@brandlab-digital/site-next 2.1.0 → 3.0.0

package/dist/google-tag-plan.d.ts

@@ -1,4 +1,4 @@
-import { type BrandlabAnalyticsContract } from '@brandlab-digital/site-core/analytics';
+/** Supplied by `defineBrandlabAnalytics(...).googleTag`. */
 export interface BrandlabGoogleTagConfig {
     enabled: boolean;
     measurementId?: string | null;
@@ -12,8 +12,5 @@ export interface BrandlabGoogleTagPlan {
     destinations: readonly string[];
     websiteCallDestination: string | null;
 }
-export declare function resolveBrandlabGoogleTagConfig(contract: BrandlabAnalyticsContract, environment: Readonly<Record<string, string | undefined>>, options: {
-    enabled: boolean;
-}): BrandlabGoogleTagConfig;
 export declare function createBrandlabGoogleTagPlan(config: BrandlabGoogleTagConfig, phoneNumber?: string | null): BrandlabGoogleTagPlan | null;
 //# sourceMappingURL=google-tag-plan.d.ts.map

package/dist/google-tag-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google-tag-plan.d.ts","sourceRoot":"","sources":["../src/google-tag-plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uCAAuC,CAAA;AAE9C,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,mCAAmC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACpD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAA;CACtC;AAKD,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,yBAAyB,EACnC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EACzD,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAC5B,uBAAuB,CAYzB;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,uBAAuB,EAC/B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAC1B,qBAAqB,GAAG,IAAI,CA2C9B"}
+{"version":3,"file":"google-tag-plan.d.ts","sourceRoot":"","sources":["../src/google-tag-plan.ts"],"names":[],"mappings":"AAEA,4DAA4D;AAC5D,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,mCAAmC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACpD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAA;CACtC;AAKD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,uBAAuB,EAC/B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAC1B,qBAAqB,GAAG,IAAI,CA2C9B"}

package/dist/google-tag-plan.js

@@ -1,19 +1,6 @@
-import { defineAnalyticsContract, getGoogleAdsWebsiteCallSendTo, } from '@brandlab-digital/site-core/analytics';
+import { getGoogleAdsWebsiteCallSendTo } from '@brandlab-digital/site-core/analytics';
 const GA4_MEASUREMENT_ID_PATTERN = /^G-[A-Z0-9]{4,20}$/i;
 const GOOGLE_ADS_CONVERSION_ID_PATTERN = /^(?:AW-)?\d{6,20}$/;
-export function resolveBrandlabGoogleTagConfig(contract, environment, options) {
-    defineAnalyticsContract(contract);
-    return {
-        enabled: options.enabled,
-        measurementId: environment[contract.measurementIdEnv],
-        googleAdsConversionId: contract.googleAds
-            ? environment[contract.googleAds.conversionIdEnv]
-            : undefined,
-        googleAdsWebsiteCallConversionLabel: contract.googleAds?.websiteCalls
-            ? environment[contract.googleAds.websiteCalls.conversionLabelEnv]
-            : undefined,
-    };
-}
 export function createBrandlabGoogleTagPlan(config, phoneNumber) {
     if (!config.enabled)
         return null;

package/dist/google-tag-plan.js.map

@@ -1 +1 @@
-{"version":3,"file":"google-tag-plan.js","sourceRoot":"","sources":["../src/google-tag-plan.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,6BAA6B,GAE9B,MAAM,uCAAuC,CAAA;AAiB9C,MAAM,0BAA0B,GAAG,qBAAqB,CAAA;AACxD,MAAM,gCAAgC,GAAG,oBAAoB,CAAA;AAE7D,MAAM,UAAU,8BAA8B,CAC5C,QAAmC,EACnC,WAAyD,EACzD,OAA6B;IAE7B,uBAAuB,CAAC,QAAQ,CAAC,CAAA;IACjC,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,aAAa,EAAE,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACrD,qBAAqB,EAAE,QAAQ,CAAC,SAAS;YACvC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC;YACjD,CAAC,CAAC,SAAS;QACb,mCAAmC,EAAE,QAAQ,CAAC,SAAS,EAAE,YAAY;YACnE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,kBAAkB,CAAC;YACjE,CAAC,CAAC,SAAS;KACd,CAAA;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,MAA+B,EAC/B,WAA2B;IAE3B,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAChC,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;IAC9D,MAAM,qBAAqB,GAAG,0BAA0B,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAA;IACtF,MAAM,QAAQ,GAAG,aAAa,IAAI,qBAAqB,CAAA;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAE1B,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;YAC/B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC,CAAC,CAAA;IACH,MAAM,YAAY,GAAG,0BAA0B,CAAC,WAAW,CAAC,CAAA;IAC5D,MAAM,sBAAsB,GAAG,YAAY;QACzC,CAAC,CAAC,6BAA6B,CAAC;YAC5B,YAAY,EAAE,qBAAqB;YACnC,eAAe,EAAE,MAAM,CAAC,mCAAmC;SAC5D,CAAC,IAAI,IAAI;QACZ,CAAC,CAAC,IAAI,CAAA;IACR,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CACrC,CAAC,WAAW,EAAE,EAAE,CAAC,yBAAyB,QAAQ,CAAC,WAAW,CAAC,IAAI,CACpE,CAAA;IACD,IAAI,sBAAsB,IAAI,YAAY,EAAE,CAAC;QAC3C,cAAc,CAAC,IAAI,CACjB,yBAAyB,QAAQ,CAAC,sBAAsB,CAAC,KAAK,QAAQ,CAAC;YACrE,uBAAuB,EAAE,YAAY;SACtC,CAAC,IAAI,CACP,CAAA;IACH,CAAC;IAED,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,+CAA+C,kBAAkB,CAAC,QAAQ,CAAC,EAAE;QACrF,YAAY,EAAE;YACZ,4CAA4C;YAC5C,6EAA6E;YAC7E,yFAAyF;YACzF,sCAAsC;YACtC,gCAAgC;YAChC,GAAG,cAAc;SAClB,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,YAAY;QACZ,sBAAsB;KACvB,CAAA;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAgC;IAC1D,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAA;IAChC,OAAO,UAAU,IAAI,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;QAC9D,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;QAC1B,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAgC;IAClE,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAA;IAChC,IAAI,CAAC,UAAU,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAA;IACvF,OAAO,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,UAAU,EAAE,CAAA;AACvE,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAgC;IAClE,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,CAAA;IACnD,OAAO,UAAU;QACf,UAAU,CAAC,MAAM,IAAI,EAAE;QACvB,MAAM,CAAC,MAAM,IAAI,CAAC;QAClB,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC;QAClC,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACzB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;AAClC,CAAC","sourcesContent":["import {\n  defineAnalyticsContract,\n  getGoogleAdsWebsiteCallSendTo,\n  type BrandlabAnalyticsContract,\n} from '@brandlab-digital/site-core/analytics'\n\nexport interface BrandlabGoogleTagConfig {\n  enabled: boolean\n  measurementId?: string | null\n  googleAdsConversionId?: string | null\n  googleAdsWebsiteCallConversionLabel?: string | null\n}\n\nexport interface BrandlabGoogleTagPlan {\n  loaderId: string\n  source: string\n  inlineScript: string\n  destinations: readonly string[]\n  websiteCallDestination: string | null\n}\n\nconst GA4_MEASUREMENT_ID_PATTERN = /^G-[A-Z0-9]{4,20}$/i\nconst GOOGLE_ADS_CONVERSION_ID_PATTERN = /^(?:AW-)?\\d{6,20}$/\n\nexport function resolveBrandlabGoogleTagConfig(\n  contract: BrandlabAnalyticsContract,\n  environment: Readonly<Record<string, string | undefined>>,\n  options: { enabled: boolean },\n): BrandlabGoogleTagConfig {\n  defineAnalyticsContract(contract)\n  return {\n    enabled: options.enabled,\n    measurementId: environment[contract.measurementIdEnv],\n    googleAdsConversionId: contract.googleAds\n      ? environment[contract.googleAds.conversionIdEnv]\n      : undefined,\n    googleAdsWebsiteCallConversionLabel: contract.googleAds?.websiteCalls\n      ? environment[contract.googleAds.websiteCalls.conversionLabelEnv]\n      : undefined,\n  }\n}\n\nexport function createBrandlabGoogleTagPlan(\n  config: BrandlabGoogleTagConfig,\n  phoneNumber?: string | null,\n): BrandlabGoogleTagPlan | null {\n  if (!config.enabled) return null\n  const measurementId = validMeasurementId(config.measurementId)\n  const googleAdsConversionId = validGoogleAdsConversionId(config.googleAdsConversionId)\n  const loaderId = measurementId ?? googleAdsConversionId\n  if (!loaderId) return null\n\n  const destinations = [...new Set([\n    ...(measurementId ? [measurementId] : []),\n    ...(googleAdsConversionId ? [googleAdsConversionId] : []),\n  ])]\n  const displayPhone = safeDisplayedBusinessPhone(phoneNumber)\n  const websiteCallDestination = displayPhone\n    ? getGoogleAdsWebsiteCallSendTo({\n        conversionId: googleAdsConversionId,\n        conversionLabel: config.googleAdsWebsiteCallConversionLabel,\n      }) ?? null\n    : null\n  const configCommands = destinations.map(\n    (destination) => `window.gtag('config', ${safeJson(destination)});`,\n  )\n  if (websiteCallDestination && displayPhone) {\n    configCommands.push(\n      `window.gtag('config', ${safeJson(websiteCallDestination)}, ${safeJson({\n        phone_conversion_number: displayPhone,\n      })});`,\n    )\n  }\n\n  return {\n    loaderId,\n    source: `https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(loaderId)}`,\n    inlineScript: [\n      'window.dataLayer = window.dataLayer || [];',\n      'window.gtag = window.gtag || function(){window.dataLayer.push(arguments);};',\n      \"window.gtag('consent', 'default', {ad_user_data:'denied',ad_personalization:'denied'});\",\n      \"window.gtag('set', 'user_data', {});\",\n      \"window.gtag('js', new Date());\",\n      ...configCommands,\n    ].join('\\n'),\n    destinations,\n    websiteCallDestination,\n  }\n}\n\nfunction validMeasurementId(value: string | null | undefined) {\n  const normalized = value?.trim()\n  return normalized && GA4_MEASUREMENT_ID_PATTERN.test(normalized)\n    ? normalized.toUpperCase()\n    : undefined\n}\n\nfunction validGoogleAdsConversionId(value: string | null | undefined) {\n  const normalized = value?.trim()\n  if (!normalized || !GOOGLE_ADS_CONVERSION_ID_PATTERN.test(normalized)) return undefined\n  return normalized.startsWith('AW-') ? normalized : `AW-${normalized}`\n}\n\nfunction safeDisplayedBusinessPhone(value: string | null | undefined) {\n  const normalized = value?.trim()\n  const digits = normalized?.replace(/\\D/g, '') ?? ''\n  return normalized &&\n    normalized.length <= 32 &&\n    digits.length >= 6 &&\n    /^[0-9+().\\s-]+$/.test(normalized)\n    ? normalized\n    : undefined\n}\n\nfunction safeJson(value: unknown) {\n  return JSON.stringify(value)\n    .replace(/</g, '\\\\u003c')\n    .replace(/>/g, '\\\\u003e')\n    .replace(/&/g, '\\\\u0026')\n    .replace(/\\u2028/g, '\\\\u2028')\n    .replace(/\\u2029/g, '\\\\u2029')\n}\n"]}
+{"version":3,"file":"google-tag-plan.js","sourceRoot":"","sources":["../src/google-tag-plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAA;AAkBrF,MAAM,0BAA0B,GAAG,qBAAqB,CAAA;AACxD,MAAM,gCAAgC,GAAG,oBAAoB,CAAA;AAE7D,MAAM,UAAU,2BAA2B,CACzC,MAA+B,EAC/B,WAA2B;IAE3B,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAChC,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;IAC9D,MAAM,qBAAqB,GAAG,0BAA0B,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAA;IACtF,MAAM,QAAQ,GAAG,aAAa,IAAI,qBAAqB,CAAA;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAE1B,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;YAC/B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC,CAAC,CAAA;IACH,MAAM,YAAY,GAAG,0BAA0B,CAAC,WAAW,CAAC,CAAA;IAC5D,MAAM,sBAAsB,GAAG,YAAY;QACzC,CAAC,CAAC,6BAA6B,CAAC;YAC5B,YAAY,EAAE,qBAAqB;YACnC,eAAe,EAAE,MAAM,CAAC,mCAAmC;SAC5D,CAAC,IAAI,IAAI;QACZ,CAAC,CAAC,IAAI,CAAA;IACR,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CACrC,CAAC,WAAW,EAAE,EAAE,CAAC,yBAAyB,QAAQ,CAAC,WAAW,CAAC,IAAI,CACpE,CAAA;IACD,IAAI,sBAAsB,IAAI,YAAY,EAAE,CAAC;QAC3C,cAAc,CAAC,IAAI,CACjB,yBAAyB,QAAQ,CAAC,sBAAsB,CAAC,KAAK,QAAQ,CAAC;YACrE,uBAAuB,EAAE,YAAY;SACtC,CAAC,IAAI,CACP,CAAA;IACH,CAAC;IAED,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,+CAA+C,kBAAkB,CAAC,QAAQ,CAAC,EAAE;QACrF,YAAY,EAAE;YACZ,4CAA4C;YAC5C,6EAA6E;YAC7E,yFAAyF;YACzF,sCAAsC;YACtC,gCAAgC;YAChC,GAAG,cAAc;SAClB,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,YAAY;QACZ,sBAAsB;KACvB,CAAA;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAgC;IAC1D,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAA;IAChC,OAAO,UAAU,IAAI,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;QAC9D,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;QAC1B,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAgC;IAClE,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAA;IAChC,IAAI,CAAC,UAAU,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAA;IACvF,OAAO,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,UAAU,EAAE,CAAA;AACvE,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAgC;IAClE,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,CAAA;IACnD,OAAO,UAAU;QACf,UAAU,CAAC,MAAM,IAAI,EAAE;QACvB,MAAM,CAAC,MAAM,IAAI,CAAC;QAClB,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC;QAClC,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACzB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;AAClC,CAAC","sourcesContent":["import { getGoogleAdsWebsiteCallSendTo } from '@brandlab-digital/site-core/analytics'\n\n/** Supplied by `defineBrandlabAnalytics(...).googleTag`. */\nexport interface BrandlabGoogleTagConfig {\n  enabled: boolean\n  measurementId?: string | null\n  googleAdsConversionId?: string | null\n  googleAdsWebsiteCallConversionLabel?: string | null\n}\n\nexport interface BrandlabGoogleTagPlan {\n  loaderId: string\n  source: string\n  inlineScript: string\n  destinations: readonly string[]\n  websiteCallDestination: string | null\n}\n\nconst GA4_MEASUREMENT_ID_PATTERN = /^G-[A-Z0-9]{4,20}$/i\nconst GOOGLE_ADS_CONVERSION_ID_PATTERN = /^(?:AW-)?\\d{6,20}$/\n\nexport function createBrandlabGoogleTagPlan(\n  config: BrandlabGoogleTagConfig,\n  phoneNumber?: string | null,\n): BrandlabGoogleTagPlan | null {\n  if (!config.enabled) return null\n  const measurementId = validMeasurementId(config.measurementId)\n  const googleAdsConversionId = validGoogleAdsConversionId(config.googleAdsConversionId)\n  const loaderId = measurementId ?? googleAdsConversionId\n  if (!loaderId) return null\n\n  const destinations = [...new Set([\n    ...(measurementId ? [measurementId] : []),\n    ...(googleAdsConversionId ? [googleAdsConversionId] : []),\n  ])]\n  const displayPhone = safeDisplayedBusinessPhone(phoneNumber)\n  const websiteCallDestination = displayPhone\n    ? getGoogleAdsWebsiteCallSendTo({\n        conversionId: googleAdsConversionId,\n        conversionLabel: config.googleAdsWebsiteCallConversionLabel,\n      }) ?? null\n    : null\n  const configCommands = destinations.map(\n    (destination) => `window.gtag('config', ${safeJson(destination)});`,\n  )\n  if (websiteCallDestination && displayPhone) {\n    configCommands.push(\n      `window.gtag('config', ${safeJson(websiteCallDestination)}, ${safeJson({\n        phone_conversion_number: displayPhone,\n      })});`,\n    )\n  }\n\n  return {\n    loaderId,\n    source: `https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(loaderId)}`,\n    inlineScript: [\n      'window.dataLayer = window.dataLayer || [];',\n      'window.gtag = window.gtag || function(){window.dataLayer.push(arguments);};',\n      \"window.gtag('consent', 'default', {ad_user_data:'denied',ad_personalization:'denied'});\",\n      \"window.gtag('set', 'user_data', {});\",\n      \"window.gtag('js', new Date());\",\n      ...configCommands,\n    ].join('\\n'),\n    destinations,\n    websiteCallDestination,\n  }\n}\n\nfunction validMeasurementId(value: string | null | undefined) {\n  const normalized = value?.trim()\n  return normalized && GA4_MEASUREMENT_ID_PATTERN.test(normalized)\n    ? normalized.toUpperCase()\n    : undefined\n}\n\nfunction validGoogleAdsConversionId(value: string | null | undefined) {\n  const normalized = value?.trim()\n  if (!normalized || !GOOGLE_ADS_CONVERSION_ID_PATTERN.test(normalized)) return undefined\n  return normalized.startsWith('AW-') ? normalized : `AW-${normalized}`\n}\n\nfunction safeDisplayedBusinessPhone(value: string | null | undefined) {\n  const normalized = value?.trim()\n  const digits = normalized?.replace(/\\D/g, '') ?? ''\n  return normalized &&\n    normalized.length <= 32 &&\n    digits.length >= 6 &&\n    /^[0-9+().\\s-]+$/.test(normalized)\n    ? normalized\n    : undefined\n}\n\nfunction safeJson(value: unknown) {\n  return JSON.stringify(value)\n    .replace(/</g, '\\\\u003c')\n    .replace(/>/g, '\\\\u003e')\n    .replace(/&/g, '\\\\u0026')\n    .replace(/\\u2028/g, '\\\\u2028')\n    .replace(/\\u2029/g, '\\\\u2029')\n}\n"]}

package/dist/google-tag.d.ts

@@ -1,5 +1,5 @@
 import { type BrandlabGoogleTagConfig } from './google-tag-plan.js';
-export { createBrandlabGoogleTagPlan, resolveBrandlabGoogleTagConfig, } from './google-tag-plan.js';
+export { createBrandlabGoogleTagPlan } from './google-tag-plan.js';
 export type { BrandlabGoogleTagConfig, BrandlabGoogleTagPlan, } from './google-tag-plan.js';
 export interface BrandlabGoogleTagProps extends BrandlabGoogleTagConfig {
     /** Must match the verified public number exactly as it is rendered on the page. */
@@ -9,9 +9,10 @@ export interface BrandlabGoogleTagProps extends BrandlabGoogleTagConfig {
 /**
  * Shared Google tag and website-call forwarding-number snippet.
  *
- * Render this exactly once from the root layout. The enabled flag remains the
- * project consent/production gate; account-side conversion settings remain
- * outside website runtime.
+ * Render this exactly once from the root layout:
+ * `<BrandlabGoogleTag {...analytics.googleTag} phoneNumber={displayedPhone} />`.
+ * `analytics.googleTag.enabled` is true only on the production deployment;
+ * account-side conversion settings remain outside website runtime.
  */
 export declare function BrandlabGoogleTag(props: BrandlabGoogleTagProps): import("react/jsx-runtime").JSX.Element | null;
 //# sourceMappingURL=google-tag.d.ts.map

package/dist/google-tag.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google-tag.d.ts","sourceRoot":"","sources":["../src/google-tag.tsx"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,sBAAsB,CAAA;AAE7B,MAAM,WAAW,sBAAuB,SAAQ,uBAAuB;IACrE,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,kDAqB9D"}
+{"version":3,"file":"google-tag.d.ts","sourceRoot":"","sources":["../src/google-tag.tsx"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAA;AAClE,YAAY,EACV,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,sBAAsB,CAAA;AAE7B,MAAM,WAAW,sBAAuB,SAAQ,uBAAuB;IACrE,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,kDAqB9D"}

package/dist/google-tag.js

@@ -1,13 +1,14 @@
 import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 import Script from 'next/script';
 import { createBrandlabGoogleTagPlan, } from './google-tag-plan.js';
-export { createBrandlabGoogleTagPlan, resolveBrandlabGoogleTagConfig, } from './google-tag-plan.js';
+export { createBrandlabGoogleTagPlan } from './google-tag-plan.js';
 /**
  * Shared Google tag and website-call forwarding-number snippet.
  *
- * Render this exactly once from the root layout. The enabled flag remains the
- * project consent/production gate; account-side conversion settings remain
- * outside website runtime.
+ * Render this exactly once from the root layout:
+ * `<BrandlabGoogleTag {...analytics.googleTag} phoneNumber={displayedPhone} />`.
+ * `analytics.googleTag.enabled` is true only on the production deployment;
+ * account-side conversion settings remain outside website runtime.
  */
 export function BrandlabGoogleTag(props) {
     const plan = createBrandlabGoogleTagPlan(props, props.phoneNumber);

package/dist/google-tag.js.map

@@ -1 +1 @@
-{"version":3,"file":"google-tag.js","sourceRoot":"","sources":["../src/google-tag.tsx"],"names":[],"mappings":";AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EACL,2BAA2B,GAE5B,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,sBAAsB,CAAA;AAY7B;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA6B;IAC7D,MAAM,IAAI,GAAG,2BAA2B,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;IAClE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,OAAO,CACL,8BACE,KAAC,MAAM,IACL,EAAE,EAAC,4BAA4B,8BACN,QAAQ,EACjC,GAAG,EAAE,IAAI,CAAC,MAAM,EAChB,QAAQ,EAAC,kBAAkB,EAC3B,KAAK,EAAE,KAAK,CAAC,KAAK,GAClB,EACF,KAAC,MAAM,IACL,EAAE,EAAC,4BAA4B,8BACN,QAAQ,EACjC,QAAQ,EAAC,kBAAkB,EAC3B,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,uBAAuB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,GACtD,IACD,CACJ,CAAA;AACH,CAAC","sourcesContent":["import Script from 'next/script'\nimport {\n  createBrandlabGoogleTagPlan,\n  type BrandlabGoogleTagConfig,\n} from './google-tag-plan.js'\n\nexport {\n  createBrandlabGoogleTagPlan,\n  resolveBrandlabGoogleTagConfig,\n} from './google-tag-plan.js'\nexport type {\n  BrandlabGoogleTagConfig,\n  BrandlabGoogleTagPlan,\n} from './google-tag-plan.js'\n\nexport interface BrandlabGoogleTagProps extends BrandlabGoogleTagConfig {\n  /** Must match the verified public number exactly as it is rendered on the page. */\n  phoneNumber?: string | null\n  nonce?: string\n}\n\n/**\n * Shared Google tag and website-call forwarding-number snippet.\n *\n * Render this exactly once from the root layout. The enabled flag remains the\n * project consent/production gate; account-side conversion settings remain\n * outside website runtime.\n */\nexport function BrandlabGoogleTag(props: BrandlabGoogleTagProps) {\n  const plan = createBrandlabGoogleTagPlan(props, props.phoneNumber)\n  if (!plan) return null\n  return (\n    <>\n      <Script\n        id=\"brandlab-google-tag-loader\"\n        data-brandlab-google-tag=\"loader\"\n        src={plan.source}\n        strategy=\"afterInteractive\"\n        nonce={props.nonce}\n      />\n      <Script\n        id=\"brandlab-google-tag-config\"\n        data-brandlab-google-tag=\"config\"\n        strategy=\"afterInteractive\"\n        nonce={props.nonce}\n        dangerouslySetInnerHTML={{ __html: plan.inlineScript }}\n      />\n    </>\n  )\n}\n"]}
+{"version":3,"file":"google-tag.js","sourceRoot":"","sources":["../src/google-tag.tsx"],"names":[],"mappings":";AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EACL,2BAA2B,GAE5B,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAA;AAYlE;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA6B;IAC7D,MAAM,IAAI,GAAG,2BAA2B,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;IAClE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,OAAO,CACL,8BACE,KAAC,MAAM,IACL,EAAE,EAAC,4BAA4B,8BACN,QAAQ,EACjC,GAAG,EAAE,IAAI,CAAC,MAAM,EAChB,QAAQ,EAAC,kBAAkB,EAC3B,KAAK,EAAE,KAAK,CAAC,KAAK,GAClB,EACF,KAAC,MAAM,IACL,EAAE,EAAC,4BAA4B,8BACN,QAAQ,EACjC,QAAQ,EAAC,kBAAkB,EAC3B,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,uBAAuB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,GACtD,IACD,CACJ,CAAA;AACH,CAAC","sourcesContent":["import Script from 'next/script'\nimport {\n  createBrandlabGoogleTagPlan,\n  type BrandlabGoogleTagConfig,\n} from './google-tag-plan.js'\n\nexport { createBrandlabGoogleTagPlan } from './google-tag-plan.js'\nexport type {\n  BrandlabGoogleTagConfig,\n  BrandlabGoogleTagPlan,\n} from './google-tag-plan.js'\n\nexport interface BrandlabGoogleTagProps extends BrandlabGoogleTagConfig {\n  /** Must match the verified public number exactly as it is rendered on the page. */\n  phoneNumber?: string | null\n  nonce?: string\n}\n\n/**\n * Shared Google tag and website-call forwarding-number snippet.\n *\n * Render this exactly once from the root layout:\n * `<BrandlabGoogleTag {...analytics.googleTag} phoneNumber={displayedPhone} />`.\n * `analytics.googleTag.enabled` is true only on the production deployment;\n * account-side conversion settings remain outside website runtime.\n */\nexport function BrandlabGoogleTag(props: BrandlabGoogleTagProps) {\n  const plan = createBrandlabGoogleTagPlan(props, props.phoneNumber)\n  if (!plan) return null\n  return (\n    <>\n      <Script\n        id=\"brandlab-google-tag-loader\"\n        data-brandlab-google-tag=\"loader\"\n        src={plan.source}\n        strategy=\"afterInteractive\"\n        nonce={props.nonce}\n      />\n      <Script\n        id=\"brandlab-google-tag-config\"\n        data-brandlab-google-tag=\"config\"\n        strategy=\"afterInteractive\"\n        nonce={props.nonce}\n        dangerouslySetInnerHTML={{ __html: plan.inlineScript }}\n      />\n    </>\n  )\n}\n"]}

package/dist/headers.d.ts

@@ -1,20 +1,18 @@
 /**
- * Brandlab security/response headers (Brandlab Project Standard §2).
+ * Brandlab security/response headers: one canonical header set for every
+ * client site, emitted by `defineBrandlabNextConfig`.
  *
- * One canonical header set for every client site, composed into
- * `next.config.ts`:
+ * The deployment decides everything environment-specific:
+ * - a production build (`next build`, on Vercel or locally) enforces the
+ *   production Content Security Policy and sends HSTS;
+ * - `next dev` sends a report-only development policy without HSTS;
+ * - a Vercel Preview additionally sends `noindex, nofollow, noarchive` and
+ *   `private, no-store`, so previews never reach search results or caches.
  *
- *   async headers() {
- *     return buildBrandlabHeaderRules({
- *       isProduction,
- *       profile: 'next-local-service',
- *     })
- *   }
- *
- * The X-Robots-Tag here carries snippet-display controls only; per-page
- * indexation stays owned by Metadata.robots (noindex pages override via
- * their <meta name="robots">).
+ * The production X-Robots-Tag carries snippet-display controls only; per-page
+ * indexation stays owned by Metadata.robots.
  */
+import type { BrandlabDeployment } from '@brandlab-digital/site-core/site';
 export interface BrandlabHeader {
     key: string;
     value: string;
@@ -23,10 +21,10 @@ export interface BrandlabHeaderRule {
     source: string;
     headers: BrandlabHeader[];
 }
-export declare const BRANDLAB_NEXT_HEADER_PROFILES: readonly ["next-local-service", "next-root-level"];
-export type BrandlabNextHeaderProfile = (typeof BRANDLAB_NEXT_HEADER_PROFILES)[number];
 export declare const BRANDLAB_DEFAULT_PERMISSIONS_POLICY = "camera=(), microphone=(), geolocation=()";
 export declare const BRANDLAB_DEFAULT_X_ROBOTS_TAG = "max-snippet:-1, max-image-preview:large, max-video-preview:-1";
+export declare const BRANDLAB_PREVIEW_X_ROBOTS_TAG = "noindex, nofollow, noarchive";
+export declare const BRANDLAB_PREVIEW_CACHE_CONTROL = "private, no-store, max-age=0";
 export declare const BRANDLAB_HSTS_VALUE = "max-age=31536000";
 export interface BrandlabHstsExpansion {
     includeSubDomains: true;
@@ -39,26 +37,21 @@ export interface BrandlabContentSecurityPolicyExtensions {
     connectSrc?: readonly string[];
     frameSrc?: readonly string[];
 }
-export type BrandlabContentSecurityPolicyMode = 'enforce' | 'report-only';
 export interface BrandlabSecurityHeaderOptions {
-    isProduction: boolean;
-    profile: BrandlabNextHeaderProfile;
-    permissionsPolicy?: string;
-    /** Pass null to omit the snippet-control header entirely. */
-    xRobotsTag?: string | null;
-    extraHeaders?: readonly BrandlabHeader[];
+    /** From resolveBrandlabDeployment(process.env). */
+    deployment: BrandlabDeployment;
     hsts?: BrandlabHstsExpansion;
-    contentSecurityPolicyMode?: BrandlabContentSecurityPolicyMode;
     /** Reviewed HTTPS origins needed by an approved project integration. */
     contentSecurityPolicyExtensions?: BrandlabContentSecurityPolicyExtensions;
+    /** Reviewed project exception, for example `geolocation=(self)` for a location feature. */
+    permissionsPolicy?: string;
+    /** Reviewed project headers; they cannot replace a protected header. */
+    extraHeaders?: readonly BrandlabHeader[];
 }
 export declare function buildBrandlabContentSecurityPolicy(options: {
-    isProduction: boolean;
-    profile: BrandlabNextHeaderProfile;
+    deployment: BrandlabDeployment;
     contentSecurityPolicyExtensions?: BrandlabContentSecurityPolicyExtensions;
 }): string;
 export declare function buildBrandlabSecurityHeaders(options: BrandlabSecurityHeaderOptions): BrandlabHeader[];
-export declare function buildBrandlabHeaderRules(options: BrandlabSecurityHeaderOptions & {
-    source?: string;
-}): BrandlabHeaderRule[];
+export declare function buildBrandlabHeaderRules(options: BrandlabSecurityHeaderOptions): BrandlabHeaderRule[];
 //# sourceMappingURL=headers.d.ts.map

package/dist/headers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../src/headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,cAAc,EAAE,CAAA;CAC1B;AAED,eAAO,MAAM,6BAA6B,oDAGhC,CAAA;AAEV,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAA;AAEtF,eAAO,MAAM,mCAAmC,6CACJ,CAAA;AAE5C,eAAO,MAAM,6BAA6B,kEACuB,CAAA;AAEjE,eAAO,MAAM,mBAAmB,qBACZ,CAAA;AAEpB,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,IAAI,CAAA;IACvB,OAAO,CAAC,EAAE,IAAI,CAAA;IACd,mEAAmE;IACnE,iBAAiB,EAAE,MAAM,CAAA;CAC1B;AAcD,MAAM,WAAW,uCAAuC;IACtD,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC7B;AAED,MAAM,MAAM,iCAAiC,GAAG,SAAS,GAAG,aAAa,CAAA;AAEzE,MAAM,WAAW,6BAA6B;IAC5C,YAAY,EAAE,OAAO,CAAA;IACrB,OAAO,EAAE,yBAAyB,CAAA;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IACxC,IAAI,CAAC,EAAE,qBAAqB,CAAA;IAC5B,yBAAyB,CAAC,EAAE,iCAAiC,CAAA;IAC7D,wEAAwE;IACxE,+BAA+B,CAAC,EAAE,uCAAuC,CAAA;CAC1E;AAED,wBAAgB,kCAAkC,CAAC,OAAO,EAAE;IAC1D,YAAY,EAAE,OAAO,CAAA;IACrB,OAAO,EAAE,yBAAyB,CAAA;IAClC,+BAA+B,CAAC,EAAE,uCAAuC,CAAA;CAC1E,UAwDA;AAyCD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,6BAA6B,GACrC,cAAc,EAAE,CAmDlB;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,6BAA6B,GAAG;IAChF,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,GAAG,kBAAkB,EAAE,CAWvB"}
+{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../src/headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,kCAAkC,CAAA;AAEzC,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,cAAc,EAAE,CAAA;CAC1B;AAED,eAAO,MAAM,mCAAmC,6CACJ,CAAA;AAE5C,eAAO,MAAM,6BAA6B,kEACuB,CAAA;AAEjE,eAAO,MAAM,6BAA6B,iCAAiC,CAAA;AAE3E,eAAO,MAAM,8BAA8B,iCAAiC,CAAA;AAE5E,eAAO,MAAM,mBAAmB,qBACZ,CAAA;AAEpB,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,IAAI,CAAA;IACvB,OAAO,CAAC,EAAE,IAAI,CAAA;IACd,mEAAmE;IACnE,iBAAiB,EAAE,MAAM,CAAA;CAC1B;AAoBD,MAAM,WAAW,uCAAuC;IACtD,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC7B;AAED,MAAM,WAAW,6BAA6B;IAC5C,mDAAmD;IACnD,UAAU,EAAE,kBAAkB,CAAA;IAC9B,IAAI,CAAC,EAAE,qBAAqB,CAAA;IAC5B,wEAAwE;IACxE,+BAA+B,CAAC,EAAE,uCAAuC,CAAA;IACzE,2FAA2F;IAC3F,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,wEAAwE;IACxE,YAAY,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;CACzC;AAcD,wBAAgB,kCAAkC,CAAC,OAAO,EAAE;IAC1D,UAAU,EAAE,kBAAkB,CAAA;IAC9B,+BAA+B,CAAC,EAAE,uCAAuC,CAAA;CAC1E,UAsDA;AAiDD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,6BAA6B,GACrC,cAAc,EAAE,CAmDlB;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,6BAA6B,GAAG,kBAAkB,EAAE,CAOrG"}

package/dist/headers.js

@@ -1,29 +1,25 @@
 /**
- * Brandlab security/response headers (Brandlab Project Standard §2).
+ * Brandlab security/response headers: one canonical header set for every
+ * client site, emitted by `defineBrandlabNextConfig`.
  *
- * One canonical header set for every client site, composed into
- * `next.config.ts`:
+ * The deployment decides everything environment-specific:
+ * - a production build (`next build`, on Vercel or locally) enforces the
+ *   production Content Security Policy and sends HSTS;
+ * - `next dev` sends a report-only development policy without HSTS;
+ * - a Vercel Preview additionally sends `noindex, nofollow, noarchive` and
+ *   `private, no-store`, so previews never reach search results or caches.
  *
- *   async headers() {
- *     return buildBrandlabHeaderRules({
- *       isProduction,
- *       profile: 'next-local-service',
- *     })
- *   }
- *
- * The X-Robots-Tag here carries snippet-display controls only; per-page
- * indexation stays owned by Metadata.robots (noindex pages override via
- * their <meta name="robots">).
+ * The production X-Robots-Tag carries snippet-display controls only; per-page
+ * indexation stays owned by Metadata.robots.
  */
-export const BRANDLAB_NEXT_HEADER_PROFILES = [
-    'next-local-service',
-    'next-root-level',
-];
 export const BRANDLAB_DEFAULT_PERMISSIONS_POLICY = 'camera=(), microphone=(), geolocation=()';
 export const BRANDLAB_DEFAULT_X_ROBOTS_TAG = 'max-snippet:-1, max-image-preview:large, max-video-preview:-1';
+export const BRANDLAB_PREVIEW_X_ROBOTS_TAG = 'noindex, nofollow, noarchive';
+export const BRANDLAB_PREVIEW_CACHE_CONTROL = 'private, no-store, max-age=0';
 export const BRANDLAB_HSTS_VALUE = 'max-age=31536000';
 const HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 const PROTECTED_HEADER_NAMES = new Set([
+    'cache-control',
     'content-security-policy',
     'content-security-policy-report-only',
     'x-frame-options',
@@ -33,11 +29,23 @@ const PROTECTED_HEADER_NAMES = new Set([
     'x-robots-tag',
     'strict-transport-security',
 ]);
-export function buildBrandlabContentSecurityPolicy(options) {
-    const profile = options.profile;
-    if (!BRANDLAB_NEXT_HEADER_PROFILES.includes(profile)) {
-        throw new Error(`Unsupported Brandlab Next header profile "${profile}".`);
+const DEPLOYMENT_ENVIRONMENTS = new Set([
+    'production',
+    'preview',
+    'development',
+]);
+function assertDeployment(deployment) {
+    const candidate = deployment;
+    if (!candidate ||
+        typeof candidate !== 'object' ||
+        !DEPLOYMENT_ENVIRONMENTS.has(candidate.environment) ||
+        typeof candidate.productionBuild !== 'boolean') {
+        throw new Error('Header rules require the deployment from resolveBrandlabDeployment(process.env).');
     }
+}
+export function buildBrandlabContentSecurityPolicy(options) {
+    assertDeployment(options.deployment);
+    const productionBuild = options.deployment.productionBuild;
     const scriptSources = [
         "'self'",
         "'unsafe-inline'",
@@ -49,7 +57,7 @@ export function buildBrandlabContentSecurityPolicy(options) {
         'https://googleads.g.doubleclick.net',
         'https://challenges.cloudflare.com',
         ...normalizeCspExtensions(options.contentSecurityPolicyExtensions?.scriptSrc, 'scriptSrc'),
-        ...(options.isProduction ? [] : ["'unsafe-eval'", 'http://localhost:*']),
+        ...(productionBuild ? [] : ["'unsafe-eval'", 'http://localhost:*']),
     ];
     const connectSources = [
         "'self'",
@@ -66,7 +74,7 @@ export function buildBrandlabContentSecurityPolicy(options) {
         'https://*.analytics.google.com',
         'https://challenges.cloudflare.com',
         ...normalizeCspExtensions(options.contentSecurityPolicyExtensions?.connectSrc, 'connectSrc'),
-        ...(options.isProduction ? [] : ['http://localhost:*', 'ws://localhost:*']),
+        ...(productionBuild ? [] : ['http://localhost:*', 'ws://localhost:*']),
     ];
     const directives = [
         "default-src 'self'",
@@ -82,7 +90,7 @@ export function buildBrandlabContentSecurityPolicy(options) {
         `frame-src 'self' https://challenges.cloudflare.com https://www.googletagmanager.com https://www.google.com ${normalizeCspExtensions(options.contentSecurityPolicyExtensions?.frameSrc, 'frameSrc').join(' ')}`.trim(),
         "manifest-src 'self'",
         "worker-src 'self' blob:",
-        ...(options.isProduction ? ['upgrade-insecure-requests'] : []),
+        ...(productionBuild ? ['upgrade-insecure-requests'] : []),
     ];
     return directives.join('; ');
 }
@@ -120,15 +128,25 @@ function validateExtraHeaders(headers) {
         assertHeaderValue(header.value, `extraHeaders[${index}].value`);
     });
 }
+const HEADER_OPTION_KEYS = new Set([
+    'deployment',
+    'hsts',
+    'contentSecurityPolicyExtensions',
+    'permissionsPolicy',
+    'extraHeaders',
+]);
 export function buildBrandlabSecurityHeaders(options) {
-    if (typeof options.isProduction !== 'boolean') {
-        throw new Error('isProduction must be boolean.');
+    if (!options || typeof options !== 'object') {
+        throw new TypeError('Header options are required.');
+    }
+    const unsupported = Object.keys(options).filter((key) => !HEADER_OPTION_KEYS.has(key));
+    if (unsupported.length > 0) {
+        throw new Error(`Header options contain unsupported keys: ${unsupported.join(', ')}. The deployment decides CSP, HSTS and X-Robots-Tag.`);
     }
-    const xRobotsTag = options.xRobotsTag === undefined ? BRANDLAB_DEFAULT_X_ROBOTS_TAG : options.xRobotsTag;
+    assertDeployment(options.deployment);
+    const { environment, productionBuild } = options.deployment;
     const permissionsPolicy = options.permissionsPolicy ?? BRANDLAB_DEFAULT_PERMISSIONS_POLICY;
     assertHeaderValue(permissionsPolicy, 'permissionsPolicy');
-    if (xRobotsTag !== null)
-        assertHeaderValue(xRobotsTag, 'xRobotsTag');
     validateExtraHeaders(options.extraHeaders ?? []);
     if (options.hsts) {
         assertHeaderValue(options.hsts.readinessEvidence, 'hsts.readinessEvidence');
@@ -139,19 +157,7 @@ export function buildBrandlabSecurityHeaders(options) {
     const hstsValue = options.hsts
         ? `${BRANDLAB_HSTS_VALUE}; includeSubDomains${options.hsts.preload ? '; preload' : ''}`
         : BRANDLAB_HSTS_VALUE;
-    const cspMode = options.contentSecurityPolicyMode ?? (options.isProduction ? 'enforce' : 'report-only');
-    if (!new Set(['enforce', 'report-only']).has(cspMode)) {
-        throw new Error(`Unsupported contentSecurityPolicyMode "${cspMode}".`);
-    }
-    if (options.isProduction && cspMode !== 'enforce') {
-        throw new Error('Production Content Security Policy must use enforce mode.');
-    }
-    const cspHeader = [{
-            key: cspMode === 'enforce'
-                ? 'Content-Security-Policy'
-                : 'Content-Security-Policy-Report-Only',
-            value: buildBrandlabContentSecurityPolicy(options),
-        }];
+    const preview = environment === 'preview';
     return [
         { key: 'X-Frame-Options', value: 'DENY' },
         { key: 'X-Content-Type-Options', value: 'nosniff' },
@@ -160,22 +166,27 @@ export function buildBrandlabSecurityHeaders(options) {
             key: 'Permissions-Policy',
             value: permissionsPolicy,
         },
-        ...(xRobotsTag ? [{ key: 'X-Robots-Tag', value: xRobotsTag }] : []),
-        ...(options.isProduction
+        {
+            key: 'X-Robots-Tag',
+            value: preview ? BRANDLAB_PREVIEW_X_ROBOTS_TAG : BRANDLAB_DEFAULT_X_ROBOTS_TAG,
+        },
+        ...(productionBuild
             ? [{ key: 'Strict-Transport-Security', value: hstsValue }]
             : []),
-        ...cspHeader,
-        ...(options.extraHeaders ?? []),
+        {
+            key: productionBuild
+                ? 'Content-Security-Policy'
+                : 'Content-Security-Policy-Report-Only',
+            value: buildBrandlabContentSecurityPolicy(options),
+        },
+        ...(options.extraHeaders ?? []).map((header) => ({ ...header })),
+        ...(preview ? [{ key: 'Cache-Control', value: BRANDLAB_PREVIEW_CACHE_CONTROL }] : []),
     ];
 }
 export function buildBrandlabHeaderRules(options) {
-    const source = options.source ?? '/:path*';
-    if (!source.startsWith('/') || /[\u0000-\u001F\u007F]/.test(source)) {
-        throw new Error('Header-rule source must be a root-relative single-line pattern.');
-    }
     return [
         {
-            source,
+            source: '/:path*',
             headers: buildBrandlabSecurityHeaders(options),
         },
     ];

package/dist/headers.js.map

@@ -1 +1 @@
-{"version":3,"file":"headers.js","sourceRoot":"","sources":["../src/headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAYH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,oBAAoB;IACpB,iBAAiB;CACT,CAAA;AAIV,MAAM,CAAC,MAAM,mCAAmC,GAC9C,0CAA0C,CAAA;AAE5C,MAAM,CAAC,MAAM,6BAA6B,GACxC,+DAA+D,CAAA;AAEjE,MAAM,CAAC,MAAM,mBAAmB,GAC9B,kBAAkB,CAAA;AASpB,MAAM,mBAAmB,GAAG,+BAA+B,CAAA;AAC3D,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,yBAAyB;IACzB,qCAAqC;IACrC,iBAAiB;IACjB,wBAAwB;IACxB,iBAAiB;IACjB,oBAAoB;IACpB,cAAc;IACd,2BAA2B;CAC5B,CAAC,CAAA;AAuBF,MAAM,UAAU,kCAAkC,CAAC,OAIlD;IACC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;IAC/B,IAAI,CAAC,6BAA6B,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,6CAA6C,OAAO,IAAI,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,aAAa,GAAG;QACpB,QAAQ;QACR,iBAAiB;QACjB,kCAAkC;QAClC,kCAAkC;QAClC,wBAAwB;QACxB,yBAAyB;QACzB,uCAAuC;QACvC,qCAAqC;QACrC,mCAAmC;QACnC,GAAG,sBAAsB,CAAC,OAAO,CAAC,+BAA+B,EAAE,SAAS,EAAE,WAAW,CAAC;QAC1F,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;KACzE,CAAA;IACD,MAAM,cAAc,GAAG;QACrB,QAAQ;QACR,kCAAkC;QAClC,gCAAgC;QAChC,kCAAkC;QAClC,kCAAkC;QAClC,2BAA2B;QAC3B,sBAAsB;QACtB,oBAAoB;QACpB,2BAA2B;QAC3B,uCAAuC;QACvC,gCAAgC;QAChC,gCAAgC;QAChC,mCAAmC;QACnC,GAAG,sBAAsB,CAAC,OAAO,CAAC,+BAA+B,EAAE,UAAU,EAAE,YAAY,CAAC;QAC5F,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;KAC5E,CAAA;IACD,MAAM,UAAU,GAAG;QACjB,oBAAoB;QACpB,iBAAiB;QACjB,mBAAmB;QACnB,wBAAwB;QACxB,oBAAoB;QACpB,cAAc,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACvC,kCAAkC;QAClC,uBAAuB;QACvB,mCAAmC;QACnC,eAAe,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACzC,8GAA8G,sBAAsB,CAClI,OAAO,CAAC,+BAA+B,EAAE,QAAQ,EACjD,UAAU,CACX,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;QACpB,qBAAqB;QACrB,yBAAyB;QACzB,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAA;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC9B,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAsC,EACtC,KAAoD;IAEpD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IACvB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACzC,IAAI,CAAC,oEAAoE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+DAA+D,CAAC,CAAA;QAC1F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IACF,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAA;IACrD,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,KAAa;IACrD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8CAA8C,CAAC,CAAA;IACzE,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAkC;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAChC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,mBAAmB,CAAC,CAAA;QAC3D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAA;QACrC,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,8CAA8C,CAAC,CAAA;QACtF,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACf,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,gBAAgB,KAAK,SAAS,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,OAAsC;IAEtC,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAClD,CAAC;IACD,MAAM,UAAU,GACd,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAA;IACvF,MAAM,iBAAiB,GACrB,OAAO,CAAC,iBAAiB,IAAI,mCAAmC,CAAA;IAClE,iBAAiB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAA;IACzD,IAAI,UAAU,KAAK,IAAI;QAAE,iBAAiB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;IACpE,oBAAoB,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAA;IAChD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAA;QAC3E,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QACvE,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI;QAC5B,CAAC,CAAC,GAAG,mBAAmB,sBAAsB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE;QACvF,CAAC,CAAC,mBAAmB,CAAA;IACvB,MAAM,OAAO,GAAG,OAAO,CAAC,yBAAyB,IAAI,CACnD,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CACjD,CAAA;IACD,IAAI,CAAC,IAAI,GAAG,CAAoC,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,0CAA0C,OAAO,IAAI,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,SAAS,GAAG,CAAC;YACjB,GAAG,EAAE,OAAO,KAAK,SAAS;gBACxB,CAAC,CAAC,yBAAyB;gBAC3B,CAAC,CAAC,qCAAqC;YACzC,KAAK,EAAE,kCAAkC,CAAC,OAAO,CAAC;SACnD,CAAC,CAAA;IAEF,OAAO;QACL,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE;QACzC,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,SAAS,EAAE;QACnD,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,iCAAiC,EAAE;QACpE;YACE,GAAG,EAAE,oBAAoB;YACzB,KAAK,EAAE,iBAAiB;SACzB;QACD,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,YAAY;YACtB,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAC1D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,SAAS;QACZ,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;KAChC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAExC;IACC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IACpF,CAAC;IACD,OAAO;QACL;YACE,MAAM;YACN,OAAO,EAAE,4BAA4B,CAAC,OAAO,CAAC;SAC/C;KACF,CAAA;AACH,CAAC","sourcesContent":["/**\n * Brandlab security/response headers (Brandlab Project Standard §2).\n *\n * One canonical header set for every client site, composed into\n * `next.config.ts`:\n *\n *   async headers() {\n *     return buildBrandlabHeaderRules({\n *       isProduction,\n *       profile: 'next-local-service',\n *     })\n *   }\n *\n * The X-Robots-Tag here carries snippet-display controls only; per-page\n * indexation stays owned by Metadata.robots (noindex pages override via\n * their <meta name=\"robots\">).\n */\n\nexport interface BrandlabHeader {\n  key: string\n  value: string\n}\n\nexport interface BrandlabHeaderRule {\n  source: string\n  headers: BrandlabHeader[]\n}\n\nexport const BRANDLAB_NEXT_HEADER_PROFILES = [\n  'next-local-service',\n  'next-root-level',\n] as const\n\nexport type BrandlabNextHeaderProfile = (typeof BRANDLAB_NEXT_HEADER_PROFILES)[number]\n\nexport const BRANDLAB_DEFAULT_PERMISSIONS_POLICY =\n  'camera=(), microphone=(), geolocation=()'\n\nexport const BRANDLAB_DEFAULT_X_ROBOTS_TAG =\n  'max-snippet:-1, max-image-preview:large, max-video-preview:-1'\n\nexport const BRANDLAB_HSTS_VALUE =\n  'max-age=31536000'\n\nexport interface BrandlabHstsExpansion {\n  includeSubDomains: true\n  preload?: true\n  /** Reviewed proof that every affected subdomain is HTTPS-ready. */\n  readinessEvidence: string\n}\n\nconst HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/\nconst PROTECTED_HEADER_NAMES = new Set([\n  'content-security-policy',\n  'content-security-policy-report-only',\n  'x-frame-options',\n  'x-content-type-options',\n  'referrer-policy',\n  'permissions-policy',\n  'x-robots-tag',\n  'strict-transport-security',\n])\n\nexport interface BrandlabContentSecurityPolicyExtensions {\n  scriptSrc?: readonly string[]\n  connectSrc?: readonly string[]\n  frameSrc?: readonly string[]\n}\n\nexport type BrandlabContentSecurityPolicyMode = 'enforce' | 'report-only'\n\nexport interface BrandlabSecurityHeaderOptions {\n  isProduction: boolean\n  profile: BrandlabNextHeaderProfile\n  permissionsPolicy?: string\n  /** Pass null to omit the snippet-control header entirely. */\n  xRobotsTag?: string | null\n  extraHeaders?: readonly BrandlabHeader[]\n  hsts?: BrandlabHstsExpansion\n  contentSecurityPolicyMode?: BrandlabContentSecurityPolicyMode\n  /** Reviewed HTTPS origins needed by an approved project integration. */\n  contentSecurityPolicyExtensions?: BrandlabContentSecurityPolicyExtensions\n}\n\nexport function buildBrandlabContentSecurityPolicy(options: {\n  isProduction: boolean\n  profile: BrandlabNextHeaderProfile\n  contentSecurityPolicyExtensions?: BrandlabContentSecurityPolicyExtensions\n}) {\n  const profile = options.profile\n  if (!BRANDLAB_NEXT_HEADER_PROFILES.includes(profile)) {\n    throw new Error(`Unsupported Brandlab Next header profile \"${profile}\".`)\n  }\n\n  const scriptSources = [\n    \"'self'\",\n    \"'unsafe-inline'\",\n    'https://www.googletagmanager.com',\n    'https://www.googleadservices.com',\n    'https://www.google.com',\n    'https://www.gstatic.com',\n    'https://pagead2.googlesyndication.com',\n    'https://googleads.g.doubleclick.net',\n    'https://challenges.cloudflare.com',\n    ...normalizeCspExtensions(options.contentSecurityPolicyExtensions?.scriptSrc, 'scriptSrc'),\n    ...(options.isProduction ? [] : [\"'unsafe-eval'\", 'http://localhost:*']),\n  ]\n  const connectSources = [\n    \"'self'\",\n    'https://www.google-analytics.com',\n    'https://*.google-analytics.com',\n    'https://www.googletagmanager.com',\n    'https://www.googleadservices.com',\n    'https://*.doubleclick.net',\n    'https://*.google.com',\n    'https://google.com',\n    'https://www.google.com.au',\n    'https://pagead2.googlesyndication.com',\n    'https://*.googletagmanager.com',\n    'https://*.analytics.google.com',\n    'https://challenges.cloudflare.com',\n    ...normalizeCspExtensions(options.contentSecurityPolicyExtensions?.connectSrc, 'connectSrc'),\n    ...(options.isProduction ? [] : ['http://localhost:*', 'ws://localhost:*']),\n  ]\n  const directives = [\n    \"default-src 'self'\",\n    \"base-uri 'self'\",\n    \"object-src 'none'\",\n    \"frame-ancestors 'none'\",\n    \"form-action 'self'\",\n    `script-src ${scriptSources.join(' ')}`,\n    \"style-src 'self' 'unsafe-inline'\",\n    \"font-src 'self' data:\",\n    \"img-src 'self' data: blob: https:\",\n    `connect-src ${connectSources.join(' ')}`,\n    `frame-src 'self' https://challenges.cloudflare.com https://www.googletagmanager.com https://www.google.com ${normalizeCspExtensions(\n      options.contentSecurityPolicyExtensions?.frameSrc,\n      'frameSrc',\n    ).join(' ')}`.trim(),\n    \"manifest-src 'self'\",\n    \"worker-src 'self' blob:\",\n    ...(options.isProduction ? ['upgrade-insecure-requests'] : []),\n  ]\n  return directives.join('; ')\n}\n\nfunction normalizeCspExtensions(\n  sources: readonly string[] | undefined,\n  field: keyof BrandlabContentSecurityPolicyExtensions,\n) {\n  if (!sources) return []\n  const normalized = sources.map((source) => {\n    const value = source.trim().toLowerCase()\n    if (!/^https:\\/\\/(?:\\*\\.)?[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?(?::\\d{1,5})?$/.test(value)) {\n      throw new Error(`${field} entries must be HTTPS origins without paths or CSP keywords.`)\n    }\n    return value\n  })\n  if (new Set(normalized).size !== normalized.length) {\n    throw new Error(`${field} entries must be unique.`)\n  }\n  return normalized\n}\n\nfunction assertHeaderValue(value: string, field: string) {\n  if (!value || value.length > 4_096 || /[\\u0000-\\u001F\\u007F]/.test(value)) {\n    throw new Error(`${field} must be a bounded single-line header value.`)\n  }\n}\n\nfunction validateExtraHeaders(headers: readonly BrandlabHeader[]) {\n  const names = new Set<string>()\n  headers.forEach((header, index) => {\n    if (!HEADER_NAME_PATTERN.test(header.key)) {\n      throw new Error(`extraHeaders[${index}].key is invalid.`)\n    }\n    const name = header.key.toLowerCase()\n    if (PROTECTED_HEADER_NAMES.has(name) || names.has(name)) {\n      throw new Error(`extraHeaders[${index}] duplicates a protected or existing header.`)\n    }\n    names.add(name)\n    assertHeaderValue(header.value, `extraHeaders[${index}].value`)\n  })\n}\n\nexport function buildBrandlabSecurityHeaders(\n  options: BrandlabSecurityHeaderOptions,\n): BrandlabHeader[] {\n  if (typeof options.isProduction !== 'boolean') {\n    throw new Error('isProduction must be boolean.')\n  }\n  const xRobotsTag =\n    options.xRobotsTag === undefined ? BRANDLAB_DEFAULT_X_ROBOTS_TAG : options.xRobotsTag\n  const permissionsPolicy =\n    options.permissionsPolicy ?? BRANDLAB_DEFAULT_PERMISSIONS_POLICY\n  assertHeaderValue(permissionsPolicy, 'permissionsPolicy')\n  if (xRobotsTag !== null) assertHeaderValue(xRobotsTag, 'xRobotsTag')\n  validateExtraHeaders(options.extraHeaders ?? [])\n  if (options.hsts) {\n    assertHeaderValue(options.hsts.readinessEvidence, 'hsts.readinessEvidence')\n    if (options.hsts.preload && !options.hsts.includeSubDomains) {\n      throw new Error('HSTS preload requires includeSubDomains readiness.')\n    }\n  }\n  const hstsValue = options.hsts\n    ? `${BRANDLAB_HSTS_VALUE}; includeSubDomains${options.hsts.preload ? '; preload' : ''}`\n    : BRANDLAB_HSTS_VALUE\n  const cspMode = options.contentSecurityPolicyMode ?? (\n    options.isProduction ? 'enforce' : 'report-only'\n  )\n  if (!new Set<BrandlabContentSecurityPolicyMode>(['enforce', 'report-only']).has(cspMode)) {\n    throw new Error(`Unsupported contentSecurityPolicyMode \"${cspMode}\".`)\n  }\n  if (options.isProduction && cspMode !== 'enforce') {\n    throw new Error('Production Content Security Policy must use enforce mode.')\n  }\n  const cspHeader = [{\n    key: cspMode === 'enforce'\n      ? 'Content-Security-Policy'\n      : 'Content-Security-Policy-Report-Only',\n    value: buildBrandlabContentSecurityPolicy(options),\n  }]\n\n  return [\n    { key: 'X-Frame-Options', value: 'DENY' },\n    { key: 'X-Content-Type-Options', value: 'nosniff' },\n    { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },\n    {\n      key: 'Permissions-Policy',\n      value: permissionsPolicy,\n    },\n    ...(xRobotsTag ? [{ key: 'X-Robots-Tag', value: xRobotsTag }] : []),\n    ...(options.isProduction\n      ? [{ key: 'Strict-Transport-Security', value: hstsValue }]\n      : []),\n    ...cspHeader,\n    ...(options.extraHeaders ?? []),\n  ]\n}\n\nexport function buildBrandlabHeaderRules(options: BrandlabSecurityHeaderOptions & {\n  source?: string\n}): BrandlabHeaderRule[] {\n  const source = options.source ?? '/:path*'\n  if (!source.startsWith('/') || /[\\u0000-\\u001F\\u007F]/.test(source)) {\n    throw new Error('Header-rule source must be a root-relative single-line pattern.')\n  }\n  return [\n    {\n      source,\n      headers: buildBrandlabSecurityHeaders(options),\n    },\n  ]\n}\n"]}
+{"version":3,"file":"headers.js","sourceRoot":"","sources":["../src/headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAiBH,MAAM,CAAC,MAAM,mCAAmC,GAC9C,0CAA0C,CAAA;AAE5C,MAAM,CAAC,MAAM,6BAA6B,GACxC,+DAA+D,CAAA;AAEjE,MAAM,CAAC,MAAM,6BAA6B,GAAG,8BAA8B,CAAA;AAE3E,MAAM,CAAC,MAAM,8BAA8B,GAAG,8BAA8B,CAAA;AAE5E,MAAM,CAAC,MAAM,mBAAmB,GAC9B,kBAAkB,CAAA;AASpB,MAAM,mBAAmB,GAAG,+BAA+B,CAAA;AAC3D,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,eAAe;IACf,yBAAyB;IACzB,qCAAqC;IACrC,iBAAiB;IACjB,wBAAwB;IACxB,iBAAiB;IACjB,oBAAoB;IACpB,cAAc;IACd,2BAA2B;CAC5B,CAAC,CAAA;AACF,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAgC;IACrE,YAAY;IACZ,SAAS;IACT,aAAa;CACd,CAAC,CAAA;AAoBF,SAAS,gBAAgB,CAAC,UAAmB;IAC3C,MAAM,SAAS,GAAG,UAAqD,CAAA;IACvE,IACE,CAAC,SAAS;QACV,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,WAA4C,CAAC;QACpF,OAAO,SAAS,CAAC,eAAe,KAAK,SAAS,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAA;IACrG,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,OAGlD;IACC,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACpC,MAAM,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,eAAe,CAAA;IAE1D,MAAM,aAAa,GAAG;QACpB,QAAQ;QACR,iBAAiB;QACjB,kCAAkC;QAClC,kCAAkC;QAClC,wBAAwB;QACxB,yBAAyB;QACzB,uCAAuC;QACvC,qCAAqC;QACrC,mCAAmC;QACnC,GAAG,sBAAsB,CAAC,OAAO,CAAC,+BAA+B,EAAE,SAAS,EAAE,WAAW,CAAC;QAC1F,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;KACpE,CAAA;IACD,MAAM,cAAc,GAAG;QACrB,QAAQ;QACR,kCAAkC;QAClC,gCAAgC;QAChC,kCAAkC;QAClC,kCAAkC;QAClC,2BAA2B;QAC3B,sBAAsB;QACtB,oBAAoB;QACpB,2BAA2B;QAC3B,uCAAuC;QACvC,gCAAgC;QAChC,gCAAgC;QAChC,mCAAmC;QACnC,GAAG,sBAAsB,CAAC,OAAO,CAAC,+BAA+B,EAAE,UAAU,EAAE,YAAY,CAAC;QAC5F,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;KACvE,CAAA;IACD,MAAM,UAAU,GAAG;QACjB,oBAAoB;QACpB,iBAAiB;QACjB,mBAAmB;QACnB,wBAAwB;QACxB,oBAAoB;QACpB,cAAc,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACvC,kCAAkC;QAClC,uBAAuB;QACvB,mCAAmC;QACnC,eAAe,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACzC,8GAA8G,sBAAsB,CAClI,OAAO,CAAC,+BAA+B,EAAE,QAAQ,EACjD,UAAU,CACX,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;QACpB,qBAAqB;QACrB,yBAAyB;QACzB,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAA;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC9B,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAsC,EACtC,KAAoD;IAEpD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IACvB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACzC,IAAI,CAAC,oEAAoE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+DAA+D,CAAC,CAAA;QAC1F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IACF,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAA;IACrD,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,KAAa;IACrD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8CAA8C,CAAC,CAAA;IACzE,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAkC;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAChC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,mBAAmB,CAAC,CAAA;QAC3D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAA;QACrC,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,8CAA8C,CAAC,CAAA;QACtF,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACf,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,gBAAgB,KAAK,SAAS,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,YAAY;IACZ,MAAM;IACN,iCAAiC;IACjC,mBAAmB;IACnB,cAAc;CACf,CAAC,CAAA;AAEF,MAAM,UAAU,4BAA4B,CAC1C,OAAsC;IAEtC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IACtF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,4CAA4C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,sDAAsD,CACzH,CAAA;IACH,CAAC;IACD,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACpC,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,UAAU,CAAA;IAC3D,MAAM,iBAAiB,GACrB,OAAO,CAAC,iBAAiB,IAAI,mCAAmC,CAAA;IAClE,iBAAiB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAA;IACzD,oBAAoB,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAA;IAChD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAA;QAC3E,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QACvE,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI;QAC5B,CAAC,CAAC,GAAG,mBAAmB,sBAAsB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE;QACvF,CAAC,CAAC,mBAAmB,CAAA;IACvB,MAAM,OAAO,GAAG,WAAW,KAAK,SAAS,CAAA;IAEzC,OAAO;QACL,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE;QACzC,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,SAAS,EAAE;QACnD,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,iCAAiC,EAAE;QACpE;YACE,GAAG,EAAE,oBAAoB;YACzB,KAAK,EAAE,iBAAiB;SACzB;QACD;YACE,GAAG,EAAE,cAAc;YACnB,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,6BAA6B;SAC/E;QACD,GAAG,CAAC,eAAe;YACjB,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAC1D,CAAC,CAAC,EAAE,CAAC;QACP;YACE,GAAG,EAAE,eAAe;gBAClB,CAAC,CAAC,yBAAyB;gBAC3B,CAAC,CAAC,qCAAqC;YACzC,KAAK,EAAE,kCAAkC,CAAC,OAAO,CAAC;SACnD;QACD,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACtF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAsC;IAC7E,OAAO;QACL;YACE,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,4BAA4B,CAAC,OAAO,CAAC;SAC/C;KACF,CAAA;AACH,CAAC","sourcesContent":["/**\n * Brandlab security/response headers: one canonical header set for every\n * client site, emitted by `defineBrandlabNextConfig`.\n *\n * The deployment decides everything environment-specific:\n * - a production build (`next build`, on Vercel or locally) enforces the\n *   production Content Security Policy and sends HSTS;\n * - `next dev` sends a report-only development policy without HSTS;\n * - a Vercel Preview additionally sends `noindex, nofollow, noarchive` and\n *   `private, no-store`, so previews never reach search results or caches.\n *\n * The production X-Robots-Tag carries snippet-display controls only; per-page\n * indexation stays owned by Metadata.robots.\n */\n\nimport type {\n  BrandlabDeployment,\n  BrandlabDeploymentEnvironment,\n} from '@brandlab-digital/site-core/site'\n\nexport interface BrandlabHeader {\n  key: string\n  value: string\n}\n\nexport interface BrandlabHeaderRule {\n  source: string\n  headers: BrandlabHeader[]\n}\n\nexport const BRANDLAB_DEFAULT_PERMISSIONS_POLICY =\n  'camera=(), microphone=(), geolocation=()'\n\nexport const BRANDLAB_DEFAULT_X_ROBOTS_TAG =\n  'max-snippet:-1, max-image-preview:large, max-video-preview:-1'\n\nexport const BRANDLAB_PREVIEW_X_ROBOTS_TAG = 'noindex, nofollow, noarchive'\n\nexport const BRANDLAB_PREVIEW_CACHE_CONTROL = 'private, no-store, max-age=0'\n\nexport const BRANDLAB_HSTS_VALUE =\n  'max-age=31536000'\n\nexport interface BrandlabHstsExpansion {\n  includeSubDomains: true\n  preload?: true\n  /** Reviewed proof that every affected subdomain is HTTPS-ready. */\n  readinessEvidence: string\n}\n\nconst HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/\nconst PROTECTED_HEADER_NAMES = new Set([\n  'cache-control',\n  'content-security-policy',\n  'content-security-policy-report-only',\n  'x-frame-options',\n  'x-content-type-options',\n  'referrer-policy',\n  'permissions-policy',\n  'x-robots-tag',\n  'strict-transport-security',\n])\nconst DEPLOYMENT_ENVIRONMENTS = new Set<BrandlabDeploymentEnvironment>([\n  'production',\n  'preview',\n  'development',\n])\n\nexport interface BrandlabContentSecurityPolicyExtensions {\n  scriptSrc?: readonly string[]\n  connectSrc?: readonly string[]\n  frameSrc?: readonly string[]\n}\n\nexport interface BrandlabSecurityHeaderOptions {\n  /** From resolveBrandlabDeployment(process.env). */\n  deployment: BrandlabDeployment\n  hsts?: BrandlabHstsExpansion\n  /** Reviewed HTTPS origins needed by an approved project integration. */\n  contentSecurityPolicyExtensions?: BrandlabContentSecurityPolicyExtensions\n  /** Reviewed project exception, for example `geolocation=(self)` for a location feature. */\n  permissionsPolicy?: string\n  /** Reviewed project headers; they cannot replace a protected header. */\n  extraHeaders?: readonly BrandlabHeader[]\n}\n\nfunction assertDeployment(deployment: unknown): asserts deployment is BrandlabDeployment {\n  const candidate = deployment as Partial<BrandlabDeployment> | undefined\n  if (\n    !candidate ||\n    typeof candidate !== 'object' ||\n    !DEPLOYMENT_ENVIRONMENTS.has(candidate.environment as BrandlabDeploymentEnvironment) ||\n    typeof candidate.productionBuild !== 'boolean'\n  ) {\n    throw new Error('Header rules require the deployment from resolveBrandlabDeployment(process.env).')\n  }\n}\n\nexport function buildBrandlabContentSecurityPolicy(options: {\n  deployment: BrandlabDeployment\n  contentSecurityPolicyExtensions?: BrandlabContentSecurityPolicyExtensions\n}) {\n  assertDeployment(options.deployment)\n  const productionBuild = options.deployment.productionBuild\n\n  const scriptSources = [\n    \"'self'\",\n    \"'unsafe-inline'\",\n    'https://www.googletagmanager.com',\n    'https://www.googleadservices.com',\n    'https://www.google.com',\n    'https://www.gstatic.com',\n    'https://pagead2.googlesyndication.com',\n    'https://googleads.g.doubleclick.net',\n    'https://challenges.cloudflare.com',\n    ...normalizeCspExtensions(options.contentSecurityPolicyExtensions?.scriptSrc, 'scriptSrc'),\n    ...(productionBuild ? [] : [\"'unsafe-eval'\", 'http://localhost:*']),\n  ]\n  const connectSources = [\n    \"'self'\",\n    'https://www.google-analytics.com',\n    'https://*.google-analytics.com',\n    'https://www.googletagmanager.com',\n    'https://www.googleadservices.com',\n    'https://*.doubleclick.net',\n    'https://*.google.com',\n    'https://google.com',\n    'https://www.google.com.au',\n    'https://pagead2.googlesyndication.com',\n    'https://*.googletagmanager.com',\n    'https://*.analytics.google.com',\n    'https://challenges.cloudflare.com',\n    ...normalizeCspExtensions(options.contentSecurityPolicyExtensions?.connectSrc, 'connectSrc'),\n    ...(productionBuild ? [] : ['http://localhost:*', 'ws://localhost:*']),\n  ]\n  const directives = [\n    \"default-src 'self'\",\n    \"base-uri 'self'\",\n    \"object-src 'none'\",\n    \"frame-ancestors 'none'\",\n    \"form-action 'self'\",\n    `script-src ${scriptSources.join(' ')}`,\n    \"style-src 'self' 'unsafe-inline'\",\n    \"font-src 'self' data:\",\n    \"img-src 'self' data: blob: https:\",\n    `connect-src ${connectSources.join(' ')}`,\n    `frame-src 'self' https://challenges.cloudflare.com https://www.googletagmanager.com https://www.google.com ${normalizeCspExtensions(\n      options.contentSecurityPolicyExtensions?.frameSrc,\n      'frameSrc',\n    ).join(' ')}`.trim(),\n    \"manifest-src 'self'\",\n    \"worker-src 'self' blob:\",\n    ...(productionBuild ? ['upgrade-insecure-requests'] : []),\n  ]\n  return directives.join('; ')\n}\n\nfunction normalizeCspExtensions(\n  sources: readonly string[] | undefined,\n  field: keyof BrandlabContentSecurityPolicyExtensions,\n) {\n  if (!sources) return []\n  const normalized = sources.map((source) => {\n    const value = source.trim().toLowerCase()\n    if (!/^https:\\/\\/(?:\\*\\.)?[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?(?::\\d{1,5})?$/.test(value)) {\n      throw new Error(`${field} entries must be HTTPS origins without paths or CSP keywords.`)\n    }\n    return value\n  })\n  if (new Set(normalized).size !== normalized.length) {\n    throw new Error(`${field} entries must be unique.`)\n  }\n  return normalized\n}\n\nfunction assertHeaderValue(value: string, field: string) {\n  if (!value || value.length > 4_096 || /[\\u0000-\\u001F\\u007F]/.test(value)) {\n    throw new Error(`${field} must be a bounded single-line header value.`)\n  }\n}\n\nfunction validateExtraHeaders(headers: readonly BrandlabHeader[]) {\n  const names = new Set<string>()\n  headers.forEach((header, index) => {\n    if (!HEADER_NAME_PATTERN.test(header.key)) {\n      throw new Error(`extraHeaders[${index}].key is invalid.`)\n    }\n    const name = header.key.toLowerCase()\n    if (PROTECTED_HEADER_NAMES.has(name) || names.has(name)) {\n      throw new Error(`extraHeaders[${index}] duplicates a protected or existing header.`)\n    }\n    names.add(name)\n    assertHeaderValue(header.value, `extraHeaders[${index}].value`)\n  })\n}\n\nconst HEADER_OPTION_KEYS = new Set([\n  'deployment',\n  'hsts',\n  'contentSecurityPolicyExtensions',\n  'permissionsPolicy',\n  'extraHeaders',\n])\n\nexport function buildBrandlabSecurityHeaders(\n  options: BrandlabSecurityHeaderOptions,\n): BrandlabHeader[] {\n  if (!options || typeof options !== 'object') {\n    throw new TypeError('Header options are required.')\n  }\n  const unsupported = Object.keys(options).filter((key) => !HEADER_OPTION_KEYS.has(key))\n  if (unsupported.length > 0) {\n    throw new Error(\n      `Header options contain unsupported keys: ${unsupported.join(', ')}. The deployment decides CSP, HSTS and X-Robots-Tag.`,\n    )\n  }\n  assertDeployment(options.deployment)\n  const { environment, productionBuild } = options.deployment\n  const permissionsPolicy =\n    options.permissionsPolicy ?? BRANDLAB_DEFAULT_PERMISSIONS_POLICY\n  assertHeaderValue(permissionsPolicy, 'permissionsPolicy')\n  validateExtraHeaders(options.extraHeaders ?? [])\n  if (options.hsts) {\n    assertHeaderValue(options.hsts.readinessEvidence, 'hsts.readinessEvidence')\n    if (options.hsts.preload && !options.hsts.includeSubDomains) {\n      throw new Error('HSTS preload requires includeSubDomains readiness.')\n    }\n  }\n  const hstsValue = options.hsts\n    ? `${BRANDLAB_HSTS_VALUE}; includeSubDomains${options.hsts.preload ? '; preload' : ''}`\n    : BRANDLAB_HSTS_VALUE\n  const preview = environment === 'preview'\n\n  return [\n    { key: 'X-Frame-Options', value: 'DENY' },\n    { key: 'X-Content-Type-Options', value: 'nosniff' },\n    { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },\n    {\n      key: 'Permissions-Policy',\n      value: permissionsPolicy,\n    },\n    {\n      key: 'X-Robots-Tag',\n      value: preview ? BRANDLAB_PREVIEW_X_ROBOTS_TAG : BRANDLAB_DEFAULT_X_ROBOTS_TAG,\n    },\n    ...(productionBuild\n      ? [{ key: 'Strict-Transport-Security', value: hstsValue }]\n      : []),\n    {\n      key: productionBuild\n        ? 'Content-Security-Policy'\n        : 'Content-Security-Policy-Report-Only',\n      value: buildBrandlabContentSecurityPolicy(options),\n    },\n    ...(options.extraHeaders ?? []).map((header) => ({ ...header })),\n    ...(preview ? [{ key: 'Cache-Control', value: BRANDLAB_PREVIEW_CACHE_CONTROL }] : []),\n  ]\n}\n\nexport function buildBrandlabHeaderRules(options: BrandlabSecurityHeaderOptions): BrandlabHeaderRule[] {\n  return [\n    {\n      source: '/:path*',\n      headers: buildBrandlabSecurityHeaders(options),\n    },\n  ]\n}\n"]}

package/dist/instrumentation-client.d.ts

@@ -1,5 +1,6 @@
 import { type ContactAttributionSummary } from '@brandlab-digital/site-core/contact';
-export type PhoneCallLocation = 'header' | 'footer' | 'hero' | 'cta' | 'fab' | 'contact' | 'location' | 'page';
+import { type BrandlabAnalytics, type PhoneCallPlacement } from './analytics.js';
+export type PhoneCallLocation = PhoneCallPlacement;
 export interface LastPhoneCallEvent {
     key: string;
     at: number;
@@ -17,6 +18,13 @@ export declare function shouldTrackPhoneCallClick(options: {
 export declare function persistInitialLanding(win?: Window): void;
 export declare function getInitialLandingPath(win?: Window): string | undefined;
 export declare function getInitialContactAttribution(win?: Window): ContactAttributionSummary;
+/**
+ * Placement of a telephone link: its own `data-phone-location`, then a
+ * `<header>` or `<footer>` ancestor, then the nearest ancestor declaring a
+ * valid `data-phone-location` (for example a hero or call-to-action section),
+ * otherwise `page`. Unrecognised values are ignored, so every tap still
+ * produces exactly one event.
+ */
 export declare function getPhoneCallLocation(link: HTMLAnchorElement): PhoneCallLocation;
 export declare function installPhoneClickListener(options: {
     trackPhoneLinkClick: (context: {
@@ -27,4 +35,16 @@ export declare function installPhoneClickListener(options: {
     win?: Window;
     dedupeWindowMs?: number;
 }): () => void;
+/**
+ * The whole of `src/instrumentation-client.ts`:
+ * `installBrandlabInstrumentation(analytics)`. Stores the privacy-safe landing
+ * path and visit source for contact attribution, and installs the single
+ * telephone-link listener that sends one `phone_link_click` per tap (rapid
+ * repeats of the same link are de-duplicated). Installing twice in one window
+ * is a no-op; the returned function removes the listener.
+ */
+export declare function installBrandlabInstrumentation(analytics: Pick<BrandlabAnalytics, 'trackPhoneLinkClick'>, options?: {
+    win?: Window;
+    dedupeWindowMs?: number;
+}): () => void;
 //# sourceMappingURL=instrumentation-client.d.ts.map

package/dist/instrumentation-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instrumentation-client.d.ts","sourceRoot":"","sources":["../src/instrumentation-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,qCAAqC,CAAA;AAM5C,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,KAAK,GACL,KAAK,GACL,SAAS,GACT,UAAU,GACV,MAAM,CAAA;AAEV,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,EAAE,EAAE,MAAM,CAAA;CACX;AAED,eAAO,MAAM,8BAA8B,6BAA6B,CAAA;AACxE,eAAO,MAAM,mCAAmC,OAAO,CAAA;AAEvD,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,UAe9E;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAEtE;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,CAAC,EAAE,kBAAkB,CAAA;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,WAOA;AAED,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAe,QAgCzD;AAED,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAe,sBAOzD;AAED,wBAAgB,4BAA4B,CAAC,GAAG,GAAE,MAAe,GAAG,yBAAyB,CAkB5F;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,iBAAiB,CAU/E;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,mBAAmB,EAAE,CAAC,OAAO,EAAE;QAC7B,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,EAAE,iBAAiB,CAAA;QAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAC5B,KAAK,IAAI,CAAA;IACV,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,cA4CA"}
+{"version":3,"file":"instrumentation-client.d.ts","sourceRoot":"","sources":["../src/instrumentation-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACxB,MAAM,gBAAgB,CAAA;AAMvB,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,CAAA;AAElD,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,EAAE,EAAE,MAAM,CAAA;CACX;AAED,eAAO,MAAM,8BAA8B,6BAA6B,CAAA;AACxE,eAAO,MAAM,mCAAmC,OAAO,CAAA;AAEvD,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,UAe9E;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAEtE;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,CAAC,EAAE,kBAAkB,CAAA;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,WAOA;AAED,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAe,QAgCzD;AAED,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAe,sBAOzD;AAED,wBAAgB,4BAA4B,CAAC,GAAG,GAAE,MAAe,GAAG,yBAAyB,CAkB5F;AASD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,iBAAiB,CAc/E;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,mBAAmB,EAAE,CAAC,OAAO,EAAE;QAC7B,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,EAAE,iBAAiB,CAAA;QAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAC5B,KAAK,IAAI,CAAA;IACV,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,cA4CA;AAID;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,IAAI,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,EACzD,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAO,GACtD,MAAM,IAAI,CA2BZ"}