@sonordev/site-kit 6.4.0 → 6.5.0

package/dist/{chunk-USQPRLSG.mjs → chunk-FPVYKSXE.mjs}

@@ -1,24 +1,25 @@
 'use client';
-import { publishSiteCredential } from './chunk-QOKMH2TD.mjs';
-import { FleetHeartbeat } from './chunk-BI7DH42Z.mjs';
+import { publishSiteCredential } from './chunk-VA2O5OSV.mjs';
+import { FleetHeartbeat } from './chunk-MDQLON5R.mjs';
 import { useDeferredActivation } from './chunk-ZVBLXXNJ.mjs';
-import { SignalBridge } from './chunk-GSU6VTCZ.mjs';
+import { SignalBridge } from './chunk-A2HL22BO.mjs';
 import { resolveSiteHost } from './chunk-KZVSB5WE.mjs';
 import { getOrCreateVisitorId, getOrCreateSessionId } from './chunk-ZZQAGCSI.mjs';
-import React, { useState, useRef, useCallback, Suspense } from 'react';
+import { announceFrameReady, isCrossOriginFrame } from './chunk-MXJOKOFK.mjs';
+import React, { useState, useRef, useCallback, useEffect, Suspense } from 'react';
 import dynamic from 'next/dynamic';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
 
 var LazyAnalyticsProvider = dynamic(
-  () => import('./AnalyticsProvider-4K5T7OQ7.mjs').then((m) => ({ default: m.AnalyticsProvider })),
+  () => import('./AnalyticsProvider-F6KHEAOX.mjs').then((m) => ({ default: m.AnalyticsProvider })),
   { ssr: false }
 );
 var LazyEngageWidget = dynamic(
-  () => import('./EngageWidget-SQU4T7CI.mjs').then((m) => ({ default: m.EngageWidget })),
+  () => import('./EngageWidget-DUEXPVOY.mjs').then((m) => ({ default: m.EngageWidget })),
   { ssr: false }
 );
 var LazySitemapSync = dynamic(
-  () => import('./SitemapSync-NG763CGN.mjs').then((m) => ({ default: m.SitemapSync })),
+  () => import('./SitemapSync-UYDL7T4M.mjs').then((m) => ({ default: m.SitemapSync })),
   { ssr: false }
 );
 function SiteKitClientProviders({
@@ -44,6 +45,7 @@ function SiteKitClientProviders({
   const onPageMetadata = useCallback((metadata) => {
     pageMetadataRef.current = metadata;
   }, []);
+  useEffect(() => announceFrameReady(), []);
   const siblings = [];
   if (signal) {
     const signalConfig = typeof signal === "object" ? signal : {};
@@ -89,8 +91,9 @@ function SiteKitClientProviders({
   }
   if (engage) {
     const engageConfig = typeof engage === "object" ? engage : {};
+    const engageInFrame = engageConfig.allowInFrame === true;
     siblings.push(
-      /* @__PURE__ */ jsx(React.Fragment, { children: modulesReady && /* @__PURE__ */ jsx(
+      /* @__PURE__ */ jsx(React.Fragment, { children: modulesReady && (engageInFrame || !isCrossOriginFrame()) && /* @__PURE__ */ jsx(
         LazyEngageWidget,
         {
           apiUrl,
@@ -147,5 +150,5 @@ function SiteKitClientProviders({
 }
 
 export { SiteKitClientProviders };
-//# sourceMappingURL=chunk-USQPRLSG.mjs.map
-//# sourceMappingURL=chunk-USQPRLSG.mjs.map
+//# sourceMappingURL=chunk-FPVYKSXE.mjs.map
+//# sourceMappingURL=chunk-FPVYKSXE.mjs.map

package/dist/chunk-FPVYKSXE.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/layout/SiteKitClientProviders.tsx"],"names":[],"mappings":";;;;;;;;;;;AAgDA,IAAM,qBAAA,GAAwB,OAAA;AAAA,EAC5B,MAAM,OAAO,kCAAgC,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,iBAAA,EAAkB,CAAE,CAAA;AAAA,EAC3F,EAAE,KAAK,KAAA;AACT,CAAA;AACA,IAAM,gBAAA,GAAmB,OAAA;AAAA,EACvB,MAAM,OAAO,6BAAwB,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,YAAA,EAAa,CAAE,CAAA;AAAA,EAC9E,EAAE,KAAK,KAAA;AACT,CAAA;AACA,IAAM,eAAA,GAAkB,OAAA;AAAA,EACtB,MAAM,OAAO,4BAAgB,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,WAAA,EAAY,CAAE,CAAA;AAAA,EACrE,EAAE,KAAK,KAAA;AACT,CAAA;AAgDO,SAAS,sBAAA,CAAuB;AAAA,EACrC,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA,GAAY,IAAA;AAAA,EACZ,MAAA,GAAS,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EACT,WAAA,GAAc,KAAA;AAAA,EACd,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ;AACV,CAAA,EAAgC;AAG9B,EAAA,MAAM,YAAA,GAAe,sBAAsB,KAAK,CAAA;AAEhD,EAAA,MAAM,eAAA,GACJ,OAAO,SAAA,KAAc,QAAA,GAAW,YAAY,EAAC;AAO/C,EAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,eAAA,CAAgB,IAAI,CAAA;AAIjD,EAAA,qBAAA,CAAsB,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,OAAO,CAAA;AAGrD,EAAA,MAAM,CAAC,SAAS,CAAA,GAAI,QAAA,CAAS,MAAM,sBAAsB,CAAA;AACzD,EAAA,MAAM,CAAC,SAAS,CAAA,GAAI,QAAA,CAAS,MAAM,sBAAsB,CAAA;AAGzD,EAAA,MAAM,eAAA,GAAkB,OAAuC,IAAI,CAAA;AACnE,EAAA,MAAM,cAAA,GAAiB,WAAA,CAAY,CAAC,QAAA,KAAsC;AACxE,IAAA,eAAA,CAAgB,OAAA,GAAU,QAAA;AAAA,EAC5B,CAAA,EAAG,EAAE,CAAA;AAKL,EAAA,SAAA,CAAU,MAAM,kBAAA,EAAmB,EAAG,EAAE,CAAA;AAGxC,EAAA,MAAM,WAAwB,EAAC;AAK/B,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,YAAA,GACJ,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,EAAC;AACzC,IAAA,QAAA,CAAS,IAAA;AAAA,sBACP,GAAA;AAAA,QAAC,YAAA;AAAA,QAAA;AAAA,UAEC,OAAA,EAAO,IAAA;AAAA,UACP,QAAA,EAAU,aAAa,QAAA,KAAa,KAAA;AAAA,UACpC,WAAA,EAAa,aAAa,WAAA,KAAgB,KAAA;AAAA,UAC1C,gBAAA,EAAkB,aAAa,gBAAA,KAAqB,KAAA;AAAA,UACpD,SAAA;AAAA,UACA,SAAA;AAAA,UACA;AAAA,SAAA;AAAA,QAPI;AAAA;AAQN,KACF;AAAA,EACF;AAaA,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,QAAA,CAAS,IAAA;AAAA,sBACP,GAAA,CAAC,MAAM,QAAA,EAAN,EACE,0CACC,GAAA,CAAC,QAAA,EAAA,EAAS,UAAU,IAAA,EAClB,QAAA,kBAAA,GAAA;AAAA,QAAC,qBAAA;AAAA,QAAA;AAAA,UACC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,IAAA;AAAA,UACA,cAAA,EAAgB,gBAAgB,cAAA,KAAmB,KAAA;AAAA,UACnD,cAAA,EAAgB,gBAAgB,cAAA,KAAmB,KAAA;AAAA,UACnD,gBAAA,EAAkB,gBAAgB,gBAAA,KAAqB,KAAA;AAAA,UACvD,WAAA,EAAa,gBAAgB,WAAA,KAAgB,KAAA;AAAA,UAC7C,gBAAgB,eAAA,CAAgB,eAAA;AAAA,UAChC,cAAc,eAAA,CAAgB,YAAA;AAAA,UAG9B,YAAA,EAAc,gBAAgB,YAAA,KAAiB,IAAA;AAAA,UAC/C,cAAA,EAAgB,gBAAgB,cAAA,KAAmB,IAAA;AAAA,UACnD,KAAA;AAAA,UACA,iBAAA,EAAmB,SAAA;AAAA,UACnB,iBAAA,EAAmB,SAAA;AAAA,UACnB;AAAA;AAAA,OACF,EACF,KAtBgB,cAwBpB;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,YAAA,GACJ,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,EAAC;AAMzC,IAAA,MAAM,aAAA,GAAgB,aAAa,YAAA,KAAiB,IAAA;AACpD,IAAA,QAAA,CAAS,IAAA;AAAA,sBACP,GAAA,CAAC,MAAM,QAAA,EAAN,EACE,2BAAiB,aAAA,IAAiB,CAAC,oBAAmB,CAAA,oBACrD,GAAA;AAAA,QAAC,gBAAA;AAAA,QAAA;AAAA,UACC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,SAAA;AAAA,UACA,YAAA,EAAc,gBAAgB,YAAA,KAAiB,IAAA;AAAA,UAC/C,cAAA,EAAgB,gBAAgB,cAAA,KAAmB,IAAA;AAAA,UACnD,QAAA,EAAU,aAAa,QAAA,IAAY,cAAA;AAAA,UACnC,cAAc,YAAA,CAAa,YAAA;AAAA,UAC3B,QAAQ,YAAA,CAAa,MAAA;AAAA,UACrB,WAAA,EAAa,aAAa,WAAA,KAAgB;AAAA;AAAA,WAX5B,WAcpB;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,QAAA,CAAS,IAAA;AAAA,sBACP,GAAA,CAAC,KAAA,CAAM,QAAA,EAAN,EACE,QAAA,EAAA,YAAA,oBACC,GAAA;AAAA,QAAC,eAAA;AAAA,QAAA;AAAA,UACC,KAAA;AAAA,UACA,YAAA,EAAc,gBAAgB,YAAA,KAAiB,IAAA;AAAA,UAC/C,cAAA,EAAgB,gBAAgB,cAAA,KAAmB;AAAA;AAAA,WALrC,YAQpB;AAAA,KACF;AAAA,EACF;AAOA,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,MAAM,gBAA+B,EAAC;AACtC,IAAA,IAAI,SAAA,EAAW,aAAA,CAAc,IAAA,CAAK,WAAW,CAAA;AAC7C,IAAA,IAAI,MAAA,EAAQ,aAAA,CAAc,IAAA,CAAK,QAAQ,CAAA;AACvC,IAAA,IAAI,MAAA,EAAQ,aAAA,CAAc,IAAA,CAAK,QAAQ,CAAA;AACvC,IAAA,IAAI,WAAA,EAAa,aAAA,CAAc,IAAA,CAAK,aAAa,CAAA;AACjD,IAAA,QAAA,CAAS,IAAA;AAAA,sBACP,GAAA,CAAC,KAAA,CAAM,QAAA,EAAN,EACE,QAAA,EAAA,YAAA,oBACC,GAAA;AAAA,QAAC,cAAA;AAAA,QAAA;AAAA,UACC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,IAAA;AAAA,UACA,OAAA,EAAS,aAAA;AAAA,UACT,YAAA,EAAc,gBAAgB,YAAA,KAAiB,IAAA;AAAA,UAC/C,cAAA,EAAgB,gBAAgB,cAAA,KAAmB,IAAA;AAAA,UACnD,KAAA,EAAO,KAAA;AAAA,UACP;AAAA;AAAA,WAVc,UAapB;AAAA,KACF;AAAA,EACF;AAEA,EAAA,uBACE,IAAA,CAAA,QAAA,EAAA,EACG,QAAA,EAAA;AAAA,IAAA,QAAA;AAAA,IACA;AAAA,GAAA,EACH,CAAA;AAEJ","file":"chunk-FPVYKSXE.mjs","sourcesContent":["'use client'\n\n/**\n * SiteKitClientProviders — Client Island\n *\n * This is the 'use client' boundary for SiteKitLayout.\n * It composes the client-only providers (Analytics, Engage, Signal, SitemapSync)\n * that require React context or browser APIs.\n *\n * All modules are lazy-loaded via next/dynamic so their JS is only downloaded\n * when the feature is enabled — keeping the initial bundle lightweight.\n *\n * All modules share a unified identity (visitor ID + session ID) read from\n * the storage-backed singleton (shared/identity), ensuring consistent\n * tracking across Analytics, Signal, and Engage.\n *\n * 4.0 INVARIANT — CHILDREN ARE NEVER WRAPPED. Every module here renders as a\n * childless sibling AFTER {children}; nothing provides context around page\n * content. That makes the prerender-bailout / remount-flash class of bug\n * structurally impossible. Do not reintroduce a wrapper.\n *\n * Props are passed down from the server-side SiteKitLayout component,\n * which reads env vars at render time.\n */\n\nimport React, { Suspense, useCallback, useEffect, useRef, useState, type ReactNode } from 'react'\nimport dynamic from 'next/dynamic'\nimport {\n  getOrCreateVisitorId,\n  getOrCreateSessionId,\n} from '../shared/identity'\n// Defer non-critical module mounting until the page is quiet: the lazy\n// modules below are dynamic(ssr:false) and never render on the server, but\n// rendering them during hydration still kicks off their chunk downloads +\n// mount effects inside the critical startup window. useDeferredActivation\n// holds them until window.load + idle or first interaction — the same\n// strategy as the hand-rolled per-site deferrals this replaces (upforge\n// `deferred-analytics.tsx`, TPS `DeferredAnalytics.tsx`). The hook is public\n// (`@sonordev/site-kit/client`) so sites can reuse it for their own scripts.\nimport { useDeferredActivation } from '../shared/defer'\nimport { announceFrameReady, isCrossOriginFrame } from '../shared/frame'\n// Single source of truth for seeding the token manager + the __SITE_KIT_*\n// globals — shared with the public `SiteKitCredential` component that\n// non-core layouts (agency-site-kit) use. Do not re-inline it here.\nimport { publishSiteCredential, resolveSiteHost } from '../shared/publishCredential'\nimport type { AnalyticsConfig, EngageConfig, SignalConfig } from './types'\n\n// Lazy-load feature modules — JS only downloaded when feature is enabled\nconst LazyAnalyticsProvider = dynamic(\n  () => import('../analytics/AnalyticsProvider').then(m => ({ default: m.AnalyticsProvider })),\n  { ssr: false },\n)\nconst LazyEngageWidget = dynamic(\n  () => import('../engage/EngageWidget').then(m => ({ default: m.EngageWidget })),\n  { ssr: false },\n)\nconst LazySitemapSync = dynamic(\n  () => import('../SitemapSync').then(m => ({ default: m.SitemapSync })),\n  { ssr: false },\n)\n// SignalBridge is imported STATICALLY, not via dynamic(ssr:false): it is a\n// tiny SSR-safe context shell that renders children immediately and\n// lazy-loads its machinery (SignalCore) as a childless sibling internally.\n// Wrapping children in a dynamic(ssr:false) component was the old SSR-bailout\n// failure mode — do not reintroduce it.\nimport { SignalBridge } from '../signal/SignalBridge'\n// Fleet heartbeat: a deferred, CHILDLESS SIBLING (like Analytics/Engage) that\n// reports this site's kit version + active modules once per session, so the\n// platform can see version drift across the fleet. Tiny and SSR-safe — renders\n// null until the shared idle gate fires; never wraps page content.\nimport { FleetHeartbeat } from '../fleet/FleetHeartbeat'\nimport type { FleetModule } from '../fleet/contract'\n\nexport interface SiteKitClientProvidersProps {\n  children: ReactNode\n  apiKey: string\n  apiUrl: string\n  projectId?: string\n  analytics?: boolean | AnalyticsConfig\n  engage?: boolean | EngageConfig\n  signal?: boolean | SignalConfig\n  /**\n   * Runtime SitemapSync from the visitor's browser. Default FALSE — sitemap\n   * registration belongs to build time and to sonor-api's nightly reconciler,\n   * not to whoever happens to load the page. See SiteKitLayout for the full\n   * reasoning; in short, its guards live in session/localStorage, so every new\n   * visitor missed them and re-POSTed the whole sitemap.\n   */\n  sitemapSync?: boolean\n  /**\n   * Fleet heartbeat — reports kit version + active modules to Sonor once per\n   * session so the platform can track version drift and key state across every\n   * site. Default true. Deferred exactly like Analytics; never in the hydration\n   * path, carries no visitor data.\n   */\n  fleet?: boolean\n  /**\n   * Defer Analytics / Engage / SitemapSync until window load + idle or first\n   * interaction (default true). Pass false to restore legacy eager mounting\n   * on hydration. SignalBridge is never deferred — it must apply experiment\n   * variants as early as possible.\n   */\n  defer?: boolean\n  debug?: boolean\n  /** Browser-safe Google Maps key, resolved server-side by SiteKitLayout. */\n}\n\nexport function SiteKitClientProviders({\n  children,\n  apiKey,\n  apiUrl,\n  projectId,\n  analytics = true,\n  engage = true,\n  signal = false,\n  sitemapSync = false,\n  fleet = true,\n  defer = true,\n  debug = false,\n}: SiteKitClientProvidersProps) {\n  // One shared activation gate for all deferred siblings, so they mount in a\n  // single commit instead of staggered re-renders.\n  const modulesReady = useDeferredActivation(defer)\n  // Hoist analytics config so the `site` dimension is resolvable up here.\n  const analyticsConfig: AnalyticsConfig =\n    typeof analytics === 'object' ? analytics : {}\n\n  // Resolve the sub-site identifier — the dimension that lets one Sonor project\n  // host many sites (e.g. truepowersystems.com + ohiopowerstudies.com under one\n  // TPS project). Precedence lives in resolveSiteHost (shared contract):\n  // explicit `analytics.site` > NEXT_PUBLIC_SITE_URL host > window.location.host.\n  // Needed as a local too — SignalBridge and the analytics config read it below.\n  const site = resolveSiteHost(analyticsConfig.site)\n\n  // Seed the token manager + publish the window globals modules read from.\n  // No-op on the server; runs during render so it lands before child effects.\n  publishSiteCredential({ apiKey, apiUrl, site, debug })\n\n  // Unified identity — single source of truth for all modules\n  const [visitorId] = useState(() => getOrCreateVisitorId())\n  const [sessionId] = useState(() => getOrCreateSessionId())\n\n  // Page metadata bridge: Analytics writes, Signal reads\n  const pageMetadataRef = useRef<Record<string, unknown> | null>(null)\n  const onPageMetadata = useCallback((metadata: Record<string, unknown>) => {\n    pageMetadataRef.current = metadata\n  }, [])\n\n  // Framed by another origin (a case study's device frame), tell the embedder\n  // once this page has painted, so it can let the live page show through its\n  // screenshot. A no-op at the top level. See shared/frame.ts.\n  useEffect(() => announceFrameReady(), [])\n\n  // Children render FIRST and are never re-parented. Siblings accumulate after.\n  const siblings: ReactNode[] = []\n\n  // SignalBridge — childless sibling (4.0: useSignal reads the module store,\n  // so it no longer needs to wrap anything). Not gated on modulesReady:\n  // experiment variants must apply as early as possible.\n  if (signal) {\n    const signalConfig: SignalConfig =\n      typeof signal === 'object' ? signal : {}\n    siblings.push(\n      <SignalBridge\n        key=\"sk-signal\"\n        enabled\n        realtime={signalConfig.realtime !== false}\n        experiments={signalConfig.experiments !== false}\n        behaviorTracking={signalConfig.behaviorTracking !== false}\n        visitorId={visitorId}\n        sessionId={sessionId}\n        pageMetadataRef={pageMetadataRef}\n      />,\n    )\n  }\n\n  // Add Analytics if enabled (renders alongside, doesn't wrap).\n  //\n  // CRITICAL: LazyAnalyticsProvider is dynamic(..., { ssr: false }). Wrapping\n  // {content} inside an ssr:false component makes the entire page tree skip\n  // server rendering — the route de-opts to 100% client rendering and the\n  // hero / LCP element only paints after hydration (mobile LCP ~4s, Lighthouse\n  // ~85). Analytics tracks via effects + a metadata ref, so it never needs to\n  // wrap page content — mount it as a childless sibling, exactly like Engage.\n  // Each deferred sibling is appended as `{modulesReady && <Module/>}` so the\n  // children slot never moves in the tree — flipping ready only mounts the\n  // sibling, it never remounts page content.\n  if (analytics) {\n    siblings.push(\n      <React.Fragment key=\"sk-analytics\">\n        {modulesReady && (\n          <Suspense fallback={null}>\n            <LazyAnalyticsProvider\n              apiUrl={apiUrl}\n              apiKey={apiKey}\n              site={site}\n              trackPageViews={analyticsConfig.trackPageViews !== false}\n              trackWebVitals={analyticsConfig.trackWebVitals !== false}\n              trackScrollDepth={analyticsConfig.trackScrollDepth !== false}\n              trackClicks={analyticsConfig.trackClicks !== false}\n              sessionTimeout={analyticsConfig.sessionDuration}\n              excludePaths={analyticsConfig.excludePaths}\n              // Off by default: a cross-origin embed of this site reports\n              // nothing (see analytics/send-gate.ts). Opt in per site.\n              allowInFrame={analyticsConfig.allowInFrame === true}\n              allowLocalhost={analyticsConfig.allowLocalhost === true}\n              debug={debug}\n              externalVisitorId={visitorId}\n              externalSessionId={sessionId}\n              onPageMetadata={onPageMetadata}\n            />\n          </Suspense>\n        )}\n      </React.Fragment>,\n    )\n  }\n\n  // Engage widget — childless sibling\n  if (engage) {\n    const engageConfig: EngageConfig =\n      typeof engage === 'object' ? engage : {}\n    // Not inside someone else's page: a popup or chat launcher in a case\n    // study's device frame is shown to the agency's visitor, not this site's,\n    // and its impressions would count against this site. Same default and\n    // opt-in as analytics (allowInFrame). modulesReady is false on the server\n    // and in the first client render, so the frame check never runs there.\n    const engageInFrame = engageConfig.allowInFrame === true\n    siblings.push(\n      <React.Fragment key=\"sk-engage\">\n        {modulesReady && (engageInFrame || !isCrossOriginFrame()) && (\n          <LazyEngageWidget\n            apiUrl={apiUrl}\n            apiKey={apiKey}\n            projectId={projectId}\n            allowInFrame={analyticsConfig.allowInFrame === true}\n            allowLocalhost={analyticsConfig.allowLocalhost === true}\n            position={engageConfig.position || 'bottom-right'}\n            offsetBottom={engageConfig.offsetBottom}\n            zIndex={engageConfig.zIndex}\n            chatEnabled={engageConfig.chatEnabled !== false}\n          />\n        )}\n      </React.Fragment>,\n    )\n  }\n\n  // SitemapSync — childless sibling\n  if (sitemapSync) {\n    siblings.push(\n      <React.Fragment key=\"sk-sitemap\">\n        {modulesReady && (\n          <LazySitemapSync\n            debug={debug}\n            allowInFrame={analyticsConfig.allowInFrame === true}\n            allowLocalhost={analyticsConfig.allowLocalhost === true}\n          />\n        )}\n      </React.Fragment>,\n    )\n  }\n\n  // Fleet heartbeat — childless sibling on the same modulesReady idle gate.\n  // Reports the modules actually enabled on THIS layout (honest client-observable\n  // set) so the platform can answer \"which version / modules is each site\n  // running\". defer={false}: the modulesReady gate already handled deferral, so\n  // the heartbeat fires on mount (still bounded to once per session internally).\n  if (fleet) {\n    const activeModules: FleetModule[] = []\n    if (analytics) activeModules.push('analytics')\n    if (engage) activeModules.push('engage')\n    if (signal) activeModules.push('signal')\n    if (sitemapSync) activeModules.push('sitemapSync')\n    siblings.push(\n      <React.Fragment key=\"sk-fleet\">\n        {modulesReady && (\n          <FleetHeartbeat\n            apiUrl={apiUrl}\n            apiKey={apiKey}\n            site={site}\n            modules={activeModules}\n            allowInFrame={analyticsConfig.allowInFrame === true}\n            allowLocalhost={analyticsConfig.allowLocalhost === true}\n            defer={false}\n            debug={debug}\n          />\n        )}\n      </React.Fragment>,\n    )\n  }\n\n  return (\n    <>\n      {children}\n      {siblings}\n    </>\n  )\n}\n"]}

package/dist/{chunk-VDEQVXNV.js → chunk-G2KGHIAP.js}

@@ -60,7 +60,7 @@ function useSignal() {
   return react.useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot);
 }
 var LazySignalCore = dynamic__default.default(
-  () => import('./SignalCore-YHT7WPXV.js').then((m) => ({ default: m.SignalCore })),
+  () => import('./SignalCore-P2JUY2BO.js').then((m) => ({ default: m.SignalCore })),
   { ssr: false }
 );
 function SignalBridge({
@@ -172,5 +172,5 @@ exports.useSignalConfig = useSignalConfig;
 exports.useSignalEvent = useSignalEvent;
 exports.useSignalExperiment = useSignalExperiment;
 exports.useSignalOutcome = useSignalOutcome;
-//# sourceMappingURL=chunk-VDEQVXNV.js.map
-//# sourceMappingURL=chunk-VDEQVXNV.js.map
+//# sourceMappingURL=chunk-G2KGHIAP.js.map
+//# sourceMappingURL=chunk-G2KGHIAP.js.map

package/dist/{chunk-VDEQVXNV.js.map → chunk-G2KGHIAP.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/signal/store.ts","../src/signal/SignalBridge.tsx"],"names":["useSyncExternalStore","dynamic","useState","useRef","useCallback","useMemo","useEffect","jsxs","Fragment","jsx"],"mappings":";;;;;;;;;;;AAyBA,IAAM,gBAAwC,EAAC;AAC/C,IAAM,kBAAmC,EAAC;AAC1C,IAAM,WAAA,GAAc,GAAA;AACpB,IAAI,cAAA,GAAiB,KAAA;AAGrB,IAAM,IAAA,GAA2B,OAAO,MAAA,CAAO;AAAA,EAC7C,MAAA,EAAQ,IAAA;AAAA,EACR,OAAA,EAAS,IAAA;AAAA,EACT,KAAA,EAAO,IAAA;AAAA,EACP,UAAA,EAAY,CAAC,KAAA,KAAgC;AAC3C,IAAA,IAAI,aAAA,CAAc,MAAA,GAAS,WAAA,EAAa,aAAA,CAAc,KAAK,KAAK,CAAA;AAAA,SAAA,IACvD,CAAC,cAAA,EAAgB;AACxB,MAAA,cAAA,GAAiB,IAAA;AACjB,MAAA,OAAA,CAAQ,KAAK,iHAA4G,CAAA;AAAA,IAC3H;AAAA,EACF,CAAA;AAAA,EACA,YAAA,EAAc,CAAC,OAAA,KAA2B;AACxC,IAAA,IAAI,eAAA,CAAgB,MAAA,GAAS,WAAA,EAAa,eAAA,CAAgB,KAAK,OAAO,CAAA;AAAA,EACxE,CAAA;AAAA,EACA,eAAe,MAAM,IAAA;AAAA,EACrB,eAAe,YAAY;AAAA,EAAC;AAC9B,CAAC,CAAA;AAED,IAAI,OAAA,GAA8B,IAAA;AAClC,IAAM,SAAA,uBAAgB,GAAA,EAAgB;AAEtC,SAAS,IAAA,GAAO;AACd,EAAA,KAAA,MAAW,CAAA,IAAK,WAAW,CAAA,EAAE;AAC/B;AAGO,SAAS,cAAc,KAAA,EAAiC;AAC7D,EAAA,MAAM,eAAe,OAAA,KAAY,IAAA;AACjC,EAAA,OAAA,GAAU,KAAA;AACV,EAAA,IAAI,YAAA,EAAc;AAGhB,IAAA,aAAA,CAAc,MAAA,CAAO,CAAC,CAAA,CAAE,OAAA,CAAQ,OAAK,KAAA,CAAM,UAAA,CAAW,CAAC,CAAC,CAAA;AACxD,IAAA,eAAA,CAAgB,MAAA,CAAO,CAAC,CAAA,CAAE,OAAA,CAAQ,OAAK,KAAA,CAAM,YAAA,CAAa,CAAC,CAAC,CAAA;AAAA,EAC9D;AACA,EAAA,IAAA,EAAK;AACP;AAGO,SAAS,WAAA,GAAoB;AAClC,EAAA,OAAA,GAAU,IAAA;AACV,EAAA,IAAA,EAAK;AACP;AAEA,SAAS,UAAU,QAAA,EAAsB;AACvC,EAAA,SAAA,CAAU,IAAI,QAAQ,CAAA;AACtB,EAAA,OAAO,MAAM,SAAA,CAAU,MAAA,CAAO,QAAQ,CAAA;AACxC;AAEA,IAAM,cAAc,MAAM,OAAA;AAC1B,IAAM,oBAAoB,MAAM,IAAA;AAMzB,SAAS,SAAA,GAAgC;AAC9C,EAAA,OAAOA,0BAAA,CAAqB,SAAA,EAAW,WAAA,EAAa,iBAAiB,CAAA;AACvE;ACnDA,IAAM,cAAA,GAAiBC,wBAAA;AAAA,EACrB,MAAM,OAAO,0BAAc,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,UAAA,EAAW,CAAE,CAAA;AAAA,EAClE,EAAE,KAAK,KAAA;AACT,CAAA;AAcO,SAAS,YAAA,CAAa;AAAA,EAC3B,OAAA,GAAU,IAAA;AAAA,EACV,QAAA,GAAW,IAAA;AAAA,EACX,WAAA,GAAc,IAAA;AAAA,EACd,gBAAA,GAAmB,IAAA;AAAA,EACnB,SAAA,EAAW,iBAAA;AAAA,EACX,SAAA,EAAW,iBAAA;AAAA,EACX,eAAA;AAAA,EACA;AACF,CAAA,EAAsB;AACpB,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAIC,eAA8B,IAAI,CAAA;AAC9D,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAIA,eAAS,IAAI,CAAA;AAC3C,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAIA,eAAuB,IAAI,CAAA;AAErD,EAAA,MAAM,OAAA,GAAUC,aAA6B,IAAI,CAAA;AAGjD,EAAA,MAAM,gBAAA,GAAmBA,YAAA,CAA+B,EAAE,CAAA;AAC1D,EAAA,MAAM,kBAAA,GAAqBA,YAAA,CAAwB,EAAE,CAAA;AAErD,EAAA,MAAM,WAAA,GAAcC,iBAAA,CAAY,CAAC,KAAA,KAA2B;AAC1D,IAAA,SAAA,CAAU,MAAM,MAAM,CAAA;AACtB,IAAA,UAAA,CAAW,MAAM,OAAO,CAAA;AACxB,IAAA,QAAA,CAAS,MAAM,KAAK,CAAA;AAAA,EACtB,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,cAAA,GAAiBA,iBAAA,CAAY,CAAC,GAAA,KAA8B;AAChE,IAAA,OAAA,CAAQ,OAAA,GAAU,GAAA;AAClB,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,gBAAA,CAAiB,OAAA,CAAQ,OAAO,CAAC,CAAA,CAAE,QAAQ,CAAA,KAAA,KAAS,GAAA,CAAI,UAAA,CAAW,KAAK,CAAC,CAAA;AACzE,MAAA,kBAAA,CAAmB,OAAA,CAAQ,OAAO,CAAC,CAAA,CAAE,QAAQ,CAAA,OAAA,KAAW,GAAA,CAAI,YAAA,CAAa,OAAO,CAAC,CAAA;AAAA,IACnF;AAAA,EACF,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,UAAA,GAAaA,iBAAA,CAAY,CAAC,KAAA,KAAgC;AAC9D,IAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,MAAA,OAAA,CAAQ,OAAA,CAAQ,WAAW,KAAK,CAAA;AAAA,IAClC,CAAA,MAAO;AACL,MAAA,gBAAA,CAAiB,OAAA,CAAQ,KAAK,KAAK,CAAA;AAAA,IACrC;AAAA,EACF,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,YAAA,GAAeA,iBAAA,CAAY,CAAC,OAAA,KAA2B;AAC3D,IAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,MAAA,OAAA,CAAQ,OAAA,CAAQ,aAAa,OAAO,CAAA;AAAA,IACtC,CAAA,MAAO;AACL,MAAA,kBAAA,CAAmB,OAAA,CAAQ,KAAK,OAAO,CAAA;AAAA,IACzC;AAAA,EACF,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,aAAA,GAAgBA,iBAAA,CAAY,CAAC,YAAA,KAAsD;AAGvF,IAAA,OAAO,OAAA,CAAQ,OAAA,EAAS,aAAA,CAAc,YAAY,CAAA,IAAK,IAAA;AAAA,EACzD,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,aAAA,GAAgBA,kBAAY,YAAY;AAC5C,IAAA,MAAM,OAAA,CAAQ,SAAS,aAAA,EAAc;AAAA,EACvC,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,YAAA,GAAeC,cAA4B,OAAO;AAAA,IACtD,MAAA;AAAA,IACA,OAAA;AAAA,IACA,KAAA;AAAA,IACA,UAAA;AAAA,IACA,YAAA;AAAA,IACA,aAAA;AAAA,IACA;AAAA,GACF,CAAA,EAAI,CAAC,MAAA,EAAQ,OAAA,EAAS,OAAO,UAAA,EAAY,YAAA,EAAc,aAAA,EAAe,aAAa,CAAC,CAAA;AAIpF,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,aAAA,CAAc,YAAY,CAAA;AAAA,EAC5B,CAAA,EAAG,CAAC,YAAY,CAAC,CAAA;AACjB,EAAAA,eAAA,CAAU,MAAM,MAAM,WAAA,EAAY,EAAG,EAAE,CAAA;AAEvC,EAAA,uBACEC,eAAA,CAAAC,mBAAA,EAAA,EACG,QAAA,EAAA;AAAA,IAAA,QAAA;AAAA,IACA,OAAA,oBACCC,cAAA;AAAA,MAAC,cAAA;AAAA,MAAA;AAAA,QACC,OAAA;AAAA,QACA,QAAA;AAAA,QACA,WAAA;AAAA,QACA,gBAAA;AAAA,QACA,iBAAA;AAAA,QACA,iBAAA;AAAA,QACA,eAAA;AAAA,QACA,UAAA,EAAY,cAAA;AAAA,QACZ,OAAA,EAAS;AAAA;AAAA;AACX,GAAA,EAEJ,CAAA;AAEJ;AASO,SAAS,eAAA,GAAuC;AACrD,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,SAAA,EAAU;AAC7B,EAAA,OAAO,MAAA;AACT;AAKO,SAAS,cAAA,GAAiB;AAC/B,EAAA,MAAM,EAAE,UAAA,EAAW,GAAI,SAAA,EAAU;AACjC,EAAA,OAAO,UAAA;AACT;AAKO,SAAS,gBAAA,GAAmB;AACjC,EAAA,MAAM,EAAE,YAAA,EAAa,GAAI,SAAA,EAAU;AACnC,EAAA,OAAO,EAAE,YAAA,EAAa;AACxB;AAKO,SAAS,oBAAoB,YAAA,EAIlC;AACA,EAAA,MAAM,EAAE,aAAA,EAAe,MAAA,EAAO,GAAI,SAAA,EAAU;AAC5C,EAAA,MAAM,UAAA,GAAa,cAAc,YAAY,CAAA;AAG7C,EAAA,MAAM,aAAa,MAAA,EAAQ,WAAA,EAAa,KAAK,CAAA,CAAA,KAAK,CAAA,CAAE,OAAO,YAAY,CAAA;AACvE,EAAA,MAAM,SAAA,GAAY,YAAY,MAAA,KAAW,SAAA;AAEzC,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,YAAY,UAAA,GAAa,IAAA;AAAA,IACrC,OAAA,EAAS,SAAA,IAAa,UAAA,GAAa,UAAA,CAAW,WAAA,GAAc,IAAA;AAAA,IAC5D,SAAA,EAAW,CAAC,UAAA,IAAc,UAAA,CAAW,WAAA,KAAgB;AAAA,GACvD;AACF","file":"chunk-VDEQVXNV.js","sourcesContent":["'use client'\n\n/**\n * Signal store — module singleton behind useSignal().\n *\n * 4.0: SignalBridge no longer wraps page children in a React context; it\n * mounts as a childless sibling and publishes its API here. useSignal()\n * subscribes via useSyncExternalStore, so consumers work anywhere in the\n * tree — and BEFORE the bridge mounts, they get a buffering stub whose\n * trackEvent/trackOutcome queue calls that the bridge drains on publish.\n * getExperiment returns null pre-publish, identical to the pre-config\n * `loading` window consumers already handle.\n *\n * Behavior change vs 3.x (major): useSignal() no longer throws outside a\n * SignalBridge. With signal disabled it stays a bounded no-op stub — a\n * one-time debug warning fires instead of a crash.\n */\n\nimport { useSyncExternalStore } from 'react'\nimport type {\n  SignalContextValue,\n  SignalEvent,\n  SignalOutcome,\n} from './types'\n\nconst pendingEvents: Partial<SignalEvent>[] = []\nconst pendingOutcomes: SignalOutcome[] = []\nconst MAX_PENDING = 100\nlet warnedNoBridge = false\n\n/** Frozen pre-bridge stub — stable reference (useSyncExternalStore requirement). */\nconst STUB: SignalContextValue = Object.freeze({\n  config: null,\n  loading: true,\n  error: null,\n  trackEvent: (event: Partial<SignalEvent>) => {\n    if (pendingEvents.length < MAX_PENDING) pendingEvents.push(event)\n    else if (!warnedNoBridge) {\n      warnedNoBridge = true\n      console.warn('[site-kit] Signal events are queuing but no SignalBridge has mounted — is signal enabled on SiteKitLayout?')\n    }\n  },\n  trackOutcome: (outcome: SignalOutcome) => {\n    if (pendingOutcomes.length < MAX_PENDING) pendingOutcomes.push(outcome)\n  },\n  getExperiment: () => null,\n  refreshConfig: async () => {},\n})\n\nlet current: SignalContextValue = STUB\nconst listeners = new Set<() => void>()\n\nfunction emit() {\n  for (const l of listeners) l()\n}\n\n/** Bridge-side: publish the live API (called whenever its value changes). */\nexport function publishSignal(value: SignalContextValue): void {\n  const firstPublish = current === STUB\n  current = value\n  if (firstPublish) {\n    // Drain calls made before the bridge mounted. The bridge's own trackEvent\n    // buffers again internally until SignalCore loads, so nothing is lost.\n    pendingEvents.splice(0).forEach(e => value.trackEvent(e))\n    pendingOutcomes.splice(0).forEach(o => value.trackOutcome(o))\n  }\n  emit()\n}\n\n/** Bridge-side: reset on unmount so a remount starts clean (tests, HMR). */\nexport function resetSignal(): void {\n  current = STUB\n  emit()\n}\n\nfunction subscribe(onChange: () => void) {\n  listeners.add(onChange)\n  return () => listeners.delete(onChange)\n}\n\nconst getSnapshot = () => current\nconst getServerSnapshot = () => STUB\n\n/**\n * Access Signal (experiments, behavioral events) from anywhere in the tree.\n * No provider required — see module docs for pre-mount buffering semantics.\n */\nexport function useSignal(): SignalContextValue {\n  return useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot)\n}\n","/**\n * @sonordev/site-kit/signal - SignalBridge\n *\n * Central coordination layer for Signal AI integration.\n *\n * Architecture (2026-07 perf release): SignalBridge is a tiny SSR-SAFE context shell. It\n * renders {children} immediately — children server-render and hydrate\n * normally, no ssr:false wrapper — and lazy-loads the heavy machinery\n * (SignalCore: config fetch, SSE streaming, experiment assignment, event\n * queue, behavior tracking) as a CHILDLESS sibling. The core registers its\n * imperative API into the shell on mount; `trackEvent`/`trackOutcome` calls\n * made before the core is ready are buffered and drained on registration.\n *\n * This removes the old failure mode where enabling `signal` de-opted the\n * whole route to client rendering (the same SSR bailout the analytics\n * sibling-mount fixed) — the #1 recommendation of the 2026-07 perf audit.\n *\n * The core is NOT idle-deferred: experiment variants must apply as early as\n * possible, so it starts loading on hydration.\n */\n\n'use client'\n\nimport React, { useCallback, useEffect, useMemo, useRef, useState } from 'react'\nimport dynamic from 'next/dynamic'\nimport type { SignalCoreApi, SignalCoreState } from './SignalCore'\nimport type {\n  SignalConfig,\n  SignalContextValue,\n  SignalBridgeProps,\n  SignalEvent,\n  SignalOutcome,\n  ExperimentAssignment,\n} from './types'\n\n// Heavy machinery — loaded client-side only, never wraps content.\nimport { publishSignal, resetSignal, useSignal } from './store'\n\nconst LazySignalCore = dynamic(\n  () => import('./SignalCore').then(m => ({ default: m.SignalCore })),\n  { ssr: false },\n)\n\n// ============================================\n// Context\n// ============================================\n\n// 4.0: the context is gone. useSignal() reads the module store, so consumers\n// work anywhere in the tree and SignalBridge mounts as a childless sibling.\nexport { useSignal } from './store'\n\n// ============================================\n// SignalBridge Component (shell)\n// ============================================\n\nexport function SignalBridge({\n  enabled = true,\n  realtime = true,\n  experiments = true,\n  behaviorTracking = true,\n  visitorId: externalVisitorId,\n  sessionId: externalSessionId,\n  pageMetadataRef,\n  children,\n}: SignalBridgeProps) {\n  const [config, setConfig] = useState<SignalConfig | null>(null)\n  const [loading, setLoading] = useState(true)\n  const [error, setError] = useState<Error | null>(null)\n\n  const coreRef = useRef<SignalCoreApi | null>(null)\n  // Calls made before the core chunk loads are buffered here and drained on\n  // registration — consumers can call trackEvent/trackOutcome from first render.\n  const pendingEventsRef = useRef<Partial<SignalEvent>[]>([])\n  const pendingOutcomesRef = useRef<SignalOutcome[]>([])\n\n  const handleState = useCallback((state: SignalCoreState) => {\n    setConfig(state.config)\n    setLoading(state.loading)\n    setError(state.error)\n  }, [])\n\n  const handleRegister = useCallback((api: SignalCoreApi | null) => {\n    coreRef.current = api\n    if (api) {\n      pendingEventsRef.current.splice(0).forEach(event => api.trackEvent(event))\n      pendingOutcomesRef.current.splice(0).forEach(outcome => api.trackOutcome(outcome))\n    }\n  }, [])\n\n  const trackEvent = useCallback((event: Partial<SignalEvent>) => {\n    if (coreRef.current) {\n      coreRef.current.trackEvent(event)\n    } else {\n      pendingEventsRef.current.push(event)\n    }\n  }, [])\n\n  const trackOutcome = useCallback((outcome: SignalOutcome) => {\n    if (coreRef.current) {\n      coreRef.current.trackOutcome(outcome)\n    } else {\n      pendingOutcomesRef.current.push(outcome)\n    }\n  }, [])\n\n  const getExperiment = useCallback((experimentId: string): ExperimentAssignment | null => {\n    // null before the core loads — identical to the pre-config-fetch behavior\n    // consumers already handle via `loading`.\n    return coreRef.current?.getExperiment(experimentId) ?? null\n  }, [])\n\n  const refreshConfig = useCallback(async () => {\n    await coreRef.current?.refreshConfig()\n  }, [])\n\n  const contextValue = useMemo<SignalContextValue>(() => ({\n    config,\n    loading,\n    error,\n    trackEvent,\n    trackOutcome,\n    getExperiment,\n    refreshConfig,\n  }), [config, loading, error, trackEvent, trackOutcome, getExperiment, refreshConfig])\n\n  // Publish to the module store (drains pre-mount buffered calls on first\n  // publish); reset on unmount so tests/HMR start clean.\n  useEffect(() => {\n    publishSignal(contextValue)\n  }, [contextValue])\n  useEffect(() => () => resetSignal(), [])\n\n  return (\n    <>\n      {children}\n      {enabled && (\n        <LazySignalCore\n          enabled={enabled}\n          realtime={realtime}\n          experiments={experiments}\n          behaviorTracking={behaviorTracking}\n          externalVisitorId={externalVisitorId}\n          externalSessionId={externalSessionId}\n          pageMetadataRef={pageMetadataRef}\n          onRegister={handleRegister}\n          onState={handleState}\n        />\n      )}\n    </>\n  )\n}\n\n// ============================================\n// Convenience Hooks\n// ============================================\n\n/**\n * Hook to access Signal config\n */\nexport function useSignalConfig(): SignalConfig | null {\n  const { config } = useSignal()\n  return config\n}\n\n/**\n * Hook for tracking events\n */\nexport function useSignalEvent() {\n  const { trackEvent } = useSignal()\n  return trackEvent\n}\n\n/**\n * Hook for tracking outcomes/conversions\n */\nexport function useSignalOutcome() {\n  const { trackOutcome } = useSignal()\n  return { trackOutcome }\n}\n\n/**\n * Hook for experiment assignment\n */\nexport function useSignalExperiment(experimentId: string): {\n  assignment: ExperimentAssignment | null\n  variant: string | null\n  isControl: boolean\n} {\n  const { getExperiment, config } = useSignal()\n  const assignment = getExperiment(experimentId)\n\n  // Check if experiment is running\n  const experiment = config?.experiments?.find(e => e.id === experimentId)\n  const isRunning = experiment?.status === 'running'\n\n  return {\n    assignment: isRunning ? assignment : null,\n    variant: isRunning && assignment ? assignment.variant_key : null,\n    isControl: !assignment || assignment.variant_key === 'control',\n  }\n}\n"]}
+{"version":3,"sources":["../src/signal/store.ts","../src/signal/SignalBridge.tsx"],"names":["useSyncExternalStore","dynamic","useState","useRef","useCallback","useMemo","useEffect","jsxs","Fragment","jsx"],"mappings":";;;;;;;;;;;AAyBA,IAAM,gBAAwC,EAAC;AAC/C,IAAM,kBAAmC,EAAC;AAC1C,IAAM,WAAA,GAAc,GAAA;AACpB,IAAI,cAAA,GAAiB,KAAA;AAGrB,IAAM,IAAA,GAA2B,OAAO,MAAA,CAAO;AAAA,EAC7C,MAAA,EAAQ,IAAA;AAAA,EACR,OAAA,EAAS,IAAA;AAAA,EACT,KAAA,EAAO,IAAA;AAAA,EACP,UAAA,EAAY,CAAC,KAAA,KAAgC;AAC3C,IAAA,IAAI,aAAA,CAAc,MAAA,GAAS,WAAA,EAAa,aAAA,CAAc,KAAK,KAAK,CAAA;AAAA,SAAA,IACvD,CAAC,cAAA,EAAgB;AACxB,MAAA,cAAA,GAAiB,IAAA;AACjB,MAAA,OAAA,CAAQ,KAAK,iHAA4G,CAAA;AAAA,IAC3H;AAAA,EACF,CAAA;AAAA,EACA,YAAA,EAAc,CAAC,OAAA,KAA2B;AACxC,IAAA,IAAI,eAAA,CAAgB,MAAA,GAAS,WAAA,EAAa,eAAA,CAAgB,KAAK,OAAO,CAAA;AAAA,EACxE,CAAA;AAAA,EACA,eAAe,MAAM,IAAA;AAAA,EACrB,eAAe,YAAY;AAAA,EAAC;AAC9B,CAAC,CAAA;AAED,IAAI,OAAA,GAA8B,IAAA;AAClC,IAAM,SAAA,uBAAgB,GAAA,EAAgB;AAEtC,SAAS,IAAA,GAAO;AACd,EAAA,KAAA,MAAW,CAAA,IAAK,WAAW,CAAA,EAAE;AAC/B;AAGO,SAAS,cAAc,KAAA,EAAiC;AAC7D,EAAA,MAAM,eAAe,OAAA,KAAY,IAAA;AACjC,EAAA,OAAA,GAAU,KAAA;AACV,EAAA,IAAI,YAAA,EAAc;AAGhB,IAAA,aAAA,CAAc,MAAA,CAAO,CAAC,CAAA,CAAE,OAAA,CAAQ,OAAK,KAAA,CAAM,UAAA,CAAW,CAAC,CAAC,CAAA;AACxD,IAAA,eAAA,CAAgB,MAAA,CAAO,CAAC,CAAA,CAAE,OAAA,CAAQ,OAAK,KAAA,CAAM,YAAA,CAAa,CAAC,CAAC,CAAA;AAAA,EAC9D;AACA,EAAA,IAAA,EAAK;AACP;AAGO,SAAS,WAAA,GAAoB;AAClC,EAAA,OAAA,GAAU,IAAA;AACV,EAAA,IAAA,EAAK;AACP;AAEA,SAAS,UAAU,QAAA,EAAsB;AACvC,EAAA,SAAA,CAAU,IAAI,QAAQ,CAAA;AACtB,EAAA,OAAO,MAAM,SAAA,CAAU,MAAA,CAAO,QAAQ,CAAA;AACxC;AAEA,IAAM,cAAc,MAAM,OAAA;AAC1B,IAAM,oBAAoB,MAAM,IAAA;AAMzB,SAAS,SAAA,GAAgC;AAC9C,EAAA,OAAOA,0BAAA,CAAqB,SAAA,EAAW,WAAA,EAAa,iBAAiB,CAAA;AACvE;ACnDA,IAAM,cAAA,GAAiBC,wBAAA;AAAA,EACrB,MAAM,OAAO,0BAAc,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,UAAA,EAAW,CAAE,CAAA;AAAA,EAClE,EAAE,KAAK,KAAA;AACT,CAAA;AAcO,SAAS,YAAA,CAAa;AAAA,EAC3B,OAAA,GAAU,IAAA;AAAA,EACV,QAAA,GAAW,IAAA;AAAA,EACX,WAAA,GAAc,IAAA;AAAA,EACd,gBAAA,GAAmB,IAAA;AAAA,EACnB,SAAA,EAAW,iBAAA;AAAA,EACX,SAAA,EAAW,iBAAA;AAAA,EACX,eAAA;AAAA,EACA;AACF,CAAA,EAAsB;AACpB,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAIC,eAA8B,IAAI,CAAA;AAC9D,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAIA,eAAS,IAAI,CAAA;AAC3C,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAIA,eAAuB,IAAI,CAAA;AAErD,EAAA,MAAM,OAAA,GAAUC,aAA6B,IAAI,CAAA;AAGjD,EAAA,MAAM,gBAAA,GAAmBA,YAAA,CAA+B,EAAE,CAAA;AAC1D,EAAA,MAAM,kBAAA,GAAqBA,YAAA,CAAwB,EAAE,CAAA;AAErD,EAAA,MAAM,WAAA,GAAcC,iBAAA,CAAY,CAAC,KAAA,KAA2B;AAC1D,IAAA,SAAA,CAAU,MAAM,MAAM,CAAA;AACtB,IAAA,UAAA,CAAW,MAAM,OAAO,CAAA;AACxB,IAAA,QAAA,CAAS,MAAM,KAAK,CAAA;AAAA,EACtB,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,cAAA,GAAiBA,iBAAA,CAAY,CAAC,GAAA,KAA8B;AAChE,IAAA,OAAA,CAAQ,OAAA,GAAU,GAAA;AAClB,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,gBAAA,CAAiB,OAAA,CAAQ,OAAO,CAAC,CAAA,CAAE,QAAQ,CAAA,KAAA,KAAS,GAAA,CAAI,UAAA,CAAW,KAAK,CAAC,CAAA;AACzE,MAAA,kBAAA,CAAmB,OAAA,CAAQ,OAAO,CAAC,CAAA,CAAE,QAAQ,CAAA,OAAA,KAAW,GAAA,CAAI,YAAA,CAAa,OAAO,CAAC,CAAA;AAAA,IACnF;AAAA,EACF,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,UAAA,GAAaA,iBAAA,CAAY,CAAC,KAAA,KAAgC;AAC9D,IAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,MAAA,OAAA,CAAQ,OAAA,CAAQ,WAAW,KAAK,CAAA;AAAA,IAClC,CAAA,MAAO;AACL,MAAA,gBAAA,CAAiB,OAAA,CAAQ,KAAK,KAAK,CAAA;AAAA,IACrC;AAAA,EACF,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,YAAA,GAAeA,iBAAA,CAAY,CAAC,OAAA,KAA2B;AAC3D,IAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,MAAA,OAAA,CAAQ,OAAA,CAAQ,aAAa,OAAO,CAAA;AAAA,IACtC,CAAA,MAAO;AACL,MAAA,kBAAA,CAAmB,OAAA,CAAQ,KAAK,OAAO,CAAA;AAAA,IACzC;AAAA,EACF,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,aAAA,GAAgBA,iBAAA,CAAY,CAAC,YAAA,KAAsD;AAGvF,IAAA,OAAO,OAAA,CAAQ,OAAA,EAAS,aAAA,CAAc,YAAY,CAAA,IAAK,IAAA;AAAA,EACzD,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,aAAA,GAAgBA,kBAAY,YAAY;AAC5C,IAAA,MAAM,OAAA,CAAQ,SAAS,aAAA,EAAc;AAAA,EACvC,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,YAAA,GAAeC,cAA4B,OAAO;AAAA,IACtD,MAAA;AAAA,IACA,OAAA;AAAA,IACA,KAAA;AAAA,IACA,UAAA;AAAA,IACA,YAAA;AAAA,IACA,aAAA;AAAA,IACA;AAAA,GACF,CAAA,EAAI,CAAC,MAAA,EAAQ,OAAA,EAAS,OAAO,UAAA,EAAY,YAAA,EAAc,aAAA,EAAe,aAAa,CAAC,CAAA;AAIpF,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,aAAA,CAAc,YAAY,CAAA;AAAA,EAC5B,CAAA,EAAG,CAAC,YAAY,CAAC,CAAA;AACjB,EAAAA,eAAA,CAAU,MAAM,MAAM,WAAA,EAAY,EAAG,EAAE,CAAA;AAEvC,EAAA,uBACEC,eAAA,CAAAC,mBAAA,EAAA,EACG,QAAA,EAAA;AAAA,IAAA,QAAA;AAAA,IACA,OAAA,oBACCC,cAAA;AAAA,MAAC,cAAA;AAAA,MAAA;AAAA,QACC,OAAA;AAAA,QACA,QAAA;AAAA,QACA,WAAA;AAAA,QACA,gBAAA;AAAA,QACA,iBAAA;AAAA,QACA,iBAAA;AAAA,QACA,eAAA;AAAA,QACA,UAAA,EAAY,cAAA;AAAA,QACZ,OAAA,EAAS;AAAA;AAAA;AACX,GAAA,EAEJ,CAAA;AAEJ;AASO,SAAS,eAAA,GAAuC;AACrD,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,SAAA,EAAU;AAC7B,EAAA,OAAO,MAAA;AACT;AAKO,SAAS,cAAA,GAAiB;AAC/B,EAAA,MAAM,EAAE,UAAA,EAAW,GAAI,SAAA,EAAU;AACjC,EAAA,OAAO,UAAA;AACT;AAKO,SAAS,gBAAA,GAAmB;AACjC,EAAA,MAAM,EAAE,YAAA,EAAa,GAAI,SAAA,EAAU;AACnC,EAAA,OAAO,EAAE,YAAA,EAAa;AACxB;AAKO,SAAS,oBAAoB,YAAA,EAIlC;AACA,EAAA,MAAM,EAAE,aAAA,EAAe,MAAA,EAAO,GAAI,SAAA,EAAU;AAC5C,EAAA,MAAM,UAAA,GAAa,cAAc,YAAY,CAAA;AAG7C,EAAA,MAAM,aAAa,MAAA,EAAQ,WAAA,EAAa,KAAK,CAAA,CAAA,KAAK,CAAA,CAAE,OAAO,YAAY,CAAA;AACvE,EAAA,MAAM,SAAA,GAAY,YAAY,MAAA,KAAW,SAAA;AAEzC,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,YAAY,UAAA,GAAa,IAAA;AAAA,IACrC,OAAA,EAAS,SAAA,IAAa,UAAA,GAAa,UAAA,CAAW,WAAA,GAAc,IAAA;AAAA,IAC5D,SAAA,EAAW,CAAC,UAAA,IAAc,UAAA,CAAW,WAAA,KAAgB;AAAA,GACvD;AACF","file":"chunk-G2KGHIAP.js","sourcesContent":["'use client'\n\n/**\n * Signal store — module singleton behind useSignal().\n *\n * 4.0: SignalBridge no longer wraps page children in a React context; it\n * mounts as a childless sibling and publishes its API here. useSignal()\n * subscribes via useSyncExternalStore, so consumers work anywhere in the\n * tree — and BEFORE the bridge mounts, they get a buffering stub whose\n * trackEvent/trackOutcome queue calls that the bridge drains on publish.\n * getExperiment returns null pre-publish, identical to the pre-config\n * `loading` window consumers already handle.\n *\n * Behavior change vs 3.x (major): useSignal() no longer throws outside a\n * SignalBridge. With signal disabled it stays a bounded no-op stub — a\n * one-time debug warning fires instead of a crash.\n */\n\nimport { useSyncExternalStore } from 'react'\nimport type {\n  SignalContextValue,\n  SignalEvent,\n  SignalOutcome,\n} from './types'\n\nconst pendingEvents: Partial<SignalEvent>[] = []\nconst pendingOutcomes: SignalOutcome[] = []\nconst MAX_PENDING = 100\nlet warnedNoBridge = false\n\n/** Frozen pre-bridge stub — stable reference (useSyncExternalStore requirement). */\nconst STUB: SignalContextValue = Object.freeze({\n  config: null,\n  loading: true,\n  error: null,\n  trackEvent: (event: Partial<SignalEvent>) => {\n    if (pendingEvents.length < MAX_PENDING) pendingEvents.push(event)\n    else if (!warnedNoBridge) {\n      warnedNoBridge = true\n      console.warn('[site-kit] Signal events are queuing but no SignalBridge has mounted — is signal enabled on SiteKitLayout?')\n    }\n  },\n  trackOutcome: (outcome: SignalOutcome) => {\n    if (pendingOutcomes.length < MAX_PENDING) pendingOutcomes.push(outcome)\n  },\n  getExperiment: () => null,\n  refreshConfig: async () => {},\n})\n\nlet current: SignalContextValue = STUB\nconst listeners = new Set<() => void>()\n\nfunction emit() {\n  for (const l of listeners) l()\n}\n\n/** Bridge-side: publish the live API (called whenever its value changes). */\nexport function publishSignal(value: SignalContextValue): void {\n  const firstPublish = current === STUB\n  current = value\n  if (firstPublish) {\n    // Drain calls made before the bridge mounted. The bridge's own trackEvent\n    // buffers again internally until SignalCore loads, so nothing is lost.\n    pendingEvents.splice(0).forEach(e => value.trackEvent(e))\n    pendingOutcomes.splice(0).forEach(o => value.trackOutcome(o))\n  }\n  emit()\n}\n\n/** Bridge-side: reset on unmount so a remount starts clean (tests, HMR). */\nexport function resetSignal(): void {\n  current = STUB\n  emit()\n}\n\nfunction subscribe(onChange: () => void) {\n  listeners.add(onChange)\n  return () => listeners.delete(onChange)\n}\n\nconst getSnapshot = () => current\nconst getServerSnapshot = () => STUB\n\n/**\n * Access Signal (experiments, behavioral events) from anywhere in the tree.\n * No provider required — see module docs for pre-mount buffering semantics.\n */\nexport function useSignal(): SignalContextValue {\n  return useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot)\n}\n","/**\n * @sonordev/site-kit/signal - SignalBridge\n *\n * Central coordination layer for Signal AI integration.\n *\n * Architecture (2026-07 perf release): SignalBridge is a tiny SSR-SAFE context shell. It\n * renders {children} immediately — children server-render and hydrate\n * normally, no ssr:false wrapper — and lazy-loads the heavy machinery\n * (SignalCore: config fetch, SSE streaming, experiment assignment, event\n * queue, behavior tracking) as a CHILDLESS sibling. The core registers its\n * imperative API into the shell on mount; `trackEvent`/`trackOutcome` calls\n * made before the core is ready are buffered and drained on registration.\n *\n * This removes the old failure mode where enabling `signal` de-opted the\n * whole route to client rendering (the same SSR bailout the analytics\n * sibling-mount fixed) — the #1 recommendation of the 2026-07 perf audit.\n *\n * The core is NOT idle-deferred: experiment variants must apply as early as\n * possible, so it starts loading on hydration.\n */\n\n'use client'\n\nimport React, { useCallback, useEffect, useMemo, useRef, useState } from 'react'\nimport dynamic from 'next/dynamic'\nimport type { SignalCoreApi, SignalCoreState } from './SignalCore'\nimport type {\n  SignalConfig,\n  SignalContextValue,\n  SignalBridgeProps,\n  SignalEvent,\n  SignalOutcome,\n  ExperimentAssignment,\n} from './types'\n\n// Heavy machinery — loaded client-side only, never wraps content.\nimport { publishSignal, resetSignal, useSignal } from './store'\n\nconst LazySignalCore = dynamic(\n  () => import('./SignalCore').then(m => ({ default: m.SignalCore })),\n  { ssr: false },\n)\n\n// ============================================\n// Context\n// ============================================\n\n// 4.0: the context is gone. useSignal() reads the module store, so consumers\n// work anywhere in the tree and SignalBridge mounts as a childless sibling.\nexport { useSignal } from './store'\n\n// ============================================\n// SignalBridge Component (shell)\n// ============================================\n\nexport function SignalBridge({\n  enabled = true,\n  realtime = true,\n  experiments = true,\n  behaviorTracking = true,\n  visitorId: externalVisitorId,\n  sessionId: externalSessionId,\n  pageMetadataRef,\n  children,\n}: SignalBridgeProps) {\n  const [config, setConfig] = useState<SignalConfig | null>(null)\n  const [loading, setLoading] = useState(true)\n  const [error, setError] = useState<Error | null>(null)\n\n  const coreRef = useRef<SignalCoreApi | null>(null)\n  // Calls made before the core chunk loads are buffered here and drained on\n  // registration — consumers can call trackEvent/trackOutcome from first render.\n  const pendingEventsRef = useRef<Partial<SignalEvent>[]>([])\n  const pendingOutcomesRef = useRef<SignalOutcome[]>([])\n\n  const handleState = useCallback((state: SignalCoreState) => {\n    setConfig(state.config)\n    setLoading(state.loading)\n    setError(state.error)\n  }, [])\n\n  const handleRegister = useCallback((api: SignalCoreApi | null) => {\n    coreRef.current = api\n    if (api) {\n      pendingEventsRef.current.splice(0).forEach(event => api.trackEvent(event))\n      pendingOutcomesRef.current.splice(0).forEach(outcome => api.trackOutcome(outcome))\n    }\n  }, [])\n\n  const trackEvent = useCallback((event: Partial<SignalEvent>) => {\n    if (coreRef.current) {\n      coreRef.current.trackEvent(event)\n    } else {\n      pendingEventsRef.current.push(event)\n    }\n  }, [])\n\n  const trackOutcome = useCallback((outcome: SignalOutcome) => {\n    if (coreRef.current) {\n      coreRef.current.trackOutcome(outcome)\n    } else {\n      pendingOutcomesRef.current.push(outcome)\n    }\n  }, [])\n\n  const getExperiment = useCallback((experimentId: string): ExperimentAssignment | null => {\n    // null before the core loads — identical to the pre-config-fetch behavior\n    // consumers already handle via `loading`.\n    return coreRef.current?.getExperiment(experimentId) ?? null\n  }, [])\n\n  const refreshConfig = useCallback(async () => {\n    await coreRef.current?.refreshConfig()\n  }, [])\n\n  const contextValue = useMemo<SignalContextValue>(() => ({\n    config,\n    loading,\n    error,\n    trackEvent,\n    trackOutcome,\n    getExperiment,\n    refreshConfig,\n  }), [config, loading, error, trackEvent, trackOutcome, getExperiment, refreshConfig])\n\n  // Publish to the module store (drains pre-mount buffered calls on first\n  // publish); reset on unmount so tests/HMR start clean.\n  useEffect(() => {\n    publishSignal(contextValue)\n  }, [contextValue])\n  useEffect(() => () => resetSignal(), [])\n\n  return (\n    <>\n      {children}\n      {enabled && (\n        <LazySignalCore\n          enabled={enabled}\n          realtime={realtime}\n          experiments={experiments}\n          behaviorTracking={behaviorTracking}\n          externalVisitorId={externalVisitorId}\n          externalSessionId={externalSessionId}\n          pageMetadataRef={pageMetadataRef}\n          onRegister={handleRegister}\n          onState={handleState}\n        />\n      )}\n    </>\n  )\n}\n\n// ============================================\n// Convenience Hooks\n// ============================================\n\n/**\n * Hook to access Signal config\n */\nexport function useSignalConfig(): SignalConfig | null {\n  const { config } = useSignal()\n  return config\n}\n\n/**\n * Hook for tracking events\n */\nexport function useSignalEvent() {\n  const { trackEvent } = useSignal()\n  return trackEvent\n}\n\n/**\n * Hook for tracking outcomes/conversions\n */\nexport function useSignalOutcome() {\n  const { trackOutcome } = useSignal()\n  return { trackOutcome }\n}\n\n/**\n * Hook for experiment assignment\n */\nexport function useSignalExperiment(experimentId: string): {\n  assignment: ExperimentAssignment | null\n  variant: string | null\n  isControl: boolean\n} {\n  const { getExperiment, config } = useSignal()\n  const assignment = getExperiment(experimentId)\n\n  // Check if experiment is running\n  const experiment = config?.experiments?.find(e => e.id === experimentId)\n  const isRunning = experiment?.status === 'running'\n\n  return {\n    assignment: isRunning ? assignment : null,\n    variant: isRunning && assignment ? assignment.variant_key : null,\n    isControl: !assignment || assignment.variant_key === 'control',\n  }\n}\n"]}

package/dist/chunk-GIGUDKLS.mjs

@@ -0,0 +1,6 @@
+// src/shared/version.ts
+var SITE_KIT_VERSION = "6.5.0";
+
+export { SITE_KIT_VERSION };
+//# sourceMappingURL=chunk-GIGUDKLS.mjs.map
+//# sourceMappingURL=chunk-GIGUDKLS.mjs.map

package/dist/{chunk-K3PVUXKB.mjs.map → chunk-GIGUDKLS.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";AASO,IAAM,gBAAA,GAAmB","file":"chunk-K3PVUXKB.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared - Package version constant\n *\n * Single source of truth for the version the kit reports at runtime (the\n * x-sitekit-version request header set by sonorFetch). Kept as a plain const\n * so client bundles don't need JSON imports; scripts/verify-dts.cjs asserts\n * it matches package.json at publish time, and version.test.ts asserts it in\n * dev, so it can't silently drift.\n */\nexport const SITE_KIT_VERSION = '6.4.0'\n"]}
+{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";AASO,IAAM,gBAAA,GAAmB","file":"chunk-GIGUDKLS.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared - Package version constant\n *\n * Single source of truth for the version the kit reports at runtime (the\n * x-sitekit-version request header set by sonorFetch). Kept as a plain const\n * so client bundles don't need JSON imports; scripts/verify-dts.cjs asserts\n * it matches package.json at publish time, and version.test.ts asserts it in\n * dev, so it can't silently drift.\n */\nexport const SITE_KIT_VERSION = '6.5.0'\n"]}

package/dist/{chunk-XXSSUCJB.js → chunk-I7AZC5ZQ.js}

@@ -2,7 +2,7 @@
 
 var chunkSNAQBZPT_js = require('./chunk-SNAQBZPT.js');
 
-// ../../../../../../../Volumes/Uptrade Media/GitHub/Sonor/site-kit/node_modules/.pnpm/@babel+parser@8.0.4/node_modules/@babel/parser/lib/index.js
+// node_modules/.pnpm/@babel+parser@8.0.4/node_modules/@babel/parser/lib/index.js
 var Position = class {
   constructor(line, col, index) {
     this.line = void 0;
@@ -14282,4 +14282,4 @@ exports.getLine = getLine;
 exports.parse = parse;
 exports.parseExpression = parseExpression;
 exports.tokTypes = tokTypes;
-//# sourceMappingURL=chunk-XXSSUCJB.js.map
+//# sourceMappingURL=chunk-I7AZC5ZQ.js.map

package/dist/{chunk-C7J4XLBN.js → chunk-IO65ROAO.js}

@@ -1,7 +1,7 @@
 'use strict';
 
-var chunkU5NFIHLY_js = require('./chunk-U5NFIHLY.js');
-var chunkCIB3RHNZ_js = require('./chunk-CIB3RHNZ.js');
+var chunkPIPGH7GA_js = require('./chunk-PIPGH7GA.js');
+var chunkPURI56RE_js = require('./chunk-PURI56RE.js');
 
 // src/shared/fetchWithRetry.ts
 function backoffDelay(attempt, response) {
@@ -50,7 +50,7 @@ var pausedKeys = (() => {
 var warnedThisPage = false;
 function isAuthPaused(credential) {
   if (typeof window === "undefined") return false;
-  const id = chunkU5NFIHLY_js.credentialBreakerId(credential);
+  const id = chunkPIPGH7GA_js.credentialBreakerId(credential);
   const until = pausedKeys.get(id);
   if (!until) return false;
   if (Date.now() >= until) {
@@ -60,7 +60,7 @@ function isAuthPaused(credential) {
   return true;
 }
 function tripBreaker(credential) {
-  pausedKeys.set(chunkU5NFIHLY_js.credentialBreakerId(credential), Date.now() + AUTH_BREAK_MS);
+  pausedKeys.set(chunkPIPGH7GA_js.credentialBreakerId(credential), Date.now() + AUTH_BREAK_MS);
   if (!warnedThisPage) {
     warnedThisPage = true;
     console.info(
@@ -70,13 +70,13 @@ function tripBreaker(credential) {
 }
 async function sonorFetch(url, init = {}, options = {}) {
   let credential = options.apiKey;
-  if (credential !== void 0 || chunkU5NFIHLY_js.isTokenMode()) {
-    credential = await chunkU5NFIHLY_js.getFreshCredential(options.apiKey);
+  if (credential !== void 0 || chunkPIPGH7GA_js.isTokenMode()) {
+    credential = await chunkPIPGH7GA_js.getFreshCredential(options.apiKey);
   }
   const headers = new Headers(init.headers || {});
-  headers.set("x-sitekit-version", chunkCIB3RHNZ_js.SITE_KIT_VERSION);
+  headers.set("x-sitekit-version", chunkPURI56RE_js.SITE_KIT_VERSION);
   if (credential) {
-    if (chunkU5NFIHLY_js.isTokenMode()) {
+    if (chunkPIPGH7GA_js.isTokenMode()) {
       headers.set("x-api-key", credential);
       headers.delete("authorization");
     } else if (!headers.has("x-api-key")) {
@@ -87,11 +87,11 @@ async function sonorFetch(url, init = {}, options = {}) {
     return new Response(null, { status: 401, statusText: "sonor-auth-paused" });
   }
   let response = await fetchWithRetry(url, { ...init, headers }, options);
-  if ((response.status === 401 || response.status === 403) && typeof window !== "undefined" && chunkU5NFIHLY_js.isSiteToken(credential)) {
-    const refreshed = await chunkU5NFIHLY_js.refreshSiteToken();
+  if ((response.status === 401 || response.status === 403) && typeof window !== "undefined" && chunkPIPGH7GA_js.isSiteToken(credential)) {
+    const refreshed = await chunkPIPGH7GA_js.refreshSiteToken();
     if (refreshed && refreshed !== credential) {
       const retryHeaders = new Headers(init.headers || {});
-      retryHeaders.set("x-sitekit-version", chunkCIB3RHNZ_js.SITE_KIT_VERSION);
+      retryHeaders.set("x-sitekit-version", chunkPURI56RE_js.SITE_KIT_VERSION);
       retryHeaders.set("x-api-key", refreshed);
       retryHeaders.delete("authorization");
       credential = refreshed;
@@ -104,7 +104,7 @@ async function sonorFetch(url, init = {}, options = {}) {
   return response;
 }
 function sonorBeacon(url, payload, apiKey) {
-  const credential = chunkU5NFIHLY_js.currentCredential(apiKey);
+  const credential = chunkPIPGH7GA_js.currentCredential(apiKey);
   const body = typeof payload === "string" ? payload : JSON.stringify(payload);
   try {
     void fetch(url, {
@@ -112,7 +112,7 @@ function sonorBeacon(url, payload, apiKey) {
       keepalive: true,
       headers: {
         "Content-Type": "application/json",
-        "x-sitekit-version": chunkCIB3RHNZ_js.SITE_KIT_VERSION,
+        "x-sitekit-version": chunkPURI56RE_js.SITE_KIT_VERSION,
         ...credential ? { "x-api-key": credential } : {}
       },
       body
@@ -130,5 +130,5 @@ function sonorBeacon(url, payload, apiKey) {
 
 exports.sonorBeacon = sonorBeacon;
 exports.sonorFetch = sonorFetch;
-//# sourceMappingURL=chunk-C7J4XLBN.js.map
-//# sourceMappingURL=chunk-C7J4XLBN.js.map
+//# sourceMappingURL=chunk-IO65ROAO.js.map
+//# sourceMappingURL=chunk-IO65ROAO.js.map

package/dist/{chunk-C7J4XLBN.js.map → chunk-IO65ROAO.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/fetchWithRetry.ts","../src/shared/sonorFetch.ts"],"names":["credentialBreakerId","isTokenMode","getFreshCredential","SITE_KIT_VERSION","isSiteToken","refreshSiteToken","currentCredential"],"mappings":";;;;;;AAsBA,SAAS,YAAA,CAAa,SAAiB,QAAA,EAA6B;AAElE,EAAA,IAAI,QAAA,EAAU,WAAW,GAAA,EAAK;AAC5B,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,MAAA,GAAS,QAAA,CAAS,MAAA,EAAQ,EAAE,CAAA,GAAI,GAAA;AAChD,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,IAAK,OAAA,GAAU,CAAA,EAAG,OAAO,IAAA,CAAK,GAAA,CAAI,OAAA,GAAU,GAAA,EAAM,GAAK,CAAA;AAAA,EAClF;AAEA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,GAAA,EAAM,GAAA,GAAM,KAAK,OAAO,CAAA;AAC1C;AASA,eAAsB,cAAA,CACpB,GAAA,EACA,IAAA,EACA,OAAA,GAA6B,EAAC,EACX;AACnB,EAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,IAAA;AACvC,EAAA,IAAI,SAAA;AAEJ,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,OAAA,EAAS,OAAA,EAAA,EAAW;AACnD,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,MAAA,YAAA,CAAa,KAAK,CAAA;AAElB,MAAA,IAAA,CAAK,SAAS,MAAA,KAAW,GAAA,IAAO,SAAS,MAAA,IAAU,GAAA,KAAQ,UAAU,OAAA,EAAS;AAC5E,QAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY,UAAA,CAAW,SAAS,YAAA,CAAa,OAAA,EAAS,QAAQ,CAAC,CAAC,CAAA;AACnF,QAAA;AAAA,MACF;AACA,MAAA,OAAO,QAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,SAAA,GAAY,KAAA;AAEZ,MAAA,IAAI,UAAU,OAAA,EAAS;AACrB,QAAA,MAAM,IAAI,QAAQ,CAAC,OAAA,KAAY,WAAW,OAAA,EAAS,YAAA,CAAa,OAAO,CAAC,CAAC,CAAA;AACzE,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,YAAqB,KAAA,GACvB,SAAA,GACA,IAAI,MAAM,mEAAmE,CAAA;AACnF;;;AC7BA,IAAM,gBAAgB,CAAA,GAAI,GAAA;AAM1B,IAAM,iBAAA,GAAoB,wBAAA;AAC1B,IAAM,cAAmC,MAAM;AAC7C,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,2BAAW,GAAA,EAAI;AAClD,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,CAAA,CAAA,iBAAA,CAAA,KAAA,CAAA,CAAA,iBAAA,CAAA,uBAA6B,GAAA,EAAI,CAAA;AAC3C,CAAA,GAAG;AACH,IAAI,cAAA,GAAiB,KAAA;AAGd,SAAS,aAAa,UAAA,EAA8B;AACzD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,MAAM,EAAA,GAAKA,qCAAoB,UAAU,CAAA;AACzC,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,EAAE,CAAA;AAC/B,EAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,EAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,KAAA,EAAO;AACvB,IAAA,UAAA,CAAW,OAAO,EAAE,CAAA;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,YAAY,UAAA,EAA2B;AAC9C,EAAA,UAAA,CAAW,IAAIA,oCAAA,CAAoB,UAAU,GAAG,IAAA,CAAK,GAAA,KAAQ,aAAa,CAAA;AAC1E,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,cAAA,GAAiB,IAAA;AAGjB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AACF;AAEA,eAAsB,WACpB,GAAA,EACA,IAAA,GAAoB,EAAC,EACrB,OAAA,GAA6B,EAAC,EACX;AAGnB,EAAA,IAAI,aAAa,OAAA,CAAQ,MAAA;AACzB,EAAA,IAAI,UAAA,KAAe,MAAA,IAAaC,4BAAA,EAAY,EAAG;AAC7C,IAAA,UAAA,GAAa,MAAMC,mCAAA,CAAmB,OAAA,CAAQ,MAAM,CAAA;AAAA,EACtD;AAEA,EAAA,MAAM,UAAU,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAC9C,EAAA,OAAA,CAAQ,GAAA,CAAI,qBAAqBC,iCAAgB,CAAA;AACjD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,IAAIF,8BAAY,EAAG;AASjB,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AACnC,MAAA,OAAA,CAAQ,OAAO,eAAe,CAAA;AAAA,IAChC,CAAA,MAAA,IAAW,CAAC,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG;AAEpC,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AAAA,IACrC;AAAA,EACF;AAEA,EAAA,IAAI,YAAA,CAAa,UAAU,CAAA,EAAG;AAG5B,IAAA,OAAO,IAAI,SAAS,IAAA,EAAM,EAAE,QAAQ,GAAA,EAAK,UAAA,EAAY,qBAAqB,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,QAAA,GAAW,MAAM,cAAA,CAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAQ,EAAG,OAAO,CAAA;AAKtE,EAAA,IAAA,CACG,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,QAAA,CAAS,MAAA,KAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClBG,4BAAA,CAAY,UAAU,CAAA,EACtB;AACA,IAAA,MAAM,SAAA,GAAY,MAAMC,iCAAA,EAAiB;AACzC,IAAA,IAAI,SAAA,IAAa,cAAc,UAAA,EAAY;AACzC,MAAA,MAAM,eAAe,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AACnD,MAAA,YAAA,CAAa,GAAA,CAAI,qBAAqBF,iCAAgB,CAAA;AACtD,MAAA,YAAA,CAAa,GAAA,CAAI,aAAa,SAAS,CAAA;AAGvC,MAAA,YAAA,CAAa,OAAO,eAAe,CAAA;AACnC,MAAA,UAAA,GAAa,SAAA;AACb,MAAA,QAAA,GAAW,MAAM,eAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,YAAA,EAAa,EAAG,OAAO,CAAA;AAAA,IAClF;AAAA,EACF;AAEA,EAAA,IAAA,CACG,QAAA,CAAS,WAAW,GAAA,IAAO,QAAA,CAAS,WAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClB,UAAA,EACA;AACA,IAAA,WAAA,CAAY,UAAU,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,QAAA;AACT;AAYO,SAAS,WAAA,CAAY,GAAA,EAAa,OAAA,EAAkB,MAAA,EAAuB;AAChF,EAAA,MAAM,UAAA,GAAaG,mCAAkB,MAAM,CAAA;AAC3C,EAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,IAAA,CAAK,UAAU,OAAO,CAAA;AAC3E,EAAA,IAAI;AACF,IAAA,KAAK,MAAM,GAAA,EAAK;AAAA,MACd,MAAA,EAAQ,MAAA;AAAA,MACR,SAAA,EAAW,IAAA;AAAA,MACX,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqBH,iCAAA;AAAA,QACrB,GAAI,UAAA,GAAa,EAAE,WAAA,EAAa,UAAA,KAAe;AAAC,OAClD;AAAA,MACA;AAAA,KACD,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAEf,CAAC,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AACN,IAAA,IAAI;AACF,MAAA,IAAI,OAAO,SAAA,KAAc,WAAA,IAAe,SAAA,CAAU,UAAA,EAAY;AAC5D,QAAA,SAAA,CAAU,UAAA,CAAW,GAAA,EAAK,IAAI,IAAA,CAAK,CAAC,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,kBAAA,EAAoB,CAAC,CAAA;AAAA,MAC1E;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACF","file":"chunk-C7J4XLBN.js","sourcesContent":["/**\n * @sonordev/site-kit shared - Resilient fetch\n *\n * Single source of truth for client-side resilient fetch (forms, SitemapSync).\n * Adds a per-attempt timeout and retries transient failures (network errors,\n * request timeouts, HTTP 429, and 5xx) with exponential backoff.\n *\n * A form submission must survive a brief API blip — a deploy, a cold start, a\n * dropped packet. A single un-retried fetch turning into \"Something went wrong\"\n * is how leads get lost. The explicit abort also matters on its own: a request\n * left to hang until the browser's own network timeout logs a console error\n * (net::ERR_TIMED_OUT) that fails Lighthouse best-practices; an aborted fetch\n * logs nothing.\n */\n\nexport interface FetchRetryOptions {\n  /** Number of retries AFTER the first attempt (default 2 → up to 3 tries total). */\n  retries?: number\n  /** Per-attempt timeout in milliseconds (default 15000). */\n  timeoutMs?: number\n}\n\nfunction backoffDelay(attempt: number, response?: Response): number {\n  // Honor a Retry-After header on 429 responses when present.\n  if (response?.status === 429) {\n    const header = response.headers.get('retry-after')\n    const seconds = header ? parseInt(header, 10) : NaN\n    if (!Number.isNaN(seconds) && seconds > 0) return Math.min(seconds * 1000, 10000)\n  }\n  // Exponential backoff: 500ms, 1s, 2s, ... capped at 8s.\n  return Math.min(8000, 500 * 2 ** attempt)\n}\n\n/**\n * fetch() with a timeout and automatic retries for transient failures.\n *\n * Non-transient responses (2xx, 3xx, and 4xx other than 429) are returned to\n * the caller as-is — only 429/5xx and thrown network/timeout errors are retried.\n * If every attempt fails with a thrown error, the last error is re-thrown.\n */\nexport async function fetchWithRetry(\n  url: string,\n  init: RequestInit,\n  options: FetchRetryOptions = {},\n): Promise<Response> {\n  const retries = options.retries ?? 2\n  const timeoutMs = options.timeoutMs ?? 15000\n  let lastError: unknown\n\n  for (let attempt = 0; attempt <= retries; attempt++) {\n    const controller = new AbortController()\n    const timer = setTimeout(() => controller.abort(), timeoutMs)\n    try {\n      const response = await fetch(url, { ...init, signal: controller.signal })\n      clearTimeout(timer)\n\n      if ((response.status === 429 || response.status >= 500) && attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt, response)))\n        continue\n      }\n      return response\n    } catch (error) {\n      clearTimeout(timer)\n      lastError = error\n      // Network failure or timeout (AbortController) — retry while attempts remain.\n      if (attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt)))\n        continue\n      }\n    }\n  }\n\n  throw lastError instanceof Error\n    ? lastError\n    : new Error('Network request failed after multiple attempts. Please try again.')\n}\n","/**\n * @sonordev/site-kit shared - Canonical client transport\n *\n * Single source of truth for how site-kit talks to Sonor from the browser.\n * Every client-side module (analytics, forms, commerce, engage, maps, images,\n * SitemapSync) routes through here instead of bare fetch(), which gives the\n * whole kit, in one place:\n *\n *  - per-attempt timeout + retry with backoff (via fetchWithRetry) — a hung\n *    request left to the browser's own network timeout logs a console error\n *    (net::ERR_TIMED_OUT) that fails Lighthouse best-practices\n *  - the x-sitekit-version header on every request, so the platform can see\n *    which kit version each site actually runs from live traffic\n *  - CREDENTIAL LIFECYCLE: sites on 3.2+ ship a short-lived minted token instead\n *    of the raw key. This transport resolves the freshest token (refreshing a\n *    stale seed transparently), and on a 401/403 for a token it refreshes once\n *    and retries before giving up. A raw key (2.x kit, or the mint-failed\n *    fallback) is a pure passthrough — legacy behavior is unchanged.\n *  - an auth circuit breaker: after a 401/403 the credential is paused for a few\n *    minutes and ONE friendly console.info is emitted — a site on a stale or\n *    canceled key must not spam the API or the visitor's console. Keyed by the\n *    project (from the token) so it survives token rotation.\n *  - sonorBeacon for unload-time telemetry that keeps the credential in headers;\n *    navigator.sendBeacon can't set headers and forced the key into the URL,\n *    where server and CDN access logs capture it\n *\n * Non-idempotent endpoints (checkout, payment intents, uploads) must pass\n * { retries: 0 } — they still get the timeout, but never an automatic retry.\n */\nimport { fetchWithRetry, type FetchRetryOptions } from './fetchWithRetry'\nimport { SITE_KIT_VERSION } from './version'\nimport {\n  credentialBreakerId,\n  currentCredential,\n  getFreshCredential,\n  isSiteToken,\n  isTokenMode,\n  refreshSiteToken,\n} from './siteToken'\n\nexport interface SonorFetchOptions extends FetchRetryOptions {\n  /** Project credential — the minted token (3.2+) or raw key. Sent as x-api-key. */\n  apiKey?: string\n}\n\n/** How long a credential stays paused after an auth failure. */\nconst AUTH_BREAK_MS = 5 * 60_000\n\n// breaker id → epoch ms until which requests are paused. Shared on window for\n// the same reason as the token state (see siteToken.ts): duplicated module\n// copies must trip and observe ONE breaker, not one each. Never applies on the\n// server, so a per-module Map there is fine.\nconst BREAKER_STATE_KEY = '__SONOR_AUTH_BREAKER__'\nconst pausedKeys: Map<string, number> = (() => {\n  if (typeof window === 'undefined') return new Map()\n  const w = window as unknown as Record<string, Map<string, number> | undefined>\n  return (w[BREAKER_STATE_KEY] ??= new Map())\n})()\nlet warnedThisPage = false\n\n/** True when a previous 401/403 has paused this credential (browser only). */\nexport function isAuthPaused(credential?: string): boolean {\n  if (typeof window === 'undefined') return false\n  const id = credentialBreakerId(credential)\n  const until = pausedKeys.get(id)\n  if (!until) return false\n  if (Date.now() >= until) {\n    pausedKeys.delete(id)\n    return false\n  }\n  return true\n}\n\nfunction tripBreaker(credential?: string): void {\n  pausedKeys.set(credentialBreakerId(credential), Date.now() + AUTH_BREAK_MS)\n  if (!warnedThisPage) {\n    warnedThisPage = true\n    // info, not error: a visitor's console must stay clean (Lighthouse\n    // errors-in-console), and copy never names env vars or key formats.\n    console.info(\n      \"[Sonor] This site couldn't authenticate with Sonor, so data features are paused for a few minutes. If this keeps happening, the site is likely running an outdated API key.\",\n    )\n  }\n}\n\nexport async function sonorFetch(\n  url: string,\n  init: RequestInit = {},\n  options: SonorFetchOptions = {},\n): Promise<Response> {\n  // Resolve the credential to send. In token mode this may transparently refresh\n  // a stale seed before the first request; in raw-key mode it's a passthrough.\n  let credential = options.apiKey\n  if (credential !== undefined || isTokenMode()) {\n    credential = await getFreshCredential(options.apiKey)\n  }\n\n  const headers = new Headers(init.headers || {})\n  headers.set('x-sitekit-version', SITE_KIT_VERSION)\n  if (credential) {\n    if (isTokenMode()) {\n      // Token mode: `credential` is the freshest token (refreshed just above if\n      // the seed was stale). It MUST override any x-api-key a caller hand-set — a\n      // stale build-time seed passed as a header would otherwise pin the request\n      // and defeat refresh entirely. Also drop a caller-set Authorization:\n      // extractApiKey() server-side prefers `Authorization: Bearer` over\n      // x-api-key, so a stale Bearer seed would win even once we set a fresh\n      // x-api-key. This is the single place the client credential is chosen — do\n      // not re-attach it as a header at call sites.\n      headers.set('x-api-key', credential)\n      headers.delete('authorization')\n    } else if (!headers.has('x-api-key')) {\n      // Raw-key mode: legacy passthrough — respect a caller-supplied header.\n      headers.set('x-api-key', credential)\n    }\n  }\n\n  if (isAuthPaused(credential)) {\n    // Synthetic response keeps every caller's !response.ok path working\n    // without a network round trip while the breaker is open.\n    return new Response(null, { status: 401, statusText: 'sonor-auth-paused' })\n  }\n\n  let response = await fetchWithRetry(url, { ...init, headers }, options)\n\n  // A token can rotate or expire mid-session. On the first auth failure, try ONE\n  // refresh + retry before tripping the breaker — only for token credentials\n  // (raw keys have nothing to refresh).\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    isSiteToken(credential)\n  ) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed && refreshed !== credential) {\n      const retryHeaders = new Headers(init.headers || {})\n      retryHeaders.set('x-sitekit-version', SITE_KIT_VERSION)\n      retryHeaders.set('x-api-key', refreshed)\n      // Same reason as the initial request: a caller-set stale Bearer would win\n      // over our fresh x-api-key server-side, so strip it on the retry too.\n      retryHeaders.delete('authorization')\n      credential = refreshed\n      response = await fetchWithRetry(url, { ...init, headers: retryHeaders }, options)\n    }\n  }\n\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    credential\n  ) {\n    tripBreaker(credential)\n  }\n\n  return response\n}\n\n/**\n * Fire-and-forget telemetry that survives page unload.\n *\n * Uses fetch({ keepalive: true }) so auth travels in headers. Falls back to\n * navigator.sendBeacon (no auth headers possible — the server may reject it,\n * but we never put the key in the URL) only when keepalive fetch is missing.\n *\n * Cannot await a refresh at unload time, so it sends the freshest token already\n * held (currentCredential) rather than the possibly-stale seed the caller passed.\n */\nexport function sonorBeacon(url: string, payload: unknown, apiKey?: string): void {\n  const credential = currentCredential(apiKey)\n  const body = typeof payload === 'string' ? payload : JSON.stringify(payload)\n  try {\n    void fetch(url, {\n      method: 'POST',\n      keepalive: true,\n      headers: {\n        'Content-Type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        ...(credential ? { 'x-api-key': credential } : {}),\n      },\n      body,\n    }).catch(() => {\n      /* page is closing — best effort */\n    })\n  } catch {\n    try {\n      if (typeof navigator !== 'undefined' && navigator.sendBeacon) {\n        navigator.sendBeacon(url, new Blob([body], { type: 'application/json' }))\n      }\n    } catch {\n      /* nothing left to try */\n    }\n  }\n}\n"]}
+{"version":3,"sources":["../src/shared/fetchWithRetry.ts","../src/shared/sonorFetch.ts"],"names":["credentialBreakerId","isTokenMode","getFreshCredential","SITE_KIT_VERSION","isSiteToken","refreshSiteToken","currentCredential"],"mappings":";;;;;;AAsBA,SAAS,YAAA,CAAa,SAAiB,QAAA,EAA6B;AAElE,EAAA,IAAI,QAAA,EAAU,WAAW,GAAA,EAAK;AAC5B,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,MAAA,GAAS,QAAA,CAAS,MAAA,EAAQ,EAAE,CAAA,GAAI,GAAA;AAChD,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,IAAK,OAAA,GAAU,CAAA,EAAG,OAAO,IAAA,CAAK,GAAA,CAAI,OAAA,GAAU,GAAA,EAAM,GAAK,CAAA;AAAA,EAClF;AAEA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,GAAA,EAAM,GAAA,GAAM,KAAK,OAAO,CAAA;AAC1C;AASA,eAAsB,cAAA,CACpB,GAAA,EACA,IAAA,EACA,OAAA,GAA6B,EAAC,EACX;AACnB,EAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,IAAA;AACvC,EAAA,IAAI,SAAA;AAEJ,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,OAAA,EAAS,OAAA,EAAA,EAAW;AACnD,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,MAAA,YAAA,CAAa,KAAK,CAAA;AAElB,MAAA,IAAA,CAAK,SAAS,MAAA,KAAW,GAAA,IAAO,SAAS,MAAA,IAAU,GAAA,KAAQ,UAAU,OAAA,EAAS;AAC5E,QAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY,UAAA,CAAW,SAAS,YAAA,CAAa,OAAA,EAAS,QAAQ,CAAC,CAAC,CAAA;AACnF,QAAA;AAAA,MACF;AACA,MAAA,OAAO,QAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,SAAA,GAAY,KAAA;AAEZ,MAAA,IAAI,UAAU,OAAA,EAAS;AACrB,QAAA,MAAM,IAAI,QAAQ,CAAC,OAAA,KAAY,WAAW,OAAA,EAAS,YAAA,CAAa,OAAO,CAAC,CAAC,CAAA;AACzE,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,YAAqB,KAAA,GACvB,SAAA,GACA,IAAI,MAAM,mEAAmE,CAAA;AACnF;;;AC7BA,IAAM,gBAAgB,CAAA,GAAI,GAAA;AAM1B,IAAM,iBAAA,GAAoB,wBAAA;AAC1B,IAAM,cAAmC,MAAM;AAC7C,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,2BAAW,GAAA,EAAI;AAClD,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,CAAA,CAAA,iBAAA,CAAA,KAAA,CAAA,CAAA,iBAAA,CAAA,uBAA6B,GAAA,EAAI,CAAA;AAC3C,CAAA,GAAG;AACH,IAAI,cAAA,GAAiB,KAAA;AAGd,SAAS,aAAa,UAAA,EAA8B;AACzD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,MAAM,EAAA,GAAKA,qCAAoB,UAAU,CAAA;AACzC,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,EAAE,CAAA;AAC/B,EAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,EAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,KAAA,EAAO;AACvB,IAAA,UAAA,CAAW,OAAO,EAAE,CAAA;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,YAAY,UAAA,EAA2B;AAC9C,EAAA,UAAA,CAAW,IAAIA,oCAAA,CAAoB,UAAU,GAAG,IAAA,CAAK,GAAA,KAAQ,aAAa,CAAA;AAC1E,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,cAAA,GAAiB,IAAA;AAGjB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AACF;AAEA,eAAsB,WACpB,GAAA,EACA,IAAA,GAAoB,EAAC,EACrB,OAAA,GAA6B,EAAC,EACX;AAGnB,EAAA,IAAI,aAAa,OAAA,CAAQ,MAAA;AACzB,EAAA,IAAI,UAAA,KAAe,MAAA,IAAaC,4BAAA,EAAY,EAAG;AAC7C,IAAA,UAAA,GAAa,MAAMC,mCAAA,CAAmB,OAAA,CAAQ,MAAM,CAAA;AAAA,EACtD;AAEA,EAAA,MAAM,UAAU,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAC9C,EAAA,OAAA,CAAQ,GAAA,CAAI,qBAAqBC,iCAAgB,CAAA;AACjD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,IAAIF,8BAAY,EAAG;AASjB,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AACnC,MAAA,OAAA,CAAQ,OAAO,eAAe,CAAA;AAAA,IAChC,CAAA,MAAA,IAAW,CAAC,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG;AAEpC,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AAAA,IACrC;AAAA,EACF;AAEA,EAAA,IAAI,YAAA,CAAa,UAAU,CAAA,EAAG;AAG5B,IAAA,OAAO,IAAI,SAAS,IAAA,EAAM,EAAE,QAAQ,GAAA,EAAK,UAAA,EAAY,qBAAqB,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,QAAA,GAAW,MAAM,cAAA,CAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAQ,EAAG,OAAO,CAAA;AAKtE,EAAA,IAAA,CACG,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,QAAA,CAAS,MAAA,KAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClBG,4BAAA,CAAY,UAAU,CAAA,EACtB;AACA,IAAA,MAAM,SAAA,GAAY,MAAMC,iCAAA,EAAiB;AACzC,IAAA,IAAI,SAAA,IAAa,cAAc,UAAA,EAAY;AACzC,MAAA,MAAM,eAAe,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AACnD,MAAA,YAAA,CAAa,GAAA,CAAI,qBAAqBF,iCAAgB,CAAA;AACtD,MAAA,YAAA,CAAa,GAAA,CAAI,aAAa,SAAS,CAAA;AAGvC,MAAA,YAAA,CAAa,OAAO,eAAe,CAAA;AACnC,MAAA,UAAA,GAAa,SAAA;AACb,MAAA,QAAA,GAAW,MAAM,eAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,YAAA,EAAa,EAAG,OAAO,CAAA;AAAA,IAClF;AAAA,EACF;AAEA,EAAA,IAAA,CACG,QAAA,CAAS,WAAW,GAAA,IAAO,QAAA,CAAS,WAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClB,UAAA,EACA;AACA,IAAA,WAAA,CAAY,UAAU,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,QAAA;AACT;AAYO,SAAS,WAAA,CAAY,GAAA,EAAa,OAAA,EAAkB,MAAA,EAAuB;AAChF,EAAA,MAAM,UAAA,GAAaG,mCAAkB,MAAM,CAAA;AAC3C,EAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,IAAA,CAAK,UAAU,OAAO,CAAA;AAC3E,EAAA,IAAI;AACF,IAAA,KAAK,MAAM,GAAA,EAAK;AAAA,MACd,MAAA,EAAQ,MAAA;AAAA,MACR,SAAA,EAAW,IAAA;AAAA,MACX,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqBH,iCAAA;AAAA,QACrB,GAAI,UAAA,GAAa,EAAE,WAAA,EAAa,UAAA,KAAe;AAAC,OAClD;AAAA,MACA;AAAA,KACD,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAEf,CAAC,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AACN,IAAA,IAAI;AACF,MAAA,IAAI,OAAO,SAAA,KAAc,WAAA,IAAe,SAAA,CAAU,UAAA,EAAY;AAC5D,QAAA,SAAA,CAAU,UAAA,CAAW,GAAA,EAAK,IAAI,IAAA,CAAK,CAAC,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,kBAAA,EAAoB,CAAC,CAAA;AAAA,MAC1E;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACF","file":"chunk-IO65ROAO.js","sourcesContent":["/**\n * @sonordev/site-kit shared - Resilient fetch\n *\n * Single source of truth for client-side resilient fetch (forms, SitemapSync).\n * Adds a per-attempt timeout and retries transient failures (network errors,\n * request timeouts, HTTP 429, and 5xx) with exponential backoff.\n *\n * A form submission must survive a brief API blip — a deploy, a cold start, a\n * dropped packet. A single un-retried fetch turning into \"Something went wrong\"\n * is how leads get lost. The explicit abort also matters on its own: a request\n * left to hang until the browser's own network timeout logs a console error\n * (net::ERR_TIMED_OUT) that fails Lighthouse best-practices; an aborted fetch\n * logs nothing.\n */\n\nexport interface FetchRetryOptions {\n  /** Number of retries AFTER the first attempt (default 2 → up to 3 tries total). */\n  retries?: number\n  /** Per-attempt timeout in milliseconds (default 15000). */\n  timeoutMs?: number\n}\n\nfunction backoffDelay(attempt: number, response?: Response): number {\n  // Honor a Retry-After header on 429 responses when present.\n  if (response?.status === 429) {\n    const header = response.headers.get('retry-after')\n    const seconds = header ? parseInt(header, 10) : NaN\n    if (!Number.isNaN(seconds) && seconds > 0) return Math.min(seconds * 1000, 10000)\n  }\n  // Exponential backoff: 500ms, 1s, 2s, ... capped at 8s.\n  return Math.min(8000, 500 * 2 ** attempt)\n}\n\n/**\n * fetch() with a timeout and automatic retries for transient failures.\n *\n * Non-transient responses (2xx, 3xx, and 4xx other than 429) are returned to\n * the caller as-is — only 429/5xx and thrown network/timeout errors are retried.\n * If every attempt fails with a thrown error, the last error is re-thrown.\n */\nexport async function fetchWithRetry(\n  url: string,\n  init: RequestInit,\n  options: FetchRetryOptions = {},\n): Promise<Response> {\n  const retries = options.retries ?? 2\n  const timeoutMs = options.timeoutMs ?? 15000\n  let lastError: unknown\n\n  for (let attempt = 0; attempt <= retries; attempt++) {\n    const controller = new AbortController()\n    const timer = setTimeout(() => controller.abort(), timeoutMs)\n    try {\n      const response = await fetch(url, { ...init, signal: controller.signal })\n      clearTimeout(timer)\n\n      if ((response.status === 429 || response.status >= 500) && attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt, response)))\n        continue\n      }\n      return response\n    } catch (error) {\n      clearTimeout(timer)\n      lastError = error\n      // Network failure or timeout (AbortController) — retry while attempts remain.\n      if (attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt)))\n        continue\n      }\n    }\n  }\n\n  throw lastError instanceof Error\n    ? lastError\n    : new Error('Network request failed after multiple attempts. Please try again.')\n}\n","/**\n * @sonordev/site-kit shared - Canonical client transport\n *\n * Single source of truth for how site-kit talks to Sonor from the browser.\n * Every client-side module (analytics, forms, commerce, engage, maps, images,\n * SitemapSync) routes through here instead of bare fetch(), which gives the\n * whole kit, in one place:\n *\n *  - per-attempt timeout + retry with backoff (via fetchWithRetry) — a hung\n *    request left to the browser's own network timeout logs a console error\n *    (net::ERR_TIMED_OUT) that fails Lighthouse best-practices\n *  - the x-sitekit-version header on every request, so the platform can see\n *    which kit version each site actually runs from live traffic\n *  - CREDENTIAL LIFECYCLE: sites on 3.2+ ship a short-lived minted token instead\n *    of the raw key. This transport resolves the freshest token (refreshing a\n *    stale seed transparently), and on a 401/403 for a token it refreshes once\n *    and retries before giving up. A raw key (2.x kit, or the mint-failed\n *    fallback) is a pure passthrough — legacy behavior is unchanged.\n *  - an auth circuit breaker: after a 401/403 the credential is paused for a few\n *    minutes and ONE friendly console.info is emitted — a site on a stale or\n *    canceled key must not spam the API or the visitor's console. Keyed by the\n *    project (from the token) so it survives token rotation.\n *  - sonorBeacon for unload-time telemetry that keeps the credential in headers;\n *    navigator.sendBeacon can't set headers and forced the key into the URL,\n *    where server and CDN access logs capture it\n *\n * Non-idempotent endpoints (checkout, payment intents, uploads) must pass\n * { retries: 0 } — they still get the timeout, but never an automatic retry.\n */\nimport { fetchWithRetry, type FetchRetryOptions } from './fetchWithRetry'\nimport { SITE_KIT_VERSION } from './version'\nimport {\n  credentialBreakerId,\n  currentCredential,\n  getFreshCredential,\n  isSiteToken,\n  isTokenMode,\n  refreshSiteToken,\n} from './siteToken'\n\nexport interface SonorFetchOptions extends FetchRetryOptions {\n  /** Project credential — the minted token (3.2+) or raw key. Sent as x-api-key. */\n  apiKey?: string\n}\n\n/** How long a credential stays paused after an auth failure. */\nconst AUTH_BREAK_MS = 5 * 60_000\n\n// breaker id → epoch ms until which requests are paused. Shared on window for\n// the same reason as the token state (see siteToken.ts): duplicated module\n// copies must trip and observe ONE breaker, not one each. Never applies on the\n// server, so a per-module Map there is fine.\nconst BREAKER_STATE_KEY = '__SONOR_AUTH_BREAKER__'\nconst pausedKeys: Map<string, number> = (() => {\n  if (typeof window === 'undefined') return new Map()\n  const w = window as unknown as Record<string, Map<string, number> | undefined>\n  return (w[BREAKER_STATE_KEY] ??= new Map())\n})()\nlet warnedThisPage = false\n\n/** True when a previous 401/403 has paused this credential (browser only). */\nexport function isAuthPaused(credential?: string): boolean {\n  if (typeof window === 'undefined') return false\n  const id = credentialBreakerId(credential)\n  const until = pausedKeys.get(id)\n  if (!until) return false\n  if (Date.now() >= until) {\n    pausedKeys.delete(id)\n    return false\n  }\n  return true\n}\n\nfunction tripBreaker(credential?: string): void {\n  pausedKeys.set(credentialBreakerId(credential), Date.now() + AUTH_BREAK_MS)\n  if (!warnedThisPage) {\n    warnedThisPage = true\n    // info, not error: a visitor's console must stay clean (Lighthouse\n    // errors-in-console), and copy never names env vars or key formats.\n    console.info(\n      \"[Sonor] This site couldn't authenticate with Sonor, so data features are paused for a few minutes. If this keeps happening, the site is likely running an outdated API key.\",\n    )\n  }\n}\n\nexport async function sonorFetch(\n  url: string,\n  init: RequestInit = {},\n  options: SonorFetchOptions = {},\n): Promise<Response> {\n  // Resolve the credential to send. In token mode this may transparently refresh\n  // a stale seed before the first request; in raw-key mode it's a passthrough.\n  let credential = options.apiKey\n  if (credential !== undefined || isTokenMode()) {\n    credential = await getFreshCredential(options.apiKey)\n  }\n\n  const headers = new Headers(init.headers || {})\n  headers.set('x-sitekit-version', SITE_KIT_VERSION)\n  if (credential) {\n    if (isTokenMode()) {\n      // Token mode: `credential` is the freshest token (refreshed just above if\n      // the seed was stale). It MUST override any x-api-key a caller hand-set — a\n      // stale build-time seed passed as a header would otherwise pin the request\n      // and defeat refresh entirely. Also drop a caller-set Authorization:\n      // extractApiKey() server-side prefers `Authorization: Bearer` over\n      // x-api-key, so a stale Bearer seed would win even once we set a fresh\n      // x-api-key. This is the single place the client credential is chosen — do\n      // not re-attach it as a header at call sites.\n      headers.set('x-api-key', credential)\n      headers.delete('authorization')\n    } else if (!headers.has('x-api-key')) {\n      // Raw-key mode: legacy passthrough — respect a caller-supplied header.\n      headers.set('x-api-key', credential)\n    }\n  }\n\n  if (isAuthPaused(credential)) {\n    // Synthetic response keeps every caller's !response.ok path working\n    // without a network round trip while the breaker is open.\n    return new Response(null, { status: 401, statusText: 'sonor-auth-paused' })\n  }\n\n  let response = await fetchWithRetry(url, { ...init, headers }, options)\n\n  // A token can rotate or expire mid-session. On the first auth failure, try ONE\n  // refresh + retry before tripping the breaker — only for token credentials\n  // (raw keys have nothing to refresh).\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    isSiteToken(credential)\n  ) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed && refreshed !== credential) {\n      const retryHeaders = new Headers(init.headers || {})\n      retryHeaders.set('x-sitekit-version', SITE_KIT_VERSION)\n      retryHeaders.set('x-api-key', refreshed)\n      // Same reason as the initial request: a caller-set stale Bearer would win\n      // over our fresh x-api-key server-side, so strip it on the retry too.\n      retryHeaders.delete('authorization')\n      credential = refreshed\n      response = await fetchWithRetry(url, { ...init, headers: retryHeaders }, options)\n    }\n  }\n\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    credential\n  ) {\n    tripBreaker(credential)\n  }\n\n  return response\n}\n\n/**\n * Fire-and-forget telemetry that survives page unload.\n *\n * Uses fetch({ keepalive: true }) so auth travels in headers. Falls back to\n * navigator.sendBeacon (no auth headers possible — the server may reject it,\n * but we never put the key in the URL) only when keepalive fetch is missing.\n *\n * Cannot await a refresh at unload time, so it sends the freshest token already\n * held (currentCredential) rather than the possibly-stale seed the caller passed.\n */\nexport function sonorBeacon(url: string, payload: unknown, apiKey?: string): void {\n  const credential = currentCredential(apiKey)\n  const body = typeof payload === 'string' ? payload : JSON.stringify(payload)\n  try {\n    void fetch(url, {\n      method: 'POST',\n      keepalive: true,\n      headers: {\n        'Content-Type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        ...(credential ? { 'x-api-key': credential } : {}),\n      },\n      body,\n    }).catch(() => {\n      /* page is closing — best effort */\n    })\n  } catch {\n    try {\n      if (typeof navigator !== 'undefined' && navigator.sendBeacon) {\n        navigator.sendBeacon(url, new Blob([body], { type: 'application/json' }))\n      }\n    } catch {\n      /* nothing left to try */\n    }\n  }\n}\n"]}

package/dist/chunk-JCDX37BY.js

@@ -0,0 +1,58 @@
+'use strict';
+
+// src/shared/frame.ts
+function isFramed() {
+  if (typeof window === "undefined") return false;
+  try {
+    return window.self !== window.top;
+  } catch {
+    return true;
+  }
+}
+function isTopFrameSameOrigin() {
+  if (typeof window === "undefined") return false;
+  try {
+    return typeof window.top?.location?.href === "string";
+  } catch {
+    return false;
+  }
+}
+function isCrossOriginFrame() {
+  if (!isFramed()) return false;
+  return !isTopFrameSameOrigin();
+}
+var FRAME_READY_MESSAGE = "sonor:frame-ready";
+function isFrameReadyMessage(data) {
+  return !!data && typeof data === "object" && data.type === FRAME_READY_MESSAGE && data.v === 1;
+}
+function announceFrameReady() {
+  if (typeof window === "undefined" || !isCrossOriginFrame()) return () => {
+  };
+  let cancelled = false;
+  let raf = 0;
+  const post = () => {
+    raf = requestAnimationFrame(() => {
+      raf = requestAnimationFrame(() => {
+        if (cancelled) return;
+        const message = { type: FRAME_READY_MESSAGE, v: 1 };
+        window.parent.postMessage(message, "*");
+      });
+    });
+  };
+  if (document.readyState === "complete") post();
+  else window.addEventListener("load", post, { once: true });
+  return () => {
+    cancelled = true;
+    cancelAnimationFrame(raf);
+    window.removeEventListener("load", post);
+  };
+}
+
+exports.FRAME_READY_MESSAGE = FRAME_READY_MESSAGE;
+exports.announceFrameReady = announceFrameReady;
+exports.isCrossOriginFrame = isCrossOriginFrame;
+exports.isFrameReadyMessage = isFrameReadyMessage;
+exports.isFramed = isFramed;
+exports.isTopFrameSameOrigin = isTopFrameSameOrigin;
+//# sourceMappingURL=chunk-JCDX37BY.js.map
+//# sourceMappingURL=chunk-JCDX37BY.js.map

package/dist/chunk-JCDX37BY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared/frame.ts"],"names":[],"mappings":";;;AA4DO,SAAS,QAAA,GAAoB;AAClC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,IAAI;AACF,IAAA,OAAO,MAAA,CAAO,SAAS,MAAA,CAAO,GAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAMO,SAAS,oBAAA,GAAgC;AAC9C,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,IAAI;AACF,IAAA,OAAO,OAAO,MAAA,CAAO,GAAA,EAAK,QAAA,EAAU,IAAA,KAAS,QAAA;AAAA,EAC/C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAMO,SAAS,kBAAA,GAA8B;AAC5C,EAAA,IAAI,CAAC,QAAA,EAAS,EAAG,OAAO,KAAA;AACxB,EAAA,OAAO,CAAC,oBAAA,EAAqB;AAC/B;AAiBO,IAAM,mBAAA,GAAsB;AAQ5B,SAAS,oBAAoB,IAAA,EAA0C;AAC5E,EAAA,OACE,CAAC,CAAC,IAAA,IACF,OAAO,IAAA,KAAS,YACf,IAAA,CAA4B,IAAA,KAAS,mBAAA,IACrC,IAAA,CAAyB,CAAA,KAAM,CAAA;AAEpC;AAQO,SAAS,kBAAA,GAAiC;AAC/C,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,CAAC,kBAAA,EAAmB,SAAU,MAAM;AAAA,EAAC,CAAA;AAC1E,EAAA,IAAI,SAAA,GAAY,KAAA;AAChB,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,MAAM,OAAO,MAAM;AACjB,IAAA,GAAA,GAAM,sBAAsB,MAAM;AAChC,MAAA,GAAA,GAAM,sBAAsB,MAAM;AAChC,QAAA,IAAI,SAAA,EAAW;AACf,QAAA,MAAM,OAAA,GAA6B,EAAE,IAAA,EAAM,mBAAA,EAAqB,GAAG,CAAA,EAAE;AACrE,QAAA,MAAA,CAAO,MAAA,CAAO,WAAA,CAAY,OAAA,EAAS,GAAG,CAAA;AAAA,MACxC,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH,CAAA;AACA,EAAA,IAAI,QAAA,CAAS,UAAA,KAAe,UAAA,EAAY,IAAA,EAAK;AAAA,cACjC,gBAAA,CAAiB,MAAA,EAAQ,MAAM,EAAE,IAAA,EAAM,MAAM,CAAA;AACzD,EAAA,OAAO,MAAM;AACX,IAAA,SAAA,GAAY,IAAA;AACZ,IAAA,oBAAA,CAAqB,GAAG,CAAA;AACxB,IAAA,MAAA,CAAO,mBAAA,CAAoB,QAAQ,IAAI,CAAA;AAAA,EACzC,CAAA;AACF","file":"chunk-JCDX37BY.js","sourcesContent":["/**\n * @sonordev/site-kit shared — am I inside someone else's page?\n *\n * SINGLE SOURCE OF TRUTH for the frame relationship. Any module that has to\n * decide whether this document is an embed imports from here; nobody writes a\n * second `window.top` check. Two copies of this rule would drift, and the\n * drift is invisible — a module that answers \"not framed\" when it is just\n * quietly writes another tenant's traffic into a client's project.\n *\n * ─── Why it exists ─────────────────────────────────────────────────────────\n *\n * Upforge case studies embed each client's whole production site in three\n * eager iframes (agency-site-kit `DeviceTrifolio`), and\n * `proxy/securityHeaders.ts`'s DEFAULT_FRAME_ANCESTORS lets upforge.io and\n * upforgelabs.com frame every managed site. Inside that frame the client's\n * site loads, hydrates and runs its site-kit modules exactly as it would for\n * a real visitor — the screenshot overlay covers the PIXELS, not the\n * JavaScript. Anything that phones home from there is attributing a visit to\n * upforge.io's page to the client's own project. Measured effect, and the\n * analytics decision built on this: `analytics/send-gate.ts`.\n *\n * ─── Detection ─────────────────────────────────────────────────────────────\n *\n * `window.self !== window.top` is the reliable signal. `top` is a\n * cross-origin-readable property, so the comparison never throws — unlike\n * touching `top.location`, which is exactly what makes the naive check\n * unusable and is the reason this is written down once.\n *\n * Same-origin is then probed by *actually reading* `top.location.href` and\n * catching the SecurityError. That is the only honest test: comparing URL\n * strings cannot see through a sandboxed, opaque, or `about:blank` origin,\n * and would call a hostile embedder same-origin if it faked the right host.\n *\n * The probe only runs when the document IS framed, so the top-level case —\n * every real visitor on every site — costs one property comparison and never\n * enters a try/catch.\n *\n * ─── Same-origin frames are NOT treated as embeds ──────────────────────────\n *\n * Being framed is not the problem; being framed by SOMEONE ELSE is. When the\n * top document is same-origin the site is embedding itself — a preview pane,\n * a print view, an on-domain booking or checkout frame. The visitor really is\n * on that site, the operator controls both documents, and there is no other\n * tenant's project to pollute. Callers should keep working normally there;\n * treating it as an embed would drop legitimate data to buy nothing.\n *\n * Nesting resolves the way you would want, because these compare against\n * `window.top` and not `window.parent`: a same-origin frame nested inside a\n * cross-origin one (upforge.io → client.com → client.com/widget) is still\n * correctly reported as a cross-origin embed.\n */\n\n/**\n * True when this document is not the top-level browsing context.\n *\n * Never throws in practice; the catch exists so a hostile or exotic embedder\n * cannot crash a caller, and it fails CLOSED (treat \"cannot tell\" as framed).\n * A false positive costs one site some of its own data; a false negative\n * writes into someone else's — the asymmetry decides the default.\n */\nexport function isFramed(): boolean {\n  if (typeof window === 'undefined') return false\n  try {\n    return window.self !== window.top\n  } catch {\n    return true\n  }\n}\n\n/**\n * True when the TOP document is same-origin and therefore readable.\n * Only meaningful when {@link isFramed} is true.\n */\nexport function isTopFrameSameOrigin(): boolean {\n  if (typeof window === 'undefined') return false\n  try {\n    return typeof window.top?.location?.href === 'string'\n  } catch {\n    return false\n  }\n}\n\n/**\n * True when this document is running inside a CROSS-ORIGIN frame — i.e. it is\n * someone else's embed, and its activity is not this site's traffic.\n */\nexport function isCrossOriginFrame(): boolean {\n  if (!isFramed()) return false\n  return !isTopFrameSameOrigin()\n}\n\n// ─── Telling the embedder this page has painted ────────────────────────────\n//\n// A case study shows a client's live site inside device frames, over a\n// screenshot of it. The screenshot should give way once the live page has\n// actually painted, and the embedder can't see that for itself: reading a\n// cross-origin frame's document returns null whether the site loaded or the\n// frame was blocked, so a check from outside never succeeds (it didn't, for\n// months, and the screenshot never faded). The frame has to say so itself.\n//\n// So a site-kit page framed by another origin posts FRAME_READY_MESSAGE to\n// its parent once it has loaded and painted. The payload carries nothing but\n// its type and version, so '*' as the target origin leaks nothing; the\n// embedder checks event.source against its own iframe before trusting it.\n\n/** The message a cross-origin-framed site-kit page posts to its embedder once it has painted. */\nexport const FRAME_READY_MESSAGE = 'sonor:frame-ready' as const\n\nexport interface FrameReadyMessage {\n  type: typeof FRAME_READY_MESSAGE\n  v: 1\n}\n\n/** True for a {@link FrameReadyMessage}, for the embedder's message handler. */\nexport function isFrameReadyMessage(data: unknown): data is FrameReadyMessage {\n  return (\n    !!data &&\n    typeof data === 'object' &&\n    (data as { type?: unknown }).type === FRAME_READY_MESSAGE &&\n    (data as { v?: unknown }).v === 1\n  )\n}\n\n/**\n * Post {@link FRAME_READY_MESSAGE} to the embedder once this page has loaded\n * and painted (the load event, then two animation frames, so the first frame\n * after load has been presented). Does nothing at the top level or in a\n * same-origin frame. Returns a cleanup that cancels a pending post.\n */\nexport function announceFrameReady(): () => void {\n  if (typeof window === 'undefined' || !isCrossOriginFrame()) return () => {}\n  let cancelled = false\n  let raf = 0\n  const post = () => {\n    raf = requestAnimationFrame(() => {\n      raf = requestAnimationFrame(() => {\n        if (cancelled) return\n        const message: FrameReadyMessage = { type: FRAME_READY_MESSAGE, v: 1 }\n        window.parent.postMessage(message, '*')\n      })\n    })\n  }\n  if (document.readyState === 'complete') post()\n  else window.addEventListener('load', post, { once: true })\n  return () => {\n    cancelled = true\n    cancelAnimationFrame(raf)\n    window.removeEventListener('load', post)\n  }\n}\n"]}