@brandlab-digital/site-next 2.0.0 → 3.0.0

package/dist/headers.d.ts

@@ -1,20 +1,18 @@
 /**
- * Brandlab security/response headers (Brandlab Project Standard §2).
+ * Brandlab security/response headers: one canonical header set for every
+ * client site, emitted by `defineBrandlabNextConfig`.
  *
- * One canonical header set for every client site, composed into
- * `next.config.ts`:
+ * The deployment decides everything environment-specific:
+ * - a production build (`next build`, on Vercel or locally) enforces the
+ *   production Content Security Policy and sends HSTS;
+ * - `next dev` sends a report-only development policy without HSTS;
+ * - a Vercel Preview additionally sends `noindex, nofollow, noarchive` and
+ *   `private, no-store`, so previews never reach search results or caches.
  *
- *   async headers() {
- *     return buildBrandlabHeaderRules({
- *       isProduction,
- *       profile: 'next-local-service',
- *     })
- *   }
- *
- * The X-Robots-Tag here carries snippet-display controls only; per-page
- * indexation stays owned by Metadata.robots (noindex pages override via
- * their <meta name="robots">).
+ * The production X-Robots-Tag carries snippet-display controls only; per-page
+ * indexation stays owned by Metadata.robots.
  */
+import type { BrandlabDeployment } from '@brandlab-digital/site-core/site';
 export interface BrandlabHeader {
     key: string;
     value: string;
@@ -23,10 +21,10 @@ export interface BrandlabHeaderRule {
     source: string;
     headers: BrandlabHeader[];
 }
-export declare const BRANDLAB_NEXT_HEADER_PROFILES: readonly ["next-local-service", "next-root-level"];
-export type BrandlabNextHeaderProfile = (typeof BRANDLAB_NEXT_HEADER_PROFILES)[number];
 export declare const BRANDLAB_DEFAULT_PERMISSIONS_POLICY = "camera=(), microphone=(), geolocation=()";
 export declare const BRANDLAB_DEFAULT_X_ROBOTS_TAG = "max-snippet:-1, max-image-preview:large, max-video-preview:-1";
+export declare const BRANDLAB_PREVIEW_X_ROBOTS_TAG = "noindex, nofollow, noarchive";
+export declare const BRANDLAB_PREVIEW_CACHE_CONTROL = "private, no-store, max-age=0";
 export declare const BRANDLAB_HSTS_VALUE = "max-age=31536000";
 export interface BrandlabHstsExpansion {
     includeSubDomains: true;
@@ -39,26 +37,21 @@ export interface BrandlabContentSecurityPolicyExtensions {
     connectSrc?: readonly string[];
     frameSrc?: readonly string[];
 }
-export type BrandlabContentSecurityPolicyMode = 'enforce' | 'report-only';
 export interface BrandlabSecurityHeaderOptions {
-    isProduction: boolean;
-    profile: BrandlabNextHeaderProfile;
-    permissionsPolicy?: string;
-    /** Pass null to omit the snippet-control header entirely. */
-    xRobotsTag?: string | null;
-    extraHeaders?: readonly BrandlabHeader[];
+    /** From resolveBrandlabDeployment(process.env). */
+    deployment: BrandlabDeployment;
     hsts?: BrandlabHstsExpansion;
-    contentSecurityPolicyMode?: BrandlabContentSecurityPolicyMode;
     /** Reviewed HTTPS origins needed by an approved project integration. */
     contentSecurityPolicyExtensions?: BrandlabContentSecurityPolicyExtensions;
+    /** Reviewed project exception, for example `geolocation=(self)` for a location feature. */
+    permissionsPolicy?: string;
+    /** Reviewed project headers; they cannot replace a protected header. */
+    extraHeaders?: readonly BrandlabHeader[];
 }
 export declare function buildBrandlabContentSecurityPolicy(options: {
-    isProduction: boolean;
-    profile: BrandlabNextHeaderProfile;
+    deployment: BrandlabDeployment;
     contentSecurityPolicyExtensions?: BrandlabContentSecurityPolicyExtensions;
 }): string;
 export declare function buildBrandlabSecurityHeaders(options: BrandlabSecurityHeaderOptions): BrandlabHeader[];
-export declare function buildBrandlabHeaderRules(options: BrandlabSecurityHeaderOptions & {
-    source?: string;
-}): BrandlabHeaderRule[];
+export declare function buildBrandlabHeaderRules(options: BrandlabSecurityHeaderOptions): BrandlabHeaderRule[];
 //# sourceMappingURL=headers.d.ts.map

package/dist/headers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../src/headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,cAAc,EAAE,CAAA;CAC1B;AAED,eAAO,MAAM,6BAA6B,oDAGhC,CAAA;AAEV,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAA;AAEtF,eAAO,MAAM,mCAAmC,6CACJ,CAAA;AAE5C,eAAO,MAAM,6BAA6B,kEACuB,CAAA;AAEjE,eAAO,MAAM,mBAAmB,qBACZ,CAAA;AAEpB,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,IAAI,CAAA;IACvB,OAAO,CAAC,EAAE,IAAI,CAAA;IACd,mEAAmE;IACnE,iBAAiB,EAAE,MAAM,CAAA;CAC1B;AAcD,MAAM,WAAW,uCAAuC;IACtD,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC7B;AAED,MAAM,MAAM,iCAAiC,GAAG,SAAS,GAAG,aAAa,CAAA;AAEzE,MAAM,WAAW,6BAA6B;IAC5C,YAAY,EAAE,OAAO,CAAA;IACrB,OAAO,EAAE,yBAAyB,CAAA;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IACxC,IAAI,CAAC,EAAE,qBAAqB,CAAA;IAC5B,yBAAyB,CAAC,EAAE,iCAAiC,CAAA;IAC7D,wEAAwE;IACxE,+BAA+B,CAAC,EAAE,uCAAuC,CAAA;CAC1E;AAED,wBAAgB,kCAAkC,CAAC,OAAO,EAAE;IAC1D,YAAY,EAAE,OAAO,CAAA;IACrB,OAAO,EAAE,yBAAyB,CAAA;IAClC,+BAA+B,CAAC,EAAE,uCAAuC,CAAA;CAC1E,UAwDA;AAyCD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,6BAA6B,GACrC,cAAc,EAAE,CAmDlB;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,6BAA6B,GAAG;IAChF,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,GAAG,kBAAkB,EAAE,CAWvB"}
+{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../src/headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,kCAAkC,CAAA;AAEzC,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,cAAc,EAAE,CAAA;CAC1B;AAED,eAAO,MAAM,mCAAmC,6CACJ,CAAA;AAE5C,eAAO,MAAM,6BAA6B,kEACuB,CAAA;AAEjE,eAAO,MAAM,6BAA6B,iCAAiC,CAAA;AAE3E,eAAO,MAAM,8BAA8B,iCAAiC,CAAA;AAE5E,eAAO,MAAM,mBAAmB,qBACZ,CAAA;AAEpB,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,IAAI,CAAA;IACvB,OAAO,CAAC,EAAE,IAAI,CAAA;IACd,mEAAmE;IACnE,iBAAiB,EAAE,MAAM,CAAA;CAC1B;AAoBD,MAAM,WAAW,uCAAuC;IACtD,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC7B;AAED,MAAM,WAAW,6BAA6B;IAC5C,mDAAmD;IACnD,UAAU,EAAE,kBAAkB,CAAA;IAC9B,IAAI,CAAC,EAAE,qBAAqB,CAAA;IAC5B,wEAAwE;IACxE,+BAA+B,CAAC,EAAE,uCAAuC,CAAA;IACzE,2FAA2F;IAC3F,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,wEAAwE;IACxE,YAAY,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;CACzC;AAcD,wBAAgB,kCAAkC,CAAC,OAAO,EAAE;IAC1D,UAAU,EAAE,kBAAkB,CAAA;IAC9B,+BAA+B,CAAC,EAAE,uCAAuC,CAAA;CAC1E,UAsDA;AAiDD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,6BAA6B,GACrC,cAAc,EAAE,CAmDlB;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,6BAA6B,GAAG,kBAAkB,EAAE,CAOrG"}

package/dist/headers.js

@@ -1,29 +1,25 @@
 /**
- * Brandlab security/response headers (Brandlab Project Standard §2).
+ * Brandlab security/response headers: one canonical header set for every
+ * client site, emitted by `defineBrandlabNextConfig`.
  *
- * One canonical header set for every client site, composed into
- * `next.config.ts`:
+ * The deployment decides everything environment-specific:
+ * - a production build (`next build`, on Vercel or locally) enforces the
+ *   production Content Security Policy and sends HSTS;
+ * - `next dev` sends a report-only development policy without HSTS;
+ * - a Vercel Preview additionally sends `noindex, nofollow, noarchive` and
+ *   `private, no-store`, so previews never reach search results or caches.
  *
- *   async headers() {
- *     return buildBrandlabHeaderRules({
- *       isProduction,
- *       profile: 'next-local-service',
- *     })
- *   }
- *
- * The X-Robots-Tag here carries snippet-display controls only; per-page
- * indexation stays owned by Metadata.robots (noindex pages override via
- * their <meta name="robots">).
+ * The production X-Robots-Tag carries snippet-display controls only; per-page
+ * indexation stays owned by Metadata.robots.
  */
-export const BRANDLAB_NEXT_HEADER_PROFILES = [
-    'next-local-service',
-    'next-root-level',
-];
 export const BRANDLAB_DEFAULT_PERMISSIONS_POLICY = 'camera=(), microphone=(), geolocation=()';
 export const BRANDLAB_DEFAULT_X_ROBOTS_TAG = 'max-snippet:-1, max-image-preview:large, max-video-preview:-1';
+export const BRANDLAB_PREVIEW_X_ROBOTS_TAG = 'noindex, nofollow, noarchive';
+export const BRANDLAB_PREVIEW_CACHE_CONTROL = 'private, no-store, max-age=0';
 export const BRANDLAB_HSTS_VALUE = 'max-age=31536000';
 const HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 const PROTECTED_HEADER_NAMES = new Set([
+    'cache-control',
     'content-security-policy',
     'content-security-policy-report-only',
     'x-frame-options',
@@ -33,11 +29,23 @@ const PROTECTED_HEADER_NAMES = new Set([
     'x-robots-tag',
     'strict-transport-security',
 ]);
-export function buildBrandlabContentSecurityPolicy(options) {
-    const profile = options.profile;
-    if (!BRANDLAB_NEXT_HEADER_PROFILES.includes(profile)) {
-        throw new Error(`Unsupported Brandlab Next header profile "${profile}".`);
+const DEPLOYMENT_ENVIRONMENTS = new Set([
+    'production',
+    'preview',
+    'development',
+]);
+function assertDeployment(deployment) {
+    const candidate = deployment;
+    if (!candidate ||
+        typeof candidate !== 'object' ||
+        !DEPLOYMENT_ENVIRONMENTS.has(candidate.environment) ||
+        typeof candidate.productionBuild !== 'boolean') {
+        throw new Error('Header rules require the deployment from resolveBrandlabDeployment(process.env).');
     }
+}
+export function buildBrandlabContentSecurityPolicy(options) {
+    assertDeployment(options.deployment);
+    const productionBuild = options.deployment.productionBuild;
     const scriptSources = [
         "'self'",
         "'unsafe-inline'",
@@ -49,7 +57,7 @@ export function buildBrandlabContentSecurityPolicy(options) {
         'https://googleads.g.doubleclick.net',
         'https://challenges.cloudflare.com',
         ...normalizeCspExtensions(options.contentSecurityPolicyExtensions?.scriptSrc, 'scriptSrc'),
-        ...(options.isProduction ? [] : ["'unsafe-eval'", 'http://localhost:*']),
+        ...(productionBuild ? [] : ["'unsafe-eval'", 'http://localhost:*']),
     ];
     const connectSources = [
         "'self'",
@@ -66,7 +74,7 @@ export function buildBrandlabContentSecurityPolicy(options) {
         'https://*.analytics.google.com',
         'https://challenges.cloudflare.com',
         ...normalizeCspExtensions(options.contentSecurityPolicyExtensions?.connectSrc, 'connectSrc'),
-        ...(options.isProduction ? [] : ['http://localhost:*', 'ws://localhost:*']),
+        ...(productionBuild ? [] : ['http://localhost:*', 'ws://localhost:*']),
     ];
     const directives = [
         "default-src 'self'",
@@ -82,7 +90,7 @@ export function buildBrandlabContentSecurityPolicy(options) {
         `frame-src 'self' https://challenges.cloudflare.com https://www.googletagmanager.com https://www.google.com ${normalizeCspExtensions(options.contentSecurityPolicyExtensions?.frameSrc, 'frameSrc').join(' ')}`.trim(),
         "manifest-src 'self'",
         "worker-src 'self' blob:",
-        ...(options.isProduction ? ['upgrade-insecure-requests'] : []),
+        ...(productionBuild ? ['upgrade-insecure-requests'] : []),
     ];
     return directives.join('; ');
 }
@@ -120,15 +128,25 @@ function validateExtraHeaders(headers) {
         assertHeaderValue(header.value, `extraHeaders[${index}].value`);
     });
 }
+const HEADER_OPTION_KEYS = new Set([
+    'deployment',
+    'hsts',
+    'contentSecurityPolicyExtensions',
+    'permissionsPolicy',
+    'extraHeaders',
+]);
 export function buildBrandlabSecurityHeaders(options) {
-    if (typeof options.isProduction !== 'boolean') {
-        throw new Error('isProduction must be boolean.');
+    if (!options || typeof options !== 'object') {
+        throw new TypeError('Header options are required.');
+    }
+    const unsupported = Object.keys(options).filter((key) => !HEADER_OPTION_KEYS.has(key));
+    if (unsupported.length > 0) {
+        throw new Error(`Header options contain unsupported keys: ${unsupported.join(', ')}. The deployment decides CSP, HSTS and X-Robots-Tag.`);
     }
-    const xRobotsTag = options.xRobotsTag === undefined ? BRANDLAB_DEFAULT_X_ROBOTS_TAG : options.xRobotsTag;
+    assertDeployment(options.deployment);
+    const { environment, productionBuild } = options.deployment;
     const permissionsPolicy = options.permissionsPolicy ?? BRANDLAB_DEFAULT_PERMISSIONS_POLICY;
     assertHeaderValue(permissionsPolicy, 'permissionsPolicy');
-    if (xRobotsTag !== null)
-        assertHeaderValue(xRobotsTag, 'xRobotsTag');
     validateExtraHeaders(options.extraHeaders ?? []);
     if (options.hsts) {
         assertHeaderValue(options.hsts.readinessEvidence, 'hsts.readinessEvidence');
@@ -139,19 +157,7 @@ export function buildBrandlabSecurityHeaders(options) {
     const hstsValue = options.hsts
         ? `${BRANDLAB_HSTS_VALUE}; includeSubDomains${options.hsts.preload ? '; preload' : ''}`
         : BRANDLAB_HSTS_VALUE;
-    const cspMode = options.contentSecurityPolicyMode ?? (options.isProduction ? 'enforce' : 'report-only');
-    if (!new Set(['enforce', 'report-only']).has(cspMode)) {
-        throw new Error(`Unsupported contentSecurityPolicyMode "${cspMode}".`);
-    }
-    if (options.isProduction && cspMode !== 'enforce') {
-        throw new Error('Production Content Security Policy must use enforce mode.');
-    }
-    const cspHeader = [{
-            key: cspMode === 'enforce'
-                ? 'Content-Security-Policy'
-                : 'Content-Security-Policy-Report-Only',
-            value: buildBrandlabContentSecurityPolicy(options),
-        }];
+    const preview = environment === 'preview';
     return [
         { key: 'X-Frame-Options', value: 'DENY' },
         { key: 'X-Content-Type-Options', value: 'nosniff' },
@@ -160,22 +166,27 @@ export function buildBrandlabSecurityHeaders(options) {
             key: 'Permissions-Policy',
             value: permissionsPolicy,
         },
-        ...(xRobotsTag ? [{ key: 'X-Robots-Tag', value: xRobotsTag }] : []),
-        ...(options.isProduction
+        {
+            key: 'X-Robots-Tag',
+            value: preview ? BRANDLAB_PREVIEW_X_ROBOTS_TAG : BRANDLAB_DEFAULT_X_ROBOTS_TAG,
+        },
+        ...(productionBuild
             ? [{ key: 'Strict-Transport-Security', value: hstsValue }]
             : []),
-        ...cspHeader,
-        ...(options.extraHeaders ?? []),
+        {
+            key: productionBuild
+                ? 'Content-Security-Policy'
+                : 'Content-Security-Policy-Report-Only',
+            value: buildBrandlabContentSecurityPolicy(options),
+        },
+        ...(options.extraHeaders ?? []).map((header) => ({ ...header })),
+        ...(preview ? [{ key: 'Cache-Control', value: BRANDLAB_PREVIEW_CACHE_CONTROL }] : []),
     ];
 }
 export function buildBrandlabHeaderRules(options) {
-    const source = options.source ?? '/:path*';
-    if (!source.startsWith('/') || /[\u0000-\u001F\u007F]/.test(source)) {
-        throw new Error('Header-rule source must be a root-relative single-line pattern.');
-    }
     return [
         {
-            source,
+            source: '/:path*',
             headers: buildBrandlabSecurityHeaders(options),
         },
     ];

package/dist/headers.js.map

@@ -1 +1 @@
-{"version":3,"file":"headers.js","sourceRoot":"","sources":["../src/headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAYH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,oBAAoB;IACpB,iBAAiB;CACT,CAAA;AAIV,MAAM,CAAC,MAAM,mCAAmC,GAC9C,0CAA0C,CAAA;AAE5C,MAAM,CAAC,MAAM,6BAA6B,GACxC,+DAA+D,CAAA;AAEjE,MAAM,CAAC,MAAM,mBAAmB,GAC9B,kBAAkB,CAAA;AASpB,MAAM,mBAAmB,GAAG,+BAA+B,CAAA;AAC3D,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,yBAAyB;IACzB,qCAAqC;IACrC,iBAAiB;IACjB,wBAAwB;IACxB,iBAAiB;IACjB,oBAAoB;IACpB,cAAc;IACd,2BAA2B;CAC5B,CAAC,CAAA;AAuBF,MAAM,UAAU,kCAAkC,CAAC,OAIlD;IACC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;IAC/B,IAAI,CAAC,6BAA6B,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,6CAA6C,OAAO,IAAI,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,aAAa,GAAG;QACpB,QAAQ;QACR,iBAAiB;QACjB,kCAAkC;QAClC,kCAAkC;QAClC,wBAAwB;QACxB,yBAAyB;QACzB,uCAAuC;QACvC,qCAAqC;QACrC,mCAAmC;QACnC,GAAG,sBAAsB,CAAC,OAAO,CAAC,+BAA+B,EAAE,SAAS,EAAE,WAAW,CAAC;QAC1F,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;KACzE,CAAA;IACD,MAAM,cAAc,GAAG;QACrB,QAAQ;QACR,kCAAkC;QAClC,gCAAgC;QAChC,kCAAkC;QAClC,kCAAkC;QAClC,2BAA2B;QAC3B,sBAAsB;QACtB,oBAAoB;QACpB,2BAA2B;QAC3B,uCAAuC;QACvC,gCAAgC;QAChC,gCAAgC;QAChC,mCAAmC;QACnC,GAAG,sBAAsB,CAAC,OAAO,CAAC,+BAA+B,EAAE,UAAU,EAAE,YAAY,CAAC;QAC5F,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;KAC5E,CAAA;IACD,MAAM,UAAU,GAAG;QACjB,oBAAoB;QACpB,iBAAiB;QACjB,mBAAmB;QACnB,wBAAwB;QACxB,oBAAoB;QACpB,cAAc,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACvC,kCAAkC;QAClC,uBAAuB;QACvB,mCAAmC;QACnC,eAAe,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACzC,8GAA8G,sBAAsB,CAClI,OAAO,CAAC,+BAA+B,EAAE,QAAQ,EACjD,UAAU,CACX,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;QACpB,qBAAqB;QACrB,yBAAyB;QACzB,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAA;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC9B,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAsC,EACtC,KAAoD;IAEpD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IACvB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACzC,IAAI,CAAC,oEAAoE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+DAA+D,CAAC,CAAA;QAC1F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IACF,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAA;IACrD,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,KAAa;IACrD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8CAA8C,CAAC,CAAA;IACzE,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAkC;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAChC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,mBAAmB,CAAC,CAAA;QAC3D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAA;QACrC,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,8CAA8C,CAAC,CAAA;QACtF,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACf,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,gBAAgB,KAAK,SAAS,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,OAAsC;IAEtC,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAClD,CAAC;IACD,MAAM,UAAU,GACd,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAA;IACvF,MAAM,iBAAiB,GACrB,OAAO,CAAC,iBAAiB,IAAI,mCAAmC,CAAA;IAClE,iBAAiB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAA;IACzD,IAAI,UAAU,KAAK,IAAI;QAAE,iBAAiB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;IACpE,oBAAoB,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAA;IAChD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAA;QAC3E,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QACvE,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI;QAC5B,CAAC,CAAC,GAAG,mBAAmB,sBAAsB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE;QACvF,CAAC,CAAC,mBAAmB,CAAA;IACvB,MAAM,OAAO,GAAG,OAAO,CAAC,yBAAyB,IAAI,CACnD,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CACjD,CAAA;IACD,IAAI,CAAC,IAAI,GAAG,CAAoC,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,0CAA0C,OAAO,IAAI,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,SAAS,GAAG,CAAC;YACjB,GAAG,EAAE,OAAO,KAAK,SAAS;gBACxB,CAAC,CAAC,yBAAyB;gBAC3B,CAAC,CAAC,qCAAqC;YACzC,KAAK,EAAE,kCAAkC,CAAC,OAAO,CAAC;SACnD,CAAC,CAAA;IAEF,OAAO;QACL,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE;QACzC,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,SAAS,EAAE;QACnD,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,iCAAiC,EAAE;QACpE;YACE,GAAG,EAAE,oBAAoB;YACzB,KAAK,EAAE,iBAAiB;SACzB;QACD,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,YAAY;YACtB,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAC1D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,SAAS;QACZ,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;KAChC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAExC;IACC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IACpF,CAAC;IACD,OAAO;QACL;YACE,MAAM;YACN,OAAO,EAAE,4BAA4B,CAAC,OAAO,CAAC;SAC/C;KACF,CAAA;AACH,CAAC","sourcesContent":["/**\n * Brandlab security/response headers (Brandlab Project Standard §2).\n *\n * One canonical header set for every client site, composed into\n * `next.config.ts`:\n *\n *   async headers() {\n *     return buildBrandlabHeaderRules({\n *       isProduction,\n *       profile: 'next-local-service',\n *     })\n *   }\n *\n * The X-Robots-Tag here carries snippet-display controls only; per-page\n * indexation stays owned by Metadata.robots (noindex pages override via\n * their <meta name=\"robots\">).\n */\n\nexport interface BrandlabHeader {\n  key: string\n  value: string\n}\n\nexport interface BrandlabHeaderRule {\n  source: string\n  headers: BrandlabHeader[]\n}\n\nexport const BRANDLAB_NEXT_HEADER_PROFILES = [\n  'next-local-service',\n  'next-root-level',\n] as const\n\nexport type BrandlabNextHeaderProfile = (typeof BRANDLAB_NEXT_HEADER_PROFILES)[number]\n\nexport const BRANDLAB_DEFAULT_PERMISSIONS_POLICY =\n  'camera=(), microphone=(), geolocation=()'\n\nexport const BRANDLAB_DEFAULT_X_ROBOTS_TAG =\n  'max-snippet:-1, max-image-preview:large, max-video-preview:-1'\n\nexport const BRANDLAB_HSTS_VALUE =\n  'max-age=31536000'\n\nexport interface BrandlabHstsExpansion {\n  includeSubDomains: true\n  preload?: true\n  /** Reviewed proof that every affected subdomain is HTTPS-ready. */\n  readinessEvidence: string\n}\n\nconst HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/\nconst PROTECTED_HEADER_NAMES = new Set([\n  'content-security-policy',\n  'content-security-policy-report-only',\n  'x-frame-options',\n  'x-content-type-options',\n  'referrer-policy',\n  'permissions-policy',\n  'x-robots-tag',\n  'strict-transport-security',\n])\n\nexport interface BrandlabContentSecurityPolicyExtensions {\n  scriptSrc?: readonly string[]\n  connectSrc?: readonly string[]\n  frameSrc?: readonly string[]\n}\n\nexport type BrandlabContentSecurityPolicyMode = 'enforce' | 'report-only'\n\nexport interface BrandlabSecurityHeaderOptions {\n  isProduction: boolean\n  profile: BrandlabNextHeaderProfile\n  permissionsPolicy?: string\n  /** Pass null to omit the snippet-control header entirely. */\n  xRobotsTag?: string | null\n  extraHeaders?: readonly BrandlabHeader[]\n  hsts?: BrandlabHstsExpansion\n  contentSecurityPolicyMode?: BrandlabContentSecurityPolicyMode\n  /** Reviewed HTTPS origins needed by an approved project integration. */\n  contentSecurityPolicyExtensions?: BrandlabContentSecurityPolicyExtensions\n}\n\nexport function buildBrandlabContentSecurityPolicy(options: {\n  isProduction: boolean\n  profile: BrandlabNextHeaderProfile\n  contentSecurityPolicyExtensions?: BrandlabContentSecurityPolicyExtensions\n}) {\n  const profile = options.profile\n  if (!BRANDLAB_NEXT_HEADER_PROFILES.includes(profile)) {\n    throw new Error(`Unsupported Brandlab Next header profile \"${profile}\".`)\n  }\n\n  const scriptSources = [\n    \"'self'\",\n    \"'unsafe-inline'\",\n    'https://www.googletagmanager.com',\n    'https://www.googleadservices.com',\n    'https://www.google.com',\n    'https://www.gstatic.com',\n    'https://pagead2.googlesyndication.com',\n    'https://googleads.g.doubleclick.net',\n    'https://challenges.cloudflare.com',\n    ...normalizeCspExtensions(options.contentSecurityPolicyExtensions?.scriptSrc, 'scriptSrc'),\n    ...(options.isProduction ? [] : [\"'unsafe-eval'\", 'http://localhost:*']),\n  ]\n  const connectSources = [\n    \"'self'\",\n    'https://www.google-analytics.com',\n    'https://*.google-analytics.com',\n    'https://www.googletagmanager.com',\n    'https://www.googleadservices.com',\n    'https://*.doubleclick.net',\n    'https://*.google.com',\n    'https://google.com',\n    'https://www.google.com.au',\n    'https://pagead2.googlesyndication.com',\n    'https://*.googletagmanager.com',\n    'https://*.analytics.google.com',\n    'https://challenges.cloudflare.com',\n    ...normalizeCspExtensions(options.contentSecurityPolicyExtensions?.connectSrc, 'connectSrc'),\n    ...(options.isProduction ? [] : ['http://localhost:*', 'ws://localhost:*']),\n  ]\n  const directives = [\n    \"default-src 'self'\",\n    \"base-uri 'self'\",\n    \"object-src 'none'\",\n    \"frame-ancestors 'none'\",\n    \"form-action 'self'\",\n    `script-src ${scriptSources.join(' ')}`,\n    \"style-src 'self' 'unsafe-inline'\",\n    \"font-src 'self' data:\",\n    \"img-src 'self' data: blob: https:\",\n    `connect-src ${connectSources.join(' ')}`,\n    `frame-src 'self' https://challenges.cloudflare.com https://www.googletagmanager.com https://www.google.com ${normalizeCspExtensions(\n      options.contentSecurityPolicyExtensions?.frameSrc,\n      'frameSrc',\n    ).join(' ')}`.trim(),\n    \"manifest-src 'self'\",\n    \"worker-src 'self' blob:\",\n    ...(options.isProduction ? ['upgrade-insecure-requests'] : []),\n  ]\n  return directives.join('; ')\n}\n\nfunction normalizeCspExtensions(\n  sources: readonly string[] | undefined,\n  field: keyof BrandlabContentSecurityPolicyExtensions,\n) {\n  if (!sources) return []\n  const normalized = sources.map((source) => {\n    const value = source.trim().toLowerCase()\n    if (!/^https:\\/\\/(?:\\*\\.)?[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?(?::\\d{1,5})?$/.test(value)) {\n      throw new Error(`${field} entries must be HTTPS origins without paths or CSP keywords.`)\n    }\n    return value\n  })\n  if (new Set(normalized).size !== normalized.length) {\n    throw new Error(`${field} entries must be unique.`)\n  }\n  return normalized\n}\n\nfunction assertHeaderValue(value: string, field: string) {\n  if (!value || value.length > 4_096 || /[\\u0000-\\u001F\\u007F]/.test(value)) {\n    throw new Error(`${field} must be a bounded single-line header value.`)\n  }\n}\n\nfunction validateExtraHeaders(headers: readonly BrandlabHeader[]) {\n  const names = new Set<string>()\n  headers.forEach((header, index) => {\n    if (!HEADER_NAME_PATTERN.test(header.key)) {\n      throw new Error(`extraHeaders[${index}].key is invalid.`)\n    }\n    const name = header.key.toLowerCase()\n    if (PROTECTED_HEADER_NAMES.has(name) || names.has(name)) {\n      throw new Error(`extraHeaders[${index}] duplicates a protected or existing header.`)\n    }\n    names.add(name)\n    assertHeaderValue(header.value, `extraHeaders[${index}].value`)\n  })\n}\n\nexport function buildBrandlabSecurityHeaders(\n  options: BrandlabSecurityHeaderOptions,\n): BrandlabHeader[] {\n  if (typeof options.isProduction !== 'boolean') {\n    throw new Error('isProduction must be boolean.')\n  }\n  const xRobotsTag =\n    options.xRobotsTag === undefined ? BRANDLAB_DEFAULT_X_ROBOTS_TAG : options.xRobotsTag\n  const permissionsPolicy =\n    options.permissionsPolicy ?? BRANDLAB_DEFAULT_PERMISSIONS_POLICY\n  assertHeaderValue(permissionsPolicy, 'permissionsPolicy')\n  if (xRobotsTag !== null) assertHeaderValue(xRobotsTag, 'xRobotsTag')\n  validateExtraHeaders(options.extraHeaders ?? [])\n  if (options.hsts) {\n    assertHeaderValue(options.hsts.readinessEvidence, 'hsts.readinessEvidence')\n    if (options.hsts.preload && !options.hsts.includeSubDomains) {\n      throw new Error('HSTS preload requires includeSubDomains readiness.')\n    }\n  }\n  const hstsValue = options.hsts\n    ? `${BRANDLAB_HSTS_VALUE}; includeSubDomains${options.hsts.preload ? '; preload' : ''}`\n    : BRANDLAB_HSTS_VALUE\n  const cspMode = options.contentSecurityPolicyMode ?? (\n    options.isProduction ? 'enforce' : 'report-only'\n  )\n  if (!new Set<BrandlabContentSecurityPolicyMode>(['enforce', 'report-only']).has(cspMode)) {\n    throw new Error(`Unsupported contentSecurityPolicyMode \"${cspMode}\".`)\n  }\n  if (options.isProduction && cspMode !== 'enforce') {\n    throw new Error('Production Content Security Policy must use enforce mode.')\n  }\n  const cspHeader = [{\n    key: cspMode === 'enforce'\n      ? 'Content-Security-Policy'\n      : 'Content-Security-Policy-Report-Only',\n    value: buildBrandlabContentSecurityPolicy(options),\n  }]\n\n  return [\n    { key: 'X-Frame-Options', value: 'DENY' },\n    { key: 'X-Content-Type-Options', value: 'nosniff' },\n    { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },\n    {\n      key: 'Permissions-Policy',\n      value: permissionsPolicy,\n    },\n    ...(xRobotsTag ? [{ key: 'X-Robots-Tag', value: xRobotsTag }] : []),\n    ...(options.isProduction\n      ? [{ key: 'Strict-Transport-Security', value: hstsValue }]\n      : []),\n    ...cspHeader,\n    ...(options.extraHeaders ?? []),\n  ]\n}\n\nexport function buildBrandlabHeaderRules(options: BrandlabSecurityHeaderOptions & {\n  source?: string\n}): BrandlabHeaderRule[] {\n  const source = options.source ?? '/:path*'\n  if (!source.startsWith('/') || /[\\u0000-\\u001F\\u007F]/.test(source)) {\n    throw new Error('Header-rule source must be a root-relative single-line pattern.')\n  }\n  return [\n    {\n      source,\n      headers: buildBrandlabSecurityHeaders(options),\n    },\n  ]\n}\n"]}
+{"version":3,"file":"headers.js","sourceRoot":"","sources":["../src/headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAiBH,MAAM,CAAC,MAAM,mCAAmC,GAC9C,0CAA0C,CAAA;AAE5C,MAAM,CAAC,MAAM,6BAA6B,GACxC,+DAA+D,CAAA;AAEjE,MAAM,CAAC,MAAM,6BAA6B,GAAG,8BAA8B,CAAA;AAE3E,MAAM,CAAC,MAAM,8BAA8B,GAAG,8BAA8B,CAAA;AAE5E,MAAM,CAAC,MAAM,mBAAmB,GAC9B,kBAAkB,CAAA;AASpB,MAAM,mBAAmB,GAAG,+BAA+B,CAAA;AAC3D,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,eAAe;IACf,yBAAyB;IACzB,qCAAqC;IACrC,iBAAiB;IACjB,wBAAwB;IACxB,iBAAiB;IACjB,oBAAoB;IACpB,cAAc;IACd,2BAA2B;CAC5B,CAAC,CAAA;AACF,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAgC;IACrE,YAAY;IACZ,SAAS;IACT,aAAa;CACd,CAAC,CAAA;AAoBF,SAAS,gBAAgB,CAAC,UAAmB;IAC3C,MAAM,SAAS,GAAG,UAAqD,CAAA;IACvE,IACE,CAAC,SAAS;QACV,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,WAA4C,CAAC;QACpF,OAAO,SAAS,CAAC,eAAe,KAAK,SAAS,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAA;IACrG,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,OAGlD;IACC,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACpC,MAAM,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,eAAe,CAAA;IAE1D,MAAM,aAAa,GAAG;QACpB,QAAQ;QACR,iBAAiB;QACjB,kCAAkC;QAClC,kCAAkC;QAClC,wBAAwB;QACxB,yBAAyB;QACzB,uCAAuC;QACvC,qCAAqC;QACrC,mCAAmC;QACnC,GAAG,sBAAsB,CAAC,OAAO,CAAC,+BAA+B,EAAE,SAAS,EAAE,WAAW,CAAC;QAC1F,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;KACpE,CAAA;IACD,MAAM,cAAc,GAAG;QACrB,QAAQ;QACR,kCAAkC;QAClC,gCAAgC;QAChC,kCAAkC;QAClC,kCAAkC;QAClC,2BAA2B;QAC3B,sBAAsB;QACtB,oBAAoB;QACpB,2BAA2B;QAC3B,uCAAuC;QACvC,gCAAgC;QAChC,gCAAgC;QAChC,mCAAmC;QACnC,GAAG,sBAAsB,CAAC,OAAO,CAAC,+BAA+B,EAAE,UAAU,EAAE,YAAY,CAAC;QAC5F,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;KACvE,CAAA;IACD,MAAM,UAAU,GAAG;QACjB,oBAAoB;QACpB,iBAAiB;QACjB,mBAAmB;QACnB,wBAAwB;QACxB,oBAAoB;QACpB,cAAc,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACvC,kCAAkC;QAClC,uBAAuB;QACvB,mCAAmC;QACnC,eAAe,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACzC,8GAA8G,sBAAsB,CAClI,OAAO,CAAC,+BAA+B,EAAE,QAAQ,EACjD,UAAU,CACX,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;QACpB,qBAAqB;QACrB,yBAAyB;QACzB,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAA;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC9B,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAsC,EACtC,KAAoD;IAEpD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IACvB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACzC,IAAI,CAAC,oEAAoE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+DAA+D,CAAC,CAAA;QAC1F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IACF,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAA;IACrD,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,KAAa;IACrD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8CAA8C,CAAC,CAAA;IACzE,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAkC;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAChC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,mBAAmB,CAAC,CAAA;QAC3D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAA;QACrC,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,8CAA8C,CAAC,CAAA;QACtF,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACf,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,gBAAgB,KAAK,SAAS,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,YAAY;IACZ,MAAM;IACN,iCAAiC;IACjC,mBAAmB;IACnB,cAAc;CACf,CAAC,CAAA;AAEF,MAAM,UAAU,4BAA4B,CAC1C,OAAsC;IAEtC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IACtF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,4CAA4C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,sDAAsD,CACzH,CAAA;IACH,CAAC;IACD,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACpC,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,UAAU,CAAA;IAC3D,MAAM,iBAAiB,GACrB,OAAO,CAAC,iBAAiB,IAAI,mCAAmC,CAAA;IAClE,iBAAiB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAA;IACzD,oBAAoB,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAA;IAChD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAA;QAC3E,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QACvE,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI;QAC5B,CAAC,CAAC,GAAG,mBAAmB,sBAAsB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE;QACvF,CAAC,CAAC,mBAAmB,CAAA;IACvB,MAAM,OAAO,GAAG,WAAW,KAAK,SAAS,CAAA;IAEzC,OAAO;QACL,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE;QACzC,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,SAAS,EAAE;QACnD,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,iCAAiC,EAAE;QACpE;YACE,GAAG,EAAE,oBAAoB;YACzB,KAAK,EAAE,iBAAiB;SACzB;QACD;YACE,GAAG,EAAE,cAAc;YACnB,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,6BAA6B;SAC/E;QACD,GAAG,CAAC,eAAe;YACjB,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAC1D,CAAC,CAAC,EAAE,CAAC;QACP;YACE,GAAG,EAAE,eAAe;gBAClB,CAAC,CAAC,yBAAyB;gBAC3B,CAAC,CAAC,qCAAqC;YACzC,KAAK,EAAE,kCAAkC,CAAC,OAAO,CAAC;SACnD;QACD,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACtF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAsC;IAC7E,OAAO;QACL;YACE,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,4BAA4B,CAAC,OAAO,CAAC;SAC/C;KACF,CAAA;AACH,CAAC","sourcesContent":["/**\n * Brandlab security/response headers: one canonical header set for every\n * client site, emitted by `defineBrandlabNextConfig`.\n *\n * The deployment decides everything environment-specific:\n * - a production build (`next build`, on Vercel or locally) enforces the\n *   production Content Security Policy and sends HSTS;\n * - `next dev` sends a report-only development policy without HSTS;\n * - a Vercel Preview additionally sends `noindex, nofollow, noarchive` and\n *   `private, no-store`, so previews never reach search results or caches.\n *\n * The production X-Robots-Tag carries snippet-display controls only; per-page\n * indexation stays owned by Metadata.robots.\n */\n\nimport type {\n  BrandlabDeployment,\n  BrandlabDeploymentEnvironment,\n} from '@brandlab-digital/site-core/site'\n\nexport interface BrandlabHeader {\n  key: string\n  value: string\n}\n\nexport interface BrandlabHeaderRule {\n  source: string\n  headers: BrandlabHeader[]\n}\n\nexport const BRANDLAB_DEFAULT_PERMISSIONS_POLICY =\n  'camera=(), microphone=(), geolocation=()'\n\nexport const BRANDLAB_DEFAULT_X_ROBOTS_TAG =\n  'max-snippet:-1, max-image-preview:large, max-video-preview:-1'\n\nexport const BRANDLAB_PREVIEW_X_ROBOTS_TAG = 'noindex, nofollow, noarchive'\n\nexport const BRANDLAB_PREVIEW_CACHE_CONTROL = 'private, no-store, max-age=0'\n\nexport const BRANDLAB_HSTS_VALUE =\n  'max-age=31536000'\n\nexport interface BrandlabHstsExpansion {\n  includeSubDomains: true\n  preload?: true\n  /** Reviewed proof that every affected subdomain is HTTPS-ready. */\n  readinessEvidence: string\n}\n\nconst HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/\nconst PROTECTED_HEADER_NAMES = new Set([\n  'cache-control',\n  'content-security-policy',\n  'content-security-policy-report-only',\n  'x-frame-options',\n  'x-content-type-options',\n  'referrer-policy',\n  'permissions-policy',\n  'x-robots-tag',\n  'strict-transport-security',\n])\nconst DEPLOYMENT_ENVIRONMENTS = new Set<BrandlabDeploymentEnvironment>([\n  'production',\n  'preview',\n  'development',\n])\n\nexport interface BrandlabContentSecurityPolicyExtensions {\n  scriptSrc?: readonly string[]\n  connectSrc?: readonly string[]\n  frameSrc?: readonly string[]\n}\n\nexport interface BrandlabSecurityHeaderOptions {\n  /** From resolveBrandlabDeployment(process.env). */\n  deployment: BrandlabDeployment\n  hsts?: BrandlabHstsExpansion\n  /** Reviewed HTTPS origins needed by an approved project integration. */\n  contentSecurityPolicyExtensions?: BrandlabContentSecurityPolicyExtensions\n  /** Reviewed project exception, for example `geolocation=(self)` for a location feature. */\n  permissionsPolicy?: string\n  /** Reviewed project headers; they cannot replace a protected header. */\n  extraHeaders?: readonly BrandlabHeader[]\n}\n\nfunction assertDeployment(deployment: unknown): asserts deployment is BrandlabDeployment {\n  const candidate = deployment as Partial<BrandlabDeployment> | undefined\n  if (\n    !candidate ||\n    typeof candidate !== 'object' ||\n    !DEPLOYMENT_ENVIRONMENTS.has(candidate.environment as BrandlabDeploymentEnvironment) ||\n    typeof candidate.productionBuild !== 'boolean'\n  ) {\n    throw new Error('Header rules require the deployment from resolveBrandlabDeployment(process.env).')\n  }\n}\n\nexport function buildBrandlabContentSecurityPolicy(options: {\n  deployment: BrandlabDeployment\n  contentSecurityPolicyExtensions?: BrandlabContentSecurityPolicyExtensions\n}) {\n  assertDeployment(options.deployment)\n  const productionBuild = options.deployment.productionBuild\n\n  const scriptSources = [\n    \"'self'\",\n    \"'unsafe-inline'\",\n    'https://www.googletagmanager.com',\n    'https://www.googleadservices.com',\n    'https://www.google.com',\n    'https://www.gstatic.com',\n    'https://pagead2.googlesyndication.com',\n    'https://googleads.g.doubleclick.net',\n    'https://challenges.cloudflare.com',\n    ...normalizeCspExtensions(options.contentSecurityPolicyExtensions?.scriptSrc, 'scriptSrc'),\n    ...(productionBuild ? [] : [\"'unsafe-eval'\", 'http://localhost:*']),\n  ]\n  const connectSources = [\n    \"'self'\",\n    'https://www.google-analytics.com',\n    'https://*.google-analytics.com',\n    'https://www.googletagmanager.com',\n    'https://www.googleadservices.com',\n    'https://*.doubleclick.net',\n    'https://*.google.com',\n    'https://google.com',\n    'https://www.google.com.au',\n    'https://pagead2.googlesyndication.com',\n    'https://*.googletagmanager.com',\n    'https://*.analytics.google.com',\n    'https://challenges.cloudflare.com',\n    ...normalizeCspExtensions(options.contentSecurityPolicyExtensions?.connectSrc, 'connectSrc'),\n    ...(productionBuild ? [] : ['http://localhost:*', 'ws://localhost:*']),\n  ]\n  const directives = [\n    \"default-src 'self'\",\n    \"base-uri 'self'\",\n    \"object-src 'none'\",\n    \"frame-ancestors 'none'\",\n    \"form-action 'self'\",\n    `script-src ${scriptSources.join(' ')}`,\n    \"style-src 'self' 'unsafe-inline'\",\n    \"font-src 'self' data:\",\n    \"img-src 'self' data: blob: https:\",\n    `connect-src ${connectSources.join(' ')}`,\n    `frame-src 'self' https://challenges.cloudflare.com https://www.googletagmanager.com https://www.google.com ${normalizeCspExtensions(\n      options.contentSecurityPolicyExtensions?.frameSrc,\n      'frameSrc',\n    ).join(' ')}`.trim(),\n    \"manifest-src 'self'\",\n    \"worker-src 'self' blob:\",\n    ...(productionBuild ? ['upgrade-insecure-requests'] : []),\n  ]\n  return directives.join('; ')\n}\n\nfunction normalizeCspExtensions(\n  sources: readonly string[] | undefined,\n  field: keyof BrandlabContentSecurityPolicyExtensions,\n) {\n  if (!sources) return []\n  const normalized = sources.map((source) => {\n    const value = source.trim().toLowerCase()\n    if (!/^https:\\/\\/(?:\\*\\.)?[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?(?::\\d{1,5})?$/.test(value)) {\n      throw new Error(`${field} entries must be HTTPS origins without paths or CSP keywords.`)\n    }\n    return value\n  })\n  if (new Set(normalized).size !== normalized.length) {\n    throw new Error(`${field} entries must be unique.`)\n  }\n  return normalized\n}\n\nfunction assertHeaderValue(value: string, field: string) {\n  if (!value || value.length > 4_096 || /[\\u0000-\\u001F\\u007F]/.test(value)) {\n    throw new Error(`${field} must be a bounded single-line header value.`)\n  }\n}\n\nfunction validateExtraHeaders(headers: readonly BrandlabHeader[]) {\n  const names = new Set<string>()\n  headers.forEach((header, index) => {\n    if (!HEADER_NAME_PATTERN.test(header.key)) {\n      throw new Error(`extraHeaders[${index}].key is invalid.`)\n    }\n    const name = header.key.toLowerCase()\n    if (PROTECTED_HEADER_NAMES.has(name) || names.has(name)) {\n      throw new Error(`extraHeaders[${index}] duplicates a protected or existing header.`)\n    }\n    names.add(name)\n    assertHeaderValue(header.value, `extraHeaders[${index}].value`)\n  })\n}\n\nconst HEADER_OPTION_KEYS = new Set([\n  'deployment',\n  'hsts',\n  'contentSecurityPolicyExtensions',\n  'permissionsPolicy',\n  'extraHeaders',\n])\n\nexport function buildBrandlabSecurityHeaders(\n  options: BrandlabSecurityHeaderOptions,\n): BrandlabHeader[] {\n  if (!options || typeof options !== 'object') {\n    throw new TypeError('Header options are required.')\n  }\n  const unsupported = Object.keys(options).filter((key) => !HEADER_OPTION_KEYS.has(key))\n  if (unsupported.length > 0) {\n    throw new Error(\n      `Header options contain unsupported keys: ${unsupported.join(', ')}. The deployment decides CSP, HSTS and X-Robots-Tag.`,\n    )\n  }\n  assertDeployment(options.deployment)\n  const { environment, productionBuild } = options.deployment\n  const permissionsPolicy =\n    options.permissionsPolicy ?? BRANDLAB_DEFAULT_PERMISSIONS_POLICY\n  assertHeaderValue(permissionsPolicy, 'permissionsPolicy')\n  validateExtraHeaders(options.extraHeaders ?? [])\n  if (options.hsts) {\n    assertHeaderValue(options.hsts.readinessEvidence, 'hsts.readinessEvidence')\n    if (options.hsts.preload && !options.hsts.includeSubDomains) {\n      throw new Error('HSTS preload requires includeSubDomains readiness.')\n    }\n  }\n  const hstsValue = options.hsts\n    ? `${BRANDLAB_HSTS_VALUE}; includeSubDomains${options.hsts.preload ? '; preload' : ''}`\n    : BRANDLAB_HSTS_VALUE\n  const preview = environment === 'preview'\n\n  return [\n    { key: 'X-Frame-Options', value: 'DENY' },\n    { key: 'X-Content-Type-Options', value: 'nosniff' },\n    { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },\n    {\n      key: 'Permissions-Policy',\n      value: permissionsPolicy,\n    },\n    {\n      key: 'X-Robots-Tag',\n      value: preview ? BRANDLAB_PREVIEW_X_ROBOTS_TAG : BRANDLAB_DEFAULT_X_ROBOTS_TAG,\n    },\n    ...(productionBuild\n      ? [{ key: 'Strict-Transport-Security', value: hstsValue }]\n      : []),\n    {\n      key: productionBuild\n        ? 'Content-Security-Policy'\n        : 'Content-Security-Policy-Report-Only',\n      value: buildBrandlabContentSecurityPolicy(options),\n    },\n    ...(options.extraHeaders ?? []).map((header) => ({ ...header })),\n    ...(preview ? [{ key: 'Cache-Control', value: BRANDLAB_PREVIEW_CACHE_CONTROL }] : []),\n  ]\n}\n\nexport function buildBrandlabHeaderRules(options: BrandlabSecurityHeaderOptions): BrandlabHeaderRule[] {\n  return [\n    {\n      source: '/:path*',\n      headers: buildBrandlabSecurityHeaders(options),\n    },\n  ]\n}\n"]}

package/dist/instrumentation-client.d.ts

@@ -1,5 +1,6 @@
 import { type ContactAttributionSummary } from '@brandlab-digital/site-core/contact';
-export type PhoneCallLocation = 'header' | 'footer' | 'hero' | 'cta' | 'fab' | 'contact' | 'location' | 'page';
+import { type BrandlabAnalytics, type PhoneCallPlacement } from './analytics.js';
+export type PhoneCallLocation = PhoneCallPlacement;
 export interface LastPhoneCallEvent {
     key: string;
     at: number;
@@ -17,6 +18,13 @@ export declare function shouldTrackPhoneCallClick(options: {
 export declare function persistInitialLanding(win?: Window): void;
 export declare function getInitialLandingPath(win?: Window): string | undefined;
 export declare function getInitialContactAttribution(win?: Window): ContactAttributionSummary;
+/**
+ * Placement of a telephone link: its own `data-phone-location`, then a
+ * `<header>` or `<footer>` ancestor, then the nearest ancestor declaring a
+ * valid `data-phone-location` (for example a hero or call-to-action section),
+ * otherwise `page`. Unrecognised values are ignored, so every tap still
+ * produces exactly one event.
+ */
 export declare function getPhoneCallLocation(link: HTMLAnchorElement): PhoneCallLocation;
 export declare function installPhoneClickListener(options: {
     trackPhoneLinkClick: (context: {
@@ -27,4 +35,16 @@ export declare function installPhoneClickListener(options: {
     win?: Window;
     dedupeWindowMs?: number;
 }): () => void;
+/**
+ * The whole of `src/instrumentation-client.ts`:
+ * `installBrandlabInstrumentation(analytics)`. Stores the privacy-safe landing
+ * path and visit source for contact attribution, and installs the single
+ * telephone-link listener that sends one `phone_link_click` per tap (rapid
+ * repeats of the same link are de-duplicated). Installing twice in one window
+ * is a no-op; the returned function removes the listener.
+ */
+export declare function installBrandlabInstrumentation(analytics: Pick<BrandlabAnalytics, 'trackPhoneLinkClick'>, options?: {
+    win?: Window;
+    dedupeWindowMs?: number;
+}): () => void;
 //# sourceMappingURL=instrumentation-client.d.ts.map

package/dist/instrumentation-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instrumentation-client.d.ts","sourceRoot":"","sources":["../src/instrumentation-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,qCAAqC,CAAA;AAM5C,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,KAAK,GACL,KAAK,GACL,SAAS,GACT,UAAU,GACV,MAAM,CAAA;AAEV,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,EAAE,EAAE,MAAM,CAAA;CACX;AAED,eAAO,MAAM,8BAA8B,6BAA6B,CAAA;AACxE,eAAO,MAAM,mCAAmC,OAAO,CAAA;AAEvD,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,UAe9E;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAEtE;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,CAAC,EAAE,kBAAkB,CAAA;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,WAOA;AAED,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAe,QAgCzD;AAED,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAe,sBAOzD;AAED,wBAAgB,4BAA4B,CAAC,GAAG,GAAE,MAAe,GAAG,yBAAyB,CAkB5F;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,iBAAiB,CAU/E;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,mBAAmB,EAAE,CAAC,OAAO,EAAE;QAC7B,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,EAAE,iBAAiB,CAAA;QAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAC5B,KAAK,IAAI,CAAA;IACV,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,cA4CA"}
+{"version":3,"file":"instrumentation-client.d.ts","sourceRoot":"","sources":["../src/instrumentation-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACxB,MAAM,gBAAgB,CAAA;AAMvB,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,CAAA;AAElD,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,EAAE,EAAE,MAAM,CAAA;CACX;AAED,eAAO,MAAM,8BAA8B,6BAA6B,CAAA;AACxE,eAAO,MAAM,mCAAmC,OAAO,CAAA;AAEvD,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,UAe9E;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAEtE;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,CAAC,EAAE,kBAAkB,CAAA;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,WAOA;AAED,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAe,QAgCzD;AAED,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAe,sBAOzD;AAED,wBAAgB,4BAA4B,CAAC,GAAG,GAAE,MAAe,GAAG,yBAAyB,CAkB5F;AASD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,iBAAiB,CAc/E;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,mBAAmB,EAAE,CAAC,OAAO,EAAE;QAC7B,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,EAAE,iBAAiB,CAAA;QAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAC5B,KAAK,IAAI,CAAA;IACV,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,cA4CA;AAID;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,IAAI,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,EACzD,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAO,GACtD,MAAM,IAAI,CA2BZ"}

package/dist/instrumentation-client.js

@@ -1,4 +1,5 @@
 import { isContactVisitSource, } from '@brandlab-digital/site-core/contact';
+import { PHONE_CALL_PLACEMENTS, } from './analytics.js';
 import { classifyContactAttribution, normalizeContactAttributionSummary, } from './contact/attribution.js';
 export const INITIAL_LANDING_STORAGE_PREFIX = 'brandlab.initialLanding.';
 export const DEFAULT_PHONE_CALL_DEDUPE_WINDOW_MS = 1200;
@@ -85,18 +86,32 @@ export function getInitialContactAttribution(win = window) {
         return { initialLandingPath: fallbackPath, visitSource: 'direct-or-unknown' };
     }
 }
+function placementValue(value) {
+    const normalized = value?.trim().toLowerCase();
+    return PHONE_CALL_PLACEMENTS.includes(normalized)
+        ? normalized
+        : undefined;
+}
+/**
+ * Placement of a telephone link: its own `data-phone-location`, then a
+ * `<header>` or `<footer>` ancestor, then the nearest ancestor declaring a
+ * valid `data-phone-location` (for example a hero or call-to-action section),
+ * otherwise `page`. Unrecognised values are ignored, so every tap still
+ * produces exactly one event.
+ */
 export function getPhoneCallLocation(link) {
-    const explicitLocation = link.dataset.phoneLocation;
-    if (explicitLocation)
-        return explicitLocation;
+    const explicit = placementValue(link.getAttribute('data-phone-location'));
+    if (explicit)
+        return explicit;
     if (link.closest('header'))
         return 'header';
     if (link.closest('footer'))
         return 'footer';
-    if (link.closest('[data-phone-location="hero"]'))
-        return 'hero';
-    if (link.closest('[data-phone-location="cta"]'))
-        return 'cta';
+    for (let ancestor = link.parentElement?.closest('[data-phone-location]'); ancestor; ancestor = ancestor.parentElement?.closest('[data-phone-location]')) {
+        const placement = placementValue(ancestor.getAttribute('data-phone-location'));
+        if (placement)
+            return placement;
+    }
     return 'page';
 }
 export function installPhoneClickListener(options) {
@@ -137,4 +152,44 @@ export function installPhoneClickListener(options) {
         win.document.removeEventListener('click', handlePhoneClick, true);
     };
 }
+const installedInstrumentation = new WeakMap();
+/**
+ * The whole of `src/instrumentation-client.ts`:
+ * `installBrandlabInstrumentation(analytics)`. Stores the privacy-safe landing
+ * path and visit source for contact attribution, and installs the single
+ * telephone-link listener that sends one `phone_link_click` per tap (rapid
+ * repeats of the same link are de-duplicated). Installing twice in one window
+ * is a no-op; the returned function removes the listener.
+ */
+export function installBrandlabInstrumentation(analytics, options = {}) {
+    if (!analytics || typeof analytics.trackPhoneLinkClick !== 'function') {
+        throw new TypeError('installBrandlabInstrumentation requires the defineBrandlabAnalytics binding.');
+    }
+    const win = options.win ?? (typeof window === 'undefined' ? undefined : window);
+    if (!win)
+        return () => undefined;
+    const existing = installedInstrumentation.get(win);
+    if (existing)
+        return existing;
+    persistInitialLanding(win);
+    const removeListener = installPhoneClickListener({
+        win,
+        ...(options.dedupeWindowMs !== undefined ? { dedupeWindowMs: options.dedupeWindowMs } : {}),
+        trackPhoneLinkClick: ({ pagePath, location }) => {
+            try {
+                analytics.trackPhoneLinkClick({ pagePath, placement: location });
+            }
+            catch {
+                // Tracking must never block the telephone action.
+            }
+        },
+    });
+    const teardown = () => {
+        removeListener();
+        if (installedInstrumentation.get(win) === teardown)
+            installedInstrumentation.delete(win);
+    };
+    installedInstrumentation.set(win, teardown);
+    return teardown;
+}
 //# sourceMappingURL=instrumentation-client.js.map

package/dist/instrumentation-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"instrumentation-client.js","sourceRoot":"","sources":["../src/instrumentation-client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,GAErB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,0BAA0B,CAAA;AAiBjC,MAAM,CAAC,MAAM,8BAA8B,GAAG,0BAA0B,CAAA;AACxE,MAAM,CAAC,MAAM,mCAAmC,GAAG,IAAI,CAAA;AAEvD,MAAM,UAAU,2BAA2B,CAAC,QAAmC;IAC7E,MAAM,OAAO,GAAG,QAAQ,EAAE,IAAI,EAAE,IAAI,GAAG,CAAA;IACvC,IACE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACxB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtB,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAC3B,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC;QACrC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EACrB,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAClD,OAAO,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,IAAY;IACrE,OAAO,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAA;AAC9B,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAKzC;IACC,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,IAAI,mCAAmC,CAAA;IAC9E,OAAO,CAAC,CACN,OAAO,CAAC,SAAS;QACjB,OAAO,CAAC,SAAS,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;QACrC,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,CAC9C,CAAA;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAc,MAAM;IACxD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,8BAA8B,MAAM,CAAA;QACvD,MAAM,SAAS,GAAG,GAAG,8BAA8B,QAAQ,CAAA;QAC3D,MAAM,SAAS,GAAG,GAAG,8BAA8B,cAAc,CAAA;QACjE,MAAM,YAAY,GAAG,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACxD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,YAAY,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACnF,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;YAC9B,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC/C,CAAC;QACD,MAAM,cAAc,GAAG,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC5D,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,EAAE,CAAC;YAC1C,MAAM,WAAW,GAAG,0BAA0B,CAAC;gBAC7C,kBAAkB,EAAE,QAAQ;gBAC5B,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;gBAC3B,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ;gBAC/B,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;aAChC,CAAC,CAAA;YACF,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,CAAA;YAC9D,IAAI,WAAW,CAAC,iBAAiB,EAAE,CAAC;gBAClC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,iBAAiB,CAAC,CAAA;YACtE,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;QACD,0EAA0E;QAC1E,2DAA2D;QAC3D,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,8BAA8B,KAAK,CAAC,CAAA;QACrE,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,8BAA8B,UAAU,CAAC,CAAA;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAc,MAAM;IACxD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,8BAA8B,MAAM,CAAC,CAAA;QACjF,OAAO,KAAK,CAAC,CAAC,CAAC,2BAA2B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAAc,MAAM;IAC/D,MAAM,YAAY,GAAG,2BAA2B,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACvE,IAAI,CAAC;QACH,MAAM,kBAAkB,GAAG,2BAA2B,CACpD,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,8BAA8B,MAAM,CAAC,IAAI,YAAY,CACpF,CAAA;QACD,MAAM,WAAW,GAAG,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,8BAA8B,QAAQ,CAAC,CAAA;QACzF,MAAM,iBAAiB,GAAG,GAAG,CAAC,cAAc,CAAC,OAAO,CAClD,GAAG,8BAA8B,cAAc,CAChD,CAAA;QACD,OAAO,kCAAkC,CAAC;YACxC,kBAAkB;YAClB,WAAW,EAAE,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,mBAAmB;YAClF,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAA;IAC/E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAuB;IAC1D,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,aAA8C,CAAA;IAEpF,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAA;IAC7C,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC3C,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC3C,IAAI,IAAI,CAAC,OAAO,CAAC,8BAA8B,CAAC;QAAE,OAAO,MAAM,CAAA;IAC/D,IAAI,IAAI,CAAC,OAAO,CAAC,6BAA6B,CAAC;QAAE,OAAO,KAAK,CAAA;IAE7D,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAQzC;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,MAAM,CAAA;IACjC,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAA;IACvD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IACD,IAAI,SAAyC,CAAA;IAE7C,MAAM,gBAAgB,GAAG,CAAC,KAAiB,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;QAC3B,IAAI,CAAC,CAAC,MAAM,YAAY,OAAO,CAAC;YAAE,OAAM;QAExC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAoB,iBAAiB,CAAC,CAAA;QACjE,IAAI,CAAC,IAAI;YAAE,OAAM;QAEjB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,GAAG,CAAA;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAA;QACnD,MAAM,GAAG,GAAG,wBAAwB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAEtB,IACE,CAAC,yBAAyB,CAAC;YACzB,GAAG;YACH,GAAG;YACH,SAAS;YACT,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC,EACF,CAAC;YACD,OAAM;QACR,CAAC;QAED,SAAS,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAAA;QAC5B,mBAAmB,CAAC;YAClB,QAAQ;YACR,QAAQ,EAAE,oBAAoB,CAAC,IAAI,CAAC;YACpC,kBAAkB,EAAE,qBAAqB,CAAC,GAAG,CAAC;SAC/C,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAA;IAE9D,OAAO,GAAG,EAAE;QACV,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAA;IACnE,CAAC,CAAA;AACH,CAAC","sourcesContent":["import {\n  isContactVisitSource,\n  type ContactAttributionSummary,\n} from '@brandlab-digital/site-core/contact'\nimport {\n  classifyContactAttribution,\n  normalizeContactAttributionSummary,\n} from './contact/attribution.js'\n\nexport type PhoneCallLocation =\n  | 'header'\n  | 'footer'\n  | 'hero'\n  | 'cta'\n  | 'fab'\n  | 'contact'\n  | 'location'\n  | 'page'\n\nexport interface LastPhoneCallEvent {\n  key: string\n  at: number\n}\n\nexport const INITIAL_LANDING_STORAGE_PREFIX = 'brandlab.initialLanding.'\nexport const DEFAULT_PHONE_CALL_DEDUPE_WINDOW_MS = 1200\n\nexport function normalizeInitialLandingPath(pathname: string | null | undefined) {\n  const trimmed = pathname?.trim() || '/'\n  if (\n    !trimmed.startsWith('/') ||\n    trimmed.startsWith('//') ||\n    trimmed.includes('\\\\') ||\n    /%(?:2f|5c)/i.test(trimmed) ||\n    /[\\u0000-\\u001f\\u007f]/.test(trimmed) ||\n    trimmed.includes('?') ||\n    trimmed.includes('#')\n  ) {\n    return '/'\n  }\n  const normalized = trimmed.replace(/\\/{2,}/g, '/')\n  return normalized === '/' ? '/' : normalized.replace(/\\/+$/, '')\n}\n\nexport function createPhoneCallDedupeKey(pagePath: string, href: string) {\n  return `${pagePath}|${href}`\n}\n\nexport function shouldTrackPhoneCallClick(options: {\n  key: string\n  now: number\n  lastEvent?: LastPhoneCallEvent\n  dedupeWindowMs?: number\n}) {\n  const windowMs = options.dedupeWindowMs ?? DEFAULT_PHONE_CALL_DEDUPE_WINDOW_MS\n  return !(\n    options.lastEvent &&\n    options.lastEvent.key === options.key &&\n    options.now - options.lastEvent.at < windowMs\n  )\n}\n\nexport function persistInitialLanding(win: Window = window) {\n  try {\n    const pathKey = `${INITIAL_LANDING_STORAGE_PREFIX}path`\n    const sourceKey = `${INITIAL_LANDING_STORAGE_PREFIX}source`\n    const detailKey = `${INITIAL_LANDING_STORAGE_PREFIX}sourceDetail`\n    const existingPath = win.sessionStorage.getItem(pathKey)\n    const safePath = normalizeInitialLandingPath(existingPath ?? win.location.pathname)\n    if (existingPath !== safePath) {\n      win.sessionStorage.setItem(pathKey, safePath)\n    }\n    const existingSource = win.sessionStorage.getItem(sourceKey)\n    if (!isContactVisitSource(existingSource)) {\n      const attribution = classifyContactAttribution({\n        initialLandingPath: safePath,\n        search: win.location.search,\n        referrer: win.document.referrer,\n        siteOrigin: win.location.origin,\n      })\n      win.sessionStorage.setItem(sourceKey, attribution.visitSource)\n      if (attribution.visitSourceDetail) {\n        win.sessionStorage.setItem(detailKey, attribution.visitSourceDetail)\n      } else {\n        win.sessionStorage.removeItem(detailKey)\n      }\n    }\n    // Remove values written by the pre-RC privacy contract. Query strings and\n    // referrers are not needed for canonical lead measurement.\n    win.sessionStorage.removeItem(`${INITIAL_LANDING_STORAGE_PREFIX}url`)\n    win.sessionStorage.removeItem(`${INITIAL_LANDING_STORAGE_PREFIX}referrer`)\n  } catch {\n    // Storage failures must not affect navigation or lead tracking.\n  }\n}\n\nexport function getInitialLandingPath(win: Window = window) {\n  try {\n    const value = win.sessionStorage.getItem(`${INITIAL_LANDING_STORAGE_PREFIX}path`)\n    return value ? normalizeInitialLandingPath(value) : undefined\n  } catch {\n    return undefined\n  }\n}\n\nexport function getInitialContactAttribution(win: Window = window): ContactAttributionSummary {\n  const fallbackPath = normalizeInitialLandingPath(win.location.pathname)\n  try {\n    const initialLandingPath = normalizeInitialLandingPath(\n      win.sessionStorage.getItem(`${INITIAL_LANDING_STORAGE_PREFIX}path`) ?? fallbackPath,\n    )\n    const visitSource = win.sessionStorage.getItem(`${INITIAL_LANDING_STORAGE_PREFIX}source`)\n    const visitSourceDetail = win.sessionStorage.getItem(\n      `${INITIAL_LANDING_STORAGE_PREFIX}sourceDetail`,\n    )\n    return normalizeContactAttributionSummary({\n      initialLandingPath,\n      visitSource: isContactVisitSource(visitSource) ? visitSource : 'direct-or-unknown',\n      ...(visitSourceDetail ? { visitSourceDetail } : {}),\n    })\n  } catch {\n    return { initialLandingPath: fallbackPath, visitSource: 'direct-or-unknown' }\n  }\n}\n\nexport function getPhoneCallLocation(link: HTMLAnchorElement): PhoneCallLocation {\n  const explicitLocation = link.dataset.phoneLocation as PhoneCallLocation | undefined\n\n  if (explicitLocation) return explicitLocation\n  if (link.closest('header')) return 'header'\n  if (link.closest('footer')) return 'footer'\n  if (link.closest('[data-phone-location=\"hero\"]')) return 'hero'\n  if (link.closest('[data-phone-location=\"cta\"]')) return 'cta'\n\n  return 'page'\n}\n\nexport function installPhoneClickListener(options: {\n  trackPhoneLinkClick: (context: {\n    pagePath: string\n    location: PhoneCallLocation\n    initialLandingPath?: string\n  }) => void\n  win?: Window\n  dedupeWindowMs?: number\n}) {\n  const win = options.win ?? window\n  const trackPhoneLinkClick = options.trackPhoneLinkClick\n  if (!trackPhoneLinkClick) {\n    throw new Error('installPhoneClickListener requires trackPhoneLinkClick.')\n  }\n  let lastEvent: LastPhoneCallEvent | undefined\n\n  const handlePhoneClick = (event: MouseEvent) => {\n    const target = event.target\n    if (!(target instanceof Element)) return\n\n    const link = target.closest<HTMLAnchorElement>('a[href^=\"tel:\"]')\n    if (!link) return\n\n    const pagePath = win.location.pathname || '/'\n    const href = link.getAttribute('href') || link.href\n    const key = createPhoneCallDedupeKey(pagePath, href)\n    const now = Date.now()\n\n    if (\n      !shouldTrackPhoneCallClick({\n        key,\n        now,\n        lastEvent,\n        dedupeWindowMs: options.dedupeWindowMs,\n      })\n    ) {\n      return\n    }\n\n    lastEvent = { key, at: now }\n    trackPhoneLinkClick({\n      pagePath,\n      location: getPhoneCallLocation(link),\n      initialLandingPath: getInitialLandingPath(win),\n    })\n  }\n\n  win.document.addEventListener('click', handlePhoneClick, true)\n\n  return () => {\n    win.document.removeEventListener('click', handlePhoneClick, true)\n  }\n}\n"]}
+{"version":3,"file":"instrumentation-client.js","sourceRoot":"","sources":["../src/instrumentation-client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,GAErB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,qBAAqB,GAGtB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,0BAA0B,CAAA;AASjC,MAAM,CAAC,MAAM,8BAA8B,GAAG,0BAA0B,CAAA;AACxE,MAAM,CAAC,MAAM,mCAAmC,GAAG,IAAI,CAAA;AAEvD,MAAM,UAAU,2BAA2B,CAAC,QAAmC;IAC7E,MAAM,OAAO,GAAG,QAAQ,EAAE,IAAI,EAAE,IAAI,GAAG,CAAA;IACvC,IACE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACxB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtB,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAC3B,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC;QACrC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EACrB,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAClD,OAAO,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,IAAY;IACrE,OAAO,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAA;AAC9B,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAKzC;IACC,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,IAAI,mCAAmC,CAAA;IAC9E,OAAO,CAAC,CACN,OAAO,CAAC,SAAS;QACjB,OAAO,CAAC,SAAS,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;QACrC,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,CAC9C,CAAA;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAc,MAAM;IACxD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,8BAA8B,MAAM,CAAA;QACvD,MAAM,SAAS,GAAG,GAAG,8BAA8B,QAAQ,CAAA;QAC3D,MAAM,SAAS,GAAG,GAAG,8BAA8B,cAAc,CAAA;QACjE,MAAM,YAAY,GAAG,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACxD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,YAAY,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACnF,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;YAC9B,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC/C,CAAC;QACD,MAAM,cAAc,GAAG,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC5D,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,EAAE,CAAC;YAC1C,MAAM,WAAW,GAAG,0BAA0B,CAAC;gBAC7C,kBAAkB,EAAE,QAAQ;gBAC5B,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;gBAC3B,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ;gBAC/B,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;aAChC,CAAC,CAAA;YACF,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,CAAA;YAC9D,IAAI,WAAW,CAAC,iBAAiB,EAAE,CAAC;gBAClC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,iBAAiB,CAAC,CAAA;YACtE,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;QACD,0EAA0E;QAC1E,2DAA2D;QAC3D,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,8BAA8B,KAAK,CAAC,CAAA;QACrE,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,8BAA8B,UAAU,CAAC,CAAA;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAc,MAAM;IACxD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,8BAA8B,MAAM,CAAC,CAAA;QACjF,OAAO,KAAK,CAAC,CAAC,CAAC,2BAA2B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAAc,MAAM;IAC/D,MAAM,YAAY,GAAG,2BAA2B,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACvE,IAAI,CAAC;QACH,MAAM,kBAAkB,GAAG,2BAA2B,CACpD,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,8BAA8B,MAAM,CAAC,IAAI,YAAY,CACpF,CAAA;QACD,MAAM,WAAW,GAAG,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,8BAA8B,QAAQ,CAAC,CAAA;QACzF,MAAM,iBAAiB,GAAG,GAAG,CAAC,cAAc,CAAC,OAAO,CAClD,GAAG,8BAA8B,cAAc,CAChD,CAAA;QACD,OAAO,kCAAkC,CAAC;YACxC,kBAAkB;YAClB,WAAW,EAAE,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,mBAAmB;YAClF,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAA;IAC/E,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAgC;IACtD,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC9C,OAAO,qBAAqB,CAAC,QAAQ,CAAC,UAA+B,CAAC;QACpE,CAAC,CAAC,UAA+B;QACjC,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAuB;IAC1D,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAA;IACzE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC3C,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC3C,KACE,IAAI,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,uBAAuB,CAAC,EACnE,QAAQ,EACR,QAAQ,GAAG,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,uBAAuB,CAAC,EACnE,CAAC;QACD,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAA;QAC9E,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;IACjC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAQzC;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,MAAM,CAAA;IACjC,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAA;IACvD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IACD,IAAI,SAAyC,CAAA;IAE7C,MAAM,gBAAgB,GAAG,CAAC,KAAiB,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;QAC3B,IAAI,CAAC,CAAC,MAAM,YAAY,OAAO,CAAC;YAAE,OAAM;QAExC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAoB,iBAAiB,CAAC,CAAA;QACjE,IAAI,CAAC,IAAI;YAAE,OAAM;QAEjB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,GAAG,CAAA;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAA;QACnD,MAAM,GAAG,GAAG,wBAAwB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAEtB,IACE,CAAC,yBAAyB,CAAC;YACzB,GAAG;YACH,GAAG;YACH,SAAS;YACT,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC,EACF,CAAC;YACD,OAAM;QACR,CAAC;QAED,SAAS,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAAA;QAC5B,mBAAmB,CAAC;YAClB,QAAQ;YACR,QAAQ,EAAE,oBAAoB,CAAC,IAAI,CAAC;YACpC,kBAAkB,EAAE,qBAAqB,CAAC,GAAG,CAAC;SAC/C,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAA;IAE9D,OAAO,GAAG,EAAE;QACV,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAA;IACnE,CAAC,CAAA;AACH,CAAC;AAED,MAAM,wBAAwB,GAAG,IAAI,OAAO,EAAsB,CAAA;AAElE;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAAyD,EACzD,UAAqD,EAAE;IAEvD,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,CAAC,mBAAmB,KAAK,UAAU,EAAE,CAAC;QACtE,MAAM,IAAI,SAAS,CAAC,8EAA8E,CAAC,CAAA;IACrG,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAC/E,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAA;IAChC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAClD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAE7B,qBAAqB,CAAC,GAAG,CAAC,CAAA;IAC1B,MAAM,cAAc,GAAG,yBAAyB,CAAC;QAC/C,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,mBAAmB,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC9C,IAAI,CAAC;gBACH,SAAS,CAAC,mBAAmB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAA;YAClE,CAAC;YAAC,MAAM,CAAC;gBACP,kDAAkD;YACpD,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,cAAc,EAAE,CAAA;QAChB,IAAI,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,wBAAwB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1F,CAAC,CAAA;IACD,wBAAwB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IAC3C,OAAO,QAAQ,CAAA;AACjB,CAAC","sourcesContent":["import {\n  isContactVisitSource,\n  type ContactAttributionSummary,\n} from '@brandlab-digital/site-core/contact'\nimport {\n  PHONE_CALL_PLACEMENTS,\n  type BrandlabAnalytics,\n  type PhoneCallPlacement,\n} from './analytics.js'\nimport {\n  classifyContactAttribution,\n  normalizeContactAttributionSummary,\n} from './contact/attribution.js'\n\nexport type PhoneCallLocation = PhoneCallPlacement\n\nexport interface LastPhoneCallEvent {\n  key: string\n  at: number\n}\n\nexport const INITIAL_LANDING_STORAGE_PREFIX = 'brandlab.initialLanding.'\nexport const DEFAULT_PHONE_CALL_DEDUPE_WINDOW_MS = 1200\n\nexport function normalizeInitialLandingPath(pathname: string | null | undefined) {\n  const trimmed = pathname?.trim() || '/'\n  if (\n    !trimmed.startsWith('/') ||\n    trimmed.startsWith('//') ||\n    trimmed.includes('\\\\') ||\n    /%(?:2f|5c)/i.test(trimmed) ||\n    /[\\u0000-\\u001f\\u007f]/.test(trimmed) ||\n    trimmed.includes('?') ||\n    trimmed.includes('#')\n  ) {\n    return '/'\n  }\n  const normalized = trimmed.replace(/\\/{2,}/g, '/')\n  return normalized === '/' ? '/' : normalized.replace(/\\/+$/, '')\n}\n\nexport function createPhoneCallDedupeKey(pagePath: string, href: string) {\n  return `${pagePath}|${href}`\n}\n\nexport function shouldTrackPhoneCallClick(options: {\n  key: string\n  now: number\n  lastEvent?: LastPhoneCallEvent\n  dedupeWindowMs?: number\n}) {\n  const windowMs = options.dedupeWindowMs ?? DEFAULT_PHONE_CALL_DEDUPE_WINDOW_MS\n  return !(\n    options.lastEvent &&\n    options.lastEvent.key === options.key &&\n    options.now - options.lastEvent.at < windowMs\n  )\n}\n\nexport function persistInitialLanding(win: Window = window) {\n  try {\n    const pathKey = `${INITIAL_LANDING_STORAGE_PREFIX}path`\n    const sourceKey = `${INITIAL_LANDING_STORAGE_PREFIX}source`\n    const detailKey = `${INITIAL_LANDING_STORAGE_PREFIX}sourceDetail`\n    const existingPath = win.sessionStorage.getItem(pathKey)\n    const safePath = normalizeInitialLandingPath(existingPath ?? win.location.pathname)\n    if (existingPath !== safePath) {\n      win.sessionStorage.setItem(pathKey, safePath)\n    }\n    const existingSource = win.sessionStorage.getItem(sourceKey)\n    if (!isContactVisitSource(existingSource)) {\n      const attribution = classifyContactAttribution({\n        initialLandingPath: safePath,\n        search: win.location.search,\n        referrer: win.document.referrer,\n        siteOrigin: win.location.origin,\n      })\n      win.sessionStorage.setItem(sourceKey, attribution.visitSource)\n      if (attribution.visitSourceDetail) {\n        win.sessionStorage.setItem(detailKey, attribution.visitSourceDetail)\n      } else {\n        win.sessionStorage.removeItem(detailKey)\n      }\n    }\n    // Remove values written by the pre-RC privacy contract. Query strings and\n    // referrers are not needed for canonical lead measurement.\n    win.sessionStorage.removeItem(`${INITIAL_LANDING_STORAGE_PREFIX}url`)\n    win.sessionStorage.removeItem(`${INITIAL_LANDING_STORAGE_PREFIX}referrer`)\n  } catch {\n    // Storage failures must not affect navigation or lead tracking.\n  }\n}\n\nexport function getInitialLandingPath(win: Window = window) {\n  try {\n    const value = win.sessionStorage.getItem(`${INITIAL_LANDING_STORAGE_PREFIX}path`)\n    return value ? normalizeInitialLandingPath(value) : undefined\n  } catch {\n    return undefined\n  }\n}\n\nexport function getInitialContactAttribution(win: Window = window): ContactAttributionSummary {\n  const fallbackPath = normalizeInitialLandingPath(win.location.pathname)\n  try {\n    const initialLandingPath = normalizeInitialLandingPath(\n      win.sessionStorage.getItem(`${INITIAL_LANDING_STORAGE_PREFIX}path`) ?? fallbackPath,\n    )\n    const visitSource = win.sessionStorage.getItem(`${INITIAL_LANDING_STORAGE_PREFIX}source`)\n    const visitSourceDetail = win.sessionStorage.getItem(\n      `${INITIAL_LANDING_STORAGE_PREFIX}sourceDetail`,\n    )\n    return normalizeContactAttributionSummary({\n      initialLandingPath,\n      visitSource: isContactVisitSource(visitSource) ? visitSource : 'direct-or-unknown',\n      ...(visitSourceDetail ? { visitSourceDetail } : {}),\n    })\n  } catch {\n    return { initialLandingPath: fallbackPath, visitSource: 'direct-or-unknown' }\n  }\n}\n\nfunction placementValue(value: string | null | undefined): PhoneCallLocation | undefined {\n  const normalized = value?.trim().toLowerCase()\n  return PHONE_CALL_PLACEMENTS.includes(normalized as PhoneCallLocation)\n    ? normalized as PhoneCallLocation\n    : undefined\n}\n\n/**\n * Placement of a telephone link: its own `data-phone-location`, then a\n * `<header>` or `<footer>` ancestor, then the nearest ancestor declaring a\n * valid `data-phone-location` (for example a hero or call-to-action section),\n * otherwise `page`. Unrecognised values are ignored, so every tap still\n * produces exactly one event.\n */\nexport function getPhoneCallLocation(link: HTMLAnchorElement): PhoneCallLocation {\n  const explicit = placementValue(link.getAttribute('data-phone-location'))\n  if (explicit) return explicit\n  if (link.closest('header')) return 'header'\n  if (link.closest('footer')) return 'footer'\n  for (\n    let ancestor = link.parentElement?.closest('[data-phone-location]');\n    ancestor;\n    ancestor = ancestor.parentElement?.closest('[data-phone-location]')\n  ) {\n    const placement = placementValue(ancestor.getAttribute('data-phone-location'))\n    if (placement) return placement\n  }\n  return 'page'\n}\n\nexport function installPhoneClickListener(options: {\n  trackPhoneLinkClick: (context: {\n    pagePath: string\n    location: PhoneCallLocation\n    initialLandingPath?: string\n  }) => void\n  win?: Window\n  dedupeWindowMs?: number\n}) {\n  const win = options.win ?? window\n  const trackPhoneLinkClick = options.trackPhoneLinkClick\n  if (!trackPhoneLinkClick) {\n    throw new Error('installPhoneClickListener requires trackPhoneLinkClick.')\n  }\n  let lastEvent: LastPhoneCallEvent | undefined\n\n  const handlePhoneClick = (event: MouseEvent) => {\n    const target = event.target\n    if (!(target instanceof Element)) return\n\n    const link = target.closest<HTMLAnchorElement>('a[href^=\"tel:\"]')\n    if (!link) return\n\n    const pagePath = win.location.pathname || '/'\n    const href = link.getAttribute('href') || link.href\n    const key = createPhoneCallDedupeKey(pagePath, href)\n    const now = Date.now()\n\n    if (\n      !shouldTrackPhoneCallClick({\n        key,\n        now,\n        lastEvent,\n        dedupeWindowMs: options.dedupeWindowMs,\n      })\n    ) {\n      return\n    }\n\n    lastEvent = { key, at: now }\n    trackPhoneLinkClick({\n      pagePath,\n      location: getPhoneCallLocation(link),\n      initialLandingPath: getInitialLandingPath(win),\n    })\n  }\n\n  win.document.addEventListener('click', handlePhoneClick, true)\n\n  return () => {\n    win.document.removeEventListener('click', handlePhoneClick, true)\n  }\n}\n\nconst installedInstrumentation = new WeakMap<Window, () => void>()\n\n/**\n * The whole of `src/instrumentation-client.ts`:\n * `installBrandlabInstrumentation(analytics)`. Stores the privacy-safe landing\n * path and visit source for contact attribution, and installs the single\n * telephone-link listener that sends one `phone_link_click` per tap (rapid\n * repeats of the same link are de-duplicated). Installing twice in one window\n * is a no-op; the returned function removes the listener.\n */\nexport function installBrandlabInstrumentation(\n  analytics: Pick<BrandlabAnalytics, 'trackPhoneLinkClick'>,\n  options: { win?: Window; dedupeWindowMs?: number } = {},\n): () => void {\n  if (!analytics || typeof analytics.trackPhoneLinkClick !== 'function') {\n    throw new TypeError('installBrandlabInstrumentation requires the defineBrandlabAnalytics binding.')\n  }\n  const win = options.win ?? (typeof window === 'undefined' ? undefined : window)\n  if (!win) return () => undefined\n  const existing = installedInstrumentation.get(win)\n  if (existing) return existing\n\n  persistInitialLanding(win)\n  const removeListener = installPhoneClickListener({\n    win,\n    ...(options.dedupeWindowMs !== undefined ? { dedupeWindowMs: options.dedupeWindowMs } : {}),\n    trackPhoneLinkClick: ({ pagePath, location }) => {\n      try {\n        analytics.trackPhoneLinkClick({ pagePath, placement: location })\n      } catch {\n        // Tracking must never block the telephone action.\n      }\n    },\n  })\n  const teardown = () => {\n    removeListener()\n    if (installedInstrumentation.get(win) === teardown) installedInstrumentation.delete(win)\n  }\n  installedInstrumentation.set(win, teardown)\n  return teardown\n}\n"]}

package/dist/lead-registry.d.ts

@@ -0,0 +1,34 @@
+import type { GtagTransport } from '@brandlab-digital/site-core/analytics';
+export interface LeadTrackingConfig {
+    enabled: boolean;
+    enhancedConversionsEnabled?: boolean;
+    measurementId?: string | null;
+    googleAdsConversionId?: string | null;
+    googleAdsConversionLabel?: string | null;
+    gtag?: GtagTransport;
+}
+export interface LeadPageParams {
+    page_template?: string;
+    service_slug?: string;
+    location_slug?: string;
+}
+export interface LeadAdsParams {
+    currency?: string;
+    value?: number;
+}
+export interface LeadContext {
+    readonly pagePath: string;
+    readonly pageParams: LeadPageParams;
+    readonly formData: FormData;
+}
+export interface LeadBinding {
+    readonly config: LeadTrackingConfig;
+    pageParams(pagePath: string): LeadPageParams;
+    adsParams(lead: LeadContext): LeadAdsParams;
+}
+export declare function getBrowserGtag(win?: Window | undefined): GtagTransport | undefined;
+export declare function safePagePath(value: string): string;
+export declare function safeSlug(value: string | undefined): string | undefined;
+export declare function registerLeadBinding(binding: object, lead: LeadBinding): void;
+export declare function leadBindingFor(binding: unknown): LeadBinding | undefined;
+//# sourceMappingURL=lead-registry.d.ts.map

package/dist/lead-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lead-registry.d.ts","sourceRoot":"","sources":["../src/lead-registry.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAA;AAG1E,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,0BAA0B,CAAC,EAAE,OAAO,CAAA;IACpC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,wBAAwB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxC,IAAI,CAAC,EAAE,aAAa,CAAA;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;IACnC,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,CAAA;IAC5C,SAAS,CAAC,IAAI,EAAE,WAAW,GAAG,aAAa,CAAA;CAC5C;AAED,wBAAgB,cAAc,CAC5B,GAAG,GAAE,MAAM,GAAG,SAA8D,GAC3E,aAAa,GAAG,SAAS,CAG3B;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,UAQzC;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,sBAKjD;AAID,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,QAErE;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAExE"}

package/dist/lead-registry.js

@@ -0,0 +1,30 @@
+import { normalizeBrandlabRoutePath } from '@brandlab-digital/site-core/routes';
+export function getBrowserGtag(win = typeof window === 'undefined' ? undefined : window) {
+    const candidate = win?.gtag;
+    return typeof candidate === 'function' ? candidate : undefined;
+}
+export function safePagePath(value) {
+    const path = value.trim().split(/[?#]/, 1)[0];
+    if (!path || path.length > 500)
+        return '/';
+    try {
+        return normalizeBrandlabRoutePath(path);
+    }
+    catch {
+        return '/';
+    }
+}
+export function safeSlug(value) {
+    const normalized = value?.trim().toLowerCase();
+    return normalized && /^[a-z0-9]+(?:[-_][a-z0-9]+)*$/.test(normalized) && normalized.length <= 80
+        ? normalized
+        : undefined;
+}
+const bindings = new WeakMap();
+export function registerLeadBinding(binding, lead) {
+    bindings.set(binding, Object.freeze(lead));
+}
+export function leadBindingFor(binding) {
+    return binding && typeof binding === 'object' ? bindings.get(binding) : undefined;
+}
+//# sourceMappingURL=lead-registry.js.map