@sonordev/site-kit 8.8.0 → 8.9.0

package/dist/{chunk-GXWM5KNS.js → chunk-SO6RSRUP.js}

@@ -1,10 +1,10 @@
 'use client';
-import { registerAnalyticsDispatcher } from './chunk-LCDVPAMR.js';
-import { getOrCreateVisitorId, getOrCreateSessionId } from './chunk-IPQKQEWI.js';
+import { registerAnalyticsDispatcher } from './chunk-AG2RDHYZ.js';
+import { getOrCreateVisitorId, getOrCreateSessionId } from './chunk-JT7GHHMV.js';
 import { onPageLeave } from './chunk-L2V5PUFN.js';
-import { resolveAnalyticsTarget } from './chunk-ZQSCMYZO.js';
-import { sonorFetch, sonorBeacon } from './chunk-FLOJUMFR.js';
-import { createContext, useRef, useEffect, useState, useMemo, useCallback, useContext } from 'react';
+import { resolveAnalyticsTarget, analyticsSend, analyticsBeacon } from './chunk-PMXQPO5Q.js';
+import { subscribeMeasurementPolicy, measurementPolicySnapshot, serverMeasurementPolicySnapshot } from './chunk-FRY6PBT6.js';
+import { createContext, useRef, useSyncExternalStore, useEffect, useState, useMemo, useCallback, useContext } from 'react';
 import { usePathname } from 'next/navigation';
 import { jsxs, jsx } from 'react/jsx-runtime';
 
@@ -73,33 +73,6 @@ function getMeasurementContext(options = {}) {
     connectionType: connection?.effectiveType || connection?.type || void 0
   };
 }
-
-// src/analytics/send-gate.ts
-async function analyticsSend(path, body, options = {}) {
-  const target = resolveAnalyticsTarget(options);
-  if (!target) return null;
-  try {
-    return await sonorFetch(
-      `${target.apiUrl}${path}`,
-      {
-        method: options.method || "POST",
-        headers: { "Content-Type": "application/json" },
-        ...options.keepalive ? { keepalive: true } : {},
-        ...body === void 0 ? {} : { body: JSON.stringify(body) }
-      },
-      { apiKey: target.apiKey, retries: options.retries ?? 0 }
-    );
-  } catch {
-    return null;
-  }
-}
-function analyticsBeacon(path, body, options = {}) {
-  const target = resolveAnalyticsTarget(options);
-  if (!target) return;
-  sonorBeacon(`${target.apiUrl}${path}`, body, target.apiKey);
-}
-
-// src/analytics/WebVitals.tsx
 function pathForMetric(metric, fallback) {
   const url = metric.navigationURL;
   if (url) {
@@ -165,15 +138,19 @@ function WebVitals({
   const landingPathRef = useRef(pathname || "/");
   const propsRef = useRef({ propApiUrl, propApiKey, propSite, allowInFrame, allowLocalhost, debug, visitorId, sessionId, sessionTimeout });
   propsRef.current = { propApiUrl, propApiKey, propSite, allowInFrame, allowLocalhost, debug, visitorId, sessionId, sessionTimeout };
+  const policy = useSyncExternalStore(subscribeMeasurementPolicy, measurementPolicySnapshot, serverMeasurementPolicySnapshot);
   useEffect(() => {
+    const epoch = policy.collectionEpoch;
+    const permitted = () => epoch === measurementPolicySnapshot().collectionEpoch && !!resolveAnalyticsTarget({ apiUrl: propApiUrl, apiKey: propApiKey, allowInFrame, allowLocalhost, debug });
+    if (!permitted()) return;
     let cancelled = false;
     let teardown;
     import('./web-vitals.attribution-N2PCCF4Q.js').then(({ onCLS, onLCP, onTTFB, onINP, onFCP }) => {
-      if (cancelled) return;
+      if (cancelled || !permitted()) return;
       const { propApiUrl: propApiUrl2, propApiKey: propApiKey2, propSite: propSite2, allowInFrame: allowInFrame2, allowLocalhost: allowLocalhost2, debug: debug2, visitorId: visitorId2, sessionId: sessionId2, sessionTimeout: sessionTimeout2 } = propsRef.current;
       const sent = /* @__PURE__ */ new Map();
       const report = (metric, viaBeacon = false) => {
-        if (!resolveAnalyticsTarget({ apiUrl: propApiUrl2, apiKey: propApiKey2, allowInFrame: allowInFrame2, allowLocalhost: allowLocalhost2, debug: debug2 })) return;
+        if (cancelled || !permitted()) return;
         if (sent.get(metric.id) === metric.value) return;
         sent.set(metric.id, metric.value);
         const site = propSite2 || (typeof window !== "undefined" ? window.__SITE_KIT_SITE__ || window.location.host : "");
@@ -202,6 +179,7 @@ function WebVitals({
       const opts = { reportSoftNavs: true };
       const pending = [];
       const collect = (metric) => {
+        if (cancelled || !permitted()) return;
         pending.push(metric);
         report(metric);
       };
@@ -225,7 +203,7 @@ function WebVitals({
       cancelled = true;
       teardown?.();
     };
-  }, []);
+  }, [policy.collectionEpoch]);
   return null;
 }
 
@@ -656,21 +634,26 @@ function AnalyticsProvider({
   allowLocalhost = false
 }) {
   const pathname = usePathname();
+  const policy = useSyncExternalStore(subscribeMeasurementPolicy, measurementPolicySnapshot, serverMeasurementPolicySnapshot);
   const [queryString, setQueryString] = useState("");
+  const navigationRef = useRef({ path: pathname, serial: 0 });
+  if (navigationRef.current.path !== pathname) navigationRef.current = { path: pathname, serial: navigationRef.current.serial + 1 };
+  const currentNavigationKey = `${propSite ?? ""}:${policy.identityScope ?? "legacy"}:${navigationRef.current.serial}`;
+  const lastReportedNavigationRef = useRef("");
   const site = propSite || (typeof window !== "undefined" ? window.__SITE_KIT_SITE__ || window.location.host : "");
   const gate = useMemo(
-    () => ({ apiUrl: propApiUrl, apiKey: propApiKey, allowInFrame, allowLocalhost, debug }),
-    [propApiUrl, propApiKey, allowInFrame, allowLocalhost, debug]
+    () => ({ apiUrl: propApiUrl, apiKey: propApiKey, allowInFrame, allowLocalhost, debug, measurementEpoch: policy.collectionEpoch }),
+    [propApiUrl, propApiKey, allowInFrame, allowLocalhost, debug, policy.collectionEpoch]
   );
   useEffect(() => {
-    if (typeof window === "undefined") return;
+    if (typeof window === "undefined" || !resolveAnalyticsTarget(gate)) return;
     setQueryString(window.location.search);
     const handlePopState = () => {
       setQueryString(window.location.search);
     };
     window.addEventListener("popstate", handlePopState);
     return () => window.removeEventListener("popstate", handlePopState);
-  }, [pathname]);
+  }, [pathname, gate]);
   const visitorIdRef = useRef("");
   const sessionIdRef = useRef("");
   const lastPathRef = useRef("");
@@ -680,9 +663,15 @@ function AnalyticsProvider({
   const pageEnterTimeRef = useRef(0);
   const currentScrollDepthRef = useRef(0);
   useEffect(() => {
+    if (!resolveAnalyticsTarget(gate)) {
+      visitorIdRef.current = "";
+      sessionIdRef.current = "";
+      lastPathRef.current = "";
+      return;
+    }
     visitorIdRef.current = externalVisitorId || getOrCreateVisitorId();
     sessionIdRef.current = externalSessionId || getOrCreateSessionId(sessionTimeout);
-  }, [sessionTimeout, externalVisitorId, externalSessionId]);
+  }, [sessionTimeout, externalVisitorId, externalSessionId, gate]);
   useEffect(() => {
     if (!validateAgainstSitemap) {
       if (debug) console.log("[Analytics] Page validation disabled");
@@ -724,11 +713,12 @@ function AnalyticsProvider({
     fetchValidPages();
   }, [gate, validateAgainstSitemap, debug]);
   useEffect(() => {
-    if (!trackPageViews) return;
+    if (!trackPageViews || !resolveAnalyticsTarget(gate)) return;
     if (!pathname) return;
     const normalizedPath = pathname === "/" ? "/" : pathname.replace(/\/+$/, "");
     if (excludePaths.some((p) => normalizedPath.startsWith(p))) return;
-    if (normalizedPath === lastPathRef.current) return;
+    if (currentNavigationKey === lastReportedNavigationRef.current) return;
+    lastReportedNavigationRef.current = currentNavigationKey;
     lastPathRef.current = normalizedPath;
     const trackPageView = async () => {
       if (!resolveAnalyticsTarget(gate)) {
@@ -738,8 +728,9 @@ function AnalyticsProvider({
       const utmParams = getUTMParams();
       const pageTitle = document.title;
       const pageMetadata = await collectPageMetadata(
-        () => lastPathRef.current !== normalizedPath
+        () => lastPathRef.current !== normalizedPath || !resolveAnalyticsTarget(gate)
       );
+      if (!resolveAnalyticsTarget(gate)) return;
       if (onPageMetadata) {
         onPageMetadata(pageMetadata);
       }
@@ -794,7 +785,7 @@ function AnalyticsProvider({
       }
     };
     scheduleIdleTask(() => trackPageView());
-  }, [pathname, queryString, gate, trackPageViews, excludePaths, debug, validateAgainstSitemap]);
+  }, [pathname, queryString, gate, trackPageViews, excludePaths, debug, validateAgainstSitemap, currentNavigationKey]);
   useEffect(() => {
     if (!trackJourneys) return;
     if (!pathname) return;
@@ -959,6 +950,7 @@ function AnalyticsProvider({
     if (typeof window === "undefined") return;
     if (!resolveAnalyticsTarget(gate)) return;
     const handleClick = async (e) => {
+      if (!resolveAnalyticsTarget(gate)) return;
       const target = e.target;
       if (!target) return;
       const docHeight = document.documentElement.scrollHeight;
@@ -1016,7 +1008,9 @@ function AnalyticsProvider({
     return () => document.removeEventListener("click", click);
   }, [gate, site, pathname]);
   const trackEvent = useCallback((options) => {
+    if (!resolveAnalyticsTarget(gate)) return;
     const doTrack = async () => {
+      if (!resolveAnalyticsTarget(gate)) return;
       const event = {
         sessionId: sessionIdRef.current,
         visitorId: visitorIdRef.current,
@@ -1040,6 +1034,7 @@ function AnalyticsProvider({
   }, [gate, site, pathname, debug]);
   const trackConversion = useCallback((options) => {
     const doTrack = async () => {
+      if (!resolveAnalyticsTarget(gate)) return;
       const conversion = {
         sessionId: sessionIdRef.current,
         visitorId: visitorIdRef.current,
@@ -1073,7 +1068,7 @@ function AnalyticsProvider({
     visitorId: visitorIdRef.current
   }), [trackEvent, trackConversion]);
   return /* @__PURE__ */ jsxs(AnalyticsContext.Provider, { value: contextValue, children: [
-    trackWebVitals && /* @__PURE__ */ jsx(
+    trackWebVitals && !!resolveAnalyticsTarget(gate) && /* @__PURE__ */ jsx(
       WebVitals,
       {
         apiUrl: propApiUrl,

package/dist/{chunk-ODOV76VW.js → chunk-STIVFCWM.js}

@@ -1,6 +1,6 @@
 import { withSiteBody } from './chunk-MJP63SSS.js';
 import { SITE_CACHE_TAGS } from './chunk-HY7ZEU2C.js';
-import { serverApiFetch, requireServerApiConfig } from './chunk-C7TLGL3R.js';
+import { serverApiFetch, requireServerApiConfig } from './chunk-7VMA3KCN.js';
 import { postRegisterSitemap, resolveSyncSite } from './chunk-DIKNRN34.js';
 import { cache } from 'react';
 import 'server-only';

package/dist/{chunk-SVHPILS3.js → chunk-T4A5J6SJ.js}

@@ -1,5 +1,5 @@
 'use client';
-import { sonorFetch } from './chunk-FLOJUMFR.js';
+import { sonorFetch } from './chunk-VXCUXHZO.js';
 import { useState, useCallback, useEffect } from 'react';
 import { jsx, Fragment, jsxs } from 'react/jsx-runtime';
 

package/dist/chunk-TPHOIE4I.js

@@ -0,0 +1,73 @@
+import { siteTokenState } from './chunk-D4M5K6JN.js';
+
+// src/shared/site-token-claims.ts
+var SITE_TOKEN_PREFIX = "st1.";
+function isSiteToken(credential) {
+  return typeof credential === "string" && credential.startsWith(SITE_TOKEN_PREFIX);
+}
+function decodeSiteTokenClaims(token) {
+  if (!isSiteToken(token)) return null;
+  const seg = token.split(".")[1];
+  if (!seg) return null;
+  try {
+    const b64 = seg.replace(/-/g, "+").replace(/_/g, "/");
+    const json = typeof atob === "function" ? atob(b64) : Buffer.from(seg, "base64url").toString("utf8");
+    const claims = JSON.parse(json);
+    return typeof claims === "object" && claims ? claims : null;
+  } catch {
+    return null;
+  }
+}
+function credentialBreakerId(credential) {
+  if (!credential) return "(anonymous)";
+  const claims = decodeSiteTokenClaims(credential);
+  if (claims?.pid) return `pid:${claims.pid}`;
+  return credential.slice(0, 16);
+}
+function tokenExp(token) {
+  const claims = decodeSiteTokenClaims(token);
+  return typeof claims?.exp === "number" ? claims.exp * 1e3 : 0;
+}
+
+// src/shared/site-token-configuration.ts
+var STORAGE_KEY = "__sonor_site_token__";
+function readStoredToken() {
+  if (typeof window === "undefined") return null;
+  try {
+    const raw = window.sessionStorage.getItem(STORAGE_KEY);
+    if (!raw) return null;
+    const parsed = JSON.parse(raw);
+    return typeof parsed?.token === "string" ? parsed.token : null;
+  } catch {
+    return null;
+  }
+}
+function storeToken(token) {
+  if (typeof window === "undefined") return;
+  try {
+    window.sessionStorage.setItem(STORAGE_KEY, JSON.stringify({ token }));
+  } catch {
+  }
+  try {
+    ;
+    window.__SITE_KIT_API_KEY__ = token;
+  } catch {
+  }
+}
+function configureSiteCredential(opts) {
+  siteTokenState.seed = opts.credential;
+  siteTokenState.isToken = isSiteToken(opts.credential);
+  if (opts.apiUrl) siteTokenState.apiUrl = opts.apiUrl.replace(/\/+$/, "");
+  if (!siteTokenState.isToken) {
+    siteTokenState.token = null;
+    return;
+  }
+  const prior = siteTokenState.token;
+  let best = opts.credential ?? null;
+  const stored = readStoredToken();
+  if (stored && tokenExp(stored) > tokenExp(best)) best = stored;
+  if (prior && tokenExp(prior) > tokenExp(best)) best = prior;
+  siteTokenState.token = best;
+}
+
+export { configureSiteCredential, credentialBreakerId, isSiteToken, storeToken, tokenExp };

package/dist/{chunk-IWNJCRXW.js → chunk-UG53ZW7S.js}

@@ -1,14 +1,20 @@
 'use client';
 import { readAgentSubmit, formToolAttributes } from './chunk-Q6E4OPGG.js';
-import { readAnalyticsIdentity } from './chunk-5ROTTMBL.js';
+import { currentResonanceFormContext } from './chunk-MDBXGN6W.js';
+import { readAnalyticsIdentity } from './chunk-PVY7X5UR.js';
 import { isFieldVisible, validateField, isFieldComplete, unseenControlValues } from './chunk-C2FZBUSS.js';
 import { normalizeFormConfig, DEFAULT_FORM_SUCCESS_MESSAGE } from './chunk-TYSIAWC3.js';
 import { DEFAULT_HONEYPOT_FIELD } from './chunk-NJCTQH2P.js';
 import { onPageLeave } from './chunk-L2V5PUFN.js';
+import { resolveAnalyticsTarget, analyticsSend, analyticsBeacon } from './chunk-PMXQPO5Q.js';
+import { RESONANCE_SUBJECT_HEADER } from './chunk-NHDRA4Y5.js';
 import { uuid } from './chunk-GJWI74ZZ.js';
-import { sonorFetch, sonorBeacon } from './chunk-FLOJUMFR.js';
-import { readPublishedApiConfig, getClientApiConfig } from './chunk-W7OPEMGJ.js';
-import { useRef, useCallback, useEffect, useState, useMemo } from 'react';
+import { sameSite } from './chunk-NZOJHERI.js';
+import { sonorFetch } from './chunk-VXCUXHZO.js';
+import { readPublishedApiConfig, getClientApiConfig, readPublishedSite } from './chunk-W7OPEMGJ.js';
+import { normalizeSiteHost } from './chunk-A4CC4ZG3.js';
+import { subscribeMeasurementPolicy, measurementPolicySnapshot, serverMeasurementPolicySnapshot, analyticsPurposePermitted } from './chunk-FRY6PBT6.js';
+import { useSyncExternalStore, useCallback, useRef, useEffect, useState, useMemo } from 'react';
 
 // src/forms/field-interactions.ts
 var MAX_TRACKED_FIELDS = 100;
@@ -171,6 +177,9 @@ function useFormTracking({
   debug = false,
   isFieldComplete: isFieldComplete2
 }) {
+  const policy = useSyncExternalStore(subscribeMeasurementPolicy, measurementPolicySnapshot, serverMeasurementPolicySnapshot);
+  const epoch = policy.collectionEpoch;
+  const permitted = useCallback(() => measurementPolicySnapshot().collectionEpoch === epoch && !!resolveAnalyticsTarget(), [epoch]);
   const sessionRef = useRef(null);
   const sessionIdRef = useRef("");
   const startTimeRef = useRef(0);
@@ -186,11 +195,17 @@ function useFormTracking({
     return session.fields.snapshot((slug) => check ? check(slug) : false, now);
   }, []);
   useEffect(() => {
-    if (!enabled) return;
+    if (!enabled || !permitted()) return;
     if (!formId) {
       if (debug) console.warn("[Forms] Tracking skipped: formId is empty");
       return;
     }
+    const registryKey = `${formId}:${measurementPolicySnapshot().identityScope ?? "legacy"}:${policy.analyticsChoiceEpoch}`;
+    analyticsIdRef.current = null;
+    sessionIdRef.current = "";
+    stepTimesRef.current = {};
+    currentStepRef.current = 1;
+    maxStepRef.current = 1;
     const startTracking = async (sessionId) => {
       const { apiUrl, apiKey } = readPublishedApiConfig();
       if (!apiUrl || !apiKey) {
@@ -198,19 +213,12 @@ function useFormTracking({
         return null;
       }
       try {
-        const response = await sonorFetch(
-          `${apiUrl}/api/public/forms/analytics/start`,
-          {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({
-              formId,
-              sessionId,
-              deviceType: getDeviceType()
-            })
-          },
-          { apiKey, retries: 0 }
-        );
+        const response = await analyticsSend("/api/public/forms/analytics/start", {
+          formId,
+          sessionId,
+          deviceType: getDeviceType()
+        }, { apiUrl, apiKey, measurementEpoch: epoch });
+        if (!response || !permitted()) return null;
         if (!response.ok) {
           throw new Error(`HTTP ${response.status}: ${response.statusText}`);
         }
@@ -222,24 +230,24 @@ function useFormTracking({
         return null;
       }
     };
-    const session = acquireTrackingSession(formId, startTracking);
+    const session = acquireTrackingSession(registryKey, startTracking);
     sessionRef.current = session;
     sessionIdRef.current = session.sessionId;
     startTimeRef.current = session.startedAt;
     stepStartTimeRef.current = Date.now();
     let joined = true;
     void session.analyticsId.then((id) => {
-      if (joined) analyticsIdRef.current = id;
+      if (joined && permitted()) analyticsIdRef.current = id;
     });
     const reportAbandon = (analyticsId) => {
-      if (!analyticsId) return;
+      if (!analyticsId || !permitted()) return;
       const { apiUrl, apiKey } = readPublishedApiConfig();
       if (!apiUrl || !apiKey) return;
       if (!claimAbandon(session)) return;
       const now = Date.now();
       stepTimesRef.current[currentStepRef.current] = Math.floor((now - stepStartTimeRef.current) / 1e3);
-      sonorBeacon(
-        `${apiUrl}/api/public/forms/analytics/abandon`,
+      analyticsBeacon(
+        "/api/public/forms/analytics/abandon",
         {
           analyticsId,
           step: currentStepRef.current,
@@ -249,7 +257,7 @@ function useFormTracking({
           fieldInteractions: fieldReport(session, now),
           abandonmentField: session.fields.lastField
         },
-        apiKey
+        { apiUrl, apiKey, measurementEpoch: epoch }
       );
       if (debug) console.log("[Forms] Abandonment tracked:", session.fields.lastField);
     };
@@ -260,33 +268,37 @@ function useFormTracking({
     return () => {
       joined = false;
       stopLeaveListener();
-      releaseTrackingSession(formId, session);
+      releaseTrackingSession(registryKey, session);
+      analyticsIdRef.current = null;
+      sessionIdRef.current = "";
       sessionRef.current = null;
     };
-  }, [formId, enabled, debug, fieldReport]);
+  }, [formId, enabled, debug, fieldReport, permitted, epoch]);
   const resolveAnalyticsId = useCallback(async () => {
+    if (!permitted()) return null;
     if (analyticsIdRef.current) return analyticsIdRef.current;
     const session = sessionRef.current;
     if (!session) return null;
     const id = await session.analyticsId;
+    if (!permitted()) return null;
     if (id) analyticsIdRef.current = id;
     return id;
-  }, []);
+  }, [permitted]);
   const trackFieldFocus = useCallback((slug) => {
     const session = sessionRef.current;
-    if (!session || session.completed) return;
+    if (!permitted() || !session || session.completed) return;
     if (session.fields.focus(slug)) noteActivity(session);
-  }, []);
+  }, [permitted]);
   const trackFieldBlur = useCallback((slug) => {
-    sessionRef.current?.fields.blur(slug);
-  }, []);
+    if (permitted()) sessionRef.current?.fields.blur(slug);
+  }, [permitted]);
   const trackFieldChange = useCallback((slug) => {
     const session = sessionRef.current;
-    if (!session || session.completed) return;
+    if (!permitted() || !session || session.completed) return;
     if (session.fields.change(slug)) noteActivity(session);
-  }, []);
+  }, [permitted]);
   const trackStepChange = useCallback(async (step) => {
-    if (!enabled) return;
+    if (!enabled || !permitted()) return;
     const { apiUrl, apiKey } = readPublishedApiConfig();
     if (!apiUrl || !apiKey) {
       if (debug) console.error("[Forms] Missing API URL or API key");
@@ -301,23 +313,16 @@ function useFormTracking({
     const session = sessionRef.current;
     if (session) noteActivity(session);
     const analyticsId = await resolveAnalyticsId();
-    if (!analyticsId) return;
+    if (!analyticsId || !permitted()) return;
     try {
-      const response = await sonorFetch(
-        `${apiUrl}/api/public/forms/analytics/step`,
-        {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({
-            analyticsId,
-            step,
-            maxStep: maxStepRef.current,
-            stepTimes: stepTimesRef.current,
-            ...session ? { fieldInteractions: fieldReport(session, Date.now()) } : {}
-          })
-        },
-        { apiKey, retries: 0 }
-      );
+      const response = await analyticsSend("/api/public/forms/analytics/step", {
+        analyticsId,
+        step,
+        maxStep: maxStepRef.current,
+        stepTimes: stepTimesRef.current,
+        ...session ? { fieldInteractions: fieldReport(session, Date.now()) } : {}
+      }, { apiUrl, apiKey, measurementEpoch: epoch });
+      if (!response || !permitted()) return;
       if (!response.ok) {
         throw new Error(`HTTP ${response.status}: ${response.statusText}`);
       }
@@ -325,9 +330,9 @@ function useFormTracking({
     } catch (error) {
       if (debug) console.error("[Forms] Error updating step:", error);
     }
-  }, [enabled, debug, resolveAnalyticsId, fieldReport]);
+  }, [enabled, debug, resolveAnalyticsId, fieldReport, permitted, epoch]);
   const trackComplete = useCallback(async () => {
-    if (!enabled) return;
+    if (!enabled || !permitted()) return;
     const session = sessionRef.current;
     if (session) markCompleted(session);
     const { apiUrl, apiKey } = readPublishedApiConfig();
@@ -340,28 +345,16 @@ function useFormTracking({
     stepTimesRef.current[currentStepRef.current] = finalStepTime;
     const fieldInteractions = session ? fieldReport(session, now) : void 0;
     const analyticsId = await resolveAnalyticsId();
-    if (!analyticsId) return;
+    if (!analyticsId || !permitted()) return;
     try {
-      const response = await sonorFetch(
-        `${apiUrl}/api/public/forms/analytics/complete`,
-        {
-          method: "POST",
-          // A form with a redirect_url navigates away right after submit, which
-          // cancels an ordinary in-flight fetch. And since completion now
-          // suppresses the abandon beacon, losing this would leave the row
-          // neither completed nor abandoned.
-          keepalive: true,
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({
-            analyticsId,
-            totalSteps,
-            stepTimes: stepTimesRef.current,
-            totalTimeSeconds: Math.floor((now - startTimeRef.current) / 1e3),
-            ...fieldInteractions ? { fieldInteractions } : {}
-          })
-        },
-        { apiKey, retries: 0 }
-      );
+      const response = await analyticsSend("/api/public/forms/analytics/complete", {
+        analyticsId,
+        totalSteps,
+        stepTimes: stepTimesRef.current,
+        totalTimeSeconds: Math.floor((now - startTimeRef.current) / 1e3),
+        ...fieldInteractions ? { fieldInteractions } : {}
+      }, { apiUrl, apiKey, measurementEpoch: epoch, keepalive: true });
+      if (!response || !permitted()) return;
       if (!response.ok) {
         throw new Error(`HTTP ${response.status}: ${response.statusText}`);
       }
@@ -369,14 +362,14 @@ function useFormTracking({
     } catch (error) {
       if (debug) console.error("[Forms] Error completing tracking:", error);
     }
-  }, [enabled, totalSteps, debug, resolveAnalyticsId, fieldReport]);
+  }, [enabled, totalSteps, debug, resolveAnalyticsId, fieldReport, permitted, epoch]);
   return {
     trackStepChange,
     trackComplete,
     trackFieldFocus,
     trackFieldBlur,
     trackFieldChange,
-    sessionId: sessionIdRef.current
+    sessionId: permitted() ? sessionIdRef.current : ""
   };
 }
 function getDeviceType() {
@@ -576,51 +569,65 @@ async function submitForm({
     throw new Error("Verification could not be completed. Please try again.");
   }
   const honeypotFieldName = config.honeypot_field || DEFAULT_HONEYPOT_FIELD;
-  const utm = getUTMParams();
-  const ga4 = readGa4Identity();
-  const identity = readAnalyticsIdentity();
-  const payload = {
-    formId: config.id,
-    form_id: config.id,
-    data: {
-      ...values,
-      ...config.honeypot_enabled ? { [honeypotFieldName]: honeypotValue } : {}
-    },
-    metadata: {
-      pageUrl: typeof window !== "undefined" ? window.location.href : null,
-      referrer: typeof document !== "undefined" ? document.referrer || null : null,
-      userAgent: typeof navigator !== "undefined" ? navigator.userAgent : null,
-      sessionId: identity.sessionId,
-      // Anonymous visitor id (_sk_vid) — the same id Analytics/Signal stamp on
-      // page views, so the Sonor side can bind this lead to its browsing session
-      // (page -> lead attribution). Sent on every submission; null pre-hydration.
-      visitorId: identity.visitorId,
-      recaptchaToken: recaptchaToken || void 0,
-      utmSource: utm.utm_source,
-      utmMedium: utm.utm_medium,
-      utmCampaign: utm.utm_campaign,
-      utmTerm: utm.utm_term,
-      utmContent: utm.utm_content,
-      ...ga4,
-      // Sub-site host — preserved on form_submissions for lead attribution
-      // across multi-site projects. Resolved by SiteKitClientProviders.
-      site: typeof window !== "undefined" ? window.__SITE_KIT_SITE__ || window.location.host : void 0,
-      _formLoadedAt: formLoadedAt,
-      ...agentInvoked ? { agentInvoked: true } : {}
+  const formData = {
+    ...values,
+    ...config.honeypot_enabled ? { [honeypotFieldName]: honeypotValue } : {}
+  };
+  const prepareAttempt = (attempt) => {
+    const policy = measurementPolicySnapshot();
+    const site = readPublishedSite() || (typeof window !== "undefined" ? window.location.hostname : "");
+    const matchingScope = !policy.config || policy.config.projectId === config.project_id && policy.config.site === site;
+    const analytics = analyticsPurposePermitted() && matchingScope;
+    const utm = analytics ? getUTMParams() : {};
+    let ga4 = {};
+    if (analytics) {
+      try {
+        ga4 = readGa4Identity();
+      } catch {
+      }
     }
+    const identity = analytics ? readAnalyticsIdentity() : { visitorId: null, sessionId: null };
+    const sameOrigin = getClientApiConfig().apiUrl === apiUrl;
+    const actualSite = typeof window !== "undefined" && sameSite(normalizeSiteHost(window.location.host), site);
+    const context = sameOrigin && actualSite ? currentResonanceFormContext(config.project_id, site) : null;
+    const headers = new Headers(attempt.headers);
+    headers.delete(RESONANCE_SUBJECT_HEADER);
+    if (context) headers.set(RESONANCE_SUBJECT_HEADER, context.subjectProof);
+    const payload = {
+      formId: config.id,
+      form_id: config.id,
+      data: formData,
+      metadata: {
+        pageUrl: typeof window !== "undefined" ? analytics ? window.location.href : window.location.origin + window.location.pathname : null,
+        referrer: analytics && typeof document !== "undefined" ? document.referrer || null : null,
+        userAgent: typeof navigator !== "undefined" ? navigator.userAgent : null,
+        sessionId: identity.sessionId,
+        visitorId: identity.visitorId,
+        recaptchaToken: recaptchaToken || void 0,
+        utmSource: utm.utm_source ?? null,
+        utmMedium: utm.utm_medium ?? null,
+        utmCampaign: utm.utm_campaign ?? null,
+        utmTerm: utm.utm_term ?? null,
+        utmContent: utm.utm_content ?? null,
+        ...ga4,
+        site: site || void 0,
+        _formLoadedAt: formLoadedAt,
+        ...agentInvoked ? { agentInvoked: true } : {},
+        ...context?.exposureId ? { resonanceExposureId: context.exposureId } : {}
+      }
+    };
+    return { ...attempt, headers, body: JSON.stringify(payload) };
   };
-  const response = await sonorFetch(
-    `${apiUrl}/api/public/forms/submit`,
-    {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${apiKey}`
-      },
-      body: JSON.stringify(payload)
-    },
-    { retries: 2, timeoutMs: 2e4 }
-  );
+  const initialRequest = prepareAttempt({
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` }
+  });
+  const response = await sonorFetch(`${apiUrl}/api/public/forms/submit`, initialRequest, {
+    apiKey,
+    retries: 2,
+    timeoutMs: 2e4,
+    prepareAttempt
+  });
   const data = await response.json().catch(() => null);
   if (!response.ok) {
     const msg = (data?.message ?? data?.error ?? (response.statusText || `HTTP ${response.status}`)).toString().trim();