@atlasauth/nextjs 0.3.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @atlasauth/nextjs changelog
 
+## 0.5.0 — 2026-10-24
+
+### Added
+
+- `@atlasauth/nextjs/compat`: server-side drop-in helpers for apps migrated from Auth.js (`getServerSessionCompat`, `nextAuthCompat`, server `signIn`/`signOut`), Auth0 (`getAuth0SessionCompat`, `withApiAuthRequiredCompat`, `withPageAuthRequiredCompat`, `handleAuthCompat`, `Auth0ClientCompat`), Supabase Auth (`getSupabaseUserCompat`, `getSupabaseSessionCompat`, `supabaseSignOutCompat`) and Better Auth (`createBetterAuthServerCompat`, `toNextJsHandlerCompat`, `getSessionCookieCompat`), and `createAtlasMiddleware()` built from the environment.
+- `withAccessToken` sets the `DPoP-Nonce` response header (on success and refusal) when the verifier is given `dpopNonces`.
+
+## 0.4.0 — 2026-10-23
+
+### Added
+
+- `withAccessToken(options, handler)`: wrap an App Router route handler so it runs only for a request with an Atlas-issued OAuth access token for your API (audience, scopes, DPoP); anything else gets 401/403 with the `WWW-Authenticate` challenge. Re-exports `createAccessTokenVerifier`, `protectedResourceMetadata`, `protectedResourceMetadataPath`.
+
 ## 0.3.0
 ### Added
 - **`getAtlasInitialState(options?)`** in `@atlasauth/nextjs/server` → `Promise<AtlasInitialState>`: the instance's

package/dist/access-token.d.ts

@@ -0,0 +1,16 @@
+import { type AccessTokenClaims, type AccessTokenVerifierOptions } from '@atlasauth/backend';
+export { createAccessTokenVerifier, protectedResourceMetadata, protectedResourceMetadataPath, type AccessTokenClaims, type AccessTokenResult, type AccessTokenVerifierOptions, } from '@atlasauth/backend';
+/** The verified token handed to a {@link withAccessToken} route handler. */
+export interface VerifiedAccessToken {
+    claims: AccessTokenClaims;
+    subject: string;
+    clientId: string | null;
+    scopes: string[];
+}
+/**
+ * Wrap a Next.js route handler (App Router, any runtime) so it only runs for a
+ * request carrying an Atlas-issued OAuth access token for YOUR API (audience,
+ * scopes, DPoP when bound). Anything else gets 401/403 with the RFC 6750 /
+ * RFC 9728 `WWW-Authenticate` challenge — what an MCP client needs to sign in.
+ */
+export declare function withAccessToken<Ctx = unknown>(options: AccessTokenVerifierOptions, handler: (request: Request, token: VerifiedAccessToken, ctx: Ctx) => Response | Promise<Response>): (request: Request, ctx: Ctx) => Promise<Response>;

package/dist/access-token.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.protectedResourceMetadataPath = exports.protectedResourceMetadata = exports.createAccessTokenVerifier = void 0;
+exports.withAccessToken = withAccessToken;
+const backend_1 = require("@atlasauth/backend");
+var backend_2 = require("@atlasauth/backend");
+Object.defineProperty(exports, "createAccessTokenVerifier", { enumerable: true, get: function () { return backend_2.createAccessTokenVerifier; } });
+Object.defineProperty(exports, "protectedResourceMetadata", { enumerable: true, get: function () { return backend_2.protectedResourceMetadata; } });
+Object.defineProperty(exports, "protectedResourceMetadataPath", { enumerable: true, get: function () { return backend_2.protectedResourceMetadataPath; } });
+/**
+ * Wrap a Next.js route handler (App Router, any runtime) so it only runs for a
+ * request carrying an Atlas-issued OAuth access token for YOUR API (audience,
+ * scopes, DPoP when bound). Anything else gets 401/403 with the RFC 6750 /
+ * RFC 9728 `WWW-Authenticate` challenge — what an MCP client needs to sign in.
+ */
+function withAccessToken(options, handler) {
+    const verify = (0, backend_1.createAccessTokenVerifier)(options);
+    return async (request, ctx) => {
+        const result = await verify({ method: request.method, url: request.url, headers: request.headers });
+        if (!result.ok) {
+            return new Response(JSON.stringify(result.error ? { error: result.error, error_description: result.description } : { error: 'unauthorized' }), {
+                status: result.status,
+                headers: {
+                    'content-type': 'application/json',
+                    'www-authenticate': result.wwwAuthenticate,
+                    ...(result.dpopNonce ? { 'dpop-nonce': result.dpopNonce } : {}),
+                },
+            });
+        }
+        const response = await handler(request, { claims: result.claims, subject: result.subject, clientId: result.clientId, scopes: result.scopes }, ctx);
+        if (!result.dpopNonce)
+            return response;
+        // RFC 9449 §8 — the server nonce on success too. Some responses (e.g. a
+        // fetched one) have immutable headers; those are re-wrapped.
+        try {
+            response.headers.set('dpop-nonce', result.dpopNonce);
+            return response;
+        }
+        catch {
+            const headers = new Headers(response.headers);
+            headers.set('dpop-nonce', result.dpopNonce);
+            return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+        }
+    };
+}
+//# sourceMappingURL=access-token.js.map

package/dist/access-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token.js","sourceRoot":"","sources":["../src/access-token.ts"],"names":[],"mappings":";;;AA6BA,0CAuCC;AApED,gDAI4B;AAE5B,8CAO4B;AAN1B,oHAAA,yBAAyB,OAAA;AACzB,oHAAA,yBAAyB,OAAA;AACzB,wHAAA,6BAA6B,OAAA;AAc/B;;;;;GAKG;AACH,SAAgB,eAAe,CAC7B,OAAmC,EACnC,OAAiG;IAEjG,MAAM,MAAM,GAAG,IAAA,mCAAyB,EAAC,OAAO,CAAC,CAAC;IAClD,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CACZ,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAC1G,EACD;gBACE,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,MAAM,CAAC,eAAe;oBAC1C,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChE;aACF,CACF,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,OAAO,EACP,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EACpG,GAAG,CACJ,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC;QACvC,wEAAwE;QACxE,6DAA6D;QAC7D,IAAI,CAAC;YACH,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACrD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5C,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/compat.d.ts

@@ -0,0 +1,220 @@
+/**
+ * `@atlasauth/nextjs/compat` — server-side drop-in helpers for Next.js apps moving
+ * to Atlas from Auth.js (NextAuth), Auth0 (nextjs-auth0), Supabase Auth and Better
+ * Auth. `atlas migrate code --from <vendor>` rewrites imports onto these so the
+ * migrated code keeps the shapes it was written against and runs on day one; move
+ * call sites to `auth()` / `currentUser()` from `@atlasauth/nextjs/server` later.
+ *
+ * Everything here reads the verified Atlas session (cookies / Authorization
+ * header) exactly as `auth()` does. Profile fields beyond the id (email, name)
+ * come from the session claims, so they are present when the instance includes
+ * the profile claims in its session token.
+ */
+import { type AtlasMiddlewareOptions, type CurrentUser, type EdgeRequest } from './middleware';
+import { type ServerAuth } from './server';
+/** Routes the migrated middleware leaves public by default: the Atlas pages. */
+export declare const COMPAT_PUBLIC_ROUTES: readonly string[];
+type NextLikeRequest = EdgeRequest & {
+    url?: string;
+};
+/**
+ * A ready-made Next.js `middleware` (14/15) built from the environment
+ * (`ATLAS_JWKS_URL`, `ATLAS_ISSUER`, `ATLAS_PUBLISHABLE_KEY`). Every route the
+ * middleware's `config.matcher` selects requires a session, except the Atlas
+ * sign-in and sign-up pages (and any `publicRoutes` you pass). The environment is
+ * read on the first request, not at import time.
+ */
+export declare function createAtlasMiddleware(options?: Partial<AtlasMiddlewareOptions>): (request: NextLikeRequest) => Promise<unknown>;
+/** The session `getServerSession()` / v5 `auth()` resolve to. */
+export interface NextAuthServerSession {
+    user: {
+        id: string;
+        name: string | null;
+        email: string | null;
+        image: string | null;
+    };
+    expires: string;
+}
+/** Pure projection, exported for tests and custom wiring. */
+export declare function nextAuthServerSessionFrom(user: CurrentUser | null, state: Pick<ServerAuth, 'claims'>): NextAuthServerSession | null;
+/**
+ * `getServerSession(authOptions)` (v4) and `auth()` (v5) on Atlas. Arguments are
+ * accepted and ignored, so existing call sites keep compiling.
+ */
+export declare function getServerSessionCompat(..._ignored: unknown[]): Promise<NextAuthServerSession | null>;
+/** Server-side `signIn()` (a v5 server action): redirects to the Atlas sign-in page. */
+export declare function nextAuthServerSignIn(_provider?: string, options?: {
+    redirectTo?: string;
+    callbackUrl?: string;
+    signInUrl?: string;
+}): Promise<never>;
+/** Server-side `signOut()` (a v5 server action): revokes the session, then redirects. */
+export declare function nextAuthServerSignOut(options?: {
+    redirectTo?: string;
+    redirect?: boolean;
+}): Promise<void>;
+/** `handlers` from v5 `NextAuth()`: the old `/api/auth/*` route now answers 404. */
+export declare const nextAuthHandlersCompat: {
+    GET: () => Promise<Response>;
+    POST: () => Promise<Response>;
+};
+/**
+ * `NextAuth(config)` on Atlas, for both shapes it is used in:
+ *
+ *  - v5 `auth.ts`: `export const { handlers, auth, signIn, signOut } = NextAuth(config)`
+ *    — the destructured members are the compat helpers above, so every
+ *    `import { auth } from '@/auth'` keeps working;
+ *  - v4 route: `const handler = NextAuth(authOptions); export { handler as GET, handler as POST }`
+ *    — the returned function answers the old `/api/auth/*` route with 404.
+ *
+ * The config is accepted and ignored: configure providers in the Atlas dashboard
+ * and port `callbacks` to Atlas Actions, then delete it.
+ */
+export declare function nextAuthCompat(..._ignored: unknown[]): (() => Promise<Response>) & {
+    handlers: {
+        GET: () => Promise<Response>;
+        POST: () => Promise<Response>;
+    };
+    auth: typeof getServerSessionCompat;
+    signIn: typeof nextAuthServerSignIn;
+    signOut: typeof nextAuthServerSignOut;
+    /** v5 `unstable_update`: Atlas sessions pick up profile changes on their own refresh. */
+    unstable_update: (..._args: unknown[]) => Promise<NextAuthServerSession | null>;
+};
+/** The OIDC profile nextjs-auth0 puts on `session.user`. */
+export interface Auth0ServerUser {
+    sub: string;
+    email?: string;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    org_id?: string;
+    [claim: string]: unknown;
+}
+export interface Auth0ServerSession {
+    user: Auth0ServerUser;
+    /** Unix seconds the Atlas session token expires at. */
+    expiresAt?: number;
+}
+export declare function auth0SessionFrom(user: CurrentUser | null, state: Pick<ServerAuth, 'claims'>): Auth0ServerSession | null;
+/** `getSession()` from nextjs-auth0 (v3, App Router) on Atlas. */
+export declare function getAuth0SessionCompat(..._ignored: unknown[]): Promise<Auth0ServerSession | null>;
+/**
+ * `withApiAuthRequired(handler)`: an App Router route handler (or a Pages API
+ * route, detected by its `res`) answers 401 unless a user is signed in.
+ */
+export declare function withApiAuthRequiredCompat<A extends unknown[], R>(handler: (...args: A) => R | Promise<R>): (...args: A) => Promise<R | Response | undefined>;
+/**
+ * `withPageAuthRequired(Page, { returnTo })` for an App Router server component:
+ * renders the page for a signed-in user, else redirects to the sign-in page.
+ */
+export declare function withPageAuthRequiredCompat<P extends object, R>(page: (props: P) => R | Promise<R>, options?: {
+    returnTo?: string | ((props: P) => string | Promise<string>);
+    signInUrl?: string;
+}): (props: P) => Promise<R>;
+/** `handleAuth()` from nextjs-auth0 v3: the old `/api/auth/[auth0]` route now answers 404. */
+export declare function handleAuthCompat(..._ignored: unknown[]): () => Promise<Response>;
+/** `withMiddlewareAuthRequired()` from `@auth0/nextjs-auth0/edge`. */
+export declare function withMiddlewareAuthRequiredCompat(..._ignored: unknown[]): (request: NextLikeRequest) => Promise<unknown>;
+/**
+ * `new Auth0Client()` from `@auth0/nextjs-auth0/server` (v4) on Atlas:
+ * `getSession()`, `middleware(request)` and `getAccessToken()`.
+ */
+export declare class Auth0ClientCompat {
+    private readonly mw;
+    constructor(_options?: Record<string, unknown>);
+    getSession(..._ignored: unknown[]): Promise<Auth0ServerSession | null>;
+    middleware(request: NextLikeRequest): Promise<unknown>;
+    /**
+     * Atlas session tokens are verified by your own backend with the instance JWKS
+     * (`AtlasBackend` from `@atlasauth/backend`); there is no separate access token
+     * to fetch server-side. Read the session token from the request instead.
+     */
+    getAccessToken(): Promise<never>;
+}
+/** The `User` object `supabase.auth.getUser()` resolves to (the fields apps read). */
+export interface SupabaseServerUser {
+    id: string;
+    aud: 'authenticated';
+    role: 'authenticated';
+    email?: string;
+    user_metadata: Record<string, unknown>;
+    app_metadata: Record<string, unknown>;
+}
+export declare function supabaseServerUserFrom(user: CurrentUser | null): SupabaseServerUser | null;
+/** `supabase.auth.getUser()` in a server component, route handler or server action. */
+export declare function getSupabaseUserCompat(): Promise<{
+    data: {
+        user: SupabaseServerUser | null;
+    };
+    error: null;
+}>;
+/** `supabase.auth.getSession()` server-side. There is no raw token here; use getUser(). */
+export declare function getSupabaseSessionCompat(): Promise<{
+    data: {
+        session: {
+            user: SupabaseServerUser;
+            expires_at?: number;
+        } | null;
+    };
+    error: null;
+}>;
+/** `supabase.auth.signOut()` server-side: revokes the active session. */
+export declare function supabaseSignOutCompat(): Promise<{
+    error: null;
+}>;
+export interface BetterAuthServerSession {
+    user: {
+        id: string;
+        email: string | null;
+        name: string | null;
+        image: string | null;
+        emailVerified: boolean;
+    };
+    session: {
+        id: string;
+        userId: string;
+        expiresAt: Date;
+        activeOrganizationId: string | null;
+    };
+}
+export declare function betterAuthServerSessionFrom(user: CurrentUser | null, state: Pick<ServerAuth, 'claims' | 'sessionId'>): BetterAuthServerSession | null;
+/**
+ * `betterAuth({...})` on Atlas: the returned object keeps `auth.api.getSession()`,
+ * `auth.api.signOut()` and `auth.handler`, so `lib/auth.ts` importers keep working.
+ * The options are accepted and ignored: configure sign-in methods, providers and
+ * plugins in the Atlas dashboard instead.
+ */
+export declare function createBetterAuthServerCompat(_options?: Record<string, unknown>): {
+    /** Type-only, like Better Auth's `typeof auth.$Infer.Session`. */
+    $Infer: {
+        Session: BetterAuthServerSession;
+    };
+    api: {
+        getSession(_input?: {
+            headers?: unknown;
+        }): Promise<BetterAuthServerSession | null>;
+        signOut(_input?: {
+            headers?: unknown;
+        }): Promise<{
+            success: boolean;
+        }>;
+    };
+    handler: () => Promise<Response>;
+};
+/** `toNextJsHandler(auth)` from `better-auth/next-js`: the old route now answers 404. */
+export declare function toNextJsHandlerCompat(..._ignored: unknown[]): {
+    GET: () => Promise<Response>;
+    POST: () => Promise<Response>;
+    PATCH: () => Promise<Response>;
+    PUT: () => Promise<Response>;
+    DELETE: () => Promise<Response>;
+};
+/**
+ * `getSessionCookie(request)` from `better-auth/cookies`: a cheap, unverified
+ * "probably signed in" check for middleware. Returns a non-empty marker when the
+ * browser carries an Atlas session hint, else null. Never proof of identity; a
+ * page that needs the user calls `auth()`.
+ */
+export declare function getSessionCookieCompat(request: EdgeRequest, ..._ignored: unknown[]): string | null;
+export {};

package/dist/compat.js

@@ -0,0 +1,352 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Auth0ClientCompat = exports.nextAuthHandlersCompat = exports.COMPAT_PUBLIC_ROUTES = void 0;
+exports.createAtlasMiddleware = createAtlasMiddleware;
+exports.nextAuthServerSessionFrom = nextAuthServerSessionFrom;
+exports.getServerSessionCompat = getServerSessionCompat;
+exports.nextAuthServerSignIn = nextAuthServerSignIn;
+exports.nextAuthServerSignOut = nextAuthServerSignOut;
+exports.nextAuthCompat = nextAuthCompat;
+exports.auth0SessionFrom = auth0SessionFrom;
+exports.getAuth0SessionCompat = getAuth0SessionCompat;
+exports.withApiAuthRequiredCompat = withApiAuthRequiredCompat;
+exports.withPageAuthRequiredCompat = withPageAuthRequiredCompat;
+exports.handleAuthCompat = handleAuthCompat;
+exports.withMiddlewareAuthRequiredCompat = withMiddlewareAuthRequiredCompat;
+exports.supabaseServerUserFrom = supabaseServerUserFrom;
+exports.getSupabaseUserCompat = getSupabaseUserCompat;
+exports.getSupabaseSessionCompat = getSupabaseSessionCompat;
+exports.supabaseSignOutCompat = supabaseSignOutCompat;
+exports.betterAuthServerSessionFrom = betterAuthServerSessionFrom;
+exports.createBetterAuthServerCompat = createBetterAuthServerCompat;
+exports.toNextJsHandlerCompat = toNextJsHandlerCompat;
+exports.getSessionCookieCompat = getSessionCookieCompat;
+/**
+ * `@atlasauth/nextjs/compat` — server-side drop-in helpers for Next.js apps moving
+ * to Atlas from Auth.js (NextAuth), Auth0 (nextjs-auth0), Supabase Auth and Better
+ * Auth. `atlas migrate code --from <vendor>` rewrites imports onto these so the
+ * migrated code keeps the shapes it was written against and runs on day one; move
+ * call sites to `auth()` / `currentUser()` from `@atlasauth/nextjs/server` later.
+ *
+ * Everything here reads the verified Atlas session (cookies / Authorization
+ * header) exactly as `auth()` does. Profile fields beyond the id (email, name)
+ * come from the session claims, so they are present when the instance includes
+ * the profile claims in its session token.
+ */
+const middleware_1 = require("./middleware");
+const matcher_1 = require("./matcher");
+const server_1 = require("./server");
+/** Routes the migrated middleware leaves public by default: the Atlas pages. */
+exports.COMPAT_PUBLIC_ROUTES = ['/sign-in(.*)', '/sign-up(.*)'];
+/**
+ * A ready-made Next.js `middleware` (14/15) built from the environment
+ * (`ATLAS_JWKS_URL`, `ATLAS_ISSUER`, `ATLAS_PUBLISHABLE_KEY`). Every route the
+ * middleware's `config.matcher` selects requires a session, except the Atlas
+ * sign-in and sign-up pages (and any `publicRoutes` you pass). The environment is
+ * read on the first request, not at import time.
+ */
+function createAtlasMiddleware(options = {}) {
+    let middleware;
+    return async (request) => {
+        if (!middleware) {
+            const publicRoutes = [...exports.COMPAT_PUBLIC_ROUTES, ...(options.publicRoutes ?? [])];
+            middleware = (0, middleware_1.atlasMiddleware)({ ...(0, server_1.configFromEnv)(), ...options, publicRoutes });
+        }
+        const { NextResponse } = await Promise.resolve().then(() => __importStar(require('next/server')));
+        return middleware(request, NextResponse);
+    };
+}
+function withRedirect(url, redirectUrl) {
+    if (!redirectUrl)
+        return url;
+    return `${url}${url.includes('?') ? '&' : '?'}redirect_url=${encodeURIComponent(redirectUrl)}`;
+}
+async function nextRedirect(url) {
+    const { redirect } = await Promise.resolve().then(() => __importStar(require('next/navigation')));
+    return redirect(url);
+}
+function expiresIso(state) {
+    const exp = typeof state.claims?.exp === 'number' ? state.claims.exp * 1000 : Date.now() + 60_000;
+    return new Date(exp).toISOString();
+}
+function fullName(user) {
+    return user.name ?? ([user.firstName, user.lastName].filter(Boolean).join(' ') || null);
+}
+/** Revoke the active session server-side (needs `ATLAS_SECRET_KEY`). */
+async function revokeActiveSession() {
+    const state = await (0, server_1.auth)();
+    if (state.sessionId)
+        await (0, server_1.atlasClient)().sessions.revoke(state.sessionId);
+}
+function notFoundHandler(vendor) {
+    return async () => new Response(JSON.stringify({
+        errors: [
+            {
+                code: 'MIGRATED_TO_ATLAS',
+                message: `This ${vendor} auth route is no longer used: sign-in, sign-out and callbacks are handled by Atlas. Delete this route.`,
+            },
+        ],
+    }), { status: 404, headers: { 'content-type': 'application/json' } });
+}
+/** Pure projection, exported for tests and custom wiring. */
+function nextAuthServerSessionFrom(user, state) {
+    if (!user)
+        return null;
+    return { user: { id: user.id, name: fullName(user), email: user.email, image: null }, expires: expiresIso(state) };
+}
+/**
+ * `getServerSession(authOptions)` (v4) and `auth()` (v5) on Atlas. Arguments are
+ * accepted and ignored, so existing call sites keep compiling.
+ */
+async function getServerSessionCompat(..._ignored) {
+    const [user, state] = await Promise.all([(0, server_1.currentUser)(), (0, server_1.auth)()]);
+    return nextAuthServerSessionFrom(user, state);
+}
+/** Server-side `signIn()` (a v5 server action): redirects to the Atlas sign-in page. */
+async function nextAuthServerSignIn(_provider, options = {}) {
+    return nextRedirect(withRedirect(options.signInUrl ?? matcher_1.DEFAULT_SIGN_IN_URL, options.redirectTo ?? options.callbackUrl));
+}
+/** Server-side `signOut()` (a v5 server action): revokes the session, then redirects. */
+async function nextAuthServerSignOut(options = {}) {
+    await revokeActiveSession();
+    if (options.redirect !== false)
+        await nextRedirect(options.redirectTo ?? '/');
+}
+/** `handlers` from v5 `NextAuth()`: the old `/api/auth/*` route now answers 404. */
+exports.nextAuthHandlersCompat = {
+    GET: notFoundHandler('Auth.js'),
+    POST: notFoundHandler('Auth.js'),
+};
+/**
+ * `NextAuth(config)` on Atlas, for both shapes it is used in:
+ *
+ *  - v5 `auth.ts`: `export const { handlers, auth, signIn, signOut } = NextAuth(config)`
+ *    — the destructured members are the compat helpers above, so every
+ *    `import { auth } from '@/auth'` keeps working;
+ *  - v4 route: `const handler = NextAuth(authOptions); export { handler as GET, handler as POST }`
+ *    — the returned function answers the old `/api/auth/*` route with 404.
+ *
+ * The config is accepted and ignored: configure providers in the Atlas dashboard
+ * and port `callbacks` to Atlas Actions, then delete it.
+ */
+function nextAuthCompat(..._ignored) {
+    const handler = notFoundHandler('Auth.js');
+    return Object.assign(handler, {
+        handlers: exports.nextAuthHandlersCompat,
+        auth: getServerSessionCompat,
+        signIn: nextAuthServerSignIn,
+        signOut: nextAuthServerSignOut,
+        /** v5 `unstable_update`: Atlas sessions pick up profile changes on their own refresh. */
+        unstable_update: async (..._args) => getServerSessionCompat(),
+    });
+}
+function auth0SessionFrom(user, state) {
+    if (!user)
+        return null;
+    const out = { sub: user.id };
+    const name = fullName(user);
+    if (user.email)
+        out.email = user.email;
+    if (name)
+        out.name = name;
+    if (user.firstName)
+        out.given_name = user.firstName;
+    if (user.lastName)
+        out.family_name = user.lastName;
+    if (user.orgId)
+        out.org_id = user.orgId;
+    return { user: out, ...(typeof state.claims?.exp === 'number' ? { expiresAt: state.claims.exp } : {}) };
+}
+/** `getSession()` from nextjs-auth0 (v3, App Router) on Atlas. */
+async function getAuth0SessionCompat(..._ignored) {
+    const [user, state] = await Promise.all([(0, server_1.currentUser)(), (0, server_1.auth)()]);
+    return auth0SessionFrom(user, state);
+}
+const UNAUTHORIZED = { error: 'not_authenticated', description: 'The user does not have an active session or is not authenticated' };
+/**
+ * `withApiAuthRequired(handler)`: an App Router route handler (or a Pages API
+ * route, detected by its `res`) answers 401 unless a user is signed in.
+ */
+function withApiAuthRequiredCompat(handler) {
+    return async (...args) => {
+        const state = await (0, server_1.auth)();
+        if (state.userId)
+            return handler(...args);
+        const res = args[1];
+        if (res && typeof res.status === 'function') {
+            res.status(401).json(UNAUTHORIZED);
+            return undefined;
+        }
+        return new Response(JSON.stringify(UNAUTHORIZED), { status: 401, headers: { 'content-type': 'application/json' } });
+    };
+}
+/**
+ * `withPageAuthRequired(Page, { returnTo })` for an App Router server component:
+ * renders the page for a signed-in user, else redirects to the sign-in page.
+ */
+function withPageAuthRequiredCompat(page, options = {}) {
+    return async (props) => {
+        const state = await (0, server_1.auth)();
+        if (state.userId)
+            return page(props);
+        const returnTo = typeof options.returnTo === 'function' ? await options.returnTo(props) : options.returnTo;
+        return nextRedirect(withRedirect(options.signInUrl ?? matcher_1.DEFAULT_SIGN_IN_URL, returnTo));
+    };
+}
+/** `handleAuth()` from nextjs-auth0 v3: the old `/api/auth/[auth0]` route now answers 404. */
+function handleAuthCompat(..._ignored) {
+    return notFoundHandler('Auth0');
+}
+/** `withMiddlewareAuthRequired()` from `@auth0/nextjs-auth0/edge`. */
+function withMiddlewareAuthRequiredCompat(..._ignored) {
+    return createAtlasMiddleware();
+}
+/**
+ * `new Auth0Client()` from `@auth0/nextjs-auth0/server` (v4) on Atlas:
+ * `getSession()`, `middleware(request)` and `getAccessToken()`.
+ */
+class Auth0ClientCompat {
+    mw = createAtlasMiddleware();
+    constructor(_options = {}) { }
+    getSession(..._ignored) {
+        return getAuth0SessionCompat();
+    }
+    middleware(request) {
+        return this.mw(request);
+    }
+    /**
+     * Atlas session tokens are verified by your own backend with the instance JWKS
+     * (`AtlasBackend` from `@atlasauth/backend`); there is no separate access token
+     * to fetch server-side. Read the session token from the request instead.
+     */
+    async getAccessToken() {
+        throw new Error('Auth0ClientCompat.getAccessToken(): Atlas has no server-side access-token exchange. Send the session token (getToken() in the browser) to your API and verify it with @atlasauth/backend.');
+    }
+}
+exports.Auth0ClientCompat = Auth0ClientCompat;
+function supabaseServerUserFrom(user) {
+    if (!user)
+        return null;
+    const name = fullName(user);
+    return {
+        id: user.id,
+        aud: 'authenticated',
+        role: 'authenticated',
+        ...(user.email ? { email: user.email } : {}),
+        user_metadata: name ? { full_name: name, name } : {},
+        app_metadata: user.orgId ? { org_id: user.orgId, org_role: user.orgRole } : {},
+    };
+}
+/** `supabase.auth.getUser()` in a server component, route handler or server action. */
+async function getSupabaseUserCompat() {
+    return { data: { user: supabaseServerUserFrom(await (0, server_1.currentUser)()) }, error: null };
+}
+/** `supabase.auth.getSession()` server-side. There is no raw token here; use getUser(). */
+async function getSupabaseSessionCompat() {
+    const [user, state] = await Promise.all([(0, server_1.currentUser)(), (0, server_1.auth)()]);
+    const mapped = supabaseServerUserFrom(user);
+    return {
+        data: {
+            session: mapped
+                ? { user: mapped, ...(typeof state.claims?.exp === 'number' ? { expires_at: state.claims.exp } : {}) }
+                : null,
+        },
+        error: null,
+    };
+}
+/** `supabase.auth.signOut()` server-side: revokes the active session. */
+async function supabaseSignOutCompat() {
+    await revokeActiveSession();
+    return { error: null };
+}
+function betterAuthServerSessionFrom(user, state) {
+    if (!user)
+        return null;
+    return {
+        user: {
+            id: user.id,
+            email: user.email,
+            name: fullName(user),
+            image: null,
+            // Present when the instance includes `email_verified` in its session claims.
+            emailVerified: state.claims?.email_verified === true,
+        },
+        session: {
+            id: state.sessionId ?? '',
+            userId: user.id,
+            expiresAt: new Date(expiresIso(state)),
+            activeOrganizationId: user.orgId,
+        },
+    };
+}
+/**
+ * `betterAuth({...})` on Atlas: the returned object keeps `auth.api.getSession()`,
+ * `auth.api.signOut()` and `auth.handler`, so `lib/auth.ts` importers keep working.
+ * The options are accepted and ignored: configure sign-in methods, providers and
+ * plugins in the Atlas dashboard instead.
+ */
+function createBetterAuthServerCompat(_options = {}) {
+    return {
+        /** Type-only, like Better Auth's `typeof auth.$Infer.Session`. */
+        $Infer: {},
+        api: {
+            async getSession(_input) {
+                const [user, state] = await Promise.all([(0, server_1.currentUser)(), (0, server_1.auth)()]);
+                return betterAuthServerSessionFrom(user, state);
+            },
+            async signOut(_input) {
+                await revokeActiveSession();
+                return { success: true };
+            },
+        },
+        handler: notFoundHandler('Better Auth'),
+    };
+}
+/** `toNextJsHandler(auth)` from `better-auth/next-js`: the old route now answers 404. */
+function toNextJsHandlerCompat(..._ignored) {
+    const handler = notFoundHandler('Better Auth');
+    return { GET: handler, POST: handler, PATCH: handler, PUT: handler, DELETE: handler };
+}
+/**
+ * `getSessionCookie(request)` from `better-auth/cookies`: a cheap, unverified
+ * "probably signed in" check for middleware. Returns a non-empty marker when the
+ * browser carries an Atlas session hint, else null. Never proof of identity; a
+ * page that needs the user calls `auth()`.
+ */
+function getSessionCookieCompat(request, ..._ignored) {
+    return (0, middleware_1.hasSignedInHint)(request) ? 'atlas' : null;
+}
+//# sourceMappingURL=compat.js.map

package/dist/compat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compat.js","sourceRoot":"","sources":["../src/compat.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,sDAYC;AAmDD,8DAMC;AAMD,wDAGC;AAGD,oDAKC;AAGD,sDAKC;AAoBD,wCAUC;AAqBD,4CAUC;AAGD,sDAGC;AAQD,8DAWC;AAMD,gEAUC;AAGD,4CAEC;AAGD,4EAEC;AA2CD,wDAWC;AAGD,sDAEC;AAGD,4DAcC;AAGD,sDAGC;AASD,kEAqBC;AAQD,oEAgBC;AAGD,sDAGC;AAQD,wDAEC;AAlYD;;;;;;;;;;;GAWG;AACH,6CAAiI;AACjI,uCAAgD;AAChD,qCAA0F;AAE1F,gFAAgF;AACnE,QAAA,oBAAoB,GAAsB,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;AAIxF;;;;;;GAMG;AACH,SAAgB,qBAAqB,CACnC,UAA2C,EAAE;IAE7C,IAAI,UAA0D,CAAC;IAC/D,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,CAAC,GAAG,4BAAoB,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;YAChF,UAAU,GAAG,IAAA,4BAAe,EAAC,EAAE,GAAG,IAAA,sBAAa,GAAE,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,aAAa,GAAC,CAAC;QACrD,OAAO,UAAU,CAAC,OAAO,EAAE,YAAqB,CAAC,CAAC;IACpD,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,WAAoB;IACrD,IAAI,CAAC,WAAW;QAAE,OAAO,GAAG,CAAC;IAC7B,OAAO,GAAG,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,gBAAgB,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;AACjG,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAW;IACrC,MAAM,EAAE,QAAQ,EAAE,GAAG,wDAAa,iBAAiB,GAAC,CAAC;IACrD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CAAC,KAAiC;IACnD,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IAClG,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAiB;IACjC,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;AAC1F,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,mBAAmB;IAChC,MAAM,KAAK,GAAG,MAAM,IAAA,aAAI,GAAE,CAAC;IAC3B,IAAI,KAAK,CAAC,SAAS;QAAE,MAAM,IAAA,oBAAW,GAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,KAAK,IAAI,EAAE,CAChB,IAAI,QAAQ,CACV,IAAI,CAAC,SAAS,CAAC;QACb,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,QAAQ,MAAM,yGAAyG;aACjI;SACF;KACF,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;AACN,CAAC;AAUD,6DAA6D;AAC7D,SAAgB,yBAAyB,CACvC,IAAwB,EACxB,KAAiC;IAEjC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;AACrH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,sBAAsB,CAAC,GAAG,QAAmB;IACjE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAA,oBAAW,GAAE,EAAE,IAAA,aAAI,GAAE,CAAC,CAAC,CAAC;IACjE,OAAO,yBAAyB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,wFAAwF;AACjF,KAAK,UAAU,oBAAoB,CACxC,SAAkB,EAClB,UAA6E,EAAE;IAE/E,OAAO,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,IAAI,6BAAmB,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;AACzH,CAAC;AAED,yFAAyF;AAClF,KAAK,UAAU,qBAAqB,CACzC,UAAuD,EAAE;IAEzD,MAAM,mBAAmB,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK;QAAE,MAAM,YAAY,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC;AAChF,CAAC;AAED,oFAAoF;AACvE,QAAA,sBAAsB,GAAG;IACpC,GAAG,EAAE,eAAe,CAAC,SAAS,CAAC;IAC/B,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC;CACjC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,SAAgB,cAAc,CAAC,GAAG,QAAmB;IACnD,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;QAC5B,QAAQ,EAAE,8BAAsB;QAChC,IAAI,EAAE,sBAAsB;QAC5B,MAAM,EAAE,oBAAoB;QAC5B,OAAO,EAAE,qBAAqB;QAC9B,yFAAyF;QACzF,eAAe,EAAE,KAAK,EAAE,GAAG,KAAgB,EAAE,EAAE,CAAC,sBAAsB,EAAE;KACzE,CAAC,CAAC;AACL,CAAC;AAqBD,SAAgB,gBAAgB,CAAC,IAAwB,EAAE,KAAiC;IAC1F,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAoB,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,KAAK;QAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACvC,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAC1B,IAAI,IAAI,CAAC,SAAS;QAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;IACpD,IAAI,IAAI,CAAC,QAAQ;QAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC;IACnD,IAAI,IAAI,CAAC,KAAK;QAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;IACxC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC1G,CAAC;AAED,kEAAkE;AAC3D,KAAK,UAAU,qBAAqB,CAAC,GAAG,QAAmB;IAChE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAA,oBAAW,GAAE,EAAE,IAAA,aAAI,GAAE,CAAC,CAAC,CAAC;IACjE,OAAO,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,YAAY,GAAG,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,kEAAkE,EAAE,CAAC;AAErI;;;GAGG;AACH,SAAgB,yBAAyB,CAAyB,OAAuC;IACvG,OAAO,KAAK,EAAE,GAAG,IAAO,EAAqC,EAAE;QAC7D,MAAM,KAAK,GAAG,MAAM,IAAA,aAAI,GAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAiF,CAAC;QACpG,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACnC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACtH,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,0BAA0B,CACxC,IAAkC,EAClC,UAAgG,EAAE;IAElG,OAAO,KAAK,EAAE,KAAQ,EAAc,EAAE;QACpC,MAAM,KAAK,GAAG,MAAM,IAAA,aAAI,GAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3G,OAAO,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,IAAI,6BAAmB,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,SAAgB,gBAAgB,CAAC,GAAG,QAAmB;IACrD,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,sEAAsE;AACtE,SAAgB,gCAAgC,CAAC,GAAG,QAAmB;IACrE,OAAO,qBAAqB,EAAE,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAa,iBAAiB;IACX,EAAE,GAAG,qBAAqB,EAAE,CAAC;IAE9C,YAAY,WAAoC,EAAE,IAAG,CAAC;IAEtD,UAAU,CAAC,GAAG,QAAmB;QAC/B,OAAO,qBAAqB,EAAE,CAAC;IACjC,CAAC;IAED,UAAU,CAAC,OAAwB;QACjC,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,IAAI,KAAK,CACb,2LAA2L,CAC5L,CAAC;IACJ,CAAC;CACF;AAvBD,8CAuBC;AAcD,SAAgB,sBAAsB,CAAC,IAAwB;IAC7D,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,GAAG,EAAE,eAAe;QACpB,IAAI,EAAE,eAAe;QACrB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;QACpD,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE;KAC/E,CAAC;AACJ,CAAC;AAED,uFAAuF;AAChF,KAAK,UAAU,qBAAqB;IACzC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,sBAAsB,CAAC,MAAM,IAAA,oBAAW,GAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACtF,CAAC;AAED,2FAA2F;AACpF,KAAK,UAAU,wBAAwB;IAI5C,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAA,oBAAW,GAAE,EAAE,IAAA,aAAI,GAAE,CAAC,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO;QACL,IAAI,EAAE;YACJ,OAAO,EAAE,MAAM;gBACb,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;gBACtG,CAAC,CAAC,IAAI;SACT;QACD,KAAK,EAAE,IAAI;KACZ,CAAC;AACJ,CAAC;AAED,yEAAyE;AAClE,KAAK,UAAU,qBAAqB;IACzC,MAAM,mBAAmB,EAAE,CAAC;IAC5B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AASD,SAAgB,2BAA2B,CACzC,IAAwB,EACxB,KAA+C;IAE/C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO;QACL,IAAI,EAAE;YACJ,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;YACpB,KAAK,EAAE,IAAI;YACX,6EAA6E;YAC7E,aAAa,EAAG,KAAK,CAAC,MAA8C,EAAE,cAAc,KAAK,IAAI;SAC9F;QACD,OAAO,EAAE;YACP,EAAE,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE;YACzB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACtC,oBAAoB,EAAE,IAAI,CAAC,KAAK;SACjC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,4BAA4B,CAAC,WAAoC,EAAE;IACjF,OAAO;QACL,kEAAkE;QAClE,MAAM,EAAE,EAA0C;QAClD,GAAG,EAAE;YACH,KAAK,CAAC,UAAU,CAAC,MAA8B;gBAC7C,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAA,oBAAW,GAAE,EAAE,IAAA,aAAI,GAAE,CAAC,CAAC,CAAC;gBACjE,OAAO,2BAA2B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAClD,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,MAA8B;gBAC1C,MAAM,mBAAmB,EAAE,CAAC;gBAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3B,CAAC;SACF;QACD,OAAO,EAAE,eAAe,CAAC,aAAa,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,SAAgB,qBAAqB,CAAC,GAAG,QAAmB;IAC1D,MAAM,OAAO,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAC/C,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,OAAoB,EAAE,GAAG,QAAmB;IACjF,OAAO,IAAA,4BAAe,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC"}

package/dist/index.d.ts

@@ -1,3 +1,4 @@
 export * from './matcher';
 export * from './middleware';
 export * from './proxy';
+export * from './access-token';

package/dist/index.js

@@ -17,4 +17,5 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./matcher"), exports);
 __exportStar(require("./middleware"), exports);
 __exportStar(require("./proxy"), exports);
+__exportStar(require("./access-token"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,+CAA6B;AAC7B,0CAAwB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,+CAA6B;AAC7B,0CAAwB;AACxB,iDAA+B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/nextjs",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -12,10 +12,14 @@
       "types": "./dist/server.d.ts",
       "default": "./dist/server.js"
     },
+    "./compat": {
+      "types": "./dist/compat.d.ts",
+      "default": "./dist/compat.js"
+    },
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@atlasauth/backend": "0.7.3"
+    "@atlasauth/backend": "0.16.0"
   },
   "peerDependencies": {
     "next": ">=13.4"