@ya-accelerators/nextjs-framework 0.0.100 → 0.0.102

package/dist/lib/next-auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/next-auth/index.ts"],"names":[],"mappings":"AACA,OAAO,mBAAmB,MAAM,iCAAiC,CAAA;AAEjE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AASrC,+EAA+E;AAC/E,+EAA+E;AAC/E,iFAAiF;AACjF,8EAA8E;AAC9E,+DAA+D;AAC/D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAyC,CAAA;AAE1E,MAAM,cAAc,GAAG,CACrB,YAAoB,EACpB,OAAgE,EACjC,EAAE;IACjC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QAC3C,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IACF,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAA;IACtC,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,SAA8E,EAC9E,OAAiE,EACjE,iBAAyE,EACxD,EAAE;IACnB,OAAO;QACL,MAAM,EAAE,gBAAgB,CAAC,eAAe;QACxC,KAAK,EAAE;YACL,MAAM,EAAE,SAAS;SAClB;QACD,OAAO,EAAE;YACP,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YACzB,QAAQ,EAAE,KAAK;SAChB;QACD,SAAS,EAAE;YACT,mBAAmB,CAAC;gBAClB,WAAW,EAAE;oBACX,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;oBACxB,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;oBAC9B,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;iBAC7B;gBACD,KAAK,CAAC,SAAS,CAAC,WAAW;oBACzB,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,OAAO,IAAI,CAAA;oBACb,CAAC;oBACD,IAAI,CAAC;wBACH,uEAAuE;wBACvE,uEAAuE;wBACvE,wEAAwE;wBACxE,IAAI,QAA8B,CAAA;wBAClC,IAAI,WAAW,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;4BAChD,QAAQ,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;wBAC5D,CAAC;6BAAM,IAAI,SAAS,EAAE,CAAC;4BACrB,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;wBACrE,CAAC;wBACD,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACd,OAAO,IAAI,CAAA;wBACb,CAAC;wBACD,OAAO;4BACL,QAAQ;yBACD,CAAA;oBACX,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,uEAAuE;wBACvE,0EAA0E;wBAC1E,qEAAqE;wBACrE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;wBAChD,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC;aACF,CAAC;SACH;QACD,SAAS,EAAE;YACT,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC9B,iGAAiG;gBACjG,iGAAiG;gBACjG,4FAA4F;gBAC5F,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC;oBACjB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;gBAC7B,CAAC;gBACD,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC;oBACjB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;gBAC7B,CAAC;gBACD,OAAO,OAAO,CAAA;YAChB,CAAC;YACD,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;gBAC7B,yEAAyE;gBACzE,qCAAqC;gBACrC,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC;oBACnB,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAA;oBAC7C,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAA;oBAC/C,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAA;oBAC/C,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAA;oBACjC,KAAK,CAAC,KAAK,GAAG,SAAS,CAAA;oBACvB,OAAO,KAAK,CAAA;gBACd,CAAC;gBACD,sEAAsE;gBACtE,mEAAmE;gBACnE,uEAAuE;gBACvE,uEAAuE;gBACvE,qEAAqE;gBACrE,kBAAkB;gBAClB,IACE,OAAO;oBACP,KAAK,CAAC,YAAY;oBAClB,KAAK,CAAC,YAAY;oBAClB,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,YAAY,GAAG,aAAa,CAAC,kBAAkB,EAC1E,CAAC;oBACD,IAAI,CAAC;wBACH,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;wBACnE,IAAI,CAAC,SAAS,EAAE,CAAC;4BACf,OAAO,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAA;wBAChF,CAAC;wBACD,OAAO;4BACL,GAAG,KAAK;4BACR,WAAW,EAAE,SAAS,CAAC,WAAW;4BAClC,YAAY,EAAE,SAAS,CAAC,YAAY;4BACpC,YAAY,EAAE,SAAS,CAAC,YAAY;4BACpC,KAAK,EAAE,SAAS,CAAC,KAAK;4BACtB,KAAK,EAAE,SAAS;yBACjB,CAAA;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAA;wBAC9C,OAAO,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAA;oBAChF,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC;YACD,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC7B,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,OAAO,GAAG,OAAO,GAAG,GAAG,EAAE,CAAA;gBAC3B,CAAC;gBACD,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAA;gBAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;gBACxE,OAAO,QAAQ,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;YACpF,CAAC;SACF;KACF,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/next-auth/index.ts"],"names":[],"mappings":"AACA,OAAO,mBAAmB,MAAM,iCAAiC,CAAA;AAEjE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AASrC,+EAA+E;AAC/E,+EAA+E;AAC/E,iFAAiF;AACjF,8EAA8E;AAC9E,+DAA+D;AAC/D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAyC,CAAA;AAE1E,MAAM,cAAc,GAAG,CACrB,YAAoB,EACpB,OAAgE,EACjC,EAAE;IACjC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QAC3C,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IACF,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAA;IACtC,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,SAA8E,EAC9E,OAAiE,EACjE,iBAAyE,EACxD,EAAE;IACnB,OAAO;QACL,MAAM,EAAE,gBAAgB,CAAC,eAAe;QACxC,KAAK,EAAE;YACL,MAAM,EAAE,SAAS;SAClB;QACD,OAAO,EAAE;YACP,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YACzB,QAAQ,EAAE,KAAK;SAChB;QACD,SAAS,EAAE;YACT,mBAAmB,CAAC;gBAClB,WAAW,EAAE;oBACX,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;oBACxB,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;oBAC9B,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;iBAC7B;gBACD,KAAK,CAAC,SAAS,CAAC,WAAW;oBACzB,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,OAAO,IAAI,CAAA;oBACb,CAAC;oBACD,IAAI,CAAC;wBACH,IAAI,QAA8B,CAAA;wBAClC,IAAI,WAAW,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;4BAChD,QAAQ,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;wBAC5D,CAAC;6BAAM,IAAI,SAAS,EAAE,CAAC;4BACrB,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;wBACrE,CAAC;wBACD,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACd,OAAO,IAAI,CAAA;wBACb,CAAC;wBACD,OAAO;4BACL,QAAQ;yBACD,CAAA;oBACX,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;wBAChD,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC;aACF,CAAC;SACH;QACD,SAAS,EAAE;YACT,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC9B,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC;oBACjB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;gBAC7B,CAAC;gBACD,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC;oBACjB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;gBAC7B,CAAC;gBACD,OAAO,OAAO,CAAA;YAChB,CAAC;YACD,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;gBAC7B,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC;oBACnB,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAA;oBAC7C,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAA;oBAC/C,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAA;oBAC/C,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAA;oBACjC,KAAK,CAAC,KAAK,GAAG,SAAS,CAAA;oBACvB,OAAO,KAAK,CAAA;gBACd,CAAC;gBACD,sEAAsE;gBACtE,mEAAmE;gBACnE,uEAAuE;gBACvE,uEAAuE;gBACvE,qEAAqE;gBACrE,kBAAkB;gBAClB,IACE,OAAO;oBACP,KAAK,CAAC,YAAY;oBAClB,KAAK,CAAC,YAAY;oBAClB,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,YAAY,GAAG,aAAa,CAAC,kBAAkB,EAC1E,CAAC;oBACD,IAAI,CAAC;wBACH,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;wBACnE,IAAI,CAAC,SAAS,EAAE,CAAC;4BACf,OAAO,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAA;wBAChF,CAAC;wBACD,OAAO;4BACL,GAAG,KAAK;4BACR,WAAW,EAAE,SAAS,CAAC,WAAW;4BAClC,YAAY,EAAE,SAAS,CAAC,YAAY;4BACpC,YAAY,EAAE,SAAS,CAAC,YAAY;4BACpC,KAAK,EAAE,SAAS,CAAC,KAAK;4BACtB,KAAK,EAAE,SAAS;yBACjB,CAAA;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAA;wBAC9C,OAAO,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAA;oBAChF,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC;YACD,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC7B,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,OAAO,GAAG,OAAO,GAAG,GAAG,EAAE,CAAA;gBAC3B,CAAC;gBACD,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAA;gBAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;gBACxE,OAAO,QAAQ,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;YACpF,CAAC;SACF;KACF,CAAA;AACH,CAAC,CAAA"}

package/dist/lib/trpc/index.d.ts

@@ -2,7 +2,8 @@ import type { HTTPHeaders } from '@trpc/client';
 export declare const setHeaderValues: (headers: HTTPHeaders, options?: {
     httpOnly?: boolean;
     secure?: boolean;
-    sameSite?: "strict" | "lax" | "none";
+    sameSite?: 'strict' | 'lax' | 'none';
     maxAge?: number;
 }) => Promise<void>;
-export declare const mergeDefaultHeaders: (extra?: HTTPHeaders) => Promise<HTTPHeaders>;
+export declare const mergeDefaultHeaders: (extra: HTTPHeaders | undefined, allowed: readonly string[]) => Promise<HTTPHeaders>;
+export declare const mergeServerHeaders: (extra: HTTPHeaders | undefined, allowed: readonly string[]) => Promise<HTTPHeaders>;

package/dist/lib/trpc/index.js

@@ -6,13 +6,32 @@ export const setHeaderValues = async (headers, options) => setCookieValue('heade
 // The real authorization is applied server-side from the JWT (getToken) below.
 const SENSITIVE_HEADER_NAMES = new Set([
     'authorization',
+    'proxy-authorization',
     'cookie',
     'x-forwarded-for',
     'x-forwarded-host',
     'x-forwarded-proto',
     'x-real-ip',
+    'user-agent',
+    'host',
+    'content-type',
+    'content-length',
 ]);
-const createDefaultHeaders = async (defaultHeaders = {}) => {
+const pickAllowedHeaders = (headers, allowed) => {
+    const admitted = allowed.map((name) => name.trim().toLowerCase());
+    const picked = {};
+    for (const [key, value] of Object.entries(headers)) {
+        const name = key.toLowerCase();
+        if (SENSITIVE_HEADER_NAMES.has(name)) {
+            continue;
+        }
+        if (admitted.includes(name)) {
+            picked[key] = value;
+        }
+    }
+    return picked;
+};
+const createDefaultHeaders = async (extra, allowed, own) => {
     let baseHeaders = {};
     let authorization;
     if (typeof window === 'undefined') {
@@ -20,7 +39,7 @@ const createDefaultHeaders = async (defaultHeaders = {}) => {
         const headersList = await nextHeaders();
         baseHeaders = { 'user-agent': headersList.get('user-agent') || 'unknown' };
         // Read the access token from the server-side JWT (getToken decodes the same session cookie
-        // getServerSession does) rather than the session — the session no longer carries the bearer, so it is
+        // getServerSession does) rather than the session — the session does not carry the bearer, so it is
         // never exposed to client JS. Do NOT refresh here: the RSC / server-action path cannot persist a
         // rotated session cookie, so an inline refresh consumes a (possibly rotating) refresh token out of
         // band and poisons the next-auth jwt-callback refresh (which is the only place that can persist the
@@ -40,22 +59,31 @@ const createDefaultHeaders = async (defaultHeaders = {}) => {
     if (headersCookie) {
         try {
             const parsedHeaders = JSON.parse(headersCookie);
-            for (const [key, value] of Object.entries(parsedHeaders)) {
-                if (!SENSITIVE_HEADER_NAMES.has(key.toLowerCase())) {
-                    savedHeaders[key] = value;
-                }
+            for (const [key, value] of Object.entries(pickAllowedHeaders(parsedHeaders, allowed))) {
+                savedHeaders[key] = value;
             }
         }
-        catch {
-            // Ignore if JSON parse fails
-        }
+        catch { }
     }
     return {
         ...baseHeaders,
         ...savedHeaders,
         ...(authorization ? { authorization } : {}),
-        ...defaultHeaders,
+        ...(own ? extra : pickAllowedHeaders(extra, allowed)),
     };
 };
-export const mergeDefaultHeaders = async (extra) => createDefaultHeaders(extra);
+// Which function the call site picks is what says whether the bag is the caller's or the server's own.
+// Both take the allow-list, so the browser-held `headers` cookie is narrowed by it on either path.
+export const mergeDefaultHeaders = async (extra, allowed) => {
+    if (allowed === undefined) {
+        throw new Error('mergeDefaultHeaders requires the allowedConsumerHeaders the generated client carries as its second argument. Reaching this means a generated client was built before that export existed; treating the bag as unrestricted would put caller-controlled headers on the request.');
+    }
+    return createDefaultHeaders(extra ?? {}, allowed, false);
+};
+export const mergeServerHeaders = async (extra, allowed) => {
+    if (allowed === undefined) {
+        throw new Error('mergeServerHeaders requires the allowedConsumerHeaders the generated client carries as its second argument: the bag it is given is unfiltered, and the cookie-held one is narrowed by that list.');
+    }
+    return createDefaultHeaders(extra ?? {}, allowed, true);
+};
 //# sourceMappingURL=index.js.map

package/dist/lib/trpc/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/trpc/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE1D,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,OAAoB,EACpB,OAKC,EACD,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAA;AAEhE,+FAA+F;AAC/F,qGAAqG;AACrG,+EAA+E;AAC/E,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,eAAe;IACf,QAAQ;IACR,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;IACnB,WAAW;CACZ,CAAC,CAAA;AAEF,MAAM,oBAAoB,GAAG,KAAK,EAAE,iBAA8B,EAAE,EAAwB,EAAE;IAC5F,IAAI,WAAW,GAAgB,EAAE,CAAA;IACjC,IAAI,aAAiC,CAAA;IAErC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAA;QAC7D,MAAM,WAAW,GAAG,MAAM,WAAW,EAAE,CAAA;QACvC,WAAW,GAAG,EAAE,YAAY,EAAE,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,EAAE,CAAA;QAC1E,2FAA2F;QAC3F,sGAAsG;QACtG,iGAAiG;QACjG,mGAAmG;QACnG,oGAAoG;QACpG,0FAA0F;QAC1F,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAA;QAClD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAA;QACnD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC;YAC3B,GAAG,EAAE,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YAClG,MAAM,EAAE,gBAAgB,CAAC,eAAe;SACzC,CAAC,CAAA;QACF,IAAI,KAAK,EAAE,WAAW,EAAE,CAAC;YACvB,aAAa,GAAG,UAAU,KAAK,CAAC,WAAW,EAAE,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAgB,EAAE,CAAA;IACpC,MAAM,aAAa,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAA;IACrD,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAA2B,CAAA;YACzE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;gBACzD,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;oBACnD,YAAY,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,WAAW;QACd,GAAG,YAAY;QACf,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,cAAc;KAClB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,KAAmB,EAAwB,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/trpc/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE1D,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,OAAoB,EACpB,OAKC,EACD,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAA;AAEhE,+FAA+F;AAC/F,qGAAqG;AACrG,+EAA+E;AAC/E,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,eAAe;IACf,qBAAqB;IACrB,QAAQ;IACR,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;IACnB,WAAW;IACX,YAAY;IACZ,MAAM;IACN,cAAc;IACd,gBAAgB;CACjB,CAAC,CAAA;AAEF,MAAM,kBAAkB,GAAG,CAAC,OAAoB,EAAE,OAA0B,EAAe,EAAE;IAC3F,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;IACjE,MAAM,MAAM,GAAgB,EAAE,CAAA;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;QAC9B,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,SAAQ;QACV,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QACrB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,oBAAoB,GAAG,KAAK,EAChC,KAAkB,EAClB,OAA0B,EAC1B,GAAY,EACU,EAAE;IACxB,IAAI,WAAW,GAAgB,EAAE,CAAA;IACjC,IAAI,aAAiC,CAAA;IAErC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAA;QAC7D,MAAM,WAAW,GAAG,MAAM,WAAW,EAAE,CAAA;QACvC,WAAW,GAAG,EAAE,YAAY,EAAE,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,EAAE,CAAA;QAC1E,2FAA2F;QAC3F,mGAAmG;QACnG,iGAAiG;QACjG,mGAAmG;QACnG,oGAAoG;QACpG,0FAA0F;QAC1F,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAA;QAClD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAA;QACnD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC;YAC3B,GAAG,EAAE,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YAClG,MAAM,EAAE,gBAAgB,CAAC,eAAe;SACzC,CAAC,CAAA;QACF,IAAI,KAAK,EAAE,WAAW,EAAE,CAAC;YACvB,aAAa,GAAG,UAAU,KAAK,CAAC,WAAW,EAAE,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAgB,EAAE,CAAA;IACpC,MAAM,aAAa,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAA;IACrD,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAA2B,CAAA;YACzE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;gBACtF,YAAY,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YAC3B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,OAAO;QACL,GAAG,WAAW;QACd,GAAG,YAAY;QACf,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;KACtD,CAAA;AACH,CAAC,CAAA;AAED,uGAAuG;AACvG,mGAAmG;AACnG,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,KAA8B,EAC9B,OAA0B,EACJ,EAAE;IACxB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,gRAAgR,CACjR,CAAA;IACH,CAAC;IACD,OAAO,oBAAoB,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;AAC1D,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,KAA8B,EAC9B,OAA0B,EACJ,EAAE;IACxB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,kMAAkM,CACnM,CAAA;IACH,CAAC;IACD,OAAO,oBAAoB,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;AACzD,CAAC,CAAA"}

package/dist/lib/uploads/index.js

@@ -1,17 +1,5 @@
 import { logger } from '../../logger';
-// Same-origin upload relay. The browser POSTs the file bytes to the app's own origin and this route
-// forwards them to the backend's `/_uploads` sink: the one-time token and the target URL are resolved
-// server-side by `uploadAction`, so the token never reaches the browser and the page never makes a
-// cross-origin request (no CORS preflight, and no mixed content when the page is served over https while
-// the backend is plain http in dev). The destination is not caller-supplied, so this is not an open relay.
 export const createUploadRoute = (uploadAction) => async (request) => {
-    // Unlike a Server Action, a route handler gets no framework CSRF protection, and this one is
-    // cookie-authenticated: without this check an attacker's page could POST a body cross-site and have the
-    // victim's session mint a token and store the object. Two accept conditions, because neither covers both
-    // deployments on its own: `Sec-Fetch-Site` is browser-set and a forbidden header name (unforgeable) but
-    // is only attached to trustworthy origins, so it is absent on the plain-http dev hosts; the Origin/Host
-    // comparison covers those, and compares against `Host` alone — `x-forwarded-host` is caller-settable, so
-    // trusting it would let an attacker match its own Origin.
     const origin = request.headers.get('origin');
     if (request.headers.get('sec-fetch-site') !== 'same-origin' &&
         (origin === null || URL.parse(origin)?.host !== request.headers.get('host'))) {
@@ -36,14 +24,9 @@ export const createUploadRoute = (uploadAction) => async (request) => {
         method: 'POST',
         headers: {
             authorization: `Bearer ${token}`,
-            // Forwarded only when present — the backend falls back to its own default name for an absent header,
-            // but an empty string would be taken as the real filename.
             ...(filename === null ? {} : { 'x-upload-filename': filename }),
             'content-type': request.headers.get('content-type') ?? 'application/octet-stream',
         },
-        // The body is buffered rather than streamed: passing `request.body` through requires the
-        // `duplex: 'half'` init option, which the DOM `RequestInit` type Next.js compiles against does not
-        // declare. The backend caps a single upload at its own ceiling, so the buffer stays bounded.
         body: await request.arrayBuffer(),
     }).catch((error) => {
         logger.error('upload', { url, error });

package/dist/lib/uploads/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/uploads/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,oGAAoG;AACpG,sGAAsG;AACtG,mGAAmG;AACnG,yGAAyG;AACzG,2GAA2G;AAC3G,MAAM,CAAC,MAAM,iBAAiB,GAC5B,CAAC,YAA2D,EAAE,EAAE,CAAC,KAAK,EAAE,OAAgB,EAAE,EAAE;IAC1F,6FAA6F;IAC7F,wGAAwG;IACxG,yGAAyG;IACzG,wGAAwG;IACxG,wGAAwG;IACxG,yGAAyG;IACzG,0DAA0D;IAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,IACE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,aAAa;QACvD,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAC5E,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,EAAE;YAC7E,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IACzD,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAClD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACjC,OAAO,SAAS,CAAA;IAClB,CAAC,CAAC,CAAA;IACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,EAAE;YACjF,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,qGAAqG;YACrG,2DAA2D;YAC3D,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,QAAQ,EAAE,CAAC;YAC/D,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,0BAA0B;SAClF;QACD,yFAAyF;QACzF,mGAAmG;QACnG,6FAA6F;QAC7F,IAAI,EAAE,MAAM,OAAO,CAAC,WAAW,EAAE;KAClC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACjB,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;QACtC,OAAO,SAAS,CAAA;IAClB,CAAC,CAAC,CAAA;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,EAAE;YAC3E,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,iGAAiG;QACjG,oGAAoG;QACpG,oGAAoG;QACpG,mGAAmG;QACnG,kEAAkE;QAClE,IAAI,QAA8B,CAAA;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACxC,QAAQ,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5F,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,SAAS,CAAA;QACtB,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IACxF,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;AACzG,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/uploads/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,MAAM,CAAC,MAAM,iBAAiB,GAC5B,CAAC,YAA2D,EAAE,EAAE,CAAC,KAAK,EAAE,OAAgB,EAAE,EAAE;IAC1F,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,IACE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,aAAa;QACvD,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAC5E,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,EAAE;YAC7E,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IACzD,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAClD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACjC,OAAO,SAAS,CAAA;IAClB,CAAC,CAAC,CAAA;IACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,EAAE;YACjF,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,QAAQ,EAAE,CAAC;YAC/D,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,0BAA0B;SAClF;QACD,IAAI,EAAE,MAAM,OAAO,CAAC,WAAW,EAAE;KAClC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACjB,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;QACtC,OAAO,SAAS,CAAA;IAClB,CAAC,CAAC,CAAA;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,EAAE;YAC3E,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,iGAAiG;QACjG,oGAAoG;QACpG,oGAAoG;QACpG,mGAAmG;QACnG,kEAAkE;QAClE,IAAI,QAA8B,CAAA;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACxC,QAAQ,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5F,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,SAAS,CAAA;QACtB,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IACxF,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;AACzG,CAAC,CAAA"}

package/dist/logger/index.d.ts

@@ -5,8 +5,9 @@ declare const LEVEL_ORDER: {
     readonly error: 40;
 };
 type LogLevel = keyof typeof LEVEL_ORDER;
+declare const enabled: (level: LogLevel) => boolean;
 export declare const logger: {
-    enabled: (level: LogLevel) => boolean;
+    enabled: typeof enabled;
     debug: (tag: string, payload: Record<string, unknown>) => void;
     info: (tag: string, payload: Record<string, unknown>) => void;
     warn: (tag: string, payload: Record<string, unknown>) => void;

package/dist/logger/index.js

@@ -11,8 +11,6 @@ const getThreshold = () => {
     return defaultClientEnv.NEXT_PUBLIC_LOG_LEVEL ?? DEFAULT_BY_DEPLOY_ENV[defaultClientEnv.NEXT_PUBLIC_DEPLOY_ENV];
 };
 const enabled = (level) => LEVEL_ORDER[level] >= LEVEL_ORDER[getThreshold()];
-// Service identifier: host on both sides (no env var). Falls back to 'unknown' when
-// `os.hostname()` is unavailable (e.g. Edge runtime in middleware).
 const getService = () => {
     if (isServer) {
         try {
@@ -24,10 +22,6 @@ const getService = () => {
     }
     return window.location.host;
 };
-// Path: auto-injected on client from `window.location.pathname`. Not auto-injected on
-// server side in v1 — Next.js middleware can't wrap downstream calls in AsyncLocalStorage
-// the way Express middleware does, and `headers()` is async (would force the logger API
-// to be async). Server callers include `path` in `payload` when relevant.
 const getAutoPath = () => (isServer ? undefined : window.location.pathname);
 const isDevFormat = () => isServer ? defaultServerEnv.NODE_ENV === 'development' : defaultClientEnv.NEXT_PUBLIC_DEPLOY_ENV === 'dev';
 const emit = (level, tag, payload) => {

package/dist/logger/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/logger/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAA;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAA;AAEpC,MAAM,WAAW,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAW,CAAA;AAGzE,MAAM,QAAQ,GAAG,OAAO,MAAM,KAAK,WAAW,CAAA;AAE9C,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAW,CAAA;AAEjF,MAAM,YAAY,GAAG,GAAa,EAAE;IAClC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,gBAAgB,CAAC,SAAS,IAAI,qBAAqB,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAA;IACzF,CAAC;IACD,OAAO,gBAAgB,CAAC,qBAAqB,IAAI,qBAAqB,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAA;AACjH,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,KAAe,EAAW,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC,CAAA;AAE/F,oFAAoF;AACpF,oEAAoE;AACpE,MAAM,UAAU,GAAG,GAAW,EAAE;IAC9B,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,OAAQ,OAAO,CAAC,SAAS,CAAmB,CAAC,QAAQ,EAAE,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAA;AAC7B,CAAC,CAAA;AAED,sFAAsF;AACtF,0FAA0F;AAC1F,wFAAwF;AACxF,0EAA0E;AAC1E,MAAM,WAAW,GAAG,GAAuB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAE/F,MAAM,WAAW,GAAG,GAAY,EAAE,CAChC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,sBAAsB,KAAK,KAAK,CAAA;AAE5G,MAAM,IAAI,GAAG,CAAC,KAAe,EAAE,GAAW,EAAE,OAAgC,EAAE,EAAE;IAC9E,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAM;IACR,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC3B,KAAK;QACL,OAAO,EAAE,UAAU,EAAE;QACrB,GAAG;QACH,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACrD,GAAG,OAAO;KACX,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACxF,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC;SAAM,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACtB,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,OAAO;IACP,KAAK,EAAE,CAAC,GAAW,EAAE,OAAgC,EAAE,EAAE;QACvD,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC7B,CAAC;IACD,IAAI,EAAE,CAAC,GAAW,EAAE,OAAgC,EAAE,EAAE;QACtD,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC5B,CAAC;IACD,IAAI,EAAE,CAAC,GAAW,EAAE,OAAgC,EAAE,EAAE;QACtD,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC5B,CAAC;IACD,KAAK,EAAE,CAAC,GAAW,EAAE,OAAgC,EAAE,EAAE;QACvD,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC7B,CAAC;IACD,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE;QAC1B,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,QAAQ,OAAO,OAAO,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/logger/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAA;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAA;AAEpC,MAAM,WAAW,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAW,CAAA;AAGzE,MAAM,QAAQ,GAAG,OAAO,MAAM,KAAK,WAAW,CAAA;AAE9C,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAW,CAAA;AAEjF,MAAM,YAAY,GAAG,GAAa,EAAE;IAClC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,gBAAgB,CAAC,SAAS,IAAI,qBAAqB,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAA;IACzF,CAAC;IACD,OAAO,gBAAgB,CAAC,qBAAqB,IAAI,qBAAqB,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAA;AACjH,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,KAAe,EAAW,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC,CAAA;AAE/F,MAAM,UAAU,GAAG,GAAW,EAAE;IAC9B,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,OAAQ,OAAO,CAAC,SAAS,CAAmB,CAAC,QAAQ,EAAE,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAA;AAC7B,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,GAAuB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAE/F,MAAM,WAAW,GAAG,GAAY,EAAE,CAChC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,sBAAsB,KAAK,KAAK,CAAA;AAE5G,MAAM,IAAI,GAAG,CAAC,KAAe,EAAE,GAAW,EAAE,OAAgC,EAAE,EAAE;IAC9E,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAM;IACR,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC3B,KAAK;QACL,OAAO,EAAE,UAAU,EAAE;QACrB,GAAG;QACH,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACrD,GAAG,OAAO;KACX,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACxF,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC;SAAM,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACtB,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,OAAO;IACP,KAAK,EAAE,CAAC,GAAW,EAAE,OAAgC,EAAE,EAAE;QACvD,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC7B,CAAC;IACD,IAAI,EAAE,CAAC,GAAW,EAAE,OAAgC,EAAE,EAAE;QACtD,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC5B,CAAC;IACD,IAAI,EAAE,CAAC,GAAW,EAAE,OAAgC,EAAE,EAAE;QACtD,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC5B,CAAC;IACD,KAAK,EAAE,CAAC,GAAW,EAAE,OAAgC,EAAE,EAAE;QACvD,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC7B,CAAC;IACD,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE;QAC1B,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,QAAQ,OAAO,OAAO,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;CACF,CAAA"}

package/dist/styles/globals.css

@@ -24,3 +24,80 @@
     @apply cursor-pointer hover:opacity-80 disabled:cursor-default disabled:opacity-50;
   }
 }
+
+@layer components {
+  .hljs {
+    color: light-dark(#24292f, #c9d1d9);
+  }
+  .hljs-doctag,
+  .hljs-keyword,
+  .hljs-meta .hljs-keyword,
+  .hljs-template-tag,
+  .hljs-template-variable,
+  .hljs-type,
+  .hljs-variable.language_ {
+    color: light-dark(#cf222e, #ff7b72);
+  }
+  .hljs-title,
+  .hljs-title.class_,
+  .hljs-title.class_.inherited__,
+  .hljs-title.function_ {
+    color: light-dark(#8250df, #d2a8ff);
+  }
+  .hljs-attr,
+  .hljs-attribute,
+  .hljs-literal,
+  .hljs-meta,
+  .hljs-number,
+  .hljs-operator,
+  .hljs-selector-attr,
+  .hljs-selector-class,
+  .hljs-selector-id,
+  .hljs-variable {
+    color: light-dark(#0550ae, #79c0ff);
+  }
+  .hljs-meta .hljs-string,
+  .hljs-regexp,
+  .hljs-string {
+    color: light-dark(#0a3069, #a5d6ff);
+  }
+  .hljs-built_in,
+  .hljs-symbol {
+    color: light-dark(#953800, #ffa657);
+  }
+  .hljs-code,
+  .hljs-comment,
+  .hljs-formula {
+    color: light-dark(#6e7781, #8b949e);
+  }
+  .hljs-name,
+  .hljs-quote,
+  .hljs-selector-pseudo,
+  .hljs-selector-tag {
+    color: light-dark(#116329, #7ee787);
+  }
+  .hljs-subst {
+    color: light-dark(#24292f, #c9d1d9);
+  }
+  .hljs-section {
+    color: light-dark(#0550ae, #1f6feb);
+    font-weight: bold;
+  }
+  .hljs-bullet {
+    color: light-dark(#953800, #f2cc60);
+  }
+  .hljs-emphasis {
+    font-style: italic;
+  }
+  .hljs-strong {
+    font-weight: bold;
+  }
+  .hljs-addition {
+    color: light-dark(#116329, #aff5b4);
+    background-color: light-dark(#dafbe1, #033a16);
+  }
+  .hljs-deletion {
+    color: light-dark(#82071e, #ffdcd7);
+    background-color: light-dark(#ffebe9, #67060c);
+  }
+}