@spfn/core 0.3.0-beta.29 → 0.3.0-beta.30

package/dist/nextjs/index.d.ts

@@ -1,6 +1,6 @@
 import { Router, RouteDef } from '@spfn/core/route';
-import { R as RequestInterceptor, a as ResponseInterceptor, I as InferRouteInput, b as InferRouteOutput, E as ExtractRoutes, A as ApiConfig } from '../types-CxhPH4s_.js';
-export { C as CallOptions, c as CookieOptions, d as RouterInput, e as RouterOutput, S as SetCookie, f as StructuredInput } from '../types-CxhPH4s_.js';
+import { R as RequestInterceptor, a as ResponseInterceptor, I as InferRouteInput, b as InferRouteOutput, E as ExtractRoutes, A as ApiConfig } from '../types-CKH0D3Dy.js';
+export { c as ApiError, d as ApiOutcome, C as CallOptions, e as CookieOptions, f as RouterInput, g as RouterOutput, S as SetCookie, h as StructuredInput } from '../types-CKH0D3Dy.js';
 import '@sinclair/typebox';
 import '@spfn/core/errors';
 
@@ -178,23 +178,4 @@ declare function csrfHeaderValue(cookies: Iterable<[string, string]>): string |
  */
 declare function documentCookieEntries(): Array<[string, string]>;
 
-/**
- * Typed client error
- *
- * `errorType` tells apart why a call failed:
- * - `'http'`: the server answered with a non-2xx status
- * - `'network'`: the fetch or the body read failed (status 0)
- * - `'timeout'`: the call's timeout elapsed before response headers arrived (status 408)
- * - `'aborted'`: the caller's own signal aborted the call (status 0); `cause` is the signal's reason
- */
-declare class ApiError extends Error {
-    readonly status: number;
-    readonly url: string;
-    readonly response?: unknown | undefined;
-    readonly errorType?: "http" | "network" | "timeout" | "aborted" | undefined;
-    constructor(message: string, status: number, url: string, response?: unknown | undefined, errorType?: "http" | "network" | "timeout" | "aborted" | undefined, options?: {
-        cause?: unknown;
-    });
-}
-
-export { ApiConfig, ApiError, CSRF_HEADER, type Client, InferRouteInput, InferRouteOutput, RequestInterceptor, ResponseInterceptor, type RouteClient, createApi, csrfHeaderValue, documentCookieEntries };
+export { ApiConfig, CSRF_HEADER, type Client, InferRouteInput, InferRouteOutput, RequestInterceptor, ResponseInterceptor, type RouteClient, createApi, csrfHeaderValue, documentCookieEntries };

package/dist/nextjs/index.js

@@ -103,7 +103,7 @@ async function autoDetectServerCookies() {
     return {};
   }
   try {
-    const { cookies } = await import('next/headers');
+    const { cookies } = await import('next/headers.js');
     const cookieStore = await cookies();
     const allCookies = cookieStore.getAll();
     const result = Object.fromEntries(
@@ -164,40 +164,49 @@ async function fetchInAbortScope(url, init, timeout, customFetch = fetch) {
     scope.close();
   }
 }
-async function handleErrorResponse(response, body, fullUrl, errorRegistry, debug, logger3) {
+function errorFromResponse(response, body, fullUrl, errorRegistry, debug, logger3) {
   if (debug) {
     logErrorResponse(logger3, response.status, body);
   }
-  let deserializedError = null;
-  if (errorRegistry && body && typeof body === "object" && "__type" in body) {
+  const deserializedError = deserializeRegisteredError(body, errorRegistry, debug, logger3);
+  if (deserializedError) {
     if (debug) {
-      logErrorDeserializationAttempt(logger3, body.__type, errorRegistry.getRegisteredTypes());
+      logThrowingDeserializedError(logger3, deserializedError);
     }
-    try {
-      deserializedError = errorRegistry.deserialize(body);
-      if (debug) {
-        logErrorDeserializationSuccess(logger3, deserializedError);
-      }
-    } catch (deserializeError) {
-      if (debug) {
-        logErrorDeserializationFailure(logger3, deserializeError);
-      }
+    return deserializedError;
+  }
+  return fallbackApiError(response, body, fullUrl, logger3);
+}
+function deserializeRegisteredError(body, errorRegistry, debug, logger3) {
+  if (!errorRegistry || !body || typeof body !== "object" || !("__type" in body)) {
+    if (debug) {
+      logErrorDeserializationSkipped(logger3, errorRegistry, body);
     }
-  } else if (debug) {
-    logErrorDeserializationSkipped(logger3, errorRegistry, body);
+    return null;
   }
-  if (deserializedError) {
+  if (debug) {
+    logErrorDeserializationAttempt(logger3, body.__type, errorRegistry.getRegisteredTypes());
+  }
+  try {
+    const deserializedError = errorRegistry.deserialize(body);
     if (debug) {
-      logThrowingDeserializedError(logger3, deserializedError);
+      logErrorDeserializationSuccess(logger3, deserializedError);
+    }
+    return deserializedError;
+  } catch (deserializeError) {
+    if (debug) {
+      logErrorDeserializationFailure(logger3, deserializeError);
     }
-    throw deserializedError;
+    return null;
   }
+}
+function fallbackApiError(response, body, fullUrl, logger3) {
   if (response.status === 404 && process.env.NODE_ENV !== "production") {
     logger3.warn(
       "\n\u26A0\uFE0F  404 Not Found\n\nCheck the following:\n  1. Routes are registered in server.config.ts:\n     \u2192 defineServerConfig().routes(appRouter)\n  2. Delete .spfn cache if you recently added new routes:\n     \u2192 rm -rf .spfn\n"
     );
   }
-  throw new ApiError(
+  return new ApiError(
     body?.message || `HTTP ${response.status}: ${response.statusText}`,
     response.status,
     fullUrl,
@@ -355,19 +364,22 @@ var RouteCallBuilder = class _RouteCallBuilder {
 
 // src/nextjs/client/core.ts
 var apiLogger = logger.child("@spfn/core:api-client");
+function transportOutcome(errorType, message, status, url, options) {
+  return { ok: false, errorType, status, error: new ApiError(message, status, url, void 0, errorType, options) };
+}
 function transportError(failure, site, timeout) {
   if (failure.cause === "timeout") {
     apiLogger.error("Request timeout", { ...site, timeout });
-    return new ApiError(`Request timeout after ${timeout}ms`, 408, site.url, void 0, "timeout");
+    return transportOutcome("timeout", `Request timeout after ${timeout}ms`, 408, site.url);
   }
   if (failure.cause === "caller") {
     apiLogger.debug("Request aborted by caller", site);
-    return new ApiError("Request aborted", 0, site.url, void 0, "aborted", { cause: failure.error });
+    return transportOutcome("aborted", "Request aborted", 0, site.url, { cause: failure.error });
   }
   const { error } = failure;
   if (error instanceof Error && error.name === "AbortError") {
     apiLogger.error("Request timeout", { ...site, timeout });
-    return new ApiError(`Request timeout after ${timeout}ms`, 408, site.url, void 0, "timeout");
+    return transportOutcome("timeout", `Request timeout after ${timeout}ms`, 408, site.url);
   }
   const errorMessage = error instanceof Error ? error.message : "Network error";
   apiLogger.error("Network error", {
@@ -375,7 +387,29 @@ function transportError(failure, site, timeout) {
     error: errorMessage,
     errorName: error instanceof Error ? error.name : "unknown"
   });
-  return new ApiError(errorMessage, 0, site.url, void 0, "network");
+  return transportOutcome("network", errorMessage, 0, site.url);
+}
+function notifyOutcome(onOutcome, outcome) {
+  if (!onOutcome) {
+    return;
+  }
+  try {
+    const returned = onOutcome(outcome);
+    if (isThenable(returned)) {
+      Promise.resolve(returned).catch(logObserverFailure);
+    }
+  } catch (error) {
+    logObserverFailure(error);
+  }
+}
+function isThenable(value) {
+  return typeof value?.then === "function";
+}
+function logObserverFailure(error) {
+  apiLogger.error("onOutcome observer failed; the call result is unchanged", {
+    errorName: error instanceof Error ? error.name : typeof error,
+    errorMessage: error instanceof Error ? error.message : String(error)
+  });
 }
 function createApi(config = {}) {
   const {
@@ -385,6 +419,7 @@ function createApi(config = {}) {
     fetch: customFetch = fetch,
     onRequest: globalOnRequest,
     onResponse: globalOnResponse,
+    onOutcome,
     errorRegistry: errorRegistryConfig,
     debug = false
   } = config;
@@ -399,7 +434,7 @@ function createApi(config = {}) {
     let appUrl = env.SPFN_APP_URL || "";
     if (!appUrl && typeof window === "undefined") {
       try {
-        const { headers: headers2 } = await import('next/headers');
+        const { headers: headers2 } = await import('next/headers.js');
         const headersList = await headers2();
         const host = headersList.get("host");
         const protocol = headersList.get("x-forwarded-proto") || "http";
@@ -495,7 +530,9 @@ function createApi(config = {}) {
     const appliedTimeout = options.timeout ?? timeout;
     const fetched = await fetchInAbortScope(fullUrl, init, appliedTimeout, customFetch);
     if (!fetched.ok) {
-      throw transportError(fetched, { route: routeName, method, url: fullUrl }, appliedTimeout);
+      const outcome = transportError(fetched, { route: routeName, method, url: fullUrl }, appliedTimeout);
+      notifyOutcome(onOutcome, outcome);
+      throw outcome.error;
     }
     let { response, body } = fetched;
     if (globalOnResponse) {
@@ -512,8 +549,11 @@ function createApi(config = {}) {
       logResponse(apiLogger, routeName, response.status, !!body);
     }
     if (!response.ok) {
-      await handleErrorResponse(response, body, fullUrl, errorRegistry$1, debug, apiLogger);
+      const error = errorFromResponse(response, body, fullUrl, errorRegistry$1, debug, apiLogger);
+      notifyOutcome(onOutcome, { ok: false, errorType: "http", status: response.status, error });
+      throw error;
     }
+    notifyOutcome(onOutcome, { ok: true, response, body });
     return body;
   }
   function buildProxy(prefix = "") {

package/dist/nextjs/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/nextjs/client/debug-logs.ts","../../src/nextjs/client/errors.ts","../../src/nextjs/shared.ts","../../src/nextjs/client/helpers.ts","../../src/nextjs/client/csrf.ts","../../src/nextjs/client/builder.ts","../../src/nextjs/client/core.ts"],"names":["logger","errorRegistry","coreErrorRegistry","headers"],"mappings":";;;;;;;AAMO,SAAS,sBAAA,CACZA,SACA,OAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,sDAAA,EAAwD;AAAA,IACjE,aAAa,OAAA,CAAQ,MAAA;AAAA,IACrB,WAAA,EAAa,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,KAAK,EAAE,IAAI;AAAA,GACvC,CAAA;AACL;AAEO,SAAS,UAAA,CACZA,OAAAA,EACA,SAAA,EACA,MAAA,EACA,KACA,OAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,gBAAA,EAAa;AAAA,IACtB,KAAA,EAAO,SAAA;AAAA,IACP,MAAA;AAAA,IACA,GAAA;AAAA,IACA;AAAA,GACH,CAAA;AACL;AAEO,SAAS,WAAA,CACZA,OAAAA,EACA,SAAA,EACA,MAAA,EACA,OAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,iBAAA,EAAc;AAAA,IACvB,KAAA,EAAO,SAAA;AAAA,IACP,MAAA;AAAA,IACA;AAAA,GACH,CAAA;AACL;AAEO,SAAS,gBAAA,CACZA,OAAAA,EACA,MAAA,EACA,IAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,yBAAA,EAA2B;AAAA,IACpC,MAAA;AAAA,IACA,OAAA,EAAS,CAAC,CAAC,IAAA;AAAA,IACX,UAAU,OAAO,IAAA;AAAA,IACjB,YAAA,EAAc,IAAA,IAAQ,OAAO,IAAA,KAAS,YAAY,QAAA,IAAY,IAAA;AAAA,IAC9D,WAAW,IAAA,EAAM;AAAA,GACpB,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,OAAAA,EACA,SAAA,EACA,eAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,kCAAA,EAAoC;AAAA,IAC7C,SAAA;AAAA,IACA,WAAA,EAAa,IAAA;AAAA,IACb;AAAA,GACH,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,SACA,KAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,iCAAA,EAAmC;AAAA,IAC5C,WAAW,KAAA,EAAO,IAAA;AAAA,IAClB,gBAAA,EAAkB,OAAO,WAAA,CAAY,IAAA;AAAA,IACrC,SAAS,KAAA,EAAO;AAAA,GACnB,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,SACA,KAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,wBAAA,EAA0B;AAAA,IACnC,SAAA,EAAW,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,IAAA,GAAO,SAAA;AAAA,IACjD,cAAc,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK;AAAA,GACtE,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,OAAAA,EACA,aAAA,EACA,IAAA,EAEJ;AACI,EAAA,MAAM,MAAA,GAAS,CAAC,aAAA,GACV,aAAA,GACA,CAAC,IAAA,GACG,SAAA,GACA,OAAO,IAAA,KAAS,QAAA,GACZ,iBAAA,GACA,EAAE,QAAA,IAAY,QACV,iBAAA,GACA,SAAA;AAElB,EAAAA,OAAAA,CAAO,KAAA,CAAM,gCAAA,EAAkC,EAAE,QAAQ,CAAA;AAC7D;AAEO,SAAS,4BAAA,CACZA,SACA,KAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,6BAAA,EAA+B;AAAA,IACxC,WAAW,KAAA,CAAM,IAAA;AAAA,IACjB,oBAAA,EAAsB,MAAM,WAAA,CAAY,IAAA;AAAA,IACxC,SAAA,EAAW,MAAA,CAAO,cAAA,CAAe,KAAK,EAAE,WAAA,CAAY;AAAA,GACvD,CAAA;AACL;;;AClHO,IAAM,QAAA,GAAN,cAAuB,KAAA,CAC9B;AAAA,EACI,YACI,OAAA,EACgB,MAAA,EACA,GAAA,EACA,QAAA,EACA,WAChB,OAAA,EAEJ;AACI,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AAPN,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAKhB,IAAA,IAAA,CAAK,IAAA,GAAO,UAAA;AAAA,EAChB;AACJ;;;ACkCO,SAAS,kBAAkB,OAAA,EAClC;AACI,EAAA,OAAO,OAAO,OAAA,CAAQ,OAAO,CAAA,CACxB,GAAA,CAAI,CAAC,CAAC,GAAA,EAAK,KAAK,CAAA,KAAM,GAAG,GAAG,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,CAAA,CACvC,KAAK,IAAI,CAAA;AAClB;AAUA,eAAsB,kBAAkB,QAAA,EACxC;AAEI,EAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EACxB;AACI,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAEvD,EAAA,IAAI,WAAA,EAAa,QAAA,CAAS,kBAAkB,CAAA,EAC5C;AACI,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,IAAA,OAAO,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,GAAI,IAAA;AAAA,EACrC,CAAA,MAEA;AACI,IAAA,OAAO,MAAM,SAAS,IAAA,EAAK;AAAA,EAC/B;AACJ;;;ACtFA,IAAM,YAAA,GAAe,MAAA,CAAO,KAAA,CAAM,yBAAyB,CAAA;AAM3D,eAAsB,uBAAA,GACtB;AAEI,EAAA,IAAI,OAAO,WAAW,WAAA,EACtB;AACI,IAAA,OAAO,EAAC;AAAA,EACZ;AAEA,EAAA,IACA;AAEI,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,OAAO,cAAc,CAAA;AAC/C,IAAA,MAAM,WAAA,GAAc,MAAM,OAAA,EAAQ;AAClC,IAAA,MAAM,UAAA,GAAa,YAAY,MAAA,EAAO;AAEtC,IAAA,MAAM,SAAS,MAAA,CAAO,WAAA;AAAA,MAClB,UAAA,CAAW,IAAI,CAAA,MAAA,KAAU,CAAC,OAAO,IAAA,EAAM,MAAA,CAAO,KAAK,CAAC;AAAA,KACxD;AAEA,IAAA,YAAA,CAAa,MAAM,yBAAA,EAA2B;AAAA,MAC1C,OAAO,UAAA,CAAW,MAAA;AAAA,MAClB,KAAA,EAAO,UAAA,CAAW,GAAA,CAAI,CAAA,CAAA,KAAK,EAAE,IAAI;AAAA,KACpC,CAAA;AAED,IAAA,OAAO,MAAA;AAAA,EACX,SACO,KAAA,EACP;AAGI,IAAA,MAAM,GAAA,GAAM,KAAA;AACZ,IAAA,YAAA,CAAa,KAAK,+BAAA,EAAiC;AAAA,MAC/C,SAAS,GAAA,CAAI,OAAA;AAAA,MACb,MAAM,GAAA,CAAI;AAAA,KACb,CAAA;AAED,IAAA,OAAO,EAAC;AAAA,EACZ;AACJ;AAwBA,SAAS,cAAA,CAAe,cAAuC,OAAA,EAC/D;AACI,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,IAAI,KAAA;AAEJ,EAAA,MAAM,KAAA,GAAQ,CAAC,MAAA,EAAoB,MAAA,KACnC;AACI,IAAA,KAAA,KAAU,MAAA;AACV,IAAA,UAAA,CAAW,MAAM,MAAM,CAAA;AAAA,EAC3B,CAAA;AACA,EAAA,MAAM,aAAA,GAAgB,MAAM,KAAA,CAAM,QAAA,EAAU,cAAc,MAAM,CAAA;AAChE,EAAA,MAAM,YAAY,UAAA,CAAW,MAAM,KAAA,CAAM,SAAS,GAAG,OAAO,CAAA;AAE5D,EAAA,YAAA,EAAc,iBAAiB,OAAA,EAAS,aAAA,EAAe,EAAE,IAAA,EAAM,MAAM,CAAA;AAErE,EAAA,OAAO;AAAA,IACH,QAAQ,UAAA,CAAW,MAAA;AAAA,IACnB,OAAO,MAAM,KAAA;AAAA,IACb,SAAA,EAAW,MAAM,YAAA,CAAa,SAAS,CAAA;AAAA,IACvC,OAAO,MACP;AACI,MAAA,YAAA,CAAa,SAAS,CAAA;AACtB,MAAA,YAAA,EAAc,mBAAA,CAAoB,SAAS,aAAa,CAAA;AAAA,IAC5D;AAAA,GACJ;AACJ;AAcA,eAAsB,iBAAA,CAClB,GAAA,EACA,IAAA,EACA,OAAA,EACA,cAA4B,KAAA,EAEhC;AACI,EAAA,MAAM,YAAA,GAAe,KAAK,MAAA,IAAU,MAAA;AAEpC,EAAA,IAAI,cAAc,OAAA,EAClB;AACI,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAO,YAAA,CAAa,MAAA,EAAQ,OAAO,QAAA,EAAS;AAAA,EACpE;AAEA,EAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,YAAA,EAAc,OAAO,CAAA;AAElD,EAAA,IACA;AACI,IAAA,MAAM,QAAA,GAAW,MAAM,WAAA,CAAY,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,KAAA,CAAM,MAAA,EAAQ,CAAA;AAEzE,IAAA,KAAA,CAAM,SAAA,EAAU;AAEhB,IAAA,MAAM,IAAA,GAAO,MAAM,iBAAA,CAAkB,QAAQ,CAAA;AAE7C,IAAA,IAAI,KAAA,CAAM,KAAA,EAAM,KAAM,QAAA,EACtB;AACI,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAO,YAAA,EAAc,MAAA,EAAQ,OAAO,QAAA,EAAS;AAAA,IACrE;AAEA,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,QAAA,EAAU,IAAA,EAAK;AAAA,EACtC,SACO,KAAA,EACP;AACI,IAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,EAAM;AAE1B,IAAA,OAAO,EAAE,IAAI,KAAA,EAAO,KAAA,EAAO,OAAO,KAAA,KAAU,QAAA,GAAW,YAAA,EAAc,MAAA,GAAS,KAAA,EAAM;AAAA,EACxF,CAAA,SACA;AAEI,IAAA,KAAA,CAAM,KAAA,EAAM;AAAA,EAChB;AACJ;AAOA,eAAsB,oBAClB,QAAA,EACA,IAAA,EACA,OAAA,EACA,aAAA,EACA,OACAA,OAAAA,EAEJ;AACI,EAAA,IAAI,KAAA,EACJ;AACI,IAAU,gBAAA,CAAiBA,OAAAA,EAAQ,QAAA,CAAS,MAAA,EAAQ,IAAI,CAAA;AAAA,EAC5D;AAGA,EAAA,IAAI,iBAAA,GAAkC,IAAA;AAEtC,EAAA,IAAI,iBAAiB,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,IAAY,YAAY,IAAA,EACrE;AACI,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,+BAA+BA,OAAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,aAAA,CAAc,oBAAoB,CAAA;AAAA,IACpG;AAEA,IAAA,IACA;AACI,MAAA,iBAAA,GAAoB,aAAA,CAAc,YAAY,IAAW,CAAA;AAEzD,MAAA,IAAI,KAAA,EACJ;AACI,QAAU,8BAAA,CAA+BA,SAAQ,iBAAiB,CAAA;AAAA,MACtE;AAAA,IACJ,SACO,gBAAA,EACP;AAEI,MAAA,IAAI,KAAA,EACJ;AACI,QAAU,8BAAA,CAA+BA,SAAQ,gBAAgB,CAAA;AAAA,MACrE;AAAA,IAEJ;AAAA,EACJ,WACS,KAAA,EACT;AACI,IAAU,8BAAA,CAA+BA,OAAAA,EAAQ,aAAA,EAAe,IAAI,CAAA;AAAA,EACxE;AAGA,EAAA,IAAI,iBAAA,EACJ;AACI,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,4BAAA,CAA6BA,SAAQ,iBAAiB,CAAA;AAAA,IACpE;AAEA,IAAA,MAAM,iBAAA;AAAA,EACV;AAGA,EAAA,IAAI,SAAS,MAAA,KAAW,GAAA,IAAO,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAA,EACxD;AACI,IAAAA,OAAAA,CAAO,IAAA;AAAA,MACH;AAAA,KAMJ;AAAA,EACJ;AAEA,EAAA,MAAM,IAAI,QAAA;AAAA,IACN,MAAM,OAAA,IAAW,CAAA,KAAA,EAAQ,SAAS,MAAM,CAAA,EAAA,EAAK,SAAS,UAAU,CAAA,CAAA;AAAA,IAChE,QAAA,CAAS,MAAA;AAAA,IACT,OAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACJ;AACJ;;;ACpOO,IAAM,WAAA,GAAc;AAW3B,IAAM,mBAAA,GAAsB,oBAAA;AAW5B,IAAM,iBAAA,GAAoB,UAAA;AAW1B,IAAM,cAAA,GAAiB,EAAA;AAkBvB,SAAS,iBAAiB,MAAA,EAC1B;AAGI,EAAA,MAAM,SAAS,KAAA,CAAM,IAAA,CAAK,IAAI,GAAA,CAAI,MAAM,CAAC,CAAA;AAEzC,EAAA,IAAI,MAAA,CAAO,UAAU,cAAA,EACrB;AACI,IAAA,OAAO,MAAA;AAAA,EACX;AAEA,EAAA,MAAM,OAAO,cAAA,GAAiB,CAAA;AAE9B,EAAA,OAAO,CAAC,GAAG,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,EAAG,GAAG,MAAA,CAAO,KAAA,CAAM,CAAC,IAAI,CAAC,CAAA;AAC5D;AAcO,SAAS,gBAAgB,OAAA,EAChC;AAMI,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,IAAA,CAAK,OAAO,CAAA,CAC5B,MAAA,CAAO,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,KAAM,mBAAA,CAAoB,KAAK,IAAI,CAAA,IACjD,iBAAA,CAAkB,IAAA,CAAK,KAAK,CAAA,IAC5B,CAAC,KAAA,CAAM,SAAS,GAAG,CAAC,CAAA,CAC1B,GAAA,CAAI,CAAC,GAAG,KAAK,MAAM,KAAK,CAAA;AAE7B,EAAA,MAAM,UAAA,GAAa,iBAAiB,MAAM,CAAA;AAE1C,EAAA,OAAO,WAAW,MAAA,GAAS,CAAA,GAAI,UAAA,CAAW,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA;AAC1D;AAOO,SAAS,qBAAA,GAChB;AACI,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA,IAAe,CAAC,SAAS,MAAA,EACjD;AACI,IAAA,OAAO,EAAC;AAAA,EACZ;AAEA,EAAA,MAAM,UAAmC,EAAC;AAE1C,EAAA,KAAA,MAAW,IAAA,IAAQ,QAAA,CAAS,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAC5C;AACI,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAElC,IAAA,IAAI,YAAY,CAAA,EAChB;AACI,MAAA,OAAA,CAAQ,KAAK,CAAC,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,SAAS,CAAA,CAAE,IAAA,EAAK,EAAG,IAAA,CAAK,MAAM,SAAA,GAAY,CAAC,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAAA,IACpF;AAAA,EACJ;AAEA,EAAA,OAAO,OAAA;AACX;;;ACrFA,IAAM,cAAA,GAAiB,UAAA;AAqChB,IAAM,gBAAA,GAAN,MAAM,iBAAA,CAIb;AAAA,EAQI,WAAA,CACqB,UACA,SAAA,EAErB;AAHqB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAEpB;AAAA,EAXO,QAAA;AAAA,EACA,QAAA;AAAA,EACA,aAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA;AAAA;AAAA;AAAA,EAWA,KAAA,GACR;AACI,IAAA,MAAM,UAAU,IAAI,iBAAA;AAAA,MAChB,IAAA,CAAK,QAAA;AAAA,MACL,IAAA,CAAK;AAAA,KACT;AACA,IAAA,OAAA,CAAQ,WAAW,IAAA,CAAK,QAAA;AACxB,IAAA,OAAA,CAAQ,WAAW,IAAA,CAAK,QAAA;AACxB,IAAA,OAAA,CAAQ,gBAAgB,IAAA,CAAK,aAAA;AAC7B,IAAA,OAAA,CAAQ,WAAW,IAAA,CAAK,QAAA;AACxB,IAAA,OAAA,CAAQ,aAAa,IAAA,CAAK,UAAA;AAC1B,IAAA,OAAA,CAAQ,cAAc,IAAA,CAAK,WAAA;AAE3B,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,OAAA,EACR;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,WAAW,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,GAAG,OAAA,EAAQ;AAElD,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,OAAA,EACR;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,WAAW,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,GAAG,OAAA,EAAQ;AAElD,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,OAAA,EACb;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,gBAAgB,EAAE,GAAG,IAAA,CAAK,aAAA,EAAe,GAAG,OAAA,EAAQ;AAE5D,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,QAAQ,EAAA,EACR;AACI,IAAA,IAAI,CAAC,OAAO,QAAA,CAAS,EAAE,KAAK,EAAA,IAAM,CAAA,IAAK,KAAK,cAAA,EAC5C;AACI,MAAA,MAAM,IAAI,UAAU,CAAA,uDAAA,EAA0D,cAAc,UAAU,MAAA,CAAO,EAAE,CAAC,CAAA,CAAE,CAAA;AAAA,IACtH;AAEA,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,QAAA,GAAW,EAAA;AAEnB,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,UAAU,WAAA,EACV;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,UAAA,GAAa,WAAA;AAErB,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,WAAW,WAAA,EACX;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,WAAA,GAAc,WAAA;AAEtB,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,KAAK,KAAA,EACL;AACI,IAAA,MAAM,UAAuB,EAAC;AAE9B,IAAA,IAAI,KAAK,QAAA,EACT;AACI,MAAA,OAAA,CAAQ,UAAU,IAAA,CAAK,QAAA;AAAA,IAC3B;AAEA,IAAA,IAAI,KAAK,QAAA,EACT;AACI,MAAA,OAAA,CAAQ,UAAU,IAAA,CAAK,QAAA;AAAA,IAC3B;AAEA,IAAA,IAAI,KAAK,aAAA,EACT;AACI,MAAA,OAAA,CAAQ,eAAe,IAAA,CAAK,aAAA;AAAA,IAChC;AAEA,IAAA,IAAI,IAAA,CAAK,aAAa,MAAA,EACtB;AACI,MAAA,OAAA,CAAQ,UAAU,IAAA,CAAK,QAAA;AAAA,IAC3B;AAEA,IAAA,IAAI,KAAK,UAAA,EACT;AACI,MAAA,OAAA,CAAQ,YAAY,IAAA,CAAK,UAAA;AAAA,IAC7B;AAEA,IAAA,IAAI,KAAK,WAAA,EACT;AACI,MAAA,OAAA,CAAQ,aAAa,IAAA,CAAK,WAAA;AAAA,IAC9B;AAEA,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,KAAA,IAAS,IAAI,OAAO,CAAA;AAAA,EAC7C;AACJ,CAAA;;;AC9LA,IAAM,SAAA,GAAYA,MAAAA,CAAO,KAAA,CAAM,uBAAuB,CAAA;AAuBtD,SAAS,cAAA,CACL,OAAA,EACA,IAAA,EACA,OAAA,EAEJ;AACI,EAAA,IAAI,OAAA,CAAQ,UAAU,SAAA,EACtB;AACI,IAAA,SAAA,CAAU,MAAM,iBAAA,EAAmB,EAAE,GAAG,IAAA,EAAM,SAAS,CAAA;AAEvD,IAAA,OAAO,IAAI,SAAS,CAAA,sBAAA,EAAyB,OAAO,MAAM,GAAA,EAAK,IAAA,CAAK,GAAA,EAAK,MAAA,EAAW,SAAS,CAAA;AAAA,EACjG;AAEA,EAAA,IAAI,OAAA,CAAQ,UAAU,QAAA,EACtB;AACI,IAAA,SAAA,CAAU,KAAA,CAAM,6BAA6B,IAAI,CAAA;AAEjD,IAAA,OAAO,IAAI,QAAA,CAAS,iBAAA,EAAmB,CAAA,EAAG,IAAA,CAAK,GAAA,EAAK,MAAA,EAAW,SAAA,EAAW,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAO,CAAA;AAAA,EACtG;AAEA,EAAA,MAAM,EAAE,OAAM,GAAI,OAAA;AAElB,EAAA,IAAI,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,YAAA,EAC7C;AACI,IAAA,SAAA,CAAU,MAAM,iBAAA,EAAmB,EAAE,GAAG,IAAA,EAAM,SAAS,CAAA;AAEvD,IAAA,OAAO,IAAI,SAAS,CAAA,sBAAA,EAAyB,OAAO,MAAM,GAAA,EAAK,IAAA,CAAK,GAAA,EAAK,MAAA,EAAW,SAAS,CAAA;AAAA,EACjG;AAEA,EAAA,MAAM,YAAA,GAAe,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,eAAA;AAC9D,EAAA,SAAA,CAAU,MAAM,eAAA,EAAiB;AAAA,IAC7B,GAAG,IAAA;AAAA,IACH,KAAA,EAAO,YAAA;AAAA,IACP,SAAA,EAAW,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,IAAA,GAAO;AAAA,GACpD,CAAA;AAED,EAAA,OAAO,IAAI,QAAA,CAAS,YAAA,EAAc,GAAG,IAAA,CAAK,GAAA,EAAK,QAAW,SAAS,CAAA;AACvE;AAwBO,SAAS,SAAA,CACZ,MAAA,GAAoB,EAAC,EAEzB;AACI,EAAA,MAAM;AAAA,IACF,OAAA,GAAU,UAAA;AAAA,IACV,OAAA,EAAS,iBAAiB,EAAC;AAAA,IAC3B,UAAU,GAAA,CAAI,cAAA;AAAA,IACd,OAAO,WAAA,GAAc,KAAA;AAAA,IACrB,SAAA,EAAW,eAAA;AAAA,IACX,UAAA,EAAY,gBAAA;AAAA,IACZ,aAAA,EAAe,mBAAA;AAAA,IACf,KAAA,GAAQ;AAAA,GACZ,GAAI,MAAA;AAGJ,EAAA,MAAMC,eAAA,GAAgB,KAAA,CAAM,OAAA,CAAQ,mBAAmB,CAAA,GACjD,IAAI,aAAA,CAAc,CAACC,aAAA,EAAmB,GAAG,mBAAmB,CAAC,IAC7D,mBAAA,IAAuBA,aAAA;AAE7B,EAAA,IAAI,KAAA,EACJ;AACI,IAAA,SAAA,CAAU,KAAA,CAAM,wBAAA,EAA0B,EAAE,OAAA,EAAS,CAAA;AAAA,EACzD;AAUA,EAAA,eAAe,YACX,SAAA,EACA,KAAA,GAAa,EAAC,EACd,OAAA,GAAuB,EAAC,EAE5B;AACI,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,KAAS,MAAA;AAC/B,IAAA,MAAM,WAAA,GAAc,MAAM,QAAA,KAAa,MAAA,IAAa,OAAO,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA,CAAE,MAAA,GAAS,CAAA;AACzF,IAAA,MAAM,MAAA,GAAU,OAAA,IAAW,WAAA,GAAe,MAAA,GAAS,KAAA;AAGnD,IAAA,IAAI,MAAA,GAAS,IAAI,YAAA,IAAgB,EAAA;AAGjC,IAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,WAAA,EACjC;AACI,MAAA,IACA;AACI,QAAA,MAAM,EAAE,OAAA,EAAAC,QAAAA,EAAQ,GAAI,MAAM,OAAO,cAAc,CAAA;AAC/C,QAAA,MAAM,WAAA,GAAc,MAAMA,QAAAA,EAAQ;AAClC,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,GAAA,CAAI,MAAM,CAAA;AACnC,QAAA,MAAM,QAAA,GAAW,WAAA,CAAY,GAAA,CAAI,mBAAmB,CAAA,IAAK,MAAA;AACzD,QAAA,IAAI,IAAA,EACJ;AACI,UAAA,MAAA,GAAS,CAAA,EAAG,QAAQ,CAAA,GAAA,EAAM,IAAI,CAAA,CAAA;AAC9B,UAAA,IAAI,KAAA,EACJ;AACI,YAAA,SAAA,CAAU,KAAA,CAAM,CAAA,oCAAA,EAAuC,MAAM,CAAA,CAAE,CAAA;AAAA,UACnE;AAAA,QACJ;AAAA,MACJ,CAAA,CAAA,MAEA;AAEI,QAAA,IAAI,KAAA,EACJ;AACI,UAAA,SAAA,CAAU,KAAK,oEAAoE,CAAA;AAAA,QACvF;AAAA,MACJ;AAAA,IACJ;AAGA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI,WAAW,KAAA,EACf;AAEI,MAAA,MAAM,UAAA,GAAa,kBAAA,CAAmB,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAC3D,MAAA,OAAA,GAAU,GAAG,MAAM,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,SAAS,UAAU,UAAU,CAAA,CAAA;AAAA,IAClE,CAAA,MAEA;AAEI,MAAA,OAAA,GAAU,CAAA,EAAG,MAAM,CAAA,EAAG,OAAO,IAAI,SAAS,CAAA,CAAA;AAAA,IAC9C;AAIA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACpC,GAAI,WAAA,GAAc,EAAC,GAAI,EAAE,gBAAgB,kBAAA,EAAmB;AAAA,MAC5D,GAAG,cAAA;AAAA,MACH,GAAG,OAAA,CAAQ;AAAA,KACf;AAGA,IAAA,MAAM,mBAAA,GAAsB,MAAM,uBAAA,EAAwB;AAC1D,IAAA,MAAM,aAAA,GAAgB;AAAA,MAClB,GAAG,mBAAA;AAAA,MACH,GAAI,OAAA,CAAQ,OAAA,IAAW;AAAC,KAC5B;AAGA,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,aAAa,CAAA,CAAE,SAAS,CAAA,EACxC;AACI,MAAA,OAAA,CAAQ,QAAQ,CAAA,GAAI,iBAAA,CAAkB,aAAa,CAAA;AAAA,IACvD;AAWA,IAAA,MAAM,SAAA,GAAY,eAAA;AAAA,MACd,OAAO,MAAA,KAAW,WAAA,GAAc,OAAO,OAAA,CAAQ,aAAa,IAAI,qBAAA;AAAsB,KAC1F;AAEA,IAAA,MAAM,eAAA,GAAkB,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,KAAK,CAAA,IAAA,KAAQ,IAAA,CAAK,WAAA,EAAY,KAAM,WAAW,CAAA;AAE5F,IAAA,IAAI,SAAA,IAAa,CAAC,eAAA,EAClB;AACI,MAAA,OAAA,CAAQ,WAAW,CAAA,GAAI,SAAA;AAAA,IAC3B;AAGA,IAAA,IAAI,SAAS,MAAA,CAAO,IAAA,CAAK,mBAAmB,CAAA,CAAE,SAAS,CAAA,EACvD;AACI,MAAA,MAAM,WAAA,GAAc,MAAA,CAAO,OAAA,CAAQ,mBAAmB,EAAE,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,MAAO,EAAE,IAAA,EAAM,OAAM,CAAE,CAAA;AAChG,MAAU,sBAAA,CAAuB,WAAW,WAAW,CAAA;AAAA,IAC3D;AAGA,IAAA,MAAM,WAAA,GAA2B;AAAA,MAC7B,MAAA;AAAA,MACA,OAAA;AAAA,MACA,GAAG,OAAA,CAAQ;AAAA,KACf;AAGA,IAAA,IAAI,WAAW,MAAA,EACf;AACI,MAAA,IAAI,WAAA,EACJ;AAEI,QAAA,MAAM,QAAA,GAAW,IAAI,QAAA,EAAS;AAG9B,QAAA,MAAM,WAAgC,EAAC;AACvC,QAAA,IAAI,KAAA,CAAM,MAAA,EAAQ,QAAA,CAAS,MAAA,GAAS,KAAA,CAAM,MAAA;AAC1C,QAAA,IAAI,KAAA,CAAM,KAAA,EAAO,QAAA,CAAS,KAAA,GAAQ,KAAA,CAAM,KAAA;AACxC,QAAA,IAAI,KAAA,CAAM,OAAA,EAAS,QAAA,CAAS,OAAA,GAAU,KAAA,CAAM,OAAA;AAC5C,QAAA,IAAI,KAAA,CAAM,OAAA,EAAS,QAAA,CAAS,OAAA,GAAU,KAAA,CAAM,OAAA;AAE5C,QAAA,IAAI,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA,CAAE,SAAS,CAAA,EACnC;AACI,UAAA,QAAA,CAAS,MAAA,CAAO,YAAA,EAAc,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,QAC1D;AAGA,QAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA,EACxD;AACI,UAAA,IAAI,iBAAiB,IAAA,EACrB;AACI,YAAA,QAAA,CAAS,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,UAC9B,CAAA,MAAA,IACS,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAC5B;AAEI,YAAA,KAAA,MAAW,QAAQ,KAAA,EACnB;AACI,cAAA,IAAI,gBAAgB,IAAA,EACpB;AACI,gBAAA,QAAA,CAAS,MAAA,CAAO,KAAK,IAAI,CAAA;AAAA,cAC7B,CAAA,MAEA;AACI,gBAAA,QAAA,CAAS,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,IAAI,CAAC,CAAA;AAAA,cACrC;AAAA,YACJ;AAAA,UACJ,CAAA,MAAA,IACS,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAC1C;AACI,YAAA,QAAA,CAAS,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,UACtC;AAAA,QACJ;AAEA,QAAA,WAAA,CAAY,IAAA,GAAO,QAAA;AAAA,MACvB,CAAA,MAEA;AACI,QAAA,WAAA,CAAY,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AAAA,MAC3C;AAAA,IACJ;AAGA,IAAA,IAAI,IAAA,GAAO,WAAA;AACX,IAAA,IAAI,eAAA,EACJ;AACI,MAAA,IAAA,GAAO,MAAM,eAAA,CAAgB,OAAA,EAAS,IAAI,CAAA;AAAA,IAC9C;AACA,IAAA,IAAI,QAAQ,SAAA,EACZ;AACI,MAAA,IAAA,GAAO,MAAM,OAAA,CAAQ,SAAA,CAAU,OAAA,EAAS,IAAI,CAAA;AAAA,IAChD;AAEA,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,UAAA,CAAW,WAAW,SAAA,EAAW,MAAA,EAAQ,SAAS,CAAC,CAAC,KAAK,IAAI,CAAA;AAAA,IAC3E;AAGA,IAAA,MAAM,cAAA,GAAiB,QAAQ,OAAA,IAAW,OAAA;AAC1C,IAAA,MAAM,UAAU,MAAM,iBAAA,CAAkB,OAAA,EAAS,IAAA,EAAM,gBAAgB,WAAW,CAAA;AAElF,IAAA,IAAI,CAAC,QAAQ,EAAA,EACb;AACI,MAAA,MAAM,cAAA,CAAe,SAAS,EAAE,KAAA,EAAO,WAAW,MAAA,EAAQ,GAAA,EAAK,OAAA,EAAQ,EAAG,cAAc,CAAA;AAAA,IAC5F;AAEA,IAAA,IAAI,EAAE,QAAA,EAAU,IAAA,EAAK,GAAI,OAAA;AAYzB,IAAA,IAAI,gBAAA,EACJ;AACI,MAAA,MAAM,MAAA,GAAS,MAAM,gBAAA,CAAiB,QAAA,EAAU,IAAI,CAAA;AACpD,MAAA,QAAA,GAAW,MAAA,CAAO,QAAA;AAClB,MAAA,IAAA,GAAO,MAAA,CAAO,IAAA;AAAA,IAClB;AACA,IAAA,IAAI,QAAQ,UAAA,EACZ;AACI,MAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,UAAA,CAAW,UAAU,IAAI,CAAA;AACtD,MAAA,QAAA,GAAW,MAAA,CAAO,QAAA;AAClB,MAAA,IAAA,GAAO,MAAA,CAAO,IAAA;AAAA,IAClB;AAEA,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,YAAY,SAAA,EAAW,SAAA,EAAW,SAAS,MAAA,EAAQ,CAAC,CAAC,IAAI,CAAA;AAAA,IACvE;AAGA,IAAA,IAAI,CAAC,SAAS,EAAA,EACd;AACI,MAAA,MAAM,oBAAoB,QAAA,EAAU,IAAA,EAAM,OAAA,EAASF,eAAA,EAAe,OAAO,SAAS,CAAA;AAAA,IACtF;AAEA,IAAA,OAAO,IAAA;AAAA,EACX;AAkBA,EAAA,SAAS,UAAA,CAAW,SAAS,EAAA,EAC7B;AACI,IAAA,OAAO,IAAI,KAAA;AAAA,MACP,EAAC;AAAA,MACD;AAAA,QACI,GAAA,CAAI,SAAS,IAAA,EACb;AACI,UAAA,MAAM,cAAc,MAAA,GAAS,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,GAAK,IAAA;AAGnD,UAAA,OAAO,IAAI,gBAAA;AAAA,YACP,CAAC,KAAA,EAAY,OAAA,KAAyB,WAAA,CAAY,WAAA,EAAa,OAAO,OAAO,CAAA;AAAA,YAC7E;AAAA,WACJ;AAAA,QACJ;AAAA;AACJ,KACJ;AAAA,EACJ;AAEA,EAAA,OAAO,UAAA,EAAW;AACtB","file":"index.js","sourcesContent":["/**\n * Debug logging utilities for API client\n * Separates debug logging logic from main client code for better maintainability\n */\nimport type { Logger } from '@spfn/core/logger';\n\nexport function logCookieAutoDetection(\n    logger: Logger,\n    cookies: Array<{ name: string; value: string }>,\n): void\n{\n    logger.debug('Auto-detected server environment, forwarding cookies', {\n        cookieCount: cookies.length,\n        cookieNames: cookies.map(c => c.name),\n    });\n}\n\nexport function logRequest(\n    logger: Logger,\n    routeName: string,\n    method: string,\n    url: string,\n    hasBody: boolean,\n): void\n{\n    logger.debug('→ Request', {\n        route: routeName,\n        method,\n        url,\n        hasBody,\n    });\n}\n\nexport function logResponse(\n    logger: Logger,\n    routeName: string,\n    status: number,\n    hasBody: boolean,\n): void\n{\n    logger.debug('← Response', {\n        route: routeName,\n        status,\n        hasBody,\n    });\n}\n\nexport function logErrorResponse(\n    logger: Logger,\n    status: number,\n    body: any,\n): void\n{\n    logger.debug('Error response received', {\n        status,\n        hasBody: !!body,\n        bodyType: typeof body,\n        hasTypeField: body && typeof body === 'object' && '__type' in body,\n        typeValue: body?.__type,\n    });\n}\n\nexport function logErrorDeserializationAttempt(\n    logger: Logger,\n    errorType: string,\n    registeredTypes: string[],\n): void\n{\n    logger.debug('Attempting error deserialization', {\n        errorType,\n        hasRegistry: true,\n        registeredTypes,\n    });\n}\n\nexport function logErrorDeserializationSuccess(\n    logger: Logger,\n    error: Error | null,\n): void\n{\n    logger.debug('Error deserialized successfully', {\n        errorName: error?.name,\n        errorConstructor: error?.constructor.name,\n        message: error?.message,\n    });\n}\n\nexport function logErrorDeserializationFailure(\n    logger: Logger,\n    error: unknown,\n): void\n{\n    logger.debug('Deserialization failed', {\n        errorName: error instanceof Error ? error.name : 'unknown',\n        errorMessage: error instanceof Error ? error.message : String(error),\n    });\n}\n\nexport function logErrorDeserializationSkipped(\n    logger: Logger,\n    errorRegistry: any,\n    body: any,\n): void\n{\n    const reason = !errorRegistry\n        ? 'no registry'\n        : !body\n            ? 'no body'\n            : typeof body !== 'object'\n                ? 'body not object'\n                : !('__type' in body)\n                    ? 'no __type field'\n                    : 'unknown';\n\n    logger.debug('Skipping error deserialization', { reason });\n}\n\nexport function logThrowingDeserializedError(\n    logger: Logger,\n    error: Error,\n): void\n{\n    logger.debug('Throwing deserialized error', {\n        errorName: error.name,\n        errorConstructorName: error.constructor.name,\n        prototype: Object.getPrototypeOf(error).constructor.name,\n    });\n}\n","// ============================================================================\n// Client Error\n// ============================================================================\n\n/**\n * Typed client error\n *\n * `errorType` tells apart why a call failed:\n * - `'http'`: the server answered with a non-2xx status\n * - `'network'`: the fetch or the body read failed (status 0)\n * - `'timeout'`: the call's timeout elapsed before response headers arrived (status 408)\n * - `'aborted'`: the caller's own signal aborted the call (status 0); `cause` is the signal's reason\n */\nexport class ApiError extends Error\n{\n    constructor(\n        message: string,\n        public readonly status: number,\n        public readonly url: string,\n        public readonly response?: unknown,\n        public readonly errorType?: 'http' | 'network' | 'timeout' | 'aborted',\n        options?: { cause?: unknown },\n    )\n    {\n        super(message, options);\n        this.name = 'ApiError';\n    }\n}\n","/**\n * Shared utilities for Next.js client and proxy modules\n *\n * Contains common functions used by both client and proxy to avoid code duplication.\n */\n\n/**\n * Build URL with path parameters replaced\n *\n * @example\n * buildUrlWithParams('/users/:id/posts/:postId', { id: '123', postId: '456' })\n * // Returns: '/users/123/posts/456'\n */\nexport function buildUrlWithParams(path: string, params: Record<string, any>): string\n{\n    let url = path;\n    for (const [key, value] of Object.entries(params))\n    {\n        url = url.replace(`:${key}`, encodeURIComponent(String(value)));\n    }\n\n    return url;\n}\n\n/**\n * Build query string from object\n *\n * @example\n * buildQueryString({ page: '1', limit: '10', tags: ['foo', 'bar'] })\n * // Returns: '?page=1&limit=10&tags=foo&tags=bar'\n */\nexport function buildQueryString(query: Record<string, any>): string\n{\n    if (Object.keys(query).length === 0)\n    {\n        return '';\n    }\n\n    const searchParams = new URLSearchParams();\n    for (const [key, value] of Object.entries(query))\n    {\n        if (Array.isArray(value))\n        {\n            value.forEach((v) => searchParams.append(key, String(v)));\n        }\n        else\n        {\n            searchParams.append(key, String(value));\n        }\n    }\n\n    return `?${searchParams.toString()}`;\n}\n\n/**\n * Build Cookie header string from cookies object\n *\n * @example\n * buildCookieHeader({ session: 'abc123', theme: 'dark' })\n * // Returns: 'session=abc123; theme=dark'\n */\nexport function buildCookieHeader(cookies: Record<string, string>): string\n{\n    return Object.entries(cookies)\n        .map(([key, value]) => `${key}=${value}`)\n        .join('; ');\n}\n\n/**\n * Parse response body based on content type\n *\n * Handles:\n * - 204 No Content: returns null (no body expected)\n * - application/json: parses JSON body\n * - Other content types: returns raw text\n */\nexport async function parseResponseBody(response: Response): Promise<any>\n{\n    // 204 No Content has no body\n    if (response.status === 204)\n    {\n        return null;\n    }\n\n    const contentType = response.headers.get('content-type');\n\n    if (contentType?.includes('application/json'))\n    {\n        const text = await response.text();\n\n        return text ? JSON.parse(text) : null;\n    }\n    else\n    {\n        return await response.text();\n    }\n}\n","import type { Logger } from '@spfn/core/logger';\nimport type { ErrorRegistry } from '@spfn/core/errors';\nimport { logger } from '@spfn/core/logger';\nimport { ApiError } from './errors';\nimport * as debugLogs from './debug-logs';\nimport { parseResponseBody } from '../shared';\n\n// Re-export shared utilities\nexport { buildCookieHeader, parseResponseBody } from '../shared';\n\nconst cookieLogger = logger.child('@spfn/core:auto-cookies');\n\n/**\n * Auto-detect cookies from Next.js server environment\n * Returns empty object if not in server environment or if cookies are not accessible\n */\nexport async function autoDetectServerCookies(): Promise<Record<string, string>>\n{\n    // Client environment — browser sends cookies automatically\n    if (typeof window !== 'undefined')\n    {\n        return {};\n    }\n\n    try\n    {\n        // Next.js cookies() API is only available in server environment\n        const { cookies } = await import('next/headers');\n        const cookieStore = await cookies();\n        const allCookies = cookieStore.getAll();\n\n        const result = Object.fromEntries(\n            allCookies.map(cookie => [cookie.name, cookie.value]),\n        );\n\n        cookieLogger.debug('Server cookies detected', {\n            count: allCookies.length,\n            names: allCookies.map(c => c.name),\n        });\n\n        return result;\n    }\n    catch (error)\n    {\n        // Server environment but cookies() not accessible\n        // (e.g. static generation, build time, or outside request context)\n        const err = error as Error;\n        cookieLogger.warn('Failed to read server cookies', {\n            message: err.message,\n            name: err.name,\n        });\n\n        return {};\n    }\n}\n\n/**\n * Why a call was aborted, as recorded by the abort scope that aborted it\n */\nexport type AbortCause = 'timeout' | 'caller';\n\n/**\n * What a fetch run in an abort scope produced: the response and its parsed body,\n * or the failure together with the abort cause the scope recorded, if any. For a\n * caller abort, `error` is the caller signal's reason.\n */\nexport type ScopedFetchResult =\n    | { ok: true; response: Response; body: any }\n    | { ok: false; error: unknown; cause?: AbortCause };\n\n/**\n * One controller that two sources may abort: the call's timer and the caller's signal\n *\n * The first source to fire is recorded as the cause and later ones are ignored, so a\n * caller aborting after the timer fired still reads as a timeout. Composed by hand\n * rather than with `AbortSignal.any` / `AbortSignal.timeout`, which browsers below\n * Safari 17.4 lack.\n */\nfunction openAbortScope(callerSignal: AbortSignal | undefined, timeout: number)\n{\n    const controller = new AbortController();\n    let cause: AbortCause | undefined;\n\n    const abort = (source: AbortCause, reason?: unknown) =>\n    {\n        cause ??= source;\n        controller.abort(reason);\n    };\n    const onCallerAbort = () => abort('caller', callerSignal?.reason);\n    const timeoutId = setTimeout(() => abort('timeout'), timeout);\n\n    callerSignal?.addEventListener('abort', onCallerAbort, { once: true });\n\n    return {\n        signal: controller.signal,\n        cause: () => cause,\n        stopTimer: () => clearTimeout(timeoutId),\n        close: () =>\n        {\n            clearTimeout(timeoutId);\n            callerSignal?.removeEventListener('abort', onCallerAbort);\n        },\n    };\n}\n\n/**\n * Fetch and parse a response inside one abort scope\n *\n * The caller's signal is the one on the final `init`, after interceptors ran. The timer\n * stops when response headers arrive; the caller's abort stays effective until the body\n * is parsed. A failure is returned, not thrown, with the cause the scope recorded —\n * classification reads that record, never the error's name.\n *\n * A custom `fetch`'s body read may not honour the signal at all, so a caller abort during\n * that read can otherwise go unnoticed and the call resolves as if nothing happened. After\n * the body is parsed, the scope is checked again: a recorded `'caller'` cause still wins.\n */\nexport async function fetchInAbortScope(\n    url: string,\n    init: RequestInit,\n    timeout: number,\n    customFetch: typeof fetch = fetch,\n): Promise<ScopedFetchResult>\n{\n    const callerSignal = init.signal ?? undefined;\n\n    if (callerSignal?.aborted)\n    {\n        return { ok: false, error: callerSignal.reason, cause: 'caller' };\n    }\n\n    const scope = openAbortScope(callerSignal, timeout);\n\n    try\n    {\n        const response = await customFetch(url, { ...init, signal: scope.signal });\n\n        scope.stopTimer();\n\n        const body = await parseResponseBody(response);\n\n        if (scope.cause() === 'caller')\n        {\n            return { ok: false, error: callerSignal?.reason, cause: 'caller' };\n        }\n\n        return { ok: true, response, body };\n    }\n    catch (error)\n    {\n        const cause = scope.cause();\n\n        return { ok: false, cause, error: cause === 'caller' ? callerSignal?.reason : error };\n    }\n    finally\n    {\n        scope.close();\n    }\n}\n\n/**\n * Handle error response with deserialization support\n * Attempts to deserialize custom errors if errorRegistry is provided\n * Falls back to ApiError if deserialization fails or is not available\n */\nexport async function handleErrorResponse(\n    response: Response,\n    body: any,\n    fullUrl: string,\n    errorRegistry: ErrorRegistry | undefined,\n    debug: boolean,\n    logger: Logger,\n): Promise<never>\n{\n    if (debug)\n    {\n        debugLogs.logErrorResponse(logger, response.status, body);\n    }\n\n    // Try to deserialize error if registry is provided\n    let deserializedError: Error | null = null;\n\n    if (errorRegistry && body && typeof body === 'object' && '__type' in body)\n    {\n        if (debug)\n        {\n            debugLogs.logErrorDeserializationAttempt(logger, body.__type, errorRegistry.getRegisteredTypes());\n        }\n\n        try\n        {\n            deserializedError = errorRegistry.deserialize(body as any);\n\n            if (debug)\n            {\n                debugLogs.logErrorDeserializationSuccess(logger, deserializedError);\n            }\n        }\n        catch (deserializeError)\n        {\n            // Deserialization itself failed (type not found, invalid data, etc.)\n            if (debug)\n            {\n                debugLogs.logErrorDeserializationFailure(logger, deserializeError);\n            }\n            // Fall through to ApiError below\n        }\n    }\n    else if (debug)\n    {\n        debugLogs.logErrorDeserializationSkipped(logger, errorRegistry, body);\n    }\n\n    // If deserialization succeeded, throw the deserialized error\n    if (deserializedError)\n    {\n        if (debug)\n        {\n            debugLogs.logThrowingDeserializedError(logger, deserializedError);\n        }\n\n        throw deserializedError;\n    }\n\n    // Fallback to generic ApiError\n    if (response.status === 404 && process.env.NODE_ENV !== 'production')\n    {\n        logger.warn(\n            '\\n⚠️  404 Not Found\\n\\n' +\n            'Check the following:\\n' +\n            '  1. Routes are registered in server.config.ts:\\n' +\n            '     → defineServerConfig().routes(appRouter)\\n' +\n            '  2. Delete .spfn cache if you recently added new routes:\\n' +\n            '     → rm -rf .spfn\\n',\n        );\n    }\n\n    throw new ApiError(\n        body?.message || `HTTP ${response.status}: ${response.statusText}`,\n        response.status,\n        fullUrl,\n        body,\n        'http',\n    );\n}\n","/**\n * CSRF token transport for the RPC client\n *\n * The Next.js proxy sets a readable (non-HttpOnly) cookie carrying an HMAC of\n * the session's key id; this module mirrors it into a request header. The proxy\n * never compares cookie against header — it recomputes the value from the\n * session — so the cookie is transport only and reading it here is not a trust\n * decision. See the CSRF section of the @spfn/auth README.\n */\n\n/**\n * Header the readable CSRF cookie is mirrored into.\n *\n * Must match CSRF_HEADER in @spfn/auth. It is duplicated rather than imported\n * because @spfn/core cannot depend on @spfn/auth.\n */\nexport const CSRF_HEADER = 'x-spfn-csrf';\n\n/**\n * Cookie names carrying a CSRF token.\n *\n * @spfn/auth suffixes its cookie names with the server port so several local dev\n * instances on the same host do not overwrite each other's session, and the\n * browser cannot know that port — so match the family, not one name. Every\n * candidate is sent and the proxy accepts the request if any of them recomputes\n * to the expected value; a candidate an attacker tossed in never will.\n */\nconst CSRF_COOKIE_PATTERN = /^spfn_csrf(_\\d+)?$/;\n\n/**\n * Values that can be put in a header at all: printable ASCII, no space.\n *\n * A cookie jar is attacker-writable in the very case this feature exists for, and\n * `new Headers()` rejects a value outside Latin-1 — so a sibling subdomain that\n * tosses `spfn_csrf=한` would make every RPC call throw before it was sent, not\n * merely fail the check. A genuine token is 64 hex characters; anything that\n * cannot be a header value cannot be one.\n */\nconst HEADER_SAFE_VALUE = /^[!-~]+$/;\n\n/**\n * Upper bound on candidates sent, so a cookie-flooded jar stays a bounded header.\n *\n * Deliberately generous. The server recomputes the expected value once and then\n * only compares fixed-length strings, so extra candidates cost it almost nothing,\n * while every candidate dropped here is a chance to lock the user out of every\n * mutation — the far worse failure. Must not exceed the matching bound in\n * @spfn/auth's `matchesCsrfToken`, or values sent would never be looked at.\n */\nconst MAX_CANDIDATES = 32;\n\n/**\n * Choose which candidates to send when the jar holds more than the cap.\n *\n * `document.cookie` exposes neither Domain nor Path, so a tossed cookie is\n * indistinguishable from the genuine one here — the proxy is what tells them\n * apart, by recomputing. What this can do is refuse to drop the genuine value on\n * the floor. Browsers order the jar by path length descending, then by age\n * ascending, so a flood pushes the genuine cookie towards the end (attacker\n * cookies on a longer path) or towards the start (attacker cookies written later\n * on the same path). Keeping both ends survives either, where a plain prefix\n * survives only one.\n *\n * A jar flooded far past the cap is a denial of service that no client-side\n * choice fully prevents; the structural fix is a `__Host-` prefixed cookie name,\n * which a sibling subdomain cannot write at all.\n */\nfunction selectCandidates(values: string[]): string[]\n{\n    // Identical duplicates carry no extra information, so collapsing them buys\n    // back slots that a flood of one repeated value would otherwise burn.\n    const unique = Array.from(new Set(values));\n\n    if (unique.length <= MAX_CANDIDATES)\n    {\n        return unique;\n    }\n\n    const half = MAX_CANDIDATES / 2;\n\n    return [...unique.slice(0, half), ...unique.slice(-half)];\n}\n\n/**\n * Collect the CSRF token candidates from cookie entries.\n *\n * Takes entries rather than a map because a name can legitimately appear twice:\n * a sibling subdomain that tosses `spfn_csrf` for the parent domain leaves the\n * browser holding two cookies of that name, and folding them into a map would\n * throw away whichever the tossed one displaced — locking the user out of every\n * mutation. Sending both keeps the real one in play, and the tossed one is inert\n * because the proxy recomputes what it expects.\n *\n * @returns Header value (comma-separated), or undefined when no cookie exists\n */\nexport function csrfHeaderValue(cookies: Iterable<[string, string]>): string | undefined\n{\n    // A comma separates candidates on the wire, so a value containing one would\n    // arrive as several. That cannot be a genuine token — they are hex — but it\n    // would let a single tossed cookie spend the receiver's whole candidate\n    // budget and bury the real value behind it. Drop those, and anything that\n    // could not be a header value at all.\n    const values = Array.from(cookies)\n        .filter(([name, value]) => CSRF_COOKIE_PATTERN.test(name)\n            && HEADER_SAFE_VALUE.test(value)\n            && !value.includes(','))\n        .map(([, value]) => value);\n\n    const candidates = selectCandidates(values);\n\n    return candidates.length > 0 ? candidates.join(',') : undefined;\n}\n\n/**\n * Read the browser cookie jar as entries, duplicates preserved.\n *\n * Empty outside a browser (SSR reads the jar it forwards instead).\n */\nexport function documentCookieEntries(): Array<[string, string]>\n{\n    if (typeof document === 'undefined' || !document.cookie)\n    {\n        return [];\n    }\n\n    const entries: Array<[string, string]> = [];\n\n    for (const pair of document.cookie.split(';'))\n    {\n        const separator = pair.indexOf('=');\n\n        if (separator > 0)\n        {\n            entries.push([pair.slice(0, separator).trim(), pair.slice(separator + 1).trim()]);\n        }\n    }\n\n    return entries;\n}\n","// ============================================================================\n// Route Call Builder (Structured Input API)\n// ============================================================================\n\nimport type { RouteDef, Router } from '@spfn/core/route';\nimport type {\n    CallOptions,\n    ExtractRoutes,\n    InferRouteInput,\n    InferRouteOutput,\n    RequestInterceptor,\n    ResponseInterceptor,\n} from './types';\n\n/**\n * Pick only non-empty fields from StructuredInput\n *\n * This removes fields that are empty objects `{}` from the input type,\n * so users only need to provide fields that are actually defined in the route.\n */\ntype PickNonEmpty<T> = {\n    [K in keyof T as T[K] extends Record<string, never> ? never : K]: T[K];\n};\n\n/**\n * Make fields that can be undefined into optional fields\n *\n * When a field is defined as `Type.Optional(Type.Object({...}))`,\n * the resulting type is `T | undefined`. This utility converts such fields\n * into proper optional fields (`field?: T`) so users don't need to pass them.\n */\ntype MakeOptionalIfUndefinable<T> =\n    // Required fields (undefined is not assignable)\n    { [K in keyof T as undefined extends T[K] ? never : K]: T[K] }\n    // Optional fields (undefined is assignable)\n    & { [K in keyof T as undefined extends T[K] ? K : never]?: Exclude<T[K], undefined> };\n\n/**\n * Clean structured input - only include fields that have actual schema,\n * and make fields optional if they accept undefined\n */\ntype CleanStructuredInput<TInput> = MakeOptionalIfUndefinable<PickNonEmpty<TInput>>;\n\n/**\n * Check if input has any required fields\n *\n * Returns false if all fields are optional (i.e., {} is assignable to the input type)\n */\ntype HasAnyRequiredFields<TInput> = {} extends CleanStructuredInput<TInput> ? false : true;\n\n/**\n * Largest delay `setTimeout` honours; a longer one fires immediately\n */\nconst MAX_TIMEOUT_MS = 2147483647;\n\n/**\n * Route call builder with structured input API\n *\n * Input is structured with explicit params, query, body fields\n * that match the server-side route definition.\n *\n * @example\n * ```typescript\n * // GET /users/:id - params only\n * const user = await api.getUser.call({ params: { id: '1' } });\n *\n * // GET /users/:id?include=posts - params + query\n * const user = await api.getUser.call({\n *     params: { id: '1' },\n *     query: { include: 'posts' }\n * });\n *\n * // POST /users - body only\n * const user = await api.createUser.call({\n *     body: { name: 'John', email: 'john@example.com' }\n * });\n *\n * // PUT /users/:id - params + body\n * const user = await api.updateUser.call({\n *     params: { id: '1' },\n *     body: { name: 'Jane' }\n * });\n *\n * // With options (headers, cookies, Next.js caching)\n * const user = await api.getUser\n *     .headers({ 'X-Custom': 'value' })\n *     .fetchOptions({ next: { revalidate: 60 } })\n *     .call({ params: { id: '1' } });\n * ```\n */\nexport class RouteCallBuilder<\n    TInput,\n    TOutput,\n>\n{\n    private _headers?: Record<string, string>;\n    private _cookies?: Record<string, string>;\n    private _fetchOptions?: RequestInit;\n    private _timeout?: number;\n    private _onRequest?: RequestInterceptor;\n    private _onResponse?: ResponseInterceptor;\n\n    constructor(\n        private readonly executor: (input: any, options: CallOptions) => Promise<TOutput>,\n        private readonly routeName: string,\n    ) \n    {}\n\n    /**\n     * Clone builder\n     */\n    private clone(): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = new RouteCallBuilder<TInput, TOutput>(\n            this.executor,\n            this.routeName,\n        );\n        builder._headers = this._headers;\n        builder._cookies = this._cookies;\n        builder._fetchOptions = this._fetchOptions;\n        builder._timeout = this._timeout;\n        builder._onRequest = this._onRequest;\n        builder._onResponse = this._onResponse;\n\n        return builder;\n    }\n\n    /**\n     * Set request headers\n     */\n    headers(headers: Record<string, string>): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._headers = { ...this._headers, ...headers };\n\n        return builder;\n    }\n\n    /**\n     * Set cookies\n     */\n    cookies(cookies: Record<string, string>): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._cookies = { ...this._cookies, ...cookies };\n\n        return builder;\n    }\n\n    /**\n     * Set Next.js fetch options\n     */\n    fetchOptions(options: RequestInit & { next?: { revalidate?: number | false; tags?: string[] } }): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._fetchOptions = { ...this._fetchOptions, ...options };\n\n        return builder;\n    }\n\n    /**\n     * Set this call's timeout in milliseconds, overriding the client-wide one\n     *\n     * Throws a `TypeError`, before any request is made, unless `ms` is a finite number\n     * greater than 0 and at most 2147483647 (the largest delay `setTimeout` honours).\n     */\n    timeout(ms: number): RouteCallBuilder<TInput, TOutput>\n    {\n        if (!Number.isFinite(ms) || ms <= 0 || ms > MAX_TIMEOUT_MS)\n        {\n            throw new TypeError(`timeout must be a finite number of milliseconds in (0, ${MAX_TIMEOUT_MS}], got ${String(ms)}`);\n        }\n\n        const builder = this.clone();\n        builder._timeout = ms;\n\n        return builder;\n    }\n\n    /**\n     * Set request interceptor\n     */\n    onRequest(interceptor: RequestInterceptor): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._onRequest = interceptor;\n\n        return builder;\n    }\n\n    /**\n     * Set response interceptor\n     */\n    onResponse(interceptor: ResponseInterceptor): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._onResponse = interceptor;\n\n        return builder;\n    }\n\n    /**\n     * Execute the API call with structured input\n     *\n     * Input structure matches the server-side route definition:\n     * - params: Path parameters (e.g., { id: '123' } for /users/:id)\n     * - query: Query string parameters\n     * - body: Request body (for POST, PUT, PATCH)\n     */\n    call(input?: CleanStructuredInput<TInput>): Promise<TOutput>\n    {\n        const options: CallOptions = {};\n\n        if (this._headers)\n        {\n            options.headers = this._headers;\n        }\n\n        if (this._cookies)\n        {\n            options.cookies = this._cookies;\n        }\n\n        if (this._fetchOptions)\n        {\n            options.fetchOptions = this._fetchOptions;\n        }\n\n        if (this._timeout !== undefined)\n        {\n            options.timeout = this._timeout;\n        }\n\n        if (this._onRequest)\n        {\n            options.onRequest = this._onRequest;\n        }\n\n        if (this._onResponse)\n        {\n            options.onResponse = this._onResponse;\n        }\n\n        return this.executor(input || {}, options);\n    }\n}\n\n/**\n * Individual route client with structured input API\n */\nexport type RouteClient<TRoute extends RouteDef<any, any>> = {\n    /**\n     * Set request headers\n     */\n    headers(headers: Record<string, string>): RouteClient<TRoute>;\n\n    /**\n     * Set cookies\n     */\n    cookies(cookies: Record<string, string>): RouteClient<TRoute>;\n\n    /**\n     * Set Next.js fetch options\n     */\n    fetchOptions(options: RequestInit & { next?: { revalidate?: number | false; tags?: string[] } }): RouteClient<TRoute>;\n\n    /**\n     * Set this call's timeout in milliseconds, overriding the client-wide one.\n     * Throws a `TypeError` unless `ms` is finite, `> 0` and `<= 2147483647`.\n     */\n    timeout(ms: number): RouteClient<TRoute>;\n\n    /**\n     * Set request interceptor\n     */\n    onRequest(interceptor: RequestInterceptor): RouteClient<TRoute>;\n\n    /**\n     * Set response interceptor\n     */\n    onResponse(interceptor: ResponseInterceptor): RouteClient<TRoute>;\n\n    /**\n     * Execute the API call with structured input\n     *\n     * @example\n     * ```typescript\n     * // GET /users/:id\n     * api.getUser.call({ params: { id: '123' } });\n     *\n     * // PUT /users/:id\n     * api.updateUser.call({ params: { id: '123' }, body: { name: 'Jane' } });\n     * ```\n     */\n    call: HasAnyRequiredFields<InferRouteInput<TRoute>> extends true\n        ? (input: CleanStructuredInput<InferRouteInput<TRoute>>) => Promise<InferRouteOutput<TRoute>>\n        : (input?: CleanStructuredInput<InferRouteInput<TRoute>>) => Promise<InferRouteOutput<TRoute>>;\n};\n\n/**\n * One property per route in a flattened route record.\n *\n * A slot the flattening could not resolve to a route definition is `never`, as it was\n * before nesting was flattened — a record whose values are neither routes nor routers\n * names nothing callable.\n */\ntype RouteClients<TRoutes> = {\n    [K in keyof TRoutes]: TRoutes[K] extends RouteDef<any, any, any>\n        ? RouteClient<TRoutes[K]>\n        : never;\n};\n\n/**\n * Typed client for entire router\n *\n * One flat namespace, holding the same route names the server registers. A route\n * declared inside a nested `defineRouter` is reached by its own key — `api.getThing`,\n * never `api.group.getThing` — because that is the name `registerRoutes` mounts it\n * under, the name the RPC proxy resolves, and the name `RouterOutput` takes. The group\n * key is not a route and naming it is a compile error.\n *\n * @example\n * ```typescript\n * const appRouter = defineRouter({\n *     getRoot,\n *     users: defineRouter({ getUser }),\n * });\n *\n * const api = createApi<typeof appRouter>();\n *\n * await api.getUser.call({ params: { id: '1' } });   // not api.users.getUser\n * ```\n *\n * A name two branches both declare is left out of the namespace rather than resolved to\n * one of them — the same collision `RouterOutput` refuses. Routes mounted with\n * `.packages()` are deliberately absent: a package publishes its own route map and its\n * own client (`authApi`, `cmsApi`), and that is what calls them.\n */\nexport type Client<TRouter extends Router<any>> = RouteClients<ExtractRoutes<TRouter>>;\n","/**\n * Type-Safe RPC-Style Client with Structured Input API\n *\n * Provides full end-to-end type safety from server routes to client calls.\n * No metadata codegen required - method/path resolution happens at the proxy layer.\n *\n * @example\n * ```typescript\n * // Server\n * export const appRouter = defineRouter({\n *   getUser: route.get('/users/:id')\n *     .input({ params: Type.Object({ id: Type.String() }) })\n *     .handler(async (c) => { ... }),\n *   createUser: route.post('/users')\n *     .input({ body: Type.Object({ name: Type.String() }) })\n *     .handler(async (c) => { ... }),\n * });\n *\n * export type AppRouter = typeof appRouter;\n *\n * // Client - no metadata needed!\n * const api = createApi<AppRouter>();\n *\n * // ✅ GET (no body) - becomes GET /api/rpc/getUser?input={...}\n * const user = await api.getUser.call({ params: { id: '1' } });\n *\n * // ✅ POST (has body) - becomes POST /api/rpc/createUser\n * const newUser = await api.createUser.call({ body: { name: 'John' } });\n *\n * // ✅ With options (headers, cookies, interceptors)\n * const user = await api.getUser\n *   .headers({ 'X-Custom': 'value' })\n *   .cookies({ session: 'xxx' })\n *   .fetchOptions({ next: { revalidate: 60 } })\n *   .call({ params: { id: '1' } });\n * ```\n */\nimport { env } from '@spfn/core/config';\nimport { ErrorRegistry, errorRegistry as coreErrorRegistry } from '@spfn/core/errors';\nimport { logger } from '@spfn/core/logger';\nimport type { Router } from '@spfn/core/route';\nimport * as debugLogs from './debug-logs';\nimport { ApiError } from './errors';\nimport {\n    fetchInAbortScope,\n    handleErrorResponse,\n    buildCookieHeader,\n    autoDetectServerCookies,\n} from './helpers';\nimport { CSRF_HEADER, csrfHeaderValue, documentCookieEntries } from './csrf';\nimport { RouteCallBuilder } from './builder';\nimport type { ScopedFetchResult } from './helpers';\nimport type { ApiConfig, CallOptions } from './types';\nimport type { Client } from './builder';\n\nconst apiLogger = logger.child('@spfn/core:api-client');\n\n/**\n * Where a failed call went, for the log line its transport error writes\n */\ninterface CallSite\n{\n    route: string;\n    method: string;\n    url: string;\n}\n\n/**\n * Classify a failed fetch by the abort cause its scope recorded\n *\n * - timeout → 408 `'timeout'`, reporting the applied timeout\n * - caller abort → status 0 `'aborted'`, the signal's reason as `cause`; logged at debug\n *   level, since it is the caller's own intent\n * - no cause recorded but the error is a plain `AbortError` (a custom `fetch` aborting its\n *   own controller, with neither our timer nor the caller's signal involved) → 408\n *   `'timeout'`, as it always was before the scope recorded a cause\n * - anything else → status 0 `'network'`\n */\nfunction transportError(\n    failure: Extract<ScopedFetchResult, { ok: false }>,\n    site: CallSite,\n    timeout: number,\n): ApiError\n{\n    if (failure.cause === 'timeout')\n    {\n        apiLogger.error('Request timeout', { ...site, timeout });\n\n        return new ApiError(`Request timeout after ${timeout}ms`, 408, site.url, undefined, 'timeout');\n    }\n\n    if (failure.cause === 'caller')\n    {\n        apiLogger.debug('Request aborted by caller', site);\n\n        return new ApiError('Request aborted', 0, site.url, undefined, 'aborted', { cause: failure.error });\n    }\n\n    const { error } = failure;\n\n    if (error instanceof Error && error.name === 'AbortError')\n    {\n        apiLogger.error('Request timeout', { ...site, timeout });\n\n        return new ApiError(`Request timeout after ${timeout}ms`, 408, site.url, undefined, 'timeout');\n    }\n\n    const errorMessage = error instanceof Error ? error.message : 'Network error';\n    apiLogger.error('Network error', {\n        ...site,\n        error: errorMessage,\n        errorName: error instanceof Error ? error.name : 'unknown',\n    });\n\n    return new ApiError(errorMessage, 0, site.url, undefined, 'network');\n}\n\n// ============================================================================\n// Client Implementation\n// ============================================================================\n\n/**\n * Create type-safe RPC client\n *\n * No metadata required - the client sends routeName + input to the proxy,\n * and the proxy resolves the actual HTTP method and path from the router.\n *\n * @example\n * ```typescript\n * // Client - no metadata needed!\n * const api = createApi<AppRouter>();\n *\n * // GET request (no body) - browser cacheable\n * const user = await api.getUser.call({ params: { id: '1' } });\n *\n * // POST request (has body)\n * const newUser = await api.createUser.call({ body: { name: 'John' } });\n * ```\n */\nexport function createApi<TRouter extends Router<any>>(\n    config: ApiConfig = {},\n): Client<TRouter>\n{\n    const {\n        baseUrl = '/api/rpc',\n        headers: defaultHeaders = {},\n        timeout = env.SERVER_TIMEOUT,\n        fetch: customFetch = fetch,\n        onRequest: globalOnRequest,\n        onResponse: globalOnResponse,\n        errorRegistry: errorRegistryConfig,\n        debug = false,\n    } = config;\n\n    // Normalize errorRegistry: always include coreErrorRegistry\n    const errorRegistry = Array.isArray(errorRegistryConfig)\n        ? new ErrorRegistry([coreErrorRegistry, ...errorRegistryConfig])\n        : errorRegistryConfig ?? coreErrorRegistry;\n\n    if (debug)\n    {\n        apiLogger.debug('API client initialized', { baseUrl });\n    }\n\n    /**\n     * Execute API call\n     *\n     * Determines GET vs POST based on body/formData presence:\n     * - No body/formData → GET /api/rpc/{routeName}?input={...}\n     * - Has body → POST /api/rpc/{routeName} with JSON body\n     * - Has formData → POST /api/rpc/{routeName} with multipart/form-data\n     */\n    async function executeCall(\n        routeName: string,\n        input: any = {},\n        options: CallOptions = {},\n    ): Promise<any>\n    {\n        const hasBody = input.body !== undefined;\n        const hasFormData = input.formData !== undefined && Object.keys(input.formData).length > 0;\n        const method = (hasBody || hasFormData) ? 'POST' : 'GET';\n\n        // Build full URL - handle SSR case where SPFN_APP_URL might not be set\n        let appUrl = env.SPFN_APP_URL || '';\n\n        // In SSR environment, if SPFN_APP_URL is not set, try to get host from request headers\n        if (!appUrl && typeof window === 'undefined')\n        {\n            try\n            {\n                const { headers } = await import('next/headers');\n                const headersList = await headers();\n                const host = headersList.get('host');\n                const protocol = headersList.get('x-forwarded-proto') || 'http';\n                if (host)\n                {\n                    appUrl = `${protocol}://${host}`;\n                    if (debug)\n                    {\n                        apiLogger.debug(`Auto-detected app URL from headers: ${appUrl}`);\n                    }\n                }\n            }\n            catch\n            {\n                // Fallback: use relative URL and let fetch handle it\n                if (debug)\n                {\n                    apiLogger.warn('Could not determine app URL in SSR environment, using relative URL');\n                }\n            }\n        }\n\n        // Build URL based on method\n        let fullUrl: string;\n        if (method === 'GET')\n        {\n            // GET: encode input in query string\n            const inputParam = encodeURIComponent(JSON.stringify(input));\n            fullUrl = `${appUrl}${baseUrl}/${routeName}?input=${inputParam}`;\n        }\n        else\n        {\n            // POST: input goes in body\n            fullUrl = `${appUrl}${baseUrl}/${routeName}`;\n        }\n\n        // Prepare headers\n        // Note: Don't set Content-Type for formData - browser sets it with boundary\n        const headers: Record<string, string> = {\n            ...(hasFormData ? {} : { 'Content-Type': 'application/json' }),\n            ...defaultHeaders,\n            ...options.headers,\n        };\n\n        // Auto-detect server cookies and merge with user-provided cookies\n        const autoDetectedCookies = await autoDetectServerCookies();\n        const cookiesToSend = {\n            ...autoDetectedCookies,\n            ...(options.cookies || {}),\n        };\n\n        // Add Cookie header if we have cookies to send\n        if (Object.keys(cookiesToSend).length > 0)\n        {\n            headers['Cookie'] = buildCookieHeader(cookiesToSend);\n        }\n\n        // Mirror the readable CSRF cookie into a header, from the browser jar or\n        // — server-side — from the jar being forwarded.\n        //\n        // Carried on GET calls too, deliberately: the wire method here is chosen\n        // by whether the input has a body, not by what the route does. A bodyless\n        // mutation (`api.logout.call({})`) travels as GET and the proxy still\n        // forwards it as the route's POST, so a GET-shaped call can be exactly\n        // the request that needs the header. The proxy decides what to check from\n        // the resolved route method, and ignores the header on safe routes.\n        const csrfToken = csrfHeaderValue(\n            typeof window === 'undefined' ? Object.entries(cookiesToSend) : documentCookieEntries(),\n        );\n\n        const csrfSetByCaller = Object.keys(headers).some(name => name.toLowerCase() === CSRF_HEADER);\n\n        if (csrfToken && !csrfSetByCaller)\n        {\n            headers[CSRF_HEADER] = csrfToken;\n        }\n\n        // Log cookie auto-detection if debug enabled\n        if (debug && Object.keys(autoDetectedCookies).length > 0)\n        {\n            const cookieArray = Object.entries(autoDetectedCookies).map(([name, value]) => ({ name, value }));\n            debugLogs.logCookieAutoDetection(apiLogger, cookieArray);\n        }\n\n        // Build request init\n        const requestInit: RequestInit = {\n            method,\n            headers,\n            ...options.fetchOptions,\n        };\n\n        // Add body for POST\n        if (method === 'POST')\n        {\n            if (hasFormData)\n            {\n                // Build FormData for file uploads\n                const formData = new FormData();\n\n                // Add non-formData fields (params, query, headers, cookies) as JSON metadata\n                const metadata: Record<string, any> = {};\n                if (input.params) metadata.params = input.params;\n                if (input.query) metadata.query = input.query;\n                if (input.headers) metadata.headers = input.headers;\n                if (input.cookies) metadata.cookies = input.cookies;\n\n                if (Object.keys(metadata).length > 0)\n                {\n                    formData.append('__metadata', JSON.stringify(metadata));\n                }\n\n                // Add formData fields\n                for (const [key, value] of Object.entries(input.formData))\n                {\n                    if (value instanceof File)\n                    {\n                        formData.append(key, value);\n                    }\n                    else if (Array.isArray(value))\n                    {\n                        // Handle array of files or values\n                        for (const item of value)\n                        {\n                            if (item instanceof File)\n                            {\n                                formData.append(key, item);\n                            }\n                            else\n                            {\n                                formData.append(key, String(item));\n                            }\n                        }\n                    }\n                    else if (value !== undefined && value !== null)\n                    {\n                        formData.append(key, String(value));\n                    }\n                }\n\n                requestInit.body = formData;\n            }\n            else\n            {\n                requestInit.body = JSON.stringify(input);\n            }\n        }\n\n        // Execute request interceptors\n        let init = requestInit;\n        if (globalOnRequest)\n        {\n            init = await globalOnRequest(fullUrl, init);\n        }\n        if (options.onRequest)\n        {\n            init = await options.onRequest(fullUrl, init);\n        }\n\n        if (debug)\n        {\n            debugLogs.logRequest(apiLogger, routeName, method, fullUrl, !!init.body);\n        }\n\n        // Execute fetch and parse the body inside one abort scope\n        const appliedTimeout = options.timeout ?? timeout;\n        const fetched = await fetchInAbortScope(fullUrl, init, appliedTimeout, customFetch);\n\n        if (!fetched.ok)\n        {\n            throw transportError(fetched, { route: routeName, method, url: fullUrl }, appliedTimeout);\n        }\n\n        let { response, body } = fetched;\n\n        // Execute global + local response interceptors\n        //\n        // These run outside the abort scope on purpose. That scope classifies a transport\n        // failure, and an interceptor throwing is not one: Next.js implements `redirect()`\n        // and `notFound()` by throwing an error carrying a digest, and an interceptor\n        // raising a domain error of its own is not a transport failure either. Run inside\n        // it, every one of those became `ApiError(..., 0, ..., 'network')` — the\n        // navigation never happened and the caller was handed a network failure that never\n        // occurred, which retry and offline handling keyed on `errorType === 'network'`\n        // act on.\n        if (globalOnResponse)\n        {\n            const result = await globalOnResponse(response, body);\n            response = result.response;\n            body = result.body;\n        }\n        if (options.onResponse)\n        {\n            const result = await options.onResponse(response, body);\n            response = result.response;\n            body = result.body;\n        }\n\n        if (debug)\n        {\n            debugLogs.logResponse(apiLogger, routeName, response.status, !!body);\n        }\n\n        // Handle error responses\n        if (!response.ok)\n        {\n            await handleErrorResponse(response, body, fullUrl, errorRegistry, debug, apiLogger);\n        }\n\n        return body;\n    }\n\n    /**\n     * Build client proxy\n     *\n     * Every property access returns a `RouteCallBuilder` for that one property read as a\n     * whole route name, and that name goes on the wire as `/api/rpc/{routeName}`. The\n     * proxy route resolves it against the generated route map, whose names are flat.\n     *\n     * Nesting needs nothing here: `registerRoutes` mounts a route declared inside a\n     * nested `defineRouter` under its own key, so `api.getThing` is the call for a nested\n     * `getThing` exactly as for a top-level one — which is the namespace `Client` types.\n     * There is no dot-notation traversal: a property access never returns another proxy,\n     * so `api.group.getThing` reads a property of a builder and is `undefined`.\n     *\n     * `prefix` is vestigial — nothing passes one, and adding a caller that did would\n     * build a dotted name the route map cannot resolve.\n     */\n    function buildProxy(prefix = ''): any\n    {\n        return new Proxy(\n            {},\n            {\n                get(_target, prop: string)\n                {\n                    const currentPath = prefix ? `${prefix}.${prop}` : prop;\n\n                    // Return RouteCallBuilder that can either be called or chained\n                    return new RouteCallBuilder(\n                        (input: any, options: CallOptions) => executeCall(currentPath, input, options),\n                        currentPath,\n                    );\n                },\n            },\n        );\n    }\n\n    return buildProxy() as Client<TRouter>;\n}\n"]}
+{"version":3,"sources":["../../src/nextjs/client/debug-logs.ts","../../src/nextjs/client/errors.ts","../../src/nextjs/shared.ts","../../src/nextjs/client/helpers.ts","../../src/nextjs/client/csrf.ts","../../src/nextjs/client/builder.ts","../../src/nextjs/client/core.ts"],"names":["logger","errorRegistry","coreErrorRegistry","headers"],"mappings":";;;;;;;AAMO,SAAS,sBAAA,CACZA,SACA,OAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,sDAAA,EAAwD;AAAA,IACjE,aAAa,OAAA,CAAQ,MAAA;AAAA,IACrB,WAAA,EAAa,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,KAAK,EAAE,IAAI;AAAA,GACvC,CAAA;AACL;AAEO,SAAS,UAAA,CACZA,OAAAA,EACA,SAAA,EACA,MAAA,EACA,KACA,OAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,gBAAA,EAAa;AAAA,IACtB,KAAA,EAAO,SAAA;AAAA,IACP,MAAA;AAAA,IACA,GAAA;AAAA,IACA;AAAA,GACH,CAAA;AACL;AAEO,SAAS,WAAA,CACZA,OAAAA,EACA,SAAA,EACA,MAAA,EACA,OAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,iBAAA,EAAc;AAAA,IACvB,KAAA,EAAO,SAAA;AAAA,IACP,MAAA;AAAA,IACA;AAAA,GACH,CAAA;AACL;AAEO,SAAS,gBAAA,CACZA,OAAAA,EACA,MAAA,EACA,IAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,yBAAA,EAA2B;AAAA,IACpC,MAAA;AAAA,IACA,OAAA,EAAS,CAAC,CAAC,IAAA;AAAA,IACX,UAAU,OAAO,IAAA;AAAA,IACjB,YAAA,EAAc,IAAA,IAAQ,OAAO,IAAA,KAAS,YAAY,QAAA,IAAY,IAAA;AAAA,IAC9D,WAAW,IAAA,EAAM;AAAA,GACpB,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,OAAAA,EACA,SAAA,EACA,eAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,kCAAA,EAAoC;AAAA,IAC7C,SAAA;AAAA,IACA,WAAA,EAAa,IAAA;AAAA,IACb;AAAA,GACH,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,SACA,KAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,iCAAA,EAAmC;AAAA,IAC5C,WAAW,KAAA,EAAO,IAAA;AAAA,IAClB,gBAAA,EAAkB,OAAO,WAAA,CAAY,IAAA;AAAA,IACrC,SAAS,KAAA,EAAO;AAAA,GACnB,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,SACA,KAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,wBAAA,EAA0B;AAAA,IACnC,SAAA,EAAW,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,IAAA,GAAO,SAAA;AAAA,IACjD,cAAc,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK;AAAA,GACtE,CAAA;AACL;AAEO,SAAS,8BAAA,CACZA,OAAAA,EACA,aAAA,EACA,IAAA,EAEJ;AACI,EAAA,MAAM,MAAA,GAAS,CAAC,aAAA,GACV,aAAA,GACA,CAAC,IAAA,GACG,SAAA,GACA,OAAO,IAAA,KAAS,QAAA,GACZ,iBAAA,GACA,EAAE,QAAA,IAAY,QACV,iBAAA,GACA,SAAA;AAElB,EAAAA,OAAAA,CAAO,KAAA,CAAM,gCAAA,EAAkC,EAAE,QAAQ,CAAA;AAC7D;AAEO,SAAS,4BAAA,CACZA,SACA,KAAA,EAEJ;AACI,EAAAA,OAAAA,CAAO,MAAM,6BAAA,EAA+B;AAAA,IACxC,WAAW,KAAA,CAAM,IAAA;AAAA,IACjB,oBAAA,EAAsB,MAAM,WAAA,CAAY,IAAA;AAAA,IACxC,SAAA,EAAW,MAAA,CAAO,cAAA,CAAe,KAAK,EAAE,WAAA,CAAY;AAAA,GACvD,CAAA;AACL;;;AClHO,IAAM,QAAA,GAAN,cAAuB,KAAA,CAC9B;AAAA,EACI,YACI,OAAA,EACgB,MAAA,EACA,GAAA,EACA,QAAA,EACA,WAChB,OAAA,EAEJ;AACI,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AAPN,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAKhB,IAAA,IAAA,CAAK,IAAA,GAAO,UAAA;AAAA,EAChB;AACJ;;;ACkCO,SAAS,kBAAkB,OAAA,EAClC;AACI,EAAA,OAAO,OAAO,OAAA,CAAQ,OAAO,CAAA,CACxB,GAAA,CAAI,CAAC,CAAC,GAAA,EAAK,KAAK,CAAA,KAAM,GAAG,GAAG,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,CAAA,CACvC,KAAK,IAAI,CAAA;AAClB;AAUA,eAAsB,kBAAkB,QAAA,EACxC;AAEI,EAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EACxB;AACI,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAEvD,EAAA,IAAI,WAAA,EAAa,QAAA,CAAS,kBAAkB,CAAA,EAC5C;AACI,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,IAAA,OAAO,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,GAAI,IAAA;AAAA,EACrC,CAAA,MAEA;AACI,IAAA,OAAO,MAAM,SAAS,IAAA,EAAK;AAAA,EAC/B;AACJ;;;ACtFA,IAAM,YAAA,GAAe,MAAA,CAAO,KAAA,CAAM,yBAAyB,CAAA;AAM3D,eAAsB,uBAAA,GACtB;AAEI,EAAA,IAAI,OAAO,WAAW,WAAA,EACtB;AACI,IAAA,OAAO,EAAC;AAAA,EACZ;AAEA,EAAA,IACA;AAEI,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,OAAO,iBAAiB,CAAA;AAClD,IAAA,MAAM,WAAA,GAAc,MAAM,OAAA,EAAQ;AAClC,IAAA,MAAM,UAAA,GAAa,YAAY,MAAA,EAAO;AAEtC,IAAA,MAAM,SAAS,MAAA,CAAO,WAAA;AAAA,MAClB,UAAA,CAAW,IAAI,CAAA,MAAA,KAAU,CAAC,OAAO,IAAA,EAAM,MAAA,CAAO,KAAK,CAAC;AAAA,KACxD;AAEA,IAAA,YAAA,CAAa,MAAM,yBAAA,EAA2B;AAAA,MAC1C,OAAO,UAAA,CAAW,MAAA;AAAA,MAClB,KAAA,EAAO,UAAA,CAAW,GAAA,CAAI,CAAA,CAAA,KAAK,EAAE,IAAI;AAAA,KACpC,CAAA;AAED,IAAA,OAAO,MAAA;AAAA,EACX,SACO,KAAA,EACP;AAGI,IAAA,MAAM,GAAA,GAAM,KAAA;AACZ,IAAA,YAAA,CAAa,KAAK,+BAAA,EAAiC;AAAA,MAC/C,SAAS,GAAA,CAAI,OAAA;AAAA,MACb,MAAM,GAAA,CAAI;AAAA,KACb,CAAA;AAED,IAAA,OAAO,EAAC;AAAA,EACZ;AACJ;AAwBA,SAAS,cAAA,CAAe,cAAuC,OAAA,EAC/D;AACI,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,IAAI,KAAA;AAEJ,EAAA,MAAM,KAAA,GAAQ,CAAC,MAAA,EAAoB,MAAA,KACnC;AACI,IAAA,KAAA,KAAU,MAAA;AACV,IAAA,UAAA,CAAW,MAAM,MAAM,CAAA;AAAA,EAC3B,CAAA;AACA,EAAA,MAAM,aAAA,GAAgB,MAAM,KAAA,CAAM,QAAA,EAAU,cAAc,MAAM,CAAA;AAChE,EAAA,MAAM,YAAY,UAAA,CAAW,MAAM,KAAA,CAAM,SAAS,GAAG,OAAO,CAAA;AAE5D,EAAA,YAAA,EAAc,iBAAiB,OAAA,EAAS,aAAA,EAAe,EAAE,IAAA,EAAM,MAAM,CAAA;AAErE,EAAA,OAAO;AAAA,IACH,QAAQ,UAAA,CAAW,MAAA;AAAA,IACnB,OAAO,MAAM,KAAA;AAAA,IACb,SAAA,EAAW,MAAM,YAAA,CAAa,SAAS,CAAA;AAAA,IACvC,OAAO,MACP;AACI,MAAA,YAAA,CAAa,SAAS,CAAA;AACtB,MAAA,YAAA,EAAc,mBAAA,CAAoB,SAAS,aAAa,CAAA;AAAA,IAC5D;AAAA,GACJ;AACJ;AAcA,eAAsB,iBAAA,CAClB,GAAA,EACA,IAAA,EACA,OAAA,EACA,cAA4B,KAAA,EAEhC;AACI,EAAA,MAAM,YAAA,GAAe,KAAK,MAAA,IAAU,MAAA;AAEpC,EAAA,IAAI,cAAc,OAAA,EAClB;AACI,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAO,YAAA,CAAa,MAAA,EAAQ,OAAO,QAAA,EAAS;AAAA,EACpE;AAEA,EAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,YAAA,EAAc,OAAO,CAAA;AAElD,EAAA,IACA;AACI,IAAA,MAAM,QAAA,GAAW,MAAM,WAAA,CAAY,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,KAAA,CAAM,MAAA,EAAQ,CAAA;AAEzE,IAAA,KAAA,CAAM,SAAA,EAAU;AAEhB,IAAA,MAAM,IAAA,GAAO,MAAM,iBAAA,CAAkB,QAAQ,CAAA;AAE7C,IAAA,IAAI,KAAA,CAAM,KAAA,EAAM,KAAM,QAAA,EACtB;AACI,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAO,YAAA,EAAc,MAAA,EAAQ,OAAO,QAAA,EAAS;AAAA,IACrE;AAEA,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,QAAA,EAAU,IAAA,EAAK;AAAA,EACtC,SACO,KAAA,EACP;AACI,IAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,EAAM;AAE1B,IAAA,OAAO,EAAE,IAAI,KAAA,EAAO,KAAA,EAAO,OAAO,KAAA,KAAU,QAAA,GAAW,YAAA,EAAc,MAAA,GAAS,KAAA,EAAM;AAAA,EACxF,CAAA,SACA;AAEI,IAAA,KAAA,CAAM,KAAA,EAAM;AAAA,EAChB;AACJ;AA0BO,SAAS,kBACZ,QAAA,EACA,IAAA,EACA,OAAA,EACA,aAAA,EACA,OACAA,OAAAA,EAEJ;AACI,EAAA,IAAI,KAAA,EACJ;AACI,IAAU,gBAAA,CAAiBA,OAAAA,EAAQ,QAAA,CAAS,MAAA,EAAQ,IAAI,CAAA;AAAA,EAC5D;AAEA,EAAA,MAAM,iBAAA,GAAoB,0BAAA,CAA2B,IAAA,EAAM,aAAA,EAAe,OAAOA,OAAM,CAAA;AAEvF,EAAA,IAAI,iBAAA,EACJ;AACI,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,4BAAA,CAA6BA,SAAQ,iBAAiB,CAAA;AAAA,IACpE;AAEA,IAAA,OAAO,iBAAA;AAAA,EACX;AAEA,EAAA,OAAO,gBAAA,CAAiB,QAAA,EAAU,IAAA,EAAM,OAAA,EAASA,OAAM,CAAA;AAC3D;AAMA,SAAS,0BAAA,CACL,IAAA,EACA,aAAA,EACA,KAAA,EACAA,OAAAA,EAEJ;AACI,EAAA,IAAI,CAAC,iBAAiB,CAAC,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,IAAY,EAAE,QAAA,IAAY,IAAA,CAAA,EACzE;AACI,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,8BAAA,CAA+BA,OAAAA,EAAQ,aAAA,EAAe,IAAI,CAAA;AAAA,IACxE;AAEA,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,IAAI,KAAA,EACJ;AACI,IAAU,+BAA+BA,OAAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,aAAA,CAAc,oBAAoB,CAAA;AAAA,EACpG;AAEA,EAAA,IACA;AACI,IAAA,MAAM,iBAAA,GAAoB,aAAA,CAAc,WAAA,CAAY,IAAW,CAAA;AAE/D,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,8BAAA,CAA+BA,SAAQ,iBAAiB,CAAA;AAAA,IACtE;AAEA,IAAA,OAAO,iBAAA;AAAA,EACX,SACO,gBAAA,EACP;AAEI,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,8BAAA,CAA+BA,SAAQ,gBAAgB,CAAA;AAAA,IACrE;AAEA,IAAA,OAAO,IAAA;AAAA,EACX;AACJ;AAKA,SAAS,gBAAA,CAAiB,QAAA,EAAoB,IAAA,EAAW,OAAA,EAAiBA,OAAAA,EAC1E;AACI,EAAA,IAAI,SAAS,MAAA,KAAW,GAAA,IAAO,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAA,EACxD;AACI,IAAAA,OAAAA,CAAO,IAAA;AAAA,MACH;AAAA,KAMJ;AAAA,EACJ;AAEA,EAAA,OAAO,IAAI,QAAA;AAAA,IACP,MAAM,OAAA,IAAW,CAAA,KAAA,EAAQ,SAAS,MAAM,CAAA,EAAA,EAAK,SAAS,UAAU,CAAA,CAAA;AAAA,IAChE,QAAA,CAAS,MAAA;AAAA,IACT,OAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACJ;AACJ;;;AC9QO,IAAM,WAAA,GAAc;AAW3B,IAAM,mBAAA,GAAsB,oBAAA;AAW5B,IAAM,iBAAA,GAAoB,UAAA;AAW1B,IAAM,cAAA,GAAiB,EAAA;AAkBvB,SAAS,iBAAiB,MAAA,EAC1B;AAGI,EAAA,MAAM,SAAS,KAAA,CAAM,IAAA,CAAK,IAAI,GAAA,CAAI,MAAM,CAAC,CAAA;AAEzC,EAAA,IAAI,MAAA,CAAO,UAAU,cAAA,EACrB;AACI,IAAA,OAAO,MAAA;AAAA,EACX;AAEA,EAAA,MAAM,OAAO,cAAA,GAAiB,CAAA;AAE9B,EAAA,OAAO,CAAC,GAAG,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,EAAG,GAAG,MAAA,CAAO,KAAA,CAAM,CAAC,IAAI,CAAC,CAAA;AAC5D;AAcO,SAAS,gBAAgB,OAAA,EAChC;AAMI,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,IAAA,CAAK,OAAO,CAAA,CAC5B,MAAA,CAAO,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,KAAM,mBAAA,CAAoB,KAAK,IAAI,CAAA,IACjD,iBAAA,CAAkB,IAAA,CAAK,KAAK,CAAA,IAC5B,CAAC,KAAA,CAAM,SAAS,GAAG,CAAC,CAAA,CAC1B,GAAA,CAAI,CAAC,GAAG,KAAK,MAAM,KAAK,CAAA;AAE7B,EAAA,MAAM,UAAA,GAAa,iBAAiB,MAAM,CAAA;AAE1C,EAAA,OAAO,WAAW,MAAA,GAAS,CAAA,GAAI,UAAA,CAAW,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA;AAC1D;AAOO,SAAS,qBAAA,GAChB;AACI,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA,IAAe,CAAC,SAAS,MAAA,EACjD;AACI,IAAA,OAAO,EAAC;AAAA,EACZ;AAEA,EAAA,MAAM,UAAmC,EAAC;AAE1C,EAAA,KAAA,MAAW,IAAA,IAAQ,QAAA,CAAS,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAC5C;AACI,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAElC,IAAA,IAAI,YAAY,CAAA,EAChB;AACI,MAAA,OAAA,CAAQ,KAAK,CAAC,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,SAAS,CAAA,CAAE,IAAA,EAAK,EAAG,IAAA,CAAK,MAAM,SAAA,GAAY,CAAC,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAAA,IACpF;AAAA,EACJ;AAEA,EAAA,OAAO,OAAA;AACX;;;ACrFA,IAAM,cAAA,GAAiB,UAAA;AAqChB,IAAM,gBAAA,GAAN,MAAM,iBAAA,CAIb;AAAA,EAQI,WAAA,CACqB,UACA,SAAA,EAErB;AAHqB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAEpB;AAAA,EAXO,QAAA;AAAA,EACA,QAAA;AAAA,EACA,aAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA;AAAA;AAAA;AAAA,EAWA,KAAA,GACR;AACI,IAAA,MAAM,UAAU,IAAI,iBAAA;AAAA,MAChB,IAAA,CAAK,QAAA;AAAA,MACL,IAAA,CAAK;AAAA,KACT;AACA,IAAA,OAAA,CAAQ,WAAW,IAAA,CAAK,QAAA;AACxB,IAAA,OAAA,CAAQ,WAAW,IAAA,CAAK,QAAA;AACxB,IAAA,OAAA,CAAQ,gBAAgB,IAAA,CAAK,aAAA;AAC7B,IAAA,OAAA,CAAQ,WAAW,IAAA,CAAK,QAAA;AACxB,IAAA,OAAA,CAAQ,aAAa,IAAA,CAAK,UAAA;AAC1B,IAAA,OAAA,CAAQ,cAAc,IAAA,CAAK,WAAA;AAE3B,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,OAAA,EACR;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,WAAW,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,GAAG,OAAA,EAAQ;AAElD,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,OAAA,EACR;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,WAAW,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,GAAG,OAAA,EAAQ;AAElD,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,OAAA,EACb;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,gBAAgB,EAAE,GAAG,IAAA,CAAK,aAAA,EAAe,GAAG,OAAA,EAAQ;AAE5D,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,QAAQ,EAAA,EACR;AACI,IAAA,IAAI,CAAC,OAAO,QAAA,CAAS,EAAE,KAAK,EAAA,IAAM,CAAA,IAAK,KAAK,cAAA,EAC5C;AACI,MAAA,MAAM,IAAI,UAAU,CAAA,uDAAA,EAA0D,cAAc,UAAU,MAAA,CAAO,EAAE,CAAC,CAAA,CAAE,CAAA;AAAA,IACtH;AAEA,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,QAAA,GAAW,EAAA;AAEnB,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,UAAU,WAAA,EACV;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,UAAA,GAAa,WAAA;AAErB,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,WAAW,WAAA,EACX;AACI,IAAA,MAAM,OAAA,GAAU,KAAK,KAAA,EAAM;AAC3B,IAAA,OAAA,CAAQ,WAAA,GAAc,WAAA;AAEtB,IAAA,OAAO,OAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,KAAK,KAAA,EACL;AACI,IAAA,MAAM,UAAuB,EAAC;AAE9B,IAAA,IAAI,KAAK,QAAA,EACT;AACI,MAAA,OAAA,CAAQ,UAAU,IAAA,CAAK,QAAA;AAAA,IAC3B;AAEA,IAAA,IAAI,KAAK,QAAA,EACT;AACI,MAAA,OAAA,CAAQ,UAAU,IAAA,CAAK,QAAA;AAAA,IAC3B;AAEA,IAAA,IAAI,KAAK,aAAA,EACT;AACI,MAAA,OAAA,CAAQ,eAAe,IAAA,CAAK,aAAA;AAAA,IAChC;AAEA,IAAA,IAAI,IAAA,CAAK,aAAa,MAAA,EACtB;AACI,MAAA,OAAA,CAAQ,UAAU,IAAA,CAAK,QAAA;AAAA,IAC3B;AAEA,IAAA,IAAI,KAAK,UAAA,EACT;AACI,MAAA,OAAA,CAAQ,YAAY,IAAA,CAAK,UAAA;AAAA,IAC7B;AAEA,IAAA,IAAI,KAAK,WAAA,EACT;AACI,MAAA,OAAA,CAAQ,aAAa,IAAA,CAAK,WAAA;AAAA,IAC9B;AAEA,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,KAAA,IAAS,IAAI,OAAO,CAAA;AAAA,EAC7C;AACJ,CAAA;;;AC9LA,IAAM,SAAA,GAAYA,MAAAA,CAAO,KAAA,CAAM,uBAAuB,CAAA;AAuBtD,SAAS,gBAAA,CACL,SAAA,EACA,OAAA,EACA,MAAA,EACA,KACA,OAAA,EAEJ;AACI,EAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,SAAA,EAAW,QAAQ,KAAA,EAAO,IAAI,QAAA,CAAS,OAAA,EAAS,MAAA,EAAQ,GAAA,EAAK,MAAA,EAAW,SAAA,EAAW,OAAO,CAAA,EAAE;AACpH;AAaA,SAAS,cAAA,CACL,OAAA,EACA,IAAA,EACA,OAAA,EAEJ;AACI,EAAA,IAAI,OAAA,CAAQ,UAAU,SAAA,EACtB;AACI,IAAA,SAAA,CAAU,MAAM,iBAAA,EAAmB,EAAE,GAAG,IAAA,EAAM,SAAS,CAAA;AAEvD,IAAA,OAAO,iBAAiB,SAAA,EAAW,CAAA,sBAAA,EAAyB,OAAO,CAAA,EAAA,CAAA,EAAM,GAAA,EAAK,KAAK,GAAG,CAAA;AAAA,EAC1F;AAEA,EAAA,IAAI,OAAA,CAAQ,UAAU,QAAA,EACtB;AACI,IAAA,SAAA,CAAU,KAAA,CAAM,6BAA6B,IAAI,CAAA;AAEjD,IAAA,OAAO,gBAAA,CAAiB,SAAA,EAAW,iBAAA,EAAmB,CAAA,EAAG,IAAA,CAAK,KAAK,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAO,CAAA;AAAA,EAC/F;AAEA,EAAA,MAAM,EAAE,OAAM,GAAI,OAAA;AAElB,EAAA,IAAI,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,YAAA,EAC7C;AACI,IAAA,SAAA,CAAU,MAAM,iBAAA,EAAmB,EAAE,GAAG,IAAA,EAAM,SAAS,CAAA;AAEvD,IAAA,OAAO,iBAAiB,SAAA,EAAW,CAAA,sBAAA,EAAyB,OAAO,CAAA,EAAA,CAAA,EAAM,GAAA,EAAK,KAAK,GAAG,CAAA;AAAA,EAC1F;AAEA,EAAA,MAAM,YAAA,GAAe,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,eAAA;AAC9D,EAAA,SAAA,CAAU,MAAM,eAAA,EAAiB;AAAA,IAC7B,GAAG,IAAA;AAAA,IACH,KAAA,EAAO,YAAA;AAAA,IACP,SAAA,EAAW,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,IAAA,GAAO;AAAA,GACpD,CAAA;AAED,EAAA,OAAO,gBAAA,CAAiB,SAAA,EAAW,YAAA,EAAc,CAAA,EAAG,KAAK,GAAG,CAAA;AAChE;AAQA,SAAS,aAAA,CAAc,WAAmC,OAAA,EAC1D;AACI,EAAA,IAAI,CAAC,SAAA,EACL;AACI,IAAA;AAAA,EACJ;AAEA,EAAA,IACA;AACI,IAAA,MAAM,QAAA,GAAoB,UAAU,OAAO,CAAA;AAE3C,IAAA,IAAI,UAAA,CAAW,QAAQ,CAAA,EACvB;AACI,MAAA,OAAA,CAAQ,OAAA,CAAQ,QAAQ,CAAA,CAAE,KAAA,CAAM,kBAAkB,CAAA;AAAA,IACtD;AAAA,EACJ,SACO,KAAA,EACP;AACI,IAAA,kBAAA,CAAmB,KAAK,CAAA;AAAA,EAC5B;AACJ;AAEA,SAAS,WAAW,KAAA,EACpB;AACI,EAAA,OAAO,OAAQ,OAAuC,IAAA,KAAS,UAAA;AACnE;AAEA,SAAS,mBAAmB,KAAA,EAC5B;AACI,EAAA,SAAA,CAAU,MAAM,yDAAA,EAA2D;AAAA,IACvE,SAAA,EAAW,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAO,OAAO,KAAA;AAAA,IACxD,cAAc,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK;AAAA,GACtE,CAAA;AACL;AAwBO,SAAS,SAAA,CACZ,MAAA,GAAoB,EAAC,EAEzB;AACI,EAAA,MAAM;AAAA,IACF,OAAA,GAAU,UAAA;AAAA,IACV,OAAA,EAAS,iBAAiB,EAAC;AAAA,IAC3B,UAAU,GAAA,CAAI,cAAA;AAAA,IACd,OAAO,WAAA,GAAc,KAAA;AAAA,IACrB,SAAA,EAAW,eAAA;AAAA,IACX,UAAA,EAAY,gBAAA;AAAA,IACZ,SAAA;AAAA,IACA,aAAA,EAAe,mBAAA;AAAA,IACf,KAAA,GAAQ;AAAA,GACZ,GAAI,MAAA;AAGJ,EAAA,MAAMC,eAAA,GAAgB,KAAA,CAAM,OAAA,CAAQ,mBAAmB,CAAA,GACjD,IAAI,aAAA,CAAc,CAACC,aAAA,EAAmB,GAAG,mBAAmB,CAAC,IAC7D,mBAAA,IAAuBA,aAAA;AAE7B,EAAA,IAAI,KAAA,EACJ;AACI,IAAA,SAAA,CAAU,KAAA,CAAM,wBAAA,EAA0B,EAAE,OAAA,EAAS,CAAA;AAAA,EACzD;AAUA,EAAA,eAAe,YACX,SAAA,EACA,KAAA,GAAa,EAAC,EACd,OAAA,GAAuB,EAAC,EAE5B;AACI,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,KAAS,MAAA;AAC/B,IAAA,MAAM,WAAA,GAAc,MAAM,QAAA,KAAa,MAAA,IAAa,OAAO,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA,CAAE,MAAA,GAAS,CAAA;AACzF,IAAA,MAAM,MAAA,GAAU,OAAA,IAAW,WAAA,GAAe,MAAA,GAAS,KAAA;AAGnD,IAAA,IAAI,MAAA,GAAS,IAAI,YAAA,IAAgB,EAAA;AAGjC,IAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,WAAA,EACjC;AACI,MAAA,IACA;AACI,QAAA,MAAM,EAAE,OAAA,EAAAC,QAAAA,EAAQ,GAAI,MAAM,OAAO,iBAAiB,CAAA;AAClD,QAAA,MAAM,WAAA,GAAc,MAAMA,QAAAA,EAAQ;AAClC,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,GAAA,CAAI,MAAM,CAAA;AACnC,QAAA,MAAM,QAAA,GAAW,WAAA,CAAY,GAAA,CAAI,mBAAmB,CAAA,IAAK,MAAA;AACzD,QAAA,IAAI,IAAA,EACJ;AACI,UAAA,MAAA,GAAS,CAAA,EAAG,QAAQ,CAAA,GAAA,EAAM,IAAI,CAAA,CAAA;AAC9B,UAAA,IAAI,KAAA,EACJ;AACI,YAAA,SAAA,CAAU,KAAA,CAAM,CAAA,oCAAA,EAAuC,MAAM,CAAA,CAAE,CAAA;AAAA,UACnE;AAAA,QACJ;AAAA,MACJ,CAAA,CAAA,MAEA;AAEI,QAAA,IAAI,KAAA,EACJ;AACI,UAAA,SAAA,CAAU,KAAK,oEAAoE,CAAA;AAAA,QACvF;AAAA,MACJ;AAAA,IACJ;AAGA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI,WAAW,KAAA,EACf;AAEI,MAAA,MAAM,UAAA,GAAa,kBAAA,CAAmB,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAC3D,MAAA,OAAA,GAAU,GAAG,MAAM,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,SAAS,UAAU,UAAU,CAAA,CAAA;AAAA,IAClE,CAAA,MAEA;AAEI,MAAA,OAAA,GAAU,CAAA,EAAG,MAAM,CAAA,EAAG,OAAO,IAAI,SAAS,CAAA,CAAA;AAAA,IAC9C;AAIA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACpC,GAAI,WAAA,GAAc,EAAC,GAAI,EAAE,gBAAgB,kBAAA,EAAmB;AAAA,MAC5D,GAAG,cAAA;AAAA,MACH,GAAG,OAAA,CAAQ;AAAA,KACf;AAGA,IAAA,MAAM,mBAAA,GAAsB,MAAM,uBAAA,EAAwB;AAC1D,IAAA,MAAM,aAAA,GAAgB;AAAA,MAClB,GAAG,mBAAA;AAAA,MACH,GAAI,OAAA,CAAQ,OAAA,IAAW;AAAC,KAC5B;AAGA,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,aAAa,CAAA,CAAE,SAAS,CAAA,EACxC;AACI,MAAA,OAAA,CAAQ,QAAQ,CAAA,GAAI,iBAAA,CAAkB,aAAa,CAAA;AAAA,IACvD;AAWA,IAAA,MAAM,SAAA,GAAY,eAAA;AAAA,MACd,OAAO,MAAA,KAAW,WAAA,GAAc,OAAO,OAAA,CAAQ,aAAa,IAAI,qBAAA;AAAsB,KAC1F;AAEA,IAAA,MAAM,eAAA,GAAkB,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,KAAK,CAAA,IAAA,KAAQ,IAAA,CAAK,WAAA,EAAY,KAAM,WAAW,CAAA;AAE5F,IAAA,IAAI,SAAA,IAAa,CAAC,eAAA,EAClB;AACI,MAAA,OAAA,CAAQ,WAAW,CAAA,GAAI,SAAA;AAAA,IAC3B;AAGA,IAAA,IAAI,SAAS,MAAA,CAAO,IAAA,CAAK,mBAAmB,CAAA,CAAE,SAAS,CAAA,EACvD;AACI,MAAA,MAAM,WAAA,GAAc,MAAA,CAAO,OAAA,CAAQ,mBAAmB,EAAE,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,MAAO,EAAE,IAAA,EAAM,OAAM,CAAE,CAAA;AAChG,MAAU,sBAAA,CAAuB,WAAW,WAAW,CAAA;AAAA,IAC3D;AAGA,IAAA,MAAM,WAAA,GAA2B;AAAA,MAC7B,MAAA;AAAA,MACA,OAAA;AAAA,MACA,GAAG,OAAA,CAAQ;AAAA,KACf;AAGA,IAAA,IAAI,WAAW,MAAA,EACf;AACI,MAAA,IAAI,WAAA,EACJ;AAEI,QAAA,MAAM,QAAA,GAAW,IAAI,QAAA,EAAS;AAG9B,QAAA,MAAM,WAAgC,EAAC;AACvC,QAAA,IAAI,KAAA,CAAM,MAAA,EAAQ,QAAA,CAAS,MAAA,GAAS,KAAA,CAAM,MAAA;AAC1C,QAAA,IAAI,KAAA,CAAM,KAAA,EAAO,QAAA,CAAS,KAAA,GAAQ,KAAA,CAAM,KAAA;AACxC,QAAA,IAAI,KAAA,CAAM,OAAA,EAAS,QAAA,CAAS,OAAA,GAAU,KAAA,CAAM,OAAA;AAC5C,QAAA,IAAI,KAAA,CAAM,OAAA,EAAS,QAAA,CAAS,OAAA,GAAU,KAAA,CAAM,OAAA;AAE5C,QAAA,IAAI,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA,CAAE,SAAS,CAAA,EACnC;AACI,UAAA,QAAA,CAAS,MAAA,CAAO,YAAA,EAAc,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,QAC1D;AAGA,QAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA,EACxD;AACI,UAAA,IAAI,iBAAiB,IAAA,EACrB;AACI,YAAA,QAAA,CAAS,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,UAC9B,CAAA,MAAA,IACS,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAC5B;AAEI,YAAA,KAAA,MAAW,QAAQ,KAAA,EACnB;AACI,cAAA,IAAI,gBAAgB,IAAA,EACpB;AACI,gBAAA,QAAA,CAAS,MAAA,CAAO,KAAK,IAAI,CAAA;AAAA,cAC7B,CAAA,MAEA;AACI,gBAAA,QAAA,CAAS,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,IAAI,CAAC,CAAA;AAAA,cACrC;AAAA,YACJ;AAAA,UACJ,CAAA,MAAA,IACS,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAC1C;AACI,YAAA,QAAA,CAAS,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,UACtC;AAAA,QACJ;AAEA,QAAA,WAAA,CAAY,IAAA,GAAO,QAAA;AAAA,MACvB,CAAA,MAEA;AACI,QAAA,WAAA,CAAY,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AAAA,MAC3C;AAAA,IACJ;AAGA,IAAA,IAAI,IAAA,GAAO,WAAA;AACX,IAAA,IAAI,eAAA,EACJ;AACI,MAAA,IAAA,GAAO,MAAM,eAAA,CAAgB,OAAA,EAAS,IAAI,CAAA;AAAA,IAC9C;AACA,IAAA,IAAI,QAAQ,SAAA,EACZ;AACI,MAAA,IAAA,GAAO,MAAM,OAAA,CAAQ,SAAA,CAAU,OAAA,EAAS,IAAI,CAAA;AAAA,IAChD;AAEA,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,UAAA,CAAW,WAAW,SAAA,EAAW,MAAA,EAAQ,SAAS,CAAC,CAAC,KAAK,IAAI,CAAA;AAAA,IAC3E;AAGA,IAAA,MAAM,cAAA,GAAiB,QAAQ,OAAA,IAAW,OAAA;AAC1C,IAAA,MAAM,UAAU,MAAM,iBAAA,CAAkB,OAAA,EAAS,IAAA,EAAM,gBAAgB,WAAW,CAAA;AAElF,IAAA,IAAI,CAAC,QAAQ,EAAA,EACb;AACI,MAAA,MAAM,OAAA,GAAU,cAAA,CAAe,OAAA,EAAS,EAAE,KAAA,EAAO,WAAW,MAAA,EAAQ,GAAA,EAAK,OAAA,EAAQ,EAAG,cAAc,CAAA;AAClG,MAAA,aAAA,CAAc,WAAW,OAAO,CAAA;AAChC,MAAA,MAAM,OAAA,CAAQ,KAAA;AAAA,IAClB;AAEA,IAAA,IAAI,EAAE,QAAA,EAAU,IAAA,EAAK,GAAI,OAAA;AAYzB,IAAA,IAAI,gBAAA,EACJ;AACI,MAAA,MAAM,MAAA,GAAS,MAAM,gBAAA,CAAiB,QAAA,EAAU,IAAI,CAAA;AACpD,MAAA,QAAA,GAAW,MAAA,CAAO,QAAA;AAClB,MAAA,IAAA,GAAO,MAAA,CAAO,IAAA;AAAA,IAClB;AACA,IAAA,IAAI,QAAQ,UAAA,EACZ;AACI,MAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,UAAA,CAAW,UAAU,IAAI,CAAA;AACtD,MAAA,QAAA,GAAW,MAAA,CAAO,QAAA;AAClB,MAAA,IAAA,GAAO,MAAA,CAAO,IAAA;AAAA,IAClB;AAEA,IAAA,IAAI,KAAA,EACJ;AACI,MAAU,YAAY,SAAA,EAAW,SAAA,EAAW,SAAS,MAAA,EAAQ,CAAC,CAAC,IAAI,CAAA;AAAA,IACvE;AAGA,IAAA,IAAI,CAAC,SAAS,EAAA,EACd;AACI,MAAA,MAAM,QAAQ,iBAAA,CAAkB,QAAA,EAAU,MAAM,OAAA,EAASF,eAAA,EAAe,OAAO,SAAS,CAAA;AACxF,MAAA,aAAA,CAAc,SAAA,EAAW,EAAE,EAAA,EAAI,KAAA,EAAO,SAAA,EAAW,QAAQ,MAAA,EAAQ,QAAA,CAAS,MAAA,EAAQ,KAAA,EAAO,CAAA;AACzF,MAAA,MAAM,KAAA;AAAA,IACV;AAEA,IAAA,aAAA,CAAc,WAAW,EAAE,EAAA,EAAI,IAAA,EAAM,QAAA,EAAU,MAAM,CAAA;AAErD,IAAA,OAAO,IAAA;AAAA,EACX;AAkBA,EAAA,SAAS,UAAA,CAAW,SAAS,EAAA,EAC7B;AACI,IAAA,OAAO,IAAI,KAAA;AAAA,MACP,EAAC;AAAA,MACD;AAAA,QACI,GAAA,CAAI,SAAS,IAAA,EACb;AACI,UAAA,MAAM,cAAc,MAAA,GAAS,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,GAAK,IAAA;AAGnD,UAAA,OAAO,IAAI,gBAAA;AAAA,YACP,CAAC,KAAA,EAAY,OAAA,KAAyB,WAAA,CAAY,WAAA,EAAa,OAAO,OAAO,CAAA;AAAA,YAC7E;AAAA,WACJ;AAAA,QACJ;AAAA;AACJ,KACJ;AAAA,EACJ;AAEA,EAAA,OAAO,UAAA,EAAW;AACtB","file":"index.js","sourcesContent":["/**\n * Debug logging utilities for API client\n * Separates debug logging logic from main client code for better maintainability\n */\nimport type { Logger } from '@spfn/core/logger';\n\nexport function logCookieAutoDetection(\n    logger: Logger,\n    cookies: Array<{ name: string; value: string }>,\n): void\n{\n    logger.debug('Auto-detected server environment, forwarding cookies', {\n        cookieCount: cookies.length,\n        cookieNames: cookies.map(c => c.name),\n    });\n}\n\nexport function logRequest(\n    logger: Logger,\n    routeName: string,\n    method: string,\n    url: string,\n    hasBody: boolean,\n): void\n{\n    logger.debug('→ Request', {\n        route: routeName,\n        method,\n        url,\n        hasBody,\n    });\n}\n\nexport function logResponse(\n    logger: Logger,\n    routeName: string,\n    status: number,\n    hasBody: boolean,\n): void\n{\n    logger.debug('← Response', {\n        route: routeName,\n        status,\n        hasBody,\n    });\n}\n\nexport function logErrorResponse(\n    logger: Logger,\n    status: number,\n    body: any,\n): void\n{\n    logger.debug('Error response received', {\n        status,\n        hasBody: !!body,\n        bodyType: typeof body,\n        hasTypeField: body && typeof body === 'object' && '__type' in body,\n        typeValue: body?.__type,\n    });\n}\n\nexport function logErrorDeserializationAttempt(\n    logger: Logger,\n    errorType: string,\n    registeredTypes: string[],\n): void\n{\n    logger.debug('Attempting error deserialization', {\n        errorType,\n        hasRegistry: true,\n        registeredTypes,\n    });\n}\n\nexport function logErrorDeserializationSuccess(\n    logger: Logger,\n    error: Error | null,\n): void\n{\n    logger.debug('Error deserialized successfully', {\n        errorName: error?.name,\n        errorConstructor: error?.constructor.name,\n        message: error?.message,\n    });\n}\n\nexport function logErrorDeserializationFailure(\n    logger: Logger,\n    error: unknown,\n): void\n{\n    logger.debug('Deserialization failed', {\n        errorName: error instanceof Error ? error.name : 'unknown',\n        errorMessage: error instanceof Error ? error.message : String(error),\n    });\n}\n\nexport function logErrorDeserializationSkipped(\n    logger: Logger,\n    errorRegistry: any,\n    body: any,\n): void\n{\n    const reason = !errorRegistry\n        ? 'no registry'\n        : !body\n            ? 'no body'\n            : typeof body !== 'object'\n                ? 'body not object'\n                : !('__type' in body)\n                    ? 'no __type field'\n                    : 'unknown';\n\n    logger.debug('Skipping error deserialization', { reason });\n}\n\nexport function logThrowingDeserializedError(\n    logger: Logger,\n    error: Error,\n): void\n{\n    logger.debug('Throwing deserialized error', {\n        errorName: error.name,\n        errorConstructorName: error.constructor.name,\n        prototype: Object.getPrototypeOf(error).constructor.name,\n    });\n}\n","// ============================================================================\n// Client Error\n// ============================================================================\n\n/**\n * Typed client error\n *\n * `errorType` tells apart why a call failed:\n * - `'http'`: the server answered with a non-2xx status\n * - `'network'`: the fetch or the body read failed (status 0)\n * - `'timeout'`: the call's timeout elapsed before response headers arrived (status 408)\n * - `'aborted'`: the caller's own signal aborted the call (status 0); `cause` is the signal's reason\n */\nexport class ApiError extends Error\n{\n    constructor(\n        message: string,\n        public readonly status: number,\n        public readonly url: string,\n        public readonly response?: unknown,\n        public readonly errorType?: 'http' | 'network' | 'timeout' | 'aborted',\n        options?: { cause?: unknown },\n    )\n    {\n        super(message, options);\n        this.name = 'ApiError';\n    }\n}\n","/**\n * Shared utilities for Next.js client and proxy modules\n *\n * Contains common functions used by both client and proxy to avoid code duplication.\n */\n\n/**\n * Build URL with path parameters replaced\n *\n * @example\n * buildUrlWithParams('/users/:id/posts/:postId', { id: '123', postId: '456' })\n * // Returns: '/users/123/posts/456'\n */\nexport function buildUrlWithParams(path: string, params: Record<string, any>): string\n{\n    let url = path;\n    for (const [key, value] of Object.entries(params))\n    {\n        url = url.replace(`:${key}`, encodeURIComponent(String(value)));\n    }\n\n    return url;\n}\n\n/**\n * Build query string from object\n *\n * @example\n * buildQueryString({ page: '1', limit: '10', tags: ['foo', 'bar'] })\n * // Returns: '?page=1&limit=10&tags=foo&tags=bar'\n */\nexport function buildQueryString(query: Record<string, any>): string\n{\n    if (Object.keys(query).length === 0)\n    {\n        return '';\n    }\n\n    const searchParams = new URLSearchParams();\n    for (const [key, value] of Object.entries(query))\n    {\n        if (Array.isArray(value))\n        {\n            value.forEach((v) => searchParams.append(key, String(v)));\n        }\n        else\n        {\n            searchParams.append(key, String(value));\n        }\n    }\n\n    return `?${searchParams.toString()}`;\n}\n\n/**\n * Build Cookie header string from cookies object\n *\n * @example\n * buildCookieHeader({ session: 'abc123', theme: 'dark' })\n * // Returns: 'session=abc123; theme=dark'\n */\nexport function buildCookieHeader(cookies: Record<string, string>): string\n{\n    return Object.entries(cookies)\n        .map(([key, value]) => `${key}=${value}`)\n        .join('; ');\n}\n\n/**\n * Parse response body based on content type\n *\n * Handles:\n * - 204 No Content: returns null (no body expected)\n * - application/json: parses JSON body\n * - Other content types: returns raw text\n */\nexport async function parseResponseBody(response: Response): Promise<any>\n{\n    // 204 No Content has no body\n    if (response.status === 204)\n    {\n        return null;\n    }\n\n    const contentType = response.headers.get('content-type');\n\n    if (contentType?.includes('application/json'))\n    {\n        const text = await response.text();\n\n        return text ? JSON.parse(text) : null;\n    }\n    else\n    {\n        return await response.text();\n    }\n}\n","import type { Logger } from '@spfn/core/logger';\nimport type { ErrorRegistry } from '@spfn/core/errors';\nimport { logger } from '@spfn/core/logger';\nimport { ApiError } from './errors';\nimport * as debugLogs from './debug-logs';\nimport { parseResponseBody } from '../shared';\n\n// Re-export shared utilities\nexport { buildCookieHeader, parseResponseBody } from '../shared';\n\nconst cookieLogger = logger.child('@spfn/core:auto-cookies');\n\n/**\n * Auto-detect cookies from Next.js server environment\n * Returns empty object if not in server environment or if cookies are not accessible\n */\nexport async function autoDetectServerCookies(): Promise<Record<string, string>>\n{\n    // Client environment — browser sends cookies automatically\n    if (typeof window !== 'undefined')\n    {\n        return {};\n    }\n\n    try\n    {\n        // Next.js cookies() API is only available in server environment\n        const { cookies } = await import('next/headers.js');\n        const cookieStore = await cookies();\n        const allCookies = cookieStore.getAll();\n\n        const result = Object.fromEntries(\n            allCookies.map(cookie => [cookie.name, cookie.value]),\n        );\n\n        cookieLogger.debug('Server cookies detected', {\n            count: allCookies.length,\n            names: allCookies.map(c => c.name),\n        });\n\n        return result;\n    }\n    catch (error)\n    {\n        // Server environment but cookies() not accessible\n        // (e.g. static generation, build time, or outside request context)\n        const err = error as Error;\n        cookieLogger.warn('Failed to read server cookies', {\n            message: err.message,\n            name: err.name,\n        });\n\n        return {};\n    }\n}\n\n/**\n * Why a call was aborted, as recorded by the abort scope that aborted it\n */\nexport type AbortCause = 'timeout' | 'caller';\n\n/**\n * What a fetch run in an abort scope produced: the response and its parsed body,\n * or the failure together with the abort cause the scope recorded, if any. For a\n * caller abort, `error` is the caller signal's reason.\n */\nexport type ScopedFetchResult =\n    | { ok: true; response: Response; body: any }\n    | { ok: false; error: unknown; cause?: AbortCause };\n\n/**\n * One controller that two sources may abort: the call's timer and the caller's signal\n *\n * The first source to fire is recorded as the cause and later ones are ignored, so a\n * caller aborting after the timer fired still reads as a timeout. Composed by hand\n * rather than with `AbortSignal.any` / `AbortSignal.timeout`, which browsers below\n * Safari 17.4 lack.\n */\nfunction openAbortScope(callerSignal: AbortSignal | undefined, timeout: number)\n{\n    const controller = new AbortController();\n    let cause: AbortCause | undefined;\n\n    const abort = (source: AbortCause, reason?: unknown) =>\n    {\n        cause ??= source;\n        controller.abort(reason);\n    };\n    const onCallerAbort = () => abort('caller', callerSignal?.reason);\n    const timeoutId = setTimeout(() => abort('timeout'), timeout);\n\n    callerSignal?.addEventListener('abort', onCallerAbort, { once: true });\n\n    return {\n        signal: controller.signal,\n        cause: () => cause,\n        stopTimer: () => clearTimeout(timeoutId),\n        close: () =>\n        {\n            clearTimeout(timeoutId);\n            callerSignal?.removeEventListener('abort', onCallerAbort);\n        },\n    };\n}\n\n/**\n * Fetch and parse a response inside one abort scope\n *\n * The caller's signal is the one on the final `init`, after interceptors ran. The timer\n * stops when response headers arrive; the caller's abort stays effective until the body\n * is parsed. A failure is returned, not thrown, with the cause the scope recorded —\n * classification reads that record, never the error's name.\n *\n * A custom `fetch`'s body read may not honour the signal at all, so a caller abort during\n * that read can otherwise go unnoticed and the call resolves as if nothing happened. After\n * the body is parsed, the scope is checked again: a recorded `'caller'` cause still wins.\n */\nexport async function fetchInAbortScope(\n    url: string,\n    init: RequestInit,\n    timeout: number,\n    customFetch: typeof fetch = fetch,\n): Promise<ScopedFetchResult>\n{\n    const callerSignal = init.signal ?? undefined;\n\n    if (callerSignal?.aborted)\n    {\n        return { ok: false, error: callerSignal.reason, cause: 'caller' };\n    }\n\n    const scope = openAbortScope(callerSignal, timeout);\n\n    try\n    {\n        const response = await customFetch(url, { ...init, signal: scope.signal });\n\n        scope.stopTimer();\n\n        const body = await parseResponseBody(response);\n\n        if (scope.cause() === 'caller')\n        {\n            return { ok: false, error: callerSignal?.reason, cause: 'caller' };\n        }\n\n        return { ok: true, response, body };\n    }\n    catch (error)\n    {\n        const cause = scope.cause();\n\n        return { ok: false, cause, error: cause === 'caller' ? callerSignal?.reason : error };\n    }\n    finally\n    {\n        scope.close();\n    }\n}\n\n/**\n * Handle error response with deserialization support\n * Attempts to deserialize custom errors if errorRegistry is provided\n * Falls back to ApiError if deserialization fails or is not available\n */\nexport async function handleErrorResponse(\n    response: Response,\n    body: any,\n    fullUrl: string,\n    errorRegistry: ErrorRegistry | undefined,\n    debug: boolean,\n    logger: Logger,\n): Promise<never>\n{\n    throw errorFromResponse(response, body, fullUrl, errorRegistry, debug, logger);\n}\n\n/**\n * The error an answered, non-2xx call ends with — what `handleErrorResponse` throws\n *\n * A body carrying a registered `__type` comes back as that class; anything else as an\n * `ApiError` of type `'http'`. Returned rather than thrown, so the caller can report the\n * very object it is about to throw.\n */\nexport function errorFromResponse(\n    response: Response,\n    body: any,\n    fullUrl: string,\n    errorRegistry: ErrorRegistry | undefined,\n    debug: boolean,\n    logger: Logger,\n): Error\n{\n    if (debug)\n    {\n        debugLogs.logErrorResponse(logger, response.status, body);\n    }\n\n    const deserializedError = deserializeRegisteredError(body, errorRegistry, debug, logger);\n\n    if (deserializedError)\n    {\n        if (debug)\n        {\n            debugLogs.logThrowingDeserializedError(logger, deserializedError);\n        }\n\n        return deserializedError;\n    }\n\n    return fallbackApiError(response, body, fullUrl, logger);\n}\n\n/**\n * Restore the registered error class a body names with `__type`, or null when the body\n * names none or the registry cannot restore it\n */\nfunction deserializeRegisteredError(\n    body: any,\n    errorRegistry: ErrorRegistry | undefined,\n    debug: boolean,\n    logger: Logger,\n): Error | null\n{\n    if (!errorRegistry || !body || typeof body !== 'object' || !('__type' in body))\n    {\n        if (debug)\n        {\n            debugLogs.logErrorDeserializationSkipped(logger, errorRegistry, body);\n        }\n\n        return null;\n    }\n\n    if (debug)\n    {\n        debugLogs.logErrorDeserializationAttempt(logger, body.__type, errorRegistry.getRegisteredTypes());\n    }\n\n    try\n    {\n        const deserializedError = errorRegistry.deserialize(body as any);\n\n        if (debug)\n        {\n            debugLogs.logErrorDeserializationSuccess(logger, deserializedError);\n        }\n\n        return deserializedError;\n    }\n    catch (deserializeError)\n    {\n        // Deserialization itself failed (type not found, invalid data, etc.)\n        if (debug)\n        {\n            debugLogs.logErrorDeserializationFailure(logger, deserializeError);\n        }\n\n        return null;\n    }\n}\n\n/**\n * The generic `'http'` ApiError for an answer no registered class claims\n */\nfunction fallbackApiError(response: Response, body: any, fullUrl: string, logger: Logger): ApiError\n{\n    if (response.status === 404 && process.env.NODE_ENV !== 'production')\n    {\n        logger.warn(\n            '\\n⚠️  404 Not Found\\n\\n' +\n            'Check the following:\\n' +\n            '  1. Routes are registered in server.config.ts:\\n' +\n            '     → defineServerConfig().routes(appRouter)\\n' +\n            '  2. Delete .spfn cache if you recently added new routes:\\n' +\n            '     → rm -rf .spfn\\n',\n        );\n    }\n\n    return new ApiError(\n        body?.message || `HTTP ${response.status}: ${response.statusText}`,\n        response.status,\n        fullUrl,\n        body,\n        'http',\n    );\n}\n","/**\n * CSRF token transport for the RPC client\n *\n * The Next.js proxy sets a readable (non-HttpOnly) cookie carrying an HMAC of\n * the session's key id; this module mirrors it into a request header. The proxy\n * never compares cookie against header — it recomputes the value from the\n * session — so the cookie is transport only and reading it here is not a trust\n * decision. See the CSRF section of the @spfn/auth README.\n */\n\n/**\n * Header the readable CSRF cookie is mirrored into.\n *\n * Must match CSRF_HEADER in @spfn/auth. It is duplicated rather than imported\n * because @spfn/core cannot depend on @spfn/auth.\n */\nexport const CSRF_HEADER = 'x-spfn-csrf';\n\n/**\n * Cookie names carrying a CSRF token.\n *\n * @spfn/auth suffixes its cookie names with the server port so several local dev\n * instances on the same host do not overwrite each other's session, and the\n * browser cannot know that port — so match the family, not one name. Every\n * candidate is sent and the proxy accepts the request if any of them recomputes\n * to the expected value; a candidate an attacker tossed in never will.\n */\nconst CSRF_COOKIE_PATTERN = /^spfn_csrf(_\\d+)?$/;\n\n/**\n * Values that can be put in a header at all: printable ASCII, no space.\n *\n * A cookie jar is attacker-writable in the very case this feature exists for, and\n * `new Headers()` rejects a value outside Latin-1 — so a sibling subdomain that\n * tosses `spfn_csrf=한` would make every RPC call throw before it was sent, not\n * merely fail the check. A genuine token is 64 hex characters; anything that\n * cannot be a header value cannot be one.\n */\nconst HEADER_SAFE_VALUE = /^[!-~]+$/;\n\n/**\n * Upper bound on candidates sent, so a cookie-flooded jar stays a bounded header.\n *\n * Deliberately generous. The server recomputes the expected value once and then\n * only compares fixed-length strings, so extra candidates cost it almost nothing,\n * while every candidate dropped here is a chance to lock the user out of every\n * mutation — the far worse failure. Must not exceed the matching bound in\n * @spfn/auth's `matchesCsrfToken`, or values sent would never be looked at.\n */\nconst MAX_CANDIDATES = 32;\n\n/**\n * Choose which candidates to send when the jar holds more than the cap.\n *\n * `document.cookie` exposes neither Domain nor Path, so a tossed cookie is\n * indistinguishable from the genuine one here — the proxy is what tells them\n * apart, by recomputing. What this can do is refuse to drop the genuine value on\n * the floor. Browsers order the jar by path length descending, then by age\n * ascending, so a flood pushes the genuine cookie towards the end (attacker\n * cookies on a longer path) or towards the start (attacker cookies written later\n * on the same path). Keeping both ends survives either, where a plain prefix\n * survives only one.\n *\n * A jar flooded far past the cap is a denial of service that no client-side\n * choice fully prevents; the structural fix is a `__Host-` prefixed cookie name,\n * which a sibling subdomain cannot write at all.\n */\nfunction selectCandidates(values: string[]): string[]\n{\n    // Identical duplicates carry no extra information, so collapsing them buys\n    // back slots that a flood of one repeated value would otherwise burn.\n    const unique = Array.from(new Set(values));\n\n    if (unique.length <= MAX_CANDIDATES)\n    {\n        return unique;\n    }\n\n    const half = MAX_CANDIDATES / 2;\n\n    return [...unique.slice(0, half), ...unique.slice(-half)];\n}\n\n/**\n * Collect the CSRF token candidates from cookie entries.\n *\n * Takes entries rather than a map because a name can legitimately appear twice:\n * a sibling subdomain that tosses `spfn_csrf` for the parent domain leaves the\n * browser holding two cookies of that name, and folding them into a map would\n * throw away whichever the tossed one displaced — locking the user out of every\n * mutation. Sending both keeps the real one in play, and the tossed one is inert\n * because the proxy recomputes what it expects.\n *\n * @returns Header value (comma-separated), or undefined when no cookie exists\n */\nexport function csrfHeaderValue(cookies: Iterable<[string, string]>): string | undefined\n{\n    // A comma separates candidates on the wire, so a value containing one would\n    // arrive as several. That cannot be a genuine token — they are hex — but it\n    // would let a single tossed cookie spend the receiver's whole candidate\n    // budget and bury the real value behind it. Drop those, and anything that\n    // could not be a header value at all.\n    const values = Array.from(cookies)\n        .filter(([name, value]) => CSRF_COOKIE_PATTERN.test(name)\n            && HEADER_SAFE_VALUE.test(value)\n            && !value.includes(','))\n        .map(([, value]) => value);\n\n    const candidates = selectCandidates(values);\n\n    return candidates.length > 0 ? candidates.join(',') : undefined;\n}\n\n/**\n * Read the browser cookie jar as entries, duplicates preserved.\n *\n * Empty outside a browser (SSR reads the jar it forwards instead).\n */\nexport function documentCookieEntries(): Array<[string, string]>\n{\n    if (typeof document === 'undefined' || !document.cookie)\n    {\n        return [];\n    }\n\n    const entries: Array<[string, string]> = [];\n\n    for (const pair of document.cookie.split(';'))\n    {\n        const separator = pair.indexOf('=');\n\n        if (separator > 0)\n        {\n            entries.push([pair.slice(0, separator).trim(), pair.slice(separator + 1).trim()]);\n        }\n    }\n\n    return entries;\n}\n","// ============================================================================\n// Route Call Builder (Structured Input API)\n// ============================================================================\n\nimport type { RouteDef, Router } from '@spfn/core/route';\nimport type {\n    CallOptions,\n    ExtractRoutes,\n    InferRouteInput,\n    InferRouteOutput,\n    RequestInterceptor,\n    ResponseInterceptor,\n} from './types';\n\n/**\n * Pick only non-empty fields from StructuredInput\n *\n * This removes fields that are empty objects `{}` from the input type,\n * so users only need to provide fields that are actually defined in the route.\n */\ntype PickNonEmpty<T> = {\n    [K in keyof T as T[K] extends Record<string, never> ? never : K]: T[K];\n};\n\n/**\n * Make fields that can be undefined into optional fields\n *\n * When a field is defined as `Type.Optional(Type.Object({...}))`,\n * the resulting type is `T | undefined`. This utility converts such fields\n * into proper optional fields (`field?: T`) so users don't need to pass them.\n */\ntype MakeOptionalIfUndefinable<T> =\n    // Required fields (undefined is not assignable)\n    { [K in keyof T as undefined extends T[K] ? never : K]: T[K] }\n    // Optional fields (undefined is assignable)\n    & { [K in keyof T as undefined extends T[K] ? K : never]?: Exclude<T[K], undefined> };\n\n/**\n * Clean structured input - only include fields that have actual schema,\n * and make fields optional if they accept undefined\n */\ntype CleanStructuredInput<TInput> = MakeOptionalIfUndefinable<PickNonEmpty<TInput>>;\n\n/**\n * Check if input has any required fields\n *\n * Returns false if all fields are optional (i.e., {} is assignable to the input type)\n */\ntype HasAnyRequiredFields<TInput> = {} extends CleanStructuredInput<TInput> ? false : true;\n\n/**\n * Largest delay `setTimeout` honours; a longer one fires immediately\n */\nconst MAX_TIMEOUT_MS = 2147483647;\n\n/**\n * Route call builder with structured input API\n *\n * Input is structured with explicit params, query, body fields\n * that match the server-side route definition.\n *\n * @example\n * ```typescript\n * // GET /users/:id - params only\n * const user = await api.getUser.call({ params: { id: '1' } });\n *\n * // GET /users/:id?include=posts - params + query\n * const user = await api.getUser.call({\n *     params: { id: '1' },\n *     query: { include: 'posts' }\n * });\n *\n * // POST /users - body only\n * const user = await api.createUser.call({\n *     body: { name: 'John', email: 'john@example.com' }\n * });\n *\n * // PUT /users/:id - params + body\n * const user = await api.updateUser.call({\n *     params: { id: '1' },\n *     body: { name: 'Jane' }\n * });\n *\n * // With options (headers, cookies, Next.js caching)\n * const user = await api.getUser\n *     .headers({ 'X-Custom': 'value' })\n *     .fetchOptions({ next: { revalidate: 60 } })\n *     .call({ params: { id: '1' } });\n * ```\n */\nexport class RouteCallBuilder<\n    TInput,\n    TOutput,\n>\n{\n    private _headers?: Record<string, string>;\n    private _cookies?: Record<string, string>;\n    private _fetchOptions?: RequestInit;\n    private _timeout?: number;\n    private _onRequest?: RequestInterceptor;\n    private _onResponse?: ResponseInterceptor;\n\n    constructor(\n        private readonly executor: (input: any, options: CallOptions) => Promise<TOutput>,\n        private readonly routeName: string,\n    ) \n    {}\n\n    /**\n     * Clone builder\n     */\n    private clone(): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = new RouteCallBuilder<TInput, TOutput>(\n            this.executor,\n            this.routeName,\n        );\n        builder._headers = this._headers;\n        builder._cookies = this._cookies;\n        builder._fetchOptions = this._fetchOptions;\n        builder._timeout = this._timeout;\n        builder._onRequest = this._onRequest;\n        builder._onResponse = this._onResponse;\n\n        return builder;\n    }\n\n    /**\n     * Set request headers\n     */\n    headers(headers: Record<string, string>): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._headers = { ...this._headers, ...headers };\n\n        return builder;\n    }\n\n    /**\n     * Set cookies\n     */\n    cookies(cookies: Record<string, string>): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._cookies = { ...this._cookies, ...cookies };\n\n        return builder;\n    }\n\n    /**\n     * Set Next.js fetch options\n     */\n    fetchOptions(options: RequestInit & { next?: { revalidate?: number | false; tags?: string[] } }): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._fetchOptions = { ...this._fetchOptions, ...options };\n\n        return builder;\n    }\n\n    /**\n     * Set this call's timeout in milliseconds, overriding the client-wide one\n     *\n     * Throws a `TypeError`, before any request is made, unless `ms` is a finite number\n     * greater than 0 and at most 2147483647 (the largest delay `setTimeout` honours).\n     */\n    timeout(ms: number): RouteCallBuilder<TInput, TOutput>\n    {\n        if (!Number.isFinite(ms) || ms <= 0 || ms > MAX_TIMEOUT_MS)\n        {\n            throw new TypeError(`timeout must be a finite number of milliseconds in (0, ${MAX_TIMEOUT_MS}], got ${String(ms)}`);\n        }\n\n        const builder = this.clone();\n        builder._timeout = ms;\n\n        return builder;\n    }\n\n    /**\n     * Set request interceptor\n     */\n    onRequest(interceptor: RequestInterceptor): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._onRequest = interceptor;\n\n        return builder;\n    }\n\n    /**\n     * Set response interceptor\n     */\n    onResponse(interceptor: ResponseInterceptor): RouteCallBuilder<TInput, TOutput>\n    {\n        const builder = this.clone();\n        builder._onResponse = interceptor;\n\n        return builder;\n    }\n\n    /**\n     * Execute the API call with structured input\n     *\n     * Input structure matches the server-side route definition:\n     * - params: Path parameters (e.g., { id: '123' } for /users/:id)\n     * - query: Query string parameters\n     * - body: Request body (for POST, PUT, PATCH)\n     */\n    call(input?: CleanStructuredInput<TInput>): Promise<TOutput>\n    {\n        const options: CallOptions = {};\n\n        if (this._headers)\n        {\n            options.headers = this._headers;\n        }\n\n        if (this._cookies)\n        {\n            options.cookies = this._cookies;\n        }\n\n        if (this._fetchOptions)\n        {\n            options.fetchOptions = this._fetchOptions;\n        }\n\n        if (this._timeout !== undefined)\n        {\n            options.timeout = this._timeout;\n        }\n\n        if (this._onRequest)\n        {\n            options.onRequest = this._onRequest;\n        }\n\n        if (this._onResponse)\n        {\n            options.onResponse = this._onResponse;\n        }\n\n        return this.executor(input || {}, options);\n    }\n}\n\n/**\n * Individual route client with structured input API\n */\nexport type RouteClient<TRoute extends RouteDef<any, any>> = {\n    /**\n     * Set request headers\n     */\n    headers(headers: Record<string, string>): RouteClient<TRoute>;\n\n    /**\n     * Set cookies\n     */\n    cookies(cookies: Record<string, string>): RouteClient<TRoute>;\n\n    /**\n     * Set Next.js fetch options\n     */\n    fetchOptions(options: RequestInit & { next?: { revalidate?: number | false; tags?: string[] } }): RouteClient<TRoute>;\n\n    /**\n     * Set this call's timeout in milliseconds, overriding the client-wide one.\n     * Throws a `TypeError` unless `ms` is finite, `> 0` and `<= 2147483647`.\n     */\n    timeout(ms: number): RouteClient<TRoute>;\n\n    /**\n     * Set request interceptor\n     */\n    onRequest(interceptor: RequestInterceptor): RouteClient<TRoute>;\n\n    /**\n     * Set response interceptor\n     */\n    onResponse(interceptor: ResponseInterceptor): RouteClient<TRoute>;\n\n    /**\n     * Execute the API call with structured input\n     *\n     * @example\n     * ```typescript\n     * // GET /users/:id\n     * api.getUser.call({ params: { id: '123' } });\n     *\n     * // PUT /users/:id\n     * api.updateUser.call({ params: { id: '123' }, body: { name: 'Jane' } });\n     * ```\n     */\n    call: HasAnyRequiredFields<InferRouteInput<TRoute>> extends true\n        ? (input: CleanStructuredInput<InferRouteInput<TRoute>>) => Promise<InferRouteOutput<TRoute>>\n        : (input?: CleanStructuredInput<InferRouteInput<TRoute>>) => Promise<InferRouteOutput<TRoute>>;\n};\n\n/**\n * One property per route in a flattened route record.\n *\n * A slot the flattening could not resolve to a route definition is `never`, as it was\n * before nesting was flattened — a record whose values are neither routes nor routers\n * names nothing callable.\n */\ntype RouteClients<TRoutes> = {\n    [K in keyof TRoutes]: TRoutes[K] extends RouteDef<any, any, any>\n        ? RouteClient<TRoutes[K]>\n        : never;\n};\n\n/**\n * Typed client for entire router\n *\n * One flat namespace, holding the same route names the server registers. A route\n * declared inside a nested `defineRouter` is reached by its own key — `api.getThing`,\n * never `api.group.getThing` — because that is the name `registerRoutes` mounts it\n * under, the name the RPC proxy resolves, and the name `RouterOutput` takes. The group\n * key is not a route and naming it is a compile error.\n *\n * @example\n * ```typescript\n * const appRouter = defineRouter({\n *     getRoot,\n *     users: defineRouter({ getUser }),\n * });\n *\n * const api = createApi<typeof appRouter>();\n *\n * await api.getUser.call({ params: { id: '1' } });   // not api.users.getUser\n * ```\n *\n * A name two branches both declare is left out of the namespace rather than resolved to\n * one of them — the same collision `RouterOutput` refuses. Routes mounted with\n * `.packages()` are deliberately absent: a package publishes its own route map and its\n * own client (`authApi`, `cmsApi`), and that is what calls them.\n */\nexport type Client<TRouter extends Router<any>> = RouteClients<ExtractRoutes<TRouter>>;\n","/**\n * Type-Safe RPC-Style Client with Structured Input API\n *\n * Provides full end-to-end type safety from server routes to client calls.\n * No metadata codegen required - method/path resolution happens at the proxy layer.\n *\n * @example\n * ```typescript\n * // Server\n * export const appRouter = defineRouter({\n *   getUser: route.get('/users/:id')\n *     .input({ params: Type.Object({ id: Type.String() }) })\n *     .handler(async (c) => { ... }),\n *   createUser: route.post('/users')\n *     .input({ body: Type.Object({ name: Type.String() }) })\n *     .handler(async (c) => { ... }),\n * });\n *\n * export type AppRouter = typeof appRouter;\n *\n * // Client - no metadata needed!\n * const api = createApi<AppRouter>();\n *\n * // ✅ GET (no body) - becomes GET /api/rpc/getUser?input={...}\n * const user = await api.getUser.call({ params: { id: '1' } });\n *\n * // ✅ POST (has body) - becomes POST /api/rpc/createUser\n * const newUser = await api.createUser.call({ body: { name: 'John' } });\n *\n * // ✅ With options (headers, cookies, interceptors)\n * const user = await api.getUser\n *   .headers({ 'X-Custom': 'value' })\n *   .cookies({ session: 'xxx' })\n *   .fetchOptions({ next: { revalidate: 60 } })\n *   .call({ params: { id: '1' } });\n * ```\n */\nimport { env } from '@spfn/core/config';\nimport { ErrorRegistry, errorRegistry as coreErrorRegistry } from '@spfn/core/errors';\nimport { logger } from '@spfn/core/logger';\nimport type { Router } from '@spfn/core/route';\nimport * as debugLogs from './debug-logs';\nimport { ApiError } from './errors';\nimport {\n    fetchInAbortScope,\n    errorFromResponse,\n    buildCookieHeader,\n    autoDetectServerCookies,\n} from './helpers';\nimport { CSRF_HEADER, csrfHeaderValue, documentCookieEntries } from './csrf';\nimport { RouteCallBuilder } from './builder';\nimport type { ScopedFetchResult } from './helpers';\nimport type { ApiConfig, ApiOutcome, CallOptions } from './types';\nimport type { Client } from './builder';\n\nconst apiLogger = logger.child('@spfn/core:api-client');\n\n/**\n * Where a failed call went, for the log line its transport error writes\n */\ninterface CallSite\n{\n    route: string;\n    method: string;\n    url: string;\n}\n\n/**\n * A call that got no answer, as both the observer and the caller see it\n */\ntype TransportOutcome = Extract<ApiOutcome, { errorType: 'network' | 'timeout' | 'aborted' }>;\n\n/**\n * Build the `ApiError` of one transport kind together with its outcome\n *\n * Built here rather than read back from `ApiError.errorType`, which is optional, so the\n * outcome's kind is the one the error was made with — no cast to trust.\n */\nfunction transportOutcome(\n    errorType: TransportOutcome['errorType'],\n    message: string,\n    status: number,\n    url: string,\n    options?: { cause?: unknown },\n): TransportOutcome\n{\n    return { ok: false, errorType, status, error: new ApiError(message, status, url, undefined, errorType, options) };\n}\n\n/**\n * Classify a failed fetch by the abort cause its scope recorded\n *\n * - timeout → 408 `'timeout'`, reporting the applied timeout\n * - caller abort → status 0 `'aborted'`, the signal's reason as `cause`; logged at debug\n *   level, since it is the caller's own intent\n * - no cause recorded but the error is a plain `AbortError` (a custom `fetch` aborting its\n *   own controller, with neither our timer nor the caller's signal involved) → 408\n *   `'timeout'`, as it always was before the scope recorded a cause\n * - anything else → status 0 `'network'`\n */\nfunction transportError(\n    failure: Extract<ScopedFetchResult, { ok: false }>,\n    site: CallSite,\n    timeout: number,\n): TransportOutcome\n{\n    if (failure.cause === 'timeout')\n    {\n        apiLogger.error('Request timeout', { ...site, timeout });\n\n        return transportOutcome('timeout', `Request timeout after ${timeout}ms`, 408, site.url);\n    }\n\n    if (failure.cause === 'caller')\n    {\n        apiLogger.debug('Request aborted by caller', site);\n\n        return transportOutcome('aborted', 'Request aborted', 0, site.url, { cause: failure.error });\n    }\n\n    const { error } = failure;\n\n    if (error instanceof Error && error.name === 'AbortError')\n    {\n        apiLogger.error('Request timeout', { ...site, timeout });\n\n        return transportOutcome('timeout', `Request timeout after ${timeout}ms`, 408, site.url);\n    }\n\n    const errorMessage = error instanceof Error ? error.message : 'Network error';\n    apiLogger.error('Network error', {\n        ...site,\n        error: errorMessage,\n        errorName: error instanceof Error ? error.name : 'unknown',\n    });\n\n    return transportOutcome('network', errorMessage, 0, site.url);\n}\n\n/**\n * Tell the app's observer how a call ended, without letting it change the call\n *\n * A synchronous throw is caught here and a returned thenable gets a `.catch`; either is\n * logged by name and message only — never the request or the body. Nothing is awaited.\n */\nfunction notifyOutcome(onOutcome: ApiConfig['onOutcome'], outcome: ApiOutcome): void\n{\n    if (!onOutcome)\n    {\n        return;\n    }\n\n    try\n    {\n        const returned: unknown = onOutcome(outcome);\n\n        if (isThenable(returned))\n        {\n            Promise.resolve(returned).catch(logObserverFailure);\n        }\n    }\n    catch (error)\n    {\n        logObserverFailure(error);\n    }\n}\n\nfunction isThenable(value: unknown): value is PromiseLike<unknown>\n{\n    return typeof (value as PromiseLike<unknown> | null)?.then === 'function';\n}\n\nfunction logObserverFailure(error: unknown): void\n{\n    apiLogger.error('onOutcome observer failed; the call result is unchanged', {\n        errorName: error instanceof Error ? error.name : typeof error,\n        errorMessage: error instanceof Error ? error.message : String(error),\n    });\n}\n\n// ============================================================================\n// Client Implementation\n// ============================================================================\n\n/**\n * Create type-safe RPC client\n *\n * No metadata required - the client sends routeName + input to the proxy,\n * and the proxy resolves the actual HTTP method and path from the router.\n *\n * @example\n * ```typescript\n * // Client - no metadata needed!\n * const api = createApi<AppRouter>();\n *\n * // GET request (no body) - browser cacheable\n * const user = await api.getUser.call({ params: { id: '1' } });\n *\n * // POST request (has body)\n * const newUser = await api.createUser.call({ body: { name: 'John' } });\n * ```\n */\nexport function createApi<TRouter extends Router<any>>(\n    config: ApiConfig = {},\n): Client<TRouter>\n{\n    const {\n        baseUrl = '/api/rpc',\n        headers: defaultHeaders = {},\n        timeout = env.SERVER_TIMEOUT,\n        fetch: customFetch = fetch,\n        onRequest: globalOnRequest,\n        onResponse: globalOnResponse,\n        onOutcome,\n        errorRegistry: errorRegistryConfig,\n        debug = false,\n    } = config;\n\n    // Normalize errorRegistry: always include coreErrorRegistry\n    const errorRegistry = Array.isArray(errorRegistryConfig)\n        ? new ErrorRegistry([coreErrorRegistry, ...errorRegistryConfig])\n        : errorRegistryConfig ?? coreErrorRegistry;\n\n    if (debug)\n    {\n        apiLogger.debug('API client initialized', { baseUrl });\n    }\n\n    /**\n     * Execute API call\n     *\n     * Determines GET vs POST based on body/formData presence:\n     * - No body/formData → GET /api/rpc/{routeName}?input={...}\n     * - Has body → POST /api/rpc/{routeName} with JSON body\n     * - Has formData → POST /api/rpc/{routeName} with multipart/form-data\n     */\n    async function executeCall(\n        routeName: string,\n        input: any = {},\n        options: CallOptions = {},\n    ): Promise<any>\n    {\n        const hasBody = input.body !== undefined;\n        const hasFormData = input.formData !== undefined && Object.keys(input.formData).length > 0;\n        const method = (hasBody || hasFormData) ? 'POST' : 'GET';\n\n        // Build full URL - handle SSR case where SPFN_APP_URL might not be set\n        let appUrl = env.SPFN_APP_URL || '';\n\n        // In SSR environment, if SPFN_APP_URL is not set, try to get host from request headers\n        if (!appUrl && typeof window === 'undefined')\n        {\n            try\n            {\n                const { headers } = await import('next/headers.js');\n                const headersList = await headers();\n                const host = headersList.get('host');\n                const protocol = headersList.get('x-forwarded-proto') || 'http';\n                if (host)\n                {\n                    appUrl = `${protocol}://${host}`;\n                    if (debug)\n                    {\n                        apiLogger.debug(`Auto-detected app URL from headers: ${appUrl}`);\n                    }\n                }\n            }\n            catch\n            {\n                // Fallback: use relative URL and let fetch handle it\n                if (debug)\n                {\n                    apiLogger.warn('Could not determine app URL in SSR environment, using relative URL');\n                }\n            }\n        }\n\n        // Build URL based on method\n        let fullUrl: string;\n        if (method === 'GET')\n        {\n            // GET: encode input in query string\n            const inputParam = encodeURIComponent(JSON.stringify(input));\n            fullUrl = `${appUrl}${baseUrl}/${routeName}?input=${inputParam}`;\n        }\n        else\n        {\n            // POST: input goes in body\n            fullUrl = `${appUrl}${baseUrl}/${routeName}`;\n        }\n\n        // Prepare headers\n        // Note: Don't set Content-Type for formData - browser sets it with boundary\n        const headers: Record<string, string> = {\n            ...(hasFormData ? {} : { 'Content-Type': 'application/json' }),\n            ...defaultHeaders,\n            ...options.headers,\n        };\n\n        // Auto-detect server cookies and merge with user-provided cookies\n        const autoDetectedCookies = await autoDetectServerCookies();\n        const cookiesToSend = {\n            ...autoDetectedCookies,\n            ...(options.cookies || {}),\n        };\n\n        // Add Cookie header if we have cookies to send\n        if (Object.keys(cookiesToSend).length > 0)\n        {\n            headers['Cookie'] = buildCookieHeader(cookiesToSend);\n        }\n\n        // Mirror the readable CSRF cookie into a header, from the browser jar or\n        // — server-side — from the jar being forwarded.\n        //\n        // Carried on GET calls too, deliberately: the wire method here is chosen\n        // by whether the input has a body, not by what the route does. A bodyless\n        // mutation (`api.logout.call({})`) travels as GET and the proxy still\n        // forwards it as the route's POST, so a GET-shaped call can be exactly\n        // the request that needs the header. The proxy decides what to check from\n        // the resolved route method, and ignores the header on safe routes.\n        const csrfToken = csrfHeaderValue(\n            typeof window === 'undefined' ? Object.entries(cookiesToSend) : documentCookieEntries(),\n        );\n\n        const csrfSetByCaller = Object.keys(headers).some(name => name.toLowerCase() === CSRF_HEADER);\n\n        if (csrfToken && !csrfSetByCaller)\n        {\n            headers[CSRF_HEADER] = csrfToken;\n        }\n\n        // Log cookie auto-detection if debug enabled\n        if (debug && Object.keys(autoDetectedCookies).length > 0)\n        {\n            const cookieArray = Object.entries(autoDetectedCookies).map(([name, value]) => ({ name, value }));\n            debugLogs.logCookieAutoDetection(apiLogger, cookieArray);\n        }\n\n        // Build request init\n        const requestInit: RequestInit = {\n            method,\n            headers,\n            ...options.fetchOptions,\n        };\n\n        // Add body for POST\n        if (method === 'POST')\n        {\n            if (hasFormData)\n            {\n                // Build FormData for file uploads\n                const formData = new FormData();\n\n                // Add non-formData fields (params, query, headers, cookies) as JSON metadata\n                const metadata: Record<string, any> = {};\n                if (input.params) metadata.params = input.params;\n                if (input.query) metadata.query = input.query;\n                if (input.headers) metadata.headers = input.headers;\n                if (input.cookies) metadata.cookies = input.cookies;\n\n                if (Object.keys(metadata).length > 0)\n                {\n                    formData.append('__metadata', JSON.stringify(metadata));\n                }\n\n                // Add formData fields\n                for (const [key, value] of Object.entries(input.formData))\n                {\n                    if (value instanceof File)\n                    {\n                        formData.append(key, value);\n                    }\n                    else if (Array.isArray(value))\n                    {\n                        // Handle array of files or values\n                        for (const item of value)\n                        {\n                            if (item instanceof File)\n                            {\n                                formData.append(key, item);\n                            }\n                            else\n                            {\n                                formData.append(key, String(item));\n                            }\n                        }\n                    }\n                    else if (value !== undefined && value !== null)\n                    {\n                        formData.append(key, String(value));\n                    }\n                }\n\n                requestInit.body = formData;\n            }\n            else\n            {\n                requestInit.body = JSON.stringify(input);\n            }\n        }\n\n        // Execute request interceptors\n        let init = requestInit;\n        if (globalOnRequest)\n        {\n            init = await globalOnRequest(fullUrl, init);\n        }\n        if (options.onRequest)\n        {\n            init = await options.onRequest(fullUrl, init);\n        }\n\n        if (debug)\n        {\n            debugLogs.logRequest(apiLogger, routeName, method, fullUrl, !!init.body);\n        }\n\n        // Execute fetch and parse the body inside one abort scope\n        const appliedTimeout = options.timeout ?? timeout;\n        const fetched = await fetchInAbortScope(fullUrl, init, appliedTimeout, customFetch);\n\n        if (!fetched.ok)\n        {\n            const outcome = transportError(fetched, { route: routeName, method, url: fullUrl }, appliedTimeout);\n            notifyOutcome(onOutcome, outcome);\n            throw outcome.error;\n        }\n\n        let { response, body } = fetched;\n\n        // Execute global + local response interceptors\n        //\n        // These run outside the abort scope on purpose. That scope classifies a transport\n        // failure, and an interceptor throwing is not one: Next.js implements `redirect()`\n        // and `notFound()` by throwing an error carrying a digest, and an interceptor\n        // raising a domain error of its own is not a transport failure either. Run inside\n        // it, every one of those became `ApiError(..., 0, ..., 'network')` — the\n        // navigation never happened and the caller was handed a network failure that never\n        // occurred, which retry and offline handling keyed on `errorType === 'network'`\n        // act on.\n        if (globalOnResponse)\n        {\n            const result = await globalOnResponse(response, body);\n            response = result.response;\n            body = result.body;\n        }\n        if (options.onResponse)\n        {\n            const result = await options.onResponse(response, body);\n            response = result.response;\n            body = result.body;\n        }\n\n        if (debug)\n        {\n            debugLogs.logResponse(apiLogger, routeName, response.status, !!body);\n        }\n\n        // Handle error responses; the observer sees the same error the caller catches\n        if (!response.ok)\n        {\n            const error = errorFromResponse(response, body, fullUrl, errorRegistry, debug, apiLogger);\n            notifyOutcome(onOutcome, { ok: false, errorType: 'http', status: response.status, error });\n            throw error;\n        }\n\n        notifyOutcome(onOutcome, { ok: true, response, body });\n\n        return body;\n    }\n\n    /**\n     * Build client proxy\n     *\n     * Every property access returns a `RouteCallBuilder` for that one property read as a\n     * whole route name, and that name goes on the wire as `/api/rpc/{routeName}`. The\n     * proxy route resolves it against the generated route map, whose names are flat.\n     *\n     * Nesting needs nothing here: `registerRoutes` mounts a route declared inside a\n     * nested `defineRouter` under its own key, so `api.getThing` is the call for a nested\n     * `getThing` exactly as for a top-level one — which is the namespace `Client` types.\n     * There is no dot-notation traversal: a property access never returns another proxy,\n     * so `api.group.getThing` reads a property of a builder and is `undefined`.\n     *\n     * `prefix` is vestigial — nothing passes one, and adding a caller that did would\n     * build a dotted name the route map cannot resolve.\n     */\n    function buildProxy(prefix = ''): any\n    {\n        return new Proxy(\n            {},\n            {\n                get(_target, prop: string)\n                {\n                    const currentPath = prefix ? `${prefix}.${prop}` : prop;\n\n                    // Return RouteCallBuilder that can either be called or chained\n                    return new RouteCallBuilder(\n                        (input: any, options: CallOptions) => executeCall(currentPath, input, options),\n                        currentPath,\n                    );\n                },\n            },\n        );\n    }\n\n    return buildProxy() as Client<TRouter>;\n}\n"]}

package/dist/nextjs/server.d.ts

@@ -1,7 +1,7 @@
-import { NextRequest, NextResponse } from 'next/server';
+import { NextRequest, NextResponse } from 'next/server.js';
 import { HttpMethod } from '@spfn/core/route';
 import { InterceptorRule as InterceptorRule$1 } from '@spfn/core/nextjs/server';
-import { S as SetCookie } from '../types-CxhPH4s_.js';
+import { S as SetCookie } from '../types-CKH0D3Dy.js';
 import '@sinclair/typebox';
 import '@spfn/core/errors';
 

package/dist/nextjs/server.js

@@ -1,4 +1,4 @@
-import { NextResponse } from 'next/server';
+import { NextResponse } from 'next/server.js';
 import { env } from '@spfn/core/config';
 import { logger } from '@spfn/core/logger';
 import { randomBytes, createHmac, createHash } from 'crypto';

package/dist/nextjs/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/security/proxy-signature.ts","../../src/nextjs/shared.ts","../../src/nextjs/proxy/interceptors/helpers.ts","../../src/nextjs/proxy/interceptors/registry.ts","../../src/nextjs/proxy/helpers.ts","../../src/nextjs/proxy/rpc.ts"],"names":["headersToForward"],"mappings":";;;;;;AA0BO,IAAM,sBAAA,GAAyB,wBAAA;AAC/B,IAAM,sBAAA,GAAyB,wBAAA;AAC/B,IAAM,kBAAA,GAAqB,oBAAA;AAC3B,IAAM,mBAAA,GAAsB,qBAAA;AAM5B,IAAM,sBAAA,GAAyB,wBAAA;AAG/B,IAAM,cAAA,GAAiB,SAAA;AAoBvB,SAAS,cAAc,GAAA,EAC9B;AACI,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAC3B,EAAA,IAAI,QAAQ,EAAA,EACZ;AACI,IAAA,OAAO,EAAE,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,GAAA,EAAI;AAAA,EAChD;AAIA,EAAA,OAAO,EAAE,KAAA,EAAO,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,IAAK,cAAA,EAAgB,MAAA,EAAQ,GAAA,CAAI,KAAA,CAAM,GAAA,GAAM,CAAC,CAAA,EAAE;AACpF;AAOO,SAAS,iBAAiB,IAAA,EACjC;AACI,EAAA,MAAM,OAAmB,EAAC;AAC1B,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAE7B,EAAA,KAAA,MAAW,OAAO,IAAA,EAClB;AACI,IAAA,IAAI,CAAC,GAAA,EACL;AACI,MAAA;AAAA,IACJ;AAEA,IAAA,KAAA,MAAW,IAAA,IAAQ,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,EAChC;AACI,MAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAC1B,MAAA,IAAI,CAAC,OAAA,EACL;AACI,QAAA;AAAA,MACJ;AAEA,MAAA,MAAM,GAAA,GAAM,cAAc,OAAO,CAAA;AACjC,MAAA,IAAI,CAAC,GAAA,CAAI,MAAA,IAAU,KAAK,GAAA,CAAI,GAAA,CAAI,KAAK,CAAA,EACrC;AACI,QAAA;AAAA,MACJ;AAEA,MAAA,IAAA,CAAK,GAAA,CAAI,IAAI,KAAK,CAAA;AAClB,MAAA,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,IACjB;AAAA,EACJ;AAEA,EAAA,OAAO,IAAA;AACX;AAuEO,SAAS,qBAAqB,KAAA,EACrC;AACI,EAAA,OAAO,CAAC,KAAA,CAAM,MAAA,CAAO,WAAA,EAAY,EAAG,MAAM,IAAA,EAAM,KAAA,CAAM,KAAA,EAAO,KAAA,CAAM,WAAW,KAAA,CAAM,KAAA,EAAO,MAAM,QAAQ,CAAA,CAAE,KAAK,IAAI,CAAA;AACxH;AAQO,SAAS,SAAS,IAAA,EACzB;AACI,EAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,MAAA,KAAW,CAAA,EAC7B;AACI,IAAA,OAAO,EAAA;AAAA,EACX;AAEA,EAAA,OAAO,OAAO,SAAS,QAAA,GACjB,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,MAAM,MAAM,CAAA,CAAE,OAAO,KAAK,CAAA,GACtD,WAAW,QAAQ,CAAA,CAAE,OAAO,IAAI,CAAA,CAAE,OAAO,KAAK,CAAA;AACxD;AAKO,SAAS,gBAAA,CAAiB,QAAgB,KAAA,EACjD;AACI,EAAA,OAAO,UAAA,CAAW,QAAA,EAAU,MAAM,CAAA,CAAE,MAAA,CAAO,qBAAqB,KAAK,CAAC,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AACxF;AAKO,SAAS,aAAA,GAChB;AACI,EAAA,OAAO,WAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AACzC;AA2BO,SAAS,iBAAiB,KAAA,EACjC;AACI,EAAA,MAAM,YAAY,KAAA,CAAM,SAAA,IAAa,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA;AACtD,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,IAAS,aAAA,EAAc;AAC3C,EAAA,MAAM,SAAA,GAAY,gBAAA,CAAiB,KAAA,CAAM,GAAA,CAAI,MAAA,EAAQ;AAAA,IACjD,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,KAAA,EAAO,MAAM,KAAA,IAAS,EAAA;AAAA,IACtB,SAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA,EAAU,QAAA,CAAS,KAAA,CAAM,IAAI;AAAA,GAChC,CAAA;AAED,EAAA,OAAO;AAAA,IACH,CAAC,sBAAsB,GAAG,SAAA;AAAA,IAC1B,CAAC,sBAAsB,GAAG,SAAA;AAAA,IAC1B,CAAC,kBAAkB,GAAG,KAAA;AAAA,IACtB,CAAC,mBAAmB,GAAG,KAAA,CAAM,GAAA,CAAI;AAAA,GACrC;AACJ;;;ACzPO,SAAS,kBAAA,CAAmB,MAAc,MAAA,EACjD;AACI,EAAA,IAAI,GAAA,GAAM,IAAA;AACV,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAChD;AACI,IAAA,GAAA,GAAM,GAAA,CAAI,QAAQ,CAAA,CAAA,EAAI,GAAG,IAAI,kBAAA,CAAmB,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAAA,EAClE;AAEA,EAAA,OAAO,GAAA;AACX;AASO,SAAS,iBAAiB,KAAA,EACjC;AACI,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,WAAW,CAAA,EAClC;AACI,IAAA,OAAO,EAAA;AAAA,EACX;AAEA,EAAA,MAAM,YAAA,GAAe,IAAI,eAAA,EAAgB;AACzC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAC/C;AACI,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EACvB;AACI,MAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,KAAM,YAAA,CAAa,OAAO,GAAA,EAAK,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AAAA,IAC5D,CAAA,MAEA;AACI,MAAA,YAAA,CAAa,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,IAC1C;AAAA,EACJ;AAEA,EAAA,OAAO,CAAA,CAAA,EAAI,YAAA,CAAa,QAAA,EAAU,CAAA,CAAA;AACtC;AAwBA,eAAsB,kBAAkB,QAAA,EACxC;AAEI,EAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EACxB;AACI,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAEvD,EAAA,IAAI,WAAA,EAAa,QAAA,CAAS,kBAAkB,CAAA,EAC5C;AACI,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,IAAA,OAAO,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,GAAI,IAAA;AAAA,EACrC,CAAA,MAEA;AACI,IAAA,OAAO,MAAM,SAAS,IAAA,EAAK;AAAA,EAC/B;AACJ;;;ACtEO,SAAS,SAAA,CAAU,MAAc,OAAA,EACxC;AAEI,EAAA,IAAI,YAAY,GAAA,EAChB;AACI,IAAA,OAAO,IAAA;AAAA,EACX;AAGA,EAAA,IAAI,mBAAmB,MAAA,EACvB;AACI,IAAA,OAAO,OAAA,CAAQ,KAAK,IAAI,CAAA;AAAA,EAC5B;AAMA,EAAA,MAAM,YAAA,GAAe,OAAA,CAChB,OAAA,CAAQ,KAAA,EAAO,IAAI,CAAA,CACnB,OAAA,CAAQ,SAAA,EAAW,OAAO,CAAA,CAC1B,OAAA,CAAQ,KAAA,EAAO,KAAK,CAAA;AAEzB,EAAA,MAAM,KAAA,GAAQ,IAAI,MAAA,CAAO,CAAA,CAAA,EAAI,YAAY,CAAA,CAAA,CAAG,CAAA;AAE5C,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AAC1B;AASO,SAAS,WAAA,CACZ,QACA,OAAA,EAEJ;AAEI,EAAA,IAAI,CAAC,OAAA,EACL;AACI,IAAA,OAAO,IAAA;AAAA,EACX;AAGA,EAAA,IAAI,OAAO,YAAY,QAAA,EACvB;AACI,IAAA,OAAO,MAAA,CAAO,WAAA,EAAY,KAAM,OAAA,CAAQ,WAAA,EAAY;AAAA,EACxD;AAGA,EAAA,OAAO,OAAA,CAAQ,KAAK,CAAC,CAAA,KAAM,EAAE,WAAA,EAAY,KAAM,MAAA,CAAO,WAAA,EAAa,CAAA;AACvE;AAUO,SAAS,0BAAA,CACZ,KAAA,EACA,IAAA,EACA,MAAA,EAEJ;AACI,EAAA,OAAO,KAAA,CAAM,MAAA,CAAO,CAAC,IAAA,KACrB;AACI,IAAA,OAAO,SAAA,CAAU,MAAM,IAAA,CAAK,WAAW,KAAK,WAAA,CAAY,MAAA,EAAQ,KAAK,MAAM,CAAA;AAAA,EAC/E,CAAC,CAAA;AACL;AAgBA,eAAsB,0BAAA,CAClB,SACA,YAAA,EAEJ;AACI,EAAA,IAAI,KAAA,GAAQ,CAAA;AAEZ,EAAA,MAAM,OAAO,YACb;AACI,IAAA,IAAI,KAAA,IAAS,aAAa,MAAA,EAC1B;AACI,MAAA;AAAA,IACJ;AAEA,IAAA,MAAM,WAAA,GAAc,aAAa,KAAK,CAAA;AACtC,IAAA,KAAA,EAAA;AAEA,IAAA,MAAM,WAAA,CAAY,SAAS,IAAI,CAAA;AAAA,EACnC,CAAA;AAEA,EAAA,MAAM,IAAA,EAAK;AACf;AAgBA,eAAsB,2BAAA,CAClB,SACA,YAAA,EAEJ;AACI,EAAA,IAAI,KAAA,GAAQ,CAAA;AAEZ,EAAA,MAAM,OAAO,YACb;AACI,IAAA,IAAI,KAAA,IAAS,aAAa,MAAA,EAC1B;AACI,MAAA;AAAA,IACJ;AAEA,IAAA,MAAM,WAAA,GAAc,aAAa,KAAK,CAAA;AACtC,IAAA,KAAA,EAAA;AAEA,IAAA,MAAM,WAAA,CAAY,SAAS,IAAI,CAAA;AAAA,EACnC,CAAA;AAEA,EAAA,MAAM,IAAA,EAAK;AACf;;;AC/IO,IAAM,sBAAN,MACP;AAAA,EACY,YAAA,uBAAmB,GAAA,EAA+B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkB1D,QAAA,CAAS,aAAqB,YAAA,EAC9B;AACI,IAAA,IAAI,CAAC,IAAA,CAAK,YAAA,CAAa,GAAA,CAAI,WAAW,CAAA,EACtC;AACI,MAAA,IAAA,CAAK,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,YAAY,CAAA;AAAA,IACnD;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAA,CAAO,OAAA,GAAoB,EAAC,EAC5B;AACI,IAAA,MAAM,MAAyB,EAAC;AAEhC,IAAA,KAAA,MAAW,CAAC,WAAA,EAAa,YAAY,KAAK,IAAA,CAAK,YAAA,CAAa,SAAQ,EACpE;AACI,MAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,CAAS,WAAW,CAAA,EACjC;AACI,QAAA,GAAA,CAAI,IAAA,CAAK,GAAG,YAAY,CAAA;AAAA,MAC5B;AAAA,IACJ;AAEA,IAAA,OAAO,GAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,IAAI,WAAA,EACJ;AACI,IAAA,OAAO,IAAA,CAAK,YAAA,CAAa,GAAA,CAAI,WAAW,CAAA;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA,EAKA,eAAA,GACA;AACI,IAAA,OAAO,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,YAAA,CAAa,MAAM,CAAA;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,WAAA,EACJ;AACI,IAAA,OAAO,IAAA,CAAK,YAAA,CAAa,GAAA,CAAI,WAAW,CAAA;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW,WAAA,EACX;AACI,IAAA,IAAA,CAAK,YAAA,CAAa,OAAO,WAAW,CAAA;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,KAAA,GACA;AACI,IAAA,IAAA,CAAK,aAAa,KAAA,EAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA,EAKA,KAAA,GACA;AACI,IAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,IAAA,KAAA,MAAW,YAAA,IAAgB,IAAA,CAAK,YAAA,CAAa,MAAA,EAAO,EACpD;AACI,MAAA,KAAA,IAAS,YAAA,CAAa,MAAA;AAAA,IAC1B;AAEA,IAAA,OAAO,KAAA;AAAA,EACX;AACJ,CAAA;AAQO,IAAM,uBAAuB,MACpC;AACI,EAAA,IAAI,CAAC,WAAW,6BAAA,EAChB;AACI,IAAA,UAAA,CAAW,6BAAA,GAAgC,IAAI,mBAAA,EAAoB;AAAA,EACvE;AAEA,EAAA,OAAO,UAAA,CAAW,6BAAA;AACtB,CAAA;AA+BO,SAAS,oBAAA,CACZ,aACA,YAAA,EAEJ;AACI,EAAA,mBAAA,CAAoB,QAAA,CAAS,aAAa,YAAY,CAAA;AAC1D;;;ACxKO,SAAS,0BAAA,CACZ,KACA,WAAA,EAEJ;AACI,EAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AAEjB,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA;AAC9D,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAE/B,EAAA,MAAM,MAAM,KAAA,CAAM,MAAA,GAAS,IAAA,CAAK,GAAA,CAAI,GAAG,WAAW,CAAA;AAIlD,EAAA,OAAO,KAAA,CAAM,GAAG,CAAA,IAAK,KAAA,CAAM,CAAC,CAAA;AAChC;AAEA,SAAS,gBAAA,GACT;AACI,EAAA,MAAM,MAAM,MAAA,CAAO,QAAA,CAAS,QAAQ,GAAA,CAAI,kBAAA,IAAsB,IAAI,EAAE,CAAA;AAEpE,EAAA,OAAO,OAAO,QAAA,CAAS,GAAG,CAAA,IAAK,GAAA,GAAM,IAAI,GAAA,GAAM,CAAA;AACnD;AASO,SAAS,iBAAA,CACZ,eACA,cAAA,EAEJ;AACI,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAG5B,EAAA,MAAMA,iBAAAA,GAAmB;AAAA,IACrB,cAAA;AAAA,IACA,eAAA;AAAA,IACA,QAAA;AAAA,IACA,YAAA;AAAA,IACA,QAAA;AAAA,IACA,iBAAA;AAAA;AAAA;AAAA,IAGA;AAAA,GACJ;AAEA,EAAA,KAAA,MAAW,UAAUA,iBAAAA,EACrB;AACI,IAAA,MAAM,KAAA,GAAQ,yBAAyB,OAAA,GACjC,aAAA,CAAc,IAAI,MAAM,CAAA,GACxB,cAAc,MAAM,CAAA;AAE1B,IAAA,IAAI,KAAA,EACJ;AACI,MAAA,OAAA,CAAQ,GAAA,CAAI,QAAQ,KAAK,CAAA;AAAA,IAC7B;AAAA,EACJ;AAKA,EAAA,MAAM,GAAA,GAAM,yBAAyB,OAAA,GAC/B,aAAA,CAAc,IAAI,iBAAiB,CAAA,GACnC,cAAc,iBAAiB,CAAA;AACrC,EAAA,MAAM,QAAA,GAAW,0BAAA,CAA2B,GAAA,EAAK,gBAAA,EAAkB,CAAA;AACnE,EAAA,IAAI,QAAA,EACJ;AACI,IAAA,OAAA,CAAQ,GAAA,CAAI,wBAAwB,QAAQ,CAAA;AAAA,EAChD;AAGA,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,cAAc,CAAA,EACxD;AACI,IAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,KAAK,CAAA;AAAA,EAC1B;AAEA,EAAA,OAAO,OAAA;AACX;AAQO,SAAS,aAAa,YAAA,EAC7B;AACI,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAoB;AAE3C,EAAA,IAAI,CAAC,YAAA,EACL;AACI,IAAA,OAAO,UAAA;AAAA,EACX;AAEA,EAAA,MAAM,WAAA,GAAc,aAAa,KAAA,CAAM,GAAG,EAAE,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,IAAA,EAAM,CAAA;AAC7D,EAAA,KAAA,MAAW,QAAQ,WAAA,EACnB;AACI,IAAA,MAAM,CAAC,IAAA,EAAM,GAAG,UAAU,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AAC5C,IAAA,IAAI,IAAA,IAAQ,UAAA,CAAW,MAAA,GAAS,CAAA,EAChC;AACI,MAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,IAAA,CAAK,GAAG,CAAA;AACjC,MAAA,UAAA,CAAW,IAAI,IAAA,CAAK,IAAA,EAAK,EAAG,KAAA,CAAM,MAAM,CAAA;AAAA,IAC5C;AAAA,EACJ;AAEA,EAAA,OAAO,UAAA;AACX;AAMO,SAAS,4BAA4B,OAAA,EAC5C;AACI,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAoB;AAG3C,EAAA,KAAA,MAAW,MAAA,IAAU,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAO,EAC5C;AACI,IAAA,UAAA,CAAW,GAAA,CAAI,MAAA,CAAO,IAAA,EAAM,MAAA,CAAO,KAAK,CAAA;AAAA,EAC5C;AAGA,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AACjD,EAAA,IAAI,YAAA,EACJ;AACI,IAAA,MAAM,MAAA,GAAS,aAAa,YAAY,CAAA;AACxC,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,CAAA,IAAK,MAAA,CAAO,SAAQ,EAC3C;AACI,MAAA,UAAA,CAAW,GAAA,CAAI,MAAM,KAAK,CAAA;AAAA,IAC9B;AAAA,EACJ;AAEA,EAAA,OAAO,UAAA;AACX;AAGA,IAAM,cAAA,GAGD;AAAA,EACD,EAAE,KAAK,UAAA,EAAY,MAAA,EAAQ,CAAC,CAAA,KAAM,CAAA,GAAI,aAAa,IAAA,EAAK;AAAA,EACxD,EAAE,KAAK,QAAA,EAAU,MAAA,EAAQ,CAAC,CAAA,KAAM,CAAA,GAAI,WAAW,IAAA,EAAK;AAAA,EACpD,EAAE,GAAA,EAAK,UAAA,EAAY,MAAA,EAAQ,CAAC,MAAM,CAAA,GAAI,CAAA,SAAA,EAAY,CAAC,CAAA,CAAA,GAAK,IAAA,EAAK;AAAA,EAC7D,EAAE,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAC,CAAA,KAAM,CAAA,KAAM,MAAA,GAAY,CAAA,QAAA,EAAW,CAAC,CAAA,CAAA,GAAK,IAAA,EAAK;AAAA,EACxE,EAAE,GAAA,EAAK,MAAA,EAAQ,MAAA,EAAQ,CAAC,MAAM,CAAA,GAAI,CAAA,KAAA,EAAQ,CAAC,CAAA,CAAA,GAAK,IAAA,EAAK;AAAA,EACrD,EAAE,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAC,MAAM,CAAA,GAAI,CAAA,OAAA,EAAU,CAAC,CAAA,CAAA,GAAK,IAAA;AACxD,CAAA;AAKO,SAAS,qBAAqB,MAAA,EACrC;AACI,EAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,EAAG,MAAA,CAAO,IAAI,CAAA,CAAA,EAAI,MAAA,CAAO,KAAK,CAAA,CAAE,CAAA;AAC/C,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,IAAW,EAAC;AAEnC,EAAA,KAAA,MAAW,EAAE,GAAA,EAAK,MAAA,EAAO,IAAK,cAAA,EAC9B;AACI,IAAA,MAAM,KAAA,GAAQ,QAAQ,GAAG,CAAA;AACzB,IAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,KAAA,EACrC;AACI,MAAA,MAAM,SAAA,GAAY,OAAO,KAAK,CAAA;AAC9B,MAAA,IAAI,SAAA,EACJ;AACI,QAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,MACxB;AAAA,IACJ;AAAA,EACJ;AAEA,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AAC1B;AAKO,SAAS,kBAAA,CACZ,SAAA,EACA,OAAA,EACA,KAAA,EACA,KAAA,EAEJ;AACI,EAAA,OAAO;AAAA,IACH,KAAA,EAAO,SAAA;AAAA,IACP,OAAA;AAAA,IACA,GAAI,KAAA,IAAS,KAAA,EAAO,SAAS,EAAE,KAAA,EAAO,MAAM,KAAA;AAAM,GACtD;AACJ;AAEA,IAAM,gBAAA,GAAmB;AAAA,EACrB,cAAA;AAAA,EACA,eAAA;AAAA,EACA,YAAA;AAAA,EACA,MAAA;AAAA,EACA;AACJ,CAAA;AAKO,SAAS,sBAAA,CACZ,eACA,aAAA,EAEJ;AACI,EAAA,KAAA,MAAW,UAAU,gBAAA,EACrB;AACI,IAAA,MAAM,KAAA,GAAQ,aAAA,CAAc,GAAA,CAAI,MAAM,CAAA;AACtC,IAAA,IAAI,KAAA,EACJ;AACI,MAAA,aAAA,CAAc,GAAA,CAAI,QAAQ,KAAK,CAAA;AAAA,IACnC;AAAA,EACJ;AACJ;AAKO,SAAS,mBAAA,CACZ,wBAAA,EACA,uBAAA,EACA,kBAAA,EACA,QAAA,EAEJ;AACI,EAAA,MAAM,kBAAqC,EAAC;AAG5C,EAAA,IAAI,wBAAA,EACJ;AACI,IAAA,MAAM,sBAAA,GAAyB,QAAA,CAAS,MAAA,CAAO,uBAAA,IAA2B,EAAE,CAAA;AAC5E,IAAA,eAAA,CAAgB,IAAA,CAAK,GAAG,sBAAsB,CAAA;AAAA,EAClD;AAGA,EAAA,IAAI,kBAAA,EACJ;AACI,IAAA,eAAA,CAAgB,IAAA,CAAK,GAAG,kBAAkB,CAAA;AAAA,EAC9C;AAEA,EAAA,OAAO,eAAA;AACX;AAKO,SAAS,oBACZ,IAAA,EACA,MAAA,EACA,SACA,IAAA,EACA,YAAA,EACA,YACA,OAAA,EAEJ;AACI,EAAA,OAAO;AAAA,IACH,IAAA,EAAM,IAAI,IAAI,CAAA,CAAA;AAAA,IACd,MAAA;AAAA,IACA,OAAA,EAAS,MAAA,CAAO,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA;AAAA,IAC7C,IAAA;AAAA,IACA,KAAA,EAAO,MAAA,CAAO,WAAA,CAAY,YAAA,CAAa,SAAS,CAAA;AAAA,IAChD,OAAA,EAAS,UAAA;AAAA,IACT,OAAA;AAAA,IACA,UAAU;AAAC,GACf;AACJ;AAKO,SAAS,oBAAA,CACZ,MACA,MAAA,EACA,cAAA,EACA,aACA,QAAA,EACA,YAAA,EACA,iBACA,OAAA,EAEJ;AACI,EAAA,OAAO;AAAA,IACH,IAAA,EAAM,IAAI,IAAI,CAAA,CAAA;AAAA,IACd,MAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACL,OAAA,EAAS,MAAA,CAAO,WAAA,CAAY,cAAA,CAAe,SAAS,CAAA;AAAA,MACpD,IAAA,EAAM;AAAA,KACV;AAAA,IACA,QAAA,EAAU;AAAA,MACN,IAAI,QAAA,CAAS,EAAA;AAAA,MACb,QAAQ,QAAA,CAAS,MAAA;AAAA,MACjB,YAAY,QAAA,CAAS,UAAA;AAAA,MACrB,SAAS,QAAA,CAAS,OAAA;AAAA,MAClB,IAAA,EAAM;AAAA,KACV;AAAA,IACA,OAAA;AAAA,IACA,YAAY,EAAC;AAAA,IACb,QAAA,EAAU;AAAA,GACd;AACJ;;;AC7RA,IAAM,SAAA,GAAY,MAAA,CAAO,KAAA,CAAM,sBAAsB,CAAA;AAsE9C,SAAS,eAAe,MAAA,EAC/B;AACI,EAAA,MAAM;AAAA,IACF,MAAA,GAAS,IAAI,YAAA,IAAgB,uBAAA;AAAA,IAC7B,KAAA,GAAQ,IAAI,QAAA,KAAa,aAAA;AAAA,IACzB,UAAU,GAAA,CAAI,iBAAA;AAAA,IACd,OAAA,EAAS,iBAAiB,EAAC;AAAA,IAC3B,YAAA;AAAA,IACA,wBAAA,GAA2B,IAAA;AAAA,IAC3B,uBAAA;AAAA,IACA,cAAc,GAAA,CAAI,iBAAA;AAAA,IAClB;AAAA,GACJ,GAAI,MAAA;AAKJ,EAAA,MAAM,QAAA,GAAW,cAAe,gBAAA,CAAiB,CAAC,WAAW,CAAC,CAAA,CAAE,CAAC,CAAA,IAAK,IAAA,GAAQ,IAAA;AAK9E,EAAA,IAAI,QAAA,EACJ;AACI,IAAA,IACA;AACI,MAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,MAAM,CAAA,CAAE,QAAA;AACjC,MAAA,IAAI,QAAA,KAAa,GAAA,IAAO,QAAA,KAAa,EAAA,EACrC;AACI,QAAA,SAAA,CAAU,IAAA;AAAA,UACN,kCAAkC,QAAQ,CAAA,+KAAA;AAAA,SAG9C;AAAA,MACJ;AAAA,IACJ,CAAA,CAAA,MAEA;AAAA,IAEA;AAAA,EACJ;AAKA,EAAA,SAAS,aAAa,SAAA,EACtB;AACI,IAAA,MAAM,KAAA,GAAQ,SAAS,SAAS,CAAA;AAChC,IAAA,IAAI,KAAA,EACJ;AACI,MAAA,OAAO,EAAE,MAAA,EAAQ,KAAA,CAAM,MAAA,EAAQ,IAAA,EAAM,MAAM,IAAA,EAAK;AAAA,IACpD;AAEA,IAAA,OAAO,IAAA;AAAA,EACX;AAKA,EAAA,eAAe,SAAA,CACX,SACA,OAAA,EAEJ;AACI,IAAA,MAAM,SAAA,GAAY,KAAK,GAAA,EAAI;AAC3B,IAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,MAAA;AAE7B,IAAA,IACA;AACI,MAAA,MAAM,YAAY,MAAA,CAAO,SAAA;AAEzB,MAAA,IAAI,CAAC,SAAA,EACL;AACI,QAAA,OAAO,YAAA,CAAa,IAAA;AAAA,UAChB,kBAAA,CAAmB,aAAA,EAAe,6BAAA,EAA+B,KAAK,CAAA;AAAA,UACtE,EAAE,QAAQ,GAAA;AAAI,SAClB;AAAA,MACJ;AAGA,MAAA,IAAI,QAOA,EAAC;AACL,MAAA,IAAI,WAAA,GAA+B,IAAA;AAEnC,MAAA,IAAI,OAAA,CAAQ,WAAW,KAAA,EACvB;AACI,QAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,YAAA,CAAa,IAAI,OAAO,CAAA;AAC3D,QAAA,IAAI,UAAA,EACJ;AACI,UAAA,IACA;AACI,YAAA,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,kBAAA,CAAmB,UAAU,CAAC,CAAA;AAAA,UACrD,CAAA,CAAA,MAEA;AACI,YAAA,OAAO,YAAA,CAAa,IAAA;AAAA,cAChB,kBAAA,CAAmB,aAAA,EAAe,yBAAA,EAA2B,KAAK,CAAA;AAAA,cAClE,EAAE,QAAQ,GAAA;AAAI,aAClB;AAAA,UACJ;AAAA,QACJ;AAAA,MACJ,CAAA,MAEA;AAEI,QAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAE3D,QAAA,IAAI,WAAA,CAAY,QAAA,CAAS,qBAAqB,CAAA,EAC9C;AAEI,UAAA,IACA;AACI,YAAA,WAAA,GAAc,MAAM,QAAQ,QAAA,EAAS;AAGrC,YAAA,MAAM,WAAA,GAAc,WAAA,CAAY,GAAA,CAAI,YAAY,CAAA;AAChD,YAAA,IAAI,WAAA,IAAe,OAAO,WAAA,KAAgB,QAAA,EAC1C;AACI,cAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,WAAW,CAAA;AACvC,cAAA,KAAA,CAAM,SAAS,QAAA,CAAS,MAAA;AACxB,cAAA,KAAA,CAAM,QAAQ,QAAA,CAAS,KAAA;AACvB,cAAA,KAAA,CAAM,UAAU,QAAA,CAAS,OAAA;AACzB,cAAA,KAAA,CAAM,UAAU,QAAA,CAAS,OAAA;AAAA,YAC7B;AAGA,YAAA,KAAA,CAAM,WAAW,EAAC;AAClB,YAAA,WAAA,CAAY,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAC5B;AACI,cAAA,IAAI,QAAQ,YAAA,EAAc;AAE1B,cAAA,MAAM,QAAA,GAAW,KAAA,CAAM,QAAA,CAAU,GAAG,CAAA;AACpC,cAAA,IAAI,aAAa,MAAA,EACjB;AAEI,gBAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,EAC1B;AACI,kBAAA,QAAA,CAAS,KAAK,KAAK,CAAA;AAAA,gBACvB,CAAA,MAEA;AACI,kBAAA,KAAA,CAAM,QAAA,CAAU,GAAG,CAAA,GAAI,CAAC,UAAU,KAAK,CAAA;AAAA,gBAC3C;AAAA,cACJ,CAAA,MAEA;AACI,gBAAA,KAAA,CAAM,QAAA,CAAU,GAAG,CAAA,GAAI,KAAA;AAAA,cAC3B;AAAA,YACJ,CAAC,CAAA;AAAA,UACL,SACO,KAAA,EACP;AACI,YAAA,OAAO,YAAA,CAAa,IAAA;AAAA,cAChB,kBAAA,CAAmB,aAAA,EAAe,mBAAA,EAAqB,KAAK,CAAA;AAAA,cAC5D,EAAE,QAAQ,GAAA;AAAI,aAClB;AAAA,UACJ;AAAA,QACJ,CAAA,MAEA;AAEI,UAAA,IACA;AACI,YAAA,KAAA,GAAQ,MAAM,QAAQ,IAAA,EAAK;AAAA,UAC/B,CAAA,CAAA,MAEA;AACI,YAAA,OAAO,YAAA,CAAa,IAAA;AAAA,cAChB,kBAAA,CAAmB,aAAA,EAAe,mBAAA,EAAqB,KAAK,CAAA;AAAA,cAC5D,EAAE,QAAQ,GAAA;AAAI,aAClB;AAAA,UACJ;AAAA,QACJ;AAAA,MACJ;AAGA,MAAA,MAAM,SAAA,GAAY,aAAa,SAAS,CAAA;AAExC,MAAA,IAAI,CAAC,SAAA,EACL;AACI,QAAA,SAAA,CAAU,IAAA,CAAK,CAAA,iBAAA,EAAoB,SAAS,CAAA,CAAE,CAAA;AAE9C,QAAA,OAAO,YAAA,CAAa,IAAA;AAAA,UAChB,kBAAA,CAAmB,WAAA,EAAa,CAAA,OAAA,EAAU,SAAS,eAAe,KAAK,CAAA;AAAA,UACvE,EAAE,QAAQ,GAAA;AAAI,SAClB;AAAA,MACJ;AAEA,MAAA,MAAM,EAAE,MAAA,EAAQ,YAAA,EAAc,IAAA,EAAM,YAAW,GAAI,SAAA;AAGnD,MAAA,MAAM,WAAA,GAAc,KAAA,CAAM,MAAA,IAAU,EAAC;AACrC,MAAA,MAAM,UAAA,GAAa,KAAA,CAAM,KAAA,IAAS,EAAC;AACnC,MAAA,MAAM,YAAY,KAAA,CAAM,IAAA;AACxB,MAAA,MAAM,gBAAgB,KAAA,CAAM,QAAA;AAC5B,MAAA,MAAM,WAAA,GAAc,gBAAgB,IAAA,IAAQ,aAAA,IAAiB,OAAO,IAAA,CAAK,aAAa,EAAE,MAAA,GAAS,CAAA;AAEjG,MAAA,MAAM,YAAA,GAAe,kBAAA,CAAmB,UAAA,EAAY,WAAW,CAAA;AAC/D,MAAA,MAAM,WAAA,GAAc,iBAAiB,UAAU,CAAA;AAC/C,MAAA,MAAM,YAAY,CAAA,EAAG,MAAM,CAAA,EAAG,YAAY,GAAG,WAAW,CAAA,CAAA;AAExD,MAAA,IAAI,KAAA,EACJ;AACI,QAAA,SAAA,CAAU,MAAM,oBAAA,EAAiB;AAAA,UAC7B,SAAA;AAAA,UACA,YAAA;AAAA,UACA,UAAA,EAAY,YAAA;AAAA,UACZ,SAAA;AAAA,UACA,OAAA,EAAS,CAAC,CAAC,SAAA;AAAA,UACX;AAAA,SACH,CAAA;AAAA,MACL;AAGA,MAAA,MAAM,OAAA,GAAU,iBAAA,CAAkB,OAAA,CAAQ,OAAA,EAAS,cAAc,CAAA;AAGjE,MAAA,IAAI,WAAA,EACJ;AACI,QAAA,OAAA,CAAQ,OAAO,cAAc,CAAA;AAAA,MACjC;AAGA,MAAA,MAAM,YAAA,GAA4B;AAAA,QAC9B,MAAA,EAAQ,YAAA;AAAA,QACR;AAAA,OACJ;AAGA,MAAA,IAAI,CAAC,MAAA,EAAQ,KAAA,EAAO,OAAO,CAAA,CAAE,QAAA,CAAS,YAAY,CAAA,EAClD;AACI,QAAA,IAAI,eAAe,WAAA,EACnB;AAEI,UAAA,MAAM,eAAA,GAAkB,IAAI,QAAA,EAAS;AACrC,UAAA,WAAA,CAAY,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAC5B;AACI,YAAA,IAAI,QAAQ,YAAA,EACZ;AACI,cAAA,eAAA,CAAgB,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,YACrC;AAAA,UACJ,CAAC,CAAA;AACD,UAAA,YAAA,CAAa,IAAA,GAAO,eAAA;AAAA,QACxB,WACS,SAAA,EACT;AACI,UAAA,YAAA,CAAa,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA;AAAA,QAChD;AAAA,MACJ;AAOA,MAAA,MAAM,eAAA,GAAkB,mBAAA,CAAoB,wBAAA,EAA0B,uBAAA,EAAyB,cAAc,mBAAmB,CAAA;AAChI,MAAA,MAAM,oBAAA,GAAuB,0BAAA,CAA2B,eAAA,EAAiB,YAAA,EAAc,YAAY,CAAA;AAEnG,MAAA,IAAI,KAAA,IAAS,oBAAA,CAAqB,MAAA,GAAS,CAAA,EAC3C;AACI,QAAA,SAAA,CAAU,KAAA,CAAM,SAAS,oBAAA,CAAqB,MAAM,8BAA8B,YAAY,CAAA,CAAA,EAAI,YAAY,CAAA,CAAE,CAAA;AAAA,MACpH;AAGA,MAAA,MAAM,UAAA,GAAa,4BAA4B,OAAO,CAAA;AACtD,MAAA,MAAM,UAAA,GAAa,mBAAA;AAAA,QACf,YAAA,CAAa,MAAM,CAAC,CAAA;AAAA;AAAA,QACpB,YAAA;AAAA,QACA,OAAA;AAAA,QACA,SAAA;AAAA,QACA,IAAI,eAAA,CAAgB,WAAA,CAAY,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA;AAAA,QACxC,UAAA;AAAA,QACA;AAAA,OACJ;AAGA,MAAA,MAAM,wBAAA,GAA2B,oBAAA,CAAqB,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,OAAO,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAkC,CAAC,CAAC,CAAC,CAAA;AACvH,MAAA,IAAI,wBAAA,CAAyB,SAAS,CAAA,EACtC;AACI,QAAA,MAAM,0BAAA,CAA2B,YAAY,wBAAwB,CAAA;AAGrE,QAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,UAAA,CAAW,OAAO,CAAA,EAC5D;AACI,UAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,KAAK,CAAA;AAAA,QAC1B;AAGA,QAAA,IAAI,WAAW,IAAA,EACf;AACI,UAAA,YAAA,CAAa,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,UAAA,CAAW,IAAI,CAAA;AAAA,QACtD;AAAA,MACJ;AAQA,MAAA,IAAI,WAAW,KAAA,EACf;AACI,QAAA,SAAA,CAAU,KAAK,mCAAA,EAAqC;AAAA,UAChD,SAAA;AAAA,UACA,MAAA,EAAQ,WAAW,KAAA,CAAM;AAAA,SAC5B,CAAA;AAED,QAAA,MAAM,gBAAgB,YAAA,CAAa,IAAA;AAAA,UAC/B,WAAW,KAAA,CAAM,IAAA;AAAA,UACjB,EAAE,MAAA,EAAQ,UAAA,CAAW,KAAA,CAAM,MAAA;AAAO,SACtC;AAEA,QAAA,KAAA,MAAW,MAAA,IAAU,UAAA,CAAW,KAAA,CAAM,UAAA,IAAc,EAAC,EACrD;AACI,UAAA,aAAA,CAAc,OAAA,CAAQ,MAAA,CAAO,YAAA,EAAc,oBAAA,CAAqB,MAAM,CAAC,CAAA;AAAA,QAC3E;AAEA,QAAA,OAAO,aAAA;AAAA,MACX;AAQA,MAAA,IAAI,QAAA,EACJ;AACI,QAAA,MAAM,aAAa,OAAO,YAAA,CAAa,IAAA,KAAS,QAAA,GAAW,aAAa,IAAA,GAAO,MAAA;AAK/E,QAAA,MAAM,mBAAmB,gBAAA,CAAiB;AAAA,UACtC,GAAA,EAAK,QAAA;AAAA,UACL,MAAA,EAAQ,YAAA;AAAA,UACR,IAAA,EAAM,YAAA;AAAA,UACN,KAAA,EAAO,WAAA;AAAA,UACP,IAAA,EAAM;AAAA,SACT,CAAA;AAED,QAAA,KAAA,MAAW,CAAC,UAAA,EAAY,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,gBAAgB,CAAA,EACjE;AACI,UAAA,OAAA,CAAQ,GAAA,CAAI,YAAY,KAAK,CAAA;AAAA,QACjC;AAAA,MACJ;AAGA,MAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,MAAA,MAAM,YAAY,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,OAAO,CAAA;AAE9D,MAAA,IACA;AACI,QAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,SAAA,EAAW;AAAA,UACpC,GAAG,YAAA;AAAA,UACH,QAAQ,UAAA,CAAW;AAAA,SACtB,CAAA;AAED,QAAA,YAAA,CAAa,SAAS,CAAA;AAGtB,QAAA,IAAI,IAAA,GAAO,MAAM,iBAAA,CAAkB,QAAQ,CAAA;AAO3C,QAAA,MAAM,WAAA,GAAc,oBAAA;AAAA,UAChB,YAAA,CAAa,MAAM,CAAC,CAAA;AAAA,UACpB,YAAA;AAAA,UACA,OAAA;AAAA,UACA,SAAA;AAAA,UACA,QAAA;AAAA,UACA,IAAA;AAAA,UACA,UAAA,CAAW,QAAA;AAAA,UACX,UAAA,CAAW;AAAA,SACf;AAGA,QAAA,MAAM,yBAAA,GAA4B,oBAAA,CAAqB,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,QAAQ,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAkC,CAAC,CAAC,CAAC,CAAA;AACzH,QAAA,IAAI,yBAAA,CAA0B,SAAS,CAAA,EACvC;AACI,UAAA,MAAM,2BAAA,CAA4B,aAAa,yBAAyB,CAAA;AACxE,UAAA,IAAA,GAAO,YAAY,QAAA,CAAS,IAAA;AAAA,QAChC;AAEA,QAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAE9B,QAAA,IAAI,KAAA,EACJ;AACI,UAAA,SAAA,CAAU,MAAM,qBAAA,EAAkB;AAAA,YAC9B,SAAA;AAAA,YACA,MAAA,EAAQ,YAAY,QAAA,CAAS,MAAA;AAAA,YAC7B,QAAA,EAAU,GAAG,QAAQ,CAAA,EAAA;AAAA,WACxB,CAAA;AAAA,QACL;AAIA,QAAA,MAAM,eAAe,WAAA,CAAY,QAAA,CAAS,WAAW,GAAA,GAC/C,IAAI,aAAa,IAAA,EAAM;AAAA,UACrB,MAAA,EAAQ,GAAA;AAAA,UACR,UAAA,EAAY,YAAY,QAAA,CAAS;AAAA,SACpC,CAAA,GACC,YAAA,CAAa,IAAA,CAAK,IAAA,EAAM;AAAA,UACtB,MAAA,EAAQ,YAAY,QAAA,CAAS,MAAA;AAAA,UAC7B,UAAA,EAAY,YAAY,QAAA,CAAS;AAAA,SACpC,CAAA;AAGL,QAAA,sBAAA,CAAuB,QAAA,CAAS,OAAA,EAAS,YAAA,CAAa,OAAO,CAAA;AAG7D,QAAA,KAAA,MAAW,MAAA,IAAU,YAAY,UAAA,EACjC;AACI,UAAA,MAAM,eAAA,GAAkB,qBAAqB,MAAM,CAAA;AACnD,UAAA,YAAA,CAAa,OAAA,CAAQ,MAAA,CAAO,YAAA,EAAc,eAAe,CAAA;AAEzD,UAAA,IAAI,KAAA,EACJ;AACI,YAAA,SAAA,CAAU,MAAM,yBAAA,EAA2B;AAAA,cACvC,MAAM,MAAA,CAAO;AAAA,aAChB,CAAA;AAAA,UACL;AAAA,QACJ;AAEA,QAAA,OAAO,YAAA;AAAA,MACX,SACO,KAAA,EACP;AACI,QAAA,YAAA,CAAa,SAAS,CAAA;AAGtB,QAAA,IAAI,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,YAAA,EAC7C;AACI,UAAA,SAAA,CAAU,MAAM,iBAAA,EAAmB;AAAA,YAC/B,SAAA;AAAA,YACA,SAAA;AAAA,YACA;AAAA,WACH,CAAA;AAED,UAAA,OAAO,YAAA,CAAa,IAAA;AAAA,YAChB,mBAAmB,iBAAA,EAAmB,CAAA,wBAAA,EAA2B,OAAO,CAAA,EAAA,CAAA,EAAM,OAAO,KAAK,CAAA;AAAA,YAC1F,EAAE,QAAQ,GAAA;AAAI,WAClB;AAAA,QACJ;AAGA,QAAA,MAAM,QAAA,GAAW,KAAA;AACjB,QAAA,SAAA,CAAU,MAAM,aAAA,EAAe;AAAA,UAC3B,SAAA;AAAA,UACA,SAAA;AAAA,UACA,OAAO,QAAA,CAAS;AAAA,SACnB,CAAA;AAED,QAAA,OAAO,YAAA,CAAa,IAAA;AAAA,UAChB,mBAAmB,aAAA,EAAe,QAAA,CAAS,OAAA,IAAW,8BAAA,EAAgC,OAAO,QAAQ,CAAA;AAAA,UACrG,EAAE,QAAQ,GAAA;AAAI,SAClB;AAAA,MACJ;AAAA,IACJ,SACO,KAAA,EACP;AACI,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAC9B,MAAA,MAAM,GAAA,GAAM,KAAA;AAEZ,MAAA,SAAA,CAAU,MAAM,iBAAA,EAAmB;AAAA,QAC/B,OAAO,GAAA,CAAI,OAAA;AAAA,QACX,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,QAAA,EAAU,GAAG,QAAQ,CAAA,EAAA;AAAA,OACxB,CAAA;AAED,MAAA,OAAO,YAAA,CAAa,IAAA;AAAA,QAChB,mBAAmB,uBAAA,EAAyB,GAAA,CAAI,OAAA,IAAW,eAAA,EAAiB,OAAO,GAAG,CAAA;AAAA,QACtF,EAAE,QAAQ,GAAA;AAAI,OAClB;AAAA,IACJ;AAAA,EACJ;AAGA,EAAA,OAAO;AAAA,IACH,KAAK,CAAC,GAAA,EAAkB,OAAA,KACpB,SAAA,CAAU,KAAK,OAAO,CAAA;AAAA,IAC1B,MAAM,CAAC,GAAA,EAAkB,OAAA,KACrB,SAAA,CAAU,KAAK,OAAO;AAAA,GAC9B;AACJ","file":"server.js","sourcesContent":["/**\n * Proxy → Backend request signing (HMAC-SHA256) with key rotation\n *\n * Shared between the Next.js RPC proxy (which signs outbound requests) and the\n * backend proxy-guard middleware (which verifies them). Keeping the canonical\n * string and HMAC logic in one pure module guarantees both sides agree.\n *\n * The signature proves a request passed through a trusted proxy that holds the\n * shared secret. It does NOT authenticate the end user — that is the JWT layer's\n * job — and it cannot stop a client from calling the proxy itself. Its role is to\n * stop direct-to-backend calls that bypass the proxy.\n *\n * Keys are identified by a short keyId so secrets can be rotated without downtime:\n * the proxy signs with the active key and stamps its keyId in a header; the\n * backend keeps a set of accepted keys (current + previous) and selects by keyId.\n * Roll a new key in, let both sides pick it up, switch the proxy to it, then drop\n * the old one after a grace period — no request is ever rejected mid-rotation.\n *\n * @module security/proxy-signature\n */\nimport { createHmac, randomBytes, timingSafeEqual, createHash } from 'node:crypto';\n\n// ============================================================================\n// Header names\n// ============================================================================\n\nexport const PROXY_SIGNATURE_HEADER = 'x-spfn-proxy-signature';\nexport const PROXY_TIMESTAMP_HEADER = 'x-spfn-proxy-timestamp';\nexport const PROXY_NONCE_HEADER = 'x-spfn-proxy-nonce';\nexport const PROXY_KEY_ID_HEADER = 'x-spfn-proxy-key-id';\n/**\n * The real client IP, forwarded by the proxy. The backend trusts this only when\n * the request is proxy-verified (proxy-guard `clientType` ≠ untrusted) — the proxy\n * itself sees no spoofable hop, so a verified request's value is the true client.\n */\nexport const PROXY_CLIENT_IP_HEADER = 'x-spfn-proxy-client-ip';\n\n/** keyId used when a raw secret carries no `keyId:` prefix (back-compat). */\nexport const DEFAULT_KEY_ID = 'default';\n\n// ============================================================================\n// Keys\n// ============================================================================\n\n/**\n * A signing key: a short identifier plus its secret. Encoded in env as\n * `<keyId>:<secret>` (e.g. `v2:9f3c...`); a bare secret gets `DEFAULT_KEY_ID`.\n */\nexport interface ProxyKey\n{\n    keyId: string;\n    secret: string;\n}\n\n/**\n * Parse one `<keyId>:<secret>` (or bare `<secret>`) string into a ProxyKey.\n * keyId is everything before the FIRST colon; the secret keeps any later colons.\n */\nexport function parseProxyKey(raw: string): ProxyKey\n{\n    const idx = raw.indexOf(':');\n    if (idx === -1)\n    {\n        return { keyId: DEFAULT_KEY_ID, secret: raw };\n    }\n\n    // A leading colon (':secret') yields an empty keyId; the backend treats an empty\n    // keyId header as \"missing\" and rejects, so normalize it to DEFAULT_KEY_ID.\n    return { keyId: raw.slice(0, idx) || DEFAULT_KEY_ID, secret: raw.slice(idx + 1) };\n}\n\n/**\n * Build the backend's accepted key set from raw env values. Each input may be a\n * single key or a comma-separated list (for multiple grace keys). Earlier inputs\n * win on keyId collision, so pass the active secret first.\n */\nexport function parseProxyKeySet(raws: Array<string | undefined | null>): ProxyKey[]\n{\n    const keys: ProxyKey[] = [];\n    const seen = new Set<string>();\n\n    for (const raw of raws)\n    {\n        if (!raw)\n        {\n            continue;\n        }\n\n        for (const part of raw.split(','))\n        {\n            const trimmed = part.trim();\n            if (!trimmed)\n            {\n                continue;\n            }\n\n            const key = parseProxyKey(trimmed);\n            if (!key.secret || seen.has(key.keyId))\n            {\n                continue;\n            }\n\n            seen.add(key.keyId);\n            keys.push(key);\n        }\n    }\n\n    return keys;\n}\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/**\n * The parts of a request that are bound into the signature.\n */\nexport interface SignatureParts\n{\n    /** Resolved backend HTTP method (GET/POST/PUT/...) */\n    method: string;\n\n    /**\n     * Raw (wire) backend path, percent-encoding preserved, leading slash, NO query.\n     * Proxy signs its outbound request-target path; the backend reconstructs the\n     * SAME bytes from `new URL(c.req.url).pathname` (NOT the decoded `c.req.path`).\n     */\n    path: string;\n\n    /**\n     * Raw (wire) query string including leading `?`, or '' when there is none.\n     * Both sides use the verbatim search string so query params are authenticated.\n     */\n    query: string;\n\n    /** Unix epoch milliseconds, as a string */\n    timestamp: string;\n\n    /** Random per-request nonce */\n    nonce: string;\n\n    /**\n     * SHA-256 hex of the raw request body, or empty string when there is no body\n     * (GET/HEAD, or multipart uploads which are excluded by design). Bound for ANY\n     * non-multipart content-type, not just application/json.\n     *\n     * Multipart is excluded so the proxy can stream large uploads without buffering\n     * them to hash. The signature therefore proves *provenance* (came through the\n     * trusted proxy) and binds method/path/query/timestamp for a multipart request,\n     * but NOT the body bytes. Two consequences, by design:\n     *   - Multipart *content* integrity/validation is the application's job (size,\n     *     type, checksum, business rules) — not the transport signature's.\n     *   - If you don't trust the proxy→backend hop itself, secure it with TLS/mTLS;\n     *     signing a prefix of the stream would be a half-measure (the tail stays\n     *     unprotected) and is intentionally not done.\n     */\n    bodyHash: string;\n}\n\n/**\n * Headers produced by signing — ready to set on the outbound fetch.\n */\nexport interface SignatureHeaders\n{\n    [PROXY_SIGNATURE_HEADER]: string;\n    [PROXY_TIMESTAMP_HEADER]: string;\n    [PROXY_NONCE_HEADER]: string;\n    [PROXY_KEY_ID_HEADER]: string;\n}\n\n// ============================================================================\n// Canonical string + HMAC\n// ============================================================================\n\n/**\n * Build the canonical string that gets signed. Field order is fixed and each\n * field is newline-separated, so a captured signature cannot be replayed against\n * a different method, path, or body.\n */\nexport function buildCanonicalString(parts: SignatureParts): string\n{\n    return [parts.method.toUpperCase(), parts.path, parts.query, parts.timestamp, parts.nonce, parts.bodyHash].join('\\n');\n}\n\n/**\n * Hash a request body. Accepts a string (proxy side, from JSON.stringify) or a\n * Buffer (backend side, straight from the stream — avoids a bytes→string→bytes\n * round-trip). Returns '' for empty/no body. A utf8 string and its Buffer hash\n * identically, so both sides agree.\n */\nexport function hashBody(body: string | Buffer | undefined | null): string\n{\n    if (!body || body.length === 0)\n    {\n        return '';\n    }\n\n    return typeof body === 'string'\n        ? createHash('sha256').update(body, 'utf8').digest('hex')\n        : createHash('sha256').update(body).digest('hex');\n}\n\n/**\n * Compute the HMAC-SHA256 signature (hex) for the given parts.\n */\nexport function computeSignature(secret: string, parts: SignatureParts): string\n{\n    return createHmac('sha256', secret).update(buildCanonicalString(parts)).digest('hex');\n}\n\n/**\n * Generate a fresh random nonce (hex).\n */\nexport function generateNonce(): string\n{\n    return randomBytes(16).toString('hex');\n}\n\n// ============================================================================\n// Sign (proxy side)\n// ============================================================================\n\nexport interface SignInput\n{\n    /** The active signing key. */\n    key: ProxyKey;\n    method: string;\n    /** Raw (wire) path, leading slash, percent-encoding preserved, NO query. */\n    path: string;\n    /** Raw (wire) query string including leading `?`, or '' / omitted for none. */\n    query?: string;\n    /** Raw request body string, if any. Omit for GET / multipart uploads. */\n    body?: string | null;\n    /** Override the timestamp (testing). Defaults to Date.now(). */\n    timestamp?: string;\n    /** Override the nonce (testing). Defaults to a random nonce. */\n    nonce?: string;\n}\n\n/**\n * Sign an outbound proxy request and return the headers to attach (including the\n * keyId so the backend knows which key to verify against).\n */\nexport function signProxyRequest(input: SignInput): SignatureHeaders\n{\n    const timestamp = input.timestamp ?? String(Date.now());\n    const nonce = input.nonce ?? generateNonce();\n    const signature = computeSignature(input.key.secret, {\n        method: input.method,\n        path: input.path,\n        query: input.query ?? '',\n        timestamp,\n        nonce,\n        bodyHash: hashBody(input.body),\n    });\n\n    return {\n        [PROXY_SIGNATURE_HEADER]: signature,\n        [PROXY_TIMESTAMP_HEADER]: timestamp,\n        [PROXY_NONCE_HEADER]: nonce,\n        [PROXY_KEY_ID_HEADER]: input.key.keyId,\n    };\n}\n\n// ============================================================================\n// Verify (backend side)\n// ============================================================================\n\nexport type VerifyFailureReason =\n    | 'missing-headers'\n    | 'stale-timestamp'\n    | 'bad-timestamp'\n    | 'unknown-key'\n    | 'signature-mismatch';\n\n// ('body-read-error' / 'origin-not-allowed' / 'nonce-replay' are guard-level\n//  reasons carried separately by the middleware, not produced by verify itself.)\n\nexport interface VerifyResult\n{\n    valid: boolean;\n    reason?: VerifyFailureReason;\n    /** The verified nonce, for optional replay tracking by the caller. */\n    nonce?: string;\n    /** The keyId the request was verified against (for logging/metrics). */\n    keyId?: string;\n}\n\nexport interface VerifyInput\n{\n    /** Accepted keys (active + grace). Selected by the request's keyId header. */\n    keys: ProxyKey[];\n    method: string;\n    /** Raw (wire) path from `new URL(c.req.url).pathname` — NOT decoded `c.req.path`. */\n    path: string;\n    /** Raw (wire) query string from `new URL(c.req.url).search`, or '' for none. */\n    query?: string;\n    /** Raw request body (string or Buffer) as received, if any. */\n    body?: string | Buffer | null;\n    signature: string | null | undefined;\n    timestamp: string | null | undefined;\n    nonce: string | null | undefined;\n    keyId: string | null | undefined;\n    /** Allowed clock skew / replay window in ms. Default 30s. */\n    windowMs?: number;\n    /** Current time (testing). Defaults to Date.now(). */\n    now?: number;\n}\n\n/**\n * Constant-time hex string comparison. Returns false on any length diff.\n *\n * Buffer.from(_, 'hex') does NOT throw on invalid hex — it silently truncates at\n * the first bad char — so a malformed signature yields a shorter buffer that the\n * length check rejects. No try/catch needed.\n */\nfunction safeEqualHex(a: string, b: string): boolean\n{\n    const bufA = Buffer.from(a, 'hex');\n    const bufB = Buffer.from(b, 'hex');\n\n    if (bufA.length === 0 || bufA.length !== bufB.length)\n    {\n        return false;\n    }\n\n    return timingSafeEqual(bufA, bufB);\n}\n\n/**\n * Verify an inbound request's proxy signature against the accepted key set.\n *\n * Checks, in order: headers present, timestamp within window (replay guard),\n * keyId known, and HMAC match. Nonce-level replay rejection is left to the caller\n * (optional, Redis-backed) since not every deployment has a shared store.\n */\nexport function verifyProxyRequest(input: VerifyInput): VerifyResult\n{\n    const { signature, timestamp, nonce, keyId } = input;\n\n    if (!signature || !timestamp || !nonce || !keyId)\n    {\n        return { valid: false, reason: 'missing-headers' };\n    }\n\n    const ts = Number(timestamp);\n    if (!Number.isFinite(ts))\n    {\n        return { valid: false, reason: 'bad-timestamp' };\n    }\n\n    const now = input.now ?? Date.now();\n    const windowMs = input.windowMs ?? 30_000;\n    if (Math.abs(now - ts) > windowMs)\n    {\n        return { valid: false, reason: 'stale-timestamp' };\n    }\n\n    const key = input.keys.find(k => k.keyId === keyId);\n    if (!key)\n    {\n        return { valid: false, reason: 'unknown-key' };\n    }\n\n    const expected = computeSignature(key.secret, {\n        method: input.method,\n        path: input.path,\n        query: input.query ?? '',\n        timestamp,\n        nonce,\n        bodyHash: hashBody(input.body),\n    });\n\n    if (!safeEqualHex(signature, expected))\n    {\n        return { valid: false, reason: 'signature-mismatch' };\n    }\n\n    return { valid: true, nonce, keyId };\n}\n","/**\n * Shared utilities for Next.js client and proxy modules\n *\n * Contains common functions used by both client and proxy to avoid code duplication.\n */\n\n/**\n * Build URL with path parameters replaced\n *\n * @example\n * buildUrlWithParams('/users/:id/posts/:postId', { id: '123', postId: '456' })\n * // Returns: '/users/123/posts/456'\n */\nexport function buildUrlWithParams(path: string, params: Record<string, any>): string\n{\n    let url = path;\n    for (const [key, value] of Object.entries(params))\n    {\n        url = url.replace(`:${key}`, encodeURIComponent(String(value)));\n    }\n\n    return url;\n}\n\n/**\n * Build query string from object\n *\n * @example\n * buildQueryString({ page: '1', limit: '10', tags: ['foo', 'bar'] })\n * // Returns: '?page=1&limit=10&tags=foo&tags=bar'\n */\nexport function buildQueryString(query: Record<string, any>): string\n{\n    if (Object.keys(query).length === 0)\n    {\n        return '';\n    }\n\n    const searchParams = new URLSearchParams();\n    for (const [key, value] of Object.entries(query))\n    {\n        if (Array.isArray(value))\n        {\n            value.forEach((v) => searchParams.append(key, String(v)));\n        }\n        else\n        {\n            searchParams.append(key, String(value));\n        }\n    }\n\n    return `?${searchParams.toString()}`;\n}\n\n/**\n * Build Cookie header string from cookies object\n *\n * @example\n * buildCookieHeader({ session: 'abc123', theme: 'dark' })\n * // Returns: 'session=abc123; theme=dark'\n */\nexport function buildCookieHeader(cookies: Record<string, string>): string\n{\n    return Object.entries(cookies)\n        .map(([key, value]) => `${key}=${value}`)\n        .join('; ');\n}\n\n/**\n * Parse response body based on content type\n *\n * Handles:\n * - 204 No Content: returns null (no body expected)\n * - application/json: parses JSON body\n * - Other content types: returns raw text\n */\nexport async function parseResponseBody(response: Response): Promise<any>\n{\n    // 204 No Content has no body\n    if (response.status === 204)\n    {\n        return null;\n    }\n\n    const contentType = response.headers.get('content-type');\n\n    if (contentType?.includes('application/json'))\n    {\n        const text = await response.text();\n\n        return text ? JSON.parse(text) : null;\n    }\n    else\n    {\n        return await response.text();\n    }\n}\n","/**\n * SPFN Next.js Proxy Interceptor Execution Engine\n */\n\nimport type {\n    InterceptorRule,\n    RequestInterceptor,\n    ResponseInterceptor,\n    RequestInterceptorContext,\n    ResponseInterceptorContext,\n} from './types';\n\n/**\n * Check if path matches pattern\n *\n * Supports:\n * - Wildcards: '/_auth/*' matches '/_auth/login'\n * - Path params: '/users/:id' matches '/users/123'\n * - RegExp: /^\\/_auth\\/.+$/ matches '/_auth/login'\n * - Exact match: '/_auth/login' matches '/_auth/login'\n * - All: '*' matches any path\n *\n * @param path - Request path to test\n * @param pattern - Pattern to match against\n * @returns True if path matches pattern\n */\nexport function matchPath(path: string, pattern: string | RegExp): boolean\n{\n    // Match all\n    if (pattern === '*')\n    {\n        return true;\n    }\n\n    // RegExp pattern\n    if (pattern instanceof RegExp)\n    {\n        return pattern.test(path);\n    }\n\n    // String pattern\n    // Convert wildcard pattern to RegExp\n    // '/_auth/*' -> /^\\/_auth\\/.*/\n    // '/users/:id' -> /^\\/users\\/[^/]+$/\n    const regexPattern = pattern\n        .replace(/\\*/g, '.*')\n        .replace(/:[^/]+/g, '[^/]+')\n        .replace(/\\//g, '\\\\/');\n\n    const regex = new RegExp(`^${regexPattern}$`);\n\n    return regex.test(path);\n}\n\n/**\n * Check if method matches pattern\n *\n * @param method - Request method (e.g., 'POST')\n * @param pattern - Method pattern (e.g., 'POST' or ['POST', 'PUT'])\n * @returns True if method matches pattern\n */\nexport function matchMethod(\n    method: string,\n    pattern?: string | string[],\n): boolean\n{\n    // No method filter = match all\n    if (!pattern)\n    {\n        return true;\n    }\n\n    // Single method\n    if (typeof pattern === 'string')\n    {\n        return method.toUpperCase() === pattern.toUpperCase();\n    }\n\n    // Multiple methods\n    return pattern.some((m) => m.toUpperCase() === method.toUpperCase());\n}\n\n/**\n * Filter interceptors that match the request\n *\n * @param rules - All interceptor rules\n * @param path - Request path\n * @param method - Request method\n * @returns Matched interceptors\n */\nexport function filterMatchingInterceptors(\n    rules: InterceptorRule[],\n    path: string,\n    method: string,\n): InterceptorRule[]\n{\n    return rules.filter((rule) => \n    {\n        return matchPath(path, rule.pathPattern) && matchMethod(method, rule.method);\n    });\n}\n\n/**\n * Execute request interceptors in chain\n *\n * Interceptors are executed in order:\n * 1. First registered interceptor\n * 2. Second registered interceptor\n * 3. ... and so on\n *\n * Each interceptor must call next() to continue the chain.\n * If next() is not called, the chain stops and remaining interceptors are skipped.\n *\n * @param context - Request interceptor context\n * @param interceptors - Interceptors to execute\n */\nexport async function executeRequestInterceptors(\n    context: RequestInterceptorContext,\n    interceptors: RequestInterceptor[],\n): Promise<void>\n{\n    let index = 0;\n\n    const next = async (): Promise<void> => \n    {\n        if (index >= interceptors.length)\n        {\n            return;\n        }\n\n        const interceptor = interceptors[index];\n        index++;\n\n        await interceptor(context, next);\n    };\n\n    await next();\n}\n\n/**\n * Execute response interceptors in chain\n *\n * Interceptors are executed in order:\n * 1. First registered interceptor\n * 2. Second registered interceptor\n * 3. ... and so on\n *\n * Each interceptor must call next() to continue the chain.\n * If next() is not called, the chain stops and remaining interceptors are skipped.\n *\n * @param context - Response interceptor context\n * @param interceptors - Interceptors to execute\n */\nexport async function executeResponseInterceptors(\n    context: ResponseInterceptorContext,\n    interceptors: ResponseInterceptor[],\n): Promise<void>\n{\n    let index = 0;\n\n    const next = async (): Promise<void> => \n    {\n        if (index >= interceptors.length)\n        {\n            return;\n        }\n\n        const interceptor = interceptors[index];\n        index++;\n\n        await interceptor(context, next);\n    };\n\n    await next();\n}\n","/**\n * Global Interceptor Registry\n *\n * Allows packages to automatically register their interceptors\n * for Next.js proxy without manual configuration.\n *\n * Uses globalThis for persistence across module reloads (HMR).\n */\nimport type { InterceptorRule } from './types';\n\n// ============================================================================\n// Global Type Declarations\n// ============================================================================\n\n/**\n * Extend globalThis with interceptor registry\n *\n * Using globalThis allows the registry to persist across module reloads (HMR).\n * preventing duplicate registrations during development with HMR.\n */\ndeclare global\n{\n    var __SPFN_INTERCEPTOR_REGISTRY__: InterceptorRegistry | undefined;\n}\n\n/**\n * Global interceptor registry\n *\n * Packages register their interceptors on import,\n * and proxy automatically discovers and applies them.\n */\nexport class InterceptorRegistry\n{\n    private interceptors = new Map<string, InterceptorRule[]>();\n\n    /**\n     * Register interceptors for a package\n     *\n     * @param packageName - Unique package identifier (e.g., 'auth', 'storage')\n     * @param interceptors - Array of interceptor rules\n     *\n     * @example\n     * ```typescript\n     * registerInterceptors('auth', [\n     *   {\n     *     pathPattern: '/_auth/*',\n     *     request: async (ctx, next) => { ... }\n     *   }\n     * ]);\n     * ```\n     */\n    register(packageName: string, interceptors: InterceptorRule[]): void\n    {\n        if (!this.interceptors.has(packageName))\n        {\n            this.interceptors.set(packageName, interceptors);\n        }\n    }\n\n    /**\n     * Get all registered interceptors\n     *\n     * @param exclude - Package names to exclude\n     * @returns Flat array of all interceptor rules\n     */\n    getAll(exclude: string[] = []): InterceptorRule[]\n    {\n        const all: InterceptorRule[] = [];\n\n        for (const [packageName, interceptors] of this.interceptors.entries())\n        {\n            if (!exclude.includes(packageName))\n            {\n                all.push(...interceptors);\n            }\n        }\n\n        return all;\n    }\n\n    /**\n     * Get interceptors for specific package\n     *\n     * @param packageName - Package identifier\n     * @returns Interceptor rules or undefined\n     */\n    get(packageName: string): InterceptorRule[] | undefined\n    {\n        return this.interceptors.get(packageName);\n    }\n\n    /**\n     * Get list of registered package names\n     */\n    getPackageNames(): string[]\n    {\n        return Array.from(this.interceptors.keys());\n    }\n\n    /**\n     * Check if package has registered interceptors\n     */\n    has(packageName: string): boolean\n    {\n        return this.interceptors.has(packageName);\n    }\n\n    /**\n     * Unregister interceptors for a package\n     *\n     * @param packageName - Package identifier\n     */\n    unregister(packageName: string): void\n    {\n        this.interceptors.delete(packageName);\n    }\n\n    /**\n     * Clear all registered interceptors\n     *\n     * Useful for testing\n     */\n    clear(): void\n    {\n        this.interceptors.clear();\n    }\n\n    /**\n     * Get total count of registered interceptors\n     */\n    count(): number\n    {\n        let total = 0;\n        for (const interceptors of this.interceptors.values())\n        {\n            total += interceptors.length;\n        }\n\n        return total;\n    }\n}\n\n/**\n * Global singleton registry instance\n *\n * Uses globalThis to persist across module reloads (HMR).\n * This prevents duplicate registrations during development.\n */\nexport const interceptorRegistry = (() =>\n{\n    if (!globalThis.__SPFN_INTERCEPTOR_REGISTRY__)\n    {\n        globalThis.__SPFN_INTERCEPTOR_REGISTRY__ = new InterceptorRegistry();\n    }\n\n    return globalThis.__SPFN_INTERCEPTOR_REGISTRY__;\n})();\n\n/**\n * Register interceptors for a package\n *\n * This should be called during package initialization (on import).\n * The interceptors will be automatically applied by the Next.js proxy.\n *\n * @param packageName - Unique package identifier (e.g., 'auth', 'storage')\n * @param interceptors - Array of interceptor rules\n *\n * @example\n * ```typescript\n * // packages/auth/src/adapters/nextjs/interceptors/index.ts\n * import { registerInterceptors } from '@spfn/core/nextjs';\n *\n * const authInterceptors = [\n *   {\n *     pathPattern: '/_auth/*',\n *     request: async (ctx, next) => {\n *       // Add JWT token\n *       ctx.headers['Authorization'] = 'Bearer token';\n *       await next();\n *     }\n *   }\n * ];\n *\n * // Auto-register on import\n * registerInterceptors('auth', authInterceptors);\n * ```\n */\nexport function registerInterceptors(\n    packageName: string,\n    interceptors: InterceptorRule[],\n): void\n{\n    interceptorRegistry.register(packageName, interceptors);\n}\n","/**\n * Helper functions for proxy handler\n * Separates utility logic from main proxy handler for better maintainability\n */\nimport { NextRequest } from 'next/server';\nimport type { CookieOptions, SetCookie } from '../client';\nimport type { InterceptorRule, RequestInterceptorContext, ResponseInterceptorContext } from './interceptors/types';\nimport type { InterceptorRegistry } from './interceptors';\nimport { PROXY_CLIENT_IP_HEADER } from '../../security/proxy-signature';\n\n// Re-export from shared\nexport { parseResponseBody } from '../shared';\n\n/**\n * Resolve the real client IP from a forwarded chain.\n *\n * `X-Forwarded-For` is `client, proxy1, proxy2, …` — each trusted hop appends the\n * address it received the connection from, so the rightmost `trustedHops` entries\n * are added by our own infra and can't be spoofed. The client as the outermost\n * trusted hop saw it is `parts[len - trustedHops]`. A client that prepends a fake\n * value just lengthens the chain to the left and is ignored.\n *\n * @param xff - raw X-Forwarded-For header value\n * @param trustedHops - number of trusted proxies in front (e.g. LB + nginx = 2)\n */\nexport function clientIpFromForwardedChain(\n    xff: string | null | undefined,\n    trustedHops: number,\n): string | undefined\n{\n    if (!xff) return undefined;\n\n    const parts = xff.split(',').map(s => s.trim()).filter(Boolean);\n    if (parts.length === 0) return undefined;\n\n    const idx = parts.length - Math.max(1, trustedHops);\n\n    // Fewer entries than configured hops (misconfig / fewer real hops): best-effort\n    // to the leftmost rather than returning nothing.\n    return parts[idx] ?? parts[0];\n}\n\nfunction trustedProxyHops(): number\n{\n    const raw = Number.parseInt(process.env.TRUSTED_PROXY_HOPS ?? '', 10);\n\n    return Number.isFinite(raw) && raw > 0 ? raw : 1;\n}\n\n/**\n * Build request headers for proxying\n * Forwards important headers from source and adds default headers\n *\n * @param sourceHeaders - Source headers (can be Headers object or Record)\n * @param defaultHeaders - Default headers to add\n */\nexport function buildProxyHeaders(\n    sourceHeaders: Headers | Record<string, string>,\n    defaultHeaders: Record<string, string>,\n): Headers\n{\n    const headers = new Headers();\n\n    // Forward important headers from source\n    const headersToForward = [\n        'content-type',\n        'authorization',\n        'cookie',\n        'user-agent',\n        'accept',\n        'accept-language',\n        // Forwarded so the backend proxy-guard can enforce its origin allowlist on\n        // the real browser Origin; without this allowedOrigins would be a no-op.\n        'origin',\n    ];\n\n    for (const header of headersToForward)\n    {\n        const value = sourceHeaders instanceof Headers\n            ? sourceHeaders.get(header)\n            : sourceHeaders[header];\n\n        if (value)\n        {\n            headers.set(header, value);\n        }\n    }\n\n    // Forward the real client IP so the backend can rate-limit per user. The\n    // backend trusts this header only on proxy-verified requests, so a direct\n    // caller can't spoof it. Resolved hop-aware from the inbound X-Forwarded-For.\n    const xff = sourceHeaders instanceof Headers\n        ? sourceHeaders.get('x-forwarded-for')\n        : sourceHeaders['x-forwarded-for'];\n    const clientIp = clientIpFromForwardedChain(xff, trustedProxyHops());\n    if (clientIp)\n    {\n        headers.set(PROXY_CLIENT_IP_HEADER, clientIp);\n    }\n\n    // Add default headers\n    for (const [key, value] of Object.entries(defaultHeaders))\n    {\n        headers.set(key, value);\n    }\n\n    return headers;\n}\n\n/**\n * Parse cookies from Cookie header string\n *\n * @param cookieHeader - Cookie header string (e.g., \"session=abc; theme=dark\")\n * @returns Map of cookie name-value pairs\n */\nexport function parseCookies(cookieHeader: string | null | undefined): Map<string, string>\n{\n    const cookiesMap = new Map<string, string>();\n\n    if (!cookieHeader)\n    {\n        return cookiesMap;\n    }\n\n    const cookiePairs = cookieHeader.split(';').map(c => c.trim());\n    for (const pair of cookiePairs)\n    {\n        const [name, ...valueParts] = pair.split('=');\n        if (name && valueParts.length > 0)\n        {\n            const value = valueParts.join('='); // Handle = in cookie value\n            cookiesMap.set(name.trim(), value.trim());\n        }\n    }\n\n    return cookiesMap;\n}\n\n/**\n * Parse cookies from NextRequest (Next.js specific helper)\n * Combines cookies from both NextRequest.cookies and Cookie header\n */\nexport function parseCookiesFromNextRequest(request: NextRequest): Map<string, string>\n{\n    const cookiesMap = new Map<string, string>();\n\n    // Add cookies from NextRequest (browser cookies)\n    for (const cookie of request.cookies.getAll())\n    {\n        cookiesMap.set(cookie.name, cookie.value);\n    }\n\n    // Add cookies from Cookie header (server-side forwarded cookies)\n    const cookieHeader = request.headers.get('cookie');\n    if (cookieHeader)\n    {\n        const parsed = parseCookies(cookieHeader);\n        for (const [name, value] of parsed.entries())\n        {\n            cookiesMap.set(name, value);\n        }\n    }\n\n    return cookiesMap;\n}\n\n// Mapping of option names to Set-Cookie attribute formats\nconst optionMappings: Array<{\n    key: keyof CookieOptions;\n    format: (value: any) => string | null;\n}> = [\n    { key: 'httpOnly', format: (v) => v ? 'HttpOnly' : null },\n    { key: 'secure', format: (v) => v ? 'Secure' : null },\n    { key: 'sameSite', format: (v) => v ? `SameSite=${v}` : null },\n    { key: 'maxAge', format: (v) => v !== undefined ? `Max-Age=${v}` : null },\n    { key: 'path', format: (v) => v ? `Path=${v}` : null },\n    { key: 'domain', format: (v) => v ? `Domain=${v}` : null },\n];\n\n/**\n * Build Set-Cookie header string from cookie options\n */\nexport function buildSetCookieHeader(cookie: SetCookie): string\n{\n    const parts = [`${cookie.name}=${cookie.value}`];\n    const options = cookie.options || {};\n\n    for (const { key, format } of optionMappings)\n    {\n        const value = options[key];\n        if (value !== undefined && value !== false)\n        {\n            const formatted = format(value);\n            if (formatted)\n            {\n                parts.push(formatted);\n            }\n        }\n    }\n\n    return parts.join('; ');\n}\n\n/**\n * Build error response JSON\n */\nexport function buildErrorResponse(\n    errorType: string,\n    message: string,\n    debug: boolean,\n    error?: Error,\n): any\n{\n    return {\n        error: errorType,\n        message,\n        ...(debug && error?.stack && { stack: error.stack }),\n    };\n}\n\nconst headersToForward = [\n    'content-type',\n    'cache-control',\n    'set-cookie',\n    'etag',\n    'last-modified',\n];\n\n/**\n * Forward response headers back to client\n */\nexport function forwardResponseHeaders(\n    sourceHeaders: Headers,\n    targetHeaders: Headers,\n): void\n{\n    for (const header of headersToForward)\n    {\n        const value = sourceHeaders.get(header);\n        if (value)\n        {\n            targetHeaders.set(header, value);\n        }\n    }\n}\n\n/**\n * Collect all interceptors (auto-discovered + config)\n */\nexport function collectInterceptors(\n    autoDiscoverInterceptors: boolean,\n    disableAutoInterceptors: string[] | undefined,\n    configInterceptors: InterceptorRule[] | undefined,\n    registry: InterceptorRegistry,\n): InterceptorRule[]\n{\n    const allInterceptors: InterceptorRule[] = [];\n\n    // Auto-discover from registry\n    if (autoDiscoverInterceptors)\n    {\n        const registeredInterceptors = registry.getAll(disableAutoInterceptors || []);\n        allInterceptors.push(...registeredInterceptors);\n    }\n\n    // Add config interceptors\n    if (configInterceptors)\n    {\n        allInterceptors.push(...configInterceptors);\n    }\n\n    return allInterceptors;\n}\n\n/**\n * Build RequestInterceptorContext\n */\nexport function buildRequestContext(\n    path: string,\n    method: string,\n    headers: Headers,\n    body: any,\n    searchParams: URLSearchParams,\n    cookiesMap: Map<string, string>,\n    request: NextRequest,\n): RequestInterceptorContext\n{\n    return {\n        path: `/${path}`,\n        method,\n        headers: Object.fromEntries(headers.entries()),\n        body,\n        query: Object.fromEntries(searchParams.entries()),\n        cookies: cookiesMap,\n        request,\n        metadata: {},\n    };\n}\n\n/**\n * Build ResponseInterceptorContext\n */\nexport function buildResponseContext(\n    path: string,\n    method: string,\n    requestHeaders: Headers,\n    requestBody: any,\n    response: Response,\n    responseBody: any,\n    requestMetadata: Record<string, any>,\n    cookies: Map<string, string>,\n): ResponseInterceptorContext\n{\n    return {\n        path: `/${path}`,\n        method,\n        request: {\n            headers: Object.fromEntries(requestHeaders.entries()),\n            body: requestBody,\n        },\n        response: {\n            ok: response.ok,\n            status: response.status,\n            statusText: response.statusText,\n            headers: response.headers,\n            body: responseBody,\n        },\n        cookies,\n        setCookies: [],\n        metadata: requestMetadata,\n    };\n}\n","/**\n * RPC-Style Proxy for define-route System\n *\n * Next.js API Route handler that resolves routeName to method/path\n * and forwards requests to SPFN backend.\n *\n * @example\n * ```typescript\n * // app/api/rpc/[routeName]/route.ts\n * import { createRpcProxy } from '@spfn/core/nextjs/server';\n * import { eventRouteMap } from '@spfn/core/event';\n * import { routeMap } from '@/generated/route-map';\n *\n * export const { GET, POST } = createRpcProxy({\n *     routeMap: { ...routeMap, ...eventRouteMap },\n * });\n * ```\n *\n * The generated `routeMap` already holds the routes of every package router the\n * app mounts with `.packages()`, so no package map is merged by hand.\n * `eventRouteMap` is the exception: a hand-written constant, not a mounted\n * router.\n */\nimport { NextRequest, NextResponse } from 'next/server';\n\nimport { env } from '@spfn/core/config';\nimport { logger } from '@spfn/core/logger';\nimport type { HttpMethod } from '@spfn/core/route';\n\nimport { signProxyRequest, parseProxyKeySet } from '../../security/proxy-signature';\nimport { buildUrlWithParams, buildQueryString } from '../shared';\nimport { interceptorRegistry } from './interceptors';\nimport { executeRequestInterceptors, executeResponseInterceptors, filterMatchingInterceptors } from './interceptors';\nimport {\n    buildProxyHeaders,\n    parseCookiesFromNextRequest,\n    buildSetCookieHeader,\n    buildErrorResponse,\n    forwardResponseHeaders,\n    parseResponseBody,\n    collectInterceptors,\n    buildRequestContext,\n    buildResponseContext,\n} from './helpers';\nimport type { TypedProxyConfig } from './types';\n\nconst rpcLogger = logger.child('@spfn/core:rpc-proxy');\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/**\n * Route info from generated route map\n */\nexport interface RouteMapEntry\n{\n    method: HttpMethod;\n    path: string;\n}\n\n/**\n * Generated route map type\n */\nexport type RouteMap = Record<string, RouteMapEntry>;\n\n/**\n * RPC proxy configuration\n */\nexport interface RpcProxyConfig extends Omit<TypedProxyConfig, 'onRequest' | 'onResponse'>\n{\n    /**\n     * Route map containing routeName → {method, path} mappings\n     *\n     * The generated map carries the app's own routes and those of every package\n     * router it mounts with `.packages()`. Merge `eventRouteMap` beside it when\n     * the app uses SSE — that one is a constant rather than a mounted router.\n     *\n     * @example\n     * ```typescript\n     * import { eventRouteMap } from '@spfn/core/event';\n     * import { routeMap } from '@/generated/route-map';\n     *\n     * export const { GET, POST } = createRpcProxy({\n     *     routeMap: { ...routeMap, ...eventRouteMap },\n     * });\n     * ```\n     */\n    routeMap: RouteMap;\n\n    /**\n     * Shared secret for signing proxy→backend requests (HMAC-SHA256).\n     *\n     * When set, every forwarded request carries an HMAC signature the backend's\n     * proxy-guard middleware verifies, letting it reject direct-to-backend calls\n     * that bypass this proxy. Set the SAME value here and on the backend.\n     *\n     * @default process.env.SPFN_PROXY_SECRET (undefined → signing disabled)\n     */\n    proxySecret?: string;\n}\n\n// ============================================================================\n// RPC Proxy Handler\n// ============================================================================\n\n/**\n * Create RPC proxy handler for Next.js API Route\n *\n * Handles requests in the format:\n * - GET /api/rpc/{routeName}?input={...}\n * - POST /api/rpc/{routeName} with body\n *\n * Resolves routeName to actual HTTP method and path from routeMap,\n * then forwards to SPFN backend.\n */\nexport function createRpcProxy(config: RpcProxyConfig)\n{\n    const {\n        apiUrl = env.SPFN_API_URL || 'http://localhost:8790',\n        debug = env.NODE_ENV === 'development',\n        timeout = env.RPC_PROXY_TIMEOUT,\n        headers: defaultHeaders = {},\n        interceptors,\n        autoDiscoverInterceptors = true,\n        disableAutoInterceptors,\n        proxySecret = env.SPFN_PROXY_SECRET,\n        routeMap,\n    } = config;\n\n    // Parse the active signing key once — it's fixed for the proxy's lifetime.\n    // Use the SAME parser the backend uses (comma key set) and take the active key,\n    // so a `v2:new,v1:old` secret is interpreted identically on both sides.\n    const proxyKey = proxySecret ? (parseProxyKeySet([proxySecret])[0] ?? null) : null;\n\n    // proxy-guard signs route-relative paths; if SPFN_API_URL carries a base path the\n    // backend keeps (no ingress strip), the signed path won't match c.req.url and\n    // strict mode 403s everything. Warn loudly so it's diagnosable.\n    if (proxyKey)\n    {\n        try\n        {\n            const basePath = new URL(apiUrl).pathname;\n            if (basePath !== '/' && basePath !== '')\n            {\n                rpcLogger.warn(\n                    `SPFN_API_URL has a base path (\"${basePath}\"). proxy-guard signs route-relative paths, `\n                    + 'so the backend must receive paths WITHOUT this prefix (e.g. ingress strip) or strict '\n                    + 'mode will reject all signed requests with 403.',\n                );\n            }\n        }\n        catch\n        {\n            // invalid apiUrl is surfaced elsewhere\n        }\n    }\n\n    /**\n     * Resolve route info from routeMap\n     */\n    function resolveRoute(routeName: string): { method: string; path: string } | null\n    {\n        const entry = routeMap[routeName];\n        if (entry)\n        {\n            return { method: entry.method, path: entry.path };\n        }\n\n        return null;\n    }\n\n    /**\n     * Handle RPC request\n     */\n    async function handleRpc(\n        request: NextRequest,\n        context: { params: Promise<{ routeName?: string }> },\n    ): Promise<NextResponse>\n    {\n        const startTime = Date.now();\n        const params = await context.params;\n\n        try\n        {\n            const routeName = params.routeName;\n\n            if (!routeName)\n            {\n                return NextResponse.json(\n                    buildErrorResponse('Bad Request', 'Missing routeName parameter', debug),\n                    { status: 400 },\n                );\n            }\n\n            // Parse input from query string (GET) or body (POST)\n            let input: {\n                params?: Record<string, any>;\n                query?: Record<string, any>;\n                body?: Record<string, any>;\n                formData?: Record<string, any>;\n                headers?: Record<string, any>;\n                cookies?: Record<string, any>;\n            } = {};\n            let rawFormData: FormData | null = null;\n\n            if (request.method === 'GET')\n            {\n                const inputParam = request.nextUrl.searchParams.get('input');\n                if (inputParam)\n                {\n                    try\n                    {\n                        input = JSON.parse(decodeURIComponent(inputParam));\n                    }\n                    catch\n                    {\n                        return NextResponse.json(\n                            buildErrorResponse('Bad Request', 'Invalid input parameter', debug),\n                            { status: 400 },\n                        );\n                    }\n                }\n            }\n            else\n            {\n                // POST - check Content-Type for formData vs JSON\n                const contentType = request.headers.get('content-type') || '';\n\n                if (contentType.includes('multipart/form-data'))\n                {\n                    // Parse multipart/form-data\n                    try\n                    {\n                        rawFormData = await request.formData();\n\n                        // Extract __metadata if present (contains params, query, etc.)\n                        const metadataStr = rawFormData.get('__metadata');\n                        if (metadataStr && typeof metadataStr === 'string')\n                        {\n                            const metadata = JSON.parse(metadataStr);\n                            input.params = metadata.params;\n                            input.query = metadata.query;\n                            input.headers = metadata.headers;\n                            input.cookies = metadata.cookies;\n                        }\n\n                        // Collect formData fields (excluding __metadata)\n                        input.formData = {};\n                        rawFormData.forEach((value, key) =>\n                        {\n                            if (key === '__metadata') return;\n\n                            const existing = input.formData![key];\n                            if (existing !== undefined)\n                            {\n                                // Multiple values with same key\n                                if (Array.isArray(existing))\n                                {\n                                    existing.push(value);\n                                }\n                                else\n                                {\n                                    input.formData![key] = [existing, value];\n                                }\n                            }\n                            else\n                            {\n                                input.formData![key] = value;\n                            }\n                        });\n                    }\n                    catch (error)\n                    {\n                        return NextResponse.json(\n                            buildErrorResponse('Bad Request', 'Invalid form data', debug),\n                            { status: 400 },\n                        );\n                    }\n                }\n                else\n                {\n                    // Parse JSON body\n                    try\n                    {\n                        input = await request.json();\n                    }\n                    catch\n                    {\n                        return NextResponse.json(\n                            buildErrorResponse('Bad Request', 'Invalid JSON body', debug),\n                            { status: 400 },\n                        );\n                    }\n                }\n            }\n\n            // Resolve route info from routeMap\n            const routeInfo = resolveRoute(routeName);\n\n            if (!routeInfo)\n            {\n                rpcLogger.warn(`Route not found: ${routeName}`);\n\n                return NextResponse.json(\n                    buildErrorResponse('Not Found', `Route \"${routeName}\" not found`, debug),\n                    { status: 404 },\n                );\n            }\n\n            const { method: targetMethod, path: targetPath } = routeInfo;\n\n            // Build target URL with params and query\n            const inputParams = input.params || {};\n            const inputQuery = input.query || {};\n            const inputBody = input.body;\n            const inputFormData = input.formData;\n            const hasFormData = rawFormData !== null && inputFormData && Object.keys(inputFormData).length > 0;\n\n            const resolvedPath = buildUrlWithParams(targetPath, inputParams);\n            const queryString = buildQueryString(inputQuery);\n            const targetUrl = `${apiUrl}${resolvedPath}${queryString}`;\n\n            if (debug)\n            {\n                rpcLogger.debug('→ RPC request', {\n                    routeName,\n                    targetMethod,\n                    targetPath: resolvedPath,\n                    targetUrl,\n                    hasBody: !!inputBody,\n                    hasFormData,\n                });\n            }\n\n            // Build headers\n            const headers = buildProxyHeaders(request.headers, defaultHeaders);\n\n            // Remove Content-Type for formData (let fetch set it with boundary)\n            if (hasFormData)\n            {\n                headers.delete('content-type');\n            }\n\n            // Build fetch options\n            const fetchOptions: RequestInit = {\n                method: targetMethod,\n                headers,\n            };\n\n            // Add body for POST/PUT/PATCH\n            if (['POST', 'PUT', 'PATCH'].includes(targetMethod))\n            {\n                if (hasFormData && rawFormData)\n                {\n                    // Forward formData to backend (rebuild without __metadata)\n                    const forwardFormData = new FormData();\n                    rawFormData.forEach((value, key) =>\n                    {\n                        if (key !== '__metadata')\n                        {\n                            forwardFormData.append(key, value);\n                        }\n                    });\n                    fetchOptions.body = forwardFormData;\n                }\n                else if (inputBody)\n                {\n                    fetchOptions.body = JSON.stringify(inputBody);\n                }\n            }\n\n            // ============================================================\n            // Advanced Interceptors - BEFORE FETCH\n            // ============================================================\n\n            // Collect and filter interceptors\n            const allInterceptors = collectInterceptors(autoDiscoverInterceptors, disableAutoInterceptors, interceptors, interceptorRegistry);\n            const matchingInterceptors = filterMatchingInterceptors(allInterceptors, resolvedPath, targetMethod);\n\n            if (debug && matchingInterceptors.length > 0)\n            {\n                rpcLogger.debug(`Found ${matchingInterceptors.length} matching interceptors for ${targetMethod} ${resolvedPath}`);\n            }\n\n            // Create RequestInterceptorContext\n            const cookiesMap = parseCookiesFromNextRequest(request);\n            const requestCtx = buildRequestContext(\n                resolvedPath.slice(1), // Remove leading slash\n                targetMethod,\n                headers,\n                inputBody,\n                new URLSearchParams(queryString.slice(1)), // Remove leading ?\n                cookiesMap,\n                request,\n            );\n\n            // Execute request interceptors\n            const requestInterceptorsToRun = matchingInterceptors.map(r => r.request).filter((i): i is NonNullable<typeof i> => !!i);\n            if (requestInterceptorsToRun.length > 0)\n            {\n                await executeRequestInterceptors(requestCtx, requestInterceptorsToRun);\n\n                // Apply modified headers\n                for (const [key, value] of Object.entries(requestCtx.headers))\n                {\n                    headers.set(key, value);\n                }\n\n                // Apply modified body\n                if (requestCtx.body)\n                {\n                    fetchOptions.body = JSON.stringify(requestCtx.body);\n                }\n            }\n\n            // An interceptor refused the request (e.g. the CSRF check in @spfn/auth).\n            // Return its response without touching the backend; no response\n            // interceptor runs, so the only cookies a refusal can carry are the\n            // ones the refusing interceptor attached to the abort. The CSRF check\n            // attaches a fresh token there, so the refusal is what repairs the\n            // browser instead of merely reporting the damage.\n            if (requestCtx.abort)\n            {\n                rpcLogger.warn('Request refused by an interceptor', {\n                    routeName,\n                    status: requestCtx.abort.status,\n                });\n\n                const abortResponse = NextResponse.json(\n                    requestCtx.abort.body,\n                    { status: requestCtx.abort.status },\n                );\n\n                for (const cookie of requestCtx.abort.setCookies ?? [])\n                {\n                    abortResponse.headers.append('Set-Cookie', buildSetCookieHeader(cookie));\n                }\n\n                return abortResponse;\n            }\n\n            // ============================================================\n            // Proxy → Backend signature (proxy-guard)\n            // ============================================================\n            // Sign the FINAL request (after interceptors settled body/headers) so\n            // the backend can prove it came through this trusted proxy. JSON body\n            // is hashed into the signature; large multipart uploads are excluded.\n            if (proxyKey)\n            {\n                const signedBody = typeof fetchOptions.body === 'string' ? fetchOptions.body : undefined;\n                // Sign the route-relative path (no SPFN_API_URL base prefix) so it\n                // matches the backend's `new URL(c.req.url).pathname` whether the\n                // prefix is absent or stripped by an ingress. resolvedPath is already\n                // the percent-encoded wire form; queryString is the raw search.\n                const signatureHeaders = signProxyRequest({\n                    key: proxyKey,\n                    method: targetMethod,\n                    path: resolvedPath,\n                    query: queryString,\n                    body: signedBody,\n                });\n\n                for (const [headerName, value] of Object.entries(signatureHeaders))\n                {\n                    headers.set(headerName, value);\n                }\n            }\n\n            // Execute fetch with timeout\n            const controller = new AbortController();\n            const timeoutId = setTimeout(() => controller.abort(), timeout);\n\n            try\n            {\n                const response = await fetch(targetUrl, {\n                    ...fetchOptions,\n                    signal: controller.signal,\n                });\n\n                clearTimeout(timeoutId);\n\n                // Parse response\n                let body = await parseResponseBody(response);\n\n                // ============================================================\n                // Advanced Interceptors - AFTER FETCH\n                // ============================================================\n\n                // Create ResponseInterceptorContext\n                const responseCtx = buildResponseContext(\n                    resolvedPath.slice(1),\n                    targetMethod,\n                    headers,\n                    inputBody,\n                    response,\n                    body,\n                    requestCtx.metadata,\n                    requestCtx.cookies,\n                );\n\n                // Execute response interceptors\n                const responseInterceptorsToRun = matchingInterceptors.map(r => r.response).filter((i): i is NonNullable<typeof i> => !!i);\n                if (responseInterceptorsToRun.length > 0)\n                {\n                    await executeResponseInterceptors(responseCtx, responseInterceptorsToRun);\n                    body = responseCtx.response.body;\n                }\n\n                const duration = Date.now() - startTime;\n\n                if (debug)\n                {\n                    rpcLogger.debug('← RPC response', {\n                        routeName,\n                        status: responseCtx.response.status,\n                        duration: `${duration}ms`,\n                    });\n                }\n\n                // Build Next.js response\n                // 204 No Content should use NextResponse directly, not NextResponse.json()\n                const nextResponse = responseCtx.response.status === 204\n                    ? new NextResponse(null, {\n                        status: 204,\n                        statusText: responseCtx.response.statusText,\n                    })\n                    : NextResponse.json(body, {\n                        status: responseCtx.response.status,\n                        statusText: responseCtx.response.statusText,\n                    });\n\n                // Forward response headers\n                forwardResponseHeaders(response.headers, nextResponse.headers);\n\n                // Apply setCookies from interceptors\n                for (const cookie of responseCtx.setCookies)\n                {\n                    const setCookieHeader = buildSetCookieHeader(cookie);\n                    nextResponse.headers.append('Set-Cookie', setCookieHeader);\n\n                    if (debug)\n                    {\n                        rpcLogger.debug('Set-Cookie header added', {\n                            name: cookie.name,\n                        });\n                    }\n                }\n\n                return nextResponse;\n            }\n            catch (error)\n            {\n                clearTimeout(timeoutId);\n\n                // Handle timeout\n                if (error instanceof Error && error.name === 'AbortError')\n                {\n                    rpcLogger.error('Request timeout', {\n                        routeName,\n                        targetUrl,\n                        timeout,\n                    });\n\n                    return NextResponse.json(\n                        buildErrorResponse('Gateway Timeout', `Request timed out after ${timeout}ms`, debug, error),\n                        { status: 504 },\n                    );\n                }\n\n                // Handle other fetch errors\n                const fetchErr = error as Error;\n                rpcLogger.error('Fetch error', {\n                    routeName,\n                    targetUrl,\n                    error: fetchErr.message,\n                });\n\n                return NextResponse.json(\n                    buildErrorResponse('Bad Gateway', fetchErr.message || 'Failed to connect to backend', debug, fetchErr),\n                    { status: 502 },\n                );\n            }\n        }\n        catch (error)\n        {\n            const duration = Date.now() - startTime;\n            const err = error as Error;\n\n            rpcLogger.error('RPC proxy error', {\n                error: err.message,\n                stack: err.stack,\n                duration: `${duration}ms`,\n            });\n\n            return NextResponse.json(\n                buildErrorResponse('Internal Server Error', err.message || 'Unknown error', debug, err),\n                { status: 500 },\n            );\n        }\n    }\n\n    // Return route handlers\n    return {\n        GET: (req: NextRequest, context: { params: Promise<{ routeName?: string }> }) =>\n            handleRpc(req, context),\n        POST: (req: NextRequest, context: { params: Promise<{ routeName?: string }> }) =>\n            handleRpc(req, context),\n    };\n}\n"]}
+{"version":3,"sources":["../../src/security/proxy-signature.ts","../../src/nextjs/shared.ts","../../src/nextjs/proxy/interceptors/helpers.ts","../../src/nextjs/proxy/interceptors/registry.ts","../../src/nextjs/proxy/helpers.ts","../../src/nextjs/proxy/rpc.ts"],"names":["headersToForward"],"mappings":";;;;;;AA0BO,IAAM,sBAAA,GAAyB,wBAAA;AAC/B,IAAM,sBAAA,GAAyB,wBAAA;AAC/B,IAAM,kBAAA,GAAqB,oBAAA;AAC3B,IAAM,mBAAA,GAAsB,qBAAA;AAM5B,IAAM,sBAAA,GAAyB,wBAAA;AAG/B,IAAM,cAAA,GAAiB,SAAA;AAoBvB,SAAS,cAAc,GAAA,EAC9B;AACI,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAC3B,EAAA,IAAI,QAAQ,EAAA,EACZ;AACI,IAAA,OAAO,EAAE,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,GAAA,EAAI;AAAA,EAChD;AAIA,EAAA,OAAO,EAAE,KAAA,EAAO,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,IAAK,cAAA,EAAgB,MAAA,EAAQ,GAAA,CAAI,KAAA,CAAM,GAAA,GAAM,CAAC,CAAA,EAAE;AACpF;AAOO,SAAS,iBAAiB,IAAA,EACjC;AACI,EAAA,MAAM,OAAmB,EAAC;AAC1B,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAE7B,EAAA,KAAA,MAAW,OAAO,IAAA,EAClB;AACI,IAAA,IAAI,CAAC,GAAA,EACL;AACI,MAAA;AAAA,IACJ;AAEA,IAAA,KAAA,MAAW,IAAA,IAAQ,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,EAChC;AACI,MAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAC1B,MAAA,IAAI,CAAC,OAAA,EACL;AACI,QAAA;AAAA,MACJ;AAEA,MAAA,MAAM,GAAA,GAAM,cAAc,OAAO,CAAA;AACjC,MAAA,IAAI,CAAC,GAAA,CAAI,MAAA,IAAU,KAAK,GAAA,CAAI,GAAA,CAAI,KAAK,CAAA,EACrC;AACI,QAAA;AAAA,MACJ;AAEA,MAAA,IAAA,CAAK,GAAA,CAAI,IAAI,KAAK,CAAA;AAClB,MAAA,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,IACjB;AAAA,EACJ;AAEA,EAAA,OAAO,IAAA;AACX;AAuEO,SAAS,qBAAqB,KAAA,EACrC;AACI,EAAA,OAAO,CAAC,KAAA,CAAM,MAAA,CAAO,WAAA,EAAY,EAAG,MAAM,IAAA,EAAM,KAAA,CAAM,KAAA,EAAO,KAAA,CAAM,WAAW,KAAA,CAAM,KAAA,EAAO,MAAM,QAAQ,CAAA,CAAE,KAAK,IAAI,CAAA;AACxH;AAQO,SAAS,SAAS,IAAA,EACzB;AACI,EAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,MAAA,KAAW,CAAA,EAC7B;AACI,IAAA,OAAO,EAAA;AAAA,EACX;AAEA,EAAA,OAAO,OAAO,SAAS,QAAA,GACjB,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,MAAM,MAAM,CAAA,CAAE,OAAO,KAAK,CAAA,GACtD,WAAW,QAAQ,CAAA,CAAE,OAAO,IAAI,CAAA,CAAE,OAAO,KAAK,CAAA;AACxD;AAKO,SAAS,gBAAA,CAAiB,QAAgB,KAAA,EACjD;AACI,EAAA,OAAO,UAAA,CAAW,QAAA,EAAU,MAAM,CAAA,CAAE,MAAA,CAAO,qBAAqB,KAAK,CAAC,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AACxF;AAKO,SAAS,aAAA,GAChB;AACI,EAAA,OAAO,WAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AACzC;AA2BO,SAAS,iBAAiB,KAAA,EACjC;AACI,EAAA,MAAM,YAAY,KAAA,CAAM,SAAA,IAAa,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA;AACtD,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,IAAS,aAAA,EAAc;AAC3C,EAAA,MAAM,SAAA,GAAY,gBAAA,CAAiB,KAAA,CAAM,GAAA,CAAI,MAAA,EAAQ;AAAA,IACjD,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,KAAA,EAAO,MAAM,KAAA,IAAS,EAAA;AAAA,IACtB,SAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA,EAAU,QAAA,CAAS,KAAA,CAAM,IAAI;AAAA,GAChC,CAAA;AAED,EAAA,OAAO;AAAA,IACH,CAAC,sBAAsB,GAAG,SAAA;AAAA,IAC1B,CAAC,sBAAsB,GAAG,SAAA;AAAA,IAC1B,CAAC,kBAAkB,GAAG,KAAA;AAAA,IACtB,CAAC,mBAAmB,GAAG,KAAA,CAAM,GAAA,CAAI;AAAA,GACrC;AACJ;;;ACzPO,SAAS,kBAAA,CAAmB,MAAc,MAAA,EACjD;AACI,EAAA,IAAI,GAAA,GAAM,IAAA;AACV,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAChD;AACI,IAAA,GAAA,GAAM,GAAA,CAAI,QAAQ,CAAA,CAAA,EAAI,GAAG,IAAI,kBAAA,CAAmB,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAAA,EAClE;AAEA,EAAA,OAAO,GAAA;AACX;AASO,SAAS,iBAAiB,KAAA,EACjC;AACI,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,WAAW,CAAA,EAClC;AACI,IAAA,OAAO,EAAA;AAAA,EACX;AAEA,EAAA,MAAM,YAAA,GAAe,IAAI,eAAA,EAAgB;AACzC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAC/C;AACI,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EACvB;AACI,MAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,KAAM,YAAA,CAAa,OAAO,GAAA,EAAK,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AAAA,IAC5D,CAAA,MAEA;AACI,MAAA,YAAA,CAAa,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,IAC1C;AAAA,EACJ;AAEA,EAAA,OAAO,CAAA,CAAA,EAAI,YAAA,CAAa,QAAA,EAAU,CAAA,CAAA;AACtC;AAwBA,eAAsB,kBAAkB,QAAA,EACxC;AAEI,EAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EACxB;AACI,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAEvD,EAAA,IAAI,WAAA,EAAa,QAAA,CAAS,kBAAkB,CAAA,EAC5C;AACI,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,IAAA,OAAO,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,GAAI,IAAA;AAAA,EACrC,CAAA,MAEA;AACI,IAAA,OAAO,MAAM,SAAS,IAAA,EAAK;AAAA,EAC/B;AACJ;;;ACtEO,SAAS,SAAA,CAAU,MAAc,OAAA,EACxC;AAEI,EAAA,IAAI,YAAY,GAAA,EAChB;AACI,IAAA,OAAO,IAAA;AAAA,EACX;AAGA,EAAA,IAAI,mBAAmB,MAAA,EACvB;AACI,IAAA,OAAO,OAAA,CAAQ,KAAK,IAAI,CAAA;AAAA,EAC5B;AAMA,EAAA,MAAM,YAAA,GAAe,OAAA,CAChB,OAAA,CAAQ,KAAA,EAAO,IAAI,CAAA,CACnB,OAAA,CAAQ,SAAA,EAAW,OAAO,CAAA,CAC1B,OAAA,CAAQ,KAAA,EAAO,KAAK,CAAA;AAEzB,EAAA,MAAM,KAAA,GAAQ,IAAI,MAAA,CAAO,CAAA,CAAA,EAAI,YAAY,CAAA,CAAA,CAAG,CAAA;AAE5C,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AAC1B;AASO,SAAS,WAAA,CACZ,QACA,OAAA,EAEJ;AAEI,EAAA,IAAI,CAAC,OAAA,EACL;AACI,IAAA,OAAO,IAAA;AAAA,EACX;AAGA,EAAA,IAAI,OAAO,YAAY,QAAA,EACvB;AACI,IAAA,OAAO,MAAA,CAAO,WAAA,EAAY,KAAM,OAAA,CAAQ,WAAA,EAAY;AAAA,EACxD;AAGA,EAAA,OAAO,OAAA,CAAQ,KAAK,CAAC,CAAA,KAAM,EAAE,WAAA,EAAY,KAAM,MAAA,CAAO,WAAA,EAAa,CAAA;AACvE;AAUO,SAAS,0BAAA,CACZ,KAAA,EACA,IAAA,EACA,MAAA,EAEJ;AACI,EAAA,OAAO,KAAA,CAAM,MAAA,CAAO,CAAC,IAAA,KACrB;AACI,IAAA,OAAO,SAAA,CAAU,MAAM,IAAA,CAAK,WAAW,KAAK,WAAA,CAAY,MAAA,EAAQ,KAAK,MAAM,CAAA;AAAA,EAC/E,CAAC,CAAA;AACL;AAgBA,eAAsB,0BAAA,CAClB,SACA,YAAA,EAEJ;AACI,EAAA,IAAI,KAAA,GAAQ,CAAA;AAEZ,EAAA,MAAM,OAAO,YACb;AACI,IAAA,IAAI,KAAA,IAAS,aAAa,MAAA,EAC1B;AACI,MAAA;AAAA,IACJ;AAEA,IAAA,MAAM,WAAA,GAAc,aAAa,KAAK,CAAA;AACtC,IAAA,KAAA,EAAA;AAEA,IAAA,MAAM,WAAA,CAAY,SAAS,IAAI,CAAA;AAAA,EACnC,CAAA;AAEA,EAAA,MAAM,IAAA,EAAK;AACf;AAgBA,eAAsB,2BAAA,CAClB,SACA,YAAA,EAEJ;AACI,EAAA,IAAI,KAAA,GAAQ,CAAA;AAEZ,EAAA,MAAM,OAAO,YACb;AACI,IAAA,IAAI,KAAA,IAAS,aAAa,MAAA,EAC1B;AACI,MAAA;AAAA,IACJ;AAEA,IAAA,MAAM,WAAA,GAAc,aAAa,KAAK,CAAA;AACtC,IAAA,KAAA,EAAA;AAEA,IAAA,MAAM,WAAA,CAAY,SAAS,IAAI,CAAA;AAAA,EACnC,CAAA;AAEA,EAAA,MAAM,IAAA,EAAK;AACf;;;AC/IO,IAAM,sBAAN,MACP;AAAA,EACY,YAAA,uBAAmB,GAAA,EAA+B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkB1D,QAAA,CAAS,aAAqB,YAAA,EAC9B;AACI,IAAA,IAAI,CAAC,IAAA,CAAK,YAAA,CAAa,GAAA,CAAI,WAAW,CAAA,EACtC;AACI,MAAA,IAAA,CAAK,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,YAAY,CAAA;AAAA,IACnD;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAA,CAAO,OAAA,GAAoB,EAAC,EAC5B;AACI,IAAA,MAAM,MAAyB,EAAC;AAEhC,IAAA,KAAA,MAAW,CAAC,WAAA,EAAa,YAAY,KAAK,IAAA,CAAK,YAAA,CAAa,SAAQ,EACpE;AACI,MAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,CAAS,WAAW,CAAA,EACjC;AACI,QAAA,GAAA,CAAI,IAAA,CAAK,GAAG,YAAY,CAAA;AAAA,MAC5B;AAAA,IACJ;AAEA,IAAA,OAAO,GAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,IAAI,WAAA,EACJ;AACI,IAAA,OAAO,IAAA,CAAK,YAAA,CAAa,GAAA,CAAI,WAAW,CAAA;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA,EAKA,eAAA,GACA;AACI,IAAA,OAAO,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,YAAA,CAAa,MAAM,CAAA;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,WAAA,EACJ;AACI,IAAA,OAAO,IAAA,CAAK,YAAA,CAAa,GAAA,CAAI,WAAW,CAAA;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW,WAAA,EACX;AACI,IAAA,IAAA,CAAK,YAAA,CAAa,OAAO,WAAW,CAAA;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,KAAA,GACA;AACI,IAAA,IAAA,CAAK,aAAa,KAAA,EAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA,EAKA,KAAA,GACA;AACI,IAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,IAAA,KAAA,MAAW,YAAA,IAAgB,IAAA,CAAK,YAAA,CAAa,MAAA,EAAO,EACpD;AACI,MAAA,KAAA,IAAS,YAAA,CAAa,MAAA;AAAA,IAC1B;AAEA,IAAA,OAAO,KAAA;AAAA,EACX;AACJ,CAAA;AAQO,IAAM,uBAAuB,MACpC;AACI,EAAA,IAAI,CAAC,WAAW,6BAAA,EAChB;AACI,IAAA,UAAA,CAAW,6BAAA,GAAgC,IAAI,mBAAA,EAAoB;AAAA,EACvE;AAEA,EAAA,OAAO,UAAA,CAAW,6BAAA;AACtB,CAAA;AA+BO,SAAS,oBAAA,CACZ,aACA,YAAA,EAEJ;AACI,EAAA,mBAAA,CAAoB,QAAA,CAAS,aAAa,YAAY,CAAA;AAC1D;;;ACxKO,SAAS,0BAAA,CACZ,KACA,WAAA,EAEJ;AACI,EAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AAEjB,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA;AAC9D,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAE/B,EAAA,MAAM,MAAM,KAAA,CAAM,MAAA,GAAS,IAAA,CAAK,GAAA,CAAI,GAAG,WAAW,CAAA;AAIlD,EAAA,OAAO,KAAA,CAAM,GAAG,CAAA,IAAK,KAAA,CAAM,CAAC,CAAA;AAChC;AAEA,SAAS,gBAAA,GACT;AACI,EAAA,MAAM,MAAM,MAAA,CAAO,QAAA,CAAS,QAAQ,GAAA,CAAI,kBAAA,IAAsB,IAAI,EAAE,CAAA;AAEpE,EAAA,OAAO,OAAO,QAAA,CAAS,GAAG,CAAA,IAAK,GAAA,GAAM,IAAI,GAAA,GAAM,CAAA;AACnD;AASO,SAAS,iBAAA,CACZ,eACA,cAAA,EAEJ;AACI,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAG5B,EAAA,MAAMA,iBAAAA,GAAmB;AAAA,IACrB,cAAA;AAAA,IACA,eAAA;AAAA,IACA,QAAA;AAAA,IACA,YAAA;AAAA,IACA,QAAA;AAAA,IACA,iBAAA;AAAA;AAAA;AAAA,IAGA;AAAA,GACJ;AAEA,EAAA,KAAA,MAAW,UAAUA,iBAAAA,EACrB;AACI,IAAA,MAAM,KAAA,GAAQ,yBAAyB,OAAA,GACjC,aAAA,CAAc,IAAI,MAAM,CAAA,GACxB,cAAc,MAAM,CAAA;AAE1B,IAAA,IAAI,KAAA,EACJ;AACI,MAAA,OAAA,CAAQ,GAAA,CAAI,QAAQ,KAAK,CAAA;AAAA,IAC7B;AAAA,EACJ;AAKA,EAAA,MAAM,GAAA,GAAM,yBAAyB,OAAA,GAC/B,aAAA,CAAc,IAAI,iBAAiB,CAAA,GACnC,cAAc,iBAAiB,CAAA;AACrC,EAAA,MAAM,QAAA,GAAW,0BAAA,CAA2B,GAAA,EAAK,gBAAA,EAAkB,CAAA;AACnE,EAAA,IAAI,QAAA,EACJ;AACI,IAAA,OAAA,CAAQ,GAAA,CAAI,wBAAwB,QAAQ,CAAA;AAAA,EAChD;AAGA,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,cAAc,CAAA,EACxD;AACI,IAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,KAAK,CAAA;AAAA,EAC1B;AAEA,EAAA,OAAO,OAAA;AACX;AAQO,SAAS,aAAa,YAAA,EAC7B;AACI,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAoB;AAE3C,EAAA,IAAI,CAAC,YAAA,EACL;AACI,IAAA,OAAO,UAAA;AAAA,EACX;AAEA,EAAA,MAAM,WAAA,GAAc,aAAa,KAAA,CAAM,GAAG,EAAE,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,IAAA,EAAM,CAAA;AAC7D,EAAA,KAAA,MAAW,QAAQ,WAAA,EACnB;AACI,IAAA,MAAM,CAAC,IAAA,EAAM,GAAG,UAAU,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AAC5C,IAAA,IAAI,IAAA,IAAQ,UAAA,CAAW,MAAA,GAAS,CAAA,EAChC;AACI,MAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,IAAA,CAAK,GAAG,CAAA;AACjC,MAAA,UAAA,CAAW,IAAI,IAAA,CAAK,IAAA,EAAK,EAAG,KAAA,CAAM,MAAM,CAAA;AAAA,IAC5C;AAAA,EACJ;AAEA,EAAA,OAAO,UAAA;AACX;AAMO,SAAS,4BAA4B,OAAA,EAC5C;AACI,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAoB;AAG3C,EAAA,KAAA,MAAW,MAAA,IAAU,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAO,EAC5C;AACI,IAAA,UAAA,CAAW,GAAA,CAAI,MAAA,CAAO,IAAA,EAAM,MAAA,CAAO,KAAK,CAAA;AAAA,EAC5C;AAGA,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AACjD,EAAA,IAAI,YAAA,EACJ;AACI,IAAA,MAAM,MAAA,GAAS,aAAa,YAAY,CAAA;AACxC,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,CAAA,IAAK,MAAA,CAAO,SAAQ,EAC3C;AACI,MAAA,UAAA,CAAW,GAAA,CAAI,MAAM,KAAK,CAAA;AAAA,IAC9B;AAAA,EACJ;AAEA,EAAA,OAAO,UAAA;AACX;AAGA,IAAM,cAAA,GAGD;AAAA,EACD,EAAE,KAAK,UAAA,EAAY,MAAA,EAAQ,CAAC,CAAA,KAAM,CAAA,GAAI,aAAa,IAAA,EAAK;AAAA,EACxD,EAAE,KAAK,QAAA,EAAU,MAAA,EAAQ,CAAC,CAAA,KAAM,CAAA,GAAI,WAAW,IAAA,EAAK;AAAA,EACpD,EAAE,GAAA,EAAK,UAAA,EAAY,MAAA,EAAQ,CAAC,MAAM,CAAA,GAAI,CAAA,SAAA,EAAY,CAAC,CAAA,CAAA,GAAK,IAAA,EAAK;AAAA,EAC7D,EAAE,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAC,CAAA,KAAM,CAAA,KAAM,MAAA,GAAY,CAAA,QAAA,EAAW,CAAC,CAAA,CAAA,GAAK,IAAA,EAAK;AAAA,EACxE,EAAE,GAAA,EAAK,MAAA,EAAQ,MAAA,EAAQ,CAAC,MAAM,CAAA,GAAI,CAAA,KAAA,EAAQ,CAAC,CAAA,CAAA,GAAK,IAAA,EAAK;AAAA,EACrD,EAAE,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAC,MAAM,CAAA,GAAI,CAAA,OAAA,EAAU,CAAC,CAAA,CAAA,GAAK,IAAA;AACxD,CAAA;AAKO,SAAS,qBAAqB,MAAA,EACrC;AACI,EAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,EAAG,MAAA,CAAO,IAAI,CAAA,CAAA,EAAI,MAAA,CAAO,KAAK,CAAA,CAAE,CAAA;AAC/C,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,IAAW,EAAC;AAEnC,EAAA,KAAA,MAAW,EAAE,GAAA,EAAK,MAAA,EAAO,IAAK,cAAA,EAC9B;AACI,IAAA,MAAM,KAAA,GAAQ,QAAQ,GAAG,CAAA;AACzB,IAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,KAAA,EACrC;AACI,MAAA,MAAM,SAAA,GAAY,OAAO,KAAK,CAAA;AAC9B,MAAA,IAAI,SAAA,EACJ;AACI,QAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,MACxB;AAAA,IACJ;AAAA,EACJ;AAEA,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AAC1B;AAKO,SAAS,kBAAA,CACZ,SAAA,EACA,OAAA,EACA,KAAA,EACA,KAAA,EAEJ;AACI,EAAA,OAAO;AAAA,IACH,KAAA,EAAO,SAAA;AAAA,IACP,OAAA;AAAA,IACA,GAAI,KAAA,IAAS,KAAA,EAAO,SAAS,EAAE,KAAA,EAAO,MAAM,KAAA;AAAM,GACtD;AACJ;AAEA,IAAM,gBAAA,GAAmB;AAAA,EACrB,cAAA;AAAA,EACA,eAAA;AAAA,EACA,YAAA;AAAA,EACA,MAAA;AAAA,EACA;AACJ,CAAA;AAKO,SAAS,sBAAA,CACZ,eACA,aAAA,EAEJ;AACI,EAAA,KAAA,MAAW,UAAU,gBAAA,EACrB;AACI,IAAA,MAAM,KAAA,GAAQ,aAAA,CAAc,GAAA,CAAI,MAAM,CAAA;AACtC,IAAA,IAAI,KAAA,EACJ;AACI,MAAA,aAAA,CAAc,GAAA,CAAI,QAAQ,KAAK,CAAA;AAAA,IACnC;AAAA,EACJ;AACJ;AAKO,SAAS,mBAAA,CACZ,wBAAA,EACA,uBAAA,EACA,kBAAA,EACA,QAAA,EAEJ;AACI,EAAA,MAAM,kBAAqC,EAAC;AAG5C,EAAA,IAAI,wBAAA,EACJ;AACI,IAAA,MAAM,sBAAA,GAAyB,QAAA,CAAS,MAAA,CAAO,uBAAA,IAA2B,EAAE,CAAA;AAC5E,IAAA,eAAA,CAAgB,IAAA,CAAK,GAAG,sBAAsB,CAAA;AAAA,EAClD;AAGA,EAAA,IAAI,kBAAA,EACJ;AACI,IAAA,eAAA,CAAgB,IAAA,CAAK,GAAG,kBAAkB,CAAA;AAAA,EAC9C;AAEA,EAAA,OAAO,eAAA;AACX;AAKO,SAAS,oBACZ,IAAA,EACA,MAAA,EACA,SACA,IAAA,EACA,YAAA,EACA,YACA,OAAA,EAEJ;AACI,EAAA,OAAO;AAAA,IACH,IAAA,EAAM,IAAI,IAAI,CAAA,CAAA;AAAA,IACd,MAAA;AAAA,IACA,OAAA,EAAS,MAAA,CAAO,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA;AAAA,IAC7C,IAAA;AAAA,IACA,KAAA,EAAO,MAAA,CAAO,WAAA,CAAY,YAAA,CAAa,SAAS,CAAA;AAAA,IAChD,OAAA,EAAS,UAAA;AAAA,IACT,OAAA;AAAA,IACA,UAAU;AAAC,GACf;AACJ;AAKO,SAAS,oBAAA,CACZ,MACA,MAAA,EACA,cAAA,EACA,aACA,QAAA,EACA,YAAA,EACA,iBACA,OAAA,EAEJ;AACI,EAAA,OAAO;AAAA,IACH,IAAA,EAAM,IAAI,IAAI,CAAA,CAAA;AAAA,IACd,MAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACL,OAAA,EAAS,MAAA,CAAO,WAAA,CAAY,cAAA,CAAe,SAAS,CAAA;AAAA,MACpD,IAAA,EAAM;AAAA,KACV;AAAA,IACA,QAAA,EAAU;AAAA,MACN,IAAI,QAAA,CAAS,EAAA;AAAA,MACb,QAAQ,QAAA,CAAS,MAAA;AAAA,MACjB,YAAY,QAAA,CAAS,UAAA;AAAA,MACrB,SAAS,QAAA,CAAS,OAAA;AAAA,MAClB,IAAA,EAAM;AAAA,KACV;AAAA,IACA,OAAA;AAAA,IACA,YAAY,EAAC;AAAA,IACb,QAAA,EAAU;AAAA,GACd;AACJ;;;AC7RA,IAAM,SAAA,GAAY,MAAA,CAAO,KAAA,CAAM,sBAAsB,CAAA;AAsE9C,SAAS,eAAe,MAAA,EAC/B;AACI,EAAA,MAAM;AAAA,IACF,MAAA,GAAS,IAAI,YAAA,IAAgB,uBAAA;AAAA,IAC7B,KAAA,GAAQ,IAAI,QAAA,KAAa,aAAA;AAAA,IACzB,UAAU,GAAA,CAAI,iBAAA;AAAA,IACd,OAAA,EAAS,iBAAiB,EAAC;AAAA,IAC3B,YAAA;AAAA,IACA,wBAAA,GAA2B,IAAA;AAAA,IAC3B,uBAAA;AAAA,IACA,cAAc,GAAA,CAAI,iBAAA;AAAA,IAClB;AAAA,GACJ,GAAI,MAAA;AAKJ,EAAA,MAAM,QAAA,GAAW,cAAe,gBAAA,CAAiB,CAAC,WAAW,CAAC,CAAA,CAAE,CAAC,CAAA,IAAK,IAAA,GAAQ,IAAA;AAK9E,EAAA,IAAI,QAAA,EACJ;AACI,IAAA,IACA;AACI,MAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,MAAM,CAAA,CAAE,QAAA;AACjC,MAAA,IAAI,QAAA,KAAa,GAAA,IAAO,QAAA,KAAa,EAAA,EACrC;AACI,QAAA,SAAA,CAAU,IAAA;AAAA,UACN,kCAAkC,QAAQ,CAAA,+KAAA;AAAA,SAG9C;AAAA,MACJ;AAAA,IACJ,CAAA,CAAA,MAEA;AAAA,IAEA;AAAA,EACJ;AAKA,EAAA,SAAS,aAAa,SAAA,EACtB;AACI,IAAA,MAAM,KAAA,GAAQ,SAAS,SAAS,CAAA;AAChC,IAAA,IAAI,KAAA,EACJ;AACI,MAAA,OAAO,EAAE,MAAA,EAAQ,KAAA,CAAM,MAAA,EAAQ,IAAA,EAAM,MAAM,IAAA,EAAK;AAAA,IACpD;AAEA,IAAA,OAAO,IAAA;AAAA,EACX;AAKA,EAAA,eAAe,SAAA,CACX,SACA,OAAA,EAEJ;AACI,IAAA,MAAM,SAAA,GAAY,KAAK,GAAA,EAAI;AAC3B,IAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,MAAA;AAE7B,IAAA,IACA;AACI,MAAA,MAAM,YAAY,MAAA,CAAO,SAAA;AAEzB,MAAA,IAAI,CAAC,SAAA,EACL;AACI,QAAA,OAAO,YAAA,CAAa,IAAA;AAAA,UAChB,kBAAA,CAAmB,aAAA,EAAe,6BAAA,EAA+B,KAAK,CAAA;AAAA,UACtE,EAAE,QAAQ,GAAA;AAAI,SAClB;AAAA,MACJ;AAGA,MAAA,IAAI,QAOA,EAAC;AACL,MAAA,IAAI,WAAA,GAA+B,IAAA;AAEnC,MAAA,IAAI,OAAA,CAAQ,WAAW,KAAA,EACvB;AACI,QAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,YAAA,CAAa,IAAI,OAAO,CAAA;AAC3D,QAAA,IAAI,UAAA,EACJ;AACI,UAAA,IACA;AACI,YAAA,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,kBAAA,CAAmB,UAAU,CAAC,CAAA;AAAA,UACrD,CAAA,CAAA,MAEA;AACI,YAAA,OAAO,YAAA,CAAa,IAAA;AAAA,cAChB,kBAAA,CAAmB,aAAA,EAAe,yBAAA,EAA2B,KAAK,CAAA;AAAA,cAClE,EAAE,QAAQ,GAAA;AAAI,aAClB;AAAA,UACJ;AAAA,QACJ;AAAA,MACJ,CAAA,MAEA;AAEI,QAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAE3D,QAAA,IAAI,WAAA,CAAY,QAAA,CAAS,qBAAqB,CAAA,EAC9C;AAEI,UAAA,IACA;AACI,YAAA,WAAA,GAAc,MAAM,QAAQ,QAAA,EAAS;AAGrC,YAAA,MAAM,WAAA,GAAc,WAAA,CAAY,GAAA,CAAI,YAAY,CAAA;AAChD,YAAA,IAAI,WAAA,IAAe,OAAO,WAAA,KAAgB,QAAA,EAC1C;AACI,cAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,WAAW,CAAA;AACvC,cAAA,KAAA,CAAM,SAAS,QAAA,CAAS,MAAA;AACxB,cAAA,KAAA,CAAM,QAAQ,QAAA,CAAS,KAAA;AACvB,cAAA,KAAA,CAAM,UAAU,QAAA,CAAS,OAAA;AACzB,cAAA,KAAA,CAAM,UAAU,QAAA,CAAS,OAAA;AAAA,YAC7B;AAGA,YAAA,KAAA,CAAM,WAAW,EAAC;AAClB,YAAA,WAAA,CAAY,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAC5B;AACI,cAAA,IAAI,QAAQ,YAAA,EAAc;AAE1B,cAAA,MAAM,QAAA,GAAW,KAAA,CAAM,QAAA,CAAU,GAAG,CAAA;AACpC,cAAA,IAAI,aAAa,MAAA,EACjB;AAEI,gBAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,EAC1B;AACI,kBAAA,QAAA,CAAS,KAAK,KAAK,CAAA;AAAA,gBACvB,CAAA,MAEA;AACI,kBAAA,KAAA,CAAM,QAAA,CAAU,GAAG,CAAA,GAAI,CAAC,UAAU,KAAK,CAAA;AAAA,gBAC3C;AAAA,cACJ,CAAA,MAEA;AACI,gBAAA,KAAA,CAAM,QAAA,CAAU,GAAG,CAAA,GAAI,KAAA;AAAA,cAC3B;AAAA,YACJ,CAAC,CAAA;AAAA,UACL,SACO,KAAA,EACP;AACI,YAAA,OAAO,YAAA,CAAa,IAAA;AAAA,cAChB,kBAAA,CAAmB,aAAA,EAAe,mBAAA,EAAqB,KAAK,CAAA;AAAA,cAC5D,EAAE,QAAQ,GAAA;AAAI,aAClB;AAAA,UACJ;AAAA,QACJ,CAAA,MAEA;AAEI,UAAA,IACA;AACI,YAAA,KAAA,GAAQ,MAAM,QAAQ,IAAA,EAAK;AAAA,UAC/B,CAAA,CAAA,MAEA;AACI,YAAA,OAAO,YAAA,CAAa,IAAA;AAAA,cAChB,kBAAA,CAAmB,aAAA,EAAe,mBAAA,EAAqB,KAAK,CAAA;AAAA,cAC5D,EAAE,QAAQ,GAAA;AAAI,aAClB;AAAA,UACJ;AAAA,QACJ;AAAA,MACJ;AAGA,MAAA,MAAM,SAAA,GAAY,aAAa,SAAS,CAAA;AAExC,MAAA,IAAI,CAAC,SAAA,EACL;AACI,QAAA,SAAA,CAAU,IAAA,CAAK,CAAA,iBAAA,EAAoB,SAAS,CAAA,CAAE,CAAA;AAE9C,QAAA,OAAO,YAAA,CAAa,IAAA;AAAA,UAChB,kBAAA,CAAmB,WAAA,EAAa,CAAA,OAAA,EAAU,SAAS,eAAe,KAAK,CAAA;AAAA,UACvE,EAAE,QAAQ,GAAA;AAAI,SAClB;AAAA,MACJ;AAEA,MAAA,MAAM,EAAE,MAAA,EAAQ,YAAA,EAAc,IAAA,EAAM,YAAW,GAAI,SAAA;AAGnD,MAAA,MAAM,WAAA,GAAc,KAAA,CAAM,MAAA,IAAU,EAAC;AACrC,MAAA,MAAM,UAAA,GAAa,KAAA,CAAM,KAAA,IAAS,EAAC;AACnC,MAAA,MAAM,YAAY,KAAA,CAAM,IAAA;AACxB,MAAA,MAAM,gBAAgB,KAAA,CAAM,QAAA;AAC5B,MAAA,MAAM,WAAA,GAAc,gBAAgB,IAAA,IAAQ,aAAA,IAAiB,OAAO,IAAA,CAAK,aAAa,EAAE,MAAA,GAAS,CAAA;AAEjG,MAAA,MAAM,YAAA,GAAe,kBAAA,CAAmB,UAAA,EAAY,WAAW,CAAA;AAC/D,MAAA,MAAM,WAAA,GAAc,iBAAiB,UAAU,CAAA;AAC/C,MAAA,MAAM,YAAY,CAAA,EAAG,MAAM,CAAA,EAAG,YAAY,GAAG,WAAW,CAAA,CAAA;AAExD,MAAA,IAAI,KAAA,EACJ;AACI,QAAA,SAAA,CAAU,MAAM,oBAAA,EAAiB;AAAA,UAC7B,SAAA;AAAA,UACA,YAAA;AAAA,UACA,UAAA,EAAY,YAAA;AAAA,UACZ,SAAA;AAAA,UACA,OAAA,EAAS,CAAC,CAAC,SAAA;AAAA,UACX;AAAA,SACH,CAAA;AAAA,MACL;AAGA,MAAA,MAAM,OAAA,GAAU,iBAAA,CAAkB,OAAA,CAAQ,OAAA,EAAS,cAAc,CAAA;AAGjE,MAAA,IAAI,WAAA,EACJ;AACI,QAAA,OAAA,CAAQ,OAAO,cAAc,CAAA;AAAA,MACjC;AAGA,MAAA,MAAM,YAAA,GAA4B;AAAA,QAC9B,MAAA,EAAQ,YAAA;AAAA,QACR;AAAA,OACJ;AAGA,MAAA,IAAI,CAAC,MAAA,EAAQ,KAAA,EAAO,OAAO,CAAA,CAAE,QAAA,CAAS,YAAY,CAAA,EAClD;AACI,QAAA,IAAI,eAAe,WAAA,EACnB;AAEI,UAAA,MAAM,eAAA,GAAkB,IAAI,QAAA,EAAS;AACrC,UAAA,WAAA,CAAY,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAC5B;AACI,YAAA,IAAI,QAAQ,YAAA,EACZ;AACI,cAAA,eAAA,CAAgB,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,YACrC;AAAA,UACJ,CAAC,CAAA;AACD,UAAA,YAAA,CAAa,IAAA,GAAO,eAAA;AAAA,QACxB,WACS,SAAA,EACT;AACI,UAAA,YAAA,CAAa,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA;AAAA,QAChD;AAAA,MACJ;AAOA,MAAA,MAAM,eAAA,GAAkB,mBAAA,CAAoB,wBAAA,EAA0B,uBAAA,EAAyB,cAAc,mBAAmB,CAAA;AAChI,MAAA,MAAM,oBAAA,GAAuB,0BAAA,CAA2B,eAAA,EAAiB,YAAA,EAAc,YAAY,CAAA;AAEnG,MAAA,IAAI,KAAA,IAAS,oBAAA,CAAqB,MAAA,GAAS,CAAA,EAC3C;AACI,QAAA,SAAA,CAAU,KAAA,CAAM,SAAS,oBAAA,CAAqB,MAAM,8BAA8B,YAAY,CAAA,CAAA,EAAI,YAAY,CAAA,CAAE,CAAA;AAAA,MACpH;AAGA,MAAA,MAAM,UAAA,GAAa,4BAA4B,OAAO,CAAA;AACtD,MAAA,MAAM,UAAA,GAAa,mBAAA;AAAA,QACf,YAAA,CAAa,MAAM,CAAC,CAAA;AAAA;AAAA,QACpB,YAAA;AAAA,QACA,OAAA;AAAA,QACA,SAAA;AAAA,QACA,IAAI,eAAA,CAAgB,WAAA,CAAY,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA;AAAA,QACxC,UAAA;AAAA,QACA;AAAA,OACJ;AAGA,MAAA,MAAM,wBAAA,GAA2B,oBAAA,CAAqB,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,OAAO,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAkC,CAAC,CAAC,CAAC,CAAA;AACvH,MAAA,IAAI,wBAAA,CAAyB,SAAS,CAAA,EACtC;AACI,QAAA,MAAM,0BAAA,CAA2B,YAAY,wBAAwB,CAAA;AAGrE,QAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,UAAA,CAAW,OAAO,CAAA,EAC5D;AACI,UAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,KAAK,CAAA;AAAA,QAC1B;AAGA,QAAA,IAAI,WAAW,IAAA,EACf;AACI,UAAA,YAAA,CAAa,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,UAAA,CAAW,IAAI,CAAA;AAAA,QACtD;AAAA,MACJ;AAQA,MAAA,IAAI,WAAW,KAAA,EACf;AACI,QAAA,SAAA,CAAU,KAAK,mCAAA,EAAqC;AAAA,UAChD,SAAA;AAAA,UACA,MAAA,EAAQ,WAAW,KAAA,CAAM;AAAA,SAC5B,CAAA;AAED,QAAA,MAAM,gBAAgB,YAAA,CAAa,IAAA;AAAA,UAC/B,WAAW,KAAA,CAAM,IAAA;AAAA,UACjB,EAAE,MAAA,EAAQ,UAAA,CAAW,KAAA,CAAM,MAAA;AAAO,SACtC;AAEA,QAAA,KAAA,MAAW,MAAA,IAAU,UAAA,CAAW,KAAA,CAAM,UAAA,IAAc,EAAC,EACrD;AACI,UAAA,aAAA,CAAc,OAAA,CAAQ,MAAA,CAAO,YAAA,EAAc,oBAAA,CAAqB,MAAM,CAAC,CAAA;AAAA,QAC3E;AAEA,QAAA,OAAO,aAAA;AAAA,MACX;AAQA,MAAA,IAAI,QAAA,EACJ;AACI,QAAA,MAAM,aAAa,OAAO,YAAA,CAAa,IAAA,KAAS,QAAA,GAAW,aAAa,IAAA,GAAO,MAAA;AAK/E,QAAA,MAAM,mBAAmB,gBAAA,CAAiB;AAAA,UACtC,GAAA,EAAK,QAAA;AAAA,UACL,MAAA,EAAQ,YAAA;AAAA,UACR,IAAA,EAAM,YAAA;AAAA,UACN,KAAA,EAAO,WAAA;AAAA,UACP,IAAA,EAAM;AAAA,SACT,CAAA;AAED,QAAA,KAAA,MAAW,CAAC,UAAA,EAAY,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,gBAAgB,CAAA,EACjE;AACI,UAAA,OAAA,CAAQ,GAAA,CAAI,YAAY,KAAK,CAAA;AAAA,QACjC;AAAA,MACJ;AAGA,MAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,MAAA,MAAM,YAAY,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,OAAO,CAAA;AAE9D,MAAA,IACA;AACI,QAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,SAAA,EAAW;AAAA,UACpC,GAAG,YAAA;AAAA,UACH,QAAQ,UAAA,CAAW;AAAA,SACtB,CAAA;AAED,QAAA,YAAA,CAAa,SAAS,CAAA;AAGtB,QAAA,IAAI,IAAA,GAAO,MAAM,iBAAA,CAAkB,QAAQ,CAAA;AAO3C,QAAA,MAAM,WAAA,GAAc,oBAAA;AAAA,UAChB,YAAA,CAAa,MAAM,CAAC,CAAA;AAAA,UACpB,YAAA;AAAA,UACA,OAAA;AAAA,UACA,SAAA;AAAA,UACA,QAAA;AAAA,UACA,IAAA;AAAA,UACA,UAAA,CAAW,QAAA;AAAA,UACX,UAAA,CAAW;AAAA,SACf;AAGA,QAAA,MAAM,yBAAA,GAA4B,oBAAA,CAAqB,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,QAAQ,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAkC,CAAC,CAAC,CAAC,CAAA;AACzH,QAAA,IAAI,yBAAA,CAA0B,SAAS,CAAA,EACvC;AACI,UAAA,MAAM,2BAAA,CAA4B,aAAa,yBAAyB,CAAA;AACxE,UAAA,IAAA,GAAO,YAAY,QAAA,CAAS,IAAA;AAAA,QAChC;AAEA,QAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAE9B,QAAA,IAAI,KAAA,EACJ;AACI,UAAA,SAAA,CAAU,MAAM,qBAAA,EAAkB;AAAA,YAC9B,SAAA;AAAA,YACA,MAAA,EAAQ,YAAY,QAAA,CAAS,MAAA;AAAA,YAC7B,QAAA,EAAU,GAAG,QAAQ,CAAA,EAAA;AAAA,WACxB,CAAA;AAAA,QACL;AAIA,QAAA,MAAM,eAAe,WAAA,CAAY,QAAA,CAAS,WAAW,GAAA,GAC/C,IAAI,aAAa,IAAA,EAAM;AAAA,UACrB,MAAA,EAAQ,GAAA;AAAA,UACR,UAAA,EAAY,YAAY,QAAA,CAAS;AAAA,SACpC,CAAA,GACC,YAAA,CAAa,IAAA,CAAK,IAAA,EAAM;AAAA,UACtB,MAAA,EAAQ,YAAY,QAAA,CAAS,MAAA;AAAA,UAC7B,UAAA,EAAY,YAAY,QAAA,CAAS;AAAA,SACpC,CAAA;AAGL,QAAA,sBAAA,CAAuB,QAAA,CAAS,OAAA,EAAS,YAAA,CAAa,OAAO,CAAA;AAG7D,QAAA,KAAA,MAAW,MAAA,IAAU,YAAY,UAAA,EACjC;AACI,UAAA,MAAM,eAAA,GAAkB,qBAAqB,MAAM,CAAA;AACnD,UAAA,YAAA,CAAa,OAAA,CAAQ,MAAA,CAAO,YAAA,EAAc,eAAe,CAAA;AAEzD,UAAA,IAAI,KAAA,EACJ;AACI,YAAA,SAAA,CAAU,MAAM,yBAAA,EAA2B;AAAA,cACvC,MAAM,MAAA,CAAO;AAAA,aAChB,CAAA;AAAA,UACL;AAAA,QACJ;AAEA,QAAA,OAAO,YAAA;AAAA,MACX,SACO,KAAA,EACP;AACI,QAAA,YAAA,CAAa,SAAS,CAAA;AAGtB,QAAA,IAAI,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,YAAA,EAC7C;AACI,UAAA,SAAA,CAAU,MAAM,iBAAA,EAAmB;AAAA,YAC/B,SAAA;AAAA,YACA,SAAA;AAAA,YACA;AAAA,WACH,CAAA;AAED,UAAA,OAAO,YAAA,CAAa,IAAA;AAAA,YAChB,mBAAmB,iBAAA,EAAmB,CAAA,wBAAA,EAA2B,OAAO,CAAA,EAAA,CAAA,EAAM,OAAO,KAAK,CAAA;AAAA,YAC1F,EAAE,QAAQ,GAAA;AAAI,WAClB;AAAA,QACJ;AAGA,QAAA,MAAM,QAAA,GAAW,KAAA;AACjB,QAAA,SAAA,CAAU,MAAM,aAAA,EAAe;AAAA,UAC3B,SAAA;AAAA,UACA,SAAA;AAAA,UACA,OAAO,QAAA,CAAS;AAAA,SACnB,CAAA;AAED,QAAA,OAAO,YAAA,CAAa,IAAA;AAAA,UAChB,mBAAmB,aAAA,EAAe,QAAA,CAAS,OAAA,IAAW,8BAAA,EAAgC,OAAO,QAAQ,CAAA;AAAA,UACrG,EAAE,QAAQ,GAAA;AAAI,SAClB;AAAA,MACJ;AAAA,IACJ,SACO,KAAA,EACP;AACI,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAC9B,MAAA,MAAM,GAAA,GAAM,KAAA;AAEZ,MAAA,SAAA,CAAU,MAAM,iBAAA,EAAmB;AAAA,QAC/B,OAAO,GAAA,CAAI,OAAA;AAAA,QACX,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,QAAA,EAAU,GAAG,QAAQ,CAAA,EAAA;AAAA,OACxB,CAAA;AAED,MAAA,OAAO,YAAA,CAAa,IAAA;AAAA,QAChB,mBAAmB,uBAAA,EAAyB,GAAA,CAAI,OAAA,IAAW,eAAA,EAAiB,OAAO,GAAG,CAAA;AAAA,QACtF,EAAE,QAAQ,GAAA;AAAI,OAClB;AAAA,IACJ;AAAA,EACJ;AAGA,EAAA,OAAO;AAAA,IACH,KAAK,CAAC,GAAA,EAAkB,OAAA,KACpB,SAAA,CAAU,KAAK,OAAO,CAAA;AAAA,IAC1B,MAAM,CAAC,GAAA,EAAkB,OAAA,KACrB,SAAA,CAAU,KAAK,OAAO;AAAA,GAC9B;AACJ","file":"server.js","sourcesContent":["/**\n * Proxy → Backend request signing (HMAC-SHA256) with key rotation\n *\n * Shared between the Next.js RPC proxy (which signs outbound requests) and the\n * backend proxy-guard middleware (which verifies them). Keeping the canonical\n * string and HMAC logic in one pure module guarantees both sides agree.\n *\n * The signature proves a request passed through a trusted proxy that holds the\n * shared secret. It does NOT authenticate the end user — that is the JWT layer's\n * job — and it cannot stop a client from calling the proxy itself. Its role is to\n * stop direct-to-backend calls that bypass the proxy.\n *\n * Keys are identified by a short keyId so secrets can be rotated without downtime:\n * the proxy signs with the active key and stamps its keyId in a header; the\n * backend keeps a set of accepted keys (current + previous) and selects by keyId.\n * Roll a new key in, let both sides pick it up, switch the proxy to it, then drop\n * the old one after a grace period — no request is ever rejected mid-rotation.\n *\n * @module security/proxy-signature\n */\nimport { createHmac, randomBytes, timingSafeEqual, createHash } from 'node:crypto';\n\n// ============================================================================\n// Header names\n// ============================================================================\n\nexport const PROXY_SIGNATURE_HEADER = 'x-spfn-proxy-signature';\nexport const PROXY_TIMESTAMP_HEADER = 'x-spfn-proxy-timestamp';\nexport const PROXY_NONCE_HEADER = 'x-spfn-proxy-nonce';\nexport const PROXY_KEY_ID_HEADER = 'x-spfn-proxy-key-id';\n/**\n * The real client IP, forwarded by the proxy. The backend trusts this only when\n * the request is proxy-verified (proxy-guard `clientType` ≠ untrusted) — the proxy\n * itself sees no spoofable hop, so a verified request's value is the true client.\n */\nexport const PROXY_CLIENT_IP_HEADER = 'x-spfn-proxy-client-ip';\n\n/** keyId used when a raw secret carries no `keyId:` prefix (back-compat). */\nexport const DEFAULT_KEY_ID = 'default';\n\n// ============================================================================\n// Keys\n// ============================================================================\n\n/**\n * A signing key: a short identifier plus its secret. Encoded in env as\n * `<keyId>:<secret>` (e.g. `v2:9f3c...`); a bare secret gets `DEFAULT_KEY_ID`.\n */\nexport interface ProxyKey\n{\n    keyId: string;\n    secret: string;\n}\n\n/**\n * Parse one `<keyId>:<secret>` (or bare `<secret>`) string into a ProxyKey.\n * keyId is everything before the FIRST colon; the secret keeps any later colons.\n */\nexport function parseProxyKey(raw: string): ProxyKey\n{\n    const idx = raw.indexOf(':');\n    if (idx === -1)\n    {\n        return { keyId: DEFAULT_KEY_ID, secret: raw };\n    }\n\n    // A leading colon (':secret') yields an empty keyId; the backend treats an empty\n    // keyId header as \"missing\" and rejects, so normalize it to DEFAULT_KEY_ID.\n    return { keyId: raw.slice(0, idx) || DEFAULT_KEY_ID, secret: raw.slice(idx + 1) };\n}\n\n/**\n * Build the backend's accepted key set from raw env values. Each input may be a\n * single key or a comma-separated list (for multiple grace keys). Earlier inputs\n * win on keyId collision, so pass the active secret first.\n */\nexport function parseProxyKeySet(raws: Array<string | undefined | null>): ProxyKey[]\n{\n    const keys: ProxyKey[] = [];\n    const seen = new Set<string>();\n\n    for (const raw of raws)\n    {\n        if (!raw)\n        {\n            continue;\n        }\n\n        for (const part of raw.split(','))\n        {\n            const trimmed = part.trim();\n            if (!trimmed)\n            {\n                continue;\n            }\n\n            const key = parseProxyKey(trimmed);\n            if (!key.secret || seen.has(key.keyId))\n            {\n                continue;\n            }\n\n            seen.add(key.keyId);\n            keys.push(key);\n        }\n    }\n\n    return keys;\n}\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/**\n * The parts of a request that are bound into the signature.\n */\nexport interface SignatureParts\n{\n    /** Resolved backend HTTP method (GET/POST/PUT/...) */\n    method: string;\n\n    /**\n     * Raw (wire) backend path, percent-encoding preserved, leading slash, NO query.\n     * Proxy signs its outbound request-target path; the backend reconstructs the\n     * SAME bytes from `new URL(c.req.url).pathname` (NOT the decoded `c.req.path`).\n     */\n    path: string;\n\n    /**\n     * Raw (wire) query string including leading `?`, or '' when there is none.\n     * Both sides use the verbatim search string so query params are authenticated.\n     */\n    query: string;\n\n    /** Unix epoch milliseconds, as a string */\n    timestamp: string;\n\n    /** Random per-request nonce */\n    nonce: string;\n\n    /**\n     * SHA-256 hex of the raw request body, or empty string when there is no body\n     * (GET/HEAD, or multipart uploads which are excluded by design). Bound for ANY\n     * non-multipart content-type, not just application/json.\n     *\n     * Multipart is excluded so the proxy can stream large uploads without buffering\n     * them to hash. The signature therefore proves *provenance* (came through the\n     * trusted proxy) and binds method/path/query/timestamp for a multipart request,\n     * but NOT the body bytes. Two consequences, by design:\n     *   - Multipart *content* integrity/validation is the application's job (size,\n     *     type, checksum, business rules) — not the transport signature's.\n     *   - If you don't trust the proxy→backend hop itself, secure it with TLS/mTLS;\n     *     signing a prefix of the stream would be a half-measure (the tail stays\n     *     unprotected) and is intentionally not done.\n     */\n    bodyHash: string;\n}\n\n/**\n * Headers produced by signing — ready to set on the outbound fetch.\n */\nexport interface SignatureHeaders\n{\n    [PROXY_SIGNATURE_HEADER]: string;\n    [PROXY_TIMESTAMP_HEADER]: string;\n    [PROXY_NONCE_HEADER]: string;\n    [PROXY_KEY_ID_HEADER]: string;\n}\n\n// ============================================================================\n// Canonical string + HMAC\n// ============================================================================\n\n/**\n * Build the canonical string that gets signed. Field order is fixed and each\n * field is newline-separated, so a captured signature cannot be replayed against\n * a different method, path, or body.\n */\nexport function buildCanonicalString(parts: SignatureParts): string\n{\n    return [parts.method.toUpperCase(), parts.path, parts.query, parts.timestamp, parts.nonce, parts.bodyHash].join('\\n');\n}\n\n/**\n * Hash a request body. Accepts a string (proxy side, from JSON.stringify) or a\n * Buffer (backend side, straight from the stream — avoids a bytes→string→bytes\n * round-trip). Returns '' for empty/no body. A utf8 string and its Buffer hash\n * identically, so both sides agree.\n */\nexport function hashBody(body: string | Buffer | undefined | null): string\n{\n    if (!body || body.length === 0)\n    {\n        return '';\n    }\n\n    return typeof body === 'string'\n        ? createHash('sha256').update(body, 'utf8').digest('hex')\n        : createHash('sha256').update(body).digest('hex');\n}\n\n/**\n * Compute the HMAC-SHA256 signature (hex) for the given parts.\n */\nexport function computeSignature(secret: string, parts: SignatureParts): string\n{\n    return createHmac('sha256', secret).update(buildCanonicalString(parts)).digest('hex');\n}\n\n/**\n * Generate a fresh random nonce (hex).\n */\nexport function generateNonce(): string\n{\n    return randomBytes(16).toString('hex');\n}\n\n// ============================================================================\n// Sign (proxy side)\n// ============================================================================\n\nexport interface SignInput\n{\n    /** The active signing key. */\n    key: ProxyKey;\n    method: string;\n    /** Raw (wire) path, leading slash, percent-encoding preserved, NO query. */\n    path: string;\n    /** Raw (wire) query string including leading `?`, or '' / omitted for none. */\n    query?: string;\n    /** Raw request body string, if any. Omit for GET / multipart uploads. */\n    body?: string | null;\n    /** Override the timestamp (testing). Defaults to Date.now(). */\n    timestamp?: string;\n    /** Override the nonce (testing). Defaults to a random nonce. */\n    nonce?: string;\n}\n\n/**\n * Sign an outbound proxy request and return the headers to attach (including the\n * keyId so the backend knows which key to verify against).\n */\nexport function signProxyRequest(input: SignInput): SignatureHeaders\n{\n    const timestamp = input.timestamp ?? String(Date.now());\n    const nonce = input.nonce ?? generateNonce();\n    const signature = computeSignature(input.key.secret, {\n        method: input.method,\n        path: input.path,\n        query: input.query ?? '',\n        timestamp,\n        nonce,\n        bodyHash: hashBody(input.body),\n    });\n\n    return {\n        [PROXY_SIGNATURE_HEADER]: signature,\n        [PROXY_TIMESTAMP_HEADER]: timestamp,\n        [PROXY_NONCE_HEADER]: nonce,\n        [PROXY_KEY_ID_HEADER]: input.key.keyId,\n    };\n}\n\n// ============================================================================\n// Verify (backend side)\n// ============================================================================\n\nexport type VerifyFailureReason =\n    | 'missing-headers'\n    | 'stale-timestamp'\n    | 'bad-timestamp'\n    | 'unknown-key'\n    | 'signature-mismatch';\n\n// ('body-read-error' / 'origin-not-allowed' / 'nonce-replay' are guard-level\n//  reasons carried separately by the middleware, not produced by verify itself.)\n\nexport interface VerifyResult\n{\n    valid: boolean;\n    reason?: VerifyFailureReason;\n    /** The verified nonce, for optional replay tracking by the caller. */\n    nonce?: string;\n    /** The keyId the request was verified against (for logging/metrics). */\n    keyId?: string;\n}\n\nexport interface VerifyInput\n{\n    /** Accepted keys (active + grace). Selected by the request's keyId header. */\n    keys: ProxyKey[];\n    method: string;\n    /** Raw (wire) path from `new URL(c.req.url).pathname` — NOT decoded `c.req.path`. */\n    path: string;\n    /** Raw (wire) query string from `new URL(c.req.url).search`, or '' for none. */\n    query?: string;\n    /** Raw request body (string or Buffer) as received, if any. */\n    body?: string | Buffer | null;\n    signature: string | null | undefined;\n    timestamp: string | null | undefined;\n    nonce: string | null | undefined;\n    keyId: string | null | undefined;\n    /** Allowed clock skew / replay window in ms. Default 30s. */\n    windowMs?: number;\n    /** Current time (testing). Defaults to Date.now(). */\n    now?: number;\n}\n\n/**\n * Constant-time hex string comparison. Returns false on any length diff.\n *\n * Buffer.from(_, 'hex') does NOT throw on invalid hex — it silently truncates at\n * the first bad char — so a malformed signature yields a shorter buffer that the\n * length check rejects. No try/catch needed.\n */\nfunction safeEqualHex(a: string, b: string): boolean\n{\n    const bufA = Buffer.from(a, 'hex');\n    const bufB = Buffer.from(b, 'hex');\n\n    if (bufA.length === 0 || bufA.length !== bufB.length)\n    {\n        return false;\n    }\n\n    return timingSafeEqual(bufA, bufB);\n}\n\n/**\n * Verify an inbound request's proxy signature against the accepted key set.\n *\n * Checks, in order: headers present, timestamp within window (replay guard),\n * keyId known, and HMAC match. Nonce-level replay rejection is left to the caller\n * (optional, Redis-backed) since not every deployment has a shared store.\n */\nexport function verifyProxyRequest(input: VerifyInput): VerifyResult\n{\n    const { signature, timestamp, nonce, keyId } = input;\n\n    if (!signature || !timestamp || !nonce || !keyId)\n    {\n        return { valid: false, reason: 'missing-headers' };\n    }\n\n    const ts = Number(timestamp);\n    if (!Number.isFinite(ts))\n    {\n        return { valid: false, reason: 'bad-timestamp' };\n    }\n\n    const now = input.now ?? Date.now();\n    const windowMs = input.windowMs ?? 30_000;\n    if (Math.abs(now - ts) > windowMs)\n    {\n        return { valid: false, reason: 'stale-timestamp' };\n    }\n\n    const key = input.keys.find(k => k.keyId === keyId);\n    if (!key)\n    {\n        return { valid: false, reason: 'unknown-key' };\n    }\n\n    const expected = computeSignature(key.secret, {\n        method: input.method,\n        path: input.path,\n        query: input.query ?? '',\n        timestamp,\n        nonce,\n        bodyHash: hashBody(input.body),\n    });\n\n    if (!safeEqualHex(signature, expected))\n    {\n        return { valid: false, reason: 'signature-mismatch' };\n    }\n\n    return { valid: true, nonce, keyId };\n}\n","/**\n * Shared utilities for Next.js client and proxy modules\n *\n * Contains common functions used by both client and proxy to avoid code duplication.\n */\n\n/**\n * Build URL with path parameters replaced\n *\n * @example\n * buildUrlWithParams('/users/:id/posts/:postId', { id: '123', postId: '456' })\n * // Returns: '/users/123/posts/456'\n */\nexport function buildUrlWithParams(path: string, params: Record<string, any>): string\n{\n    let url = path;\n    for (const [key, value] of Object.entries(params))\n    {\n        url = url.replace(`:${key}`, encodeURIComponent(String(value)));\n    }\n\n    return url;\n}\n\n/**\n * Build query string from object\n *\n * @example\n * buildQueryString({ page: '1', limit: '10', tags: ['foo', 'bar'] })\n * // Returns: '?page=1&limit=10&tags=foo&tags=bar'\n */\nexport function buildQueryString(query: Record<string, any>): string\n{\n    if (Object.keys(query).length === 0)\n    {\n        return '';\n    }\n\n    const searchParams = new URLSearchParams();\n    for (const [key, value] of Object.entries(query))\n    {\n        if (Array.isArray(value))\n        {\n            value.forEach((v) => searchParams.append(key, String(v)));\n        }\n        else\n        {\n            searchParams.append(key, String(value));\n        }\n    }\n\n    return `?${searchParams.toString()}`;\n}\n\n/**\n * Build Cookie header string from cookies object\n *\n * @example\n * buildCookieHeader({ session: 'abc123', theme: 'dark' })\n * // Returns: 'session=abc123; theme=dark'\n */\nexport function buildCookieHeader(cookies: Record<string, string>): string\n{\n    return Object.entries(cookies)\n        .map(([key, value]) => `${key}=${value}`)\n        .join('; ');\n}\n\n/**\n * Parse response body based on content type\n *\n * Handles:\n * - 204 No Content: returns null (no body expected)\n * - application/json: parses JSON body\n * - Other content types: returns raw text\n */\nexport async function parseResponseBody(response: Response): Promise<any>\n{\n    // 204 No Content has no body\n    if (response.status === 204)\n    {\n        return null;\n    }\n\n    const contentType = response.headers.get('content-type');\n\n    if (contentType?.includes('application/json'))\n    {\n        const text = await response.text();\n\n        return text ? JSON.parse(text) : null;\n    }\n    else\n    {\n        return await response.text();\n    }\n}\n","/**\n * SPFN Next.js Proxy Interceptor Execution Engine\n */\n\nimport type {\n    InterceptorRule,\n    RequestInterceptor,\n    ResponseInterceptor,\n    RequestInterceptorContext,\n    ResponseInterceptorContext,\n} from './types';\n\n/**\n * Check if path matches pattern\n *\n * Supports:\n * - Wildcards: '/_auth/*' matches '/_auth/login'\n * - Path params: '/users/:id' matches '/users/123'\n * - RegExp: /^\\/_auth\\/.+$/ matches '/_auth/login'\n * - Exact match: '/_auth/login' matches '/_auth/login'\n * - All: '*' matches any path\n *\n * @param path - Request path to test\n * @param pattern - Pattern to match against\n * @returns True if path matches pattern\n */\nexport function matchPath(path: string, pattern: string | RegExp): boolean\n{\n    // Match all\n    if (pattern === '*')\n    {\n        return true;\n    }\n\n    // RegExp pattern\n    if (pattern instanceof RegExp)\n    {\n        return pattern.test(path);\n    }\n\n    // String pattern\n    // Convert wildcard pattern to RegExp\n    // '/_auth/*' -> /^\\/_auth\\/.*/\n    // '/users/:id' -> /^\\/users\\/[^/]+$/\n    const regexPattern = pattern\n        .replace(/\\*/g, '.*')\n        .replace(/:[^/]+/g, '[^/]+')\n        .replace(/\\//g, '\\\\/');\n\n    const regex = new RegExp(`^${regexPattern}$`);\n\n    return regex.test(path);\n}\n\n/**\n * Check if method matches pattern\n *\n * @param method - Request method (e.g., 'POST')\n * @param pattern - Method pattern (e.g., 'POST' or ['POST', 'PUT'])\n * @returns True if method matches pattern\n */\nexport function matchMethod(\n    method: string,\n    pattern?: string | string[],\n): boolean\n{\n    // No method filter = match all\n    if (!pattern)\n    {\n        return true;\n    }\n\n    // Single method\n    if (typeof pattern === 'string')\n    {\n        return method.toUpperCase() === pattern.toUpperCase();\n    }\n\n    // Multiple methods\n    return pattern.some((m) => m.toUpperCase() === method.toUpperCase());\n}\n\n/**\n * Filter interceptors that match the request\n *\n * @param rules - All interceptor rules\n * @param path - Request path\n * @param method - Request method\n * @returns Matched interceptors\n */\nexport function filterMatchingInterceptors(\n    rules: InterceptorRule[],\n    path: string,\n    method: string,\n): InterceptorRule[]\n{\n    return rules.filter((rule) => \n    {\n        return matchPath(path, rule.pathPattern) && matchMethod(method, rule.method);\n    });\n}\n\n/**\n * Execute request interceptors in chain\n *\n * Interceptors are executed in order:\n * 1. First registered interceptor\n * 2. Second registered interceptor\n * 3. ... and so on\n *\n * Each interceptor must call next() to continue the chain.\n * If next() is not called, the chain stops and remaining interceptors are skipped.\n *\n * @param context - Request interceptor context\n * @param interceptors - Interceptors to execute\n */\nexport async function executeRequestInterceptors(\n    context: RequestInterceptorContext,\n    interceptors: RequestInterceptor[],\n): Promise<void>\n{\n    let index = 0;\n\n    const next = async (): Promise<void> => \n    {\n        if (index >= interceptors.length)\n        {\n            return;\n        }\n\n        const interceptor = interceptors[index];\n        index++;\n\n        await interceptor(context, next);\n    };\n\n    await next();\n}\n\n/**\n * Execute response interceptors in chain\n *\n * Interceptors are executed in order:\n * 1. First registered interceptor\n * 2. Second registered interceptor\n * 3. ... and so on\n *\n * Each interceptor must call next() to continue the chain.\n * If next() is not called, the chain stops and remaining interceptors are skipped.\n *\n * @param context - Response interceptor context\n * @param interceptors - Interceptors to execute\n */\nexport async function executeResponseInterceptors(\n    context: ResponseInterceptorContext,\n    interceptors: ResponseInterceptor[],\n): Promise<void>\n{\n    let index = 0;\n\n    const next = async (): Promise<void> => \n    {\n        if (index >= interceptors.length)\n        {\n            return;\n        }\n\n        const interceptor = interceptors[index];\n        index++;\n\n        await interceptor(context, next);\n    };\n\n    await next();\n}\n","/**\n * Global Interceptor Registry\n *\n * Allows packages to automatically register their interceptors\n * for Next.js proxy without manual configuration.\n *\n * Uses globalThis for persistence across module reloads (HMR).\n */\nimport type { InterceptorRule } from './types';\n\n// ============================================================================\n// Global Type Declarations\n// ============================================================================\n\n/**\n * Extend globalThis with interceptor registry\n *\n * Using globalThis allows the registry to persist across module reloads (HMR).\n * preventing duplicate registrations during development with HMR.\n */\ndeclare global\n{\n    var __SPFN_INTERCEPTOR_REGISTRY__: InterceptorRegistry | undefined;\n}\n\n/**\n * Global interceptor registry\n *\n * Packages register their interceptors on import,\n * and proxy automatically discovers and applies them.\n */\nexport class InterceptorRegistry\n{\n    private interceptors = new Map<string, InterceptorRule[]>();\n\n    /**\n     * Register interceptors for a package\n     *\n     * @param packageName - Unique package identifier (e.g., 'auth', 'storage')\n     * @param interceptors - Array of interceptor rules\n     *\n     * @example\n     * ```typescript\n     * registerInterceptors('auth', [\n     *   {\n     *     pathPattern: '/_auth/*',\n     *     request: async (ctx, next) => { ... }\n     *   }\n     * ]);\n     * ```\n     */\n    register(packageName: string, interceptors: InterceptorRule[]): void\n    {\n        if (!this.interceptors.has(packageName))\n        {\n            this.interceptors.set(packageName, interceptors);\n        }\n    }\n\n    /**\n     * Get all registered interceptors\n     *\n     * @param exclude - Package names to exclude\n     * @returns Flat array of all interceptor rules\n     */\n    getAll(exclude: string[] = []): InterceptorRule[]\n    {\n        const all: InterceptorRule[] = [];\n\n        for (const [packageName, interceptors] of this.interceptors.entries())\n        {\n            if (!exclude.includes(packageName))\n            {\n                all.push(...interceptors);\n            }\n        }\n\n        return all;\n    }\n\n    /**\n     * Get interceptors for specific package\n     *\n     * @param packageName - Package identifier\n     * @returns Interceptor rules or undefined\n     */\n    get(packageName: string): InterceptorRule[] | undefined\n    {\n        return this.interceptors.get(packageName);\n    }\n\n    /**\n     * Get list of registered package names\n     */\n    getPackageNames(): string[]\n    {\n        return Array.from(this.interceptors.keys());\n    }\n\n    /**\n     * Check if package has registered interceptors\n     */\n    has(packageName: string): boolean\n    {\n        return this.interceptors.has(packageName);\n    }\n\n    /**\n     * Unregister interceptors for a package\n     *\n     * @param packageName - Package identifier\n     */\n    unregister(packageName: string): void\n    {\n        this.interceptors.delete(packageName);\n    }\n\n    /**\n     * Clear all registered interceptors\n     *\n     * Useful for testing\n     */\n    clear(): void\n    {\n        this.interceptors.clear();\n    }\n\n    /**\n     * Get total count of registered interceptors\n     */\n    count(): number\n    {\n        let total = 0;\n        for (const interceptors of this.interceptors.values())\n        {\n            total += interceptors.length;\n        }\n\n        return total;\n    }\n}\n\n/**\n * Global singleton registry instance\n *\n * Uses globalThis to persist across module reloads (HMR).\n * This prevents duplicate registrations during development.\n */\nexport const interceptorRegistry = (() =>\n{\n    if (!globalThis.__SPFN_INTERCEPTOR_REGISTRY__)\n    {\n        globalThis.__SPFN_INTERCEPTOR_REGISTRY__ = new InterceptorRegistry();\n    }\n\n    return globalThis.__SPFN_INTERCEPTOR_REGISTRY__;\n})();\n\n/**\n * Register interceptors for a package\n *\n * This should be called during package initialization (on import).\n * The interceptors will be automatically applied by the Next.js proxy.\n *\n * @param packageName - Unique package identifier (e.g., 'auth', 'storage')\n * @param interceptors - Array of interceptor rules\n *\n * @example\n * ```typescript\n * // packages/auth/src/adapters/nextjs/interceptors/index.ts\n * import { registerInterceptors } from '@spfn/core/nextjs';\n *\n * const authInterceptors = [\n *   {\n *     pathPattern: '/_auth/*',\n *     request: async (ctx, next) => {\n *       // Add JWT token\n *       ctx.headers['Authorization'] = 'Bearer token';\n *       await next();\n *     }\n *   }\n * ];\n *\n * // Auto-register on import\n * registerInterceptors('auth', authInterceptors);\n * ```\n */\nexport function registerInterceptors(\n    packageName: string,\n    interceptors: InterceptorRule[],\n): void\n{\n    interceptorRegistry.register(packageName, interceptors);\n}\n","/**\n * Helper functions for proxy handler\n * Separates utility logic from main proxy handler for better maintainability\n */\nimport { NextRequest } from 'next/server.js';\nimport type { CookieOptions, SetCookie } from '../client';\nimport type { InterceptorRule, RequestInterceptorContext, ResponseInterceptorContext } from './interceptors/types';\nimport type { InterceptorRegistry } from './interceptors';\nimport { PROXY_CLIENT_IP_HEADER } from '../../security/proxy-signature';\n\n// Re-export from shared\nexport { parseResponseBody } from '../shared';\n\n/**\n * Resolve the real client IP from a forwarded chain.\n *\n * `X-Forwarded-For` is `client, proxy1, proxy2, …` — each trusted hop appends the\n * address it received the connection from, so the rightmost `trustedHops` entries\n * are added by our own infra and can't be spoofed. The client as the outermost\n * trusted hop saw it is `parts[len - trustedHops]`. A client that prepends a fake\n * value just lengthens the chain to the left and is ignored.\n *\n * @param xff - raw X-Forwarded-For header value\n * @param trustedHops - number of trusted proxies in front (e.g. LB + nginx = 2)\n */\nexport function clientIpFromForwardedChain(\n    xff: string | null | undefined,\n    trustedHops: number,\n): string | undefined\n{\n    if (!xff) return undefined;\n\n    const parts = xff.split(',').map(s => s.trim()).filter(Boolean);\n    if (parts.length === 0) return undefined;\n\n    const idx = parts.length - Math.max(1, trustedHops);\n\n    // Fewer entries than configured hops (misconfig / fewer real hops): best-effort\n    // to the leftmost rather than returning nothing.\n    return parts[idx] ?? parts[0];\n}\n\nfunction trustedProxyHops(): number\n{\n    const raw = Number.parseInt(process.env.TRUSTED_PROXY_HOPS ?? '', 10);\n\n    return Number.isFinite(raw) && raw > 0 ? raw : 1;\n}\n\n/**\n * Build request headers for proxying\n * Forwards important headers from source and adds default headers\n *\n * @param sourceHeaders - Source headers (can be Headers object or Record)\n * @param defaultHeaders - Default headers to add\n */\nexport function buildProxyHeaders(\n    sourceHeaders: Headers | Record<string, string>,\n    defaultHeaders: Record<string, string>,\n): Headers\n{\n    const headers = new Headers();\n\n    // Forward important headers from source\n    const headersToForward = [\n        'content-type',\n        'authorization',\n        'cookie',\n        'user-agent',\n        'accept',\n        'accept-language',\n        // Forwarded so the backend proxy-guard can enforce its origin allowlist on\n        // the real browser Origin; without this allowedOrigins would be a no-op.\n        'origin',\n    ];\n\n    for (const header of headersToForward)\n    {\n        const value = sourceHeaders instanceof Headers\n            ? sourceHeaders.get(header)\n            : sourceHeaders[header];\n\n        if (value)\n        {\n            headers.set(header, value);\n        }\n    }\n\n    // Forward the real client IP so the backend can rate-limit per user. The\n    // backend trusts this header only on proxy-verified requests, so a direct\n    // caller can't spoof it. Resolved hop-aware from the inbound X-Forwarded-For.\n    const xff = sourceHeaders instanceof Headers\n        ? sourceHeaders.get('x-forwarded-for')\n        : sourceHeaders['x-forwarded-for'];\n    const clientIp = clientIpFromForwardedChain(xff, trustedProxyHops());\n    if (clientIp)\n    {\n        headers.set(PROXY_CLIENT_IP_HEADER, clientIp);\n    }\n\n    // Add default headers\n    for (const [key, value] of Object.entries(defaultHeaders))\n    {\n        headers.set(key, value);\n    }\n\n    return headers;\n}\n\n/**\n * Parse cookies from Cookie header string\n *\n * @param cookieHeader - Cookie header string (e.g., \"session=abc; theme=dark\")\n * @returns Map of cookie name-value pairs\n */\nexport function parseCookies(cookieHeader: string | null | undefined): Map<string, string>\n{\n    const cookiesMap = new Map<string, string>();\n\n    if (!cookieHeader)\n    {\n        return cookiesMap;\n    }\n\n    const cookiePairs = cookieHeader.split(';').map(c => c.trim());\n    for (const pair of cookiePairs)\n    {\n        const [name, ...valueParts] = pair.split('=');\n        if (name && valueParts.length > 0)\n        {\n            const value = valueParts.join('='); // Handle = in cookie value\n            cookiesMap.set(name.trim(), value.trim());\n        }\n    }\n\n    return cookiesMap;\n}\n\n/**\n * Parse cookies from NextRequest (Next.js specific helper)\n * Combines cookies from both NextRequest.cookies and Cookie header\n */\nexport function parseCookiesFromNextRequest(request: NextRequest): Map<string, string>\n{\n    const cookiesMap = new Map<string, string>();\n\n    // Add cookies from NextRequest (browser cookies)\n    for (const cookie of request.cookies.getAll())\n    {\n        cookiesMap.set(cookie.name, cookie.value);\n    }\n\n    // Add cookies from Cookie header (server-side forwarded cookies)\n    const cookieHeader = request.headers.get('cookie');\n    if (cookieHeader)\n    {\n        const parsed = parseCookies(cookieHeader);\n        for (const [name, value] of parsed.entries())\n        {\n            cookiesMap.set(name, value);\n        }\n    }\n\n    return cookiesMap;\n}\n\n// Mapping of option names to Set-Cookie attribute formats\nconst optionMappings: Array<{\n    key: keyof CookieOptions;\n    format: (value: any) => string | null;\n}> = [\n    { key: 'httpOnly', format: (v) => v ? 'HttpOnly' : null },\n    { key: 'secure', format: (v) => v ? 'Secure' : null },\n    { key: 'sameSite', format: (v) => v ? `SameSite=${v}` : null },\n    { key: 'maxAge', format: (v) => v !== undefined ? `Max-Age=${v}` : null },\n    { key: 'path', format: (v) => v ? `Path=${v}` : null },\n    { key: 'domain', format: (v) => v ? `Domain=${v}` : null },\n];\n\n/**\n * Build Set-Cookie header string from cookie options\n */\nexport function buildSetCookieHeader(cookie: SetCookie): string\n{\n    const parts = [`${cookie.name}=${cookie.value}`];\n    const options = cookie.options || {};\n\n    for (const { key, format } of optionMappings)\n    {\n        const value = options[key];\n        if (value !== undefined && value !== false)\n        {\n            const formatted = format(value);\n            if (formatted)\n            {\n                parts.push(formatted);\n            }\n        }\n    }\n\n    return parts.join('; ');\n}\n\n/**\n * Build error response JSON\n */\nexport function buildErrorResponse(\n    errorType: string,\n    message: string,\n    debug: boolean,\n    error?: Error,\n): any\n{\n    return {\n        error: errorType,\n        message,\n        ...(debug && error?.stack && { stack: error.stack }),\n    };\n}\n\nconst headersToForward = [\n    'content-type',\n    'cache-control',\n    'set-cookie',\n    'etag',\n    'last-modified',\n];\n\n/**\n * Forward response headers back to client\n */\nexport function forwardResponseHeaders(\n    sourceHeaders: Headers,\n    targetHeaders: Headers,\n): void\n{\n    for (const header of headersToForward)\n    {\n        const value = sourceHeaders.get(header);\n        if (value)\n        {\n            targetHeaders.set(header, value);\n        }\n    }\n}\n\n/**\n * Collect all interceptors (auto-discovered + config)\n */\nexport function collectInterceptors(\n    autoDiscoverInterceptors: boolean,\n    disableAutoInterceptors: string[] | undefined,\n    configInterceptors: InterceptorRule[] | undefined,\n    registry: InterceptorRegistry,\n): InterceptorRule[]\n{\n    const allInterceptors: InterceptorRule[] = [];\n\n    // Auto-discover from registry\n    if (autoDiscoverInterceptors)\n    {\n        const registeredInterceptors = registry.getAll(disableAutoInterceptors || []);\n        allInterceptors.push(...registeredInterceptors);\n    }\n\n    // Add config interceptors\n    if (configInterceptors)\n    {\n        allInterceptors.push(...configInterceptors);\n    }\n\n    return allInterceptors;\n}\n\n/**\n * Build RequestInterceptorContext\n */\nexport function buildRequestContext(\n    path: string,\n    method: string,\n    headers: Headers,\n    body: any,\n    searchParams: URLSearchParams,\n    cookiesMap: Map<string, string>,\n    request: NextRequest,\n): RequestInterceptorContext\n{\n    return {\n        path: `/${path}`,\n        method,\n        headers: Object.fromEntries(headers.entries()),\n        body,\n        query: Object.fromEntries(searchParams.entries()),\n        cookies: cookiesMap,\n        request,\n        metadata: {},\n    };\n}\n\n/**\n * Build ResponseInterceptorContext\n */\nexport function buildResponseContext(\n    path: string,\n    method: string,\n    requestHeaders: Headers,\n    requestBody: any,\n    response: Response,\n    responseBody: any,\n    requestMetadata: Record<string, any>,\n    cookies: Map<string, string>,\n): ResponseInterceptorContext\n{\n    return {\n        path: `/${path}`,\n        method,\n        request: {\n            headers: Object.fromEntries(requestHeaders.entries()),\n            body: requestBody,\n        },\n        response: {\n            ok: response.ok,\n            status: response.status,\n            statusText: response.statusText,\n            headers: response.headers,\n            body: responseBody,\n        },\n        cookies,\n        setCookies: [],\n        metadata: requestMetadata,\n    };\n}\n","/**\n * RPC-Style Proxy for define-route System\n *\n * Next.js API Route handler that resolves routeName to method/path\n * and forwards requests to SPFN backend.\n *\n * @example\n * ```typescript\n * // app/api/rpc/[routeName]/route.ts\n * import { createRpcProxy } from '@spfn/core/nextjs/server';\n * import { eventRouteMap } from '@spfn/core/event';\n * import { routeMap } from '@/generated/route-map';\n *\n * export const { GET, POST } = createRpcProxy({\n *     routeMap: { ...routeMap, ...eventRouteMap },\n * });\n * ```\n *\n * The generated `routeMap` already holds the routes of every package router the\n * app mounts with `.packages()`, so no package map is merged by hand.\n * `eventRouteMap` is the exception: a hand-written constant, not a mounted\n * router.\n */\nimport { NextRequest, NextResponse } from 'next/server.js';\n\nimport { env } from '@spfn/core/config';\nimport { logger } from '@spfn/core/logger';\nimport type { HttpMethod } from '@spfn/core/route';\n\nimport { signProxyRequest, parseProxyKeySet } from '../../security/proxy-signature';\nimport { buildUrlWithParams, buildQueryString } from '../shared';\nimport { interceptorRegistry } from './interceptors';\nimport { executeRequestInterceptors, executeResponseInterceptors, filterMatchingInterceptors } from './interceptors';\nimport {\n    buildProxyHeaders,\n    parseCookiesFromNextRequest,\n    buildSetCookieHeader,\n    buildErrorResponse,\n    forwardResponseHeaders,\n    parseResponseBody,\n    collectInterceptors,\n    buildRequestContext,\n    buildResponseContext,\n} from './helpers';\nimport type { TypedProxyConfig } from './types';\n\nconst rpcLogger = logger.child('@spfn/core:rpc-proxy');\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/**\n * Route info from generated route map\n */\nexport interface RouteMapEntry\n{\n    method: HttpMethod;\n    path: string;\n}\n\n/**\n * Generated route map type\n */\nexport type RouteMap = Record<string, RouteMapEntry>;\n\n/**\n * RPC proxy configuration\n */\nexport interface RpcProxyConfig extends Omit<TypedProxyConfig, 'onRequest' | 'onResponse'>\n{\n    /**\n     * Route map containing routeName → {method, path} mappings\n     *\n     * The generated map carries the app's own routes and those of every package\n     * router it mounts with `.packages()`. Merge `eventRouteMap` beside it when\n     * the app uses SSE — that one is a constant rather than a mounted router.\n     *\n     * @example\n     * ```typescript\n     * import { eventRouteMap } from '@spfn/core/event';\n     * import { routeMap } from '@/generated/route-map';\n     *\n     * export const { GET, POST } = createRpcProxy({\n     *     routeMap: { ...routeMap, ...eventRouteMap },\n     * });\n     * ```\n     */\n    routeMap: RouteMap;\n\n    /**\n     * Shared secret for signing proxy→backend requests (HMAC-SHA256).\n     *\n     * When set, every forwarded request carries an HMAC signature the backend's\n     * proxy-guard middleware verifies, letting it reject direct-to-backend calls\n     * that bypass this proxy. Set the SAME value here and on the backend.\n     *\n     * @default process.env.SPFN_PROXY_SECRET (undefined → signing disabled)\n     */\n    proxySecret?: string;\n}\n\n// ============================================================================\n// RPC Proxy Handler\n// ============================================================================\n\n/**\n * Create RPC proxy handler for Next.js API Route\n *\n * Handles requests in the format:\n * - GET /api/rpc/{routeName}?input={...}\n * - POST /api/rpc/{routeName} with body\n *\n * Resolves routeName to actual HTTP method and path from routeMap,\n * then forwards to SPFN backend.\n */\nexport function createRpcProxy(config: RpcProxyConfig)\n{\n    const {\n        apiUrl = env.SPFN_API_URL || 'http://localhost:8790',\n        debug = env.NODE_ENV === 'development',\n        timeout = env.RPC_PROXY_TIMEOUT,\n        headers: defaultHeaders = {},\n        interceptors,\n        autoDiscoverInterceptors = true,\n        disableAutoInterceptors,\n        proxySecret = env.SPFN_PROXY_SECRET,\n        routeMap,\n    } = config;\n\n    // Parse the active signing key once — it's fixed for the proxy's lifetime.\n    // Use the SAME parser the backend uses (comma key set) and take the active key,\n    // so a `v2:new,v1:old` secret is interpreted identically on both sides.\n    const proxyKey = proxySecret ? (parseProxyKeySet([proxySecret])[0] ?? null) : null;\n\n    // proxy-guard signs route-relative paths; if SPFN_API_URL carries a base path the\n    // backend keeps (no ingress strip), the signed path won't match c.req.url and\n    // strict mode 403s everything. Warn loudly so it's diagnosable.\n    if (proxyKey)\n    {\n        try\n        {\n            const basePath = new URL(apiUrl).pathname;\n            if (basePath !== '/' && basePath !== '')\n            {\n                rpcLogger.warn(\n                    `SPFN_API_URL has a base path (\"${basePath}\"). proxy-guard signs route-relative paths, `\n                    + 'so the backend must receive paths WITHOUT this prefix (e.g. ingress strip) or strict '\n                    + 'mode will reject all signed requests with 403.',\n                );\n            }\n        }\n        catch\n        {\n            // invalid apiUrl is surfaced elsewhere\n        }\n    }\n\n    /**\n     * Resolve route info from routeMap\n     */\n    function resolveRoute(routeName: string): { method: string; path: string } | null\n    {\n        const entry = routeMap[routeName];\n        if (entry)\n        {\n            return { method: entry.method, path: entry.path };\n        }\n\n        return null;\n    }\n\n    /**\n     * Handle RPC request\n     */\n    async function handleRpc(\n        request: NextRequest,\n        context: { params: Promise<{ routeName?: string }> },\n    ): Promise<NextResponse>\n    {\n        const startTime = Date.now();\n        const params = await context.params;\n\n        try\n        {\n            const routeName = params.routeName;\n\n            if (!routeName)\n            {\n                return NextResponse.json(\n                    buildErrorResponse('Bad Request', 'Missing routeName parameter', debug),\n                    { status: 400 },\n                );\n            }\n\n            // Parse input from query string (GET) or body (POST)\n            let input: {\n                params?: Record<string, any>;\n                query?: Record<string, any>;\n                body?: Record<string, any>;\n                formData?: Record<string, any>;\n                headers?: Record<string, any>;\n                cookies?: Record<string, any>;\n            } = {};\n            let rawFormData: FormData | null = null;\n\n            if (request.method === 'GET')\n            {\n                const inputParam = request.nextUrl.searchParams.get('input');\n                if (inputParam)\n                {\n                    try\n                    {\n                        input = JSON.parse(decodeURIComponent(inputParam));\n                    }\n                    catch\n                    {\n                        return NextResponse.json(\n                            buildErrorResponse('Bad Request', 'Invalid input parameter', debug),\n                            { status: 400 },\n                        );\n                    }\n                }\n            }\n            else\n            {\n                // POST - check Content-Type for formData vs JSON\n                const contentType = request.headers.get('content-type') || '';\n\n                if (contentType.includes('multipart/form-data'))\n                {\n                    // Parse multipart/form-data\n                    try\n                    {\n                        rawFormData = await request.formData();\n\n                        // Extract __metadata if present (contains params, query, etc.)\n                        const metadataStr = rawFormData.get('__metadata');\n                        if (metadataStr && typeof metadataStr === 'string')\n                        {\n                            const metadata = JSON.parse(metadataStr);\n                            input.params = metadata.params;\n                            input.query = metadata.query;\n                            input.headers = metadata.headers;\n                            input.cookies = metadata.cookies;\n                        }\n\n                        // Collect formData fields (excluding __metadata)\n                        input.formData = {};\n                        rawFormData.forEach((value, key) =>\n                        {\n                            if (key === '__metadata') return;\n\n                            const existing = input.formData![key];\n                            if (existing !== undefined)\n                            {\n                                // Multiple values with same key\n                                if (Array.isArray(existing))\n                                {\n                                    existing.push(value);\n                                }\n                                else\n                                {\n                                    input.formData![key] = [existing, value];\n                                }\n                            }\n                            else\n                            {\n                                input.formData![key] = value;\n                            }\n                        });\n                    }\n                    catch (error)\n                    {\n                        return NextResponse.json(\n                            buildErrorResponse('Bad Request', 'Invalid form data', debug),\n                            { status: 400 },\n                        );\n                    }\n                }\n                else\n                {\n                    // Parse JSON body\n                    try\n                    {\n                        input = await request.json();\n                    }\n                    catch\n                    {\n                        return NextResponse.json(\n                            buildErrorResponse('Bad Request', 'Invalid JSON body', debug),\n                            { status: 400 },\n                        );\n                    }\n                }\n            }\n\n            // Resolve route info from routeMap\n            const routeInfo = resolveRoute(routeName);\n\n            if (!routeInfo)\n            {\n                rpcLogger.warn(`Route not found: ${routeName}`);\n\n                return NextResponse.json(\n                    buildErrorResponse('Not Found', `Route \"${routeName}\" not found`, debug),\n                    { status: 404 },\n                );\n            }\n\n            const { method: targetMethod, path: targetPath } = routeInfo;\n\n            // Build target URL with params and query\n            const inputParams = input.params || {};\n            const inputQuery = input.query || {};\n            const inputBody = input.body;\n            const inputFormData = input.formData;\n            const hasFormData = rawFormData !== null && inputFormData && Object.keys(inputFormData).length > 0;\n\n            const resolvedPath = buildUrlWithParams(targetPath, inputParams);\n            const queryString = buildQueryString(inputQuery);\n            const targetUrl = `${apiUrl}${resolvedPath}${queryString}`;\n\n            if (debug)\n            {\n                rpcLogger.debug('→ RPC request', {\n                    routeName,\n                    targetMethod,\n                    targetPath: resolvedPath,\n                    targetUrl,\n                    hasBody: !!inputBody,\n                    hasFormData,\n                });\n            }\n\n            // Build headers\n            const headers = buildProxyHeaders(request.headers, defaultHeaders);\n\n            // Remove Content-Type for formData (let fetch set it with boundary)\n            if (hasFormData)\n            {\n                headers.delete('content-type');\n            }\n\n            // Build fetch options\n            const fetchOptions: RequestInit = {\n                method: targetMethod,\n                headers,\n            };\n\n            // Add body for POST/PUT/PATCH\n            if (['POST', 'PUT', 'PATCH'].includes(targetMethod))\n            {\n                if (hasFormData && rawFormData)\n                {\n                    // Forward formData to backend (rebuild without __metadata)\n                    const forwardFormData = new FormData();\n                    rawFormData.forEach((value, key) =>\n                    {\n                        if (key !== '__metadata')\n                        {\n                            forwardFormData.append(key, value);\n                        }\n                    });\n                    fetchOptions.body = forwardFormData;\n                }\n                else if (inputBody)\n                {\n                    fetchOptions.body = JSON.stringify(inputBody);\n                }\n            }\n\n            // ============================================================\n            // Advanced Interceptors - BEFORE FETCH\n            // ============================================================\n\n            // Collect and filter interceptors\n            const allInterceptors = collectInterceptors(autoDiscoverInterceptors, disableAutoInterceptors, interceptors, interceptorRegistry);\n            const matchingInterceptors = filterMatchingInterceptors(allInterceptors, resolvedPath, targetMethod);\n\n            if (debug && matchingInterceptors.length > 0)\n            {\n                rpcLogger.debug(`Found ${matchingInterceptors.length} matching interceptors for ${targetMethod} ${resolvedPath}`);\n            }\n\n            // Create RequestInterceptorContext\n            const cookiesMap = parseCookiesFromNextRequest(request);\n            const requestCtx = buildRequestContext(\n                resolvedPath.slice(1), // Remove leading slash\n                targetMethod,\n                headers,\n                inputBody,\n                new URLSearchParams(queryString.slice(1)), // Remove leading ?\n                cookiesMap,\n                request,\n            );\n\n            // Execute request interceptors\n            const requestInterceptorsToRun = matchingInterceptors.map(r => r.request).filter((i): i is NonNullable<typeof i> => !!i);\n            if (requestInterceptorsToRun.length > 0)\n            {\n                await executeRequestInterceptors(requestCtx, requestInterceptorsToRun);\n\n                // Apply modified headers\n                for (const [key, value] of Object.entries(requestCtx.headers))\n                {\n                    headers.set(key, value);\n                }\n\n                // Apply modified body\n                if (requestCtx.body)\n                {\n                    fetchOptions.body = JSON.stringify(requestCtx.body);\n                }\n            }\n\n            // An interceptor refused the request (e.g. the CSRF check in @spfn/auth).\n            // Return its response without touching the backend; no response\n            // interceptor runs, so the only cookies a refusal can carry are the\n            // ones the refusing interceptor attached to the abort. The CSRF check\n            // attaches a fresh token there, so the refusal is what repairs the\n            // browser instead of merely reporting the damage.\n            if (requestCtx.abort)\n            {\n                rpcLogger.warn('Request refused by an interceptor', {\n                    routeName,\n                    status: requestCtx.abort.status,\n                });\n\n                const abortResponse = NextResponse.json(\n                    requestCtx.abort.body,\n                    { status: requestCtx.abort.status },\n                );\n\n                for (const cookie of requestCtx.abort.setCookies ?? [])\n                {\n                    abortResponse.headers.append('Set-Cookie', buildSetCookieHeader(cookie));\n                }\n\n                return abortResponse;\n            }\n\n            // ============================================================\n            // Proxy → Backend signature (proxy-guard)\n            // ============================================================\n            // Sign the FINAL request (after interceptors settled body/headers) so\n            // the backend can prove it came through this trusted proxy. JSON body\n            // is hashed into the signature; large multipart uploads are excluded.\n            if (proxyKey)\n            {\n                const signedBody = typeof fetchOptions.body === 'string' ? fetchOptions.body : undefined;\n                // Sign the route-relative path (no SPFN_API_URL base prefix) so it\n                // matches the backend's `new URL(c.req.url).pathname` whether the\n                // prefix is absent or stripped by an ingress. resolvedPath is already\n                // the percent-encoded wire form; queryString is the raw search.\n                const signatureHeaders = signProxyRequest({\n                    key: proxyKey,\n                    method: targetMethod,\n                    path: resolvedPath,\n                    query: queryString,\n                    body: signedBody,\n                });\n\n                for (const [headerName, value] of Object.entries(signatureHeaders))\n                {\n                    headers.set(headerName, value);\n                }\n            }\n\n            // Execute fetch with timeout\n            const controller = new AbortController();\n            const timeoutId = setTimeout(() => controller.abort(), timeout);\n\n            try\n            {\n                const response = await fetch(targetUrl, {\n                    ...fetchOptions,\n                    signal: controller.signal,\n                });\n\n                clearTimeout(timeoutId);\n\n                // Parse response\n                let body = await parseResponseBody(response);\n\n                // ============================================================\n                // Advanced Interceptors - AFTER FETCH\n                // ============================================================\n\n                // Create ResponseInterceptorContext\n                const responseCtx = buildResponseContext(\n                    resolvedPath.slice(1),\n                    targetMethod,\n                    headers,\n                    inputBody,\n                    response,\n                    body,\n                    requestCtx.metadata,\n                    requestCtx.cookies,\n                );\n\n                // Execute response interceptors\n                const responseInterceptorsToRun = matchingInterceptors.map(r => r.response).filter((i): i is NonNullable<typeof i> => !!i);\n                if (responseInterceptorsToRun.length > 0)\n                {\n                    await executeResponseInterceptors(responseCtx, responseInterceptorsToRun);\n                    body = responseCtx.response.body;\n                }\n\n                const duration = Date.now() - startTime;\n\n                if (debug)\n                {\n                    rpcLogger.debug('← RPC response', {\n                        routeName,\n                        status: responseCtx.response.status,\n                        duration: `${duration}ms`,\n                    });\n                }\n\n                // Build Next.js response\n                // 204 No Content should use NextResponse directly, not NextResponse.json()\n                const nextResponse = responseCtx.response.status === 204\n                    ? new NextResponse(null, {\n                        status: 204,\n                        statusText: responseCtx.response.statusText,\n                    })\n                    : NextResponse.json(body, {\n                        status: responseCtx.response.status,\n                        statusText: responseCtx.response.statusText,\n                    });\n\n                // Forward response headers\n                forwardResponseHeaders(response.headers, nextResponse.headers);\n\n                // Apply setCookies from interceptors\n                for (const cookie of responseCtx.setCookies)\n                {\n                    const setCookieHeader = buildSetCookieHeader(cookie);\n                    nextResponse.headers.append('Set-Cookie', setCookieHeader);\n\n                    if (debug)\n                    {\n                        rpcLogger.debug('Set-Cookie header added', {\n                            name: cookie.name,\n                        });\n                    }\n                }\n\n                return nextResponse;\n            }\n            catch (error)\n            {\n                clearTimeout(timeoutId);\n\n                // Handle timeout\n                if (error instanceof Error && error.name === 'AbortError')\n                {\n                    rpcLogger.error('Request timeout', {\n                        routeName,\n                        targetUrl,\n                        timeout,\n                    });\n\n                    return NextResponse.json(\n                        buildErrorResponse('Gateway Timeout', `Request timed out after ${timeout}ms`, debug, error),\n                        { status: 504 },\n                    );\n                }\n\n                // Handle other fetch errors\n                const fetchErr = error as Error;\n                rpcLogger.error('Fetch error', {\n                    routeName,\n                    targetUrl,\n                    error: fetchErr.message,\n                });\n\n                return NextResponse.json(\n                    buildErrorResponse('Bad Gateway', fetchErr.message || 'Failed to connect to backend', debug, fetchErr),\n                    { status: 502 },\n                );\n            }\n        }\n        catch (error)\n        {\n            const duration = Date.now() - startTime;\n            const err = error as Error;\n\n            rpcLogger.error('RPC proxy error', {\n                error: err.message,\n                stack: err.stack,\n                duration: `${duration}ms`,\n            });\n\n            return NextResponse.json(\n                buildErrorResponse('Internal Server Error', err.message || 'Unknown error', debug, err),\n                { status: 500 },\n            );\n        }\n    }\n\n    // Return route handlers\n    return {\n        GET: (req: NextRequest, context: { params: Promise<{ routeName?: string }> }) =>\n            handleRpc(req, context),\n        POST: (req: NextRequest, context: { params: Promise<{ routeName?: string }> }) =>\n            handleRpc(req, context),\n    };\n}\n"]}

package/dist/{types-CxhPH4s_.d.ts → types-CKH0D3Dy.d.ts}

@@ -2,6 +2,25 @@ import { TSchema, Static } from '@sinclair/typebox';
 import { ErrorRegistry, ErrorRegistryInput } from '@spfn/core/errors';
 import { RouteDef, RouteInput } from '@spfn/core/route';
 
+/**
+ * Typed client error
+ *
+ * `errorType` tells apart why a call failed:
+ * - `'http'`: the server answered with a non-2xx status
+ * - `'network'`: the fetch or the body read failed (status 0)
+ * - `'timeout'`: the call's timeout elapsed before response headers arrived (status 408)
+ * - `'aborted'`: the caller's own signal aborted the call (status 0); `cause` is the signal's reason
+ */
+declare class ApiError extends Error {
+    readonly status: number;
+    readonly url: string;
+    readonly response?: unknown | undefined;
+    readonly errorType?: "http" | "network" | "timeout" | "aborted" | undefined;
+    constructor(message: string, status: number, url: string, response?: unknown | undefined, errorType?: "http" | "network" | "timeout" | "aborted" | undefined, options?: {
+        cause?: unknown;
+    });
+}
+
 /**
  * Convert File types in schema to actual File for client usage
  *
@@ -266,6 +285,32 @@ type ResponseInterceptor = (response: Response, body: any) => Promise<{
     response: Response;
     body: any;
 };
+/**
+ * How one call ended, as `ApiConfig.onOutcome` is told it
+ *
+ * - `ok: true`: the server answered 2xx; `response` and `body` are what the response
+ *   interceptors left, and `body` is what the call returns
+ * - `'http'`: the server answered with an error status; `error` is the object the call
+ *   throws — the registered class a `__type` body names (`NotFoundError`,
+ *   `UnauthorizedError`, …) or else an `ApiError`, hence `Error`
+ * - `'network'` / `'timeout'` / `'aborted'`: no answer; `error` is the `ApiError` the call
+ *   throws, `status` its status (0, 408, 0)
+ */
+type ApiOutcome = {
+    ok: true;
+    response: Response;
+    body: unknown;
+} | {
+    ok: false;
+    errorType: 'http';
+    status: number;
+    error: Error;
+} | {
+    ok: false;
+    errorType: 'network' | 'timeout' | 'aborted';
+    status: number;
+    error: ApiError;
+};
 /**
  * Client configuration
  */
@@ -299,6 +344,27 @@ interface ApiConfig {
      * Global response interceptor
      */
     onResponse?: ResponseInterceptor;
+    /**
+     * Told once how each call that reached fetch ended — after the response interceptors
+     * ran, before the call returns or throws
+     *
+     * Observed: a transport failure (`'network'`, `'timeout'`, `'aborted'`) and every
+     * answer, error statuses included; `error` is the very object the call then throws.
+     * Not observed: a throw from an `onRequest` or `onResponse` interceptor, or from
+     * building the request — those are the app's own and reach the caller unchanged.
+     *
+     * Called synchronously and never awaited. A throw from it, or a rejection of the
+     * promise it returns, is logged and never changes what the call returns or throws.
+     * Config only: there is no per-call observer.
+     *
+     * @example
+     * ```typescript
+     * const api = createApi<AppRouter>({
+     *   onOutcome: (outcome) => setServerStatus(outcome.ok ? 'up' : outcome.errorType),
+     * });
+     * ```
+     */
+    onOutcome?: (outcome: ApiOutcome) => void;
     /**
      * Custom error registry for deserialization
      *
@@ -372,4 +438,4 @@ interface CallOptions {
     };
 }
 
-export type { ApiConfig as A, CallOptions as C, ExtractRoutes as E, InferRouteInput as I, RequestInterceptor as R, SetCookie as S, ResponseInterceptor as a, InferRouteOutput as b, CookieOptions as c, RouterInput as d, RouterOutput as e, StructuredInput as f };
+export { type ApiConfig as A, type CallOptions as C, type ExtractRoutes as E, type InferRouteInput as I, type RequestInterceptor as R, type SetCookie as S, type ResponseInterceptor as a, type InferRouteOutput as b, ApiError as c, type ApiOutcome as d, type CookieOptions as e, type RouterInput as f, type RouterOutput as g, type StructuredInput as h };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@spfn/core",
-    "version": "0.3.0-beta.29",
+    "version": "0.3.0-beta.30",
     "description": "Full-stack TypeScript backend for Next.js: file-based typed routes, Drizzle entities and repositories, PostgreSQL transactions and a generated end-to-end client, in one fixed vertical slice per feature",
     "type": "module",
     "exports": {

package/src/nextjs/README.md

@@ -40,7 +40,7 @@ import { createRpcProxy, registerInterceptors } from '@spfn/core/nextjs/server';
 From `@spfn/core/nextjs` (client-safe):
 
 - Values: `createApi`, `ApiError`
-- Types: `Client`, `RouteClient`, `ApiConfig`, `CallOptions`, `InferRouteInput`,
+- Types: `Client`, `RouteClient`, `ApiConfig`, `ApiOutcome`, `CallOptions`, `InferRouteInput`,
   `InferRouteOutput`, `RouterInput`, `RouterOutput`, `StructuredInput`,
   `RequestInterceptor`, `ResponseInterceptor`, `CookieOptions`, `SetCookie`
 
@@ -233,6 +233,7 @@ interface ApiConfig {
     fetch?: typeof fetch;                          // custom fetch impl
     onRequest?: RequestInterceptor;                // global, (url, init) => init
     onResponse?: ResponseInterceptor;              // global, (response, body) => { response, body }
+    onOutcome?: (outcome: ApiOutcome) => void;     // told once how each call that reached fetch ended
     errorRegistry?: ErrorRegistry | ErrorRegistryInput[]; // custom error deserialization
     debug?: boolean;                               // default false
 }
@@ -659,12 +660,79 @@ export async function createUser(formData: FormData) {
   Only a failed fetch (`0` / `'network'`), a timed-out one (`408` / `'timeout'`) and one the
   caller aborted (`0` / `'aborted'`) are.
 
+### How do I learn how every call ended?
+
+Give `createApi` an `onOutcome`. It is told once how each call that reached `fetch` ended,
+before that call returns or throws:
+
+```typescript
+type ApiOutcome =
+    | { ok: true; response: Response; body: unknown }
+    | { ok: false; errorType: 'http'; status: number; error: Error }
+    | { ok: false; errorType: 'network' | 'timeout' | 'aborted'; status: number; error: ApiError };
+```
+
+- **Observed**: every answer — `ok: true` with the `response` and `body` your `onResponse`
+  interceptors left, or `'http'` with the final response's status — and every call that got
+  no answer (`'network'` 0, `'timeout'` 408, `'aborted'` 0).
+- **`error` is the object the call throws**: for `'http'`, the registered class a `__type`
+  body names (`NotFoundError`, `UnauthorizedError`, …) or else an `ApiError`, hence `Error`;
+  for the transport kinds, the `ApiError`.
+- **Not observed**: a throw from an `onRequest` or `onResponse` interceptor (`redirect()`,
+  `notFound()`, your own errors) or from building the request. Those are yours and reach the
+  caller unchanged.
+- **The observer cannot change the call.** It is called synchronously and never awaited; a
+  throw or a rejected promise from it is logged (`onOutcome`, the error's name and message)
+  and the call still returns or throws what it would have.
+- **Config only**: there is no per-call `onOutcome`.
+
+```typescript
+import { createApi } from '@spfn/core/nextjs';
+import type { ApiOutcome } from '@spfn/core/nextjs';
+import { UnauthorizedError } from '@spfn/core/errors';
+
+type ServerStatus = 'up' | 'unreachable' | 'failing' | 'signed-out';
+
+let serverStatus: ServerStatus = 'up';
+
+function statusOf(outcome: ApiOutcome): ServerStatus
+{
+    if (outcome.ok)
+    {
+        return 'up';
+    }
+
+    if (outcome.errorType !== 'http')
+    {
+        return outcome.errorType === 'aborted' ? serverStatus : 'unreachable';
+    }
+
+    if (outcome.error instanceof UnauthorizedError)
+    {
+        return 'signed-out';
+    }
+
+    return outcome.status >= 500 ? 'failing' : 'up';
+}
+
+export const api = createApi<AppRouter>({
+    onOutcome: (outcome) =>
+    {
+        serverStatus = statusOf(outcome);
+    },
+});
+```
+
 ---
 
 ## Types reference
 
 ```typescript
 // client (@spfn/core/nextjs)
+type ApiOutcome =
+    | { ok: true; response: Response; body: unknown }
+    | { ok: false; errorType: 'http'; status: number; error: Error }
+    | { ok: false; errorType: 'network' | 'timeout' | 'aborted'; status: number; error: ApiError };
 type RequestInterceptor  = (url: string, init: RequestInit) => Promise<RequestInit> | RequestInit;
 type ResponseInterceptor = (response: Response, body: any)
     => Promise<{ response: Response; body: any }> | { response: Response; body: any };