@btst/stack 3.0.0-rc.2 → 3.0.0-rc.3

package/dist/client/index.d.ts

@@ -1,9 +1,15 @@
-import { c as Sitemap, C as ClientPlugin, d as PluginRoutes, e as ClientLibConfig, f as ClientLib } from '../shared/stack.BqTR6qi2.js';
-export { b as ClientStackContext } from '../shared/stack.BqTR6qi2.js';
+import { s as Sitemap, q as ClientPluginRegistration, t as PluginRoutes, u as ClientStackConfig, v as ResolvedClientStack } from '../shared/stack.0O62uXqP.js';
+export { w as ClientApiConfig, x as ClientApiEndpointOverride, y as ClientLocation, z as ClientLocationOverride, C as ClientPlugin, p as ClientPluginDefinition, E as ClientPluginEndpointOverride, F as ClientPluginEndpointOverrides, G as ClientProviderApi, H as ClientProviderPluginRuntime, J as ClientProviderProjection, N as ClientStack, K as ClientStackContext, L as ResolvedClientApi, r as ResolvedClientPluginRuntime, M as ResolvedClientStackConfig } from '../shared/stack.0O62uXqP.js';
+export { I as InferListState, b as ListStateField, L as ListStateSchema, S as SetListState, a as SetListStateOptions, l as listStateParamKey, p as parseListStateFromSearchParams, r as resolveListStateHistoryMode, s as serializeListStateToSearchParams } from '../shared/stack.Cmg7lzzy.js';
 import '@btst/yar';
+import '@tanstack/react-query';
 import '@btst/db';
 import 'better-call';
-import '../shared/stack.C4_gEENS.js';
+import '../authorization/server.js';
+import '../authorization/index.js';
+import 'zod';
+import '../shared/stack.CKXzdGiJ.js';
+import '../shared/stack.BYMentwB.js';
 
 /**
  * Converts an array of sitemap entries into an XML string following the sitemap.org protocol.
@@ -97,113 +103,37 @@ declare function metaElementsToObject(metaElements: Array<React.JSX.IntrinsicEle
  */
 declare function normalizePath(path?: string | Array<string> | undefined): string;
 
-type ListStateFieldType = "string" | "number" | "boolean";
-interface ListStateField<T extends ListStateFieldType = ListStateFieldType> {
-    type: T;
-    default: T extends "string" ? string : T extends "number" ? number : boolean;
-    /**
-     * How URL history is updated when this field changes.
-     * - `"push"` (default): discrete changes (tab switch, page change) — back button undoes.
-     * - `"replace"`: rapid changes (typing in a filter) — no extra history entries.
-     */
-    history?: "push" | "replace";
-}
-type ListStateSchema = Record<string, ListStateField>;
-type InferListStateValue<F extends ListStateField> = F["type"] extends "string" ? string : F["type"] extends "number" ? number : boolean;
-type InferListState<S extends ListStateSchema> = {
-    [K in keyof S]: InferListStateValue<S[K]>;
-};
-/**
- * URL query param key for a list-state field.
- * The `namespace` argument identifies the hook instance for SSR helpers but
- * does not prefix URL keys — field names are used directly (e.g. `?tab=spam`).
- */
-declare function listStateParamKey(_namespace: string, fieldKey: string): string;
-/**
- * Parse list state from URL search params (SSR-safe — pass the request URL's
- * search string or a `URLSearchParams` instance).
- */
-declare function parseListStateFromSearchParams<S extends ListStateSchema>(namespace: string, schema: S, searchParams: URLSearchParams | string): InferListState<S>;
-/**
- * Serialize list state into URL search params. Default values are omitted for
- * clean URLs.
- */
-declare function serializeListStateToSearchParams<S extends ListStateSchema>(namespace: string, schema: S, state: InferListState<S>, baseParams?: URLSearchParams): URLSearchParams;
-
-type SetListStateOptions = {
-    /** Force `replace` vs `push` history semantics for this update */
-    replace?: boolean;
-};
-type SetListState<S extends ListStateSchema> = (updates: Partial<InferListState<S>> | ((prev: InferListState<S>) => Partial<InferListState<S>>), options?: SetListStateOptions) => void;
+type AnyPluginMap = Record<string, ClientPluginRegistration<any, any, any, any, any>>;
 /**
- * Sync list UI state (filters, tabs, pagination) with URL search params.
- *
- * Defaults are omitted from the URL. Field-level `history: "replace"` is used
- * for rapid changes; discrete changes (tab/page) default to `push` so the back
- * button undoes them.
+ * Resolves all registered client plugin definitions against one API location,
+ * site location, and React Query client.
  *
- * The `namespace` identifies this list state for SSR helpers; URL keys use
- * the schema field names directly.
- *
- * @example
- * ```tsx
- * const [state, setState] = useListState("comments-moderation", {
- *   tab: { type: "string", default: "pending" },
- *   page: { type: "number", default: 1 },
- * });
- * // URL: ?tab=spam&page=3
- * ```
- */
-declare function useListState<S extends ListStateSchema>(namespace: string, schema: S): [InferListState<S>, SetListState<S>];
-
-/**
- * Creates the client library with plugin support
+ * Create a request-specific instance with `api.headers` for SSR/SSG and a
+ * separate browser instance without request headers. The returned `provider`
+ * projection contains no request headers.
  *
  * @example
  * ```ts
- * // For Next.js with SSR:
- * const lib = createStackClient({
+ * const clientStack = createClientStack({
+ *   api: {
+ *     baseURL: "https://app.example.com",
+ *     basePath: "/api/data",
+ *     headers: requestHeaders,
+ *   },
+ *   site: {
+ *     baseURL: "https://app.example.com",
+ *     basePath: "/pages",
+ *   },
+ *   queryClient,
  *   plugins: {
- *     blog: blogPlugin.client
- *   }
+ *     example: exampleClientPlugin(),
+ *   },
  * });
- *
- * // SPA usage - just render the route
- * function Page() {
- *   return lib.resolveRoute('/blog');
- * }
- *
- * // SSR usage - prefetch data with loader, then render
- * async function Page({ params }) {
- *   const path = '/blog';
- *
- *   // Load data server-side if loader exists
- *   const loader = lib.getLoader(path);
- *   if (loader) await loader(queryClient, baseURL, basePath);
- *
- *   // Render with built-in Suspense + Error Boundary
- *   return lib.resolveRoute(path);
- * }
- *
- * // Next.js with notFound() function
- * import { notFound } from 'next/navigation';
- *
- * async function Page({ params }) {
- *   const path = '/blog';
- *   const loader = lib.getLoader(path);
- *   if (loader) await loader(queryClient, baseURL);
- *
- *   return lib.resolveRoute(path, {
- *     onNotFound: notFound // Calls Next.js notFound() instead of rendering
- *   });
- * }
- *
  * ```
  *
  * @template TPlugins - The exact plugins map (inferred from config)
  * @template TRoutes - All routes from all plugins, merged (computed automatically)
  */
-declare function createStackClient<TPlugins extends Record<string, ClientPlugin<any, any>>, TRoutes extends PluginRoutes<TPlugins> = PluginRoutes<TPlugins>>(config: ClientLibConfig<TPlugins>): ClientLib<TRoutes>;
+declare function createClientStack<TPlugins extends AnyPluginMap, TRoutes extends PluginRoutes<TPlugins> = PluginRoutes<TPlugins>>(config: ClientStackConfig<TPlugins>): ResolvedClientStack<TRoutes, TPlugins>;
 
-export { ClientLib, ClientLibConfig, ClientPlugin, createStackClient, listStateParamKey, metaElementsToObject, normalizePath, parseListStateFromSearchParams, serializeListStateToSearchParams, sitemapEntryToXmlString, useListState };
-export type { InferListState, ListStateField, ListStateSchema, SetListState, SetListStateOptions };
+export { ClientPluginRegistration, ClientStackConfig, ResolvedClientStack, createClientStack, metaElementsToObject, normalizePath, sitemapEntryToXmlString };

package/dist/client/index.mjs

@@ -1,13 +1,42 @@
 import { createRouter } from '@btst/yar';
+import { resolveClientRuntime } from '../packages/stack/src/client/runtime.mjs';
+import { resolvePluginRegistrationIds } from '../packages/stack/src/plugin-registration.mjs';
 export { sitemapEntryToXmlString } from '../packages/stack/src/client/sitemap-utils.mjs';
 export { metaElementsToObject } from '../packages/stack/src/client/meta-utils.mjs';
 export { normalizePath } from '../packages/stack/src/client/path-utils.mjs';
-export { useListState } from '../packages/stack/src/client/hooks/use-list-state.mjs';
-export { listStateParamKey, parseListStateFromSearchParams, serializeListStateToSearchParams } from '../packages/stack/src/shared/list-state.mjs';
+export { listStateParamKey, parseListStateFromSearchParams, resolveListStateHistoryMode, serializeListStateToSearchParams } from '../packages/stack/src/shared/list-state.mjs';
 
-function createStackClient(config) {
-  const { plugins, basePath } = config;
-  const allRoutes = {};
+function createClientStack(config) {
+  const registrations = config.plugins;
+  const registrationIds = resolvePluginRegistrationIds(registrations, "client");
+  const validatedRegistrations = registrations;
+  const runtime = resolveClientRuntime(config, registrationIds);
+  const resolvedPlugins = /* @__PURE__ */ Object.create(
+    null
+  );
+  for (const [pluginKey, registration] of Object.entries(
+    validatedRegistrations
+  )) {
+    const definition = registration;
+    if (!Object.hasOwn(definition, "resolve") || typeof definition.resolve !== "function") {
+      throw new Error(
+        `[btst/client] Client plugin "${pluginKey}" must declare an own resolve() function.`
+      );
+    }
+    const resolution = definition.resolve(runtime.pluginRuntimes[pluginKey]);
+    if (!resolution || typeof resolution.routes !== "function") {
+      throw new Error(
+        `[btst/client] Client plugin "${pluginKey}" did not resolve to a routes() function.`
+      );
+    }
+    resolvedPlugins[pluginKey] = {
+      ...resolution,
+      id: registrationIds[pluginKey]
+    };
+  }
+  const plugins = resolvedPlugins;
+  const basePath = runtime.provider.site.basePath;
+  const allRoutes = /* @__PURE__ */ Object.create(null);
   const clientStackContext = {
     plugins,
     basePath
@@ -17,7 +46,8 @@ function createStackClient(config) {
     Object.assign(allRoutes, pluginRoutes);
   }
   const router = createRouter(allRoutes);
-  return {
+  const result = {
+    context: clientStackContext,
     router,
     async generateSitemap() {
       const sitemapEntries = [];
@@ -37,6 +67,7 @@ function createStackClient(config) {
       return deduped;
     }
   };
+  return { ...result, provider: runtime.provider };
 }
 
-export { createStackClient };
+export { createClientStack };

package/dist/client/server.cjs

@@ -0,0 +1,96 @@
+'use strict';
+
+const ROUTING_AND_HOP_BY_HOP_HEADERS = [
+  "connection",
+  "content-length",
+  "forwarded",
+  "host",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "proxy-connection",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade",
+  "x-forwarded-for",
+  "x-forwarded-host",
+  "x-forwarded-port",
+  "x-forwarded-proto",
+  "x-real-ip"
+];
+function filterCredentialForwardingHeaders(requestHeaders) {
+  const headers = new Headers(requestHeaders);
+  const connectionHeaders = headers.get("connection")?.split(",").map((name) => name.trim()).filter(Boolean);
+  for (const name of ROUTING_AND_HOP_BY_HOP_HEADERS) headers.delete(name);
+  for (const name of connectionHeaders ?? []) headers.delete(name);
+  return headers;
+}
+function normalizeHttpOrigin(value, label) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new Error(`${label} must be an absolute HTTP(S) origin.`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.search || parsed.hash || parsed.pathname !== "/" && parsed.pathname !== "") {
+    throw new Error(
+      `${label} must be an absolute HTTP(S) origin without credentials, path, query, or hash.`
+    );
+  }
+  return parsed.origin;
+}
+function isLoopbackOrigin(origin) {
+  const hostname = new URL(origin).hostname;
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+function resolveTrustedServerOrigin(options) {
+  const label = options.label ?? "server origin";
+  if (options.configuredOrigin) {
+    return normalizeHttpOrigin(options.configuredOrigin, label);
+  }
+  if (options.isProduction) {
+    throw new Error(`${label} must be configured in production.`);
+  }
+  if (options.requestOrigin) {
+    const requestOrigin = normalizeHttpOrigin(
+      options.requestOrigin,
+      "request origin"
+    );
+    if (!isLoopbackOrigin(requestOrigin)) {
+      throw new Error(
+        `${label} without configuration is limited to loopback development origins.`
+      );
+    }
+    return requestOrigin;
+  }
+  const fallback = normalizeHttpOrigin(
+    options.developmentFallback ?? "http://localhost:3000",
+    "development fallback"
+  );
+  if (!isLoopbackOrigin(fallback)) {
+    throw new Error("development fallback must use a loopback origin.");
+  }
+  return fallback;
+}
+function resolveTrustedClientOrigins(options) {
+  const siteOrigin = resolveTrustedServerOrigin({
+    configuredOrigin: options.configuredSiteOrigin,
+    requestOrigin: options.requestOrigin,
+    isProduction: options.isProduction,
+    developmentFallback: options.developmentFallback,
+    label: options.siteLabel ?? "site origin"
+  });
+  const apiOrigin = resolveTrustedServerOrigin({
+    configuredOrigin: options.configuredApiOrigin ?? siteOrigin,
+    requestOrigin: options.requestOrigin,
+    isProduction: options.isProduction,
+    developmentFallback: options.developmentFallback,
+    label: options.apiLabel ?? "API origin"
+  });
+  return { apiOrigin, siteOrigin };
+}
+
+exports.filterCredentialForwardingHeaders = filterCredentialForwardingHeaders;
+exports.resolveTrustedClientOrigins = resolveTrustedClientOrigins;
+exports.resolveTrustedServerOrigin = resolveTrustedServerOrigin;

package/dist/client/server.d.cts

@@ -0,0 +1,57 @@
+/** Security policy used to resolve one deployment-trusted server origin. */
+interface TrustedServerOriginOptions {
+    /** Deployment-controlled origin. This always wins when present. */
+    configuredOrigin?: string;
+    /** Request-derived origin used only for loopback development. */
+    requestOrigin?: string;
+    /** Whether missing deployment configuration must fail closed. */
+    isProduction: boolean;
+    /** Loopback-only origin used when development has no request origin. */
+    developmentFallback?: string;
+    /** Human-readable configuration name included in validation errors. */
+    label?: string;
+}
+/** Browser-safe API and site origins resolved from server-owned configuration. */
+interface TrustedClientOrigins {
+    /** Trusted destination for client-stack API requests. */
+    apiOrigin: string;
+    /** Trusted public origin used to build page and asset URLs. */
+    siteOrigin: string;
+}
+/** Security policy used to resolve one API/site origin snapshot. */
+interface TrustedClientOriginsOptions {
+    /** Deployment-controlled managed or same-origin API destination. */
+    configuredApiOrigin?: string;
+    /** Deployment-controlled public site origin. */
+    configuredSiteOrigin?: string;
+    /** Request-derived origin used only for loopback development. */
+    requestOrigin?: string;
+    /** Whether missing deployment configuration must fail closed. */
+    isProduction: boolean;
+    /** Loopback-only origin used when development has no request origin. */
+    developmentFallback?: string;
+    /** Human-readable API configuration name included in validation errors. */
+    apiLabel?: string;
+    /** Human-readable site configuration name included in validation errors. */
+    siteLabel?: string;
+}
+/** Keeps identity headers while removing inbound routing and hop-by-hop state. */
+declare function filterCredentialForwardingHeaders(requestHeaders: HeadersInit): Headers;
+/**
+ * Resolves a server transport origin without trusting production Host headers.
+ *
+ * A deployment-controlled origin always wins, which supports managed and
+ * cross-origin APIs. Production fails closed without one. Local development may
+ * infer only a loopback request origin.
+ */
+declare function resolveTrustedServerOrigin(options: TrustedServerOriginOptions): string;
+/**
+ * Resolves the API and public site origins once on the server.
+ *
+ * A separately configured managed API remains distinct. Without one, the API
+ * safely defaults to the already-trusted site origin.
+ */
+declare function resolveTrustedClientOrigins(options: TrustedClientOriginsOptions): TrustedClientOrigins;
+
+export { filterCredentialForwardingHeaders, resolveTrustedClientOrigins, resolveTrustedServerOrigin };
+export type { TrustedClientOrigins, TrustedClientOriginsOptions, TrustedServerOriginOptions };

package/dist/client/server.d.mts

@@ -0,0 +1,57 @@
+/** Security policy used to resolve one deployment-trusted server origin. */
+interface TrustedServerOriginOptions {
+    /** Deployment-controlled origin. This always wins when present. */
+    configuredOrigin?: string;
+    /** Request-derived origin used only for loopback development. */
+    requestOrigin?: string;
+    /** Whether missing deployment configuration must fail closed. */
+    isProduction: boolean;
+    /** Loopback-only origin used when development has no request origin. */
+    developmentFallback?: string;
+    /** Human-readable configuration name included in validation errors. */
+    label?: string;
+}
+/** Browser-safe API and site origins resolved from server-owned configuration. */
+interface TrustedClientOrigins {
+    /** Trusted destination for client-stack API requests. */
+    apiOrigin: string;
+    /** Trusted public origin used to build page and asset URLs. */
+    siteOrigin: string;
+}
+/** Security policy used to resolve one API/site origin snapshot. */
+interface TrustedClientOriginsOptions {
+    /** Deployment-controlled managed or same-origin API destination. */
+    configuredApiOrigin?: string;
+    /** Deployment-controlled public site origin. */
+    configuredSiteOrigin?: string;
+    /** Request-derived origin used only for loopback development. */
+    requestOrigin?: string;
+    /** Whether missing deployment configuration must fail closed. */
+    isProduction: boolean;
+    /** Loopback-only origin used when development has no request origin. */
+    developmentFallback?: string;
+    /** Human-readable API configuration name included in validation errors. */
+    apiLabel?: string;
+    /** Human-readable site configuration name included in validation errors. */
+    siteLabel?: string;
+}
+/** Keeps identity headers while removing inbound routing and hop-by-hop state. */
+declare function filterCredentialForwardingHeaders(requestHeaders: HeadersInit): Headers;
+/**
+ * Resolves a server transport origin without trusting production Host headers.
+ *
+ * A deployment-controlled origin always wins, which supports managed and
+ * cross-origin APIs. Production fails closed without one. Local development may
+ * infer only a loopback request origin.
+ */
+declare function resolveTrustedServerOrigin(options: TrustedServerOriginOptions): string;
+/**
+ * Resolves the API and public site origins once on the server.
+ *
+ * A separately configured managed API remains distinct. Without one, the API
+ * safely defaults to the already-trusted site origin.
+ */
+declare function resolveTrustedClientOrigins(options: TrustedClientOriginsOptions): TrustedClientOrigins;
+
+export { filterCredentialForwardingHeaders, resolveTrustedClientOrigins, resolveTrustedServerOrigin };
+export type { TrustedClientOrigins, TrustedClientOriginsOptions, TrustedServerOriginOptions };

package/dist/client/server.d.ts

@@ -0,0 +1,57 @@
+/** Security policy used to resolve one deployment-trusted server origin. */
+interface TrustedServerOriginOptions {
+    /** Deployment-controlled origin. This always wins when present. */
+    configuredOrigin?: string;
+    /** Request-derived origin used only for loopback development. */
+    requestOrigin?: string;
+    /** Whether missing deployment configuration must fail closed. */
+    isProduction: boolean;
+    /** Loopback-only origin used when development has no request origin. */
+    developmentFallback?: string;
+    /** Human-readable configuration name included in validation errors. */
+    label?: string;
+}
+/** Browser-safe API and site origins resolved from server-owned configuration. */
+interface TrustedClientOrigins {
+    /** Trusted destination for client-stack API requests. */
+    apiOrigin: string;
+    /** Trusted public origin used to build page and asset URLs. */
+    siteOrigin: string;
+}
+/** Security policy used to resolve one API/site origin snapshot. */
+interface TrustedClientOriginsOptions {
+    /** Deployment-controlled managed or same-origin API destination. */
+    configuredApiOrigin?: string;
+    /** Deployment-controlled public site origin. */
+    configuredSiteOrigin?: string;
+    /** Request-derived origin used only for loopback development. */
+    requestOrigin?: string;
+    /** Whether missing deployment configuration must fail closed. */
+    isProduction: boolean;
+    /** Loopback-only origin used when development has no request origin. */
+    developmentFallback?: string;
+    /** Human-readable API configuration name included in validation errors. */
+    apiLabel?: string;
+    /** Human-readable site configuration name included in validation errors. */
+    siteLabel?: string;
+}
+/** Keeps identity headers while removing inbound routing and hop-by-hop state. */
+declare function filterCredentialForwardingHeaders(requestHeaders: HeadersInit): Headers;
+/**
+ * Resolves a server transport origin without trusting production Host headers.
+ *
+ * A deployment-controlled origin always wins, which supports managed and
+ * cross-origin APIs. Production fails closed without one. Local development may
+ * infer only a loopback request origin.
+ */
+declare function resolveTrustedServerOrigin(options: TrustedServerOriginOptions): string;
+/**
+ * Resolves the API and public site origins once on the server.
+ *
+ * A separately configured managed API remains distinct. Without one, the API
+ * safely defaults to the already-trusted site origin.
+ */
+declare function resolveTrustedClientOrigins(options: TrustedClientOriginsOptions): TrustedClientOrigins;
+
+export { filterCredentialForwardingHeaders, resolveTrustedClientOrigins, resolveTrustedServerOrigin };
+export type { TrustedClientOrigins, TrustedClientOriginsOptions, TrustedServerOriginOptions };

package/dist/client/server.mjs

@@ -0,0 +1,92 @@
+const ROUTING_AND_HOP_BY_HOP_HEADERS = [
+  "connection",
+  "content-length",
+  "forwarded",
+  "host",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "proxy-connection",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade",
+  "x-forwarded-for",
+  "x-forwarded-host",
+  "x-forwarded-port",
+  "x-forwarded-proto",
+  "x-real-ip"
+];
+function filterCredentialForwardingHeaders(requestHeaders) {
+  const headers = new Headers(requestHeaders);
+  const connectionHeaders = headers.get("connection")?.split(",").map((name) => name.trim()).filter(Boolean);
+  for (const name of ROUTING_AND_HOP_BY_HOP_HEADERS) headers.delete(name);
+  for (const name of connectionHeaders ?? []) headers.delete(name);
+  return headers;
+}
+function normalizeHttpOrigin(value, label) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new Error(`${label} must be an absolute HTTP(S) origin.`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.search || parsed.hash || parsed.pathname !== "/" && parsed.pathname !== "") {
+    throw new Error(
+      `${label} must be an absolute HTTP(S) origin without credentials, path, query, or hash.`
+    );
+  }
+  return parsed.origin;
+}
+function isLoopbackOrigin(origin) {
+  const hostname = new URL(origin).hostname;
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+function resolveTrustedServerOrigin(options) {
+  const label = options.label ?? "server origin";
+  if (options.configuredOrigin) {
+    return normalizeHttpOrigin(options.configuredOrigin, label);
+  }
+  if (options.isProduction) {
+    throw new Error(`${label} must be configured in production.`);
+  }
+  if (options.requestOrigin) {
+    const requestOrigin = normalizeHttpOrigin(
+      options.requestOrigin,
+      "request origin"
+    );
+    if (!isLoopbackOrigin(requestOrigin)) {
+      throw new Error(
+        `${label} without configuration is limited to loopback development origins.`
+      );
+    }
+    return requestOrigin;
+  }
+  const fallback = normalizeHttpOrigin(
+    options.developmentFallback ?? "http://localhost:3000",
+    "development fallback"
+  );
+  if (!isLoopbackOrigin(fallback)) {
+    throw new Error("development fallback must use a loopback origin.");
+  }
+  return fallback;
+}
+function resolveTrustedClientOrigins(options) {
+  const siteOrigin = resolveTrustedServerOrigin({
+    configuredOrigin: options.configuredSiteOrigin,
+    requestOrigin: options.requestOrigin,
+    isProduction: options.isProduction,
+    developmentFallback: options.developmentFallback,
+    label: options.siteLabel ?? "site origin"
+  });
+  const apiOrigin = resolveTrustedServerOrigin({
+    configuredOrigin: options.configuredApiOrigin ?? siteOrigin,
+    requestOrigin: options.requestOrigin,
+    isProduction: options.isProduction,
+    developmentFallback: options.developmentFallback,
+    label: options.apiLabel ?? "API origin"
+  });
+  return { apiOrigin, siteOrigin };
+}
+
+export { filterCredentialForwardingHeaders, resolveTrustedClientOrigins, resolveTrustedServerOrigin };

package/dist/components/auto-form/index.d.cts

@@ -2,8 +2,8 @@ import * as react_jsx_runtime from 'react/jsx-runtime';
 import React__default from 'react';
 import { UseFormReturn, FormState } from 'react-hook-form';
 import { z } from 'zod';
-import { a as FieldConfig, D as Dependency } from '../../shared/stack.CPsYC2-Z.cjs';
-export { A as AutoFormInputComponentProps, b as DependencyType, F as FieldConfigItem } from '../../shared/stack.CPsYC2-Z.cjs';
+import { a as FieldConfig, D as Dependency } from '../../shared/stack.fdi94T4S.cjs';
+export { A as AutoFormInputComponentProps, b as DependencyType, F as FieldConfigItem } from '../../shared/stack.fdi94T4S.cjs';
 import { Z as ZodObjectOrWrapped } from '../../shared/stack.CZMWR72v.cjs';
 
 declare function AutoFormSubmit({ children, className, disabled, }: {

package/dist/components/auto-form/index.d.mts

@@ -2,8 +2,8 @@ import * as react_jsx_runtime from 'react/jsx-runtime';
 import React__default from 'react';
 import { UseFormReturn, FormState } from 'react-hook-form';
 import { z } from 'zod';
-import { a as FieldConfig, D as Dependency } from '../../shared/stack.CPsYC2-Z.mjs';
-export { A as AutoFormInputComponentProps, b as DependencyType, F as FieldConfigItem } from '../../shared/stack.CPsYC2-Z.mjs';
+import { a as FieldConfig, D as Dependency } from '../../shared/stack.fdi94T4S.mjs';
+export { A as AutoFormInputComponentProps, b as DependencyType, F as FieldConfigItem } from '../../shared/stack.fdi94T4S.mjs';
 import { Z as ZodObjectOrWrapped } from '../../shared/stack.CZMWR72v.mjs';
 
 declare function AutoFormSubmit({ children, className, disabled, }: {

package/dist/components/auto-form/index.d.ts

@@ -2,8 +2,8 @@ import * as react_jsx_runtime from 'react/jsx-runtime';
 import React__default from 'react';
 import { UseFormReturn, FormState } from 'react-hook-form';
 import { z } from 'zod';
-import { a as FieldConfig, D as Dependency } from '../../shared/stack.CPsYC2-Z.js';
-export { A as AutoFormInputComponentProps, b as DependencyType, F as FieldConfigItem } from '../../shared/stack.CPsYC2-Z.js';
+import { a as FieldConfig, D as Dependency } from '../../shared/stack.fdi94T4S.js';
+export { A as AutoFormInputComponentProps, b as DependencyType, F as FieldConfigItem } from '../../shared/stack.fdi94T4S.js';
 import { Z as ZodObjectOrWrapped } from '../../shared/stack.CZMWR72v.js';
 
 declare function AutoFormSubmit({ children, className, disabled, }: {

package/dist/components/form-builder/index.d.cts

@@ -1,6 +1,6 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { z } from 'zod';
-import { I as InputPropsByBackingType, c as FieldType, S as SerializableInputProps, J as JSONSchemaPropertyBase, A as AutoFormInputComponentProps } from '../../shared/stack.CPsYC2-Z.cjs';
+import { I as InputPropsByBackingType, c as FieldType, S as SerializableInputProps, J as JSONSchemaPropertyBase, A as AutoFormInputComponentProps } from '../../shared/stack.fdi94T4S.cjs';
 import 'react-hook-form';
 
 /**

package/dist/components/form-builder/index.d.mts

@@ -1,6 +1,6 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { z } from 'zod';
-import { I as InputPropsByBackingType, c as FieldType, S as SerializableInputProps, J as JSONSchemaPropertyBase, A as AutoFormInputComponentProps } from '../../shared/stack.CPsYC2-Z.mjs';
+import { I as InputPropsByBackingType, c as FieldType, S as SerializableInputProps, J as JSONSchemaPropertyBase, A as AutoFormInputComponentProps } from '../../shared/stack.fdi94T4S.mjs';
 import 'react-hook-form';
 
 /**

package/dist/components/form-builder/index.d.ts

@@ -1,6 +1,6 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { z } from 'zod';
-import { I as InputPropsByBackingType, c as FieldType, S as SerializableInputProps, J as JSONSchemaPropertyBase, A as AutoFormInputComponentProps } from '../../shared/stack.CPsYC2-Z.js';
+import { I as InputPropsByBackingType, c as FieldType, S as SerializableInputProps, J as JSONSchemaPropertyBase, A as AutoFormInputComponentProps } from '../../shared/stack.fdi94T4S.js';
 import 'react-hook-form';
 
 /**

package/dist/components/stepped-auto-form/index.d.cts

@@ -2,7 +2,7 @@ import * as react_jsx_runtime from 'react/jsx-runtime';
 import React__default from 'react';
 import { z } from 'zod';
 import { UseFormReturn } from 'react-hook-form';
-import { a as FieldConfig } from '../../shared/stack.CPsYC2-Z.cjs';
+import { a as FieldConfig } from '../../shared/stack.fdi94T4S.cjs';
 import { Z as ZodObjectOrWrapped } from '../../shared/stack.CZMWR72v.cjs';
 
 interface StepperComponentProps {