@businessdash/sdk 0.9.60

package/dist/adapters-revalidate.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Framework-agnostic revalidation handler builder.
+ *
+ * The Next.js drop-in at `@businessdash/sdk/next/revalidate` is the
+ * happy path for Next consumers — one-line `export { POST } from`
+ * and the handler verifies the HMAC + calls `revalidateTag`.
+ *
+ * For everything else (Cloudflare Workers, plain Node HTTP,
+ * SvelteKit, Remix, static-site rebuilds), this adapter exposes
+ * the same verification logic without the Next dependency. The
+ * consumer plugs in their own cache-invalidation callback —
+ * KV.delete, fetch(`/purge-cache`), trigger a static rebuild, etc.
+ *
+ * Usage example (Cloudflare Workers):
+ *
+ *     import { createGenericRevalidateHandler } from "@businessdash/sdk/adapters/revalidate";
+ *
+ *     const handler = createGenericRevalidateHandler({
+ *       secret: env.BIAB_REVALIDATION_SECRET,
+ *       onTagsRevalidated: async (tags) => {
+ *         for (const tag of tags) {
+ *           await env.PURGE_CACHE.fetch(new Request(`/?tag=${tag}`));
+ *         }
+ *       },
+ *     });
+ *
+ *     export default { fetch: (req) => handler(req) };
+ *
+ * The HMAC verification + replay-window logic lives in
+ * `verifyAndExtractTags` (next-revalidate.ts) and is shared.
+ */
+export { verifyAndExtractTags } from "./revalidate-verify.js";
+export interface CreateGenericRevalidateHandlerOptions {
+    secret: string;
+    /**
+     * Called when the request verifies and a publish event is
+     * received. The consumer's framework-appropriate cache purge
+     * goes here. Failures should throw so the response is 500 —
+     * BIAB-side retry can re-deliver.
+     */
+    onTagsRevalidated: (tags: string[], orgId: string) => Promise<void> | void;
+}
+export declare function createGenericRevalidateHandler(opts: CreateGenericRevalidateHandlerOptions): (request: Request) => Promise<Response>;
+//# sourceMappingURL=adapters-revalidate.d.ts.map

package/dist/adapters-revalidate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapters-revalidate.d.ts","sourceRoot":"","sources":["../src/adapters-revalidate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAOH,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAI9D,MAAM,WAAW,qCAAqC;IACrD,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC3E;AAED,wBAAgB,8BAA8B,CAC7C,IAAI,EAAE,qCAAqC,IAKd,SAAS,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CA6BjE"}

package/dist/adapters-revalidate.js

@@ -0,0 +1,68 @@
+/**
+ * Framework-agnostic revalidation handler builder.
+ *
+ * The Next.js drop-in at `@businessdash/sdk/next/revalidate` is the
+ * happy path for Next consumers — one-line `export { POST } from`
+ * and the handler verifies the HMAC + calls `revalidateTag`.
+ *
+ * For everything else (Cloudflare Workers, plain Node HTTP,
+ * SvelteKit, Remix, static-site rebuilds), this adapter exposes
+ * the same verification logic without the Next dependency. The
+ * consumer plugs in their own cache-invalidation callback —
+ * KV.delete, fetch(`/purge-cache`), trigger a static rebuild, etc.
+ *
+ * Usage example (Cloudflare Workers):
+ *
+ *     import { createGenericRevalidateHandler } from "@businessdash/sdk/adapters/revalidate";
+ *
+ *     const handler = createGenericRevalidateHandler({
+ *       secret: env.BIAB_REVALIDATION_SECRET,
+ *       onTagsRevalidated: async (tags) => {
+ *         for (const tag of tags) {
+ *           await env.PURGE_CACHE.fetch(new Request(`/?tag=${tag}`));
+ *         }
+ *       },
+ *     });
+ *
+ *     export default { fetch: (req) => handler(req) };
+ *
+ * The HMAC verification + replay-window logic lives in
+ * `verifyAndExtractTags` (next-revalidate.ts) and is shared.
+ */
+// Import directly from the framework-agnostic verifier so this
+// adapter file doesn't transitively pull in `next/cache` (which
+// some non-Next bundlers — Nuxt's Nitro, Cloudflare's workerd —
+// try to resolve at build time even when it's behind a runtime
+// dynamic import).
+export { verifyAndExtractTags } from "./revalidate-verify.js";
+import { verifyAndExtractTags } from "./revalidate-verify.js";
+export function createGenericRevalidateHandler(opts) {
+    if (!opts.secret) {
+        throw new Error("createGenericRevalidateHandler: secret is required.");
+    }
+    return async function handle(request) {
+        const rawBody = await request.text();
+        const sig = request.headers.get("x-biab-signature");
+        const verified = verifyAndExtractTags({
+            secret: opts.secret,
+            rawBody,
+            signatureHeader: sig,
+        });
+        if (!verified.ok || !verified.payload) {
+            return Response.json({ ok: false, reason: verified.reason ?? "verify_failed" }, { status: 401 });
+        }
+        try {
+            await opts.onTagsRevalidated(verified.payload.tags, verified.payload.orgId);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "callback_failed";
+            return Response.json({ ok: false, reason: message }, { status: 500 });
+        }
+        return Response.json({
+            ok: true,
+            revalidated: verified.payload.tags,
+            orgId: verified.payload.orgId,
+        });
+    };
+}
+//# sourceMappingURL=adapters-revalidate.js.map

package/dist/adapters-revalidate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapters-revalidate.js","sourceRoot":"","sources":["../src/adapters-revalidate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,+DAA+D;AAC/D,gEAAgE;AAChE,gEAAgE;AAChE,+DAA+D;AAC/D,mBAAmB;AACnB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAa9D,MAAM,UAAU,8BAA8B,CAC7C,IAA2C;IAE3C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,UAAU,MAAM,CAAC,OAAgB;QAC5C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACrC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO;YACP,eAAe,EAAE,GAAG;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACvC,OAAO,QAAQ,CAAC,IAAI,CACnB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,eAAe,EAAE,EACzD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,iBAAiB,CAC3B,QAAQ,CAAC,OAAO,CAAC,IAAI,EACrB,QAAQ,CAAC,OAAO,CAAC,KAAK,CACtB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC;YACvE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC;YACpB,EAAE,EAAE,IAAI;YACR,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI;YAClC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK;SAC7B,CAAC,CAAC;IACJ,CAAC,CAAC;AACH,CAAC"}

package/dist/alpha.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `@businessdash/sdk/alpha` — legacy/deprecated schema API for backward compatibility.
+ *
+ * This entrypoint re-exports the original `data-model-schema` surface exactly as
+ * it was available from `@businessdash/sdk` prior to the `0.9` entrypoint split.
+ *
+ * Use it when migrating old codebases that rely on the deprecated API:
+ *
+ * ```ts
+ * // old: import { defineDataModel, defineField, defineObject } from "@businessdash/sdk"
+ * // new:
+ * import { defineDataModel, defineField, defineObject } from "@businessdash/sdk/alpha"
+ *
+ * // Or for the full legacy surface:
+ * import * as Alpha from "@businessdash/sdk/alpha"
+ * ```
+ *
+ * New projects should use `@businessdash/sdk/collections` or `@businessdash/sdk/forms` instead.
+ */
+export { type AddressDef, type AllFormElements, type BoundaryMetadata, bd, type ChoiceCardDef, type CollectionDefinition, type CollectionOptions, collection, computeDataModelChecksum, createSchema, type DataModelArtifact, type DataModelClientShape, type DataModelInput, type DeleteAction, type DynamicOptionsDef, defineCollection, defineDataModel, defineField, defineObject, type ElementMetadata, type EncryptionMode, type ExtArrayType, type ExtBooleanType, type ExtNumberType, type ExtObjectType, type ExtractFieldPaths, type ExtTextType, FIELD_TYPES, type FieldBuilder, type FieldDefinition, type FieldOptions, type FieldSpec, type Fields, type FieldType, type FileDef, type FindFieldTypeByPath, fields, type InferJsType, isFieldType, isRelationFieldType, type MeasurementCategory, type MeasurementDef, type ObjectDefinition, type ObjectKind, type ObjectPropertyDef, type ObjectSchemaDef, type ObjectVisibility, objectVisibilityValues, PREDEFINED_UNITS, type PrimaryKeyType, type RangeDef, RELATION_FIELD_TYPES, type RelationMetadata, type RelationOnDelete, type RequiredIfCondition, type RlsPolicyConfig, SchemaBoundary, type SchemaBoundaryNode, type SchemaOptions, type SecureEvalRule, type SelectOption, type SpecialDateValue, type StorageStrategy, UNSUPPORTED_FIELD_TYPES, type ValidationRules, validateAndResolveMeasurement, validateFieldValue, } from "./data-model-schema.js";
+//# sourceMappingURL=alpha.d.ts.map

package/dist/alpha.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alpha.d.ts","sourceRoot":"","sources":["../src/alpha.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EACN,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,EAAE,EACF,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,UAAU,EACV,wBAAwB,EACxB,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,gBAAgB,EAChB,eAAe,EACf,WAAW,EACX,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,WAAW,EACX,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,MAAM,EACX,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,mBAAmB,EACxB,MAAM,EACN,KAAK,WAAW,EAChB,WAAW,EACX,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,cAAc,EACd,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,uBAAuB,EACvB,KAAK,eAAe,EACpB,6BAA6B,EAC7B,kBAAkB,GAClB,MAAM,wBAAwB,CAAC"}

package/dist/alpha.js

@@ -0,0 +1,21 @@
+/**
+ * `@businessdash/sdk/alpha` — legacy/deprecated schema API for backward compatibility.
+ *
+ * This entrypoint re-exports the original `data-model-schema` surface exactly as
+ * it was available from `@businessdash/sdk` prior to the `0.9` entrypoint split.
+ *
+ * Use it when migrating old codebases that rely on the deprecated API:
+ *
+ * ```ts
+ * // old: import { defineDataModel, defineField, defineObject } from "@businessdash/sdk"
+ * // new:
+ * import { defineDataModel, defineField, defineObject } from "@businessdash/sdk/alpha"
+ *
+ * // Or for the full legacy surface:
+ * import * as Alpha from "@businessdash/sdk/alpha"
+ * ```
+ *
+ * New projects should use `@businessdash/sdk/collections` or `@businessdash/sdk/forms` instead.
+ */
+export { bd, collection, computeDataModelChecksum, createSchema, defineCollection, defineDataModel, defineField, defineObject, FIELD_TYPES, fields, isFieldType, isRelationFieldType, objectVisibilityValues, PREDEFINED_UNITS, RELATION_FIELD_TYPES, SchemaBoundary, UNSUPPORTED_FIELD_TYPES, validateAndResolveMeasurement, validateFieldValue, } from "./data-model-schema.js";
+//# sourceMappingURL=alpha.js.map

package/dist/alpha.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alpha.js","sourceRoot":"","sources":["../src/alpha.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAIN,EAAE,EAIF,UAAU,EACV,wBAAwB,EACxB,YAAY,EAMZ,gBAAgB,EAChB,eAAe,EACf,WAAW,EACX,YAAY,EASZ,WAAW,EASX,MAAM,EAEN,WAAW,EACX,mBAAmB,EAQnB,sBAAsB,EACtB,gBAAgB,EAGhB,oBAAoB,EAKpB,cAAc,EAOd,uBAAuB,EAEvB,6BAA6B,EAC7B,kBAAkB,GAClB,MAAM,wBAAwB,CAAC"}

package/dist/analytics-core.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Framework-agnostic core for BIAB site analytics. The React
+ * component (`<BIABAnalytics />`) wraps this; Svelte/Qwik/Vue/
+ * vanilla-JS consumers call `initBiabAnalytics(opts)` directly
+ * from their framework's "on mount" hook and call the returned
+ * cleanup function in their "on unmount" hook.
+ *
+ * Same privacy posture as the React component:
+ *   - No cookies, no localStorage, no third-party requests
+ *   - Honours navigator.doNotTrack + globalPrivacyControl
+ *   - Never sees the visitor's IP or UA — those are read
+ *     server-side by the ingest endpoint and used only to
+ *     derive country + device family + a daily-rotating
+ *     anon-id hash that resets every UTC midnight.
+ */
+export type InitBiabAnalyticsOptions = {
+    siteId: string;
+    baseUrl: string;
+    apiKey: string;
+    /** Defaults to true. Set false only if your privacy policy
+     *  already commits to honouring DNT/GPC and you want to
+     *  count those visitors. */
+    respectDnt?: boolean;
+};
+export type BiabAnalyticsTracker = {
+    /** Tear down the listeners. Safe to call multiple times. */
+    stop: () => void;
+    /** Fire a custom event. */
+    track: (name: string, opts?: {
+        path?: string;
+    }) => void;
+};
+export declare function initBiabAnalytics(options: InitBiabAnalyticsOptions): BiabAnalyticsTracker;
+//# sourceMappingURL=analytics-core.d.ts.map

package/dist/analytics-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analytics-core.d.ts","sourceRoot":"","sources":["../src/analytics-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,MAAM,wBAAwB,GAAG;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf;;gCAE4B;IAC5B,UAAU,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAClC,4DAA4D;IAC5D,IAAI,EAAE,MAAM,IAAI,CAAC;IACjB,2BAA2B;IAC3B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACxD,CAAC;AAEF,wBAAgB,iBAAiB,CAChC,OAAO,EAAE,wBAAwB,GAC/B,oBAAoB,CA+HtB"}

package/dist/analytics-core.js

@@ -0,0 +1,138 @@
+/**
+ * Framework-agnostic core for BIAB site analytics. The React
+ * component (`<BIABAnalytics />`) wraps this; Svelte/Qwik/Vue/
+ * vanilla-JS consumers call `initBiabAnalytics(opts)` directly
+ * from their framework's "on mount" hook and call the returned
+ * cleanup function in their "on unmount" hook.
+ *
+ * Same privacy posture as the React component:
+ *   - No cookies, no localStorage, no third-party requests
+ *   - Honours navigator.doNotTrack + globalPrivacyControl
+ *   - Never sees the visitor's IP or UA — those are read
+ *     server-side by the ingest endpoint and used only to
+ *     derive country + device family + a daily-rotating
+ *     anon-id hash that resets every UTC midnight.
+ */
+export function initBiabAnalytics(options) {
+    if (typeof window === "undefined") {
+        return { stop: () => { }, track: () => { } };
+    }
+    const respectDnt = options.respectDnt ?? true;
+    if (respectDnt && shouldOptOut()) {
+        return { stop: () => { }, track: () => { } };
+    }
+    const endpoint = `${options.baseUrl.replace(/\/$/, "")}/sites/${encodeURIComponent(options.siteId)}/analytics/events`;
+    let lastPath = null;
+    let lastEnterAt = 0;
+    let stopped = false;
+    const send = (kind, payload = {}) => {
+        if (stopped)
+            return;
+        const body = JSON.stringify({
+            kind,
+            path: payload.path ?? window.location.pathname,
+            referer: payload.referer === undefined
+                ? document.referrer || null
+                : payload.referer,
+            ...(payload.durationMs != null ? { durationMs: payload.durationMs } : {}),
+            ...(payload.customEventName
+                ? { customEventName: payload.customEventName }
+                : {}),
+        });
+        const blob = new Blob([body], { type: "application/json" });
+        try {
+            if (typeof navigator !== "undefined" &&
+                "sendBeacon" in navigator &&
+                navigator.sendBeacon(endpoint, blob)) {
+                return;
+            }
+        }
+        catch {
+            /* fallthrough */
+        }
+        fetch(endpoint, {
+            method: "POST",
+            body,
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${options.apiKey}`,
+            },
+            keepalive: true,
+        }).catch(() => {
+            /* drop silently — analytics shouldn't break the page */
+        });
+    };
+    const trackPageview = (nextPath) => {
+        const now = Date.now();
+        if (lastPath && lastEnterAt > 0) {
+            const dur = now - lastEnterAt;
+            send("custom", {
+                path: lastPath,
+                durationMs: Math.max(0, Math.min(dur, 24 * 60 * 60 * 1000)),
+                customEventName: "pageview_duration",
+            });
+        }
+        lastPath = nextPath;
+        lastEnterAt = now;
+        send("pageview", { path: nextPath });
+    };
+    // Session start once per init.
+    send("session_start");
+    trackPageview(window.location.pathname);
+    const origPush = history.pushState;
+    const origReplace = history.replaceState;
+    history.pushState = function (...args) {
+        const ret = origPush.apply(this, args);
+        queueMicrotask(() => trackPageview(window.location.pathname));
+        return ret;
+    };
+    history.replaceState = function (...args) {
+        const ret = origReplace.apply(this, args);
+        queueMicrotask(() => trackPageview(window.location.pathname));
+        return ret;
+    };
+    const onPop = () => trackPageview(window.location.pathname);
+    window.addEventListener("popstate", onPop);
+    const onVisibility = () => {
+        if (document.visibilityState !== "hidden")
+            return;
+        if (!lastPath || lastEnterAt === 0)
+            return;
+        const dur = Date.now() - lastEnterAt;
+        send("custom", {
+            path: lastPath,
+            durationMs: Math.max(0, Math.min(dur, 24 * 60 * 60 * 1000)),
+            customEventName: "pageview_duration",
+        });
+    };
+    document.addEventListener("visibilitychange", onVisibility);
+    return {
+        stop: () => {
+            if (stopped)
+                return;
+            stopped = true;
+            history.pushState = origPush;
+            history.replaceState = origReplace;
+            window.removeEventListener("popstate", onPop);
+            document.removeEventListener("visibilitychange", onVisibility);
+        },
+        track: (name, opts) => send("custom", {
+            ...(opts?.path !== undefined ? { path: opts.path } : {}),
+            customEventName: name,
+        }),
+    };
+}
+function shouldOptOut() {
+    if (typeof navigator === "undefined")
+        return false;
+    const dnt = navigator.doNotTrack ??
+        window.doNotTrack;
+    if (dnt === "1" || dnt === "yes")
+        return true;
+    const gpc = navigator
+        .globalPrivacyControl;
+    if (gpc === true)
+        return true;
+    return false;
+}
+//# sourceMappingURL=analytics-core.js.map

package/dist/analytics-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analytics-core.js","sourceRoot":"","sources":["../src/analytics-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAmBH,MAAM,UAAU,iBAAiB,CAChC,OAAiC;IAEjC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAC9C,IAAI,UAAU,IAAI,YAAY,EAAE,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,kBAAkB,CACjF,OAAO,CAAC,MAAM,CACd,mBAAmB,CAAC;IAErB,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,IAAI,GAAG,CACZ,IAA6C,EAC7C,UAKI,EAAE,EACL,EAAE;QACH,IAAI,OAAO;YAAE,OAAO;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC3B,IAAI;YACJ,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ;YAC9C,OAAO,EACN,OAAO,CAAC,OAAO,KAAK,SAAS;gBAC5B,CAAC,CAAC,QAAQ,CAAC,QAAQ,IAAI,IAAI;gBAC3B,CAAC,CAAC,OAAO,CAAC,OAAO;YACnB,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,OAAO,CAAC,eAAe;gBAC1B,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;SACN,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC;YACJ,IACC,OAAO,SAAS,KAAK,WAAW;gBAChC,YAAY,IAAI,SAAS;gBACzB,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,EACnC,CAAC;gBACF,OAAO;YACR,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,iBAAiB;QAClB,CAAC;QACD,KAAK,CAAC,QAAQ,EAAE;YACf,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,OAAO,EAAE;gBACR,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;aACzC;YACD,SAAS,EAAE,IAAI;SACf,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACb,wDAAwD;QACzD,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAE,EAAE;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,QAAQ,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,GAAG,GAAG,WAAW,CAAC;YAC9B,IAAI,CAAC,QAAQ,EAAE;gBACd,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;gBAC3D,eAAe,EAAE,mBAAmB;aACpC,CAAC,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,QAAQ,CAAC;QACpB,WAAW,GAAG,GAAG,CAAC;QAClB,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC;IAEF,+BAA+B;IAC/B,IAAI,CAAC,eAAe,CAAC,CAAC;IACtB,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAExC,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;IACnC,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IACzC,OAAO,CAAC,SAAS,GAAG,UAAU,GAAG,IAA0C;QAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,cAAc,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9D,OAAO,GAAG,CAAC;IACZ,CAAC,CAAC;IACF,OAAO,CAAC,YAAY,GAAG,UACtB,GAAG,IAA6C;QAEhD,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1C,cAAc,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9D,OAAO,GAAG,CAAC;IACZ,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,CAAC,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAE3C,MAAM,YAAY,GAAG,GAAG,EAAE;QACzB,IAAI,QAAQ,CAAC,eAAe,KAAK,QAAQ;YAAE,OAAO;QAClD,IAAI,CAAC,QAAQ,IAAI,WAAW,KAAK,CAAC;YAAE,OAAO;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;QACrC,IAAI,CAAC,QAAQ,EAAE;YACd,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC3D,eAAe,EAAE,mBAAmB;SACpC,CAAC,CAAC;IACJ,CAAC,CAAC;IACF,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;IAE5D,OAAO;QACN,IAAI,EAAE,GAAG,EAAE;YACV,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC;YAC7B,OAAO,CAAC,YAAY,GAAG,WAAW,CAAC;YACnC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAC9C,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAChE,CAAC;QACD,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CACrB,IAAI,CAAC,QAAQ,EAAE;YACd,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,eAAe,EAAE,IAAI;SACrB,CAAC;KACH,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACpB,IAAI,OAAO,SAAS,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,GAAG,GACP,SAAiD,CAAC,UAAU;QAC5D,MAA2C,CAAC,UAAU,CAAC;IACzD,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,GAAG,GAAI,SAA4D;SACvE,oBAAoB,CAAC;IACvB,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/analytics-server.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Server-side analytics reporting — the half the browser tracker can't do.
+ *
+ * AI crawlers (GPTBot, ClaudeBot, PerplexityBot, …) fetch your HTML without
+ * executing JavaScript, so `<BIABAnalytics />` never sees them. Your server
+ * does. Call `reportAiCrawlerHit` from your middleware / request handler and
+ * BIAB records which pages the answer engines actually read — first-party
+ * AEO visibility, per page, per crawler.
+ *
+ * Next.js example (middleware.ts):
+ *
+ * ```ts
+ * import { isAiCrawlerUserAgent, reportAiCrawlerHit } from "@businessdash/sdk/analytics-server";
+ *
+ * export function middleware(request: Request) {
+ *   const ua = request.headers.get("user-agent");
+ *   if (isAiCrawlerUserAgent(ua)) {
+ *     // Fire-and-forget — never block or fail the crawler's request.
+ *     void reportAiCrawlerHit({
+ *       siteId: process.env.BIAB_SITE_ID!,
+ *       baseUrl: process.env.NEXT_PUBLIC_BIAB_API_URL!,
+ *       apiKey: process.env.NEXT_PUBLIC_BIAB_PUBLISHABLE_KEY!,
+ *       userAgent: ua,
+ *       path: new URL(request.url).pathname,
+ *     });
+ *   }
+ * }
+ * ```
+ *
+ * Abuse posture: the ingest endpoint accepts a forwarded user-agent ONLY
+ * when it matches a known AI crawler — a forwarded human UA is dropped
+ * server-side, so this path can record crawler visibility but can never
+ * inflate the site's human visitor counts. If this local pattern list ever
+ * lags the platform's, the result is under-reporting, never bad data.
+ */
+export declare function isAiCrawlerUserAgent(userAgent: string | null | undefined): boolean;
+export type ReportAiCrawlerHitOptions = {
+    siteId: string;
+    /** Package-API base URL, e.g. "https://www.biab.app/api/package/v1". */
+    baseUrl: string;
+    /** Publishable key — same one `<BIABAnalytics />` uses. */
+    apiKey: string;
+    /** The crawler request's user-agent, verbatim. */
+    userAgent: string;
+    /** The path the crawler fetched, e.g. "/pricing". */
+    path: string;
+};
+/**
+ * Report one crawler fetch. Resolves quietly on every outcome — analytics
+ * must never break page serving — and returns whether the platform accepted
+ * the event (false for non-crawler UAs, network failures, etc.).
+ */
+export declare function reportAiCrawlerHit(options: ReportAiCrawlerHitOptions): Promise<boolean>;
+//# sourceMappingURL=analytics-server.d.ts.map

package/dist/analytics-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analytics-server.d.ts","sourceRoot":"","sources":["../src/analytics-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAUH,wBAAgB,oBAAoB,CACnC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,OAAO,CAET;AAED,MAAM,MAAM,yBAAyB,GAAG;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,yBAAyB,GAChC,OAAO,CAAC,OAAO,CAAC,CA6BlB"}

package/dist/analytics-server.js

@@ -0,0 +1,78 @@
+/**
+ * Server-side analytics reporting — the half the browser tracker can't do.
+ *
+ * AI crawlers (GPTBot, ClaudeBot, PerplexityBot, …) fetch your HTML without
+ * executing JavaScript, so `<BIABAnalytics />` never sees them. Your server
+ * does. Call `reportAiCrawlerHit` from your middleware / request handler and
+ * BIAB records which pages the answer engines actually read — first-party
+ * AEO visibility, per page, per crawler.
+ *
+ * Next.js example (middleware.ts):
+ *
+ * ```ts
+ * import { isAiCrawlerUserAgent, reportAiCrawlerHit } from "@businessdash/sdk/analytics-server";
+ *
+ * export function middleware(request: Request) {
+ *   const ua = request.headers.get("user-agent");
+ *   if (isAiCrawlerUserAgent(ua)) {
+ *     // Fire-and-forget — never block or fail the crawler's request.
+ *     void reportAiCrawlerHit({
+ *       siteId: process.env.BIAB_SITE_ID!,
+ *       baseUrl: process.env.NEXT_PUBLIC_BIAB_API_URL!,
+ *       apiKey: process.env.NEXT_PUBLIC_BIAB_PUBLISHABLE_KEY!,
+ *       userAgent: ua,
+ *       path: new URL(request.url).pathname,
+ *     });
+ *   }
+ * }
+ * ```
+ *
+ * Abuse posture: the ingest endpoint accepts a forwarded user-agent ONLY
+ * when it matches a known AI crawler — a forwarded human UA is dropped
+ * server-side, so this path can record crawler visibility but can never
+ * inflate the site's human visitor counts. If this local pattern list ever
+ * lags the platform's, the result is under-reporting, never bad data.
+ */
+/**
+ * Cheap prefilter mirroring the platform's AI-crawler classifier, so your
+ * middleware only spends a network call on requests that will be kept.
+ * The platform's list is authoritative — this one just saves the round trip.
+ */
+const AI_CRAWLER_UA_PATTERN = /GPTBot|OAI-SearchBot|ChatGPT-User|ClaudeBot|Claude-User|Claude-SearchBot|Claude-Web|anthropic-ai|PerplexityBot|Perplexity-User|GrokBot|xAI-Crawler|Google-CloudVertexBot|GoogleOther|Applebot-Extended|meta-externalagent|Bytespider|CCBot|Amazonbot|cohere-ai|cohere-training-data-crawler|MistralAI-User|DuckAssistBot|YouBot|AI2Bot/i;
+export function isAiCrawlerUserAgent(userAgent) {
+    return userAgent != null && AI_CRAWLER_UA_PATTERN.test(userAgent);
+}
+/**
+ * Report one crawler fetch. Resolves quietly on every outcome — analytics
+ * must never break page serving — and returns whether the platform accepted
+ * the event (false for non-crawler UAs, network failures, etc.).
+ */
+export async function reportAiCrawlerHit(options) {
+    const endpoint = `${options.baseUrl.replace(/\/$/, "")}/sites/${encodeURIComponent(options.siteId)}/analytics/events`;
+    try {
+        const res = await fetch(endpoint, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${options.apiKey}`,
+            },
+            body: JSON.stringify({
+                kind: "pageview",
+                path: options.path,
+                referer: null,
+                visitorUserAgent: options.userAgent,
+            }),
+            // Middleware runtimes kill slow side-requests anyway; keepalive
+            // lets the report outlive the response where supported.
+            keepalive: true,
+        });
+        if (!res.ok)
+            return false;
+        const body = (await res.json().catch(() => null));
+        return body?.accepted === true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=analytics-server.js.map

package/dist/analytics-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analytics-server.js","sourceRoot":"","sources":["../src/analytics-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH;;;;GAIG;AACH,MAAM,qBAAqB,GAC1B,yUAAyU,CAAC;AAE3U,MAAM,UAAU,oBAAoB,CACnC,SAAoC;IAEpC,OAAO,SAAS,IAAI,IAAI,IAAI,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACnE,CAAC;AAcD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,OAAkC;IAElC,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,kBAAkB,CACjF,OAAO,CAAC,MAAM,CACd,mBAAmB,CAAC;IACrB,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;aACzC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,OAAO,CAAC,SAAS;aACnC,CAAC;YACF,gEAAgE;YAChE,wDAAwD;YACxD,SAAS,EAAE,IAAI;SACf,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAExC,CAAC;QACT,OAAO,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC"}