@sonordev/site-kit 2.8.2 → 3.0.0

package/dist/middleware/index.js

@@ -7,6 +7,76 @@ require('../chunk-JP5WGL75.js');
 require('../chunk-ZSMWDLMK.js');
 var server = require('next/server');
 
+// src/middleware/segment.ts
+var PAID_MEDIUMS = ["cpc", "ppc", "paid", "paidsearch", "paid-search", "display", "cpm", "banner"];
+var SOCIAL_MEDIUMS = ["social", "social-media", "social_media", "sm"];
+var SOCIAL_HOSTS = [
+  "facebook.",
+  "instagram.",
+  "linkedin.",
+  "t.co",
+  "twitter.",
+  "x.com",
+  "pinterest.",
+  "tiktok.",
+  "youtube.",
+  "reddit."
+];
+var SEARCH_HOSTS = ["google.", "bing.", "duckduckgo.", "yahoo.", "ecosia.", "brave.", "baidu.", "yandex."];
+function resolveVisitorSegment(request, opts) {
+  const params = request.nextUrl.searchParams;
+  const medium = (params.get("utm_medium") || "").toLowerCase().trim();
+  const campaign = params.get("utm_campaign");
+  let source = "direct";
+  if (PAID_MEDIUMS.includes(medium)) {
+    source = "paid";
+  } else if (SOCIAL_MEDIUMS.includes(medium)) {
+    source = "social";
+  } else if (medium === "organic") {
+    source = "organic";
+  } else if (medium === "referral") {
+    source = "referral";
+  } else if (params.get("utm_source") || params.get("gclid") || params.get("fbclid")) {
+    if (params.get("gclid")) source = "paid";
+    else if (params.get("fbclid")) source = "social";
+    else source = "referral";
+  } else {
+    const ref = request.headers.get("referer") || "";
+    if (ref) {
+      try {
+        const host = new URL(ref).host.toLowerCase();
+        const selfHost = request.nextUrl.host.toLowerCase();
+        if (host && host !== selfHost) {
+          if (SEARCH_HOSTS.some((h) => host.includes(h))) source = "organic";
+          else if (SOCIAL_HOSTS.some((h) => host.includes(h))) source = "social";
+          else source = "referral";
+        }
+      } catch {
+      }
+    }
+  }
+  return {
+    visitorType: opts.hadVisitorCookie ? "returning" : "new",
+    source,
+    campaign: campaign || null
+  };
+}
+function encodeSegment(seg) {
+  const campaign = (seg.campaign || "").replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 40);
+  return `${seg.visitorType}|${seg.source}|${campaign}`;
+}
+function decodeSegment(value) {
+  if (!value) return null;
+  const [visitorType, source, campaign] = value.split("|");
+  if (visitorType !== "new" && visitorType !== "returning") return null;
+  return {
+    visitorType,
+    source: ["paid", "organic", "social", "referral", "direct"].includes(source) ? source : "direct",
+    campaign: campaign || null
+  };
+}
+
+// src/middleware/index.ts
 function createMiddleware(config) {
   const securityHeaders = chunk3MYZS6PD_js.buildSecurityHeaders(
     config?.securityHeaders
@@ -42,12 +112,44 @@ function createMiddleware(config) {
         applyHeaders(response, discoveryHeaders);
       }
     }
+    if (config?.identity) {
+      const idCfg = typeof config.identity === "object" ? config.identity : {};
+      const hadVisitorCookie = !!request.cookies.get("_sk_vid")?.value;
+      if (!hadVisitorCookie) {
+        const maxAgeDays = idCfg.cookieMaxAgeDays ?? 730;
+        response.cookies.set("_sk_vid", generateVisitorId(), {
+          maxAge: maxAgeDays * 24 * 60 * 60,
+          path: "/",
+          sameSite: "lax",
+          secure: true
+        });
+      }
+      if (idCfg.segment !== false) {
+        const segment = encodeSegment(
+          resolveVisitorSegment(request, { hadVisitorCookie })
+        );
+        response.cookies.set("_sk_seg", segment, {
+          // Session-ish: a fresh campaign / source on a later visit re-segments.
+          maxAge: 30 * 60,
+          path: "/",
+          sameSite: "lax",
+          secure: true
+        });
+      }
+    }
     if (config?.after) {
       response = await config.after(request, response);
     }
     return response;
   };
 }
+function generateVisitorId() {
+  if (typeof crypto !== "undefined" && crypto.randomUUID) return crypto.randomUUID();
+  return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (c) => {
+    const r = Math.random() * 16 | 0;
+    return (c === "x" ? r : r & 3 | 8).toString(16);
+  });
+}
 function applyHeaders(response, headers) {
   for (const [key, value] of Object.entries(headers)) {
     response.headers.set(key, value);
@@ -62,6 +164,9 @@ var createProxy = createMiddleware;
 
 exports.createMiddleware = createMiddleware;
 exports.createProxy = createProxy;
+exports.decodeSegment = decodeSegment;
+exports.encodeSegment = encodeSegment;
+exports.resolveVisitorSegment = resolveVisitorSegment;
 exports.siteKitMatcher = siteKitMatcher;
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/middleware/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/middleware/index.ts"],"names":["buildSecurityHeaders","buildAiDiscoveryHeaders","handleManagedRedirects","NextResponse"],"mappings":";;;;;;;;;AAiFO,SAAS,iBAAiB,MAAA,EAAkC;AACjE,EAAA,MAAM,eAAA,GAAkBA,qCAAA;AAAA,IACtB,MAAA,EAAQ;AAAA,GACV;AAGA,EAAA,MAAM,gBAAA,GACJ,MAAA,EAAQ,aAAA,GACJC,wCAAA,CAAwB;AAAA,IACtB,OAAA,EAAS,OAAO,aAAA,CAAc,OAAA;AAAA,IAC9B,QAAA,EAAU,OAAO,aAAA,CAAc;AAAA,GAChC,IACD,EAAC;AAEP,EAAA,OAAO,eAAe,MACpB,OAAA,EACuB;AAEvB,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,MAAM,aAAA,GAAgB,MAAM,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA;AACjD,MAAA,IAAI,aAAA,EAAe;AAEjB,QAAA,YAAA,CAAa,eAAe,eAAe,CAAA;AAC3C,QAAA,OAAO,aAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,MAAA,EAAQ,cAAc,KAAA,EAAO;AAC/B,MAAA,MAAM,iBACJ,OAAO,MAAA,EAAQ,cAAc,QAAA,GACzB,MAAA,CAAO,YACP,EAAC;AAEP,MAAA,MAAM,WAAW,MAAMC,uCAAA;AAAA,QACrB,OAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,QAAA,EAAU;AAEZ,QAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AACtC,QAAA,OAAO,QAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,QAAA,GAAWC,oBAAa,IAAA,EAAK;AAGjC,IAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AAGtC,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,gBAAgB,CAAA,CAAE,SAAS,CAAA,EAAG;AAC5C,MAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA,IAAK,EAAA;AAChD,MAAA,IAAI,OAAO,QAAA,CAAS,WAAW,KAAK,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AAC1D,QAAA,YAAA,CAAa,UAAU,gBAAgB,CAAA;AAAA,MACzC;AAAA,IACF;AAGA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,QAAA,GAAW,MAAM,MAAA,CAAO,KAAA,CAAM,OAAA,EAAS,QAAQ,CAAA;AAAA,IACjD;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AAEA,SAAS,YAAA,CACP,UACA,OAAA,EACM;AACN,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,IAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,EACjC;AACF;AAMO,IAAM,cAAA,GAAiB;AAAA,EAC5B,OAAA,EAAS;AAAA,IACP;AAAA;AAEJ;AAGO,IAAM,WAAA,GAAc","file":"index.js","sourcesContent":["/**\n * @sonordev/site-kit/middleware\n *\n * Composable Next.js middleware factory. Handles:\n * - Portal-managed redirects (via existing handleManagedRedirects)\n * - Security headers (X-Frame-Options, CSP, etc.)\n * - Optional before/after hooks for custom logic\n *\n * @example\n * ```ts\n * // middleware.ts — entire file\n * import { createMiddleware, siteKitMatcher } from '@sonordev/site-kit/middleware'\n *\n * export default createMiddleware()\n * export const config = siteKitMatcher\n * ```\n *\n * @example With custom hooks:\n * ```ts\n * export default createMiddleware({\n *   securityHeaders: { frameOptions: 'SAMEORIGIN' },\n *   before: (req) => {\n *     // Custom auth check, etc.\n *   },\n * })\n * ```\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport {\n  handleManagedRedirects,\n  type RedirectConfig,\n} from '../redirects'\nimport {\n  buildSecurityHeaders,\n  type SecurityHeadersConfig,\n} from './securityHeaders'\nimport { buildAiDiscoveryHeaders } from '../llms/discovery-headers'\n\nexport type { SecurityHeadersConfig } from './securityHeaders'\n\nexport interface LlmsDiscoveryConfig {\n  /** Canonical site origin, e.g. `https://example.com` */\n  siteUrl: string\n  /** Path to llms.txt (default `/llms.txt`) */\n  llmsPath?: string\n}\n\nexport interface SiteKitMiddlewareConfig {\n  /** Enable Portal-managed redirects. Default: true */\n  redirects?: boolean | RedirectConfig\n  /** Enable security headers. Default: true */\n  securityHeaders?: boolean | SecurityHeadersConfig\n  /**\n   * Opt-in: inject `Link: <...>; rel=\"describedby\"` header on HTML responses\n   * pointing to /llms.txt for AI crawler discovery (RFC 8288).\n   * Preferred over visible footer links.\n   */\n  llmsDiscovery?: LlmsDiscoveryConfig | false\n  /**\n   * Hook that runs BEFORE redirect check.\n   * Return a NextResponse to short-circuit, or undefined to continue.\n   */\n  before?: (\n    request: NextRequest,\n  ) => NextResponse | undefined | Promise<NextResponse | undefined>\n  /**\n   * Hook that runs AFTER all processing.\n   * Receives the response that will be sent — mutate headers, etc.\n   */\n  after?: (\n    request: NextRequest,\n    response: NextResponse,\n  ) => NextResponse | Promise<NextResponse>\n}\n\n/**\n * Create a fully-featured Next.js middleware function.\n *\n * With zero config this handles redirects + security headers automatically.\n */\nexport function createMiddleware(config?: SiteKitMiddlewareConfig) {\n  const securityHeaders = buildSecurityHeaders(\n    config?.securityHeaders,\n  )\n\n  // Pre-compute discovery headers (static per middleware instance)\n  const discoveryHeaders: Record<string, string> =\n    config?.llmsDiscovery\n      ? buildAiDiscoveryHeaders({\n          siteUrl: config.llmsDiscovery.siteUrl,\n          llmsPath: config.llmsDiscovery.llmsPath,\n        })\n      : {}\n\n  return async function proxy(\n    request: NextRequest,\n  ): Promise<NextResponse> {\n    // 1. Run user's 'before' hook\n    if (config?.before) {\n      const earlyResponse = await config.before(request)\n      if (earlyResponse) {\n        // Apply security headers even to early responses\n        applyHeaders(earlyResponse, securityHeaders)\n        return earlyResponse\n      }\n    }\n\n    // 2. Check Portal-managed redirects (unless disabled)\n    if (config?.redirects !== false) {\n      const redirectConfig: RedirectConfig =\n        typeof config?.redirects === 'object'\n          ? config.redirects\n          : {}\n\n      const redirect = await handleManagedRedirects(\n        request,\n        redirectConfig,\n      )\n      if (redirect) {\n        // Redirects get security headers too\n        applyHeaders(redirect, securityHeaders)\n        return redirect\n      }\n    }\n\n    // 3. Build the pass-through response\n    let response = NextResponse.next()\n\n    // 4. Apply security headers\n    applyHeaders(response, securityHeaders)\n\n    // 5. Apply AI discovery Link header (only on HTML-like requests, not static assets)\n    if (Object.keys(discoveryHeaders).length > 0) {\n      const accept = request.headers.get('accept') || ''\n      if (accept.includes('text/html') || accept.includes('*/*')) {\n        applyHeaders(response, discoveryHeaders)\n      }\n    }\n\n    // 6. Run user's 'after' hook\n    if (config?.after) {\n      response = await config.after(request, response)\n    }\n\n    return response\n  }\n}\n\nfunction applyHeaders(\n  response: NextResponse,\n  headers: Record<string, string>,\n): void {\n  for (const [key, value] of Object.entries(headers)) {\n    response.headers.set(key, value)\n  }\n}\n\n/**\n * Standard matcher config that excludes static assets and images.\n * Export alongside createProxy/createMiddleware in your proxy.ts.\n */\nexport const siteKitMatcher = {\n  matcher: [\n    '/((?!_next/static|_next/image|favicon\\\\.ico|.*\\\\.(?:ico|png|jpg|jpeg|gif|webp|svg|woff2?)$).*)',\n  ],\n}\n\n/** Next.js 16+ alias — same as createMiddleware, named for the proxy convention. */\nexport const createProxy = createMiddleware\n"]}
+{"version":3,"sources":["../../src/middleware/segment.ts","../../src/middleware/index.ts"],"names":["buildSecurityHeaders","buildAiDiscoveryHeaders","handleManagedRedirects","NextResponse"],"mappings":";;;;;;;;;;AAyBA,IAAM,YAAA,GAAe,CAAC,KAAA,EAAO,KAAA,EAAO,QAAQ,YAAA,EAAc,aAAA,EAAe,SAAA,EAAW,KAAA,EAAO,QAAQ,CAAA;AACnG,IAAM,cAAA,GAAiB,CAAC,QAAA,EAAU,cAAA,EAAgB,gBAAgB,IAAI,CAAA;AACtE,IAAM,YAAA,GAAe;AAAA,EACnB,WAAA;AAAA,EACA,YAAA;AAAA,EACA,WAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;AACA,IAAM,YAAA,GAAe,CAAC,SAAA,EAAW,OAAA,EAAS,eAAe,QAAA,EAAU,SAAA,EAAW,QAAA,EAAU,QAAA,EAAU,SAAS,CAAA;AAMpG,SAAS,qBAAA,CACd,SACA,IAAA,EACgB;AAChB,EAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,YAAA;AAC/B,EAAA,MAAM,MAAA,GAAA,CAAU,OAAO,GAAA,CAAI,YAAY,KAAK,EAAA,EAAI,WAAA,GAAc,IAAA,EAAK;AACnE,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,cAAc,CAAA;AAE1C,EAAA,IAAI,MAAA,GAAwB,QAAA;AAE5B,EAAA,IAAI,YAAA,CAAa,QAAA,CAAS,MAAM,CAAA,EAAG;AACjC,IAAA,MAAA,GAAS,MAAA;AAAA,EACX,CAAA,MAAA,IAAW,cAAA,CAAe,QAAA,CAAS,MAAM,CAAA,EAAG;AAC1C,IAAA,MAAA,GAAS,QAAA;AAAA,EACX,CAAA,MAAA,IAAW,WAAW,SAAA,EAAW;AAC/B,IAAA,MAAA,GAAS,SAAA;AAAA,EACX,CAAA,MAAA,IAAW,WAAW,UAAA,EAAY;AAChC,IAAA,MAAA,GAAS,UAAA;AAAA,EACX,CAAA,MAAA,IAAW,MAAA,CAAO,GAAA,CAAI,YAAY,CAAA,IAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,IAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG;AAElF,IAAA,IAAI,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,EAAG,MAAA,GAAS,MAAA;AAAA,SAAA,IACzB,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG,MAAA,GAAS,QAAA;AAAA,SACnC,MAAA,GAAS,UAAA;AAAA,EAChB,CAAA,MAAO;AAEL,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,IAAK,EAAA;AAC9C,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,KAAK,WAAA,EAAY;AAC3C,QAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,WAAA,EAAY;AAClD,QAAA,IAAI,IAAA,IAAQ,SAAS,QAAA,EAAU;AAC7B,UAAA,IAAI,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,MAAA,GAAS,SAAA;AAAA,eAAA,IAChD,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,MAAA,GAAS,QAAA;AAAA,eACzD,MAAA,GAAS,UAAA;AAAA,QAChB;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,IAAA,CAAK,gBAAA,GAAmB,WAAA,GAAc,KAAA;AAAA,IACnD,MAAA;AAAA,IACA,UAAU,QAAA,IAAY;AAAA,GACxB;AACF;AAOO,SAAS,cAAc,GAAA,EAA6B;AACzD,EAAA,MAAM,QAAA,GAAA,CAAY,GAAA,CAAI,QAAA,IAAY,EAAA,EAAI,OAAA,CAAQ,mBAAmB,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAChF,EAAA,OAAO,GAAG,GAAA,CAAI,WAAW,IAAI,GAAA,CAAI,MAAM,IAAI,QAAQ,CAAA,CAAA;AACrD;AAGO,SAAS,cAAc,KAAA,EAAyD;AACrF,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,CAAC,WAAA,EAAa,MAAA,EAAQ,QAAQ,CAAA,GAAI,KAAA,CAAM,MAAM,GAAG,CAAA;AACvD,EAAA,IAAI,WAAA,KAAgB,KAAA,IAAS,WAAA,KAAgB,WAAA,EAAa,OAAO,IAAA;AACjE,EAAA,OAAO;AAAA,IACL,WAAA;AAAA,IACA,MAAA,EAAS,CAAC,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,UAAA,EAAY,QAAQ,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,GAAI,MAAA,GAAS,QAAA;AAAA,IACzF,UAAU,QAAA,IAAY;AAAA,GACxB;AACF;;;ACAO,SAAS,iBAAiB,MAAA,EAAkC;AACjE,EAAA,MAAM,eAAA,GAAkBA,qCAAA;AAAA,IACtB,MAAA,EAAQ;AAAA,GACV;AAGA,EAAA,MAAM,gBAAA,GACJ,MAAA,EAAQ,aAAA,GACJC,wCAAA,CAAwB;AAAA,IACtB,OAAA,EAAS,OAAO,aAAA,CAAc,OAAA;AAAA,IAC9B,QAAA,EAAU,OAAO,aAAA,CAAc;AAAA,GAChC,IACD,EAAC;AAEP,EAAA,OAAO,eAAe,MACpB,OAAA,EACuB;AAEvB,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,MAAM,aAAA,GAAgB,MAAM,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA;AACjD,MAAA,IAAI,aAAA,EAAe;AAEjB,QAAA,YAAA,CAAa,eAAe,eAAe,CAAA;AAC3C,QAAA,OAAO,aAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,MAAA,EAAQ,cAAc,KAAA,EAAO;AAC/B,MAAA,MAAM,iBACJ,OAAO,MAAA,EAAQ,cAAc,QAAA,GACzB,MAAA,CAAO,YACP,EAAC;AAEP,MAAA,MAAM,WAAW,MAAMC,uCAAA;AAAA,QACrB,OAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,QAAA,EAAU;AAEZ,QAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AACtC,QAAA,OAAO,QAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,QAAA,GAAWC,oBAAa,IAAA,EAAK;AAGjC,IAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AAGtC,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,gBAAgB,CAAA,CAAE,SAAS,CAAA,EAAG;AAC5C,MAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA,IAAK,EAAA;AAChD,MAAA,IAAI,OAAO,QAAA,CAAS,WAAW,KAAK,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AAC1D,QAAA,YAAA,CAAa,UAAU,gBAAgB,CAAA;AAAA,MACzC;AAAA,IACF;AAKA,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,MAAM,QACJ,OAAO,MAAA,CAAO,aAAa,QAAA,GAAW,MAAA,CAAO,WAAW,EAAC;AAC3D,MAAA,MAAM,mBAAmB,CAAC,CAAC,QAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,EAAG,KAAA;AAC3D,MAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,QAAA,MAAM,UAAA,GAAa,MAAM,gBAAA,IAAoB,GAAA;AAC7C,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,SAAA,EAAW,iBAAA,EAAkB,EAAG;AAAA,UACnD,MAAA,EAAQ,UAAA,GAAa,EAAA,GAAK,EAAA,GAAK,EAAA;AAAA,UAC/B,IAAA,EAAM,GAAA;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AACA,MAAA,IAAI,KAAA,CAAM,YAAY,KAAA,EAAO;AAC3B,QAAA,MAAM,OAAA,GAAU,aAAA;AAAA,UACd,qBAAA,CAAsB,OAAA,EAAS,EAAE,gBAAA,EAAkB;AAAA,SACrD;AACA,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,SAAA,EAAW,OAAA,EAAS;AAAA;AAAA,UAEvC,QAAQ,EAAA,GAAK,EAAA;AAAA,UACb,IAAA,EAAM,GAAA;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AAAA,IACF;AAGA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,QAAA,GAAW,MAAM,MAAA,CAAO,KAAA,CAAM,OAAA,EAAS,QAAQ,CAAA;AAAA,IACjD;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AAMA,SAAS,iBAAA,GAA4B;AACnC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,OAAO,UAAA,EAAY,OAAO,OAAO,UAAA,EAAW;AACjF,EAAA,OAAO,sCAAA,CAAuC,OAAA,CAAQ,OAAA,EAAS,CAAC,CAAA,KAAM;AACpE,IAAA,MAAM,CAAA,GAAK,IAAA,CAAK,MAAA,EAAO,GAAI,EAAA,GAAM,CAAA;AACjC,IAAA,OAAA,CAAQ,MAAM,GAAA,GAAM,CAAA,GAAK,IAAI,CAAA,GAAO,CAAA,EAAK,SAAS,EAAE,CAAA;AAAA,EACtD,CAAC,CAAA;AACH;AAEA,SAAS,YAAA,CACP,UACA,OAAA,EACM;AACN,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,IAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,EACjC;AACF;AAMO,IAAM,cAAA,GAAiB;AAAA,EAC5B,OAAA,EAAS;AAAA,IACP;AAAA;AAEJ;AAGO,IAAM,WAAA,GAAc","file":"index.js","sourcesContent":["/**\n * @sonordev/site-kit/middleware — visitor segment resolution (the \"one edge pass\").\n *\n * Pure, edge-runtime-safe helpers that classify a request into a coarse visitor\n * segment (new-vs-returning + marketing source + campaign) from the URL's UTM\n * params and the referrer. The middleware writes the result to the `_sk_seg`\n * cookie so server-rendered slots / personalization can vary by segment WITHOUT\n * each one re-parsing the request. Resolved once, at the edge.\n *\n * Kept side-effect-free (no NextResponse, no cookie writes) so it is trivially\n * unit-testable and reusable.\n */\nimport type { NextRequest } from 'next/server'\n\nexport type SegmentSource = 'paid' | 'organic' | 'social' | 'referral' | 'direct'\n\nexport interface VisitorSegment {\n  /** `new` on the first visit (no prior `_sk_vid` cookie), else `returning`. */\n  visitorType: 'new' | 'returning'\n  /** Marketing source bucket derived from UTM medium/source, then referrer. */\n  source: SegmentSource\n  /** `utm_campaign`, if present (sanitized when encoded). */\n  campaign: string | null\n}\n\nconst PAID_MEDIUMS = ['cpc', 'ppc', 'paid', 'paidsearch', 'paid-search', 'display', 'cpm', 'banner']\nconst SOCIAL_MEDIUMS = ['social', 'social-media', 'social_media', 'sm']\nconst SOCIAL_HOSTS = [\n  'facebook.',\n  'instagram.',\n  'linkedin.',\n  't.co',\n  'twitter.',\n  'x.com',\n  'pinterest.',\n  'tiktok.',\n  'youtube.',\n  'reddit.',\n]\nconst SEARCH_HOSTS = ['google.', 'bing.', 'duckduckgo.', 'yahoo.', 'ecosia.', 'brave.', 'baidu.', 'yandex.']\n\n/**\n * Classify `request` into a {@link VisitorSegment}. UTM params win over the\n * referrer; a same-host referrer is ignored (internal navigation, not a source).\n */\nexport function resolveVisitorSegment(\n  request: NextRequest,\n  opts: { hadVisitorCookie: boolean },\n): VisitorSegment {\n  const params = request.nextUrl.searchParams\n  const medium = (params.get('utm_medium') || '').toLowerCase().trim()\n  const campaign = params.get('utm_campaign')\n\n  let source: SegmentSource = 'direct'\n\n  if (PAID_MEDIUMS.includes(medium)) {\n    source = 'paid'\n  } else if (SOCIAL_MEDIUMS.includes(medium)) {\n    source = 'social'\n  } else if (medium === 'organic') {\n    source = 'organic'\n  } else if (medium === 'referral') {\n    source = 'referral'\n  } else if (params.get('utm_source') || params.get('gclid') || params.get('fbclid')) {\n    // A tagged link with a non-standard medium: gclid => paid Google, fbclid => social.\n    if (params.get('gclid')) source = 'paid'\n    else if (params.get('fbclid')) source = 'social'\n    else source = 'referral'\n  } else {\n    // No campaign tagging — fall back to the referrer host.\n    const ref = request.headers.get('referer') || ''\n    if (ref) {\n      try {\n        const host = new URL(ref).host.toLowerCase()\n        const selfHost = request.nextUrl.host.toLowerCase()\n        if (host && host !== selfHost) {\n          if (SEARCH_HOSTS.some((h) => host.includes(h))) source = 'organic'\n          else if (SOCIAL_HOSTS.some((h) => host.includes(h))) source = 'social'\n          else source = 'referral'\n        }\n      } catch {\n        /* malformed referer — stays 'direct' */\n      }\n    }\n  }\n\n  return {\n    visitorType: opts.hadVisitorCookie ? 'returning' : 'new',\n    source,\n    campaign: campaign || null,\n  }\n}\n\n/**\n * Compact, cookie-safe encoding: `\"<visitorType>|<source>|<campaign>\"`, e.g.\n * `\"new|paid|spring_sale\"`. Campaign is sanitized to `[A-Za-z0-9_-]` and capped.\n * Decode with {@link decodeSegment}.\n */\nexport function encodeSegment(seg: VisitorSegment): string {\n  const campaign = (seg.campaign || '').replace(/[^a-zA-Z0-9_-]/g, '').slice(0, 40)\n  return `${seg.visitorType}|${seg.source}|${campaign}`\n}\n\n/** Parse a `_sk_seg` cookie value produced by {@link encodeSegment}. */\nexport function decodeSegment(value: string | undefined | null): VisitorSegment | null {\n  if (!value) return null\n  const [visitorType, source, campaign] = value.split('|')\n  if (visitorType !== 'new' && visitorType !== 'returning') return null\n  return {\n    visitorType,\n    source: (['paid', 'organic', 'social', 'referral', 'direct'].includes(source) ? source : 'direct') as SegmentSource,\n    campaign: campaign || null,\n  }\n}\n","/**\n * @sonordev/site-kit/middleware\n *\n * Composable Next.js middleware factory. Handles:\n * - Portal-managed redirects (via existing handleManagedRedirects)\n * - Security headers (X-Frame-Options, CSP, etc.)\n * - Optional before/after hooks for custom logic\n *\n * @example\n * ```ts\n * // middleware.ts — entire file\n * import { createMiddleware, siteKitMatcher } from '@sonordev/site-kit/middleware'\n *\n * export default createMiddleware()\n * export const config = siteKitMatcher\n * ```\n *\n * @example With custom hooks:\n * ```ts\n * export default createMiddleware({\n *   securityHeaders: { frameOptions: 'SAMEORIGIN' },\n *   before: (req) => {\n *     // Custom auth check, etc.\n *   },\n * })\n * ```\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport {\n  handleManagedRedirects,\n  type RedirectConfig,\n} from '../redirects'\nimport {\n  buildSecurityHeaders,\n  type SecurityHeadersConfig,\n} from './securityHeaders'\nimport { buildAiDiscoveryHeaders } from '../llms/discovery-headers'\nimport { resolveVisitorSegment, encodeSegment } from './segment'\n\nexport type { SecurityHeadersConfig } from './securityHeaders'\nexport {\n  resolveVisitorSegment,\n  encodeSegment,\n  decodeSegment,\n  type VisitorSegment,\n  type SegmentSource,\n} from './segment'\n\nexport interface IdentityConfig {\n  /**\n   * Also resolve + persist a coarse visitor segment (new-vs-returning + source\n   * + campaign) into the `_sk_seg` cookie, for segment-aware slots /\n   * personalization. Default: true (when identity is enabled).\n   */\n  segment?: boolean\n  /** Days the `_sk_vid` visitor cookie persists. Default: 730 (~2 years). */\n  cookieMaxAgeDays?: number\n}\n\nexport interface LlmsDiscoveryConfig {\n  /** Canonical site origin, e.g. `https://example.com` */\n  siteUrl: string\n  /** Path to llms.txt (default `/llms.txt`) */\n  llmsPath?: string\n}\n\nexport interface SiteKitMiddlewareConfig {\n  /** Enable Portal-managed redirects. Default: true */\n  redirects?: boolean | RedirectConfig\n  /** Enable security headers. Default: true */\n  securityHeaders?: boolean | SecurityHeadersConfig\n  /**\n   * Opt-in: inject `Link: <...>; rel=\"describedby\"` header on HTML responses\n   * pointing to /llms.txt for AI crawler discovery (RFC 8288).\n   * Preferred over visible footer links.\n   */\n  llmsDiscovery?: LlmsDiscoveryConfig | false\n  /**\n   * Opt-in EDGE IDENTITY pass. When enabled, the middleware ensures a\n   * first-party `_sk_vid` visitor cookie exists (server-authoritative id) and\n   * resolves the visitor segment into `_sk_seg`, so server-rendered slots and\n   * personalization can read identity + segment without re-parsing the request.\n   * Purely additive — it only writes cookies, never changes the rendered HTML,\n   * so it is LCP/static-safe. Default: OFF (sites opt in for 3.0 personalization).\n   *\n   * NOTE: to make these the SAME id the client uses, the shared identity helper\n   * must read `_sk_vid` cookie-first (a follow-on change validated with a live\n   * preview); until then the cookie is the server-side mirror.\n   */\n  identity?: boolean | IdentityConfig\n  /**\n   * Hook that runs BEFORE redirect check.\n   * Return a NextResponse to short-circuit, or undefined to continue.\n   */\n  before?: (\n    request: NextRequest,\n  ) => NextResponse | undefined | Promise<NextResponse | undefined>\n  /**\n   * Hook that runs AFTER all processing.\n   * Receives the response that will be sent — mutate headers, etc.\n   */\n  after?: (\n    request: NextRequest,\n    response: NextResponse,\n  ) => NextResponse | Promise<NextResponse>\n}\n\n/**\n * Create a fully-featured Next.js middleware function.\n *\n * With zero config this handles redirects + security headers automatically.\n */\nexport function createMiddleware(config?: SiteKitMiddlewareConfig) {\n  const securityHeaders = buildSecurityHeaders(\n    config?.securityHeaders,\n  )\n\n  // Pre-compute discovery headers (static per middleware instance)\n  const discoveryHeaders: Record<string, string> =\n    config?.llmsDiscovery\n      ? buildAiDiscoveryHeaders({\n          siteUrl: config.llmsDiscovery.siteUrl,\n          llmsPath: config.llmsDiscovery.llmsPath,\n        })\n      : {}\n\n  return async function proxy(\n    request: NextRequest,\n  ): Promise<NextResponse> {\n    // 1. Run user's 'before' hook\n    if (config?.before) {\n      const earlyResponse = await config.before(request)\n      if (earlyResponse) {\n        // Apply security headers even to early responses\n        applyHeaders(earlyResponse, securityHeaders)\n        return earlyResponse\n      }\n    }\n\n    // 2. Check Portal-managed redirects (unless disabled)\n    if (config?.redirects !== false) {\n      const redirectConfig: RedirectConfig =\n        typeof config?.redirects === 'object'\n          ? config.redirects\n          : {}\n\n      const redirect = await handleManagedRedirects(\n        request,\n        redirectConfig,\n      )\n      if (redirect) {\n        // Redirects get security headers too\n        applyHeaders(redirect, securityHeaders)\n        return redirect\n      }\n    }\n\n    // 3. Build the pass-through response\n    let response = NextResponse.next()\n\n    // 4. Apply security headers\n    applyHeaders(response, securityHeaders)\n\n    // 5. Apply AI discovery Link header (only on HTML-like requests, not static assets)\n    if (Object.keys(discoveryHeaders).length > 0) {\n      const accept = request.headers.get('accept') || ''\n      if (accept.includes('text/html') || accept.includes('*/*')) {\n        applyHeaders(response, discoveryHeaders)\n      }\n    }\n\n    // 5b. Edge identity pass (opt-in). Ensure a first-party `_sk_vid` visitor\n    // cookie exists and resolve the visitor segment into `_sk_seg`. Additive:\n    // only writes cookies, never changes the rendered HTML (LCP/static-safe).\n    if (config?.identity) {\n      const idCfg: IdentityConfig =\n        typeof config.identity === 'object' ? config.identity : {}\n      const hadVisitorCookie = !!request.cookies.get('_sk_vid')?.value\n      if (!hadVisitorCookie) {\n        const maxAgeDays = idCfg.cookieMaxAgeDays ?? 730\n        response.cookies.set('_sk_vid', generateVisitorId(), {\n          maxAge: maxAgeDays * 24 * 60 * 60,\n          path: '/',\n          sameSite: 'lax',\n          secure: true,\n        })\n      }\n      if (idCfg.segment !== false) {\n        const segment = encodeSegment(\n          resolveVisitorSegment(request, { hadVisitorCookie }),\n        )\n        response.cookies.set('_sk_seg', segment, {\n          // Session-ish: a fresh campaign / source on a later visit re-segments.\n          maxAge: 30 * 60,\n          path: '/',\n          sameSite: 'lax',\n          secure: true,\n        })\n      }\n    }\n\n    // 6. Run user's 'after' hook\n    if (config?.after) {\n      response = await config.after(request, response)\n    }\n\n    return response\n  }\n}\n\n/**\n * Generate a visitor id at the edge. Prefers Web Crypto (available in the\n * Next.js edge runtime); falls back to a v4-shaped string elsewhere.\n */\nfunction generateVisitorId(): string {\n  if (typeof crypto !== 'undefined' && crypto.randomUUID) return crypto.randomUUID()\n  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {\n    const r = (Math.random() * 16) | 0\n    return (c === 'x' ? r : (r & 0x3) | 0x8).toString(16)\n  })\n}\n\nfunction applyHeaders(\n  response: NextResponse,\n  headers: Record<string, string>,\n): void {\n  for (const [key, value] of Object.entries(headers)) {\n    response.headers.set(key, value)\n  }\n}\n\n/**\n * Standard matcher config that excludes static assets and images.\n * Export alongside createProxy/createMiddleware in your proxy.ts.\n */\nexport const siteKitMatcher = {\n  matcher: [\n    '/((?!_next/static|_next/image|favicon\\\\.ico|.*\\\\.(?:ico|png|jpg|jpeg|gif|webp|svg|woff2?)$).*)',\n  ],\n}\n\n/** Next.js 16+ alias — same as createMiddleware, named for the proxy convention. */\nexport const createProxy = createMiddleware\n"]}

package/dist/middleware/index.mjs

@@ -5,6 +5,76 @@ import '../chunk-B22WSN4L.mjs';
 import '../chunk-4XPGGLVP.mjs';
 import { NextResponse } from 'next/server';
 
+// src/middleware/segment.ts
+var PAID_MEDIUMS = ["cpc", "ppc", "paid", "paidsearch", "paid-search", "display", "cpm", "banner"];
+var SOCIAL_MEDIUMS = ["social", "social-media", "social_media", "sm"];
+var SOCIAL_HOSTS = [
+  "facebook.",
+  "instagram.",
+  "linkedin.",
+  "t.co",
+  "twitter.",
+  "x.com",
+  "pinterest.",
+  "tiktok.",
+  "youtube.",
+  "reddit."
+];
+var SEARCH_HOSTS = ["google.", "bing.", "duckduckgo.", "yahoo.", "ecosia.", "brave.", "baidu.", "yandex."];
+function resolveVisitorSegment(request, opts) {
+  const params = request.nextUrl.searchParams;
+  const medium = (params.get("utm_medium") || "").toLowerCase().trim();
+  const campaign = params.get("utm_campaign");
+  let source = "direct";
+  if (PAID_MEDIUMS.includes(medium)) {
+    source = "paid";
+  } else if (SOCIAL_MEDIUMS.includes(medium)) {
+    source = "social";
+  } else if (medium === "organic") {
+    source = "organic";
+  } else if (medium === "referral") {
+    source = "referral";
+  } else if (params.get("utm_source") || params.get("gclid") || params.get("fbclid")) {
+    if (params.get("gclid")) source = "paid";
+    else if (params.get("fbclid")) source = "social";
+    else source = "referral";
+  } else {
+    const ref = request.headers.get("referer") || "";
+    if (ref) {
+      try {
+        const host = new URL(ref).host.toLowerCase();
+        const selfHost = request.nextUrl.host.toLowerCase();
+        if (host && host !== selfHost) {
+          if (SEARCH_HOSTS.some((h) => host.includes(h))) source = "organic";
+          else if (SOCIAL_HOSTS.some((h) => host.includes(h))) source = "social";
+          else source = "referral";
+        }
+      } catch {
+      }
+    }
+  }
+  return {
+    visitorType: opts.hadVisitorCookie ? "returning" : "new",
+    source,
+    campaign: campaign || null
+  };
+}
+function encodeSegment(seg) {
+  const campaign = (seg.campaign || "").replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 40);
+  return `${seg.visitorType}|${seg.source}|${campaign}`;
+}
+function decodeSegment(value) {
+  if (!value) return null;
+  const [visitorType, source, campaign] = value.split("|");
+  if (visitorType !== "new" && visitorType !== "returning") return null;
+  return {
+    visitorType,
+    source: ["paid", "organic", "social", "referral", "direct"].includes(source) ? source : "direct",
+    campaign: campaign || null
+  };
+}
+
+// src/middleware/index.ts
 function createMiddleware(config) {
   const securityHeaders = buildSecurityHeaders(
     config?.securityHeaders
@@ -40,12 +110,44 @@ function createMiddleware(config) {
         applyHeaders(response, discoveryHeaders);
       }
     }
+    if (config?.identity) {
+      const idCfg = typeof config.identity === "object" ? config.identity : {};
+      const hadVisitorCookie = !!request.cookies.get("_sk_vid")?.value;
+      if (!hadVisitorCookie) {
+        const maxAgeDays = idCfg.cookieMaxAgeDays ?? 730;
+        response.cookies.set("_sk_vid", generateVisitorId(), {
+          maxAge: maxAgeDays * 24 * 60 * 60,
+          path: "/",
+          sameSite: "lax",
+          secure: true
+        });
+      }
+      if (idCfg.segment !== false) {
+        const segment = encodeSegment(
+          resolveVisitorSegment(request, { hadVisitorCookie })
+        );
+        response.cookies.set("_sk_seg", segment, {
+          // Session-ish: a fresh campaign / source on a later visit re-segments.
+          maxAge: 30 * 60,
+          path: "/",
+          sameSite: "lax",
+          secure: true
+        });
+      }
+    }
     if (config?.after) {
       response = await config.after(request, response);
     }
     return response;
   };
 }
+function generateVisitorId() {
+  if (typeof crypto !== "undefined" && crypto.randomUUID) return crypto.randomUUID();
+  return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (c) => {
+    const r = Math.random() * 16 | 0;
+    return (c === "x" ? r : r & 3 | 8).toString(16);
+  });
+}
 function applyHeaders(response, headers) {
   for (const [key, value] of Object.entries(headers)) {
     response.headers.set(key, value);
@@ -58,6 +160,6 @@ var siteKitMatcher = {
 };
 var createProxy = createMiddleware;
 
-export { createMiddleware, createProxy, siteKitMatcher };
+export { createMiddleware, createProxy, decodeSegment, encodeSegment, resolveVisitorSegment, siteKitMatcher };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map

package/dist/middleware/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/middleware/index.ts"],"names":[],"mappings":";;;;;;;AAiFO,SAAS,iBAAiB,MAAA,EAAkC;AACjE,EAAA,MAAM,eAAA,GAAkB,oBAAA;AAAA,IACtB,MAAA,EAAQ;AAAA,GACV;AAGA,EAAA,MAAM,gBAAA,GACJ,MAAA,EAAQ,aAAA,GACJ,uBAAA,CAAwB;AAAA,IACtB,OAAA,EAAS,OAAO,aAAA,CAAc,OAAA;AAAA,IAC9B,QAAA,EAAU,OAAO,aAAA,CAAc;AAAA,GAChC,IACD,EAAC;AAEP,EAAA,OAAO,eAAe,MACpB,OAAA,EACuB;AAEvB,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,MAAM,aAAA,GAAgB,MAAM,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA;AACjD,MAAA,IAAI,aAAA,EAAe;AAEjB,QAAA,YAAA,CAAa,eAAe,eAAe,CAAA;AAC3C,QAAA,OAAO,aAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,MAAA,EAAQ,cAAc,KAAA,EAAO;AAC/B,MAAA,MAAM,iBACJ,OAAO,MAAA,EAAQ,cAAc,QAAA,GACzB,MAAA,CAAO,YACP,EAAC;AAEP,MAAA,MAAM,WAAW,MAAM,sBAAA;AAAA,QACrB,OAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,QAAA,EAAU;AAEZ,QAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AACtC,QAAA,OAAO,QAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,QAAA,GAAW,aAAa,IAAA,EAAK;AAGjC,IAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AAGtC,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,gBAAgB,CAAA,CAAE,SAAS,CAAA,EAAG;AAC5C,MAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA,IAAK,EAAA;AAChD,MAAA,IAAI,OAAO,QAAA,CAAS,WAAW,KAAK,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AAC1D,QAAA,YAAA,CAAa,UAAU,gBAAgB,CAAA;AAAA,MACzC;AAAA,IACF;AAGA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,QAAA,GAAW,MAAM,MAAA,CAAO,KAAA,CAAM,OAAA,EAAS,QAAQ,CAAA;AAAA,IACjD;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AAEA,SAAS,YAAA,CACP,UACA,OAAA,EACM;AACN,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,IAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,EACjC;AACF;AAMO,IAAM,cAAA,GAAiB;AAAA,EAC5B,OAAA,EAAS;AAAA,IACP;AAAA;AAEJ;AAGO,IAAM,WAAA,GAAc","file":"index.mjs","sourcesContent":["/**\n * @sonordev/site-kit/middleware\n *\n * Composable Next.js middleware factory. Handles:\n * - Portal-managed redirects (via existing handleManagedRedirects)\n * - Security headers (X-Frame-Options, CSP, etc.)\n * - Optional before/after hooks for custom logic\n *\n * @example\n * ```ts\n * // middleware.ts — entire file\n * import { createMiddleware, siteKitMatcher } from '@sonordev/site-kit/middleware'\n *\n * export default createMiddleware()\n * export const config = siteKitMatcher\n * ```\n *\n * @example With custom hooks:\n * ```ts\n * export default createMiddleware({\n *   securityHeaders: { frameOptions: 'SAMEORIGIN' },\n *   before: (req) => {\n *     // Custom auth check, etc.\n *   },\n * })\n * ```\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport {\n  handleManagedRedirects,\n  type RedirectConfig,\n} from '../redirects'\nimport {\n  buildSecurityHeaders,\n  type SecurityHeadersConfig,\n} from './securityHeaders'\nimport { buildAiDiscoveryHeaders } from '../llms/discovery-headers'\n\nexport type { SecurityHeadersConfig } from './securityHeaders'\n\nexport interface LlmsDiscoveryConfig {\n  /** Canonical site origin, e.g. `https://example.com` */\n  siteUrl: string\n  /** Path to llms.txt (default `/llms.txt`) */\n  llmsPath?: string\n}\n\nexport interface SiteKitMiddlewareConfig {\n  /** Enable Portal-managed redirects. Default: true */\n  redirects?: boolean | RedirectConfig\n  /** Enable security headers. Default: true */\n  securityHeaders?: boolean | SecurityHeadersConfig\n  /**\n   * Opt-in: inject `Link: <...>; rel=\"describedby\"` header on HTML responses\n   * pointing to /llms.txt for AI crawler discovery (RFC 8288).\n   * Preferred over visible footer links.\n   */\n  llmsDiscovery?: LlmsDiscoveryConfig | false\n  /**\n   * Hook that runs BEFORE redirect check.\n   * Return a NextResponse to short-circuit, or undefined to continue.\n   */\n  before?: (\n    request: NextRequest,\n  ) => NextResponse | undefined | Promise<NextResponse | undefined>\n  /**\n   * Hook that runs AFTER all processing.\n   * Receives the response that will be sent — mutate headers, etc.\n   */\n  after?: (\n    request: NextRequest,\n    response: NextResponse,\n  ) => NextResponse | Promise<NextResponse>\n}\n\n/**\n * Create a fully-featured Next.js middleware function.\n *\n * With zero config this handles redirects + security headers automatically.\n */\nexport function createMiddleware(config?: SiteKitMiddlewareConfig) {\n  const securityHeaders = buildSecurityHeaders(\n    config?.securityHeaders,\n  )\n\n  // Pre-compute discovery headers (static per middleware instance)\n  const discoveryHeaders: Record<string, string> =\n    config?.llmsDiscovery\n      ? buildAiDiscoveryHeaders({\n          siteUrl: config.llmsDiscovery.siteUrl,\n          llmsPath: config.llmsDiscovery.llmsPath,\n        })\n      : {}\n\n  return async function proxy(\n    request: NextRequest,\n  ): Promise<NextResponse> {\n    // 1. Run user's 'before' hook\n    if (config?.before) {\n      const earlyResponse = await config.before(request)\n      if (earlyResponse) {\n        // Apply security headers even to early responses\n        applyHeaders(earlyResponse, securityHeaders)\n        return earlyResponse\n      }\n    }\n\n    // 2. Check Portal-managed redirects (unless disabled)\n    if (config?.redirects !== false) {\n      const redirectConfig: RedirectConfig =\n        typeof config?.redirects === 'object'\n          ? config.redirects\n          : {}\n\n      const redirect = await handleManagedRedirects(\n        request,\n        redirectConfig,\n      )\n      if (redirect) {\n        // Redirects get security headers too\n        applyHeaders(redirect, securityHeaders)\n        return redirect\n      }\n    }\n\n    // 3. Build the pass-through response\n    let response = NextResponse.next()\n\n    // 4. Apply security headers\n    applyHeaders(response, securityHeaders)\n\n    // 5. Apply AI discovery Link header (only on HTML-like requests, not static assets)\n    if (Object.keys(discoveryHeaders).length > 0) {\n      const accept = request.headers.get('accept') || ''\n      if (accept.includes('text/html') || accept.includes('*/*')) {\n        applyHeaders(response, discoveryHeaders)\n      }\n    }\n\n    // 6. Run user's 'after' hook\n    if (config?.after) {\n      response = await config.after(request, response)\n    }\n\n    return response\n  }\n}\n\nfunction applyHeaders(\n  response: NextResponse,\n  headers: Record<string, string>,\n): void {\n  for (const [key, value] of Object.entries(headers)) {\n    response.headers.set(key, value)\n  }\n}\n\n/**\n * Standard matcher config that excludes static assets and images.\n * Export alongside createProxy/createMiddleware in your proxy.ts.\n */\nexport const siteKitMatcher = {\n  matcher: [\n    '/((?!_next/static|_next/image|favicon\\\\.ico|.*\\\\.(?:ico|png|jpg|jpeg|gif|webp|svg|woff2?)$).*)',\n  ],\n}\n\n/** Next.js 16+ alias — same as createMiddleware, named for the proxy convention. */\nexport const createProxy = createMiddleware\n"]}
+{"version":3,"sources":["../../src/middleware/segment.ts","../../src/middleware/index.ts"],"names":[],"mappings":";;;;;;;;AAyBA,IAAM,YAAA,GAAe,CAAC,KAAA,EAAO,KAAA,EAAO,QAAQ,YAAA,EAAc,aAAA,EAAe,SAAA,EAAW,KAAA,EAAO,QAAQ,CAAA;AACnG,IAAM,cAAA,GAAiB,CAAC,QAAA,EAAU,cAAA,EAAgB,gBAAgB,IAAI,CAAA;AACtE,IAAM,YAAA,GAAe;AAAA,EACnB,WAAA;AAAA,EACA,YAAA;AAAA,EACA,WAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;AACA,IAAM,YAAA,GAAe,CAAC,SAAA,EAAW,OAAA,EAAS,eAAe,QAAA,EAAU,SAAA,EAAW,QAAA,EAAU,QAAA,EAAU,SAAS,CAAA;AAMpG,SAAS,qBAAA,CACd,SACA,IAAA,EACgB;AAChB,EAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,YAAA;AAC/B,EAAA,MAAM,MAAA,GAAA,CAAU,OAAO,GAAA,CAAI,YAAY,KAAK,EAAA,EAAI,WAAA,GAAc,IAAA,EAAK;AACnE,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,cAAc,CAAA;AAE1C,EAAA,IAAI,MAAA,GAAwB,QAAA;AAE5B,EAAA,IAAI,YAAA,CAAa,QAAA,CAAS,MAAM,CAAA,EAAG;AACjC,IAAA,MAAA,GAAS,MAAA;AAAA,EACX,CAAA,MAAA,IAAW,cAAA,CAAe,QAAA,CAAS,MAAM,CAAA,EAAG;AAC1C,IAAA,MAAA,GAAS,QAAA;AAAA,EACX,CAAA,MAAA,IAAW,WAAW,SAAA,EAAW;AAC/B,IAAA,MAAA,GAAS,SAAA;AAAA,EACX,CAAA,MAAA,IAAW,WAAW,UAAA,EAAY;AAChC,IAAA,MAAA,GAAS,UAAA;AAAA,EACX,CAAA,MAAA,IAAW,MAAA,CAAO,GAAA,CAAI,YAAY,CAAA,IAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,IAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG;AAElF,IAAA,IAAI,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,EAAG,MAAA,GAAS,MAAA;AAAA,SAAA,IACzB,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG,MAAA,GAAS,QAAA;AAAA,SACnC,MAAA,GAAS,UAAA;AAAA,EAChB,CAAA,MAAO;AAEL,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,IAAK,EAAA;AAC9C,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,KAAK,WAAA,EAAY;AAC3C,QAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,WAAA,EAAY;AAClD,QAAA,IAAI,IAAA,IAAQ,SAAS,QAAA,EAAU;AAC7B,UAAA,IAAI,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,MAAA,GAAS,SAAA;AAAA,eAAA,IAChD,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,MAAA,GAAS,QAAA;AAAA,eACzD,MAAA,GAAS,UAAA;AAAA,QAChB;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,IAAA,CAAK,gBAAA,GAAmB,WAAA,GAAc,KAAA;AAAA,IACnD,MAAA;AAAA,IACA,UAAU,QAAA,IAAY;AAAA,GACxB;AACF;AAOO,SAAS,cAAc,GAAA,EAA6B;AACzD,EAAA,MAAM,QAAA,GAAA,CAAY,GAAA,CAAI,QAAA,IAAY,EAAA,EAAI,OAAA,CAAQ,mBAAmB,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAChF,EAAA,OAAO,GAAG,GAAA,CAAI,WAAW,IAAI,GAAA,CAAI,MAAM,IAAI,QAAQ,CAAA,CAAA;AACrD;AAGO,SAAS,cAAc,KAAA,EAAyD;AACrF,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,CAAC,WAAA,EAAa,MAAA,EAAQ,QAAQ,CAAA,GAAI,KAAA,CAAM,MAAM,GAAG,CAAA;AACvD,EAAA,IAAI,WAAA,KAAgB,KAAA,IAAS,WAAA,KAAgB,WAAA,EAAa,OAAO,IAAA;AACjE,EAAA,OAAO;AAAA,IACL,WAAA;AAAA,IACA,MAAA,EAAS,CAAC,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,UAAA,EAAY,QAAQ,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,GAAI,MAAA,GAAS,QAAA;AAAA,IACzF,UAAU,QAAA,IAAY;AAAA,GACxB;AACF;;;ACAO,SAAS,iBAAiB,MAAA,EAAkC;AACjE,EAAA,MAAM,eAAA,GAAkB,oBAAA;AAAA,IACtB,MAAA,EAAQ;AAAA,GACV;AAGA,EAAA,MAAM,gBAAA,GACJ,MAAA,EAAQ,aAAA,GACJ,uBAAA,CAAwB;AAAA,IACtB,OAAA,EAAS,OAAO,aAAA,CAAc,OAAA;AAAA,IAC9B,QAAA,EAAU,OAAO,aAAA,CAAc;AAAA,GAChC,IACD,EAAC;AAEP,EAAA,OAAO,eAAe,MACpB,OAAA,EACuB;AAEvB,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,MAAM,aAAA,GAAgB,MAAM,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA;AACjD,MAAA,IAAI,aAAA,EAAe;AAEjB,QAAA,YAAA,CAAa,eAAe,eAAe,CAAA;AAC3C,QAAA,OAAO,aAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,MAAA,EAAQ,cAAc,KAAA,EAAO;AAC/B,MAAA,MAAM,iBACJ,OAAO,MAAA,EAAQ,cAAc,QAAA,GACzB,MAAA,CAAO,YACP,EAAC;AAEP,MAAA,MAAM,WAAW,MAAM,sBAAA;AAAA,QACrB,OAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,QAAA,EAAU;AAEZ,QAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AACtC,QAAA,OAAO,QAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,QAAA,GAAW,aAAa,IAAA,EAAK;AAGjC,IAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AAGtC,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,gBAAgB,CAAA,CAAE,SAAS,CAAA,EAAG;AAC5C,MAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA,IAAK,EAAA;AAChD,MAAA,IAAI,OAAO,QAAA,CAAS,WAAW,KAAK,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AAC1D,QAAA,YAAA,CAAa,UAAU,gBAAgB,CAAA;AAAA,MACzC;AAAA,IACF;AAKA,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,MAAM,QACJ,OAAO,MAAA,CAAO,aAAa,QAAA,GAAW,MAAA,CAAO,WAAW,EAAC;AAC3D,MAAA,MAAM,mBAAmB,CAAC,CAAC,QAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,EAAG,KAAA;AAC3D,MAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,QAAA,MAAM,UAAA,GAAa,MAAM,gBAAA,IAAoB,GAAA;AAC7C,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,SAAA,EAAW,iBAAA,EAAkB,EAAG;AAAA,UACnD,MAAA,EAAQ,UAAA,GAAa,EAAA,GAAK,EAAA,GAAK,EAAA;AAAA,UAC/B,IAAA,EAAM,GAAA;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AACA,MAAA,IAAI,KAAA,CAAM,YAAY,KAAA,EAAO;AAC3B,QAAA,MAAM,OAAA,GAAU,aAAA;AAAA,UACd,qBAAA,CAAsB,OAAA,EAAS,EAAE,gBAAA,EAAkB;AAAA,SACrD;AACA,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,SAAA,EAAW,OAAA,EAAS;AAAA;AAAA,UAEvC,QAAQ,EAAA,GAAK,EAAA;AAAA,UACb,IAAA,EAAM,GAAA;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AAAA,IACF;AAGA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,QAAA,GAAW,MAAM,MAAA,CAAO,KAAA,CAAM,OAAA,EAAS,QAAQ,CAAA;AAAA,IACjD;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AAMA,SAAS,iBAAA,GAA4B;AACnC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,OAAO,UAAA,EAAY,OAAO,OAAO,UAAA,EAAW;AACjF,EAAA,OAAO,sCAAA,CAAuC,OAAA,CAAQ,OAAA,EAAS,CAAC,CAAA,KAAM;AACpE,IAAA,MAAM,CAAA,GAAK,IAAA,CAAK,MAAA,EAAO,GAAI,EAAA,GAAM,CAAA;AACjC,IAAA,OAAA,CAAQ,MAAM,GAAA,GAAM,CAAA,GAAK,IAAI,CAAA,GAAO,CAAA,EAAK,SAAS,EAAE,CAAA;AAAA,EACtD,CAAC,CAAA;AACH;AAEA,SAAS,YAAA,CACP,UACA,OAAA,EACM;AACN,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,IAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,EACjC;AACF;AAMO,IAAM,cAAA,GAAiB;AAAA,EAC5B,OAAA,EAAS;AAAA,IACP;AAAA;AAEJ;AAGO,IAAM,WAAA,GAAc","file":"index.mjs","sourcesContent":["/**\n * @sonordev/site-kit/middleware — visitor segment resolution (the \"one edge pass\").\n *\n * Pure, edge-runtime-safe helpers that classify a request into a coarse visitor\n * segment (new-vs-returning + marketing source + campaign) from the URL's UTM\n * params and the referrer. The middleware writes the result to the `_sk_seg`\n * cookie so server-rendered slots / personalization can vary by segment WITHOUT\n * each one re-parsing the request. Resolved once, at the edge.\n *\n * Kept side-effect-free (no NextResponse, no cookie writes) so it is trivially\n * unit-testable and reusable.\n */\nimport type { NextRequest } from 'next/server'\n\nexport type SegmentSource = 'paid' | 'organic' | 'social' | 'referral' | 'direct'\n\nexport interface VisitorSegment {\n  /** `new` on the first visit (no prior `_sk_vid` cookie), else `returning`. */\n  visitorType: 'new' | 'returning'\n  /** Marketing source bucket derived from UTM medium/source, then referrer. */\n  source: SegmentSource\n  /** `utm_campaign`, if present (sanitized when encoded). */\n  campaign: string | null\n}\n\nconst PAID_MEDIUMS = ['cpc', 'ppc', 'paid', 'paidsearch', 'paid-search', 'display', 'cpm', 'banner']\nconst SOCIAL_MEDIUMS = ['social', 'social-media', 'social_media', 'sm']\nconst SOCIAL_HOSTS = [\n  'facebook.',\n  'instagram.',\n  'linkedin.',\n  't.co',\n  'twitter.',\n  'x.com',\n  'pinterest.',\n  'tiktok.',\n  'youtube.',\n  'reddit.',\n]\nconst SEARCH_HOSTS = ['google.', 'bing.', 'duckduckgo.', 'yahoo.', 'ecosia.', 'brave.', 'baidu.', 'yandex.']\n\n/**\n * Classify `request` into a {@link VisitorSegment}. UTM params win over the\n * referrer; a same-host referrer is ignored (internal navigation, not a source).\n */\nexport function resolveVisitorSegment(\n  request: NextRequest,\n  opts: { hadVisitorCookie: boolean },\n): VisitorSegment {\n  const params = request.nextUrl.searchParams\n  const medium = (params.get('utm_medium') || '').toLowerCase().trim()\n  const campaign = params.get('utm_campaign')\n\n  let source: SegmentSource = 'direct'\n\n  if (PAID_MEDIUMS.includes(medium)) {\n    source = 'paid'\n  } else if (SOCIAL_MEDIUMS.includes(medium)) {\n    source = 'social'\n  } else if (medium === 'organic') {\n    source = 'organic'\n  } else if (medium === 'referral') {\n    source = 'referral'\n  } else if (params.get('utm_source') || params.get('gclid') || params.get('fbclid')) {\n    // A tagged link with a non-standard medium: gclid => paid Google, fbclid => social.\n    if (params.get('gclid')) source = 'paid'\n    else if (params.get('fbclid')) source = 'social'\n    else source = 'referral'\n  } else {\n    // No campaign tagging — fall back to the referrer host.\n    const ref = request.headers.get('referer') || ''\n    if (ref) {\n      try {\n        const host = new URL(ref).host.toLowerCase()\n        const selfHost = request.nextUrl.host.toLowerCase()\n        if (host && host !== selfHost) {\n          if (SEARCH_HOSTS.some((h) => host.includes(h))) source = 'organic'\n          else if (SOCIAL_HOSTS.some((h) => host.includes(h))) source = 'social'\n          else source = 'referral'\n        }\n      } catch {\n        /* malformed referer — stays 'direct' */\n      }\n    }\n  }\n\n  return {\n    visitorType: opts.hadVisitorCookie ? 'returning' : 'new',\n    source,\n    campaign: campaign || null,\n  }\n}\n\n/**\n * Compact, cookie-safe encoding: `\"<visitorType>|<source>|<campaign>\"`, e.g.\n * `\"new|paid|spring_sale\"`. Campaign is sanitized to `[A-Za-z0-9_-]` and capped.\n * Decode with {@link decodeSegment}.\n */\nexport function encodeSegment(seg: VisitorSegment): string {\n  const campaign = (seg.campaign || '').replace(/[^a-zA-Z0-9_-]/g, '').slice(0, 40)\n  return `${seg.visitorType}|${seg.source}|${campaign}`\n}\n\n/** Parse a `_sk_seg` cookie value produced by {@link encodeSegment}. */\nexport function decodeSegment(value: string | undefined | null): VisitorSegment | null {\n  if (!value) return null\n  const [visitorType, source, campaign] = value.split('|')\n  if (visitorType !== 'new' && visitorType !== 'returning') return null\n  return {\n    visitorType,\n    source: (['paid', 'organic', 'social', 'referral', 'direct'].includes(source) ? source : 'direct') as SegmentSource,\n    campaign: campaign || null,\n  }\n}\n","/**\n * @sonordev/site-kit/middleware\n *\n * Composable Next.js middleware factory. Handles:\n * - Portal-managed redirects (via existing handleManagedRedirects)\n * - Security headers (X-Frame-Options, CSP, etc.)\n * - Optional before/after hooks for custom logic\n *\n * @example\n * ```ts\n * // middleware.ts — entire file\n * import { createMiddleware, siteKitMatcher } from '@sonordev/site-kit/middleware'\n *\n * export default createMiddleware()\n * export const config = siteKitMatcher\n * ```\n *\n * @example With custom hooks:\n * ```ts\n * export default createMiddleware({\n *   securityHeaders: { frameOptions: 'SAMEORIGIN' },\n *   before: (req) => {\n *     // Custom auth check, etc.\n *   },\n * })\n * ```\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport {\n  handleManagedRedirects,\n  type RedirectConfig,\n} from '../redirects'\nimport {\n  buildSecurityHeaders,\n  type SecurityHeadersConfig,\n} from './securityHeaders'\nimport { buildAiDiscoveryHeaders } from '../llms/discovery-headers'\nimport { resolveVisitorSegment, encodeSegment } from './segment'\n\nexport type { SecurityHeadersConfig } from './securityHeaders'\nexport {\n  resolveVisitorSegment,\n  encodeSegment,\n  decodeSegment,\n  type VisitorSegment,\n  type SegmentSource,\n} from './segment'\n\nexport interface IdentityConfig {\n  /**\n   * Also resolve + persist a coarse visitor segment (new-vs-returning + source\n   * + campaign) into the `_sk_seg` cookie, for segment-aware slots /\n   * personalization. Default: true (when identity is enabled).\n   */\n  segment?: boolean\n  /** Days the `_sk_vid` visitor cookie persists. Default: 730 (~2 years). */\n  cookieMaxAgeDays?: number\n}\n\nexport interface LlmsDiscoveryConfig {\n  /** Canonical site origin, e.g. `https://example.com` */\n  siteUrl: string\n  /** Path to llms.txt (default `/llms.txt`) */\n  llmsPath?: string\n}\n\nexport interface SiteKitMiddlewareConfig {\n  /** Enable Portal-managed redirects. Default: true */\n  redirects?: boolean | RedirectConfig\n  /** Enable security headers. Default: true */\n  securityHeaders?: boolean | SecurityHeadersConfig\n  /**\n   * Opt-in: inject `Link: <...>; rel=\"describedby\"` header on HTML responses\n   * pointing to /llms.txt for AI crawler discovery (RFC 8288).\n   * Preferred over visible footer links.\n   */\n  llmsDiscovery?: LlmsDiscoveryConfig | false\n  /**\n   * Opt-in EDGE IDENTITY pass. When enabled, the middleware ensures a\n   * first-party `_sk_vid` visitor cookie exists (server-authoritative id) and\n   * resolves the visitor segment into `_sk_seg`, so server-rendered slots and\n   * personalization can read identity + segment without re-parsing the request.\n   * Purely additive — it only writes cookies, never changes the rendered HTML,\n   * so it is LCP/static-safe. Default: OFF (sites opt in for 3.0 personalization).\n   *\n   * NOTE: to make these the SAME id the client uses, the shared identity helper\n   * must read `_sk_vid` cookie-first (a follow-on change validated with a live\n   * preview); until then the cookie is the server-side mirror.\n   */\n  identity?: boolean | IdentityConfig\n  /**\n   * Hook that runs BEFORE redirect check.\n   * Return a NextResponse to short-circuit, or undefined to continue.\n   */\n  before?: (\n    request: NextRequest,\n  ) => NextResponse | undefined | Promise<NextResponse | undefined>\n  /**\n   * Hook that runs AFTER all processing.\n   * Receives the response that will be sent — mutate headers, etc.\n   */\n  after?: (\n    request: NextRequest,\n    response: NextResponse,\n  ) => NextResponse | Promise<NextResponse>\n}\n\n/**\n * Create a fully-featured Next.js middleware function.\n *\n * With zero config this handles redirects + security headers automatically.\n */\nexport function createMiddleware(config?: SiteKitMiddlewareConfig) {\n  const securityHeaders = buildSecurityHeaders(\n    config?.securityHeaders,\n  )\n\n  // Pre-compute discovery headers (static per middleware instance)\n  const discoveryHeaders: Record<string, string> =\n    config?.llmsDiscovery\n      ? buildAiDiscoveryHeaders({\n          siteUrl: config.llmsDiscovery.siteUrl,\n          llmsPath: config.llmsDiscovery.llmsPath,\n        })\n      : {}\n\n  return async function proxy(\n    request: NextRequest,\n  ): Promise<NextResponse> {\n    // 1. Run user's 'before' hook\n    if (config?.before) {\n      const earlyResponse = await config.before(request)\n      if (earlyResponse) {\n        // Apply security headers even to early responses\n        applyHeaders(earlyResponse, securityHeaders)\n        return earlyResponse\n      }\n    }\n\n    // 2. Check Portal-managed redirects (unless disabled)\n    if (config?.redirects !== false) {\n      const redirectConfig: RedirectConfig =\n        typeof config?.redirects === 'object'\n          ? config.redirects\n          : {}\n\n      const redirect = await handleManagedRedirects(\n        request,\n        redirectConfig,\n      )\n      if (redirect) {\n        // Redirects get security headers too\n        applyHeaders(redirect, securityHeaders)\n        return redirect\n      }\n    }\n\n    // 3. Build the pass-through response\n    let response = NextResponse.next()\n\n    // 4. Apply security headers\n    applyHeaders(response, securityHeaders)\n\n    // 5. Apply AI discovery Link header (only on HTML-like requests, not static assets)\n    if (Object.keys(discoveryHeaders).length > 0) {\n      const accept = request.headers.get('accept') || ''\n      if (accept.includes('text/html') || accept.includes('*/*')) {\n        applyHeaders(response, discoveryHeaders)\n      }\n    }\n\n    // 5b. Edge identity pass (opt-in). Ensure a first-party `_sk_vid` visitor\n    // cookie exists and resolve the visitor segment into `_sk_seg`. Additive:\n    // only writes cookies, never changes the rendered HTML (LCP/static-safe).\n    if (config?.identity) {\n      const idCfg: IdentityConfig =\n        typeof config.identity === 'object' ? config.identity : {}\n      const hadVisitorCookie = !!request.cookies.get('_sk_vid')?.value\n      if (!hadVisitorCookie) {\n        const maxAgeDays = idCfg.cookieMaxAgeDays ?? 730\n        response.cookies.set('_sk_vid', generateVisitorId(), {\n          maxAge: maxAgeDays * 24 * 60 * 60,\n          path: '/',\n          sameSite: 'lax',\n          secure: true,\n        })\n      }\n      if (idCfg.segment !== false) {\n        const segment = encodeSegment(\n          resolveVisitorSegment(request, { hadVisitorCookie }),\n        )\n        response.cookies.set('_sk_seg', segment, {\n          // Session-ish: a fresh campaign / source on a later visit re-segments.\n          maxAge: 30 * 60,\n          path: '/',\n          sameSite: 'lax',\n          secure: true,\n        })\n      }\n    }\n\n    // 6. Run user's 'after' hook\n    if (config?.after) {\n      response = await config.after(request, response)\n    }\n\n    return response\n  }\n}\n\n/**\n * Generate a visitor id at the edge. Prefers Web Crypto (available in the\n * Next.js edge runtime); falls back to a v4-shaped string elsewhere.\n */\nfunction generateVisitorId(): string {\n  if (typeof crypto !== 'undefined' && crypto.randomUUID) return crypto.randomUUID()\n  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {\n    const r = (Math.random() * 16) | 0\n    return (c === 'x' ? r : (r & 0x3) | 0x8).toString(16)\n  })\n}\n\nfunction applyHeaders(\n  response: NextResponse,\n  headers: Record<string, string>,\n): void {\n  for (const [key, value] of Object.entries(headers)) {\n    response.headers.set(key, value)\n  }\n}\n\n/**\n * Standard matcher config that excludes static assets and images.\n * Export alongside createProxy/createMiddleware in your proxy.ts.\n */\nexport const siteKitMatcher = {\n  matcher: [\n    '/((?!_next/static|_next/image|favicon\\\\.ico|.*\\\\.(?:ico|png|jpg|jpeg|gif|webp|svg|woff2?)$).*)',\n  ],\n}\n\n/** Next.js 16+ alias — same as createMiddleware, named for the proxy convention. */\nexport const createProxy = createMiddleware\n"]}

package/dist/seo/index.d.mts

@@ -1,201 +1,10 @@
-import { c as ManagedSchemaProps, e as ManagedFAQProps, g as ManagedInternalLinksProps, i as ManagedContentProps, h as ManagedContentBlock, p as ManagedScriptsProps } from '../types-DYyIAgQg.mjs';
-export { A as ABTest, k as ABTestResult, F as FAQItem, l as GetABVariantOptions, G as GetManagedMetadataOptions, n as GetRedirectOptions, r as GetRobotsOptions, t as GetSitemapEntriesOptions, d as ManagedFAQData, f as ManagedLink, M as ManagedMetadataResult, m as ManagedRedirect, o as ManagedScript, R as RedirectResult, q as RobotsDirective, a as SEOPageData, b as SchemaMarkup, s as SitemapEntry, S as SonorSEOConfig } from '../types-DYyIAgQg.mjs';
-export { b as generateSitemap, c as getABVariant, g as getManagedMetadata, a as getManagedMetadataWithAB, d as getRedirect, e as getRobotsDirective, i as isIndexable } from '../routing-trNzR1Pz.mjs';
+import { a as ManagedSchemaProps, c as ManagedFAQProps, d as ManagedInternalLinksProps, e as ManagedContentProps, f as ManagedContentBlock, g as ManagedScriptsProps } from '../types-DPsbBKiu.mjs';
+export { A as ABTest, k as ABTestResult, F as FAQItem, l as GetABVariantOptions, G as GetManagedMetadataOptions, n as GetRedirectOptions, q as GetRobotsOptions, s as GetSitemapEntriesOptions, b as ManagedFAQData, j as ManagedLink, M as ManagedMetadataResult, m as ManagedRedirect, o as ManagedScript, R as RedirectResult, p as RobotsDirective, h as SEOPageData, i as SchemaMarkup, r as SitemapEntry, S as SonorSEOConfig } from '../types-DPsbBKiu.mjs';
+export { E as EntityType, P as PageSeoContext, S as SEOEntity, e as generateSitemap, m as getABTest, b as getABVariant, l as getContentBlock, t as getEntities, v as getEntityEnhancedSchema, j as getFAQData, k as getInternalLinks, g as getManagedMetadata, a as getManagedMetadataWithAB, o as getManagedScripts, u as getPrimaryEntity, c as getRedirect, n as getRedirectData, p as getRobotsData, d as getRobotsDirective, f as getSEOPageData, h as getSchemaMarkups, q as getSitemapEntries, w as getVisibilityScore, x as getVisibilitySummary, i as isIndexable, r as recordABImpression, s as registerSitemap } from '../server-mX5At_6x.mjs';
 import { ResolvingMetadata, Metadata } from 'next';
 import * as React from 'react';
 export { SitemapSync } from './client.mjs';
 
-/**
- * @sonordev/site-kit/seo - Server-Only API Functions
- *
- * SECURITY: These functions use private environment variables
- * and should ONLY be imported in server-side code (RSC, API routes, server actions).
- *
- * DO NOT import this file in client components or it will expose API keys.
- */
-
-/** Response shape for POST /api/public/seo/page-context */
-type PageSeoContext = {
-    page: any | null;
-    schemas: any[];
-    project: {
-        id: string;
-        title?: string | null;
-        domain?: string | null;
-        logo_url?: string | null;
-        site_url?: string | null;
-    } | null;
-};
-/**
- * Fetch SEO page data - cached per request
- * @server-only
- */
-declare const getSEOPageData: (path: string) => Promise<{
-    page: any;
-    project: {
-        id: string;
-        title?: string | null;
-        domain?: string | null;
-        logo_url?: string | null;
-        site_url?: string | null;
-    } | null;
-}>;
-/**
- * Fetch schema markups for a page - cached per request (shares loadPageSeoContext with getSEOPageData)
- * @server-only
- */
-declare const getSchemaMarkups: (path: string, options?: {
-    includeTypes?: string[];
-    excludeTypes?: string[];
-}) => Promise<any[]>;
-/**
- * Fetch FAQ data for a page - cached per request
- * @server-only
- */
-declare const getFAQData: (path: string) => Promise<any>;
-/**
- * Fetch internal links for a page - cached per request
- * @server-only
- */
-declare const getInternalLinks: (sourcePath: string, options?: {
-    position?: string;
-    limit?: number;
-}) => Promise<any[]>;
-/**
- * Fetch content block - cached per request
- * @server-only
- */
-declare const getContentBlock: (path: string, section: string) => Promise<any>;
-/**
- * Fetch A/B test and determine variant - cached per request
- * @server-only
- */
-declare const getABTest: (path: string, field: string) => Promise<any>;
-/**
- * Record A/B test impression
- * @server-only
- */
-declare function recordABImpression(testId: string, variant: 'a' | 'b', sessionId?: string): Promise<void>;
-/**
- * Fetch redirect for a path - cached per request
- * @server-only
- */
-declare const getRedirectData: (path: string) => Promise<any>;
-/**
- * Fetch managed scripts - cached per request
- * @server-only
- */
-declare const getManagedScripts: (position: string, currentPath?: string) => Promise<any[]>;
-/**
- * Fetch robots directive for a page - cached per request
- * @server-only
- */
-declare const getRobotsData: (path: string) => Promise<any>;
-/**
- * Fetch sitemap entries - cached per request
- * @server-only
- */
-declare const getSitemapEntries: (options?: {
-    publishedOnly?: boolean;
-}) => Promise<any[]>;
-/**
- * Register/sync sitemap entries from the client site
- * Call this at build time to populate seo_pages from your sitemap.xml
- * @server-only
- *
- * @example
- * ```ts
- * // scripts/register-sitemap.ts (run at build time)
- * import { registerSitemap } from '@sonordev/seo/server'
- *
- * await registerSitemap([
- *   { path: '/', priority: 1.0, changefreq: 'daily' },
- *   { path: '/about', priority: 0.8, changefreq: 'weekly' },
- * ])
- * ```
- */
-declare function registerSitemap(entries: Array<{
-    path: string;
-    title?: string;
-    priority?: number;
-    changefreq?: 'always' | 'hourly' | 'daily' | 'weekly' | 'monthly' | 'yearly' | 'never';
-}>, options?: {
-    /**
-     * Sync mode:
-     * - 'full-replace': replaces the entire page set (default for build-time sync)
-     * - 'additive': adds/updates pages but never deletes existing ones
-     */
-    mode?: 'additive' | 'full-replace';
-}): Promise<{
-    success: boolean;
-    created: number;
-    updated: number;
-}>;
-/**
- * Entity types for the knowledge graph
- */
-type EntityType = 'organization' | 'person' | 'service' | 'product' | 'location' | 'concept' | 'credential';
-/**
- * Entity from the knowledge graph
- */
-interface SEOEntity {
-    id: string;
-    project_id: string;
-    entity_type: EntityType;
-    name: string;
-    slug: string;
-    properties: Record<string, unknown>;
-    knows_about: string[];
-    same_as: string[];
-    schema_type?: string;
-    is_primary: boolean;
-}
-/**
- * Fetch entities for a project - cached per request
- * Returns the entity graph for enhanced schema markup
- * @server-only
- */
-declare const getEntities: (options?: {
-    type?: EntityType;
-}) => Promise<SEOEntity[]>;
-/**
- * Fetch primary entity (the business) - cached per request
- * @server-only
- */
-declare const getPrimaryEntity: () => Promise<SEOEntity | null>;
-/**
- * Fetch entity-enhanced schema for a page
- * Returns Organization schema with knowsAbout, areaServed, employee, etc.
- * @server-only
- */
-declare const getEntityEnhancedSchema: (pagePath: string) => Promise<object[]>;
-/**
- * Get AI visibility score for a page
- * @server-only
- */
-declare const getVisibilityScore: (pagePath: string) => Promise<{
-    overall_score: number;
-    entity_coverage: number;
-    answer_density: number;
-    chunk_readability: number;
-    authority_signals: number;
-    schema_completeness: number;
-} | null>;
-/**
- * Get AI visibility summary for project
- * @server-only
- */
-declare const getVisibilitySummary: () => Promise<{
-    overall_score: number;
-    total_entities: number;
-    pages_analyzed: number;
-    top_recommendations: Array<{
-        priority: string;
-        type: string;
-        message: string;
-    }>;
-} | null>;
-
 /**
  * @sonordev/site-kit/seo - withManagedMetadata
  *
@@ -323,17 +132,13 @@ declare function ManagedNoScripts(props: {
 }): React.ReactElement;
 
 /**
- * LocationPageContent - Server Component for fetching location page sections
- *
- * Usage:
- *   <LocationPageContent
- *     projectId="uuid"
- *     path="/areas/seattle-wa/plumbing"
- *     section="hero"
- *   />
+ * @deprecated DO NOT USE. This component calls an endpoint that does not exist
+ * (and sends project_id from the client, violating the x-api-key-only auth
+ * contract) — it has only ever rendered its fallback. Location page content is
+ * served through the standard managed-content path instead. Kept exported so
+ * existing imports keep compiling; it renders the fallback and warns.
  *
- * This component fetches content from seo_location_pages.sections for a given
- * path and section, making it editable in Portal without code deploys.
+ * LocationPageContent - Server Component for fetching location page sections
  */
 
 interface LocationPageContentProps {
@@ -388,4 +193,4 @@ declare const getLocationSection: (projectId: string, path: string, section: str
  */
 declare function LocationPageContent(props: LocationPageContentProps): React.ReactElement;
 
-export { type EntityType, LLMSchema, type HeroSectionContent as LocationHeroContent, LocationPageContent, type LocationPageContentProps, type LocationSectionData, type ServiceGridContent as LocationServicesContent, type TextSectionContent as LocationTextContent, ManagedContent, ManagedContentBlock, ManagedContentProps, ManagedFAQ, ManagedFAQProps, ManagedInternalLinks, ManagedInternalLinksProps, ManagedNoScripts, ManagedSchema, ManagedSchemaProps, ManagedScripts, ManagedScriptsProps, type PageSeoContext, type SEOEntity, createBreadcrumbSchema, createSchema, createWebSiteOrganizationStub, getABTest, getContentBlock, getEntities, getEntityEnhancedSchema, getFAQData, getInternalLinks, getLocationSection, getManagedContentData, getManagedScripts, getPrimaryEntity, getRedirectData, getRobotsData, getSEOPageData, getSchemaMarkups, getSitemapEntries, getVisibilityScore, getVisibilitySummary, recordABImpression, registerSitemap, withManagedMetadata };
+export { LLMSchema, type HeroSectionContent as LocationHeroContent, LocationPageContent, type LocationPageContentProps, type LocationSectionData, type ServiceGridContent as LocationServicesContent, type TextSectionContent as LocationTextContent, ManagedContent, ManagedContentBlock, ManagedContentProps, ManagedFAQ, ManagedFAQProps, ManagedInternalLinks, ManagedInternalLinksProps, ManagedNoScripts, ManagedSchema, ManagedSchemaProps, ManagedScripts, ManagedScriptsProps, createBreadcrumbSchema, createSchema, createWebSiteOrganizationStub, getLocationSection, getManagedContentData, withManagedMetadata };