@brandlab-digital/site-next 2.1.0 → 3.1.0

package/dist/contact/testing.js

@@ -1,2 +1,29 @@
+import { defineContactContract } from '@brandlab-digital/site-core/contact';
+import { leadBindingFor } from '../lead-registry.js';
+import { reportAcceptedLead } from '../lead-reporting.js';
+import { CONTACT_CONFIRMATION_ID_PATTERN } from './shared.js';
 export { buildContactEmailSubject, escapeContactEmailHtml, renderContactEmail, sanitizeContactEmailSubject, } from './email.js';
+/**
+ * Records exactly what useBrandlabContactForm sends for one accepted enquiry
+ * on the production deployment, without a browser: the GA4 contact_form event
+ * and, when the contract declares Google Ads, the form conversion. Use it to
+ * pin a site's declared lead reporting in its own tests.
+ */
+export function recordBrandlabContactLead(input) {
+    const lead = leadBindingFor(input.analytics);
+    if (!lead)
+        throw new TypeError('analytics must be the binding returned by defineBrandlabAnalytics.');
+    if (!CONTACT_CONFIRMATION_ID_PATTERN.test(input.confirmationId)) {
+        throw new TypeError('confirmationId must be 64 lowercase hexadecimal characters.');
+    }
+    const contract = defineContactContract(input.contract);
+    const calls = [];
+    const outcome = reportAcceptedLead(lead, { ok: true, accepted: true, trackConversion: true, confirmationId: input.confirmationId }, {
+        pagePath: input.pagePath,
+        formData: input.formData,
+        fieldRoles: { fields: contract.fields.map((field) => ({ name: field.key, role: field.role })) },
+        adUserDataConsent: input.adUserDataConsent === true,
+    }, { enabled: true, gtag: (...args) => void calls.push(args) });
+    return { calls, ...outcome };
+}
 //# sourceMappingURL=testing.js.map

package/dist/contact/testing.js.map

@@ -1 +1 @@
-{"version":3,"file":"testing.js","sourceRoot":"","sources":["../../src/contact/testing.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAClB,2BAA2B,GAG5B,MAAM,YAAY,CAAA","sourcesContent":["export {\n  buildContactEmailSubject,\n  escapeContactEmailHtml,\n  renderContactEmail,\n  sanitizeContactEmailSubject,\n  type RenderContactEmailInput,\n  type RenderedContactEmail,\n} from './email.js'\n"]}
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../../src/contact/testing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAgC,MAAM,qCAAqC,CAAA;AAEzG,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAA;AAE7D,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAClB,2BAA2B,GAG5B,MAAM,YAAY,CAAA;AAwBnB;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAqC;IAC7E,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAC5C,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,oEAAoE,CAAC,CAAA;IACpG,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAA;IACpF,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACtD,MAAM,KAAK,GAAgB,EAAE,CAAA;IAC7B,MAAM,OAAO,GAAG,kBAAkB,CAChC,IAAI,EACJ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,EACzF;QACE,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE;QAC/F,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,KAAK,IAAI;KACpD,EACD,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvE,CAAA;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAA;AAC9B,CAAC","sourcesContent":["import { defineContactContract, type BrandlabContactContract } from '@brandlab-digital/site-core/contact'\nimport type { BrandlabAnalytics } from '../analytics.js'\nimport { leadBindingFor } from '../lead-registry.js'\nimport { reportAcceptedLead } from '../lead-reporting.js'\nimport { CONTACT_CONFIRMATION_ID_PATTERN } from './shared.js'\n\nexport {\n  buildContactEmailSubject,\n  escapeContactEmailHtml,\n  renderContactEmail,\n  sanitizeContactEmailSubject,\n  type RenderContactEmailInput,\n  type RenderedContactEmail,\n} from './email.js'\n\nexport interface RecordBrandlabContactLeadInput {\n  /** The site's defineBrandlabAnalytics binding. */\n  analytics: BrandlabAnalytics\n  /** The site's contact contract (its email and phone roles feed Enhanced Conversions). */\n  contract: BrandlabContactContract\n  /** The form's pagePath, as useBrandlabContactForm receives it. */\n  pagePath: string\n  /** The accepted enquiry's fields, including any that onSubmitStart adds. */\n  formData: FormData\n  /** The provider confirmation ID (64 lowercase hex characters). */\n  confirmationId: string\n  adUserDataConsent?: boolean\n}\n\nexport interface RecordedBrandlabContactLead {\n  /** Every gtag call, in order, that the accepted enquiry sends on the production deployment. */\n  calls: unknown[][]\n  ga4Sent: boolean\n  enhancedConversionSent: boolean\n  adsConversionSent: boolean\n}\n\n/**\n * Records exactly what useBrandlabContactForm sends for one accepted enquiry\n * on the production deployment, without a browser: the GA4 contact_form event\n * and, when the contract declares Google Ads, the form conversion. Use it to\n * pin a site's declared lead reporting in its own tests.\n */\nexport function recordBrandlabContactLead(input: RecordBrandlabContactLeadInput): RecordedBrandlabContactLead {\n  const lead = leadBindingFor(input.analytics)\n  if (!lead) throw new TypeError('analytics must be the binding returned by defineBrandlabAnalytics.')\n  if (!CONTACT_CONFIRMATION_ID_PATTERN.test(input.confirmationId)) {\n    throw new TypeError('confirmationId must be 64 lowercase hexadecimal characters.')\n  }\n  const contract = defineContactContract(input.contract)\n  const calls: unknown[][] = []\n  const outcome = reportAcceptedLead(\n    lead,\n    { ok: true, accepted: true, trackConversion: true, confirmationId: input.confirmationId },\n    {\n      pagePath: input.pagePath,\n      formData: input.formData,\n      fieldRoles: { fields: contract.fields.map((field) => ({ name: field.key, role: field.role })) },\n      adUserDataConsent: input.adUserDataConsent === true,\n    },\n    { enabled: true, gtag: (...args: unknown[]) => void calls.push(args) },\n  )\n  return { calls, ...outcome }\n}\n"]}

package/dist/google-tag-plan.d.ts

@@ -1,4 +1,4 @@
-import { type BrandlabAnalyticsContract } from '@brandlab-digital/site-core/analytics';
+/** Supplied by `defineBrandlabAnalytics(...).googleTag`. */
 export interface BrandlabGoogleTagConfig {
     enabled: boolean;
     measurementId?: string | null;
@@ -12,8 +12,5 @@ export interface BrandlabGoogleTagPlan {
     destinations: readonly string[];
     websiteCallDestination: string | null;
 }
-export declare function resolveBrandlabGoogleTagConfig(contract: BrandlabAnalyticsContract, environment: Readonly<Record<string, string | undefined>>, options: {
-    enabled: boolean;
-}): BrandlabGoogleTagConfig;
 export declare function createBrandlabGoogleTagPlan(config: BrandlabGoogleTagConfig, phoneNumber?: string | null): BrandlabGoogleTagPlan | null;
 //# sourceMappingURL=google-tag-plan.d.ts.map

package/dist/google-tag-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google-tag-plan.d.ts","sourceRoot":"","sources":["../src/google-tag-plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uCAAuC,CAAA;AAE9C,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,mCAAmC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACpD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAA;CACtC;AAKD,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,yBAAyB,EACnC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EACzD,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAC5B,uBAAuB,CAYzB;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,uBAAuB,EAC/B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAC1B,qBAAqB,GAAG,IAAI,CA2C9B"}
+{"version":3,"file":"google-tag-plan.d.ts","sourceRoot":"","sources":["../src/google-tag-plan.ts"],"names":[],"mappings":"AAEA,4DAA4D;AAC5D,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,mCAAmC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACpD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAA;CACtC;AAKD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,uBAAuB,EAC/B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAC1B,qBAAqB,GAAG,IAAI,CA2C9B"}

package/dist/google-tag-plan.js

@@ -1,19 +1,6 @@
-import { defineAnalyticsContract, getGoogleAdsWebsiteCallSendTo, } from '@brandlab-digital/site-core/analytics';
+import { getGoogleAdsWebsiteCallSendTo } from '@brandlab-digital/site-core/analytics';
 const GA4_MEASUREMENT_ID_PATTERN = /^G-[A-Z0-9]{4,20}$/i;
 const GOOGLE_ADS_CONVERSION_ID_PATTERN = /^(?:AW-)?\d{6,20}$/;
-export function resolveBrandlabGoogleTagConfig(contract, environment, options) {
-    defineAnalyticsContract(contract);
-    return {
-        enabled: options.enabled,
-        measurementId: environment[contract.measurementIdEnv],
-        googleAdsConversionId: contract.googleAds
-            ? environment[contract.googleAds.conversionIdEnv]
-            : undefined,
-        googleAdsWebsiteCallConversionLabel: contract.googleAds?.websiteCalls
-            ? environment[contract.googleAds.websiteCalls.conversionLabelEnv]
-            : undefined,
-    };
-}
 export function createBrandlabGoogleTagPlan(config, phoneNumber) {
     if (!config.enabled)
         return null;

package/dist/google-tag-plan.js.map

@@ -1 +1 @@
-{"version":3,"file":"google-tag-plan.js","sourceRoot":"","sources":["../src/google-tag-plan.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,6BAA6B,GAE9B,MAAM,uCAAuC,CAAA;AAiB9C,MAAM,0BAA0B,GAAG,qBAAqB,CAAA;AACxD,MAAM,gCAAgC,GAAG,oBAAoB,CAAA;AAE7D,MAAM,UAAU,8BAA8B,CAC5C,QAAmC,EACnC,WAAyD,EACzD,OAA6B;IAE7B,uBAAuB,CAAC,QAAQ,CAAC,CAAA;IACjC,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,aAAa,EAAE,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACrD,qBAAqB,EAAE,QAAQ,CAAC,SAAS;YACvC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC;YACjD,CAAC,CAAC,SAAS;QACb,mCAAmC,EAAE,QAAQ,CAAC,SAAS,EAAE,YAAY;YACnE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,kBAAkB,CAAC;YACjE,CAAC,CAAC,SAAS;KACd,CAAA;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,MAA+B,EAC/B,WAA2B;IAE3B,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAChC,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;IAC9D,MAAM,qBAAqB,GAAG,0BAA0B,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAA;IACtF,MAAM,QAAQ,GAAG,aAAa,IAAI,qBAAqB,CAAA;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAE1B,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;YAC/B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC,CAAC,CAAA;IACH,MAAM,YAAY,GAAG,0BAA0B,CAAC,WAAW,CAAC,CAAA;IAC5D,MAAM,sBAAsB,GAAG,YAAY;QACzC,CAAC,CAAC,6BAA6B,CAAC;YAC5B,YAAY,EAAE,qBAAqB;YACnC,eAAe,EAAE,MAAM,CAAC,mCAAmC;SAC5D,CAAC,IAAI,IAAI;QACZ,CAAC,CAAC,IAAI,CAAA;IACR,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CACrC,CAAC,WAAW,EAAE,EAAE,CAAC,yBAAyB,QAAQ,CAAC,WAAW,CAAC,IAAI,CACpE,CAAA;IACD,IAAI,sBAAsB,IAAI,YAAY,EAAE,CAAC;QAC3C,cAAc,CAAC,IAAI,CACjB,yBAAyB,QAAQ,CAAC,sBAAsB,CAAC,KAAK,QAAQ,CAAC;YACrE,uBAAuB,EAAE,YAAY;SACtC,CAAC,IAAI,CACP,CAAA;IACH,CAAC;IAED,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,+CAA+C,kBAAkB,CAAC,QAAQ,CAAC,EAAE;QACrF,YAAY,EAAE;YACZ,4CAA4C;YAC5C,6EAA6E;YAC7E,yFAAyF;YACzF,sCAAsC;YACtC,gCAAgC;YAChC,GAAG,cAAc;SAClB,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,YAAY;QACZ,sBAAsB;KACvB,CAAA;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAgC;IAC1D,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAA;IAChC,OAAO,UAAU,IAAI,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;QAC9D,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;QAC1B,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAgC;IAClE,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAA;IAChC,IAAI,CAAC,UAAU,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAA;IACvF,OAAO,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,UAAU,EAAE,CAAA;AACvE,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAgC;IAClE,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,CAAA;IACnD,OAAO,UAAU;QACf,UAAU,CAAC,MAAM,IAAI,EAAE;QACvB,MAAM,CAAC,MAAM,IAAI,CAAC;QAClB,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC;QAClC,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACzB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;AAClC,CAAC","sourcesContent":["import {\n  defineAnalyticsContract,\n  getGoogleAdsWebsiteCallSendTo,\n  type BrandlabAnalyticsContract,\n} from '@brandlab-digital/site-core/analytics'\n\nexport interface BrandlabGoogleTagConfig {\n  enabled: boolean\n  measurementId?: string | null\n  googleAdsConversionId?: string | null\n  googleAdsWebsiteCallConversionLabel?: string | null\n}\n\nexport interface BrandlabGoogleTagPlan {\n  loaderId: string\n  source: string\n  inlineScript: string\n  destinations: readonly string[]\n  websiteCallDestination: string | null\n}\n\nconst GA4_MEASUREMENT_ID_PATTERN = /^G-[A-Z0-9]{4,20}$/i\nconst GOOGLE_ADS_CONVERSION_ID_PATTERN = /^(?:AW-)?\\d{6,20}$/\n\nexport function resolveBrandlabGoogleTagConfig(\n  contract: BrandlabAnalyticsContract,\n  environment: Readonly<Record<string, string | undefined>>,\n  options: { enabled: boolean },\n): BrandlabGoogleTagConfig {\n  defineAnalyticsContract(contract)\n  return {\n    enabled: options.enabled,\n    measurementId: environment[contract.measurementIdEnv],\n    googleAdsConversionId: contract.googleAds\n      ? environment[contract.googleAds.conversionIdEnv]\n      : undefined,\n    googleAdsWebsiteCallConversionLabel: contract.googleAds?.websiteCalls\n      ? environment[contract.googleAds.websiteCalls.conversionLabelEnv]\n      : undefined,\n  }\n}\n\nexport function createBrandlabGoogleTagPlan(\n  config: BrandlabGoogleTagConfig,\n  phoneNumber?: string | null,\n): BrandlabGoogleTagPlan | null {\n  if (!config.enabled) return null\n  const measurementId = validMeasurementId(config.measurementId)\n  const googleAdsConversionId = validGoogleAdsConversionId(config.googleAdsConversionId)\n  const loaderId = measurementId ?? googleAdsConversionId\n  if (!loaderId) return null\n\n  const destinations = [...new Set([\n    ...(measurementId ? [measurementId] : []),\n    ...(googleAdsConversionId ? [googleAdsConversionId] : []),\n  ])]\n  const displayPhone = safeDisplayedBusinessPhone(phoneNumber)\n  const websiteCallDestination = displayPhone\n    ? getGoogleAdsWebsiteCallSendTo({\n        conversionId: googleAdsConversionId,\n        conversionLabel: config.googleAdsWebsiteCallConversionLabel,\n      }) ?? null\n    : null\n  const configCommands = destinations.map(\n    (destination) => `window.gtag('config', ${safeJson(destination)});`,\n  )\n  if (websiteCallDestination && displayPhone) {\n    configCommands.push(\n      `window.gtag('config', ${safeJson(websiteCallDestination)}, ${safeJson({\n        phone_conversion_number: displayPhone,\n      })});`,\n    )\n  }\n\n  return {\n    loaderId,\n    source: `https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(loaderId)}`,\n    inlineScript: [\n      'window.dataLayer = window.dataLayer || [];',\n      'window.gtag = window.gtag || function(){window.dataLayer.push(arguments);};',\n      \"window.gtag('consent', 'default', {ad_user_data:'denied',ad_personalization:'denied'});\",\n      \"window.gtag('set', 'user_data', {});\",\n      \"window.gtag('js', new Date());\",\n      ...configCommands,\n    ].join('\\n'),\n    destinations,\n    websiteCallDestination,\n  }\n}\n\nfunction validMeasurementId(value: string | null | undefined) {\n  const normalized = value?.trim()\n  return normalized && GA4_MEASUREMENT_ID_PATTERN.test(normalized)\n    ? normalized.toUpperCase()\n    : undefined\n}\n\nfunction validGoogleAdsConversionId(value: string | null | undefined) {\n  const normalized = value?.trim()\n  if (!normalized || !GOOGLE_ADS_CONVERSION_ID_PATTERN.test(normalized)) return undefined\n  return normalized.startsWith('AW-') ? normalized : `AW-${normalized}`\n}\n\nfunction safeDisplayedBusinessPhone(value: string | null | undefined) {\n  const normalized = value?.trim()\n  const digits = normalized?.replace(/\\D/g, '') ?? ''\n  return normalized &&\n    normalized.length <= 32 &&\n    digits.length >= 6 &&\n    /^[0-9+().\\s-]+$/.test(normalized)\n    ? normalized\n    : undefined\n}\n\nfunction safeJson(value: unknown) {\n  return JSON.stringify(value)\n    .replace(/</g, '\\\\u003c')\n    .replace(/>/g, '\\\\u003e')\n    .replace(/&/g, '\\\\u0026')\n    .replace(/\\u2028/g, '\\\\u2028')\n    .replace(/\\u2029/g, '\\\\u2029')\n}\n"]}
+{"version":3,"file":"google-tag-plan.js","sourceRoot":"","sources":["../src/google-tag-plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAA;AAkBrF,MAAM,0BAA0B,GAAG,qBAAqB,CAAA;AACxD,MAAM,gCAAgC,GAAG,oBAAoB,CAAA;AAE7D,MAAM,UAAU,2BAA2B,CACzC,MAA+B,EAC/B,WAA2B;IAE3B,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAChC,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;IAC9D,MAAM,qBAAqB,GAAG,0BAA0B,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAA;IACtF,MAAM,QAAQ,GAAG,aAAa,IAAI,qBAAqB,CAAA;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAE1B,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;YAC/B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC,CAAC,CAAA;IACH,MAAM,YAAY,GAAG,0BAA0B,CAAC,WAAW,CAAC,CAAA;IAC5D,MAAM,sBAAsB,GAAG,YAAY;QACzC,CAAC,CAAC,6BAA6B,CAAC;YAC5B,YAAY,EAAE,qBAAqB;YACnC,eAAe,EAAE,MAAM,CAAC,mCAAmC;SAC5D,CAAC,IAAI,IAAI;QACZ,CAAC,CAAC,IAAI,CAAA;IACR,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CACrC,CAAC,WAAW,EAAE,EAAE,CAAC,yBAAyB,QAAQ,CAAC,WAAW,CAAC,IAAI,CACpE,CAAA;IACD,IAAI,sBAAsB,IAAI,YAAY,EAAE,CAAC;QAC3C,cAAc,CAAC,IAAI,CACjB,yBAAyB,QAAQ,CAAC,sBAAsB,CAAC,KAAK,QAAQ,CAAC;YACrE,uBAAuB,EAAE,YAAY;SACtC,CAAC,IAAI,CACP,CAAA;IACH,CAAC;IAED,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,+CAA+C,kBAAkB,CAAC,QAAQ,CAAC,EAAE;QACrF,YAAY,EAAE;YACZ,4CAA4C;YAC5C,6EAA6E;YAC7E,yFAAyF;YACzF,sCAAsC;YACtC,gCAAgC;YAChC,GAAG,cAAc;SAClB,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,YAAY;QACZ,sBAAsB;KACvB,CAAA;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAgC;IAC1D,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAA;IAChC,OAAO,UAAU,IAAI,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;QAC9D,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;QAC1B,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAgC;IAClE,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAA;IAChC,IAAI,CAAC,UAAU,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAA;IACvF,OAAO,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,UAAU,EAAE,CAAA;AACvE,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAgC;IAClE,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,CAAA;IACnD,OAAO,UAAU;QACf,UAAU,CAAC,MAAM,IAAI,EAAE;QACvB,MAAM,CAAC,MAAM,IAAI,CAAC;QAClB,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC;QAClC,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACzB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;AAClC,CAAC","sourcesContent":["import { getGoogleAdsWebsiteCallSendTo } from '@brandlab-digital/site-core/analytics'\n\n/** Supplied by `defineBrandlabAnalytics(...).googleTag`. */\nexport interface BrandlabGoogleTagConfig {\n  enabled: boolean\n  measurementId?: string | null\n  googleAdsConversionId?: string | null\n  googleAdsWebsiteCallConversionLabel?: string | null\n}\n\nexport interface BrandlabGoogleTagPlan {\n  loaderId: string\n  source: string\n  inlineScript: string\n  destinations: readonly string[]\n  websiteCallDestination: string | null\n}\n\nconst GA4_MEASUREMENT_ID_PATTERN = /^G-[A-Z0-9]{4,20}$/i\nconst GOOGLE_ADS_CONVERSION_ID_PATTERN = /^(?:AW-)?\\d{6,20}$/\n\nexport function createBrandlabGoogleTagPlan(\n  config: BrandlabGoogleTagConfig,\n  phoneNumber?: string | null,\n): BrandlabGoogleTagPlan | null {\n  if (!config.enabled) return null\n  const measurementId = validMeasurementId(config.measurementId)\n  const googleAdsConversionId = validGoogleAdsConversionId(config.googleAdsConversionId)\n  const loaderId = measurementId ?? googleAdsConversionId\n  if (!loaderId) return null\n\n  const destinations = [...new Set([\n    ...(measurementId ? [measurementId] : []),\n    ...(googleAdsConversionId ? [googleAdsConversionId] : []),\n  ])]\n  const displayPhone = safeDisplayedBusinessPhone(phoneNumber)\n  const websiteCallDestination = displayPhone\n    ? getGoogleAdsWebsiteCallSendTo({\n        conversionId: googleAdsConversionId,\n        conversionLabel: config.googleAdsWebsiteCallConversionLabel,\n      }) ?? null\n    : null\n  const configCommands = destinations.map(\n    (destination) => `window.gtag('config', ${safeJson(destination)});`,\n  )\n  if (websiteCallDestination && displayPhone) {\n    configCommands.push(\n      `window.gtag('config', ${safeJson(websiteCallDestination)}, ${safeJson({\n        phone_conversion_number: displayPhone,\n      })});`,\n    )\n  }\n\n  return {\n    loaderId,\n    source: `https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(loaderId)}`,\n    inlineScript: [\n      'window.dataLayer = window.dataLayer || [];',\n      'window.gtag = window.gtag || function(){window.dataLayer.push(arguments);};',\n      \"window.gtag('consent', 'default', {ad_user_data:'denied',ad_personalization:'denied'});\",\n      \"window.gtag('set', 'user_data', {});\",\n      \"window.gtag('js', new Date());\",\n      ...configCommands,\n    ].join('\\n'),\n    destinations,\n    websiteCallDestination,\n  }\n}\n\nfunction validMeasurementId(value: string | null | undefined) {\n  const normalized = value?.trim()\n  return normalized && GA4_MEASUREMENT_ID_PATTERN.test(normalized)\n    ? normalized.toUpperCase()\n    : undefined\n}\n\nfunction validGoogleAdsConversionId(value: string | null | undefined) {\n  const normalized = value?.trim()\n  if (!normalized || !GOOGLE_ADS_CONVERSION_ID_PATTERN.test(normalized)) return undefined\n  return normalized.startsWith('AW-') ? normalized : `AW-${normalized}`\n}\n\nfunction safeDisplayedBusinessPhone(value: string | null | undefined) {\n  const normalized = value?.trim()\n  const digits = normalized?.replace(/\\D/g, '') ?? ''\n  return normalized &&\n    normalized.length <= 32 &&\n    digits.length >= 6 &&\n    /^[0-9+().\\s-]+$/.test(normalized)\n    ? normalized\n    : undefined\n}\n\nfunction safeJson(value: unknown) {\n  return JSON.stringify(value)\n    .replace(/</g, '\\\\u003c')\n    .replace(/>/g, '\\\\u003e')\n    .replace(/&/g, '\\\\u0026')\n    .replace(/\\u2028/g, '\\\\u2028')\n    .replace(/\\u2029/g, '\\\\u2029')\n}\n"]}

package/dist/google-tag.d.ts

@@ -1,5 +1,5 @@
 import { type BrandlabGoogleTagConfig } from './google-tag-plan.js';
-export { createBrandlabGoogleTagPlan, resolveBrandlabGoogleTagConfig, } from './google-tag-plan.js';
+export { createBrandlabGoogleTagPlan } from './google-tag-plan.js';
 export type { BrandlabGoogleTagConfig, BrandlabGoogleTagPlan, } from './google-tag-plan.js';
 export interface BrandlabGoogleTagProps extends BrandlabGoogleTagConfig {
     /** Must match the verified public number exactly as it is rendered on the page. */
@@ -9,9 +9,10 @@ export interface BrandlabGoogleTagProps extends BrandlabGoogleTagConfig {
 /**
  * Shared Google tag and website-call forwarding-number snippet.
  *
- * Render this exactly once from the root layout. The enabled flag remains the
- * project consent/production gate; account-side conversion settings remain
- * outside website runtime.
+ * Render this exactly once from the root layout:
+ * `<BrandlabGoogleTag {...analytics.googleTag} phoneNumber={displayedPhone} />`.
+ * `analytics.googleTag.enabled` is true only on the production deployment;
+ * account-side conversion settings remain outside website runtime.
  */
 export declare function BrandlabGoogleTag(props: BrandlabGoogleTagProps): import("react/jsx-runtime").JSX.Element | null;
 //# sourceMappingURL=google-tag.d.ts.map

package/dist/google-tag.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google-tag.d.ts","sourceRoot":"","sources":["../src/google-tag.tsx"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,sBAAsB,CAAA;AAE7B,MAAM,WAAW,sBAAuB,SAAQ,uBAAuB;IACrE,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,kDAqB9D"}
+{"version":3,"file":"google-tag.d.ts","sourceRoot":"","sources":["../src/google-tag.tsx"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAA;AAClE,YAAY,EACV,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,sBAAsB,CAAA;AAE7B,MAAM,WAAW,sBAAuB,SAAQ,uBAAuB;IACrE,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,kDAqB9D"}

package/dist/google-tag.js

@@ -1,13 +1,14 @@
 import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 import Script from 'next/script';
 import { createBrandlabGoogleTagPlan, } from './google-tag-plan.js';
-export { createBrandlabGoogleTagPlan, resolveBrandlabGoogleTagConfig, } from './google-tag-plan.js';
+export { createBrandlabGoogleTagPlan } from './google-tag-plan.js';
 /**
  * Shared Google tag and website-call forwarding-number snippet.
  *
- * Render this exactly once from the root layout. The enabled flag remains the
- * project consent/production gate; account-side conversion settings remain
- * outside website runtime.
+ * Render this exactly once from the root layout:
+ * `<BrandlabGoogleTag {...analytics.googleTag} phoneNumber={displayedPhone} />`.
+ * `analytics.googleTag.enabled` is true only on the production deployment;
+ * account-side conversion settings remain outside website runtime.
  */
 export function BrandlabGoogleTag(props) {
     const plan = createBrandlabGoogleTagPlan(props, props.phoneNumber);

package/dist/google-tag.js.map

@@ -1 +1 @@
-{"version":3,"file":"google-tag.js","sourceRoot":"","sources":["../src/google-tag.tsx"],"names":[],"mappings":";AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EACL,2BAA2B,GAE5B,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,sBAAsB,CAAA;AAY7B;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA6B;IAC7D,MAAM,IAAI,GAAG,2BAA2B,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;IAClE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,OAAO,CACL,8BACE,KAAC,MAAM,IACL,EAAE,EAAC,4BAA4B,8BACN,QAAQ,EACjC,GAAG,EAAE,IAAI,CAAC,MAAM,EAChB,QAAQ,EAAC,kBAAkB,EAC3B,KAAK,EAAE,KAAK,CAAC,KAAK,GAClB,EACF,KAAC,MAAM,IACL,EAAE,EAAC,4BAA4B,8BACN,QAAQ,EACjC,QAAQ,EAAC,kBAAkB,EAC3B,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,uBAAuB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,GACtD,IACD,CACJ,CAAA;AACH,CAAC","sourcesContent":["import Script from 'next/script'\nimport {\n  createBrandlabGoogleTagPlan,\n  type BrandlabGoogleTagConfig,\n} from './google-tag-plan.js'\n\nexport {\n  createBrandlabGoogleTagPlan,\n  resolveBrandlabGoogleTagConfig,\n} from './google-tag-plan.js'\nexport type {\n  BrandlabGoogleTagConfig,\n  BrandlabGoogleTagPlan,\n} from './google-tag-plan.js'\n\nexport interface BrandlabGoogleTagProps extends BrandlabGoogleTagConfig {\n  /** Must match the verified public number exactly as it is rendered on the page. */\n  phoneNumber?: string | null\n  nonce?: string\n}\n\n/**\n * Shared Google tag and website-call forwarding-number snippet.\n *\n * Render this exactly once from the root layout. The enabled flag remains the\n * project consent/production gate; account-side conversion settings remain\n * outside website runtime.\n */\nexport function BrandlabGoogleTag(props: BrandlabGoogleTagProps) {\n  const plan = createBrandlabGoogleTagPlan(props, props.phoneNumber)\n  if (!plan) return null\n  return (\n    <>\n      <Script\n        id=\"brandlab-google-tag-loader\"\n        data-brandlab-google-tag=\"loader\"\n        src={plan.source}\n        strategy=\"afterInteractive\"\n        nonce={props.nonce}\n      />\n      <Script\n        id=\"brandlab-google-tag-config\"\n        data-brandlab-google-tag=\"config\"\n        strategy=\"afterInteractive\"\n        nonce={props.nonce}\n        dangerouslySetInnerHTML={{ __html: plan.inlineScript }}\n      />\n    </>\n  )\n}\n"]}
+{"version":3,"file":"google-tag.js","sourceRoot":"","sources":["../src/google-tag.tsx"],"names":[],"mappings":";AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EACL,2BAA2B,GAE5B,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAA;AAYlE;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA6B;IAC7D,MAAM,IAAI,GAAG,2BAA2B,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;IAClE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,OAAO,CACL,8BACE,KAAC,MAAM,IACL,EAAE,EAAC,4BAA4B,8BACN,QAAQ,EACjC,GAAG,EAAE,IAAI,CAAC,MAAM,EAChB,QAAQ,EAAC,kBAAkB,EAC3B,KAAK,EAAE,KAAK,CAAC,KAAK,GAClB,EACF,KAAC,MAAM,IACL,EAAE,EAAC,4BAA4B,8BACN,QAAQ,EACjC,QAAQ,EAAC,kBAAkB,EAC3B,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,uBAAuB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,GACtD,IACD,CACJ,CAAA;AACH,CAAC","sourcesContent":["import Script from 'next/script'\nimport {\n  createBrandlabGoogleTagPlan,\n  type BrandlabGoogleTagConfig,\n} from './google-tag-plan.js'\n\nexport { createBrandlabGoogleTagPlan } from './google-tag-plan.js'\nexport type {\n  BrandlabGoogleTagConfig,\n  BrandlabGoogleTagPlan,\n} from './google-tag-plan.js'\n\nexport interface BrandlabGoogleTagProps extends BrandlabGoogleTagConfig {\n  /** Must match the verified public number exactly as it is rendered on the page. */\n  phoneNumber?: string | null\n  nonce?: string\n}\n\n/**\n * Shared Google tag and website-call forwarding-number snippet.\n *\n * Render this exactly once from the root layout:\n * `<BrandlabGoogleTag {...analytics.googleTag} phoneNumber={displayedPhone} />`.\n * `analytics.googleTag.enabled` is true only on the production deployment;\n * account-side conversion settings remain outside website runtime.\n */\nexport function BrandlabGoogleTag(props: BrandlabGoogleTagProps) {\n  const plan = createBrandlabGoogleTagPlan(props, props.phoneNumber)\n  if (!plan) return null\n  return (\n    <>\n      <Script\n        id=\"brandlab-google-tag-loader\"\n        data-brandlab-google-tag=\"loader\"\n        src={plan.source}\n        strategy=\"afterInteractive\"\n        nonce={props.nonce}\n      />\n      <Script\n        id=\"brandlab-google-tag-config\"\n        data-brandlab-google-tag=\"config\"\n        strategy=\"afterInteractive\"\n        nonce={props.nonce}\n        dangerouslySetInnerHTML={{ __html: plan.inlineScript }}\n      />\n    </>\n  )\n}\n"]}

package/dist/headers.d.ts

@@ -1,20 +1,22 @@
 /**
- * Brandlab security/response headers (Brandlab Project Standard §2).
+ * Brandlab security/response headers: one canonical header set for every
+ * client site, emitted by `defineBrandlabNextConfig`.
  *
- * One canonical header set for every client site, composed into
- * `next.config.ts`:
+ * The deployment decides everything environment-specific:
+ * - a production build (`next build`, on Vercel or locally) enforces the
+ *   production Content Security Policy and sends HSTS;
+ * - `next dev` sends a report-only development policy without HSTS;
+ * - a Vercel Preview additionally sends `noindex, nofollow, noarchive` and
+ *   `private, no-store`, so previews never reach search results or caches.
  *
- *   async headers() {
- *     return buildBrandlabHeaderRules({
- *       isProduction,
- *       profile: 'next-local-service',
- *     })
- *   }
+ * The production X-Robots-Tag carries snippet-display controls only; per-page
+ * indexation stays owned by Metadata.robots.
  *
- * The X-Robots-Tag here carries snippet-display controls only; per-page
- * indexation stays owned by Metadata.robots (noindex pages override via
- * their <meta name="robots">).
+ * Declared public folders of static files (`staticAssetCache`) are served with
+ * `public, max-age=31536000, immutable` by production builds; Previews and
+ * `next dev` never cache them.
  */
+import type { BrandlabDeployment } from '@brandlab-digital/site-core/site';
 export interface BrandlabHeader {
     key: string;
     value: string;
@@ -23,11 +25,13 @@ export interface BrandlabHeaderRule {
     source: string;
     headers: BrandlabHeader[];
 }
-export declare const BRANDLAB_NEXT_HEADER_PROFILES: readonly ["next-local-service", "next-root-level"];
-export type BrandlabNextHeaderProfile = (typeof BRANDLAB_NEXT_HEADER_PROFILES)[number];
 export declare const BRANDLAB_DEFAULT_PERMISSIONS_POLICY = "camera=(), microphone=(), geolocation=()";
 export declare const BRANDLAB_DEFAULT_X_ROBOTS_TAG = "max-snippet:-1, max-image-preview:large, max-video-preview:-1";
+export declare const BRANDLAB_PREVIEW_X_ROBOTS_TAG = "noindex, nofollow, noarchive";
+export declare const BRANDLAB_PREVIEW_CACHE_CONTROL = "private, no-store, max-age=0";
 export declare const BRANDLAB_HSTS_VALUE = "max-age=31536000";
+/** Cache-Control for the declared static public folders on production builds. */
+export declare const BRANDLAB_STATIC_ASSET_CACHE_CONTROL = "public, max-age=31536000, immutable";
 export interface BrandlabHstsExpansion {
     includeSubDomains: true;
     preload?: true;
@@ -39,26 +43,49 @@ export interface BrandlabContentSecurityPolicyExtensions {
     connectSrc?: readonly string[];
     frameSrc?: readonly string[];
 }
-export type BrandlabContentSecurityPolicyMode = 'enforce' | 'report-only';
 export interface BrandlabSecurityHeaderOptions {
-    isProduction: boolean;
-    profile: BrandlabNextHeaderProfile;
-    permissionsPolicy?: string;
-    /** Pass null to omit the snippet-control header entirely. */
-    xRobotsTag?: string | null;
-    extraHeaders?: readonly BrandlabHeader[];
+    /** From resolveBrandlabDeployment(process.env). */
+    deployment: BrandlabDeployment;
     hsts?: BrandlabHstsExpansion;
-    contentSecurityPolicyMode?: BrandlabContentSecurityPolicyMode;
     /** Reviewed HTTPS origins needed by an approved project integration. */
     contentSecurityPolicyExtensions?: BrandlabContentSecurityPolicyExtensions;
+    /** Reviewed project exception, for example `geolocation=(self)` for a location feature. */
+    permissionsPolicy?: string;
+    /** Reviewed project headers; they cannot replace a protected header. */
+    extraHeaders?: readonly BrandlabHeader[];
 }
 export declare function buildBrandlabContentSecurityPolicy(options: {
-    isProduction: boolean;
-    profile: BrandlabNextHeaderProfile;
+    deployment: BrandlabDeployment;
     contentSecurityPolicyExtensions?: BrandlabContentSecurityPolicyExtensions;
 }): string;
 export declare function buildBrandlabSecurityHeaders(options: BrandlabSecurityHeaderOptions): BrandlabHeader[];
-export declare function buildBrandlabHeaderRules(options: BrandlabSecurityHeaderOptions & {
-    source?: string;
-}): BrandlabHeaderRule[];
+export interface BrandlabStaticAssetFolder {
+    /** The declared source, for example `/images/:path*`. */
+    source: string;
+    /** The public folder's path segments, for example `['images']`. */
+    folder: readonly string[];
+    /**
+     * The emitted rule's source: file names with an extension below the folder,
+     * such as `/images/:path(.+\.[A-Za-z0-9]+)`. The folder itself and
+     * extensionless paths, where a page would answer, never match.
+     */
+    fileSource: string;
+}
+/**
+ * Validates `staticAssetCache`: at most 10 public folders, each written as Next's
+ * source `/<folder>/:path*` (one to four literal segments, then one catch-all
+ * parameter, at most 100 characters). `/`, `/api`, `/_next` and `/_vercel` are
+ * rejected.
+ */
+export declare function parseBrandlabStaticAssetCache(sources: unknown): BrandlabStaticAssetFolder[];
+export interface BrandlabHeaderRuleOptions extends BrandlabSecurityHeaderOptions {
+    /**
+     * Public folders of static files that never change in place, for example
+     * `['/images/:path*', '/fonts/:path*']`: production builds serve their files with
+     * `public, max-age=31536000, immutable`. A file replaced under the same name stays
+     * cached in browsers for up to a year, so give a changed file a new name.
+     */
+    staticAssetCache?: readonly string[];
+}
+export declare function buildBrandlabHeaderRules(options: BrandlabHeaderRuleOptions): BrandlabHeaderRule[];
 //# sourceMappingURL=headers.d.ts.map

package/dist/headers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../src/headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,cAAc,EAAE,CAAA;CAC1B;AAED,eAAO,MAAM,6BAA6B,oDAGhC,CAAA;AAEV,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAA;AAEtF,eAAO,MAAM,mCAAmC,6CACJ,CAAA;AAE5C,eAAO,MAAM,6BAA6B,kEACuB,CAAA;AAEjE,eAAO,MAAM,mBAAmB,qBACZ,CAAA;AAEpB,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,IAAI,CAAA;IACvB,OAAO,CAAC,EAAE,IAAI,CAAA;IACd,mEAAmE;IACnE,iBAAiB,EAAE,MAAM,CAAA;CAC1B;AAcD,MAAM,WAAW,uCAAuC;IACtD,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC7B;AAED,MAAM,MAAM,iCAAiC,GAAG,SAAS,GAAG,aAAa,CAAA;AAEzE,MAAM,WAAW,6BAA6B;IAC5C,YAAY,EAAE,OAAO,CAAA;IACrB,OAAO,EAAE,yBAAyB,CAAA;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IACxC,IAAI,CAAC,EAAE,qBAAqB,CAAA;IAC5B,yBAAyB,CAAC,EAAE,iCAAiC,CAAA;IAC7D,wEAAwE;IACxE,+BAA+B,CAAC,EAAE,uCAAuC,CAAA;CAC1E;AAED,wBAAgB,kCAAkC,CAAC,OAAO,EAAE;IAC1D,YAAY,EAAE,OAAO,CAAA;IACrB,OAAO,EAAE,yBAAyB,CAAA;IAClC,+BAA+B,CAAC,EAAE,uCAAuC,CAAA;CAC1E,UAwDA;AAyCD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,6BAA6B,GACrC,cAAc,EAAE,CAmDlB;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,6BAA6B,GAAG;IAChF,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,GAAG,kBAAkB,EAAE,CAWvB"}
+{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../src/headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,kCAAkC,CAAA;AAEzC,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,cAAc,EAAE,CAAA;CAC1B;AAED,eAAO,MAAM,mCAAmC,6CACJ,CAAA;AAE5C,eAAO,MAAM,6BAA6B,kEACuB,CAAA;AAEjE,eAAO,MAAM,6BAA6B,iCAAiC,CAAA;AAE3E,eAAO,MAAM,8BAA8B,iCAAiC,CAAA;AAE5E,eAAO,MAAM,mBAAmB,qBACZ,CAAA;AAEpB,iFAAiF;AACjF,eAAO,MAAM,mCAAmC,wCAAwC,CAAA;AAExF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,IAAI,CAAA;IACvB,OAAO,CAAC,EAAE,IAAI,CAAA;IACd,mEAAmE;IACnE,iBAAiB,EAAE,MAAM,CAAA;CAC1B;AAoBD,MAAM,WAAW,uCAAuC;IACtD,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC7B;AAED,MAAM,WAAW,6BAA6B;IAC5C,mDAAmD;IACnD,UAAU,EAAE,kBAAkB,CAAA;IAC9B,IAAI,CAAC,EAAE,qBAAqB,CAAA;IAC5B,wEAAwE;IACxE,+BAA+B,CAAC,EAAE,uCAAuC,CAAA;IACzE,2FAA2F;IAC3F,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,wEAAwE;IACxE,YAAY,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;CACzC;AAcD,wBAAgB,kCAAkC,CAAC,OAAO,EAAE;IAC1D,UAAU,EAAE,kBAAkB,CAAA;IAC9B,+BAA+B,CAAC,EAAE,uCAAuC,CAAA;CAC1E,UAsDA;AAiDD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,6BAA6B,GACrC,cAAc,EAAE,CAmDlB;AAOD,MAAM,WAAW,yBAAyB;IACxC,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAA;IACd,mEAAmE;IACnE,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IACzB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,OAAO,GAAG,yBAAyB,EAAE,CA4B3F;AAED,MAAM,WAAW,yBAA0B,SAAQ,6BAA6B;IAC9E;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG,kBAAkB,EAAE,CAuBjG"}

package/dist/headers.js

@@ -1,29 +1,31 @@
 /**
- * Brandlab security/response headers (Brandlab Project Standard §2).
+ * Brandlab security/response headers: one canonical header set for every
+ * client site, emitted by `defineBrandlabNextConfig`.
  *
- * One canonical header set for every client site, composed into
- * `next.config.ts`:
+ * The deployment decides everything environment-specific:
+ * - a production build (`next build`, on Vercel or locally) enforces the
+ *   production Content Security Policy and sends HSTS;
+ * - `next dev` sends a report-only development policy without HSTS;
+ * - a Vercel Preview additionally sends `noindex, nofollow, noarchive` and
+ *   `private, no-store`, so previews never reach search results or caches.
  *
- *   async headers() {
- *     return buildBrandlabHeaderRules({
- *       isProduction,
- *       profile: 'next-local-service',
- *     })
- *   }
+ * The production X-Robots-Tag carries snippet-display controls only; per-page
+ * indexation stays owned by Metadata.robots.
  *
- * The X-Robots-Tag here carries snippet-display controls only; per-page
- * indexation stays owned by Metadata.robots (noindex pages override via
- * their <meta name="robots">).
+ * Declared public folders of static files (`staticAssetCache`) are served with
+ * `public, max-age=31536000, immutable` by production builds; Previews and
+ * `next dev` never cache them.
  */
-export const BRANDLAB_NEXT_HEADER_PROFILES = [
-    'next-local-service',
-    'next-root-level',
-];
 export const BRANDLAB_DEFAULT_PERMISSIONS_POLICY = 'camera=(), microphone=(), geolocation=()';
 export const BRANDLAB_DEFAULT_X_ROBOTS_TAG = 'max-snippet:-1, max-image-preview:large, max-video-preview:-1';
+export const BRANDLAB_PREVIEW_X_ROBOTS_TAG = 'noindex, nofollow, noarchive';
+export const BRANDLAB_PREVIEW_CACHE_CONTROL = 'private, no-store, max-age=0';
 export const BRANDLAB_HSTS_VALUE = 'max-age=31536000';
+/** Cache-Control for the declared static public folders on production builds. */
+export const BRANDLAB_STATIC_ASSET_CACHE_CONTROL = 'public, max-age=31536000, immutable';
 const HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 const PROTECTED_HEADER_NAMES = new Set([
+    'cache-control',
     'content-security-policy',
     'content-security-policy-report-only',
     'x-frame-options',
@@ -33,11 +35,23 @@ const PROTECTED_HEADER_NAMES = new Set([
     'x-robots-tag',
     'strict-transport-security',
 ]);
-export function buildBrandlabContentSecurityPolicy(options) {
-    const profile = options.profile;
-    if (!BRANDLAB_NEXT_HEADER_PROFILES.includes(profile)) {
-        throw new Error(`Unsupported Brandlab Next header profile "${profile}".`);
+const DEPLOYMENT_ENVIRONMENTS = new Set([
+    'production',
+    'preview',
+    'development',
+]);
+function assertDeployment(deployment) {
+    const candidate = deployment;
+    if (!candidate ||
+        typeof candidate !== 'object' ||
+        !DEPLOYMENT_ENVIRONMENTS.has(candidate.environment) ||
+        typeof candidate.productionBuild !== 'boolean') {
+        throw new Error('Header rules require the deployment from resolveBrandlabDeployment(process.env).');
     }
+}
+export function buildBrandlabContentSecurityPolicy(options) {
+    assertDeployment(options.deployment);
+    const productionBuild = options.deployment.productionBuild;
     const scriptSources = [
         "'self'",
         "'unsafe-inline'",
@@ -49,7 +63,7 @@ export function buildBrandlabContentSecurityPolicy(options) {
         'https://googleads.g.doubleclick.net',
         'https://challenges.cloudflare.com',
         ...normalizeCspExtensions(options.contentSecurityPolicyExtensions?.scriptSrc, 'scriptSrc'),
-        ...(options.isProduction ? [] : ["'unsafe-eval'", 'http://localhost:*']),
+        ...(productionBuild ? [] : ["'unsafe-eval'", 'http://localhost:*']),
     ];
     const connectSources = [
         "'self'",
@@ -66,7 +80,7 @@ export function buildBrandlabContentSecurityPolicy(options) {
         'https://*.analytics.google.com',
         'https://challenges.cloudflare.com',
         ...normalizeCspExtensions(options.contentSecurityPolicyExtensions?.connectSrc, 'connectSrc'),
-        ...(options.isProduction ? [] : ['http://localhost:*', 'ws://localhost:*']),
+        ...(productionBuild ? [] : ['http://localhost:*', 'ws://localhost:*']),
     ];
     const directives = [
         "default-src 'self'",
@@ -82,7 +96,7 @@ export function buildBrandlabContentSecurityPolicy(options) {
         `frame-src 'self' https://challenges.cloudflare.com https://www.googletagmanager.com https://www.google.com ${normalizeCspExtensions(options.contentSecurityPolicyExtensions?.frameSrc, 'frameSrc').join(' ')}`.trim(),
         "manifest-src 'self'",
         "worker-src 'self' blob:",
-        ...(options.isProduction ? ['upgrade-insecure-requests'] : []),
+        ...(productionBuild ? ['upgrade-insecure-requests'] : []),
     ];
     return directives.join('; ');
 }
@@ -120,15 +134,25 @@ function validateExtraHeaders(headers) {
         assertHeaderValue(header.value, `extraHeaders[${index}].value`);
     });
 }
+const HEADER_OPTION_KEYS = new Set([
+    'deployment',
+    'hsts',
+    'contentSecurityPolicyExtensions',
+    'permissionsPolicy',
+    'extraHeaders',
+]);
 export function buildBrandlabSecurityHeaders(options) {
-    if (typeof options.isProduction !== 'boolean') {
-        throw new Error('isProduction must be boolean.');
+    if (!options || typeof options !== 'object') {
+        throw new TypeError('Header options are required.');
+    }
+    const unsupported = Object.keys(options).filter((key) => !HEADER_OPTION_KEYS.has(key));
+    if (unsupported.length > 0) {
+        throw new Error(`Header options contain unsupported keys: ${unsupported.join(', ')}. The deployment decides CSP, HSTS and X-Robots-Tag.`);
     }
-    const xRobotsTag = options.xRobotsTag === undefined ? BRANDLAB_DEFAULT_X_ROBOTS_TAG : options.xRobotsTag;
+    assertDeployment(options.deployment);
+    const { environment, productionBuild } = options.deployment;
     const permissionsPolicy = options.permissionsPolicy ?? BRANDLAB_DEFAULT_PERMISSIONS_POLICY;
     assertHeaderValue(permissionsPolicy, 'permissionsPolicy');
-    if (xRobotsTag !== null)
-        assertHeaderValue(xRobotsTag, 'xRobotsTag');
     validateExtraHeaders(options.extraHeaders ?? []);
     if (options.hsts) {
         assertHeaderValue(options.hsts.readinessEvidence, 'hsts.readinessEvidence');
@@ -139,19 +163,7 @@ export function buildBrandlabSecurityHeaders(options) {
     const hstsValue = options.hsts
         ? `${BRANDLAB_HSTS_VALUE}; includeSubDomains${options.hsts.preload ? '; preload' : ''}`
         : BRANDLAB_HSTS_VALUE;
-    const cspMode = options.contentSecurityPolicyMode ?? (options.isProduction ? 'enforce' : 'report-only');
-    if (!new Set(['enforce', 'report-only']).has(cspMode)) {
-        throw new Error(`Unsupported contentSecurityPolicyMode "${cspMode}".`);
-    }
-    if (options.isProduction && cspMode !== 'enforce') {
-        throw new Error('Production Content Security Policy must use enforce mode.');
-    }
-    const cspHeader = [{
-            key: cspMode === 'enforce'
-                ? 'Content-Security-Policy'
-                : 'Content-Security-Policy-Report-Only',
-            value: buildBrandlabContentSecurityPolicy(options),
-        }];
+    const preview = environment === 'preview';
     return [
         { key: 'X-Frame-Options', value: 'DENY' },
         { key: 'X-Content-Type-Options', value: 'nosniff' },
@@ -160,24 +172,83 @@ export function buildBrandlabSecurityHeaders(options) {
             key: 'Permissions-Policy',
             value: permissionsPolicy,
         },
-        ...(xRobotsTag ? [{ key: 'X-Robots-Tag', value: xRobotsTag }] : []),
-        ...(options.isProduction
+        {
+            key: 'X-Robots-Tag',
+            value: preview ? BRANDLAB_PREVIEW_X_ROBOTS_TAG : BRANDLAB_DEFAULT_X_ROBOTS_TAG,
+        },
+        ...(productionBuild
             ? [{ key: 'Strict-Transport-Security', value: hstsValue }]
             : []),
-        ...cspHeader,
-        ...(options.extraHeaders ?? []),
+        {
+            key: productionBuild
+                ? 'Content-Security-Policy'
+                : 'Content-Security-Policy-Report-Only',
+            value: buildBrandlabContentSecurityPolicy(options),
+        },
+        ...(options.extraHeaders ?? []).map((header) => ({ ...header })),
+        ...(preview ? [{ key: 'Cache-Control', value: BRANDLAB_PREVIEW_CACHE_CONTROL }] : []),
     ];
 }
+const STATIC_ASSET_SOURCE = /^\/((?:[A-Za-z0-9][A-Za-z0-9._-]*\/){1,4}):([A-Za-z_][A-Za-z0-9_]*)\*$/;
+const STATIC_ASSET_RESERVED = new Set(['api', '_next', '_vercel']);
+const STATIC_ASSET_MAX_SOURCES = 10;
+const STATIC_ASSET_MAX_LENGTH = 100;
+/**
+ * Validates `staticAssetCache`: at most 10 public folders, each written as Next's
+ * source `/<folder>/:path*` (one to four literal segments, then one catch-all
+ * parameter, at most 100 characters). `/`, `/api`, `/_next` and `/_vercel` are
+ * rejected.
+ */
+export function parseBrandlabStaticAssetCache(sources) {
+    if (!Array.isArray(sources)) {
+        throw new Error('staticAssetCache must list public folders such as /images/:path*.');
+    }
+    if (sources.length > STATIC_ASSET_MAX_SOURCES) {
+        throw new Error(`staticAssetCache lists at most ${STATIC_ASSET_MAX_SOURCES} public folders.`);
+    }
+    const seen = new Set();
+    return sources.map((source, index) => {
+        const field = `staticAssetCache[${index}]`;
+        if (typeof source !== 'string' || source.length > STATIC_ASSET_MAX_LENGTH) {
+            throw new Error(`${field} must be a source of at most ${STATIC_ASSET_MAX_LENGTH} characters.`);
+        }
+        if (STATIC_ASSET_RESERVED.has(source.split('/')[1]?.toLowerCase() ?? '')) {
+            throw new Error(`${field} "${source}" is a Next or API path, not a public folder.`);
+        }
+        const match = STATIC_ASSET_SOURCE.exec(source);
+        if (!match) {
+            throw new Error(`${field} "${source}" must name a public folder as /<folder>/:path* (literal folder segments, then one catch-all parameter).`);
+        }
+        const folder = match[1].slice(0, -1).split('/');
+        const key = folder.join('/').toLowerCase();
+        if (seen.has(key))
+            throw new Error(`${field} repeats the /${folder.join('/')} folder.`);
+        seen.add(key);
+        return { source, folder, fileSource: `/${folder.join('/')}/:${match[2]}(.+\\.[A-Za-z0-9]+)` };
+    });
+}
 export function buildBrandlabHeaderRules(options) {
-    const source = options.source ?? '/:path*';
-    if (!source.startsWith('/') || /[\u0000-\u001F\u007F]/.test(source)) {
-        throw new Error('Header-rule source must be a root-relative single-line pattern.');
+    if (!options || typeof options !== 'object') {
+        throw new TypeError('Header options are required.');
     }
-    return [
+    const { staticAssetCache, ...security } = options;
+    const folders = staticAssetCache === undefined ? [] : parseBrandlabStaticAssetCache(staticAssetCache);
+    const rules = [
         {
-            source,
-            headers: buildBrandlabSecurityHeaders(options),
+            source: '/:path*',
+            headers: buildBrandlabSecurityHeaders(security),
         },
     ];
+    // A production build outside a Preview; Previews keep private, no-store everywhere.
+    const { environment, productionBuild } = options.deployment;
+    if (productionBuild && environment !== 'preview') {
+        for (const folder of folders) {
+            rules.push({
+                source: folder.fileSource,
+                headers: [{ key: 'Cache-Control', value: BRANDLAB_STATIC_ASSET_CACHE_CONTROL }],
+            });
+        }
+    }
+    return rules;
 }
 //# sourceMappingURL=headers.js.map