@sonordev/site-kit 7.3.0 → 8.0.0

package/AGENTS.md

@@ -1,8 +1,8 @@
-# Integrating a site with Sonor — agent guide
+# Integrating a site with Sonor: agent guide
 
 > **You installed `@sonordev/site-kit`.** This file tells a coding agent how to
-> wire a Next.js site to Sonor correctly and prove it works — no web access
-> needed. **Editing site-kit itself?** See `CONTRIBUTING.md`.
+> wire a Next.js site to Sonor correctly and prove it works, with no web
+> access needed. **Editing site-kit itself?** See `CONTRIBUTING.md`.
 
 For the full machine-readable contract (modules, env, blessed patterns, failure
 modes, exit codes) run:
@@ -16,7 +16,7 @@ Everything below is also in that manifest. This file is the human-skimmable vers
 ## North star
 
 Take a bare Next.js repo → a fully wired, **verified-green** Sonor site. The
-signal that you are done is `verify` exiting 0 — not "the command ran."
+signal that you're done is `verify` exiting 0, not "the command ran."
 
 ## Canonical sequence
 
@@ -28,6 +28,9 @@ npx sonor-setup mcp --yes --json                             # agent tools: MCP
 # Existing 2.x-6.x site? migrate deterministically:
 npx sonor-setup codemod --check --json                       # exit 1 ⇒ work pending
 npx sonor-setup codemod --write --json                       # apply (idempotent, minimal diffs)
+# 7.x site that imports commerce? One more hop (commerce moved to @sonordev/commerce-kit):
+npx sonor-setup codemod --only site-kit-8 --write --json     # swaps the package name in its imports
+pnpm install                                                 # the codemod edits package.json, not node_modules (or npm / yarn)
 next build                                                   # you run the build
 npx sonor-setup verify --json                                # exit 0 === done
 ```
@@ -38,7 +41,7 @@ npx sonor-setup verify --json                                # exit 0 === done
   envelope to stdout (all human logs go to stderr). Parse stdout; branch on
   `exitCode` / `ok` / `checks`.
 - **Exit codes:** `0` OK · `1` FAILED (result is red, fix the code) · `2` USAGE
-  (bad invocation) · `3` CONFIG (missing input — the error names the flag) · `4`
+  (bad invocation) · `3` CONFIG (missing input; the error names the flag) · `4`
   NETWORK (API/key) · `5` INTERNAL.
 - **Never interactive under `--json`, `--yes`, or a non-TTY.** A command that
   needs input exits `3` with an actionable `fix` instead of hanging.
@@ -50,17 +53,17 @@ npx sonor-setup verify --json                                # exit 0 === done
 The **only** variable a site needs is:
 
 ```bash
-SONOR_API_KEY=sonor_1a2b3c4d_...   # server-side only — NO NEXT_PUBLIC_ prefix
+SONOR_API_KEY=sonor_1a2b3c4d_...   # server-side only, NO NEXT_PUBLIC_ prefix
 ```
 
 `SiteKitLayout` reads it server-side and derives the project id + all client
 config. **Never** add `NEXT_PUBLIC_SONOR_API_KEY`, `UPTRADE_API_KEY`,
-`NEXT_PUBLIC_UPTRADE_API_KEY`, or `SONOR_PROJECT_ID`. Uptrade keys/vars are fully
-deprecated. Key format: `sonor_{project-uuid-first8}_{secret}`.
+`NEXT_PUBLIC_UPTRADE_API_KEY`, or `SONOR_PROJECT_ID`. Pre-rebrand keys and
+variables are fully deprecated. Key format: `sonor_{project-uuid-first8}_{secret}`.
 
 ## Blessed patterns
 
-**Root layout — `SiteKitLayout` (a server component), wrap `{children}`:**
+**Root layout: `SiteKitLayout` (a server component), wrap `{children}`:**
 
 ```tsx
 import { SiteKitLayout } from '@sonordev/site-kit/layout'
@@ -95,7 +98,7 @@ wrap around `{children}` that skips server rendering, usually
 a hand-rolled deferred sibling was the workaround for site-kit <3.0.2. On those
 installs, upgrade.
 
-**Agent tools — the built-in Sonor MCP server (7.0).** Don't hand-write
+**Agent tools: the built-in Sonor MCP server (7.0).** Don't hand-write
 business-info, FAQ or review tools; `npx sonor-setup mcp` wires
 `sonorMcpServer` from `@sonordev/site-kit/mcp/sonor`, and a site's own tools
 go in its `tools` array. `send_inquiry` needs the person's go-ahead
@@ -109,6 +112,30 @@ and so should you; add reporting to it rather than replacing it.
 `/website/images`, `/seo/llms`), never the root, which is types-only. The
 package is ESM only.
 
+**Commerce and memberships (8.0).** Commerce isn't in site-kit any more, and
+memberships is new and ships only in commerce-kit. Products, services, events,
+checkout and memberships are
+[`@sonordev/commerce-kit`](https://sonor.dev/commerce-kit), which builds on
+site-kit and releases on its own. Install it beside site-kit and import from
+`@sonordev/commerce-kit/commerce`, `/commerce/server`, `/memberships` or
+`/memberships/server`; its root entry is types-only (`CommerceOffering` and the
+other commerce types). The old site-kit commerce entries are gone, so don't
+import commerce from site-kit; `npx sonor-setup manifest --json` lists every
+moved subpath under `relocated`, the types the root used to export under
+`relocatedTypes`, and what was retired for good under `removed`. A 7.x site
+that sells moves with
+`npx sonor-setup codemod --only site-kit-8 --write` (the guide is
+[Moving a site to site-kit 8](docs/MIGRATING-TO-8.md)). The opt-in
+`list_offerings` agent tool needs a reader since 8.0:
+`sonorMcpServer({ businessName, offerings: { path: '/shop', read: getOfferingsResult } })`,
+with `getOfferingsResult` from `@sonordev/commerce-kit/commerce/server`.
+
+**Building a package on top of site-kit** (a kit, as commerce-kit is)? Take the
+browser transport from `@sonordev/site-kit/runtime` (`sonorFetch`,
+`getClientApiConfig`) and server data from `@sonordev/site-kit/server`, and
+don't read `window.__SITE_KIT_*` or call `fetch` on the Sonor API yourself. List
+site-kit as a peer dependency. See [Building a kit](src/runtime/README.md).
+
 ## Common failure modes → the check that catches it
 
 | Symptom | Cause | Fix | `doctor`/`verify` check |
@@ -118,7 +145,8 @@ package is ESM only.
 | Invalid-key console spam; data features paused (401/403) | Stale/rotated key, or an env change wasn't redeployed | Put the current `sonor_` key in `.env.local` and redeploy | `key.valid` |
 | Deprecated `SiteKitProvider` in layout | 2.x integration | `npx sonor-setup codemod --only provider-to-layout --write` | `layout.sitekit` |
 | `@uptrademedia/site-kit` / `UPTRADE_*` remnants | pre-rebrand site | `npx sonor-setup codemod --only uptrade-to-sonor --write` | `package.installed` / `env.api-key` |
-| Hero present but LCP late | above-the-fold element is `opacity:0` + JS entrance-animated | Render hero fully static; gate reveal animations below the fold | — |
+| Hero present but LCP late | above-the-fold element is `opacity:0` + JS entrance-animated | Render hero fully static; gate reveal animations below the fold | none |
+| Build can't resolve a site-kit commerce path (`Can't resolve '@sonordev/site-kit/commerce'`, or `Package subpath './commerce' is not defined by "exports"`) | The site is on site-kit 8, where commerce moved to `@sonordev/commerce-kit` | `npm install @sonordev/commerce-kit`, then `npx sonor-setup codemod --only site-kit-8 --write`, then build | none |
 
 ## Verifying (definition of done)
 
@@ -128,5 +156,5 @@ npx sonor-setup verify --url https://your-site.com --json   # SSR check against
 ```
 
 `verify` exits `0` only when the integration is genuinely green. If it exits
-non-zero, read `checks[]` — each red check carries a `fix` (and often a
+non-zero, read `checks[]`; each red check carries a `fix` (and often a
 `fixCommand`), and `nextSteps[]` names what to run. Loop until green.

package/CHANGELOG.md

@@ -1,5 +1,78 @@
 # @sonordev/site-kit Changelog
 
+## 8.0.0
+
+Two things leave site-kit in this release. Commerce (products, services, events and checkout) and the new memberships module move into their own package, [`@sonordev/commerce-kit`](https://sonor.dev/commerce-kit), which versions and releases on its own. And the entries for the modules Sonor retired, Engage and the Sanity CMS, are removed, as the 7.0, 7.1 and 7.2 notes said they'd be. A site that uses neither changes nothing: update site-kit and rebuild.
+
+The commerce move is about release independence and package surface, not bundle size. site-kit's root entry was already types-only and no core entry referenced commerce, so visitors to a site without commerce never downloaded any of it. What changes is that checkout, the busiest money path on a site, can ship a fix without a site-kit release, and site-kit's package is about 8% smaller to download and about 13% smaller on disk than 7.4.0.
+
+### Breaking: commerce moved to commerce-kit
+
+`@sonordev/site-kit/commerce` and `@sonordev/site-kit/commerce/server` are removed, and the root entry no longer re-exports the commerce types. Nothing is left behind at the old paths, so an import you miss fails the build. The subpath stays the same, so it's a swap of the package name:
+
+| Was | Now |
+|---|---|
+| `@sonordev/site-kit/commerce` | `@sonordev/commerce-kit/commerce` |
+| `@sonordev/site-kit/commerce/server` | `@sonordev/commerce-kit/commerce/server` |
+| Commerce types imported from the root, `@sonordev/site-kit` | `@sonordev/commerce-kit` |
+
+The root types were `CommerceOffering`, `CommerceCategory`, `CommerceVariant`, `CommerceSchedule`, `OfferingType`, `Cart`, `CartItem`, `EventCheckoutProps` and `CheckoutLineItem`. Install `@sonordev/commerce-kit` beside site-kit 8; it lists site-kit 8 or newer as a peer dependency.
+
+The codemod (sonor-setup 7.3.0 or later) does the swap. `npx sonor-setup codemod --only site-kit-8` shows what it would change and writes nothing; add `--write` to apply it. It rewrites the imports, then adds `@sonordev/commerce-kit` to package.json and raises site-kit's range to `^8.0.0` when your code imports commerce, and it flags anything it can't rewrite safely, such as an `offerings` option with no reader. Then install and build. The full guide is [docs/MIGRATING-TO-8.md](docs/MIGRATING-TO-8.md).
+
+The new entries export what the old ones did, under the same names, and your styles still apply: the components keep their `site-kit-` class names, and brand tokens still come from site-kit's `brand.css`, which your site imports as before. A few things behave better, all listed in [commerce-kit's changelog](https://sonor.dev/commerce-kit/changelog): the shopping events now reach Sonor, server helpers return whole offerings and cache them under a tag Sonor expires when you edit, and a product marked sold out keeps its page. In your server log, a failed fetch starts with `[commerce-kit]` instead of `[site-kit/commerce]`.
+
+Memberships is new in this release and ships only in commerce-kit; it was never part of a site-kit release. See [Memberships](https://sonor.dev/commerce-kit/memberships).
+
+### Breaking: the retired Engage and CMS entries are removed
+
+Both modules were retired in Sonor, nothing renders from them any more, and their entries were kept through 7.x so old imports kept building. They're gone, with nothing to replace them:
+
+- **`@sonordev/site-kit/engage`.** Website chat is `@sonordev/site-kit/chat` and popups are `@sonordev/site-kit/website/popups`. `npx sonor-setup codemod --write` moves each name that has a home there and flags the rest (`EngageWidget`, which `SiteKitLayout` already mounts for you). The deprecated type names the root re-exported from it (`EngageElement`, `WidgetConfig` and the rest) are gone too: use `SitePopup` and `SitePopupConfig`.
+- **`@sonordev/site-kit/cms`, `/cms/server`, `/website/cms` and `/website/cms/server`,** with their optional peer dependencies `@portabletext/react` and `@sanity/image-url`, which you can uninstall. No project has CMS pages and Sonor no longer serves them. Site copy is managed copy: `ManagedSlot`, `ManagedRichText`, `ManagedLink` and `ManagedList` from `@sonordev/site-kit/website/slots`.
+- **`ManagedContent`, `getManagedContentData` and `getContentBlock`** from `@sonordev/site-kit/seo`, and their types. Content blocks are retired for the same reason; use `ManagedRichText`.
+
+The codemod flags an import of any of these with the fix, and `npx sonor-setup manifest --json` lists them under `removed`. Nothing else changes for a site that never imported them.
+
+### MCP: offerings need a reader
+
+`list_offerings`, the opt-in agent tool for priced products, services and events, used to read commerce directly. It takes its reader as an option now, so site-kit doesn't depend on commerce-kit. The tool, its ranking and its rule that a private price is never shown stay in site-kit.
+
+```ts
+// 7.x
+sonorMcpServer({ businessName: 'Example Studio', offerings: { path: '/shop' } })
+
+// 8.0
+import { getOfferingsResult } from '@sonordev/commerce-kit/commerce/server'
+
+sonorMcpServer({ businessName: 'Example Studio', offerings: { path: '/shop', read: getOfferingsResult } })
+```
+
+`getOfferingsResult` reports a failed request as "the catalog is unavailable"; the plain `getOfferings` also works, but it reads an outage as an empty catalog. A site that doesn't pass `offerings` changes nothing, and `list_services` is unchanged (it reads core data). Without `read`, `sonorMcpServer` throws when the server is built, with a message that says what to pass. See [MCP and agent tools](src/mcp/README.md).
+
+### New: `@sonordev/site-kit/runtime`
+
+The browser transport and API-address reader that packages built on site-kit share: `sonorFetch` (the site credential, retries with a timeout, one token refresh, and a pause after an authentication failure) and `getClientApiConfig`, plus `readAnalyticsIdentity` for the visitor's analytics ids. commerce-kit is built on it, and it's public API under semver. A site doesn't need to import it, since forms, analytics and the other modules already go through it. See [Building a kit](src/runtime/README.md).
+
+### What isn't affected
+
+A site that doesn't import commerce, one of the removed entries, or pass `offerings` to `sonorMcpServer` changes nothing. The other deprecated paths from 7 still work, because sites still import them: `./middleware` (with `createMiddleware`), `./sitemap`, `./robots`, `./redirects`, `./og`, `./llms`, `./images`, `./slots`, `./landing` and `./cta-bar`, plus `SiteKitLayout`'s `engage` prop and the options that are accepted and ignored. Earlier notes said they'd go in 8.0; they stay until sites have moved off them, and will go in a later major. `npx sonor-setup codemod --write` moves a site onto the new homes whenever you like.
+
+### Also
+
+- **SEO: pages get a self-referencing canonical by default** (`alternates.canonical './'`, resolved against `metadataBase`) when Sonor has none set. `getManagedMetadata` takes a new `scope: 'layout'` option, so a root or shared layout doesn't hand one path's managed canonical and hreflang to every route beneath it, and `alternates` now merge key by key (in `getManagedMetadata` and `withManagedMetadata`), so a page that sets only `languages` keeps its canonical. See [Canonical URLs](src/seo/README.md#canonical-urls).
+- **Server fetches let Next steer the render.** `serverApiFetch` caught the errors Next throws on purpose (a page turning dynamic during the build, `redirect()`, `notFound()`) like failed requests: it retried them and then returned nothing, so such a page could be built with no data. It passes them on now. Kits that make their own server calls get the same check as `isNextControlFlow` from `@sonordev/site-kit/server`, which also exports `SITE_CACHE_TAGS`, the cache tags Sonor expires through [Live updates](src/revalidate/README.md). There's a new one, `commerce`, for products, events and membership plans.
+- **Pages keep working when the browser blocks site storage.** The visitor and session ids are set up while the page first renders, and a browser set to block site data threw an error right there, which could break the whole page. The ids now stay in memory for that page instead, and forms, popups and analytics carry on with them.
+- Browser modules read the Sonor API address and site credential from one place. During server rendering, booking, Signal and the form helpers now follow `SONOR_API_URL` like forms already did, so a staging site's server-rendered URLs point at staging. commerce-kit gets the same behavior through `@sonordev/site-kit/runtime`.
+- **Autocomplete tokens for forms you draw yourself.** `autocompleteFor` is now exported from `@sonordev/site-kit/forms`. A form built with `useForm` can set `autoComplete={autocompleteFor(field)}` on its own controls and get the same token a `ManagedForm` control gets (`given-name`, `email`, `tel` and so on, or none when a field has no confident match), so a custom form no longer needs a list of its own. The type of its argument is exported as `AutocompleteField`. See [Autocomplete on your own controls](src/forms/README.md#autocomplete-on-your-own-controls).
+- **The `stage` form layout meets WCAG AA contrast.** Its step numbers and the labels of answered steps measured between 3.4:1 and 4:1 against white, under the 4.5:1 AA asks for small text; they sit at about 5:1 now, and are still quieter than an open step's label.
+
+## 7.4.0
+
+- Reviews can include a project-managed photo, caption, and alternative text. Text-only reviews remain visible while imagery is pending for Broadcast.
+- `VisualReviewCard` and `VisualReviewGallery` are available from the server-safe reputation entry point. `TestimonialSection` also displays attached review photos.
+- Token minting supports a cold Next.js Cache Components prerender, including the default 404 page. Each mint stays fresh across deploys and token expiry, without changing form initialization or putting a raw API key into successful token responses.
+
 ## 7.3.0
 
 AI assistants can discover a site's existing MCP tools through more of the surfaces they read.

package/README.md

@@ -1,6 +1,6 @@
 # @sonordev/site-kit
 
-All-in-one integration kit for [Sonor](https://sonor.io)-powered Next.js sites. One package, one env var, every module: SEO, Analytics, Forms, Articles, Commerce, Website chat, Popups, GEO/AEO, Booking, Reputation, A/B Testing, and more — all managed from the Sonor dashboard at [app.sonor.io](https://app.sonor.io).
+All-in-one integration kit for [Sonor](https://sonor.io)-powered Next.js sites. One package, one env var, and the modules a site needs: SEO, Analytics, Forms, Articles, Website chat, Popups, GEO/AEO, Booking, Reputation, A/B Testing, and more, all managed from the Sonor dashboard at [app.sonor.io](https://app.sonor.io). Products, events and memberships come from the companion package [`@sonordev/commerce-kit`](https://sonor.dev/commerce-kit), which builds on site-kit.
 
 ## Install
 
@@ -8,6 +8,14 @@ All-in-one integration kit for [Sonor](https://sonor.io)-powered Next.js sites.
 npm install @sonordev/site-kit
 ```
 
+Selling products, events or memberships? Add the companion package too: `npm install @sonordev/commerce-kit`. See [Commerce and memberships](#commerce-and-memberships).
+
+## What's new in 8.0
+
+- **Commerce and memberships are their own package.** Products, services, events, checkout and the new memberships module now live in [`@sonordev/commerce-kit`](https://sonor.dev/commerce-kit), which builds on site-kit and releases on its own. A site that doesn't sell anything changes nothing. A site that does swaps the package name in its imports: `npx sonor-setup codemod --only site-kit-8 --write`, then install and build. See [docs/MIGRATING-TO-8.md](docs/MIGRATING-TO-8.md).
+- **The retired Engage and CMS entries are removed,** as the 7.x notes said: `@sonordev/site-kit/engage`, `/cms` and `/website/cms`, and `ManagedContent` with its data helpers. A site that never imported them changes nothing. The deprecated aliases for renamed modules (`./middleware`, `./og`, `./llms` and the rest) still work.
+- **A documented entry for kits.** [`@sonordev/site-kit/runtime`](src/runtime/README.md) is the browser transport and API-address reader that packages like commerce-kit build on.
+
 ## What's new in 7.0
 
 - **Agents can use the site.** `npx sonor-setup mcp` serves the built-in
@@ -75,7 +83,7 @@ export const config = {
 
 Handles Sonor-managed redirects, security headers, and AI discovery headers.
 
-**CLI (optional — scaffolds everything):**
+**CLI (optional, scaffolds everything):**
 
 ```bash
 npx sonor-setup init
@@ -97,7 +105,7 @@ Every module has its own README in `src/<module>/README.md` with full API docs,
 | **SEO** | `@sonordev/site-kit/seo` | Managed metadata, schemas, FAQs, internal links | [README](src/seo/README.md) |
 | **Analytics** | `@sonordev/site-kit/analytics` | Page views, events, conversions, Web Vitals | [README](src/analytics/README.md) |
 | **Sitemap** | `@sonordev/site-kit/seo/sitemap` | Auto-generated sitemap with Sonor sync. URLs follow next.config `trailingSlash` | [README](src/sitemap/README.md) |
-| **Proxy** | `@sonordev/site-kit/proxy` | Redirects, security headers, AI discovery (`./middleware` is its 7.x alias) | [README](src/proxy/README.md) |
+| **Proxy** | `@sonordev/site-kit/proxy` | Redirects, security headers, AI discovery (`./middleware` is a deprecated alias) | [README](src/proxy/README.md) |
 | **Redirects** | `@sonordev/site-kit/seo/redirects` | Sonor-managed 301/302 redirect rules | [README](src/redirects/README.md) |
 
 ### Content
@@ -115,14 +123,19 @@ Every module has its own README in `src/<module>/README.md` with full API docs,
 | **Website chat** | `@sonordev/site-kit/chat` | The chat launcher and Echo (Sonor → Messages) | [README](src/chat/README.md) |
 | **Popups & Banners** | `@sonordev/site-kit/website/popups` | Popups, banners and toasts from Sonor → Website, drawn in the site's own design | [README](src/website/README.md) |
 | **Forms** | `@sonordev/site-kit/forms` | Managed forms with CRM routing, multi-step, validation | [README](src/forms/README.md) |
+| **Sync** | `@sonordev/site-kit/sync` | Booking/scheduling widget (Calendly-like) | [README](src/sync/README.md) |
 | **Signal** | `@sonordev/site-kit/signal` | A/B experiments, behavior tracking, real-time config | [README](src/signal/README.md) |
 
-### Commerce
+### Commerce and memberships
+
+Products, services, events, checkout and memberships live in [`@sonordev/commerce-kit`](https://sonor.dev/commerce-kit), which builds on site-kit and releases on its own. Install it beside site-kit: `npm install @sonordev/commerce-kit`. Each module also has a `/server` entry for server components and route handlers.
 
 | Module | Import | Purpose | Docs |
 |--------|--------|---------|------|
-| **Commerce** | `@sonordev/site-kit/commerce` | Products, services, events, checkout | [README](src/commerce/README.md) |
-| **Sync** | `@sonordev/site-kit/sync` | Booking/scheduling widget (Calendly-like) | [README](src/sync/README.md) |
+| **Commerce** | `@sonordev/commerce-kit/commerce` | Products, services, events, checkout | [Docs](https://sonor.dev/commerce-kit/commerce) |
+| **Memberships** | `@sonordev/commerce-kit/memberships` | Sell a membership and let members in | [Docs](https://sonor.dev/commerce-kit/memberships) |
+
+Upgrading a site that imports commerce from site-kit? That entry moved in 8.0: see [Moving a site to site-kit 8](docs/MIGRATING-TO-8.md).
 
 ### GEO / AEO (AI Visibility)
 
@@ -135,13 +148,13 @@ Every module has its own README in `src/<module>/README.md` with full API docs,
 
 ### Motion
 
-Three tiers as three subpaths — a site only installs and ships what it imports. Server HTML always stays visible; above-the-fold content is never animated in.
+Three tiers as three subpaths: a site only installs and ships what it imports. Server HTML always stays visible; above-the-fold content is never animated in.
 
 | Module | Import | Purpose | Docs |
 |--------|--------|---------|------|
-| **Motion** | `@sonordev/site-kit/motion` | `<Reveal>`, `<Parallax>`, `<ScrollScene>` and the scroll engine — zero deps, ~2KB | [README](src/motion/README.md) |
-| **Motion / GSAP** | `@sonordev/site-kit/motion/gsap` | Lazy-loaded GSAP timelines (`useGsap`) — optional peer `gsap` | [README](src/motion/README.md) |
-| **Motion / three** | `@sonordev/site-kit/motion/three` | WebGL stages on the engine (`useThreeStage`) — optional peer `three` | [README](src/motion/README.md) |
+| **Motion** | `@sonordev/site-kit/motion` | `<Reveal>`, `<Parallax>`, `<ScrollScene>` and the scroll engine; zero deps, ~2KB | [README](src/motion/README.md) |
+| **Motion / GSAP** | `@sonordev/site-kit/motion/gsap` | Lazy-loaded GSAP timelines (`useGsap`); optional peer `gsap` | [README](src/motion/README.md) |
+| **Motion / three** | `@sonordev/site-kit/motion/three` | WebGL stages on the engine (`useThreeStage`); optional peer `three` | [README](src/motion/README.md) |
 
 ### Liquid Glass chrome
 
@@ -151,6 +164,12 @@ Three tiers as three subpaths — a site only installs and ships what it imports
 
 Echo's launcher and chat window use the same glass recipe; see [Website chat](src/chat/README.md#liquid-glass-610).
 
+### For kits built on site-kit
+
+| Module | Import | Purpose | Docs |
+|--------|--------|---------|------|
+| **Runtime** | `@sonordev/site-kit/runtime` | The browser transport (`sonorFetch`) and API-address reader that packages like commerce-kit build on. A site doesn't need it | [README](src/runtime/README.md) |
+
 ---
 
 ## How It Works
@@ -199,12 +218,15 @@ import { AnalyticsProvider, useAnalytics, WebVitals } from '@sonordev/site-kit/a
 // Forms
 import { ManagedForm, useForm, formsApi, field } from '@sonordev/site-kit/forms'
 
-// Articles (server components — keeps server-only data helpers out of client bundles)
+// Articles (server components; keeps server-only data helpers out of client bundles)
 import { Article, ArticleList, ClusterLandingPage } from '@sonordev/site-kit/articles/server-ui'
 import { getArticle, generateArticleStaticParams } from '@sonordev/site-kit/articles/server'
 
-// Commerce
-import { OfferingCard, ProductPage, EventCalendar } from '@sonordev/site-kit/commerce'
+// Commerce and memberships are their own package: npm install @sonordev/commerce-kit
+import { OfferingCard, ProductPage, EventCalendar } from '@sonordev/commerce-kit/commerce'
+import { getOfferingBySlug } from '@sonordev/commerce-kit/commerce/server'
+import { MembershipCheckoutButton } from '@sonordev/commerce-kit/memberships'
+import type { CommerceOffering } from '@sonordev/commerce-kit'
 
 // Booking
 import { BookingWidget } from '@sonordev/site-kit/sync'
@@ -240,7 +262,7 @@ import { handleManagedRedirects } from '@sonordev/site-kit/seo/redirects'
 // Robots (the AI crawler helpers live in /llms; /robots re-exports them)
 import { createRobots, buildAiCrawlerRules, createRobotsTxtHandler } from '@sonordev/site-kit/seo/robots'
 
-// Motion (tier 0, zero deps) — tiers 1/2 need `npm i gsap` / `npm i three`
+// Motion (tier 0, zero deps); tiers 1/2 need `npm i gsap` / `npm i three`
 import { Reveal, Parallax, ScrollScene, registerScene } from '@sonordev/site-kit/motion'
 import { useGsap } from '@sonordev/site-kit/motion/gsap'
 import { useThreeStage, canRunWebGL } from '@sonordev/site-kit/motion/three'
@@ -248,6 +270,9 @@ import { useThreeStage, canRunWebGL } from '@sonordev/site-kit/motion/three'
 // Liquid Glass mobile CTA bar (server component; pass Next Link via `as`)
 import { CtaBar, CtaBarAction } from '@sonordev/site-kit/website/cta-bar'
 
+// Building a package on site-kit (a kit, like commerce-kit): the browser transport
+import { sonorFetch, getClientApiConfig } from '@sonordev/site-kit/runtime'
+
 // Styles (optional)
 import '@sonordev/site-kit/brand.css'
 import '@sonordev/site-kit/forms/styles.css'
@@ -258,7 +283,7 @@ import '@sonordev/site-kit/forms/styles.css'
 ## Environment Variables
 
 ```bash
-# Required (server-only — SiteKitLayout injects into client automatically):
+# Required (server-only; SiteKitLayout injects into client automatically):
 SONOR_API_KEY=sonor_xxxxxxxx_xxxxx
 
 # Optional:
@@ -268,7 +293,7 @@ REVALIDATION_SECRET=your_secret                  # On-demand ISR for llms.txt
 MCP_TRANSPORT_SECRET=...                         # Netlify MCP relay (npx sonor-setup mcp writes it)
 ```
 
-Uptrade-era variables (`UPTRADE_API_KEY`, `NEXT_PUBLIC_UPTRADE_API_KEY`) aren't read, and `uptrade_` keys aren't accepted. A site that only sets those runs with no key. Move it to `SONOR_API_KEY` with `npx sonor-setup codemod --only uptrade-to-sonor --write`.
+The pre-rebrand variables (`UPTRADE_API_KEY`, `NEXT_PUBLIC_UPTRADE_API_KEY`) aren't read, and keys with the old `uptrade_` prefix aren't accepted. A site that only sets those runs with no key. Move it to `SONOR_API_KEY` with `npx sonor-setup codemod --only uptrade-to-sonor --write`.
 
 ---
 
@@ -312,19 +337,20 @@ Fully typed. All types are exported from their respective module paths:
 import type { LLMsDataResponse, GenerateLLMSTxtOptions } from '@sonordev/site-kit/seo/llms'
 import type { ManagedFormConfig, UseFormReturn } from '@sonordev/site-kit/forms'
 import type { Article, TopicCluster } from '@sonordev/site-kit/articles'
-import type { CommerceOffering, SizeChart } from '@sonordev/site-kit/commerce'
 import type { SiteKitLayoutProps } from '@sonordev/site-kit/layout'
+import type { CommerceOffering } from '@sonordev/commerce-kit'   // commerce types live in commerce-kit
 ```
 
 ---
 
 ## Architecture Note
 
-`@sonordev/site-kit` is the client bridge between Next.js marketing sites and the Sonor platform. All persistent data (forms, articles, SEO config, analytics) lives in Sonor — site-kit fetches, renders, and tracks.
+`@sonordev/site-kit` is the client bridge between Next.js marketing sites and the Sonor platform. All persistent data (forms, articles, SEO config, analytics) lives in Sonor; site-kit fetches, renders, and tracks.
 
 - **Server components** (SEO, Articles, Images): Import directly, RSC-compatible, no provider needed
 - **Client modules** (Analytics, chat, popups, Signal): Lazy-loaded via `SiteKitLayout`, tree-shaken
 - **Build-time** (Sitemap, llms.txt): Run during `next build`, sync to Sonor
 - **Middleware** (Redirects, Security, AI Discovery): Runs on every request edge
+- **Kits** (commerce-kit): Packages that build on site-kit's public entries (`runtime`, `analytics`, `server`) and release on their own
 
 Full docs for every module: [sonor.dev](https://sonor.dev).

package/agent-manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@sonordev/site-kit",
-  "version": "7.3.0",
+  "version": "8.0.0",
   "description": "Machine-readable manifest for coding agents integrating a site with Sonor. See AGENTS.md (shipped) and docs/SITE-KIT-AGENT-NATIVE.md.",
   "env": {
     "required": [
@@ -27,7 +27,7 @@
     "npx sonor-setup manifest --json",
     "npx sonor-setup init --api-key $SONOR_API_KEY --yes --json",
     "npx sonor-setup scaffold --yes --json",
-    "npx sonor-setup codemod --check --json   # an existing 2.x–6.x site → migrate (--write) if exit 1",
+    "npx sonor-setup codemod --check --json   # an existing 2.x–7.x site → migrate (--write) if exit 1",
     "next build",
     "npx sonor-setup verify --json            # exit 0 === done"
   ],
@@ -54,7 +54,7 @@
       "name": "codemod",
       "json": true,
       "interactive": false,
-      "purpose": "Deterministic migration of a 2.x-6.x site to the current site-kit (uptrade-to-sonor, provider-to-layout, analytics-sibling, site-kit-7, next-16-proxy). Dry-run by default; --write applies; --check gates (exit 1 if pending)."
+      "purpose": "Deterministic migration of a 2.x-7.x site to the current site-kit (uptrade-to-sonor, provider-to-layout, analytics-sibling, site-kit-7, site-kit-8, next-16-proxy). site-kit-8 moves commerce imports to @sonordev/commerce-kit and adds the dependency. Dry-run by default; --write applies; --check gates (exit 1 if pending)."
     },
     {
       "name": "manifest",
@@ -135,18 +135,6 @@
       "purpose": "Page views, scroll depth, web vitals, heatmap clicks.",
       "caution": "SiteKitLayout already mounts this as a deferred, childless sibling (site-kit >=3.0.2); configure it with analytics={{ ... }} rather than mounting it yourself. Never wrap {children} in AnalyticsProvider: it puts analytics in the hydration path, and lazy-loaded with next/dynamic({ ssr: false }) it de-opts the route to client rendering (SSR bailout). Track custom events with the standalone trackEvent / trackConversion (no provider needed); useAnalytics() throws outside a provider."
     },
-    {
-      "name": "engage",
-      "import": "@sonordev/site-kit/engage",
-      "side": "client",
-      "purpose": "Deprecated alias, kept through 7.x: Engage was retired in Sonor. Re-exports ./chat (ChatWidget, chat types) and ./website/popups under the old names; EngageWidget draws SiteChat and SitePopups.",
-      "caution": "Import ./chat or ./website/popups instead, or let SiteKitLayout mount both (its chat and popups props). DesignRenderer (Engage Studio) is gone; popups render from blocks.",
-      "stability": "deprecated",
-      "movedTo": [
-        "@sonordev/site-kit/chat",
-        "@sonordev/site-kit/website/popups"
-      ]
-    },
     {
       "name": "signal",
       "import": "@sonordev/site-kit/signal",
@@ -188,17 +176,6 @@
       "side": "server",
       "purpose": "RSC-safe article UI: Article, ArticleList, PublicationLayout, PublicationSidebar, RelatedPosts, ClusterLandingPage, ClusterNavigation, and page helpers. Pass a shared routing object (basePath defaults to /articles) so a site keeps its own publication path. Article art, complete generated cards and themed table scrolling are handled by default."
     },
-    {
-      "name": "commerce",
-      "import": "@sonordev/site-kit/commerce",
-      "side": "mixed",
-      "purpose": "Products, services, events, checkout."
-    },
-    {
-      "name": "commerce/server",
-      "import": "@sonordev/site-kit/commerce/server",
-      "side": "unknown"
-    },
     {
       "name": "sync",
       "import": "@sonordev/site-kit/sync",
@@ -420,17 +397,6 @@
       "import": "@sonordev/site-kit/website/slots/contract",
       "side": "unknown"
     },
-    {
-      "name": "website/cms",
-      "import": "@sonordev/site-kit/website/cms",
-      "side": "mixed",
-      "purpose": "Deprecated in 7.1, removed in 8.0: the retired Sanity CMS. Use slots (managed copy) instead."
-    },
-    {
-      "name": "website/cms/server",
-      "import": "@sonordev/site-kit/website/cms/server",
-      "side": "unknown"
-    },
     {
       "name": "website/landing",
       "import": "@sonordev/site-kit/website/landing",
@@ -613,25 +579,6 @@
       "side": "server",
       "purpose": "Next.js config helper (image formats, etc.)."
     },
-    {
-      "name": "cms",
-      "import": "@sonordev/site-kit/cms",
-      "side": "mixed",
-      "purpose": "Deprecated in 7.1, removed in 8.0: the retired Sanity CMS. Use slots (managed copy) instead.",
-      "stability": "deprecated",
-      "movedTo": [
-        "@sonordev/site-kit/website/cms"
-      ]
-    },
-    {
-      "name": "cms/server",
-      "import": "@sonordev/site-kit/cms/server",
-      "side": "unknown",
-      "stability": "deprecated",
-      "movedTo": [
-        "@sonordev/site-kit/website/cms/server"
-      ]
-    },
     {
       "name": "maps",
       "import": "@sonordev/site-kit/maps",
@@ -676,6 +623,13 @@
       "side": "client",
       "purpose": "useDeferredActivation + shared identity for deferred, non-blocking client work; VisualViewportGap keeps fixed bottom UI (the Echo launcher included) on screen when a phone's layout viewport is taller than the visible one."
     },
+    {
+      "name": "runtime",
+      "import": "@sonordev/site-kit/runtime",
+      "side": "mixed",
+      "purpose": "For packages that build on site-kit (such as @sonordev/commerce-kit): sonorFetch, the browser transport (site credential, retries, token refresh, auth breaker), getClientApiConfig/readPublishedApiConfig, the one reader of the API origin the layout publishes, and readAnalyticsIdentity, the visitor's analytics ids (read only).",
+      "caution": "Not stamped 'use client' and free of React, Next and server-only, so it works from server and client code alike. A site doesn't need it: forms, analytics and the other modules already use the same transport."
+    },
     {
       "name": "forms/static",
       "import": "@sonordev/site-kit/forms/static",
@@ -691,6 +645,100 @@
       ]
     }
   ],
+  "relocated": [
+    {
+      "from": "@sonordev/site-kit/commerce",
+      "to": "@sonordev/commerce-kit/commerce",
+      "package": "@sonordev/commerce-kit",
+      "range": "^1.0.0",
+      "since": "8.0.0"
+    },
+    {
+      "from": "@sonordev/site-kit/commerce/server",
+      "to": "@sonordev/commerce-kit/commerce/server",
+      "package": "@sonordev/commerce-kit",
+      "range": "^1.0.0",
+      "since": "8.0.0"
+    },
+    {
+      "from": "@sonordev/site-kit/memberships",
+      "to": "@sonordev/commerce-kit/memberships",
+      "package": "@sonordev/commerce-kit",
+      "range": "^1.0.0",
+      "since": "8.0.0"
+    },
+    {
+      "from": "@sonordev/site-kit/memberships/server",
+      "to": "@sonordev/commerce-kit/memberships/server",
+      "package": "@sonordev/commerce-kit",
+      "range": "^1.0.0",
+      "since": "8.0.0"
+    }
+  ],
+  "relocatedTypes": [
+    {
+      "from": "@sonordev/site-kit",
+      "types": [
+        "CommerceOffering",
+        "CommerceCategory",
+        "CommerceVariant",
+        "CommerceSchedule",
+        "OfferingType",
+        "Cart",
+        "CartItem",
+        "EventCheckoutProps",
+        "CheckoutLineItem"
+      ],
+      "to": "@sonordev/commerce-kit",
+      "range": "^1.0.0",
+      "since": "8.0.0"
+    }
+  ],
+  "removed": [
+    {
+      "import": "@sonordev/site-kit/engage",
+      "since": "8.0.0",
+      "why": "Retired in Sonor. Use @sonordev/site-kit/chat and @sonordev/site-kit/website/popups instead (the site-kit-7 codemod moves the names that have a home)."
+    },
+    {
+      "import": "@sonordev/site-kit/cms",
+      "since": "8.0.0",
+      "why": "The Sanity CMS is retired in Sonor and no longer serves pages. Site copy is managed copy: ManagedSlot, ManagedRichText, ManagedLink and ManagedList from @sonordev/site-kit/website/slots, edited in Sonor under Website → Content."
+    },
+    {
+      "import": "@sonordev/site-kit/cms/server",
+      "since": "8.0.0",
+      "why": "The Sanity CMS is retired in Sonor and no longer serves pages. Site copy is managed copy: ManagedSlot, ManagedRichText, ManagedLink and ManagedList from @sonordev/site-kit/website/slots, edited in Sonor under Website → Content."
+    },
+    {
+      "import": "@sonordev/site-kit/website/cms",
+      "since": "8.0.0",
+      "why": "The Sanity CMS is retired in Sonor and no longer serves pages. Site copy is managed copy: ManagedSlot, ManagedRichText, ManagedLink and ManagedList from @sonordev/site-kit/website/slots, edited in Sonor under Website → Content."
+    },
+    {
+      "import": "@sonordev/site-kit/website/cms/server",
+      "since": "8.0.0",
+      "why": "The Sanity CMS is retired in Sonor and no longer serves pages. Site copy is managed copy: ManagedSlot, ManagedRichText, ManagedLink and ManagedList from @sonordev/site-kit/website/slots, edited in Sonor under Website → Content."
+    },
+    {
+      "import": "@sonordev/site-kit/seo",
+      "export": "ManagedContent",
+      "since": "8.0.0",
+      "why": "Content blocks are retired in Sonor. Use ManagedRichText from @sonordev/site-kit/website/slots."
+    },
+    {
+      "import": "@sonordev/site-kit/seo",
+      "export": "getManagedContentData",
+      "since": "8.0.0",
+      "why": "Content blocks are retired in Sonor. Use ManagedRichText from @sonordev/site-kit/website/slots."
+    },
+    {
+      "import": "@sonordev/site-kit/seo",
+      "export": "getContentBlock",
+      "since": "8.0.0",
+      "why": "Content blocks are retired in Sonor. Use ManagedRichText from @sonordev/site-kit/website/slots."
+    }
+  ],
   "blessedPatterns": [
     {
       "id": "layout.sitekit",
@@ -762,6 +810,13 @@
       "cause": "The above-the-fold hero is opacity:0 + JS entrance-animated, so Chrome records LCP at the tween's end (or never).",
       "fix": "Render hero/first-paint content fully static; gate reveal animations to below-the-fold only. <Reveal> from @sonordev/site-kit/motion does this by construction (above-the-fold elements are never touched).",
       "check": null
+    },
+    {
+      "id": "commerce.moved",
+      "symptom": "Build can't resolve a site-kit commerce path: \"Can't resolve '@sonordev/site-kit/commerce'\" (Turbopack) or \"Package subpath './commerce' is not defined by \\\"exports\\\"\" (Node).",
+      "cause": "The site is on site-kit 8, where commerce moved to @sonordev/commerce-kit, which also carries the new memberships module. Nothing is left at the old paths.",
+      "fix": "Install @sonordev/commerce-kit, then run `npx sonor-setup codemod --only site-kit-8 --write` (it rewrites the imports, adds the dependency and raises site-kit to ^8), then build. A site that enables the MCP offerings tool also passes the reader: offerings: { path, read: getOfferingsResult } with getOfferingsResult from @sonordev/commerce-kit/commerce/server. The old paths and the new ones are listed under `relocated` in this manifest.",
+      "check": null
     }
   ]
 }

package/dist/AnalyticsProvider-LYFDQRRJ.js

@@ -0,0 +1,13 @@
+export { AnalyticsProvider, useAnalytics, useAnalyticsOptional, useTrackEvent } from './chunk-J65N34YM.js';
+import './chunk-LCDVPAMR.js';
+import './chunk-ZKADJNR2.js';
+import './chunk-L2V5PUFN.js';
+import './chunk-5TM3WPCI.js';
+import './chunk-GJWI74ZZ.js';
+import './chunk-CAH4Y4PY.js';
+import './chunk-EKBEOXTH.js';
+import './chunk-3G7YABRA.js';
+import './chunk-56VDS2RP.js';
+import './chunk-ZLFGXKLG.js';
+import './chunk-5S2XDG5O.js';
+import './chunk-PKBMQBKP.js';