@sonordev/site-kit 4.2.4 → 4.3.1

package/dist/ManagedForm-LVBNVUZE.mjs

@@ -1,14 +0,0 @@
-export { ManagedForm } from './chunk-L5GUV4M7.mjs';
-import './chunk-ULV3DZ27.mjs';
-import './chunk-UBSZ466T.mjs';
-import './chunk-LB7LHVWI.mjs';
-import './chunk-33OSUHPZ.mjs';
-import './chunk-E3F6OOVQ.mjs';
-import './chunk-TMVKRQGJ.mjs';
-import './chunk-6EDVCUAG.mjs';
-import './chunk-XWBQLPTZ.mjs';
-import './chunk-FSSVIYQ7.mjs';
-import './chunk-EFMPOC6L.mjs';
-import './chunk-BEXTDHO4.mjs';
-//# sourceMappingURL=ManagedForm-LVBNVUZE.mjs.map
-//# sourceMappingURL=ManagedForm-LVBNVUZE.mjs.map

package/dist/ManagedForm-YC6WLYVJ.js

@@ -1,23 +0,0 @@
-'use strict';
-
-var chunkLSNIDSLQ_js = require('./chunk-LSNIDSLQ.js');
-require('./chunk-A7O7IWL7.js');
-require('./chunk-LUXCT2NU.js');
-require('./chunk-2ACKOMAL.js');
-require('./chunk-2XLWCYB3.js');
-require('./chunk-BDDTZJKC.js');
-require('./chunk-KHPJ3CEL.js');
-require('./chunk-VJMPIRSD.js');
-require('./chunk-ZJNIM4GQ.js');
-require('./chunk-NK6K4VHD.js');
-require('./chunk-4JVFWTER.js');
-require('./chunk-SNAQBZPT.js');
-
-
-
-Object.defineProperty(exports, "ManagedForm", {
-  enumerable: true,
-  get: function () { return chunkLSNIDSLQ_js.ManagedForm; }
-});
-//# sourceMappingURL=ManagedForm-YC6WLYVJ.js.map
-//# sourceMappingURL=ManagedForm-YC6WLYVJ.js.map

package/dist/SitemapSync-2JJOGL7D.mjs

@@ -1,8 +0,0 @@
-export { SitemapSync } from './chunk-XKBADVXN.mjs';
-import './chunk-QJU6HBSK.mjs';
-import './chunk-XWBQLPTZ.mjs';
-import './chunk-FSSVIYQ7.mjs';
-import './chunk-EFMPOC6L.mjs';
-import './chunk-BEXTDHO4.mjs';
-//# sourceMappingURL=SitemapSync-2JJOGL7D.mjs.map
-//# sourceMappingURL=SitemapSync-2JJOGL7D.mjs.map

package/dist/SitemapSync-S54TSZLM.js

@@ -1,17 +0,0 @@
-'use strict';
-
-var chunkCLD3IE6D_js = require('./chunk-CLD3IE6D.js');
-require('./chunk-JEOKDUPQ.js');
-require('./chunk-ZJNIM4GQ.js');
-require('./chunk-NK6K4VHD.js');
-require('./chunk-4JVFWTER.js');
-require('./chunk-SNAQBZPT.js');
-
-
-
-Object.defineProperty(exports, "SitemapSync", {
-  enumerable: true,
-  get: function () { return chunkCLD3IE6D_js.SitemapSync; }
-});
-//# sourceMappingURL=SitemapSync-S54TSZLM.js.map
-//# sourceMappingURL=SitemapSync-S54TSZLM.js.map

package/dist/chunk-4JVFWTER.js

@@ -1,8 +0,0 @@
-'use strict';
-
-// src/shared/version.ts
-var SITE_KIT_VERSION = "4.2.4";
-
-exports.SITE_KIT_VERSION = SITE_KIT_VERSION;
-//# sourceMappingURL=chunk-4JVFWTER.js.map
-//# sourceMappingURL=chunk-4JVFWTER.js.map

package/dist/chunk-77CIIDE6.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/middleware/securityHeaders.ts"],"names":[],"mappings":";;;AAoBO,IAAM,uBAAA,GAA0B;AAAA,EACrC,QAAA;AAAA,EACA,oBAAA;AAAA,EACA;AACF;AAiCO,SAAS,qBACd,MAAA,EACwB;AACxB,EAAA,IAAI,MAAA,KAAW,KAAA,EAAO,OAAO,EAAC;AAE9B,EAAA,MAAM,CAAA,GACJ,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,EAAC;AAEzC,EAAA,MAAM,UAAkC,EAAC;AAGzC,EAAA,IAAI,CAAA,CAAE,uBAAuB,KAAA,EAAO;AAClC,IAAA,OAAA,CAAQ,wBAAwB,CAAA,GAAI,IAAA;AAAA,EACtC;AAUA,EAAA,MAAM,cAAA,GACJ,CAAA,CAAE,cAAA,KAAmB,KAAA,GACjB,IAAA,GACA,CAAA,CAAE,cAAA,IAAkB,CAAA,CAAE,cAAA,CAAe,MAAA,GAAS,CAAA,GAC5C,CAAA,CAAE,cAAA,GACF,uBAAA;AAER,EAAA,IAAI,cAAA,EAAgB;AAClB,IAAA,OAAA,CAAQ,yBAAyB,CAAA,GAC/B,CAAA,gBAAA,EAAmB,cAAA,CAAe,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA;AAE7C,IAAA,IAAI,EAAE,YAAA,EAAc;AAClB,MAAA,OAAA,CAAQ,iBAAiB,IAAI,CAAA,CAAE,YAAA;AAAA,IACjC;AAAA,EACF,CAAA,MAAA,IAAW,CAAA,CAAE,YAAA,KAAiB,KAAA,EAAO;AACnC,IAAA,OAAA,CAAQ,iBAAiB,CAAA,GAAI,CAAA,CAAE,YAAA,IAAgB,MAAA;AAAA,EACjD;AAGA,EAAA,IAAI,CAAA,CAAE,uBAAuB,KAAA,EAAO;AAClC,IAAA,OAAA,CAAQ,wBAAwB,CAAA,GAAI,SAAA;AAAA,EACtC;AAGA,EAAA,IAAI,CAAA,CAAE,kBAAkB,KAAA,EAAO;AAC7B,IAAA,OAAA,CAAQ,kBAAkB,CAAA,GAAI,eAAA;AAAA,EAChC;AAGA,EAAA,OAAA,CAAQ,iBAAiB,CAAA,GACvB,CAAA,CAAE,cAAA,IAAkB,iCAAA;AAGtB,EAAA,OAAA,CAAQ,oBAAoB,CAAA,GAC1B,CAAA,CAAE,iBAAA,IAAqB,0CAAA;AAGzB,EAAA,IAAI,EAAE,aAAA,EAAe;AACnB,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,EAAS,CAAA,CAAE,aAAa,CAAA;AAAA,EACxC;AAEA,EAAA,OAAO,OAAA;AACT","file":"chunk-77CIIDE6.js","sourcesContent":["/**\n * Default security headers applied by site-kit middleware.\n *\n * These match industry best practices and are the same headers\n * recommended by Next.js documentation. All are opt-out.\n */\n\n/**\n * Single source of truth for who may frame a site-kit site.\n *\n * Upforge showcases live client work inside iframes on its portfolio /\n * area pages, so every managed marketing site has to be embeddable from\n * upforge.io. `X-Frame-Options` cannot express an allowlist (`ALLOW-FROM`\n * is dead and ignored by every current browser), so the CSP\n * `frame-ancestors` directive is the only way to say \"these origins and\n * nobody else\". Everything not listed here is still blocked.\n *\n * Do NOT re-fork this list into individual sites' middleware/next.config —\n * add origins here and let the fleet inherit them.\n */\nexport const DEFAULT_FRAME_ANCESTORS = [\n  \"'self'\",\n  'https://upforge.io',\n  'https://*.upforge.io',\n]\n\nexport interface SecurityHeadersConfig {\n  /** X-Frame-Options value. false to disable. Default: omitted when\n   * `frameAncestors` is active (the two conflict), otherwise 'DENY'. */\n  frameOptions?: 'DENY' | 'SAMEORIGIN' | false\n  /**\n   * Origins allowed to frame this site, emitted as a CSP `frame-ancestors`\n   * directive. Defaults to {@link DEFAULT_FRAME_ANCESTORS} ('self' + upforge.io)\n   * so Upforge can showcase the site. Pass an array to extend/replace, or\n   * `false` to opt out entirely and fall back to X-Frame-Options.\n   *\n   * Ignored if a `Content-Security-Policy` is supplied via `customHeaders` —\n   * that CSP wins, and must carry its own frame-ancestors directive.\n   */\n  frameAncestors?: string[] | false\n  /** X-Content-Type-Options: nosniff. Default: true */\n  contentTypeOptions?: boolean\n  /** X-XSS-Protection header. Default: true */\n  xssProtection?: boolean\n  /** Referrer-Policy value. Default: 'strict-origin-when-cross-origin' */\n  referrerPolicy?: string\n  /** Permissions-Policy value. Default restricts camera, microphone, geolocation */\n  permissionsPolicy?: string\n  /** X-DNS-Prefetch-Control. Default: true (on) */\n  dnsPrefetchControl?: boolean\n  /** Additional custom headers */\n  customHeaders?: Record<string, string>\n}\n\n/**\n * Build a flat Record of header name → value from the config.\n */\nexport function buildSecurityHeaders(\n  config?: SecurityHeadersConfig | boolean,\n): Record<string, string> {\n  if (config === false) return {}\n\n  const c: SecurityHeadersConfig =\n    typeof config === 'object' ? config : {}\n\n  const headers: Record<string, string> = {}\n\n  // X-DNS-Prefetch-Control\n  if (c.dnsPrefetchControl !== false) {\n    headers['X-DNS-Prefetch-Control'] = 'on'\n  }\n\n  // Framing policy — CSP frame-ancestors is the allowlist mechanism;\n  // X-Frame-Options is only a fallback for the opted-out case.\n  //\n  // These two headers MUST NOT both be emitted: X-Frame-Options has no\n  // allowlist form, so a stray `DENY`/`SAMEORIGIN` alongside a permissive\n  // frame-ancestors is honoured by some browsers and silently re-blocks the\n  // embed. So when frame-ancestors is active we drop XFO unless the site\n  // explicitly asked for a value.\n  const frameAncestors =\n    c.frameAncestors === false\n      ? null\n      : c.frameAncestors && c.frameAncestors.length > 0\n        ? c.frameAncestors\n        : DEFAULT_FRAME_ANCESTORS\n\n  if (frameAncestors) {\n    headers['Content-Security-Policy'] =\n      `frame-ancestors ${frameAncestors.join(' ')}`\n    // Only honour an explicitly-requested XFO value here.\n    if (c.frameOptions) {\n      headers['X-Frame-Options'] = c.frameOptions\n    }\n  } else if (c.frameOptions !== false) {\n    headers['X-Frame-Options'] = c.frameOptions || 'DENY'\n  }\n\n  // X-Content-Type-Options\n  if (c.contentTypeOptions !== false) {\n    headers['X-Content-Type-Options'] = 'nosniff'\n  }\n\n  // X-XSS-Protection\n  if (c.xssProtection !== false) {\n    headers['X-XSS-Protection'] = '1; mode=block'\n  }\n\n  // Referrer-Policy\n  headers['Referrer-Policy'] =\n    c.referrerPolicy || 'strict-origin-when-cross-origin'\n\n  // Permissions-Policy\n  headers['Permissions-Policy'] =\n    c.permissionsPolicy || 'camera=(), microphone=(), geolocation=()'\n\n  // Custom headers\n  if (c.customHeaders) {\n    Object.assign(headers, c.customHeaders)\n  }\n\n  return headers\n}\n"]}

package/dist/chunk-EFMPOC6L.mjs

@@ -1,6 +0,0 @@
-// src/shared/version.ts
-var SITE_KIT_VERSION = "4.2.4";
-
-export { SITE_KIT_VERSION };
-//# sourceMappingURL=chunk-EFMPOC6L.mjs.map
-//# sourceMappingURL=chunk-EFMPOC6L.mjs.map

package/dist/chunk-GC3BC6HQ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/redirects/index.ts"],"names":["getSiteConfig","NextResponse"],"mappings":";;;;;AAmDA,IAAM,kBAAA,GAAqB,sBAAA;AAO3B,SAAS,SAAA,GAAgC;AACvC,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,KAAY,WAAA,IAAe,QAAQ,GAAA,GAAM,OAAA,CAAQ,IAAI,aAAA,GAAgB,MAAA;AACxF,EAAA,OAAO,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,GAAM,GAAA,GAAM,MAAA;AAChD;AACA,IAAM,wBAAA,GAA2B,GAAA;AAKjC,IAAM,mBAAA,GAAsB,GAAA;AAQrB,IAAM,cAAA,GAAiB;AAG9B,IAAM,UAAA,uBAAiB,GAAA,EAAuD;AAE9E,SAAS,mBAAA,CAAoB,QAA4B,MAAA,EAAoC;AAC3F,EAAA,IAAI,MAAA,EAAQ,OAAO,CAAA,IAAA,EAAO,MAAM,CAAA,CAAA;AAChC,EAAA,OAAO,CAAA,OAAA,EAAU,UAAU,EAAE,CAAA,CAAA;AAC/B;AAOA,eAAsB,mBAAmB,MAAA,EAAiD;AACxF,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,YAAA,GAAe,OAAO,YAAA,IAAgB,GAAA;AAC5C,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,YAAA,IAAgB,SAAA,EAAU,IAAK,kBAAA;AAEtD,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,KAAW,OAAO,OAAA,KAAY,eAAe,OAAA,CAAQ,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,aAAA,GAAgB,MAAA,CAAA;AAC7G,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,KAAW,QAAA,GAAW,MAAA,GAAS,MAAA;AACrD,EAAA,IAAI,SAAS,MAAA,CAAO,MAAA;AAEpB,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,MAAA,EAAQ;AACtB,IAAA,MAAM,aAAa,MAAMA,8BAAA,CAAc,EAAE,MAAA,EAAQ,SAAS,CAAA;AAC1D,IAAA,MAAA,GAAS,UAAA,EAAY,MAAA;AAAA,EACvB;AAEA,EAAA,MAAM,QAAA,GAAW,mBAAA,CAAoB,MAAA,EAAQ,MAAM,CAAA;AACnD,EAAA,MAAM,MAAA,GAAS,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA;AACtC,EAAA,IAAI,MAAA,IAAU,GAAA,GAAM,MAAA,CAAO,MAAA,EAAQ;AACjC,IAAA,OAAO,MAAA,CAAO,KAAA;AAAA,EAChB;AAEA,EAAA,IAAI;AACF,IAAA,IAAI,GAAA;AACJ,IAAA,MAAM,OAAA,GAAkC,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAE7E,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,GAAA,GAAM,GAAG,OAAO,CAAA,yBAAA,CAAA;AAChB,MAAA,OAAA,CAAQ,WAAW,CAAA,GAAI,MAAA;AAAA,IACzB,WAAW,MAAA,EAAQ;AACjB,MAAA,GAAA,GAAM,CAAA,EAAG,OAAO,CAAA,iCAAA,EAAoC,kBAAA,CAAmB,MAAM,CAAC,CAAA,CAAA;AAAA,IAChF,CAAA,MAAO;AACL,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,SAAA,GAAY,OAAO,cAAA,IAAkB,wBAAA;AAG3C,IAAA,MAAM,MAAA,GACJ,OAAO,WAAA,KAAgB,WAAA,IAAe,OAAO,WAAA,CAAY,OAAA,KAAY,UAAA,GACjE,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA,GAC7B,KAAA,CAAA;AAEN,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,MAC3B,OAAA;AAAA,MACA,MAAA;AAAA;AAAA;AAAA,MAGA,IAAA,EAAM,EAAE,UAAA,EAAY,YAAA;AAAa,KAClC,CAAA;AAED,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,sCAAA,EAAyC,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AACnE,MAAA,UAAA,CAAW,GAAA,CAAI,QAAA,EAAU,EAAE,KAAA,EAAO,MAAA,EAAQ,KAAA,IAAS,EAAC,EAAG,MAAA,EAAQ,GAAA,GAAM,mBAAA,EAAqB,CAAA;AAC1F,MAAA,OAAO,MAAA,EAAQ,SAAS,EAAC;AAAA,IAC3B;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,MAAM,KAAA,GAAA,CAAS,KAAK,SAAA,IAAa,IAAI,MAAA,CAAO,CAAC,CAAA,KAAoB,CAAA,CAAE,UAAU,CAAA;AAC7E,IAAA,UAAA,CAAW,GAAA,CAAI,UAAU,EAAE,KAAA,EAAO,QAAQ,GAAA,GAAM,YAAA,GAAe,KAAM,CAAA;AACrE,IAAA,OAAO,KAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,wCAAwC,KAAK,CAAA;AAC3D,IAAA,UAAA,CAAW,GAAA,CAAI,QAAA,EAAU,EAAE,KAAA,EAAO,MAAA,EAAQ,KAAA,IAAS,EAAC,EAAG,MAAA,EAAQ,GAAA,GAAM,mBAAA,EAAqB,CAAA;AAC1F,IAAA,OAAO,MAAA,EAAQ,SAAS,EAAC;AAAA,EAC3B;AACF;AAOO,SAAS,iBAAA,CACd,UACA,KAAA,EAC0B;AAC1B,EAAA,OAAO,KAAA,CAAM,KAAK,CAAA,CAAA,KAAK;AACrB,IAAA,IAAI,CAAA,CAAE,SAAA,KAAc,QAAA,EAAU,OAAO,IAAA;AACrC,IAAA,MAAM,cAAA,GAAiB,CAAA,CAAE,SAAA,CAAU,QAAA,CAAS,GAAG,CAAA,GAAI,CAAA,CAAE,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,CAAA,CAAE,SAAA;AAChF,IAAA,MAAM,cAAA,GAAiB,SAAS,QAAA,CAAS,GAAG,IAAI,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,QAAA;AACxE,IAAA,OAAO,cAAA,KAAmB,cAAA;AAAA,EAC5B,CAAC,CAAA;AACH;AAMA,eAAsB,sBAAA,CACpB,SACA,MAAA,EACmC;AACnC,EAAA,MAAM,QAAA,GAAW,QAAQ,OAAA,CAAQ,QAAA;AAGjC,EAAA,IACE,QAAA,CAAS,UAAA,CAAW,QAAQ,CAAA,IAC5B,QAAA,CAAS,UAAA,CAAW,MAAM,CAAA,IAC1B,QAAA,CAAS,QAAA,CAAS,GAAG,CAAA,EACrB;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAM,kBAAA,CAAmB,MAAM,CAAA;AAC7C,EAAA,MAAM,KAAA,GAAQ,iBAAA,CAAkB,QAAA,EAAU,KAAK,CAAA;AAE/C,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,MAAA;AAAA,EACT;AAGA,EAAA,MAAM,cAAc,IAAI,GAAA,CAAI,KAAA,CAAM,OAAA,EAAS,QAAQ,GAAG,CAAA;AAGtD,EAAA,OAAA,CAAQ,OAAA,CAAQ,YAAA,CAAa,OAAA,CAAQ,CAAC,OAAO,GAAA,KAAQ;AACnD,IAAA,WAAA,CAAY,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,EACzC,CAAC,CAAA;AAGD,EAAA,gBAAA,CAAiB,QAAQ,KAAA,CAAM,SAAA,EAAW,OAAO,MAAM,CAAA,CAAE,MAAM,MAAM;AAAA,EAAC,CAAC,CAAA;AAGvE,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,KAAA,CAAM,aAAa,CAAA;AAC/C,EAAA,OAAOC,mBAAA,CAAa,QAAA,CAAS,WAAA,EAAa,UAAU,CAAA;AACtD;AAMA,eAAsB,gBAAA,CAAiB,MAAA,EAAwB,QAAA,EAAkB,YAAA,EAAsC;AACrH,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,YAAA,IAAgB,SAAA,EAAU,IAAK,kBAAA;AACtD,IAAA,MAAM,MAAA,GAAS,YAAA,IAAgB,MAAA,CAAO,MAAA,IAAA,CAAW,MAAMD,8BAAA,CAAc,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,CAAA,GAAI,MAAA;AACnH,IAAA,IAAI,CAAC,MAAA,EAAQ;AACb,IAAA,MAAM,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA,6BAAA,CAAA,EAAiC;AAAA,MACrD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,MAAA,EAAQ,SAAA,EAAW,UAAU;AAAA,KACrD,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAmBA,eAAsB,sBAAsB,MAAA,EAIxC;AAGF,EAAA,MAAM,KAAA,GAAQ,MAAM,kBAAA,CAAmB,EAAE,cAAA,EAAgB,KAAQ,GAAG,MAAA,EAAQ,YAAA,EAAc,CAAA,EAAG,CAAA;AAE7F,EAAA,OAAO,KAAA,CAAM,IAAI,CAAA,CAAA,MAAM;AAAA,IACrB,QAAQ,CAAA,CAAE,SAAA;AAAA,IACV,aAAa,CAAA,CAAE,OAAA;AAAA,IACf,SAAA,EAAW,CAAA,CAAE,aAAA,KAAkB,KAAA,IAAS,EAAE,aAAA,KAAkB;AAAA,GAC9D,CAAE,CAAA;AACJ;AAKO,SAAS,kBAAA,GAA2B;AACzC,EAAA,UAAA,CAAW,KAAA,EAAM;AACnB","file":"chunk-GC3BC6HQ.js","sourcesContent":["/**\n * Managed Redirects - Next.js Middleware Helper\n * \n * Fetches redirect rules from Portal and applies them.\n * Supports API key only (domain resolved from Portal) or domain-based lookup.\n * \n * Usage in middleware.ts (API key only):\n * \n * import { handleManagedRedirects } from '@sonordev/site-kit/redirects'\n * \n * export async function middleware(request: NextRequest) {\n *   const redirect = await handleManagedRedirects(request, {\n *     apiKey: process.env.SONOR_API_KEY,\n *     portalApiUrl: process.env.SONOR_API_URL,\n *   })\n *   if (redirect) return redirect\n *   return NextResponse.next()\n * }\n * \n * Or with domain (legacy):\n *   const redirect = await handleManagedRedirects(request, { domain: 'example.com' })\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { getSiteConfig } from '../site-config'\n\nexport interface RedirectRule {\n  from_path: string\n  to_path: string\n  redirect_type: '301' | '302' | '307' | '308'\n  is_enabled: boolean\n}\n\nexport interface RedirectConfig {\n  /** Domain to fetch redirects for (optional when apiKey is set) */\n  domain?: string\n  /** Project API key; when set, redirects are fetched by key (no domain needed) */\n  apiKey?: string\n  portalApiUrl?: string\n  cacheSeconds?: number\n  /**\n   * Hard ceiling on the rules fetch, in ms. Default 300.\n   *\n   * This fetch can sit in front of HTML (proxy hot path / not-found render),\n   * and without a bound a *slow* Portal becomes every page's TTFB — the\n   * try/catch only fails open on error, not on slow. Build-time callers\n   * (generateNextRedirects) pass a larger value.\n   */\n  fetchTimeoutMs?: number\n}\n\nconst DEFAULT_PORTAL_URL = 'https://api.sonor.io'\n\n/**\n * Env parity with the API key: SONOR_API_URL was honored for the key's\n * sibling everywhere else in the kit but ignored here, so sites overriding\n * the API URL by env silently fetched redirect rules from production.\n */\nfunction envApiUrl(): string | undefined {\n  const raw = typeof process !== 'undefined' && process.env ? process.env.SONOR_API_URL : undefined\n  return typeof raw === 'string' && raw ? raw : undefined\n}\nconst DEFAULT_FETCH_TIMEOUT_MS = 300\n/**\n * After a failed fetch, don't re-hit the API for this long. Without this a\n * cold instance with a down Portal pays the full timeout on EVERY request.\n */\nconst FAILURE_COOLDOWN_MS = 30_000\n\n/**\n * Request header the site-kit proxy stamps with `pathname + search` so the\n * not-found boundary (which receives no URL from Next) can know what was\n * requested. Single source of truth — used by createProxy and\n * resolveManagedRedirect.\n */\nexport const SK_PATH_HEADER = 'x-sk-path'\n\n// Cache for redirect rules keyed by apiKey or 'domain:'+domain\nconst rulesCache = new Map<string, { rules: RedirectRule[]; expiry: number }>()\n\nfunction getRedirectCacheKey(apiKey: string | undefined, domain: string | undefined): string {\n  if (apiKey) return `key:${apiKey}`\n  return `domain:${domain || ''}`\n}\n\n/**\n * Fetch redirect rules from Portal API.\n * When apiKey is set (or from env), uses key-based endpoint (no domain required).\n * Otherwise uses domain query (or domain from getSiteConfig when only env API key is set).\n */\nexport async function fetchRedirectRules(config: RedirectConfig): Promise<RedirectRule[]> {\n  const now = Date.now()\n  const cacheSeconds = config.cacheSeconds ?? 300\n  const baseUrl = config.portalApiUrl || envApiUrl() || DEFAULT_PORTAL_URL\n\n  const rawKey = config.apiKey ?? (typeof process !== 'undefined' && process.env ? process.env.SONOR_API_KEY : undefined)\n  const apiKey = typeof rawKey === 'string' ? rawKey : undefined\n  let domain = config.domain\n\n  if (!apiKey && !domain) {\n    const siteConfig = await getSiteConfig({ apiUrl: baseUrl })\n    domain = siteConfig?.domain\n  }\n\n  const cacheKey = getRedirectCacheKey(apiKey, domain)\n  const cached = rulesCache.get(cacheKey)\n  if (cached && now < cached.expiry) {\n    return cached.rules\n  }\n\n  try {\n    let url: string\n    const headers: Record<string, string> = { 'Content-Type': 'application/json' }\n\n    if (apiKey) {\n      url = `${baseUrl}/api/public/seo/redirects`\n      headers['x-api-key'] = apiKey\n    } else if (domain) {\n      url = `${baseUrl}/api/public/seo/redirects?domain=${encodeURIComponent(domain)}`\n    } else {\n      return []\n    }\n\n    const timeoutMs = config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS\n    // Guarded like every other web API here (see shared/identity): AbortSignal\n    // .timeout is Node 17.3+/modern edge; when absent we just fetch unbounded.\n    const signal =\n      typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function'\n        ? AbortSignal.timeout(timeoutMs)\n        : undefined\n\n    const res = await fetch(url, {\n      headers,\n      signal,\n      // No-op in proxy (outside the data cache) but real in RSC renders,\n      // where the not-found resolver runs.\n      next: { revalidate: cacheSeconds },\n    })\n\n    if (!res.ok) {\n      console.error(`[site-kit] Failed to fetch redirects: ${res.status}`)\n      rulesCache.set(cacheKey, { rules: cached?.rules ?? [], expiry: now + FAILURE_COOLDOWN_MS })\n      return cached?.rules ?? []\n    }\n\n    const data = await res.json()\n    const rules = (data.redirects || []).filter((r: RedirectRule) => r.is_enabled)\n    rulesCache.set(cacheKey, { rules, expiry: now + cacheSeconds * 1000 })\n    return rules\n  } catch (error) {\n    console.error('[site-kit] Error fetching redirects:', error)\n    rulesCache.set(cacheKey, { rules: cached?.rules ?? [], expiry: now + FAILURE_COOLDOWN_MS })\n    return cached?.rules ?? []\n  }\n}\n\n/**\n * Find the rule matching a pathname (exact, tolerating trailing-slash\n * variance). Single source of truth for match semantics — used by the proxy\n * hot path and the not-found resolver. Do not re-fork.\n */\nexport function findRedirectMatch(\n  pathname: string,\n  rules: RedirectRule[],\n): RedirectRule | undefined {\n  return rules.find(r => {\n    if (r.from_path === pathname) return true\n    const normalizedFrom = r.from_path.endsWith('/') ? r.from_path.slice(0, -1) : r.from_path\n    const normalizedPath = pathname.endsWith('/') ? pathname.slice(0, -1) : pathname\n    return normalizedFrom === normalizedPath\n  })\n}\n\n/**\n * Handle managed redirects in middleware\n * Returns a NextResponse.redirect if a match is found, otherwise undefined\n */\nexport async function handleManagedRedirects(\n  request: NextRequest,\n  config: RedirectConfig,\n): Promise<NextResponse | undefined> {\n  const pathname = request.nextUrl.pathname\n  \n  // Skip for static assets and API routes\n  if (\n    pathname.startsWith('/_next') ||\n    pathname.startsWith('/api') ||\n    pathname.includes('.') // Has file extension\n  ) {\n    return undefined\n  }\n\n  const rules = await fetchRedirectRules(config)\n  const match = findRedirectMatch(pathname, rules)\n\n  if (!match) {\n    return undefined\n  }\n\n  // Build redirect URL\n  const redirectUrl = new URL(match.to_path, request.url)\n  \n  // Preserve query params\n  request.nextUrl.searchParams.forEach((value, key) => {\n    redirectUrl.searchParams.set(key, value)\n  })\n\n  // Track hit (fire and forget); domain may be from config or resolved by apiKey\n  trackRedirectHit(config, match.from_path, config.domain).catch(() => {})\n\n  // Return redirect response\n  const statusCode = parseInt(match.redirect_type) as 301 | 302 | 307 | 308\n  return NextResponse.redirect(redirectUrl, statusCode)\n}\n\n/**\n * Track redirect hit for analytics (needs domain; resolved from config or getSiteConfig when using apiKey)\n * Exported for the not-found resolver — fire-and-forget, never throws.\n */\nexport async function trackRedirectHit(config: RedirectConfig, fromPath: string, domainForHit?: string): Promise<void> {\n  try {\n    const baseUrl = config.portalApiUrl || envApiUrl() || DEFAULT_PORTAL_URL\n    const domain = domainForHit ?? config.domain ?? (await getSiteConfig({ apiKey: config.apiKey, apiUrl: baseUrl }))?.domain\n    if (!domain) return\n    await fetch(`${baseUrl}/api/public/seo/redirects/hit`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({ domain, from_path: fromPath }),\n    })\n  } catch {\n    // Ignore tracking errors\n  }\n}\n\n/**\n * Generate Next.js redirects config from Portal\n * Use this in next.config.js for build-time redirects\n * \n * Usage in next.config.js:\n * \n * const { generateNextRedirects } = require('@sonordev/site-kit/redirects')\n * \n * module.exports = {\n *   async redirects() {\n *     return generateNextRedirects({\n *       domain: 'example.com',\n *       portalApiUrl: process.env.PORTAL_API_URL,\n *     })\n *   }\n * }\n */\nexport async function generateNextRedirects(config: RedirectConfig): Promise<Array<{\n  source: string\n  destination: string\n  permanent: boolean\n}>> {\n  // Build-time: nothing is waiting on this response, so allow a generous\n  // timeout instead of the request-path default.\n  const rules = await fetchRedirectRules({ fetchTimeoutMs: 10_000, ...config, cacheSeconds: 0 })\n  \n  return rules.map(r => ({\n    source: r.from_path,\n    destination: r.to_path,\n    permanent: r.redirect_type === '301' || r.redirect_type === '308',\n  }))\n}\n\n/**\n * Clear redirect cache (useful for development)\n */\nexport function clearRedirectCache(): void {\n  rulesCache.clear()\n}\n"]}

package/dist/chunk-KRARQ2ZF.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/redirects/index.ts"],"names":[],"mappings":";;;AAmDA,IAAM,kBAAA,GAAqB,sBAAA;AAO3B,SAAS,SAAA,GAAgC;AACvC,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,KAAY,WAAA,IAAe,QAAQ,GAAA,GAAM,OAAA,CAAQ,IAAI,aAAA,GAAgB,MAAA;AACxF,EAAA,OAAO,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,GAAM,GAAA,GAAM,MAAA;AAChD;AACA,IAAM,wBAAA,GAA2B,GAAA;AAKjC,IAAM,mBAAA,GAAsB,GAAA;AAQrB,IAAM,cAAA,GAAiB;AAG9B,IAAM,UAAA,uBAAiB,GAAA,EAAuD;AAE9E,SAAS,mBAAA,CAAoB,QAA4B,MAAA,EAAoC;AAC3F,EAAA,IAAI,MAAA,EAAQ,OAAO,CAAA,IAAA,EAAO,MAAM,CAAA,CAAA;AAChC,EAAA,OAAO,CAAA,OAAA,EAAU,UAAU,EAAE,CAAA,CAAA;AAC/B;AAOA,eAAsB,mBAAmB,MAAA,EAAiD;AACxF,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,YAAA,GAAe,OAAO,YAAA,IAAgB,GAAA;AAC5C,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,YAAA,IAAgB,SAAA,EAAU,IAAK,kBAAA;AAEtD,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,KAAW,OAAO,OAAA,KAAY,eAAe,OAAA,CAAQ,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,aAAA,GAAgB,MAAA,CAAA;AAC7G,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,KAAW,QAAA,GAAW,MAAA,GAAS,MAAA;AACrD,EAAA,IAAI,SAAS,MAAA,CAAO,MAAA;AAEpB,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,MAAA,EAAQ;AACtB,IAAA,MAAM,aAAa,MAAM,aAAA,CAAc,EAAE,MAAA,EAAQ,SAAS,CAAA;AAC1D,IAAA,MAAA,GAAS,UAAA,EAAY,MAAA;AAAA,EACvB;AAEA,EAAA,MAAM,QAAA,GAAW,mBAAA,CAAoB,MAAA,EAAQ,MAAM,CAAA;AACnD,EAAA,MAAM,MAAA,GAAS,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA;AACtC,EAAA,IAAI,MAAA,IAAU,GAAA,GAAM,MAAA,CAAO,MAAA,EAAQ;AACjC,IAAA,OAAO,MAAA,CAAO,KAAA;AAAA,EAChB;AAEA,EAAA,IAAI;AACF,IAAA,IAAI,GAAA;AACJ,IAAA,MAAM,OAAA,GAAkC,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAE7E,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,GAAA,GAAM,GAAG,OAAO,CAAA,yBAAA,CAAA;AAChB,MAAA,OAAA,CAAQ,WAAW,CAAA,GAAI,MAAA;AAAA,IACzB,WAAW,MAAA,EAAQ;AACjB,MAAA,GAAA,GAAM,CAAA,EAAG,OAAO,CAAA,iCAAA,EAAoC,kBAAA,CAAmB,MAAM,CAAC,CAAA,CAAA;AAAA,IAChF,CAAA,MAAO;AACL,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,SAAA,GAAY,OAAO,cAAA,IAAkB,wBAAA;AAG3C,IAAA,MAAM,MAAA,GACJ,OAAO,WAAA,KAAgB,WAAA,IAAe,OAAO,WAAA,CAAY,OAAA,KAAY,UAAA,GACjE,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA,GAC7B,KAAA,CAAA;AAEN,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,MAC3B,OAAA;AAAA,MACA,MAAA;AAAA;AAAA;AAAA,MAGA,IAAA,EAAM,EAAE,UAAA,EAAY,YAAA;AAAa,KAClC,CAAA;AAED,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,sCAAA,EAAyC,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AACnE,MAAA,UAAA,CAAW,GAAA,CAAI,QAAA,EAAU,EAAE,KAAA,EAAO,MAAA,EAAQ,KAAA,IAAS,EAAC,EAAG,MAAA,EAAQ,GAAA,GAAM,mBAAA,EAAqB,CAAA;AAC1F,MAAA,OAAO,MAAA,EAAQ,SAAS,EAAC;AAAA,IAC3B;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,MAAM,KAAA,GAAA,CAAS,KAAK,SAAA,IAAa,IAAI,MAAA,CAAO,CAAC,CAAA,KAAoB,CAAA,CAAE,UAAU,CAAA;AAC7E,IAAA,UAAA,CAAW,GAAA,CAAI,UAAU,EAAE,KAAA,EAAO,QAAQ,GAAA,GAAM,YAAA,GAAe,KAAM,CAAA;AACrE,IAAA,OAAO,KAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,wCAAwC,KAAK,CAAA;AAC3D,IAAA,UAAA,CAAW,GAAA,CAAI,QAAA,EAAU,EAAE,KAAA,EAAO,MAAA,EAAQ,KAAA,IAAS,EAAC,EAAG,MAAA,EAAQ,GAAA,GAAM,mBAAA,EAAqB,CAAA;AAC1F,IAAA,OAAO,MAAA,EAAQ,SAAS,EAAC;AAAA,EAC3B;AACF;AAOO,SAAS,iBAAA,CACd,UACA,KAAA,EAC0B;AAC1B,EAAA,OAAO,KAAA,CAAM,KAAK,CAAA,CAAA,KAAK;AACrB,IAAA,IAAI,CAAA,CAAE,SAAA,KAAc,QAAA,EAAU,OAAO,IAAA;AACrC,IAAA,MAAM,cAAA,GAAiB,CAAA,CAAE,SAAA,CAAU,QAAA,CAAS,GAAG,CAAA,GAAI,CAAA,CAAE,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,CAAA,CAAE,SAAA;AAChF,IAAA,MAAM,cAAA,GAAiB,SAAS,QAAA,CAAS,GAAG,IAAI,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,QAAA;AACxE,IAAA,OAAO,cAAA,KAAmB,cAAA;AAAA,EAC5B,CAAC,CAAA;AACH;AAMA,eAAsB,sBAAA,CACpB,SACA,MAAA,EACmC;AACnC,EAAA,MAAM,QAAA,GAAW,QAAQ,OAAA,CAAQ,QAAA;AAGjC,EAAA,IACE,QAAA,CAAS,UAAA,CAAW,QAAQ,CAAA,IAC5B,QAAA,CAAS,UAAA,CAAW,MAAM,CAAA,IAC1B,QAAA,CAAS,QAAA,CAAS,GAAG,CAAA,EACrB;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAM,kBAAA,CAAmB,MAAM,CAAA;AAC7C,EAAA,MAAM,KAAA,GAAQ,iBAAA,CAAkB,QAAA,EAAU,KAAK,CAAA;AAE/C,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,MAAA;AAAA,EACT;AAGA,EAAA,MAAM,cAAc,IAAI,GAAA,CAAI,KAAA,CAAM,OAAA,EAAS,QAAQ,GAAG,CAAA;AAGtD,EAAA,OAAA,CAAQ,OAAA,CAAQ,YAAA,CAAa,OAAA,CAAQ,CAAC,OAAO,GAAA,KAAQ;AACnD,IAAA,WAAA,CAAY,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,EACzC,CAAC,CAAA;AAGD,EAAA,gBAAA,CAAiB,QAAQ,KAAA,CAAM,SAAA,EAAW,OAAO,MAAM,CAAA,CAAE,MAAM,MAAM;AAAA,EAAC,CAAC,CAAA;AAGvE,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,KAAA,CAAM,aAAa,CAAA;AAC/C,EAAA,OAAO,YAAA,CAAa,QAAA,CAAS,WAAA,EAAa,UAAU,CAAA;AACtD;AAMA,eAAsB,gBAAA,CAAiB,MAAA,EAAwB,QAAA,EAAkB,YAAA,EAAsC;AACrH,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,YAAA,IAAgB,SAAA,EAAU,IAAK,kBAAA;AACtD,IAAA,MAAM,MAAA,GAAS,YAAA,IAAgB,MAAA,CAAO,MAAA,IAAA,CAAW,MAAM,aAAA,CAAc,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,CAAA,GAAI,MAAA;AACnH,IAAA,IAAI,CAAC,MAAA,EAAQ;AACb,IAAA,MAAM,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA,6BAAA,CAAA,EAAiC;AAAA,MACrD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,MAAA,EAAQ,SAAA,EAAW,UAAU;AAAA,KACrD,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAmBA,eAAsB,sBAAsB,MAAA,EAIxC;AAGF,EAAA,MAAM,KAAA,GAAQ,MAAM,kBAAA,CAAmB,EAAE,cAAA,EAAgB,KAAQ,GAAG,MAAA,EAAQ,YAAA,EAAc,CAAA,EAAG,CAAA;AAE7F,EAAA,OAAO,KAAA,CAAM,IAAI,CAAA,CAAA,MAAM;AAAA,IACrB,QAAQ,CAAA,CAAE,SAAA;AAAA,IACV,aAAa,CAAA,CAAE,OAAA;AAAA,IACf,SAAA,EAAW,CAAA,CAAE,aAAA,KAAkB,KAAA,IAAS,EAAE,aAAA,KAAkB;AAAA,GAC9D,CAAE,CAAA;AACJ;AAKO,SAAS,kBAAA,GAA2B;AACzC,EAAA,UAAA,CAAW,KAAA,EAAM;AACnB","file":"chunk-KRARQ2ZF.mjs","sourcesContent":["/**\n * Managed Redirects - Next.js Middleware Helper\n * \n * Fetches redirect rules from Portal and applies them.\n * Supports API key only (domain resolved from Portal) or domain-based lookup.\n * \n * Usage in middleware.ts (API key only):\n * \n * import { handleManagedRedirects } from '@sonordev/site-kit/redirects'\n * \n * export async function middleware(request: NextRequest) {\n *   const redirect = await handleManagedRedirects(request, {\n *     apiKey: process.env.SONOR_API_KEY,\n *     portalApiUrl: process.env.SONOR_API_URL,\n *   })\n *   if (redirect) return redirect\n *   return NextResponse.next()\n * }\n * \n * Or with domain (legacy):\n *   const redirect = await handleManagedRedirects(request, { domain: 'example.com' })\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { getSiteConfig } from '../site-config'\n\nexport interface RedirectRule {\n  from_path: string\n  to_path: string\n  redirect_type: '301' | '302' | '307' | '308'\n  is_enabled: boolean\n}\n\nexport interface RedirectConfig {\n  /** Domain to fetch redirects for (optional when apiKey is set) */\n  domain?: string\n  /** Project API key; when set, redirects are fetched by key (no domain needed) */\n  apiKey?: string\n  portalApiUrl?: string\n  cacheSeconds?: number\n  /**\n   * Hard ceiling on the rules fetch, in ms. Default 300.\n   *\n   * This fetch can sit in front of HTML (proxy hot path / not-found render),\n   * and without a bound a *slow* Portal becomes every page's TTFB — the\n   * try/catch only fails open on error, not on slow. Build-time callers\n   * (generateNextRedirects) pass a larger value.\n   */\n  fetchTimeoutMs?: number\n}\n\nconst DEFAULT_PORTAL_URL = 'https://api.sonor.io'\n\n/**\n * Env parity with the API key: SONOR_API_URL was honored for the key's\n * sibling everywhere else in the kit but ignored here, so sites overriding\n * the API URL by env silently fetched redirect rules from production.\n */\nfunction envApiUrl(): string | undefined {\n  const raw = typeof process !== 'undefined' && process.env ? process.env.SONOR_API_URL : undefined\n  return typeof raw === 'string' && raw ? raw : undefined\n}\nconst DEFAULT_FETCH_TIMEOUT_MS = 300\n/**\n * After a failed fetch, don't re-hit the API for this long. Without this a\n * cold instance with a down Portal pays the full timeout on EVERY request.\n */\nconst FAILURE_COOLDOWN_MS = 30_000\n\n/**\n * Request header the site-kit proxy stamps with `pathname + search` so the\n * not-found boundary (which receives no URL from Next) can know what was\n * requested. Single source of truth — used by createProxy and\n * resolveManagedRedirect.\n */\nexport const SK_PATH_HEADER = 'x-sk-path'\n\n// Cache for redirect rules keyed by apiKey or 'domain:'+domain\nconst rulesCache = new Map<string, { rules: RedirectRule[]; expiry: number }>()\n\nfunction getRedirectCacheKey(apiKey: string | undefined, domain: string | undefined): string {\n  if (apiKey) return `key:${apiKey}`\n  return `domain:${domain || ''}`\n}\n\n/**\n * Fetch redirect rules from Portal API.\n * When apiKey is set (or from env), uses key-based endpoint (no domain required).\n * Otherwise uses domain query (or domain from getSiteConfig when only env API key is set).\n */\nexport async function fetchRedirectRules(config: RedirectConfig): Promise<RedirectRule[]> {\n  const now = Date.now()\n  const cacheSeconds = config.cacheSeconds ?? 300\n  const baseUrl = config.portalApiUrl || envApiUrl() || DEFAULT_PORTAL_URL\n\n  const rawKey = config.apiKey ?? (typeof process !== 'undefined' && process.env ? process.env.SONOR_API_KEY : undefined)\n  const apiKey = typeof rawKey === 'string' ? rawKey : undefined\n  let domain = config.domain\n\n  if (!apiKey && !domain) {\n    const siteConfig = await getSiteConfig({ apiUrl: baseUrl })\n    domain = siteConfig?.domain\n  }\n\n  const cacheKey = getRedirectCacheKey(apiKey, domain)\n  const cached = rulesCache.get(cacheKey)\n  if (cached && now < cached.expiry) {\n    return cached.rules\n  }\n\n  try {\n    let url: string\n    const headers: Record<string, string> = { 'Content-Type': 'application/json' }\n\n    if (apiKey) {\n      url = `${baseUrl}/api/public/seo/redirects`\n      headers['x-api-key'] = apiKey\n    } else if (domain) {\n      url = `${baseUrl}/api/public/seo/redirects?domain=${encodeURIComponent(domain)}`\n    } else {\n      return []\n    }\n\n    const timeoutMs = config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS\n    // Guarded like every other web API here (see shared/identity): AbortSignal\n    // .timeout is Node 17.3+/modern edge; when absent we just fetch unbounded.\n    const signal =\n      typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function'\n        ? AbortSignal.timeout(timeoutMs)\n        : undefined\n\n    const res = await fetch(url, {\n      headers,\n      signal,\n      // No-op in proxy (outside the data cache) but real in RSC renders,\n      // where the not-found resolver runs.\n      next: { revalidate: cacheSeconds },\n    })\n\n    if (!res.ok) {\n      console.error(`[site-kit] Failed to fetch redirects: ${res.status}`)\n      rulesCache.set(cacheKey, { rules: cached?.rules ?? [], expiry: now + FAILURE_COOLDOWN_MS })\n      return cached?.rules ?? []\n    }\n\n    const data = await res.json()\n    const rules = (data.redirects || []).filter((r: RedirectRule) => r.is_enabled)\n    rulesCache.set(cacheKey, { rules, expiry: now + cacheSeconds * 1000 })\n    return rules\n  } catch (error) {\n    console.error('[site-kit] Error fetching redirects:', error)\n    rulesCache.set(cacheKey, { rules: cached?.rules ?? [], expiry: now + FAILURE_COOLDOWN_MS })\n    return cached?.rules ?? []\n  }\n}\n\n/**\n * Find the rule matching a pathname (exact, tolerating trailing-slash\n * variance). Single source of truth for match semantics — used by the proxy\n * hot path and the not-found resolver. Do not re-fork.\n */\nexport function findRedirectMatch(\n  pathname: string,\n  rules: RedirectRule[],\n): RedirectRule | undefined {\n  return rules.find(r => {\n    if (r.from_path === pathname) return true\n    const normalizedFrom = r.from_path.endsWith('/') ? r.from_path.slice(0, -1) : r.from_path\n    const normalizedPath = pathname.endsWith('/') ? pathname.slice(0, -1) : pathname\n    return normalizedFrom === normalizedPath\n  })\n}\n\n/**\n * Handle managed redirects in middleware\n * Returns a NextResponse.redirect if a match is found, otherwise undefined\n */\nexport async function handleManagedRedirects(\n  request: NextRequest,\n  config: RedirectConfig,\n): Promise<NextResponse | undefined> {\n  const pathname = request.nextUrl.pathname\n  \n  // Skip for static assets and API routes\n  if (\n    pathname.startsWith('/_next') ||\n    pathname.startsWith('/api') ||\n    pathname.includes('.') // Has file extension\n  ) {\n    return undefined\n  }\n\n  const rules = await fetchRedirectRules(config)\n  const match = findRedirectMatch(pathname, rules)\n\n  if (!match) {\n    return undefined\n  }\n\n  // Build redirect URL\n  const redirectUrl = new URL(match.to_path, request.url)\n  \n  // Preserve query params\n  request.nextUrl.searchParams.forEach((value, key) => {\n    redirectUrl.searchParams.set(key, value)\n  })\n\n  // Track hit (fire and forget); domain may be from config or resolved by apiKey\n  trackRedirectHit(config, match.from_path, config.domain).catch(() => {})\n\n  // Return redirect response\n  const statusCode = parseInt(match.redirect_type) as 301 | 302 | 307 | 308\n  return NextResponse.redirect(redirectUrl, statusCode)\n}\n\n/**\n * Track redirect hit for analytics (needs domain; resolved from config or getSiteConfig when using apiKey)\n * Exported for the not-found resolver — fire-and-forget, never throws.\n */\nexport async function trackRedirectHit(config: RedirectConfig, fromPath: string, domainForHit?: string): Promise<void> {\n  try {\n    const baseUrl = config.portalApiUrl || envApiUrl() || DEFAULT_PORTAL_URL\n    const domain = domainForHit ?? config.domain ?? (await getSiteConfig({ apiKey: config.apiKey, apiUrl: baseUrl }))?.domain\n    if (!domain) return\n    await fetch(`${baseUrl}/api/public/seo/redirects/hit`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({ domain, from_path: fromPath }),\n    })\n  } catch {\n    // Ignore tracking errors\n  }\n}\n\n/**\n * Generate Next.js redirects config from Portal\n * Use this in next.config.js for build-time redirects\n * \n * Usage in next.config.js:\n * \n * const { generateNextRedirects } = require('@sonordev/site-kit/redirects')\n * \n * module.exports = {\n *   async redirects() {\n *     return generateNextRedirects({\n *       domain: 'example.com',\n *       portalApiUrl: process.env.PORTAL_API_URL,\n *     })\n *   }\n * }\n */\nexport async function generateNextRedirects(config: RedirectConfig): Promise<Array<{\n  source: string\n  destination: string\n  permanent: boolean\n}>> {\n  // Build-time: nothing is waiting on this response, so allow a generous\n  // timeout instead of the request-path default.\n  const rules = await fetchRedirectRules({ fetchTimeoutMs: 10_000, ...config, cacheSeconds: 0 })\n  \n  return rules.map(r => ({\n    source: r.from_path,\n    destination: r.to_path,\n    permanent: r.redirect_type === '301' || r.redirect_type === '308',\n  }))\n}\n\n/**\n * Clear redirect cache (useful for development)\n */\nexport function clearRedirectCache(): void {\n  rulesCache.clear()\n}\n"]}

package/dist/chunk-NB4MK2Q5.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/sites/normalize.ts"],"names":[],"mappings":";;;AAkCO,SAAS,kBAAkB,IAAA,EAAqC;AACrE,EAAA,IAAI,CAAC,IAAA,IAAQ,OAAO,IAAA,KAAS,UAAU,OAAO,IAAA;AAC9C,EAAA,IAAI,CAAA,GAAI,IAAA,CAAK,IAAA,EAAK,CAAE,WAAA,EAAY;AAChC,EAAA,IAAI,CAAC,GAAG,OAAO,IAAA;AAEf,EAAA,CAAA,GAAI,CAAA,CAAE,OAAA,CAAQ,cAAA,EAAgB,EAAE,CAAA;AAEhC,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AAC3B,EAAA,IAAI,SAAS,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,KAAA,CAAM,GAAG,KAAK,CAAA;AAEpC,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AAC3B,EAAA,IAAI,SAAS,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,KAAA,CAAM,GAAG,KAAK,CAAA;AACpC,EAAA,OAAO,CAAA,IAAK,IAAA;AACd","file":"chunk-NB4MK2Q5.js","sourcesContent":["/**\n * @sonordev/site-kit/sites — normalizeSiteHost (leaf module)\n *\n * Deliberately its own file, not part of `./contract`, so browser code can pull\n * in the normalizer WITHOUT the rest of the contract surface.\n *\n * `publishCredential` (which every client entry that publishes a credential\n * imports) needs exactly this one function. When it lived in `./contract`, the\n * bundler emitted that whole module as one shared chunk — `SITE_HOST_JSON_SCHEMA`,\n * `SITE_HOST_CONTRACT_VERSION`, `stripWww`, `sameSite`, `hostFromUrl`,\n * `isNormalizedSiteHost` and all — into `client`, `layout/client` and every\n * other entry that touched it. That was ~750B gzipped of agent-facing contract\n * metadata shipped to browsers for a 14-line string normalizer, and it is what\n * pushed those entries over their bundle budgets.\n *\n * `./contract` re-exports this, so the public `@sonordev/site-kit/sites/contract`\n * surface and the cross-repo drift tests are unchanged. Keep the implementation\n * HERE — the Nest APIs mirror this exact logic (sonor-api\n * `src/common/utils/site-host.ts`, signal-api `src/shared/utils/seo-page-pick.util.ts`).\n *\n * Pure string logic only (no Node built-ins) so it is safe in the browser.\n */\n\n/**\n * normalizeSiteHost — canonical normalizer for a sub-site host value before it\n * is persisted or used as a filter.\n *\n *   `https://OhioPowerStudies.com:3000/path` → `ohiopowerstudies.com`\n *\n * Lowercases, strips protocol, keeps host only (drops path + query), strips\n * port (rollups span dev/prod). Returns null for empty/non-string input.\n * Note: `www.` is intentionally preserved here — use `sameSite`/`stripWww`\n * for www-insensitive equality.\n */\nexport function normalizeSiteHost(site?: string | null): string | null {\n  if (!site || typeof site !== 'string') return null\n  let s = site.trim().toLowerCase()\n  if (!s) return null\n  // Strip protocol if present\n  s = s.replace(/^https?:\\/\\//, '')\n  // Keep host only — drop everything from first slash onward\n  const slash = s.indexOf('/')\n  if (slash >= 0) s = s.slice(0, slash)\n  // Strip port (rollups span dev/prod)\n  const colon = s.indexOf(':')\n  if (colon >= 0) s = s.slice(0, colon)\n  return s || null\n}\n"]}

package/dist/chunk-NI7OY4FW.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/sites/normalize.ts"],"names":[],"mappings":";AAkCO,SAAS,kBAAkB,IAAA,EAAqC;AACrE,EAAA,IAAI,CAAC,IAAA,IAAQ,OAAO,IAAA,KAAS,UAAU,OAAO,IAAA;AAC9C,EAAA,IAAI,CAAA,GAAI,IAAA,CAAK,IAAA,EAAK,CAAE,WAAA,EAAY;AAChC,EAAA,IAAI,CAAC,GAAG,OAAO,IAAA;AAEf,EAAA,CAAA,GAAI,CAAA,CAAE,OAAA,CAAQ,cAAA,EAAgB,EAAE,CAAA;AAEhC,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AAC3B,EAAA,IAAI,SAAS,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,KAAA,CAAM,GAAG,KAAK,CAAA;AAEpC,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AAC3B,EAAA,IAAI,SAAS,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,KAAA,CAAM,GAAG,KAAK,CAAA;AACpC,EAAA,OAAO,CAAA,IAAK,IAAA;AACd","file":"chunk-NI7OY4FW.mjs","sourcesContent":["/**\n * @sonordev/site-kit/sites — normalizeSiteHost (leaf module)\n *\n * Deliberately its own file, not part of `./contract`, so browser code can pull\n * in the normalizer WITHOUT the rest of the contract surface.\n *\n * `publishCredential` (which every client entry that publishes a credential\n * imports) needs exactly this one function. When it lived in `./contract`, the\n * bundler emitted that whole module as one shared chunk — `SITE_HOST_JSON_SCHEMA`,\n * `SITE_HOST_CONTRACT_VERSION`, `stripWww`, `sameSite`, `hostFromUrl`,\n * `isNormalizedSiteHost` and all — into `client`, `layout/client` and every\n * other entry that touched it. That was ~750B gzipped of agent-facing contract\n * metadata shipped to browsers for a 14-line string normalizer, and it is what\n * pushed those entries over their bundle budgets.\n *\n * `./contract` re-exports this, so the public `@sonordev/site-kit/sites/contract`\n * surface and the cross-repo drift tests are unchanged. Keep the implementation\n * HERE — the Nest APIs mirror this exact logic (sonor-api\n * `src/common/utils/site-host.ts`, signal-api `src/shared/utils/seo-page-pick.util.ts`).\n *\n * Pure string logic only (no Node built-ins) so it is safe in the browser.\n */\n\n/**\n * normalizeSiteHost — canonical normalizer for a sub-site host value before it\n * is persisted or used as a filter.\n *\n *   `https://OhioPowerStudies.com:3000/path` → `ohiopowerstudies.com`\n *\n * Lowercases, strips protocol, keeps host only (drops path + query), strips\n * port (rollups span dev/prod). Returns null for empty/non-string input.\n * Note: `www.` is intentionally preserved here — use `sameSite`/`stripWww`\n * for www-insensitive equality.\n */\nexport function normalizeSiteHost(site?: string | null): string | null {\n  if (!site || typeof site !== 'string') return null\n  let s = site.trim().toLowerCase()\n  if (!s) return null\n  // Strip protocol if present\n  s = s.replace(/^https?:\\/\\//, '')\n  // Keep host only — drop everything from first slash onward\n  const slash = s.indexOf('/')\n  if (slash >= 0) s = s.slice(0, slash)\n  // Strip port (rollups span dev/prod)\n  const colon = s.indexOf(':')\n  if (colon >= 0) s = s.slice(0, colon)\n  return s || null\n}\n"]}

package/dist/chunk-OVIDFJIK.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/middleware/securityHeaders.ts"],"names":[],"mappings":";AAoBO,IAAM,uBAAA,GAA0B;AAAA,EACrC,QAAA;AAAA,EACA,oBAAA;AAAA,EACA;AACF;AAiCO,SAAS,qBACd,MAAA,EACwB;AACxB,EAAA,IAAI,MAAA,KAAW,KAAA,EAAO,OAAO,EAAC;AAE9B,EAAA,MAAM,CAAA,GACJ,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,EAAC;AAEzC,EAAA,MAAM,UAAkC,EAAC;AAGzC,EAAA,IAAI,CAAA,CAAE,uBAAuB,KAAA,EAAO;AAClC,IAAA,OAAA,CAAQ,wBAAwB,CAAA,GAAI,IAAA;AAAA,EACtC;AAUA,EAAA,MAAM,cAAA,GACJ,CAAA,CAAE,cAAA,KAAmB,KAAA,GACjB,IAAA,GACA,CAAA,CAAE,cAAA,IAAkB,CAAA,CAAE,cAAA,CAAe,MAAA,GAAS,CAAA,GAC5C,CAAA,CAAE,cAAA,GACF,uBAAA;AAER,EAAA,IAAI,cAAA,EAAgB;AAClB,IAAA,OAAA,CAAQ,yBAAyB,CAAA,GAC/B,CAAA,gBAAA,EAAmB,cAAA,CAAe,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA;AAE7C,IAAA,IAAI,EAAE,YAAA,EAAc;AAClB,MAAA,OAAA,CAAQ,iBAAiB,IAAI,CAAA,CAAE,YAAA;AAAA,IACjC;AAAA,EACF,CAAA,MAAA,IAAW,CAAA,CAAE,YAAA,KAAiB,KAAA,EAAO;AACnC,IAAA,OAAA,CAAQ,iBAAiB,CAAA,GAAI,CAAA,CAAE,YAAA,IAAgB,MAAA;AAAA,EACjD;AAGA,EAAA,IAAI,CAAA,CAAE,uBAAuB,KAAA,EAAO;AAClC,IAAA,OAAA,CAAQ,wBAAwB,CAAA,GAAI,SAAA;AAAA,EACtC;AAGA,EAAA,IAAI,CAAA,CAAE,kBAAkB,KAAA,EAAO;AAC7B,IAAA,OAAA,CAAQ,kBAAkB,CAAA,GAAI,eAAA;AAAA,EAChC;AAGA,EAAA,OAAA,CAAQ,iBAAiB,CAAA,GACvB,CAAA,CAAE,cAAA,IAAkB,iCAAA;AAGtB,EAAA,OAAA,CAAQ,oBAAoB,CAAA,GAC1B,CAAA,CAAE,iBAAA,IAAqB,0CAAA;AAGzB,EAAA,IAAI,EAAE,aAAA,EAAe;AACnB,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,EAAS,CAAA,CAAE,aAAa,CAAA;AAAA,EACxC;AAEA,EAAA,OAAO,OAAA;AACT","file":"chunk-OVIDFJIK.mjs","sourcesContent":["/**\n * Default security headers applied by site-kit middleware.\n *\n * These match industry best practices and are the same headers\n * recommended by Next.js documentation. All are opt-out.\n */\n\n/**\n * Single source of truth for who may frame a site-kit site.\n *\n * Upforge showcases live client work inside iframes on its portfolio /\n * area pages, so every managed marketing site has to be embeddable from\n * upforge.io. `X-Frame-Options` cannot express an allowlist (`ALLOW-FROM`\n * is dead and ignored by every current browser), so the CSP\n * `frame-ancestors` directive is the only way to say \"these origins and\n * nobody else\". Everything not listed here is still blocked.\n *\n * Do NOT re-fork this list into individual sites' middleware/next.config —\n * add origins here and let the fleet inherit them.\n */\nexport const DEFAULT_FRAME_ANCESTORS = [\n  \"'self'\",\n  'https://upforge.io',\n  'https://*.upforge.io',\n]\n\nexport interface SecurityHeadersConfig {\n  /** X-Frame-Options value. false to disable. Default: omitted when\n   * `frameAncestors` is active (the two conflict), otherwise 'DENY'. */\n  frameOptions?: 'DENY' | 'SAMEORIGIN' | false\n  /**\n   * Origins allowed to frame this site, emitted as a CSP `frame-ancestors`\n   * directive. Defaults to {@link DEFAULT_FRAME_ANCESTORS} ('self' + upforge.io)\n   * so Upforge can showcase the site. Pass an array to extend/replace, or\n   * `false` to opt out entirely and fall back to X-Frame-Options.\n   *\n   * Ignored if a `Content-Security-Policy` is supplied via `customHeaders` —\n   * that CSP wins, and must carry its own frame-ancestors directive.\n   */\n  frameAncestors?: string[] | false\n  /** X-Content-Type-Options: nosniff. Default: true */\n  contentTypeOptions?: boolean\n  /** X-XSS-Protection header. Default: true */\n  xssProtection?: boolean\n  /** Referrer-Policy value. Default: 'strict-origin-when-cross-origin' */\n  referrerPolicy?: string\n  /** Permissions-Policy value. Default restricts camera, microphone, geolocation */\n  permissionsPolicy?: string\n  /** X-DNS-Prefetch-Control. Default: true (on) */\n  dnsPrefetchControl?: boolean\n  /** Additional custom headers */\n  customHeaders?: Record<string, string>\n}\n\n/**\n * Build a flat Record of header name → value from the config.\n */\nexport function buildSecurityHeaders(\n  config?: SecurityHeadersConfig | boolean,\n): Record<string, string> {\n  if (config === false) return {}\n\n  const c: SecurityHeadersConfig =\n    typeof config === 'object' ? config : {}\n\n  const headers: Record<string, string> = {}\n\n  // X-DNS-Prefetch-Control\n  if (c.dnsPrefetchControl !== false) {\n    headers['X-DNS-Prefetch-Control'] = 'on'\n  }\n\n  // Framing policy — CSP frame-ancestors is the allowlist mechanism;\n  // X-Frame-Options is only a fallback for the opted-out case.\n  //\n  // These two headers MUST NOT both be emitted: X-Frame-Options has no\n  // allowlist form, so a stray `DENY`/`SAMEORIGIN` alongside a permissive\n  // frame-ancestors is honoured by some browsers and silently re-blocks the\n  // embed. So when frame-ancestors is active we drop XFO unless the site\n  // explicitly asked for a value.\n  const frameAncestors =\n    c.frameAncestors === false\n      ? null\n      : c.frameAncestors && c.frameAncestors.length > 0\n        ? c.frameAncestors\n        : DEFAULT_FRAME_ANCESTORS\n\n  if (frameAncestors) {\n    headers['Content-Security-Policy'] =\n      `frame-ancestors ${frameAncestors.join(' ')}`\n    // Only honour an explicitly-requested XFO value here.\n    if (c.frameOptions) {\n      headers['X-Frame-Options'] = c.frameOptions\n    }\n  } else if (c.frameOptions !== false) {\n    headers['X-Frame-Options'] = c.frameOptions || 'DENY'\n  }\n\n  // X-Content-Type-Options\n  if (c.contentTypeOptions !== false) {\n    headers['X-Content-Type-Options'] = 'nosniff'\n  }\n\n  // X-XSS-Protection\n  if (c.xssProtection !== false) {\n    headers['X-XSS-Protection'] = '1; mode=block'\n  }\n\n  // Referrer-Policy\n  headers['Referrer-Policy'] =\n    c.referrerPolicy || 'strict-origin-when-cross-origin'\n\n  // Permissions-Policy\n  headers['Permissions-Policy'] =\n    c.permissionsPolicy || 'camera=(), microphone=(), geolocation=()'\n\n  // Custom headers\n  if (c.customHeaders) {\n    Object.assign(headers, c.customHeaders)\n  }\n\n  return headers\n}\n"]}

package/dist/chunk-QPIKPWAZ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/server-fetch.ts"],"names":[],"mappings":";;;;;AAsBA,IAAM,eAAA,GAAkB,sBAAA;AACxB,IAAM,kBAAA,GAAqB,KAAA;AAC3B,IAAM,oBAAA,GAAuB,CAAA;AAwBtB,SAAS,sBAAA,CACd,OAAA,GAAyC,EAAC,EAClB;AACxB,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,IAAU,OAAA,CAAQ,IAAI,aAAA,IAAiB,EAAA;AAE9D,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AAEpB,EAAA,MAAM,MAAA,GAAA,CACJ,OAAA,CAAQ,MAAA,IACR,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,OAAA,CAAQ,GAAA,CAAI,yBAAA,IACZ,eAAA,EACA,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAEpB,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC1B;AAOO,SAAS,sBAAA,CACd,OAAA,GAAyC,EAAC,EAC1C,eAAe,8FAAA,EACE;AACjB,EAAA,MAAM,MAAA,GAAS,uBAAuB,OAAO,CAAA;AAC7C,EAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,MAAM,YAAY,CAAA;AACzC,EAAA,OAAO,MAAA;AACT;AAOO,SAAS,iBAAiB,MAAA,EAAyB;AACxD,EAAA,MAAM,GAAA,GAAM,MAAA,IAAU,OAAA,CAAQ,GAAA,CAAI,aAAA,IAAiB,eAAA;AACnD,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,GAAA,CAAI,GAAA,CAAI,QAAQ,MAAA,EAAQ,EAAE,CAAC,CAAA,CAAE,MAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,eAAA;AAAA,EACT;AACF;AAGA,IAAM,iCAAiB,IAAI,GAAA,CAAI,CAAC,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAE9C,SAAS,MAAM,EAAA,EAA2B;AACxC,EAAA,OAAO,IAAI,OAAA,CAAc,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AAC/D;AAwDA,eAAsB,cAAA,CACpB,IAAA,EACA,OAAA,GAA8B,EAAC,EACZ;AACnB,EAAA,MAAM;AAAA,IACJ,MAAA,GAAS,KAAA;AAAA,IACT,IAAA;AAAA,IACA,OAAA,EAAS,eAAe,EAAC;AAAA,IACzB,UAAA,GAAa,kBAAA;AAAA,IACb,IAAA;AAAA,IACA,MAAA,EAAQ,cAAA;AAAA,IACR,MAAA,EAAQ,cAAA;AAAA,IACR,KAAA,GAAQ,IAAA;AAAA,IACR,WAAA,GAAc,oBAAA;AAAA,IACd,UAAA,GAAa,KAAA;AAAA,IACb,SAAA,GAAY,oBAAA;AAAA,IACZ;AAAA,GACF,GAAI,OAAA;AAEJ,EAAA,MAAM,SAAA,GAAY,EAAE,MAAA,EAAQ,cAAA,EAAgB,QAAQ,cAAA,EAAe;AACnE,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAA,GAAS,uBAAuB,SAAS,CAAA;AAAA,EAC3C,CAAA,MAAO;AACL,IAAA,MAAM,QAAA,GAAW,uBAAuB,SAAS,CAAA;AACjD,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,EAAG,SAAS,CAAA,0CAAA,EAAwC,IAAI,CAAA,SAAA,CAAW,CAAA;AAChF,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,MAAA,GAAS,QAAA;AAAA,EACX;AAEA,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,MAAA;AAC3B,EAAA,MAAM,GAAA,GAAM,CAAA,EAAG,MAAM,CAAA,EAAG,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAI,IAAA,GAAO,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA,CAAA;AAEhE,EAAA,MAAM,cAAA,GACJ,IAAA,KAAS,MAAA,GACL,MAAA,GACA,OAAO,SAAS,QAAA,GACd,IAAA,GACA,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAE3B,EAAA,MAAM,WAAW,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,WAAW,CAAA,GAAI,CAAA;AAEpD,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,QAAA,EAAU,OAAA,EAAA,EAAW;AACpD,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,QAChC,GAAG,IAAA;AAAA,QACH,MAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,WAAA,EAAa,MAAA;AAAA,UACb,GAAG;AAAA,SACL;AAAA,QACA,GAAI,cAAA,KAAmB,KAAA,CAAA,GAAY,EAAE,IAAA,EAAM,cAAA,KAAmB,EAAC;AAAA,QAC/D,IAAA,EAAM,EAAE,UAAA,EAAY,GAAI,IAAA,EAAM,SAAS,EAAE,IAAA,EAAK,GAAI,EAAC;AAAG,OACxC,CAAA;AAEhB,MAAA,IAAI,SAAS,cAAA,CAAe,GAAA,CAAI,SAAS,MAAM,CAAA,IAAK,UAAU,QAAA,EAAU;AACtE,QAAA,MAAM,QAAA,CAAS,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM;AAAA,QAAC,CAAC,CAAA;AACpC,QAAA,MAAM,UAAA,GAAa,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACrD,QAAA,IAAI,UAAU,GAAA,GAAM,OAAA,GAAU,OAAA,GAAU,IAAA,CAAK,QAAO,GAAI,GAAA;AACxD,QAAA,IAAI,UAAA,EAAY;AACd,UAAA,MAAM,GAAA,GAAM,QAAA,CAAS,UAAA,EAAY,EAAE,CAAA;AACnC,UAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,IAAK,GAAA,GAAM,CAAA,EAAG,OAAA,GAAU,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,GAAA,GAAM,GAAI,CAAA;AAAA,QAC3E;AACA,QAAA,MAAM,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,GAAM,CAAC,CAAA;AACrC,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,IAAI,SAAS,QAAA,CAAS,UAAA;AACtB,QAAA,IAAI;AACF,UAAA,MAAM,GAAA,GAAM,MAAM,QAAA,CAAS,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AAClD,UAAA,IAAI,GAAA,EAAK,OAAA,EAAS,MAAA,GAAS,GAAA,CAAI,OAAA;AAAA,QACjC,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,EAAG,SAAS,CAAA,YAAA,EAAe,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,EAAA,EAAK,MAAM,CAAA,CAAE,CAAA;AACtF,QAAA,OAAO,IAAA;AAAA,MACT;AAEA,MAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,IAC9B,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,KAAA,IAAS,UAAU,QAAA,EAAU;AAC/B,QAAA,MAAM,MAAM,GAAA,GAAM,OAAA,GAAU,UAAU,IAAA,CAAK,MAAA,KAAW,GAAG,CAAA;AACzD,QAAA;AAAA,MACF;AACA,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,EAAG,SAAS,CAAA,oBAAA,EAAuB,GAAG,CAAA,CAAA,CAAA;AAAA,QACtC,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU;AAAA,OAC3C;AACA,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT","file":"chunk-QPIKPWAZ.js","sourcesContent":["/**\n * @sonordev/site-kit/server — Shared server-fetch primitive\n *\n * SECURITY: Server-only. Reads SONOR_API_KEY from process.env and injects it as\n * `x-api-key`. Importing this module into a client component is a hard build\n * error (see `import 'server-only'` below) — the API key must never reach the\n * browser. Project is resolved by the Portal from the API key; sites never send\n * or read a project ID (x-api-key only).\n *\n * This is the SINGLE SOURCE OF TRUTH for site-kit's server data plane. It is the\n * canonical fetcher that:\n *   - core `seo/server-api.ts` builds its cached SEO fetchers on,\n *   - `@sonordev/agency-site-kit` builds its portfolio fetchers on, and\n *   - `@sonordev/re-site-kit` (real-estate) builds its listing fetchers on.\n *\n * The retry/backoff + config-resolution logic here was extracted from\n * `seo/server-api.ts` so there is exactly one copy — do NOT re-fork it into a\n * sibling package. Import it from `@sonordev/site-kit/server` instead.\n */\n\nimport 'server-only'\n\nconst DEFAULT_API_URL = 'https://api.sonor.io'\nconst DEFAULT_REVALIDATE = 86400 // 24h — Portal data rarely changes; on-demand revalidate busts it\nconst DEFAULT_MAX_ATTEMPTS = 6\n\n/** Resolved Portal API config. */\nexport interface ServerApiConfig {\n  apiUrl: string\n  apiKey: string\n}\n\nexport interface ResolveServerApiConfigOptions {\n  /** Override the API key (e.g. passed from a layout prop). Falls back to env. */\n  apiKey?: string\n  /** Override the API URL. Falls back to env, then https://api.sonor.io. */\n  apiUrl?: string\n}\n\n/**\n * Resolve Portal API config from overrides → env. Returns null (does NOT throw)\n * when no API key is available, so callers that prefer to degrade gracefully\n * (e.g. portfolio fetchers) can warn-and-skip.\n *\n * Sonor-only: the deprecated `UPTRADE_API_KEY` is intentionally NOT read. The\n * Uptrade brand and the `@uptrademedia/site-kit` package are fully retired and\n * nothing runs on them, so there is no legacy key left to honor.\n */\nexport function resolveServerApiConfig(\n  options: ResolveServerApiConfigOptions = {},\n): ServerApiConfig | null {\n  const apiKey = options.apiKey || process.env.SONOR_API_KEY || ''\n\n  if (!apiKey) return null\n\n  const apiUrl = (\n    options.apiUrl ||\n    process.env.SONOR_API_URL ||\n    process.env.NEXT_PUBLIC_SONOR_API_URL ||\n    DEFAULT_API_URL\n  ).replace(/\\/+$/, '')\n\n  return { apiUrl, apiKey }\n}\n\n/**\n * Like {@link resolveServerApiConfig} but throws when no API key is available.\n * Used by callers that treat a missing key as a hard configuration error\n * (e.g. core SEO server functions).\n */\nexport function requireServerApiConfig(\n  options: ResolveServerApiConfigOptions = {},\n  errorMessage = '@sonordev/site-kit: SONOR_API_KEY environment variable is required for server-side functions',\n): ServerApiConfig {\n  const config = resolveServerApiConfig(options)\n  if (!config) throw new Error(errorMessage)\n  return config\n}\n\n/**\n * Origin for the Portal API preconnect/dns-prefetch hints (handles a custom\n * SONOR_API_URL in staging). Shared by SiteKitLayout and AgencySiteKitLayout so\n * the origin-resolution logic lives in one place.\n */\nexport function resolveApiOrigin(apiUrl?: string): string {\n  const url = apiUrl || process.env.SONOR_API_URL || DEFAULT_API_URL\n  try {\n    return new URL(url.replace(/\\/+$/, '')).origin\n  } catch {\n    return DEFAULT_API_URL\n  }\n}\n\n/** Transient failures during Next SSG (parallel workers, one egress IP). */\nconst RETRYABLE_HTTP = new Set([429, 502, 503])\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise<void>((resolve) => setTimeout(resolve, ms))\n}\n\nexport interface ServerFetchOptions {\n  /** HTTP method. Defaults to 'GET'. */\n  method?: string\n  /**\n   * Request body. An object/array is JSON.stringify-ed; a string is sent as-is.\n   * Omit for GET.\n   */\n  body?: unknown\n  /** Additional headers merged over the defaults (Content-Type + x-api-key). */\n  headers?: Record<string, string>\n  /**\n   * ISR revalidation interval in seconds. Defaults to 24h. Pass 0 to disable\n   * caching for this call.\n   */\n  revalidate?: number\n  /**\n   * Next.js cache tags for on-demand invalidation. Lets a single revalidateTag()\n   * bust every tagged fetch (the pattern agency-site-kit's PORTFOLIO_CACHE_TAG\n   * relies on).\n   */\n  tags?: string[]\n  /** Override the API key for this call. Falls back to env. */\n  apiKey?: string\n  /** Override the API URL for this call. Falls back to env. */\n  apiUrl?: string\n  /**\n   * Retry transient 429/502/503 (and network errors) with exponential backoff.\n   * Defaults to true — the right default for build-time SSG. Pass false to\n   * preserve single-attempt semantics.\n   */\n  retry?: boolean\n  /** Max attempts when retrying. Defaults to 6. */\n  maxAttempts?: number\n  /**\n   * When true, throw if no API key is configured. When false (default), warn and\n   * return null so callers can degrade gracefully.\n   */\n  requireKey?: boolean\n  /** Prefix for warning/error logs, so each consumer is identifiable. */\n  logPrefix?: string\n  /** Extra fetch init passthrough (cache, signal, etc.). */\n  init?: RequestInit\n}\n\n/**\n * The canonical Portal API fetcher.\n *\n * - Injects `x-api-key` automatically (resolved from overrides → env)\n * - JSON request/response\n * - Next.js ISR caching via `next.revalidate` (+ optional cache `tags`)\n * - Optional retry/backoff on transient failures (default on)\n * - Returns null on failure (or missing key, unless `requireKey`) instead of\n *   throwing, so a single bad fetch never crashes a render.\n */\nexport async function serverApiFetch<T>(\n  path: string,\n  options: ServerFetchOptions = {},\n): Promise<T | null> {\n  const {\n    method = 'GET',\n    body,\n    headers: extraHeaders = {},\n    revalidate = DEFAULT_REVALIDATE,\n    tags,\n    apiKey: overrideApiKey,\n    apiUrl: overrideApiUrl,\n    retry = true,\n    maxAttempts = DEFAULT_MAX_ATTEMPTS,\n    requireKey = false,\n    logPrefix = '@sonordev/site-kit',\n    init,\n  } = options\n\n  const overrides = { apiKey: overrideApiKey, apiUrl: overrideApiUrl }\n  let config: ServerApiConfig\n  if (requireKey) {\n    config = requireServerApiConfig(overrides)\n  } else {\n    const resolved = resolveServerApiConfig(overrides)\n    if (!resolved) {\n      console.warn(`${logPrefix}: Missing SONOR_API_KEY — request to ${path} skipped.`)\n      return null\n    }\n    config = resolved\n  }\n\n  const { apiUrl, apiKey } = config\n  const url = `${apiUrl}${path.startsWith('/') ? path : `/${path}`}`\n\n  const serializedBody =\n    body === undefined\n      ? undefined\n      : typeof body === 'string'\n        ? body\n        : JSON.stringify(body)\n\n  const attempts = retry ? Math.max(1, maxAttempts) : 1\n\n  for (let attempt = 1; attempt <= attempts; attempt++) {\n    try {\n      const response = await fetch(url, {\n        ...init,\n        method,\n        headers: {\n          'Content-Type': 'application/json',\n          'x-api-key': apiKey,\n          ...extraHeaders,\n        },\n        ...(serializedBody !== undefined ? { body: serializedBody } : {}),\n        next: { revalidate, ...(tags?.length ? { tags } : {}) },\n      } as RequestInit)\n\n      if (retry && RETRYABLE_HTTP.has(response.status) && attempt < attempts) {\n        await response.text().catch(() => {})\n        const retryAfter = response.headers.get('retry-after')\n        let delayMs = 250 * attempt * attempt + Math.random() * 200\n        if (retryAfter) {\n          const sec = parseInt(retryAfter, 10)\n          if (!Number.isNaN(sec) && sec > 0) delayMs = Math.max(delayMs, sec * 1000)\n        }\n        await sleep(Math.min(delayMs, 10_000))\n        continue\n      }\n\n      if (!response.ok) {\n        let detail = response.statusText\n        try {\n          const err = await response.json().catch(() => ({}))\n          if (err?.message) detail = err.message\n        } catch {\n          /* ignore */\n        }\n        console.warn(`${logPrefix}: API error ${response.status} ${method} ${path}: ${detail}`)\n        return null\n      }\n\n      return (await response.json()) as T\n    } catch (error) {\n      if (retry && attempt < attempts) {\n        await sleep(200 * attempt * attempt + Math.random() * 150)\n        continue\n      }\n      console.warn(\n        `${logPrefix}: Network error for ${url}:`,\n        error instanceof Error ? error.message : error,\n      )\n      return null\n    }\n  }\n\n  return null\n}\n"]}

package/dist/chunk-SACGTFCK.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/og/config.ts","../src/og/template.ts"],"names":[],"mappings":";;;AA8HO,SAAS,aAAa,MAAA,EAAoC;AAC/D,EAAA,OAAO,MAAA;AACT;AAEO,IAAM,QAAA,GAAW;AACjB,IAAM,SAAA,GAAY;AAWlB,IAAM,YAAA,GAAe;AACrB,IAAM,YAAA,GAAe,EAAA;AAOrB,IAAM,cAAA,GAAiB;;;ACjH9B,SAAS,SAAA,GAAoB;AAC3B,EAAA,OAAO,CAAA;AAAA;AAAA,sCAAA,EAE+B,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAAA,EAmBjC,YAAY,CAAA;AAAA,oBAAA,EACT,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA,iCAAA,EAQC,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA,4BAAA,EAIjB,YAAY,CAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mCAAA,EA2BL,SAAS,CAAA;AAAA,kDAAA,EACM,SAAS,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yCAAA,EAOlB,cAAc,CAAA;AAAA;AAAA,SAAA,CAAA;AAGzD;AAEA,SAAS,IAAI,CAAA,EAAmB;AAC9B,EAAA,OAAO,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA;AAC5E;AAEA,SAAS,SAAS,MAAA,EAA8B;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,EAAO,MAAA,GACxB,OAAO,KAAA,GACP,CAAC,EAAE,MAAA,EAAQ,kBAAA,EAAoB,OAAA,EAAS,CAAC,GAAG,GAAG,CAAA;AACnD,EAAA,MAAM,QAAA,GAAW,MACd,GAAA,CAAI,CAAA,CAAA,KAAK,UAAU,CAAA,CAAE,MAAA,CAAO,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC,UAAU,CAAA,CAAE,OAAA,IAAW,CAAC,GAAG,CAAA,EAAG,IAAA,CAAK,GAAG,CAAC,CAAA,CAAE,CAAA,CACvF,IAAA,CAAK,GAAG,CAAA;AACX,EAAA,OAAO,iDAAiD,QAAQ,CAAA,iCAAA,CAAA;AAClE;AAEA,SAAS,cAAc,MAAA,EAA8B;AACnD,EAAA,OAAO,MAAA,CAAO,KAAA,GAAQ,CAAC,CAAA,EAAG,MAAA,IAAU,kBAAA;AACtC;AAEA,SAAS,WAAW,MAAA,EAA8B;AAChD,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,IAAS,EAAC;AAC/B,EAAA,OAAO,KAAA,CAAM,MAAA,GAAS,CAAA,GAAI,KAAA,CAAM,KAAA,CAAM,SAAS,CAAC,CAAA,CAAE,MAAA,GAAS,aAAA,CAAc,MAAM,CAAA;AACjF;AAEA,SAAS,MAAM,KAAA,EAAwB;AACrC,EAAA,OAAO,KAAA,CAAM,SAAS,KAAA,CAAM,IAAA;AAC9B;AAEA,SAAS,iBAAiB,MAAA,EAA8B;AACtD,EAAA,IAAI,CAAC,MAAA,CAAO,UAAA,EAAY,OAAO,EAAA;AAC/B,EAAA,MAAM,EAAE,KAAA,EAAO,IAAA,GAAO,CAAA,EAAG,KAAA,KAAU,MAAA,CAAO,UAAA;AAC1C,EAAA,OAAO;AAAA,4BAAA,EACqB,GAAA,CAAI,KAAK,CAAC,CAAA,qBAAA,EAAwB,IAAI,CAAA;AAAA,EAAA,EAChE,QAAQ,CAAA,qCAAA,EAAwC,GAAA,CAAI,KAAK,CAAC,aAAa,EAAE,CAAA,CAAA;AAC7E;AAEA,SAAS,OAAA,CAAQ,SAAoB,KAAA,EAAwB;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,EAAK,MAAA,EAAQ,OAAO,EAAA;AACjC,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAClB,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,MAAA,EAAS,GAAA,CAAI,CAAC,CAAC,CAAA,OAAA,CAAS,CAAA,CACjC,IAAA,CAAK,2BAA2B,CAAA;AACnC,EAAA,OAAO,sCAAsC,GAAA,CAAI,KAAA,CAAM,MAAM,CAAC,KAAK,IAAI,CAAA,MAAA,CAAA;AACzE;AAEA,SAAS,SAAS,MAAA,EAA8B;AAC9C,EAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAM,GAAI,MAAA;AAC3B,EAAA,MAAM,YAAY,GAAA,CAAI,OAAA,CAAQ,KAAK,CAAA,CAAE,OAAA,CAAQ,OAAO,MAAM,CAAA;AAK1D,EAAA,MAAM,IAAA,GACJ,MAAA,CAAO,IAAA,IAAA,CAAS,MAAA,CAAO,WAAW,MAAA,CAAO,IAAA,GAAO,YAAA,GAAe,QAAA,CAAA,MAAe,UAC1E,CAAA,uBAAA,EAA0B,GAAA,CAAI,MAAA,CAAO,IAAI,CAAC,CAAA,EAAA,CAAA,GAC1C,EAAA;AACN,EAAA,OAAO;AAAA;AAAA,MAAA,EAED,IAAI;AAAA,MAAA,EACJ,OAAA,CAAQ,SAAS,CAAA,oBAAA,EAAuB,GAAA,CAAI,QAAQ,MAAM,CAAC,WAAW,EAAE;AAAA,UAAA,EACpE,SAAS,CAAA;AAAA,MAAA,EACb,OAAA,CAAQ,QAAA,GAAW,CAAA,8BAAA,EAAiC,GAAA,CAAI,MAAM,KAAK,CAAC,CAAC,CAAA,EAAA,EAAK,GAAA,CAAI,OAAA,CAAQ,QAAQ,CAAC,WAAW,EAAE;AAAA,MAAA,EAC5G,OAAA,CAAQ,IAAA,GAAO,CAAA,sCAAA,EAAyC,GAAA,CAAI,WAAW,MAAM,CAAC,CAAC,CAAA,WAAA,EAAc,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAC,WAAW,EAAE;AAAA,UAAA,CAAA;AAEnI;AAEO,SAAS,YAAY,MAAA,EAA8B;AACxD,EAAA,IAAI,MAAA,CAAO,IAAA,EAAM,OAAO,MAAA,CAAO,IAAA;AAC/B,EAAA,IAAI,OAAO,QAAA,EAAU;AACnB,IAAA,OAAO,MAAA,CAAO,SAAS,MAAA,EAAQ;AAAA,MAC7B,GAAA;AAAA,MACA,QAAA,EAAU,SAAS,MAAM,CAAA;AAAA,MACzB,KAAA,EAAO,QAAA;AAAA,MACP,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,EAAE,KAAA,EAAO,IAAA,EAAM,SAAS,IAAA,GAAO,YAAA,GAAe,UAAS,GAAI,MAAA;AACjE,EAAA,MAAM,OAAA,GAAU,cAAc,MAAM,CAAA;AAEpC,EAAA,MAAM,KAAA,GAAQ,IAAA,GACV,CAAA,qCAAA,EAAwC,GAAA,CAAI,KAAA,CAAM,OAAO,CAAC,CAAA,YAAA,EAAe,GAAA,CAAI,IAAI,CAAC,CAAA,QAAA,CAAA,GAClF,EAAA;AAEJ,EAAA,MAAM,QAAQ,MAAA,CAAO,KAAA,GACjB,wCAAwC,MAAA,CAAO,KAAA,CAAM,SAAS,GAAG,CAAA,iBAAA,EAAoB,OAAO,KAAA,CAAM,MAAA,IAAU,EAAE,CAAA,cAAA,EAAiB,GAAA,CAAI,OAAO,KAAA,CAAM,GAAG,CAAC,CAAA,QAAA,CAAA,GACpJ,EAAA;AAEJ,EAAA,MAAM,IAAA,GACJ,MAAA,KAAW,UAAA,GACP,CAAA,2BAAA,EAA8B,KAAK,CAAA,EAAG,QAAA,CAAS,MAAM,CAAC,CAAA,MAAA,CAAA,GACtD,MAAA,KAAW,QAAA,GACT,CAAA,yBAAA,EAA4B,SAAS,MAAM,CAAC,CAAA,MAAA,CAAA,GAC5C,MAAA,KAAW,OAAA,GACT,CAAA,kBAAA,EAAqB,QAAA,CAAS,MAAM,CAAC,CAAA,EAAG,KAAK,CAAA,MAAA,CAAA,GAC7C,CAAA,kBAAA,EAAqB,KAAA,IAAS,KAAK,CAAA,EAAG,QAAA,CAAS,MAAM,CAAC,CAAA,MAAA,CAAA;AAEhE,EAAA,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA,EAIP,QAAA,CAAS,MAAM,CAAC;AAAA;AAAA;AAAA,oBAAA,EAGI,QAAQ,cAAc,SAAS,CAAA;AAAA,uCAAA,EACZ,MAAM,EAAE,CAAA,eAAA,EAAkB,OAAO,CAAA,oBAAA,EAAuB,MAAM,IAAI,CAAA;AAAA;AAAA;AAAA;AAAA,qGAAA,EAIJ,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAA,GAAS,SAAS,GAAG,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mGAAA,EAY3C,MAAM,MAAM,CAAA;AAAA;AAAA,4DAAA,EAEnD,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+FAAA,EAKuB,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ5G,gBAAA,CAAiB,MAAM,CAAC;AAAA,EACxB,IAAI;AAAA,EACJ,OAAA,CAAQ,MAAA,CAAO,OAAA,EAAS,KAAK,CAAC;AAAA,EAC9B,WAAW;AAAA,cAAA,CAAA;AAEb","file":"chunk-SACGTFCK.js","sourcesContent":["/**\n * @sonordev/site-kit/og — OG card config contract.\n *\n * THE SITE OWNS THE THEME. Sonor stores one brand_primary/secondary per\n * project; real sites have full palettes (Ludlow: red, ink, cream, scrim —\n * four tokens where Sonor stores two). So the card's colors, fonts, and\n * layout come from a repo-owned og.config.ts, typically importing the same\n * constants the site itself uses. Sonor brand data is only the zero-config\n * seed used by `sonor-setup og` when no og.config.ts exists.\n *\n * Rendering is BUILD-TIME via headless Chrome (`sonor-setup og`), writing a\n * static public/og.png: full real CSS (no Satori subset), Google Fonts load\n * in the template (no font vendoring), zero runtime cost — the right shape\n * for a force-static fleet. Per-entity runtime cards are a future tier.\n */\n\nexport interface OgTheme {\n  /** Page background behind everything. */\n  bg: string\n  /** Primary text color. */\n  text: string\n  /** Accent (kicker, bar). */\n  accent: string\n  /** Plate/surface color behind the logo. */\n  surface: string\n  /** Muted text (subtitle). Defaults derived from `text` when omitted. */\n  muted?: string\n}\n\nexport interface OgFont {\n  /** Google Fonts family name, e.g. 'Barlow Condensed'. */\n  family: string\n  weights?: number[]\n}\n\nexport interface OgBackground {\n  /** Path under public/, e.g. '/hero-frost.avif'. */\n  image: string\n  /** CSS blur radius in px. */\n  blur?: number\n  /** Overlay color, e.g. 'rgba(17,17,16,.68)'. */\n  scrim?: string\n}\n\nexport interface OgPhoto {\n  /** Path under public/ ('/team.jpg') or an absolute https URL. */\n  src: string\n  /** Pane width in px (default 430). */\n  width?: number\n  /** Corner radius in px (default 24). */\n  radius?: number\n}\n\nexport interface OgContent {\n  /** Small all-caps line above the title. */\n  kicker?: string\n  /** The big line. `\\n` for a manual break. Keep it short — previews truncate. */\n  title: string\n  /** One supporting line. */\n  subtitle?: string\n  /** Handwritten-style accent line (rendered in the last configured font). */\n  hand?: string\n  /** Bottom bar segments, e.g. ['Give an hour', 'ludlowpto.org']. */\n  bar?: string[]\n}\n\n/**\n * A per-route entry in `cards`. Layered over the derived card, so it only\n * states what differs — including inside `content`: a route can override just\n * the subtitle and keep the title Sonor derived. The runtime always merged\n * field by field; this type used to demand a full OgContent, which forced\n * casts in every site that used the documented pattern.\n */\nexport type OgCardOverride = Partial<Omit<OgCardConfig, 'cards' | 'content'>> & {\n  content?: Partial<OgContent>\n}\n\nexport interface OgCardConfig {\n  theme: OgTheme\n  /** First font = display face, second (optional) = hand/accent face. */\n  fonts?: OgFont[]\n  /** Path under public/ to the logo shown on the plate, e.g. '/logo-mark.svg'. */\n  logo?: string\n  background?: OgBackground\n  /**\n   * 'plate-left': logo plate left, copy right (the Ludlow layout).\n   * 'centered': stacked, logo above title.\n   * 'banner': no plate, full-bleed copy.\n   * 'split': copy left, content photo right — for cards that show the page's\n   *   own imagery (a project photo, a product, the storefront).\n   */\n  layout?: 'plate-left' | 'centered' | 'banner' | 'split'\n  /** Content photo for the 'split' layout (also rendered in 'plate-left' when set, replacing the plate). */\n  photo?: OgPhoto\n  content: OgContent\n  /**\n   * Per-page overrides, keyed by route path (`/services/garage`) or its slug\n   * (`services-garage`). Every static route already gets its own card built\n   * from its managed title and description; this is for the handful worth\n   * writing by hand — a campaign landing page, the flagship service.\n   *\n   * Each entry is layered over the site card, so it only states what differs.\n   * Build-time only: never rendered as part of a card.\n   */\n  cards?: Record<string, OgCardOverride>\n  /**\n   * MIDDLE escape hatch: keep the loader/renderer/verifier pipeline but\n   * produce your own document. Receives the config and the same helpers the\n   * stock template uses (esc, fontLink). Root-relative src attributes are\n   * still rewritten to public/ files automatically.\n   */\n  template?: (config: OgCardConfig, helpers: OgTemplateHelpers) => string\n  /** FULL escape hatch: raw HTML replaces everything, no helpers. */\n  html?: string\n}\n\nexport interface OgTemplateHelpers {\n  /** HTML-escape user text. */\n  esc: (s: string) => string\n  /** <link> tag loading the config's Google Fonts. */\n  fontLink: string\n  width: number\n  height: number\n}\n\n/** Identity helper for typed configs: `export default defineOgCard({...})`. */\nexport function defineOgCard(config: OgCardConfig): OgCardConfig {\n  return config\n}\n\nexport const OG_WIDTH = 1200\nexport const OG_HEIGHT = 630\n\n/**\n * Title type scale. The card opens at TITLE_MAX and the in-page fitter steps\n * down until the copy column fits, stopping at TITLE_MIN.\n *\n * The floor is a legibility floor, not a layout one: below ~56px the headline\n * stops reading at the ~300px thumbnail width platforms actually show. A card\n * that would need to go under it is a card whose copy is too long, so the\n * renderer reports that rather than shrinking into mush.\n */\nexport const TITLE_MAX_PX = 104\nexport const TITLE_MIN_PX = 56\n\n/**\n * The attribute the in-page fitter writes its findings to, read back by\n * `sonor-setup og` via Chrome's --dump-dom. Shared so the template and the CLI\n * cannot drift on the name.\n */\nexport const OG_REPORT_ATTR = 'data-og-report'\n\n/** What the in-page fitter reports back about a rendered card. */\nexport interface OgRenderReport {\n  /** Did everything land inside the frame, at or above the legibility floor? */\n  fits: boolean\n  /** Final title size after fitting. Below TITLE_MAX means the copy ran long. */\n  titlePx: number\n  /** Human-readable problems, each naming the element and the overflow. */\n  issues: string[]\n}\n","/**\n * OG card HTML template builder.\n *\n * Turns an OgCardConfig into a self-contained 1200x630 HTML document rendered\n * by headless Chrome. Layout rules baked in from the Ludlow card:\n * - content held inside the middle ~80% (platforms crop toward 2:1 and the\n *   bottom bar is the first casualty)\n * - script/hand faces never below 40px — under that they turn to mush at\n *   iMessage thumbnail width (~300px)\n * - the plate + title must survive alone if everything else is cropped\n */\n\nimport type { OgCardConfig, OgContent, OgTheme } from './config'\nimport {\n  OG_WIDTH,\n  OG_HEIGHT,\n  TITLE_MAX_PX,\n  TITLE_MIN_PX,\n  OG_REPORT_ATTR,\n} from './config'\n\n/**\n * The in-page fitter. Runs inside the render, after webfonts settle, and does\n * the two things a Node-side template cannot:\n *\n *  1. FITS THE TITLE. The h1 opens at TITLE_MAX_PX and steps down until the\n *     copy column fits the frame. Before this the size was fixed, so title\n *     length silently decided whether a card worked — a long one did not\n *     shrink, it pushed the kicker off the top and the subtitle under the\n *     bottom bar, and the CLI still reported success.\n *  2. MEASURES WHAT IS LEFT. Anything still clipped is written to the report\n *     attribute, which `sonor-setup og` reads back through --dump-dom and\n *     turns into a failure. Real measurement, not a character-count estimate.\n *\n * Fonts matter: measuring before `document.fonts.ready` measures the fallback\n * face and produces a size that is wrong for the face that actually renders.\n */\nfunction fitScript(): string {\n  return `<script>\n(async function () {\n  var report = { fits: true, titlePx: ${TITLE_MAX_PX}, issues: [] };\n  function push(msg) { report.fits = false; report.issues.push(msg); }\n  try {\n    try { await document.fonts.ready; } catch (e) {}\n    var h1 = document.querySelector('h1');\n    var copy = document.querySelector('.copy');\n    var wrap = document.querySelector('.wrap');\n    var bar = document.querySelector('.bar');\n\n    if (h1 && copy && wrap) {\n      var cs = getComputedStyle(wrap);\n      var avail = wrap.clientHeight - parseFloat(cs.paddingTop || '0') - parseFloat(cs.paddingBottom || '0');\n\n      // Fit BOTH axes. Height alone is not enough: a single long word\n      // (\"WORKBENCHES\") cannot wrap, so it keeps overflowing the column\n      // sideways at a size that fits vertically. Shrinking for either\n      // condition is what makes an arbitrary managed title safe to render.\n      var tooTall = function () { return copy.scrollHeight > avail; };\n      var tooWide = function () { return h1.scrollWidth > copy.clientWidth + 1; };\n      var size = ${TITLE_MAX_PX};\n      while (size > ${TITLE_MIN_PX} && (tooTall() || tooWide())) {\n        size -= 2;\n        h1.style.fontSize = size + 'px';\n      }\n      report.titlePx = size;\n\n      if (tooTall()) {\n        push('title/subtitle block overflows the card by ' + Math.ceil(copy.scrollHeight - avail) +\n             'px even at the ' + ${TITLE_MIN_PX} + 'px legibility floor - shorten content.title or content.subtitle');\n      }\n      if (tooWide()) {\n        push('the longest title word still overflows the copy column by ' + Math.ceil(h1.scrollWidth - copy.clientWidth) +\n             'px at the ' + ${TITLE_MIN_PX} + 'px floor - shorten it or add a line break');\n      }\n    }\n\n    // The bar is checked on BOTH axes. Width alone missed a real failure: a\n    // long segment wrapped INSIDE its span, so scrollWidth never exceeded\n    // clientWidth while the text grew past the bar's fixed height and spilled\n    // over the subtitle. Segments are nowrap now, which turns that into\n    // horizontal overflow the width check sees, and the height check is the\n    // belt-and-braces for anything else that grows the bar.\n    if (bar) {\n      if (bar.scrollWidth > bar.clientWidth + 1) {\n        push('bottom bar content overflows by ' + Math.ceil(bar.scrollWidth - bar.clientWidth) +\n             'px - drop a content.bar segment or shorten one');\n      }\n      if (bar.scrollHeight > bar.clientHeight + 1) {\n        push('bottom bar content is ' + Math.ceil(bar.scrollHeight - bar.clientHeight) +\n             'px taller than the bar - a segment is wrapping; shorten it');\n      }\n    }\n\n    // Nothing may sit outside the frame platforms actually crop to.\n    var named = [['kicker', '.kicker'], ['title', 'h1'], ['subtitle', '.sub'], ['hand', '.hand'], ['bar', '.bar']];\n    for (var i = 0; i < named.length; i++) {\n      var el = document.querySelector(named[i][1]);\n      if (!el) continue;\n      var r = el.getBoundingClientRect();\n      if (r.top < -1 || r.bottom > ${OG_HEIGHT} + 1) {\n        push(named[i][0] + ' sits outside the ' + ${OG_HEIGHT} + 'px frame (top ' +\n             Math.round(r.top) + ', bottom ' + Math.round(r.bottom) + ')');\n      }\n    }\n  } catch (e) {\n    push('fitter failed: ' + (e && e.message ? e.message : String(e)));\n  }\n  document.documentElement.setAttribute('${OG_REPORT_ATTR}', JSON.stringify(report));\n})();\n</script>`\n}\n\nfunction esc(s: string): string {\n  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')\n}\n\nfunction fontLink(config: OgCardConfig): string {\n  const fonts = config.fonts?.length\n    ? config.fonts\n    : [{ family: 'Barlow Condensed', weights: [800] }]\n  const families = fonts\n    .map(f => `family=${f.family.replace(/ /g, '+')}:wght@${(f.weights || [700]).join(';')}`)\n    .join('&')\n  return `<link href=\"https://fonts.googleapis.com/css2?${families}&display=block\" rel=\"stylesheet\">`\n}\n\nfunction displayFamily(config: OgCardConfig): string {\n  return config.fonts?.[0]?.family || 'Barlow Condensed'\n}\n\nfunction handFamily(config: OgCardConfig): string {\n  const fonts = config.fonts || []\n  return fonts.length > 1 ? fonts[fonts.length - 1].family : displayFamily(config)\n}\n\nfunction muted(theme: OgTheme): string {\n  return theme.muted || theme.text\n}\n\nfunction backgroundLayers(config: OgCardConfig): string {\n  if (!config.background) return ''\n  const { image, blur = 0, scrim } = config.background\n  return `\n  <div class=\"bg\"><img src=\"${esc(image)}\" style=\"filter:blur(${blur}px)\"></div>\n  ${scrim ? `<div class=\"scrim\" style=\"background:${esc(scrim)}\"></div>` : ''}`\n}\n\nfunction barHtml(content: OgContent, theme: OgTheme): string {\n  if (!content.bar?.length) return ''\n  const segs = content.bar\n    .map(s => `<span>${esc(s)}</span>`)\n    .join('<span class=\"dot\"></span>')\n  return `<div class=\"bar\" style=\"background:${esc(theme.accent)}\">${segs}</div>`\n}\n\nfunction copyHtml(config: OgCardConfig): string {\n  const { content, theme } = config\n  const titleHtml = esc(content.title).replace(/\\n/g, '<br>')\n  // In `split` the photo owns the right pane, so a configured logo has nowhere\n  // to go as a plate. It used to be dropped silently. Render it small above the\n  // kicker instead: the brand mark still appears, and the plate invariant that\n  // split has no `.plate` is preserved.\n  const mark =\n    config.logo && (config.layout ?? (config.logo ? 'plate-left' : 'banner')) === 'split'\n      ? `<img class=\"mark\" src=\"${esc(config.logo)}\">`\n      : ''\n  return `\n    <div class=\"copy\">\n      ${mark}\n      ${content.kicker ? `<div class=\"kicker\">${esc(content.kicker)}</div>` : ''}\n      <h1>${titleHtml}</h1>\n      ${content.subtitle ? `<div class=\"sub\" style=\"color:${esc(muted(theme))}\">${esc(content.subtitle)}</div>` : ''}\n      ${content.hand ? `<div class=\"hand\" style=\"font-family:'${esc(handFamily(config))}',cursive\">${esc(content.hand)}</div>` : ''}\n    </div>`\n}\n\nexport function buildOgHtml(config: OgCardConfig): string {\n  if (config.html) return config.html\n  if (config.template) {\n    return config.template(config, {\n      esc,\n      fontLink: fontLink(config),\n      width: OG_WIDTH,\n      height: OG_HEIGHT,\n    })\n  }\n\n  const { theme, logo, layout = logo ? 'plate-left' : 'banner' } = config\n  const display = displayFamily(config)\n\n  const plate = logo\n    ? `<div class=\"plate\" style=\"background:${esc(theme.surface)}\"><img src=\"${esc(logo)}\"></div>`\n    : ''\n\n  const photo = config.photo\n    ? `<div class=\"photo\" style=\"flex-basis:${config.photo.width ?? 430}px;border-radius:${config.photo.radius ?? 24}px\"><img src=\"${esc(config.photo.src)}\"></div>`\n    : ''\n\n  const body =\n    layout === 'centered'\n      ? `<div class=\"wrap centered\">${plate}${copyHtml(config)}</div>`\n      : layout === 'banner'\n        ? `<div class=\"wrap banner\">${copyHtml(config)}</div>`\n        : layout === 'split'\n          ? `<div class=\"wrap\">${copyHtml(config)}${photo}</div>`\n          : `<div class=\"wrap\">${photo || plate}${copyHtml(config)}</div>`\n\n  return `<!doctype html>\n<html><head><meta charset=\"utf-8\">\n<link rel=\"preconnect\" href=\"https://fonts.googleapis.com\">\n<link rel=\"preconnect\" href=\"https://fonts.gstatic.com\" crossorigin>\n${fontLink(config)}\n<style>\n  * { margin:0; padding:0; box-sizing:border-box; }\n  html,body { width:${OG_WIDTH}px; height:${OG_HEIGHT}px; overflow:hidden; }\n  body { position:relative; background:${theme.bg}; font-family:'${display}',sans-serif; color:${theme.text}; }\n  .bg { position:absolute; inset:0; }\n  .bg img { width:100%; height:100%; object-fit:cover; transform:scale(1.05); }\n  .scrim { position:absolute; inset:0; }\n  .wrap { position:relative; height:100%; display:flex; align-items:center; gap:52px; padding:0 68px ${config.content.bar?.length ? '74px' : '0'}; }\n  .wrap.centered { flex-direction:column; justify-content:center; text-align:center; gap:28px; }\n  .wrap.banner { padding-left:90px; }\n  .plate { border-radius:28px; padding:26px; flex:0 0 auto; }\n  .plate img { display:block; width:250px; height:auto; }\n  .centered .plate img { width:180px; }\n  .photo { flex:0 0 auto; height:76%; overflow:hidden; box-shadow:0 8px 40px rgba(0,0,0,.25); }\n  .photo img { width:100%; height:100%; object-fit:cover; display:block; }\n  .copy { flex:1 1 auto; min-width:0; }\n  /* split-layout brand mark: the photo owns the right pane, so the logo rides\n     above the kicker rather than being dropped. */\n  .mark { display:block; height:44px; width:auto; margin-bottom:20px; }\n  .kicker { font-weight:800; text-transform:uppercase; letter-spacing:.22em; font-size:24px; color:${theme.accent}; margin-bottom:14px; }\n  /* Opening size only — the in-page fitter steps this down to fit the frame. */\n  h1 { font-weight:800; text-transform:uppercase; font-size:${TITLE_MAX_PX}px; line-height:.9; letter-spacing:-.01em; }\n  .sub { margin-top:22px; font-size:29px; font-weight:500; line-height:1.32; }\n  /* Never below 40px: script faces are illegible at thumbnail width under that. */\n  .hand { font-size:42px; margin-top:14px; transform:rotate(-1.5deg); display:inline-block; }\n  .bar { position:absolute; left:0; right:0; bottom:0; height:74px; display:flex; align-items:center; justify-content:center; gap:26px;\n         font-weight:800; text-transform:uppercase; letter-spacing:.1em; font-size:31px; color:${theme.surface}; }\n  /* nowrap so an over-long segment overflows the bar sideways, where the\n     fitter's width check sees it, instead of silently wrapping to a second\n     line and spilling over the copy above. */\n  .bar > span { white-space:nowrap; }\n  .bar .dot { width:10px; height:10px; border-radius:50%; background:currentColor; opacity:.55; flex:0 0 auto; }\n</style></head>\n<body>\n${backgroundLayers(config)}\n${body}\n${barHtml(config.content, theme)}\n${fitScript()}\n</body></html>`\n}\n"]}

package/dist/chunk-SRJSR6YP.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/og/config.ts","../src/og/template.ts"],"names":[],"mappings":";AA8HO,SAAS,aAAa,MAAA,EAAoC;AAC/D,EAAA,OAAO,MAAA;AACT;AAEO,IAAM,QAAA,GAAW;AACjB,IAAM,SAAA,GAAY;AAWlB,IAAM,YAAA,GAAe;AACrB,IAAM,YAAA,GAAe,EAAA;AAOrB,IAAM,cAAA,GAAiB;;;ACjH9B,SAAS,SAAA,GAAoB;AAC3B,EAAA,OAAO,CAAA;AAAA;AAAA,sCAAA,EAE+B,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAAA,EAmBjC,YAAY,CAAA;AAAA,oBAAA,EACT,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA,iCAAA,EAQC,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA,4BAAA,EAIjB,YAAY,CAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mCAAA,EA2BL,SAAS,CAAA;AAAA,kDAAA,EACM,SAAS,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yCAAA,EAOlB,cAAc,CAAA;AAAA;AAAA,SAAA,CAAA;AAGzD;AAEA,SAAS,IAAI,CAAA,EAAmB;AAC9B,EAAA,OAAO,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA;AAC5E;AAEA,SAAS,SAAS,MAAA,EAA8B;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,EAAO,MAAA,GACxB,OAAO,KAAA,GACP,CAAC,EAAE,MAAA,EAAQ,kBAAA,EAAoB,OAAA,EAAS,CAAC,GAAG,GAAG,CAAA;AACnD,EAAA,MAAM,QAAA,GAAW,MACd,GAAA,CAAI,CAAA,CAAA,KAAK,UAAU,CAAA,CAAE,MAAA,CAAO,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC,UAAU,CAAA,CAAE,OAAA,IAAW,CAAC,GAAG,CAAA,EAAG,IAAA,CAAK,GAAG,CAAC,CAAA,CAAE,CAAA,CACvF,IAAA,CAAK,GAAG,CAAA;AACX,EAAA,OAAO,iDAAiD,QAAQ,CAAA,iCAAA,CAAA;AAClE;AAEA,SAAS,cAAc,MAAA,EAA8B;AACnD,EAAA,OAAO,MAAA,CAAO,KAAA,GAAQ,CAAC,CAAA,EAAG,MAAA,IAAU,kBAAA;AACtC;AAEA,SAAS,WAAW,MAAA,EAA8B;AAChD,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,IAAS,EAAC;AAC/B,EAAA,OAAO,KAAA,CAAM,MAAA,GAAS,CAAA,GAAI,KAAA,CAAM,KAAA,CAAM,SAAS,CAAC,CAAA,CAAE,MAAA,GAAS,aAAA,CAAc,MAAM,CAAA;AACjF;AAEA,SAAS,MAAM,KAAA,EAAwB;AACrC,EAAA,OAAO,KAAA,CAAM,SAAS,KAAA,CAAM,IAAA;AAC9B;AAEA,SAAS,iBAAiB,MAAA,EAA8B;AACtD,EAAA,IAAI,CAAC,MAAA,CAAO,UAAA,EAAY,OAAO,EAAA;AAC/B,EAAA,MAAM,EAAE,KAAA,EAAO,IAAA,GAAO,CAAA,EAAG,KAAA,KAAU,MAAA,CAAO,UAAA;AAC1C,EAAA,OAAO;AAAA,4BAAA,EACqB,GAAA,CAAI,KAAK,CAAC,CAAA,qBAAA,EAAwB,IAAI,CAAA;AAAA,EAAA,EAChE,QAAQ,CAAA,qCAAA,EAAwC,GAAA,CAAI,KAAK,CAAC,aAAa,EAAE,CAAA,CAAA;AAC7E;AAEA,SAAS,OAAA,CAAQ,SAAoB,KAAA,EAAwB;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,EAAK,MAAA,EAAQ,OAAO,EAAA;AACjC,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAClB,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,MAAA,EAAS,GAAA,CAAI,CAAC,CAAC,CAAA,OAAA,CAAS,CAAA,CACjC,IAAA,CAAK,2BAA2B,CAAA;AACnC,EAAA,OAAO,sCAAsC,GAAA,CAAI,KAAA,CAAM,MAAM,CAAC,KAAK,IAAI,CAAA,MAAA,CAAA;AACzE;AAEA,SAAS,SAAS,MAAA,EAA8B;AAC9C,EAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAM,GAAI,MAAA;AAC3B,EAAA,MAAM,YAAY,GAAA,CAAI,OAAA,CAAQ,KAAK,CAAA,CAAE,OAAA,CAAQ,OAAO,MAAM,CAAA;AAK1D,EAAA,MAAM,IAAA,GACJ,MAAA,CAAO,IAAA,IAAA,CAAS,MAAA,CAAO,WAAW,MAAA,CAAO,IAAA,GAAO,YAAA,GAAe,QAAA,CAAA,MAAe,UAC1E,CAAA,uBAAA,EAA0B,GAAA,CAAI,MAAA,CAAO,IAAI,CAAC,CAAA,EAAA,CAAA,GAC1C,EAAA;AACN,EAAA,OAAO;AAAA;AAAA,MAAA,EAED,IAAI;AAAA,MAAA,EACJ,OAAA,CAAQ,SAAS,CAAA,oBAAA,EAAuB,GAAA,CAAI,QAAQ,MAAM,CAAC,WAAW,EAAE;AAAA,UAAA,EACpE,SAAS,CAAA;AAAA,MAAA,EACb,OAAA,CAAQ,QAAA,GAAW,CAAA,8BAAA,EAAiC,GAAA,CAAI,MAAM,KAAK,CAAC,CAAC,CAAA,EAAA,EAAK,GAAA,CAAI,OAAA,CAAQ,QAAQ,CAAC,WAAW,EAAE;AAAA,MAAA,EAC5G,OAAA,CAAQ,IAAA,GAAO,CAAA,sCAAA,EAAyC,GAAA,CAAI,WAAW,MAAM,CAAC,CAAC,CAAA,WAAA,EAAc,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAC,WAAW,EAAE;AAAA,UAAA,CAAA;AAEnI;AAEO,SAAS,YAAY,MAAA,EAA8B;AACxD,EAAA,IAAI,MAAA,CAAO,IAAA,EAAM,OAAO,MAAA,CAAO,IAAA;AAC/B,EAAA,IAAI,OAAO,QAAA,EAAU;AACnB,IAAA,OAAO,MAAA,CAAO,SAAS,MAAA,EAAQ;AAAA,MAC7B,GAAA;AAAA,MACA,QAAA,EAAU,SAAS,MAAM,CAAA;AAAA,MACzB,KAAA,EAAO,QAAA;AAAA,MACP,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,EAAE,KAAA,EAAO,IAAA,EAAM,SAAS,IAAA,GAAO,YAAA,GAAe,UAAS,GAAI,MAAA;AACjE,EAAA,MAAM,OAAA,GAAU,cAAc,MAAM,CAAA;AAEpC,EAAA,MAAM,KAAA,GAAQ,IAAA,GACV,CAAA,qCAAA,EAAwC,GAAA,CAAI,KAAA,CAAM,OAAO,CAAC,CAAA,YAAA,EAAe,GAAA,CAAI,IAAI,CAAC,CAAA,QAAA,CAAA,GAClF,EAAA;AAEJ,EAAA,MAAM,QAAQ,MAAA,CAAO,KAAA,GACjB,wCAAwC,MAAA,CAAO,KAAA,CAAM,SAAS,GAAG,CAAA,iBAAA,EAAoB,OAAO,KAAA,CAAM,MAAA,IAAU,EAAE,CAAA,cAAA,EAAiB,GAAA,CAAI,OAAO,KAAA,CAAM,GAAG,CAAC,CAAA,QAAA,CAAA,GACpJ,EAAA;AAEJ,EAAA,MAAM,IAAA,GACJ,MAAA,KAAW,UAAA,GACP,CAAA,2BAAA,EAA8B,KAAK,CAAA,EAAG,QAAA,CAAS,MAAM,CAAC,CAAA,MAAA,CAAA,GACtD,MAAA,KAAW,QAAA,GACT,CAAA,yBAAA,EAA4B,SAAS,MAAM,CAAC,CAAA,MAAA,CAAA,GAC5C,MAAA,KAAW,OAAA,GACT,CAAA,kBAAA,EAAqB,QAAA,CAAS,MAAM,CAAC,CAAA,EAAG,KAAK,CAAA,MAAA,CAAA,GAC7C,CAAA,kBAAA,EAAqB,KAAA,IAAS,KAAK,CAAA,EAAG,QAAA,CAAS,MAAM,CAAC,CAAA,MAAA,CAAA;AAEhE,EAAA,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA,EAIP,QAAA,CAAS,MAAM,CAAC;AAAA;AAAA;AAAA,oBAAA,EAGI,QAAQ,cAAc,SAAS,CAAA;AAAA,uCAAA,EACZ,MAAM,EAAE,CAAA,eAAA,EAAkB,OAAO,CAAA,oBAAA,EAAuB,MAAM,IAAI,CAAA;AAAA;AAAA;AAAA;AAAA,qGAAA,EAIJ,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAA,GAAS,SAAS,GAAG,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mGAAA,EAY3C,MAAM,MAAM,CAAA;AAAA;AAAA,4DAAA,EAEnD,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+FAAA,EAKuB,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ5G,gBAAA,CAAiB,MAAM,CAAC;AAAA,EACxB,IAAI;AAAA,EACJ,OAAA,CAAQ,MAAA,CAAO,OAAA,EAAS,KAAK,CAAC;AAAA,EAC9B,WAAW;AAAA,cAAA,CAAA;AAEb","file":"chunk-SRJSR6YP.mjs","sourcesContent":["/**\n * @sonordev/site-kit/og — OG card config contract.\n *\n * THE SITE OWNS THE THEME. Sonor stores one brand_primary/secondary per\n * project; real sites have full palettes (Ludlow: red, ink, cream, scrim —\n * four tokens where Sonor stores two). So the card's colors, fonts, and\n * layout come from a repo-owned og.config.ts, typically importing the same\n * constants the site itself uses. Sonor brand data is only the zero-config\n * seed used by `sonor-setup og` when no og.config.ts exists.\n *\n * Rendering is BUILD-TIME via headless Chrome (`sonor-setup og`), writing a\n * static public/og.png: full real CSS (no Satori subset), Google Fonts load\n * in the template (no font vendoring), zero runtime cost — the right shape\n * for a force-static fleet. Per-entity runtime cards are a future tier.\n */\n\nexport interface OgTheme {\n  /** Page background behind everything. */\n  bg: string\n  /** Primary text color. */\n  text: string\n  /** Accent (kicker, bar). */\n  accent: string\n  /** Plate/surface color behind the logo. */\n  surface: string\n  /** Muted text (subtitle). Defaults derived from `text` when omitted. */\n  muted?: string\n}\n\nexport interface OgFont {\n  /** Google Fonts family name, e.g. 'Barlow Condensed'. */\n  family: string\n  weights?: number[]\n}\n\nexport interface OgBackground {\n  /** Path under public/, e.g. '/hero-frost.avif'. */\n  image: string\n  /** CSS blur radius in px. */\n  blur?: number\n  /** Overlay color, e.g. 'rgba(17,17,16,.68)'. */\n  scrim?: string\n}\n\nexport interface OgPhoto {\n  /** Path under public/ ('/team.jpg') or an absolute https URL. */\n  src: string\n  /** Pane width in px (default 430). */\n  width?: number\n  /** Corner radius in px (default 24). */\n  radius?: number\n}\n\nexport interface OgContent {\n  /** Small all-caps line above the title. */\n  kicker?: string\n  /** The big line. `\\n` for a manual break. Keep it short — previews truncate. */\n  title: string\n  /** One supporting line. */\n  subtitle?: string\n  /** Handwritten-style accent line (rendered in the last configured font). */\n  hand?: string\n  /** Bottom bar segments, e.g. ['Give an hour', 'ludlowpto.org']. */\n  bar?: string[]\n}\n\n/**\n * A per-route entry in `cards`. Layered over the derived card, so it only\n * states what differs — including inside `content`: a route can override just\n * the subtitle and keep the title Sonor derived. The runtime always merged\n * field by field; this type used to demand a full OgContent, which forced\n * casts in every site that used the documented pattern.\n */\nexport type OgCardOverride = Partial<Omit<OgCardConfig, 'cards' | 'content'>> & {\n  content?: Partial<OgContent>\n}\n\nexport interface OgCardConfig {\n  theme: OgTheme\n  /** First font = display face, second (optional) = hand/accent face. */\n  fonts?: OgFont[]\n  /** Path under public/ to the logo shown on the plate, e.g. '/logo-mark.svg'. */\n  logo?: string\n  background?: OgBackground\n  /**\n   * 'plate-left': logo plate left, copy right (the Ludlow layout).\n   * 'centered': stacked, logo above title.\n   * 'banner': no plate, full-bleed copy.\n   * 'split': copy left, content photo right — for cards that show the page's\n   *   own imagery (a project photo, a product, the storefront).\n   */\n  layout?: 'plate-left' | 'centered' | 'banner' | 'split'\n  /** Content photo for the 'split' layout (also rendered in 'plate-left' when set, replacing the plate). */\n  photo?: OgPhoto\n  content: OgContent\n  /**\n   * Per-page overrides, keyed by route path (`/services/garage`) or its slug\n   * (`services-garage`). Every static route already gets its own card built\n   * from its managed title and description; this is for the handful worth\n   * writing by hand — a campaign landing page, the flagship service.\n   *\n   * Each entry is layered over the site card, so it only states what differs.\n   * Build-time only: never rendered as part of a card.\n   */\n  cards?: Record<string, OgCardOverride>\n  /**\n   * MIDDLE escape hatch: keep the loader/renderer/verifier pipeline but\n   * produce your own document. Receives the config and the same helpers the\n   * stock template uses (esc, fontLink). Root-relative src attributes are\n   * still rewritten to public/ files automatically.\n   */\n  template?: (config: OgCardConfig, helpers: OgTemplateHelpers) => string\n  /** FULL escape hatch: raw HTML replaces everything, no helpers. */\n  html?: string\n}\n\nexport interface OgTemplateHelpers {\n  /** HTML-escape user text. */\n  esc: (s: string) => string\n  /** <link> tag loading the config's Google Fonts. */\n  fontLink: string\n  width: number\n  height: number\n}\n\n/** Identity helper for typed configs: `export default defineOgCard({...})`. */\nexport function defineOgCard(config: OgCardConfig): OgCardConfig {\n  return config\n}\n\nexport const OG_WIDTH = 1200\nexport const OG_HEIGHT = 630\n\n/**\n * Title type scale. The card opens at TITLE_MAX and the in-page fitter steps\n * down until the copy column fits, stopping at TITLE_MIN.\n *\n * The floor is a legibility floor, not a layout one: below ~56px the headline\n * stops reading at the ~300px thumbnail width platforms actually show. A card\n * that would need to go under it is a card whose copy is too long, so the\n * renderer reports that rather than shrinking into mush.\n */\nexport const TITLE_MAX_PX = 104\nexport const TITLE_MIN_PX = 56\n\n/**\n * The attribute the in-page fitter writes its findings to, read back by\n * `sonor-setup og` via Chrome's --dump-dom. Shared so the template and the CLI\n * cannot drift on the name.\n */\nexport const OG_REPORT_ATTR = 'data-og-report'\n\n/** What the in-page fitter reports back about a rendered card. */\nexport interface OgRenderReport {\n  /** Did everything land inside the frame, at or above the legibility floor? */\n  fits: boolean\n  /** Final title size after fitting. Below TITLE_MAX means the copy ran long. */\n  titlePx: number\n  /** Human-readable problems, each naming the element and the overflow. */\n  issues: string[]\n}\n","/**\n * OG card HTML template builder.\n *\n * Turns an OgCardConfig into a self-contained 1200x630 HTML document rendered\n * by headless Chrome. Layout rules baked in from the Ludlow card:\n * - content held inside the middle ~80% (platforms crop toward 2:1 and the\n *   bottom bar is the first casualty)\n * - script/hand faces never below 40px — under that they turn to mush at\n *   iMessage thumbnail width (~300px)\n * - the plate + title must survive alone if everything else is cropped\n */\n\nimport type { OgCardConfig, OgContent, OgTheme } from './config'\nimport {\n  OG_WIDTH,\n  OG_HEIGHT,\n  TITLE_MAX_PX,\n  TITLE_MIN_PX,\n  OG_REPORT_ATTR,\n} from './config'\n\n/**\n * The in-page fitter. Runs inside the render, after webfonts settle, and does\n * the two things a Node-side template cannot:\n *\n *  1. FITS THE TITLE. The h1 opens at TITLE_MAX_PX and steps down until the\n *     copy column fits the frame. Before this the size was fixed, so title\n *     length silently decided whether a card worked — a long one did not\n *     shrink, it pushed the kicker off the top and the subtitle under the\n *     bottom bar, and the CLI still reported success.\n *  2. MEASURES WHAT IS LEFT. Anything still clipped is written to the report\n *     attribute, which `sonor-setup og` reads back through --dump-dom and\n *     turns into a failure. Real measurement, not a character-count estimate.\n *\n * Fonts matter: measuring before `document.fonts.ready` measures the fallback\n * face and produces a size that is wrong for the face that actually renders.\n */\nfunction fitScript(): string {\n  return `<script>\n(async function () {\n  var report = { fits: true, titlePx: ${TITLE_MAX_PX}, issues: [] };\n  function push(msg) { report.fits = false; report.issues.push(msg); }\n  try {\n    try { await document.fonts.ready; } catch (e) {}\n    var h1 = document.querySelector('h1');\n    var copy = document.querySelector('.copy');\n    var wrap = document.querySelector('.wrap');\n    var bar = document.querySelector('.bar');\n\n    if (h1 && copy && wrap) {\n      var cs = getComputedStyle(wrap);\n      var avail = wrap.clientHeight - parseFloat(cs.paddingTop || '0') - parseFloat(cs.paddingBottom || '0');\n\n      // Fit BOTH axes. Height alone is not enough: a single long word\n      // (\"WORKBENCHES\") cannot wrap, so it keeps overflowing the column\n      // sideways at a size that fits vertically. Shrinking for either\n      // condition is what makes an arbitrary managed title safe to render.\n      var tooTall = function () { return copy.scrollHeight > avail; };\n      var tooWide = function () { return h1.scrollWidth > copy.clientWidth + 1; };\n      var size = ${TITLE_MAX_PX};\n      while (size > ${TITLE_MIN_PX} && (tooTall() || tooWide())) {\n        size -= 2;\n        h1.style.fontSize = size + 'px';\n      }\n      report.titlePx = size;\n\n      if (tooTall()) {\n        push('title/subtitle block overflows the card by ' + Math.ceil(copy.scrollHeight - avail) +\n             'px even at the ' + ${TITLE_MIN_PX} + 'px legibility floor - shorten content.title or content.subtitle');\n      }\n      if (tooWide()) {\n        push('the longest title word still overflows the copy column by ' + Math.ceil(h1.scrollWidth - copy.clientWidth) +\n             'px at the ' + ${TITLE_MIN_PX} + 'px floor - shorten it or add a line break');\n      }\n    }\n\n    // The bar is checked on BOTH axes. Width alone missed a real failure: a\n    // long segment wrapped INSIDE its span, so scrollWidth never exceeded\n    // clientWidth while the text grew past the bar's fixed height and spilled\n    // over the subtitle. Segments are nowrap now, which turns that into\n    // horizontal overflow the width check sees, and the height check is the\n    // belt-and-braces for anything else that grows the bar.\n    if (bar) {\n      if (bar.scrollWidth > bar.clientWidth + 1) {\n        push('bottom bar content overflows by ' + Math.ceil(bar.scrollWidth - bar.clientWidth) +\n             'px - drop a content.bar segment or shorten one');\n      }\n      if (bar.scrollHeight > bar.clientHeight + 1) {\n        push('bottom bar content is ' + Math.ceil(bar.scrollHeight - bar.clientHeight) +\n             'px taller than the bar - a segment is wrapping; shorten it');\n      }\n    }\n\n    // Nothing may sit outside the frame platforms actually crop to.\n    var named = [['kicker', '.kicker'], ['title', 'h1'], ['subtitle', '.sub'], ['hand', '.hand'], ['bar', '.bar']];\n    for (var i = 0; i < named.length; i++) {\n      var el = document.querySelector(named[i][1]);\n      if (!el) continue;\n      var r = el.getBoundingClientRect();\n      if (r.top < -1 || r.bottom > ${OG_HEIGHT} + 1) {\n        push(named[i][0] + ' sits outside the ' + ${OG_HEIGHT} + 'px frame (top ' +\n             Math.round(r.top) + ', bottom ' + Math.round(r.bottom) + ')');\n      }\n    }\n  } catch (e) {\n    push('fitter failed: ' + (e && e.message ? e.message : String(e)));\n  }\n  document.documentElement.setAttribute('${OG_REPORT_ATTR}', JSON.stringify(report));\n})();\n</script>`\n}\n\nfunction esc(s: string): string {\n  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')\n}\n\nfunction fontLink(config: OgCardConfig): string {\n  const fonts = config.fonts?.length\n    ? config.fonts\n    : [{ family: 'Barlow Condensed', weights: [800] }]\n  const families = fonts\n    .map(f => `family=${f.family.replace(/ /g, '+')}:wght@${(f.weights || [700]).join(';')}`)\n    .join('&')\n  return `<link href=\"https://fonts.googleapis.com/css2?${families}&display=block\" rel=\"stylesheet\">`\n}\n\nfunction displayFamily(config: OgCardConfig): string {\n  return config.fonts?.[0]?.family || 'Barlow Condensed'\n}\n\nfunction handFamily(config: OgCardConfig): string {\n  const fonts = config.fonts || []\n  return fonts.length > 1 ? fonts[fonts.length - 1].family : displayFamily(config)\n}\n\nfunction muted(theme: OgTheme): string {\n  return theme.muted || theme.text\n}\n\nfunction backgroundLayers(config: OgCardConfig): string {\n  if (!config.background) return ''\n  const { image, blur = 0, scrim } = config.background\n  return `\n  <div class=\"bg\"><img src=\"${esc(image)}\" style=\"filter:blur(${blur}px)\"></div>\n  ${scrim ? `<div class=\"scrim\" style=\"background:${esc(scrim)}\"></div>` : ''}`\n}\n\nfunction barHtml(content: OgContent, theme: OgTheme): string {\n  if (!content.bar?.length) return ''\n  const segs = content.bar\n    .map(s => `<span>${esc(s)}</span>`)\n    .join('<span class=\"dot\"></span>')\n  return `<div class=\"bar\" style=\"background:${esc(theme.accent)}\">${segs}</div>`\n}\n\nfunction copyHtml(config: OgCardConfig): string {\n  const { content, theme } = config\n  const titleHtml = esc(content.title).replace(/\\n/g, '<br>')\n  // In `split` the photo owns the right pane, so a configured logo has nowhere\n  // to go as a plate. It used to be dropped silently. Render it small above the\n  // kicker instead: the brand mark still appears, and the plate invariant that\n  // split has no `.plate` is preserved.\n  const mark =\n    config.logo && (config.layout ?? (config.logo ? 'plate-left' : 'banner')) === 'split'\n      ? `<img class=\"mark\" src=\"${esc(config.logo)}\">`\n      : ''\n  return `\n    <div class=\"copy\">\n      ${mark}\n      ${content.kicker ? `<div class=\"kicker\">${esc(content.kicker)}</div>` : ''}\n      <h1>${titleHtml}</h1>\n      ${content.subtitle ? `<div class=\"sub\" style=\"color:${esc(muted(theme))}\">${esc(content.subtitle)}</div>` : ''}\n      ${content.hand ? `<div class=\"hand\" style=\"font-family:'${esc(handFamily(config))}',cursive\">${esc(content.hand)}</div>` : ''}\n    </div>`\n}\n\nexport function buildOgHtml(config: OgCardConfig): string {\n  if (config.html) return config.html\n  if (config.template) {\n    return config.template(config, {\n      esc,\n      fontLink: fontLink(config),\n      width: OG_WIDTH,\n      height: OG_HEIGHT,\n    })\n  }\n\n  const { theme, logo, layout = logo ? 'plate-left' : 'banner' } = config\n  const display = displayFamily(config)\n\n  const plate = logo\n    ? `<div class=\"plate\" style=\"background:${esc(theme.surface)}\"><img src=\"${esc(logo)}\"></div>`\n    : ''\n\n  const photo = config.photo\n    ? `<div class=\"photo\" style=\"flex-basis:${config.photo.width ?? 430}px;border-radius:${config.photo.radius ?? 24}px\"><img src=\"${esc(config.photo.src)}\"></div>`\n    : ''\n\n  const body =\n    layout === 'centered'\n      ? `<div class=\"wrap centered\">${plate}${copyHtml(config)}</div>`\n      : layout === 'banner'\n        ? `<div class=\"wrap banner\">${copyHtml(config)}</div>`\n        : layout === 'split'\n          ? `<div class=\"wrap\">${copyHtml(config)}${photo}</div>`\n          : `<div class=\"wrap\">${photo || plate}${copyHtml(config)}</div>`\n\n  return `<!doctype html>\n<html><head><meta charset=\"utf-8\">\n<link rel=\"preconnect\" href=\"https://fonts.googleapis.com\">\n<link rel=\"preconnect\" href=\"https://fonts.gstatic.com\" crossorigin>\n${fontLink(config)}\n<style>\n  * { margin:0; padding:0; box-sizing:border-box; }\n  html,body { width:${OG_WIDTH}px; height:${OG_HEIGHT}px; overflow:hidden; }\n  body { position:relative; background:${theme.bg}; font-family:'${display}',sans-serif; color:${theme.text}; }\n  .bg { position:absolute; inset:0; }\n  .bg img { width:100%; height:100%; object-fit:cover; transform:scale(1.05); }\n  .scrim { position:absolute; inset:0; }\n  .wrap { position:relative; height:100%; display:flex; align-items:center; gap:52px; padding:0 68px ${config.content.bar?.length ? '74px' : '0'}; }\n  .wrap.centered { flex-direction:column; justify-content:center; text-align:center; gap:28px; }\n  .wrap.banner { padding-left:90px; }\n  .plate { border-radius:28px; padding:26px; flex:0 0 auto; }\n  .plate img { display:block; width:250px; height:auto; }\n  .centered .plate img { width:180px; }\n  .photo { flex:0 0 auto; height:76%; overflow:hidden; box-shadow:0 8px 40px rgba(0,0,0,.25); }\n  .photo img { width:100%; height:100%; object-fit:cover; display:block; }\n  .copy { flex:1 1 auto; min-width:0; }\n  /* split-layout brand mark: the photo owns the right pane, so the logo rides\n     above the kicker rather than being dropped. */\n  .mark { display:block; height:44px; width:auto; margin-bottom:20px; }\n  .kicker { font-weight:800; text-transform:uppercase; letter-spacing:.22em; font-size:24px; color:${theme.accent}; margin-bottom:14px; }\n  /* Opening size only — the in-page fitter steps this down to fit the frame. */\n  h1 { font-weight:800; text-transform:uppercase; font-size:${TITLE_MAX_PX}px; line-height:.9; letter-spacing:-.01em; }\n  .sub { margin-top:22px; font-size:29px; font-weight:500; line-height:1.32; }\n  /* Never below 40px: script faces are illegible at thumbnail width under that. */\n  .hand { font-size:42px; margin-top:14px; transform:rotate(-1.5deg); display:inline-block; }\n  .bar { position:absolute; left:0; right:0; bottom:0; height:74px; display:flex; align-items:center; justify-content:center; gap:26px;\n         font-weight:800; text-transform:uppercase; letter-spacing:.1em; font-size:31px; color:${theme.surface}; }\n  /* nowrap so an over-long segment overflows the bar sideways, where the\n     fitter's width check sees it, instead of silently wrapping to a second\n     line and spilling over the copy above. */\n  .bar > span { white-space:nowrap; }\n  .bar .dot { width:10px; height:10px; border-radius:50%; background:currentColor; opacity:.55; flex:0 0 auto; }\n</style></head>\n<body>\n${backgroundLayers(config)}\n${body}\n${barHtml(config.content, theme)}\n${fitScript()}\n</body></html>`\n}\n"]}

package/dist/chunk-UDBUK5ZJ.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/server-fetch.ts"],"names":[],"mappings":";;;AAsBA,IAAM,eAAA,GAAkB,sBAAA;AACxB,IAAM,kBAAA,GAAqB,KAAA;AAC3B,IAAM,oBAAA,GAAuB,CAAA;AAwBtB,SAAS,sBAAA,CACd,OAAA,GAAyC,EAAC,EAClB;AACxB,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,IAAU,OAAA,CAAQ,IAAI,aAAA,IAAiB,EAAA;AAE9D,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AAEpB,EAAA,MAAM,MAAA,GAAA,CACJ,OAAA,CAAQ,MAAA,IACR,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,OAAA,CAAQ,GAAA,CAAI,yBAAA,IACZ,eAAA,EACA,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAEpB,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC1B;AAOO,SAAS,sBAAA,CACd,OAAA,GAAyC,EAAC,EAC1C,eAAe,8FAAA,EACE;AACjB,EAAA,MAAM,MAAA,GAAS,uBAAuB,OAAO,CAAA;AAC7C,EAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,MAAM,YAAY,CAAA;AACzC,EAAA,OAAO,MAAA;AACT;AAOO,SAAS,iBAAiB,MAAA,EAAyB;AACxD,EAAA,MAAM,GAAA,GAAM,MAAA,IAAU,OAAA,CAAQ,GAAA,CAAI,aAAA,IAAiB,eAAA;AACnD,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,GAAA,CAAI,GAAA,CAAI,QAAQ,MAAA,EAAQ,EAAE,CAAC,CAAA,CAAE,MAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,eAAA;AAAA,EACT;AACF;AAGA,IAAM,iCAAiB,IAAI,GAAA,CAAI,CAAC,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAE9C,SAAS,MAAM,EAAA,EAA2B;AACxC,EAAA,OAAO,IAAI,OAAA,CAAc,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AAC/D;AAwDA,eAAsB,cAAA,CACpB,IAAA,EACA,OAAA,GAA8B,EAAC,EACZ;AACnB,EAAA,MAAM;AAAA,IACJ,MAAA,GAAS,KAAA;AAAA,IACT,IAAA;AAAA,IACA,OAAA,EAAS,eAAe,EAAC;AAAA,IACzB,UAAA,GAAa,kBAAA;AAAA,IACb,IAAA;AAAA,IACA,MAAA,EAAQ,cAAA;AAAA,IACR,MAAA,EAAQ,cAAA;AAAA,IACR,KAAA,GAAQ,IAAA;AAAA,IACR,WAAA,GAAc,oBAAA;AAAA,IACd,UAAA,GAAa,KAAA;AAAA,IACb,SAAA,GAAY,oBAAA;AAAA,IACZ;AAAA,GACF,GAAI,OAAA;AAEJ,EAAA,MAAM,SAAA,GAAY,EAAE,MAAA,EAAQ,cAAA,EAAgB,QAAQ,cAAA,EAAe;AACnE,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAA,GAAS,uBAAuB,SAAS,CAAA;AAAA,EAC3C,CAAA,MAAO;AACL,IAAA,MAAM,QAAA,GAAW,uBAAuB,SAAS,CAAA;AACjD,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,EAAG,SAAS,CAAA,0CAAA,EAAwC,IAAI,CAAA,SAAA,CAAW,CAAA;AAChF,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,MAAA,GAAS,QAAA;AAAA,EACX;AAEA,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,MAAA;AAC3B,EAAA,MAAM,GAAA,GAAM,CAAA,EAAG,MAAM,CAAA,EAAG,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAI,IAAA,GAAO,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA,CAAA;AAEhE,EAAA,MAAM,cAAA,GACJ,IAAA,KAAS,MAAA,GACL,MAAA,GACA,OAAO,SAAS,QAAA,GACd,IAAA,GACA,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAE3B,EAAA,MAAM,WAAW,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,WAAW,CAAA,GAAI,CAAA;AAEpD,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,QAAA,EAAU,OAAA,EAAA,EAAW;AACpD,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,QAChC,GAAG,IAAA;AAAA,QACH,MAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,WAAA,EAAa,MAAA;AAAA,UACb,GAAG;AAAA,SACL;AAAA,QACA,GAAI,cAAA,KAAmB,KAAA,CAAA,GAAY,EAAE,IAAA,EAAM,cAAA,KAAmB,EAAC;AAAA,QAC/D,IAAA,EAAM,EAAE,UAAA,EAAY,GAAI,IAAA,EAAM,SAAS,EAAE,IAAA,EAAK,GAAI,EAAC;AAAG,OACxC,CAAA;AAEhB,MAAA,IAAI,SAAS,cAAA,CAAe,GAAA,CAAI,SAAS,MAAM,CAAA,IAAK,UAAU,QAAA,EAAU;AACtE,QAAA,MAAM,QAAA,CAAS,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM;AAAA,QAAC,CAAC,CAAA;AACpC,QAAA,MAAM,UAAA,GAAa,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACrD,QAAA,IAAI,UAAU,GAAA,GAAM,OAAA,GAAU,OAAA,GAAU,IAAA,CAAK,QAAO,GAAI,GAAA;AACxD,QAAA,IAAI,UAAA,EAAY;AACd,UAAA,MAAM,GAAA,GAAM,QAAA,CAAS,UAAA,EAAY,EAAE,CAAA;AACnC,UAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,IAAK,GAAA,GAAM,CAAA,EAAG,OAAA,GAAU,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,GAAA,GAAM,GAAI,CAAA;AAAA,QAC3E;AACA,QAAA,MAAM,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,GAAM,CAAC,CAAA;AACrC,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,IAAI,SAAS,QAAA,CAAS,UAAA;AACtB,QAAA,IAAI;AACF,UAAA,MAAM,GAAA,GAAM,MAAM,QAAA,CAAS,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AAClD,UAAA,IAAI,GAAA,EAAK,OAAA,EAAS,MAAA,GAAS,GAAA,CAAI,OAAA;AAAA,QACjC,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,EAAG,SAAS,CAAA,YAAA,EAAe,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,EAAA,EAAK,MAAM,CAAA,CAAE,CAAA;AACtF,QAAA,OAAO,IAAA;AAAA,MACT;AAEA,MAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,IAC9B,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,KAAA,IAAS,UAAU,QAAA,EAAU;AAC/B,QAAA,MAAM,MAAM,GAAA,GAAM,OAAA,GAAU,UAAU,IAAA,CAAK,MAAA,KAAW,GAAG,CAAA;AACzD,QAAA;AAAA,MACF;AACA,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,EAAG,SAAS,CAAA,oBAAA,EAAuB,GAAG,CAAA,CAAA,CAAA;AAAA,QACtC,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU;AAAA,OAC3C;AACA,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT","file":"chunk-UDBUK5ZJ.mjs","sourcesContent":["/**\n * @sonordev/site-kit/server — Shared server-fetch primitive\n *\n * SECURITY: Server-only. Reads SONOR_API_KEY from process.env and injects it as\n * `x-api-key`. Importing this module into a client component is a hard build\n * error (see `import 'server-only'` below) — the API key must never reach the\n * browser. Project is resolved by the Portal from the API key; sites never send\n * or read a project ID (x-api-key only).\n *\n * This is the SINGLE SOURCE OF TRUTH for site-kit's server data plane. It is the\n * canonical fetcher that:\n *   - core `seo/server-api.ts` builds its cached SEO fetchers on,\n *   - `@sonordev/agency-site-kit` builds its portfolio fetchers on, and\n *   - `@sonordev/re-site-kit` (real-estate) builds its listing fetchers on.\n *\n * The retry/backoff + config-resolution logic here was extracted from\n * `seo/server-api.ts` so there is exactly one copy — do NOT re-fork it into a\n * sibling package. Import it from `@sonordev/site-kit/server` instead.\n */\n\nimport 'server-only'\n\nconst DEFAULT_API_URL = 'https://api.sonor.io'\nconst DEFAULT_REVALIDATE = 86400 // 24h — Portal data rarely changes; on-demand revalidate busts it\nconst DEFAULT_MAX_ATTEMPTS = 6\n\n/** Resolved Portal API config. */\nexport interface ServerApiConfig {\n  apiUrl: string\n  apiKey: string\n}\n\nexport interface ResolveServerApiConfigOptions {\n  /** Override the API key (e.g. passed from a layout prop). Falls back to env. */\n  apiKey?: string\n  /** Override the API URL. Falls back to env, then https://api.sonor.io. */\n  apiUrl?: string\n}\n\n/**\n * Resolve Portal API config from overrides → env. Returns null (does NOT throw)\n * when no API key is available, so callers that prefer to degrade gracefully\n * (e.g. portfolio fetchers) can warn-and-skip.\n *\n * Sonor-only: the deprecated `UPTRADE_API_KEY` is intentionally NOT read. The\n * Uptrade brand and the `@uptrademedia/site-kit` package are fully retired and\n * nothing runs on them, so there is no legacy key left to honor.\n */\nexport function resolveServerApiConfig(\n  options: ResolveServerApiConfigOptions = {},\n): ServerApiConfig | null {\n  const apiKey = options.apiKey || process.env.SONOR_API_KEY || ''\n\n  if (!apiKey) return null\n\n  const apiUrl = (\n    options.apiUrl ||\n    process.env.SONOR_API_URL ||\n    process.env.NEXT_PUBLIC_SONOR_API_URL ||\n    DEFAULT_API_URL\n  ).replace(/\\/+$/, '')\n\n  return { apiUrl, apiKey }\n}\n\n/**\n * Like {@link resolveServerApiConfig} but throws when no API key is available.\n * Used by callers that treat a missing key as a hard configuration error\n * (e.g. core SEO server functions).\n */\nexport function requireServerApiConfig(\n  options: ResolveServerApiConfigOptions = {},\n  errorMessage = '@sonordev/site-kit: SONOR_API_KEY environment variable is required for server-side functions',\n): ServerApiConfig {\n  const config = resolveServerApiConfig(options)\n  if (!config) throw new Error(errorMessage)\n  return config\n}\n\n/**\n * Origin for the Portal API preconnect/dns-prefetch hints (handles a custom\n * SONOR_API_URL in staging). Shared by SiteKitLayout and AgencySiteKitLayout so\n * the origin-resolution logic lives in one place.\n */\nexport function resolveApiOrigin(apiUrl?: string): string {\n  const url = apiUrl || process.env.SONOR_API_URL || DEFAULT_API_URL\n  try {\n    return new URL(url.replace(/\\/+$/, '')).origin\n  } catch {\n    return DEFAULT_API_URL\n  }\n}\n\n/** Transient failures during Next SSG (parallel workers, one egress IP). */\nconst RETRYABLE_HTTP = new Set([429, 502, 503])\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise<void>((resolve) => setTimeout(resolve, ms))\n}\n\nexport interface ServerFetchOptions {\n  /** HTTP method. Defaults to 'GET'. */\n  method?: string\n  /**\n   * Request body. An object/array is JSON.stringify-ed; a string is sent as-is.\n   * Omit for GET.\n   */\n  body?: unknown\n  /** Additional headers merged over the defaults (Content-Type + x-api-key). */\n  headers?: Record<string, string>\n  /**\n   * ISR revalidation interval in seconds. Defaults to 24h. Pass 0 to disable\n   * caching for this call.\n   */\n  revalidate?: number\n  /**\n   * Next.js cache tags for on-demand invalidation. Lets a single revalidateTag()\n   * bust every tagged fetch (the pattern agency-site-kit's PORTFOLIO_CACHE_TAG\n   * relies on).\n   */\n  tags?: string[]\n  /** Override the API key for this call. Falls back to env. */\n  apiKey?: string\n  /** Override the API URL for this call. Falls back to env. */\n  apiUrl?: string\n  /**\n   * Retry transient 429/502/503 (and network errors) with exponential backoff.\n   * Defaults to true — the right default for build-time SSG. Pass false to\n   * preserve single-attempt semantics.\n   */\n  retry?: boolean\n  /** Max attempts when retrying. Defaults to 6. */\n  maxAttempts?: number\n  /**\n   * When true, throw if no API key is configured. When false (default), warn and\n   * return null so callers can degrade gracefully.\n   */\n  requireKey?: boolean\n  /** Prefix for warning/error logs, so each consumer is identifiable. */\n  logPrefix?: string\n  /** Extra fetch init passthrough (cache, signal, etc.). */\n  init?: RequestInit\n}\n\n/**\n * The canonical Portal API fetcher.\n *\n * - Injects `x-api-key` automatically (resolved from overrides → env)\n * - JSON request/response\n * - Next.js ISR caching via `next.revalidate` (+ optional cache `tags`)\n * - Optional retry/backoff on transient failures (default on)\n * - Returns null on failure (or missing key, unless `requireKey`) instead of\n *   throwing, so a single bad fetch never crashes a render.\n */\nexport async function serverApiFetch<T>(\n  path: string,\n  options: ServerFetchOptions = {},\n): Promise<T | null> {\n  const {\n    method = 'GET',\n    body,\n    headers: extraHeaders = {},\n    revalidate = DEFAULT_REVALIDATE,\n    tags,\n    apiKey: overrideApiKey,\n    apiUrl: overrideApiUrl,\n    retry = true,\n    maxAttempts = DEFAULT_MAX_ATTEMPTS,\n    requireKey = false,\n    logPrefix = '@sonordev/site-kit',\n    init,\n  } = options\n\n  const overrides = { apiKey: overrideApiKey, apiUrl: overrideApiUrl }\n  let config: ServerApiConfig\n  if (requireKey) {\n    config = requireServerApiConfig(overrides)\n  } else {\n    const resolved = resolveServerApiConfig(overrides)\n    if (!resolved) {\n      console.warn(`${logPrefix}: Missing SONOR_API_KEY — request to ${path} skipped.`)\n      return null\n    }\n    config = resolved\n  }\n\n  const { apiUrl, apiKey } = config\n  const url = `${apiUrl}${path.startsWith('/') ? path : `/${path}`}`\n\n  const serializedBody =\n    body === undefined\n      ? undefined\n      : typeof body === 'string'\n        ? body\n        : JSON.stringify(body)\n\n  const attempts = retry ? Math.max(1, maxAttempts) : 1\n\n  for (let attempt = 1; attempt <= attempts; attempt++) {\n    try {\n      const response = await fetch(url, {\n        ...init,\n        method,\n        headers: {\n          'Content-Type': 'application/json',\n          'x-api-key': apiKey,\n          ...extraHeaders,\n        },\n        ...(serializedBody !== undefined ? { body: serializedBody } : {}),\n        next: { revalidate, ...(tags?.length ? { tags } : {}) },\n      } as RequestInit)\n\n      if (retry && RETRYABLE_HTTP.has(response.status) && attempt < attempts) {\n        await response.text().catch(() => {})\n        const retryAfter = response.headers.get('retry-after')\n        let delayMs = 250 * attempt * attempt + Math.random() * 200\n        if (retryAfter) {\n          const sec = parseInt(retryAfter, 10)\n          if (!Number.isNaN(sec) && sec > 0) delayMs = Math.max(delayMs, sec * 1000)\n        }\n        await sleep(Math.min(delayMs, 10_000))\n        continue\n      }\n\n      if (!response.ok) {\n        let detail = response.statusText\n        try {\n          const err = await response.json().catch(() => ({}))\n          if (err?.message) detail = err.message\n        } catch {\n          /* ignore */\n        }\n        console.warn(`${logPrefix}: API error ${response.status} ${method} ${path}: ${detail}`)\n        return null\n      }\n\n      return (await response.json()) as T\n    } catch (error) {\n      if (retry && attempt < attempts) {\n        await sleep(200 * attempt * attempt + Math.random() * 150)\n        continue\n      }\n      console.warn(\n        `${logPrefix}: Network error for ${url}:`,\n        error instanceof Error ? error.message : error,\n      )\n      return null\n    }\n  }\n\n  return null\n}\n"]}

package/dist/middleware/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAA;AACrB,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,mBAAmB,CAAA;AAO1B,YAAY,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,aAAa,EACb,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,WAAW,CAAA;AAElB,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAA;IACf,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,cAAc,CAAA;IACpC,6CAA6C;IAC7C,eAAe,CAAC,EAAE,OAAO,GAAG,qBAAqB,CAAA;IACjD;;;;OAIG;IACH,aAAa,CAAC,EAAE,mBAAmB,GAAG,KAAK,CAAA;IAC3C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,cAAc,CAAA;IACnC;;;OAGG;IACH,MAAM,CAAC,EAAE,CACP,OAAO,EAAE,WAAW,KACjB,YAAY,GAAG,SAAS,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;IACjE;;;OAGG;IACH,KAAK,CAAC,EAAE,CACN,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,KACnB,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,CAAC,EAAE,uBAAuB,aAepD,WAAW,KACnB,OAAO,CAAC,YAAY,CAAC,CAwFzB;AAWD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;IACzB,OAAO;CAGR,CAAA;AAED,oFAAoF;AACpF,eAAO,MAAM,WAAW,yBAAmB,CAAA"}

package/dist/middleware/index.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/middleware/segment.ts","../../src/middleware/index.ts"],"names":["buildSecurityHeaders","buildAiDiscoveryHeaders","handleManagedRedirects","SK_PATH_HEADER","NextResponse","uuid"],"mappings":";;;;;;;;;;;AAyBA,IAAM,YAAA,GAAe,CAAC,KAAA,EAAO,KAAA,EAAO,QAAQ,YAAA,EAAc,aAAA,EAAe,SAAA,EAAW,KAAA,EAAO,QAAQ,CAAA;AACnG,IAAM,cAAA,GAAiB,CAAC,QAAA,EAAU,cAAA,EAAgB,gBAAgB,IAAI,CAAA;AACtE,IAAM,YAAA,GAAe;AAAA,EACnB,WAAA;AAAA,EACA,YAAA;AAAA,EACA,WAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;AACA,IAAM,YAAA,GAAe,CAAC,SAAA,EAAW,OAAA,EAAS,eAAe,QAAA,EAAU,SAAA,EAAW,QAAA,EAAU,QAAA,EAAU,SAAS,CAAA;AAMpG,SAAS,qBAAA,CACd,SACA,IAAA,EACgB;AAChB,EAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,YAAA;AAC/B,EAAA,MAAM,MAAA,GAAA,CAAU,OAAO,GAAA,CAAI,YAAY,KAAK,EAAA,EAAI,WAAA,GAAc,IAAA,EAAK;AACnE,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,cAAc,CAAA;AAE1C,EAAA,IAAI,MAAA,GAAwB,QAAA;AAE5B,EAAA,IAAI,YAAA,CAAa,QAAA,CAAS,MAAM,CAAA,EAAG;AACjC,IAAA,MAAA,GAAS,MAAA;AAAA,EACX,CAAA,MAAA,IAAW,cAAA,CAAe,QAAA,CAAS,MAAM,CAAA,EAAG;AAC1C,IAAA,MAAA,GAAS,QAAA;AAAA,EACX,CAAA,MAAA,IAAW,WAAW,SAAA,EAAW;AAC/B,IAAA,MAAA,GAAS,SAAA;AAAA,EACX,CAAA,MAAA,IAAW,WAAW,UAAA,EAAY;AAChC,IAAA,MAAA,GAAS,UAAA;AAAA,EACX,CAAA,MAAA,IAAW,MAAA,CAAO,GAAA,CAAI,YAAY,CAAA,IAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,IAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG;AAElF,IAAA,IAAI,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,EAAG,MAAA,GAAS,MAAA;AAAA,SAAA,IACzB,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG,MAAA,GAAS,QAAA;AAAA,SACnC,MAAA,GAAS,UAAA;AAAA,EAChB,CAAA,MAAO;AAEL,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,IAAK,EAAA;AAC9C,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,KAAK,WAAA,EAAY;AAC3C,QAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,WAAA,EAAY;AAClD,QAAA,IAAI,IAAA,IAAQ,SAAS,QAAA,EAAU;AAC7B,UAAA,IAAI,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,MAAA,GAAS,SAAA;AAAA,eAAA,IAChD,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,MAAA,GAAS,QAAA;AAAA,eACzD,MAAA,GAAS,UAAA;AAAA,QAChB;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,IAAA,CAAK,gBAAA,GAAmB,WAAA,GAAc,KAAA;AAAA,IACnD,MAAA;AAAA,IACA,UAAU,QAAA,IAAY;AAAA,GACxB;AACF;AAOO,SAAS,cAAc,GAAA,EAA6B;AACzD,EAAA,MAAM,QAAA,GAAA,CAAY,GAAA,CAAI,QAAA,IAAY,EAAA,EAAI,OAAA,CAAQ,mBAAmB,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAChF,EAAA,OAAO,GAAG,GAAA,CAAI,WAAW,IAAI,GAAA,CAAI,MAAM,IAAI,QAAQ,CAAA,CAAA;AACrD;AAGO,SAAS,cAAc,KAAA,EAAyD;AACrF,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,CAAC,WAAA,EAAa,MAAA,EAAQ,QAAQ,CAAA,GAAI,KAAA,CAAM,MAAM,GAAG,CAAA;AACvD,EAAA,IAAI,WAAA,KAAgB,KAAA,IAAS,WAAA,KAAgB,WAAA,EAAa,OAAO,IAAA;AACjE,EAAA,OAAO;AAAA,IACL,WAAA;AAAA,IACA,MAAA,EAAS,CAAC,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,UAAA,EAAY,QAAQ,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,GAAI,MAAA,GAAS,QAAA;AAAA,IACzF,UAAU,QAAA,IAAY;AAAA,GACxB;AACF;;;AC8BO,SAAS,iBAAiB,MAAA,EAAkC;AACjE,EAAA,MAAM,eAAA,GAAkBA,qCAAA;AAAA,IACtB,MAAA,EAAQ;AAAA,GACV;AAGA,EAAA,MAAM,gBAAA,GACJ,MAAA,EAAQ,aAAA,GACJC,wCAAA,CAAwB;AAAA,IACtB,OAAA,EAAS,OAAO,aAAA,CAAc,OAAA;AAAA,IAC9B,QAAA,EAAU,OAAO,aAAA,CAAc;AAAA,GAChC,IACD,EAAC;AAEP,EAAA,OAAO,eAAe,MACpB,OAAA,EACuB;AAEvB,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,MAAM,aAAA,GAAgB,MAAM,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA;AACjD,MAAA,IAAI,aAAA,EAAe;AAEjB,QAAA,YAAA,CAAa,eAAe,eAAe,CAAA;AAC3C,QAAA,OAAO,aAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,MAAA,EAAQ,cAAc,KAAA,EAAO;AAC/B,MAAA,MAAM,iBACJ,OAAO,MAAA,EAAQ,cAAc,QAAA,GACzB,MAAA,CAAO,YACP,EAAC;AAEP,MAAA,MAAM,WAAW,MAAMC,uCAAA;AAAA,QACrB,OAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,QAAA,EAAU;AAEZ,QAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AACtC,QAAA,OAAO,QAAA;AAAA,MACT;AAAA,IACF;AAMA,IAAA,MAAM,cAAA,GAAiB,IAAI,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA;AAClD,IAAA,cAAA,CAAe,GAAA;AAAA,MACbC,+BAAA;AAAA,MACA,OAAA,CAAQ,OAAA,CAAQ,QAAA,GAAW,OAAA,CAAQ,OAAA,CAAQ;AAAA,KAC7C;AACA,IAAA,IAAI,QAAA,GAAWC,oBAAa,IAAA,CAAK,EAAE,SAAS,EAAE,OAAA,EAAS,cAAA,EAAe,EAAG,CAAA;AAGzE,IAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AAGtC,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,gBAAgB,CAAA,CAAE,SAAS,CAAA,EAAG;AAC5C,MAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA,IAAK,EAAA;AAChD,MAAA,IAAI,OAAO,QAAA,CAAS,WAAW,KAAK,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AAC1D,QAAA,YAAA,CAAa,UAAU,gBAAgB,CAAA;AAAA,MACzC;AAAA,IACF;AAKA,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,MAAM,QACJ,OAAO,MAAA,CAAO,aAAa,QAAA,GAAW,MAAA,CAAO,WAAW,EAAC;AAC3D,MAAA,MAAM,mBAAmB,CAAC,CAAC,QAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,EAAG,KAAA;AAC3D,MAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,QAAA,MAAM,UAAA,GAAa,MAAM,gBAAA,IAAoB,GAAA;AAC7C,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,SAAA,EAAWC,qBAAA,EAAK,EAAG;AAAA,UACtC,MAAA,EAAQ,UAAA,GAAa,EAAA,GAAK,EAAA,GAAK,EAAA;AAAA,UAC/B,IAAA,EAAM,GAAA;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AACA,MAAA,IAAI,KAAA,CAAM,YAAY,KAAA,EAAO;AAC3B,QAAA,MAAM,OAAA,GAAU,aAAA;AAAA,UACd,qBAAA,CAAsB,OAAA,EAAS,EAAE,gBAAA,EAAkB;AAAA,SACrD;AACA,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,SAAA,EAAW,OAAA,EAAS;AAAA;AAAA,UAEvC,QAAQ,EAAA,GAAK,EAAA;AAAA,UACb,IAAA,EAAM,GAAA;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AAAA,IACF;AAGA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,QAAA,GAAW,MAAM,MAAA,CAAO,KAAA,CAAM,OAAA,EAAS,QAAQ,CAAA;AAAA,IACjD;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AAEA,SAAS,YAAA,CACP,UACA,OAAA,EACM;AACN,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,IAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,EACjC;AACF;AAUO,IAAM,cAAA,GAAiB;AAAA,EAC5B,OAAA,EAAS;AAAA,IACP;AAAA;AAEJ;AAGO,IAAM,WAAA,GAAc","file":"index.js","sourcesContent":["/**\n * @sonordev/site-kit/middleware — visitor segment resolution (the \"one edge pass\").\n *\n * Pure, edge-runtime-safe helpers that classify a request into a coarse visitor\n * segment (new-vs-returning + marketing source + campaign) from the URL's UTM\n * params and the referrer. The middleware writes the result to the `_sk_seg`\n * cookie so server-rendered slots / personalization can vary by segment WITHOUT\n * each one re-parsing the request. Resolved once, at the edge.\n *\n * Kept side-effect-free (no NextResponse, no cookie writes) so it is trivially\n * unit-testable and reusable.\n */\nimport type { NextRequest } from 'next/server'\n\nexport type SegmentSource = 'paid' | 'organic' | 'social' | 'referral' | 'direct'\n\nexport interface VisitorSegment {\n  /** `new` on the first visit (no prior `_sk_vid` cookie), else `returning`. */\n  visitorType: 'new' | 'returning'\n  /** Marketing source bucket derived from UTM medium/source, then referrer. */\n  source: SegmentSource\n  /** `utm_campaign`, if present (sanitized when encoded). */\n  campaign: string | null\n}\n\nconst PAID_MEDIUMS = ['cpc', 'ppc', 'paid', 'paidsearch', 'paid-search', 'display', 'cpm', 'banner']\nconst SOCIAL_MEDIUMS = ['social', 'social-media', 'social_media', 'sm']\nconst SOCIAL_HOSTS = [\n  'facebook.',\n  'instagram.',\n  'linkedin.',\n  't.co',\n  'twitter.',\n  'x.com',\n  'pinterest.',\n  'tiktok.',\n  'youtube.',\n  'reddit.',\n]\nconst SEARCH_HOSTS = ['google.', 'bing.', 'duckduckgo.', 'yahoo.', 'ecosia.', 'brave.', 'baidu.', 'yandex.']\n\n/**\n * Classify `request` into a {@link VisitorSegment}. UTM params win over the\n * referrer; a same-host referrer is ignored (internal navigation, not a source).\n */\nexport function resolveVisitorSegment(\n  request: NextRequest,\n  opts: { hadVisitorCookie: boolean },\n): VisitorSegment {\n  const params = request.nextUrl.searchParams\n  const medium = (params.get('utm_medium') || '').toLowerCase().trim()\n  const campaign = params.get('utm_campaign')\n\n  let source: SegmentSource = 'direct'\n\n  if (PAID_MEDIUMS.includes(medium)) {\n    source = 'paid'\n  } else if (SOCIAL_MEDIUMS.includes(medium)) {\n    source = 'social'\n  } else if (medium === 'organic') {\n    source = 'organic'\n  } else if (medium === 'referral') {\n    source = 'referral'\n  } else if (params.get('utm_source') || params.get('gclid') || params.get('fbclid')) {\n    // A tagged link with a non-standard medium: gclid => paid Google, fbclid => social.\n    if (params.get('gclid')) source = 'paid'\n    else if (params.get('fbclid')) source = 'social'\n    else source = 'referral'\n  } else {\n    // No campaign tagging — fall back to the referrer host.\n    const ref = request.headers.get('referer') || ''\n    if (ref) {\n      try {\n        const host = new URL(ref).host.toLowerCase()\n        const selfHost = request.nextUrl.host.toLowerCase()\n        if (host && host !== selfHost) {\n          if (SEARCH_HOSTS.some((h) => host.includes(h))) source = 'organic'\n          else if (SOCIAL_HOSTS.some((h) => host.includes(h))) source = 'social'\n          else source = 'referral'\n        }\n      } catch {\n        /* malformed referer — stays 'direct' */\n      }\n    }\n  }\n\n  return {\n    visitorType: opts.hadVisitorCookie ? 'returning' : 'new',\n    source,\n    campaign: campaign || null,\n  }\n}\n\n/**\n * Compact, cookie-safe encoding: `\"<visitorType>|<source>|<campaign>\"`, e.g.\n * `\"new|paid|spring_sale\"`. Campaign is sanitized to `[A-Za-z0-9_-]` and capped.\n * Decode with {@link decodeSegment}.\n */\nexport function encodeSegment(seg: VisitorSegment): string {\n  const campaign = (seg.campaign || '').replace(/[^a-zA-Z0-9_-]/g, '').slice(0, 40)\n  return `${seg.visitorType}|${seg.source}|${campaign}`\n}\n\n/** Parse a `_sk_seg` cookie value produced by {@link encodeSegment}. */\nexport function decodeSegment(value: string | undefined | null): VisitorSegment | null {\n  if (!value) return null\n  const [visitorType, source, campaign] = value.split('|')\n  if (visitorType !== 'new' && visitorType !== 'returning') return null\n  return {\n    visitorType,\n    source: (['paid', 'organic', 'social', 'referral', 'direct'].includes(source) ? source : 'direct') as SegmentSource,\n    campaign: campaign || null,\n  }\n}\n","/**\n * @sonordev/site-kit/middleware\n *\n * Composable Next.js proxy/middleware factory. Handles:\n * - Security headers (CSP frame-ancestors, nosniff, referrer/permissions\n *   policy — deliberately NO X-Frame-Options; see securityHeaders.ts)\n * - Portal-managed redirects (legacy hot-path mode; prefer the 404-boundary\n *   resolver — see the `redirects` option below)\n * - Stamps `x-sk-path` on the request so app/not-found.tsx can know the URL\n * - Optional before/after hooks for custom logic\n *\n * @example\n * ```ts\n * // proxy.ts — entire file (Next 16 name for middleware.ts)\n * import { createProxy } from '@sonordev/site-kit/middleware'\n *\n * export default createProxy()\n *\n * // Inlined on purpose: Next statically parses `config.matcher` at build\n * // time and REJECTS an imported value (Turbopack build error). Keep in\n * // sync with siteKitMatcher below.\n * export const config = {\n *   matcher: [\n *     '/((?!_next/static|_next/image|favicon\\\\.ico|.*\\\\.(?:ico|png|jpg|jpeg|gif|webp|svg|woff2?)$).*)',\n *   ],\n * }\n * ```\n *\n * Next 16 notes: `middleware.ts` is deprecated (codemod:\n * `npx @next/codemod@canary middleware-to-proxy .`), Proxy defaults to the\n * Node.js runtime, and the `runtime` config option is unavailable in proxy\n * files — setting it throws at build time.\n *\n * @example With custom hooks:\n * ```ts\n * export default createProxy({\n *   before: (req) => {\n *     // Custom auth check, etc.\n *   },\n * })\n * ```\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport {\n  handleManagedRedirects,\n  SK_PATH_HEADER,\n  type RedirectConfig,\n} from '../redirects'\nimport {\n  buildSecurityHeaders,\n  type SecurityHeadersConfig,\n} from './securityHeaders'\nimport { buildAiDiscoveryHeaders } from '../llms/discovery-headers'\nimport { resolveVisitorSegment, encodeSegment } from './segment'\n// Single source of truth for v4 UUIDs — Web Crypto in the edge runtime, with a\n// non-throwing fallback everywhere else. Do NOT re-fork ID generation here.\nimport { uuid } from '../shared/uuid'\n\nexport type { SecurityHeadersConfig } from './securityHeaders'\nexport { DEFAULT_FRAME_ANCESTORS } from './securityHeaders'\nexport {\n  resolveVisitorSegment,\n  encodeSegment,\n  decodeSegment,\n  type VisitorSegment,\n  type SegmentSource,\n} from './segment'\n\nexport interface IdentityConfig {\n  /**\n   * Also resolve + persist a coarse visitor segment (new-vs-returning + source\n   * + campaign) into the `_sk_seg` cookie, for segment-aware slots /\n   * personalization. Default: true (when identity is enabled).\n   */\n  segment?: boolean\n  /** Days the `_sk_vid` visitor cookie persists. Default: 730 (~2 years). */\n  cookieMaxAgeDays?: number\n}\n\nexport interface LlmsDiscoveryConfig {\n  /** Canonical site origin, e.g. `https://example.com` */\n  siteUrl: string\n  /** Path to llms.txt (default `/llms.txt`) */\n  llmsPath?: string\n}\n\nexport interface SiteKitMiddlewareConfig {\n  /**\n   * Portal-managed redirects on the proxy hot path. Default: true (legacy).\n   *\n   * LEGACY MODE: this checks rules before EVERY page render — a network\n   * fetch (now bounded at 300ms, 30s failure cooldown) paid by 100% of\n   * requests to serve the <1% that would 404. Prefer `redirects: false`\n   * plus `resolveManagedRedirect()` from\n   * `@sonordev/site-kit/redirects/not-found` in app/not-found.tsx: same\n   * instant dashboard behavior, zero cost on successful loads. The proxy\n   * always stamps `x-sk-path` for it, regardless of this flag.\n   */\n  redirects?: boolean | RedirectConfig\n  /** Enable security headers. Default: true */\n  securityHeaders?: boolean | SecurityHeadersConfig\n  /**\n   * Opt-in: inject `Link: <...>; rel=\"describedby\"` header on HTML responses\n   * pointing to /llms.txt for AI crawler discovery (RFC 8288).\n   * Preferred over visible footer links.\n   */\n  llmsDiscovery?: LlmsDiscoveryConfig | false\n  /**\n   * Opt-in EDGE IDENTITY pass. When enabled, the middleware ensures a\n   * first-party `_sk_vid` visitor cookie exists (server-authoritative id) and\n   * resolves the visitor segment into `_sk_seg`, so server-rendered slots and\n   * personalization can read identity + segment without re-parsing the request.\n   * Purely additive — it only writes cookies, never changes the rendered HTML,\n   * so it is LCP/static-safe. Default: OFF (sites opt in for 3.0 personalization).\n   *\n   * NOTE: to make these the SAME id the client uses, the shared identity helper\n   * must read `_sk_vid` cookie-first (a follow-on change validated with a live\n   * preview); until then the cookie is the server-side mirror.\n   */\n  identity?: boolean | IdentityConfig\n  /**\n   * Hook that runs BEFORE redirect check.\n   * Return a NextResponse to short-circuit, or undefined to continue.\n   */\n  before?: (\n    request: NextRequest,\n  ) => NextResponse | undefined | Promise<NextResponse | undefined>\n  /**\n   * Hook that runs AFTER all processing.\n   * Receives the response that will be sent — mutate headers, etc.\n   */\n  after?: (\n    request: NextRequest,\n    response: NextResponse,\n  ) => NextResponse | Promise<NextResponse>\n}\n\n/**\n * Create a fully-featured Next.js middleware function.\n *\n * With zero config this handles redirects + security headers automatically.\n */\nexport function createMiddleware(config?: SiteKitMiddlewareConfig) {\n  const securityHeaders = buildSecurityHeaders(\n    config?.securityHeaders,\n  )\n\n  // Pre-compute discovery headers (static per middleware instance)\n  const discoveryHeaders: Record<string, string> =\n    config?.llmsDiscovery\n      ? buildAiDiscoveryHeaders({\n          siteUrl: config.llmsDiscovery.siteUrl,\n          llmsPath: config.llmsDiscovery.llmsPath,\n        })\n      : {}\n\n  return async function proxy(\n    request: NextRequest,\n  ): Promise<NextResponse> {\n    // 1. Run user's 'before' hook\n    if (config?.before) {\n      const earlyResponse = await config.before(request)\n      if (earlyResponse) {\n        // Apply security headers even to early responses\n        applyHeaders(earlyResponse, securityHeaders)\n        return earlyResponse\n      }\n    }\n\n    // 2. Check Portal-managed redirects (unless disabled)\n    if (config?.redirects !== false) {\n      const redirectConfig: RedirectConfig =\n        typeof config?.redirects === 'object'\n          ? config.redirects\n          : {}\n\n      const redirect = await handleManagedRedirects(\n        request,\n        redirectConfig,\n      )\n      if (redirect) {\n        // Redirects get security headers too\n        applyHeaders(redirect, securityHeaders)\n        return redirect\n      }\n    }\n\n    // 3. Build the pass-through response. Always stamp the requested\n    // pathname+search onto the REQUEST so app/not-found.tsx (which Next\n    // gives no URL) can resolve managed redirects at the 404 boundary.\n    // Pure header write — no fetch, static-safe.\n    const requestHeaders = new Headers(request.headers)\n    requestHeaders.set(\n      SK_PATH_HEADER,\n      request.nextUrl.pathname + request.nextUrl.search,\n    )\n    let response = NextResponse.next({ request: { headers: requestHeaders } })\n\n    // 4. Apply security headers\n    applyHeaders(response, securityHeaders)\n\n    // 5. Apply AI discovery Link header (only on HTML-like requests, not static assets)\n    if (Object.keys(discoveryHeaders).length > 0) {\n      const accept = request.headers.get('accept') || ''\n      if (accept.includes('text/html') || accept.includes('*/*')) {\n        applyHeaders(response, discoveryHeaders)\n      }\n    }\n\n    // 5b. Edge identity pass (opt-in). Ensure a first-party `_sk_vid` visitor\n    // cookie exists and resolve the visitor segment into `_sk_seg`. Additive:\n    // only writes cookies, never changes the rendered HTML (LCP/static-safe).\n    if (config?.identity) {\n      const idCfg: IdentityConfig =\n        typeof config.identity === 'object' ? config.identity : {}\n      const hadVisitorCookie = !!request.cookies.get('_sk_vid')?.value\n      if (!hadVisitorCookie) {\n        const maxAgeDays = idCfg.cookieMaxAgeDays ?? 730\n        response.cookies.set('_sk_vid', uuid(), {\n          maxAge: maxAgeDays * 24 * 60 * 60,\n          path: '/',\n          sameSite: 'lax',\n          secure: true,\n        })\n      }\n      if (idCfg.segment !== false) {\n        const segment = encodeSegment(\n          resolveVisitorSegment(request, { hadVisitorCookie }),\n        )\n        response.cookies.set('_sk_seg', segment, {\n          // Session-ish: a fresh campaign / source on a later visit re-segments.\n          maxAge: 30 * 60,\n          path: '/',\n          sameSite: 'lax',\n          secure: true,\n        })\n      }\n    }\n\n    // 6. Run user's 'after' hook\n    if (config?.after) {\n      response = await config.after(request, response)\n    }\n\n    return response\n  }\n}\n\nfunction applyHeaders(\n  response: NextResponse,\n  headers: Record<string, string>,\n): void {\n  for (const [key, value] of Object.entries(headers)) {\n    response.headers.set(key, value)\n  }\n}\n\n/**\n * REFERENCE VALUE ONLY — copy the array into your proxy.ts, do not export it.\n *\n * `export const config = siteKitMatcher` is a BUILD ERROR on Next 16:\n * `config.matcher` must be statically analyzable and Turbopack rejects any\n * imported value. This constant exists so the canonical pattern lives in one\n * place (the scaffold, docs, and tests read it) — inline its contents.\n */\nexport const siteKitMatcher = {\n  matcher: [\n    '/((?!_next/static|_next/image|favicon\\\\.ico|.*\\\\.(?:ico|png|jpg|jpeg|gif|webp|svg|woff2?)$).*)',\n  ],\n}\n\n/** Next.js 16+ alias — same as createMiddleware, named for the proxy convention. */\nexport const createProxy = createMiddleware\n"]}

package/dist/middleware/index.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/middleware/segment.ts","../../src/middleware/index.ts"],"names":[],"mappings":";;;;;;;;;;AAyBA,IAAM,YAAA,GAAe,CAAC,KAAA,EAAO,KAAA,EAAO,QAAQ,YAAA,EAAc,aAAA,EAAe,SAAA,EAAW,KAAA,EAAO,QAAQ,CAAA;AACnG,IAAM,cAAA,GAAiB,CAAC,QAAA,EAAU,cAAA,EAAgB,gBAAgB,IAAI,CAAA;AACtE,IAAM,YAAA,GAAe;AAAA,EACnB,WAAA;AAAA,EACA,YAAA;AAAA,EACA,WAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;AACA,IAAM,YAAA,GAAe,CAAC,SAAA,EAAW,OAAA,EAAS,eAAe,QAAA,EAAU,SAAA,EAAW,QAAA,EAAU,QAAA,EAAU,SAAS,CAAA;AAMpG,SAAS,qBAAA,CACd,SACA,IAAA,EACgB;AAChB,EAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,YAAA;AAC/B,EAAA,MAAM,MAAA,GAAA,CAAU,OAAO,GAAA,CAAI,YAAY,KAAK,EAAA,EAAI,WAAA,GAAc,IAAA,EAAK;AACnE,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,cAAc,CAAA;AAE1C,EAAA,IAAI,MAAA,GAAwB,QAAA;AAE5B,EAAA,IAAI,YAAA,CAAa,QAAA,CAAS,MAAM,CAAA,EAAG;AACjC,IAAA,MAAA,GAAS,MAAA;AAAA,EACX,CAAA,MAAA,IAAW,cAAA,CAAe,QAAA,CAAS,MAAM,CAAA,EAAG;AAC1C,IAAA,MAAA,GAAS,QAAA;AAAA,EACX,CAAA,MAAA,IAAW,WAAW,SAAA,EAAW;AAC/B,IAAA,MAAA,GAAS,SAAA;AAAA,EACX,CAAA,MAAA,IAAW,WAAW,UAAA,EAAY;AAChC,IAAA,MAAA,GAAS,UAAA;AAAA,EACX,CAAA,MAAA,IAAW,MAAA,CAAO,GAAA,CAAI,YAAY,CAAA,IAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,IAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG;AAElF,IAAA,IAAI,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,EAAG,MAAA,GAAS,MAAA;AAAA,SAAA,IACzB,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG,MAAA,GAAS,QAAA;AAAA,SACnC,MAAA,GAAS,UAAA;AAAA,EAChB,CAAA,MAAO;AAEL,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,IAAK,EAAA;AAC9C,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,KAAK,WAAA,EAAY;AAC3C,QAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,WAAA,EAAY;AAClD,QAAA,IAAI,IAAA,IAAQ,SAAS,QAAA,EAAU;AAC7B,UAAA,IAAI,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,MAAA,GAAS,SAAA;AAAA,eAAA,IAChD,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,MAAA,GAAS,QAAA;AAAA,eACzD,MAAA,GAAS,UAAA;AAAA,QAChB;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,IAAA,CAAK,gBAAA,GAAmB,WAAA,GAAc,KAAA;AAAA,IACnD,MAAA;AAAA,IACA,UAAU,QAAA,IAAY;AAAA,GACxB;AACF;AAOO,SAAS,cAAc,GAAA,EAA6B;AACzD,EAAA,MAAM,QAAA,GAAA,CAAY,GAAA,CAAI,QAAA,IAAY,EAAA,EAAI,OAAA,CAAQ,mBAAmB,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAChF,EAAA,OAAO,GAAG,GAAA,CAAI,WAAW,IAAI,GAAA,CAAI,MAAM,IAAI,QAAQ,CAAA,CAAA;AACrD;AAGO,SAAS,cAAc,KAAA,EAAyD;AACrF,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,CAAC,WAAA,EAAa,MAAA,EAAQ,QAAQ,CAAA,GAAI,KAAA,CAAM,MAAM,GAAG,CAAA;AACvD,EAAA,IAAI,WAAA,KAAgB,KAAA,IAAS,WAAA,KAAgB,WAAA,EAAa,OAAO,IAAA;AACjE,EAAA,OAAO;AAAA,IACL,WAAA;AAAA,IACA,MAAA,EAAS,CAAC,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,UAAA,EAAY,QAAQ,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,GAAI,MAAA,GAAS,QAAA;AAAA,IACzF,UAAU,QAAA,IAAY;AAAA,GACxB;AACF;;;AC8BO,SAAS,iBAAiB,MAAA,EAAkC;AACjE,EAAA,MAAM,eAAA,GAAkB,oBAAA;AAAA,IACtB,MAAA,EAAQ;AAAA,GACV;AAGA,EAAA,MAAM,gBAAA,GACJ,MAAA,EAAQ,aAAA,GACJ,uBAAA,CAAwB;AAAA,IACtB,OAAA,EAAS,OAAO,aAAA,CAAc,OAAA;AAAA,IAC9B,QAAA,EAAU,OAAO,aAAA,CAAc;AAAA,GAChC,IACD,EAAC;AAEP,EAAA,OAAO,eAAe,MACpB,OAAA,EACuB;AAEvB,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,MAAM,aAAA,GAAgB,MAAM,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA;AACjD,MAAA,IAAI,aAAA,EAAe;AAEjB,QAAA,YAAA,CAAa,eAAe,eAAe,CAAA;AAC3C,QAAA,OAAO,aAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,MAAA,EAAQ,cAAc,KAAA,EAAO;AAC/B,MAAA,MAAM,iBACJ,OAAO,MAAA,EAAQ,cAAc,QAAA,GACzB,MAAA,CAAO,YACP,EAAC;AAEP,MAAA,MAAM,WAAW,MAAM,sBAAA;AAAA,QACrB,OAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,QAAA,EAAU;AAEZ,QAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AACtC,QAAA,OAAO,QAAA;AAAA,MACT;AAAA,IACF;AAMA,IAAA,MAAM,cAAA,GAAiB,IAAI,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA;AAClD,IAAA,cAAA,CAAe,GAAA;AAAA,MACb,cAAA;AAAA,MACA,OAAA,CAAQ,OAAA,CAAQ,QAAA,GAAW,OAAA,CAAQ,OAAA,CAAQ;AAAA,KAC7C;AACA,IAAA,IAAI,QAAA,GAAW,aAAa,IAAA,CAAK,EAAE,SAAS,EAAE,OAAA,EAAS,cAAA,EAAe,EAAG,CAAA;AAGzE,IAAA,YAAA,CAAa,UAAU,eAAe,CAAA;AAGtC,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,gBAAgB,CAAA,CAAE,SAAS,CAAA,EAAG;AAC5C,MAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA,IAAK,EAAA;AAChD,MAAA,IAAI,OAAO,QAAA,CAAS,WAAW,KAAK,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AAC1D,QAAA,YAAA,CAAa,UAAU,gBAAgB,CAAA;AAAA,MACzC;AAAA,IACF;AAKA,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,MAAM,QACJ,OAAO,MAAA,CAAO,aAAa,QAAA,GAAW,MAAA,CAAO,WAAW,EAAC;AAC3D,MAAA,MAAM,mBAAmB,CAAC,CAAC,QAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,EAAG,KAAA;AAC3D,MAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,QAAA,MAAM,UAAA,GAAa,MAAM,gBAAA,IAAoB,GAAA;AAC7C,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,SAAA,EAAW,IAAA,EAAK,EAAG;AAAA,UACtC,MAAA,EAAQ,UAAA,GAAa,EAAA,GAAK,EAAA,GAAK,EAAA;AAAA,UAC/B,IAAA,EAAM,GAAA;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AACA,MAAA,IAAI,KAAA,CAAM,YAAY,KAAA,EAAO;AAC3B,QAAA,MAAM,OAAA,GAAU,aAAA;AAAA,UACd,qBAAA,CAAsB,OAAA,EAAS,EAAE,gBAAA,EAAkB;AAAA,SACrD;AACA,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,SAAA,EAAW,OAAA,EAAS;AAAA;AAAA,UAEvC,QAAQ,EAAA,GAAK,EAAA;AAAA,UACb,IAAA,EAAM,GAAA;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,MACH;AAAA,IACF;AAGA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,QAAA,GAAW,MAAM,MAAA,CAAO,KAAA,CAAM,OAAA,EAAS,QAAQ,CAAA;AAAA,IACjD;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AAEA,SAAS,YAAA,CACP,UACA,OAAA,EACM;AACN,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,IAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,EACjC;AACF;AAUO,IAAM,cAAA,GAAiB;AAAA,EAC5B,OAAA,EAAS;AAAA,IACP;AAAA;AAEJ;AAGO,IAAM,WAAA,GAAc","file":"index.mjs","sourcesContent":["/**\n * @sonordev/site-kit/middleware — visitor segment resolution (the \"one edge pass\").\n *\n * Pure, edge-runtime-safe helpers that classify a request into a coarse visitor\n * segment (new-vs-returning + marketing source + campaign) from the URL's UTM\n * params and the referrer. The middleware writes the result to the `_sk_seg`\n * cookie so server-rendered slots / personalization can vary by segment WITHOUT\n * each one re-parsing the request. Resolved once, at the edge.\n *\n * Kept side-effect-free (no NextResponse, no cookie writes) so it is trivially\n * unit-testable and reusable.\n */\nimport type { NextRequest } from 'next/server'\n\nexport type SegmentSource = 'paid' | 'organic' | 'social' | 'referral' | 'direct'\n\nexport interface VisitorSegment {\n  /** `new` on the first visit (no prior `_sk_vid` cookie), else `returning`. */\n  visitorType: 'new' | 'returning'\n  /** Marketing source bucket derived from UTM medium/source, then referrer. */\n  source: SegmentSource\n  /** `utm_campaign`, if present (sanitized when encoded). */\n  campaign: string | null\n}\n\nconst PAID_MEDIUMS = ['cpc', 'ppc', 'paid', 'paidsearch', 'paid-search', 'display', 'cpm', 'banner']\nconst SOCIAL_MEDIUMS = ['social', 'social-media', 'social_media', 'sm']\nconst SOCIAL_HOSTS = [\n  'facebook.',\n  'instagram.',\n  'linkedin.',\n  't.co',\n  'twitter.',\n  'x.com',\n  'pinterest.',\n  'tiktok.',\n  'youtube.',\n  'reddit.',\n]\nconst SEARCH_HOSTS = ['google.', 'bing.', 'duckduckgo.', 'yahoo.', 'ecosia.', 'brave.', 'baidu.', 'yandex.']\n\n/**\n * Classify `request` into a {@link VisitorSegment}. UTM params win over the\n * referrer; a same-host referrer is ignored (internal navigation, not a source).\n */\nexport function resolveVisitorSegment(\n  request: NextRequest,\n  opts: { hadVisitorCookie: boolean },\n): VisitorSegment {\n  const params = request.nextUrl.searchParams\n  const medium = (params.get('utm_medium') || '').toLowerCase().trim()\n  const campaign = params.get('utm_campaign')\n\n  let source: SegmentSource = 'direct'\n\n  if (PAID_MEDIUMS.includes(medium)) {\n    source = 'paid'\n  } else if (SOCIAL_MEDIUMS.includes(medium)) {\n    source = 'social'\n  } else if (medium === 'organic') {\n    source = 'organic'\n  } else if (medium === 'referral') {\n    source = 'referral'\n  } else if (params.get('utm_source') || params.get('gclid') || params.get('fbclid')) {\n    // A tagged link with a non-standard medium: gclid => paid Google, fbclid => social.\n    if (params.get('gclid')) source = 'paid'\n    else if (params.get('fbclid')) source = 'social'\n    else source = 'referral'\n  } else {\n    // No campaign tagging — fall back to the referrer host.\n    const ref = request.headers.get('referer') || ''\n    if (ref) {\n      try {\n        const host = new URL(ref).host.toLowerCase()\n        const selfHost = request.nextUrl.host.toLowerCase()\n        if (host && host !== selfHost) {\n          if (SEARCH_HOSTS.some((h) => host.includes(h))) source = 'organic'\n          else if (SOCIAL_HOSTS.some((h) => host.includes(h))) source = 'social'\n          else source = 'referral'\n        }\n      } catch {\n        /* malformed referer — stays 'direct' */\n      }\n    }\n  }\n\n  return {\n    visitorType: opts.hadVisitorCookie ? 'returning' : 'new',\n    source,\n    campaign: campaign || null,\n  }\n}\n\n/**\n * Compact, cookie-safe encoding: `\"<visitorType>|<source>|<campaign>\"`, e.g.\n * `\"new|paid|spring_sale\"`. Campaign is sanitized to `[A-Za-z0-9_-]` and capped.\n * Decode with {@link decodeSegment}.\n */\nexport function encodeSegment(seg: VisitorSegment): string {\n  const campaign = (seg.campaign || '').replace(/[^a-zA-Z0-9_-]/g, '').slice(0, 40)\n  return `${seg.visitorType}|${seg.source}|${campaign}`\n}\n\n/** Parse a `_sk_seg` cookie value produced by {@link encodeSegment}. */\nexport function decodeSegment(value: string | undefined | null): VisitorSegment | null {\n  if (!value) return null\n  const [visitorType, source, campaign] = value.split('|')\n  if (visitorType !== 'new' && visitorType !== 'returning') return null\n  return {\n    visitorType,\n    source: (['paid', 'organic', 'social', 'referral', 'direct'].includes(source) ? source : 'direct') as SegmentSource,\n    campaign: campaign || null,\n  }\n}\n","/**\n * @sonordev/site-kit/middleware\n *\n * Composable Next.js proxy/middleware factory. Handles:\n * - Security headers (CSP frame-ancestors, nosniff, referrer/permissions\n *   policy — deliberately NO X-Frame-Options; see securityHeaders.ts)\n * - Portal-managed redirects (legacy hot-path mode; prefer the 404-boundary\n *   resolver — see the `redirects` option below)\n * - Stamps `x-sk-path` on the request so app/not-found.tsx can know the URL\n * - Optional before/after hooks for custom logic\n *\n * @example\n * ```ts\n * // proxy.ts — entire file (Next 16 name for middleware.ts)\n * import { createProxy } from '@sonordev/site-kit/middleware'\n *\n * export default createProxy()\n *\n * // Inlined on purpose: Next statically parses `config.matcher` at build\n * // time and REJECTS an imported value (Turbopack build error). Keep in\n * // sync with siteKitMatcher below.\n * export const config = {\n *   matcher: [\n *     '/((?!_next/static|_next/image|favicon\\\\.ico|.*\\\\.(?:ico|png|jpg|jpeg|gif|webp|svg|woff2?)$).*)',\n *   ],\n * }\n * ```\n *\n * Next 16 notes: `middleware.ts` is deprecated (codemod:\n * `npx @next/codemod@canary middleware-to-proxy .`), Proxy defaults to the\n * Node.js runtime, and the `runtime` config option is unavailable in proxy\n * files — setting it throws at build time.\n *\n * @example With custom hooks:\n * ```ts\n * export default createProxy({\n *   before: (req) => {\n *     // Custom auth check, etc.\n *   },\n * })\n * ```\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport {\n  handleManagedRedirects,\n  SK_PATH_HEADER,\n  type RedirectConfig,\n} from '../redirects'\nimport {\n  buildSecurityHeaders,\n  type SecurityHeadersConfig,\n} from './securityHeaders'\nimport { buildAiDiscoveryHeaders } from '../llms/discovery-headers'\nimport { resolveVisitorSegment, encodeSegment } from './segment'\n// Single source of truth for v4 UUIDs — Web Crypto in the edge runtime, with a\n// non-throwing fallback everywhere else. Do NOT re-fork ID generation here.\nimport { uuid } from '../shared/uuid'\n\nexport type { SecurityHeadersConfig } from './securityHeaders'\nexport { DEFAULT_FRAME_ANCESTORS } from './securityHeaders'\nexport {\n  resolveVisitorSegment,\n  encodeSegment,\n  decodeSegment,\n  type VisitorSegment,\n  type SegmentSource,\n} from './segment'\n\nexport interface IdentityConfig {\n  /**\n   * Also resolve + persist a coarse visitor segment (new-vs-returning + source\n   * + campaign) into the `_sk_seg` cookie, for segment-aware slots /\n   * personalization. Default: true (when identity is enabled).\n   */\n  segment?: boolean\n  /** Days the `_sk_vid` visitor cookie persists. Default: 730 (~2 years). */\n  cookieMaxAgeDays?: number\n}\n\nexport interface LlmsDiscoveryConfig {\n  /** Canonical site origin, e.g. `https://example.com` */\n  siteUrl: string\n  /** Path to llms.txt (default `/llms.txt`) */\n  llmsPath?: string\n}\n\nexport interface SiteKitMiddlewareConfig {\n  /**\n   * Portal-managed redirects on the proxy hot path. Default: true (legacy).\n   *\n   * LEGACY MODE: this checks rules before EVERY page render — a network\n   * fetch (now bounded at 300ms, 30s failure cooldown) paid by 100% of\n   * requests to serve the <1% that would 404. Prefer `redirects: false`\n   * plus `resolveManagedRedirect()` from\n   * `@sonordev/site-kit/redirects/not-found` in app/not-found.tsx: same\n   * instant dashboard behavior, zero cost on successful loads. The proxy\n   * always stamps `x-sk-path` for it, regardless of this flag.\n   */\n  redirects?: boolean | RedirectConfig\n  /** Enable security headers. Default: true */\n  securityHeaders?: boolean | SecurityHeadersConfig\n  /**\n   * Opt-in: inject `Link: <...>; rel=\"describedby\"` header on HTML responses\n   * pointing to /llms.txt for AI crawler discovery (RFC 8288).\n   * Preferred over visible footer links.\n   */\n  llmsDiscovery?: LlmsDiscoveryConfig | false\n  /**\n   * Opt-in EDGE IDENTITY pass. When enabled, the middleware ensures a\n   * first-party `_sk_vid` visitor cookie exists (server-authoritative id) and\n   * resolves the visitor segment into `_sk_seg`, so server-rendered slots and\n   * personalization can read identity + segment without re-parsing the request.\n   * Purely additive — it only writes cookies, never changes the rendered HTML,\n   * so it is LCP/static-safe. Default: OFF (sites opt in for 3.0 personalization).\n   *\n   * NOTE: to make these the SAME id the client uses, the shared identity helper\n   * must read `_sk_vid` cookie-first (a follow-on change validated with a live\n   * preview); until then the cookie is the server-side mirror.\n   */\n  identity?: boolean | IdentityConfig\n  /**\n   * Hook that runs BEFORE redirect check.\n   * Return a NextResponse to short-circuit, or undefined to continue.\n   */\n  before?: (\n    request: NextRequest,\n  ) => NextResponse | undefined | Promise<NextResponse | undefined>\n  /**\n   * Hook that runs AFTER all processing.\n   * Receives the response that will be sent — mutate headers, etc.\n   */\n  after?: (\n    request: NextRequest,\n    response: NextResponse,\n  ) => NextResponse | Promise<NextResponse>\n}\n\n/**\n * Create a fully-featured Next.js middleware function.\n *\n * With zero config this handles redirects + security headers automatically.\n */\nexport function createMiddleware(config?: SiteKitMiddlewareConfig) {\n  const securityHeaders = buildSecurityHeaders(\n    config?.securityHeaders,\n  )\n\n  // Pre-compute discovery headers (static per middleware instance)\n  const discoveryHeaders: Record<string, string> =\n    config?.llmsDiscovery\n      ? buildAiDiscoveryHeaders({\n          siteUrl: config.llmsDiscovery.siteUrl,\n          llmsPath: config.llmsDiscovery.llmsPath,\n        })\n      : {}\n\n  return async function proxy(\n    request: NextRequest,\n  ): Promise<NextResponse> {\n    // 1. Run user's 'before' hook\n    if (config?.before) {\n      const earlyResponse = await config.before(request)\n      if (earlyResponse) {\n        // Apply security headers even to early responses\n        applyHeaders(earlyResponse, securityHeaders)\n        return earlyResponse\n      }\n    }\n\n    // 2. Check Portal-managed redirects (unless disabled)\n    if (config?.redirects !== false) {\n      const redirectConfig: RedirectConfig =\n        typeof config?.redirects === 'object'\n          ? config.redirects\n          : {}\n\n      const redirect = await handleManagedRedirects(\n        request,\n        redirectConfig,\n      )\n      if (redirect) {\n        // Redirects get security headers too\n        applyHeaders(redirect, securityHeaders)\n        return redirect\n      }\n    }\n\n    // 3. Build the pass-through response. Always stamp the requested\n    // pathname+search onto the REQUEST so app/not-found.tsx (which Next\n    // gives no URL) can resolve managed redirects at the 404 boundary.\n    // Pure header write — no fetch, static-safe.\n    const requestHeaders = new Headers(request.headers)\n    requestHeaders.set(\n      SK_PATH_HEADER,\n      request.nextUrl.pathname + request.nextUrl.search,\n    )\n    let response = NextResponse.next({ request: { headers: requestHeaders } })\n\n    // 4. Apply security headers\n    applyHeaders(response, securityHeaders)\n\n    // 5. Apply AI discovery Link header (only on HTML-like requests, not static assets)\n    if (Object.keys(discoveryHeaders).length > 0) {\n      const accept = request.headers.get('accept') || ''\n      if (accept.includes('text/html') || accept.includes('*/*')) {\n        applyHeaders(response, discoveryHeaders)\n      }\n    }\n\n    // 5b. Edge identity pass (opt-in). Ensure a first-party `_sk_vid` visitor\n    // cookie exists and resolve the visitor segment into `_sk_seg`. Additive:\n    // only writes cookies, never changes the rendered HTML (LCP/static-safe).\n    if (config?.identity) {\n      const idCfg: IdentityConfig =\n        typeof config.identity === 'object' ? config.identity : {}\n      const hadVisitorCookie = !!request.cookies.get('_sk_vid')?.value\n      if (!hadVisitorCookie) {\n        const maxAgeDays = idCfg.cookieMaxAgeDays ?? 730\n        response.cookies.set('_sk_vid', uuid(), {\n          maxAge: maxAgeDays * 24 * 60 * 60,\n          path: '/',\n          sameSite: 'lax',\n          secure: true,\n        })\n      }\n      if (idCfg.segment !== false) {\n        const segment = encodeSegment(\n          resolveVisitorSegment(request, { hadVisitorCookie }),\n        )\n        response.cookies.set('_sk_seg', segment, {\n          // Session-ish: a fresh campaign / source on a later visit re-segments.\n          maxAge: 30 * 60,\n          path: '/',\n          sameSite: 'lax',\n          secure: true,\n        })\n      }\n    }\n\n    // 6. Run user's 'after' hook\n    if (config?.after) {\n      response = await config.after(request, response)\n    }\n\n    return response\n  }\n}\n\nfunction applyHeaders(\n  response: NextResponse,\n  headers: Record<string, string>,\n): void {\n  for (const [key, value] of Object.entries(headers)) {\n    response.headers.set(key, value)\n  }\n}\n\n/**\n * REFERENCE VALUE ONLY — copy the array into your proxy.ts, do not export it.\n *\n * `export const config = siteKitMatcher` is a BUILD ERROR on Next 16:\n * `config.matcher` must be statically analyzable and Turbopack rejects any\n * imported value. This constant exists so the canonical pattern lives in one\n * place (the scaffold, docs, and tests read it) — inline its contents.\n */\nexport const siteKitMatcher = {\n  matcher: [\n    '/((?!_next/static|_next/image|favicon\\\\.ico|.*\\\\.(?:ico|png|jpg|jpeg|gif|webp|svg|woff2?)$).*)',\n  ],\n}\n\n/** Next.js 16+ alias — same as createMiddleware, named for the proxy convention. */\nexport const createProxy = createMiddleware\n"]}

package/dist/middleware/securityHeaders.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"securityHeaders.d.ts","sourceRoot":"","sources":["../../src/middleware/securityHeaders.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,UAInC,CAAA;AAED,MAAM,WAAW,qBAAqB;IACpC;0EACsE;IACtE,YAAY,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,KAAK,CAAA;IAC5C;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;IACjC,qDAAqD;IACrD,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,6CAA6C;IAC7C,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,kFAAkF;IAClF,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,iDAAiD;IACjD,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,gCAAgC;IAChC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACvC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,CAAC,EAAE,qBAAqB,GAAG,OAAO,GACvC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA+DxB"}

package/dist/middleware/securityHeaders.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"securityHeaders.test.d.ts","sourceRoot":"","sources":["../../src/middleware/securityHeaders.test.ts"],"names":[],"mappings":""}

package/dist/middleware/segment.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"segment.d.ts","sourceRoot":"","sources":["../../src/middleware/segment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE9C,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,QAAQ,CAAA;AAEjF,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,WAAW,EAAE,KAAK,GAAG,WAAW,CAAA;IAChC,6EAA6E;IAC7E,MAAM,EAAE,aAAa,CAAA;IACrB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAkBD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE;IAAE,gBAAgB,EAAE,OAAO,CAAA;CAAE,GAClC,cAAc,CA2ChB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAGzD;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,cAAc,GAAG,IAAI,CASrF"}

package/dist/middleware/segment.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"segment.test.d.ts","sourceRoot":"","sources":["../../src/middleware/segment.test.ts"],"names":[],"mappings":""}