@atlasauth/nextjs 0.1.4 → 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,45 @@
+# @atlasauth/nextjs changelog
+
+## 0.2.0
+
+### Added
+- **Next.js 16 `proxy.ts` support.** `atlasProxy(options)` returns `(request) => Promise<Response | null>`. It resolves to a `Response` when Atlas must act (the sign-in redirect, the cross-property handshake, or a JSON 401 for `/api/*`) and to `null` to let the rest of the proxy run. It takes the same options and makes the same decisions as `atlasMiddleware`. It uses only Web-standard APIs, so it runs on both the Node.js runtime (the Next 16 default) and the Edge runtime.
+- `withAtlasHeaders(request, response, auth?)` forwards the verified session to the app as request headers: `x-atlas-auth-status`, `x-atlas-user-id`, `x-atlas-session-id`, `x-atlas-org-id` and `x-atlas-org-role`. It works on a `NextResponse.next()` or a rewrite produced by any later step, such as next-intl, and merges with request-header overrides already set. It always drops `x-atlas-*` headers sent by the client.
+- `readAtlasHeaders(headers)` returns the forwarded session as a `ForwardedAuth` (`{ signedIn, userId, sessionId, orgId, orgRole }`). `proxyAuth(request)` returns the `AuthState` the proxy resolved for a request. `ATLAS_AUTH_HEADERS` names the header constants.
+- New types: `AtlasProxy`, `ProxyRequest`, `HeaderCarryingResponse`, `ForwardedAuth`.
+- **Locale-prefixed routes.** Route patterns accept whole-segment `:name` parameters (`/:locale/dashboard(.*)`). The new `MiddlewareConfig` fields `locales` and `defaultLocale` restrict a `:locale` segment to the listed locales and fill in a `signInUrl` such as `/:locale/sign-in` from the request. New exports: `localizeSignInUrl` and the `PatternOptions` type. `matchesPattern`, `matchesAny` and `createRouteMatcher` take an optional `PatternOptions` argument.
+- `createAtlasDecider(options)` exposes the runtime-neutral decision engine behind both `atlasMiddleware` and `atlasProxy`. It resolves to an `AtlasDecision` (`continue`, `redirect` with cookies, or `unauthorized`). New types: `AtlasDecision`, `AtlasCookie`. New constant: `UNAUTHENTICATED_BODY`.
+- A package README.
+
+### Changed
+- `atlasMiddleware` / `authMiddleware` now render the shared decision engine. Their behaviour and signature are unchanged.
+- Patterns without a `:name` segment keep their exact previous meaning.
+
+## 0.1.4
+
+### Added
+- New `@atlasauth/nextjs/server` entry with pre-bound, zero-argument `auth()` and `currentUser()`. They read the ambient request through `next/headers` and their config from `ATLAS_JWKS_URL` / `ATLAS_ISSUER` (or the `NEXT_PUBLIC_` forms). The base entry still doesn't need `next` installed.
+- `atlasClient()`: a configured `@atlasauth/backend` client built from `ATLAS_SECRET_KEY` (and `ATLAS_API_URL`, if set).
+- `configFromEnv()`, `backendConfigFromEnv()`, `buildEdgeRequest()`, and the `ServerAuth`, `CookieStoreLike` and `HeaderStoreLike` types.
+
+## 0.1.3
+
+### Added
+- `createRouteMatcher(patterns)`. It returns a predicate over a `NextRequest`, a `{ nextUrl }` / `{ url }` object, or a path string, using the same `(.*)` pattern engine as the middleware.
+
+## 0.1.2
+
+### Added
+- The middleware honours the durable signed-in hint (`__atlas_uat`, or the same-origin `__atlas_rt` cookie). A signed-in user whose short-lived `__session` has lapsed between refreshes is let through instead of being redirected to sign-in. Exported as `hasSignedInHint(request)`.
+- `authMiddleware`, an alias of `atlasMiddleware`.
+- `createCurrentUserHelper(options)` returns `currentUser(request)`. It gives a `CurrentUser` (`id`, `orgId`, `orgRole`, `email`, `name`, `firstName`, `lastName`), read from the verified session claims without a network call.
+
+## 0.1.1
+
+First release published under the `@atlasauth` scope.
+
+### Added
+- `atlasMiddleware(options)`: verifies the session JWT locally (JWKS cached in-process), protects routes by default (`publicRoutes` / `protectedRoutes`, where protected wins), returns a 401 JSON response for `/api/*`, skips static assets, and validates `redirect_url` (`safeRedirect`).
+- `createAuthHelper(options)` returns `auth(request)`, with `has(condition)` and `protect(condition)` over the full permission/role condition set shared with the other Atlas SDKs.
+- Cross-property SSO: `handshake: true` (with `publishableKey`, and optionally `fapiOrigin`) bounces a signed-out visitor through the Atlas handshake once, PKCE-bound and loop-guarded. A cross-domain return redeems the nonce and sets first-party `__session` / `__atlas_rt` cookies.
+- Exports: `resolveAuth`, `SIGNED_OUT`, `decideRoute`, `matchesPattern`, `matchesAny`, `isStaticAsset`, `DEFAULT_SIGN_IN_URL`, and the `AuthState`, `EdgeRequest`, `EdgeResponse`, `EdgeRedirect`, `EdgeCookies`, `MiddlewareConfig` and `RouteDecision` types.

package/README.md

@@ -0,0 +1,103 @@
+# @atlasauth/nextjs
+
+Atlas authentication for Next.js (App Router). It covers route protection in `middleware.ts` (Next 14/15) or `proxy.ts` (Next 16), plus `auth()` and `currentUser()` in server components and route handlers. Session tokens are verified locally against your instance's JWKS, so a warm instance makes no network call.
+
+```bash
+npm install @atlasauth/nextjs
+```
+
+`next` is an optional peer dependency (`>=13.4`, including 16).
+
+## Next.js 16: `proxy.ts`
+
+```ts
+// proxy.ts
+import { NextResponse, type NextRequest } from 'next/server';
+import { atlasProxy, withAtlasHeaders } from '@atlasauth/nextjs';
+
+const atlas = atlasProxy({
+  jwksUrl: 'https://auth.example.com/.well-known/jwks.json',
+  issuer: 'https://auth.example.com',
+  publicRoutes: ['/', '/sign-in(.*)', '/sign-up(.*)'],
+});
+
+export async function proxy(request: NextRequest) {
+  return (await atlas(request)) ?? withAtlasHeaders(request, NextResponse.next());
+}
+
+export const config = { matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'] };
+```
+
+- `atlas(request)` resolves to a `Response` when Atlas has to act (a sign-in redirect, the cross-property handshake, or a JSON 401 for `/api/*`). Otherwise it resolves to `null` and your proxy carries on.
+- `withAtlasHeaders(request, response)` forwards the verified session to your app on whatever response the rest of your proxy returns, as `x-atlas-auth-status`, `x-atlas-user-id`, `x-atlas-session-id`, `x-atlas-org-id` and `x-atlas-org-role` request headers. It merges with request-header overrides that other steps have already set, and it always drops `x-atlas-*` headers sent by the client. Read them in a server component with `readAtlasHeaders(await headers())`.
+- `proxyAuth(request)` returns the auth state the proxy already resolved, for extra checks inside `proxy.ts`.
+
+**Why `Response | null`?** In Next 16 the proxy is usually a chain (auth, then i18n, then your own logic), so Atlas returns a response only when it must and otherwise steps aside. The session is attached to the final response with `withAtlasHeaders`, and the token is verified only once.
+
+It uses only Web-standard APIs, so it runs on both the Node.js runtime (the Next 16 default) and the Edge runtime.
+
+### With next-intl
+
+```ts
+import createMiddleware from 'next-intl/middleware';
+import type { NextRequest } from 'next/server';
+import { atlasProxy, withAtlasHeaders } from '@atlasauth/nextjs';
+import { routing } from './i18n/routing';
+
+const intl = createMiddleware(routing);
+const atlas = atlasProxy({
+  jwksUrl: 'https://auth.example.com/.well-known/jwks.json',
+  issuer: 'https://auth.example.com',
+  locales: routing.locales,
+  defaultLocale: routing.defaultLocale,
+  publicRoutes: ['/', '/:locale', '/:locale/sign-in(.*)'],
+  protectedRoutes: ['/:locale/dashboard(.*)'],
+  signInUrl: '/:locale/sign-in', // /de/dashboard → /de/sign-in?redirect_url=…
+});
+
+export async function proxy(request: NextRequest) {
+  return (await atlas(request)) ?? withAtlasHeaders(request, intl(request));
+}
+```
+
+A `:locale` segment matches only the configured `locales`. Any other `:name` segment matches any single path segment.
+
+## Next.js 14/15: `middleware.ts`
+
+```ts
+import { authMiddleware } from '@atlasauth/nextjs';
+import { NextResponse, type NextRequest } from 'next/server';
+
+const middleware = authMiddleware({
+  jwksUrl: 'https://auth.example.com/.well-known/jwks.json',
+  issuer: 'https://auth.example.com',
+  publicRoutes: ['/', '/sign-in(.*)'],
+});
+
+export default function (request: NextRequest) {
+  return middleware(request, NextResponse);
+}
+```
+
+`atlasMiddleware` is the same function as `authMiddleware`.
+
+## Server components and route handlers
+
+```ts
+import { auth, currentUser } from '@atlasauth/nextjs/server';
+
+const { userId, protect } = await auth();
+const user = await currentUser(); // from the verified session claims, no network call
+```
+
+These read `ATLAS_JWKS_URL` and `ATLAS_ISSUER` (or their `NEXT_PUBLIC_` forms) from the environment.
+
+## Routing rules
+
+- Routes are protected unless they match `publicRoutes`. `protectedRoutes` wins over `publicRoutes`.
+- Patterns support a trailing `(.*)` and whole-segment `:name` parameters. They aren't regular expressions.
+- A signed-in user whose short-lived `__session` cookie has expired is let through on the durable signed-in hint, so the client can refresh it. It doesn't bounce to sign-in.
+
+## Changelog
+
+See [CHANGELOG.md](./CHANGELOG.md).

package/dist/index.d.ts

@@ -1,2 +1,3 @@
 export * from './matcher';
 export * from './middleware';
+export * from './proxy';

package/dist/index.js

@@ -16,4 +16,5 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./matcher"), exports);
 __exportStar(require("./middleware"), exports);
+__exportStar(require("./proxy"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,+CAA6B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,+CAA6B;AAC7B,0CAAwB"}

package/dist/matcher.d.ts

@@ -12,15 +12,26 @@
  * which is a loud failure rather than a silent breach.
  */
 /**
- * Patterns support one wildcard form: `(.*)` at the end, matching Next.js's own
- * matcher syntax so a developer writes one dialect rather than two.
+ * Patterns support two forms, both from Next.js's own matcher dialect so a
+ * developer writes one dialect rather than two:
+ *
+ * - `(.*)` at the end — matches the rest of the path (`/admin(.*)`).
+ * - `:name` as a whole segment — matches exactly one non-empty segment
+ *   (`/:locale/dashboard`). This is what makes locale-prefixed routing
+ *   (next-intl and friends) expressible. When {@link PatternOptions.locales} is
+ *   given, a `:locale` segment matches ONLY those values, so
+ *   `/:locale/sign-in` can't make `/admin/sign-in` public by accident.
  *
  * Deliberately NOT a general regex. A customer-authored regex in an
  * authorization path is a catastrophic-backtracking outage waiting to happen,
  * and `/admin(.*)` covers what anyone actually needs.
  */
-export declare function matchesPattern(pathname: string, pattern: string): boolean;
-export declare function matchesAny(pathname: string, patterns: readonly string[]): boolean;
+export interface PatternOptions {
+    /** The app's locales. Restricts what a `:locale` pattern segment matches. */
+    locales?: readonly string[];
+}
+export declare function matchesPattern(pathname: string, pattern: string, options?: PatternOptions): boolean;
+export declare function matchesAny(pathname: string, patterns: readonly string[], options?: PatternOptions): boolean;
 /**
  * §10.1 Clerk-parity `createRouteMatcher(patterns)` — the idiom integrators write
  * at the top of `middleware.ts` (`const isProtected = createRouteMatcher(['/dashboard(.*)'])`).
@@ -30,7 +41,7 @@ export declare function matchesAny(pathname: string, patterns: readonly string[]
  * matcher written here and the middleware's own routing agree exactly (no second
  * dialect, no customer regex in the auth path).
  */
-export declare function createRouteMatcher(patterns: readonly string[]): (input: string | {
+export declare function createRouteMatcher(patterns: readonly string[], options?: PatternOptions): (input: string | {
     nextUrl?: {
         pathname?: string;
     };
@@ -45,7 +56,23 @@ export interface MiddlewareConfig {
     signInUrl?: string;
     /** Exact origins a `redirect_url` may point at (§13.1). */
     allowedOrigins?: readonly string[];
+    /**
+     * The app's locales, for locale-prefixed routing (next-intl and similar). A
+     * `:locale` segment in `publicRoutes`/`protectedRoutes` then matches only
+     * these values, and a `signInUrl` containing `/:locale` is filled in from the
+     * request's own locale prefix.
+     */
+    locales?: readonly string[];
+    /** Locale used for a `/:locale` sign-in URL when the request carries none. When
+     *  absent, the `/:locale` segment is dropped and the i18n layer picks one. */
+    defaultLocale?: string;
 }
+/**
+ * Fill a `signInUrl` like `/:locale/sign-in` from the request path's locale
+ * prefix, so a signed-out visitor on `/de/dashboard` lands on `/de/sign-in`
+ * rather than bouncing through the i18n layer's own redirect.
+ */
+export declare function localizeSignInUrl(signInUrl: string, pathname: string, config?: Pick<MiddlewareConfig, 'locales' | 'defaultLocale'>): string;
 export declare const DEFAULT_SIGN_IN_URL = "/sign-in";
 export type RouteDecision = {
     action: 'skip';

package/dist/matcher.js

@@ -18,28 +18,51 @@ exports.matchesPattern = matchesPattern;
 exports.matchesAny = matchesAny;
 exports.createRouteMatcher = createRouteMatcher;
 exports.isStaticAsset = isStaticAsset;
+exports.localizeSignInUrl = localizeSignInUrl;
 exports.decideRoute = decideRoute;
 exports.safeRedirect = safeRedirect;
-/**
- * Patterns support one wildcard form: `(.*)` at the end, matching Next.js's own
- * matcher syntax so a developer writes one dialect rather than two.
- *
- * Deliberately NOT a general regex. A customer-authored regex in an
- * authorization path is a catastrophic-backtracking outage waiting to happen,
- * and `/admin(.*)` covers what anyone actually needs.
- */
-function matchesPattern(pathname, pattern) {
+function segmentMatches(actual, pattern, options) {
+    if (!pattern.startsWith(':'))
+        return actual === pattern;
+    if (actual === '')
+        return false;
+    if (pattern === ':locale' && options.locales)
+        return options.locales.includes(actual);
+    return true;
+}
+function matchesPattern(pathname, pattern, options = {}) {
     if (pattern === pathname)
         return true;
     const wildcard = pattern.indexOf('(.*)');
-    if (wildcard === -1)
-        return false;
     // Anything after the wildcard is meaningless — `(.*)` already matched it.
-    const prefix = pattern.slice(0, wildcard);
-    return pathname.startsWith(prefix);
+    const prefix = wildcard === -1 ? pattern : pattern.slice(0, wildcard);
+    // No `:param` segment: the original string semantics, unchanged.
+    if (!prefix.includes('/:')) {
+        return wildcard !== -1 && pathname.startsWith(prefix);
+    }
+    const want = prefix.split('/');
+    const have = pathname.split('/');
+    if (wildcard === -1) {
+        return (want.length === have.length &&
+            want.every((segment, i) => segmentMatches(have[i], segment, options)));
+    }
+    // Wildcard: every segment but the last matches whole; the last one keeps the
+    // string-prefix semantics (`/:locale/dash(.*)` matches `/en/dashboard`), and a
+    // trailing `:param` must still be present.
+    if (have.length < want.length)
+        return false;
+    const last = want.length - 1;
+    for (let i = 0; i < last; i++) {
+        if (!segmentMatches(have[i], want[i], options))
+            return false;
+    }
+    const tail = want[last];
+    return tail.startsWith(':')
+        ? segmentMatches(have[last], tail, options)
+        : have[last].startsWith(tail);
 }
-function matchesAny(pathname, patterns) {
-    return patterns.some((pattern) => matchesPattern(pathname, pattern));
+function matchesAny(pathname, patterns, options = {}) {
+    return patterns.some((pattern) => matchesPattern(pathname, pattern, options));
 }
 /**
  * §10.1 Clerk-parity `createRouteMatcher(patterns)` — the idiom integrators write
@@ -50,7 +73,7 @@ function matchesAny(pathname, patterns) {
  * matcher written here and the middleware's own routing agree exactly (no second
  * dialect, no customer regex in the auth path).
  */
-function createRouteMatcher(patterns) {
+function createRouteMatcher(patterns, options = {}) {
     return (input) => {
         let pathname;
         if (typeof input === 'string') {
@@ -61,7 +84,7 @@ function createRouteMatcher(patterns) {
             pathname =
                 input.nextUrl?.pathname ?? (input.url ? new URL(input.url, 'http://x').pathname : '');
         }
-        return matchesAny(pathname, patterns);
+        return matchesAny(pathname, patterns, options);
     };
 }
 /**
@@ -79,6 +102,20 @@ function isStaticAsset(pathname) {
     const last = pathname.split('/').pop() ?? '';
     return last.includes('.');
 }
+/**
+ * Fill a `signInUrl` like `/:locale/sign-in` from the request path's locale
+ * prefix, so a signed-out visitor on `/de/dashboard` lands on `/de/sign-in`
+ * rather than bouncing through the i18n layer's own redirect.
+ */
+function localizeSignInUrl(signInUrl, pathname, config = {}) {
+    if (!signInUrl.includes('/:locale'))
+        return signInUrl;
+    const first = pathname.split('/')[1] ?? '';
+    const locale = config.locales?.includes(first) ? first : config.defaultLocale;
+    return locale
+        ? signInUrl.replace('/:locale', `/${locale}`)
+        : signInUrl.replace('/:locale', '') || '/';
+}
 exports.DEFAULT_SIGN_IN_URL = '/sign-in';
 /**
  * Decide what to do with a request.
@@ -92,8 +129,9 @@ function decideRoute(input) {
     const config = input.config ?? {};
     if (isStaticAsset(input.pathname))
         return { action: 'skip' };
-    const explicitlyProtected = matchesAny(input.pathname, config.protectedRoutes ?? []);
-    const isPublic = !explicitlyProtected && matchesAny(input.pathname, config.publicRoutes ?? []);
+    const patternOptions = { locales: config.locales };
+    const explicitlyProtected = matchesAny(input.pathname, config.protectedRoutes ?? [], patternOptions);
+    const isPublic = !explicitlyProtected && matchesAny(input.pathname, config.publicRoutes ?? [], patternOptions);
     if (isPublic || input.signedIn)
         return { action: 'allow' };
     /**
@@ -103,7 +141,7 @@ function decideRoute(input) {
      */
     if (input.isApiRoute)
         return { action: 'unauthorized' };
-    const signInUrl = config.signInUrl ?? exports.DEFAULT_SIGN_IN_URL;
+    const signInUrl = localizeSignInUrl(config.signInUrl ?? exports.DEFAULT_SIGN_IN_URL, input.pathname, config);
     return {
         action: 'redirect',
         to: `${signInUrl}?redirect_url=${encodeURIComponent(input.pathname)}`,

package/dist/matcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"matcher.js","sourceRoot":"","sources":["../src/matcher.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAUH,wCASC;AAED,gCAEC;AAWD,gDAcC;AAWD,sCAKC;AA4BD,kCA4BC;AASD,oCAiBC;AAhJD;;;;;;;GAOG;AACH,SAAgB,cAAc,CAAC,QAAgB,EAAE,OAAe;IAC9D,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAElC,0EAA0E;IAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC1C,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,SAAgB,UAAU,CAAC,QAAgB,EAAE,QAA2B;IACtE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,kBAAkB,CAChC,QAA2B;IAE3B,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,IAAI,QAAgB,CAAC;QACrB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,oCAAoC;YACpC,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,QAAQ;gBACN,KAAK,CAAC,OAAO,EAAE,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;AAEnG,SAAgB,aAAa,CAAC,QAAgB;IAC5C,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,gDAAgD;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAYY,QAAA,mBAAmB,GAAG,UAAU,CAAC;AAQ9C;;;;;;;GAOG;AACH,SAAgB,WAAW,CAAC,KAM3B;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAElC,IAAI,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE7D,MAAM,mBAAmB,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,CAAC,mBAAmB,IAAI,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAE/F,IAAI,QAAQ,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAE3D;;;;OAIG;IACH,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAExD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,2BAAmB,CAAC;IAC1D,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,EAAE,EAAE,GAAG,SAAS,iBAAiB,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;KACtE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,YAAY,CAC1B,WAAsC,EACtC,iBAAoC,EAAE,EACtC,QAAQ,GAAG,GAAG;IAEd,IAAI,CAAC,WAAW;QAAE,OAAO,QAAQ,CAAC;IAElC,yEAAyE;IACzE,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClD,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,OAAO,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC"}
+{"version":3,"file":"matcher.js","sourceRoot":"","sources":["../src/matcher.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AA6BH,wCAqCC;AAED,gCAMC;AAWD,gDAeC;AAWD,sCAKC;AA2BD,8CAWC;AAkBD,kCAkCC;AASD,oCAiBC;AAlND,SAAS,cAAc,CAAC,MAAc,EAAE,OAAe,EAAE,OAAuB;IAC9E,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,KAAK,OAAO,CAAC;IACxD,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,cAAc,CAC5B,QAAgB,EAChB,OAAe,EACf,UAA0B,EAAE;IAE5B,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,0EAA0E;IAC1E,MAAM,MAAM,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAEtE,iEAAiE;IACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,QAAQ,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAC3B,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CACvE,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,+EAA+E;IAC/E,2CAA2C;IAC3C,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;IACjE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAE,CAAC;IACzB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAE,EAAE,IAAI,EAAE,OAAO,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,SAAgB,UAAU,CACxB,QAAgB,EAChB,QAA2B,EAC3B,UAA0B,EAAE;IAE5B,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,kBAAkB,CAChC,QAA2B,EAC3B,UAA0B,EAAE;IAE5B,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,IAAI,QAAgB,CAAC;QACrB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,oCAAoC;YACpC,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,QAAQ;gBACN,KAAK,CAAC,OAAO,EAAE,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;AAEnG,SAAgB,aAAa,CAAC,QAAgB;IAC5C,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,gDAAgD;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAsBD;;;;GAIG;AACH,SAAgB,iBAAiB,CAC/B,SAAiB,EACjB,QAAgB,EAChB,SAA8D,EAAE;IAEhE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC;IAC9E,OAAO,MAAM;QACX,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,MAAM,EAAE,CAAC;QAC7C,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAC/C,CAAC;AAEY,QAAA,mBAAmB,GAAG,UAAU,CAAC;AAQ9C;;;;;;;GAOG;AACH,SAAgB,WAAW,CAAC,KAM3B;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAElC,IAAI,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE7D,MAAM,cAAc,GAAmB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACnE,MAAM,mBAAmB,GAAG,UAAU,CACpC,KAAK,CAAC,QAAQ,EACd,MAAM,CAAC,eAAe,IAAI,EAAE,EAC5B,cAAc,CACf,CAAC;IACF,MAAM,QAAQ,GACZ,CAAC,mBAAmB,IAAI,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC;IAEhG,IAAI,QAAQ,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAE3D;;;;OAIG;IACH,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAExD,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,IAAI,2BAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrG,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,EAAE,EAAE,GAAG,SAAS,iBAAiB,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;KACtE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,YAAY,CAC1B,WAAsC,EACtC,iBAAoC,EAAE,EACtC,QAAQ,GAAG,GAAG;IAEd,IAAI,CAAC,WAAW;QAAE,OAAO,QAAQ,CAAC;IAElC,yEAAyE;IACzE,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClD,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,OAAO,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/middleware.d.ts

@@ -95,6 +95,48 @@ export declare function hasSignedInHint(request: EdgeRequest): boolean;
  * user needs anyway.
  */
 export declare function resolveAuth(backend: AtlasBackend, request: EdgeRequest): Promise<AuthState>;
+/** A first-party cookie Atlas wants set on the response it returns. */
+export interface AtlasCookie {
+    name: string;
+    value: string;
+    options: {
+        path?: string;
+        httpOnly?: boolean;
+        sameSite?: 'lax' | 'strict' | 'none';
+        secure?: boolean;
+        maxAge?: number;
+    };
+}
+/**
+ * What Atlas decided for one request, before it is rendered into any particular
+ * response type. `atlasMiddleware` renders it through Next's `NextResponse`
+ * helpers; `atlasProxy` renders it as a standard Web `Response`. Keeping the
+ * decision in one place means the two can never disagree about who is let in.
+ */
+export type AtlasDecision = {
+    kind: 'continue';
+    auth: AuthState;
+} | {
+    kind: 'redirect';
+    location: string;
+    cookies: AtlasCookie[];
+    auth: AuthState;
+} | {
+    kind: 'unauthorized';
+    auth: AuthState;
+};
+/**
+ * The runtime-neutral decision engine behind {@link atlasMiddleware} and
+ * `atlasProxy`. Uses only Web-standard APIs (`URL`, `fetch`, Web Crypto), so it
+ * runs unchanged on the Edge runtime and on Node.
+ */
+export declare function createAtlasDecider(options: AtlasMiddlewareOptions): (request: EdgeRequest) => Promise<AtlasDecision>;
+/** The JSON body Atlas answers an unauthenticated API request with. */
+export declare const UNAUTHENTICATED_BODY: {
+    readonly errors: readonly [{
+        readonly code: "UNAUTHENTICATED";
+    }];
+};
 export declare function atlasMiddleware(options: AtlasMiddlewareOptions): (request: EdgeRequest, response: EdgeResponse) => Promise<unknown>;
 /**
  * The `auth()` helper for server components and route handlers.

package/dist/middleware.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.safeRedirect = exports.authMiddleware = exports.SIGNED_OUT = void 0;
+exports.safeRedirect = exports.authMiddleware = exports.UNAUTHENTICATED_BODY = exports.SIGNED_OUT = void 0;
 exports.hasSignedInHint = hasSignedInHint;
 exports.resolveAuth = resolveAuth;
+exports.createAtlasDecider = createAtlasDecider;
 exports.atlasMiddleware = atlasMiddleware;
 exports.createAuthHelper = createAuthHelper;
 exports.createCurrentUserHelper = createCurrentUserHelper;
@@ -79,14 +80,19 @@ async function resolveAuth(backend, request) {
         claims: result.claims,
     };
 }
-function atlasMiddleware(options) {
+/**
+ * The runtime-neutral decision engine behind {@link atlasMiddleware} and
+ * `atlasProxy`. Uses only Web-standard APIs (`URL`, `fetch`, Web Crypto), so it
+ * runs unchanged on the Edge runtime and on Node.
+ */
+function createAtlasDecider(options) {
     const backend = new backend_1.AtlasBackend({
         jwksUrl: options.jwksUrl,
         issuer: options.issuer,
         authorizedParties: options.authorizedParties,
         fetchImpl: options.fetchImpl,
     });
-    return async function middleware(request, response) {
+    return async function decide(request) {
         /**
          * Cross-domain satellite RETURN: the handshake endpoint bounced the browser
          * back with `?__atlas_hs=ok&__atlas_hu=<userId>&__atlas_hn=<nonce>`. Exchange
@@ -123,17 +129,21 @@ function atlasMiddleware(options) {
                 for (const k of ['__atlas_hs', '__atlas_hu', '__atlas_hn'])
                     clean.searchParams.delete(k);
                 if (session) {
-                    const res = response.redirect(clean.toString());
-                    res.cookies?.set('__session', session.jwt, { path: '/', sameSite: 'lax', secure: true });
-                    res.cookies?.set('__atlas_rt', session.refreshToken, {
-                        path: '/',
-                        httpOnly: true,
-                        sameSite: 'lax',
-                        secure: true,
-                    });
-                    // The verifier is spent — clear it so it can't be reused or leak.
-                    res.cookies?.set('__atlas_hv', '', { path: '/', maxAge: 0 });
-                    return res;
+                    return {
+                        kind: 'redirect',
+                        location: clean.toString(),
+                        auth: exports.SIGNED_OUT,
+                        cookies: [
+                            { name: '__session', value: session.jwt, options: { path: '/', sameSite: 'lax', secure: true } },
+                            {
+                                name: '__atlas_rt',
+                                value: session.refreshToken,
+                                options: { path: '/', httpOnly: true, sameSite: 'lax', secure: true },
+                            },
+                            // The verifier is spent — clear it so it can't be reused or leak.
+                            { name: '__atlas_hv', value: '', options: { path: '/', maxAge: 0 } },
+                        ],
+                    };
                 }
                 // A bad/expired/replayed nonce, a rejected PKCE proof, or no verifier →
                 // no session. Carry a SPENT marker (__atlas_hs=failed) instead of a clean
@@ -141,9 +151,12 @@ function atlasMiddleware(options) {
                 // URL here would bounce straight back to the handshake forever. With the
                 // marker, normal routing takes over and sends the user to sign-in.
                 clean.searchParams.set('__atlas_hs', 'failed');
-                const res = response.redirect(clean.toString());
-                res.cookies?.set('__atlas_hv', '', { path: '/', maxAge: 0 });
-                return res;
+                return {
+                    kind: 'redirect',
+                    location: clean.toString(),
+                    auth: exports.SIGNED_OUT,
+                    cookies: [{ name: '__atlas_hv', value: '', options: { path: '/', maxAge: 0 } }],
+                };
             }
         }
         const auth = await resolveAuth(backend, request);
@@ -156,9 +169,9 @@ function atlasMiddleware(options) {
         switch (decision.action) {
             case 'skip':
             case 'allow':
-                return response.next();
+                return { kind: 'continue', auth };
             case 'unauthorized':
-                return response.json({ errors: [{ code: 'UNAUTHENTICATED' }] }, { status: 401 });
+                return { kind: 'unauthorized', auth };
             case 'redirect': {
                 /**
                  * §R3.1 FIRST, don't bounce a user who is actually signed in here but
@@ -171,7 +184,7 @@ function atlasMiddleware(options) {
                  * common "same-property, token just expired" case never leaves the app.
                  */
                 if (hasSignedInHint(request))
-                    return response.next();
+                    return { kind: 'continue', auth };
                 /**
                  * Cross-property handshake: before sending a signed-out user to the
                  * sign-in page, try the Atlas handshake ONCE — they may already have a
@@ -193,15 +206,24 @@ function atlasMiddleware(options) {
                         hs.searchParams.set('publishable_key', options.publishableKey);
                         hs.searchParams.set('redirect_url', current.toString());
                         hs.searchParams.set('code_challenge', challenge);
-                        const res = response.redirect(hs.toString());
-                        res.cookies?.set('__atlas_hv', verifier, {
-                            path: '/',
-                            httpOnly: true,
-                            sameSite: 'lax',
-                            secure: true,
-                            maxAge: 300, // the handshake round trip is seconds; don't linger
-                        });
-                        return res;
+                        return {
+                            kind: 'redirect',
+                            location: hs.toString(),
+                            auth,
+                            cookies: [
+                                {
+                                    name: '__atlas_hv',
+                                    value: verifier,
+                                    options: {
+                                        path: '/',
+                                        httpOnly: true,
+                                        sameSite: 'lax',
+                                        secure: true,
+                                        maxAge: 300, // the handshake round trip is seconds; don't linger
+                                    },
+                                },
+                            ],
+                        };
                     }
                 }
                 /**
@@ -211,7 +233,28 @@ function atlasMiddleware(options) {
                  * would otherwise be carried forward unchecked (§13.1).
                  */
                 const base = request.url ? new URL(request.url).origin : '';
-                return response.redirect(`${base}${decision.to}`);
+                return { kind: 'redirect', location: `${base}${decision.to}`, auth, cookies: [] };
+            }
+        }
+    };
+}
+/** The JSON body Atlas answers an unauthenticated API request with. */
+exports.UNAUTHENTICATED_BODY = { errors: [{ code: 'UNAUTHENTICATED' }] };
+function atlasMiddleware(options) {
+    const decide = createAtlasDecider(options);
+    return async function middleware(request, response) {
+        const decision = await decide(request);
+        switch (decision.kind) {
+            case 'continue':
+                return response.next();
+            case 'unauthorized':
+                return response.json(exports.UNAUTHENTICATED_BODY, { status: 401 });
+            case 'redirect': {
+                const res = response.redirect(decision.location);
+                for (const cookie of decision.cookies) {
+                    res.cookies?.set(cookie.name, cookie.value, cookie.options);
+                }
+                return res;
             }
         }
     };

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":";;;AAgHA,0CAMC;AAUD,kCAkBC;AAED,0CA+IC;AASD,4CAsCC;AA6BD,0DAqBC;AApYD,gDAS4B;AAC5B,uCAA6E;AA4XpE,6FA5Xa,sBAAY,OA4Xb;AA1TR,QAAA,UAAU,GAAc;IACnC,MAAM,EAAE,IAAI;IACZ,SAAS,EAAE,IAAI;IACf,KAAK,EAAE,IAAI;IACX,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,SAAS,UAAU,CAAC,MAAqB,EAAE,IAAY;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,eAAe,CAAC,OAAoB;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC9C,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,2EAA2E;IAC3E,OAAO,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,WAAW,CAAC,OAAqB,EAAE,OAAoB;IAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;IAEtE,MAAM,KAAK,GAAG,MAAM,IAAI,MAAM,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,kBAAU,CAAC;IAE9B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,kBAAU,CAAC;IAElC,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;QACzB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;QAC5B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI;QACnC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe,CAAC,OAA+B;IAC7D,MAAM,OAAO,GAAG,IAAI,sBAAY,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IAEH,OAAO,KAAK,UAAU,UAAU,CAAC,OAAoB,EAAE,QAAsB;QAC3E;;;;;;;;;;WAUG;QACH,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACjD,IAAI,EAAE,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;gBACnC,uEAAuE;gBACvE,wEAAwE;gBACxE,uEAAuE;gBACvE,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC;gBAC7E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;gBACzE,MAAM,OAAO,GAAG,YAAY;oBAC1B,CAAC,CAAC,MAAM,IAAA,yBAAe,EAAC;wBACpB,UAAU;wBACV,cAAc,EAAE,OAAO,CAAC,cAAc;wBACtC,MAAM;wBACN,KAAK;wBACL,YAAY;wBACZ,SAAS,EAAE,OAAO,CAAC,SAAS;qBAC7B,CAAC;oBACJ,CAAC,CAAC,IAAI,CAAC;gBAET,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACtC,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC;oBAAE,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAEzF,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAChD,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBACzF,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;wBACnD,IAAI,EAAE,GAAG;wBACT,QAAQ,EAAE,IAAI;wBACd,QAAQ,EAAE,KAAK;wBACf,MAAM,EAAE,IAAI;qBACb,CAAC,CAAC;oBACH,kEAAkE;oBAClE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;oBAC7D,OAAO,GAAG,CAAC;gBACb,CAAC;gBAED,wEAAwE;gBACxE,0EAA0E;gBAC1E,0EAA0E;gBAC1E,yEAAyE;gBACzE,mEAAmE;gBACnE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;gBAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAChD,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC7D,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEjD,MAAM,QAAQ,GAAG,IAAA,qBAAW,EAAC;YAC3B,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;YAClC,QAAQ,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;YAC9B,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;SACzD,CAAC,CAAC;QAEH,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC;YACZ,KAAK,OAAO;gBACV,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;YAEzB,KAAK,cAAc;gBACjB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAEnF,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB;;;;;;;;;mBASG;gBACH,IAAI,eAAe,CAAC,OAAO,CAAC;oBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACrD;;;;;;;;mBAQG;gBACH,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;oBAC/D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACrC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;wBAC5C,gEAAgE;wBAChE,6DAA6D;wBAC7D,iEAAiE;wBACjE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,IAAA,wBAAc,GAAE,CAAC;wBACvD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;wBACzE,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC;wBACvD,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;wBAC/D,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;wBACxD,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;wBACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;wBAC7C,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE;4BACvC,IAAI,EAAE,GAAG;4BACT,QAAQ,EAAE,IAAI;4BACd,QAAQ,EAAE,KAAK;4BACf,MAAM,EAAE,IAAI;4BACZ,MAAM,EAAE,GAAG,EAAE,oDAAoD;yBAClE,CAAC,CAAC;wBACH,OAAO,GAAG,CAAC;oBACb,CAAC;gBACH,CAAC;gBACD;;;;;mBAKG;gBACH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,OAA+B;IAC9D,MAAM,OAAO,GAAG,IAAI,sBAAY,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IAEH,OAAO,KAAK,UAAU,IAAI,CAAC,OAAoB;QAiB7C,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAElD,OAAO;YACL,GAAG,KAAK;YACR,GAAG,CAAC,SAAS,GAAG,EAAE;gBAChB,OAAO,IAAA,uBAAa,EAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,CAAC,YAA8B,EAAE;gBACtC,MAAM,OAAO,GAAG,IAAA,kBAAQ,EAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBAClD,IAAI,CAAC,OAAO,CAAC,OAAO;oBAAE,MAAM,IAAI,wBAAc,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC5E,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACU,QAAA,cAAc,GAAG,eAAe,CAAC;AAe9C;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,OAA+B;IACrE,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,KAAK,UAAU,WAAW,CAAC,OAAoB;QACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,CAAC,GAAG,KAAK,CAAC,MAKf,CAAC;QACF,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,MAAM;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;YACpB,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;YAC/B,QAAQ,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;SAChC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":";;;AAgHA,0CAMC;AAUD,kCAkBC;AA+BD,gDA+JC;AAKD,0CAmBC;AASD,4CAsCC;AA6BD,0DAqBC;AAzcD,gDAS4B;AAC5B,uCAA6E;AAicpE,6FAjca,sBAAY,OAicb;AA/XR,QAAA,UAAU,GAAc;IACnC,MAAM,EAAE,IAAI;IACZ,SAAS,EAAE,IAAI;IACf,KAAK,EAAE,IAAI;IACX,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,SAAS,UAAU,CAAC,MAAqB,EAAE,IAAY;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,eAAe,CAAC,OAAoB;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC9C,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,2EAA2E;IAC3E,OAAO,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,WAAW,CAAC,OAAqB,EAAE,OAAoB;IAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;IAEtE,MAAM,KAAK,GAAG,MAAM,IAAI,MAAM,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,kBAAU,CAAC;IAE9B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,kBAAU,CAAC;IAElC,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;QACzB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;QAC5B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI;QACnC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC;AA0BD;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,OAA+B;IAChE,MAAM,OAAO,GAAG,IAAI,sBAAY,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IAEH,OAAO,KAAK,UAAU,MAAM,CAAC,OAAoB;QAC/C;;;;;;;;;;WAUG;QACH,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACjD,IAAI,EAAE,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;gBACnC,uEAAuE;gBACvE,wEAAwE;gBACxE,uEAAuE;gBACvE,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC;gBAC7E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;gBACzE,MAAM,OAAO,GAAG,YAAY;oBAC1B,CAAC,CAAC,MAAM,IAAA,yBAAe,EAAC;wBACpB,UAAU;wBACV,cAAc,EAAE,OAAO,CAAC,cAAc;wBACtC,MAAM;wBACN,KAAK;wBACL,YAAY;wBACZ,SAAS,EAAE,OAAO,CAAC,SAAS;qBAC7B,CAAC;oBACJ,CAAC,CAAC,IAAI,CAAC;gBAET,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACtC,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC;oBAAE,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAEzF,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO;wBACL,IAAI,EAAE,UAAU;wBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;wBAC1B,IAAI,EAAE,kBAAU;wBAChB,OAAO,EAAE;4BACP,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;4BAChG;gCACE,IAAI,EAAE,YAAY;gCAClB,KAAK,EAAE,OAAO,CAAC,YAAY;gCAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;6BACtE;4BACD,kEAAkE;4BAClE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE;yBACrE;qBACF,CAAC;gBACJ,CAAC;gBAED,wEAAwE;gBACxE,0EAA0E;gBAC1E,0EAA0E;gBAC1E,yEAAyE;gBACzE,mEAAmE;gBACnE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;gBAC/C,OAAO;oBACL,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;oBAC1B,IAAI,EAAE,kBAAU;oBAChB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;iBAChF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEjD,MAAM,QAAQ,GAAG,IAAA,qBAAW,EAAC;YAC3B,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;YAClC,QAAQ,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;YAC9B,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;SACzD,CAAC,CAAC;QAEH,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC;YACZ,KAAK,OAAO;gBACV,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAEpC,KAAK,cAAc;gBACjB,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;YAExC,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB;;;;;;;;;mBASG;gBACH,IAAI,eAAe,CAAC,OAAO,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;gBAChE;;;;;;;;mBAQG;gBACH,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;oBAC/D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACrC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;wBAC5C,gEAAgE;wBAChE,6DAA6D;wBAC7D,iEAAiE;wBACjE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,IAAA,wBAAc,GAAE,CAAC;wBACvD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;wBACzE,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC;wBACvD,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;wBAC/D,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;wBACxD,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;wBACjD,OAAO;4BACL,IAAI,EAAE,UAAU;4BAChB,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE;4BACvB,IAAI;4BACJ,OAAO,EAAE;gCACP;oCACE,IAAI,EAAE,YAAY;oCAClB,KAAK,EAAE,QAAQ;oCACf,OAAO,EAAE;wCACP,IAAI,EAAE,GAAG;wCACT,QAAQ,EAAE,IAAI;wCACd,QAAQ,EAAE,KAAK;wCACf,MAAM,EAAE,IAAI;wCACZ,MAAM,EAAE,GAAG,EAAE,oDAAoD;qCAClE;iCACF;6BACF;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD;;;;;mBAKG;gBACH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACpF,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,uEAAuE;AAC1D,QAAA,oBAAoB,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAW,CAAC;AAEvF,SAAgB,eAAe,CAAC,OAA+B;IAC7D,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE3C,OAAO,KAAK,UAAU,UAAU,CAAC,OAAoB,EAAE,QAAsB;QAC3E,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtB,KAAK,UAAU;gBACb,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,cAAc;gBACjB,OAAO,QAAQ,CAAC,IAAI,CAAC,4BAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACjD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC9D,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,OAA+B;IAC9D,MAAM,OAAO,GAAG,IAAI,sBAAY,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IAEH,OAAO,KAAK,UAAU,IAAI,CAAC,OAAoB;QAiB7C,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAElD,OAAO;YACL,GAAG,KAAK;YACR,GAAG,CAAC,SAAS,GAAG,EAAE;gBAChB,OAAO,IAAA,uBAAa,EAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,CAAC,YAA8B,EAAE;gBACtC,MAAM,OAAO,GAAG,IAAA,kBAAQ,EAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBAClD,IAAI,CAAC,OAAO,CAAC,OAAO;oBAAE,MAAM,IAAI,wBAAc,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC5E,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACU,QAAA,cAAc,GAAG,eAAe,CAAC;AAe9C;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,OAA+B;IACrE,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,KAAK,UAAU,WAAW,CAAC,OAAoB;QACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,CAAC,GAAG,KAAK,CAAC,MAKf,CAAC;QACF,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,MAAM;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;YACpB,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;YAC/B,QAAQ,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;SAChC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/proxy.d.ts

@@ -0,0 +1,96 @@
+import { type AtlasMiddlewareOptions, type AuthState, type EdgeRequest } from './middleware';
+/**
+ * Next.js 16 renamed `middleware.ts` to `proxy.ts` (exporting `proxy` or a
+ * default function) and made it run on the Node.js runtime by default. A proxy
+ * is usually a CHAIN — auth, then i18n (next-intl), then whatever else — so the
+ * shape that composes is not "Atlas returns the final response" but "Atlas
+ * returns a response only when it must act, otherwise steps aside":
+ *
+ * ```ts
+ * const atlas = atlasProxy({ ... });
+ * export async function proxy(req: NextRequest) {
+ *   return (await atlas(req)) ?? withAtlasHeaders(req, intl(req));
+ * }
+ * ```
+ *
+ * `atlas(req)` resolves to a `Response` (sign-in redirect, handshake bounce,
+ * 401 for an API route) or `null` (let the app continue). The verified auth
+ * state is remembered for that request, so {@link withAtlasHeaders} can forward
+ * it to the app on WHATEVER response the rest of the chain produced — without
+ * verifying the token a second time and without Atlas having to own the final
+ * response.
+ *
+ * Everything here is Web-standard (`Response`, `Headers`, `URL`, Web Crypto),
+ * so the same proxy runs on the Node.js runtime and on the Edge runtime.
+ */
+/** Request headers the proxy forwards to the app (server components, route
+ *  handlers) describing the verified session. */
+export declare const ATLAS_AUTH_HEADERS: {
+    readonly status: "x-atlas-auth-status";
+    readonly userId: "x-atlas-user-id";
+    readonly sessionId: "x-atlas-session-id";
+    readonly orgId: "x-atlas-org-id";
+    readonly orgRole: "x-atlas-org-role";
+};
+/** What `atlasProxy` needs from a request: a `NextRequest` satisfies it. */
+export interface ProxyRequest extends EdgeRequest {
+    headers: {
+        get(name: string): string | null;
+        forEach(callback: (value: string, key: string) => void): void;
+    };
+}
+/** The request-headers slice of a response — `NextResponse` and `Response`
+ *  both satisfy it. */
+export interface HeaderCarryingResponse {
+    status: number;
+    headers: Headers;
+}
+export type AtlasProxy = (request: ProxyRequest) => Promise<Response | null>;
+/**
+ * The Next.js 16 `proxy.ts` entry for Atlas. Same options, same decisions as
+ * `atlasMiddleware` (they share one engine) — only the calling convention
+ * differs: it takes just the request and resolves to `Response | null`.
+ */
+export declare function atlasProxy(options: AtlasMiddlewareOptions): AtlasProxy;
+/**
+ * The auth state the proxy resolved for this request (signed-out if the proxy
+ * hasn't run on it). For extra checks inside `proxy.ts` itself — a role gate on
+ * `/admin`, say — without verifying the token again.
+ */
+export declare function proxyAuth(request: object): AuthState;
+/**
+ * Forward the verified session to the app as `x-atlas-*` REQUEST headers on a
+ * response produced by any later step of the chain (`NextResponse.next()`, a
+ * next-intl rewrite, …). Returns the same response, for `return withAtlasHeaders(...)`.
+ *
+ * It speaks Next's request-header override protocol (what
+ * `NextResponse.next({ request: { headers } })` emits), MERGING with any
+ * override a previous step already set rather than clobbering it, so it composes
+ * with next-intl or your own header tweaks in either order.
+ *
+ * Any `x-atlas-*` header the CLIENT sent is always dropped — a browser can't
+ * forge `x-atlas-user-id` past the proxy. Responses that don't continue to the
+ * app (redirects, direct bodies) are returned untouched: there's no downstream
+ * request to carry headers.
+ *
+ * `auth` defaults to what {@link atlasProxy} resolved for `request`, or
+ * signed-out if it didn't run.
+ */
+export declare function withAtlasHeaders<R extends HeaderCarryingResponse>(request: ProxyRequest, response: R, auth?: AuthState): R;
+/** The session as forwarded by {@link withAtlasHeaders}. */
+export interface ForwardedAuth {
+    signedIn: boolean;
+    userId: string | null;
+    sessionId: string | null;
+    orgId: string | null;
+    orgRole: string | null;
+}
+/**
+ * Read the `x-atlas-*` headers the proxy forwarded (e.g. from `await headers()`
+ * in a server component). Cheap — no verification — so use it for rendering
+ * decisions; keep authorization on `auth()`/`protect()`, which verify the token
+ * themselves and don't depend on the proxy's matcher covering the route.
+ */
+export declare function readAtlasHeaders(headers: {
+    get(name: string): string | null;
+}): ForwardedAuth;

package/dist/proxy.js

@@ -0,0 +1,189 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ATLAS_AUTH_HEADERS = void 0;
+exports.atlasProxy = atlasProxy;
+exports.proxyAuth = proxyAuth;
+exports.withAtlasHeaders = withAtlasHeaders;
+exports.readAtlasHeaders = readAtlasHeaders;
+const middleware_1 = require("./middleware");
+/**
+ * Next.js 16 renamed `middleware.ts` to `proxy.ts` (exporting `proxy` or a
+ * default function) and made it run on the Node.js runtime by default. A proxy
+ * is usually a CHAIN — auth, then i18n (next-intl), then whatever else — so the
+ * shape that composes is not "Atlas returns the final response" but "Atlas
+ * returns a response only when it must act, otherwise steps aside":
+ *
+ * ```ts
+ * const atlas = atlasProxy({ ... });
+ * export async function proxy(req: NextRequest) {
+ *   return (await atlas(req)) ?? withAtlasHeaders(req, intl(req));
+ * }
+ * ```
+ *
+ * `atlas(req)` resolves to a `Response` (sign-in redirect, handshake bounce,
+ * 401 for an API route) or `null` (let the app continue). The verified auth
+ * state is remembered for that request, so {@link withAtlasHeaders} can forward
+ * it to the app on WHATEVER response the rest of the chain produced — without
+ * verifying the token a second time and without Atlas having to own the final
+ * response.
+ *
+ * Everything here is Web-standard (`Response`, `Headers`, `URL`, Web Crypto),
+ * so the same proxy runs on the Node.js runtime and on the Edge runtime.
+ */
+/** Request headers the proxy forwards to the app (server components, route
+ *  handlers) describing the verified session. */
+exports.ATLAS_AUTH_HEADERS = {
+    status: 'x-atlas-auth-status',
+    userId: 'x-atlas-user-id',
+    sessionId: 'x-atlas-session-id',
+    orgId: 'x-atlas-org-id',
+    orgRole: 'x-atlas-org-role',
+};
+const ATLAS_HEADER_PREFIX = 'x-atlas-';
+const OVERRIDE_LIST = 'x-middleware-override-headers';
+const OVERRIDE_PREFIX = 'x-middleware-request-';
+/** Auth state per request, recorded by the proxy for `withAtlasHeaders` /
+ *  `proxyAuth`. Weak, so a finished request's state is collected with it. */
+const resolved = new WeakMap();
+function serializeCookie({ name, value, options }) {
+    // Same encoding Next's `response.cookies.set` applies, so readers agree.
+    const parts = [`${name}=${encodeURIComponent(value)}`];
+    if (options.path)
+        parts.push(`Path=${options.path}`);
+    if (options.maxAge !== undefined)
+        parts.push(`Max-Age=${options.maxAge}`);
+    if (options.httpOnly)
+        parts.push('HttpOnly');
+    if (options.secure)
+        parts.push('Secure');
+    if (options.sameSite) {
+        parts.push(`SameSite=${options.sameSite[0].toUpperCase()}${options.sameSite.slice(1)}`);
+    }
+    return parts.join('; ');
+}
+/**
+ * The Next.js 16 `proxy.ts` entry for Atlas. Same options, same decisions as
+ * `atlasMiddleware` (they share one engine) — only the calling convention
+ * differs: it takes just the request and resolves to `Response | null`.
+ */
+function atlasProxy(options) {
+    const decide = (0, middleware_1.createAtlasDecider)(options);
+    return async function proxy(request) {
+        const decision = await decide(request);
+        resolved.set(request, decision.auth);
+        switch (decision.kind) {
+            case 'continue':
+                return null;
+            case 'unauthorized':
+                return new Response(JSON.stringify(middleware_1.UNAUTHENTICATED_BODY), {
+                    status: 401,
+                    headers: { 'content-type': 'application/json' },
+                });
+            case 'redirect': {
+                // Built by hand rather than `Response.redirect`, whose headers are
+                // immutable — the handshake legs must also set first-party cookies.
+                const headers = new Headers({ location: decision.location });
+                for (const cookie of decision.cookies)
+                    headers.append('set-cookie', serializeCookie(cookie));
+                return new Response(null, { status: 307, headers });
+            }
+        }
+    };
+}
+/**
+ * The auth state the proxy resolved for this request (signed-out if the proxy
+ * hasn't run on it). For extra checks inside `proxy.ts` itself — a role gate on
+ * `/admin`, say — without verifying the token again.
+ */
+function proxyAuth(request) {
+    return resolved.get(request) ?? middleware_1.SIGNED_OUT;
+}
+function authHeaderValues(auth) {
+    const values = [
+        [exports.ATLAS_AUTH_HEADERS.status, auth.userId ? 'signed-in' : 'signed-out'],
+    ];
+    if (auth.userId)
+        values.push([exports.ATLAS_AUTH_HEADERS.userId, auth.userId]);
+    if (auth.sessionId)
+        values.push([exports.ATLAS_AUTH_HEADERS.sessionId, auth.sessionId]);
+    if (auth.orgId)
+        values.push([exports.ATLAS_AUTH_HEADERS.orgId, auth.orgId]);
+    if (auth.orgRole)
+        values.push([exports.ATLAS_AUTH_HEADERS.orgRole, auth.orgRole]);
+    return values;
+}
+/**
+ * Forward the verified session to the app as `x-atlas-*` REQUEST headers on a
+ * response produced by any later step of the chain (`NextResponse.next()`, a
+ * next-intl rewrite, …). Returns the same response, for `return withAtlasHeaders(...)`.
+ *
+ * It speaks Next's request-header override protocol (what
+ * `NextResponse.next({ request: { headers } })` emits), MERGING with any
+ * override a previous step already set rather than clobbering it, so it composes
+ * with next-intl or your own header tweaks in either order.
+ *
+ * Any `x-atlas-*` header the CLIENT sent is always dropped — a browser can't
+ * forge `x-atlas-user-id` past the proxy. Responses that don't continue to the
+ * app (redirects, direct bodies) are returned untouched: there's no downstream
+ * request to carry headers.
+ *
+ * `auth` defaults to what {@link atlasProxy} resolved for `request`, or
+ * signed-out if it didn't run.
+ */
+function withAtlasHeaders(request, response, auth = proxyAuth(request)) {
+    const continues = response.headers.has('x-middleware-next') || response.headers.has('x-middleware-rewrite');
+    if (!continues)
+        return response;
+    const existing = response.headers.get(OVERRIDE_LIST);
+    const names = new Set();
+    if (existing !== null) {
+        // An earlier step already chose the full downstream header set; keep its
+        // choices and only take over the `x-atlas-*` namespace.
+        for (const raw of existing.split(',')) {
+            const name = raw.trim().toLowerCase();
+            if (!name)
+                continue;
+            if (name.startsWith(ATLAS_HEADER_PREFIX)) {
+                response.headers.delete(`${OVERRIDE_PREFIX}${name}`);
+            }
+            else {
+                names.add(name);
+            }
+        }
+    }
+    else {
+        // First override: start from the incoming request headers, as
+        // `NextResponse.next({ request: { headers: new Headers(req.headers) } })` does.
+        request.headers.forEach((value, key) => {
+            const name = key.toLowerCase();
+            if (name.startsWith(ATLAS_HEADER_PREFIX))
+                return;
+            names.add(name);
+            response.headers.set(`${OVERRIDE_PREFIX}${name}`, value);
+        });
+    }
+    for (const [name, value] of authHeaderValues(auth)) {
+        names.add(name);
+        response.headers.set(`${OVERRIDE_PREFIX}${name}`, value);
+    }
+    response.headers.set(OVERRIDE_LIST, [...names].join(','));
+    return response;
+}
+/**
+ * Read the `x-atlas-*` headers the proxy forwarded (e.g. from `await headers()`
+ * in a server component). Cheap — no verification — so use it for rendering
+ * decisions; keep authorization on `auth()`/`protect()`, which verify the token
+ * themselves and don't depend on the proxy's matcher covering the route.
+ */
+function readAtlasHeaders(headers) {
+    const userId = headers.get(exports.ATLAS_AUTH_HEADERS.userId);
+    const signedIn = headers.get(exports.ATLAS_AUTH_HEADERS.status) === 'signed-in' && Boolean(userId);
+    return {
+        signedIn,
+        userId: signedIn ? userId : null,
+        sessionId: signedIn ? headers.get(exports.ATLAS_AUTH_HEADERS.sessionId) : null,
+        orgId: signedIn ? headers.get(exports.ATLAS_AUTH_HEADERS.orgId) : null,
+        orgRole: signedIn ? headers.get(exports.ATLAS_AUTH_HEADERS.orgRole) : null,
+    };
+}
+//# sourceMappingURL=proxy.js.map

package/dist/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":";;;AAwFA,gCA0BC;AAOD,8BAEC;AA+BD,4CAyCC;AAiBD,4CAUC;AA9ND,6CAQsB;AAEtB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;iDACiD;AACpC,QAAA,kBAAkB,GAAG;IAChC,MAAM,EAAE,qBAAqB;IAC7B,MAAM,EAAE,iBAAiB;IACzB,SAAS,EAAE,oBAAoB;IAC/B,KAAK,EAAE,gBAAgB;IACvB,OAAO,EAAE,kBAAkB;CACnB,CAAC;AAEX,MAAM,mBAAmB,GAAG,UAAU,CAAC;AACvC,MAAM,aAAa,GAAG,+BAA+B,CAAC;AACtD,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAmBhD;6EAC6E;AAC7E,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAqB,CAAC;AAElD,SAAS,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAe;IAC5D,yEAAyE;IACzE,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CAAC,OAA+B;IACxD,MAAM,MAAM,GAAG,IAAA,+BAAkB,EAAC,OAAO,CAAC,CAAC;IAE3C,OAAO,KAAK,UAAU,KAAK,CAAC,OAAO;QACjC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAErC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtB,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC;YAEd,KAAK,cAAc;gBACjB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,iCAAoB,CAAC,EAAE;oBACxD,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CAAC,CAAC;YAEL,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,mEAAmE;gBACnE,oEAAoE;gBACpE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC7D,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO;oBAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC7F,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,SAAS,CAAC,OAAe;IACvC,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,uBAAU,CAAC;AAC7C,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAe;IACvC,MAAM,MAAM,GAA4B;QACtC,CAAC,0BAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;KACtE,CAAC;IACF,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,0BAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,IAAI,IAAI,CAAC,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,0BAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAChF,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,0BAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,IAAI,IAAI,CAAC,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,0BAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,gBAAgB,CAC9B,OAAqB,EACrB,QAAW,EACX,OAAkB,SAAS,CAAC,OAAO,CAAC;IAEpC,MAAM,SAAS,GACb,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC5F,IAAI,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAC;IAEhC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,yEAAyE;QACzE,wDAAwD;QACxD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACzC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,CAAC,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,8DAA8D;QAC9D,gFAAgF;QAChF,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;gBAAE,OAAO;YACjD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAWD;;;;;GAKG;AACH,SAAgB,gBAAgB,CAAC,OAA6C;IAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,MAAM,CAAC,KAAK,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3F,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAChC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;QACtE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;QAC9D,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;KACnE,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/nextjs",
-  "version": "0.1.4",
+  "version": "0.2.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -15,7 +15,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@atlasauth/backend": "0.1.2"
+    "@atlasauth/backend": "0.7.0"
   },
   "peerDependencies": {
     "next": ">=13.4"
@@ -36,7 +36,8 @@
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.build.json",