@sonordev/site-kit 7.4.0 → 8.0.0

package/dist/shared/identity-storage.d.ts

@@ -0,0 +1,30 @@
+/**
+ * @sonordev/site-kit/shared — where the analytics identity is kept.
+ *
+ * Single source of truth for the `_sk_*` storage keys and for the in-memory
+ * fallback the writer (identity.tsx) and the reader (identity-reader.ts)
+ * share:
+ *
+ *   localStorage:    _sk_vid   (visitor ID, kept across visits)
+ *   sessionStorage:  _sk_sid   (session ID, per tab)
+ *   sessionStorage:  _sk_stime (last activity, for the inactivity timeout)
+ *
+ * Kept this small on purpose: analytics loads on every page of every site,
+ * and it shares this module with the forms, popups and runtime bundles. What
+ * only they use, the reader, lives in its own module so analytics doesn't
+ * download it.
+ */
+/** localStorage: the visitor id, kept across visits. */
+export declare const VISITOR_ID_KEY = "_sk_vid";
+/** sessionStorage: the session id, per tab. */
+export declare const SESSION_ID_KEY = "_sk_sid";
+/** sessionStorage: last activity, for the session's inactivity timeout. */
+export declare const SESSION_TIME_KEY = "_sk_stime";
+/**
+ * The ids for this page load when storage can't hold them (privacy settings,
+ * a sandboxed frame). Written only by get-or-create in identity.tsx.
+ */
+export declare const memoryIdentity: {
+    visitorId: string;
+    sessionId: string;
+};

package/dist/shared/identity.d.ts

@@ -1,25 +1,25 @@
 /**
  * @sonordev/site-kit/shared — Unified Identity Management
  *
- * Single source of truth for visitor and session IDs across
- * Analytics, Signal, chat and popups.
+ * Creates the visitor and session ids that Analytics, Signal, chat and popups
+ * share, and the hook that reads them. The storage keys and the in-memory
+ * fallback live in identity-storage.ts (the single source of truth for where
+ * the ids are kept); the read-only reader is identity-reader.ts.
  *
- * Storage keys:
- *   localStorage:    _sk_vid   (visitor ID, persists ~forever)
- *   sessionStorage:  _sk_sid   (session ID, per-tab)
- *   sessionStorage:  _sk_stime (last activity timestamp for timeout)
- *
- * Storage keys are prefixed with `_sk_*`.
+ * When the browser blocks storage (privacy settings, a sandboxed frame), the
+ * ids live in memory for this page load instead. That matters because these
+ * functions run DURING RENDER (SiteKitClientProviders), where a throw takes
+ * the whole page down; same reason shared/uuid.ts never throws.
  */
 /**
- * Get or create a persistent visitor ID.
- * Stored in localStorage under `_sk_vid`.
+ * Get or create a persistent visitor ID, stored in localStorage under
+ * `_sk_vid`. Never throws.
  */
 export declare function getOrCreateVisitorId(): string;
 /**
- * Get or create a session ID with inactivity timeout.
- * Stored in sessionStorage under `_sk_sid`.
- * Session expires after `timeoutMinutes` of inactivity (default 30).
+ * Get or create a session ID, stored in sessionStorage under `_sk_sid`. The
+ * session expires after `timeoutMinutes` of inactivity (default 30). Never
+ * throws.
  */
 export declare function getOrCreateSessionId(timeoutMinutes?: number): string;
 export interface SiteKitIdentity {

package/dist/shared/import-specifiers.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The module specifiers a piece of code imports, and what an isomorphic entry
+ * may not import: the one definition behind both the source-level boundary
+ * checks (./boundary-graph.ts) and the built-chunk check
+ * (scripts/kit-post-build.ts), which had each grown their own copy.
+ *
+ * Test and build infrastructure: nothing ships from here (tsconfig.build.json
+ * leaves it out of the declarations, and no entry reaches it).
+ *
+ * Callers strip comments (and type-only imports, where erased imports don't
+ * count) first; a comment that names an import is not an import.
+ */
+/**
+ * Every specifier `code` imports, in the order they appear, without a query or
+ * hash a bundler would strip (`./server?raw` is `./server`).
+ */
+export declare function importSpecifiers(code: string): string[];
+/**
+ * A specifier an isomorphic entry's graph must not import: React, Next or
+ * `server-only` (hooks, a client reference, or a hard error on the other
+ * side), and any site-kit entry but `./runtime`, which is isomorphic by design
+ * (the others are `'use client'` or server-only: `./analytics`, `./server`...).
+ * Matches by package name, so a subpath (`react/jsx-runtime`, `next/headers`)
+ * counts.
+ */
+export declare function isNotIsomorphicSpecifier(spec: string): boolean;

package/dist/shared/sonorFetch.d.ts

@@ -2,9 +2,10 @@
  * @sonordev/site-kit shared - Canonical client transport
  *
  * Single source of truth for how site-kit talks to Sonor from the browser.
- * Every client-side module (analytics, forms, commerce, engage, maps, images,
- * SitemapSync) routes through here instead of bare fetch(), which gives the
- * whole kit, in one place:
+ * Every client-side module (analytics, forms, engage, maps, images,
+ * SitemapSync) routes through here instead of bare fetch(), and so do the kits
+ * that build on site-kit (commerce-kit), through `@sonordev/site-kit/runtime`.
+ * That gives the whole kit family, in one place:
  *
  *  - per-attempt timeout + retry with backoff (via fetchWithRetry) — a hung
  *    request left to the browser's own network timeout logs a console error

package/dist/shared/version.d.ts

@@ -7,4 +7,4 @@
  * it matches package.json at publish time, and version.test.ts asserts it in
  * dev, so it can't silently drift.
  */
-export declare const SITE_KIT_VERSION = "7.4.0";
+export declare const SITE_KIT_VERSION = "8.0.0";

package/dist/signal/index.js

@@ -1,6 +1,6 @@
 'use client';
-import { useSignalExperiment, useSignalEvent } from '../chunk-AH4AXO4P.js';
-export { SignalBridge, useSignal, useSignalConfig, useSignalEvent, useSignalExperiment, useSignalOutcome } from '../chunk-AH4AXO4P.js';
+import { useSignalExperiment, useSignalEvent } from '../chunk-6ZXJ3SXR.js';
+export { SignalBridge, useSignal, useSignalConfig, useSignalEvent, useSignalExperiment, useSignalOutcome } from '../chunk-6ZXJ3SXR.js';
 import '../chunk-PKBMQBKP.js';
 import React, { useEffect } from 'react';
 import { jsx, Fragment } from 'react/jsx-runtime';

package/dist/sitemap/index.js

@@ -1,7 +1,7 @@
-export { createSitemap, getPortfolioPaths, syncSitemapToPortal } from '../chunk-4DJMJ4V5.js';
+export { createSitemap, getPortfolioPaths, syncSitemapToPortal } from '../chunk-OE3NXEOF.js';
+import '../chunk-TZ5RTANX.js';
+import '../chunk-JIH32RH2.js';
 import '../chunk-Z22QVHT4.js';
-import '../chunk-ZTLU3BSW.js';
-import '../chunk-4BHRA7TI.js';
 import '../chunk-L5UOHS6E.js';
 import '../chunk-WMVK77ND.js';
 import '../chunk-UAYAJPEP.js';
@@ -12,4 +12,5 @@ import '../chunk-YVKRYQRG.js';
 import '../chunk-DIKNRN34.js';
 import '../chunk-FESKKJAS.js';
 import '../chunk-A4CC4ZG3.js';
+import '../chunk-3G7YABRA.js';
 import '../chunk-PKBMQBKP.js';

package/dist/slots/index.js

@@ -1,7 +1,7 @@
-export { ManagedLink, ManagedList, ManagedRichText, ManagedSlot, SLOTS_CACHE_TAG, createSlotsRevalidateHandler, ManagedSlot_default as default, getSlot, renderSlotRichText, resolveSlots } from '../chunk-CGWUXUYZ.js';
+export { ManagedLink, ManagedList, ManagedRichText, ManagedSlot, SLOTS_CACHE_TAG, createSlotsRevalidateHandler, ManagedSlot_default as default, getSlot, renderSlotRichText, resolveSlots } from '../chunk-3RDJKIYO.js';
 export { SLOTS_CONTRACT_VERSION, signSlotContent, slotSigningPayload, verifySlotContent } from '../chunk-VCJYLYJV.js';
 export { SLOT_CONTENT_MAX_LENGTH, SLOT_CONTENT_TYPES, SLOT_ID_PATTERN, SLOT_LIST_MAX_ITEMS, isSafeSlotHref, isValidSlotId, normalizeSlotValue, parseSlotRichText } from '../chunk-LPH5FANE.js';
-import '../chunk-RYVDGXC2.js';
-import '../chunk-X6F6SO4S.js';
+import '../chunk-6KU7STM3.js';
+import '../chunk-C7TLGL3R.js';
 import '../chunk-MH2DSGC6.js';
 import '../chunk-PKBMQBKP.js';

package/dist/sync/index.js

@@ -1,6 +1,7 @@
-export { BookingWidget } from '../chunk-AV4QAK5F.js';
-export { createBooking, createSlotHold, detectTimezone, fetchAvailability, fetchAvailableDates, fetchBookingTypeDetails, fetchBookingTypes, formatDate, formatDuration, formatTime, prepareMeeting, releaseSlotHold } from '../chunk-MHGAZ3LL.js';
-import '../chunk-3E3PPSNR.js';
-import '../chunk-GK7TV7EK.js';
-import '../chunk-KHQ5GD6T.js';
+export { BookingWidget } from '../chunk-OGK7OL3T.js';
+export { createBooking, createSlotHold, detectTimezone, fetchAvailability, fetchAvailableDates, fetchBookingTypeDetails, fetchBookingTypes, formatDate, formatDuration, formatTime, prepareMeeting, releaseSlotHold } from '../chunk-IJQ767JS.js';
+import '../chunk-3G7YABRA.js';
+import '../chunk-56VDS2RP.js';
+import '../chunk-ZLFGXKLG.js';
+import '../chunk-5S2XDG5O.js';
 import '../chunk-PKBMQBKP.js';

package/dist/types.d.ts

@@ -16,6 +16,5 @@ export * from './seo/types';
 export * from './analytics/types';
 export * from './chat/types';
 export * from './website/popup-types';
-export type { EngageAnalytics, EngageConfig, EngageElement, TargetingRules, TriggerConfig, WidgetConfig, WidgetType } from './engage/types';
 export * from './forms/types';
 export * from './articles/types';

package/dist/website/cta-bar.js

@@ -1,5 +1,5 @@
 export { CTA_BAR_BREAKPOINTS, CTA_BAR_SPACE, CtaBar, CtaBarAction, ECHO_CLEARANCE } from '../chunk-LNSNA3W4.js';
 import '../chunk-UPFU63L4.js';
-import '../chunk-LCDVPAMR.js';
 import '../chunk-JE4A5S4F.js';
+import '../chunk-LCDVPAMR.js';
 import '../chunk-PKBMQBKP.js';

package/dist/website/images.js

@@ -1,6 +1,6 @@
-export { ManagedImage, assignImageToSlot, clearImageSlot, fetchManagedImage, fetchManagedImages, listImageFiles, uploadImage } from '../chunk-DA5XC7Y6.js';
+export { ManagedImage, assignImageToSlot, clearImageSlot, fetchManagedImage, fetchManagedImages, listImageFiles, uploadImage } from '../chunk-TOSZGJEQ.js';
 export { ManagedFavicon, getManagedFaviconUrl } from '../chunk-GW7GSBO7.js';
-import '../chunk-3E3PPSNR.js';
-import '../chunk-GK7TV7EK.js';
-import '../chunk-KHQ5GD6T.js';
+import '../chunk-56VDS2RP.js';
+import '../chunk-ZLFGXKLG.js';
+import '../chunk-5S2XDG5O.js';
 import '../chunk-PKBMQBKP.js';

package/dist/website/index.js

@@ -1,13 +1,14 @@
 'use client';
-export { SiteDesignReporter } from '../chunk-PQDJNIHR.js';
-export { SITE_DESIGN_PATH, cleanFontStack, colorToHex, getSiteDesignTokens, measureSiteDesign, readDeclaredDesign, sendSiteDesign } from '../chunk-CG4ETW5Y.js';
+export { SiteDesignReporter } from '../chunk-ZHNQFNO3.js';
+export { SITE_DESIGN_PATH, cleanFontStack, colorToHex, getSiteDesignTokens, measureSiteDesign, readDeclaredDesign, sendSiteDesign } from '../chunk-KRBBH64S.js';
 export { DEFAULT_POPUP_TOKENS, PopupBlocks } from '../chunk-BF7TZYC3.js';
 import '../chunk-IHG36STL.js';
 import '../chunk-YC7ELZS3.js';
 import '../chunk-S22FSH7C.js';
-import '../chunk-43OCZ3JA.js';
+import '../chunk-CAH4Y4PY.js';
 import '../chunk-EKBEOXTH.js';
-import '../chunk-3E3PPSNR.js';
-import '../chunk-GK7TV7EK.js';
-import '../chunk-KHQ5GD6T.js';
+import '../chunk-3G7YABRA.js';
+import '../chunk-56VDS2RP.js';
+import '../chunk-ZLFGXKLG.js';
+import '../chunk-5S2XDG5O.js';
 import '../chunk-PKBMQBKP.js';

package/dist/website/popups.js

@@ -1,14 +1,17 @@
 'use client';
+export { SitePopups } from '../chunk-S7SSYGUJ.js';
+import '../chunk-27FISYK4.js';
 export { DEFAULT_POPUP_TOKENS, PopupBlocks } from '../chunk-BF7TZYC3.js';
 import '../chunk-IHG36STL.js';
-export { SitePopups } from '../chunk-6LLTLLEJ.js';
-import '../chunk-27FISYK4.js';
+import '../chunk-5ROTTMBL.js';
 import '../chunk-S22FSH7C.js';
-import '../chunk-24QZEO3Q.js';
+import '../chunk-ZKADJNR2.js';
+import '../chunk-5TM3WPCI.js';
 import '../chunk-GJWI74ZZ.js';
-import '../chunk-43OCZ3JA.js';
+import '../chunk-CAH4Y4PY.js';
 import '../chunk-EKBEOXTH.js';
-import '../chunk-3E3PPSNR.js';
-import '../chunk-GK7TV7EK.js';
-import '../chunk-KHQ5GD6T.js';
+import '../chunk-3G7YABRA.js';
+import '../chunk-56VDS2RP.js';
+import '../chunk-ZLFGXKLG.js';
+import '../chunk-5S2XDG5O.js';
 import '../chunk-PKBMQBKP.js';

package/dist/website/slots.js

@@ -1,7 +1,7 @@
-export { ManagedLink, ManagedList, ManagedRichText, ManagedSlot, SLOTS_CACHE_TAG, createSlotsRevalidateHandler, ManagedSlot_default as default, getSlot, renderSlotRichText, resolveSlots } from '../chunk-CGWUXUYZ.js';
+export { ManagedLink, ManagedList, ManagedRichText, ManagedSlot, SLOTS_CACHE_TAG, createSlotsRevalidateHandler, ManagedSlot_default as default, getSlot, renderSlotRichText, resolveSlots } from '../chunk-3RDJKIYO.js';
 export { SLOTS_CONTRACT_VERSION, signSlotContent, slotSigningPayload, verifySlotContent } from '../chunk-VCJYLYJV.js';
 export { SLOT_CONTENT_MAX_LENGTH, SLOT_CONTENT_TYPES, SLOT_ID_PATTERN, SLOT_LIST_MAX_ITEMS, isSafeSlotHref, isValidSlotId, normalizeSlotValue, parseSlotRichText } from '../chunk-LPH5FANE.js';
-import '../chunk-RYVDGXC2.js';
-import '../chunk-X6F6SO4S.js';
+import '../chunk-6KU7STM3.js';
+import '../chunk-C7TLGL3R.js';
 import '../chunk-MH2DSGC6.js';
 import '../chunk-PKBMQBKP.js';

package/dist/{writeLLMsTxt-OL4KQERZ.js → writeLLMsTxt-UZGN6IBU.js}

@@ -1,5 +1,5 @@
-export { writeLLMsTxtToPublic } from './chunk-ZTLU3BSW.js';
-import './chunk-4BHRA7TI.js';
+export { writeLLMsTxtToPublic } from './chunk-TZ5RTANX.js';
+import './chunk-JIH32RH2.js';
 import './chunk-L5UOHS6E.js';
 import './chunk-WMVK77ND.js';
 import './chunk-UAYAJPEP.js';
@@ -8,4 +8,5 @@ import './chunk-MJP63SSS.js';
 import './chunk-YVKRYQRG.js';
 import './chunk-FESKKJAS.js';
 import './chunk-A4CC4ZG3.js';
+import './chunk-3G7YABRA.js';
 import './chunk-PKBMQBKP.js';

package/docs/MIGRATING-TO-7.md

@@ -1,5 +1,7 @@
 # Moving a site to site-kit 7
 
+> This guide covers the move from 6 to 7 and is kept as it was. Moving from 7 to 8 is a separate, shorter guide: [Migrating to 8](MIGRATING-TO-8.md). Two things have changed since this page was written. Commerce now lives in [`@sonordev/commerce-kit`](https://sonor.dev/commerce-kit), so the commerce row below names a path that moved in 8.0. And where this page says old paths are removed in 8.0, the [8.0.0 changelog entry](../CHANGELOG.md) says what that release actually removed: the retired Engage and CMS entries, but not the aliases for renamed modules, which are still there.
+
 site-kit 7 is organised the way Sonor's dashboard is: one entry per module.
 Most sites need no changes at all. Move a site when you next touch it;
 nothing forces it before then, because a
@@ -78,7 +80,8 @@ New homes, each the same module as before:
 - Website chat: `./chat`, and popups: `./website/popups` (both out of
   `./engage`, which Sonor retired with the Engage module)
 
-**The old paths keep working through 7.x** and are removed in 8.0. The
+**The old paths keep working through 7.x** (and in 8, except `./engage`, which was
+removed with the retired Engage module). The
 codemod moves them anyway, so a touched site is done in one pass: chat
 imports go to `./chat`, popup types to `./website/popups` under their new
 names (`EngageElement` is `SitePopup`). It flags `EngageWidget`, which draws
@@ -128,7 +131,7 @@ just this part.
   type (not `withSiteKitConfig`, which stays).
 - Source maps. The package no longer ships `.map` files (7.3 of 6.x's 11 MB).
 
-Still accepted and ignored until 8.0, because sites pass them:
+Still accepted and ignored (in 8 too), because sites pass them:
 `contentSignals` on `createRobotsTxtHandler`, `nativeReturnTo` on forms, and
 `<ManagedScripts />`.
 

package/docs/MIGRATING-TO-8.md

@@ -0,0 +1,183 @@
+# Moving a site to site-kit 8
+
+site-kit 8 moves commerce into its own package, [`@sonordev/commerce-kit`](https://sonor.dev/commerce-kit), which also carries the new memberships module, and removes the entries for two modules Sonor retired, Engage and the Sanity CMS. Most sites need no changes at all: if yours uses none of these, update site-kit and rebuild. A site's `^7` range never picks up 8, so nothing forces the move before you next touch the site.
+
+## Who's affected
+
+Only sites that do one of these:
+
+- Import from `@sonordev/site-kit/commerce` or `@sonordev/site-kit/commerce/server` (products, services, events, checkout, calendars).
+- Import a commerce type from the root, such as `import type { CommerceOffering } from '@sonordev/site-kit'`.
+- Turn on the opt-in `list_offerings` agent tool by passing `offerings` to `sonorMcpServer`. See [The MCP change](#the-mcp-change).
+- Import one of the entries that were [removed](#what-was-removed): `@sonordev/site-kit/engage`, `/cms`, `/website/cms` (or their `/server` entries), or `ManagedContent`, `getManagedContentData` or `getContentBlock` from `/seo`.
+
+Not sure which you are? Search the site for the old paths, then for root imports:
+
+```bash
+grep -rnE "@sonordev/site-kit/(commerce|memberships|engage|cms|website/cms)" . \
+  --include='*.ts' --include='*.tsx' --include='*.js' --include='*.jsx' \
+  --include='*.mjs' --include='*.cjs' --include='*.mts' --include='*.cts' --include='*.mdx' \
+  --exclude-dir=node_modules --exclude-dir=.next
+
+grep -rnE "ManagedContent|getManagedContentData|getContentBlock" . \
+  --include='*.ts' --include='*.tsx' --include='*.js' --include='*.jsx' --exclude-dir=node_modules --exclude-dir=.next
+
+grep -rnE "from ['\"]@sonordev/site-kit['\"]" . \
+  --include='*.ts' --include='*.tsx' --exclude-dir=node_modules --exclude-dir=.next
+```
+
+The root entry is types-only (plus `SITE_KIT_VERSION`), so the last search turns up type imports. Look for the commerce types listed under [What moved](#what-moved) and the Engage type names under [What was removed](#what-was-removed). If the first two searches find nothing, none of the root imports are those types, and you don't pass `offerings` to `sonorMcpServer`, you're done: raise site-kit to `^8` whenever you like.
+
+## Steps
+
+### 1. Install both packages
+
+```bash
+pnpm add @sonordev/site-kit@^8 @sonordev/commerce-kit
+```
+
+`npm install @sonordev/site-kit@^8 @sonordev/commerce-kit` does the same. commerce-kit lists site-kit 8 or newer as a peer dependency, so it uses your site's one copy of site-kit. If your package manager reports that commerce-kit needs `@sonordev/site-kit >=8.0.0` (npm stops with an `ERESOLVE` error, pnpm and Yarn warn), site-kit is still on 7. Like site-kit, commerce-kit needs React 19. Next 16 is an optional peer: only the memberships server helpers use it.
+
+### 2. Run the codemod
+
+Dry run first:
+
+```bash
+npx sonor-setup codemod --only site-kit-8
+```
+
+It prints what it would change and writes nothing. When the diff looks right, apply it:
+
+```bash
+npx sonor-setup codemod --only site-kit-8 --write
+```
+
+The codemod needs sonor-setup 7.3.0 or later, and `npx` fetches the latest. It reads source files anywhere in the project (`pages/`, `hooks/` and `scripts/` count, not just `app/` and `src/`), but not `node_modules`, build output or `public/`. It rewrites your imports (the table below). When your code imports commerce, it also adds `@sonordev/commerce-kit` to package.json and raises site-kit's range to `^8.0.0`, and if `pnpm-workspace.yaml` lists site-kit under `minimumReleaseAgeExclude` it adds commerce-kit there too. Anything it can't rewrite safely it flags, with the fix, so you can finish those by hand: a `require()` of an old path (commerce-kit is ESM only, so that call needs an `import`), an import of a [removed](#what-was-removed) entry, or a `sonorMcpServer` whose `offerings` has no reader (see [The MCP change](#the-mcp-change)). Run it in the app's folder: in a monorepo, once per app that imports commerce, because it stops at a workspace root.
+
+`--check` is the gate: it exits 1 while a file needs rewriting and while a manual follow-up remains, so exit 0 means there's nothing left for you to do.
+
+If it changed package.json, install before you build:
+
+```bash
+pnpm install
+```
+
+No codemod handy? The swap is mechanical: replace the package name in each import and add commerce-kit to package.json. The subpath stays the same.
+
+### 3. Build
+
+```bash
+pnpm build
+```
+
+A build is the real test. Nothing is left behind at the old paths, so an import you missed fails with "Module not found" instead of quietly running something stale. A bump you didn't build is a guess.
+
+## What moved
+
+The subpath stays the same; only the package name changes.
+
+| Was | Now |
+|---|---|
+| `@sonordev/site-kit/commerce` | `@sonordev/commerce-kit/commerce` |
+| `@sonordev/site-kit/commerce/server` | `@sonordev/commerce-kit/commerce/server` |
+| `@sonordev/site-kit/memberships` | `@sonordev/commerce-kit/memberships` |
+| `@sonordev/site-kit/memberships/server` | `@sonordev/commerce-kit/memberships/server` |
+| Commerce types from the root, `@sonordev/site-kit` | `@sonordev/commerce-kit` |
+
+Memberships never shipped in a site-kit release, so those two rows only matter if you tried an unreleased build. The root types are `CommerceOffering`, `CommerceCategory`, `CommerceVariant`, `CommerceSchedule`, `OfferingType`, `Cart`, `CartItem`, `EventCheckoutProps` and `CheckoutLineItem`.
+
+```tsx
+// before
+import { OfferingCard, ProductPage } from '@sonordev/site-kit/commerce'
+import { getOfferingBySlug } from '@sonordev/site-kit/commerce/server'
+import type { CommerceOffering } from '@sonordev/site-kit'
+
+// after
+import { OfferingCard, ProductPage } from '@sonordev/commerce-kit/commerce'
+import { getOfferingBySlug } from '@sonordev/commerce-kit/commerce/server'
+import type { CommerceOffering } from '@sonordev/commerce-kit'
+```
+
+The new entries export what the old ones did, under the same names. `/commerce` is a client entry and `/commerce/server` is server code, the same split as before. commerce-kit's root is types-only, so import anything that runs from one of its module entries.
+
+What stays where it was:
+
+- **Your CSS.** The components keep their `site-kit-` class names (`site-kit-product-grid`, `site-kit-calendar-event` and the rest), so your styles still apply. Brand tokens still come from site-kit's `brand.css`, which your site imports as before.
+- **Your credential.** commerce-kit uses the credential `SiteKitLayout` already publishes, so there's no new environment variable.
+
+What's different besides the import path, all in [commerce-kit's changelog](https://sonor.dev/commerce-kit/changelog):
+
+- The shopping events (`product_view`, `add_to_cart`, `begin_checkout`, `checkout_start` and `purchase`) reach Sonor. site-kit 7 reported them through a hook that returns nothing under `SiteKitLayout`, so they were never sent.
+- The server helpers return whole offerings (gallery, size chart and options included), and they're server-only now. Each response is cached for 60 seconds under the `commerce` tag, which Sonor expires when you edit an offering, and a request gives up after 30 seconds. Pass `{ revalidate: 0 }` in the config if a page needs every request fresh.
+- A product marked sold out in Sonor keeps its page, shown as unavailable, instead of answering "no such product".
+- Checkout works in a browser set to block site data.
+- When a server fetch fails, the log line starts with `[commerce-kit]` instead of `[site-kit/commerce]`. If you filter or alert on that prefix, update it.
+
+## What was removed
+
+These modules were retired in Sonor, and their entries were kept through 7.x so old imports kept building. They're gone in 8, and nothing replaces them:
+
+| Removed | Use instead |
+|---|---|
+| `@sonordev/site-kit/engage` | `@sonordev/site-kit/chat` and `@sonordev/site-kit/website/popups`. The 7 codemod (`npx sonor-setup codemod --write`) moves the names that have a home there and flags `EngageWidget`, which `SiteKitLayout` already mounts |
+| `@sonordev/site-kit/cms`, `/cms/server`, `/website/cms`, `/website/cms/server` | Managed copy: `ManagedSlot`, `ManagedRichText`, `ManagedLink` and `ManagedList` from `@sonordev/site-kit/website/slots`. You can uninstall `@portabletext/react` and `@sanity/image-url` |
+| `ManagedContent`, `getManagedContentData`, `getContentBlock` and their types, from `@sonordev/site-kit/seo` | `ManagedRichText` from `@sonordev/site-kit/website/slots` |
+| `EngageElement`, `WidgetConfig`, `EngageConfig` and the other Engage type names, from the root | `SitePopup`, `SitePopupConfig` and the rest of `@sonordev/site-kit/website/popups`. (The `engage` prop on `SiteKitLayout` and its own `EngageConfig` type stay.) |
+
+They rendered nothing in 7.x, so most sites never imported them and have nothing to do. `npx sonor-setup manifest --json` lists them under `removed`.
+
+## The MCP change
+
+`list_offerings` is the opt-in agent tool that lists priced products, services and events. It used to read the commerce fetchers directly. It takes its reader as an option now, so site-kit doesn't depend on commerce-kit:
+
+```ts
+// before (site-kit 7)
+sonorMcpServer({ businessName: 'Example Studio', offerings: { path: '/shop' } })
+
+// after (site-kit 8)
+import { getOfferingsResult } from '@sonordev/commerce-kit/commerce/server'
+
+sonorMcpServer({ businessName: 'Example Studio', offerings: { path: '/shop', read: getOfferingsResult } })
+```
+
+`read` is `getOfferingsResult` from `@sonordev/commerce-kit/commerce/server`. It reports a failed request as "the catalog is unavailable" instead of an empty catalog; the plain `getOfferings` from the same entry also works, but it reads an outage as empty. `path` is still optional and still defaults to `/shop`. The tool, how it ranks a query, and its rule that a price the business keeps private is never shown all stay in site-kit.
+
+If `read` is missing, `sonorMcpServer` throws when the server is built, with a message that says what to pass. A TypeScript site sees the same reminder as a type error. A site that doesn't pass `offerings` changes nothing, and neither does `list_services`: it reads the site's core data, not commerce. See [MCP and agent tools](../src/mcp/README.md).
+
+## Check your work
+
+1. The first two searches from [Who's affected](#whos-affected) come back empty, and none of the root imports the last one finds are commerce or Engage types.
+2. `pnpm build` passes.
+3. `pnpm ls @sonordev/site-kit @sonordev/commerce-kit` (or `npm ls`) shows site-kit 8.x and commerce-kit 1.x.
+4. On a preview deploy or in dev, load a product or events page and start a checkout.
+5. `npx sonor-setup verify` still exits 0.
+
+## Staying on 7.x
+
+Staying on 7 is fine while you plan the move. A `^7` range never picks up 8, and everything in 7.4 keeps working, commerce included. Two things to know: commerce-kit needs site-kit 8, so a site on 7 can't install it, and the memberships module ships only in commerce-kit. If a dependency update raised your range to 8 before you were ready, pin it back with `pnpm add @sonordev/site-kit@^7.4.0`.
+
+## Questions
+
+### Why is commerce a separate package?
+
+It versions and releases on its own. Checkout is the busiest money path on a site, and most sites don't sell anything, so a fix there shouldn't wait for a site-kit release (or the other way round). commerce-kit builds on site-kit and takes its transport, credential, analytics and server data from it instead of carrying copies. The one entry site-kit added for it, [`@sonordev/site-kit/runtime`](../src/runtime/README.md), is public API, and a site doesn't need to import it.
+
+### Does this make my site's JavaScript smaller?
+
+No, and it was never meant to. site-kit's root entry was already types-only and no core entry referenced commerce, so visitors to a site without commerce never downloaded any of it. For a site that does sell, the components are the same code, now built and shipped from commerce-kit. What shrinks is site-kit's package: about 8% fewer bytes to download and about 13% fewer on disk than 7.4.0, which is install size, not page weight.
+
+### Why 8.0, and not a 7.x release with the old paths still working?
+
+Removing a published entry is a breaking change, and a `^7` range would have picked it up on the next install. Keeping the old paths alive would have meant a second copy of the code, or site-kit depending on a package that depends back on it. It wouldn't have saved an edit either, since commerce-kit has to be added to package.json whichever way. (The retired Engage and CMS entries were promised for 8.0 in the 7.0, 7.1 and 7.2 notes, so they go with it.)
+
+### Do my styles, environment variables or API key change?
+
+No. The class names, the brand tokens and the credential are all as they were. See [What moved](#what-moved).
+
+### Did anything else leave site-kit in 8.0?
+
+Only [what was removed](#what-was-removed). Every other entry works as it did in 7.4, including the deprecated aliases for renamed modules (`./middleware`, `./sitemap`, `./robots`, `./redirects`, `./og`, `./llms`, `./images`, `./slots`, `./landing` and `./cta-bar`), because sites still import them. Earlier notes said those would go in 8.0; they stay, and will go in a later major once sites have moved off them. [Migrating to 7](MIGRATING-TO-7.md) lists them, and the codemod (`npx sonor-setup codemod --write`) that moves a site onto their new homes.
+
+### Where are the commerce docs now?
+
+At [sonor.dev/commerce-kit](https://sonor.dev/commerce-kit): [Commerce](https://sonor.dev/commerce-kit/commerce), [Memberships](https://sonor.dev/commerce-kit/memberships) and the [changelog](https://sonor.dev/commerce-kit/changelog).

package/docs.json

@@ -2,13 +2,14 @@
   "$comment": "What sonor.dev renders for this package, in nav order. sonor.dev reads this file from the published tarball (latest on npm), so a release IS the docs deploy: add a page here and ship it in package.json `files`. scripts/verify-docs.cjs fails the publish if a listed file is missing from the pack.",
   "schemaVersion": 1,
   "title": "site-kit",
-  "summary": "One package, one env var, every Sonor module on a Next.js site: SEO, analytics, forms, articles, commerce, chat, AI visibility, agent tools and motion.",
+  "summary": "One package, one env var, the Sonor modules a Next.js site needs: SEO, analytics, forms, articles, booking, chat, AI visibility, agent tools and motion. Commerce and memberships live in commerce-kit.",
   "groups": [
     {
       "title": "Start here",
       "pages": [
         { "slug": "", "title": "Overview", "file": "README.md" },
         { "slug": "migrating-to-7", "title": "Migrating to 7", "file": "docs/MIGRATING-TO-7.md" },
+        { "slug": "migrating-to-8", "title": "Migrating to 8", "file": "docs/MIGRATING-TO-8.md" },
         { "slug": "agents", "title": "For coding agents", "file": "AGENTS.md" }
       ]
     },
@@ -41,16 +42,10 @@
         { "slug": "chat", "title": "Website chat", "file": "src/chat/README.md" },
         { "slug": "popups", "title": "Popups and banners", "file": "src/website/README.md" },
         { "slug": "cta-bar", "title": "CTA bar", "file": "src/cta-bar/README.md" },
+        { "slug": "booking", "title": "Booking", "file": "src/sync/README.md" },
         { "slug": "signal", "title": "Signal (A/B)", "file": "src/signal/README.md" }
       ]
     },
-    {
-      "title": "Commerce",
-      "pages": [
-        { "slug": "commerce", "title": "Commerce", "file": "src/commerce/README.md" },
-        { "slug": "booking", "title": "Booking", "file": "src/sync/README.md" }
-      ]
-    },
     {
       "title": "AI visibility",
       "pages": [
@@ -62,6 +57,7 @@
       "title": "More",
       "pages": [
         { "slug": "motion", "title": "Motion", "file": "src/motion/README.md" },
+        { "slug": "runtime", "title": "Building a kit", "file": "src/runtime/README.md" },
         { "slug": "admin-auth", "title": "Sign in with Sonor", "file": "src/admin-auth/README.md" }
       ]
     }