@sonordev/site-kit 8.8.1 → 8.10.0

package/dist/resonance/bridge.d.ts

@@ -0,0 +1,16 @@
+import type { ResonanceExperimentExposure } from "../contracts/resonance.js";
+import type { ResonanceController } from "./controller.js";
+export { currentResonanceFormContext } from "./form-context.js";
+/** Capability observation only; never returns the subject proof or grants authority. */
+export declare function getResonanceMeasurementStatus(): {
+    state: "blocked" | "legacy_unconfigured" | "pending" | "ready" | "unknown" | "waiting_for_consent";
+    reason: string | null;
+    policy: "configured" | "legacy_unconfigured" | "resolving";
+    analyticsPermitted: boolean;
+    advertisingPermitted: boolean;
+    providerBlockers: string[];
+};
+export declare function setProviderBlockers(next: readonly string[]): void;
+export declare function registerResonanceController(next: ResonanceController): (() => void) | null;
+/** Actual rendered assignment only. Accepted forms are recorded by the server. */
+export declare function recordResonanceExposure(exposure: ResonanceExperimentExposure): void;

package/dist/resonance/consent-adapter.d.ts

@@ -0,0 +1,26 @@
+import { type MeasurementPurpose, type PurposeChoices } from "../shared/measurement-store.js";
+/** The site's maintained CMP remains the owner. Resonance never creates a competing banner/state. */
+export interface ConsentObservation {
+    valid: boolean;
+    choices: PurposeChoices;
+    observedAt: string;
+    /** Actual current CMP evidence, not an inference from a visit or newsletter opt-in. */
+    source: 'cmp' | 'user_preference';
+}
+export interface ConsentReadContext {
+    projectId: string | null;
+    site: string;
+    configRevision: string | null;
+    policyRevision: string | null;
+    requiredPurposes: readonly MeasurementPurpose[];
+}
+export interface ResonanceConsentAdapter {
+    requiredPurposes: readonly MeasurementPurpose[];
+    /** Return valid:false if existing CMP evidence is invalid for this policy. */
+    read(context?: ConsentReadContext): ConsentObservation | Promise<ConsentObservation>;
+    subscribe(onChange: () => void): () => void;
+}
+export declare const getConsentAdapter: () => ResonanceConsentAdapter | null;
+export declare const subscribeConsentAdapter: (listener: () => void) => (() => void);
+export declare function registerResonanceConsentAdapter(next: ResonanceConsentAdapter): () => void;
+export declare const unknownConsentObservation: () => ConsentObservation;

package/dist/resonance/controller-registry.d.ts

@@ -0,0 +1,14 @@
+/** One existing page-wide Resonance controller registry; no permission or proof owner here. */
+import type { ResonanceExperimentExposure } from "../contracts/resonance.js";
+import type { ResonanceController, RenderedResonanceContext } from "./controller.js";
+interface BridgeStore {
+    controller: ResonanceController | null;
+    blockers: readonly string[];
+    registrationConflict: boolean;
+}
+export declare const resonanceControllerState: BridgeStore;
+/** Internal rendered seam: mint the exposure ID in the actual registered controller, once. */
+export declare function recordRenderedResonanceExposure(exposure: Omit<ResonanceExperimentExposure, 'exposureId'>, context?: RenderedResonanceContext): boolean;
+/** Release only this actual effect's registration; a newer render is untouched. */
+export declare function releaseRenderedResonanceExposure(exposure: Omit<ResonanceExperimentExposure, 'exposureId'>): void;
+export {};

package/dist/resonance/controller.d.ts

@@ -0,0 +1,103 @@
+import { type ResonanceMeasurementOccurrence, type ResonanceExperimentExposure } from "../contracts/resonance.js";
+import type { ConsentObservation, ResonanceConsentAdapter } from "./consent-adapter.js";
+export interface ResonanceTransport {
+    /** Existing sonorFetch adapter; the controller never logs proof or input. */
+    request(path: string, init: RequestInit, stillAllowed?: () => boolean): Promise<{
+        status: number;
+        body: unknown;
+    }>;
+}
+export interface ResonanceControllerOptions {
+    site: string;
+    transport: ResonanceTransport;
+    now?: () => number;
+    /** Lazy current-location read, called only for a new consented page view. No query history. */
+    readClickIdentifiers?: (pathname: string) => unknown;
+    /** Actual current first-party cookies only; called after proof and an owned page mapping. */
+    readMetaCookieObservation?: (pathname: string) => unknown;
+    /** Test seam and lifecycle notification; no provider dispatch happens inside consent capture. */
+    onState?: () => void;
+    onOccurrence?: (event: ResonanceMeasurementOccurrence) => void;
+}
+/** Existing native page-version identity is a local render fence, never a wire token. */
+export interface RenderedResonanceContext {
+    pagePath: string;
+    pageVersionId: string;
+}
+/** One scope's consent/occurrence state machine. No storage, no pre-choice event backlog. */
+export declare class ResonanceController {
+    private readonly options;
+    private config;
+    private proof;
+    private adapter;
+    private unsubscribe;
+    private configEpoch;
+    private readEpoch;
+    private deliveryEpoch;
+    private stopped;
+    private busy;
+    private latest;
+    private latestEpoch;
+    private completedEpoch;
+    private path;
+    private sourceMarker;
+    private navigationSequence;
+    private recordedNavigationKey;
+    private navigation;
+    private renderedFrame;
+    private acceptedExposure;
+    private retry;
+    private expiryTimer;
+    private configExpiryTimer;
+    private refreshTimer;
+    private refreshing;
+    private renewing;
+    private renewalTimer;
+    readonly status: {
+        state: 'unknown' | 'legacy_unconfigured' | 'waiting_for_consent' | 'pending' | 'ready' | 'blocked';
+        reason: string | null;
+    };
+    constructor(options: ResonanceControllerOptions);
+    private now;
+    private changed;
+    /** One current-navigation slot, not a history cache. A true identity change
+     * retires its receipt and retry work; late deliveries cannot rejoin it. */
+    private discardRenderedFrame;
+    private invalidate;
+    private timerDelay;
+    private timers;
+    private scheduleConfigRefresh;
+    /** A safe public read refreshes policy freshness without re-prompting or changing consent. */
+    refreshConfig(): Promise<void>;
+    start(): Promise<void>;
+    setAdapter(adapter: ResonanceConsentAdapter | null): void;
+    private consentContext;
+    private configPolicy;
+    private readConsent;
+    /** Maintained CMP observations may resume valid consent; this never prompts or infers a grant. */
+    observe(observation: ConsentObservation): void;
+    private captureLatest;
+    private verifyProofScope;
+    renew(): Promise<void>;
+    /** Connectivity recovery renews existing proof; it never replays a failed grant. */
+    recover(): Promise<void>;
+    navigate(path: string, sourceMarker?: string | null): void;
+    private recordCurrentNavigation;
+    exposure(experiment: ResonanceExperimentExposure): Promise<void>;
+    /** Internal rendered occurrence seam; retry queues retain the resulting immutable event and ID. */
+    renderedExposure(experiment: Omit<ResonanceExperimentExposure, 'exposureId'>, context?: RenderedResonanceContext): Promise<void> | null;
+    /** Close form attachment immediately, but retain this single bounded frame
+     * while the current assignment is revalidated. An exact native-identity rejoin
+     * keeps its original occurrence/receipt even after an asynchronous fallback.
+     * Navigation, replacement, consent/scope invalidation and stop retire it. */
+    releaseRenderedExposure(experiment: Omit<ResonanceExperimentExposure, 'exposureId'>): void;
+    private exposurePermitted;
+    private submitExposure;
+    private emit;
+    private deliver;
+    /** Explicit network recovery only; identical occurrence ID, never old preference/scope epochs. */
+    retryPending(): void;
+    /** Optional server receipt reference, never a claim that a form converted. */
+    formExposureId(): string | null;
+    stop(): void;
+}

package/dist/resonance/form-context.d.ts

@@ -0,0 +1,5 @@
+/** Actual form-submit seam only. Call per attempt; never attach this to unrelated requests. */
+export declare function currentResonanceFormContext(projectId: string, site: string): {
+    subjectProof: string;
+    exposureId: string | null;
+} | null;

package/dist/resonance/index.d.ts

@@ -0,0 +1,4 @@
+export { ResonanceRuntime, type ResonanceRuntimeProps } from "./ResonanceRuntime.js";
+export { registerResonanceConsentAdapter, type ResonanceConsentAdapter, type ConsentObservation, type ConsentReadContext } from "./consent-adapter.js";
+export { recordResonanceExposure, getResonanceMeasurementStatus } from "./bridge.js";
+export type { MeasurementPurpose, PurposeChoice, PurposeChoices } from "../shared/measurement-policy.js";

package/dist/resonance/index.js

@@ -0,0 +1,9 @@
+'use client';
+export { getResonanceMeasurementStatus, recordResonanceExposure, registerResonanceConsentAdapter } from '../chunk-WYNDBJG7.js';
+export { ResonanceRuntime } from '../chunk-3RBOES2C.js';
+import '../chunk-MDBXGN6W.js';
+import '../chunk-YC7ELZS3.js';
+import '../chunk-KMNHNCVG.js';
+import '../chunk-MOACHHOJ.js';
+import '../chunk-FRY6PBT6.js';
+import '../chunk-PKBMQBKP.js';

package/dist/resonance/meta-pixel.d.ts

@@ -0,0 +1,67 @@
+import type { ResonanceMeasurementConfig } from "../contracts/resonance.js";
+/**
+ * Meta browser pixel loader, controls C1 to C21 of the Resonance Meta pixel standard.
+ *
+ * Option A: the pixel is loaded only so Meta's own first-party cookies exist. This module sends NO browser
+ * event (it has no `track` capability), passes no user data to `init`, reads nothing from the page beyond the
+ * URL hygiene checks, attaches no DOM listener and never writes `_fbp` or `_fbc`. The Conversions API
+ * `PageView` the server builds stays the only event.
+ *
+ * The loader ships dark: a server witness for a controls revision listed in META_BROWSER_CONTROLS_IMPLEMENTED
+ * is the only thing that lets it start, and that list stays empty until Security accepts the evidence bundle.
+ */
+export declare const META_BROWSER_CONTROLS_V1 = "META_BROWSER_CONTROLS_V1";
+/** Controls revisions this build may start. Empty on purpose: add a revision only with Security's acceptance. */
+export declare const META_BROWSER_CONTROLS_IMPLEMENTED: readonly string[];
+/** One fixed URL. Locale is constant (no navigator.language); never a mirror, never a tag manager. */
+export declare const META_SDK_URL = "https://connect.facebook.net/en_US/fbevents.js";
+export type MetaBlocker = 'meta_duplicate_installation' | 'meta_scope_change_requires_reload' | 'meta_load_failed' | 'meta_multiple_destinations' | 'meta_page_not_eligible' | 'meta_url_not_clean';
+export interface MetaPixelHooks {
+    /** The provider runtime's own fence: the same function the Google loader uses. Never a copy. */
+    allowed(): boolean;
+    setBlocker(code: MetaBlocker, present: boolean): void;
+    /** Test seam; production reads META_BROWSER_CONTROLS_IMPLEMENTED. */
+    implementedRevisions?: readonly string[];
+}
+export type MetaPageDecision = {
+    ok: true;
+} | {
+    ok: false;
+    blocker: MetaBlocker;
+};
+/** Whether Meta may initialize on THIS page right now. Pure reads; no side effects. */
+export declare function decideMetaPage(config: ResonanceMeasurementConfig): MetaPageDecision;
+export declare class MetaPixelLoader {
+    private readonly config;
+    private readonly hooks;
+    private generation;
+    private owned;
+    private granted;
+    private cookiesExpired;
+    constructor(config: ResonanceMeasurementConfig, hooks: MetaPixelHooks);
+    private destinations;
+    /** Configuration-level facts, independent of consent and of the page. */
+    inspect(): {
+        destinations: number;
+        multiple: boolean;
+        witnessed: boolean;
+    };
+    /** Every SDK command re-checks the fence; a withdrawn runtime pushes nothing. */
+    private command;
+    private blockers;
+    private foreign;
+    update(): void;
+    /** Single-page navigation: re-evaluate; never re-initialize. */
+    navigate(): void;
+    private resume;
+    private install;
+    /** The grant is issued live, after the SDK has executed: a grant queued ahead of the script never releases its lock. */
+    private afterLoad;
+    private grant;
+    /** The page stopped being eligible or clean: pause the SDK without forgetting the installation. */
+    private pause;
+    /** Before the SDK has executed nothing needs retracting: remove everything so a late script finds no queue and does nothing. */
+    private discard;
+    withdraw(): void;
+    stop(): void;
+}

package/dist/resonance/providers.d.ts

@@ -0,0 +1,32 @@
+import type { ResonanceMeasurementConfig, ResonanceMeasurementOccurrence } from "../contracts/resonance.js";
+import { type MetaBlocker } from "./meta-pixel.js";
+export type ProviderBlocker = 'google_duplicate_installation' | 'google_scope_change_requires_reload' | 'google_load_failed' | 'meta_browser_collection_unverified' | MetaBlocker;
+/** Allowlisted, basic-mode delivery. No browser conversion action exists here. */
+export declare class ResonanceProviderRuntime {
+    private readonly config;
+    private readonly onBlockers?;
+    private google;
+    private script;
+    private configured;
+    private pending;
+    private generation;
+    private active;
+    private loaded;
+    private finishLoad;
+    readonly blockers: Set<ProviderBlocker>;
+    private readonly meta;
+    constructor(config: ResonanceMeasurementConfig, onBlockers?: ((blockers: ProviderBlocker[]) => void) | undefined, options?: {
+        metaControlsRevisions?: readonly string[];
+    });
+    private block;
+    private setBlocker;
+    private allowed;
+    update(): void;
+    private applyConsent;
+    private loadGoogle;
+    occurrence(event: ResonanceMeasurementOccurrence): Promise<void>;
+    /** Single-page navigation: Meta re-evaluates the new page's eligibility and URL hygiene. */
+    navigate(): void;
+    withdraw(): void;
+    stop(): void;
+}

package/dist/resonance/runtime-core.d.ts

@@ -0,0 +1,5 @@
+import type { ResonanceRuntimeProps } from "./ResonanceRuntime.js";
+export declare function mountResonanceRuntime({ site, apiUrl, apiKey }: ResonanceRuntimeProps): {
+    navigate(pathname: string): void;
+    stop(): void;
+} | undefined;

package/dist/revalidate/index.d.ts

@@ -25,9 +25,9 @@
  * single implementation of the webhook; this only supplies the key and
  * Next's cache functions.
  */
-import { type SeoRevalidationHandlerOptions } from '../llms/seo-revalidate';
-export { SITE_CACHE_TAGS, SITE_REVALIDATE_PATH, isSiteRevalidatePong } from '../contracts/site-cache';
-export type { SiteCacheTag, SiteRevalidatePayload, SiteRevalidatePong } from '../contracts/site-cache';
+import { type SeoRevalidationHandlerOptions } from "../llms/seo-revalidate.js";
+export { SITE_CACHE_TAGS, SITE_REVALIDATE_PATH, isSiteRevalidatePong } from "../contracts/site-cache.js";
+export type { SiteCacheTag, SiteRevalidatePayload, SiteRevalidatePong } from "../contracts/site-cache.js";
 export type RevalidateRouteOptions = Pick<SeoRevalidationHandlerOptions, 'publicationBasePath' | 'extraPaths' | 'extendPayload'> & {
     /** The key Sonor signs the call with. Defaults to `SONOR_API_KEY`, read on every call. */
     secret?: SeoRevalidationHandlerOptions['secret'];

package/dist/revalidate/index.js

@@ -1,7 +1,7 @@
-import { createSeoRevalidationHandler } from '../chunk-THXELZTQ.js';
+import { createSeoRevalidationHandler } from '../chunk-RUV6DCKL.js';
 import '../chunk-XTRZGXB2.js';
 export { SITE_CACHE_TAGS, SITE_REVALIDATE_PATH, isSiteRevalidatePong } from '../chunk-HY7ZEU2C.js';
-import '../chunk-F6WLHVMQ.js';
+import '../chunk-D4R3FQED.js';
 import '../chunk-PKBMQBKP.js';
 
 // src/revalidate/index.ts

package/dist/robots/index.d.ts

@@ -16,9 +16,9 @@
  *   disallow: ['/admin'],
  * })
  */
-export { isNextInternalsPath } from './next-internals';
-export { AI_RETRIEVAL_CRAWLERS, AI_TRAINING_CRAWLERS, buildAiCrawlerRules, createRobotsTxtHandler, } from '../llms/aiRobots';
-export type { AiCrawlerRulesOptions, ContentSignalsOptions, RobotsTxtHandlerOptions } from '../llms/aiRobots';
+export { isNextInternalsPath } from "./next-internals.js";
+export { AI_RETRIEVAL_CRAWLERS, AI_TRAINING_CRAWLERS, buildAiCrawlerRules, createRobotsTxtHandler, } from "../llms/aiRobots.js";
+export type { AiCrawlerRulesOptions, ContentSignalsOptions, RobotsTxtHandlerOptions } from "../llms/aiRobots.js";
 export interface RobotsConfig {
     /** Base URL of the site (optional when apiKey is set; then resolved from Sonor) */
     baseUrl?: string;

package/dist/robots/indexnow.js

@@ -1,4 +1,4 @@
-export { GET, INDEXNOW_KEY_PATH, createIndexNowKeyRoute, fetchIndexNowKey } from '../chunk-EATJPSTS.js';
-import '../chunk-C7TLGL3R.js';
+export { GET, INDEXNOW_KEY_PATH, createIndexNowKeyRoute, fetchIndexNowKey } from '../chunk-O5LQUBBN.js';
+import '../chunk-7VMA3KCN.js';
 import '../chunk-MH2DSGC6.js';
 import '../chunk-PKBMQBKP.js';

package/dist/runtime/index.d.ts

@@ -23,10 +23,10 @@
  * exact list of exports, so adding or removing one is a deliberate change.
  * See README.md.
  */
-export { sonorFetch } from '../shared/sonorFetch';
-export type { SonorFetchOptions } from '../shared/sonorFetch';
-export type { FetchRetryOptions } from '../shared/fetchWithRetry';
-export { getClientApiConfig, readPublishedApiConfig, DEFAULT_SONOR_API_URL } from '../shared/clientApiConfig';
-export type { ClientApiConfigOptions } from '../shared/clientApiConfig';
-export { readAnalyticsIdentity } from '../shared/identity-reader';
-export type { AnalyticsIdentity } from '../shared/identity-reader';
+export { sonorFetch } from '../shared/sonor-fetch.js';
+export type { SonorFetchOptions } from '../shared/sonor-fetch.js';
+export type { FetchRetryOptions } from '../shared/fetchWithRetry.js';
+export { getClientApiConfig, readPublishedApiConfig, DEFAULT_SONOR_API_URL } from '../shared/clientApiConfig.js';
+export type { ClientApiConfigOptions } from '../shared/clientApiConfig.js';
+export { readAnalyticsIdentity } from '../shared/identity-reader.js';
+export type { AnalyticsIdentity } from '../shared/identity-reader.js';

package/dist/runtime/index.js

@@ -1,8 +1,7 @@
 import '../chunk-B7T2SFUF.js';
-export { readAnalyticsIdentity } from '../chunk-5ROTTMBL.js';
-import '../chunk-5TM3WPCI.js';
-export { sonorFetch } from '../chunk-FLOJUMFR.js';
-import '../chunk-7HW4TZB5.js';
+export { readAnalyticsIdentity } from '../chunk-PVY7X5UR.js';
+import '../chunk-5IVD6G77.js';
+export { sonorFetch } from '../chunk-Z4XJOVQX.js';
 export { DEFAULT_SONOR_API_URL, getClientApiConfig, readPublishedApiConfig } from '../chunk-W7OPEMGJ.js';
-import '../chunk-F6WLHVMQ.js';
+import '../chunk-FRY6PBT6.js';
 import '../chunk-PKBMQBKP.js';