@sonordev/site-kit 6.4.0 → 6.5.0

package/dist/{chunk-YRKWJCML.mjs.map → chunk-PGYOBEPL.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/siteToken.ts"],"names":[],"mappings":";;;AAuBO,IAAM,iBAAA,GAAoB,MAAA;AAGjC,IAAM,kBAAkB,CAAA,GAAI,GAAA;AAC5B,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,WAAA,GAAc,sBAAA;AAEb,SAAS,YAAY,UAAA,EAAqC;AAC/D,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,IAAY,UAAA,CAAW,WAAW,iBAAiB,CAAA;AAClF;AASO,SAAS,sBAAsB,KAAA,EAA6C;AACjF,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,MAAM,GAAA,GAAO,KAAA,CAAiB,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC1C,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,IAAI;AAEF,IAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACpD,IAAA,MAAM,IAAA,GACJ,OAAO,IAAA,KAAS,UAAA,GACZ,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACnD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,IAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,GAAS,MAAA,GAAS,IAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOO,SAAS,oBAAoB,UAAA,EAAoC;AACtE,EAAA,IAAI,CAAC,YAAY,OAAO,aAAA;AACxB,EAAA,MAAM,MAAA,GAAS,sBAAsB,UAAU,CAAA;AAC/C,EAAA,IAAI,MAAA,EAAQ,GAAA,EAAK,OAAO,CAAA,IAAA,EAAO,OAAO,GAAG,CAAA,CAAA;AACzC,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B;AAeA,SAAS,iBAAA,GAAgC;AACvC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,MAAA;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,MAAA,EAAQ,sBAAA;AAAA,IACR,KAAA,EAAO,IAAA;AAAA,IACP,UAAA,EAAY;AAAA,GACd;AACF;AAcA,IAAM,eAAA,GAAkB,4BAAA;AAExB,IAAM,SAAqB,MAAM;AAC/B,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,iBAAA,EAAkB;AAC5D,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,4CAAuB,iBAAA,EAAkB,CAAA;AACnD,CAAA,GAAG;AAEH,SAAS,eAAA,GAAiC;AACxC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AACrD,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,OAAO,MAAA,EAAQ,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ,IAAA;AAAA,EAC5D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAW,KAAA,EAAqB;AACvC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACnC,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,cAAA,CAAe,QAAQ,WAAA,EAAa,IAAA,CAAK,UAAU,EAAE,KAAA,EAAO,CAAC,CAAA;AAAA,EACtE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA;AAAC,IAAC,OAAe,oBAAA,GAAuB,KAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,SAAS,KAAA,EAA8B;AAC9C,EAAA,MAAM,MAAA,GAAS,sBAAsB,KAAK,CAAA;AAC1C,EAAA,OAAO,OAAO,MAAA,EAAQ,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,MAAM,GAAA,GAAO,CAAA;AAC/D;AAMO,SAAS,wBAAwB,IAAA,EAG/B;AACP,EAAA,KAAA,CAAM,OAAO,IAAA,CAAK,UAAA;AAClB,EAAA,KAAA,CAAM,OAAA,GAAU,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,QAAQ,KAAA,CAAM,MAAA,GAAS,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAE9D,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,IAAA;AAAA,EACF;AAKA,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,EAAA,IAAI,IAAA,GAAO,KAAK,UAAA,IAAc,IAAA;AAC9B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,IAAI,UAAU,QAAA,CAAS,MAAM,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,MAAA;AACxD,EAAA,IAAI,SAAS,QAAA,CAAS,KAAK,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,KAAA;AACtD,EAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AAChB;AAEA,SAAS,YAAA,GAAwB;AAC/B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,KAAA;AAC3B,EAAA,IAAI,CAAC,KAAA,CAAM,KAAA,EAAO,OAAO,IAAA;AACzB,EAAA,OAAO,KAAK,GAAA,EAAI,IAAK,QAAA,CAAS,KAAA,CAAM,KAAK,CAAA,GAAI,eAAA;AAC/C;AAEA,eAAe,SAAA,GAAoC;AACjD,EAAA,MAAM,UAAU,KAAA,CAAM,KAAA;AACtB,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,8BAAA,CAAA,EAAkC;AAAA,MACvE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqB,gBAAA;AAAA;AAAA;AAAA,QAGrB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACvC,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,kBAAkB,CAAA,GACtC,KAAA;AAAA,KACP,CAAA;AACD,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,OAAO,IAAA;AACpB,IAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC9C,IAAA,MAAM,OAAO,IAAA,EAAM,KAAA;AACnB,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,WAAA,CAAY,IAAI,CAAA,EAAG;AACjD,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,UAAA,CAAW,IAAI,CAAA;AACf,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,gBAAA,GAA2C;AACzD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,UAAA,EAAY,OAAO,KAAA,CAAM,UAAA;AACnC,EAAA,KAAA,CAAM,UAAA,GAAa,SAAA,EAAU,CAAE,OAAA,CAAQ,MAAM;AAC3C,IAAA,KAAA,CAAM,UAAA,GAAa,IAAA;AAAA,EACrB,CAAC,CAAA;AACD,EAAA,OAAO,KAAA,CAAM,UAAA;AACf;AAMA,eAAsB,mBACpB,IAAA,EAC6B;AAI7B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,IAAW,WAAA,CAAY,IAAI,CAAA,EAAG;AACvC,IAAA,uBAAA,CAAwB,EAAE,UAAA,EAAY,IAAA,EAAM,CAAA;AAAA,EAC9C;AAEA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,IAAI,cAAa,EAAG;AAClB,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,WAAW,OAAO,SAAA;AAAA,EAGxB;AACA,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC;AAGO,SAAS,WAAA,GAAuB;AACrC,EAAA,OAAO,KAAA,CAAM,OAAA;AACf;AAOO,SAAS,kBAAkB,IAAA,EAAmC;AACnE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC","file":"chunk-YRKWJCML.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared — Client token manager\n *\n * SiteKitLayout (a server component) no longer ships the raw `sonor_` API key to\n * the browser. Instead it mints a short-lived, project-scoped token server-side\n * and injects THAT. This module is the browser-side lifecycle for that token:\n *\n *   - holds the current token (seeded from the injected value)\n *   - a static page's seed can be days old and already expired on first view, so\n *     it transparently REFRESHES via the public endpoint before first use\n *   - dedupes concurrent refreshes (one in-flight request, awaited by all)\n *   - persists the freshest token in sessionStorage so navigations within a\n *     session don't each re-refresh\n *\n * Everything here is a no-op passthrough when the injected credential is a raw\n * key (a 2.x kit, or the mint-failed fallback) — legacy behavior is unchanged.\n * Fully SSR-safe: on the server there is no refresh, just the seed.\n *\n * The token payload is NOT secret (only its HMAC is unforgeable), so decoding it\n * client-side to read `exp`/`pid` is fine and needs no crypto.\n */\nimport { SITE_KIT_VERSION } from './version'\n\nexport const SITE_TOKEN_PREFIX = 'st1.'\n\n/** Refresh this many ms before expiry, so a request never races the deadline. */\nconst REFRESH_SKEW_MS = 5 * 60_000\nconst REFRESH_TIMEOUT_MS = 6_000\nconst STORAGE_KEY = '__sonor_site_token__'\n\nexport function isSiteToken(credential?: string | null): boolean {\n  return typeof credential === 'string' && credential.startsWith(SITE_TOKEN_PREFIX)\n}\n\ninterface DecodedClaims {\n  pid?: string\n  iat?: number\n  exp?: number\n}\n\n/** Decode the (non-secret) token payload. Returns null if not a token / malformed. */\nexport function decodeSiteTokenClaims(token?: string | null): DecodedClaims | null {\n  if (!isSiteToken(token)) return null\n  const seg = (token as string).split('.')[1]\n  if (!seg) return null\n  try {\n    // base64url → JSON. atob handles standard base64; restore url-safe chars.\n    const b64 = seg.replace(/-/g, '+').replace(/_/g, '/')\n    const json =\n      typeof atob === 'function'\n        ? atob(b64)\n        : Buffer.from(seg, 'base64url').toString('utf8')\n    const claims = JSON.parse(json)\n    return typeof claims === 'object' && claims ? claims : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Stable id for the auth circuit breaker. Tokens rotate, so keying the breaker\n * by the raw value would reset it every refresh — key by the project id encoded\n * in the token instead. Raw keys use a safe prefix.\n */\nexport function credentialBreakerId(credential?: string | null): string {\n  if (!credential) return '(anonymous)'\n  const claims = decodeSiteTokenClaims(credential)\n  if (claims?.pid) return `pid:${claims.pid}`\n  return credential.slice(0, 16)\n}\n\ninterface TokenState {\n  /** The credential injected by the layout (token or raw key). */\n  seed: string | undefined\n  /** Whether we're in token mode (seed is a token). */\n  isToken: boolean\n  /** Base API URL for the refresh endpoint. */\n  apiUrl: string\n  /** The freshest known token (>= seed). Null in raw-key mode. */\n  token: string | null\n  /** In-flight refresh, deduped. */\n  refreshing: Promise<string | null> | null\n}\n\nfunction initialTokenState(): TokenState {\n  return {\n    seed: undefined,\n    isToken: false,\n    apiUrl: 'https://api.sonor.io',\n    token: null,\n    refreshing: null,\n  }\n}\n\n/**\n * Page-wide singleton, keyed on window. Bundlers can (and in the field, do)\n * inline more than one copy of this module into a page — e.g. an app importing\n * site-kit directly while a transpiled component library bundles its own copy.\n * Module-scoped state then splits into per-copy brains: one copy gets\n * configured and refreshes fine while the other keeps sending the stale\n * prerendered seed, 401s, and trips its breaker (\"sonor-auth-paused\" with a\n * working network). Sharing the state object on window gives every copy the\n * same token, the same deduped refresh, and the same breaker. On the server\n * (no window) each module instance keeps private state — there's no refresh\n * lifecycle there anyway.\n */\nconst TOKEN_STATE_KEY = '__SONOR_SITE_TOKEN_STATE__'\n\nconst state: TokenState = (() => {\n  if (typeof window === 'undefined') return initialTokenState()\n  const w = window as unknown as Record<string, TokenState | undefined>\n  return (w[TOKEN_STATE_KEY] ??= initialTokenState())\n})()\n\nfunction readStoredToken(): string | null {\n  if (typeof window === 'undefined') return null\n  try {\n    const raw = window.sessionStorage.getItem(STORAGE_KEY)\n    if (!raw) return null\n    const parsed = JSON.parse(raw)\n    return typeof parsed?.token === 'string' ? parsed.token : null\n  } catch {\n    return null\n  }\n}\n\nfunction storeToken(token: string): void {\n  if (typeof window === 'undefined') return\n  try {\n    window.sessionStorage.setItem(STORAGE_KEY, JSON.stringify({ token }))\n  } catch {\n    /* private mode / disabled storage — memory-only is fine */\n  }\n  try {\n    ;(window as any).__SITE_KIT_API_KEY__ = token\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction tokenExp(token: string | null): number {\n  const claims = decodeSiteTokenClaims(token)\n  return typeof claims?.exp === 'number' ? claims.exp * 1000 : 0\n}\n\n/**\n * Configure the manager from the layout-injected values. Adopts a fresher token\n * from sessionStorage if a prior page in this session already refreshed.\n */\nexport function configureSiteCredential(opts: {\n  credential?: string\n  apiUrl?: string\n}): void {\n  state.seed = opts.credential\n  state.isToken = isSiteToken(opts.credential)\n  if (opts.apiUrl) state.apiUrl = opts.apiUrl.replace(/\\/+$/, '')\n\n  if (!state.isToken) {\n    state.token = null\n    return\n  }\n\n  // configure runs on every render — never downgrade. Keep the freshest of the\n  // injected seed, a token stored by an earlier page this session, and whatever\n  // an in-flight/prior refresh already put in memory.\n  const prior = state.token\n  let best = opts.credential ?? null\n  const stored = readStoredToken()\n  if (stored && tokenExp(stored) > tokenExp(best)) best = stored\n  if (prior && tokenExp(prior) > tokenExp(best)) best = prior\n  state.token = best\n}\n\nfunction needsRefresh(): boolean {\n  if (!state.isToken) return false\n  if (!state.token) return true\n  return Date.now() >= tokenExp(state.token) - REFRESH_SKEW_MS\n}\n\nasync function doRefresh(): Promise<string | null> {\n  const current = state.token\n  if (!current) return null\n  try {\n    const res = await fetch(`${state.apiUrl}/api/public/site-token/refresh`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        // Send the current token as x-api-key too, so the server's key-scoped\n        // throttler buckets refreshes by token rather than by shared CDN IP.\n        'x-api-key': current,\n      },\n      body: JSON.stringify({ token: current }),\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(REFRESH_TIMEOUT_MS)\n          : undefined,\n    })\n    if (!res.ok) return null\n    const data = await res.json().catch(() => null)\n    const next = data?.token\n    if (typeof next === 'string' && isSiteToken(next)) {\n      state.token = next\n      storeToken(next)\n      return next\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\n/** Refresh now (deduped). Returns the new token, or null on failure. */\nexport function refreshSiteToken(): Promise<string | null> {\n  if (!state.isToken) return Promise.resolve(null)\n  if (state.refreshing) return state.refreshing\n  state.refreshing = doRefresh().finally(() => {\n    state.refreshing = null\n  })\n  return state.refreshing\n}\n\n/**\n * The credential to put on the next request. In token mode, refreshes a stale\n * seed first. In raw-key mode, returns the seed unchanged (legacy passthrough).\n */\nexport async function getFreshCredential(\n  seed?: string,\n): Promise<string | undefined> {\n  // Unconfigured but handed a token (a component received the prerendered seed\n  // as a prop before any provider configured the manager): adopt it so the\n  // refresh machinery works instead of replaying a possibly-expired seed.\n  if (!state.isToken && isSiteToken(seed)) {\n    configureSiteCredential({ credential: seed })\n  }\n  // A raw key (or nothing configured) — no token machinery.\n  if (!state.isToken) return seed ?? state.seed\n  if (needsRefresh()) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed) return refreshed\n    // Refresh failed — fall through to whatever we have; the request may 401 and\n    // trip the breaker with friendly copy.\n  }\n  return state.token ?? seed ?? state.seed\n}\n\n/** Whether the given credential is being managed as a token. */\nexport function isTokenMode(): boolean {\n  return state.isToken\n}\n\n/**\n * Best-known credential WITHOUT refreshing — for synchronous unload paths\n * (sonorBeacon) that can't await. In token mode returns the freshest token held;\n * in raw-key mode returns the seed.\n */\nexport function currentCredential(seed?: string): string | undefined {\n  if (!state.isToken) return seed ?? state.seed\n  return state.token ?? seed ?? state.seed\n}\n"]}
+{"version":3,"sources":["../src/shared/siteToken.ts"],"names":[],"mappings":";;;AAuBO,IAAM,iBAAA,GAAoB,MAAA;AAGjC,IAAM,kBAAkB,CAAA,GAAI,GAAA;AAC5B,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,WAAA,GAAc,sBAAA;AAEb,SAAS,YAAY,UAAA,EAAqC;AAC/D,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,IAAY,UAAA,CAAW,WAAW,iBAAiB,CAAA;AAClF;AASO,SAAS,sBAAsB,KAAA,EAA6C;AACjF,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,MAAM,GAAA,GAAO,KAAA,CAAiB,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC1C,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,IAAI;AAEF,IAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACpD,IAAA,MAAM,IAAA,GACJ,OAAO,IAAA,KAAS,UAAA,GACZ,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACnD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,IAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,GAAS,MAAA,GAAS,IAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOO,SAAS,oBAAoB,UAAA,EAAoC;AACtE,EAAA,IAAI,CAAC,YAAY,OAAO,aAAA;AACxB,EAAA,MAAM,MAAA,GAAS,sBAAsB,UAAU,CAAA;AAC/C,EAAA,IAAI,MAAA,EAAQ,GAAA,EAAK,OAAO,CAAA,IAAA,EAAO,OAAO,GAAG,CAAA,CAAA;AACzC,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B;AAeA,SAAS,iBAAA,GAAgC;AACvC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,MAAA;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,MAAA,EAAQ,sBAAA;AAAA,IACR,KAAA,EAAO,IAAA;AAAA,IACP,UAAA,EAAY;AAAA,GACd;AACF;AAcA,IAAM,eAAA,GAAkB,4BAAA;AAExB,IAAM,SAAqB,MAAM;AAC/B,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,iBAAA,EAAkB;AAC5D,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,4CAAuB,iBAAA,EAAkB,CAAA;AACnD,CAAA,GAAG;AAEH,SAAS,eAAA,GAAiC;AACxC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AACrD,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,OAAO,MAAA,EAAQ,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ,IAAA;AAAA,EAC5D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAW,KAAA,EAAqB;AACvC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACnC,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,cAAA,CAAe,QAAQ,WAAA,EAAa,IAAA,CAAK,UAAU,EAAE,KAAA,EAAO,CAAC,CAAA;AAAA,EACtE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA;AAAC,IAAC,OAAe,oBAAA,GAAuB,KAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,SAAS,KAAA,EAA8B;AAC9C,EAAA,MAAM,MAAA,GAAS,sBAAsB,KAAK,CAAA;AAC1C,EAAA,OAAO,OAAO,MAAA,EAAQ,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,MAAM,GAAA,GAAO,CAAA;AAC/D;AAMO,SAAS,wBAAwB,IAAA,EAG/B;AACP,EAAA,KAAA,CAAM,OAAO,IAAA,CAAK,UAAA;AAClB,EAAA,KAAA,CAAM,OAAA,GAAU,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,QAAQ,KAAA,CAAM,MAAA,GAAS,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAE9D,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,IAAA;AAAA,EACF;AAKA,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,EAAA,IAAI,IAAA,GAAO,KAAK,UAAA,IAAc,IAAA;AAC9B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,IAAI,UAAU,QAAA,CAAS,MAAM,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,MAAA;AACxD,EAAA,IAAI,SAAS,QAAA,CAAS,KAAK,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,KAAA;AACtD,EAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AAChB;AAEA,SAAS,YAAA,GAAwB;AAC/B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,KAAA;AAC3B,EAAA,IAAI,CAAC,KAAA,CAAM,KAAA,EAAO,OAAO,IAAA;AACzB,EAAA,OAAO,KAAK,GAAA,EAAI,IAAK,QAAA,CAAS,KAAA,CAAM,KAAK,CAAA,GAAI,eAAA;AAC/C;AAEA,eAAe,SAAA,GAAoC;AACjD,EAAA,MAAM,UAAU,KAAA,CAAM,KAAA;AACtB,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,8BAAA,CAAA,EAAkC;AAAA,MACvE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqB,gBAAA;AAAA;AAAA;AAAA,QAGrB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACvC,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,kBAAkB,CAAA,GACtC,KAAA;AAAA,KACP,CAAA;AACD,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,OAAO,IAAA;AACpB,IAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC9C,IAAA,MAAM,OAAO,IAAA,EAAM,KAAA;AACnB,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,WAAA,CAAY,IAAI,CAAA,EAAG;AACjD,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,UAAA,CAAW,IAAI,CAAA;AACf,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,gBAAA,GAA2C;AACzD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,UAAA,EAAY,OAAO,KAAA,CAAM,UAAA;AACnC,EAAA,KAAA,CAAM,UAAA,GAAa,SAAA,EAAU,CAAE,OAAA,CAAQ,MAAM;AAC3C,IAAA,KAAA,CAAM,UAAA,GAAa,IAAA;AAAA,EACrB,CAAC,CAAA;AACD,EAAA,OAAO,KAAA,CAAM,UAAA;AACf;AAMA,eAAsB,mBACpB,IAAA,EAC6B;AAI7B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,IAAW,WAAA,CAAY,IAAI,CAAA,EAAG;AACvC,IAAA,uBAAA,CAAwB,EAAE,UAAA,EAAY,IAAA,EAAM,CAAA;AAAA,EAC9C;AAEA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,IAAI,cAAa,EAAG;AAClB,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,WAAW,OAAO,SAAA;AAAA,EAGxB;AACA,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC;AAGO,SAAS,WAAA,GAAuB;AACrC,EAAA,OAAO,KAAA,CAAM,OAAA;AACf;AAOO,SAAS,kBAAkB,IAAA,EAAmC;AACnE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC","file":"chunk-PGYOBEPL.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared — Client token manager\n *\n * SiteKitLayout (a server component) no longer ships the raw `sonor_` API key to\n * the browser. Instead it mints a short-lived, project-scoped token server-side\n * and injects THAT. This module is the browser-side lifecycle for that token:\n *\n *   - holds the current token (seeded from the injected value)\n *   - a static page's seed can be days old and already expired on first view, so\n *     it transparently REFRESHES via the public endpoint before first use\n *   - dedupes concurrent refreshes (one in-flight request, awaited by all)\n *   - persists the freshest token in sessionStorage so navigations within a\n *     session don't each re-refresh\n *\n * Everything here is a no-op passthrough when the injected credential is a raw\n * key (a 2.x kit, or the mint-failed fallback) — legacy behavior is unchanged.\n * Fully SSR-safe: on the server there is no refresh, just the seed.\n *\n * The token payload is NOT secret (only its HMAC is unforgeable), so decoding it\n * client-side to read `exp`/`pid` is fine and needs no crypto.\n */\nimport { SITE_KIT_VERSION } from './version'\n\nexport const SITE_TOKEN_PREFIX = 'st1.'\n\n/** Refresh this many ms before expiry, so a request never races the deadline. */\nconst REFRESH_SKEW_MS = 5 * 60_000\nconst REFRESH_TIMEOUT_MS = 6_000\nconst STORAGE_KEY = '__sonor_site_token__'\n\nexport function isSiteToken(credential?: string | null): boolean {\n  return typeof credential === 'string' && credential.startsWith(SITE_TOKEN_PREFIX)\n}\n\ninterface DecodedClaims {\n  pid?: string\n  iat?: number\n  exp?: number\n}\n\n/** Decode the (non-secret) token payload. Returns null if not a token / malformed. */\nexport function decodeSiteTokenClaims(token?: string | null): DecodedClaims | null {\n  if (!isSiteToken(token)) return null\n  const seg = (token as string).split('.')[1]\n  if (!seg) return null\n  try {\n    // base64url → JSON. atob handles standard base64; restore url-safe chars.\n    const b64 = seg.replace(/-/g, '+').replace(/_/g, '/')\n    const json =\n      typeof atob === 'function'\n        ? atob(b64)\n        : Buffer.from(seg, 'base64url').toString('utf8')\n    const claims = JSON.parse(json)\n    return typeof claims === 'object' && claims ? claims : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Stable id for the auth circuit breaker. Tokens rotate, so keying the breaker\n * by the raw value would reset it every refresh — key by the project id encoded\n * in the token instead. Raw keys use a safe prefix.\n */\nexport function credentialBreakerId(credential?: string | null): string {\n  if (!credential) return '(anonymous)'\n  const claims = decodeSiteTokenClaims(credential)\n  if (claims?.pid) return `pid:${claims.pid}`\n  return credential.slice(0, 16)\n}\n\ninterface TokenState {\n  /** The credential injected by the layout (token or raw key). */\n  seed: string | undefined\n  /** Whether we're in token mode (seed is a token). */\n  isToken: boolean\n  /** Base API URL for the refresh endpoint. */\n  apiUrl: string\n  /** The freshest known token (>= seed). Null in raw-key mode. */\n  token: string | null\n  /** In-flight refresh, deduped. */\n  refreshing: Promise<string | null> | null\n}\n\nfunction initialTokenState(): TokenState {\n  return {\n    seed: undefined,\n    isToken: false,\n    apiUrl: 'https://api.sonor.io',\n    token: null,\n    refreshing: null,\n  }\n}\n\n/**\n * Page-wide singleton, keyed on window. Bundlers can (and in the field, do)\n * inline more than one copy of this module into a page — e.g. an app importing\n * site-kit directly while a transpiled component library bundles its own copy.\n * Module-scoped state then splits into per-copy brains: one copy gets\n * configured and refreshes fine while the other keeps sending the stale\n * prerendered seed, 401s, and trips its breaker (\"sonor-auth-paused\" with a\n * working network). Sharing the state object on window gives every copy the\n * same token, the same deduped refresh, and the same breaker. On the server\n * (no window) each module instance keeps private state — there's no refresh\n * lifecycle there anyway.\n */\nconst TOKEN_STATE_KEY = '__SONOR_SITE_TOKEN_STATE__'\n\nconst state: TokenState = (() => {\n  if (typeof window === 'undefined') return initialTokenState()\n  const w = window as unknown as Record<string, TokenState | undefined>\n  return (w[TOKEN_STATE_KEY] ??= initialTokenState())\n})()\n\nfunction readStoredToken(): string | null {\n  if (typeof window === 'undefined') return null\n  try {\n    const raw = window.sessionStorage.getItem(STORAGE_KEY)\n    if (!raw) return null\n    const parsed = JSON.parse(raw)\n    return typeof parsed?.token === 'string' ? parsed.token : null\n  } catch {\n    return null\n  }\n}\n\nfunction storeToken(token: string): void {\n  if (typeof window === 'undefined') return\n  try {\n    window.sessionStorage.setItem(STORAGE_KEY, JSON.stringify({ token }))\n  } catch {\n    /* private mode / disabled storage — memory-only is fine */\n  }\n  try {\n    ;(window as any).__SITE_KIT_API_KEY__ = token\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction tokenExp(token: string | null): number {\n  const claims = decodeSiteTokenClaims(token)\n  return typeof claims?.exp === 'number' ? claims.exp * 1000 : 0\n}\n\n/**\n * Configure the manager from the layout-injected values. Adopts a fresher token\n * from sessionStorage if a prior page in this session already refreshed.\n */\nexport function configureSiteCredential(opts: {\n  credential?: string\n  apiUrl?: string\n}): void {\n  state.seed = opts.credential\n  state.isToken = isSiteToken(opts.credential)\n  if (opts.apiUrl) state.apiUrl = opts.apiUrl.replace(/\\/+$/, '')\n\n  if (!state.isToken) {\n    state.token = null\n    return\n  }\n\n  // configure runs on every render — never downgrade. Keep the freshest of the\n  // injected seed, a token stored by an earlier page this session, and whatever\n  // an in-flight/prior refresh already put in memory.\n  const prior = state.token\n  let best = opts.credential ?? null\n  const stored = readStoredToken()\n  if (stored && tokenExp(stored) > tokenExp(best)) best = stored\n  if (prior && tokenExp(prior) > tokenExp(best)) best = prior\n  state.token = best\n}\n\nfunction needsRefresh(): boolean {\n  if (!state.isToken) return false\n  if (!state.token) return true\n  return Date.now() >= tokenExp(state.token) - REFRESH_SKEW_MS\n}\n\nasync function doRefresh(): Promise<string | null> {\n  const current = state.token\n  if (!current) return null\n  try {\n    const res = await fetch(`${state.apiUrl}/api/public/site-token/refresh`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        // Send the current token as x-api-key too, so the server's key-scoped\n        // throttler buckets refreshes by token rather than by shared CDN IP.\n        'x-api-key': current,\n      },\n      body: JSON.stringify({ token: current }),\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(REFRESH_TIMEOUT_MS)\n          : undefined,\n    })\n    if (!res.ok) return null\n    const data = await res.json().catch(() => null)\n    const next = data?.token\n    if (typeof next === 'string' && isSiteToken(next)) {\n      state.token = next\n      storeToken(next)\n      return next\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\n/** Refresh now (deduped). Returns the new token, or null on failure. */\nexport function refreshSiteToken(): Promise<string | null> {\n  if (!state.isToken) return Promise.resolve(null)\n  if (state.refreshing) return state.refreshing\n  state.refreshing = doRefresh().finally(() => {\n    state.refreshing = null\n  })\n  return state.refreshing\n}\n\n/**\n * The credential to put on the next request. In token mode, refreshes a stale\n * seed first. In raw-key mode, returns the seed unchanged (legacy passthrough).\n */\nexport async function getFreshCredential(\n  seed?: string,\n): Promise<string | undefined> {\n  // Unconfigured but handed a token (a component received the prerendered seed\n  // as a prop before any provider configured the manager): adopt it so the\n  // refresh machinery works instead of replaying a possibly-expired seed.\n  if (!state.isToken && isSiteToken(seed)) {\n    configureSiteCredential({ credential: seed })\n  }\n  // A raw key (or nothing configured) — no token machinery.\n  if (!state.isToken) return seed ?? state.seed\n  if (needsRefresh()) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed) return refreshed\n    // Refresh failed — fall through to whatever we have; the request may 401 and\n    // trip the breaker with friendly copy.\n  }\n  return state.token ?? seed ?? state.seed\n}\n\n/** Whether the given credential is being managed as a token. */\nexport function isTokenMode(): boolean {\n  return state.isToken\n}\n\n/**\n * Best-known credential WITHOUT refreshing — for synchronous unload paths\n * (sonorBeacon) that can't await. In token mode returns the freshest token held;\n * in raw-key mode returns the seed.\n */\nexport function currentCredential(seed?: string): string | undefined {\n  if (!state.isToken) return seed ?? state.seed\n  return state.token ?? seed ?? state.seed\n}\n"]}

package/dist/{chunk-U5NFIHLY.js → chunk-PIPGH7GA.js}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkCIB3RHNZ_js = require('./chunk-CIB3RHNZ.js');
+var chunkPURI56RE_js = require('./chunk-PURI56RE.js');
 
 // src/shared/siteToken.ts
 var SITE_TOKEN_PREFIX = "st1.";
@@ -99,7 +99,7 @@ async function doRefresh() {
       method: "POST",
       headers: {
         "content-type": "application/json",
-        "x-sitekit-version": chunkCIB3RHNZ_js.SITE_KIT_VERSION,
+        "x-sitekit-version": chunkPURI56RE_js.SITE_KIT_VERSION,
         // Send the current token as x-api-key too, so the server's key-scoped
         // throttler buckets refreshes by token rather than by shared CDN IP.
         "x-api-key": current
@@ -154,5 +154,5 @@ exports.getFreshCredential = getFreshCredential;
 exports.isSiteToken = isSiteToken;
 exports.isTokenMode = isTokenMode;
 exports.refreshSiteToken = refreshSiteToken;
-//# sourceMappingURL=chunk-U5NFIHLY.js.map
-//# sourceMappingURL=chunk-U5NFIHLY.js.map
+//# sourceMappingURL=chunk-PIPGH7GA.js.map
+//# sourceMappingURL=chunk-PIPGH7GA.js.map

package/dist/{chunk-U5NFIHLY.js.map → chunk-PIPGH7GA.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/siteToken.ts"],"names":["SITE_KIT_VERSION"],"mappings":";;;;;AAuBO,IAAM,iBAAA,GAAoB,MAAA;AAGjC,IAAM,kBAAkB,CAAA,GAAI,GAAA;AAC5B,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,WAAA,GAAc,sBAAA;AAEb,SAAS,YAAY,UAAA,EAAqC;AAC/D,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,IAAY,UAAA,CAAW,WAAW,iBAAiB,CAAA;AAClF;AASO,SAAS,sBAAsB,KAAA,EAA6C;AACjF,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,MAAM,GAAA,GAAO,KAAA,CAAiB,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC1C,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,IAAI;AAEF,IAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACpD,IAAA,MAAM,IAAA,GACJ,OAAO,IAAA,KAAS,UAAA,GACZ,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACnD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,IAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,GAAS,MAAA,GAAS,IAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOO,SAAS,oBAAoB,UAAA,EAAoC;AACtE,EAAA,IAAI,CAAC,YAAY,OAAO,aAAA;AACxB,EAAA,MAAM,MAAA,GAAS,sBAAsB,UAAU,CAAA;AAC/C,EAAA,IAAI,MAAA,EAAQ,GAAA,EAAK,OAAO,CAAA,IAAA,EAAO,OAAO,GAAG,CAAA,CAAA;AACzC,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B;AAeA,SAAS,iBAAA,GAAgC;AACvC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,MAAA;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,MAAA,EAAQ,sBAAA;AAAA,IACR,KAAA,EAAO,IAAA;AAAA,IACP,UAAA,EAAY;AAAA,GACd;AACF;AAcA,IAAM,eAAA,GAAkB,4BAAA;AAExB,IAAM,SAAqB,MAAM;AAC/B,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,iBAAA,EAAkB;AAC5D,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,4CAAuB,iBAAA,EAAkB,CAAA;AACnD,CAAA,GAAG;AAEH,SAAS,eAAA,GAAiC;AACxC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AACrD,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,OAAO,MAAA,EAAQ,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ,IAAA;AAAA,EAC5D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAW,KAAA,EAAqB;AACvC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACnC,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,cAAA,CAAe,QAAQ,WAAA,EAAa,IAAA,CAAK,UAAU,EAAE,KAAA,EAAO,CAAC,CAAA;AAAA,EACtE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA;AAAC,IAAC,OAAe,oBAAA,GAAuB,KAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,SAAS,KAAA,EAA8B;AAC9C,EAAA,MAAM,MAAA,GAAS,sBAAsB,KAAK,CAAA;AAC1C,EAAA,OAAO,OAAO,MAAA,EAAQ,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,MAAM,GAAA,GAAO,CAAA;AAC/D;AAMO,SAAS,wBAAwB,IAAA,EAG/B;AACP,EAAA,KAAA,CAAM,OAAO,IAAA,CAAK,UAAA;AAClB,EAAA,KAAA,CAAM,OAAA,GAAU,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,QAAQ,KAAA,CAAM,MAAA,GAAS,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAE9D,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,IAAA;AAAA,EACF;AAKA,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,EAAA,IAAI,IAAA,GAAO,KAAK,UAAA,IAAc,IAAA;AAC9B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,IAAI,UAAU,QAAA,CAAS,MAAM,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,MAAA;AACxD,EAAA,IAAI,SAAS,QAAA,CAAS,KAAK,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,KAAA;AACtD,EAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AAChB;AAEA,SAAS,YAAA,GAAwB;AAC/B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,KAAA;AAC3B,EAAA,IAAI,CAAC,KAAA,CAAM,KAAA,EAAO,OAAO,IAAA;AACzB,EAAA,OAAO,KAAK,GAAA,EAAI,IAAK,QAAA,CAAS,KAAA,CAAM,KAAK,CAAA,GAAI,eAAA;AAC/C;AAEA,eAAe,SAAA,GAAoC;AACjD,EAAA,MAAM,UAAU,KAAA,CAAM,KAAA;AACtB,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,8BAAA,CAAA,EAAkC;AAAA,MACvE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqBA,iCAAA;AAAA;AAAA;AAAA,QAGrB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACvC,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,kBAAkB,CAAA,GACtC,KAAA;AAAA,KACP,CAAA;AACD,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,OAAO,IAAA;AACpB,IAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC9C,IAAA,MAAM,OAAO,IAAA,EAAM,KAAA;AACnB,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,WAAA,CAAY,IAAI,CAAA,EAAG;AACjD,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,UAAA,CAAW,IAAI,CAAA;AACf,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,gBAAA,GAA2C;AACzD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,UAAA,EAAY,OAAO,KAAA,CAAM,UAAA;AACnC,EAAA,KAAA,CAAM,UAAA,GAAa,SAAA,EAAU,CAAE,OAAA,CAAQ,MAAM;AAC3C,IAAA,KAAA,CAAM,UAAA,GAAa,IAAA;AAAA,EACrB,CAAC,CAAA;AACD,EAAA,OAAO,KAAA,CAAM,UAAA;AACf;AAMA,eAAsB,mBACpB,IAAA,EAC6B;AAI7B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,IAAW,WAAA,CAAY,IAAI,CAAA,EAAG;AACvC,IAAA,uBAAA,CAAwB,EAAE,UAAA,EAAY,IAAA,EAAM,CAAA;AAAA,EAC9C;AAEA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,IAAI,cAAa,EAAG;AAClB,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,WAAW,OAAO,SAAA;AAAA,EAGxB;AACA,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC;AAGO,SAAS,WAAA,GAAuB;AACrC,EAAA,OAAO,KAAA,CAAM,OAAA;AACf;AAOO,SAAS,kBAAkB,IAAA,EAAmC;AACnE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC","file":"chunk-U5NFIHLY.js","sourcesContent":["/**\n * @sonordev/site-kit shared — Client token manager\n *\n * SiteKitLayout (a server component) no longer ships the raw `sonor_` API key to\n * the browser. Instead it mints a short-lived, project-scoped token server-side\n * and injects THAT. This module is the browser-side lifecycle for that token:\n *\n *   - holds the current token (seeded from the injected value)\n *   - a static page's seed can be days old and already expired on first view, so\n *     it transparently REFRESHES via the public endpoint before first use\n *   - dedupes concurrent refreshes (one in-flight request, awaited by all)\n *   - persists the freshest token in sessionStorage so navigations within a\n *     session don't each re-refresh\n *\n * Everything here is a no-op passthrough when the injected credential is a raw\n * key (a 2.x kit, or the mint-failed fallback) — legacy behavior is unchanged.\n * Fully SSR-safe: on the server there is no refresh, just the seed.\n *\n * The token payload is NOT secret (only its HMAC is unforgeable), so decoding it\n * client-side to read `exp`/`pid` is fine and needs no crypto.\n */\nimport { SITE_KIT_VERSION } from './version'\n\nexport const SITE_TOKEN_PREFIX = 'st1.'\n\n/** Refresh this many ms before expiry, so a request never races the deadline. */\nconst REFRESH_SKEW_MS = 5 * 60_000\nconst REFRESH_TIMEOUT_MS = 6_000\nconst STORAGE_KEY = '__sonor_site_token__'\n\nexport function isSiteToken(credential?: string | null): boolean {\n  return typeof credential === 'string' && credential.startsWith(SITE_TOKEN_PREFIX)\n}\n\ninterface DecodedClaims {\n  pid?: string\n  iat?: number\n  exp?: number\n}\n\n/** Decode the (non-secret) token payload. Returns null if not a token / malformed. */\nexport function decodeSiteTokenClaims(token?: string | null): DecodedClaims | null {\n  if (!isSiteToken(token)) return null\n  const seg = (token as string).split('.')[1]\n  if (!seg) return null\n  try {\n    // base64url → JSON. atob handles standard base64; restore url-safe chars.\n    const b64 = seg.replace(/-/g, '+').replace(/_/g, '/')\n    const json =\n      typeof atob === 'function'\n        ? atob(b64)\n        : Buffer.from(seg, 'base64url').toString('utf8')\n    const claims = JSON.parse(json)\n    return typeof claims === 'object' && claims ? claims : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Stable id for the auth circuit breaker. Tokens rotate, so keying the breaker\n * by the raw value would reset it every refresh — key by the project id encoded\n * in the token instead. Raw keys use a safe prefix.\n */\nexport function credentialBreakerId(credential?: string | null): string {\n  if (!credential) return '(anonymous)'\n  const claims = decodeSiteTokenClaims(credential)\n  if (claims?.pid) return `pid:${claims.pid}`\n  return credential.slice(0, 16)\n}\n\ninterface TokenState {\n  /** The credential injected by the layout (token or raw key). */\n  seed: string | undefined\n  /** Whether we're in token mode (seed is a token). */\n  isToken: boolean\n  /** Base API URL for the refresh endpoint. */\n  apiUrl: string\n  /** The freshest known token (>= seed). Null in raw-key mode. */\n  token: string | null\n  /** In-flight refresh, deduped. */\n  refreshing: Promise<string | null> | null\n}\n\nfunction initialTokenState(): TokenState {\n  return {\n    seed: undefined,\n    isToken: false,\n    apiUrl: 'https://api.sonor.io',\n    token: null,\n    refreshing: null,\n  }\n}\n\n/**\n * Page-wide singleton, keyed on window. Bundlers can (and in the field, do)\n * inline more than one copy of this module into a page — e.g. an app importing\n * site-kit directly while a transpiled component library bundles its own copy.\n * Module-scoped state then splits into per-copy brains: one copy gets\n * configured and refreshes fine while the other keeps sending the stale\n * prerendered seed, 401s, and trips its breaker (\"sonor-auth-paused\" with a\n * working network). Sharing the state object on window gives every copy the\n * same token, the same deduped refresh, and the same breaker. On the server\n * (no window) each module instance keeps private state — there's no refresh\n * lifecycle there anyway.\n */\nconst TOKEN_STATE_KEY = '__SONOR_SITE_TOKEN_STATE__'\n\nconst state: TokenState = (() => {\n  if (typeof window === 'undefined') return initialTokenState()\n  const w = window as unknown as Record<string, TokenState | undefined>\n  return (w[TOKEN_STATE_KEY] ??= initialTokenState())\n})()\n\nfunction readStoredToken(): string | null {\n  if (typeof window === 'undefined') return null\n  try {\n    const raw = window.sessionStorage.getItem(STORAGE_KEY)\n    if (!raw) return null\n    const parsed = JSON.parse(raw)\n    return typeof parsed?.token === 'string' ? parsed.token : null\n  } catch {\n    return null\n  }\n}\n\nfunction storeToken(token: string): void {\n  if (typeof window === 'undefined') return\n  try {\n    window.sessionStorage.setItem(STORAGE_KEY, JSON.stringify({ token }))\n  } catch {\n    /* private mode / disabled storage — memory-only is fine */\n  }\n  try {\n    ;(window as any).__SITE_KIT_API_KEY__ = token\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction tokenExp(token: string | null): number {\n  const claims = decodeSiteTokenClaims(token)\n  return typeof claims?.exp === 'number' ? claims.exp * 1000 : 0\n}\n\n/**\n * Configure the manager from the layout-injected values. Adopts a fresher token\n * from sessionStorage if a prior page in this session already refreshed.\n */\nexport function configureSiteCredential(opts: {\n  credential?: string\n  apiUrl?: string\n}): void {\n  state.seed = opts.credential\n  state.isToken = isSiteToken(opts.credential)\n  if (opts.apiUrl) state.apiUrl = opts.apiUrl.replace(/\\/+$/, '')\n\n  if (!state.isToken) {\n    state.token = null\n    return\n  }\n\n  // configure runs on every render — never downgrade. Keep the freshest of the\n  // injected seed, a token stored by an earlier page this session, and whatever\n  // an in-flight/prior refresh already put in memory.\n  const prior = state.token\n  let best = opts.credential ?? null\n  const stored = readStoredToken()\n  if (stored && tokenExp(stored) > tokenExp(best)) best = stored\n  if (prior && tokenExp(prior) > tokenExp(best)) best = prior\n  state.token = best\n}\n\nfunction needsRefresh(): boolean {\n  if (!state.isToken) return false\n  if (!state.token) return true\n  return Date.now() >= tokenExp(state.token) - REFRESH_SKEW_MS\n}\n\nasync function doRefresh(): Promise<string | null> {\n  const current = state.token\n  if (!current) return null\n  try {\n    const res = await fetch(`${state.apiUrl}/api/public/site-token/refresh`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        // Send the current token as x-api-key too, so the server's key-scoped\n        // throttler buckets refreshes by token rather than by shared CDN IP.\n        'x-api-key': current,\n      },\n      body: JSON.stringify({ token: current }),\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(REFRESH_TIMEOUT_MS)\n          : undefined,\n    })\n    if (!res.ok) return null\n    const data = await res.json().catch(() => null)\n    const next = data?.token\n    if (typeof next === 'string' && isSiteToken(next)) {\n      state.token = next\n      storeToken(next)\n      return next\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\n/** Refresh now (deduped). Returns the new token, or null on failure. */\nexport function refreshSiteToken(): Promise<string | null> {\n  if (!state.isToken) return Promise.resolve(null)\n  if (state.refreshing) return state.refreshing\n  state.refreshing = doRefresh().finally(() => {\n    state.refreshing = null\n  })\n  return state.refreshing\n}\n\n/**\n * The credential to put on the next request. In token mode, refreshes a stale\n * seed first. In raw-key mode, returns the seed unchanged (legacy passthrough).\n */\nexport async function getFreshCredential(\n  seed?: string,\n): Promise<string | undefined> {\n  // Unconfigured but handed a token (a component received the prerendered seed\n  // as a prop before any provider configured the manager): adopt it so the\n  // refresh machinery works instead of replaying a possibly-expired seed.\n  if (!state.isToken && isSiteToken(seed)) {\n    configureSiteCredential({ credential: seed })\n  }\n  // A raw key (or nothing configured) — no token machinery.\n  if (!state.isToken) return seed ?? state.seed\n  if (needsRefresh()) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed) return refreshed\n    // Refresh failed — fall through to whatever we have; the request may 401 and\n    // trip the breaker with friendly copy.\n  }\n  return state.token ?? seed ?? state.seed\n}\n\n/** Whether the given credential is being managed as a token. */\nexport function isTokenMode(): boolean {\n  return state.isToken\n}\n\n/**\n * Best-known credential WITHOUT refreshing — for synchronous unload paths\n * (sonorBeacon) that can't await. In token mode returns the freshest token held;\n * in raw-key mode returns the seed.\n */\nexport function currentCredential(seed?: string): string | undefined {\n  if (!state.isToken) return seed ?? state.seed\n  return state.token ?? seed ?? state.seed\n}\n"]}
+{"version":3,"sources":["../src/shared/siteToken.ts"],"names":["SITE_KIT_VERSION"],"mappings":";;;;;AAuBO,IAAM,iBAAA,GAAoB,MAAA;AAGjC,IAAM,kBAAkB,CAAA,GAAI,GAAA;AAC5B,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,WAAA,GAAc,sBAAA;AAEb,SAAS,YAAY,UAAA,EAAqC;AAC/D,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,IAAY,UAAA,CAAW,WAAW,iBAAiB,CAAA;AAClF;AASO,SAAS,sBAAsB,KAAA,EAA6C;AACjF,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,MAAM,GAAA,GAAO,KAAA,CAAiB,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC1C,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,IAAI;AAEF,IAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACpD,IAAA,MAAM,IAAA,GACJ,OAAO,IAAA,KAAS,UAAA,GACZ,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACnD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,IAAA,OAAO,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,GAAS,MAAA,GAAS,IAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOO,SAAS,oBAAoB,UAAA,EAAoC;AACtE,EAAA,IAAI,CAAC,YAAY,OAAO,aAAA;AACxB,EAAA,MAAM,MAAA,GAAS,sBAAsB,UAAU,CAAA;AAC/C,EAAA,IAAI,MAAA,EAAQ,GAAA,EAAK,OAAO,CAAA,IAAA,EAAO,OAAO,GAAG,CAAA,CAAA;AACzC,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B;AAeA,SAAS,iBAAA,GAAgC;AACvC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,MAAA;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,MAAA,EAAQ,sBAAA;AAAA,IACR,KAAA,EAAO,IAAA;AAAA,IACP,UAAA,EAAY;AAAA,GACd;AACF;AAcA,IAAM,eAAA,GAAkB,4BAAA;AAExB,IAAM,SAAqB,MAAM;AAC/B,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,iBAAA,EAAkB;AAC5D,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,4CAAuB,iBAAA,EAAkB,CAAA;AACnD,CAAA,GAAG;AAEH,SAAS,eAAA,GAAiC;AACxC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AACrD,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,OAAO,MAAA,EAAQ,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ,IAAA;AAAA,EAC5D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAW,KAAA,EAAqB;AACvC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACnC,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,cAAA,CAAe,QAAQ,WAAA,EAAa,IAAA,CAAK,UAAU,EAAE,KAAA,EAAO,CAAC,CAAA;AAAA,EACtE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA;AAAC,IAAC,OAAe,oBAAA,GAAuB,KAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,SAAS,KAAA,EAA8B;AAC9C,EAAA,MAAM,MAAA,GAAS,sBAAsB,KAAK,CAAA;AAC1C,EAAA,OAAO,OAAO,MAAA,EAAQ,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,MAAM,GAAA,GAAO,CAAA;AAC/D;AAMO,SAAS,wBAAwB,IAAA,EAG/B;AACP,EAAA,KAAA,CAAM,OAAO,IAAA,CAAK,UAAA;AAClB,EAAA,KAAA,CAAM,OAAA,GAAU,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,QAAQ,KAAA,CAAM,MAAA,GAAS,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAE9D,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,IAAA;AAAA,EACF;AAKA,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,EAAA,IAAI,IAAA,GAAO,KAAK,UAAA,IAAc,IAAA;AAC9B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,IAAI,UAAU,QAAA,CAAS,MAAM,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,MAAA;AACxD,EAAA,IAAI,SAAS,QAAA,CAAS,KAAK,IAAI,QAAA,CAAS,IAAI,GAAG,IAAA,GAAO,KAAA;AACtD,EAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AAChB;AAEA,SAAS,YAAA,GAAwB;AAC/B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,KAAA;AAC3B,EAAA,IAAI,CAAC,KAAA,CAAM,KAAA,EAAO,OAAO,IAAA;AACzB,EAAA,OAAO,KAAK,GAAA,EAAI,IAAK,QAAA,CAAS,KAAA,CAAM,KAAK,CAAA,GAAI,eAAA;AAC/C;AAEA,eAAe,SAAA,GAAoC;AACjD,EAAA,MAAM,UAAU,KAAA,CAAM,KAAA;AACtB,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,8BAAA,CAAA,EAAkC;AAAA,MACvE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqBA,iCAAA;AAAA;AAAA;AAAA,QAGrB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACvC,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,kBAAkB,CAAA,GACtC,KAAA;AAAA,KACP,CAAA;AACD,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,OAAO,IAAA;AACpB,IAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC9C,IAAA,MAAM,OAAO,IAAA,EAAM,KAAA;AACnB,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,WAAA,CAAY,IAAI,CAAA,EAAG;AACjD,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,UAAA,CAAW,IAAI,CAAA;AACf,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,gBAAA,GAA2C;AACzD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,UAAA,EAAY,OAAO,KAAA,CAAM,UAAA;AACnC,EAAA,KAAA,CAAM,UAAA,GAAa,SAAA,EAAU,CAAE,OAAA,CAAQ,MAAM;AAC3C,IAAA,KAAA,CAAM,UAAA,GAAa,IAAA;AAAA,EACrB,CAAC,CAAA;AACD,EAAA,OAAO,KAAA,CAAM,UAAA;AACf;AAMA,eAAsB,mBACpB,IAAA,EAC6B;AAI7B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,IAAW,WAAA,CAAY,IAAI,CAAA,EAAG;AACvC,IAAA,uBAAA,CAAwB,EAAE,UAAA,EAAY,IAAA,EAAM,CAAA;AAAA,EAC9C;AAEA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,IAAI,cAAa,EAAG;AAClB,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,WAAW,OAAO,SAAA;AAAA,EAGxB;AACA,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC;AAGO,SAAS,WAAA,GAAuB;AACrC,EAAA,OAAO,KAAA,CAAM,OAAA;AACf;AAOO,SAAS,kBAAkB,IAAA,EAAmC;AACnE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,OAAO,QAAQ,KAAA,CAAM,IAAA;AACzC,EAAA,OAAO,KAAA,CAAM,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA;AACtC","file":"chunk-PIPGH7GA.js","sourcesContent":["/**\n * @sonordev/site-kit shared — Client token manager\n *\n * SiteKitLayout (a server component) no longer ships the raw `sonor_` API key to\n * the browser. Instead it mints a short-lived, project-scoped token server-side\n * and injects THAT. This module is the browser-side lifecycle for that token:\n *\n *   - holds the current token (seeded from the injected value)\n *   - a static page's seed can be days old and already expired on first view, so\n *     it transparently REFRESHES via the public endpoint before first use\n *   - dedupes concurrent refreshes (one in-flight request, awaited by all)\n *   - persists the freshest token in sessionStorage so navigations within a\n *     session don't each re-refresh\n *\n * Everything here is a no-op passthrough when the injected credential is a raw\n * key (a 2.x kit, or the mint-failed fallback) — legacy behavior is unchanged.\n * Fully SSR-safe: on the server there is no refresh, just the seed.\n *\n * The token payload is NOT secret (only its HMAC is unforgeable), so decoding it\n * client-side to read `exp`/`pid` is fine and needs no crypto.\n */\nimport { SITE_KIT_VERSION } from './version'\n\nexport const SITE_TOKEN_PREFIX = 'st1.'\n\n/** Refresh this many ms before expiry, so a request never races the deadline. */\nconst REFRESH_SKEW_MS = 5 * 60_000\nconst REFRESH_TIMEOUT_MS = 6_000\nconst STORAGE_KEY = '__sonor_site_token__'\n\nexport function isSiteToken(credential?: string | null): boolean {\n  return typeof credential === 'string' && credential.startsWith(SITE_TOKEN_PREFIX)\n}\n\ninterface DecodedClaims {\n  pid?: string\n  iat?: number\n  exp?: number\n}\n\n/** Decode the (non-secret) token payload. Returns null if not a token / malformed. */\nexport function decodeSiteTokenClaims(token?: string | null): DecodedClaims | null {\n  if (!isSiteToken(token)) return null\n  const seg = (token as string).split('.')[1]\n  if (!seg) return null\n  try {\n    // base64url → JSON. atob handles standard base64; restore url-safe chars.\n    const b64 = seg.replace(/-/g, '+').replace(/_/g, '/')\n    const json =\n      typeof atob === 'function'\n        ? atob(b64)\n        : Buffer.from(seg, 'base64url').toString('utf8')\n    const claims = JSON.parse(json)\n    return typeof claims === 'object' && claims ? claims : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Stable id for the auth circuit breaker. Tokens rotate, so keying the breaker\n * by the raw value would reset it every refresh — key by the project id encoded\n * in the token instead. Raw keys use a safe prefix.\n */\nexport function credentialBreakerId(credential?: string | null): string {\n  if (!credential) return '(anonymous)'\n  const claims = decodeSiteTokenClaims(credential)\n  if (claims?.pid) return `pid:${claims.pid}`\n  return credential.slice(0, 16)\n}\n\ninterface TokenState {\n  /** The credential injected by the layout (token or raw key). */\n  seed: string | undefined\n  /** Whether we're in token mode (seed is a token). */\n  isToken: boolean\n  /** Base API URL for the refresh endpoint. */\n  apiUrl: string\n  /** The freshest known token (>= seed). Null in raw-key mode. */\n  token: string | null\n  /** In-flight refresh, deduped. */\n  refreshing: Promise<string | null> | null\n}\n\nfunction initialTokenState(): TokenState {\n  return {\n    seed: undefined,\n    isToken: false,\n    apiUrl: 'https://api.sonor.io',\n    token: null,\n    refreshing: null,\n  }\n}\n\n/**\n * Page-wide singleton, keyed on window. Bundlers can (and in the field, do)\n * inline more than one copy of this module into a page — e.g. an app importing\n * site-kit directly while a transpiled component library bundles its own copy.\n * Module-scoped state then splits into per-copy brains: one copy gets\n * configured and refreshes fine while the other keeps sending the stale\n * prerendered seed, 401s, and trips its breaker (\"sonor-auth-paused\" with a\n * working network). Sharing the state object on window gives every copy the\n * same token, the same deduped refresh, and the same breaker. On the server\n * (no window) each module instance keeps private state — there's no refresh\n * lifecycle there anyway.\n */\nconst TOKEN_STATE_KEY = '__SONOR_SITE_TOKEN_STATE__'\n\nconst state: TokenState = (() => {\n  if (typeof window === 'undefined') return initialTokenState()\n  const w = window as unknown as Record<string, TokenState | undefined>\n  return (w[TOKEN_STATE_KEY] ??= initialTokenState())\n})()\n\nfunction readStoredToken(): string | null {\n  if (typeof window === 'undefined') return null\n  try {\n    const raw = window.sessionStorage.getItem(STORAGE_KEY)\n    if (!raw) return null\n    const parsed = JSON.parse(raw)\n    return typeof parsed?.token === 'string' ? parsed.token : null\n  } catch {\n    return null\n  }\n}\n\nfunction storeToken(token: string): void {\n  if (typeof window === 'undefined') return\n  try {\n    window.sessionStorage.setItem(STORAGE_KEY, JSON.stringify({ token }))\n  } catch {\n    /* private mode / disabled storage — memory-only is fine */\n  }\n  try {\n    ;(window as any).__SITE_KIT_API_KEY__ = token\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction tokenExp(token: string | null): number {\n  const claims = decodeSiteTokenClaims(token)\n  return typeof claims?.exp === 'number' ? claims.exp * 1000 : 0\n}\n\n/**\n * Configure the manager from the layout-injected values. Adopts a fresher token\n * from sessionStorage if a prior page in this session already refreshed.\n */\nexport function configureSiteCredential(opts: {\n  credential?: string\n  apiUrl?: string\n}): void {\n  state.seed = opts.credential\n  state.isToken = isSiteToken(opts.credential)\n  if (opts.apiUrl) state.apiUrl = opts.apiUrl.replace(/\\/+$/, '')\n\n  if (!state.isToken) {\n    state.token = null\n    return\n  }\n\n  // configure runs on every render — never downgrade. Keep the freshest of the\n  // injected seed, a token stored by an earlier page this session, and whatever\n  // an in-flight/prior refresh already put in memory.\n  const prior = state.token\n  let best = opts.credential ?? null\n  const stored = readStoredToken()\n  if (stored && tokenExp(stored) > tokenExp(best)) best = stored\n  if (prior && tokenExp(prior) > tokenExp(best)) best = prior\n  state.token = best\n}\n\nfunction needsRefresh(): boolean {\n  if (!state.isToken) return false\n  if (!state.token) return true\n  return Date.now() >= tokenExp(state.token) - REFRESH_SKEW_MS\n}\n\nasync function doRefresh(): Promise<string | null> {\n  const current = state.token\n  if (!current) return null\n  try {\n    const res = await fetch(`${state.apiUrl}/api/public/site-token/refresh`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        // Send the current token as x-api-key too, so the server's key-scoped\n        // throttler buckets refreshes by token rather than by shared CDN IP.\n        'x-api-key': current,\n      },\n      body: JSON.stringify({ token: current }),\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(REFRESH_TIMEOUT_MS)\n          : undefined,\n    })\n    if (!res.ok) return null\n    const data = await res.json().catch(() => null)\n    const next = data?.token\n    if (typeof next === 'string' && isSiteToken(next)) {\n      state.token = next\n      storeToken(next)\n      return next\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\n/** Refresh now (deduped). Returns the new token, or null on failure. */\nexport function refreshSiteToken(): Promise<string | null> {\n  if (!state.isToken) return Promise.resolve(null)\n  if (state.refreshing) return state.refreshing\n  state.refreshing = doRefresh().finally(() => {\n    state.refreshing = null\n  })\n  return state.refreshing\n}\n\n/**\n * The credential to put on the next request. In token mode, refreshes a stale\n * seed first. In raw-key mode, returns the seed unchanged (legacy passthrough).\n */\nexport async function getFreshCredential(\n  seed?: string,\n): Promise<string | undefined> {\n  // Unconfigured but handed a token (a component received the prerendered seed\n  // as a prop before any provider configured the manager): adopt it so the\n  // refresh machinery works instead of replaying a possibly-expired seed.\n  if (!state.isToken && isSiteToken(seed)) {\n    configureSiteCredential({ credential: seed })\n  }\n  // A raw key (or nothing configured) — no token machinery.\n  if (!state.isToken) return seed ?? state.seed\n  if (needsRefresh()) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed) return refreshed\n    // Refresh failed — fall through to whatever we have; the request may 401 and\n    // trip the breaker with friendly copy.\n  }\n  return state.token ?? seed ?? state.seed\n}\n\n/** Whether the given credential is being managed as a token. */\nexport function isTokenMode(): boolean {\n  return state.isToken\n}\n\n/**\n * Best-known credential WITHOUT refreshing — for synchronous unload paths\n * (sonorBeacon) that can't await. In token mode returns the freshest token held;\n * in raw-key mode returns the seed.\n */\nexport function currentCredential(seed?: string): string | undefined {\n  if (!state.isToken) return seed ?? state.seed\n  return state.token ?? seed ?? state.seed\n}\n"]}

package/dist/chunk-PURI56RE.js

@@ -0,0 +1,8 @@
+'use strict';
+
+// src/shared/version.ts
+var SITE_KIT_VERSION = "6.5.0";
+
+exports.SITE_KIT_VERSION = SITE_KIT_VERSION;
+//# sourceMappingURL=chunk-PURI56RE.js.map
+//# sourceMappingURL=chunk-PURI56RE.js.map

package/dist/{chunk-CIB3RHNZ.js.map → chunk-PURI56RE.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";;;AASO,IAAM,gBAAA,GAAmB","file":"chunk-CIB3RHNZ.js","sourcesContent":["/**\n * @sonordev/site-kit shared - Package version constant\n *\n * Single source of truth for the version the kit reports at runtime (the\n * x-sitekit-version request header set by sonorFetch). Kept as a plain const\n * so client bundles don't need JSON imports; scripts/verify-dts.cjs asserts\n * it matches package.json at publish time, and version.test.ts asserts it in\n * dev, so it can't silently drift.\n */\nexport const SITE_KIT_VERSION = '6.4.0'\n"]}
+{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";;;AASO,IAAM,gBAAA,GAAmB","file":"chunk-PURI56RE.js","sourcesContent":["/**\n * @sonordev/site-kit shared - Package version constant\n *\n * Single source of truth for the version the kit reports at runtime (the\n * x-sitekit-version request header set by sonorFetch). Kept as a plain const\n * so client bundles don't need JSON imports; scripts/verify-dts.cjs asserts\n * it matches package.json at publish time, and version.test.ts asserts it in\n * dev, so it can't silently drift.\n */\nexport const SITE_KIT_VERSION = '6.5.0'\n"]}

package/dist/{chunk-EWDWLY74.js → chunk-QCS7NWMA.js}

@@ -1,12 +1,13 @@
 'use client';
 'use strict';
 
-var chunkCUZ3I6CO_js = require('./chunk-CUZ3I6CO.js');
-var chunkHSLPN3QK_js = require('./chunk-HSLPN3QK.js');
+var chunkU577ITSA_js = require('./chunk-U577ITSA.js');
+var chunkOY3PDIB3_js = require('./chunk-OY3PDIB3.js');
 var chunkHGNSJXWT_js = require('./chunk-HGNSJXWT.js');
-var chunkVDEQVXNV_js = require('./chunk-VDEQVXNV.js');
+var chunkG2KGHIAP_js = require('./chunk-G2KGHIAP.js');
 var chunkUZKXOZHR_js = require('./chunk-UZKXOZHR.js');
 var chunkRC4WWQXR_js = require('./chunk-RC4WWQXR.js');
+var chunkJCDX37BY_js = require('./chunk-JCDX37BY.js');
 var React = require('react');
 var dynamic = require('next/dynamic');
 var jsxRuntime = require('react/jsx-runtime');
@@ -17,15 +18,15 @@ var React__default = /*#__PURE__*/_interopDefault(React);
 var dynamic__default = /*#__PURE__*/_interopDefault(dynamic);
 
 var LazyAnalyticsProvider = dynamic__default.default(
-  () => import('./AnalyticsProvider-QXZN5O6D.js').then((m) => ({ default: m.AnalyticsProvider })),
+  () => import('./AnalyticsProvider-44PDLORZ.js').then((m) => ({ default: m.AnalyticsProvider })),
   { ssr: false }
 );
 var LazyEngageWidget = dynamic__default.default(
-  () => import('./EngageWidget-S234YAT2.js').then((m) => ({ default: m.EngageWidget })),
+  () => import('./EngageWidget-MDCRS3BN.js').then((m) => ({ default: m.EngageWidget })),
   { ssr: false }
 );
 var LazySitemapSync = dynamic__default.default(
-  () => import('./SitemapSync-GN4OXIM2.js').then((m) => ({ default: m.SitemapSync })),
+  () => import('./SitemapSync-KFY4PJ7G.js').then((m) => ({ default: m.SitemapSync })),
   { ssr: false }
 );
 function SiteKitClientProviders({
@@ -44,19 +45,20 @@ function SiteKitClientProviders({
   const modulesReady = chunkHGNSJXWT_js.useDeferredActivation(defer);
   const analyticsConfig = typeof analytics === "object" ? analytics : {};
   const site = chunkUZKXOZHR_js.resolveSiteHost(analyticsConfig.site);
-  chunkCUZ3I6CO_js.publishSiteCredential({ apiKey, apiUrl, site, debug });
+  chunkU577ITSA_js.publishSiteCredential({ apiKey, apiUrl, site, debug });
   const [visitorId] = React.useState(() => chunkRC4WWQXR_js.getOrCreateVisitorId());
   const [sessionId] = React.useState(() => chunkRC4WWQXR_js.getOrCreateSessionId());
   const pageMetadataRef = React.useRef(null);
   const onPageMetadata = React.useCallback((metadata) => {
     pageMetadataRef.current = metadata;
   }, []);
+  React.useEffect(() => chunkJCDX37BY_js.announceFrameReady(), []);
   const siblings = [];
   if (signal) {
     const signalConfig = typeof signal === "object" ? signal : {};
     siblings.push(
       /* @__PURE__ */ jsxRuntime.jsx(
-        chunkVDEQVXNV_js.SignalBridge,
+        chunkG2KGHIAP_js.SignalBridge,
         {
           enabled: true,
           realtime: signalConfig.realtime !== false,
@@ -96,8 +98,9 @@ function SiteKitClientProviders({
   }
   if (engage) {
     const engageConfig = typeof engage === "object" ? engage : {};
+    const engageInFrame = engageConfig.allowInFrame === true;
     siblings.push(
-      /* @__PURE__ */ jsxRuntime.jsx(React__default.default.Fragment, { children: modulesReady && /* @__PURE__ */ jsxRuntime.jsx(
+      /* @__PURE__ */ jsxRuntime.jsx(React__default.default.Fragment, { children: modulesReady && (engageInFrame || !chunkJCDX37BY_js.isCrossOriginFrame()) && /* @__PURE__ */ jsxRuntime.jsx(
         LazyEngageWidget,
         {
           apiUrl,
@@ -133,7 +136,7 @@ function SiteKitClientProviders({
     if (sitemapSync) activeModules.push("sitemapSync");
     siblings.push(
       /* @__PURE__ */ jsxRuntime.jsx(React__default.default.Fragment, { children: modulesReady && /* @__PURE__ */ jsxRuntime.jsx(
-        chunkHSLPN3QK_js.FleetHeartbeat,
+        chunkOY3PDIB3_js.FleetHeartbeat,
         {
           apiUrl,
           apiKey,
@@ -154,5 +157,5 @@ function SiteKitClientProviders({
 }
 
 exports.SiteKitClientProviders = SiteKitClientProviders;
-//# sourceMappingURL=chunk-EWDWLY74.js.map
-//# sourceMappingURL=chunk-EWDWLY74.js.map
+//# sourceMappingURL=chunk-QCS7NWMA.js.map
+//# sourceMappingURL=chunk-QCS7NWMA.js.map

package/dist/chunk-QCS7NWMA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/layout/SiteKitClientProviders.tsx"],"names":["dynamic","useDeferredActivation","resolveSiteHost","publishSiteCredential","useState","getOrCreateVisitorId","getOrCreateSessionId","useRef","useCallback","useEffect","announceFrameReady","jsx","SignalBridge","React","Suspense","isCrossOriginFrame","FleetHeartbeat","jsxs","Fragment"],"mappings":";;;;;;;;;;;;;;;;;;AAgDA,IAAM,qBAAA,GAAwBA,wBAAA;AAAA,EAC5B,MAAM,OAAO,iCAAgC,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,iBAAA,EAAkB,CAAE,CAAA;AAAA,EAC3F,EAAE,KAAK,KAAA;AACT,CAAA;AACA,IAAM,gBAAA,GAAmBA,wBAAA;AAAA,EACvB,MAAM,OAAO,4BAAwB,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,YAAA,EAAa,CAAE,CAAA;AAAA,EAC9E,EAAE,KAAK,KAAA;AACT,CAAA;AACA,IAAM,eAAA,GAAkBA,wBAAA;AAAA,EACtB,MAAM,OAAO,2BAAgB,CAAA,CAAE,IAAA,CAAK,QAAM,EAAE,OAAA,EAAS,CAAA,CAAE,WAAA,EAAY,CAAE,CAAA;AAAA,EACrE,EAAE,KAAK,KAAA;AACT,CAAA;AAgDO,SAAS,sBAAA,CAAuB;AAAA,EACrC,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA,GAAY,IAAA;AAAA,EACZ,MAAA,GAAS,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EACT,WAAA,GAAc,KAAA;AAAA,EACd,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ;AACV,CAAA,EAAgC;AAG9B,EAAA,MAAM,YAAA,GAAeC,uCAAsB,KAAK,CAAA;AAEhD,EAAA,MAAM,eAAA,GACJ,OAAO,SAAA,KAAc,QAAA,GAAW,YAAY,EAAC;AAO/C,EAAA,MAAM,IAAA,GAAOC,gCAAA,CAAgB,eAAA,CAAgB,IAAI,CAAA;AAIjD,EAAAC,sCAAA,CAAsB,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,OAAO,CAAA;AAGrD,EAAA,MAAM,CAAC,SAAS,CAAA,GAAIC,cAAA,CAAS,MAAMC,uCAAsB,CAAA;AACzD,EAAA,MAAM,CAAC,SAAS,CAAA,GAAID,cAAA,CAAS,MAAME,uCAAsB,CAAA;AAGzD,EAAA,MAAM,eAAA,GAAkBC,aAAuC,IAAI,CAAA;AACnE,EAAA,MAAM,cAAA,GAAiBC,iBAAA,CAAY,CAAC,QAAA,KAAsC;AACxE,IAAA,eAAA,CAAgB,OAAA,GAAU,QAAA;AAAA,EAC5B,CAAA,EAAG,EAAE,CAAA;AAKL,EAAAC,eAAA,CAAU,MAAMC,mCAAA,EAAmB,EAAG,EAAE,CAAA;AAGxC,EAAA,MAAM,WAAwB,EAAC;AAK/B,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,YAAA,GACJ,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,EAAC;AACzC,IAAA,QAAA,CAAS,IAAA;AAAA,sBACPC,cAAA;AAAA,QAACC,6BAAA;AAAA,QAAA;AAAA,UAEC,OAAA,EAAO,IAAA;AAAA,UACP,QAAA,EAAU,aAAa,QAAA,KAAa,KAAA;AAAA,UACpC,WAAA,EAAa,aAAa,WAAA,KAAgB,KAAA;AAAA,UAC1C,gBAAA,EAAkB,aAAa,gBAAA,KAAqB,KAAA;AAAA,UACpD,SAAA;AAAA,UACA,SAAA;AAAA,UACA;AAAA,SAAA;AAAA,QAPI;AAAA;AAQN,KACF;AAAA,EACF;AAaA,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,QAAA,CAAS,IAAA;AAAA,sBACPD,cAAA,CAACE,uBAAM,QAAA,EAAN,EACE,0CACCF,cAAA,CAACG,cAAA,EAAA,EAAS,UAAU,IAAA,EAClB,QAAA,kBAAAH,cAAA;AAAA,QAAC,qBAAA;AAAA,QAAA;AAAA,UACC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,IAAA;AAAA,UACA,cAAA,EAAgB,gBAAgB,cAAA,KAAmB,KAAA;AAAA,UACnD,cAAA,EAAgB,gBAAgB,cAAA,KAAmB,KAAA;AAAA,UACnD,gBAAA,EAAkB,gBAAgB,gBAAA,KAAqB,KAAA;AAAA,UACvD,WAAA,EAAa,gBAAgB,WAAA,KAAgB,KAAA;AAAA,UAC7C,gBAAgB,eAAA,CAAgB,eAAA;AAAA,UAChC,cAAc,eAAA,CAAgB,YAAA;AAAA,UAG9B,YAAA,EAAc,gBAAgB,YAAA,KAAiB,IAAA;AAAA,UAC/C,cAAA,EAAgB,gBAAgB,cAAA,KAAmB,IAAA;AAAA,UACnD,KAAA;AAAA,UACA,iBAAA,EAAmB,SAAA;AAAA,UACnB,iBAAA,EAAmB,SAAA;AAAA,UACnB;AAAA;AAAA,OACF,EACF,KAtBgB,cAwBpB;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,YAAA,GACJ,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,EAAC;AAMzC,IAAA,MAAM,aAAA,GAAgB,aAAa,YAAA,KAAiB,IAAA;AACpD,IAAA,QAAA,CAAS,IAAA;AAAA,sBACPA,cAAA,CAACE,uBAAM,QAAA,EAAN,EACE,2BAAiB,aAAA,IAAiB,CAACE,qCAAmB,CAAA,oBACrDJ,cAAA;AAAA,QAAC,gBAAA;AAAA,QAAA;AAAA,UACC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,SAAA;AAAA,UACA,YAAA,EAAc,gBAAgB,YAAA,KAAiB,IAAA;AAAA,UAC/C,cAAA,EAAgB,gBAAgB,cAAA,KAAmB,IAAA;AAAA,UACnD,QAAA,EAAU,aAAa,QAAA,IAAY,cAAA;AAAA,UACnC,cAAc,YAAA,CAAa,YAAA;AAAA,UAC3B,QAAQ,YAAA,CAAa,MAAA;AAAA,UACrB,WAAA,EAAa,aAAa,WAAA,KAAgB;AAAA;AAAA,WAX5B,WAcpB;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,QAAA,CAAS,IAAA;AAAA,sBACPA,cAAA,CAACE,sBAAA,CAAM,QAAA,EAAN,EACE,QAAA,EAAA,YAAA,oBACCF,cAAA;AAAA,QAAC,eAAA;AAAA,QAAA;AAAA,UACC,KAAA;AAAA,UACA,YAAA,EAAc,gBAAgB,YAAA,KAAiB,IAAA;AAAA,UAC/C,cAAA,EAAgB,gBAAgB,cAAA,KAAmB;AAAA;AAAA,WALrC,YAQpB;AAAA,KACF;AAAA,EACF;AAOA,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,MAAM,gBAA+B,EAAC;AACtC,IAAA,IAAI,SAAA,EAAW,aAAA,CAAc,IAAA,CAAK,WAAW,CAAA;AAC7C,IAAA,IAAI,MAAA,EAAQ,aAAA,CAAc,IAAA,CAAK,QAAQ,CAAA;AACvC,IAAA,IAAI,MAAA,EAAQ,aAAA,CAAc,IAAA,CAAK,QAAQ,CAAA;AACvC,IAAA,IAAI,WAAA,EAAa,aAAA,CAAc,IAAA,CAAK,aAAa,CAAA;AACjD,IAAA,QAAA,CAAS,IAAA;AAAA,sBACPA,cAAA,CAACE,sBAAA,CAAM,QAAA,EAAN,EACE,QAAA,EAAA,YAAA,oBACCF,cAAA;AAAA,QAACK,+BAAA;AAAA,QAAA;AAAA,UACC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,IAAA;AAAA,UACA,OAAA,EAAS,aAAA;AAAA,UACT,YAAA,EAAc,gBAAgB,YAAA,KAAiB,IAAA;AAAA,UAC/C,cAAA,EAAgB,gBAAgB,cAAA,KAAmB,IAAA;AAAA,UACnD,KAAA,EAAO,KAAA;AAAA,UACP;AAAA;AAAA,WAVc,UAapB;AAAA,KACF;AAAA,EACF;AAEA,EAAA,uBACEC,eAAA,CAAAC,mBAAA,EAAA,EACG,QAAA,EAAA;AAAA,IAAA,QAAA;AAAA,IACA;AAAA,GAAA,EACH,CAAA;AAEJ","file":"chunk-QCS7NWMA.js","sourcesContent":["'use client'\n\n/**\n * SiteKitClientProviders — Client Island\n *\n * This is the 'use client' boundary for SiteKitLayout.\n * It composes the client-only providers (Analytics, Engage, Signal, SitemapSync)\n * that require React context or browser APIs.\n *\n * All modules are lazy-loaded via next/dynamic so their JS is only downloaded\n * when the feature is enabled — keeping the initial bundle lightweight.\n *\n * All modules share a unified identity (visitor ID + session ID) read from\n * the storage-backed singleton (shared/identity), ensuring consistent\n * tracking across Analytics, Signal, and Engage.\n *\n * 4.0 INVARIANT — CHILDREN ARE NEVER WRAPPED. Every module here renders as a\n * childless sibling AFTER {children}; nothing provides context around page\n * content. That makes the prerender-bailout / remount-flash class of bug\n * structurally impossible. Do not reintroduce a wrapper.\n *\n * Props are passed down from the server-side SiteKitLayout component,\n * which reads env vars at render time.\n */\n\nimport React, { Suspense, useCallback, useEffect, useRef, useState, type ReactNode } from 'react'\nimport dynamic from 'next/dynamic'\nimport {\n  getOrCreateVisitorId,\n  getOrCreateSessionId,\n} from '../shared/identity'\n// Defer non-critical module mounting until the page is quiet: the lazy\n// modules below are dynamic(ssr:false) and never render on the server, but\n// rendering them during hydration still kicks off their chunk downloads +\n// mount effects inside the critical startup window. useDeferredActivation\n// holds them until window.load + idle or first interaction — the same\n// strategy as the hand-rolled per-site deferrals this replaces (upforge\n// `deferred-analytics.tsx`, TPS `DeferredAnalytics.tsx`). The hook is public\n// (`@sonordev/site-kit/client`) so sites can reuse it for their own scripts.\nimport { useDeferredActivation } from '../shared/defer'\nimport { announceFrameReady, isCrossOriginFrame } from '../shared/frame'\n// Single source of truth for seeding the token manager + the __SITE_KIT_*\n// globals — shared with the public `SiteKitCredential` component that\n// non-core layouts (agency-site-kit) use. Do not re-inline it here.\nimport { publishSiteCredential, resolveSiteHost } from '../shared/publishCredential'\nimport type { AnalyticsConfig, EngageConfig, SignalConfig } from './types'\n\n// Lazy-load feature modules — JS only downloaded when feature is enabled\nconst LazyAnalyticsProvider = dynamic(\n  () => import('../analytics/AnalyticsProvider').then(m => ({ default: m.AnalyticsProvider })),\n  { ssr: false },\n)\nconst LazyEngageWidget = dynamic(\n  () => import('../engage/EngageWidget').then(m => ({ default: m.EngageWidget })),\n  { ssr: false },\n)\nconst LazySitemapSync = dynamic(\n  () => import('../SitemapSync').then(m => ({ default: m.SitemapSync })),\n  { ssr: false },\n)\n// SignalBridge is imported STATICALLY, not via dynamic(ssr:false): it is a\n// tiny SSR-safe context shell that renders children immediately and\n// lazy-loads its machinery (SignalCore) as a childless sibling internally.\n// Wrapping children in a dynamic(ssr:false) component was the old SSR-bailout\n// failure mode — do not reintroduce it.\nimport { SignalBridge } from '../signal/SignalBridge'\n// Fleet heartbeat: a deferred, CHILDLESS SIBLING (like Analytics/Engage) that\n// reports this site's kit version + active modules once per session, so the\n// platform can see version drift across the fleet. Tiny and SSR-safe — renders\n// null until the shared idle gate fires; never wraps page content.\nimport { FleetHeartbeat } from '../fleet/FleetHeartbeat'\nimport type { FleetModule } from '../fleet/contract'\n\nexport interface SiteKitClientProvidersProps {\n  children: ReactNode\n  apiKey: string\n  apiUrl: string\n  projectId?: string\n  analytics?: boolean | AnalyticsConfig\n  engage?: boolean | EngageConfig\n  signal?: boolean | SignalConfig\n  /**\n   * Runtime SitemapSync from the visitor's browser. Default FALSE — sitemap\n   * registration belongs to build time and to sonor-api's nightly reconciler,\n   * not to whoever happens to load the page. See SiteKitLayout for the full\n   * reasoning; in short, its guards live in session/localStorage, so every new\n   * visitor missed them and re-POSTed the whole sitemap.\n   */\n  sitemapSync?: boolean\n  /**\n   * Fleet heartbeat — reports kit version + active modules to Sonor once per\n   * session so the platform can track version drift and key state across every\n   * site. Default true. Deferred exactly like Analytics; never in the hydration\n   * path, carries no visitor data.\n   */\n  fleet?: boolean\n  /**\n   * Defer Analytics / Engage / SitemapSync until window load + idle or first\n   * interaction (default true). Pass false to restore legacy eager mounting\n   * on hydration. SignalBridge is never deferred — it must apply experiment\n   * variants as early as possible.\n   */\n  defer?: boolean\n  debug?: boolean\n  /** Browser-safe Google Maps key, resolved server-side by SiteKitLayout. */\n}\n\nexport function SiteKitClientProviders({\n  children,\n  apiKey,\n  apiUrl,\n  projectId,\n  analytics = true,\n  engage = true,\n  signal = false,\n  sitemapSync = false,\n  fleet = true,\n  defer = true,\n  debug = false,\n}: SiteKitClientProvidersProps) {\n  // One shared activation gate for all deferred siblings, so they mount in a\n  // single commit instead of staggered re-renders.\n  const modulesReady = useDeferredActivation(defer)\n  // Hoist analytics config so the `site` dimension is resolvable up here.\n  const analyticsConfig: AnalyticsConfig =\n    typeof analytics === 'object' ? analytics : {}\n\n  // Resolve the sub-site identifier — the dimension that lets one Sonor project\n  // host many sites (e.g. truepowersystems.com + ohiopowerstudies.com under one\n  // TPS project). Precedence lives in resolveSiteHost (shared contract):\n  // explicit `analytics.site` > NEXT_PUBLIC_SITE_URL host > window.location.host.\n  // Needed as a local too — SignalBridge and the analytics config read it below.\n  const site = resolveSiteHost(analyticsConfig.site)\n\n  // Seed the token manager + publish the window globals modules read from.\n  // No-op on the server; runs during render so it lands before child effects.\n  publishSiteCredential({ apiKey, apiUrl, site, debug })\n\n  // Unified identity — single source of truth for all modules\n  const [visitorId] = useState(() => getOrCreateVisitorId())\n  const [sessionId] = useState(() => getOrCreateSessionId())\n\n  // Page metadata bridge: Analytics writes, Signal reads\n  const pageMetadataRef = useRef<Record<string, unknown> | null>(null)\n  const onPageMetadata = useCallback((metadata: Record<string, unknown>) => {\n    pageMetadataRef.current = metadata\n  }, [])\n\n  // Framed by another origin (a case study's device frame), tell the embedder\n  // once this page has painted, so it can let the live page show through its\n  // screenshot. A no-op at the top level. See shared/frame.ts.\n  useEffect(() => announceFrameReady(), [])\n\n  // Children render FIRST and are never re-parented. Siblings accumulate after.\n  const siblings: ReactNode[] = []\n\n  // SignalBridge — childless sibling (4.0: useSignal reads the module store,\n  // so it no longer needs to wrap anything). Not gated on modulesReady:\n  // experiment variants must apply as early as possible.\n  if (signal) {\n    const signalConfig: SignalConfig =\n      typeof signal === 'object' ? signal : {}\n    siblings.push(\n      <SignalBridge\n        key=\"sk-signal\"\n        enabled\n        realtime={signalConfig.realtime !== false}\n        experiments={signalConfig.experiments !== false}\n        behaviorTracking={signalConfig.behaviorTracking !== false}\n        visitorId={visitorId}\n        sessionId={sessionId}\n        pageMetadataRef={pageMetadataRef}\n      />,\n    )\n  }\n\n  // Add Analytics if enabled (renders alongside, doesn't wrap).\n  //\n  // CRITICAL: LazyAnalyticsProvider is dynamic(..., { ssr: false }). Wrapping\n  // {content} inside an ssr:false component makes the entire page tree skip\n  // server rendering — the route de-opts to 100% client rendering and the\n  // hero / LCP element only paints after hydration (mobile LCP ~4s, Lighthouse\n  // ~85). Analytics tracks via effects + a metadata ref, so it never needs to\n  // wrap page content — mount it as a childless sibling, exactly like Engage.\n  // Each deferred sibling is appended as `{modulesReady && <Module/>}` so the\n  // children slot never moves in the tree — flipping ready only mounts the\n  // sibling, it never remounts page content.\n  if (analytics) {\n    siblings.push(\n      <React.Fragment key=\"sk-analytics\">\n        {modulesReady && (\n          <Suspense fallback={null}>\n            <LazyAnalyticsProvider\n              apiUrl={apiUrl}\n              apiKey={apiKey}\n              site={site}\n              trackPageViews={analyticsConfig.trackPageViews !== false}\n              trackWebVitals={analyticsConfig.trackWebVitals !== false}\n              trackScrollDepth={analyticsConfig.trackScrollDepth !== false}\n              trackClicks={analyticsConfig.trackClicks !== false}\n              sessionTimeout={analyticsConfig.sessionDuration}\n              excludePaths={analyticsConfig.excludePaths}\n              // Off by default: a cross-origin embed of this site reports\n              // nothing (see analytics/send-gate.ts). Opt in per site.\n              allowInFrame={analyticsConfig.allowInFrame === true}\n              allowLocalhost={analyticsConfig.allowLocalhost === true}\n              debug={debug}\n              externalVisitorId={visitorId}\n              externalSessionId={sessionId}\n              onPageMetadata={onPageMetadata}\n            />\n          </Suspense>\n        )}\n      </React.Fragment>,\n    )\n  }\n\n  // Engage widget — childless sibling\n  if (engage) {\n    const engageConfig: EngageConfig =\n      typeof engage === 'object' ? engage : {}\n    // Not inside someone else's page: a popup or chat launcher in a case\n    // study's device frame is shown to the agency's visitor, not this site's,\n    // and its impressions would count against this site. Same default and\n    // opt-in as analytics (allowInFrame). modulesReady is false on the server\n    // and in the first client render, so the frame check never runs there.\n    const engageInFrame = engageConfig.allowInFrame === true\n    siblings.push(\n      <React.Fragment key=\"sk-engage\">\n        {modulesReady && (engageInFrame || !isCrossOriginFrame()) && (\n          <LazyEngageWidget\n            apiUrl={apiUrl}\n            apiKey={apiKey}\n            projectId={projectId}\n            allowInFrame={analyticsConfig.allowInFrame === true}\n            allowLocalhost={analyticsConfig.allowLocalhost === true}\n            position={engageConfig.position || 'bottom-right'}\n            offsetBottom={engageConfig.offsetBottom}\n            zIndex={engageConfig.zIndex}\n            chatEnabled={engageConfig.chatEnabled !== false}\n          />\n        )}\n      </React.Fragment>,\n    )\n  }\n\n  // SitemapSync — childless sibling\n  if (sitemapSync) {\n    siblings.push(\n      <React.Fragment key=\"sk-sitemap\">\n        {modulesReady && (\n          <LazySitemapSync\n            debug={debug}\n            allowInFrame={analyticsConfig.allowInFrame === true}\n            allowLocalhost={analyticsConfig.allowLocalhost === true}\n          />\n        )}\n      </React.Fragment>,\n    )\n  }\n\n  // Fleet heartbeat — childless sibling on the same modulesReady idle gate.\n  // Reports the modules actually enabled on THIS layout (honest client-observable\n  // set) so the platform can answer \"which version / modules is each site\n  // running\". defer={false}: the modulesReady gate already handled deferral, so\n  // the heartbeat fires on mount (still bounded to once per session internally).\n  if (fleet) {\n    const activeModules: FleetModule[] = []\n    if (analytics) activeModules.push('analytics')\n    if (engage) activeModules.push('engage')\n    if (signal) activeModules.push('signal')\n    if (sitemapSync) activeModules.push('sitemapSync')\n    siblings.push(\n      <React.Fragment key=\"sk-fleet\">\n        {modulesReady && (\n          <FleetHeartbeat\n            apiUrl={apiUrl}\n            apiKey={apiKey}\n            site={site}\n            modules={activeModules}\n            allowInFrame={analyticsConfig.allowInFrame === true}\n            allowLocalhost={analyticsConfig.allowLocalhost === true}\n            defer={false}\n            debug={debug}\n          />\n        )}\n      </React.Fragment>,\n    )\n  }\n\n  return (\n    <>\n      {children}\n      {siblings}\n    </>\n  )\n}\n"]}

package/dist/{chunk-W7IAG5YD.js → chunk-RMDH2HMW.js}

@@ -10,7 +10,7 @@ function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 var React__default = /*#__PURE__*/_interopDefault(React);
 
 var InteractiveForm = React.lazy(
-  () => import('./ManagedForm-JCMEE626.js').then((m) => ({ default: m.ManagedForm }))
+  () => import('./ManagedForm-4AD3LWSC.js').then((m) => ({ default: m.ManagedForm }))
 );
 function FormEnhancer({
   formId,
@@ -104,5 +104,5 @@ function EnterStyles() {
 }
 
 exports.FormEnhancer = FormEnhancer;
-//# sourceMappingURL=chunk-W7IAG5YD.js.map
-//# sourceMappingURL=chunk-W7IAG5YD.js.map
+//# sourceMappingURL=chunk-RMDH2HMW.js.map
+//# sourceMappingURL=chunk-RMDH2HMW.js.map

package/dist/{chunk-W7IAG5YD.js.map → chunk-RMDH2HMW.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/forms/FormEnhancer.tsx"],"names":["lazy","useDeferredActivation","useState","jsxs","jsx","Suspense","React","useRef","useEffect"],"mappings":";;;;;;;;;;AAkDA,IAAM,eAAA,GAAkBA,UAAA;AAAA,EAAK,MAC3B,OAAO,2BAAe,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,MAAO,EAAE,OAAA,EAAS,CAAA,CAAE,WAAA,EAAY,CAAE;AAClE,CAAA;AA+BO,SAAS,YAAA,CAAa;AAAA,EAC3B,MAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA,GAAQ,MAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR;AACF,CAAA,EAAsB;AACpB,EAAA,MAAM,KAAA,GAAQC,uCAAsB,KAAK,CAAA;AAGzC,EAAA,MAAM,CAAC,QAAA,EAAU,WAAW,CAAA,GAAIC,eAAS,KAAK,CAAA;AAE9C,EAAA,uBACEC,eAAA;AAAA,IAAC,KAAA;AAAA,IAAA;AAAA,MACC,oBAAA,EAAoB,WAAW,UAAA,GAAa,OAAA;AAAA,MAC5C,cAAA,EAAa,YAAA;AAAA,MACb,KAAA,EAAO,KAAA,KAAU,MAAA,GAAS,SAAA,GAAY,MAAA;AAAA,MAErC,QAAA,EAAA;AAAA,QAAA,KAAA,KAAU,MAAA,mCAAW,WAAA,EAAA,EAAY,CAAA;AAAA,QACjC,KAAA,mBACCC,cAAA,CAACC,cAAA,EAAA,EAAS,QAAA,EAAU,QAAA,EAClB,QAAA,kBAAAD,cAAA,CAAC,QAAA,EAAA,EAAS,OAAA,EAAS,MAAM,WAAA,CAAY,IAAI,CAAA,EAAG,UAAU,QAAA,EACpD,QAAA,kBAAAA,cAAA;AAAA,UAAC,eAAA;AAAA,UAAA;AAAA,YACC,MAAA;AAAA,YACA,aAAA;AAAA,YACA,SAAA;AAAA,YACA,UAAA;AAAA,YACA,aAAA;AAAA,YACA,SAAA;AAAA,YACA;AAAA;AAAA,SACF,EACF,GACF,CAAA,GAEA;AAAA;AAAA;AAAA,GAEJ;AAEJ;AAOA,IAAM,QAAA,GAAN,cAAuBE,sBAAA,CAAM,SAAA,CAG3B;AAAA,EAHF,WAAA,GAAA;AAAA,IAAA,KAAA,CAAA,GAAA,SAAA,CAAA;AAIE,IAAA,IAAA,CAAA,KAAA,GAAQ,EAAE,QAAQ,KAAA,EAAM;AAAA,EAAA;AAAA,EAExB,OAAO,wBAAA,GAA2B;AAChC,IAAA,OAAO,EAAE,QAAQ,IAAA,EAAK;AAAA,EACxB;AAAA,EAEA,kBAAkB,GAAA,EAAc;AAC9B,IAAA,OAAA,CAAQ,KAAA,CAAM,wDAAwD,GAAG,CAAA;AAAA,EAC3E;AAAA,EAEA,iBAAA,GAAoB;AAClB,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,IAAA,CAAK,MAAM,OAAA,EAAQ;AAAA,EAC7C;AAAA,EAEA,MAAA,GAAS;AACP,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,OAAO,KAAK,KAAA,CAAM,QAAA;AACzC,IAAA,uBAAOF,cAAA,CAAC,QAAA,EAAA,EAAU,QAAA,EAAA,IAAA,CAAK,KAAA,CAAM,QAAA,EAAS,CAAA;AAAA,EACxC;AACF,CAAA;AAGA,SAAS,QAAA,CAAS,EAAE,QAAA,EAAS,EAAkC;AAC7D,EAAA,MAAM,GAAA,GAAMG,aAAuB,IAAI,CAAA;AACvC,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,MAAM,KAAK,GAAA,CAAI,OAAA;AACf,IAAA,IAAI,CAAC,EAAA,EAAI;AACT,IAAA,EAAA,CAAG,YAAA,CAAa,iBAAiB,EAAE,CAAA;AACnC,IAAA,MAAM,KAAK,qBAAA,CAAsB,MAAM,EAAA,CAAG,eAAA,CAAgB,eAAe,CAAC,CAAA;AAC1E,IAAA,OAAO,MAAM,qBAAqB,EAAE,CAAA;AAAA,EACtC,CAAA,EAAG,EAAE,CAAA;AACL,EAAA,uBACEJ,cAAA,CAAC,SAAI,GAAA,EAAU,KAAA,EAAO,EAAE,OAAA,EAAS,UAAA,IAC9B,QAAA,EACH,CAAA;AAEJ;AAEA,IAAM,SAAA,GAAiC;AAAA,EACrC,UAAA,EACE;AACJ,CAAA;AAOA,SAAS,WAAA,GAAc;AACrB,EAAA,uBACEA,cAAA;AAAA,IAAC,OAAA;AAAA,IAAA;AAAA,MAEC,uBAAA,EAAyB;AAAA,QACvB,MAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA;AAUV;AAAA,GACF;AAEJ","file":"chunk-W7IAG5YD.js","sourcesContent":["'use client'\n\n/**\n * FormEnhancer — the only client code a managed form needs up front.\n *\n * Renders the server-rendered shell (<StaticForm>, passed as `children`) until\n * an idle/first-interaction gate fires, then lazy-imports the interactive form\n * and swaps it in. Everything expensive — validation, conditional logic,\n * spotlight/stage, celebration, momentum — lives behind that dynamic import,\n * so a page ships this boundary and nothing else in its initial chunk set.\n *\n * The shell is a REAL form the whole time (native action + signed token), so\n * the progression is:\n *\n *   no JS at all      -> shell, submits natively. Works.\n *   JS, pre-idle      -> shell, submits natively. Works.\n *   JS, post-idle     -> enhanced form, submits over JSON. Works, with delight.\n *   chunk 404s        -> shell stays. Works. (Never left blank.)\n *\n * That last line is the invariant to protect: the shell is only removed once\n * the enhancement has actually rendered. Do not \"hide the shell then load\" —\n * a CDN hiccup would leave a visitor staring at an empty box where the form\n * used to be.\n *\n * ── Entrance animation ──────────────────────────────────────────────────\n *\n * Above-the-fold forms upgrade while the visitor is looking at them, so the\n * swap must not pop. The wrapper carries `data-sk-form-mount=\"shell\"` and\n * flips to `\"enhanced\"`, and the enhanced form gets `data-sk-enter` for one\n * frame, so a site can style the transition entirely in CSS:\n *\n *   [data-sk-form-mount] { transition: opacity .35s ease }\n *   [data-sk-form-mount=\"shell\"] { opacity: .6 }\n *\n * Defaults ship as CSS variables rather than hard-coded values:\n *\n *   --sk-form-enter-duration  (default 320ms)\n *   --sk-form-enter-easing    (default cubic-bezier(.22,1,.36,1))\n *   --sk-form-enter-distance  (default 6px)\n *\n * `enter=\"none\"` opts out entirely; `enter=\"custom\"` emits the data\n * attributes but no site-kit styles, leaving the animation to the site.\n * Every default is collapsed by prefers-reduced-motion.\n */\n\nimport React, { lazy, Suspense, useEffect, useRef, useState } from 'react'\nimport { useDeferredActivation } from '../shared/defer'\nimport type { FormExperience, FormSubmitResult } from './types'\n\n/** The heavy half. Nothing else in this module may import it statically. */\nconst InteractiveForm = lazy(() =>\n  import('./ManagedForm').then((m) => ({ default: m.ManagedForm })),\n)\n\nexport type FormEnterAnimation = 'fade' | 'none' | 'custom'\n\nexport interface FormEnhancerProps {\n  formId: string\n  /** Server-fetched raw config — hands the enhancement its fields instantly. */\n  initialConfig?: Record<string, unknown> | null\n  className?: string\n  /** @deprecated Ignored since 6.3.2 (the no-JavaScript form POST was removed). */\n  nativeReturnTo?: string\n  experience?: FormExperience\n  /** Pre-fill field values by slug. See ManagedForm.defaultValues. */\n  defaultValues?: Record<string, unknown>\n  onSuccess?: (submission: FormSubmitResult) => void\n  onError?: (error: Error) => void\n  /**\n   * How the enhanced form arrives. 'fade' (default) crossfades and lifts it\n   * into place; 'none' swaps instantly; 'custom' emits the data attributes\n   * and no styles so the site owns the animation.\n   */\n  enter?: FormEnterAnimation\n  /**\n   * Set false to enhance immediately instead of waiting for idle. Only worth\n   * it for a form that is the entire point of the page AND above the fold.\n   */\n  defer?: boolean\n  /** The server-rendered <StaticForm>. Shown until the enhancement mounts. */\n  children: React.ReactNode\n}\n\nexport function FormEnhancer({\n  formId,\n  initialConfig,\n  className,\n  experience,\n  defaultValues,\n  onSuccess,\n  onError,\n  enter = 'fade',\n  defer = true,\n  children,\n}: FormEnhancerProps) {\n  const ready = useDeferredActivation(defer)\n  // Flipped only after the enhancement has actually committed to the DOM, so\n  // the shell never disappears ahead of its replacement.\n  const [enhanced, setEnhanced] = useState(false)\n\n  return (\n    <div\n      data-sk-form-mount={enhanced ? 'enhanced' : 'shell'}\n      data-sk-part=\"form-mount\"\n      style={enter === 'fade' ? FADE_HOST : undefined}\n    >\n      {enter === 'fade' && <EnterStyles />}\n      {ready ? (\n        <Suspense fallback={children}>\n          <Enhanced onMount={() => setEnhanced(true)} fallback={children}>\n            <InteractiveForm\n              formId={formId}\n              initialConfig={initialConfig}\n              className={className}\n              experience={experience}\n              defaultValues={defaultValues}\n              onSuccess={onSuccess}\n              onError={onError}\n            />\n          </Enhanced>\n        </Suspense>\n      ) : (\n        children\n      )}\n    </div>\n  )\n}\n\n/**\n * Reports the moment the enhancement is on screen, and keeps the shell\n * rendered if it throws. An error boundary is the difference between \"the\n * fancy version failed\" and \"there is no form on this page\".\n */\nclass Enhanced extends React.Component<\n  { onMount: () => void; fallback: React.ReactNode; children: React.ReactNode },\n  { failed: boolean }\n> {\n  state = { failed: false }\n\n  static getDerivedStateFromError() {\n    return { failed: true }\n  }\n\n  componentDidCatch(err: unknown) {\n    console.error('[Forms] Enhancement failed; keeping the native form:', err)\n  }\n\n  componentDidMount() {\n    if (!this.state.failed) this.props.onMount()\n  }\n\n  render() {\n    if (this.state.failed) return this.props.fallback\n    return <FrameTag>{this.props.children}</FrameTag>\n  }\n}\n\n/** Adds data-sk-enter for one frame so a CSS transition has something to run. */\nfunction FrameTag({ children }: { children: React.ReactNode }) {\n  const ref = useRef<HTMLDivElement>(null)\n  useEffect(() => {\n    const el = ref.current\n    if (!el) return\n    el.setAttribute('data-sk-enter', '')\n    const id = requestAnimationFrame(() => el.removeAttribute('data-sk-enter'))\n    return () => cancelAnimationFrame(id)\n  }, [])\n  return (\n    <div ref={ref} style={{ display: 'contents' }}>\n      {children}\n    </div>\n  )\n}\n\nconst FADE_HOST: React.CSSProperties = {\n  transition:\n    'opacity var(--sk-form-enter-duration, 320ms) var(--sk-form-enter-easing, cubic-bezier(.22,1,.36,1))',\n}\n\n/**\n * Scoped to [data-sk-part=\"form-mount\"] so it can never touch a site's own\n * markup. Emitted once per form; identical text dedupes in every browser's\n * style cache and gzips to nothing.\n */\nfunction EnterStyles() {\n  return (\n    <style\n      // biome-ignore lint/security/noDangerouslySetInnerHtml: static string, no interpolation\n      dangerouslySetInnerHTML={{\n        __html: `\n[data-sk-part=\"form-mount\"][data-sk-form-mount=\"shell\"]{opacity:.55}\n[data-sk-part=\"form-mount\"][data-sk-form-mount=\"enhanced\"]{opacity:1}\n[data-sk-part=\"form-mount\"] [data-sk-enter]{opacity:0;transform:translateY(var(--sk-form-enter-distance,6px))}\n[data-sk-part=\"form-mount\"] [data-sk-enter] *{transition:none!important}\n@media (prefers-reduced-motion: reduce){\n[data-sk-part=\"form-mount\"]{transition:none!important}\n[data-sk-part=\"form-mount\"][data-sk-form-mount=\"shell\"]{opacity:1}\n[data-sk-part=\"form-mount\"] [data-sk-enter]{opacity:1;transform:none}\n}`,\n      }}\n    />\n  )\n}\n"]}
+{"version":3,"sources":["../src/forms/FormEnhancer.tsx"],"names":["lazy","useDeferredActivation","useState","jsxs","jsx","Suspense","React","useRef","useEffect"],"mappings":";;;;;;;;;;AAkDA,IAAM,eAAA,GAAkBA,UAAA;AAAA,EAAK,MAC3B,OAAO,2BAAe,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,MAAO,EAAE,OAAA,EAAS,CAAA,CAAE,WAAA,EAAY,CAAE;AAClE,CAAA;AA+BO,SAAS,YAAA,CAAa;AAAA,EAC3B,MAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA,GAAQ,MAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR;AACF,CAAA,EAAsB;AACpB,EAAA,MAAM,KAAA,GAAQC,uCAAsB,KAAK,CAAA;AAGzC,EAAA,MAAM,CAAC,QAAA,EAAU,WAAW,CAAA,GAAIC,eAAS,KAAK,CAAA;AAE9C,EAAA,uBACEC,eAAA;AAAA,IAAC,KAAA;AAAA,IAAA;AAAA,MACC,oBAAA,EAAoB,WAAW,UAAA,GAAa,OAAA;AAAA,MAC5C,cAAA,EAAa,YAAA;AAAA,MACb,KAAA,EAAO,KAAA,KAAU,MAAA,GAAS,SAAA,GAAY,MAAA;AAAA,MAErC,QAAA,EAAA;AAAA,QAAA,KAAA,KAAU,MAAA,mCAAW,WAAA,EAAA,EAAY,CAAA;AAAA,QACjC,KAAA,mBACCC,cAAA,CAACC,cAAA,EAAA,EAAS,QAAA,EAAU,QAAA,EAClB,QAAA,kBAAAD,cAAA,CAAC,QAAA,EAAA,EAAS,OAAA,EAAS,MAAM,WAAA,CAAY,IAAI,CAAA,EAAG,UAAU,QAAA,EACpD,QAAA,kBAAAA,cAAA;AAAA,UAAC,eAAA;AAAA,UAAA;AAAA,YACC,MAAA;AAAA,YACA,aAAA;AAAA,YACA,SAAA;AAAA,YACA,UAAA;AAAA,YACA,aAAA;AAAA,YACA,SAAA;AAAA,YACA;AAAA;AAAA,SACF,EACF,GACF,CAAA,GAEA;AAAA;AAAA;AAAA,GAEJ;AAEJ;AAOA,IAAM,QAAA,GAAN,cAAuBE,sBAAA,CAAM,SAAA,CAG3B;AAAA,EAHF,WAAA,GAAA;AAAA,IAAA,KAAA,CAAA,GAAA,SAAA,CAAA;AAIE,IAAA,IAAA,CAAA,KAAA,GAAQ,EAAE,QAAQ,KAAA,EAAM;AAAA,EAAA;AAAA,EAExB,OAAO,wBAAA,GAA2B;AAChC,IAAA,OAAO,EAAE,QAAQ,IAAA,EAAK;AAAA,EACxB;AAAA,EAEA,kBAAkB,GAAA,EAAc;AAC9B,IAAA,OAAA,CAAQ,KAAA,CAAM,wDAAwD,GAAG,CAAA;AAAA,EAC3E;AAAA,EAEA,iBAAA,GAAoB;AAClB,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,IAAA,CAAK,MAAM,OAAA,EAAQ;AAAA,EAC7C;AAAA,EAEA,MAAA,GAAS;AACP,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,OAAO,KAAK,KAAA,CAAM,QAAA;AACzC,IAAA,uBAAOF,cAAA,CAAC,QAAA,EAAA,EAAU,QAAA,EAAA,IAAA,CAAK,KAAA,CAAM,QAAA,EAAS,CAAA;AAAA,EACxC;AACF,CAAA;AAGA,SAAS,QAAA,CAAS,EAAE,QAAA,EAAS,EAAkC;AAC7D,EAAA,MAAM,GAAA,GAAMG,aAAuB,IAAI,CAAA;AACvC,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,MAAM,KAAK,GAAA,CAAI,OAAA;AACf,IAAA,IAAI,CAAC,EAAA,EAAI;AACT,IAAA,EAAA,CAAG,YAAA,CAAa,iBAAiB,EAAE,CAAA;AACnC,IAAA,MAAM,KAAK,qBAAA,CAAsB,MAAM,EAAA,CAAG,eAAA,CAAgB,eAAe,CAAC,CAAA;AAC1E,IAAA,OAAO,MAAM,qBAAqB,EAAE,CAAA;AAAA,EACtC,CAAA,EAAG,EAAE,CAAA;AACL,EAAA,uBACEJ,cAAA,CAAC,SAAI,GAAA,EAAU,KAAA,EAAO,EAAE,OAAA,EAAS,UAAA,IAC9B,QAAA,EACH,CAAA;AAEJ;AAEA,IAAM,SAAA,GAAiC;AAAA,EACrC,UAAA,EACE;AACJ,CAAA;AAOA,SAAS,WAAA,GAAc;AACrB,EAAA,uBACEA,cAAA;AAAA,IAAC,OAAA;AAAA,IAAA;AAAA,MAEC,uBAAA,EAAyB;AAAA,QACvB,MAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA;AAUV;AAAA,GACF;AAEJ","file":"chunk-RMDH2HMW.js","sourcesContent":["'use client'\n\n/**\n * FormEnhancer — the only client code a managed form needs up front.\n *\n * Renders the server-rendered shell (<StaticForm>, passed as `children`) until\n * an idle/first-interaction gate fires, then lazy-imports the interactive form\n * and swaps it in. Everything expensive — validation, conditional logic,\n * spotlight/stage, celebration, momentum — lives behind that dynamic import,\n * so a page ships this boundary and nothing else in its initial chunk set.\n *\n * The shell is a REAL form the whole time (native action + signed token), so\n * the progression is:\n *\n *   no JS at all      -> shell, submits natively. Works.\n *   JS, pre-idle      -> shell, submits natively. Works.\n *   JS, post-idle     -> enhanced form, submits over JSON. Works, with delight.\n *   chunk 404s        -> shell stays. Works. (Never left blank.)\n *\n * That last line is the invariant to protect: the shell is only removed once\n * the enhancement has actually rendered. Do not \"hide the shell then load\" —\n * a CDN hiccup would leave a visitor staring at an empty box where the form\n * used to be.\n *\n * ── Entrance animation ──────────────────────────────────────────────────\n *\n * Above-the-fold forms upgrade while the visitor is looking at them, so the\n * swap must not pop. The wrapper carries `data-sk-form-mount=\"shell\"` and\n * flips to `\"enhanced\"`, and the enhanced form gets `data-sk-enter` for one\n * frame, so a site can style the transition entirely in CSS:\n *\n *   [data-sk-form-mount] { transition: opacity .35s ease }\n *   [data-sk-form-mount=\"shell\"] { opacity: .6 }\n *\n * Defaults ship as CSS variables rather than hard-coded values:\n *\n *   --sk-form-enter-duration  (default 320ms)\n *   --sk-form-enter-easing    (default cubic-bezier(.22,1,.36,1))\n *   --sk-form-enter-distance  (default 6px)\n *\n * `enter=\"none\"` opts out entirely; `enter=\"custom\"` emits the data\n * attributes but no site-kit styles, leaving the animation to the site.\n * Every default is collapsed by prefers-reduced-motion.\n */\n\nimport React, { lazy, Suspense, useEffect, useRef, useState } from 'react'\nimport { useDeferredActivation } from '../shared/defer'\nimport type { FormExperience, FormSubmitResult } from './types'\n\n/** The heavy half. Nothing else in this module may import it statically. */\nconst InteractiveForm = lazy(() =>\n  import('./ManagedForm').then((m) => ({ default: m.ManagedForm })),\n)\n\nexport type FormEnterAnimation = 'fade' | 'none' | 'custom'\n\nexport interface FormEnhancerProps {\n  formId: string\n  /** Server-fetched raw config — hands the enhancement its fields instantly. */\n  initialConfig?: Record<string, unknown> | null\n  className?: string\n  /** @deprecated Ignored since 6.3.2 (the no-JavaScript form POST was removed). */\n  nativeReturnTo?: string\n  experience?: FormExperience\n  /** Pre-fill field values by slug. See ManagedForm.defaultValues. */\n  defaultValues?: Record<string, unknown>\n  onSuccess?: (submission: FormSubmitResult) => void\n  onError?: (error: Error) => void\n  /**\n   * How the enhanced form arrives. 'fade' (default) crossfades and lifts it\n   * into place; 'none' swaps instantly; 'custom' emits the data attributes\n   * and no styles so the site owns the animation.\n   */\n  enter?: FormEnterAnimation\n  /**\n   * Set false to enhance immediately instead of waiting for idle. Only worth\n   * it for a form that is the entire point of the page AND above the fold.\n   */\n  defer?: boolean\n  /** The server-rendered <StaticForm>. Shown until the enhancement mounts. */\n  children: React.ReactNode\n}\n\nexport function FormEnhancer({\n  formId,\n  initialConfig,\n  className,\n  experience,\n  defaultValues,\n  onSuccess,\n  onError,\n  enter = 'fade',\n  defer = true,\n  children,\n}: FormEnhancerProps) {\n  const ready = useDeferredActivation(defer)\n  // Flipped only after the enhancement has actually committed to the DOM, so\n  // the shell never disappears ahead of its replacement.\n  const [enhanced, setEnhanced] = useState(false)\n\n  return (\n    <div\n      data-sk-form-mount={enhanced ? 'enhanced' : 'shell'}\n      data-sk-part=\"form-mount\"\n      style={enter === 'fade' ? FADE_HOST : undefined}\n    >\n      {enter === 'fade' && <EnterStyles />}\n      {ready ? (\n        <Suspense fallback={children}>\n          <Enhanced onMount={() => setEnhanced(true)} fallback={children}>\n            <InteractiveForm\n              formId={formId}\n              initialConfig={initialConfig}\n              className={className}\n              experience={experience}\n              defaultValues={defaultValues}\n              onSuccess={onSuccess}\n              onError={onError}\n            />\n          </Enhanced>\n        </Suspense>\n      ) : (\n        children\n      )}\n    </div>\n  )\n}\n\n/**\n * Reports the moment the enhancement is on screen, and keeps the shell\n * rendered if it throws. An error boundary is the difference between \"the\n * fancy version failed\" and \"there is no form on this page\".\n */\nclass Enhanced extends React.Component<\n  { onMount: () => void; fallback: React.ReactNode; children: React.ReactNode },\n  { failed: boolean }\n> {\n  state = { failed: false }\n\n  static getDerivedStateFromError() {\n    return { failed: true }\n  }\n\n  componentDidCatch(err: unknown) {\n    console.error('[Forms] Enhancement failed; keeping the native form:', err)\n  }\n\n  componentDidMount() {\n    if (!this.state.failed) this.props.onMount()\n  }\n\n  render() {\n    if (this.state.failed) return this.props.fallback\n    return <FrameTag>{this.props.children}</FrameTag>\n  }\n}\n\n/** Adds data-sk-enter for one frame so a CSS transition has something to run. */\nfunction FrameTag({ children }: { children: React.ReactNode }) {\n  const ref = useRef<HTMLDivElement>(null)\n  useEffect(() => {\n    const el = ref.current\n    if (!el) return\n    el.setAttribute('data-sk-enter', '')\n    const id = requestAnimationFrame(() => el.removeAttribute('data-sk-enter'))\n    return () => cancelAnimationFrame(id)\n  }, [])\n  return (\n    <div ref={ref} style={{ display: 'contents' }}>\n      {children}\n    </div>\n  )\n}\n\nconst FADE_HOST: React.CSSProperties = {\n  transition:\n    'opacity var(--sk-form-enter-duration, 320ms) var(--sk-form-enter-easing, cubic-bezier(.22,1,.36,1))',\n}\n\n/**\n * Scoped to [data-sk-part=\"form-mount\"] so it can never touch a site's own\n * markup. Emitted once per form; identical text dedupes in every browser's\n * style cache and gzips to nothing.\n */\nfunction EnterStyles() {\n  return (\n    <style\n      // biome-ignore lint/security/noDangerouslySetInnerHtml: static string, no interpolation\n      dangerouslySetInnerHTML={{\n        __html: `\n[data-sk-part=\"form-mount\"][data-sk-form-mount=\"shell\"]{opacity:.55}\n[data-sk-part=\"form-mount\"][data-sk-form-mount=\"enhanced\"]{opacity:1}\n[data-sk-part=\"form-mount\"] [data-sk-enter]{opacity:0;transform:translateY(var(--sk-form-enter-distance,6px))}\n[data-sk-part=\"form-mount\"] [data-sk-enter] *{transition:none!important}\n@media (prefers-reduced-motion: reduce){\n[data-sk-part=\"form-mount\"]{transition:none!important}\n[data-sk-part=\"form-mount\"][data-sk-form-mount=\"shell\"]{opacity:1}\n[data-sk-part=\"form-mount\"] [data-sk-enter]{opacity:1;transform:none}\n}`,\n      }}\n    />\n  )\n}\n"]}

package/dist/{chunk-U4CYO4NG.js → chunk-SUGBIEYQ.js}

@@ -2,8 +2,8 @@
 'use strict';
 
 var chunkJONWE26J_js = require('./chunk-JONWE26J.js');
-var chunk5RNAUYWE_js = require('./chunk-5RNAUYWE.js');
-var chunkC7J4XLBN_js = require('./chunk-C7J4XLBN.js');
+var chunkNH2P27MA_js = require('./chunk-NH2P27MA.js');
+var chunkIO65ROAO_js = require('./chunk-IO65ROAO.js');
 var react = require('react');
 
 var SYNC_STAMP_KEY = "_sk_sitemap_synced_at";
@@ -47,7 +47,7 @@ function storeSyncedHash(hash) {
 }
 async function parseSitemap(sitemapUrl, debug) {
   try {
-    const response = await chunkC7J4XLBN_js.sonorFetch(sitemapUrl);
+    const response = await chunkIO65ROAO_js.sonorFetch(sitemapUrl);
     if (!response.ok) {
       if (debug) console.warn("[SitemapSync] Failed to fetch sitemap:", response.status);
       return [];
@@ -95,9 +95,9 @@ async function syncToPortal(entries, apiUrl, apiKey, site, debug, mode = "additi
     return { success: true, created: 0, updated: 0 };
   }
   try {
-    const target = chunk5RNAUYWE_js.resolveAnalyticsTarget({ ...gate, apiUrl, apiKey });
+    const target = chunkNH2P27MA_js.resolveAnalyticsTarget({ ...gate, apiUrl, apiKey });
     if (!target) return { success: false, created: 0, updated: 0 };
-    const response = await chunkC7J4XLBN_js.sonorFetch(`${target.apiUrl}/api/public/seo/register-sitemap`, {
+    const response = await chunkIO65ROAO_js.sonorFetch(`${target.apiUrl}/api/public/seo/register-sitemap`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -149,7 +149,7 @@ function SitemapSync({
     const throttleMinutes = syncInterval > 0 ? syncInterval : 60;
     const doSync = async () => {
       const gate = { apiUrl: propApiUrl, apiKey: propApiKey, allowInFrame, allowLocalhost, debug };
-      const target = chunk5RNAUYWE_js.resolveAnalyticsTarget(gate);
+      const target = chunkNH2P27MA_js.resolveAnalyticsTarget(gate);
       if (!target) return;
       const { apiUrl, apiKey } = target;
       const site = window.__SITE_KIT_SITE__ || window.location.host || "";
@@ -173,7 +173,7 @@ function SitemapSync({
         }
       }
     };
-    if (!chunk5RNAUYWE_js.resolveAnalyticsTarget({ apiUrl: propApiUrl, apiKey: propApiKey, allowInFrame, allowLocalhost, debug })) return;
+    if (!chunkNH2P27MA_js.resolveAnalyticsTarget({ apiUrl: propApiUrl, apiKey: propApiKey, allowInFrame, allowLocalhost, debug })) return;
     if (!hasSyncedRef.current) {
       hasSyncedRef.current = true;
       doSync();
@@ -191,5 +191,5 @@ function SitemapSync({
 }
 
 exports.SitemapSync = SitemapSync;
-//# sourceMappingURL=chunk-U4CYO4NG.js.map
-//# sourceMappingURL=chunk-U4CYO4NG.js.map
+//# sourceMappingURL=chunk-SUGBIEYQ.js.map
+//# sourceMappingURL=chunk-SUGBIEYQ.js.map

package/dist/{chunk-U4CYO4NG.js.map → chunk-SUGBIEYQ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/SitemapSync.tsx"],"names":["sonorFetch","locToPath","isMalformedSitemapPath","resolveAnalyticsTarget","inferPageType","useRef","useEffect"],"mappings":";;;;;;;AAwDA,IAAM,cAAA,GAAiB,uBAAA;AACvB,IAAM,aAAA,GAAgB,kBAAA;AAEtB,SAAS,iBAAiB,eAAA,EAAkC;AAC1D,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,OAAA,CAAQ,cAAc,CAAA;AACnD,IAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,IAAA,MAAM,UAAU,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,CAAS,OAAO,EAAE,CAAA;AAC/C,IAAA,OAAO,OAAA,IAAW,CAAA,IAAK,OAAA,GAAU,eAAA,GAAkB,EAAA,GAAK,GAAA;AAAA,EAC1D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAA,GAAoB;AAC3B,EAAA,IAAI;AACF,IAAA,cAAA,CAAe,QAAQ,cAAA,EAAgB,IAAA,CAAK,GAAA,EAAI,CAAE,UAAU,CAAA;AAAA,EAC9D,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AASA,SAAS,WAAA,CAAY,YAAoB,OAAA,EAAiC;AACxE,EAAA,MAAM,IAAA,GAAO,QACV,GAAA,CAAI,CAAA,CAAA,KAAK,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAA,IAAW,EAAE,IAAI,CAAA,CAAE,UAAA,IAAc,EAAE,CAAA,CAAA,EAAI,CAAA,CAAE,YAAY,EAAE,CAAA,CAAE,CAAA,CACjF,IAAA,CAAK,IAAI,CAAA;AACZ,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,QAAQ,CAAA,EAAA,EAAK;AACpC,IAAA,IAAA,GAAA,CAAS,QAAQ,CAAA,IAAK,IAAA,GAAO,IAAA,CAAK,UAAA,CAAW,CAAC,CAAA,GAAK,CAAA;AAAA,EACrD;AACA,EAAA,OAAO,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,OAAA,CAAQ,MAAM,CAAA,CAAA,EAAI,IAAA,CAAK,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA;AAC7D;AAEA,SAAS,oBAAoB,IAAA,EAAuB;AAClD,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,OAAA,CAAQ,aAAa,CAAA,KAAM,IAAA;AAAA,EACjD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB,IAAA,EAAoB;AAC3C,EAAA,IAAI;AACF,IAAA,YAAA,CAAa,OAAA,CAAQ,eAAe,IAAI,CAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,eAAe,YAAA,CAAa,YAAoB,KAAA,EAAyC;AACvF,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAMA,2BAAA,CAAW,UAAU,CAAA;AAC5C,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,wCAAA,EAA0C,SAAS,MAAM,CAAA;AACjF,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,MAAM,MAAA,GAAS,IAAI,SAAA,EAAU;AAC7B,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,eAAA,CAAgB,IAAA,EAAM,iBAAiB,CAAA;AAE1D,IAAA,MAAM,UAAA,GAAa,GAAA,CAAI,aAAA,CAAc,aAAa,CAAA;AAClD,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,oCAAA,EAAsC,WAAW,WAAW,CAAA;AACpF,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,gBAAA,CAAiB,KAAK,CAAA;AACvC,IAAA,MAAM,UAA0B,EAAC;AAEjC,IAAA,IAAA,CAAK,QAAQ,CAAA,GAAA,KAAO;AAClB,MAAA,MAAM,MAAM,GAAA,CAAI,aAAA,CAAc,KAAK,CAAA,EAAG,aAAa,IAAA,EAAK;AACxD,MAAA,IAAI,CAAC,GAAA,EAAK;AAEV,MAAA,MAAM,IAAA,GAAOC,2BAAU,GAAG,CAAA;AAG1B,MAAA,IAAIC,uCAAA,CAAuB,IAAI,CAAA,EAAG;AAChC,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,CAAA,uCAAA,EAA0C,IAAI,CAAA,CAAE,CAAA;AACxE,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,GAAA,CAAI,aAAA,CAAc,SAAS,GAAG,WAAA,IAAe,KAAA,CAAA;AAC7D,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,aAAA,CAAc,YAAY,GAAG,WAAA,IAAe,KAAA,CAAA;AACnE,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,aAAA,CAAc,UAAU,CAAA,EAAG,WAAA;AACnD,MAAA,MAAM,QAAA,GAAW,WAAA,GAAc,UAAA,CAAW,WAAW,CAAA,GAAI,KAAA,CAAA;AAEzD,MAAA,OAAA,CAAQ,KAAK,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,UAAU,CAAA;AAAA,IACtD,CAAC,CAAA;AAED,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,qBAAA,EAAwB,OAAA,CAAQ,MAAM,CAAA,qBAAA,CAAuB,CAAA;AAAA,IAC3E;AAEA,IAAA,OAAO,OAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,sCAAA,EAAwC,KAAK,CAAA;AACtE,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAEA,eAAe,YAAA,CACb,OAAA,EACA,MAAA,EACA,MAAA,EACA,IAAA,EACA,OACA,IAAA,GAAoC,UAAA,EACpC,IAAA,GAA6B,EAAC,EACmC;AACjE,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,qCAAqC,CAAA;AAC7D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AAEA,EAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,kCAAkC,CAAA;AACzD,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EACjD;AAEA,EAAA,IAAI;AAGF,IAAA,MAAM,SAASC,uCAAA,CAAuB,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,QAAQ,CAAA;AACjE,IAAA,IAAI,CAAC,QAAQ,OAAO,EAAE,SAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,OAAA,EAAS,CAAA,EAAE;AAC7D,IAAA,MAAM,WAAW,MAAMH,2BAAA,CAAW,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,gCAAA,CAAA,EAAoC;AAAA,MACpF,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,OAAA,EAAS,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,MAAM;AAAA,UACzB,MAAM,CAAA,CAAE,IAAA;AAAA,UACR,UAAU,CAAA,CAAE,QAAA;AAAA,UACZ,YAAY,CAAA,CAAE,UAAA;AAAA,UACd,QAAA,EAAUI,8BAAA,CAAc,CAAA,CAAE,IAAI;AAAA,SAChC,CAAE,CAAA;AAAA,QACF,IAAA;AAAA;AAAA;AAAA;AAAA,QAIA,GAAI,IAAA,GAAO,EAAE,IAAA,KAAS;AAAC,OACxB;AAAA,OACA,EAAE,MAAA,EAAQ,OAAO,MAAA,EAAQ,OAAA,EAAS,GAAG,CAAA;AAExC,IAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,MAAA,IAAI,OAAO,OAAA,CAAQ,KAAA,CAAM,4BAA4B,QAAA,EAAU,MAAA,EAAQ,UAAU,UAAU,CAAA;AAC3F,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,IAClD;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AAEnC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,IAAI,CAAA,sBAAA,EAAyB,MAAA,CAAO,OAAO,CAAA,UAAA,EAAa,MAAA,CAAO,OAAO,CAAA,QAAA,CAAU,CAAA;AAAA,IAC1F;AAEA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAA;AAAA,MACT,OAAA,EAAS,OAAO,OAAA,IAAW,CAAA;AAAA,MAC3B,OAAA,EAAS,OAAO,OAAA,IAAW;AAAA,KAC7B;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,2BAAA,EAA6B,KAAK,CAAA;AAC3D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AACF;AAEO,SAAS,WAAA,CAAY;AAAA,EAC1B,UAAA,GAAa,cAAA;AAAA,EACb,YAAA,GAAe,EAAA;AAAA,EACf,KAAA,GAAQ,KAAA;AAAA,EACR,IAAA,GAAO,UAAA;AAAA,EACP,MAAA,EAAQ,UAAA;AAAA,EACR,MAAA,EAAQ,UAAA;AAAA,EACR,YAAA,GAAe,KAAA;AAAA,EACf,cAAA,GAAiB;AACnB,CAAA,EAAqB;AACnB,EAAA,MAAM,YAAA,GAAeC,aAAO,KAAK,CAAA;AACjC,EAAA,MAAM,WAAA,GAAcA,aAA8C,IAAI,CAAA;AAEtE,EAAAC,eAAA,CAAU,MAAM;AAMd,IAAA,MAAM,aAAA,GAA6C,UAAA;AAInD,IAAA,MAAM,eAAA,GAAkB,YAAA,GAAe,CAAA,GAAI,YAAA,GAAe,EAAA;AAE1D,IAAA,MAAM,SAAS,YAAY;AACzB,MAAA,MAAM,IAAA,GAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,QAAQ,UAAA,EAAY,YAAA,EAAc,gBAAgB,KAAA,EAAM;AAC3F,MAAA,MAAM,MAAA,GAASH,wCAAuB,IAAI,CAAA;AAC1C,MAAA,IAAI,CAAC,MAAA,EAAQ;AACb,MAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,MAAA;AAC3B,MAAA,MAAM,IAAA,GAAQ,MAAA,CAAe,iBAAA,IAAqB,MAAA,CAAO,SAAS,IAAA,IAAQ,EAAA;AAE1E,MAAA,IAAI,gBAAA,CAAiB,eAAe,CAAA,EAAG;AACrC,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,qDAAA,EAAkD,iBAAiB,kBAAkB,CAAA;AAC5G,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,KAAA,UAAe,GAAA,CAAI,wCAAA,EAA0C,OAAO,CAAA,OAAA,EAAU,IAAI,MAAM,EAAE,CAAA;AAE9F,MAAA,MAAM,OAAA,GAAU,MAAM,YAAA,CAAa,UAAA,EAAY,KAAK,CAAA;AAEpD,MAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,UAAA,EAAY,OAAO,CAAA;AAC5C,QAAA,IAAI,mBAAA,CAAoB,IAAI,CAAA,EAAG;AAI7B,UAAA,WAAA,EAAY;AACZ,UAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,gFAA2E,CAAA;AAClG,UAAA;AAAA,QACF;AACA,QAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,OAAA,EAAS,QAAQ,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAO,aAAA,EAAe,IAAI,CAAA;AAC3F,QAAA,IAAI,OAAO,OAAA,EAAS;AAClB,UAAA,WAAA,EAAY;AACZ,UAAA,eAAA,CAAgB,IAAI,CAAA;AAAA,QACtB;AAAA,MACF;AAAA,IACF,CAAA;AAEA,IAAA,IAAI,CAACA,uCAAA,CAAuB,EAAE,MAAA,EAAQ,UAAA,EAAY,MAAA,EAAQ,UAAA,EAAY,YAAA,EAAc,cAAA,EAAgB,KAAA,EAAO,CAAA,EAAG;AAE9G,IAAA,IAAI,CAAC,aAAa,OAAA,EAAS;AACzB,MAAA,YAAA,CAAa,OAAA,GAAU,IAAA;AACvB,MAAA,MAAA,EAAO;AAAA,IACT;AAEA,IAAA,IAAI,eAAe,CAAA,EAAG;AACpB,MAAA,WAAA,CAAY,OAAA,GAAU,WAAA,CAAY,MAAA,EAAQ,YAAA,GAAe,KAAK,GAAI,CAAA;AAAA,IACpE;AAEA,IAAA,OAAO,MAAM;AACX,MAAA,IAAI,YAAY,OAAA,EAAS;AACvB,QAAA,aAAA,CAAc,YAAY,OAAO,CAAA;AAAA,MACnC;AAAA,IACF,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,UAAA,EAAY,YAAA,EAAc,KAAA,EAAO,MAAM,UAAA,EAAY,UAAA,EAAY,YAAA,EAAc,cAAc,CAAC,CAAA;AAEhG,EAAA,OAAO,IAAA;AACT","file":"chunk-U4CYO4NG.js","sourcesContent":["/**\n * SitemapSync - Automatically sync sitemap.xml to Portal API\n *\n * Client-only component. Lives at package root so the main entry does not\n * pull in seo/ (and server-only code). For use in SiteKitLayout and\n * from @sonordev/site-kit/seo.\n *\n * @example\n * ```tsx\n * import { SitemapSync } from '@sonordev/site-kit'\n * // or\n * import { SitemapSync } from '@sonordev/site-kit/seo'\n * ```\n */\n\n'use client'\n\nimport { useEffect, useRef } from 'react'\nimport { sonorFetch } from './shared/sonorFetch'\nimport { resolveAnalyticsTarget, type AnalyticsGateOptions } from './shared/reporting-gate'\n// Single source of truth for page-type inference + path normalization, shared\n// with createSitemap (build) and the register-sitemap CLI. Pure string logic,\n// safe in the browser.\nimport { inferPageType, locToPath, isMalformedSitemapPath } from './sitemap/shared'\n\ninterface SitemapSyncProps extends AnalyticsGateOptions {\n  /** Custom sitemap URL (defaults to /sitemap.xml) */\n  sitemapUrl?: string\n  /** How often to re-sync in minutes (0 = only on mount, default: 60) */\n  syncInterval?: number\n  /** Enable debug logging */\n  debug?: boolean\n  /**\n   * Sync mode:\n   * - 'additive' (default for runtime): adds/updates pages but never deletes existing ones\n   * - 'full-replace': replaces the entire page set (use only for build-time sync via createSitemap)\n   */\n  mode?: 'additive' | 'full-replace'\n}\n\ninterface SitemapEntry {\n  path: string\n  lastmod?: string\n  changefreq?: string\n  priority?: number\n  pageType?: string\n}\n\n/**\n * Per-browser-session sync throttle. Build-time sync (createSitemap) is the\n * canonical source of truth; runtime SitemapSync is only a safety net — so\n * re-registering the sitemap on every full page load of every visitor is pure\n * waste (fetch + DOMParser on the visitor's main thread, plus a write per\n * pageview against the API). Stamp the last successful sync in sessionStorage\n * and skip while inside the throttle window.\n */\nconst SYNC_STAMP_KEY = '_sk_sitemap_synced_at'\nconst SYNC_HASH_KEY = '_sk_sitemap_hash'\n\nfunction isRecentlySynced(throttleMinutes: number): boolean {\n  try {\n    const stamp = sessionStorage.getItem(SYNC_STAMP_KEY)\n    if (!stamp) return false\n    const elapsed = Date.now() - parseInt(stamp, 10)\n    return elapsed >= 0 && elapsed < throttleMinutes * 60 * 1000\n  } catch {\n    return false // storage unavailable (private mode) — sync as before\n  }\n}\n\nfunction stampSynced(): void {\n  try {\n    sessionStorage.setItem(SYNC_STAMP_KEY, Date.now().toString())\n  } catch {\n    /* storage unavailable — throttle simply won't apply */\n  }\n}\n\n/**\n * Content-hash guard (localStorage, so it survives across sessions): the\n * sitemap of a static site only changes at deploy, so once ONE sync of a given\n * sitemap succeeded from this browser, re-POSTing the identical entry set is\n * pure API load. Hash the parsed entries; skip the POST when unchanged.\n * Keyed by sitemap URL so multiple SitemapSync instances don't collide.\n */\nfunction hashEntries(sitemapUrl: string, entries: SitemapEntry[]): string {\n  const text = entries\n    .map(e => `${e.path}|${e.lastmod ?? ''}|${e.changefreq ?? ''}|${e.priority ?? ''}`)\n    .join('\\n')\n  let hash = 0\n  for (let i = 0; i < text.length; i++) {\n    hash = ((hash << 5) - hash + text.charCodeAt(i)) | 0\n  }\n  return `${sitemapUrl}:${entries.length}:${hash.toString(16)}`\n}\n\nfunction isAlreadySyncedHash(hash: string): boolean {\n  try {\n    return localStorage.getItem(SYNC_HASH_KEY) === hash\n  } catch {\n    return false\n  }\n}\n\nfunction storeSyncedHash(hash: string): void {\n  try {\n    localStorage.setItem(SYNC_HASH_KEY, hash)\n  } catch {\n    /* storage unavailable — guard simply won't apply */\n  }\n}\n\nasync function parseSitemap(sitemapUrl: string, debug: boolean): Promise<SitemapEntry[]> {\n  try {\n    const response = await sonorFetch(sitemapUrl)\n    if (!response.ok) {\n      if (debug) console.warn('[SitemapSync] Failed to fetch sitemap:', response.status)\n      return []\n    }\n\n    const text = await response.text()\n    const parser = new DOMParser()\n    const doc = parser.parseFromString(text, 'application/xml')\n\n    const parseError = doc.querySelector('parsererror')\n    if (parseError) {\n      if (debug) console.warn('[SitemapSync] Sitemap parse error:', parseError.textContent)\n      return []\n    }\n\n    const urls = doc.querySelectorAll('url')\n    const entries: SitemapEntry[] = []\n\n    urls.forEach(url => {\n      const loc = url.querySelector('loc')?.textContent?.trim()\n      if (!loc) return\n\n      const path = locToPath(loc)\n\n      // Reject malformed paths (embedded domains, double protocols, etc.)\n      if (isMalformedSitemapPath(path)) {\n        if (debug) console.warn(`[SitemapSync] Skipping malformed path: ${path}`)\n        return\n      }\n\n      const lastmod = url.querySelector('lastmod')?.textContent || undefined\n      const changefreq = url.querySelector('changefreq')?.textContent || undefined\n      const priorityStr = url.querySelector('priority')?.textContent\n      const priority = priorityStr ? parseFloat(priorityStr) : undefined\n\n      entries.push({ path, lastmod, changefreq, priority })\n    })\n\n    if (debug) {\n      console.log(`[SitemapSync] Parsed ${entries.length} entries from sitemap`)\n    }\n\n    return entries\n  } catch (error) {\n    if (debug) console.error('[SitemapSync] Error parsing sitemap:', error)\n    return []\n  }\n}\n\nasync function syncToPortal(\n  entries: SitemapEntry[],\n  apiUrl: string,\n  apiKey: string,\n  site: string,\n  debug: boolean,\n  mode: 'additive' | 'full-replace' = 'additive',\n  gate: AnalyticsGateOptions = {},\n): Promise<{ success: boolean; created: number; updated: number }> {\n  if (!apiKey) {\n    if (debug) console.warn('[SitemapSync] No API key configured')\n    return { success: false, created: 0, updated: 0 }\n  }\n\n  if (entries.length === 0) {\n    if (debug) console.log('[SitemapSync] No entries to sync')\n    return { success: true, created: 0, updated: 0 }\n  }\n\n  try {\n    // Registration is idempotent in both modes (same payload → same final\n    // state), so retrying a timed-out attempt is safe.\n    const target = resolveAnalyticsTarget({ ...gate, apiUrl, apiKey })\n    if (!target) return { success: false, created: 0, updated: 0 }\n    const response = await sonorFetch(`${target.apiUrl}/api/public/seo/register-sitemap`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        entries: entries.map(e => ({\n          path: e.path,\n          priority: e.priority,\n          changefreq: e.changefreq,\n          pageType: inferPageType(e.path),\n        })),\n        mode,\n        // Sub-site host — tagged on every seo_pages row so the dashboard\n        // can scope the page tree to one microsite. Resolved by\n        // SiteKitClientProviders (see __SITE_KIT_SITE__).\n        ...(site ? { site } : {}),\n      }),\n    }, { apiKey: target.apiKey, retries: 2 })\n\n    if (!response?.ok) {\n      if (debug) console.error('[SitemapSync] API error:', response?.status, response?.statusText)\n      return { success: false, created: 0, updated: 0 }\n    }\n\n    const result = await response.json()\n\n    if (debug) {\n      console.log(`[SitemapSync] Synced: ${result.created} created, ${result.updated} updated`)\n    }\n\n    return {\n      success: true,\n      created: result.created || 0,\n      updated: result.updated || 0,\n    }\n  } catch (error) {\n    if (debug) console.error('[SitemapSync] Sync error:', error)\n    return { success: false, created: 0, updated: 0 }\n  }\n}\n\nexport function SitemapSync({\n  sitemapUrl = '/sitemap.xml',\n  syncInterval = 60,\n  debug = false,\n  mode = 'additive',\n  apiUrl: propApiUrl,\n  apiKey: propApiKey,\n  allowInFrame = false,\n  allowLocalhost = false,\n}: SitemapSyncProps) {\n  const hasSyncedRef = useRef(false)\n  const intervalRef = useRef<ReturnType<typeof setInterval> | null>(null)\n\n  useEffect(() => {\n    // Build-time sync via createSitemap is the canonical source of truth, but\n    // it can fail during ISR revalidation (app/ dir unavailable on serverless).\n    // Runtime SitemapSync in additive mode is a safe fallback — it adds/updates\n    // pages that may be missing without ever deleting existing ones.\n    // Full-replace is never safe at runtime — always force additive.\n    const effectiveMode: 'additive' | 'full-replace' = 'additive'\n\n    // Throttle window: reuse syncInterval when periodic syncing is on,\n    // otherwise default to 60 minutes for the on-mount sync.\n    const throttleMinutes = syncInterval > 0 ? syncInterval : 60\n\n    const doSync = async () => {\n      const gate = { apiUrl: propApiUrl, apiKey: propApiKey, allowInFrame, allowLocalhost, debug }\n      const target = resolveAnalyticsTarget(gate)\n      if (!target) return\n      const { apiUrl, apiKey } = target\n      const site = (window as any).__SITE_KIT_SITE__ || window.location.host || ''\n\n      if (isRecentlySynced(throttleMinutes)) {\n        if (debug) console.log('[SitemapSync] Skipped — synced within the last', throttleMinutes, 'min this session')\n        return\n      }\n\n      if (debug) console.log('[SitemapSync] Starting sitemap sync...', site ? `(site: ${site})` : '')\n\n      const entries = await parseSitemap(sitemapUrl, debug)\n\n      if (entries.length > 0) {\n        const hash = hashEntries(sitemapUrl, entries)\n        if (isAlreadySyncedHash(hash)) {\n          // This exact sitemap already synced from this browser — the server\n          // state can't be improved by re-POSTing it. Stamp the session so we\n          // don't even re-fetch/parse for the rest of the throttle window.\n          stampSynced()\n          if (debug) console.log('[SitemapSync] Skipped POST — sitemap unchanged since last successful sync')\n          return\n        }\n        const result = await syncToPortal(entries, apiUrl, apiKey, site, debug, effectiveMode, gate)\n        if (result.success) {\n          stampSynced()\n          storeSyncedHash(hash)\n        }\n      }\n    }\n\n    if (!resolveAnalyticsTarget({ apiUrl: propApiUrl, apiKey: propApiKey, allowInFrame, allowLocalhost, debug })) return\n\n    if (!hasSyncedRef.current) {\n      hasSyncedRef.current = true\n      doSync()\n    }\n\n    if (syncInterval > 0) {\n      intervalRef.current = setInterval(doSync, syncInterval * 60 * 1000)\n    }\n\n    return () => {\n      if (intervalRef.current) {\n        clearInterval(intervalRef.current)\n      }\n    }\n  }, [sitemapUrl, syncInterval, debug, mode, propApiUrl, propApiKey, allowInFrame, allowLocalhost])\n\n  return null\n}\n"]}
+{"version":3,"sources":["../src/SitemapSync.tsx"],"names":["sonorFetch","locToPath","isMalformedSitemapPath","resolveAnalyticsTarget","inferPageType","useRef","useEffect"],"mappings":";;;;;;;AAwDA,IAAM,cAAA,GAAiB,uBAAA;AACvB,IAAM,aAAA,GAAgB,kBAAA;AAEtB,SAAS,iBAAiB,eAAA,EAAkC;AAC1D,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,OAAA,CAAQ,cAAc,CAAA;AACnD,IAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,IAAA,MAAM,UAAU,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,CAAS,OAAO,EAAE,CAAA;AAC/C,IAAA,OAAO,OAAA,IAAW,CAAA,IAAK,OAAA,GAAU,eAAA,GAAkB,EAAA,GAAK,GAAA;AAAA,EAC1D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAA,GAAoB;AAC3B,EAAA,IAAI;AACF,IAAA,cAAA,CAAe,QAAQ,cAAA,EAAgB,IAAA,CAAK,GAAA,EAAI,CAAE,UAAU,CAAA;AAAA,EAC9D,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AASA,SAAS,WAAA,CAAY,YAAoB,OAAA,EAAiC;AACxE,EAAA,MAAM,IAAA,GAAO,QACV,GAAA,CAAI,CAAA,CAAA,KAAK,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAA,IAAW,EAAE,IAAI,CAAA,CAAE,UAAA,IAAc,EAAE,CAAA,CAAA,EAAI,CAAA,CAAE,YAAY,EAAE,CAAA,CAAE,CAAA,CACjF,IAAA,CAAK,IAAI,CAAA;AACZ,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,QAAQ,CAAA,EAAA,EAAK;AACpC,IAAA,IAAA,GAAA,CAAS,QAAQ,CAAA,IAAK,IAAA,GAAO,IAAA,CAAK,UAAA,CAAW,CAAC,CAAA,GAAK,CAAA;AAAA,EACrD;AACA,EAAA,OAAO,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,OAAA,CAAQ,MAAM,CAAA,CAAA,EAAI,IAAA,CAAK,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA;AAC7D;AAEA,SAAS,oBAAoB,IAAA,EAAuB;AAClD,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,OAAA,CAAQ,aAAa,CAAA,KAAM,IAAA;AAAA,EACjD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB,IAAA,EAAoB;AAC3C,EAAA,IAAI;AACF,IAAA,YAAA,CAAa,OAAA,CAAQ,eAAe,IAAI,CAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,eAAe,YAAA,CAAa,YAAoB,KAAA,EAAyC;AACvF,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAMA,2BAAA,CAAW,UAAU,CAAA;AAC5C,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,wCAAA,EAA0C,SAAS,MAAM,CAAA;AACjF,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,MAAM,MAAA,GAAS,IAAI,SAAA,EAAU;AAC7B,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,eAAA,CAAgB,IAAA,EAAM,iBAAiB,CAAA;AAE1D,IAAA,MAAM,UAAA,GAAa,GAAA,CAAI,aAAA,CAAc,aAAa,CAAA;AAClD,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,oCAAA,EAAsC,WAAW,WAAW,CAAA;AACpF,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,gBAAA,CAAiB,KAAK,CAAA;AACvC,IAAA,MAAM,UAA0B,EAAC;AAEjC,IAAA,IAAA,CAAK,QAAQ,CAAA,GAAA,KAAO;AAClB,MAAA,MAAM,MAAM,GAAA,CAAI,aAAA,CAAc,KAAK,CAAA,EAAG,aAAa,IAAA,EAAK;AACxD,MAAA,IAAI,CAAC,GAAA,EAAK;AAEV,MAAA,MAAM,IAAA,GAAOC,2BAAU,GAAG,CAAA;AAG1B,MAAA,IAAIC,uCAAA,CAAuB,IAAI,CAAA,EAAG;AAChC,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,CAAA,uCAAA,EAA0C,IAAI,CAAA,CAAE,CAAA;AACxE,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,GAAA,CAAI,aAAA,CAAc,SAAS,GAAG,WAAA,IAAe,KAAA,CAAA;AAC7D,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,aAAA,CAAc,YAAY,GAAG,WAAA,IAAe,KAAA,CAAA;AACnE,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,aAAA,CAAc,UAAU,CAAA,EAAG,WAAA;AACnD,MAAA,MAAM,QAAA,GAAW,WAAA,GAAc,UAAA,CAAW,WAAW,CAAA,GAAI,KAAA,CAAA;AAEzD,MAAA,OAAA,CAAQ,KAAK,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,UAAU,CAAA;AAAA,IACtD,CAAC,CAAA;AAED,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,qBAAA,EAAwB,OAAA,CAAQ,MAAM,CAAA,qBAAA,CAAuB,CAAA;AAAA,IAC3E;AAEA,IAAA,OAAO,OAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,sCAAA,EAAwC,KAAK,CAAA;AACtE,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAEA,eAAe,YAAA,CACb,OAAA,EACA,MAAA,EACA,MAAA,EACA,IAAA,EACA,OACA,IAAA,GAAoC,UAAA,EACpC,IAAA,GAA6B,EAAC,EACmC;AACjE,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,qCAAqC,CAAA;AAC7D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AAEA,EAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,kCAAkC,CAAA;AACzD,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EACjD;AAEA,EAAA,IAAI;AAGF,IAAA,MAAM,SAASC,uCAAA,CAAuB,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,QAAQ,CAAA;AACjE,IAAA,IAAI,CAAC,QAAQ,OAAO,EAAE,SAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,OAAA,EAAS,CAAA,EAAE;AAC7D,IAAA,MAAM,WAAW,MAAMH,2BAAA,CAAW,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,gCAAA,CAAA,EAAoC;AAAA,MACpF,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,OAAA,EAAS,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,MAAM;AAAA,UACzB,MAAM,CAAA,CAAE,IAAA;AAAA,UACR,UAAU,CAAA,CAAE,QAAA;AAAA,UACZ,YAAY,CAAA,CAAE,UAAA;AAAA,UACd,QAAA,EAAUI,8BAAA,CAAc,CAAA,CAAE,IAAI;AAAA,SAChC,CAAE,CAAA;AAAA,QACF,IAAA;AAAA;AAAA;AAAA;AAAA,QAIA,GAAI,IAAA,GAAO,EAAE,IAAA,KAAS;AAAC,OACxB;AAAA,OACA,EAAE,MAAA,EAAQ,OAAO,MAAA,EAAQ,OAAA,EAAS,GAAG,CAAA;AAExC,IAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,MAAA,IAAI,OAAO,OAAA,CAAQ,KAAA,CAAM,4BAA4B,QAAA,EAAU,MAAA,EAAQ,UAAU,UAAU,CAAA;AAC3F,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,IAClD;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AAEnC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,IAAI,CAAA,sBAAA,EAAyB,MAAA,CAAO,OAAO,CAAA,UAAA,EAAa,MAAA,CAAO,OAAO,CAAA,QAAA,CAAU,CAAA;AAAA,IAC1F;AAEA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAA;AAAA,MACT,OAAA,EAAS,OAAO,OAAA,IAAW,CAAA;AAAA,MAC3B,OAAA,EAAS,OAAO,OAAA,IAAW;AAAA,KAC7B;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,2BAAA,EAA6B,KAAK,CAAA;AAC3D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AACF;AAEO,SAAS,WAAA,CAAY;AAAA,EAC1B,UAAA,GAAa,cAAA;AAAA,EACb,YAAA,GAAe,EAAA;AAAA,EACf,KAAA,GAAQ,KAAA;AAAA,EACR,IAAA,GAAO,UAAA;AAAA,EACP,MAAA,EAAQ,UAAA;AAAA,EACR,MAAA,EAAQ,UAAA;AAAA,EACR,YAAA,GAAe,KAAA;AAAA,EACf,cAAA,GAAiB;AACnB,CAAA,EAAqB;AACnB,EAAA,MAAM,YAAA,GAAeC,aAAO,KAAK,CAAA;AACjC,EAAA,MAAM,WAAA,GAAcA,aAA8C,IAAI,CAAA;AAEtE,EAAAC,eAAA,CAAU,MAAM;AAMd,IAAA,MAAM,aAAA,GAA6C,UAAA;AAInD,IAAA,MAAM,eAAA,GAAkB,YAAA,GAAe,CAAA,GAAI,YAAA,GAAe,EAAA;AAE1D,IAAA,MAAM,SAAS,YAAY;AACzB,MAAA,MAAM,IAAA,GAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,QAAQ,UAAA,EAAY,YAAA,EAAc,gBAAgB,KAAA,EAAM;AAC3F,MAAA,MAAM,MAAA,GAASH,wCAAuB,IAAI,CAAA;AAC1C,MAAA,IAAI,CAAC,MAAA,EAAQ;AACb,MAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,MAAA;AAC3B,MAAA,MAAM,IAAA,GAAQ,MAAA,CAAe,iBAAA,IAAqB,MAAA,CAAO,SAAS,IAAA,IAAQ,EAAA;AAE1E,MAAA,IAAI,gBAAA,CAAiB,eAAe,CAAA,EAAG;AACrC,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,qDAAA,EAAkD,iBAAiB,kBAAkB,CAAA;AAC5G,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,KAAA,UAAe,GAAA,CAAI,wCAAA,EAA0C,OAAO,CAAA,OAAA,EAAU,IAAI,MAAM,EAAE,CAAA;AAE9F,MAAA,MAAM,OAAA,GAAU,MAAM,YAAA,CAAa,UAAA,EAAY,KAAK,CAAA;AAEpD,MAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,UAAA,EAAY,OAAO,CAAA;AAC5C,QAAA,IAAI,mBAAA,CAAoB,IAAI,CAAA,EAAG;AAI7B,UAAA,WAAA,EAAY;AACZ,UAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,gFAA2E,CAAA;AAClG,UAAA;AAAA,QACF;AACA,QAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,OAAA,EAAS,QAAQ,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAO,aAAA,EAAe,IAAI,CAAA;AAC3F,QAAA,IAAI,OAAO,OAAA,EAAS;AAClB,UAAA,WAAA,EAAY;AACZ,UAAA,eAAA,CAAgB,IAAI,CAAA;AAAA,QACtB;AAAA,MACF;AAAA,IACF,CAAA;AAEA,IAAA,IAAI,CAACA,uCAAA,CAAuB,EAAE,MAAA,EAAQ,UAAA,EAAY,MAAA,EAAQ,UAAA,EAAY,YAAA,EAAc,cAAA,EAAgB,KAAA,EAAO,CAAA,EAAG;AAE9G,IAAA,IAAI,CAAC,aAAa,OAAA,EAAS;AACzB,MAAA,YAAA,CAAa,OAAA,GAAU,IAAA;AACvB,MAAA,MAAA,EAAO;AAAA,IACT;AAEA,IAAA,IAAI,eAAe,CAAA,EAAG;AACpB,MAAA,WAAA,CAAY,OAAA,GAAU,WAAA,CAAY,MAAA,EAAQ,YAAA,GAAe,KAAK,GAAI,CAAA;AAAA,IACpE;AAEA,IAAA,OAAO,MAAM;AACX,MAAA,IAAI,YAAY,OAAA,EAAS;AACvB,QAAA,aAAA,CAAc,YAAY,OAAO,CAAA;AAAA,MACnC;AAAA,IACF,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,UAAA,EAAY,YAAA,EAAc,KAAA,EAAO,MAAM,UAAA,EAAY,UAAA,EAAY,YAAA,EAAc,cAAc,CAAC,CAAA;AAEhG,EAAA,OAAO,IAAA;AACT","file":"chunk-SUGBIEYQ.js","sourcesContent":["/**\n * SitemapSync - Automatically sync sitemap.xml to Portal API\n *\n * Client-only component. Lives at package root so the main entry does not\n * pull in seo/ (and server-only code). For use in SiteKitLayout and\n * from @sonordev/site-kit/seo.\n *\n * @example\n * ```tsx\n * import { SitemapSync } from '@sonordev/site-kit'\n * // or\n * import { SitemapSync } from '@sonordev/site-kit/seo'\n * ```\n */\n\n'use client'\n\nimport { useEffect, useRef } from 'react'\nimport { sonorFetch } from './shared/sonorFetch'\nimport { resolveAnalyticsTarget, type AnalyticsGateOptions } from './shared/reporting-gate'\n// Single source of truth for page-type inference + path normalization, shared\n// with createSitemap (build) and the register-sitemap CLI. Pure string logic,\n// safe in the browser.\nimport { inferPageType, locToPath, isMalformedSitemapPath } from './sitemap/shared'\n\ninterface SitemapSyncProps extends AnalyticsGateOptions {\n  /** Custom sitemap URL (defaults to /sitemap.xml) */\n  sitemapUrl?: string\n  /** How often to re-sync in minutes (0 = only on mount, default: 60) */\n  syncInterval?: number\n  /** Enable debug logging */\n  debug?: boolean\n  /**\n   * Sync mode:\n   * - 'additive' (default for runtime): adds/updates pages but never deletes existing ones\n   * - 'full-replace': replaces the entire page set (use only for build-time sync via createSitemap)\n   */\n  mode?: 'additive' | 'full-replace'\n}\n\ninterface SitemapEntry {\n  path: string\n  lastmod?: string\n  changefreq?: string\n  priority?: number\n  pageType?: string\n}\n\n/**\n * Per-browser-session sync throttle. Build-time sync (createSitemap) is the\n * canonical source of truth; runtime SitemapSync is only a safety net — so\n * re-registering the sitemap on every full page load of every visitor is pure\n * waste (fetch + DOMParser on the visitor's main thread, plus a write per\n * pageview against the API). Stamp the last successful sync in sessionStorage\n * and skip while inside the throttle window.\n */\nconst SYNC_STAMP_KEY = '_sk_sitemap_synced_at'\nconst SYNC_HASH_KEY = '_sk_sitemap_hash'\n\nfunction isRecentlySynced(throttleMinutes: number): boolean {\n  try {\n    const stamp = sessionStorage.getItem(SYNC_STAMP_KEY)\n    if (!stamp) return false\n    const elapsed = Date.now() - parseInt(stamp, 10)\n    return elapsed >= 0 && elapsed < throttleMinutes * 60 * 1000\n  } catch {\n    return false // storage unavailable (private mode) — sync as before\n  }\n}\n\nfunction stampSynced(): void {\n  try {\n    sessionStorage.setItem(SYNC_STAMP_KEY, Date.now().toString())\n  } catch {\n    /* storage unavailable — throttle simply won't apply */\n  }\n}\n\n/**\n * Content-hash guard (localStorage, so it survives across sessions): the\n * sitemap of a static site only changes at deploy, so once ONE sync of a given\n * sitemap succeeded from this browser, re-POSTing the identical entry set is\n * pure API load. Hash the parsed entries; skip the POST when unchanged.\n * Keyed by sitemap URL so multiple SitemapSync instances don't collide.\n */\nfunction hashEntries(sitemapUrl: string, entries: SitemapEntry[]): string {\n  const text = entries\n    .map(e => `${e.path}|${e.lastmod ?? ''}|${e.changefreq ?? ''}|${e.priority ?? ''}`)\n    .join('\\n')\n  let hash = 0\n  for (let i = 0; i < text.length; i++) {\n    hash = ((hash << 5) - hash + text.charCodeAt(i)) | 0\n  }\n  return `${sitemapUrl}:${entries.length}:${hash.toString(16)}`\n}\n\nfunction isAlreadySyncedHash(hash: string): boolean {\n  try {\n    return localStorage.getItem(SYNC_HASH_KEY) === hash\n  } catch {\n    return false\n  }\n}\n\nfunction storeSyncedHash(hash: string): void {\n  try {\n    localStorage.setItem(SYNC_HASH_KEY, hash)\n  } catch {\n    /* storage unavailable — guard simply won't apply */\n  }\n}\n\nasync function parseSitemap(sitemapUrl: string, debug: boolean): Promise<SitemapEntry[]> {\n  try {\n    const response = await sonorFetch(sitemapUrl)\n    if (!response.ok) {\n      if (debug) console.warn('[SitemapSync] Failed to fetch sitemap:', response.status)\n      return []\n    }\n\n    const text = await response.text()\n    const parser = new DOMParser()\n    const doc = parser.parseFromString(text, 'application/xml')\n\n    const parseError = doc.querySelector('parsererror')\n    if (parseError) {\n      if (debug) console.warn('[SitemapSync] Sitemap parse error:', parseError.textContent)\n      return []\n    }\n\n    const urls = doc.querySelectorAll('url')\n    const entries: SitemapEntry[] = []\n\n    urls.forEach(url => {\n      const loc = url.querySelector('loc')?.textContent?.trim()\n      if (!loc) return\n\n      const path = locToPath(loc)\n\n      // Reject malformed paths (embedded domains, double protocols, etc.)\n      if (isMalformedSitemapPath(path)) {\n        if (debug) console.warn(`[SitemapSync] Skipping malformed path: ${path}`)\n        return\n      }\n\n      const lastmod = url.querySelector('lastmod')?.textContent || undefined\n      const changefreq = url.querySelector('changefreq')?.textContent || undefined\n      const priorityStr = url.querySelector('priority')?.textContent\n      const priority = priorityStr ? parseFloat(priorityStr) : undefined\n\n      entries.push({ path, lastmod, changefreq, priority })\n    })\n\n    if (debug) {\n      console.log(`[SitemapSync] Parsed ${entries.length} entries from sitemap`)\n    }\n\n    return entries\n  } catch (error) {\n    if (debug) console.error('[SitemapSync] Error parsing sitemap:', error)\n    return []\n  }\n}\n\nasync function syncToPortal(\n  entries: SitemapEntry[],\n  apiUrl: string,\n  apiKey: string,\n  site: string,\n  debug: boolean,\n  mode: 'additive' | 'full-replace' = 'additive',\n  gate: AnalyticsGateOptions = {},\n): Promise<{ success: boolean; created: number; updated: number }> {\n  if (!apiKey) {\n    if (debug) console.warn('[SitemapSync] No API key configured')\n    return { success: false, created: 0, updated: 0 }\n  }\n\n  if (entries.length === 0) {\n    if (debug) console.log('[SitemapSync] No entries to sync')\n    return { success: true, created: 0, updated: 0 }\n  }\n\n  try {\n    // Registration is idempotent in both modes (same payload → same final\n    // state), so retrying a timed-out attempt is safe.\n    const target = resolveAnalyticsTarget({ ...gate, apiUrl, apiKey })\n    if (!target) return { success: false, created: 0, updated: 0 }\n    const response = await sonorFetch(`${target.apiUrl}/api/public/seo/register-sitemap`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        entries: entries.map(e => ({\n          path: e.path,\n          priority: e.priority,\n          changefreq: e.changefreq,\n          pageType: inferPageType(e.path),\n        })),\n        mode,\n        // Sub-site host — tagged on every seo_pages row so the dashboard\n        // can scope the page tree to one microsite. Resolved by\n        // SiteKitClientProviders (see __SITE_KIT_SITE__).\n        ...(site ? { site } : {}),\n      }),\n    }, { apiKey: target.apiKey, retries: 2 })\n\n    if (!response?.ok) {\n      if (debug) console.error('[SitemapSync] API error:', response?.status, response?.statusText)\n      return { success: false, created: 0, updated: 0 }\n    }\n\n    const result = await response.json()\n\n    if (debug) {\n      console.log(`[SitemapSync] Synced: ${result.created} created, ${result.updated} updated`)\n    }\n\n    return {\n      success: true,\n      created: result.created || 0,\n      updated: result.updated || 0,\n    }\n  } catch (error) {\n    if (debug) console.error('[SitemapSync] Sync error:', error)\n    return { success: false, created: 0, updated: 0 }\n  }\n}\n\nexport function SitemapSync({\n  sitemapUrl = '/sitemap.xml',\n  syncInterval = 60,\n  debug = false,\n  mode = 'additive',\n  apiUrl: propApiUrl,\n  apiKey: propApiKey,\n  allowInFrame = false,\n  allowLocalhost = false,\n}: SitemapSyncProps) {\n  const hasSyncedRef = useRef(false)\n  const intervalRef = useRef<ReturnType<typeof setInterval> | null>(null)\n\n  useEffect(() => {\n    // Build-time sync via createSitemap is the canonical source of truth, but\n    // it can fail during ISR revalidation (app/ dir unavailable on serverless).\n    // Runtime SitemapSync in additive mode is a safe fallback — it adds/updates\n    // pages that may be missing without ever deleting existing ones.\n    // Full-replace is never safe at runtime — always force additive.\n    const effectiveMode: 'additive' | 'full-replace' = 'additive'\n\n    // Throttle window: reuse syncInterval when periodic syncing is on,\n    // otherwise default to 60 minutes for the on-mount sync.\n    const throttleMinutes = syncInterval > 0 ? syncInterval : 60\n\n    const doSync = async () => {\n      const gate = { apiUrl: propApiUrl, apiKey: propApiKey, allowInFrame, allowLocalhost, debug }\n      const target = resolveAnalyticsTarget(gate)\n      if (!target) return\n      const { apiUrl, apiKey } = target\n      const site = (window as any).__SITE_KIT_SITE__ || window.location.host || ''\n\n      if (isRecentlySynced(throttleMinutes)) {\n        if (debug) console.log('[SitemapSync] Skipped — synced within the last', throttleMinutes, 'min this session')\n        return\n      }\n\n      if (debug) console.log('[SitemapSync] Starting sitemap sync...', site ? `(site: ${site})` : '')\n\n      const entries = await parseSitemap(sitemapUrl, debug)\n\n      if (entries.length > 0) {\n        const hash = hashEntries(sitemapUrl, entries)\n        if (isAlreadySyncedHash(hash)) {\n          // This exact sitemap already synced from this browser — the server\n          // state can't be improved by re-POSTing it. Stamp the session so we\n          // don't even re-fetch/parse for the rest of the throttle window.\n          stampSynced()\n          if (debug) console.log('[SitemapSync] Skipped POST — sitemap unchanged since last successful sync')\n          return\n        }\n        const result = await syncToPortal(entries, apiUrl, apiKey, site, debug, effectiveMode, gate)\n        if (result.success) {\n          stampSynced()\n          storeSyncedHash(hash)\n        }\n      }\n    }\n\n    if (!resolveAnalyticsTarget({ apiUrl: propApiUrl, apiKey: propApiKey, allowInFrame, allowLocalhost, debug })) return\n\n    if (!hasSyncedRef.current) {\n      hasSyncedRef.current = true\n      doSync()\n    }\n\n    if (syncInterval > 0) {\n      intervalRef.current = setInterval(doSync, syncInterval * 60 * 1000)\n    }\n\n    return () => {\n      if (intervalRef.current) {\n        clearInterval(intervalRef.current)\n      }\n    }\n  }, [sitemapUrl, syncInterval, debug, mode, propApiUrl, propApiKey, allowInFrame, allowLocalhost])\n\n  return null\n}\n"]}

package/dist/{chunk-M62L2N5A.mjs → chunk-SVCKJ5KH.mjs}

@@ -1,7 +1,7 @@
 'use client';
 import { locToPath, isMalformedSitemapPath, inferPageType } from './chunk-C2CTLLIO.mjs';
-import { resolveAnalyticsTarget } from './chunk-A6UYV475.mjs';
-import { sonorFetch } from './chunk-5T3J24K4.mjs';
+import { resolveAnalyticsTarget } from './chunk-CABEVWKJ.mjs';
+import { sonorFetch } from './chunk-3BLKKF67.mjs';
 import { useRef, useEffect } from 'react';
 
 var SYNC_STAMP_KEY = "_sk_sitemap_synced_at";
@@ -189,5 +189,5 @@ function SitemapSync({
 }
 
 export { SitemapSync };
-//# sourceMappingURL=chunk-M62L2N5A.mjs.map
-//# sourceMappingURL=chunk-M62L2N5A.mjs.map
+//# sourceMappingURL=chunk-SVCKJ5KH.mjs.map
+//# sourceMappingURL=chunk-SVCKJ5KH.mjs.map