seed ?? state.seed\n  return state.token ?? seed ?? state.seed\n}\n"]}

package/dist/chunk-FCAHV5P3.mjs

@@ -0,0 +1,45 @@
+import { jsx } from 'react/jsx-runtime';
+
+// src/forms/HoneypotField.tsx
+function HoneypotField({ name, value, onChange }) {
+  const interactive = typeof onChange === "function";
+  return /* @__PURE__ */ jsx(
+    "input",
+    {
+      type: "text",
+      name,
+      tabIndex: -1,
+      autoComplete: "new-password",
+      "aria-hidden": "true",
+      inert: true,
+      "data-sk-honeypot": "",
+      "data-1p-ignore": "",
+      "data-lpignore": "true",
+      "data-form-type": "other",
+      "data-bwignore": "",
+      style: {
+        position: "absolute",
+        left: -9999,
+        width: 1,
+        height: 1,
+        overflow: "hidden",
+        opacity: 0,
+        visibility: "hidden",
+        pointerEvents: "none"
+      },
+      ...interactive ? {
+        value: value ?? "",
+        onChange: (e) => {
+          onChange(e.target.value);
+          if (e.target.value) {
+            console.warn("[Forms] Honeypot triggered");
+          }
+        }
+      } : { defaultValue: "" }
+    }
+  );
+}
+
+export { HoneypotField };
+//# sourceMappingURL=chunk-FCAHV5P3.mjs.map
+//# sourceMappingURL=chunk-FCAHV5P3.mjs.map

package/dist/chunk-FCAHV5P3.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/forms/HoneypotField.tsx"],"names":[],"mappings":";;;AAqCO,SAAS,aAAA,CAAc,EAAE,IAAA,EAAM,KAAA,EAAO,UAAS,EAAuB;AAC3E,EAAA,MAAM,WAAA,GAAc,OAAO,QAAA,KAAa,UAAA;AACxC,EAAA,uBACE,GAAA;AAAA,IAAC,OAAA;AAAA,IAAA;AAAA,MACC,IAAA,EAAK,MAAA;AAAA,MACL,IAAA;AAAA,MACA,QAAA,EAAU,EAAA;AAAA,MACV,YAAA,EAAa,cAAA;AAAA,MACb,aAAA,EAAY,MAAA;AAAA,MACZ,KAAA,EAAK,IAAA;AAAA,MACL,kBAAA,EAAiB,EAAA;AAAA,MAGjB,gBAAA,EAAe,EAAA;AAAA,MACf,eAAA,EAAc,MAAA;AAAA,MACd,gBAAA,EAAe,OAAA;AAAA,MACf,eAAA,EAAc,EAAA;AAAA,MACd,KAAA,EAAO;AAAA,QACL,QAAA,EAAU,UAAA;AAAA,QACV,IAAA,EAAM,KAAA;AAAA,QACN,KAAA,EAAO,CAAA;AAAA,QACP,MAAA,EAAQ,CAAA;AAAA,QACR,QAAA,EAAU,QAAA;AAAA,QACV,OAAA,EAAS,CAAA;AAAA,QACT,UAAA,EAAY,QAAA;AAAA,QACZ,aAAA,EAAe;AAAA,OACjB;AAAA,MACC,GAAI,WAAA,GACD;AAAA,QACE,OAAO,KAAA,IAAS,EAAA;AAAA,QAChB,QAAA,EAAU,CAAC,CAAA,KAA2C;AACpD,UAAA,QAAA,CAAU,CAAA,CAAE,OAAO,KAAK,CAAA;AACxB,UAAA,IAAI,CAAA,CAAE,OAAO,KAAA,EAAO;AAElB,YAAA,OAAA,CAAQ,KAAK,4BAA4B,CAAA;AAAA,UAC3C;AAAA,QACF;AAAA,OACF,GACA,EAAE,YAAA,EAAc,EAAA;AAAG;AAAA,GACzB;AAEJ","file":"chunk-FCAHV5P3.mjs","sourcesContent":["/**\n * Single source of truth for the honeypot input — rendered by BOTH form\n * experiences (classic and stage) inside their <form>. The customRender path\n * deliberately gets none (documented limitation: custom renders lose the\n * honeypot, which is why alternate experiences must be render branches).\n *\n * Invariants (do not weaken any of these):\n * - `inert` blocks focus/interaction at the browser level, surviving hostile\n *   site CSS that could defeat the inline styles.\n * - data-sk-honeypot gives site CSS a stable opt-OUT hook.\n * - Controlled input: bots filling via JS still fire React onChange, so the\n *   value reaches submitForm's data payload.\n * - Name comes from config (`honeypot_field || DEFAULT_HONEYPOT_FIELD` from\n *   the shared contract) — resolved by the caller, never forked here.\n * - The trap must be invisible to AUTOFILL as well as to people. A browser or\n *   password manager filling a hidden input flags a real visitor as a bot, and\n *   because the value is stripped server-side the mistake is undiagnosable\n *   after the fact. `autocomplete=\"off\"` does not achieve this — it is the one\n *   value Chrome deliberately ignores for contact/address autofill — so the\n *   trap declares `new-password` (never offered saved contact data) plus the\n *   documented per-manager opt-outs.\n */\n\nimport React from 'react'\n\nexport interface HoneypotFieldProps {\n  name: string\n  value?: string\n  /**\n   * Omit for STATIC mode — an uncontrolled trap a Server Component can render.\n   * The trap's whole job is server-side (the value is read off the submission\n   * and stripped), so it needs no client state to work; the controlled form is\n   * only so the hydrated JSON path can read it back out of React state.\n   */\n  onChange?: (value: string) => void\n}\n\nexport function HoneypotField({ name, value, onChange }: HoneypotFieldProps) {\n  const interactive = typeof onChange === 'function'\n  return (\n    <input\n      type=\"text\"\n      name={name}\n      tabIndex={-1}\n      autoComplete=\"new-password\"\n      aria-hidden=\"true\"\n      inert\n      data-sk-honeypot=\"\"\n      // Password-manager opt-outs: 1Password, LastPass, Dashlane, Bitwarden.\n      // Each ignores its own attribute; none respects autocomplete alone.\n      data-1p-ignore=\"\"\n      data-lpignore=\"true\"\n      data-form-type=\"other\"\n      data-bwignore=\"\"\n      style={{\n        position: 'absolute',\n        left: -9999,\n        width: 1,\n        height: 1,\n        overflow: 'hidden',\n        opacity: 0,\n        visibility: 'hidden',\n        pointerEvents: 'none',\n      }}\n      {...(interactive\n        ? {\n            value: value ?? '',\n            onChange: (e: React.ChangeEvent<HTMLInputElement>) => {\n              onChange!(e.target.value)\n              if (e.target.value) {\n                // Bot detected\n                console.warn('[Forms] Honeypot triggered')\n              }\n            },\n          }\n        : { defaultValue: '' })}\n    />\n  )\n}\n"]}

package/dist/chunk-GBMVAKX3.mjs

@@ -0,0 +1,6 @@
+// src/shared/version.ts
+var SITE_KIT_VERSION = "6.3.3";
+
+export { SITE_KIT_VERSION };
+//# sourceMappingURL=chunk-GBMVAKX3.mjs.map
+//# sourceMappingURL=chunk-GBMVAKX3.mjs.map

package/dist/{chunk-C654VCWV.mjs.map → chunk-GBMVAKX3.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";AASO,IAAM,gBAAA,GAAmB","file":"chunk-C654VCWV.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared - Package version constant\n *\n * Single source of truth for the version the kit reports at runtime (the\n * x-sitekit-version request header set by sonorFetch). Kept as a plain const\n * so client bundles don't need JSON imports; scripts/verify-dts.cjs asserts\n * it matches package.json at publish time, and version.test.ts asserts it in\n * dev, so it can't silently drift.\n */\nexport const SITE_KIT_VERSION = '6.3.1'\n"]}
+{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";AASO,IAAM,gBAAA,GAAmB","file":"chunk-GBMVAKX3.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared - Package version constant\n *\n * Single source of truth for the version the kit reports at runtime (the\n * x-sitekit-version request header set by sonorFetch). Kept as a plain const\n * so client bundles don't need JSON imports; scripts/verify-dts.cjs asserts\n * it matches package.json at publish time, and version.test.ts asserts it in\n * dev, so it can't silently drift.\n */\nexport const SITE_KIT_VERSION = '6.3.3'\n"]}

package/dist/{chunk-KAJT3MOM.mjs → chunk-GFWSYLGO.mjs}

@@ -1,9 +1,9 @@
 'use client';
 import { chatLauncherStyles } from './chunk-4U5NCKQY.mjs';
 import { GlassStyles } from './chunk-OBKS3CPP.mjs';
-import { useForm } from './chunk-YUCKBIRE.mjs';
+import { useForm } from './chunk-PHTL4CPD.mjs';
 import { parseColor, relativeLuminance, DARK_LUMINANCE, contrastRatio } from './chunk-NYXENHD2.mjs';
-import { sonorFetch } from './chunk-XNZ2WFXR.mjs';
+import { sonorFetch } from './chunk-377Z7GOV.mjs';
 import { useState, useEffect, useRef, useLayoutEffect, useCallback } from 'react';
 import ReactMarkdown from 'react-markdown';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
@@ -1665,5 +1665,5 @@ function EchoChat({ projectId, widgetConfig, config, apiUrl: propApiUrl, signalU
 }
 
 export { ChatWidget, EchoChat, isChatEnabled };
-//# sourceMappingURL=chunk-KAJT3MOM.mjs.map
-//# sourceMappingURL=chunk-KAJT3MOM.mjs.map
+//# sourceMappingURL=chunk-GFWSYLGO.mjs.map
+//# sourceMappingURL=chunk-GFWSYLGO.mjs.map