@sonordev/site-kit 8.8.0 → 8.9.0

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # @sonordev/site-kit Changelog
 
+## 8.9.0
+
+- Keep the CTA bar's actions and page content server-rendered on dynamic routes with Next.js Cache Components. Pathname-dependent CTA behavior and the Resonance runtime wait inside their own Suspense boundaries.
+
+- Add `@sonordev/site-kit/resonance`, the measurement runtime that connects your site's consent manager to scoped consent receipts and approved advertising destinations. Register one adapter for the consent manager you already use; the runtime reads its current choices, never creates a banner, and keeps the visitor proof in memory only. `SiteKitLayout` mounts it as a childless sibling, so pages and managed forms render the same when measurement is unavailable. Google tags load only after the required advertising grants. Sites that don't configure it behave as before.
+
+- Gate analytics collection, identity initialization, Signal and retries by the visitor's current purpose permission. Explicit denial drops pending tracking work, and a later grant starts fresh without replaying what was denied. A site with no configured requirement keeps its first-party analytics behavior, recorded as an unknown policy rather than a consent grant. Forms and chat keep working without optional measurement.
+
+- Show an experiment variant as a measured exposure only when the server confirms the visitor's current assignment. Without that confirmation, or without consent, the control content shows. Accepted forms are still recorded as conversions by the server, never by the browser.
+
+- Add the Meta browser pixel loader, switched off in this release. 8.9.0 can't start it: this build implements no loader controls revision, so even a capability witness from Sonor's server can't enable it, and a later release turns it on. When it's on, it will load Meta's script only after the three advertising grants, on pages a person has approved, with a clean address, no fragment and a clean referrer, outside frames, previews and signed-in areas. It mints Meta's own first-party cookies and sends no browser events, passes no user data, reads nothing from the page and attaches no listeners. A site that already has a Meta pixel or a tag manager gets a status code instead of a second pixel. Withdrawing consent pauses the pixel and expires `_fbp` and `_fbc`. The same-page cookie observation now also requires the page to be approved. Read `getResonanceMeasurementStatus()` for the current blocker codes, and see the Resonance page for the Content Security Policy hosts a strict site will need.
+
+- Attach one optional Google click identifier to a new consented page-view occurrence. Only the current matching address is read, after advertising permission, including when analytics consent is denied. Ambiguous values are rejected, and nothing is kept in query history or browser storage.
+
+- Load less for the same behavior: consent state is read through smaller shared readers that keep permission checks synchronous across bundles, and campaign validation schemas stay out of the deferred Signal runtime.
+
+- The Resonance schemas and rules this release uses are the ones published in `@sonordev/contracts` 2.22.0.
+
+## 8.8.1
+
+- Add optional full-wordmark presentation to runtime OG cards. Branded cards keep one photograph while fitting the title, and existing cards retain their layout. Use resolved logo assets and intrinsic dimensions with the metadata-file factory.
+
 ## 8.8.0
 
 - `@sonordev/site-kit/portfolio/contract` adds the verification, a proof-stage case study section for a build a Lighthouse run can't honestly score, such as an app behind a sign-in. It's a short list of checks, each saying what was checked, where, how, when, what came out and what it doesn't cover. New: `portfolioVerification` in `PORTFOLIO_SECTION_TYPES` (in the proof stage), `verificationProblems`, `readVerificationChecks`, `verificationLink`, `isVacuousScope`, `isPlaceholderText`, `isRealDay`, `latestVerificationDay`, `PORTFOLIO_VERIFICATION_JSON_SCHEMA`, the `PortfolioVerificationData` and `VerificationCheck` types and the limits `VERIFICATION_MAX_CHECKS`, `VERIFICATION_FIELD_MAX_CHARS` and `VERIFICATION_EARLIEST_DAY`. Nothing was removed or renamed. A `Record<PortfolioSectionType, ...>` of your own needs an entry for `portfolioVerification` before it type-checks.

package/README.md

@@ -4,6 +4,15 @@ All-in-one integration kit for [Sonor](https://sonor.io)-powered Next.js sites.
 
 Articles, publications and Broadcast-powered editorial artwork live in [`@sonordev/press-kit`](https://www.npmjs.com/package/@sonordev/press-kit), a companion built on Site Kit. Legacy article imports remain compatible in 8.x.
 
+## Resonance measurement
+
+Site Kit 8.9 adds a consent adapter and childless measurement runtime through
+[`@sonordev/site-kit/resonance`](src/resonance/README.md). It uses current server
+receipts for advertising eligibility and keeps the existing analytics provider
+as the pageview counter. Connect your maintained consent manager before enabling
+measurement. Meta browser delivery remains blocked pending verified automatic
+collection controls.
+
 ## Install
 
 ```bash

package/agent-manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@sonordev/site-kit",
-  "version": "8.8.0",
+  "version": "8.9.0",
   "description": "Machine-readable manifest for coding agents integrating a site with Sonor. See AGENTS.md (shipped) and docs/SITE-KIT-AGENT-NATIVE.md.",
   "env": {
     "required": [
@@ -141,6 +141,13 @@
       "purpose": "Page views, scroll depth, web vitals, heatmap clicks.",
       "caution": "SiteKitLayout already mounts this as a deferred, childless sibling (site-kit >=3.0.2); configure it with analytics={{ ... }} rather than mounting it yourself. Never wrap {children} in AnalyticsProvider: it puts analytics in the hydration path, and lazy-loaded with next/dynamic({ ssr: false }) it de-opts the route to client rendering (SSR bailout). Track custom events with the standalone trackEvent / trackConversion (no provider needed); useAnalytics() throws outside a provider."
     },
+    {
+      "name": "resonance",
+      "import": "@sonordev/site-kit/resonance",
+      "side": "client",
+      "purpose": "Purpose-aware measurement and the maintained CMP adapter. SiteKitLayout mounts its childless runtime. Read getResonanceMeasurementStatus for eligibility and provider blockers.",
+      "caution": "Advertising requires current server proof and purpose grants. Unknown is never a grant. Meta browser collection remains blocked pending verified automatic collection controls. Accepted forms are server conversions. Package availability does not establish site installation or provider delivery."
+    },
     {
       "name": "signal",
       "import": "@sonordev/site-kit/signal",

package/dist/AnalyticsProvider-X7JJN3QL.js

@@ -0,0 +1,19 @@
+export { AnalyticsProvider, useAnalytics, useAnalyticsOptional, useTrackEvent } from './chunk-SO6RSRUP.js';
+import './chunk-AG2RDHYZ.js';
+import './chunk-JT7GHHMV.js';
+import './chunk-L2V5PUFN.js';
+import './chunk-PMXQPO5Q.js';
+import './chunk-NHDRA4Y5.js';
+import './chunk-D4M5K6JN.js';
+import './chunk-GJWI74ZZ.js';
+import './chunk-NZOJHERI.js';
+import './chunk-KMNHNCVG.js';
+import './chunk-5IVD6G77.js';
+import './chunk-DXE6SXWW.js';
+import './chunk-7643MCD2.js';
+import './chunk-64XODP7M.js';
+import './chunk-VXCUXHZO.js';
+import './chunk-W7OPEMGJ.js';
+import './chunk-A4CC4ZG3.js';
+import './chunk-FRY6PBT6.js';
+import './chunk-PKBMQBKP.js';

package/dist/{ArticleViewTracker-PV2RD3P6.js → ArticleViewTracker-7Q6AMCKX.js}

@@ -1,24 +1,25 @@
 'use client';
-import './chunk-Y6SHFILE.js';
+import './chunk-OEOSR5EG.js';
 import './chunk-B7T2SFUF.js';
-import './chunk-OPUY4RS6.js';
+import './chunk-2LBKIE2K.js';
+import './chunk-TPHOIE4I.js';
 import './chunk-6T6CQVNL.js';
-import './chunk-5ROTTMBL.js';
+import './chunk-PVY7X5UR.js';
 import { useDeferredActivation } from './chunk-YC7ELZS3.js';
 import './chunk-H72ZFO3F.js';
 import './chunk-4KZ6W3ZH.js';
 import { withSiteBody } from './chunk-MJP63SSS.js';
 import './chunk-YVKRYQRG.js';
 import './chunk-FESKKJAS.js';
-import './chunk-A4CC4ZG3.js';
-import './chunk-LCDVPAMR.js';
-import './chunk-IPQKQEWI.js';
+import './chunk-AG2RDHYZ.js';
+import './chunk-JT7GHHMV.js';
+import './chunk-D4M5K6JN.js';
 import './chunk-GJWI74ZZ.js';
-import './chunk-5TM3WPCI.js';
-import { sonorFetch } from './chunk-FLOJUMFR.js';
-import './chunk-7HW4TZB5.js';
+import './chunk-5IVD6G77.js';
+import { sonorFetch } from './chunk-VXCUXHZO.js';
 import { readPublishedApiConfig, readPublishedSite } from './chunk-W7OPEMGJ.js';
-import './chunk-F6WLHVMQ.js';
+import './chunk-A4CC4ZG3.js';
+import './chunk-FRY6PBT6.js';
 import './chunk-PKBMQBKP.js';
 import { useEffect } from 'react';
 

package/dist/{BlocksPopup-NEEFV2L3.js → BlocksPopup-U5VIYEBA.js}

@@ -1,15 +1,14 @@
 'use client';
-import { getSiteDesignTokens } from './chunk-URLTBVRX.js';
+import { getSiteDesignTokens } from './chunk-6EDE7BOE.js';
 import { DEFAULT_POPUP_TOKENS, PopupBlocks } from './chunk-52KO4LKD.js';
 import './chunk-XLAHRN4B.js';
 import { normalizePopupBlocks, toHexColor, readableOn } from './chunk-XHYE24HU.js';
 import './chunk-S22FSH7C.js';
-import './chunk-ZQSCMYZO.js';
+import './chunk-DXE6SXWW.js';
+import './chunk-7643MCD2.js';
 import './chunk-64XODP7M.js';
-import './chunk-FLOJUMFR.js';
-import './chunk-7HW4TZB5.js';
+import './chunk-VXCUXHZO.js';
 import './chunk-W7OPEMGJ.js';
-import './chunk-F6WLHVMQ.js';
 import './chunk-PKBMQBKP.js';
 import { useState } from 'react';
 import { jsx } from 'react/jsx-runtime';

package/dist/ChatWidget-EAATOFCT.js

@@ -0,0 +1,30 @@
+export { ChatWidget, EchoChat, isChatEnabled } from './chunk-CJ43K7RA.js';
+import './chunk-6T6CQVNL.js';
+import './chunk-JE4A5S4F.js';
+import './chunk-27FISYK4.js';
+import './chunk-UG53ZW7S.js';
+import './chunk-Q6E4OPGG.js';
+import './chunk-MDBXGN6W.js';
+import './chunk-PVY7X5UR.js';
+import './chunk-C2FZBUSS.js';
+import './chunk-TYSIAWC3.js';
+import './chunk-HW7B43E5.js';
+import './chunk-NJCTQH2P.js';
+import './chunk-S22FSH7C.js';
+import './chunk-L2V5PUFN.js';
+import './chunk-PMXQPO5Q.js';
+import './chunk-NHDRA4Y5.js';
+import './chunk-D4M5K6JN.js';
+import './chunk-GJWI74ZZ.js';
+import './chunk-NZOJHERI.js';
+import './chunk-KMNHNCVG.js';
+import './chunk-5IVD6G77.js';
+import './chunk-DXE6SXWW.js';
+import './chunk-7643MCD2.js';
+import './chunk-64XODP7M.js';
+import './chunk-VXCUXHZO.js';
+import './chunk-W7OPEMGJ.js';
+import './chunk-A4CC4ZG3.js';
+import './chunk-MOACHHOJ.js';
+import './chunk-FRY6PBT6.js';
+import './chunk-PKBMQBKP.js';

package/dist/{FileField-MJ3RCNFJ.js → FileField-YWMSK7RF.js}

@@ -1,8 +1,6 @@
 'use client';
-import { sonorFetch } from './chunk-FLOJUMFR.js';
-import './chunk-7HW4TZB5.js';
+import { sonorFetch } from './chunk-VXCUXHZO.js';
 import { getClientApiConfig } from './chunk-W7OPEMGJ.js';
-import './chunk-F6WLHVMQ.js';
 import './chunk-PKBMQBKP.js';
 import React2, { useState, useRef } from 'react';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';

package/dist/{FormSpotlight-NQPQFZS7.js → FormSpotlight-MAXDW3TK.js}

@@ -1,6 +1,6 @@
 'use client';
 import { StageStyles, SummaryTick } from './chunk-3YKQLC7J.js';
-import { stageFirstName, useFieldControls, stageViews, stageEstimate, AUTO_ADVANCE_TYPES } from './chunk-GQN4BGK6.js';
+import { stageFirstName, useFieldControls, stageViews, stageEstimate, AUTO_ADVANCE_TYPES } from './chunk-OUD4RTBD.js';
 import { readAgentSubmit, formToolAttributes } from './chunk-Q6E4OPGG.js';
 import { isEmptyValue, unseenControlValues, isDisplayOnly } from './chunk-C2FZBUSS.js';
 import { FormField } from './chunk-CVADNHJ4.js';

package/dist/{FormStage-4T5PJR5K.js → FormStage-VAHRVOIZ.js}

@@ -1,6 +1,6 @@
 'use client';
 import { StageStyles, SummaryTick } from './chunk-3YKQLC7J.js';
-import { useFieldControls, stageViews, stageFirstName, stageEstimate, formatAnswer, AUTO_ADVANCE_TYPES } from './chunk-GQN4BGK6.js';
+import { useFieldControls, stageViews, stageFirstName, stageEstimate, formatAnswer, AUTO_ADVANCE_TYPES } from './chunk-OUD4RTBD.js';
 import { readAgentSubmit, formToolAttributes } from './chunk-Q6E4OPGG.js';
 import { isEmptyValue, unseenControlValues } from './chunk-C2FZBUSS.js';
 import { FormField } from './chunk-CVADNHJ4.js';

package/dist/ManagedForm-7IZT7ZII.js

@@ -0,0 +1,29 @@
+export { ManagedForm } from './chunk-S33CUULL.js';
+import './chunk-OUD4RTBD.js';
+import './chunk-UG53ZW7S.js';
+import './chunk-Q6E4OPGG.js';
+import './chunk-MDBXGN6W.js';
+import './chunk-PVY7X5UR.js';
+import './chunk-C2FZBUSS.js';
+import './chunk-DXO6SBMD.js';
+import './chunk-CVADNHJ4.js';
+import './chunk-TYSIAWC3.js';
+import './chunk-HW7B43E5.js';
+import './chunk-NJCTQH2P.js';
+import './chunk-L2V5PUFN.js';
+import './chunk-PMXQPO5Q.js';
+import './chunk-NHDRA4Y5.js';
+import './chunk-D4M5K6JN.js';
+import './chunk-GJWI74ZZ.js';
+import './chunk-NZOJHERI.js';
+import './chunk-KMNHNCVG.js';
+import './chunk-5IVD6G77.js';
+import './chunk-DXE6SXWW.js';
+import './chunk-7643MCD2.js';
+import './chunk-64XODP7M.js';
+import './chunk-VXCUXHZO.js';
+import './chunk-W7OPEMGJ.js';
+import './chunk-A4CC4ZG3.js';
+import './chunk-MOACHHOJ.js';
+import './chunk-FRY6PBT6.js';
+import './chunk-PKBMQBKP.js';

package/dist/{ManagedNewsletterForm-TUYGN6O3.js → ManagedNewsletterForm-VVXZSEAL.js}

@@ -1,12 +1,13 @@
-import './chunk-DYROJGI2.js';
-import './chunk-YGGDU6C3.js';
-import './chunk-G7BRCSV6.js';
-import './chunk-GQN4BGK6.js';
+import './chunk-6NLVHTYY.js';
 import './chunk-SOD2F6C2.js';
-import { useForm } from './chunk-IWNJCRXW.js';
+import './chunk-YGGDU6C3.js';
+import './chunk-S33CUULL.js';
+import './chunk-OUD4RTBD.js';
+import { useForm } from './chunk-UG53ZW7S.js';
 import './chunk-Q6E4OPGG.js';
-import './chunk-5ROTTMBL.js';
-import './chunk-SLFYTELD.js';
+import './chunk-MDBXGN6W.js';
+import './chunk-PVY7X5UR.js';
+import './chunk-J4LJE4NB.js';
 import './chunk-C2FZBUSS.js';
 import './chunk-YC7ELZS3.js';
 import './chunk-DXO6SBMD.js';
@@ -17,12 +18,21 @@ import './chunk-NJCTQH2P.js';
 import { NewsletterShell } from './chunk-JHTPHA2D.js';
 import './chunk-DJAYFHVF.js';
 import './chunk-L2V5PUFN.js';
+import './chunk-PMXQPO5Q.js';
+import './chunk-NHDRA4Y5.js';
+import './chunk-D4M5K6JN.js';
 import './chunk-GJWI74ZZ.js';
-import './chunk-5TM3WPCI.js';
-import './chunk-FLOJUMFR.js';
-import './chunk-7HW4TZB5.js';
+import './chunk-NZOJHERI.js';
+import './chunk-KMNHNCVG.js';
+import './chunk-5IVD6G77.js';
+import './chunk-DXE6SXWW.js';
+import './chunk-7643MCD2.js';
+import './chunk-64XODP7M.js';
+import './chunk-VXCUXHZO.js';
 import './chunk-W7OPEMGJ.js';
-import './chunk-F6WLHVMQ.js';
+import './chunk-A4CC4ZG3.js';
+import './chunk-MOACHHOJ.js';
+import './chunk-FRY6PBT6.js';
 import './chunk-PKBMQBKP.js';
 import { jsxs, jsx } from 'react/jsx-runtime';
 

package/dist/{SignalCore-OW3YIH6M.js → SignalCore-HAN4O7QG.js}

@@ -1,17 +1,23 @@
 'use client';
-import { getOrCreateVisitorId, getOrCreateSessionId } from './chunk-IPQKQEWI.js';
+import { getFreshCredential } from './chunk-FAY6MOLL.js';
+import { isSiteToken } from './chunk-TPHOIE4I.js';
+import { getOrCreateSessionId, getOrCreateVisitorId } from './chunk-JT7GHHMV.js';
 import { onPageLeave } from './chunk-L2V5PUFN.js';
+import { RESONANCE_SUBJECT_HEADER } from './chunk-NHDRA4Y5.js';
+import './chunk-D4M5K6JN.js';
 import './chunk-GJWI74ZZ.js';
-import './chunk-5TM3WPCI.js';
-import { isPrivatePreview } from './chunk-ZQSCMYZO.js';
+import { experimentMeasurementPermitted, currentSubjectProof } from './chunk-KMNHNCVG.js';
+import './chunk-5IVD6G77.js';
+import './chunk-DXE6SXWW.js';
+import { resolveAnalyticsTarget } from './chunk-7643MCD2.js';
 import './chunk-64XODP7M.js';
-import { sonorFetch } from './chunk-FLOJUMFR.js';
-import { getFreshCredential, isSiteToken } from './chunk-7HW4TZB5.js';
-import { getClientApiConfig } from './chunk-W7OPEMGJ.js';
-import './chunk-F6WLHVMQ.js';
+import { sonorFetch } from './chunk-VXCUXHZO.js';
+import { getClientApiConfig, readPublishedSite } from './chunk-W7OPEMGJ.js';
+import { subscribeMeasurementPolicy, measurementPolicySnapshot, serverMeasurementPolicySnapshot, analyticsPurposePermitted } from './chunk-FRY6PBT6.js';
 import './chunk-PKBMQBKP.js';
-import { useState, useRef, useEffect, useCallback } from 'react';
+import { useState, useRef, useSyncExternalStore, useEffect, useCallback } from 'react';
 
+var getClientSite = () => readPublishedSite() || (typeof window !== "undefined" ? window.location.host : "");
 function getApiConfig() {
   return getClientApiConfig();
 }
@@ -56,6 +62,7 @@ function SignalCore({
   onState
 }) {
   const [config, setConfig] = useState(null);
+  const [assignmentRevision, setAssignmentRevision] = useState(0);
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState(null);
   const eventSourceRef = useRef(null);
@@ -66,19 +73,53 @@ function SignalCore({
   const scrollDepthRef = useRef(0);
   const clickCountRef = useRef(0);
   const { apiUrl, apiKey } = getApiConfig();
-  const resolvedVisitorId = externalVisitorId || getOrCreateVisitorId();
-  const resolvedSessionId = externalSessionId || getOrCreateSessionId();
+  const policy = useSyncExternalStore(subscribeMeasurementPolicy, measurementPolicySnapshot, serverMeasurementPolicySnapshot);
+  const [identity, setIdentity] = useState({ visitor: "", session: "" });
+  const permitted = () => analyticsPurposePermitted() && !!resolveAnalyticsTarget({ apiUrl, apiKey });
+  const epoch = policy.collectionEpoch;
+  const allowed = () => permitted() && measurementPolicySnapshot().collectionEpoch === epoch;
   useEffect(() => {
-    onState({ config, loading, error });
-  }, [config, loading, error, onState]);
+    if (!permitted()) {
+      setIdentity({ visitor: "", session: "" });
+      return;
+    }
+    setIdentity({ visitor: externalVisitorId || getOrCreateVisitorId(), session: externalSessionId || getOrCreateSessionId() });
+  }, [epoch, externalVisitorId, externalSessionId, apiUrl, apiKey]);
+  const resolvedVisitorId = identity.visitor;
+  const resolvedSessionId = identity.session;
+  useEffect(() => subscribeMeasurementPolicy(() => {
+    if (!allowed()) {
+      eventQueueRef.current = [];
+      assignmentsRef.current.clear();
+      eventSourceRef.current?.close();
+      eventSourceRef.current = null;
+      if (flushTimeoutRef.current) clearTimeout(flushTimeoutRef.current);
+      setConfig(null);
+    }
+  }), [epoch, apiUrl, apiKey]);
+  useEffect(() => {
+    onState({ config, loading, error, assignmentRevision });
+  }, [config, loading, error, assignmentRevision, onState]);
   const loadExperimentAssignment = useCallback(async (experimentId) => {
-    const storageKey = `_signal_exp_${experimentId}`;
-    const stored = localStorage.getItem(storageKey);
+    if (!allowed() || !resolvedVisitorId) return null;
+    const managed = measurementPolicySnapshot().policy === "configured";
+    if (managed && !experimentMeasurementPermitted()) return null;
+    const proof = managed ? currentSubjectProof() : null;
+    if (managed && assignmentsRef.current.delete(experimentId)) setAssignmentRevision((value) => value + 1);
+    const storageKey = `_sk_signal_exp_${experimentId}`;
+    let stored = null;
+    if (!managed) {
+      try {
+        stored = localStorage.getItem(storageKey);
+      } catch {
+      }
+    }
     if (stored) {
       try {
         const assignment = JSON.parse(stored);
         if (assignment.expires > Date.now()) {
           assignmentsRef.current.set(experimentId, assignment);
+          setAssignmentRevision((value) => value + 1);
           return assignment;
         }
       } catch {
@@ -86,29 +127,38 @@ function SignalCore({
     }
     try {
       const response = await sonorFetch(
-        `${apiUrl}/api/public/signal/experiment/${experimentId}`,
+        `${apiUrl}/api/public/signal/experiment/${experimentId}?site=${encodeURIComponent(getClientSite())}`,
         {
           headers: {
-            "x-visitor-id": resolvedVisitorId
+            "x-visitor-id": resolvedVisitorId,
+            ...currentSubjectProof() ? { [RESONANCE_SUBJECT_HEADER]: currentSubjectProof().subjectProof } : {}
           }
         },
-        { apiKey }
+        { apiKey, shouldSend: allowed }
       );
       if (!response.ok) return null;
       const assignment = await response.json();
-      localStorage.setItem(storageKey, JSON.stringify(assignment));
+      if (!allowed() || managed && (!proof || currentSubjectProof()?.subjectProof !== proof.subjectProof || assignment.site !== getClientSite() || !assignment.assignment_id || !assignment.experiment_revision)) return null;
+      if (!managed) {
+        try {
+          localStorage.setItem(storageKey, JSON.stringify(assignment));
+        } catch {
+        }
+      }
       assignmentsRef.current.set(experimentId, assignment);
+      setAssignmentRevision((value) => value + 1);
       return assignment;
     } catch (err) {
       if (isDebug()) console.error("[Signal] Experiment assignment error:", err);
       return null;
     }
-  }, [apiUrl, apiKey]);
+  }, [apiUrl, apiKey, resolvedVisitorId, resolvedSessionId, epoch, policy.proof]);
   const getExperiment = useCallback((experimentId) => {
+    if (!permitted() || measurementPolicySnapshot().policy === "configured" && !experimentMeasurementPermitted()) return null;
     return assignmentsRef.current.get(experimentId) || null;
   }, []);
   const fetchConfig = useCallback(async () => {
-    if (!apiKey || !enabled || isPrivatePreview()) {
+    if (!apiKey || !enabled || !allowed() || !resolvedVisitorId) {
       setLoading(false);
       return;
     }
@@ -117,15 +167,17 @@ function SignalCore({
         `${apiUrl}/api/public/signal/config`,
         {
           headers: {
-            "x-visitor-id": resolvedVisitorId
+            "x-visitor-id": resolvedVisitorId,
+            ...currentSubjectProof() ? { [RESONANCE_SUBJECT_HEADER]: currentSubjectProof().subjectProof } : {}
           }
         },
-        { apiKey }
+        { apiKey, shouldSend: allowed }
       );
       if (!response.ok) {
         throw new Error(`Failed to fetch Signal config: ${response.statusText}`);
       }
       const data = await response.json();
+      if (!allowed()) return;
       setConfig(data.config);
       setError(null);
       if (experiments && data.config?.experiments) {
@@ -143,7 +195,7 @@ function SignalCore({
     }
   }, [apiUrl, apiKey, enabled, experiments, resolvedVisitorId, loadExperimentAssignment]);
   const connectSSE = useCallback(() => {
-    if (!apiKey || !enabled || !realtime || isPrivatePreview()) return;
+    if (!apiKey || !enabled || !realtime || !allowed() || measurementPolicySnapshot().policy === "configured") return;
     if (eventSourceRef.current) {
       eventSourceRef.current.close();
       eventSourceRef.current = null;
@@ -156,7 +208,7 @@ function SignalCore({
         }
         return;
       }
-      if (eventSourceRef.current) return;
+      if (!allowed() || eventSourceRef.current) return;
       const url = `${apiUrl}/api/public/signal/stream?token=${encodeURIComponent(credential)}`;
       connectEventSource(url);
     })();
@@ -200,7 +252,7 @@ function SignalCore({
     }
   }, [apiUrl, apiKey, enabled, realtime, loadExperimentAssignment]);
   const flushEvents = useCallback(async () => {
-    if (isPrivatePreview()) {
+    if (!allowed() || !resolvedVisitorId || !resolvedSessionId) {
       eventQueueRef.current = [];
       return;
     }
@@ -219,15 +271,15 @@ function SignalCore({
             events
           })
         },
-        { apiKey, retries: 0 }
+        { apiKey, retries: 0, shouldSend: allowed }
       );
     } catch (err) {
-      eventQueueRef.current = [...events, ...eventQueueRef.current];
+      if (allowed()) eventQueueRef.current = [...events, ...eventQueueRef.current].slice(0, 100);
       if (isDebug()) console.error("[Signal] Event flush error:", err);
     }
-  }, [apiUrl, apiKey]);
+  }, [apiUrl, apiKey, resolvedVisitorId, resolvedSessionId, epoch]);
   const trackEvent = useCallback((event) => {
-    if (!enabled || !apiKey || isPrivatePreview()) return;
+    if (!enabled || !apiKey || !allowed() || !resolvedVisitorId || !resolvedSessionId) return;
     const enrichedEvent = {
       ...event,
       page_url: window.location.href,
@@ -249,14 +301,14 @@ function SignalCore({
       page_metadata: pageMetadataRef?.current ?? void 0,
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     };
-    eventQueueRef.current.push(enrichedEvent);
+    if (eventQueueRef.current.length < 100) eventQueueRef.current.push(enrichedEvent);
     if (flushTimeoutRef.current) {
       clearTimeout(flushTimeoutRef.current);
     }
     flushTimeoutRef.current = setTimeout(flushEvents, 1e3);
-  }, [enabled, apiKey, flushEvents]);
+  }, [enabled, apiKey, flushEvents, epoch]);
   const trackOutcome = useCallback(async (outcome) => {
-    if (!enabled || !apiKey || isPrivatePreview()) return;
+    if (!enabled || !apiKey || !allowed() || !resolvedVisitorId || !resolvedSessionId) return;
     try {
       await sonorFetch(
         `${apiUrl}/api/public/signal/outcome`,
@@ -272,21 +324,23 @@ function SignalCore({
             timestamp: (/* @__PURE__ */ new Date()).toISOString()
           })
         },
-        { apiKey, retries: 0 }
+        { apiKey, retries: 0, shouldSend: allowed }
       );
     } catch (err) {
       if (isDebug()) console.error("[Signal] Outcome tracking error:", err);
     }
-  }, [apiUrl, apiKey, enabled]);
+  }, [apiUrl, apiKey, enabled, resolvedVisitorId, resolvedSessionId, epoch]);
   useEffect(() => {
-    if (!behaviorTracking || typeof window === "undefined") return;
+    if (!behaviorTracking || typeof window === "undefined" || !allowed()) return;
     const handleScroll = () => {
+      if (!allowed()) return;
       const scrollTop = window.scrollY;
       const docHeight = document.documentElement.scrollHeight - window.innerHeight;
       const depth = docHeight > 0 ? Math.round(scrollTop / docHeight * 100) : 0;
       scrollDepthRef.current = Math.max(scrollDepthRef.current, depth);
     };
     const handleClick = () => {
+      if (!allowed()) return;
       clickCountRef.current++;
     };
     window.addEventListener("scroll", handleScroll, { passive: true });
@@ -297,7 +351,7 @@ function SignalCore({
       window.removeEventListener("click", handleClick);
       stopLeaveListener();
     };
-  }, [behaviorTracking, flushEvents]);
+  }, [behaviorTracking, flushEvents, epoch]);
   useEffect(() => {
     fetchConfig();
   }, [fetchConfig]);

package/dist/{SiteChat-XMKHBSEK.js → SiteChat-3JLCEL2N.js}

@@ -1,6 +1,6 @@
-export { SiteChat } from './chunk-SBPUFTMP.js';
+export { SiteChat } from './chunk-WHFWDK2H.js';
 import './chunk-27FISYK4.js';
-import './chunk-ZQSCMYZO.js';
+import './chunk-7643MCD2.js';
 import './chunk-64XODP7M.js';
 import './chunk-W7OPEMGJ.js';
 import './chunk-PKBMQBKP.js';

package/dist/{SiteDesignReporter-BRH7ORQS.js → SiteDesignReporter-6CCO645E.js}

@@ -1,13 +1,12 @@
-export { SiteDesignReporter } from './chunk-6BFQI3ZE.js';
-import './chunk-URLTBVRX.js';
+export { SiteDesignReporter } from './chunk-IO6BWRZ5.js';
+import './chunk-6EDE7BOE.js';
 import './chunk-XLAHRN4B.js';
 import './chunk-XHYE24HU.js';
 import './chunk-YC7ELZS3.js';
 import './chunk-S22FSH7C.js';
-import './chunk-ZQSCMYZO.js';
+import './chunk-DXE6SXWW.js';
+import './chunk-7643MCD2.js';
 import './chunk-64XODP7M.js';
-import './chunk-FLOJUMFR.js';
-import './chunk-7HW4TZB5.js';
+import './chunk-VXCUXHZO.js';
 import './chunk-W7OPEMGJ.js';
-import './chunk-F6WLHVMQ.js';
 import './chunk-PKBMQBKP.js';

package/dist/SitePopups-ZGHQNGGH.js

@@ -0,0 +1,19 @@
+export { SitePopups } from './chunk-EBEM5BI5.js';
+import './chunk-27FISYK4.js';
+import './chunk-PVY7X5UR.js';
+import './chunk-JT7GHHMV.js';
+import './chunk-PMXQPO5Q.js';
+import './chunk-NHDRA4Y5.js';
+import './chunk-D4M5K6JN.js';
+import './chunk-GJWI74ZZ.js';
+import './chunk-NZOJHERI.js';
+import './chunk-KMNHNCVG.js';
+import './chunk-5IVD6G77.js';
+import './chunk-DXE6SXWW.js';
+import './chunk-7643MCD2.js';
+import './chunk-64XODP7M.js';
+import './chunk-VXCUXHZO.js';
+import './chunk-W7OPEMGJ.js';
+import './chunk-A4CC4ZG3.js';
+import './chunk-FRY6PBT6.js';
+import './chunk-PKBMQBKP.js';

package/dist/SitemapSync-5LSYCBKS.js

@@ -0,0 +1,7 @@
+export { SitemapSync } from './chunk-ADQ3VCKK.js';
+import './chunk-YVKRYQRG.js';
+import './chunk-7643MCD2.js';
+import './chunk-64XODP7M.js';
+import './chunk-VXCUXHZO.js';
+import './chunk-W7OPEMGJ.js';
+import './chunk-PKBMQBKP.js';

package/dist/SitemapSync.d.ts

@@ -12,7 +12,7 @@
  * import { SitemapSync } from '@sonordev/site-kit/seo'
  * ```
  */
-import { type AnalyticsGateOptions } from './shared/reporting-gate';
+import { type AnalyticsGateOptions } from "./shared/reporting-gate.js";
 interface SitemapSyncProps extends AnalyticsGateOptions {
     /** Custom sitemap URL (defaults to /sitemap.xml) */
     sitemapUrl?: string;

package/dist/_client/booking-widget.d.ts

@@ -1,4 +1,4 @@
 import * as React from 'react';
-import type { BookingWidgetProps } from '../sync/types';
+import type { BookingWidgetProps } from "../sync/types.js";
 export declare function BookingWidget({ orgSlug, apiKey: propApiKey, apiUrl: propApiUrl, bookingTypeSlug, timezone: propTimezone, className, daysToShow, onBookingComplete, onError, hideTypeSelector, autoSelectFirstDay, styles, }: BookingWidgetProps): React.JSX.Element;
 export default BookingWidget;

package/dist/_client/booking-widget.js

@@ -1,10 +1,9 @@
 'use client';
-export { BookingWidget, BookingWidget_default as default } from '../chunk-6DXQHNZK.js';
-import '../chunk-PSS6M4CG.js';
-import '../chunk-5ROTTMBL.js';
-import '../chunk-5TM3WPCI.js';
-import '../chunk-FLOJUMFR.js';
-import '../chunk-7HW4TZB5.js';
+export { BookingWidget, BookingWidget_default as default } from '../chunk-MP35JETP.js';
+import '../chunk-ZRSXCT4O.js';
+import '../chunk-PVY7X5UR.js';
+import '../chunk-5IVD6G77.js';
+import '../chunk-VXCUXHZO.js';
 import '../chunk-W7OPEMGJ.js';
-import '../chunk-F6WLHVMQ.js';
+import '../chunk-FRY6PBT6.js';
 import '../chunk-PKBMQBKP.js';