@spfn/core 0.3.0-beta.12 → 0.3.0-beta.14

package/dist/contract/index.d.ts

@@ -1,4 +1,4 @@
-import { R as Router } from '../router-9L3El7nO.js';
+import { R as Router } from '../router-BqyEARoY.js';
 import { C as ContractDocument, a as ContractViolation, b as ContractOperation, c as ContractSnapshot } from '../types-ClQVomgV.js';
 export { d as CompatibilityPolicy, e as ContractRequest, f as ContractViolationKind, J as JsonSchema } from '../types-ClQVomgV.js';
 import '../define-middleware-CVKgqo8S.js';

package/dist/event/index.d.ts

@@ -53,11 +53,10 @@ declare function defineEvent<T extends TSchema>(name: string, schema: T): EventD
  * // app/api/rpc/[routeName]/route.ts
  * import { createRpcProxy } from '@spfn/core/nextjs/server';
  * import { eventRouteMap } from '@spfn/core/event';
- * import { authRouteMap } from '@spfn/auth';
  * import { routeMap } from '@/generated/route-map';
  *
  * export const { GET, POST } = createRpcProxy({
- *     routeMap: { ...routeMap, ...authRouteMap, ...eventRouteMap },
+ *     routeMap: { ...routeMap, ...eventRouteMap },
  * });
  * ```
  */

package/dist/event/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/event/event.ts","../../src/event/sse/route-map.ts","../../src/event/router.ts","../../src/event/ws/handler.ts","../../src/event/ws/index.ts"],"names":["logger"],"mappings":";;;AA+BA,IAAM,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,kBAAkB,CAAA;AAKnD,SAAS,eAAA,CAAgB,WAAmB,KAAA,EAC5C;AACI,EAAA,WAAA,CAAY,KAAA,CAAM,CAAA,qBAAA,EAAwB,SAAS,CAAA,CAAA,EAAI;AAAA,IACnD,OAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK;AAAA,GAC/D,CAAA;AACL;AAKA,SAAS,gBAAA,CAAiB,WAAmB,KAAA,EAC7C;AACI,EAAA,WAAA,CAAY,KAAA,CAAM,CAAA,mCAAA,EAAsC,SAAS,CAAA,CAAA,EAAI;AAAA,IACjE,OAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK;AAAA,GAC/D,CAAA;AACL;AAKA,SAAS,qBAA+B,IAAA,EACxC;AACI,EAAA,MAAM,QAAA,uBAA4C,GAAA,EAAI;AAEtD,EAAA,OAAO;AAAA,IACH,GAAA,EAAK,CAAC,OAAA,KACN;AACI,MAAA,QAAA,CAAS,IAAI,OAAO,CAAA;AACpB,MAAA,WAAA,CAAY,KAAA,CAAM,wBAAwB,IAAI,CAAA,CAAA,EAAI,EAAE,YAAA,EAAc,QAAA,CAAS,MAAM,CAAA;AAEjF,MAAA,OAAO,MACP;AACI,QAAA,QAAA,CAAS,OAAO,OAAO,CAAA;AACvB,QAAA,WAAA,CAAY,KAAA,CAAM,4BAA4B,IAAI,CAAA,CAAA,EAAI,EAAE,YAAA,EAAc,QAAA,CAAS,MAAM,CAAA;AAAA,MACzF,CAAA;AAAA,IACJ,CAAA;AAAA,IAEA,OAAO,MACP;AACI,MAAA,QAAA,CAAS,KAAA,EAAM;AACf,MAAA,WAAA,CAAY,KAAA,CAAM,CAAA,6BAAA,EAAgC,IAAI,CAAA,CAAE,CAAA;AAAA,IAC5D,CAAA;AAAA,IAEA,OAAA,EAAS,OAAO,OAAA,KAChB;AACI,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,UAAA;AAAA,QAC1B,CAAC,GAAG,QAAQ,CAAA,CAAE,IAAI,CAAC,OAAA,KAAY,OAAA,CAAQ,OAAO,CAAC;AAAA,OACnD;AAEA,MAAA,KAAA,MAAW,UAAU,OAAA,EACrB;AACI,QAAA,IAAI,MAAA,CAAO,WAAW,UAAA,EACtB;AACI,UAAA,eAAA,CAAgB,IAAA,EAAM,OAAO,MAAM,CAAA;AAAA,QACvC;AAAA,MACJ;AAAA,IACJ;AAAA,GACJ;AACJ;AAKA,SAAS,sBAAsB,IAAA,EAC/B;AACI,EAAA,MAAM,SAAA,uBAA6C,GAAA,EAAI;AAEvD,EAAA,OAAO;AAAA,IACH,QAAA,EAAU,CAAC,SAAA,EAAmB,MAAA,KAC9B;AACI,MAAA,SAAA,CAAU,GAAA,CAAI,WAAW,MAAM,CAAA;AAC/B,MAAA,WAAA,CAAY,MAAM,CAAA,gCAAA,EAAmC,IAAI,CAAA,CAAA,EAAI,EAAE,WAAW,CAAA;AAAA,IAC9E,CAAA;AAAA,IAEA,IAAA,EAAM,OAAO,OAAA,KACb;AACI,MAAA,IAAI,SAAA,CAAU,SAAS,CAAA,EACvB;AACI,QAAA;AAAA,MACJ;AAEA,MAAA,MAAM,OAAA,GAAU,CAAC,GAAG,SAAA,CAAU,SAAS,CAAA;AACvC,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,UAAA;AAAA,QAC1B,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,SAAA,EAAW,MAAM,CAAA,KAAM,MAAA,CAAO,SAAA,EAAW,OAAO,CAAC;AAAA,OACnE;AAEA,MAAA,KAAA,MAAW,CAAC,CAAA,EAAG,MAAM,CAAA,IAAK,OAAA,CAAQ,SAAQ,EAC1C;AACI,QAAA,IAAI,MAAA,CAAO,WAAW,UAAA,EACtB;AACI,UAAA,gBAAA,CAAiB,QAAQ,CAAC,CAAA,CAAE,CAAC,CAAA,EAAG,OAAO,MAAM,CAAA;AAAA,QACjD;AAAA,MACJ;AAAA,IACJ,CAAA;AAAA,IAEA,IAAI,IAAA,GACJ;AACI,MAAA,OAAO,SAAA,CAAU,IAAA;AAAA,IACrB;AAAA,GACJ;AACJ;AAKA,SAAS,eAAA,CACL,MACA,MAAA,EAEJ;AACI,EAAA,MAAM,cAAA,GAAiB,qBAA+B,IAAI,CAAA;AAC1D,EAAA,MAAM,eAAA,GAAkB,sBAAsB,IAAI,CAAA;AAClD,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,eAAA,GAAkB,KAAA;AAEtB,EAAA,MAAM,IAAA,GAAO,OAAO,OAAA,KACpB;AACI,IAAA,WAAA,CAAY,KAAA,CAAM,CAAA,gBAAA,EAAmB,IAAI,CAAA,CAAA,EAAI;AAAA,MACzC,OAAA;AAAA,MACA,QAAA,EAAU,CAAC,CAAC,KAAA;AAAA,MACZ,eAAe,eAAA,CAAgB;AAAA,KAClC,CAAA;AAED,IAAA,IAAI,KAAA,EACJ;AACI,MAAA,MAAM,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA;AAAA,IACrC,CAAA,MAEA;AACI,MAAA,MAAM,cAAA,CAAe,QAAQ,OAAmB,CAAA;AAAA,IACpD;AAEA,IAAA,MAAM,eAAA,CAAgB,KAAK,OAAO,CAAA;AAClC,IAAA,WAAA,CAAY,KAAA,CAAM,CAAA,eAAA,EAAkB,IAAI,CAAA,CAAE,CAAA;AAAA,EAC9C,CAAA;AAEA,EAAA,MAAM,QAAA,GAAW,OAAO,QAAA,KACxB;AACI,IAAA,IAAI,eAAA,EACJ;AACI,MAAA,WAAA,CAAY,IAAA,CAAK,CAAA,oCAAA,EAAuC,IAAI,CAAA,CAAE,CAAA;AAE9D,MAAA,OAAO,IAAA;AAAA,IACX;AAOA,IAAA,MAAM,QAAA,CAAS,SAAA,CAAU,IAAA,EAAM,OAAO,OAAA,KACtC;AACI,MAAA,WAAA,CAAY,KAAA,CAAM,CAAA,2BAAA,EAA8B,IAAI,CAAA,CAAE,CAAA;AACtD,MAAA,MAAM,cAAA,CAAe,QAAQ,OAAmB,CAAA;AAAA,IACpD,CAAC,CAAA;AAED,IAAA,KAAA,GAAQ,QAAA;AACR,IAAA,eAAA,GAAkB,IAAA;AAElB,IAAA,WAAA,CAAY,KAAA,CAAM,CAAA,oCAAA,EAAuC,IAAI,CAAA,CAAE,CAAA;AAE/D,IAAA,OAAO,IAAA;AAAA,EACX,CAAA;AAMA,EAAA,MAAM,aAAa,MACnB;AACI,IAAA,KAAA,GAAQ,MAAA;AACR,IAAA,eAAA,GAAkB,KAAA;AAAA,EACtB,CAAA;AAEA,EAAA,MAAM,IAAA,GAA2B;AAAA,IAC7B,IAAA;AAAA,IACA,MAAA;AAAA,IACA,WAAW,cAAA,CAAe,GAAA;AAAA,IAC1B,gBAAgB,cAAA,CAAe,KAAA;AAAA,IAC/B,IAAA;AAAA,IACA,QAAA;AAAA,IACA,mBAAmB,eAAA,CAAgB,QAAA;AAAA,IACnC,WAAA,EAAa,UAAA;AAAA,IACb,QAAA,EAAU;AAAA,GACd;AAEA,EAAA,OAAO,IAAA;AACX;AAyCO,SAAS,WAAA,CACZ,MACA,MAAA,EAEJ;AACI,EAAA,IAAI,MAAA,EACJ;AACI,IAAA,OAAO,eAAA,CAA2B,MAAM,MAAM,CAAA;AAAA,EAClD;AAEA,EAAA,OAAO,gBAAsB,IAAI,CAAA;AACrC;;;AChQO,IAAM,aAAA,GAAgB;AAAA,EACzB,WAAA,EAAa,EAAE,MAAA,EAAQ,MAAA,EAAiB,MAAM,eAAA;AAClD;;;ACsEO,SAAS,kBAEd,MAAA,EACF;AACI,EAAA,OAAO;AAAA,IACH,MAAA;AAAA,IACA,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA;AAAA,IAC9B,QAAQ;AAAC,GACb;AACJ;ACjFiBA,MAAAA,CAAO,KAAA,CAAM,eAAe;;;ACkEtC,SAAS,eAGd,GAAA,EAIF;AACI,EAAA,OAAO;AAAA,IACH,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA;AAAA,IAClC,QAAA,EAAW,GAAA,CAAI,QAAA,IAAY,EAAC;AAAA,IAC5B,QAAQ;AAAC,GACb;AACJ","file":"index.js","sourcesContent":["/**\n * Event System\n *\n * Decoupled pub/sub event system with optional cache integration for multi-instance support\n *\n * @example\n * ```typescript\n * // Define event\n * const userCreated = defineEvent('user.created', Type.Object({\n *     userId: Type.String(),\n * }));\n *\n * // Subscribe (in-memory)\n * userCreated.subscribe((payload) => {\n *     console.log('User created:', payload.userId);\n * });\n *\n * // Emit\n * await userCreated.emit({ userId: '123' });\n *\n * // With cache for multi-instance\n * const event = defineEvent('user.created', schema);\n * await event.useCache(cache);  // Must await before emitting\n * await event.emit({ userId: '123' });  // Broadcast to all instances\n * ```\n */\n\nimport type { TSchema, Static } from '@sinclair/typebox';\nimport { logger } from '@spfn/core/logger';\nimport type { EventDef, EventHandler, JobQueueSender, PubSubCache } from './types';\n\nconst eventLogger = logger.child('@spfn/core:event');\n\n/**\n * Log handler error with consistent format\n */\nfunction logHandlerError(eventName: string, error: unknown): void\n{\n    eventLogger.error(`Event handler error: ${eventName}`, {\n        error: error instanceof Error ? error.message : String(error),\n    });\n}\n\n/**\n * Log job queue error with consistent format\n */\nfunction logJobQueueError(queueName: string, error: unknown): void\n{\n    eventLogger.error(`Failed to send event to job queue: ${queueName}`, {\n        error: error instanceof Error ? error.message : String(error),\n    });\n}\n\n/**\n * Create handler subscription manager\n */\nfunction createHandlerManager<TPayload>(name: string)\n{\n    const handlers: Set<EventHandler<TPayload>> = new Set();\n\n    return {\n        add: (handler: EventHandler<TPayload>): (() => void) =>\n        {\n            handlers.add(handler);\n            eventLogger.debug(`Subscribed to event: ${name}`, { handlerCount: handlers.size });\n\n            return () =>\n            {\n                handlers.delete(handler);\n                eventLogger.debug(`Unsubscribed from event: ${name}`, { handlerCount: handlers.size });\n            };\n        },\n\n        clear: (): void =>\n        {\n            handlers.clear();\n            eventLogger.debug(`Unsubscribed all from event: ${name}`);\n        },\n\n        trigger: async (payload: TPayload): Promise<void> =>\n        {\n            const results = await Promise.allSettled(\n                [...handlers].map((handler) => handler(payload)),\n            );\n\n            for (const result of results)\n            {\n                if (result.status === 'rejected')\n                {\n                    logHandlerError(name, result.reason);\n                }\n            }\n        },\n    };\n}\n\n/**\n * Create job queue manager\n */\nfunction createJobQueueManager(name: string)\n{\n    const jobQueues: Map<string, JobQueueSender> = new Map();\n\n    return {\n        register: (queueName: string, sender: JobQueueSender): void =>\n        {\n            jobQueues.set(queueName, sender);\n            eventLogger.debug(`Registered job queue for event: ${name}`, { queueName });\n        },\n\n        send: async (payload: unknown): Promise<void> =>\n        {\n            if (jobQueues.size === 0)\n            {\n                return;\n            }\n\n            const entries = [...jobQueues.entries()];\n            const results = await Promise.allSettled(\n                entries.map(([queueName, sender]) => sender(queueName, payload)),\n            );\n\n            for (const [i, result] of results.entries())\n            {\n                if (result.status === 'rejected')\n                {\n                    logJobQueueError(entries[i][0], result.reason);\n                }\n            }\n        },\n\n        get size(): number\n        {\n            return jobQueues.size;\n        },\n    };\n}\n\n/**\n * Internal: Create event implementation\n */\nfunction createEventImpl<TPayload>(\n    name: string,\n    schema?: TSchema,\n): EventDef<TPayload>\n{\n    const handlerManager = createHandlerManager<TPayload>(name);\n    const jobQueueManager = createJobQueueManager(name);\n    let cache: PubSubCache | undefined;\n    let cacheSubscribed = false;\n\n    const emit = async (payload?: TPayload): Promise<void> =>\n    {\n        eventLogger.debug(`Emitting event: ${name}`, {\n            payload,\n            hasCache: !!cache,\n            jobQueueCount: jobQueueManager.size,\n        });\n\n        if (cache)\n        {\n            await cache.publish(name, payload);\n        }\n        else\n        {\n            await handlerManager.trigger(payload as TPayload);\n        }\n\n        await jobQueueManager.send(payload);\n        eventLogger.debug(`Event emitted: ${name}`);\n    };\n\n    const useCache = async (newCache: PubSubCache): Promise<EventDef<TPayload>> =>\n    {\n        if (cacheSubscribed)\n        {\n            eventLogger.warn(`Cache already configured for event: ${name}`);\n\n            return self;\n        }\n\n        // Subscribe FIRST, then flip to cache mode. If subscribe rejects, the\n        // event stays in-process (cache undefined) and cacheSubscribed stays\n        // false — so emit keeps delivering locally and a later useCache can retry.\n        // Setting these before the await would latch a half-broken state: emit\n        // would publish to a channel this instance never subscribed to.\n        await newCache.subscribe(name, async (message: unknown) =>\n        {\n            eventLogger.debug(`Received event from cache: ${name}`);\n            await handlerManager.trigger(message as TPayload);\n        });\n\n        cache = newCache;\n        cacheSubscribed = true;\n\n        eventLogger.debug(`Cache subscription ready for event: ${name}`);\n\n        return self;\n    };\n\n    // Drop the cache binding so a later useCache can rebind a fresh transport.\n    // Without this, the cacheSubscribed latch would make a second server start in\n    // the same process (tests, hot-reload) a no-op while the event still points at\n    // a torn-down cache — cross-pod fan-out would silently stay dead.\n    const resetCache = (): void =>\n    {\n        cache = undefined;\n        cacheSubscribed = false;\n    };\n\n    const self: EventDef<TPayload> = {\n        name,\n        schema,\n        subscribe: handlerManager.add,\n        unsubscribeAll: handlerManager.clear,\n        emit: emit as EventDef<TPayload>['emit'],\n        useCache,\n        _registerJobQueue: jobQueueManager.register,\n        _resetCache: resetCache,\n        _payload: undefined as unknown as TPayload,\n    };\n\n    return self;\n}\n\n/**\n * Define an event without payload\n */\nexport function defineEvent(name: string): EventDef<void>;\n\n/**\n * Define an event with typed payload\n */\nexport function defineEvent<T extends TSchema>(\n    name: string,\n    schema: T,\n): EventDef<Static<T>>;\n\n/**\n * Define an event for decoupled pub/sub\n *\n * @example\n * ```typescript\n * // Define event with payload\n * export const userCreated = defineEvent('user.created', Type.Object({\n *     userId: Type.String(),\n * }));\n *\n * // Subscribe to event (in-memory)\n * const unsubscribe = userCreated.subscribe((payload) => {\n *     console.log('User created:', payload.userId);\n * });\n *\n * // Emit event\n * await userCreated.emit({ userId: '123' });\n *\n * // Unsubscribe when done\n * unsubscribe();\n *\n * // Multi-instance with cache\n * await userCreated.useCache(cache);\n * await userCreated.emit({ userId: '123' });  // Broadcast to all instances\n * ```\n */\nexport function defineEvent<T extends TSchema>(\n    name: string,\n    schema?: T,\n): EventDef<Static<T>> | EventDef\n{\n    if (schema)\n    {\n        return createEventImpl<Static<T>>(name, schema);\n    }\n\n    return createEventImpl<void>(name);\n}\n","/**\n * SSE Event Route Map\n *\n * Static route map for SSE token endpoint.\n * Merge into RPC proxy routeMap so `eventsToken` resolves to `POST /events/token`.\n *\n * @example\n * ```typescript\n * // app/api/rpc/[routeName]/route.ts\n * import { createRpcProxy } from '@spfn/core/nextjs/server';\n * import { eventRouteMap } from '@spfn/core/event';\n * import { authRouteMap } from '@spfn/auth';\n * import { routeMap } from '@/generated/route-map';\n *\n * export const { GET, POST } = createRpcProxy({\n *     routeMap: { ...routeMap, ...authRouteMap, ...eventRouteMap },\n * });\n * ```\n */\nexport const eventRouteMap = {\n    eventsToken: { method: 'POST' as const, path: '/events/token' },\n};\n","/**\n * Event Router\n *\n * Type-safe event router for SSE subscription\n *\n * @example\n * ```typescript\n * import { defineEvent, defineEventRouter } from '@spfn/core/event';\n * import { Type } from '@sinclair/typebox';\n *\n * const userCreated = defineEvent('user.created', Type.Object({\n *     userId: Type.String(),\n * }));\n *\n * const orderPlaced = defineEvent('order.placed', Type.Object({\n *     orderId: Type.String(),\n *     amount: Type.Number(),\n * }));\n *\n * export const eventRouter = defineEventRouter({\n *     userCreated,\n *     orderPlaced,\n * });\n *\n * export type EventRouter = typeof eventRouter;\n * ```\n */\n\nimport type { EventDef } from './types';\n\n/**\n * Event Router Definition\n */\nexport interface EventRouterDef<TEvents extends Record<string, EventDef<any>>>\n{\n    /**\n     * Event definitions\n     */\n    readonly events: TEvents;\n\n    /**\n     * Event names as array\n     */\n    readonly eventNames: (keyof TEvents)[];\n\n    /**\n     * Type inference helper - payload types by event name\n     */\n    readonly _types: {\n        [K in keyof TEvents]: TEvents[K]['_payload'];\n    };\n}\n\n/**\n * Infer event names from EventRouter\n */\nexport type InferEventNames<T> = T extends EventRouterDef<infer E>\n    ? keyof E & string\n    : never;\n\n/**\n * Infer payload type for specific event\n */\nexport type InferEventPayload<\n    T extends EventRouterDef<any>,\n    K extends InferEventNames<T>,\n> = T['_types'][K];\n\n/**\n * Infer all event payloads map\n */\nexport type InferEventPayloads<T extends EventRouterDef<any>> = T['_types'];\n\n/**\n * Define an event router for SSE subscription\n *\n * @example\n * ```typescript\n * export const eventRouter = defineEventRouter({\n *     userCreated,\n *     orderPlaced,\n * });\n *\n * // Type inference\n * type Names = InferEventNames<typeof eventRouter>;\n * // 'userCreated' | 'orderPlaced'\n *\n * type Payload = InferEventPayload<typeof eventRouter, 'userCreated'>;\n * // { userId: string }\n * ```\n */\nexport function defineEventRouter<\n    TEvents extends Record<string, EventDef<any>>,\n>(events: TEvents): EventRouterDef<TEvents>\n{\n    return {\n        events,\n        eventNames: Object.keys(events) as (keyof TEvents)[],\n        _types: {} as EventRouterDef<TEvents>['_types'],\n    };\n}\n","/**\n * WebSocket Handler\n *\n * Attaches a WebSocket server to an existing Node.js http.Server.\n * Handles authentication, event subscription, and client message routing.\n */\n\nimport type { Server } from 'node:http';\nimport type { EventDef } from '../types';\nimport type {\n    WSRouterDef,\n    WSHandlerConfig,\n    WSHandlerAuthConfig,\n    WSMessageHandlers,\n    WSRawConnection,\n} from './types';\nimport type { SSETokenManager } from '../sse/token-manager';\nimport { logger } from '@spfn/core/logger';\n\nconst wsLogger = logger.child('@spfn/core:ws');\n\n/**\n * Decide whether a WebSocket upgrade's Origin is permitted.\n *\n * - no allow-list configured → allowed (check disabled)\n * - no Origin header (native/non-browser client) → allowed\n * - Origin present → must be in the allow-list\n */\nexport function isOriginAllowed(\n    origin: string | undefined,\n    allowList: Set<string> | null,\n): boolean\n{\n    if (!allowList)\n    {\n        return true;\n    }\n\n    if (!origin)\n    {\n        return true;\n    }\n\n    return allowList.has(origin);\n}\n\n// ============================================================================\n// Public API\n// ============================================================================\n\n/**\n * Attach a WebSocket server to a Node.js http.Server\n *\n * @returns cleanup function that closes the WebSocket server\n */\nexport async function attachWSHandler<\n    TEvents extends Record<string, EventDef<any>>,\n    TMessages extends WSMessageHandlers,\n>(\n    server: Server,\n    router: WSRouterDef<TEvents, TMessages>,\n    config: WSHandlerConfig & { path?: string } = {},\n    tokenManager?: SSETokenManager,\n): Promise<() => Promise<void>>\n{\n    const WebSocketServer = await loadWSServer();\n\n    const {\n        pingInterval = 30000,\n        path = '/ws',\n        maxPayload = 1_048_576,\n        maxBufferedBytes = 1_048_576,\n        maxConnections = 10_000,\n        maxConnectionsPerSubject = 0,\n        allowedOrigins,\n        auth: authConfig,\n    } = config;\n\n    const originAllowList = allowedOrigins && allowedOrigins.length > 0\n        ? new Set(allowedOrigins)\n        : null;\n\n    if (authConfig?.enabled && !tokenManager)\n    {\n        throw new Error(\n            'WebSocket auth.enabled=true requires a tokenManager. ' +\n            'Pass tokenManager or use .websockets(router, { auth: { enabled: true } }) via startServer.',\n        );\n    }\n\n    const wss = new WebSocketServer({ server, path, maxPayload });\n\n    // Track live connections for graceful shutdown\n    const clients = new Set<any>();\n    // Live connection count per authenticated subject (for the per-subject cap)\n    const subjectCounts = new Map<string, number>();\n\n    wss.on('connection', (ws: any, req: any) =>\n    {\n        // Origin allow-list (cross-site WebSocket hijacking protection). Browsers\n        // always send Origin on the upgrade; reject one that isn't allowed before\n        // doing any work. A missing Origin (native/non-browser client, which can't\n        // be CSRF'd into using ambient cookies) passes through.\n        if (!isOriginAllowed(req.headers?.origin, originAllowList))\n        {\n            wsLogger.warn('WebSocket rejected: disallowed origin', { origin: req.headers?.origin });\n            ws.close(1008, 'Origin not allowed');\n\n            return;\n        }\n\n        // Global connection cap — reject before doing any work\n        if (clients.size >= maxConnections)\n        {\n            ws.close(1013, 'Server at capacity');\n\n            return;\n        }\n\n        clients.add(ws);\n        ws.on('close', () => clients.delete(ws));\n        handleConnection(ws, req, router, authConfig, tokenManager, {\n            pingInterval,\n            maxBufferedBytes,\n            maxConnectionsPerSubject,\n            subjectCounts,\n        })\n            .catch((err: Error) =>\n            {\n                wsLogger.error('WebSocket connection handler error', err);\n                if (ws.readyState === 1) ws.close(1011, 'Internal server error');\n            });\n    });\n\n    wss.on('error', (err: Error) =>\n    {\n        wsLogger.error('WebSocket server error', err);\n    });\n\n    wsLogger.info(`✓ WebSocket endpoint registered at ${path}`, {\n        events: router.eventNames,\n        auth: !!authConfig?.enabled,\n    });\n\n    return () => new Promise<void>((resolve, reject) =>\n    {\n        // Close all existing connections with 1001 Going Away\n        for (const client of clients)\n        {\n            client.close(1001, 'Server shutting down');\n        }\n        clients.clear();\n\n        wss.close((err?: Error) =>\n        {\n            if (err) reject(err);\n            else resolve();\n        });\n    });\n}\n\n// ============================================================================\n// Connection Handler\n// ============================================================================\n\ninterface ConnectionOptions\n{\n    pingInterval: number;\n    maxBufferedBytes: number;\n    maxConnectionsPerSubject: number;\n    subjectCounts: Map<string, number>;\n}\n\nasync function handleConnection(\n    ws: any,\n    req: any,\n    router: WSRouterDef<any, any>,\n    authConfig: WSHandlerAuthConfig | undefined,\n    tokenManager: SSETokenManager | undefined,\n    opts: ConnectionOptions,\n): Promise<void>\n{\n    const { pingInterval, maxBufferedBytes, maxConnectionsPerSubject, subjectCounts } = opts;\n    // Register close handler before any await — ensures we never miss the event even during auth\n    let pingTimer: ReturnType<typeof setInterval> | undefined;\n    let connectionUnsubscribes: (() => void)[] = [];\n    let subscribedEvents: string[] = [];\n    ws.on('close', () =>\n    {\n        clearInterval(pingTimer);\n        connectionUnsubscribes.forEach(fn => fn());\n        if (subscribedEvents.length > 0)\n            wsLogger.info('WebSocket connection closed', { events: subscribedEvents });\n    });\n\n    const url = parseURL(req);\n    if (!url)\n    {\n        ws.close(1002, 'Invalid request URL');\n\n        return;\n    }\n\n    // ── 1. Authenticate ──\n    const subject = await resolveSubject(url, authConfig?.enabled ? tokenManager : undefined);\n    if (subject === false)\n    {\n        ws.close(4001, 'Missing token');\n\n        return;\n    }\n    if (subject === null)\n    {\n        ws.close(4001, 'Invalid or expired token');\n\n        return;\n    }\n\n    // ── 2. Resolve subscribed events ──\n    const requestedEvents = parseRequestedEvents(url, router.eventNames as string[]);\n    if (requestedEvents.length === 0)\n    {\n        ws.close(4000, 'No valid event names specified');\n\n        return;\n    }\n\n    // ── 3. Authorize ──\n    const allowedEvents = await resolveAllowedEvents(subject, requestedEvents, authConfig);\n    if (allowedEvents === null)\n    {\n        ws.close(4003, 'Not authorized for any requested events');\n\n        return;\n    }\n\n    // ── Per-subject connection cap (authenticated subjects only) ──\n    if (maxConnectionsPerSubject > 0 && typeof subject === 'string')\n    {\n        const current = subjectCounts.get(subject) ?? 0;\n        if (current >= maxConnectionsPerSubject)\n        {\n            ws.close(1013, 'Too many connections for this subject');\n\n            return;\n        }\n\n        subjectCounts.set(subject, current + 1);\n        ws.on('close', () =>\n        {\n            const remaining = (subjectCounts.get(subject) ?? 1) - 1;\n            if (remaining <= 0) subjectCounts.delete(subject);\n            else subjectCounts.set(subject, remaining);\n        });\n    }\n\n    subscribedEvents = allowedEvents;\n    wsLogger.info('WebSocket connection established', {\n        events: allowedEvents,\n        subject: subject ?? undefined,\n    });\n\n    // ── 4. Build connection wrapper ──\n    const connection = createConnection(ws, maxBufferedBytes);\n\n    // ── 5. Subscribe to server-push events ──\n    connectionUnsubscribes = subscribeEvents(ws, router, allowedEvents, subject, authConfig, maxBufferedBytes);\n\n    // If socket closed during auth awaits, clean up and bail\n    if (ws.readyState !== 1)\n    {\n        connectionUnsubscribes.forEach(fn => fn());\n        connectionUnsubscribes = [];\n\n        return;\n    }\n\n    // ── 6. Handle incoming messages ──\n    ws.on('message', (data: Buffer | string) =>\n    {\n        onClientMessage(data, router, connection, subject)\n            .catch((err: Error) => wsLogger.error('Unhandled message error', err));\n    });\n\n    // ── 7. Keep-alive ping with liveness (pong) tracking ──\n    // Without reaping un-ponged sockets, a half-open connection (sleeping device,\n    // NAT drop with no FIN) lingers with its subscriptions, timer, and buffers.\n    if (pingInterval > 0)\n    {\n        ws.isAlive = true;\n        ws.on('pong', () =>\n        {\n            ws.isAlive = true;\n        });\n\n        pingTimer = setInterval(() =>\n        {\n            if (ws.readyState !== 1) return;\n\n            if (ws.isAlive === false)\n            {\n                // No pong since the previous tick — drop the dead/half-open socket\n                ws.terminate();\n\n                return;\n            }\n\n            ws.isAlive = false;\n            ws.ping();\n        }, pingInterval);\n    }\n\n    // ── 9. Send connected ack ──\n    connection.send('__connected', {\n        subscribedEvents: allowedEvents,\n        timestamp: Date.now(),\n    });\n}\n\n// ============================================================================\n// Helpers\n// ============================================================================\n\nfunction parseURL(req: any): URL | null\n{\n    try\n    {\n        return new URL(req.url ?? '/', 'ws://localhost');\n    }\n    catch\n    {\n        return null;\n    }\n}\n\n/**\n * Resolve subject from token\n * - undefined: no auth required\n * - false: token param missing (when required)\n * - null: token invalid/expired\n * - string: authenticated subject\n */\nasync function resolveSubject(\n    url: URL,\n    tokenManager?: SSETokenManager,\n): Promise<string | undefined | false | null>\n{\n    if (!tokenManager)\n    {\n        return undefined;\n    }\n\n    const token = url.searchParams.get('token');\n    if (!token)\n    {\n        return false;\n    }\n\n    return await tokenManager.verify(token);\n}\n\nfunction parseRequestedEvents(url: URL, validEventNames: string[]): string[]\n{\n    const eventsParam = url.searchParams.get('events');\n    if (!eventsParam)\n    {\n        return [];\n    }\n\n    return eventsParam\n        .split(',')\n        .map(e => e.trim())\n        .filter(e => validEventNames.includes(e));\n}\n\nasync function resolveAllowedEvents(\n    subject: string | undefined,\n    requestedEvents: string[],\n    authConfig?: WSHandlerAuthConfig,\n): Promise<string[] | null>\n{\n    if (!subject || !authConfig?.authorize)\n    {\n        return requestedEvents;\n    }\n\n    const allowed = await authConfig.authorize(subject, requestedEvents);\n\n    return allowed.length === 0 ? null : allowed;\n}\n\n/**\n * Send a JSON frame with backpressure protection. If the socket's outbound\n * buffer is already past the cap, the consumer is too slow — close the\n * connection (1013) instead of buffering more and risking OOM. The client\n * reconnects and re-subscribes.\n */\nexport function safeSend(ws: any, frame: unknown, maxBufferedBytes: number): void\n{\n    if (ws.readyState !== 1) return;\n\n    if (ws.bufferedAmount > maxBufferedBytes)\n    {\n        ws.close(1013, 'Send buffer overflow');\n\n        return;\n    }\n\n    try\n    {\n        ws.send(JSON.stringify(frame));\n    }\n    catch\n    {\n        // Socket closed between the readyState check and send — ignore\n    }\n}\n\nfunction createConnection(ws: any, maxBufferedBytes: number): WSRawConnection\n{\n    return {\n        send: (type, payload) => safeSend(ws, { type, data: payload }, maxBufferedBytes),\n        close: (code, reason) => ws.close(code, reason),\n    };\n}\n\nfunction subscribeEvents(\n    ws: any,\n    router: WSRouterDef<any, any>,\n    allowedEvents: string[],\n    subject: string | undefined,\n    authConfig: WSHandlerAuthConfig | undefined,\n    maxBufferedBytes: number,\n): (() => void)[]\n{\n    const unsubscribes: (() => void)[] = [];\n\n    for (const eventName of allowedEvents)\n    {\n        const eventDef = router.events[eventName];\n        if (!eventDef) continue;\n\n        const unsubscribe = eventDef.subscribe((payload: unknown) =>\n        {\n            if (ws.readyState !== 1) return;\n\n            if (subject && authConfig?.filter?.[eventName])\n            {\n                if (!authConfig.filter[eventName](subject, payload)) return;\n            }\n\n            safeSend(ws, { type: eventName, data: payload }, maxBufferedBytes);\n        });\n\n        unsubscribes.push(unsubscribe);\n    }\n\n    return unsubscribes;\n}\n\nasync function onClientMessage(\n    data: Buffer | string,\n    router: WSRouterDef<any, any>,\n    connection: WSRawConnection,\n    subject: string | undefined,\n): Promise<void>\n{\n    let message: { type?: string; data?: unknown };\n\n    try\n    {\n        message = JSON.parse(data.toString());\n    }\n    catch\n    {\n        return;\n    }\n\n    const { type, data: payload } = message;\n    if (!type) return;\n\n    const handler = router.messages[type];\n    if (!handler) return;\n\n    try\n    {\n        await handler({ payload, subject, ws: connection });\n    }\n    catch (err)\n    {\n        wsLogger.error(`WebSocket message handler error: ${type}`, err as Error);\n    }\n}\n\n// ============================================================================\n// Dynamic import for optional 'ws' dependency\n// ============================================================================\n\n/**\n * Resolve the WebSocketServer constructor from the 'ws' module object.\n *\n * ws is a dual package, so the module shape depends on the loader path:\n * - ESM (exports.import → wrapper.mjs): WebSocketServer is a named export;\n *   the default export is the bare WebSocket class with no properties on it.\n * - CJS (require interop): module.exports = WebSocket with\n *   WebSocket.WebSocketServer attached, surfaced under .default.\n * Named exports must win — checking .default first crashes on the ESM path.\n */\nexport function resolveWSServerCtor(mod: any): any\n{\n    return mod.WebSocketServer ?? mod.Server\n        ?? mod.default?.WebSocketServer ?? mod.default?.Server;\n}\n\nasync function loadWSServer(): Promise<any>\n{\n    let mod: any;\n\n    try\n    {\n        mod = await import('ws');\n    }\n    catch\n    {\n        throw new Error(\n            '@spfn/core WebSocket support requires the \"ws\" package.\\n' +\n            'Install it with: pnpm add ws',\n        );\n    }\n\n    const WSS = resolveWSServerCtor(mod);\n\n    if (typeof WSS !== 'function')\n    {\n        throw new Error(\n            'WebSocketServer not found in ws module. ' +\n            'Ensure ws@^8 is installed: pnpm add ws',\n        );\n    }\n\n    return WSS;\n}\n","/**\n * WebSocket Module\n *\n * Type-safe WebSocket server with event-based pub/sub and bidirectional messaging.\n *\n * @example Server setup\n * ```typescript\n * // src/server/ws.ts\n * import { defineWSRouter } from '@spfn/core/event/ws';\n * import { defineEvent } from '@spfn/core/event';\n * import { Type } from '@sinclair/typebox';\n *\n * const userUpdated = defineEvent('user.updated', Type.Object({ userId: Type.String() }));\n * const notification = defineEvent('notification', Type.Object({ message: Type.String() }));\n *\n * export const wsRouter = defineWSRouter({\n *     events: { userUpdated, notification },\n *     messages: {\n *         ping: ({ ws }) => ws.send('pong', {}),\n *     },\n * });\n *\n * export type WSRouter = typeof wsRouter;\n *\n * // server.config.ts\n * defineServerConfig()\n *     .websockets(wsRouter)\n *     .build();\n * ```\n *\n * @example Client usage\n * ```typescript\n * import { createWSClient } from '@spfn/core/event/ws/client';\n * import type { WSRouter } from '@/server/ws';\n *\n * const client = createWSClient<WSRouter>();\n *\n * client.subscribe({\n *     events: ['userUpdated', 'notification'],\n *     handlers: {\n *         userUpdated: ({ userId }) => console.log(userId),\n *         notification: ({ message }) => console.log(message),\n *     },\n * });\n *\n * client.send('ping', {});\n * ```\n */\n\nimport type { EventDef } from '../types';\nimport type { WSRouterDef, WSMessageHandlers } from './types';\n\nexport { attachWSHandler } from './handler';\nexport type {\n    WSRouterDef,\n    WSHandlerConfig,\n    WSAuthConfig,\n    WSHandlerAuthConfig,\n    WSMessageContext,\n    WSMessageHandlerFn,\n    WSMessageHandlers,\n    WSRawConnection,\n    WSClientConfig,\n    WSConnectionState,\n    WSEventHandlers,\n    WSSubscribeOptions,\n    WSUnsubscribe,\n} from './types';\n\n/**\n * Define a WebSocket router\n *\n * Combines server→client event push with client→server message handlers.\n *\n * @example\n * ```typescript\n * export const wsRouter = defineWSRouter({\n *     events: { userUpdated, notification },\n *     messages: {\n *         ping: ({ ws }) => ws.send('pong', {}),\n *         'chat.send': ({ payload, subject }) => handleChat(payload, subject),\n *     },\n * });\n * ```\n */\nexport function defineWSRouter<\n    TEvents extends Record<string, EventDef<any>>,\n    TMessages extends WSMessageHandlers = WSMessageHandlers,\n>(def: {\n    events: TEvents;\n    messages?: TMessages;\n}): WSRouterDef<TEvents, TMessages>\n{\n    return {\n        events: def.events,\n        eventNames: Object.keys(def.events) as (keyof TEvents)[],\n        messages: (def.messages ?? {}) as TMessages,\n        _types: {} as WSRouterDef<TEvents, TMessages>['_types'],\n    };\n}\n"]}
+{"version":3,"sources":["../../src/event/event.ts","../../src/event/sse/route-map.ts","../../src/event/router.ts","../../src/event/ws/handler.ts","../../src/event/ws/index.ts"],"names":["logger"],"mappings":";;;AA+BA,IAAM,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,kBAAkB,CAAA;AAKnD,SAAS,eAAA,CAAgB,WAAmB,KAAA,EAC5C;AACI,EAAA,WAAA,CAAY,KAAA,CAAM,CAAA,qBAAA,EAAwB,SAAS,CAAA,CAAA,EAAI;AAAA,IACnD,OAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK;AAAA,GAC/D,CAAA;AACL;AAKA,SAAS,gBAAA,CAAiB,WAAmB,KAAA,EAC7C;AACI,EAAA,WAAA,CAAY,KAAA,CAAM,CAAA,mCAAA,EAAsC,SAAS,CAAA,CAAA,EAAI;AAAA,IACjE,OAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK;AAAA,GAC/D,CAAA;AACL;AAKA,SAAS,qBAA+B,IAAA,EACxC;AACI,EAAA,MAAM,QAAA,uBAA4C,GAAA,EAAI;AAEtD,EAAA,OAAO;AAAA,IACH,GAAA,EAAK,CAAC,OAAA,KACN;AACI,MAAA,QAAA,CAAS,IAAI,OAAO,CAAA;AACpB,MAAA,WAAA,CAAY,KAAA,CAAM,wBAAwB,IAAI,CAAA,CAAA,EAAI,EAAE,YAAA,EAAc,QAAA,CAAS,MAAM,CAAA;AAEjF,MAAA,OAAO,MACP;AACI,QAAA,QAAA,CAAS,OAAO,OAAO,CAAA;AACvB,QAAA,WAAA,CAAY,KAAA,CAAM,4BAA4B,IAAI,CAAA,CAAA,EAAI,EAAE,YAAA,EAAc,QAAA,CAAS,MAAM,CAAA;AAAA,MACzF,CAAA;AAAA,IACJ,CAAA;AAAA,IAEA,OAAO,MACP;AACI,MAAA,QAAA,CAAS,KAAA,EAAM;AACf,MAAA,WAAA,CAAY,KAAA,CAAM,CAAA,6BAAA,EAAgC,IAAI,CAAA,CAAE,CAAA;AAAA,IAC5D,CAAA;AAAA,IAEA,OAAA,EAAS,OAAO,OAAA,KAChB;AACI,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,UAAA;AAAA,QAC1B,CAAC,GAAG,QAAQ,CAAA,CAAE,IAAI,CAAC,OAAA,KAAY,OAAA,CAAQ,OAAO,CAAC;AAAA,OACnD;AAEA,MAAA,KAAA,MAAW,UAAU,OAAA,EACrB;AACI,QAAA,IAAI,MAAA,CAAO,WAAW,UAAA,EACtB;AACI,UAAA,eAAA,CAAgB,IAAA,EAAM,OAAO,MAAM,CAAA;AAAA,QACvC;AAAA,MACJ;AAAA,IACJ;AAAA,GACJ;AACJ;AAKA,SAAS,sBAAsB,IAAA,EAC/B;AACI,EAAA,MAAM,SAAA,uBAA6C,GAAA,EAAI;AAEvD,EAAA,OAAO;AAAA,IACH,QAAA,EAAU,CAAC,SAAA,EAAmB,MAAA,KAC9B;AACI,MAAA,SAAA,CAAU,GAAA,CAAI,WAAW,MAAM,CAAA;AAC/B,MAAA,WAAA,CAAY,MAAM,CAAA,gCAAA,EAAmC,IAAI,CAAA,CAAA,EAAI,EAAE,WAAW,CAAA;AAAA,IAC9E,CAAA;AAAA,IAEA,IAAA,EAAM,OAAO,OAAA,KACb;AACI,MAAA,IAAI,SAAA,CAAU,SAAS,CAAA,EACvB;AACI,QAAA;AAAA,MACJ;AAEA,MAAA,MAAM,OAAA,GAAU,CAAC,GAAG,SAAA,CAAU,SAAS,CAAA;AACvC,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,UAAA;AAAA,QAC1B,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,SAAA,EAAW,MAAM,CAAA,KAAM,MAAA,CAAO,SAAA,EAAW,OAAO,CAAC;AAAA,OACnE;AAEA,MAAA,KAAA,MAAW,CAAC,CAAA,EAAG,MAAM,CAAA,IAAK,OAAA,CAAQ,SAAQ,EAC1C;AACI,QAAA,IAAI,MAAA,CAAO,WAAW,UAAA,EACtB;AACI,UAAA,gBAAA,CAAiB,QAAQ,CAAC,CAAA,CAAE,CAAC,CAAA,EAAG,OAAO,MAAM,CAAA;AAAA,QACjD;AAAA,MACJ;AAAA,IACJ,CAAA;AAAA,IAEA,IAAI,IAAA,GACJ;AACI,MAAA,OAAO,SAAA,CAAU,IAAA;AAAA,IACrB;AAAA,GACJ;AACJ;AAKA,SAAS,eAAA,CACL,MACA,MAAA,EAEJ;AACI,EAAA,MAAM,cAAA,GAAiB,qBAA+B,IAAI,CAAA;AAC1D,EAAA,MAAM,eAAA,GAAkB,sBAAsB,IAAI,CAAA;AAClD,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,eAAA,GAAkB,KAAA;AAEtB,EAAA,MAAM,IAAA,GAAO,OAAO,OAAA,KACpB;AACI,IAAA,WAAA,CAAY,KAAA,CAAM,CAAA,gBAAA,EAAmB,IAAI,CAAA,CAAA,EAAI;AAAA,MACzC,OAAA;AAAA,MACA,QAAA,EAAU,CAAC,CAAC,KAAA;AAAA,MACZ,eAAe,eAAA,CAAgB;AAAA,KAClC,CAAA;AAED,IAAA,IAAI,KAAA,EACJ;AACI,MAAA,MAAM,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA;AAAA,IACrC,CAAA,MAEA;AACI,MAAA,MAAM,cAAA,CAAe,QAAQ,OAAmB,CAAA;AAAA,IACpD;AAEA,IAAA,MAAM,eAAA,CAAgB,KAAK,OAAO,CAAA;AAClC,IAAA,WAAA,CAAY,KAAA,CAAM,CAAA,eAAA,EAAkB,IAAI,CAAA,CAAE,CAAA;AAAA,EAC9C,CAAA;AAEA,EAAA,MAAM,QAAA,GAAW,OAAO,QAAA,KACxB;AACI,IAAA,IAAI,eAAA,EACJ;AACI,MAAA,WAAA,CAAY,IAAA,CAAK,CAAA,oCAAA,EAAuC,IAAI,CAAA,CAAE,CAAA;AAE9D,MAAA,OAAO,IAAA;AAAA,IACX;AAOA,IAAA,MAAM,QAAA,CAAS,SAAA,CAAU,IAAA,EAAM,OAAO,OAAA,KACtC;AACI,MAAA,WAAA,CAAY,KAAA,CAAM,CAAA,2BAAA,EAA8B,IAAI,CAAA,CAAE,CAAA;AACtD,MAAA,MAAM,cAAA,CAAe,QAAQ,OAAmB,CAAA;AAAA,IACpD,CAAC,CAAA;AAED,IAAA,KAAA,GAAQ,QAAA;AACR,IAAA,eAAA,GAAkB,IAAA;AAElB,IAAA,WAAA,CAAY,KAAA,CAAM,CAAA,oCAAA,EAAuC,IAAI,CAAA,CAAE,CAAA;AAE/D,IAAA,OAAO,IAAA;AAAA,EACX,CAAA;AAMA,EAAA,MAAM,aAAa,MACnB;AACI,IAAA,KAAA,GAAQ,MAAA;AACR,IAAA,eAAA,GAAkB,KAAA;AAAA,EACtB,CAAA;AAEA,EAAA,MAAM,IAAA,GAA2B;AAAA,IAC7B,IAAA;AAAA,IACA,MAAA;AAAA,IACA,WAAW,cAAA,CAAe,GAAA;AAAA,IAC1B,gBAAgB,cAAA,CAAe,KAAA;AAAA,IAC/B,IAAA;AAAA,IACA,QAAA;AAAA,IACA,mBAAmB,eAAA,CAAgB,QAAA;AAAA,IACnC,WAAA,EAAa,UAAA;AAAA,IACb,QAAA,EAAU;AAAA,GACd;AAEA,EAAA,OAAO,IAAA;AACX;AAyCO,SAAS,WAAA,CACZ,MACA,MAAA,EAEJ;AACI,EAAA,IAAI,MAAA,EACJ;AACI,IAAA,OAAO,eAAA,CAA2B,MAAM,MAAM,CAAA;AAAA,EAClD;AAEA,EAAA,OAAO,gBAAsB,IAAI,CAAA;AACrC;;;ACjQO,IAAM,aAAA,GAAgB;AAAA,EACzB,WAAA,EAAa,EAAE,MAAA,EAAQ,MAAA,EAAiB,MAAM,eAAA;AAClD;;;ACuEO,SAAS,kBAEd,MAAA,EACF;AACI,EAAA,OAAO;AAAA,IACH,MAAA;AAAA,IACA,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA;AAAA,IAC9B,QAAQ;AAAC,GACb;AACJ;ACjFiBA,MAAAA,CAAO,KAAA,CAAM,eAAe;;;ACkEtC,SAAS,eAGd,GAAA,EAIF;AACI,EAAA,OAAO;AAAA,IACH,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA;AAAA,IAClC,QAAA,EAAW,GAAA,CAAI,QAAA,IAAY,EAAC;AAAA,IAC5B,QAAQ;AAAC,GACb;AACJ","file":"index.js","sourcesContent":["/**\n * Event System\n *\n * Decoupled pub/sub event system with optional cache integration for multi-instance support\n *\n * @example\n * ```typescript\n * // Define event\n * const userCreated = defineEvent('user.created', Type.Object({\n *     userId: Type.String(),\n * }));\n *\n * // Subscribe (in-memory)\n * userCreated.subscribe((payload) => {\n *     console.log('User created:', payload.userId);\n * });\n *\n * // Emit\n * await userCreated.emit({ userId: '123' });\n *\n * // With cache for multi-instance\n * const event = defineEvent('user.created', schema);\n * await event.useCache(cache);  // Must await before emitting\n * await event.emit({ userId: '123' });  // Broadcast to all instances\n * ```\n */\n\nimport type { TSchema, Static } from '@sinclair/typebox';\nimport { logger } from '@spfn/core/logger';\nimport type { EventDef, EventHandler, JobQueueSender, PubSubCache } from './types';\n\nconst eventLogger = logger.child('@spfn/core:event');\n\n/**\n * Log handler error with consistent format\n */\nfunction logHandlerError(eventName: string, error: unknown): void\n{\n    eventLogger.error(`Event handler error: ${eventName}`, {\n        error: error instanceof Error ? error.message : String(error),\n    });\n}\n\n/**\n * Log job queue error with consistent format\n */\nfunction logJobQueueError(queueName: string, error: unknown): void\n{\n    eventLogger.error(`Failed to send event to job queue: ${queueName}`, {\n        error: error instanceof Error ? error.message : String(error),\n    });\n}\n\n/**\n * Create handler subscription manager\n */\nfunction createHandlerManager<TPayload>(name: string)\n{\n    const handlers: Set<EventHandler<TPayload>> = new Set();\n\n    return {\n        add: (handler: EventHandler<TPayload>): (() => void) =>\n        {\n            handlers.add(handler);\n            eventLogger.debug(`Subscribed to event: ${name}`, { handlerCount: handlers.size });\n\n            return () =>\n            {\n                handlers.delete(handler);\n                eventLogger.debug(`Unsubscribed from event: ${name}`, { handlerCount: handlers.size });\n            };\n        },\n\n        clear: (): void =>\n        {\n            handlers.clear();\n            eventLogger.debug(`Unsubscribed all from event: ${name}`);\n        },\n\n        trigger: async (payload: TPayload): Promise<void> =>\n        {\n            const results = await Promise.allSettled(\n                [...handlers].map((handler) => handler(payload)),\n            );\n\n            for (const result of results)\n            {\n                if (result.status === 'rejected')\n                {\n                    logHandlerError(name, result.reason);\n                }\n            }\n        },\n    };\n}\n\n/**\n * Create job queue manager\n */\nfunction createJobQueueManager(name: string)\n{\n    const jobQueues: Map<string, JobQueueSender> = new Map();\n\n    return {\n        register: (queueName: string, sender: JobQueueSender): void =>\n        {\n            jobQueues.set(queueName, sender);\n            eventLogger.debug(`Registered job queue for event: ${name}`, { queueName });\n        },\n\n        send: async (payload: unknown): Promise<void> =>\n        {\n            if (jobQueues.size === 0)\n            {\n                return;\n            }\n\n            const entries = [...jobQueues.entries()];\n            const results = await Promise.allSettled(\n                entries.map(([queueName, sender]) => sender(queueName, payload)),\n            );\n\n            for (const [i, result] of results.entries())\n            {\n                if (result.status === 'rejected')\n                {\n                    logJobQueueError(entries[i][0], result.reason);\n                }\n            }\n        },\n\n        get size(): number\n        {\n            return jobQueues.size;\n        },\n    };\n}\n\n/**\n * Internal: Create event implementation\n */\nfunction createEventImpl<TPayload>(\n    name: string,\n    schema?: TSchema,\n): EventDef<TPayload>\n{\n    const handlerManager = createHandlerManager<TPayload>(name);\n    const jobQueueManager = createJobQueueManager(name);\n    let cache: PubSubCache | undefined;\n    let cacheSubscribed = false;\n\n    const emit = async (payload?: TPayload): Promise<void> =>\n    {\n        eventLogger.debug(`Emitting event: ${name}`, {\n            payload,\n            hasCache: !!cache,\n            jobQueueCount: jobQueueManager.size,\n        });\n\n        if (cache)\n        {\n            await cache.publish(name, payload);\n        }\n        else\n        {\n            await handlerManager.trigger(payload as TPayload);\n        }\n\n        await jobQueueManager.send(payload);\n        eventLogger.debug(`Event emitted: ${name}`);\n    };\n\n    const useCache = async (newCache: PubSubCache): Promise<EventDef<TPayload>> =>\n    {\n        if (cacheSubscribed)\n        {\n            eventLogger.warn(`Cache already configured for event: ${name}`);\n\n            return self;\n        }\n\n        // Subscribe FIRST, then flip to cache mode. If subscribe rejects, the\n        // event stays in-process (cache undefined) and cacheSubscribed stays\n        // false — so emit keeps delivering locally and a later useCache can retry.\n        // Setting these before the await would latch a half-broken state: emit\n        // would publish to a channel this instance never subscribed to.\n        await newCache.subscribe(name, async (message: unknown) =>\n        {\n            eventLogger.debug(`Received event from cache: ${name}`);\n            await handlerManager.trigger(message as TPayload);\n        });\n\n        cache = newCache;\n        cacheSubscribed = true;\n\n        eventLogger.debug(`Cache subscription ready for event: ${name}`);\n\n        return self;\n    };\n\n    // Drop the cache binding so a later useCache can rebind a fresh transport.\n    // Without this, the cacheSubscribed latch would make a second server start in\n    // the same process (tests, hot-reload) a no-op while the event still points at\n    // a torn-down cache — cross-pod fan-out would silently stay dead.\n    const resetCache = (): void =>\n    {\n        cache = undefined;\n        cacheSubscribed = false;\n    };\n\n    const self: EventDef<TPayload> = {\n        name,\n        schema,\n        subscribe: handlerManager.add,\n        unsubscribeAll: handlerManager.clear,\n        emit: emit as EventDef<TPayload>['emit'],\n        useCache,\n        _registerJobQueue: jobQueueManager.register,\n        _resetCache: resetCache,\n        _payload: undefined as unknown as TPayload,\n    };\n\n    return self;\n}\n\n/**\n * Define an event without payload\n */\nexport function defineEvent(name: string): EventDef<void>;\n\n/**\n * Define an event with typed payload\n */\nexport function defineEvent<T extends TSchema>(\n    name: string,\n    schema: T,\n): EventDef<Static<T>>;\n\n/**\n * Define an event for decoupled pub/sub\n *\n * @example\n * ```typescript\n * // Define event with payload\n * export const userCreated = defineEvent('user.created', Type.Object({\n *     userId: Type.String(),\n * }));\n *\n * // Subscribe to event (in-memory)\n * const unsubscribe = userCreated.subscribe((payload) => {\n *     console.log('User created:', payload.userId);\n * });\n *\n * // Emit event\n * await userCreated.emit({ userId: '123' });\n *\n * // Unsubscribe when done\n * unsubscribe();\n *\n * // Multi-instance with cache\n * await userCreated.useCache(cache);\n * await userCreated.emit({ userId: '123' });  // Broadcast to all instances\n * ```\n */\nexport function defineEvent<T extends TSchema>(\n    name: string,\n    schema?: T,\n): EventDef<Static<T>> | EventDef\n{\n    if (schema)\n    {\n        return createEventImpl<Static<T>>(name, schema);\n    }\n\n    return createEventImpl<void>(name);\n}\n","/**\n * SSE Event Route Map\n *\n * Static route map for SSE token endpoint.\n * Merge into RPC proxy routeMap so `eventsToken` resolves to `POST /events/token`.\n *\n * @example\n * ```typescript\n * // app/api/rpc/[routeName]/route.ts\n * import { createRpcProxy } from '@spfn/core/nextjs/server';\n * import { eventRouteMap } from '@spfn/core/event';\n * import { routeMap } from '@/generated/route-map';\n *\n * export const { GET, POST } = createRpcProxy({\n *     routeMap: { ...routeMap, ...eventRouteMap },\n * });\n * ```\n */\nexport const eventRouteMap = {\n    eventsToken: { method: 'POST' as const, path: '/events/token' },\n};\n","/**\n * Event Router\n *\n * Type-safe event router for SSE subscription\n *\n * @example\n * ```typescript\n * import { defineEvent, defineEventRouter } from '@spfn/core/event';\n * import { Type } from '@sinclair/typebox';\n *\n * const userCreated = defineEvent('user.created', Type.Object({\n *     userId: Type.String(),\n * }));\n *\n * const orderPlaced = defineEvent('order.placed', Type.Object({\n *     orderId: Type.String(),\n *     amount: Type.Number(),\n * }));\n *\n * export const eventRouter = defineEventRouter({\n *     userCreated,\n *     orderPlaced,\n * });\n *\n * export type EventRouter = typeof eventRouter;\n * ```\n */\n\nimport type { EventDef } from './types';\n\n/**\n * Event Router Definition\n */\nexport interface EventRouterDef<TEvents extends Record<string, EventDef<any>>>\n{\n    /**\n     * Event definitions\n     */\n    readonly events: TEvents;\n\n    /**\n     * Event names as array\n     */\n    readonly eventNames: (keyof TEvents)[];\n\n    /**\n     * Type inference helper - payload types by event name\n     */\n    readonly _types: {\n        [K in keyof TEvents]: TEvents[K]['_payload'];\n    };\n}\n\n/**\n * Infer event names from EventRouter\n */\nexport type InferEventNames<T> = T extends EventRouterDef<infer E>\n    ? keyof E & string\n    : never;\n\n/**\n * Infer payload type for specific event\n */\nexport type InferEventPayload<\n    T extends EventRouterDef<any>,\n    K extends InferEventNames<T>,\n> = T['_types'][K];\n\n/**\n * Infer all event payloads map\n */\nexport type InferEventPayloads<T extends EventRouterDef<any>> = T['_types'];\n\n/**\n * Define an event router for SSE subscription\n *\n * @example\n * ```typescript\n * export const eventRouter = defineEventRouter({\n *     userCreated,\n *     orderPlaced,\n * });\n *\n * // Type inference\n * type Names = InferEventNames<typeof eventRouter>;\n * // 'userCreated' | 'orderPlaced'\n *\n * type Payload = InferEventPayload<typeof eventRouter, 'userCreated'>;\n * // { userId: string }\n * ```\n */\nexport function defineEventRouter<\n    TEvents extends Record<string, EventDef<any>>,\n>(events: TEvents): EventRouterDef<TEvents>\n{\n    return {\n        events,\n        eventNames: Object.keys(events) as (keyof TEvents)[],\n        _types: {} as EventRouterDef<TEvents>['_types'],\n    };\n}\n","/**\n * WebSocket Handler\n *\n * Attaches a WebSocket server to an existing Node.js http.Server.\n * Handles authentication, event subscription, and client message routing.\n */\n\nimport type { Server } from 'node:http';\nimport type { EventDef } from '../types';\nimport type {\n    WSRouterDef,\n    WSHandlerConfig,\n    WSHandlerAuthConfig,\n    WSMessageHandlers,\n    WSRawConnection,\n} from './types';\nimport type { SSETokenManager } from '../sse/token-manager';\nimport { logger } from '@spfn/core/logger';\n\nconst wsLogger = logger.child('@spfn/core:ws');\n\n/**\n * Decide whether a WebSocket upgrade's Origin is permitted.\n *\n * - no allow-list configured → allowed (check disabled)\n * - no Origin header (native/non-browser client) → allowed\n * - Origin present → must be in the allow-list\n */\nexport function isOriginAllowed(\n    origin: string | undefined,\n    allowList: Set<string> | null,\n): boolean\n{\n    if (!allowList)\n    {\n        return true;\n    }\n\n    if (!origin)\n    {\n        return true;\n    }\n\n    return allowList.has(origin);\n}\n\n// ============================================================================\n// Public API\n// ============================================================================\n\n/**\n * Attach a WebSocket server to a Node.js http.Server\n *\n * @returns cleanup function that closes the WebSocket server\n */\nexport async function attachWSHandler<\n    TEvents extends Record<string, EventDef<any>>,\n    TMessages extends WSMessageHandlers,\n>(\n    server: Server,\n    router: WSRouterDef<TEvents, TMessages>,\n    config: WSHandlerConfig & { path?: string } = {},\n    tokenManager?: SSETokenManager,\n): Promise<() => Promise<void>>\n{\n    const WebSocketServer = await loadWSServer();\n\n    const {\n        pingInterval = 30000,\n        path = '/ws',\n        maxPayload = 1_048_576,\n        maxBufferedBytes = 1_048_576,\n        maxConnections = 10_000,\n        maxConnectionsPerSubject = 0,\n        allowedOrigins,\n        auth: authConfig,\n    } = config;\n\n    const originAllowList = allowedOrigins && allowedOrigins.length > 0\n        ? new Set(allowedOrigins)\n        : null;\n\n    if (authConfig?.enabled && !tokenManager)\n    {\n        throw new Error(\n            'WebSocket auth.enabled=true requires a tokenManager. ' +\n            'Pass tokenManager or use .websockets(router, { auth: { enabled: true } }) via startServer.',\n        );\n    }\n\n    const wss = new WebSocketServer({ server, path, maxPayload });\n\n    // Track live connections for graceful shutdown\n    const clients = new Set<any>();\n    // Live connection count per authenticated subject (for the per-subject cap)\n    const subjectCounts = new Map<string, number>();\n\n    wss.on('connection', (ws: any, req: any) =>\n    {\n        // Origin allow-list (cross-site WebSocket hijacking protection). Browsers\n        // always send Origin on the upgrade; reject one that isn't allowed before\n        // doing any work. A missing Origin (native/non-browser client, which can't\n        // be CSRF'd into using ambient cookies) passes through.\n        if (!isOriginAllowed(req.headers?.origin, originAllowList))\n        {\n            wsLogger.warn('WebSocket rejected: disallowed origin', { origin: req.headers?.origin });\n            ws.close(1008, 'Origin not allowed');\n\n            return;\n        }\n\n        // Global connection cap — reject before doing any work\n        if (clients.size >= maxConnections)\n        {\n            ws.close(1013, 'Server at capacity');\n\n            return;\n        }\n\n        clients.add(ws);\n        ws.on('close', () => clients.delete(ws));\n        handleConnection(ws, req, router, authConfig, tokenManager, {\n            pingInterval,\n            maxBufferedBytes,\n            maxConnectionsPerSubject,\n            subjectCounts,\n        })\n            .catch((err: Error) =>\n            {\n                wsLogger.error('WebSocket connection handler error', err);\n                if (ws.readyState === 1) ws.close(1011, 'Internal server error');\n            });\n    });\n\n    wss.on('error', (err: Error) =>\n    {\n        wsLogger.error('WebSocket server error', err);\n    });\n\n    wsLogger.info(`✓ WebSocket endpoint registered at ${path}`, {\n        events: router.eventNames,\n        auth: !!authConfig?.enabled,\n    });\n\n    return () => new Promise<void>((resolve, reject) =>\n    {\n        // Close all existing connections with 1001 Going Away\n        for (const client of clients)\n        {\n            client.close(1001, 'Server shutting down');\n        }\n        clients.clear();\n\n        wss.close((err?: Error) =>\n        {\n            if (err) reject(err);\n            else resolve();\n        });\n    });\n}\n\n// ============================================================================\n// Connection Handler\n// ============================================================================\n\ninterface ConnectionOptions\n{\n    pingInterval: number;\n    maxBufferedBytes: number;\n    maxConnectionsPerSubject: number;\n    subjectCounts: Map<string, number>;\n}\n\nasync function handleConnection(\n    ws: any,\n    req: any,\n    router: WSRouterDef<any, any>,\n    authConfig: WSHandlerAuthConfig | undefined,\n    tokenManager: SSETokenManager | undefined,\n    opts: ConnectionOptions,\n): Promise<void>\n{\n    const { pingInterval, maxBufferedBytes, maxConnectionsPerSubject, subjectCounts } = opts;\n    // Register close handler before any await — ensures we never miss the event even during auth\n    let pingTimer: ReturnType<typeof setInterval> | undefined;\n    let connectionUnsubscribes: (() => void)[] = [];\n    let subscribedEvents: string[] = [];\n    ws.on('close', () =>\n    {\n        clearInterval(pingTimer);\n        connectionUnsubscribes.forEach(fn => fn());\n        if (subscribedEvents.length > 0)\n            wsLogger.info('WebSocket connection closed', { events: subscribedEvents });\n    });\n\n    const url = parseURL(req);\n    if (!url)\n    {\n        ws.close(1002, 'Invalid request URL');\n\n        return;\n    }\n\n    // ── 1. Authenticate ──\n    const subject = await resolveSubject(url, authConfig?.enabled ? tokenManager : undefined);\n    if (subject === false)\n    {\n        ws.close(4001, 'Missing token');\n\n        return;\n    }\n    if (subject === null)\n    {\n        ws.close(4001, 'Invalid or expired token');\n\n        return;\n    }\n\n    // ── 2. Resolve subscribed events ──\n    const requestedEvents = parseRequestedEvents(url, router.eventNames as string[]);\n    if (requestedEvents.length === 0)\n    {\n        ws.close(4000, 'No valid event names specified');\n\n        return;\n    }\n\n    // ── 3. Authorize ──\n    const allowedEvents = await resolveAllowedEvents(subject, requestedEvents, authConfig);\n    if (allowedEvents === null)\n    {\n        ws.close(4003, 'Not authorized for any requested events');\n\n        return;\n    }\n\n    // ── Per-subject connection cap (authenticated subjects only) ──\n    if (maxConnectionsPerSubject > 0 && typeof subject === 'string')\n    {\n        const current = subjectCounts.get(subject) ?? 0;\n        if (current >= maxConnectionsPerSubject)\n        {\n            ws.close(1013, 'Too many connections for this subject');\n\n            return;\n        }\n\n        subjectCounts.set(subject, current + 1);\n        ws.on('close', () =>\n        {\n            const remaining = (subjectCounts.get(subject) ?? 1) - 1;\n            if (remaining <= 0) subjectCounts.delete(subject);\n            else subjectCounts.set(subject, remaining);\n        });\n    }\n\n    subscribedEvents = allowedEvents;\n    wsLogger.info('WebSocket connection established', {\n        events: allowedEvents,\n        subject: subject ?? undefined,\n    });\n\n    // ── 4. Build connection wrapper ──\n    const connection = createConnection(ws, maxBufferedBytes);\n\n    // ── 5. Subscribe to server-push events ──\n    connectionUnsubscribes = subscribeEvents(ws, router, allowedEvents, subject, authConfig, maxBufferedBytes);\n\n    // If socket closed during auth awaits, clean up and bail\n    if (ws.readyState !== 1)\n    {\n        connectionUnsubscribes.forEach(fn => fn());\n        connectionUnsubscribes = [];\n\n        return;\n    }\n\n    // ── 6. Handle incoming messages ──\n    ws.on('message', (data: Buffer | string) =>\n    {\n        onClientMessage(data, router, connection, subject)\n            .catch((err: Error) => wsLogger.error('Unhandled message error', err));\n    });\n\n    // ── 7. Keep-alive ping with liveness (pong) tracking ──\n    // Without reaping un-ponged sockets, a half-open connection (sleeping device,\n    // NAT drop with no FIN) lingers with its subscriptions, timer, and buffers.\n    if (pingInterval > 0)\n    {\n        ws.isAlive = true;\n        ws.on('pong', () =>\n        {\n            ws.isAlive = true;\n        });\n\n        pingTimer = setInterval(() =>\n        {\n            if (ws.readyState !== 1) return;\n\n            if (ws.isAlive === false)\n            {\n                // No pong since the previous tick — drop the dead/half-open socket\n                ws.terminate();\n\n                return;\n            }\n\n            ws.isAlive = false;\n            ws.ping();\n        }, pingInterval);\n    }\n\n    // ── 9. Send connected ack ──\n    connection.send('__connected', {\n        subscribedEvents: allowedEvents,\n        timestamp: Date.now(),\n    });\n}\n\n// ============================================================================\n// Helpers\n// ============================================================================\n\nfunction parseURL(req: any): URL | null\n{\n    try\n    {\n        return new URL(req.url ?? '/', 'ws://localhost');\n    }\n    catch\n    {\n        return null;\n    }\n}\n\n/**\n * Resolve subject from token\n * - undefined: no auth required\n * - false: token param missing (when required)\n * - null: token invalid/expired\n * - string: authenticated subject\n */\nasync function resolveSubject(\n    url: URL,\n    tokenManager?: SSETokenManager,\n): Promise<string | undefined | false | null>\n{\n    if (!tokenManager)\n    {\n        return undefined;\n    }\n\n    const token = url.searchParams.get('token');\n    if (!token)\n    {\n        return false;\n    }\n\n    return await tokenManager.verify(token);\n}\n\nfunction parseRequestedEvents(url: URL, validEventNames: string[]): string[]\n{\n    const eventsParam = url.searchParams.get('events');\n    if (!eventsParam)\n    {\n        return [];\n    }\n\n    return eventsParam\n        .split(',')\n        .map(e => e.trim())\n        .filter(e => validEventNames.includes(e));\n}\n\nasync function resolveAllowedEvents(\n    subject: string | undefined,\n    requestedEvents: string[],\n    authConfig?: WSHandlerAuthConfig,\n): Promise<string[] | null>\n{\n    if (!subject || !authConfig?.authorize)\n    {\n        return requestedEvents;\n    }\n\n    const allowed = await authConfig.authorize(subject, requestedEvents);\n\n    return allowed.length === 0 ? null : allowed;\n}\n\n/**\n * Send a JSON frame with backpressure protection. If the socket's outbound\n * buffer is already past the cap, the consumer is too slow — close the\n * connection (1013) instead of buffering more and risking OOM. The client\n * reconnects and re-subscribes.\n */\nexport function safeSend(ws: any, frame: unknown, maxBufferedBytes: number): void\n{\n    if (ws.readyState !== 1) return;\n\n    if (ws.bufferedAmount > maxBufferedBytes)\n    {\n        ws.close(1013, 'Send buffer overflow');\n\n        return;\n    }\n\n    try\n    {\n        ws.send(JSON.stringify(frame));\n    }\n    catch\n    {\n        // Socket closed between the readyState check and send — ignore\n    }\n}\n\nfunction createConnection(ws: any, maxBufferedBytes: number): WSRawConnection\n{\n    return {\n        send: (type, payload) => safeSend(ws, { type, data: payload }, maxBufferedBytes),\n        close: (code, reason) => ws.close(code, reason),\n    };\n}\n\nfunction subscribeEvents(\n    ws: any,\n    router: WSRouterDef<any, any>,\n    allowedEvents: string[],\n    subject: string | undefined,\n    authConfig: WSHandlerAuthConfig | undefined,\n    maxBufferedBytes: number,\n): (() => void)[]\n{\n    const unsubscribes: (() => void)[] = [];\n\n    for (const eventName of allowedEvents)\n    {\n        const eventDef = router.events[eventName];\n        if (!eventDef) continue;\n\n        const unsubscribe = eventDef.subscribe((payload: unknown) =>\n        {\n            if (ws.readyState !== 1) return;\n\n            if (subject && authConfig?.filter?.[eventName])\n            {\n                if (!authConfig.filter[eventName](subject, payload)) return;\n            }\n\n            safeSend(ws, { type: eventName, data: payload }, maxBufferedBytes);\n        });\n\n        unsubscribes.push(unsubscribe);\n    }\n\n    return unsubscribes;\n}\n\nasync function onClientMessage(\n    data: Buffer | string,\n    router: WSRouterDef<any, any>,\n    connection: WSRawConnection,\n    subject: string | undefined,\n): Promise<void>\n{\n    let message: { type?: string; data?: unknown };\n\n    try\n    {\n        message = JSON.parse(data.toString());\n    }\n    catch\n    {\n        return;\n    }\n\n    const { type, data: payload } = message;\n    if (!type) return;\n\n    const handler = router.messages[type];\n    if (!handler) return;\n\n    try\n    {\n        await handler({ payload, subject, ws: connection });\n    }\n    catch (err)\n    {\n        wsLogger.error(`WebSocket message handler error: ${type}`, err as Error);\n    }\n}\n\n// ============================================================================\n// Dynamic import for optional 'ws' dependency\n// ============================================================================\n\n/**\n * Resolve the WebSocketServer constructor from the 'ws' module object.\n *\n * ws is a dual package, so the module shape depends on the loader path:\n * - ESM (exports.import → wrapper.mjs): WebSocketServer is a named export;\n *   the default export is the bare WebSocket class with no properties on it.\n * - CJS (require interop): module.exports = WebSocket with\n *   WebSocket.WebSocketServer attached, surfaced under .default.\n * Named exports must win — checking .default first crashes on the ESM path.\n */\nexport function resolveWSServerCtor(mod: any): any\n{\n    return mod.WebSocketServer ?? mod.Server\n        ?? mod.default?.WebSocketServer ?? mod.default?.Server;\n}\n\nasync function loadWSServer(): Promise<any>\n{\n    let mod: any;\n\n    try\n    {\n        mod = await import('ws');\n    }\n    catch\n    {\n        throw new Error(\n            '@spfn/core WebSocket support requires the \"ws\" package.\\n' +\n            'Install it with: pnpm add ws',\n        );\n    }\n\n    const WSS = resolveWSServerCtor(mod);\n\n    if (typeof WSS !== 'function')\n    {\n        throw new Error(\n            'WebSocketServer not found in ws module. ' +\n            'Ensure ws@^8 is installed: pnpm add ws',\n        );\n    }\n\n    return WSS;\n}\n","/**\n * WebSocket Module\n *\n * Type-safe WebSocket server with event-based pub/sub and bidirectional messaging.\n *\n * @example Server setup\n * ```typescript\n * // src/server/ws.ts\n * import { defineWSRouter } from '@spfn/core/event/ws';\n * import { defineEvent } from '@spfn/core/event';\n * import { Type } from '@sinclair/typebox';\n *\n * const userUpdated = defineEvent('user.updated', Type.Object({ userId: Type.String() }));\n * const notification = defineEvent('notification', Type.Object({ message: Type.String() }));\n *\n * export const wsRouter = defineWSRouter({\n *     events: { userUpdated, notification },\n *     messages: {\n *         ping: ({ ws }) => ws.send('pong', {}),\n *     },\n * });\n *\n * export type WSRouter = typeof wsRouter;\n *\n * // server.config.ts\n * defineServerConfig()\n *     .websockets(wsRouter)\n *     .build();\n * ```\n *\n * @example Client usage\n * ```typescript\n * import { createWSClient } from '@spfn/core/event/ws/client';\n * import type { WSRouter } from '@/server/ws';\n *\n * const client = createWSClient<WSRouter>();\n *\n * client.subscribe({\n *     events: ['userUpdated', 'notification'],\n *     handlers: {\n *         userUpdated: ({ userId }) => console.log(userId),\n *         notification: ({ message }) => console.log(message),\n *     },\n * });\n *\n * client.send('ping', {});\n * ```\n */\n\nimport type { EventDef } from '../types';\nimport type { WSRouterDef, WSMessageHandlers } from './types';\n\nexport { attachWSHandler } from './handler';\nexport type {\n    WSRouterDef,\n    WSHandlerConfig,\n    WSAuthConfig,\n    WSHandlerAuthConfig,\n    WSMessageContext,\n    WSMessageHandlerFn,\n    WSMessageHandlers,\n    WSRawConnection,\n    WSClientConfig,\n    WSConnectionState,\n    WSEventHandlers,\n    WSSubscribeOptions,\n    WSUnsubscribe,\n} from './types';\n\n/**\n * Define a WebSocket router\n *\n * Combines server→client event push with client→server message handlers.\n *\n * @example\n * ```typescript\n * export const wsRouter = defineWSRouter({\n *     events: { userUpdated, notification },\n *     messages: {\n *         ping: ({ ws }) => ws.send('pong', {}),\n *         'chat.send': ({ payload, subject }) => handleChat(payload, subject),\n *     },\n * });\n * ```\n */\nexport function defineWSRouter<\n    TEvents extends Record<string, EventDef<any>>,\n    TMessages extends WSMessageHandlers = WSMessageHandlers,\n>(def: {\n    events: TEvents;\n    messages?: TMessages;\n}): WSRouterDef<TEvents, TMessages>\n{\n    return {\n        events: def.events,\n        eventNames: Object.keys(def.events) as (keyof TEvents)[],\n        messages: (def.messages ?? {}) as TMessages,\n        _types: {} as WSRouterDef<TEvents, TMessages>['_types'],\n    };\n}\n"]}

package/dist/nextjs/index.d.ts

@@ -1,6 +1,6 @@
 import { Router, RouteDef } from '@spfn/core/route';
-import { R as RequestInterceptor, a as ResponseInterceptor, I as InferRouteInput, b as InferRouteOutput, E as ExtractRoutes, A as ApiConfig } from '../types-yv6z_mK7.js';
-export { C as CallOptions, c as CookieOptions, d as RouterInput, e as RouterOutput, S as SetCookie, f as StructuredInput } from '../types-yv6z_mK7.js';
+import { R as RequestInterceptor, a as ResponseInterceptor, I as InferRouteInput, b as InferRouteOutput, E as ExtractRoutes, A as ApiConfig } from '../types-QoyjaJWw.js';
+export { C as CallOptions, c as CookieOptions, d as RouterInput, e as RouterOutput, S as SetCookie, f as StructuredInput } from '../types-QoyjaJWw.js';
 import '@sinclair/typebox';
 import '@spfn/core/errors';
 

package/dist/nextjs/index.js

@@ -429,19 +429,6 @@ function createApi(config = {}) {
     try {
       response = await executeFetchWithTimeout(fullUrl, init, timeout, customFetch);
       body = await parseResponseBody(response);
-      if (globalOnResponse) {
-        const result = await globalOnResponse(response, body);
-        response = result.response;
-        body = result.body;
-      }
-      if (options.onResponse) {
-        const result = await options.onResponse(response, body);
-        response = result.response;
-        body = result.body;
-      }
-      if (debug) {
-        logResponse(apiLogger, routeName, response.status, !!body);
-      }
     } catch (error) {
       if (error instanceof Error && error.name === "AbortError") {
         apiLogger.error("Request timeout", {
@@ -474,6 +461,19 @@ function createApi(config = {}) {
         "network"
       );
     }
+    if (globalOnResponse) {
+      const result = await globalOnResponse(response, body);
+      response = result.response;
+      body = result.body;
+    }
+    if (options.onResponse) {
+      const result = await options.onResponse(response, body);
+      response = result.response;
+      body = result.body;
+    }
+    if (debug) {
+      logResponse(apiLogger, routeName, response.status, !!body);
+    }
     if (!response.ok) {
       await handleErrorResponse(response, body, fullUrl, errorRegistry$1, debug, apiLogger);
     }

package/dist/nextjs/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/nextjs/client/debug-logs.ts","../../src/nextjs/client/errors.ts","../../src/nextjs/shared.ts","../../src/nextjs/client/helpers.ts","../../src/nextjs/client/csrf.ts","../../src/nextjs/client/builder.ts","../../src/nextjs/client/core.ts"],"names":["logger","errorRegistry","coreErrorRegistry","headers"],"mappings":";;;;;;;AAMO,SAAS,sBAAA,CACZA,SACA,OAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,sDAAA,EAAwD;AAAA,IACjE,aAAa,OAAA,CAAQ,MAAA;AAAA,IACrB,WAAA,EAAa,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,KAAK,EAAE,IAAI;AAAA,GACvC,CAAA;AACL;AAEO,SAAS,UAAA,CACZA,OAAAA,EACA,SAAA,EACA,MAAA,EACA,KACA,OAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,gBAAA,EAAa;AAAA,IACtB,KAAA,EAAO,SAAA;AAAA,IACP,MAAA;AAAA,IACA,GAAA;AAAA,IACA;AAAA,GACH,CAAA;AACL;AAEO,SAAS,WAAA,CACZA,OAAAA,EACA,SAAA,EACA,MAAA,EACA,OAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,iBAAA,EAAc;AAAA,IACvB,KAAA,EAAO,SAAA;AAAA,IACP,MAAA;AAAA,IACA;AAAA,GACH,CAAA;AACL;AAEO,SAAS,gBAAA,CACZA,OAAAA,EACA,MAAA,EACA,IAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,yBAAA,EAA2B;AAAA,IACpC,MAAA;AAAA,IACA,OAAA,EAAS,CAAC,CAAC,IAAA;AAAA,IACX,UAAU,OAAO,IAAA;AAAA,IACjB,YAAA,EAAc,IAAA,IAAQ,OAAO,IAAA,KAAS,YAAY,QAAA,IAAY,IAAA;AAAA,IAC9D,WAAW,IAAA,EAAM;AAAA,GACpB,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,OAAAA,EACA,SAAA,EACA,eAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,kCAAA,EAAoC;AAAA,IAC7C,SAAA;AAAA,IACA,WAAA,EAAa,IAAA;AAAA,IACb;AAAA,GACH,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,SACA,KAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,iCAAA,EAAmC;AAAA,IAC5C,WAAW,KAAA,EAAO,IAAA;AAAA,IAClB,gBAAA,EAAkB,OAAO,WAAA,CAAY,IAAA;AAAA,IACrC,SAAS,KAAA,EAAO;AAAA,GACnB,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,SACA,KAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,wBAAA,EAA0B;AAAA,IACnC,SAAA,EAAW,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,IAAA,GAAO,SAAA;AAAA,IACjD,cAAc,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK;AAAA,GACtE,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,OAAAA,EACA,aAAA,EACA,IAAA,EAEJ;AACI,EAAA,MAAM,MAAA,GAAS,CAAC,aAAA,GACV,aAAA,GACA,CAAC,IAAA,GACG,SAAA,GACA,OAAO,IAAA,KAAS,QAAA,GACZ,iBAAA,GACA,EAAE,QAAA,IAAY,QACV,iBAAA,GACA,SAAA;AAElB,EAAAA,OAAAA,CAAO,KAAA,CAAM,gCAAA,EAAkC,EAAE,QAAQ,CAAA;AAC7D;AAEO,SAAS,4BAAA,CACZA,SACA,KAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,6BAAA,EAA+B;AAAA,IACxC,WAAW,KAAA,CAAM,IAAA;AAAA,IACjB,oBAAA,EAAsB,MAAM,WAAA,CAAY,IAAA;AAAA,IACxC,SAAA,EAAW,MAAA,CAAO,cAAA,CAAe,KAAK,EAAE,WAAA,CAAY;AAAA,GACvD,CAAA;AACL;;;ACxHO,IAAM,QAAA,GAAN,cAAuB,KAAA,CAC9B;AAAA,EACI,WAAA,CACI,OAAA,EACgB,MAAA,EACA,GAAA,EACA,UACA,SAAA,EAEpB;AACI,IAAA,KAAA,CAAM,OAAO,CAAA;AANG,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAIhB,IAAA,IAAA,CAAK,IAAA,GAAO,UAAA;AAAA,EAChB;AACJ;;;ACyCO,SAAS,kBAAkB,OAAA,EAClC;AACI,EAAA,OAAO,OAAO,OAAA,CAAQ,OAAO,CAAA,CACxB,GAAA,CAAI,CAAC,CAAC,GAAA,EAAK,KAAK,CAAA,KAAM,GAAG,GAAG,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,CAAA,CACvC,KAAK,IAAI,CAAA;AAClB;AAUA,eAAsB,kBAAkB,QAAA,EACxC;AAEI,EAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EACxB;AACI,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAEvD,EAAA,IAAI,WAAA,EAAa,QAAA,CAAS,kBAAkB,CAAA,EAC5C;AACI,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,IAAA,OAAO,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,GAAI,IAAA;AAAA,EACrC,CAAA,MAEA;AACI,IAAA,OAAO,MAAM,SAAS,IAAA,EAAK;AAAA,EAC/B;AACJ;;;ACvFA,IAAM,YAAA,GAAe,MAAA,CAAO,KAAA,CAAM,yBAAyB,CAAA;AAM3D,eAAsB,uBAAA,GACtB;AAEI,EAAA,IAAI,OAAO,WAAW,WAAA,EACtB;AACI,IAAA,OAAO,EAAC;AAAA,EACZ;AAEA,EAAA,IACA;AAEI,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,OAAO,cAAc,CAAA;AAC/C,IAAA,MAAM,WAAA,GAAc,MAAM,OAAA,EAAQ;AAClC,IAAA,MAAM,UAAA,GAAa,YAAY,MAAA,EAAO;AAEtC,IAAA,MAAM,SAAS,MAAA,CAAO,WAAA;AAAA,MAClB,UAAA,CAAW,IAAI,CAAA,MAAA,KAAU,CAAC,OAAO,IAAA,EAAM,MAAA,CAAO,KAAK,CAAC;AAAA,KACxD;AAEA,IAAA,YAAA,CAAa,MAAM,yBAAA,EAA2B;AAAA,MAC1C,OAAO,UAAA,CAAW,MAAA;AAAA,MAClB,KAAA,EAAO,UAAA,CAAW,GAAA,CAAI,CAAA,CAAA,KAAK,EAAE,IAAI;AAAA,KACpC,CAAA;AAED,IAAA,OAAO,MAAA;AAAA,EACX,SACO,KAAA,EACP;AAGI,IAAA,MAAM,GAAA,GAAM,KAAA;AACZ,IAAA,YAAA,CAAa,KAAK,+BAAA,EAAiC;AAAA,MAC/C,SAAS,GAAA,CAAI,OAAA;AAAA,MACb,MAAM,GAAA,CAAI;AAAA,KACb,CAAA;AAED,IAAA,OAAO,EAAC;AAAA,EACZ;AACJ;AAKA,eAAsB,uBAAA,CAClB,GAAA,EACA,IAAA,EACA,OAAA,EACA,cAA4B,KAAA,EAEhC;AACI,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,YAAY,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,OAAO,CAAA;AAE9D,EAAA,IACA;AACI,IAAA,MAAM,QAAA,GAAW,MAAM,WAAA,CAAY,GAAA,EAAK;AAAA,MACpC,GAAG,IAAA;AAAA,MACH,QAAQ,UAAA,CAAW;AAAA,KACtB,CAAA;AAED,IAAA,YAAA,CAAa,SAAS,CAAA;AAEtB,IAAA,OAAO,QAAA;AAAA,EACX,SACO,KAAA,EACP;AACI,IAAA,YAAA,CAAa,SAAS,CAAA;AACtB,IAAA,MAAM,KAAA;AAAA,EACV;AACJ;AAOA,eAAsB,oBAClB,QAAA,EACA,IAAA,EACA,OAAA,EACA,aAAA,EACA,OACAA,OAAAA,EAEJ;AACI,EAAA,IAAI,KAAA,EACJ;AACI,IAAU,gBAAA,CAAiBA,OAAAA,EAAQ,QAAA,CAAS,MAAA,EAAQ,IAAI,CAAA;AAAA,EAC5D;AAGA,EAAA,IAAI,iBAAA,GAAkC,IAAA;AAEtC,EAAA,IAAI,iBAAiB,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,IAAY,YAAY,IAAA,EACrE;AACI,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,+BAA+BA,OAAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,aAAA,CAAc,oBAAoB,CAAA;AAAA,IACpG;AAEA,IAAA,IACA;AACI,MAAA,iBAAA,GAAoB,aAAA,CAAc,YAAY,IAAW,CAAA;AAEzD,MAAA,IAAI,KAAA,EACJ;AACI,QAAU,8BAAA,CAA+BA,SAAQ,iBAAiB,CAAA;AAAA,MACtE;AAAA,IACJ,SACO,gBAAA,EACP;AAEI,MAAA,IAAI,KAAA,EACJ;AACI,QAAU,8BAAA,CAA+BA,SAAQ,gBAAgB,CAAA;AAAA,MACrE;AAAA,IAEJ;AAAA,EACJ,WACS,KAAA,EACT;AACI,IAAU,8BAAA,CAA+BA,OAAAA,EAAQ,aAAA,EAAe,IAAI,CAAA;AAAA,EACxE;AAGA,EAAA,IAAI,iBAAA,EACJ;AACI,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,4BAAA,CAA6BA,SAAQ,iBAAiB,CAAA;AAAA,IACpE;AAEA,IAAA,MAAM,iBAAA;AAAA,EACV;AAGA,EAAA,IAAI,SAAS,MAAA,KAAW,GAAA,IAAO,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAA,EACxD;AACI,IAAAA,OAAAA,CAAO,IAAA;AAAA,MACH;AAAA,KAMJ;AAAA,EACJ;AAEA,EAAA,MAAM,IAAI,QAAA;AAAA,IACN,MAAM,OAAA,IAAW,CAAA,KAAA,EAAQ,SAAS,MAAM,CAAA,EAAA,EAAK,SAAS,UAAU,CAAA,CAAA;AAAA,IAChE,QAAA,CAAS,MAAA;AAAA,IACT,OAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACJ;AACJ;;;AC1JO,IAAM,WAAA,GAAc;AAW3B,IAAM,mBAAA,GAAsB,oBAAA;AAW5B,IAAM,iBAAA,GAAoB,UAAA;AAW1B,IAAM,cAAA,GAAiB,EAAA;AAkBvB,SAAS,iBAAiB,MAAA,EAC1B;AAGI,EAAA,MAAM,SAAS,KAAA,CAAM,IAAA,CAAK,IAAI,GAAA,CAAI,MAAM,CAAC,CAAA;AAEzC,EAAA,IAAI,MAAA,CAAO,UAAU,cAAA,EACrB;AACI,IAAA,OAAO,MAAA;AAAA,EACX;AAEA,EAAA,MAAM,OAAO,cAAA,GAAiB,CAAA;AAE9B,EAAA,OAAO,CAAC,GAAG,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,EAAG,GAAG,MAAA,CAAO,KAAA,CAAM,CAAC,IAAI,CAAC,CAAA;AAC5D;AAcO,SAAS,gBAAgB,OAAA,EAChC;AAMI,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,IAAA,CAAK,OAAO,CAAA,CAC5B,MAAA,CAAO,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,KAAM,mBAAA,CAAoB,KAAK,IAAI,CAAA,IACjD,iBAAA,CAAkB,IAAA,CAAK,KAAK,CAAA,IAC5B,CAAC,KAAA,CAAM,SAAS,GAAG,CAAC,CAAA,CAC1B,GAAA,CAAI,CAAC,GAAG,KAAK,MAAM,KAAK,CAAA;AAE7B,EAAA,MAAM,UAAA,GAAa,iBAAiB,MAAM,CAAA;AAE1C,EAAA,OAAO,WAAW,MAAA,GAAS,CAAA,GAAI,UAAA,CAAW,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA;AAC1D;AAOO,SAAS,qBAAA,GAChB;AACI,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA,IAAe,CAAC,SAAS,MAAA,EACjD;AACI,IAAA,OAAO,EAAC;AAAA,EACZ;AAEA,EAAA,MAAM,UAAmC,EAAC;AAE1C,EAAA,KAAA,MAAW,IAAA,IAAQ,QAAA,CAAS,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAC5C;AACI,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAElC,IAAA,IAAI,YAAY,CAAA,EAChB;AACI,MAAA,OAAA,CAAQ,KAAK,CAAC,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,SAAS,CAAA,CAAE,IAAA,EAAK,EAAG,IAAA,CAAK,MAAM,SAAA,GAAY,CAAC,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAAA,IACpF;AAAA,EACJ;AAEA,EAAA,OAAO,OAAA;AACX;;;ACrDO,IAAM,gBAAA,GAAN,MAAM,iBAAA,CAIb;AAAA,EAOI,WAAA,CACqB,UACA,SAAA,EAErB;AAHqB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAEpB;AAAA,EAVO,QAAA;AAAA,EACA,QAAA;AAAA,EACA,aAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA;AAAA;AAAA;AAAA,EAWA,KAAA,GACR;AACI,IAAA,MAAM,UAAU,IAAI,iBAAA;AAAA,MAChB,IAAA,CAAK,QAAA;AAAA,MACL,IAAA,CAAK;AAAA,KACT;AACA,IAAA,OAAA,CAAQ,WAAW,IAAA,CAAK,QAAA;AACxB,IAAA,OAAA,CAAQ,WAAW,IAAA,CAAK,QAAA;AACxB,IAAA,OAAA,CAAQ,gBAAgB,IAAA,CAAK,aAAA;AAC7B,IAAA,OAAA,CAAQ,aAAa,IAAA,CAAK,UAAA;AAC1B,IAAA,OAAA,CAAQ,cAAc,IAAA,CAAK,WAAA;AAE3B,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,OAAA,EACR;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,WAAW,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,GAAG,OAAA,EAAQ;AAElD,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,OAAA,EACR;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,WAAW,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,GAAG,OAAA,EAAQ;AAElD,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,OAAA,EACb;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,gBAAgB,EAAE,GAAG,IAAA,CAAK,aAAA,EAAe,GAAG,OAAA,EAAQ;AAE5D,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,UAAU,WAAA,EACV;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,UAAA,GAAa,WAAA;AAErB,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,WAAW,WAAA,EACX;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,WAAA,GAAc,WAAA;AAEtB,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,KAAK,KAAA,EACL;AACI,IAAA,MAAM,UAAuB,EAAC;AAE9B,IAAA,IAAI,KAAK,QAAA,EACT;AACI,MAAA,OAAA,CAAQ,UAAU,IAAA,CAAK,QAAA;AAAA,IAC3B;AAEA,IAAA,IAAI,KAAK,QAAA,EACT;AACI,MAAA,OAAA,CAAQ,UAAU,IAAA,CAAK,QAAA;AAAA,IAC3B;AAEA,IAAA,IAAI,KAAK,aAAA,EACT;AACI,MAAA,OAAA,CAAQ,eAAe,IAAA,CAAK,aAAA;AAAA,IAChC;AAEA,IAAA,IAAI,KAAK,UAAA,EACT;AACI,MAAA,OAAA,CAAQ,YAAY,IAAA,CAAK,UAAA;AAAA,IAC7B;AAEA,IAAA,IAAI,KAAK,WAAA,EACT;AACI,MAAA,OAAA,CAAQ,aAAa,IAAA,CAAK,WAAA;AAAA,IAC9B;AAEA,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,KAAA,IAAS,IAAI,OAAO,CAAA;AAAA,EAC7C;AACJ,CAAA;;;AC/JA,IAAM,SAAA,GAAYA,MAAAA,CAAO,KAAA,CAAM,uBAAuB,CAAA;AAwB/C,SAAS,SAAA,CACZ,MAAA,GAAoB,EAAC,EAEzB;AACI,EAAA,MAAM;AAAA,IACF,OAAA,GAAU,UAAA;AAAA,IACV,OAAA,EAAS,iBAAiB,EAAC;AAAA,IAC3B,UAAU,GAAA,CAAI,cAAA;AAAA,IACd,OAAO,WAAA,GAAc,KAAA;AAAA,IACrB,SAAA,EAAW,eAAA;AAAA,IACX,UAAA,EAAY,gBAAA;AAAA,IACZ,aAAA,EAAe,mBAAA;AAAA,IACf,KAAA,GAAQ;AAAA,GACZ,GAAI,MAAA;AAGJ,EAAA,MAAMC,eAAA,GAAgB,KAAA,CAAM,OAAA,CAAQ,mBAAmB,CAAA,GACjD,IAAI,aAAA,CAAc,CAACC,aAAA,EAAmB,GAAG,mBAAmB,CAAC,IAC7D,mBAAA,IAAuBA,aAAA;AAE7B,EAAA,IAAI,KAAA,EACJ;AACI,IAAA,SAAA,CAAU,KAAA,CAAM,wBAAA,EAA0B,EAAE,OAAA,EAAS,CAAA;AAAA,EACzD;AAUA,EAAA,eAAe,YACX,SAAA,EACA,KAAA,GAAa,EAAC,EACd,OAAA,GAAuB,EAAC,EAE5B;AACI,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,KAAS,MAAA;AAC/B,IAAA,MAAM,WAAA,GAAc,MAAM,QAAA,KAAa,MAAA,IAAa,OAAO,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA,CAAE,MAAA,GAAS,CAAA;AACzF,IAAA,MAAM,MAAA,GAAU,OAAA,IAAW,WAAA,GAAe,MAAA,GAAS,KAAA;AAGnD,IAAA,IAAI,MAAA,GAAS,IAAI,YAAA,IAAgB,EAAA;AAGjC,IAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,WAAA,EACjC;AACI,MAAA,IACA;AACI,QAAA,MAAM,EAAE,OAAA,EAAAC,QAAAA,EAAQ,GAAI,MAAM,OAAO,cAAc,CAAA;AAC/C,QAAA,MAAM,WAAA,GAAc,MAAMA,QAAAA,EAAQ;AAClC,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,GAAA,CAAI,MAAM,CAAA;AACnC,QAAA,MAAM,QAAA,GAAW,WAAA,CAAY,GAAA,CAAI,mBAAmB,CAAA,IAAK,MAAA;AACzD,QAAA,IAAI,IAAA,EACJ;AACI,UAAA,MAAA,GAAS,CAAA,EAAG,QAAQ,CAAA,GAAA,EAAM,IAAI,CAAA,CAAA;AAC9B,UAAA,IAAI,KAAA,EACJ;AACI,YAAA,SAAA,CAAU,KAAA,CAAM,CAAA,oCAAA,EAAuC,MAAM,CAAA,CAAE,CAAA;AAAA,UACnE;AAAA,QACJ;AAAA,MACJ,CAAA,CAAA,MAEA;AAEI,QAAA,IAAI,KAAA,EACJ;AACI,UAAA,SAAA,CAAU,KAAK,oEAAoE,CAAA;AAAA,QACvF;AAAA,MACJ;AAAA,IACJ;AAGA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI,WAAW,KAAA,EACf;AAEI,MAAA,MAAM,UAAA,GAAa,kBAAA,CAAmB,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAC3D,MAAA,OAAA,GAAU,GAAG,MAAM,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,SAAS,UAAU,UAAU,CAAA,CAAA;AAAA,IAClE,CAAA,MAEA;AAEI,MAAA,OAAA,GAAU,CAAA,EAAG,MAAM,CAAA,EAAG,OAAO,IAAI,SAAS,CAAA,CAAA;AAAA,IAC9C;AAIA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACpC,GAAI,WAAA,GAAc,EAAC,GAAI,EAAE,gBAAgB,kBAAA,EAAmB;AAAA,MAC5D,GAAG,cAAA;AAAA,MACH,GAAG,OAAA,CAAQ;AAAA,KACf;AAGA,IAAA,MAAM,mBAAA,GAAsB,MAAM,uBAAA,EAAwB;AAC1D,IAAA,MAAM,aAAA,GAAgB;AAAA,MAClB,GAAG,mBAAA;AAAA,MACH,GAAI,OAAA,CAAQ,OAAA,IAAW;AAAC,KAC5B;AAGA,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,aAAa,CAAA,CAAE,SAAS,CAAA,EACxC;AACI,MAAA,OAAA,CAAQ,QAAQ,CAAA,GAAI,iBAAA,CAAkB,aAAa,CAAA;AAAA,IACvD;AAWA,IAAA,MAAM,SAAA,GAAY,eAAA;AAAA,MACd,OAAO,MAAA,KAAW,WAAA,GAAc,OAAO,OAAA,CAAQ,aAAa,IAAI,qBAAA;AAAsB,KAC1F;AAEA,IAAA,MAAM,eAAA,GAAkB,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,KAAK,CAAA,IAAA,KAAQ,IAAA,CAAK,WAAA,EAAY,KAAM,WAAW,CAAA;AAE5F,IAAA,IAAI,SAAA,IAAa,CAAC,eAAA,EAClB;AACI,MAAA,OAAA,CAAQ,WAAW,CAAA,GAAI,SAAA;AAAA,IAC3B;AAGA,IAAA,IAAI,SAAS,MAAA,CAAO,IAAA,CAAK,mBAAmB,CAAA,CAAE,SAAS,CAAA,EACvD;AACI,MAAA,MAAM,WAAA,GAAc,MAAA,CAAO,OAAA,CAAQ,mBAAmB,EAAE,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,MAAO,EAAE,IAAA,EAAM,OAAM,CAAE,CAAA;AAChG,MAAU,sBAAA,CAAuB,WAAW,WAAW,CAAA;AAAA,IAC3D;AAGA,IAAA,MAAM,WAAA,GAA2B;AAAA,MAC7B,MAAA;AAAA,MACA,OAAA;AAAA,MACA,GAAG,OAAA,CAAQ;AAAA,KACf;AAGA,IAAA,IAAI,WAAW,MAAA,EACf;AACI,MAAA,IAAI,WAAA,EACJ;AAEI,QAAA,MAAM,QAAA,GAAW,IAAI,QAAA,EAAS;AAG9B,QAAA,MAAM,WAAgC,EAAC;AACvC,QAAA,IAAI,KAAA,CAAM,MAAA,EAAQ,QAAA,CAAS,MAAA,GAAS,KAAA,CAAM,MAAA;AAC1C,QAAA,IAAI,KAAA,CAAM,KAAA,EAAO,QAAA,CAAS,KAAA,GAAQ,KAAA,CAAM,KAAA;AACxC,QAAA,IAAI,KAAA,CAAM,OAAA,EAAS,QAAA,CAAS,OAAA,GAAU,KAAA,CAAM,OAAA;AAC5C,QAAA,IAAI,KAAA,CAAM,OAAA,EAAS,QAAA,CAAS,OAAA,GAAU,KAAA,CAAM,OAAA;AAE5C,QAAA,IAAI,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA,CAAE,SAAS,CAAA,EACnC;AACI,UAAA,QAAA,CAAS,MAAA,CAAO,YAAA,EAAc,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,QAC1D;AAGA,QAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA,EACxD;AACI,UAAA,IAAI,iBAAiB,IAAA,EACrB;AACI,YAAA,QAAA,CAAS,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,UAC9B,CAAA,MAAA,IACS,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAC5B;AAEI,YAAA,KAAA,MAAW,QAAQ,KAAA,EACnB;AACI,cAAA,IAAI,gBAAgB,IAAA,EACpB;AACI,gBAAA,QAAA,CAAS,MAAA,CAAO,KAAK,IAAI,CAAA;AAAA,cAC7B,CAAA,MAEA;AACI,gBAAA,QAAA,CAAS,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,IAAI,CAAC,CAAA;AAAA,cACrC;AAAA,YACJ;AAAA,UACJ,CAAA,MAAA,IACS,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAC1C;AACI,YAAA,QAAA,CAAS,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,UACtC;AAAA,QACJ;AAEA,QAAA,WAAA,CAAY,IAAA,GAAO,QAAA;AAAA,MACvB,CAAA,MAEA;AACI,QAAA,WAAA,CAAY,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AAAA,MAC3C;AAAA,IACJ;AAGA,IAAA,IAAI,IAAA,GAAO,WAAA;AACX,IAAA,IAAI,eAAA,EACJ;AACI,MAAA,IAAA,GAAO,MAAM,eAAA,CAAgB,OAAA,EAAS,IAAI,CAAA;AAAA,IAC9C;AACA,IAAA,IAAI,QAAQ,SAAA,EACZ;AACI,MAAA,IAAA,GAAO,MAAM,OAAA,CAAQ,SAAA,CAAU,OAAA,EAAS,IAAI,CAAA;AAAA,IAChD;AAEA,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,UAAA,CAAW,WAAW,SAAA,EAAW,MAAA,EAAQ,SAAS,CAAC,CAAC,KAAK,IAAI,CAAA;AAAA,IAC3E;AAGA,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI,IAAA;AAEJ,IAAA,IACA;AACI,MAAA,QAAA,GAAW,MAAM,uBAAA,CAAwB,OAAA,EAAS,IAAA,EAAM,SAAS,WAAW,CAAA;AAG5E,MAAA,IAAA,GAAO,MAAM,kBAAkB,QAAQ,CAAA;AAGvC,MAAA,IAAI,gBAAA,EACJ;AACI,QAAA,MAAM,MAAA,GAAS,MAAM,gBAAA,CAAiB,QAAA,EAAU,IAAI,CAAA;AACpD,QAAA,QAAA,GAAW,MAAA,CAAO,QAAA;AAClB,QAAA,IAAA,GAAO,MAAA,CAAO,IAAA;AAAA,MAClB;AACA,MAAA,IAAI,QAAQ,UAAA,EACZ;AACI,QAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,UAAA,CAAW,UAAU,IAAI,CAAA;AACtD,QAAA,QAAA,GAAW,MAAA,CAAO,QAAA;AAClB,QAAA,IAAA,GAAO,MAAA,CAAO,IAAA;AAAA,MAClB;AAEA,MAAA,IAAI,KAAA,EACJ;AACI,QAAU,YAAY,SAAA,EAAW,SAAA,EAAW,SAAS,MAAA,EAAQ,CAAC,CAAC,IAAI,CAAA;AAAA,MACvE;AAAA,IACJ,SACO,KAAA,EACP;AAEI,MAAA,IAAI,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,YAAA,EAC7C;AACI,QAAA,SAAA,CAAU,MAAM,iBAAA,EAAmB;AAAA,UAC/B,KAAA,EAAO,SAAA;AAAA,UACP,MAAA;AAAA,UACA,GAAA,EAAK,OAAA;AAAA,UACL;AAAA,SACH,CAAA;AAED,QAAA,MAAM,IAAI,QAAA;AAAA,UACN,yBAAyB,OAAO,CAAA,EAAA,CAAA;AAAA,UAChC,GAAA;AAAA,UACA,OAAA;AAAA,UACA,MAAA;AAAA,UACA;AAAA,SACJ;AAAA,MACJ;AAGA,MAAA,MAAM,YAAA,GAAe,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,eAAA;AAC9D,MAAA,SAAA,CAAU,MAAM,eAAA,EAAiB;AAAA,QAC7B,KAAA,EAAO,SAAA;AAAA,QACP,MAAA;AAAA,QACA,GAAA,EAAK,OAAA;AAAA,QACL,KAAA,EAAO,YAAA;AAAA,QACP,SAAA,EAAW,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,IAAA,GAAO;AAAA,OACpD,CAAA;AAED,MAAA,MAAM,IAAI,QAAA;AAAA,QACN,YAAA;AAAA,QACA,CAAA;AAAA,QACA,OAAA;AAAA,QACA,MAAA;AAAA,QACA;AAAA,OACJ;AAAA,IACJ;AAGA,IAAA,IAAI,CAAC,SAAS,EAAA,EACd;AACI,MAAA,MAAM,oBAAoB,QAAA,EAAU,IAAA,EAAM,OAAA,EAASF,eAAA,EAAe,OAAO,SAAS,CAAA;AAAA,IACtF;AAEA,IAAA,OAAO,IAAA;AAAA,EACX;AAkBA,EAAA,SAAS,UAAA,CAAW,SAAS,EAAA,EAC7B;AACI,IAAA,OAAO,IAAI,KAAA;AAAA,MACP,EAAC;AAAA,MACD;AAAA,QACI,GAAA,CAAI,SAAS,IAAA,EACb;AACI,UAAA,MAAM,cAAc,MAAA,GAAS,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,GAAK,IAAA;AAGnD,UAAA,OAAO,IAAI,gBAAA;AAAA,YACP,CAAC,KAAA,EAAY,OAAA,KAAyB,WAAA,CAAY,WAAA,EAAa,OAAO,OAAO,CAAA;AAAA,YAC7E;AAAA,WACJ;AAAA,QACJ;AAAA;AACJ,KACJ;AAAA,EACJ;AAEA,EAAA,OAAO,UAAA,EAAW;AACtB","file":"index.js","sourcesContent":["/**\n * Debug logging utilities for API client\n * Separates debug logging logic from main client code for better maintainability\n */\nimport type { Logger } from '@spfn/core/logger';\n\nexport function logCookieAutoDetection(\n    logger: Logger,\n    cookies: Array<{ name: string; value: string }>,\n): void\n{\n    logger.debug('Auto-detected server environment, forwarding cookies', {\n        cookieCount: cookies.length,\n        cookieNames: cookies.map(c => c.name),\n    });\n}\n\nexport function logRequest(\n    logger: Logger,\n    routeName: string,\n    method: string,\n    url: string,\n    hasBody: boolean,\n): void\n{\n    logger.debug('→ Request', {\n        route: routeName,\n        method,\n        url,\n        hasBody,\n    });\n}\n\nexport function logResponse(\n    logger: Logger,\n    routeName: string,\n    status: number,\n    hasBody: boolean,\n): void\n{\n    logger.debug('← Response', {\n        route: routeName,\n        status,\n        hasBody,\n    });\n}\n\nexport function logErrorResponse(\n    logger: Logger,\n    status: number,\n    body: any,\n): void\n{\n    logger.debug('Error response received', {\n        status,\n        hasBody: !!body,\n        bodyType: typeof body,\n        hasTypeField: body && typeof body === 'object' && '__type' in body,\n        typeValue: body?.__type,\n    });\n}\n\nexport function logErrorDeserializationAttempt(\n    logger: Logger,\n    errorType: string,\n    registeredTypes: string[],\n): void\n{\n    logger.debug('Attempting error deserialization', {\n        errorType,\n        hasRegistry: true,\n        registeredTypes,\n    });\n}\n\nexport function logErrorDeserializationSuccess(\n    logger: Logger,\n    error: Error | null,\n): void\n{\n    logger.debug('Error deserialized successfully', {\n        errorName: error?.name,\n        errorConstructor: error?.constructor.name,\n        message: error?.message,\n    });\n}\n\nexport function logErrorDeserializationFailure(\n    logger: Logger,\n    error: unknown,\n): void\n{\n    logger.debug('Deserialization failed', {\n        errorName: error instanceof Error ? error.name : 'unknown',\n        errorMessage: error instanceof Error ? error.message : String(error),\n    });\n}\n\nexport function logErrorDeserializationSkipped(\n    logger: Logger,\n    errorRegistry: any,\n    body: any,\n): void\n{\n    const reason = !errorRegistry\n        ? 'no registry'\n        : !body\n            ? 'no body'\n            : typeof body !== 'object'\n                ? 'body not object'\n                : !('__type' in body)\n                    ? 'no __type field'\n                    : 'unknown';\n\n    logger.debug('Skipping error deserialization', { reason });\n}\n\nexport function logThrowingDeserializedError(\n    logger: Logger,\n    error: Error,\n): void\n{\n    logger.debug('Throwing deserialized error', {\n        errorName: error.name,\n        errorConstructorName: error.constructor.name,\n        prototype: Object.getPrototypeOf(error).constructor.name,\n    });\n}\n","// ============================================================================\n// Client Error\n// ============================================================================\n\n/**\n * Typed client error\n */\nexport class ApiError extends Error\n{\n    constructor(\n        message: string,\n        public readonly status: number,\n        public readonly url: string,\n        public readonly response?: unknown,\n        public readonly errorType?: 'http' | 'network' | 'timeout',\n    )\n    {\n        super(message);\n        this.name = 'ApiError';\n    }\n}\n","/**\n * Shared utilities for Next.js client and proxy modules\n *\n * Contains common functions used by both client and proxy to avoid code duplication.\n */\n\n/**\n * Build URL with path parameters replaced\n *\n * @example\n * buildUrlWithParams('/users/:id/posts/:postId', { id: '123', postId: '456' })\n * // Returns: '/users/123/posts/456'\n */\nexport function buildUrlWithParams(path: string, params: Record<string, any>): string\n{\n    let url = path;\n    for (const [key, value] of Object.entries(params))\n    {\n        url = url.replace(`:${key}`, encodeURIComponent(String(value)));\n    }\n\n    return url;\n}\n\n/**\n * Build query string from object\n *\n * @example\n * buildQueryString({ page: '1', limit: '10', tags: ['foo', 'bar'] })\n * // Returns: '?page=1&limit=10&tags=foo&tags=bar'\n */\nexport function buildQueryString(query: Record<string, any>): string\n{\n    if (Object.keys(query).length === 0)\n    {\n        return '';\n    }\n\n    const searchParams = new URLSearchParams();\n    for (const [key, value] of Object.entries(query))\n    {\n        if (Array.isArray(value))\n        {\n            value.forEach((v) => searchParams.append(key, String(v)));\n        }\n        else\n        {\n            searchParams.append(key, String(value));\n        }\n    }\n\n    return `?${searchParams.toString()}`;\n}\n\n/**\n * Build Cookie header string from cookies object\n *\n * @example\n * buildCookieHeader({ session: 'abc123', theme: 'dark' })\n * // Returns: 'session=abc123; theme=dark'\n */\nexport function buildCookieHeader(cookies: Record<string, string>): string\n{\n    return Object.entries(cookies)\n        .map(([key, value]) => `${key}=${value}`)\n        .join('; ');\n}\n\n/**\n * Parse response body based on content type\n *\n * Handles:\n * - 204 No Content: returns null (no body expected)\n * - application/json: parses JSON body\n * - Other content types: returns raw text\n */\nexport async function parseResponseBody(response: Response): Promise<any>\n{\n    // 204 No Content has no body\n    if (response.status === 204)\n    {\n        return null;\n    }\n\n    const contentType = response.headers.get('content-type');\n\n    if (contentType?.includes('application/json'))\n    {\n        const text = await response.text();\n\n        return text ? JSON.parse(text) : null;\n    }\n    else\n    {\n        return await response.text();\n    }\n}\n","import type { Logger } from '@spfn/core/logger';\nimport type { ErrorRegistry } from '@spfn/core/errors';\nimport { logger } from '@spfn/core/logger';\nimport { ApiError } from './errors';\nimport * as debugLogs from './debug-logs';\n\n// Re-export shared utilities\nexport { buildCookieHeader, parseResponseBody } from '../shared';\n\nconst cookieLogger = logger.child('@spfn/core:auto-cookies');\n\n/**\n * Auto-detect cookies from Next.js server environment\n * Returns empty object if not in server environment or if cookies are not accessible\n */\nexport async function autoDetectServerCookies(): Promise<Record<string, string>>\n{\n    // Client environment — browser sends cookies automatically\n    if (typeof window !== 'undefined')\n    {\n        return {};\n    }\n\n    try\n    {\n        // Next.js cookies() API is only available in server environment\n        const { cookies } = await import('next/headers');\n        const cookieStore = await cookies();\n        const allCookies = cookieStore.getAll();\n\n        const result = Object.fromEntries(\n            allCookies.map(cookie => [cookie.name, cookie.value]),\n        );\n\n        cookieLogger.debug('Server cookies detected', {\n            count: allCookies.length,\n            names: allCookies.map(c => c.name),\n        });\n\n        return result;\n    }\n    catch (error)\n    {\n        // Server environment but cookies() not accessible\n        // (e.g. static generation, build time, or outside request context)\n        const err = error as Error;\n        cookieLogger.warn('Failed to read server cookies', {\n            message: err.message,\n            name: err.name,\n        });\n\n        return {};\n    }\n}\n\n/**\n * Execute fetch with timeout and abort controller\n */\nexport async function executeFetchWithTimeout(\n    url: string,\n    init: RequestInit,\n    timeout: number,\n    customFetch: typeof fetch = fetch,\n): Promise<Response>\n{\n    const controller = new AbortController();\n    const timeoutId = setTimeout(() => controller.abort(), timeout);\n\n    try\n    {\n        const response = await customFetch(url, {\n            ...init,\n            signal: controller.signal,\n        });\n\n        clearTimeout(timeoutId);\n\n        return response;\n    }\n    catch (error)\n    {\n        clearTimeout(timeoutId);\n        throw error;\n    }\n}\n\n/**\n * Handle error response with deserialization support\n * Attempts to deserialize custom errors if errorRegistry is provided\n * Falls back to ApiError if deserialization fails or is not available\n */\nexport async function handleErrorResponse(\n    response: Response,\n    body: any,\n    fullUrl: string,\n    errorRegistry: ErrorRegistry | undefined,\n    debug: boolean,\n    logger: Logger,\n): Promise<never>\n{\n    if (debug)\n    {\n        debugLogs.logErrorResponse(logger, response.status, body);\n    }\n\n    // Try to deserialize error if registry is provided\n    let deserializedError: Error | null = null;\n\n    if (errorRegistry && body && typeof body === 'object' && '__type' in body)\n    {\n        if (debug)\n        {\n            debugLogs.logErrorDeserializationAttempt(logger, body.__type, errorRegistry.getRegisteredTypes());\n        }\n\n        try\n        {\n            deserializedError = errorRegistry.deserialize(body as any);\n\n            if (debug)\n            {\n                debugLogs.logErrorDeserializationSuccess(logger, deserializedError);\n            }\n        }\n        catch (deserializeError)\n        {\n            // Deserialization itself failed (type not found, invalid data, etc.)\n            if (debug)\n            {\n                debugLogs.logErrorDeserializationFailure(logger, deserializeError);\n            }\n            // Fall through to ApiError below\n        }\n    }\n    else if (debug)\n    {\n        debugLogs.logErrorDeserializationSkipped(logger, errorRegistry, body);\n    }\n\n    // If deserialization succeeded, throw the deserialized error\n    if (deserializedError)\n    {\n        if (debug)\n        {\n            debugLogs.logThrowingDeserializedError(logger, deserializedError);\n        }\n\n        throw deserializedError;\n    }\n\n    // Fallback to generic ApiError\n    if (response.status === 404 && process.env.NODE_ENV !== 'production')\n    {\n        logger.warn(\n            '\\n⚠️  404 Not Found\\n\\n' +\n            'Check the following:\\n' +\n            '  1. Routes are registered in server.config.ts:\\n' +\n            '     → defineServerConfig().routes(appRouter)\\n' +\n            '  2. Delete .spfn cache if you recently added new routes:\\n' +\n            '     → rm -rf .spfn\\n',\n        );\n    }\n\n    throw new ApiError(\n        body?.message || `HTTP ${response.status}: ${response.statusText}`,\n        response.status,\n        fullUrl,\n        body,\n        'http',\n    );\n}\n","/**\n * CSRF token transport for the RPC client\n *\n * The Next.js proxy sets a readable (non-HttpOnly) cookie carrying an HMAC of\n * the session's key id; this module mirrors it into a request header. The proxy\n * never compares cookie against header — it recomputes the value from the\n * session — so the cookie is transport only and reading it here is not a trust\n * decision. See the CSRF section of the @spfn/auth README.\n */\n\n/**\n * Header the readable CSRF cookie is mirrored into.\n *\n * Must match CSRF_HEADER in @spfn/auth. It is duplicated rather than imported\n * because @spfn/core cannot depend on @spfn/auth.\n */\nexport const CSRF_HEADER = 'x-spfn-csrf';\n\n/**\n * Cookie names carrying a CSRF token.\n *\n * @spfn/auth suffixes its cookie names with the server port so several local dev\n * instances on the same host do not overwrite each other's session, and the\n * browser cannot know that port — so match the family, not one name. Every\n * candidate is sent and the proxy accepts the request if any of them recomputes\n * to the expected value; a candidate an attacker tossed in never will.\n */\nconst CSRF_COOKIE_PATTERN = /^spfn_csrf(_\\d+)?$/;\n\n/**\n * Values that can be put in a header at all: printable ASCII, no space.\n *\n * A cookie jar is attacker-writable in the very case this feature exists for, and\n * `new Headers()` rejects a value outside Latin-1 — so a sibling subdomain that\n * tosses `spfn_csrf=한` would make every RPC call throw before it was sent, not\n * merely fail the check. A genuine token is 64 hex characters; anything that\n * cannot be a header value cannot be one.\n */\nconst HEADER_SAFE_VALUE = /^[!-~]+$/;\n\n/**\n * Upper bound on candidates sent, so a cookie-flooded jar stays a bounded header.\n *\n * Deliberately generous. The server recomputes the expected value once and then\n * only compares fixed-length strings, so extra candidates cost it almost nothing,\n * while every candidate dropped here is a chance to lock the user out of every\n * mutation — the far worse failure. Must not exceed the matching bound in\n * @spfn/auth's `matchesCsrfToken`, or values sent would never be looked at.\n */\nconst MAX_CANDIDATES = 32;\n\n/**\n * Choose which candidates to send when the jar holds more than the cap.\n *\n * `document.cookie` exposes neither Domain nor Path, so a tossed cookie is\n * indistinguishable from the genuine one here — the proxy is what tells them\n * apart, by recomputing. What this can do is refuse to drop the genuine value on\n * the floor. Browsers order the jar by path length descending, then by age\n * ascending, so a flood pushes the genuine cookie towards the end (attacker\n * cookies on a longer path) or towards the start (attacker cookies written later\n * on the same path). Keeping both ends survives either, where a plain prefix\n * survives only one.\n *\n * A jar flooded far past the cap is a denial of service that no client-side\n * choice fully prevents; the structural fix is a `__Host-` prefixed cookie name,\n * which a sibling subdomain cannot write at all.\n */\nfunction selectCandidates(values: string[]): string[]\n{\n    // Identical duplicates carry no extra information, so collapsing them buys\n    // back slots that a flood of one repeated value would otherwise burn.\n    const unique = Array.from(new Set(values));\n\n    if (unique.length <= MAX_CANDIDATES)\n    {\n        return unique;\n    }\n\n    const half = MAX_CANDIDATES / 2;\n\n    return [...unique.slice(0, half), ...unique.slice(-half)];\n}\n\n/**\n * Collect the CSRF token candidates from cookie entries.\n *\n * Takes entries rather than a map because a name can legitimately appear twice:\n * a sibling subdomain that tosses `spfn_csrf` for the parent domain leaves the\n * browser holding two cookies of that name, and folding them into a map would\n * throw away whichever the tossed one displaced — locking the user out of every\n * mutation. Sending both keeps the real one in play, and the tossed one is inert\n * because the proxy recomputes what it expects.\n *\n * @returns Header value (comma-separated), or undefined when no cookie exists\n */\nexport function csrfHeaderValue(cookies: Iterable<[string, string]>): string | undefined\n{\n    // A comma separates candidates on the wire, so a value containing one would\n    // arrive as several. That cannot be a genuine token — they are hex — but it\n    // would let a single tossed cookie spend the receiver's whole candidate\n    // budget and bury the real value behind it. Drop those, and anything that\n    // could not be a header value at all.\n    const values = Array.from(cookies)\n        .filter(([name, value]) => CSRF_COOKIE_PATTERN.test(name)\n            && HEADER_SAFE_VALUE.test(value)\n            && !value.includes(','))\n        .map(([, value]) => value);\n\n    const candidates = selectCandidates(values);\n\n    return candidates.length > 0 ? candidates.join(',') : undefined;\n}\n\n/**\n * Read the browser cookie jar as entries, duplicates preserved.\n *\n * Empty outside a browser (SSR reads the jar it forwards instead).\n */\nexport function documentCookieEntries(): Array<[string, string]>\n{\n    if (typeof document === 'undefined' || !document.cookie)\n    {\n        return [];\n    }\n\n    const entries: Array<[string, string]> = [];\n\n    for (const pair of document.cookie.split(';'))\n    {\n        const separator = pair.indexOf('=');\n\n        if (separator > 0)\n        {\n            entries.push([pair.slice(0, separator).trim(), pair.slice(separator + 1).trim()]);\n        }\n    }\n\n    return entries;\n}\n","// ============================================================================\n// Route Call Builder (Structured Input API)\n// ============================================================================\n\nimport type { RouteDef, Router } from '@spfn/core/route';\nimport type {\n    CallOptions,\n    ExtractRoutes,\n    InferRouteInput,\n    InferRouteOutput,\n    RequestInterceptor,\n    ResponseInterceptor,\n} from './types';\n\n/**\n * Pick only non-empty fields from StructuredInput\n *\n * This removes fields that are empty objects `{}` from the input type,\n * so users only need to provide fields that are actually defined in the route.\n */\ntype PickNonEmpty<T> = {\n    [K in keyof T as T[K] extends Record<string, never> ? never : K]: T[K];\n};\n\n/**\n * Make fields that can be undefined into optional fields\n *\n * When a field is defined as `Type.Optional(Type.Object({...}))`,\n * the resulting type is `T | undefined`. This utility converts such fields\n * into proper optional fields (`field?: T`) so users don't need to pass them.\n */\ntype MakeOptionalIfUndefinable<T> =\n    // Required fields (undefined is not assignable)\n    { [K in keyof T as undefined extends T[K] ? never : K]: T[K] }\n    // Optional fields (undefined is assignable)\n    & { [K in keyof T as undefined extends T[K] ? K : never]?: Exclude<T[K], undefined> };\n\n/**\n * Clean structured input - only include fields that have actual schema,\n * and make fields optional if they accept undefined\n */\ntype CleanStructuredInput<TInput> = MakeOptionalIfUndefinable<PickNonEmpty<TInput>>;\n\n/**\n * Check if input has any required fields\n *\n * Returns false if all fields are optional (i.e., {} is assignable to the input type)\n */\ntype HasAnyRequiredFields<TInput> = {} extends CleanStructuredInput<TInput> ? false : true;\n\n/**\n * Route call builder with structured input API\n *\n * Input is structured with explicit params, query, body fields\n * that match the server-side route definition.\n *\n * @example\n * ```typescript\n * // GET /users/:id - params only\n * const user = await api.getUser.call({ params: { id: '1' } });\n *\n * // GET /users/:id?include=posts - params + query\n * const user = await api.getUser.call({\n *     params: { id: '1' },\n *     query: { include: 'posts' }\n * });\n *\n * // POST /users - body only\n * const user = await api.createUser.call({\n *     body: { name: 'John', email: 'john@example.com' }\n * });\n *\n * // PUT /users/:id - params + body\n * const user = await api.updateUser.call({\n *     params: { id: '1' },\n *     body: { name: 'Jane' }\n * });\n *\n * // With options (headers, cookies, Next.js caching)\n * const user = await api.getUser\n *     .headers({ 'X-Custom': 'value' })\n *     .fetchOptions({ next: { revalidate: 60 } })\n *     .call({ params: { id: '1' } });\n * ```\n */\nexport class RouteCallBuilder<\n    TInput,\n    TOutput,\n>\n{\n    private _headers?: Record<string, string>;\n    private _cookies?: Record<string, string>;\n    private _fetchOptions?: RequestInit;\n    private _onRequest?: RequestInterceptor;\n    private _onResponse?: ResponseInterceptor;\n\n    constructor(\n        private readonly executor: (input: any, options: CallOptions) => Promise<TOutput>,\n        private readonly routeName: string,\n    ) \n    {}\n\n    /**\n     * Clone builder\n     */\n    private clone(): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = new RouteCallBuilder<TInput, TOutput>(\n            this.executor,\n            this.routeName,\n        );\n        builder._headers = this._headers;\n        builder._cookies = this._cookies;\n        builder._fetchOptions = this._fetchOptions;\n        builder._onRequest = this._onRequest;\n        builder._onResponse = this._onResponse;\n\n        return builder;\n    }\n\n    /**\n     * Set request headers\n     */\n    headers(headers: Record<string, string>): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._headers = { ...this._headers, ...headers };\n\n        return builder;\n    }\n\n    /**\n     * Set cookies\n     */\n    cookies(cookies: Record<string, string>): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._cookies = { ...this._cookies, ...cookies };\n\n        return builder;\n    }\n\n    /**\n     * Set Next.js fetch options\n     */\n    fetchOptions(options: RequestInit & { next?: { revalidate?: number | false; tags?: string[] } }): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._fetchOptions = { ...this._fetchOptions, ...options };\n\n        return builder;\n    }\n\n    /**\n     * Set request interceptor\n     */\n    onRequest(interceptor: RequestInterceptor): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._onRequest = interceptor;\n\n        return builder;\n    }\n\n    /**\n     * Set response interceptor\n     */\n    onResponse(interceptor: ResponseInterceptor): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._onResponse = interceptor;\n\n        return builder;\n    }\n\n    /**\n     * Execute the API call with structured input\n     *\n     * Input structure matches the server-side route definition:\n     * - params: Path parameters (e.g., { id: '123' } for /users/:id)\n     * - query: Query string parameters\n     * - body: Request body (for POST, PUT, PATCH)\n     */\n    call(input?: CleanStructuredInput<TInput>): Promise<TOutput>\n    {\n        const options: CallOptions = {};\n\n        if (this._headers)\n        {\n            options.headers = this._headers;\n        }\n\n        if (this._cookies)\n        {\n            options.cookies = this._cookies;\n        }\n\n        if (this._fetchOptions)\n        {\n            options.fetchOptions = this._fetchOptions;\n        }\n\n        if (this._onRequest)\n        {\n            options.onRequest = this._onRequest;\n        }\n\n        if (this._onResponse)\n        {\n            options.onResponse = this._onResponse;\n        }\n\n        return this.executor(input || {}, options);\n    }\n}\n\n/**\n * Individual route client with structured input API\n */\nexport type RouteClient<TRoute extends RouteDef<any, any>> = {\n    /**\n     * Set request headers\n     */\n    headers(headers: Record<string, string>): RouteClient<TRoute>;\n\n    /**\n     * Set cookies\n     */\n    cookies(cookies: Record<string, string>): RouteClient<TRoute>;\n\n    /**\n     * Set Next.js fetch options\n     */\n    fetchOptions(options: RequestInit & { next?: { revalidate?: number | false; tags?: string[] } }): RouteClient<TRoute>;\n\n    /**\n     * Set request interceptor\n     */\n    onRequest(interceptor: RequestInterceptor): RouteClient<TRoute>;\n\n    /**\n     * Set response interceptor\n     */\n    onResponse(interceptor: ResponseInterceptor): RouteClient<TRoute>;\n\n    /**\n     * Execute the API call with structured input\n     *\n     * @example\n     * ```typescript\n     * // GET /users/:id\n     * api.getUser.call({ params: { id: '123' } });\n     *\n     * // PUT /users/:id\n     * api.updateUser.call({ params: { id: '123' }, body: { name: 'Jane' } });\n     * ```\n     */\n    call: HasAnyRequiredFields<InferRouteInput<TRoute>> extends true\n        ? (input: CleanStructuredInput<InferRouteInput<TRoute>>) => Promise<InferRouteOutput<TRoute>>\n        : (input?: CleanStructuredInput<InferRouteInput<TRoute>>) => Promise<InferRouteOutput<TRoute>>;\n};\n\n/**\n * One property per route in a flattened route record.\n *\n * A slot the flattening could not resolve to a route definition is `never`, as it was\n * before nesting was flattened — a record whose values are neither routes nor routers\n * names nothing callable.\n */\ntype RouteClients<TRoutes> = {\n    [K in keyof TRoutes]: TRoutes[K] extends RouteDef<any, any, any>\n        ? RouteClient<TRoutes[K]>\n        : never;\n};\n\n/**\n * Typed client for entire router\n *\n * One flat namespace, holding the same route names the server registers. A route\n * declared inside a nested `defineRouter` is reached by its own key — `api.getThing`,\n * never `api.group.getThing` — because that is the name `registerRoutes` mounts it\n * under, the name the RPC proxy resolves, and the name `RouterOutput` takes. The group\n * key is not a route and naming it is a compile error.\n *\n * @example\n * ```typescript\n * const appRouter = defineRouter({\n *     getRoot,\n *     users: defineRouter({ getUser }),\n * });\n *\n * const api = createApi<typeof appRouter>();\n *\n * await api.getUser.call({ params: { id: '1' } });   // not api.users.getUser\n * ```\n *\n * A name two branches both declare is left out of the namespace rather than resolved to\n * one of them — the same collision `RouterOutput` refuses. Routes mounted with\n * `.packages()` are deliberately absent: a package publishes its own route map and its\n * own client (`authApi`, `cmsApi`), and that is what calls them.\n */\nexport type Client<TRouter extends Router<any>> = RouteClients<ExtractRoutes<TRouter>>;\n","/**\n * Type-Safe RPC-Style Client with Structured Input API\n *\n * Provides full end-to-end type safety from server routes to client calls.\n * No metadata codegen required - method/path resolution happens at the proxy layer.\n *\n * @example\n * ```typescript\n * // Server\n * export const appRouter = defineRouter({\n *   getUser: route.get('/users/:id')\n *     .input({ params: Type.Object({ id: Type.String() }) })\n *     .handler(async (c) => { ... }),\n *   createUser: route.post('/users')\n *     .input({ body: Type.Object({ name: Type.String() }) })\n *     .handler(async (c) => { ... }),\n * });\n *\n * export type AppRouter = typeof appRouter;\n *\n * // Client - no metadata needed!\n * const api = createApi<AppRouter>();\n *\n * // ✅ GET (no body) - becomes GET /api/rpc/getUser?input={...}\n * const user = await api.getUser.call({ params: { id: '1' } });\n *\n * // ✅ POST (has body) - becomes POST /api/rpc/createUser\n * const newUser = await api.createUser.call({ body: { name: 'John' } });\n *\n * // ✅ With options (headers, cookies, interceptors)\n * const user = await api.getUser\n *   .headers({ 'X-Custom': 'value' })\n *   .cookies({ session: 'xxx' })\n *   .fetchOptions({ next: { revalidate: 60 } })\n *   .call({ params: { id: '1' } });\n * ```\n */\nimport { env } from '@spfn/core/config';\nimport { ErrorRegistry, errorRegistry as coreErrorRegistry } from '@spfn/core/errors';\nimport { logger } from '@spfn/core/logger';\nimport type { Router } from '@spfn/core/route';\nimport * as debugLogs from './debug-logs';\nimport { ApiError } from './errors';\nimport {\n    parseResponseBody,\n    executeFetchWithTimeout,\n    handleErrorResponse,\n    buildCookieHeader,\n    autoDetectServerCookies,\n} from './helpers';\nimport { CSRF_HEADER, csrfHeaderValue, documentCookieEntries } from './csrf';\nimport { RouteCallBuilder } from './builder';\nimport type { ApiConfig, CallOptions } from './types';\nimport type { Client } from './builder';\n\nconst apiLogger = logger.child('@spfn/core:api-client');\n\n// ============================================================================\n// Client Implementation\n// ============================================================================\n\n/**\n * Create type-safe RPC client\n *\n * No metadata required - the client sends routeName + input to the proxy,\n * and the proxy resolves the actual HTTP method and path from the router.\n *\n * @example\n * ```typescript\n * // Client - no metadata needed!\n * const api = createApi<AppRouter>();\n *\n * // GET request (no body) - browser cacheable\n * const user = await api.getUser.call({ params: { id: '1' } });\n *\n * // POST request (has body)\n * const newUser = await api.createUser.call({ body: { name: 'John' } });\n * ```\n */\nexport function createApi<TRouter extends Router<any>>(\n    config: ApiConfig = {},\n): Client<TRouter>\n{\n    const {\n        baseUrl = '/api/rpc',\n        headers: defaultHeaders = {},\n        timeout = env.SERVER_TIMEOUT,\n        fetch: customFetch = fetch,\n        onRequest: globalOnRequest,\n        onResponse: globalOnResponse,\n        errorRegistry: errorRegistryConfig,\n        debug = false,\n    } = config;\n\n    // Normalize errorRegistry: always include coreErrorRegistry\n    const errorRegistry = Array.isArray(errorRegistryConfig)\n        ? new ErrorRegistry([coreErrorRegistry, ...errorRegistryConfig])\n        : errorRegistryConfig ?? coreErrorRegistry;\n\n    if (debug)\n    {\n        apiLogger.debug('API client initialized', { baseUrl });\n    }\n\n    /**\n     * Execute API call\n     *\n     * Determines GET vs POST based on body/formData presence:\n     * - No body/formData → GET /api/rpc/{routeName}?input={...}\n     * - Has body → POST /api/rpc/{routeName} with JSON body\n     * - Has formData → POST /api/rpc/{routeName} with multipart/form-data\n     */\n    async function executeCall(\n        routeName: string,\n        input: any = {},\n        options: CallOptions = {},\n    ): Promise<any>\n    {\n        const hasBody = input.body !== undefined;\n        const hasFormData = input.formData !== undefined && Object.keys(input.formData).length > 0;\n        const method = (hasBody || hasFormData) ? 'POST' : 'GET';\n\n        // Build full URL - handle SSR case where SPFN_APP_URL might not be set\n        let appUrl = env.SPFN_APP_URL || '';\n\n        // In SSR environment, if SPFN_APP_URL is not set, try to get host from request headers\n        if (!appUrl && typeof window === 'undefined')\n        {\n            try\n            {\n                const { headers } = await import('next/headers');\n                const headersList = await headers();\n                const host = headersList.get('host');\n                const protocol = headersList.get('x-forwarded-proto') || 'http';\n                if (host)\n                {\n                    appUrl = `${protocol}://${host}`;\n                    if (debug)\n                    {\n                        apiLogger.debug(`Auto-detected app URL from headers: ${appUrl}`);\n                    }\n                }\n            }\n            catch\n            {\n                // Fallback: use relative URL and let fetch handle it\n                if (debug)\n                {\n                    apiLogger.warn('Could not determine app URL in SSR environment, using relative URL');\n                }\n            }\n        }\n\n        // Build URL based on method\n        let fullUrl: string;\n        if (method === 'GET')\n        {\n            // GET: encode input in query string\n            const inputParam = encodeURIComponent(JSON.stringify(input));\n            fullUrl = `${appUrl}${baseUrl}/${routeName}?input=${inputParam}`;\n        }\n        else\n        {\n            // POST: input goes in body\n            fullUrl = `${appUrl}${baseUrl}/${routeName}`;\n        }\n\n        // Prepare headers\n        // Note: Don't set Content-Type for formData - browser sets it with boundary\n        const headers: Record<string, string> = {\n            ...(hasFormData ? {} : { 'Content-Type': 'application/json' }),\n            ...defaultHeaders,\n            ...options.headers,\n        };\n\n        // Auto-detect server cookies and merge with user-provided cookies\n        const autoDetectedCookies = await autoDetectServerCookies();\n        const cookiesToSend = {\n            ...autoDetectedCookies,\n            ...(options.cookies || {}),\n        };\n\n        // Add Cookie header if we have cookies to send\n        if (Object.keys(cookiesToSend).length > 0)\n        {\n            headers['Cookie'] = buildCookieHeader(cookiesToSend);\n        }\n\n        // Mirror the readable CSRF cookie into a header, from the browser jar or\n        // — server-side — from the jar being forwarded.\n        //\n        // Carried on GET calls too, deliberately: the wire method here is chosen\n        // by whether the input has a body, not by what the route does. A bodyless\n        // mutation (`api.logout.call({})`) travels as GET and the proxy still\n        // forwards it as the route's POST, so a GET-shaped call can be exactly\n        // the request that needs the header. The proxy decides what to check from\n        // the resolved route method, and ignores the header on safe routes.\n        const csrfToken = csrfHeaderValue(\n            typeof window === 'undefined' ? Object.entries(cookiesToSend) : documentCookieEntries(),\n        );\n\n        const csrfSetByCaller = Object.keys(headers).some(name => name.toLowerCase() === CSRF_HEADER);\n\n        if (csrfToken && !csrfSetByCaller)\n        {\n            headers[CSRF_HEADER] = csrfToken;\n        }\n\n        // Log cookie auto-detection if debug enabled\n        if (debug && Object.keys(autoDetectedCookies).length > 0)\n        {\n            const cookieArray = Object.entries(autoDetectedCookies).map(([name, value]) => ({ name, value }));\n            debugLogs.logCookieAutoDetection(apiLogger, cookieArray);\n        }\n\n        // Build request init\n        const requestInit: RequestInit = {\n            method,\n            headers,\n            ...options.fetchOptions,\n        };\n\n        // Add body for POST\n        if (method === 'POST')\n        {\n            if (hasFormData)\n            {\n                // Build FormData for file uploads\n                const formData = new FormData();\n\n                // Add non-formData fields (params, query, headers, cookies) as JSON metadata\n                const metadata: Record<string, any> = {};\n                if (input.params) metadata.params = input.params;\n                if (input.query) metadata.query = input.query;\n                if (input.headers) metadata.headers = input.headers;\n                if (input.cookies) metadata.cookies = input.cookies;\n\n                if (Object.keys(metadata).length > 0)\n                {\n                    formData.append('__metadata', JSON.stringify(metadata));\n                }\n\n                // Add formData fields\n                for (const [key, value] of Object.entries(input.formData))\n                {\n                    if (value instanceof File)\n                    {\n                        formData.append(key, value);\n                    }\n                    else if (Array.isArray(value))\n                    {\n                        // Handle array of files or values\n                        for (const item of value)\n                        {\n                            if (item instanceof File)\n                            {\n                                formData.append(key, item);\n                            }\n                            else\n                            {\n                                formData.append(key, String(item));\n                            }\n                        }\n                    }\n                    else if (value !== undefined && value !== null)\n                    {\n                        formData.append(key, String(value));\n                    }\n                }\n\n                requestInit.body = formData;\n            }\n            else\n            {\n                requestInit.body = JSON.stringify(input);\n            }\n        }\n\n        // Execute request interceptors\n        let init = requestInit;\n        if (globalOnRequest)\n        {\n            init = await globalOnRequest(fullUrl, init);\n        }\n        if (options.onRequest)\n        {\n            init = await options.onRequest(fullUrl, init);\n        }\n\n        if (debug)\n        {\n            debugLogs.logRequest(apiLogger, routeName, method, fullUrl, !!init.body);\n        }\n\n        // Execute fetch with timeout\n        let response: Response;\n        let body: any;\n\n        try\n        {\n            response = await executeFetchWithTimeout(fullUrl, init, timeout, customFetch);\n\n            // Parse response\n            body = await parseResponseBody(response);\n\n            // Execute global + local response interceptors\n            if (globalOnResponse)\n            {\n                const result = await globalOnResponse(response, body);\n                response = result.response;\n                body = result.body;\n            }\n            if (options.onResponse)\n            {\n                const result = await options.onResponse(response, body);\n                response = result.response;\n                body = result.body;\n            }\n\n            if (debug)\n            {\n                debugLogs.logResponse(apiLogger, routeName, response.status, !!body);\n            }\n        }\n        catch (error)\n        {\n            // Handle timeout specifically\n            if (error instanceof Error && error.name === 'AbortError')\n            {\n                apiLogger.error('Request timeout', {\n                    route: routeName,\n                    method,\n                    url: fullUrl,\n                    timeout,\n                });\n\n                throw new ApiError(\n                    `Request timeout after ${timeout}ms`,\n                    408,\n                    fullUrl,\n                    undefined,\n                    'timeout',\n                );\n            }\n\n            // Network error\n            const errorMessage = error instanceof Error ? error.message : 'Network error';\n            apiLogger.error('Network error', {\n                route: routeName,\n                method,\n                url: fullUrl,\n                error: errorMessage,\n                errorName: error instanceof Error ? error.name : 'unknown',\n            });\n\n            throw new ApiError(\n                errorMessage,\n                0,\n                fullUrl,\n                undefined,\n                'network',\n            );\n        }\n\n        // Handle error responses\n        if (!response.ok)\n        {\n            await handleErrorResponse(response, body, fullUrl, errorRegistry, debug, apiLogger);\n        }\n\n        return body;\n    }\n\n    /**\n     * Build client proxy\n     *\n     * Every property access returns a `RouteCallBuilder` for that one property read as a\n     * whole route name, and that name goes on the wire as `/api/rpc/{routeName}`. The\n     * proxy route resolves it against the generated route map, whose names are flat.\n     *\n     * Nesting needs nothing here: `registerRoutes` mounts a route declared inside a\n     * nested `defineRouter` under its own key, so `api.getThing` is the call for a nested\n     * `getThing` exactly as for a top-level one — which is the namespace `Client` types.\n     * There is no dot-notation traversal: a property access never returns another proxy,\n     * so `api.group.getThing` reads a property of a builder and is `undefined`.\n     *\n     * `prefix` is vestigial — nothing passes one, and adding a caller that did would\n     * build a dotted name the route map cannot resolve.\n     */\n    function buildProxy(prefix = ''): any\n    {\n        return new Proxy(\n            {},\n            {\n                get(_target, prop: string)\n                {\n                    const currentPath = prefix ? `${prefix}.${prop}` : prop;\n\n                    // Return RouteCallBuilder that can either be called or chained\n                    return new RouteCallBuilder(\n                        (input: any, options: CallOptions) => executeCall(currentPath, input, options),\n                        currentPath,\n                    );\n                },\n            },\n        );\n    }\n\n    return buildProxy() as Client<TRouter>;\n}\n"]}
+{"version":3,"sources":["../../src/nextjs/client/debug-logs.ts","../../src/nextjs/client/errors.ts","../../src/nextjs/shared.ts","../../src/nextjs/client/helpers.ts","../../src/nextjs/client/csrf.ts","../../src/nextjs/client/builder.ts","../../src/nextjs/client/core.ts"],"names":["logger","errorRegistry","coreErrorRegistry","headers"],"mappings":";;;;;;;AAMO,SAAS,sBAAA,CACZA,SACA,OAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,sDAAA,EAAwD;AAAA,IACjE,aAAa,OAAA,CAAQ,MAAA;AAAA,IACrB,WAAA,EAAa,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,KAAK,EAAE,IAAI;AAAA,GACvC,CAAA;AACL;AAEO,SAAS,UAAA,CACZA,OAAAA,EACA,SAAA,EACA,MAAA,EACA,KACA,OAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,gBAAA,EAAa;AAAA,IACtB,KAAA,EAAO,SAAA;AAAA,IACP,MAAA;AAAA,IACA,GAAA;AAAA,IACA;AAAA,GACH,CAAA;AACL;AAEO,SAAS,WAAA,CACZA,OAAAA,EACA,SAAA,EACA,MAAA,EACA,OAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,iBAAA,EAAc;AAAA,IACvB,KAAA,EAAO,SAAA;AAAA,IACP,MAAA;AAAA,IACA;AAAA,GACH,CAAA;AACL;AAEO,SAAS,gBAAA,CACZA,OAAAA,EACA,MAAA,EACA,IAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,yBAAA,EAA2B;AAAA,IACpC,MAAA;AAAA,IACA,OAAA,EAAS,CAAC,CAAC,IAAA;AAAA,IACX,UAAU,OAAO,IAAA;AAAA,IACjB,YAAA,EAAc,IAAA,IAAQ,OAAO,IAAA,KAAS,YAAY,QAAA,IAAY,IAAA;AAAA,IAC9D,WAAW,IAAA,EAAM;AAAA,GACpB,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,OAAAA,EACA,SAAA,EACA,eAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,kCAAA,EAAoC;AAAA,IAC7C,SAAA;AAAA,IACA,WAAA,EAAa,IAAA;AAAA,IACb;AAAA,GACH,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,SACA,KAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,iCAAA,EAAmC;AAAA,IAC5C,WAAW,KAAA,EAAO,IAAA;AAAA,IAClB,gBAAA,EAAkB,OAAO,WAAA,CAAY,IAAA;AAAA,IACrC,SAAS,KAAA,EAAO;AAAA,GACnB,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,SACA,KAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,wBAAA,EAA0B;AAAA,IACnC,SAAA,EAAW,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,IAAA,GAAO,SAAA;AAAA,IACjD,cAAc,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK;AAAA,GACtE,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,OAAAA,EACA,aAAA,EACA,IAAA,EAEJ;AACI,EAAA,MAAM,MAAA,GAAS,CAAC,aAAA,GACV,aAAA,GACA,CAAC,IAAA,GACG,SAAA,GACA,OAAO,IAAA,KAAS,QAAA,GACZ,iBAAA,GACA,EAAE,QAAA,IAAY,QACV,iBAAA,GACA,SAAA;AAElB,EAAAA,OAAAA,CAAO,KAAA,CAAM,gCAAA,EAAkC,EAAE,QAAQ,CAAA;AAC7D;AAEO,SAAS,4BAAA,CACZA,SACA,KAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,6BAAA,EAA+B;AAAA,IACxC,WAAW,KAAA,CAAM,IAAA;AAAA,IACjB,oBAAA,EAAsB,MAAM,WAAA,CAAY,IAAA;AAAA,IACxC,SAAA,EAAW,MAAA,CAAO,cAAA,CAAe,KAAK,EAAE,WAAA,CAAY;AAAA,GACvD,CAAA;AACL;;;ACxHO,IAAM,QAAA,GAAN,cAAuB,KAAA,CAC9B;AAAA,EACI,WAAA,CACI,OAAA,EACgB,MAAA,EACA,GAAA,EACA,UACA,SAAA,EAEpB;AACI,IAAA,KAAA,CAAM,OAAO,CAAA;AANG,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAIhB,IAAA,IAAA,CAAK,IAAA,GAAO,UAAA;AAAA,EAChB;AACJ;;;ACyCO,SAAS,kBAAkB,OAAA,EAClC;AACI,EAAA,OAAO,OAAO,OAAA,CAAQ,OAAO,CAAA,CACxB,GAAA,CAAI,CAAC,CAAC,GAAA,EAAK,KAAK,CAAA,KAAM,GAAG,GAAG,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,CAAA,CACvC,KAAK,IAAI,CAAA;AAClB;AAUA,eAAsB,kBAAkB,QAAA,EACxC;AAEI,EAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EACxB;AACI,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAEvD,EAAA,IAAI,WAAA,EAAa,QAAA,CAAS,kBAAkB,CAAA,EAC5C;AACI,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,IAAA,OAAO,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,GAAI,IAAA;AAAA,EACrC,CAAA,MAEA;AACI,IAAA,OAAO,MAAM,SAAS,IAAA,EAAK;AAAA,EAC/B;AACJ;;;ACvFA,IAAM,YAAA,GAAe,MAAA,CAAO,KAAA,CAAM,yBAAyB,CAAA;AAM3D,eAAsB,uBAAA,GACtB;AAEI,EAAA,IAAI,OAAO,WAAW,WAAA,EACtB;AACI,IAAA,OAAO,EAAC;AAAA,EACZ;AAEA,EAAA,IACA;AAEI,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,OAAO,cAAc,CAAA;AAC/C,IAAA,MAAM,WAAA,GAAc,MAAM,OAAA,EAAQ;AAClC,IAAA,MAAM,UAAA,GAAa,YAAY,MAAA,EAAO;AAEtC,IAAA,MAAM,SAAS,MAAA,CAAO,WAAA;AAAA,MAClB,UAAA,CAAW,IAAI,CAAA,MAAA,KAAU,CAAC,OAAO,IAAA,EAAM,MAAA,CAAO,KAAK,CAAC;AAAA,KACxD;AAEA,IAAA,YAAA,CAAa,MAAM,yBAAA,EAA2B;AAAA,MAC1C,OAAO,UAAA,CAAW,MAAA;AAAA,MAClB,KAAA,EAAO,UAAA,CAAW,GAAA,CAAI,CAAA,CAAA,KAAK,EAAE,IAAI;AAAA,KACpC,CAAA;AAED,IAAA,OAAO,MAAA;AAAA,EACX,SACO,KAAA,EACP;AAGI,IAAA,MAAM,GAAA,GAAM,KAAA;AACZ,IAAA,YAAA,CAAa,KAAK,+BAAA,EAAiC;AAAA,MAC/C,SAAS,GAAA,CAAI,OAAA;AAAA,MACb,MAAM,GAAA,CAAI;AAAA,KACb,CAAA;AAED,IAAA,OAAO,EAAC;AAAA,EACZ;AACJ;AAKA,eAAsB,uBAAA,CAClB,GAAA,EACA,IAAA,EACA,OAAA,EACA,cAA4B,KAAA,EAEhC;AACI,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,YAAY,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,OAAO,CAAA;AAE9D,EAAA,IACA;AACI,IAAA,MAAM,QAAA,GAAW,MAAM,WAAA,CAAY,GAAA,EAAK;AAAA,MACpC,GAAG,IAAA;AAAA,MACH,QAAQ,UAAA,CAAW;AAAA,KACtB,CAAA;AAED,IAAA,YAAA,CAAa,SAAS,CAAA;AAEtB,IAAA,OAAO,QAAA;AAAA,EACX,SACO,KAAA,EACP;AACI,IAAA,YAAA,CAAa,SAAS,CAAA;AACtB,IAAA,MAAM,KAAA;AAAA,EACV;AACJ;AAOA,eAAsB,oBAClB,QAAA,EACA,IAAA,EACA,OAAA,EACA,aAAA,EACA,OACAA,OAAAA,EAEJ;AACI,EAAA,IAAI,KAAA,EACJ;AACI,IAAU,gBAAA,CAAiBA,OAAAA,EAAQ,QAAA,CAAS,MAAA,EAAQ,IAAI,CAAA;AAAA,EAC5D;AAGA,EAAA,IAAI,iBAAA,GAAkC,IAAA;AAEtC,EAAA,IAAI,iBAAiB,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,IAAY,YAAY,IAAA,EACrE;AACI,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,+BAA+BA,OAAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,aAAA,CAAc,oBAAoB,CAAA;AAAA,IACpG;AAEA,IAAA,IACA;AACI,MAAA,iBAAA,GAAoB,aAAA,CAAc,YAAY,IAAW,CAAA;AAEzD,MAAA,IAAI,KAAA,EACJ;AACI,QAAU,8BAAA,CAA+BA,SAAQ,iBAAiB,CAAA;AAAA,MACtE;AAAA,IACJ,SACO,gBAAA,EACP;AAEI,MAAA,IAAI,KAAA,EACJ;AACI,QAAU,8BAAA,CAA+BA,SAAQ,gBAAgB,CAAA;AAAA,MACrE;AAAA,IAEJ;AAAA,EACJ,WACS,KAAA,EACT;AACI,IAAU,8BAAA,CAA+BA,OAAAA,EAAQ,aAAA,EAAe,IAAI,CAAA;AAAA,EACxE;AAGA,EAAA,IAAI,iBAAA,EACJ;AACI,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,4BAAA,CAA6BA,SAAQ,iBAAiB,CAAA;AAAA,IACpE;AAEA,IAAA,MAAM,iBAAA;AAAA,EACV;AAGA,EAAA,IAAI,SAAS,MAAA,KAAW,GAAA,IAAO,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAA,EACxD;AACI,IAAAA,OAAAA,CAAO,IAAA;AAAA,MACH;AAAA,KAMJ;AAAA,EACJ;AAEA,EAAA,MAAM,IAAI,QAAA;AAAA,IACN,MAAM,OAAA,IAAW,CAAA,KAAA,EAAQ,SAAS,MAAM,CAAA,EAAA,EAAK,SAAS,UAAU,CAAA,CAAA;AAAA,IAChE,QAAA,CAAS,MAAA;AAAA,IACT,OAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACJ;AACJ;;;AC1JO,IAAM,WAAA,GAAc;AAW3B,IAAM,mBAAA,GAAsB,oBAAA;AAW5B,IAAM,iBAAA,GAAoB,UAAA;AAW1B,IAAM,cAAA,GAAiB,EAAA;AAkBvB,SAAS,iBAAiB,MAAA,EAC1B;AAGI,EAAA,MAAM,SAAS,KAAA,CAAM,IAAA,CAAK,IAAI,GAAA,CAAI,MAAM,CAAC,CAAA;AAEzC,EAAA,IAAI,MAAA,CAAO,UAAU,cAAA,EACrB;AACI,IAAA,OAAO,MAAA;AAAA,EACX;AAEA,EAAA,MAAM,OAAO,cAAA,GAAiB,CAAA;AAE9B,EAAA,OAAO,CAAC,GAAG,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,EAAG,GAAG,MAAA,CAAO,KAAA,CAAM,CAAC,IAAI,CAAC,CAAA;AAC5D;AAcO,SAAS,gBAAgB,OAAA,EAChC;AAMI,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,IAAA,CAAK,OAAO,CAAA,CAC5B,MAAA,CAAO,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,KAAM,mBAAA,CAAoB,KAAK,IAAI,CAAA,IACjD,iBAAA,CAAkB,IAAA,CAAK,KAAK,CAAA,IAC5B,CAAC,KAAA,CAAM,SAAS,GAAG,CAAC,CAAA,CAC1B,GAAA,CAAI,CAAC,GAAG,KAAK,MAAM,KAAK,CAAA;AAE7B,EAAA,MAAM,UAAA,GAAa,iBAAiB,MAAM,CAAA;AAE1C,EAAA,OAAO,WAAW,MAAA,GAAS,CAAA,GAAI,UAAA,CAAW,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA;AAC1D;AAOO,SAAS,qBAAA,GAChB;AACI,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA,IAAe,CAAC,SAAS,MAAA,EACjD;AACI,IAAA,OAAO,EAAC;AAAA,EACZ;AAEA,EAAA,MAAM,UAAmC,EAAC;AAE1C,EAAA,KAAA,MAAW,IAAA,IAAQ,QAAA,CAAS,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAC5C;AACI,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAElC,IAAA,IAAI,YAAY,CAAA,EAChB;AACI,MAAA,OAAA,CAAQ,KAAK,CAAC,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,SAAS,CAAA,CAAE,IAAA,EAAK,EAAG,IAAA,CAAK,MAAM,SAAA,GAAY,CAAC,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAAA,IACpF;AAAA,EACJ;AAEA,EAAA,OAAO,OAAA;AACX;;;ACrDO,IAAM,gBAAA,GAAN,MAAM,iBAAA,CAIb;AAAA,EAOI,WAAA,CACqB,UACA,SAAA,EAErB;AAHqB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAEpB;AAAA,EAVO,QAAA;AAAA,EACA,QAAA;AAAA,EACA,aAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA;AAAA;AAAA;AAAA,EAWA,KAAA,GACR;AACI,IAAA,MAAM,UAAU,IAAI,iBAAA;AAAA,MAChB,IAAA,CAAK,QAAA;AAAA,MACL,IAAA,CAAK;AAAA,KACT;AACA,IAAA,OAAA,CAAQ,WAAW,IAAA,CAAK,QAAA;AACxB,IAAA,OAAA,CAAQ,WAAW,IAAA,CAAK,QAAA;AACxB,IAAA,OAAA,CAAQ,gBAAgB,IAAA,CAAK,aAAA;AAC7B,IAAA,OAAA,CAAQ,aAAa,IAAA,CAAK,UAAA;AAC1B,IAAA,OAAA,CAAQ,cAAc,IAAA,CAAK,WAAA;AAE3B,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,OAAA,EACR;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,WAAW,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,GAAG,OAAA,EAAQ;AAElD,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,OAAA,EACR;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,WAAW,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,GAAG,OAAA,EAAQ;AAElD,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,OAAA,EACb;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,gBAAgB,EAAE,GAAG,IAAA,CAAK,aAAA,EAAe,GAAG,OAAA,EAAQ;AAE5D,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,UAAU,WAAA,EACV;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,UAAA,GAAa,WAAA;AAErB,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,WAAW,WAAA,EACX;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,WAAA,GAAc,WAAA;AAEtB,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,KAAK,KAAA,EACL;AACI,IAAA,MAAM,UAAuB,EAAC;AAE9B,IAAA,IAAI,KAAK,QAAA,EACT;AACI,MAAA,OAAA,CAAQ,UAAU,IAAA,CAAK,QAAA;AAAA,IAC3B;AAEA,IAAA,IAAI,KAAK,QAAA,EACT;AACI,MAAA,OAAA,CAAQ,UAAU,IAAA,CAAK,QAAA;AAAA,IAC3B;AAEA,IAAA,IAAI,KAAK,aAAA,EACT;AACI,MAAA,OAAA,CAAQ,eAAe,IAAA,CAAK,aAAA;AAAA,IAChC;AAEA,IAAA,IAAI,KAAK,UAAA,EACT;AACI,MAAA,OAAA,CAAQ,YAAY,IAAA,CAAK,UAAA;AAAA,IAC7B;AAEA,IAAA,IAAI,KAAK,WAAA,EACT;AACI,MAAA,OAAA,CAAQ,aAAa,IAAA,CAAK,WAAA;AAAA,IAC9B;AAEA,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,KAAA,IAAS,IAAI,OAAO,CAAA;AAAA,EAC7C;AACJ,CAAA;;;AC/JA,IAAM,SAAA,GAAYA,MAAAA,CAAO,KAAA,CAAM,uBAAuB,CAAA;AAwB/C,SAAS,SAAA,CACZ,MAAA,GAAoB,EAAC,EAEzB;AACI,EAAA,MAAM;AAAA,IACF,OAAA,GAAU,UAAA;AAAA,IACV,OAAA,EAAS,iBAAiB,EAAC;AAAA,IAC3B,UAAU,GAAA,CAAI,cAAA;AAAA,IACd,OAAO,WAAA,GAAc,KAAA;AAAA,IACrB,SAAA,EAAW,eAAA;AAAA,IACX,UAAA,EAAY,gBAAA;AAAA,IACZ,aAAA,EAAe,mBAAA;AAAA,IACf,KAAA,GAAQ;AAAA,GACZ,GAAI,MAAA;AAGJ,EAAA,MAAMC,eAAA,GAAgB,KAAA,CAAM,OAAA,CAAQ,mBAAmB,CAAA,GACjD,IAAI,aAAA,CAAc,CAACC,aAAA,EAAmB,GAAG,mBAAmB,CAAC,IAC7D,mBAAA,IAAuBA,aAAA;AAE7B,EAAA,IAAI,KAAA,EACJ;AACI,IAAA,SAAA,CAAU,KAAA,CAAM,wBAAA,EAA0B,EAAE,OAAA,EAAS,CAAA;AAAA,EACzD;AAUA,EAAA,eAAe,YACX,SAAA,EACA,KAAA,GAAa,EAAC,EACd,OAAA,GAAuB,EAAC,EAE5B;AACI,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,KAAS,MAAA;AAC/B,IAAA,MAAM,WAAA,GAAc,MAAM,QAAA,KAAa,MAAA,IAAa,OAAO,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA,CAAE,MAAA,GAAS,CAAA;AACzF,IAAA,MAAM,MAAA,GAAU,OAAA,IAAW,WAAA,GAAe,MAAA,GAAS,KAAA;AAGnD,IAAA,IAAI,MAAA,GAAS,IAAI,YAAA,IAAgB,EAAA;AAGjC,IAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,WAAA,EACjC;AACI,MAAA,IACA;AACI,QAAA,MAAM,EAAE,OAAA,EAAAC,QAAAA,EAAQ,GAAI,MAAM,OAAO,cAAc,CAAA;AAC/C,QAAA,MAAM,WAAA,GAAc,MAAMA,QAAAA,EAAQ;AAClC,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,GAAA,CAAI,MAAM,CAAA;AACnC,QAAA,MAAM,QAAA,GAAW,WAAA,CAAY,GAAA,CAAI,mBAAmB,CAAA,IAAK,MAAA;AACzD,QAAA,IAAI,IAAA,EACJ;AACI,UAAA,MAAA,GAAS,CAAA,EAAG,QAAQ,CAAA,GAAA,EAAM,IAAI,CAAA,CAAA;AAC9B,UAAA,IAAI,KAAA,EACJ;AACI,YAAA,SAAA,CAAU,KAAA,CAAM,CAAA,oCAAA,EAAuC,MAAM,CAAA,CAAE,CAAA;AAAA,UACnE;AAAA,QACJ;AAAA,MACJ,CAAA,CAAA,MAEA;AAEI,QAAA,IAAI,KAAA,EACJ;AACI,UAAA,SAAA,CAAU,KAAK,oEAAoE,CAAA;AAAA,QACvF;AAAA,MACJ;AAAA,IACJ;AAGA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI,WAAW,KAAA,EACf;AAEI,MAAA,MAAM,UAAA,GAAa,kBAAA,CAAmB,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAC3D,MAAA,OAAA,GAAU,GAAG,MAAM,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,SAAS,UAAU,UAAU,CAAA,CAAA;AAAA,IAClE,CAAA,MAEA;AAEI,MAAA,OAAA,GAAU,CAAA,EAAG,MAAM,CAAA,EAAG,OAAO,IAAI,SAAS,CAAA,CAAA;AAAA,IAC9C;AAIA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACpC,GAAI,WAAA,GAAc,EAAC,GAAI,EAAE,gBAAgB,kBAAA,EAAmB;AAAA,MAC5D,GAAG,cAAA;AAAA,MACH,GAAG,OAAA,CAAQ;AAAA,KACf;AAGA,IAAA,MAAM,mBAAA,GAAsB,MAAM,uBAAA,EAAwB;AAC1D,IAAA,MAAM,aAAA,GAAgB;AAAA,MAClB,GAAG,mBAAA;AAAA,MACH,GAAI,OAAA,CAAQ,OAAA,IAAW;AAAC,KAC5B;AAGA,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,aAAa,CAAA,CAAE,SAAS,CAAA,EACxC;AACI,MAAA,OAAA,CAAQ,QAAQ,CAAA,GAAI,iBAAA,CAAkB,aAAa,CAAA;AAAA,IACvD;AAWA,IAAA,MAAM,SAAA,GAAY,eAAA;AAAA,MACd,OAAO,MAAA,KAAW,WAAA,GAAc,OAAO,OAAA,CAAQ,aAAa,IAAI,qBAAA;AAAsB,KAC1F;AAEA,IAAA,MAAM,eAAA,GAAkB,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,KAAK,CAAA,IAAA,KAAQ,IAAA,CAAK,WAAA,EAAY,KAAM,WAAW,CAAA;AAE5F,IAAA,IAAI,SAAA,IAAa,CAAC,eAAA,EAClB;AACI,MAAA,OAAA,CAAQ,WAAW,CAAA,GAAI,SAAA;AAAA,IAC3B;AAGA,IAAA,IAAI,SAAS,MAAA,CAAO,IAAA,CAAK,mBAAmB,CAAA,CAAE,SAAS,CAAA,EACvD;AACI,MAAA,MAAM,WAAA,GAAc,MAAA,CAAO,OAAA,CAAQ,mBAAmB,EAAE,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,MAAO,EAAE,IAAA,EAAM,OAAM,CAAE,CAAA;AAChG,MAAU,sBAAA,CAAuB,WAAW,WAAW,CAAA;AAAA,IAC3D;AAGA,IAAA,MAAM,WAAA,GAA2B;AAAA,MAC7B,MAAA;AAAA,MACA,OAAA;AAAA,MACA,GAAG,OAAA,CAAQ;AAAA,KACf;AAGA,IAAA,IAAI,WAAW,MAAA,EACf;AACI,MAAA,IAAI,WAAA,EACJ;AAEI,QAAA,MAAM,QAAA,GAAW,IAAI,QAAA,EAAS;AAG9B,QAAA,MAAM,WAAgC,EAAC;AACvC,QAAA,IAAI,KAAA,CAAM,MAAA,EAAQ,QAAA,CAAS,MAAA,GAAS,KAAA,CAAM,MAAA;AAC1C,QAAA,IAAI,KAAA,CAAM,KAAA,EAAO,QAAA,CAAS,KAAA,GAAQ,KAAA,CAAM,KAAA;AACxC,QAAA,IAAI,KAAA,CAAM,OAAA,EAAS,QAAA,CAAS,OAAA,GAAU,KAAA,CAAM,OAAA;AAC5C,QAAA,IAAI,KAAA,CAAM,OAAA,EAAS,QAAA,CAAS,OAAA,GAAU,KAAA,CAAM,OAAA;AAE5C,QAAA,IAAI,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA,CAAE,SAAS,CAAA,EACnC;AACI,UAAA,QAAA,CAAS,MAAA,CAAO,YAAA,EAAc,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,QAC1D;AAGA,QAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA,EACxD;AACI,UAAA,IAAI,iBAAiB,IAAA,EACrB;AACI,YAAA,QAAA,CAAS,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,UAC9B,CAAA,MAAA,IACS,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAC5B;AAEI,YAAA,KAAA,MAAW,QAAQ,KAAA,EACnB;AACI,cAAA,IAAI,gBAAgB,IAAA,EACpB;AACI,gBAAA,QAAA,CAAS,MAAA,CAAO,KAAK,IAAI,CAAA;AAAA,cAC7B,CAAA,MAEA;AACI,gBAAA,QAAA,CAAS,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,IAAI,CAAC,CAAA;AAAA,cACrC;AAAA,YACJ;AAAA,UACJ,CAAA,MAAA,IACS,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAC1C;AACI,YAAA,QAAA,CAAS,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,UACtC;AAAA,QACJ;AAEA,QAAA,WAAA,CAAY,IAAA,GAAO,QAAA;AAAA,MACvB,CAAA,MAEA;AACI,QAAA,WAAA,CAAY,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AAAA,MAC3C;AAAA,IACJ;AAGA,IAAA,IAAI,IAAA,GAAO,WAAA;AACX,IAAA,IAAI,eAAA,EACJ;AACI,MAAA,IAAA,GAAO,MAAM,eAAA,CAAgB,OAAA,EAAS,IAAI,CAAA;AAAA,IAC9C;AACA,IAAA,IAAI,QAAQ,SAAA,EACZ;AACI,MAAA,IAAA,GAAO,MAAM,OAAA,CAAQ,SAAA,CAAU,OAAA,EAAS,IAAI,CAAA;AAAA,IAChD;AAEA,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,UAAA,CAAW,WAAW,SAAA,EAAW,MAAA,EAAQ,SAAS,CAAC,CAAC,KAAK,IAAI,CAAA;AAAA,IAC3E;AAGA,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI,IAAA;AAEJ,IAAA,IACA;AACI,MAAA,QAAA,GAAW,MAAM,uBAAA,CAAwB,OAAA,EAAS,IAAA,EAAM,SAAS,WAAW,CAAA;AAG5E,MAAA,IAAA,GAAO,MAAM,kBAAkB,QAAQ,CAAA;AAAA,IAC3C,SACO,KAAA,EACP;AAEI,MAAA,IAAI,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,YAAA,EAC7C;AACI,QAAA,SAAA,CAAU,MAAM,iBAAA,EAAmB;AAAA,UAC/B,KAAA,EAAO,SAAA;AAAA,UACP,MAAA;AAAA,UACA,GAAA,EAAK,OAAA;AAAA,UACL;AAAA,SACH,CAAA;AAED,QAAA,MAAM,IAAI,QAAA;AAAA,UACN,yBAAyB,OAAO,CAAA,EAAA,CAAA;AAAA,UAChC,GAAA;AAAA,UACA,OAAA;AAAA,UACA,MAAA;AAAA,UACA;AAAA,SACJ;AAAA,MACJ;AAGA,MAAA,MAAM,YAAA,GAAe,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,eAAA;AAC9D,MAAA,SAAA,CAAU,MAAM,eAAA,EAAiB;AAAA,QAC7B,KAAA,EAAO,SAAA;AAAA,QACP,MAAA;AAAA,QACA,GAAA,EAAK,OAAA;AAAA,QACL,KAAA,EAAO,YAAA;AAAA,QACP,SAAA,EAAW,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,IAAA,GAAO;AAAA,OACpD,CAAA;AAED,MAAA,MAAM,IAAI,QAAA;AAAA,QACN,YAAA;AAAA,QACA,CAAA;AAAA,QACA,OAAA;AAAA,QACA,MAAA;AAAA,QACA;AAAA,OACJ;AAAA,IACJ;AAYA,IAAA,IAAI,gBAAA,EACJ;AACI,MAAA,MAAM,MAAA,GAAS,MAAM,gBAAA,CAAiB,QAAA,EAAU,IAAI,CAAA;AACpD,MAAA,QAAA,GAAW,MAAA,CAAO,QAAA;AAClB,MAAA,IAAA,GAAO,MAAA,CAAO,IAAA;AAAA,IAClB;AACA,IAAA,IAAI,QAAQ,UAAA,EACZ;AACI,MAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,UAAA,CAAW,UAAU,IAAI,CAAA;AACtD,MAAA,QAAA,GAAW,MAAA,CAAO,QAAA;AAClB,MAAA,IAAA,GAAO,MAAA,CAAO,IAAA;AAAA,IAClB;AAEA,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,YAAY,SAAA,EAAW,SAAA,EAAW,SAAS,MAAA,EAAQ,CAAC,CAAC,IAAI,CAAA;AAAA,IACvE;AAGA,IAAA,IAAI,CAAC,SAAS,EAAA,EACd;AACI,MAAA,MAAM,oBAAoB,QAAA,EAAU,IAAA,EAAM,OAAA,EAASF,eAAA,EAAe,OAAO,SAAS,CAAA;AAAA,IACtF;AAEA,IAAA,OAAO,IAAA;AAAA,EACX;AAkBA,EAAA,SAAS,UAAA,CAAW,SAAS,EAAA,EAC7B;AACI,IAAA,OAAO,IAAI,KAAA;AAAA,MACP,EAAC;AAAA,MACD;AAAA,QACI,GAAA,CAAI,SAAS,IAAA,EACb;AACI,UAAA,MAAM,cAAc,MAAA,GAAS,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,GAAK,IAAA;AAGnD,UAAA,OAAO,IAAI,gBAAA;AAAA,YACP,CAAC,KAAA,EAAY,OAAA,KAAyB,WAAA,CAAY,WAAA,EAAa,OAAO,OAAO,CAAA;AAAA,YAC7E;AAAA,WACJ;AAAA,QACJ;AAAA;AACJ,KACJ;AAAA,EACJ;AAEA,EAAA,OAAO,UAAA,EAAW;AACtB","file":"index.js","sourcesContent":["/**\n * Debug logging utilities for API client\n * Separates debug logging logic from main client code for better maintainability\n */\nimport type { Logger } from '@spfn/core/logger';\n\nexport function logCookieAutoDetection(\n    logger: Logger,\n    cookies: Array<{ name: string; value: string }>,\n): void\n{\n    logger.debug('Auto-detected server environment, forwarding cookies', {\n        cookieCount: cookies.length,\n        cookieNames: cookies.map(c => c.name),\n    });\n}\n\nexport function logRequest(\n    logger: Logger,\n    routeName: string,\n    method: string,\n    url: string,\n    hasBody: boolean,\n): void\n{\n    logger.debug('→ Request', {\n        route: routeName,\n        method,\n        url,\n        hasBody,\n    });\n}\n\nexport function logResponse(\n    logger: Logger,\n    routeName: string,\n    status: number,\n    hasBody: boolean,\n): void\n{\n    logger.debug('← Response', {\n        route: routeName,\n        status,\n        hasBody,\n    });\n}\n\nexport function logErrorResponse(\n    logger: Logger,\n    status: number,\n    body: any,\n): void\n{\n    logger.debug('Error response received', {\n        status,\n        hasBody: !!body,\n        bodyType: typeof body,\n        hasTypeField: body && typeof body === 'object' && '__type' in body,\n        typeValue: body?.__type,\n    });\n}\n\nexport function logErrorDeserializationAttempt(\n    logger: Logger,\n    errorType: string,\n    registeredTypes: string[],\n): void\n{\n    logger.debug('Attempting error deserialization', {\n        errorType,\n        hasRegistry: true,\n        registeredTypes,\n    });\n}\n\nexport function logErrorDeserializationSuccess(\n    logger: Logger,\n    error: Error | null,\n): void\n{\n    logger.debug('Error deserialized successfully', {\n        errorName: error?.name,\n        errorConstructor: error?.constructor.name,\n        message: error?.message,\n    });\n}\n\nexport function logErrorDeserializationFailure(\n    logger: Logger,\n    error: unknown,\n): void\n{\n    logger.debug('Deserialization failed', {\n        errorName: error instanceof Error ? error.name : 'unknown',\n        errorMessage: error instanceof Error ? error.message : String(error),\n    });\n}\n\nexport function logErrorDeserializationSkipped(\n    logger: Logger,\n    errorRegistry: any,\n    body: any,\n): void\n{\n    const reason = !errorRegistry\n        ? 'no registry'\n        : !body\n            ? 'no body'\n            : typeof body !== 'object'\n                ? 'body not object'\n                : !('__type' in body)\n                    ? 'no __type field'\n                    : 'unknown';\n\n    logger.debug('Skipping error deserialization', { reason });\n}\n\nexport function logThrowingDeserializedError(\n    logger: Logger,\n    error: Error,\n): void\n{\n    logger.debug('Throwing deserialized error', {\n        errorName: error.name,\n        errorConstructorName: error.constructor.name,\n        prototype: Object.getPrototypeOf(error).constructor.name,\n    });\n}\n","// ============================================================================\n// Client Error\n// ============================================================================\n\n/**\n * Typed client error\n */\nexport class ApiError extends Error\n{\n    constructor(\n        message: string,\n        public readonly status: number,\n        public readonly url: string,\n        public readonly response?: unknown,\n        public readonly errorType?: 'http' | 'network' | 'timeout',\n    )\n    {\n        super(message);\n        this.name = 'ApiError';\n    }\n}\n","/**\n * Shared utilities for Next.js client and proxy modules\n *\n * Contains common functions used by both client and proxy to avoid code duplication.\n */\n\n/**\n * Build URL with path parameters replaced\n *\n * @example\n * buildUrlWithParams('/users/:id/posts/:postId', { id: '123', postId: '456' })\n * // Returns: '/users/123/posts/456'\n */\nexport function buildUrlWithParams(path: string, params: Record<string, any>): string\n{\n    let url = path;\n    for (const [key, value] of Object.entries(params))\n    {\n        url = url.replace(`:${key}`, encodeURIComponent(String(value)));\n    }\n\n    return url;\n}\n\n/**\n * Build query string from object\n *\n * @example\n * buildQueryString({ page: '1', limit: '10', tags: ['foo', 'bar'] })\n * // Returns: '?page=1&limit=10&tags=foo&tags=bar'\n */\nexport function buildQueryString(query: Record<string, any>): string\n{\n    if (Object.keys(query).length === 0)\n    {\n        return '';\n    }\n\n    const searchParams = new URLSearchParams();\n    for (const [key, value] of Object.entries(query))\n    {\n        if (Array.isArray(value))\n        {\n            value.forEach((v) => searchParams.append(key, String(v)));\n        }\n        else\n        {\n            searchParams.append(key, String(value));\n        }\n    }\n\n    return `?${searchParams.toString()}`;\n}\n\n/**\n * Build Cookie header string from cookies object\n *\n * @example\n * buildCookieHeader({ session: 'abc123', theme: 'dark' })\n * // Returns: 'session=abc123; theme=dark'\n */\nexport function buildCookieHeader(cookies: Record<string, string>): string\n{\n    return Object.entries(cookies)\n        .map(([key, value]) => `${key}=${value}`)\n        .join('; ');\n}\n\n/**\n * Parse response body based on content type\n *\n * Handles:\n * - 204 No Content: returns null (no body expected)\n * - application/json: parses JSON body\n * - Other content types: returns raw text\n */\nexport async function parseResponseBody(response: Response): Promise<any>\n{\n    // 204 No Content has no body\n    if (response.status === 204)\n    {\n        return null;\n    }\n\n    const contentType = response.headers.get('content-type');\n\n    if (contentType?.includes('application/json'))\n    {\n        const text = await response.text();\n\n        return text ? JSON.parse(text) : null;\n    }\n    else\n    {\n        return await response.text();\n    }\n}\n","import type { Logger } from '@spfn/core/logger';\nimport type { ErrorRegistry } from '@spfn/core/errors';\nimport { logger } from '@spfn/core/logger';\nimport { ApiError } from './errors';\nimport * as debugLogs from './debug-logs';\n\n// Re-export shared utilities\nexport { buildCookieHeader, parseResponseBody } from '../shared';\n\nconst cookieLogger = logger.child('@spfn/core:auto-cookies');\n\n/**\n * Auto-detect cookies from Next.js server environment\n * Returns empty object if not in server environment or if cookies are not accessible\n */\nexport async function autoDetectServerCookies(): Promise<Record<string, string>>\n{\n    // Client environment — browser sends cookies automatically\n    if (typeof window !== 'undefined')\n    {\n        return {};\n    }\n\n    try\n    {\n        // Next.js cookies() API is only available in server environment\n        const { cookies } = await import('next/headers');\n        const cookieStore = await cookies();\n        const allCookies = cookieStore.getAll();\n\n        const result = Object.fromEntries(\n            allCookies.map(cookie => [cookie.name, cookie.value]),\n        );\n\n        cookieLogger.debug('Server cookies detected', {\n            count: allCookies.length,\n            names: allCookies.map(c => c.name),\n        });\n\n        return result;\n    }\n    catch (error)\n    {\n        // Server environment but cookies() not accessible\n        // (e.g. static generation, build time, or outside request context)\n        const err = error as Error;\n        cookieLogger.warn('Failed to read server cookies', {\n            message: err.message,\n            name: err.name,\n        });\n\n        return {};\n    }\n}\n\n/**\n * Execute fetch with timeout and abort controller\n */\nexport async function executeFetchWithTimeout(\n    url: string,\n    init: RequestInit,\n    timeout: number,\n    customFetch: typeof fetch = fetch,\n): Promise<Response>\n{\n    const controller = new AbortController();\n    const timeoutId = setTimeout(() => controller.abort(), timeout);\n\n    try\n    {\n        const response = await customFetch(url, {\n            ...init,\n            signal: controller.signal,\n        });\n\n        clearTimeout(timeoutId);\n\n        return response;\n    }\n    catch (error)\n    {\n        clearTimeout(timeoutId);\n        throw error;\n    }\n}\n\n/**\n * Handle error response with deserialization support\n * Attempts to deserialize custom errors if errorRegistry is provided\n * Falls back to ApiError if deserialization fails or is not available\n */\nexport async function handleErrorResponse(\n    response: Response,\n    body: any,\n    fullUrl: string,\n    errorRegistry: ErrorRegistry | undefined,\n    debug: boolean,\n    logger: Logger,\n): Promise<never>\n{\n    if (debug)\n    {\n        debugLogs.logErrorResponse(logger, response.status, body);\n    }\n\n    // Try to deserialize error if registry is provided\n    let deserializedError: Error | null = null;\n\n    if (errorRegistry && body && typeof body === 'object' && '__type' in body)\n    {\n        if (debug)\n        {\n            debugLogs.logErrorDeserializationAttempt(logger, body.__type, errorRegistry.getRegisteredTypes());\n        }\n\n        try\n        {\n            deserializedError = errorRegistry.deserialize(body as any);\n\n            if (debug)\n            {\n                debugLogs.logErrorDeserializationSuccess(logger, deserializedError);\n            }\n        }\n        catch (deserializeError)\n        {\n            // Deserialization itself failed (type not found, invalid data, etc.)\n            if (debug)\n            {\n                debugLogs.logErrorDeserializationFailure(logger, deserializeError);\n            }\n            // Fall through to ApiError below\n        }\n    }\n    else if (debug)\n    {\n        debugLogs.logErrorDeserializationSkipped(logger, errorRegistry, body);\n    }\n\n    // If deserialization succeeded, throw the deserialized error\n    if (deserializedError)\n    {\n        if (debug)\n        {\n            debugLogs.logThrowingDeserializedError(logger, deserializedError);\n        }\n\n        throw deserializedError;\n    }\n\n    // Fallback to generic ApiError\n    if (response.status === 404 && process.env.NODE_ENV !== 'production')\n    {\n        logger.warn(\n            '\\n⚠️  404 Not Found\\n\\n' +\n            'Check the following:\\n' +\n            '  1. Routes are registered in server.config.ts:\\n' +\n            '     → defineServerConfig().routes(appRouter)\\n' +\n            '  2. Delete .spfn cache if you recently added new routes:\\n' +\n            '     → rm -rf .spfn\\n',\n        );\n    }\n\n    throw new ApiError(\n        body?.message || `HTTP ${response.status}: ${response.statusText}`,\n        response.status,\n        fullUrl,\n        body,\n        'http',\n    );\n}\n","/**\n * CSRF token transport for the RPC client\n *\n * The Next.js proxy sets a readable (non-HttpOnly) cookie carrying an HMAC of\n * the session's key id; this module mirrors it into a request header. The proxy\n * never compares cookie against header — it recomputes the value from the\n * session — so the cookie is transport only and reading it here is not a trust\n * decision. See the CSRF section of the @spfn/auth README.\n */\n\n/**\n * Header the readable CSRF cookie is mirrored into.\n *\n * Must match CSRF_HEADER in @spfn/auth. It is duplicated rather than imported\n * because @spfn/core cannot depend on @spfn/auth.\n */\nexport const CSRF_HEADER = 'x-spfn-csrf';\n\n/**\n * Cookie names carrying a CSRF token.\n *\n * @spfn/auth suffixes its cookie names with the server port so several local dev\n * instances on the same host do not overwrite each other's session, and the\n * browser cannot know that port — so match the family, not one name. Every\n * candidate is sent and the proxy accepts the request if any of them recomputes\n * to the expected value; a candidate an attacker tossed in never will.\n */\nconst CSRF_COOKIE_PATTERN = /^spfn_csrf(_\\d+)?$/;\n\n/**\n * Values that can be put in a header at all: printable ASCII, no space.\n *\n * A cookie jar is attacker-writable in the very case this feature exists for, and\n * `new Headers()` rejects a value outside Latin-1 — so a sibling subdomain that\n * tosses `spfn_csrf=한` would make every RPC call throw before it was sent, not\n * merely fail the check. A genuine token is 64 hex characters; anything that\n * cannot be a header value cannot be one.\n */\nconst HEADER_SAFE_VALUE = /^[!-~]+$/;\n\n/**\n * Upper bound on candidates sent, so a cookie-flooded jar stays a bounded header.\n *\n * Deliberately generous. The server recomputes the expected value once and then\n * only compares fixed-length strings, so extra candidates cost it almost nothing,\n * while every candidate dropped here is a chance to lock the user out of every\n * mutation — the far worse failure. Must not exceed the matching bound in\n * @spfn/auth's `matchesCsrfToken`, or values sent would never be looked at.\n */\nconst MAX_CANDIDATES = 32;\n\n/**\n * Choose which candidates to send when the jar holds more than the cap.\n *\n * `document.cookie` exposes neither Domain nor Path, so a tossed cookie is\n * indistinguishable from the genuine one here — the proxy is what tells them\n * apart, by recomputing. What this can do is refuse to drop the genuine value on\n * the floor. Browsers order the jar by path length descending, then by age\n * ascending, so a flood pushes the genuine cookie towards the end (attacker\n * cookies on a longer path) or towards the start (attacker cookies written later\n * on the same path). Keeping both ends survives either, where a plain prefix\n * survives only one.\n *\n * A jar flooded far past the cap is a denial of service that no client-side\n * choice fully prevents; the structural fix is a `__Host-` prefixed cookie name,\n * which a sibling subdomain cannot write at all.\n */\nfunction selectCandidates(values: string[]): string[]\n{\n    // Identical duplicates carry no extra information, so collapsing them buys\n    // back slots that a flood of one repeated value would otherwise burn.\n    const unique = Array.from(new Set(values));\n\n    if (unique.length <= MAX_CANDIDATES)\n    {\n        return unique;\n    }\n\n    const half = MAX_CANDIDATES / 2;\n\n    return [...unique.slice(0, half), ...unique.slice(-half)];\n}\n\n/**\n * Collect the CSRF token candidates from cookie entries.\n *\n * Takes entries rather than a map because a name can legitimately appear twice:\n * a sibling subdomain that tosses `spfn_csrf` for the parent domain leaves the\n * browser holding two cookies of that name, and folding them into a map would\n * throw away whichever the tossed one displaced — locking the user out of every\n * mutation. Sending both keeps the real one in play, and the tossed one is inert\n * because the proxy recomputes what it expects.\n *\n * @returns Header value (comma-separated), or undefined when no cookie exists\n */\nexport function csrfHeaderValue(cookies: Iterable<[string, string]>): string | undefined\n{\n    // A comma separates candidates on the wire, so a value containing one would\n    // arrive as several. That cannot be a genuine token — they are hex — but it\n    // would let a single tossed cookie spend the receiver's whole candidate\n    // budget and bury the real value behind it. Drop those, and anything that\n    // could not be a header value at all.\n    const values = Array.from(cookies)\n        .filter(([name, value]) => CSRF_COOKIE_PATTERN.test(name)\n            && HEADER_SAFE_VALUE.test(value)\n            && !value.includes(','))\n        .map(([, value]) => value);\n\n    const candidates = selectCandidates(values);\n\n    return candidates.length > 0 ? candidates.join(',') : undefined;\n}\n\n/**\n * Read the browser cookie jar as entries, duplicates preserved.\n *\n * Empty outside a browser (SSR reads the jar it forwards instead).\n */\nexport function documentCookieEntries(): Array<[string, string]>\n{\n    if (typeof document === 'undefined' || !document.cookie)\n    {\n        return [];\n    }\n\n    const entries: Array<[string, string]> = [];\n\n    for (const pair of document.cookie.split(';'))\n    {\n        const separator = pair.indexOf('=');\n\n        if (separator > 0)\n        {\n            entries.push([pair.slice(0, separator).trim(), pair.slice(separator + 1).trim()]);\n        }\n    }\n\n    return entries;\n}\n","// ============================================================================\n// Route Call Builder (Structured Input API)\n// ============================================================================\n\nimport type { RouteDef, Router } from '@spfn/core/route';\nimport type {\n    CallOptions,\n    ExtractRoutes,\n    InferRouteInput,\n    InferRouteOutput,\n    RequestInterceptor,\n    ResponseInterceptor,\n} from './types';\n\n/**\n * Pick only non-empty fields from StructuredInput\n *\n * This removes fields that are empty objects `{}` from the input type,\n * so users only need to provide fields that are actually defined in the route.\n */\ntype PickNonEmpty<T> = {\n    [K in keyof T as T[K] extends Record<string, never> ? never : K]: T[K];\n};\n\n/**\n * Make fields that can be undefined into optional fields\n *\n * When a field is defined as `Type.Optional(Type.Object({...}))`,\n * the resulting type is `T | undefined`. This utility converts such fields\n * into proper optional fields (`field?: T`) so users don't need to pass them.\n */\ntype MakeOptionalIfUndefinable<T> =\n    // Required fields (undefined is not assignable)\n    { [K in keyof T as undefined extends T[K] ? never : K]: T[K] }\n    // Optional fields (undefined is assignable)\n    & { [K in keyof T as undefined extends T[K] ? K : never]?: Exclude<T[K], undefined> };\n\n/**\n * Clean structured input - only include fields that have actual schema,\n * and make fields optional if they accept undefined\n */\ntype CleanStructuredInput<TInput> = MakeOptionalIfUndefinable<PickNonEmpty<TInput>>;\n\n/**\n * Check if input has any required fields\n *\n * Returns false if all fields are optional (i.e., {} is assignable to the input type)\n */\ntype HasAnyRequiredFields<TInput> = {} extends CleanStructuredInput<TInput> ? false : true;\n\n/**\n * Route call builder with structured input API\n *\n * Input is structured with explicit params, query, body fields\n * that match the server-side route definition.\n *\n * @example\n * ```typescript\n * // GET /users/:id - params only\n * const user = await api.getUser.call({ params: { id: '1' } });\n *\n * // GET /users/:id?include=posts - params + query\n * const user = await api.getUser.call({\n *     params: { id: '1' },\n *     query: { include: 'posts' }\n * });\n *\n * // POST /users - body only\n * const user = await api.createUser.call({\n *     body: { name: 'John', email: 'john@example.com' }\n * });\n *\n * // PUT /users/:id - params + body\n * const user = await api.updateUser.call({\n *     params: { id: '1' },\n *     body: { name: 'Jane' }\n * });\n *\n * // With options (headers, cookies, Next.js caching)\n * const user = await api.getUser\n *     .headers({ 'X-Custom': 'value' })\n *     .fetchOptions({ next: { revalidate: 60 } })\n *     .call({ params: { id: '1' } });\n * ```\n */\nexport class RouteCallBuilder<\n    TInput,\n    TOutput,\n>\n{\n    private _headers?: Record<string, string>;\n    private _cookies?: Record<string, string>;\n    private _fetchOptions?: RequestInit;\n    private _onRequest?: RequestInterceptor;\n    private _onResponse?: ResponseInterceptor;\n\n    constructor(\n        private readonly executor: (input: any, options: CallOptions) => Promise<TOutput>,\n        private readonly routeName: string,\n    ) \n    {}\n\n    /**\n     * Clone builder\n     */\n    private clone(): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = new RouteCallBuilder<TInput, TOutput>(\n            this.executor,\n            this.routeName,\n        );\n        builder._headers = this._headers;\n        builder._cookies = this._cookies;\n        builder._fetchOptions = this._fetchOptions;\n        builder._onRequest = this._onRequest;\n        builder._onResponse = this._onResponse;\n\n        return builder;\n    }\n\n    /**\n     * Set request headers\n     */\n    headers(headers: Record<string, string>): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._headers = { ...this._headers, ...headers };\n\n        return builder;\n    }\n\n    /**\n     * Set cookies\n     */\n    cookies(cookies: Record<string, string>): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._cookies = { ...this._cookies, ...cookies };\n\n        return builder;\n    }\n\n    /**\n     * Set Next.js fetch options\n     */\n    fetchOptions(options: RequestInit & { next?: { revalidate?: number | false; tags?: string[] } }): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._fetchOptions = { ...this._fetchOptions, ...options };\n\n        return builder;\n    }\n\n    /**\n     * Set request interceptor\n     */\n    onRequest(interceptor: RequestInterceptor): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._onRequest = interceptor;\n\n        return builder;\n    }\n\n    /**\n     * Set response interceptor\n     */\n    onResponse(interceptor: ResponseInterceptor): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._onResponse = interceptor;\n\n        return builder;\n    }\n\n    /**\n     * Execute the API call with structured input\n     *\n     * Input structure matches the server-side route definition:\n     * - params: Path parameters (e.g., { id: '123' } for /users/:id)\n     * - query: Query string parameters\n     * - body: Request body (for POST, PUT, PATCH)\n     */\n    call(input?: CleanStructuredInput<TInput>): Promise<TOutput>\n    {\n        const options: CallOptions = {};\n\n        if (this._headers)\n        {\n            options.headers = this._headers;\n        }\n\n        if (this._cookies)\n        {\n            options.cookies = this._cookies;\n        }\n\n        if (this._fetchOptions)\n        {\n            options.fetchOptions = this._fetchOptions;\n        }\n\n        if (this._onRequest)\n        {\n            options.onRequest = this._onRequest;\n        }\n\n        if (this._onResponse)\n        {\n            options.onResponse = this._onResponse;\n        }\n\n        return this.executor(input || {}, options);\n    }\n}\n\n/**\n * Individual route client with structured input API\n */\nexport type RouteClient<TRoute extends RouteDef<any, any>> = {\n    /**\n     * Set request headers\n     */\n    headers(headers: Record<string, string>): RouteClient<TRoute>;\n\n    /**\n     * Set cookies\n     */\n    cookies(cookies: Record<string, string>): RouteClient<TRoute>;\n\n    /**\n     * Set Next.js fetch options\n     */\n    fetchOptions(options: RequestInit & { next?: { revalidate?: number | false; tags?: string[] } }): RouteClient<TRoute>;\n\n    /**\n     * Set request interceptor\n     */\n    onRequest(interceptor: RequestInterceptor): RouteClient<TRoute>;\n\n    /**\n     * Set response interceptor\n     */\n    onResponse(interceptor: ResponseInterceptor): RouteClient<TRoute>;\n\n    /**\n     * Execute the API call with structured input\n     *\n     * @example\n     * ```typescript\n     * // GET /users/:id\n     * api.getUser.call({ params: { id: '123' } });\n     *\n     * // PUT /users/:id\n     * api.updateUser.call({ params: { id: '123' }, body: { name: 'Jane' } });\n     * ```\n     */\n    call: HasAnyRequiredFields<InferRouteInput<TRoute>> extends true\n        ? (input: CleanStructuredInput<InferRouteInput<TRoute>>) => Promise<InferRouteOutput<TRoute>>\n        : (input?: CleanStructuredInput<InferRouteInput<TRoute>>) => Promise<InferRouteOutput<TRoute>>;\n};\n\n/**\n * One property per route in a flattened route record.\n *\n * A slot the flattening could not resolve to a route definition is `never`, as it was\n * before nesting was flattened — a record whose values are neither routes nor routers\n * names nothing callable.\n */\ntype RouteClients<TRoutes> = {\n    [K in keyof TRoutes]: TRoutes[K] extends RouteDef<any, any, any>\n        ? RouteClient<TRoutes[K]>\n        : never;\n};\n\n/**\n * Typed client for entire router\n *\n * One flat namespace, holding the same route names the server registers. A route\n * declared inside a nested `defineRouter` is reached by its own key — `api.getThing`,\n * never `api.group.getThing` — because that is the name `registerRoutes` mounts it\n * under, the name the RPC proxy resolves, and the name `RouterOutput` takes. The group\n * key is not a route and naming it is a compile error.\n *\n * @example\n * ```typescript\n * const appRouter = defineRouter({\n *     getRoot,\n *     users: defineRouter({ getUser }),\n * });\n *\n * const api = createApi<typeof appRouter>();\n *\n * await api.getUser.call({ params: { id: '1' } });   // not api.users.getUser\n * ```\n *\n * A name two branches both declare is left out of the namespace rather than resolved to\n * one of them — the same collision `RouterOutput` refuses. Routes mounted with\n * `.packages()` are deliberately absent: a package publishes its own route map and its\n * own client (`authApi`, `cmsApi`), and that is what calls them.\n */\nexport type Client<TRouter extends Router<any>> = RouteClients<ExtractRoutes<TRouter>>;\n","/**\n * Type-Safe RPC-Style Client with Structured Input API\n *\n * Provides full end-to-end type safety from server routes to client calls.\n * No metadata codegen required - method/path resolution happens at the proxy layer.\n *\n * @example\n * ```typescript\n * // Server\n * export const appRouter = defineRouter({\n *   getUser: route.get('/users/:id')\n *     .input({ params: Type.Object({ id: Type.String() }) })\n *     .handler(async (c) => { ... }),\n *   createUser: route.post('/users')\n *     .input({ body: Type.Object({ name: Type.String() }) })\n *     .handler(async (c) => { ... }),\n * });\n *\n * export type AppRouter = typeof appRouter;\n *\n * // Client - no metadata needed!\n * const api = createApi<AppRouter>();\n *\n * // ✅ GET (no body) - becomes GET /api/rpc/getUser?input={...}\n * const user = await api.getUser.call({ params: { id: '1' } });\n *\n * // ✅ POST (has body) - becomes POST /api/rpc/createUser\n * const newUser = await api.createUser.call({ body: { name: 'John' } });\n *\n * // ✅ With options (headers, cookies, interceptors)\n * const user = await api.getUser\n *   .headers({ 'X-Custom': 'value' })\n *   .cookies({ session: 'xxx' })\n *   .fetchOptions({ next: { revalidate: 60 } })\n *   .call({ params: { id: '1' } });\n * ```\n */\nimport { env } from '@spfn/core/config';\nimport { ErrorRegistry, errorRegistry as coreErrorRegistry } from '@spfn/core/errors';\nimport { logger } from '@spfn/core/logger';\nimport type { Router } from '@spfn/core/route';\nimport * as debugLogs from './debug-logs';\nimport { ApiError } from './errors';\nimport {\n    parseResponseBody,\n    executeFetchWithTimeout,\n    handleErrorResponse,\n    buildCookieHeader,\n    autoDetectServerCookies,\n} from './helpers';\nimport { CSRF_HEADER, csrfHeaderValue, documentCookieEntries } from './csrf';\nimport { RouteCallBuilder } from './builder';\nimport type { ApiConfig, CallOptions } from './types';\nimport type { Client } from './builder';\n\nconst apiLogger = logger.child('@spfn/core:api-client');\n\n// ============================================================================\n// Client Implementation\n// ============================================================================\n\n/**\n * Create type-safe RPC client\n *\n * No metadata required - the client sends routeName + input to the proxy,\n * and the proxy resolves the actual HTTP method and path from the router.\n *\n * @example\n * ```typescript\n * // Client - no metadata needed!\n * const api = createApi<AppRouter>();\n *\n * // GET request (no body) - browser cacheable\n * const user = await api.getUser.call({ params: { id: '1' } });\n *\n * // POST request (has body)\n * const newUser = await api.createUser.call({ body: { name: 'John' } });\n * ```\n */\nexport function createApi<TRouter extends Router<any>>(\n    config: ApiConfig = {},\n): Client<TRouter>\n{\n    const {\n        baseUrl = '/api/rpc',\n        headers: defaultHeaders = {},\n        timeout = env.SERVER_TIMEOUT,\n        fetch: customFetch = fetch,\n        onRequest: globalOnRequest,\n        onResponse: globalOnResponse,\n        errorRegistry: errorRegistryConfig,\n        debug = false,\n    } = config;\n\n    // Normalize errorRegistry: always include coreErrorRegistry\n    const errorRegistry = Array.isArray(errorRegistryConfig)\n        ? new ErrorRegistry([coreErrorRegistry, ...errorRegistryConfig])\n        : errorRegistryConfig ?? coreErrorRegistry;\n\n    if (debug)\n    {\n        apiLogger.debug('API client initialized', { baseUrl });\n    }\n\n    /**\n     * Execute API call\n     *\n     * Determines GET vs POST based on body/formData presence:\n     * - No body/formData → GET /api/rpc/{routeName}?input={...}\n     * - Has body → POST /api/rpc/{routeName} with JSON body\n     * - Has formData → POST /api/rpc/{routeName} with multipart/form-data\n     */\n    async function executeCall(\n        routeName: string,\n        input: any = {},\n        options: CallOptions = {},\n    ): Promise<any>\n    {\n        const hasBody = input.body !== undefined;\n        const hasFormData = input.formData !== undefined && Object.keys(input.formData).length > 0;\n        const method = (hasBody || hasFormData) ? 'POST' : 'GET';\n\n        // Build full URL - handle SSR case where SPFN_APP_URL might not be set\n        let appUrl = env.SPFN_APP_URL || '';\n\n        // In SSR environment, if SPFN_APP_URL is not set, try to get host from request headers\n        if (!appUrl && typeof window === 'undefined')\n        {\n            try\n            {\n                const { headers } = await import('next/headers');\n                const headersList = await headers();\n                const host = headersList.get('host');\n                const protocol = headersList.get('x-forwarded-proto') || 'http';\n                if (host)\n                {\n                    appUrl = `${protocol}://${host}`;\n                    if (debug)\n                    {\n                        apiLogger.debug(`Auto-detected app URL from headers: ${appUrl}`);\n                    }\n                }\n            }\n            catch\n            {\n                // Fallback: use relative URL and let fetch handle it\n                if (debug)\n                {\n                    apiLogger.warn('Could not determine app URL in SSR environment, using relative URL');\n                }\n            }\n        }\n\n        // Build URL based on method\n        let fullUrl: string;\n        if (method === 'GET')\n        {\n            // GET: encode input in query string\n            const inputParam = encodeURIComponent(JSON.stringify(input));\n            fullUrl = `${appUrl}${baseUrl}/${routeName}?input=${inputParam}`;\n        }\n        else\n        {\n            // POST: input goes in body\n            fullUrl = `${appUrl}${baseUrl}/${routeName}`;\n        }\n\n        // Prepare headers\n        // Note: Don't set Content-Type for formData - browser sets it with boundary\n        const headers: Record<string, string> = {\n            ...(hasFormData ? {} : { 'Content-Type': 'application/json' }),\n            ...defaultHeaders,\n            ...options.headers,\n        };\n\n        // Auto-detect server cookies and merge with user-provided cookies\n        const autoDetectedCookies = await autoDetectServerCookies();\n        const cookiesToSend = {\n            ...autoDetectedCookies,\n            ...(options.cookies || {}),\n        };\n\n        // Add Cookie header if we have cookies to send\n        if (Object.keys(cookiesToSend).length > 0)\n        {\n            headers['Cookie'] = buildCookieHeader(cookiesToSend);\n        }\n\n        // Mirror the readable CSRF cookie into a header, from the browser jar or\n        // — server-side — from the jar being forwarded.\n        //\n        // Carried on GET calls too, deliberately: the wire method here is chosen\n        // by whether the input has a body, not by what the route does. A bodyless\n        // mutation (`api.logout.call({})`) travels as GET and the proxy still\n        // forwards it as the route's POST, so a GET-shaped call can be exactly\n        // the request that needs the header. The proxy decides what to check from\n        // the resolved route method, and ignores the header on safe routes.\n        const csrfToken = csrfHeaderValue(\n            typeof window === 'undefined' ? Object.entries(cookiesToSend) : documentCookieEntries(),\n        );\n\n        const csrfSetByCaller = Object.keys(headers).some(name => name.toLowerCase() === CSRF_HEADER);\n\n        if (csrfToken && !csrfSetByCaller)\n        {\n            headers[CSRF_HEADER] = csrfToken;\n        }\n\n        // Log cookie auto-detection if debug enabled\n        if (debug && Object.keys(autoDetectedCookies).length > 0)\n        {\n            const cookieArray = Object.entries(autoDetectedCookies).map(([name, value]) => ({ name, value }));\n            debugLogs.logCookieAutoDetection(apiLogger, cookieArray);\n        }\n\n        // Build request init\n        const requestInit: RequestInit = {\n            method,\n            headers,\n            ...options.fetchOptions,\n        };\n\n        // Add body for POST\n        if (method === 'POST')\n        {\n            if (hasFormData)\n            {\n                // Build FormData for file uploads\n                const formData = new FormData();\n\n                // Add non-formData fields (params, query, headers, cookies) as JSON metadata\n                const metadata: Record<string, any> = {};\n                if (input.params) metadata.params = input.params;\n                if (input.query) metadata.query = input.query;\n                if (input.headers) metadata.headers = input.headers;\n                if (input.cookies) metadata.cookies = input.cookies;\n\n                if (Object.keys(metadata).length > 0)\n                {\n                    formData.append('__metadata', JSON.stringify(metadata));\n                }\n\n                // Add formData fields\n                for (const [key, value] of Object.entries(input.formData))\n                {\n                    if (value instanceof File)\n                    {\n                        formData.append(key, value);\n                    }\n                    else if (Array.isArray(value))\n                    {\n                        // Handle array of files or values\n                        for (const item of value)\n                        {\n                            if (item instanceof File)\n                            {\n                                formData.append(key, item);\n                            }\n                            else\n                            {\n                                formData.append(key, String(item));\n                            }\n                        }\n                    }\n                    else if (value !== undefined && value !== null)\n                    {\n                        formData.append(key, String(value));\n                    }\n                }\n\n                requestInit.body = formData;\n            }\n            else\n            {\n                requestInit.body = JSON.stringify(input);\n            }\n        }\n\n        // Execute request interceptors\n        let init = requestInit;\n        if (globalOnRequest)\n        {\n            init = await globalOnRequest(fullUrl, init);\n        }\n        if (options.onRequest)\n        {\n            init = await options.onRequest(fullUrl, init);\n        }\n\n        if (debug)\n        {\n            debugLogs.logRequest(apiLogger, routeName, method, fullUrl, !!init.body);\n        }\n\n        // Execute fetch with timeout\n        let response: Response;\n        let body: any;\n\n        try\n        {\n            response = await executeFetchWithTimeout(fullUrl, init, timeout, customFetch);\n\n            // Parse response\n            body = await parseResponseBody(response);\n        }\n        catch (error)\n        {\n            // Handle timeout specifically\n            if (error instanceof Error && error.name === 'AbortError')\n            {\n                apiLogger.error('Request timeout', {\n                    route: routeName,\n                    method,\n                    url: fullUrl,\n                    timeout,\n                });\n\n                throw new ApiError(\n                    `Request timeout after ${timeout}ms`,\n                    408,\n                    fullUrl,\n                    undefined,\n                    'timeout',\n                );\n            }\n\n            // Network error\n            const errorMessage = error instanceof Error ? error.message : 'Network error';\n            apiLogger.error('Network error', {\n                route: routeName,\n                method,\n                url: fullUrl,\n                error: errorMessage,\n                errorName: error instanceof Error ? error.name : 'unknown',\n            });\n\n            throw new ApiError(\n                errorMessage,\n                0,\n                fullUrl,\n                undefined,\n                'network',\n            );\n        }\n\n        // Execute global + local response interceptors\n        //\n        // These run outside the try/catch on purpose. That catch classifies a transport\n        // failure, and an interceptor throwing is not one: Next.js implements `redirect()`\n        // and `notFound()` by throwing an error carrying a digest, and an interceptor\n        // raising a domain error of its own is not a transport failure either. Run inside\n        // the try, every one of those became `ApiError(..., 0, ..., 'network')` — the\n        // navigation never happened and the caller was handed a network failure that never\n        // occurred, which retry and offline handling keyed on `errorType === 'network'`\n        // act on.\n        if (globalOnResponse)\n        {\n            const result = await globalOnResponse(response, body);\n            response = result.response;\n            body = result.body;\n        }\n        if (options.onResponse)\n        {\n            const result = await options.onResponse(response, body);\n            response = result.response;\n            body = result.body;\n        }\n\n        if (debug)\n        {\n            debugLogs.logResponse(apiLogger, routeName, response.status, !!body);\n        }\n\n        // Handle error responses\n        if (!response.ok)\n        {\n            await handleErrorResponse(response, body, fullUrl, errorRegistry, debug, apiLogger);\n        }\n\n        return body;\n    }\n\n    /**\n     * Build client proxy\n     *\n     * Every property access returns a `RouteCallBuilder` for that one property read as a\n     * whole route name, and that name goes on the wire as `/api/rpc/{routeName}`. The\n     * proxy route resolves it against the generated route map, whose names are flat.\n     *\n     * Nesting needs nothing here: `registerRoutes` mounts a route declared inside a\n     * nested `defineRouter` under its own key, so `api.getThing` is the call for a nested\n     * `getThing` exactly as for a top-level one — which is the namespace `Client` types.\n     * There is no dot-notation traversal: a property access never returns another proxy,\n     * so `api.group.getThing` reads a property of a builder and is `undefined`.\n     *\n     * `prefix` is vestigial — nothing passes one, and adding a caller that did would\n     * build a dotted name the route map cannot resolve.\n     */\n    function buildProxy(prefix = ''): any\n    {\n        return new Proxy(\n            {},\n            {\n                get(_target, prop: string)\n                {\n                    const currentPath = prefix ? `${prefix}.${prop}` : prop;\n\n                    // Return RouteCallBuilder that can either be called or chained\n                    return new RouteCallBuilder(\n                        (input: any, options: CallOptions) => executeCall(currentPath, input, options),\n                        currentPath,\n                    );\n                },\n            },\n        );\n    }\n\n    return buildProxy() as Client<TRouter>;\n}\n"]}

package/dist/nextjs/server.d.ts

@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { HttpMethod } from '@spfn/core/route';
 import { InterceptorRule as InterceptorRule$1 } from '@spfn/core/nextjs/server';
-import { S as SetCookie } from '../types-yv6z_mK7.js';
+import { S as SetCookie } from '../types-QoyjaJWw.js';
 import '@sinclair/typebox';
 import '@spfn/core/errors';
 
@@ -121,14 +121,18 @@ interface TypedProxyConfig {
  * ```typescript
  * // app/api/rpc/[routeName]/route.ts
  * import { createRpcProxy } from '@spfn/core/nextjs/server';
- * import { authRouteMap } from '@spfn/auth';
  * import { eventRouteMap } from '@spfn/core/event';
  * import { routeMap } from '@/generated/route-map';
  *
  * export const { GET, POST } = createRpcProxy({
- *     routeMap: { ...routeMap, ...authRouteMap, ...eventRouteMap },
+ *     routeMap: { ...routeMap, ...eventRouteMap },
  * });
  * ```
+ *
+ * The generated `routeMap` already holds the routes of every package router the
+ * app mounts with `.packages()`, so no package map is merged by hand.
+ * `eventRouteMap` is the exception: a hand-written constant, not a mounted
+ * router.
  */
 
 /**
@@ -149,16 +153,17 @@ interface RpcProxyConfig extends Omit<TypedProxyConfig, 'onRequest' | 'onRespons
     /**
      * Route map containing routeName → {method, path} mappings
      *
-     * Merge generated route map with package route maps (auth, events, etc.)
+     * The generated map carries the app's own routes and those of every package
+     * router it mounts with `.packages()`. Merge `eventRouteMap` beside it when
+     * the app uses SSE — that one is a constant rather than a mounted router.
      *
      * @example
      * ```typescript
-     * import { authRouteMap } from '@spfn/auth';
      * import { eventRouteMap } from '@spfn/core/event';
      * import { routeMap } from '@/generated/route-map';
      *
      * export const { GET, POST } = createRpcProxy({
-     *     routeMap: { ...routeMap, ...authRouteMap, ...eventRouteMap },
+     *     routeMap: { ...routeMap, ...eventRouteMap },
      * });
      * ```
      */