@sonordev/site-kit 6.3.6 → 6.5.0

package/dist/chunk-MXJOKOFK.mjs

@@ -0,0 +1,51 @@
+// src/shared/frame.ts
+function isFramed() {
+  if (typeof window === "undefined") return false;
+  try {
+    return window.self !== window.top;
+  } catch {
+    return true;
+  }
+}
+function isTopFrameSameOrigin() {
+  if (typeof window === "undefined") return false;
+  try {
+    return typeof window.top?.location?.href === "string";
+  } catch {
+    return false;
+  }
+}
+function isCrossOriginFrame() {
+  if (!isFramed()) return false;
+  return !isTopFrameSameOrigin();
+}
+var FRAME_READY_MESSAGE = "sonor:frame-ready";
+function isFrameReadyMessage(data) {
+  return !!data && typeof data === "object" && data.type === FRAME_READY_MESSAGE && data.v === 1;
+}
+function announceFrameReady() {
+  if (typeof window === "undefined" || !isCrossOriginFrame()) return () => {
+  };
+  let cancelled = false;
+  let raf = 0;
+  const post = () => {
+    raf = requestAnimationFrame(() => {
+      raf = requestAnimationFrame(() => {
+        if (cancelled) return;
+        const message = { type: FRAME_READY_MESSAGE, v: 1 };
+        window.parent.postMessage(message, "*");
+      });
+    });
+  };
+  if (document.readyState === "complete") post();
+  else window.addEventListener("load", post, { once: true });
+  return () => {
+    cancelled = true;
+    cancelAnimationFrame(raf);
+    window.removeEventListener("load", post);
+  };
+}
+
+export { FRAME_READY_MESSAGE, announceFrameReady, isCrossOriginFrame, isFrameReadyMessage, isFramed, isTopFrameSameOrigin };
+//# sourceMappingURL=chunk-MXJOKOFK.mjs.map
+//# sourceMappingURL=chunk-MXJOKOFK.mjs.map

package/dist/chunk-MXJOKOFK.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared/frame.ts"],"names":[],"mappings":";AA4DO,SAAS,QAAA,GAAoB;AAClC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,IAAI;AACF,IAAA,OAAO,MAAA,CAAO,SAAS,MAAA,CAAO,GAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAMO,SAAS,oBAAA,GAAgC;AAC9C,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,IAAI;AACF,IAAA,OAAO,OAAO,MAAA,CAAO,GAAA,EAAK,QAAA,EAAU,IAAA,KAAS,QAAA;AAAA,EAC/C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAMO,SAAS,kBAAA,GAA8B;AAC5C,EAAA,IAAI,CAAC,QAAA,EAAS,EAAG,OAAO,KAAA;AACxB,EAAA,OAAO,CAAC,oBAAA,EAAqB;AAC/B;AAiBO,IAAM,mBAAA,GAAsB;AAQ5B,SAAS,oBAAoB,IAAA,EAA0C;AAC5E,EAAA,OACE,CAAC,CAAC,IAAA,IACF,OAAO,IAAA,KAAS,YACf,IAAA,CAA4B,IAAA,KAAS,mBAAA,IACrC,IAAA,CAAyB,CAAA,KAAM,CAAA;AAEpC;AAQO,SAAS,kBAAA,GAAiC;AAC/C,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,CAAC,kBAAA,EAAmB,SAAU,MAAM;AAAA,EAAC,CAAA;AAC1E,EAAA,IAAI,SAAA,GAAY,KAAA;AAChB,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,MAAM,OAAO,MAAM;AACjB,IAAA,GAAA,GAAM,sBAAsB,MAAM;AAChC,MAAA,GAAA,GAAM,sBAAsB,MAAM;AAChC,QAAA,IAAI,SAAA,EAAW;AACf,QAAA,MAAM,OAAA,GAA6B,EAAE,IAAA,EAAM,mBAAA,EAAqB,GAAG,CAAA,EAAE;AACrE,QAAA,MAAA,CAAO,MAAA,CAAO,WAAA,CAAY,OAAA,EAAS,GAAG,CAAA;AAAA,MACxC,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH,CAAA;AACA,EAAA,IAAI,QAAA,CAAS,UAAA,KAAe,UAAA,EAAY,IAAA,EAAK;AAAA,cACjC,gBAAA,CAAiB,MAAA,EAAQ,MAAM,EAAE,IAAA,EAAM,MAAM,CAAA;AACzD,EAAA,OAAO,MAAM;AACX,IAAA,SAAA,GAAY,IAAA;AACZ,IAAA,oBAAA,CAAqB,GAAG,CAAA;AACxB,IAAA,MAAA,CAAO,mBAAA,CAAoB,QAAQ,IAAI,CAAA;AAAA,EACzC,CAAA;AACF","file":"chunk-MXJOKOFK.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared — am I inside someone else's page?\n *\n * SINGLE SOURCE OF TRUTH for the frame relationship. Any module that has to\n * decide whether this document is an embed imports from here; nobody writes a\n * second `window.top` check. Two copies of this rule would drift, and the\n * drift is invisible — a module that answers \"not framed\" when it is just\n * quietly writes another tenant's traffic into a client's project.\n *\n * ─── Why it exists ─────────────────────────────────────────────────────────\n *\n * Upforge case studies embed each client's whole production site in three\n * eager iframes (agency-site-kit `DeviceTrifolio`), and\n * `proxy/securityHeaders.ts`'s DEFAULT_FRAME_ANCESTORS lets upforge.io and\n * upforgelabs.com frame every managed site. Inside that frame the client's\n * site loads, hydrates and runs its site-kit modules exactly as it would for\n * a real visitor — the screenshot overlay covers the PIXELS, not the\n * JavaScript. Anything that phones home from there is attributing a visit to\n * upforge.io's page to the client's own project. Measured effect, and the\n * analytics decision built on this: `analytics/send-gate.ts`.\n *\n * ─── Detection ─────────────────────────────────────────────────────────────\n *\n * `window.self !== window.top` is the reliable signal. `top` is a\n * cross-origin-readable property, so the comparison never throws — unlike\n * touching `top.location`, which is exactly what makes the naive check\n * unusable and is the reason this is written down once.\n *\n * Same-origin is then probed by *actually reading* `top.location.href` and\n * catching the SecurityError. That is the only honest test: comparing URL\n * strings cannot see through a sandboxed, opaque, or `about:blank` origin,\n * and would call a hostile embedder same-origin if it faked the right host.\n *\n * The probe only runs when the document IS framed, so the top-level case —\n * every real visitor on every site — costs one property comparison and never\n * enters a try/catch.\n *\n * ─── Same-origin frames are NOT treated as embeds ──────────────────────────\n *\n * Being framed is not the problem; being framed by SOMEONE ELSE is. When the\n * top document is same-origin the site is embedding itself — a preview pane,\n * a print view, an on-domain booking or checkout frame. The visitor really is\n * on that site, the operator controls both documents, and there is no other\n * tenant's project to pollute. Callers should keep working normally there;\n * treating it as an embed would drop legitimate data to buy nothing.\n *\n * Nesting resolves the way you would want, because these compare against\n * `window.top` and not `window.parent`: a same-origin frame nested inside a\n * cross-origin one (upforge.io → client.com → client.com/widget) is still\n * correctly reported as a cross-origin embed.\n */\n\n/**\n * True when this document is not the top-level browsing context.\n *\n * Never throws in practice; the catch exists so a hostile or exotic embedder\n * cannot crash a caller, and it fails CLOSED (treat \"cannot tell\" as framed).\n * A false positive costs one site some of its own data; a false negative\n * writes into someone else's — the asymmetry decides the default.\n */\nexport function isFramed(): boolean {\n  if (typeof window === 'undefined') return false\n  try {\n    return window.self !== window.top\n  } catch {\n    return true\n  }\n}\n\n/**\n * True when the TOP document is same-origin and therefore readable.\n * Only meaningful when {@link isFramed} is true.\n */\nexport function isTopFrameSameOrigin(): boolean {\n  if (typeof window === 'undefined') return false\n  try {\n    return typeof window.top?.location?.href === 'string'\n  } catch {\n    return false\n  }\n}\n\n/**\n * True when this document is running inside a CROSS-ORIGIN frame — i.e. it is\n * someone else's embed, and its activity is not this site's traffic.\n */\nexport function isCrossOriginFrame(): boolean {\n  if (!isFramed()) return false\n  return !isTopFrameSameOrigin()\n}\n\n// ─── Telling the embedder this page has painted ────────────────────────────\n//\n// A case study shows a client's live site inside device frames, over a\n// screenshot of it. The screenshot should give way once the live page has\n// actually painted, and the embedder can't see that for itself: reading a\n// cross-origin frame's document returns null whether the site loaded or the\n// frame was blocked, so a check from outside never succeeds (it didn't, for\n// months, and the screenshot never faded). The frame has to say so itself.\n//\n// So a site-kit page framed by another origin posts FRAME_READY_MESSAGE to\n// its parent once it has loaded and painted. The payload carries nothing but\n// its type and version, so '*' as the target origin leaks nothing; the\n// embedder checks event.source against its own iframe before trusting it.\n\n/** The message a cross-origin-framed site-kit page posts to its embedder once it has painted. */\nexport const FRAME_READY_MESSAGE = 'sonor:frame-ready' as const\n\nexport interface FrameReadyMessage {\n  type: typeof FRAME_READY_MESSAGE\n  v: 1\n}\n\n/** True for a {@link FrameReadyMessage}, for the embedder's message handler. */\nexport function isFrameReadyMessage(data: unknown): data is FrameReadyMessage {\n  return (\n    !!data &&\n    typeof data === 'object' &&\n    (data as { type?: unknown }).type === FRAME_READY_MESSAGE &&\n    (data as { v?: unknown }).v === 1\n  )\n}\n\n/**\n * Post {@link FRAME_READY_MESSAGE} to the embedder once this page has loaded\n * and painted (the load event, then two animation frames, so the first frame\n * after load has been presented). Does nothing at the top level or in a\n * same-origin frame. Returns a cleanup that cancels a pending post.\n */\nexport function announceFrameReady(): () => void {\n  if (typeof window === 'undefined' || !isCrossOriginFrame()) return () => {}\n  let cancelled = false\n  let raf = 0\n  const post = () => {\n    raf = requestAnimationFrame(() => {\n      raf = requestAnimationFrame(() => {\n        if (cancelled) return\n        const message: FrameReadyMessage = { type: FRAME_READY_MESSAGE, v: 1 }\n        window.parent.postMessage(message, '*')\n      })\n    })\n  }\n  if (document.readyState === 'complete') post()\n  else window.addEventListener('load', post, { once: true })\n  return () => {\n    cancelled = true\n    cancelAnimationFrame(raf)\n    window.removeEventListener('load', post)\n  }\n}\n"]}

package/dist/{chunk-5RNAUYWE.js → chunk-NH2P27MA.js}

@@ -1,26 +1,6 @@
 'use strict';
 
-// src/shared/frame.ts
-function isFramed() {
-  if (typeof window === "undefined") return false;
-  try {
-    return window.self !== window.top;
-  } catch {
-    return true;
-  }
-}
-function isTopFrameSameOrigin() {
-  if (typeof window === "undefined") return false;
-  try {
-    return typeof window.top?.location?.href === "string";
-  } catch {
-    return false;
-  }
-}
-function isCrossOriginFrame() {
-  if (!isFramed()) return false;
-  return !isTopFrameSameOrigin();
-}
+var chunkJCDX37BY_js = require('./chunk-JCDX37BY.js');
 
 // src/shared/reporting-gate.ts
 var announcedSuppression = false;
@@ -31,7 +11,7 @@ function resolveAnalyticsTarget(options = {}) {
   if (!apiKey) return null;
   const hostname = (config?.location?.hostname || "").toLowerCase().replace(/\.+$/, "");
   const local = hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1" || hostname === "0.0.0.0";
-  const optIn = local && options.allowLocalhost !== true ? "allowLocalhost" : !options.allowInFrame && isCrossOriginFrame() ? "allowInFrame" : null;
+  const optIn = local && options.allowLocalhost !== true ? "allowLocalhost" : !options.allowInFrame && chunkJCDX37BY_js.isCrossOriginFrame() ? "allowInFrame" : null;
   if (optIn) {
     if (options.debug && !announcedSuppression) {
       announcedSuppression = true;
@@ -42,9 +22,6 @@ function resolveAnalyticsTarget(options = {}) {
   return { apiUrl, apiKey };
 }
 
-exports.isCrossOriginFrame = isCrossOriginFrame;
-exports.isFramed = isFramed;
-exports.isTopFrameSameOrigin = isTopFrameSameOrigin;
 exports.resolveAnalyticsTarget = resolveAnalyticsTarget;
-//# sourceMappingURL=chunk-5RNAUYWE.js.map
-//# sourceMappingURL=chunk-5RNAUYWE.js.map
+//# sourceMappingURL=chunk-NH2P27MA.js.map
+//# sourceMappingURL=chunk-NH2P27MA.js.map

package/dist/chunk-NH2P27MA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared/reporting-gate.ts"],"names":["isCrossOriginFrame"],"mappings":";;;;;AA4CA,IAAI,oBAAA,GAAuB,KAAA;AAepB,SAAS,sBAAA,CACd,OAAA,GAAgC,EAAC,EACT;AACxB,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,KAAW,WAAA,GAAc,MAAA,GAAY,MAAA;AAI3D,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,IAAU,MAAA,EAAQ,oBAAA,IAAwB,sBAAA;AACjE,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,IAAU,MAAA,EAAQ,oBAAA;AAEzC,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AAKpB,EAAA,MAAM,QAAA,GAAA,CAAY,QAAQ,QAAA,EAAU,QAAA,IAAY,IAAI,WAAA,EAAY,CAAE,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACpF,EAAA,MAAM,KAAA,GAAQ,QAAA,KAAa,WAAA,IAAe,QAAA,CAAS,QAAA,CAAS,YAAY,CAAA,IACtE,QAAA,KAAa,WAAA,IAAe,QAAA,KAAa,OAAA,IAAW,QAAA,KAAa,SACjE,QAAA,KAAa,SAAA;AACf,EAAA,MAAM,KAAA,GAAQ,KAAA,IAAS,OAAA,CAAQ,cAAA,KAAmB,IAAA,GAAO,gBAAA,GACrD,CAAC,OAAA,CAAQ,YAAA,IAAgBA,mCAAA,EAAmB,GAAI,cAAA,GAAiB,IAAA;AACrE,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,IAAI,OAAA,CAAQ,KAAA,IAAS,CAAC,oBAAA,EAAsB;AAC1C,MAAA,oBAAA,GAAuB,IAAA;AACvB,MAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,+CAAA,EAAkD,KAAK,CAAA,sBAAA,CAAwB,CAAA;AAAA,IAC9F;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC1B","file":"chunk-NH2P27MA.js","sourcesContent":["/**\n * Single source of truth for client reporting eligibility and credentials.\n * Analytics, fleet, SitemapSync and Engage all resolve through this gate.\n * Kept separate from transport wrappers so non-analytics modules stay lean.\n */\n\nimport { isCrossOriginFrame } from './frame'\n\n/** Resolved destination for an analytics send. */\nexport interface AnalyticsTarget {\n  apiUrl: string\n  apiKey: string\n}\n\nexport interface AnalyticsGateOptions {\n  /** `apiUrl` prop, when the caller was given one. Falls back to the window global. */\n  apiUrl?: string\n  /** `apiKey` prop, when the caller was given one. Falls back to the window global. */\n  apiKey?: string\n  /**\n   * Opt back in to reporting from inside a cross-origin frame. For a site\n   * deliberately distributed as an embed (a widget, a partner-hosted\n   * booking or menu page) the frame IS the product, and its traffic is real.\n   * Explicit per-site config only — see AnalyticsConfig.allowInFrame. There\n   * is deliberately no window global or env var for this: a silent switch\n   * that turns cross-tenant tracking back on is the failure mode, not the\n   * feature.\n   */\n  allowInFrame?: boolean\n  /** Explicitly allow reporting from local browser hosts. Default false. */\n  allowLocalhost?: boolean\n  /** Emit the one-time diagnostic when a send is suppressed. */\n  debug?: boolean\n}\n\n// Re-exported so analytics consumers have one import for the whole decision.\nexport { isCrossOriginFrame, isFramed, isTopFrameSameOrigin } from './frame'\n\n/**\n * One `console.info` per document, not one per event. A framed page fires\n * page view + journey + vitals + a click's worth of heatmap rows; logging\n * each suppression would turn a correct decision into console spam (and\n * Lighthouse best-practices noise) in someone else's page.\n */\nlet announcedSuppression = false\n\n/** Test seam — resets the once-per-document log latch. */\nexport function __resetSendGate(): void {\n  announcedSuppression = false\n}\n\n/**\n * Resolve where an analytics call should go, or `null` if it must not happen.\n *\n * Returning `null` is the ONLY \"do not send\" signal in this module. Callers\n * that set up listeners or scrape the DOM should resolve first and bail on\n * `null`, so a blocked document never even attaches a scroll or click\n * listener — the guard saves the work, not just the request.\n */\nexport function resolveAnalyticsTarget(\n  options: AnalyticsGateOptions = {},\n): AnalyticsTarget | null {\n  const config = typeof window === 'undefined' ? undefined : window as Window & {\n    __SITE_KIT_API_URL__?: string\n    __SITE_KIT_API_KEY__?: string\n  }\n  const apiUrl = options.apiUrl || config?.__SITE_KIT_API_URL__ || 'https://api.sonor.io'\n  const apiKey = options.apiKey || config?.__SITE_KIT_API_KEY__\n\n  if (!apiKey) return null\n\n  // Single source of truth for browser reporting: use the actual document\n  // hostname, NEVER analytics.site or NEXT_PUBLIC_SITE_URL (often production\n  // domains even when next start is being verified on localhost).\n  const hostname = (config?.location?.hostname || '').toLowerCase().replace(/\\.+$/, '')\n  const local = hostname === 'localhost' || hostname.endsWith('.localhost') ||\n    hostname === '127.0.0.1' || hostname === '[::1]' || hostname === '::1' ||\n    hostname === '0.0.0.0'\n  const optIn = local && options.allowLocalhost !== true ? 'allowLocalhost'\n    : !options.allowInFrame && isCrossOriginFrame() ? 'allowInFrame' : null\n  if (optIn) {\n    if (options.debug && !announcedSuppression) {\n      announcedSuppression = true\n      console.info(`[Site-kit] Reporting suppressed. Set analytics.${optIn} to explicitly opt in.`)\n    }\n    return null\n  }\n\n  return { apiUrl, apiKey }\n}\n"]}

package/dist/{chunk-5DZVQW35.mjs → chunk-OFBEBMXN.mjs}

@@ -1,6 +1,6 @@
 'use client';
-import { useAnalyticsOptional } from './chunk-UJIKP35G.mjs';
-import { sonorFetch } from './chunk-BJKA3XRS.mjs';
+import { useAnalyticsOptional } from './chunk-7F66Y4MA.mjs';
+import { sonorFetch } from './chunk-3BLKKF67.mjs';
 import { jsxs, jsx, Fragment } from 'react/jsx-runtime';
 import React5, { useState, useEffect, useMemo, useRef, useCallback } from 'react';
 
@@ -8010,5 +8010,5 @@ function CapacityBadge({
 }
 
 export { CalendarView, CapacityBadge, CheckoutForm, EventCalendar, EventCheckout, EventEmbed, EventJsonLd, EventModal, EventTile, EventsAgenda, EventsWidget, OfferingCard, OfferingList, ProductDetail, ProductEmbed, ProductGrid, ProductPage, RegistrationForm, SizeChart, UpcomingEvents, createCheckoutSession, createPaymentIntent, fetchActiveProcessor, fetchCategories, fetchLatestOffering, fetchNextEvent, fetchOffering, fetchOfferings, fetchProcessorConfig, fetchProductBySlug, fetchProducts, fetchProductsPublic, fetchServices, fetchShippingRates, fetchUpcomingEvents, formatDate, formatDateRange, formatDateTime, formatPrice, formatTime, getOfferingUrl, getRelativeTimeUntil, getSpotsRemaining, googleCalendarUrl, icsForEvent, icsResponse, isEventSoldOut, registerForEvent, shippingSelection, useEventModal, validateAddress, validateDiscountCode };
-//# sourceMappingURL=chunk-5DZVQW35.mjs.map
-//# sourceMappingURL=chunk-5DZVQW35.mjs.map
+//# sourceMappingURL=chunk-OFBEBMXN.mjs.map
+//# sourceMappingURL=chunk-OFBEBMXN.mjs.map