@sonordev/site-kit 6.3.6 → 6.5.0

package/dist/chunk-JCDX37BY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared/frame.ts"],"names":[],"mappings":";;;AA4DO,SAAS,QAAA,GAAoB;AAClC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,IAAI;AACF,IAAA,OAAO,MAAA,CAAO,SAAS,MAAA,CAAO,GAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAMO,SAAS,oBAAA,GAAgC;AAC9C,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,IAAI;AACF,IAAA,OAAO,OAAO,MAAA,CAAO,GAAA,EAAK,QAAA,EAAU,IAAA,KAAS,QAAA;AAAA,EAC/C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAMO,SAAS,kBAAA,GAA8B;AAC5C,EAAA,IAAI,CAAC,QAAA,EAAS,EAAG,OAAO,KAAA;AACxB,EAAA,OAAO,CAAC,oBAAA,EAAqB;AAC/B;AAiBO,IAAM,mBAAA,GAAsB;AAQ5B,SAAS,oBAAoB,IAAA,EAA0C;AAC5E,EAAA,OACE,CAAC,CAAC,IAAA,IACF,OAAO,IAAA,KAAS,YACf,IAAA,CAA4B,IAAA,KAAS,mBAAA,IACrC,IAAA,CAAyB,CAAA,KAAM,CAAA;AAEpC;AAQO,SAAS,kBAAA,GAAiC;AAC/C,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,CAAC,kBAAA,EAAmB,SAAU,MAAM;AAAA,EAAC,CAAA;AAC1E,EAAA,IAAI,SAAA,GAAY,KAAA;AAChB,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,MAAM,OAAO,MAAM;AACjB,IAAA,GAAA,GAAM,sBAAsB,MAAM;AAChC,MAAA,GAAA,GAAM,sBAAsB,MAAM;AAChC,QAAA,IAAI,SAAA,EAAW;AACf,QAAA,MAAM,OAAA,GAA6B,EAAE,IAAA,EAAM,mBAAA,EAAqB,GAAG,CAAA,EAAE;AACrE,QAAA,MAAA,CAAO,MAAA,CAAO,WAAA,CAAY,OAAA,EAAS,GAAG,CAAA;AAAA,MACxC,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH,CAAA;AACA,EAAA,IAAI,QAAA,CAAS,UAAA,KAAe,UAAA,EAAY,IAAA,EAAK;AAAA,cACjC,gBAAA,CAAiB,MAAA,EAAQ,MAAM,EAAE,IAAA,EAAM,MAAM,CAAA;AACzD,EAAA,OAAO,MAAM;AACX,IAAA,SAAA,GAAY,IAAA;AACZ,IAAA,oBAAA,CAAqB,GAAG,CAAA;AACxB,IAAA,MAAA,CAAO,mBAAA,CAAoB,QAAQ,IAAI,CAAA;AAAA,EACzC,CAAA;AACF","file":"chunk-JCDX37BY.js","sourcesContent":["/**\n * @sonordev/site-kit shared — am I inside someone else's page?\n *\n * SINGLE SOURCE OF TRUTH for the frame relationship. Any module that has to\n * decide whether this document is an embed imports from here; nobody writes a\n * second `window.top` check. Two copies of this rule would drift, and the\n * drift is invisible — a module that answers \"not framed\" when it is just\n * quietly writes another tenant's traffic into a client's project.\n *\n * ─── Why it exists ─────────────────────────────────────────────────────────\n *\n * Upforge case studies embed each client's whole production site in three\n * eager iframes (agency-site-kit `DeviceTrifolio`), and\n * `proxy/securityHeaders.ts`'s DEFAULT_FRAME_ANCESTORS lets upforge.io and\n * upforgelabs.com frame every managed site. Inside that frame the client's\n * site loads, hydrates and runs its site-kit modules exactly as it would for\n * a real visitor — the screenshot overlay covers the PIXELS, not the\n * JavaScript. Anything that phones home from there is attributing a visit to\n * upforge.io's page to the client's own project. Measured effect, and the\n * analytics decision built on this: `analytics/send-gate.ts`.\n *\n * ─── Detection ─────────────────────────────────────────────────────────────\n *\n * `window.self !== window.top` is the reliable signal. `top` is a\n * cross-origin-readable property, so the comparison never throws — unlike\n * touching `top.location`, which is exactly what makes the naive check\n * unusable and is the reason this is written down once.\n *\n * Same-origin is then probed by *actually reading* `top.location.href` and\n * catching the SecurityError. That is the only honest test: comparing URL\n * strings cannot see through a sandboxed, opaque, or `about:blank` origin,\n * and would call a hostile embedder same-origin if it faked the right host.\n *\n * The probe only runs when the document IS framed, so the top-level case —\n * every real visitor on every site — costs one property comparison and never\n * enters a try/catch.\n *\n * ─── Same-origin frames are NOT treated as embeds ──────────────────────────\n *\n * Being framed is not the problem; being framed by SOMEONE ELSE is. When the\n * top document is same-origin the site is embedding itself — a preview pane,\n * a print view, an on-domain booking or checkout frame. The visitor really is\n * on that site, the operator controls both documents, and there is no other\n * tenant's project to pollute. Callers should keep working normally there;\n * treating it as an embed would drop legitimate data to buy nothing.\n *\n * Nesting resolves the way you would want, because these compare against\n * `window.top` and not `window.parent`: a same-origin frame nested inside a\n * cross-origin one (upforge.io → client.com → client.com/widget) is still\n * correctly reported as a cross-origin embed.\n */\n\n/**\n * True when this document is not the top-level browsing context.\n *\n * Never throws in practice; the catch exists so a hostile or exotic embedder\n * cannot crash a caller, and it fails CLOSED (treat \"cannot tell\" as framed).\n * A false positive costs one site some of its own data; a false negative\n * writes into someone else's — the asymmetry decides the default.\n */\nexport function isFramed(): boolean {\n  if (typeof window === 'undefined') return false\n  try {\n    return window.self !== window.top\n  } catch {\n    return true\n  }\n}\n\n/**\n * True when the TOP document is same-origin and therefore readable.\n * Only meaningful when {@link isFramed} is true.\n */\nexport function isTopFrameSameOrigin(): boolean {\n  if (typeof window === 'undefined') return false\n  try {\n    return typeof window.top?.location?.href === 'string'\n  } catch {\n    return false\n  }\n}\n\n/**\n * True when this document is running inside a CROSS-ORIGIN frame — i.e. it is\n * someone else's embed, and its activity is not this site's traffic.\n */\nexport function isCrossOriginFrame(): boolean {\n  if (!isFramed()) return false\n  return !isTopFrameSameOrigin()\n}\n\n// ─── Telling the embedder this page has painted ────────────────────────────\n//\n// A case study shows a client's live site inside device frames, over a\n// screenshot of it. The screenshot should give way once the live page has\n// actually painted, and the embedder can't see that for itself: reading a\n// cross-origin frame's document returns null whether the site loaded or the\n// frame was blocked, so a check from outside never succeeds (it didn't, for\n// months, and the screenshot never faded). The frame has to say so itself.\n//\n// So a site-kit page framed by another origin posts FRAME_READY_MESSAGE to\n// its parent once it has loaded and painted. The payload carries nothing but\n// its type and version, so '*' as the target origin leaks nothing; the\n// embedder checks event.source against its own iframe before trusting it.\n\n/** The message a cross-origin-framed site-kit page posts to its embedder once it has painted. */\nexport const FRAME_READY_MESSAGE = 'sonor:frame-ready' as const\n\nexport interface FrameReadyMessage {\n  type: typeof FRAME_READY_MESSAGE\n  v: 1\n}\n\n/** True for a {@link FrameReadyMessage}, for the embedder's message handler. */\nexport function isFrameReadyMessage(data: unknown): data is FrameReadyMessage {\n  return (\n    !!data &&\n    typeof data === 'object' &&\n    (data as { type?: unknown }).type === FRAME_READY_MESSAGE &&\n    (data as { v?: unknown }).v === 1\n  )\n}\n\n/**\n * Post {@link FRAME_READY_MESSAGE} to the embedder once this page has loaded\n * and painted (the load event, then two animation frames, so the first frame\n * after load has been presented). Does nothing at the top level or in a\n * same-origin frame. Returns a cleanup that cancels a pending post.\n */\nexport function announceFrameReady(): () => void {\n  if (typeof window === 'undefined' || !isCrossOriginFrame()) return () => {}\n  let cancelled = false\n  let raf = 0\n  const post = () => {\n    raf = requestAnimationFrame(() => {\n      raf = requestAnimationFrame(() => {\n        if (cancelled) return\n        const message: FrameReadyMessage = { type: FRAME_READY_MESSAGE, v: 1 }\n        window.parent.postMessage(message, '*')\n      })\n    })\n  }\n  if (document.readyState === 'complete') post()\n  else window.addEventListener('load', post, { once: true })\n  return () => {\n    cancelled = true\n    cancelAnimationFrame(raf)\n    window.removeEventListener('load', post)\n  }\n}\n"]}

package/dist/{chunk-5J4FKRGH.mjs → chunk-MDQLON5R.mjs}

@@ -1,9 +1,9 @@
 'use client';
 import { sanitizeFleetVersion, buildFleetHeartbeatPayload } from './chunk-4WCA2HM6.mjs';
 import { useDeferredActivation } from './chunk-ZVBLXXNJ.mjs';
-import { resolveAnalyticsTarget } from './chunk-A6UYV475.mjs';
-import { sonorFetch } from './chunk-BJKA3XRS.mjs';
-import { SITE_KIT_VERSION } from './chunk-3V6DIQI7.mjs';
+import { resolveAnalyticsTarget } from './chunk-CABEVWKJ.mjs';
+import { sonorFetch } from './chunk-3BLKKF67.mjs';
+import { SITE_KIT_VERSION } from './chunk-GIGUDKLS.mjs';
 import { useRef, useEffect } from 'react';
 
 // src/fleet/heartbeat.ts
@@ -97,5 +97,5 @@ function FleetHeartbeat({
 }
 
 export { FLEET_HEARTBEAT_PATH, FleetHeartbeat, detectNextVersion, sendFleetHeartbeat };
-//# sourceMappingURL=chunk-5J4FKRGH.mjs.map
-//# sourceMappingURL=chunk-5J4FKRGH.mjs.map
+//# sourceMappingURL=chunk-MDQLON5R.mjs.map
+//# sourceMappingURL=chunk-MDQLON5R.mjs.map

package/dist/{chunk-5J4FKRGH.mjs.map → chunk-MDQLON5R.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/fleet/heartbeat.ts","../src/fleet/FleetHeartbeat.tsx"],"names":[],"mappings":";;;;;;;;AAwBO,IAAM,oBAAA,GAAuB;AA4B7B,SAAS,iBAAA,GAAmC;AACjD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,MAAM,CAAA,GAAI,MAAA;AAIV,EAAA,OAAO,qBAAqB,CAAA,CAAE,yBAAA,IAA6B,CAAA,CAAE,IAAA,EAAM,WAAW,IAAI,CAAA;AACpF;AAOA,eAAsB,mBAAmB,IAAA,EAAmD;AAC1F,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,IAAA;AAC3B,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,MAAA,EAAQ,OAAO,KAAA;AAC/B,EAAA,MAAM,MAAA,GAAS,uBAAuB,IAAI,CAAA;AAC1C,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AAEpB,EAAA,MAAM,UAAiC,0BAAA,CAA2B;AAAA,IAChE,UAAA,EAAY,KAAK,UAAA,IAAc,gBAAA;AAAA,IAC/B,aAAa,IAAA,CAAK,WAAA;AAAA,IAClB,SAAS,IAAA,CAAK,OAAA;AAAA,IACd,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,QAAQ,IAAA,CAAK;AAAA,GACd,CAAA;AAED,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,UAAA;AAAA,MAChB,CAAA,EAAG,OAAO,MAAA,CAAO,OAAA,CAAQ,OAAO,EAAE,CAAC,GAAG,oBAAoB,CAAA,CAAA;AAAA,MAC1D;AAAA,QACE,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,QAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAO;AAAA,OAC9B;AAAA,MACA,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAQ,SAAS,CAAA;AAAE,KACtC;AACA,IAAA,IAAI,KAAK,KAAA,EAAO;AAEd,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,wBAAA,EAA2B,GAAA,CAAI,MAAM,CAAA,EAAA,EAAK,OAAA,CAAQ,WAAW,CAAA,EAAA,EAAK,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA,IAAK,MAAM,CAAA,CAAA;AAAA,OACvG;AAAA,IACF;AACA,IAAA,OAAO,GAAA,CAAI,EAAA;AAAA,EACb,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,IAAA,CAAK,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,6CAA6C,GAAG,CAAA;AAC7E,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AC3EA,IAAM,iBAAA,GAAoB,cAAA;AAuBnB,SAAS,cAAA,CAAe;AAAA,EAC7B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,IAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,KAAA,GAAQ,IAAA;AAAA,EACR,cAAA,GAAiB,IAAA;AAAA,EACjB,KAAA,GAAQ,KAAA;AAAA,EACR,YAAA,GAAe,KAAA;AAAA,EACf,cAAA,GAAiB;AACnB,CAAA,EAAwB;AACtB,EAAA,MAAM,KAAA,GAAQ,sBAAsB,KAAK,CAAA;AACzC,EAAA,MAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAE5B,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,KAAA,IAAS,OAAA,CAAQ,OAAA,EAAS;AAC/B,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAEnC,IAAA,MAAM,CAAA,GAAI,MAAA;AAKV,IAAA,MAAM,MAAA,GAAS,uBAAuB,EAAE,MAAA,EAAQ,QAAQ,YAAA,EAAc,cAAA,EAAgB,OAAO,CAAA;AAC7F,IAAA,IAAI,CAAC,MAAA,EAAQ;AACb,IAAA,MAAM,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAA,EAAQ,KAAI,GAAI,MAAA;AAErC,IAAA,MAAM,eAAe,IAAA,IAAQ,CAAA,CAAE,iBAAA,IAAqB,MAAA,CAAO,SAAS,IAAA,IAAQ,EAAA;AAK5E,IAAA,IAAI,cAAA,EAAgB;AAClB,MAAA,MAAM,KAAA,GAAQ,CAAA,EAAG,gBAAgB,CAAA,CAAA,EAAI,YAAY,CAAA,CAAA;AACjD,MAAA,IAAI;AACF,QAAA,IAAI,cAAA,CAAe,OAAA,CAAQ,iBAAiB,CAAA,KAAM,KAAA,EAAO;AACvD,UAAA,OAAA,CAAQ,OAAA,GAAU,IAAA;AAClB,UAAA;AAAA,QACF;AACA,QAAA,cAAA,CAAe,OAAA,CAAQ,mBAAmB,KAAK,CAAA;AAAA,MACjD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAEA,IAAA,OAAA,CAAQ,OAAA,GAAU,IAAA;AAClB,IAAA,KAAK,kBAAA,CAAmB;AAAA,MACtB,MAAA,EAAQ,GAAA;AAAA,MACR,MAAA,EAAQ,GAAA;AAAA,MACR,IAAA,EAAM,YAAA;AAAA,MACN,OAAA;AAAA,MACA,WAAA,EAAa,eAAe,iBAAA,EAAkB;AAAA,MAC9C,MAAA,EAAQ,QAAA;AAAA,MACR,YAAA;AAAA,MACA,cAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH,CAAA,EAAG,CAAC,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,WAAA,EAAa,cAAA,EAAgB,KAAA,EAAO,YAAA,EAAc,cAAc,CAAC,CAAA;AAE3G,EAAA,OAAO,IAAA;AACT","file":"chunk-5J4FKRGH.mjs","sourcesContent":["/**\n * @sonordev/site-kit/fleet — heartbeat sender (single source of truth for the POST)\n *\n * One place that turns fleet inputs into a validated payload and ships it to\n * `/api/public/fleet/heartbeat`. Used by BOTH the client component\n * (FleetHeartbeat) and any build-time caller, so the send path never forks.\n *\n * It routes through the shared analytics send gate and `sonorFetch`, which stamps\n * the x-sitekit-version header, attaches x-api-key, and honors the auth\n * circuit breaker — a site on a stale/canceled key will not spam the API.\n */\n\nimport { resolveAnalyticsTarget, type AnalyticsGateOptions } from '../shared/reporting-gate'\nimport { sonorFetch } from '../shared/sonorFetch'\nimport { SITE_KIT_VERSION } from '../shared/version'\nimport {\n  buildFleetHeartbeatPayload,\n  sanitizeFleetVersion,\n  type FleetHeartbeatPayload,\n  type FleetHeartbeatSource,\n  type FleetModule,\n} from './contract'\n\n/** Canonical ingest path — resolved against the site's Sonor API origin. */\nexport const FLEET_HEARTBEAT_PATH = '/api/public/fleet/heartbeat'\n\nexport interface SendFleetHeartbeatOptions extends AnalyticsGateOptions {\n  /** Sonor API origin (e.g. https://api.sonor.io). Trailing slash tolerated. */\n  apiUrl: string\n  /** Project API key — scopes the request; the project is resolved server-side. */\n  apiKey: string\n  /** Client-observable active modules (validated/deduped by the contract). */\n  modules?: FleetModule[] | string[]\n  /** Normalized host for the multi-site sub-dimension (server re-normalizes). */\n  site?: string | null\n  /** Installed Next.js version, if the caller can resolve it. */\n  nextVersion?: string | null\n  /** 'client' (runtime boot) or 'build' (CI). Default 'client'. */\n  source?: FleetHeartbeatSource\n  /** Override the reported kit version. Defaults to the runtime SITE_KIT_VERSION. */\n  kitVersion?: string\n  /** Log one info line with the result. Never logs at error level. */\n  debug?: boolean\n}\n\n/**\n * Best-effort runtime detection of the host Next.js version. Unreliable by\n * design — Next does not expose its version consistently across app/pages\n * router — so it returns null unless a site injects `__SITE_KIT_NEXT_VERSION__`\n * or `window.next.version` is present. Build-time callers should pass\n * `nextVersion` explicitly (resolvable from `next/package.json`).\n */\nexport function detectNextVersion(): string | null {\n  if (typeof window === 'undefined') return null\n  const w = window as unknown as {\n    __SITE_KIT_NEXT_VERSION__?: string\n    next?: { version?: string }\n  }\n  return sanitizeFleetVersion(w.__SITE_KIT_NEXT_VERSION__ ?? w.next?.version ?? null)\n}\n\n/**\n * Fire one heartbeat. Fire-and-forget by contract: it never throws — a\n * telemetry POST must never break a visitor's page or a site's build. Returns\n * true only when the POST was accepted (2xx).\n */\nexport async function sendFleetHeartbeat(opts: SendFleetHeartbeatOptions): Promise<boolean> {\n  const { apiUrl, apiKey } = opts\n  if (!apiUrl || !apiKey) return false\n  const target = resolveAnalyticsTarget(opts)\n  if (!target) return false\n\n  const payload: FleetHeartbeatPayload = buildFleetHeartbeatPayload({\n    kitVersion: opts.kitVersion || SITE_KIT_VERSION,\n    nextVersion: opts.nextVersion,\n    modules: opts.modules,\n    site: opts.site,\n    source: opts.source,\n  })\n\n  try {\n    const res = await sonorFetch(\n      `${target.apiUrl.replace(/\\/$/, '')}${FLEET_HEARTBEAT_PATH}`,\n      {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(payload),\n      },\n      { apiKey: target.apiKey, retries: 0 },\n    )\n    if (opts.debug) {\n      // info, never error: a visitor's console must stay clean (Lighthouse).\n      console.info(\n        `[Sonor fleet] heartbeat ${res.status} v${payload.kit_version} [${payload.modules.join(',') || 'none'}]`,\n      )\n    }\n    return res.ok\n  } catch (err) {\n    if (opts.debug) console.info('[Sonor fleet] heartbeat skipped (network)', err)\n    return false\n  }\n}\n","/**\n * @sonordev/site-kit/fleet — FleetHeartbeat\n *\n * A childless, effect-only client component that reports this site's build\n * fingerprint (kit version, Next.js version, active modules, host) to Sonor\n * exactly once per browser session. It exists so the platform can answer\n * \"which version / modules / key state is each site running\" without shelling\n * into every client repo.\n *\n * It is mounted as a deferred, CHILDLESS SIBLING — never a wrapper — by\n * SiteKitClientProviders, behind the same idle/first-interaction gate as\n * Analytics and Engage, so it never enters the critical hydration path (see\n * CLAUDE.md \"the page must server-render\"). It renders null and carries no\n * visitor data.\n */\n\n'use client'\n\nimport { useEffect, useRef } from 'react'\nimport { useDeferredActivation } from '../shared/defer'\nimport { SITE_KIT_VERSION } from '../shared/version'\nimport { detectNextVersion, sendFleetHeartbeat } from './heartbeat'\nimport { resolveAnalyticsTarget, type AnalyticsGateOptions } from '../shared/reporting-gate'\nimport type { FleetModule } from './contract'\n\n/** Session guard key — one heartbeat per session, re-sent when version/host changes. */\nconst SESSION_GUARD_KEY = '_sk_fleet_hb'\n\nexport interface FleetHeartbeatProps extends AnalyticsGateOptions {\n  /** Sonor API origin. Falls back to `window.__SITE_KIT_API_URL__` then api.sonor.io. */\n  apiUrl?: string\n  /** Project API key. Falls back to `window.__SITE_KIT_API_KEY__`. */\n  apiKey?: string\n  /** Host for the multi-site sub-dimension. Falls back to `__SITE_KIT_SITE__` then location.host. */\n  site?: string | null\n  /** Client-observable active modules (SiteKitClientProviders passes the enabled set). */\n  modules?: FleetModule[]\n  /** Installed Next.js version if known; otherwise best-effort runtime detection. */\n  nextVersion?: string | null\n  /**\n   * Self-defer to idle / first interaction. Default true so standalone use is\n   * safe. SiteKitClientProviders already gates the mount and passes false.\n   */\n  defer?: boolean\n  /** Send at most once per browser session per (version, host). Default true. */\n  oncePerSession?: boolean\n  debug?: boolean\n}\n\nexport function FleetHeartbeat({\n  apiUrl,\n  apiKey,\n  site,\n  modules,\n  nextVersion,\n  defer = true,\n  oncePerSession = true,\n  debug = false,\n  allowInFrame = false,\n  allowLocalhost = false,\n}: FleetHeartbeatProps) {\n  const ready = useDeferredActivation(defer)\n  const sentRef = useRef(false)\n\n  useEffect(() => {\n    if (!ready || sentRef.current) return\n    if (typeof window === 'undefined') return\n\n    const w = window as unknown as {\n      __SITE_KIT_API_URL__?: string\n      __SITE_KIT_API_KEY__?: string\n      __SITE_KIT_SITE__?: string\n    }\n    const target = resolveAnalyticsTarget({ apiUrl, apiKey, allowInFrame, allowLocalhost, debug })\n    if (!target) return // Gate before stamping session storage.\n    const { apiUrl: url, apiKey: key } = target\n\n    const resolvedSite = site ?? w.__SITE_KIT_SITE__ ?? window.location.host ?? ''\n\n    // Once-per-session-per-(version,host): keeps heartbeat volume to one POST\n    // per visitor session while still re-reporting after an upgrade or on a\n    // different sub-site. Storage-disabled browsers simply send once per load.\n    if (oncePerSession) {\n      const stamp = `${SITE_KIT_VERSION}:${resolvedSite}`\n      try {\n        if (sessionStorage.getItem(SESSION_GUARD_KEY) === stamp) {\n          sentRef.current = true\n          return\n        }\n        sessionStorage.setItem(SESSION_GUARD_KEY, stamp)\n      } catch {\n        /* storage unavailable — fall through and send this load */\n      }\n    }\n\n    sentRef.current = true\n    void sendFleetHeartbeat({\n      apiUrl: url,\n      apiKey: key,\n      site: resolvedSite,\n      modules,\n      nextVersion: nextVersion ?? detectNextVersion(),\n      source: 'client',\n      allowInFrame,\n      allowLocalhost,\n      debug,\n    })\n  }, [ready, apiUrl, apiKey, site, modules, nextVersion, oncePerSession, debug, allowInFrame, allowLocalhost])\n\n  return null\n}\n"]}
+{"version":3,"sources":["../src/fleet/heartbeat.ts","../src/fleet/FleetHeartbeat.tsx"],"names":[],"mappings":";;;;;;;;AAwBO,IAAM,oBAAA,GAAuB;AA4B7B,SAAS,iBAAA,GAAmC;AACjD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,MAAM,CAAA,GAAI,MAAA;AAIV,EAAA,OAAO,qBAAqB,CAAA,CAAE,yBAAA,IAA6B,CAAA,CAAE,IAAA,EAAM,WAAW,IAAI,CAAA;AACpF;AAOA,eAAsB,mBAAmB,IAAA,EAAmD;AAC1F,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,IAAA;AAC3B,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,MAAA,EAAQ,OAAO,KAAA;AAC/B,EAAA,MAAM,MAAA,GAAS,uBAAuB,IAAI,CAAA;AAC1C,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AAEpB,EAAA,MAAM,UAAiC,0BAAA,CAA2B;AAAA,IAChE,UAAA,EAAY,KAAK,UAAA,IAAc,gBAAA;AAAA,IAC/B,aAAa,IAAA,CAAK,WAAA;AAAA,IAClB,SAAS,IAAA,CAAK,OAAA;AAAA,IACd,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,QAAQ,IAAA,CAAK;AAAA,GACd,CAAA;AAED,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,UAAA;AAAA,MAChB,CAAA,EAAG,OAAO,MAAA,CAAO,OAAA,CAAQ,OAAO,EAAE,CAAC,GAAG,oBAAoB,CAAA,CAAA;AAAA,MAC1D;AAAA,QACE,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,QAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAO;AAAA,OAC9B;AAAA,MACA,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAQ,SAAS,CAAA;AAAE,KACtC;AACA,IAAA,IAAI,KAAK,KAAA,EAAO;AAEd,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,wBAAA,EAA2B,GAAA,CAAI,MAAM,CAAA,EAAA,EAAK,OAAA,CAAQ,WAAW,CAAA,EAAA,EAAK,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA,IAAK,MAAM,CAAA,CAAA;AAAA,OACvG;AAAA,IACF;AACA,IAAA,OAAO,GAAA,CAAI,EAAA;AAAA,EACb,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,IAAA,CAAK,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,6CAA6C,GAAG,CAAA;AAC7E,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AC3EA,IAAM,iBAAA,GAAoB,cAAA;AAuBnB,SAAS,cAAA,CAAe;AAAA,EAC7B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,IAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,KAAA,GAAQ,IAAA;AAAA,EACR,cAAA,GAAiB,IAAA;AAAA,EACjB,KAAA,GAAQ,KAAA;AAAA,EACR,YAAA,GAAe,KAAA;AAAA,EACf,cAAA,GAAiB;AACnB,CAAA,EAAwB;AACtB,EAAA,MAAM,KAAA,GAAQ,sBAAsB,KAAK,CAAA;AACzC,EAAA,MAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAE5B,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,KAAA,IAAS,OAAA,CAAQ,OAAA,EAAS;AAC/B,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAEnC,IAAA,MAAM,CAAA,GAAI,MAAA;AAKV,IAAA,MAAM,MAAA,GAAS,uBAAuB,EAAE,MAAA,EAAQ,QAAQ,YAAA,EAAc,cAAA,EAAgB,OAAO,CAAA;AAC7F,IAAA,IAAI,CAAC,MAAA,EAAQ;AACb,IAAA,MAAM,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAA,EAAQ,KAAI,GAAI,MAAA;AAErC,IAAA,MAAM,eAAe,IAAA,IAAQ,CAAA,CAAE,iBAAA,IAAqB,MAAA,CAAO,SAAS,IAAA,IAAQ,EAAA;AAK5E,IAAA,IAAI,cAAA,EAAgB;AAClB,MAAA,MAAM,KAAA,GAAQ,CAAA,EAAG,gBAAgB,CAAA,CAAA,EAAI,YAAY,CAAA,CAAA;AACjD,MAAA,IAAI;AACF,QAAA,IAAI,cAAA,CAAe,OAAA,CAAQ,iBAAiB,CAAA,KAAM,KAAA,EAAO;AACvD,UAAA,OAAA,CAAQ,OAAA,GAAU,IAAA;AAClB,UAAA;AAAA,QACF;AACA,QAAA,cAAA,CAAe,OAAA,CAAQ,mBAAmB,KAAK,CAAA;AAAA,MACjD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAEA,IAAA,OAAA,CAAQ,OAAA,GAAU,IAAA;AAClB,IAAA,KAAK,kBAAA,CAAmB;AAAA,MACtB,MAAA,EAAQ,GAAA;AAAA,MACR,MAAA,EAAQ,GAAA;AAAA,MACR,IAAA,EAAM,YAAA;AAAA,MACN,OAAA;AAAA,MACA,WAAA,EAAa,eAAe,iBAAA,EAAkB;AAAA,MAC9C,MAAA,EAAQ,QAAA;AAAA,MACR,YAAA;AAAA,MACA,cAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH,CAAA,EAAG,CAAC,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,WAAA,EAAa,cAAA,EAAgB,KAAA,EAAO,YAAA,EAAc,cAAc,CAAC,CAAA;AAE3G,EAAA,OAAO,IAAA;AACT","file":"chunk-MDQLON5R.mjs","sourcesContent":["/**\n * @sonordev/site-kit/fleet — heartbeat sender (single source of truth for the POST)\n *\n * One place that turns fleet inputs into a validated payload and ships it to\n * `/api/public/fleet/heartbeat`. Used by BOTH the client component\n * (FleetHeartbeat) and any build-time caller, so the send path never forks.\n *\n * It routes through the shared analytics send gate and `sonorFetch`, which stamps\n * the x-sitekit-version header, attaches x-api-key, and honors the auth\n * circuit breaker — a site on a stale/canceled key will not spam the API.\n */\n\nimport { resolveAnalyticsTarget, type AnalyticsGateOptions } from '../shared/reporting-gate'\nimport { sonorFetch } from '../shared/sonorFetch'\nimport { SITE_KIT_VERSION } from '../shared/version'\nimport {\n  buildFleetHeartbeatPayload,\n  sanitizeFleetVersion,\n  type FleetHeartbeatPayload,\n  type FleetHeartbeatSource,\n  type FleetModule,\n} from './contract'\n\n/** Canonical ingest path — resolved against the site's Sonor API origin. */\nexport const FLEET_HEARTBEAT_PATH = '/api/public/fleet/heartbeat'\n\nexport interface SendFleetHeartbeatOptions extends AnalyticsGateOptions {\n  /** Sonor API origin (e.g. https://api.sonor.io). Trailing slash tolerated. */\n  apiUrl: string\n  /** Project API key — scopes the request; the project is resolved server-side. */\n  apiKey: string\n  /** Client-observable active modules (validated/deduped by the contract). */\n  modules?: FleetModule[] | string[]\n  /** Normalized host for the multi-site sub-dimension (server re-normalizes). */\n  site?: string | null\n  /** Installed Next.js version, if the caller can resolve it. */\n  nextVersion?: string | null\n  /** 'client' (runtime boot) or 'build' (CI). Default 'client'. */\n  source?: FleetHeartbeatSource\n  /** Override the reported kit version. Defaults to the runtime SITE_KIT_VERSION. */\n  kitVersion?: string\n  /** Log one info line with the result. Never logs at error level. */\n  debug?: boolean\n}\n\n/**\n * Best-effort runtime detection of the host Next.js version. Unreliable by\n * design — Next does not expose its version consistently across app/pages\n * router — so it returns null unless a site injects `__SITE_KIT_NEXT_VERSION__`\n * or `window.next.version` is present. Build-time callers should pass\n * `nextVersion` explicitly (resolvable from `next/package.json`).\n */\nexport function detectNextVersion(): string | null {\n  if (typeof window === 'undefined') return null\n  const w = window as unknown as {\n    __SITE_KIT_NEXT_VERSION__?: string\n    next?: { version?: string }\n  }\n  return sanitizeFleetVersion(w.__SITE_KIT_NEXT_VERSION__ ?? w.next?.version ?? null)\n}\n\n/**\n * Fire one heartbeat. Fire-and-forget by contract: it never throws — a\n * telemetry POST must never break a visitor's page or a site's build. Returns\n * true only when the POST was accepted (2xx).\n */\nexport async function sendFleetHeartbeat(opts: SendFleetHeartbeatOptions): Promise<boolean> {\n  const { apiUrl, apiKey } = opts\n  if (!apiUrl || !apiKey) return false\n  const target = resolveAnalyticsTarget(opts)\n  if (!target) return false\n\n  const payload: FleetHeartbeatPayload = buildFleetHeartbeatPayload({\n    kitVersion: opts.kitVersion || SITE_KIT_VERSION,\n    nextVersion: opts.nextVersion,\n    modules: opts.modules,\n    site: opts.site,\n    source: opts.source,\n  })\n\n  try {\n    const res = await sonorFetch(\n      `${target.apiUrl.replace(/\\/$/, '')}${FLEET_HEARTBEAT_PATH}`,\n      {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(payload),\n      },\n      { apiKey: target.apiKey, retries: 0 },\n    )\n    if (opts.debug) {\n      // info, never error: a visitor's console must stay clean (Lighthouse).\n      console.info(\n        `[Sonor fleet] heartbeat ${res.status} v${payload.kit_version} [${payload.modules.join(',') || 'none'}]`,\n      )\n    }\n    return res.ok\n  } catch (err) {\n    if (opts.debug) console.info('[Sonor fleet] heartbeat skipped (network)', err)\n    return false\n  }\n}\n","/**\n * @sonordev/site-kit/fleet — FleetHeartbeat\n *\n * A childless, effect-only client component that reports this site's build\n * fingerprint (kit version, Next.js version, active modules, host) to Sonor\n * exactly once per browser session. It exists so the platform can answer\n * \"which version / modules / key state is each site running\" without shelling\n * into every client repo.\n *\n * It is mounted as a deferred, CHILDLESS SIBLING — never a wrapper — by\n * SiteKitClientProviders, behind the same idle/first-interaction gate as\n * Analytics and Engage, so it never enters the critical hydration path (see\n * CLAUDE.md \"the page must server-render\"). It renders null and carries no\n * visitor data.\n */\n\n'use client'\n\nimport { useEffect, useRef } from 'react'\nimport { useDeferredActivation } from '../shared/defer'\nimport { SITE_KIT_VERSION } from '../shared/version'\nimport { detectNextVersion, sendFleetHeartbeat } from './heartbeat'\nimport { resolveAnalyticsTarget, type AnalyticsGateOptions } from '../shared/reporting-gate'\nimport type { FleetModule } from './contract'\n\n/** Session guard key — one heartbeat per session, re-sent when version/host changes. */\nconst SESSION_GUARD_KEY = '_sk_fleet_hb'\n\nexport interface FleetHeartbeatProps extends AnalyticsGateOptions {\n  /** Sonor API origin. Falls back to `window.__SITE_KIT_API_URL__` then api.sonor.io. */\n  apiUrl?: string\n  /** Project API key. Falls back to `window.__SITE_KIT_API_KEY__`. */\n  apiKey?: string\n  /** Host for the multi-site sub-dimension. Falls back to `__SITE_KIT_SITE__` then location.host. */\n  site?: string | null\n  /** Client-observable active modules (SiteKitClientProviders passes the enabled set). */\n  modules?: FleetModule[]\n  /** Installed Next.js version if known; otherwise best-effort runtime detection. */\n  nextVersion?: string | null\n  /**\n   * Self-defer to idle / first interaction. Default true so standalone use is\n   * safe. SiteKitClientProviders already gates the mount and passes false.\n   */\n  defer?: boolean\n  /** Send at most once per browser session per (version, host). Default true. */\n  oncePerSession?: boolean\n  debug?: boolean\n}\n\nexport function FleetHeartbeat({\n  apiUrl,\n  apiKey,\n  site,\n  modules,\n  nextVersion,\n  defer = true,\n  oncePerSession = true,\n  debug = false,\n  allowInFrame = false,\n  allowLocalhost = false,\n}: FleetHeartbeatProps) {\n  const ready = useDeferredActivation(defer)\n  const sentRef = useRef(false)\n\n  useEffect(() => {\n    if (!ready || sentRef.current) return\n    if (typeof window === 'undefined') return\n\n    const w = window as unknown as {\n      __SITE_KIT_API_URL__?: string\n      __SITE_KIT_API_KEY__?: string\n      __SITE_KIT_SITE__?: string\n    }\n    const target = resolveAnalyticsTarget({ apiUrl, apiKey, allowInFrame, allowLocalhost, debug })\n    if (!target) return // Gate before stamping session storage.\n    const { apiUrl: url, apiKey: key } = target\n\n    const resolvedSite = site ?? w.__SITE_KIT_SITE__ ?? window.location.host ?? ''\n\n    // Once-per-session-per-(version,host): keeps heartbeat volume to one POST\n    // per visitor session while still re-reporting after an upgrade or on a\n    // different sub-site. Storage-disabled browsers simply send once per load.\n    if (oncePerSession) {\n      const stamp = `${SITE_KIT_VERSION}:${resolvedSite}`\n      try {\n        if (sessionStorage.getItem(SESSION_GUARD_KEY) === stamp) {\n          sentRef.current = true\n          return\n        }\n        sessionStorage.setItem(SESSION_GUARD_KEY, stamp)\n      } catch {\n        /* storage unavailable — fall through and send this load */\n      }\n    }\n\n    sentRef.current = true\n    void sendFleetHeartbeat({\n      apiUrl: url,\n      apiKey: key,\n      site: resolvedSite,\n      modules,\n      nextVersion: nextVersion ?? detectNextVersion(),\n      source: 'client',\n      allowInFrame,\n      allowLocalhost,\n      debug,\n    })\n  }, [ready, apiUrl, apiKey, site, modules, nextVersion, oncePerSession, debug, allowInFrame, allowLocalhost])\n\n  return null\n}\n"]}

package/dist/{chunk-3POB4JKR.js → chunk-MHKD34B4.js}

@@ -3,9 +3,9 @@
 
 var chunkESP5RMB7_js = require('./chunk-ESP5RMB7.js');
 var chunkNBOBOYMT_js = require('./chunk-NBOBOYMT.js');
-var chunkE7EV2AHT_js = require('./chunk-E7EV2AHT.js');
+var chunk6OQYRVMI_js = require('./chunk-6OQYRVMI.js');
 var chunkM2N7NY3V_js = require('./chunk-M2N7NY3V.js');
-var chunkJ4C3JAJF_js = require('./chunk-J4C3JAJF.js');
+var chunkIO65ROAO_js = require('./chunk-IO65ROAO.js');
 var react = require('react');
 var ReactMarkdown = require('react-markdown');
 var jsxRuntime = require('react/jsx-runtime');
@@ -92,7 +92,7 @@ function InlineManagedForm({ slug, prefill, primaryColor, primaryRgb }) {
     submit,
     isSubmitting,
     isComplete
-  } = chunkE7EV2AHT_js.useForm(slug, { initialValues: prefill || {} });
+  } = chunk6OQYRVMI_js.useForm(slug, { initialValues: prefill || {} });
   const cardStyle = {
     marginTop: 8,
     padding: 12,
@@ -441,7 +441,7 @@ function ChatWidget(props) {
     const { apiKey } = getApiConfig();
     if (!apiKey) return;
     let cancelled = false;
-    chunkJ4C3JAJF_js.sonorFetch(`${baseUrl}/api/public/seo/project-info`, {}, { apiKey, retries: 0 }).then((res) => res.ok ? res.json() : null).then((data) => {
+    chunkIO65ROAO_js.sonorFetch(`${baseUrl}/api/public/seo/project-info`, {}, { apiKey, retries: 0 }).then((res) => res.ok ? res.json() : null).then((data) => {
       if (cancelled || !data?.valid || !data?.project_id) return;
       setResolvedProjectId(data.project_id);
     }).catch(() => {
@@ -458,7 +458,7 @@ function ChatWidget(props) {
       return;
     }
     let cancelled = false;
-    chunkJ4C3JAJF_js.sonorFetch(`${baseUrl}/engage/widget/config?projectId=${projectId}`, {}, { apiKey, retries: 0 }).then((res) => res.ok ? res.json() : null).then((json) => {
+    chunkIO65ROAO_js.sonorFetch(`${baseUrl}/engage/widget/config?projectId=${projectId}`, {}, { apiKey, retries: 0 }).then((res) => res.ok ? res.json() : null).then((json) => {
       if (!cancelled) setWidgetConfig(json?.data ?? null);
     }).catch((error) => {
       if (process.env.NODE_ENV === "development") {
@@ -546,7 +546,7 @@ function EchoChat({ projectId, widgetConfig, config, apiUrl: propApiUrl, signalU
     const apiKey = ensureApiKey();
     if (!apiKey) return null;
     try {
-      const response = await chunkJ4C3JAJF_js.sonorFetch(`${baseUrl}/engage/widget/availability?projectId=${projectId}`, {}, { apiKey, retries: 0 });
+      const response = await chunkIO65ROAO_js.sonorFetch(`${baseUrl}/engage/widget/availability?projectId=${projectId}`, {}, { apiKey, retries: 0 });
       if (response.ok) {
         const { data } = await response.json();
         setAvailability(data);
@@ -563,7 +563,7 @@ function EchoChat({ projectId, widgetConfig, config, apiUrl: propApiUrl, signalU
     const apiKey = ensureApiKey();
     if (!apiKey) return null;
     try {
-      const response = await chunkJ4C3JAJF_js.sonorFetch(`${baseUrl}/engage/widget/session`, {
+      const response = await chunkIO65ROAO_js.sonorFetch(`${baseUrl}/engage/widget/session`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
@@ -624,7 +624,7 @@ function EchoChat({ projectId, widgetConfig, config, apiUrl: propApiUrl, signalU
         pageUrl: typeof window !== "undefined" ? window.location.href : void 0,
         ...siteContext ? { siteContext } : {}
       };
-      const res = await chunkJ4C3JAJF_js.sonorFetch(url, {
+      const res = await chunkIO65ROAO_js.sonorFetch(url, {
         method: "POST",
         headers: {
           "Content-Type": "application/json"
@@ -727,7 +727,7 @@ function EchoChat({ projectId, widgetConfig, config, apiUrl: propApiUrl, signalU
         if (currentSessionId) {
           const apiKey = ensureApiKey();
           if (apiKey) {
-            chunkJ4C3JAJF_js.sonorFetch(`${baseUrl}/engage/widget/messages?sessionId=${currentSessionId}`, {}, { apiKey, retries: 0 }).then((res) => res.ok ? res.json() : null).then((json) => {
+            chunkIO65ROAO_js.sonorFetch(`${baseUrl}/engage/widget/messages?sessionId=${currentSessionId}`, {}, { apiKey, retries: 0 }).then((res) => res.ok ? res.json() : null).then((json) => {
               const data = json?.data ?? json;
               if (Array.isArray(data) && data.length) {
                 setMessages((prev) => {
@@ -790,7 +790,7 @@ function EchoChat({ projectId, widgetConfig, config, apiUrl: propApiUrl, signalU
         try {
           const apiKey = ensureApiKey();
           if (!apiKey) return;
-          const response = await chunkJ4C3JAJF_js.sonorFetch(`${baseUrl}/engage/widget/messages?sessionId=${currentSessionId}`, {}, { apiKey, retries: 0 });
+          const response = await chunkIO65ROAO_js.sonorFetch(`${baseUrl}/engage/widget/messages?sessionId=${currentSessionId}`, {}, { apiKey, retries: 0 });
           if (response.ok) {
             const { data } = await response.json();
             setMessages((prev) => {
@@ -920,7 +920,7 @@ function EchoChat({ projectId, widgetConfig, config, apiUrl: propApiUrl, signalU
       form.append("file", file);
       form.append("sessionId", sessionId);
       form.append("visitorId", visitorId);
-      const res = await chunkJ4C3JAJF_js.sonorFetch(`${baseUrl}/engage/widget/upload`, {
+      const res = await chunkIO65ROAO_js.sonorFetch(`${baseUrl}/engage/widget/upload`, {
         method: "POST",
         body: form
       }, { apiKey, retries: 0 });
@@ -1020,7 +1020,7 @@ function EchoChat({ projectId, widgetConfig, config, apiUrl: propApiUrl, signalU
     if (!apiKey) return;
     setCheckingHandoff(true);
     try {
-      const res = await chunkJ4C3JAJF_js.sonorFetch(`${baseUrl}/engage/widget/handoff`, {
+      const res = await chunkIO65ROAO_js.sonorFetch(`${baseUrl}/engage/widget/handoff`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ sessionId })
@@ -1059,7 +1059,7 @@ function EchoChat({ projectId, widgetConfig, config, apiUrl: propApiUrl, signalU
       setIsLoading(true);
       setOfflineError(null);
       try {
-        const response = await chunkJ4C3JAJF_js.sonorFetch(`${baseUrl}/engage/widget/offline-form`, {
+        const response = await chunkIO65ROAO_js.sonorFetch(`${baseUrl}/engage/widget/offline-form`, {
           method: "POST",
           headers: { "Content-Type": "application/json" },
           body: JSON.stringify({
@@ -1673,5 +1673,5 @@ function EchoChat({ projectId, widgetConfig, config, apiUrl: propApiUrl, signalU
 exports.ChatWidget = ChatWidget;
 exports.EchoChat = EchoChat;
 exports.isChatEnabled = isChatEnabled;
-//# sourceMappingURL=chunk-3POB4JKR.js.map
-//# sourceMappingURL=chunk-3POB4JKR.js.map
+//# sourceMappingURL=chunk-MHKD34B4.js.map
+//# sourceMappingURL=chunk-MHKD34B4.js.map