@luckystack/core 0.1.8 → 0.2.0

package/dist/client.js

@@ -1,485 +1,133 @@
-// src/projectConfig.ts
-var DEFAULT_PROJECT_CONFIG = {
-  app: {
-    publicUrl: ""
-  },
-  logging: {
-    devLogs: false,
-    devNotifications: false,
-    socketStatus: false,
-    socketStartup: false,
-    stream: false
-  },
-  rateLimiting: {
-    enabled: true,
-    store: "memory",
-    redisKeyPrefix: "rate-limit",
-    defaultApiLimit: 60,
-    defaultIpLimit: 100,
-    windowMs: 6e4,
-    cleanupIntervalMs: 6e4
-  },
-  session: {
-    basedToken: false,
-    expiryDays: 7,
-    allowMultiple: false,
-    perBrowser: "single",
-    perUser: "single",
-    maxConcurrentPerUser: null,
-    onConflict: "revokeOld",
-    notifyOldDeviceOnRevoke: true,
-    //? Empty default — `getProjectName()` reads `process.env.PROJECT_NAME` at
-    //? call time and falls back to `'luckystack'`. Avoids capturing env at
-    //? module-load before dotenv runs.
-    projectName: ""
-  },
-  http: {
-    sessionCookieName: "token",
-    sessionCookieSameSite: "Strict",
-    sessionCookiePath: "/",
-    requestBodyMaxBytes: 1024 * 1024,
-    healthEndpoint: "/_health",
-    liveEndpoint: "/livez",
-    readyEndpoint: "/readyz",
-    testResetEndpoint: "/_test/reset",
-    stream: {
-      queryParam: "stream",
-      enabledValue: "true",
-      connectedComment: ": connected"
-    },
-    securityHeaders: {
-      frameOptions: "SAMEORIGIN",
-      referrerPolicy: "no-referrer",
-      xssProtection: "1; mode=block",
-      contentTypeOptions: "nosniff"
-    },
-    cors: {
-      allowedMethods: "GET, POST, PUT, DELETE, OPTIONS",
-      allowedHeaders: "Content-Type, Authorization, X-Session-Based-Token, X-CSRF-Token, X-Request-Id",
-      exposedHeaders: "X-Session-Token, X-Request-Id",
-      credentials: true,
-      allowedOrigins: [],
-      allowLocalhost: false
-    }
-  },
-  auth: {
-    oauthStateTtlSeconds: 60 * 10,
-    passwordMinLength: 8,
-    passwordMaxLength: 191,
-    passwordPolicy: {
-      minLength: 8,
-      maxLength: 191,
-      requireUppercase: false,
-      requireLowercase: false,
-      requireNumber: false,
-      requireSpecial: false,
-      forbidCommon: true
-    },
-    emailMaxLength: 191,
-    nameMaxLength: 191,
-    bcryptRounds: 10,
-    providerAccountStrategy: "per-provider",
-    forgotPassword: "disabled",
-    passwordResetTtlSeconds: 60 * 60,
-    emailChangeTtlSeconds: 60 * 60
-  },
-  socket: {
-    maxHttpBufferSize: 5 * 1024 * 1024,
-    pingTimeout: 2e4,
-    pingInterval: 25e3
-  },
-  sync: {
-    streamThrottle: {
-      flushAtChars: 32,
-      flushEveryMs: 50,
-      field: "chunk"
-    },
-    fanoutYieldEvery: 100,
-    fanoutYieldMs: 1
-  },
-  offlineQueue: {
-    maxSize: 200,
-    maxAgeMs: 60 * 60 * 1e3,
-    dropPolicy: "drop-oldest"
-  },
-  dev: {
-    hotReloadDebounceMs: 120,
-    watcherStabilityThresholdMs: 120,
-    watcherPollIntervalMs: 20
-  },
-  paths: {
-    srcDir: "src",
-    serverDir: "server",
-    sharedDir: "shared",
-    uploadsDir: "uploads",
-    publicDir: "public",
-    serverFunctionsDir: "server/functions",
-    serverFunctionDirs: ["functions", "shared"],
-    generatedSocketTypes: "src/_sockets/apiTypes.generated.ts",
-    generatedApiSchemas: "src/_sockets/apiInputSchemas.generated.ts",
-    generatedApiDocs: "src/docs/apiDocs.generated.json"
-  },
-  defaultLanguage: "en",
-  defaultTheme: "light",
-  socketActivityBroadcaster: false,
-  socketStatusIndicator: false,
-  locationProviderEnabled: false,
-  loginRedirectUrl: "/"
-};
-var isPlainObject = (value) => {
-  if (value === null || typeof value !== "object") return false;
-  const proto = Object.getPrototypeOf(value);
-  return proto === Object.prototype || proto === null;
-};
-var deepMerge = (base, override) => {
-  if (override === void 0) return base;
-  if (!isPlainObject(base) || !isPlainObject(override)) {
-    return override ?? base;
-  }
-  const result = { ...base };
-  for (const [key, overrideValue] of Object.entries(override)) {
-    if (overrideValue === void 0) continue;
-    const baseValue = base[key];
-    result[key] = isPlainObject(baseValue) && isPlainObject(overrideValue) ? deepMerge(baseValue, overrideValue) : overrideValue;
-  }
-  return result;
-};
-var activeConfig = DEFAULT_PROJECT_CONFIG;
-var isRegistered = false;
-var registerProjectConfig = (config) => {
-  activeConfig = deepMerge(DEFAULT_PROJECT_CONFIG, config);
-  isRegistered = true;
-};
-var getProjectConfig = () => activeConfig;
-var isProjectConfigRegistered = () => isRegistered;
+import {
+  DEFAULT_PAGE_ROUTE_RULES,
+  buildApiResponseEventName,
+  buildApiStreamEventName,
+  buildGetJoinedRoomsResponseEventName,
+  buildJoinRoomResponseEventName,
+  buildLeaveRoomResponseEventName,
+  buildSyncProgressEventName,
+  buildSyncResponseEventName,
+  clearCsrfToken,
+  dispatchClientHook,
+  dispatchVetoableClientHook,
+  enqueueApiRequest,
+  enqueueSyncRequest,
+  flushApiQueue,
+  flushSyncQueue,
+  getApiQueueSize,
+  getCsrfToken,
+  getNotifier,
+  getRegisteredApiMethod,
+  getSyncQueueSize,
+  httpFetch,
+  incrementResponseIndex,
+  isApiMethodMapRegistered,
+  isGetMethodName,
+  isOnline,
+  normalizeErrorResponseCore,
+  notify,
+  parseServiceRouteName,
+  registerApiMethodMap,
+  registerClientHook,
+  registerNotifier,
+  removeApiQueueItem,
+  removeApiQueueItemsByKey,
+  removeSyncQueueItem,
+  setSocket,
+  sleep,
+  socket,
+  socketEventNames,
+  tryCatchSync,
+  validatePagePath,
+  waitForSocket
+} from "./chunk-OZTB2RL2.js";
+import {
+  getProjectConfig,
+  isProjectConfigRegistered,
+  registerProjectConfig
+} from "./chunk-W62GGT2P.js";
+import {
+  getLogger,
+  registerLogger
+} from "./chunk-V2WKGTZH.js";
+import "./chunk-USQA6QTX.js";
 
-// src/loggerRegistry.ts
-var defaultLogger = {
-  debug: (message, context) => {
-    if (context === void 0) {
-      console.debug(message);
-    } else {
-      console.debug(message, context);
-    }
-  },
-  info: (message, context) => {
-    if (context === void 0) {
-      console.info(message);
-    } else {
-      console.info(message, context);
-    }
-  },
-  warn: (message, context) => {
-    if (context === void 0) {
-      console.warn(message);
-    } else {
-      console.warn(message, context);
-    }
-  },
-  error: (message, error, context) => {
-    if (error !== void 0 && context !== void 0) console.error(message, error, context);
-    else if (error !== void 0) console.error(message, error);
-    else if (context === void 0) {
-      console.error(message);
-    } else {
-      console.error(message, context);
+// src/apiInterceptors.ts
+var requestInterceptors = /* @__PURE__ */ new Set();
+var responseInterceptors = /* @__PURE__ */ new Set();
+function registerApiRequestInterceptor(interceptor) {
+  requestInterceptors.add(interceptor);
+  return () => {
+    requestInterceptors.delete(interceptor);
+  };
+}
+function registerApiResponseInterceptor(interceptor) {
+  responseInterceptors.add(interceptor);
+  return () => {
+    responseInterceptors.delete(interceptor);
+  };
+}
+async function dispatchApiRequestInterceptors(ctx) {
+  if (requestInterceptors.size === 0) return;
+  const interceptors = [...requestInterceptors];
+  for (const interceptor of interceptors) {
+    try {
+      await interceptor(ctx);
+    } catch (error) {
+      getLogger().error("[apiRequestInterceptor] handler threw", error);
     }
   }
-};
-var activeLogger = defaultLogger;
-var isRegistered2 = false;
-var registerLogger = (logger) => {
-  activeLogger = logger;
-  isRegistered2 = true;
-};
-var getLogger = () => activeLogger;
-
-// src/apiMethodMapRegistry.ts
-var activeMap = null;
-var registerApiMethodMap = (map) => {
-  activeMap = map;
-};
-var getRegisteredApiMethod = (pagePath, apiName, version) => {
-  if (!activeMap) return void 0;
-  return activeMap[pagePath]?.[apiName]?.[version];
-};
-var isApiMethodMapRegistered = () => activeMap !== null;
-
-// src/socketState.ts
-var socket = null;
-var setSocket = (next) => {
-  socket = next;
-};
-var responseIndex = 0;
-var WAIT_FOR_SOCKET_INTERVAL_MS = 10;
-var WAIT_FOR_SOCKET_MAX_ITERATIONS = 500;
-var incrementResponseIndex = () => {
-  responseIndex = responseIndex + 1;
-  return responseIndex;
-};
-var waitForSocket = async () => {
-  let i = 0;
-  while (!socket) {
-    await new Promise((resolve2) => setTimeout(resolve2, WAIT_FOR_SOCKET_INTERVAL_MS));
-    i++;
-    if (i > WAIT_FOR_SOCKET_MAX_ITERATIONS) {
-      return null;
+}
+function dispatchApiResponseInterceptors(ctx) {
+  if (responseInterceptors.size === 0) return;
+  const interceptors = [...responseInterceptors];
+  for (const interceptor of interceptors) {
+    try {
+      const result = interceptor(ctx);
+      if (result && typeof result.catch === "function") {
+        result.catch((error) => {
+          getLogger().error("[apiResponseInterceptor] async handler rejected", error);
+        });
+      }
+    } catch (error) {
+      getLogger().error("[apiResponseInterceptor] handler threw", error);
     }
   }
-  return socket;
-};
-
-// src/notifier.ts
-var noopNotifier = {
-  success: () => {
-  },
-  error: () => {
-  },
-  info: () => {
-  },
-  warning: () => {
-  }
-};
-var activeNotifier = noopNotifier;
-var registerNotifier = (notifier) => {
-  activeNotifier = notifier;
-};
-var getNotifier = () => activeNotifier;
-var notify = {
-  success: (input) => {
-    activeNotifier.success(input);
-  },
-  error: (input) => {
-    activeNotifier.error(input);
-  },
-  info: (input) => {
-    activeNotifier.info(input);
-  },
-  warning: (input) => {
-    activeNotifier.warning(input);
-  }
-};
+}
 
-// src/offlineQueue.ts
-var apiQueue = [];
-var syncQueue = [];
-var isFlushingApi = false;
-var isFlushingSync = false;
-var isOnline = () => {
-  if (typeof navigator === "undefined") return true;
-  return navigator.onLine;
-};
-var evictExpired = (queue) => {
-  const maxAgeMs = getProjectConfig().offlineQueue.maxAgeMs;
-  if (maxAgeMs <= 0) return;
-  const cutoff = Date.now() - maxAgeMs;
-  for (let i = queue.length - 1; i >= 0; i -= 1) {
-    const item = queue[i];
-    if (item && item.createdAt < cutoff) {
-      queue.splice(i, 1);
-    }
-  }
-};
-var enqueueWithPolicy = (queue, item, label) => {
-  evictExpired(queue);
-  const { maxSize, dropPolicy: globalPolicy } = getProjectConfig().offlineQueue;
-  const effectivePolicy = item.dropPolicy ?? globalPolicy;
-  if (queue.length < maxSize) {
-    queue.push(item);
-    return true;
-  }
-  if (effectivePolicy === "drop-oldest") {
-    queue.shift();
-    queue.push(item);
-    getLogger().debug(`offlineQueue:${label} full \u2014 dropped oldest item (policy=${effectivePolicy})`);
-    return true;
-  }
-  if (effectivePolicy === "drop-newest") {
-    getLogger().debug(`offlineQueue:${label} full \u2014 dropped newest item (policy=${effectivePolicy})`);
-    return false;
-  }
-  getLogger().warn(`offlineQueue:${label} full \u2014 rejecting enqueue (policy=${effectivePolicy})`);
-  return false;
-};
-var enqueueApiRequest = (item) => enqueueWithPolicy(apiQueue, item, "api");
-var enqueueSyncRequest = (item) => enqueueWithPolicy(syncQueue, item, "sync");
-var removeApiQueueItem = (id) => {
-  const index = apiQueue.findIndex((item) => item.id === id);
-  if (index !== -1) {
-    apiQueue.splice(index, 1);
-  }
-};
-var removeSyncQueueItem = (id) => {
-  const index = syncQueue.findIndex((item) => item.id === id);
-  if (index !== -1) {
-    syncQueue.splice(index, 1);
-  }
-};
-var removeApiQueueItemsByKey = (key) => {
-  for (let i = apiQueue.length - 1; i >= 0; i -= 1) {
-    if (apiQueue[i]?.key === key) {
-      apiQueue.splice(i, 1);
+// src/apiRequest.ts
+var abortControllers = /* @__PURE__ */ new Map();
+var stableStringify = (value) => {
+  const seen = /* @__PURE__ */ new WeakSet();
+  const walk = (input) => {
+    if (input === null || typeof input !== "object") return input;
+    if (seen.has(input)) return "[circular]";
+    seen.add(input);
+    if (Array.isArray(input)) return input.map((entry) => walk(entry));
+    const record = input;
+    const out = {};
+    for (const key of Object.keys(record).toSorted()) {
+      out[key] = walk(record[key]);
     }
-  }
-};
-var flushApiQueue = (canRun, socketInstance) => {
-  if (isFlushingApi) return;
-  evictExpired(apiQueue);
-  if (apiQueue.length === 0) return;
-  if (!canRun()) return;
-  isFlushingApi = true;
-  while (apiQueue.length > 0) {
-    if (!canRun()) break;
-    const item = apiQueue.shift();
-    item?.run(socketInstance);
-  }
-  isFlushingApi = false;
-};
-var flushSyncQueue = (canRun, socketInstance) => {
-  if (isFlushingSync) return;
-  evictExpired(syncQueue);
-  if (syncQueue.length === 0) return;
-  if (!canRun()) return;
-  isFlushingSync = true;
-  while (syncQueue.length > 0) {
-    if (!canRun()) break;
-    const item = syncQueue.shift();
-    item?.run(socketInstance);
-  }
-  isFlushingSync = false;
-};
-var getApiQueueSize = () => apiQueue.length;
-var getSyncQueueSize = () => syncQueue.length;
-
-// src/responseNormalizer.ts
-var INVALID_ERROR_RESPONSE_CODE = "error.invalidResponse";
-var isErrorParamArray = (value) => {
-  return Array.isArray(value) && value.every((item) => {
-    return !!item && typeof item === "object" && typeof item.key === "string" && ["string", "number", "boolean"].includes(typeof item.value);
-  });
-};
-var normalizeErrorResponseCore = ({
-  response,
-  fallbackHttpStatus,
-  fallbackErrorCode,
-  resolveMessage
-}) => {
-  const normalizedParams = isErrorParamArray(response.errorParams) ? response.errorParams : void 0;
-  const errorCodeValue = typeof response.errorCode === "string" ? response.errorCode.trim() : "";
-  const hasErrorCode = errorCodeValue.length > 0;
-  const finalErrorCode = hasErrorCode ? errorCodeValue : fallbackErrorCode ?? INVALID_ERROR_RESPONSE_CODE;
-  const providedHttpStatus = typeof response.httpStatus === "number" ? response.httpStatus : void 0;
-  const message = resolveMessage ? resolveMessage({ errorCode: finalErrorCode, errorParams: normalizedParams }) : finalErrorCode;
-  return {
-    status: "error",
-    message,
-    errorCode: finalErrorCode,
-    errorParams: normalizedParams,
-    httpStatus: providedHttpStatus ?? fallbackHttpStatus
+    return out;
   };
-};
-
-// src/serviceRoute.ts
-var normalizeRawRoute = (value) => {
-  return value.trim().replaceAll("\\", "/").replaceAll(/^\/+/g, "").replaceAll(/\/+$/g, "");
-};
-var hasEmptySegments = (value) => {
-  return value.split("/").some((segment) => segment.length === 0);
-};
-var parseServiceRouteName = (value) => {
-  const normalized = normalizeRawRoute(value);
-  if (!normalized) {
-    return { status: "error", reason: "Route name cannot be empty." };
+  const [error, json] = tryCatchSync(() => JSON.stringify(walk(value)));
+  if (error || typeof json !== "string") {
+    return `__unserializable__:${String(Date.now())}-${String(Math.random())}`;
   }
-  if (hasEmptySegments(normalized)) {
-    return { status: "error", reason: "Route name cannot contain empty segments." };
-  }
-  const segments = normalized.split("/");
-  if (segments.length < 2) {
-    return { status: "error", reason: "Route name must include service and route segments." };
-  }
-  const [service, ...routeSegments] = segments;
-  const routeName = routeSegments.join("/");
-  if (!service || !routeName) {
-    return { status: "error", reason: "Route name must include service and route segments." };
-  }
-  return {
-    status: "success",
-    normalizedRouteName: `${service}/${routeName}`,
-    service,
-    routeName
-  };
-};
-
-// src/socketEvents.ts
-var withIndex = (prefix, responseIndex2) => {
-  return `${prefix}${String(responseIndex2)}`;
-};
-var socketEventNames = {
-  apiRequest: "apiRequest",
-  apiCancel: "apiCancel",
-  sync: "sync",
-  syncCancel: "syncCancel",
-  joinRoom: "joinRoom",
-  leaveRoom: "leaveRoom",
-  getJoinedRooms: "getJoinedRooms",
-  updateLocation: "updateLocation",
-  updateSession: "updateSession",
-  sessionReplaced: "sessionReplaced",
-  logout: "logout",
-  intentionalDisconnect: "intentionalDisconnect",
-  intentionalReconnect: "intentionalReconnect",
-  userAfk: "userAfk",
-  userBack: "userBack",
-  connect: "connect",
-  disconnect: "disconnect",
-  reconnectAttempt: "reconnect_attempt",
-  connectError: "connect_error",
-  apiResponsePrefix: "apiResponse-",
-  apiStreamPrefix: "apiStream-",
-  syncResponsePrefix: "sync-",
-  syncProgressPrefix: "sync-progress-",
-  joinRoomResponsePrefix: "joinRoom-",
-  leaveRoomResponsePrefix: "leaveRoom-",
-  getJoinedRoomsResponsePrefix: "getJoinedRooms-"
+  return json;
 };
-var buildApiResponseEventName = (responseIndex2) => {
-  return withIndex(socketEventNames.apiResponsePrefix, responseIndex2);
-};
-var buildApiStreamEventName = (responseIndex2) => {
-  return withIndex(socketEventNames.apiStreamPrefix, responseIndex2);
-};
-var buildSyncResponseEventName = (responseIndex2) => {
-  return withIndex(socketEventNames.syncResponsePrefix, responseIndex2);
-};
-var buildSyncProgressEventName = (responseIndex2) => {
-  return withIndex(socketEventNames.syncProgressPrefix, responseIndex2);
-};
-var buildJoinRoomResponseEventName = (responseIndex2) => {
-  return withIndex(socketEventNames.joinRoomResponsePrefix, responseIndex2);
-};
-var buildLeaveRoomResponseEventName = (responseIndex2) => {
-  return withIndex(socketEventNames.leaveRoomResponsePrefix, responseIndex2);
-};
-var buildGetJoinedRoomsResponseEventName = (responseIndex2) => {
-  return withIndex(socketEventNames.getJoinedRoomsResponsePrefix, responseIndex2);
-};
-
-// src/apiRequest.ts
-var abortControllers = /* @__PURE__ */ new Map();
-var isGetMethodByPrefix = (apiName) => {
-  const lower = apiName.toLowerCase();
-  return lower.startsWith("get") || lower.startsWith("fetch") || lower.startsWith("list");
-};
-var isGetMethod = (apiName, version) => {
+var buildAbortKey = (fullName, data) => `${fullName}::${stableStringify(data)}`;
+var isGetMethodByPrefix = (apiName) => isGetMethodName(apiName.toLowerCase());
+var resolveGetMethod = (apiName, version) => {
   const lastSlash = apiName.lastIndexOf("/");
   if (lastSlash > 0) {
     const pagePath = apiName.slice(0, lastSlash);
     const leaf = apiName.slice(lastSlash + 1);
     const method = getRegisteredApiMethod(pagePath, leaf, version);
-    if (method) return method === "GET";
+    if (method) return { isGet: method === "GET", usingHeuristic: false };
   }
-  return isGetMethodByPrefix(apiName);
+  return { isGet: isGetMethodByPrefix(apiName), usingHeuristic: true };
 };
 var canSendNow = (socketInstance) => {
   if (!socketInstance.connected) return false;
@@ -494,10 +142,12 @@ var shouldNotifyDev = () => getLogging().devNotifications;
 var shouldLogStream = () => getLogging().stream;
 var shouldUseAbortController = ({
   abortable,
-  isGet
+  isGet,
+  usingHeuristic
 }) => {
   if (abortable === true) return true;
   if (abortable === false) return false;
+  if (usingHeuristic) return false;
   return isGet;
 };
 var normalizeApiError = ({
@@ -526,9 +176,9 @@ var normalizeApiError = ({
 };
 function apiRequest(params) {
   const runtimeParams = params;
-  const { name, version, disableErrorMessage = false, onStream, signal: externalSignal } = runtimeParams;
+  const { name, version, disableErrorMessage = false, onStream, signal: externalSignal, timeoutMs } = runtimeParams;
   const payloadData = runtimeParams.data;
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve2) => {
     void (async () => {
       if (externalSignal?.aborted) {
         resolve2(normalizeApiError({
@@ -597,58 +247,102 @@ function apiRequest(params) {
         }));
         return;
       }
-      const isGet = isGetMethod(sanitizedName, version);
+      const { isGet, usingHeuristic } = resolveGetMethod(sanitizedName, version);
       const useAbortController = shouldUseAbortController({
         abortable: runtimeParams.abortable,
-        isGet
+        isGet,
+        usingHeuristic
       });
       const fullName = `api/${sanitizedName}/${version}`;
+      const abortKey = buildAbortKey(fullName, data);
       let signal = null;
       let abortHandler = null;
       let queueId = null;
       let cleanupStreamListener = null;
+      let cleanupResponseListener = null;
+      let responseTimeout = null;
+      const clearResponseTimeout = () => {
+        if (responseTimeout) {
+          clearTimeout(responseTimeout);
+          responseTimeout = null;
+        }
+      };
       const cleanupAbortController = () => {
         if (signal && abortHandler) {
           signal.removeEventListener("abort", abortHandler);
         }
-        abortControllers.delete(fullName);
+        abortControllers.delete(abortKey);
       };
       if (useAbortController) {
-        if (abortControllers.has(fullName)) {
-          const prevAbortController = abortControllers.get(fullName);
+        if (abortControllers.has(abortKey)) {
+          const prevAbortController = abortControllers.get(abortKey);
           prevAbortController?.abort();
         }
         const abortController = new AbortController();
-        abortControllers.set(fullName, abortController);
+        abortControllers.set(abortKey, abortController);
         signal = abortController.signal;
         abortHandler = () => {
+          clearResponseTimeout();
           cleanupStreamListener?.();
           cleanupStreamListener = null;
+          cleanupResponseListener?.();
+          cleanupResponseListener = null;
           cleanupAbortController();
           if (queueId) {
             removeApiQueueItem(queueId);
           }
-          reject(new Error(`Request ${fullName} aborted`));
+          resolve2(normalizeApiError({
+            response: { status: "error", errorCode: "request.aborted" },
+            fallbackErrorCode: "request.aborted"
+          }));
         };
         signal.addEventListener("abort", abortHandler);
       }
       const runRequest = (socketInstance) => {
         if (!canSendNow(socketInstance)) {
           queueId ??= createQueueId();
+          let suppressOnDrop = true;
           const enqueued = enqueueApiRequest({
             id: queueId,
             key: fullName,
             run: (nextSocket) => {
               runRequest(nextSocket);
             },
-            createdAt: Date.now()
+            createdAt: Date.now(),
+            //? CORE: mirror SYNC-09. Settle the awaiting caller when this
+            //? QUEUED request is later EVICTED (drop-oldest by a future
+            //? enqueue / age expiry) instead of ever running. Without it the
+            //? promise hangs forever, since `run` is the only thing that could
+            //? otherwise resolve it — `apiRequest` had drifted from the sibling
+            //? `syncRequest` which already had this fix. Also tear down the
+            //? abort-controller registry entry so it isn't leaked.
+            onDrop: (reason) => {
+              if (suppressOnDrop) return;
+              cleanupAbortController();
+              resolve2(normalizeApiError({
+                response: { status: "error", errorCode: "offline.dropped", errorParams: [{ key: "reason", value: reason }] },
+                fallbackErrorCode: "offline.dropped"
+              }));
+            }
           });
+          suppressOnDrop = false;
           if (!enqueued) {
             resolve2(normalizeApiError({
               response: { status: "error", errorCode: "offline.queueFull", httpStatus: 503 },
               fallbackErrorCode: "offline.queueFull",
               fallbackHttpStatus: 503
             }));
+          } else if (externalSignal && queueId) {
+            const capturedQueueId = queueId;
+            const queueAbortHandler = () => {
+              removeApiQueueItem(capturedQueueId);
+              cleanupAbortController();
+              resolve2(normalizeApiError({
+                response: { status: "error", errorCode: "request.aborted" },
+                fallbackErrorCode: "request.aborted"
+              }));
+            };
+            externalSignal.addEventListener("abort", queueAbortHandler, { once: true });
           }
           return;
         }
@@ -660,9 +354,12 @@ function apiRequest(params) {
         let cleanupExternalAbort = null;
         if (externalSignal) {
           const externalAbortHandler = () => {
+            clearResponseTimeout();
             socketInstance.emit(socketEventNames.apiCancel, { responseIndex: tempIndex });
             cleanupStreamListener?.();
             cleanupStreamListener = null;
+            cleanupResponseListener?.();
+            cleanupResponseListener = null;
             cleanupAbortController();
             cleanupExternalAbort?.();
             cleanupExternalAbort = null;
@@ -676,6 +373,28 @@ function apiRequest(params) {
             externalSignal.removeEventListener("abort", externalAbortHandler);
           };
         }
+        clearResponseTimeout();
+        const effectiveTimeoutMs = timeoutMs ?? getProjectConfig().api.requestTimeoutMs;
+        if (typeof effectiveTimeoutMs === "number" && effectiveTimeoutMs > 0) {
+          responseTimeout = setTimeout(() => {
+            responseTimeout = null;
+            cleanupStreamListener?.();
+            cleanupStreamListener = null;
+            cleanupResponseListener?.();
+            cleanupResponseListener = null;
+            cleanupExternalAbort?.();
+            cleanupExternalAbort = null;
+            cleanupAbortController();
+            if (queueId) {
+              removeApiQueueItem(queueId);
+            }
+            resolve2(normalizeApiError({
+              response: { status: "error", errorCode: "api.timeout", httpStatus: 504 },
+              fallbackErrorCode: "api.timeout",
+              fallbackHttpStatus: 504
+            }));
+          }, effectiveTimeoutMs);
+        }
         if (typeof onStream === "function") {
           const streamEventName = buildApiStreamEventName(tempIndex);
           const streamListener = (streamPayload) => {
@@ -695,17 +414,23 @@ function apiRequest(params) {
         if (shouldLogDev()) {
           getLogger().debug(`Client API Request(${String(tempIndex)})`, { APINAME: sanitizedName, data });
         }
-        socketInstance.once(buildApiResponseEventName(tempIndex), (response) => {
+        const responseEventName = buildApiResponseEventName(tempIndex);
+        const responseListener = (response) => {
           if (signal?.aborted) {
+            clearResponseTimeout();
             cleanupExternalAbort?.();
             cleanupExternalAbort = null;
             return;
           }
+          clearResponseTimeout();
           cleanupStreamListener?.();
           cleanupStreamListener = null;
           cleanupExternalAbort?.();
           cleanupExternalAbort = null;
+          cleanupResponseListener?.();
+          cleanupResponseListener = null;
           const status = response.status;
+          dispatchApiResponseInterceptors({ name: sanitizedName, version, response });
           if (shouldLogDev()) {
             getLogger().debug(`Server API Response(${String(tempIndex)})`, { ...response, APINAME: sanitizedName });
           }
@@ -725,154 +450,63 @@ function apiRequest(params) {
           }
           cleanupAbortController();
           resolve2(response);
-        });
+        };
+        socketInstance.once(responseEventName, responseListener);
+        cleanupResponseListener = () => {
+          socketInstance.off(responseEventName, responseListener);
+        };
+        const disconnectHandler = () => {
+          if (cleanupResponseListener) {
+            cleanupResponseListener();
+            cleanupResponseListener = null;
+          }
+          cleanupStreamListener?.();
+          cleanupStreamListener = null;
+          cleanupExternalAbort?.();
+          cleanupExternalAbort = null;
+          clearResponseTimeout();
+          cleanupAbortController();
+          resolve2(normalizeApiError({
+            response: { status: "error", errorCode: "api.disconnected" },
+            fallbackErrorCode: "api.disconnected"
+          }));
+        };
+        socketInstance.once("disconnect", disconnectHandler);
+        const originalCleanupResponseListener = cleanupResponseListener;
+        cleanupResponseListener = () => {
+          socketInstance.off("disconnect", disconnectHandler);
+          originalCleanupResponseListener();
+        };
       };
+      await dispatchApiRequestInterceptors({
+        name: sanitizedName,
+        version,
+        data
+      });
+      if (externalSignal?.aborted) {
+        resolve2(normalizeApiError({
+          response: { status: "error", errorCode: "request.aborted" },
+          fallbackErrorCode: "request.aborted"
+        }));
+        return;
+      }
       runRequest(socket);
     })();
   });
 }
 
-// src/sleep.ts
-function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
-}
-
-// src/errorTrackerRegistry.ts
-var activeTrackers = [];
-var captureExceptionAcrossTrackers = (error, context) => {
-  for (const tracker of activeTrackers) {
-    try {
-      tracker.captureException(error, context);
-    } catch {
-    }
-  }
-};
-
-// src/sentrySetup.ts
-var sentry;
-var captureException = (error, context) => {
-  if (sentry) {
-    if (context) {
-      sentry.captureException(error, { extra: context });
-    } else {
-      sentry.captureException(error);
-    }
-  }
-  captureExceptionAcrossTrackers(error, context);
-};
-
-// src/tryCatch.ts
+// src/tryCatchClient.ts
 async function tryCatch(func, params, context) {
   try {
     const response = await func(params);
     return [null, response];
   } catch (error) {
+    const { captureException } = await import("./sentrySetup-Q4BKUAQ3.js");
     captureException(error, context);
     return [error, null];
   }
 }
 
-// src/csrfConfig.ts
-var DEFAULT_CSRF_CONFIG = {
-  cookieName: "csrf-token",
-  headerName: "x-csrf-token",
-  tokenLength: 32,
-  cookieOptions: {
-    sameSite: "lax",
-    secure: true,
-    httpOnly: false,
-    path: "/",
-    maxAgeMs: 24 * 60 * 60 * 1e3
-  }
-};
-var active = DEFAULT_CSRF_CONFIG;
-var getCsrfConfig = () => active;
-
-// src/csrf.ts
-var cachedToken = null;
-var inflightFetch = null;
-var resolveBackendUrl = () => {
-  if (globalThis.window !== void 0 && globalThis.location?.origin) {
-    return globalThis.location.origin;
-  }
-  return "";
-};
-var fetchCsrfToken = async () => {
-  const base = resolveBackendUrl();
-  const [error, token] = await tryCatch(async () => {
-    const response = await fetch(`${base}/auth/csrf`, {
-      method: "GET",
-      credentials: "include"
-    });
-    if (!response.ok) return null;
-    const body = await response.json();
-    return body.csrfToken ?? null;
-  });
-  if (error) return null;
-  return token ?? null;
-};
-var getCsrfToken = async () => {
-  if (getProjectConfig().session.basedToken) {
-    return null;
-  }
-  if (cachedToken) return cachedToken;
-  if (inflightFetch) return inflightFetch;
-  inflightFetch = fetchCsrfToken().then((token) => {
-    cachedToken = token;
-    inflightFetch = null;
-    return token;
-  });
-  return inflightFetch;
-};
-var clearCsrfToken = () => {
-  cachedToken = null;
-  inflightFetch = null;
-};
-var STATE_CHANGING = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
-var isCsrfMismatchResponse = async (response) => {
-  if (response.status !== 403) return false;
-  const [error, isMismatch] = await tryCatch(async () => {
-    const cloned = response.clone();
-    const body = await cloned.json();
-    return body.errorCode === "auth.csrfMismatch";
-  });
-  if (error) return false;
-  return isMismatch ?? false;
-};
-var httpFetch = async (input, init = {}) => {
-  const method = (init.method ?? "GET").toUpperCase();
-  const headers = new Headers(init.headers);
-  if (!headers.has("Content-Type") && init.body && typeof init.body === "string") {
-    headers.set("Content-Type", "application/json");
-  }
-  const csrfHeaderName = getCsrfConfig().headerName;
-  const send = async (csrfToken) => {
-    const finalHeaders = new Headers(headers);
-    if (csrfToken && STATE_CHANGING.has(method) && !finalHeaders.has(csrfHeaderName)) {
-      finalHeaders.set(csrfHeaderName, csrfToken);
-    }
-    return fetch(input, {
-      ...init,
-      method,
-      headers: finalHeaders,
-      credentials: init.credentials ?? "include"
-    });
-  };
-  if (!STATE_CHANGING.has(method) || getProjectConfig().session.basedToken) {
-    return send(null);
-  }
-  const token = await getCsrfToken();
-  let response = await send(token);
-  if (await isCsrfMismatchResponse(response)) {
-    clearCsrfToken();
-    const refreshed = await getCsrfToken();
-    if (refreshed) {
-      response = await send(refreshed);
-    }
-  }
-  return response;
-};
-
 // src/localesRegistry.ts
 var activeLocales = {};
 var activeLanguageSource = null;
@@ -912,98 +546,6 @@ var registerPageMiddleware = (path, middleware) => {
 var getPageMiddleware = (path) => pageMiddlewares.get(path);
 var hasPageMiddleware = (path) => pageMiddlewares.has(path);
 
-// src/clientHookBus.ts
-var handlerSets = {};
-function registerClientHook(name, handler) {
-  const existing = handlerSets[name];
-  const set = existing ?? /* @__PURE__ */ new Set();
-  if (!existing) handlerSets[name] = set;
-  const wrapped = handler;
-  set.add(wrapped);
-  return () => {
-    set.delete(wrapped);
-  };
-}
-function dispatchClientHook(name, payload) {
-  const set = handlerSets[name];
-  if (!set || set.size === 0) return;
-  for (const handler of set) {
-    try {
-      const result = handler(payload);
-      if (result && typeof result.catch === "function") {
-        result.catch((error) => {
-          console.error(`[clientHook:${name}] async handler rejected:`, error);
-        });
-      }
-    } catch (error) {
-      console.error(`[clientHook:${name}] handler threw:`, error);
-    }
-  }
-}
-async function dispatchVetoableClientHook(name, payload) {
-  const set = handlerSets[name];
-  if (!set || set.size === 0) return { stopped: false };
-  for (const handler of set) {
-    let result;
-    try {
-      result = await handler(payload);
-    } catch (error) {
-      console.error(`[clientHook:${name}] vetoable handler threw:`, error);
-      continue;
-    }
-    if (result?.stop) {
-      return { stopped: true, signal: result };
-    }
-  }
-  return { stopped: false };
-}
-
-// src/pageRouteValidation.ts
-var DEFAULT_PAGE_ROUTE_RULES = {
-  privateFolderPrefix: "_",
-  scaffoldIgnoredFolders: [
-    "_api",
-    "_sync",
-    "_function",
-    "_functions",
-    "_component",
-    "_components",
-    "_provider",
-    "_providers",
-    "_locale",
-    "_locales",
-    "_socket",
-    "_sockets",
-    "_shared",
-    "_server"
-  ]
-};
-var validatePagePath = (srcRelativePath, rules = DEFAULT_PAGE_ROUTE_RULES) => {
-  const normalized = srcRelativePath.replaceAll("\\", "/").replace(/^\.\//, "").replace(/^\/+/, "");
-  const segments = normalized.split("/").filter((segment) => segment.length > 0);
-  if (segments.length === 0) {
-    return { valid: false, reason: "empty path" };
-  }
-  const filename = segments.at(-1);
-  if (filename !== "page.tsx" && filename !== "page.jsx") {
-    return { valid: false, reason: "not a page file (expected page.tsx)" };
-  }
-  const folderSegments = segments.slice(0, -1);
-  const prefix = rules.privateFolderPrefix;
-  const reserved = rules.scaffoldIgnoredFolders;
-  for (const reservedName of reserved) {
-    if (folderSegments.includes(reservedName)) {
-      return { valid: false, reason: `page.tsx cannot live inside reserved folder ${reservedName}` };
-    }
-  }
-  const visibleSegments = folderSegments.filter((segment) => !segment.startsWith(prefix));
-  if (folderSegments.length > 0 && visibleSegments.length === 0) {
-    return { valid: false, reason: "no URL segment left after stripping underscore folders" };
-  }
-  const route = visibleSegments.length === 0 ? "/" : `/${visibleSegments.join("/")}`;
-  return { valid: true, route };
-};
-
 // src/react/sessionContext.ts
 import { createContext, use } from "react";
 var DEFAULT_VALUE = {
@@ -1119,8 +661,10 @@ function translate({ translationList, key, params }) {
   let finalResult = result;
   for (const param of params) {
     if (!param.key) continue;
-    const regex = new RegExp(`\\{\\{${param.key}\\}\\}`, "g");
-    finalResult = finalResult.replace(regex, String(param.value));
+    const escapedKey = param.key.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
+    const regex = new RegExp(`\\{\\{${escapedKey}\\}\\}`, "g");
+    const replacement = String(param.value);
+    finalResult = finalResult.replace(regex, () => replacement);
   }
   return finalResult;
 }
@@ -1223,7 +767,7 @@ function Middleware({ children }) {
       } else if (result?.redirect) {
         void navigate(result.redirect);
       } else {
-        void navigate(-1);
+        void navigate(getProjectConfig().loginRedirectUrl ?? "/");
       }
       setChecking(false);
     })();
@@ -1312,6 +856,8 @@ export {
   parseServiceRouteName,
   proposeLogin,
   registerApiMethodMap,
+  registerApiRequestInterceptor,
+  registerApiResponseInterceptor,
   registerClientHook,
   registerLanguageSource,
   registerLocales,