@spfn/core 0.3.0-beta.10 → 0.3.0-beta.11

package/dist/nextjs/index.d.ts

@@ -1,6 +1,6 @@
 import { Router, RouteDef } from '@spfn/core/route';
-import { R as RequestInterceptor, a as ResponseInterceptor, I as InferRouteInput, b as InferRouteOutput, A as ApiConfig } from '../types-9oszaJqp.js';
-export { C as CallOptions, c as CookieOptions, d as RouterInput, e as RouterOutput, S as SetCookie, f as StructuredInput } from '../types-9oszaJqp.js';
+import { R as RequestInterceptor, a as ResponseInterceptor, I as InferRouteInput, b as InferRouteOutput, E as ExtractRoutes, A as ApiConfig } from '../types-yv6z_mK7.js';
+export { C as CallOptions, c as CookieOptions, d as RouterInput, e as RouterOutput, S as SetCookie, f as StructuredInput } from '../types-yv6z_mK7.js';
 import '@sinclair/typebox';
 import '@spfn/core/errors';
 
@@ -80,11 +80,42 @@ type RouteClient<TRoute extends RouteDef<any, any>> = {
     call: HasAnyRequiredFields<InferRouteInput<TRoute>> extends true ? (input: CleanStructuredInput<InferRouteInput<TRoute>>) => Promise<InferRouteOutput<TRoute>> : (input?: CleanStructuredInput<InferRouteInput<TRoute>>) => Promise<InferRouteOutput<TRoute>>;
 };
 /**
- * Typed client for entire router
+ * One property per route in a flattened route record.
+ *
+ * A slot the flattening could not resolve to a route definition is `never`, as it was
+ * before nesting was flattened — a record whose values are neither routes nor routers
+ * names nothing callable.
  */
-type Client<TRouter extends Router<any>> = {
-    [K in keyof TRouter['routes']]: TRouter['routes'][K] extends RouteDef<any, any, any> ? RouteClient<TRouter['routes'][K]> : TRouter['routes'][K] extends Router<any> ? Client<TRouter['routes'][K]> : never;
+type RouteClients<TRoutes> = {
+    [K in keyof TRoutes]: TRoutes[K] extends RouteDef<any, any, any> ? RouteClient<TRoutes[K]> : never;
 };
+/**
+ * Typed client for entire router
+ *
+ * One flat namespace, holding the same route names the server registers. A route
+ * declared inside a nested `defineRouter` is reached by its own key — `api.getThing`,
+ * never `api.group.getThing` — because that is the name `registerRoutes` mounts it
+ * under, the name the RPC proxy resolves, and the name `RouterOutput` takes. The group
+ * key is not a route and naming it is a compile error.
+ *
+ * @example
+ * ```typescript
+ * const appRouter = defineRouter({
+ *     getRoot,
+ *     users: defineRouter({ getUser }),
+ * });
+ *
+ * const api = createApi<typeof appRouter>();
+ *
+ * await api.getUser.call({ params: { id: '1' } });   // not api.users.getUser
+ * ```
+ *
+ * A name two branches both declare is left out of the namespace rather than resolved to
+ * one of them — the same collision `RouterOutput` refuses. Routes mounted with
+ * `.packages()` are deliberately absent: a package publishes its own route map and its
+ * own client (`authApi`, `cmsApi`), and that is what calls them.
+ */
+type Client<TRouter extends Router<any>> = RouteClients<ExtractRoutes<TRouter>>;
 
 /**
  * Create type-safe RPC client

package/dist/nextjs/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/nextjs/client/debug-logs.ts","../../src/nextjs/client/errors.ts","../../src/nextjs/shared.ts","../../src/nextjs/client/helpers.ts","../../src/nextjs/client/csrf.ts","../../src/nextjs/client/builder.ts","../../src/nextjs/client/core.ts"],"names":["logger","errorRegistry","coreErrorRegistry","headers"],"mappings":";;;;;;;AAMO,SAAS,sBAAA,CACZA,SACA,OAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,sDAAA,EAAwD;AAAA,IACjE,aAAa,OAAA,CAAQ,MAAA;AAAA,IACrB,WAAA,EAAa,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,KAAK,EAAE,IAAI;AAAA,GACvC,CAAA;AACL;AAEO,SAAS,UAAA,CACZA,OAAAA,EACA,SAAA,EACA,MAAA,EACA,KACA,OAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,gBAAA,EAAa;AAAA,IACtB,KAAA,EAAO,SAAA;AAAA,IACP,MAAA;AAAA,IACA,GAAA;AAAA,IACA;AAAA,GACH,CAAA;AACL;AAEO,SAAS,WAAA,CACZA,OAAAA,EACA,SAAA,EACA,MAAA,EACA,OAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,iBAAA,EAAc;AAAA,IACvB,KAAA,EAAO,SAAA;AAAA,IACP,MAAA;AAAA,IACA;AAAA,GACH,CAAA;AACL;AAEO,SAAS,gBAAA,CACZA,OAAAA,EACA,MAAA,EACA,IAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,yBAAA,EAA2B;AAAA,IACpC,MAAA;AAAA,IACA,OAAA,EAAS,CAAC,CAAC,IAAA;AAAA,IACX,UAAU,OAAO,IAAA;AAAA,IACjB,YAAA,EAAc,IAAA,IAAQ,OAAO,IAAA,KAAS,YAAY,QAAA,IAAY,IAAA;AAAA,IAC9D,WAAW,IAAA,EAAM;AAAA,GACpB,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,OAAAA,EACA,SAAA,EACA,eAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,kCAAA,EAAoC;AAAA,IAC7C,SAAA;AAAA,IACA,WAAA,EAAa,IAAA;AAAA,IACb;AAAA,GACH,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,SACA,KAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,iCAAA,EAAmC;AAAA,IAC5C,WAAW,KAAA,EAAO,IAAA;AAAA,IAClB,gBAAA,EAAkB,OAAO,WAAA,CAAY,IAAA;AAAA,IACrC,SAAS,KAAA,EAAO;AAAA,GACnB,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,SACA,KAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,wBAAA,EAA0B;AAAA,IACnC,SAAA,EAAW,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,IAAA,GAAO,SAAA;AAAA,IACjD,cAAc,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK;AAAA,GACtE,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,OAAAA,EACA,aAAA,EACA,IAAA,EAEJ;AACI,EAAA,MAAM,MAAA,GAAS,CAAC,aAAA,GACV,aAAA,GACA,CAAC,IAAA,GACG,SAAA,GACA,OAAO,IAAA,KAAS,QAAA,GACZ,iBAAA,GACA,EAAE,QAAA,IAAY,QACV,iBAAA,GACA,SAAA;AAElB,EAAAA,OAAAA,CAAO,KAAA,CAAM,gCAAA,EAAkC,EAAE,QAAQ,CAAA;AAC7D;AAEO,SAAS,4BAAA,CACZA,SACA,KAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,6BAAA,EAA+B;AAAA,IACxC,WAAW,KAAA,CAAM,IAAA;AAAA,IACjB,oBAAA,EAAsB,MAAM,WAAA,CAAY,IAAA;AAAA,IACxC,SAAA,EAAW,MAAA,CAAO,cAAA,CAAe,KAAK,EAAE,WAAA,CAAY;AAAA,GACvD,CAAA;AACL;;;ACxHO,IAAM,QAAA,GAAN,cAAuB,KAAA,CAC9B;AAAA,EACI,WAAA,CACI,OAAA,EACgB,MAAA,EACA,GAAA,EACA,UACA,SAAA,EAEpB;AACI,IAAA,KAAA,CAAM,OAAO,CAAA;AANG,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAIhB,IAAA,IAAA,CAAK,IAAA,GAAO,UAAA;AAAA,EAChB;AACJ;;;ACyCO,SAAS,kBAAkB,OAAA,EAClC;AACI,EAAA,OAAO,OAAO,OAAA,CAAQ,OAAO,CAAA,CACxB,GAAA,CAAI,CAAC,CAAC,GAAA,EAAK,KAAK,CAAA,KAAM,GAAG,GAAG,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,CAAA,CACvC,KAAK,IAAI,CAAA;AAClB;AAUA,eAAsB,kBAAkB,QAAA,EACxC;AAEI,EAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EACxB;AACI,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAEvD,EAAA,IAAI,WAAA,EAAa,QAAA,CAAS,kBAAkB,CAAA,EAC5C;AACI,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,IAAA,OAAO,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,GAAI,IAAA;AAAA,EACrC,CAAA,MAEA;AACI,IAAA,OAAO,MAAM,SAAS,IAAA,EAAK;AAAA,EAC/B;AACJ;;;ACvFA,IAAM,YAAA,GAAe,MAAA,CAAO,KAAA,CAAM,yBAAyB,CAAA;AAM3D,eAAsB,uBAAA,GACtB;AAEI,EAAA,IAAI,OAAO,WAAW,WAAA,EACtB;AACI,IAAA,OAAO,EAAC;AAAA,EACZ;AAEA,EAAA,IACA;AAEI,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,OAAO,cAAc,CAAA;AAC/C,IAAA,MAAM,WAAA,GAAc,MAAM,OAAA,EAAQ;AAClC,IAAA,MAAM,UAAA,GAAa,YAAY,MAAA,EAAO;AAEtC,IAAA,MAAM,SAAS,MAAA,CAAO,WAAA;AAAA,MAClB,UAAA,CAAW,IAAI,CAAA,MAAA,KAAU,CAAC,OAAO,IAAA,EAAM,MAAA,CAAO,KAAK,CAAC;AAAA,KACxD;AAEA,IAAA,YAAA,CAAa,MAAM,yBAAA,EAA2B;AAAA,MAC1C,OAAO,UAAA,CAAW,MAAA;AAAA,MAClB,KAAA,EAAO,UAAA,CAAW,GAAA,CAAI,CAAA,CAAA,KAAK,EAAE,IAAI;AAAA,KACpC,CAAA;AAED,IAAA,OAAO,MAAA;AAAA,EACX,SACO,KAAA,EACP;AAGI,IAAA,MAAM,GAAA,GAAM,KAAA;AACZ,IAAA,YAAA,CAAa,KAAK,+BAAA,EAAiC;AAAA,MAC/C,SAAS,GAAA,CAAI,OAAA;AAAA,MACb,MAAM,GAAA,CAAI;AAAA,KACb,CAAA;AAED,IAAA,OAAO,EAAC;AAAA,EACZ;AACJ;AAKA,eAAsB,uBAAA,CAClB,GAAA,EACA,IAAA,EACA,OAAA,EACA,cAA4B,KAAA,EAEhC;AACI,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,YAAY,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,OAAO,CAAA;AAE9D,EAAA,IACA;AACI,IAAA,MAAM,QAAA,GAAW,MAAM,WAAA,CAAY,GAAA,EAAK;AAAA,MACpC,GAAG,IAAA;AAAA,MACH,QAAQ,UAAA,CAAW;AAAA,KACtB,CAAA;AAED,IAAA,YAAA,CAAa,SAAS,CAAA;AAEtB,IAAA,OAAO,QAAA;AAAA,EACX,SACO,KAAA,EACP;AACI,IAAA,YAAA,CAAa,SAAS,CAAA;AACtB,IAAA,MAAM,KAAA;AAAA,EACV;AACJ;AAOA,eAAsB,oBAClB,QAAA,EACA,IAAA,EACA,OAAA,EACA,aAAA,EACA,OACAA,OAAAA,EAEJ;AACI,EAAA,IAAI,KAAA,EACJ;AACI,IAAU,gBAAA,CAAiBA,OAAAA,EAAQ,QAAA,CAAS,MAAA,EAAQ,IAAI,CAAA;AAAA,EAC5D;AAGA,EAAA,IAAI,iBAAA,GAAkC,IAAA;AAEtC,EAAA,IAAI,iBAAiB,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,IAAY,YAAY,IAAA,EACrE;AACI,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,+BAA+BA,OAAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,aAAA,CAAc,oBAAoB,CAAA;AAAA,IACpG;AAEA,IAAA,IACA;AACI,MAAA,iBAAA,GAAoB,aAAA,CAAc,YAAY,IAAW,CAAA;AAEzD,MAAA,IAAI,KAAA,EACJ;AACI,QAAU,8BAAA,CAA+BA,SAAQ,iBAAiB,CAAA;AAAA,MACtE;AAAA,IACJ,SACO,gBAAA,EACP;AAEI,MAAA,IAAI,KAAA,EACJ;AACI,QAAU,8BAAA,CAA+BA,SAAQ,gBAAgB,CAAA;AAAA,MACrE;AAAA,IAEJ;AAAA,EACJ,WACS,KAAA,EACT;AACI,IAAU,8BAAA,CAA+BA,OAAAA,EAAQ,aAAA,EAAe,IAAI,CAAA;AAAA,EACxE;AAGA,EAAA,IAAI,iBAAA,EACJ;AACI,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,4BAAA,CAA6BA,SAAQ,iBAAiB,CAAA;AAAA,IACpE;AAEA,IAAA,MAAM,iBAAA;AAAA,EACV;AAGA,EAAA,IAAI,SAAS,MAAA,KAAW,GAAA,IAAO,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAA,EACxD;AACI,IAAAA,OAAAA,CAAO,IAAA;AAAA,MACH;AAAA,KAMJ;AAAA,EACJ;AAEA,EAAA,MAAM,IAAI,QAAA;AAAA,IACN,MAAM,OAAA,IAAW,CAAA,KAAA,EAAQ,SAAS,MAAM,CAAA,EAAA,EAAK,SAAS,UAAU,CAAA,CAAA;AAAA,IAChE,QAAA,CAAS,MAAA;AAAA,IACT,OAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACJ;AACJ;;;AC1JO,IAAM,WAAA,GAAc;AAW3B,IAAM,mBAAA,GAAsB,oBAAA;AAW5B,IAAM,iBAAA,GAAoB,UAAA;AAW1B,IAAM,cAAA,GAAiB,EAAA;AAkBvB,SAAS,iBAAiB,MAAA,EAC1B;AAGI,EAAA,MAAM,SAAS,KAAA,CAAM,IAAA,CAAK,IAAI,GAAA,CAAI,MAAM,CAAC,CAAA;AAEzC,EAAA,IAAI,MAAA,CAAO,UAAU,cAAA,EACrB;AACI,IAAA,OAAO,MAAA;AAAA,EACX;AAEA,EAAA,MAAM,OAAO,cAAA,GAAiB,CAAA;AAE9B,EAAA,OAAO,CAAC,GAAG,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,EAAG,GAAG,MAAA,CAAO,KAAA,CAAM,CAAC,IAAI,CAAC,CAAA;AAC5D;AAcO,SAAS,gBAAgB,OAAA,EAChC;AAMI,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,IAAA,CAAK,OAAO,CAAA,CAC5B,MAAA,CAAO,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,KAAM,mBAAA,CAAoB,KAAK,IAAI,CAAA,IACjD,iBAAA,CAAkB,IAAA,CAAK,KAAK,CAAA,IAC5B,CAAC,KAAA,CAAM,SAAS,GAAG,CAAC,CAAA,CAC1B,GAAA,CAAI,CAAC,GAAG,KAAK,MAAM,KAAK,CAAA;AAE7B,EAAA,MAAM,UAAA,GAAa,iBAAiB,MAAM,CAAA;AAE1C,EAAA,OAAO,WAAW,MAAA,GAAS,CAAA,GAAI,UAAA,CAAW,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA;AAC1D;AAOO,SAAS,qBAAA,GAChB;AACI,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA,IAAe,CAAC,SAAS,MAAA,EACjD;AACI,IAAA,OAAO,EAAC;AAAA,EACZ;AAEA,EAAA,MAAM,UAAmC,EAAC;AAE1C,EAAA,KAAA,MAAW,IAAA,IAAQ,QAAA,CAAS,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAC5C;AACI,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAElC,IAAA,IAAI,YAAY,CAAA,EAChB;AACI,MAAA,OAAA,CAAQ,KAAK,CAAC,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,SAAS,CAAA,CAAE,IAAA,EAAK,EAAG,IAAA,CAAK,MAAM,SAAA,GAAY,CAAC,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAAA,IACpF;AAAA,EACJ;AAEA,EAAA,OAAO,OAAA;AACX;;;ACtDO,IAAM,gBAAA,GAAN,MAAM,iBAAA,CAIb;AAAA,EAOI,WAAA,CACqB,UACA,SAAA,EAErB;AAHqB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAEpB;AAAA,EAVO,QAAA;AAAA,EACA,QAAA;AAAA,EACA,aAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA;AAAA;AAAA;AAAA,EAWA,KAAA,GACR;AACI,IAAA,MAAM,UAAU,IAAI,iBAAA;AAAA,MAChB,IAAA,CAAK,QAAA;AAAA,MACL,IAAA,CAAK;AAAA,KACT;AACA,IAAA,OAAA,CAAQ,WAAW,IAAA,CAAK,QAAA;AACxB,IAAA,OAAA,CAAQ,WAAW,IAAA,CAAK,QAAA;AACxB,IAAA,OAAA,CAAQ,gBAAgB,IAAA,CAAK,aAAA;AAC7B,IAAA,OAAA,CAAQ,aAAa,IAAA,CAAK,UAAA;AAC1B,IAAA,OAAA,CAAQ,cAAc,IAAA,CAAK,WAAA;AAE3B,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,OAAA,EACR;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,WAAW,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,GAAG,OAAA,EAAQ;AAElD,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,OAAA,EACR;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,WAAW,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,GAAG,OAAA,EAAQ;AAElD,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,OAAA,EACb;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,gBAAgB,EAAE,GAAG,IAAA,CAAK,aAAA,EAAe,GAAG,OAAA,EAAQ;AAE5D,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,UAAU,WAAA,EACV;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,UAAA,GAAa,WAAA;AAErB,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,WAAW,WAAA,EACX;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,WAAA,GAAc,WAAA;AAEtB,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,KAAK,KAAA,EACL;AACI,IAAA,MAAM,UAAuB,EAAC;AAE9B,IAAA,IAAI,KAAK,QAAA,EACT;AACI,MAAA,OAAA,CAAQ,UAAU,IAAA,CAAK,QAAA;AAAA,IAC3B;AAEA,IAAA,IAAI,KAAK,QAAA,EACT;AACI,MAAA,OAAA,CAAQ,UAAU,IAAA,CAAK,QAAA;AAAA,IAC3B;AAEA,IAAA,IAAI,KAAK,aAAA,EACT;AACI,MAAA,OAAA,CAAQ,eAAe,IAAA,CAAK,aAAA;AAAA,IAChC;AAEA,IAAA,IAAI,KAAK,UAAA,EACT;AACI,MAAA,OAAA,CAAQ,YAAY,IAAA,CAAK,UAAA;AAAA,IAC7B;AAEA,IAAA,IAAI,KAAK,WAAA,EACT;AACI,MAAA,OAAA,CAAQ,aAAa,IAAA,CAAK,WAAA;AAAA,IAC9B;AAEA,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,KAAA,IAAS,IAAI,OAAO,CAAA;AAAA,EAC7C;AACJ,CAAA;;;AC9JA,IAAM,SAAA,GAAYA,MAAAA,CAAO,KAAA,CAAM,uBAAuB,CAAA;AAwB/C,SAAS,SAAA,CACZ,MAAA,GAAoB,EAAC,EAEzB;AACI,EAAA,MAAM;AAAA,IACF,OAAA,GAAU,UAAA;AAAA,IACV,OAAA,EAAS,iBAAiB,EAAC;AAAA,IAC3B,UAAU,GAAA,CAAI,cAAA;AAAA,IACd,OAAO,WAAA,GAAc,KAAA;AAAA,IACrB,SAAA,EAAW,eAAA;AAAA,IACX,UAAA,EAAY,gBAAA;AAAA,IACZ,aAAA,EAAe,mBAAA;AAAA,IACf,KAAA,GAAQ;AAAA,GACZ,GAAI,MAAA;AAGJ,EAAA,MAAMC,eAAA,GAAgB,KAAA,CAAM,OAAA,CAAQ,mBAAmB,CAAA,GACjD,IAAI,aAAA,CAAc,CAACC,aAAA,EAAmB,GAAG,mBAAmB,CAAC,IAC7D,mBAAA,IAAuBA,aAAA;AAE7B,EAAA,IAAI,KAAA,EACJ;AACI,IAAA,SAAA,CAAU,KAAA,CAAM,wBAAA,EAA0B,EAAE,OAAA,EAAS,CAAA;AAAA,EACzD;AAUA,EAAA,eAAe,YACX,SAAA,EACA,KAAA,GAAa,EAAC,EACd,OAAA,GAAuB,EAAC,EAE5B;AACI,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,KAAS,MAAA;AAC/B,IAAA,MAAM,WAAA,GAAc,MAAM,QAAA,KAAa,MAAA,IAAa,OAAO,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA,CAAE,MAAA,GAAS,CAAA;AACzF,IAAA,MAAM,MAAA,GAAU,OAAA,IAAW,WAAA,GAAe,MAAA,GAAS,KAAA;AAGnD,IAAA,IAAI,MAAA,GAAS,IAAI,YAAA,IAAgB,EAAA;AAGjC,IAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,WAAA,EACjC;AACI,MAAA,IACA;AACI,QAAA,MAAM,EAAE,OAAA,EAAAC,QAAAA,EAAQ,GAAI,MAAM,OAAO,cAAc,CAAA;AAC/C,QAAA,MAAM,WAAA,GAAc,MAAMA,QAAAA,EAAQ;AAClC,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,GAAA,CAAI,MAAM,CAAA;AACnC,QAAA,MAAM,QAAA,GAAW,WAAA,CAAY,GAAA,CAAI,mBAAmB,CAAA,IAAK,MAAA;AACzD,QAAA,IAAI,IAAA,EACJ;AACI,UAAA,MAAA,GAAS,CAAA,EAAG,QAAQ,CAAA,GAAA,EAAM,IAAI,CAAA,CAAA;AAC9B,UAAA,IAAI,KAAA,EACJ;AACI,YAAA,SAAA,CAAU,KAAA,CAAM,CAAA,oCAAA,EAAuC,MAAM,CAAA,CAAE,CAAA;AAAA,UACnE;AAAA,QACJ;AAAA,MACJ,CAAA,CAAA,MAEA;AAEI,QAAA,IAAI,KAAA,EACJ;AACI,UAAA,SAAA,CAAU,KAAK,oEAAoE,CAAA;AAAA,QACvF;AAAA,MACJ;AAAA,IACJ;AAGA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI,WAAW,KAAA,EACf;AAEI,MAAA,MAAM,UAAA,GAAa,kBAAA,CAAmB,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAC3D,MAAA,OAAA,GAAU,GAAG,MAAM,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,SAAS,UAAU,UAAU,CAAA,CAAA;AAAA,IAClE,CAAA,MAEA;AAEI,MAAA,OAAA,GAAU,CAAA,EAAG,MAAM,CAAA,EAAG,OAAO,IAAI,SAAS,CAAA,CAAA;AAAA,IAC9C;AAIA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACpC,GAAI,WAAA,GAAc,EAAC,GAAI,EAAE,gBAAgB,kBAAA,EAAmB;AAAA,MAC5D,GAAG,cAAA;AAAA,MACH,GAAG,OAAA,CAAQ;AAAA,KACf;AAGA,IAAA,MAAM,mBAAA,GAAsB,MAAM,uBAAA,EAAwB;AAC1D,IAAA,MAAM,aAAA,GAAgB;AAAA,MAClB,GAAG,mBAAA;AAAA,MACH,GAAI,OAAA,CAAQ,OAAA,IAAW;AAAC,KAC5B;AAGA,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,aAAa,CAAA,CAAE,SAAS,CAAA,EACxC;AACI,MAAA,OAAA,CAAQ,QAAQ,CAAA,GAAI,iBAAA,CAAkB,aAAa,CAAA;AAAA,IACvD;AAWA,IAAA,MAAM,SAAA,GAAY,eAAA;AAAA,MACd,OAAO,MAAA,KAAW,WAAA,GAAc,OAAO,OAAA,CAAQ,aAAa,IAAI,qBAAA;AAAsB,KAC1F;AAEA,IAAA,MAAM,eAAA,GAAkB,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,KAAK,CAAA,IAAA,KAAQ,IAAA,CAAK,WAAA,EAAY,KAAM,WAAW,CAAA;AAE5F,IAAA,IAAI,SAAA,IAAa,CAAC,eAAA,EAClB;AACI,MAAA,OAAA,CAAQ,WAAW,CAAA,GAAI,SAAA;AAAA,IAC3B;AAGA,IAAA,IAAI,SAAS,MAAA,CAAO,IAAA,CAAK,mBAAmB,CAAA,CAAE,SAAS,CAAA,EACvD;AACI,MAAA,MAAM,WAAA,GAAc,MAAA,CAAO,OAAA,CAAQ,mBAAmB,EAAE,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,MAAO,EAAE,IAAA,EAAM,OAAM,CAAE,CAAA;AAChG,MAAU,sBAAA,CAAuB,WAAW,WAAW,CAAA;AAAA,IAC3D;AAGA,IAAA,MAAM,WAAA,GAA2B;AAAA,MAC7B,MAAA;AAAA,MACA,OAAA;AAAA,MACA,GAAG,OAAA,CAAQ;AAAA,KACf;AAGA,IAAA,IAAI,WAAW,MAAA,EACf;AACI,MAAA,IAAI,WAAA,EACJ;AAEI,QAAA,MAAM,QAAA,GAAW,IAAI,QAAA,EAAS;AAG9B,QAAA,MAAM,WAAgC,EAAC;AACvC,QAAA,IAAI,KAAA,CAAM,MAAA,EAAQ,QAAA,CAAS,MAAA,GAAS,KAAA,CAAM,MAAA;AAC1C,QAAA,IAAI,KAAA,CAAM,KAAA,EAAO,QAAA,CAAS,KAAA,GAAQ,KAAA,CAAM,KAAA;AACxC,QAAA,IAAI,KAAA,CAAM,OAAA,EAAS,QAAA,CAAS,OAAA,GAAU,KAAA,CAAM,OAAA;AAC5C,QAAA,IAAI,KAAA,CAAM,OAAA,EAAS,QAAA,CAAS,OAAA,GAAU,KAAA,CAAM,OAAA;AAE5C,QAAA,IAAI,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA,CAAE,SAAS,CAAA,EACnC;AACI,UAAA,QAAA,CAAS,MAAA,CAAO,YAAA,EAAc,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,QAC1D;AAGA,QAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA,EACxD;AACI,UAAA,IAAI,iBAAiB,IAAA,EACrB;AACI,YAAA,QAAA,CAAS,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,UAC9B,CAAA,MAAA,IACS,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAC5B;AAEI,YAAA,KAAA,MAAW,QAAQ,KAAA,EACnB;AACI,cAAA,IAAI,gBAAgB,IAAA,EACpB;AACI,gBAAA,QAAA,CAAS,MAAA,CAAO,KAAK,IAAI,CAAA;AAAA,cAC7B,CAAA,MAEA;AACI,gBAAA,QAAA,CAAS,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,IAAI,CAAC,CAAA;AAAA,cACrC;AAAA,YACJ;AAAA,UACJ,CAAA,MAAA,IACS,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAC1C;AACI,YAAA,QAAA,CAAS,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,UACtC;AAAA,QACJ;AAEA,QAAA,WAAA,CAAY,IAAA,GAAO,QAAA;AAAA,MACvB,CAAA,MAEA;AACI,QAAA,WAAA,CAAY,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AAAA,MAC3C;AAAA,IACJ;AAGA,IAAA,IAAI,IAAA,GAAO,WAAA;AACX,IAAA,IAAI,eAAA,EACJ;AACI,MAAA,IAAA,GAAO,MAAM,eAAA,CAAgB,OAAA,EAAS,IAAI,CAAA;AAAA,IAC9C;AACA,IAAA,IAAI,QAAQ,SAAA,EACZ;AACI,MAAA,IAAA,GAAO,MAAM,OAAA,CAAQ,SAAA,CAAU,OAAA,EAAS,IAAI,CAAA;AAAA,IAChD;AAEA,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,UAAA,CAAW,WAAW,SAAA,EAAW,MAAA,EAAQ,SAAS,CAAC,CAAC,KAAK,IAAI,CAAA;AAAA,IAC3E;AAGA,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI,IAAA;AAEJ,IAAA,IACA;AACI,MAAA,QAAA,GAAW,MAAM,uBAAA,CAAwB,OAAA,EAAS,IAAA,EAAM,SAAS,WAAW,CAAA;AAG5E,MAAA,IAAA,GAAO,MAAM,kBAAkB,QAAQ,CAAA;AAGvC,MAAA,IAAI,gBAAA,EACJ;AACI,QAAA,MAAM,MAAA,GAAS,MAAM,gBAAA,CAAiB,QAAA,EAAU,IAAI,CAAA;AACpD,QAAA,QAAA,GAAW,MAAA,CAAO,QAAA;AAClB,QAAA,IAAA,GAAO,MAAA,CAAO,IAAA;AAAA,MAClB;AACA,MAAA,IAAI,QAAQ,UAAA,EACZ;AACI,QAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,UAAA,CAAW,UAAU,IAAI,CAAA;AACtD,QAAA,QAAA,GAAW,MAAA,CAAO,QAAA;AAClB,QAAA,IAAA,GAAO,MAAA,CAAO,IAAA;AAAA,MAClB;AAEA,MAAA,IAAI,KAAA,EACJ;AACI,QAAU,YAAY,SAAA,EAAW,SAAA,EAAW,SAAS,MAAA,EAAQ,CAAC,CAAC,IAAI,CAAA;AAAA,MACvE;AAAA,IACJ,SACO,KAAA,EACP;AAEI,MAAA,IAAI,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,YAAA,EAC7C;AACI,QAAA,SAAA,CAAU,MAAM,iBAAA,EAAmB;AAAA,UAC/B,KAAA,EAAO,SAAA;AAAA,UACP,MAAA;AAAA,UACA,GAAA,EAAK,OAAA;AAAA,UACL;AAAA,SACH,CAAA;AAED,QAAA,MAAM,IAAI,QAAA;AAAA,UACN,yBAAyB,OAAO,CAAA,EAAA,CAAA;AAAA,UAChC,GAAA;AAAA,UACA,OAAA;AAAA,UACA,MAAA;AAAA,UACA;AAAA,SACJ;AAAA,MACJ;AAGA,MAAA,MAAM,YAAA,GAAe,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,eAAA;AAC9D,MAAA,SAAA,CAAU,MAAM,eAAA,EAAiB;AAAA,QAC7B,KAAA,EAAO,SAAA;AAAA,QACP,MAAA;AAAA,QACA,GAAA,EAAK,OAAA;AAAA,QACL,KAAA,EAAO,YAAA;AAAA,QACP,SAAA,EAAW,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,IAAA,GAAO;AAAA,OACpD,CAAA;AAED,MAAA,MAAM,IAAI,QAAA;AAAA,QACN,YAAA;AAAA,QACA,CAAA;AAAA,QACA,OAAA;AAAA,QACA,MAAA;AAAA,QACA;AAAA,OACJ;AAAA,IACJ;AAGA,IAAA,IAAI,CAAC,SAAS,EAAA,EACd;AACI,MAAA,MAAM,oBAAoB,QAAA,EAAU,IAAA,EAAM,OAAA,EAASF,eAAA,EAAe,OAAO,SAAS,CAAA;AAAA,IACtF;AAEA,IAAA,OAAO,IAAA;AAAA,EACX;AAQA,EAAA,SAAS,UAAA,CAAW,SAAS,EAAA,EAC7B;AACI,IAAA,OAAO,IAAI,KAAA;AAAA,MACP,EAAC;AAAA,MACD;AAAA,QACI,GAAA,CAAI,SAAS,IAAA,EACb;AACI,UAAA,MAAM,cAAc,MAAA,GAAS,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,GAAK,IAAA;AAGnD,UAAA,OAAO,IAAI,gBAAA;AAAA,YACP,CAAC,KAAA,EAAY,OAAA,KAAyB,WAAA,CAAY,WAAA,EAAa,OAAO,OAAO,CAAA;AAAA,YAC7E;AAAA,WACJ;AAAA,QACJ;AAAA;AACJ,KACJ;AAAA,EACJ;AAEA,EAAA,OAAO,UAAA,EAAW;AACtB","file":"index.js","sourcesContent":["/**\n * Debug logging utilities for API client\n * Separates debug logging logic from main client code for better maintainability\n */\nimport type { Logger } from '@spfn/core/logger';\n\nexport function logCookieAutoDetection(\n    logger: Logger,\n    cookies: Array<{ name: string; value: string }>,\n): void\n{\n    logger.debug('Auto-detected server environment, forwarding cookies', {\n        cookieCount: cookies.length,\n        cookieNames: cookies.map(c => c.name),\n    });\n}\n\nexport function logRequest(\n    logger: Logger,\n    routeName: string,\n    method: string,\n    url: string,\n    hasBody: boolean,\n): void\n{\n    logger.debug('→ Request', {\n        route: routeName,\n        method,\n        url,\n        hasBody,\n    });\n}\n\nexport function logResponse(\n    logger: Logger,\n    routeName: string,\n    status: number,\n    hasBody: boolean,\n): void\n{\n    logger.debug('← Response', {\n        route: routeName,\n        status,\n        hasBody,\n    });\n}\n\nexport function logErrorResponse(\n    logger: Logger,\n    status: number,\n    body: any,\n): void\n{\n    logger.debug('Error response received', {\n        status,\n        hasBody: !!body,\n        bodyType: typeof body,\n        hasTypeField: body && typeof body === 'object' && '__type' in body,\n        typeValue: body?.__type,\n    });\n}\n\nexport function logErrorDeserializationAttempt(\n    logger: Logger,\n    errorType: string,\n    registeredTypes: string[],\n): void\n{\n    logger.debug('Attempting error deserialization', {\n        errorType,\n        hasRegistry: true,\n        registeredTypes,\n    });\n}\n\nexport function logErrorDeserializationSuccess(\n    logger: Logger,\n    error: Error | null,\n): void\n{\n    logger.debug('Error deserialized successfully', {\n        errorName: error?.name,\n        errorConstructor: error?.constructor.name,\n        message: error?.message,\n    });\n}\n\nexport function logErrorDeserializationFailure(\n    logger: Logger,\n    error: unknown,\n): void\n{\n    logger.debug('Deserialization failed', {\n        errorName: error instanceof Error ? error.name : 'unknown',\n        errorMessage: error instanceof Error ? error.message : String(error),\n    });\n}\n\nexport function logErrorDeserializationSkipped(\n    logger: Logger,\n    errorRegistry: any,\n    body: any,\n): void\n{\n    const reason = !errorRegistry\n        ? 'no registry'\n        : !body\n            ? 'no body'\n            : typeof body !== 'object'\n                ? 'body not object'\n                : !('__type' in body)\n                    ? 'no __type field'\n                    : 'unknown';\n\n    logger.debug('Skipping error deserialization', { reason });\n}\n\nexport function logThrowingDeserializedError(\n    logger: Logger,\n    error: Error,\n): void\n{\n    logger.debug('Throwing deserialized error', {\n        errorName: error.name,\n        errorConstructorName: error.constructor.name,\n        prototype: Object.getPrototypeOf(error).constructor.name,\n    });\n}\n","// ============================================================================\n// Client Error\n// ============================================================================\n\n/**\n * Typed client error\n */\nexport class ApiError extends Error\n{\n    constructor(\n        message: string,\n        public readonly status: number,\n        public readonly url: string,\n        public readonly response?: unknown,\n        public readonly errorType?: 'http' | 'network' | 'timeout',\n    )\n    {\n        super(message);\n        this.name = 'ApiError';\n    }\n}\n","/**\n * Shared utilities for Next.js client and proxy modules\n *\n * Contains common functions used by both client and proxy to avoid code duplication.\n */\n\n/**\n * Build URL with path parameters replaced\n *\n * @example\n * buildUrlWithParams('/users/:id/posts/:postId', { id: '123', postId: '456' })\n * // Returns: '/users/123/posts/456'\n */\nexport function buildUrlWithParams(path: string, params: Record<string, any>): string\n{\n    let url = path;\n    for (const [key, value] of Object.entries(params))\n    {\n        url = url.replace(`:${key}`, encodeURIComponent(String(value)));\n    }\n\n    return url;\n}\n\n/**\n * Build query string from object\n *\n * @example\n * buildQueryString({ page: '1', limit: '10', tags: ['foo', 'bar'] })\n * // Returns: '?page=1&limit=10&tags=foo&tags=bar'\n */\nexport function buildQueryString(query: Record<string, any>): string\n{\n    if (Object.keys(query).length === 0)\n    {\n        return '';\n    }\n\n    const searchParams = new URLSearchParams();\n    for (const [key, value] of Object.entries(query))\n    {\n        if (Array.isArray(value))\n        {\n            value.forEach((v) => searchParams.append(key, String(v)));\n        }\n        else\n        {\n            searchParams.append(key, String(value));\n        }\n    }\n\n    return `?${searchParams.toString()}`;\n}\n\n/**\n * Build Cookie header string from cookies object\n *\n * @example\n * buildCookieHeader({ session: 'abc123', theme: 'dark' })\n * // Returns: 'session=abc123; theme=dark'\n */\nexport function buildCookieHeader(cookies: Record<string, string>): string\n{\n    return Object.entries(cookies)\n        .map(([key, value]) => `${key}=${value}`)\n        .join('; ');\n}\n\n/**\n * Parse response body based on content type\n *\n * Handles:\n * - 204 No Content: returns null (no body expected)\n * - application/json: parses JSON body\n * - Other content types: returns raw text\n */\nexport async function parseResponseBody(response: Response): Promise<any>\n{\n    // 204 No Content has no body\n    if (response.status === 204)\n    {\n        return null;\n    }\n\n    const contentType = response.headers.get('content-type');\n\n    if (contentType?.includes('application/json'))\n    {\n        const text = await response.text();\n\n        return text ? JSON.parse(text) : null;\n    }\n    else\n    {\n        return await response.text();\n    }\n}\n","import type { Logger } from '@spfn/core/logger';\nimport type { ErrorRegistry } from '@spfn/core/errors';\nimport { logger } from '@spfn/core/logger';\nimport { ApiError } from './errors';\nimport * as debugLogs from './debug-logs';\n\n// Re-export shared utilities\nexport { buildCookieHeader, parseResponseBody } from '../shared';\n\nconst cookieLogger = logger.child('@spfn/core:auto-cookies');\n\n/**\n * Auto-detect cookies from Next.js server environment\n * Returns empty object if not in server environment or if cookies are not accessible\n */\nexport async function autoDetectServerCookies(): Promise<Record<string, string>>\n{\n    // Client environment — browser sends cookies automatically\n    if (typeof window !== 'undefined')\n    {\n        return {};\n    }\n\n    try\n    {\n        // Next.js cookies() API is only available in server environment\n        const { cookies } = await import('next/headers');\n        const cookieStore = await cookies();\n        const allCookies = cookieStore.getAll();\n\n        const result = Object.fromEntries(\n            allCookies.map(cookie => [cookie.name, cookie.value]),\n        );\n\n        cookieLogger.debug('Server cookies detected', {\n            count: allCookies.length,\n            names: allCookies.map(c => c.name),\n        });\n\n        return result;\n    }\n    catch (error)\n    {\n        // Server environment but cookies() not accessible\n        // (e.g. static generation, build time, or outside request context)\n        const err = error as Error;\n        cookieLogger.warn('Failed to read server cookies', {\n            message: err.message,\n            name: err.name,\n        });\n\n        return {};\n    }\n}\n\n/**\n * Execute fetch with timeout and abort controller\n */\nexport async function executeFetchWithTimeout(\n    url: string,\n    init: RequestInit,\n    timeout: number,\n    customFetch: typeof fetch = fetch,\n): Promise<Response>\n{\n    const controller = new AbortController();\n    const timeoutId = setTimeout(() => controller.abort(), timeout);\n\n    try\n    {\n        const response = await customFetch(url, {\n            ...init,\n            signal: controller.signal,\n        });\n\n        clearTimeout(timeoutId);\n\n        return response;\n    }\n    catch (error)\n    {\n        clearTimeout(timeoutId);\n        throw error;\n    }\n}\n\n/**\n * Handle error response with deserialization support\n * Attempts to deserialize custom errors if errorRegistry is provided\n * Falls back to ApiError if deserialization fails or is not available\n */\nexport async function handleErrorResponse(\n    response: Response,\n    body: any,\n    fullUrl: string,\n    errorRegistry: ErrorRegistry | undefined,\n    debug: boolean,\n    logger: Logger,\n): Promise<never>\n{\n    if (debug)\n    {\n        debugLogs.logErrorResponse(logger, response.status, body);\n    }\n\n    // Try to deserialize error if registry is provided\n    let deserializedError: Error | null = null;\n\n    if (errorRegistry && body && typeof body === 'object' && '__type' in body)\n    {\n        if (debug)\n        {\n            debugLogs.logErrorDeserializationAttempt(logger, body.__type, errorRegistry.getRegisteredTypes());\n        }\n\n        try\n        {\n            deserializedError = errorRegistry.deserialize(body as any);\n\n            if (debug)\n            {\n                debugLogs.logErrorDeserializationSuccess(logger, deserializedError);\n            }\n        }\n        catch (deserializeError)\n        {\n            // Deserialization itself failed (type not found, invalid data, etc.)\n            if (debug)\n            {\n                debugLogs.logErrorDeserializationFailure(logger, deserializeError);\n            }\n            // Fall through to ApiError below\n        }\n    }\n    else if (debug)\n    {\n        debugLogs.logErrorDeserializationSkipped(logger, errorRegistry, body);\n    }\n\n    // If deserialization succeeded, throw the deserialized error\n    if (deserializedError)\n    {\n        if (debug)\n        {\n            debugLogs.logThrowingDeserializedError(logger, deserializedError);\n        }\n\n        throw deserializedError;\n    }\n\n    // Fallback to generic ApiError\n    if (response.status === 404 && process.env.NODE_ENV !== 'production')\n    {\n        logger.warn(\n            '\\n⚠️  404 Not Found\\n\\n' +\n            'Check the following:\\n' +\n            '  1. Routes are registered in server.config.ts:\\n' +\n            '     → defineServerConfig().routes(appRouter)\\n' +\n            '  2. Delete .spfn cache if you recently added new routes:\\n' +\n            '     → rm -rf .spfn\\n',\n        );\n    }\n\n    throw new ApiError(\n        body?.message || `HTTP ${response.status}: ${response.statusText}`,\n        response.status,\n        fullUrl,\n        body,\n        'http',\n    );\n}\n","/**\n * CSRF token transport for the RPC client\n *\n * The Next.js proxy sets a readable (non-HttpOnly) cookie carrying an HMAC of\n * the session's key id; this module mirrors it into a request header. The proxy\n * never compares cookie against header — it recomputes the value from the\n * session — so the cookie is transport only and reading it here is not a trust\n * decision. See the CSRF section of the @spfn/auth README.\n */\n\n/**\n * Header the readable CSRF cookie is mirrored into.\n *\n * Must match CSRF_HEADER in @spfn/auth. It is duplicated rather than imported\n * because @spfn/core cannot depend on @spfn/auth.\n */\nexport const CSRF_HEADER = 'x-spfn-csrf';\n\n/**\n * Cookie names carrying a CSRF token.\n *\n * @spfn/auth suffixes its cookie names with the server port so several local dev\n * instances on the same host do not overwrite each other's session, and the\n * browser cannot know that port — so match the family, not one name. Every\n * candidate is sent and the proxy accepts the request if any of them recomputes\n * to the expected value; a candidate an attacker tossed in never will.\n */\nconst CSRF_COOKIE_PATTERN = /^spfn_csrf(_\\d+)?$/;\n\n/**\n * Values that can be put in a header at all: printable ASCII, no space.\n *\n * A cookie jar is attacker-writable in the very case this feature exists for, and\n * `new Headers()` rejects a value outside Latin-1 — so a sibling subdomain that\n * tosses `spfn_csrf=한` would make every RPC call throw before it was sent, not\n * merely fail the check. A genuine token is 64 hex characters; anything that\n * cannot be a header value cannot be one.\n */\nconst HEADER_SAFE_VALUE = /^[!-~]+$/;\n\n/**\n * Upper bound on candidates sent, so a cookie-flooded jar stays a bounded header.\n *\n * Deliberately generous. The server recomputes the expected value once and then\n * only compares fixed-length strings, so extra candidates cost it almost nothing,\n * while every candidate dropped here is a chance to lock the user out of every\n * mutation — the far worse failure. Must not exceed the matching bound in\n * @spfn/auth's `matchesCsrfToken`, or values sent would never be looked at.\n */\nconst MAX_CANDIDATES = 32;\n\n/**\n * Choose which candidates to send when the jar holds more than the cap.\n *\n * `document.cookie` exposes neither Domain nor Path, so a tossed cookie is\n * indistinguishable from the genuine one here — the proxy is what tells them\n * apart, by recomputing. What this can do is refuse to drop the genuine value on\n * the floor. Browsers order the jar by path length descending, then by age\n * ascending, so a flood pushes the genuine cookie towards the end (attacker\n * cookies on a longer path) or towards the start (attacker cookies written later\n * on the same path). Keeping both ends survives either, where a plain prefix\n * survives only one.\n *\n * A jar flooded far past the cap is a denial of service that no client-side\n * choice fully prevents; the structural fix is a `__Host-` prefixed cookie name,\n * which a sibling subdomain cannot write at all.\n */\nfunction selectCandidates(values: string[]): string[]\n{\n    // Identical duplicates carry no extra information, so collapsing them buys\n    // back slots that a flood of one repeated value would otherwise burn.\n    const unique = Array.from(new Set(values));\n\n    if (unique.length <= MAX_CANDIDATES)\n    {\n        return unique;\n    }\n\n    const half = MAX_CANDIDATES / 2;\n\n    return [...unique.slice(0, half), ...unique.slice(-half)];\n}\n\n/**\n * Collect the CSRF token candidates from cookie entries.\n *\n * Takes entries rather than a map because a name can legitimately appear twice:\n * a sibling subdomain that tosses `spfn_csrf` for the parent domain leaves the\n * browser holding two cookies of that name, and folding them into a map would\n * throw away whichever the tossed one displaced — locking the user out of every\n * mutation. Sending both keeps the real one in play, and the tossed one is inert\n * because the proxy recomputes what it expects.\n *\n * @returns Header value (comma-separated), or undefined when no cookie exists\n */\nexport function csrfHeaderValue(cookies: Iterable<[string, string]>): string | undefined\n{\n    // A comma separates candidates on the wire, so a value containing one would\n    // arrive as several. That cannot be a genuine token — they are hex — but it\n    // would let a single tossed cookie spend the receiver's whole candidate\n    // budget and bury the real value behind it. Drop those, and anything that\n    // could not be a header value at all.\n    const values = Array.from(cookies)\n        .filter(([name, value]) => CSRF_COOKIE_PATTERN.test(name)\n            && HEADER_SAFE_VALUE.test(value)\n            && !value.includes(','))\n        .map(([, value]) => value);\n\n    const candidates = selectCandidates(values);\n\n    return candidates.length > 0 ? candidates.join(',') : undefined;\n}\n\n/**\n * Read the browser cookie jar as entries, duplicates preserved.\n *\n * Empty outside a browser (SSR reads the jar it forwards instead).\n */\nexport function documentCookieEntries(): Array<[string, string]>\n{\n    if (typeof document === 'undefined' || !document.cookie)\n    {\n        return [];\n    }\n\n    const entries: Array<[string, string]> = [];\n\n    for (const pair of document.cookie.split(';'))\n    {\n        const separator = pair.indexOf('=');\n\n        if (separator > 0)\n        {\n            entries.push([pair.slice(0, separator).trim(), pair.slice(separator + 1).trim()]);\n        }\n    }\n\n    return entries;\n}\n","// ============================================================================\n// Route Call Builder (Structured Input API)\n// ============================================================================\n\nimport type { RouteDef, Router } from '@spfn/core/route';\nimport type {\n    CallOptions,\n    InferRouteInput,\n    InferRouteOutput,\n    RequestInterceptor,\n    ResponseInterceptor,\n} from './types';\n\n/**\n * Pick only non-empty fields from StructuredInput\n *\n * This removes fields that are empty objects `{}` from the input type,\n * so users only need to provide fields that are actually defined in the route.\n */\ntype PickNonEmpty<T> = {\n    [K in keyof T as T[K] extends Record<string, never> ? never : K]: T[K];\n};\n\n/**\n * Make fields that can be undefined into optional fields\n *\n * When a field is defined as `Type.Optional(Type.Object({...}))`,\n * the resulting type is `T | undefined`. This utility converts such fields\n * into proper optional fields (`field?: T`) so users don't need to pass them.\n */\ntype MakeOptionalIfUndefinable<T> =\n    // Required fields (undefined is not assignable)\n    { [K in keyof T as undefined extends T[K] ? never : K]: T[K] }\n    // Optional fields (undefined is assignable)\n    & { [K in keyof T as undefined extends T[K] ? K : never]?: Exclude<T[K], undefined> };\n\n/**\n * Clean structured input - only include fields that have actual schema,\n * and make fields optional if they accept undefined\n */\ntype CleanStructuredInput<TInput> = MakeOptionalIfUndefinable<PickNonEmpty<TInput>>;\n\n/**\n * Check if input has any required fields\n *\n * Returns false if all fields are optional (i.e., {} is assignable to the input type)\n */\ntype HasAnyRequiredFields<TInput> = {} extends CleanStructuredInput<TInput> ? false : true;\n\n/**\n * Route call builder with structured input API\n *\n * Input is structured with explicit params, query, body fields\n * that match the server-side route definition.\n *\n * @example\n * ```typescript\n * // GET /users/:id - params only\n * const user = await api.getUser.call({ params: { id: '1' } });\n *\n * // GET /users/:id?include=posts - params + query\n * const user = await api.getUser.call({\n *     params: { id: '1' },\n *     query: { include: 'posts' }\n * });\n *\n * // POST /users - body only\n * const user = await api.createUser.call({\n *     body: { name: 'John', email: 'john@example.com' }\n * });\n *\n * // PUT /users/:id - params + body\n * const user = await api.updateUser.call({\n *     params: { id: '1' },\n *     body: { name: 'Jane' }\n * });\n *\n * // With options (headers, cookies, Next.js caching)\n * const user = await api.getUser\n *     .headers({ 'X-Custom': 'value' })\n *     .fetchOptions({ next: { revalidate: 60 } })\n *     .call({ params: { id: '1' } });\n * ```\n */\nexport class RouteCallBuilder<\n    TInput,\n    TOutput,\n>\n{\n    private _headers?: Record<string, string>;\n    private _cookies?: Record<string, string>;\n    private _fetchOptions?: RequestInit;\n    private _onRequest?: RequestInterceptor;\n    private _onResponse?: ResponseInterceptor;\n\n    constructor(\n        private readonly executor: (input: any, options: CallOptions) => Promise<TOutput>,\n        private readonly routeName: string,\n    ) \n    {}\n\n    /**\n     * Clone builder\n     */\n    private clone(): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = new RouteCallBuilder<TInput, TOutput>(\n            this.executor,\n            this.routeName,\n        );\n        builder._headers = this._headers;\n        builder._cookies = this._cookies;\n        builder._fetchOptions = this._fetchOptions;\n        builder._onRequest = this._onRequest;\n        builder._onResponse = this._onResponse;\n\n        return builder;\n    }\n\n    /**\n     * Set request headers\n     */\n    headers(headers: Record<string, string>): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._headers = { ...this._headers, ...headers };\n\n        return builder;\n    }\n\n    /**\n     * Set cookies\n     */\n    cookies(cookies: Record<string, string>): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._cookies = { ...this._cookies, ...cookies };\n\n        return builder;\n    }\n\n    /**\n     * Set Next.js fetch options\n     */\n    fetchOptions(options: RequestInit & { next?: { revalidate?: number | false; tags?: string[] } }): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._fetchOptions = { ...this._fetchOptions, ...options };\n\n        return builder;\n    }\n\n    /**\n     * Set request interceptor\n     */\n    onRequest(interceptor: RequestInterceptor): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._onRequest = interceptor;\n\n        return builder;\n    }\n\n    /**\n     * Set response interceptor\n     */\n    onResponse(interceptor: ResponseInterceptor): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._onResponse = interceptor;\n\n        return builder;\n    }\n\n    /**\n     * Execute the API call with structured input\n     *\n     * Input structure matches the server-side route definition:\n     * - params: Path parameters (e.g., { id: '123' } for /users/:id)\n     * - query: Query string parameters\n     * - body: Request body (for POST, PUT, PATCH)\n     */\n    call(input?: CleanStructuredInput<TInput>): Promise<TOutput>\n    {\n        const options: CallOptions = {};\n\n        if (this._headers)\n        {\n            options.headers = this._headers;\n        }\n\n        if (this._cookies)\n        {\n            options.cookies = this._cookies;\n        }\n\n        if (this._fetchOptions)\n        {\n            options.fetchOptions = this._fetchOptions;\n        }\n\n        if (this._onRequest)\n        {\n            options.onRequest = this._onRequest;\n        }\n\n        if (this._onResponse)\n        {\n            options.onResponse = this._onResponse;\n        }\n\n        return this.executor(input || {}, options);\n    }\n}\n\n/**\n * Individual route client with structured input API\n */\nexport type RouteClient<TRoute extends RouteDef<any, any>> = {\n    /**\n     * Set request headers\n     */\n    headers(headers: Record<string, string>): RouteClient<TRoute>;\n\n    /**\n     * Set cookies\n     */\n    cookies(cookies: Record<string, string>): RouteClient<TRoute>;\n\n    /**\n     * Set Next.js fetch options\n     */\n    fetchOptions(options: RequestInit & { next?: { revalidate?: number | false; tags?: string[] } }): RouteClient<TRoute>;\n\n    /**\n     * Set request interceptor\n     */\n    onRequest(interceptor: RequestInterceptor): RouteClient<TRoute>;\n\n    /**\n     * Set response interceptor\n     */\n    onResponse(interceptor: ResponseInterceptor): RouteClient<TRoute>;\n\n    /**\n     * Execute the API call with structured input\n     *\n     * @example\n     * ```typescript\n     * // GET /users/:id\n     * api.getUser.call({ params: { id: '123' } });\n     *\n     * // PUT /users/:id\n     * api.updateUser.call({ params: { id: '123' }, body: { name: 'Jane' } });\n     * ```\n     */\n    call: HasAnyRequiredFields<InferRouteInput<TRoute>> extends true\n        ? (input: CleanStructuredInput<InferRouteInput<TRoute>>) => Promise<InferRouteOutput<TRoute>>\n        : (input?: CleanStructuredInput<InferRouteInput<TRoute>>) => Promise<InferRouteOutput<TRoute>>;\n};\n\n/**\n * Typed client for entire router\n */\nexport type Client<TRouter extends Router<any>> = {\n    [K in keyof TRouter['routes']]: TRouter['routes'][K] extends RouteDef<any, any, any>\n        ? RouteClient<TRouter['routes'][K]>\n        : TRouter['routes'][K] extends Router<any>\n            ? Client<TRouter['routes'][K]>\n            : never;\n};\n","/**\n * Type-Safe RPC-Style Client with Structured Input API\n *\n * Provides full end-to-end type safety from server routes to client calls.\n * No metadata codegen required - method/path resolution happens at the proxy layer.\n *\n * @example\n * ```typescript\n * // Server\n * export const appRouter = defineRouter({\n *   getUser: route.get('/users/:id')\n *     .input({ params: Type.Object({ id: Type.String() }) })\n *     .handler(async (c) => { ... }),\n *   createUser: route.post('/users')\n *     .input({ body: Type.Object({ name: Type.String() }) })\n *     .handler(async (c) => { ... }),\n * });\n *\n * export type AppRouter = typeof appRouter;\n *\n * // Client - no metadata needed!\n * const api = createApi<AppRouter>();\n *\n * // ✅ GET (no body) - becomes GET /api/rpc/getUser?input={...}\n * const user = await api.getUser.call({ params: { id: '1' } });\n *\n * // ✅ POST (has body) - becomes POST /api/rpc/createUser\n * const newUser = await api.createUser.call({ body: { name: 'John' } });\n *\n * // ✅ With options (headers, cookies, interceptors)\n * const user = await api.getUser\n *   .headers({ 'X-Custom': 'value' })\n *   .cookies({ session: 'xxx' })\n *   .fetchOptions({ next: { revalidate: 60 } })\n *   .call({ params: { id: '1' } });\n * ```\n */\nimport { env } from '@spfn/core/config';\nimport { ErrorRegistry, errorRegistry as coreErrorRegistry } from '@spfn/core/errors';\nimport { logger } from '@spfn/core/logger';\nimport type { Router } from '@spfn/core/route';\nimport * as debugLogs from './debug-logs';\nimport { ApiError } from './errors';\nimport {\n    parseResponseBody,\n    executeFetchWithTimeout,\n    handleErrorResponse,\n    buildCookieHeader,\n    autoDetectServerCookies,\n} from './helpers';\nimport { CSRF_HEADER, csrfHeaderValue, documentCookieEntries } from './csrf';\nimport { RouteCallBuilder } from './builder';\nimport type { ApiConfig, CallOptions } from './types';\nimport type { Client } from './builder';\n\nconst apiLogger = logger.child('@spfn/core:api-client');\n\n// ============================================================================\n// Client Implementation\n// ============================================================================\n\n/**\n * Create type-safe RPC client\n *\n * No metadata required - the client sends routeName + input to the proxy,\n * and the proxy resolves the actual HTTP method and path from the router.\n *\n * @example\n * ```typescript\n * // Client - no metadata needed!\n * const api = createApi<AppRouter>();\n *\n * // GET request (no body) - browser cacheable\n * const user = await api.getUser.call({ params: { id: '1' } });\n *\n * // POST request (has body)\n * const newUser = await api.createUser.call({ body: { name: 'John' } });\n * ```\n */\nexport function createApi<TRouter extends Router<any>>(\n    config: ApiConfig = {},\n): Client<TRouter>\n{\n    const {\n        baseUrl = '/api/rpc',\n        headers: defaultHeaders = {},\n        timeout = env.SERVER_TIMEOUT,\n        fetch: customFetch = fetch,\n        onRequest: globalOnRequest,\n        onResponse: globalOnResponse,\n        errorRegistry: errorRegistryConfig,\n        debug = false,\n    } = config;\n\n    // Normalize errorRegistry: always include coreErrorRegistry\n    const errorRegistry = Array.isArray(errorRegistryConfig)\n        ? new ErrorRegistry([coreErrorRegistry, ...errorRegistryConfig])\n        : errorRegistryConfig ?? coreErrorRegistry;\n\n    if (debug)\n    {\n        apiLogger.debug('API client initialized', { baseUrl });\n    }\n\n    /**\n     * Execute API call\n     *\n     * Determines GET vs POST based on body/formData presence:\n     * - No body/formData → GET /api/rpc/{routeName}?input={...}\n     * - Has body → POST /api/rpc/{routeName} with JSON body\n     * - Has formData → POST /api/rpc/{routeName} with multipart/form-data\n     */\n    async function executeCall(\n        routeName: string,\n        input: any = {},\n        options: CallOptions = {},\n    ): Promise<any>\n    {\n        const hasBody = input.body !== undefined;\n        const hasFormData = input.formData !== undefined && Object.keys(input.formData).length > 0;\n        const method = (hasBody || hasFormData) ? 'POST' : 'GET';\n\n        // Build full URL - handle SSR case where SPFN_APP_URL might not be set\n        let appUrl = env.SPFN_APP_URL || '';\n\n        // In SSR environment, if SPFN_APP_URL is not set, try to get host from request headers\n        if (!appUrl && typeof window === 'undefined')\n        {\n            try\n            {\n                const { headers } = await import('next/headers');\n                const headersList = await headers();\n                const host = headersList.get('host');\n                const protocol = headersList.get('x-forwarded-proto') || 'http';\n                if (host)\n                {\n                    appUrl = `${protocol}://${host}`;\n                    if (debug)\n                    {\n                        apiLogger.debug(`Auto-detected app URL from headers: ${appUrl}`);\n                    }\n                }\n            }\n            catch\n            {\n                // Fallback: use relative URL and let fetch handle it\n                if (debug)\n                {\n                    apiLogger.warn('Could not determine app URL in SSR environment, using relative URL');\n                }\n            }\n        }\n\n        // Build URL based on method\n        let fullUrl: string;\n        if (method === 'GET')\n        {\n            // GET: encode input in query string\n            const inputParam = encodeURIComponent(JSON.stringify(input));\n            fullUrl = `${appUrl}${baseUrl}/${routeName}?input=${inputParam}`;\n        }\n        else\n        {\n            // POST: input goes in body\n            fullUrl = `${appUrl}${baseUrl}/${routeName}`;\n        }\n\n        // Prepare headers\n        // Note: Don't set Content-Type for formData - browser sets it with boundary\n        const headers: Record<string, string> = {\n            ...(hasFormData ? {} : { 'Content-Type': 'application/json' }),\n            ...defaultHeaders,\n            ...options.headers,\n        };\n\n        // Auto-detect server cookies and merge with user-provided cookies\n        const autoDetectedCookies = await autoDetectServerCookies();\n        const cookiesToSend = {\n            ...autoDetectedCookies,\n            ...(options.cookies || {}),\n        };\n\n        // Add Cookie header if we have cookies to send\n        if (Object.keys(cookiesToSend).length > 0)\n        {\n            headers['Cookie'] = buildCookieHeader(cookiesToSend);\n        }\n\n        // Mirror the readable CSRF cookie into a header, from the browser jar or\n        // — server-side — from the jar being forwarded.\n        //\n        // Carried on GET calls too, deliberately: the wire method here is chosen\n        // by whether the input has a body, not by what the route does. A bodyless\n        // mutation (`api.logout.call({})`) travels as GET and the proxy still\n        // forwards it as the route's POST, so a GET-shaped call can be exactly\n        // the request that needs the header. The proxy decides what to check from\n        // the resolved route method, and ignores the header on safe routes.\n        const csrfToken = csrfHeaderValue(\n            typeof window === 'undefined' ? Object.entries(cookiesToSend) : documentCookieEntries(),\n        );\n\n        const csrfSetByCaller = Object.keys(headers).some(name => name.toLowerCase() === CSRF_HEADER);\n\n        if (csrfToken && !csrfSetByCaller)\n        {\n            headers[CSRF_HEADER] = csrfToken;\n        }\n\n        // Log cookie auto-detection if debug enabled\n        if (debug && Object.keys(autoDetectedCookies).length > 0)\n        {\n            const cookieArray = Object.entries(autoDetectedCookies).map(([name, value]) => ({ name, value }));\n            debugLogs.logCookieAutoDetection(apiLogger, cookieArray);\n        }\n\n        // Build request init\n        const requestInit: RequestInit = {\n            method,\n            headers,\n            ...options.fetchOptions,\n        };\n\n        // Add body for POST\n        if (method === 'POST')\n        {\n            if (hasFormData)\n            {\n                // Build FormData for file uploads\n                const formData = new FormData();\n\n                // Add non-formData fields (params, query, headers, cookies) as JSON metadata\n                const metadata: Record<string, any> = {};\n                if (input.params) metadata.params = input.params;\n                if (input.query) metadata.query = input.query;\n                if (input.headers) metadata.headers = input.headers;\n                if (input.cookies) metadata.cookies = input.cookies;\n\n                if (Object.keys(metadata).length > 0)\n                {\n                    formData.append('__metadata', JSON.stringify(metadata));\n                }\n\n                // Add formData fields\n                for (const [key, value] of Object.entries(input.formData))\n                {\n                    if (value instanceof File)\n                    {\n                        formData.append(key, value);\n                    }\n                    else if (Array.isArray(value))\n                    {\n                        // Handle array of files or values\n                        for (const item of value)\n                        {\n                            if (item instanceof File)\n                            {\n                                formData.append(key, item);\n                            }\n                            else\n                            {\n                                formData.append(key, String(item));\n                            }\n                        }\n                    }\n                    else if (value !== undefined && value !== null)\n                    {\n                        formData.append(key, String(value));\n                    }\n                }\n\n                requestInit.body = formData;\n            }\n            else\n            {\n                requestInit.body = JSON.stringify(input);\n            }\n        }\n\n        // Execute request interceptors\n        let init = requestInit;\n        if (globalOnRequest)\n        {\n            init = await globalOnRequest(fullUrl, init);\n        }\n        if (options.onRequest)\n        {\n            init = await options.onRequest(fullUrl, init);\n        }\n\n        if (debug)\n        {\n            debugLogs.logRequest(apiLogger, routeName, method, fullUrl, !!init.body);\n        }\n\n        // Execute fetch with timeout\n        let response: Response;\n        let body: any;\n\n        try\n        {\n            response = await executeFetchWithTimeout(fullUrl, init, timeout, customFetch);\n\n            // Parse response\n            body = await parseResponseBody(response);\n\n            // Execute global + local response interceptors\n            if (globalOnResponse)\n            {\n                const result = await globalOnResponse(response, body);\n                response = result.response;\n                body = result.body;\n            }\n            if (options.onResponse)\n            {\n                const result = await options.onResponse(response, body);\n                response = result.response;\n                body = result.body;\n            }\n\n            if (debug)\n            {\n                debugLogs.logResponse(apiLogger, routeName, response.status, !!body);\n            }\n        }\n        catch (error)\n        {\n            // Handle timeout specifically\n            if (error instanceof Error && error.name === 'AbortError')\n            {\n                apiLogger.error('Request timeout', {\n                    route: routeName,\n                    method,\n                    url: fullUrl,\n                    timeout,\n                });\n\n                throw new ApiError(\n                    `Request timeout after ${timeout}ms`,\n                    408,\n                    fullUrl,\n                    undefined,\n                    'timeout',\n                );\n            }\n\n            // Network error\n            const errorMessage = error instanceof Error ? error.message : 'Network error';\n            apiLogger.error('Network error', {\n                route: routeName,\n                method,\n                url: fullUrl,\n                error: errorMessage,\n                errorName: error instanceof Error ? error.name : 'unknown',\n            });\n\n            throw new ApiError(\n                errorMessage,\n                0,\n                fullUrl,\n                undefined,\n                'network',\n            );\n        }\n\n        // Handle error responses\n        if (!response.ok)\n        {\n            await handleErrorResponse(response, body, fullUrl, errorRegistry, debug, apiLogger);\n        }\n\n        return body;\n    }\n\n    /**\n     * Build client proxy\n     *\n     * Every property access returns a RouteCallBuilder.\n     * Nested routers are supported via dot notation in routeName.\n     */\n    function buildProxy(prefix = ''): any\n    {\n        return new Proxy(\n            {},\n            {\n                get(_target, prop: string)\n                {\n                    const currentPath = prefix ? `${prefix}.${prop}` : prop;\n\n                    // Return RouteCallBuilder that can either be called or chained\n                    return new RouteCallBuilder(\n                        (input: any, options: CallOptions) => executeCall(currentPath, input, options),\n                        currentPath,\n                    );\n                },\n            },\n        );\n    }\n\n    return buildProxy() as Client<TRouter>;\n}\n"]}
+{"version":3,"sources":["../../src/nextjs/client/debug-logs.ts","../../src/nextjs/client/errors.ts","../../src/nextjs/shared.ts","../../src/nextjs/client/helpers.ts","../../src/nextjs/client/csrf.ts","../../src/nextjs/client/builder.ts","../../src/nextjs/client/core.ts"],"names":["logger","errorRegistry","coreErrorRegistry","headers"],"mappings":";;;;;;;AAMO,SAAS,sBAAA,CACZA,SACA,OAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,sDAAA,EAAwD;AAAA,IACjE,aAAa,OAAA,CAAQ,MAAA;AAAA,IACrB,WAAA,EAAa,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,KAAK,EAAE,IAAI;AAAA,GACvC,CAAA;AACL;AAEO,SAAS,UAAA,CACZA,OAAAA,EACA,SAAA,EACA,MAAA,EACA,KACA,OAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,gBAAA,EAAa;AAAA,IACtB,KAAA,EAAO,SAAA;AAAA,IACP,MAAA;AAAA,IACA,GAAA;AAAA,IACA;AAAA,GACH,CAAA;AACL;AAEO,SAAS,WAAA,CACZA,OAAAA,EACA,SAAA,EACA,MAAA,EACA,OAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,iBAAA,EAAc;AAAA,IACvB,KAAA,EAAO,SAAA;AAAA,IACP,MAAA;AAAA,IACA;AAAA,GACH,CAAA;AACL;AAEO,SAAS,gBAAA,CACZA,OAAAA,EACA,MAAA,EACA,IAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,yBAAA,EAA2B;AAAA,IACpC,MAAA;AAAA,IACA,OAAA,EAAS,CAAC,CAAC,IAAA;AAAA,IACX,UAAU,OAAO,IAAA;AAAA,IACjB,YAAA,EAAc,IAAA,IAAQ,OAAO,IAAA,KAAS,YAAY,QAAA,IAAY,IAAA;AAAA,IAC9D,WAAW,IAAA,EAAM;AAAA,GACpB,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,OAAAA,EACA,SAAA,EACA,eAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,kCAAA,EAAoC;AAAA,IAC7C,SAAA;AAAA,IACA,WAAA,EAAa,IAAA;AAAA,IACb;AAAA,GACH,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,SACA,KAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,iCAAA,EAAmC;AAAA,IAC5C,WAAW,KAAA,EAAO,IAAA;AAAA,IAClB,gBAAA,EAAkB,OAAO,WAAA,CAAY,IAAA;AAAA,IACrC,SAAS,KAAA,EAAO;AAAA,GACnB,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,SACA,KAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,wBAAA,EAA0B;AAAA,IACnC,SAAA,EAAW,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,IAAA,GAAO,SAAA;AAAA,IACjD,cAAc,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK;AAAA,GACtE,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,OAAAA,EACA,aAAA,EACA,IAAA,EAEJ;AACI,EAAA,MAAM,MAAA,GAAS,CAAC,aAAA,GACV,aAAA,GACA,CAAC,IAAA,GACG,SAAA,GACA,OAAO,IAAA,KAAS,QAAA,GACZ,iBAAA,GACA,EAAE,QAAA,IAAY,QACV,iBAAA,GACA,SAAA;AAElB,EAAAA,OAAAA,CAAO,KAAA,CAAM,gCAAA,EAAkC,EAAE,QAAQ,CAAA;AAC7D;AAEO,SAAS,4BAAA,CACZA,SACA,KAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,6BAAA,EAA+B;AAAA,IACxC,WAAW,KAAA,CAAM,IAAA;AAAA,IACjB,oBAAA,EAAsB,MAAM,WAAA,CAAY,IAAA;AAAA,IACxC,SAAA,EAAW,MAAA,CAAO,cAAA,CAAe,KAAK,EAAE,WAAA,CAAY;AAAA,GACvD,CAAA;AACL;;;ACxHO,IAAM,QAAA,GAAN,cAAuB,KAAA,CAC9B;AAAA,EACI,WAAA,CACI,OAAA,EACgB,MAAA,EACA,GAAA,EACA,UACA,SAAA,EAEpB;AACI,IAAA,KAAA,CAAM,OAAO,CAAA;AANG,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAIhB,IAAA,IAAA,CAAK,IAAA,GAAO,UAAA;AAAA,EAChB;AACJ;;;ACyCO,SAAS,kBAAkB,OAAA,EAClC;AACI,EAAA,OAAO,OAAO,OAAA,CAAQ,OAAO,CAAA,CACxB,GAAA,CAAI,CAAC,CAAC,GAAA,EAAK,KAAK,CAAA,KAAM,GAAG,GAAG,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,CAAA,CACvC,KAAK,IAAI,CAAA;AAClB;AAUA,eAAsB,kBAAkB,QAAA,EACxC;AAEI,EAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EACxB;AACI,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAEvD,EAAA,IAAI,WAAA,EAAa,QAAA,CAAS,kBAAkB,CAAA,EAC5C;AACI,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,IAAA,OAAO,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,GAAI,IAAA;AAAA,EACrC,CAAA,MAEA;AACI,IAAA,OAAO,MAAM,SAAS,IAAA,EAAK;AAAA,EAC/B;AACJ;;;ACvFA,IAAM,YAAA,GAAe,MAAA,CAAO,KAAA,CAAM,yBAAyB,CAAA;AAM3D,eAAsB,uBAAA,GACtB;AAEI,EAAA,IAAI,OAAO,WAAW,WAAA,EACtB;AACI,IAAA,OAAO,EAAC;AAAA,EACZ;AAEA,EAAA,IACA;AAEI,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,OAAO,cAAc,CAAA;AAC/C,IAAA,MAAM,WAAA,GAAc,MAAM,OAAA,EAAQ;AAClC,IAAA,MAAM,UAAA,GAAa,YAAY,MAAA,EAAO;AAEtC,IAAA,MAAM,SAAS,MAAA,CAAO,WAAA;AAAA,MAClB,UAAA,CAAW,IAAI,CAAA,MAAA,KAAU,CAAC,OAAO,IAAA,EAAM,MAAA,CAAO,KAAK,CAAC;AAAA,KACxD;AAEA,IAAA,YAAA,CAAa,MAAM,yBAAA,EAA2B;AAAA,MAC1C,OAAO,UAAA,CAAW,MAAA;AAAA,MAClB,KAAA,EAAO,UAAA,CAAW,GAAA,CAAI,CAAA,CAAA,KAAK,EAAE,IAAI;AAAA,KACpC,CAAA;AAED,IAAA,OAAO,MAAA;AAAA,EACX,SACO,KAAA,EACP;AAGI,IAAA,MAAM,GAAA,GAAM,KAAA;AACZ,IAAA,YAAA,CAAa,KAAK,+BAAA,EAAiC;AAAA,MAC/C,SAAS,GAAA,CAAI,OAAA;AAAA,MACb,MAAM,GAAA,CAAI;AAAA,KACb,CAAA;AAED,IAAA,OAAO,EAAC;AAAA,EACZ;AACJ;AAKA,eAAsB,uBAAA,CAClB,GAAA,EACA,IAAA,EACA,OAAA,EACA,cAA4B,KAAA,EAEhC;AACI,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,YAAY,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,OAAO,CAAA;AAE9D,EAAA,IACA;AACI,IAAA,MAAM,QAAA,GAAW,MAAM,WAAA,CAAY,GAAA,EAAK;AAAA,MACpC,GAAG,IAAA;AAAA,MACH,QAAQ,UAAA,CAAW;AAAA,KACtB,CAAA;AAED,IAAA,YAAA,CAAa,SAAS,CAAA;AAEtB,IAAA,OAAO,QAAA;AAAA,EACX,SACO,KAAA,EACP;AACI,IAAA,YAAA,CAAa,SAAS,CAAA;AACtB,IAAA,MAAM,KAAA;AAAA,EACV;AACJ;AAOA,eAAsB,oBAClB,QAAA,EACA,IAAA,EACA,OAAA,EACA,aAAA,EACA,OACAA,OAAAA,EAEJ;AACI,EAAA,IAAI,KAAA,EACJ;AACI,IAAU,gBAAA,CAAiBA,OAAAA,EAAQ,QAAA,CAAS,MAAA,EAAQ,IAAI,CAAA;AAAA,EAC5D;AAGA,EAAA,IAAI,iBAAA,GAAkC,IAAA;AAEtC,EAAA,IAAI,iBAAiB,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,IAAY,YAAY,IAAA,EACrE;AACI,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,+BAA+BA,OAAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,aAAA,CAAc,oBAAoB,CAAA;AAAA,IACpG;AAEA,IAAA,IACA;AACI,MAAA,iBAAA,GAAoB,aAAA,CAAc,YAAY,IAAW,CAAA;AAEzD,MAAA,IAAI,KAAA,EACJ;AACI,QAAU,8BAAA,CAA+BA,SAAQ,iBAAiB,CAAA;AAAA,MACtE;AAAA,IACJ,SACO,gBAAA,EACP;AAEI,MAAA,IAAI,KAAA,EACJ;AACI,QAAU,8BAAA,CAA+BA,SAAQ,gBAAgB,CAAA;AAAA,MACrE;AAAA,IAEJ;AAAA,EACJ,WACS,KAAA,EACT;AACI,IAAU,8BAAA,CAA+BA,OAAAA,EAAQ,aAAA,EAAe,IAAI,CAAA;AAAA,EACxE;AAGA,EAAA,IAAI,iBAAA,EACJ;AACI,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,4BAAA,CAA6BA,SAAQ,iBAAiB,CAAA;AAAA,IACpE;AAEA,IAAA,MAAM,iBAAA;AAAA,EACV;AAGA,EAAA,IAAI,SAAS,MAAA,KAAW,GAAA,IAAO,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAA,EACxD;AACI,IAAAA,OAAAA,CAAO,IAAA;AAAA,MACH;AAAA,KAMJ;AAAA,EACJ;AAEA,EAAA,MAAM,IAAI,QAAA;AAAA,IACN,MAAM,OAAA,IAAW,CAAA,KAAA,EAAQ,SAAS,MAAM,CAAA,EAAA,EAAK,SAAS,UAAU,CAAA,CAAA;AAAA,IAChE,QAAA,CAAS,MAAA;AAAA,IACT,OAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACJ;AACJ;;;AC1JO,IAAM,WAAA,GAAc;AAW3B,IAAM,mBAAA,GAAsB,oBAAA;AAW5B,IAAM,iBAAA,GAAoB,UAAA;AAW1B,IAAM,cAAA,GAAiB,EAAA;AAkBvB,SAAS,iBAAiB,MAAA,EAC1B;AAGI,EAAA,MAAM,SAAS,KAAA,CAAM,IAAA,CAAK,IAAI,GAAA,CAAI,MAAM,CAAC,CAAA;AAEzC,EAAA,IAAI,MAAA,CAAO,UAAU,cAAA,EACrB;AACI,IAAA,OAAO,MAAA;AAAA,EACX;AAEA,EAAA,MAAM,OAAO,cAAA,GAAiB,CAAA;AAE9B,EAAA,OAAO,CAAC,GAAG,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,EAAG,GAAG,MAAA,CAAO,KAAA,CAAM,CAAC,IAAI,CAAC,CAAA;AAC5D;AAcO,SAAS,gBAAgB,OAAA,EAChC;AAMI,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,IAAA,CAAK,OAAO,CAAA,CAC5B,MAAA,CAAO,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,KAAM,mBAAA,CAAoB,KAAK,IAAI,CAAA,IACjD,iBAAA,CAAkB,IAAA,CAAK,KAAK,CAAA,IAC5B,CAAC,KAAA,CAAM,SAAS,GAAG,CAAC,CAAA,CAC1B,GAAA,CAAI,CAAC,GAAG,KAAK,MAAM,KAAK,CAAA;AAE7B,EAAA,MAAM,UAAA,GAAa,iBAAiB,MAAM,CAAA;AAE1C,EAAA,OAAO,WAAW,MAAA,GAAS,CAAA,GAAI,UAAA,CAAW,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA;AAC1D;AAOO,SAAS,qBAAA,GAChB;AACI,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA,IAAe,CAAC,SAAS,MAAA,EACjD;AACI,IAAA,OAAO,EAAC;AAAA,EACZ;AAEA,EAAA,MAAM,UAAmC,EAAC;AAE1C,EAAA,KAAA,MAAW,IAAA,IAAQ,QAAA,CAAS,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAC5C;AACI,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAElC,IAAA,IAAI,YAAY,CAAA,EAChB;AACI,MAAA,OAAA,CAAQ,KAAK,CAAC,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,SAAS,CAAA,CAAE,IAAA,EAAK,EAAG,IAAA,CAAK,MAAM,SAAA,GAAY,CAAC,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAAA,IACpF;AAAA,EACJ;AAEA,EAAA,OAAO,OAAA;AACX;;;ACrDO,IAAM,gBAAA,GAAN,MAAM,iBAAA,CAIb;AAAA,EAOI,WAAA,CACqB,UACA,SAAA,EAErB;AAHqB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAEpB;AAAA,EAVO,QAAA;AAAA,EACA,QAAA;AAAA,EACA,aAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA;AAAA;AAAA;AAAA,EAWA,KAAA,GACR;AACI,IAAA,MAAM,UAAU,IAAI,iBAAA;AAAA,MAChB,IAAA,CAAK,QAAA;AAAA,MACL,IAAA,CAAK;AAAA,KACT;AACA,IAAA,OAAA,CAAQ,WAAW,IAAA,CAAK,QAAA;AACxB,IAAA,OAAA,CAAQ,WAAW,IAAA,CAAK,QAAA;AACxB,IAAA,OAAA,CAAQ,gBAAgB,IAAA,CAAK,aAAA;AAC7B,IAAA,OAAA,CAAQ,aAAa,IAAA,CAAK,UAAA;AAC1B,IAAA,OAAA,CAAQ,cAAc,IAAA,CAAK,WAAA;AAE3B,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,OAAA,EACR;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,WAAW,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,GAAG,OAAA,EAAQ;AAElD,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,OAAA,EACR;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,WAAW,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,GAAG,OAAA,EAAQ;AAElD,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,OAAA,EACb;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,gBAAgB,EAAE,GAAG,IAAA,CAAK,aAAA,EAAe,GAAG,OAAA,EAAQ;AAE5D,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,UAAU,WAAA,EACV;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,UAAA,GAAa,WAAA;AAErB,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,WAAW,WAAA,EACX;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,WAAA,GAAc,WAAA;AAEtB,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,KAAK,KAAA,EACL;AACI,IAAA,MAAM,UAAuB,EAAC;AAE9B,IAAA,IAAI,KAAK,QAAA,EACT;AACI,MAAA,OAAA,CAAQ,UAAU,IAAA,CAAK,QAAA;AAAA,IAC3B;AAEA,IAAA,IAAI,KAAK,QAAA,EACT;AACI,MAAA,OAAA,CAAQ,UAAU,IAAA,CAAK,QAAA;AAAA,IAC3B;AAEA,IAAA,IAAI,KAAK,aAAA,EACT;AACI,MAAA,OAAA,CAAQ,eAAe,IAAA,CAAK,aAAA;AAAA,IAChC;AAEA,IAAA,IAAI,KAAK,UAAA,EACT;AACI,MAAA,OAAA,CAAQ,YAAY,IAAA,CAAK,UAAA;AAAA,IAC7B;AAEA,IAAA,IAAI,KAAK,WAAA,EACT;AACI,MAAA,OAAA,CAAQ,aAAa,IAAA,CAAK,WAAA;AAAA,IAC9B;AAEA,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,KAAA,IAAS,IAAI,OAAO,CAAA;AAAA,EAC7C;AACJ,CAAA;;;AC/JA,IAAM,SAAA,GAAYA,MAAAA,CAAO,KAAA,CAAM,uBAAuB,CAAA;AAwB/C,SAAS,SAAA,CACZ,MAAA,GAAoB,EAAC,EAEzB;AACI,EAAA,MAAM;AAAA,IACF,OAAA,GAAU,UAAA;AAAA,IACV,OAAA,EAAS,iBAAiB,EAAC;AAAA,IAC3B,UAAU,GAAA,CAAI,cAAA;AAAA,IACd,OAAO,WAAA,GAAc,KAAA;AAAA,IACrB,SAAA,EAAW,eAAA;AAAA,IACX,UAAA,EAAY,gBAAA;AAAA,IACZ,aAAA,EAAe,mBAAA;AAAA,IACf,KAAA,GAAQ;AAAA,GACZ,GAAI,MAAA;AAGJ,EAAA,MAAMC,eAAA,GAAgB,KAAA,CAAM,OAAA,CAAQ,mBAAmB,CAAA,GACjD,IAAI,aAAA,CAAc,CAACC,aAAA,EAAmB,GAAG,mBAAmB,CAAC,IAC7D,mBAAA,IAAuBA,aAAA;AAE7B,EAAA,IAAI,KAAA,EACJ;AACI,IAAA,SAAA,CAAU,KAAA,CAAM,wBAAA,EAA0B,EAAE,OAAA,EAAS,CAAA;AAAA,EACzD;AAUA,EAAA,eAAe,YACX,SAAA,EACA,KAAA,GAAa,EAAC,EACd,OAAA,GAAuB,EAAC,EAE5B;AACI,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,KAAS,MAAA;AAC/B,IAAA,MAAM,WAAA,GAAc,MAAM,QAAA,KAAa,MAAA,IAAa,OAAO,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA,CAAE,MAAA,GAAS,CAAA;AACzF,IAAA,MAAM,MAAA,GAAU,OAAA,IAAW,WAAA,GAAe,MAAA,GAAS,KAAA;AAGnD,IAAA,IAAI,MAAA,GAAS,IAAI,YAAA,IAAgB,EAAA;AAGjC,IAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,WAAA,EACjC;AACI,MAAA,IACA;AACI,QAAA,MAAM,EAAE,OAAA,EAAAC,QAAAA,EAAQ,GAAI,MAAM,OAAO,cAAc,CAAA;AAC/C,QAAA,MAAM,WAAA,GAAc,MAAMA,QAAAA,EAAQ;AAClC,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,GAAA,CAAI,MAAM,CAAA;AACnC,QAAA,MAAM,QAAA,GAAW,WAAA,CAAY,GAAA,CAAI,mBAAmB,CAAA,IAAK,MAAA;AACzD,QAAA,IAAI,IAAA,EACJ;AACI,UAAA,MAAA,GAAS,CAAA,EAAG,QAAQ,CAAA,GAAA,EAAM,IAAI,CAAA,CAAA;AAC9B,UAAA,IAAI,KAAA,EACJ;AACI,YAAA,SAAA,CAAU,KAAA,CAAM,CAAA,oCAAA,EAAuC,MAAM,CAAA,CAAE,CAAA;AAAA,UACnE;AAAA,QACJ;AAAA,MACJ,CAAA,CAAA,MAEA;AAEI,QAAA,IAAI,KAAA,EACJ;AACI,UAAA,SAAA,CAAU,KAAK,oEAAoE,CAAA;AAAA,QACvF;AAAA,MACJ;AAAA,IACJ;AAGA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI,WAAW,KAAA,EACf;AAEI,MAAA,MAAM,UAAA,GAAa,kBAAA,CAAmB,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAC3D,MAAA,OAAA,GAAU,GAAG,MAAM,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,SAAS,UAAU,UAAU,CAAA,CAAA;AAAA,IAClE,CAAA,MAEA;AAEI,MAAA,OAAA,GAAU,CAAA,EAAG,MAAM,CAAA,EAAG,OAAO,IAAI,SAAS,CAAA,CAAA;AAAA,IAC9C;AAIA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACpC,GAAI,WAAA,GAAc,EAAC,GAAI,EAAE,gBAAgB,kBAAA,EAAmB;AAAA,MAC5D,GAAG,cAAA;AAAA,MACH,GAAG,OAAA,CAAQ;AAAA,KACf;AAGA,IAAA,MAAM,mBAAA,GAAsB,MAAM,uBAAA,EAAwB;AAC1D,IAAA,MAAM,aAAA,GAAgB;AAAA,MAClB,GAAG,mBAAA;AAAA,MACH,GAAI,OAAA,CAAQ,OAAA,IAAW;AAAC,KAC5B;AAGA,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,aAAa,CAAA,CAAE,SAAS,CAAA,EACxC;AACI,MAAA,OAAA,CAAQ,QAAQ,CAAA,GAAI,iBAAA,CAAkB,aAAa,CAAA;AAAA,IACvD;AAWA,IAAA,MAAM,SAAA,GAAY,eAAA;AAAA,MACd,OAAO,MAAA,KAAW,WAAA,GAAc,OAAO,OAAA,CAAQ,aAAa,IAAI,qBAAA;AAAsB,KAC1F;AAEA,IAAA,MAAM,eAAA,GAAkB,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,KAAK,CAAA,IAAA,KAAQ,IAAA,CAAK,WAAA,EAAY,KAAM,WAAW,CAAA;AAE5F,IAAA,IAAI,SAAA,IAAa,CAAC,eAAA,EAClB;AACI,MAAA,OAAA,CAAQ,WAAW,CAAA,GAAI,SAAA;AAAA,IAC3B;AAGA,IAAA,IAAI,SAAS,MAAA,CAAO,IAAA,CAAK,mBAAmB,CAAA,CAAE,SAAS,CAAA,EACvD;AACI,MAAA,MAAM,WAAA,GAAc,MAAA,CAAO,OAAA,CAAQ,mBAAmB,EAAE,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,MAAO,EAAE,IAAA,EAAM,OAAM,CAAE,CAAA;AAChG,MAAU,sBAAA,CAAuB,WAAW,WAAW,CAAA;AAAA,IAC3D;AAGA,IAAA,MAAM,WAAA,GAA2B;AAAA,MAC7B,MAAA;AAAA,MACA,OAAA;AAAA,MACA,GAAG,OAAA,CAAQ;AAAA,KACf;AAGA,IAAA,IAAI,WAAW,MAAA,EACf;AACI,MAAA,IAAI,WAAA,EACJ;AAEI,QAAA,MAAM,QAAA,GAAW,IAAI,QAAA,EAAS;AAG9B,QAAA,MAAM,WAAgC,EAAC;AACvC,QAAA,IAAI,KAAA,CAAM,MAAA,EAAQ,QAAA,CAAS,MAAA,GAAS,KAAA,CAAM,MAAA;AAC1C,QAAA,IAAI,KAAA,CAAM,KAAA,EAAO,QAAA,CAAS,KAAA,GAAQ,KAAA,CAAM,KAAA;AACxC,QAAA,IAAI,KAAA,CAAM,OAAA,EAAS,QAAA,CAAS,OAAA,GAAU,KAAA,CAAM,OAAA;AAC5C,QAAA,IAAI,KAAA,CAAM,OAAA,EAAS,QAAA,CAAS,OAAA,GAAU,KAAA,CAAM,OAAA;AAE5C,QAAA,IAAI,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA,CAAE,SAAS,CAAA,EACnC;AACI,UAAA,QAAA,CAAS,MAAA,CAAO,YAAA,EAAc,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,QAC1D;AAGA,QAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA,EACxD;AACI,UAAA,IAAI,iBAAiB,IAAA,EACrB;AACI,YAAA,QAAA,CAAS,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,UAC9B,CAAA,MAAA,IACS,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAC5B;AAEI,YAAA,KAAA,MAAW,QAAQ,KAAA,EACnB;AACI,cAAA,IAAI,gBAAgB,IAAA,EACpB;AACI,gBAAA,QAAA,CAAS,MAAA,CAAO,KAAK,IAAI,CAAA;AAAA,cAC7B,CAAA,MAEA;AACI,gBAAA,QAAA,CAAS,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,IAAI,CAAC,CAAA;AAAA,cACrC;AAAA,YACJ;AAAA,UACJ,CAAA,MAAA,IACS,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAC1C;AACI,YAAA,QAAA,CAAS,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,UACtC;AAAA,QACJ;AAEA,QAAA,WAAA,CAAY,IAAA,GAAO,QAAA;AAAA,MACvB,CAAA,MAEA;AACI,QAAA,WAAA,CAAY,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AAAA,MAC3C;AAAA,IACJ;AAGA,IAAA,IAAI,IAAA,GAAO,WAAA;AACX,IAAA,IAAI,eAAA,EACJ;AACI,MAAA,IAAA,GAAO,MAAM,eAAA,CAAgB,OAAA,EAAS,IAAI,CAAA;AAAA,IAC9C;AACA,IAAA,IAAI,QAAQ,SAAA,EACZ;AACI,MAAA,IAAA,GAAO,MAAM,OAAA,CAAQ,SAAA,CAAU,OAAA,EAAS,IAAI,CAAA;AAAA,IAChD;AAEA,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,UAAA,CAAW,WAAW,SAAA,EAAW,MAAA,EAAQ,SAAS,CAAC,CAAC,KAAK,IAAI,CAAA;AAAA,IAC3E;AAGA,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI,IAAA;AAEJ,IAAA,IACA;AACI,MAAA,QAAA,GAAW,MAAM,uBAAA,CAAwB,OAAA,EAAS,IAAA,EAAM,SAAS,WAAW,CAAA;AAG5E,MAAA,IAAA,GAAO,MAAM,kBAAkB,QAAQ,CAAA;AAGvC,MAAA,IAAI,gBAAA,EACJ;AACI,QAAA,MAAM,MAAA,GAAS,MAAM,gBAAA,CAAiB,QAAA,EAAU,IAAI,CAAA;AACpD,QAAA,QAAA,GAAW,MAAA,CAAO,QAAA;AAClB,QAAA,IAAA,GAAO,MAAA,CAAO,IAAA;AAAA,MAClB;AACA,MAAA,IAAI,QAAQ,UAAA,EACZ;AACI,QAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,UAAA,CAAW,UAAU,IAAI,CAAA;AACtD,QAAA,QAAA,GAAW,MAAA,CAAO,QAAA;AAClB,QAAA,IAAA,GAAO,MAAA,CAAO,IAAA;AAAA,MAClB;AAEA,MAAA,IAAI,KAAA,EACJ;AACI,QAAU,YAAY,SAAA,EAAW,SAAA,EAAW,SAAS,MAAA,EAAQ,CAAC,CAAC,IAAI,CAAA;AAAA,MACvE;AAAA,IACJ,SACO,KAAA,EACP;AAEI,MAAA,IAAI,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,YAAA,EAC7C;AACI,QAAA,SAAA,CAAU,MAAM,iBAAA,EAAmB;AAAA,UAC/B,KAAA,EAAO,SAAA;AAAA,UACP,MAAA;AAAA,UACA,GAAA,EAAK,OAAA;AAAA,UACL;AAAA,SACH,CAAA;AAED,QAAA,MAAM,IAAI,QAAA;AAAA,UACN,yBAAyB,OAAO,CAAA,EAAA,CAAA;AAAA,UAChC,GAAA;AAAA,UACA,OAAA;AAAA,UACA,MAAA;AAAA,UACA;AAAA,SACJ;AAAA,MACJ;AAGA,MAAA,MAAM,YAAA,GAAe,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,eAAA;AAC9D,MAAA,SAAA,CAAU,MAAM,eAAA,EAAiB;AAAA,QAC7B,KAAA,EAAO,SAAA;AAAA,QACP,MAAA;AAAA,QACA,GAAA,EAAK,OAAA;AAAA,QACL,KAAA,EAAO,YAAA;AAAA,QACP,SAAA,EAAW,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,IAAA,GAAO;AAAA,OACpD,CAAA;AAED,MAAA,MAAM,IAAI,QAAA;AAAA,QACN,YAAA;AAAA,QACA,CAAA;AAAA,QACA,OAAA;AAAA,QACA,MAAA;AAAA,QACA;AAAA,OACJ;AAAA,IACJ;AAGA,IAAA,IAAI,CAAC,SAAS,EAAA,EACd;AACI,MAAA,MAAM,oBAAoB,QAAA,EAAU,IAAA,EAAM,OAAA,EAASF,eAAA,EAAe,OAAO,SAAS,CAAA;AAAA,IACtF;AAEA,IAAA,OAAO,IAAA;AAAA,EACX;AAkBA,EAAA,SAAS,UAAA,CAAW,SAAS,EAAA,EAC7B;AACI,IAAA,OAAO,IAAI,KAAA;AAAA,MACP,EAAC;AAAA,MACD;AAAA,QACI,GAAA,CAAI,SAAS,IAAA,EACb;AACI,UAAA,MAAM,cAAc,MAAA,GAAS,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,GAAK,IAAA;AAGnD,UAAA,OAAO,IAAI,gBAAA;AAAA,YACP,CAAC,KAAA,EAAY,OAAA,KAAyB,WAAA,CAAY,WAAA,EAAa,OAAO,OAAO,CAAA;AAAA,YAC7E;AAAA,WACJ;AAAA,QACJ;AAAA;AACJ,KACJ;AAAA,EACJ;AAEA,EAAA,OAAO,UAAA,EAAW;AACtB","file":"index.js","sourcesContent":["/**\n * Debug logging utilities for API client\n * Separates debug logging logic from main client code for better maintainability\n */\nimport type { Logger } from '@spfn/core/logger';\n\nexport function logCookieAutoDetection(\n    logger: Logger,\n    cookies: Array<{ name: string; value: string }>,\n): void\n{\n    logger.debug('Auto-detected server environment, forwarding cookies', {\n        cookieCount: cookies.length,\n        cookieNames: cookies.map(c => c.name),\n    });\n}\n\nexport function logRequest(\n    logger: Logger,\n    routeName: string,\n    method: string,\n    url: string,\n    hasBody: boolean,\n): void\n{\n    logger.debug('→ Request', {\n        route: routeName,\n        method,\n        url,\n        hasBody,\n    });\n}\n\nexport function logResponse(\n    logger: Logger,\n    routeName: string,\n    status: number,\n    hasBody: boolean,\n): void\n{\n    logger.debug('← Response', {\n        route: routeName,\n        status,\n        hasBody,\n    });\n}\n\nexport function logErrorResponse(\n    logger: Logger,\n    status: number,\n    body: any,\n): void\n{\n    logger.debug('Error response received', {\n        status,\n        hasBody: !!body,\n        bodyType: typeof body,\n        hasTypeField: body && typeof body === 'object' && '__type' in body,\n        typeValue: body?.__type,\n    });\n}\n\nexport function logErrorDeserializationAttempt(\n    logger: Logger,\n    errorType: string,\n    registeredTypes: string[],\n): void\n{\n    logger.debug('Attempting error deserialization', {\n        errorType,\n        hasRegistry: true,\n        registeredTypes,\n    });\n}\n\nexport function logErrorDeserializationSuccess(\n    logger: Logger,\n    error: Error | null,\n): void\n{\n    logger.debug('Error deserialized successfully', {\n        errorName: error?.name,\n        errorConstructor: error?.constructor.name,\n        message: error?.message,\n    });\n}\n\nexport function logErrorDeserializationFailure(\n    logger: Logger,\n    error: unknown,\n): void\n{\n    logger.debug('Deserialization failed', {\n        errorName: error instanceof Error ? error.name : 'unknown',\n        errorMessage: error instanceof Error ? error.message : String(error),\n    });\n}\n\nexport function logErrorDeserializationSkipped(\n    logger: Logger,\n    errorRegistry: any,\n    body: any,\n): void\n{\n    const reason = !errorRegistry\n        ? 'no registry'\n        : !body\n            ? 'no body'\n            : typeof body !== 'object'\n                ? 'body not object'\n                : !('__type' in body)\n                    ? 'no __type field'\n                    : 'unknown';\n\n    logger.debug('Skipping error deserialization', { reason });\n}\n\nexport function logThrowingDeserializedError(\n    logger: Logger,\n    error: Error,\n): void\n{\n    logger.debug('Throwing deserialized error', {\n        errorName: error.name,\n        errorConstructorName: error.constructor.name,\n        prototype: Object.getPrototypeOf(error).constructor.name,\n    });\n}\n","// ============================================================================\n// Client Error\n// ============================================================================\n\n/**\n * Typed client error\n */\nexport class ApiError extends Error\n{\n    constructor(\n        message: string,\n        public readonly status: number,\n        public readonly url: string,\n        public readonly response?: unknown,\n        public readonly errorType?: 'http' | 'network' | 'timeout',\n    )\n    {\n        super(message);\n        this.name = 'ApiError';\n    }\n}\n","/**\n * Shared utilities for Next.js client and proxy modules\n *\n * Contains common functions used by both client and proxy to avoid code duplication.\n */\n\n/**\n * Build URL with path parameters replaced\n *\n * @example\n * buildUrlWithParams('/users/:id/posts/:postId', { id: '123', postId: '456' })\n * // Returns: '/users/123/posts/456'\n */\nexport function buildUrlWithParams(path: string, params: Record<string, any>): string\n{\n    let url = path;\n    for (const [key, value] of Object.entries(params))\n    {\n        url = url.replace(`:${key}`, encodeURIComponent(String(value)));\n    }\n\n    return url;\n}\n\n/**\n * Build query string from object\n *\n * @example\n * buildQueryString({ page: '1', limit: '10', tags: ['foo', 'bar'] })\n * // Returns: '?page=1&limit=10&tags=foo&tags=bar'\n */\nexport function buildQueryString(query: Record<string, any>): string\n{\n    if (Object.keys(query).length === 0)\n    {\n        return '';\n    }\n\n    const searchParams = new URLSearchParams();\n    for (const [key, value] of Object.entries(query))\n    {\n        if (Array.isArray(value))\n        {\n            value.forEach((v) => searchParams.append(key, String(v)));\n        }\n        else\n        {\n            searchParams.append(key, String(value));\n        }\n    }\n\n    return `?${searchParams.toString()}`;\n}\n\n/**\n * Build Cookie header string from cookies object\n *\n * @example\n * buildCookieHeader({ session: 'abc123', theme: 'dark' })\n * // Returns: 'session=abc123; theme=dark'\n */\nexport function buildCookieHeader(cookies: Record<string, string>): string\n{\n    return Object.entries(cookies)\n        .map(([key, value]) => `${key}=${value}`)\n        .join('; ');\n}\n\n/**\n * Parse response body based on content type\n *\n * Handles:\n * - 204 No Content: returns null (no body expected)\n * - application/json: parses JSON body\n * - Other content types: returns raw text\n */\nexport async function parseResponseBody(response: Response): Promise<any>\n{\n    // 204 No Content has no body\n    if (response.status === 204)\n    {\n        return null;\n    }\n\n    const contentType = response.headers.get('content-type');\n\n    if (contentType?.includes('application/json'))\n    {\n        const text = await response.text();\n\n        return text ? JSON.parse(text) : null;\n    }\n    else\n    {\n        return await response.text();\n    }\n}\n","import type { Logger } from '@spfn/core/logger';\nimport type { ErrorRegistry } from '@spfn/core/errors';\nimport { logger } from '@spfn/core/logger';\nimport { ApiError } from './errors';\nimport * as debugLogs from './debug-logs';\n\n// Re-export shared utilities\nexport { buildCookieHeader, parseResponseBody } from '../shared';\n\nconst cookieLogger = logger.child('@spfn/core:auto-cookies');\n\n/**\n * Auto-detect cookies from Next.js server environment\n * Returns empty object if not in server environment or if cookies are not accessible\n */\nexport async function autoDetectServerCookies(): Promise<Record<string, string>>\n{\n    // Client environment — browser sends cookies automatically\n    if (typeof window !== 'undefined')\n    {\n        return {};\n    }\n\n    try\n    {\n        // Next.js cookies() API is only available in server environment\n        const { cookies } = await import('next/headers');\n        const cookieStore = await cookies();\n        const allCookies = cookieStore.getAll();\n\n        const result = Object.fromEntries(\n            allCookies.map(cookie => [cookie.name, cookie.value]),\n        );\n\n        cookieLogger.debug('Server cookies detected', {\n            count: allCookies.length,\n            names: allCookies.map(c => c.name),\n        });\n\n        return result;\n    }\n    catch (error)\n    {\n        // Server environment but cookies() not accessible\n        // (e.g. static generation, build time, or outside request context)\n        const err = error as Error;\n        cookieLogger.warn('Failed to read server cookies', {\n            message: err.message,\n            name: err.name,\n        });\n\n        return {};\n    }\n}\n\n/**\n * Execute fetch with timeout and abort controller\n */\nexport async function executeFetchWithTimeout(\n    url: string,\n    init: RequestInit,\n    timeout: number,\n    customFetch: typeof fetch = fetch,\n): Promise<Response>\n{\n    const controller = new AbortController();\n    const timeoutId = setTimeout(() => controller.abort(), timeout);\n\n    try\n    {\n        const response = await customFetch(url, {\n            ...init,\n            signal: controller.signal,\n        });\n\n        clearTimeout(timeoutId);\n\n        return response;\n    }\n    catch (error)\n    {\n        clearTimeout(timeoutId);\n        throw error;\n    }\n}\n\n/**\n * Handle error response with deserialization support\n * Attempts to deserialize custom errors if errorRegistry is provided\n * Falls back to ApiError if deserialization fails or is not available\n */\nexport async function handleErrorResponse(\n    response: Response,\n    body: any,\n    fullUrl: string,\n    errorRegistry: ErrorRegistry | undefined,\n    debug: boolean,\n    logger: Logger,\n): Promise<never>\n{\n    if (debug)\n    {\n        debugLogs.logErrorResponse(logger, response.status, body);\n    }\n\n    // Try to deserialize error if registry is provided\n    let deserializedError: Error | null = null;\n\n    if (errorRegistry && body && typeof body === 'object' && '__type' in body)\n    {\n        if (debug)\n        {\n            debugLogs.logErrorDeserializationAttempt(logger, body.__type, errorRegistry.getRegisteredTypes());\n        }\n\n        try\n        {\n            deserializedError = errorRegistry.deserialize(body as any);\n\n            if (debug)\n            {\n                debugLogs.logErrorDeserializationSuccess(logger, deserializedError);\n            }\n        }\n        catch (deserializeError)\n        {\n            // Deserialization itself failed (type not found, invalid data, etc.)\n            if (debug)\n            {\n                debugLogs.logErrorDeserializationFailure(logger, deserializeError);\n            }\n            // Fall through to ApiError below\n        }\n    }\n    else if (debug)\n    {\n        debugLogs.logErrorDeserializationSkipped(logger, errorRegistry, body);\n    }\n\n    // If deserialization succeeded, throw the deserialized error\n    if (deserializedError)\n    {\n        if (debug)\n        {\n            debugLogs.logThrowingDeserializedError(logger, deserializedError);\n        }\n\n        throw deserializedError;\n    }\n\n    // Fallback to generic ApiError\n    if (response.status === 404 && process.env.NODE_ENV !== 'production')\n    {\n        logger.warn(\n            '\\n⚠️  404 Not Found\\n\\n' +\n            'Check the following:\\n' +\n            '  1. Routes are registered in server.config.ts:\\n' +\n            '     → defineServerConfig().routes(appRouter)\\n' +\n            '  2. Delete .spfn cache if you recently added new routes:\\n' +\n            '     → rm -rf .spfn\\n',\n        );\n    }\n\n    throw new ApiError(\n        body?.message || `HTTP ${response.status}: ${response.statusText}`,\n        response.status,\n        fullUrl,\n        body,\n        'http',\n    );\n}\n","/**\n * CSRF token transport for the RPC client\n *\n * The Next.js proxy sets a readable (non-HttpOnly) cookie carrying an HMAC of\n * the session's key id; this module mirrors it into a request header. The proxy\n * never compares cookie against header — it recomputes the value from the\n * session — so the cookie is transport only and reading it here is not a trust\n * decision. See the CSRF section of the @spfn/auth README.\n */\n\n/**\n * Header the readable CSRF cookie is mirrored into.\n *\n * Must match CSRF_HEADER in @spfn/auth. It is duplicated rather than imported\n * because @spfn/core cannot depend on @spfn/auth.\n */\nexport const CSRF_HEADER = 'x-spfn-csrf';\n\n/**\n * Cookie names carrying a CSRF token.\n *\n * @spfn/auth suffixes its cookie names with the server port so several local dev\n * instances on the same host do not overwrite each other's session, and the\n * browser cannot know that port — so match the family, not one name. Every\n * candidate is sent and the proxy accepts the request if any of them recomputes\n * to the expected value; a candidate an attacker tossed in never will.\n */\nconst CSRF_COOKIE_PATTERN = /^spfn_csrf(_\\d+)?$/;\n\n/**\n * Values that can be put in a header at all: printable ASCII, no space.\n *\n * A cookie jar is attacker-writable in the very case this feature exists for, and\n * `new Headers()` rejects a value outside Latin-1 — so a sibling subdomain that\n * tosses `spfn_csrf=한` would make every RPC call throw before it was sent, not\n * merely fail the check. A genuine token is 64 hex characters; anything that\n * cannot be a header value cannot be one.\n */\nconst HEADER_SAFE_VALUE = /^[!-~]+$/;\n\n/**\n * Upper bound on candidates sent, so a cookie-flooded jar stays a bounded header.\n *\n * Deliberately generous. The server recomputes the expected value once and then\n * only compares fixed-length strings, so extra candidates cost it almost nothing,\n * while every candidate dropped here is a chance to lock the user out of every\n * mutation — the far worse failure. Must not exceed the matching bound in\n * @spfn/auth's `matchesCsrfToken`, or values sent would never be looked at.\n */\nconst MAX_CANDIDATES = 32;\n\n/**\n * Choose which candidates to send when the jar holds more than the cap.\n *\n * `document.cookie` exposes neither Domain nor Path, so a tossed cookie is\n * indistinguishable from the genuine one here — the proxy is what tells them\n * apart, by recomputing. What this can do is refuse to drop the genuine value on\n * the floor. Browsers order the jar by path length descending, then by age\n * ascending, so a flood pushes the genuine cookie towards the end (attacker\n * cookies on a longer path) or towards the start (attacker cookies written later\n * on the same path). Keeping both ends survives either, where a plain prefix\n * survives only one.\n *\n * A jar flooded far past the cap is a denial of service that no client-side\n * choice fully prevents; the structural fix is a `__Host-` prefixed cookie name,\n * which a sibling subdomain cannot write at all.\n */\nfunction selectCandidates(values: string[]): string[]\n{\n    // Identical duplicates carry no extra information, so collapsing them buys\n    // back slots that a flood of one repeated value would otherwise burn.\n    const unique = Array.from(new Set(values));\n\n    if (unique.length <= MAX_CANDIDATES)\n    {\n        return unique;\n    }\n\n    const half = MAX_CANDIDATES / 2;\n\n    return [...unique.slice(0, half), ...unique.slice(-half)];\n}\n\n/**\n * Collect the CSRF token candidates from cookie entries.\n *\n * Takes entries rather than a map because a name can legitimately appear twice:\n * a sibling subdomain that tosses `spfn_csrf` for the parent domain leaves the\n * browser holding two cookies of that name, and folding them into a map would\n * throw away whichever the tossed one displaced — locking the user out of every\n * mutation. Sending both keeps the real one in play, and the tossed one is inert\n * because the proxy recomputes what it expects.\n *\n * @returns Header value (comma-separated), or undefined when no cookie exists\n */\nexport function csrfHeaderValue(cookies: Iterable<[string, string]>): string | undefined\n{\n    // A comma separates candidates on the wire, so a value containing one would\n    // arrive as several. That cannot be a genuine token — they are hex — but it\n    // would let a single tossed cookie spend the receiver's whole candidate\n    // budget and bury the real value behind it. Drop those, and anything that\n    // could not be a header value at all.\n    const values = Array.from(cookies)\n        .filter(([name, value]) => CSRF_COOKIE_PATTERN.test(name)\n            && HEADER_SAFE_VALUE.test(value)\n            && !value.includes(','))\n        .map(([, value]) => value);\n\n    const candidates = selectCandidates(values);\n\n    return candidates.length > 0 ? candidates.join(',') : undefined;\n}\n\n/**\n * Read the browser cookie jar as entries, duplicates preserved.\n *\n * Empty outside a browser (SSR reads the jar it forwards instead).\n */\nexport function documentCookieEntries(): Array<[string, string]>\n{\n    if (typeof document === 'undefined' || !document.cookie)\n    {\n        return [];\n    }\n\n    const entries: Array<[string, string]> = [];\n\n    for (const pair of document.cookie.split(';'))\n    {\n        const separator = pair.indexOf('=');\n\n        if (separator > 0)\n        {\n            entries.push([pair.slice(0, separator).trim(), pair.slice(separator + 1).trim()]);\n        }\n    }\n\n    return entries;\n}\n","// ============================================================================\n// Route Call Builder (Structured Input API)\n// ============================================================================\n\nimport type { RouteDef, Router } from '@spfn/core/route';\nimport type {\n    CallOptions,\n    ExtractRoutes,\n    InferRouteInput,\n    InferRouteOutput,\n    RequestInterceptor,\n    ResponseInterceptor,\n} from './types';\n\n/**\n * Pick only non-empty fields from StructuredInput\n *\n * This removes fields that are empty objects `{}` from the input type,\n * so users only need to provide fields that are actually defined in the route.\n */\ntype PickNonEmpty<T> = {\n    [K in keyof T as T[K] extends Record<string, never> ? never : K]: T[K];\n};\n\n/**\n * Make fields that can be undefined into optional fields\n *\n * When a field is defined as `Type.Optional(Type.Object({...}))`,\n * the resulting type is `T | undefined`. This utility converts such fields\n * into proper optional fields (`field?: T`) so users don't need to pass them.\n */\ntype MakeOptionalIfUndefinable<T> =\n    // Required fields (undefined is not assignable)\n    { [K in keyof T as undefined extends T[K] ? never : K]: T[K] }\n    // Optional fields (undefined is assignable)\n    & { [K in keyof T as undefined extends T[K] ? K : never]?: Exclude<T[K], undefined> };\n\n/**\n * Clean structured input - only include fields that have actual schema,\n * and make fields optional if they accept undefined\n */\ntype CleanStructuredInput<TInput> = MakeOptionalIfUndefinable<PickNonEmpty<TInput>>;\n\n/**\n * Check if input has any required fields\n *\n * Returns false if all fields are optional (i.e., {} is assignable to the input type)\n */\ntype HasAnyRequiredFields<TInput> = {} extends CleanStructuredInput<TInput> ? false : true;\n\n/**\n * Route call builder with structured input API\n *\n * Input is structured with explicit params, query, body fields\n * that match the server-side route definition.\n *\n * @example\n * ```typescript\n * // GET /users/:id - params only\n * const user = await api.getUser.call({ params: { id: '1' } });\n *\n * // GET /users/:id?include=posts - params + query\n * const user = await api.getUser.call({\n *     params: { id: '1' },\n *     query: { include: 'posts' }\n * });\n *\n * // POST /users - body only\n * const user = await api.createUser.call({\n *     body: { name: 'John', email: 'john@example.com' }\n * });\n *\n * // PUT /users/:id - params + body\n * const user = await api.updateUser.call({\n *     params: { id: '1' },\n *     body: { name: 'Jane' }\n * });\n *\n * // With options (headers, cookies, Next.js caching)\n * const user = await api.getUser\n *     .headers({ 'X-Custom': 'value' })\n *     .fetchOptions({ next: { revalidate: 60 } })\n *     .call({ params: { id: '1' } });\n * ```\n */\nexport class RouteCallBuilder<\n    TInput,\n    TOutput,\n>\n{\n    private _headers?: Record<string, string>;\n    private _cookies?: Record<string, string>;\n    private _fetchOptions?: RequestInit;\n    private _onRequest?: RequestInterceptor;\n    private _onResponse?: ResponseInterceptor;\n\n    constructor(\n        private readonly executor: (input: any, options: CallOptions) => Promise<TOutput>,\n        private readonly routeName: string,\n    ) \n    {}\n\n    /**\n     * Clone builder\n     */\n    private clone(): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = new RouteCallBuilder<TInput, TOutput>(\n            this.executor,\n            this.routeName,\n        );\n        builder._headers = this._headers;\n        builder._cookies = this._cookies;\n        builder._fetchOptions = this._fetchOptions;\n        builder._onRequest = this._onRequest;\n        builder._onResponse = this._onResponse;\n\n        return builder;\n    }\n\n    /**\n     * Set request headers\n     */\n    headers(headers: Record<string, string>): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._headers = { ...this._headers, ...headers };\n\n        return builder;\n    }\n\n    /**\n     * Set cookies\n     */\n    cookies(cookies: Record<string, string>): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._cookies = { ...this._cookies, ...cookies };\n\n        return builder;\n    }\n\n    /**\n     * Set Next.js fetch options\n     */\n    fetchOptions(options: RequestInit & { next?: { revalidate?: number | false; tags?: string[] } }): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._fetchOptions = { ...this._fetchOptions, ...options };\n\n        return builder;\n    }\n\n    /**\n     * Set request interceptor\n     */\n    onRequest(interceptor: RequestInterceptor): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._onRequest = interceptor;\n\n        return builder;\n    }\n\n    /**\n     * Set response interceptor\n     */\n    onResponse(interceptor: ResponseInterceptor): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._onResponse = interceptor;\n\n        return builder;\n    }\n\n    /**\n     * Execute the API call with structured input\n     *\n     * Input structure matches the server-side route definition:\n     * - params: Path parameters (e.g., { id: '123' } for /users/:id)\n     * - query: Query string parameters\n     * - body: Request body (for POST, PUT, PATCH)\n     */\n    call(input?: CleanStructuredInput<TInput>): Promise<TOutput>\n    {\n        const options: CallOptions = {};\n\n        if (this._headers)\n        {\n            options.headers = this._headers;\n        }\n\n        if (this._cookies)\n        {\n            options.cookies = this._cookies;\n        }\n\n        if (this._fetchOptions)\n        {\n            options.fetchOptions = this._fetchOptions;\n        }\n\n        if (this._onRequest)\n        {\n            options.onRequest = this._onRequest;\n        }\n\n        if (this._onResponse)\n        {\n            options.onResponse = this._onResponse;\n        }\n\n        return this.executor(input || {}, options);\n    }\n}\n\n/**\n * Individual route client with structured input API\n */\nexport type RouteClient<TRoute extends RouteDef<any, any>> = {\n    /**\n     * Set request headers\n     */\n    headers(headers: Record<string, string>): RouteClient<TRoute>;\n\n    /**\n     * Set cookies\n     */\n    cookies(cookies: Record<string, string>): RouteClient<TRoute>;\n\n    /**\n     * Set Next.js fetch options\n     */\n    fetchOptions(options: RequestInit & { next?: { revalidate?: number | false; tags?: string[] } }): RouteClient<TRoute>;\n\n    /**\n     * Set request interceptor\n     */\n    onRequest(interceptor: RequestInterceptor): RouteClient<TRoute>;\n\n    /**\n     * Set response interceptor\n     */\n    onResponse(interceptor: ResponseInterceptor): RouteClient<TRoute>;\n\n    /**\n     * Execute the API call with structured input\n     *\n     * @example\n     * ```typescript\n     * // GET /users/:id\n     * api.getUser.call({ params: { id: '123' } });\n     *\n     * // PUT /users/:id\n     * api.updateUser.call({ params: { id: '123' }, body: { name: 'Jane' } });\n     * ```\n     */\n    call: HasAnyRequiredFields<InferRouteInput<TRoute>> extends true\n        ? (input: CleanStructuredInput<InferRouteInput<TRoute>>) => Promise<InferRouteOutput<TRoute>>\n        : (input?: CleanStructuredInput<InferRouteInput<TRoute>>) => Promise<InferRouteOutput<TRoute>>;\n};\n\n/**\n * One property per route in a flattened route record.\n *\n * A slot the flattening could not resolve to a route definition is `never`, as it was\n * before nesting was flattened — a record whose values are neither routes nor routers\n * names nothing callable.\n */\ntype RouteClients<TRoutes> = {\n    [K in keyof TRoutes]: TRoutes[K] extends RouteDef<any, any, any>\n        ? RouteClient<TRoutes[K]>\n        : never;\n};\n\n/**\n * Typed client for entire router\n *\n * One flat namespace, holding the same route names the server registers. A route\n * declared inside a nested `defineRouter` is reached by its own key — `api.getThing`,\n * never `api.group.getThing` — because that is the name `registerRoutes` mounts it\n * under, the name the RPC proxy resolves, and the name `RouterOutput` takes. The group\n * key is not a route and naming it is a compile error.\n *\n * @example\n * ```typescript\n * const appRouter = defineRouter({\n *     getRoot,\n *     users: defineRouter({ getUser }),\n * });\n *\n * const api = createApi<typeof appRouter>();\n *\n * await api.getUser.call({ params: { id: '1' } });   // not api.users.getUser\n * ```\n *\n * A name two branches both declare is left out of the namespace rather than resolved to\n * one of them — the same collision `RouterOutput` refuses. Routes mounted with\n * `.packages()` are deliberately absent: a package publishes its own route map and its\n * own client (`authApi`, `cmsApi`), and that is what calls them.\n */\nexport type Client<TRouter extends Router<any>> = RouteClients<ExtractRoutes<TRouter>>;\n","/**\n * Type-Safe RPC-Style Client with Structured Input API\n *\n * Provides full end-to-end type safety from server routes to client calls.\n * No metadata codegen required - method/path resolution happens at the proxy layer.\n *\n * @example\n * ```typescript\n * // Server\n * export const appRouter = defineRouter({\n *   getUser: route.get('/users/:id')\n *     .input({ params: Type.Object({ id: Type.String() }) })\n *     .handler(async (c) => { ... }),\n *   createUser: route.post('/users')\n *     .input({ body: Type.Object({ name: Type.String() }) })\n *     .handler(async (c) => { ... }),\n * });\n *\n * export type AppRouter = typeof appRouter;\n *\n * // Client - no metadata needed!\n * const api = createApi<AppRouter>();\n *\n * // ✅ GET (no body) - becomes GET /api/rpc/getUser?input={...}\n * const user = await api.getUser.call({ params: { id: '1' } });\n *\n * // ✅ POST (has body) - becomes POST /api/rpc/createUser\n * const newUser = await api.createUser.call({ body: { name: 'John' } });\n *\n * // ✅ With options (headers, cookies, interceptors)\n * const user = await api.getUser\n *   .headers({ 'X-Custom': 'value' })\n *   .cookies({ session: 'xxx' })\n *   .fetchOptions({ next: { revalidate: 60 } })\n *   .call({ params: { id: '1' } });\n * ```\n */\nimport { env } from '@spfn/core/config';\nimport { ErrorRegistry, errorRegistry as coreErrorRegistry } from '@spfn/core/errors';\nimport { logger } from '@spfn/core/logger';\nimport type { Router } from '@spfn/core/route';\nimport * as debugLogs from './debug-logs';\nimport { ApiError } from './errors';\nimport {\n    parseResponseBody,\n    executeFetchWithTimeout,\n    handleErrorResponse,\n    buildCookieHeader,\n    autoDetectServerCookies,\n} from './helpers';\nimport { CSRF_HEADER, csrfHeaderValue, documentCookieEntries } from './csrf';\nimport { RouteCallBuilder } from './builder';\nimport type { ApiConfig, CallOptions } from './types';\nimport type { Client } from './builder';\n\nconst apiLogger = logger.child('@spfn/core:api-client');\n\n// ============================================================================\n// Client Implementation\n// ============================================================================\n\n/**\n * Create type-safe RPC client\n *\n * No metadata required - the client sends routeName + input to the proxy,\n * and the proxy resolves the actual HTTP method and path from the router.\n *\n * @example\n * ```typescript\n * // Client - no metadata needed!\n * const api = createApi<AppRouter>();\n *\n * // GET request (no body) - browser cacheable\n * const user = await api.getUser.call({ params: { id: '1' } });\n *\n * // POST request (has body)\n * const newUser = await api.createUser.call({ body: { name: 'John' } });\n * ```\n */\nexport function createApi<TRouter extends Router<any>>(\n    config: ApiConfig = {},\n): Client<TRouter>\n{\n    const {\n        baseUrl = '/api/rpc',\n        headers: defaultHeaders = {},\n        timeout = env.SERVER_TIMEOUT,\n        fetch: customFetch = fetch,\n        onRequest: globalOnRequest,\n        onResponse: globalOnResponse,\n        errorRegistry: errorRegistryConfig,\n        debug = false,\n    } = config;\n\n    // Normalize errorRegistry: always include coreErrorRegistry\n    const errorRegistry = Array.isArray(errorRegistryConfig)\n        ? new ErrorRegistry([coreErrorRegistry, ...errorRegistryConfig])\n        : errorRegistryConfig ?? coreErrorRegistry;\n\n    if (debug)\n    {\n        apiLogger.debug('API client initialized', { baseUrl });\n    }\n\n    /**\n     * Execute API call\n     *\n     * Determines GET vs POST based on body/formData presence:\n     * - No body/formData → GET /api/rpc/{routeName}?input={...}\n     * - Has body → POST /api/rpc/{routeName} with JSON body\n     * - Has formData → POST /api/rpc/{routeName} with multipart/form-data\n     */\n    async function executeCall(\n        routeName: string,\n        input: any = {},\n        options: CallOptions = {},\n    ): Promise<any>\n    {\n        const hasBody = input.body !== undefined;\n        const hasFormData = input.formData !== undefined && Object.keys(input.formData).length > 0;\n        const method = (hasBody || hasFormData) ? 'POST' : 'GET';\n\n        // Build full URL - handle SSR case where SPFN_APP_URL might not be set\n        let appUrl = env.SPFN_APP_URL || '';\n\n        // In SSR environment, if SPFN_APP_URL is not set, try to get host from request headers\n        if (!appUrl && typeof window === 'undefined')\n        {\n            try\n            {\n                const { headers } = await import('next/headers');\n                const headersList = await headers();\n                const host = headersList.get('host');\n                const protocol = headersList.get('x-forwarded-proto') || 'http';\n                if (host)\n                {\n                    appUrl = `${protocol}://${host}`;\n                    if (debug)\n                    {\n                        apiLogger.debug(`Auto-detected app URL from headers: ${appUrl}`);\n                    }\n                }\n            }\n            catch\n            {\n                // Fallback: use relative URL and let fetch handle it\n                if (debug)\n                {\n                    apiLogger.warn('Could not determine app URL in SSR environment, using relative URL');\n                }\n            }\n        }\n\n        // Build URL based on method\n        let fullUrl: string;\n        if (method === 'GET')\n        {\n            // GET: encode input in query string\n            const inputParam = encodeURIComponent(JSON.stringify(input));\n            fullUrl = `${appUrl}${baseUrl}/${routeName}?input=${inputParam}`;\n        }\n        else\n        {\n            // POST: input goes in body\n            fullUrl = `${appUrl}${baseUrl}/${routeName}`;\n        }\n\n        // Prepare headers\n        // Note: Don't set Content-Type for formData - browser sets it with boundary\n        const headers: Record<string, string> = {\n            ...(hasFormData ? {} : { 'Content-Type': 'application/json' }),\n            ...defaultHeaders,\n            ...options.headers,\n        };\n\n        // Auto-detect server cookies and merge with user-provided cookies\n        const autoDetectedCookies = await autoDetectServerCookies();\n        const cookiesToSend = {\n            ...autoDetectedCookies,\n            ...(options.cookies || {}),\n        };\n\n        // Add Cookie header if we have cookies to send\n        if (Object.keys(cookiesToSend).length > 0)\n        {\n            headers['Cookie'] = buildCookieHeader(cookiesToSend);\n        }\n\n        // Mirror the readable CSRF cookie into a header, from the browser jar or\n        // — server-side — from the jar being forwarded.\n        //\n        // Carried on GET calls too, deliberately: the wire method here is chosen\n        // by whether the input has a body, not by what the route does. A bodyless\n        // mutation (`api.logout.call({})`) travels as GET and the proxy still\n        // forwards it as the route's POST, so a GET-shaped call can be exactly\n        // the request that needs the header. The proxy decides what to check from\n        // the resolved route method, and ignores the header on safe routes.\n        const csrfToken = csrfHeaderValue(\n            typeof window === 'undefined' ? Object.entries(cookiesToSend) : documentCookieEntries(),\n        );\n\n        const csrfSetByCaller = Object.keys(headers).some(name => name.toLowerCase() === CSRF_HEADER);\n\n        if (csrfToken && !csrfSetByCaller)\n        {\n            headers[CSRF_HEADER] = csrfToken;\n        }\n\n        // Log cookie auto-detection if debug enabled\n        if (debug && Object.keys(autoDetectedCookies).length > 0)\n        {\n            const cookieArray = Object.entries(autoDetectedCookies).map(([name, value]) => ({ name, value }));\n            debugLogs.logCookieAutoDetection(apiLogger, cookieArray);\n        }\n\n        // Build request init\n        const requestInit: RequestInit = {\n            method,\n            headers,\n            ...options.fetchOptions,\n        };\n\n        // Add body for POST\n        if (method === 'POST')\n        {\n            if (hasFormData)\n            {\n                // Build FormData for file uploads\n                const formData = new FormData();\n\n                // Add non-formData fields (params, query, headers, cookies) as JSON metadata\n                const metadata: Record<string, any> = {};\n                if (input.params) metadata.params = input.params;\n                if (input.query) metadata.query = input.query;\n                if (input.headers) metadata.headers = input.headers;\n                if (input.cookies) metadata.cookies = input.cookies;\n\n                if (Object.keys(metadata).length > 0)\n                {\n                    formData.append('__metadata', JSON.stringify(metadata));\n                }\n\n                // Add formData fields\n                for (const [key, value] of Object.entries(input.formData))\n                {\n                    if (value instanceof File)\n                    {\n                        formData.append(key, value);\n                    }\n                    else if (Array.isArray(value))\n                    {\n                        // Handle array of files or values\n                        for (const item of value)\n                        {\n                            if (item instanceof File)\n                            {\n                                formData.append(key, item);\n                            }\n                            else\n                            {\n                                formData.append(key, String(item));\n                            }\n                        }\n                    }\n                    else if (value !== undefined && value !== null)\n                    {\n                        formData.append(key, String(value));\n                    }\n                }\n\n                requestInit.body = formData;\n            }\n            else\n            {\n                requestInit.body = JSON.stringify(input);\n            }\n        }\n\n        // Execute request interceptors\n        let init = requestInit;\n        if (globalOnRequest)\n        {\n            init = await globalOnRequest(fullUrl, init);\n        }\n        if (options.onRequest)\n        {\n            init = await options.onRequest(fullUrl, init);\n        }\n\n        if (debug)\n        {\n            debugLogs.logRequest(apiLogger, routeName, method, fullUrl, !!init.body);\n        }\n\n        // Execute fetch with timeout\n        let response: Response;\n        let body: any;\n\n        try\n        {\n            response = await executeFetchWithTimeout(fullUrl, init, timeout, customFetch);\n\n            // Parse response\n            body = await parseResponseBody(response);\n\n            // Execute global + local response interceptors\n            if (globalOnResponse)\n            {\n                const result = await globalOnResponse(response, body);\n                response = result.response;\n                body = result.body;\n            }\n            if (options.onResponse)\n            {\n                const result = await options.onResponse(response, body);\n                response = result.response;\n                body = result.body;\n            }\n\n            if (debug)\n            {\n                debugLogs.logResponse(apiLogger, routeName, response.status, !!body);\n            }\n        }\n        catch (error)\n        {\n            // Handle timeout specifically\n            if (error instanceof Error && error.name === 'AbortError')\n            {\n                apiLogger.error('Request timeout', {\n                    route: routeName,\n                    method,\n                    url: fullUrl,\n                    timeout,\n                });\n\n                throw new ApiError(\n                    `Request timeout after ${timeout}ms`,\n                    408,\n                    fullUrl,\n                    undefined,\n                    'timeout',\n                );\n            }\n\n            // Network error\n            const errorMessage = error instanceof Error ? error.message : 'Network error';\n            apiLogger.error('Network error', {\n                route: routeName,\n                method,\n                url: fullUrl,\n                error: errorMessage,\n                errorName: error instanceof Error ? error.name : 'unknown',\n            });\n\n            throw new ApiError(\n                errorMessage,\n                0,\n                fullUrl,\n                undefined,\n                'network',\n            );\n        }\n\n        // Handle error responses\n        if (!response.ok)\n        {\n            await handleErrorResponse(response, body, fullUrl, errorRegistry, debug, apiLogger);\n        }\n\n        return body;\n    }\n\n    /**\n     * Build client proxy\n     *\n     * Every property access returns a `RouteCallBuilder` for that one property read as a\n     * whole route name, and that name goes on the wire as `/api/rpc/{routeName}`. The\n     * proxy route resolves it against the generated route map, whose names are flat.\n     *\n     * Nesting needs nothing here: `registerRoutes` mounts a route declared inside a\n     * nested `defineRouter` under its own key, so `api.getThing` is the call for a nested\n     * `getThing` exactly as for a top-level one — which is the namespace `Client` types.\n     * There is no dot-notation traversal: a property access never returns another proxy,\n     * so `api.group.getThing` reads a property of a builder and is `undefined`.\n     *\n     * `prefix` is vestigial — nothing passes one, and adding a caller that did would\n     * build a dotted name the route map cannot resolve.\n     */\n    function buildProxy(prefix = ''): any\n    {\n        return new Proxy(\n            {},\n            {\n                get(_target, prop: string)\n                {\n                    const currentPath = prefix ? `${prefix}.${prop}` : prop;\n\n                    // Return RouteCallBuilder that can either be called or chained\n                    return new RouteCallBuilder(\n                        (input: any, options: CallOptions) => executeCall(currentPath, input, options),\n                        currentPath,\n                    );\n                },\n            },\n        );\n    }\n\n    return buildProxy() as Client<TRouter>;\n}\n"]}

package/dist/nextjs/server.d.ts

@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { HttpMethod } from '@spfn/core/route';
 import { InterceptorRule as InterceptorRule$1 } from '@spfn/core/nextjs/server';
-import { S as SetCookie } from '../types-9oszaJqp.js';
+import { S as SetCookie } from '../types-yv6z_mK7.js';
 import '@sinclair/typebox';
 import '@spfn/core/errors';
 

package/dist/{types-9oszaJqp.d.ts → types-yv6z_mK7.d.ts}

@@ -62,13 +62,112 @@ type InferRouteInput<TRoute> = TRoute extends RouteDef<infer TInput, any, any> ?
  * ```
  */
 type InferRouteOutput<TRoute> = TRoute extends RouteDef<any, any, infer TResponse> ? TResponse : never;
+/**
+ * True only for `any`.
+ *
+ * `any` satisfies both branches of a conditional type, so a router whose routes are
+ * unresolved (`Router<any>`) would otherwise flatten into "every name exists" and
+ * accept a misspelled route name. A route record that is not known contributes no
+ * names instead.
+ */
+type IsAny<T> = 0 extends (1 & T) ? true : false;
+/**
+ * True when `T` is a union of two or more members.
+ */
+type IsUnion<T, TCopy = T> = T extends unknown ? ([TCopy] extends [T] ? false : true) : false;
+/**
+ * One leaf of a router tree: the name a route is registered under, its definition, and
+ * the path it was reached by.
+ *
+ * A route is identified by its own key whatever depth it sits at — `registerRoutes`
+ * mounts a nested route under that key, and the contract collector reports a collision
+ * on it. Nesting groups the source; it does not qualify the name. The trail is carried
+ * so that one name reached through two branches stays two leaves.
+ */
+interface RouteLeaf<TName extends PropertyKey, TDef, TTrail extends PropertyKey[]> {
+    name: TName;
+    def: TDef;
+    trail: TTrail;
+}
+/** Decrements the nesting budget; `PrevDepth[0]` is `never`, which ends the walk. */
+type PrevDepth = [never, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9];
+/**
+ * How many levels of nesting are followed.
+ *
+ * A budget rather than open recursion: a router type that refers to itself would
+ * otherwise never terminate, and TypeScript would report an instantiation-depth error
+ * in whichever component happened to read a route type. A route below the budget is not
+ * visible to these types; ten levels is far past any hand-written tree.
+ */
+type MaxNesting = 10;
+/**
+ * Collect every route in a route record as a leaf, descending into nested routers
+ * exactly as `registerRoutes` does.
+ */
+type RouteLeaves<TRoutes, TTrail extends PropertyKey[] = [], TDepth extends number = MaxNesting> = [
+    TDepth
+] extends [never] ? never : IsAny<TRoutes> extends true ? never : {
+    [K in keyof TRoutes]-?: RouteLeafOf<K, Exclude<TRoutes[K], undefined>, [...TTrail, K], TDepth>;
+}[keyof TRoutes];
+/**
+ * A nested router contributes its own leaves; anything else is a leaf.
+ *
+ * `{ _routes: ... }` is the runtime's own test for a router (`isRouter`), and a
+ * `RouteDef` carries `handler`, `_input` and `_response` but never `_routes`, so a
+ * route cannot be mistaken for a router.
+ */
+type RouteLeafOf<TName extends PropertyKey, TValue, TTrail extends PropertyKey[], TDepth extends number> = TValue extends {
+    _routes: infer TNested;
+} ? RouteLeaves<TNested, TTrail, PrevDepth[TDepth]> : RouteLeaf<TName, TValue, TTrail>;
+/** Every name the tree declares. */
+type LeafNames<TLeaves> = Extract<TLeaves extends RouteLeaf<infer TName, any, any> ? TName : never, PropertyKey>;
+/**
+ * The leaves declaring exactly this name.
+ *
+ * Exactly, not assignably: a record typed `Record<string, RouteDef>` contributes the
+ * name `string`, which every literal name is assignable to, and a loose sibling must
+ * not make each of its siblings look doubly declared.
+ */
+type LeavesNamed<TLeaves, TName extends PropertyKey> = TLeaves extends RouteLeaf<infer TLeafName, any, any> ? [TLeafName] extends [TName] ? [TName] extends [TLeafName] ? TLeaves : never : never : never;
+/** The definition a leaf carries. */
+type LeafDef<TLeaves> = TLeaves extends RouteLeaf<any, infer TDef, any> ? TDef : never;
+/** Where a leaf was found — one distinct trail per place the name is declared. */
+type LeafTrail<TLeaves> = TLeaves extends RouteLeaf<any, any, infer TTrail> ? TTrail : never;
+/**
+ * Flatten the leaves into one namespace of name → definition.
+ *
+ * A name that two branches both declare is left out rather than resolved to one of
+ * them: the tree gives it no single meaning, and picking a winner silently would hand
+ * a component another route's types. Naming it then fails the `K` constraint on
+ * `RouterOutput`/`RouterInput`, on the line that named it. Two places is counted by
+ * trail, so one slot holding a union of route definitions stays one route and still
+ * infers the union.
+ *
+ * The result is a fresh mapped type, so no key carries an optional or readonly modifier
+ * out of the source record — a route key that turned optional would change what
+ * `InferRouteInput` returns for it.
+ */
+type FlattenLeaves<TLeaves> = {
+    [TName in LeafNames<TLeaves> as UnambiguousName<TLeaves, TName>]: LeafDef<LeavesNamed<TLeaves, TName>>;
+};
+/** The name itself when one place declares it, and nothing when two do. */
+type UnambiguousName<TLeaves, TName extends PropertyKey> = IsUnion<LeafTrail<LeavesNamed<TLeaves, TName>>> extends true ? never : TName;
 /**
  * Extract routes from Router type
- * Router<TRoutes> has routes in `_routes` property
+ *
+ * `Router<TRoutes>` holds its routes in `_routes`, and a value in that record is either
+ * a route or another router. Nested routers are flattened away, so every route appears
+ * here under its own name at one level — the same set of names the server registers.
+ *
+ * Exported so that the typed client (`Client`, in `./builder`) names a route the same
+ * way `RouterOutput` and `RouterInput` do; the two must not diverge, or a route would
+ * type in one place and not the other. It stays internal to the package: the
+ * `@spfn/core/nextjs` entry point exports a fixed list of type names, and this is not
+ * one of them.
  */
 type ExtractRoutes<TRouter> = TRouter extends {
     _routes: infer TRoutes;
-} ? TRoutes : TRouter;
+} ? FlattenLeaves<RouteLeaves<TRoutes>> : FlattenLeaves<RouteLeaves<TRouter>>;
 /**
  * Extract output type for a specific route from router
  *
@@ -88,6 +187,23 @@ type ExtractRoutes<TRouter> = TRouter extends {
  * // Extract item type from paginated response
  * type Example = RouterOutput<AppRouter, 'listExamples'>['items'][number];
  * ```
+ *
+ * A route declared inside a nested router is named the same way. The server registers
+ * a nested route under its own key, so `K` is the flat set of route names in the tree
+ * and the depth the route was declared at never appears here:
+ *
+ * ```typescript
+ * const appRouter = defineRouter({
+ *     getRoot,
+ *     examples: defineRouter({ listExamples, createExample }),
+ * });
+ *
+ * type ListData = RouterOutput<typeof appRouter, 'listExamples'>;
+ * ```
+ *
+ * Two branches declaring the same name make that name ambiguous, and it is left out of
+ * `K` rather than resolved to one of them — naming it is a compile error here instead
+ * of the wrong route's types reaching a component.
  */
 type RouterOutput<TRouter, K extends keyof ExtractRoutes<TRouter>> = InferRouteOutput<ExtractRoutes<TRouter>[K]>;
 /**
@@ -106,6 +222,9 @@ type RouterOutput<TRouter, K extends keyof ExtractRoutes<TRouter>> = InferRouteO
  *     // ...
  * }
  * ```
+ *
+ * `K` is the flat set of route names, so a route declared inside a nested router is
+ * named by its own key here too — see {@link RouterOutput}.
  */
 type RouterInput<TRouter, K extends keyof ExtractRoutes<TRouter>> = InferRouteInput<ExtractRoutes<TRouter>[K]>;
 /**
@@ -247,4 +366,4 @@ interface CallOptions {
     };
 }
 
-export type { ApiConfig as A, CallOptions as C, InferRouteInput as I, RequestInterceptor as R, SetCookie as S, ResponseInterceptor as a, InferRouteOutput as b, CookieOptions as c, RouterInput as d, RouterOutput as e, StructuredInput as f };
+export type { ApiConfig as A, CallOptions as C, ExtractRoutes as E, InferRouteInput as I, RequestInterceptor as R, SetCookie as S, ResponseInterceptor as a, InferRouteOutput as b, CookieOptions as c, RouterInput as d, RouterOutput as e, StructuredInput as f };

package/docs/file-upload.md

@@ -229,8 +229,8 @@ export const uploadImage = route.post('/images')
 
 ### `@spfn/storage` (recommended)
 
-SPFN ships provider-agnostic object storage — S3-compatible services (S3, R2, MinIO,
-Wasabi), Google Cloud Storage, and the local filesystem behind one interface. Prefer it
+SPFN ships provider-agnostic object storage — S3-compatible services (S3, R2, Wasabi,
+SeaweedFS), Google Cloud Storage, and the local filesystem behind one interface. Prefer it
 over calling a provider SDK directly: every object operation validates its key before it
 reaches the provider (rejecting `..` segments, leading `/`, backslashes, control
 characters and URLs), so a key built from user input cannot escape its prefix.
@@ -281,7 +281,7 @@ Three constraints decide whether this is safe:
 | Constraint | Behaviour |
 |---|---|
 | `contentLength` (exact size) | Signed on **both** S3-compatible and GCS. A mismatched size fails. |
-| `maxBytes` (upper bound) | Enforced on **GCS only**. A presigned PUT cannot sign a size range, so S3, R2, MinIO and Wasabi **ignore it silently**. |
+| `maxBytes` (upper bound) | Enforced on **GCS only**. A presigned PUT cannot sign a size range, so S3, R2 and Wasabi **ignore it silently**. |
 | Local filesystem provider | Presigned upload is **not supported** — `getUploadUrl()` throws. Use the direct `upload()` path in local dev. |
 
 A client can declare one size and send another, so a server-side check of a

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@spfn/core",
-    "version": "0.3.0-beta.10",
+    "version": "0.3.0-beta.11",
     "description": "Full-stack TypeScript backend for Next.js: file-based typed routes, Drizzle entities and repositories, PostgreSQL transactions and a generated end-to-end client, in one fixed vertical slice per feature",
     "type": "module",
     "exports": {

package/src/nextjs/README.md

@@ -122,8 +122,28 @@ const created = await api.createUser.call({ body: { name: 'A' } }); // POST /api
 function createApi<TRouter extends Router<any>>(config?: ApiConfig): Client<TRouter>;
 ```
 
-Returns a `Proxy`: every property access (`api.getUser`, `api.foo.bar` for nested routers)
-yields a `RouteClient` builder. Calls are made via `.call(input)`.
+Returns a `Proxy`: every property access (`api.getUser`) yields a `RouteClient` builder.
+Calls are made via `.call(input)`.
+
+The client is one **flat** namespace, holding exactly the names the server registers. A
+route declared inside a nested `defineRouter` is reached by its own key — `registerRoutes`
+mounts it under that key, the proxy resolves that name against the route map, and
+`RouterOutput` takes the same name:
+
+```typescript
+const appRouter = defineRouter({
+    getRoot,
+    users: defineRouter({ getUser }),
+});
+
+await api.getUser.call({ params: { id: '123' } });   // ✅ GET /api/rpc/getUser
+await api.users.getUser.call({ ... });               // ❌ compile error — `users` is a group
+```
+
+There is no dot notation: a property access never yields another proxy, so a group key
+names nothing on either side. A name two branches both declare is left out of the client
+rather than resolved to one of them, and `.packages()` routes stay out on purpose — call
+them through the package's own client (`authApi`, `cmsApi`).
 
 ### Structured input
 
@@ -452,6 +472,27 @@ type BodyInput   = RouterInput<AppRouter, 'createExample'>['body'];
 `InferRouteOutput` take a single `RouteDef`. All inference is compile-time only (zero runtime
 cost).
 
+The route-name key is the **flat** set of names in the router tree. A route declared inside a
+nested `defineRouter` is named by its own key here, exactly as the server registers it — the
+group key is not part of the name and does not appear:
+
+```typescript
+const appRouter = defineRouter({
+    getRoot,
+    examples: defineRouter({ listExamples, createExample }),
+});
+
+type ListData = RouterOutput<typeof appRouter, 'listExamples'>;   // not 'examples.listExamples'
+```
+
+A name two branches both declare is left out of that set rather than resolved to one of them,
+so naming it is a compile error where it is named. Routes mounted with `.packages()` stay out
+of the set on purpose — call them through the package's own client.
+
+`Client<AppRouter>` — what `createApi` returns — is built from the same flat set, so a route
+is named identically whether you call it (`api.listExamples`) or take its type
+(`RouterOutput<AppRouter, 'listExamples'>`).
+
 ---
 
 ## Error handling

package/src/route/README.md

@@ -435,6 +435,12 @@ export const appRouter = defineRouter({ ...userRoutes, ...postRoutes });
 export type AppRouter = typeof appRouter;
 ```
 
+Nesting groups the source, not the name: a nested route is registered — and typed, through
+`RouterOutput`/`RouterInput` and the `createApi` client — under its own key (`get`, `list`),
+never under `users.get`. `api.get.call({...})` is the call; `api.users` is not a route and
+does not compile. Two branches declaring one name is therefore a collision, which the contract
+collector refuses and the client types leave out of the namespace.
+
 ### `.packages([...])` — mount package routers
 
 Attach routers from SPFN packages (`@spfn/auth`, `@spfn/cms`, …). Package routes **are**