@sonordev/site-kit 8.8.0 → 8.9.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sonordev/site-kit",
-  "version": "8.8.0",
+  "version": "8.9.0",
   "type": "module",
   "packageManager": "pnpm@11.5.3",
   "description": "Sonor's Next.js foundation: SEO, analytics, forms, chat, booking, AI visibility and agent tools. Add @sonordev/press-kit for publications or @sonordev/commerce-kit for selling. Legacy article imports remain compatible in 8.x.",
@@ -43,6 +43,10 @@
       "types": "./dist/analytics/index.d.ts",
       "default": "./dist/analytics/index.js"
     },
+    "./resonance": {
+      "types": "./dist/resonance/index.d.ts",
+      "default": "./dist/resonance/index.js"
+    },
     "./signal": {
       "types": "./dist/signal/index.d.ts",
       "default": "./dist/signal/index.js"
@@ -373,6 +377,8 @@
     "test:integration:baseline": "node test/integration/run.mjs --update-baseline",
     "test:integration:selfcheck": "node test/integration/checks/selfcheck.mjs",
     "test:integration:setup": "playwright install chromium",
+    "test:meta-capture": "node test/meta-capture/run.mjs",
+    "test:meta-mutants": "node test/meta-capture/run-mutants.mjs",
     "clean": "rm -rf dist",
     "typecheck": "tsc --noEmit",
     "typecheck:setup": "tsc --noEmit -p packages/sonor-setup/tsconfig.json",
@@ -429,7 +435,7 @@
     "@babel/parser": "^8.0.4",
     "@babel/traverse": "^8.0.4",
     "@babel/types": "^8.0.4",
-    "@sonordev/contracts": "^2.7.0",
+    "@sonordev/contracts": "^2.22.0",
     "@types/babel__generator": "^7.27.0",
     "@types/babel__traverse": "^7.28.0",
     "@types/inquirer": "^9.0.10",

package/src/analytics/README.md

@@ -260,3 +260,24 @@ site without forcing each microsite into its own Sonor project.
 Most projects leave it implicit: `NEXT_PUBLIC_SITE_URL` is already set per
 microsite, so the dimension fills in automatically. The dashboard shows a
 "Site" picker + a "Sites" tab as soon as ≥2 distinct hosts are detected.
+
+## Consent-aware collection (8.9)
+
+The shared purpose policy gates identity initialization, collectors and each
+transport attempt. Explicit analytics denial stops collection. Unknown consent
+stops it when your maintained CMP or server policy requires analytics consent.
+Unconfigured legacy analytics retains its unknown-policy behavior.
+
+Connect the existing consent manager through the [Resonance adapter](../resonance/README.md).
+Withdrawal discards pending work so a later grant can't replay it. Resonance
+occurrences are a separate evidence stream and don't increment analytics
+pageview counts. Accepted managed-form conversions remain server-owned.
+
+Configured telemetry carries the current scoped subject proof in its dedicated
+header through the existing analytics transport. The proof is refreshed for
+each attempt and for unload-time keepalive requests. It isn't attached to
+functional or arbitrary API routes, and never enters a URL or browser storage.
+The server checks current receipts independently of the browser gate.
+
+
+Optional telemetry rechecks current purpose permission after transport execution loads and before every attempt. A preference change during loading or credential refresh drops the pending telemetry; it doesn't authorize replay after a later grant. The existing event IDs and functional request bodies keep their meaning.

package/src/cta-bar/README.md

@@ -3,6 +3,10 @@
 The Liquid Glass mobile CTA bar (6.1.0). A floating frosted capsule that
 keeps a site's one or two highest-intent actions a thumb away on phones.
 
+On dynamic routes with Next.js Cache Components, the bar keeps its actions
+in the server-rendered page while its pathname-dependent behavior waits
+inside its own Suspense boundary.
+
 It replaces a hand-rolled sticky mobile bar, and handles what each of those
 ends up solving on its own:
 

package/src/forms/README.md

@@ -342,3 +342,32 @@ import '@sonordev/site-kit/forms/styles.css'  // Optional default styles
 ```
 
 All components use `.sk-form__*` class names. Override with `className` prop or CSS variables.
+
+## Purpose-aware submission and tracking (8.9)
+
+Managed form values can still submit when measurement is denied or unavailable.
+The canonical submit helper refreshes optional measurement context before every
+network attempt, including a credential-refresh retry. A withdrawal removes
+that context while preserving the functional request.
+
+GA4 cookie reads, UTM fields and existing analytics visitor/session IDs follow
+the analytics purpose policy. Advertising grants alone don't authorize those
+reads. The separate opaque measurement proof can accompany an eligible request
+for server verification. A managed experiment exposure reference is included
+only after the measurement endpoint accepted that exposure. The server still
+verifies its subject, scope and current consent against the canonical accepted
+submission. The browser doesn't post a form conversion.
+
+The existing form analytics hook uses the shared analytics gate for starts,
+field interactions, steps, completion and abandonment. Unknown required consent
+and explicit denial stop collection. Regrant creates a fresh tracking period
+without replaying denied interactions. Trackers in the same current period
+still share one row. Legacy sites without an analytics requirement keep their
+first-party unknown-policy behavior.
+
+Connect your maintained consent manager through the
+[Resonance adapter](../resonance/README.md). Keep it separate from newsletter
+subscriptions and form follow-up permission.
+
+
+Functional form submission stays available without optional measurement. Current measurement context is resolved at each actual attempt, including after transport loading or credential refresh. A withdrawn or stale context is omitted from the functional request; it isn't recovered from an old queued grant.

package/src/landing/README.md

@@ -34,6 +34,20 @@ Keep `SiteKitLayout` in your root layout and use its deferred analytics sibling.
 
 Published-page reads use `no-store` in this version so an outdated or removed publication isn't served from the fetch cache. Keep the route dynamic and avoid wrapping this reader in a persistent cache. `managedFunnelMetadata` defaults to noindex, nofollow. Keep these campaign routes out of your sitemap.
 
+On Next.js 16.3 and later with Cache Components, `instant = false` applies
+only to this per-request route. There isn't a useful static publication
+shell: the content and its availability both come from the fresh read.
+Navigation waits for that read, so the complete content and managed form
+arrive as readable server HTML, including without JavaScript. Keep the
+reader uncached and verify visible content with JavaScript disabled.
+
+Add this export to the page **only when `cacheComponents: true` is enabled**
+in your Next config; Next rejects it when Cache Components is off:
+
+```tsx
+export const instant = false
+```
+
 Use the normal revalidation route:
 
 ```ts

package/src/layout/README.md

@@ -99,3 +99,6 @@ on private child routes; they don't include the current URL, preview token, or
 article content. Private preview cache, indexing, and reporting rules stay in
 place. If private pages must contain no discovery tags at all, render
 `AiDiscoveryLinks` in a public route-group layout instead of the root layout.
+
+
+The layout publishes the current credential and first-party identity scope before child effects. Purpose checks stay synchronous while optional runtime work loads, so pending preferences and withdrawal don't create a collection window. Page content remains server-rendered independently of measurement.

package/src/og/README.md

@@ -279,6 +279,34 @@ dropped), and fonts supplied as ArrayBuffers. Reach for it only when the cards
 can't be rendered at build time; per-URL cards in `og.config.ts` cover
 everything `generateStaticParams` can list.
 
+### Full-wordmark article cards
+
+Available in Site Kit 8.8.1 and later.
+
+Pass `logo: { src, width, height, alt }` in the card returned to
+`createOgImage` to select the branded layout. The intrinsic logo dimensions
+preserve its aspect ratio. Use an absolute HTTP(S) image URL or a base64 image
+data URI; rasterizing a local SVG to PNG is useful when preparing assets.
+Invalid logo sources or dimensions throw before rendering.
+
+The 1200×630 card keeps the full wordmark at the upper left, with the title
+below and one edge-to-edge photograph on the right. Set `theme.bg` to the
+publication's light panel color and `theme.text` to its dark text color.
+Optional `kicker` and `bar` provide a small publication label and domain.
+The branded layout uses `title`, `logo`, `photoUrl`, `kicker`, `bar` and the
+theme; `subtitle` belongs to the original layout.
+
+Branded titles fit from 64px down to 36px while retaining the logo and photo.
+Exceptionally long titles receive an ellipsis on the card; full page metadata
+stays unchanged. Without a photo the copy gets the wider panel. Cards without
+`logo` retain the original layout and fitting behavior.
+
+For publication articles, use Press Kit's existing
+`resolveArticleArtwork(post, 'article')` to choose the raw article artwork.
+Don't use an already composed promotional card as `photoUrl`. Supply fonts
+through the existing `fonts` option as ArrayBuffers, and keep the page's
+`generateArticleMetadata` call on `images: false` so the file card is used.
+
 ### Code cards on a `trailingSlash: true` site
 
 Next serves a code card at `<page>/opengraph-image`, with no extension, and

package/src/resonance/README.md

@@ -0,0 +1,273 @@
+# Resonance measurement
+
+`@sonordev/site-kit/resonance` connects the site's consent manager to scoped
+measurement receipts and approved advertising destinations. `SiteKitLayout`
+mounts its childless runtime alongside the existing analytics provider. Page
+content and managed forms still render when measurement is unavailable. The
+small shell blocks unresolved collection immediately; its controller loads
+after the page reaches idle or the visitor interacts.
+
+On dynamic routes with Next.js Cache Components, the layout gives the
+pathname-dependent runtime its own Suspense boundary. Measurement stays
+blocked while it's unresolved, and page content renders independently.
+
+## Connect your consent manager
+
+Register one adapter for the consent manager your site already uses. The
+adapter reads its actual current preferences and subscribes to changes. It
+doesn't create a banner or choose preferences for the visitor.
+
+```tsx
+'use client'
+
+import { useEffect } from 'react'
+import {
+  registerResonanceConsentAdapter,
+  type ResonanceConsentAdapter,
+} from '@sonordev/site-kit/resonance'
+
+// Map these methods to your site's maintained consent manager.
+export function ConsentConnection({ adapter }: { adapter: ResonanceConsentAdapter }) {
+  useEffect(() => registerResonanceConsentAdapter(adapter), [adapter])
+  return null
+}
+```
+
+The adapter supplies `requiredPurposes`, `read()` and `subscribe(onChange)`.
+`read()` may be asynchronous. It returns:
+
+```ts
+{
+  valid: true,
+  observedAt: '2026-10-24T12:00:00Z',
+  source: 'cmp', // or 'user_preference'
+  choices: {
+    analytics_storage: 'granted',
+    ad_storage: 'denied',
+    ad_user_data: 'denied',
+    ad_personalization: 'denied',
+  },
+}
+```
+
+Each purpose can be `unknown`, `granted`, `denied` or `withdrawn`. Return
+`valid: false` when the manager can't establish current preferences. Include
+`analytics_storage` in `requiredPurposes` when your site's policy requires it.
+Notify subscribers as soon as a preference changes. Dispatch stops before an
+asynchronous read completes.
+
+The initial config read creates no measurement subject. A valid current
+preference observation can create a new subject with server receipts. Configured
+collection waits for that receipt response before activating. The
+opaque proof stays in memory and never enters a URL or browser storage. Its
+30-minute renewal doesn't prompt the visitor again or change consent. After
+memory is lost, an actual valid preference observation can establish a new
+subject. Visitor IDs and old receipt IDs can't recover the previous subject.
+
+## What can send?
+
+Advertising requires a current server proof and grants for `ad_storage`,
+`ad_user_data` and `ad_personalization`, plus any additional configured purpose.
+Explicit analytics denial stops first-party tracking. Required but unknown
+analytics consent also stops it. Legacy sites without a configured requirement
+keep their first-party analytics behavior, recorded as unknown policy rather
+than a consent grant.
+
+The existing analytics provider remains the pageview counter. Resonance
+occurrences supply separate retargeting and experiment evidence. Resource
+interest uses approved resource IDs. It doesn't submit raw query strings,
+form values or DOM text. Accepted forms become conversions on the server.
+
+Withdrawal clears pending occurrence retries and prevents delayed work from
+crossing into a later grant. Granting again records the current page with a
+new occurrence ID. It doesn't replay denied page history. Failed occurrence
+requests can retry with the same event ID while their scope and consent remain
+current. Already delivered provider requests can't be retracted.
+
+## Advertising click lineage
+
+After the current advertising grants and scoped proof are available, a new
+page-view occurrence can carry one `gclid`, `gbraid` or `wbraid` from the current
+URL. The live pathname must match the navigation being recorded. Duplicate or
+mixed identifiers, whitespace, control characters and values longer than 1024
+characters leave matching data absent. The length is an application transport
+bound. Other occurrence kinds don't carry click identifiers.
+
+This path works when analytics consent is denied and the configured advertising
+policy doesn't additionally require it. The runtime doesn't retain a query from
+before consent or recover one that's been removed. Retries use the same event
+within its current consent and scope; withdrawal clears them. An already
+recorded page isn't updated with a later identifier. No click identifier enters
+browser storage or public status output.
+
+An observed identifier doesn't prove a paid click. The server owns the link to
+the actual accepted form and checks qualification and current advertising
+consent before export. Deploy its accepting occurrence parser before enabling
+the browser change.
+
+## Same-page Meta cookie observation
+
+After the required advertising grants and actual scoped consent proof are
+available, the existing page-view occurrence can include an SDK-reported
+`metaCookieObservation`. The runtime reads only actual `_fbp` and `_fbc`
+cookies from the current page. It doesn't construct `fbc` from a click URL,
+write cookies, retain a cookie jar, or install Meta's browser SDK.
+
+Matching requires a unique configured page resource for the current path.
+The occurrence uses that exact native resource reference and the same
+navigation's `pagePath`. Missing or ambiguous mappings leave the base view
+unmatched. Cookie reads don't run before persisted consent, for an unmatched
+page, or after consent/proof/config expiry. The live pathname must match
+before and after reading. Duplicate cookie names are omitted. The shared
+occurrence parser rejects invalid matching values; valid values contain
+1–1024 Unicode characters without whitespace or controls. Invalid optional
+matching leaves the valid base occurrence intact.
+
+This enriches one existing page view. It doesn't add another page-view
+counter, create a business conversion or claim that a person rendered the
+page. Existing content-interest evidence remains separate. Retries retain
+the exact original event ID, navigation, time and captured body without
+reading cookies again. Repeated consent notifications or configuration-cache
+refreshes don't update an already recorded view. Withdrawal clears pending
+work; a later grant can record only the current page with a new event.
+
+Raw matching isn't forwarded through the provider event allowlist, public
+status or browser storage. The accepting API must support the occurrence
+shape and verify the actual owned page, current source rules and consent
+before enabling this browser version. An accepted capture doesn't grant a
+feed, prove native audience admission or establish provider delivery. Those
+checks and the original grant/claim/time fences remain server-owned.
+
+## Provider capabilities
+
+Google's allowlisted tag loads after the required grants. Automatic pageviews
+are disabled. Browser events use an explicit safe page location, empty
+referrer and approved resource fields. The runtime has no browser conversion
+action. A pre-existing Google tag or tag manager blocks installation until
+compatibility is resolved, preventing a second installation.
+
+## Meta browser pixel
+
+The browser pixel exists for one reason: so Meta's own first-party cookies
+(`_fbp`, and `_fbc` when a visitor arrives from a Meta ad click) exist on pages
+you've approved. It sends no browser events. The only Meta event for a visit is
+the server's Conversions API `PageView`, and the runtime exposes no `track`
+capability. It passes no user data to the pixel, reads no form field, page title
+or page metadata, and attaches no click or submit listener. It never writes
+`_fbp` or `_fbc` itself and never builds one from a click URL.
+
+**It's switched off in this release.** Site Kit 8.9.0 can't start the pixel.
+This build implements no loader controls revision, so even a capability
+witness from the server can't lift `meta_browser_collection_unverified`, and
+`getResonanceMeasurementStatus()` keeps reporting it. A later release turns the
+loader on. Everything below describes how it will behave then.
+
+When it's on, a site's pixel starts only if the server's configuration carries
+a capability witness for that site. The witness names the loader controls
+revision and the policy revision it was issued under, and the runtime refuses a
+revision it doesn't implement, a witness from an older policy, and a witness
+issued more than 48 hours ago, and it withdraws a running pixel if the witness
+lapses mid-session. A site without a witness loads nothing. The lift is per
+site, and a configuration refresh that removes the witness, the destination or
+`enabled` withdraws the pixel. The longest that can take is the configuration's
+own expiry.
+
+**What loads, and when.** Nothing exists before consent: no script, no
+`window.fbq`, no cookie, no storage key. After the three advertising grants
+(`ad_storage`, `ad_user_data`, `ad_personalization`) and a current scoped proof,
+and on a page that's eligible and clean, the runtime queues consent revoked,
+automatic configuration off and `init` with only the dataset ID from your
+signed configuration, then inserts
+`https://connect.facebook.net/en_US/fbevents.js` (async, no referrer). Once the
+script has run, and the consent fence still holds, it grants consent. Each step
+rechecks the fence. A grant that's queued ahead of the script doesn't release
+the pixel's own lock, which is why the grant waits.
+
+**Which pages.** A page is eligible only when its configured page resource has
+`metaEligible: true`, which a person with owner or admin standing sets in
+Sonor. It defaults to false, an agent can't set it, and the browser never
+decides it. The same flag gates the cookie observation described above. The
+runtime also refuses, with `meta_page_not_eligible`: any frame, a private
+preview, a local host, a Sonor application host, a page carrying
+`data-sk-authenticated`, and these paths and their children: `/admin`,
+`/account`, `/dashboard`, `/login`, `/signin`, `/signup`, `/checkout`, `/cart`,
+`/portal`, `/api` and `/preview`. Put `data-sk-authenticated` on the document in
+any layout that sits behind a login.
+
+**Clean URLs only.** The pixel reads the page URL and referrer on its own, so
+the runtime doesn't start it, and pauses it on a single-page navigation, unless
+the query holds only `fbclid`, `sonor_source` or `utm_*` keys with plain
+values, there's no fragment, and the referrer is empty, an origin-only
+cross-site address, or a same-site address whose path isn't on the denied list above and whose query follows the same rule.
+Otherwise the status shows `meta_url_not_clean`. There's no rewriting.
+
+**One pixel per page.** A page with its own `fbq`, a Meta script tag, a pixel
+image or `noscript`, or a tag manager gets `meta_duplicate_installation` and no
+second pixel. A tag manager clears only through an approved attestation in the
+signed configuration. A changed dataset ID or scope under a running pixel shows
+`meta_scope_change_requires_reload`, and more than one Meta destination shows
+`meta_multiple_destinations`. A script that's blocked or fails shows
+`meta_load_failed`. It isn't retried and no image or `noscript` fallback is
+added.
+
+**Withdrawal.** When consent, the proof or the configuration lapses, the runtime
+sets the pixel's consent to revoked, stops issuing commands and, once the pixel has
+run, expires `_fbp` and `_fbc` on the host and its parent domains, whether or not
+consent was ever granted on that page. Code that has already run can't
+be retracted, so the guarantee is that nothing further is sent. A later grant
+starts fresh and never replays an earlier visit.
+
+**For your site.** Your consent manager's vendor list and privacy notice must
+name Meta, and the Conversions API user agent has its own consent wording.
+Sites that ship a Content Security Policy need `script-src` for
+`https://connect.facebook.net`, plus `connect-src` and `img-src` for
+`https://connect.facebook.net` and `https://www.facebook.com`. Site-kit's
+`securityHeaders` emits none of these. First-party receipts alone don't prove
+provider audience admission, conversion matching or attribution.
+
+Read `getResonanceMeasurementStatus()` to inspect the current policy and
+provider blockers. `advertisingPermitted` describes consent eligibility. It
+doesn't establish provider delivery or an installed campaign.
+
+Managed experiments require the server's current assignment ID, experiment
+revision and site. Without that witness, the existing experiment component
+shows its control content. Its exposure reference records the assignment
+actually rendered. Forms remain usable with measurement denied or unavailable.
+
+## Other layouts and verification
+
+A custom layout can mount `<ResonanceRuntime site="example.com" ... />` as a
+childless sibling after publishing the existing browser-safe site credential.
+Use the established server credential component. Don't expose a raw API key.
+Mount one runtime per document.
+
+Verify unknown, grant and withdrawal states against your actual consent
+manager before enabling a campaign. Check preview suppression, navigation,
+scope changes and failed requests using intercepted provider URLs. A built or
+packed package isn't proof that a site installed it or that a provider accepted
+an event.
+
+### Current config and public source markers
+
+Config freshness renews through a public read. An unchanged revision preserves
+current consent; it doesn't create another subject or prompt. A changed config
+or policy stops the previous scope and reads actual current preferences before
+establishing the new scope. A failed lookup can't turn a configured requirement
+into legacy permission. Advertising stops when proof or config expires.
+
+The runtime reads only the bounded `sonor_source` parameter for campaign source
+mapping. It forwards that marker on a current permitted occurrence. The server
+verifies its signature and approved plan/destination scope. Other query fields
+don't become measurement payload. A marker authenticates reviewed source
+mapping, not a paid click or causal result. A visit made before consent isn't
+replayed after the visitor has moved to another page.
+
+The actual managed form submit refreshes its optional proof at each attempt.
+Its accepted exposure reference comes from the measurement response. Analytics
+and advertising purposes remain separate, and canonical form conversion stays
+on the server. Compatible Google installations created by this runtime can be
+reused for the same project/site and exact tag set. Changed scope or unknown
+installations expose a blocker instead of initializing another tag.
+
+
+The controller registry is shared by status observations, rendered experiment exposures and per-attempt form context. These readers use the same current policy and proof; none creates a grant. Deferred transport execution rechecks its current permission fence before sending, including after loading or credential refresh.

package/src/runtime/README.md

@@ -12,7 +12,7 @@ Building a site? You don't need this entry. Forms, analytics, articles and the r
 | `getClientApiConfig(options?)` | Find the API origin and credential. In the browser that's what `SiteKitLayout` published. During server rendering it's the server's `SONOR_API_URL`, and with `{ serverKey: true }` its `SONOR_API_KEY`. |
 | `readPublishedApiConfig()` | Exactly what `SiteKitLayout` published, with no fallbacks. For code that must stay quiet on a page without the layout. |
 | `DEFAULT_SONOR_API_URL` | `https://api.sonor.io`. |
-| `readAnalyticsIdentity()` | Get the visitor's analytics ids, `{ sessionId, visitorId }`, so what you send to Sonor ties to the visit analytics recorded. It only reads: either id is `null` during server rendering and before analytics has started a session in the tab. It never throws, including when the browser blocks site storage. |
+| `readAnalyticsIdentity()` | Get the visitor's analytics ids, `{ sessionId, visitorId }`, so what you send to Sonor ties to the visit analytics recorded. It only reads: either id is `null` during server rendering and before analytics has started a session in the tab. It returns null ids when current analytics permission blocks collection. It never throws, including when the browser blocks site storage. |
 
 The types `SonorFetchOptions`, `FetchRetryOptions`, `ClientApiConfigOptions` and `AnalyticsIdentity` come with them.
 
@@ -46,6 +46,8 @@ Pass `apiKey` from `getClientApiConfig()` and `sonorFetch` sets the `x-api-key`
 
 `@sonordev/site-kit/client` is stamped `'use client'`. A function imported from a stamped module into a server component becomes a client reference there and can't be called, and `getClientApiConfig` is built to run during server rendering. So `runtime` isn't stamped, imports neither React nor Next, and works the same from a server component, a route handler or a client component.
 
+Analytics identity reads share the same current consent state as the layout and analytics runtime, including when separate bundles load them. Pending preferences, withdrawal and expired configured policy block reads synchronously. Reading an identity never grants advertising permission or creates an id.
+
 ## Stability
 
 This entry is public API under semver. New exports arrive in minor releases; nothing in the list above is removed or changed in a minor or patch release.
@@ -53,3 +55,6 @@ This entry is public API under semver. New exports arrive in minor releases; not
 ## Shared website utilities (8.3)
 
 `@sonordev/site-kit/shared` provides `withSiteParam`, `withSiteBody`, `resolveSiteHost`, `readPublishedSite`, `applyTrailingSlash`, `resolveTrailingSlash` and `safeJsonLd`. These are framework-free functions for kits and sites; the entry is never marked `use client`. Press Kit uses them to keep sub-site scoping, URL shape and JSON-LD escaping consistent without reaching into private Site Kit files. `readPublishedSite()` returns the layout's explicitly published host, or undefined on the server.
+
+
+`sonorFetch` loads its shared execution path on use and keeps its existing Promise-based API. Optional dispatch checks run again after loading and before each attempt. The same token state, refresh and auth breaker serve every caller; loading failure rejects the Promise rather than using another transport. Synchronous unload telemetry doesn't wait for that execution module.

package/src/signal/README.md

@@ -113,3 +113,24 @@ interface SignalEvent {
   experiments: Array<{ id: string; variant: string }>;
 }
 ```
+
+## Measurement consent (8.9)
+
+Signal follows the shared analytics purpose policy and document reporting gate.
+It initializes tracking identity in an effect after permission, drops denied
+tracking work and closes its stream on withdrawal. Functional page content
+continues to render.
+
+Managed experiments also require the current server measurement proof and a
+scoped assignment ID, experiment revision and site. The existing component
+records the assignment actually rendered. It shows control content when the
+managed witness is unavailable and never treats a browser click as a trusted
+accepted-form conversion. Managed assignment reads revalidate with the server
+instead of reusing a legacy visitor cache. See the [consent adapter](../resonance/README.md).
+
+The deferred Signal runtime reads its measurement header from the shared wire
+constants, so that import doesn't pull in campaign validation schemas. Consent
+checks, assignment witnesses and the public Signal API stay the same.
+
+
+One bounded pre-core queue holds events and outcomes before the bridge and its existing core register. Each kind keeps at most 100 pending items. Registration drains current permitted work once; state updates don't replay it. Withdrawal, pending preferences and scope changes drop old queued work. Children and control content stay readable while the childless core loads.

package/src/website/README.md

@@ -104,8 +104,17 @@ them and their controls by name:
 
 ## Tracking
 
-Each popup's impression (once half of it is on screen) and button presses are
-counted in Sonor, against the same visitor ID (`_sk_vid`) analytics uses.
+Popup impressions (once half is on screen) and button presses use the same
+analytics-purpose gate as first-party tracking. Explicit denial or withdrawal,
+required but unknown consent, and unavailable configured policy stop optional
+collection. Current permission enables it without a reload. A genuinely
+unconfigured site keeps its legacy first-party behavior as unknown policy;
+that doesn't grant advertising consent.
+
+Current scoped receipts accompany configured telemetry. Withdrawal fences
+pending callbacks and retries, so a later grant doesn't replay denied events.
+Popup rendering, dismissal, navigation and frequency preferences still work
+when optional measurement is unavailable.
 
 ## Drawing one popup yourself
 
@@ -132,3 +141,6 @@ make them again in Website → Popups & Banners. `@sonordev/site-kit/engage`
 was removed in site-kit 8: `SiteKitLayout` mounts `SitePopups` and the website
 chat for you, and `npx sonor-setup codemod --write` moves the names that have
 a home.
+
+
+Popup rendering, dismissal and navigation remain functional while optional tracking waits for transport execution. Pending tracking callbacks still need current purpose permission and scope at dispatch; a later grant doesn't replay withdrawn work.

package/dist/AnalyticsProvider-7SBJ27SI.js

@@ -1,13 +0,0 @@
-export { AnalyticsProvider, useAnalytics, useAnalyticsOptional, useTrackEvent } from './chunk-GXWM5KNS.js';
-import './chunk-LCDVPAMR.js';
-import './chunk-IPQKQEWI.js';
-import './chunk-L2V5PUFN.js';
-import './chunk-GJWI74ZZ.js';
-import './chunk-5TM3WPCI.js';
-import './chunk-ZQSCMYZO.js';
-import './chunk-64XODP7M.js';
-import './chunk-FLOJUMFR.js';
-import './chunk-7HW4TZB5.js';
-import './chunk-W7OPEMGJ.js';
-import './chunk-F6WLHVMQ.js';
-import './chunk-PKBMQBKP.js';

package/dist/ChatWidget-V46UBDOM.js

@@ -1,20 +0,0 @@
-export { ChatWidget, EchoChat, isChatEnabled } from './chunk-TP32MRXV.js';
-import './chunk-6T6CQVNL.js';
-import './chunk-JE4A5S4F.js';
-import './chunk-27FISYK4.js';
-import './chunk-IWNJCRXW.js';
-import './chunk-Q6E4OPGG.js';
-import './chunk-5ROTTMBL.js';
-import './chunk-C2FZBUSS.js';
-import './chunk-TYSIAWC3.js';
-import './chunk-HW7B43E5.js';
-import './chunk-NJCTQH2P.js';
-import './chunk-S22FSH7C.js';
-import './chunk-L2V5PUFN.js';
-import './chunk-GJWI74ZZ.js';
-import './chunk-5TM3WPCI.js';
-import './chunk-FLOJUMFR.js';
-import './chunk-7HW4TZB5.js';
-import './chunk-W7OPEMGJ.js';
-import './chunk-F6WLHVMQ.js';
-import './chunk-PKBMQBKP.js';

package/dist/ManagedForm-DDDVMKLJ.js

@@ -1,19 +0,0 @@
-export { ManagedForm } from './chunk-G7BRCSV6.js';
-import './chunk-GQN4BGK6.js';
-import './chunk-IWNJCRXW.js';
-import './chunk-Q6E4OPGG.js';
-import './chunk-5ROTTMBL.js';
-import './chunk-C2FZBUSS.js';
-import './chunk-DXO6SBMD.js';
-import './chunk-CVADNHJ4.js';
-import './chunk-TYSIAWC3.js';
-import './chunk-HW7B43E5.js';
-import './chunk-NJCTQH2P.js';
-import './chunk-L2V5PUFN.js';
-import './chunk-GJWI74ZZ.js';
-import './chunk-5TM3WPCI.js';
-import './chunk-FLOJUMFR.js';
-import './chunk-7HW4TZB5.js';
-import './chunk-W7OPEMGJ.js';
-import './chunk-F6WLHVMQ.js';
-import './chunk-PKBMQBKP.js';

package/dist/SitePopups-VU2C3Z6B.js

@@ -1,13 +0,0 @@
-export { SitePopups } from './chunk-YEX5RAEU.js';
-import './chunk-27FISYK4.js';
-import './chunk-5ROTTMBL.js';
-import './chunk-IPQKQEWI.js';
-import './chunk-GJWI74ZZ.js';
-import './chunk-5TM3WPCI.js';
-import './chunk-ZQSCMYZO.js';
-import './chunk-64XODP7M.js';
-import './chunk-FLOJUMFR.js';
-import './chunk-7HW4TZB5.js';
-import './chunk-W7OPEMGJ.js';
-import './chunk-F6WLHVMQ.js';
-import './chunk-PKBMQBKP.js';

package/dist/SitemapSync-C4H3HF3L.js

@@ -1,9 +0,0 @@
-export { SitemapSync } from './chunk-OWZWRP7Y.js';
-import './chunk-YVKRYQRG.js';
-import './chunk-ZQSCMYZO.js';
-import './chunk-64XODP7M.js';
-import './chunk-FLOJUMFR.js';
-import './chunk-7HW4TZB5.js';
-import './chunk-W7OPEMGJ.js';
-import './chunk-F6WLHVMQ.js';
-import './chunk-PKBMQBKP.js';

package/dist/chunk-5ROTTMBL.js

@@ -1,19 +0,0 @@
-import { memoryIdentity, VISITOR_ID_KEY, SESSION_ID_KEY } from './chunk-5TM3WPCI.js';
-
-// src/shared/identity-reader.ts
-function readKey(kind, key) {
-  try {
-    return window[kind].getItem(key) || null;
-  } catch {
-    return null;
-  }
-}
-function readAnalyticsIdentity() {
-  if (typeof window === "undefined") return { sessionId: null, visitorId: null };
-  return {
-    sessionId: readKey("sessionStorage", SESSION_ID_KEY) || memoryIdentity.sessionId || null,
-    visitorId: readKey("localStorage", VISITOR_ID_KEY) || memoryIdentity.visitorId || null
-  };
-}
-
-export { readAnalyticsIdentity };

package/dist/chunk-5TM3WPCI.js

@@ -1,7 +0,0 @@
-// src/shared/identity-storage.ts
-var VISITOR_ID_KEY = "_sk_vid";
-var SESSION_ID_KEY = "_sk_sid";
-var SESSION_TIME_KEY = "_sk_stime";
-var memoryIdentity = { visitorId: "", sessionId: "" };
-
-export { SESSION_ID_KEY, SESSION_TIME_KEY, VISITOR_ID_KEY, memoryIdentity };