@sonordev/site-kit 3.3.0 → 3.4.0

package/dist/layout/client.js

@@ -1,22 +1,23 @@
 'use client';
 'use strict';
 
-var chunkBOTWTNHW_js = require('../chunk-BOTWTNHW.js');
-require('../chunk-FX3VR4BF.js');
+var chunk56X3IUOL_js = require('../chunk-56X3IUOL.js');
+require('../chunk-RMUOY6XB.js');
 require('../chunk-HGNSJXWT.js');
 require('../chunk-Q2NBD54V.js');
 require('../chunk-WZHWWOUC.js');
-require('../chunk-6UK5JIKE.js');
-require('../chunk-3BNFUMLL.js');
-require('../chunk-M2EGCGIT.js');
-require('../chunk-EOENN46G.js');
+require('../chunk-MJV6RC7I.js');
+require('../chunk-XB57AM6T.js');
+require('../chunk-VJMPIRSD.js');
+require('../chunk-XKV73RDH.js');
+require('../chunk-CDETOO5W.js');
 require('../chunk-ZSMWDLMK.js');
 
 
 
 Object.defineProperty(exports, "SiteKitClientProviders", {
   enumerable: true,
-  get: function () { return chunkBOTWTNHW_js.SiteKitClientProviders; }
+  get: function () { return chunk56X3IUOL_js.SiteKitClientProviders; }
 });
 //# sourceMappingURL=client.js.map
 //# sourceMappingURL=client.js.map

package/dist/layout/client.mjs

@@ -1,13 +1,14 @@
 'use client';
-export { SiteKitClientProviders } from '../chunk-AXFM4MFK.mjs';
-import '../chunk-X72PFC4X.mjs';
+export { SiteKitClientProviders } from '../chunk-WVAY4ZWC.mjs';
+import '../chunk-QE53WRXW.mjs';
 import '../chunk-ZVBLXXNJ.mjs';
 import '../chunk-ZPLN537Q.mjs';
 import '../chunk-X4OPM3SK.mjs';
-import '../chunk-ZCZEKWFW.mjs';
-import '../chunk-EE6SFAZP.mjs';
-import '../chunk-FO6Y27AH.mjs';
-import '../chunk-S4FJIG6Y.mjs';
+import '../chunk-VNQFKBKF.mjs';
+import '../chunk-AX4AROLH.mjs';
+import '../chunk-6EDVCUAG.mjs';
+import '../chunk-WS4GNH3F.mjs';
+import '../chunk-YCQHE2XT.mjs';
 import '../chunk-4XPGGLVP.mjs';
 //# sourceMappingURL=client.mjs.map
 //# sourceMappingURL=client.mjs.map

package/dist/layout/index.js

@@ -1,17 +1,18 @@
 'use strict';
 
-var chunkBOTWTNHW_js = require('../chunk-BOTWTNHW.js');
-require('../chunk-FX3VR4BF.js');
+var chunk56X3IUOL_js = require('../chunk-56X3IUOL.js');
+require('../chunk-RMUOY6XB.js');
 require('../chunk-HGNSJXWT.js');
 require('../chunk-Q2NBD54V.js');
 require('../chunk-WZHWWOUC.js');
 var chunkGCPPXUAI_js = require('../chunk-GCPPXUAI.js');
-require('../chunk-6UK5JIKE.js');
+require('../chunk-MJV6RC7I.js');
 var chunkDV2LJYFD_js = require('../chunk-DV2LJYFD.js');
 var chunkQPIKPWAZ_js = require('../chunk-QPIKPWAZ.js');
-require('../chunk-3BNFUMLL.js');
-require('../chunk-M2EGCGIT.js');
-var chunkEOENN46G_js = require('../chunk-EOENN46G.js');
+require('../chunk-XB57AM6T.js');
+require('../chunk-VJMPIRSD.js');
+require('../chunk-XKV73RDH.js');
+var chunkCDETOO5W_js = require('../chunk-CDETOO5W.js');
 require('../chunk-ZSMWDLMK.js');
 require('server-only');
 var jsxRuntime = require('react/jsx-runtime');
@@ -33,7 +34,7 @@ async function resolveClientCredential(rawKey, apiUrl) {
       headers: {
         "content-type": "application/json",
         "x-api-key": rawKey,
-        "x-sitekit-version": chunkEOENN46G_js.SITE_KIT_VERSION
+        "x-sitekit-version": chunkCDETOO5W_js.SITE_KIT_VERSION
       },
       cache: "no-store",
       signal: typeof AbortSignal !== "undefined" && AbortSignal.timeout ? AbortSignal.timeout(MINT_TIMEOUT_MS) : void 0
@@ -91,7 +92,7 @@ async function SiteKitLayout({
     favicon && /* @__PURE__ */ jsxRuntime.jsx(chunkGCPPXUAI_js.ManagedFavicon, { apiKey: resolvedApiKey, apiUrl: resolvedApiUrl }),
     managedScripts && /* @__PURE__ */ jsxRuntime.jsx(chunkDV2LJYFD_js.ManagedScripts, { position: "head" }),
     /* @__PURE__ */ jsxRuntime.jsxs(
-      chunkBOTWTNHW_js.SiteKitClientProviders,
+      chunk56X3IUOL_js.SiteKitClientProviders,
       {
         apiKey: clientCredential,
         apiUrl: resolvedApiUrl,

package/dist/layout/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/mint-site-token.ts","../../src/layout/SiteKitLayout.tsx"],"names":["SITE_KIT_VERSION","resolveApiOrigin","jsxs","Fragment","jsx","ManagedFavicon","ManagedScripts","SiteKitClientProviders"],"mappings":";;;;;;;;;;;;;;;;;;AAqBA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAM1B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAE1C,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,MAAA,IAAU,MAAA,CAAO,SAAA,GAAY,GAAA,SAAY,MAAA,CAAO,UAAA;AAEpD,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,GAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,MAC7C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,WAAA,EAAa,MAAA;AAAA,QACb,mBAAA,EAAqBA;AAAA,OACvB;AAAA,MACA,KAAA,EAAO,UAAA;AAAA,MACP,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,KACP,CAAA;AAED,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,MAAM,IAAA,CAAK,GAAA,CAAK,YAAY,GAAA,GAAQ,CAAA,EAAG,KAAK,GAAM;AAAA,SAC9D,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AAAA,IACF,CAAA,MAAA,IAAW,GAAA,CAAI,MAAA,KAAW,GAAA,EAAK;AAG7B,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA,oCAAA;AAAA,OACnD;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAA,CAAQ,KAAK,4EAA4E,CAAA;AAAA,EAC3F;AAIA,EAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,EAAA,OAAO,MAAA;AACT;ACaA,eAAsB,aAAA,CAAc;AAAA,EAClC,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA,GAAY,IAAA;AAAA,EACZ,MAAA,GAAS,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EACT,WAAA,GAAc,IAAA;AAAA,EACd,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR,OAAA,GAAU,IAAA;AAAA,EACV,cAAA,GAAiB,IAAA;AAAA,EACjB,KAAA,GAAQ,KAAA;AAAA,EACR,qBAAA,GAAwB;AAC1B,CAAA,EAAuB;AAErB,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,EAAA;AACF,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,sBAAA;AAEF,EAAA,IAAI,CAAC,kBAAkB,KAAA,EAAO;AAC5B,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAYC,kCAAiB,cAAc,CAAA;AAKjD,EAAA,MAAM,gBAAA,GAAmB,MAAM,uBAAA,CAAwB,cAAA,EAAgB,cAAc,CAAA;AAErF,EAAA,uBACEC,eAAA,CAAAC,mBAAA,EAAA,EACE,QAAA,EAAA;AAAA,oBAAAC,cAAA,CAAC,UAAK,GAAA,EAAI,YAAA,EAAa,IAAA,EAAM,SAAA,EAAW,aAAY,WAAA,EAAY,CAAA;AAAA,oBAChEA,cAAA,CAAC,MAAA,EAAA,EAAK,GAAA,EAAI,cAAA,EAAe,MAAM,SAAA,EAAW,CAAA;AAAA,IAEzC,2BAAWA,cAAA,CAACC,+BAAA,EAAA,EAAe,MAAA,EAAQ,cAAA,EAAgB,QAAQ,cAAA,EAAgB,CAAA;AAAA,IAC3E,cAAA,oBAAkBD,cAAA,CAACE,+BAAA,EAAA,EAAe,QAAA,EAAS,MAAA,EAAO,CAAA;AAAA,oBAInDJ,eAAA;AAAA,MAACK,uCAAA;AAAA,MAAA;AAAA,QACC,MAAA,EAAQ,gBAAA;AAAA,QACR,MAAA,EAAQ,cAAA;AAAA,QACR,SAAA;AAAA,QACA,SAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,WAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QAEC,QAAA,EAAA;AAAA,UAAA,QAAA;AAAA,UACA,qBAAA,mBACCH,cAAA,CAAC,QAAA,EAAA,EAAO,SAAA,EAAU,SAAA,EAAU,aAAA,EAAY,MAAA,EACtC,QAAA,kBAAAA,cAAA,CAAC,GAAA,EAAA,EAAE,IAAA,EAAK,WAAA,EAAY,QAAA,EAAA,UAAA,EAAQ,GAC9B,CAAA,GACE;AAAA;AAAA;AAAA,KACN;AAAA,IAGC,cAAA,oBAAkBA,cAAA,CAACE,+BAAA,EAAA,EAAe,QAAA,EAAS,UAAA,EAAW;AAAA,GAAA,EACzD,CAAA;AAEJ","file":"index.js","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * Resilience: if minting is unavailable (older API without the endpoint, token\n * auth not configured, transient outage) it returns the RAW KEY, so a build never\n * breaks. Domain-binding is log-only by default, so the raw key still works —\n * worst case is exactly pre-3.2 behavior. Memoized per raw key for the process,\n * so an entire `next build` mints ~once and every static page reuses one seed\n * (the client refreshes on the far side as needed).\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const now = Date.now()\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > now) return cached.credential\n\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  try {\n    const res = await fetch(`${base}${MINT_PATH}`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-api-key': rawKey,\n        'x-sitekit-version': SITE_KIT_VERSION,\n      },\n      cache: 'no-store',\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n          : undefined,\n    })\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: now + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n    } else if (res.status !== 404) {\n      // 404 = older API without the endpoint (expected during rollout). Anything\n      // else is worth a server-side note. Never logs the key value.\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; injecting raw key for this render.`,\n      )\n    }\n  } catch {\n    console.warn('[SiteKitLayout] Token mint unavailable; injecting raw key for this render.')\n  }\n\n  // Fallback: the raw key (pre-3.2 behavior). Short cache so a transient outage\n  // retries soon rather than pinning the raw key for the whole build.\n  cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n  return rawKey\n}\n","/**\n * @sonordev/site-kit/layout — SiteKitLayout\n *\n * The master layout component. A single RSC that auto-composes every\n * site-kit feature your layout needs:\n *\n * Server-side (RSC):\n *   - ManagedFavicon (link tags from Portal logo)\n *   - ManagedScripts position=\"head\" (tracking pixels, analytics tags)\n *   - ManagedScripts position=\"body-end\"\n *\n * Client-side (island):\n *   - AnalyticsProvider (page views, scroll depth, heatmap, web vitals)\n *   - EngageWidget (popups, nudges, chat)\n *   - SignalBridge (A/B experiments, behavior tracking)\n *   - SitemapSync (keeps Portal seo_pages in sync)\n *\n * @example\n * ```tsx\n * // app/layout.tsx\n * import { SiteKitLayout } from '@sonordev/site-kit/layout'\n *\n * export default function RootLayout({ children }) {\n *   return (\n *     <html lang=\"en\">\n *       <body>\n *         <SiteKitLayout>\n *           <Header />\n *           <main>{children}</main>\n *           <Footer />\n *         </SiteKitLayout>\n *       </body>\n *     </html>\n *   )\n * }\n * ```\n *\n * @example Opt out of specific features:\n * ```tsx\n * <SiteKitLayout engage={false} signal={false}>\n *   {children}\n * </SiteKitLayout>\n * ```\n */\n\nimport * as React from 'react'\nimport { ManagedFavicon } from '../images/ManagedFavicon'\nimport { ManagedScripts } from '../seo/ManagedScripts'\nimport { resolveApiOrigin } from '../server/server-fetch'\nimport { resolveClientCredential } from '../server/mint-site-token'\nimport { SiteKitClientProviders } from './SiteKitClientProviders'\nimport type { AnalyticsConfig, EngageConfig, SignalConfig } from './types'\n\nexport interface SiteKitLayoutProps {\n  children: React.ReactNode\n\n  /** Portal API key. Defaults to SONOR_API_KEY env var. */\n  apiKey?: string\n  /** Portal API URL. Defaults to env or https://api.sonor.io */\n  apiUrl?: string\n  /** Project ID (for Engage chat room routing). Auto-resolved if not provided. */\n  projectId?: string\n\n  /** Analytics tracking. true (default) | false | config object */\n  analytics?: boolean | AnalyticsConfig\n  /** Engage widgets (popups, chat). true (default) | false | config object */\n  engage?: boolean | EngageConfig\n  /** Signal AI (experiments, behavior). false (default) | true | config object */\n  signal?: boolean | SignalConfig\n  /** SitemapSync client component. Default: true */\n  sitemapSync?: boolean\n  /**\n   * Fleet heartbeat — reports this site's kit version + active modules to Sonor\n   * once per session so the platform can track version drift. Default: true.\n   * Deferred like Analytics; never in the hydration path.\n   */\n  fleet?: boolean\n  /**\n   * Defer client modules (Analytics, Engage, SitemapSync) until window load +\n   * idle or the first user interaction, keeping their JS and mount work out of\n   * the critical hydration path. Default: true. Pass false to restore legacy\n   * eager mounting. SignalBridge is never deferred.\n   */\n  defer?: boolean\n  /** ManagedFavicon in <head>. Default: true */\n  favicon?: boolean\n  /** ManagedScripts (head + body-end). Default: true */\n  managedScripts?: boolean\n\n  /** Debug mode — logs to console. Default: false */\n  debug?: boolean\n  /**\n   * When true, append a screen-reader-only link to `/llms.txt` after main content.\n   * Default false — prefer `buildAiDiscoveryHeaders()` for discovery.\n   */\n  showLlmsTxtFooterLink?: boolean\n}\n\nexport async function SiteKitLayout({\n  children,\n  apiKey,\n  apiUrl,\n  projectId,\n  analytics = true,\n  engage = true,\n  signal = false,\n  sitemapSync = true,\n  fleet = true,\n  defer = true,\n  favicon = true,\n  managedScripts = true,\n  debug = false,\n  showLlmsTxtFooterLink = false,\n}: SiteKitLayoutProps) {\n  // Resolve API config from env (server-side, safe)\n  const resolvedApiKey =\n    apiKey ??\n    process.env.SONOR_API_KEY ??\n    ''\n  const resolvedApiUrl =\n    apiUrl ??\n    process.env.SONOR_API_URL ??\n    'https://api.sonor.io'\n\n  if (!resolvedApiKey && debug) {\n    console.warn(\n      '[SiteKitLayout] No API key found. Set SONOR_API_KEY.',\n    )\n  }\n\n  const apiOrigin = resolveApiOrigin(resolvedApiUrl)\n\n  // Mint a short-lived client token so the raw key never reaches the browser.\n  // Falls back to the raw key if minting is unavailable (older API / transient\n  // outage) — the build never breaks. The client refreshes the token as needed.\n  const clientCredential = await resolveClientCredential(resolvedApiKey, resolvedApiUrl)\n\n  return (\n    <>\n      <link rel=\"preconnect\" href={apiOrigin} crossOrigin=\"anonymous\" />\n      <link rel=\"dns-prefetch\" href={apiOrigin} />\n      {/* Server-rendered head components */}\n      {favicon && <ManagedFavicon apiKey={resolvedApiKey} apiUrl={resolvedApiUrl} />}\n      {managedScripts && <ManagedScripts position=\"head\" />}\n\n      {/* Client-side providers island — receives the minted token (or raw-key\n          fallback), never the raw key when minting succeeds. */}\n      <SiteKitClientProviders\n        apiKey={clientCredential}\n        apiUrl={resolvedApiUrl}\n        projectId={projectId}\n        analytics={analytics}\n        engage={engage}\n        signal={signal}\n        sitemapSync={sitemapSync}\n        fleet={fleet}\n        defer={defer}\n        debug={debug}\n      >\n        {children}\n        {showLlmsTxtFooterLink ? (\n          <footer className=\"sr-only\" aria-hidden=\"true\">\n            <a href=\"/llms.txt\">llms.txt</a>\n          </footer>\n        ) : null}\n      </SiteKitClientProviders>\n\n      {/* Server-rendered body-end scripts */}\n      {managedScripts && <ManagedScripts position=\"body-end\" />}\n    </>\n  )\n}\n"]}
+{"version":3,"sources":["../../src/server/mint-site-token.ts","../../src/layout/SiteKitLayout.tsx"],"names":["SITE_KIT_VERSION","resolveApiOrigin","jsxs","Fragment","jsx","ManagedFavicon","ManagedScripts","SiteKitClientProviders"],"mappings":";;;;;;;;;;;;;;;;;;;AAqBA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAM1B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAE1C,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,MAAA,IAAU,MAAA,CAAO,SAAA,GAAY,GAAA,SAAY,MAAA,CAAO,UAAA;AAEpD,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,GAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,MAC7C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,WAAA,EAAa,MAAA;AAAA,QACb,mBAAA,EAAqBA;AAAA,OACvB;AAAA,MACA,KAAA,EAAO,UAAA;AAAA,MACP,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,KACP,CAAA;AAED,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,MAAM,IAAA,CAAK,GAAA,CAAK,YAAY,GAAA,GAAQ,CAAA,EAAG,KAAK,GAAM;AAAA,SAC9D,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AAAA,IACF,CAAA,MAAA,IAAW,GAAA,CAAI,MAAA,KAAW,GAAA,EAAK;AAG7B,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA,oCAAA;AAAA,OACnD;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAA,CAAQ,KAAK,4EAA4E,CAAA;AAAA,EAC3F;AAIA,EAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,EAAA,OAAO,MAAA;AACT;ACaA,eAAsB,aAAA,CAAc;AAAA,EAClC,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA,GAAY,IAAA;AAAA,EACZ,MAAA,GAAS,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EACT,WAAA,GAAc,IAAA;AAAA,EACd,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR,OAAA,GAAU,IAAA;AAAA,EACV,cAAA,GAAiB,IAAA;AAAA,EACjB,KAAA,GAAQ,KAAA;AAAA,EACR,qBAAA,GAAwB;AAC1B,CAAA,EAAuB;AAErB,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,EAAA;AACF,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,sBAAA;AAEF,EAAA,IAAI,CAAC,kBAAkB,KAAA,EAAO;AAC5B,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAYC,kCAAiB,cAAc,CAAA;AAKjD,EAAA,MAAM,gBAAA,GAAmB,MAAM,uBAAA,CAAwB,cAAA,EAAgB,cAAc,CAAA;AAErF,EAAA,uBACEC,eAAA,CAAAC,mBAAA,EAAA,EACE,QAAA,EAAA;AAAA,oBAAAC,cAAA,CAAC,UAAK,GAAA,EAAI,YAAA,EAAa,IAAA,EAAM,SAAA,EAAW,aAAY,WAAA,EAAY,CAAA;AAAA,oBAChEA,cAAA,CAAC,MAAA,EAAA,EAAK,GAAA,EAAI,cAAA,EAAe,MAAM,SAAA,EAAW,CAAA;AAAA,IAEzC,2BAAWA,cAAA,CAACC,+BAAA,EAAA,EAAe,MAAA,EAAQ,cAAA,EAAgB,QAAQ,cAAA,EAAgB,CAAA;AAAA,IAC3E,cAAA,oBAAkBD,cAAA,CAACE,+BAAA,EAAA,EAAe,QAAA,EAAS,MAAA,EAAO,CAAA;AAAA,oBAInDJ,eAAA;AAAA,MAACK,uCAAA;AAAA,MAAA;AAAA,QACC,MAAA,EAAQ,gBAAA;AAAA,QACR,MAAA,EAAQ,cAAA;AAAA,QACR,SAAA;AAAA,QACA,SAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,WAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QAEC,QAAA,EAAA;AAAA,UAAA,QAAA;AAAA,UACA,qBAAA,mBACCH,cAAA,CAAC,QAAA,EAAA,EAAO,SAAA,EAAU,SAAA,EAAU,aAAA,EAAY,MAAA,EACtC,QAAA,kBAAAA,cAAA,CAAC,GAAA,EAAA,EAAE,IAAA,EAAK,WAAA,EAAY,QAAA,EAAA,UAAA,EAAQ,GAC9B,CAAA,GACE;AAAA;AAAA;AAAA,KACN;AAAA,IAGC,cAAA,oBAAkBA,cAAA,CAACE,+BAAA,EAAA,EAAe,QAAA,EAAS,UAAA,EAAW;AAAA,GAAA,EACzD,CAAA;AAEJ","file":"index.js","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * Resilience: if minting is unavailable (older API without the endpoint, token\n * auth not configured, transient outage) it returns the RAW KEY, so a build never\n * breaks. Domain-binding is log-only by default, so the raw key still works —\n * worst case is exactly pre-3.2 behavior. Memoized per raw key for the process,\n * so an entire `next build` mints ~once and every static page reuses one seed\n * (the client refreshes on the far side as needed).\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const now = Date.now()\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > now) return cached.credential\n\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  try {\n    const res = await fetch(`${base}${MINT_PATH}`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-api-key': rawKey,\n        'x-sitekit-version': SITE_KIT_VERSION,\n      },\n      cache: 'no-store',\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n          : undefined,\n    })\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: now + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n    } else if (res.status !== 404) {\n      // 404 = older API without the endpoint (expected during rollout). Anything\n      // else is worth a server-side note. Never logs the key value.\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; injecting raw key for this render.`,\n      )\n    }\n  } catch {\n    console.warn('[SiteKitLayout] Token mint unavailable; injecting raw key for this render.')\n  }\n\n  // Fallback: the raw key (pre-3.2 behavior). Short cache so a transient outage\n  // retries soon rather than pinning the raw key for the whole build.\n  cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n  return rawKey\n}\n","/**\n * @sonordev/site-kit/layout — SiteKitLayout\n *\n * The master layout component. A single RSC that auto-composes every\n * site-kit feature your layout needs:\n *\n * Server-side (RSC):\n *   - ManagedFavicon (link tags from Portal logo)\n *   - ManagedScripts position=\"head\" (tracking pixels, analytics tags)\n *   - ManagedScripts position=\"body-end\"\n *\n * Client-side (island):\n *   - AnalyticsProvider (page views, scroll depth, heatmap, web vitals)\n *   - EngageWidget (popups, nudges, chat)\n *   - SignalBridge (A/B experiments, behavior tracking)\n *   - SitemapSync (keeps Portal seo_pages in sync)\n *\n * @example\n * ```tsx\n * // app/layout.tsx\n * import { SiteKitLayout } from '@sonordev/site-kit/layout'\n *\n * export default function RootLayout({ children }) {\n *   return (\n *     <html lang=\"en\">\n *       <body>\n *         <SiteKitLayout>\n *           <Header />\n *           <main>{children}</main>\n *           <Footer />\n *         </SiteKitLayout>\n *       </body>\n *     </html>\n *   )\n * }\n * ```\n *\n * @example Opt out of specific features:\n * ```tsx\n * <SiteKitLayout engage={false} signal={false}>\n *   {children}\n * </SiteKitLayout>\n * ```\n */\n\nimport * as React from 'react'\nimport { ManagedFavicon } from '../images/ManagedFavicon'\nimport { ManagedScripts } from '../seo/ManagedScripts'\nimport { resolveApiOrigin } from '../server/server-fetch'\nimport { resolveClientCredential } from '../server/mint-site-token'\nimport { SiteKitClientProviders } from './SiteKitClientProviders'\nimport type { AnalyticsConfig, EngageConfig, SignalConfig } from './types'\n\nexport interface SiteKitLayoutProps {\n  children: React.ReactNode\n\n  /** Portal API key. Defaults to SONOR_API_KEY env var. */\n  apiKey?: string\n  /** Portal API URL. Defaults to env or https://api.sonor.io */\n  apiUrl?: string\n  /** Project ID (for Engage chat room routing). Auto-resolved if not provided. */\n  projectId?: string\n\n  /** Analytics tracking. true (default) | false | config object */\n  analytics?: boolean | AnalyticsConfig\n  /** Engage widgets (popups, chat). true (default) | false | config object */\n  engage?: boolean | EngageConfig\n  /** Signal AI (experiments, behavior). false (default) | true | config object */\n  signal?: boolean | SignalConfig\n  /** SitemapSync client component. Default: true */\n  sitemapSync?: boolean\n  /**\n   * Fleet heartbeat — reports this site's kit version + active modules to Sonor\n   * once per session so the platform can track version drift. Default: true.\n   * Deferred like Analytics; never in the hydration path.\n   */\n  fleet?: boolean\n  /**\n   * Defer client modules (Analytics, Engage, SitemapSync) until window load +\n   * idle or the first user interaction, keeping their JS and mount work out of\n   * the critical hydration path. Default: true. Pass false to restore legacy\n   * eager mounting. SignalBridge is never deferred.\n   */\n  defer?: boolean\n  /** ManagedFavicon in <head>. Default: true */\n  favicon?: boolean\n  /** ManagedScripts (head + body-end). Default: true */\n  managedScripts?: boolean\n\n  /** Debug mode — logs to console. Default: false */\n  debug?: boolean\n  /**\n   * When true, append a screen-reader-only link to `/llms.txt` after main content.\n   * Default false — prefer `buildAiDiscoveryHeaders()` for discovery.\n   */\n  showLlmsTxtFooterLink?: boolean\n}\n\nexport async function SiteKitLayout({\n  children,\n  apiKey,\n  apiUrl,\n  projectId,\n  analytics = true,\n  engage = true,\n  signal = false,\n  sitemapSync = true,\n  fleet = true,\n  defer = true,\n  favicon = true,\n  managedScripts = true,\n  debug = false,\n  showLlmsTxtFooterLink = false,\n}: SiteKitLayoutProps) {\n  // Resolve API config from env (server-side, safe)\n  const resolvedApiKey =\n    apiKey ??\n    process.env.SONOR_API_KEY ??\n    ''\n  const resolvedApiUrl =\n    apiUrl ??\n    process.env.SONOR_API_URL ??\n    'https://api.sonor.io'\n\n  if (!resolvedApiKey && debug) {\n    console.warn(\n      '[SiteKitLayout] No API key found. Set SONOR_API_KEY.',\n    )\n  }\n\n  const apiOrigin = resolveApiOrigin(resolvedApiUrl)\n\n  // Mint a short-lived client token so the raw key never reaches the browser.\n  // Falls back to the raw key if minting is unavailable (older API / transient\n  // outage) — the build never breaks. The client refreshes the token as needed.\n  const clientCredential = await resolveClientCredential(resolvedApiKey, resolvedApiUrl)\n\n  return (\n    <>\n      <link rel=\"preconnect\" href={apiOrigin} crossOrigin=\"anonymous\" />\n      <link rel=\"dns-prefetch\" href={apiOrigin} />\n      {/* Server-rendered head components */}\n      {favicon && <ManagedFavicon apiKey={resolvedApiKey} apiUrl={resolvedApiUrl} />}\n      {managedScripts && <ManagedScripts position=\"head\" />}\n\n      {/* Client-side providers island — receives the minted token (or raw-key\n          fallback), never the raw key when minting succeeds. */}\n      <SiteKitClientProviders\n        apiKey={clientCredential}\n        apiUrl={resolvedApiUrl}\n        projectId={projectId}\n        analytics={analytics}\n        engage={engage}\n        signal={signal}\n        sitemapSync={sitemapSync}\n        fleet={fleet}\n        defer={defer}\n        debug={debug}\n      >\n        {children}\n        {showLlmsTxtFooterLink ? (\n          <footer className=\"sr-only\" aria-hidden=\"true\">\n            <a href=\"/llms.txt\">llms.txt</a>\n          </footer>\n        ) : null}\n      </SiteKitClientProviders>\n\n      {/* Server-rendered body-end scripts */}\n      {managedScripts && <ManagedScripts position=\"body-end\" />}\n    </>\n  )\n}\n"]}

package/dist/layout/index.mjs

@@ -1,15 +1,16 @@
-import { SiteKitClientProviders } from '../chunk-AXFM4MFK.mjs';
-import '../chunk-X72PFC4X.mjs';
+import { SiteKitClientProviders } from '../chunk-WVAY4ZWC.mjs';
+import '../chunk-QE53WRXW.mjs';
 import '../chunk-ZVBLXXNJ.mjs';
 import '../chunk-ZPLN537Q.mjs';
 import '../chunk-X4OPM3SK.mjs';
 import { ManagedFavicon } from '../chunk-CU6OGBKK.mjs';
-import '../chunk-ZCZEKWFW.mjs';
+import '../chunk-VNQFKBKF.mjs';
 import { ManagedScripts } from '../chunk-6PJTLBRR.mjs';
 import { resolveApiOrigin } from '../chunk-UDBUK5ZJ.mjs';
-import '../chunk-EE6SFAZP.mjs';
-import '../chunk-FO6Y27AH.mjs';
-import { SITE_KIT_VERSION } from '../chunk-S4FJIG6Y.mjs';
+import '../chunk-AX4AROLH.mjs';
+import '../chunk-6EDVCUAG.mjs';
+import '../chunk-WS4GNH3F.mjs';
+import { SITE_KIT_VERSION } from '../chunk-YCQHE2XT.mjs';
 import '../chunk-4XPGGLVP.mjs';
 import 'server-only';
 import { jsxs, Fragment, jsx } from 'react/jsx-runtime';

package/dist/layout/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/mint-site-token.ts","../../src/layout/SiteKitLayout.tsx"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAqBA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAM1B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAE1C,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,MAAA,IAAU,MAAA,CAAO,SAAA,GAAY,GAAA,SAAY,MAAA,CAAO,UAAA;AAEpD,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,GAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,MAC7C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,WAAA,EAAa,MAAA;AAAA,QACb,mBAAA,EAAqB;AAAA,OACvB;AAAA,MACA,KAAA,EAAO,UAAA;AAAA,MACP,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,KACP,CAAA;AAED,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,MAAM,IAAA,CAAK,GAAA,CAAK,YAAY,GAAA,GAAQ,CAAA,EAAG,KAAK,GAAM;AAAA,SAC9D,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AAAA,IACF,CAAA,MAAA,IAAW,GAAA,CAAI,MAAA,KAAW,GAAA,EAAK;AAG7B,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA,oCAAA;AAAA,OACnD;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAA,CAAQ,KAAK,4EAA4E,CAAA;AAAA,EAC3F;AAIA,EAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,EAAA,OAAO,MAAA;AACT;ACaA,eAAsB,aAAA,CAAc;AAAA,EAClC,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA,GAAY,IAAA;AAAA,EACZ,MAAA,GAAS,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EACT,WAAA,GAAc,IAAA;AAAA,EACd,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR,OAAA,GAAU,IAAA;AAAA,EACV,cAAA,GAAiB,IAAA;AAAA,EACjB,KAAA,GAAQ,KAAA;AAAA,EACR,qBAAA,GAAwB;AAC1B,CAAA,EAAuB;AAErB,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,EAAA;AACF,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,sBAAA;AAEF,EAAA,IAAI,CAAC,kBAAkB,KAAA,EAAO;AAC5B,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAY,iBAAiB,cAAc,CAAA;AAKjD,EAAA,MAAM,gBAAA,GAAmB,MAAM,uBAAA,CAAwB,cAAA,EAAgB,cAAc,CAAA;AAErF,EAAA,uBACE,IAAA,CAAA,QAAA,EAAA,EACE,QAAA,EAAA;AAAA,oBAAA,GAAA,CAAC,UAAK,GAAA,EAAI,YAAA,EAAa,IAAA,EAAM,SAAA,EAAW,aAAY,WAAA,EAAY,CAAA;AAAA,oBAChE,GAAA,CAAC,MAAA,EAAA,EAAK,GAAA,EAAI,cAAA,EAAe,MAAM,SAAA,EAAW,CAAA;AAAA,IAEzC,2BAAW,GAAA,CAAC,cAAA,EAAA,EAAe,MAAA,EAAQ,cAAA,EAAgB,QAAQ,cAAA,EAAgB,CAAA;AAAA,IAC3E,cAAA,oBAAkB,GAAA,CAAC,cAAA,EAAA,EAAe,QAAA,EAAS,MAAA,EAAO,CAAA;AAAA,oBAInD,IAAA;AAAA,MAAC,sBAAA;AAAA,MAAA;AAAA,QACC,MAAA,EAAQ,gBAAA;AAAA,QACR,MAAA,EAAQ,cAAA;AAAA,QACR,SAAA;AAAA,QACA,SAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,WAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QAEC,QAAA,EAAA;AAAA,UAAA,QAAA;AAAA,UACA,qBAAA,mBACC,GAAA,CAAC,QAAA,EAAA,EAAO,SAAA,EAAU,SAAA,EAAU,aAAA,EAAY,MAAA,EACtC,QAAA,kBAAA,GAAA,CAAC,GAAA,EAAA,EAAE,IAAA,EAAK,WAAA,EAAY,QAAA,EAAA,UAAA,EAAQ,GAC9B,CAAA,GACE;AAAA;AAAA;AAAA,KACN;AAAA,IAGC,cAAA,oBAAkB,GAAA,CAAC,cAAA,EAAA,EAAe,QAAA,EAAS,UAAA,EAAW;AAAA,GAAA,EACzD,CAAA;AAEJ","file":"index.mjs","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * Resilience: if minting is unavailable (older API without the endpoint, token\n * auth not configured, transient outage) it returns the RAW KEY, so a build never\n * breaks. Domain-binding is log-only by default, so the raw key still works —\n * worst case is exactly pre-3.2 behavior. Memoized per raw key for the process,\n * so an entire `next build` mints ~once and every static page reuses one seed\n * (the client refreshes on the far side as needed).\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const now = Date.now()\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > now) return cached.credential\n\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  try {\n    const res = await fetch(`${base}${MINT_PATH}`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-api-key': rawKey,\n        'x-sitekit-version': SITE_KIT_VERSION,\n      },\n      cache: 'no-store',\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n          : undefined,\n    })\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: now + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n    } else if (res.status !== 404) {\n      // 404 = older API without the endpoint (expected during rollout). Anything\n      // else is worth a server-side note. Never logs the key value.\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; injecting raw key for this render.`,\n      )\n    }\n  } catch {\n    console.warn('[SiteKitLayout] Token mint unavailable; injecting raw key for this render.')\n  }\n\n  // Fallback: the raw key (pre-3.2 behavior). Short cache so a transient outage\n  // retries soon rather than pinning the raw key for the whole build.\n  cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n  return rawKey\n}\n","/**\n * @sonordev/site-kit/layout — SiteKitLayout\n *\n * The master layout component. A single RSC that auto-composes every\n * site-kit feature your layout needs:\n *\n * Server-side (RSC):\n *   - ManagedFavicon (link tags from Portal logo)\n *   - ManagedScripts position=\"head\" (tracking pixels, analytics tags)\n *   - ManagedScripts position=\"body-end\"\n *\n * Client-side (island):\n *   - AnalyticsProvider (page views, scroll depth, heatmap, web vitals)\n *   - EngageWidget (popups, nudges, chat)\n *   - SignalBridge (A/B experiments, behavior tracking)\n *   - SitemapSync (keeps Portal seo_pages in sync)\n *\n * @example\n * ```tsx\n * // app/layout.tsx\n * import { SiteKitLayout } from '@sonordev/site-kit/layout'\n *\n * export default function RootLayout({ children }) {\n *   return (\n *     <html lang=\"en\">\n *       <body>\n *         <SiteKitLayout>\n *           <Header />\n *           <main>{children}</main>\n *           <Footer />\n *         </SiteKitLayout>\n *       </body>\n *     </html>\n *   )\n * }\n * ```\n *\n * @example Opt out of specific features:\n * ```tsx\n * <SiteKitLayout engage={false} signal={false}>\n *   {children}\n * </SiteKitLayout>\n * ```\n */\n\nimport * as React from 'react'\nimport { ManagedFavicon } from '../images/ManagedFavicon'\nimport { ManagedScripts } from '../seo/ManagedScripts'\nimport { resolveApiOrigin } from '../server/server-fetch'\nimport { resolveClientCredential } from '../server/mint-site-token'\nimport { SiteKitClientProviders } from './SiteKitClientProviders'\nimport type { AnalyticsConfig, EngageConfig, SignalConfig } from './types'\n\nexport interface SiteKitLayoutProps {\n  children: React.ReactNode\n\n  /** Portal API key. Defaults to SONOR_API_KEY env var. */\n  apiKey?: string\n  /** Portal API URL. Defaults to env or https://api.sonor.io */\n  apiUrl?: string\n  /** Project ID (for Engage chat room routing). Auto-resolved if not provided. */\n  projectId?: string\n\n  /** Analytics tracking. true (default) | false | config object */\n  analytics?: boolean | AnalyticsConfig\n  /** Engage widgets (popups, chat). true (default) | false | config object */\n  engage?: boolean | EngageConfig\n  /** Signal AI (experiments, behavior). false (default) | true | config object */\n  signal?: boolean | SignalConfig\n  /** SitemapSync client component. Default: true */\n  sitemapSync?: boolean\n  /**\n   * Fleet heartbeat — reports this site's kit version + active modules to Sonor\n   * once per session so the platform can track version drift. Default: true.\n   * Deferred like Analytics; never in the hydration path.\n   */\n  fleet?: boolean\n  /**\n   * Defer client modules (Analytics, Engage, SitemapSync) until window load +\n   * idle or the first user interaction, keeping their JS and mount work out of\n   * the critical hydration path. Default: true. Pass false to restore legacy\n   * eager mounting. SignalBridge is never deferred.\n   */\n  defer?: boolean\n  /** ManagedFavicon in <head>. Default: true */\n  favicon?: boolean\n  /** ManagedScripts (head + body-end). Default: true */\n  managedScripts?: boolean\n\n  /** Debug mode — logs to console. Default: false */\n  debug?: boolean\n  /**\n   * When true, append a screen-reader-only link to `/llms.txt` after main content.\n   * Default false — prefer `buildAiDiscoveryHeaders()` for discovery.\n   */\n  showLlmsTxtFooterLink?: boolean\n}\n\nexport async function SiteKitLayout({\n  children,\n  apiKey,\n  apiUrl,\n  projectId,\n  analytics = true,\n  engage = true,\n  signal = false,\n  sitemapSync = true,\n  fleet = true,\n  defer = true,\n  favicon = true,\n  managedScripts = true,\n  debug = false,\n  showLlmsTxtFooterLink = false,\n}: SiteKitLayoutProps) {\n  // Resolve API config from env (server-side, safe)\n  const resolvedApiKey =\n    apiKey ??\n    process.env.SONOR_API_KEY ??\n    ''\n  const resolvedApiUrl =\n    apiUrl ??\n    process.env.SONOR_API_URL ??\n    'https://api.sonor.io'\n\n  if (!resolvedApiKey && debug) {\n    console.warn(\n      '[SiteKitLayout] No API key found. Set SONOR_API_KEY.',\n    )\n  }\n\n  const apiOrigin = resolveApiOrigin(resolvedApiUrl)\n\n  // Mint a short-lived client token so the raw key never reaches the browser.\n  // Falls back to the raw key if minting is unavailable (older API / transient\n  // outage) — the build never breaks. The client refreshes the token as needed.\n  const clientCredential = await resolveClientCredential(resolvedApiKey, resolvedApiUrl)\n\n  return (\n    <>\n      <link rel=\"preconnect\" href={apiOrigin} crossOrigin=\"anonymous\" />\n      <link rel=\"dns-prefetch\" href={apiOrigin} />\n      {/* Server-rendered head components */}\n      {favicon && <ManagedFavicon apiKey={resolvedApiKey} apiUrl={resolvedApiUrl} />}\n      {managedScripts && <ManagedScripts position=\"head\" />}\n\n      {/* Client-side providers island — receives the minted token (or raw-key\n          fallback), never the raw key when minting succeeds. */}\n      <SiteKitClientProviders\n        apiKey={clientCredential}\n        apiUrl={resolvedApiUrl}\n        projectId={projectId}\n        analytics={analytics}\n        engage={engage}\n        signal={signal}\n        sitemapSync={sitemapSync}\n        fleet={fleet}\n        defer={defer}\n        debug={debug}\n      >\n        {children}\n        {showLlmsTxtFooterLink ? (\n          <footer className=\"sr-only\" aria-hidden=\"true\">\n            <a href=\"/llms.txt\">llms.txt</a>\n          </footer>\n        ) : null}\n      </SiteKitClientProviders>\n\n      {/* Server-rendered body-end scripts */}\n      {managedScripts && <ManagedScripts position=\"body-end\" />}\n    </>\n  )\n}\n"]}
+{"version":3,"sources":["../../src/server/mint-site-token.ts","../../src/layout/SiteKitLayout.tsx"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAqBA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAM1B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAE1C,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,MAAA,IAAU,MAAA,CAAO,SAAA,GAAY,GAAA,SAAY,MAAA,CAAO,UAAA;AAEpD,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,GAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,MAC7C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,WAAA,EAAa,MAAA;AAAA,QACb,mBAAA,EAAqB;AAAA,OACvB;AAAA,MACA,KAAA,EAAO,UAAA;AAAA,MACP,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,KACP,CAAA;AAED,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,MAAM,IAAA,CAAK,GAAA,CAAK,YAAY,GAAA,GAAQ,CAAA,EAAG,KAAK,GAAM;AAAA,SAC9D,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AAAA,IACF,CAAA,MAAA,IAAW,GAAA,CAAI,MAAA,KAAW,GAAA,EAAK;AAG7B,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA,oCAAA;AAAA,OACnD;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAA,CAAQ,KAAK,4EAA4E,CAAA;AAAA,EAC3F;AAIA,EAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,EAAA,OAAO,MAAA;AACT;ACaA,eAAsB,aAAA,CAAc;AAAA,EAClC,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA,GAAY,IAAA;AAAA,EACZ,MAAA,GAAS,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EACT,WAAA,GAAc,IAAA;AAAA,EACd,KAAA,GAAQ,IAAA;AAAA,EACR,KAAA,GAAQ,IAAA;AAAA,EACR,OAAA,GAAU,IAAA;AAAA,EACV,cAAA,GAAiB,IAAA;AAAA,EACjB,KAAA,GAAQ,KAAA;AAAA,EACR,qBAAA,GAAwB;AAC1B,CAAA,EAAuB;AAErB,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,EAAA;AACF,EAAA,MAAM,cAAA,GACJ,MAAA,IACA,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,sBAAA;AAEF,EAAA,IAAI,CAAC,kBAAkB,KAAA,EAAO;AAC5B,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAY,iBAAiB,cAAc,CAAA;AAKjD,EAAA,MAAM,gBAAA,GAAmB,MAAM,uBAAA,CAAwB,cAAA,EAAgB,cAAc,CAAA;AAErF,EAAA,uBACE,IAAA,CAAA,QAAA,EAAA,EACE,QAAA,EAAA;AAAA,oBAAA,GAAA,CAAC,UAAK,GAAA,EAAI,YAAA,EAAa,IAAA,EAAM,SAAA,EAAW,aAAY,WAAA,EAAY,CAAA;AAAA,oBAChE,GAAA,CAAC,MAAA,EAAA,EAAK,GAAA,EAAI,cAAA,EAAe,MAAM,SAAA,EAAW,CAAA;AAAA,IAEzC,2BAAW,GAAA,CAAC,cAAA,EAAA,EAAe,MAAA,EAAQ,cAAA,EAAgB,QAAQ,cAAA,EAAgB,CAAA;AAAA,IAC3E,cAAA,oBAAkB,GAAA,CAAC,cAAA,EAAA,EAAe,QAAA,EAAS,MAAA,EAAO,CAAA;AAAA,oBAInD,IAAA;AAAA,MAAC,sBAAA;AAAA,MAAA;AAAA,QACC,MAAA,EAAQ,gBAAA;AAAA,QACR,MAAA,EAAQ,cAAA;AAAA,QACR,SAAA;AAAA,QACA,SAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,WAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QACA,KAAA;AAAA,QAEC,QAAA,EAAA;AAAA,UAAA,QAAA;AAAA,UACA,qBAAA,mBACC,GAAA,CAAC,QAAA,EAAA,EAAO,SAAA,EAAU,SAAA,EAAU,aAAA,EAAY,MAAA,EACtC,QAAA,kBAAA,GAAA,CAAC,GAAA,EAAA,EAAE,IAAA,EAAK,WAAA,EAAY,QAAA,EAAA,UAAA,EAAQ,GAC9B,CAAA,GACE;AAAA;AAAA;AAAA,KACN;AAAA,IAGC,cAAA,oBAAkB,GAAA,CAAC,cAAA,EAAA,EAAe,QAAA,EAAS,UAAA,EAAW;AAAA,GAAA,EACzD,CAAA;AAEJ","file":"index.mjs","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * Resilience: if minting is unavailable (older API without the endpoint, token\n * auth not configured, transient outage) it returns the RAW KEY, so a build never\n * breaks. Domain-binding is log-only by default, so the raw key still works —\n * worst case is exactly pre-3.2 behavior. Memoized per raw key for the process,\n * so an entire `next build` mints ~once and every static page reuses one seed\n * (the client refreshes on the far side as needed).\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const now = Date.now()\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > now) return cached.credential\n\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  try {\n    const res = await fetch(`${base}${MINT_PATH}`, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'x-api-key': rawKey,\n        'x-sitekit-version': SITE_KIT_VERSION,\n      },\n      cache: 'no-store',\n      signal:\n        typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n          ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n          : undefined,\n    })\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: now + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n    } else if (res.status !== 404) {\n      // 404 = older API without the endpoint (expected during rollout). Anything\n      // else is worth a server-side note. Never logs the key value.\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; injecting raw key for this render.`,\n      )\n    }\n  } catch {\n    console.warn('[SiteKitLayout] Token mint unavailable; injecting raw key for this render.')\n  }\n\n  // Fallback: the raw key (pre-3.2 behavior). Short cache so a transient outage\n  // retries soon rather than pinning the raw key for the whole build.\n  cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n  return rawKey\n}\n","/**\n * @sonordev/site-kit/layout — SiteKitLayout\n *\n * The master layout component. A single RSC that auto-composes every\n * site-kit feature your layout needs:\n *\n * Server-side (RSC):\n *   - ManagedFavicon (link tags from Portal logo)\n *   - ManagedScripts position=\"head\" (tracking pixels, analytics tags)\n *   - ManagedScripts position=\"body-end\"\n *\n * Client-side (island):\n *   - AnalyticsProvider (page views, scroll depth, heatmap, web vitals)\n *   - EngageWidget (popups, nudges, chat)\n *   - SignalBridge (A/B experiments, behavior tracking)\n *   - SitemapSync (keeps Portal seo_pages in sync)\n *\n * @example\n * ```tsx\n * // app/layout.tsx\n * import { SiteKitLayout } from '@sonordev/site-kit/layout'\n *\n * export default function RootLayout({ children }) {\n *   return (\n *     <html lang=\"en\">\n *       <body>\n *         <SiteKitLayout>\n *           <Header />\n *           <main>{children}</main>\n *           <Footer />\n *         </SiteKitLayout>\n *       </body>\n *     </html>\n *   )\n * }\n * ```\n *\n * @example Opt out of specific features:\n * ```tsx\n * <SiteKitLayout engage={false} signal={false}>\n *   {children}\n * </SiteKitLayout>\n * ```\n */\n\nimport * as React from 'react'\nimport { ManagedFavicon } from '../images/ManagedFavicon'\nimport { ManagedScripts } from '../seo/ManagedScripts'\nimport { resolveApiOrigin } from '../server/server-fetch'\nimport { resolveClientCredential } from '../server/mint-site-token'\nimport { SiteKitClientProviders } from './SiteKitClientProviders'\nimport type { AnalyticsConfig, EngageConfig, SignalConfig } from './types'\n\nexport interface SiteKitLayoutProps {\n  children: React.ReactNode\n\n  /** Portal API key. Defaults to SONOR_API_KEY env var. */\n  apiKey?: string\n  /** Portal API URL. Defaults to env or https://api.sonor.io */\n  apiUrl?: string\n  /** Project ID (for Engage chat room routing). Auto-resolved if not provided. */\n  projectId?: string\n\n  /** Analytics tracking. true (default) | false | config object */\n  analytics?: boolean | AnalyticsConfig\n  /** Engage widgets (popups, chat). true (default) | false | config object */\n  engage?: boolean | EngageConfig\n  /** Signal AI (experiments, behavior). false (default) | true | config object */\n  signal?: boolean | SignalConfig\n  /** SitemapSync client component. Default: true */\n  sitemapSync?: boolean\n  /**\n   * Fleet heartbeat — reports this site's kit version + active modules to Sonor\n   * once per session so the platform can track version drift. Default: true.\n   * Deferred like Analytics; never in the hydration path.\n   */\n  fleet?: boolean\n  /**\n   * Defer client modules (Analytics, Engage, SitemapSync) until window load +\n   * idle or the first user interaction, keeping their JS and mount work out of\n   * the critical hydration path. Default: true. Pass false to restore legacy\n   * eager mounting. SignalBridge is never deferred.\n   */\n  defer?: boolean\n  /** ManagedFavicon in <head>. Default: true */\n  favicon?: boolean\n  /** ManagedScripts (head + body-end). Default: true */\n  managedScripts?: boolean\n\n  /** Debug mode — logs to console. Default: false */\n  debug?: boolean\n  /**\n   * When true, append a screen-reader-only link to `/llms.txt` after main content.\n   * Default false — prefer `buildAiDiscoveryHeaders()` for discovery.\n   */\n  showLlmsTxtFooterLink?: boolean\n}\n\nexport async function SiteKitLayout({\n  children,\n  apiKey,\n  apiUrl,\n  projectId,\n  analytics = true,\n  engage = true,\n  signal = false,\n  sitemapSync = true,\n  fleet = true,\n  defer = true,\n  favicon = true,\n  managedScripts = true,\n  debug = false,\n  showLlmsTxtFooterLink = false,\n}: SiteKitLayoutProps) {\n  // Resolve API config from env (server-side, safe)\n  const resolvedApiKey =\n    apiKey ??\n    process.env.SONOR_API_KEY ??\n    ''\n  const resolvedApiUrl =\n    apiUrl ??\n    process.env.SONOR_API_URL ??\n    'https://api.sonor.io'\n\n  if (!resolvedApiKey && debug) {\n    console.warn(\n      '[SiteKitLayout] No API key found. Set SONOR_API_KEY.',\n    )\n  }\n\n  const apiOrigin = resolveApiOrigin(resolvedApiUrl)\n\n  // Mint a short-lived client token so the raw key never reaches the browser.\n  // Falls back to the raw key if minting is unavailable (older API / transient\n  // outage) — the build never breaks. The client refreshes the token as needed.\n  const clientCredential = await resolveClientCredential(resolvedApiKey, resolvedApiUrl)\n\n  return (\n    <>\n      <link rel=\"preconnect\" href={apiOrigin} crossOrigin=\"anonymous\" />\n      <link rel=\"dns-prefetch\" href={apiOrigin} />\n      {/* Server-rendered head components */}\n      {favicon && <ManagedFavicon apiKey={resolvedApiKey} apiUrl={resolvedApiUrl} />}\n      {managedScripts && <ManagedScripts position=\"head\" />}\n\n      {/* Client-side providers island — receives the minted token (or raw-key\n          fallback), never the raw key when minting succeeds. */}\n      <SiteKitClientProviders\n        apiKey={clientCredential}\n        apiUrl={resolvedApiUrl}\n        projectId={projectId}\n        analytics={analytics}\n        engage={engage}\n        signal={signal}\n        sitemapSync={sitemapSync}\n        fleet={fleet}\n        defer={defer}\n        debug={debug}\n      >\n        {children}\n        {showLlmsTxtFooterLink ? (\n          <footer className=\"sr-only\" aria-hidden=\"true\">\n            <a href=\"/llms.txt\">llms.txt</a>\n          </footer>\n        ) : null}\n      </SiteKitClientProviders>\n\n      {/* Server-rendered body-end scripts */}\n      {managedScripts && <ManagedScripts position=\"body-end\" />}\n    </>\n  )\n}\n"]}

package/dist/maps/index.js

@@ -1,8 +1,8 @@
 'use client';
 'use strict';
 
-var chunkM2EGCGIT_js = require('../chunk-M2EGCGIT.js');
-require('../chunk-EOENN46G.js');
+var chunkXKV73RDH_js = require('../chunk-XKV73RDH.js');
+require('../chunk-CDETOO5W.js');
 require('../chunk-ZSMWDLMK.js');
 var react = require('react');
 var reactGoogleMaps = require('@vis.gl/react-google-maps');
@@ -139,7 +139,7 @@ async function fetchMapsConfig() {
   const { apiUrl, apiKey } = getApiConfig();
   if (apiKey) {
     try {
-      const res = await chunkM2EGCGIT_js.sonorFetch(
+      const res = await chunkXKV73RDH_js.sonorFetch(
         `${apiUrl}/api/public/maps/config`,
         { headers: { "Content-Type": "application/json" } },
         { apiKey }
@@ -179,7 +179,7 @@ async function fetchNearbyPlaces(params) {
     });
     if (params.radius) searchParams.set("radius", String(params.radius));
     if (params.limit) searchParams.set("limit", String(params.limit));
-    const res = await chunkM2EGCGIT_js.sonorFetch(
+    const res = await chunkXKV73RDH_js.sonorFetch(
       `${apiUrl}/api/public/maps/nearby-places?${searchParams}`,
       { headers: { "Content-Type": "application/json" } },
       { apiKey }

package/dist/maps/index.mjs

@@ -1,6 +1,6 @@
 'use client';
-import { sonorFetch } from '../chunk-FO6Y27AH.mjs';
-import '../chunk-S4FJIG6Y.mjs';
+import { sonorFetch } from '../chunk-WS4GNH3F.mjs';
+import '../chunk-YCQHE2XT.mjs';
 import '../chunk-4XPGGLVP.mjs';
 import { useState, useCallback, useEffect } from 'react';
 import { APIProvider, Map as Map$1, AdvancedMarker, Pin, InfoWindow } from '@vis.gl/react-google-maps';

package/dist/metadata-D_GiY8LJ.d.mts

@@ -0,0 +1,36 @@
+import * as react_jsx_runtime from 'react/jsx-runtime';
+import { ReactNode } from 'react';
+import { Metadata } from 'next';
+
+interface LandingPageProps {
+    /** Campaign identity (e.g. "spring-hvac-2026"). Normalized to a slug; one campaign can back several landing page variants. */
+    campaign: string;
+    children?: ReactNode;
+    /**
+     * Render the hoisted robots meta tag (default true). Turn off only if the
+     * route manages robots itself — landingPageMetadata() remains required
+     * either way for reliable noindex.
+     */
+    robotsMeta?: boolean;
+}
+declare function LandingPage({ campaign, children, robotsMeta }: LandingPageProps): react_jsx_runtime.JSX.Element;
+
+/**
+ * Metadata for a paid-ad landing page: noindex, nofollow by default.
+ *
+ * This is the RELIABLE noindex mechanism — export it from the landing
+ * route so the robots directives render in <head> at SSR:
+ *
+ *   export const metadata = landingPageMetadata({
+ *     title: 'Spring HVAC Tune-Up | Acme Heating',
+ *     description: 'Book your $99 spring tune-up.',
+ *   })
+ *
+ * The <LandingPage> wrapper also hoists a robots meta tag as belt-and-braces,
+ * but body-rendered meta is not honored by all crawlers — always use this
+ * helper too. Pass an explicit `robots` object to override the default
+ * (e.g. a landing page you deliberately want indexed).
+ */
+declare function landingPageMetadata(meta?: Metadata): Metadata;
+
+export { LandingPage as L, type LandingPageProps as a, landingPageMetadata as l };

package/dist/metadata-D_GiY8LJ.d.ts

@@ -0,0 +1,36 @@
+import * as react_jsx_runtime from 'react/jsx-runtime';
+import { ReactNode } from 'react';
+import { Metadata } from 'next';
+
+interface LandingPageProps {
+    /** Campaign identity (e.g. "spring-hvac-2026"). Normalized to a slug; one campaign can back several landing page variants. */
+    campaign: string;
+    children?: ReactNode;
+    /**
+     * Render the hoisted robots meta tag (default true). Turn off only if the
+     * route manages robots itself — landingPageMetadata() remains required
+     * either way for reliable noindex.
+     */
+    robotsMeta?: boolean;
+}
+declare function LandingPage({ campaign, children, robotsMeta }: LandingPageProps): react_jsx_runtime.JSX.Element;
+
+/**
+ * Metadata for a paid-ad landing page: noindex, nofollow by default.
+ *
+ * This is the RELIABLE noindex mechanism — export it from the landing
+ * route so the robots directives render in <head> at SSR:
+ *
+ *   export const metadata = landingPageMetadata({
+ *     title: 'Spring HVAC Tune-Up | Acme Heating',
+ *     description: 'Book your $99 spring tune-up.',
+ *   })
+ *
+ * The <LandingPage> wrapper also hoists a robots meta tag as belt-and-braces,
+ * but body-rendered meta is not honored by all crawlers — always use this
+ * helper too. Pass an explicit `robots` object to override the default
+ * (e.g. a landing page you deliberately want indexed).
+ */
+declare function landingPageMetadata(meta?: Metadata): Metadata;
+
+export { LandingPage as L, type LandingPageProps as a, landingPageMetadata as l };

package/dist/middleware/index.js

@@ -4,6 +4,7 @@ var chunk3MYZS6PD_js = require('../chunk-3MYZS6PD.js');
 var chunk5B4FABFK_js = require('../chunk-5B4FABFK.js');
 var chunkW6K7MQCC_js = require('../chunk-W6K7MQCC.js');
 require('../chunk-JP5WGL75.js');
+var chunkVJMPIRSD_js = require('../chunk-VJMPIRSD.js');
 require('../chunk-ZSMWDLMK.js');
 var server = require('next/server');
 
@@ -117,7 +118,7 @@ function createMiddleware(config) {
       const hadVisitorCookie = !!request.cookies.get("_sk_vid")?.value;
       if (!hadVisitorCookie) {
         const maxAgeDays = idCfg.cookieMaxAgeDays ?? 730;
-        response.cookies.set("_sk_vid", generateVisitorId(), {
+        response.cookies.set("_sk_vid", chunkVJMPIRSD_js.uuid(), {
           maxAge: maxAgeDays * 24 * 60 * 60,
           path: "/",
           sameSite: "lax",
@@ -143,13 +144,6 @@ function createMiddleware(config) {
     return response;
   };
 }
-function generateVisitorId() {
-  if (typeof crypto !== "undefined" && crypto.randomUUID) return crypto.randomUUID();
-  return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (c) => {
-    const r = Math.random() * 16 | 0;
-    return (c === "x" ? r : r & 3 | 8).toString(16);
-  });
-}
 function applyHeaders(response, headers) {
   for (const [key, value] of Object.entries(headers)) {
     response.headers.set(key, value);

package/dist/middleware/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/middleware/segment.ts","../../src/middleware/index.ts"],"names":["buildSecurityHeaders","buildAiDiscoveryHeaders","handleManagedRedirects","NextResponse"],"mappings":";;;;;;;;;;AAyBA,IAAM,YAAA,GAAe,CAAC,KAAA,EAAO,KAAA,EAAO,QAAQ,YAAA,EAAc,aAAA,EAAe,SAAA,EAAW,KAAA,EAAO,QAAQ,CAAA;AACnG,IAAM,cAAA,GAAiB,CAAC,QAAA,EAAU,cAAA,EAAgB,gBAAgB,IAAI,CAAA;AACtE,IAAM,YAAA,GAAe;AAAA,EACnB,WAAA;AAAA,EACA,YAAA;AAAA,EACA,WAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;AACA,IAAM,YAAA,GAAe,CAAC,SAAA,EAAW,OAAA,EAAS,eAAe,QAAA,EAAU,SAAA,EAAW,QAAA,EAAU,QAAA,EAAU,SAAS,CAAA;AAMpG,SAAS,qBAAA,CACd,SACA,IAAA,EACgB;AAChB,EAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,YAAA;AAC/B,EAAA,MAAM,MAAA,GAAA,CAAU,OAAO,GAAA,CAAI,YAAY,KAAK,EAAA,EAAI,WAAA,GAAc,IAAA,EAAK;AACnE,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,cAAc,CAAA;AAE1C,EAAA,IAAI,MAAA,GAAwB,QAAA;AAE5B,EAAA,IAAI,YAAA,CAAa,QAAA,CAAS,MAAM,CAAA,EAAG;AACjC,IAAA,MAAA,GAAS,MAAA;AAAA,EACX,CAAA,MAAA,IAAW,cAAA,CAAe,QAAA,CAAS,MAAM,CAAA,EAAG;AAC1C,IAAA,MAAA,GAAS,QAAA;AAAA,EACX,CAAA,MAAA,IAAW,WAAW,SAAA,EAAW;AAC/B,IAAA,MAAA,GAAS,SAAA;AAAA,EACX,CAAA,MAAA,IAAW,WAAW,UAAA,EAAY;AAChC,IAAA,MAAA,GAAS,UAAA;AAAA,EACX,CAAA,MAAA,IAAW,MAAA,CAAO,GAAA,CAAI,YAAY,CAAA,IAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,IAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG;AAElF,IAAA,IAAI,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,EAAG,MAAA,GAAS,MAAA;AAAA,SAAA,IACzB,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG,MAAA,GAAS,QAAA;AAAA,SACnC,MAAA,GAAS,UAAA;AAAA,EAChB,CAAA,MAAO;AAEL,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,IAAK,EAAA;AAC9C,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,KAAK,WAAA,EAAY;AAC3C,QAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,WAAA,EAAY;AAClD,QAAA,IAAI,IAAA,IAAQ,SAAS,QAAA,EAAU;AAC7B,UAAA,IAAI,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,MAAA,GAAS,SAAA;AAAA,eAAA,IAChD,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,MAAA,GAAS,QAAA;AAAA,eACzD,MAAA,GAAS,UAAA;AAAA,QAChB;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,IAAA,CAAK,gBAAA,GAAmB,WAAA,GAAc,KAAA;AAAA,IACnD,MAAA;AAAA,IACA,UAAU,QAAA,IAAY;AAAA,GACxB;AACF;AAOO,SAAS,cAAc,GAAA,EAA6B;AACzD,EAAA,MAAM,QAAA,GAAA,CAAY,GAAA,CAAI,QAAA,IAAY,EAAA,EAAI,OAAA,CAAQ,mBAAmB,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAChF,EAAA,OAAO,GAAG,GAAA,CAAI,WAAW,IAAI,GAAA,CAAI,MAAM,IAAI,QAAQ,CAAA,CAAA;AACrD;AAGO,SAAS,cAAc,KAAA,EAAyD;AACrF,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,CAAC,WAAA,EAAa,MAAA,EAAQ,QAAQ,CAAA,GAAI,KAAA,CAAM,MAAM,GAAG,CAAA;AACvD,EAAA,IAAI,WAAA,KAAgB,KAAA,IAAS,WAAA,KAAgB,WAAA,EAAa,OAAO,IAAA;AACjE,EAAA,OAAO;AAAA,IACL,WAAA;AAAA,IACA,MAAA,EAAS,CAAC,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,UAAA,EAAY,QAAQ,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,GAAI,MAAA,GAAS,QAAA;AAAA,IACzF,UAAU,QAAA,IAAY;AAAA,GACxB;AACF;;;ACAO,SAAS,iBAAiB,MAAA,EAAkC;AACjE,EAAA,MAAM,eAAA,GAAkBA,qCAAA;AAAA,IACtB,MAAA,EAAQ;AAAA,GACV;AAGA,EAAA,MAAM,gBAAA,GACJ,MAAA,EAAQ,aAAA,GACJC,wCAAA,CAAwB;AAAA,IACtB,OAAA,EAAS,OAAO,aAAA,CAAc,OAAA;AAAA,IAC9B,QAAA,EAAU,OAAO,aAAA,CAAc;AAAA,GAChC,IACD,EAAC;AAEP,EAAA,OAAO,eAAe,MACpB,OAAA,EACuB;AAEvB,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,MAAM,aAAA,GAAgB,MAAM,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA;AACjD,MAAA,IAAI,aAAA,EAAe;AAEjB,QAAA,YAAA,CAAa,eAAe,eAAe,CAAA;AAC3C,QAAA,OAAO,aAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,MAAA,EAAQ,cAAc,KAAA,EAAO;AAC/B,MAAA,MAAM,iBACJ,OAAO,MAAA,EAAQ,cAAc,QAAA,GACzB,MAAA,CAAO,YACP,EAAC;AAEP,MAAA,MAAM,WAAW,MAAMC,uCAAA;AAAA,QACrB,OAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,QAAA,EAAU;AAEZ,QAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AACtC,QAAA,OAAO,QAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,QAAA,GAAWC,oBAAa,IAAA,EAAK;AAGjC,IAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AAGtC,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,gBAAgB,CAAA,CAAE,SAAS,CAAA,EAAG;AAC5C,MAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA,IAAK,EAAA;AAChD,MAAA,IAAI,OAAO,QAAA,CAAS,WAAW,KAAK,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AAC1D,QAAA,YAAA,CAAa,UAAU,gBAAgB,CAAA;AAAA,MACzC;AAAA,IACF;AAKA,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,MAAM,QACJ,OAAO,MAAA,CAAO,aAAa,QAAA,GAAW,MAAA,CAAO,WAAW,EAAC;AAC3D,MAAA,MAAM,mBAAmB,CAAC,CAAC,QAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,EAAG,KAAA;AAC3D,MAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,QAAA,MAAM,UAAA,GAAa,MAAM,gBAAA,IAAoB,GAAA;AAC7C,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,SAAA,EAAW,iBAAA,EAAkB,EAAG;AAAA,UACnD,MAAA,EAAQ,UAAA,GAAa,EAAA,GAAK,EAAA,GAAK,EAAA;AAAA,UAC/B,IAAA,EAAM,GAAA;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AACA,MAAA,IAAI,KAAA,CAAM,YAAY,KAAA,EAAO;AAC3B,QAAA,MAAM,OAAA,GAAU,aAAA;AAAA,UACd,qBAAA,CAAsB,OAAA,EAAS,EAAE,gBAAA,EAAkB;AAAA,SACrD;AACA,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,SAAA,EAAW,OAAA,EAAS;AAAA;AAAA,UAEvC,QAAQ,EAAA,GAAK,EAAA;AAAA,UACb,IAAA,EAAM,GAAA;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AAAA,IACF;AAGA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,QAAA,GAAW,MAAM,MAAA,CAAO,KAAA,CAAM,OAAA,EAAS,QAAQ,CAAA;AAAA,IACjD;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AAMA,SAAS,iBAAA,GAA4B;AACnC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,OAAO,UAAA,EAAY,OAAO,OAAO,UAAA,EAAW;AACjF,EAAA,OAAO,sCAAA,CAAuC,OAAA,CAAQ,OAAA,EAAS,CAAC,CAAA,KAAM;AACpE,IAAA,MAAM,CAAA,GAAK,IAAA,CAAK,MAAA,EAAO,GAAI,EAAA,GAAM,CAAA;AACjC,IAAA,OAAA,CAAQ,MAAM,GAAA,GAAM,CAAA,GAAK,IAAI,CAAA,GAAO,CAAA,EAAK,SAAS,EAAE,CAAA;AAAA,EACtD,CAAC,CAAA;AACH;AAEA,SAAS,YAAA,CACP,UACA,OAAA,EACM;AACN,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,IAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,EACjC;AACF;AAMO,IAAM,cAAA,GAAiB;AAAA,EAC5B,OAAA,EAAS;AAAA,IACP;AAAA;AAEJ;AAGO,IAAM,WAAA,GAAc","file":"index.js","sourcesContent":["/**\n * @sonordev/site-kit/middleware — visitor segment resolution (the \"one edge pass\").\n *\n * Pure, edge-runtime-safe helpers that classify a request into a coarse visitor\n * segment (new-vs-returning + marketing source + campaign) from the URL's UTM\n * params and the referrer. The middleware writes the result to the `_sk_seg`\n * cookie so server-rendered slots / personalization can vary by segment WITHOUT\n * each one re-parsing the request. Resolved once, at the edge.\n *\n * Kept side-effect-free (no NextResponse, no cookie writes) so it is trivially\n * unit-testable and reusable.\n */\nimport type { NextRequest } from 'next/server'\n\nexport type SegmentSource = 'paid' | 'organic' | 'social' | 'referral' | 'direct'\n\nexport interface VisitorSegment {\n  /** `new` on the first visit (no prior `_sk_vid` cookie), else `returning`. */\n  visitorType: 'new' | 'returning'\n  /** Marketing source bucket derived from UTM medium/source, then referrer. */\n  source: SegmentSource\n  /** `utm_campaign`, if present (sanitized when encoded). */\n  campaign: string | null\n}\n\nconst PAID_MEDIUMS = ['cpc', 'ppc', 'paid', 'paidsearch', 'paid-search', 'display', 'cpm', 'banner']\nconst SOCIAL_MEDIUMS = ['social', 'social-media', 'social_media', 'sm']\nconst SOCIAL_HOSTS = [\n  'facebook.',\n  'instagram.',\n  'linkedin.',\n  't.co',\n  'twitter.',\n  'x.com',\n  'pinterest.',\n  'tiktok.',\n  'youtube.',\n  'reddit.',\n]\nconst SEARCH_HOSTS = ['google.', 'bing.', 'duckduckgo.', 'yahoo.', 'ecosia.', 'brave.', 'baidu.', 'yandex.']\n\n/**\n * Classify `request` into a {@link VisitorSegment}. UTM params win over the\n * referrer; a same-host referrer is ignored (internal navigation, not a source).\n */\nexport function resolveVisitorSegment(\n  request: NextRequest,\n  opts: { hadVisitorCookie: boolean },\n): VisitorSegment {\n  const params = request.nextUrl.searchParams\n  const medium = (params.get('utm_medium') || '').toLowerCase().trim()\n  const campaign = params.get('utm_campaign')\n\n  let source: SegmentSource = 'direct'\n\n  if (PAID_MEDIUMS.includes(medium)) {\n    source = 'paid'\n  } else if (SOCIAL_MEDIUMS.includes(medium)) {\n    source = 'social'\n  } else if (medium === 'organic') {\n    source = 'organic'\n  } else if (medium === 'referral') {\n    source = 'referral'\n  } else if (params.get('utm_source') || params.get('gclid') || params.get('fbclid')) {\n    // A tagged link with a non-standard medium: gclid => paid Google, fbclid => social.\n    if (params.get('gclid')) source = 'paid'\n    else if (params.get('fbclid')) source = 'social'\n    else source = 'referral'\n  } else {\n    // No campaign tagging — fall back to the referrer host.\n    const ref = request.headers.get('referer') || ''\n    if (ref) {\n      try {\n        const host = new URL(ref).host.toLowerCase()\n        const selfHost = request.nextUrl.host.toLowerCase()\n        if (host && host !== selfHost) {\n          if (SEARCH_HOSTS.some((h) => host.includes(h))) source = 'organic'\n          else if (SOCIAL_HOSTS.some((h) => host.includes(h))) source = 'social'\n          else source = 'referral'\n        }\n      } catch {\n        /* malformed referer — stays 'direct' */\n      }\n    }\n  }\n\n  return {\n    visitorType: opts.hadVisitorCookie ? 'returning' : 'new',\n    source,\n    campaign: campaign || null,\n  }\n}\n\n/**\n * Compact, cookie-safe encoding: `\"<visitorType>|<source>|<campaign>\"`, e.g.\n * `\"new|paid|spring_sale\"`. Campaign is sanitized to `[A-Za-z0-9_-]` and capped.\n * Decode with {@link decodeSegment}.\n */\nexport function encodeSegment(seg: VisitorSegment): string {\n  const campaign = (seg.campaign || '').replace(/[^a-zA-Z0-9_-]/g, '').slice(0, 40)\n  return `${seg.visitorType}|${seg.source}|${campaign}`\n}\n\n/** Parse a `_sk_seg` cookie value produced by {@link encodeSegment}. */\nexport function decodeSegment(value: string | undefined | null): VisitorSegment | null {\n  if (!value) return null\n  const [visitorType, source, campaign] = value.split('|')\n  if (visitorType !== 'new' && visitorType !== 'returning') return null\n  return {\n    visitorType,\n    source: (['paid', 'organic', 'social', 'referral', 'direct'].includes(source) ? source : 'direct') as SegmentSource,\n    campaign: campaign || null,\n  }\n}\n","/**\n * @sonordev/site-kit/middleware\n *\n * Composable Next.js middleware factory. Handles:\n * - Portal-managed redirects (via existing handleManagedRedirects)\n * - Security headers (X-Frame-Options, CSP, etc.)\n * - Optional before/after hooks for custom logic\n *\n * @example\n * ```ts\n * // middleware.ts — entire file\n * import { createMiddleware, siteKitMatcher } from '@sonordev/site-kit/middleware'\n *\n * export default createMiddleware()\n * export const config = siteKitMatcher\n * ```\n *\n * @example With custom hooks:\n * ```ts\n * export default createMiddleware({\n *   securityHeaders: { frameOptions: 'SAMEORIGIN' },\n *   before: (req) => {\n *     // Custom auth check, etc.\n *   },\n * })\n * ```\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport {\n  handleManagedRedirects,\n  type RedirectConfig,\n} from '../redirects'\nimport {\n  buildSecurityHeaders,\n  type SecurityHeadersConfig,\n} from './securityHeaders'\nimport { buildAiDiscoveryHeaders } from '../llms/discovery-headers'\nimport { resolveVisitorSegment, encodeSegment } from './segment'\n\nexport type { SecurityHeadersConfig } from './securityHeaders'\nexport {\n  resolveVisitorSegment,\n  encodeSegment,\n  decodeSegment,\n  type VisitorSegment,\n  type SegmentSource,\n} from './segment'\n\nexport interface IdentityConfig {\n  /**\n   * Also resolve + persist a coarse visitor segment (new-vs-returning + source\n   * + campaign) into the `_sk_seg` cookie, for segment-aware slots /\n   * personalization. Default: true (when identity is enabled).\n   */\n  segment?: boolean\n  /** Days the `_sk_vid` visitor cookie persists. Default: 730 (~2 years). */\n  cookieMaxAgeDays?: number\n}\n\nexport interface LlmsDiscoveryConfig {\n  /** Canonical site origin, e.g. `https://example.com` */\n  siteUrl: string\n  /** Path to llms.txt (default `/llms.txt`) */\n  llmsPath?: string\n}\n\nexport interface SiteKitMiddlewareConfig {\n  /** Enable Portal-managed redirects. Default: true */\n  redirects?: boolean | RedirectConfig\n  /** Enable security headers. Default: true */\n  securityHeaders?: boolean | SecurityHeadersConfig\n  /**\n   * Opt-in: inject `Link: <...>; rel=\"describedby\"` header on HTML responses\n   * pointing to /llms.txt for AI crawler discovery (RFC 8288).\n   * Preferred over visible footer links.\n   */\n  llmsDiscovery?: LlmsDiscoveryConfig | false\n  /**\n   * Opt-in EDGE IDENTITY pass. When enabled, the middleware ensures a\n   * first-party `_sk_vid` visitor cookie exists (server-authoritative id) and\n   * resolves the visitor segment into `_sk_seg`, so server-rendered slots and\n   * personalization can read identity + segment without re-parsing the request.\n   * Purely additive — it only writes cookies, never changes the rendered HTML,\n   * so it is LCP/static-safe. Default: OFF (sites opt in for 3.0 personalization).\n   *\n   * NOTE: to make these the SAME id the client uses, the shared identity helper\n   * must read `_sk_vid` cookie-first (a follow-on change validated with a live\n   * preview); until then the cookie is the server-side mirror.\n   */\n  identity?: boolean | IdentityConfig\n  /**\n   * Hook that runs BEFORE redirect check.\n   * Return a NextResponse to short-circuit, or undefined to continue.\n   */\n  before?: (\n    request: NextRequest,\n  ) => NextResponse | undefined | Promise<NextResponse | undefined>\n  /**\n   * Hook that runs AFTER all processing.\n   * Receives the response that will be sent — mutate headers, etc.\n   */\n  after?: (\n    request: NextRequest,\n    response: NextResponse,\n  ) => NextResponse | Promise<NextResponse>\n}\n\n/**\n * Create a fully-featured Next.js middleware function.\n *\n * With zero config this handles redirects + security headers automatically.\n */\nexport function createMiddleware(config?: SiteKitMiddlewareConfig) {\n  const securityHeaders = buildSecurityHeaders(\n    config?.securityHeaders,\n  )\n\n  // Pre-compute discovery headers (static per middleware instance)\n  const discoveryHeaders: Record<string, string> =\n    config?.llmsDiscovery\n      ? buildAiDiscoveryHeaders({\n          siteUrl: config.llmsDiscovery.siteUrl,\n          llmsPath: config.llmsDiscovery.llmsPath,\n        })\n      : {}\n\n  return async function proxy(\n    request: NextRequest,\n  ): Promise<NextResponse> {\n    // 1. Run user's 'before' hook\n    if (config?.before) {\n      const earlyResponse = await config.before(request)\n      if (earlyResponse) {\n        // Apply security headers even to early responses\n        applyHeaders(earlyResponse, securityHeaders)\n        return earlyResponse\n      }\n    }\n\n    // 2. Check Portal-managed redirects (unless disabled)\n    if (config?.redirects !== false) {\n      const redirectConfig: RedirectConfig =\n        typeof config?.redirects === 'object'\n          ? config.redirects\n          : {}\n\n      const redirect = await handleManagedRedirects(\n        request,\n        redirectConfig,\n      )\n      if (redirect) {\n        // Redirects get security headers too\n        applyHeaders(redirect, securityHeaders)\n        return redirect\n      }\n    }\n\n    // 3. Build the pass-through response\n    let response = NextResponse.next()\n\n    // 4. Apply security headers\n    applyHeaders(response, securityHeaders)\n\n    // 5. Apply AI discovery Link header (only on HTML-like requests, not static assets)\n    if (Object.keys(discoveryHeaders).length > 0) {\n      const accept = request.headers.get('accept') || ''\n      if (accept.includes('text/html') || accept.includes('*/*')) {\n        applyHeaders(response, discoveryHeaders)\n      }\n    }\n\n    // 5b. Edge identity pass (opt-in). Ensure a first-party `_sk_vid` visitor\n    // cookie exists and resolve the visitor segment into `_sk_seg`. Additive:\n    // only writes cookies, never changes the rendered HTML (LCP/static-safe).\n    if (config?.identity) {\n      const idCfg: IdentityConfig =\n        typeof config.identity === 'object' ? config.identity : {}\n      const hadVisitorCookie = !!request.cookies.get('_sk_vid')?.value\n      if (!hadVisitorCookie) {\n        const maxAgeDays = idCfg.cookieMaxAgeDays ?? 730\n        response.cookies.set('_sk_vid', generateVisitorId(), {\n          maxAge: maxAgeDays * 24 * 60 * 60,\n          path: '/',\n          sameSite: 'lax',\n          secure: true,\n        })\n      }\n      if (idCfg.segment !== false) {\n        const segment = encodeSegment(\n          resolveVisitorSegment(request, { hadVisitorCookie }),\n        )\n        response.cookies.set('_sk_seg', segment, {\n          // Session-ish: a fresh campaign / source on a later visit re-segments.\n          maxAge: 30 * 60,\n          path: '/',\n          sameSite: 'lax',\n          secure: true,\n        })\n      }\n    }\n\n    // 6. Run user's 'after' hook\n    if (config?.after) {\n      response = await config.after(request, response)\n    }\n\n    return response\n  }\n}\n\n/**\n * Generate a visitor id at the edge. Prefers Web Crypto (available in the\n * Next.js edge runtime); falls back to a v4-shaped string elsewhere.\n */\nfunction generateVisitorId(): string {\n  if (typeof crypto !== 'undefined' && crypto.randomUUID) return crypto.randomUUID()\n  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {\n    const r = (Math.random() * 16) | 0\n    return (c === 'x' ? r : (r & 0x3) | 0x8).toString(16)\n  })\n}\n\nfunction applyHeaders(\n  response: NextResponse,\n  headers: Record<string, string>,\n): void {\n  for (const [key, value] of Object.entries(headers)) {\n    response.headers.set(key, value)\n  }\n}\n\n/**\n * Standard matcher config that excludes static assets and images.\n * Export alongside createProxy/createMiddleware in your proxy.ts.\n */\nexport const siteKitMatcher = {\n  matcher: [\n    '/((?!_next/static|_next/image|favicon\\\\.ico|.*\\\\.(?:ico|png|jpg|jpeg|gif|webp|svg|woff2?)$).*)',\n  ],\n}\n\n/** Next.js 16+ alias — same as createMiddleware, named for the proxy convention. */\nexport const createProxy = createMiddleware\n"]}
+{"version":3,"sources":["../../src/middleware/segment.ts","../../src/middleware/index.ts"],"names":["buildSecurityHeaders","buildAiDiscoveryHeaders","handleManagedRedirects","NextResponse","uuid"],"mappings":";;;;;;;;;;;AAyBA,IAAM,YAAA,GAAe,CAAC,KAAA,EAAO,KAAA,EAAO,QAAQ,YAAA,EAAc,aAAA,EAAe,SAAA,EAAW,KAAA,EAAO,QAAQ,CAAA;AACnG,IAAM,cAAA,GAAiB,CAAC,QAAA,EAAU,cAAA,EAAgB,gBAAgB,IAAI,CAAA;AACtE,IAAM,YAAA,GAAe;AAAA,EACnB,WAAA;AAAA,EACA,YAAA;AAAA,EACA,WAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;AACA,IAAM,YAAA,GAAe,CAAC,SAAA,EAAW,OAAA,EAAS,eAAe,QAAA,EAAU,SAAA,EAAW,QAAA,EAAU,QAAA,EAAU,SAAS,CAAA;AAMpG,SAAS,qBAAA,CACd,SACA,IAAA,EACgB;AAChB,EAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,YAAA;AAC/B,EAAA,MAAM,MAAA,GAAA,CAAU,OAAO,GAAA,CAAI,YAAY,KAAK,EAAA,EAAI,WAAA,GAAc,IAAA,EAAK;AACnE,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,cAAc,CAAA;AAE1C,EAAA,IAAI,MAAA,GAAwB,QAAA;AAE5B,EAAA,IAAI,YAAA,CAAa,QAAA,CAAS,MAAM,CAAA,EAAG;AACjC,IAAA,MAAA,GAAS,MAAA;AAAA,EACX,CAAA,MAAA,IAAW,cAAA,CAAe,QAAA,CAAS,MAAM,CAAA,EAAG;AAC1C,IAAA,MAAA,GAAS,QAAA;AAAA,EACX,CAAA,MAAA,IAAW,WAAW,SAAA,EAAW;AAC/B,IAAA,MAAA,GAAS,SAAA;AAAA,EACX,CAAA,MAAA,IAAW,WAAW,UAAA,EAAY;AAChC,IAAA,MAAA,GAAS,UAAA;AAAA,EACX,CAAA,MAAA,IAAW,MAAA,CAAO,GAAA,CAAI,YAAY,CAAA,IAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,IAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG;AAElF,IAAA,IAAI,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,EAAG,MAAA,GAAS,MAAA;AAAA,SAAA,IACzB,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG,MAAA,GAAS,QAAA;AAAA,SACnC,MAAA,GAAS,UAAA;AAAA,EAChB,CAAA,MAAO;AAEL,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,IAAK,EAAA;AAC9C,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,KAAK,WAAA,EAAY;AAC3C,QAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,WAAA,EAAY;AAClD,QAAA,IAAI,IAAA,IAAQ,SAAS,QAAA,EAAU;AAC7B,UAAA,IAAI,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,MAAA,GAAS,SAAA;AAAA,eAAA,IAChD,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,MAAA,GAAS,QAAA;AAAA,eACzD,MAAA,GAAS,UAAA;AAAA,QAChB;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,IAAA,CAAK,gBAAA,GAAmB,WAAA,GAAc,KAAA;AAAA,IACnD,MAAA;AAAA,IACA,UAAU,QAAA,IAAY;AAAA,GACxB;AACF;AAOO,SAAS,cAAc,GAAA,EAA6B;AACzD,EAAA,MAAM,QAAA,GAAA,CAAY,GAAA,CAAI,QAAA,IAAY,EAAA,EAAI,OAAA,CAAQ,mBAAmB,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAChF,EAAA,OAAO,GAAG,GAAA,CAAI,WAAW,IAAI,GAAA,CAAI,MAAM,IAAI,QAAQ,CAAA,CAAA;AACrD;AAGO,SAAS,cAAc,KAAA,EAAyD;AACrF,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,CAAC,WAAA,EAAa,MAAA,EAAQ,QAAQ,CAAA,GAAI,KAAA,CAAM,MAAM,GAAG,CAAA;AACvD,EAAA,IAAI,WAAA,KAAgB,KAAA,IAAS,WAAA,KAAgB,WAAA,EAAa,OAAO,IAAA;AACjE,EAAA,OAAO;AAAA,IACL,WAAA;AAAA,IACA,MAAA,EAAS,CAAC,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,UAAA,EAAY,QAAQ,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,GAAI,MAAA,GAAS,QAAA;AAAA,IACzF,UAAU,QAAA,IAAY;AAAA,GACxB;AACF;;;ACGO,SAAS,iBAAiB,MAAA,EAAkC;AACjE,EAAA,MAAM,eAAA,GAAkBA,qCAAA;AAAA,IACtB,MAAA,EAAQ;AAAA,GACV;AAGA,EAAA,MAAM,gBAAA,GACJ,MAAA,EAAQ,aAAA,GACJC,wCAAA,CAAwB;AAAA,IACtB,OAAA,EAAS,OAAO,aAAA,CAAc,OAAA;AAAA,IAC9B,QAAA,EAAU,OAAO,aAAA,CAAc;AAAA,GAChC,IACD,EAAC;AAEP,EAAA,OAAO,eAAe,MACpB,OAAA,EACuB;AAEvB,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,MAAM,aAAA,GAAgB,MAAM,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA;AACjD,MAAA,IAAI,aAAA,EAAe;AAEjB,QAAA,YAAA,CAAa,eAAe,eAAe,CAAA;AAC3C,QAAA,OAAO,aAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,MAAA,EAAQ,cAAc,KAAA,EAAO;AAC/B,MAAA,MAAM,iBACJ,OAAO,MAAA,EAAQ,cAAc,QAAA,GACzB,MAAA,CAAO,YACP,EAAC;AAEP,MAAA,MAAM,WAAW,MAAMC,uCAAA;AAAA,QACrB,OAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,QAAA,EAAU;AAEZ,QAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AACtC,QAAA,OAAO,QAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,QAAA,GAAWC,oBAAa,IAAA,EAAK;AAGjC,IAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AAGtC,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,gBAAgB,CAAA,CAAE,SAAS,CAAA,EAAG;AAC5C,MAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA,IAAK,EAAA;AAChD,MAAA,IAAI,OAAO,QAAA,CAAS,WAAW,KAAK,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AAC1D,QAAA,YAAA,CAAa,UAAU,gBAAgB,CAAA;AAAA,MACzC;AAAA,IACF;AAKA,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,MAAM,QACJ,OAAO,MAAA,CAAO,aAAa,QAAA,GAAW,MAAA,CAAO,WAAW,EAAC;AAC3D,MAAA,MAAM,mBAAmB,CAAC,CAAC,QAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,EAAG,KAAA;AAC3D,MAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,QAAA,MAAM,UAAA,GAAa,MAAM,gBAAA,IAAoB,GAAA;AAC7C,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,SAAA,EAAWC,qBAAA,EAAK,EAAG;AAAA,UACtC,MAAA,EAAQ,UAAA,GAAa,EAAA,GAAK,EAAA,GAAK,EAAA;AAAA,UAC/B,IAAA,EAAM,GAAA;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AACA,MAAA,IAAI,KAAA,CAAM,YAAY,KAAA,EAAO;AAC3B,QAAA,MAAM,OAAA,GAAU,aAAA;AAAA,UACd,qBAAA,CAAsB,OAAA,EAAS,EAAE,gBAAA,EAAkB;AAAA,SACrD;AACA,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,SAAA,EAAW,OAAA,EAAS;AAAA;AAAA,UAEvC,QAAQ,EAAA,GAAK,EAAA;AAAA,UACb,IAAA,EAAM,GAAA;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AAAA,IACF;AAGA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,QAAA,GAAW,MAAM,MAAA,CAAO,KAAA,CAAM,OAAA,EAAS,QAAQ,CAAA;AAAA,IACjD;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AAEA,SAAS,YAAA,CACP,UACA,OAAA,EACM;AACN,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,IAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,EACjC;AACF;AAMO,IAAM,cAAA,GAAiB;AAAA,EAC5B,OAAA,EAAS;AAAA,IACP;AAAA;AAEJ;AAGO,IAAM,WAAA,GAAc","file":"index.js","sourcesContent":["/**\n * @sonordev/site-kit/middleware — visitor segment resolution (the \"one edge pass\").\n *\n * Pure, edge-runtime-safe helpers that classify a request into a coarse visitor\n * segment (new-vs-returning + marketing source + campaign) from the URL's UTM\n * params and the referrer. The middleware writes the result to the `_sk_seg`\n * cookie so server-rendered slots / personalization can vary by segment WITHOUT\n * each one re-parsing the request. Resolved once, at the edge.\n *\n * Kept side-effect-free (no NextResponse, no cookie writes) so it is trivially\n * unit-testable and reusable.\n */\nimport type { NextRequest } from 'next/server'\n\nexport type SegmentSource = 'paid' | 'organic' | 'social' | 'referral' | 'direct'\n\nexport interface VisitorSegment {\n  /** `new` on the first visit (no prior `_sk_vid` cookie), else `returning`. */\n  visitorType: 'new' | 'returning'\n  /** Marketing source bucket derived from UTM medium/source, then referrer. */\n  source: SegmentSource\n  /** `utm_campaign`, if present (sanitized when encoded). */\n  campaign: string | null\n}\n\nconst PAID_MEDIUMS = ['cpc', 'ppc', 'paid', 'paidsearch', 'paid-search', 'display', 'cpm', 'banner']\nconst SOCIAL_MEDIUMS = ['social', 'social-media', 'social_media', 'sm']\nconst SOCIAL_HOSTS = [\n  'facebook.',\n  'instagram.',\n  'linkedin.',\n  't.co',\n  'twitter.',\n  'x.com',\n  'pinterest.',\n  'tiktok.',\n  'youtube.',\n  'reddit.',\n]\nconst SEARCH_HOSTS = ['google.', 'bing.', 'duckduckgo.', 'yahoo.', 'ecosia.', 'brave.', 'baidu.', 'yandex.']\n\n/**\n * Classify `request` into a {@link VisitorSegment}. UTM params win over the\n * referrer; a same-host referrer is ignored (internal navigation, not a source).\n */\nexport function resolveVisitorSegment(\n  request: NextRequest,\n  opts: { hadVisitorCookie: boolean },\n): VisitorSegment {\n  const params = request.nextUrl.searchParams\n  const medium = (params.get('utm_medium') || '').toLowerCase().trim()\n  const campaign = params.get('utm_campaign')\n\n  let source: SegmentSource = 'direct'\n\n  if (PAID_MEDIUMS.includes(medium)) {\n    source = 'paid'\n  } else if (SOCIAL_MEDIUMS.includes(medium)) {\n    source = 'social'\n  } else if (medium === 'organic') {\n    source = 'organic'\n  } else if (medium === 'referral') {\n    source = 'referral'\n  } else if (params.get('utm_source') || params.get('gclid') || params.get('fbclid')) {\n    // A tagged link with a non-standard medium: gclid => paid Google, fbclid => social.\n    if (params.get('gclid')) source = 'paid'\n    else if (params.get('fbclid')) source = 'social'\n    else source = 'referral'\n  } else {\n    // No campaign tagging — fall back to the referrer host.\n    const ref = request.headers.get('referer') || ''\n    if (ref) {\n      try {\n        const host = new URL(ref).host.toLowerCase()\n        const selfHost = request.nextUrl.host.toLowerCase()\n        if (host && host !== selfHost) {\n          if (SEARCH_HOSTS.some((h) => host.includes(h))) source = 'organic'\n          else if (SOCIAL_HOSTS.some((h) => host.includes(h))) source = 'social'\n          else source = 'referral'\n        }\n      } catch {\n        /* malformed referer — stays 'direct' */\n      }\n    }\n  }\n\n  return {\n    visitorType: opts.hadVisitorCookie ? 'returning' : 'new',\n    source,\n    campaign: campaign || null,\n  }\n}\n\n/**\n * Compact, cookie-safe encoding: `\"<visitorType>|<source>|<campaign>\"`, e.g.\n * `\"new|paid|spring_sale\"`. Campaign is sanitized to `[A-Za-z0-9_-]` and capped.\n * Decode with {@link decodeSegment}.\n */\nexport function encodeSegment(seg: VisitorSegment): string {\n  const campaign = (seg.campaign || '').replace(/[^a-zA-Z0-9_-]/g, '').slice(0, 40)\n  return `${seg.visitorType}|${seg.source}|${campaign}`\n}\n\n/** Parse a `_sk_seg` cookie value produced by {@link encodeSegment}. */\nexport function decodeSegment(value: string | undefined | null): VisitorSegment | null {\n  if (!value) return null\n  const [visitorType, source, campaign] = value.split('|')\n  if (visitorType !== 'new' && visitorType !== 'returning') return null\n  return {\n    visitorType,\n    source: (['paid', 'organic', 'social', 'referral', 'direct'].includes(source) ? source : 'direct') as SegmentSource,\n    campaign: campaign || null,\n  }\n}\n","/**\n * @sonordev/site-kit/middleware\n *\n * Composable Next.js middleware factory. Handles:\n * - Portal-managed redirects (via existing handleManagedRedirects)\n * - Security headers (X-Frame-Options, CSP, etc.)\n * - Optional before/after hooks for custom logic\n *\n * @example\n * ```ts\n * // middleware.ts — entire file\n * import { createMiddleware, siteKitMatcher } from '@sonordev/site-kit/middleware'\n *\n * export default createMiddleware()\n * export const config = siteKitMatcher\n * ```\n *\n * @example With custom hooks:\n * ```ts\n * export default createMiddleware({\n *   securityHeaders: { frameOptions: 'SAMEORIGIN' },\n *   before: (req) => {\n *     // Custom auth check, etc.\n *   },\n * })\n * ```\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport {\n  handleManagedRedirects,\n  type RedirectConfig,\n} from '../redirects'\nimport {\n  buildSecurityHeaders,\n  type SecurityHeadersConfig,\n} from './securityHeaders'\nimport { buildAiDiscoveryHeaders } from '../llms/discovery-headers'\nimport { resolveVisitorSegment, encodeSegment } from './segment'\n// Single source of truth for v4 UUIDs — Web Crypto in the edge runtime, with a\n// non-throwing fallback everywhere else. Do NOT re-fork ID generation here.\nimport { uuid } from '../shared/uuid'\n\nexport type { SecurityHeadersConfig } from './securityHeaders'\nexport {\n  resolveVisitorSegment,\n  encodeSegment,\n  decodeSegment,\n  type VisitorSegment,\n  type SegmentSource,\n} from './segment'\n\nexport interface IdentityConfig {\n  /**\n   * Also resolve + persist a coarse visitor segment (new-vs-returning + source\n   * + campaign) into the `_sk_seg` cookie, for segment-aware slots /\n   * personalization. Default: true (when identity is enabled).\n   */\n  segment?: boolean\n  /** Days the `_sk_vid` visitor cookie persists. Default: 730 (~2 years). */\n  cookieMaxAgeDays?: number\n}\n\nexport interface LlmsDiscoveryConfig {\n  /** Canonical site origin, e.g. `https://example.com` */\n  siteUrl: string\n  /** Path to llms.txt (default `/llms.txt`) */\n  llmsPath?: string\n}\n\nexport interface SiteKitMiddlewareConfig {\n  /** Enable Portal-managed redirects. Default: true */\n  redirects?: boolean | RedirectConfig\n  /** Enable security headers. Default: true */\n  securityHeaders?: boolean | SecurityHeadersConfig\n  /**\n   * Opt-in: inject `Link: <...>; rel=\"describedby\"` header on HTML responses\n   * pointing to /llms.txt for AI crawler discovery (RFC 8288).\n   * Preferred over visible footer links.\n   */\n  llmsDiscovery?: LlmsDiscoveryConfig | false\n  /**\n   * Opt-in EDGE IDENTITY pass. When enabled, the middleware ensures a\n   * first-party `_sk_vid` visitor cookie exists (server-authoritative id) and\n   * resolves the visitor segment into `_sk_seg`, so server-rendered slots and\n   * personalization can read identity + segment without re-parsing the request.\n   * Purely additive — it only writes cookies, never changes the rendered HTML,\n   * so it is LCP/static-safe. Default: OFF (sites opt in for 3.0 personalization).\n   *\n   * NOTE: to make these the SAME id the client uses, the shared identity helper\n   * must read `_sk_vid` cookie-first (a follow-on change validated with a live\n   * preview); until then the cookie is the server-side mirror.\n   */\n  identity?: boolean | IdentityConfig\n  /**\n   * Hook that runs BEFORE redirect check.\n   * Return a NextResponse to short-circuit, or undefined to continue.\n   */\n  before?: (\n    request: NextRequest,\n  ) => NextResponse | undefined | Promise<NextResponse | undefined>\n  /**\n   * Hook that runs AFTER all processing.\n   * Receives the response that will be sent — mutate headers, etc.\n   */\n  after?: (\n    request: NextRequest,\n    response: NextResponse,\n  ) => NextResponse | Promise<NextResponse>\n}\n\n/**\n * Create a fully-featured Next.js middleware function.\n *\n * With zero config this handles redirects + security headers automatically.\n */\nexport function createMiddleware(config?: SiteKitMiddlewareConfig) {\n  const securityHeaders = buildSecurityHeaders(\n    config?.securityHeaders,\n  )\n\n  // Pre-compute discovery headers (static per middleware instance)\n  const discoveryHeaders: Record<string, string> =\n    config?.llmsDiscovery\n      ? buildAiDiscoveryHeaders({\n          siteUrl: config.llmsDiscovery.siteUrl,\n          llmsPath: config.llmsDiscovery.llmsPath,\n        })\n      : {}\n\n  return async function proxy(\n    request: NextRequest,\n  ): Promise<NextResponse> {\n    // 1. Run user's 'before' hook\n    if (config?.before) {\n      const earlyResponse = await config.before(request)\n      if (earlyResponse) {\n        // Apply security headers even to early responses\n        applyHeaders(earlyResponse, securityHeaders)\n        return earlyResponse\n      }\n    }\n\n    // 2. Check Portal-managed redirects (unless disabled)\n    if (config?.redirects !== false) {\n      const redirectConfig: RedirectConfig =\n        typeof config?.redirects === 'object'\n          ? config.redirects\n          : {}\n\n      const redirect = await handleManagedRedirects(\n        request,\n        redirectConfig,\n      )\n      if (redirect) {\n        // Redirects get security headers too\n        applyHeaders(redirect, securityHeaders)\n        return redirect\n      }\n    }\n\n    // 3. Build the pass-through response\n    let response = NextResponse.next()\n\n    // 4. Apply security headers\n    applyHeaders(response, securityHeaders)\n\n    // 5. Apply AI discovery Link header (only on HTML-like requests, not static assets)\n    if (Object.keys(discoveryHeaders).length > 0) {\n      const accept = request.headers.get('accept') || ''\n      if (accept.includes('text/html') || accept.includes('*/*')) {\n        applyHeaders(response, discoveryHeaders)\n      }\n    }\n\n    // 5b. Edge identity pass (opt-in). Ensure a first-party `_sk_vid` visitor\n    // cookie exists and resolve the visitor segment into `_sk_seg`. Additive:\n    // only writes cookies, never changes the rendered HTML (LCP/static-safe).\n    if (config?.identity) {\n      const idCfg: IdentityConfig =\n        typeof config.identity === 'object' ? config.identity : {}\n      const hadVisitorCookie = !!request.cookies.get('_sk_vid')?.value\n      if (!hadVisitorCookie) {\n        const maxAgeDays = idCfg.cookieMaxAgeDays ?? 730\n        response.cookies.set('_sk_vid', uuid(), {\n          maxAge: maxAgeDays * 24 * 60 * 60,\n          path: '/',\n          sameSite: 'lax',\n          secure: true,\n        })\n      }\n      if (idCfg.segment !== false) {\n        const segment = encodeSegment(\n          resolveVisitorSegment(request, { hadVisitorCookie }),\n        )\n        response.cookies.set('_sk_seg', segment, {\n          // Session-ish: a fresh campaign / source on a later visit re-segments.\n          maxAge: 30 * 60,\n          path: '/',\n          sameSite: 'lax',\n          secure: true,\n        })\n      }\n    }\n\n    // 6. Run user's 'after' hook\n    if (config?.after) {\n      response = await config.after(request, response)\n    }\n\n    return response\n  }\n}\n\nfunction applyHeaders(\n  response: NextResponse,\n  headers: Record<string, string>,\n): void {\n  for (const [key, value] of Object.entries(headers)) {\n    response.headers.set(key, value)\n  }\n}\n\n/**\n * Standard matcher config that excludes static assets and images.\n * Export alongside createProxy/createMiddleware in your proxy.ts.\n */\nexport const siteKitMatcher = {\n  matcher: [\n    '/((?!_next/static|_next/image|favicon\\\\.ico|.*\\\\.(?:ico|png|jpg|jpeg|gif|webp|svg|woff2?)$).*)',\n  ],\n}\n\n/** Next.js 16+ alias — same as createMiddleware, named for the proxy convention. */\nexport const createProxy = createMiddleware\n"]}

package/dist/middleware/index.mjs

@@ -2,6 +2,7 @@ import { buildSecurityHeaders } from '../chunk-6BIPAKL4.mjs';
 import { buildAiDiscoveryHeaders } from '../chunk-H4OBGC43.mjs';
 import { handleManagedRedirects } from '../chunk-7LAOWIWE.mjs';
 import '../chunk-B22WSN4L.mjs';
+import { uuid } from '../chunk-6EDVCUAG.mjs';
 import '../chunk-4XPGGLVP.mjs';
 import { NextResponse } from 'next/server';
 
@@ -115,7 +116,7 @@ function createMiddleware(config) {
       const hadVisitorCookie = !!request.cookies.get("_sk_vid")?.value;
       if (!hadVisitorCookie) {
         const maxAgeDays = idCfg.cookieMaxAgeDays ?? 730;
-        response.cookies.set("_sk_vid", generateVisitorId(), {
+        response.cookies.set("_sk_vid", uuid(), {
           maxAge: maxAgeDays * 24 * 60 * 60,
           path: "/",
           sameSite: "lax",
@@ -141,13 +142,6 @@ function createMiddleware(config) {
     return response;
   };
 }
-function generateVisitorId() {
-  if (typeof crypto !== "undefined" && crypto.randomUUID) return crypto.randomUUID();
-  return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (c) => {
-    const r = Math.random() * 16 | 0;
-    return (c === "x" ? r : r & 3 | 8).toString(16);
-  });
-}
 function applyHeaders(response, headers) {
   for (const [key, value] of Object.entries(headers)) {
     response.headers.set(key, value);

package/dist/middleware/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/middleware/segment.ts","../../src/middleware/index.ts"],"names":[],"mappings":";;;;;;;;AAyBA,IAAM,YAAA,GAAe,CAAC,KAAA,EAAO,KAAA,EAAO,QAAQ,YAAA,EAAc,aAAA,EAAe,SAAA,EAAW,KAAA,EAAO,QAAQ,CAAA;AACnG,IAAM,cAAA,GAAiB,CAAC,QAAA,EAAU,cAAA,EAAgB,gBAAgB,IAAI,CAAA;AACtE,IAAM,YAAA,GAAe;AAAA,EACnB,WAAA;AAAA,EACA,YAAA;AAAA,EACA,WAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;AACA,IAAM,YAAA,GAAe,CAAC,SAAA,EAAW,OAAA,EAAS,eAAe,QAAA,EAAU,SAAA,EAAW,QAAA,EAAU,QAAA,EAAU,SAAS,CAAA;AAMpG,SAAS,qBAAA,CACd,SACA,IAAA,EACgB;AAChB,EAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,YAAA;AAC/B,EAAA,MAAM,MAAA,GAAA,CAAU,OAAO,GAAA,CAAI,YAAY,KAAK,EAAA,EAAI,WAAA,GAAc,IAAA,EAAK;AACnE,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,cAAc,CAAA;AAE1C,EAAA,IAAI,MAAA,GAAwB,QAAA;AAE5B,EAAA,IAAI,YAAA,CAAa,QAAA,CAAS,MAAM,CAAA,EAAG;AACjC,IAAA,MAAA,GAAS,MAAA;AAAA,EACX,CAAA,MAAA,IAAW,cAAA,CAAe,QAAA,CAAS,MAAM,CAAA,EAAG;AAC1C,IAAA,MAAA,GAAS,QAAA;AAAA,EACX,CAAA,MAAA,IAAW,WAAW,SAAA,EAAW;AAC/B,IAAA,MAAA,GAAS,SAAA;AAAA,EACX,CAAA,MAAA,IAAW,WAAW,UAAA,EAAY;AAChC,IAAA,MAAA,GAAS,UAAA;AAAA,EACX,CAAA,MAAA,IAAW,MAAA,CAAO,GAAA,CAAI,YAAY,CAAA,IAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,IAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG;AAElF,IAAA,IAAI,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,EAAG,MAAA,GAAS,MAAA;AAAA,SAAA,IACzB,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG,MAAA,GAAS,QAAA;AAAA,SACnC,MAAA,GAAS,UAAA;AAAA,EAChB,CAAA,MAAO;AAEL,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,IAAK,EAAA;AAC9C,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,KAAK,WAAA,EAAY;AAC3C,QAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,WAAA,EAAY;AAClD,QAAA,IAAI,IAAA,IAAQ,SAAS,QAAA,EAAU;AAC7B,UAAA,IAAI,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,MAAA,GAAS,SAAA;AAAA,eAAA,IAChD,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,MAAA,GAAS,QAAA;AAAA,eACzD,MAAA,GAAS,UAAA;AAAA,QAChB;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,IAAA,CAAK,gBAAA,GAAmB,WAAA,GAAc,KAAA;AAAA,IACnD,MAAA;AAAA,IACA,UAAU,QAAA,IAAY;AAAA,GACxB;AACF;AAOO,SAAS,cAAc,GAAA,EAA6B;AACzD,EAAA,MAAM,QAAA,GAAA,CAAY,GAAA,CAAI,QAAA,IAAY,EAAA,EAAI,OAAA,CAAQ,mBAAmB,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAChF,EAAA,OAAO,GAAG,GAAA,CAAI,WAAW,IAAI,GAAA,CAAI,MAAM,IAAI,QAAQ,CAAA,CAAA;AACrD;AAGO,SAAS,cAAc,KAAA,EAAyD;AACrF,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,CAAC,WAAA,EAAa,MAAA,EAAQ,QAAQ,CAAA,GAAI,KAAA,CAAM,MAAM,GAAG,CAAA;AACvD,EAAA,IAAI,WAAA,KAAgB,KAAA,IAAS,WAAA,KAAgB,WAAA,EAAa,OAAO,IAAA;AACjE,EAAA,OAAO;AAAA,IACL,WAAA;AAAA,IACA,MAAA,EAAS,CAAC,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,UAAA,EAAY,QAAQ,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,GAAI,MAAA,GAAS,QAAA;AAAA,IACzF,UAAU,QAAA,IAAY;AAAA,GACxB;AACF;;;ACAO,SAAS,iBAAiB,MAAA,EAAkC;AACjE,EAAA,MAAM,eAAA,GAAkB,oBAAA;AAAA,IACtB,MAAA,EAAQ;AAAA,GACV;AAGA,EAAA,MAAM,gBAAA,GACJ,MAAA,EAAQ,aAAA,GACJ,uBAAA,CAAwB;AAAA,IACtB,OAAA,EAAS,OAAO,aAAA,CAAc,OAAA;AAAA,IAC9B,QAAA,EAAU,OAAO,aAAA,CAAc;AAAA,GAChC,IACD,EAAC;AAEP,EAAA,OAAO,eAAe,MACpB,OAAA,EACuB;AAEvB,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,MAAM,aAAA,GAAgB,MAAM,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA;AACjD,MAAA,IAAI,aAAA,EAAe;AAEjB,QAAA,YAAA,CAAa,eAAe,eAAe,CAAA;AAC3C,QAAA,OAAO,aAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,MAAA,EAAQ,cAAc,KAAA,EAAO;AAC/B,MAAA,MAAM,iBACJ,OAAO,MAAA,EAAQ,cAAc,QAAA,GACzB,MAAA,CAAO,YACP,EAAC;AAEP,MAAA,MAAM,WAAW,MAAM,sBAAA;AAAA,QACrB,OAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,QAAA,EAAU;AAEZ,QAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AACtC,QAAA,OAAO,QAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,QAAA,GAAW,aAAa,IAAA,EAAK;AAGjC,IAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AAGtC,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,gBAAgB,CAAA,CAAE,SAAS,CAAA,EAAG;AAC5C,MAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA,IAAK,EAAA;AAChD,MAAA,IAAI,OAAO,QAAA,CAAS,WAAW,KAAK,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AAC1D,QAAA,YAAA,CAAa,UAAU,gBAAgB,CAAA;AAAA,MACzC;AAAA,IACF;AAKA,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,MAAM,QACJ,OAAO,MAAA,CAAO,aAAa,QAAA,GAAW,MAAA,CAAO,WAAW,EAAC;AAC3D,MAAA,MAAM,mBAAmB,CAAC,CAAC,QAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,EAAG,KAAA;AAC3D,MAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,QAAA,MAAM,UAAA,GAAa,MAAM,gBAAA,IAAoB,GAAA;AAC7C,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,SAAA,EAAW,iBAAA,EAAkB,EAAG;AAAA,UACnD,MAAA,EAAQ,UAAA,GAAa,EAAA,GAAK,EAAA,GAAK,EAAA;AAAA,UAC/B,IAAA,EAAM,GAAA;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AACA,MAAA,IAAI,KAAA,CAAM,YAAY,KAAA,EAAO;AAC3B,QAAA,MAAM,OAAA,GAAU,aAAA;AAAA,UACd,qBAAA,CAAsB,OAAA,EAAS,EAAE,gBAAA,EAAkB;AAAA,SACrD;AACA,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,SAAA,EAAW,OAAA,EAAS;AAAA;AAAA,UAEvC,QAAQ,EAAA,GAAK,EAAA;AAAA,UACb,IAAA,EAAM,GAAA;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AAAA,IACF;AAGA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,QAAA,GAAW,MAAM,MAAA,CAAO,KAAA,CAAM,OAAA,EAAS,QAAQ,CAAA;AAAA,IACjD;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AAMA,SAAS,iBAAA,GAA4B;AACnC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,OAAO,UAAA,EAAY,OAAO,OAAO,UAAA,EAAW;AACjF,EAAA,OAAO,sCAAA,CAAuC,OAAA,CAAQ,OAAA,EAAS,CAAC,CAAA,KAAM;AACpE,IAAA,MAAM,CAAA,GAAK,IAAA,CAAK,MAAA,EAAO,GAAI,EAAA,GAAM,CAAA;AACjC,IAAA,OAAA,CAAQ,MAAM,GAAA,GAAM,CAAA,GAAK,IAAI,CAAA,GAAO,CAAA,EAAK,SAAS,EAAE,CAAA;AAAA,EACtD,CAAC,CAAA;AACH;AAEA,SAAS,YAAA,CACP,UACA,OAAA,EACM;AACN,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,IAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,EACjC;AACF;AAMO,IAAM,cAAA,GAAiB;AAAA,EAC5B,OAAA,EAAS;AAAA,IACP;AAAA;AAEJ;AAGO,IAAM,WAAA,GAAc","file":"index.mjs","sourcesContent":["/**\n * @sonordev/site-kit/middleware — visitor segment resolution (the \"one edge pass\").\n *\n * Pure, edge-runtime-safe helpers that classify a request into a coarse visitor\n * segment (new-vs-returning + marketing source + campaign) from the URL's UTM\n * params and the referrer. The middleware writes the result to the `_sk_seg`\n * cookie so server-rendered slots / personalization can vary by segment WITHOUT\n * each one re-parsing the request. Resolved once, at the edge.\n *\n * Kept side-effect-free (no NextResponse, no cookie writes) so it is trivially\n * unit-testable and reusable.\n */\nimport type { NextRequest } from 'next/server'\n\nexport type SegmentSource = 'paid' | 'organic' | 'social' | 'referral' | 'direct'\n\nexport interface VisitorSegment {\n  /** `new` on the first visit (no prior `_sk_vid` cookie), else `returning`. */\n  visitorType: 'new' | 'returning'\n  /** Marketing source bucket derived from UTM medium/source, then referrer. */\n  source: SegmentSource\n  /** `utm_campaign`, if present (sanitized when encoded). */\n  campaign: string | null\n}\n\nconst PAID_MEDIUMS = ['cpc', 'ppc', 'paid', 'paidsearch', 'paid-search', 'display', 'cpm', 'banner']\nconst SOCIAL_MEDIUMS = ['social', 'social-media', 'social_media', 'sm']\nconst SOCIAL_HOSTS = [\n  'facebook.',\n  'instagram.',\n  'linkedin.',\n  't.co',\n  'twitter.',\n  'x.com',\n  'pinterest.',\n  'tiktok.',\n  'youtube.',\n  'reddit.',\n]\nconst SEARCH_HOSTS = ['google.', 'bing.', 'duckduckgo.', 'yahoo.', 'ecosia.', 'brave.', 'baidu.', 'yandex.']\n\n/**\n * Classify `request` into a {@link VisitorSegment}. UTM params win over the\n * referrer; a same-host referrer is ignored (internal navigation, not a source).\n */\nexport function resolveVisitorSegment(\n  request: NextRequest,\n  opts: { hadVisitorCookie: boolean },\n): VisitorSegment {\n  const params = request.nextUrl.searchParams\n  const medium = (params.get('utm_medium') || '').toLowerCase().trim()\n  const campaign = params.get('utm_campaign')\n\n  let source: SegmentSource = 'direct'\n\n  if (PAID_MEDIUMS.includes(medium)) {\n    source = 'paid'\n  } else if (SOCIAL_MEDIUMS.includes(medium)) {\n    source = 'social'\n  } else if (medium === 'organic') {\n    source = 'organic'\n  } else if (medium === 'referral') {\n    source = 'referral'\n  } else if (params.get('utm_source') || params.get('gclid') || params.get('fbclid')) {\n    // A tagged link with a non-standard medium: gclid => paid Google, fbclid => social.\n    if (params.get('gclid')) source = 'paid'\n    else if (params.get('fbclid')) source = 'social'\n    else source = 'referral'\n  } else {\n    // No campaign tagging — fall back to the referrer host.\n    const ref = request.headers.get('referer') || ''\n    if (ref) {\n      try {\n        const host = new URL(ref).host.toLowerCase()\n        const selfHost = request.nextUrl.host.toLowerCase()\n        if (host && host !== selfHost) {\n          if (SEARCH_HOSTS.some((h) => host.includes(h))) source = 'organic'\n          else if (SOCIAL_HOSTS.some((h) => host.includes(h))) source = 'social'\n          else source = 'referral'\n        }\n      } catch {\n        /* malformed referer — stays 'direct' */\n      }\n    }\n  }\n\n  return {\n    visitorType: opts.hadVisitorCookie ? 'returning' : 'new',\n    source,\n    campaign: campaign || null,\n  }\n}\n\n/**\n * Compact, cookie-safe encoding: `\"<visitorType>|<source>|<campaign>\"`, e.g.\n * `\"new|paid|spring_sale\"`. Campaign is sanitized to `[A-Za-z0-9_-]` and capped.\n * Decode with {@link decodeSegment}.\n */\nexport function encodeSegment(seg: VisitorSegment): string {\n  const campaign = (seg.campaign || '').replace(/[^a-zA-Z0-9_-]/g, '').slice(0, 40)\n  return `${seg.visitorType}|${seg.source}|${campaign}`\n}\n\n/** Parse a `_sk_seg` cookie value produced by {@link encodeSegment}. */\nexport function decodeSegment(value: string | undefined | null): VisitorSegment | null {\n  if (!value) return null\n  const [visitorType, source, campaign] = value.split('|')\n  if (visitorType !== 'new' && visitorType !== 'returning') return null\n  return {\n    visitorType,\n    source: (['paid', 'organic', 'social', 'referral', 'direct'].includes(source) ? source : 'direct') as SegmentSource,\n    campaign: campaign || null,\n  }\n}\n","/**\n * @sonordev/site-kit/middleware\n *\n * Composable Next.js middleware factory. Handles:\n * - Portal-managed redirects (via existing handleManagedRedirects)\n * - Security headers (X-Frame-Options, CSP, etc.)\n * - Optional before/after hooks for custom logic\n *\n * @example\n * ```ts\n * // middleware.ts — entire file\n * import { createMiddleware, siteKitMatcher } from '@sonordev/site-kit/middleware'\n *\n * export default createMiddleware()\n * export const config = siteKitMatcher\n * ```\n *\n * @example With custom hooks:\n * ```ts\n * export default createMiddleware({\n *   securityHeaders: { frameOptions: 'SAMEORIGIN' },\n *   before: (req) => {\n *     // Custom auth check, etc.\n *   },\n * })\n * ```\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport {\n  handleManagedRedirects,\n  type RedirectConfig,\n} from '../redirects'\nimport {\n  buildSecurityHeaders,\n  type SecurityHeadersConfig,\n} from './securityHeaders'\nimport { buildAiDiscoveryHeaders } from '../llms/discovery-headers'\nimport { resolveVisitorSegment, encodeSegment } from './segment'\n\nexport type { SecurityHeadersConfig } from './securityHeaders'\nexport {\n  resolveVisitorSegment,\n  encodeSegment,\n  decodeSegment,\n  type VisitorSegment,\n  type SegmentSource,\n} from './segment'\n\nexport interface IdentityConfig {\n  /**\n   * Also resolve + persist a coarse visitor segment (new-vs-returning + source\n   * + campaign) into the `_sk_seg` cookie, for segment-aware slots /\n   * personalization. Default: true (when identity is enabled).\n   */\n  segment?: boolean\n  /** Days the `_sk_vid` visitor cookie persists. Default: 730 (~2 years). */\n  cookieMaxAgeDays?: number\n}\n\nexport interface LlmsDiscoveryConfig {\n  /** Canonical site origin, e.g. `https://example.com` */\n  siteUrl: string\n  /** Path to llms.txt (default `/llms.txt`) */\n  llmsPath?: string\n}\n\nexport interface SiteKitMiddlewareConfig {\n  /** Enable Portal-managed redirects. Default: true */\n  redirects?: boolean | RedirectConfig\n  /** Enable security headers. Default: true */\n  securityHeaders?: boolean | SecurityHeadersConfig\n  /**\n   * Opt-in: inject `Link: <...>; rel=\"describedby\"` header on HTML responses\n   * pointing to /llms.txt for AI crawler discovery (RFC 8288).\n   * Preferred over visible footer links.\n   */\n  llmsDiscovery?: LlmsDiscoveryConfig | false\n  /**\n   * Opt-in EDGE IDENTITY pass. When enabled, the middleware ensures a\n   * first-party `_sk_vid` visitor cookie exists (server-authoritative id) and\n   * resolves the visitor segment into `_sk_seg`, so server-rendered slots and\n   * personalization can read identity + segment without re-parsing the request.\n   * Purely additive — it only writes cookies, never changes the rendered HTML,\n   * so it is LCP/static-safe. Default: OFF (sites opt in for 3.0 personalization).\n   *\n   * NOTE: to make these the SAME id the client uses, the shared identity helper\n   * must read `_sk_vid` cookie-first (a follow-on change validated with a live\n   * preview); until then the cookie is the server-side mirror.\n   */\n  identity?: boolean | IdentityConfig\n  /**\n   * Hook that runs BEFORE redirect check.\n   * Return a NextResponse to short-circuit, or undefined to continue.\n   */\n  before?: (\n    request: NextRequest,\n  ) => NextResponse | undefined | Promise<NextResponse | undefined>\n  /**\n   * Hook that runs AFTER all processing.\n   * Receives the response that will be sent — mutate headers, etc.\n   */\n  after?: (\n    request: NextRequest,\n    response: NextResponse,\n  ) => NextResponse | Promise<NextResponse>\n}\n\n/**\n * Create a fully-featured Next.js middleware function.\n *\n * With zero config this handles redirects + security headers automatically.\n */\nexport function createMiddleware(config?: SiteKitMiddlewareConfig) {\n  const securityHeaders = buildSecurityHeaders(\n    config?.securityHeaders,\n  )\n\n  // Pre-compute discovery headers (static per middleware instance)\n  const discoveryHeaders: Record<string, string> =\n    config?.llmsDiscovery\n      ? buildAiDiscoveryHeaders({\n          siteUrl: config.llmsDiscovery.siteUrl,\n          llmsPath: config.llmsDiscovery.llmsPath,\n        })\n      : {}\n\n  return async function proxy(\n    request: NextRequest,\n  ): Promise<NextResponse> {\n    // 1. Run user's 'before' hook\n    if (config?.before) {\n      const earlyResponse = await config.before(request)\n      if (earlyResponse) {\n        // Apply security headers even to early responses\n        applyHeaders(earlyResponse, securityHeaders)\n        return earlyResponse\n      }\n    }\n\n    // 2. Check Portal-managed redirects (unless disabled)\n    if (config?.redirects !== false) {\n      const redirectConfig: RedirectConfig =\n        typeof config?.redirects === 'object'\n          ? config.redirects\n          : {}\n\n      const redirect = await handleManagedRedirects(\n        request,\n        redirectConfig,\n      )\n      if (redirect) {\n        // Redirects get security headers too\n        applyHeaders(redirect, securityHeaders)\n        return redirect\n      }\n    }\n\n    // 3. Build the pass-through response\n    let response = NextResponse.next()\n\n    // 4. Apply security headers\n    applyHeaders(response, securityHeaders)\n\n    // 5. Apply AI discovery Link header (only on HTML-like requests, not static assets)\n    if (Object.keys(discoveryHeaders).length > 0) {\n      const accept = request.headers.get('accept') || ''\n      if (accept.includes('text/html') || accept.includes('*/*')) {\n        applyHeaders(response, discoveryHeaders)\n      }\n    }\n\n    // 5b. Edge identity pass (opt-in). Ensure a first-party `_sk_vid` visitor\n    // cookie exists and resolve the visitor segment into `_sk_seg`. Additive:\n    // only writes cookies, never changes the rendered HTML (LCP/static-safe).\n    if (config?.identity) {\n      const idCfg: IdentityConfig =\n        typeof config.identity === 'object' ? config.identity : {}\n      const hadVisitorCookie = !!request.cookies.get('_sk_vid')?.value\n      if (!hadVisitorCookie) {\n        const maxAgeDays = idCfg.cookieMaxAgeDays ?? 730\n        response.cookies.set('_sk_vid', generateVisitorId(), {\n          maxAge: maxAgeDays * 24 * 60 * 60,\n          path: '/',\n          sameSite: 'lax',\n          secure: true,\n        })\n      }\n      if (idCfg.segment !== false) {\n        const segment = encodeSegment(\n          resolveVisitorSegment(request, { hadVisitorCookie }),\n        )\n        response.cookies.set('_sk_seg', segment, {\n          // Session-ish: a fresh campaign / source on a later visit re-segments.\n          maxAge: 30 * 60,\n          path: '/',\n          sameSite: 'lax',\n          secure: true,\n        })\n      }\n    }\n\n    // 6. Run user's 'after' hook\n    if (config?.after) {\n      response = await config.after(request, response)\n    }\n\n    return response\n  }\n}\n\n/**\n * Generate a visitor id at the edge. Prefers Web Crypto (available in the\n * Next.js edge runtime); falls back to a v4-shaped string elsewhere.\n */\nfunction generateVisitorId(): string {\n  if (typeof crypto !== 'undefined' && crypto.randomUUID) return crypto.randomUUID()\n  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {\n    const r = (Math.random() * 16) | 0\n    return (c === 'x' ? r : (r & 0x3) | 0x8).toString(16)\n  })\n}\n\nfunction applyHeaders(\n  response: NextResponse,\n  headers: Record<string, string>,\n): void {\n  for (const [key, value] of Object.entries(headers)) {\n    response.headers.set(key, value)\n  }\n}\n\n/**\n * Standard matcher config that excludes static assets and images.\n * Export alongside createProxy/createMiddleware in your proxy.ts.\n */\nexport const siteKitMatcher = {\n  matcher: [\n    '/((?!_next/static|_next/image|favicon\\\\.ico|.*\\\\.(?:ico|png|jpg|jpeg|gif|webp|svg|woff2?)$).*)',\n  ],\n}\n\n/** Next.js 16+ alias — same as createMiddleware, named for the proxy convention. */\nexport const createProxy = createMiddleware\n"]}
+{"version":3,"sources":["../../src/middleware/segment.ts","../../src/middleware/index.ts"],"names":[],"mappings":";;;;;;;;;AAyBA,IAAM,YAAA,GAAe,CAAC,KAAA,EAAO,KAAA,EAAO,QAAQ,YAAA,EAAc,aAAA,EAAe,SAAA,EAAW,KAAA,EAAO,QAAQ,CAAA;AACnG,IAAM,cAAA,GAAiB,CAAC,QAAA,EAAU,cAAA,EAAgB,gBAAgB,IAAI,CAAA;AACtE,IAAM,YAAA,GAAe;AAAA,EACnB,WAAA;AAAA,EACA,YAAA;AAAA,EACA,WAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;AACA,IAAM,YAAA,GAAe,CAAC,SAAA,EAAW,OAAA,EAAS,eAAe,QAAA,EAAU,SAAA,EAAW,QAAA,EAAU,QAAA,EAAU,SAAS,CAAA;AAMpG,SAAS,qBAAA,CACd,SACA,IAAA,EACgB;AAChB,EAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,YAAA;AAC/B,EAAA,MAAM,MAAA,GAAA,CAAU,OAAO,GAAA,CAAI,YAAY,KAAK,EAAA,EAAI,WAAA,GAAc,IAAA,EAAK;AACnE,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,cAAc,CAAA;AAE1C,EAAA,IAAI,MAAA,GAAwB,QAAA;AAE5B,EAAA,IAAI,YAAA,CAAa,QAAA,CAAS,MAAM,CAAA,EAAG;AACjC,IAAA,MAAA,GAAS,MAAA;AAAA,EACX,CAAA,MAAA,IAAW,cAAA,CAAe,QAAA,CAAS,MAAM,CAAA,EAAG;AAC1C,IAAA,MAAA,GAAS,QAAA;AAAA,EACX,CAAA,MAAA,IAAW,WAAW,SAAA,EAAW;AAC/B,IAAA,MAAA,GAAS,SAAA;AAAA,EACX,CAAA,MAAA,IAAW,WAAW,UAAA,EAAY;AAChC,IAAA,MAAA,GAAS,UAAA;AAAA,EACX,CAAA,MAAA,IAAW,MAAA,CAAO,GAAA,CAAI,YAAY,CAAA,IAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,IAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG;AAElF,IAAA,IAAI,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,EAAG,MAAA,GAAS,MAAA;AAAA,SAAA,IACzB,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG,MAAA,GAAS,QAAA;AAAA,SACnC,MAAA,GAAS,UAAA;AAAA,EAChB,CAAA,MAAO;AAEL,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,IAAK,EAAA;AAC9C,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,KAAK,WAAA,EAAY;AAC3C,QAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,WAAA,EAAY;AAClD,QAAA,IAAI,IAAA,IAAQ,SAAS,QAAA,EAAU;AAC7B,UAAA,IAAI,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,MAAA,GAAS,SAAA;AAAA,eAAA,IAChD,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,MAAA,GAAS,QAAA;AAAA,eACzD,MAAA,GAAS,UAAA;AAAA,QAChB;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,IAAA,CAAK,gBAAA,GAAmB,WAAA,GAAc,KAAA;AAAA,IACnD,MAAA;AAAA,IACA,UAAU,QAAA,IAAY;AAAA,GACxB;AACF;AAOO,SAAS,cAAc,GAAA,EAA6B;AACzD,EAAA,MAAM,QAAA,GAAA,CAAY,GAAA,CAAI,QAAA,IAAY,EAAA,EAAI,OAAA,CAAQ,mBAAmB,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAChF,EAAA,OAAO,GAAG,GAAA,CAAI,WAAW,IAAI,GAAA,CAAI,MAAM,IAAI,QAAQ,CAAA,CAAA;AACrD;AAGO,SAAS,cAAc,KAAA,EAAyD;AACrF,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,CAAC,WAAA,EAAa,MAAA,EAAQ,QAAQ,CAAA,GAAI,KAAA,CAAM,MAAM,GAAG,CAAA;AACvD,EAAA,IAAI,WAAA,KAAgB,KAAA,IAAS,WAAA,KAAgB,WAAA,EAAa,OAAO,IAAA;AACjE,EAAA,OAAO;AAAA,IACL,WAAA;AAAA,IACA,MAAA,EAAS,CAAC,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,UAAA,EAAY,QAAQ,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,GAAI,MAAA,GAAS,QAAA;AAAA,IACzF,UAAU,QAAA,IAAY;AAAA,GACxB;AACF;;;ACGO,SAAS,iBAAiB,MAAA,EAAkC;AACjE,EAAA,MAAM,eAAA,GAAkB,oBAAA;AAAA,IACtB,MAAA,EAAQ;AAAA,GACV;AAGA,EAAA,MAAM,gBAAA,GACJ,MAAA,EAAQ,aAAA,GACJ,uBAAA,CAAwB;AAAA,IACtB,OAAA,EAAS,OAAO,aAAA,CAAc,OAAA;AAAA,IAC9B,QAAA,EAAU,OAAO,aAAA,CAAc;AAAA,GAChC,IACD,EAAC;AAEP,EAAA,OAAO,eAAe,MACpB,OAAA,EACuB;AAEvB,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,MAAM,aAAA,GAAgB,MAAM,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA;AACjD,MAAA,IAAI,aAAA,EAAe;AAEjB,QAAA,YAAA,CAAa,eAAe,eAAe,CAAA;AAC3C,QAAA,OAAO,aAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,MAAA,EAAQ,cAAc,KAAA,EAAO;AAC/B,MAAA,MAAM,iBACJ,OAAO,MAAA,EAAQ,cAAc,QAAA,GACzB,MAAA,CAAO,YACP,EAAC;AAEP,MAAA,MAAM,WAAW,MAAM,sBAAA;AAAA,QACrB,OAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,QAAA,EAAU;AAEZ,QAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AACtC,QAAA,OAAO,QAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,QAAA,GAAW,aAAa,IAAA,EAAK;AAGjC,IAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AAGtC,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,gBAAgB,CAAA,CAAE,SAAS,CAAA,EAAG;AAC5C,MAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA,IAAK,EAAA;AAChD,MAAA,IAAI,OAAO,QAAA,CAAS,WAAW,KAAK,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AAC1D,QAAA,YAAA,CAAa,UAAU,gBAAgB,CAAA;AAAA,MACzC;AAAA,IACF;AAKA,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,MAAM,QACJ,OAAO,MAAA,CAAO,aAAa,QAAA,GAAW,MAAA,CAAO,WAAW,EAAC;AAC3D,MAAA,MAAM,mBAAmB,CAAC,CAAC,QAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,EAAG,KAAA;AAC3D,MAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,QAAA,MAAM,UAAA,GAAa,MAAM,gBAAA,IAAoB,GAAA;AAC7C,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,SAAA,EAAW,IAAA,EAAK,EAAG;AAAA,UACtC,MAAA,EAAQ,UAAA,GAAa,EAAA,GAAK,EAAA,GAAK,EAAA;AAAA,UAC/B,IAAA,EAAM,GAAA;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AACA,MAAA,IAAI,KAAA,CAAM,YAAY,KAAA,EAAO;AAC3B,QAAA,MAAM,OAAA,GAAU,aAAA;AAAA,UACd,qBAAA,CAAsB,OAAA,EAAS,EAAE,gBAAA,EAAkB;AAAA,SACrD;AACA,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,SAAA,EAAW,OAAA,EAAS;AAAA;AAAA,UAEvC,QAAQ,EAAA,GAAK,EAAA;AAAA,UACb,IAAA,EAAM,GAAA;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AAAA,IACF;AAGA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,QAAA,GAAW,MAAM,MAAA,CAAO,KAAA,CAAM,OAAA,EAAS,QAAQ,CAAA;AAAA,IACjD;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AAEA,SAAS,YAAA,CACP,UACA,OAAA,EACM;AACN,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,IAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,EACjC;AACF;AAMO,IAAM,cAAA,GAAiB;AAAA,EAC5B,OAAA,EAAS;AAAA,IACP;AAAA;AAEJ;AAGO,IAAM,WAAA,GAAc","file":"index.mjs","sourcesContent":["/**\n * @sonordev/site-kit/middleware — visitor segment resolution (the \"one edge pass\").\n *\n * Pure, edge-runtime-safe helpers that classify a request into a coarse visitor\n * segment (new-vs-returning + marketing source + campaign) from the URL's UTM\n * params and the referrer. The middleware writes the result to the `_sk_seg`\n * cookie so server-rendered slots / personalization can vary by segment WITHOUT\n * each one re-parsing the request. Resolved once, at the edge.\n *\n * Kept side-effect-free (no NextResponse, no cookie writes) so it is trivially\n * unit-testable and reusable.\n */\nimport type { NextRequest } from 'next/server'\n\nexport type SegmentSource = 'paid' | 'organic' | 'social' | 'referral' | 'direct'\n\nexport interface VisitorSegment {\n  /** `new` on the first visit (no prior `_sk_vid` cookie), else `returning`. */\n  visitorType: 'new' | 'returning'\n  /** Marketing source bucket derived from UTM medium/source, then referrer. */\n  source: SegmentSource\n  /** `utm_campaign`, if present (sanitized when encoded). */\n  campaign: string | null\n}\n\nconst PAID_MEDIUMS = ['cpc', 'ppc', 'paid', 'paidsearch', 'paid-search', 'display', 'cpm', 'banner']\nconst SOCIAL_MEDIUMS = ['social', 'social-media', 'social_media', 'sm']\nconst SOCIAL_HOSTS = [\n  'facebook.',\n  'instagram.',\n  'linkedin.',\n  't.co',\n  'twitter.',\n  'x.com',\n  'pinterest.',\n  'tiktok.',\n  'youtube.',\n  'reddit.',\n]\nconst SEARCH_HOSTS = ['google.', 'bing.', 'duckduckgo.', 'yahoo.', 'ecosia.', 'brave.', 'baidu.', 'yandex.']\n\n/**\n * Classify `request` into a {@link VisitorSegment}. UTM params win over the\n * referrer; a same-host referrer is ignored (internal navigation, not a source).\n */\nexport function resolveVisitorSegment(\n  request: NextRequest,\n  opts: { hadVisitorCookie: boolean },\n): VisitorSegment {\n  const params = request.nextUrl.searchParams\n  const medium = (params.get('utm_medium') || '').toLowerCase().trim()\n  const campaign = params.get('utm_campaign')\n\n  let source: SegmentSource = 'direct'\n\n  if (PAID_MEDIUMS.includes(medium)) {\n    source = 'paid'\n  } else if (SOCIAL_MEDIUMS.includes(medium)) {\n    source = 'social'\n  } else if (medium === 'organic') {\n    source = 'organic'\n  } else if (medium === 'referral') {\n    source = 'referral'\n  } else if (params.get('utm_source') || params.get('gclid') || params.get('fbclid')) {\n    // A tagged link with a non-standard medium: gclid => paid Google, fbclid => social.\n    if (params.get('gclid')) source = 'paid'\n    else if (params.get('fbclid')) source = 'social'\n    else source = 'referral'\n  } else {\n    // No campaign tagging — fall back to the referrer host.\n    const ref = request.headers.get('referer') || ''\n    if (ref) {\n      try {\n        const host = new URL(ref).host.toLowerCase()\n        const selfHost = request.nextUrl.host.toLowerCase()\n        if (host && host !== selfHost) {\n          if (SEARCH_HOSTS.some((h) => host.includes(h))) source = 'organic'\n          else if (SOCIAL_HOSTS.some((h) => host.includes(h))) source = 'social'\n          else source = 'referral'\n        }\n      } catch {\n        /* malformed referer — stays 'direct' */\n      }\n    }\n  }\n\n  return {\n    visitorType: opts.hadVisitorCookie ? 'returning' : 'new',\n    source,\n    campaign: campaign || null,\n  }\n}\n\n/**\n * Compact, cookie-safe encoding: `\"<visitorType>|<source>|<campaign>\"`, e.g.\n * `\"new|paid|spring_sale\"`. Campaign is sanitized to `[A-Za-z0-9_-]` and capped.\n * Decode with {@link decodeSegment}.\n */\nexport function encodeSegment(seg: VisitorSegment): string {\n  const campaign = (seg.campaign || '').replace(/[^a-zA-Z0-9_-]/g, '').slice(0, 40)\n  return `${seg.visitorType}|${seg.source}|${campaign}`\n}\n\n/** Parse a `_sk_seg` cookie value produced by {@link encodeSegment}. */\nexport function decodeSegment(value: string | undefined | null): VisitorSegment | null {\n  if (!value) return null\n  const [visitorType, source, campaign] = value.split('|')\n  if (visitorType !== 'new' && visitorType !== 'returning') return null\n  return {\n    visitorType,\n    source: (['paid', 'organic', 'social', 'referral', 'direct'].includes(source) ? source : 'direct') as SegmentSource,\n    campaign: campaign || null,\n  }\n}\n","/**\n * @sonordev/site-kit/middleware\n *\n * Composable Next.js middleware factory. Handles:\n * - Portal-managed redirects (via existing handleManagedRedirects)\n * - Security headers (X-Frame-Options, CSP, etc.)\n * - Optional before/after hooks for custom logic\n *\n * @example\n * ```ts\n * // middleware.ts — entire file\n * import { createMiddleware, siteKitMatcher } from '@sonordev/site-kit/middleware'\n *\n * export default createMiddleware()\n * export const config = siteKitMatcher\n * ```\n *\n * @example With custom hooks:\n * ```ts\n * export default createMiddleware({\n *   securityHeaders: { frameOptions: 'SAMEORIGIN' },\n *   before: (req) => {\n *     // Custom auth check, etc.\n *   },\n * })\n * ```\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport {\n  handleManagedRedirects,\n  type RedirectConfig,\n} from '../redirects'\nimport {\n  buildSecurityHeaders,\n  type SecurityHeadersConfig,\n} from './securityHeaders'\nimport { buildAiDiscoveryHeaders } from '../llms/discovery-headers'\nimport { resolveVisitorSegment, encodeSegment } from './segment'\n// Single source of truth for v4 UUIDs — Web Crypto in the edge runtime, with a\n// non-throwing fallback everywhere else. Do NOT re-fork ID generation here.\nimport { uuid } from '../shared/uuid'\n\nexport type { SecurityHeadersConfig } from './securityHeaders'\nexport {\n  resolveVisitorSegment,\n  encodeSegment,\n  decodeSegment,\n  type VisitorSegment,\n  type SegmentSource,\n} from './segment'\n\nexport interface IdentityConfig {\n  /**\n   * Also resolve + persist a coarse visitor segment (new-vs-returning + source\n   * + campaign) into the `_sk_seg` cookie, for segment-aware slots /\n   * personalization. Default: true (when identity is enabled).\n   */\n  segment?: boolean\n  /** Days the `_sk_vid` visitor cookie persists. Default: 730 (~2 years). */\n  cookieMaxAgeDays?: number\n}\n\nexport interface LlmsDiscoveryConfig {\n  /** Canonical site origin, e.g. `https://example.com` */\n  siteUrl: string\n  /** Path to llms.txt (default `/llms.txt`) */\n  llmsPath?: string\n}\n\nexport interface SiteKitMiddlewareConfig {\n  /** Enable Portal-managed redirects. Default: true */\n  redirects?: boolean | RedirectConfig\n  /** Enable security headers. Default: true */\n  securityHeaders?: boolean | SecurityHeadersConfig\n  /**\n   * Opt-in: inject `Link: <...>; rel=\"describedby\"` header on HTML responses\n   * pointing to /llms.txt for AI crawler discovery (RFC 8288).\n   * Preferred over visible footer links.\n   */\n  llmsDiscovery?: LlmsDiscoveryConfig | false\n  /**\n   * Opt-in EDGE IDENTITY pass. When enabled, the middleware ensures a\n   * first-party `_sk_vid` visitor cookie exists (server-authoritative id) and\n   * resolves the visitor segment into `_sk_seg`, so server-rendered slots and\n   * personalization can read identity + segment without re-parsing the request.\n   * Purely additive — it only writes cookies, never changes the rendered HTML,\n   * so it is LCP/static-safe. Default: OFF (sites opt in for 3.0 personalization).\n   *\n   * NOTE: to make these the SAME id the client uses, the shared identity helper\n   * must read `_sk_vid` cookie-first (a follow-on change validated with a live\n   * preview); until then the cookie is the server-side mirror.\n   */\n  identity?: boolean | IdentityConfig\n  /**\n   * Hook that runs BEFORE redirect check.\n   * Return a NextResponse to short-circuit, or undefined to continue.\n   */\n  before?: (\n    request: NextRequest,\n  ) => NextResponse | undefined | Promise<NextResponse | undefined>\n  /**\n   * Hook that runs AFTER all processing.\n   * Receives the response that will be sent — mutate headers, etc.\n   */\n  after?: (\n    request: NextRequest,\n    response: NextResponse,\n  ) => NextResponse | Promise<NextResponse>\n}\n\n/**\n * Create a fully-featured Next.js middleware function.\n *\n * With zero config this handles redirects + security headers automatically.\n */\nexport function createMiddleware(config?: SiteKitMiddlewareConfig) {\n  const securityHeaders = buildSecurityHeaders(\n    config?.securityHeaders,\n  )\n\n  // Pre-compute discovery headers (static per middleware instance)\n  const discoveryHeaders: Record<string, string> =\n    config?.llmsDiscovery\n      ? buildAiDiscoveryHeaders({\n          siteUrl: config.llmsDiscovery.siteUrl,\n          llmsPath: config.llmsDiscovery.llmsPath,\n        })\n      : {}\n\n  return async function proxy(\n    request: NextRequest,\n  ): Promise<NextResponse> {\n    // 1. Run user's 'before' hook\n    if (config?.before) {\n      const earlyResponse = await config.before(request)\n      if (earlyResponse) {\n        // Apply security headers even to early responses\n        applyHeaders(earlyResponse, securityHeaders)\n        return earlyResponse\n      }\n    }\n\n    // 2. Check Portal-managed redirects (unless disabled)\n    if (config?.redirects !== false) {\n      const redirectConfig: RedirectConfig =\n        typeof config?.redirects === 'object'\n          ? config.redirects\n          : {}\n\n      const redirect = await handleManagedRedirects(\n        request,\n        redirectConfig,\n      )\n      if (redirect) {\n        // Redirects get security headers too\n        applyHeaders(redirect, securityHeaders)\n        return redirect\n      }\n    }\n\n    // 3. Build the pass-through response\n    let response = NextResponse.next()\n\n    // 4. Apply security headers\n    applyHeaders(response, securityHeaders)\n\n    // 5. Apply AI discovery Link header (only on HTML-like requests, not static assets)\n    if (Object.keys(discoveryHeaders).length > 0) {\n      const accept = request.headers.get('accept') || ''\n      if (accept.includes('text/html') || accept.includes('*/*')) {\n        applyHeaders(response, discoveryHeaders)\n      }\n    }\n\n    // 5b. Edge identity pass (opt-in). Ensure a first-party `_sk_vid` visitor\n    // cookie exists and resolve the visitor segment into `_sk_seg`. Additive:\n    // only writes cookies, never changes the rendered HTML (LCP/static-safe).\n    if (config?.identity) {\n      const idCfg: IdentityConfig =\n        typeof config.identity === 'object' ? config.identity : {}\n      const hadVisitorCookie = !!request.cookies.get('_sk_vid')?.value\n      if (!hadVisitorCookie) {\n        const maxAgeDays = idCfg.cookieMaxAgeDays ?? 730\n        response.cookies.set('_sk_vid', uuid(), {\n          maxAge: maxAgeDays * 24 * 60 * 60,\n          path: '/',\n          sameSite: 'lax',\n          secure: true,\n        })\n      }\n      if (idCfg.segment !== false) {\n        const segment = encodeSegment(\n          resolveVisitorSegment(request, { hadVisitorCookie }),\n        )\n        response.cookies.set('_sk_seg', segment, {\n          // Session-ish: a fresh campaign / source on a later visit re-segments.\n          maxAge: 30 * 60,\n          path: '/',\n          sameSite: 'lax',\n          secure: true,\n        })\n      }\n    }\n\n    // 6. Run user's 'after' hook\n    if (config?.after) {\n      response = await config.after(request, response)\n    }\n\n    return response\n  }\n}\n\nfunction applyHeaders(\n  response: NextResponse,\n  headers: Record<string, string>,\n): void {\n  for (const [key, value] of Object.entries(headers)) {\n    response.headers.set(key, value)\n  }\n}\n\n/**\n * Standard matcher config that excludes static assets and images.\n * Export alongside createProxy/createMiddleware in your proxy.ts.\n */\nexport const siteKitMatcher = {\n  matcher: [\n    '/((?!_next/static|_next/image|favicon\\\\.ico|.*\\\\.(?:ico|png|jpg|jpeg|gif|webp|svg|woff2?)$).*)',\n  ],\n}\n\n/** Next.js 16+ alias — same as createMiddleware, named for the proxy convention. */\nexport const createProxy = createMiddleware\n"]}