@fewchurs/next 1.0.1 → 1.1.0

package/README.md

@@ -26,9 +26,14 @@ export default function Page() {
 }
 ```
 
+Add your domain to your app in the Fewchurs dashboard. The API key only works there, and
+`localhost` always works while you build. The package reads the domain from each request. Set
+`FEWCHURS_APP_ID=yourcompany.com` when your site runs on another address, such as a preview
+deployment.
+
 - `<FewchursBoard initialFeatureId="…">` — opens the board on one request, rendered on the
   server, for a link straight to it.
-- `createHandler({ apiKey, baseUrl, apiPath, deviceId })` — the proxy, mounted wherever you like.
+- `createHandler({ apiKey, baseUrl, appId, apiPath, deviceId })` — the proxy, mounted wherever you like.
 - `@fewchurs/next/actions` — `submitFeatureAction`, `voteAction`, `commentAction`, `followAction`
   for boards built from plain forms.
 - `@fewchurs/next/identity` — the `httpOnly` device-id cookie helpers.

package/dist/actions.js

@@ -33,6 +33,7 @@ var import_core3 = require("@fewchurs/react/core");
 
 // src/config.ts
 var import_server_only = require("server-only");
+var import_headers = require("next/headers");
 var import_core = require("@fewchurs/react/core");
 function resolveApiKey(apiKey) {
   return apiKey ?? process.env.FEWCHURS_API_KEY;
@@ -40,7 +41,20 @@ function resolveApiKey(apiKey) {
 function resolveBaseUrl(baseUrl) {
   return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? import_core.DEFAULT_BASE_URL;
 }
-function serverClient(deviceId, config = {}) {
+function configuredAppId(appId) {
+  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || void 0;
+}
+function requestHostname(requestHeaders) {
+  const forwarded = requestHeaders.get("x-forwarded-host")?.split(",")[0]?.trim();
+  const host = forwarded || requestHeaders.get("host")?.trim();
+  if (!host) return void 0;
+  try {
+    return new URL(`http://${host}`).hostname;
+  } catch {
+    return void 0;
+  }
+}
+async function serverClient(deviceId, config = {}) {
   const apiKey = resolveApiKey(config.apiKey);
   if (!apiKey) {
     throw new Error(
@@ -51,17 +65,19 @@ function serverClient(deviceId, config = {}) {
     apiKey,
     baseUrl: resolveBaseUrl(config.baseUrl),
     deviceId,
-    language: config.language
+    language: config.language,
+    // Only read the request when needed, so a page with a set domain can still render statically.
+    appId: configuredAppId(config.appId) ?? requestHostname(await (0, import_headers.headers)())
   });
 }
 
 // src/identity.ts
 var import_server_only2 = require("server-only");
-var import_headers = require("next/headers");
+var import_headers2 = require("next/headers");
 var import_core2 = require("@fewchurs/react/core");
 
 // src/version.ts
-var SDK_VERSION = "1.0.1";
+var SDK_VERSION = "1.1.0";
 
 // src/constants.ts
 var DEVICE_ID_COOKIE = "fewchurs_did";
@@ -70,7 +86,7 @@ var SDK_HEADER = `next/${SDK_VERSION}`;
 
 // src/identity.ts
 async function readDeviceId() {
-  const store = await (0, import_headers.cookies)();
+  const store = await (0, import_headers2.cookies)();
   return store.get(DEVICE_ID_COOKIE)?.value ?? null;
 }
 async function resolveDeviceId(custom) {
@@ -80,7 +96,7 @@ async function resolveDeviceId(custom) {
 
 // src/actions.ts
 async function submitFeatureAction(formData) {
-  const client = serverClient(await resolveDeviceId());
+  const client = await serverClient(await resolveDeviceId());
   const result = await client.submitFeature({
     title: String(formData.get("title") ?? ""),
     description: String(formData.get("description") ?? ""),
@@ -92,13 +108,13 @@ async function submitFeatureAction(formData) {
 async function voteAction(formData) {
   const featureId = String(formData.get("featureId") ?? "");
   const hasVoted = formData.get("hasVoted") === "true";
-  const client = serverClient(await resolveDeviceId());
+  const client = await serverClient(await resolveDeviceId());
   const result = hasVoted ? await client.unvote(featureId) : await client.vote(featureId);
   revalidate(formData);
   return result.ok ? { ok: true } : { ok: false, message: (0, import_core3.userMessage)(result.error) };
 }
 async function commentAction(formData) {
-  const client = serverClient(await resolveDeviceId());
+  const client = await serverClient(await resolveDeviceId());
   const result = await client.createComment({
     featureId: String(formData.get("featureId") ?? ""),
     text: String(formData.get("text") ?? ""),
@@ -110,7 +126,7 @@ async function commentAction(formData) {
 async function followAction(formData) {
   const featureId = String(formData.get("featureId") ?? "");
   const email = optional(formData.get("email"));
-  const client = serverClient(await resolveDeviceId());
+  const client = await serverClient(await resolveDeviceId());
   const result = email ? await client.follow(featureId, email) : await client.unfollow(featureId);
   revalidate(formData);
   return result.ok ? { ok: true } : { ok: false, message: (0, import_core3.userMessage)(result.error) };

package/dist/actions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/actions.ts","../src/config.ts","../src/identity.ts","../src/version.ts","../src/constants.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { userMessage } from \"@fewchurs/react/core\";\nimport { serverClient } from \"./config\";\nimport { resolveDeviceId } from \"./identity\";\n\nexport interface ActionResult {\n  ok: boolean;\n  message?: string;\n}\n\n/**\n * Server actions for boards built with plain forms — the client board talks to the route\n * handler instead. Pass `path` when the page should re-render with the new data.\n */\nexport async function submitFeatureAction(formData: FormData): Promise<ActionResult> {\n  const client = serverClient(await resolveDeviceId());\n  const result = await client.submitFeature({\n    title: String(formData.get(\"title\") ?? \"\"),\n    description: String(formData.get(\"description\") ?? \"\"),\n    email: optional(formData.get(\"email\")),\n  });\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function voteAction(formData: FormData): Promise<ActionResult> {\n  const featureId = String(formData.get(\"featureId\") ?? \"\");\n  const hasVoted = formData.get(\"hasVoted\") === \"true\";\n  const client = serverClient(await resolveDeviceId());\n  const result = hasVoted ? await client.unvote(featureId) : await client.vote(featureId);\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function commentAction(formData: FormData): Promise<ActionResult> {\n  const client = serverClient(await resolveDeviceId());\n  const result = await client.createComment({\n    featureId: String(formData.get(\"featureId\") ?? \"\"),\n    text: String(formData.get(\"text\") ?? \"\"),\n    authorName: optional(formData.get(\"authorName\")),\n  });\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function followAction(formData: FormData): Promise<ActionResult> {\n  const featureId = String(formData.get(\"featureId\") ?? \"\");\n  const email = optional(formData.get(\"email\"));\n  const client = serverClient(await resolveDeviceId());\n  const result = email ? await client.follow(featureId, email) : await client.unfollow(featureId);\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nfunction optional(value: FormDataEntryValue | null): string | undefined {\n  const text = typeof value === \"string\" ? value.trim() : \"\";\n  return text.length > 0 ? text : undefined;\n}\n\nfunction revalidate(formData: FormData): void {\n  const path = formData.get(\"path\");\n  if (typeof path === \"string\" && path.startsWith(\"/\")) revalidatePath(path);\n}\n","import \"server-only\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\nexport function serverClient(deviceId: string | null, config: ServerConfig = {}): FewchursClient {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n  });\n}\n","import \"server-only\";\nimport { cookies } from \"next/headers\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE } from \"./constants\";\n\nexport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE };\n\nexport type DeviceIdResolver = () => string | Promise<string>;\n\n/** The visitor's id, or null when nothing has been stored for them yet. */\nexport async function readDeviceId(): Promise<string | null> {\n  const store = await cookies();\n  return store.get(DEVICE_ID_COOKIE)?.value ?? null;\n}\n\n/**\n * Reads the cookie, falling back to a fresh id. The value is not persisted here: a server\n * component cannot set cookies, so the route handler stores it on the first request instead.\n */\nexport async function resolveDeviceId(custom?: DeviceIdResolver): Promise<string> {\n  if (custom) return custom();\n  return (await readDeviceId()) ?? createDeviceId();\n}\n\nexport function deviceIdCookie(deviceId: string): {\n  name: string;\n  value: string;\n  options: {\n    httpOnly: true;\n    sameSite: \"lax\";\n    path: string;\n    maxAge: number;\n    secure: boolean;\n  };\n} {\n  return {\n    name: DEVICE_ID_COOKIE,\n    value: deviceId,\n    options: {\n      httpOnly: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: DEVICE_ID_MAX_AGE,\n      secure: process.env.NODE_ENV === \"production\",\n    },\n  };\n}\n\nexport { createDeviceId };\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.0.1\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,mBAA+B;AAC/B,IAAAA,eAA4B;;;ACH5B,yBAAO;AACP,kBAA4E;AAUrE,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAMO,SAAS,aAAa,UAAyB,SAAuB,CAAC,GAAmB;AAC/F,QAAM,SAAS,cAAc,OAAO,MAAM;AAC1C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,aAAO,kCAAqB;AAAA,IAC1B;AAAA,IACA,SAAS,eAAe,OAAO,OAAO;AAAA,IACtC;AAAA,IACA,UAAU,OAAO;AAAA,EACnB,CAAC;AACH;;;ACrCA,IAAAC,sBAAO;AACP,qBAAwB;AACxB,IAAAC,eAA+B;;;ACDxB,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AFK7C,eAAsB,eAAuC;AAC3D,QAAM,QAAQ,UAAM,wBAAQ;AAC5B,SAAO,MAAM,IAAI,gBAAgB,GAAG,SAAS;AAC/C;AAMA,eAAsB,gBAAgB,QAA4C;AAChF,MAAI,OAAQ,QAAO,OAAO;AAC1B,SAAQ,MAAM,aAAa,SAAM,6BAAe;AAClD;;;AFNA,eAAsB,oBAAoB,UAA2C;AACnF,QAAM,SAAS,aAAa,MAAM,gBAAgB,CAAC;AACnD,QAAM,SAAS,MAAM,OAAO,cAAc;AAAA,IACxC,OAAO,OAAO,SAAS,IAAI,OAAO,KAAK,EAAE;AAAA,IACzC,aAAa,OAAO,SAAS,IAAI,aAAa,KAAK,EAAE;AAAA,IACrD,OAAO,SAAS,SAAS,IAAI,OAAO,CAAC;AAAA,EACvC,CAAC;AAED,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,aAAS,0BAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,WAAW,UAA2C;AAC1E,QAAM,YAAY,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AACxD,QAAM,WAAW,SAAS,IAAI,UAAU,MAAM;AAC9C,QAAM,SAAS,aAAa,MAAM,gBAAgB,CAAC;AACnD,QAAM,SAAS,WAAW,MAAM,OAAO,OAAO,SAAS,IAAI,MAAM,OAAO,KAAK,SAAS;AAEtF,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,aAAS,0BAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,cAAc,UAA2C;AAC7E,QAAM,SAAS,aAAa,MAAM,gBAAgB,CAAC;AACnD,QAAM,SAAS,MAAM,OAAO,cAAc;AAAA,IACxC,WAAW,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AAAA,IACjD,MAAM,OAAO,SAAS,IAAI,MAAM,KAAK,EAAE;AAAA,IACvC,YAAY,SAAS,SAAS,IAAI,YAAY,CAAC;AAAA,EACjD,CAAC;AAED,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,aAAS,0BAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,aAAa,UAA2C;AAC5E,QAAM,YAAY,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AACxD,QAAM,QAAQ,SAAS,SAAS,IAAI,OAAO,CAAC;AAC5C,QAAM,SAAS,aAAa,MAAM,gBAAgB,CAAC;AACnD,QAAM,SAAS,QAAQ,MAAM,OAAO,OAAO,WAAW,KAAK,IAAI,MAAM,OAAO,SAAS,SAAS;AAE9F,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,aAAS,0BAAY,OAAO,KAAK,EAAE;AACpF;AAEA,SAAS,SAAS,OAAsD;AACtE,QAAM,OAAO,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACxD,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AAEA,SAAS,WAAW,UAA0B;AAC5C,QAAM,OAAO,SAAS,IAAI,MAAM;AAChC,MAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG,EAAG,kCAAe,IAAI;AAC3E;","names":["import_core","import_server_only","import_core"]}
+{"version":3,"sources":["../src/actions.ts","../src/config.ts","../src/identity.ts","../src/version.ts","../src/constants.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { userMessage } from \"@fewchurs/react/core\";\nimport { serverClient } from \"./config\";\nimport { resolveDeviceId } from \"./identity\";\n\nexport interface ActionResult {\n  ok: boolean;\n  message?: string;\n}\n\n/**\n * Server actions for boards built with plain forms — the client board talks to the route\n * handler instead. Pass `path` when the page should re-render with the new data.\n */\nexport async function submitFeatureAction(formData: FormData): Promise<ActionResult> {\n  const client = await serverClient(await resolveDeviceId());\n  const result = await client.submitFeature({\n    title: String(formData.get(\"title\") ?? \"\"),\n    description: String(formData.get(\"description\") ?? \"\"),\n    email: optional(formData.get(\"email\")),\n  });\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function voteAction(formData: FormData): Promise<ActionResult> {\n  const featureId = String(formData.get(\"featureId\") ?? \"\");\n  const hasVoted = formData.get(\"hasVoted\") === \"true\";\n  const client = await serverClient(await resolveDeviceId());\n  const result = hasVoted ? await client.unvote(featureId) : await client.vote(featureId);\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function commentAction(formData: FormData): Promise<ActionResult> {\n  const client = await serverClient(await resolveDeviceId());\n  const result = await client.createComment({\n    featureId: String(formData.get(\"featureId\") ?? \"\"),\n    text: String(formData.get(\"text\") ?? \"\"),\n    authorName: optional(formData.get(\"authorName\")),\n  });\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function followAction(formData: FormData): Promise<ActionResult> {\n  const featureId = String(formData.get(\"featureId\") ?? \"\");\n  const email = optional(formData.get(\"email\"));\n  const client = await serverClient(await resolveDeviceId());\n  const result = email ? await client.follow(featureId, email) : await client.unfollow(featureId);\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nfunction optional(value: FormDataEntryValue | null): string | undefined {\n  const text = typeof value === \"string\" ? value.trim() : \"\";\n  return text.length > 0 ? text : undefined;\n}\n\nfunction revalidate(formData: FormData): void {\n  const path = formData.get(\"path\");\n  if (typeof path === \"string\" && path.startsWith(\"/\")) revalidatePath(path);\n}\n","import \"server-only\";\nimport { headers } from \"next/headers\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\n/** A domain set by the developer, which replaces the one read from the request. */\nexport function configuredAppId(appId?: string): string | undefined {\n  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || undefined;\n}\n\n/** The site's host name without a port. A reverse proxy reports the public one in `x-forwarded-host`. */\nexport function requestHostname(requestHeaders: Headers): string | undefined {\n  const forwarded = requestHeaders.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  const host = forwarded || requestHeaders.get(\"host\")?.trim();\n  if (!host) return undefined;\n  try {\n    return new URL(`http://${host}`).hostname;\n  } catch {\n    return undefined;\n  }\n}\n\nexport async function serverClient(\n  deviceId: string | null,\n  config: ServerConfig = {},\n): Promise<FewchursClient> {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n    // Only read the request when needed, so a page with a set domain can still render statically.\n    appId: configuredAppId(config.appId) ?? requestHostname(await headers()),\n  });\n}\n","import \"server-only\";\nimport { cookies } from \"next/headers\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE } from \"./constants\";\n\nexport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE };\n\nexport type DeviceIdResolver = () => string | Promise<string>;\n\n/** The visitor's id, or null when nothing has been stored for them yet. */\nexport async function readDeviceId(): Promise<string | null> {\n  const store = await cookies();\n  return store.get(DEVICE_ID_COOKIE)?.value ?? null;\n}\n\n/**\n * Reads the cookie, falling back to a fresh id. The value is not persisted here: a server\n * component cannot set cookies, so the route handler stores it on the first request instead.\n */\nexport async function resolveDeviceId(custom?: DeviceIdResolver): Promise<string> {\n  if (custom) return custom();\n  return (await readDeviceId()) ?? createDeviceId();\n}\n\nexport function deviceIdCookie(deviceId: string): {\n  name: string;\n  value: string;\n  options: {\n    httpOnly: true;\n    sameSite: \"lax\";\n    path: string;\n    maxAge: number;\n    secure: boolean;\n  };\n} {\n  return {\n    name: DEVICE_ID_COOKIE,\n    value: deviceId,\n    options: {\n      httpOnly: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: DEVICE_ID_MAX_AGE,\n      secure: process.env.NODE_ENV === \"production\",\n    },\n  };\n}\n\nexport { createDeviceId };\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.1.0\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,mBAA+B;AAC/B,IAAAA,eAA4B;;;ACH5B,yBAAO;AACP,qBAAwB;AACxB,kBAA4E;AAYrE,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAOO,SAAS,gBAAgB,OAAoC;AAClE,SAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,KAAK,KAAK;AACjE;AAGO,SAAS,gBAAgB,gBAA6C;AAC3E,QAAM,YAAY,eAAe,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAC9E,QAAM,OAAO,aAAa,eAAe,IAAI,MAAM,GAAG,KAAK;AAC3D,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,IAAI,EAAE,EAAE;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,aACpB,UACA,SAAuB,CAAC,GACC;AACzB,QAAM,SAAS,cAAc,OAAO,MAAM;AAC1C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,aAAO,kCAAqB;AAAA,IAC1B;AAAA,IACA,SAAS,eAAe,OAAO,OAAO;AAAA,IACtC;AAAA,IACA,UAAU,OAAO;AAAA;AAAA,IAEjB,OAAO,gBAAgB,OAAO,KAAK,KAAK,gBAAgB,UAAM,wBAAQ,CAAC;AAAA,EACzE,CAAC;AACH;;;AC9DA,IAAAC,sBAAO;AACP,IAAAC,kBAAwB;AACxB,IAAAC,eAA+B;;;ACDxB,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AFK7C,eAAsB,eAAuC;AAC3D,QAAM,QAAQ,UAAM,yBAAQ;AAC5B,SAAO,MAAM,IAAI,gBAAgB,GAAG,SAAS;AAC/C;AAMA,eAAsB,gBAAgB,QAA4C;AAChF,MAAI,OAAQ,QAAO,OAAO;AAC1B,SAAQ,MAAM,aAAa,SAAM,6BAAe;AAClD;;;AFNA,eAAsB,oBAAoB,UAA2C;AACnF,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,MAAM,OAAO,cAAc;AAAA,IACxC,OAAO,OAAO,SAAS,IAAI,OAAO,KAAK,EAAE;AAAA,IACzC,aAAa,OAAO,SAAS,IAAI,aAAa,KAAK,EAAE;AAAA,IACrD,OAAO,SAAS,SAAS,IAAI,OAAO,CAAC;AAAA,EACvC,CAAC;AAED,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,aAAS,0BAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,WAAW,UAA2C;AAC1E,QAAM,YAAY,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AACxD,QAAM,WAAW,SAAS,IAAI,UAAU,MAAM;AAC9C,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,WAAW,MAAM,OAAO,OAAO,SAAS,IAAI,MAAM,OAAO,KAAK,SAAS;AAEtF,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,aAAS,0BAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,cAAc,UAA2C;AAC7E,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,MAAM,OAAO,cAAc;AAAA,IACxC,WAAW,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AAAA,IACjD,MAAM,OAAO,SAAS,IAAI,MAAM,KAAK,EAAE;AAAA,IACvC,YAAY,SAAS,SAAS,IAAI,YAAY,CAAC;AAAA,EACjD,CAAC;AAED,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,aAAS,0BAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,aAAa,UAA2C;AAC5E,QAAM,YAAY,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AACxD,QAAM,QAAQ,SAAS,SAAS,IAAI,OAAO,CAAC;AAC5C,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,QAAQ,MAAM,OAAO,OAAO,WAAW,KAAK,IAAI,MAAM,OAAO,SAAS,SAAS;AAE9F,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,aAAS,0BAAY,OAAO,KAAK,EAAE;AACpF;AAEA,SAAS,SAAS,OAAsD;AACtE,QAAM,OAAO,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACxD,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AAEA,SAAS,WAAW,UAA0B;AAC5C,QAAM,OAAO,SAAS,IAAI,MAAM;AAChC,MAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG,EAAG,kCAAe,IAAI;AAC3E;","names":["import_core","import_server_only","import_headers","import_core"]}

package/dist/actions.mjs

@@ -7,6 +7,7 @@ import { userMessage } from "@fewchurs/react/core";
 
 // src/config.ts
 import "server-only";
+import { headers } from "next/headers";
 import { createFewchursClient, DEFAULT_BASE_URL } from "@fewchurs/react/core";
 function resolveApiKey(apiKey) {
   return apiKey ?? process.env.FEWCHURS_API_KEY;
@@ -14,7 +15,20 @@ function resolveApiKey(apiKey) {
 function resolveBaseUrl(baseUrl) {
   return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;
 }
-function serverClient(deviceId, config = {}) {
+function configuredAppId(appId) {
+  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || void 0;
+}
+function requestHostname(requestHeaders) {
+  const forwarded = requestHeaders.get("x-forwarded-host")?.split(",")[0]?.trim();
+  const host = forwarded || requestHeaders.get("host")?.trim();
+  if (!host) return void 0;
+  try {
+    return new URL(`http://${host}`).hostname;
+  } catch {
+    return void 0;
+  }
+}
+async function serverClient(deviceId, config = {}) {
   const apiKey = resolveApiKey(config.apiKey);
   if (!apiKey) {
     throw new Error(
@@ -25,7 +39,9 @@ function serverClient(deviceId, config = {}) {
     apiKey,
     baseUrl: resolveBaseUrl(config.baseUrl),
     deviceId,
-    language: config.language
+    language: config.language,
+    // Only read the request when needed, so a page with a set domain can still render statically.
+    appId: configuredAppId(config.appId) ?? requestHostname(await headers())
   });
 }
 
@@ -35,7 +51,7 @@ import { cookies } from "next/headers";
 import { createDeviceId } from "@fewchurs/react/core";
 
 // src/version.ts
-var SDK_VERSION = "1.0.1";
+var SDK_VERSION = "1.1.0";
 
 // src/constants.ts
 var DEVICE_ID_COOKIE = "fewchurs_did";
@@ -54,7 +70,7 @@ async function resolveDeviceId(custom) {
 
 // src/actions.ts
 async function submitFeatureAction(formData) {
-  const client = serverClient(await resolveDeviceId());
+  const client = await serverClient(await resolveDeviceId());
   const result = await client.submitFeature({
     title: String(formData.get("title") ?? ""),
     description: String(formData.get("description") ?? ""),
@@ -66,13 +82,13 @@ async function submitFeatureAction(formData) {
 async function voteAction(formData) {
   const featureId = String(formData.get("featureId") ?? "");
   const hasVoted = formData.get("hasVoted") === "true";
-  const client = serverClient(await resolveDeviceId());
+  const client = await serverClient(await resolveDeviceId());
   const result = hasVoted ? await client.unvote(featureId) : await client.vote(featureId);
   revalidate(formData);
   return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };
 }
 async function commentAction(formData) {
-  const client = serverClient(await resolveDeviceId());
+  const client = await serverClient(await resolveDeviceId());
   const result = await client.createComment({
     featureId: String(formData.get("featureId") ?? ""),
     text: String(formData.get("text") ?? ""),
@@ -84,7 +100,7 @@ async function commentAction(formData) {
 async function followAction(formData) {
   const featureId = String(formData.get("featureId") ?? "");
   const email = optional(formData.get("email"));
-  const client = serverClient(await resolveDeviceId());
+  const client = await serverClient(await resolveDeviceId());
   const result = email ? await client.follow(featureId, email) : await client.unfollow(featureId);
   revalidate(formData);
   return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };

package/dist/actions.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/actions.ts","../src/config.ts","../src/identity.ts","../src/version.ts","../src/constants.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { userMessage } from \"@fewchurs/react/core\";\nimport { serverClient } from \"./config\";\nimport { resolveDeviceId } from \"./identity\";\n\nexport interface ActionResult {\n  ok: boolean;\n  message?: string;\n}\n\n/**\n * Server actions for boards built with plain forms — the client board talks to the route\n * handler instead. Pass `path` when the page should re-render with the new data.\n */\nexport async function submitFeatureAction(formData: FormData): Promise<ActionResult> {\n  const client = serverClient(await resolveDeviceId());\n  const result = await client.submitFeature({\n    title: String(formData.get(\"title\") ?? \"\"),\n    description: String(formData.get(\"description\") ?? \"\"),\n    email: optional(formData.get(\"email\")),\n  });\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function voteAction(formData: FormData): Promise<ActionResult> {\n  const featureId = String(formData.get(\"featureId\") ?? \"\");\n  const hasVoted = formData.get(\"hasVoted\") === \"true\";\n  const client = serverClient(await resolveDeviceId());\n  const result = hasVoted ? await client.unvote(featureId) : await client.vote(featureId);\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function commentAction(formData: FormData): Promise<ActionResult> {\n  const client = serverClient(await resolveDeviceId());\n  const result = await client.createComment({\n    featureId: String(formData.get(\"featureId\") ?? \"\"),\n    text: String(formData.get(\"text\") ?? \"\"),\n    authorName: optional(formData.get(\"authorName\")),\n  });\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function followAction(formData: FormData): Promise<ActionResult> {\n  const featureId = String(formData.get(\"featureId\") ?? \"\");\n  const email = optional(formData.get(\"email\"));\n  const client = serverClient(await resolveDeviceId());\n  const result = email ? await client.follow(featureId, email) : await client.unfollow(featureId);\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nfunction optional(value: FormDataEntryValue | null): string | undefined {\n  const text = typeof value === \"string\" ? value.trim() : \"\";\n  return text.length > 0 ? text : undefined;\n}\n\nfunction revalidate(formData: FormData): void {\n  const path = formData.get(\"path\");\n  if (typeof path === \"string\" && path.startsWith(\"/\")) revalidatePath(path);\n}\n","import \"server-only\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\nexport function serverClient(deviceId: string | null, config: ServerConfig = {}): FewchursClient {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n  });\n}\n","import \"server-only\";\nimport { cookies } from \"next/headers\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE } from \"./constants\";\n\nexport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE };\n\nexport type DeviceIdResolver = () => string | Promise<string>;\n\n/** The visitor's id, or null when nothing has been stored for them yet. */\nexport async function readDeviceId(): Promise<string | null> {\n  const store = await cookies();\n  return store.get(DEVICE_ID_COOKIE)?.value ?? null;\n}\n\n/**\n * Reads the cookie, falling back to a fresh id. The value is not persisted here: a server\n * component cannot set cookies, so the route handler stores it on the first request instead.\n */\nexport async function resolveDeviceId(custom?: DeviceIdResolver): Promise<string> {\n  if (custom) return custom();\n  return (await readDeviceId()) ?? createDeviceId();\n}\n\nexport function deviceIdCookie(deviceId: string): {\n  name: string;\n  value: string;\n  options: {\n    httpOnly: true;\n    sameSite: \"lax\";\n    path: string;\n    maxAge: number;\n    secure: boolean;\n  };\n} {\n  return {\n    name: DEVICE_ID_COOKIE,\n    value: deviceId,\n    options: {\n      httpOnly: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: DEVICE_ID_MAX_AGE,\n      secure: process.env.NODE_ENV === \"production\",\n    },\n  };\n}\n\nexport { createDeviceId };\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.0.1\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";;;;AAEA,SAAS,sBAAsB;AAC/B,SAAS,mBAAmB;;;ACH5B,OAAO;AACP,SAAS,sBAAsB,wBAA6C;AAUrE,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAMO,SAAS,aAAa,UAAyB,SAAuB,CAAC,GAAmB;AAC/F,QAAM,SAAS,cAAc,OAAO,MAAM;AAC1C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO,qBAAqB;AAAA,IAC1B;AAAA,IACA,SAAS,eAAe,OAAO,OAAO;AAAA,IACtC;AAAA,IACA,UAAU,OAAO;AAAA,EACnB,CAAC;AACH;;;ACrCA,OAAO;AACP,SAAS,eAAe;AACxB,SAAS,sBAAsB;;;ACDxB,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AFK7C,eAAsB,eAAuC;AAC3D,QAAM,QAAQ,MAAM,QAAQ;AAC5B,SAAO,MAAM,IAAI,gBAAgB,GAAG,SAAS;AAC/C;AAMA,eAAsB,gBAAgB,QAA4C;AAChF,MAAI,OAAQ,QAAO,OAAO;AAC1B,SAAQ,MAAM,aAAa,KAAM,eAAe;AAClD;;;AFNA,eAAsB,oBAAoB,UAA2C;AACnF,QAAM,SAAS,aAAa,MAAM,gBAAgB,CAAC;AACnD,QAAM,SAAS,MAAM,OAAO,cAAc;AAAA,IACxC,OAAO,OAAO,SAAS,IAAI,OAAO,KAAK,EAAE;AAAA,IACzC,aAAa,OAAO,SAAS,IAAI,aAAa,KAAK,EAAE;AAAA,IACrD,OAAO,SAAS,SAAS,IAAI,OAAO,CAAC;AAAA,EACvC,CAAC;AAED,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,SAAS,YAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,WAAW,UAA2C;AAC1E,QAAM,YAAY,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AACxD,QAAM,WAAW,SAAS,IAAI,UAAU,MAAM;AAC9C,QAAM,SAAS,aAAa,MAAM,gBAAgB,CAAC;AACnD,QAAM,SAAS,WAAW,MAAM,OAAO,OAAO,SAAS,IAAI,MAAM,OAAO,KAAK,SAAS;AAEtF,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,SAAS,YAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,cAAc,UAA2C;AAC7E,QAAM,SAAS,aAAa,MAAM,gBAAgB,CAAC;AACnD,QAAM,SAAS,MAAM,OAAO,cAAc;AAAA,IACxC,WAAW,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AAAA,IACjD,MAAM,OAAO,SAAS,IAAI,MAAM,KAAK,EAAE;AAAA,IACvC,YAAY,SAAS,SAAS,IAAI,YAAY,CAAC;AAAA,EACjD,CAAC;AAED,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,SAAS,YAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,aAAa,UAA2C;AAC5E,QAAM,YAAY,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AACxD,QAAM,QAAQ,SAAS,SAAS,IAAI,OAAO,CAAC;AAC5C,QAAM,SAAS,aAAa,MAAM,gBAAgB,CAAC;AACnD,QAAM,SAAS,QAAQ,MAAM,OAAO,OAAO,WAAW,KAAK,IAAI,MAAM,OAAO,SAAS,SAAS;AAE9F,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,SAAS,YAAY,OAAO,KAAK,EAAE;AACpF;AAEA,SAAS,SAAS,OAAsD;AACtE,QAAM,OAAO,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACxD,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AAEA,SAAS,WAAW,UAA0B;AAC5C,QAAM,OAAO,SAAS,IAAI,MAAM;AAChC,MAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG,EAAG,gBAAe,IAAI;AAC3E;","names":[]}
+{"version":3,"sources":["../src/actions.ts","../src/config.ts","../src/identity.ts","../src/version.ts","../src/constants.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { userMessage } from \"@fewchurs/react/core\";\nimport { serverClient } from \"./config\";\nimport { resolveDeviceId } from \"./identity\";\n\nexport interface ActionResult {\n  ok: boolean;\n  message?: string;\n}\n\n/**\n * Server actions for boards built with plain forms — the client board talks to the route\n * handler instead. Pass `path` when the page should re-render with the new data.\n */\nexport async function submitFeatureAction(formData: FormData): Promise<ActionResult> {\n  const client = await serverClient(await resolveDeviceId());\n  const result = await client.submitFeature({\n    title: String(formData.get(\"title\") ?? \"\"),\n    description: String(formData.get(\"description\") ?? \"\"),\n    email: optional(formData.get(\"email\")),\n  });\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function voteAction(formData: FormData): Promise<ActionResult> {\n  const featureId = String(formData.get(\"featureId\") ?? \"\");\n  const hasVoted = formData.get(\"hasVoted\") === \"true\";\n  const client = await serverClient(await resolveDeviceId());\n  const result = hasVoted ? await client.unvote(featureId) : await client.vote(featureId);\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function commentAction(formData: FormData): Promise<ActionResult> {\n  const client = await serverClient(await resolveDeviceId());\n  const result = await client.createComment({\n    featureId: String(formData.get(\"featureId\") ?? \"\"),\n    text: String(formData.get(\"text\") ?? \"\"),\n    authorName: optional(formData.get(\"authorName\")),\n  });\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function followAction(formData: FormData): Promise<ActionResult> {\n  const featureId = String(formData.get(\"featureId\") ?? \"\");\n  const email = optional(formData.get(\"email\"));\n  const client = await serverClient(await resolveDeviceId());\n  const result = email ? await client.follow(featureId, email) : await client.unfollow(featureId);\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nfunction optional(value: FormDataEntryValue | null): string | undefined {\n  const text = typeof value === \"string\" ? value.trim() : \"\";\n  return text.length > 0 ? text : undefined;\n}\n\nfunction revalidate(formData: FormData): void {\n  const path = formData.get(\"path\");\n  if (typeof path === \"string\" && path.startsWith(\"/\")) revalidatePath(path);\n}\n","import \"server-only\";\nimport { headers } from \"next/headers\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\n/** A domain set by the developer, which replaces the one read from the request. */\nexport function configuredAppId(appId?: string): string | undefined {\n  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || undefined;\n}\n\n/** The site's host name without a port. A reverse proxy reports the public one in `x-forwarded-host`. */\nexport function requestHostname(requestHeaders: Headers): string | undefined {\n  const forwarded = requestHeaders.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  const host = forwarded || requestHeaders.get(\"host\")?.trim();\n  if (!host) return undefined;\n  try {\n    return new URL(`http://${host}`).hostname;\n  } catch {\n    return undefined;\n  }\n}\n\nexport async function serverClient(\n  deviceId: string | null,\n  config: ServerConfig = {},\n): Promise<FewchursClient> {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n    // Only read the request when needed, so a page with a set domain can still render statically.\n    appId: configuredAppId(config.appId) ?? requestHostname(await headers()),\n  });\n}\n","import \"server-only\";\nimport { cookies } from \"next/headers\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE } from \"./constants\";\n\nexport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE };\n\nexport type DeviceIdResolver = () => string | Promise<string>;\n\n/** The visitor's id, or null when nothing has been stored for them yet. */\nexport async function readDeviceId(): Promise<string | null> {\n  const store = await cookies();\n  return store.get(DEVICE_ID_COOKIE)?.value ?? null;\n}\n\n/**\n * Reads the cookie, falling back to a fresh id. The value is not persisted here: a server\n * component cannot set cookies, so the route handler stores it on the first request instead.\n */\nexport async function resolveDeviceId(custom?: DeviceIdResolver): Promise<string> {\n  if (custom) return custom();\n  return (await readDeviceId()) ?? createDeviceId();\n}\n\nexport function deviceIdCookie(deviceId: string): {\n  name: string;\n  value: string;\n  options: {\n    httpOnly: true;\n    sameSite: \"lax\";\n    path: string;\n    maxAge: number;\n    secure: boolean;\n  };\n} {\n  return {\n    name: DEVICE_ID_COOKIE,\n    value: deviceId,\n    options: {\n      httpOnly: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: DEVICE_ID_MAX_AGE,\n      secure: process.env.NODE_ENV === \"production\",\n    },\n  };\n}\n\nexport { createDeviceId };\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.1.0\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";;;;AAEA,SAAS,sBAAsB;AAC/B,SAAS,mBAAmB;;;ACH5B,OAAO;AACP,SAAS,eAAe;AACxB,SAAS,sBAAsB,wBAA6C;AAYrE,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAOO,SAAS,gBAAgB,OAAoC;AAClE,SAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,KAAK,KAAK;AACjE;AAGO,SAAS,gBAAgB,gBAA6C;AAC3E,QAAM,YAAY,eAAe,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAC9E,QAAM,OAAO,aAAa,eAAe,IAAI,MAAM,GAAG,KAAK;AAC3D,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,IAAI,EAAE,EAAE;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,aACpB,UACA,SAAuB,CAAC,GACC;AACzB,QAAM,SAAS,cAAc,OAAO,MAAM;AAC1C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO,qBAAqB;AAAA,IAC1B;AAAA,IACA,SAAS,eAAe,OAAO,OAAO;AAAA,IACtC;AAAA,IACA,UAAU,OAAO;AAAA;AAAA,IAEjB,OAAO,gBAAgB,OAAO,KAAK,KAAK,gBAAgB,MAAM,QAAQ,CAAC;AAAA,EACzE,CAAC;AACH;;;AC9DA,OAAO;AACP,SAAS,eAAe;AACxB,SAAS,sBAAsB;;;ACDxB,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AFK7C,eAAsB,eAAuC;AAC3D,QAAM,QAAQ,MAAM,QAAQ;AAC5B,SAAO,MAAM,IAAI,gBAAgB,GAAG,SAAS;AAC/C;AAMA,eAAsB,gBAAgB,QAA4C;AAChF,MAAI,OAAQ,QAAO,OAAO;AAC1B,SAAQ,MAAM,aAAa,KAAM,eAAe;AAClD;;;AFNA,eAAsB,oBAAoB,UAA2C;AACnF,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,MAAM,OAAO,cAAc;AAAA,IACxC,OAAO,OAAO,SAAS,IAAI,OAAO,KAAK,EAAE;AAAA,IACzC,aAAa,OAAO,SAAS,IAAI,aAAa,KAAK,EAAE;AAAA,IACrD,OAAO,SAAS,SAAS,IAAI,OAAO,CAAC;AAAA,EACvC,CAAC;AAED,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,SAAS,YAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,WAAW,UAA2C;AAC1E,QAAM,YAAY,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AACxD,QAAM,WAAW,SAAS,IAAI,UAAU,MAAM;AAC9C,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,WAAW,MAAM,OAAO,OAAO,SAAS,IAAI,MAAM,OAAO,KAAK,SAAS;AAEtF,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,SAAS,YAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,cAAc,UAA2C;AAC7E,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,MAAM,OAAO,cAAc;AAAA,IACxC,WAAW,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AAAA,IACjD,MAAM,OAAO,SAAS,IAAI,MAAM,KAAK,EAAE;AAAA,IACvC,YAAY,SAAS,SAAS,IAAI,YAAY,CAAC;AAAA,EACjD,CAAC;AAED,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,SAAS,YAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,aAAa,UAA2C;AAC5E,QAAM,YAAY,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AACxD,QAAM,QAAQ,SAAS,SAAS,IAAI,OAAO,CAAC;AAC5C,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,QAAQ,MAAM,OAAO,OAAO,WAAW,KAAK,IAAI,MAAM,OAAO,SAAS,SAAS;AAE9F,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,SAAS,YAAY,OAAO,KAAK,EAAE;AACpF;AAEA,SAAS,SAAS,OAAsD;AACtE,QAAM,OAAO,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACxD,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AAEA,SAAS,WAAW,UAA0B;AAC5C,QAAM,OAAO,SAAS,IAAI,MAAM;AAChC,MAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG,EAAG,gBAAe,IAAI;AAC3E;","names":[]}

package/dist/{chunk-QULKPZB4.mjs → chunk-DM357WK6.mjs}

@@ -1,7 +1,7 @@
 import {
   DEVICE_ID_COOKIE,
   DEVICE_ID_MAX_AGE
-} from "./chunk-W6QR6DEB.mjs";
+} from "./chunk-L57II7SI.mjs";
 
 // src/identity.ts
 import "server-only";
@@ -35,4 +35,4 @@ export {
   resolveDeviceId,
   deviceIdCookie
 };
-//# sourceMappingURL=chunk-QULKPZB4.mjs.map
+//# sourceMappingURL=chunk-DM357WK6.mjs.map

package/dist/{chunk-W6QR6DEB.mjs → chunk-L57II7SI.mjs}

@@ -1,5 +1,5 @@
 // src/version.ts
-var SDK_VERSION = "1.0.1";
+var SDK_VERSION = "1.1.0";
 
 // src/constants.ts
 var DEVICE_ID_COOKIE = "fewchurs_did";
@@ -11,4 +11,4 @@ export {
   DEVICE_ID_MAX_AGE,
   SDK_HEADER
 };
-//# sourceMappingURL=chunk-W6QR6DEB.mjs.map
+//# sourceMappingURL=chunk-L57II7SI.mjs.map

package/dist/{chunk-W6QR6DEB.mjs.map → chunk-L57II7SI.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/version.ts","../src/constants.ts"],"sourcesContent":["// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.0.1\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";AACO,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;","names":[]}
+{"version":3,"sources":["../src/version.ts","../src/constants.ts"],"sourcesContent":["// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.1.0\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";AACO,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;","names":[]}

package/dist/{chunk-KPJHLDQU.mjs → chunk-ZRYXVCLB.mjs}

@@ -2,7 +2,7 @@ import {
   DEVICE_ID_COOKIE,
   DEVICE_ID_MAX_AGE,
   SDK_HEADER
-} from "./chunk-W6QR6DEB.mjs";
+} from "./chunk-L57II7SI.mjs";
 
 // src/handler.ts
 import "server-only";
@@ -10,6 +10,7 @@ import { createDeviceId } from "@fewchurs/react/core";
 
 // src/config.ts
 import "server-only";
+import { headers } from "next/headers";
 import { createFewchursClient, DEFAULT_BASE_URL } from "@fewchurs/react/core";
 var DEFAULT_API_PATH = "/api/fewchurs";
 function resolveApiKey(apiKey) {
@@ -21,7 +22,20 @@ function resolveBaseUrl(baseUrl) {
 function resolveApiPath(apiPath) {
   return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\/$/, "");
 }
-function serverClient(deviceId, config = {}) {
+function configuredAppId(appId) {
+  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || void 0;
+}
+function requestHostname(requestHeaders) {
+  const forwarded = requestHeaders.get("x-forwarded-host")?.split(",")[0]?.trim();
+  const host = forwarded || requestHeaders.get("host")?.trim();
+  if (!host) return void 0;
+  try {
+    return new URL(`http://${host}`).hostname;
+  } catch {
+    return void 0;
+  }
+}
+async function serverClient(deviceId, config = {}) {
   const apiKey = resolveApiKey(config.apiKey);
   if (!apiKey) {
     throw new Error(
@@ -32,7 +46,9 @@ function serverClient(deviceId, config = {}) {
     apiKey,
     baseUrl: resolveBaseUrl(config.baseUrl),
     deviceId,
-    language: config.language
+    language: config.language,
+    // Only read the request when needed, so a page with a set domain can still render statically.
+    appId: configuredAppId(config.appId) ?? requestHostname(await headers())
   });
 }
 
@@ -67,23 +83,26 @@ function createHandler(options = {}) {
     const custom = options.deviceId ? await options.deviceId() : null;
     const deviceId = custom ?? cookieValue ?? claimedDeviceId(request) ?? createDeviceId();
     const target = `${resolveBaseUrl(options.baseUrl)}/${path}${new URL(request.url).search}`;
-    const headers = {
+    const headers2 = {
       Authorization: `Bearer ${apiKey}`,
       "X-Device-Id": deviceId,
-      "X-Fewchurs-Sdk": request.headers.get("x-fewchurs-sdk") ?? SDK_HEADER,
+      "X-Fewchurs-Sdk": SDK_HEADER,
+      "X-Fewchurs-App-Id": configuredAppId(options.appId) ?? requestHostname(request.headers) ?? new URL(request.url).hostname,
       Accept: "application/json"
     };
     const language = request.headers.get("accept-language");
-    if (language) headers["Accept-Language"] = language;
+    if (language) headers2["Accept-Language"] = language;
     const body = request.method === "GET" ? void 0 : await request.text();
-    if (body) headers["Content-Type"] = "application/json";
+    if (body) headers2["Content-Type"] = "application/json";
     let upstream;
     try {
-      upstream = await fetch(target, { method: request.method, headers, body, cache: "no-store" });
+      upstream = await fetch(target, { method: request.method, headers: headers2, body, cache: "no-store" });
     } catch {
       return json({ error: { code: "internal", message: "Could not reach Fewchurs." } }, 502);
     }
-    const response = new Response(await upstream.text(), {
+    const text = await upstream.text();
+    if (upstream.status === 403) logRefusal(text);
+    const response = new Response(text, {
       status: upstream.status,
       headers: { "Content-Type": "application/json", "Cache-Control": "no-store" }
     });
@@ -98,6 +117,17 @@ var defaultHandler = createHandler();
 var GET = defaultHandler.GET;
 var POST = defaultHandler.POST;
 var DELETE = defaultHandler.DELETE;
+var loggedRefusal = false;
+function logRefusal(body) {
+  if (loggedRefusal) return;
+  try {
+    const error = JSON.parse(body).error;
+    if (error?.code !== "wrong_app") return;
+    loggedRefusal = true;
+    console.error(`[fewchurs] ${error.message}`);
+  } catch {
+  }
+}
 async function routePath(request, context, apiPath) {
   const params = await context?.params;
   if (params?.route?.length) return params.route.map(encodeURIComponent).join("/");
@@ -142,4 +172,4 @@ export {
   POST,
   DELETE
 };
-//# sourceMappingURL=chunk-KPJHLDQU.mjs.map
+//# sourceMappingURL=chunk-ZRYXVCLB.mjs.map

package/dist/chunk-ZRYXVCLB.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/handler.ts","../src/config.ts"],"sourcesContent":["import \"server-only\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport {\n  configuredAppId,\n  requestHostname,\n  resolveApiKey,\n  resolveApiPath,\n  resolveBaseUrl,\n} from \"./config\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE, SDK_HEADER } from \"./constants\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface HandlerOptions {\n  apiKey?: string;\n  baseUrl?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n  /** Where the handler is mounted, when it is not `/api/fewchurs`. */\n  apiPath?: string;\n  /** Return a stable, hashed id for the signed-in visitor so votes follow the account. */\n  deviceId?: DeviceIdResolver;\n}\n\ntype RouteParams = { route?: string[] };\n\n/** What Next passes: a Promise in 15, a plain object in 14. Both are awaited the same way. */\ntype IncomingContext = { params?: RouteParams | Promise<RouteParams> };\n\n// Next 15's route check wants a required second argument whose `params` is a Promise. The\n// handler itself takes `IncomingContext`, so Next 14's plain object still works at runtime.\ntype RouteContext = { params: Promise<RouteParams> };\n\nexport type RouteHandler = (request: Request, context: RouteContext) => Promise<Response>;\n\n/** Only the endpoints the board needs: everything else is a 404, not a proxy to the API. */\nconst ALLOWED: Array<{ method: string; pattern: RegExp }> = [\n  { method: \"GET\", pattern: /^config$/ },\n  { method: \"GET\", pattern: /^features$/ },\n  { method: \"POST\", pattern: /^features$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+\\/comments$/ },\n  { method: \"POST\", pattern: /^comments$/ },\n];\n\nconst DEVICE_ID_PATTERN = /^[A-Za-z0-9_-]{8,128}$/;\n\nexport function createHandler(options: HandlerOptions = {}): {\n  GET: RouteHandler;\n  POST: RouteHandler;\n  DELETE: RouteHandler;\n} {\n  async function handle(request: Request, context?: IncomingContext): Promise<Response> {\n    const path = await routePath(request, context, resolveApiPath(options.apiPath));\n\n    if (!ALLOWED.some((route) => route.method === request.method && route.pattern.test(path))) {\n      return json({ error: { code: \"not_found\", message: \"Unknown Fewchurs route.\" } }, 404);\n    }\n\n    const apiKey = resolveApiKey(options.apiKey);\n    if (!apiKey) {\n      console.error(\n        \"[fewchurs] No API key. Set FEWCHURS_API_KEY, or pass apiKey to createHandler().\",\n      );\n      return json({ error: { code: \"internal\", message: \"Fewchurs is not configured.\" } }, 500);\n    }\n\n    const cookieValue = readCookie(request, DEVICE_ID_COOKIE);\n    const custom = options.deviceId ? await options.deviceId() : null;\n    const deviceId = custom ?? cookieValue ?? claimedDeviceId(request) ?? createDeviceId();\n\n    const target = `${resolveBaseUrl(options.baseUrl)}/${path}${new URL(request.url).search}`;\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${apiKey}`,\n      \"X-Device-Id\": deviceId,\n      \"X-Fewchurs-Sdk\": SDK_HEADER,\n      \"X-Fewchurs-App-Id\":\n        configuredAppId(options.appId) ??\n        requestHostname(request.headers) ??\n        new URL(request.url).hostname,\n      Accept: \"application/json\",\n    };\n    const language = request.headers.get(\"accept-language\");\n    if (language) headers[\"Accept-Language\"] = language;\n\n    const body = request.method === \"GET\" ? undefined : await request.text();\n    if (body) headers[\"Content-Type\"] = \"application/json\";\n\n    let upstream: Response;\n    try {\n      upstream = await fetch(target, { method: request.method, headers, body, cache: \"no-store\" });\n    } catch {\n      return json({ error: { code: \"internal\", message: \"Could not reach Fewchurs.\" } }, 502);\n    }\n\n    const text = await upstream.text();\n    if (upstream.status === 403) logRefusal(text);\n\n    const response = new Response(text, {\n      status: upstream.status,\n      headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n    });\n\n    // A visitor keeps the same id across requests without the browser ever seeing the key,\n    // and an httpOnly cookie means page scripts cannot read or change it either.\n    if (!custom && deviceId !== cookieValue) {\n      response.headers.append(\"Set-Cookie\", serializeCookie(deviceId));\n    }\n\n    return response;\n  }\n\n  return { GET: handle, POST: handle, DELETE: handle };\n}\n\nconst defaultHandler = createHandler();\n\nexport const GET = defaultHandler.GET;\nexport const POST = defaultHandler.POST;\nexport const DELETE = defaultHandler.DELETE;\n\nlet loggedRefusal = false;\n\n/** Visitors only see a safe message, so a live site's server log is where the domain gets named. */\nfunction logRefusal(body: string): void {\n  if (loggedRefusal) return;\n  try {\n    const error = (JSON.parse(body) as { error?: { code?: string; message?: string } }).error;\n    if (error?.code !== \"wrong_app\") return;\n    loggedRefusal = true;\n    console.error(`[fewchurs] ${error.message}`);\n  } catch {\n    // Not JSON, so it isn't a refusal from Fewchurs.\n  }\n}\n\nasync function routePath(\n  request: Request,\n  context: IncomingContext | undefined,\n  apiPath: string,\n): Promise<string> {\n  const params = await context?.params;\n  if (params?.route?.length) return params.route.map(encodeURIComponent).join(\"/\");\n\n  const { pathname } = new URL(request.url);\n  const index = pathname.indexOf(apiPath);\n  return index === -1 ? \"\" : pathname.slice(index + apiPath.length).replace(/^\\//, \"\");\n}\n\n/**\n * The first request from a server-rendered board carries the id the page was rendered with,\n * so adopting it keeps the server's `hasVoted` answers and the browser's in agreement.\n */\nfunction claimedDeviceId(request: Request): string | null {\n  const claimed = request.headers.get(\"x-device-id\");\n  return claimed && DEVICE_ID_PATTERN.test(claimed) ? claimed : null;\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n  const header = request.headers.get(\"cookie\");\n  if (!header) return null;\n  const match = header.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match?.[1] ? decodeURIComponent(match[1]) : null;\n}\n\nfunction serializeCookie(deviceId: string): string {\n  const parts = [\n    `${DEVICE_ID_COOKIE}=${encodeURIComponent(deviceId)}`,\n    \"Path=/\",\n    `Max-Age=${DEVICE_ID_MAX_AGE}`,\n    \"HttpOnly\",\n    \"SameSite=Lax\",\n  ];\n  if (process.env.NODE_ENV === \"production\") parts.push(\"Secure\");\n  return parts.join(\"; \");\n}\n\nfunction json(body: unknown, status: number): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n  });\n}\n","import \"server-only\";\nimport { headers } from \"next/headers\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\n/** A domain set by the developer, which replaces the one read from the request. */\nexport function configuredAppId(appId?: string): string | undefined {\n  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || undefined;\n}\n\n/** The site's host name without a port. A reverse proxy reports the public one in `x-forwarded-host`. */\nexport function requestHostname(requestHeaders: Headers): string | undefined {\n  const forwarded = requestHeaders.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  const host = forwarded || requestHeaders.get(\"host\")?.trim();\n  if (!host) return undefined;\n  try {\n    return new URL(`http://${host}`).hostname;\n  } catch {\n    return undefined;\n  }\n}\n\nexport async function serverClient(\n  deviceId: string | null,\n  config: ServerConfig = {},\n): Promise<FewchursClient> {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n    // Only read the request when needed, so a page with a set domain can still render statically.\n    appId: configuredAppId(config.appId) ?? requestHostname(await headers()),\n  });\n}\n"],"mappings":";;;;;;;AAAA,OAAO;AACP,SAAS,sBAAsB;;;ACD/B,OAAO;AACP,SAAS,eAAe;AACxB,SAAS,sBAAsB,wBAA6C;AAErE,IAAM,mBAAmB;AAUzB,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAEO,SAAS,eAAe,SAA0B;AACvD,UAAQ,WAAW,QAAQ,IAAI,qBAAqB,kBAAkB,QAAQ,OAAO,EAAE;AACzF;AAGO,SAAS,gBAAgB,OAAoC;AAClE,SAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,KAAK,KAAK;AACjE;AAGO,SAAS,gBAAgB,gBAA6C;AAC3E,QAAM,YAAY,eAAe,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAC9E,QAAM,OAAO,aAAa,eAAe,IAAI,MAAM,GAAG,KAAK;AAC3D,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,IAAI,EAAE,EAAE;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,aACpB,UACA,SAAuB,CAAC,GACC;AACzB,QAAM,SAAS,cAAc,OAAO,MAAM;AAC1C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO,qBAAqB;AAAA,IAC1B;AAAA,IACA,SAAS,eAAe,OAAO,OAAO;AAAA,IACtC;AAAA,IACA,UAAU,OAAO;AAAA;AAAA,IAEjB,OAAO,gBAAgB,OAAO,KAAK,KAAK,gBAAgB,MAAM,QAAQ,CAAC;AAAA,EACzE,CAAC;AACH;;;AD3BA,IAAM,UAAsD;AAAA,EAC1D,EAAE,QAAQ,OAAO,SAAS,WAAW;AAAA,EACrC,EAAE,QAAQ,OAAO,SAAS,aAAa;AAAA,EACvC,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAAA,EACxC,EAAE,QAAQ,OAAO,SAAS,oBAAoB;AAAA,EAC9C,EAAE,QAAQ,QAAQ,SAAS,0BAA0B;AAAA,EACrD,EAAE,QAAQ,UAAU,SAAS,0BAA0B;AAAA,EACvD,EAAE,QAAQ,QAAQ,SAAS,4BAA4B;AAAA,EACvD,EAAE,QAAQ,UAAU,SAAS,4BAA4B;AAAA,EACzD,EAAE,QAAQ,OAAO,SAAS,8BAA8B;AAAA,EACxD,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAC1C;AAEA,IAAM,oBAAoB;AAEnB,SAAS,cAAc,UAA0B,CAAC,GAIvD;AACA,iBAAe,OAAO,SAAkB,SAA8C;AACpF,UAAM,OAAO,MAAM,UAAU,SAAS,SAAS,eAAe,QAAQ,OAAO,CAAC;AAE9E,QAAI,CAAC,QAAQ,KAAK,CAAC,UAAU,MAAM,WAAW,QAAQ,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG;AACzF,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,SAAS,0BAA0B,EAAE,GAAG,GAAG;AAAA,IACvF;AAEA,UAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,QAAI,CAAC,QAAQ;AACX,cAAQ;AAAA,QACN;AAAA,MACF;AACA,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,8BAA8B,EAAE,GAAG,GAAG;AAAA,IAC1F;AAEA,UAAM,cAAc,WAAW,SAAS,gBAAgB;AACxD,UAAM,SAAS,QAAQ,WAAW,MAAM,QAAQ,SAAS,IAAI;AAC7D,UAAM,WAAW,UAAU,eAAe,gBAAgB,OAAO,KAAK,eAAe;AAErF,UAAM,SAAS,GAAG,eAAe,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,MAAM;AACvF,UAAMA,WAAkC;AAAA,MACtC,eAAe,UAAU,MAAM;AAAA,MAC/B,eAAe;AAAA,MACf,kBAAkB;AAAA,MAClB,qBACE,gBAAgB,QAAQ,KAAK,KAC7B,gBAAgB,QAAQ,OAAO,KAC/B,IAAI,IAAI,QAAQ,GAAG,EAAE;AAAA,MACvB,QAAQ;AAAA,IACV;AACA,UAAM,WAAW,QAAQ,QAAQ,IAAI,iBAAiB;AACtD,QAAI,SAAU,CAAAA,SAAQ,iBAAiB,IAAI;AAE3C,UAAM,OAAO,QAAQ,WAAW,QAAQ,SAAY,MAAM,QAAQ,KAAK;AACvE,QAAI,KAAM,CAAAA,SAAQ,cAAc,IAAI;AAEpC,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,QAAQ,EAAE,QAAQ,QAAQ,QAAQ,SAAAA,UAAS,MAAM,OAAO,WAAW,CAAC;AAAA,IAC7F,QAAQ;AACN,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,4BAA4B,EAAE,GAAG,GAAG;AAAA,IACxF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,SAAS,WAAW,IAAK,YAAW,IAAI;AAE5C,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ,SAAS;AAAA,MACjB,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,IAC7E,CAAC;AAID,QAAI,CAAC,UAAU,aAAa,aAAa;AACvC,eAAS,QAAQ,OAAO,cAAc,gBAAgB,QAAQ,CAAC;AAAA,IACjE;AAEA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,OAAO;AACrD;AAEA,IAAM,iBAAiB,cAAc;AAE9B,IAAM,MAAM,eAAe;AAC3B,IAAM,OAAO,eAAe;AAC5B,IAAM,SAAS,eAAe;AAErC,IAAI,gBAAgB;AAGpB,SAAS,WAAW,MAAoB;AACtC,MAAI,cAAe;AACnB,MAAI;AACF,UAAM,QAAS,KAAK,MAAM,IAAI,EAAsD;AACpF,QAAI,OAAO,SAAS,YAAa;AACjC,oBAAgB;AAChB,YAAQ,MAAM,cAAc,MAAM,OAAO,EAAE;AAAA,EAC7C,QAAQ;AAAA,EAER;AACF;AAEA,eAAe,UACb,SACA,SACA,SACiB;AACjB,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,QAAQ,OAAO,OAAQ,QAAO,OAAO,MAAM,IAAI,kBAAkB,EAAE,KAAK,GAAG;AAE/E,QAAM,EAAE,SAAS,IAAI,IAAI,IAAI,QAAQ,GAAG;AACxC,QAAM,QAAQ,SAAS,QAAQ,OAAO;AACtC,SAAO,UAAU,KAAK,KAAK,SAAS,MAAM,QAAQ,QAAQ,MAAM,EAAE,QAAQ,OAAO,EAAE;AACrF;AAMA,SAAS,gBAAgB,SAAiC;AACxD,QAAM,UAAU,QAAQ,QAAQ,IAAI,aAAa;AACjD,SAAO,WAAW,kBAAkB,KAAK,OAAO,IAAI,UAAU;AAChE;AAEA,SAAS,WAAW,SAAkB,MAA6B;AACjE,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACnE,SAAO,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACrD;AAEA,SAAS,gBAAgB,UAA0B;AACjD,QAAM,QAAQ;AAAA,IACZ,GAAG,gBAAgB,IAAI,mBAAmB,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,WAAW,iBAAiB;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,aAAa,aAAc,OAAM,KAAK,QAAQ;AAC9D,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,KAAK,MAAe,QAA0B;AACrD,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,EAC7E,CAAC;AACH;","names":["headers"]}

package/dist/handler.d.mts

@@ -4,6 +4,8 @@ import '@fewchurs/react/core';
 interface HandlerOptions {
     apiKey?: string;
     baseUrl?: string;
+    /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */
+    appId?: string;
     /** Where the handler is mounted, when it is not `/api/fewchurs`. */
     apiPath?: string;
     /** Return a stable, hashed id for the signed-in visitor so votes follow the account. */

package/dist/handler.d.ts

@@ -4,6 +4,8 @@ import '@fewchurs/react/core';
 interface HandlerOptions {
     apiKey?: string;
     baseUrl?: string;
+    /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */
+    appId?: string;
     /** Where the handler is mounted, when it is not `/api/fewchurs`. */
     apiPath?: string;
     /** Return a stable, hashed id for the signed-in visitor so votes follow the account. */

package/dist/handler.js

@@ -31,6 +31,7 @@ var import_core2 = require("@fewchurs/react/core");
 
 // src/config.ts
 var import_server_only = require("server-only");
+var import_headers = require("next/headers");
 var import_core = require("@fewchurs/react/core");
 var DEFAULT_API_PATH = "/api/fewchurs";
 function resolveApiKey(apiKey) {
@@ -42,9 +43,22 @@ function resolveBaseUrl(baseUrl) {
 function resolveApiPath(apiPath) {
   return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\/$/, "");
 }
+function configuredAppId(appId) {
+  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || void 0;
+}
+function requestHostname(requestHeaders) {
+  const forwarded = requestHeaders.get("x-forwarded-host")?.split(",")[0]?.trim();
+  const host = forwarded || requestHeaders.get("host")?.trim();
+  if (!host) return void 0;
+  try {
+    return new URL(`http://${host}`).hostname;
+  } catch {
+    return void 0;
+  }
+}
 
 // src/version.ts
-var SDK_VERSION = "1.0.1";
+var SDK_VERSION = "1.1.0";
 
 // src/constants.ts
 var DEVICE_ID_COOKIE = "fewchurs_did";
@@ -82,23 +96,26 @@ function createHandler(options = {}) {
     const custom = options.deviceId ? await options.deviceId() : null;
     const deviceId = custom ?? cookieValue ?? claimedDeviceId(request) ?? (0, import_core2.createDeviceId)();
     const target = `${resolveBaseUrl(options.baseUrl)}/${path}${new URL(request.url).search}`;
-    const headers = {
+    const headers2 = {
       Authorization: `Bearer ${apiKey}`,
       "X-Device-Id": deviceId,
-      "X-Fewchurs-Sdk": request.headers.get("x-fewchurs-sdk") ?? SDK_HEADER,
+      "X-Fewchurs-Sdk": SDK_HEADER,
+      "X-Fewchurs-App-Id": configuredAppId(options.appId) ?? requestHostname(request.headers) ?? new URL(request.url).hostname,
       Accept: "application/json"
     };
     const language = request.headers.get("accept-language");
-    if (language) headers["Accept-Language"] = language;
+    if (language) headers2["Accept-Language"] = language;
     const body = request.method === "GET" ? void 0 : await request.text();
-    if (body) headers["Content-Type"] = "application/json";
+    if (body) headers2["Content-Type"] = "application/json";
     let upstream;
     try {
-      upstream = await fetch(target, { method: request.method, headers, body, cache: "no-store" });
+      upstream = await fetch(target, { method: request.method, headers: headers2, body, cache: "no-store" });
     } catch {
       return json({ error: { code: "internal", message: "Could not reach Fewchurs." } }, 502);
     }
-    const response = new Response(await upstream.text(), {
+    const text = await upstream.text();
+    if (upstream.status === 403) logRefusal(text);
+    const response = new Response(text, {
       status: upstream.status,
       headers: { "Content-Type": "application/json", "Cache-Control": "no-store" }
     });
@@ -113,6 +130,17 @@ var defaultHandler = createHandler();
 var GET = defaultHandler.GET;
 var POST = defaultHandler.POST;
 var DELETE = defaultHandler.DELETE;
+var loggedRefusal = false;
+function logRefusal(body) {
+  if (loggedRefusal) return;
+  try {
+    const error = JSON.parse(body).error;
+    if (error?.code !== "wrong_app") return;
+    loggedRefusal = true;
+    console.error(`[fewchurs] ${error.message}`);
+  } catch {
+  }
+}
 async function routePath(request, context, apiPath) {
   const params = await context?.params;
   if (params?.route?.length) return params.route.map(encodeURIComponent).join("/");

package/dist/handler.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/handler.ts","../src/config.ts","../src/version.ts","../src/constants.ts"],"sourcesContent":["import \"server-only\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { resolveApiKey, resolveApiPath, resolveBaseUrl } from \"./config\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE, SDK_HEADER } from \"./constants\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface HandlerOptions {\n  apiKey?: string;\n  baseUrl?: string;\n  /** Where the handler is mounted, when it is not `/api/fewchurs`. */\n  apiPath?: string;\n  /** Return a stable, hashed id for the signed-in visitor so votes follow the account. */\n  deviceId?: DeviceIdResolver;\n}\n\ntype RouteParams = { route?: string[] };\n\n/** What Next passes: a Promise in 15, a plain object in 14. Both are awaited the same way. */\ntype IncomingContext = { params?: RouteParams | Promise<RouteParams> };\n\n// Next 15's route check wants a required second argument whose `params` is a Promise. The\n// handler itself takes `IncomingContext`, so Next 14's plain object still works at runtime.\ntype RouteContext = { params: Promise<RouteParams> };\n\nexport type RouteHandler = (request: Request, context: RouteContext) => Promise<Response>;\n\n/** Only the endpoints the board needs: everything else is a 404, not a proxy to the API. */\nconst ALLOWED: Array<{ method: string; pattern: RegExp }> = [\n  { method: \"GET\", pattern: /^config$/ },\n  { method: \"GET\", pattern: /^features$/ },\n  { method: \"POST\", pattern: /^features$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+\\/comments$/ },\n  { method: \"POST\", pattern: /^comments$/ },\n];\n\nconst DEVICE_ID_PATTERN = /^[A-Za-z0-9_-]{8,128}$/;\n\nexport function createHandler(options: HandlerOptions = {}): {\n  GET: RouteHandler;\n  POST: RouteHandler;\n  DELETE: RouteHandler;\n} {\n  async function handle(request: Request, context?: IncomingContext): Promise<Response> {\n    const path = await routePath(request, context, resolveApiPath(options.apiPath));\n\n    if (!ALLOWED.some((route) => route.method === request.method && route.pattern.test(path))) {\n      return json({ error: { code: \"not_found\", message: \"Unknown Fewchurs route.\" } }, 404);\n    }\n\n    const apiKey = resolveApiKey(options.apiKey);\n    if (!apiKey) {\n      console.error(\n        \"[fewchurs] No API key. Set FEWCHURS_API_KEY, or pass apiKey to createHandler().\",\n      );\n      return json({ error: { code: \"internal\", message: \"Fewchurs is not configured.\" } }, 500);\n    }\n\n    const cookieValue = readCookie(request, DEVICE_ID_COOKIE);\n    const custom = options.deviceId ? await options.deviceId() : null;\n    const deviceId = custom ?? cookieValue ?? claimedDeviceId(request) ?? createDeviceId();\n\n    const target = `${resolveBaseUrl(options.baseUrl)}/${path}${new URL(request.url).search}`;\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${apiKey}`,\n      \"X-Device-Id\": deviceId,\n      \"X-Fewchurs-Sdk\": request.headers.get(\"x-fewchurs-sdk\") ?? SDK_HEADER,\n      Accept: \"application/json\",\n    };\n    const language = request.headers.get(\"accept-language\");\n    if (language) headers[\"Accept-Language\"] = language;\n\n    const body = request.method === \"GET\" ? undefined : await request.text();\n    if (body) headers[\"Content-Type\"] = \"application/json\";\n\n    let upstream: Response;\n    try {\n      upstream = await fetch(target, { method: request.method, headers, body, cache: \"no-store\" });\n    } catch {\n      return json({ error: { code: \"internal\", message: \"Could not reach Fewchurs.\" } }, 502);\n    }\n\n    const response = new Response(await upstream.text(), {\n      status: upstream.status,\n      headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n    });\n\n    // A visitor keeps the same id across requests without the browser ever seeing the key,\n    // and an httpOnly cookie means page scripts cannot read or change it either.\n    if (!custom && deviceId !== cookieValue) {\n      response.headers.append(\"Set-Cookie\", serializeCookie(deviceId));\n    }\n\n    return response;\n  }\n\n  return { GET: handle, POST: handle, DELETE: handle };\n}\n\nconst defaultHandler = createHandler();\n\nexport const GET = defaultHandler.GET;\nexport const POST = defaultHandler.POST;\nexport const DELETE = defaultHandler.DELETE;\n\nasync function routePath(\n  request: Request,\n  context: IncomingContext | undefined,\n  apiPath: string,\n): Promise<string> {\n  const params = await context?.params;\n  if (params?.route?.length) return params.route.map(encodeURIComponent).join(\"/\");\n\n  const { pathname } = new URL(request.url);\n  const index = pathname.indexOf(apiPath);\n  return index === -1 ? \"\" : pathname.slice(index + apiPath.length).replace(/^\\//, \"\");\n}\n\n/**\n * The first request from a server-rendered board carries the id the page was rendered with,\n * so adopting it keeps the server's `hasVoted` answers and the browser's in agreement.\n */\nfunction claimedDeviceId(request: Request): string | null {\n  const claimed = request.headers.get(\"x-device-id\");\n  return claimed && DEVICE_ID_PATTERN.test(claimed) ? claimed : null;\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n  const header = request.headers.get(\"cookie\");\n  if (!header) return null;\n  const match = header.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match?.[1] ? decodeURIComponent(match[1]) : null;\n}\n\nfunction serializeCookie(deviceId: string): string {\n  const parts = [\n    `${DEVICE_ID_COOKIE}=${encodeURIComponent(deviceId)}`,\n    \"Path=/\",\n    `Max-Age=${DEVICE_ID_MAX_AGE}`,\n    \"HttpOnly\",\n    \"SameSite=Lax\",\n  ];\n  if (process.env.NODE_ENV === \"production\") parts.push(\"Secure\");\n  return parts.join(\"; \");\n}\n\nfunction json(body: unknown, status: number): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n  });\n}\n","import \"server-only\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\nexport function serverClient(deviceId: string | null, config: ServerConfig = {}): FewchursClient {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n  });\n}\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.0.1\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAAA,sBAAO;AACP,IAAAC,eAA+B;;;ACD/B,yBAAO;AACP,kBAA4E;AAErE,IAAM,mBAAmB;AAQzB,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAEO,SAAS,eAAe,SAA0B;AACvD,UAAQ,WAAW,QAAQ,IAAI,qBAAqB,kBAAkB,QAAQ,OAAO,EAAE;AACzF;;;ACpBO,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AHsB7C,IAAM,UAAsD;AAAA,EAC1D,EAAE,QAAQ,OAAO,SAAS,WAAW;AAAA,EACrC,EAAE,QAAQ,OAAO,SAAS,aAAa;AAAA,EACvC,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAAA,EACxC,EAAE,QAAQ,OAAO,SAAS,oBAAoB;AAAA,EAC9C,EAAE,QAAQ,QAAQ,SAAS,0BAA0B;AAAA,EACrD,EAAE,QAAQ,UAAU,SAAS,0BAA0B;AAAA,EACvD,EAAE,QAAQ,QAAQ,SAAS,4BAA4B;AAAA,EACvD,EAAE,QAAQ,UAAU,SAAS,4BAA4B;AAAA,EACzD,EAAE,QAAQ,OAAO,SAAS,8BAA8B;AAAA,EACxD,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAC1C;AAEA,IAAM,oBAAoB;AAEnB,SAAS,cAAc,UAA0B,CAAC,GAIvD;AACA,iBAAe,OAAO,SAAkB,SAA8C;AACpF,UAAM,OAAO,MAAM,UAAU,SAAS,SAAS,eAAe,QAAQ,OAAO,CAAC;AAE9E,QAAI,CAAC,QAAQ,KAAK,CAAC,UAAU,MAAM,WAAW,QAAQ,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG;AACzF,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,SAAS,0BAA0B,EAAE,GAAG,GAAG;AAAA,IACvF;AAEA,UAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,QAAI,CAAC,QAAQ;AACX,cAAQ;AAAA,QACN;AAAA,MACF;AACA,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,8BAA8B,EAAE,GAAG,GAAG;AAAA,IAC1F;AAEA,UAAM,cAAc,WAAW,SAAS,gBAAgB;AACxD,UAAM,SAAS,QAAQ,WAAW,MAAM,QAAQ,SAAS,IAAI;AAC7D,UAAM,WAAW,UAAU,eAAe,gBAAgB,OAAO,SAAK,6BAAe;AAErF,UAAM,SAAS,GAAG,eAAe,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,MAAM;AACvF,UAAM,UAAkC;AAAA,MACtC,eAAe,UAAU,MAAM;AAAA,MAC/B,eAAe;AAAA,MACf,kBAAkB,QAAQ,QAAQ,IAAI,gBAAgB,KAAK;AAAA,MAC3D,QAAQ;AAAA,IACV;AACA,UAAM,WAAW,QAAQ,QAAQ,IAAI,iBAAiB;AACtD,QAAI,SAAU,SAAQ,iBAAiB,IAAI;AAE3C,UAAM,OAAO,QAAQ,WAAW,QAAQ,SAAY,MAAM,QAAQ,KAAK;AACvE,QAAI,KAAM,SAAQ,cAAc,IAAI;AAEpC,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,QAAQ,EAAE,QAAQ,QAAQ,QAAQ,SAAS,MAAM,OAAO,WAAW,CAAC;AAAA,IAC7F,QAAQ;AACN,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,4BAA4B,EAAE,GAAG,GAAG;AAAA,IACxF;AAEA,UAAM,WAAW,IAAI,SAAS,MAAM,SAAS,KAAK,GAAG;AAAA,MACnD,QAAQ,SAAS;AAAA,MACjB,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,IAC7E,CAAC;AAID,QAAI,CAAC,UAAU,aAAa,aAAa;AACvC,eAAS,QAAQ,OAAO,cAAc,gBAAgB,QAAQ,CAAC;AAAA,IACjE;AAEA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,OAAO;AACrD;AAEA,IAAM,iBAAiB,cAAc;AAE9B,IAAM,MAAM,eAAe;AAC3B,IAAM,OAAO,eAAe;AAC5B,IAAM,SAAS,eAAe;AAErC,eAAe,UACb,SACA,SACA,SACiB;AACjB,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,QAAQ,OAAO,OAAQ,QAAO,OAAO,MAAM,IAAI,kBAAkB,EAAE,KAAK,GAAG;AAE/E,QAAM,EAAE,SAAS,IAAI,IAAI,IAAI,QAAQ,GAAG;AACxC,QAAM,QAAQ,SAAS,QAAQ,OAAO;AACtC,SAAO,UAAU,KAAK,KAAK,SAAS,MAAM,QAAQ,QAAQ,MAAM,EAAE,QAAQ,OAAO,EAAE;AACrF;AAMA,SAAS,gBAAgB,SAAiC;AACxD,QAAM,UAAU,QAAQ,QAAQ,IAAI,aAAa;AACjD,SAAO,WAAW,kBAAkB,KAAK,OAAO,IAAI,UAAU;AAChE;AAEA,SAAS,WAAW,SAAkB,MAA6B;AACjE,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACnE,SAAO,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACrD;AAEA,SAAS,gBAAgB,UAA0B;AACjD,QAAM,QAAQ;AAAA,IACZ,GAAG,gBAAgB,IAAI,mBAAmB,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,WAAW,iBAAiB;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,aAAa,aAAc,OAAM,KAAK,QAAQ;AAC9D,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,KAAK,MAAe,QAA0B;AACrD,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,EAC7E,CAAC;AACH;","names":["import_server_only","import_core"]}
+{"version":3,"sources":["../src/handler.ts","../src/config.ts","../src/version.ts","../src/constants.ts"],"sourcesContent":["import \"server-only\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport {\n  configuredAppId,\n  requestHostname,\n  resolveApiKey,\n  resolveApiPath,\n  resolveBaseUrl,\n} from \"./config\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE, SDK_HEADER } from \"./constants\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface HandlerOptions {\n  apiKey?: string;\n  baseUrl?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n  /** Where the handler is mounted, when it is not `/api/fewchurs`. */\n  apiPath?: string;\n  /** Return a stable, hashed id for the signed-in visitor so votes follow the account. */\n  deviceId?: DeviceIdResolver;\n}\n\ntype RouteParams = { route?: string[] };\n\n/** What Next passes: a Promise in 15, a plain object in 14. Both are awaited the same way. */\ntype IncomingContext = { params?: RouteParams | Promise<RouteParams> };\n\n// Next 15's route check wants a required second argument whose `params` is a Promise. The\n// handler itself takes `IncomingContext`, so Next 14's plain object still works at runtime.\ntype RouteContext = { params: Promise<RouteParams> };\n\nexport type RouteHandler = (request: Request, context: RouteContext) => Promise<Response>;\n\n/** Only the endpoints the board needs: everything else is a 404, not a proxy to the API. */\nconst ALLOWED: Array<{ method: string; pattern: RegExp }> = [\n  { method: \"GET\", pattern: /^config$/ },\n  { method: \"GET\", pattern: /^features$/ },\n  { method: \"POST\", pattern: /^features$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+\\/comments$/ },\n  { method: \"POST\", pattern: /^comments$/ },\n];\n\nconst DEVICE_ID_PATTERN = /^[A-Za-z0-9_-]{8,128}$/;\n\nexport function createHandler(options: HandlerOptions = {}): {\n  GET: RouteHandler;\n  POST: RouteHandler;\n  DELETE: RouteHandler;\n} {\n  async function handle(request: Request, context?: IncomingContext): Promise<Response> {\n    const path = await routePath(request, context, resolveApiPath(options.apiPath));\n\n    if (!ALLOWED.some((route) => route.method === request.method && route.pattern.test(path))) {\n      return json({ error: { code: \"not_found\", message: \"Unknown Fewchurs route.\" } }, 404);\n    }\n\n    const apiKey = resolveApiKey(options.apiKey);\n    if (!apiKey) {\n      console.error(\n        \"[fewchurs] No API key. Set FEWCHURS_API_KEY, or pass apiKey to createHandler().\",\n      );\n      return json({ error: { code: \"internal\", message: \"Fewchurs is not configured.\" } }, 500);\n    }\n\n    const cookieValue = readCookie(request, DEVICE_ID_COOKIE);\n    const custom = options.deviceId ? await options.deviceId() : null;\n    const deviceId = custom ?? cookieValue ?? claimedDeviceId(request) ?? createDeviceId();\n\n    const target = `${resolveBaseUrl(options.baseUrl)}/${path}${new URL(request.url).search}`;\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${apiKey}`,\n      \"X-Device-Id\": deviceId,\n      \"X-Fewchurs-Sdk\": SDK_HEADER,\n      \"X-Fewchurs-App-Id\":\n        configuredAppId(options.appId) ??\n        requestHostname(request.headers) ??\n        new URL(request.url).hostname,\n      Accept: \"application/json\",\n    };\n    const language = request.headers.get(\"accept-language\");\n    if (language) headers[\"Accept-Language\"] = language;\n\n    const body = request.method === \"GET\" ? undefined : await request.text();\n    if (body) headers[\"Content-Type\"] = \"application/json\";\n\n    let upstream: Response;\n    try {\n      upstream = await fetch(target, { method: request.method, headers, body, cache: \"no-store\" });\n    } catch {\n      return json({ error: { code: \"internal\", message: \"Could not reach Fewchurs.\" } }, 502);\n    }\n\n    const text = await upstream.text();\n    if (upstream.status === 403) logRefusal(text);\n\n    const response = new Response(text, {\n      status: upstream.status,\n      headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n    });\n\n    // A visitor keeps the same id across requests without the browser ever seeing the key,\n    // and an httpOnly cookie means page scripts cannot read or change it either.\n    if (!custom && deviceId !== cookieValue) {\n      response.headers.append(\"Set-Cookie\", serializeCookie(deviceId));\n    }\n\n    return response;\n  }\n\n  return { GET: handle, POST: handle, DELETE: handle };\n}\n\nconst defaultHandler = createHandler();\n\nexport const GET = defaultHandler.GET;\nexport const POST = defaultHandler.POST;\nexport const DELETE = defaultHandler.DELETE;\n\nlet loggedRefusal = false;\n\n/** Visitors only see a safe message, so a live site's server log is where the domain gets named. */\nfunction logRefusal(body: string): void {\n  if (loggedRefusal) return;\n  try {\n    const error = (JSON.parse(body) as { error?: { code?: string; message?: string } }).error;\n    if (error?.code !== \"wrong_app\") return;\n    loggedRefusal = true;\n    console.error(`[fewchurs] ${error.message}`);\n  } catch {\n    // Not JSON, so it isn't a refusal from Fewchurs.\n  }\n}\n\nasync function routePath(\n  request: Request,\n  context: IncomingContext | undefined,\n  apiPath: string,\n): Promise<string> {\n  const params = await context?.params;\n  if (params?.route?.length) return params.route.map(encodeURIComponent).join(\"/\");\n\n  const { pathname } = new URL(request.url);\n  const index = pathname.indexOf(apiPath);\n  return index === -1 ? \"\" : pathname.slice(index + apiPath.length).replace(/^\\//, \"\");\n}\n\n/**\n * The first request from a server-rendered board carries the id the page was rendered with,\n * so adopting it keeps the server's `hasVoted` answers and the browser's in agreement.\n */\nfunction claimedDeviceId(request: Request): string | null {\n  const claimed = request.headers.get(\"x-device-id\");\n  return claimed && DEVICE_ID_PATTERN.test(claimed) ? claimed : null;\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n  const header = request.headers.get(\"cookie\");\n  if (!header) return null;\n  const match = header.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match?.[1] ? decodeURIComponent(match[1]) : null;\n}\n\nfunction serializeCookie(deviceId: string): string {\n  const parts = [\n    `${DEVICE_ID_COOKIE}=${encodeURIComponent(deviceId)}`,\n    \"Path=/\",\n    `Max-Age=${DEVICE_ID_MAX_AGE}`,\n    \"HttpOnly\",\n    \"SameSite=Lax\",\n  ];\n  if (process.env.NODE_ENV === \"production\") parts.push(\"Secure\");\n  return parts.join(\"; \");\n}\n\nfunction json(body: unknown, status: number): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n  });\n}\n","import \"server-only\";\nimport { headers } from \"next/headers\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\n/** A domain set by the developer, which replaces the one read from the request. */\nexport function configuredAppId(appId?: string): string | undefined {\n  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || undefined;\n}\n\n/** The site's host name without a port. A reverse proxy reports the public one in `x-forwarded-host`. */\nexport function requestHostname(requestHeaders: Headers): string | undefined {\n  const forwarded = requestHeaders.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  const host = forwarded || requestHeaders.get(\"host\")?.trim();\n  if (!host) return undefined;\n  try {\n    return new URL(`http://${host}`).hostname;\n  } catch {\n    return undefined;\n  }\n}\n\nexport async function serverClient(\n  deviceId: string | null,\n  config: ServerConfig = {},\n): Promise<FewchursClient> {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n    // Only read the request when needed, so a page with a set domain can still render statically.\n    appId: configuredAppId(config.appId) ?? requestHostname(await headers()),\n  });\n}\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.1.0\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAAA,sBAAO;AACP,IAAAC,eAA+B;;;ACD/B,yBAAO;AACP,qBAAwB;AACxB,kBAA4E;AAErE,IAAM,mBAAmB;AAUzB,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAEO,SAAS,eAAe,SAA0B;AACvD,UAAQ,WAAW,QAAQ,IAAI,qBAAqB,kBAAkB,QAAQ,OAAO,EAAE;AACzF;AAGO,SAAS,gBAAgB,OAAoC;AAClE,SAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,KAAK,KAAK;AACjE;AAGO,SAAS,gBAAgB,gBAA6C;AAC3E,QAAM,YAAY,eAAe,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAC9E,QAAM,OAAO,aAAa,eAAe,IAAI,MAAM,GAAG,KAAK;AAC3D,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,IAAI,EAAE,EAAE;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACxCO,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AH8B7C,IAAM,UAAsD;AAAA,EAC1D,EAAE,QAAQ,OAAO,SAAS,WAAW;AAAA,EACrC,EAAE,QAAQ,OAAO,SAAS,aAAa;AAAA,EACvC,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAAA,EACxC,EAAE,QAAQ,OAAO,SAAS,oBAAoB;AAAA,EAC9C,EAAE,QAAQ,QAAQ,SAAS,0BAA0B;AAAA,EACrD,EAAE,QAAQ,UAAU,SAAS,0BAA0B;AAAA,EACvD,EAAE,QAAQ,QAAQ,SAAS,4BAA4B;AAAA,EACvD,EAAE,QAAQ,UAAU,SAAS,4BAA4B;AAAA,EACzD,EAAE,QAAQ,OAAO,SAAS,8BAA8B;AAAA,EACxD,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAC1C;AAEA,IAAM,oBAAoB;AAEnB,SAAS,cAAc,UAA0B,CAAC,GAIvD;AACA,iBAAe,OAAO,SAAkB,SAA8C;AACpF,UAAM,OAAO,MAAM,UAAU,SAAS,SAAS,eAAe,QAAQ,OAAO,CAAC;AAE9E,QAAI,CAAC,QAAQ,KAAK,CAAC,UAAU,MAAM,WAAW,QAAQ,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG;AACzF,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,SAAS,0BAA0B,EAAE,GAAG,GAAG;AAAA,IACvF;AAEA,UAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,QAAI,CAAC,QAAQ;AACX,cAAQ;AAAA,QACN;AAAA,MACF;AACA,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,8BAA8B,EAAE,GAAG,GAAG;AAAA,IAC1F;AAEA,UAAM,cAAc,WAAW,SAAS,gBAAgB;AACxD,UAAM,SAAS,QAAQ,WAAW,MAAM,QAAQ,SAAS,IAAI;AAC7D,UAAM,WAAW,UAAU,eAAe,gBAAgB,OAAO,SAAK,6BAAe;AAErF,UAAM,SAAS,GAAG,eAAe,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,MAAM;AACvF,UAAMC,WAAkC;AAAA,MACtC,eAAe,UAAU,MAAM;AAAA,MAC/B,eAAe;AAAA,MACf,kBAAkB;AAAA,MAClB,qBACE,gBAAgB,QAAQ,KAAK,KAC7B,gBAAgB,QAAQ,OAAO,KAC/B,IAAI,IAAI,QAAQ,GAAG,EAAE;AAAA,MACvB,QAAQ;AAAA,IACV;AACA,UAAM,WAAW,QAAQ,QAAQ,IAAI,iBAAiB;AACtD,QAAI,SAAU,CAAAA,SAAQ,iBAAiB,IAAI;AAE3C,UAAM,OAAO,QAAQ,WAAW,QAAQ,SAAY,MAAM,QAAQ,KAAK;AACvE,QAAI,KAAM,CAAAA,SAAQ,cAAc,IAAI;AAEpC,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,QAAQ,EAAE,QAAQ,QAAQ,QAAQ,SAAAA,UAAS,MAAM,OAAO,WAAW,CAAC;AAAA,IAC7F,QAAQ;AACN,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,4BAA4B,EAAE,GAAG,GAAG;AAAA,IACxF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,SAAS,WAAW,IAAK,YAAW,IAAI;AAE5C,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ,SAAS;AAAA,MACjB,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,IAC7E,CAAC;AAID,QAAI,CAAC,UAAU,aAAa,aAAa;AACvC,eAAS,QAAQ,OAAO,cAAc,gBAAgB,QAAQ,CAAC;AAAA,IACjE;AAEA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,OAAO;AACrD;AAEA,IAAM,iBAAiB,cAAc;AAE9B,IAAM,MAAM,eAAe;AAC3B,IAAM,OAAO,eAAe;AAC5B,IAAM,SAAS,eAAe;AAErC,IAAI,gBAAgB;AAGpB,SAAS,WAAW,MAAoB;AACtC,MAAI,cAAe;AACnB,MAAI;AACF,UAAM,QAAS,KAAK,MAAM,IAAI,EAAsD;AACpF,QAAI,OAAO,SAAS,YAAa;AACjC,oBAAgB;AAChB,YAAQ,MAAM,cAAc,MAAM,OAAO,EAAE;AAAA,EAC7C,QAAQ;AAAA,EAER;AACF;AAEA,eAAe,UACb,SACA,SACA,SACiB;AACjB,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,QAAQ,OAAO,OAAQ,QAAO,OAAO,MAAM,IAAI,kBAAkB,EAAE,KAAK,GAAG;AAE/E,QAAM,EAAE,SAAS,IAAI,IAAI,IAAI,QAAQ,GAAG;AACxC,QAAM,QAAQ,SAAS,QAAQ,OAAO;AACtC,SAAO,UAAU,KAAK,KAAK,SAAS,MAAM,QAAQ,QAAQ,MAAM,EAAE,QAAQ,OAAO,EAAE;AACrF;AAMA,SAAS,gBAAgB,SAAiC;AACxD,QAAM,UAAU,QAAQ,QAAQ,IAAI,aAAa;AACjD,SAAO,WAAW,kBAAkB,KAAK,OAAO,IAAI,UAAU;AAChE;AAEA,SAAS,WAAW,SAAkB,MAA6B;AACjE,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACnE,SAAO,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACrD;AAEA,SAAS,gBAAgB,UAA0B;AACjD,QAAM,QAAQ;AAAA,IACZ,GAAG,gBAAgB,IAAI,mBAAmB,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,WAAW,iBAAiB;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,aAAa,aAAc,OAAM,KAAK,QAAQ;AAC9D,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,KAAK,MAAe,QAA0B;AACrD,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,EAC7E,CAAC;AACH;","names":["import_server_only","import_core","headers"]}

package/dist/handler.mjs

@@ -3,8 +3,8 @@ import {
   GET,
   POST,
   createHandler
-} from "./chunk-KPJHLDQU.mjs";
-import "./chunk-W6QR6DEB.mjs";
+} from "./chunk-ZRYXVCLB.mjs";
+import "./chunk-L57II7SI.mjs";
 export {
   DELETE,
   GET,

package/dist/identity.js

@@ -33,7 +33,7 @@ var import_headers = require("next/headers");
 var import_core = require("@fewchurs/react/core");
 
 // src/version.ts
-var SDK_VERSION = "1.0.1";
+var SDK_VERSION = "1.1.0";
 
 // src/constants.ts
 var DEVICE_ID_COOKIE = "fewchurs_did";

package/dist/identity.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/identity.ts","../src/version.ts","../src/constants.ts"],"sourcesContent":["import \"server-only\";\nimport { cookies } from \"next/headers\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE } from \"./constants\";\n\nexport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE };\n\nexport type DeviceIdResolver = () => string | Promise<string>;\n\n/** The visitor's id, or null when nothing has been stored for them yet. */\nexport async function readDeviceId(): Promise<string | null> {\n  const store = await cookies();\n  return store.get(DEVICE_ID_COOKIE)?.value ?? null;\n}\n\n/**\n * Reads the cookie, falling back to a fresh id. The value is not persisted here: a server\n * component cannot set cookies, so the route handler stores it on the first request instead.\n */\nexport async function resolveDeviceId(custom?: DeviceIdResolver): Promise<string> {\n  if (custom) return custom();\n  return (await readDeviceId()) ?? createDeviceId();\n}\n\nexport function deviceIdCookie(deviceId: string): {\n  name: string;\n  value: string;\n  options: {\n    httpOnly: true;\n    sameSite: \"lax\";\n    path: string;\n    maxAge: number;\n    secure: boolean;\n  };\n} {\n  return {\n    name: DEVICE_ID_COOKIE,\n    value: deviceId,\n    options: {\n      httpOnly: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: DEVICE_ID_MAX_AGE,\n      secure: process.env.NODE_ENV === \"production\",\n    },\n  };\n}\n\nexport { createDeviceId };\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.0.1\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAAO;AACP,qBAAwB;AACxB,kBAA+B;;;ACDxB,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AFK7C,eAAsB,eAAuC;AAC3D,QAAM,QAAQ,UAAM,wBAAQ;AAC5B,SAAO,MAAM,IAAI,gBAAgB,GAAG,SAAS;AAC/C;AAMA,eAAsB,gBAAgB,QAA4C;AAChF,MAAI,OAAQ,QAAO,OAAO;AAC1B,SAAQ,MAAM,aAAa,SAAM,4BAAe;AAClD;AAEO,SAAS,eAAe,UAU7B;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SAAS;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,MACV,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/identity.ts","../src/version.ts","../src/constants.ts"],"sourcesContent":["import \"server-only\";\nimport { cookies } from \"next/headers\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE } from \"./constants\";\n\nexport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE };\n\nexport type DeviceIdResolver = () => string | Promise<string>;\n\n/** The visitor's id, or null when nothing has been stored for them yet. */\nexport async function readDeviceId(): Promise<string | null> {\n  const store = await cookies();\n  return store.get(DEVICE_ID_COOKIE)?.value ?? null;\n}\n\n/**\n * Reads the cookie, falling back to a fresh id. The value is not persisted here: a server\n * component cannot set cookies, so the route handler stores it on the first request instead.\n */\nexport async function resolveDeviceId(custom?: DeviceIdResolver): Promise<string> {\n  if (custom) return custom();\n  return (await readDeviceId()) ?? createDeviceId();\n}\n\nexport function deviceIdCookie(deviceId: string): {\n  name: string;\n  value: string;\n  options: {\n    httpOnly: true;\n    sameSite: \"lax\";\n    path: string;\n    maxAge: number;\n    secure: boolean;\n  };\n} {\n  return {\n    name: DEVICE_ID_COOKIE,\n    value: deviceId,\n    options: {\n      httpOnly: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: DEVICE_ID_MAX_AGE,\n      secure: process.env.NODE_ENV === \"production\",\n    },\n  };\n}\n\nexport { createDeviceId };\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.1.0\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAAO;AACP,qBAAwB;AACxB,kBAA+B;;;ACDxB,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AFK7C,eAAsB,eAAuC;AAC3D,QAAM,QAAQ,UAAM,wBAAQ;AAC5B,SAAO,MAAM,IAAI,gBAAgB,GAAG,SAAS;AAC/C;AAMA,eAAsB,gBAAgB,QAA4C;AAChF,MAAI,OAAQ,QAAO,OAAO;AAC1B,SAAQ,MAAM,aAAa,SAAM,4BAAe;AAClD;AAEO,SAAS,eAAe,UAU7B;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SAAS;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,MACV,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}

package/dist/identity.mjs

@@ -3,11 +3,11 @@ import {
   deviceIdCookie,
   readDeviceId,
   resolveDeviceId
-} from "./chunk-QULKPZB4.mjs";
+} from "./chunk-DM357WK6.mjs";
 import {
   DEVICE_ID_COOKIE,
   DEVICE_ID_MAX_AGE
-} from "./chunk-W6QR6DEB.mjs";
+} from "./chunk-L57II7SI.mjs";
 export {
   DEVICE_ID_COOKIE,
   DEVICE_ID_MAX_AGE,

package/dist/index.d.mts

@@ -13,15 +13,19 @@ interface FewchursBoardProps extends SerializableBoardProps {
     /** Where your route handler is mounted. Defaults to `/api/fewchurs`. */
     apiPath?: string;
     language?: string;
+    /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */
+    appId?: string;
     deviceId?: DeviceIdResolver;
 }
-declare function FewchursBoard({ apiKey, baseUrl, apiPath, language, deviceId: deviceIdOption, ...board }: FewchursBoardProps): Promise<React.JSX.Element>;
+declare function FewchursBoard({ apiKey, baseUrl, apiPath, language, appId, deviceId: deviceIdOption, ...board }: FewchursBoardProps): Promise<React.JSX.Element>;
 
 declare const DEFAULT_API_PATH = "/api/fewchurs";
 interface ServerConfig {
     apiKey?: string;
     baseUrl?: string;
     language?: string;
+    /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */
+    appId?: string;
 }
 
 export { DEFAULT_API_PATH, DeviceIdResolver, FewchursBoard, type FewchursBoardProps, type ServerConfig };

package/dist/index.d.ts

@@ -13,15 +13,19 @@ interface FewchursBoardProps extends SerializableBoardProps {
     /** Where your route handler is mounted. Defaults to `/api/fewchurs`. */
     apiPath?: string;
     language?: string;
+    /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */
+    appId?: string;
     deviceId?: DeviceIdResolver;
 }
-declare function FewchursBoard({ apiKey, baseUrl, apiPath, language, deviceId: deviceIdOption, ...board }: FewchursBoardProps): Promise<React.JSX.Element>;
+declare function FewchursBoard({ apiKey, baseUrl, apiPath, language, appId, deviceId: deviceIdOption, ...board }: FewchursBoardProps): Promise<React.JSX.Element>;
 
 declare const DEFAULT_API_PATH = "/api/fewchurs";
 interface ServerConfig {
     apiKey?: string;
     baseUrl?: string;
     language?: string;
+    /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */
+    appId?: string;
 }
 
 export { DEFAULT_API_PATH, DeviceIdResolver, FewchursBoard, type FewchursBoardProps, type ServerConfig };

package/dist/index.js

@@ -36,6 +36,7 @@ var import_core3 = require("@fewchurs/react/core");
 
 // src/config.ts
 var import_server_only = require("server-only");
+var import_headers = require("next/headers");
 var import_core = require("@fewchurs/react/core");
 var DEFAULT_API_PATH = "/api/fewchurs";
 function resolveApiKey(apiKey) {
@@ -47,7 +48,20 @@ function resolveBaseUrl(baseUrl) {
 function resolveApiPath(apiPath) {
   return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\/$/, "");
 }
-function serverClient(deviceId, config = {}) {
+function configuredAppId(appId) {
+  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || void 0;
+}
+function requestHostname(requestHeaders) {
+  const forwarded = requestHeaders.get("x-forwarded-host")?.split(",")[0]?.trim();
+  const host = forwarded || requestHeaders.get("host")?.trim();
+  if (!host) return void 0;
+  try {
+    return new URL(`http://${host}`).hostname;
+  } catch {
+    return void 0;
+  }
+}
+async function serverClient(deviceId, config = {}) {
   const apiKey = resolveApiKey(config.apiKey);
   if (!apiKey) {
     throw new Error(
@@ -58,17 +72,19 @@ function serverClient(deviceId, config = {}) {
     apiKey,
     baseUrl: resolveBaseUrl(config.baseUrl),
     deviceId,
-    language: config.language
+    language: config.language,
+    // Only read the request when needed, so a page with a set domain can still render statically.
+    appId: configuredAppId(config.appId) ?? requestHostname(await (0, import_headers.headers)())
   });
 }
 
 // src/identity.ts
 var import_server_only2 = require("server-only");
-var import_headers = require("next/headers");
+var import_headers2 = require("next/headers");
 var import_core2 = require("@fewchurs/react/core");
 
 // src/version.ts
-var SDK_VERSION = "1.0.1";
+var SDK_VERSION = "1.1.0";
 
 // src/constants.ts
 var DEVICE_ID_COOKIE = "fewchurs_did";
@@ -77,7 +93,7 @@ var SDK_HEADER = `next/${SDK_VERSION}`;
 
 // src/identity.ts
 async function readDeviceId() {
-  const store = await (0, import_headers.cookies)();
+  const store = await (0, import_headers2.cookies)();
   return store.get(DEVICE_ID_COOKIE)?.value ?? null;
 }
 async function resolveDeviceId(custom) {
@@ -92,11 +108,12 @@ async function FewchursBoard({
   baseUrl,
   apiPath,
   language,
+  appId,
   deviceId: deviceIdOption,
   ...board
 }) {
   const deviceId = await resolveDeviceId(deviceIdOption);
-  const client = serverClient(deviceId, { apiKey, baseUrl, language });
+  const client = await serverClient(deviceId, { apiKey, baseUrl, language, appId });
   const tab = board.defaultTab ?? board.tabs?.[0] ?? "top";
   const sort = tab === "roadmap" ? "top" : tab;
   const status = tab === "roadmap" ? import_core3.ROADMAP_STATUSES : void 0;
@@ -172,23 +189,26 @@ function createHandler(options = {}) {
     const custom = options.deviceId ? await options.deviceId() : null;
     const deviceId = custom ?? cookieValue ?? claimedDeviceId(request) ?? (0, import_core4.createDeviceId)();
     const target = `${resolveBaseUrl(options.baseUrl)}/${path}${new URL(request.url).search}`;
-    const headers = {
+    const headers2 = {
       Authorization: `Bearer ${apiKey}`,
       "X-Device-Id": deviceId,
-      "X-Fewchurs-Sdk": request.headers.get("x-fewchurs-sdk") ?? SDK_HEADER,
+      "X-Fewchurs-Sdk": SDK_HEADER,
+      "X-Fewchurs-App-Id": configuredAppId(options.appId) ?? requestHostname(request.headers) ?? new URL(request.url).hostname,
       Accept: "application/json"
     };
     const language = request.headers.get("accept-language");
-    if (language) headers["Accept-Language"] = language;
+    if (language) headers2["Accept-Language"] = language;
     const body = request.method === "GET" ? void 0 : await request.text();
-    if (body) headers["Content-Type"] = "application/json";
+    if (body) headers2["Content-Type"] = "application/json";
     let upstream;
     try {
-      upstream = await fetch(target, { method: request.method, headers, body, cache: "no-store" });
+      upstream = await fetch(target, { method: request.method, headers: headers2, body, cache: "no-store" });
     } catch {
       return json({ error: { code: "internal", message: "Could not reach Fewchurs." } }, 502);
     }
-    const response = new Response(await upstream.text(), {
+    const text = await upstream.text();
+    if (upstream.status === 403) logRefusal(text);
+    const response = new Response(text, {
       status: upstream.status,
       headers: { "Content-Type": "application/json", "Cache-Control": "no-store" }
     });
@@ -203,6 +223,17 @@ var defaultHandler = createHandler();
 var GET = defaultHandler.GET;
 var POST = defaultHandler.POST;
 var DELETE = defaultHandler.DELETE;
+var loggedRefusal = false;
+function logRefusal(body) {
+  if (loggedRefusal) return;
+  try {
+    const error = JSON.parse(body).error;
+    if (error?.code !== "wrong_app") return;
+    loggedRefusal = true;
+    console.error(`[fewchurs] ${error.message}`);
+  } catch {
+  }
+}
 async function routePath(request, context, apiPath) {
   const params = await context?.params;
   if (params?.route?.length) return params.route.map(encodeURIComponent).join("/");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/board.tsx","../src/config.ts","../src/identity.ts","../src/version.ts","../src/constants.ts","../src/handler.ts"],"sourcesContent":["export { FewchursBoard } from \"./board\";\nexport type { FewchursBoardProps } from \"./board\";\nexport { createHandler } from \"./handler\";\nexport type { HandlerOptions, RouteHandler } from \"./handler\";\nexport { DEVICE_ID_COOKIE, readDeviceId, resolveDeviceId } from \"./identity\";\nexport type { DeviceIdResolver } from \"./identity\";\nexport { DEFAULT_API_PATH } from \"./config\";\nexport type { ServerConfig } from \"./config\";\n\nexport type {\n  Comment,\n  CommentPage,\n  Feature,\n  FeaturePage,\n  FeatureSort,\n  FeatureStatus,\n  FewchursConfig,\n  FewchursError,\n} from \"@fewchurs/react/core\";\n","import \"server-only\";\nimport { FewchursBoard as ClientBoard, FewchursProvider } from \"@fewchurs/react\";\nimport type { FewchursBoardProps as ClientBoardProps } from \"@fewchurs/react\";\nimport {\n  featureKey,\n  listKey,\n  ROADMAP_STATUSES,\n  type FeatureSort,\n  type StoreState,\n} from \"@fewchurs/react/core\";\nimport { resolveApiPath, serverClient } from \"./config\";\nimport { resolveDeviceId, type DeviceIdResolver } from \"./identity\";\n\n/** Function props cannot cross the server/client boundary — compose in your own client file. */\ntype SerializableBoardProps = Omit<\n  ClientBoardProps,\n  \"renderHeader\" | \"renderEmpty\" | \"renderFeature\" | \"children\"\n>;\n\nexport interface FewchursBoardProps extends SerializableBoardProps {\n  /** Defaults to `process.env.FEWCHURS_API_KEY`. Never reaches the browser. */\n  apiKey?: string;\n  baseUrl?: string;\n  /** Where your route handler is mounted. Defaults to `/api/fewchurs`. */\n  apiPath?: string;\n  language?: string;\n  deviceId?: DeviceIdResolver;\n}\n\nexport async function FewchursBoard({\n  apiKey,\n  baseUrl,\n  apiPath,\n  language,\n  deviceId: deviceIdOption,\n  ...board\n}: FewchursBoardProps): Promise<React.JSX.Element> {\n  const deviceId = await resolveDeviceId(deviceIdOption);\n  const client = serverClient(deviceId, { apiKey, baseUrl, language });\n\n  const tab = board.defaultTab ?? board.tabs?.[0] ?? \"top\";\n  const sort: FeatureSort = tab === \"roadmap\" ? \"top\" : tab;\n  const status = tab === \"roadmap\" ? ROADMAP_STATUSES : undefined;\n  const pageSize = board.pageSize ?? 20;\n\n  const [config, page, pinned] = await Promise.all([\n    client.getConfig(),\n    client.listFeatures({ sort, status, limit: pageSize }),\n    board.initialFeatureId ? client.getFeature(board.initialFeatureId) : null,\n  ]);\n\n  // Seeded under the same key the client hook will ask for, so the first paint is the\n  // rendered HTML and no second request goes out just to fetch what is already there.\n  const lists: StoreState[\"lists\"] = {};\n  if (page.ok) {\n    lists[listKey({ sort, status })] = {\n      features: page.data.features,\n      cursor: page.data.nextCursor,\n      status: \"ready\",\n      error: null,\n    };\n  }\n  // A deep-linked request is rendered on the server too, so the link lands on real content.\n  if (board.initialFeatureId && pinned?.ok) {\n    lists[featureKey(board.initialFeatureId)] = {\n      features: [pinned.data],\n      cursor: null,\n      status: \"ready\",\n      error: null,\n    };\n  }\n\n  const initialState: Partial<StoreState> = {\n    config: config.ok ? config.data : null,\n    lists,\n  };\n\n  return (\n    <FewchursProvider\n      baseUrl={resolveApiPath(apiPath)}\n      deviceId={deviceId}\n      pageSize={pageSize}\n      initialState={initialState}\n    >\n      <ClientBoard {...board} />\n    </FewchursProvider>\n  );\n}\n","import \"server-only\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\nexport function serverClient(deviceId: string | null, config: ServerConfig = {}): FewchursClient {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n  });\n}\n","import \"server-only\";\nimport { cookies } from \"next/headers\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE } from \"./constants\";\n\nexport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE };\n\nexport type DeviceIdResolver = () => string | Promise<string>;\n\n/** The visitor's id, or null when nothing has been stored for them yet. */\nexport async function readDeviceId(): Promise<string | null> {\n  const store = await cookies();\n  return store.get(DEVICE_ID_COOKIE)?.value ?? null;\n}\n\n/**\n * Reads the cookie, falling back to a fresh id. The value is not persisted here: a server\n * component cannot set cookies, so the route handler stores it on the first request instead.\n */\nexport async function resolveDeviceId(custom?: DeviceIdResolver): Promise<string> {\n  if (custom) return custom();\n  return (await readDeviceId()) ?? createDeviceId();\n}\n\nexport function deviceIdCookie(deviceId: string): {\n  name: string;\n  value: string;\n  options: {\n    httpOnly: true;\n    sameSite: \"lax\";\n    path: string;\n    maxAge: number;\n    secure: boolean;\n  };\n} {\n  return {\n    name: DEVICE_ID_COOKIE,\n    value: deviceId,\n    options: {\n      httpOnly: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: DEVICE_ID_MAX_AGE,\n      secure: process.env.NODE_ENV === \"production\",\n    },\n  };\n}\n\nexport { createDeviceId };\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.0.1\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n","import \"server-only\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { resolveApiKey, resolveApiPath, resolveBaseUrl } from \"./config\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE, SDK_HEADER } from \"./constants\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface HandlerOptions {\n  apiKey?: string;\n  baseUrl?: string;\n  /** Where the handler is mounted, when it is not `/api/fewchurs`. */\n  apiPath?: string;\n  /** Return a stable, hashed id for the signed-in visitor so votes follow the account. */\n  deviceId?: DeviceIdResolver;\n}\n\ntype RouteParams = { route?: string[] };\n\n/** What Next passes: a Promise in 15, a plain object in 14. Both are awaited the same way. */\ntype IncomingContext = { params?: RouteParams | Promise<RouteParams> };\n\n// Next 15's route check wants a required second argument whose `params` is a Promise. The\n// handler itself takes `IncomingContext`, so Next 14's plain object still works at runtime.\ntype RouteContext = { params: Promise<RouteParams> };\n\nexport type RouteHandler = (request: Request, context: RouteContext) => Promise<Response>;\n\n/** Only the endpoints the board needs: everything else is a 404, not a proxy to the API. */\nconst ALLOWED: Array<{ method: string; pattern: RegExp }> = [\n  { method: \"GET\", pattern: /^config$/ },\n  { method: \"GET\", pattern: /^features$/ },\n  { method: \"POST\", pattern: /^features$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+\\/comments$/ },\n  { method: \"POST\", pattern: /^comments$/ },\n];\n\nconst DEVICE_ID_PATTERN = /^[A-Za-z0-9_-]{8,128}$/;\n\nexport function createHandler(options: HandlerOptions = {}): {\n  GET: RouteHandler;\n  POST: RouteHandler;\n  DELETE: RouteHandler;\n} {\n  async function handle(request: Request, context?: IncomingContext): Promise<Response> {\n    const path = await routePath(request, context, resolveApiPath(options.apiPath));\n\n    if (!ALLOWED.some((route) => route.method === request.method && route.pattern.test(path))) {\n      return json({ error: { code: \"not_found\", message: \"Unknown Fewchurs route.\" } }, 404);\n    }\n\n    const apiKey = resolveApiKey(options.apiKey);\n    if (!apiKey) {\n      console.error(\n        \"[fewchurs] No API key. Set FEWCHURS_API_KEY, or pass apiKey to createHandler().\",\n      );\n      return json({ error: { code: \"internal\", message: \"Fewchurs is not configured.\" } }, 500);\n    }\n\n    const cookieValue = readCookie(request, DEVICE_ID_COOKIE);\n    const custom = options.deviceId ? await options.deviceId() : null;\n    const deviceId = custom ?? cookieValue ?? claimedDeviceId(request) ?? createDeviceId();\n\n    const target = `${resolveBaseUrl(options.baseUrl)}/${path}${new URL(request.url).search}`;\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${apiKey}`,\n      \"X-Device-Id\": deviceId,\n      \"X-Fewchurs-Sdk\": request.headers.get(\"x-fewchurs-sdk\") ?? SDK_HEADER,\n      Accept: \"application/json\",\n    };\n    const language = request.headers.get(\"accept-language\");\n    if (language) headers[\"Accept-Language\"] = language;\n\n    const body = request.method === \"GET\" ? undefined : await request.text();\n    if (body) headers[\"Content-Type\"] = \"application/json\";\n\n    let upstream: Response;\n    try {\n      upstream = await fetch(target, { method: request.method, headers, body, cache: \"no-store\" });\n    } catch {\n      return json({ error: { code: \"internal\", message: \"Could not reach Fewchurs.\" } }, 502);\n    }\n\n    const response = new Response(await upstream.text(), {\n      status: upstream.status,\n      headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n    });\n\n    // A visitor keeps the same id across requests without the browser ever seeing the key,\n    // and an httpOnly cookie means page scripts cannot read or change it either.\n    if (!custom && deviceId !== cookieValue) {\n      response.headers.append(\"Set-Cookie\", serializeCookie(deviceId));\n    }\n\n    return response;\n  }\n\n  return { GET: handle, POST: handle, DELETE: handle };\n}\n\nconst defaultHandler = createHandler();\n\nexport const GET = defaultHandler.GET;\nexport const POST = defaultHandler.POST;\nexport const DELETE = defaultHandler.DELETE;\n\nasync function routePath(\n  request: Request,\n  context: IncomingContext | undefined,\n  apiPath: string,\n): Promise<string> {\n  const params = await context?.params;\n  if (params?.route?.length) return params.route.map(encodeURIComponent).join(\"/\");\n\n  const { pathname } = new URL(request.url);\n  const index = pathname.indexOf(apiPath);\n  return index === -1 ? \"\" : pathname.slice(index + apiPath.length).replace(/^\\//, \"\");\n}\n\n/**\n * The first request from a server-rendered board carries the id the page was rendered with,\n * so adopting it keeps the server's `hasVoted` answers and the browser's in agreement.\n */\nfunction claimedDeviceId(request: Request): string | null {\n  const claimed = request.headers.get(\"x-device-id\");\n  return claimed && DEVICE_ID_PATTERN.test(claimed) ? claimed : null;\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n  const header = request.headers.get(\"cookie\");\n  if (!header) return null;\n  const match = header.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match?.[1] ? decodeURIComponent(match[1]) : null;\n}\n\nfunction serializeCookie(deviceId: string): string {\n  const parts = [\n    `${DEVICE_ID_COOKIE}=${encodeURIComponent(deviceId)}`,\n    \"Path=/\",\n    `Max-Age=${DEVICE_ID_MAX_AGE}`,\n    \"HttpOnly\",\n    \"SameSite=Lax\",\n  ];\n  if (process.env.NODE_ENV === \"production\") parts.push(\"Secure\");\n  return parts.join(\"; \");\n}\n\nfunction json(body: unknown, status: number): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,sBAAO;AACP,mBAA+D;AAE/D,IAAAC,eAMO;;;ACTP,yBAAO;AACP,kBAA4E;AAErE,IAAM,mBAAmB;AAQzB,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAEO,SAAS,eAAe,SAA0B;AACvD,UAAQ,WAAW,QAAQ,IAAI,qBAAqB,kBAAkB,QAAQ,OAAO,EAAE;AACzF;AAEO,SAAS,aAAa,UAAyB,SAAuB,CAAC,GAAmB;AAC/F,QAAM,SAAS,cAAc,OAAO,MAAM;AAC1C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,aAAO,kCAAqB;AAAA,IAC1B;AAAA,IACA,SAAS,eAAe,OAAO,OAAO;AAAA,IACtC;AAAA,IACA,UAAU,OAAO;AAAA,EACnB,CAAC;AACH;;;ACrCA,IAAAC,sBAAO;AACP,qBAAwB;AACxB,IAAAC,eAA+B;;;ACDxB,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AFK7C,eAAsB,eAAuC;AAC3D,QAAM,QAAQ,UAAM,wBAAQ;AAC5B,SAAO,MAAM,IAAI,gBAAgB,GAAG,SAAS;AAC/C;AAMA,eAAsB,gBAAgB,QAA4C;AAChF,MAAI,OAAQ,QAAO,OAAO;AAC1B,SAAQ,MAAM,aAAa,SAAM,6BAAe;AAClD;;;AF8DM;AAvDN,eAAsB,cAAc;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV,GAAG;AACL,GAAmD;AACjD,QAAM,WAAW,MAAM,gBAAgB,cAAc;AACrD,QAAM,SAAS,aAAa,UAAU,EAAE,QAAQ,SAAS,SAAS,CAAC;AAEnE,QAAM,MAAM,MAAM,cAAc,MAAM,OAAO,CAAC,KAAK;AACnD,QAAM,OAAoB,QAAQ,YAAY,QAAQ;AACtD,QAAM,SAAS,QAAQ,YAAY,gCAAmB;AACtD,QAAM,WAAW,MAAM,YAAY;AAEnC,QAAM,CAAC,QAAQ,MAAM,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC/C,OAAO,UAAU;AAAA,IACjB,OAAO,aAAa,EAAE,MAAM,QAAQ,OAAO,SAAS,CAAC;AAAA,IACrD,MAAM,mBAAmB,OAAO,WAAW,MAAM,gBAAgB,IAAI;AAAA,EACvE,CAAC;AAID,QAAM,QAA6B,CAAC;AACpC,MAAI,KAAK,IAAI;AACX,cAAM,sBAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,IAAI;AAAA,MACjC,UAAU,KAAK,KAAK;AAAA,MACpB,QAAQ,KAAK,KAAK;AAAA,MAClB,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,MAAM,oBAAoB,QAAQ,IAAI;AACxC,cAAM,yBAAW,MAAM,gBAAgB,CAAC,IAAI;AAAA,MAC1C,UAAU,CAAC,OAAO,IAAI;AAAA,MACtB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,eAAoC;AAAA,IACxC,QAAQ,OAAO,KAAK,OAAO,OAAO;AAAA,IAClC;AAAA,EACF;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS,eAAe,OAAO;AAAA,MAC/B;AAAA,MACA;AAAA,MACA;AAAA,MAEA,sDAAC,aAAAC,eAAA,EAAa,GAAG,OAAO;AAAA;AAAA,EAC1B;AAEJ;;;AKvFA,IAAAC,sBAAO;AACP,IAAAC,eAA+B;AA0B/B,IAAM,UAAsD;AAAA,EAC1D,EAAE,QAAQ,OAAO,SAAS,WAAW;AAAA,EACrC,EAAE,QAAQ,OAAO,SAAS,aAAa;AAAA,EACvC,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAAA,EACxC,EAAE,QAAQ,OAAO,SAAS,oBAAoB;AAAA,EAC9C,EAAE,QAAQ,QAAQ,SAAS,0BAA0B;AAAA,EACrD,EAAE,QAAQ,UAAU,SAAS,0BAA0B;AAAA,EACvD,EAAE,QAAQ,QAAQ,SAAS,4BAA4B;AAAA,EACvD,EAAE,QAAQ,UAAU,SAAS,4BAA4B;AAAA,EACzD,EAAE,QAAQ,OAAO,SAAS,8BAA8B;AAAA,EACxD,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAC1C;AAEA,IAAM,oBAAoB;AAEnB,SAAS,cAAc,UAA0B,CAAC,GAIvD;AACA,iBAAe,OAAO,SAAkB,SAA8C;AACpF,UAAM,OAAO,MAAM,UAAU,SAAS,SAAS,eAAe,QAAQ,OAAO,CAAC;AAE9E,QAAI,CAAC,QAAQ,KAAK,CAAC,UAAU,MAAM,WAAW,QAAQ,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG;AACzF,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,SAAS,0BAA0B,EAAE,GAAG,GAAG;AAAA,IACvF;AAEA,UAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,QAAI,CAAC,QAAQ;AACX,cAAQ;AAAA,QACN;AAAA,MACF;AACA,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,8BAA8B,EAAE,GAAG,GAAG;AAAA,IAC1F;AAEA,UAAM,cAAc,WAAW,SAAS,gBAAgB;AACxD,UAAM,SAAS,QAAQ,WAAW,MAAM,QAAQ,SAAS,IAAI;AAC7D,UAAM,WAAW,UAAU,eAAe,gBAAgB,OAAO,SAAK,6BAAe;AAErF,UAAM,SAAS,GAAG,eAAe,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,MAAM;AACvF,UAAM,UAAkC;AAAA,MACtC,eAAe,UAAU,MAAM;AAAA,MAC/B,eAAe;AAAA,MACf,kBAAkB,QAAQ,QAAQ,IAAI,gBAAgB,KAAK;AAAA,MAC3D,QAAQ;AAAA,IACV;AACA,UAAM,WAAW,QAAQ,QAAQ,IAAI,iBAAiB;AACtD,QAAI,SAAU,SAAQ,iBAAiB,IAAI;AAE3C,UAAM,OAAO,QAAQ,WAAW,QAAQ,SAAY,MAAM,QAAQ,KAAK;AACvE,QAAI,KAAM,SAAQ,cAAc,IAAI;AAEpC,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,QAAQ,EAAE,QAAQ,QAAQ,QAAQ,SAAS,MAAM,OAAO,WAAW,CAAC;AAAA,IAC7F,QAAQ;AACN,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,4BAA4B,EAAE,GAAG,GAAG;AAAA,IACxF;AAEA,UAAM,WAAW,IAAI,SAAS,MAAM,SAAS,KAAK,GAAG;AAAA,MACnD,QAAQ,SAAS;AAAA,MACjB,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,IAC7E,CAAC;AAID,QAAI,CAAC,UAAU,aAAa,aAAa;AACvC,eAAS,QAAQ,OAAO,cAAc,gBAAgB,QAAQ,CAAC;AAAA,IACjE;AAEA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,OAAO;AACrD;AAEA,IAAM,iBAAiB,cAAc;AAE9B,IAAM,MAAM,eAAe;AAC3B,IAAM,OAAO,eAAe;AAC5B,IAAM,SAAS,eAAe;AAErC,eAAe,UACb,SACA,SACA,SACiB;AACjB,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,QAAQ,OAAO,OAAQ,QAAO,OAAO,MAAM,IAAI,kBAAkB,EAAE,KAAK,GAAG;AAE/E,QAAM,EAAE,SAAS,IAAI,IAAI,IAAI,QAAQ,GAAG;AACxC,QAAM,QAAQ,SAAS,QAAQ,OAAO;AACtC,SAAO,UAAU,KAAK,KAAK,SAAS,MAAM,QAAQ,QAAQ,MAAM,EAAE,QAAQ,OAAO,EAAE;AACrF;AAMA,SAAS,gBAAgB,SAAiC;AACxD,QAAM,UAAU,QAAQ,QAAQ,IAAI,aAAa;AACjD,SAAO,WAAW,kBAAkB,KAAK,OAAO,IAAI,UAAU;AAChE;AAEA,SAAS,WAAW,SAAkB,MAA6B;AACjE,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACnE,SAAO,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACrD;AAEA,SAAS,gBAAgB,UAA0B;AACjD,QAAM,QAAQ;AAAA,IACZ,GAAG,gBAAgB,IAAI,mBAAmB,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,WAAW,iBAAiB;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,aAAa,aAAc,OAAM,KAAK,QAAQ;AAC9D,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,KAAK,MAAe,QAA0B;AACrD,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,EAC7E,CAAC;AACH;","names":["import_server_only","import_core","import_server_only","import_core","ClientBoard","import_server_only","import_core"]}
+{"version":3,"sources":["../src/index.ts","../src/board.tsx","../src/config.ts","../src/identity.ts","../src/version.ts","../src/constants.ts","../src/handler.ts"],"sourcesContent":["export { FewchursBoard } from \"./board\";\nexport type { FewchursBoardProps } from \"./board\";\nexport { createHandler } from \"./handler\";\nexport type { HandlerOptions, RouteHandler } from \"./handler\";\nexport { DEVICE_ID_COOKIE, readDeviceId, resolveDeviceId } from \"./identity\";\nexport type { DeviceIdResolver } from \"./identity\";\nexport { DEFAULT_API_PATH } from \"./config\";\nexport type { ServerConfig } from \"./config\";\n\nexport type {\n  Comment,\n  CommentPage,\n  Feature,\n  FeaturePage,\n  FeatureSort,\n  FeatureStatus,\n  FewchursConfig,\n  FewchursError,\n} from \"@fewchurs/react/core\";\n","import \"server-only\";\nimport { FewchursBoard as ClientBoard, FewchursProvider } from \"@fewchurs/react\";\nimport type { FewchursBoardProps as ClientBoardProps } from \"@fewchurs/react\";\nimport {\n  featureKey,\n  listKey,\n  ROADMAP_STATUSES,\n  type FeatureSort,\n  type StoreState,\n} from \"@fewchurs/react/core\";\nimport { resolveApiPath, serverClient } from \"./config\";\nimport { resolveDeviceId, type DeviceIdResolver } from \"./identity\";\n\n/** Function props cannot cross the server/client boundary — compose in your own client file. */\ntype SerializableBoardProps = Omit<\n  ClientBoardProps,\n  \"renderHeader\" | \"renderEmpty\" | \"renderFeature\" | \"children\"\n>;\n\nexport interface FewchursBoardProps extends SerializableBoardProps {\n  /** Defaults to `process.env.FEWCHURS_API_KEY`. Never reaches the browser. */\n  apiKey?: string;\n  baseUrl?: string;\n  /** Where your route handler is mounted. Defaults to `/api/fewchurs`. */\n  apiPath?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n  deviceId?: DeviceIdResolver;\n}\n\nexport async function FewchursBoard({\n  apiKey,\n  baseUrl,\n  apiPath,\n  language,\n  appId,\n  deviceId: deviceIdOption,\n  ...board\n}: FewchursBoardProps): Promise<React.JSX.Element> {\n  const deviceId = await resolveDeviceId(deviceIdOption);\n  const client = await serverClient(deviceId, { apiKey, baseUrl, language, appId });\n\n  const tab = board.defaultTab ?? board.tabs?.[0] ?? \"top\";\n  const sort: FeatureSort = tab === \"roadmap\" ? \"top\" : tab;\n  const status = tab === \"roadmap\" ? ROADMAP_STATUSES : undefined;\n  const pageSize = board.pageSize ?? 20;\n\n  const [config, page, pinned] = await Promise.all([\n    client.getConfig(),\n    client.listFeatures({ sort, status, limit: pageSize }),\n    board.initialFeatureId ? client.getFeature(board.initialFeatureId) : null,\n  ]);\n\n  // Seeded under the same key the client hook will ask for, so the first paint is the\n  // rendered HTML and no second request goes out just to fetch what is already there.\n  const lists: StoreState[\"lists\"] = {};\n  if (page.ok) {\n    lists[listKey({ sort, status })] = {\n      features: page.data.features,\n      cursor: page.data.nextCursor,\n      status: \"ready\",\n      error: null,\n    };\n  }\n  // A deep-linked request is rendered on the server too, so the link lands on real content.\n  if (board.initialFeatureId && pinned?.ok) {\n    lists[featureKey(board.initialFeatureId)] = {\n      features: [pinned.data],\n      cursor: null,\n      status: \"ready\",\n      error: null,\n    };\n  }\n\n  const initialState: Partial<StoreState> = {\n    config: config.ok ? config.data : null,\n    lists,\n  };\n\n  return (\n    <FewchursProvider\n      baseUrl={resolveApiPath(apiPath)}\n      deviceId={deviceId}\n      pageSize={pageSize}\n      initialState={initialState}\n    >\n      <ClientBoard {...board} />\n    </FewchursProvider>\n  );\n}\n","import \"server-only\";\nimport { headers } from \"next/headers\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\n/** A domain set by the developer, which replaces the one read from the request. */\nexport function configuredAppId(appId?: string): string | undefined {\n  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || undefined;\n}\n\n/** The site's host name without a port. A reverse proxy reports the public one in `x-forwarded-host`. */\nexport function requestHostname(requestHeaders: Headers): string | undefined {\n  const forwarded = requestHeaders.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  const host = forwarded || requestHeaders.get(\"host\")?.trim();\n  if (!host) return undefined;\n  try {\n    return new URL(`http://${host}`).hostname;\n  } catch {\n    return undefined;\n  }\n}\n\nexport async function serverClient(\n  deviceId: string | null,\n  config: ServerConfig = {},\n): Promise<FewchursClient> {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n    // Only read the request when needed, so a page with a set domain can still render statically.\n    appId: configuredAppId(config.appId) ?? requestHostname(await headers()),\n  });\n}\n","import \"server-only\";\nimport { cookies } from \"next/headers\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE } from \"./constants\";\n\nexport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE };\n\nexport type DeviceIdResolver = () => string | Promise<string>;\n\n/** The visitor's id, or null when nothing has been stored for them yet. */\nexport async function readDeviceId(): Promise<string | null> {\n  const store = await cookies();\n  return store.get(DEVICE_ID_COOKIE)?.value ?? null;\n}\n\n/**\n * Reads the cookie, falling back to a fresh id. The value is not persisted here: a server\n * component cannot set cookies, so the route handler stores it on the first request instead.\n */\nexport async function resolveDeviceId(custom?: DeviceIdResolver): Promise<string> {\n  if (custom) return custom();\n  return (await readDeviceId()) ?? createDeviceId();\n}\n\nexport function deviceIdCookie(deviceId: string): {\n  name: string;\n  value: string;\n  options: {\n    httpOnly: true;\n    sameSite: \"lax\";\n    path: string;\n    maxAge: number;\n    secure: boolean;\n  };\n} {\n  return {\n    name: DEVICE_ID_COOKIE,\n    value: deviceId,\n    options: {\n      httpOnly: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: DEVICE_ID_MAX_AGE,\n      secure: process.env.NODE_ENV === \"production\",\n    },\n  };\n}\n\nexport { createDeviceId };\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.1.0\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n","import \"server-only\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport {\n  configuredAppId,\n  requestHostname,\n  resolveApiKey,\n  resolveApiPath,\n  resolveBaseUrl,\n} from \"./config\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE, SDK_HEADER } from \"./constants\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface HandlerOptions {\n  apiKey?: string;\n  baseUrl?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n  /** Where the handler is mounted, when it is not `/api/fewchurs`. */\n  apiPath?: string;\n  /** Return a stable, hashed id for the signed-in visitor so votes follow the account. */\n  deviceId?: DeviceIdResolver;\n}\n\ntype RouteParams = { route?: string[] };\n\n/** What Next passes: a Promise in 15, a plain object in 14. Both are awaited the same way. */\ntype IncomingContext = { params?: RouteParams | Promise<RouteParams> };\n\n// Next 15's route check wants a required second argument whose `params` is a Promise. The\n// handler itself takes `IncomingContext`, so Next 14's plain object still works at runtime.\ntype RouteContext = { params: Promise<RouteParams> };\n\nexport type RouteHandler = (request: Request, context: RouteContext) => Promise<Response>;\n\n/** Only the endpoints the board needs: everything else is a 404, not a proxy to the API. */\nconst ALLOWED: Array<{ method: string; pattern: RegExp }> = [\n  { method: \"GET\", pattern: /^config$/ },\n  { method: \"GET\", pattern: /^features$/ },\n  { method: \"POST\", pattern: /^features$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+\\/comments$/ },\n  { method: \"POST\", pattern: /^comments$/ },\n];\n\nconst DEVICE_ID_PATTERN = /^[A-Za-z0-9_-]{8,128}$/;\n\nexport function createHandler(options: HandlerOptions = {}): {\n  GET: RouteHandler;\n  POST: RouteHandler;\n  DELETE: RouteHandler;\n} {\n  async function handle(request: Request, context?: IncomingContext): Promise<Response> {\n    const path = await routePath(request, context, resolveApiPath(options.apiPath));\n\n    if (!ALLOWED.some((route) => route.method === request.method && route.pattern.test(path))) {\n      return json({ error: { code: \"not_found\", message: \"Unknown Fewchurs route.\" } }, 404);\n    }\n\n    const apiKey = resolveApiKey(options.apiKey);\n    if (!apiKey) {\n      console.error(\n        \"[fewchurs] No API key. Set FEWCHURS_API_KEY, or pass apiKey to createHandler().\",\n      );\n      return json({ error: { code: \"internal\", message: \"Fewchurs is not configured.\" } }, 500);\n    }\n\n    const cookieValue = readCookie(request, DEVICE_ID_COOKIE);\n    const custom = options.deviceId ? await options.deviceId() : null;\n    const deviceId = custom ?? cookieValue ?? claimedDeviceId(request) ?? createDeviceId();\n\n    const target = `${resolveBaseUrl(options.baseUrl)}/${path}${new URL(request.url).search}`;\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${apiKey}`,\n      \"X-Device-Id\": deviceId,\n      \"X-Fewchurs-Sdk\": SDK_HEADER,\n      \"X-Fewchurs-App-Id\":\n        configuredAppId(options.appId) ??\n        requestHostname(request.headers) ??\n        new URL(request.url).hostname,\n      Accept: \"application/json\",\n    };\n    const language = request.headers.get(\"accept-language\");\n    if (language) headers[\"Accept-Language\"] = language;\n\n    const body = request.method === \"GET\" ? undefined : await request.text();\n    if (body) headers[\"Content-Type\"] = \"application/json\";\n\n    let upstream: Response;\n    try {\n      upstream = await fetch(target, { method: request.method, headers, body, cache: \"no-store\" });\n    } catch {\n      return json({ error: { code: \"internal\", message: \"Could not reach Fewchurs.\" } }, 502);\n    }\n\n    const text = await upstream.text();\n    if (upstream.status === 403) logRefusal(text);\n\n    const response = new Response(text, {\n      status: upstream.status,\n      headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n    });\n\n    // A visitor keeps the same id across requests without the browser ever seeing the key,\n    // and an httpOnly cookie means page scripts cannot read or change it either.\n    if (!custom && deviceId !== cookieValue) {\n      response.headers.append(\"Set-Cookie\", serializeCookie(deviceId));\n    }\n\n    return response;\n  }\n\n  return { GET: handle, POST: handle, DELETE: handle };\n}\n\nconst defaultHandler = createHandler();\n\nexport const GET = defaultHandler.GET;\nexport const POST = defaultHandler.POST;\nexport const DELETE = defaultHandler.DELETE;\n\nlet loggedRefusal = false;\n\n/** Visitors only see a safe message, so a live site's server log is where the domain gets named. */\nfunction logRefusal(body: string): void {\n  if (loggedRefusal) return;\n  try {\n    const error = (JSON.parse(body) as { error?: { code?: string; message?: string } }).error;\n    if (error?.code !== \"wrong_app\") return;\n    loggedRefusal = true;\n    console.error(`[fewchurs] ${error.message}`);\n  } catch {\n    // Not JSON, so it isn't a refusal from Fewchurs.\n  }\n}\n\nasync function routePath(\n  request: Request,\n  context: IncomingContext | undefined,\n  apiPath: string,\n): Promise<string> {\n  const params = await context?.params;\n  if (params?.route?.length) return params.route.map(encodeURIComponent).join(\"/\");\n\n  const { pathname } = new URL(request.url);\n  const index = pathname.indexOf(apiPath);\n  return index === -1 ? \"\" : pathname.slice(index + apiPath.length).replace(/^\\//, \"\");\n}\n\n/**\n * The first request from a server-rendered board carries the id the page was rendered with,\n * so adopting it keeps the server's `hasVoted` answers and the browser's in agreement.\n */\nfunction claimedDeviceId(request: Request): string | null {\n  const claimed = request.headers.get(\"x-device-id\");\n  return claimed && DEVICE_ID_PATTERN.test(claimed) ? claimed : null;\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n  const header = request.headers.get(\"cookie\");\n  if (!header) return null;\n  const match = header.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match?.[1] ? decodeURIComponent(match[1]) : null;\n}\n\nfunction serializeCookie(deviceId: string): string {\n  const parts = [\n    `${DEVICE_ID_COOKIE}=${encodeURIComponent(deviceId)}`,\n    \"Path=/\",\n    `Max-Age=${DEVICE_ID_MAX_AGE}`,\n    \"HttpOnly\",\n    \"SameSite=Lax\",\n  ];\n  if (process.env.NODE_ENV === \"production\") parts.push(\"Secure\");\n  return parts.join(\"; \");\n}\n\nfunction json(body: unknown, status: number): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,sBAAO;AACP,mBAA+D;AAE/D,IAAAC,eAMO;;;ACTP,yBAAO;AACP,qBAAwB;AACxB,kBAA4E;AAErE,IAAM,mBAAmB;AAUzB,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAEO,SAAS,eAAe,SAA0B;AACvD,UAAQ,WAAW,QAAQ,IAAI,qBAAqB,kBAAkB,QAAQ,OAAO,EAAE;AACzF;AAGO,SAAS,gBAAgB,OAAoC;AAClE,SAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,KAAK,KAAK;AACjE;AAGO,SAAS,gBAAgB,gBAA6C;AAC3E,QAAM,YAAY,eAAe,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAC9E,QAAM,OAAO,aAAa,eAAe,IAAI,MAAM,GAAG,KAAK;AAC3D,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,IAAI,EAAE,EAAE;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,aACpB,UACA,SAAuB,CAAC,GACC;AACzB,QAAM,SAAS,cAAc,OAAO,MAAM;AAC1C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,aAAO,kCAAqB;AAAA,IAC1B;AAAA,IACA,SAAS,eAAe,OAAO,OAAO;AAAA,IACtC;AAAA,IACA,UAAU,OAAO;AAAA;AAAA,IAEjB,OAAO,gBAAgB,OAAO,KAAK,KAAK,gBAAgB,UAAM,wBAAQ,CAAC;AAAA,EACzE,CAAC;AACH;;;AC9DA,IAAAC,sBAAO;AACP,IAAAC,kBAAwB;AACxB,IAAAC,eAA+B;;;ACDxB,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AFK7C,eAAsB,eAAuC;AAC3D,QAAM,QAAQ,UAAM,yBAAQ;AAC5B,SAAO,MAAM,IAAI,gBAAgB,GAAG,SAAS;AAC/C;AAMA,eAAsB,gBAAgB,QAA4C;AAChF,MAAI,OAAQ,QAAO,OAAO;AAC1B,SAAQ,MAAM,aAAa,SAAM,6BAAe;AAClD;;;AFiEM;AAxDN,eAAsB,cAAc;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV,GAAG;AACL,GAAmD;AACjD,QAAM,WAAW,MAAM,gBAAgB,cAAc;AACrD,QAAM,SAAS,MAAM,aAAa,UAAU,EAAE,QAAQ,SAAS,UAAU,MAAM,CAAC;AAEhF,QAAM,MAAM,MAAM,cAAc,MAAM,OAAO,CAAC,KAAK;AACnD,QAAM,OAAoB,QAAQ,YAAY,QAAQ;AACtD,QAAM,SAAS,QAAQ,YAAY,gCAAmB;AACtD,QAAM,WAAW,MAAM,YAAY;AAEnC,QAAM,CAAC,QAAQ,MAAM,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC/C,OAAO,UAAU;AAAA,IACjB,OAAO,aAAa,EAAE,MAAM,QAAQ,OAAO,SAAS,CAAC;AAAA,IACrD,MAAM,mBAAmB,OAAO,WAAW,MAAM,gBAAgB,IAAI;AAAA,EACvE,CAAC;AAID,QAAM,QAA6B,CAAC;AACpC,MAAI,KAAK,IAAI;AACX,cAAM,sBAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,IAAI;AAAA,MACjC,UAAU,KAAK,KAAK;AAAA,MACpB,QAAQ,KAAK,KAAK;AAAA,MAClB,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,MAAM,oBAAoB,QAAQ,IAAI;AACxC,cAAM,yBAAW,MAAM,gBAAgB,CAAC,IAAI;AAAA,MAC1C,UAAU,CAAC,OAAO,IAAI;AAAA,MACtB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,eAAoC;AAAA,IACxC,QAAQ,OAAO,KAAK,OAAO,OAAO;AAAA,IAClC;AAAA,EACF;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS,eAAe,OAAO;AAAA,MAC/B;AAAA,MACA;AAAA,MACA;AAAA,MAEA,sDAAC,aAAAC,eAAA,EAAa,GAAG,OAAO;AAAA;AAAA,EAC1B;AAEJ;;;AK1FA,IAAAC,sBAAO;AACP,IAAAC,eAA+B;AAkC/B,IAAM,UAAsD;AAAA,EAC1D,EAAE,QAAQ,OAAO,SAAS,WAAW;AAAA,EACrC,EAAE,QAAQ,OAAO,SAAS,aAAa;AAAA,EACvC,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAAA,EACxC,EAAE,QAAQ,OAAO,SAAS,oBAAoB;AAAA,EAC9C,EAAE,QAAQ,QAAQ,SAAS,0BAA0B;AAAA,EACrD,EAAE,QAAQ,UAAU,SAAS,0BAA0B;AAAA,EACvD,EAAE,QAAQ,QAAQ,SAAS,4BAA4B;AAAA,EACvD,EAAE,QAAQ,UAAU,SAAS,4BAA4B;AAAA,EACzD,EAAE,QAAQ,OAAO,SAAS,8BAA8B;AAAA,EACxD,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAC1C;AAEA,IAAM,oBAAoB;AAEnB,SAAS,cAAc,UAA0B,CAAC,GAIvD;AACA,iBAAe,OAAO,SAAkB,SAA8C;AACpF,UAAM,OAAO,MAAM,UAAU,SAAS,SAAS,eAAe,QAAQ,OAAO,CAAC;AAE9E,QAAI,CAAC,QAAQ,KAAK,CAAC,UAAU,MAAM,WAAW,QAAQ,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG;AACzF,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,SAAS,0BAA0B,EAAE,GAAG,GAAG;AAAA,IACvF;AAEA,UAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,QAAI,CAAC,QAAQ;AACX,cAAQ;AAAA,QACN;AAAA,MACF;AACA,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,8BAA8B,EAAE,GAAG,GAAG;AAAA,IAC1F;AAEA,UAAM,cAAc,WAAW,SAAS,gBAAgB;AACxD,UAAM,SAAS,QAAQ,WAAW,MAAM,QAAQ,SAAS,IAAI;AAC7D,UAAM,WAAW,UAAU,eAAe,gBAAgB,OAAO,SAAK,6BAAe;AAErF,UAAM,SAAS,GAAG,eAAe,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,MAAM;AACvF,UAAMC,WAAkC;AAAA,MACtC,eAAe,UAAU,MAAM;AAAA,MAC/B,eAAe;AAAA,MACf,kBAAkB;AAAA,MAClB,qBACE,gBAAgB,QAAQ,KAAK,KAC7B,gBAAgB,QAAQ,OAAO,KAC/B,IAAI,IAAI,QAAQ,GAAG,EAAE;AAAA,MACvB,QAAQ;AAAA,IACV;AACA,UAAM,WAAW,QAAQ,QAAQ,IAAI,iBAAiB;AACtD,QAAI,SAAU,CAAAA,SAAQ,iBAAiB,IAAI;AAE3C,UAAM,OAAO,QAAQ,WAAW,QAAQ,SAAY,MAAM,QAAQ,KAAK;AACvE,QAAI,KAAM,CAAAA,SAAQ,cAAc,IAAI;AAEpC,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,QAAQ,EAAE,QAAQ,QAAQ,QAAQ,SAAAA,UAAS,MAAM,OAAO,WAAW,CAAC;AAAA,IAC7F,QAAQ;AACN,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,4BAA4B,EAAE,GAAG,GAAG;AAAA,IACxF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,SAAS,WAAW,IAAK,YAAW,IAAI;AAE5C,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ,SAAS;AAAA,MACjB,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,IAC7E,CAAC;AAID,QAAI,CAAC,UAAU,aAAa,aAAa;AACvC,eAAS,QAAQ,OAAO,cAAc,gBAAgB,QAAQ,CAAC;AAAA,IACjE;AAEA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,OAAO;AACrD;AAEA,IAAM,iBAAiB,cAAc;AAE9B,IAAM,MAAM,eAAe;AAC3B,IAAM,OAAO,eAAe;AAC5B,IAAM,SAAS,eAAe;AAErC,IAAI,gBAAgB;AAGpB,SAAS,WAAW,MAAoB;AACtC,MAAI,cAAe;AACnB,MAAI;AACF,UAAM,QAAS,KAAK,MAAM,IAAI,EAAsD;AACpF,QAAI,OAAO,SAAS,YAAa;AACjC,oBAAgB;AAChB,YAAQ,MAAM,cAAc,MAAM,OAAO,EAAE;AAAA,EAC7C,QAAQ;AAAA,EAER;AACF;AAEA,eAAe,UACb,SACA,SACA,SACiB;AACjB,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,QAAQ,OAAO,OAAQ,QAAO,OAAO,MAAM,IAAI,kBAAkB,EAAE,KAAK,GAAG;AAE/E,QAAM,EAAE,SAAS,IAAI,IAAI,IAAI,QAAQ,GAAG;AACxC,QAAM,QAAQ,SAAS,QAAQ,OAAO;AACtC,SAAO,UAAU,KAAK,KAAK,SAAS,MAAM,QAAQ,QAAQ,MAAM,EAAE,QAAQ,OAAO,EAAE;AACrF;AAMA,SAAS,gBAAgB,SAAiC;AACxD,QAAM,UAAU,QAAQ,QAAQ,IAAI,aAAa;AACjD,SAAO,WAAW,kBAAkB,KAAK,OAAO,IAAI,UAAU;AAChE;AAEA,SAAS,WAAW,SAAkB,MAA6B;AACjE,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACnE,SAAO,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACrD;AAEA,SAAS,gBAAgB,UAA0B;AACjD,QAAM,QAAQ;AAAA,IACZ,GAAG,gBAAgB,IAAI,mBAAmB,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,WAAW,iBAAiB;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,aAAa,aAAc,OAAM,KAAK,QAAQ;AAC9D,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,KAAK,MAAe,QAA0B;AACrD,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,EAC7E,CAAC;AACH;","names":["import_server_only","import_core","import_server_only","import_headers","import_core","ClientBoard","import_server_only","import_core","headers"]}

package/dist/index.mjs

@@ -3,14 +3,14 @@ import {
   createHandler,
   resolveApiPath,
   serverClient
-} from "./chunk-KPJHLDQU.mjs";
+} from "./chunk-ZRYXVCLB.mjs";
 import {
   readDeviceId,
   resolveDeviceId
-} from "./chunk-QULKPZB4.mjs";
+} from "./chunk-DM357WK6.mjs";
 import {
   DEVICE_ID_COOKIE
-} from "./chunk-W6QR6DEB.mjs";
+} from "./chunk-L57II7SI.mjs";
 
 // src/board.tsx
 import "server-only";
@@ -26,11 +26,12 @@ async function FewchursBoard({
   baseUrl,
   apiPath,
   language,
+  appId,
   deviceId: deviceIdOption,
   ...board
 }) {
   const deviceId = await resolveDeviceId(deviceIdOption);
-  const client = serverClient(deviceId, { apiKey, baseUrl, language });
+  const client = await serverClient(deviceId, { apiKey, baseUrl, language, appId });
   const tab = board.defaultTab ?? board.tabs?.[0] ?? "top";
   const sort = tab === "roadmap" ? "top" : tab;
   const status = tab === "roadmap" ? ROADMAP_STATUSES : void 0;

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/board.tsx"],"sourcesContent":["import \"server-only\";\nimport { FewchursBoard as ClientBoard, FewchursProvider } from \"@fewchurs/react\";\nimport type { FewchursBoardProps as ClientBoardProps } from \"@fewchurs/react\";\nimport {\n  featureKey,\n  listKey,\n  ROADMAP_STATUSES,\n  type FeatureSort,\n  type StoreState,\n} from \"@fewchurs/react/core\";\nimport { resolveApiPath, serverClient } from \"./config\";\nimport { resolveDeviceId, type DeviceIdResolver } from \"./identity\";\n\n/** Function props cannot cross the server/client boundary — compose in your own client file. */\ntype SerializableBoardProps = Omit<\n  ClientBoardProps,\n  \"renderHeader\" | \"renderEmpty\" | \"renderFeature\" | \"children\"\n>;\n\nexport interface FewchursBoardProps extends SerializableBoardProps {\n  /** Defaults to `process.env.FEWCHURS_API_KEY`. Never reaches the browser. */\n  apiKey?: string;\n  baseUrl?: string;\n  /** Where your route handler is mounted. Defaults to `/api/fewchurs`. */\n  apiPath?: string;\n  language?: string;\n  deviceId?: DeviceIdResolver;\n}\n\nexport async function FewchursBoard({\n  apiKey,\n  baseUrl,\n  apiPath,\n  language,\n  deviceId: deviceIdOption,\n  ...board\n}: FewchursBoardProps): Promise<React.JSX.Element> {\n  const deviceId = await resolveDeviceId(deviceIdOption);\n  const client = serverClient(deviceId, { apiKey, baseUrl, language });\n\n  const tab = board.defaultTab ?? board.tabs?.[0] ?? \"top\";\n  const sort: FeatureSort = tab === \"roadmap\" ? \"top\" : tab;\n  const status = tab === \"roadmap\" ? ROADMAP_STATUSES : undefined;\n  const pageSize = board.pageSize ?? 20;\n\n  const [config, page, pinned] = await Promise.all([\n    client.getConfig(),\n    client.listFeatures({ sort, status, limit: pageSize }),\n    board.initialFeatureId ? client.getFeature(board.initialFeatureId) : null,\n  ]);\n\n  // Seeded under the same key the client hook will ask for, so the first paint is the\n  // rendered HTML and no second request goes out just to fetch what is already there.\n  const lists: StoreState[\"lists\"] = {};\n  if (page.ok) {\n    lists[listKey({ sort, status })] = {\n      features: page.data.features,\n      cursor: page.data.nextCursor,\n      status: \"ready\",\n      error: null,\n    };\n  }\n  // A deep-linked request is rendered on the server too, so the link lands on real content.\n  if (board.initialFeatureId && pinned?.ok) {\n    lists[featureKey(board.initialFeatureId)] = {\n      features: [pinned.data],\n      cursor: null,\n      status: \"ready\",\n      error: null,\n    };\n  }\n\n  const initialState: Partial<StoreState> = {\n    config: config.ok ? config.data : null,\n    lists,\n  };\n\n  return (\n    <FewchursProvider\n      baseUrl={resolveApiPath(apiPath)}\n      deviceId={deviceId}\n      pageSize={pageSize}\n      initialState={initialState}\n    >\n      <ClientBoard {...board} />\n    </FewchursProvider>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;AAAA,OAAO;AACP,SAAS,iBAAiB,aAAa,wBAAwB;AAE/D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AA2ED;AAvDN,eAAsB,cAAc;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV,GAAG;AACL,GAAmD;AACjD,QAAM,WAAW,MAAM,gBAAgB,cAAc;AACrD,QAAM,SAAS,aAAa,UAAU,EAAE,QAAQ,SAAS,SAAS,CAAC;AAEnE,QAAM,MAAM,MAAM,cAAc,MAAM,OAAO,CAAC,KAAK;AACnD,QAAM,OAAoB,QAAQ,YAAY,QAAQ;AACtD,QAAM,SAAS,QAAQ,YAAY,mBAAmB;AACtD,QAAM,WAAW,MAAM,YAAY;AAEnC,QAAM,CAAC,QAAQ,MAAM,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC/C,OAAO,UAAU;AAAA,IACjB,OAAO,aAAa,EAAE,MAAM,QAAQ,OAAO,SAAS,CAAC;AAAA,IACrD,MAAM,mBAAmB,OAAO,WAAW,MAAM,gBAAgB,IAAI;AAAA,EACvE,CAAC;AAID,QAAM,QAA6B,CAAC;AACpC,MAAI,KAAK,IAAI;AACX,UAAM,QAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,IAAI;AAAA,MACjC,UAAU,KAAK,KAAK;AAAA,MACpB,QAAQ,KAAK,KAAK;AAAA,MAClB,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,MAAM,oBAAoB,QAAQ,IAAI;AACxC,UAAM,WAAW,MAAM,gBAAgB,CAAC,IAAI;AAAA,MAC1C,UAAU,CAAC,OAAO,IAAI;AAAA,MACtB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,eAAoC;AAAA,IACxC,QAAQ,OAAO,KAAK,OAAO,OAAO;AAAA,IAClC;AAAA,EACF;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS,eAAe,OAAO;AAAA,MAC/B;AAAA,MACA;AAAA,MACA;AAAA,MAEA,8BAAC,eAAa,GAAG,OAAO;AAAA;AAAA,EAC1B;AAEJ;","names":[]}
+{"version":3,"sources":["../src/board.tsx"],"sourcesContent":["import \"server-only\";\nimport { FewchursBoard as ClientBoard, FewchursProvider } from \"@fewchurs/react\";\nimport type { FewchursBoardProps as ClientBoardProps } from \"@fewchurs/react\";\nimport {\n  featureKey,\n  listKey,\n  ROADMAP_STATUSES,\n  type FeatureSort,\n  type StoreState,\n} from \"@fewchurs/react/core\";\nimport { resolveApiPath, serverClient } from \"./config\";\nimport { resolveDeviceId, type DeviceIdResolver } from \"./identity\";\n\n/** Function props cannot cross the server/client boundary — compose in your own client file. */\ntype SerializableBoardProps = Omit<\n  ClientBoardProps,\n  \"renderHeader\" | \"renderEmpty\" | \"renderFeature\" | \"children\"\n>;\n\nexport interface FewchursBoardProps extends SerializableBoardProps {\n  /** Defaults to `process.env.FEWCHURS_API_KEY`. Never reaches the browser. */\n  apiKey?: string;\n  baseUrl?: string;\n  /** Where your route handler is mounted. Defaults to `/api/fewchurs`. */\n  apiPath?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n  deviceId?: DeviceIdResolver;\n}\n\nexport async function FewchursBoard({\n  apiKey,\n  baseUrl,\n  apiPath,\n  language,\n  appId,\n  deviceId: deviceIdOption,\n  ...board\n}: FewchursBoardProps): Promise<React.JSX.Element> {\n  const deviceId = await resolveDeviceId(deviceIdOption);\n  const client = await serverClient(deviceId, { apiKey, baseUrl, language, appId });\n\n  const tab = board.defaultTab ?? board.tabs?.[0] ?? \"top\";\n  const sort: FeatureSort = tab === \"roadmap\" ? \"top\" : tab;\n  const status = tab === \"roadmap\" ? ROADMAP_STATUSES : undefined;\n  const pageSize = board.pageSize ?? 20;\n\n  const [config, page, pinned] = await Promise.all([\n    client.getConfig(),\n    client.listFeatures({ sort, status, limit: pageSize }),\n    board.initialFeatureId ? client.getFeature(board.initialFeatureId) : null,\n  ]);\n\n  // Seeded under the same key the client hook will ask for, so the first paint is the\n  // rendered HTML and no second request goes out just to fetch what is already there.\n  const lists: StoreState[\"lists\"] = {};\n  if (page.ok) {\n    lists[listKey({ sort, status })] = {\n      features: page.data.features,\n      cursor: page.data.nextCursor,\n      status: \"ready\",\n      error: null,\n    };\n  }\n  // A deep-linked request is rendered on the server too, so the link lands on real content.\n  if (board.initialFeatureId && pinned?.ok) {\n    lists[featureKey(board.initialFeatureId)] = {\n      features: [pinned.data],\n      cursor: null,\n      status: \"ready\",\n      error: null,\n    };\n  }\n\n  const initialState: Partial<StoreState> = {\n    config: config.ok ? config.data : null,\n    lists,\n  };\n\n  return (\n    <FewchursProvider\n      baseUrl={resolveApiPath(apiPath)}\n      deviceId={deviceId}\n      pageSize={pageSize}\n      initialState={initialState}\n    >\n      <ClientBoard {...board} />\n    </FewchursProvider>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;AAAA,OAAO;AACP,SAAS,iBAAiB,aAAa,wBAAwB;AAE/D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AA8ED;AAxDN,eAAsB,cAAc;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV,GAAG;AACL,GAAmD;AACjD,QAAM,WAAW,MAAM,gBAAgB,cAAc;AACrD,QAAM,SAAS,MAAM,aAAa,UAAU,EAAE,QAAQ,SAAS,UAAU,MAAM,CAAC;AAEhF,QAAM,MAAM,MAAM,cAAc,MAAM,OAAO,CAAC,KAAK;AACnD,QAAM,OAAoB,QAAQ,YAAY,QAAQ;AACtD,QAAM,SAAS,QAAQ,YAAY,mBAAmB;AACtD,QAAM,WAAW,MAAM,YAAY;AAEnC,QAAM,CAAC,QAAQ,MAAM,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC/C,OAAO,UAAU;AAAA,IACjB,OAAO,aAAa,EAAE,MAAM,QAAQ,OAAO,SAAS,CAAC;AAAA,IACrD,MAAM,mBAAmB,OAAO,WAAW,MAAM,gBAAgB,IAAI;AAAA,EACvE,CAAC;AAID,QAAM,QAA6B,CAAC;AACpC,MAAI,KAAK,IAAI;AACX,UAAM,QAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,IAAI;AAAA,MACjC,UAAU,KAAK,KAAK;AAAA,MACpB,QAAQ,KAAK,KAAK;AAAA,MAClB,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,MAAM,oBAAoB,QAAQ,IAAI;AACxC,UAAM,WAAW,MAAM,gBAAgB,CAAC,IAAI;AAAA,MAC1C,UAAU,CAAC,OAAO,IAAI;AAAA,MACtB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,eAAoC;AAAA,IACxC,QAAQ,OAAO,KAAK,OAAO,OAAO;AAAA,IAClC;AAAA,EACF;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS,eAAe,OAAO;AAAA,MAC/B;AAAA,MACA;AAAA,MACA;AAAA,MAEA,8BAAC,eAAa,GAAG,OAAO;AAAA;AAAA,EAC1B;AAEJ;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fewchurs/next",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "A server-rendered Fewchurs feature-request board for Next.js, with the API key kept on the server.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "commonjs",
@@ -86,7 +86,7 @@
   },
   "dependencies": {
     "server-only": "^0.0.1",
-    "@fewchurs/react": "^1.0.1"
+    "@fewchurs/react": "^1.1.0"
   },
   "peerDependencies": {
     "next": ">=14",

package/dist/chunk-KPJHLDQU.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/handler.ts","../src/config.ts"],"sourcesContent":["import \"server-only\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { resolveApiKey, resolveApiPath, resolveBaseUrl } from \"./config\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE, SDK_HEADER } from \"./constants\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface HandlerOptions {\n  apiKey?: string;\n  baseUrl?: string;\n  /** Where the handler is mounted, when it is not `/api/fewchurs`. */\n  apiPath?: string;\n  /** Return a stable, hashed id for the signed-in visitor so votes follow the account. */\n  deviceId?: DeviceIdResolver;\n}\n\ntype RouteParams = { route?: string[] };\n\n/** What Next passes: a Promise in 15, a plain object in 14. Both are awaited the same way. */\ntype IncomingContext = { params?: RouteParams | Promise<RouteParams> };\n\n// Next 15's route check wants a required second argument whose `params` is a Promise. The\n// handler itself takes `IncomingContext`, so Next 14's plain object still works at runtime.\ntype RouteContext = { params: Promise<RouteParams> };\n\nexport type RouteHandler = (request: Request, context: RouteContext) => Promise<Response>;\n\n/** Only the endpoints the board needs: everything else is a 404, not a proxy to the API. */\nconst ALLOWED: Array<{ method: string; pattern: RegExp }> = [\n  { method: \"GET\", pattern: /^config$/ },\n  { method: \"GET\", pattern: /^features$/ },\n  { method: \"POST\", pattern: /^features$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+\\/comments$/ },\n  { method: \"POST\", pattern: /^comments$/ },\n];\n\nconst DEVICE_ID_PATTERN = /^[A-Za-z0-9_-]{8,128}$/;\n\nexport function createHandler(options: HandlerOptions = {}): {\n  GET: RouteHandler;\n  POST: RouteHandler;\n  DELETE: RouteHandler;\n} {\n  async function handle(request: Request, context?: IncomingContext): Promise<Response> {\n    const path = await routePath(request, context, resolveApiPath(options.apiPath));\n\n    if (!ALLOWED.some((route) => route.method === request.method && route.pattern.test(path))) {\n      return json({ error: { code: \"not_found\", message: \"Unknown Fewchurs route.\" } }, 404);\n    }\n\n    const apiKey = resolveApiKey(options.apiKey);\n    if (!apiKey) {\n      console.error(\n        \"[fewchurs] No API key. Set FEWCHURS_API_KEY, or pass apiKey to createHandler().\",\n      );\n      return json({ error: { code: \"internal\", message: \"Fewchurs is not configured.\" } }, 500);\n    }\n\n    const cookieValue = readCookie(request, DEVICE_ID_COOKIE);\n    const custom = options.deviceId ? await options.deviceId() : null;\n    const deviceId = custom ?? cookieValue ?? claimedDeviceId(request) ?? createDeviceId();\n\n    const target = `${resolveBaseUrl(options.baseUrl)}/${path}${new URL(request.url).search}`;\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${apiKey}`,\n      \"X-Device-Id\": deviceId,\n      \"X-Fewchurs-Sdk\": request.headers.get(\"x-fewchurs-sdk\") ?? SDK_HEADER,\n      Accept: \"application/json\",\n    };\n    const language = request.headers.get(\"accept-language\");\n    if (language) headers[\"Accept-Language\"] = language;\n\n    const body = request.method === \"GET\" ? undefined : await request.text();\n    if (body) headers[\"Content-Type\"] = \"application/json\";\n\n    let upstream: Response;\n    try {\n      upstream = await fetch(target, { method: request.method, headers, body, cache: \"no-store\" });\n    } catch {\n      return json({ error: { code: \"internal\", message: \"Could not reach Fewchurs.\" } }, 502);\n    }\n\n    const response = new Response(await upstream.text(), {\n      status: upstream.status,\n      headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n    });\n\n    // A visitor keeps the same id across requests without the browser ever seeing the key,\n    // and an httpOnly cookie means page scripts cannot read or change it either.\n    if (!custom && deviceId !== cookieValue) {\n      response.headers.append(\"Set-Cookie\", serializeCookie(deviceId));\n    }\n\n    return response;\n  }\n\n  return { GET: handle, POST: handle, DELETE: handle };\n}\n\nconst defaultHandler = createHandler();\n\nexport const GET = defaultHandler.GET;\nexport const POST = defaultHandler.POST;\nexport const DELETE = defaultHandler.DELETE;\n\nasync function routePath(\n  request: Request,\n  context: IncomingContext | undefined,\n  apiPath: string,\n): Promise<string> {\n  const params = await context?.params;\n  if (params?.route?.length) return params.route.map(encodeURIComponent).join(\"/\");\n\n  const { pathname } = new URL(request.url);\n  const index = pathname.indexOf(apiPath);\n  return index === -1 ? \"\" : pathname.slice(index + apiPath.length).replace(/^\\//, \"\");\n}\n\n/**\n * The first request from a server-rendered board carries the id the page was rendered with,\n * so adopting it keeps the server's `hasVoted` answers and the browser's in agreement.\n */\nfunction claimedDeviceId(request: Request): string | null {\n  const claimed = request.headers.get(\"x-device-id\");\n  return claimed && DEVICE_ID_PATTERN.test(claimed) ? claimed : null;\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n  const header = request.headers.get(\"cookie\");\n  if (!header) return null;\n  const match = header.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match?.[1] ? decodeURIComponent(match[1]) : null;\n}\n\nfunction serializeCookie(deviceId: string): string {\n  const parts = [\n    `${DEVICE_ID_COOKIE}=${encodeURIComponent(deviceId)}`,\n    \"Path=/\",\n    `Max-Age=${DEVICE_ID_MAX_AGE}`,\n    \"HttpOnly\",\n    \"SameSite=Lax\",\n  ];\n  if (process.env.NODE_ENV === \"production\") parts.push(\"Secure\");\n  return parts.join(\"; \");\n}\n\nfunction json(body: unknown, status: number): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n  });\n}\n","import \"server-only\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\nexport function serverClient(deviceId: string | null, config: ServerConfig = {}): FewchursClient {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n  });\n}\n"],"mappings":";;;;;;;AAAA,OAAO;AACP,SAAS,sBAAsB;;;ACD/B,OAAO;AACP,SAAS,sBAAsB,wBAA6C;AAErE,IAAM,mBAAmB;AAQzB,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAEO,SAAS,eAAe,SAA0B;AACvD,UAAQ,WAAW,QAAQ,IAAI,qBAAqB,kBAAkB,QAAQ,OAAO,EAAE;AACzF;AAEO,SAAS,aAAa,UAAyB,SAAuB,CAAC,GAAmB;AAC/F,QAAM,SAAS,cAAc,OAAO,MAAM;AAC1C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO,qBAAqB;AAAA,IAC1B;AAAA,IACA,SAAS,eAAe,OAAO,OAAO;AAAA,IACtC;AAAA,IACA,UAAU,OAAO;AAAA,EACnB,CAAC;AACH;;;ADVA,IAAM,UAAsD;AAAA,EAC1D,EAAE,QAAQ,OAAO,SAAS,WAAW;AAAA,EACrC,EAAE,QAAQ,OAAO,SAAS,aAAa;AAAA,EACvC,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAAA,EACxC,EAAE,QAAQ,OAAO,SAAS,oBAAoB;AAAA,EAC9C,EAAE,QAAQ,QAAQ,SAAS,0BAA0B;AAAA,EACrD,EAAE,QAAQ,UAAU,SAAS,0BAA0B;AAAA,EACvD,EAAE,QAAQ,QAAQ,SAAS,4BAA4B;AAAA,EACvD,EAAE,QAAQ,UAAU,SAAS,4BAA4B;AAAA,EACzD,EAAE,QAAQ,OAAO,SAAS,8BAA8B;AAAA,EACxD,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAC1C;AAEA,IAAM,oBAAoB;AAEnB,SAAS,cAAc,UAA0B,CAAC,GAIvD;AACA,iBAAe,OAAO,SAAkB,SAA8C;AACpF,UAAM,OAAO,MAAM,UAAU,SAAS,SAAS,eAAe,QAAQ,OAAO,CAAC;AAE9E,QAAI,CAAC,QAAQ,KAAK,CAAC,UAAU,MAAM,WAAW,QAAQ,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG;AACzF,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,SAAS,0BAA0B,EAAE,GAAG,GAAG;AAAA,IACvF;AAEA,UAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,QAAI,CAAC,QAAQ;AACX,cAAQ;AAAA,QACN;AAAA,MACF;AACA,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,8BAA8B,EAAE,GAAG,GAAG;AAAA,IAC1F;AAEA,UAAM,cAAc,WAAW,SAAS,gBAAgB;AACxD,UAAM,SAAS,QAAQ,WAAW,MAAM,QAAQ,SAAS,IAAI;AAC7D,UAAM,WAAW,UAAU,eAAe,gBAAgB,OAAO,KAAK,eAAe;AAErF,UAAM,SAAS,GAAG,eAAe,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,MAAM;AACvF,UAAM,UAAkC;AAAA,MACtC,eAAe,UAAU,MAAM;AAAA,MAC/B,eAAe;AAAA,MACf,kBAAkB,QAAQ,QAAQ,IAAI,gBAAgB,KAAK;AAAA,MAC3D,QAAQ;AAAA,IACV;AACA,UAAM,WAAW,QAAQ,QAAQ,IAAI,iBAAiB;AACtD,QAAI,SAAU,SAAQ,iBAAiB,IAAI;AAE3C,UAAM,OAAO,QAAQ,WAAW,QAAQ,SAAY,MAAM,QAAQ,KAAK;AACvE,QAAI,KAAM,SAAQ,cAAc,IAAI;AAEpC,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,QAAQ,EAAE,QAAQ,QAAQ,QAAQ,SAAS,MAAM,OAAO,WAAW,CAAC;AAAA,IAC7F,QAAQ;AACN,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,4BAA4B,EAAE,GAAG,GAAG;AAAA,IACxF;AAEA,UAAM,WAAW,IAAI,SAAS,MAAM,SAAS,KAAK,GAAG;AAAA,MACnD,QAAQ,SAAS;AAAA,MACjB,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,IAC7E,CAAC;AAID,QAAI,CAAC,UAAU,aAAa,aAAa;AACvC,eAAS,QAAQ,OAAO,cAAc,gBAAgB,QAAQ,CAAC;AAAA,IACjE;AAEA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,OAAO;AACrD;AAEA,IAAM,iBAAiB,cAAc;AAE9B,IAAM,MAAM,eAAe;AAC3B,IAAM,OAAO,eAAe;AAC5B,IAAM,SAAS,eAAe;AAErC,eAAe,UACb,SACA,SACA,SACiB;AACjB,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,QAAQ,OAAO,OAAQ,QAAO,OAAO,MAAM,IAAI,kBAAkB,EAAE,KAAK,GAAG;AAE/E,QAAM,EAAE,SAAS,IAAI,IAAI,IAAI,QAAQ,GAAG;AACxC,QAAM,QAAQ,SAAS,QAAQ,OAAO;AACtC,SAAO,UAAU,KAAK,KAAK,SAAS,MAAM,QAAQ,QAAQ,MAAM,EAAE,QAAQ,OAAO,EAAE;AACrF;AAMA,SAAS,gBAAgB,SAAiC;AACxD,QAAM,UAAU,QAAQ,QAAQ,IAAI,aAAa;AACjD,SAAO,WAAW,kBAAkB,KAAK,OAAO,IAAI,UAAU;AAChE;AAEA,SAAS,WAAW,SAAkB,MAA6B;AACjE,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACnE,SAAO,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACrD;AAEA,SAAS,gBAAgB,UAA0B;AACjD,QAAM,QAAQ;AAAA,IACZ,GAAG,gBAAgB,IAAI,mBAAmB,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,WAAW,iBAAiB;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,aAAa,aAAc,OAAM,KAAK,QAAQ;AAC9D,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,KAAK,MAAe,QAA0B;AACrD,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,EAC7E,CAAC;AACH;","names":[]}