@sonordev/site-kit 6.4.0 → 7.0.0

package/dist/chunk-KOPFFKG2.mjs

@@ -1,132 +0,0 @@
-'use client';
-import { isEmptyValue, isDisplayOnly } from './chunk-QRHVMTHF.mjs';
-import { useMemo, useState, useRef, useEffect } from 'react';
-
-var NO_CONTROLS = {};
-function useFieldControls(fields) {
-  const needsDate = useMemo(
-    () => (fields ?? []).some((f) => f.field_type === "date" || f.field_type === "datetime"),
-    [fields]
-  );
-  const needsFile = useMemo(
-    () => (fields ?? []).some((f) => f.field_type === "file"),
-    [fields]
-  );
-  const [controls, setControls] = useState(NO_CONTROLS);
-  const requested = useRef({ date: false, file: false });
-  useEffect(() => {
-    let cancelled = false;
-    if (needsDate && !requested.current.date) {
-      requested.current.date = true;
-      import('./DatePicker-4WNKNNCV.mjs').then((m) => {
-        if (!cancelled) setControls((prev) => ({ ...prev, Date: m.DatePicker }));
-      }).catch(() => {
-        requested.current.date = false;
-      });
-    }
-    if (needsFile && !requested.current.file) {
-      requested.current.file = true;
-      import('./FileField-HNEBEBLB.mjs').then((m) => {
-        if (!cancelled) setControls((prev) => ({ ...prev, File: m.FileField }));
-      }).catch(() => {
-        requested.current.file = false;
-      });
-    }
-    return () => {
-      cancelled = true;
-    };
-  }, [needsDate, needsFile]);
-  return controls;
-}
-
-// src/forms/experience-plan.ts
-function stageQuestions(config) {
-  const input = (config.fields || []).filter(
-    (f) => !isDisplayOnly(f)
-  );
-  if (!config.is_multi_step || !config.steps?.length) {
-    return input.map((field) => ({ field }));
-  }
-  const ordered = [...config.steps].sort((a, b) => a.step_number - b.step_number);
-  const out = [];
-  const claimed = /* @__PURE__ */ new Set();
-  for (const step of ordered) {
-    for (const field of input) {
-      if (field.step_id === step.id) {
-        out.push({ field, step });
-        claimed.add(field.id);
-      }
-    }
-  }
-  for (const field of input) {
-    if (!claimed.has(field.id)) out.push({ field });
-  }
-  return out;
-}
-var WIDTH_FRACTION = {
-  full: 1,
-  half: 1 / 2,
-  third: 1 / 3,
-  quarter: 1 / 4
-};
-function stageViews(config) {
-  const questions = stageQuestions(config);
-  const views = [];
-  let open = null;
-  let openWidth = 0;
-  const close = () => {
-    if (open) views.push(open);
-    open = null;
-    openWidth = 0;
-  };
-  for (const q of questions) {
-    const fraction = WIDTH_FRACTION[q.field.width] ?? 1;
-    const chapterChanged = open && open.step?.id !== q.step?.id;
-    if (fraction >= 1 || chapterChanged) close();
-    if (!open) {
-      open = { fields: [q.field], step: q.step };
-      openWidth = fraction;
-      if (fraction >= 1) close();
-      continue;
-    }
-    if (openWidth + fraction > 1.0001) close();
-    if (!open) {
-      open = { fields: [q.field], step: q.step };
-      openWidth = fraction;
-      continue;
-    }
-    open.fields.push(q.field);
-    openWidth += fraction;
-  }
-  close();
-  return views;
-}
-function countStageViews(config) {
-  return stageViews(config).length;
-}
-function countStageQuestions(config) {
-  return stageQuestions(config).length;
-}
-function stageEstimate(questionCount) {
-  const seconds = questionCount * 8;
-  if (seconds < 50) return `about ${Math.max(15, Math.ceil(seconds / 5) * 5)} seconds`;
-  if (seconds <= 90) return "about a minute";
-  return `about ${Math.round(seconds / 60)} minutes`;
-}
-function stageFirstName(value) {
-  if (typeof value !== "string") return null;
-  const token = value.trim().split(/\s+/)[0];
-  if (!token || token.length > 24) return null;
-  return token;
-}
-function formatAnswer(value) {
-  if (isEmptyValue(value)) return null;
-  if (Array.isArray(value)) return value.map(String).join(", ");
-  if (typeof value === "boolean") return value ? "Yes" : "No";
-  return String(value);
-}
-var AUTO_ADVANCE_TYPES = ["radio", "select", "rating"];
-
-export { AUTO_ADVANCE_TYPES, countStageQuestions, countStageViews, formatAnswer, stageEstimate, stageFirstName, stageViews, useFieldControls };
-//# sourceMappingURL=chunk-KOPFFKG2.mjs.map
-//# sourceMappingURL=chunk-KOPFFKG2.mjs.map

package/dist/chunk-KOPFFKG2.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/forms/field-controls.ts","../src/forms/experience-plan.ts"],"names":[],"mappings":";;;AAqCA,IAAM,cAA6B,EAAC;AAE7B,SAAS,iBAAiB,MAAA,EAAoD;AACnF,EAAA,MAAM,SAAA,GAAY,OAAA;AAAA,IAChB,MAAA,CAAO,MAAA,IAAU,EAAC,EAAG,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,KAAe,MAAA,IAAU,CAAA,CAAE,UAAA,KAAe,UAAU,CAAA;AAAA,IACvF,CAAC,MAAM;AAAA,GACT;AACA,EAAA,MAAM,SAAA,GAAY,OAAA;AAAA,IAChB,MAAA,CAAO,UAAU,EAAC,EAAG,KAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,KAAe,MAAM,CAAA;AAAA,IACxD,CAAC,MAAM;AAAA,GACT;AAEA,EAAA,MAAM,CAAC,QAAA,EAAU,WAAW,CAAA,GAAI,SAAwB,WAAW,CAAA;AAEnE,EAAA,MAAM,YAAY,MAAA,CAAO,EAAE,MAAM,KAAA,EAAO,IAAA,EAAM,OAAO,CAAA;AAErD,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,SAAA,GAAY,KAAA;AAEhB,IAAA,IAAI,SAAA,IAAa,CAAC,SAAA,CAAU,OAAA,CAAQ,IAAA,EAAM;AACxC,MAAA,SAAA,CAAU,QAAQ,IAAA,GAAO,IAAA;AACzB,MAAA,OAAO,2BAAc,CAAA,CAClB,IAAA,CAAK,CAAC,CAAA,KAAM;AACX,QAAA,IAAI,CAAC,SAAA,EAAW,WAAA,CAAY,CAAC,IAAA,MAAU,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,CAAA,CAAE,UAAA,EAAW,CAAE,CAAA;AAAA,MACzE,CAAC,CAAA,CACA,KAAA,CAAM,MAAM;AAGX,QAAA,SAAA,CAAU,QAAQ,IAAA,GAAO,KAAA;AAAA,MAC3B,CAAC,CAAA;AAAA,IACL;AAEA,IAAA,IAAI,SAAA,IAAa,CAAC,SAAA,CAAU,OAAA,CAAQ,IAAA,EAAM;AACxC,MAAA,SAAA,CAAU,QAAQ,IAAA,GAAO,IAAA;AACzB,MAAA,OAAO,0BAAa,CAAA,CACjB,IAAA,CAAK,CAAC,CAAA,KAAM;AACX,QAAA,IAAI,CAAC,SAAA,EAAW,WAAA,CAAY,CAAC,IAAA,MAAU,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,CAAA,CAAE,SAAA,EAAU,CAAE,CAAA;AAAA,MACxE,CAAC,CAAA,CACA,KAAA,CAAM,MAAM;AACX,QAAA,SAAA,CAAU,QAAQ,IAAA,GAAO,KAAA;AAAA,MAC3B,CAAC,CAAA;AAAA,IACL;AAEA,IAAA,OAAO,MAAM;AACX,MAAA,SAAA,GAAY,IAAA;AAAA,IACd,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,SAAA,EAAW,SAAS,CAAC,CAAA;AAEzB,EAAA,OAAO,QAAA;AACT;;;ACrDO,SAAS,eAAe,MAAA,EAA4C;AACzE,EAAA,MAAM,KAAA,GAAA,CAAS,MAAA,CAAO,MAAA,IAAU,EAAC,EAAG,MAAA;AAAA,IAClC,CAAC,CAAA,KAAM,CAAC,aAAA,CAAc,CAAC;AAAA,GACzB;AACA,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,IAAiB,CAAC,MAAA,CAAO,OAAO,MAAA,EAAQ;AAClD,IAAA,OAAO,MAAM,GAAA,CAAI,CAAC,KAAA,MAAW,EAAE,OAAM,CAAE,CAAA;AAAA,EACzC;AACA,EAAA,MAAM,OAAA,GAAU,CAAC,GAAG,MAAA,CAAO,KAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,WAAA,GAAc,EAAE,WAAW,CAAA;AAC9E,EAAA,MAAM,MAAuB,EAAC;AAC9B,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAY;AAChC,EAAA,KAAA,MAAW,QAAQ,OAAA,EAAS;AAC1B,IAAA,KAAA,MAAW,SAAS,KAAA,EAAO;AACzB,MAAA,IAAI,KAAA,CAAM,OAAA,KAAY,IAAA,CAAK,EAAA,EAAI;AAC7B,QAAA,GAAA,CAAI,IAAA,CAAK,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AACxB,QAAA,OAAA,CAAQ,GAAA,CAAI,MAAM,EAAE,CAAA;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AACA,EAAA,KAAA,MAAW,SAAS,KAAA,EAAO;AACzB,IAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,EAAE,GAAG,GAAA,CAAI,IAAA,CAAK,EAAE,KAAA,EAAO,CAAA;AAAA,EAChD;AACA,EAAA,OAAO,GAAA;AACT;AAEA,IAAM,cAAA,GAAyC;AAAA,EAC7C,IAAA,EAAM,CAAA;AAAA,EACN,MAAM,CAAA,GAAI,CAAA;AAAA,EACV,OAAO,CAAA,GAAI,CAAA;AAAA,EACX,SAAS,CAAA,GAAI;AACf,CAAA;AAQO,SAAS,WAAW,MAAA,EAAwC;AACjE,EAAA,MAAM,SAAA,GAAY,eAAe,MAAM,CAAA;AACvC,EAAA,MAAM,QAAqB,EAAC;AAC5B,EAAA,IAAI,IAAA,GAAyB,IAAA;AAC7B,EAAA,IAAI,SAAA,GAAY,CAAA;AAEhB,EAAA,MAAM,QAAQ,MAAM;AAClB,IAAA,IAAI,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AACzB,IAAA,IAAA,GAAO,IAAA;AACP,IAAA,SAAA,GAAY,CAAA;AAAA,EACd,CAAA;AAEA,EAAA,KAAA,MAAW,KAAK,SAAA,EAAW;AACzB,IAAA,MAAM,QAAA,GAAW,cAAA,CAAe,CAAA,CAAE,KAAA,CAAM,KAAK,CAAA,IAAK,CAAA;AAClD,IAAA,MAAM,iBAAiB,IAAA,IAAQ,IAAA,CAAK,IAAA,EAAM,EAAA,KAAO,EAAE,IAAA,EAAM,EAAA;AACzD,IAAA,IAAI,QAAA,IAAY,CAAA,IAAK,cAAA,EAAgB,KAAA,EAAM;AAC3C,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,IAAA,GAAO,EAAE,QAAQ,CAAC,CAAA,CAAE,KAAK,CAAA,EAAG,IAAA,EAAM,EAAE,IAAA,EAAK;AACzC,MAAA,SAAA,GAAY,QAAA;AACZ,MAAA,IAAI,QAAA,IAAY,GAAG,KAAA,EAAM;AACzB,MAAA;AAAA,IACF;AACA,IAAA,IAAI,SAAA,GAAY,QAAA,GAAW,MAAA,EAAQ,KAAA,EAAM;AACzC,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,IAAA,GAAO,EAAE,QAAQ,CAAC,CAAA,CAAE,KAAK,CAAA,EAAG,IAAA,EAAM,EAAE,IAAA,EAAK;AACzC,MAAA,SAAA,GAAY,QAAA;AACZ,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAA,CAAE,KAAK,CAAA;AACxB,IAAA,SAAA,IAAa,QAAA;AAAA,EACf;AACA,EAAA,KAAA,EAAM;AACN,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,gBAAgB,MAAA,EAAmC;AACjE,EAAA,OAAO,UAAA,CAAW,MAAM,CAAA,CAAE,MAAA;AAC5B;AAEO,SAAS,oBAAoB,MAAA,EAAmC;AACrE,EAAA,OAAO,cAAA,CAAe,MAAM,CAAA,CAAE,MAAA;AAChC;AAMO,SAAS,cAAc,aAAA,EAA+B;AAC3D,EAAA,MAAM,UAAU,aAAA,GAAgB,CAAA;AAChC,EAAA,IAAI,OAAA,GAAU,EAAA,EAAI,OAAO,CAAA,MAAA,EAAS,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,IAAA,CAAK,IAAA,CAAK,OAAA,GAAU,CAAC,CAAA,GAAI,CAAC,CAAC,CAAA,QAAA,CAAA;AAC1E,EAAA,IAAI,OAAA,IAAW,IAAI,OAAO,gBAAA;AAC1B,EAAA,OAAO,CAAA,MAAA,EAAS,IAAA,CAAK,KAAA,CAAM,OAAA,GAAU,EAAE,CAAC,CAAA,QAAA,CAAA;AAC1C;AAGO,SAAS,eAAe,KAAA,EAA+B;AAC5D,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,IAAA;AACtC,EAAA,MAAM,QAAQ,KAAA,CAAM,IAAA,GAAO,KAAA,CAAM,KAAK,EAAE,CAAC,CAAA;AACzC,EAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,MAAA,GAAS,IAAI,OAAO,IAAA;AACxC,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,aAAa,KAAA,EAA+B;AAC1D,EAAA,IAAI,YAAA,CAAa,KAAK,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,OAAO,MAAM,GAAA,CAAI,MAAM,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AAC5D,EAAA,IAAI,OAAO,KAAA,KAAU,SAAA,EAAW,OAAO,QAAQ,KAAA,GAAQ,IAAA;AACvD,EAAA,OAAO,OAAO,KAAK,CAAA;AACrB;AAGO,IAAM,kBAAA,GAAqB,CAAC,OAAA,EAAS,QAAA,EAAU,QAAQ","file":"chunk-KOPFFKG2.mjs","sourcesContent":["'use client'\n\n/**\n * The field controls that need React hooks, loaded only when a form actually\n * has a field that uses them.\n *\n * FormField deliberately does NOT import these. DatePicker carries 17 hooks\n * and FileField holds upload state; importing them there put both in\n * FormField's chunk, which the build stamps `'use client'` — so a Server\n * Component rendering a single text input shipped 38 KB of date picker to the\n * browser. Injecting them from the client side keeps FormField hook-free and\n * therefore server-renderable, which is the whole basis of StaticForm.\n *\n * Injection alone still put both controls in the forms entry's eager graph,\n * because a module-level constant referencing them is a static import: every\n * form paid for the date picker, and most forms have no date field. They are\n * now fetched on demand, per control, from the field list.\n *\n * The wait costs nothing visually. FormField already renders the native\n * control when a control is absent (static mode does exactly this), so a date\n * field paints as `<input type=\"date\">` and upgrades in place when the chunk\n * lands — the same enhancement path a no-JS visitor never leaves.\n *\n * Every client renderer of <FormField> (FormClient, FormSpotlight, FormStage)\n * calls this hook, so the experiences and the classic form always offer\n * identical controls.\n */\n\nimport { useEffect, useMemo, useRef, useState } from 'react'\nimport type { FormField as FormFieldType } from './types'\n\nexport interface FieldControls {\n  Date?: React.ComponentType<any>\n  File?: React.ComponentType<any>\n}\n\n/** Stable identity for the common case (no date, no file) — no render churn. */\nconst NO_CONTROLS: FieldControls = {}\n\nexport function useFieldControls(fields: FormFieldType[] | undefined): FieldControls {\n  const needsDate = useMemo(\n    () => (fields ?? []).some((f) => f.field_type === 'date' || f.field_type === 'datetime'),\n    [fields],\n  )\n  const needsFile = useMemo(\n    () => (fields ?? []).some((f) => f.field_type === 'file'),\n    [fields],\n  )\n\n  const [controls, setControls] = useState<FieldControls>(NO_CONTROLS)\n  // Guards re-import when a conditional field toggles visibility mid-fill.\n  const requested = useRef({ date: false, file: false })\n\n  useEffect(() => {\n    let cancelled = false\n\n    if (needsDate && !requested.current.date) {\n      requested.current.date = true\n      import('./DatePicker')\n        .then((m) => {\n          if (!cancelled) setControls((prev) => ({ ...prev, Date: m.DatePicker }))\n        })\n        .catch(() => {\n          // Chunk never arrived — the native date input stays, which submits\n          // the same value. A failed fetch must not cost the lead.\n          requested.current.date = false\n        })\n    }\n\n    if (needsFile && !requested.current.file) {\n      requested.current.file = true\n      import('./FileField')\n        .then((m) => {\n          if (!cancelled) setControls((prev) => ({ ...prev, File: m.FileField }))\n        })\n        .catch(() => {\n          requested.current.file = false\n        })\n    }\n\n    return () => {\n      cancelled = true\n    }\n  }, [needsDate, needsFile])\n\n  return controls\n}\n","/**\n * Shared planning helpers for the alternate form experiences (stage,\n * spotlight). Pure data — no React, no CSS — so FormClient can import the\n * counts it needs for tracking WITHOUT pulling an experience component (and\n * its stylesheet) into every site's forms bundle. The components themselves\n * are lazy-loaded; this module is the only part that ships eagerly.\n */\n\nimport type {\n  FormField as FormFieldType,\n  FormStep,\n  ManagedFormConfig,\n} from './types'\n// Display-only types are never staged; what counts as empty is shared with\n// validation. Both live in field-rules.ts.\nimport { isDisplayOnly, isEmptyValue } from './field-rules'\n\nexport interface StageQuestion {\n  field: FormFieldType\n  /** The step (chapter) this question belongs to, when the form is multi-step. */\n  step?: FormStep\n}\n\nexport interface StageView {\n  fields: FormFieldType[]\n  step?: FormStep\n}\n\n/**\n * Flatten a form into its ordered question list. Steps become chapters:\n * multi-step forms iterate steps in step_number order (fields are already\n * sorted by sort_order via normalizeFormConfig); stepless fields trail.\n */\nexport function stageQuestions(config: ManagedFormConfig): StageQuestion[] {\n  const input = (config.fields || []).filter(\n    (f) => !isDisplayOnly(f),\n  )\n  if (!config.is_multi_step || !config.steps?.length) {\n    return input.map((field) => ({ field }))\n  }\n  const ordered = [...config.steps].sort((a, b) => a.step_number - b.step_number)\n  const out: StageQuestion[] = []\n  const claimed = new Set<string>()\n  for (const step of ordered) {\n    for (const field of input) {\n      if (field.step_id === step.id) {\n        out.push({ field, step })\n        claimed.add(field.id)\n      }\n    }\n  }\n  for (const field of input) {\n    if (!claimed.has(field.id)) out.push({ field })\n  }\n  return out\n}\n\nconst WIDTH_FRACTION: Record<string, number> = {\n  full: 1,\n  half: 1 / 2,\n  third: 1 / 3,\n  quarter: 1 / 4,\n}\n\n/**\n * Group questions into beats using the classic grid's own row math:\n * consecutive sub-full-width fields fill a row (2 halves, 3 thirds...) and\n * that row is one beat; a full-width field closes any open row and stands\n * alone; a chapter change always starts a fresh beat.\n */\nexport function stageViews(config: ManagedFormConfig): StageView[] {\n  const questions = stageQuestions(config)\n  const views: StageView[] = []\n  let open: StageView | null = null\n  let openWidth = 0\n\n  const close = () => {\n    if (open) views.push(open)\n    open = null\n    openWidth = 0\n  }\n\n  for (const q of questions) {\n    const fraction = WIDTH_FRACTION[q.field.width] ?? 1\n    const chapterChanged = open && open.step?.id !== q.step?.id\n    if (fraction >= 1 || chapterChanged) close()\n    if (!open) {\n      open = { fields: [q.field], step: q.step }\n      openWidth = fraction\n      if (fraction >= 1) close()\n      continue\n    }\n    if (openWidth + fraction > 1.0001) close()\n    if (!open) {\n      open = { fields: [q.field], step: q.step }\n      openWidth = fraction\n      continue\n    }\n    open.fields.push(q.field)\n    openWidth += fraction\n  }\n  close()\n  return views\n}\n\nexport function countStageViews(config: ManagedFormConfig): number {\n  return stageViews(config).length\n}\n\nexport function countStageQuestions(config: ManagedFormConfig): number {\n  return stageQuestions(config).length\n}\n\n/**\n * Honest, friendly time estimate: \"about 40 seconds\".\n * ~8s per question, rounded to something a human would actually say.\n */\nexport function stageEstimate(questionCount: number): string {\n  const seconds = questionCount * 8\n  if (seconds < 50) return `about ${Math.max(15, Math.ceil(seconds / 5) * 5)} seconds`\n  if (seconds <= 90) return 'about a minute'\n  return `about ${Math.round(seconds / 60)} minutes`\n}\n\n/** First name for the greeting — conservative: short, single token, else null. */\nexport function stageFirstName(value: unknown): string | null {\n  if (typeof value !== 'string') return null\n  const token = value.trim().split(/\\s+/)[0]\n  if (!token || token.length > 24) return null\n  return token\n}\n\nexport function formatAnswer(value: unknown): string | null {\n  if (isEmptyValue(value)) return null\n  if (Array.isArray(value)) return value.map(String).join(', ')\n  if (typeof value === 'boolean') return value ? 'Yes' : 'No'\n  return String(value)\n}\n\n/** Single-select types where picking an answer advances after a lock-in beat. */\nexport const AUTO_ADVANCE_TYPES = ['radio', 'select', 'rating']\n"]}

package/dist/chunk-KP5BFPGT.js

@@ -1,44 +0,0 @@
-'use strict';
-
-// src/proxy/securityHeaders.ts
-var DEFAULT_FRAME_ANCESTORS = [
-  "'self'",
-  "https://upforge.io",
-  "https://*.upforge.io",
-  "https://upforgelabs.com",
-  "https://*.upforgelabs.com"
-];
-function buildSecurityHeaders(config) {
-  if (config === false) return {};
-  const c = typeof config === "object" ? config : {};
-  const headers = {};
-  if (c.dnsPrefetchControl !== false) {
-    headers["X-DNS-Prefetch-Control"] = "on";
-  }
-  const frameAncestors = c.frameAncestors === false ? null : c.frameAncestors && c.frameAncestors.length > 0 ? c.frameAncestors : DEFAULT_FRAME_ANCESTORS;
-  if (frameAncestors) {
-    headers["Content-Security-Policy"] = `frame-ancestors ${frameAncestors.join(" ")}`;
-    if (c.frameOptions) {
-      headers["X-Frame-Options"] = c.frameOptions;
-    }
-  } else if (c.frameOptions !== false) {
-    headers["X-Frame-Options"] = c.frameOptions || "DENY";
-  }
-  if (c.contentTypeOptions !== false) {
-    headers["X-Content-Type-Options"] = "nosniff";
-  }
-  if (c.xssProtection !== false) {
-    headers["X-XSS-Protection"] = "1; mode=block";
-  }
-  headers["Referrer-Policy"] = c.referrerPolicy || "strict-origin-when-cross-origin";
-  headers["Permissions-Policy"] = c.permissionsPolicy || "camera=(), microphone=(), geolocation=()";
-  if (c.customHeaders) {
-    Object.assign(headers, c.customHeaders);
-  }
-  return headers;
-}
-
-exports.DEFAULT_FRAME_ANCESTORS = DEFAULT_FRAME_ANCESTORS;
-exports.buildSecurityHeaders = buildSecurityHeaders;
-//# sourceMappingURL=chunk-KP5BFPGT.js.map
-//# sourceMappingURL=chunk-KP5BFPGT.js.map

package/dist/chunk-KP5BFPGT.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/proxy/securityHeaders.ts"],"names":[],"mappings":";;;AAmCO,IAAM,uBAAA,GAA0B;AAAA,EACrC,QAAA;AAAA,EACA,oBAAA;AAAA,EACA,sBAAA;AAAA,EACA,yBAAA;AAAA,EACA;AACF;AAiCO,SAAS,qBACd,MAAA,EACwB;AACxB,EAAA,IAAI,MAAA,KAAW,KAAA,EAAO,OAAO,EAAC;AAE9B,EAAA,MAAM,CAAA,GACJ,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,EAAC;AAEzC,EAAA,MAAM,UAAkC,EAAC;AAGzC,EAAA,IAAI,CAAA,CAAE,uBAAuB,KAAA,EAAO;AAClC,IAAA,OAAA,CAAQ,wBAAwB,CAAA,GAAI,IAAA;AAAA,EACtC;AAUA,EAAA,MAAM,cAAA,GACJ,CAAA,CAAE,cAAA,KAAmB,KAAA,GACjB,IAAA,GACA,CAAA,CAAE,cAAA,IAAkB,CAAA,CAAE,cAAA,CAAe,MAAA,GAAS,CAAA,GAC5C,CAAA,CAAE,cAAA,GACF,uBAAA;AAER,EAAA,IAAI,cAAA,EAAgB;AAClB,IAAA,OAAA,CAAQ,yBAAyB,CAAA,GAC/B,CAAA,gBAAA,EAAmB,cAAA,CAAe,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA;AAE7C,IAAA,IAAI,EAAE,YAAA,EAAc;AAClB,MAAA,OAAA,CAAQ,iBAAiB,IAAI,CAAA,CAAE,YAAA;AAAA,IACjC;AAAA,EACF,CAAA,MAAA,IAAW,CAAA,CAAE,YAAA,KAAiB,KAAA,EAAO;AACnC,IAAA,OAAA,CAAQ,iBAAiB,CAAA,GAAI,CAAA,CAAE,YAAA,IAAgB,MAAA;AAAA,EACjD;AAGA,EAAA,IAAI,CAAA,CAAE,uBAAuB,KAAA,EAAO;AAClC,IAAA,OAAA,CAAQ,wBAAwB,CAAA,GAAI,SAAA;AAAA,EACtC;AAGA,EAAA,IAAI,CAAA,CAAE,kBAAkB,KAAA,EAAO;AAC7B,IAAA,OAAA,CAAQ,kBAAkB,CAAA,GAAI,eAAA;AAAA,EAChC;AAGA,EAAA,OAAA,CAAQ,iBAAiB,CAAA,GACvB,CAAA,CAAE,cAAA,IAAkB,iCAAA;AAGtB,EAAA,OAAA,CAAQ,oBAAoB,CAAA,GAC1B,CAAA,CAAE,iBAAA,IAAqB,0CAAA;AAGzB,EAAA,IAAI,EAAE,aAAA,EAAe;AACnB,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,EAAS,CAAA,CAAE,aAAa,CAAA;AAAA,EACxC;AAEA,EAAA,OAAO,OAAA;AACT","file":"chunk-KP5BFPGT.js","sourcesContent":["/**\n * Default security headers applied by site-kit middleware.\n *\n * These match industry best practices and are the same headers\n * recommended by Next.js documentation. All are opt-out.\n */\n\n/**\n * Single source of truth for who may frame a site-kit site.\n *\n * Upforge showcases live client work inside iframes on its portfolio /\n * area pages, so every managed marketing site has to be embeddable from\n * the Upforge showcase origins. `X-Frame-Options` cannot express an\n * allowlist (`ALLOW-FROM` is dead and ignored by every current browser),\n * so the CSP `frame-ancestors` directive is the only way to say \"these\n * origins and nobody else\". Everything not listed here is still blocked.\n *\n * upforgelabs.com is a SEPARATE APEX DOMAIN, not a subdomain of\n * upforge.io, so `https://*.upforge.io` does not cover it and never did.\n * Labs case studies embed three live client frames each; without this\n * entry every one of them is refused with ERR_BLOCKED_BY_RESPONSE.\n *\n * upforgeapps.com is deliberately NOT here. It is a third Upforge apex,\n * but it only *links* to case studies (`upforge.io/work/<slug>`, see its\n * `lib/proof.ts`) and frames no client site anywhere. An origin earns a\n * place on this list by embedding, not by belonging to Upforge; adding a\n * non-embedder would hand out framing rights nothing needs. Re-check that\n * before adding it.\n *\n * Do NOT re-fork this list into individual sites' proxy/middleware/\n * next.config/netlify.toml/_headers — a fork is a copy that stops\n * tracking this one, which is exactly how upforgelabs.com came to be\n * missing from ten sites' allowlists at once. Add origins HERE and let\n * the fleet inherit them on its next deploy.\n */\nexport const DEFAULT_FRAME_ANCESTORS = [\n  \"'self'\",\n  'https://upforge.io',\n  'https://*.upforge.io',\n  'https://upforgelabs.com',\n  'https://*.upforgelabs.com',\n]\n\nexport interface SecurityHeadersConfig {\n  /** X-Frame-Options value. false to disable. Default: omitted when\n   * `frameAncestors` is active (the two conflict), otherwise 'DENY'. */\n  frameOptions?: 'DENY' | 'SAMEORIGIN' | false\n  /**\n   * Origins allowed to frame this site, emitted as a CSP `frame-ancestors`\n   * directive. Defaults to {@link DEFAULT_FRAME_ANCESTORS} ('self' + upforge.io)\n   * so Upforge can showcase the site. Pass an array to extend/replace, or\n   * `false` to opt out entirely and fall back to X-Frame-Options.\n   *\n   * Ignored if a `Content-Security-Policy` is supplied via `customHeaders` —\n   * that CSP wins, and must carry its own frame-ancestors directive.\n   */\n  frameAncestors?: string[] | false\n  /** X-Content-Type-Options: nosniff. Default: true */\n  contentTypeOptions?: boolean\n  /** X-XSS-Protection header. Default: true */\n  xssProtection?: boolean\n  /** Referrer-Policy value. Default: 'strict-origin-when-cross-origin' */\n  referrerPolicy?: string\n  /** Permissions-Policy value. Default restricts camera, microphone, geolocation */\n  permissionsPolicy?: string\n  /** X-DNS-Prefetch-Control. Default: true (on) */\n  dnsPrefetchControl?: boolean\n  /** Additional custom headers */\n  customHeaders?: Record<string, string>\n}\n\n/**\n * Build a flat Record of header name → value from the config.\n */\nexport function buildSecurityHeaders(\n  config?: SecurityHeadersConfig | boolean,\n): Record<string, string> {\n  if (config === false) return {}\n\n  const c: SecurityHeadersConfig =\n    typeof config === 'object' ? config : {}\n\n  const headers: Record<string, string> = {}\n\n  // X-DNS-Prefetch-Control\n  if (c.dnsPrefetchControl !== false) {\n    headers['X-DNS-Prefetch-Control'] = 'on'\n  }\n\n  // Framing policy — CSP frame-ancestors is the allowlist mechanism;\n  // X-Frame-Options is only a fallback for the opted-out case.\n  //\n  // These two headers MUST NOT both be emitted: X-Frame-Options has no\n  // allowlist form, so a stray `DENY`/`SAMEORIGIN` alongside a permissive\n  // frame-ancestors is honoured by some browsers and silently re-blocks the\n  // embed. So when frame-ancestors is active we drop XFO unless the site\n  // explicitly asked for a value.\n  const frameAncestors =\n    c.frameAncestors === false\n      ? null\n      : c.frameAncestors && c.frameAncestors.length > 0\n        ? c.frameAncestors\n        : DEFAULT_FRAME_ANCESTORS\n\n  if (frameAncestors) {\n    headers['Content-Security-Policy'] =\n      `frame-ancestors ${frameAncestors.join(' ')}`\n    // Only honour an explicitly-requested XFO value here.\n    if (c.frameOptions) {\n      headers['X-Frame-Options'] = c.frameOptions\n    }\n  } else if (c.frameOptions !== false) {\n    headers['X-Frame-Options'] = c.frameOptions || 'DENY'\n  }\n\n  // X-Content-Type-Options\n  if (c.contentTypeOptions !== false) {\n    headers['X-Content-Type-Options'] = 'nosniff'\n  }\n\n  // X-XSS-Protection\n  if (c.xssProtection !== false) {\n    headers['X-XSS-Protection'] = '1; mode=block'\n  }\n\n  // Referrer-Policy\n  headers['Referrer-Policy'] =\n    c.referrerPolicy || 'strict-origin-when-cross-origin'\n\n  // Permissions-Policy\n  headers['Permissions-Policy'] =\n    c.permissionsPolicy || 'camera=(), microphone=(), geolocation=()'\n\n  // Custom headers\n  if (c.customHeaders) {\n    Object.assign(headers, c.customHeaders)\n  }\n\n  return headers\n}\n"]}

package/dist/chunk-KR7ATPAN.js

@@ -1,52 +0,0 @@
-'use strict';
-
-// src/articles/processArticleHtml.ts
-function linkClassificationHost(siteUrl) {
-  try {
-    const base = siteUrl.startsWith("http") ? siteUrl : `https://${siteUrl}`;
-    const u = new URL(base);
-    return u.hostname.replace(/^www\./i, "").toLowerCase();
-  } catch {
-    return "";
-  }
-}
-var normalizeSiteHost = linkClassificationHost;
-function resolvePublicationSiteUrl(explicit) {
-  const fromProp = explicit?.trim();
-  if (fromProp) return fromProp;
-  const next = process.env.NEXT_PUBLIC_SITE_URL?.trim();
-  if (next) return next;
-  const site = process.env.SITE_URL?.trim();
-  if (site) return site;
-  const vercel = process.env.VERCEL_URL?.trim();
-  if (vercel) return vercel.startsWith("http") ? vercel : `https://${vercel}`;
-  return "";
-}
-function addExternalLinkTargets(html, siteUrl) {
-  if (!html || !siteUrl) return html;
-  const siteHost = linkClassificationHost(siteUrl);
-  if (!siteHost) return html;
-  return html.replace(/<a\b([^>]*)>/gi, (_full, attrs) => {
-    const hrefMatch = attrs.match(/\bhref\s*=\s*(["'])([^"']*)\1/i);
-    if (!hrefMatch) return `<a${attrs}>`;
-    const href = hrefMatch[2].trim();
-    if (!/^https?:\/\//i.test(href)) return `<a${attrs}>`;
-    try {
-      const url = new URL(href);
-      const linkHost = url.hostname.replace(/^www\./i, "").toLowerCase();
-      if (linkHost === siteHost) return `<a${attrs}>`;
-      if (/\btarget\s*=/i.test(attrs)) return `<a${attrs}>`;
-      const trimmed = attrs.trim();
-      return `<a ${trimmed} target="_blank" rel="noopener noreferrer">`;
-    } catch {
-      return `<a${attrs}>`;
-    }
-  });
-}
-
-exports.addExternalLinkTargets = addExternalLinkTargets;
-exports.linkClassificationHost = linkClassificationHost;
-exports.normalizeSiteHost = normalizeSiteHost;
-exports.resolvePublicationSiteUrl = resolvePublicationSiteUrl;
-//# sourceMappingURL=chunk-KR7ATPAN.js.map
-//# sourceMappingURL=chunk-KR7ATPAN.js.map

package/dist/chunk-KR7ATPAN.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/articles/processArticleHtml.ts"],"names":[],"mappings":";;;AAgBO,SAAS,uBAAuB,OAAA,EAAyB;AAC9D,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,OAAA,CAAQ,UAAA,CAAW,MAAM,CAAA,GAAI,OAAA,GAAU,WAAW,OAAO,CAAA,CAAA;AACtE,IAAA,MAAM,CAAA,GAAI,IAAI,GAAA,CAAI,IAAI,CAAA;AACtB,IAAA,OAAO,EAAE,QAAA,CAAS,OAAA,CAAQ,SAAA,EAAW,EAAE,EAAE,WAAA,EAAY;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAA;AAAA,EACT;AACF;AAQO,IAAM,iBAAA,GAAoB;AAM1B,SAAS,0BAA0B,QAAA,EAA2B;AACnE,EAAA,MAAM,QAAA,GAAW,UAAU,IAAA,EAAK;AAChC,EAAA,IAAI,UAAU,OAAO,QAAA;AACrB,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,oBAAA,EAAsB,IAAA,EAAK;AACpD,EAAA,IAAI,MAAM,OAAO,IAAA;AACjB,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,QAAA,EAAU,IAAA,EAAK;AACxC,EAAA,IAAI,MAAM,OAAO,IAAA;AACjB,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,UAAA,EAAY,IAAA,EAAK;AAC5C,EAAA,IAAI,MAAA,SAAe,MAAA,CAAO,UAAA,CAAW,MAAM,CAAA,GAAI,MAAA,GAAS,WAAW,MAAM,CAAA,CAAA;AACzE,EAAA,OAAO,EAAA;AACT;AAOO,SAAS,sBAAA,CAAuB,MAAc,OAAA,EAAyB;AAC5E,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,OAAA,EAAS,OAAO,IAAA;AAC9B,EAAA,MAAM,QAAA,GAAW,uBAAuB,OAAO,CAAA;AAC/C,EAAA,IAAI,CAAC,UAAU,OAAO,IAAA;AAEtB,EAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,gBAAA,EAAkB,CAAC,OAAO,KAAA,KAAkB;AAC9D,IAAA,MAAM,SAAA,GAAY,KAAA,CAAM,KAAA,CAAM,gCAAgC,CAAA;AAC9D,IAAA,IAAI,CAAC,SAAA,EAAW,OAAO,CAAA,EAAA,EAAK,KAAK,CAAA,CAAA,CAAA;AACjC,IAAA,MAAM,IAAA,GAAO,SAAA,CAAU,CAAC,CAAA,CAAE,IAAA,EAAK;AAC/B,IAAA,IAAI,CAAC,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,KAAK,KAAK,CAAA,CAAA,CAAA;AAElD,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAI,CAAA;AACxB,MAAA,MAAM,WAAW,GAAA,CAAI,QAAA,CAAS,QAAQ,SAAA,EAAW,EAAE,EAAE,WAAA,EAAY;AACjE,MAAA,IAAI,QAAA,KAAa,QAAA,EAAU,OAAO,CAAA,EAAA,EAAK,KAAK,CAAA,CAAA,CAAA;AAC5C,MAAA,IAAI,gBAAgB,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,KAAK,KAAK,CAAA,CAAA,CAAA;AAClD,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,EAAK;AAC3B,MAAA,OAAO,MAAM,OAAO,CAAA,2CAAA,CAAA;AAAA,IACtB,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAK,KAAK,CAAA,CAAA,CAAA;AAAA,IACnB;AAAA,EACF,CAAC,CAAA;AACH","file":"chunk-KR7ATPAN.js","sourcesContent":["/**\n * Post-process Portal/article HTML for safe, consistent link behavior.\n * Server-safe string transforms only (no DOM).\n */\n\n/**\n * The host `addExternalLinkTargets` compares links against to decide whether a\n * link is internal (same tab) or external (`target=\"_blank\"`). Lowercased,\n * leading `www.` stripped, so `www.example.com` and `example.com` count as the\n * same site; returns '' for anything unparseable.\n *\n * NOT the multi-site host normalizer. That is `normalizeSiteHost` in\n * `sites/normalize`, which keeps `www.` because `www.example.com` and\n * `example.com` can be different sub-sites of one Sonor project. This used to\n * share that name, so the two were easy to swap by accident.\n */\nexport function linkClassificationHost(siteUrl: string): string {\n  try {\n    const base = siteUrl.startsWith('http') ? siteUrl : `https://${siteUrl}`\n    const u = new URL(base)\n    return u.hostname.replace(/^www\\./i, '').toLowerCase()\n  } catch {\n    return ''\n  }\n}\n\n/**\n * @deprecated Renamed to {@link linkClassificationHost} (same behavior: strips\n * `www.`). It shared a name with the multi-site `normalizeSiteHost` from\n * `sites/normalize`, which keeps `www.`. Kept so existing imports from\n * `@sonordev/site-kit/articles` still work.\n */\nexport const normalizeSiteHost = linkClassificationHost\n\n/**\n * Resolve canonical site URL for link classification.\n * Pass `explicit` from props when env vars are not set (e.g. non-Vercel hosts).\n */\nexport function resolvePublicationSiteUrl(explicit?: string): string {\n  const fromProp = explicit?.trim()\n  if (fromProp) return fromProp\n  const next = process.env.NEXT_PUBLIC_SITE_URL?.trim()\n  if (next) return next\n  const site = process.env.SITE_URL?.trim()\n  if (site) return site\n  const vercel = process.env.VERCEL_URL?.trim()\n  if (vercel) return vercel.startsWith('http') ? vercel : `https://${vercel}`\n  return ''\n}\n\n/**\n * Add `target=\"_blank\"` and `rel=\"noopener noreferrer\"` to external http(s) links.\n * Same registrable host (with or without `www`) is treated as internal.\n * Skips anchors that already set `target`.\n */\nexport function addExternalLinkTargets(html: string, siteUrl: string): string {\n  if (!html || !siteUrl) return html\n  const siteHost = linkClassificationHost(siteUrl)\n  if (!siteHost) return html\n\n  return html.replace(/<a\\b([^>]*)>/gi, (_full, attrs: string) => {\n    const hrefMatch = attrs.match(/\\bhref\\s*=\\s*([\"'])([^\"']*)\\1/i)\n    if (!hrefMatch) return `<a${attrs}>`\n    const href = hrefMatch[2].trim()\n    if (!/^https?:\\/\\//i.test(href)) return `<a${attrs}>`\n\n    try {\n      const url = new URL(href)\n      const linkHost = url.hostname.replace(/^www\\./i, '').toLowerCase()\n      if (linkHost === siteHost) return `<a${attrs}>`\n      if (/\\btarget\\s*=/i.test(attrs)) return `<a${attrs}>`\n      const trimmed = attrs.trim()\n      return `<a ${trimmed} target=\"_blank\" rel=\"noopener noreferrer\">`\n    } catch {\n      return `<a${attrs}>`\n    }\n  })\n}\n"]}

package/dist/chunk-KZBDH5A3.js

@@ -1,130 +0,0 @@
-'use strict';
-
-var chunkLVGSOW2F_js = require('./chunk-LVGSOW2F.js');
-var chunkCIB3RHNZ_js = require('./chunk-CIB3RHNZ.js');
-require('server-only');
-
-var MINT_PATH = "/api/public/site-token";
-var MINT_TIMEOUT_MS = 4e3;
-var SITE_TOKEN_PREFIX = "st1.";
-var MINT_MAX_ATTEMPTS = 4;
-var MINT_BACKOFF_BASE_MS = 500;
-var MINT_BACKOFF_CAP_MS = 8e3;
-var cache = /* @__PURE__ */ new Map();
-var inflight = /* @__PURE__ */ new Map();
-var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-function retryDelayMs(res, attempt) {
-  const header = res?.headers?.get?.("retry-after");
-  if (header) {
-    const seconds = Number(header);
-    const ms = Number.isFinite(seconds) ? seconds * 1e3 : Date.parse(header) - Date.now();
-    if (Number.isFinite(ms) && ms > 0) return Math.min(ms, MINT_BACKOFF_CAP_MS);
-  }
-  return Math.min(MINT_BACKOFF_BASE_MS * 2 ** attempt, MINT_BACKOFF_CAP_MS);
-}
-var isRetryableStatus = (status) => status === 429 || status >= 500;
-function rawFallbackAllowed() {
-  return typeof process !== "undefined" && process.env?.SONOR_SITE_TOKEN_FALLBACK === "raw";
-}
-function failClosed(reason, rawKey, now) {
-  if (rawFallbackAllowed()) {
-    console.warn(
-      `[SiteKitLayout] Token mint failed (${reason}) and SONOR_SITE_TOKEN_FALLBACK=raw is set; injecting the RAW API KEY into page HTML. The key is publicly readable wherever this page is served \u2014 unset the escape hatch once the mint is healthy.`
-    );
-    cache.set(rawKey, { credential: rawKey, expiresAt: now + 6e4 });
-    return rawKey;
-  }
-  throw new Error(
-    `site-kit: could not mint a site token (${reason}). Refusing to publish the raw SONOR_API_KEY in page HTML, so this build fails instead. Check that the mint endpoint is reachable and the key is valid, then rebuild. To ship anyway \u2014 which publishes the project secret in public HTML \u2014 set SONOR_SITE_TOKEN_FALLBACK=raw.`
-  );
-}
-function isFrameworkSignal(err) {
-  if (!err || typeof err !== "object") return false;
-  const e = err;
-  if (e.digest === "DYNAMIC_SERVER_USAGE") return true;
-  if (e.code === "NEXT_STATIC_GEN_BAILOUT") return true;
-  if (typeof e.digest === "string" && e.digest.startsWith("NEXT_")) return true;
-  if (e.$$typeof === /* @__PURE__ */ Symbol.for("react.postpone")) return true;
-  return false;
-}
-async function resolveClientCredential(rawKey, apiUrl) {
-  if (!rawKey) return "";
-  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey;
-  const cached = cache.get(rawKey);
-  if (cached && cached.expiresAt > Date.now()) return cached.credential;
-  const pending = inflight.get(rawKey);
-  if (pending) return pending;
-  const request = mintWithRetry(rawKey, apiUrl);
-  inflight.set(rawKey, request);
-  try {
-    return await request;
-  } finally {
-    inflight.delete(rawKey);
-  }
-}
-async function mintWithRetry(rawKey, apiUrl) {
-  const base = (apiUrl || "https://api.sonor.io").replace(/\/+$/, "");
-  let lastReason = "unknown error";
-  for (let attempt = 0; attempt < MINT_MAX_ATTEMPTS; attempt++) {
-    let res = null;
-    try {
-      const { fn: fetchFn, unpatched } = chunkLVGSOW2F_js.resolveFetch();
-      res = await fetchFn(`${base}${MINT_PATH}`, {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-          "x-api-key": rawKey,
-          "x-sitekit-version": chunkCIB3RHNZ_js.SITE_KIT_VERSION
-        },
-        // Only meaningful on the fallback path, where a future Next stopped
-        // exposing `_nextOriginalFetch` and we're back on the patched fetch.
-        // `revalidate: false` is the one setting that neither bails out of static
-        // generation nor downgrades the route to ISR; a Data Cache entry is the
-        // lesser evil versus shipping the raw key again.
-        ...unpatched ? {} : { next: { revalidate: false } },
-        signal: typeof AbortSignal !== "undefined" && AbortSignal.timeout ? AbortSignal.timeout(MINT_TIMEOUT_MS) : void 0
-      });
-    } catch (err) {
-      if (isFrameworkSignal(err)) throw err;
-      lastReason = err instanceof Error ? err.message : "network error";
-      if (attempt < MINT_MAX_ATTEMPTS - 1) {
-        await sleep(retryDelayMs(null, attempt));
-        continue;
-      }
-      break;
-    }
-    if (res.ok) {
-      const data = await res.json().catch(() => null);
-      const token = data?.token;
-      const expiresIn = typeof data?.expiresIn === "number" ? data.expiresIn : 3600;
-      if (typeof token === "string" && token.startsWith(SITE_TOKEN_PREFIX)) {
-        cache.set(rawKey, {
-          credential: token,
-          expiresAt: Date.now() + Math.min(expiresIn * 1e3 / 2, 30 * 6e4)
-        });
-        return token;
-      }
-      lastReason = "mint returned no usable token";
-      break;
-    }
-    if (res.status === 404) {
-      cache.set(rawKey, { credential: rawKey, expiresAt: Date.now() + 6e4 });
-      return rawKey;
-    }
-    lastReason = `HTTP ${res.status}`;
-    if (isRetryableStatus(res.status) && attempt < MINT_MAX_ATTEMPTS - 1) {
-      const delay = retryDelayMs(res, attempt);
-      console.warn(
-        `[SiteKitLayout] Token mint returned ${res.status}; retrying in ${Math.round(delay)}ms (attempt ${attempt + 2}/${MINT_MAX_ATTEMPTS}).`
-      );
-      await sleep(delay);
-      continue;
-    }
-    break;
-  }
-  return failClosed(lastReason, rawKey, Date.now());
-}
-
-exports.resolveClientCredential = resolveClientCredential;
-//# sourceMappingURL=chunk-KZBDH5A3.js.map
-//# sourceMappingURL=chunk-KZBDH5A3.js.map

package/dist/chunk-KZBDH5A3.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/mint-site-token.ts"],"names":["resolveFetch","SITE_KIT_VERSION"],"mappings":";;;;;;AAgDA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAO1B,IAAM,iBAAA,GAAoB,CAAA;AAC1B,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,mBAAA,GAAsB,GAAA;AAM5B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAO1C,IAAM,QAAA,uBAAe,GAAA,EAA6B;AAElD,IAAM,KAAA,GAAQ,CAAC,EAAA,KAAe,IAAI,OAAA,CAAc,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAOxE,SAAS,YAAA,CAAa,KAAsB,OAAA,EAAyB;AACnE,EAAA,MAAM,MAAA,GAAS,GAAA,EAAK,OAAA,EAAS,GAAA,GAAM,aAAa,CAAA;AAChD,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,OAAA,GAAU,OAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GAC9B,OAAA,GAAU,GAAA,GACV,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,GAAI,IAAA,CAAK,GAAA,EAAI;AAClC,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,EAAE,CAAA,IAAK,EAAA,GAAK,GAAG,OAAO,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,mBAAmB,CAAA;AAAA,EAC5E;AACA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,oBAAA,GAAuB,CAAA,IAAK,SAAS,mBAAmB,CAAA;AAC1E;AAGA,IAAM,iBAAA,GAAoB,CAAC,MAAA,KAAmB,MAAA,KAAW,OAAO,MAAA,IAAU,GAAA;AAM1E,SAAS,kBAAA,GAA8B;AACrC,EAAA,OACE,OAAO,OAAA,KAAY,WAAA,IACnB,OAAA,CAAQ,KAAK,yBAAA,KAA8B,KAAA;AAE/C;AAEA,SAAS,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAgB,GAAA,EAAqB;AACvE,EAAA,IAAI,oBAAmB,EAAG;AACxB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,sCAAsC,MAAM,CAAA,uMAAA;AAAA,KAG9C;AACA,IAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,0CAA0C,MAAM,CAAA,uRAAA;AAAA,GAIlD;AACF;AAsBO,SAAS,kBAAkB,GAAA,EAAuB;AACvD,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AAC5C,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,sBAAA,EAAwB,OAAO,IAAA;AAChD,EAAA,IAAI,CAAA,CAAE,IAAA,KAAS,yBAAA,EAA2B,OAAO,IAAA;AACjD,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,EAAE,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,EAAG,OAAO,IAAA;AACzE,EAAA,IAAI,EAAE,QAAA,qBAAa,MAAA,CAAO,GAAA,CAAI,gBAAgB,GAAG,OAAO,IAAA;AACxD,EAAA,OAAO,KAAA;AACT;AAEA,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,UAAU,MAAA,CAAO,SAAA,GAAY,KAAK,GAAA,EAAI,SAAU,MAAA,CAAO,UAAA;AAG3D,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,SAAS,OAAO,OAAA;AAEpB,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AAC5C,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,OAAO,CAAA;AAC5B,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAA;AAAA,EACf,CAAA,SAAE;AACA,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,EACxB;AACF;AAEA,eAAe,aAAA,CAAc,QAAgB,MAAA,EAAiC;AAC5E,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI,UAAA,GAAa,eAAA;AAEjB,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,iBAAA,EAAmB,OAAA,EAAA,EAAW;AAC5D,IAAA,IAAI,GAAA,GAAuB,IAAA;AAC3B,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,EAAA,EAAI,OAAA,EAAS,SAAA,KAAcA,6BAAA,EAAa;AAChD,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,QACzC,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,WAAA,EAAa,MAAA;AAAA,UACb,mBAAA,EAAqBC;AAAA,SACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMA,GAAI,YAAY,EAAC,GAAK,EAAE,IAAA,EAAM,EAAE,UAAA,EAAY,KAAA,EAAM,EAAE;AAAA,QACpD,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,OACP,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAI,iBAAA,CAAkB,GAAG,CAAA,EAAG,MAAM,GAAA;AAClC,MAAA,UAAA,GAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,eAAA;AAClD,MAAA,IAAI,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACnC,QAAA,MAAM,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AACvC,QAAA;AAAA,MACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,IAAK,SAAA,GAAY,GAAA,GAAQ,CAAA,EAAG,EAAA,GAAK,GAAM;AAAA,SACrE,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,UAAA,GAAa,+BAAA;AACb,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,MAAA,KAAA,CAAM,GAAA,CAAI,MAAA,EAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,WAAW,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,EAAQ,CAAA;AACxE,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,UAAA,GAAa,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAC/B,IAAA,IAAI,kBAAkB,GAAA,CAAI,MAAM,CAAA,IAAK,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACpE,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,EAAK,OAAO,CAAA;AACvC,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,GAAA,CAAI,MAAM,CAAA,cAAA,EAAiB,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA,YAAA,EACrE,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,iBAAiB,CAAA,EAAA;AAAA,OAChD;AACA,MAAA,MAAM,MAAM,KAAK,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA;AAAA,EACF;AAEA,EAAA,OAAO,UAAA,CAAW,UAAA,EAAY,MAAA,EAAQ,IAAA,CAAK,KAAK,CAAA;AAClD","file":"chunk-KZBDH5A3.js","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * FAILS CLOSED. If minting genuinely fails, this throws and the build fails —\n * it does NOT publish the raw key. A failed deploy is loud and recoverable; a\n * leaked project secret in public HTML is neither. The only paths that still\n * return the raw key are a 404 (an older API that predates the endpoint, an\n * expected state during rollout) and the explicit `SONOR_SITE_TOKEN_FALLBACK=raw`\n * escape hatch, for when shipping beats being blocked.\n *\n * That posture is not academic. Through 3.5.0 a throttled mint (HTTP 429)\n * returned the raw key AND cached it for 60s, so every page rendered in that\n * window shipped the secret: one real build came out with 180 of 272 prerendered\n * pages carrying it. The build \"succeeded\" and nothing downstream noticed.\n * Rate limiting is transient by definition — the fix is to wait and retry, not\n * to downgrade to publishing the key.\n *\n * Two things keep the request count low enough that throttling is rare:\n *  - a module-level memo, so a worker mints once and every page reuses the seed;\n *  - an in-flight map, because that memo is only populated AFTER the await. Next\n *    renders pages concurrently, so without coalescing the first N concurrent\n *    renders in a process all miss the cache and all fire a request — a\n *    stampede per worker, multiplied by one worker per core. That is how a\n *    single site exhausted a 60/min budget.\n *\n * SEED FRESHNESS: a static page's seed carries `iat` = build time, and the API\n * refuses to refresh a seed older than SITE_TOKEN_MAX_REFRESH_AGE_SECONDS\n * (sonor-api common/site-auth/site-token.util.ts — currently 400 days, raised\n * from 30 alongside this fix). A site not rebuilt within that window serves a\n * seed the client cannot refresh, and its forms/analytics/engage start failing\n * for new visitors. Keep that limit comfortably longer than the fleet's\n * realistic redeploy gap; marketing sites routinely go many months untouched.\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\nimport { resolveFetch } from '../shared/fresh-fetch'\n\n// Re-exported for this module's unit tests; the helper lives in shared/fresh-fetch.\nexport { resolveFetch }\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\n/**\n * Retry budget for transient failures (429 / 5xx / network). Rate limiting is\n * measured per minute, so a few seconds of backoff clears it; the whole ladder\n * costs at most ~20s once per build worker, and only when something is wrong.\n */\nconst MINT_MAX_ATTEMPTS = 4\nconst MINT_BACKOFF_BASE_MS = 500\nconst MINT_BACKOFF_CAP_MS = 8_000\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\n/**\n * Requests already in flight, keyed by raw key. The `cache` above is only\n * written after the response lands, so concurrent renders would otherwise each\n * start their own mint. See the module header.\n */\nconst inflight = new Map<string, Promise<string>>()\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\n/**\n * Honour `Retry-After` when the server sends it (delta-seconds or HTTP date),\n * otherwise exponential backoff. Capped so a misconfigured server cannot stall\n * a build indefinitely.\n */\nfunction retryDelayMs(res: Response | null, attempt: number): number {\n  const header = res?.headers?.get?.('retry-after')\n  if (header) {\n    const seconds = Number(header)\n    const ms = Number.isFinite(seconds)\n      ? seconds * 1000\n      : Date.parse(header) - Date.now()\n    if (Number.isFinite(ms) && ms > 0) return Math.min(ms, MINT_BACKOFF_CAP_MS)\n  }\n  return Math.min(MINT_BACKOFF_BASE_MS * 2 ** attempt, MINT_BACKOFF_CAP_MS)\n}\n\n/** 429 and 5xx are transient; waiting is the correct response to both. */\nconst isRetryableStatus = (status: number) => status === 429 || status >= 500\n\n/**\n * The escape hatch, for when a broken mint must not block a release. Opt-in and\n * loud: it re-enables publishing the project secret in page HTML.\n */\nfunction rawFallbackAllowed(): boolean {\n  return (\n    typeof process !== 'undefined' &&\n    process.env?.SONOR_SITE_TOKEN_FALLBACK === 'raw'\n  )\n}\n\nfunction failClosed(reason: string, rawKey: string, now: number): string {\n  if (rawFallbackAllowed()) {\n    console.warn(\n      `[SiteKitLayout] Token mint failed (${reason}) and SONOR_SITE_TOKEN_FALLBACK=raw is set; ` +\n        'injecting the RAW API KEY into page HTML. The key is publicly readable wherever ' +\n        'this page is served — unset the escape hatch once the mint is healthy.',\n    )\n    cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n    return rawKey\n  }\n  throw new Error(\n    `site-kit: could not mint a site token (${reason}). Refusing to publish the raw ` +\n      'SONOR_API_KEY in page HTML, so this build fails instead. Check that the mint ' +\n      'endpoint is reachable and the key is valid, then rebuild. To ship anyway — ' +\n      'which publishes the project secret in public HTML — set SONOR_SITE_TOKEN_FALLBACK=raw.',\n  )\n}\n\n/*\n * The mint uses Next's saved original fetch (resolveFetch, shared/fresh-fetch.ts,\n * which documents why). A credential is not page data: `cache: 'no-store'` would\n * bail a static route before the request goes out (verified on Next 16.2.9: the\n * mint endpoint received zero requests for a static build, and every page\n * shipped the raw key), and a Data Cache entry would let a fresh deploy re-bake a\n * months-old seed. The module-level memo above is the only cache we want: one\n * mint per build process, and a build-fresh seed on every deploy.\n */\n\n/**\n * Next signals \"this render must go dynamic\" by THROWING (DynamicServerError,\n * static-gen bailout, redirect/notFound digests, React's postpone). Those are\n * the framework's control flow, not a mint failure. Swallowing one makes Next\n * believe the render succeeded statically — which is precisely how the raw key\n * ended up stranded in prerendered HTML with no error anywhere. Let them\n * propagate; only real network/HTTP failures fall back to the raw key.\n *\n * @internal Exported for unit tests; not part of the package's public API.\n */\nexport function isFrameworkSignal(err: unknown): boolean {\n  if (!err || typeof err !== 'object') return false\n  const e = err as { digest?: unknown; code?: unknown; $$typeof?: unknown }\n  if (e.digest === 'DYNAMIC_SERVER_USAGE') return true\n  if (e.code === 'NEXT_STATIC_GEN_BAILOUT') return true\n  if (typeof e.digest === 'string' && e.digest.startsWith('NEXT_')) return true\n  if (e.$$typeof === Symbol.for('react.postpone')) return true\n  return false\n}\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > Date.now()) return cached.credential\n\n  // Collapse concurrent renders onto one request rather than a stampede.\n  const pending = inflight.get(rawKey)\n  if (pending) return pending\n\n  const request = mintWithRetry(rawKey, apiUrl)\n  inflight.set(rawKey, request)\n  try {\n    return await request\n  } finally {\n    inflight.delete(rawKey)\n  }\n}\n\nasync function mintWithRetry(rawKey: string, apiUrl: string): Promise<string> {\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  let lastReason = 'unknown error'\n\n  for (let attempt = 0; attempt < MINT_MAX_ATTEMPTS; attempt++) {\n    let res: Response | null = null\n    try {\n      const { fn: fetchFn, unpatched } = resolveFetch()\n      res = await fetchFn(`${base}${MINT_PATH}`, {\n        method: 'POST',\n        headers: {\n          'content-type': 'application/json',\n          'x-api-key': rawKey,\n          'x-sitekit-version': SITE_KIT_VERSION,\n        },\n        // Only meaningful on the fallback path, where a future Next stopped\n        // exposing `_nextOriginalFetch` and we're back on the patched fetch.\n        // `revalidate: false` is the one setting that neither bails out of static\n        // generation nor downgrades the route to ISR; a Data Cache entry is the\n        // lesser evil versus shipping the raw key again.\n        ...(unpatched ? {} : ({ next: { revalidate: false } } as RequestInit)),\n        signal:\n          typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n            ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n            : undefined,\n      })\n    } catch (err) {\n      // Never swallow the framework's own control flow — see isFrameworkSignal.\n      if (isFrameworkSignal(err)) throw err\n      lastReason = err instanceof Error ? err.message : 'network error'\n      if (attempt < MINT_MAX_ATTEMPTS - 1) {\n        await sleep(retryDelayMs(null, attempt))\n        continue\n      }\n      break\n    }\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: Date.now() + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n      lastReason = 'mint returned no usable token'\n      break\n    }\n\n    // 404 = an API older than the endpoint. Expected during rollout, and the raw\n    // key is exactly what such an API still expects, so this stays a fallback\n    // rather than a build failure.\n    if (res.status === 404) {\n      cache.set(rawKey, { credential: rawKey, expiresAt: Date.now() + 60_000 })\n      return rawKey\n    }\n\n    lastReason = `HTTP ${res.status}`\n    if (isRetryableStatus(res.status) && attempt < MINT_MAX_ATTEMPTS - 1) {\n      const delay = retryDelayMs(res, attempt)\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; retrying in ${Math.round(delay)}ms ` +\n          `(attempt ${attempt + 2}/${MINT_MAX_ATTEMPTS}).`,\n      )\n      await sleep(delay)\n      continue\n    }\n    break\n  }\n\n  return failClosed(lastReason, rawKey, Date.now())\n}\n"]}

package/dist/chunk-KZVSB5WE.mjs

@@ -1,21 +0,0 @@
-import { normalizeSiteHost } from './chunk-ZN4HBK5C.mjs';
-
-// src/sites/resolve.ts
-function resolveSiteHost(explicitSite) {
-  const envSiteUrl = typeof process !== "undefined" ? process.env.NEXT_PUBLIC_SITE_URL : void 0;
-  let resolved = explicitSite ?? "";
-  if (!resolved && envSiteUrl) {
-    try {
-      resolved = new URL(envSiteUrl).host;
-    } catch {
-    }
-  }
-  if (!resolved && typeof window !== "undefined") {
-    resolved = window.location.host;
-  }
-  return normalizeSiteHost(resolved) ?? "";
-}
-
-export { resolveSiteHost };
-//# sourceMappingURL=chunk-KZVSB5WE.mjs.map
-//# sourceMappingURL=chunk-KZVSB5WE.mjs.map

package/dist/chunk-KZVSB5WE.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/sites/resolve.ts"],"names":[],"mappings":";;;AAkCO,SAAS,gBAAgB,YAAA,EAA+B;AAC7D,EAAA,MAAM,aACJ,OAAO,OAAA,KAAY,WAAA,GAAc,OAAA,CAAQ,IAAI,oBAAA,GAAuB,MAAA;AAEtE,EAAA,IAAI,WAAW,YAAA,IAAgB,EAAA;AAC/B,EAAA,IAAI,CAAC,YAAY,UAAA,EAAY;AAC3B,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,IAAI,GAAA,CAAI,UAAU,CAAA,CAAE,IAAA;AAAA,IACjC,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,IAAI,CAAC,QAAA,IAAY,OAAO,MAAA,KAAW,WAAA,EAAa;AAC9C,IAAA,QAAA,GAAW,OAAO,QAAA,CAAS,IAAA;AAAA,EAC7B;AACA,EAAA,OAAO,iBAAA,CAAkB,QAAQ,CAAA,IAAK,EAAA;AACxC","file":"chunk-KZVSB5WE.mjs","sourcesContent":["/**\n * @sonordev/site-kit/sites — resolveSiteHost (leaf module)\n *\n * SINGLE SOURCE OF TRUTH for \"which sub-site am I?\" — the multi-site `site`\n * dimension that lets one Sonor project host many domains (bd-aec.com plus 48\n * sibling domains; truepowersystems.com plus 16 state microsites).\n *\n * Precedence, per the platform site contract:\n *   explicit `site` > NEXT_PUBLIC_SITE_URL host > window.location.host\n *\n * Deliberately usable on BOTH sides. The browser half seeds\n * `window.__SITE_KIT_SITE__` (see `shared/publishCredential`); the build half\n * tags the sitemap sync, the llms.txt reads and every article read (see\n * `sitemap/index`, `llms/writeLLMsTxt`, and `./site-param`, which appends the\n * host to API requests) so a build describes only its OWN host. Server-side the\n * `window` branch simply never fires, which leaves the NEXT_PUBLIC_SITE_URL\n * host — the right source at build time.\n *\n * Do not re-fork this. Before it existed the build path sent no `site` at all,\n * so every site in a 49-domain network read whichever sibling's seo_pages row\n * the database happened to hand back for a shared path like `/` — bd-aec.com\n * shipped soqwriters.com's homepage copy in its llms.txt.\n *\n * Its own file, not `./contract`, for the same bundle reason as\n * `./normalize`: browser entries import this without dragging the contract's\n * JSON schema along.\n */\nimport { normalizeSiteHost } from './normalize'\n\n/**\n * Resolve the sub-site host. Always returns a string (possibly empty), already\n * normalized with the shared contract (lowercase host, no protocol/path/port)\n * so it matches exactly what the Sonor API stores.\n */\nexport function resolveSiteHost(explicitSite?: string): string {\n  const envSiteUrl =\n    typeof process !== 'undefined' ? process.env.NEXT_PUBLIC_SITE_URL : undefined\n\n  let resolved = explicitSite ?? ''\n  if (!resolved && envSiteUrl) {\n    try {\n      resolved = new URL(envSiteUrl).host\n    } catch {\n      /* malformed URL — fall through to client-side host */\n    }\n  }\n  if (!resolved && typeof window !== 'undefined') {\n    resolved = window.location.host\n  }\n  return normalizeSiteHost(resolved) ?? ''\n}\n"]}