@fewchurs/next 1.3.0 → 1.5.0

package/dist/actions.js

@@ -77,7 +77,7 @@ var import_headers2 = require("next/headers");
 var import_core2 = require("@fewchurs/react/core");
 
 // src/version.ts
-var SDK_VERSION = "1.3.0";
+var SDK_VERSION = "1.5.0";
 
 // src/constants.ts
 var DEVICE_ID_COOKIE = "fewchurs_did";

package/dist/actions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/actions.ts","../src/config.ts","../src/identity.ts","../src/version.ts","../src/constants.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { userMessage } from \"@fewchurs/react/core\";\nimport { serverClient } from \"./config\";\nimport { resolveDeviceId } from \"./identity\";\n\nexport interface ActionResult {\n  ok: boolean;\n  message?: string;\n}\n\n/**\n * Server actions for boards built with plain forms — the client board talks to the route\n * handler instead. Pass `path` when the page should re-render with the new data.\n */\nexport async function submitFeatureAction(formData: FormData): Promise<ActionResult> {\n  const client = await serverClient(await resolveDeviceId());\n  const result = await client.submitFeature({\n    title: String(formData.get(\"title\") ?? \"\"),\n    description: String(formData.get(\"description\") ?? \"\"),\n    email: optional(formData.get(\"email\")),\n  });\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function voteAction(formData: FormData): Promise<ActionResult> {\n  const featureId = String(formData.get(\"featureId\") ?? \"\");\n  const hasVoted = formData.get(\"hasVoted\") === \"true\";\n  const client = await serverClient(await resolveDeviceId());\n  const result = hasVoted ? await client.unvote(featureId) : await client.vote(featureId);\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function commentAction(formData: FormData): Promise<ActionResult> {\n  const client = await serverClient(await resolveDeviceId());\n  const result = await client.createComment({\n    featureId: String(formData.get(\"featureId\") ?? \"\"),\n    text: String(formData.get(\"text\") ?? \"\"),\n    authorName: optional(formData.get(\"authorName\")),\n  });\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function followAction(formData: FormData): Promise<ActionResult> {\n  const featureId = String(formData.get(\"featureId\") ?? \"\");\n  const email = optional(formData.get(\"email\"));\n  const client = await serverClient(await resolveDeviceId());\n  const result = email ? await client.follow(featureId, email) : await client.unfollow(featureId);\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nfunction optional(value: FormDataEntryValue | null): string | undefined {\n  const text = typeof value === \"string\" ? value.trim() : \"\";\n  return text.length > 0 ? text : undefined;\n}\n\nfunction revalidate(formData: FormData): void {\n  const path = formData.get(\"path\");\n  if (typeof path === \"string\" && path.startsWith(\"/\")) revalidatePath(path);\n}\n","import \"server-only\";\nimport { headers } from \"next/headers\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\n/** A domain set by the developer, which replaces the one read from the request. */\nexport function configuredAppId(appId?: string): string | undefined {\n  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || undefined;\n}\n\n/** The site's host name without a port. A reverse proxy reports the public one in `x-forwarded-host`. */\nexport function requestHostname(requestHeaders: Headers): string | undefined {\n  const forwarded = requestHeaders.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  const host = forwarded || requestHeaders.get(\"host\")?.trim();\n  if (!host) return undefined;\n  try {\n    return new URL(`http://${host}`).hostname;\n  } catch {\n    return undefined;\n  }\n}\n\nexport async function serverClient(\n  deviceId: string | null,\n  config: ServerConfig = {},\n): Promise<FewchursClient> {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n    // Only read the request when needed, so a page with a set domain can still render statically.\n    appId: configuredAppId(config.appId) ?? requestHostname(await headers()),\n  });\n}\n","import \"server-only\";\nimport { cookies } from \"next/headers\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE } from \"./constants\";\n\nexport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE };\n\nexport type DeviceIdResolver = () => string | Promise<string>;\n\n/** The visitor's id, or null when nothing has been stored for them yet. */\nexport async function readDeviceId(): Promise<string | null> {\n  const store = await cookies();\n  return store.get(DEVICE_ID_COOKIE)?.value ?? null;\n}\n\n/**\n * Reads the cookie, falling back to a fresh id. The value is not persisted here: a server\n * component cannot set cookies, so the route handler stores it on the first request instead.\n */\nexport async function resolveDeviceId(custom?: DeviceIdResolver): Promise<string> {\n  if (custom) return custom();\n  return (await readDeviceId()) ?? createDeviceId();\n}\n\nexport function deviceIdCookie(deviceId: string): {\n  name: string;\n  value: string;\n  options: {\n    httpOnly: true;\n    sameSite: \"lax\";\n    path: string;\n    maxAge: number;\n    secure: boolean;\n  };\n} {\n  return {\n    name: DEVICE_ID_COOKIE,\n    value: deviceId,\n    options: {\n      httpOnly: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: DEVICE_ID_MAX_AGE,\n      secure: process.env.NODE_ENV === \"production\",\n    },\n  };\n}\n\nexport { createDeviceId };\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.3.0\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,mBAA+B;AAC/B,IAAAA,eAA4B;;;ACH5B,yBAAO;AACP,qBAAwB;AACxB,kBAA4E;AAYrE,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAOO,SAAS,gBAAgB,OAAoC;AAClE,SAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,KAAK,KAAK;AACjE;AAGO,SAAS,gBAAgB,gBAA6C;AAC3E,QAAM,YAAY,eAAe,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAC9E,QAAM,OAAO,aAAa,eAAe,IAAI,MAAM,GAAG,KAAK;AAC3D,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,IAAI,EAAE,EAAE;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,aACpB,UACA,SAAuB,CAAC,GACC;AACzB,QAAM,SAAS,cAAc,OAAO,MAAM;AAC1C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,aAAO,kCAAqB;AAAA,IAC1B;AAAA,IACA,SAAS,eAAe,OAAO,OAAO;AAAA,IACtC;AAAA,IACA,UAAU,OAAO;AAAA;AAAA,IAEjB,OAAO,gBAAgB,OAAO,KAAK,KAAK,gBAAgB,UAAM,wBAAQ,CAAC;AAAA,EACzE,CAAC;AACH;;;AC9DA,IAAAC,sBAAO;AACP,IAAAC,kBAAwB;AACxB,IAAAC,eAA+B;;;ACDxB,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AFK7C,eAAsB,eAAuC;AAC3D,QAAM,QAAQ,UAAM,yBAAQ;AAC5B,SAAO,MAAM,IAAI,gBAAgB,GAAG,SAAS;AAC/C;AAMA,eAAsB,gBAAgB,QAA4C;AAChF,MAAI,OAAQ,QAAO,OAAO;AAC1B,SAAQ,MAAM,aAAa,SAAM,6BAAe;AAClD;;;AFNA,eAAsB,oBAAoB,UAA2C;AACnF,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,MAAM,OAAO,cAAc;AAAA,IACxC,OAAO,OAAO,SAAS,IAAI,OAAO,KAAK,EAAE;AAAA,IACzC,aAAa,OAAO,SAAS,IAAI,aAAa,KAAK,EAAE;AAAA,IACrD,OAAO,SAAS,SAAS,IAAI,OAAO,CAAC;AAAA,EACvC,CAAC;AAED,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,aAAS,0BAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,WAAW,UAA2C;AAC1E,QAAM,YAAY,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AACxD,QAAM,WAAW,SAAS,IAAI,UAAU,MAAM;AAC9C,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,WAAW,MAAM,OAAO,OAAO,SAAS,IAAI,MAAM,OAAO,KAAK,SAAS;AAEtF,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,aAAS,0BAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,cAAc,UAA2C;AAC7E,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,MAAM,OAAO,cAAc;AAAA,IACxC,WAAW,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AAAA,IACjD,MAAM,OAAO,SAAS,IAAI,MAAM,KAAK,EAAE;AAAA,IACvC,YAAY,SAAS,SAAS,IAAI,YAAY,CAAC;AAAA,EACjD,CAAC;AAED,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,aAAS,0BAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,aAAa,UAA2C;AAC5E,QAAM,YAAY,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AACxD,QAAM,QAAQ,SAAS,SAAS,IAAI,OAAO,CAAC;AAC5C,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,QAAQ,MAAM,OAAO,OAAO,WAAW,KAAK,IAAI,MAAM,OAAO,SAAS,SAAS;AAE9F,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,aAAS,0BAAY,OAAO,KAAK,EAAE;AACpF;AAEA,SAAS,SAAS,OAAsD;AACtE,QAAM,OAAO,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACxD,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AAEA,SAAS,WAAW,UAA0B;AAC5C,QAAM,OAAO,SAAS,IAAI,MAAM;AAChC,MAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG,EAAG,kCAAe,IAAI;AAC3E;","names":["import_core","import_server_only","import_headers","import_core"]}
+{"version":3,"sources":["../src/actions.ts","../src/config.ts","../src/identity.ts","../src/version.ts","../src/constants.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { userMessage } from \"@fewchurs/react/core\";\nimport { serverClient } from \"./config\";\nimport { resolveDeviceId } from \"./identity\";\n\nexport interface ActionResult {\n  ok: boolean;\n  message?: string;\n}\n\n/**\n * Server actions for boards built with plain forms — the client board talks to the route\n * handler instead. Pass `path` when the page should re-render with the new data.\n */\nexport async function submitFeatureAction(formData: FormData): Promise<ActionResult> {\n  const client = await serverClient(await resolveDeviceId());\n  const result = await client.submitFeature({\n    title: String(formData.get(\"title\") ?? \"\"),\n    description: String(formData.get(\"description\") ?? \"\"),\n    email: optional(formData.get(\"email\")),\n  });\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function voteAction(formData: FormData): Promise<ActionResult> {\n  const featureId = String(formData.get(\"featureId\") ?? \"\");\n  const hasVoted = formData.get(\"hasVoted\") === \"true\";\n  const client = await serverClient(await resolveDeviceId());\n  const result = hasVoted ? await client.unvote(featureId) : await client.vote(featureId);\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function commentAction(formData: FormData): Promise<ActionResult> {\n  const client = await serverClient(await resolveDeviceId());\n  const result = await client.createComment({\n    featureId: String(formData.get(\"featureId\") ?? \"\"),\n    text: String(formData.get(\"text\") ?? \"\"),\n    authorName: optional(formData.get(\"authorName\")),\n  });\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function followAction(formData: FormData): Promise<ActionResult> {\n  const featureId = String(formData.get(\"featureId\") ?? \"\");\n  const email = optional(formData.get(\"email\"));\n  const client = await serverClient(await resolveDeviceId());\n  const result = email ? await client.follow(featureId, email) : await client.unfollow(featureId);\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nfunction optional(value: FormDataEntryValue | null): string | undefined {\n  const text = typeof value === \"string\" ? value.trim() : \"\";\n  return text.length > 0 ? text : undefined;\n}\n\nfunction revalidate(formData: FormData): void {\n  const path = formData.get(\"path\");\n  if (typeof path === \"string\" && path.startsWith(\"/\")) revalidatePath(path);\n}\n","import \"server-only\";\nimport { headers } from \"next/headers\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\n/** A domain set by the developer, which replaces the one read from the request. */\nexport function configuredAppId(appId?: string): string | undefined {\n  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || undefined;\n}\n\n/** The site's host name without a port. A reverse proxy reports the public one in `x-forwarded-host`. */\nexport function requestHostname(requestHeaders: Headers): string | undefined {\n  const forwarded = requestHeaders.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  const host = forwarded || requestHeaders.get(\"host\")?.trim();\n  if (!host) return undefined;\n  try {\n    return new URL(`http://${host}`).hostname;\n  } catch {\n    return undefined;\n  }\n}\n\nexport async function serverClient(\n  deviceId: string | null,\n  config: ServerConfig = {},\n): Promise<FewchursClient> {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n    // Only read the request when needed, so a page with a set domain can still render statically.\n    appId: configuredAppId(config.appId) ?? requestHostname(await headers()),\n  });\n}\n","import \"server-only\";\nimport { cookies } from \"next/headers\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE } from \"./constants\";\n\nexport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE };\n\nexport type DeviceIdResolver = () => string | Promise<string>;\n\n/** The visitor's id, or null when nothing has been stored for them yet. */\nexport async function readDeviceId(): Promise<string | null> {\n  const store = await cookies();\n  return store.get(DEVICE_ID_COOKIE)?.value ?? null;\n}\n\n/**\n * Reads the cookie, falling back to a fresh id. The value is not persisted here: a server\n * component cannot set cookies, so the route handler stores it on the first request instead.\n */\nexport async function resolveDeviceId(custom?: DeviceIdResolver): Promise<string> {\n  if (custom) return custom();\n  return (await readDeviceId()) ?? createDeviceId();\n}\n\nexport function deviceIdCookie(deviceId: string): {\n  name: string;\n  value: string;\n  options: {\n    httpOnly: true;\n    sameSite: \"lax\";\n    path: string;\n    maxAge: number;\n    secure: boolean;\n  };\n} {\n  return {\n    name: DEVICE_ID_COOKIE,\n    value: deviceId,\n    options: {\n      httpOnly: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: DEVICE_ID_MAX_AGE,\n      secure: process.env.NODE_ENV === \"production\",\n    },\n  };\n}\n\nexport { createDeviceId };\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.5.0\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,mBAA+B;AAC/B,IAAAA,eAA4B;;;ACH5B,yBAAO;AACP,qBAAwB;AACxB,kBAA4E;AAYrE,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAOO,SAAS,gBAAgB,OAAoC;AAClE,SAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,KAAK,KAAK;AACjE;AAGO,SAAS,gBAAgB,gBAA6C;AAC3E,QAAM,YAAY,eAAe,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAC9E,QAAM,OAAO,aAAa,eAAe,IAAI,MAAM,GAAG,KAAK;AAC3D,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,IAAI,EAAE,EAAE;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,aACpB,UACA,SAAuB,CAAC,GACC;AACzB,QAAM,SAAS,cAAc,OAAO,MAAM;AAC1C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,aAAO,kCAAqB;AAAA,IAC1B;AAAA,IACA,SAAS,eAAe,OAAO,OAAO;AAAA,IACtC;AAAA,IACA,UAAU,OAAO;AAAA;AAAA,IAEjB,OAAO,gBAAgB,OAAO,KAAK,KAAK,gBAAgB,UAAM,wBAAQ,CAAC;AAAA,EACzE,CAAC;AACH;;;AC9DA,IAAAC,sBAAO;AACP,IAAAC,kBAAwB;AACxB,IAAAC,eAA+B;;;ACDxB,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AFK7C,eAAsB,eAAuC;AAC3D,QAAM,QAAQ,UAAM,yBAAQ;AAC5B,SAAO,MAAM,IAAI,gBAAgB,GAAG,SAAS;AAC/C;AAMA,eAAsB,gBAAgB,QAA4C;AAChF,MAAI,OAAQ,QAAO,OAAO;AAC1B,SAAQ,MAAM,aAAa,SAAM,6BAAe;AAClD;;;AFNA,eAAsB,oBAAoB,UAA2C;AACnF,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,MAAM,OAAO,cAAc;AAAA,IACxC,OAAO,OAAO,SAAS,IAAI,OAAO,KAAK,EAAE;AAAA,IACzC,aAAa,OAAO,SAAS,IAAI,aAAa,KAAK,EAAE;AAAA,IACrD,OAAO,SAAS,SAAS,IAAI,OAAO,CAAC;AAAA,EACvC,CAAC;AAED,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,aAAS,0BAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,WAAW,UAA2C;AAC1E,QAAM,YAAY,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AACxD,QAAM,WAAW,SAAS,IAAI,UAAU,MAAM;AAC9C,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,WAAW,MAAM,OAAO,OAAO,SAAS,IAAI,MAAM,OAAO,KAAK,SAAS;AAEtF,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,aAAS,0BAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,cAAc,UAA2C;AAC7E,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,MAAM,OAAO,cAAc;AAAA,IACxC,WAAW,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AAAA,IACjD,MAAM,OAAO,SAAS,IAAI,MAAM,KAAK,EAAE;AAAA,IACvC,YAAY,SAAS,SAAS,IAAI,YAAY,CAAC;AAAA,EACjD,CAAC;AAED,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,aAAS,0BAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,aAAa,UAA2C;AAC5E,QAAM,YAAY,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AACxD,QAAM,QAAQ,SAAS,SAAS,IAAI,OAAO,CAAC;AAC5C,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,QAAQ,MAAM,OAAO,OAAO,WAAW,KAAK,IAAI,MAAM,OAAO,SAAS,SAAS;AAE9F,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,aAAS,0BAAY,OAAO,KAAK,EAAE;AACpF;AAEA,SAAS,SAAS,OAAsD;AACtE,QAAM,OAAO,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACxD,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AAEA,SAAS,WAAW,UAA0B;AAC5C,QAAM,OAAO,SAAS,IAAI,MAAM;AAChC,MAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG,EAAG,kCAAe,IAAI;AAC3E;","names":["import_core","import_server_only","import_headers","import_core"]}

package/dist/actions.mjs

@@ -51,7 +51,7 @@ import { cookies } from "next/headers";
 import { createDeviceId } from "@fewchurs/react/core";
 
 // src/version.ts
-var SDK_VERSION = "1.3.0";
+var SDK_VERSION = "1.5.0";
 
 // src/constants.ts
 var DEVICE_ID_COOKIE = "fewchurs_did";

package/dist/actions.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/actions.ts","../src/config.ts","../src/identity.ts","../src/version.ts","../src/constants.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { userMessage } from \"@fewchurs/react/core\";\nimport { serverClient } from \"./config\";\nimport { resolveDeviceId } from \"./identity\";\n\nexport interface ActionResult {\n  ok: boolean;\n  message?: string;\n}\n\n/**\n * Server actions for boards built with plain forms — the client board talks to the route\n * handler instead. Pass `path` when the page should re-render with the new data.\n */\nexport async function submitFeatureAction(formData: FormData): Promise<ActionResult> {\n  const client = await serverClient(await resolveDeviceId());\n  const result = await client.submitFeature({\n    title: String(formData.get(\"title\") ?? \"\"),\n    description: String(formData.get(\"description\") ?? \"\"),\n    email: optional(formData.get(\"email\")),\n  });\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function voteAction(formData: FormData): Promise<ActionResult> {\n  const featureId = String(formData.get(\"featureId\") ?? \"\");\n  const hasVoted = formData.get(\"hasVoted\") === \"true\";\n  const client = await serverClient(await resolveDeviceId());\n  const result = hasVoted ? await client.unvote(featureId) : await client.vote(featureId);\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function commentAction(formData: FormData): Promise<ActionResult> {\n  const client = await serverClient(await resolveDeviceId());\n  const result = await client.createComment({\n    featureId: String(formData.get(\"featureId\") ?? \"\"),\n    text: String(formData.get(\"text\") ?? \"\"),\n    authorName: optional(formData.get(\"authorName\")),\n  });\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function followAction(formData: FormData): Promise<ActionResult> {\n  const featureId = String(formData.get(\"featureId\") ?? \"\");\n  const email = optional(formData.get(\"email\"));\n  const client = await serverClient(await resolveDeviceId());\n  const result = email ? await client.follow(featureId, email) : await client.unfollow(featureId);\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nfunction optional(value: FormDataEntryValue | null): string | undefined {\n  const text = typeof value === \"string\" ? value.trim() : \"\";\n  return text.length > 0 ? text : undefined;\n}\n\nfunction revalidate(formData: FormData): void {\n  const path = formData.get(\"path\");\n  if (typeof path === \"string\" && path.startsWith(\"/\")) revalidatePath(path);\n}\n","import \"server-only\";\nimport { headers } from \"next/headers\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\n/** A domain set by the developer, which replaces the one read from the request. */\nexport function configuredAppId(appId?: string): string | undefined {\n  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || undefined;\n}\n\n/** The site's host name without a port. A reverse proxy reports the public one in `x-forwarded-host`. */\nexport function requestHostname(requestHeaders: Headers): string | undefined {\n  const forwarded = requestHeaders.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  const host = forwarded || requestHeaders.get(\"host\")?.trim();\n  if (!host) return undefined;\n  try {\n    return new URL(`http://${host}`).hostname;\n  } catch {\n    return undefined;\n  }\n}\n\nexport async function serverClient(\n  deviceId: string | null,\n  config: ServerConfig = {},\n): Promise<FewchursClient> {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n    // Only read the request when needed, so a page with a set domain can still render statically.\n    appId: configuredAppId(config.appId) ?? requestHostname(await headers()),\n  });\n}\n","import \"server-only\";\nimport { cookies } from \"next/headers\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE } from \"./constants\";\n\nexport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE };\n\nexport type DeviceIdResolver = () => string | Promise<string>;\n\n/** The visitor's id, or null when nothing has been stored for them yet. */\nexport async function readDeviceId(): Promise<string | null> {\n  const store = await cookies();\n  return store.get(DEVICE_ID_COOKIE)?.value ?? null;\n}\n\n/**\n * Reads the cookie, falling back to a fresh id. The value is not persisted here: a server\n * component cannot set cookies, so the route handler stores it on the first request instead.\n */\nexport async function resolveDeviceId(custom?: DeviceIdResolver): Promise<string> {\n  if (custom) return custom();\n  return (await readDeviceId()) ?? createDeviceId();\n}\n\nexport function deviceIdCookie(deviceId: string): {\n  name: string;\n  value: string;\n  options: {\n    httpOnly: true;\n    sameSite: \"lax\";\n    path: string;\n    maxAge: number;\n    secure: boolean;\n  };\n} {\n  return {\n    name: DEVICE_ID_COOKIE,\n    value: deviceId,\n    options: {\n      httpOnly: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: DEVICE_ID_MAX_AGE,\n      secure: process.env.NODE_ENV === \"production\",\n    },\n  };\n}\n\nexport { createDeviceId };\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.3.0\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";;;;AAEA,SAAS,sBAAsB;AAC/B,SAAS,mBAAmB;;;ACH5B,OAAO;AACP,SAAS,eAAe;AACxB,SAAS,sBAAsB,wBAA6C;AAYrE,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAOO,SAAS,gBAAgB,OAAoC;AAClE,SAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,KAAK,KAAK;AACjE;AAGO,SAAS,gBAAgB,gBAA6C;AAC3E,QAAM,YAAY,eAAe,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAC9E,QAAM,OAAO,aAAa,eAAe,IAAI,MAAM,GAAG,KAAK;AAC3D,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,IAAI,EAAE,EAAE;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,aACpB,UACA,SAAuB,CAAC,GACC;AACzB,QAAM,SAAS,cAAc,OAAO,MAAM;AAC1C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO,qBAAqB;AAAA,IAC1B;AAAA,IACA,SAAS,eAAe,OAAO,OAAO;AAAA,IACtC;AAAA,IACA,UAAU,OAAO;AAAA;AAAA,IAEjB,OAAO,gBAAgB,OAAO,KAAK,KAAK,gBAAgB,MAAM,QAAQ,CAAC;AAAA,EACzE,CAAC;AACH;;;AC9DA,OAAO;AACP,SAAS,eAAe;AACxB,SAAS,sBAAsB;;;ACDxB,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AFK7C,eAAsB,eAAuC;AAC3D,QAAM,QAAQ,MAAM,QAAQ;AAC5B,SAAO,MAAM,IAAI,gBAAgB,GAAG,SAAS;AAC/C;AAMA,eAAsB,gBAAgB,QAA4C;AAChF,MAAI,OAAQ,QAAO,OAAO;AAC1B,SAAQ,MAAM,aAAa,KAAM,eAAe;AAClD;;;AFNA,eAAsB,oBAAoB,UAA2C;AACnF,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,MAAM,OAAO,cAAc;AAAA,IACxC,OAAO,OAAO,SAAS,IAAI,OAAO,KAAK,EAAE;AAAA,IACzC,aAAa,OAAO,SAAS,IAAI,aAAa,KAAK,EAAE;AAAA,IACrD,OAAO,SAAS,SAAS,IAAI,OAAO,CAAC;AAAA,EACvC,CAAC;AAED,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,SAAS,YAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,WAAW,UAA2C;AAC1E,QAAM,YAAY,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AACxD,QAAM,WAAW,SAAS,IAAI,UAAU,MAAM;AAC9C,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,WAAW,MAAM,OAAO,OAAO,SAAS,IAAI,MAAM,OAAO,KAAK,SAAS;AAEtF,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,SAAS,YAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,cAAc,UAA2C;AAC7E,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,MAAM,OAAO,cAAc;AAAA,IACxC,WAAW,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AAAA,IACjD,MAAM,OAAO,SAAS,IAAI,MAAM,KAAK,EAAE;AAAA,IACvC,YAAY,SAAS,SAAS,IAAI,YAAY,CAAC;AAAA,EACjD,CAAC;AAED,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,SAAS,YAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,aAAa,UAA2C;AAC5E,QAAM,YAAY,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AACxD,QAAM,QAAQ,SAAS,SAAS,IAAI,OAAO,CAAC;AAC5C,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,QAAQ,MAAM,OAAO,OAAO,WAAW,KAAK,IAAI,MAAM,OAAO,SAAS,SAAS;AAE9F,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,SAAS,YAAY,OAAO,KAAK,EAAE;AACpF;AAEA,SAAS,SAAS,OAAsD;AACtE,QAAM,OAAO,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACxD,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AAEA,SAAS,WAAW,UAA0B;AAC5C,QAAM,OAAO,SAAS,IAAI,MAAM;AAChC,MAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG,EAAG,gBAAe,IAAI;AAC3E;","names":[]}
+{"version":3,"sources":["../src/actions.ts","../src/config.ts","../src/identity.ts","../src/version.ts","../src/constants.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { userMessage } from \"@fewchurs/react/core\";\nimport { serverClient } from \"./config\";\nimport { resolveDeviceId } from \"./identity\";\n\nexport interface ActionResult {\n  ok: boolean;\n  message?: string;\n}\n\n/**\n * Server actions for boards built with plain forms — the client board talks to the route\n * handler instead. Pass `path` when the page should re-render with the new data.\n */\nexport async function submitFeatureAction(formData: FormData): Promise<ActionResult> {\n  const client = await serverClient(await resolveDeviceId());\n  const result = await client.submitFeature({\n    title: String(formData.get(\"title\") ?? \"\"),\n    description: String(formData.get(\"description\") ?? \"\"),\n    email: optional(formData.get(\"email\")),\n  });\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function voteAction(formData: FormData): Promise<ActionResult> {\n  const featureId = String(formData.get(\"featureId\") ?? \"\");\n  const hasVoted = formData.get(\"hasVoted\") === \"true\";\n  const client = await serverClient(await resolveDeviceId());\n  const result = hasVoted ? await client.unvote(featureId) : await client.vote(featureId);\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function commentAction(formData: FormData): Promise<ActionResult> {\n  const client = await serverClient(await resolveDeviceId());\n  const result = await client.createComment({\n    featureId: String(formData.get(\"featureId\") ?? \"\"),\n    text: String(formData.get(\"text\") ?? \"\"),\n    authorName: optional(formData.get(\"authorName\")),\n  });\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nexport async function followAction(formData: FormData): Promise<ActionResult> {\n  const featureId = String(formData.get(\"featureId\") ?? \"\");\n  const email = optional(formData.get(\"email\"));\n  const client = await serverClient(await resolveDeviceId());\n  const result = email ? await client.follow(featureId, email) : await client.unfollow(featureId);\n\n  revalidate(formData);\n  return result.ok ? { ok: true } : { ok: false, message: userMessage(result.error) };\n}\n\nfunction optional(value: FormDataEntryValue | null): string | undefined {\n  const text = typeof value === \"string\" ? value.trim() : \"\";\n  return text.length > 0 ? text : undefined;\n}\n\nfunction revalidate(formData: FormData): void {\n  const path = formData.get(\"path\");\n  if (typeof path === \"string\" && path.startsWith(\"/\")) revalidatePath(path);\n}\n","import \"server-only\";\nimport { headers } from \"next/headers\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\n/** A domain set by the developer, which replaces the one read from the request. */\nexport function configuredAppId(appId?: string): string | undefined {\n  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || undefined;\n}\n\n/** The site's host name without a port. A reverse proxy reports the public one in `x-forwarded-host`. */\nexport function requestHostname(requestHeaders: Headers): string | undefined {\n  const forwarded = requestHeaders.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  const host = forwarded || requestHeaders.get(\"host\")?.trim();\n  if (!host) return undefined;\n  try {\n    return new URL(`http://${host}`).hostname;\n  } catch {\n    return undefined;\n  }\n}\n\nexport async function serverClient(\n  deviceId: string | null,\n  config: ServerConfig = {},\n): Promise<FewchursClient> {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n    // Only read the request when needed, so a page with a set domain can still render statically.\n    appId: configuredAppId(config.appId) ?? requestHostname(await headers()),\n  });\n}\n","import \"server-only\";\nimport { cookies } from \"next/headers\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE } from \"./constants\";\n\nexport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE };\n\nexport type DeviceIdResolver = () => string | Promise<string>;\n\n/** The visitor's id, or null when nothing has been stored for them yet. */\nexport async function readDeviceId(): Promise<string | null> {\n  const store = await cookies();\n  return store.get(DEVICE_ID_COOKIE)?.value ?? null;\n}\n\n/**\n * Reads the cookie, falling back to a fresh id. The value is not persisted here: a server\n * component cannot set cookies, so the route handler stores it on the first request instead.\n */\nexport async function resolveDeviceId(custom?: DeviceIdResolver): Promise<string> {\n  if (custom) return custom();\n  return (await readDeviceId()) ?? createDeviceId();\n}\n\nexport function deviceIdCookie(deviceId: string): {\n  name: string;\n  value: string;\n  options: {\n    httpOnly: true;\n    sameSite: \"lax\";\n    path: string;\n    maxAge: number;\n    secure: boolean;\n  };\n} {\n  return {\n    name: DEVICE_ID_COOKIE,\n    value: deviceId,\n    options: {\n      httpOnly: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: DEVICE_ID_MAX_AGE,\n      secure: process.env.NODE_ENV === \"production\",\n    },\n  };\n}\n\nexport { createDeviceId };\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.5.0\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";;;;AAEA,SAAS,sBAAsB;AAC/B,SAAS,mBAAmB;;;ACH5B,OAAO;AACP,SAAS,eAAe;AACxB,SAAS,sBAAsB,wBAA6C;AAYrE,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAOO,SAAS,gBAAgB,OAAoC;AAClE,SAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,KAAK,KAAK;AACjE;AAGO,SAAS,gBAAgB,gBAA6C;AAC3E,QAAM,YAAY,eAAe,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAC9E,QAAM,OAAO,aAAa,eAAe,IAAI,MAAM,GAAG,KAAK;AAC3D,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,IAAI,EAAE,EAAE;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,aACpB,UACA,SAAuB,CAAC,GACC;AACzB,QAAM,SAAS,cAAc,OAAO,MAAM;AAC1C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO,qBAAqB;AAAA,IAC1B;AAAA,IACA,SAAS,eAAe,OAAO,OAAO;AAAA,IACtC;AAAA,IACA,UAAU,OAAO;AAAA;AAAA,IAEjB,OAAO,gBAAgB,OAAO,KAAK,KAAK,gBAAgB,MAAM,QAAQ,CAAC;AAAA,EACzE,CAAC;AACH;;;AC9DA,OAAO;AACP,SAAS,eAAe;AACxB,SAAS,sBAAsB;;;ACDxB,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AFK7C,eAAsB,eAAuC;AAC3D,QAAM,QAAQ,MAAM,QAAQ;AAC5B,SAAO,MAAM,IAAI,gBAAgB,GAAG,SAAS;AAC/C;AAMA,eAAsB,gBAAgB,QAA4C;AAChF,MAAI,OAAQ,QAAO,OAAO;AAC1B,SAAQ,MAAM,aAAa,KAAM,eAAe;AAClD;;;AFNA,eAAsB,oBAAoB,UAA2C;AACnF,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,MAAM,OAAO,cAAc;AAAA,IACxC,OAAO,OAAO,SAAS,IAAI,OAAO,KAAK,EAAE;AAAA,IACzC,aAAa,OAAO,SAAS,IAAI,aAAa,KAAK,EAAE;AAAA,IACrD,OAAO,SAAS,SAAS,IAAI,OAAO,CAAC;AAAA,EACvC,CAAC;AAED,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,SAAS,YAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,WAAW,UAA2C;AAC1E,QAAM,YAAY,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AACxD,QAAM,WAAW,SAAS,IAAI,UAAU,MAAM;AAC9C,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,WAAW,MAAM,OAAO,OAAO,SAAS,IAAI,MAAM,OAAO,KAAK,SAAS;AAEtF,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,SAAS,YAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,cAAc,UAA2C;AAC7E,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,MAAM,OAAO,cAAc;AAAA,IACxC,WAAW,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AAAA,IACjD,MAAM,OAAO,SAAS,IAAI,MAAM,KAAK,EAAE;AAAA,IACvC,YAAY,SAAS,SAAS,IAAI,YAAY,CAAC;AAAA,EACjD,CAAC;AAED,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,SAAS,YAAY,OAAO,KAAK,EAAE;AACpF;AAEA,eAAsB,aAAa,UAA2C;AAC5E,QAAM,YAAY,OAAO,SAAS,IAAI,WAAW,KAAK,EAAE;AACxD,QAAM,QAAQ,SAAS,SAAS,IAAI,OAAO,CAAC;AAC5C,QAAM,SAAS,MAAM,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAM,SAAS,QAAQ,MAAM,OAAO,OAAO,WAAW,KAAK,IAAI,MAAM,OAAO,SAAS,SAAS;AAE9F,aAAW,QAAQ;AACnB,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,SAAS,YAAY,OAAO,KAAK,EAAE;AACpF;AAEA,SAAS,SAAS,OAAsD;AACtE,QAAM,OAAO,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACxD,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AAEA,SAAS,WAAW,UAA0B;AAC5C,QAAM,OAAO,SAAS,IAAI,MAAM;AAChC,MAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG,EAAG,gBAAe,IAAI;AAC3E;","names":[]}

package/dist/{chunk-SFNYZN24.mjs → chunk-DCIL2IC4.mjs}

@@ -2,11 +2,11 @@ import {
   DEVICE_ID_COOKIE,
   DEVICE_ID_MAX_AGE,
   SDK_HEADER
-} from "./chunk-WUW57LPF.mjs";
+} from "./chunk-F4BPXSKD.mjs";
 
 // src/handler.ts
 import "server-only";
-import { createDeviceId } from "@fewchurs/react/core";
+import { createDeviceId, NOT_CONFIGURED_MESSAGE } from "@fewchurs/react/core";
 
 // src/config.ts
 import "server-only";
@@ -77,7 +77,7 @@ function createHandler(options = {}) {
       console.error(
         "[fewchurs] No API key. Set FEWCHURS_API_KEY, or pass apiKey to createHandler()."
       );
-      return json({ error: { code: "internal", message: "Fewchurs is not configured." } }, 500);
+      return json({ error: { code: "internal", message: NOT_CONFIGURED_MESSAGE } }, 500);
     }
     const cookieValue = readCookie(request, DEVICE_ID_COOKIE);
     const custom = options.deviceId ? await options.deviceId() : null;
@@ -165,6 +165,7 @@ function json(body, status) {
 
 export {
   DEFAULT_API_PATH,
+  resolveApiKey,
   resolveApiPath,
   serverClient,
   createHandler,
@@ -172,4 +173,4 @@ export {
   POST,
   DELETE
 };
-//# sourceMappingURL=chunk-SFNYZN24.mjs.map
+//# sourceMappingURL=chunk-DCIL2IC4.mjs.map

package/dist/chunk-DCIL2IC4.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/handler.ts","../src/config.ts"],"sourcesContent":["import \"server-only\";\nimport { createDeviceId, NOT_CONFIGURED_MESSAGE } from \"@fewchurs/react/core\";\nimport {\n  configuredAppId,\n  requestHostname,\n  resolveApiKey,\n  resolveApiPath,\n  resolveBaseUrl,\n} from \"./config\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE, SDK_HEADER } from \"./constants\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface HandlerOptions {\n  apiKey?: string;\n  baseUrl?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n  /** Where the handler is mounted, when it is not `/api/fewchurs`. */\n  apiPath?: string;\n  /** Return a stable, hashed id for the signed-in visitor so votes follow the account. */\n  deviceId?: DeviceIdResolver;\n}\n\ntype RouteParams = { route?: string[] };\n\n/** What Next passes: a Promise in 15, a plain object in 14. Both are awaited the same way. */\ntype IncomingContext = { params?: RouteParams | Promise<RouteParams> };\n\n// Next 15's route check wants a required second argument whose `params` is a Promise. The\n// handler itself takes `IncomingContext`, so Next 14's plain object still works at runtime.\ntype RouteContext = { params: Promise<RouteParams> };\n\nexport type RouteHandler = (request: Request, context: RouteContext) => Promise<Response>;\n\n/** Only the endpoints the board needs: everything else is a 404, not a proxy to the API. */\nconst ALLOWED: Array<{ method: string; pattern: RegExp }> = [\n  { method: \"GET\", pattern: /^config$/ },\n  { method: \"GET\", pattern: /^features$/ },\n  { method: \"POST\", pattern: /^features$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+\\/comments$/ },\n  { method: \"POST\", pattern: /^comments$/ },\n];\n\nconst DEVICE_ID_PATTERN = /^[A-Za-z0-9_-]{8,128}$/;\n\nexport function createHandler(options: HandlerOptions = {}): {\n  GET: RouteHandler;\n  POST: RouteHandler;\n  DELETE: RouteHandler;\n} {\n  async function handle(request: Request, context?: IncomingContext): Promise<Response> {\n    const path = await routePath(request, context, resolveApiPath(options.apiPath));\n\n    if (!ALLOWED.some((route) => route.method === request.method && route.pattern.test(path))) {\n      return json({ error: { code: \"not_found\", message: \"Unknown Fewchurs route.\" } }, 404);\n    }\n\n    const apiKey = resolveApiKey(options.apiKey);\n    if (!apiKey) {\n      console.error(\n        \"[fewchurs] No API key. Set FEWCHURS_API_KEY, or pass apiKey to createHandler().\",\n      );\n      return json({ error: { code: \"internal\", message: NOT_CONFIGURED_MESSAGE } }, 500);\n    }\n\n    const cookieValue = readCookie(request, DEVICE_ID_COOKIE);\n    const custom = options.deviceId ? await options.deviceId() : null;\n    const deviceId = custom ?? cookieValue ?? claimedDeviceId(request) ?? createDeviceId();\n\n    const target = `${resolveBaseUrl(options.baseUrl)}/${path}${new URL(request.url).search}`;\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${apiKey}`,\n      \"X-Device-Id\": deviceId,\n      \"X-Fewchurs-Sdk\": SDK_HEADER,\n      \"X-Fewchurs-App-Id\":\n        configuredAppId(options.appId) ??\n        requestHostname(request.headers) ??\n        new URL(request.url).hostname,\n      Accept: \"application/json\",\n    };\n    const language = request.headers.get(\"accept-language\");\n    if (language) headers[\"Accept-Language\"] = language;\n\n    const body = request.method === \"GET\" ? undefined : await request.text();\n    if (body) headers[\"Content-Type\"] = \"application/json\";\n\n    let upstream: Response;\n    try {\n      upstream = await fetch(target, { method: request.method, headers, body, cache: \"no-store\" });\n    } catch {\n      return json({ error: { code: \"internal\", message: \"Could not reach Fewchurs.\" } }, 502);\n    }\n\n    const text = await upstream.text();\n    if (upstream.status === 403) logRefusal(text);\n\n    const response = new Response(text, {\n      status: upstream.status,\n      headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n    });\n\n    // A visitor keeps the same id across requests without the browser ever seeing the key,\n    // and an httpOnly cookie means page scripts cannot read or change it either.\n    if (!custom && deviceId !== cookieValue) {\n      response.headers.append(\"Set-Cookie\", serializeCookie(deviceId));\n    }\n\n    return response;\n  }\n\n  return { GET: handle, POST: handle, DELETE: handle };\n}\n\nconst defaultHandler = createHandler();\n\nexport const GET = defaultHandler.GET;\nexport const POST = defaultHandler.POST;\nexport const DELETE = defaultHandler.DELETE;\n\nlet loggedRefusal = false;\n\n/** Visitors only see a safe message, so a live site's server log is where the domain gets named. */\nfunction logRefusal(body: string): void {\n  if (loggedRefusal) return;\n  try {\n    const error = (JSON.parse(body) as { error?: { code?: string; message?: string } }).error;\n    if (error?.code !== \"wrong_app\") return;\n    loggedRefusal = true;\n    console.error(`[fewchurs] ${error.message}`);\n  } catch {\n    // Not JSON, so it isn't a refusal from Fewchurs.\n  }\n}\n\nasync function routePath(\n  request: Request,\n  context: IncomingContext | undefined,\n  apiPath: string,\n): Promise<string> {\n  const params = await context?.params;\n  if (params?.route?.length) return params.route.map(encodeURIComponent).join(\"/\");\n\n  const { pathname } = new URL(request.url);\n  const index = pathname.indexOf(apiPath);\n  return index === -1 ? \"\" : pathname.slice(index + apiPath.length).replace(/^\\//, \"\");\n}\n\n/**\n * The first request from a server-rendered board carries the id the page was rendered with,\n * so adopting it keeps the server's `hasVoted` answers and the browser's in agreement.\n */\nfunction claimedDeviceId(request: Request): string | null {\n  const claimed = request.headers.get(\"x-device-id\");\n  return claimed && DEVICE_ID_PATTERN.test(claimed) ? claimed : null;\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n  const header = request.headers.get(\"cookie\");\n  if (!header) return null;\n  const match = header.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match?.[1] ? decodeURIComponent(match[1]) : null;\n}\n\nfunction serializeCookie(deviceId: string): string {\n  const parts = [\n    `${DEVICE_ID_COOKIE}=${encodeURIComponent(deviceId)}`,\n    \"Path=/\",\n    `Max-Age=${DEVICE_ID_MAX_AGE}`,\n    \"HttpOnly\",\n    \"SameSite=Lax\",\n  ];\n  if (process.env.NODE_ENV === \"production\") parts.push(\"Secure\");\n  return parts.join(\"; \");\n}\n\nfunction json(body: unknown, status: number): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n  });\n}\n","import \"server-only\";\nimport { headers } from \"next/headers\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\n/** A domain set by the developer, which replaces the one read from the request. */\nexport function configuredAppId(appId?: string): string | undefined {\n  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || undefined;\n}\n\n/** The site's host name without a port. A reverse proxy reports the public one in `x-forwarded-host`. */\nexport function requestHostname(requestHeaders: Headers): string | undefined {\n  const forwarded = requestHeaders.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  const host = forwarded || requestHeaders.get(\"host\")?.trim();\n  if (!host) return undefined;\n  try {\n    return new URL(`http://${host}`).hostname;\n  } catch {\n    return undefined;\n  }\n}\n\nexport async function serverClient(\n  deviceId: string | null,\n  config: ServerConfig = {},\n): Promise<FewchursClient> {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n    // Only read the request when needed, so a page with a set domain can still render statically.\n    appId: configuredAppId(config.appId) ?? requestHostname(await headers()),\n  });\n}\n"],"mappings":";;;;;;;AAAA,OAAO;AACP,SAAS,gBAAgB,8BAA8B;;;ACDvD,OAAO;AACP,SAAS,eAAe;AACxB,SAAS,sBAAsB,wBAA6C;AAErE,IAAM,mBAAmB;AAUzB,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAEO,SAAS,eAAe,SAA0B;AACvD,UAAQ,WAAW,QAAQ,IAAI,qBAAqB,kBAAkB,QAAQ,OAAO,EAAE;AACzF;AAGO,SAAS,gBAAgB,OAAoC;AAClE,SAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,KAAK,KAAK;AACjE;AAGO,SAAS,gBAAgB,gBAA6C;AAC3E,QAAM,YAAY,eAAe,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAC9E,QAAM,OAAO,aAAa,eAAe,IAAI,MAAM,GAAG,KAAK;AAC3D,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,IAAI,EAAE,EAAE;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,aACpB,UACA,SAAuB,CAAC,GACC;AACzB,QAAM,SAAS,cAAc,OAAO,MAAM;AAC1C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO,qBAAqB;AAAA,IAC1B;AAAA,IACA,SAAS,eAAe,OAAO,OAAO;AAAA,IACtC;AAAA,IACA,UAAU,OAAO;AAAA;AAAA,IAEjB,OAAO,gBAAgB,OAAO,KAAK,KAAK,gBAAgB,MAAM,QAAQ,CAAC;AAAA,EACzE,CAAC;AACH;;;AD3BA,IAAM,UAAsD;AAAA,EAC1D,EAAE,QAAQ,OAAO,SAAS,WAAW;AAAA,EACrC,EAAE,QAAQ,OAAO,SAAS,aAAa;AAAA,EACvC,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAAA,EACxC,EAAE,QAAQ,OAAO,SAAS,oBAAoB;AAAA,EAC9C,EAAE,QAAQ,QAAQ,SAAS,0BAA0B;AAAA,EACrD,EAAE,QAAQ,UAAU,SAAS,0BAA0B;AAAA,EACvD,EAAE,QAAQ,QAAQ,SAAS,4BAA4B;AAAA,EACvD,EAAE,QAAQ,UAAU,SAAS,4BAA4B;AAAA,EACzD,EAAE,QAAQ,OAAO,SAAS,8BAA8B;AAAA,EACxD,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAC1C;AAEA,IAAM,oBAAoB;AAEnB,SAAS,cAAc,UAA0B,CAAC,GAIvD;AACA,iBAAe,OAAO,SAAkB,SAA8C;AACpF,UAAM,OAAO,MAAM,UAAU,SAAS,SAAS,eAAe,QAAQ,OAAO,CAAC;AAE9E,QAAI,CAAC,QAAQ,KAAK,CAAC,UAAU,MAAM,WAAW,QAAQ,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG;AACzF,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,SAAS,0BAA0B,EAAE,GAAG,GAAG;AAAA,IACvF;AAEA,UAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,QAAI,CAAC,QAAQ;AACX,cAAQ;AAAA,QACN;AAAA,MACF;AACA,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,uBAAuB,EAAE,GAAG,GAAG;AAAA,IACnF;AAEA,UAAM,cAAc,WAAW,SAAS,gBAAgB;AACxD,UAAM,SAAS,QAAQ,WAAW,MAAM,QAAQ,SAAS,IAAI;AAC7D,UAAM,WAAW,UAAU,eAAe,gBAAgB,OAAO,KAAK,eAAe;AAErF,UAAM,SAAS,GAAG,eAAe,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,MAAM;AACvF,UAAMA,WAAkC;AAAA,MACtC,eAAe,UAAU,MAAM;AAAA,MAC/B,eAAe;AAAA,MACf,kBAAkB;AAAA,MAClB,qBACE,gBAAgB,QAAQ,KAAK,KAC7B,gBAAgB,QAAQ,OAAO,KAC/B,IAAI,IAAI,QAAQ,GAAG,EAAE;AAAA,MACvB,QAAQ;AAAA,IACV;AACA,UAAM,WAAW,QAAQ,QAAQ,IAAI,iBAAiB;AACtD,QAAI,SAAU,CAAAA,SAAQ,iBAAiB,IAAI;AAE3C,UAAM,OAAO,QAAQ,WAAW,QAAQ,SAAY,MAAM,QAAQ,KAAK;AACvE,QAAI,KAAM,CAAAA,SAAQ,cAAc,IAAI;AAEpC,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,QAAQ,EAAE,QAAQ,QAAQ,QAAQ,SAAAA,UAAS,MAAM,OAAO,WAAW,CAAC;AAAA,IAC7F,QAAQ;AACN,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,4BAA4B,EAAE,GAAG,GAAG;AAAA,IACxF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,SAAS,WAAW,IAAK,YAAW,IAAI;AAE5C,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ,SAAS;AAAA,MACjB,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,IAC7E,CAAC;AAID,QAAI,CAAC,UAAU,aAAa,aAAa;AACvC,eAAS,QAAQ,OAAO,cAAc,gBAAgB,QAAQ,CAAC;AAAA,IACjE;AAEA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,OAAO;AACrD;AAEA,IAAM,iBAAiB,cAAc;AAE9B,IAAM,MAAM,eAAe;AAC3B,IAAM,OAAO,eAAe;AAC5B,IAAM,SAAS,eAAe;AAErC,IAAI,gBAAgB;AAGpB,SAAS,WAAW,MAAoB;AACtC,MAAI,cAAe;AACnB,MAAI;AACF,UAAM,QAAS,KAAK,MAAM,IAAI,EAAsD;AACpF,QAAI,OAAO,SAAS,YAAa;AACjC,oBAAgB;AAChB,YAAQ,MAAM,cAAc,MAAM,OAAO,EAAE;AAAA,EAC7C,QAAQ;AAAA,EAER;AACF;AAEA,eAAe,UACb,SACA,SACA,SACiB;AACjB,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,QAAQ,OAAO,OAAQ,QAAO,OAAO,MAAM,IAAI,kBAAkB,EAAE,KAAK,GAAG;AAE/E,QAAM,EAAE,SAAS,IAAI,IAAI,IAAI,QAAQ,GAAG;AACxC,QAAM,QAAQ,SAAS,QAAQ,OAAO;AACtC,SAAO,UAAU,KAAK,KAAK,SAAS,MAAM,QAAQ,QAAQ,MAAM,EAAE,QAAQ,OAAO,EAAE;AACrF;AAMA,SAAS,gBAAgB,SAAiC;AACxD,QAAM,UAAU,QAAQ,QAAQ,IAAI,aAAa;AACjD,SAAO,WAAW,kBAAkB,KAAK,OAAO,IAAI,UAAU;AAChE;AAEA,SAAS,WAAW,SAAkB,MAA6B;AACjE,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACnE,SAAO,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACrD;AAEA,SAAS,gBAAgB,UAA0B;AACjD,QAAM,QAAQ;AAAA,IACZ,GAAG,gBAAgB,IAAI,mBAAmB,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,WAAW,iBAAiB;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,aAAa,aAAc,OAAM,KAAK,QAAQ;AAC9D,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,KAAK,MAAe,QAA0B;AACrD,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,EAC7E,CAAC;AACH;","names":["headers"]}

package/dist/{chunk-WUW57LPF.mjs → chunk-F4BPXSKD.mjs}

@@ -1,5 +1,5 @@
 // src/version.ts
-var SDK_VERSION = "1.3.0";
+var SDK_VERSION = "1.5.0";
 
 // src/constants.ts
 var DEVICE_ID_COOKIE = "fewchurs_did";
@@ -11,4 +11,4 @@ export {
   DEVICE_ID_MAX_AGE,
   SDK_HEADER
 };
-//# sourceMappingURL=chunk-WUW57LPF.mjs.map
+//# sourceMappingURL=chunk-F4BPXSKD.mjs.map

package/dist/{chunk-WUW57LPF.mjs.map → chunk-F4BPXSKD.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/version.ts","../src/constants.ts"],"sourcesContent":["// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.3.0\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";AACO,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;","names":[]}
+{"version":3,"sources":["../src/version.ts","../src/constants.ts"],"sourcesContent":["// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.5.0\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";AACO,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;","names":[]}

package/dist/{chunk-B4TL4JIY.mjs → chunk-MIJLYYIN.mjs}

@@ -1,7 +1,7 @@
 import {
   DEVICE_ID_COOKIE,
   DEVICE_ID_MAX_AGE
-} from "./chunk-WUW57LPF.mjs";
+} from "./chunk-F4BPXSKD.mjs";
 
 // src/identity.ts
 import "server-only";
@@ -35,4 +35,4 @@ export {
   resolveDeviceId,
   deviceIdCookie
 };
-//# sourceMappingURL=chunk-B4TL4JIY.mjs.map
+//# sourceMappingURL=chunk-MIJLYYIN.mjs.map

package/dist/handler.js

@@ -58,7 +58,7 @@ function requestHostname(requestHeaders) {
 }
 
 // src/version.ts
-var SDK_VERSION = "1.3.0";
+var SDK_VERSION = "1.5.0";
 
 // src/constants.ts
 var DEVICE_ID_COOKIE = "fewchurs_did";
@@ -90,7 +90,7 @@ function createHandler(options = {}) {
       console.error(
         "[fewchurs] No API key. Set FEWCHURS_API_KEY, or pass apiKey to createHandler()."
       );
-      return json({ error: { code: "internal", message: "Fewchurs is not configured." } }, 500);
+      return json({ error: { code: "internal", message: import_core2.NOT_CONFIGURED_MESSAGE } }, 500);
     }
     const cookieValue = readCookie(request, DEVICE_ID_COOKIE);
     const custom = options.deviceId ? await options.deviceId() : null;

package/dist/handler.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/handler.ts","../src/config.ts","../src/version.ts","../src/constants.ts"],"sourcesContent":["import \"server-only\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport {\n  configuredAppId,\n  requestHostname,\n  resolveApiKey,\n  resolveApiPath,\n  resolveBaseUrl,\n} from \"./config\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE, SDK_HEADER } from \"./constants\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface HandlerOptions {\n  apiKey?: string;\n  baseUrl?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n  /** Where the handler is mounted, when it is not `/api/fewchurs`. */\n  apiPath?: string;\n  /** Return a stable, hashed id for the signed-in visitor so votes follow the account. */\n  deviceId?: DeviceIdResolver;\n}\n\ntype RouteParams = { route?: string[] };\n\n/** What Next passes: a Promise in 15, a plain object in 14. Both are awaited the same way. */\ntype IncomingContext = { params?: RouteParams | Promise<RouteParams> };\n\n// Next 15's route check wants a required second argument whose `params` is a Promise. The\n// handler itself takes `IncomingContext`, so Next 14's plain object still works at runtime.\ntype RouteContext = { params: Promise<RouteParams> };\n\nexport type RouteHandler = (request: Request, context: RouteContext) => Promise<Response>;\n\n/** Only the endpoints the board needs: everything else is a 404, not a proxy to the API. */\nconst ALLOWED: Array<{ method: string; pattern: RegExp }> = [\n  { method: \"GET\", pattern: /^config$/ },\n  { method: \"GET\", pattern: /^features$/ },\n  { method: \"POST\", pattern: /^features$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+\\/comments$/ },\n  { method: \"POST\", pattern: /^comments$/ },\n];\n\nconst DEVICE_ID_PATTERN = /^[A-Za-z0-9_-]{8,128}$/;\n\nexport function createHandler(options: HandlerOptions = {}): {\n  GET: RouteHandler;\n  POST: RouteHandler;\n  DELETE: RouteHandler;\n} {\n  async function handle(request: Request, context?: IncomingContext): Promise<Response> {\n    const path = await routePath(request, context, resolveApiPath(options.apiPath));\n\n    if (!ALLOWED.some((route) => route.method === request.method && route.pattern.test(path))) {\n      return json({ error: { code: \"not_found\", message: \"Unknown Fewchurs route.\" } }, 404);\n    }\n\n    const apiKey = resolveApiKey(options.apiKey);\n    if (!apiKey) {\n      console.error(\n        \"[fewchurs] No API key. Set FEWCHURS_API_KEY, or pass apiKey to createHandler().\",\n      );\n      return json({ error: { code: \"internal\", message: \"Fewchurs is not configured.\" } }, 500);\n    }\n\n    const cookieValue = readCookie(request, DEVICE_ID_COOKIE);\n    const custom = options.deviceId ? await options.deviceId() : null;\n    const deviceId = custom ?? cookieValue ?? claimedDeviceId(request) ?? createDeviceId();\n\n    const target = `${resolveBaseUrl(options.baseUrl)}/${path}${new URL(request.url).search}`;\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${apiKey}`,\n      \"X-Device-Id\": deviceId,\n      \"X-Fewchurs-Sdk\": SDK_HEADER,\n      \"X-Fewchurs-App-Id\":\n        configuredAppId(options.appId) ??\n        requestHostname(request.headers) ??\n        new URL(request.url).hostname,\n      Accept: \"application/json\",\n    };\n    const language = request.headers.get(\"accept-language\");\n    if (language) headers[\"Accept-Language\"] = language;\n\n    const body = request.method === \"GET\" ? undefined : await request.text();\n    if (body) headers[\"Content-Type\"] = \"application/json\";\n\n    let upstream: Response;\n    try {\n      upstream = await fetch(target, { method: request.method, headers, body, cache: \"no-store\" });\n    } catch {\n      return json({ error: { code: \"internal\", message: \"Could not reach Fewchurs.\" } }, 502);\n    }\n\n    const text = await upstream.text();\n    if (upstream.status === 403) logRefusal(text);\n\n    const response = new Response(text, {\n      status: upstream.status,\n      headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n    });\n\n    // A visitor keeps the same id across requests without the browser ever seeing the key,\n    // and an httpOnly cookie means page scripts cannot read or change it either.\n    if (!custom && deviceId !== cookieValue) {\n      response.headers.append(\"Set-Cookie\", serializeCookie(deviceId));\n    }\n\n    return response;\n  }\n\n  return { GET: handle, POST: handle, DELETE: handle };\n}\n\nconst defaultHandler = createHandler();\n\nexport const GET = defaultHandler.GET;\nexport const POST = defaultHandler.POST;\nexport const DELETE = defaultHandler.DELETE;\n\nlet loggedRefusal = false;\n\n/** Visitors only see a safe message, so a live site's server log is where the domain gets named. */\nfunction logRefusal(body: string): void {\n  if (loggedRefusal) return;\n  try {\n    const error = (JSON.parse(body) as { error?: { code?: string; message?: string } }).error;\n    if (error?.code !== \"wrong_app\") return;\n    loggedRefusal = true;\n    console.error(`[fewchurs] ${error.message}`);\n  } catch {\n    // Not JSON, so it isn't a refusal from Fewchurs.\n  }\n}\n\nasync function routePath(\n  request: Request,\n  context: IncomingContext | undefined,\n  apiPath: string,\n): Promise<string> {\n  const params = await context?.params;\n  if (params?.route?.length) return params.route.map(encodeURIComponent).join(\"/\");\n\n  const { pathname } = new URL(request.url);\n  const index = pathname.indexOf(apiPath);\n  return index === -1 ? \"\" : pathname.slice(index + apiPath.length).replace(/^\\//, \"\");\n}\n\n/**\n * The first request from a server-rendered board carries the id the page was rendered with,\n * so adopting it keeps the server's `hasVoted` answers and the browser's in agreement.\n */\nfunction claimedDeviceId(request: Request): string | null {\n  const claimed = request.headers.get(\"x-device-id\");\n  return claimed && DEVICE_ID_PATTERN.test(claimed) ? claimed : null;\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n  const header = request.headers.get(\"cookie\");\n  if (!header) return null;\n  const match = header.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match?.[1] ? decodeURIComponent(match[1]) : null;\n}\n\nfunction serializeCookie(deviceId: string): string {\n  const parts = [\n    `${DEVICE_ID_COOKIE}=${encodeURIComponent(deviceId)}`,\n    \"Path=/\",\n    `Max-Age=${DEVICE_ID_MAX_AGE}`,\n    \"HttpOnly\",\n    \"SameSite=Lax\",\n  ];\n  if (process.env.NODE_ENV === \"production\") parts.push(\"Secure\");\n  return parts.join(\"; \");\n}\n\nfunction json(body: unknown, status: number): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n  });\n}\n","import \"server-only\";\nimport { headers } from \"next/headers\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\n/** A domain set by the developer, which replaces the one read from the request. */\nexport function configuredAppId(appId?: string): string | undefined {\n  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || undefined;\n}\n\n/** The site's host name without a port. A reverse proxy reports the public one in `x-forwarded-host`. */\nexport function requestHostname(requestHeaders: Headers): string | undefined {\n  const forwarded = requestHeaders.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  const host = forwarded || requestHeaders.get(\"host\")?.trim();\n  if (!host) return undefined;\n  try {\n    return new URL(`http://${host}`).hostname;\n  } catch {\n    return undefined;\n  }\n}\n\nexport async function serverClient(\n  deviceId: string | null,\n  config: ServerConfig = {},\n): Promise<FewchursClient> {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n    // Only read the request when needed, so a page with a set domain can still render statically.\n    appId: configuredAppId(config.appId) ?? requestHostname(await headers()),\n  });\n}\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.3.0\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAAA,sBAAO;AACP,IAAAC,eAA+B;;;ACD/B,yBAAO;AACP,qBAAwB;AACxB,kBAA4E;AAErE,IAAM,mBAAmB;AAUzB,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAEO,SAAS,eAAe,SAA0B;AACvD,UAAQ,WAAW,QAAQ,IAAI,qBAAqB,kBAAkB,QAAQ,OAAO,EAAE;AACzF;AAGO,SAAS,gBAAgB,OAAoC;AAClE,SAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,KAAK,KAAK;AACjE;AAGO,SAAS,gBAAgB,gBAA6C;AAC3E,QAAM,YAAY,eAAe,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAC9E,QAAM,OAAO,aAAa,eAAe,IAAI,MAAM,GAAG,KAAK;AAC3D,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,IAAI,EAAE,EAAE;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACxCO,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AH8B7C,IAAM,UAAsD;AAAA,EAC1D,EAAE,QAAQ,OAAO,SAAS,WAAW;AAAA,EACrC,EAAE,QAAQ,OAAO,SAAS,aAAa;AAAA,EACvC,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAAA,EACxC,EAAE,QAAQ,OAAO,SAAS,oBAAoB;AAAA,EAC9C,EAAE,QAAQ,QAAQ,SAAS,0BAA0B;AAAA,EACrD,EAAE,QAAQ,UAAU,SAAS,0BAA0B;AAAA,EACvD,EAAE,QAAQ,QAAQ,SAAS,4BAA4B;AAAA,EACvD,EAAE,QAAQ,UAAU,SAAS,4BAA4B;AAAA,EACzD,EAAE,QAAQ,OAAO,SAAS,8BAA8B;AAAA,EACxD,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAC1C;AAEA,IAAM,oBAAoB;AAEnB,SAAS,cAAc,UAA0B,CAAC,GAIvD;AACA,iBAAe,OAAO,SAAkB,SAA8C;AACpF,UAAM,OAAO,MAAM,UAAU,SAAS,SAAS,eAAe,QAAQ,OAAO,CAAC;AAE9E,QAAI,CAAC,QAAQ,KAAK,CAAC,UAAU,MAAM,WAAW,QAAQ,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG;AACzF,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,SAAS,0BAA0B,EAAE,GAAG,GAAG;AAAA,IACvF;AAEA,UAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,QAAI,CAAC,QAAQ;AACX,cAAQ;AAAA,QACN;AAAA,MACF;AACA,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,8BAA8B,EAAE,GAAG,GAAG;AAAA,IAC1F;AAEA,UAAM,cAAc,WAAW,SAAS,gBAAgB;AACxD,UAAM,SAAS,QAAQ,WAAW,MAAM,QAAQ,SAAS,IAAI;AAC7D,UAAM,WAAW,UAAU,eAAe,gBAAgB,OAAO,SAAK,6BAAe;AAErF,UAAM,SAAS,GAAG,eAAe,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,MAAM;AACvF,UAAMC,WAAkC;AAAA,MACtC,eAAe,UAAU,MAAM;AAAA,MAC/B,eAAe;AAAA,MACf,kBAAkB;AAAA,MAClB,qBACE,gBAAgB,QAAQ,KAAK,KAC7B,gBAAgB,QAAQ,OAAO,KAC/B,IAAI,IAAI,QAAQ,GAAG,EAAE;AAAA,MACvB,QAAQ;AAAA,IACV;AACA,UAAM,WAAW,QAAQ,QAAQ,IAAI,iBAAiB;AACtD,QAAI,SAAU,CAAAA,SAAQ,iBAAiB,IAAI;AAE3C,UAAM,OAAO,QAAQ,WAAW,QAAQ,SAAY,MAAM,QAAQ,KAAK;AACvE,QAAI,KAAM,CAAAA,SAAQ,cAAc,IAAI;AAEpC,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,QAAQ,EAAE,QAAQ,QAAQ,QAAQ,SAAAA,UAAS,MAAM,OAAO,WAAW,CAAC;AAAA,IAC7F,QAAQ;AACN,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,4BAA4B,EAAE,GAAG,GAAG;AAAA,IACxF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,SAAS,WAAW,IAAK,YAAW,IAAI;AAE5C,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ,SAAS;AAAA,MACjB,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,IAC7E,CAAC;AAID,QAAI,CAAC,UAAU,aAAa,aAAa;AACvC,eAAS,QAAQ,OAAO,cAAc,gBAAgB,QAAQ,CAAC;AAAA,IACjE;AAEA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,OAAO;AACrD;AAEA,IAAM,iBAAiB,cAAc;AAE9B,IAAM,MAAM,eAAe;AAC3B,IAAM,OAAO,eAAe;AAC5B,IAAM,SAAS,eAAe;AAErC,IAAI,gBAAgB;AAGpB,SAAS,WAAW,MAAoB;AACtC,MAAI,cAAe;AACnB,MAAI;AACF,UAAM,QAAS,KAAK,MAAM,IAAI,EAAsD;AACpF,QAAI,OAAO,SAAS,YAAa;AACjC,oBAAgB;AAChB,YAAQ,MAAM,cAAc,MAAM,OAAO,EAAE;AAAA,EAC7C,QAAQ;AAAA,EAER;AACF;AAEA,eAAe,UACb,SACA,SACA,SACiB;AACjB,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,QAAQ,OAAO,OAAQ,QAAO,OAAO,MAAM,IAAI,kBAAkB,EAAE,KAAK,GAAG;AAE/E,QAAM,EAAE,SAAS,IAAI,IAAI,IAAI,QAAQ,GAAG;AACxC,QAAM,QAAQ,SAAS,QAAQ,OAAO;AACtC,SAAO,UAAU,KAAK,KAAK,SAAS,MAAM,QAAQ,QAAQ,MAAM,EAAE,QAAQ,OAAO,EAAE;AACrF;AAMA,SAAS,gBAAgB,SAAiC;AACxD,QAAM,UAAU,QAAQ,QAAQ,IAAI,aAAa;AACjD,SAAO,WAAW,kBAAkB,KAAK,OAAO,IAAI,UAAU;AAChE;AAEA,SAAS,WAAW,SAAkB,MAA6B;AACjE,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACnE,SAAO,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACrD;AAEA,SAAS,gBAAgB,UAA0B;AACjD,QAAM,QAAQ;AAAA,IACZ,GAAG,gBAAgB,IAAI,mBAAmB,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,WAAW,iBAAiB;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,aAAa,aAAc,OAAM,KAAK,QAAQ;AAC9D,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,KAAK,MAAe,QAA0B;AACrD,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,EAC7E,CAAC;AACH;","names":["import_server_only","import_core","headers"]}
+{"version":3,"sources":["../src/handler.ts","../src/config.ts","../src/version.ts","../src/constants.ts"],"sourcesContent":["import \"server-only\";\nimport { createDeviceId, NOT_CONFIGURED_MESSAGE } from \"@fewchurs/react/core\";\nimport {\n  configuredAppId,\n  requestHostname,\n  resolveApiKey,\n  resolveApiPath,\n  resolveBaseUrl,\n} from \"./config\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE, SDK_HEADER } from \"./constants\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface HandlerOptions {\n  apiKey?: string;\n  baseUrl?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n  /** Where the handler is mounted, when it is not `/api/fewchurs`. */\n  apiPath?: string;\n  /** Return a stable, hashed id for the signed-in visitor so votes follow the account. */\n  deviceId?: DeviceIdResolver;\n}\n\ntype RouteParams = { route?: string[] };\n\n/** What Next passes: a Promise in 15, a plain object in 14. Both are awaited the same way. */\ntype IncomingContext = { params?: RouteParams | Promise<RouteParams> };\n\n// Next 15's route check wants a required second argument whose `params` is a Promise. The\n// handler itself takes `IncomingContext`, so Next 14's plain object still works at runtime.\ntype RouteContext = { params: Promise<RouteParams> };\n\nexport type RouteHandler = (request: Request, context: RouteContext) => Promise<Response>;\n\n/** Only the endpoints the board needs: everything else is a 404, not a proxy to the API. */\nconst ALLOWED: Array<{ method: string; pattern: RegExp }> = [\n  { method: \"GET\", pattern: /^config$/ },\n  { method: \"GET\", pattern: /^features$/ },\n  { method: \"POST\", pattern: /^features$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+\\/comments$/ },\n  { method: \"POST\", pattern: /^comments$/ },\n];\n\nconst DEVICE_ID_PATTERN = /^[A-Za-z0-9_-]{8,128}$/;\n\nexport function createHandler(options: HandlerOptions = {}): {\n  GET: RouteHandler;\n  POST: RouteHandler;\n  DELETE: RouteHandler;\n} {\n  async function handle(request: Request, context?: IncomingContext): Promise<Response> {\n    const path = await routePath(request, context, resolveApiPath(options.apiPath));\n\n    if (!ALLOWED.some((route) => route.method === request.method && route.pattern.test(path))) {\n      return json({ error: { code: \"not_found\", message: \"Unknown Fewchurs route.\" } }, 404);\n    }\n\n    const apiKey = resolveApiKey(options.apiKey);\n    if (!apiKey) {\n      console.error(\n        \"[fewchurs] No API key. Set FEWCHURS_API_KEY, or pass apiKey to createHandler().\",\n      );\n      return json({ error: { code: \"internal\", message: NOT_CONFIGURED_MESSAGE } }, 500);\n    }\n\n    const cookieValue = readCookie(request, DEVICE_ID_COOKIE);\n    const custom = options.deviceId ? await options.deviceId() : null;\n    const deviceId = custom ?? cookieValue ?? claimedDeviceId(request) ?? createDeviceId();\n\n    const target = `${resolveBaseUrl(options.baseUrl)}/${path}${new URL(request.url).search}`;\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${apiKey}`,\n      \"X-Device-Id\": deviceId,\n      \"X-Fewchurs-Sdk\": SDK_HEADER,\n      \"X-Fewchurs-App-Id\":\n        configuredAppId(options.appId) ??\n        requestHostname(request.headers) ??\n        new URL(request.url).hostname,\n      Accept: \"application/json\",\n    };\n    const language = request.headers.get(\"accept-language\");\n    if (language) headers[\"Accept-Language\"] = language;\n\n    const body = request.method === \"GET\" ? undefined : await request.text();\n    if (body) headers[\"Content-Type\"] = \"application/json\";\n\n    let upstream: Response;\n    try {\n      upstream = await fetch(target, { method: request.method, headers, body, cache: \"no-store\" });\n    } catch {\n      return json({ error: { code: \"internal\", message: \"Could not reach Fewchurs.\" } }, 502);\n    }\n\n    const text = await upstream.text();\n    if (upstream.status === 403) logRefusal(text);\n\n    const response = new Response(text, {\n      status: upstream.status,\n      headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n    });\n\n    // A visitor keeps the same id across requests without the browser ever seeing the key,\n    // and an httpOnly cookie means page scripts cannot read or change it either.\n    if (!custom && deviceId !== cookieValue) {\n      response.headers.append(\"Set-Cookie\", serializeCookie(deviceId));\n    }\n\n    return response;\n  }\n\n  return { GET: handle, POST: handle, DELETE: handle };\n}\n\nconst defaultHandler = createHandler();\n\nexport const GET = defaultHandler.GET;\nexport const POST = defaultHandler.POST;\nexport const DELETE = defaultHandler.DELETE;\n\nlet loggedRefusal = false;\n\n/** Visitors only see a safe message, so a live site's server log is where the domain gets named. */\nfunction logRefusal(body: string): void {\n  if (loggedRefusal) return;\n  try {\n    const error = (JSON.parse(body) as { error?: { code?: string; message?: string } }).error;\n    if (error?.code !== \"wrong_app\") return;\n    loggedRefusal = true;\n    console.error(`[fewchurs] ${error.message}`);\n  } catch {\n    // Not JSON, so it isn't a refusal from Fewchurs.\n  }\n}\n\nasync function routePath(\n  request: Request,\n  context: IncomingContext | undefined,\n  apiPath: string,\n): Promise<string> {\n  const params = await context?.params;\n  if (params?.route?.length) return params.route.map(encodeURIComponent).join(\"/\");\n\n  const { pathname } = new URL(request.url);\n  const index = pathname.indexOf(apiPath);\n  return index === -1 ? \"\" : pathname.slice(index + apiPath.length).replace(/^\\//, \"\");\n}\n\n/**\n * The first request from a server-rendered board carries the id the page was rendered with,\n * so adopting it keeps the server's `hasVoted` answers and the browser's in agreement.\n */\nfunction claimedDeviceId(request: Request): string | null {\n  const claimed = request.headers.get(\"x-device-id\");\n  return claimed && DEVICE_ID_PATTERN.test(claimed) ? claimed : null;\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n  const header = request.headers.get(\"cookie\");\n  if (!header) return null;\n  const match = header.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match?.[1] ? decodeURIComponent(match[1]) : null;\n}\n\nfunction serializeCookie(deviceId: string): string {\n  const parts = [\n    `${DEVICE_ID_COOKIE}=${encodeURIComponent(deviceId)}`,\n    \"Path=/\",\n    `Max-Age=${DEVICE_ID_MAX_AGE}`,\n    \"HttpOnly\",\n    \"SameSite=Lax\",\n  ];\n  if (process.env.NODE_ENV === \"production\") parts.push(\"Secure\");\n  return parts.join(\"; \");\n}\n\nfunction json(body: unknown, status: number): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n  });\n}\n","import \"server-only\";\nimport { headers } from \"next/headers\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\n/** A domain set by the developer, which replaces the one read from the request. */\nexport function configuredAppId(appId?: string): string | undefined {\n  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || undefined;\n}\n\n/** The site's host name without a port. A reverse proxy reports the public one in `x-forwarded-host`. */\nexport function requestHostname(requestHeaders: Headers): string | undefined {\n  const forwarded = requestHeaders.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  const host = forwarded || requestHeaders.get(\"host\")?.trim();\n  if (!host) return undefined;\n  try {\n    return new URL(`http://${host}`).hostname;\n  } catch {\n    return undefined;\n  }\n}\n\nexport async function serverClient(\n  deviceId: string | null,\n  config: ServerConfig = {},\n): Promise<FewchursClient> {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n    // Only read the request when needed, so a page with a set domain can still render statically.\n    appId: configuredAppId(config.appId) ?? requestHostname(await headers()),\n  });\n}\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.5.0\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAAA,sBAAO;AACP,IAAAC,eAAuD;;;ACDvD,yBAAO;AACP,qBAAwB;AACxB,kBAA4E;AAErE,IAAM,mBAAmB;AAUzB,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAEO,SAAS,eAAe,SAA0B;AACvD,UAAQ,WAAW,QAAQ,IAAI,qBAAqB,kBAAkB,QAAQ,OAAO,EAAE;AACzF;AAGO,SAAS,gBAAgB,OAAoC;AAClE,SAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,KAAK,KAAK;AACjE;AAGO,SAAS,gBAAgB,gBAA6C;AAC3E,QAAM,YAAY,eAAe,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAC9E,QAAM,OAAO,aAAa,eAAe,IAAI,MAAM,GAAG,KAAK;AAC3D,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,IAAI,EAAE,EAAE;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACxCO,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AH8B7C,IAAM,UAAsD;AAAA,EAC1D,EAAE,QAAQ,OAAO,SAAS,WAAW;AAAA,EACrC,EAAE,QAAQ,OAAO,SAAS,aAAa;AAAA,EACvC,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAAA,EACxC,EAAE,QAAQ,OAAO,SAAS,oBAAoB;AAAA,EAC9C,EAAE,QAAQ,QAAQ,SAAS,0BAA0B;AAAA,EACrD,EAAE,QAAQ,UAAU,SAAS,0BAA0B;AAAA,EACvD,EAAE,QAAQ,QAAQ,SAAS,4BAA4B;AAAA,EACvD,EAAE,QAAQ,UAAU,SAAS,4BAA4B;AAAA,EACzD,EAAE,QAAQ,OAAO,SAAS,8BAA8B;AAAA,EACxD,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAC1C;AAEA,IAAM,oBAAoB;AAEnB,SAAS,cAAc,UAA0B,CAAC,GAIvD;AACA,iBAAe,OAAO,SAAkB,SAA8C;AACpF,UAAM,OAAO,MAAM,UAAU,SAAS,SAAS,eAAe,QAAQ,OAAO,CAAC;AAE9E,QAAI,CAAC,QAAQ,KAAK,CAAC,UAAU,MAAM,WAAW,QAAQ,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG;AACzF,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,SAAS,0BAA0B,EAAE,GAAG,GAAG;AAAA,IACvF;AAEA,UAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,QAAI,CAAC,QAAQ;AACX,cAAQ;AAAA,QACN;AAAA,MACF;AACA,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,oCAAuB,EAAE,GAAG,GAAG;AAAA,IACnF;AAEA,UAAM,cAAc,WAAW,SAAS,gBAAgB;AACxD,UAAM,SAAS,QAAQ,WAAW,MAAM,QAAQ,SAAS,IAAI;AAC7D,UAAM,WAAW,UAAU,eAAe,gBAAgB,OAAO,SAAK,6BAAe;AAErF,UAAM,SAAS,GAAG,eAAe,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,MAAM;AACvF,UAAMC,WAAkC;AAAA,MACtC,eAAe,UAAU,MAAM;AAAA,MAC/B,eAAe;AAAA,MACf,kBAAkB;AAAA,MAClB,qBACE,gBAAgB,QAAQ,KAAK,KAC7B,gBAAgB,QAAQ,OAAO,KAC/B,IAAI,IAAI,QAAQ,GAAG,EAAE;AAAA,MACvB,QAAQ;AAAA,IACV;AACA,UAAM,WAAW,QAAQ,QAAQ,IAAI,iBAAiB;AACtD,QAAI,SAAU,CAAAA,SAAQ,iBAAiB,IAAI;AAE3C,UAAM,OAAO,QAAQ,WAAW,QAAQ,SAAY,MAAM,QAAQ,KAAK;AACvE,QAAI,KAAM,CAAAA,SAAQ,cAAc,IAAI;AAEpC,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,QAAQ,EAAE,QAAQ,QAAQ,QAAQ,SAAAA,UAAS,MAAM,OAAO,WAAW,CAAC;AAAA,IAC7F,QAAQ;AACN,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,4BAA4B,EAAE,GAAG,GAAG;AAAA,IACxF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,SAAS,WAAW,IAAK,YAAW,IAAI;AAE5C,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ,SAAS;AAAA,MACjB,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,IAC7E,CAAC;AAID,QAAI,CAAC,UAAU,aAAa,aAAa;AACvC,eAAS,QAAQ,OAAO,cAAc,gBAAgB,QAAQ,CAAC;AAAA,IACjE;AAEA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,OAAO;AACrD;AAEA,IAAM,iBAAiB,cAAc;AAE9B,IAAM,MAAM,eAAe;AAC3B,IAAM,OAAO,eAAe;AAC5B,IAAM,SAAS,eAAe;AAErC,IAAI,gBAAgB;AAGpB,SAAS,WAAW,MAAoB;AACtC,MAAI,cAAe;AACnB,MAAI;AACF,UAAM,QAAS,KAAK,MAAM,IAAI,EAAsD;AACpF,QAAI,OAAO,SAAS,YAAa;AACjC,oBAAgB;AAChB,YAAQ,MAAM,cAAc,MAAM,OAAO,EAAE;AAAA,EAC7C,QAAQ;AAAA,EAER;AACF;AAEA,eAAe,UACb,SACA,SACA,SACiB;AACjB,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,QAAQ,OAAO,OAAQ,QAAO,OAAO,MAAM,IAAI,kBAAkB,EAAE,KAAK,GAAG;AAE/E,QAAM,EAAE,SAAS,IAAI,IAAI,IAAI,QAAQ,GAAG;AACxC,QAAM,QAAQ,SAAS,QAAQ,OAAO;AACtC,SAAO,UAAU,KAAK,KAAK,SAAS,MAAM,QAAQ,QAAQ,MAAM,EAAE,QAAQ,OAAO,EAAE;AACrF;AAMA,SAAS,gBAAgB,SAAiC;AACxD,QAAM,UAAU,QAAQ,QAAQ,IAAI,aAAa;AACjD,SAAO,WAAW,kBAAkB,KAAK,OAAO,IAAI,UAAU;AAChE;AAEA,SAAS,WAAW,SAAkB,MAA6B;AACjE,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACnE,SAAO,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACrD;AAEA,SAAS,gBAAgB,UAA0B;AACjD,QAAM,QAAQ;AAAA,IACZ,GAAG,gBAAgB,IAAI,mBAAmB,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,WAAW,iBAAiB;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,aAAa,aAAc,OAAM,KAAK,QAAQ;AAC9D,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,KAAK,MAAe,QAA0B;AACrD,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,EAC7E,CAAC;AACH;","names":["import_server_only","import_core","headers"]}

package/dist/handler.mjs

@@ -3,8 +3,8 @@ import {
   GET,
   POST,
   createHandler
-} from "./chunk-SFNYZN24.mjs";
-import "./chunk-WUW57LPF.mjs";
+} from "./chunk-DCIL2IC4.mjs";
+import "./chunk-F4BPXSKD.mjs";
 export {
   DELETE,
   GET,

package/dist/identity.js

@@ -33,7 +33,7 @@ var import_headers = require("next/headers");
 var import_core = require("@fewchurs/react/core");
 
 // src/version.ts
-var SDK_VERSION = "1.3.0";
+var SDK_VERSION = "1.5.0";
 
 // src/constants.ts
 var DEVICE_ID_COOKIE = "fewchurs_did";

package/dist/identity.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/identity.ts","../src/version.ts","../src/constants.ts"],"sourcesContent":["import \"server-only\";\nimport { cookies } from \"next/headers\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE } from \"./constants\";\n\nexport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE };\n\nexport type DeviceIdResolver = () => string | Promise<string>;\n\n/** The visitor's id, or null when nothing has been stored for them yet. */\nexport async function readDeviceId(): Promise<string | null> {\n  const store = await cookies();\n  return store.get(DEVICE_ID_COOKIE)?.value ?? null;\n}\n\n/**\n * Reads the cookie, falling back to a fresh id. The value is not persisted here: a server\n * component cannot set cookies, so the route handler stores it on the first request instead.\n */\nexport async function resolveDeviceId(custom?: DeviceIdResolver): Promise<string> {\n  if (custom) return custom();\n  return (await readDeviceId()) ?? createDeviceId();\n}\n\nexport function deviceIdCookie(deviceId: string): {\n  name: string;\n  value: string;\n  options: {\n    httpOnly: true;\n    sameSite: \"lax\";\n    path: string;\n    maxAge: number;\n    secure: boolean;\n  };\n} {\n  return {\n    name: DEVICE_ID_COOKIE,\n    value: deviceId,\n    options: {\n      httpOnly: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: DEVICE_ID_MAX_AGE,\n      secure: process.env.NODE_ENV === \"production\",\n    },\n  };\n}\n\nexport { createDeviceId };\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.3.0\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAAO;AACP,qBAAwB;AACxB,kBAA+B;;;ACDxB,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AFK7C,eAAsB,eAAuC;AAC3D,QAAM,QAAQ,UAAM,wBAAQ;AAC5B,SAAO,MAAM,IAAI,gBAAgB,GAAG,SAAS;AAC/C;AAMA,eAAsB,gBAAgB,QAA4C;AAChF,MAAI,OAAQ,QAAO,OAAO;AAC1B,SAAQ,MAAM,aAAa,SAAM,4BAAe;AAClD;AAEO,SAAS,eAAe,UAU7B;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SAAS;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,MACV,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/identity.ts","../src/version.ts","../src/constants.ts"],"sourcesContent":["import \"server-only\";\nimport { cookies } from \"next/headers\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE } from \"./constants\";\n\nexport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE };\n\nexport type DeviceIdResolver = () => string | Promise<string>;\n\n/** The visitor's id, or null when nothing has been stored for them yet. */\nexport async function readDeviceId(): Promise<string | null> {\n  const store = await cookies();\n  return store.get(DEVICE_ID_COOKIE)?.value ?? null;\n}\n\n/**\n * Reads the cookie, falling back to a fresh id. The value is not persisted here: a server\n * component cannot set cookies, so the route handler stores it on the first request instead.\n */\nexport async function resolveDeviceId(custom?: DeviceIdResolver): Promise<string> {\n  if (custom) return custom();\n  return (await readDeviceId()) ?? createDeviceId();\n}\n\nexport function deviceIdCookie(deviceId: string): {\n  name: string;\n  value: string;\n  options: {\n    httpOnly: true;\n    sameSite: \"lax\";\n    path: string;\n    maxAge: number;\n    secure: boolean;\n  };\n} {\n  return {\n    name: DEVICE_ID_COOKIE,\n    value: deviceId,\n    options: {\n      httpOnly: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: DEVICE_ID_MAX_AGE,\n      secure: process.env.NODE_ENV === \"production\",\n    },\n  };\n}\n\nexport { createDeviceId };\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.5.0\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAAO;AACP,qBAAwB;AACxB,kBAA+B;;;ACDxB,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AFK7C,eAAsB,eAAuC;AAC3D,QAAM,QAAQ,UAAM,wBAAQ;AAC5B,SAAO,MAAM,IAAI,gBAAgB,GAAG,SAAS;AAC/C;AAMA,eAAsB,gBAAgB,QAA4C;AAChF,MAAI,OAAQ,QAAO,OAAO;AAC1B,SAAQ,MAAM,aAAa,SAAM,4BAAe;AAClD;AAEO,SAAS,eAAe,UAU7B;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SAAS;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,MACV,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}

package/dist/identity.mjs

@@ -3,11 +3,11 @@ import {
   deviceIdCookie,
   readDeviceId,
   resolveDeviceId
-} from "./chunk-B4TL4JIY.mjs";
+} from "./chunk-MIJLYYIN.mjs";
 import {
   DEVICE_ID_COOKIE,
   DEVICE_ID_MAX_AGE
-} from "./chunk-WUW57LPF.mjs";
+} from "./chunk-F4BPXSKD.mjs";
 export {
   DEVICE_ID_COOKIE,
   DEVICE_ID_MAX_AGE,

package/dist/index.js

@@ -85,7 +85,7 @@ var import_headers2 = require("next/headers");
 var import_core2 = require("@fewchurs/react/core");
 
 // src/version.ts
-var SDK_VERSION = "1.3.0";
+var SDK_VERSION = "1.5.0";
 
 // src/constants.ts
 var DEVICE_ID_COOKIE = "fewchurs_did";
@@ -114,6 +114,9 @@ async function FewchursBoard({
   ...board
 }) {
   const deviceId = await resolveDeviceId(deviceIdOption);
+  if (!resolveApiKey(apiKey)) {
+    return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_react.FewchursProvider, { deviceId, pageSize: board.pageSize ?? 20, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_react.FewchursBoard, { ...board }) });
+  }
   const client = await serverClient(deviceId, { apiKey, baseUrl, language, appId });
   const tab = board.defaultTab ?? board.tabs?.[0] ?? "top";
   const sort = tab === "roadmap" ? "top" : tab;
@@ -205,7 +208,7 @@ function createHandler(options = {}) {
       console.error(
         "[fewchurs] No API key. Set FEWCHURS_API_KEY, or pass apiKey to createHandler()."
       );
-      return json({ error: { code: "internal", message: "Fewchurs is not configured." } }, 500);
+      return json({ error: { code: "internal", message: import_core4.NOT_CONFIGURED_MESSAGE } }, 500);
     }
     const cookieValue = readCookie(request, DEVICE_ID_COOKIE);
     const custom = options.deviceId ? await options.deviceId() : null;

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/board.tsx","../src/config.ts","../src/identity.ts","../src/version.ts","../src/constants.ts","../src/button.tsx","../src/handler.ts"],"sourcesContent":["export { FewchursBoard } from \"./board\";\nexport type { FewchursBoardProps } from \"./board\";\nexport { FewchursButton } from \"./button\";\nexport type { FewchursButtonProps } from \"./button\";\nexport { createHandler } from \"./handler\";\nexport type { HandlerOptions, RouteHandler } from \"./handler\";\nexport { DEVICE_ID_COOKIE, readDeviceId, resolveDeviceId } from \"./identity\";\nexport type { DeviceIdResolver } from \"./identity\";\nexport { DEFAULT_API_PATH } from \"./config\";\nexport type { ServerConfig } from \"./config\";\n\nexport type {\n  Comment,\n  CommentPage,\n  Feature,\n  FeaturePage,\n  FeatureSort,\n  FeatureStatus,\n  FewchursConfig,\n  FewchursError,\n} from \"@fewchurs/react/core\";\n","import \"server-only\";\nimport { FewchursBoard as ClientBoard, FewchursProvider } from \"@fewchurs/react\";\nimport type { FewchursBoardProps as ClientBoardProps } from \"@fewchurs/react\";\nimport {\n  featureKey,\n  listKey,\n  ROADMAP_STATUSES,\n  type FeatureSort,\n  type StoreState,\n} from \"@fewchurs/react/core\";\nimport { resolveApiPath, serverClient } from \"./config\";\nimport { resolveDeviceId, type DeviceIdResolver } from \"./identity\";\n\n/** Function props cannot cross the server/client boundary — compose in your own client file. */\ntype SerializableBoardProps = Omit<\n  ClientBoardProps,\n  \"renderHeader\" | \"renderEmpty\" | \"renderFeature\" | \"children\"\n>;\n\nexport interface FewchursBoardProps extends SerializableBoardProps {\n  /** Defaults to `process.env.FEWCHURS_API_KEY`. Never reaches the browser. */\n  apiKey?: string;\n  baseUrl?: string;\n  /** Where your route handler is mounted. Defaults to `/api/fewchurs`. */\n  apiPath?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n  deviceId?: DeviceIdResolver;\n}\n\nexport async function FewchursBoard({\n  apiKey,\n  baseUrl,\n  apiPath,\n  language,\n  appId,\n  deviceId: deviceIdOption,\n  ...board\n}: FewchursBoardProps): Promise<React.JSX.Element> {\n  const deviceId = await resolveDeviceId(deviceIdOption);\n  const client = await serverClient(deviceId, { apiKey, baseUrl, language, appId });\n\n  const tab = board.defaultTab ?? board.tabs?.[0] ?? \"top\";\n  const sort: FeatureSort = tab === \"roadmap\" ? \"top\" : tab;\n  const status = tab === \"roadmap\" ? ROADMAP_STATUSES : undefined;\n  const pageSize = board.pageSize ?? 20;\n\n  const [config, page, pinned] = await Promise.all([\n    client.getConfig(),\n    client.listFeatures({ sort, status, limit: pageSize }),\n    board.initialFeatureId ? client.getFeature(board.initialFeatureId) : null,\n  ]);\n\n  // Seeded under the same key the client hook will ask for, so the first paint is the\n  // rendered HTML and no second request goes out just to fetch what is already there.\n  const lists: StoreState[\"lists\"] = {};\n  if (page.ok) {\n    lists[listKey({ sort, status })] = {\n      features: page.data.features,\n      cursor: page.data.nextCursor,\n      status: \"ready\",\n      error: null,\n    };\n  }\n  // A deep-linked request is rendered on the server too, so the link lands on real content.\n  if (board.initialFeatureId && pinned?.ok) {\n    lists[featureKey(board.initialFeatureId)] = {\n      features: [pinned.data],\n      cursor: null,\n      status: \"ready\",\n      error: null,\n    };\n  }\n\n  const initialState: Partial<StoreState> = {\n    config: config.ok ? config.data : null,\n    lists,\n  };\n\n  return (\n    <FewchursProvider\n      baseUrl={resolveApiPath(apiPath)}\n      deviceId={deviceId}\n      pageSize={pageSize}\n      initialState={initialState}\n    >\n      <ClientBoard {...board} />\n    </FewchursProvider>\n  );\n}\n","import \"server-only\";\nimport { headers } from \"next/headers\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\n/** A domain set by the developer, which replaces the one read from the request. */\nexport function configuredAppId(appId?: string): string | undefined {\n  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || undefined;\n}\n\n/** The site's host name without a port. A reverse proxy reports the public one in `x-forwarded-host`. */\nexport function requestHostname(requestHeaders: Headers): string | undefined {\n  const forwarded = requestHeaders.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  const host = forwarded || requestHeaders.get(\"host\")?.trim();\n  if (!host) return undefined;\n  try {\n    return new URL(`http://${host}`).hostname;\n  } catch {\n    return undefined;\n  }\n}\n\nexport async function serverClient(\n  deviceId: string | null,\n  config: ServerConfig = {},\n): Promise<FewchursClient> {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n    // Only read the request when needed, so a page with a set domain can still render statically.\n    appId: configuredAppId(config.appId) ?? requestHostname(await headers()),\n  });\n}\n","import \"server-only\";\nimport { cookies } from \"next/headers\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE } from \"./constants\";\n\nexport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE };\n\nexport type DeviceIdResolver = () => string | Promise<string>;\n\n/** The visitor's id, or null when nothing has been stored for them yet. */\nexport async function readDeviceId(): Promise<string | null> {\n  const store = await cookies();\n  return store.get(DEVICE_ID_COOKIE)?.value ?? null;\n}\n\n/**\n * Reads the cookie, falling back to a fresh id. The value is not persisted here: a server\n * component cannot set cookies, so the route handler stores it on the first request instead.\n */\nexport async function resolveDeviceId(custom?: DeviceIdResolver): Promise<string> {\n  if (custom) return custom();\n  return (await readDeviceId()) ?? createDeviceId();\n}\n\nexport function deviceIdCookie(deviceId: string): {\n  name: string;\n  value: string;\n  options: {\n    httpOnly: true;\n    sameSite: \"lax\";\n    path: string;\n    maxAge: number;\n    secure: boolean;\n  };\n} {\n  return {\n    name: DEVICE_ID_COOKIE,\n    value: deviceId,\n    options: {\n      httpOnly: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: DEVICE_ID_MAX_AGE,\n      secure: process.env.NODE_ENV === \"production\",\n    },\n  };\n}\n\nexport { createDeviceId };\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.3.0\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n","import \"server-only\";\nimport { FewchursButton as ClientButton, FewchursProvider } from \"@fewchurs/react\";\nimport type { FewchursButtonProps as ClientButtonProps } from \"@fewchurs/react\";\nimport { resolveApiPath } from \"./config\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface FewchursButtonProps extends Omit<\n  ClientButtonProps,\n  \"renderHeader\" | \"renderEmpty\" | \"renderFeature\"\n> {\n  apiPath?: string;\n  language?: string;\n  deviceId?: DeviceIdResolver;\n}\n\nexport async function FewchursButton({\n  apiPath,\n  language,\n  deviceId,\n  ...button\n}: FewchursButtonProps): Promise<React.JSX.Element> {\n  return (\n    <FewchursProvider\n      baseUrl={resolveApiPath(apiPath)}\n      language={language}\n      deviceId={deviceId ? await deviceId() : undefined}\n    >\n      <ClientButton {...button} />\n    </FewchursProvider>\n  );\n}\n","import \"server-only\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport {\n  configuredAppId,\n  requestHostname,\n  resolveApiKey,\n  resolveApiPath,\n  resolveBaseUrl,\n} from \"./config\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE, SDK_HEADER } from \"./constants\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface HandlerOptions {\n  apiKey?: string;\n  baseUrl?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n  /** Where the handler is mounted, when it is not `/api/fewchurs`. */\n  apiPath?: string;\n  /** Return a stable, hashed id for the signed-in visitor so votes follow the account. */\n  deviceId?: DeviceIdResolver;\n}\n\ntype RouteParams = { route?: string[] };\n\n/** What Next passes: a Promise in 15, a plain object in 14. Both are awaited the same way. */\ntype IncomingContext = { params?: RouteParams | Promise<RouteParams> };\n\n// Next 15's route check wants a required second argument whose `params` is a Promise. The\n// handler itself takes `IncomingContext`, so Next 14's plain object still works at runtime.\ntype RouteContext = { params: Promise<RouteParams> };\n\nexport type RouteHandler = (request: Request, context: RouteContext) => Promise<Response>;\n\n/** Only the endpoints the board needs: everything else is a 404, not a proxy to the API. */\nconst ALLOWED: Array<{ method: string; pattern: RegExp }> = [\n  { method: \"GET\", pattern: /^config$/ },\n  { method: \"GET\", pattern: /^features$/ },\n  { method: \"POST\", pattern: /^features$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+\\/comments$/ },\n  { method: \"POST\", pattern: /^comments$/ },\n];\n\nconst DEVICE_ID_PATTERN = /^[A-Za-z0-9_-]{8,128}$/;\n\nexport function createHandler(options: HandlerOptions = {}): {\n  GET: RouteHandler;\n  POST: RouteHandler;\n  DELETE: RouteHandler;\n} {\n  async function handle(request: Request, context?: IncomingContext): Promise<Response> {\n    const path = await routePath(request, context, resolveApiPath(options.apiPath));\n\n    if (!ALLOWED.some((route) => route.method === request.method && route.pattern.test(path))) {\n      return json({ error: { code: \"not_found\", message: \"Unknown Fewchurs route.\" } }, 404);\n    }\n\n    const apiKey = resolveApiKey(options.apiKey);\n    if (!apiKey) {\n      console.error(\n        \"[fewchurs] No API key. Set FEWCHURS_API_KEY, or pass apiKey to createHandler().\",\n      );\n      return json({ error: { code: \"internal\", message: \"Fewchurs is not configured.\" } }, 500);\n    }\n\n    const cookieValue = readCookie(request, DEVICE_ID_COOKIE);\n    const custom = options.deviceId ? await options.deviceId() : null;\n    const deviceId = custom ?? cookieValue ?? claimedDeviceId(request) ?? createDeviceId();\n\n    const target = `${resolveBaseUrl(options.baseUrl)}/${path}${new URL(request.url).search}`;\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${apiKey}`,\n      \"X-Device-Id\": deviceId,\n      \"X-Fewchurs-Sdk\": SDK_HEADER,\n      \"X-Fewchurs-App-Id\":\n        configuredAppId(options.appId) ??\n        requestHostname(request.headers) ??\n        new URL(request.url).hostname,\n      Accept: \"application/json\",\n    };\n    const language = request.headers.get(\"accept-language\");\n    if (language) headers[\"Accept-Language\"] = language;\n\n    const body = request.method === \"GET\" ? undefined : await request.text();\n    if (body) headers[\"Content-Type\"] = \"application/json\";\n\n    let upstream: Response;\n    try {\n      upstream = await fetch(target, { method: request.method, headers, body, cache: \"no-store\" });\n    } catch {\n      return json({ error: { code: \"internal\", message: \"Could not reach Fewchurs.\" } }, 502);\n    }\n\n    const text = await upstream.text();\n    if (upstream.status === 403) logRefusal(text);\n\n    const response = new Response(text, {\n      status: upstream.status,\n      headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n    });\n\n    // A visitor keeps the same id across requests without the browser ever seeing the key,\n    // and an httpOnly cookie means page scripts cannot read or change it either.\n    if (!custom && deviceId !== cookieValue) {\n      response.headers.append(\"Set-Cookie\", serializeCookie(deviceId));\n    }\n\n    return response;\n  }\n\n  return { GET: handle, POST: handle, DELETE: handle };\n}\n\nconst defaultHandler = createHandler();\n\nexport const GET = defaultHandler.GET;\nexport const POST = defaultHandler.POST;\nexport const DELETE = defaultHandler.DELETE;\n\nlet loggedRefusal = false;\n\n/** Visitors only see a safe message, so a live site's server log is where the domain gets named. */\nfunction logRefusal(body: string): void {\n  if (loggedRefusal) return;\n  try {\n    const error = (JSON.parse(body) as { error?: { code?: string; message?: string } }).error;\n    if (error?.code !== \"wrong_app\") return;\n    loggedRefusal = true;\n    console.error(`[fewchurs] ${error.message}`);\n  } catch {\n    // Not JSON, so it isn't a refusal from Fewchurs.\n  }\n}\n\nasync function routePath(\n  request: Request,\n  context: IncomingContext | undefined,\n  apiPath: string,\n): Promise<string> {\n  const params = await context?.params;\n  if (params?.route?.length) return params.route.map(encodeURIComponent).join(\"/\");\n\n  const { pathname } = new URL(request.url);\n  const index = pathname.indexOf(apiPath);\n  return index === -1 ? \"\" : pathname.slice(index + apiPath.length).replace(/^\\//, \"\");\n}\n\n/**\n * The first request from a server-rendered board carries the id the page was rendered with,\n * so adopting it keeps the server's `hasVoted` answers and the browser's in agreement.\n */\nfunction claimedDeviceId(request: Request): string | null {\n  const claimed = request.headers.get(\"x-device-id\");\n  return claimed && DEVICE_ID_PATTERN.test(claimed) ? claimed : null;\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n  const header = request.headers.get(\"cookie\");\n  if (!header) return null;\n  const match = header.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match?.[1] ? decodeURIComponent(match[1]) : null;\n}\n\nfunction serializeCookie(deviceId: string): string {\n  const parts = [\n    `${DEVICE_ID_COOKIE}=${encodeURIComponent(deviceId)}`,\n    \"Path=/\",\n    `Max-Age=${DEVICE_ID_MAX_AGE}`,\n    \"HttpOnly\",\n    \"SameSite=Lax\",\n  ];\n  if (process.env.NODE_ENV === \"production\") parts.push(\"Secure\");\n  return parts.join(\"; \");\n}\n\nfunction json(body: unknown, status: number): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,sBAAO;AACP,mBAA+D;AAE/D,IAAAC,eAMO;;;ACTP,yBAAO;AACP,qBAAwB;AACxB,kBAA4E;AAErE,IAAM,mBAAmB;AAUzB,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAEO,SAAS,eAAe,SAA0B;AACvD,UAAQ,WAAW,QAAQ,IAAI,qBAAqB,kBAAkB,QAAQ,OAAO,EAAE;AACzF;AAGO,SAAS,gBAAgB,OAAoC;AAClE,SAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,KAAK,KAAK;AACjE;AAGO,SAAS,gBAAgB,gBAA6C;AAC3E,QAAM,YAAY,eAAe,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAC9E,QAAM,OAAO,aAAa,eAAe,IAAI,MAAM,GAAG,KAAK;AAC3D,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,IAAI,EAAE,EAAE;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,aACpB,UACA,SAAuB,CAAC,GACC;AACzB,QAAM,SAAS,cAAc,OAAO,MAAM;AAC1C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,aAAO,kCAAqB;AAAA,IAC1B;AAAA,IACA,SAAS,eAAe,OAAO,OAAO;AAAA,IACtC;AAAA,IACA,UAAU,OAAO;AAAA;AAAA,IAEjB,OAAO,gBAAgB,OAAO,KAAK,KAAK,gBAAgB,UAAM,wBAAQ,CAAC;AAAA,EACzE,CAAC;AACH;;;AC9DA,IAAAC,sBAAO;AACP,IAAAC,kBAAwB;AACxB,IAAAC,eAA+B;;;ACDxB,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AFK7C,eAAsB,eAAuC;AAC3D,QAAM,QAAQ,UAAM,yBAAQ;AAC5B,SAAO,MAAM,IAAI,gBAAgB,GAAG,SAAS;AAC/C;AAMA,eAAsB,gBAAgB,QAA4C;AAChF,MAAI,OAAQ,QAAO,OAAO;AAC1B,SAAQ,MAAM,aAAa,SAAM,6BAAe;AAClD;;;AFiEM;AAxDN,eAAsB,cAAc;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV,GAAG;AACL,GAAmD;AACjD,QAAM,WAAW,MAAM,gBAAgB,cAAc;AACrD,QAAM,SAAS,MAAM,aAAa,UAAU,EAAE,QAAQ,SAAS,UAAU,MAAM,CAAC;AAEhF,QAAM,MAAM,MAAM,cAAc,MAAM,OAAO,CAAC,KAAK;AACnD,QAAM,OAAoB,QAAQ,YAAY,QAAQ;AACtD,QAAM,SAAS,QAAQ,YAAY,gCAAmB;AACtD,QAAM,WAAW,MAAM,YAAY;AAEnC,QAAM,CAAC,QAAQ,MAAM,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC/C,OAAO,UAAU;AAAA,IACjB,OAAO,aAAa,EAAE,MAAM,QAAQ,OAAO,SAAS,CAAC;AAAA,IACrD,MAAM,mBAAmB,OAAO,WAAW,MAAM,gBAAgB,IAAI;AAAA,EACvE,CAAC;AAID,QAAM,QAA6B,CAAC;AACpC,MAAI,KAAK,IAAI;AACX,cAAM,sBAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,IAAI;AAAA,MACjC,UAAU,KAAK,KAAK;AAAA,MACpB,QAAQ,KAAK,KAAK;AAAA,MAClB,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,MAAM,oBAAoB,QAAQ,IAAI;AACxC,cAAM,yBAAW,MAAM,gBAAgB,CAAC,IAAI;AAAA,MAC1C,UAAU,CAAC,OAAO,IAAI;AAAA,MACtB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,eAAoC;AAAA,IACxC,QAAQ,OAAO,KAAK,OAAO,OAAO;AAAA,IAClC;AAAA,EACF;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS,eAAe,OAAO;AAAA,MAC/B;AAAA,MACA;AAAA,MACA;AAAA,MAEA,sDAAC,aAAAC,eAAA,EAAa,GAAG,OAAO;AAAA;AAAA,EAC1B;AAEJ;;;AK1FA,IAAAC,sBAAO;AACP,IAAAC,gBAAiE;AA0B3D,IAAAC,sBAAA;AAZN,eAAsB,eAAe;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,GAAoD;AAClD,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS,eAAe,OAAO;AAAA,MAC/B;AAAA,MACA,UAAU,WAAW,MAAM,SAAS,IAAI;AAAA,MAExC,uDAAC,cAAAC,gBAAA,EAAc,GAAG,QAAQ;AAAA;AAAA,EAC5B;AAEJ;;;AC9BA,IAAAC,sBAAO;AACP,IAAAC,eAA+B;AAkC/B,IAAM,UAAsD;AAAA,EAC1D,EAAE,QAAQ,OAAO,SAAS,WAAW;AAAA,EACrC,EAAE,QAAQ,OAAO,SAAS,aAAa;AAAA,EACvC,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAAA,EACxC,EAAE,QAAQ,OAAO,SAAS,oBAAoB;AAAA,EAC9C,EAAE,QAAQ,QAAQ,SAAS,0BAA0B;AAAA,EACrD,EAAE,QAAQ,UAAU,SAAS,0BAA0B;AAAA,EACvD,EAAE,QAAQ,QAAQ,SAAS,4BAA4B;AAAA,EACvD,EAAE,QAAQ,UAAU,SAAS,4BAA4B;AAAA,EACzD,EAAE,QAAQ,OAAO,SAAS,8BAA8B;AAAA,EACxD,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAC1C;AAEA,IAAM,oBAAoB;AAEnB,SAAS,cAAc,UAA0B,CAAC,GAIvD;AACA,iBAAe,OAAO,SAAkB,SAA8C;AACpF,UAAM,OAAO,MAAM,UAAU,SAAS,SAAS,eAAe,QAAQ,OAAO,CAAC;AAE9E,QAAI,CAAC,QAAQ,KAAK,CAAC,UAAU,MAAM,WAAW,QAAQ,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG;AACzF,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,SAAS,0BAA0B,EAAE,GAAG,GAAG;AAAA,IACvF;AAEA,UAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,QAAI,CAAC,QAAQ;AACX,cAAQ;AAAA,QACN;AAAA,MACF;AACA,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,8BAA8B,EAAE,GAAG,GAAG;AAAA,IAC1F;AAEA,UAAM,cAAc,WAAW,SAAS,gBAAgB;AACxD,UAAM,SAAS,QAAQ,WAAW,MAAM,QAAQ,SAAS,IAAI;AAC7D,UAAM,WAAW,UAAU,eAAe,gBAAgB,OAAO,SAAK,6BAAe;AAErF,UAAM,SAAS,GAAG,eAAe,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,MAAM;AACvF,UAAMC,WAAkC;AAAA,MACtC,eAAe,UAAU,MAAM;AAAA,MAC/B,eAAe;AAAA,MACf,kBAAkB;AAAA,MAClB,qBACE,gBAAgB,QAAQ,KAAK,KAC7B,gBAAgB,QAAQ,OAAO,KAC/B,IAAI,IAAI,QAAQ,GAAG,EAAE;AAAA,MACvB,QAAQ;AAAA,IACV;AACA,UAAM,WAAW,QAAQ,QAAQ,IAAI,iBAAiB;AACtD,QAAI,SAAU,CAAAA,SAAQ,iBAAiB,IAAI;AAE3C,UAAM,OAAO,QAAQ,WAAW,QAAQ,SAAY,MAAM,QAAQ,KAAK;AACvE,QAAI,KAAM,CAAAA,SAAQ,cAAc,IAAI;AAEpC,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,QAAQ,EAAE,QAAQ,QAAQ,QAAQ,SAAAA,UAAS,MAAM,OAAO,WAAW,CAAC;AAAA,IAC7F,QAAQ;AACN,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,4BAA4B,EAAE,GAAG,GAAG;AAAA,IACxF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,SAAS,WAAW,IAAK,YAAW,IAAI;AAE5C,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ,SAAS;AAAA,MACjB,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,IAC7E,CAAC;AAID,QAAI,CAAC,UAAU,aAAa,aAAa;AACvC,eAAS,QAAQ,OAAO,cAAc,gBAAgB,QAAQ,CAAC;AAAA,IACjE;AAEA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,OAAO;AACrD;AAEA,IAAM,iBAAiB,cAAc;AAE9B,IAAM,MAAM,eAAe;AAC3B,IAAM,OAAO,eAAe;AAC5B,IAAM,SAAS,eAAe;AAErC,IAAI,gBAAgB;AAGpB,SAAS,WAAW,MAAoB;AACtC,MAAI,cAAe;AACnB,MAAI;AACF,UAAM,QAAS,KAAK,MAAM,IAAI,EAAsD;AACpF,QAAI,OAAO,SAAS,YAAa;AACjC,oBAAgB;AAChB,YAAQ,MAAM,cAAc,MAAM,OAAO,EAAE;AAAA,EAC7C,QAAQ;AAAA,EAER;AACF;AAEA,eAAe,UACb,SACA,SACA,SACiB;AACjB,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,QAAQ,OAAO,OAAQ,QAAO,OAAO,MAAM,IAAI,kBAAkB,EAAE,KAAK,GAAG;AAE/E,QAAM,EAAE,SAAS,IAAI,IAAI,IAAI,QAAQ,GAAG;AACxC,QAAM,QAAQ,SAAS,QAAQ,OAAO;AACtC,SAAO,UAAU,KAAK,KAAK,SAAS,MAAM,QAAQ,QAAQ,MAAM,EAAE,QAAQ,OAAO,EAAE;AACrF;AAMA,SAAS,gBAAgB,SAAiC;AACxD,QAAM,UAAU,QAAQ,QAAQ,IAAI,aAAa;AACjD,SAAO,WAAW,kBAAkB,KAAK,OAAO,IAAI,UAAU;AAChE;AAEA,SAAS,WAAW,SAAkB,MAA6B;AACjE,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACnE,SAAO,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACrD;AAEA,SAAS,gBAAgB,UAA0B;AACjD,QAAM,QAAQ;AAAA,IACZ,GAAG,gBAAgB,IAAI,mBAAmB,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,WAAW,iBAAiB;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,aAAa,aAAc,OAAM,KAAK,QAAQ;AAC9D,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,KAAK,MAAe,QAA0B;AACrD,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,EAC7E,CAAC;AACH;","names":["import_server_only","import_core","import_server_only","import_headers","import_core","ClientBoard","import_server_only","import_react","import_jsx_runtime","ClientButton","import_server_only","import_core","headers"]}
+{"version":3,"sources":["../src/index.ts","../src/board.tsx","../src/config.ts","../src/identity.ts","../src/version.ts","../src/constants.ts","../src/button.tsx","../src/handler.ts"],"sourcesContent":["export { FewchursBoard } from \"./board\";\nexport type { FewchursBoardProps } from \"./board\";\nexport { FewchursButton } from \"./button\";\nexport type { FewchursButtonProps } from \"./button\";\nexport { createHandler } from \"./handler\";\nexport type { HandlerOptions, RouteHandler } from \"./handler\";\nexport { DEVICE_ID_COOKIE, readDeviceId, resolveDeviceId } from \"./identity\";\nexport type { DeviceIdResolver } from \"./identity\";\nexport { DEFAULT_API_PATH } from \"./config\";\nexport type { ServerConfig } from \"./config\";\n\nexport type {\n  Comment,\n  CommentPage,\n  Feature,\n  FeaturePage,\n  FeatureSort,\n  FeatureStatus,\n  FewchursConfig,\n  FewchursError,\n} from \"@fewchurs/react/core\";\n","import \"server-only\";\nimport { FewchursBoard as ClientBoard, FewchursProvider } from \"@fewchurs/react\";\nimport type { FewchursBoardProps as ClientBoardProps } from \"@fewchurs/react\";\nimport {\n  featureKey,\n  listKey,\n  ROADMAP_STATUSES,\n  type FeatureSort,\n  type StoreState,\n} from \"@fewchurs/react/core\";\nimport { resolveApiKey, resolveApiPath, serverClient } from \"./config\";\nimport { resolveDeviceId, type DeviceIdResolver } from \"./identity\";\n\n/** Function props cannot cross the server/client boundary — compose in your own client file. */\ntype SerializableBoardProps = Omit<\n  ClientBoardProps,\n  \"renderHeader\" | \"renderEmpty\" | \"renderFeature\" | \"children\"\n>;\n\nexport interface FewchursBoardProps extends SerializableBoardProps {\n  /** Defaults to `process.env.FEWCHURS_API_KEY`. Never reaches the browser. */\n  apiKey?: string;\n  baseUrl?: string;\n  /** Where your route handler is mounted. Defaults to `/api/fewchurs`. */\n  apiPath?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n  deviceId?: DeviceIdResolver;\n}\n\nexport async function FewchursBoard({\n  apiKey,\n  baseUrl,\n  apiPath,\n  language,\n  appId,\n  deviceId: deviceIdOption,\n  ...board\n}: FewchursBoardProps): Promise<React.JSX.Element> {\n  const deviceId = await resolveDeviceId(deviceIdOption);\n\n  if (!resolveApiKey(apiKey)) {\n    return (\n      <FewchursProvider deviceId={deviceId} pageSize={board.pageSize ?? 20}>\n        <ClientBoard {...board} />\n      </FewchursProvider>\n    );\n  }\n\n  const client = await serverClient(deviceId, { apiKey, baseUrl, language, appId });\n\n  const tab = board.defaultTab ?? board.tabs?.[0] ?? \"top\";\n  const sort: FeatureSort = tab === \"roadmap\" ? \"top\" : tab;\n  const status = tab === \"roadmap\" ? ROADMAP_STATUSES : undefined;\n  const pageSize = board.pageSize ?? 20;\n\n  const [config, page, pinned] = await Promise.all([\n    client.getConfig(),\n    client.listFeatures({ sort, status, limit: pageSize }),\n    board.initialFeatureId ? client.getFeature(board.initialFeatureId) : null,\n  ]);\n\n  // Seeded under the same key the client hook will ask for, so the first paint is the\n  // rendered HTML and no second request goes out just to fetch what is already there.\n  const lists: StoreState[\"lists\"] = {};\n  if (page.ok) {\n    lists[listKey({ sort, status })] = {\n      features: page.data.features,\n      cursor: page.data.nextCursor,\n      status: \"ready\",\n      error: null,\n    };\n  }\n  // A deep-linked request is rendered on the server too, so the link lands on real content.\n  if (board.initialFeatureId && pinned?.ok) {\n    lists[featureKey(board.initialFeatureId)] = {\n      features: [pinned.data],\n      cursor: null,\n      status: \"ready\",\n      error: null,\n    };\n  }\n\n  const initialState: Partial<StoreState> = {\n    config: config.ok ? config.data : null,\n    lists,\n  };\n\n  return (\n    <FewchursProvider\n      baseUrl={resolveApiPath(apiPath)}\n      deviceId={deviceId}\n      pageSize={pageSize}\n      initialState={initialState}\n    >\n      <ClientBoard {...board} />\n    </FewchursProvider>\n  );\n}\n","import \"server-only\";\nimport { headers } from \"next/headers\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\n/** A domain set by the developer, which replaces the one read from the request. */\nexport function configuredAppId(appId?: string): string | undefined {\n  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || undefined;\n}\n\n/** The site's host name without a port. A reverse proxy reports the public one in `x-forwarded-host`. */\nexport function requestHostname(requestHeaders: Headers): string | undefined {\n  const forwarded = requestHeaders.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  const host = forwarded || requestHeaders.get(\"host\")?.trim();\n  if (!host) return undefined;\n  try {\n    return new URL(`http://${host}`).hostname;\n  } catch {\n    return undefined;\n  }\n}\n\nexport async function serverClient(\n  deviceId: string | null,\n  config: ServerConfig = {},\n): Promise<FewchursClient> {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n    // Only read the request when needed, so a page with a set domain can still render statically.\n    appId: configuredAppId(config.appId) ?? requestHostname(await headers()),\n  });\n}\n","import \"server-only\";\nimport { cookies } from \"next/headers\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE } from \"./constants\";\n\nexport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE };\n\nexport type DeviceIdResolver = () => string | Promise<string>;\n\n/** The visitor's id, or null when nothing has been stored for them yet. */\nexport async function readDeviceId(): Promise<string | null> {\n  const store = await cookies();\n  return store.get(DEVICE_ID_COOKIE)?.value ?? null;\n}\n\n/**\n * Reads the cookie, falling back to a fresh id. The value is not persisted here: a server\n * component cannot set cookies, so the route handler stores it on the first request instead.\n */\nexport async function resolveDeviceId(custom?: DeviceIdResolver): Promise<string> {\n  if (custom) return custom();\n  return (await readDeviceId()) ?? createDeviceId();\n}\n\nexport function deviceIdCookie(deviceId: string): {\n  name: string;\n  value: string;\n  options: {\n    httpOnly: true;\n    sameSite: \"lax\";\n    path: string;\n    maxAge: number;\n    secure: boolean;\n  };\n} {\n  return {\n    name: DEVICE_ID_COOKIE,\n    value: deviceId,\n    options: {\n      httpOnly: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: DEVICE_ID_MAX_AGE,\n      secure: process.env.NODE_ENV === \"production\",\n    },\n  };\n}\n\nexport { createDeviceId };\n","// Generated by tools/stamp-version.mjs from @fewchurs/next's package.json. Do not edit by hand.\nexport const SDK_VERSION = \"1.5.0\";\n","import { SDK_VERSION } from \"./version\";\n\nexport const DEVICE_ID_COOKIE = \"fewchurs_did\";\nexport const DEVICE_ID_MAX_AGE = 60 * 60 * 24 * 365;\nexport { SDK_VERSION };\nexport const SDK_HEADER = `next/${SDK_VERSION}`;\n","import \"server-only\";\nimport { FewchursButton as ClientButton, FewchursProvider } from \"@fewchurs/react\";\nimport type { FewchursButtonProps as ClientButtonProps } from \"@fewchurs/react\";\nimport { resolveApiPath } from \"./config\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface FewchursButtonProps extends Omit<\n  ClientButtonProps,\n  \"renderHeader\" | \"renderEmpty\" | \"renderFeature\"\n> {\n  apiPath?: string;\n  language?: string;\n  deviceId?: DeviceIdResolver;\n}\n\nexport async function FewchursButton({\n  apiPath,\n  language,\n  deviceId,\n  ...button\n}: FewchursButtonProps): Promise<React.JSX.Element> {\n  return (\n    <FewchursProvider\n      baseUrl={resolveApiPath(apiPath)}\n      language={language}\n      deviceId={deviceId ? await deviceId() : undefined}\n    >\n      <ClientButton {...button} />\n    </FewchursProvider>\n  );\n}\n","import \"server-only\";\nimport { createDeviceId, NOT_CONFIGURED_MESSAGE } from \"@fewchurs/react/core\";\nimport {\n  configuredAppId,\n  requestHostname,\n  resolveApiKey,\n  resolveApiPath,\n  resolveBaseUrl,\n} from \"./config\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE, SDK_HEADER } from \"./constants\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface HandlerOptions {\n  apiKey?: string;\n  baseUrl?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n  /** Where the handler is mounted, when it is not `/api/fewchurs`. */\n  apiPath?: string;\n  /** Return a stable, hashed id for the signed-in visitor so votes follow the account. */\n  deviceId?: DeviceIdResolver;\n}\n\ntype RouteParams = { route?: string[] };\n\n/** What Next passes: a Promise in 15, a plain object in 14. Both are awaited the same way. */\ntype IncomingContext = { params?: RouteParams | Promise<RouteParams> };\n\n// Next 15's route check wants a required second argument whose `params` is a Promise. The\n// handler itself takes `IncomingContext`, so Next 14's plain object still works at runtime.\ntype RouteContext = { params: Promise<RouteParams> };\n\nexport type RouteHandler = (request: Request, context: RouteContext) => Promise<Response>;\n\n/** Only the endpoints the board needs: everything else is a 404, not a proxy to the API. */\nconst ALLOWED: Array<{ method: string; pattern: RegExp }> = [\n  { method: \"GET\", pattern: /^config$/ },\n  { method: \"GET\", pattern: /^features$/ },\n  { method: \"POST\", pattern: /^features$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+\\/comments$/ },\n  { method: \"POST\", pattern: /^comments$/ },\n];\n\nconst DEVICE_ID_PATTERN = /^[A-Za-z0-9_-]{8,128}$/;\n\nexport function createHandler(options: HandlerOptions = {}): {\n  GET: RouteHandler;\n  POST: RouteHandler;\n  DELETE: RouteHandler;\n} {\n  async function handle(request: Request, context?: IncomingContext): Promise<Response> {\n    const path = await routePath(request, context, resolveApiPath(options.apiPath));\n\n    if (!ALLOWED.some((route) => route.method === request.method && route.pattern.test(path))) {\n      return json({ error: { code: \"not_found\", message: \"Unknown Fewchurs route.\" } }, 404);\n    }\n\n    const apiKey = resolveApiKey(options.apiKey);\n    if (!apiKey) {\n      console.error(\n        \"[fewchurs] No API key. Set FEWCHURS_API_KEY, or pass apiKey to createHandler().\",\n      );\n      return json({ error: { code: \"internal\", message: NOT_CONFIGURED_MESSAGE } }, 500);\n    }\n\n    const cookieValue = readCookie(request, DEVICE_ID_COOKIE);\n    const custom = options.deviceId ? await options.deviceId() : null;\n    const deviceId = custom ?? cookieValue ?? claimedDeviceId(request) ?? createDeviceId();\n\n    const target = `${resolveBaseUrl(options.baseUrl)}/${path}${new URL(request.url).search}`;\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${apiKey}`,\n      \"X-Device-Id\": deviceId,\n      \"X-Fewchurs-Sdk\": SDK_HEADER,\n      \"X-Fewchurs-App-Id\":\n        configuredAppId(options.appId) ??\n        requestHostname(request.headers) ??\n        new URL(request.url).hostname,\n      Accept: \"application/json\",\n    };\n    const language = request.headers.get(\"accept-language\");\n    if (language) headers[\"Accept-Language\"] = language;\n\n    const body = request.method === \"GET\" ? undefined : await request.text();\n    if (body) headers[\"Content-Type\"] = \"application/json\";\n\n    let upstream: Response;\n    try {\n      upstream = await fetch(target, { method: request.method, headers, body, cache: \"no-store\" });\n    } catch {\n      return json({ error: { code: \"internal\", message: \"Could not reach Fewchurs.\" } }, 502);\n    }\n\n    const text = await upstream.text();\n    if (upstream.status === 403) logRefusal(text);\n\n    const response = new Response(text, {\n      status: upstream.status,\n      headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n    });\n\n    // A visitor keeps the same id across requests without the browser ever seeing the key,\n    // and an httpOnly cookie means page scripts cannot read or change it either.\n    if (!custom && deviceId !== cookieValue) {\n      response.headers.append(\"Set-Cookie\", serializeCookie(deviceId));\n    }\n\n    return response;\n  }\n\n  return { GET: handle, POST: handle, DELETE: handle };\n}\n\nconst defaultHandler = createHandler();\n\nexport const GET = defaultHandler.GET;\nexport const POST = defaultHandler.POST;\nexport const DELETE = defaultHandler.DELETE;\n\nlet loggedRefusal = false;\n\n/** Visitors only see a safe message, so a live site's server log is where the domain gets named. */\nfunction logRefusal(body: string): void {\n  if (loggedRefusal) return;\n  try {\n    const error = (JSON.parse(body) as { error?: { code?: string; message?: string } }).error;\n    if (error?.code !== \"wrong_app\") return;\n    loggedRefusal = true;\n    console.error(`[fewchurs] ${error.message}`);\n  } catch {\n    // Not JSON, so it isn't a refusal from Fewchurs.\n  }\n}\n\nasync function routePath(\n  request: Request,\n  context: IncomingContext | undefined,\n  apiPath: string,\n): Promise<string> {\n  const params = await context?.params;\n  if (params?.route?.length) return params.route.map(encodeURIComponent).join(\"/\");\n\n  const { pathname } = new URL(request.url);\n  const index = pathname.indexOf(apiPath);\n  return index === -1 ? \"\" : pathname.slice(index + apiPath.length).replace(/^\\//, \"\");\n}\n\n/**\n * The first request from a server-rendered board carries the id the page was rendered with,\n * so adopting it keeps the server's `hasVoted` answers and the browser's in agreement.\n */\nfunction claimedDeviceId(request: Request): string | null {\n  const claimed = request.headers.get(\"x-device-id\");\n  return claimed && DEVICE_ID_PATTERN.test(claimed) ? claimed : null;\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n  const header = request.headers.get(\"cookie\");\n  if (!header) return null;\n  const match = header.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match?.[1] ? decodeURIComponent(match[1]) : null;\n}\n\nfunction serializeCookie(deviceId: string): string {\n  const parts = [\n    `${DEVICE_ID_COOKIE}=${encodeURIComponent(deviceId)}`,\n    \"Path=/\",\n    `Max-Age=${DEVICE_ID_MAX_AGE}`,\n    \"HttpOnly\",\n    \"SameSite=Lax\",\n  ];\n  if (process.env.NODE_ENV === \"production\") parts.push(\"Secure\");\n  return parts.join(\"; \");\n}\n\nfunction json(body: unknown, status: number): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,sBAAO;AACP,mBAA+D;AAE/D,IAAAC,eAMO;;;ACTP,yBAAO;AACP,qBAAwB;AACxB,kBAA4E;AAErE,IAAM,mBAAmB;AAUzB,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAEO,SAAS,eAAe,SAA0B;AACvD,UAAQ,WAAW,QAAQ,IAAI,qBAAqB,kBAAkB,QAAQ,OAAO,EAAE;AACzF;AAGO,SAAS,gBAAgB,OAAoC;AAClE,SAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,KAAK,KAAK;AACjE;AAGO,SAAS,gBAAgB,gBAA6C;AAC3E,QAAM,YAAY,eAAe,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAC9E,QAAM,OAAO,aAAa,eAAe,IAAI,MAAM,GAAG,KAAK;AAC3D,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,IAAI,EAAE,EAAE;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,aACpB,UACA,SAAuB,CAAC,GACC;AACzB,QAAM,SAAS,cAAc,OAAO,MAAM;AAC1C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,aAAO,kCAAqB;AAAA,IAC1B;AAAA,IACA,SAAS,eAAe,OAAO,OAAO;AAAA,IACtC;AAAA,IACA,UAAU,OAAO;AAAA;AAAA,IAEjB,OAAO,gBAAgB,OAAO,KAAK,KAAK,gBAAgB,UAAM,wBAAQ,CAAC;AAAA,EACzE,CAAC;AACH;;;AC9DA,IAAAC,sBAAO;AACP,IAAAC,kBAAwB;AACxB,IAAAC,eAA+B;;;ACDxB,IAAM,cAAc;;;ACCpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,KAAK,KAAK,KAAK;AAEzC,IAAM,aAAa,QAAQ,WAAW;;;AFK7C,eAAsB,eAAuC;AAC3D,QAAM,QAAQ,UAAM,yBAAQ;AAC5B,SAAO,MAAM,IAAI,gBAAgB,GAAG,SAAS;AAC/C;AAMA,eAAsB,gBAAgB,QAA4C;AAChF,MAAI,OAAQ,QAAO,OAAO;AAC1B,SAAQ,MAAM,aAAa,SAAM,6BAAe;AAClD;;;AFuBQ;AAdR,eAAsB,cAAc;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV,GAAG;AACL,GAAmD;AACjD,QAAM,WAAW,MAAM,gBAAgB,cAAc;AAErD,MAAI,CAAC,cAAc,MAAM,GAAG;AAC1B,WACE,4CAAC,iCAAiB,UAAoB,UAAU,MAAM,YAAY,IAChE,sDAAC,aAAAC,eAAA,EAAa,GAAG,OAAO,GAC1B;AAAA,EAEJ;AAEA,QAAM,SAAS,MAAM,aAAa,UAAU,EAAE,QAAQ,SAAS,UAAU,MAAM,CAAC;AAEhF,QAAM,MAAM,MAAM,cAAc,MAAM,OAAO,CAAC,KAAK;AACnD,QAAM,OAAoB,QAAQ,YAAY,QAAQ;AACtD,QAAM,SAAS,QAAQ,YAAY,gCAAmB;AACtD,QAAM,WAAW,MAAM,YAAY;AAEnC,QAAM,CAAC,QAAQ,MAAM,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC/C,OAAO,UAAU;AAAA,IACjB,OAAO,aAAa,EAAE,MAAM,QAAQ,OAAO,SAAS,CAAC;AAAA,IACrD,MAAM,mBAAmB,OAAO,WAAW,MAAM,gBAAgB,IAAI;AAAA,EACvE,CAAC;AAID,QAAM,QAA6B,CAAC;AACpC,MAAI,KAAK,IAAI;AACX,cAAM,sBAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,IAAI;AAAA,MACjC,UAAU,KAAK,KAAK;AAAA,MACpB,QAAQ,KAAK,KAAK;AAAA,MAClB,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,MAAM,oBAAoB,QAAQ,IAAI;AACxC,cAAM,yBAAW,MAAM,gBAAgB,CAAC,IAAI;AAAA,MAC1C,UAAU,CAAC,OAAO,IAAI;AAAA,MACtB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,eAAoC;AAAA,IACxC,QAAQ,OAAO,KAAK,OAAO,OAAO;AAAA,IAClC;AAAA,EACF;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS,eAAe,OAAO;AAAA,MAC/B;AAAA,MACA;AAAA,MACA;AAAA,MAEA,sDAAC,aAAAA,eAAA,EAAa,GAAG,OAAO;AAAA;AAAA,EAC1B;AAEJ;;;AKnGA,IAAAC,sBAAO;AACP,IAAAC,gBAAiE;AA0B3D,IAAAC,sBAAA;AAZN,eAAsB,eAAe;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,GAAoD;AAClD,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS,eAAe,OAAO;AAAA,MAC/B;AAAA,MACA,UAAU,WAAW,MAAM,SAAS,IAAI;AAAA,MAExC,uDAAC,cAAAC,gBAAA,EAAc,GAAG,QAAQ;AAAA;AAAA,EAC5B;AAEJ;;;AC9BA,IAAAC,sBAAO;AACP,IAAAC,eAAuD;AAkCvD,IAAM,UAAsD;AAAA,EAC1D,EAAE,QAAQ,OAAO,SAAS,WAAW;AAAA,EACrC,EAAE,QAAQ,OAAO,SAAS,aAAa;AAAA,EACvC,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAAA,EACxC,EAAE,QAAQ,OAAO,SAAS,oBAAoB;AAAA,EAC9C,EAAE,QAAQ,QAAQ,SAAS,0BAA0B;AAAA,EACrD,EAAE,QAAQ,UAAU,SAAS,0BAA0B;AAAA,EACvD,EAAE,QAAQ,QAAQ,SAAS,4BAA4B;AAAA,EACvD,EAAE,QAAQ,UAAU,SAAS,4BAA4B;AAAA,EACzD,EAAE,QAAQ,OAAO,SAAS,8BAA8B;AAAA,EACxD,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAC1C;AAEA,IAAM,oBAAoB;AAEnB,SAAS,cAAc,UAA0B,CAAC,GAIvD;AACA,iBAAe,OAAO,SAAkB,SAA8C;AACpF,UAAM,OAAO,MAAM,UAAU,SAAS,SAAS,eAAe,QAAQ,OAAO,CAAC;AAE9E,QAAI,CAAC,QAAQ,KAAK,CAAC,UAAU,MAAM,WAAW,QAAQ,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG;AACzF,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,SAAS,0BAA0B,EAAE,GAAG,GAAG;AAAA,IACvF;AAEA,UAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,QAAI,CAAC,QAAQ;AACX,cAAQ;AAAA,QACN;AAAA,MACF;AACA,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,oCAAuB,EAAE,GAAG,GAAG;AAAA,IACnF;AAEA,UAAM,cAAc,WAAW,SAAS,gBAAgB;AACxD,UAAM,SAAS,QAAQ,WAAW,MAAM,QAAQ,SAAS,IAAI;AAC7D,UAAM,WAAW,UAAU,eAAe,gBAAgB,OAAO,SAAK,6BAAe;AAErF,UAAM,SAAS,GAAG,eAAe,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,MAAM;AACvF,UAAMC,WAAkC;AAAA,MACtC,eAAe,UAAU,MAAM;AAAA,MAC/B,eAAe;AAAA,MACf,kBAAkB;AAAA,MAClB,qBACE,gBAAgB,QAAQ,KAAK,KAC7B,gBAAgB,QAAQ,OAAO,KAC/B,IAAI,IAAI,QAAQ,GAAG,EAAE;AAAA,MACvB,QAAQ;AAAA,IACV;AACA,UAAM,WAAW,QAAQ,QAAQ,IAAI,iBAAiB;AACtD,QAAI,SAAU,CAAAA,SAAQ,iBAAiB,IAAI;AAE3C,UAAM,OAAO,QAAQ,WAAW,QAAQ,SAAY,MAAM,QAAQ,KAAK;AACvE,QAAI,KAAM,CAAAA,SAAQ,cAAc,IAAI;AAEpC,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,QAAQ,EAAE,QAAQ,QAAQ,QAAQ,SAAAA,UAAS,MAAM,OAAO,WAAW,CAAC;AAAA,IAC7F,QAAQ;AACN,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,4BAA4B,EAAE,GAAG,GAAG;AAAA,IACxF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,SAAS,WAAW,IAAK,YAAW,IAAI;AAE5C,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ,SAAS;AAAA,MACjB,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,IAC7E,CAAC;AAID,QAAI,CAAC,UAAU,aAAa,aAAa;AACvC,eAAS,QAAQ,OAAO,cAAc,gBAAgB,QAAQ,CAAC;AAAA,IACjE;AAEA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,OAAO;AACrD;AAEA,IAAM,iBAAiB,cAAc;AAE9B,IAAM,MAAM,eAAe;AAC3B,IAAM,OAAO,eAAe;AAC5B,IAAM,SAAS,eAAe;AAErC,IAAI,gBAAgB;AAGpB,SAAS,WAAW,MAAoB;AACtC,MAAI,cAAe;AACnB,MAAI;AACF,UAAM,QAAS,KAAK,MAAM,IAAI,EAAsD;AACpF,QAAI,OAAO,SAAS,YAAa;AACjC,oBAAgB;AAChB,YAAQ,MAAM,cAAc,MAAM,OAAO,EAAE;AAAA,EAC7C,QAAQ;AAAA,EAER;AACF;AAEA,eAAe,UACb,SACA,SACA,SACiB;AACjB,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,QAAQ,OAAO,OAAQ,QAAO,OAAO,MAAM,IAAI,kBAAkB,EAAE,KAAK,GAAG;AAE/E,QAAM,EAAE,SAAS,IAAI,IAAI,IAAI,QAAQ,GAAG;AACxC,QAAM,QAAQ,SAAS,QAAQ,OAAO;AACtC,SAAO,UAAU,KAAK,KAAK,SAAS,MAAM,QAAQ,QAAQ,MAAM,EAAE,QAAQ,OAAO,EAAE;AACrF;AAMA,SAAS,gBAAgB,SAAiC;AACxD,QAAM,UAAU,QAAQ,QAAQ,IAAI,aAAa;AACjD,SAAO,WAAW,kBAAkB,KAAK,OAAO,IAAI,UAAU;AAChE;AAEA,SAAS,WAAW,SAAkB,MAA6B;AACjE,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACnE,SAAO,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACrD;AAEA,SAAS,gBAAgB,UAA0B;AACjD,QAAM,QAAQ;AAAA,IACZ,GAAG,gBAAgB,IAAI,mBAAmB,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,WAAW,iBAAiB;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,aAAa,aAAc,OAAM,KAAK,QAAQ;AAC9D,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,KAAK,MAAe,QAA0B;AACrD,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,EAC7E,CAAC;AACH;","names":["import_server_only","import_core","import_server_only","import_headers","import_core","ClientBoard","import_server_only","import_react","import_jsx_runtime","ClientButton","import_server_only","import_core","headers"]}

package/dist/index.mjs

@@ -1,16 +1,17 @@
 import {
   DEFAULT_API_PATH,
   createHandler,
+  resolveApiKey,
   resolveApiPath,
   serverClient
-} from "./chunk-SFNYZN24.mjs";
+} from "./chunk-DCIL2IC4.mjs";
 import {
   readDeviceId,
   resolveDeviceId
-} from "./chunk-B4TL4JIY.mjs";
+} from "./chunk-MIJLYYIN.mjs";
 import {
   DEVICE_ID_COOKIE
-} from "./chunk-WUW57LPF.mjs";
+} from "./chunk-F4BPXSKD.mjs";
 
 // src/board.tsx
 import "server-only";
@@ -31,6 +32,9 @@ async function FewchursBoard({
   ...board
 }) {
   const deviceId = await resolveDeviceId(deviceIdOption);
+  if (!resolveApiKey(apiKey)) {
+    return /* @__PURE__ */ jsx(FewchursProvider, { deviceId, pageSize: board.pageSize ?? 20, children: /* @__PURE__ */ jsx(ClientBoard, { ...board }) });
+  }
   const client = await serverClient(deviceId, { apiKey, baseUrl, language, appId });
   const tab = board.defaultTab ?? board.tabs?.[0] ?? "top";
   const sort = tab === "roadmap" ? "top" : tab;

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/board.tsx","../src/button.tsx"],"sourcesContent":["import \"server-only\";\nimport { FewchursBoard as ClientBoard, FewchursProvider } from \"@fewchurs/react\";\nimport type { FewchursBoardProps as ClientBoardProps } from \"@fewchurs/react\";\nimport {\n  featureKey,\n  listKey,\n  ROADMAP_STATUSES,\n  type FeatureSort,\n  type StoreState,\n} from \"@fewchurs/react/core\";\nimport { resolveApiPath, serverClient } from \"./config\";\nimport { resolveDeviceId, type DeviceIdResolver } from \"./identity\";\n\n/** Function props cannot cross the server/client boundary — compose in your own client file. */\ntype SerializableBoardProps = Omit<\n  ClientBoardProps,\n  \"renderHeader\" | \"renderEmpty\" | \"renderFeature\" | \"children\"\n>;\n\nexport interface FewchursBoardProps extends SerializableBoardProps {\n  /** Defaults to `process.env.FEWCHURS_API_KEY`. Never reaches the browser. */\n  apiKey?: string;\n  baseUrl?: string;\n  /** Where your route handler is mounted. Defaults to `/api/fewchurs`. */\n  apiPath?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n  deviceId?: DeviceIdResolver;\n}\n\nexport async function FewchursBoard({\n  apiKey,\n  baseUrl,\n  apiPath,\n  language,\n  appId,\n  deviceId: deviceIdOption,\n  ...board\n}: FewchursBoardProps): Promise<React.JSX.Element> {\n  const deviceId = await resolveDeviceId(deviceIdOption);\n  const client = await serverClient(deviceId, { apiKey, baseUrl, language, appId });\n\n  const tab = board.defaultTab ?? board.tabs?.[0] ?? \"top\";\n  const sort: FeatureSort = tab === \"roadmap\" ? \"top\" : tab;\n  const status = tab === \"roadmap\" ? ROADMAP_STATUSES : undefined;\n  const pageSize = board.pageSize ?? 20;\n\n  const [config, page, pinned] = await Promise.all([\n    client.getConfig(),\n    client.listFeatures({ sort, status, limit: pageSize }),\n    board.initialFeatureId ? client.getFeature(board.initialFeatureId) : null,\n  ]);\n\n  // Seeded under the same key the client hook will ask for, so the first paint is the\n  // rendered HTML and no second request goes out just to fetch what is already there.\n  const lists: StoreState[\"lists\"] = {};\n  if (page.ok) {\n    lists[listKey({ sort, status })] = {\n      features: page.data.features,\n      cursor: page.data.nextCursor,\n      status: \"ready\",\n      error: null,\n    };\n  }\n  // A deep-linked request is rendered on the server too, so the link lands on real content.\n  if (board.initialFeatureId && pinned?.ok) {\n    lists[featureKey(board.initialFeatureId)] = {\n      features: [pinned.data],\n      cursor: null,\n      status: \"ready\",\n      error: null,\n    };\n  }\n\n  const initialState: Partial<StoreState> = {\n    config: config.ok ? config.data : null,\n    lists,\n  };\n\n  return (\n    <FewchursProvider\n      baseUrl={resolveApiPath(apiPath)}\n      deviceId={deviceId}\n      pageSize={pageSize}\n      initialState={initialState}\n    >\n      <ClientBoard {...board} />\n    </FewchursProvider>\n  );\n}\n","import \"server-only\";\nimport { FewchursButton as ClientButton, FewchursProvider } from \"@fewchurs/react\";\nimport type { FewchursButtonProps as ClientButtonProps } from \"@fewchurs/react\";\nimport { resolveApiPath } from \"./config\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface FewchursButtonProps extends Omit<\n  ClientButtonProps,\n  \"renderHeader\" | \"renderEmpty\" | \"renderFeature\"\n> {\n  apiPath?: string;\n  language?: string;\n  deviceId?: DeviceIdResolver;\n}\n\nexport async function FewchursButton({\n  apiPath,\n  language,\n  deviceId,\n  ...button\n}: FewchursButtonProps): Promise<React.JSX.Element> {\n  return (\n    <FewchursProvider\n      baseUrl={resolveApiPath(apiPath)}\n      language={language}\n      deviceId={deviceId ? await deviceId() : undefined}\n    >\n      <ClientButton {...button} />\n    </FewchursProvider>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;AAAA,OAAO;AACP,SAAS,iBAAiB,aAAa,wBAAwB;AAE/D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AA8ED;AAxDN,eAAsB,cAAc;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV,GAAG;AACL,GAAmD;AACjD,QAAM,WAAW,MAAM,gBAAgB,cAAc;AACrD,QAAM,SAAS,MAAM,aAAa,UAAU,EAAE,QAAQ,SAAS,UAAU,MAAM,CAAC;AAEhF,QAAM,MAAM,MAAM,cAAc,MAAM,OAAO,CAAC,KAAK;AACnD,QAAM,OAAoB,QAAQ,YAAY,QAAQ;AACtD,QAAM,SAAS,QAAQ,YAAY,mBAAmB;AACtD,QAAM,WAAW,MAAM,YAAY;AAEnC,QAAM,CAAC,QAAQ,MAAM,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC/C,OAAO,UAAU;AAAA,IACjB,OAAO,aAAa,EAAE,MAAM,QAAQ,OAAO,SAAS,CAAC;AAAA,IACrD,MAAM,mBAAmB,OAAO,WAAW,MAAM,gBAAgB,IAAI;AAAA,EACvE,CAAC;AAID,QAAM,QAA6B,CAAC;AACpC,MAAI,KAAK,IAAI;AACX,UAAM,QAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,IAAI;AAAA,MACjC,UAAU,KAAK,KAAK;AAAA,MACpB,QAAQ,KAAK,KAAK;AAAA,MAClB,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,MAAM,oBAAoB,QAAQ,IAAI;AACxC,UAAM,WAAW,MAAM,gBAAgB,CAAC,IAAI;AAAA,MAC1C,UAAU,CAAC,OAAO,IAAI;AAAA,MACtB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,eAAoC;AAAA,IACxC,QAAQ,OAAO,KAAK,OAAO,OAAO;AAAA,IAClC;AAAA,EACF;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS,eAAe,OAAO;AAAA,MAC/B;AAAA,MACA;AAAA,MACA;AAAA,MAEA,8BAAC,eAAa,GAAG,OAAO;AAAA;AAAA,EAC1B;AAEJ;;;AC1FA,OAAO;AACP,SAAS,kBAAkB,cAAc,oBAAAA,yBAAwB;AA0B3D,gBAAAC,YAAA;AAZN,eAAsB,eAAe;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,GAAoD;AAClD,SACE,gBAAAA;AAAA,IAACC;AAAA,IAAA;AAAA,MACC,SAAS,eAAe,OAAO;AAAA,MAC/B;AAAA,MACA,UAAU,WAAW,MAAM,SAAS,IAAI;AAAA,MAExC,0BAAAD,KAAC,gBAAc,GAAG,QAAQ;AAAA;AAAA,EAC5B;AAEJ;","names":["FewchursProvider","jsx","FewchursProvider"]}
+{"version":3,"sources":["../src/board.tsx","../src/button.tsx"],"sourcesContent":["import \"server-only\";\nimport { FewchursBoard as ClientBoard, FewchursProvider } from \"@fewchurs/react\";\nimport type { FewchursBoardProps as ClientBoardProps } from \"@fewchurs/react\";\nimport {\n  featureKey,\n  listKey,\n  ROADMAP_STATUSES,\n  type FeatureSort,\n  type StoreState,\n} from \"@fewchurs/react/core\";\nimport { resolveApiKey, resolveApiPath, serverClient } from \"./config\";\nimport { resolveDeviceId, type DeviceIdResolver } from \"./identity\";\n\n/** Function props cannot cross the server/client boundary — compose in your own client file. */\ntype SerializableBoardProps = Omit<\n  ClientBoardProps,\n  \"renderHeader\" | \"renderEmpty\" | \"renderFeature\" | \"children\"\n>;\n\nexport interface FewchursBoardProps extends SerializableBoardProps {\n  /** Defaults to `process.env.FEWCHURS_API_KEY`. Never reaches the browser. */\n  apiKey?: string;\n  baseUrl?: string;\n  /** Where your route handler is mounted. Defaults to `/api/fewchurs`. */\n  apiPath?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n  deviceId?: DeviceIdResolver;\n}\n\nexport async function FewchursBoard({\n  apiKey,\n  baseUrl,\n  apiPath,\n  language,\n  appId,\n  deviceId: deviceIdOption,\n  ...board\n}: FewchursBoardProps): Promise<React.JSX.Element> {\n  const deviceId = await resolveDeviceId(deviceIdOption);\n\n  if (!resolveApiKey(apiKey)) {\n    return (\n      <FewchursProvider deviceId={deviceId} pageSize={board.pageSize ?? 20}>\n        <ClientBoard {...board} />\n      </FewchursProvider>\n    );\n  }\n\n  const client = await serverClient(deviceId, { apiKey, baseUrl, language, appId });\n\n  const tab = board.defaultTab ?? board.tabs?.[0] ?? \"top\";\n  const sort: FeatureSort = tab === \"roadmap\" ? \"top\" : tab;\n  const status = tab === \"roadmap\" ? ROADMAP_STATUSES : undefined;\n  const pageSize = board.pageSize ?? 20;\n\n  const [config, page, pinned] = await Promise.all([\n    client.getConfig(),\n    client.listFeatures({ sort, status, limit: pageSize }),\n    board.initialFeatureId ? client.getFeature(board.initialFeatureId) : null,\n  ]);\n\n  // Seeded under the same key the client hook will ask for, so the first paint is the\n  // rendered HTML and no second request goes out just to fetch what is already there.\n  const lists: StoreState[\"lists\"] = {};\n  if (page.ok) {\n    lists[listKey({ sort, status })] = {\n      features: page.data.features,\n      cursor: page.data.nextCursor,\n      status: \"ready\",\n      error: null,\n    };\n  }\n  // A deep-linked request is rendered on the server too, so the link lands on real content.\n  if (board.initialFeatureId && pinned?.ok) {\n    lists[featureKey(board.initialFeatureId)] = {\n      features: [pinned.data],\n      cursor: null,\n      status: \"ready\",\n      error: null,\n    };\n  }\n\n  const initialState: Partial<StoreState> = {\n    config: config.ok ? config.data : null,\n    lists,\n  };\n\n  return (\n    <FewchursProvider\n      baseUrl={resolveApiPath(apiPath)}\n      deviceId={deviceId}\n      pageSize={pageSize}\n      initialState={initialState}\n    >\n      <ClientBoard {...board} />\n    </FewchursProvider>\n  );\n}\n","import \"server-only\";\nimport { FewchursButton as ClientButton, FewchursProvider } from \"@fewchurs/react\";\nimport type { FewchursButtonProps as ClientButtonProps } from \"@fewchurs/react\";\nimport { resolveApiPath } from \"./config\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface FewchursButtonProps extends Omit<\n  ClientButtonProps,\n  \"renderHeader\" | \"renderEmpty\" | \"renderFeature\"\n> {\n  apiPath?: string;\n  language?: string;\n  deviceId?: DeviceIdResolver;\n}\n\nexport async function FewchursButton({\n  apiPath,\n  language,\n  deviceId,\n  ...button\n}: FewchursButtonProps): Promise<React.JSX.Element> {\n  return (\n    <FewchursProvider\n      baseUrl={resolveApiPath(apiPath)}\n      language={language}\n      deviceId={deviceId ? await deviceId() : undefined}\n    >\n      <ClientButton {...button} />\n    </FewchursProvider>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA,OAAO;AACP,SAAS,iBAAiB,aAAa,wBAAwB;AAE/D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAoCC;AAdR,eAAsB,cAAc;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV,GAAG;AACL,GAAmD;AACjD,QAAM,WAAW,MAAM,gBAAgB,cAAc;AAErD,MAAI,CAAC,cAAc,MAAM,GAAG;AAC1B,WACE,oBAAC,oBAAiB,UAAoB,UAAU,MAAM,YAAY,IAChE,8BAAC,eAAa,GAAG,OAAO,GAC1B;AAAA,EAEJ;AAEA,QAAM,SAAS,MAAM,aAAa,UAAU,EAAE,QAAQ,SAAS,UAAU,MAAM,CAAC;AAEhF,QAAM,MAAM,MAAM,cAAc,MAAM,OAAO,CAAC,KAAK;AACnD,QAAM,OAAoB,QAAQ,YAAY,QAAQ;AACtD,QAAM,SAAS,QAAQ,YAAY,mBAAmB;AACtD,QAAM,WAAW,MAAM,YAAY;AAEnC,QAAM,CAAC,QAAQ,MAAM,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC/C,OAAO,UAAU;AAAA,IACjB,OAAO,aAAa,EAAE,MAAM,QAAQ,OAAO,SAAS,CAAC;AAAA,IACrD,MAAM,mBAAmB,OAAO,WAAW,MAAM,gBAAgB,IAAI;AAAA,EACvE,CAAC;AAID,QAAM,QAA6B,CAAC;AACpC,MAAI,KAAK,IAAI;AACX,UAAM,QAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,IAAI;AAAA,MACjC,UAAU,KAAK,KAAK;AAAA,MACpB,QAAQ,KAAK,KAAK;AAAA,MAClB,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,MAAM,oBAAoB,QAAQ,IAAI;AACxC,UAAM,WAAW,MAAM,gBAAgB,CAAC,IAAI;AAAA,MAC1C,UAAU,CAAC,OAAO,IAAI;AAAA,MACtB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,eAAoC;AAAA,IACxC,QAAQ,OAAO,KAAK,OAAO,OAAO;AAAA,IAClC;AAAA,EACF;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS,eAAe,OAAO;AAAA,MAC/B;AAAA,MACA;AAAA,MACA;AAAA,MAEA,8BAAC,eAAa,GAAG,OAAO;AAAA;AAAA,EAC1B;AAEJ;;;ACnGA,OAAO;AACP,SAAS,kBAAkB,cAAc,oBAAAA,yBAAwB;AA0B3D,gBAAAC,YAAA;AAZN,eAAsB,eAAe;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,GAAoD;AAClD,SACE,gBAAAA;AAAA,IAACC;AAAA,IAAA;AAAA,MACC,SAAS,eAAe,OAAO;AAAA,MAC/B;AAAA,MACA,UAAU,WAAW,MAAM,SAAS,IAAI;AAAA,MAExC,0BAAAD,KAAC,gBAAc,GAAG,QAAQ;AAAA;AAAA,EAC5B;AAEJ;","names":["FewchursProvider","jsx","FewchursProvider"]}

package/dist/styles.css

@@ -88,6 +88,7 @@
 
 .fewchurs .fw-tab:focus-visible,
 .fewchurs .fw-btn:focus-visible,
+.fewchurs .fw-btn-text:focus-visible,
 .fewchurs .fw-vote:focus-visible,
 .fewchurs .fw-input:focus-visible,
 .fewchurs .fw-link:focus-visible {
@@ -318,6 +319,46 @@
   margin: 0 0 0.25rem;
 }
 
+.fewchurs .fw-empty__detail {
+  margin: 0 0 0.75rem;
+}
+
+.fewchurs .fw-empty--compact {
+  padding: 0.75rem 0;
+}
+
+.fewchurs .fw-field__foot {
+  display: flex;
+  justify-content: space-between;
+  gap: 0.5rem;
+  font-size: 0.8rem;
+}
+
+.fewchurs .fw-meta .fw-error {
+  flex-basis: 100%;
+}
+
+.fewchurs .fw-pagination[role="alert"] {
+  align-items: center;
+  gap: 0.25rem;
+  color: var(--fw-subtle);
+}
+
+.fewchurs .fw-btn-text {
+  padding: 0.45rem 0.75rem;
+  font: inherit;
+  font-weight: 600;
+  cursor: pointer;
+  color: var(--fw-text);
+  background: transparent;
+  border: 0;
+  border-radius: 0.55rem;
+}
+
+.fewchurs .fw-btn-text:hover {
+  background: var(--fw-muted);
+}
+
 .fewchurs .fw-comments {
   margin-top: 0.9rem;
   padding-top: 0.9rem;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fewchurs/next",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "A server-rendered Fewchurs feature-request board for Next.js, with the API key kept on the server.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "commonjs",
@@ -86,7 +86,7 @@
   },
   "dependencies": {
     "server-only": "^0.0.1",
-    "@fewchurs/react": "^1.3.0"
+    "@fewchurs/react": "^1.5.0"
   },
   "peerDependencies": {
     "next": ">=14",

package/dist/chunk-SFNYZN24.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/handler.ts","../src/config.ts"],"sourcesContent":["import \"server-only\";\nimport { createDeviceId } from \"@fewchurs/react/core\";\nimport {\n  configuredAppId,\n  requestHostname,\n  resolveApiKey,\n  resolveApiPath,\n  resolveBaseUrl,\n} from \"./config\";\nimport { DEVICE_ID_COOKIE, DEVICE_ID_MAX_AGE, SDK_HEADER } from \"./constants\";\nimport type { DeviceIdResolver } from \"./identity\";\n\nexport interface HandlerOptions {\n  apiKey?: string;\n  baseUrl?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n  /** Where the handler is mounted, when it is not `/api/fewchurs`. */\n  apiPath?: string;\n  /** Return a stable, hashed id for the signed-in visitor so votes follow the account. */\n  deviceId?: DeviceIdResolver;\n}\n\ntype RouteParams = { route?: string[] };\n\n/** What Next passes: a Promise in 15, a plain object in 14. Both are awaited the same way. */\ntype IncomingContext = { params?: RouteParams | Promise<RouteParams> };\n\n// Next 15's route check wants a required second argument whose `params` is a Promise. The\n// handler itself takes `IncomingContext`, so Next 14's plain object still works at runtime.\ntype RouteContext = { params: Promise<RouteParams> };\n\nexport type RouteHandler = (request: Request, context: RouteContext) => Promise<Response>;\n\n/** Only the endpoints the board needs: everything else is a 404, not a proxy to the API. */\nconst ALLOWED: Array<{ method: string; pattern: RegExp }> = [\n  { method: \"GET\", pattern: /^config$/ },\n  { method: \"GET\", pattern: /^features$/ },\n  { method: \"POST\", pattern: /^features$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/vote$/ },\n  { method: \"POST\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"DELETE\", pattern: /^features\\/[^/]+\\/follow$/ },\n  { method: \"GET\", pattern: /^features\\/[^/]+\\/comments$/ },\n  { method: \"POST\", pattern: /^comments$/ },\n];\n\nconst DEVICE_ID_PATTERN = /^[A-Za-z0-9_-]{8,128}$/;\n\nexport function createHandler(options: HandlerOptions = {}): {\n  GET: RouteHandler;\n  POST: RouteHandler;\n  DELETE: RouteHandler;\n} {\n  async function handle(request: Request, context?: IncomingContext): Promise<Response> {\n    const path = await routePath(request, context, resolveApiPath(options.apiPath));\n\n    if (!ALLOWED.some((route) => route.method === request.method && route.pattern.test(path))) {\n      return json({ error: { code: \"not_found\", message: \"Unknown Fewchurs route.\" } }, 404);\n    }\n\n    const apiKey = resolveApiKey(options.apiKey);\n    if (!apiKey) {\n      console.error(\n        \"[fewchurs] No API key. Set FEWCHURS_API_KEY, or pass apiKey to createHandler().\",\n      );\n      return json({ error: { code: \"internal\", message: \"Fewchurs is not configured.\" } }, 500);\n    }\n\n    const cookieValue = readCookie(request, DEVICE_ID_COOKIE);\n    const custom = options.deviceId ? await options.deviceId() : null;\n    const deviceId = custom ?? cookieValue ?? claimedDeviceId(request) ?? createDeviceId();\n\n    const target = `${resolveBaseUrl(options.baseUrl)}/${path}${new URL(request.url).search}`;\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${apiKey}`,\n      \"X-Device-Id\": deviceId,\n      \"X-Fewchurs-Sdk\": SDK_HEADER,\n      \"X-Fewchurs-App-Id\":\n        configuredAppId(options.appId) ??\n        requestHostname(request.headers) ??\n        new URL(request.url).hostname,\n      Accept: \"application/json\",\n    };\n    const language = request.headers.get(\"accept-language\");\n    if (language) headers[\"Accept-Language\"] = language;\n\n    const body = request.method === \"GET\" ? undefined : await request.text();\n    if (body) headers[\"Content-Type\"] = \"application/json\";\n\n    let upstream: Response;\n    try {\n      upstream = await fetch(target, { method: request.method, headers, body, cache: \"no-store\" });\n    } catch {\n      return json({ error: { code: \"internal\", message: \"Could not reach Fewchurs.\" } }, 502);\n    }\n\n    const text = await upstream.text();\n    if (upstream.status === 403) logRefusal(text);\n\n    const response = new Response(text, {\n      status: upstream.status,\n      headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n    });\n\n    // A visitor keeps the same id across requests without the browser ever seeing the key,\n    // and an httpOnly cookie means page scripts cannot read or change it either.\n    if (!custom && deviceId !== cookieValue) {\n      response.headers.append(\"Set-Cookie\", serializeCookie(deviceId));\n    }\n\n    return response;\n  }\n\n  return { GET: handle, POST: handle, DELETE: handle };\n}\n\nconst defaultHandler = createHandler();\n\nexport const GET = defaultHandler.GET;\nexport const POST = defaultHandler.POST;\nexport const DELETE = defaultHandler.DELETE;\n\nlet loggedRefusal = false;\n\n/** Visitors only see a safe message, so a live site's server log is where the domain gets named. */\nfunction logRefusal(body: string): void {\n  if (loggedRefusal) return;\n  try {\n    const error = (JSON.parse(body) as { error?: { code?: string; message?: string } }).error;\n    if (error?.code !== \"wrong_app\") return;\n    loggedRefusal = true;\n    console.error(`[fewchurs] ${error.message}`);\n  } catch {\n    // Not JSON, so it isn't a refusal from Fewchurs.\n  }\n}\n\nasync function routePath(\n  request: Request,\n  context: IncomingContext | undefined,\n  apiPath: string,\n): Promise<string> {\n  const params = await context?.params;\n  if (params?.route?.length) return params.route.map(encodeURIComponent).join(\"/\");\n\n  const { pathname } = new URL(request.url);\n  const index = pathname.indexOf(apiPath);\n  return index === -1 ? \"\" : pathname.slice(index + apiPath.length).replace(/^\\//, \"\");\n}\n\n/**\n * The first request from a server-rendered board carries the id the page was rendered with,\n * so adopting it keeps the server's `hasVoted` answers and the browser's in agreement.\n */\nfunction claimedDeviceId(request: Request): string | null {\n  const claimed = request.headers.get(\"x-device-id\");\n  return claimed && DEVICE_ID_PATTERN.test(claimed) ? claimed : null;\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n  const header = request.headers.get(\"cookie\");\n  if (!header) return null;\n  const match = header.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match?.[1] ? decodeURIComponent(match[1]) : null;\n}\n\nfunction serializeCookie(deviceId: string): string {\n  const parts = [\n    `${DEVICE_ID_COOKIE}=${encodeURIComponent(deviceId)}`,\n    \"Path=/\",\n    `Max-Age=${DEVICE_ID_MAX_AGE}`,\n    \"HttpOnly\",\n    \"SameSite=Lax\",\n  ];\n  if (process.env.NODE_ENV === \"production\") parts.push(\"Secure\");\n  return parts.join(\"; \");\n}\n\nfunction json(body: unknown, status: number): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n  });\n}\n","import \"server-only\";\nimport { headers } from \"next/headers\";\nimport { createFewchursClient, DEFAULT_BASE_URL, type FewchursClient } from \"@fewchurs/react/core\";\n\nexport const DEFAULT_API_PATH = \"/api/fewchurs\";\n\nexport interface ServerConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  language?: string;\n  /** The domain the API key is checked against. Defaults to `FEWCHURS_APP_ID`, then your site's host. */\n  appId?: string;\n}\n\nexport function resolveApiKey(apiKey?: string): string | undefined {\n  return apiKey ?? process.env.FEWCHURS_API_KEY;\n}\n\nexport function resolveBaseUrl(baseUrl?: string): string {\n  return baseUrl ?? process.env.FEWCHURS_BASE_URL ?? DEFAULT_BASE_URL;\n}\n\nexport function resolveApiPath(apiPath?: string): string {\n  return (apiPath ?? process.env.FEWCHURS_API_PATH ?? DEFAULT_API_PATH).replace(/\\/$/, \"\");\n}\n\n/** A domain set by the developer, which replaces the one read from the request. */\nexport function configuredAppId(appId?: string): string | undefined {\n  return appId?.trim() || process.env.FEWCHURS_APP_ID?.trim() || undefined;\n}\n\n/** The site's host name without a port. A reverse proxy reports the public one in `x-forwarded-host`. */\nexport function requestHostname(requestHeaders: Headers): string | undefined {\n  const forwarded = requestHeaders.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  const host = forwarded || requestHeaders.get(\"host\")?.trim();\n  if (!host) return undefined;\n  try {\n    return new URL(`http://${host}`).hostname;\n  } catch {\n    return undefined;\n  }\n}\n\nexport async function serverClient(\n  deviceId: string | null,\n  config: ServerConfig = {},\n): Promise<FewchursClient> {\n  const apiKey = resolveApiKey(config.apiKey);\n  if (!apiKey) {\n    throw new Error(\n      \"[fewchurs] No API key. Set FEWCHURS_API_KEY in your environment, or pass apiKey to the server component or createHandler().\",\n    );\n  }\n\n  return createFewchursClient({\n    apiKey,\n    baseUrl: resolveBaseUrl(config.baseUrl),\n    deviceId,\n    language: config.language,\n    // Only read the request when needed, so a page with a set domain can still render statically.\n    appId: configuredAppId(config.appId) ?? requestHostname(await headers()),\n  });\n}\n"],"mappings":";;;;;;;AAAA,OAAO;AACP,SAAS,sBAAsB;;;ACD/B,OAAO;AACP,SAAS,eAAe;AACxB,SAAS,sBAAsB,wBAA6C;AAErE,IAAM,mBAAmB;AAUzB,SAAS,cAAc,QAAqC;AACjE,SAAO,UAAU,QAAQ,IAAI;AAC/B;AAEO,SAAS,eAAe,SAA0B;AACvD,SAAO,WAAW,QAAQ,IAAI,qBAAqB;AACrD;AAEO,SAAS,eAAe,SAA0B;AACvD,UAAQ,WAAW,QAAQ,IAAI,qBAAqB,kBAAkB,QAAQ,OAAO,EAAE;AACzF;AAGO,SAAS,gBAAgB,OAAoC;AAClE,SAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,KAAK,KAAK;AACjE;AAGO,SAAS,gBAAgB,gBAA6C;AAC3E,QAAM,YAAY,eAAe,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAC9E,QAAM,OAAO,aAAa,eAAe,IAAI,MAAM,GAAG,KAAK;AAC3D,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,IAAI,EAAE,EAAE;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,aACpB,UACA,SAAuB,CAAC,GACC;AACzB,QAAM,SAAS,cAAc,OAAO,MAAM;AAC1C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO,qBAAqB;AAAA,IAC1B;AAAA,IACA,SAAS,eAAe,OAAO,OAAO;AAAA,IACtC;AAAA,IACA,UAAU,OAAO;AAAA;AAAA,IAEjB,OAAO,gBAAgB,OAAO,KAAK,KAAK,gBAAgB,MAAM,QAAQ,CAAC;AAAA,EACzE,CAAC;AACH;;;AD3BA,IAAM,UAAsD;AAAA,EAC1D,EAAE,QAAQ,OAAO,SAAS,WAAW;AAAA,EACrC,EAAE,QAAQ,OAAO,SAAS,aAAa;AAAA,EACvC,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAAA,EACxC,EAAE,QAAQ,OAAO,SAAS,oBAAoB;AAAA,EAC9C,EAAE,QAAQ,QAAQ,SAAS,0BAA0B;AAAA,EACrD,EAAE,QAAQ,UAAU,SAAS,0BAA0B;AAAA,EACvD,EAAE,QAAQ,QAAQ,SAAS,4BAA4B;AAAA,EACvD,EAAE,QAAQ,UAAU,SAAS,4BAA4B;AAAA,EACzD,EAAE,QAAQ,OAAO,SAAS,8BAA8B;AAAA,EACxD,EAAE,QAAQ,QAAQ,SAAS,aAAa;AAC1C;AAEA,IAAM,oBAAoB;AAEnB,SAAS,cAAc,UAA0B,CAAC,GAIvD;AACA,iBAAe,OAAO,SAAkB,SAA8C;AACpF,UAAM,OAAO,MAAM,UAAU,SAAS,SAAS,eAAe,QAAQ,OAAO,CAAC;AAE9E,QAAI,CAAC,QAAQ,KAAK,CAAC,UAAU,MAAM,WAAW,QAAQ,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG;AACzF,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,SAAS,0BAA0B,EAAE,GAAG,GAAG;AAAA,IACvF;AAEA,UAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,QAAI,CAAC,QAAQ;AACX,cAAQ;AAAA,QACN;AAAA,MACF;AACA,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,8BAA8B,EAAE,GAAG,GAAG;AAAA,IAC1F;AAEA,UAAM,cAAc,WAAW,SAAS,gBAAgB;AACxD,UAAM,SAAS,QAAQ,WAAW,MAAM,QAAQ,SAAS,IAAI;AAC7D,UAAM,WAAW,UAAU,eAAe,gBAAgB,OAAO,KAAK,eAAe;AAErF,UAAM,SAAS,GAAG,eAAe,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,MAAM;AACvF,UAAMA,WAAkC;AAAA,MACtC,eAAe,UAAU,MAAM;AAAA,MAC/B,eAAe;AAAA,MACf,kBAAkB;AAAA,MAClB,qBACE,gBAAgB,QAAQ,KAAK,KAC7B,gBAAgB,QAAQ,OAAO,KAC/B,IAAI,IAAI,QAAQ,GAAG,EAAE;AAAA,MACvB,QAAQ;AAAA,IACV;AACA,UAAM,WAAW,QAAQ,QAAQ,IAAI,iBAAiB;AACtD,QAAI,SAAU,CAAAA,SAAQ,iBAAiB,IAAI;AAE3C,UAAM,OAAO,QAAQ,WAAW,QAAQ,SAAY,MAAM,QAAQ,KAAK;AACvE,QAAI,KAAM,CAAAA,SAAQ,cAAc,IAAI;AAEpC,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,QAAQ,EAAE,QAAQ,QAAQ,QAAQ,SAAAA,UAAS,MAAM,OAAO,WAAW,CAAC;AAAA,IAC7F,QAAQ;AACN,aAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,SAAS,4BAA4B,EAAE,GAAG,GAAG;AAAA,IACxF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,SAAS,WAAW,IAAK,YAAW,IAAI;AAE5C,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ,SAAS;AAAA,MACjB,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,IAC7E,CAAC;AAID,QAAI,CAAC,UAAU,aAAa,aAAa;AACvC,eAAS,QAAQ,OAAO,cAAc,gBAAgB,QAAQ,CAAC;AAAA,IACjE;AAEA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,OAAO;AACrD;AAEA,IAAM,iBAAiB,cAAc;AAE9B,IAAM,MAAM,eAAe;AAC3B,IAAM,OAAO,eAAe;AAC5B,IAAM,SAAS,eAAe;AAErC,IAAI,gBAAgB;AAGpB,SAAS,WAAW,MAAoB;AACtC,MAAI,cAAe;AACnB,MAAI;AACF,UAAM,QAAS,KAAK,MAAM,IAAI,EAAsD;AACpF,QAAI,OAAO,SAAS,YAAa;AACjC,oBAAgB;AAChB,YAAQ,MAAM,cAAc,MAAM,OAAO,EAAE;AAAA,EAC7C,QAAQ;AAAA,EAER;AACF;AAEA,eAAe,UACb,SACA,SACA,SACiB;AACjB,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,QAAQ,OAAO,OAAQ,QAAO,OAAO,MAAM,IAAI,kBAAkB,EAAE,KAAK,GAAG;AAE/E,QAAM,EAAE,SAAS,IAAI,IAAI,IAAI,QAAQ,GAAG;AACxC,QAAM,QAAQ,SAAS,QAAQ,OAAO;AACtC,SAAO,UAAU,KAAK,KAAK,SAAS,MAAM,QAAQ,QAAQ,MAAM,EAAE,QAAQ,OAAO,EAAE;AACrF;AAMA,SAAS,gBAAgB,SAAiC;AACxD,QAAM,UAAU,QAAQ,QAAQ,IAAI,aAAa;AACjD,SAAO,WAAW,kBAAkB,KAAK,OAAO,IAAI,UAAU;AAChE;AAEA,SAAS,WAAW,SAAkB,MAA6B;AACjE,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACnE,SAAO,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACrD;AAEA,SAAS,gBAAgB,UAA0B;AACjD,QAAM,QAAQ;AAAA,IACZ,GAAG,gBAAgB,IAAI,mBAAmB,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,WAAW,iBAAiB;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,aAAa,aAAc,OAAM,KAAK,QAAQ;AAC9D,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,KAAK,MAAe,QAA0B;AACrD,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,EAC7E,CAAC;AACH;","names":["headers"]}