@atlasauth/nextjs 0.1.2 → 0.1.4

package/dist/matcher.d.ts

@@ -21,6 +21,21 @@
  */
 export declare function matchesPattern(pathname: string, pattern: string): boolean;
 export declare function matchesAny(pathname: string, patterns: readonly string[]): boolean;
+/**
+ * §10.1 Clerk-parity `createRouteMatcher(patterns)` — the idiom integrators write
+ * at the top of `middleware.ts` (`const isProtected = createRouteMatcher(['/dashboard(.*)'])`).
+ * Returns a predicate over anything carrying a pathname: a Next `NextRequest`
+ * (`req.nextUrl.pathname`), a plain `{ nextUrl }` / `{ url }`, or a bare path
+ * string. Uses the SAME `(.*)`-only pattern engine as the middleware, so a
+ * matcher written here and the middleware's own routing agree exactly (no second
+ * dialect, no customer regex in the auth path).
+ */
+export declare function createRouteMatcher(patterns: readonly string[]): (input: string | {
+    nextUrl?: {
+        pathname?: string;
+    };
+    url?: string;
+}) => boolean;
 export declare function isStaticAsset(pathname: string): boolean;
 export interface MiddlewareConfig {
     /** Routes reachable without a session. Everything else requires one. */

package/dist/matcher.js

@@ -16,6 +16,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_SIGN_IN_URL = void 0;
 exports.matchesPattern = matchesPattern;
 exports.matchesAny = matchesAny;
+exports.createRouteMatcher = createRouteMatcher;
 exports.isStaticAsset = isStaticAsset;
 exports.decideRoute = decideRoute;
 exports.safeRedirect = safeRedirect;
@@ -40,6 +41,29 @@ function matchesPattern(pathname, pattern) {
 function matchesAny(pathname, patterns) {
     return patterns.some((pattern) => matchesPattern(pathname, pattern));
 }
+/**
+ * §10.1 Clerk-parity `createRouteMatcher(patterns)` — the idiom integrators write
+ * at the top of `middleware.ts` (`const isProtected = createRouteMatcher(['/dashboard(.*)'])`).
+ * Returns a predicate over anything carrying a pathname: a Next `NextRequest`
+ * (`req.nextUrl.pathname`), a plain `{ nextUrl }` / `{ url }`, or a bare path
+ * string. Uses the SAME `(.*)`-only pattern engine as the middleware, so a
+ * matcher written here and the middleware's own routing agree exactly (no second
+ * dialect, no customer regex in the auth path).
+ */
+function createRouteMatcher(patterns) {
+    return (input) => {
+        let pathname;
+        if (typeof input === 'string') {
+            // Accept a full URL or a bare path.
+            pathname = input.startsWith('http') ? new URL(input).pathname : input;
+        }
+        else {
+            pathname =
+                input.nextUrl?.pathname ?? (input.url ? new URL(input.url, 'http://x').pathname : '');
+        }
+        return matchesAny(pathname, patterns);
+    };
+}
 /**
  * Paths that are never auth decisions.
  *

package/dist/matcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"matcher.js","sourceRoot":"","sources":["../src/matcher.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAUH,wCASC;AAED,gCAEC;AAWD,sCAKC;AA4BD,kCA4BC;AASD,oCAiBC;AAvHD;;;;;;;GAOG;AACH,SAAgB,cAAc,CAAC,QAAgB,EAAE,OAAe;IAC9D,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAElC,0EAA0E;IAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC1C,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,SAAgB,UAAU,CAAC,QAAgB,EAAE,QAA2B;IACtE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;AAEnG,SAAgB,aAAa,CAAC,QAAgB;IAC5C,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,gDAAgD;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAYY,QAAA,mBAAmB,GAAG,UAAU,CAAC;AAQ9C;;;;;;;GAOG;AACH,SAAgB,WAAW,CAAC,KAM3B;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAElC,IAAI,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE7D,MAAM,mBAAmB,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,CAAC,mBAAmB,IAAI,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAE/F,IAAI,QAAQ,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAE3D;;;;OAIG;IACH,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAExD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,2BAAmB,CAAC;IAC1D,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,EAAE,EAAE,GAAG,SAAS,iBAAiB,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;KACtE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,YAAY,CAC1B,WAAsC,EACtC,iBAAoC,EAAE,EACtC,QAAQ,GAAG,GAAG;IAEd,IAAI,CAAC,WAAW;QAAE,OAAO,QAAQ,CAAC;IAElC,yEAAyE;IACzE,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClD,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,OAAO,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC"}
+{"version":3,"file":"matcher.js","sourceRoot":"","sources":["../src/matcher.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAUH,wCASC;AAED,gCAEC;AAWD,gDAcC;AAWD,sCAKC;AA4BD,kCA4BC;AASD,oCAiBC;AAhJD;;;;;;;GAOG;AACH,SAAgB,cAAc,CAAC,QAAgB,EAAE,OAAe;IAC9D,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAElC,0EAA0E;IAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC1C,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,SAAgB,UAAU,CAAC,QAAgB,EAAE,QAA2B;IACtE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,kBAAkB,CAChC,QAA2B;IAE3B,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,IAAI,QAAgB,CAAC;QACrB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,oCAAoC;YACpC,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,QAAQ;gBACN,KAAK,CAAC,OAAO,EAAE,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;AAEnG,SAAgB,aAAa,CAAC,QAAgB;IAC5C,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,gDAAgD;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAYY,QAAA,mBAAmB,GAAG,UAAU,CAAC;AAQ9C;;;;;;;GAOG;AACH,SAAgB,WAAW,CAAC,KAM3B;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAElC,IAAI,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE7D,MAAM,mBAAmB,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,CAAC,mBAAmB,IAAI,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAE/F,IAAI,QAAQ,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAE3D;;;;OAIG;IACH,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAExD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,2BAAmB,CAAC;IAC1D,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,EAAE,EAAE,GAAG,SAAS,iBAAiB,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;KACtE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,YAAY,CAC1B,WAAsC,EACtC,iBAAoC,EAAE,EACtC,QAAQ,GAAG,GAAG;IAEd,IAAI,CAAC,WAAW;QAAE,OAAO,QAAQ,CAAC;IAElC,yEAAyE;IACzE,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClD,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,OAAO,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,80 @@
+/**
+ * `@atlasauth/nextjs/server` — the pre-bound, zero-argument App-Router helpers.
+ *
+ * §Q7 gap: the base entry ships FACTORIES (`createAuthHelper`,
+ * `createCurrentUserHelper`) that the integrator wires once and then feeds an
+ * `EdgeRequest` on every call. Clerk instead ships `auth()` / `currentUser()`
+ * that read the ambient request from `next/headers` with no argument and read
+ * their config from the environment. This subpath adds exactly that ergonomic
+ * ON TOP of the existing core — it reuses `resolveAuth` + `AtlasBackend` through
+ * the very same factories, so JWT verification is defined in exactly one place.
+ *
+ * It lives in its own entry precisely because it imports `next/headers`: keeping
+ * it out of `index.ts` means `@atlasauth/nextjs` (middleware + matcher) still
+ * builds and runs with no `next` installed. `next` is only an OPTIONAL peer.
+ */
+import { type AtlasClient, type AtlasClientConfig } from '@atlasauth/backend';
+import { createAuthHelper, type AtlasMiddlewareOptions, type CurrentUser, type EdgeRequest } from './middleware';
+type Env = Record<string, string | undefined>;
+/**
+ * Resolve the edge-verification config from the environment, mirroring how Clerk
+ * reads `CLERK_*` / `NEXT_PUBLIC_CLERK_*`. Server-only names win over their
+ * `NEXT_PUBLIC_` fallbacks. Throws with an actionable message when a required
+ * value is absent, because a silently-misconfigured verifier fails every request
+ * anyway — better a clear error at the first call than a mystery sign-out loop.
+ */
+export declare function configFromEnv(env?: Env): AtlasMiddlewareOptions;
+/**
+ * Resolve the Backend-API (secret-key) config from the environment, for
+ * {@link atlasClient}. The secret key is server-only by definition — there is no
+ * `NEXT_PUBLIC_` fallback for it, and there must never be one.
+ */
+export declare function backendConfigFromEnv(env?: Env): AtlasClientConfig;
+/**
+ * `clerkClient()`-equivalent: a configured `@atlasauth/backend` management client
+ * built from `ATLAS_SECRET_KEY` (+ optional `ATLAS_API_URL`). Overrides win over
+ * the environment, for tests and multi-instance setups.
+ */
+export declare function atlasClient(overrides?: Partial<AtlasClientConfig>): AtlasClient;
+/** The subset of Next's cookie store {@link buildEdgeRequest} reads. */
+export interface CookieStoreLike {
+    getAll(): ReadonlyArray<{
+        name: string;
+        value: string;
+    }>;
+    get?(name: string): {
+        value: string;
+    } | undefined;
+}
+/** The subset of Next's header store {@link buildEdgeRequest} reads. */
+export interface HeaderStoreLike {
+    get(name: string): string | null | undefined;
+}
+/**
+ * Build an `EdgeRequest`-shaped object from a cookie store + a header store, the
+ * bridge between `next/headers` and the existing `resolveAuth` core. Pure and
+ * injectable: the ambient `auth()` feeds it the real Next stores, and tests feed
+ * it fakes — no request context required. `resolveAuth` reads only the
+ * `authorization` and `cookie` headers, so those are what we synthesize; the
+ * cookie header is reconstructed from the cookie store (which reflects any
+ * in-request mutations), falling back to the raw `cookie` header.
+ */
+export declare function buildEdgeRequest(cookieStore: CookieStoreLike, headerStore: HeaderStoreLike): EdgeRequest;
+/** What the pre-bound `auth()` resolves to — the same state + `has`/`protect` the
+ *  factory helper returns. */
+export type ServerAuth = Awaited<ReturnType<ReturnType<typeof createAuthHelper>>>;
+/**
+ * Clerk-parity `auth()` — no arguments. Reads cookies/headers from the ambient
+ * `next/headers` request, verifies the session at the edge via the shared core,
+ * and returns the same `AuthState & { has, protect }`. Config comes from the
+ * environment (see {@link configFromEnv}). Signed-out is a plain state, not a
+ * throw — call `.protect()` where anonymous access is a bug.
+ */
+export declare function auth(): Promise<ServerAuth>;
+/**
+ * Clerk-parity `currentUser()` — no arguments. The signed-in user's profile from
+ * the verified session claims (no round-trip), or `null` when signed out.
+ */
+export declare function currentUser(): Promise<CurrentUser | null>;
+export type { AtlasClient, AtlasClientConfig } from '@atlasauth/backend';
+export type { AuthState, CurrentUser, EdgeRequest } from './middleware';

package/dist/server.js

@@ -0,0 +1,216 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configFromEnv = configFromEnv;
+exports.backendConfigFromEnv = backendConfigFromEnv;
+exports.atlasClient = atlasClient;
+exports.buildEdgeRequest = buildEdgeRequest;
+exports.auth = auth;
+exports.currentUser = currentUser;
+/**
+ * `@atlasauth/nextjs/server` — the pre-bound, zero-argument App-Router helpers.
+ *
+ * §Q7 gap: the base entry ships FACTORIES (`createAuthHelper`,
+ * `createCurrentUserHelper`) that the integrator wires once and then feeds an
+ * `EdgeRequest` on every call. Clerk instead ships `auth()` / `currentUser()`
+ * that read the ambient request from `next/headers` with no argument and read
+ * their config from the environment. This subpath adds exactly that ergonomic
+ * ON TOP of the existing core — it reuses `resolveAuth` + `AtlasBackend` through
+ * the very same factories, so JWT verification is defined in exactly one place.
+ *
+ * It lives in its own entry precisely because it imports `next/headers`: keeping
+ * it out of `index.ts` means `@atlasauth/nextjs` (middleware + matcher) still
+ * builds and runs with no `next` installed. `next` is only an OPTIONAL peer.
+ */
+const backend_1 = require("@atlasauth/backend");
+const middleware_1 = require("./middleware");
+/** Read `process.env` without requiring `process` to be typed (no @types/node). */
+function readEnv() {
+    return globalThis.process?.env ?? {};
+}
+/** First non-empty env var among `names`. */
+function pick(env, ...names) {
+    for (const name of names) {
+        const value = env[name];
+        if (value !== undefined && value !== '')
+            return value;
+    }
+    return undefined;
+}
+/**
+ * Resolve the edge-verification config from the environment, mirroring how Clerk
+ * reads `CLERK_*` / `NEXT_PUBLIC_CLERK_*`. Server-only names win over their
+ * `NEXT_PUBLIC_` fallbacks. Throws with an actionable message when a required
+ * value is absent, because a silently-misconfigured verifier fails every request
+ * anyway — better a clear error at the first call than a mystery sign-out loop.
+ */
+function configFromEnv(env = readEnv()) {
+    const jwksUrl = pick(env, 'ATLAS_JWKS_URL', 'NEXT_PUBLIC_ATLAS_JWKS_URL');
+    const issuer = pick(env, 'ATLAS_ISSUER', 'NEXT_PUBLIC_ATLAS_ISSUER');
+    if (!jwksUrl) {
+        throw new Error('@atlasauth/nextjs/server: missing ATLAS_JWKS_URL (or NEXT_PUBLIC_ATLAS_JWKS_URL).');
+    }
+    if (!issuer) {
+        throw new Error('@atlasauth/nextjs/server: missing ATLAS_ISSUER (or NEXT_PUBLIC_ATLAS_ISSUER).');
+    }
+    const authorizedPartiesRaw = pick(env, 'ATLAS_AUTHORIZED_PARTIES', 'NEXT_PUBLIC_ATLAS_AUTHORIZED_PARTIES');
+    const authorizedParties = authorizedPartiesRaw
+        ? authorizedPartiesRaw
+            .split(',')
+            .map((part) => part.trim())
+            .filter(Boolean)
+        : undefined;
+    const publishableKey = pick(env, 'ATLAS_PUBLISHABLE_KEY', 'NEXT_PUBLIC_ATLAS_PUBLISHABLE_KEY');
+    return { jwksUrl, issuer, authorizedParties, publishableKey };
+}
+/**
+ * Resolve the Backend-API (secret-key) config from the environment, for
+ * {@link atlasClient}. The secret key is server-only by definition — there is no
+ * `NEXT_PUBLIC_` fallback for it, and there must never be one.
+ */
+function backendConfigFromEnv(env = readEnv()) {
+    const secretKey = pick(env, 'ATLAS_SECRET_KEY');
+    if (!secretKey) {
+        throw new Error('@atlasauth/nextjs/server: missing ATLAS_SECRET_KEY.');
+    }
+    const apiUrl = pick(env, 'ATLAS_API_URL', 'NEXT_PUBLIC_ATLAS_API_URL');
+    return { secretKey, apiUrl };
+}
+/**
+ * `clerkClient()`-equivalent: a configured `@atlasauth/backend` management client
+ * built from `ATLAS_SECRET_KEY` (+ optional `ATLAS_API_URL`). Overrides win over
+ * the environment, for tests and multi-instance setups.
+ */
+function atlasClient(overrides = {}) {
+    const env = readEnv();
+    // Resolve from the environment leniently so an explicit override can supply
+    // the secret key on its own; `createAtlasClient` still throws if none is found
+    // from either source.
+    return (0, backend_1.createAtlasClient)({
+        secretKey: overrides.secretKey ?? pick(env, 'ATLAS_SECRET_KEY') ?? '',
+        apiUrl: overrides.apiUrl ?? pick(env, 'ATLAS_API_URL', 'NEXT_PUBLIC_ATLAS_API_URL'),
+        fetch: overrides.fetch,
+    });
+}
+/**
+ * Build an `EdgeRequest`-shaped object from a cookie store + a header store, the
+ * bridge between `next/headers` and the existing `resolveAuth` core. Pure and
+ * injectable: the ambient `auth()` feeds it the real Next stores, and tests feed
+ * it fakes — no request context required. `resolveAuth` reads only the
+ * `authorization` and `cookie` headers, so those are what we synthesize; the
+ * cookie header is reconstructed from the cookie store (which reflects any
+ * in-request mutations), falling back to the raw `cookie` header.
+ */
+function buildEdgeRequest(cookieStore, headerStore) {
+    const reconstructed = cookieStore
+        .getAll()
+        .map(({ name, value }) => `${name}=${value}`)
+        .join('; ');
+    const cookieHeader = reconstructed.length > 0 ? reconstructed : (headerStore.get('cookie') ?? null);
+    const authorization = headerStore.get('authorization') ?? null;
+    return {
+        nextUrl: { pathname: '' },
+        headers: {
+            get(name) {
+                const key = name.toLowerCase();
+                if (key === 'cookie')
+                    return cookieHeader;
+                if (key === 'authorization')
+                    return authorization;
+                return headerStore.get(name) ?? null;
+            },
+        },
+    };
+}
+/**
+ * Read the ambient request from `next/headers` and shape it for the core.
+ * Imported dynamically so merely importing this module never touches
+ * `next/headers` (which throws outside a request scope) — the module loads only
+ * when `auth()`/`currentUser()` actually run inside a server component, route
+ * handler, or Server Action.
+ */
+async function edgeRequestFromContext() {
+    const { cookies, headers } = await Promise.resolve().then(() => __importStar(require('next/headers')));
+    const cookieStore = await cookies();
+    const headerStore = await headers();
+    return buildEdgeRequest(cookieStore, headerStore);
+}
+/**
+ * Memoize the factory-built helpers by their resolved config so the in-process
+ * JWKS cache inside `AtlasBackend` stays warm across calls — rebuilding a fresh
+ * backend per `auth()` would throw that cache away and re-fetch the JWKS on
+ * every render, defeating the whole point of edge-local verification.
+ */
+function cacheKey(options) {
+    return [options.jwksUrl, options.issuer, (options.authorizedParties ?? []).join(',')].join('\n');
+}
+let authHelperCache;
+function getAuthHelper() {
+    const options = configFromEnv();
+    const key = cacheKey(options);
+    if (!authHelperCache || authHelperCache.key !== key) {
+        authHelperCache = { key, fn: (0, middleware_1.createAuthHelper)(options) };
+    }
+    return authHelperCache.fn;
+}
+let currentUserHelperCache;
+function getCurrentUserHelper() {
+    const options = configFromEnv();
+    const key = cacheKey(options);
+    if (!currentUserHelperCache || currentUserHelperCache.key !== key) {
+        currentUserHelperCache = { key, fn: (0, middleware_1.createCurrentUserHelper)(options) };
+    }
+    return currentUserHelperCache.fn;
+}
+/**
+ * Clerk-parity `auth()` — no arguments. Reads cookies/headers from the ambient
+ * `next/headers` request, verifies the session at the edge via the shared core,
+ * and returns the same `AuthState & { has, protect }`. Config comes from the
+ * environment (see {@link configFromEnv}). Signed-out is a plain state, not a
+ * throw — call `.protect()` where anonymous access is a bug.
+ */
+async function auth() {
+    const helper = getAuthHelper();
+    return helper(await edgeRequestFromContext());
+}
+/**
+ * Clerk-parity `currentUser()` — no arguments. The signed-in user's profile from
+ * the verified session claims (no round-trip), or `null` when signed out.
+ */
+async function currentUser() {
+    const helper = getCurrentUserHelper();
+    return helper(await edgeRequestFromContext());
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,sCA6BC;AAOD,oDAOC;AAOD,kCAUC;AAsBD,4CAsBC;AA2DD,oBAGC;AAMD,kCAGC;AAlOD;;;;;;;;;;;;;;GAcG;AACH,gDAI4B;AAC5B,6CAMsB;AAItB,mFAAmF;AACnF,SAAS,OAAO;IACd,OAAQ,UAA0C,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;AACxE,CAAC;AAED,6CAA6C;AAC7C,SAAS,IAAI,CAAC,GAAQ,EAAE,GAAG,KAAwB;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;IACxD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,MAAW,OAAO,EAAE;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,0BAA0B,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,oBAAoB,GAAG,IAAI,CAC/B,GAAG,EACH,0BAA0B,EAC1B,sCAAsC,CACvC,CAAC;IACF,MAAM,iBAAiB,GAAG,oBAAoB;QAC5C,CAAC,CAAC,oBAAoB;aACjB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC;QACpB,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,EAAE,mCAAmC,CAAC,CAAC;IAE/F,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,MAAW,OAAO,EAAE;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,2BAA2B,CAAC,CAAC;IACvE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,YAAwC,EAAE;IACpE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,4EAA4E;IAC5E,+EAA+E;IAC/E,sBAAsB;IACtB,OAAO,IAAA,2BAAiB,EAAC;QACvB,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,IAAI,EAAE;QACrE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,2BAA2B,CAAC;QACnF,KAAK,EAAE,SAAS,CAAC,KAAK;KACvB,CAAC,CAAC;AACL,CAAC;AAaD;;;;;;;;GAQG;AACH,SAAgB,gBAAgB,CAC9B,WAA4B,EAC5B,WAA4B;IAE5B,MAAM,aAAa,GAAG,WAAW;SAC9B,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;SAC5C,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC;IACpG,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC;IAE/D,OAAO;QACL,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACzB,OAAO,EAAE;YACP,GAAG,CAAC,IAAY;gBACd,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC/B,IAAI,GAAG,KAAK,QAAQ;oBAAE,OAAO,YAAY,CAAC;gBAC1C,IAAI,GAAG,KAAK,eAAe;oBAAE,OAAO,aAAa,CAAC;gBAClD,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;YACvC,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,sBAAsB;IACnC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,wDAAa,cAAc,GAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;IACpC,OAAO,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,OAA+B;IAC/C,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnG,CAAC;AAED,IAAI,eAAqF,CAAC;AAC1F,SAAS,aAAa;IACpB,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACpD,eAAe,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,IAAA,6BAAgB,EAAC,OAAO,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,eAAe,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED,IAAI,sBAES,CAAC;AACd,SAAS,oBAAoB;IAC3B,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,sBAAsB,IAAI,sBAAsB,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QAClE,sBAAsB,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,sBAAsB,CAAC,EAAE,CAAC;AACnC,CAAC;AAMD;;;;;;GAMG;AACI,KAAK,UAAU,IAAI;IACxB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,OAAO,MAAM,CAAC,MAAM,sBAAsB,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,WAAW;IAC/B,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,sBAAsB,EAAE,CAAC,CAAC;AAChD,CAAC"}

package/package.json

@@ -1,15 +1,35 @@
 {
   "name": "@atlasauth/nextjs",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "default": "./dist/server.js"
+    },
+    "./package.json": "./package.json"
+  },
   "dependencies": {
-    "@atlasauth/backend": "0.1.1"
+    "@atlasauth/backend": "0.1.2"
+  },
+  "peerDependencies": {
+    "next": ">=13.4"
+  },
+  "peerDependenciesMeta": {
+    "next": {
+      "optional": true
+    }
   },
   "devDependencies": {
     "typescript": "^5.6.3",
     "vitest": "^2.1.4",
-    "jose": "^5.9.6"
+    "jose": "^5.9.6",
+    "next": "^15.0.0"
   },
   "publishConfig": {
     "access": "public"