@fewchurs/next 1.0.1 → 1.2.0

package/dist/handler.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/handler.ts","../src/config.ts","../src/version.ts","../src/constants.ts"],"sourcesContent":["import \"server-only\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { resolveApiKey, resolveApiPath, resolveBaseUrl } from \"./config\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE, SDK_HEADER } from \"./constants\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface HandlerOptions {\n  apiKey?: string;\n  baseUrl?: string;\n  /** Where the handler is mounted, when it is not `/api/fewchurs`. */\n  apiPath?: string;\n  /** Return a stable, hashed id for the signed-in visitor so votes follow the account. */\n  deviceId?: DeviceIdResolver;\n}\n\ntype RouteParams = { route?: string[] };\n\n/** What Next passes: a Promise in 15, a plain object in 14. Both are awaited the same way. */\ntype IncomingContext = { params?: RouteParams | Promise<RouteParams> };\n\n// Next 15's route check wants a required second argument whose `params` is a Promise. The\n// handler itself takes `IncomingContext`, so Next 14's plain object still works at runtime.\ntype RouteContext = { params: Promise<RouteParams> };\n\nexport type RouteHandler = (request: Request, context: RouteContext) => Promise<Response>;\n\n/** Only the endpoints the board needs: everything else is a 404, not a proxy to the API. */\nconst ALLOWED: Array<{ method: string; pattern: RegExp }> = [\n  { method: \"GET\", pattern: /^config$/ },\n  { method: \"GET\", pattern: /^features$/ },\n  { method: \"POST\", pattern: /^features$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+\\/comments$/ },\n  { method: \"POST\", pattern: /^comments$/ },\n];\n\nconst DEVICE_ID_PATTERN = /^[A-Za-z0-9_-]{8,128}$/;\n\nexport function createHandler(options: HandlerOptions = {}): {\n  GET: RouteHandler;\n  POST: RouteHandler;\n  DELETE: RouteHandler;\n} {\n  async function handle(request: Request, context?: IncomingContext): Promise<Response> {\n    const path = await routePath(request, context, resolveApiPath(options.apiPath));\n\n    if (!ALLOWED.some((route) => route.method === request.method && route.pattern.test(path))) {\n      return json({ error: { code: \"not_found\", message: \"Unknown Fewchurs route.\" } }, 404);\n    }\n\n    const apiKey = resolveApiKey(options.apiKey);\n    if (!apiKey) {\n      console.error(\n        \"[fewchurs] No API key. Set FEWCHURS_API_KEY, or pass apiKey to createHandler().\",\n      );\n      return json({ error: { code: \"internal\", message: \"Fewchurs is not configured.\" } }, 500);\n    }\n\n    const cookieValue = readCookie(request, DEVICE_ID_COOKIE);\n    const custom = options.deviceId ? await options.deviceId() : null;\n    const deviceId = custom ?? cookieValue ?? claimedDeviceId(request) ?? createDeviceId();\n\n    const target = `${resolveBaseUrl(options.baseUrl)}/${path}${new URL(request.url).search}`;\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${apiKey}`,\n      \"X-Device-Id\": deviceId,\n      \"X-Fewchurs-Sdk\": request.headers.get(\"x-fewchurs-sdk\") ?? SDK_HEADER,\n      Accept: \"application/json\",\n    };\n    const language = request.headers.get(\"accept-language\");\n    if (language) headers[\"Accept-Language\"] = language;\n\n    const body = request.method === \"GET\" ? undefined : await request.text();\n    if (body) headers[\"Content-Type\"] = \"application/json\";\n\n    let upstream: Response;\n    try {\n      upstream = await fetch(target, { method: request.method, headers, body, cache: \"no-store\" });\n    } catch {\n      return json({ error: { code: \"internal\", message: \"Could not reach Fewchurs.\" } }, 502);\n    }\n\n    const response = new Response(await upstream.text(), {\n      status: upstream.status,\n      headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n    });\n\n    // A visitor keeps the same id across requests without the browser ever seeing the key,\n    // and an httpOnly cookie means page scripts cannot read or change it either.\n    if (!custom && deviceId !== cookieValue) {\n      response.headers.append(\"Set-Cookie\", serializeCookie(deviceId));\n    }\n\n    return response;\n  }\n\n  return { GET: handle, POST: handle, DELETE: handle };\n}\n\nconst defaultHandler = createHandler();\n\nexport const GET = defaultHandler.GET;\nexport const POST = defaultHandler.POST;\nexport const DELETE = defaultHandler.DELETE;\n\nasync function routePath(\n  request: Request,\n  context: IncomingContext | undefined,\n  apiPath: string,\n): Promise<string> {\n  const params = await context?.params;\n  if (params?.route?.length) return params.route.map(encodeURIComponent).join(\"/\");\n\n  const { pathname } = new URL(request.url);\n  const index = pathname.indexOf(apiPath);\n  return index === -1 ? \"\" : pathname.slice(index + apiPath.length).replace(/^\\//, \"\");\n}\n\n/**\n * The first request from a server-rendered board carries the id the page was rendered with,\n * so adopting it keeps the server's `hasVoted` answers and the browser's in agreement.\n */\nfunction claimedDeviceId(request: Request): string | null {\n  const claimed = request.headers.get(\"x-device-id\");\n  return claimed && DEVICE_ID_PATTERN.test(claimed) ? claimed : null;\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n  const header = request.headers.get(\"cookie\");\n  if (!header) return null;\n  const match = header.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match?.[1] ? decodeURIComponent(match[1]) : null;\n}\n\nfunction serializeCookie(deviceId: string): string {\n  const parts = [\n    `${DEVICE_ID_COOKIE}=${encodeURIComponent(deviceId)}`,\n    \"Path=/\",\n    `Max-Age=${DEVICE_ID_MAX_AGE}`,\n    \"HttpOnly\",\n    \"SameSite=Lax\",\n  ];\n  if (process.env.NODE_ENV === \"production\") parts.push(\"Secure\");\n  return parts.join(\"; \");\n}\n\nfunction json(body: unknown, status: number): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n  });\n}\n","import \"server-only\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\nexport function serverClient(deviceId: string | null, config: ServerConfig = {}): FewchursClient {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n  });\n}\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.0.1\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAAA,sBAAO;AACP,IAAAC,eAA+B;;;ACD/B,yBAAO;AACP,kBAA4E;AAErE,IAAM,mBAAmB;AAQzB,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAEO,SAAS,eAAe,SAA0B;AACvD,UAAQ,WAAW,QAAQ,IAAI,qBAAqB,kBAAkB,QAAQ,OAAO,EAAE;AACzF;;;ACpBO,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AHsB7C,IAAM,UAAsD;AAAA,EAC1D,EAAE,QAAQ,OAAO,SAAS,WAAW;AAAA,EACrC,EAAE,QAAQ,OAAO,SAAS,aAAa;AAAA,EACvC,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAAA,EACxC,EAAE,QAAQ,OAAO,SAAS,oBAAoB;AAAA,EAC9C,EAAE,QAAQ,QAAQ,SAAS,0BAA0B;AAAA,EACrD,EAAE,QAAQ,UAAU,SAAS,0BAA0B;AAAA,EACvD,EAAE,QAAQ,QAAQ,SAAS,4BAA4B;AAAA,EACvD,EAAE,QAAQ,UAAU,SAAS,4BAA4B;AAAA,EACzD,EAAE,QAAQ,OAAO,SAAS,8BAA8B;AAAA,EACxD,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAC1C;AAEA,IAAM,oBAAoB;AAEnB,SAAS,cAAc,UAA0B,CAAC,GAIvD;AACA,iBAAe,OAAO,SAAkB,SAA8C;AACpF,UAAM,OAAO,MAAM,UAAU,SAAS,SAAS,eAAe,QAAQ,OAAO,CAAC;AAE9E,QAAI,CAAC,QAAQ,KAAK,CAAC,UAAU,MAAM,WAAW,QAAQ,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG;AACzF,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,SAAS,0BAA0B,EAAE,GAAG,GAAG;AAAA,IACvF;AAEA,UAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,QAAI,CAAC,QAAQ;AACX,cAAQ;AAAA,QACN;AAAA,MACF;AACA,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,8BAA8B,EAAE,GAAG,GAAG;AAAA,IAC1F;AAEA,UAAM,cAAc,WAAW,SAAS,gBAAgB;AACxD,UAAM,SAAS,QAAQ,WAAW,MAAM,QAAQ,SAAS,IAAI;AAC7D,UAAM,WAAW,UAAU,eAAe,gBAAgB,OAAO,SAAK,6BAAe;AAErF,UAAM,SAAS,GAAG,eAAe,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,MAAM;AACvF,UAAM,UAAkC;AAAA,MACtC,eAAe,UAAU,MAAM;AAAA,MAC/B,eAAe;AAAA,MACf,kBAAkB,QAAQ,QAAQ,IAAI,gBAAgB,KAAK;AAAA,MAC3D,QAAQ;AAAA,IACV;AACA,UAAM,WAAW,QAAQ,QAAQ,IAAI,iBAAiB;AACtD,QAAI,SAAU,SAAQ,iBAAiB,IAAI;AAE3C,UAAM,OAAO,QAAQ,WAAW,QAAQ,SAAY,MAAM,QAAQ,KAAK;AACvE,QAAI,KAAM,SAAQ,cAAc,IAAI;AAEpC,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,QAAQ,EAAE,QAAQ,QAAQ,QAAQ,SAAS,MAAM,OAAO,WAAW,CAAC;AAAA,IAC7F,QAAQ;AACN,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,4BAA4B,EAAE,GAAG,GAAG;AAAA,IACxF;AAEA,UAAM,WAAW,IAAI,SAAS,MAAM,SAAS,KAAK,GAAG;AAAA,MACnD,QAAQ,SAAS;AAAA,MACjB,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,IAC7E,CAAC;AAID,QAAI,CAAC,UAAU,aAAa,aAAa;AACvC,eAAS,QAAQ,OAAO,cAAc,gBAAgB,QAAQ,CAAC;AAAA,IACjE;AAEA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,OAAO;AACrD;AAEA,IAAM,iBAAiB,cAAc;AAE9B,IAAM,MAAM,eAAe;AAC3B,IAAM,OAAO,eAAe;AAC5B,IAAM,SAAS,eAAe;AAErC,eAAe,UACb,SACA,SACA,SACiB;AACjB,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,QAAQ,OAAO,OAAQ,QAAO,OAAO,MAAM,IAAI,kBAAkB,EAAE,KAAK,GAAG;AAE/E,QAAM,EAAE,SAAS,IAAI,IAAI,IAAI,QAAQ,GAAG;AACxC,QAAM,QAAQ,SAAS,QAAQ,OAAO;AACtC,SAAO,UAAU,KAAK,KAAK,SAAS,MAAM,QAAQ,QAAQ,MAAM,EAAE,QAAQ,OAAO,EAAE;AACrF;AAMA,SAAS,gBAAgB,SAAiC;AACxD,QAAM,UAAU,QAAQ,QAAQ,IAAI,aAAa;AACjD,SAAO,WAAW,kBAAkB,KAAK,OAAO,IAAI,UAAU;AAChE;AAEA,SAAS,WAAW,SAAkB,MAA6B;AACjE,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACnE,SAAO,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACrD;AAEA,SAAS,gBAAgB,UAA0B;AACjD,QAAM,QAAQ;AAAA,IACZ,GAAG,gBAAgB,IAAI,mBAAmB,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,WAAW,iBAAiB;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,aAAa,aAAc,OAAM,KAAK,QAAQ;AAC9D,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,KAAK,MAAe,QAA0B;AACrD,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,EAC7E,CAAC;AACH;","names":["import_server_only","import_core"]}
+{"version":3,"sources":["../src/handler.ts","../src/config.ts","../src/version.ts","../src/constants.ts"],"sourcesContent":["import \"server-only\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport {\n  configuredAppId,\n  requestHostname,\n  resolveApiKey,\n  resolveApiPath,\n  resolveBaseUrl,\n} from \"./config\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE, SDK_HEADER } from \"./constants\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface HandlerOptions {\n  apiKey?: string;\n  baseUrl?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n  /** Where the handler is mounted, when it is not `/api/fewchurs`. */\n  apiPath?: string;\n  /** Return a stable, hashed id for the signed-in visitor so votes follow the account. */\n  deviceId?: DeviceIdResolver;\n}\n\ntype RouteParams = { route?: string[] };\n\n/** What Next passes: a Promise in 15, a plain object in 14. Both are awaited the same way. */\ntype IncomingContext = { params?: RouteParams | Promise<RouteParams> };\n\n// Next 15's route check wants a required second argument whose `params` is a Promise. The\n// handler itself takes `IncomingContext`, so Next 14's plain object still works at runtime.\ntype RouteContext = { params: Promise<RouteParams> };\n\nexport type RouteHandler = (request: Request, context: RouteContext) => Promise<Response>;\n\n/** Only the endpoints the board needs: everything else is a 404, not a proxy to the API. */\nconst ALLOWED: Array<{ method: string; pattern: RegExp }> = [\n  { method: \"GET\", pattern: /^config$/ },\n  { method: \"GET\", pattern: /^features$/ },\n  { method: \"POST\", pattern: /^features$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+\\/comments$/ },\n  { method: \"POST\", pattern: /^comments$/ },\n];\n\nconst DEVICE_ID_PATTERN = /^[A-Za-z0-9_-]{8,128}$/;\n\nexport function createHandler(options: HandlerOptions = {}): {\n  GET: RouteHandler;\n  POST: RouteHandler;\n  DELETE: RouteHandler;\n} {\n  async function handle(request: Request, context?: IncomingContext): Promise<Response> {\n    const path = await routePath(request, context, resolveApiPath(options.apiPath));\n\n    if (!ALLOWED.some((route) => route.method === request.method && route.pattern.test(path))) {\n      return json({ error: { code: \"not_found\", message: \"Unknown Fewchurs route.\" } }, 404);\n    }\n\n    const apiKey = resolveApiKey(options.apiKey);\n    if (!apiKey) {\n      console.error(\n        \"[fewchurs] No API key. Set FEWCHURS_API_KEY, or pass apiKey to createHandler().\",\n      );\n      return json({ error: { code: \"internal\", message: \"Fewchurs is not configured.\" } }, 500);\n    }\n\n    const cookieValue = readCookie(request, DEVICE_ID_COOKIE);\n    const custom = options.deviceId ? await options.deviceId() : null;\n    const deviceId = custom ?? cookieValue ?? claimedDeviceId(request) ?? createDeviceId();\n\n    const target = `${resolveBaseUrl(options.baseUrl)}/${path}${new URL(request.url).search}`;\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${apiKey}`,\n      \"X-Device-Id\": deviceId,\n      \"X-Fewchurs-Sdk\": SDK_HEADER,\n      \"X-Fewchurs-App-Id\":\n        configuredAppId(options.appId) ??\n        requestHostname(request.headers) ??\n        new URL(request.url).hostname,\n      Accept: \"application/json\",\n    };\n    const language = request.headers.get(\"accept-language\");\n    if (language) headers[\"Accept-Language\"] = language;\n\n    const body = request.method === \"GET\" ? undefined : await request.text();\n    if (body) headers[\"Content-Type\"] = \"application/json\";\n\n    let upstream: Response;\n    try {\n      upstream = await fetch(target, { method: request.method, headers, body, cache: \"no-store\" });\n    } catch {\n      return json({ error: { code: \"internal\", message: \"Could not reach Fewchurs.\" } }, 502);\n    }\n\n    const text = await upstream.text();\n    if (upstream.status === 403) logRefusal(text);\n\n    const response = new Response(text, {\n      status: upstream.status,\n      headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n    });\n\n    // A visitor keeps the same id across requests without the browser ever seeing the key,\n    // and an httpOnly cookie means page scripts cannot read or change it either.\n    if (!custom && deviceId !== cookieValue) {\n      response.headers.append(\"Set-Cookie\", serializeCookie(deviceId));\n    }\n\n    return response;\n  }\n\n  return { GET: handle, POST: handle, DELETE: handle };\n}\n\nconst defaultHandler = createHandler();\n\nexport const GET = defaultHandler.GET;\nexport const POST = defaultHandler.POST;\nexport const DELETE = defaultHandler.DELETE;\n\nlet loggedRefusal = false;\n\n/** Visitors only see a safe message, so a live site's server log is where the domain gets named. */\nfunction logRefusal(body: string): void {\n  if (loggedRefusal) return;\n  try {\n    const error = (JSON.parse(body) as { error?: { code?: string; message?: string } }).error;\n    if (error?.code !== \"wrong_app\") return;\n    loggedRefusal = true;\n    console.error(`[fewchurs] ${error.message}`);\n  } catch {\n    // Not JSON, so it isn't a refusal from Fewchurs.\n  }\n}\n\nasync function routePath(\n  request: Request,\n  context: IncomingContext | undefined,\n  apiPath: string,\n): Promise<string> {\n  const params = await context?.params;\n  if (params?.route?.length) return params.route.map(encodeURIComponent).join(\"/\");\n\n  const { pathname } = new URL(request.url);\n  const index = pathname.indexOf(apiPath);\n  return index === -1 ? \"\" : pathname.slice(index + apiPath.length).replace(/^\\//, \"\");\n}\n\n/**\n * The first request from a server-rendered board carries the id the page was rendered with,\n * so adopting it keeps the server's `hasVoted` answers and the browser's in agreement.\n */\nfunction claimedDeviceId(request: Request): string | null {\n  const claimed = request.headers.get(\"x-device-id\");\n  return claimed && DEVICE_ID_PATTERN.test(claimed) ? claimed : null;\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n  const header = request.headers.get(\"cookie\");\n  if (!header) return null;\n  const match = header.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match?.[1] ? decodeURIComponent(match[1]) : null;\n}\n\nfunction serializeCookie(deviceId: string): string {\n  const parts = [\n    `${DEVICE_ID_COOKIE}=${encodeURIComponent(deviceId)}`,\n    \"Path=/\",\n    `Max-Age=${DEVICE_ID_MAX_AGE}`,\n    \"HttpOnly\",\n    \"SameSite=Lax\",\n  ];\n  if (process.env.NODE_ENV === \"production\") parts.push(\"Secure\");\n  return parts.join(\"; \");\n}\n\nfunction json(body: unknown, status: number): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n  });\n}\n","import \"server-only\";\nimport { headers } from \"next/headers\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\n/** A domain set by the developer, which replaces the one read from the request. */\nexport function configuredAppId(appId?: string): string | undefined {\n  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || undefined;\n}\n\n/** The site's host name without a port. A reverse proxy reports the public one in `x-forwarded-host`. */\nexport function requestHostname(requestHeaders: Headers): string | undefined {\n  const forwarded = requestHeaders.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  const host = forwarded || requestHeaders.get(\"host\")?.trim();\n  if (!host) return undefined;\n  try {\n    return new URL(`http://${host}`).hostname;\n  } catch {\n    return undefined;\n  }\n}\n\nexport async function serverClient(\n  deviceId: string | null,\n  config: ServerConfig = {},\n): Promise<FewchursClient> {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n    // Only read the request when needed, so a page with a set domain can still render statically.\n    appId: configuredAppId(config.appId) ?? requestHostname(await headers()),\n  });\n}\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.2.0\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAAA,sBAAO;AACP,IAAAC,eAA+B;;;ACD/B,yBAAO;AACP,qBAAwB;AACxB,kBAA4E;AAErE,IAAM,mBAAmB;AAUzB,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAEO,SAAS,eAAe,SAA0B;AACvD,UAAQ,WAAW,QAAQ,IAAI,qBAAqB,kBAAkB,QAAQ,OAAO,EAAE;AACzF;AAGO,SAAS,gBAAgB,OAAoC;AAClE,SAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,KAAK,KAAK;AACjE;AAGO,SAAS,gBAAgB,gBAA6C;AAC3E,QAAM,YAAY,eAAe,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAC9E,QAAM,OAAO,aAAa,eAAe,IAAI,MAAM,GAAG,KAAK;AAC3D,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,IAAI,EAAE,EAAE;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACxCO,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AH8B7C,IAAM,UAAsD;AAAA,EAC1D,EAAE,QAAQ,OAAO,SAAS,WAAW;AAAA,EACrC,EAAE,QAAQ,OAAO,SAAS,aAAa;AAAA,EACvC,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAAA,EACxC,EAAE,QAAQ,OAAO,SAAS,oBAAoB;AAAA,EAC9C,EAAE,QAAQ,QAAQ,SAAS,0BAA0B;AAAA,EACrD,EAAE,QAAQ,UAAU,SAAS,0BAA0B;AAAA,EACvD,EAAE,QAAQ,QAAQ,SAAS,4BAA4B;AAAA,EACvD,EAAE,QAAQ,UAAU,SAAS,4BAA4B;AAAA,EACzD,EAAE,QAAQ,OAAO,SAAS,8BAA8B;AAAA,EACxD,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAC1C;AAEA,IAAM,oBAAoB;AAEnB,SAAS,cAAc,UAA0B,CAAC,GAIvD;AACA,iBAAe,OAAO,SAAkB,SAA8C;AACpF,UAAM,OAAO,MAAM,UAAU,SAAS,SAAS,eAAe,QAAQ,OAAO,CAAC;AAE9E,QAAI,CAAC,QAAQ,KAAK,CAAC,UAAU,MAAM,WAAW,QAAQ,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG;AACzF,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,SAAS,0BAA0B,EAAE,GAAG,GAAG;AAAA,IACvF;AAEA,UAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,QAAI,CAAC,QAAQ;AACX,cAAQ;AAAA,QACN;AAAA,MACF;AACA,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,8BAA8B,EAAE,GAAG,GAAG;AAAA,IAC1F;AAEA,UAAM,cAAc,WAAW,SAAS,gBAAgB;AACxD,UAAM,SAAS,QAAQ,WAAW,MAAM,QAAQ,SAAS,IAAI;AAC7D,UAAM,WAAW,UAAU,eAAe,gBAAgB,OAAO,SAAK,6BAAe;AAErF,UAAM,SAAS,GAAG,eAAe,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,MAAM;AACvF,UAAMC,WAAkC;AAAA,MACtC,eAAe,UAAU,MAAM;AAAA,MAC/B,eAAe;AAAA,MACf,kBAAkB;AAAA,MAClB,qBACE,gBAAgB,QAAQ,KAAK,KAC7B,gBAAgB,QAAQ,OAAO,KAC/B,IAAI,IAAI,QAAQ,GAAG,EAAE;AAAA,MACvB,QAAQ;AAAA,IACV;AACA,UAAM,WAAW,QAAQ,QAAQ,IAAI,iBAAiB;AACtD,QAAI,SAAU,CAAAA,SAAQ,iBAAiB,IAAI;AAE3C,UAAM,OAAO,QAAQ,WAAW,QAAQ,SAAY,MAAM,QAAQ,KAAK;AACvE,QAAI,KAAM,CAAAA,SAAQ,cAAc,IAAI;AAEpC,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,QAAQ,EAAE,QAAQ,QAAQ,QAAQ,SAAAA,UAAS,MAAM,OAAO,WAAW,CAAC;AAAA,IAC7F,QAAQ;AACN,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,4BAA4B,EAAE,GAAG,GAAG;AAAA,IACxF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,SAAS,WAAW,IAAK,YAAW,IAAI;AAE5C,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ,SAAS;AAAA,MACjB,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,IAC7E,CAAC;AAID,QAAI,CAAC,UAAU,aAAa,aAAa;AACvC,eAAS,QAAQ,OAAO,cAAc,gBAAgB,QAAQ,CAAC;AAAA,IACjE;AAEA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,OAAO;AACrD;AAEA,IAAM,iBAAiB,cAAc;AAE9B,IAAM,MAAM,eAAe;AAC3B,IAAM,OAAO,eAAe;AAC5B,IAAM,SAAS,eAAe;AAErC,IAAI,gBAAgB;AAGpB,SAAS,WAAW,MAAoB;AACtC,MAAI,cAAe;AACnB,MAAI;AACF,UAAM,QAAS,KAAK,MAAM,IAAI,EAAsD;AACpF,QAAI,OAAO,SAAS,YAAa;AACjC,oBAAgB;AAChB,YAAQ,MAAM,cAAc,MAAM,OAAO,EAAE;AAAA,EAC7C,QAAQ;AAAA,EAER;AACF;AAEA,eAAe,UACb,SACA,SACA,SACiB;AACjB,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,QAAQ,OAAO,OAAQ,QAAO,OAAO,MAAM,IAAI,kBAAkB,EAAE,KAAK,GAAG;AAE/E,QAAM,EAAE,SAAS,IAAI,IAAI,IAAI,QAAQ,GAAG;AACxC,QAAM,QAAQ,SAAS,QAAQ,OAAO;AACtC,SAAO,UAAU,KAAK,KAAK,SAAS,MAAM,QAAQ,QAAQ,MAAM,EAAE,QAAQ,OAAO,EAAE;AACrF;AAMA,SAAS,gBAAgB,SAAiC;AACxD,QAAM,UAAU,QAAQ,QAAQ,IAAI,aAAa;AACjD,SAAO,WAAW,kBAAkB,KAAK,OAAO,IAAI,UAAU;AAChE;AAEA,SAAS,WAAW,SAAkB,MAA6B;AACjE,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACnE,SAAO,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACrD;AAEA,SAAS,gBAAgB,UAA0B;AACjD,QAAM,QAAQ;AAAA,IACZ,GAAG,gBAAgB,IAAI,mBAAmB,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,WAAW,iBAAiB;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,aAAa,aAAc,OAAM,KAAK,QAAQ;AAC9D,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,KAAK,MAAe,QAA0B;AACrD,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,EAC7E,CAAC;AACH;","names":["import_server_only","import_core","headers"]}

package/dist/handler.mjs

@@ -3,8 +3,8 @@ import {
   GET,
   POST,
   createHandler
-} from "./chunk-KPJHLDQU.mjs";
-import "./chunk-W6QR6DEB.mjs";
+} from "./chunk-2QY6VFBK.mjs";
+import "./chunk-5F6I6CNG.mjs";
 export {
   DELETE,
   GET,

package/dist/identity.js

@@ -33,7 +33,7 @@ var import_headers = require("next/headers");
 var import_core = require("@fewchurs/react/core");
 
 // src/version.ts
-var SDK_VERSION = "1.0.1";
+var SDK_VERSION = "1.2.0";
 
 // src/constants.ts
 var DEVICE_ID_COOKIE = "fewchurs_did";

package/dist/identity.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/identity.ts","../src/version.ts","../src/constants.ts"],"sourcesContent":["import \"server-only\";\nimport { cookies } from \"next/headers\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE } from \"./constants\";\n\nexport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE };\n\nexport type DeviceIdResolver = () => string | Promise<string>;\n\n/** The visitor's id, or null when nothing has been stored for them yet. */\nexport async function readDeviceId(): Promise<string | null> {\n  const store = await cookies();\n  return store.get(DEVICE_ID_COOKIE)?.value ?? null;\n}\n\n/**\n * Reads the cookie, falling back to a fresh id. The value is not persisted here: a server\n * component cannot set cookies, so the route handler stores it on the first request instead.\n */\nexport async function resolveDeviceId(custom?: DeviceIdResolver): Promise<string> {\n  if (custom) return custom();\n  return (await readDeviceId()) ?? createDeviceId();\n}\n\nexport function deviceIdCookie(deviceId: string): {\n  name: string;\n  value: string;\n  options: {\n    httpOnly: true;\n    sameSite: \"lax\";\n    path: string;\n    maxAge: number;\n    secure: boolean;\n  };\n} {\n  return {\n    name: DEVICE_ID_COOKIE,\n    value: deviceId,\n    options: {\n      httpOnly: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: DEVICE_ID_MAX_AGE,\n      secure: process.env.NODE_ENV === \"production\",\n    },\n  };\n}\n\nexport { createDeviceId };\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.0.1\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAAO;AACP,qBAAwB;AACxB,kBAA+B;;;ACDxB,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AFK7C,eAAsB,eAAuC;AAC3D,QAAM,QAAQ,UAAM,wBAAQ;AAC5B,SAAO,MAAM,IAAI,gBAAgB,GAAG,SAAS;AAC/C;AAMA,eAAsB,gBAAgB,QAA4C;AAChF,MAAI,OAAQ,QAAO,OAAO;AAC1B,SAAQ,MAAM,aAAa,SAAM,4BAAe;AAClD;AAEO,SAAS,eAAe,UAU7B;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SAAS;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,MACV,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/identity.ts","../src/version.ts","../src/constants.ts"],"sourcesContent":["import \"server-only\";\nimport { cookies } from \"next/headers\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE } from \"./constants\";\n\nexport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE };\n\nexport type DeviceIdResolver = () => string | Promise<string>;\n\n/** The visitor's id, or null when nothing has been stored for them yet. */\nexport async function readDeviceId(): Promise<string | null> {\n  const store = await cookies();\n  return store.get(DEVICE_ID_COOKIE)?.value ?? null;\n}\n\n/**\n * Reads the cookie, falling back to a fresh id. The value is not persisted here: a server\n * component cannot set cookies, so the route handler stores it on the first request instead.\n */\nexport async function resolveDeviceId(custom?: DeviceIdResolver): Promise<string> {\n  if (custom) return custom();\n  return (await readDeviceId()) ?? createDeviceId();\n}\n\nexport function deviceIdCookie(deviceId: string): {\n  name: string;\n  value: string;\n  options: {\n    httpOnly: true;\n    sameSite: \"lax\";\n    path: string;\n    maxAge: number;\n    secure: boolean;\n  };\n} {\n  return {\n    name: DEVICE_ID_COOKIE,\n    value: deviceId,\n    options: {\n      httpOnly: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: DEVICE_ID_MAX_AGE,\n      secure: process.env.NODE_ENV === \"production\",\n    },\n  };\n}\n\nexport { createDeviceId };\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.2.0\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAAO;AACP,qBAAwB;AACxB,kBAA+B;;;ACDxB,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AFK7C,eAAsB,eAAuC;AAC3D,QAAM,QAAQ,UAAM,wBAAQ;AAC5B,SAAO,MAAM,IAAI,gBAAgB,GAAG,SAAS;AAC/C;AAMA,eAAsB,gBAAgB,QAA4C;AAChF,MAAI,OAAQ,QAAO,OAAO;AAC1B,SAAQ,MAAM,aAAa,SAAM,4BAAe;AAClD;AAEO,SAAS,eAAe,UAU7B;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SAAS;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,MACV,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}

package/dist/identity.mjs

@@ -3,11 +3,11 @@ import {
   deviceIdCookie,
   readDeviceId,
   resolveDeviceId
-} from "./chunk-QULKPZB4.mjs";
+} from "./chunk-PGFHB443.mjs";
 import {
   DEVICE_ID_COOKIE,
   DEVICE_ID_MAX_AGE
-} from "./chunk-W6QR6DEB.mjs";
+} from "./chunk-5F6I6CNG.mjs";
 export {
   DEVICE_ID_COOKIE,
   DEVICE_ID_MAX_AGE,

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { FewchursBoardProps as FewchursBoardProps$1 } from '@fewchurs/react';
+import { FewchursBoardProps as FewchursBoardProps$1, FewchursButtonProps as FewchursButtonProps$1 } from '@fewchurs/react';
 import { DeviceIdResolver } from './identity.mjs';
 export { DEVICE_ID_COOKIE, readDeviceId, resolveDeviceId } from './identity.mjs';
 export { HandlerOptions, RouteHandler, createHandler } from './handler.mjs';
@@ -13,15 +13,26 @@ interface FewchursBoardProps extends SerializableBoardProps {
     /** Where your route handler is mounted. Defaults to `/api/fewchurs`. */
     apiPath?: string;
     language?: string;
+    /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */
+    appId?: string;
     deviceId?: DeviceIdResolver;
 }
-declare function FewchursBoard({ apiKey, baseUrl, apiPath, language, deviceId: deviceIdOption, ...board }: FewchursBoardProps): Promise<React.JSX.Element>;
+declare function FewchursBoard({ apiKey, baseUrl, apiPath, language, appId, deviceId: deviceIdOption, ...board }: FewchursBoardProps): Promise<React.JSX.Element>;
+
+interface FewchursButtonProps extends Omit<FewchursButtonProps$1, "renderHeader" | "renderEmpty" | "renderFeature"> {
+    apiPath?: string;
+    language?: string;
+    deviceId?: DeviceIdResolver;
+}
+declare function FewchursButton({ apiPath, language, deviceId, ...button }: FewchursButtonProps): Promise<React.JSX.Element>;
 
 declare const DEFAULT_API_PATH = "/api/fewchurs";
 interface ServerConfig {
     apiKey?: string;
     baseUrl?: string;
     language?: string;
+    /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */
+    appId?: string;
 }
 
-export { DEFAULT_API_PATH, DeviceIdResolver, FewchursBoard, type FewchursBoardProps, type ServerConfig };
+export { DEFAULT_API_PATH, DeviceIdResolver, FewchursBoard, type FewchursBoardProps, FewchursButton, type FewchursButtonProps, type ServerConfig };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { FewchursBoardProps as FewchursBoardProps$1 } from '@fewchurs/react';
+import { FewchursBoardProps as FewchursBoardProps$1, FewchursButtonProps as FewchursButtonProps$1 } from '@fewchurs/react';
 import { DeviceIdResolver } from './identity.js';
 export { DEVICE_ID_COOKIE, readDeviceId, resolveDeviceId } from './identity.js';
 export { HandlerOptions, RouteHandler, createHandler } from './handler.js';
@@ -13,15 +13,26 @@ interface FewchursBoardProps extends SerializableBoardProps {
     /** Where your route handler is mounted. Defaults to `/api/fewchurs`. */
     apiPath?: string;
     language?: string;
+    /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */
+    appId?: string;
     deviceId?: DeviceIdResolver;
 }
-declare function FewchursBoard({ apiKey, baseUrl, apiPath, language, deviceId: deviceIdOption, ...board }: FewchursBoardProps): Promise<React.JSX.Element>;
+declare function FewchursBoard({ apiKey, baseUrl, apiPath, language, appId, deviceId: deviceIdOption, ...board }: FewchursBoardProps): Promise<React.JSX.Element>;
+
+interface FewchursButtonProps extends Omit<FewchursButtonProps$1, "renderHeader" | "renderEmpty" | "renderFeature"> {
+    apiPath?: string;
+    language?: string;
+    deviceId?: DeviceIdResolver;
+}
+declare function FewchursButton({ apiPath, language, deviceId, ...button }: FewchursButtonProps): Promise<React.JSX.Element>;
 
 declare const DEFAULT_API_PATH = "/api/fewchurs";
 interface ServerConfig {
     apiKey?: string;
     baseUrl?: string;
     language?: string;
+    /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */
+    appId?: string;
 }
 
-export { DEFAULT_API_PATH, DeviceIdResolver, FewchursBoard, type FewchursBoardProps, type ServerConfig };
+export { DEFAULT_API_PATH, DeviceIdResolver, FewchursBoard, type FewchursBoardProps, FewchursButton, type FewchursButtonProps, type ServerConfig };

package/dist/index.js

@@ -23,6 +23,7 @@ __export(src_exports, {
   DEFAULT_API_PATH: () => DEFAULT_API_PATH,
   DEVICE_ID_COOKIE: () => DEVICE_ID_COOKIE,
   FewchursBoard: () => FewchursBoard,
+  FewchursButton: () => FewchursButton,
   createHandler: () => createHandler,
   readDeviceId: () => readDeviceId,
   resolveDeviceId: () => resolveDeviceId
@@ -36,6 +37,7 @@ var import_core3 = require("@fewchurs/react/core");
 
 // src/config.ts
 var import_server_only = require("server-only");
+var import_headers = require("next/headers");
 var import_core = require("@fewchurs/react/core");
 var DEFAULT_API_PATH = "/api/fewchurs";
 function resolveApiKey(apiKey) {
@@ -47,7 +49,20 @@ function resolveBaseUrl(baseUrl) {
 function resolveApiPath(apiPath) {
   return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\/$/, "");
 }
-function serverClient(deviceId, config = {}) {
+function configuredAppId(appId) {
+  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || void 0;
+}
+function requestHostname(requestHeaders) {
+  const forwarded = requestHeaders.get("x-forwarded-host")?.split(",")[0]?.trim();
+  const host = forwarded || requestHeaders.get("host")?.trim();
+  if (!host) return void 0;
+  try {
+    return new URL(`http://${host}`).hostname;
+  } catch {
+    return void 0;
+  }
+}
+async function serverClient(deviceId, config = {}) {
   const apiKey = resolveApiKey(config.apiKey);
   if (!apiKey) {
     throw new Error(
@@ -58,17 +73,19 @@ function serverClient(deviceId, config = {}) {
     apiKey,
     baseUrl: resolveBaseUrl(config.baseUrl),
     deviceId,
-    language: config.language
+    language: config.language,
+    // Only read the request when needed, so a page with a set domain can still render statically.
+    appId: configuredAppId(config.appId) ?? requestHostname(await (0, import_headers.headers)())
   });
 }
 
 // src/identity.ts
 var import_server_only2 = require("server-only");
-var import_headers = require("next/headers");
+var import_headers2 = require("next/headers");
 var import_core2 = require("@fewchurs/react/core");
 
 // src/version.ts
-var SDK_VERSION = "1.0.1";
+var SDK_VERSION = "1.2.0";
 
 // src/constants.ts
 var DEVICE_ID_COOKIE = "fewchurs_did";
@@ -77,7 +94,7 @@ var SDK_HEADER = `next/${SDK_VERSION}`;
 
 // src/identity.ts
 async function readDeviceId() {
-  const store = await (0, import_headers.cookies)();
+  const store = await (0, import_headers2.cookies)();
   return store.get(DEVICE_ID_COOKIE)?.value ?? null;
 }
 async function resolveDeviceId(custom) {
@@ -92,11 +109,12 @@ async function FewchursBoard({
   baseUrl,
   apiPath,
   language,
+  appId,
   deviceId: deviceIdOption,
   ...board
 }) {
   const deviceId = await resolveDeviceId(deviceIdOption);
-  const client = serverClient(deviceId, { apiKey, baseUrl, language });
+  const client = await serverClient(deviceId, { apiKey, baseUrl, language, appId });
   const tab = board.defaultTab ?? board.tabs?.[0] ?? "top";
   const sort = tab === "roadmap" ? "top" : tab;
   const status = tab === "roadmap" ? import_core3.ROADMAP_STATUSES : void 0;
@@ -139,8 +157,29 @@ async function FewchursBoard({
   );
 }
 
-// src/handler.ts
+// src/button.tsx
 var import_server_only4 = require("server-only");
+var import_react2 = require("@fewchurs/react");
+var import_jsx_runtime2 = require("react/jsx-runtime");
+async function FewchursButton({
+  apiPath,
+  language,
+  deviceId,
+  ...button
+}) {
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(
+    import_react2.FewchursProvider,
+    {
+      baseUrl: resolveApiPath(apiPath),
+      language,
+      deviceId: deviceId ? await deviceId() : void 0,
+      children: /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(import_react2.FewchursButton, { ...button })
+    }
+  );
+}
+
+// src/handler.ts
+var import_server_only5 = require("server-only");
 var import_core4 = require("@fewchurs/react/core");
 var ALLOWED = [
   { method: "GET", pattern: /^config$/ },
@@ -172,23 +211,26 @@ function createHandler(options = {}) {
     const custom = options.deviceId ? await options.deviceId() : null;
     const deviceId = custom ?? cookieValue ?? claimedDeviceId(request) ?? (0, import_core4.createDeviceId)();
     const target = `${resolveBaseUrl(options.baseUrl)}/${path}${new URL(request.url).search}`;
-    const headers = {
+    const headers2 = {
       Authorization: `Bearer ${apiKey}`,
       "X-Device-Id": deviceId,
-      "X-Fewchurs-Sdk": request.headers.get("x-fewchurs-sdk") ?? SDK_HEADER,
+      "X-Fewchurs-Sdk": SDK_HEADER,
+      "X-Fewchurs-App-Id": configuredAppId(options.appId) ?? requestHostname(request.headers) ?? new URL(request.url).hostname,
       Accept: "application/json"
     };
     const language = request.headers.get("accept-language");
-    if (language) headers["Accept-Language"] = language;
+    if (language) headers2["Accept-Language"] = language;
     const body = request.method === "GET" ? void 0 : await request.text();
-    if (body) headers["Content-Type"] = "application/json";
+    if (body) headers2["Content-Type"] = "application/json";
     let upstream;
     try {
-      upstream = await fetch(target, { method: request.method, headers, body, cache: "no-store" });
+      upstream = await fetch(target, { method: request.method, headers: headers2, body, cache: "no-store" });
     } catch {
       return json({ error: { code: "internal", message: "Could not reach Fewchurs." } }, 502);
     }
-    const response = new Response(await upstream.text(), {
+    const text = await upstream.text();
+    if (upstream.status === 403) logRefusal(text);
+    const response = new Response(text, {
       status: upstream.status,
       headers: { "Content-Type": "application/json", "Cache-Control": "no-store" }
     });
@@ -203,6 +245,17 @@ var defaultHandler = createHandler();
 var GET = defaultHandler.GET;
 var POST = defaultHandler.POST;
 var DELETE = defaultHandler.DELETE;
+var loggedRefusal = false;
+function logRefusal(body) {
+  if (loggedRefusal) return;
+  try {
+    const error = JSON.parse(body).error;
+    if (error?.code !== "wrong_app") return;
+    loggedRefusal = true;
+    console.error(`[fewchurs] ${error.message}`);
+  } catch {
+  }
+}
 async function routePath(request, context, apiPath) {
   const params = await context?.params;
   if (params?.route?.length) return params.route.map(encodeURIComponent).join("/");
@@ -242,6 +295,7 @@ function json(body, status) {
   DEFAULT_API_PATH,
   DEVICE_ID_COOKIE,
   FewchursBoard,
+  FewchursButton,
   createHandler,
   readDeviceId,
   resolveDeviceId

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/board.tsx","../src/config.ts","../src/identity.ts","../src/version.ts","../src/constants.ts","../src/handler.ts"],"sourcesContent":["export { FewchursBoard } from \"./board\";\nexport type { FewchursBoardProps } from \"./board\";\nexport { createHandler } from \"./handler\";\nexport type { HandlerOptions, RouteHandler } from \"./handler\";\nexport { DEVICE_ID_COOKIE, readDeviceId, resolveDeviceId } from \"./identity\";\nexport type { DeviceIdResolver } from \"./identity\";\nexport { DEFAULT_API_PATH } from \"./config\";\nexport type { ServerConfig } from \"./config\";\n\nexport type {\n  Comment,\n  CommentPage,\n  Feature,\n  FeaturePage,\n  FeatureSort,\n  FeatureStatus,\n  FewchursConfig,\n  FewchursError,\n} from \"@fewchurs/react/core\";\n","import \"server-only\";\nimport { FewchursBoard as ClientBoard, FewchursProvider } from \"@fewchurs/react\";\nimport type { FewchursBoardProps as ClientBoardProps } from \"@fewchurs/react\";\nimport {\n  featureKey,\n  listKey,\n  ROADMAP_STATUSES,\n  type FeatureSort,\n  type StoreState,\n} from \"@fewchurs/react/core\";\nimport { resolveApiPath, serverClient } from \"./config\";\nimport { resolveDeviceId, type DeviceIdResolver } from \"./identity\";\n\n/** Function props cannot cross the server/client boundary — compose in your own client file. */\ntype SerializableBoardProps = Omit<\n  ClientBoardProps,\n  \"renderHeader\" | \"renderEmpty\" | \"renderFeature\" | \"children\"\n>;\n\nexport interface FewchursBoardProps extends SerializableBoardProps {\n  /** Defaults to `process.env.FEWCHURS_API_KEY`. Never reaches the browser. */\n  apiKey?: string;\n  baseUrl?: string;\n  /** Where your route handler is mounted. Defaults to `/api/fewchurs`. */\n  apiPath?: string;\n  language?: string;\n  deviceId?: DeviceIdResolver;\n}\n\nexport async function FewchursBoard({\n  apiKey,\n  baseUrl,\n  apiPath,\n  language,\n  deviceId: deviceIdOption,\n  ...board\n}: FewchursBoardProps): Promise<React.JSX.Element> {\n  const deviceId = await resolveDeviceId(deviceIdOption);\n  const client = serverClient(deviceId, { apiKey, baseUrl, language });\n\n  const tab = board.defaultTab ?? board.tabs?.[0] ?? \"top\";\n  const sort: FeatureSort = tab === \"roadmap\" ? \"top\" : tab;\n  const status = tab === \"roadmap\" ? ROADMAP_STATUSES : undefined;\n  const pageSize = board.pageSize ?? 20;\n\n  const [config, page, pinned] = await Promise.all([\n    client.getConfig(),\n    client.listFeatures({ sort, status, limit: pageSize }),\n    board.initialFeatureId ? client.getFeature(board.initialFeatureId) : null,\n  ]);\n\n  // Seeded under the same key the client hook will ask for, so the first paint is the\n  // rendered HTML and no second request goes out just to fetch what is already there.\n  const lists: StoreState[\"lists\"] = {};\n  if (page.ok) {\n    lists[listKey({ sort, status })] = {\n      features: page.data.features,\n      cursor: page.data.nextCursor,\n      status: \"ready\",\n      error: null,\n    };\n  }\n  // A deep-linked request is rendered on the server too, so the link lands on real content.\n  if (board.initialFeatureId && pinned?.ok) {\n    lists[featureKey(board.initialFeatureId)] = {\n      features: [pinned.data],\n      cursor: null,\n      status: \"ready\",\n      error: null,\n    };\n  }\n\n  const initialState: Partial<StoreState> = {\n    config: config.ok ? config.data : null,\n    lists,\n  };\n\n  return (\n    <FewchursProvider\n      baseUrl={resolveApiPath(apiPath)}\n      deviceId={deviceId}\n      pageSize={pageSize}\n      initialState={initialState}\n    >\n      <ClientBoard {...board} />\n    </FewchursProvider>\n  );\n}\n","import \"server-only\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\nexport function serverClient(deviceId: string | null, config: ServerConfig = {}): FewchursClient {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n  });\n}\n","import \"server-only\";\nimport { cookies } from \"next/headers\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE } from \"./constants\";\n\nexport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE };\n\nexport type DeviceIdResolver = () => string | Promise<string>;\n\n/** The visitor's id, or null when nothing has been stored for them yet. */\nexport async function readDeviceId(): Promise<string | null> {\n  const store = await cookies();\n  return store.get(DEVICE_ID_COOKIE)?.value ?? null;\n}\n\n/**\n * Reads the cookie, falling back to a fresh id. The value is not persisted here: a server\n * component cannot set cookies, so the route handler stores it on the first request instead.\n */\nexport async function resolveDeviceId(custom?: DeviceIdResolver): Promise<string> {\n  if (custom) return custom();\n  return (await readDeviceId()) ?? createDeviceId();\n}\n\nexport function deviceIdCookie(deviceId: string): {\n  name: string;\n  value: string;\n  options: {\n    httpOnly: true;\n    sameSite: \"lax\";\n    path: string;\n    maxAge: number;\n    secure: boolean;\n  };\n} {\n  return {\n    name: DEVICE_ID_COOKIE,\n    value: deviceId,\n    options: {\n      httpOnly: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: DEVICE_ID_MAX_AGE,\n      secure: process.env.NODE_ENV === \"production\",\n    },\n  };\n}\n\nexport { createDeviceId };\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.0.1\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n","import \"server-only\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { resolveApiKey, resolveApiPath, resolveBaseUrl } from \"./config\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE, SDK_HEADER } from \"./constants\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface HandlerOptions {\n  apiKey?: string;\n  baseUrl?: string;\n  /** Where the handler is mounted, when it is not `/api/fewchurs`. */\n  apiPath?: string;\n  /** Return a stable, hashed id for the signed-in visitor so votes follow the account. */\n  deviceId?: DeviceIdResolver;\n}\n\ntype RouteParams = { route?: string[] };\n\n/** What Next passes: a Promise in 15, a plain object in 14. Both are awaited the same way. */\ntype IncomingContext = { params?: RouteParams | Promise<RouteParams> };\n\n// Next 15's route check wants a required second argument whose `params` is a Promise. The\n// handler itself takes `IncomingContext`, so Next 14's plain object still works at runtime.\ntype RouteContext = { params: Promise<RouteParams> };\n\nexport type RouteHandler = (request: Request, context: RouteContext) => Promise<Response>;\n\n/** Only the endpoints the board needs: everything else is a 404, not a proxy to the API. */\nconst ALLOWED: Array<{ method: string; pattern: RegExp }> = [\n  { method: \"GET\", pattern: /^config$/ },\n  { method: \"GET\", pattern: /^features$/ },\n  { method: \"POST\", pattern: /^features$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+\\/comments$/ },\n  { method: \"POST\", pattern: /^comments$/ },\n];\n\nconst DEVICE_ID_PATTERN = /^[A-Za-z0-9_-]{8,128}$/;\n\nexport function createHandler(options: HandlerOptions = {}): {\n  GET: RouteHandler;\n  POST: RouteHandler;\n  DELETE: RouteHandler;\n} {\n  async function handle(request: Request, context?: IncomingContext): Promise<Response> {\n    const path = await routePath(request, context, resolveApiPath(options.apiPath));\n\n    if (!ALLOWED.some((route) => route.method === request.method && route.pattern.test(path))) {\n      return json({ error: { code: \"not_found\", message: \"Unknown Fewchurs route.\" } }, 404);\n    }\n\n    const apiKey = resolveApiKey(options.apiKey);\n    if (!apiKey) {\n      console.error(\n        \"[fewchurs] No API key. Set FEWCHURS_API_KEY, or pass apiKey to createHandler().\",\n      );\n      return json({ error: { code: \"internal\", message: \"Fewchurs is not configured.\" } }, 500);\n    }\n\n    const cookieValue = readCookie(request, DEVICE_ID_COOKIE);\n    const custom = options.deviceId ? await options.deviceId() : null;\n    const deviceId = custom ?? cookieValue ?? claimedDeviceId(request) ?? createDeviceId();\n\n    const target = `${resolveBaseUrl(options.baseUrl)}/${path}${new URL(request.url).search}`;\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${apiKey}`,\n      \"X-Device-Id\": deviceId,\n      \"X-Fewchurs-Sdk\": request.headers.get(\"x-fewchurs-sdk\") ?? SDK_HEADER,\n      Accept: \"application/json\",\n    };\n    const language = request.headers.get(\"accept-language\");\n    if (language) headers[\"Accept-Language\"] = language;\n\n    const body = request.method === \"GET\" ? undefined : await request.text();\n    if (body) headers[\"Content-Type\"] = \"application/json\";\n\n    let upstream: Response;\n    try {\n      upstream = await fetch(target, { method: request.method, headers, body, cache: \"no-store\" });\n    } catch {\n      return json({ error: { code: \"internal\", message: \"Could not reach Fewchurs.\" } }, 502);\n    }\n\n    const response = new Response(await upstream.text(), {\n      status: upstream.status,\n      headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n    });\n\n    // A visitor keeps the same id across requests without the browser ever seeing the key,\n    // and an httpOnly cookie means page scripts cannot read or change it either.\n    if (!custom && deviceId !== cookieValue) {\n      response.headers.append(\"Set-Cookie\", serializeCookie(deviceId));\n    }\n\n    return response;\n  }\n\n  return { GET: handle, POST: handle, DELETE: handle };\n}\n\nconst defaultHandler = createHandler();\n\nexport const GET = defaultHandler.GET;\nexport const POST = defaultHandler.POST;\nexport const DELETE = defaultHandler.DELETE;\n\nasync function routePath(\n  request: Request,\n  context: IncomingContext | undefined,\n  apiPath: string,\n): Promise<string> {\n  const params = await context?.params;\n  if (params?.route?.length) return params.route.map(encodeURIComponent).join(\"/\");\n\n  const { pathname } = new URL(request.url);\n  const index = pathname.indexOf(apiPath);\n  return index === -1 ? \"\" : pathname.slice(index + apiPath.length).replace(/^\\//, \"\");\n}\n\n/**\n * The first request from a server-rendered board carries the id the page was rendered with,\n * so adopting it keeps the server's `hasVoted` answers and the browser's in agreement.\n */\nfunction claimedDeviceId(request: Request): string | null {\n  const claimed = request.headers.get(\"x-device-id\");\n  return claimed && DEVICE_ID_PATTERN.test(claimed) ? claimed : null;\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n  const header = request.headers.get(\"cookie\");\n  if (!header) return null;\n  const match = header.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match?.[1] ? decodeURIComponent(match[1]) : null;\n}\n\nfunction serializeCookie(deviceId: string): string {\n  const parts = [\n    `${DEVICE_ID_COOKIE}=${encodeURIComponent(deviceId)}`,\n    \"Path=/\",\n    `Max-Age=${DEVICE_ID_MAX_AGE}`,\n    \"HttpOnly\",\n    \"SameSite=Lax\",\n  ];\n  if (process.env.NODE_ENV === \"production\") parts.push(\"Secure\");\n  return parts.join(\"; \");\n}\n\nfunction json(body: unknown, status: number): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,sBAAO;AACP,mBAA+D;AAE/D,IAAAC,eAMO;;;ACTP,yBAAO;AACP,kBAA4E;AAErE,IAAM,mBAAmB;AAQzB,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAEO,SAAS,eAAe,SAA0B;AACvD,UAAQ,WAAW,QAAQ,IAAI,qBAAqB,kBAAkB,QAAQ,OAAO,EAAE;AACzF;AAEO,SAAS,aAAa,UAAyB,SAAuB,CAAC,GAAmB;AAC/F,QAAM,SAAS,cAAc,OAAO,MAAM;AAC1C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,aAAO,kCAAqB;AAAA,IAC1B;AAAA,IACA,SAAS,eAAe,OAAO,OAAO;AAAA,IACtC;AAAA,IACA,UAAU,OAAO;AAAA,EACnB,CAAC;AACH;;;ACrCA,IAAAC,sBAAO;AACP,qBAAwB;AACxB,IAAAC,eAA+B;;;ACDxB,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AFK7C,eAAsB,eAAuC;AAC3D,QAAM,QAAQ,UAAM,wBAAQ;AAC5B,SAAO,MAAM,IAAI,gBAAgB,GAAG,SAAS;AAC/C;AAMA,eAAsB,gBAAgB,QAA4C;AAChF,MAAI,OAAQ,QAAO,OAAO;AAC1B,SAAQ,MAAM,aAAa,SAAM,6BAAe;AAClD;;;AF8DM;AAvDN,eAAsB,cAAc;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV,GAAG;AACL,GAAmD;AACjD,QAAM,WAAW,MAAM,gBAAgB,cAAc;AACrD,QAAM,SAAS,aAAa,UAAU,EAAE,QAAQ,SAAS,SAAS,CAAC;AAEnE,QAAM,MAAM,MAAM,cAAc,MAAM,OAAO,CAAC,KAAK;AACnD,QAAM,OAAoB,QAAQ,YAAY,QAAQ;AACtD,QAAM,SAAS,QAAQ,YAAY,gCAAmB;AACtD,QAAM,WAAW,MAAM,YAAY;AAEnC,QAAM,CAAC,QAAQ,MAAM,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC/C,OAAO,UAAU;AAAA,IACjB,OAAO,aAAa,EAAE,MAAM,QAAQ,OAAO,SAAS,CAAC;AAAA,IACrD,MAAM,mBAAmB,OAAO,WAAW,MAAM,gBAAgB,IAAI;AAAA,EACvE,CAAC;AAID,QAAM,QAA6B,CAAC;AACpC,MAAI,KAAK,IAAI;AACX,cAAM,sBAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,IAAI;AAAA,MACjC,UAAU,KAAK,KAAK;AAAA,MACpB,QAAQ,KAAK,KAAK;AAAA,MAClB,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,MAAM,oBAAoB,QAAQ,IAAI;AACxC,cAAM,yBAAW,MAAM,gBAAgB,CAAC,IAAI;AAAA,MAC1C,UAAU,CAAC,OAAO,IAAI;AAAA,MACtB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,eAAoC;AAAA,IACxC,QAAQ,OAAO,KAAK,OAAO,OAAO;AAAA,IAClC;AAAA,EACF;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS,eAAe,OAAO;AAAA,MAC/B;AAAA,MACA;AAAA,MACA;AAAA,MAEA,sDAAC,aAAAC,eAAA,EAAa,GAAG,OAAO;AAAA;AAAA,EAC1B;AAEJ;;;AKvFA,IAAAC,sBAAO;AACP,IAAAC,eAA+B;AA0B/B,IAAM,UAAsD;AAAA,EAC1D,EAAE,QAAQ,OAAO,SAAS,WAAW;AAAA,EACrC,EAAE,QAAQ,OAAO,SAAS,aAAa;AAAA,EACvC,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAAA,EACxC,EAAE,QAAQ,OAAO,SAAS,oBAAoB;AAAA,EAC9C,EAAE,QAAQ,QAAQ,SAAS,0BAA0B;AAAA,EACrD,EAAE,QAAQ,UAAU,SAAS,0BAA0B;AAAA,EACvD,EAAE,QAAQ,QAAQ,SAAS,4BAA4B;AAAA,EACvD,EAAE,QAAQ,UAAU,SAAS,4BAA4B;AAAA,EACzD,EAAE,QAAQ,OAAO,SAAS,8BAA8B;AAAA,EACxD,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAC1C;AAEA,IAAM,oBAAoB;AAEnB,SAAS,cAAc,UAA0B,CAAC,GAIvD;AACA,iBAAe,OAAO,SAAkB,SAA8C;AACpF,UAAM,OAAO,MAAM,UAAU,SAAS,SAAS,eAAe,QAAQ,OAAO,CAAC;AAE9E,QAAI,CAAC,QAAQ,KAAK,CAAC,UAAU,MAAM,WAAW,QAAQ,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG;AACzF,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,SAAS,0BAA0B,EAAE,GAAG,GAAG;AAAA,IACvF;AAEA,UAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,QAAI,CAAC,QAAQ;AACX,cAAQ;AAAA,QACN;AAAA,MACF;AACA,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,8BAA8B,EAAE,GAAG,GAAG;AAAA,IAC1F;AAEA,UAAM,cAAc,WAAW,SAAS,gBAAgB;AACxD,UAAM,SAAS,QAAQ,WAAW,MAAM,QAAQ,SAAS,IAAI;AAC7D,UAAM,WAAW,UAAU,eAAe,gBAAgB,OAAO,SAAK,6BAAe;AAErF,UAAM,SAAS,GAAG,eAAe,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,MAAM;AACvF,UAAM,UAAkC;AAAA,MACtC,eAAe,UAAU,MAAM;AAAA,MAC/B,eAAe;AAAA,MACf,kBAAkB,QAAQ,QAAQ,IAAI,gBAAgB,KAAK;AAAA,MAC3D,QAAQ;AAAA,IACV;AACA,UAAM,WAAW,QAAQ,QAAQ,IAAI,iBAAiB;AACtD,QAAI,SAAU,SAAQ,iBAAiB,IAAI;AAE3C,UAAM,OAAO,QAAQ,WAAW,QAAQ,SAAY,MAAM,QAAQ,KAAK;AACvE,QAAI,KAAM,SAAQ,cAAc,IAAI;AAEpC,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,QAAQ,EAAE,QAAQ,QAAQ,QAAQ,SAAS,MAAM,OAAO,WAAW,CAAC;AAAA,IAC7F,QAAQ;AACN,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,4BAA4B,EAAE,GAAG,GAAG;AAAA,IACxF;AAEA,UAAM,WAAW,IAAI,SAAS,MAAM,SAAS,KAAK,GAAG;AAAA,MACnD,QAAQ,SAAS;AAAA,MACjB,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,IAC7E,CAAC;AAID,QAAI,CAAC,UAAU,aAAa,aAAa;AACvC,eAAS,QAAQ,OAAO,cAAc,gBAAgB,QAAQ,CAAC;AAAA,IACjE;AAEA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,OAAO;AACrD;AAEA,IAAM,iBAAiB,cAAc;AAE9B,IAAM,MAAM,eAAe;AAC3B,IAAM,OAAO,eAAe;AAC5B,IAAM,SAAS,eAAe;AAErC,eAAe,UACb,SACA,SACA,SACiB;AACjB,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,QAAQ,OAAO,OAAQ,QAAO,OAAO,MAAM,IAAI,kBAAkB,EAAE,KAAK,GAAG;AAE/E,QAAM,EAAE,SAAS,IAAI,IAAI,IAAI,QAAQ,GAAG;AACxC,QAAM,QAAQ,SAAS,QAAQ,OAAO;AACtC,SAAO,UAAU,KAAK,KAAK,SAAS,MAAM,QAAQ,QAAQ,MAAM,EAAE,QAAQ,OAAO,EAAE;AACrF;AAMA,SAAS,gBAAgB,SAAiC;AACxD,QAAM,UAAU,QAAQ,QAAQ,IAAI,aAAa;AACjD,SAAO,WAAW,kBAAkB,KAAK,OAAO,IAAI,UAAU;AAChE;AAEA,SAAS,WAAW,SAAkB,MAA6B;AACjE,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACnE,SAAO,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACrD;AAEA,SAAS,gBAAgB,UAA0B;AACjD,QAAM,QAAQ;AAAA,IACZ,GAAG,gBAAgB,IAAI,mBAAmB,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,WAAW,iBAAiB;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,aAAa,aAAc,OAAM,KAAK,QAAQ;AAC9D,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,KAAK,MAAe,QAA0B;AACrD,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,EAC7E,CAAC;AACH;","names":["import_server_only","import_core","import_server_only","import_core","ClientBoard","import_server_only","import_core"]}
+{"version":3,"sources":["../src/index.ts","../src/board.tsx","../src/config.ts","../src/identity.ts","../src/version.ts","../src/constants.ts","../src/button.tsx","../src/handler.ts"],"sourcesContent":["export { FewchursBoard } from \"./board\";\nexport type { FewchursBoardProps } from \"./board\";\nexport { FewchursButton } from \"./button\";\nexport type { FewchursButtonProps } from \"./button\";\nexport { createHandler } from \"./handler\";\nexport type { HandlerOptions, RouteHandler } from \"./handler\";\nexport { DEVICE_ID_COOKIE, readDeviceId, resolveDeviceId } from \"./identity\";\nexport type { DeviceIdResolver } from \"./identity\";\nexport { DEFAULT_API_PATH } from \"./config\";\nexport type { ServerConfig } from \"./config\";\n\nexport type {\n  Comment,\n  CommentPage,\n  Feature,\n  FeaturePage,\n  FeatureSort,\n  FeatureStatus,\n  FewchursConfig,\n  FewchursError,\n} from \"@fewchurs/react/core\";\n","import \"server-only\";\nimport { FewchursBoard as ClientBoard, FewchursProvider } from \"@fewchurs/react\";\nimport type { FewchursBoardProps as ClientBoardProps } from \"@fewchurs/react\";\nimport {\n  featureKey,\n  listKey,\n  ROADMAP_STATUSES,\n  type FeatureSort,\n  type StoreState,\n} from \"@fewchurs/react/core\";\nimport { resolveApiPath, serverClient } from \"./config\";\nimport { resolveDeviceId, type DeviceIdResolver } from \"./identity\";\n\n/** Function props cannot cross the server/client boundary — compose in your own client file. */\ntype SerializableBoardProps = Omit<\n  ClientBoardProps,\n  \"renderHeader\" | \"renderEmpty\" | \"renderFeature\" | \"children\"\n>;\n\nexport interface FewchursBoardProps extends SerializableBoardProps {\n  /** Defaults to `process.env.FEWCHURS_API_KEY`. Never reaches the browser. */\n  apiKey?: string;\n  baseUrl?: string;\n  /** Where your route handler is mounted. Defaults to `/api/fewchurs`. */\n  apiPath?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n  deviceId?: DeviceIdResolver;\n}\n\nexport async function FewchursBoard({\n  apiKey,\n  baseUrl,\n  apiPath,\n  language,\n  appId,\n  deviceId: deviceIdOption,\n  ...board\n}: FewchursBoardProps): Promise<React.JSX.Element> {\n  const deviceId = await resolveDeviceId(deviceIdOption);\n  const client = await serverClient(deviceId, { apiKey, baseUrl, language, appId });\n\n  const tab = board.defaultTab ?? board.tabs?.[0] ?? \"top\";\n  const sort: FeatureSort = tab === \"roadmap\" ? \"top\" : tab;\n  const status = tab === \"roadmap\" ? ROADMAP_STATUSES : undefined;\n  const pageSize = board.pageSize ?? 20;\n\n  const [config, page, pinned] = await Promise.all([\n    client.getConfig(),\n    client.listFeatures({ sort, status, limit: pageSize }),\n    board.initialFeatureId ? client.getFeature(board.initialFeatureId) : null,\n  ]);\n\n  // Seeded under the same key the client hook will ask for, so the first paint is the\n  // rendered HTML and no second request goes out just to fetch what is already there.\n  const lists: StoreState[\"lists\"] = {};\n  if (page.ok) {\n    lists[listKey({ sort, status })] = {\n      features: page.data.features,\n      cursor: page.data.nextCursor,\n      status: \"ready\",\n      error: null,\n    };\n  }\n  // A deep-linked request is rendered on the server too, so the link lands on real content.\n  if (board.initialFeatureId && pinned?.ok) {\n    lists[featureKey(board.initialFeatureId)] = {\n      features: [pinned.data],\n      cursor: null,\n      status: \"ready\",\n      error: null,\n    };\n  }\n\n  const initialState: Partial<StoreState> = {\n    config: config.ok ? config.data : null,\n    lists,\n  };\n\n  return (\n    <FewchursProvider\n      baseUrl={resolveApiPath(apiPath)}\n      deviceId={deviceId}\n      pageSize={pageSize}\n      initialState={initialState}\n    >\n      <ClientBoard {...board} />\n    </FewchursProvider>\n  );\n}\n","import \"server-only\";\nimport { headers } from \"next/headers\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\n/** A domain set by the developer, which replaces the one read from the request. */\nexport function configuredAppId(appId?: string): string | undefined {\n  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || undefined;\n}\n\n/** The site's host name without a port. A reverse proxy reports the public one in `x-forwarded-host`. */\nexport function requestHostname(requestHeaders: Headers): string | undefined {\n  const forwarded = requestHeaders.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  const host = forwarded || requestHeaders.get(\"host\")?.trim();\n  if (!host) return undefined;\n  try {\n    return new URL(`http://${host}`).hostname;\n  } catch {\n    return undefined;\n  }\n}\n\nexport async function serverClient(\n  deviceId: string | null,\n  config: ServerConfig = {},\n): Promise<FewchursClient> {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n    // Only read the request when needed, so a page with a set domain can still render statically.\n    appId: configuredAppId(config.appId) ?? requestHostname(await headers()),\n  });\n}\n","import \"server-only\";\nimport { cookies } from \"next/headers\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE } from \"./constants\";\n\nexport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE };\n\nexport type DeviceIdResolver = () => string | Promise<string>;\n\n/** The visitor's id, or null when nothing has been stored for them yet. */\nexport async function readDeviceId(): Promise<string | null> {\n  const store = await cookies();\n  return store.get(DEVICE_ID_COOKIE)?.value ?? null;\n}\n\n/**\n * Reads the cookie, falling back to a fresh id. The value is not persisted here: a server\n * component cannot set cookies, so the route handler stores it on the first request instead.\n */\nexport async function resolveDeviceId(custom?: DeviceIdResolver): Promise<string> {\n  if (custom) return custom();\n  return (await readDeviceId()) ?? createDeviceId();\n}\n\nexport function deviceIdCookie(deviceId: string): {\n  name: string;\n  value: string;\n  options: {\n    httpOnly: true;\n    sameSite: \"lax\";\n    path: string;\n    maxAge: number;\n    secure: boolean;\n  };\n} {\n  return {\n    name: DEVICE_ID_COOKIE,\n    value: deviceId,\n    options: {\n      httpOnly: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: DEVICE_ID_MAX_AGE,\n      secure: process.env.NODE_ENV === \"production\",\n    },\n  };\n}\n\nexport { createDeviceId };\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.2.0\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n","import \"server-only\";\nimport { FewchursButton as ClientButton, FewchursProvider } from \"@fewchurs/react\";\nimport type { FewchursButtonProps as ClientButtonProps } from \"@fewchurs/react\";\nimport { resolveApiPath } from \"./config\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface FewchursButtonProps extends Omit<\n  ClientButtonProps,\n  \"renderHeader\" | \"renderEmpty\" | \"renderFeature\"\n> {\n  apiPath?: string;\n  language?: string;\n  deviceId?: DeviceIdResolver;\n}\n\nexport async function FewchursButton({\n  apiPath,\n  language,\n  deviceId,\n  ...button\n}: FewchursButtonProps): Promise<React.JSX.Element> {\n  return (\n    <FewchursProvider\n      baseUrl={resolveApiPath(apiPath)}\n      language={language}\n      deviceId={deviceId ? await deviceId() : undefined}\n    >\n      <ClientButton {...button} />\n    </FewchursProvider>\n  );\n}\n","import \"server-only\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport {\n  configuredAppId,\n  requestHostname,\n  resolveApiKey,\n  resolveApiPath,\n  resolveBaseUrl,\n} from \"./config\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE, SDK_HEADER } from \"./constants\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface HandlerOptions {\n  apiKey?: string;\n  baseUrl?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n  /** Where the handler is mounted, when it is not `/api/fewchurs`. */\n  apiPath?: string;\n  /** Return a stable, hashed id for the signed-in visitor so votes follow the account. */\n  deviceId?: DeviceIdResolver;\n}\n\ntype RouteParams = { route?: string[] };\n\n/** What Next passes: a Promise in 15, a plain object in 14. Both are awaited the same way. */\ntype IncomingContext = { params?: RouteParams | Promise<RouteParams> };\n\n// Next 15's route check wants a required second argument whose `params` is a Promise. The\n// handler itself takes `IncomingContext`, so Next 14's plain object still works at runtime.\ntype RouteContext = { params: Promise<RouteParams> };\n\nexport type RouteHandler = (request: Request, context: RouteContext) => Promise<Response>;\n\n/** Only the endpoints the board needs: everything else is a 404, not a proxy to the API. */\nconst ALLOWED: Array<{ method: string; pattern: RegExp }> = [\n  { method: \"GET\", pattern: /^config$/ },\n  { method: \"GET\", pattern: /^features$/ },\n  { method: \"POST\", pattern: /^features$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+\\/comments$/ },\n  { method: \"POST\", pattern: /^comments$/ },\n];\n\nconst DEVICE_ID_PATTERN = /^[A-Za-z0-9_-]{8,128}$/;\n\nexport function createHandler(options: HandlerOptions = {}): {\n  GET: RouteHandler;\n  POST: RouteHandler;\n  DELETE: RouteHandler;\n} {\n  async function handle(request: Request, context?: IncomingContext): Promise<Response> {\n    const path = await routePath(request, context, resolveApiPath(options.apiPath));\n\n    if (!ALLOWED.some((route) => route.method === request.method && route.pattern.test(path))) {\n      return json({ error: { code: \"not_found\", message: \"Unknown Fewchurs route.\" } }, 404);\n    }\n\n    const apiKey = resolveApiKey(options.apiKey);\n    if (!apiKey) {\n      console.error(\n        \"[fewchurs] No API key. Set FEWCHURS_API_KEY, or pass apiKey to createHandler().\",\n      );\n      return json({ error: { code: \"internal\", message: \"Fewchurs is not configured.\" } }, 500);\n    }\n\n    const cookieValue = readCookie(request, DEVICE_ID_COOKIE);\n    const custom = options.deviceId ? await options.deviceId() : null;\n    const deviceId = custom ?? cookieValue ?? claimedDeviceId(request) ?? createDeviceId();\n\n    const target = `${resolveBaseUrl(options.baseUrl)}/${path}${new URL(request.url).search}`;\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${apiKey}`,\n      \"X-Device-Id\": deviceId,\n      \"X-Fewchurs-Sdk\": SDK_HEADER,\n      \"X-Fewchurs-App-Id\":\n        configuredAppId(options.appId) ??\n        requestHostname(request.headers) ??\n        new URL(request.url).hostname,\n      Accept: \"application/json\",\n    };\n    const language = request.headers.get(\"accept-language\");\n    if (language) headers[\"Accept-Language\"] = language;\n\n    const body = request.method === \"GET\" ? undefined : await request.text();\n    if (body) headers[\"Content-Type\"] = \"application/json\";\n\n    let upstream: Response;\n    try {\n      upstream = await fetch(target, { method: request.method, headers, body, cache: \"no-store\" });\n    } catch {\n      return json({ error: { code: \"internal\", message: \"Could not reach Fewchurs.\" } }, 502);\n    }\n\n    const text = await upstream.text();\n    if (upstream.status === 403) logRefusal(text);\n\n    const response = new Response(text, {\n      status: upstream.status,\n      headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n    });\n\n    // A visitor keeps the same id across requests without the browser ever seeing the key,\n    // and an httpOnly cookie means page scripts cannot read or change it either.\n    if (!custom && deviceId !== cookieValue) {\n      response.headers.append(\"Set-Cookie\", serializeCookie(deviceId));\n    }\n\n    return response;\n  }\n\n  return { GET: handle, POST: handle, DELETE: handle };\n}\n\nconst defaultHandler = createHandler();\n\nexport const GET = defaultHandler.GET;\nexport const POST = defaultHandler.POST;\nexport const DELETE = defaultHandler.DELETE;\n\nlet loggedRefusal = false;\n\n/** Visitors only see a safe message, so a live site's server log is where the domain gets named. */\nfunction logRefusal(body: string): void {\n  if (loggedRefusal) return;\n  try {\n    const error = (JSON.parse(body) as { error?: { code?: string; message?: string } }).error;\n    if (error?.code !== \"wrong_app\") return;\n    loggedRefusal = true;\n    console.error(`[fewchurs] ${error.message}`);\n  } catch {\n    // Not JSON, so it isn't a refusal from Fewchurs.\n  }\n}\n\nasync function routePath(\n  request: Request,\n  context: IncomingContext | undefined,\n  apiPath: string,\n): Promise<string> {\n  const params = await context?.params;\n  if (params?.route?.length) return params.route.map(encodeURIComponent).join(\"/\");\n\n  const { pathname } = new URL(request.url);\n  const index = pathname.indexOf(apiPath);\n  return index === -1 ? \"\" : pathname.slice(index + apiPath.length).replace(/^\\//, \"\");\n}\n\n/**\n * The first request from a server-rendered board carries the id the page was rendered with,\n * so adopting it keeps the server's `hasVoted` answers and the browser's in agreement.\n */\nfunction claimedDeviceId(request: Request): string | null {\n  const claimed = request.headers.get(\"x-device-id\");\n  return claimed && DEVICE_ID_PATTERN.test(claimed) ? claimed : null;\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n  const header = request.headers.get(\"cookie\");\n  if (!header) return null;\n  const match = header.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match?.[1] ? decodeURIComponent(match[1]) : null;\n}\n\nfunction serializeCookie(deviceId: string): string {\n  const parts = [\n    `${DEVICE_ID_COOKIE}=${encodeURIComponent(deviceId)}`,\n    \"Path=/\",\n    `Max-Age=${DEVICE_ID_MAX_AGE}`,\n    \"HttpOnly\",\n    \"SameSite=Lax\",\n  ];\n  if (process.env.NODE_ENV === \"production\") parts.push(\"Secure\");\n  return parts.join(\"; \");\n}\n\nfunction json(body: unknown, status: number): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,sBAAO;AACP,mBAA+D;AAE/D,IAAAC,eAMO;;;ACTP,yBAAO;AACP,qBAAwB;AACxB,kBAA4E;AAErE,IAAM,mBAAmB;AAUzB,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAEO,SAAS,eAAe,SAA0B;AACvD,UAAQ,WAAW,QAAQ,IAAI,qBAAqB,kBAAkB,QAAQ,OAAO,EAAE;AACzF;AAGO,SAAS,gBAAgB,OAAoC;AAClE,SAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,KAAK,KAAK;AACjE;AAGO,SAAS,gBAAgB,gBAA6C;AAC3E,QAAM,YAAY,eAAe,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAC9E,QAAM,OAAO,aAAa,eAAe,IAAI,MAAM,GAAG,KAAK;AAC3D,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,IAAI,EAAE,EAAE;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,aACpB,UACA,SAAuB,CAAC,GACC;AACzB,QAAM,SAAS,cAAc,OAAO,MAAM;AAC1C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,aAAO,kCAAqB;AAAA,IAC1B;AAAA,IACA,SAAS,eAAe,OAAO,OAAO;AAAA,IACtC;AAAA,IACA,UAAU,OAAO;AAAA;AAAA,IAEjB,OAAO,gBAAgB,OAAO,KAAK,KAAK,gBAAgB,UAAM,wBAAQ,CAAC;AAAA,EACzE,CAAC;AACH;;;AC9DA,IAAAC,sBAAO;AACP,IAAAC,kBAAwB;AACxB,IAAAC,eAA+B;;;ACDxB,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AFK7C,eAAsB,eAAuC;AAC3D,QAAM,QAAQ,UAAM,yBAAQ;AAC5B,SAAO,MAAM,IAAI,gBAAgB,GAAG,SAAS;AAC/C;AAMA,eAAsB,gBAAgB,QAA4C;AAChF,MAAI,OAAQ,QAAO,OAAO;AAC1B,SAAQ,MAAM,aAAa,SAAM,6BAAe;AAClD;;;AFiEM;AAxDN,eAAsB,cAAc;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV,GAAG;AACL,GAAmD;AACjD,QAAM,WAAW,MAAM,gBAAgB,cAAc;AACrD,QAAM,SAAS,MAAM,aAAa,UAAU,EAAE,QAAQ,SAAS,UAAU,MAAM,CAAC;AAEhF,QAAM,MAAM,MAAM,cAAc,MAAM,OAAO,CAAC,KAAK;AACnD,QAAM,OAAoB,QAAQ,YAAY,QAAQ;AACtD,QAAM,SAAS,QAAQ,YAAY,gCAAmB;AACtD,QAAM,WAAW,MAAM,YAAY;AAEnC,QAAM,CAAC,QAAQ,MAAM,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC/C,OAAO,UAAU;AAAA,IACjB,OAAO,aAAa,EAAE,MAAM,QAAQ,OAAO,SAAS,CAAC;AAAA,IACrD,MAAM,mBAAmB,OAAO,WAAW,MAAM,gBAAgB,IAAI;AAAA,EACvE,CAAC;AAID,QAAM,QAA6B,CAAC;AACpC,MAAI,KAAK,IAAI;AACX,cAAM,sBAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,IAAI;AAAA,MACjC,UAAU,KAAK,KAAK;AAAA,MACpB,QAAQ,KAAK,KAAK;AAAA,MAClB,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,MAAM,oBAAoB,QAAQ,IAAI;AACxC,cAAM,yBAAW,MAAM,gBAAgB,CAAC,IAAI;AAAA,MAC1C,UAAU,CAAC,OAAO,IAAI;AAAA,MACtB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,eAAoC;AAAA,IACxC,QAAQ,OAAO,KAAK,OAAO,OAAO;AAAA,IAClC;AAAA,EACF;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS,eAAe,OAAO;AAAA,MAC/B;AAAA,MACA;AAAA,MACA;AAAA,MAEA,sDAAC,aAAAC,eAAA,EAAa,GAAG,OAAO;AAAA;AAAA,EAC1B;AAEJ;;;AK1FA,IAAAC,sBAAO;AACP,IAAAC,gBAAiE;AA0B3D,IAAAC,sBAAA;AAZN,eAAsB,eAAe;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,GAAoD;AAClD,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS,eAAe,OAAO;AAAA,MAC/B;AAAA,MACA,UAAU,WAAW,MAAM,SAAS,IAAI;AAAA,MAExC,uDAAC,cAAAC,gBAAA,EAAc,GAAG,QAAQ;AAAA;AAAA,EAC5B;AAEJ;;;AC9BA,IAAAC,sBAAO;AACP,IAAAC,eAA+B;AAkC/B,IAAM,UAAsD;AAAA,EAC1D,EAAE,QAAQ,OAAO,SAAS,WAAW;AAAA,EACrC,EAAE,QAAQ,OAAO,SAAS,aAAa;AAAA,EACvC,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAAA,EACxC,EAAE,QAAQ,OAAO,SAAS,oBAAoB;AAAA,EAC9C,EAAE,QAAQ,QAAQ,SAAS,0BAA0B;AAAA,EACrD,EAAE,QAAQ,UAAU,SAAS,0BAA0B;AAAA,EACvD,EAAE,QAAQ,QAAQ,SAAS,4BAA4B;AAAA,EACvD,EAAE,QAAQ,UAAU,SAAS,4BAA4B;AAAA,EACzD,EAAE,QAAQ,OAAO,SAAS,8BAA8B;AAAA,EACxD,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAC1C;AAEA,IAAM,oBAAoB;AAEnB,SAAS,cAAc,UAA0B,CAAC,GAIvD;AACA,iBAAe,OAAO,SAAkB,SAA8C;AACpF,UAAM,OAAO,MAAM,UAAU,SAAS,SAAS,eAAe,QAAQ,OAAO,CAAC;AAE9E,QAAI,CAAC,QAAQ,KAAK,CAAC,UAAU,MAAM,WAAW,QAAQ,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG;AACzF,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,SAAS,0BAA0B,EAAE,GAAG,GAAG;AAAA,IACvF;AAEA,UAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,QAAI,CAAC,QAAQ;AACX,cAAQ;AAAA,QACN;AAAA,MACF;AACA,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,8BAA8B,EAAE,GAAG,GAAG;AAAA,IAC1F;AAEA,UAAM,cAAc,WAAW,SAAS,gBAAgB;AACxD,UAAM,SAAS,QAAQ,WAAW,MAAM,QAAQ,SAAS,IAAI;AAC7D,UAAM,WAAW,UAAU,eAAe,gBAAgB,OAAO,SAAK,6BAAe;AAErF,UAAM,SAAS,GAAG,eAAe,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,MAAM;AACvF,UAAMC,WAAkC;AAAA,MACtC,eAAe,UAAU,MAAM;AAAA,MAC/B,eAAe;AAAA,MACf,kBAAkB;AAAA,MAClB,qBACE,gBAAgB,QAAQ,KAAK,KAC7B,gBAAgB,QAAQ,OAAO,KAC/B,IAAI,IAAI,QAAQ,GAAG,EAAE;AAAA,MACvB,QAAQ;AAAA,IACV;AACA,UAAM,WAAW,QAAQ,QAAQ,IAAI,iBAAiB;AACtD,QAAI,SAAU,CAAAA,SAAQ,iBAAiB,IAAI;AAE3C,UAAM,OAAO,QAAQ,WAAW,QAAQ,SAAY,MAAM,QAAQ,KAAK;AACvE,QAAI,KAAM,CAAAA,SAAQ,cAAc,IAAI;AAEpC,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,QAAQ,EAAE,QAAQ,QAAQ,QAAQ,SAAAA,UAAS,MAAM,OAAO,WAAW,CAAC;AAAA,IAC7F,QAAQ;AACN,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,4BAA4B,EAAE,GAAG,GAAG;AAAA,IACxF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,SAAS,WAAW,IAAK,YAAW,IAAI;AAE5C,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ,SAAS;AAAA,MACjB,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,IAC7E,CAAC;AAID,QAAI,CAAC,UAAU,aAAa,aAAa;AACvC,eAAS,QAAQ,OAAO,cAAc,gBAAgB,QAAQ,CAAC;AAAA,IACjE;AAEA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,OAAO;AACrD;AAEA,IAAM,iBAAiB,cAAc;AAE9B,IAAM,MAAM,eAAe;AAC3B,IAAM,OAAO,eAAe;AAC5B,IAAM,SAAS,eAAe;AAErC,IAAI,gBAAgB;AAGpB,SAAS,WAAW,MAAoB;AACtC,MAAI,cAAe;AACnB,MAAI;AACF,UAAM,QAAS,KAAK,MAAM,IAAI,EAAsD;AACpF,QAAI,OAAO,SAAS,YAAa;AACjC,oBAAgB;AAChB,YAAQ,MAAM,cAAc,MAAM,OAAO,EAAE;AAAA,EAC7C,QAAQ;AAAA,EAER;AACF;AAEA,eAAe,UACb,SACA,SACA,SACiB;AACjB,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,QAAQ,OAAO,OAAQ,QAAO,OAAO,MAAM,IAAI,kBAAkB,EAAE,KAAK,GAAG;AAE/E,QAAM,EAAE,SAAS,IAAI,IAAI,IAAI,QAAQ,GAAG;AACxC,QAAM,QAAQ,SAAS,QAAQ,OAAO;AACtC,SAAO,UAAU,KAAK,KAAK,SAAS,MAAM,QAAQ,QAAQ,MAAM,EAAE,QAAQ,OAAO,EAAE;AACrF;AAMA,SAAS,gBAAgB,SAAiC;AACxD,QAAM,UAAU,QAAQ,QAAQ,IAAI,aAAa;AACjD,SAAO,WAAW,kBAAkB,KAAK,OAAO,IAAI,UAAU;AAChE;AAEA,SAAS,WAAW,SAAkB,MAA6B;AACjE,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACnE,SAAO,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACrD;AAEA,SAAS,gBAAgB,UAA0B;AACjD,QAAM,QAAQ;AAAA,IACZ,GAAG,gBAAgB,IAAI,mBAAmB,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,WAAW,iBAAiB;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,aAAa,aAAc,OAAM,KAAK,QAAQ;AAC9D,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,KAAK,MAAe,QAA0B;AACrD,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,EAC7E,CAAC;AACH;","names":["import_server_only","import_core","import_server_only","import_headers","import_core","ClientBoard","import_server_only","import_react","import_jsx_runtime","ClientButton","import_server_only","import_core","headers"]}

package/dist/index.mjs

@@ -3,14 +3,14 @@ import {
   createHandler,
   resolveApiPath,
   serverClient
-} from "./chunk-KPJHLDQU.mjs";
+} from "./chunk-2QY6VFBK.mjs";
 import {
   readDeviceId,
   resolveDeviceId
-} from "./chunk-QULKPZB4.mjs";
+} from "./chunk-PGFHB443.mjs";
 import {
   DEVICE_ID_COOKIE
-} from "./chunk-W6QR6DEB.mjs";
+} from "./chunk-5F6I6CNG.mjs";
 
 // src/board.tsx
 import "server-only";
@@ -26,11 +26,12 @@ async function FewchursBoard({
   baseUrl,
   apiPath,
   language,
+  appId,
   deviceId: deviceIdOption,
   ...board
 }) {
   const deviceId = await resolveDeviceId(deviceIdOption);
-  const client = serverClient(deviceId, { apiKey, baseUrl, language });
+  const client = await serverClient(deviceId, { apiKey, baseUrl, language, appId });
   const tab = board.defaultTab ?? board.tabs?.[0] ?? "top";
   const sort = tab === "roadmap" ? "top" : tab;
   const status = tab === "roadmap" ? ROADMAP_STATUSES : void 0;
@@ -72,10 +73,32 @@ async function FewchursBoard({
     }
   );
 }
+
+// src/button.tsx
+import "server-only";
+import { FewchursButton as ClientButton, FewchursProvider as FewchursProvider2 } from "@fewchurs/react";
+import { jsx as jsx2 } from "react/jsx-runtime";
+async function FewchursButton({
+  apiPath,
+  language,
+  deviceId,
+  ...button
+}) {
+  return /* @__PURE__ */ jsx2(
+    FewchursProvider2,
+    {
+      baseUrl: resolveApiPath(apiPath),
+      language,
+      deviceId: deviceId ? await deviceId() : void 0,
+      children: /* @__PURE__ */ jsx2(ClientButton, { ...button })
+    }
+  );
+}
 export {
   DEFAULT_API_PATH,
   DEVICE_ID_COOKIE,
   FewchursBoard,
+  FewchursButton,
   createHandler,
   readDeviceId,
   resolveDeviceId

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/board.tsx"],"sourcesContent":["import \"server-only\";\nimport { FewchursBoard as ClientBoard, FewchursProvider } from \"@fewchurs/react\";\nimport type { FewchursBoardProps as ClientBoardProps } from \"@fewchurs/react\";\nimport {\n  featureKey,\n  listKey,\n  ROADMAP_STATUSES,\n  type FeatureSort,\n  type StoreState,\n} from \"@fewchurs/react/core\";\nimport { resolveApiPath, serverClient } from \"./config\";\nimport { resolveDeviceId, type DeviceIdResolver } from \"./identity\";\n\n/** Function props cannot cross the server/client boundary — compose in your own client file. */\ntype SerializableBoardProps = Omit<\n  ClientBoardProps,\n  \"renderHeader\" | \"renderEmpty\" | \"renderFeature\" | \"children\"\n>;\n\nexport interface FewchursBoardProps extends SerializableBoardProps {\n  /** Defaults to `process.env.FEWCHURS_API_KEY`. Never reaches the browser. */\n  apiKey?: string;\n  baseUrl?: string;\n  /** Where your route handler is mounted. Defaults to `/api/fewchurs`. */\n  apiPath?: string;\n  language?: string;\n  deviceId?: DeviceIdResolver;\n}\n\nexport async function FewchursBoard({\n  apiKey,\n  baseUrl,\n  apiPath,\n  language,\n  deviceId: deviceIdOption,\n  ...board\n}: FewchursBoardProps): Promise<React.JSX.Element> {\n  const deviceId = await resolveDeviceId(deviceIdOption);\n  const client = serverClient(deviceId, { apiKey, baseUrl, language });\n\n  const tab = board.defaultTab ?? board.tabs?.[0] ?? \"top\";\n  const sort: FeatureSort = tab === \"roadmap\" ? \"top\" : tab;\n  const status = tab === \"roadmap\" ? ROADMAP_STATUSES : undefined;\n  const pageSize = board.pageSize ?? 20;\n\n  const [config, page, pinned] = await Promise.all([\n    client.getConfig(),\n    client.listFeatures({ sort, status, limit: pageSize }),\n    board.initialFeatureId ? client.getFeature(board.initialFeatureId) : null,\n  ]);\n\n  // Seeded under the same key the client hook will ask for, so the first paint is the\n  // rendered HTML and no second request goes out just to fetch what is already there.\n  const lists: StoreState[\"lists\"] = {};\n  if (page.ok) {\n    lists[listKey({ sort, status })] = {\n      features: page.data.features,\n      cursor: page.data.nextCursor,\n      status: \"ready\",\n      error: null,\n    };\n  }\n  // A deep-linked request is rendered on the server too, so the link lands on real content.\n  if (board.initialFeatureId && pinned?.ok) {\n    lists[featureKey(board.initialFeatureId)] = {\n      features: [pinned.data],\n      cursor: null,\n      status: \"ready\",\n      error: null,\n    };\n  }\n\n  const initialState: Partial<StoreState> = {\n    config: config.ok ? config.data : null,\n    lists,\n  };\n\n  return (\n    <FewchursProvider\n      baseUrl={resolveApiPath(apiPath)}\n      deviceId={deviceId}\n      pageSize={pageSize}\n      initialState={initialState}\n    >\n      <ClientBoard {...board} />\n    </FewchursProvider>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;AAAA,OAAO;AACP,SAAS,iBAAiB,aAAa,wBAAwB;AAE/D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AA2ED;AAvDN,eAAsB,cAAc;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV,GAAG;AACL,GAAmD;AACjD,QAAM,WAAW,MAAM,gBAAgB,cAAc;AACrD,QAAM,SAAS,aAAa,UAAU,EAAE,QAAQ,SAAS,SAAS,CAAC;AAEnE,QAAM,MAAM,MAAM,cAAc,MAAM,OAAO,CAAC,KAAK;AACnD,QAAM,OAAoB,QAAQ,YAAY,QAAQ;AACtD,QAAM,SAAS,QAAQ,YAAY,mBAAmB;AACtD,QAAM,WAAW,MAAM,YAAY;AAEnC,QAAM,CAAC,QAAQ,MAAM,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC/C,OAAO,UAAU;AAAA,IACjB,OAAO,aAAa,EAAE,MAAM,QAAQ,OAAO,SAAS,CAAC;AAAA,IACrD,MAAM,mBAAmB,OAAO,WAAW,MAAM,gBAAgB,IAAI;AAAA,EACvE,CAAC;AAID,QAAM,QAA6B,CAAC;AACpC,MAAI,KAAK,IAAI;AACX,UAAM,QAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,IAAI;AAAA,MACjC,UAAU,KAAK,KAAK;AAAA,MACpB,QAAQ,KAAK,KAAK;AAAA,MAClB,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,MAAM,oBAAoB,QAAQ,IAAI;AACxC,UAAM,WAAW,MAAM,gBAAgB,CAAC,IAAI;AAAA,MAC1C,UAAU,CAAC,OAAO,IAAI;AAAA,MACtB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,eAAoC;AAAA,IACxC,QAAQ,OAAO,KAAK,OAAO,OAAO;AAAA,IAClC;AAAA,EACF;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS,eAAe,OAAO;AAAA,MAC/B;AAAA,MACA;AAAA,MACA;AAAA,MAEA,8BAAC,eAAa,GAAG,OAAO;AAAA;AAAA,EAC1B;AAEJ;","names":[]}
+{"version":3,"sources":["../src/board.tsx","../src/button.tsx"],"sourcesContent":["import \"server-only\";\nimport { FewchursBoard as ClientBoard, FewchursProvider } from \"@fewchurs/react\";\nimport type { FewchursBoardProps as ClientBoardProps } from \"@fewchurs/react\";\nimport {\n  featureKey,\n  listKey,\n  ROADMAP_STATUSES,\n  type FeatureSort,\n  type StoreState,\n} from \"@fewchurs/react/core\";\nimport { resolveApiPath, serverClient } from \"./config\";\nimport { resolveDeviceId, type DeviceIdResolver } from \"./identity\";\n\n/** Function props cannot cross the server/client boundary — compose in your own client file. */\ntype SerializableBoardProps = Omit<\n  ClientBoardProps,\n  \"renderHeader\" | \"renderEmpty\" | \"renderFeature\" | \"children\"\n>;\n\nexport interface FewchursBoardProps extends SerializableBoardProps {\n  /** Defaults to `process.env.FEWCHURS_API_KEY`. Never reaches the browser. */\n  apiKey?: string;\n  baseUrl?: string;\n  /** Where your route handler is mounted. Defaults to `/api/fewchurs`. */\n  apiPath?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n  deviceId?: DeviceIdResolver;\n}\n\nexport async function FewchursBoard({\n  apiKey,\n  baseUrl,\n  apiPath,\n  language,\n  appId,\n  deviceId: deviceIdOption,\n  ...board\n}: FewchursBoardProps): Promise<React.JSX.Element> {\n  const deviceId = await resolveDeviceId(deviceIdOption);\n  const client = await serverClient(deviceId, { apiKey, baseUrl, language, appId });\n\n  const tab = board.defaultTab ?? board.tabs?.[0] ?? \"top\";\n  const sort: FeatureSort = tab === \"roadmap\" ? \"top\" : tab;\n  const status = tab === \"roadmap\" ? ROADMAP_STATUSES : undefined;\n  const pageSize = board.pageSize ?? 20;\n\n  const [config, page, pinned] = await Promise.all([\n    client.getConfig(),\n    client.listFeatures({ sort, status, limit: pageSize }),\n    board.initialFeatureId ? client.getFeature(board.initialFeatureId) : null,\n  ]);\n\n  // Seeded under the same key the client hook will ask for, so the first paint is the\n  // rendered HTML and no second request goes out just to fetch what is already there.\n  const lists: StoreState[\"lists\"] = {};\n  if (page.ok) {\n    lists[listKey({ sort, status })] = {\n      features: page.data.features,\n      cursor: page.data.nextCursor,\n      status: \"ready\",\n      error: null,\n    };\n  }\n  // A deep-linked request is rendered on the server too, so the link lands on real content.\n  if (board.initialFeatureId && pinned?.ok) {\n    lists[featureKey(board.initialFeatureId)] = {\n      features: [pinned.data],\n      cursor: null,\n      status: \"ready\",\n      error: null,\n    };\n  }\n\n  const initialState: Partial<StoreState> = {\n    config: config.ok ? config.data : null,\n    lists,\n  };\n\n  return (\n    <FewchursProvider\n      baseUrl={resolveApiPath(apiPath)}\n      deviceId={deviceId}\n      pageSize={pageSize}\n      initialState={initialState}\n    >\n      <ClientBoard {...board} />\n    </FewchursProvider>\n  );\n}\n","import \"server-only\";\nimport { FewchursButton as ClientButton, FewchursProvider } from \"@fewchurs/react\";\nimport type { FewchursButtonProps as ClientButtonProps } from \"@fewchurs/react\";\nimport { resolveApiPath } from \"./config\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface FewchursButtonProps extends Omit<\n  ClientButtonProps,\n  \"renderHeader\" | \"renderEmpty\" | \"renderFeature\"\n> {\n  apiPath?: string;\n  language?: string;\n  deviceId?: DeviceIdResolver;\n}\n\nexport async function FewchursButton({\n  apiPath,\n  language,\n  deviceId,\n  ...button\n}: FewchursButtonProps): Promise<React.JSX.Element> {\n  return (\n    <FewchursProvider\n      baseUrl={resolveApiPath(apiPath)}\n      language={language}\n      deviceId={deviceId ? await deviceId() : undefined}\n    >\n      <ClientButton {...button} />\n    </FewchursProvider>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;AAAA,OAAO;AACP,SAAS,iBAAiB,aAAa,wBAAwB;AAE/D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AA8ED;AAxDN,eAAsB,cAAc;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV,GAAG;AACL,GAAmD;AACjD,QAAM,WAAW,MAAM,gBAAgB,cAAc;AACrD,QAAM,SAAS,MAAM,aAAa,UAAU,EAAE,QAAQ,SAAS,UAAU,MAAM,CAAC;AAEhF,QAAM,MAAM,MAAM,cAAc,MAAM,OAAO,CAAC,KAAK;AACnD,QAAM,OAAoB,QAAQ,YAAY,QAAQ;AACtD,QAAM,SAAS,QAAQ,YAAY,mBAAmB;AACtD,QAAM,WAAW,MAAM,YAAY;AAEnC,QAAM,CAAC,QAAQ,MAAM,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC/C,OAAO,UAAU;AAAA,IACjB,OAAO,aAAa,EAAE,MAAM,QAAQ,OAAO,SAAS,CAAC;AAAA,IACrD,MAAM,mBAAmB,OAAO,WAAW,MAAM,gBAAgB,IAAI;AAAA,EACvE,CAAC;AAID,QAAM,QAA6B,CAAC;AACpC,MAAI,KAAK,IAAI;AACX,UAAM,QAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,IAAI;AAAA,MACjC,UAAU,KAAK,KAAK;AAAA,MACpB,QAAQ,KAAK,KAAK;AAAA,MAClB,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,MAAM,oBAAoB,QAAQ,IAAI;AACxC,UAAM,WAAW,MAAM,gBAAgB,CAAC,IAAI;AAAA,MAC1C,UAAU,CAAC,OAAO,IAAI;AAAA,MACtB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,eAAoC;AAAA,IACxC,QAAQ,OAAO,KAAK,OAAO,OAAO;AAAA,IAClC;AAAA,EACF;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS,eAAe,OAAO;AAAA,MAC/B;AAAA,MACA;AAAA,MACA;AAAA,MAEA,8BAAC,eAAa,GAAG,OAAO;AAAA;AAAA,EAC1B;AAEJ;;;AC1FA,OAAO;AACP,SAAS,kBAAkB,cAAc,oBAAAA,yBAAwB;AA0B3D,gBAAAC,YAAA;AAZN,eAAsB,eAAe;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,GAAoD;AAClD,SACE,gBAAAA;AAAA,IAACC;AAAA,IAAA;AAAA,MACC,SAAS,eAAe,OAAO;AAAA,MAC/B;AAAA,MACA,UAAU,WAAW,MAAM,SAAS,IAAI;AAAA,MAExC,0BAAAD,KAAC,gBAAc,GAAG,QAAQ;AAAA;AAAA,EAC5B;AAEJ;","names":["FewchursProvider","jsx","FewchursProvider"]}