@lynkow/next 0.1.0

package/dist/index.js

@@ -0,0 +1,169 @@
+export { REVALIDATE, TAGS, cached, uncached } from './chunk-XNN4SECG.js';
+import { createLocalePaths } from './chunk-4QTGOTFV.js';
+export { ABSOLUTE_HREF, createLocalePaths } from './chunk-4QTGOTFV.js';
+import { createClient } from 'lynkow';
+
+// src/config.ts
+var DEFAULT_API_URL = "https://api.lynkow.com";
+var HOST = /^(?:[a-z0-9_-]+(?:\.[a-z0-9_-]+)*\.?|\[[0-9a-f:.]+\])$/i;
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var LOCALE = /^[a-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;
+function resolveConfig(input, labels = {}) {
+  const problems = [];
+  const name = (field) => `\`${labels[field] ?? field}\``;
+  const siteId = input.siteId?.trim() ?? "";
+  if (!siteId) problems.push(`${name("siteId")} is required`);
+  else if (!UUID.test(siteId)) problems.push(`${name("siteId")} is not a site UUID: ${quote(siteId)}`);
+  const rawSiteUrl = input.siteUrl?.trim() ?? "";
+  if (!rawSiteUrl) problems.push(`${name("siteUrl")} is required`);
+  const siteUrl = rawSiteUrl ? parseOrigin(name("siteUrl"), rawSiteUrl, problems) : void 0;
+  const rawApiUrl = input.apiUrl?.trim() ?? "";
+  const apiUrl = rawApiUrl ? parseOrigin(name("apiUrl"), rawApiUrl, problems) : DEFAULT_API_URL;
+  const locales = parseLocales(name("locales"), input.locales, problems);
+  const wanted = input.defaultLocale?.trim() ?? "";
+  const defaultLocale = wanted ? locales.find((locale) => locale.toLowerCase() === wanted.toLowerCase()) : locales[0];
+  if (wanted && locales.length > 0 && !defaultLocale) {
+    problems.push(
+      `${name("defaultLocale")} is ${quote(wanted)}, which is not one of the locales (${locales.join(", ")})`
+    );
+  }
+  const prefixDefaultLocale = parseFlag(
+    name("prefixDefaultLocale"),
+    input.prefixDefaultLocale,
+    true,
+    problems
+  );
+  const publishableKey = input.publishableKey?.trim() || void 0;
+  if (publishableKey && !publishableKey.startsWith("lkw_pk_")) {
+    problems.push(
+      `${name("publishableKey")} is not a publishable key (lkw_pk_...). This configuration reaches the browser, so it must never hold a secret API key`
+    );
+  }
+  if (problems.length > 0 || !siteUrl || !apiUrl || !defaultLocale) {
+    throw new TypeError(`Invalid Lynkow configuration:
+  - ${problems.join("\n  - ")}`);
+  }
+  return Object.freeze({
+    siteId: siteId.toLowerCase(),
+    siteUrl,
+    apiUrl,
+    publishableKey,
+    locales: Object.freeze([...locales]),
+    defaultLocale,
+    prefixDefaultLocale
+  });
+}
+function parseOrigin(field, raw, problems) {
+  if (hasUnsafeCharacter(raw)) {
+    problems.push(`${field} contains whitespace or a control character`);
+    return void 0;
+  }
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    problems.push(`${field} is not an absolute URL${echoUrl(raw)}`);
+    return void 0;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    problems.push(`${field} must use http or https${echoUrl(raw)}`);
+  } else if (url.username || url.password) {
+    problems.push(`${field} must not carry credentials`);
+  } else if (!HOST.test(url.hostname)) {
+    problems.push(`${field} has a host with characters no domain carries${echoUrl(raw)}`);
+  } else if (!/^\/+$/.test(url.pathname) || url.search || url.hash) {
+    problems.push(`${field} must be an origin, with no path, query or fragment${echoUrl(raw)}`);
+  } else {
+    return url.origin;
+  }
+  return void 0;
+}
+function parseLocales(field, input, problems) {
+  const list = typeof input === "string" ? input.split(",") : [...input ?? []];
+  const locales = list.map((locale) => String(locale).trim()).filter(Boolean);
+  if (locales.length === 0) {
+    problems.push(`${field} must name at least one locale`);
+    return [];
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const locale of locales) {
+    if (!LOCALE.test(locale)) {
+      problems.push(`${field} has an invalid locale ${quote(locale)}, expected a code such as "en" or "pt-BR"`);
+    }
+    const key = locale.toLowerCase();
+    if (seen.has(key)) problems.push(`${field} lists ${quote(locale)} twice`);
+    seen.add(key);
+  }
+  return locales;
+}
+function parseFlag(field, value, fallback, problems) {
+  if (typeof value === "boolean") return value;
+  const normalized = value?.trim().toLowerCase() ?? "";
+  if (normalized === "") return fallback;
+  if (normalized === "true") return true;
+  if (normalized === "false") return false;
+  problems.push(`${field} must be true or false, not ${quote(String(value))}`);
+  return fallback;
+}
+function hasUnsafeCharacter(value) {
+  if (/\s/.test(value)) return true;
+  for (let index = 0; index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    if (code < 32 || code === 127) return true;
+  }
+  return false;
+}
+function echoUrl(raw) {
+  return raw.includes("@") ? "" : `: ${quote(raw)}`;
+}
+function quote(value) {
+  return JSON.stringify(value.length > 120 ? `${value.slice(0, 120)}...` : value);
+}
+function createClients(config) {
+  const { toLocale } = createLocalePaths(config);
+  const clients = /* @__PURE__ */ new Map();
+  return function lynkow(locale = config.defaultLocale, { retry = true } = {}) {
+    const canonical = toLocale(locale);
+    if (!canonical) {
+      throw new RangeError(
+        `${JSON.stringify(locale)} is not one of the configured locales (${config.locales.join(", ")})`
+      );
+    }
+    const key = retry ? canonical : `${canonical}:no-retry`;
+    const existing = clients.get(key);
+    if (existing) return existing;
+    const client = createClient({
+      siteId: config.siteId,
+      locale: canonical,
+      baseUrl: config.apiUrl,
+      ...config.publishableKey ? { publishableKey: config.publishableKey } : {},
+      cache: false,
+      retry
+    });
+    clients.set(key, client);
+    return client;
+  };
+}
+
+// src/analytics/events.ts
+function tracker() {
+  if (typeof window === "undefined") return null;
+  const global = window.LynkowAnalytics;
+  return global && typeof global.track === "function" ? global : null;
+}
+function trackEvent(type, data) {
+  const global = tracker();
+  if (!global) return false;
+  global.track({
+    event_type: type,
+    page_path: window.location.pathname,
+    page_url: window.location.href,
+    page_title: document.title,
+    ...data
+  });
+  return true;
+}
+
+export { createClients, resolveConfig, trackEvent };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config.ts","../src/clients.ts","../src/analytics/events.ts"],"names":[],"mappings":";;;;;;AAmEA,IAAM,eAAA,GAAkB,wBAAA;AAOxB,IAAM,IAAA,GAAO,yDAAA;AAEb,IAAM,IAAA,GAAO,iEAAA;AAQb,IAAM,MAAA,GAAS,oCAAA;AAqBR,SAAS,aAAA,CACd,KAAA,EACA,MAAA,GAAiC,EAAC,EAChB;AAClB,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,MAAM,OAAO,CAAC,KAAA,KAAuC,KAAK,MAAA,CAAO,KAAK,KAAK,KAAK,CAAA,EAAA,CAAA;AAEhF,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,MAAA,EAAQ,IAAA,EAAK,IAAK,EAAA;AACvC,EAAA,IAAI,CAAC,QAAQ,QAAA,CAAS,IAAA,CAAK,GAAG,IAAA,CAAK,QAAQ,CAAC,CAAA,YAAA,CAAc,CAAA;AAAA,OAAA,IACjD,CAAC,IAAA,CAAK,IAAA,CAAK,MAAM,GAAG,QAAA,CAAS,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,QAAQ,CAAC,CAAA,qBAAA,EAAwB,KAAA,CAAM,MAAM,CAAC,CAAA,CAAE,CAAA;AAEnG,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,OAAA,EAAS,IAAA,EAAK,IAAK,EAAA;AAC5C,EAAA,IAAI,CAAC,YAAY,QAAA,CAAS,IAAA,CAAK,GAAG,IAAA,CAAK,SAAS,CAAC,CAAA,YAAA,CAAc,CAAA;AAC/D,EAAA,MAAM,OAAA,GAAU,aAAa,WAAA,CAAY,IAAA,CAAK,SAAS,CAAA,EAAG,UAAA,EAAY,QAAQ,CAAA,GAAI,MAAA;AAElF,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,MAAA,EAAQ,IAAA,EAAK,IAAK,EAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,YAAY,WAAA,CAAY,IAAA,CAAK,QAAQ,CAAA,EAAG,SAAA,EAAW,QAAQ,CAAA,GAAI,eAAA;AAE9E,EAAA,MAAM,UAAU,YAAA,CAAa,IAAA,CAAK,SAAS,CAAA,EAAG,KAAA,CAAM,SAAS,QAAQ,CAAA;AAErE,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,aAAA,EAAe,IAAA,EAAK,IAAK,EAAA;AAC9C,EAAA,MAAM,aAAA,GAAgB,MAAA,GAClB,OAAA,CAAQ,IAAA,CAAK,CAAC,MAAA,KAAW,MAAA,CAAO,WAAA,EAAY,KAAM,MAAA,CAAO,WAAA,EAAa,CAAA,GACtE,QAAQ,CAAC,CAAA;AACb,EAAA,IAAI,MAAA,IAAU,OAAA,CAAQ,MAAA,GAAS,CAAA,IAAK,CAAC,aAAA,EAAe;AAClD,IAAA,QAAA,CAAS,IAAA;AAAA,MACP,CAAA,EAAG,IAAA,CAAK,eAAe,CAAC,CAAA,IAAA,EAAO,KAAA,CAAM,MAAM,CAAC,CAAA,mCAAA,EAAsC,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,KACtG;AAAA,EACF;AAEA,EAAA,MAAM,mBAAA,GAAsB,SAAA;AAAA,IAC1B,KAAK,qBAAqB,CAAA;AAAA,IAC1B,KAAA,CAAM,mBAAA;AAAA,IACN,IAAA;AAAA,IACA;AAAA,GACF;AAIA,EAAA,MAAM,cAAA,GAAiB,KAAA,CAAM,cAAA,EAAgB,IAAA,EAAK,IAAK,MAAA;AACvD,EAAA,IAAI,cAAA,IAAkB,CAAC,cAAA,CAAe,UAAA,CAAW,SAAS,CAAA,EAAG;AAC3D,IAAA,QAAA,CAAS,IAAA;AAAA,MACP,CAAA,EAAG,IAAA,CAAK,gBAAgB,CAAC,CAAA,sHAAA;AAAA,KAC3B;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,CAAS,SAAS,CAAA,IAAK,CAAC,WAAW,CAAC,MAAA,IAAU,CAAC,aAAA,EAAe;AAChE,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA;AAAA,IAAA,EAAsC,QAAA,CAAS,IAAA,CAAK,QAAQ,CAAC,CAAA,CAAE,CAAA;AAAA,EACrF;AAEA,EAAA,OAAO,OAAO,MAAA,CAAO;AAAA,IACnB,MAAA,EAAQ,OAAO,WAAA,EAAY;AAAA,IAC3B,OAAA;AAAA,IACA,MAAA;AAAA,IACA,cAAA;AAAA,IACA,SAAS,MAAA,CAAO,MAAA,CAAO,CAAC,GAAG,OAAO,CAAC,CAAA;AAAA,IACnC,aAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAQA,SAAS,WAAA,CAAY,KAAA,EAAe,GAAA,EAAa,QAAA,EAAwC;AACvF,EAAA,IAAI,kBAAA,CAAmB,GAAG,CAAA,EAAG;AAC3B,IAAA,QAAA,CAAS,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA,2CAAA,CAA6C,CAAA;AACnE,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,GAAG,CAAA;AAAA,EACnB,CAAA,CAAA,MAAQ;AACN,IAAA,QAAA,CAAS,KAAK,CAAA,EAAG,KAAK,0BAA0B,OAAA,CAAQ,GAAG,CAAC,CAAA,CAAE,CAAA;AAC9D,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,GAAA,CAAI,QAAA,KAAa,OAAA,IAAW,GAAA,CAAI,aAAa,QAAA,EAAU;AACzD,IAAA,QAAA,CAAS,KAAK,CAAA,EAAG,KAAK,0BAA0B,OAAA,CAAQ,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAChE,CAAA,MAAA,IAAW,GAAA,CAAI,QAAA,IAAY,GAAA,CAAI,QAAA,EAAU;AACvC,IAAA,QAAA,CAAS,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA,2BAAA,CAA6B,CAAA;AAAA,EACrD,WAAW,CAAC,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,QAAQ,CAAA,EAAG;AACnC,IAAA,QAAA,CAAS,KAAK,CAAA,EAAG,KAAK,gDAAgD,OAAA,CAAQ,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EACtF,CAAA,MAAA,IAAW,CAAC,OAAA,CAAQ,IAAA,CAAK,GAAA,CAAI,QAAQ,CAAA,IAAK,GAAA,CAAI,MAAA,IAAU,GAAA,CAAI,IAAA,EAAM;AAChE,IAAA,QAAA,CAAS,KAAK,CAAA,EAAG,KAAK,sDAAsD,OAAA,CAAQ,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAC5F,CAAA,MAAO;AACL,IAAA,OAAO,GAAA,CAAI,MAAA;AAAA,EACb;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,YAAA,CACP,KAAA,EACA,KAAA,EACA,QAAA,EACU;AACV,EAAA,MAAM,IAAA,GAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA,GAAI,CAAC,GAAI,KAAA,IAAS,EAAG,CAAA;AAC7E,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,GAAA,CAAI,CAAC,MAAA,KAAW,MAAA,CAAO,MAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA;AAC1E,EAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,IAAA,QAAA,CAAS,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA,8BAAA,CAAgC,CAAA;AACtD,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,EAAG;AACxB,MAAA,QAAA,CAAS,KAAK,CAAA,EAAG,KAAK,0BAA0B,KAAA,CAAM,MAAM,CAAC,CAAA,yCAAA,CAA2C,CAAA;AAAA,IAC1G;AACA,IAAA,MAAM,GAAA,GAAM,OAAO,WAAA,EAAY;AAC/B,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG,QAAA,CAAS,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA,OAAA,EAAU,KAAA,CAAM,MAAM,CAAC,CAAA,MAAA,CAAQ,CAAA;AACxE,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AAAA,EACd;AACA,EAAA,OAAO,OAAA;AACT;AAEA,SAAS,SAAA,CACP,KAAA,EACA,KAAA,EACA,QAAA,EACA,QAAA,EACS;AACT,EAAA,IAAI,OAAO,KAAA,KAAU,SAAA,EAAW,OAAO,KAAA;AACvC,EAAA,MAAM,UAAA,GAAa,KAAA,EAAO,IAAA,EAAK,CAAE,aAAY,IAAK,EAAA;AAClD,EAAA,IAAI,UAAA,KAAe,IAAI,OAAO,QAAA;AAC9B,EAAA,IAAI,UAAA,KAAe,QAAQ,OAAO,IAAA;AAClC,EAAA,IAAI,UAAA,KAAe,SAAS,OAAO,KAAA;AACnC,EAAA,QAAA,CAAS,IAAA,CAAK,GAAG,KAAK,CAAA,4BAAA,EAA+B,MAAM,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA,CAAE,CAAA;AAC3E,EAAA,OAAO,QAAA;AACT;AAEA,SAAS,mBAAmB,KAAA,EAAwB;AAClD,EAAA,IAAI,IAAA,CAAK,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,IAAA;AAC7B,EAAA,KAAA,IAAS,KAAA,GAAQ,CAAA,EAAG,KAAA,GAAQ,KAAA,CAAM,QAAQ,KAAA,EAAA,EAAS;AACjD,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,UAAA,CAAW,KAAK,CAAA;AACnC,IAAA,IAAI,IAAA,GAAO,EAAA,IAAQ,IAAA,KAAS,GAAA,EAAM,OAAO,IAAA;AAAA,EAC3C;AACA,EAAA,OAAO,KAAA;AACT;AAMA,SAAS,QAAQ,GAAA,EAAqB;AACpC,EAAA,OAAO,GAAA,CAAI,SAAS,GAAG,CAAA,GAAI,KAAK,CAAA,EAAA,EAAK,KAAA,CAAM,GAAG,CAAC,CAAA,CAAA;AACjD;AAGA,SAAS,MAAM,KAAA,EAAuB;AACpC,EAAA,OAAO,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,MAAA,GAAS,GAAA,GAAM,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,GAAA,CAAA,GAAQ,KAAK,CAAA;AAChF;ACvNO,SAAS,cAAc,MAAA,EAAyC;AACrE,EAAA,MAAM,EAAE,QAAA,EAAS,GAAI,iBAAA,CAAkB,MAAM,CAAA;AAC7C,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAoB;AAExC,EAAA,OAAO,SAAS,MAAA,CAAO,MAAA,GAAS,MAAA,CAAO,aAAA,EAAe,EAAE,KAAA,GAAQ,IAAA,EAAK,GAAI,EAAC,EAAG;AAC3E,IAAA,MAAM,SAAA,GAAY,SAAS,MAAM,CAAA;AACjC,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,CAAA,EAAG,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,0CAA0C,MAAA,CAAO,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,OAC9F;AAAA,IACF;AAEA,IAAA,MAAM,GAAA,GAAM,KAAA,GAAQ,SAAA,GAAY,CAAA,EAAG,SAAS,CAAA,SAAA,CAAA;AAC5C,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAChC,IAAA,IAAI,UAAU,OAAO,QAAA;AAErB,IAAA,MAAM,SAAS,YAAA,CAAa;AAAA,MAC1B,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,MAAA,EAAQ,SAAA;AAAA,MACR,SAAS,MAAA,CAAO,MAAA;AAAA,MAChB,GAAI,OAAO,cAAA,GAAiB,EAAE,gBAAgB,MAAA,CAAO,cAAA,KAAmB,EAAC;AAAA,MACzE,KAAA,EAAO,KAAA;AAAA,MACP;AAAA,KACD,CAAA;AACD,IAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,MAAM,CAAA;AACvB,IAAA,OAAO,MAAA;AAAA,EACT,CAAA;AACF;;;AC5DA,SAAS,OAAA,GAAgC;AACvC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,MAAM,SAAU,MAAA,CAA0D,eAAA;AAC1E,EAAA,OAAO,MAAA,IAAU,OAAO,MAAA,CAAO,KAAA,KAAU,aAAa,MAAA,GAAS,IAAA;AACjE;AAoBO,SAAS,UAAA,CAAW,MAA0B,IAAA,EAAyC;AAC5F,EAAA,MAAM,SAAS,OAAA,EAAQ;AACvB,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AAEpB,EAAA,MAAA,CAAO,KAAA,CAAM;AAAA,IACX,UAAA,EAAY,IAAA;AAAA,IACZ,SAAA,EAAW,OAAO,QAAA,CAAS,QAAA;AAAA,IAC3B,QAAA,EAAU,OAAO,QAAA,CAAS,IAAA;AAAA,IAC1B,YAAY,QAAA,CAAS,KAAA;AAAA,IACrB,GAAG;AAAA,GACJ,CAAA;AACD,EAAA,OAAO,IAAA;AACT","file":"index.js","sourcesContent":["/**\n * The configuration a Lynkow site hands this adapter, and the one function\n * that validates it.\n *\n * Nothing in this package reads `process.env`. Next inlines `NEXT_PUBLIC_*`\n * variables at build time by textual substitution, so only a literal\n * `process.env.NEXT_PUBLIC_X` written in the application's own source reaches\n * the browser bundle, and a library cannot spell out names an application\n * chose. The application reads its environment and passes the values here.\n *\n * Everything in the resolved configuration is public, because it reaches\n * client bundles. A server secret, such as the webhook signing secret, never\n * belongs in it.\n */\n\n/** What an application passes to {@link resolveConfig}, typically straight from its environment. */\nexport interface LynkowNextConfigInput {\n  /** The site's UUID, shown in the Lynkow admin and returned by the MCP `list_sites` tool. */\n  siteId: string | undefined\n  /** The public origin of the site, such as `https://www.example.com`. No path, query or fragment. */\n  siteUrl: string | undefined\n  /**\n   * The locales the site serves, as an array or a comma-separated list, in the\n   * order they should be advertised. Must mirror the site's enabled locales.\n   */\n  locales: string | readonly string[] | undefined\n  /** The default locale. Defaults to the first of `locales`. */\n  defaultLocale?: string | undefined\n  /**\n   * Whether the default locale carries its prefix in public URLs. `true`, the\n   * default, serves `/en/about` and `/fr/a-propos`; `false` serves `/about` and\n   * `/fr/a-propos`. The strings `\"true\"` and `\"false\"` are accepted too, so an\n   * environment variable can be passed as it is.\n   */\n  prefixDefaultLocale?: boolean | string | undefined\n  /** The Lynkow API origin. Defaults to `https://api.lynkow.com`. */\n  apiUrl?: string | undefined\n  /** The site's publishable key (`lkw_pk_...`), which storefront reads need. */\n  publishableKey?: string | undefined\n}\n\n/** A validated configuration, frozen. Every field is safe to ship to the browser. */\nexport interface LynkowNextConfig {\n  readonly siteId: string\n  /** The site's origin, with no trailing slash, so `${siteUrl}${path}` is always well formed. */\n  readonly siteUrl: string\n  /** The API origin, with no trailing slash. */\n  readonly apiUrl: string\n  readonly publishableKey: string | undefined\n  /** The locales as configured, in their configured case. URLs carry them lowercased. */\n  readonly locales: readonly string[]\n  /** One of `locales`, in its configured case. */\n  readonly defaultLocale: string\n  readonly prefixDefaultLocale: boolean\n}\n\n/**\n * Names to use for each field in error messages, such as the environment\n * variable the application reads it from.\n */\nexport type LynkowNextConfigLabels = Partial<Record<keyof LynkowNextConfigInput, string>>\n\n/**\n * The SDK's own default API origin, which it does not export. Repeated here\n * because the analytics tracker is a plain script tag rather than an SDK call,\n * and needs a real URL.\n */\nconst DEFAULT_API_URL = 'https://api.lynkow.com'\n\n/**\n * A DNS name or an IP literal. The URL standard lets a host carry `\"`, `'`, `&`\n * or a backtick, and the origin is pasted as text into JSON-LD, XML sitemaps and\n * HTML attributes, so only what a real host is made of passes.\n */\nconst HOST = /^(?:[a-z0-9_-]+(?:\\.[a-z0-9_-]+)*\\.?|\\[[0-9a-f:.]+\\])$/i\n\nconst UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\n/**\n * A language subtag, then optional region or variant subtags: `en`, `fr`,\n * `pt-BR`. Strict on purpose: a locale becomes a path segment, and a value\n * such as `//evil.example` or `en/../fr` would turn a localized link into one\n * that leaves the site or lands on another locale.\n */\nconst LOCALE = /^[a-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/\n\n/**\n * Validates a configuration and fills in its defaults.\n *\n * It throws from a call the application made, never while this module is\n * imported, so a site owner gets an error they can read rather than a stack\n * trace out of a dependency's import graph.\n *\n * @param input - The values, typically read from the application's environment\n * @param labels - Optional names for the fields in error messages, such as\n *   `{ siteId: 'NEXT_PUBLIC_LYNKOW_SITE_ID' }`\n * @throws {TypeError} Listing every problem found, one per line\n *\n * @example\n * export const config = resolveConfig({\n *   siteId: process.env.NEXT_PUBLIC_LYNKOW_SITE_ID,\n *   siteUrl: process.env.NEXT_PUBLIC_SITE_URL,\n *   locales: process.env.NEXT_PUBLIC_LOCALES,\n * })\n */\nexport function resolveConfig(\n  input: LynkowNextConfigInput,\n  labels: LynkowNextConfigLabels = {}\n): LynkowNextConfig {\n  const problems: string[] = []\n  const name = (field: keyof LynkowNextConfigInput) => `\\`${labels[field] ?? field}\\``\n\n  const siteId = input.siteId?.trim() ?? ''\n  if (!siteId) problems.push(`${name('siteId')} is required`)\n  else if (!UUID.test(siteId)) problems.push(`${name('siteId')} is not a site UUID: ${quote(siteId)}`)\n\n  const rawSiteUrl = input.siteUrl?.trim() ?? ''\n  if (!rawSiteUrl) problems.push(`${name('siteUrl')} is required`)\n  const siteUrl = rawSiteUrl ? parseOrigin(name('siteUrl'), rawSiteUrl, problems) : undefined\n\n  const rawApiUrl = input.apiUrl?.trim() ?? ''\n  const apiUrl = rawApiUrl ? parseOrigin(name('apiUrl'), rawApiUrl, problems) : DEFAULT_API_URL\n\n  const locales = parseLocales(name('locales'), input.locales, problems)\n\n  const wanted = input.defaultLocale?.trim() ?? ''\n  const defaultLocale = wanted\n    ? locales.find((locale) => locale.toLowerCase() === wanted.toLowerCase())\n    : locales[0]\n  if (wanted && locales.length > 0 && !defaultLocale) {\n    problems.push(\n      `${name('defaultLocale')} is ${quote(wanted)}, which is not one of the locales (${locales.join(', ')})`\n    )\n  }\n\n  const prefixDefaultLocale = parseFlag(\n    name('prefixDefaultLocale'),\n    input.prefixDefaultLocale,\n    true,\n    problems\n  )\n\n  // An allowlist, not a denylist of `lkw_sk_`: legacy secret tokens are bare\n  // hex and still authenticate, and every publishable key is `lkw_pk_`.\n  const publishableKey = input.publishableKey?.trim() || undefined\n  if (publishableKey && !publishableKey.startsWith('lkw_pk_')) {\n    problems.push(\n      `${name('publishableKey')} is not a publishable key (lkw_pk_...). This configuration reaches the browser, so it must never hold a secret API key`\n    )\n  }\n\n  if (problems.length > 0 || !siteUrl || !apiUrl || !defaultLocale) {\n    throw new TypeError(`Invalid Lynkow configuration:\\n  - ${problems.join('\\n  - ')}`)\n  }\n\n  return Object.freeze({\n    siteId: siteId.toLowerCase(),\n    siteUrl,\n    apiUrl,\n    publishableKey,\n    locales: Object.freeze([...locales]),\n    defaultLocale,\n    prefixDefaultLocale,\n  })\n}\n\n/**\n * Parses an http(s) origin. Whitespace and control characters are refused\n * before the URL parser sees the value, because it silently strips tabs and\n * newlines, and a newline in a site URL written into robots.txt is a line of\n * its own.\n */\nfunction parseOrigin(field: string, raw: string, problems: string[]): string | undefined {\n  if (hasUnsafeCharacter(raw)) {\n    problems.push(`${field} contains whitespace or a control character`)\n    return undefined\n  }\n  let url: URL\n  try {\n    url = new URL(raw)\n  } catch {\n    problems.push(`${field} is not an absolute URL${echoUrl(raw)}`)\n    return undefined\n  }\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') {\n    problems.push(`${field} must use http or https${echoUrl(raw)}`)\n  } else if (url.username || url.password) {\n    problems.push(`${field} must not carry credentials`)\n  } else if (!HOST.test(url.hostname)) {\n    problems.push(`${field} has a host with characters no domain carries${echoUrl(raw)}`)\n  } else if (!/^\\/+$/.test(url.pathname) || url.search || url.hash) {\n    problems.push(`${field} must be an origin, with no path, query or fragment${echoUrl(raw)}`)\n  } else {\n    return url.origin\n  }\n  return undefined\n}\n\nfunction parseLocales(\n  field: string,\n  input: string | readonly string[] | undefined,\n  problems: string[]\n): string[] {\n  const list = typeof input === 'string' ? input.split(',') : [...(input ?? [])]\n  const locales = list.map((locale) => String(locale).trim()).filter(Boolean)\n  if (locales.length === 0) {\n    problems.push(`${field} must name at least one locale`)\n    return []\n  }\n  const seen = new Set<string>()\n  for (const locale of locales) {\n    if (!LOCALE.test(locale)) {\n      problems.push(`${field} has an invalid locale ${quote(locale)}, expected a code such as \"en\" or \"pt-BR\"`)\n    }\n    const key = locale.toLowerCase()\n    if (seen.has(key)) problems.push(`${field} lists ${quote(locale)} twice`)\n    seen.add(key)\n  }\n  return locales\n}\n\nfunction parseFlag(\n  field: string,\n  value: boolean | string | undefined,\n  fallback: boolean,\n  problems: string[]\n): boolean {\n  if (typeof value === 'boolean') return value\n  const normalized = value?.trim().toLowerCase() ?? ''\n  if (normalized === '') return fallback\n  if (normalized === 'true') return true\n  if (normalized === 'false') return false\n  problems.push(`${field} must be true or false, not ${quote(String(value))}`)\n  return fallback\n}\n\nfunction hasUnsafeCharacter(value: string): boolean {\n  if (/\\s/.test(value)) return true\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code < 0x20 || code === 0x7f) return true\n  }\n  return false\n}\n\n/**\n * A URL value appended to an error message, or nothing when it holds an `@`:\n * a value the parser refused can still carry credentials it never extracted.\n */\nfunction echoUrl(raw: string): string {\n  return raw.includes('@') ? '' : `: ${quote(raw)}`\n}\n\n/** A value quoted for an error message, cut short so a pasted blob stays readable. */\nfunction quote(value: string): string {\n  return JSON.stringify(value.length > 120 ? `${value.slice(0, 120)}...` : value)\n}\n","import { createClient, type Client } from 'lynkow'\nimport type { LynkowNextConfig } from './config.js'\nimport { createLocalePaths } from './locale-paths.js'\n\n/** Options of the client {@link LynkowClients} returns. */\nexport interface ClientOptions {\n  /**\n   * `false` returns a client that sends each read once instead of retrying a\n   * 429 or a 503. Defaults to `true`.\n   */\n  retry?: boolean\n}\n\n/** Returns the Lynkow client of a locale, the default one when none is given. */\nexport type LynkowClients = (locale?: string, options?: ClientOptions) => Client\n\n/**\n * One Lynkow client per locale, reused across requests.\n *\n * The SDK's own cache stays OFF. On the server it is a process-global\n * unbounded `Map`, which would duplicate and outlive Next's data cache without\n * any of its invalidation. Caching is Next's job, expressed per read with\n * `cached()`.\n *\n * `{ retry: false }` gives a second client for the locale, because the SDK's\n * retry is a client setting rather than a per-read one. Only a read that\n * already knows what to do when it fails should ask for it.\n *\n * FOR READS THAT ARE THE SAME FOR EVERY VISITOR. The clients are shared by\n * every request the process serves, and the SDK keeps a buyer's state on the\n * client instance: the guest cart token and the signed-in customer session.\n * Calling `cart` or `customers` on one of these from server code would hand\n * one visitor's cart or session to the next. Buyer flows run in the browser,\n * or on a client created for that one request.\n *\n * A locale outside the configuration throws a `RangeError` instead of creating\n * a client. The clients live as long as the process, so a locale taken from a\n * URL and passed through unchecked would grow that set without bound. The\n * locale is matched case-insensitively and the client gets its configured\n * spelling.\n */\nexport function createClients(config: LynkowNextConfig): LynkowClients {\n  const { toLocale } = createLocalePaths(config)\n  const clients = new Map<string, Client>()\n\n  return function lynkow(locale = config.defaultLocale, { retry = true } = {}) {\n    const canonical = toLocale(locale)\n    if (!canonical) {\n      throw new RangeError(\n        `${JSON.stringify(locale)} is not one of the configured locales (${config.locales.join(', ')})`\n      )\n    }\n\n    const key = retry ? canonical : `${canonical}:no-retry`\n    const existing = clients.get(key)\n    if (existing) return existing\n\n    const client = createClient({\n      siteId: config.siteId,\n      locale: canonical,\n      baseUrl: config.apiUrl,\n      ...(config.publishableKey ? { publishableKey: config.publishableKey } : {}),\n      cache: false,\n      retry,\n    })\n    clients.set(key, client)\n    return client\n  }\n}\n","import type { AnalyticsEventType } from 'lynkow'\n\nexport type { AnalyticsEventType }\n\ninterface TrackerGlobal {\n  track: (event: Record<string, unknown>) => void\n}\n\nfunction tracker(): TrackerGlobal | null {\n  if (typeof window === 'undefined') return null\n  const global = (window as unknown as { LynkowAnalytics?: TrackerGlobal }).LynkowAnalytics\n  return global && typeof global.track === 'function' ? global : null\n}\n\n/**\n * Sends one custom event through the tracker already on the page.\n *\n * `type` is a CLOSED enum of mechanical interactions, the SDK's\n * `AnalyticsEventType`: there is no free-form event name. A value outside it is\n * a compile error rather than a silently dropped row, since the collector\n * answers `204` to a payload it rejects.\n *\n * Returns `false` when no tracker has loaded, which is never an error: on an\n * `opt-in` site none loads before the visitor accepts analytics. `true` means\n * the event was handed to the tracker, which adds the session id, the visitor\n * id and the timestamp, and drops the event itself when the visitor refused on\n * an `opt-in` or `opt-out` site.\n *\n * The tracker already records pageviews, scroll, clicks, form events and Core\n * Web Vitals. Reach for this only for an interaction that escapes it, such as a\n * form submitted through `fetch` without a real `submit` event.\n */\nexport function trackEvent(type: AnalyticsEventType, data?: Record<string, unknown>): boolean {\n  const global = tracker()\n  if (!global) return false\n\n  global.track({\n    event_type: type,\n    page_path: window.location.pathname,\n    page_url: window.location.href,\n    page_title: document.title,\n    ...data,\n  })\n  return true\n}\n"]}

package/dist/proxy/index.d.ts

@@ -0,0 +1,236 @@
+import { NextMiddleware, NextRequest, NextResponse } from 'next/server';
+import { Client, Redirect } from 'lynkow';
+import { L as LynkowNextConfig } from '../config-CwDV7jFS.js';
+export { DEFAULT_CMS_ORIGIN } from 'lynkow/visual-editor';
+
+/** Options of {@link createLynkowProxy}. */
+interface LynkowProxyOptions {
+    config: LynkowNextConfig;
+    /** The client of a locale, typically the function `createClients(config)` returns. */
+    client: (locale: string) => Client;
+    /**
+     * The origin allowed to frame the site on a preview request. Defaults to the
+     * Lynkow dashboard. Give the visual editor the same value, or neither one.
+     */
+    cmsOrigin?: string;
+}
+/**
+ * The proxy of a Lynkow site: redirects, then locale routing, with the preview
+ * headers the visual editor needs.
+ *
+ * 1. **Redirects**, first, on the path as the visitor typed it. The CMS stores
+ *    sources that way, a mix of `/old` and `/fr/blog/old` on a multilingual
+ *    site, so matching after a locale prefix is added would silently break
+ *    every unprefixed rule. The status code is the one the editor chose, which
+ *    `redirect()` from `next/navigation` could not give (307 or 308 only). A
+ *    target an editor wrote without a locale gets the visitor's, so the rule
+ *    and the locale step cost one hop rather than two.
+ * 2. **Locale routing.** With `prefixDefaultLocale` on, a path without a locale
+ *    is sent (307) to the visitor's best match: the `NEXT_LOCALE` cookie, then
+ *    `Accept-Language`, then the default. With it off, a path without a locale
+ *    IS the default locale's page and is served from its `[locale]` route under
+ *    the same URL, while `/<default>/...` answers 308 to that URL. Either way a
+ *    locale segment written in another case answers 308 to its lowercase form,
+ *    the form the API writes, so each page has one URL.
+ *
+ * The application keeps its own `config.matcher`, which Next requires to be a
+ * literal in `src/proxy.ts`. It must exclude everything that is not a page:
+ * Next internals, API routes and files.
+ *
+ * @example
+ * // src/proxy.ts
+ * import { createClients } from '@lynkow/next'
+ * import { createLynkowProxy } from '@lynkow/next/proxy'
+ * import { config as site } from './lib/config'
+ *
+ * export default createLynkowProxy({ config: site, client: createClients(site) })
+ *
+ * export const config = {
+ *   matcher: ['/((?!_next/|api/|.*\\.[\\w]+$).*)'],
+ * }
+ */
+declare function createLynkowProxy({ config, client, cmsOrigin }: LynkowProxyOptions): NextMiddleware;
+
+interface LynkowPreviewOptions {
+    /**
+     * Origin allowed to frame this site, defaulting to {@link DEFAULT_CMS_ORIGIN}.
+     *
+     * Note the deliberate divergence from `VisualEditorConfig.cmsOrigin`: an EMPTY
+     * value here takes the default too, because the safe direction for a CSP is a
+     * header that names the real dashboard rather than one that names nothing.
+     * The editor half instead refuses to start, since an editor pointed nowhere is
+     * inert rather than unsafe.
+     */
+    cmsOrigin?: string;
+    /**
+     * @deprecated Ignored. The middleware always looks for `lynkow-preview`.
+     *
+     * The Lynkow dashboard always opens the preview with `lynkow-preview=true` in
+     * the URL, and the visual editor only starts when it sees that exact parameter.
+     * Any other name would stop the dashboard from framing the page and leave the
+     * editor inactive, so this option no longer has any effect. Remove it from your
+     * configuration.
+     */
+    previewParam?: string;
+}
+/**
+ * Creates a Next.js middleware that lets the Lynkow dashboard frame the site in
+ * preview mode. It is {@link withLynkowPreview} around a middleware that returns
+ * nothing, so every response starts from `NextResponse.next()`.
+ *
+ * On a request carrying the `lynkow-preview` query parameter, the response gets
+ * `Content-Security-Policy: frame-ancestors 'self' <cmsOrigin>` and loses any
+ * `X-Frame-Options`. Every other response gets `frame-ancestors 'self'`.
+ */
+declare function lynkowPreviewMiddleware(options?: LynkowPreviewOptions): NextMiddleware;
+/**
+ * Wraps an existing Next.js middleware so its responses let the Lynkow dashboard
+ * frame the site in preview mode.
+ *
+ * The wrapped middleware's own `Content-Security-Policy` is kept and merged at
+ * the directive level. In preview mode (the `lynkow-preview` query parameter),
+ * its `frame-ancestors` is replaced by one allowing `cmsOrigin` and
+ * `X-Frame-Options` is removed. Outside preview mode, a `frame-ancestors` it
+ * already set is left as is, and `frame-ancestors 'self'` is added only when it
+ * set none. A middleware returning nothing is treated as `NextResponse.next()`.
+ */
+declare function withLynkowPreview(existingMiddleware: NextMiddleware, options?: LynkowPreviewOptions): NextMiddleware;
+
+/** Returns the redirect rule matching a pathname, or null. */
+type RedirectMatcher = (pathname: string) => Promise<Redirect | null>;
+/**
+ * A redirect lookup with its own in-process cache.
+ *
+ * Why its own cache, when every other read hands caching to Next. Two facts,
+ * both measured against Next 16.3.4 and the live API on 2026-09-08:
+ *
+ *   1. **Next's fetch cache does not reach the proxy.** `next: { revalidate,
+ *      tags }` is accepted and ignored there: five identical requests each
+ *      produced a real network call. So `cached()` would be decoration here,
+ *      and `revalidateTag()` from the revalidation webhook can never reach this
+ *      code, since the proxy is a separate bundle with its own module scope.
+ *   2. **A miss is uncacheable at the edge.** A path with no redirect answers
+ *      404 with `Cache-Control: no-store`, so a CDN bypasses it. Almost every
+ *      request is a miss, so an uncached lookup would send every page view of
+ *      the site to the API.
+ *
+ * The cache is per process, so a multi-instance deployment holds one copy per
+ * instance, and nothing invalidates it early: `TTL_MS` is the whole contract.
+ *
+ * Concurrent lookups of one path share one request, so a link posted somewhere
+ * busy costs one call rather than one per simultaneous visitor. A failed lookup
+ * answers `null` and is never cached: a transient API error would otherwise
+ * blind every redirect on the site for a full TTL, while answering "no
+ * redirect" for one request gives the visitor exactly the page they would have
+ * got without this module.
+ *
+ * `pathname` must carry no query string: the API compares the stored source
+ * against it verbatim, so `/old?page=2` matches nothing.
+ */
+declare function createRedirectMatcher(client: () => Client): RedirectMatcher;
+
+/**
+ * Options for the {@link markdownProxy} helper.
+ */
+interface MarkdownProxyOptions {
+    /**
+     * URL prefix where the Markdown route handler is mounted. The helper
+     * rewrites `Accept: text/markdown` requests from `<path>` to
+     * `<mdPathPrefix><path>`. Defaults to `'/md'`.
+     *
+     * If your route handler lives at `app/markdown/[...path]/route.ts`,
+     * set this to `'/markdown'`.
+     */
+    mdPathPrefix?: string;
+    /**
+     * Whether to set `Vary: Accept` on the rewritten response. Defaults
+     * to `true`. Set to `false` only if your edge or CDN already sets the
+     * header and you want to avoid duplication.
+     */
+    setVary?: boolean;
+    /**
+     * Whether to set `X-Forwarded-Accept: text/markdown` on the rewritten
+     * request so the route handler can confirm the request originated
+     * from a Markdown negotiation. Defaults to `true`.
+     */
+    setForwardedAccept?: boolean;
+}
+/**
+ * Parses an `Accept` header per RFC 9110 §12.5.1 and returns the
+ * highest q-value for a target media type. Supports exact match
+ * (`text/markdown`), type wildcard (`text/*`), full wildcard (`*\/*`),
+ * and q-values.
+ *
+ * Returns `0` if the type is not present or has `q=0`. Returns `1` if
+ * no q value is given (per RFC, missing q means q=1). Out-of-range or
+ * non-numeric q values fall back to the default `1`.
+ *
+ * @param acceptHeader - The raw `Accept` header value, or `null` if absent
+ * @param targetType - The target media type, e.g. `'text/markdown'`
+ * @returns The highest q-value for the target type (0 to 1)
+ *
+ * @example
+ * ```typescript
+ * acceptQuality('text/html;q=0.9, text/markdown;q=0.8', 'text/markdown') // 0.8
+ * acceptQuality('text/markdown', 'text/markdown')                        // 1
+ * acceptQuality(null, 'text/markdown')                                   // 0
+ * ```
+ */
+declare function acceptQuality(acceptHeader: string | null, targetType: string): number;
+/**
+ * Decides whether the request prefers Markdown over HTML based on its
+ * `Accept` header.
+ *
+ * Returns `true` when `Accept` contains `text/markdown` with q strictly
+ * higher than `text/html`. Ties break in favor of HTML (the default
+ * browsers expect).
+ *
+ * @param acceptHeader - The raw `Accept` header value, or `null` if absent
+ * @returns `true` when Markdown is the preferred representation
+ *
+ * @example
+ * ```typescript
+ * prefersMarkdown('text/markdown;q=0.9, text/html;q=0.8') // true
+ * prefersMarkdown('text/markdown, text/html')             // false (tie -> HTML)
+ * prefersMarkdown('text/html')                            // false
+ * ```
+ */
+declare function prefersMarkdown(acceptHeader: string | null): boolean;
+/**
+ * Next.js proxy/middleware helper that translates
+ * `Accept: text/markdown` requests into rewrites to a dedicated
+ * Markdown route handler.
+ *
+ * Returns the rewritten `NextResponse` when the request preferred
+ * Markdown, or `null` when the request did not (so the caller can pass
+ * through to the next middleware step).
+ *
+ * Sets `Vary: Accept` on the rewritten response so intermediate caches
+ * keep separate variants for HTML and Markdown.
+ *
+ * The helper is Edge runtime compatible (no `node:` imports).
+ *
+ * @param request - The incoming `NextRequest`
+ * @param options - Optional {@link MarkdownProxyOptions} overrides
+ * @returns A `NextResponse.rewrite(...)` when Markdown was preferred, or `null` otherwise
+ *
+ * @example
+ * ```typescript
+ * // Next 16, proxy.ts
+ * import { markdownProxy } from '@lynkow/next/proxy'
+ * import { NextResponse, type NextRequest } from 'next/server'
+ *
+ * export function proxy(request: NextRequest) {
+ *   const md = markdownProxy(request)
+ *   if (md) return md
+ *   return NextResponse.next()
+ * }
+ *
+ * export const config = {
+ *   matcher: ['/((?!_next|favicon.ico|md|api).*)'],
+ * }
+ * ```
+ */
+declare function markdownProxy(request: NextRequest, options?: MarkdownProxyOptions): NextResponse | null;
+
+export { type LynkowProxyOptions, type MarkdownProxyOptions, type RedirectMatcher, acceptQuality, createLynkowProxy, createRedirectMatcher, lynkowPreviewMiddleware, markdownProxy, prefersMarkdown, withLynkowPreview };

package/dist/proxy/index.js

@@ -0,0 +1,219 @@
+import { createLocalePaths } from '../chunk-4QTGOTFV.js';
+import { NextResponse } from 'next/server';
+import { DEFAULT_CMS_ORIGIN, PREVIEW_PARAM } from 'lynkow/visual-editor';
+export { DEFAULT_CMS_ORIGIN } from 'lynkow/visual-editor';
+
+var CSP_HEADER = "Content-Security-Policy";
+function warnIgnoredPreviewParam(options) {
+  const previewParam = options?.previewParam;
+  if (previewParam && previewParam !== PREVIEW_PARAM) {
+    console.warn(
+      `[lynkow] The previewParam option ("${previewParam}") is deprecated and ignored. The preview middleware always uses "${PREVIEW_PARAM}", the only parameter the Lynkow dashboard sends and the visual editor recognises. Remove the option.`
+    );
+  }
+}
+function lynkowPreviewMiddleware(options) {
+  return withLynkowPreview(() => void 0, options);
+}
+function isFrameAncestors(directive) {
+  const [name = ""] = directive.split(/\s+/, 1);
+  return name.toLowerCase() === "frame-ancestors";
+}
+function parseCspList(value) {
+  if (!value) return [];
+  return value.split(",").map(
+    (policy) => policy.split(";").map((directive) => directive.trim()).filter((directive) => directive.length > 0)
+  ).filter((policy) => policy.length > 0);
+}
+function appendToFirstPolicy(policies, directive) {
+  const [first = [], ...rest] = policies;
+  return [[...first, directive], ...rest];
+}
+function serializeCspList(policies) {
+  return policies.filter((policy) => policy.length > 0).map((policy) => policy.join("; ")).join(", ");
+}
+function addCspHeaders(response, request, cmsOrigin) {
+  const isPreview = request.nextUrl.searchParams.has(PREVIEW_PARAM);
+  const policies = parseCspList(response.headers.get(CSP_HEADER));
+  if (isPreview) {
+    const withoutFraming = policies.map(
+      (policy) => policy.filter((directive) => !isFrameAncestors(directive))
+    );
+    const merged = appendToFirstPolicy(withoutFraming, `frame-ancestors 'self' ${cmsOrigin}`);
+    response.headers.set(CSP_HEADER, serializeCspList(merged));
+    response.headers.delete("X-Frame-Options");
+  } else if (!policies.some((policy) => policy.some(isFrameAncestors))) {
+    const merged = appendToFirstPolicy(policies, "frame-ancestors 'self'");
+    response.headers.set(CSP_HEADER, serializeCspList(merged));
+  }
+  return response;
+}
+function withLynkowPreview(existingMiddleware, options) {
+  const cmsOrigin = options?.cmsOrigin || DEFAULT_CMS_ORIGIN;
+  warnIgnoredPreviewParam(options);
+  return function middleware(request, event) {
+    const response = existingMiddleware(request, event);
+    const finalResponse = response instanceof Promise ? response.then((res) => addCspHeaders(res || NextResponse.next(), request, cmsOrigin)) : addCspHeaders(response || NextResponse.next(), request, cmsOrigin);
+    return finalResponse;
+  };
+}
+
+// src/proxy/redirects.ts
+var TTL_MS = 6e4;
+var MAX_ENTRIES = 500;
+function createRedirectMatcher(client) {
+  const cache = /* @__PURE__ */ new Map();
+  const inFlight = /* @__PURE__ */ new Map();
+  function remember(path, value) {
+    if (cache.size >= MAX_ENTRIES && !cache.has(path)) {
+      const oldest = cache.keys().next().value;
+      if (oldest !== void 0) cache.delete(oldest);
+    }
+    cache.set(path, { value, expiresAt: Date.now() + TTL_MS });
+  }
+  return async function matchRedirect(pathname) {
+    const entry = cache.get(pathname);
+    if (entry && entry.expiresAt > Date.now()) return entry.value;
+    if (entry) cache.delete(pathname);
+    const pending = inFlight.get(pathname);
+    if (pending) return pending;
+    const lookup = Promise.resolve().then(() => client().paths.matchRedirect(pathname)).then((value) => {
+      remember(pathname, value);
+      return value;
+    }).catch((error) => {
+      console.error(`[lynkow] redirect lookup failed for ${pathname}`, error);
+      return null;
+    }).finally(() => {
+      inFlight.delete(pathname);
+    });
+    inFlight.set(pathname, lookup);
+    return lookup;
+  };
+}
+
+// src/proxy/lynkow-proxy.ts
+var LOCALE_COOKIE = "NEXT_LOCALE";
+function createLynkowProxy({ config, client, cmsOrigin }) {
+  const paths = createLocalePaths(config);
+  const { defaultLocale, prefixDefaultLocale } = config;
+  const defaultSegment = `/${defaultLocale.toLowerCase()}`;
+  const matchRedirect = createRedirectMatcher(() => client(defaultLocale));
+  function prefixOf(pathname) {
+    const segment = pathname.split("/")[1] ?? "";
+    const locale = paths.toLocale(segment);
+    return locale ? { locale, rest: pathname.slice(segment.length + 1) || "/" } : null;
+  }
+  function resolveLocale(request) {
+    return paths.localeFromPath(request.nextUrl.pathname) ?? paths.toLocale(request.cookies.get(LOCALE_COOKIE)?.value) ?? paths.negotiateLocale(request.headers.get("accept-language"));
+  }
+  async function findRedirect(pathname) {
+    if (prefixDefaultLocale || prefixOf(pathname)) return matchRedirect(pathname);
+    const [typed, prefixed] = await Promise.all([
+      matchRedirect(pathname),
+      matchRedirect(pathname === "/" ? defaultSegment : defaultSegment + pathname)
+    ]);
+    return typed ?? prefixed;
+  }
+  function redirectTo(request, redirect, locale) {
+    const from = request.nextUrl;
+    let url;
+    try {
+      url = new URL(paths.localizeHref(redirect.target, locale), from.href);
+    } catch {
+      console.error(`[lynkow] unparseable redirect target ${redirect.target} for ${redirect.source}`);
+      return null;
+    }
+    if (url.origin === from.origin) url.pathname = url.pathname.replace(/^\/{2,}/, "/");
+    if (redirect.preserveQueryString) {
+      for (const [key, value] of from.searchParams) {
+        if (!url.searchParams.has(key)) url.searchParams.append(key, value);
+      }
+    }
+    if (url.origin === from.origin && url.pathname === from.pathname && url.search === from.search) {
+      console.error(`[lynkow] ignoring self-referential redirect on ${redirect.source}`);
+      return null;
+    }
+    return NextResponse.redirect(url, redirect.statusCode);
+  }
+  function redirectToPath(request, pathname, status) {
+    const url = request.nextUrl.clone();
+    url.pathname = pathname;
+    return NextResponse.redirect(url, status);
+  }
+  function route(request, locale) {
+    const { pathname } = request.nextUrl;
+    const prefix = prefixOf(pathname);
+    if (prefix) {
+      const canonical = paths.localePath(prefix.locale, prefix.rest);
+      return canonical === pathname ? NextResponse.next() : redirectToPath(request, canonical, 308);
+    }
+    if (!prefixDefaultLocale) {
+      const url = request.nextUrl.clone();
+      url.pathname = pathname === "/" ? defaultSegment : defaultSegment + pathname;
+      return NextResponse.rewrite(url);
+    }
+    const response = redirectToPath(request, paths.localePath(locale, pathname), 307);
+    response.cookies.set(LOCALE_COOKIE, locale, {
+      path: "/",
+      maxAge: 60 * 60 * 24 * 365,
+      sameSite: "lax"
+    });
+    return response;
+  }
+  async function site(request) {
+    const locale = resolveLocale(request);
+    const redirect = await findRedirect(request.nextUrl.pathname);
+    return redirect && redirectTo(request, redirect, locale) || route(request, locale);
+  }
+  return withLynkowPreview(site, { cmsOrigin });
+}
+var DEFAULT_MD_PREFIX = "/md";
+function acceptQuality(acceptHeader, targetType) {
+  if (!acceptHeader) return 0;
+  const [targetMain, targetSub] = targetType.toLowerCase().split("/");
+  let best = 0;
+  for (const raw of acceptHeader.split(",")) {
+    const parts = raw.trim().split(";").map((p) => p.trim()).filter(Boolean);
+    const mediaType = parts[0]?.toLowerCase();
+    if (!mediaType || !mediaType.includes("/")) continue;
+    const [main, sub] = mediaType.split("/");
+    const matches = main === targetMain && sub === targetSub || main === targetMain && sub === "*" || main === "*" && sub === "*";
+    if (!matches) continue;
+    let q = 1;
+    for (const param of parts.slice(1)) {
+      if (param.startsWith("q=")) {
+        const parsed = Number.parseFloat(param.slice(2));
+        if (!Number.isNaN(parsed) && parsed >= 0 && parsed <= 1) q = parsed;
+      }
+    }
+    if (q > best) best = q;
+  }
+  return best;
+}
+function prefersMarkdown(acceptHeader) {
+  const md = acceptQuality(acceptHeader, "text/markdown");
+  if (md === 0) return false;
+  const html = acceptQuality(acceptHeader, "text/html");
+  return md > html;
+}
+function markdownProxy(request, options) {
+  const accept = request.headers.get("accept");
+  if (!prefersMarkdown(accept)) return null;
+  const prefix = options?.mdPathPrefix ?? DEFAULT_MD_PREFIX;
+  const setVary = options?.setVary ?? true;
+  const setForwardedAccept = options?.setForwardedAccept ?? true;
+  const url = request.nextUrl.clone();
+  if (url.pathname.startsWith(`${prefix}/`) || url.pathname === prefix) {
+    return null;
+  }
+  url.pathname = `${prefix}${url.pathname}`;
+  const headers = new Headers(request.headers);
+  if (setForwardedAccept) headers.set("x-forwarded-accept", "text/markdown");
+  const response = NextResponse.rewrite(url, { request: { headers } });
+  if (setVary) response.headers.set("vary", "accept");
+  return response;
+}
+
+export { acceptQuality, createLynkowProxy, createRedirectMatcher, lynkowPreviewMiddleware, markdownProxy, prefersMarkdown, withLynkowPreview };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map