@sonordev/site-kit 3.7.0 → 3.8.1

package/dist/middleware/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/middleware/segment.ts","../../src/middleware/index.ts"],"names":[],"mappings":";;;;;;;;;AAyBA,IAAM,YAAA,GAAe,CAAC,KAAA,EAAO,KAAA,EAAO,QAAQ,YAAA,EAAc,aAAA,EAAe,SAAA,EAAW,KAAA,EAAO,QAAQ,CAAA;AACnG,IAAM,cAAA,GAAiB,CAAC,QAAA,EAAU,cAAA,EAAgB,gBAAgB,IAAI,CAAA;AACtE,IAAM,YAAA,GAAe;AAAA,EACnB,WAAA;AAAA,EACA,YAAA;AAAA,EACA,WAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;AACA,IAAM,YAAA,GAAe,CAAC,SAAA,EAAW,OAAA,EAAS,eAAe,QAAA,EAAU,SAAA,EAAW,QAAA,EAAU,QAAA,EAAU,SAAS,CAAA;AAMpG,SAAS,qBAAA,CACd,SACA,IAAA,EACgB;AAChB,EAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,YAAA;AAC/B,EAAA,MAAM,MAAA,GAAA,CAAU,OAAO,GAAA,CAAI,YAAY,KAAK,EAAA,EAAI,WAAA,GAAc,IAAA,EAAK;AACnE,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,cAAc,CAAA;AAE1C,EAAA,IAAI,MAAA,GAAwB,QAAA;AAE5B,EAAA,IAAI,YAAA,CAAa,QAAA,CAAS,MAAM,CAAA,EAAG;AACjC,IAAA,MAAA,GAAS,MAAA;AAAA,EACX,CAAA,MAAA,IAAW,cAAA,CAAe,QAAA,CAAS,MAAM,CAAA,EAAG;AAC1C,IAAA,MAAA,GAAS,QAAA;AAAA,EACX,CAAA,MAAA,IAAW,WAAW,SAAA,EAAW;AAC/B,IAAA,MAAA,GAAS,SAAA;AAAA,EACX,CAAA,MAAA,IAAW,WAAW,UAAA,EAAY;AAChC,IAAA,MAAA,GAAS,UAAA;AAAA,EACX,CAAA,MAAA,IAAW,MAAA,CAAO,GAAA,CAAI,YAAY,CAAA,IAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,IAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG;AAElF,IAAA,IAAI,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,EAAG,MAAA,GAAS,MAAA;AAAA,SAAA,IACzB,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG,MAAA,GAAS,QAAA;AAAA,SACnC,MAAA,GAAS,UAAA;AAAA,EAChB,CAAA,MAAO;AAEL,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,IAAK,EAAA;AAC9C,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,KAAK,WAAA,EAAY;AAC3C,QAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,WAAA,EAAY;AAClD,QAAA,IAAI,IAAA,IAAQ,SAAS,QAAA,EAAU;AAC7B,UAAA,IAAI,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,MAAA,GAAS,SAAA;AAAA,eAAA,IAChD,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,MAAA,GAAS,QAAA;AAAA,eACzD,MAAA,GAAS,UAAA;AAAA,QAChB;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,IAAA,CAAK,gBAAA,GAAmB,WAAA,GAAc,KAAA;AAAA,IACnD,MAAA;AAAA,IACA,UAAU,QAAA,IAAY;AAAA,GACxB;AACF;AAOO,SAAS,cAAc,GAAA,EAA6B;AACzD,EAAA,MAAM,QAAA,GAAA,CAAY,GAAA,CAAI,QAAA,IAAY,EAAA,EAAI,OAAA,CAAQ,mBAAmB,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAChF,EAAA,OAAO,GAAG,GAAA,CAAI,WAAW,IAAI,GAAA,CAAI,MAAM,IAAI,QAAQ,CAAA,CAAA;AACrD;AAGO,SAAS,cAAc,KAAA,EAAyD;AACrF,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,CAAC,WAAA,EAAa,MAAA,EAAQ,QAAQ,CAAA,GAAI,KAAA,CAAM,MAAM,GAAG,CAAA;AACvD,EAAA,IAAI,WAAA,KAAgB,KAAA,IAAS,WAAA,KAAgB,WAAA,EAAa,OAAO,IAAA;AACjE,EAAA,OAAO;AAAA,IACL,WAAA;AAAA,IACA,MAAA,EAAS,CAAC,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,UAAA,EAAY,QAAQ,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,GAAI,MAAA,GAAS,QAAA;AAAA,IACzF,UAAU,QAAA,IAAY;AAAA,GACxB;AACF;;;ACGO,SAAS,iBAAiB,MAAA,EAAkC;AACjE,EAAA,MAAM,eAAA,GAAkB,oBAAA;AAAA,IACtB,MAAA,EAAQ;AAAA,GACV;AAGA,EAAA,MAAM,gBAAA,GACJ,MAAA,EAAQ,aAAA,GACJ,uBAAA,CAAwB;AAAA,IACtB,OAAA,EAAS,OAAO,aAAA,CAAc,OAAA;AAAA,IAC9B,QAAA,EAAU,OAAO,aAAA,CAAc;AAAA,GAChC,IACD,EAAC;AAEP,EAAA,OAAO,eAAe,MACpB,OAAA,EACuB;AAEvB,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,MAAM,aAAA,GAAgB,MAAM,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA;AACjD,MAAA,IAAI,aAAA,EAAe;AAEjB,QAAA,YAAA,CAAa,eAAe,eAAe,CAAA;AAC3C,QAAA,OAAO,aAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,MAAA,EAAQ,cAAc,KAAA,EAAO;AAC/B,MAAA,MAAM,iBACJ,OAAO,MAAA,EAAQ,cAAc,QAAA,GACzB,MAAA,CAAO,YACP,EAAC;AAEP,MAAA,MAAM,WAAW,MAAM,sBAAA;AAAA,QACrB,OAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,QAAA,EAAU;AAEZ,QAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AACtC,QAAA,OAAO,QAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,QAAA,GAAW,aAAa,IAAA,EAAK;AAGjC,IAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AAGtC,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,gBAAgB,CAAA,CAAE,SAAS,CAAA,EAAG;AAC5C,MAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA,IAAK,EAAA;AAChD,MAAA,IAAI,OAAO,QAAA,CAAS,WAAW,KAAK,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AAC1D,QAAA,YAAA,CAAa,UAAU,gBAAgB,CAAA;AAAA,MACzC;AAAA,IACF;AAKA,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,MAAM,QACJ,OAAO,MAAA,CAAO,aAAa,QAAA,GAAW,MAAA,CAAO,WAAW,EAAC;AAC3D,MAAA,MAAM,mBAAmB,CAAC,CAAC,QAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,EAAG,KAAA;AAC3D,MAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,QAAA,MAAM,UAAA,GAAa,MAAM,gBAAA,IAAoB,GAAA;AAC7C,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,SAAA,EAAW,IAAA,EAAK,EAAG;AAAA,UACtC,MAAA,EAAQ,UAAA,GAAa,EAAA,GAAK,EAAA,GAAK,EAAA;AAAA,UAC/B,IAAA,EAAM,GAAA;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AACA,MAAA,IAAI,KAAA,CAAM,YAAY,KAAA,EAAO;AAC3B,QAAA,MAAM,OAAA,GAAU,aAAA;AAAA,UACd,qBAAA,CAAsB,OAAA,EAAS,EAAE,gBAAA,EAAkB;AAAA,SACrD;AACA,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,SAAA,EAAW,OAAA,EAAS;AAAA;AAAA,UAEvC,QAAQ,EAAA,GAAK,EAAA;AAAA,UACb,IAAA,EAAM,GAAA;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AAAA,IACF;AAGA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,QAAA,GAAW,MAAM,MAAA,CAAO,KAAA,CAAM,OAAA,EAAS,QAAQ,CAAA;AAAA,IACjD;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AAEA,SAAS,YAAA,CACP,UACA,OAAA,EACM;AACN,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,IAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,EACjC;AACF;AAMO,IAAM,cAAA,GAAiB;AAAA,EAC5B,OAAA,EAAS;AAAA,IACP;AAAA;AAEJ;AAGO,IAAM,WAAA,GAAc","file":"index.mjs","sourcesContent":["/**\n * @sonordev/site-kit/middleware — visitor segment resolution (the \"one edge pass\").\n *\n * Pure, edge-runtime-safe helpers that classify a request into a coarse visitor\n * segment (new-vs-returning + marketing source + campaign) from the URL's UTM\n * params and the referrer. The middleware writes the result to the `_sk_seg`\n * cookie so server-rendered slots / personalization can vary by segment WITHOUT\n * each one re-parsing the request. Resolved once, at the edge.\n *\n * Kept side-effect-free (no NextResponse, no cookie writes) so it is trivially\n * unit-testable and reusable.\n */\nimport type { NextRequest } from 'next/server'\n\nexport type SegmentSource = 'paid' | 'organic' | 'social' | 'referral' | 'direct'\n\nexport interface VisitorSegment {\n  /** `new` on the first visit (no prior `_sk_vid` cookie), else `returning`. */\n  visitorType: 'new' | 'returning'\n  /** Marketing source bucket derived from UTM medium/source, then referrer. */\n  source: SegmentSource\n  /** `utm_campaign`, if present (sanitized when encoded). */\n  campaign: string | null\n}\n\nconst PAID_MEDIUMS = ['cpc', 'ppc', 'paid', 'paidsearch', 'paid-search', 'display', 'cpm', 'banner']\nconst SOCIAL_MEDIUMS = ['social', 'social-media', 'social_media', 'sm']\nconst SOCIAL_HOSTS = [\n  'facebook.',\n  'instagram.',\n  'linkedin.',\n  't.co',\n  'twitter.',\n  'x.com',\n  'pinterest.',\n  'tiktok.',\n  'youtube.',\n  'reddit.',\n]\nconst SEARCH_HOSTS = ['google.', 'bing.', 'duckduckgo.', 'yahoo.', 'ecosia.', 'brave.', 'baidu.', 'yandex.']\n\n/**\n * Classify `request` into a {@link VisitorSegment}. UTM params win over the\n * referrer; a same-host referrer is ignored (internal navigation, not a source).\n */\nexport function resolveVisitorSegment(\n  request: NextRequest,\n  opts: { hadVisitorCookie: boolean },\n): VisitorSegment {\n  const params = request.nextUrl.searchParams\n  const medium = (params.get('utm_medium') || '').toLowerCase().trim()\n  const campaign = params.get('utm_campaign')\n\n  let source: SegmentSource = 'direct'\n\n  if (PAID_MEDIUMS.includes(medium)) {\n    source = 'paid'\n  } else if (SOCIAL_MEDIUMS.includes(medium)) {\n    source = 'social'\n  } else if (medium === 'organic') {\n    source = 'organic'\n  } else if (medium === 'referral') {\n    source = 'referral'\n  } else if (params.get('utm_source') || params.get('gclid') || params.get('fbclid')) {\n    // A tagged link with a non-standard medium: gclid => paid Google, fbclid => social.\n    if (params.get('gclid')) source = 'paid'\n    else if (params.get('fbclid')) source = 'social'\n    else source = 'referral'\n  } else {\n    // No campaign tagging — fall back to the referrer host.\n    const ref = request.headers.get('referer') || ''\n    if (ref) {\n      try {\n        const host = new URL(ref).host.toLowerCase()\n        const selfHost = request.nextUrl.host.toLowerCase()\n        if (host && host !== selfHost) {\n          if (SEARCH_HOSTS.some((h) => host.includes(h))) source = 'organic'\n          else if (SOCIAL_HOSTS.some((h) => host.includes(h))) source = 'social'\n          else source = 'referral'\n        }\n      } catch {\n        /* malformed referer — stays 'direct' */\n      }\n    }\n  }\n\n  return {\n    visitorType: opts.hadVisitorCookie ? 'returning' : 'new',\n    source,\n    campaign: campaign || null,\n  }\n}\n\n/**\n * Compact, cookie-safe encoding: `\"<visitorType>|<source>|<campaign>\"`, e.g.\n * `\"new|paid|spring_sale\"`. Campaign is sanitized to `[A-Za-z0-9_-]` and capped.\n * Decode with {@link decodeSegment}.\n */\nexport function encodeSegment(seg: VisitorSegment): string {\n  const campaign = (seg.campaign || '').replace(/[^a-zA-Z0-9_-]/g, '').slice(0, 40)\n  return `${seg.visitorType}|${seg.source}|${campaign}`\n}\n\n/** Parse a `_sk_seg` cookie value produced by {@link encodeSegment}. */\nexport function decodeSegment(value: string | undefined | null): VisitorSegment | null {\n  if (!value) return null\n  const [visitorType, source, campaign] = value.split('|')\n  if (visitorType !== 'new' && visitorType !== 'returning') return null\n  return {\n    visitorType,\n    source: (['paid', 'organic', 'social', 'referral', 'direct'].includes(source) ? source : 'direct') as SegmentSource,\n    campaign: campaign || null,\n  }\n}\n","/**\n * @sonordev/site-kit/middleware\n *\n * Composable Next.js middleware factory. Handles:\n * - Portal-managed redirects (via existing handleManagedRedirects)\n * - Security headers (X-Frame-Options, CSP, etc.)\n * - Optional before/after hooks for custom logic\n *\n * @example\n * ```ts\n * // middleware.ts — entire file\n * import { createMiddleware, siteKitMatcher } from '@sonordev/site-kit/middleware'\n *\n * export default createMiddleware()\n * export const config = siteKitMatcher\n * ```\n *\n * @example With custom hooks:\n * ```ts\n * export default createMiddleware({\n *   securityHeaders: { frameOptions: 'SAMEORIGIN' },\n *   before: (req) => {\n *     // Custom auth check, etc.\n *   },\n * })\n * ```\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport {\n  handleManagedRedirects,\n  type RedirectConfig,\n} from '../redirects'\nimport {\n  buildSecurityHeaders,\n  type SecurityHeadersConfig,\n} from './securityHeaders'\nimport { buildAiDiscoveryHeaders } from '../llms/discovery-headers'\nimport { resolveVisitorSegment, encodeSegment } from './segment'\n// Single source of truth for v4 UUIDs — Web Crypto in the edge runtime, with a\n// non-throwing fallback everywhere else. Do NOT re-fork ID generation here.\nimport { uuid } from '../shared/uuid'\n\nexport type { SecurityHeadersConfig } from './securityHeaders'\nexport {\n  resolveVisitorSegment,\n  encodeSegment,\n  decodeSegment,\n  type VisitorSegment,\n  type SegmentSource,\n} from './segment'\n\nexport interface IdentityConfig {\n  /**\n   * Also resolve + persist a coarse visitor segment (new-vs-returning + source\n   * + campaign) into the `_sk_seg` cookie, for segment-aware slots /\n   * personalization. Default: true (when identity is enabled).\n   */\n  segment?: boolean\n  /** Days the `_sk_vid` visitor cookie persists. Default: 730 (~2 years). */\n  cookieMaxAgeDays?: number\n}\n\nexport interface LlmsDiscoveryConfig {\n  /** Canonical site origin, e.g. `https://example.com` */\n  siteUrl: string\n  /** Path to llms.txt (default `/llms.txt`) */\n  llmsPath?: string\n}\n\nexport interface SiteKitMiddlewareConfig {\n  /** Enable Portal-managed redirects. Default: true */\n  redirects?: boolean | RedirectConfig\n  /** Enable security headers. Default: true */\n  securityHeaders?: boolean | SecurityHeadersConfig\n  /**\n   * Opt-in: inject `Link: <...>; rel=\"describedby\"` header on HTML responses\n   * pointing to /llms.txt for AI crawler discovery (RFC 8288).\n   * Preferred over visible footer links.\n   */\n  llmsDiscovery?: LlmsDiscoveryConfig | false\n  /**\n   * Opt-in EDGE IDENTITY pass. When enabled, the middleware ensures a\n   * first-party `_sk_vid` visitor cookie exists (server-authoritative id) and\n   * resolves the visitor segment into `_sk_seg`, so server-rendered slots and\n   * personalization can read identity + segment without re-parsing the request.\n   * Purely additive — it only writes cookies, never changes the rendered HTML,\n   * so it is LCP/static-safe. Default: OFF (sites opt in for 3.0 personalization).\n   *\n   * NOTE: to make these the SAME id the client uses, the shared identity helper\n   * must read `_sk_vid` cookie-first (a follow-on change validated with a live\n   * preview); until then the cookie is the server-side mirror.\n   */\n  identity?: boolean | IdentityConfig\n  /**\n   * Hook that runs BEFORE redirect check.\n   * Return a NextResponse to short-circuit, or undefined to continue.\n   */\n  before?: (\n    request: NextRequest,\n  ) => NextResponse | undefined | Promise<NextResponse | undefined>\n  /**\n   * Hook that runs AFTER all processing.\n   * Receives the response that will be sent — mutate headers, etc.\n   */\n  after?: (\n    request: NextRequest,\n    response: NextResponse,\n  ) => NextResponse | Promise<NextResponse>\n}\n\n/**\n * Create a fully-featured Next.js middleware function.\n *\n * With zero config this handles redirects + security headers automatically.\n */\nexport function createMiddleware(config?: SiteKitMiddlewareConfig) {\n  const securityHeaders = buildSecurityHeaders(\n    config?.securityHeaders,\n  )\n\n  // Pre-compute discovery headers (static per middleware instance)\n  const discoveryHeaders: Record<string, string> =\n    config?.llmsDiscovery\n      ? buildAiDiscoveryHeaders({\n          siteUrl: config.llmsDiscovery.siteUrl,\n          llmsPath: config.llmsDiscovery.llmsPath,\n        })\n      : {}\n\n  return async function proxy(\n    request: NextRequest,\n  ): Promise<NextResponse> {\n    // 1. Run user's 'before' hook\n    if (config?.before) {\n      const earlyResponse = await config.before(request)\n      if (earlyResponse) {\n        // Apply security headers even to early responses\n        applyHeaders(earlyResponse, securityHeaders)\n        return earlyResponse\n      }\n    }\n\n    // 2. Check Portal-managed redirects (unless disabled)\n    if (config?.redirects !== false) {\n      const redirectConfig: RedirectConfig =\n        typeof config?.redirects === 'object'\n          ? config.redirects\n          : {}\n\n      const redirect = await handleManagedRedirects(\n        request,\n        redirectConfig,\n      )\n      if (redirect) {\n        // Redirects get security headers too\n        applyHeaders(redirect, securityHeaders)\n        return redirect\n      }\n    }\n\n    // 3. Build the pass-through response\n    let response = NextResponse.next()\n\n    // 4. Apply security headers\n    applyHeaders(response, securityHeaders)\n\n    // 5. Apply AI discovery Link header (only on HTML-like requests, not static assets)\n    if (Object.keys(discoveryHeaders).length > 0) {\n      const accept = request.headers.get('accept') || ''\n      if (accept.includes('text/html') || accept.includes('*/*')) {\n        applyHeaders(response, discoveryHeaders)\n      }\n    }\n\n    // 5b. Edge identity pass (opt-in). Ensure a first-party `_sk_vid` visitor\n    // cookie exists and resolve the visitor segment into `_sk_seg`. Additive:\n    // only writes cookies, never changes the rendered HTML (LCP/static-safe).\n    if (config?.identity) {\n      const idCfg: IdentityConfig =\n        typeof config.identity === 'object' ? config.identity : {}\n      const hadVisitorCookie = !!request.cookies.get('_sk_vid')?.value\n      if (!hadVisitorCookie) {\n        const maxAgeDays = idCfg.cookieMaxAgeDays ?? 730\n        response.cookies.set('_sk_vid', uuid(), {\n          maxAge: maxAgeDays * 24 * 60 * 60,\n          path: '/',\n          sameSite: 'lax',\n          secure: true,\n        })\n      }\n      if (idCfg.segment !== false) {\n        const segment = encodeSegment(\n          resolveVisitorSegment(request, { hadVisitorCookie }),\n        )\n        response.cookies.set('_sk_seg', segment, {\n          // Session-ish: a fresh campaign / source on a later visit re-segments.\n          maxAge: 30 * 60,\n          path: '/',\n          sameSite: 'lax',\n          secure: true,\n        })\n      }\n    }\n\n    // 6. Run user's 'after' hook\n    if (config?.after) {\n      response = await config.after(request, response)\n    }\n\n    return response\n  }\n}\n\nfunction applyHeaders(\n  response: NextResponse,\n  headers: Record<string, string>,\n): void {\n  for (const [key, value] of Object.entries(headers)) {\n    response.headers.set(key, value)\n  }\n}\n\n/**\n * Standard matcher config that excludes static assets and images.\n * Export alongside createProxy/createMiddleware in your proxy.ts.\n */\nexport const siteKitMatcher = {\n  matcher: [\n    '/((?!_next/static|_next/image|favicon\\\\.ico|.*\\\\.(?:ico|png|jpg|jpeg|gif|webp|svg|woff2?)$).*)',\n  ],\n}\n\n/** Next.js 16+ alias — same as createMiddleware, named for the proxy convention. */\nexport const createProxy = createMiddleware\n"]}
+{"version":3,"sources":["../../src/middleware/segment.ts","../../src/middleware/index.ts"],"names":[],"mappings":";;;;;;;;;;AAyBA,IAAM,YAAA,GAAe,CAAC,KAAA,EAAO,KAAA,EAAO,QAAQ,YAAA,EAAc,aAAA,EAAe,SAAA,EAAW,KAAA,EAAO,QAAQ,CAAA;AACnG,IAAM,cAAA,GAAiB,CAAC,QAAA,EAAU,cAAA,EAAgB,gBAAgB,IAAI,CAAA;AACtE,IAAM,YAAA,GAAe;AAAA,EACnB,WAAA;AAAA,EACA,YAAA;AAAA,EACA,WAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;AACA,IAAM,YAAA,GAAe,CAAC,SAAA,EAAW,OAAA,EAAS,eAAe,QAAA,EAAU,SAAA,EAAW,QAAA,EAAU,QAAA,EAAU,SAAS,CAAA;AAMpG,SAAS,qBAAA,CACd,SACA,IAAA,EACgB;AAChB,EAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,YAAA;AAC/B,EAAA,MAAM,MAAA,GAAA,CAAU,OAAO,GAAA,CAAI,YAAY,KAAK,EAAA,EAAI,WAAA,GAAc,IAAA,EAAK;AACnE,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,cAAc,CAAA;AAE1C,EAAA,IAAI,MAAA,GAAwB,QAAA;AAE5B,EAAA,IAAI,YAAA,CAAa,QAAA,CAAS,MAAM,CAAA,EAAG;AACjC,IAAA,MAAA,GAAS,MAAA;AAAA,EACX,CAAA,MAAA,IAAW,cAAA,CAAe,QAAA,CAAS,MAAM,CAAA,EAAG;AAC1C,IAAA,MAAA,GAAS,QAAA;AAAA,EACX,CAAA,MAAA,IAAW,WAAW,SAAA,EAAW;AAC/B,IAAA,MAAA,GAAS,SAAA;AAAA,EACX,CAAA,MAAA,IAAW,WAAW,UAAA,EAAY;AAChC,IAAA,MAAA,GAAS,UAAA;AAAA,EACX,CAAA,MAAA,IAAW,MAAA,CAAO,GAAA,CAAI,YAAY,CAAA,IAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,IAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG;AAElF,IAAA,IAAI,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,EAAG,MAAA,GAAS,MAAA;AAAA,SAAA,IACzB,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG,MAAA,GAAS,QAAA;AAAA,SACnC,MAAA,GAAS,UAAA;AAAA,EAChB,CAAA,MAAO;AAEL,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,IAAK,EAAA;AAC9C,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,KAAK,WAAA,EAAY;AAC3C,QAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,WAAA,EAAY;AAClD,QAAA,IAAI,IAAA,IAAQ,SAAS,QAAA,EAAU;AAC7B,UAAA,IAAI,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,MAAA,GAAS,SAAA;AAAA,eAAA,IAChD,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,MAAA,GAAS,QAAA;AAAA,eACzD,MAAA,GAAS,UAAA;AAAA,QAChB;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,IAAA,CAAK,gBAAA,GAAmB,WAAA,GAAc,KAAA;AAAA,IACnD,MAAA;AAAA,IACA,UAAU,QAAA,IAAY;AAAA,GACxB;AACF;AAOO,SAAS,cAAc,GAAA,EAA6B;AACzD,EAAA,MAAM,QAAA,GAAA,CAAY,GAAA,CAAI,QAAA,IAAY,EAAA,EAAI,OAAA,CAAQ,mBAAmB,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAChF,EAAA,OAAO,GAAG,GAAA,CAAI,WAAW,IAAI,GAAA,CAAI,MAAM,IAAI,QAAQ,CAAA,CAAA;AACrD;AAGO,SAAS,cAAc,KAAA,EAAyD;AACrF,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,CAAC,WAAA,EAAa,MAAA,EAAQ,QAAQ,CAAA,GAAI,KAAA,CAAM,MAAM,GAAG,CAAA;AACvD,EAAA,IAAI,WAAA,KAAgB,KAAA,IAAS,WAAA,KAAgB,WAAA,EAAa,OAAO,IAAA;AACjE,EAAA,OAAO;AAAA,IACL,WAAA;AAAA,IACA,MAAA,EAAS,CAAC,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,UAAA,EAAY,QAAQ,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,GAAI,MAAA,GAAS,QAAA;AAAA,IACzF,UAAU,QAAA,IAAY;AAAA,GACxB;AACF;;;ACIO,SAAS,iBAAiB,MAAA,EAAkC;AACjE,EAAA,MAAM,eAAA,GAAkB,oBAAA;AAAA,IACtB,MAAA,EAAQ;AAAA,GACV;AAGA,EAAA,MAAM,gBAAA,GACJ,MAAA,EAAQ,aAAA,GACJ,uBAAA,CAAwB;AAAA,IACtB,OAAA,EAAS,OAAO,aAAA,CAAc,OAAA;AAAA,IAC9B,QAAA,EAAU,OAAO,aAAA,CAAc;AAAA,GAChC,IACD,EAAC;AAEP,EAAA,OAAO,eAAe,MACpB,OAAA,EACuB;AAEvB,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,MAAM,aAAA,GAAgB,MAAM,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA;AACjD,MAAA,IAAI,aAAA,EAAe;AAEjB,QAAA,YAAA,CAAa,eAAe,eAAe,CAAA;AAC3C,QAAA,OAAO,aAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,MAAA,EAAQ,cAAc,KAAA,EAAO;AAC/B,MAAA,MAAM,iBACJ,OAAO,MAAA,EAAQ,cAAc,QAAA,GACzB,MAAA,CAAO,YACP,EAAC;AAEP,MAAA,MAAM,WAAW,MAAM,sBAAA;AAAA,QACrB,OAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,QAAA,EAAU;AAEZ,QAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AACtC,QAAA,OAAO,QAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,QAAA,GAAW,aAAa,IAAA,EAAK;AAGjC,IAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AAGtC,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,gBAAgB,CAAA,CAAE,SAAS,CAAA,EAAG;AAC5C,MAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA,IAAK,EAAA;AAChD,MAAA,IAAI,OAAO,QAAA,CAAS,WAAW,KAAK,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AAC1D,QAAA,YAAA,CAAa,UAAU,gBAAgB,CAAA;AAAA,MACzC;AAAA,IACF;AAKA,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,MAAM,QACJ,OAAO,MAAA,CAAO,aAAa,QAAA,GAAW,MAAA,CAAO,WAAW,EAAC;AAC3D,MAAA,MAAM,mBAAmB,CAAC,CAAC,QAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,EAAG,KAAA;AAC3D,MAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,QAAA,MAAM,UAAA,GAAa,MAAM,gBAAA,IAAoB,GAAA;AAC7C,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,SAAA,EAAW,IAAA,EAAK,EAAG;AAAA,UACtC,MAAA,EAAQ,UAAA,GAAa,EAAA,GAAK,EAAA,GAAK,EAAA;AAAA,UAC/B,IAAA,EAAM,GAAA;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AACA,MAAA,IAAI,KAAA,CAAM,YAAY,KAAA,EAAO;AAC3B,QAAA,MAAM,OAAA,GAAU,aAAA;AAAA,UACd,qBAAA,CAAsB,OAAA,EAAS,EAAE,gBAAA,EAAkB;AAAA,SACrD;AACA,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,SAAA,EAAW,OAAA,EAAS;AAAA;AAAA,UAEvC,QAAQ,EAAA,GAAK,EAAA;AAAA,UACb,IAAA,EAAM,GAAA;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AAAA,IACF;AAGA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,QAAA,GAAW,MAAM,MAAA,CAAO,KAAA,CAAM,OAAA,EAAS,QAAQ,CAAA;AAAA,IACjD;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AAEA,SAAS,YAAA,CACP,UACA,OAAA,EACM;AACN,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,IAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,EACjC;AACF;AAMO,IAAM,cAAA,GAAiB;AAAA,EAC5B,OAAA,EAAS;AAAA,IACP;AAAA;AAEJ;AAGO,IAAM,WAAA,GAAc","file":"index.mjs","sourcesContent":["/**\n * @sonordev/site-kit/middleware — visitor segment resolution (the \"one edge pass\").\n *\n * Pure, edge-runtime-safe helpers that classify a request into a coarse visitor\n * segment (new-vs-returning + marketing source + campaign) from the URL's UTM\n * params and the referrer. The middleware writes the result to the `_sk_seg`\n * cookie so server-rendered slots / personalization can vary by segment WITHOUT\n * each one re-parsing the request. Resolved once, at the edge.\n *\n * Kept side-effect-free (no NextResponse, no cookie writes) so it is trivially\n * unit-testable and reusable.\n */\nimport type { NextRequest } from 'next/server'\n\nexport type SegmentSource = 'paid' | 'organic' | 'social' | 'referral' | 'direct'\n\nexport interface VisitorSegment {\n  /** `new` on the first visit (no prior `_sk_vid` cookie), else `returning`. */\n  visitorType: 'new' | 'returning'\n  /** Marketing source bucket derived from UTM medium/source, then referrer. */\n  source: SegmentSource\n  /** `utm_campaign`, if present (sanitized when encoded). */\n  campaign: string | null\n}\n\nconst PAID_MEDIUMS = ['cpc', 'ppc', 'paid', 'paidsearch', 'paid-search', 'display', 'cpm', 'banner']\nconst SOCIAL_MEDIUMS = ['social', 'social-media', 'social_media', 'sm']\nconst SOCIAL_HOSTS = [\n  'facebook.',\n  'instagram.',\n  'linkedin.',\n  't.co',\n  'twitter.',\n  'x.com',\n  'pinterest.',\n  'tiktok.',\n  'youtube.',\n  'reddit.',\n]\nconst SEARCH_HOSTS = ['google.', 'bing.', 'duckduckgo.', 'yahoo.', 'ecosia.', 'brave.', 'baidu.', 'yandex.']\n\n/**\n * Classify `request` into a {@link VisitorSegment}. UTM params win over the\n * referrer; a same-host referrer is ignored (internal navigation, not a source).\n */\nexport function resolveVisitorSegment(\n  request: NextRequest,\n  opts: { hadVisitorCookie: boolean },\n): VisitorSegment {\n  const params = request.nextUrl.searchParams\n  const medium = (params.get('utm_medium') || '').toLowerCase().trim()\n  const campaign = params.get('utm_campaign')\n\n  let source: SegmentSource = 'direct'\n\n  if (PAID_MEDIUMS.includes(medium)) {\n    source = 'paid'\n  } else if (SOCIAL_MEDIUMS.includes(medium)) {\n    source = 'social'\n  } else if (medium === 'organic') {\n    source = 'organic'\n  } else if (medium === 'referral') {\n    source = 'referral'\n  } else if (params.get('utm_source') || params.get('gclid') || params.get('fbclid')) {\n    // A tagged link with a non-standard medium: gclid => paid Google, fbclid => social.\n    if (params.get('gclid')) source = 'paid'\n    else if (params.get('fbclid')) source = 'social'\n    else source = 'referral'\n  } else {\n    // No campaign tagging — fall back to the referrer host.\n    const ref = request.headers.get('referer') || ''\n    if (ref) {\n      try {\n        const host = new URL(ref).host.toLowerCase()\n        const selfHost = request.nextUrl.host.toLowerCase()\n        if (host && host !== selfHost) {\n          if (SEARCH_HOSTS.some((h) => host.includes(h))) source = 'organic'\n          else if (SOCIAL_HOSTS.some((h) => host.includes(h))) source = 'social'\n          else source = 'referral'\n        }\n      } catch {\n        /* malformed referer — stays 'direct' */\n      }\n    }\n  }\n\n  return {\n    visitorType: opts.hadVisitorCookie ? 'returning' : 'new',\n    source,\n    campaign: campaign || null,\n  }\n}\n\n/**\n * Compact, cookie-safe encoding: `\"<visitorType>|<source>|<campaign>\"`, e.g.\n * `\"new|paid|spring_sale\"`. Campaign is sanitized to `[A-Za-z0-9_-]` and capped.\n * Decode with {@link decodeSegment}.\n */\nexport function encodeSegment(seg: VisitorSegment): string {\n  const campaign = (seg.campaign || '').replace(/[^a-zA-Z0-9_-]/g, '').slice(0, 40)\n  return `${seg.visitorType}|${seg.source}|${campaign}`\n}\n\n/** Parse a `_sk_seg` cookie value produced by {@link encodeSegment}. */\nexport function decodeSegment(value: string | undefined | null): VisitorSegment | null {\n  if (!value) return null\n  const [visitorType, source, campaign] = value.split('|')\n  if (visitorType !== 'new' && visitorType !== 'returning') return null\n  return {\n    visitorType,\n    source: (['paid', 'organic', 'social', 'referral', 'direct'].includes(source) ? source : 'direct') as SegmentSource,\n    campaign: campaign || null,\n  }\n}\n","/**\n * @sonordev/site-kit/middleware\n *\n * Composable Next.js middleware factory. Handles:\n * - Portal-managed redirects (via existing handleManagedRedirects)\n * - Security headers (X-Frame-Options, CSP, etc.)\n * - Optional before/after hooks for custom logic\n *\n * @example\n * ```ts\n * // middleware.ts — entire file\n * import { createMiddleware, siteKitMatcher } from '@sonordev/site-kit/middleware'\n *\n * export default createMiddleware()\n * export const config = siteKitMatcher\n * ```\n *\n * @example With custom hooks:\n * ```ts\n * export default createMiddleware({\n *   securityHeaders: { frameOptions: 'SAMEORIGIN' },\n *   before: (req) => {\n *     // Custom auth check, etc.\n *   },\n * })\n * ```\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport {\n  handleManagedRedirects,\n  type RedirectConfig,\n} from '../redirects'\nimport {\n  buildSecurityHeaders,\n  type SecurityHeadersConfig,\n} from './securityHeaders'\nimport { buildAiDiscoveryHeaders } from '../llms/discovery-headers'\nimport { resolveVisitorSegment, encodeSegment } from './segment'\n// Single source of truth for v4 UUIDs — Web Crypto in the edge runtime, with a\n// non-throwing fallback everywhere else. Do NOT re-fork ID generation here.\nimport { uuid } from '../shared/uuid'\n\nexport type { SecurityHeadersConfig } from './securityHeaders'\nexport { DEFAULT_FRAME_ANCESTORS } from './securityHeaders'\nexport {\n  resolveVisitorSegment,\n  encodeSegment,\n  decodeSegment,\n  type VisitorSegment,\n  type SegmentSource,\n} from './segment'\n\nexport interface IdentityConfig {\n  /**\n   * Also resolve + persist a coarse visitor segment (new-vs-returning + source\n   * + campaign) into the `_sk_seg` cookie, for segment-aware slots /\n   * personalization. Default: true (when identity is enabled).\n   */\n  segment?: boolean\n  /** Days the `_sk_vid` visitor cookie persists. Default: 730 (~2 years). */\n  cookieMaxAgeDays?: number\n}\n\nexport interface LlmsDiscoveryConfig {\n  /** Canonical site origin, e.g. `https://example.com` */\n  siteUrl: string\n  /** Path to llms.txt (default `/llms.txt`) */\n  llmsPath?: string\n}\n\nexport interface SiteKitMiddlewareConfig {\n  /** Enable Portal-managed redirects. Default: true */\n  redirects?: boolean | RedirectConfig\n  /** Enable security headers. Default: true */\n  securityHeaders?: boolean | SecurityHeadersConfig\n  /**\n   * Opt-in: inject `Link: <...>; rel=\"describedby\"` header on HTML responses\n   * pointing to /llms.txt for AI crawler discovery (RFC 8288).\n   * Preferred over visible footer links.\n   */\n  llmsDiscovery?: LlmsDiscoveryConfig | false\n  /**\n   * Opt-in EDGE IDENTITY pass. When enabled, the middleware ensures a\n   * first-party `_sk_vid` visitor cookie exists (server-authoritative id) and\n   * resolves the visitor segment into `_sk_seg`, so server-rendered slots and\n   * personalization can read identity + segment without re-parsing the request.\n   * Purely additive — it only writes cookies, never changes the rendered HTML,\n   * so it is LCP/static-safe. Default: OFF (sites opt in for 3.0 personalization).\n   *\n   * NOTE: to make these the SAME id the client uses, the shared identity helper\n   * must read `_sk_vid` cookie-first (a follow-on change validated with a live\n   * preview); until then the cookie is the server-side mirror.\n   */\n  identity?: boolean | IdentityConfig\n  /**\n   * Hook that runs BEFORE redirect check.\n   * Return a NextResponse to short-circuit, or undefined to continue.\n   */\n  before?: (\n    request: NextRequest,\n  ) => NextResponse | undefined | Promise<NextResponse | undefined>\n  /**\n   * Hook that runs AFTER all processing.\n   * Receives the response that will be sent — mutate headers, etc.\n   */\n  after?: (\n    request: NextRequest,\n    response: NextResponse,\n  ) => NextResponse | Promise<NextResponse>\n}\n\n/**\n * Create a fully-featured Next.js middleware function.\n *\n * With zero config this handles redirects + security headers automatically.\n */\nexport function createMiddleware(config?: SiteKitMiddlewareConfig) {\n  const securityHeaders = buildSecurityHeaders(\n    config?.securityHeaders,\n  )\n\n  // Pre-compute discovery headers (static per middleware instance)\n  const discoveryHeaders: Record<string, string> =\n    config?.llmsDiscovery\n      ? buildAiDiscoveryHeaders({\n          siteUrl: config.llmsDiscovery.siteUrl,\n          llmsPath: config.llmsDiscovery.llmsPath,\n        })\n      : {}\n\n  return async function proxy(\n    request: NextRequest,\n  ): Promise<NextResponse> {\n    // 1. Run user's 'before' hook\n    if (config?.before) {\n      const earlyResponse = await config.before(request)\n      if (earlyResponse) {\n        // Apply security headers even to early responses\n        applyHeaders(earlyResponse, securityHeaders)\n        return earlyResponse\n      }\n    }\n\n    // 2. Check Portal-managed redirects (unless disabled)\n    if (config?.redirects !== false) {\n      const redirectConfig: RedirectConfig =\n        typeof config?.redirects === 'object'\n          ? config.redirects\n          : {}\n\n      const redirect = await handleManagedRedirects(\n        request,\n        redirectConfig,\n      )\n      if (redirect) {\n        // Redirects get security headers too\n        applyHeaders(redirect, securityHeaders)\n        return redirect\n      }\n    }\n\n    // 3. Build the pass-through response\n    let response = NextResponse.next()\n\n    // 4. Apply security headers\n    applyHeaders(response, securityHeaders)\n\n    // 5. Apply AI discovery Link header (only on HTML-like requests, not static assets)\n    if (Object.keys(discoveryHeaders).length > 0) {\n      const accept = request.headers.get('accept') || ''\n      if (accept.includes('text/html') || accept.includes('*/*')) {\n        applyHeaders(response, discoveryHeaders)\n      }\n    }\n\n    // 5b. Edge identity pass (opt-in). Ensure a first-party `_sk_vid` visitor\n    // cookie exists and resolve the visitor segment into `_sk_seg`. Additive:\n    // only writes cookies, never changes the rendered HTML (LCP/static-safe).\n    if (config?.identity) {\n      const idCfg: IdentityConfig =\n        typeof config.identity === 'object' ? config.identity : {}\n      const hadVisitorCookie = !!request.cookies.get('_sk_vid')?.value\n      if (!hadVisitorCookie) {\n        const maxAgeDays = idCfg.cookieMaxAgeDays ?? 730\n        response.cookies.set('_sk_vid', uuid(), {\n          maxAge: maxAgeDays * 24 * 60 * 60,\n          path: '/',\n          sameSite: 'lax',\n          secure: true,\n        })\n      }\n      if (idCfg.segment !== false) {\n        const segment = encodeSegment(\n          resolveVisitorSegment(request, { hadVisitorCookie }),\n        )\n        response.cookies.set('_sk_seg', segment, {\n          // Session-ish: a fresh campaign / source on a later visit re-segments.\n          maxAge: 30 * 60,\n          path: '/',\n          sameSite: 'lax',\n          secure: true,\n        })\n      }\n    }\n\n    // 6. Run user's 'after' hook\n    if (config?.after) {\n      response = await config.after(request, response)\n    }\n\n    return response\n  }\n}\n\nfunction applyHeaders(\n  response: NextResponse,\n  headers: Record<string, string>,\n): void {\n  for (const [key, value] of Object.entries(headers)) {\n    response.headers.set(key, value)\n  }\n}\n\n/**\n * Standard matcher config that excludes static assets and images.\n * Export alongside createProxy/createMiddleware in your proxy.ts.\n */\nexport const siteKitMatcher = {\n  matcher: [\n    '/((?!_next/static|_next/image|favicon\\\\.ico|.*\\\\.(?:ico|png|jpg|jpeg|gif|webp|svg|woff2?)$).*)',\n  ],\n}\n\n/** Next.js 16+ alias — same as createMiddleware, named for the proxy convention. */\nexport const createProxy = createMiddleware\n"]}

package/dist/securityHeaders-CwsFdDcJ.d.mts

@@ -0,0 +1,49 @@
+/**
+ * Default security headers applied by site-kit middleware.
+ *
+ * These match industry best practices and are the same headers
+ * recommended by Next.js documentation. All are opt-out.
+ */
+/**
+ * Single source of truth for who may frame a site-kit site.
+ *
+ * Upforge showcases live client work inside iframes on its portfolio /
+ * area pages, so every managed marketing site has to be embeddable from
+ * upforge.io. `X-Frame-Options` cannot express an allowlist (`ALLOW-FROM`
+ * is dead and ignored by every current browser), so the CSP
+ * `frame-ancestors` directive is the only way to say "these origins and
+ * nobody else". Everything not listed here is still blocked.
+ *
+ * Do NOT re-fork this list into individual sites' middleware/next.config —
+ * add origins here and let the fleet inherit them.
+ */
+declare const DEFAULT_FRAME_ANCESTORS: string[];
+interface SecurityHeadersConfig {
+    /** X-Frame-Options value. false to disable. Default: omitted when
+     * `frameAncestors` is active (the two conflict), otherwise 'DENY'. */
+    frameOptions?: 'DENY' | 'SAMEORIGIN' | false;
+    /**
+     * Origins allowed to frame this site, emitted as a CSP `frame-ancestors`
+     * directive. Defaults to {@link DEFAULT_FRAME_ANCESTORS} ('self' + upforge.io)
+     * so Upforge can showcase the site. Pass an array to extend/replace, or
+     * `false` to opt out entirely and fall back to X-Frame-Options.
+     *
+     * Ignored if a `Content-Security-Policy` is supplied via `customHeaders` —
+     * that CSP wins, and must carry its own frame-ancestors directive.
+     */
+    frameAncestors?: string[] | false;
+    /** X-Content-Type-Options: nosniff. Default: true */
+    contentTypeOptions?: boolean;
+    /** X-XSS-Protection header. Default: true */
+    xssProtection?: boolean;
+    /** Referrer-Policy value. Default: 'strict-origin-when-cross-origin' */
+    referrerPolicy?: string;
+    /** Permissions-Policy value. Default restricts camera, microphone, geolocation */
+    permissionsPolicy?: string;
+    /** X-DNS-Prefetch-Control. Default: true (on) */
+    dnsPrefetchControl?: boolean;
+    /** Additional custom headers */
+    customHeaders?: Record<string, string>;
+}
+
+export { DEFAULT_FRAME_ANCESTORS as D, type SecurityHeadersConfig as S };

package/dist/securityHeaders-CwsFdDcJ.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Default security headers applied by site-kit middleware.
+ *
+ * These match industry best practices and are the same headers
+ * recommended by Next.js documentation. All are opt-out.
+ */
+/**
+ * Single source of truth for who may frame a site-kit site.
+ *
+ * Upforge showcases live client work inside iframes on its portfolio /
+ * area pages, so every managed marketing site has to be embeddable from
+ * upforge.io. `X-Frame-Options` cannot express an allowlist (`ALLOW-FROM`
+ * is dead and ignored by every current browser), so the CSP
+ * `frame-ancestors` directive is the only way to say "these origins and
+ * nobody else". Everything not listed here is still blocked.
+ *
+ * Do NOT re-fork this list into individual sites' middleware/next.config —
+ * add origins here and let the fleet inherit them.
+ */
+declare const DEFAULT_FRAME_ANCESTORS: string[];
+interface SecurityHeadersConfig {
+    /** X-Frame-Options value. false to disable. Default: omitted when
+     * `frameAncestors` is active (the two conflict), otherwise 'DENY'. */
+    frameOptions?: 'DENY' | 'SAMEORIGIN' | false;
+    /**
+     * Origins allowed to frame this site, emitted as a CSP `frame-ancestors`
+     * directive. Defaults to {@link DEFAULT_FRAME_ANCESTORS} ('self' + upforge.io)
+     * so Upforge can showcase the site. Pass an array to extend/replace, or
+     * `false` to opt out entirely and fall back to X-Frame-Options.
+     *
+     * Ignored if a `Content-Security-Policy` is supplied via `customHeaders` —
+     * that CSP wins, and must carry its own frame-ancestors directive.
+     */
+    frameAncestors?: string[] | false;
+    /** X-Content-Type-Options: nosniff. Default: true */
+    contentTypeOptions?: boolean;
+    /** X-XSS-Protection header. Default: true */
+    xssProtection?: boolean;
+    /** Referrer-Policy value. Default: 'strict-origin-when-cross-origin' */
+    referrerPolicy?: string;
+    /** Permissions-Policy value. Default restricts camera, microphone, geolocation */
+    permissionsPolicy?: string;
+    /** X-DNS-Prefetch-Control. Default: true (on) */
+    dnsPrefetchControl?: boolean;
+    /** Additional custom headers */
+    customHeaders?: Record<string, string>;
+}
+
+export { DEFAULT_FRAME_ANCESTORS as D, type SecurityHeadersConfig as S };

package/dist/seo/client.js

@@ -1,18 +1,18 @@
 'use client';
 'use strict';
 
-var chunkTQS2X5A3_js = require('../chunk-TQS2X5A3.js');
+var chunkTFU6J77X_js = require('../chunk-TFU6J77X.js');
 require('../chunk-JEOKDUPQ.js');
-require('../chunk-AKBGYQLC.js');
-require('../chunk-GZHLVOW3.js');
-require('../chunk-SCMHZBTN.js');
+require('../chunk-GPXUJQFX.js');
+require('../chunk-XMKZXFVX.js');
+require('../chunk-J4RBHTWC.js');
 require('../chunk-ZSMWDLMK.js');
 
 
 
 Object.defineProperty(exports, "SitemapSync", {
   enumerable: true,
-  get: function () { return chunkTQS2X5A3_js.SitemapSync; }
+  get: function () { return chunkTFU6J77X_js.SitemapSync; }
 });
 //# sourceMappingURL=client.js.map
 //# sourceMappingURL=client.js.map

package/dist/seo/client.mjs

@@ -1,9 +1,9 @@
 'use client';
-export { SitemapSync } from '../chunk-FP523A7G.mjs';
+export { SitemapSync } from '../chunk-CDW6LDLH.mjs';
 import '../chunk-QJU6HBSK.mjs';
-import '../chunk-NM7L2XKF.mjs';
-import '../chunk-QAYCRXT4.mjs';
-import '../chunk-2HH4VVJT.mjs';
+import '../chunk-HJTAHRR3.mjs';
+import '../chunk-PUZ6XJ2L.mjs';
+import '../chunk-M2SHY2FQ.mjs';
 import '../chunk-4XPGGLVP.mjs';
 //# sourceMappingURL=client.mjs.map
 //# sourceMappingURL=client.mjs.map

package/dist/seo/index.js

@@ -1,16 +1,16 @@
 'use strict';
 
 var chunkDV2LJYFD_js = require('../chunk-DV2LJYFD.js');
-var chunkATG4FJY6_js = require('../chunk-ATG4FJY6.js');
+var chunkH6AU3WKF_js = require('../chunk-H6AU3WKF.js');
 var chunkJ7QI3GDX_js = require('../chunk-J7QI3GDX.js');
-var chunkTQS2X5A3_js = require('../chunk-TQS2X5A3.js');
+var chunkTFU6J77X_js = require('../chunk-TFU6J77X.js');
 var chunkVMVEL4WU_js = require('../chunk-VMVEL4WU.js');
 var chunkQCZBXG7G_js = require('../chunk-QCZBXG7G.js');
 require('../chunk-QPIKPWAZ.js');
 require('../chunk-JEOKDUPQ.js');
-require('../chunk-AKBGYQLC.js');
-require('../chunk-GZHLVOW3.js');
-require('../chunk-SCMHZBTN.js');
+require('../chunk-GPXUJQFX.js');
+require('../chunk-XMKZXFVX.js');
+require('../chunk-J4RBHTWC.js');
 require('../chunk-ZSMWDLMK.js');
 var react = require('react');
 var jsxRuntime = require('react/jsx-runtime');
@@ -118,7 +118,7 @@ async function LLMSchemaAsync({
 }) {
   const { page: pageData, project } = await chunkQCZBXG7G_js.getSEOPageData(path);
   const raw = pageData?.managed_llm_schema;
-  const picked = chunkATG4FJY6_js.pickManagedLlmSchemaForJsonLd(raw);
+  const picked = chunkH6AU3WKF_js.pickManagedLlmSchemaForJsonLd(raw);
   if (!picked) {
     return null;
   }
@@ -687,7 +687,7 @@ Object.defineProperty(exports, "ManagedScripts", {
 });
 Object.defineProperty(exports, "SitemapSync", {
   enumerable: true,
-  get: function () { return chunkTQS2X5A3_js.SitemapSync; }
+  get: function () { return chunkTFU6J77X_js.SitemapSync; }
 });
 Object.defineProperty(exports, "generateSitemap", {
   enumerable: true,

package/dist/seo/index.mjs

@@ -1,16 +1,16 @@
 export { ManagedNoScripts, ManagedScripts } from '../chunk-6PJTLBRR.mjs';
-import { pickManagedLlmSchemaForJsonLd } from '../chunk-H23ZT2I2.mjs';
+import { pickManagedLlmSchemaForJsonLd } from '../chunk-PENNTSJE.mjs';
 import { safeJsonLd } from '../chunk-662YHKWW.mjs';
-export { SitemapSync } from '../chunk-FP523A7G.mjs';
+export { SitemapSync } from '../chunk-CDW6LDLH.mjs';
 import { getManagedMetadata } from '../chunk-QGV7FEUI.mjs';
 export { generateSitemap, getABVariant, getManagedMetadata, getManagedMetadataWithAB, getRedirect, getRobotsDirective, isIndexable } from '../chunk-QGV7FEUI.mjs';
 import { getContentBlock, getSchemaMarkups, getSEOPageData, getEntityEnhancedSchema, getFAQData, getInternalLinks, getEntities } from '../chunk-2CHOHLB7.mjs';
 export { getABTest, getContentBlock, getEntities, getEntityEnhancedSchema, getFAQData, getInternalLinks, getManagedScripts, getPrimaryEntity, getRedirectData, getRobotsData, getSEOPageData, getSchemaMarkups, getSitemapEntries, getVisibilityScore, getVisibilitySummary, recordABImpression, registerSitemap } from '../chunk-2CHOHLB7.mjs';
 import '../chunk-UDBUK5ZJ.mjs';
 import '../chunk-QJU6HBSK.mjs';
-import '../chunk-NM7L2XKF.mjs';
-import '../chunk-QAYCRXT4.mjs';
-import '../chunk-2HH4VVJT.mjs';
+import '../chunk-HJTAHRR3.mjs';
+import '../chunk-PUZ6XJ2L.mjs';
+import '../chunk-M2SHY2FQ.mjs';
 import '../chunk-4XPGGLVP.mjs';
 import { cache, Suspense } from 'react';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';

package/dist/server/index.js

@@ -1,15 +1,15 @@
 'use strict';
 
-var chunkWQ64SU6E_js = require('../chunk-WQ64SU6E.js');
+var chunkSUWDZOPH_js = require('../chunk-SUWDZOPH.js');
 var chunkQPIKPWAZ_js = require('../chunk-QPIKPWAZ.js');
-require('../chunk-SCMHZBTN.js');
+require('../chunk-J4RBHTWC.js');
 require('../chunk-ZSMWDLMK.js');
 
 
 
 Object.defineProperty(exports, "resolveClientCredential", {
   enumerable: true,
-  get: function () { return chunkWQ64SU6E_js.resolveClientCredential; }
+  get: function () { return chunkSUWDZOPH_js.resolveClientCredential; }
 });
 Object.defineProperty(exports, "requireServerApiConfig", {
   enumerable: true,

package/dist/server/index.mjs

@@ -1,6 +1,6 @@
-export { resolveClientCredential } from '../chunk-54ZC6LPR.mjs';
+export { resolveClientCredential } from '../chunk-J6MMNTYG.mjs';
 export { requireServerApiConfig, resolveApiOrigin, resolveServerApiConfig, serverApiFetch } from '../chunk-UDBUK5ZJ.mjs';
-import '../chunk-2HH4VVJT.mjs';
+import '../chunk-M2SHY2FQ.mjs';
 import '../chunk-4XPGGLVP.mjs';
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map

package/dist/signal/index.js

@@ -1,47 +1,47 @@
 'use client';
 'use strict';
 
-var chunkAUBFDSTJ_js = require('../chunk-AUBFDSTJ.js');
-var chunkR3CXRMP7_js = require('../chunk-R3CXRMP7.js');
+var chunkILCDV3MM_js = require('../chunk-ILCDV3MM.js');
+var chunkHNHZLRB6_js = require('../chunk-HNHZLRB6.js');
 require('../chunk-ZSMWDLMK.js');
 
 
 
 Object.defineProperty(exports, "ExperimentConversion", {
   enumerable: true,
-  get: function () { return chunkAUBFDSTJ_js.ExperimentConversion; }
+  get: function () { return chunkILCDV3MM_js.ExperimentConversion; }
 });
 Object.defineProperty(exports, "SignalExperiment", {
   enumerable: true,
-  get: function () { return chunkAUBFDSTJ_js.SignalExperiment; }
+  get: function () { return chunkILCDV3MM_js.SignalExperiment; }
 });
 Object.defineProperty(exports, "useExperimentVariant", {
   enumerable: true,
-  get: function () { return chunkAUBFDSTJ_js.useExperimentVariant; }
+  get: function () { return chunkILCDV3MM_js.useExperimentVariant; }
 });
 Object.defineProperty(exports, "SignalBridge", {
   enumerable: true,
-  get: function () { return chunkR3CXRMP7_js.SignalBridge; }
+  get: function () { return chunkHNHZLRB6_js.SignalBridge; }
 });
 Object.defineProperty(exports, "useSignal", {
   enumerable: true,
-  get: function () { return chunkR3CXRMP7_js.useSignal; }
+  get: function () { return chunkHNHZLRB6_js.useSignal; }
 });
 Object.defineProperty(exports, "useSignalConfig", {
   enumerable: true,
-  get: function () { return chunkR3CXRMP7_js.useSignalConfig; }
+  get: function () { return chunkHNHZLRB6_js.useSignalConfig; }
 });
 Object.defineProperty(exports, "useSignalEvent", {
   enumerable: true,
-  get: function () { return chunkR3CXRMP7_js.useSignalEvent; }
+  get: function () { return chunkHNHZLRB6_js.useSignalEvent; }
 });
 Object.defineProperty(exports, "useSignalExperiment", {
   enumerable: true,
-  get: function () { return chunkR3CXRMP7_js.useSignalExperiment; }
+  get: function () { return chunkHNHZLRB6_js.useSignalExperiment; }
 });
 Object.defineProperty(exports, "useSignalOutcome", {
   enumerable: true,
-  get: function () { return chunkR3CXRMP7_js.useSignalOutcome; }
+  get: function () { return chunkHNHZLRB6_js.useSignalOutcome; }
 });
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/signal/index.mjs

@@ -1,6 +1,6 @@
 'use client';
-export { ExperimentConversion, SignalExperiment, useExperimentVariant } from '../chunk-TZTO5CDS.mjs';
-export { SignalBridge, useSignal, useSignalConfig, useSignalEvent, useSignalExperiment, useSignalOutcome } from '../chunk-LSWTMMKJ.mjs';
+export { ExperimentConversion, SignalExperiment, useExperimentVariant } from '../chunk-IVJLQJEP.mjs';
+export { SignalBridge, useSignal, useSignalConfig, useSignalEvent, useSignalExperiment, useSignalOutcome } from '../chunk-75PY4H43.mjs';
 import '../chunk-4XPGGLVP.mjs';
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map

package/dist/sitemap/index.d.mts

@@ -1,4 +1,4 @@
-import { L as LLMsDataResponse } from '../types-DhCAWUmd.mjs';
+import { L as LLMsDataResponse, W as WriteLLMsTxtOptions } from '../writeLLMsTxt-SpMdyHQT.mjs';
 import '../llms/contract.mjs';
 
 /**
@@ -75,6 +75,13 @@ interface SitemapConfig {
     getLocalData?: () => Promise<LLMsDataResponse | null>;
     /** Pass-through to GET /api/public/llms/txt?publicSummaryOnly=true and local llms fallback */
     llmsPublicSummaryOnly?: boolean;
+    /**
+     * Site-authored sections appended to the build-time llms-full.txt (see
+     * WriteLLMsTxtOptions.customSections). Use with formatSourcedFactsSection
+     * to publish the site's verified citation registry as a "Sourced facts"
+     * section AI answer engines can quote with attribution.
+     */
+    llmsCustomSections?: WriteLLMsTxtOptions['customSections'];
     /** Use Signal AI visibility scores to compute page priority (40% visibility + 30% depth + 30% base) */
     intelligentPriority?: boolean;
     /** When true, append `/llms.txt` to sitemap (low priority). Default false. */

package/dist/sitemap/index.d.ts

@@ -1,4 +1,4 @@
-import { L as LLMsDataResponse } from '../types-xcP_owwn.js';
+import { L as LLMsDataResponse, W as WriteLLMsTxtOptions } from '../writeLLMsTxt-BFaNr4re.js';
 import '../llms/contract.js';
 
 /**
@@ -75,6 +75,13 @@ interface SitemapConfig {
     getLocalData?: () => Promise<LLMsDataResponse | null>;
     /** Pass-through to GET /api/public/llms/txt?publicSummaryOnly=true and local llms fallback */
     llmsPublicSummaryOnly?: boolean;
+    /**
+     * Site-authored sections appended to the build-time llms-full.txt (see
+     * WriteLLMsTxtOptions.customSections). Use with formatSourcedFactsSection
+     * to publish the site's verified citation registry as a "Sourced facts"
+     * section AI answer engines can quote with attribution.
+     */
+    llmsCustomSections?: WriteLLMsTxtOptions['customSections'];
     /** Use Signal AI visibility scores to compute page priority (40% visibility + 30% depth + 30% base) */
     intelligentPriority?: boolean;
     /** When true, append `/llms.txt` to sitemap (low priority). Default false. */

package/dist/sitemap/index.js

@@ -1,8 +1,8 @@
 'use strict';
 
-var chunk6T4NVCAT_js = require('../chunk-6T4NVCAT.js');
+var chunkXMBYDIV6_js = require('../chunk-XMBYDIV6.js');
 var chunkJP5WGL75_js = require('../chunk-JP5WGL75.js');
-require('../chunk-ATG4FJY6.js');
+require('../chunk-H6AU3WKF.js');
 var chunkJEOKDUPQ_js = require('../chunk-JEOKDUPQ.js');
 require('../chunk-ZSMWDLMK.js');
 var fs = require('fs');
@@ -477,13 +477,14 @@ function createSitemap(config) {
           }
           if (config.optimizedLLMsTxt !== false) {
             try {
-              const writeResult = await chunk6T4NVCAT_js.writeLLMsTxtToPublic({
+              const writeResult = await chunkXMBYDIV6_js.writeLLMsTxtToPublic({
                 apiUrl,
                 apiKey,
                 full: config.optimizedLLMsFullTxt ?? false,
                 fallbackToLocal: true,
                 getLocalData: config.getLocalData,
-                publicSummaryOnly: config.llmsPublicSummaryOnly
+                publicSummaryOnly: config.llmsPublicSummaryOnly,
+                customSections: config.llmsCustomSections
               });
               if (writeResult.success) {
                 console.log(`[site-kit] Wrote llms.txt (optimized=${writeResult.optimized})`);