@carlonicora/nextjs-jsonapi 3.28.2 → 4.0.1

package/dist/next-config/index.mjs

@@ -0,0 +1,230 @@
+import {
+  __name
+} from "../chunk-PAWJFY3S.mjs";
+
+// src/next-config/csp.ts
+var SERVICE_SOURCES = {
+  stripe: {
+    "script-src": ["https://js.stripe.com"],
+    "img-src": ["https://*.stripe.com"],
+    "connect-src": ["https://api.stripe.com"],
+    "frame-src": ["https://js.stripe.com", "https://hooks.stripe.com"]
+  },
+  googleMaps: {
+    "script-src": ["https://maps.googleapis.com"],
+    "img-src": ["https://maps.googleapis.com", "https://maps.gstatic.com"],
+    "connect-src": ["https://maps.googleapis.com", "https://places.googleapis.com"]
+  },
+  turnstile: {
+    "script-src": ["https://challenges.cloudflare.com"],
+    "connect-src": ["https://challenges.cloudflare.com"],
+    "frame-src": ["https://challenges.cloudflare.com"]
+  },
+  discord: {
+    "img-src": ["https://cdn.discordapp.com"]
+  },
+  googleFonts: {
+    "style-src": ["https://fonts.googleapis.com"],
+    "font-src": ["https://fonts.gstatic.com"]
+  }
+};
+function listImageSources(env) {
+  return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(",").map((s) => s.trim()) : [];
+}
+__name(listImageSources, "listImageSources");
+function buildCsp(options, env) {
+  const apiUrl = env.NEXT_PUBLIC_API_URL || "";
+  const imageSources = listImageSources(env);
+  const services = options.services ?? [];
+  const fetchDirectives = {
+    // Scripts: self, and unsafe-inline/eval for Next.js
+    "script-src": { base: ["'self'", "'unsafe-inline'", "'unsafe-eval'"], fromEnv: [] },
+    // Styles: self and unsafe-inline for styled-components/emotion
+    "style-src": { base: ["'self'", "'unsafe-inline'"], fromEnv: [] },
+    // Images: self, data URIs, blobs, and configured image sources
+    "img-src": { base: ["'self'", "data:", "blob:"], fromEnv: imageSources },
+    // Fonts: self
+    "font-src": { base: ["'self'"], fromEnv: [] },
+    // Connect: self, API (http + ws for socket.io), and storage (for uploads)
+    "connect-src": {
+      base: ["'self'"],
+      fromEnv: [
+        apiUrl,
+        // Add WebSocket URL for socket.io (convert http->ws, https->wss)
+        apiUrl.replace(/^http/, "ws"),
+        env.NEXT_PUBLIC_ADDRESS || "",
+        ...imageSources
+      ]
+    },
+    // Frames: self
+    "frame-src": { base: ["'self'"], fromEnv: [] },
+    // Worker sources: self and blob (for Web Workers with dynamic imports)
+    "worker-src": { base: ["'self'", "blob:"], fromEnv: [] }
+  };
+  const directive = /* @__PURE__ */ __name((name) => {
+    const { base, fromEnv } = fetchDirectives[name];
+    const fromServices = services.flatMap((service) => SERVICE_SOURCES[service][name] ?? []);
+    const sources = [...base, ...fromServices, ...options.csp?.[name] ?? [], ...fromEnv].filter(
+      (source) => source !== ""
+    );
+    return [name, ...new Set(sources)].join(" ");
+  }, "directive");
+  return [
+    "default-src 'self'",
+    directive("script-src"),
+    directive("style-src"),
+    directive("img-src"),
+    directive("font-src"),
+    directive("connect-src"),
+    directive("frame-src"),
+    // Frame ancestors: deny embedding (equivalent to X-Frame-Options: DENY)
+    "frame-ancestors 'none'",
+    // Form actions: only self
+    "form-action 'self'",
+    // Base URI: only self
+    "base-uri 'self'",
+    // Object sources: none (no plugins)
+    "object-src 'none'",
+    directive("worker-src"),
+    // Upgrade insecure requests in production.
+    //
+    // NOT under E2E_BUILD: the e2e harness runs a PRODUCTION build (for speed)
+    // and serves it over plain http on a custom hostname. With this directive
+    // the browser rewrites every /_next/static asset to https, which nothing is
+    // listening on — every chunk fails with ERR_SSL_PROTOCOL_ERROR, the page
+    // never hydrates, and each spec sees only server-rendered markup.
+    env.NODE_ENV === "production" && env.E2E_BUILD !== "true" ? "upgrade-insecure-requests" : ""
+  ].filter(Boolean).join("; ");
+}
+__name(buildCsp, "buildCsp");
+
+// src/next-config/headers.ts
+function buildSecurityHeaders(options, env) {
+  const camera = options.permissionsPolicy?.camera === "none" ? "" : "self";
+  return [
+    {
+      // Apply to all routes
+      source: "/:path*",
+      headers: [
+        // Content Security Policy - prevents XSS attacks
+        {
+          key: "Content-Security-Policy",
+          value: buildCsp(options, env)
+        },
+        // X-Frame-Options - prevents clickjacking (backup for older browsers)
+        {
+          key: "X-Frame-Options",
+          value: "DENY"
+        },
+        // X-Content-Type-Options - prevents MIME sniffing
+        {
+          key: "X-Content-Type-Options",
+          value: "nosniff"
+        },
+        // Strict-Transport-Security - enforces HTTPS (1 year, include subdomains).
+        // Omitted under E2E_BUILD for the same reason as upgrade-insecure-requests:
+        // the suite speaks plain http, and an HSTS pin would force https on every
+        // later request to this host from the same browser profile.
+        ...env.E2E_BUILD === "true" ? [] : [
+          {
+            key: "Strict-Transport-Security",
+            value: "max-age=31536000; includeSubDomains"
+          }
+        ],
+        // Referrer-Policy - controls referrer information
+        {
+          key: "Referrer-Policy",
+          value: "strict-origin-when-cross-origin"
+        },
+        // Permissions-Policy - restricts browser features
+        {
+          key: "Permissions-Policy",
+          value: `camera=(${camera}), microphone=(), geolocation=()`
+        }
+      ]
+    }
+  ];
+}
+__name(buildSecurityHeaders, "buildSecurityHeaders");
+
+// src/next-config/index.ts
+function parseImageSources(env) {
+  return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(",").map((url) => {
+    const { hostname, protocol, port } = new URL(url.trim());
+    return {
+      protocol: protocol.replace(":", ""),
+      hostname,
+      port: port || void 0
+    };
+  }) : [];
+}
+__name(parseImageSources, "parseImageSources");
+function createNextConfig(options) {
+  const env = process.env;
+  const reactCompiler = options.reactCompiler === true;
+  const config = {
+    // The e2e stack (scripts/e2e.sh) runs a PRODUCTION build of this app while a
+    // `next dev` server may still be running against the same worktree. `next
+    // build` and `next dev` share `.next`, so a build performed underneath a live
+    // dev server clobbers it and that dev server then 404s every route. Giving
+    // the e2e build its own directory keeps the two independent. E2E_BUILD must
+    // be set for `next build` AND for `next start`, or `start` looks in `.next`
+    // and serves someone else's output.
+    ...env.E2E_BUILD === "true" ? { distDir: ".next-e2e" } : {},
+    cacheComponents: true,
+    partialPrefetching: true,
+    reactCompiler,
+    experimental: {
+      serverActions: {
+        bodySizeLimit: "5mb"
+      },
+      // Required by `unauthorized()` (next/navigation), which ServerSession.checkPermission
+      // calls to deny access. Without this flag the function throws a plain Error instead of
+      // rendering the nearest unauthorized.tsx.
+      authInterrupts: options.authInterrupts ?? true,
+      turbopackGc: true,
+      turbopackLazyDynamicImports: true,
+      ...reactCompiler ? { turbopackRustReactCompiler: true } : {}
+    },
+    allowedDevOrigins: options.devOrigins,
+    pageExtensions: options.mdx ? ["ts", "tsx", "mdx"] : ["ts", "tsx"],
+    images: {
+      minimumCacheTTL: options.imageMinimumCacheTTL ?? 60,
+      remotePatterns: parseImageSources(env),
+      dangerouslyAllowLocalIP: true
+    },
+    poweredByHeader: false,
+    reactStrictMode: false,
+    env: {
+      NEXT_PUBLIC_API_URL: env.NEXT_PUBLIC_API_URL ?? "",
+      NEXT_PUBLIC_ADDRESS: env.NEXT_PUBLIC_ADDRESS ?? "",
+      NEXT_PUBLIC_VAPID_PUBLIC_KEY: env.NEXT_PUBLIC_VAPID_PUBLIC_KEY ?? "",
+      NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY ?? "",
+      ...options.env
+    },
+    // Inlined replacement for @serwist/turbopack's withSerwist wrapper, which
+    // does nothing but append these two entries. Requiring the package here
+    // instead CRASHES production: it is a devDependency, next.config.js is loaded
+    // at RUNTIME by `next start`, and the web-production image installs with
+    // --prod. Do not re-add a require of any devDependency to this file.
+    ...options.serwist ? { serverExternalPackages: ["esbuild", "esbuild-wasm"] } : {},
+    // Next 16 builds AND serves dev with Turbopack, so this is what pins yjs to a
+    // single instance in both modes.
+    turbopack: {
+      resolveAlias: {
+        yjs: "./node_modules/yjs"
+      }
+    }
+  };
+  if (options.securityHeaders !== false) {
+    config.headers = async () => buildSecurityHeaders(options, process.env);
+  }
+  if (options.rewrites) config.rewrites = options.rewrites;
+  return options.extend ? options.extend(config) : config;
+}
+__name(createNextConfig, "createNextConfig");
+export {
+  buildCsp,
+  createNextConfig
+};
+//# sourceMappingURL=index.mjs.map

package/dist/next-config/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/next-config/csp.ts","../../src/next-config/headers.ts","../../src/next-config/index.ts"],"sourcesContent":["// Runtime imports: none. next.config.js loads this at RUNTIME under `next start`\n// in an image installed with --prod, so it may import only Node built-ins.\n\nexport type CspDirective =\n  \"script-src\" | \"style-src\" | \"img-src\" | \"font-src\" | \"connect-src\" | \"frame-src\" | \"worker-src\";\n\n/**\n * Third-party services an app may load. Each one adds its hosts to the\n * directives it needs; nothing is allowed unless the app names it.\n *\n * - `stripe`: the billing feature (`@carlonicora/nextjs-jsonapi/billing`).\n * - `googleMaps`: `FormPlaceAutocomplete` (Places API) and Maps JS/static tiles.\n * - `turnstile`: Cloudflare Turnstile widgets (contact and waitlist forms).\n * - `discord`: Discord avatars shown for users who log in with Discord.\n * - `googleFonts`: fonts linked at runtime from Google Fonts. Not needed for\n *   `next/font/google`, which self-hosts at build time.\n */\nexport type CspService = \"stripe\" | \"googleMaps\" | \"turnstile\" | \"discord\" | \"googleFonts\";\n\nexport interface CspOptions {\n  services?: CspService[];\n  csp?: Partial<Record<CspDirective, string[]>>;\n}\n\nconst SERVICE_SOURCES: Record<CspService, Partial<Record<CspDirective, string[]>>> = {\n  stripe: {\n    \"script-src\": [\"https://js.stripe.com\"],\n    \"img-src\": [\"https://*.stripe.com\"],\n    \"connect-src\": [\"https://api.stripe.com\"],\n    \"frame-src\": [\"https://js.stripe.com\", \"https://hooks.stripe.com\"],\n  },\n  googleMaps: {\n    \"script-src\": [\"https://maps.googleapis.com\"],\n    \"img-src\": [\"https://maps.googleapis.com\", \"https://maps.gstatic.com\"],\n    \"connect-src\": [\"https://maps.googleapis.com\", \"https://places.googleapis.com\"],\n  },\n  turnstile: {\n    \"script-src\": [\"https://challenges.cloudflare.com\"],\n    \"connect-src\": [\"https://challenges.cloudflare.com\"],\n    \"frame-src\": [\"https://challenges.cloudflare.com\"],\n  },\n  discord: {\n    \"img-src\": [\"https://cdn.discordapp.com\"],\n  },\n  googleFonts: {\n    \"style-src\": [\"https://fonts.googleapis.com\"],\n    \"font-src\": [\"https://fonts.gstatic.com\"],\n  },\n};\n\nfunction listImageSources(env: NodeJS.ProcessEnv): string[] {\n  return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((s) => s.trim()) : [];\n}\n\n// Build CSP directives\n// Note: 'unsafe-inline' and 'unsafe-eval' needed for Next.js dev mode and some runtime features\n// In production, consider using nonces for stricter CSP\nexport function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string {\n  const apiUrl = env.NEXT_PUBLIC_API_URL || \"\";\n  const imageSources = listImageSources(env);\n  const services = options.services ?? [];\n\n  // Each fetch directive: what Next itself needs, then the named services, then\n  // the app's extras, then the sources derived from the env.\n  const fetchDirectives: Record<CspDirective, { base: string[]; fromEnv: string[] }> = {\n    // Scripts: self, and unsafe-inline/eval for Next.js\n    \"script-src\": { base: [\"'self'\", \"'unsafe-inline'\", \"'unsafe-eval'\"], fromEnv: [] },\n    // Styles: self and unsafe-inline for styled-components/emotion\n    \"style-src\": { base: [\"'self'\", \"'unsafe-inline'\"], fromEnv: [] },\n    // Images: self, data URIs, blobs, and configured image sources\n    \"img-src\": { base: [\"'self'\", \"data:\", \"blob:\"], fromEnv: imageSources },\n    // Fonts: self\n    \"font-src\": { base: [\"'self'\"], fromEnv: [] },\n    // Connect: self, API (http + ws for socket.io), and storage (for uploads)\n    \"connect-src\": {\n      base: [\"'self'\"],\n      fromEnv: [\n        apiUrl,\n        // Add WebSocket URL for socket.io (convert http->ws, https->wss)\n        apiUrl.replace(/^http/, \"ws\"),\n        env.NEXT_PUBLIC_ADDRESS || \"\",\n        ...imageSources,\n      ],\n    },\n    // Frames: self\n    \"frame-src\": { base: [\"'self'\"], fromEnv: [] },\n    // Worker sources: self and blob (for Web Workers with dynamic imports)\n    \"worker-src\": { base: [\"'self'\", \"blob:\"], fromEnv: [] },\n  };\n\n  const directive = (name: CspDirective): string => {\n    const { base, fromEnv } = fetchDirectives[name];\n    const fromServices = services.flatMap((service) => SERVICE_SOURCES[service][name] ?? []);\n    const sources = [...base, ...fromServices, ...(options.csp?.[name] ?? []), ...fromEnv].filter(\n      (source) => source !== \"\",\n    );\n    return [name, ...new Set(sources)].join(\" \");\n  };\n\n  return [\n    \"default-src 'self'\",\n    directive(\"script-src\"),\n    directive(\"style-src\"),\n    directive(\"img-src\"),\n    directive(\"font-src\"),\n    directive(\"connect-src\"),\n    directive(\"frame-src\"),\n    // Frame ancestors: deny embedding (equivalent to X-Frame-Options: DENY)\n    \"frame-ancestors 'none'\",\n    // Form actions: only self\n    \"form-action 'self'\",\n    // Base URI: only self\n    \"base-uri 'self'\",\n    // Object sources: none (no plugins)\n    \"object-src 'none'\",\n    directive(\"worker-src\"),\n    // Upgrade insecure requests in production.\n    //\n    // NOT under E2E_BUILD: the e2e harness runs a PRODUCTION build (for speed)\n    // and serves it over plain http on a custom hostname. With this directive\n    // the browser rewrites every /_next/static asset to https, which nothing is\n    // listening on — every chunk fails with ERR_SSL_PROTOCOL_ERROR, the page\n    // never hydrates, and each spec sees only server-rendered markup.\n    env.NODE_ENV === \"production\" && env.E2E_BUILD !== \"true\" ? \"upgrade-insecure-requests\" : \"\",\n  ]\n    .filter(Boolean)\n    .join(\"; \");\n}\n","// Runtime imports: relative only. See csp.ts.\nimport { buildCsp, type CspOptions } from \"./csp\";\n\nexport interface SecurityHeaderOptions extends CspOptions {\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n}\n\nexport interface HeaderRule {\n  source: string;\n  headers: { key: string; value: string }[];\n}\n\nexport function buildSecurityHeaders(options: SecurityHeaderOptions, env: NodeJS.ProcessEnv): HeaderRule[] {\n  const camera = options.permissionsPolicy?.camera === \"none\" ? \"\" : \"self\";\n\n  return [\n    {\n      // Apply to all routes\n      source: \"/:path*\",\n      headers: [\n        // Content Security Policy - prevents XSS attacks\n        {\n          key: \"Content-Security-Policy\",\n          value: buildCsp(options, env),\n        },\n        // X-Frame-Options - prevents clickjacking (backup for older browsers)\n        {\n          key: \"X-Frame-Options\",\n          value: \"DENY\",\n        },\n        // X-Content-Type-Options - prevents MIME sniffing\n        {\n          key: \"X-Content-Type-Options\",\n          value: \"nosniff\",\n        },\n        // Strict-Transport-Security - enforces HTTPS (1 year, include subdomains).\n        // Omitted under E2E_BUILD for the same reason as upgrade-insecure-requests:\n        // the suite speaks plain http, and an HSTS pin would force https on every\n        // later request to this host from the same browser profile.\n        ...(env.E2E_BUILD === \"true\"\n          ? []\n          : [\n              {\n                key: \"Strict-Transport-Security\",\n                value: \"max-age=31536000; includeSubDomains\",\n              },\n            ]),\n        // Referrer-Policy - controls referrer information\n        {\n          key: \"Referrer-Policy\",\n          value: \"strict-origin-when-cross-origin\",\n        },\n        // Permissions-Policy - restricts browser features\n        {\n          key: \"Permissions-Policy\",\n          value: `camera=(${camera}), microphone=(), geolocation=()`,\n        },\n      ],\n    },\n  ];\n}\n","// Shared next.config for the nja fleet. Apps wrap the result with their own\n// plugins: `withNextIntl(withMDX(createNextConfig({...})))`.\n//\n// next.config.js is loaded at RUNTIME by `next start`, and the production image\n// installs with --prod. This entry may therefore import only Node built-ins at\n// runtime: never next-intl, @next/mdx, serwist or any devDependency. `next` is\n// imported for its types only.\nimport type { NextConfig } from \"next\";\nimport { buildCsp, type CspDirective, type CspService } from \"./csp\";\nimport { buildSecurityHeaders } from \"./headers\";\n\nexport { buildCsp };\nexport type { CspDirective, CspService };\n\nexport interface NjaNextConfigOptions {\n  devOrigins: string[];\n  /** Third-party services the app loads; each adds its own hosts to the CSP. Nothing is allowed by default. */\n  services?: CspService[];\n  /** Extra CSP sources per directive, for hosts no named service covers. */\n  csp?: Partial<Record<CspDirective, string[]>>;\n  env?: Record<string, string>;\n  imageMinimumCacheTTL?: number;\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n  mdx?: boolean;\n  serwist?: boolean;\n  securityHeaders?: boolean;\n  authInterrupts?: boolean;\n  reactCompiler?: boolean;\n  rewrites?: NextConfig[\"rewrites\"];\n  extend?: (config: NextConfig) => NextConfig;\n}\n\ntype RemotePattern = { protocol: \"http\" | \"https\"; hostname: string; port?: string };\n\nfunction parseImageSources(env: NodeJS.ProcessEnv): RemotePattern[] {\n  return env.IMAGE_SOURCES\n    ? env.IMAGE_SOURCES.split(\",\").map((url) => {\n        const { hostname, protocol, port } = new URL(url.trim());\n        return {\n          protocol: protocol.replace(\":\", \"\") as RemotePattern[\"protocol\"],\n          hostname,\n          port: port || undefined,\n        };\n      })\n    : [];\n}\n\nexport function createNextConfig(options: NjaNextConfigOptions): NextConfig {\n  const env = process.env;\n  const reactCompiler = options.reactCompiler === true;\n\n  const config: NextConfig = {\n    // The e2e stack (scripts/e2e.sh) runs a PRODUCTION build of this app while a\n    // `next dev` server may still be running against the same worktree. `next\n    // build` and `next dev` share `.next`, so a build performed underneath a live\n    // dev server clobbers it and that dev server then 404s every route. Giving\n    // the e2e build its own directory keeps the two independent. E2E_BUILD must\n    // be set for `next build` AND for `next start`, or `start` looks in `.next`\n    // and serves someone else's output.\n    ...(env.E2E_BUILD === \"true\" ? { distDir: \".next-e2e\" } : {}),\n    cacheComponents: true,\n    partialPrefetching: true,\n    reactCompiler,\n    experimental: {\n      serverActions: {\n        bodySizeLimit: \"5mb\",\n      },\n      // Required by `unauthorized()` (next/navigation), which ServerSession.checkPermission\n      // calls to deny access. Without this flag the function throws a plain Error instead of\n      // rendering the nearest unauthorized.tsx.\n      authInterrupts: options.authInterrupts ?? true,\n      turbopackGc: true,\n      turbopackLazyDynamicImports: true,\n      ...(reactCompiler ? { turbopackRustReactCompiler: true } : {}),\n    },\n    allowedDevOrigins: options.devOrigins,\n    pageExtensions: options.mdx ? [\"ts\", \"tsx\", \"mdx\"] : [\"ts\", \"tsx\"],\n    images: {\n      minimumCacheTTL: options.imageMinimumCacheTTL ?? 60,\n      remotePatterns: parseImageSources(env),\n      dangerouslyAllowLocalIP: true,\n    },\n    poweredByHeader: false,\n    reactStrictMode: false,\n    env: {\n      NEXT_PUBLIC_API_URL: env.NEXT_PUBLIC_API_URL ?? \"\",\n      NEXT_PUBLIC_ADDRESS: env.NEXT_PUBLIC_ADDRESS ?? \"\",\n      NEXT_PUBLIC_VAPID_PUBLIC_KEY: env.NEXT_PUBLIC_VAPID_PUBLIC_KEY ?? \"\",\n      NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY ?? \"\",\n      ...options.env,\n    },\n    // Inlined replacement for @serwist/turbopack's withSerwist wrapper, which\n    // does nothing but append these two entries. Requiring the package here\n    // instead CRASHES production: it is a devDependency, next.config.js is loaded\n    // at RUNTIME by `next start`, and the web-production image installs with\n    // --prod. Do not re-add a require of any devDependency to this file.\n    ...(options.serwist ? { serverExternalPackages: [\"esbuild\", \"esbuild-wasm\"] } : {}),\n    // Next 16 builds AND serves dev with Turbopack, so this is what pins yjs to a\n    // single instance in both modes.\n    turbopack: {\n      resolveAlias: {\n        yjs: \"./node_modules/yjs\",\n      },\n    },\n  };\n\n  if (options.securityHeaders !== false) {\n    config.headers = async () => buildSecurityHeaders(options, process.env);\n  }\n\n  if (options.rewrites) config.rewrites = options.rewrites;\n\n  return options.extend ? options.extend(config) : config;\n}\n"],"mappings":";;;;;AAwBA,IAAM,kBAA+E;AAAA,EACnF,QAAQ;AAAA,IACN,cAAc,CAAC,uBAAuB;AAAA,IACtC,WAAW,CAAC,sBAAsB;AAAA,IAClC,eAAe,CAAC,wBAAwB;AAAA,IACxC,aAAa,CAAC,yBAAyB,0BAA0B;AAAA,EACnE;AAAA,EACA,YAAY;AAAA,IACV,cAAc,CAAC,6BAA6B;AAAA,IAC5C,WAAW,CAAC,+BAA+B,0BAA0B;AAAA,IACrE,eAAe,CAAC,+BAA+B,+BAA+B;AAAA,EAChF;AAAA,EACA,WAAW;AAAA,IACT,cAAc,CAAC,mCAAmC;AAAA,IAClD,eAAe,CAAC,mCAAmC;AAAA,IACnD,aAAa,CAAC,mCAAmC;AAAA,EACnD;AAAA,EACA,SAAS;AAAA,IACP,WAAW,CAAC,4BAA4B;AAAA,EAC1C;AAAA,EACA,aAAa;AAAA,IACX,aAAa,CAAC,8BAA8B;AAAA,IAC5C,YAAY,CAAC,2BAA2B;AAAA,EAC1C;AACF;AAEA,SAAS,iBAAiB,KAAkC;AAC1D,SAAO,IAAI,gBAAgB,IAAI,cAAc,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;AAClF;AAFS;AAOF,SAAS,SAAS,SAAqB,KAAgC;AAC5E,QAAM,SAAS,IAAI,uBAAuB;AAC1C,QAAM,eAAe,iBAAiB,GAAG;AACzC,QAAM,WAAW,QAAQ,YAAY,CAAC;AAItC,QAAM,kBAA+E;AAAA;AAAA,IAEnF,cAAc,EAAE,MAAM,CAAC,UAAU,mBAAmB,eAAe,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAElF,aAAa,EAAE,MAAM,CAAC,UAAU,iBAAiB,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAEhE,WAAW,EAAE,MAAM,CAAC,UAAU,SAAS,OAAO,GAAG,SAAS,aAAa;AAAA;AAAA,IAEvE,YAAY,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAE5C,eAAe;AAAA,MACb,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,QACP;AAAA;AAAA,QAEA,OAAO,QAAQ,SAAS,IAAI;AAAA,QAC5B,IAAI,uBAAuB;AAAA,QAC3B,GAAG;AAAA,MACL;AAAA,IACF;AAAA;AAAA,IAEA,aAAa,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAE7C,cAAc,EAAE,MAAM,CAAC,UAAU,OAAO,GAAG,SAAS,CAAC,EAAE;AAAA,EACzD;AAEA,QAAM,YAAY,wBAAC,SAA+B;AAChD,UAAM,EAAE,MAAM,QAAQ,IAAI,gBAAgB,IAAI;AAC9C,UAAM,eAAe,SAAS,QAAQ,CAAC,YAAY,gBAAgB,OAAO,EAAE,IAAI,KAAK,CAAC,CAAC;AACvF,UAAM,UAAU,CAAC,GAAG,MAAM,GAAG,cAAc,GAAI,QAAQ,MAAM,IAAI,KAAK,CAAC,GAAI,GAAG,OAAO,EAAE;AAAA,MACrF,CAAC,WAAW,WAAW;AAAA,IACzB;AACA,WAAO,CAAC,MAAM,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG;AAAA,EAC7C,GAPkB;AASlB,SAAO;AAAA,IACL;AAAA,IACA,UAAU,YAAY;AAAA,IACtB,UAAU,WAAW;AAAA,IACrB,UAAU,SAAS;AAAA,IACnB,UAAU,UAAU;AAAA,IACpB,UAAU,aAAa;AAAA,IACvB,UAAU,WAAW;AAAA;AAAA,IAErB;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA,IACA,UAAU,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQtB,IAAI,aAAa,gBAAgB,IAAI,cAAc,SAAS,8BAA8B;AAAA,EAC5F,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AACd;AAtEgB;;;AC7CT,SAAS,qBAAqB,SAAgC,KAAsC;AACzG,QAAM,SAAS,QAAQ,mBAAmB,WAAW,SAAS,KAAK;AAEnE,SAAO;AAAA,IACL;AAAA;AAAA,MAEE,QAAQ;AAAA,MACR,SAAS;AAAA;AAAA,QAEP;AAAA,UACE,KAAK;AAAA,UACL,OAAO,SAAS,SAAS,GAAG;AAAA,QAC9B;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,GAAI,IAAI,cAAc,SAClB,CAAC,IACD;AAAA,UACE;AAAA,YACE,KAAK;AAAA,YACL,OAAO;AAAA,UACT;AAAA,QACF;AAAA;AAAA,QAEJ;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO,WAAW,MAAM;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAhDgB;;;ACsBhB,SAAS,kBAAkB,KAAyC;AAClE,SAAO,IAAI,gBACP,IAAI,cAAc,MAAM,GAAG,EAAE,IAAI,CAAC,QAAQ;AACxC,UAAM,EAAE,UAAU,UAAU,KAAK,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC;AACvD,WAAO;AAAA,MACL,UAAU,SAAS,QAAQ,KAAK,EAAE;AAAA,MAClC;AAAA,MACA,MAAM,QAAQ;AAAA,IAChB;AAAA,EACF,CAAC,IACD,CAAC;AACP;AAXS;AAaF,SAAS,iBAAiB,SAA2C;AAC1E,QAAM,MAAM,QAAQ;AACpB,QAAM,gBAAgB,QAAQ,kBAAkB;AAEhD,QAAM,SAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQzB,GAAI,IAAI,cAAc,SAAS,EAAE,SAAS,YAAY,IAAI,CAAC;AAAA,IAC3D,iBAAiB;AAAA,IACjB,oBAAoB;AAAA,IACpB;AAAA,IACA,cAAc;AAAA,MACZ,eAAe;AAAA,QACb,eAAe;AAAA,MACjB;AAAA;AAAA;AAAA;AAAA,MAIA,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,aAAa;AAAA,MACb,6BAA6B;AAAA,MAC7B,GAAI,gBAAgB,EAAE,4BAA4B,KAAK,IAAI,CAAC;AAAA,IAC9D;AAAA,IACA,mBAAmB,QAAQ;AAAA,IAC3B,gBAAgB,QAAQ,MAAM,CAAC,MAAM,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AAAA,IACjE,QAAQ;AAAA,MACN,iBAAiB,QAAQ,wBAAwB;AAAA,MACjD,gBAAgB,kBAAkB,GAAG;AAAA,MACrC,yBAAyB;AAAA,IAC3B;AAAA,IACA,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,IACjB,KAAK;AAAA,MACH,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,8BAA8B,IAAI,gCAAgC;AAAA,MAClE,iCAAiC,IAAI,mCAAmC;AAAA,MACxE,GAAG,QAAQ;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,GAAI,QAAQ,UAAU,EAAE,wBAAwB,CAAC,WAAW,cAAc,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA,IAGjF,WAAW;AAAA,MACT,cAAc;AAAA,QACZ,KAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAEA,MAAI,QAAQ,oBAAoB,OAAO;AACrC,WAAO,UAAU,YAAY,qBAAqB,SAAS,QAAQ,GAAG;AAAA,EACxE;AAEA,MAAI,QAAQ,SAAU,QAAO,WAAW,QAAQ;AAEhD,SAAO,QAAQ,SAAS,QAAQ,OAAO,MAAM,IAAI;AACnD;AAlEgB;","names":[]}

package/dist/{request-FXF63NSQ.mjs → request-3IUMNVOS.mjs}

@@ -1,8 +1,8 @@
 import {
   serverRequest
-} from "./chunk-SJLXPHK5.mjs";
+} from "./chunk-E2LENTUH.mjs";
 import "./chunk-PAWJFY3S.mjs";
 export {
   serverRequest
 };
-//# sourceMappingURL=request-FXF63NSQ.mjs.map
+//# sourceMappingURL=request-3IUMNVOS.mjs.map

package/dist/request-LZBAOT3Y.js

@@ -0,0 +1,8 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunk6TUB7Y6Tjs = require('./chunk-6TUB7Y6T.js');
+require('./chunk-7QVYU63E.js');
+
+
+exports.serverRequest = _chunk6TUB7Y6Tjs.serverRequest;
+//# sourceMappingURL=request-LZBAOT3Y.js.map

package/dist/request-LZBAOT3Y.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/request-LZBAOT3Y.js"],"names":[],"mappings":"AAAA;AACE;AACF,sDAA4B;AAC5B,+BAA4B;AAC5B;AACE;AACF,uDAAC","file":"/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/request-LZBAOT3Y.js"}

package/dist/server/cachedGet.d.mts

@@ -0,0 +1,28 @@
+import { A as ApiData } from '../ApiData-DPKNfY-9.mjs';
+
+/** Reads the HTTP status from an `HTTP_<status>` digest, or `undefined` when there is none. */
+declare function statusFromDigest(error: unknown): number | undefined;
+
+interface CachedGetParams {
+    url: string;
+    /** A cacheLife profile name, or a tag. */
+    cache: string;
+    language: string;
+    companyId?: string;
+    additionalHeaders?: Record<string, string>;
+}
+/**
+ * Token-free cached GET for shared data.
+ *
+ * The arguments are the cache key, so they never carry a token, a cookie value
+ * or a user id. The request is sent without `Authorization`: an endpoint that
+ * needs a token is per-user and must not set `cache`.
+ *
+ * A non-OK response or an unreachable API throws, so Next does not store the
+ * entry. The status travels in `error.digest` as `HTTP_<status>` (503 when the
+ * API is unreachable), because `digest` is the only property that survives
+ * into production. Read it back with `statusFromDigest`.
+ */
+declare function cachedServerGet(params: CachedGetParams): Promise<ApiData>;
+
+export { type CachedGetParams, cachedServerGet, statusFromDigest };

package/dist/server/cachedGet.d.ts

@@ -0,0 +1,28 @@
+import { A as ApiData } from '../ApiData-DPKNfY-9.js';
+
+/** Reads the HTTP status from an `HTTP_<status>` digest, or `undefined` when there is none. */
+declare function statusFromDigest(error: unknown): number | undefined;
+
+interface CachedGetParams {
+    url: string;
+    /** A cacheLife profile name, or a tag. */
+    cache: string;
+    language: string;
+    companyId?: string;
+    additionalHeaders?: Record<string, string>;
+}
+/**
+ * Token-free cached GET for shared data.
+ *
+ * The arguments are the cache key, so they never carry a token, a cookie value
+ * or a user id. The request is sent without `Authorization`: an endpoint that
+ * needs a token is per-user and must not set `cache`.
+ *
+ * A non-OK response or an unreachable API throws, so Next does not store the
+ * entry. The status travels in `error.digest` as `HTTP_<status>` (503 when the
+ * API is unreachable), because `digest` is the only property that survives
+ * into production. Read it back with `statusFromDigest`.
+ */
+declare function cachedServerGet(params: CachedGetParams): Promise<ApiData>;
+
+export { type CachedGetParams, cachedServerGet, statusFromDigest };

package/dist/server/cachedGet.js

@@ -0,0 +1,60 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunkOEOK6A3Pjs = require('../chunk-OEOK6A3P.js');
+
+
+var _chunkIK65TDQHjs = require('../chunk-IK65TDQH.js');
+
+
+var _chunk7QVYU63Ejs = require('../chunk-7QVYU63E.js');
+
+// src/server/cachedGet.ts
+var _cache = require('next/cache');
+function httpError(status, statusText) {
+  return Object.assign(new Error(statusText), { status, digest: `HTTP_${status}` });
+}
+_chunk7QVYU63Ejs.__name.call(void 0, httpError, "httpError");
+async function cachedServerGet(params) {
+  "use cache";
+  if (_chunkIK65TDQHjs.CACHE_PROFILES.includes(params.cache)) {
+    _cache.cacheLife.call(void 0, params.cache);
+  } else {
+    _cache.cacheTag.call(void 0, params.cache);
+    _cache.cacheLife.call(void 0, "max");
+  }
+  const headers = {
+    Accept: "application/json",
+    ...params.additionalHeaders,
+    "x-language": params.language
+  };
+  if (params.companyId) {
+    headers["x-companyid"] = params.companyId;
+  }
+  let apiResponse;
+  try {
+    apiResponse = await fetch(params.url, { method: "GET", headers });
+  } catch (e) {
+    throw httpError(503, "Service Unavailable");
+  }
+  if (!apiResponse.ok) {
+    throw httpError(apiResponse.status, apiResponse.statusText);
+  }
+  let data;
+  try {
+    data = await apiResponse.json();
+  } catch (e2) {
+    data = void 0;
+  }
+  return {
+    data,
+    ok: apiResponse.ok,
+    status: apiResponse.status,
+    statusText: apiResponse.statusText
+  };
+}
+_chunk7QVYU63Ejs.__name.call(void 0, cachedServerGet, "cachedServerGet");
+
+
+
+exports.cachedServerGet = cachedServerGet; exports.statusFromDigest = _chunkOEOK6A3Pjs.statusFromDigest;
+//# sourceMappingURL=cachedGet.js.map

package/dist/server/cachedGet.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/server/cachedGet.js","../../src/server/cachedGet.ts"],"names":[],"mappings":"AAAA;AACE;AACF,uDAA6B;AAC7B;AACE;AACF,uDAA6B;AAC7B;AACE;AACF,uDAA6B;AAC7B;AACA;ACLA,mCAAoC;AAepC,SAAS,SAAA,CAAU,MAAA,EAAgB,UAAA,EAA2B;AAC5D,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,IAAI,KAAA,CAAM,UAAU,CAAA,EAAG,EAAE,MAAA,EAAQ,MAAA,EAAQ,CAAA,KAAA,EAAQ,MAAM,CAAA,EAAA;AAC9E;AAFS;AAgBwE;AAC/E,EAAA;AAE2D,EAAA;AACnB,IAAA;AACjC,EAAA;AACgB,IAAA;AACN,IAAA;AACjB,EAAA;AAEwC,EAAA;AAC9B,IAAA;AACE,IAAA;AACW,IAAA;AACvB,EAAA;AACsB,EAAA;AACY,IAAA;AAClC,EAAA;AAEI,EAAA;AACA,EAAA;AAC8D,IAAA;AAC1D,EAAA;AACoC,IAAA;AAC5C,EAAA;AAEqB,EAAA;AACuC,IAAA;AAC5D,EAAA;AAEI,EAAA;AACA,EAAA;AAC4B,IAAA;AACxB,EAAA;AACC,IAAA;AACT,EAAA;AAEO,EAAA;AACL,IAAA;AACgB,IAAA;AACI,IAAA;AACI,IAAA;AAC1B,EAAA;AACF;AA3CsB;ADmByD;AACA;AACA;AACA","file":"/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/server/cachedGet.js","sourcesContent":[null,"// Server-only utilities (NOT server actions - these cannot be called from client components)\n//\n// Reached through `@carlonicora/nextjs-jsonapi/cached-get` under the `react-server`\n// condition only; every other bundle gets `cachedGet.stub.ts` (see package.json).\n\nimport { cacheLife, cacheTag } from \"next/cache\";\nimport { ApiData } from \"../core/interfaces/ApiData\";\nimport { CACHE_PROFILES, CacheProfile } from \"./cacheProfiles\";\n\nexport { statusFromDigest } from \"./cacheDigest\";\n\nexport interface CachedGetParams {\n  url: string;\n  /** A cacheLife profile name, or a tag. */\n  cache: string;\n  language: string;\n  companyId?: string;\n  additionalHeaders?: Record<string, string>;\n}\n\nfunction httpError(status: number, statusText: string): Error {\n  return Object.assign(new Error(statusText), { status, digest: `HTTP_${status}` });\n}\n\n/**\n * Token-free cached GET for shared data.\n *\n * The arguments are the cache key, so they never carry a token, a cookie value\n * or a user id. The request is sent without `Authorization`: an endpoint that\n * needs a token is per-user and must not set `cache`.\n *\n * A non-OK response or an unreachable API throws, so Next does not store the\n * entry. The status travels in `error.digest` as `HTTP_<status>` (503 when the\n * API is unreachable), because `digest` is the only property that survives\n * into production. Read it back with `statusFromDigest`.\n */\nexport async function cachedServerGet(params: CachedGetParams): Promise<ApiData> {\n  \"use cache\";\n\n  if (CACHE_PROFILES.includes(params.cache as CacheProfile)) {\n    cacheLife(params.cache as CacheProfile);\n  } else {\n    cacheTag(params.cache);\n    cacheLife(\"max\");\n  }\n\n  const headers: Record<string, string> = {\n    Accept: \"application/json\",\n    ...params.additionalHeaders,\n    \"x-language\": params.language,\n  };\n  if (params.companyId) {\n    headers[\"x-companyid\"] = params.companyId;\n  }\n\n  let apiResponse: Response;\n  try {\n    apiResponse = await fetch(params.url, { method: \"GET\", headers });\n  } catch {\n    throw httpError(503, \"Service Unavailable\");\n  }\n\n  if (!apiResponse.ok) {\n    throw httpError(apiResponse.status, apiResponse.statusText);\n  }\n\n  let data: any;\n  try {\n    data = await apiResponse.json();\n  } catch {\n    data = undefined;\n  }\n\n  return {\n    data,\n    ok: apiResponse.ok,\n    status: apiResponse.status,\n    statusText: apiResponse.statusText,\n  };\n}\n"]}

package/dist/server/cachedGet.mjs

@@ -0,0 +1,60 @@
+import {
+  statusFromDigest
+} from "../chunk-EBEXWN3I.mjs";
+import {
+  CACHE_PROFILES
+} from "../chunk-T7SAW3UW.mjs";
+import {
+  __name
+} from "../chunk-PAWJFY3S.mjs";
+
+// src/server/cachedGet.ts
+import { cacheLife, cacheTag } from "next/cache";
+function httpError(status, statusText) {
+  return Object.assign(new Error(statusText), { status, digest: `HTTP_${status}` });
+}
+__name(httpError, "httpError");
+async function cachedServerGet(params) {
+  "use cache";
+  if (CACHE_PROFILES.includes(params.cache)) {
+    cacheLife(params.cache);
+  } else {
+    cacheTag(params.cache);
+    cacheLife("max");
+  }
+  const headers = {
+    Accept: "application/json",
+    ...params.additionalHeaders,
+    "x-language": params.language
+  };
+  if (params.companyId) {
+    headers["x-companyid"] = params.companyId;
+  }
+  let apiResponse;
+  try {
+    apiResponse = await fetch(params.url, { method: "GET", headers });
+  } catch {
+    throw httpError(503, "Service Unavailable");
+  }
+  if (!apiResponse.ok) {
+    throw httpError(apiResponse.status, apiResponse.statusText);
+  }
+  let data;
+  try {
+    data = await apiResponse.json();
+  } catch {
+    data = void 0;
+  }
+  return {
+    data,
+    ok: apiResponse.ok,
+    status: apiResponse.status,
+    statusText: apiResponse.statusText
+  };
+}
+__name(cachedServerGet, "cachedServerGet");
+export {
+  cachedServerGet,
+  statusFromDigest
+};
+//# sourceMappingURL=cachedGet.mjs.map

package/dist/server/cachedGet.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/server/cachedGet.ts"],"sourcesContent":["// Server-only utilities (NOT server actions - these cannot be called from client components)\n//\n// Reached through `@carlonicora/nextjs-jsonapi/cached-get` under the `react-server`\n// condition only; every other bundle gets `cachedGet.stub.ts` (see package.json).\n\nimport { cacheLife, cacheTag } from \"next/cache\";\nimport { ApiData } from \"../core/interfaces/ApiData\";\nimport { CACHE_PROFILES, CacheProfile } from \"./cacheProfiles\";\n\nexport { statusFromDigest } from \"./cacheDigest\";\n\nexport interface CachedGetParams {\n  url: string;\n  /** A cacheLife profile name, or a tag. */\n  cache: string;\n  language: string;\n  companyId?: string;\n  additionalHeaders?: Record<string, string>;\n}\n\nfunction httpError(status: number, statusText: string): Error {\n  return Object.assign(new Error(statusText), { status, digest: `HTTP_${status}` });\n}\n\n/**\n * Token-free cached GET for shared data.\n *\n * The arguments are the cache key, so they never carry a token, a cookie value\n * or a user id. The request is sent without `Authorization`: an endpoint that\n * needs a token is per-user and must not set `cache`.\n *\n * A non-OK response or an unreachable API throws, so Next does not store the\n * entry. The status travels in `error.digest` as `HTTP_<status>` (503 when the\n * API is unreachable), because `digest` is the only property that survives\n * into production. Read it back with `statusFromDigest`.\n */\nexport async function cachedServerGet(params: CachedGetParams): Promise<ApiData> {\n  \"use cache\";\n\n  if (CACHE_PROFILES.includes(params.cache as CacheProfile)) {\n    cacheLife(params.cache as CacheProfile);\n  } else {\n    cacheTag(params.cache);\n    cacheLife(\"max\");\n  }\n\n  const headers: Record<string, string> = {\n    Accept: \"application/json\",\n    ...params.additionalHeaders,\n    \"x-language\": params.language,\n  };\n  if (params.companyId) {\n    headers[\"x-companyid\"] = params.companyId;\n  }\n\n  let apiResponse: Response;\n  try {\n    apiResponse = await fetch(params.url, { method: \"GET\", headers });\n  } catch {\n    throw httpError(503, \"Service Unavailable\");\n  }\n\n  if (!apiResponse.ok) {\n    throw httpError(apiResponse.status, apiResponse.statusText);\n  }\n\n  let data: any;\n  try {\n    data = await apiResponse.json();\n  } catch {\n    data = undefined;\n  }\n\n  return {\n    data,\n    ok: apiResponse.ok,\n    status: apiResponse.status,\n    statusText: apiResponse.statusText,\n  };\n}\n"],"mappings":";;;;;;;;;;;AAKA,SAAS,WAAW,gBAAgB;AAepC,SAAS,UAAU,QAAgB,YAA2B;AAC5D,SAAO,OAAO,OAAO,IAAI,MAAM,UAAU,GAAG,EAAE,QAAQ,QAAQ,QAAQ,MAAM,GAAG,CAAC;AAClF;AAFS;AAgBT,eAAsB,gBAAgB,QAA2C;AAC/E;AAEA,MAAI,eAAe,SAAS,OAAO,KAAqB,GAAG;AACzD,cAAU,OAAO,KAAqB;AAAA,EACxC,OAAO;AACL,aAAS,OAAO,KAAK;AACrB,cAAU,KAAK;AAAA,EACjB;AAEA,QAAM,UAAkC;AAAA,IACtC,QAAQ;AAAA,IACR,GAAG,OAAO;AAAA,IACV,cAAc,OAAO;AAAA,EACvB;AACA,MAAI,OAAO,WAAW;AACpB,YAAQ,aAAa,IAAI,OAAO;AAAA,EAClC;AAEA,MAAI;AACJ,MAAI;AACF,kBAAc,MAAM,MAAM,OAAO,KAAK,EAAE,QAAQ,OAAO,QAAQ,CAAC;AAAA,EAClE,QAAQ;AACN,UAAM,UAAU,KAAK,qBAAqB;AAAA,EAC5C;AAEA,MAAI,CAAC,YAAY,IAAI;AACnB,UAAM,UAAU,YAAY,QAAQ,YAAY,UAAU;AAAA,EAC5D;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,YAAY,KAAK;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA,IAAI,YAAY;AAAA,IAChB,QAAQ,YAAY;AAAA,IACpB,YAAY,YAAY;AAAA,EAC1B;AACF;AA3CsB;","names":[]}

package/dist/server/cachedGet.stub.d.mts

@@ -0,0 +1,7 @@
+import { A as ApiData } from '../ApiData-DPKNfY-9.mjs';
+import { CachedGetParams } from './cachedGet.mjs';
+export { statusFromDigest } from './cachedGet.mjs';
+
+declare function cachedServerGet(_params: CachedGetParams): Promise<ApiData>;
+
+export { CachedGetParams, cachedServerGet };

package/dist/server/cachedGet.stub.d.ts

@@ -0,0 +1,7 @@
+import { A as ApiData } from '../ApiData-DPKNfY-9.js';
+import { CachedGetParams } from './cachedGet.js';
+export { statusFromDigest } from './cachedGet.js';
+
+declare function cachedServerGet(_params: CachedGetParams): Promise<ApiData>;
+
+export { CachedGetParams, cachedServerGet };

package/dist/server/cachedGet.stub.js

@@ -0,0 +1,17 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunkOEOK6A3Pjs = require('../chunk-OEOK6A3P.js');
+
+
+var _chunk7QVYU63Ejs = require('../chunk-7QVYU63E.js');
+
+// src/server/cachedGet.stub.ts
+async function cachedServerGet(_params) {
+  throw new Error("cachedServerGet is server-only: it was resolved outside the react-server condition");
+}
+_chunk7QVYU63Ejs.__name.call(void 0, cachedServerGet, "cachedServerGet");
+
+
+
+exports.cachedServerGet = cachedServerGet; exports.statusFromDigest = _chunkOEOK6A3Pjs.statusFromDigest;
+//# sourceMappingURL=cachedGet.stub.js.map

package/dist/server/cachedGet.stub.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/server/cachedGet.stub.js","../../src/server/cachedGet.stub.ts"],"names":[],"mappings":"AAAA;AACE;AACF,uDAA6B;AAC7B;AACE;AACF,uDAA6B;AAC7B;AACA;ACKA,MAAA,SAAsB,eAAA,CAAgB,OAAA,EAA4C;AAChF,EAAA,MAAM,IAAI,KAAA,CAAM,oFAAoF,CAAA;AACtG;AAFsB,qCAAA,eAAA,EAAA,iBAAA,CAAA;ADAtB;AACE;AACA;AACF,wGAAC","file":"/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/server/cachedGet.stub.js","sourcesContent":[null,"// What `@carlonicora/nextjs-jsonapi/cached-get` resolves to outside the `react-server`\n// condition (client components, their SSR pass). The shared request code reaches\n// `serverRequest` from client hooks too, and Next rejects `\"use cache\"` and\n// `cacheLife`/`cacheTag` in those bundles. Nothing there calls the cached path: it\n// only runs on the server, where the real `cachedGet.ts` is resolved instead.\n\nimport type { ApiData } from \"../core/interfaces/ApiData\";\nimport type { CachedGetParams } from \"./cachedGet\";\n\nexport { statusFromDigest } from \"./cacheDigest\";\nexport type { CachedGetParams } from \"./cachedGet\";\n\nexport async function cachedServerGet(_params: CachedGetParams): Promise<ApiData> {\n  throw new Error(\"cachedServerGet is server-only: it was resolved outside the react-server condition\");\n}\n"]}

package/dist/server/cachedGet.stub.mjs

@@ -0,0 +1,17 @@
+import {
+  statusFromDigest
+} from "../chunk-EBEXWN3I.mjs";
+import {
+  __name
+} from "../chunk-PAWJFY3S.mjs";
+
+// src/server/cachedGet.stub.ts
+async function cachedServerGet(_params) {
+  throw new Error("cachedServerGet is server-only: it was resolved outside the react-server condition");
+}
+__name(cachedServerGet, "cachedServerGet");
+export {
+  cachedServerGet,
+  statusFromDigest
+};
+//# sourceMappingURL=cachedGet.stub.mjs.map

package/dist/server/cachedGet.stub.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/server/cachedGet.stub.ts"],"sourcesContent":["// What `@carlonicora/nextjs-jsonapi/cached-get` resolves to outside the `react-server`\n// condition (client components, their SSR pass). The shared request code reaches\n// `serverRequest` from client hooks too, and Next rejects `\"use cache\"` and\n// `cacheLife`/`cacheTag` in those bundles. Nothing there calls the cached path: it\n// only runs on the server, where the real `cachedGet.ts` is resolved instead.\n\nimport type { ApiData } from \"../core/interfaces/ApiData\";\nimport type { CachedGetParams } from \"./cachedGet\";\n\nexport { statusFromDigest } from \"./cacheDigest\";\nexport type { CachedGetParams } from \"./cachedGet\";\n\nexport async function cachedServerGet(_params: CachedGetParams): Promise<ApiData> {\n  throw new Error(\"cachedServerGet is server-only: it was resolved outside the react-server condition\");\n}\n"],"mappings":";;;;;;;;AAYA,eAAsB,gBAAgB,SAA4C;AAChF,QAAM,IAAI,MAAM,oFAAoF;AACtG;AAFsB;","names":[]}