@atlasauth/nextjs 0.1.3 → 0.2.0

package/dist/proxy.d.ts

@@ -0,0 +1,96 @@
+import { type AtlasMiddlewareOptions, type AuthState, type EdgeRequest } from './middleware';
+/**
+ * Next.js 16 renamed `middleware.ts` to `proxy.ts` (exporting `proxy` or a
+ * default function) and made it run on the Node.js runtime by default. A proxy
+ * is usually a CHAIN — auth, then i18n (next-intl), then whatever else — so the
+ * shape that composes is not "Atlas returns the final response" but "Atlas
+ * returns a response only when it must act, otherwise steps aside":
+ *
+ * ```ts
+ * const atlas = atlasProxy({ ... });
+ * export async function proxy(req: NextRequest) {
+ *   return (await atlas(req)) ?? withAtlasHeaders(req, intl(req));
+ * }
+ * ```
+ *
+ * `atlas(req)` resolves to a `Response` (sign-in redirect, handshake bounce,
+ * 401 for an API route) or `null` (let the app continue). The verified auth
+ * state is remembered for that request, so {@link withAtlasHeaders} can forward
+ * it to the app on WHATEVER response the rest of the chain produced — without
+ * verifying the token a second time and without Atlas having to own the final
+ * response.
+ *
+ * Everything here is Web-standard (`Response`, `Headers`, `URL`, Web Crypto),
+ * so the same proxy runs on the Node.js runtime and on the Edge runtime.
+ */
+/** Request headers the proxy forwards to the app (server components, route
+ *  handlers) describing the verified session. */
+export declare const ATLAS_AUTH_HEADERS: {
+    readonly status: "x-atlas-auth-status";
+    readonly userId: "x-atlas-user-id";
+    readonly sessionId: "x-atlas-session-id";
+    readonly orgId: "x-atlas-org-id";
+    readonly orgRole: "x-atlas-org-role";
+};
+/** What `atlasProxy` needs from a request: a `NextRequest` satisfies it. */
+export interface ProxyRequest extends EdgeRequest {
+    headers: {
+        get(name: string): string | null;
+        forEach(callback: (value: string, key: string) => void): void;
+    };
+}
+/** The request-headers slice of a response — `NextResponse` and `Response`
+ *  both satisfy it. */
+export interface HeaderCarryingResponse {
+    status: number;
+    headers: Headers;
+}
+export type AtlasProxy = (request: ProxyRequest) => Promise<Response | null>;
+/**
+ * The Next.js 16 `proxy.ts` entry for Atlas. Same options, same decisions as
+ * `atlasMiddleware` (they share one engine) — only the calling convention
+ * differs: it takes just the request and resolves to `Response | null`.
+ */
+export declare function atlasProxy(options: AtlasMiddlewareOptions): AtlasProxy;
+/**
+ * The auth state the proxy resolved for this request (signed-out if the proxy
+ * hasn't run on it). For extra checks inside `proxy.ts` itself — a role gate on
+ * `/admin`, say — without verifying the token again.
+ */
+export declare function proxyAuth(request: object): AuthState;
+/**
+ * Forward the verified session to the app as `x-atlas-*` REQUEST headers on a
+ * response produced by any later step of the chain (`NextResponse.next()`, a
+ * next-intl rewrite, …). Returns the same response, for `return withAtlasHeaders(...)`.
+ *
+ * It speaks Next's request-header override protocol (what
+ * `NextResponse.next({ request: { headers } })` emits), MERGING with any
+ * override a previous step already set rather than clobbering it, so it composes
+ * with next-intl or your own header tweaks in either order.
+ *
+ * Any `x-atlas-*` header the CLIENT sent is always dropped — a browser can't
+ * forge `x-atlas-user-id` past the proxy. Responses that don't continue to the
+ * app (redirects, direct bodies) are returned untouched: there's no downstream
+ * request to carry headers.
+ *
+ * `auth` defaults to what {@link atlasProxy} resolved for `request`, or
+ * signed-out if it didn't run.
+ */
+export declare function withAtlasHeaders<R extends HeaderCarryingResponse>(request: ProxyRequest, response: R, auth?: AuthState): R;
+/** The session as forwarded by {@link withAtlasHeaders}. */
+export interface ForwardedAuth {
+    signedIn: boolean;
+    userId: string | null;
+    sessionId: string | null;
+    orgId: string | null;
+    orgRole: string | null;
+}
+/**
+ * Read the `x-atlas-*` headers the proxy forwarded (e.g. from `await headers()`
+ * in a server component). Cheap — no verification — so use it for rendering
+ * decisions; keep authorization on `auth()`/`protect()`, which verify the token
+ * themselves and don't depend on the proxy's matcher covering the route.
+ */
+export declare function readAtlasHeaders(headers: {
+    get(name: string): string | null;
+}): ForwardedAuth;

package/dist/proxy.js

@@ -0,0 +1,189 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ATLAS_AUTH_HEADERS = void 0;
+exports.atlasProxy = atlasProxy;
+exports.proxyAuth = proxyAuth;
+exports.withAtlasHeaders = withAtlasHeaders;
+exports.readAtlasHeaders = readAtlasHeaders;
+const middleware_1 = require("./middleware");
+/**
+ * Next.js 16 renamed `middleware.ts` to `proxy.ts` (exporting `proxy` or a
+ * default function) and made it run on the Node.js runtime by default. A proxy
+ * is usually a CHAIN — auth, then i18n (next-intl), then whatever else — so the
+ * shape that composes is not "Atlas returns the final response" but "Atlas
+ * returns a response only when it must act, otherwise steps aside":
+ *
+ * ```ts
+ * const atlas = atlasProxy({ ... });
+ * export async function proxy(req: NextRequest) {
+ *   return (await atlas(req)) ?? withAtlasHeaders(req, intl(req));
+ * }
+ * ```
+ *
+ * `atlas(req)` resolves to a `Response` (sign-in redirect, handshake bounce,
+ * 401 for an API route) or `null` (let the app continue). The verified auth
+ * state is remembered for that request, so {@link withAtlasHeaders} can forward
+ * it to the app on WHATEVER response the rest of the chain produced — without
+ * verifying the token a second time and without Atlas having to own the final
+ * response.
+ *
+ * Everything here is Web-standard (`Response`, `Headers`, `URL`, Web Crypto),
+ * so the same proxy runs on the Node.js runtime and on the Edge runtime.
+ */
+/** Request headers the proxy forwards to the app (server components, route
+ *  handlers) describing the verified session. */
+exports.ATLAS_AUTH_HEADERS = {
+    status: 'x-atlas-auth-status',
+    userId: 'x-atlas-user-id',
+    sessionId: 'x-atlas-session-id',
+    orgId: 'x-atlas-org-id',
+    orgRole: 'x-atlas-org-role',
+};
+const ATLAS_HEADER_PREFIX = 'x-atlas-';
+const OVERRIDE_LIST = 'x-middleware-override-headers';
+const OVERRIDE_PREFIX = 'x-middleware-request-';
+/** Auth state per request, recorded by the proxy for `withAtlasHeaders` /
+ *  `proxyAuth`. Weak, so a finished request's state is collected with it. */
+const resolved = new WeakMap();
+function serializeCookie({ name, value, options }) {
+    // Same encoding Next's `response.cookies.set` applies, so readers agree.
+    const parts = [`${name}=${encodeURIComponent(value)}`];
+    if (options.path)
+        parts.push(`Path=${options.path}`);
+    if (options.maxAge !== undefined)
+        parts.push(`Max-Age=${options.maxAge}`);
+    if (options.httpOnly)
+        parts.push('HttpOnly');
+    if (options.secure)
+        parts.push('Secure');
+    if (options.sameSite) {
+        parts.push(`SameSite=${options.sameSite[0].toUpperCase()}${options.sameSite.slice(1)}`);
+    }
+    return parts.join('; ');
+}
+/**
+ * The Next.js 16 `proxy.ts` entry for Atlas. Same options, same decisions as
+ * `atlasMiddleware` (they share one engine) — only the calling convention
+ * differs: it takes just the request and resolves to `Response | null`.
+ */
+function atlasProxy(options) {
+    const decide = (0, middleware_1.createAtlasDecider)(options);
+    return async function proxy(request) {
+        const decision = await decide(request);
+        resolved.set(request, decision.auth);
+        switch (decision.kind) {
+            case 'continue':
+                return null;
+            case 'unauthorized':
+                return new Response(JSON.stringify(middleware_1.UNAUTHENTICATED_BODY), {
+                    status: 401,
+                    headers: { 'content-type': 'application/json' },
+                });
+            case 'redirect': {
+                // Built by hand rather than `Response.redirect`, whose headers are
+                // immutable — the handshake legs must also set first-party cookies.
+                const headers = new Headers({ location: decision.location });
+                for (const cookie of decision.cookies)
+                    headers.append('set-cookie', serializeCookie(cookie));
+                return new Response(null, { status: 307, headers });
+            }
+        }
+    };
+}
+/**
+ * The auth state the proxy resolved for this request (signed-out if the proxy
+ * hasn't run on it). For extra checks inside `proxy.ts` itself — a role gate on
+ * `/admin`, say — without verifying the token again.
+ */
+function proxyAuth(request) {
+    return resolved.get(request) ?? middleware_1.SIGNED_OUT;
+}
+function authHeaderValues(auth) {
+    const values = [
+        [exports.ATLAS_AUTH_HEADERS.status, auth.userId ? 'signed-in' : 'signed-out'],
+    ];
+    if (auth.userId)
+        values.push([exports.ATLAS_AUTH_HEADERS.userId, auth.userId]);
+    if (auth.sessionId)
+        values.push([exports.ATLAS_AUTH_HEADERS.sessionId, auth.sessionId]);
+    if (auth.orgId)
+        values.push([exports.ATLAS_AUTH_HEADERS.orgId, auth.orgId]);
+    if (auth.orgRole)
+        values.push([exports.ATLAS_AUTH_HEADERS.orgRole, auth.orgRole]);
+    return values;
+}
+/**
+ * Forward the verified session to the app as `x-atlas-*` REQUEST headers on a
+ * response produced by any later step of the chain (`NextResponse.next()`, a
+ * next-intl rewrite, …). Returns the same response, for `return withAtlasHeaders(...)`.
+ *
+ * It speaks Next's request-header override protocol (what
+ * `NextResponse.next({ request: { headers } })` emits), MERGING with any
+ * override a previous step already set rather than clobbering it, so it composes
+ * with next-intl or your own header tweaks in either order.
+ *
+ * Any `x-atlas-*` header the CLIENT sent is always dropped — a browser can't
+ * forge `x-atlas-user-id` past the proxy. Responses that don't continue to the
+ * app (redirects, direct bodies) are returned untouched: there's no downstream
+ * request to carry headers.
+ *
+ * `auth` defaults to what {@link atlasProxy} resolved for `request`, or
+ * signed-out if it didn't run.
+ */
+function withAtlasHeaders(request, response, auth = proxyAuth(request)) {
+    const continues = response.headers.has('x-middleware-next') || response.headers.has('x-middleware-rewrite');
+    if (!continues)
+        return response;
+    const existing = response.headers.get(OVERRIDE_LIST);
+    const names = new Set();
+    if (existing !== null) {
+        // An earlier step already chose the full downstream header set; keep its
+        // choices and only take over the `x-atlas-*` namespace.
+        for (const raw of existing.split(',')) {
+            const name = raw.trim().toLowerCase();
+            if (!name)
+                continue;
+            if (name.startsWith(ATLAS_HEADER_PREFIX)) {
+                response.headers.delete(`${OVERRIDE_PREFIX}${name}`);
+            }
+            else {
+                names.add(name);
+            }
+        }
+    }
+    else {
+        // First override: start from the incoming request headers, as
+        // `NextResponse.next({ request: { headers: new Headers(req.headers) } })` does.
+        request.headers.forEach((value, key) => {
+            const name = key.toLowerCase();
+            if (name.startsWith(ATLAS_HEADER_PREFIX))
+                return;
+            names.add(name);
+            response.headers.set(`${OVERRIDE_PREFIX}${name}`, value);
+        });
+    }
+    for (const [name, value] of authHeaderValues(auth)) {
+        names.add(name);
+        response.headers.set(`${OVERRIDE_PREFIX}${name}`, value);
+    }
+    response.headers.set(OVERRIDE_LIST, [...names].join(','));
+    return response;
+}
+/**
+ * Read the `x-atlas-*` headers the proxy forwarded (e.g. from `await headers()`
+ * in a server component). Cheap — no verification — so use it for rendering
+ * decisions; keep authorization on `auth()`/`protect()`, which verify the token
+ * themselves and don't depend on the proxy's matcher covering the route.
+ */
+function readAtlasHeaders(headers) {
+    const userId = headers.get(exports.ATLAS_AUTH_HEADERS.userId);
+    const signedIn = headers.get(exports.ATLAS_AUTH_HEADERS.status) === 'signed-in' && Boolean(userId);
+    return {
+        signedIn,
+        userId: signedIn ? userId : null,
+        sessionId: signedIn ? headers.get(exports.ATLAS_AUTH_HEADERS.sessionId) : null,
+        orgId: signedIn ? headers.get(exports.ATLAS_AUTH_HEADERS.orgId) : null,
+        orgRole: signedIn ? headers.get(exports.ATLAS_AUTH_HEADERS.orgRole) : null,
+    };
+}
+//# sourceMappingURL=proxy.js.map

package/dist/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":";;;AAwFA,gCA0BC;AAOD,8BAEC;AA+BD,4CAyCC;AAiBD,4CAUC;AA9ND,6CAQsB;AAEtB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;iDACiD;AACpC,QAAA,kBAAkB,GAAG;IAChC,MAAM,EAAE,qBAAqB;IAC7B,MAAM,EAAE,iBAAiB;IACzB,SAAS,EAAE,oBAAoB;IAC/B,KAAK,EAAE,gBAAgB;IACvB,OAAO,EAAE,kBAAkB;CACnB,CAAC;AAEX,MAAM,mBAAmB,GAAG,UAAU,CAAC;AACvC,MAAM,aAAa,GAAG,+BAA+B,CAAC;AACtD,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAmBhD;6EAC6E;AAC7E,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAqB,CAAC;AAElD,SAAS,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAe;IAC5D,yEAAyE;IACzE,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CAAC,OAA+B;IACxD,MAAM,MAAM,GAAG,IAAA,+BAAkB,EAAC,OAAO,CAAC,CAAC;IAE3C,OAAO,KAAK,UAAU,KAAK,CAAC,OAAO;QACjC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAErC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtB,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC;YAEd,KAAK,cAAc;gBACjB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,iCAAoB,CAAC,EAAE;oBACxD,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CAAC,CAAC;YAEL,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,mEAAmE;gBACnE,oEAAoE;gBACpE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC7D,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO;oBAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC7F,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,SAAS,CAAC,OAAe;IACvC,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,uBAAU,CAAC;AAC7C,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAe;IACvC,MAAM,MAAM,GAA4B;QACtC,CAAC,0BAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;KACtE,CAAC;IACF,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,0BAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,IAAI,IAAI,CAAC,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,0BAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAChF,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,0BAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,IAAI,IAAI,CAAC,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,0BAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,gBAAgB,CAC9B,OAAqB,EACrB,QAAW,EACX,OAAkB,SAAS,CAAC,OAAO,CAAC;IAEpC,MAAM,SAAS,GACb,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC5F,IAAI,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAC;IAEhC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,yEAAyE;QACzE,wDAAwD;QACxD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACzC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,CAAC,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,8DAA8D;QAC9D,gFAAgF;QAChF,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;gBAAE,OAAO;YACjD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAWD;;;;;GAKG;AACH,SAAgB,gBAAgB,CAAC,OAA6C;IAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,MAAM,CAAC,KAAK,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3F,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAChC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;QACtE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;QAC9D,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;KACnE,CAAC;AACJ,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,80 @@
+/**
+ * `@atlasauth/nextjs/server` — the pre-bound, zero-argument App-Router helpers.
+ *
+ * §Q7 gap: the base entry ships FACTORIES (`createAuthHelper`,
+ * `createCurrentUserHelper`) that the integrator wires once and then feeds an
+ * `EdgeRequest` on every call. Clerk instead ships `auth()` / `currentUser()`
+ * that read the ambient request from `next/headers` with no argument and read
+ * their config from the environment. This subpath adds exactly that ergonomic
+ * ON TOP of the existing core — it reuses `resolveAuth` + `AtlasBackend` through
+ * the very same factories, so JWT verification is defined in exactly one place.
+ *
+ * It lives in its own entry precisely because it imports `next/headers`: keeping
+ * it out of `index.ts` means `@atlasauth/nextjs` (middleware + matcher) still
+ * builds and runs with no `next` installed. `next` is only an OPTIONAL peer.
+ */
+import { type AtlasClient, type AtlasClientConfig } from '@atlasauth/backend';
+import { createAuthHelper, type AtlasMiddlewareOptions, type CurrentUser, type EdgeRequest } from './middleware';
+type Env = Record<string, string | undefined>;
+/**
+ * Resolve the edge-verification config from the environment, mirroring how Clerk
+ * reads `CLERK_*` / `NEXT_PUBLIC_CLERK_*`. Server-only names win over their
+ * `NEXT_PUBLIC_` fallbacks. Throws with an actionable message when a required
+ * value is absent, because a silently-misconfigured verifier fails every request
+ * anyway — better a clear error at the first call than a mystery sign-out loop.
+ */
+export declare function configFromEnv(env?: Env): AtlasMiddlewareOptions;
+/**
+ * Resolve the Backend-API (secret-key) config from the environment, for
+ * {@link atlasClient}. The secret key is server-only by definition — there is no
+ * `NEXT_PUBLIC_` fallback for it, and there must never be one.
+ */
+export declare function backendConfigFromEnv(env?: Env): AtlasClientConfig;
+/**
+ * `clerkClient()`-equivalent: a configured `@atlasauth/backend` management client
+ * built from `ATLAS_SECRET_KEY` (+ optional `ATLAS_API_URL`). Overrides win over
+ * the environment, for tests and multi-instance setups.
+ */
+export declare function atlasClient(overrides?: Partial<AtlasClientConfig>): AtlasClient;
+/** The subset of Next's cookie store {@link buildEdgeRequest} reads. */
+export interface CookieStoreLike {
+    getAll(): ReadonlyArray<{
+        name: string;
+        value: string;
+    }>;
+    get?(name: string): {
+        value: string;
+    } | undefined;
+}
+/** The subset of Next's header store {@link buildEdgeRequest} reads. */
+export interface HeaderStoreLike {
+    get(name: string): string | null | undefined;
+}
+/**
+ * Build an `EdgeRequest`-shaped object from a cookie store + a header store, the
+ * bridge between `next/headers` and the existing `resolveAuth` core. Pure and
+ * injectable: the ambient `auth()` feeds it the real Next stores, and tests feed
+ * it fakes — no request context required. `resolveAuth` reads only the
+ * `authorization` and `cookie` headers, so those are what we synthesize; the
+ * cookie header is reconstructed from the cookie store (which reflects any
+ * in-request mutations), falling back to the raw `cookie` header.
+ */
+export declare function buildEdgeRequest(cookieStore: CookieStoreLike, headerStore: HeaderStoreLike): EdgeRequest;
+/** What the pre-bound `auth()` resolves to — the same state + `has`/`protect` the
+ *  factory helper returns. */
+export type ServerAuth = Awaited<ReturnType<ReturnType<typeof createAuthHelper>>>;
+/**
+ * Clerk-parity `auth()` — no arguments. Reads cookies/headers from the ambient
+ * `next/headers` request, verifies the session at the edge via the shared core,
+ * and returns the same `AuthState & { has, protect }`. Config comes from the
+ * environment (see {@link configFromEnv}). Signed-out is a plain state, not a
+ * throw — call `.protect()` where anonymous access is a bug.
+ */
+export declare function auth(): Promise<ServerAuth>;
+/**
+ * Clerk-parity `currentUser()` — no arguments. The signed-in user's profile from
+ * the verified session claims (no round-trip), or `null` when signed out.
+ */
+export declare function currentUser(): Promise<CurrentUser | null>;
+export type { AtlasClient, AtlasClientConfig } from '@atlasauth/backend';
+export type { AuthState, CurrentUser, EdgeRequest } from './middleware';

package/dist/server.js

@@ -0,0 +1,216 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configFromEnv = configFromEnv;
+exports.backendConfigFromEnv = backendConfigFromEnv;
+exports.atlasClient = atlasClient;
+exports.buildEdgeRequest = buildEdgeRequest;
+exports.auth = auth;
+exports.currentUser = currentUser;
+/**
+ * `@atlasauth/nextjs/server` — the pre-bound, zero-argument App-Router helpers.
+ *
+ * §Q7 gap: the base entry ships FACTORIES (`createAuthHelper`,
+ * `createCurrentUserHelper`) that the integrator wires once and then feeds an
+ * `EdgeRequest` on every call. Clerk instead ships `auth()` / `currentUser()`
+ * that read the ambient request from `next/headers` with no argument and read
+ * their config from the environment. This subpath adds exactly that ergonomic
+ * ON TOP of the existing core — it reuses `resolveAuth` + `AtlasBackend` through
+ * the very same factories, so JWT verification is defined in exactly one place.
+ *
+ * It lives in its own entry precisely because it imports `next/headers`: keeping
+ * it out of `index.ts` means `@atlasauth/nextjs` (middleware + matcher) still
+ * builds and runs with no `next` installed. `next` is only an OPTIONAL peer.
+ */
+const backend_1 = require("@atlasauth/backend");
+const middleware_1 = require("./middleware");
+/** Read `process.env` without requiring `process` to be typed (no @types/node). */
+function readEnv() {
+    return globalThis.process?.env ?? {};
+}
+/** First non-empty env var among `names`. */
+function pick(env, ...names) {
+    for (const name of names) {
+        const value = env[name];
+        if (value !== undefined && value !== '')
+            return value;
+    }
+    return undefined;
+}
+/**
+ * Resolve the edge-verification config from the environment, mirroring how Clerk
+ * reads `CLERK_*` / `NEXT_PUBLIC_CLERK_*`. Server-only names win over their
+ * `NEXT_PUBLIC_` fallbacks. Throws with an actionable message when a required
+ * value is absent, because a silently-misconfigured verifier fails every request
+ * anyway — better a clear error at the first call than a mystery sign-out loop.
+ */
+function configFromEnv(env = readEnv()) {
+    const jwksUrl = pick(env, 'ATLAS_JWKS_URL', 'NEXT_PUBLIC_ATLAS_JWKS_URL');
+    const issuer = pick(env, 'ATLAS_ISSUER', 'NEXT_PUBLIC_ATLAS_ISSUER');
+    if (!jwksUrl) {
+        throw new Error('@atlasauth/nextjs/server: missing ATLAS_JWKS_URL (or NEXT_PUBLIC_ATLAS_JWKS_URL).');
+    }
+    if (!issuer) {
+        throw new Error('@atlasauth/nextjs/server: missing ATLAS_ISSUER (or NEXT_PUBLIC_ATLAS_ISSUER).');
+    }
+    const authorizedPartiesRaw = pick(env, 'ATLAS_AUTHORIZED_PARTIES', 'NEXT_PUBLIC_ATLAS_AUTHORIZED_PARTIES');
+    const authorizedParties = authorizedPartiesRaw
+        ? authorizedPartiesRaw
+            .split(',')
+            .map((part) => part.trim())
+            .filter(Boolean)
+        : undefined;
+    const publishableKey = pick(env, 'ATLAS_PUBLISHABLE_KEY', 'NEXT_PUBLIC_ATLAS_PUBLISHABLE_KEY');
+    return { jwksUrl, issuer, authorizedParties, publishableKey };
+}
+/**
+ * Resolve the Backend-API (secret-key) config from the environment, for
+ * {@link atlasClient}. The secret key is server-only by definition — there is no
+ * `NEXT_PUBLIC_` fallback for it, and there must never be one.
+ */
+function backendConfigFromEnv(env = readEnv()) {
+    const secretKey = pick(env, 'ATLAS_SECRET_KEY');
+    if (!secretKey) {
+        throw new Error('@atlasauth/nextjs/server: missing ATLAS_SECRET_KEY.');
+    }
+    const apiUrl = pick(env, 'ATLAS_API_URL', 'NEXT_PUBLIC_ATLAS_API_URL');
+    return { secretKey, apiUrl };
+}
+/**
+ * `clerkClient()`-equivalent: a configured `@atlasauth/backend` management client
+ * built from `ATLAS_SECRET_KEY` (+ optional `ATLAS_API_URL`). Overrides win over
+ * the environment, for tests and multi-instance setups.
+ */
+function atlasClient(overrides = {}) {
+    const env = readEnv();
+    // Resolve from the environment leniently so an explicit override can supply
+    // the secret key on its own; `createAtlasClient` still throws if none is found
+    // from either source.
+    return (0, backend_1.createAtlasClient)({
+        secretKey: overrides.secretKey ?? pick(env, 'ATLAS_SECRET_KEY') ?? '',
+        apiUrl: overrides.apiUrl ?? pick(env, 'ATLAS_API_URL', 'NEXT_PUBLIC_ATLAS_API_URL'),
+        fetch: overrides.fetch,
+    });
+}
+/**
+ * Build an `EdgeRequest`-shaped object from a cookie store + a header store, the
+ * bridge between `next/headers` and the existing `resolveAuth` core. Pure and
+ * injectable: the ambient `auth()` feeds it the real Next stores, and tests feed
+ * it fakes — no request context required. `resolveAuth` reads only the
+ * `authorization` and `cookie` headers, so those are what we synthesize; the
+ * cookie header is reconstructed from the cookie store (which reflects any
+ * in-request mutations), falling back to the raw `cookie` header.
+ */
+function buildEdgeRequest(cookieStore, headerStore) {
+    const reconstructed = cookieStore
+        .getAll()
+        .map(({ name, value }) => `${name}=${value}`)
+        .join('; ');
+    const cookieHeader = reconstructed.length > 0 ? reconstructed : (headerStore.get('cookie') ?? null);
+    const authorization = headerStore.get('authorization') ?? null;
+    return {
+        nextUrl: { pathname: '' },
+        headers: {
+            get(name) {
+                const key = name.toLowerCase();
+                if (key === 'cookie')
+                    return cookieHeader;
+                if (key === 'authorization')
+                    return authorization;
+                return headerStore.get(name) ?? null;
+            },
+        },
+    };
+}
+/**
+ * Read the ambient request from `next/headers` and shape it for the core.
+ * Imported dynamically so merely importing this module never touches
+ * `next/headers` (which throws outside a request scope) — the module loads only
+ * when `auth()`/`currentUser()` actually run inside a server component, route
+ * handler, or Server Action.
+ */
+async function edgeRequestFromContext() {
+    const { cookies, headers } = await Promise.resolve().then(() => __importStar(require('next/headers')));
+    const cookieStore = await cookies();
+    const headerStore = await headers();
+    return buildEdgeRequest(cookieStore, headerStore);
+}
+/**
+ * Memoize the factory-built helpers by their resolved config so the in-process
+ * JWKS cache inside `AtlasBackend` stays warm across calls — rebuilding a fresh
+ * backend per `auth()` would throw that cache away and re-fetch the JWKS on
+ * every render, defeating the whole point of edge-local verification.
+ */
+function cacheKey(options) {
+    return [options.jwksUrl, options.issuer, (options.authorizedParties ?? []).join(',')].join('\n');
+}
+let authHelperCache;
+function getAuthHelper() {
+    const options = configFromEnv();
+    const key = cacheKey(options);
+    if (!authHelperCache || authHelperCache.key !== key) {
+        authHelperCache = { key, fn: (0, middleware_1.createAuthHelper)(options) };
+    }
+    return authHelperCache.fn;
+}
+let currentUserHelperCache;
+function getCurrentUserHelper() {
+    const options = configFromEnv();
+    const key = cacheKey(options);
+    if (!currentUserHelperCache || currentUserHelperCache.key !== key) {
+        currentUserHelperCache = { key, fn: (0, middleware_1.createCurrentUserHelper)(options) };
+    }
+    return currentUserHelperCache.fn;
+}
+/**
+ * Clerk-parity `auth()` — no arguments. Reads cookies/headers from the ambient
+ * `next/headers` request, verifies the session at the edge via the shared core,
+ * and returns the same `AuthState & { has, protect }`. Config comes from the
+ * environment (see {@link configFromEnv}). Signed-out is a plain state, not a
+ * throw — call `.protect()` where anonymous access is a bug.
+ */
+async function auth() {
+    const helper = getAuthHelper();
+    return helper(await edgeRequestFromContext());
+}
+/**
+ * Clerk-parity `currentUser()` — no arguments. The signed-in user's profile from
+ * the verified session claims (no round-trip), or `null` when signed out.
+ */
+async function currentUser() {
+    const helper = getCurrentUserHelper();
+    return helper(await edgeRequestFromContext());
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,sCA6BC;AAOD,oDAOC;AAOD,kCAUC;AAsBD,4CAsBC;AA2DD,oBAGC;AAMD,kCAGC;AAlOD;;;;;;;;;;;;;;GAcG;AACH,gDAI4B;AAC5B,6CAMsB;AAItB,mFAAmF;AACnF,SAAS,OAAO;IACd,OAAQ,UAA0C,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;AACxE,CAAC;AAED,6CAA6C;AAC7C,SAAS,IAAI,CAAC,GAAQ,EAAE,GAAG,KAAwB;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;IACxD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,MAAW,OAAO,EAAE;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,0BAA0B,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,oBAAoB,GAAG,IAAI,CAC/B,GAAG,EACH,0BAA0B,EAC1B,sCAAsC,CACvC,CAAC;IACF,MAAM,iBAAiB,GAAG,oBAAoB;QAC5C,CAAC,CAAC,oBAAoB;aACjB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC;QACpB,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,EAAE,mCAAmC,CAAC,CAAC;IAE/F,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,MAAW,OAAO,EAAE;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,2BAA2B,CAAC,CAAC;IACvE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,YAAwC,EAAE;IACpE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,4EAA4E;IAC5E,+EAA+E;IAC/E,sBAAsB;IACtB,OAAO,IAAA,2BAAiB,EAAC;QACvB,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,IAAI,EAAE;QACrE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,2BAA2B,CAAC;QACnF,KAAK,EAAE,SAAS,CAAC,KAAK;KACvB,CAAC,CAAC;AACL,CAAC;AAaD;;;;;;;;GAQG;AACH,SAAgB,gBAAgB,CAC9B,WAA4B,EAC5B,WAA4B;IAE5B,MAAM,aAAa,GAAG,WAAW;SAC9B,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;SAC5C,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC;IACpG,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC;IAE/D,OAAO;QACL,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACzB,OAAO,EAAE;YACP,GAAG,CAAC,IAAY;gBACd,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC/B,IAAI,GAAG,KAAK,QAAQ;oBAAE,OAAO,YAAY,CAAC;gBAC1C,IAAI,GAAG,KAAK,eAAe;oBAAE,OAAO,aAAa,CAAC;gBAClD,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;YACvC,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,sBAAsB;IACnC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,wDAAa,cAAc,GAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;IACpC,OAAO,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,OAA+B;IAC/C,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnG,CAAC;AAED,IAAI,eAAqF,CAAC;AAC1F,SAAS,aAAa;IACpB,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACpD,eAAe,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,IAAA,6BAAgB,EAAC,OAAO,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,eAAe,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED,IAAI,sBAES,CAAC;AACd,SAAS,oBAAoB;IAC3B,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,sBAAsB,IAAI,sBAAsB,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QAClE,sBAAsB,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,sBAAsB,CAAC,EAAE,CAAC;AACnC,CAAC;AAMD;;;;;;GAMG;AACI,KAAK,UAAU,IAAI;IACxB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,OAAO,MAAM,CAAC,MAAM,sBAAsB,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,WAAW;IAC/B,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,sBAAsB,EAAE,CAAC,CAAC;AAChD,CAAC"}

package/package.json

@@ -1,22 +1,43 @@
 {
   "name": "@atlasauth/nextjs",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "default": "./dist/server.js"
+    },
+    "./package.json": "./package.json"
+  },
   "dependencies": {
-    "@atlasauth/backend": "0.1.2"
+    "@atlasauth/backend": "0.7.0"
+  },
+  "peerDependencies": {
+    "next": ">=13.4"
+  },
+  "peerDependenciesMeta": {
+    "next": {
+      "optional": true
+    }
   },
   "devDependencies": {
     "typescript": "^5.6.3",
     "vitest": "^2.1.4",
-    "jose": "^5.9.6"
+    "jose": "^5.9.6",
+    "next": "^15.0.0"
   },
   "publishConfig": {
     "access": "public"
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.build.json",