@sonordev/site-kit 6.4.0 → 7.0.0

package/dist/chunk-5BARLEAI.mjs

@@ -1,102 +0,0 @@
-'use client';
-import { useDeferredActivation } from './chunk-ZVBLXXNJ.mjs';
-import React, { lazy, useRef, useEffect, useState, Suspense } from 'react';
-import { jsx, jsxs } from 'react/jsx-runtime';
-
-var InteractiveForm = lazy(
-  () => import('./ManagedForm-4PZOCKCV.mjs').then((m) => ({ default: m.ManagedForm }))
-);
-function FormEnhancer({
-  formId,
-  initialConfig,
-  className,
-  experience,
-  defaultValues,
-  onSuccess,
-  onError,
-  enter = "fade",
-  defer = true,
-  children
-}) {
-  const ready = useDeferredActivation(defer);
-  const [enhanced, setEnhanced] = useState(false);
-  return /* @__PURE__ */ jsxs(
-    "div",
-    {
-      "data-sk-form-mount": enhanced ? "enhanced" : "shell",
-      "data-sk-part": "form-mount",
-      style: enter === "fade" ? FADE_HOST : void 0,
-      children: [
-        enter === "fade" && /* @__PURE__ */ jsx(EnterStyles, {}),
-        ready ? /* @__PURE__ */ jsx(Suspense, { fallback: children, children: /* @__PURE__ */ jsx(Enhanced, { onMount: () => setEnhanced(true), fallback: children, children: /* @__PURE__ */ jsx(
-          InteractiveForm,
-          {
-            formId,
-            initialConfig,
-            className,
-            experience,
-            defaultValues,
-            onSuccess,
-            onError
-          }
-        ) }) }) : children
-      ]
-    }
-  );
-}
-var Enhanced = class extends React.Component {
-  constructor() {
-    super(...arguments);
-    this.state = { failed: false };
-  }
-  static getDerivedStateFromError() {
-    return { failed: true };
-  }
-  componentDidCatch(err) {
-    console.error("[Forms] Enhancement failed; keeping the native form:", err);
-  }
-  componentDidMount() {
-    if (!this.state.failed) this.props.onMount();
-  }
-  render() {
-    if (this.state.failed) return this.props.fallback;
-    return /* @__PURE__ */ jsx(FrameTag, { children: this.props.children });
-  }
-};
-function FrameTag({ children }) {
-  const ref = useRef(null);
-  useEffect(() => {
-    const el = ref.current;
-    if (!el) return;
-    el.setAttribute("data-sk-enter", "");
-    const id = requestAnimationFrame(() => el.removeAttribute("data-sk-enter"));
-    return () => cancelAnimationFrame(id);
-  }, []);
-  return /* @__PURE__ */ jsx("div", { ref, style: { display: "contents" }, children });
-}
-var FADE_HOST = {
-  transition: "opacity var(--sk-form-enter-duration, 320ms) var(--sk-form-enter-easing, cubic-bezier(.22,1,.36,1))"
-};
-function EnterStyles() {
-  return /* @__PURE__ */ jsx(
-    "style",
-    {
-      dangerouslySetInnerHTML: {
-        __html: `
-[data-sk-part="form-mount"][data-sk-form-mount="shell"]{opacity:.55}
-[data-sk-part="form-mount"][data-sk-form-mount="enhanced"]{opacity:1}
-[data-sk-part="form-mount"] [data-sk-enter]{opacity:0;transform:translateY(var(--sk-form-enter-distance,6px))}
-[data-sk-part="form-mount"] [data-sk-enter] *{transition:none!important}
-@media (prefers-reduced-motion: reduce){
-[data-sk-part="form-mount"]{transition:none!important}
-[data-sk-part="form-mount"][data-sk-form-mount="shell"]{opacity:1}
-[data-sk-part="form-mount"] [data-sk-enter]{opacity:1;transform:none}
-}`
-      }
-    }
-  );
-}
-
-export { FormEnhancer };
-//# sourceMappingURL=chunk-5BARLEAI.mjs.map
-//# sourceMappingURL=chunk-5BARLEAI.mjs.map

package/dist/chunk-5BARLEAI.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/forms/FormEnhancer.tsx"],"names":[],"mappings":";;;;AAkDA,IAAM,eAAA,GAAkB,IAAA;AAAA,EAAK,MAC3B,OAAO,4BAAe,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,MAAO,EAAE,OAAA,EAAS,CAAA,CAAE,WAAA,EAAY,CAAE;AAClE,CAAA;AA+BO,SAAS,YAAA,CAAa;AAAA,EAC3B,MAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA,GAAQ,MAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR;AACF,CAAA,EAAsB;AACpB,EAAA,MAAM,KAAA,GAAQ,sBAAsB,KAAK,CAAA;AAGzC,EAAA,MAAM,CAAC,QAAA,EAAU,WAAW,CAAA,GAAI,SAAS,KAAK,CAAA;AAE9C,EAAA,uBACE,IAAA;AAAA,IAAC,KAAA;AAAA,IAAA;AAAA,MACC,oBAAA,EAAoB,WAAW,UAAA,GAAa,OAAA;AAAA,MAC5C,cAAA,EAAa,YAAA;AAAA,MACb,KAAA,EAAO,KAAA,KAAU,MAAA,GAAS,SAAA,GAAY,MAAA;AAAA,MAErC,QAAA,EAAA;AAAA,QAAA,KAAA,KAAU,MAAA,wBAAW,WAAA,EAAA,EAAY,CAAA;AAAA,QACjC,KAAA,mBACC,GAAA,CAAC,QAAA,EAAA,EAAS,QAAA,EAAU,QAAA,EAClB,QAAA,kBAAA,GAAA,CAAC,QAAA,EAAA,EAAS,OAAA,EAAS,MAAM,WAAA,CAAY,IAAI,CAAA,EAAG,UAAU,QAAA,EACpD,QAAA,kBAAA,GAAA;AAAA,UAAC,eAAA;AAAA,UAAA;AAAA,YACC,MAAA;AAAA,YACA,aAAA;AAAA,YACA,SAAA;AAAA,YACA,UAAA;AAAA,YACA,aAAA;AAAA,YACA,SAAA;AAAA,YACA;AAAA;AAAA,SACF,EACF,GACF,CAAA,GAEA;AAAA;AAAA;AAAA,GAEJ;AAEJ;AAOA,IAAM,QAAA,GAAN,cAAuB,KAAA,CAAM,SAAA,CAG3B;AAAA,EAHF,WAAA,GAAA;AAAA,IAAA,KAAA,CAAA,GAAA,SAAA,CAAA;AAIE,IAAA,IAAA,CAAA,KAAA,GAAQ,EAAE,QAAQ,KAAA,EAAM;AAAA,EAAA;AAAA,EAExB,OAAO,wBAAA,GAA2B;AAChC,IAAA,OAAO,EAAE,QAAQ,IAAA,EAAK;AAAA,EACxB;AAAA,EAEA,kBAAkB,GAAA,EAAc;AAC9B,IAAA,OAAA,CAAQ,KAAA,CAAM,wDAAwD,GAAG,CAAA;AAAA,EAC3E;AAAA,EAEA,iBAAA,GAAoB;AAClB,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,IAAA,CAAK,MAAM,OAAA,EAAQ;AAAA,EAC7C;AAAA,EAEA,MAAA,GAAS;AACP,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,OAAO,KAAK,KAAA,CAAM,QAAA;AACzC,IAAA,uBAAO,GAAA,CAAC,QAAA,EAAA,EAAU,QAAA,EAAA,IAAA,CAAK,KAAA,CAAM,QAAA,EAAS,CAAA;AAAA,EACxC;AACF,CAAA;AAGA,SAAS,QAAA,CAAS,EAAE,QAAA,EAAS,EAAkC;AAC7D,EAAA,MAAM,GAAA,GAAM,OAAuB,IAAI,CAAA;AACvC,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,MAAM,KAAK,GAAA,CAAI,OAAA;AACf,IAAA,IAAI,CAAC,EAAA,EAAI;AACT,IAAA,EAAA,CAAG,YAAA,CAAa,iBAAiB,EAAE,CAAA;AACnC,IAAA,MAAM,KAAK,qBAAA,CAAsB,MAAM,EAAA,CAAG,eAAA,CAAgB,eAAe,CAAC,CAAA;AAC1E,IAAA,OAAO,MAAM,qBAAqB,EAAE,CAAA;AAAA,EACtC,CAAA,EAAG,EAAE,CAAA;AACL,EAAA,uBACE,GAAA,CAAC,SAAI,GAAA,EAAU,KAAA,EAAO,EAAE,OAAA,EAAS,UAAA,IAC9B,QAAA,EACH,CAAA;AAEJ;AAEA,IAAM,SAAA,GAAiC;AAAA,EACrC,UAAA,EACE;AACJ,CAAA;AAOA,SAAS,WAAA,GAAc;AACrB,EAAA,uBACE,GAAA;AAAA,IAAC,OAAA;AAAA,IAAA;AAAA,MAEC,uBAAA,EAAyB;AAAA,QACvB,MAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA;AAUV;AAAA,GACF;AAEJ","file":"chunk-5BARLEAI.mjs","sourcesContent":["'use client'\n\n/**\n * FormEnhancer — the only client code a managed form needs up front.\n *\n * Renders the server-rendered shell (<StaticForm>, passed as `children`) until\n * an idle/first-interaction gate fires, then lazy-imports the interactive form\n * and swaps it in. Everything expensive — validation, conditional logic,\n * spotlight/stage, celebration, momentum — lives behind that dynamic import,\n * so a page ships this boundary and nothing else in its initial chunk set.\n *\n * The shell is a REAL form the whole time (native action + signed token), so\n * the progression is:\n *\n *   no JS at all      -> shell, submits natively. Works.\n *   JS, pre-idle      -> shell, submits natively. Works.\n *   JS, post-idle     -> enhanced form, submits over JSON. Works, with delight.\n *   chunk 404s        -> shell stays. Works. (Never left blank.)\n *\n * That last line is the invariant to protect: the shell is only removed once\n * the enhancement has actually rendered. Do not \"hide the shell then load\" —\n * a CDN hiccup would leave a visitor staring at an empty box where the form\n * used to be.\n *\n * ── Entrance animation ──────────────────────────────────────────────────\n *\n * Above-the-fold forms upgrade while the visitor is looking at them, so the\n * swap must not pop. The wrapper carries `data-sk-form-mount=\"shell\"` and\n * flips to `\"enhanced\"`, and the enhanced form gets `data-sk-enter` for one\n * frame, so a site can style the transition entirely in CSS:\n *\n *   [data-sk-form-mount] { transition: opacity .35s ease }\n *   [data-sk-form-mount=\"shell\"] { opacity: .6 }\n *\n * Defaults ship as CSS variables rather than hard-coded values:\n *\n *   --sk-form-enter-duration  (default 320ms)\n *   --sk-form-enter-easing    (default cubic-bezier(.22,1,.36,1))\n *   --sk-form-enter-distance  (default 6px)\n *\n * `enter=\"none\"` opts out entirely; `enter=\"custom\"` emits the data\n * attributes but no site-kit styles, leaving the animation to the site.\n * Every default is collapsed by prefers-reduced-motion.\n */\n\nimport React, { lazy, Suspense, useEffect, useRef, useState } from 'react'\nimport { useDeferredActivation } from '../shared/defer'\nimport type { FormExperience, FormSubmitResult } from './types'\n\n/** The heavy half. Nothing else in this module may import it statically. */\nconst InteractiveForm = lazy(() =>\n  import('./ManagedForm').then((m) => ({ default: m.ManagedForm })),\n)\n\nexport type FormEnterAnimation = 'fade' | 'none' | 'custom'\n\nexport interface FormEnhancerProps {\n  formId: string\n  /** Server-fetched raw config — hands the enhancement its fields instantly. */\n  initialConfig?: Record<string, unknown> | null\n  className?: string\n  /** @deprecated Ignored since 6.3.2 (the no-JavaScript form POST was removed). */\n  nativeReturnTo?: string\n  experience?: FormExperience\n  /** Pre-fill field values by slug. See ManagedForm.defaultValues. */\n  defaultValues?: Record<string, unknown>\n  onSuccess?: (submission: FormSubmitResult) => void\n  onError?: (error: Error) => void\n  /**\n   * How the enhanced form arrives. 'fade' (default) crossfades and lifts it\n   * into place; 'none' swaps instantly; 'custom' emits the data attributes\n   * and no styles so the site owns the animation.\n   */\n  enter?: FormEnterAnimation\n  /**\n   * Set false to enhance immediately instead of waiting for idle. Only worth\n   * it for a form that is the entire point of the page AND above the fold.\n   */\n  defer?: boolean\n  /** The server-rendered <StaticForm>. Shown until the enhancement mounts. */\n  children: React.ReactNode\n}\n\nexport function FormEnhancer({\n  formId,\n  initialConfig,\n  className,\n  experience,\n  defaultValues,\n  onSuccess,\n  onError,\n  enter = 'fade',\n  defer = true,\n  children,\n}: FormEnhancerProps) {\n  const ready = useDeferredActivation(defer)\n  // Flipped only after the enhancement has actually committed to the DOM, so\n  // the shell never disappears ahead of its replacement.\n  const [enhanced, setEnhanced] = useState(false)\n\n  return (\n    <div\n      data-sk-form-mount={enhanced ? 'enhanced' : 'shell'}\n      data-sk-part=\"form-mount\"\n      style={enter === 'fade' ? FADE_HOST : undefined}\n    >\n      {enter === 'fade' && <EnterStyles />}\n      {ready ? (\n        <Suspense fallback={children}>\n          <Enhanced onMount={() => setEnhanced(true)} fallback={children}>\n            <InteractiveForm\n              formId={formId}\n              initialConfig={initialConfig}\n              className={className}\n              experience={experience}\n              defaultValues={defaultValues}\n              onSuccess={onSuccess}\n              onError={onError}\n            />\n          </Enhanced>\n        </Suspense>\n      ) : (\n        children\n      )}\n    </div>\n  )\n}\n\n/**\n * Reports the moment the enhancement is on screen, and keeps the shell\n * rendered if it throws. An error boundary is the difference between \"the\n * fancy version failed\" and \"there is no form on this page\".\n */\nclass Enhanced extends React.Component<\n  { onMount: () => void; fallback: React.ReactNode; children: React.ReactNode },\n  { failed: boolean }\n> {\n  state = { failed: false }\n\n  static getDerivedStateFromError() {\n    return { failed: true }\n  }\n\n  componentDidCatch(err: unknown) {\n    console.error('[Forms] Enhancement failed; keeping the native form:', err)\n  }\n\n  componentDidMount() {\n    if (!this.state.failed) this.props.onMount()\n  }\n\n  render() {\n    if (this.state.failed) return this.props.fallback\n    return <FrameTag>{this.props.children}</FrameTag>\n  }\n}\n\n/** Adds data-sk-enter for one frame so a CSS transition has something to run. */\nfunction FrameTag({ children }: { children: React.ReactNode }) {\n  const ref = useRef<HTMLDivElement>(null)\n  useEffect(() => {\n    const el = ref.current\n    if (!el) return\n    el.setAttribute('data-sk-enter', '')\n    const id = requestAnimationFrame(() => el.removeAttribute('data-sk-enter'))\n    return () => cancelAnimationFrame(id)\n  }, [])\n  return (\n    <div ref={ref} style={{ display: 'contents' }}>\n      {children}\n    </div>\n  )\n}\n\nconst FADE_HOST: React.CSSProperties = {\n  transition:\n    'opacity var(--sk-form-enter-duration, 320ms) var(--sk-form-enter-easing, cubic-bezier(.22,1,.36,1))',\n}\n\n/**\n * Scoped to [data-sk-part=\"form-mount\"] so it can never touch a site's own\n * markup. Emitted once per form; identical text dedupes in every browser's\n * style cache and gzips to nothing.\n */\nfunction EnterStyles() {\n  return (\n    <style\n      // biome-ignore lint/security/noDangerouslySetInnerHtml: static string, no interpolation\n      dangerouslySetInnerHTML={{\n        __html: `\n[data-sk-part=\"form-mount\"][data-sk-form-mount=\"shell\"]{opacity:.55}\n[data-sk-part=\"form-mount\"][data-sk-form-mount=\"enhanced\"]{opacity:1}\n[data-sk-part=\"form-mount\"] [data-sk-enter]{opacity:0;transform:translateY(var(--sk-form-enter-distance,6px))}\n[data-sk-part=\"form-mount\"] [data-sk-enter] *{transition:none!important}\n@media (prefers-reduced-motion: reduce){\n[data-sk-part=\"form-mount\"]{transition:none!important}\n[data-sk-part=\"form-mount\"][data-sk-form-mount=\"shell\"]{opacity:1}\n[data-sk-part=\"form-mount\"] [data-sk-enter]{opacity:1;transform:none}\n}`,\n      }}\n    />\n  )\n}\n"]}

package/dist/chunk-5F2FIM5A.mjs

@@ -1,135 +0,0 @@
-// src/articles/article-tables.ts
-var tableScrollClass = "sk-article-table-scroll";
-var legacyTableScrollClass = "sk-blog-table-scroll";
-var voidElements = /* @__PURE__ */ new Set([
-  "area",
-  "base",
-  "br",
-  "col",
-  "embed",
-  "hr",
-  "img",
-  "input",
-  "link",
-  "meta",
-  "param",
-  "source",
-  "track",
-  "wbr"
-]);
-var preservedElements = /* @__PURE__ */ new Set(["pre", "code", "script", "style", "textarea", "xmp", "template"]);
-function htmlTags() {
-  return /<!--[\s\S]*?(?:-->|$)|<\/?[a-z][\w:-]*(?=[\s/>])(?:[^"'<>]|"[^"]*"|'[^']*')*>/gi;
-}
-function hasScrollClass(tag) {
-  const attributes = tag.replace(/^<[\w:-]+/, "").replace(/\/?>$/, "");
-  const pattern = /([^\s=/>]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;
-  for (const attribute of attributes.matchAll(pattern)) {
-    if (attribute[1].toLowerCase() !== "class") continue;
-    return (attribute[2] ?? attribute[3] ?? attribute[4] ?? "").split(/\s+/).some((name) => name === tableScrollClass || name === legacyTableScrollClass);
-  }
-  return false;
-}
-function labelText(html) {
-  return html.replace(/<!--[\s\S]*?(?:-->|$)/g, "").replace(htmlTags(), " ").replace(/\s+/g, " ").trim();
-}
-function escapeLabel(text) {
-  return text.replace(/&(?!(?:#\d+|#x[\da-f]+|[a-z][\da-z]+);)/gi, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-}
-function tableLabel(table, number) {
-  const caption = table.match(/<caption\b(?:[^"'<>]|"[^"]*"|'[^']*')*>([\s\S]*?)<\/caption\s*>/i)?.[1];
-  const headers = [...table.matchAll(/<th\b(?:[^"'<>]|"[^"]*"|'[^']*')*>([\s\S]*?)<\/th\s*>/gi)].slice(0, 4).map((match) => labelText(match[1])).filter(Boolean).join(", ");
-  const summary = labelText(caption || headers).slice(0, 180);
-  return escapeLabel(`Table ${number}${summary ? `: ${summary}` : ""}`);
-}
-function wrapArticleTables(html) {
-  const tags = htmlTags();
-  const stack = [];
-  const tables = [];
-  let tableNumber = 0;
-  let token;
-  while (token = tags.exec(html)) {
-    const tag = token[0];
-    if (tag.startsWith("<!--")) continue;
-    const tagName = /^<\/?([\w:-]+)/.exec(tag)[1].toLowerCase();
-    if (tag.startsWith("</")) {
-      const index = stack.map((frame3) => frame3.tag).lastIndexOf(tagName);
-      if (index < 0) continue;
-      const frame2 = stack[index];
-      if (frame2.table) tables.push({ ...frame2.table, end: tags.lastIndex });
-      stack.length = index;
-      continue;
-    }
-    if (preservedElements.has(tagName)) {
-      const closingTag = new RegExp(`</${tagName}\\s*>`, "gi");
-      closingTag.lastIndex = tags.lastIndex;
-      if (!closingTag.exec(html)) break;
-      tags.lastIndex = closingTag.lastIndex;
-      continue;
-    }
-    if (voidElements.has(tagName) || /\/\s*>$/.test(tag)) continue;
-    const frame = { tag: tagName, scrollRegion: hasScrollClass(tag) };
-    if (tagName === "table" && !stack.some((ancestor) => ancestor.tag === "table")) {
-      tableNumber += 1;
-      if (!stack.some((ancestor) => ancestor.scrollRegion)) {
-        frame.table = { start: token.index, number: tableNumber };
-      }
-    }
-    stack.push(frame);
-  }
-  let output = "";
-  let cursor = 0;
-  for (const { start, end, number } of tables) {
-    const table = html.slice(start, end);
-    output += `${html.slice(cursor, start)}<div class="${tableScrollClass}" role="region" tabindex="0" aria-label="${tableLabel(table, number)}">${table}</div>`;
-    cursor = end;
-  }
-  return output + html.slice(cursor);
-}
-var articleTableCss = (
-  /* css */
-  `
-.sk-article-content .sk-article-table-scroll {
-  box-sizing: border-box;
-  min-width: 0;
-  max-width: 100%;
-  overflow-x: auto;
-  margin: 1.5em 0;
-  border: 1px solid var(--sk-surface-border, #e2e8f0);
-  border-radius: var(--sk-radius, 0.5rem);
-  background: var(--sk-bg-elevated, #f8fafc);
-  scrollbar-width: thin;
-  scrollbar-color: var(--sk-primary, #2563eb) var(--sk-bg-elevated, #f8fafc);
-  overscroll-behavior-x: contain;
-}
-.sk-article-content .sk-article-table-scroll:focus-visible {
-  outline: 2px solid var(--sk-border-focus, var(--sk-primary, #2563eb));
-  outline-offset: 3px;
-}
-.sk-article-content .sk-article-table-scroll::-webkit-scrollbar { height: 10px; }
-.sk-article-content .sk-article-table-scroll::-webkit-scrollbar-track {
-  background: var(--sk-bg-elevated, #f8fafc);
-  border-radius: var(--sk-radius, 0.5rem);
-}
-.sk-article-content .sk-article-table-scroll::-webkit-scrollbar-thumb {
-  background: var(--sk-primary, #2563eb);
-  background-clip: padding-box;
-  border: 2px solid var(--sk-bg-elevated, #f8fafc);
-  border-radius: var(--sk-radius, 0.5rem);
-}
-.sk-article-content .sk-article-table-scroll > table {
-  display: table;
-  margin: 0;
-  overflow: visible;
-}
-.sk-article-content .sk-article-table-scroll caption {
-  padding: 0.625rem 0.875rem;
-  text-align: start;
-  color: var(--sk-text-secondary, #475569);
-}
-`.trim()
-);
-
-export { articleTableCss, wrapArticleTables };
-//# sourceMappingURL=chunk-5F2FIM5A.mjs.map
-//# sourceMappingURL=chunk-5F2FIM5A.mjs.map

package/dist/chunk-5F2FIM5A.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/articles/article-tables.ts"],"names":["frame"],"mappings":";AAKA,IAAM,gBAAA,GAAmB,yBAAA;AAEzB,IAAM,sBAAA,GAAyB,sBAAA;AAC/B,IAAM,YAAA,uBAAmB,GAAA,CAAI;AAAA,EAC3B,MAAA;AAAA,EAAQ,MAAA;AAAA,EAAQ,IAAA;AAAA,EAAM,KAAA;AAAA,EAAO,OAAA;AAAA,EAAS,IAAA;AAAA,EAAM,KAAA;AAAA,EAAO,OAAA;AAAA,EAAS,MAAA;AAAA,EAAQ,MAAA;AAAA,EACpE,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS;AAC9B,CAAC,CAAA;AACD,IAAM,iBAAA,mBAAoB,IAAI,GAAA,CAAI,CAAC,KAAA,EAAO,MAAA,EAAQ,QAAA,EAAU,OAAA,EAAS,UAAA,EAAY,KAAA,EAAO,UAAU,CAAC,CAAA;AAGnG,SAAS,QAAA,GAAmB;AAC1B,EAAA,OAAO,iFAAA;AACT;AAEA,SAAS,eAAe,GAAA,EAAsB;AAC5C,EAAA,MAAM,UAAA,GAAa,IAAI,OAAA,CAAQ,WAAA,EAAa,EAAE,CAAA,CAAE,OAAA,CAAQ,SAAS,EAAE,CAAA;AACnE,EAAA,MAAM,OAAA,GAAU,gEAAA;AAChB,EAAA,KAAA,MAAW,SAAA,IAAa,UAAA,CAAW,QAAA,CAAS,OAAO,CAAA,EAAG;AACpD,IAAA,IAAI,SAAA,CAAU,CAAC,CAAA,CAAE,WAAA,OAAkB,OAAA,EAAS;AAC5C,IAAA,OAAA,CAAQ,UAAU,CAAC,CAAA,IAAK,UAAU,CAAC,CAAA,IAAK,UAAU,CAAC,CAAA,IAAK,IAAI,KAAA,CAAM,KAAK,EAAE,IAAA,CAAK,CAAC,SAAS,IAAA,KAAS,gBAAA,IAAoB,SAAS,sBAAsB,CAAA;AAAA,EACtJ;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,UAAU,IAAA,EAAsB;AAGvC,EAAA,OAAO,IAAA,CACJ,OAAA,CAAQ,wBAAA,EAA0B,EAAE,EACpC,OAAA,CAAQ,QAAA,EAAS,EAAG,GAAG,CAAA,CACvB,OAAA,CAAQ,MAAA,EAAQ,GAAG,EACnB,IAAA,EAAK;AACV;AAEA,SAAS,YAAY,IAAA,EAAsB;AACzC,EAAA,OAAO,IAAA,CACJ,OAAA,CAAQ,2CAAA,EAA6C,OAAO,EAC5D,OAAA,CAAQ,IAAA,EAAM,QAAQ,CAAA,CACtB,QAAQ,IAAA,EAAM,MAAM,CAAA,CACpB,OAAA,CAAQ,MAAM,MAAM,CAAA;AACzB;AAEA,SAAS,UAAA,CAAW,OAAe,MAAA,EAAwB;AACzD,EAAA,MAAM,OAAA,GAAU,KAAA,CAAM,KAAA,CAAM,kEAAkE,IAAI,CAAC,CAAA;AACnG,EAAA,MAAM,OAAA,GAAU,CAAC,GAAG,KAAA,CAAM,QAAA,CAAS,yDAAyD,CAAC,CAAA,CAC1F,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA,CACV,IAAI,CAAC,KAAA,KAAU,SAAA,CAAU,KAAA,CAAM,CAAC,CAAC,CAAC,CAAA,CAClC,MAAA,CAAO,OAAO,CAAA,CACd,IAAA,CAAK,IAAI,CAAA;AACZ,EAAA,MAAM,UAAU,SAAA,CAAU,OAAA,IAAW,OAAO,CAAA,CAAE,KAAA,CAAM,GAAG,GAAG,CAAA;AAC1D,EAAA,OAAO,WAAA,CAAY,SAAS,MAAM,CAAA,EAAG,UAAU,CAAA,EAAA,EAAK,OAAO,CAAA,CAAA,GAAK,EAAE,CAAA,CAAE,CAAA;AACtE;AAaO,SAAS,kBAAkB,IAAA,EAAsB;AACtD,EAAA,MAAM,OAAO,QAAA,EAAS;AACtB,EAAA,MAAM,QAAwB,EAAC;AAC/B,EAAA,MAAM,SAAgE,EAAC;AACvE,EAAA,IAAI,WAAA,GAAc,CAAA;AAClB,EAAA,IAAI,KAAA;AAEJ,EAAA,OAAQ,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA,EAAI;AAChC,IAAA,MAAM,GAAA,GAAM,MAAM,CAAC,CAAA;AACnB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG;AAC5B,IAAA,MAAM,UAAU,gBAAA,CAAiB,IAAA,CAAK,GAAG,CAAA,CAAG,CAAC,EAAE,WAAA,EAAY;AAE3D,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,IAAI,CAAA,EAAG;AACxB,MAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,CAACA,WAAUA,MAAAA,CAAM,GAAG,CAAA,CAAE,WAAA,CAAY,OAAO,CAAA;AACjE,MAAA,IAAI,QAAQ,CAAA,EAAG;AACf,MAAA,MAAMA,MAAAA,GAAQ,MAAM,KAAK,CAAA;AACzB,MAAA,IAAIA,MAAAA,CAAM,KAAA,EAAO,MAAA,CAAO,IAAA,CAAK,EAAE,GAAGA,MAAAA,CAAM,KAAA,EAAO,GAAA,EAAK,IAAA,CAAK,SAAA,EAAW,CAAA;AACpE,MAAA,KAAA,CAAM,MAAA,GAAS,KAAA;AACf,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,iBAAA,CAAkB,GAAA,CAAI,OAAO,CAAA,EAAG;AAGlC,MAAA,MAAM,aAAa,IAAI,MAAA,CAAO,CAAA,EAAA,EAAK,OAAO,SAAS,IAAI,CAAA;AACvD,MAAA,UAAA,CAAW,YAAY,IAAA,CAAK,SAAA;AAC5B,MAAA,IAAI,CAAC,UAAA,CAAW,IAAA,CAAK,IAAI,CAAA,EAAG;AAC5B,MAAA,IAAA,CAAK,YAAY,UAAA,CAAW,SAAA;AAC5B,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,aAAa,GAAA,CAAI,OAAO,KAAK,SAAA,CAAU,IAAA,CAAK,GAAG,CAAA,EAAG;AACtD,IAAA,MAAM,QAAsB,EAAE,GAAA,EAAK,SAAS,YAAA,EAAc,cAAA,CAAe,GAAG,CAAA,EAAE;AAC9E,IAAA,IAAI,OAAA,KAAY,OAAA,IAAW,CAAC,KAAA,CAAM,IAAA,CAAK,CAAC,QAAA,KAAa,QAAA,CAAS,GAAA,KAAQ,OAAO,CAAA,EAAG;AAC9E,MAAA,WAAA,IAAe,CAAA;AACf,MAAA,IAAI,CAAC,KAAA,CAAM,IAAA,CAAK,CAAC,QAAA,KAAa,QAAA,CAAS,YAAY,CAAA,EAAG;AACpD,QAAA,KAAA,CAAM,QAAQ,EAAE,KAAA,EAAO,KAAA,CAAM,KAAA,EAAO,QAAQ,WAAA,EAAY;AAAA,MAC1D;AAAA,IACF;AACA,IAAA,KAAA,CAAM,KAAK,KAAK,CAAA;AAAA,EAClB;AAEA,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,EAAE,KAAA,EAAO,GAAA,EAAK,MAAA,MAAY,MAAA,EAAQ;AAC3C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,KAAA,EAAO,GAAG,CAAA;AACnC,IAAA,MAAA,IAAU,CAAA,EAAG,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,KAAK,CAAC,CAAA,YAAA,EAAe,gBAAgB,CAAA,yCAAA,EAA4C,UAAA,CAAW,KAAA,EAAO,MAAM,CAAC,KAAK,KAAK,CAAA,MAAA,CAAA;AACpJ,IAAA,MAAA,GAAS,GAAA;AAAA,EACX;AACA,EAAA,OAAO,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA;AACnC;AAGO,IAAM,eAAA;AAAA;AAAA,EAA4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA,CAuCvC,IAAA;AAAK","file":"chunk-5F2FIM5A.mjs","sourcesContent":["/**\n * Server-rendered table scrolling. Keep the author's table markup intact so\n * captions, header associations, links and table semantics survive unchanged.\n */\n\nconst tableScrollClass = 'sk-article-table-scroll'\n/** The pre-6.0 name, still recognized in stored HTML so an already-wrapped table isn't wrapped twice. */\nconst legacyTableScrollClass = 'sk-blog-table-scroll'\nconst voidElements = new Set([\n  'area', 'base', 'br', 'col', 'embed', 'hr', 'img', 'input', 'link', 'meta',\n  'param', 'source', 'track', 'wbr',\n])\nconst preservedElements = new Set(['pre', 'code', 'script', 'style', 'textarea', 'xmp', 'template'])\n\n/** Match complete tags, including quoted `>` characters, without reserializing HTML. */\nfunction htmlTags(): RegExp {\n  return /<!--[\\s\\S]*?(?:-->|$)|<\\/?[a-z][\\w:-]*(?=[\\s/>])(?:[^\"'<>]|\"[^\"]*\"|'[^']*')*>/gi\n}\n\nfunction hasScrollClass(tag: string): boolean {\n  const attributes = tag.replace(/^<[\\w:-]+/, '').replace(/\\/?>$/, '')\n  const pattern = /([^\\s=/>]+)(?:\\s*=\\s*(?:\"([^\"]*)\"|'([^']*)'|([^\\s\"'=<>`]+)))?/g\n  for (const attribute of attributes.matchAll(pattern)) {\n    if (attribute[1].toLowerCase() !== 'class') continue\n    return (attribute[2] ?? attribute[3] ?? attribute[4] ?? '').split(/\\s+/).some((name) => name === tableScrollClass || name === legacyTableScrollClass)\n  }\n  return false\n}\n\nfunction labelText(html: string): string {\n  // Preserve existing character references in the eventual attribute. Escaping\n  // them a second time would announce \"amp\" instead of the author's text.\n  return html\n    .replace(/<!--[\\s\\S]*?(?:-->|$)/g, '')\n    .replace(htmlTags(), ' ')\n    .replace(/\\s+/g, ' ')\n    .trim()\n}\n\nfunction escapeLabel(text: string): string {\n  return text\n    .replace(/&(?!(?:#\\d+|#x[\\da-f]+|[a-z][\\da-z]+);)/gi, '&amp;')\n    .replace(/\"/g, '&quot;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n}\n\nfunction tableLabel(table: string, number: number): string {\n  const caption = table.match(/<caption\\b(?:[^\"'<>]|\"[^\"]*\"|'[^']*')*>([\\s\\S]*?)<\\/caption\\s*>/i)?.[1]\n  const headers = [...table.matchAll(/<th\\b(?:[^\"'<>]|\"[^\"]*\"|'[^']*')*>([\\s\\S]*?)<\\/th\\s*>/gi)]\n    .slice(0, 4)\n    .map((match) => labelText(match[1]))\n    .filter(Boolean)\n    .join(', ')\n  const summary = labelText(caption || headers).slice(0, 180)\n  return escapeLabel(`Table ${number}${summary ? `: ${summary}` : ''}`)\n}\n\ninterface ElementFrame {\n  tag: string\n  scrollRegion: boolean\n  table?: { start: number; number: number }\n}\n\n/**\n * Single source of truth for default article table wrappers. Safe to call twice;\n * already wrapped tables and HTML examples are left alone. This is a layout\n * transform, not an HTML sanitizer: content still follows the host's trust policy.\n */\nexport function wrapArticleTables(html: string): string {\n  const tags = htmlTags()\n  const stack: ElementFrame[] = []\n  const tables: Array<{ start: number; end: number; number: number }> = []\n  let tableNumber = 0\n  let token: RegExpExecArray | null\n\n  while ((token = tags.exec(html))) {\n    const tag = token[0]\n    if (tag.startsWith('<!--')) continue\n    const tagName = /^<\\/?([\\w:-]+)/.exec(tag)![1].toLowerCase()\n\n    if (tag.startsWith('</')) {\n      const index = stack.map((frame) => frame.tag).lastIndexOf(tagName)\n      if (index < 0) continue\n      const frame = stack[index]\n      if (frame.table) tables.push({ ...frame.table, end: tags.lastIndex })\n      stack.length = index\n      continue\n    }\n\n    if (preservedElements.has(tagName)) {\n      // Code examples and raw text can contain literal HTML. Skip to the end\n      // without interpreting any of those tags as article content.\n      const closingTag = new RegExp(`</${tagName}\\\\s*>`, 'gi')\n      closingTag.lastIndex = tags.lastIndex\n      if (!closingTag.exec(html)) break\n      tags.lastIndex = closingTag.lastIndex\n      continue\n    }\n\n    if (voidElements.has(tagName) || /\\/\\s*>$/.test(tag)) continue\n    const frame: ElementFrame = { tag: tagName, scrollRegion: hasScrollClass(tag) }\n    if (tagName === 'table' && !stack.some((ancestor) => ancestor.tag === 'table')) {\n      tableNumber += 1\n      if (!stack.some((ancestor) => ancestor.scrollRegion)) {\n        frame.table = { start: token.index, number: tableNumber }\n      }\n    }\n    stack.push(frame)\n  }\n\n  let output = ''\n  let cursor = 0\n  for (const { start, end, number } of tables) {\n    const table = html.slice(start, end)\n    output += `${html.slice(cursor, start)}<div class=\"${tableScrollClass}\" role=\"region\" tabindex=\"0\" aria-label=\"${tableLabel(table, number)}\">${table}</div>`\n    cursor = end\n  }\n  return output + html.slice(cursor)\n}\n\n/** Native overflow only when content needs it; small tables retain their layout. */\nexport const articleTableCss = /* css */ `\n.sk-article-content .sk-article-table-scroll {\n  box-sizing: border-box;\n  min-width: 0;\n  max-width: 100%;\n  overflow-x: auto;\n  margin: 1.5em 0;\n  border: 1px solid var(--sk-surface-border, #e2e8f0);\n  border-radius: var(--sk-radius, 0.5rem);\n  background: var(--sk-bg-elevated, #f8fafc);\n  scrollbar-width: thin;\n  scrollbar-color: var(--sk-primary, #2563eb) var(--sk-bg-elevated, #f8fafc);\n  overscroll-behavior-x: contain;\n}\n.sk-article-content .sk-article-table-scroll:focus-visible {\n  outline: 2px solid var(--sk-border-focus, var(--sk-primary, #2563eb));\n  outline-offset: 3px;\n}\n.sk-article-content .sk-article-table-scroll::-webkit-scrollbar { height: 10px; }\n.sk-article-content .sk-article-table-scroll::-webkit-scrollbar-track {\n  background: var(--sk-bg-elevated, #f8fafc);\n  border-radius: var(--sk-radius, 0.5rem);\n}\n.sk-article-content .sk-article-table-scroll::-webkit-scrollbar-thumb {\n  background: var(--sk-primary, #2563eb);\n  background-clip: padding-box;\n  border: 2px solid var(--sk-bg-elevated, #f8fafc);\n  border-radius: var(--sk-radius, 0.5rem);\n}\n.sk-article-content .sk-article-table-scroll > table {\n  display: table;\n  margin: 0;\n  overflow: visible;\n}\n.sk-article-content .sk-article-table-scroll caption {\n  padding: 0.625rem 0.875rem;\n  text-align: start;\n  color: var(--sk-text-secondary, #475569);\n}\n`.trim()\n"]}

package/dist/chunk-5RNAUYWE.js

@@ -1,50 +0,0 @@
-'use strict';
-
-// src/shared/frame.ts
-function isFramed() {
-  if (typeof window === "undefined") return false;
-  try {
-    return window.self !== window.top;
-  } catch {
-    return true;
-  }
-}
-function isTopFrameSameOrigin() {
-  if (typeof window === "undefined") return false;
-  try {
-    return typeof window.top?.location?.href === "string";
-  } catch {
-    return false;
-  }
-}
-function isCrossOriginFrame() {
-  if (!isFramed()) return false;
-  return !isTopFrameSameOrigin();
-}
-
-// src/shared/reporting-gate.ts
-var announcedSuppression = false;
-function resolveAnalyticsTarget(options = {}) {
-  const config = typeof window === "undefined" ? void 0 : window;
-  const apiUrl = options.apiUrl || config?.__SITE_KIT_API_URL__ || "https://api.sonor.io";
-  const apiKey = options.apiKey || config?.__SITE_KIT_API_KEY__;
-  if (!apiKey) return null;
-  const hostname = (config?.location?.hostname || "").toLowerCase().replace(/\.+$/, "");
-  const local = hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1" || hostname === "0.0.0.0";
-  const optIn = local && options.allowLocalhost !== true ? "allowLocalhost" : !options.allowInFrame && isCrossOriginFrame() ? "allowInFrame" : null;
-  if (optIn) {
-    if (options.debug && !announcedSuppression) {
-      announcedSuppression = true;
-      console.info(`[Site-kit] Reporting suppressed. Set analytics.${optIn} to explicitly opt in.`);
-    }
-    return null;
-  }
-  return { apiUrl, apiKey };
-}
-
-exports.isCrossOriginFrame = isCrossOriginFrame;
-exports.isFramed = isFramed;
-exports.isTopFrameSameOrigin = isTopFrameSameOrigin;
-exports.resolveAnalyticsTarget = resolveAnalyticsTarget;
-//# sourceMappingURL=chunk-5RNAUYWE.js.map
-//# sourceMappingURL=chunk-5RNAUYWE.js.map

package/dist/chunk-5RNAUYWE.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/shared/frame.ts","../src/shared/reporting-gate.ts"],"names":[],"mappings":";;;AA4DO,SAAS,QAAA,GAAoB;AAClC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,IAAI;AACF,IAAA,OAAO,MAAA,CAAO,SAAS,MAAA,CAAO,GAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAMO,SAAS,oBAAA,GAAgC;AAC9C,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,IAAI;AACF,IAAA,OAAO,OAAO,MAAA,CAAO,GAAA,EAAK,QAAA,EAAU,IAAA,KAAS,QAAA;AAAA,EAC/C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAMO,SAAS,kBAAA,GAA8B;AAC5C,EAAA,IAAI,CAAC,QAAA,EAAS,EAAG,OAAO,KAAA;AACxB,EAAA,OAAO,CAAC,oBAAA,EAAqB;AAC/B;;;AC7CA,IAAI,oBAAA,GAAuB,KAAA;AAepB,SAAS,sBAAA,CACd,OAAA,GAAgC,EAAC,EACT;AACxB,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,KAAW,WAAA,GAAc,MAAA,GAAY,MAAA;AAI3D,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,IAAU,MAAA,EAAQ,oBAAA,IAAwB,sBAAA;AACjE,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,IAAU,MAAA,EAAQ,oBAAA;AAEzC,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AAKpB,EAAA,MAAM,QAAA,GAAA,CAAY,QAAQ,QAAA,EAAU,QAAA,IAAY,IAAI,WAAA,EAAY,CAAE,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACpF,EAAA,MAAM,KAAA,GAAQ,QAAA,KAAa,WAAA,IAAe,QAAA,CAAS,QAAA,CAAS,YAAY,CAAA,IACtE,QAAA,KAAa,WAAA,IAAe,QAAA,KAAa,OAAA,IAAW,QAAA,KAAa,SACjE,QAAA,KAAa,SAAA;AACf,EAAA,MAAM,KAAA,GAAQ,KAAA,IAAS,OAAA,CAAQ,cAAA,KAAmB,IAAA,GAAO,gBAAA,GACrD,CAAC,OAAA,CAAQ,YAAA,IAAgB,kBAAA,EAAmB,GAAI,cAAA,GAAiB,IAAA;AACrE,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,IAAI,OAAA,CAAQ,KAAA,IAAS,CAAC,oBAAA,EAAsB;AAC1C,MAAA,oBAAA,GAAuB,IAAA;AACvB,MAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,+CAAA,EAAkD,KAAK,CAAA,sBAAA,CAAwB,CAAA;AAAA,IAC9F;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC1B","file":"chunk-5RNAUYWE.js","sourcesContent":["/**\n * @sonordev/site-kit shared — am I inside someone else's page?\n *\n * SINGLE SOURCE OF TRUTH for the frame relationship. Any module that has to\n * decide whether this document is an embed imports from here; nobody writes a\n * second `window.top` check. Two copies of this rule would drift, and the\n * drift is invisible — a module that answers \"not framed\" when it is just\n * quietly writes another tenant's traffic into a client's project.\n *\n * ─── Why it exists ─────────────────────────────────────────────────────────\n *\n * Upforge case studies embed each client's whole production site in three\n * eager iframes (agency-site-kit `DeviceTrifolio`), and\n * `proxy/securityHeaders.ts`'s DEFAULT_FRAME_ANCESTORS lets upforge.io and\n * upforgelabs.com frame every managed site. Inside that frame the client's\n * site loads, hydrates and runs its site-kit modules exactly as it would for\n * a real visitor — the screenshot overlay covers the PIXELS, not the\n * JavaScript. Anything that phones home from there is attributing a visit to\n * upforge.io's page to the client's own project. Measured effect, and the\n * analytics decision built on this: `analytics/send-gate.ts`.\n *\n * ─── Detection ─────────────────────────────────────────────────────────────\n *\n * `window.self !== window.top` is the reliable signal. `top` is a\n * cross-origin-readable property, so the comparison never throws — unlike\n * touching `top.location`, which is exactly what makes the naive check\n * unusable and is the reason this is written down once.\n *\n * Same-origin is then probed by *actually reading* `top.location.href` and\n * catching the SecurityError. That is the only honest test: comparing URL\n * strings cannot see through a sandboxed, opaque, or `about:blank` origin,\n * and would call a hostile embedder same-origin if it faked the right host.\n *\n * The probe only runs when the document IS framed, so the top-level case —\n * every real visitor on every site — costs one property comparison and never\n * enters a try/catch.\n *\n * ─── Same-origin frames are NOT treated as embeds ──────────────────────────\n *\n * Being framed is not the problem; being framed by SOMEONE ELSE is. When the\n * top document is same-origin the site is embedding itself — a preview pane,\n * a print view, an on-domain booking or checkout frame. The visitor really is\n * on that site, the operator controls both documents, and there is no other\n * tenant's project to pollute. Callers should keep working normally there;\n * treating it as an embed would drop legitimate data to buy nothing.\n *\n * Nesting resolves the way you would want, because these compare against\n * `window.top` and not `window.parent`: a same-origin frame nested inside a\n * cross-origin one (upforge.io → client.com → client.com/widget) is still\n * correctly reported as a cross-origin embed.\n */\n\n/**\n * True when this document is not the top-level browsing context.\n *\n * Never throws in practice; the catch exists so a hostile or exotic embedder\n * cannot crash a caller, and it fails CLOSED (treat \"cannot tell\" as framed).\n * A false positive costs one site some of its own data; a false negative\n * writes into someone else's — the asymmetry decides the default.\n */\nexport function isFramed(): boolean {\n  if (typeof window === 'undefined') return false\n  try {\n    return window.self !== window.top\n  } catch {\n    return true\n  }\n}\n\n/**\n * True when the TOP document is same-origin and therefore readable.\n * Only meaningful when {@link isFramed} is true.\n */\nexport function isTopFrameSameOrigin(): boolean {\n  if (typeof window === 'undefined') return false\n  try {\n    return typeof window.top?.location?.href === 'string'\n  } catch {\n    return false\n  }\n}\n\n/**\n * True when this document is running inside a CROSS-ORIGIN frame — i.e. it is\n * someone else's embed, and its activity is not this site's traffic.\n */\nexport function isCrossOriginFrame(): boolean {\n  if (!isFramed()) return false\n  return !isTopFrameSameOrigin()\n}\n","/**\n * Single source of truth for client reporting eligibility and credentials.\n * Analytics, fleet, SitemapSync and Engage all resolve through this gate.\n * Kept separate from transport wrappers so non-analytics modules stay lean.\n */\n\nimport { isCrossOriginFrame } from './frame'\n\n/** Resolved destination for an analytics send. */\nexport interface AnalyticsTarget {\n  apiUrl: string\n  apiKey: string\n}\n\nexport interface AnalyticsGateOptions {\n  /** `apiUrl` prop, when the caller was given one. Falls back to the window global. */\n  apiUrl?: string\n  /** `apiKey` prop, when the caller was given one. Falls back to the window global. */\n  apiKey?: string\n  /**\n   * Opt back in to reporting from inside a cross-origin frame. For a site\n   * deliberately distributed as an embed (a widget, a partner-hosted\n   * booking or menu page) the frame IS the product, and its traffic is real.\n   * Explicit per-site config only — see AnalyticsConfig.allowInFrame. There\n   * is deliberately no window global or env var for this: a silent switch\n   * that turns cross-tenant tracking back on is the failure mode, not the\n   * feature.\n   */\n  allowInFrame?: boolean\n  /** Explicitly allow reporting from local browser hosts. Default false. */\n  allowLocalhost?: boolean\n  /** Emit the one-time diagnostic when a send is suppressed. */\n  debug?: boolean\n}\n\n// Re-exported so analytics consumers have one import for the whole decision.\nexport { isCrossOriginFrame, isFramed, isTopFrameSameOrigin } from './frame'\n\n/**\n * One `console.info` per document, not one per event. A framed page fires\n * page view + journey + vitals + a click's worth of heatmap rows; logging\n * each suppression would turn a correct decision into console spam (and\n * Lighthouse best-practices noise) in someone else's page.\n */\nlet announcedSuppression = false\n\n/** Test seam — resets the once-per-document log latch. */\nexport function __resetSendGate(): void {\n  announcedSuppression = false\n}\n\n/**\n * Resolve where an analytics call should go, or `null` if it must not happen.\n *\n * Returning `null` is the ONLY \"do not send\" signal in this module. Callers\n * that set up listeners or scrape the DOM should resolve first and bail on\n * `null`, so a blocked document never even attaches a scroll or click\n * listener — the guard saves the work, not just the request.\n */\nexport function resolveAnalyticsTarget(\n  options: AnalyticsGateOptions = {},\n): AnalyticsTarget | null {\n  const config = typeof window === 'undefined' ? undefined : window as Window & {\n    __SITE_KIT_API_URL__?: string\n    __SITE_KIT_API_KEY__?: string\n  }\n  const apiUrl = options.apiUrl || config?.__SITE_KIT_API_URL__ || 'https://api.sonor.io'\n  const apiKey = options.apiKey || config?.__SITE_KIT_API_KEY__\n\n  if (!apiKey) return null\n\n  // Single source of truth for browser reporting: use the actual document\n  // hostname, NEVER analytics.site or NEXT_PUBLIC_SITE_URL (often production\n  // domains even when next start is being verified on localhost).\n  const hostname = (config?.location?.hostname || '').toLowerCase().replace(/\\.+$/, '')\n  const local = hostname === 'localhost' || hostname.endsWith('.localhost') ||\n    hostname === '127.0.0.1' || hostname === '[::1]' || hostname === '::1' ||\n    hostname === '0.0.0.0'\n  const optIn = local && options.allowLocalhost !== true ? 'allowLocalhost'\n    : !options.allowInFrame && isCrossOriginFrame() ? 'allowInFrame' : null\n  if (optIn) {\n    if (options.debug && !announcedSuppression) {\n      announcedSuppression = true\n      console.info(`[Site-kit] Reporting suppressed. Set analytics.${optIn} to explicitly opt in.`)\n    }\n    return null\n  }\n\n  return { apiUrl, apiKey }\n}\n"]}

package/dist/chunk-5SANRSX3.mjs

@@ -1,17 +0,0 @@
-// src/shared/page-leave.ts
-function onPageLeave(onLeave, win = window, doc = document) {
-  const handleVisibilityChange = () => {
-    if (doc.visibilityState === "hidden") onLeave();
-  };
-  const handlePageHide = () => onLeave();
-  doc.addEventListener("visibilitychange", handleVisibilityChange);
-  win.addEventListener("pagehide", handlePageHide);
-  return () => {
-    doc.removeEventListener("visibilitychange", handleVisibilityChange);
-    win.removeEventListener("pagehide", handlePageHide);
-  };
-}
-
-export { onPageLeave };
-//# sourceMappingURL=chunk-5SANRSX3.mjs.map
-//# sourceMappingURL=chunk-5SANRSX3.mjs.map

package/dist/chunk-5SANRSX3.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/shared/page-leave.ts"],"names":[],"mappings":";AAwBO,SAAS,WAAA,CACd,OAAA,EACA,GAAA,GAAsB,MAAA,EACtB,MAAqE,QAAA,EACzD;AACZ,EAAA,MAAM,yBAAyB,MAAM;AACnC,IAAA,IAAI,GAAA,CAAI,eAAA,KAAoB,QAAA,EAAU,OAAA,EAAQ;AAAA,EAChD,CAAA;AACA,EAAA,MAAM,cAAA,GAAiB,MAAM,OAAA,EAAQ;AAErC,EAAA,GAAA,CAAI,gBAAA,CAAiB,oBAAoB,sBAAsB,CAAA;AAC/D,EAAA,GAAA,CAAI,gBAAA,CAAiB,YAAY,cAAc,CAAA;AAE/C,EAAA,OAAO,MAAM;AACX,IAAA,GAAA,CAAI,mBAAA,CAAoB,oBAAoB,sBAAsB,CAAA;AAClE,IAAA,GAAA,CAAI,mBAAA,CAAoB,YAAY,cAAc,CAAA;AAAA,EACpD,CAAA;AACF","file":"chunk-5SANRSX3.mjs","sourcesContent":["/**\n * @sonordev/site-kit - page-leave signal\n *\n * SINGLE SOURCE OF TRUTH for \"the visitor may be gone, send what you have\".\n * Used by form abandonment, Signal's behavior flush and scroll-depth reporting.\n * Do NOT hand-roll another pagehide/visibilitychange pair.\n *\n * Two events, because neither covers every leave on its own:\n * - `visibilitychange` to hidden: tab switch, app switch, screen lock, and the\n *   last thing a mobile browser reliably fires before it discards a\n *   backgrounded tab (it often never fires pagehide for those).\n * - `pagehide`: full navigation or close, including Safari versions that skip\n *   visibilitychange on navigation.\n *\n * Never `beforeunload`: iOS Safari doesn't fire it, and Firefox won't put a\n * page that listens for it in the back/forward cache.\n *\n * One leave usually fires both events, and a hidden tab can come back, so\n * `onLeave` can run several times per page. It must be idempotent.\n */\n\ntype ListenerTarget = Pick<EventTarget, 'addEventListener' | 'removeEventListener'>\n\n/** Call `onLeave` whenever the page is hidden or unloaded. Returns the cleanup. */\nexport function onPageLeave(\n  onLeave: () => void,\n  win: ListenerTarget = window,\n  doc: ListenerTarget & { visibilityState: DocumentVisibilityState } = document,\n): () => void {\n  const handleVisibilityChange = () => {\n    if (doc.visibilityState === 'hidden') onLeave()\n  }\n  const handlePageHide = () => onLeave()\n\n  doc.addEventListener('visibilitychange', handleVisibilityChange)\n  win.addEventListener('pagehide', handlePageHide)\n\n  return () => {\n    doc.removeEventListener('visibilitychange', handleVisibilityChange)\n    win.removeEventListener('pagehide', handlePageHide)\n  }\n}\n"]}

package/dist/chunk-5T3J24K4.mjs

@@ -1,131 +0,0 @@
-import { isTokenMode, getFreshCredential, isSiteToken, refreshSiteToken, currentCredential, credentialBreakerId } from './chunk-YRKWJCML.mjs';
-import { SITE_KIT_VERSION } from './chunk-K3PVUXKB.mjs';
-
-// src/shared/fetchWithRetry.ts
-function backoffDelay(attempt, response) {
-  if (response?.status === 429) {
-    const header = response.headers.get("retry-after");
-    const seconds = header ? parseInt(header, 10) : NaN;
-    if (!Number.isNaN(seconds) && seconds > 0) return Math.min(seconds * 1e3, 1e4);
-  }
-  return Math.min(8e3, 500 * 2 ** attempt);
-}
-async function fetchWithRetry(url, init, options = {}) {
-  const retries = options.retries ?? 2;
-  const timeoutMs = options.timeoutMs ?? 15e3;
-  let lastError;
-  for (let attempt = 0; attempt <= retries; attempt++) {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
-    try {
-      const response = await fetch(url, { ...init, signal: controller.signal });
-      clearTimeout(timer);
-      if ((response.status === 429 || response.status >= 500) && attempt < retries) {
-        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt, response)));
-        continue;
-      }
-      return response;
-    } catch (error) {
-      clearTimeout(timer);
-      lastError = error;
-      if (attempt < retries) {
-        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt)));
-        continue;
-      }
-    }
-  }
-  throw lastError instanceof Error ? lastError : new Error("Network request failed after multiple attempts. Please try again.");
-}
-
-// src/shared/sonorFetch.ts
-var AUTH_BREAK_MS = 5 * 6e4;
-var BREAKER_STATE_KEY = "__SONOR_AUTH_BREAKER__";
-var pausedKeys = (() => {
-  if (typeof window === "undefined") return /* @__PURE__ */ new Map();
-  const w = window;
-  return w[BREAKER_STATE_KEY] ?? (w[BREAKER_STATE_KEY] = /* @__PURE__ */ new Map());
-})();
-var warnedThisPage = false;
-function isAuthPaused(credential) {
-  if (typeof window === "undefined") return false;
-  const id = credentialBreakerId(credential);
-  const until = pausedKeys.get(id);
-  if (!until) return false;
-  if (Date.now() >= until) {
-    pausedKeys.delete(id);
-    return false;
-  }
-  return true;
-}
-function tripBreaker(credential) {
-  pausedKeys.set(credentialBreakerId(credential), Date.now() + AUTH_BREAK_MS);
-  if (!warnedThisPage) {
-    warnedThisPage = true;
-    console.info(
-      "[Sonor] This site couldn't authenticate with Sonor, so data features are paused for a few minutes. If this keeps happening, the site is likely running an outdated API key."
-    );
-  }
-}
-async function sonorFetch(url, init = {}, options = {}) {
-  let credential = options.apiKey;
-  if (credential !== void 0 || isTokenMode()) {
-    credential = await getFreshCredential(options.apiKey);
-  }
-  const headers = new Headers(init.headers || {});
-  headers.set("x-sitekit-version", SITE_KIT_VERSION);
-  if (credential) {
-    if (isTokenMode()) {
-      headers.set("x-api-key", credential);
-      headers.delete("authorization");
-    } else if (!headers.has("x-api-key")) {
-      headers.set("x-api-key", credential);
-    }
-  }
-  if (isAuthPaused(credential)) {
-    return new Response(null, { status: 401, statusText: "sonor-auth-paused" });
-  }
-  let response = await fetchWithRetry(url, { ...init, headers }, options);
-  if ((response.status === 401 || response.status === 403) && typeof window !== "undefined" && isSiteToken(credential)) {
-    const refreshed = await refreshSiteToken();
-    if (refreshed && refreshed !== credential) {
-      const retryHeaders = new Headers(init.headers || {});
-      retryHeaders.set("x-sitekit-version", SITE_KIT_VERSION);
-      retryHeaders.set("x-api-key", refreshed);
-      retryHeaders.delete("authorization");
-      credential = refreshed;
-      response = await fetchWithRetry(url, { ...init, headers: retryHeaders }, options);
-    }
-  }
-  if ((response.status === 401 || response.status === 403) && typeof window !== "undefined" && credential) {
-    tripBreaker(credential);
-  }
-  return response;
-}
-function sonorBeacon(url, payload, apiKey) {
-  const credential = currentCredential(apiKey);
-  const body = typeof payload === "string" ? payload : JSON.stringify(payload);
-  try {
-    void fetch(url, {
-      method: "POST",
-      keepalive: true,
-      headers: {
-        "Content-Type": "application/json",
-        "x-sitekit-version": SITE_KIT_VERSION,
-        ...credential ? { "x-api-key": credential } : {}
-      },
-      body
-    }).catch(() => {
-    });
-  } catch {
-    try {
-      if (typeof navigator !== "undefined" && navigator.sendBeacon) {
-        navigator.sendBeacon(url, new Blob([body], { type: "application/json" }));
-      }
-    } catch {
-    }
-  }
-}
-
-export { sonorBeacon, sonorFetch };
-//# sourceMappingURL=chunk-5T3J24K4.mjs.map
-//# sourceMappingURL=chunk-5T3J24K4.mjs.map

package/dist/chunk-5T3J24K4.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/shared/fetchWithRetry.ts","../src/shared/sonorFetch.ts"],"names":[],"mappings":";;;;AAsBA,SAAS,YAAA,CAAa,SAAiB,QAAA,EAA6B;AAElE,EAAA,IAAI,QAAA,EAAU,WAAW,GAAA,EAAK;AAC5B,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,MAAA,GAAS,QAAA,CAAS,MAAA,EAAQ,EAAE,CAAA,GAAI,GAAA;AAChD,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,IAAK,OAAA,GAAU,CAAA,EAAG,OAAO,IAAA,CAAK,GAAA,CAAI,OAAA,GAAU,GAAA,EAAM,GAAK,CAAA;AAAA,EAClF;AAEA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,GAAA,EAAM,GAAA,GAAM,KAAK,OAAO,CAAA;AAC1C;AASA,eAAsB,cAAA,CACpB,GAAA,EACA,IAAA,EACA,OAAA,GAA6B,EAAC,EACX;AACnB,EAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,IAAA;AACvC,EAAA,IAAI,SAAA;AAEJ,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,OAAA,EAAS,OAAA,EAAA,EAAW;AACnD,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,MAAA,YAAA,CAAa,KAAK,CAAA;AAElB,MAAA,IAAA,CAAK,SAAS,MAAA,KAAW,GAAA,IAAO,SAAS,MAAA,IAAU,GAAA,KAAQ,UAAU,OAAA,EAAS;AAC5E,QAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY,UAAA,CAAW,SAAS,YAAA,CAAa,OAAA,EAAS,QAAQ,CAAC,CAAC,CAAA;AACnF,QAAA;AAAA,MACF;AACA,MAAA,OAAO,QAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,SAAA,GAAY,KAAA;AAEZ,MAAA,IAAI,UAAU,OAAA,EAAS;AACrB,QAAA,MAAM,IAAI,QAAQ,CAAC,OAAA,KAAY,WAAW,OAAA,EAAS,YAAA,CAAa,OAAO,CAAC,CAAC,CAAA;AACzE,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,YAAqB,KAAA,GACvB,SAAA,GACA,IAAI,MAAM,mEAAmE,CAAA;AACnF;;;AC7BA,IAAM,gBAAgB,CAAA,GAAI,GAAA;AAM1B,IAAM,iBAAA,GAAoB,wBAAA;AAC1B,IAAM,cAAmC,MAAM;AAC7C,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,2BAAW,GAAA,EAAI;AAClD,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,CAAA,CAAA,iBAAA,CAAA,KAAA,CAAA,CAAA,iBAAA,CAAA,uBAA6B,GAAA,EAAI,CAAA;AAC3C,CAAA,GAAG;AACH,IAAI,cAAA,GAAiB,KAAA;AAGd,SAAS,aAAa,UAAA,EAA8B;AACzD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,MAAM,EAAA,GAAK,oBAAoB,UAAU,CAAA;AACzC,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,EAAE,CAAA;AAC/B,EAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,EAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,KAAA,EAAO;AACvB,IAAA,UAAA,CAAW,OAAO,EAAE,CAAA;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,YAAY,UAAA,EAA2B;AAC9C,EAAA,UAAA,CAAW,IAAI,mBAAA,CAAoB,UAAU,GAAG,IAAA,CAAK,GAAA,KAAQ,aAAa,CAAA;AAC1E,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,cAAA,GAAiB,IAAA;AAGjB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AACF;AAEA,eAAsB,WACpB,GAAA,EACA,IAAA,GAAoB,EAAC,EACrB,OAAA,GAA6B,EAAC,EACX;AAGnB,EAAA,IAAI,aAAa,OAAA,CAAQ,MAAA;AACzB,EAAA,IAAI,UAAA,KAAe,MAAA,IAAa,WAAA,EAAY,EAAG;AAC7C,IAAA,UAAA,GAAa,MAAM,kBAAA,CAAmB,OAAA,CAAQ,MAAM,CAAA;AAAA,EACtD;AAEA,EAAA,MAAM,UAAU,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAC9C,EAAA,OAAA,CAAQ,GAAA,CAAI,qBAAqB,gBAAgB,CAAA;AACjD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,IAAI,aAAY,EAAG;AASjB,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AACnC,MAAA,OAAA,CAAQ,OAAO,eAAe,CAAA;AAAA,IAChC,CAAA,MAAA,IAAW,CAAC,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG;AAEpC,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAa,UAAU,CAAA;AAAA,IACrC;AAAA,EACF;AAEA,EAAA,IAAI,YAAA,CAAa,UAAU,CAAA,EAAG;AAG5B,IAAA,OAAO,IAAI,SAAS,IAAA,EAAM,EAAE,QAAQ,GAAA,EAAK,UAAA,EAAY,qBAAqB,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,QAAA,GAAW,MAAM,cAAA,CAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAQ,EAAG,OAAO,CAAA;AAKtE,EAAA,IAAA,CACG,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,QAAA,CAAS,MAAA,KAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClB,WAAA,CAAY,UAAU,CAAA,EACtB;AACA,IAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,EAAiB;AACzC,IAAA,IAAI,SAAA,IAAa,cAAc,UAAA,EAAY;AACzC,MAAA,MAAM,eAAe,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AACnD,MAAA,YAAA,CAAa,GAAA,CAAI,qBAAqB,gBAAgB,CAAA;AACtD,MAAA,YAAA,CAAa,GAAA,CAAI,aAAa,SAAS,CAAA;AAGvC,MAAA,YAAA,CAAa,OAAO,eAAe,CAAA;AACnC,MAAA,UAAA,GAAa,SAAA;AACb,MAAA,QAAA,GAAW,MAAM,eAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,YAAA,EAAa,EAAG,OAAO,CAAA;AAAA,IAClF;AAAA,EACF;AAEA,EAAA,IAAA,CACG,QAAA,CAAS,WAAW,GAAA,IAAO,QAAA,CAAS,WAAW,GAAA,KAChD,OAAO,MAAA,KAAW,WAAA,IAClB,UAAA,EACA;AACA,IAAA,WAAA,CAAY,UAAU,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,QAAA;AACT;AAYO,SAAS,WAAA,CAAY,GAAA,EAAa,OAAA,EAAkB,MAAA,EAAuB;AAChF,EAAA,MAAM,UAAA,GAAa,kBAAkB,MAAM,CAAA;AAC3C,EAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,IAAA,CAAK,UAAU,OAAO,CAAA;AAC3E,EAAA,IAAI;AACF,IAAA,KAAK,MAAM,GAAA,EAAK;AAAA,MACd,MAAA,EAAQ,MAAA;AAAA,MACR,SAAA,EAAW,IAAA;AAAA,MACX,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,mBAAA,EAAqB,gBAAA;AAAA,QACrB,GAAI,UAAA,GAAa,EAAE,WAAA,EAAa,UAAA,KAAe;AAAC,OAClD;AAAA,MACA;AAAA,KACD,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAEf,CAAC,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AACN,IAAA,IAAI;AACF,MAAA,IAAI,OAAO,SAAA,KAAc,WAAA,IAAe,SAAA,CAAU,UAAA,EAAY;AAC5D,QAAA,SAAA,CAAU,UAAA,CAAW,GAAA,EAAK,IAAI,IAAA,CAAK,CAAC,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,kBAAA,EAAoB,CAAC,CAAA;AAAA,MAC1E;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACF","file":"chunk-5T3J24K4.mjs","sourcesContent":["/**\n * @sonordev/site-kit shared - Resilient fetch\n *\n * Single source of truth for client-side resilient fetch (forms, SitemapSync).\n * Adds a per-attempt timeout and retries transient failures (network errors,\n * request timeouts, HTTP 429, and 5xx) with exponential backoff.\n *\n * A form submission must survive a brief API blip — a deploy, a cold start, a\n * dropped packet. A single un-retried fetch turning into \"Something went wrong\"\n * is how leads get lost. The explicit abort also matters on its own: a request\n * left to hang until the browser's own network timeout logs a console error\n * (net::ERR_TIMED_OUT) that fails Lighthouse best-practices; an aborted fetch\n * logs nothing.\n */\n\nexport interface FetchRetryOptions {\n  /** Number of retries AFTER the first attempt (default 2 → up to 3 tries total). */\n  retries?: number\n  /** Per-attempt timeout in milliseconds (default 15000). */\n  timeoutMs?: number\n}\n\nfunction backoffDelay(attempt: number, response?: Response): number {\n  // Honor a Retry-After header on 429 responses when present.\n  if (response?.status === 429) {\n    const header = response.headers.get('retry-after')\n    const seconds = header ? parseInt(header, 10) : NaN\n    if (!Number.isNaN(seconds) && seconds > 0) return Math.min(seconds * 1000, 10000)\n  }\n  // Exponential backoff: 500ms, 1s, 2s, ... capped at 8s.\n  return Math.min(8000, 500 * 2 ** attempt)\n}\n\n/**\n * fetch() with a timeout and automatic retries for transient failures.\n *\n * Non-transient responses (2xx, 3xx, and 4xx other than 429) are returned to\n * the caller as-is — only 429/5xx and thrown network/timeout errors are retried.\n * If every attempt fails with a thrown error, the last error is re-thrown.\n */\nexport async function fetchWithRetry(\n  url: string,\n  init: RequestInit,\n  options: FetchRetryOptions = {},\n): Promise<Response> {\n  const retries = options.retries ?? 2\n  const timeoutMs = options.timeoutMs ?? 15000\n  let lastError: unknown\n\n  for (let attempt = 0; attempt <= retries; attempt++) {\n    const controller = new AbortController()\n    const timer = setTimeout(() => controller.abort(), timeoutMs)\n    try {\n      const response = await fetch(url, { ...init, signal: controller.signal })\n      clearTimeout(timer)\n\n      if ((response.status === 429 || response.status >= 500) && attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt, response)))\n        continue\n      }\n      return response\n    } catch (error) {\n      clearTimeout(timer)\n      lastError = error\n      // Network failure or timeout (AbortController) — retry while attempts remain.\n      if (attempt < retries) {\n        await new Promise((resolve) => setTimeout(resolve, backoffDelay(attempt)))\n        continue\n      }\n    }\n  }\n\n  throw lastError instanceof Error\n    ? lastError\n    : new Error('Network request failed after multiple attempts. Please try again.')\n}\n","/**\n * @sonordev/site-kit shared - Canonical client transport\n *\n * Single source of truth for how site-kit talks to Sonor from the browser.\n * Every client-side module (analytics, forms, commerce, engage, maps, images,\n * SitemapSync) routes through here instead of bare fetch(), which gives the\n * whole kit, in one place:\n *\n *  - per-attempt timeout + retry with backoff (via fetchWithRetry) — a hung\n *    request left to the browser's own network timeout logs a console error\n *    (net::ERR_TIMED_OUT) that fails Lighthouse best-practices\n *  - the x-sitekit-version header on every request, so the platform can see\n *    which kit version each site actually runs from live traffic\n *  - CREDENTIAL LIFECYCLE: sites on 3.2+ ship a short-lived minted token instead\n *    of the raw key. This transport resolves the freshest token (refreshing a\n *    stale seed transparently), and on a 401/403 for a token it refreshes once\n *    and retries before giving up. A raw key (2.x kit, or the mint-failed\n *    fallback) is a pure passthrough — legacy behavior is unchanged.\n *  - an auth circuit breaker: after a 401/403 the credential is paused for a few\n *    minutes and ONE friendly console.info is emitted — a site on a stale or\n *    canceled key must not spam the API or the visitor's console. Keyed by the\n *    project (from the token) so it survives token rotation.\n *  - sonorBeacon for unload-time telemetry that keeps the credential in headers;\n *    navigator.sendBeacon can't set headers and forced the key into the URL,\n *    where server and CDN access logs capture it\n *\n * Non-idempotent endpoints (checkout, payment intents, uploads) must pass\n * { retries: 0 } — they still get the timeout, but never an automatic retry.\n */\nimport { fetchWithRetry, type FetchRetryOptions } from './fetchWithRetry'\nimport { SITE_KIT_VERSION } from './version'\nimport {\n  credentialBreakerId,\n  currentCredential,\n  getFreshCredential,\n  isSiteToken,\n  isTokenMode,\n  refreshSiteToken,\n} from './siteToken'\n\nexport interface SonorFetchOptions extends FetchRetryOptions {\n  /** Project credential — the minted token (3.2+) or raw key. Sent as x-api-key. */\n  apiKey?: string\n}\n\n/** How long a credential stays paused after an auth failure. */\nconst AUTH_BREAK_MS = 5 * 60_000\n\n// breaker id → epoch ms until which requests are paused. Shared on window for\n// the same reason as the token state (see siteToken.ts): duplicated module\n// copies must trip and observe ONE breaker, not one each. Never applies on the\n// server, so a per-module Map there is fine.\nconst BREAKER_STATE_KEY = '__SONOR_AUTH_BREAKER__'\nconst pausedKeys: Map<string, number> = (() => {\n  if (typeof window === 'undefined') return new Map()\n  const w = window as unknown as Record<string, Map<string, number> | undefined>\n  return (w[BREAKER_STATE_KEY] ??= new Map())\n})()\nlet warnedThisPage = false\n\n/** True when a previous 401/403 has paused this credential (browser only). */\nexport function isAuthPaused(credential?: string): boolean {\n  if (typeof window === 'undefined') return false\n  const id = credentialBreakerId(credential)\n  const until = pausedKeys.get(id)\n  if (!until) return false\n  if (Date.now() >= until) {\n    pausedKeys.delete(id)\n    return false\n  }\n  return true\n}\n\nfunction tripBreaker(credential?: string): void {\n  pausedKeys.set(credentialBreakerId(credential), Date.now() + AUTH_BREAK_MS)\n  if (!warnedThisPage) {\n    warnedThisPage = true\n    // info, not error: a visitor's console must stay clean (Lighthouse\n    // errors-in-console), and copy never names env vars or key formats.\n    console.info(\n      \"[Sonor] This site couldn't authenticate with Sonor, so data features are paused for a few minutes. If this keeps happening, the site is likely running an outdated API key.\",\n    )\n  }\n}\n\nexport async function sonorFetch(\n  url: string,\n  init: RequestInit = {},\n  options: SonorFetchOptions = {},\n): Promise<Response> {\n  // Resolve the credential to send. In token mode this may transparently refresh\n  // a stale seed before the first request; in raw-key mode it's a passthrough.\n  let credential = options.apiKey\n  if (credential !== undefined || isTokenMode()) {\n    credential = await getFreshCredential(options.apiKey)\n  }\n\n  const headers = new Headers(init.headers || {})\n  headers.set('x-sitekit-version', SITE_KIT_VERSION)\n  if (credential) {\n    if (isTokenMode()) {\n      // Token mode: `credential` is the freshest token (refreshed just above if\n      // the seed was stale). It MUST override any x-api-key a caller hand-set — a\n      // stale build-time seed passed as a header would otherwise pin the request\n      // and defeat refresh entirely. Also drop a caller-set Authorization:\n      // extractApiKey() server-side prefers `Authorization: Bearer` over\n      // x-api-key, so a stale Bearer seed would win even once we set a fresh\n      // x-api-key. This is the single place the client credential is chosen — do\n      // not re-attach it as a header at call sites.\n      headers.set('x-api-key', credential)\n      headers.delete('authorization')\n    } else if (!headers.has('x-api-key')) {\n      // Raw-key mode: legacy passthrough — respect a caller-supplied header.\n      headers.set('x-api-key', credential)\n    }\n  }\n\n  if (isAuthPaused(credential)) {\n    // Synthetic response keeps every caller's !response.ok path working\n    // without a network round trip while the breaker is open.\n    return new Response(null, { status: 401, statusText: 'sonor-auth-paused' })\n  }\n\n  let response = await fetchWithRetry(url, { ...init, headers }, options)\n\n  // A token can rotate or expire mid-session. On the first auth failure, try ONE\n  // refresh + retry before tripping the breaker — only for token credentials\n  // (raw keys have nothing to refresh).\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    isSiteToken(credential)\n  ) {\n    const refreshed = await refreshSiteToken()\n    if (refreshed && refreshed !== credential) {\n      const retryHeaders = new Headers(init.headers || {})\n      retryHeaders.set('x-sitekit-version', SITE_KIT_VERSION)\n      retryHeaders.set('x-api-key', refreshed)\n      // Same reason as the initial request: a caller-set stale Bearer would win\n      // over our fresh x-api-key server-side, so strip it on the retry too.\n      retryHeaders.delete('authorization')\n      credential = refreshed\n      response = await fetchWithRetry(url, { ...init, headers: retryHeaders }, options)\n    }\n  }\n\n  if (\n    (response.status === 401 || response.status === 403) &&\n    typeof window !== 'undefined' &&\n    credential\n  ) {\n    tripBreaker(credential)\n  }\n\n  return response\n}\n\n/**\n * Fire-and-forget telemetry that survives page unload.\n *\n * Uses fetch({ keepalive: true }) so auth travels in headers. Falls back to\n * navigator.sendBeacon (no auth headers possible — the server may reject it,\n * but we never put the key in the URL) only when keepalive fetch is missing.\n *\n * Cannot await a refresh at unload time, so it sends the freshest token already\n * held (currentCredential) rather than the possibly-stale seed the caller passed.\n */\nexport function sonorBeacon(url: string, payload: unknown, apiKey?: string): void {\n  const credential = currentCredential(apiKey)\n  const body = typeof payload === 'string' ? payload : JSON.stringify(payload)\n  try {\n    void fetch(url, {\n      method: 'POST',\n      keepalive: true,\n      headers: {\n        'Content-Type': 'application/json',\n        'x-sitekit-version': SITE_KIT_VERSION,\n        ...(credential ? { 'x-api-key': credential } : {}),\n      },\n      body,\n    }).catch(() => {\n      /* page is closing — best effort */\n    })\n  } catch {\n    try {\n      if (typeof navigator !== 'undefined' && navigator.sendBeacon) {\n        navigator.sendBeacon(url, new Blob([body], { type: 'application/json' }))\n      }\n    } catch {\n      /* nothing left to try */\n    }\n  }\n}\n"]}