@authgear/nextjs 0.3.0 → 0.4.0

package/README.md

@@ -218,10 +218,17 @@ export async function callMyApiAction() {
 | Export | Description |
 |---|---|
 | `<AuthgearProvider>` | React context provider, must wrap the app |
-| `useAuthgear()` | Returns `{ state, user, isLoaded, isAuthenticated, signIn, signOut }` |
+| `useAuthgear()` | Returns `{ state, user, isLoaded, isAuthenticated, signIn, signOut, openPage }` |
 | `useUser()` | Returns `UserInfo \| null` |
 | `<SignInButton>` | Button that calls `signIn()` on click |
 | `<SignOutButton>` | Button that calls `signOut()` on click |
+| `<UserSettingsButton>` | Button that opens Authgear account settings in a new tab |
+
+**`AuthgearProvider` props**:
+
+| Prop | Default | Description |
+|---|---|---|
+| `openPagePath` | `"/api/auth/open"` | Route used by `openPage()` and `<UserSettingsButton>` to pre-authenticate and redirect to an Authgear page |
 
 ### `SignInOptions`
 

package/dist/{chunk-CCQOLKXU.js → chunk-AJJAXXPI.js}

@@ -26,4 +26,4 @@ export {
   DEFAULT_SCOPES,
   SessionState
 };
-//# sourceMappingURL=chunk-CCQOLKXU.js.map
+//# sourceMappingURL=chunk-AJJAXXPI.js.map

package/dist/chunk-AJJAXXPI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts"],"sourcesContent":["export interface AuthgearConfig {\n  /** Authgear endpoint, e.g. \"https://myapp.authgear.cloud\" */\n  endpoint: string;\n  /** OAuth client ID */\n  clientID: string;\n  /** Redirect URI for OAuth callback, e.g. \"http://localhost:3000/api/auth/callback\" */\n  redirectURI: string;\n  /** Where to redirect after logout */\n  postLogoutRedirectURI?: string;\n  /** OAuth scopes. Defaults to [\"openid\", \"offline_access\", \"https://authgear.com/scopes/full-userinfo\"] */\n  scopes?: string[];\n  /** Secret key for encrypting session cookie (min 32 chars) */\n  sessionSecret: string;\n  /** Session cookie name. Defaults to \"authgear.session\" */\n  cookieName?: string;\n  /**\n   * Whether to enable SSO (Single Sign-On) with other apps on the same Authgear tenant.\n   * When `true` (default), Authgear silently reuses its server-side session if the user\n   * is already logged in, so users are not prompted for credentials again.\n   * Set to `false` to always show the login form (`prompt=login`), which is recommended\n   * for single-app deployments where silent sign-in feels unexpected to the user.\n   * Defaults to `true`.\n   */\n  isSSOEnabled?: boolean;\n}\n\n/**\n * Pages that can be opened in a new tab with the current user pre-authenticated.\n * Used by `getOpenURL` from `@authgear/nextjs/server` and by `openPage` / `<UserSettingsButton>`\n * from `@authgear/nextjs/client`.\n */\nexport enum Page {\n  Settings = \"/settings\",\n}\n\n/**\n * OIDC `prompt` parameter values.\n * Pass to `signIn({ prompt })` or `SignInButton signInOptions={{ prompt }}` to control\n * whether Authgear shows the login form for a specific authentication call.\n *\n * @see https://docs.authgear.com/authentication-and-access/single-sign-on/force-authgear-to-show-login-page\n */\nexport enum PromptOption {\n  /** Always show the login form, even if the user has an active Authgear session. */\n  Login = \"login\",\n  /** Never show the login form; return an error if the user is not already authenticated. */\n  None = \"none\",\n}\n\nexport const DEFAULT_SCOPES = [\n  \"openid\",\n  \"offline_access\",\n  \"https://authgear.com/scopes/full-userinfo\",\n];\n\nexport enum SessionState {\n  Unknown = \"UNKNOWN\",\n  NoSession = \"NO_SESSION\",\n  Authenticated = \"AUTHENTICATED\",\n}\n\nexport interface SessionData {\n  accessToken: string;\n  refreshToken: string | null;\n  idToken: string | null;\n  expiresAt: number;\n}\n\nexport interface Session {\n  state: SessionState;\n  accessToken: string | null;\n  refreshToken: string | null;\n  idToken: string | null;\n  expiresAt: number | null;\n  user: UserInfo | null;\n}\n\nexport interface UserInfo {\n  sub: string;\n  email?: string;\n  emailVerified?: boolean;\n  phoneNumber?: string;\n  phoneNumberVerified?: boolean;\n  preferredUsername?: string;\n  givenName?: string;\n  familyName?: string;\n  name?: string;\n  picture?: string;\n  roles?: string[];\n  isAnonymous?: boolean;\n  isVerified?: boolean;\n  canReauthenticate?: boolean;\n  customAttributes?: Record<string, unknown>;\n  raw: Record<string, unknown>;\n}\n\nexport interface JWTPayload {\n  sub: string;\n  iss: string;\n  aud: string | string[];\n  exp: number;\n  iat: number;\n  jti?: string;\n  client_id?: string;\n  \"https://authgear.com/claims/user/is_anonymous\"?: boolean;\n  \"https://authgear.com/claims/user/is_verified\"?: boolean;\n  \"https://authgear.com/claims/user/can_reauthenticate\"?: boolean;\n  \"https://authgear.com/claims/user/roles\"?: string[];\n  [key: string]: unknown;\n}\n\nexport interface TokenResponse {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token?: string;\n  id_token?: string;\n}\n\nexport interface AppSessionTokenResponse {\n  app_session_token: string;\n  expire_at: string;\n}\n\nexport interface OIDCConfiguration {\n  authorization_endpoint: string;\n  token_endpoint: string;\n  userinfo_endpoint: string;\n  revocation_endpoint: string;\n  end_session_endpoint: string;\n  jwks_uri: string;\n  issuer: string;\n}\n"],"mappings":";AA+BO,IAAK,OAAL,kBAAKA,UAAL;AACL,EAAAA,MAAA,cAAW;AADD,SAAAA;AAAA,GAAA;AAWL,IAAK,eAAL,kBAAKC,kBAAL;AAEL,EAAAA,cAAA,WAAQ;AAER,EAAAA,cAAA,UAAO;AAJG,SAAAA;AAAA,GAAA;AAOL,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAK,eAAL,kBAAKC,kBAAL;AACL,EAAAA,cAAA,aAAU;AACV,EAAAA,cAAA,eAAY;AACZ,EAAAA,cAAA,mBAAgB;AAHN,SAAAA;AAAA,GAAA;","names":["Page","PromptOption","SessionState"]}

package/dist/{chunk-UERNRN5J.js → chunk-LPGVCNZ6.js}

@@ -1,6 +1,6 @@
 import {
   DEFAULT_SCOPES
-} from "./chunk-CCQOLKXU.js";
+} from "./chunk-AJJAXXPI.js";
 
 // src/config.ts
 function resolveConfig(config) {
@@ -232,4 +232,4 @@ export {
   deriveSessionState,
   isTokenExpired
 };
-//# sourceMappingURL=chunk-UERNRN5J.js.map
+//# sourceMappingURL=chunk-LPGVCNZ6.js.map

package/dist/client.d.ts

@@ -1,7 +1,7 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactNode, ButtonHTMLAttributes } from 'react';
-import { c as SessionState, U as UserInfo } from './types-Cx-gnfE7.js';
-export { a as PromptOption, S as Session } from './types-Cx-gnfE7.js';
+import { c as SessionState, U as UserInfo } from './types-D6m4Hact.js';
+export { P as Page, a as PromptOption, S as Session } from './types-D6m4Hact.js';
 
 interface SignInOptions {
     returnTo?: string;
@@ -21,8 +21,10 @@ interface AuthgearProviderProps {
     loginPath?: string;
     /** Path to the logout route. Defaults to "/api/auth/logout". */
     logoutPath?: string;
+    /** Path to the open-page route handler. Defaults to "/api/auth/open". */
+    openPagePath?: string;
 }
-declare function AuthgearProvider({ children, userInfoPath, loginPath, logoutPath, }: AuthgearProviderProps): react_jsx_runtime.JSX.Element;
+declare function AuthgearProvider({ children, userInfoPath, loginPath, logoutPath, openPagePath, }: AuthgearProviderProps): react_jsx_runtime.JSX.Element;
 
 interface SignInButtonProps extends ButtonHTMLAttributes<HTMLButtonElement> {
     signInOptions?: SignInOptions;
@@ -32,6 +34,15 @@ declare function SignInButton({ signInOptions, children, ...props }: SignInButto
 type SignOutButtonProps = ButtonHTMLAttributes<HTMLButtonElement>;
 declare function SignOutButton({ children, ...props }: SignOutButtonProps): react_jsx_runtime.JSX.Element;
 
+type UserSettingsButtonProps = ButtonHTMLAttributes<HTMLButtonElement>;
+/**
+ * A button that opens Authgear's account settings page in a new tab
+ * for the currently authenticated user. Requires `AuthgearProvider` as an ancestor.
+ *
+ * Uses `GET /api/auth/open?page=/settings` under the hood — no Server Action needed.
+ */
+declare function UserSettingsButton({ children, ...props }: UserSettingsButtonProps): react_jsx_runtime.JSX.Element;
+
 interface UseAuthgearReturn {
     /** Current session state */
     state: SessionState;
@@ -45,10 +56,12 @@ interface UseAuthgearReturn {
     signIn: (options?: SignInOptions) => void;
     /** Navigate to the sign-out endpoint */
     signOut: () => void;
+    /** Open an Authgear page (e.g. Page.Settings) in a new tab */
+    openPage: (path: string) => void;
 }
 declare function useAuthgear(): UseAuthgearReturn;
 
 /** Returns the current user info, or null if not authenticated. */
 declare function useUser(): UserInfo | null;
 
-export { AuthgearProvider, type AuthgearProviderProps, SessionState, SignInButton, type SignInButtonProps, type SignInOptions, SignOutButton, type SignOutButtonProps, type UseAuthgearReturn, UserInfo, useAuthgear, useUser };
+export { AuthgearProvider, type AuthgearProviderProps, SessionState, SignInButton, type SignInButtonProps, type SignInOptions, SignOutButton, type SignOutButtonProps, type UseAuthgearReturn, UserInfo, UserSettingsButton, type UserSettingsButtonProps, useAuthgear, useUser };

package/dist/client.js

@@ -1,8 +1,9 @@
 "use client";
 import {
+  Page,
   PromptOption,
   SessionState
-} from "./chunk-CCQOLKXU.js";
+} from "./chunk-AJJAXXPI.js";
 
 // src/components/AuthgearProvider.tsx
 import {
@@ -18,7 +19,8 @@ function AuthgearProvider({
   children,
   userInfoPath = "/api/auth/userinfo",
   loginPath = "/api/auth/login",
-  logoutPath = "/api/auth/logout"
+  logoutPath = "/api/auth/logout",
+  openPagePath = "/api/auth/open"
 }) {
   const [state, setState] = useState("UNKNOWN" /* Unknown */);
   const [user, setUser] = useState(null);
@@ -70,7 +72,15 @@ function AuthgearProvider({
   const signOut = useCallback(() => {
     window.location.href = logoutPath;
   }, [logoutPath]);
-  return /* @__PURE__ */ jsx(AuthgearContext.Provider, { value: { state, user, isLoaded, signIn, signOut }, children });
+  const openPage = useCallback(
+    (path) => {
+      const url = new URL(openPagePath, window.location.origin);
+      url.searchParams.set("page", path);
+      window.open(url.toString(), "_blank", "noopener,noreferrer");
+    },
+    [openPagePath]
+  );
+  return /* @__PURE__ */ jsx(AuthgearContext.Provider, { value: { state, user, isLoaded, signIn, signOut, openPage }, children });
 }
 function useAuthgearContext() {
   const ctx = useContext(AuthgearContext);
@@ -84,26 +94,46 @@ function useAuthgearContext() {
 import { jsx as jsx2 } from "react/jsx-runtime";
 function SignInButton({ signInOptions, children = "Sign In", ...props }) {
   const { signIn } = useAuthgearContext();
-  return /* @__PURE__ */ jsx2("button", { ...props, onClick: () => signIn(signInOptions), children });
+  return /* @__PURE__ */ jsx2("button", { ...props, onClick: (e) => {
+    props.onClick?.(e);
+    signIn(signInOptions);
+  }, children });
 }
 
 // src/components/SignOutButton.tsx
 import { jsx as jsx3 } from "react/jsx-runtime";
 function SignOutButton({ children = "Sign Out", ...props }) {
   const { signOut } = useAuthgearContext();
-  return /* @__PURE__ */ jsx3("button", { ...props, onClick: signOut, children });
+  return /* @__PURE__ */ jsx3("button", { ...props, onClick: (e) => {
+    props.onClick?.(e);
+    signOut();
+  }, children });
+}
+
+// src/components/UserSettingsButton.tsx
+import { jsx as jsx4 } from "react/jsx-runtime";
+function UserSettingsButton({
+  children = "Account Settings",
+  ...props
+}) {
+  const { openPage } = useAuthgearContext();
+  return /* @__PURE__ */ jsx4("button", { ...props, onClick: (e) => {
+    props.onClick?.(e);
+    openPage("/settings" /* Settings */);
+  }, children });
 }
 
 // src/hooks/useAuthgear.ts
 function useAuthgear() {
-  const { state, user, isLoaded, signIn, signOut } = useAuthgearContext();
+  const { state, user, isLoaded, signIn, signOut, openPage } = useAuthgearContext();
   return {
     state,
     user,
     isLoaded,
     isAuthenticated: state === "AUTHENTICATED" /* Authenticated */,
     signIn,
-    signOut
+    signOut,
+    openPage
   };
 }
 
@@ -114,10 +144,12 @@ function useUser() {
 }
 export {
   AuthgearProvider,
+  Page,
   PromptOption,
   SessionState,
   SignInButton,
   SignOutButton,
+  UserSettingsButton,
   useAuthgear,
   useUser
 };

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/components/AuthgearProvider.tsx","../src/components/SignInButton.tsx","../src/components/SignOutButton.tsx","../src/hooks/useAuthgear.ts","../src/hooks/useUser.ts"],"sourcesContent":["\"use client\";\n\nimport React, {\n  createContext,\n  useContext,\n  useEffect,\n  useState,\n  useCallback,\n  type ReactNode,\n} from \"react\";\nimport { SessionState, type UserInfo } from \"../types.js\";\n\nexport interface AuthgearContextValue {\n  state: SessionState;\n  user: UserInfo | null;\n  isLoaded: boolean;\n  signIn: (options?: SignInOptions) => void;\n  signOut: () => void;\n}\n\nexport interface SignInOptions {\n  returnTo?: string;\n  loginPath?: string;\n  /**\n   * OIDC `prompt` parameter for this sign-in call.\n   * Overrides the global `isSSOEnabled` setting for this navigation.\n   * Use `PromptOption.Login` or `PromptOption.None` for type-safe values.\n   */\n  prompt?: string;\n}\n\nconst AuthgearContext = createContext<AuthgearContextValue | null>(null);\n\nexport interface AuthgearProviderProps {\n  children: ReactNode;\n  /** Path to the userinfo API route. Defaults to \"/api/auth/userinfo\". */\n  userInfoPath?: string;\n  /** Path to the login route. Defaults to \"/api/auth/login\". */\n  loginPath?: string;\n  /** Path to the logout route. Defaults to \"/api/auth/logout\". */\n  logoutPath?: string;\n}\n\nexport function AuthgearProvider({\n  children,\n  userInfoPath = \"/api/auth/userinfo\",\n  loginPath = \"/api/auth/login\",\n  logoutPath = \"/api/auth/logout\",\n}: AuthgearProviderProps) {\n  const [state, setState] = useState<SessionState>(SessionState.Unknown);\n  const [user, setUser] = useState<UserInfo | null>(null);\n  const [isLoaded, setIsLoaded] = useState(false);\n\n  useEffect(() => {\n    let cancelled = false;\n\n    async function fetchSession() {\n      try {\n        const res = await fetch(userInfoPath);\n        if (cancelled) return;\n\n        if (res.ok) {\n          const userInfo = (await res.json()) as UserInfo;\n          setState(SessionState.Authenticated);\n          setUser(userInfo);\n        } else {\n          setState(SessionState.NoSession);\n          setUser(null);\n        }\n      } catch {\n        if (!cancelled) {\n          setState(SessionState.NoSession);\n          setUser(null);\n        }\n      } finally {\n        if (!cancelled) {\n          setIsLoaded(true);\n        }\n      }\n    }\n\n    fetchSession();\n    return () => { cancelled = true; };\n  }, [userInfoPath]);\n\n  const signIn = useCallback(\n    (options?: SignInOptions) => {\n      const path = options?.loginPath ?? loginPath;\n      const url = new URL(path, window.location.origin);\n      if (options?.returnTo) {\n        url.searchParams.set(\"returnTo\", options.returnTo);\n      }\n      if (options?.prompt != null) {\n        url.searchParams.set(\"prompt\", options.prompt);\n      }\n      window.location.href = url.toString();\n    },\n    [loginPath],\n  );\n\n  const signOut = useCallback(() => {\n    window.location.href = logoutPath;\n  }, [logoutPath]);\n\n  return (\n    <AuthgearContext.Provider value={{ state, user, isLoaded, signIn, signOut }}>\n      {children}\n    </AuthgearContext.Provider>\n  );\n}\n\nexport function useAuthgearContext(): AuthgearContextValue {\n  const ctx = useContext(AuthgearContext);\n  if (!ctx) {\n    throw new Error(\"useAuthgearContext must be used within <AuthgearProvider>\");\n  }\n  return ctx;\n}\n","\"use client\";\n\nimport React, { type ButtonHTMLAttributes } from \"react\";\nimport { useAuthgearContext, type SignInOptions } from \"./AuthgearProvider.js\";\n\nexport interface SignInButtonProps extends ButtonHTMLAttributes<HTMLButtonElement> {\n  signInOptions?: SignInOptions;\n}\n\nexport function SignInButton({ signInOptions, children = \"Sign In\", ...props }: SignInButtonProps) {\n  const { signIn } = useAuthgearContext();\n  return (\n    <button {...props} onClick={() => signIn(signInOptions)}>\n      {children}\n    </button>\n  );\n}\n","\"use client\";\n\nimport React, { type ButtonHTMLAttributes } from \"react\";\nimport { useAuthgearContext } from \"./AuthgearProvider.js\";\n\nexport type SignOutButtonProps = ButtonHTMLAttributes<HTMLButtonElement>;\n\nexport function SignOutButton({ children = \"Sign Out\", ...props }: SignOutButtonProps) {\n  const { signOut } = useAuthgearContext();\n  return (\n    <button {...props} onClick={signOut}>\n      {children}\n    </button>\n  );\n}\n","\"use client\";\n\nimport { useAuthgearContext, type SignInOptions } from \"../components/AuthgearProvider.js\";\nimport { SessionState, type UserInfo } from \"../types.js\";\n\nexport interface UseAuthgearReturn {\n  /** Current session state */\n  state: SessionState;\n  /** Current user info, null if not authenticated */\n  user: UserInfo | null;\n  /** Whether the initial session check has completed */\n  isLoaded: boolean;\n  /** Whether the user is currently authenticated */\n  isAuthenticated: boolean;\n  /** Navigate to the sign-in page */\n  signIn: (options?: SignInOptions) => void;\n  /** Navigate to the sign-out endpoint */\n  signOut: () => void;\n}\n\nexport function useAuthgear(): UseAuthgearReturn {\n  const { state, user, isLoaded, signIn, signOut } = useAuthgearContext();\n\n  return {\n    state,\n    user,\n    isLoaded,\n    isAuthenticated: state === SessionState.Authenticated,\n    signIn,\n    signOut,\n  };\n}\n","\"use client\";\n\nimport { useAuthgearContext } from \"../components/AuthgearProvider.js\";\nimport type { UserInfo } from \"../types.js\";\n\n/** Returns the current user info, or null if not authenticated. */\nexport function useUser(): UserInfo | null {\n  const { user } = useAuthgearContext();\n  return user;\n}\n"],"mappings":";;;;;;;AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAgGH;AA1EJ,IAAM,kBAAkB,cAA2C,IAAI;AAYhE,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,aAAa;AACf,GAA0B;AACxB,QAAM,CAAC,OAAO,QAAQ,IAAI,gCAA2C;AACrE,QAAM,CAAC,MAAM,OAAO,IAAI,SAA0B,IAAI;AACtD,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,KAAK;AAE9C,YAAU,MAAM;AACd,QAAI,YAAY;AAEhB,mBAAe,eAAe;AAC5B,UAAI;AACF,cAAM,MAAM,MAAM,MAAM,YAAY;AACpC,YAAI,UAAW;AAEf,YAAI,IAAI,IAAI;AACV,gBAAM,WAAY,MAAM,IAAI,KAAK;AACjC,sDAAmC;AACnC,kBAAQ,QAAQ;AAAA,QAClB,OAAO;AACL,+CAA+B;AAC/B,kBAAQ,IAAI;AAAA,QACd;AAAA,MACF,QAAQ;AACN,YAAI,CAAC,WAAW;AACd,+CAA+B;AAC/B,kBAAQ,IAAI;AAAA,QACd;AAAA,MACF,UAAE;AACA,YAAI,CAAC,WAAW;AACd,sBAAY,IAAI;AAAA,QAClB;AAAA,MACF;AAAA,IACF;AAEA,iBAAa;AACb,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAM;AAAA,EACnC,GAAG,CAAC,YAAY,CAAC;AAEjB,QAAM,SAAS;AAAA,IACb,CAAC,YAA4B;AAC3B,YAAM,OAAO,SAAS,aAAa;AACnC,YAAM,MAAM,IAAI,IAAI,MAAM,OAAO,SAAS,MAAM;AAChD,UAAI,SAAS,UAAU;AACrB,YAAI,aAAa,IAAI,YAAY,QAAQ,QAAQ;AAAA,MACnD;AACA,UAAI,SAAS,UAAU,MAAM;AAC3B,YAAI,aAAa,IAAI,UAAU,QAAQ,MAAM;AAAA,MAC/C;AACA,aAAO,SAAS,OAAO,IAAI,SAAS;AAAA,IACtC;AAAA,IACA,CAAC,SAAS;AAAA,EACZ;AAEA,QAAM,UAAU,YAAY,MAAM;AAChC,WAAO,SAAS,OAAO;AAAA,EACzB,GAAG,CAAC,UAAU,CAAC;AAEf,SACE,oBAAC,gBAAgB,UAAhB,EAAyB,OAAO,EAAE,OAAO,MAAM,UAAU,QAAQ,QAAQ,GACvE,UACH;AAEJ;AAEO,SAAS,qBAA2C;AACzD,QAAM,MAAM,WAAW,eAAe;AACtC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,SAAO;AACT;;;ACzGI,gBAAAA,YAAA;AAHG,SAAS,aAAa,EAAE,eAAe,WAAW,WAAW,GAAG,MAAM,GAAsB;AACjG,QAAM,EAAE,OAAO,IAAI,mBAAmB;AACtC,SACE,gBAAAA,KAAC,YAAQ,GAAG,OAAO,SAAS,MAAM,OAAO,aAAa,GACnD,UACH;AAEJ;;;ACNI,gBAAAC,YAAA;AAHG,SAAS,cAAc,EAAE,WAAW,YAAY,GAAG,MAAM,GAAuB;AACrF,QAAM,EAAE,QAAQ,IAAI,mBAAmB;AACvC,SACE,gBAAAA,KAAC,YAAQ,GAAG,OAAO,SAAS,SACzB,UACH;AAEJ;;;ACMO,SAAS,cAAiC;AAC/C,QAAM,EAAE,OAAO,MAAM,UAAU,QAAQ,QAAQ,IAAI,mBAAmB;AAEtE,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AACF;;;ACzBO,SAAS,UAA2B;AACzC,QAAM,EAAE,KAAK,IAAI,mBAAmB;AACpC,SAAO;AACT;","names":["jsx","jsx"]}
+{"version":3,"sources":["../src/components/AuthgearProvider.tsx","../src/components/SignInButton.tsx","../src/components/SignOutButton.tsx","../src/components/UserSettingsButton.tsx","../src/hooks/useAuthgear.ts","../src/hooks/useUser.ts"],"sourcesContent":["\"use client\";\n\nimport React, {\n  createContext,\n  useContext,\n  useEffect,\n  useState,\n  useCallback,\n  type ReactNode,\n} from \"react\";\nimport { SessionState, type UserInfo } from \"../types.js\";\n\nexport interface AuthgearContextValue {\n  state: SessionState;\n  user: UserInfo | null;\n  isLoaded: boolean;\n  signIn: (options?: SignInOptions) => void;\n  signOut: () => void;\n  /** Open an Authgear page (e.g. Page.Settings) in a new tab for the current user */\n  openPage: (path: string) => void;\n}\n\nexport interface SignInOptions {\n  returnTo?: string;\n  loginPath?: string;\n  /**\n   * OIDC `prompt` parameter for this sign-in call.\n   * Overrides the global `isSSOEnabled` setting for this navigation.\n   * Use `PromptOption.Login` or `PromptOption.None` for type-safe values.\n   */\n  prompt?: string;\n}\n\nconst AuthgearContext = createContext<AuthgearContextValue | null>(null);\n\nexport interface AuthgearProviderProps {\n  children: ReactNode;\n  /** Path to the userinfo API route. Defaults to \"/api/auth/userinfo\". */\n  userInfoPath?: string;\n  /** Path to the login route. Defaults to \"/api/auth/login\". */\n  loginPath?: string;\n  /** Path to the logout route. Defaults to \"/api/auth/logout\". */\n  logoutPath?: string;\n  /** Path to the open-page route handler. Defaults to \"/api/auth/open\". */\n  openPagePath?: string;\n}\n\nexport function AuthgearProvider({\n  children,\n  userInfoPath = \"/api/auth/userinfo\",\n  loginPath = \"/api/auth/login\",\n  logoutPath = \"/api/auth/logout\",\n  openPagePath = \"/api/auth/open\",\n}: AuthgearProviderProps) {\n  const [state, setState] = useState<SessionState>(SessionState.Unknown);\n  const [user, setUser] = useState<UserInfo | null>(null);\n  const [isLoaded, setIsLoaded] = useState(false);\n\n  useEffect(() => {\n    let cancelled = false;\n\n    async function fetchSession() {\n      try {\n        const res = await fetch(userInfoPath);\n        if (cancelled) return;\n\n        if (res.ok) {\n          const userInfo = (await res.json()) as UserInfo;\n          setState(SessionState.Authenticated);\n          setUser(userInfo);\n        } else {\n          setState(SessionState.NoSession);\n          setUser(null);\n        }\n      } catch {\n        if (!cancelled) {\n          setState(SessionState.NoSession);\n          setUser(null);\n        }\n      } finally {\n        if (!cancelled) {\n          setIsLoaded(true);\n        }\n      }\n    }\n\n    fetchSession();\n    return () => { cancelled = true; };\n  }, [userInfoPath]);\n\n  const signIn = useCallback(\n    (options?: SignInOptions) => {\n      const path = options?.loginPath ?? loginPath;\n      const url = new URL(path, window.location.origin);\n      if (options?.returnTo) {\n        url.searchParams.set(\"returnTo\", options.returnTo);\n      }\n      if (options?.prompt != null) {\n        url.searchParams.set(\"prompt\", options.prompt);\n      }\n      window.location.href = url.toString();\n    },\n    [loginPath],\n  );\n\n  const signOut = useCallback(() => {\n    window.location.href = logoutPath;\n  }, [logoutPath]);\n\n  const openPage = useCallback(\n    (path: string) => {\n      const url = new URL(openPagePath, window.location.origin);\n      url.searchParams.set(\"page\", path);\n      window.open(url.toString(), \"_blank\", \"noopener,noreferrer\");\n    },\n    [openPagePath],\n  );\n\n  return (\n    <AuthgearContext.Provider value={{ state, user, isLoaded, signIn, signOut, openPage }}>\n      {children}\n    </AuthgearContext.Provider>\n  );\n}\n\nexport function useAuthgearContext(): AuthgearContextValue {\n  const ctx = useContext(AuthgearContext);\n  if (!ctx) {\n    throw new Error(\"useAuthgearContext must be used within <AuthgearProvider>\");\n  }\n  return ctx;\n}\n","\"use client\";\n\nimport React, { type ButtonHTMLAttributes } from \"react\";\nimport { useAuthgearContext, type SignInOptions } from \"./AuthgearProvider.js\";\n\nexport interface SignInButtonProps extends ButtonHTMLAttributes<HTMLButtonElement> {\n  signInOptions?: SignInOptions;\n}\n\nexport function SignInButton({ signInOptions, children = \"Sign In\", ...props }: SignInButtonProps) {\n  const { signIn } = useAuthgearContext();\n  return (\n    <button {...props} onClick={(e) => { props.onClick?.(e); signIn(signInOptions); }}>\n      {children}\n    </button>\n  );\n}\n","\"use client\";\n\nimport React, { type ButtonHTMLAttributes } from \"react\";\nimport { useAuthgearContext } from \"./AuthgearProvider.js\";\n\nexport type SignOutButtonProps = ButtonHTMLAttributes<HTMLButtonElement>;\n\nexport function SignOutButton({ children = \"Sign Out\", ...props }: SignOutButtonProps) {\n  const { signOut } = useAuthgearContext();\n  return (\n    <button {...props} onClick={(e) => { props.onClick?.(e); signOut(); }}>\n      {children}\n    </button>\n  );\n}\n","\"use client\";\n\nimport React, { type ButtonHTMLAttributes } from \"react\";\nimport { useAuthgearContext } from \"./AuthgearProvider.js\";\nimport { Page } from \"../types.js\";\n\nexport type UserSettingsButtonProps = ButtonHTMLAttributes<HTMLButtonElement>;\n\n/**\n * A button that opens Authgear's account settings page in a new tab\n * for the currently authenticated user. Requires `AuthgearProvider` as an ancestor.\n *\n * Uses `GET /api/auth/open?page=/settings` under the hood — no Server Action needed.\n */\nexport function UserSettingsButton({\n  children = \"Account Settings\",\n  ...props\n}: UserSettingsButtonProps) {\n  const { openPage } = useAuthgearContext();\n  return (\n    <button {...props} onClick={(e) => { props.onClick?.(e); openPage(Page.Settings); }}>\n      {children}\n    </button>\n  );\n}\n","\"use client\";\n\nimport { useAuthgearContext, type SignInOptions } from \"../components/AuthgearProvider.js\";\nimport { SessionState, type UserInfo } from \"../types.js\";\n\nexport interface UseAuthgearReturn {\n  /** Current session state */\n  state: SessionState;\n  /** Current user info, null if not authenticated */\n  user: UserInfo | null;\n  /** Whether the initial session check has completed */\n  isLoaded: boolean;\n  /** Whether the user is currently authenticated */\n  isAuthenticated: boolean;\n  /** Navigate to the sign-in page */\n  signIn: (options?: SignInOptions) => void;\n  /** Navigate to the sign-out endpoint */\n  signOut: () => void;\n  /** Open an Authgear page (e.g. Page.Settings) in a new tab */\n  openPage: (path: string) => void;\n}\n\nexport function useAuthgear(): UseAuthgearReturn {\n  const { state, user, isLoaded, signIn, signOut, openPage } = useAuthgearContext();\n\n  return {\n    state,\n    user,\n    isLoaded,\n    isAuthenticated: state === SessionState.Authenticated,\n    signIn,\n    signOut,\n    openPage,\n  };\n}\n","\"use client\";\n\nimport { useAuthgearContext } from \"../components/AuthgearProvider.js\";\nimport type { UserInfo } from \"../types.js\";\n\n/** Returns the current user info, or null if not authenticated. */\nexport function useUser(): UserInfo | null {\n  const { user } = useAuthgearContext();\n  return user;\n}\n"],"mappings":";;;;;;;;AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AA8GH;AAtFJ,IAAM,kBAAkB,cAA2C,IAAI;AAchE,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,eAAe;AACjB,GAA0B;AACxB,QAAM,CAAC,OAAO,QAAQ,IAAI,gCAA2C;AACrE,QAAM,CAAC,MAAM,OAAO,IAAI,SAA0B,IAAI;AACtD,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,KAAK;AAE9C,YAAU,MAAM;AACd,QAAI,YAAY;AAEhB,mBAAe,eAAe;AAC5B,UAAI;AACF,cAAM,MAAM,MAAM,MAAM,YAAY;AACpC,YAAI,UAAW;AAEf,YAAI,IAAI,IAAI;AACV,gBAAM,WAAY,MAAM,IAAI,KAAK;AACjC,sDAAmC;AACnC,kBAAQ,QAAQ;AAAA,QAClB,OAAO;AACL,+CAA+B;AAC/B,kBAAQ,IAAI;AAAA,QACd;AAAA,MACF,QAAQ;AACN,YAAI,CAAC,WAAW;AACd,+CAA+B;AAC/B,kBAAQ,IAAI;AAAA,QACd;AAAA,MACF,UAAE;AACA,YAAI,CAAC,WAAW;AACd,sBAAY,IAAI;AAAA,QAClB;AAAA,MACF;AAAA,IACF;AAEA,iBAAa;AACb,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAM;AAAA,EACnC,GAAG,CAAC,YAAY,CAAC;AAEjB,QAAM,SAAS;AAAA,IACb,CAAC,YAA4B;AAC3B,YAAM,OAAO,SAAS,aAAa;AACnC,YAAM,MAAM,IAAI,IAAI,MAAM,OAAO,SAAS,MAAM;AAChD,UAAI,SAAS,UAAU;AACrB,YAAI,aAAa,IAAI,YAAY,QAAQ,QAAQ;AAAA,MACnD;AACA,UAAI,SAAS,UAAU,MAAM;AAC3B,YAAI,aAAa,IAAI,UAAU,QAAQ,MAAM;AAAA,MAC/C;AACA,aAAO,SAAS,OAAO,IAAI,SAAS;AAAA,IACtC;AAAA,IACA,CAAC,SAAS;AAAA,EACZ;AAEA,QAAM,UAAU,YAAY,MAAM;AAChC,WAAO,SAAS,OAAO;AAAA,EACzB,GAAG,CAAC,UAAU,CAAC;AAEf,QAAM,WAAW;AAAA,IACf,CAAC,SAAiB;AAChB,YAAM,MAAM,IAAI,IAAI,cAAc,OAAO,SAAS,MAAM;AACxD,UAAI,aAAa,IAAI,QAAQ,IAAI;AACjC,aAAO,KAAK,IAAI,SAAS,GAAG,UAAU,qBAAqB;AAAA,IAC7D;AAAA,IACA,CAAC,YAAY;AAAA,EACf;AAEA,SACE,oBAAC,gBAAgB,UAAhB,EAAyB,OAAO,EAAE,OAAO,MAAM,UAAU,QAAQ,SAAS,SAAS,GACjF,UACH;AAEJ;AAEO,SAAS,qBAA2C;AACzD,QAAM,MAAM,WAAW,eAAe;AACtC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,SAAO;AACT;;;ACvHI,gBAAAA,YAAA;AAHG,SAAS,aAAa,EAAE,eAAe,WAAW,WAAW,GAAG,MAAM,GAAsB;AACjG,QAAM,EAAE,OAAO,IAAI,mBAAmB;AACtC,SACE,gBAAAA,KAAC,YAAQ,GAAG,OAAO,SAAS,CAAC,MAAM;AAAE,UAAM,UAAU,CAAC;AAAG,WAAO,aAAa;AAAA,EAAG,GAC7E,UACH;AAEJ;;;ACNI,gBAAAC,YAAA;AAHG,SAAS,cAAc,EAAE,WAAW,YAAY,GAAG,MAAM,GAAuB;AACrF,QAAM,EAAE,QAAQ,IAAI,mBAAmB;AACvC,SACE,gBAAAA,KAAC,YAAQ,GAAG,OAAO,SAAS,CAAC,MAAM;AAAE,UAAM,UAAU,CAAC;AAAG,YAAQ;AAAA,EAAG,GACjE,UACH;AAEJ;;;ACMI,gBAAAC,YAAA;AANG,SAAS,mBAAmB;AAAA,EACjC,WAAW;AAAA,EACX,GAAG;AACL,GAA4B;AAC1B,QAAM,EAAE,SAAS,IAAI,mBAAmB;AACxC,SACE,gBAAAA,KAAC,YAAQ,GAAG,OAAO,SAAS,CAAC,MAAM;AAAE,UAAM,UAAU,CAAC;AAAG,uCAAsB;AAAA,EAAG,GAC/E,UACH;AAEJ;;;ACFO,SAAS,cAAiC;AAC/C,QAAM,EAAE,OAAO,MAAM,UAAU,QAAQ,SAAS,SAAS,IAAI,mBAAmB;AAEhF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;AC5BO,SAAS,UAA2B;AACzC,QAAM,EAAE,KAAK,IAAI,mBAAmB;AACpC,SAAO;AACT;","names":["jsx","jsx","jsx"]}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { A as AuthgearConfig } from './types-Cx-gnfE7.js';
-export { D as DEFAULT_SCOPES, J as JWTPayload, O as OIDCConfiguration, P as Page, a as PromptOption, S as Session, b as SessionData, c as SessionState, T as TokenResponse, U as UserInfo } from './types-Cx-gnfE7.js';
+import { A as AuthgearConfig } from './types-D6m4Hact.js';
+export { D as DEFAULT_SCOPES, J as JWTPayload, O as OIDCConfiguration, P as Page, a as PromptOption, S as Session, b as SessionData, c as SessionState, T as TokenResponse, U as UserInfo } from './types-D6m4Hact.js';
 
 /**
  * Creates Next.js route handlers for all Authgear auth endpoints.
@@ -17,6 +17,7 @@ export { D as DEFAULT_SCOPES, J as JWTPayload, O as OIDCConfiguration, P as Page
  * - GET /api/auth/logout    — Logout and revoke tokens
  * - POST /api/auth/refresh  — Refresh access token
  * - GET /api/auth/userinfo  — Get current user info
+ * - GET /api/auth/open      — Open an Authgear page (e.g. /settings) for the current user
  */
 declare function createAuthgearHandlers(config: AuthgearConfig): {
     GET: (request: NextRequest, { params }: {

package/dist/index.js

@@ -1,5 +1,6 @@
 import {
   buildAuthorizeURL,
+  buildOpenURL,
   generateCodeVerifier,
   generateState,
   parseUserInfo
@@ -12,20 +13,21 @@ import {
   decryptSession,
   exchangeCode,
   fetchOIDCConfiguration,
+  getAppSessionToken,
   isTokenExpired,
   refreshAccessToken,
   resolveConfig,
   revokeToken
-} from "./chunk-UERNRN5J.js";
+} from "./chunk-LPGVCNZ6.js";
 import {
   DEFAULT_SCOPES,
   Page,
   PromptOption,
   SessionState
-} from "./chunk-CCQOLKXU.js";
+} from "./chunk-AJJAXXPI.js";
 
 // src/handlers/index.ts
-import { NextResponse as NextResponse6 } from "next/server";
+import { NextResponse as NextResponse7 } from "next/server";
 
 // src/handlers/login.ts
 import { NextResponse } from "next/server";
@@ -232,6 +234,46 @@ async function handleUserInfo(request, config) {
   return response;
 }
 
+// src/handlers/open.ts
+import { NextResponse as NextResponse6 } from "next/server";
+var ALLOWED_PAGES = new Set(Object.values(Page));
+async function handleOpen(request, config) {
+  const resolved = resolveConfig(config);
+  const pageParam = request.nextUrl.searchParams.get("page");
+  if (!pageParam || !ALLOWED_PAGES.has(pageParam)) {
+    return NextResponse6.json({ error: "invalid_page" }, { status: 400 });
+  }
+  const sessionCookieValue = request.cookies.get(resolved.cookieName)?.value;
+  if (!sessionCookieValue) {
+    return NextResponse6.json({ error: "not_authenticated" }, { status: 401 });
+  }
+  const sessionData = decryptSession(sessionCookieValue, resolved.sessionSecret);
+  if (!sessionData) {
+    return NextResponse6.json({ error: "not_authenticated" }, { status: 401 });
+  }
+  if (!sessionData.refreshToken) {
+    return NextResponse6.json({ error: "no_refresh_token" }, { status: 401 });
+  }
+  const oidcConfig = await fetchOIDCConfiguration(resolved.endpoint);
+  let app_session_token;
+  try {
+    const tokenResponse = await getAppSessionToken(
+      resolved.endpoint,
+      sessionData.refreshToken
+    );
+    app_session_token = tokenResponse.app_session_token;
+  } catch {
+    return NextResponse6.json({ error: "not_authenticated" }, { status: 401 });
+  }
+  const url = buildOpenURL(oidcConfig, {
+    clientID: resolved.clientID,
+    appSessionToken: app_session_token,
+    targetPath: pageParam,
+    scopes: resolved.scopes
+  });
+  return NextResponse6.redirect(url, 302);
+}
+
 // src/handlers/index.ts
 function createAuthgearHandlers(config) {
   async function GET(request, { params }) {
@@ -246,8 +288,10 @@ function createAuthgearHandlers(config) {
         return handleLogout(request, config);
       case "userinfo":
         return handleUserInfo(request, config);
+      case "open":
+        return handleOpen(request, config);
       default:
-        return NextResponse6.json({ error: "not_found" }, { status: 404 });
+        return NextResponse7.json({ error: "not_found" }, { status: 404 });
     }
   }
   async function POST(request, { params }) {
@@ -257,7 +301,7 @@ function createAuthgearHandlers(config) {
       case "refresh":
         return handleRefresh(request, config);
       default:
-        return NextResponse6.json({ error: "not_found" }, { status: 404 });
+        return NextResponse7.json({ error: "not_found" }, { status: 404 });
     }
   }
   return { GET, POST };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/handlers/index.ts","../src/handlers/login.ts","../src/handlers/callback.ts","../src/handlers/logout.ts","../src/handlers/refresh.ts","../src/handlers/userinfo.ts"],"sourcesContent":["import { NextResponse, type NextRequest } from \"next/server\";\nimport type { AuthgearConfig } from \"../types.js\";\nimport { handleLogin } from \"./login.js\";\nimport { handleCallback } from \"./callback.js\";\nimport { handleLogout } from \"./logout.js\";\nimport { handleRefresh } from \"./refresh.js\";\nimport { handleUserInfo } from \"./userinfo.js\";\n\n/**\n * Creates Next.js route handlers for all Authgear auth endpoints.\n *\n * Usage in `app/api/auth/[...authgear]/route.ts`:\n * ```ts\n * import { createAuthgearHandlers } from \"@authgear/nextjs\";\n * export const { GET, POST } = createAuthgearHandlers(config);\n * ```\n *\n * Routes handled:\n * - GET /api/auth/login     — Start OAuth flow\n * - GET /api/auth/callback  — Handle OAuth callback\n * - GET /api/auth/logout    — Logout and revoke tokens\n * - POST /api/auth/refresh  — Refresh access token\n * - GET /api/auth/userinfo  — Get current user info\n */\nexport function createAuthgearHandlers(config: AuthgearConfig) {\n  async function GET(\n    request: NextRequest,\n    { params }: { params: Promise<{ authgear: string[] }> },\n  ): Promise<NextResponse> {\n    const { authgear } = await params;\n    const action = authgear?.[0];\n\n    switch (action) {\n      case \"login\":\n        return handleLogin(request, config);\n      case \"callback\":\n        return handleCallback(request, config);\n      case \"logout\":\n        return handleLogout(request, config);\n      case \"userinfo\":\n        return handleUserInfo(request, config);\n      default:\n        return NextResponse.json({ error: \"not_found\" }, { status: 404 });\n    }\n  }\n\n  async function POST(\n    request: NextRequest,\n    { params }: { params: Promise<{ authgear: string[] }> },\n  ): Promise<NextResponse> {\n    const { authgear } = await params;\n    const action = authgear?.[0];\n\n    switch (action) {\n      case \"refresh\":\n        return handleRefresh(request, config);\n      default:\n        return NextResponse.json({ error: \"not_found\" }, { status: 404 });\n    }\n  }\n\n  return { GET, POST };\n}\n","import { NextResponse, type NextRequest } from \"next/server\";\nimport type { AuthgearConfig } from \"../types.js\";\nimport { PromptOption } from \"../types.js\";\nimport { resolveConfig } from \"../config.js\";\nimport { fetchOIDCConfiguration } from \"../oauth/discovery.js\";\nimport { generateCodeVerifier } from \"../oauth/pkce.js\";\nimport { buildAuthorizeURL, generateState } from \"../oauth/authorize.js\";\nimport { buildPKCECookie } from \"../session/cookie.js\";\n\nexport async function handleLogin(\n  request: NextRequest,\n  config: AuthgearConfig,\n): Promise<NextResponse> {\n  const resolved = resolveConfig(config);\n  const oidcConfig = await fetchOIDCConfiguration(resolved.endpoint);\n\n  const returnTo = request.nextUrl.searchParams.get(\"returnTo\") ?? \"/\";\n  const codeVerifier = generateCodeVerifier();\n  const state = generateState();\n\n  // Per-call ?prompt= query param takes precedence over the global isSSOEnabled default\n  const ALLOWED_PROMPTS = new Set<string>(Object.values(PromptOption));\n  const rawPrompt = request.nextUrl.searchParams.get(\"prompt\");\n  const perCallPrompt = rawPrompt !== null && ALLOWED_PROMPTS.has(rawPrompt) ? rawPrompt : undefined;\n  const prompt = perCallPrompt ?? (resolved.isSSOEnabled ? undefined : \"login\");\n\n  const authorizeURL = buildAuthorizeURL(oidcConfig, {\n    clientID: resolved.clientID,\n    redirectURI: resolved.redirectURI,\n    scopes: resolved.scopes,\n    codeVerifier,\n    state,\n    prompt,\n  });\n\n  const pkceCookie = buildPKCECookie({ codeVerifier, state, returnTo }, resolved.sessionSecret);\n\n  const response = NextResponse.redirect(authorizeURL);\n  response.cookies.set(pkceCookie.name, pkceCookie.value, {\n    httpOnly: pkceCookie.httpOnly,\n    secure: pkceCookie.secure,\n    sameSite: pkceCookie.sameSite,\n    path: pkceCookie.path,\n    maxAge: pkceCookie.maxAge,\n  });\n\n  return response;\n}\n","import { NextResponse, type NextRequest } from \"next/server\";\nimport type { AuthgearConfig } from \"../types.js\";\nimport { resolveConfig } from \"../config.js\";\nimport { fetchOIDCConfiguration } from \"../oauth/discovery.js\";\nimport { exchangeCode } from \"../oauth/token.js\";\nimport { decryptPKCECookie, buildSessionCookie } from \"../session/cookie.js\";\n\nexport async function handleCallback(\n  request: NextRequest,\n  config: AuthgearConfig,\n): Promise<NextResponse> {\n  const resolved = resolveConfig(config);\n\n  const code = request.nextUrl.searchParams.get(\"code\");\n  const state = request.nextUrl.searchParams.get(\"state\");\n  const error = request.nextUrl.searchParams.get(\"error\");\n  const errorDescription = request.nextUrl.searchParams.get(\"error_description\");\n\n  if (error) {\n    return NextResponse.json(\n      { error, error_description: errorDescription },\n      { status: 400 },\n    );\n  }\n\n  if (!code || !state) {\n    return NextResponse.json(\n      { error: \"missing_params\", error_description: \"Missing code or state parameter\" },\n      { status: 400 },\n    );\n  }\n\n  // Validate PKCE state\n  const pkceCookieValue = request.cookies.get(\"authgear.pkce\")?.value;\n  if (!pkceCookieValue) {\n    return NextResponse.json(\n      { error: \"invalid_state\", error_description: \"Missing PKCE cookie\" },\n      { status: 400 },\n    );\n  }\n\n  const pkceData = decryptPKCECookie(pkceCookieValue, resolved.sessionSecret);\n  if (!pkceData || pkceData.state !== state) {\n    return NextResponse.json(\n      { error: \"invalid_state\", error_description: \"State mismatch\" },\n      { status: 400 },\n    );\n  }\n\n  // Exchange code for tokens\n  const oidcConfig = await fetchOIDCConfiguration(resolved.endpoint);\n  const tokenResponse = await exchangeCode(oidcConfig, {\n    code,\n    codeVerifier: pkceData.codeVerifier,\n    clientID: resolved.clientID,\n    redirectURI: resolved.redirectURI,\n  });\n\n  // Build session cookie\n  const sessionCookie = buildSessionCookie(\n    resolved.cookieName,\n    {\n      accessToken: tokenResponse.access_token,\n      refreshToken: tokenResponse.refresh_token ?? null,\n      idToken: tokenResponse.id_token ?? null,\n      expiresAt: Math.floor(Date.now() / 1000) + tokenResponse.expires_in,\n    },\n    resolved.sessionSecret,\n  );\n\n  const returnTo = pkceData.returnTo || \"/\";\n  const redirectURL = new URL(returnTo, request.nextUrl.origin);\n  const response = NextResponse.redirect(redirectURL);\n\n  // Set session cookie\n  response.cookies.set(sessionCookie.name, sessionCookie.value, {\n    httpOnly: sessionCookie.httpOnly,\n    secure: sessionCookie.secure,\n    sameSite: sessionCookie.sameSite,\n    path: sessionCookie.path,\n    maxAge: sessionCookie.maxAge,\n  });\n\n  // Clear PKCE cookie\n  response.cookies.set(\"authgear.pkce\", \"\", { maxAge: 0, path: \"/\" });\n\n  return response;\n}\n","import { NextResponse, type NextRequest } from \"next/server\";\nimport type { AuthgearConfig } from \"../types.js\";\nimport { resolveConfig } from \"../config.js\";\nimport { fetchOIDCConfiguration } from \"../oauth/discovery.js\";\nimport { revokeToken } from \"../oauth/token.js\";\nimport { decryptSession, buildClearCookie } from \"../session/cookie.js\";\n\nexport async function handleLogout(\n  request: NextRequest,\n  config: AuthgearConfig,\n): Promise<NextResponse> {\n  const resolved = resolveConfig(config);\n\n  // Revoke refresh token if present\n  const sessionCookie = request.cookies.get(resolved.cookieName)?.value;\n  if (sessionCookie) {\n    const session = decryptSession(sessionCookie, resolved.sessionSecret);\n    if (session?.refreshToken) {\n      const oidcConfig = await fetchOIDCConfiguration(resolved.endpoint);\n      try {\n        await revokeToken(oidcConfig, session.refreshToken);\n      } catch {\n        // Best-effort revocation\n      }\n    }\n  }\n\n  const clearCookie = buildClearCookie(resolved.cookieName);\n  const redirectURL = new URL(resolved.postLogoutRedirectURI, request.nextUrl.origin);\n  const response = NextResponse.redirect(redirectURL);\n\n  response.cookies.set(clearCookie.name, clearCookie.value, {\n    httpOnly: clearCookie.httpOnly,\n    secure: clearCookie.secure,\n    sameSite: clearCookie.sameSite,\n    path: clearCookie.path,\n    maxAge: clearCookie.maxAge,\n  });\n\n  return response;\n}\n","import { NextResponse, type NextRequest } from \"next/server\";\nimport type { AuthgearConfig } from \"../types.js\";\nimport { resolveConfig } from \"../config.js\";\nimport { fetchOIDCConfiguration } from \"../oauth/discovery.js\";\nimport { refreshAccessToken } from \"../oauth/token.js\";\nimport { decryptSession, buildSessionCookie } from \"../session/cookie.js\";\n\nexport async function handleRefresh(\n  request: NextRequest,\n  config: AuthgearConfig,\n): Promise<NextResponse> {\n  const resolved = resolveConfig(config);\n\n  const sessionCookieValue = request.cookies.get(resolved.cookieName)?.value;\n  if (!sessionCookieValue) {\n    return NextResponse.json({ error: \"no_session\" }, { status: 401 });\n  }\n\n  const session = decryptSession(sessionCookieValue, resolved.sessionSecret);\n  if (!session?.refreshToken) {\n    return NextResponse.json({ error: \"no_refresh_token\" }, { status: 401 });\n  }\n\n  const oidcConfig = await fetchOIDCConfiguration(resolved.endpoint);\n  const tokenResponse = await refreshAccessToken(oidcConfig, {\n    refreshToken: session.refreshToken,\n    clientID: resolved.clientID,\n  });\n\n  const newSession = {\n    accessToken: tokenResponse.access_token,\n    refreshToken: tokenResponse.refresh_token ?? session.refreshToken,\n    idToken: tokenResponse.id_token ?? session.idToken,\n    expiresAt: Math.floor(Date.now() / 1000) + tokenResponse.expires_in,\n  };\n\n  const sessionCookie = buildSessionCookie(resolved.cookieName, newSession, resolved.sessionSecret);\n  const response = NextResponse.json({ ok: true });\n\n  response.cookies.set(sessionCookie.name, sessionCookie.value, {\n    httpOnly: sessionCookie.httpOnly,\n    secure: sessionCookie.secure,\n    sameSite: sessionCookie.sameSite,\n    path: sessionCookie.path,\n    maxAge: sessionCookie.maxAge,\n  });\n\n  return response;\n}\n","import { NextResponse, type NextRequest } from \"next/server\";\nimport type { AuthgearConfig, UserInfo } from \"../types.js\";\nimport { resolveConfig } from \"../config.js\";\nimport { fetchOIDCConfiguration } from \"../oauth/discovery.js\";\nimport { decryptSession } from \"../session/cookie.js\";\nimport { isTokenExpired } from \"../session/state.js\";\nimport { refreshAccessToken } from \"../oauth/token.js\";\nimport { buildSessionCookie } from \"../session/cookie.js\";\nimport { parseUserInfo } from \"../user.js\";\n\nexport async function handleUserInfo(\n  request: NextRequest,\n  config: AuthgearConfig,\n): Promise<NextResponse> {\n  const resolved = resolveConfig(config);\n\n  const sessionCookieValue = request.cookies.get(resolved.cookieName)?.value;\n  if (!sessionCookieValue) {\n    return NextResponse.json({ error: \"no_session\" }, { status: 401 });\n  }\n\n  let session = decryptSession(sessionCookieValue, resolved.sessionSecret);\n  if (!session) {\n    return NextResponse.json({ error: \"invalid_session\" }, { status: 401 });\n  }\n\n  const oidcConfig = await fetchOIDCConfiguration(resolved.endpoint);\n\n  // Auto-refresh if access token is expired\n  if (isTokenExpired(session.expiresAt) && session.refreshToken) {\n    const tokenResponse = await refreshAccessToken(oidcConfig, {\n      refreshToken: session.refreshToken,\n      clientID: resolved.clientID,\n    });\n    session = {\n      accessToken: tokenResponse.access_token,\n      refreshToken: tokenResponse.refresh_token ?? session.refreshToken,\n      idToken: tokenResponse.id_token ?? session.idToken,\n      expiresAt: Math.floor(Date.now() / 1000) + tokenResponse.expires_in,\n    };\n  }\n\n  // Fetch user info from Authgear\n  const userinfoRes = await fetch(oidcConfig.userinfo_endpoint, {\n    headers: { Authorization: `Bearer ${session.accessToken}` },\n  });\n\n  if (!userinfoRes.ok) {\n    return NextResponse.json({ error: \"userinfo_failed\" }, { status: userinfoRes.status });\n  }\n\n  const raw = (await userinfoRes.json()) as Record<string, unknown>;\n  const userInfo: UserInfo = parseUserInfo(raw);\n\n  const response = NextResponse.json(userInfo);\n\n  // Update session cookie if tokens were refreshed\n  const newCookie = buildSessionCookie(resolved.cookieName, session, resolved.sessionSecret);\n  response.cookies.set(newCookie.name, newCookie.value, {\n    httpOnly: newCookie.httpOnly,\n    secure: newCookie.secure,\n    sameSite: newCookie.sameSite,\n    path: newCookie.path,\n    maxAge: newCookie.maxAge,\n  });\n\n  return response;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,gBAAAA,qBAAsC;;;ACA/C,SAAS,oBAAsC;AAS/C,eAAsB,YACpB,SACA,QACuB;AACvB,QAAM,WAAW,cAAc,MAAM;AACrC,QAAM,aAAa,MAAM,uBAAuB,SAAS,QAAQ;AAEjE,QAAM,WAAW,QAAQ,QAAQ,aAAa,IAAI,UAAU,KAAK;AACjE,QAAM,eAAe,qBAAqB;AAC1C,QAAM,QAAQ,cAAc;AAG5B,QAAM,kBAAkB,IAAI,IAAY,OAAO,OAAO,YAAY,CAAC;AACnE,QAAM,YAAY,QAAQ,QAAQ,aAAa,IAAI,QAAQ;AAC3D,QAAM,gBAAgB,cAAc,QAAQ,gBAAgB,IAAI,SAAS,IAAI,YAAY;AACzF,QAAM,SAAS,kBAAkB,SAAS,eAAe,SAAY;AAErE,QAAM,eAAe,kBAAkB,YAAY;AAAA,IACjD,UAAU,SAAS;AAAA,IACnB,aAAa,SAAS;AAAA,IACtB,QAAQ,SAAS;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,aAAa,gBAAgB,EAAE,cAAc,OAAO,SAAS,GAAG,SAAS,aAAa;AAE5F,QAAM,WAAW,aAAa,SAAS,YAAY;AACnD,WAAS,QAAQ,IAAI,WAAW,MAAM,WAAW,OAAO;AAAA,IACtD,UAAU,WAAW;AAAA,IACrB,QAAQ,WAAW;AAAA,IACnB,UAAU,WAAW;AAAA,IACrB,MAAM,WAAW;AAAA,IACjB,QAAQ,WAAW;AAAA,EACrB,CAAC;AAED,SAAO;AACT;;;AC/CA,SAAS,gBAAAC,qBAAsC;AAO/C,eAAsB,eACpB,SACA,QACuB;AACvB,QAAM,WAAW,cAAc,MAAM;AAErC,QAAM,OAAO,QAAQ,QAAQ,aAAa,IAAI,MAAM;AACpD,QAAM,QAAQ,QAAQ,QAAQ,aAAa,IAAI,OAAO;AACtD,QAAM,QAAQ,QAAQ,QAAQ,aAAa,IAAI,OAAO;AACtD,QAAM,mBAAmB,QAAQ,QAAQ,aAAa,IAAI,mBAAmB;AAE7E,MAAI,OAAO;AACT,WAAOC,cAAa;AAAA,MAClB,EAAE,OAAO,mBAAmB,iBAAiB;AAAA,MAC7C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,CAAC,OAAO;AACnB,WAAOA,cAAa;AAAA,MAClB,EAAE,OAAO,kBAAkB,mBAAmB,kCAAkC;AAAA,MAChF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAGA,QAAM,kBAAkB,QAAQ,QAAQ,IAAI,eAAe,GAAG;AAC9D,MAAI,CAAC,iBAAiB;AACpB,WAAOA,cAAa;AAAA,MAClB,EAAE,OAAO,iBAAiB,mBAAmB,sBAAsB;AAAA,MACnE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,WAAW,kBAAkB,iBAAiB,SAAS,aAAa;AAC1E,MAAI,CAAC,YAAY,SAAS,UAAU,OAAO;AACzC,WAAOA,cAAa;AAAA,MAClB,EAAE,OAAO,iBAAiB,mBAAmB,iBAAiB;AAAA,MAC9D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAGA,QAAM,aAAa,MAAM,uBAAuB,SAAS,QAAQ;AACjE,QAAM,gBAAgB,MAAM,aAAa,YAAY;AAAA,IACnD;AAAA,IACA,cAAc,SAAS;AAAA,IACvB,UAAU,SAAS;AAAA,IACnB,aAAa,SAAS;AAAA,EACxB,CAAC;AAGD,QAAM,gBAAgB;AAAA,IACpB,SAAS;AAAA,IACT;AAAA,MACE,aAAa,cAAc;AAAA,MAC3B,cAAc,cAAc,iBAAiB;AAAA,MAC7C,SAAS,cAAc,YAAY;AAAA,MACnC,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,cAAc;AAAA,IAC3D;AAAA,IACA,SAAS;AAAA,EACX;AAEA,QAAM,WAAW,SAAS,YAAY;AACtC,QAAM,cAAc,IAAI,IAAI,UAAU,QAAQ,QAAQ,MAAM;AAC5D,QAAM,WAAWA,cAAa,SAAS,WAAW;AAGlD,WAAS,QAAQ,IAAI,cAAc,MAAM,cAAc,OAAO;AAAA,IAC5D,UAAU,cAAc;AAAA,IACxB,QAAQ,cAAc;AAAA,IACtB,UAAU,cAAc;AAAA,IACxB,MAAM,cAAc;AAAA,IACpB,QAAQ,cAAc;AAAA,EACxB,CAAC;AAGD,WAAS,QAAQ,IAAI,iBAAiB,IAAI,EAAE,QAAQ,GAAG,MAAM,IAAI,CAAC;AAElE,SAAO;AACT;;;ACvFA,SAAS,gBAAAC,qBAAsC;AAO/C,eAAsB,aACpB,SACA,QACuB;AACvB,QAAM,WAAW,cAAc,MAAM;AAGrC,QAAM,gBAAgB,QAAQ,QAAQ,IAAI,SAAS,UAAU,GAAG;AAChE,MAAI,eAAe;AACjB,UAAM,UAAU,eAAe,eAAe,SAAS,aAAa;AACpE,QAAI,SAAS,cAAc;AACzB,YAAM,aAAa,MAAM,uBAAuB,SAAS,QAAQ;AACjE,UAAI;AACF,cAAM,YAAY,YAAY,QAAQ,YAAY;AAAA,MACpD,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,iBAAiB,SAAS,UAAU;AACxD,QAAM,cAAc,IAAI,IAAI,SAAS,uBAAuB,QAAQ,QAAQ,MAAM;AAClF,QAAM,WAAWC,cAAa,SAAS,WAAW;AAElD,WAAS,QAAQ,IAAI,YAAY,MAAM,YAAY,OAAO;AAAA,IACxD,UAAU,YAAY;AAAA,IACtB,QAAQ,YAAY;AAAA,IACpB,UAAU,YAAY;AAAA,IACtB,MAAM,YAAY;AAAA,IAClB,QAAQ,YAAY;AAAA,EACtB,CAAC;AAED,SAAO;AACT;;;ACxCA,SAAS,gBAAAC,qBAAsC;AAO/C,eAAsB,cACpB,SACA,QACuB;AACvB,QAAM,WAAW,cAAc,MAAM;AAErC,QAAM,qBAAqB,QAAQ,QAAQ,IAAI,SAAS,UAAU,GAAG;AACrE,MAAI,CAAC,oBAAoB;AACvB,WAAOC,cAAa,KAAK,EAAE,OAAO,aAAa,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnE;AAEA,QAAM,UAAU,eAAe,oBAAoB,SAAS,aAAa;AACzE,MAAI,CAAC,SAAS,cAAc;AAC1B,WAAOA,cAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AAEA,QAAM,aAAa,MAAM,uBAAuB,SAAS,QAAQ;AACjE,QAAM,gBAAgB,MAAM,mBAAmB,YAAY;AAAA,IACzD,cAAc,QAAQ;AAAA,IACtB,UAAU,SAAS;AAAA,EACrB,CAAC;AAED,QAAM,aAAa;AAAA,IACjB,aAAa,cAAc;AAAA,IAC3B,cAAc,cAAc,iBAAiB,QAAQ;AAAA,IACrD,SAAS,cAAc,YAAY,QAAQ;AAAA,IAC3C,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,cAAc;AAAA,EAC3D;AAEA,QAAM,gBAAgB,mBAAmB,SAAS,YAAY,YAAY,SAAS,aAAa;AAChG,QAAM,WAAWA,cAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAE/C,WAAS,QAAQ,IAAI,cAAc,MAAM,cAAc,OAAO;AAAA,IAC5D,UAAU,cAAc;AAAA,IACxB,QAAQ,cAAc;AAAA,IACtB,UAAU,cAAc;AAAA,IACxB,MAAM,cAAc;AAAA,IACpB,QAAQ,cAAc;AAAA,EACxB,CAAC;AAED,SAAO;AACT;;;AChDA,SAAS,gBAAAC,qBAAsC;AAU/C,eAAsB,eACpB,SACA,QACuB;AACvB,QAAM,WAAW,cAAc,MAAM;AAErC,QAAM,qBAAqB,QAAQ,QAAQ,IAAI,SAAS,UAAU,GAAG;AACrE,MAAI,CAAC,oBAAoB;AACvB,WAAOC,cAAa,KAAK,EAAE,OAAO,aAAa,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnE;AAEA,MAAI,UAAU,eAAe,oBAAoB,SAAS,aAAa;AACvE,MAAI,CAAC,SAAS;AACZ,WAAOA,cAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAEA,QAAM,aAAa,MAAM,uBAAuB,SAAS,QAAQ;AAGjE,MAAI,eAAe,QAAQ,SAAS,KAAK,QAAQ,cAAc;AAC7D,UAAM,gBAAgB,MAAM,mBAAmB,YAAY;AAAA,MACzD,cAAc,QAAQ;AAAA,MACtB,UAAU,SAAS;AAAA,IACrB,CAAC;AACD,cAAU;AAAA,MACR,aAAa,cAAc;AAAA,MAC3B,cAAc,cAAc,iBAAiB,QAAQ;AAAA,MACrD,SAAS,cAAc,YAAY,QAAQ;AAAA,MAC3C,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,cAAc;AAAA,IAC3D;AAAA,EACF;AAGA,QAAM,cAAc,MAAM,MAAM,WAAW,mBAAmB;AAAA,IAC5D,SAAS,EAAE,eAAe,UAAU,QAAQ,WAAW,GAAG;AAAA,EAC5D,CAAC;AAED,MAAI,CAAC,YAAY,IAAI;AACnB,WAAOA,cAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EACvF;AAEA,QAAM,MAAO,MAAM,YAAY,KAAK;AACpC,QAAM,WAAqB,cAAc,GAAG;AAE5C,QAAM,WAAWA,cAAa,KAAK,QAAQ;AAG3C,QAAM,YAAY,mBAAmB,SAAS,YAAY,SAAS,SAAS,aAAa;AACzF,WAAS,QAAQ,IAAI,UAAU,MAAM,UAAU,OAAO;AAAA,IACpD,UAAU,UAAU;AAAA,IACpB,QAAQ,UAAU;AAAA,IAClB,UAAU,UAAU;AAAA,IACpB,MAAM,UAAU;AAAA,IAChB,QAAQ,UAAU;AAAA,EACpB,CAAC;AAED,SAAO;AACT;;;AL3CO,SAAS,uBAAuB,QAAwB;AAC7D,iBAAe,IACb,SACA,EAAE,OAAO,GACc;AACvB,UAAM,EAAE,SAAS,IAAI,MAAM;AAC3B,UAAM,SAAS,WAAW,CAAC;AAE3B,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,eAAO,YAAY,SAAS,MAAM;AAAA,MACpC,KAAK;AACH,eAAO,eAAe,SAAS,MAAM;AAAA,MACvC,KAAK;AACH,eAAO,aAAa,SAAS,MAAM;AAAA,MACrC,KAAK;AACH,eAAO,eAAe,SAAS,MAAM;AAAA,MACvC;AACE,eAAOC,cAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpE;AAAA,EACF;AAEA,iBAAe,KACb,SACA,EAAE,OAAO,GACc;AACvB,UAAM,EAAE,SAAS,IAAI,MAAM;AAC3B,UAAM,SAAS,WAAW,CAAC;AAE3B,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,eAAO,cAAc,SAAS,MAAM;AAAA,MACtC;AACE,eAAOA,cAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpE;AAAA,EACF;AAEA,SAAO,EAAE,KAAK,KAAK;AACrB;","names":["NextResponse","NextResponse","NextResponse","NextResponse","NextResponse","NextResponse","NextResponse","NextResponse","NextResponse","NextResponse"]}
+{"version":3,"sources":["../src/handlers/index.ts","../src/handlers/login.ts","../src/handlers/callback.ts","../src/handlers/logout.ts","../src/handlers/refresh.ts","../src/handlers/userinfo.ts","../src/handlers/open.ts"],"sourcesContent":["import { NextResponse, type NextRequest } from \"next/server\";\nimport type { AuthgearConfig } from \"../types.js\";\nimport { handleLogin } from \"./login.js\";\nimport { handleCallback } from \"./callback.js\";\nimport { handleLogout } from \"./logout.js\";\nimport { handleRefresh } from \"./refresh.js\";\nimport { handleUserInfo } from \"./userinfo.js\";\nimport { handleOpen } from \"./open.js\";\n\n/**\n * Creates Next.js route handlers for all Authgear auth endpoints.\n *\n * Usage in `app/api/auth/[...authgear]/route.ts`:\n * ```ts\n * import { createAuthgearHandlers } from \"@authgear/nextjs\";\n * export const { GET, POST } = createAuthgearHandlers(config);\n * ```\n *\n * Routes handled:\n * - GET /api/auth/login     — Start OAuth flow\n * - GET /api/auth/callback  — Handle OAuth callback\n * - GET /api/auth/logout    — Logout and revoke tokens\n * - POST /api/auth/refresh  — Refresh access token\n * - GET /api/auth/userinfo  — Get current user info\n * - GET /api/auth/open      — Open an Authgear page (e.g. /settings) for the current user\n */\nexport function createAuthgearHandlers(config: AuthgearConfig) {\n  async function GET(\n    request: NextRequest,\n    { params }: { params: Promise<{ authgear: string[] }> },\n  ): Promise<NextResponse> {\n    const { authgear } = await params;\n    const action = authgear?.[0];\n\n    switch (action) {\n      case \"login\":\n        return handleLogin(request, config);\n      case \"callback\":\n        return handleCallback(request, config);\n      case \"logout\":\n        return handleLogout(request, config);\n      case \"userinfo\":\n        return handleUserInfo(request, config);\n      case \"open\":\n        return handleOpen(request, config);\n      default:\n        return NextResponse.json({ error: \"not_found\" }, { status: 404 });\n    }\n  }\n\n  async function POST(\n    request: NextRequest,\n    { params }: { params: Promise<{ authgear: string[] }> },\n  ): Promise<NextResponse> {\n    const { authgear } = await params;\n    const action = authgear?.[0];\n\n    switch (action) {\n      case \"refresh\":\n        return handleRefresh(request, config);\n      default:\n        return NextResponse.json({ error: \"not_found\" }, { status: 404 });\n    }\n  }\n\n  return { GET, POST };\n}\n","import { NextResponse, type NextRequest } from \"next/server\";\nimport type { AuthgearConfig } from \"../types.js\";\nimport { PromptOption } from \"../types.js\";\nimport { resolveConfig } from \"../config.js\";\nimport { fetchOIDCConfiguration } from \"../oauth/discovery.js\";\nimport { generateCodeVerifier } from \"../oauth/pkce.js\";\nimport { buildAuthorizeURL, generateState } from \"../oauth/authorize.js\";\nimport { buildPKCECookie } from \"../session/cookie.js\";\n\nexport async function handleLogin(\n  request: NextRequest,\n  config: AuthgearConfig,\n): Promise<NextResponse> {\n  const resolved = resolveConfig(config);\n  const oidcConfig = await fetchOIDCConfiguration(resolved.endpoint);\n\n  const returnTo = request.nextUrl.searchParams.get(\"returnTo\") ?? \"/\";\n  const codeVerifier = generateCodeVerifier();\n  const state = generateState();\n\n  // Per-call ?prompt= query param takes precedence over the global isSSOEnabled default\n  const ALLOWED_PROMPTS = new Set<string>(Object.values(PromptOption));\n  const rawPrompt = request.nextUrl.searchParams.get(\"prompt\");\n  const perCallPrompt = rawPrompt !== null && ALLOWED_PROMPTS.has(rawPrompt) ? rawPrompt : undefined;\n  const prompt = perCallPrompt ?? (resolved.isSSOEnabled ? undefined : \"login\");\n\n  const authorizeURL = buildAuthorizeURL(oidcConfig, {\n    clientID: resolved.clientID,\n    redirectURI: resolved.redirectURI,\n    scopes: resolved.scopes,\n    codeVerifier,\n    state,\n    prompt,\n  });\n\n  const pkceCookie = buildPKCECookie({ codeVerifier, state, returnTo }, resolved.sessionSecret);\n\n  const response = NextResponse.redirect(authorizeURL);\n  response.cookies.set(pkceCookie.name, pkceCookie.value, {\n    httpOnly: pkceCookie.httpOnly,\n    secure: pkceCookie.secure,\n    sameSite: pkceCookie.sameSite,\n    path: pkceCookie.path,\n    maxAge: pkceCookie.maxAge,\n  });\n\n  return response;\n}\n","import { NextResponse, type NextRequest } from \"next/server\";\nimport type { AuthgearConfig } from \"../types.js\";\nimport { resolveConfig } from \"../config.js\";\nimport { fetchOIDCConfiguration } from \"../oauth/discovery.js\";\nimport { exchangeCode } from \"../oauth/token.js\";\nimport { decryptPKCECookie, buildSessionCookie } from \"../session/cookie.js\";\n\nexport async function handleCallback(\n  request: NextRequest,\n  config: AuthgearConfig,\n): Promise<NextResponse> {\n  const resolved = resolveConfig(config);\n\n  const code = request.nextUrl.searchParams.get(\"code\");\n  const state = request.nextUrl.searchParams.get(\"state\");\n  const error = request.nextUrl.searchParams.get(\"error\");\n  const errorDescription = request.nextUrl.searchParams.get(\"error_description\");\n\n  if (error) {\n    return NextResponse.json(\n      { error, error_description: errorDescription },\n      { status: 400 },\n    );\n  }\n\n  if (!code || !state) {\n    return NextResponse.json(\n      { error: \"missing_params\", error_description: \"Missing code or state parameter\" },\n      { status: 400 },\n    );\n  }\n\n  // Validate PKCE state\n  const pkceCookieValue = request.cookies.get(\"authgear.pkce\")?.value;\n  if (!pkceCookieValue) {\n    return NextResponse.json(\n      { error: \"invalid_state\", error_description: \"Missing PKCE cookie\" },\n      { status: 400 },\n    );\n  }\n\n  const pkceData = decryptPKCECookie(pkceCookieValue, resolved.sessionSecret);\n  if (!pkceData || pkceData.state !== state) {\n    return NextResponse.json(\n      { error: \"invalid_state\", error_description: \"State mismatch\" },\n      { status: 400 },\n    );\n  }\n\n  // Exchange code for tokens\n  const oidcConfig = await fetchOIDCConfiguration(resolved.endpoint);\n  const tokenResponse = await exchangeCode(oidcConfig, {\n    code,\n    codeVerifier: pkceData.codeVerifier,\n    clientID: resolved.clientID,\n    redirectURI: resolved.redirectURI,\n  });\n\n  // Build session cookie\n  const sessionCookie = buildSessionCookie(\n    resolved.cookieName,\n    {\n      accessToken: tokenResponse.access_token,\n      refreshToken: tokenResponse.refresh_token ?? null,\n      idToken: tokenResponse.id_token ?? null,\n      expiresAt: Math.floor(Date.now() / 1000) + tokenResponse.expires_in,\n    },\n    resolved.sessionSecret,\n  );\n\n  const returnTo = pkceData.returnTo || \"/\";\n  const redirectURL = new URL(returnTo, request.nextUrl.origin);\n  const response = NextResponse.redirect(redirectURL);\n\n  // Set session cookie\n  response.cookies.set(sessionCookie.name, sessionCookie.value, {\n    httpOnly: sessionCookie.httpOnly,\n    secure: sessionCookie.secure,\n    sameSite: sessionCookie.sameSite,\n    path: sessionCookie.path,\n    maxAge: sessionCookie.maxAge,\n  });\n\n  // Clear PKCE cookie\n  response.cookies.set(\"authgear.pkce\", \"\", { maxAge: 0, path: \"/\" });\n\n  return response;\n}\n","import { NextResponse, type NextRequest } from \"next/server\";\nimport type { AuthgearConfig } from \"../types.js\";\nimport { resolveConfig } from \"../config.js\";\nimport { fetchOIDCConfiguration } from \"../oauth/discovery.js\";\nimport { revokeToken } from \"../oauth/token.js\";\nimport { decryptSession, buildClearCookie } from \"../session/cookie.js\";\n\nexport async function handleLogout(\n  request: NextRequest,\n  config: AuthgearConfig,\n): Promise<NextResponse> {\n  const resolved = resolveConfig(config);\n\n  // Revoke refresh token if present\n  const sessionCookie = request.cookies.get(resolved.cookieName)?.value;\n  if (sessionCookie) {\n    const session = decryptSession(sessionCookie, resolved.sessionSecret);\n    if (session?.refreshToken) {\n      const oidcConfig = await fetchOIDCConfiguration(resolved.endpoint);\n      try {\n        await revokeToken(oidcConfig, session.refreshToken);\n      } catch {\n        // Best-effort revocation\n      }\n    }\n  }\n\n  const clearCookie = buildClearCookie(resolved.cookieName);\n  const redirectURL = new URL(resolved.postLogoutRedirectURI, request.nextUrl.origin);\n  const response = NextResponse.redirect(redirectURL);\n\n  response.cookies.set(clearCookie.name, clearCookie.value, {\n    httpOnly: clearCookie.httpOnly,\n    secure: clearCookie.secure,\n    sameSite: clearCookie.sameSite,\n    path: clearCookie.path,\n    maxAge: clearCookie.maxAge,\n  });\n\n  return response;\n}\n","import { NextResponse, type NextRequest } from \"next/server\";\nimport type { AuthgearConfig } from \"../types.js\";\nimport { resolveConfig } from \"../config.js\";\nimport { fetchOIDCConfiguration } from \"../oauth/discovery.js\";\nimport { refreshAccessToken } from \"../oauth/token.js\";\nimport { decryptSession, buildSessionCookie } from \"../session/cookie.js\";\n\nexport async function handleRefresh(\n  request: NextRequest,\n  config: AuthgearConfig,\n): Promise<NextResponse> {\n  const resolved = resolveConfig(config);\n\n  const sessionCookieValue = request.cookies.get(resolved.cookieName)?.value;\n  if (!sessionCookieValue) {\n    return NextResponse.json({ error: \"no_session\" }, { status: 401 });\n  }\n\n  const session = decryptSession(sessionCookieValue, resolved.sessionSecret);\n  if (!session?.refreshToken) {\n    return NextResponse.json({ error: \"no_refresh_token\" }, { status: 401 });\n  }\n\n  const oidcConfig = await fetchOIDCConfiguration(resolved.endpoint);\n  const tokenResponse = await refreshAccessToken(oidcConfig, {\n    refreshToken: session.refreshToken,\n    clientID: resolved.clientID,\n  });\n\n  const newSession = {\n    accessToken: tokenResponse.access_token,\n    refreshToken: tokenResponse.refresh_token ?? session.refreshToken,\n    idToken: tokenResponse.id_token ?? session.idToken,\n    expiresAt: Math.floor(Date.now() / 1000) + tokenResponse.expires_in,\n  };\n\n  const sessionCookie = buildSessionCookie(resolved.cookieName, newSession, resolved.sessionSecret);\n  const response = NextResponse.json({ ok: true });\n\n  response.cookies.set(sessionCookie.name, sessionCookie.value, {\n    httpOnly: sessionCookie.httpOnly,\n    secure: sessionCookie.secure,\n    sameSite: sessionCookie.sameSite,\n    path: sessionCookie.path,\n    maxAge: sessionCookie.maxAge,\n  });\n\n  return response;\n}\n","import { NextResponse, type NextRequest } from \"next/server\";\nimport type { AuthgearConfig, UserInfo } from \"../types.js\";\nimport { resolveConfig } from \"../config.js\";\nimport { fetchOIDCConfiguration } from \"../oauth/discovery.js\";\nimport { decryptSession } from \"../session/cookie.js\";\nimport { isTokenExpired } from \"../session/state.js\";\nimport { refreshAccessToken } from \"../oauth/token.js\";\nimport { buildSessionCookie } from \"../session/cookie.js\";\nimport { parseUserInfo } from \"../user.js\";\n\nexport async function handleUserInfo(\n  request: NextRequest,\n  config: AuthgearConfig,\n): Promise<NextResponse> {\n  const resolved = resolveConfig(config);\n\n  const sessionCookieValue = request.cookies.get(resolved.cookieName)?.value;\n  if (!sessionCookieValue) {\n    return NextResponse.json({ error: \"no_session\" }, { status: 401 });\n  }\n\n  let session = decryptSession(sessionCookieValue, resolved.sessionSecret);\n  if (!session) {\n    return NextResponse.json({ error: \"invalid_session\" }, { status: 401 });\n  }\n\n  const oidcConfig = await fetchOIDCConfiguration(resolved.endpoint);\n\n  // Auto-refresh if access token is expired\n  if (isTokenExpired(session.expiresAt) && session.refreshToken) {\n    const tokenResponse = await refreshAccessToken(oidcConfig, {\n      refreshToken: session.refreshToken,\n      clientID: resolved.clientID,\n    });\n    session = {\n      accessToken: tokenResponse.access_token,\n      refreshToken: tokenResponse.refresh_token ?? session.refreshToken,\n      idToken: tokenResponse.id_token ?? session.idToken,\n      expiresAt: Math.floor(Date.now() / 1000) + tokenResponse.expires_in,\n    };\n  }\n\n  // Fetch user info from Authgear\n  const userinfoRes = await fetch(oidcConfig.userinfo_endpoint, {\n    headers: { Authorization: `Bearer ${session.accessToken}` },\n  });\n\n  if (!userinfoRes.ok) {\n    return NextResponse.json({ error: \"userinfo_failed\" }, { status: userinfoRes.status });\n  }\n\n  const raw = (await userinfoRes.json()) as Record<string, unknown>;\n  const userInfo: UserInfo = parseUserInfo(raw);\n\n  const response = NextResponse.json(userInfo);\n\n  // Update session cookie if tokens were refreshed\n  const newCookie = buildSessionCookie(resolved.cookieName, session, resolved.sessionSecret);\n  response.cookies.set(newCookie.name, newCookie.value, {\n    httpOnly: newCookie.httpOnly,\n    secure: newCookie.secure,\n    sameSite: newCookie.sameSite,\n    path: newCookie.path,\n    maxAge: newCookie.maxAge,\n  });\n\n  return response;\n}\n","import { NextResponse, type NextRequest } from \"next/server\";\nimport type { AuthgearConfig } from \"../types.js\";\nimport { Page } from \"../types.js\";\nimport { resolveConfig } from \"../config.js\";\nimport { fetchOIDCConfiguration } from \"../oauth/discovery.js\";\nimport { getAppSessionToken } from \"../oauth/token.js\";\nimport { buildOpenURL } from \"../oauth/authorize.js\";\nimport { decryptSession } from \"../session/cookie.js\";\n\nconst ALLOWED_PAGES = new Set<string>(Object.values(Page));\n\nexport async function handleOpen(\n  request: NextRequest,\n  config: AuthgearConfig,\n): Promise<NextResponse> {\n  const resolved = resolveConfig(config);\n\n  const pageParam = request.nextUrl.searchParams.get(\"page\");\n  if (!pageParam || !ALLOWED_PAGES.has(pageParam)) {\n    return NextResponse.json({ error: \"invalid_page\" }, { status: 400 });\n  }\n\n  const sessionCookieValue = request.cookies.get(resolved.cookieName)?.value;\n  if (!sessionCookieValue) {\n    return NextResponse.json({ error: \"not_authenticated\" }, { status: 401 });\n  }\n\n  const sessionData = decryptSession(sessionCookieValue, resolved.sessionSecret);\n  if (!sessionData) {\n    return NextResponse.json({ error: \"not_authenticated\" }, { status: 401 });\n  }\n\n  if (!sessionData.refreshToken) {\n    return NextResponse.json({ error: \"no_refresh_token\" }, { status: 401 });\n  }\n\n  const oidcConfig = await fetchOIDCConfiguration(resolved.endpoint);\n\n  let app_session_token: string;\n  try {\n    const tokenResponse = await getAppSessionToken(\n      resolved.endpoint,\n      sessionData.refreshToken,\n    );\n    app_session_token = tokenResponse.app_session_token;\n  } catch {\n    return NextResponse.json({ error: \"not_authenticated\" }, { status: 401 });\n  }\n\n  const url = buildOpenURL(oidcConfig, {\n    clientID: resolved.clientID,\n    appSessionToken: app_session_token,\n    targetPath: pageParam,\n    scopes: resolved.scopes,\n  });\n\n  return NextResponse.redirect(url, 302);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,gBAAAA,qBAAsC;;;ACA/C,SAAS,oBAAsC;AAS/C,eAAsB,YACpB,SACA,QACuB;AACvB,QAAM,WAAW,cAAc,MAAM;AACrC,QAAM,aAAa,MAAM,uBAAuB,SAAS,QAAQ;AAEjE,QAAM,WAAW,QAAQ,QAAQ,aAAa,IAAI,UAAU,KAAK;AACjE,QAAM,eAAe,qBAAqB;AAC1C,QAAM,QAAQ,cAAc;AAG5B,QAAM,kBAAkB,IAAI,IAAY,OAAO,OAAO,YAAY,CAAC;AACnE,QAAM,YAAY,QAAQ,QAAQ,aAAa,IAAI,QAAQ;AAC3D,QAAM,gBAAgB,cAAc,QAAQ,gBAAgB,IAAI,SAAS,IAAI,YAAY;AACzF,QAAM,SAAS,kBAAkB,SAAS,eAAe,SAAY;AAErE,QAAM,eAAe,kBAAkB,YAAY;AAAA,IACjD,UAAU,SAAS;AAAA,IACnB,aAAa,SAAS;AAAA,IACtB,QAAQ,SAAS;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,aAAa,gBAAgB,EAAE,cAAc,OAAO,SAAS,GAAG,SAAS,aAAa;AAE5F,QAAM,WAAW,aAAa,SAAS,YAAY;AACnD,WAAS,QAAQ,IAAI,WAAW,MAAM,WAAW,OAAO;AAAA,IACtD,UAAU,WAAW;AAAA,IACrB,QAAQ,WAAW;AAAA,IACnB,UAAU,WAAW;AAAA,IACrB,MAAM,WAAW;AAAA,IACjB,QAAQ,WAAW;AAAA,EACrB,CAAC;AAED,SAAO;AACT;;;AC/CA,SAAS,gBAAAC,qBAAsC;AAO/C,eAAsB,eACpB,SACA,QACuB;AACvB,QAAM,WAAW,cAAc,MAAM;AAErC,QAAM,OAAO,QAAQ,QAAQ,aAAa,IAAI,MAAM;AACpD,QAAM,QAAQ,QAAQ,QAAQ,aAAa,IAAI,OAAO;AACtD,QAAM,QAAQ,QAAQ,QAAQ,aAAa,IAAI,OAAO;AACtD,QAAM,mBAAmB,QAAQ,QAAQ,aAAa,IAAI,mBAAmB;AAE7E,MAAI,OAAO;AACT,WAAOC,cAAa;AAAA,MAClB,EAAE,OAAO,mBAAmB,iBAAiB;AAAA,MAC7C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,CAAC,OAAO;AACnB,WAAOA,cAAa;AAAA,MAClB,EAAE,OAAO,kBAAkB,mBAAmB,kCAAkC;AAAA,MAChF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAGA,QAAM,kBAAkB,QAAQ,QAAQ,IAAI,eAAe,GAAG;AAC9D,MAAI,CAAC,iBAAiB;AACpB,WAAOA,cAAa;AAAA,MAClB,EAAE,OAAO,iBAAiB,mBAAmB,sBAAsB;AAAA,MACnE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,WAAW,kBAAkB,iBAAiB,SAAS,aAAa;AAC1E,MAAI,CAAC,YAAY,SAAS,UAAU,OAAO;AACzC,WAAOA,cAAa;AAAA,MAClB,EAAE,OAAO,iBAAiB,mBAAmB,iBAAiB;AAAA,MAC9D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAGA,QAAM,aAAa,MAAM,uBAAuB,SAAS,QAAQ;AACjE,QAAM,gBAAgB,MAAM,aAAa,YAAY;AAAA,IACnD;AAAA,IACA,cAAc,SAAS;AAAA,IACvB,UAAU,SAAS;AAAA,IACnB,aAAa,SAAS;AAAA,EACxB,CAAC;AAGD,QAAM,gBAAgB;AAAA,IACpB,SAAS;AAAA,IACT;AAAA,MACE,aAAa,cAAc;AAAA,MAC3B,cAAc,cAAc,iBAAiB;AAAA,MAC7C,SAAS,cAAc,YAAY;AAAA,MACnC,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,cAAc;AAAA,IAC3D;AAAA,IACA,SAAS;AAAA,EACX;AAEA,QAAM,WAAW,SAAS,YAAY;AACtC,QAAM,cAAc,IAAI,IAAI,UAAU,QAAQ,QAAQ,MAAM;AAC5D,QAAM,WAAWA,cAAa,SAAS,WAAW;AAGlD,WAAS,QAAQ,IAAI,cAAc,MAAM,cAAc,OAAO;AAAA,IAC5D,UAAU,cAAc;AAAA,IACxB,QAAQ,cAAc;AAAA,IACtB,UAAU,cAAc;AAAA,IACxB,MAAM,cAAc;AAAA,IACpB,QAAQ,cAAc;AAAA,EACxB,CAAC;AAGD,WAAS,QAAQ,IAAI,iBAAiB,IAAI,EAAE,QAAQ,GAAG,MAAM,IAAI,CAAC;AAElE,SAAO;AACT;;;ACvFA,SAAS,gBAAAC,qBAAsC;AAO/C,eAAsB,aACpB,SACA,QACuB;AACvB,QAAM,WAAW,cAAc,MAAM;AAGrC,QAAM,gBAAgB,QAAQ,QAAQ,IAAI,SAAS,UAAU,GAAG;AAChE,MAAI,eAAe;AACjB,UAAM,UAAU,eAAe,eAAe,SAAS,aAAa;AACpE,QAAI,SAAS,cAAc;AACzB,YAAM,aAAa,MAAM,uBAAuB,SAAS,QAAQ;AACjE,UAAI;AACF,cAAM,YAAY,YAAY,QAAQ,YAAY;AAAA,MACpD,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,iBAAiB,SAAS,UAAU;AACxD,QAAM,cAAc,IAAI,IAAI,SAAS,uBAAuB,QAAQ,QAAQ,MAAM;AAClF,QAAM,WAAWC,cAAa,SAAS,WAAW;AAElD,WAAS,QAAQ,IAAI,YAAY,MAAM,YAAY,OAAO;AAAA,IACxD,UAAU,YAAY;AAAA,IACtB,QAAQ,YAAY;AAAA,IACpB,UAAU,YAAY;AAAA,IACtB,MAAM,YAAY;AAAA,IAClB,QAAQ,YAAY;AAAA,EACtB,CAAC;AAED,SAAO;AACT;;;ACxCA,SAAS,gBAAAC,qBAAsC;AAO/C,eAAsB,cACpB,SACA,QACuB;AACvB,QAAM,WAAW,cAAc,MAAM;AAErC,QAAM,qBAAqB,QAAQ,QAAQ,IAAI,SAAS,UAAU,GAAG;AACrE,MAAI,CAAC,oBAAoB;AACvB,WAAOC,cAAa,KAAK,EAAE,OAAO,aAAa,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnE;AAEA,QAAM,UAAU,eAAe,oBAAoB,SAAS,aAAa;AACzE,MAAI,CAAC,SAAS,cAAc;AAC1B,WAAOA,cAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AAEA,QAAM,aAAa,MAAM,uBAAuB,SAAS,QAAQ;AACjE,QAAM,gBAAgB,MAAM,mBAAmB,YAAY;AAAA,IACzD,cAAc,QAAQ;AAAA,IACtB,UAAU,SAAS;AAAA,EACrB,CAAC;AAED,QAAM,aAAa;AAAA,IACjB,aAAa,cAAc;AAAA,IAC3B,cAAc,cAAc,iBAAiB,QAAQ;AAAA,IACrD,SAAS,cAAc,YAAY,QAAQ;AAAA,IAC3C,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,cAAc;AAAA,EAC3D;AAEA,QAAM,gBAAgB,mBAAmB,SAAS,YAAY,YAAY,SAAS,aAAa;AAChG,QAAM,WAAWA,cAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAE/C,WAAS,QAAQ,IAAI,cAAc,MAAM,cAAc,OAAO;AAAA,IAC5D,UAAU,cAAc;AAAA,IACxB,QAAQ,cAAc;AAAA,IACtB,UAAU,cAAc;AAAA,IACxB,MAAM,cAAc;AAAA,IACpB,QAAQ,cAAc;AAAA,EACxB,CAAC;AAED,SAAO;AACT;;;AChDA,SAAS,gBAAAC,qBAAsC;AAU/C,eAAsB,eACpB,SACA,QACuB;AACvB,QAAM,WAAW,cAAc,MAAM;AAErC,QAAM,qBAAqB,QAAQ,QAAQ,IAAI,SAAS,UAAU,GAAG;AACrE,MAAI,CAAC,oBAAoB;AACvB,WAAOC,cAAa,KAAK,EAAE,OAAO,aAAa,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnE;AAEA,MAAI,UAAU,eAAe,oBAAoB,SAAS,aAAa;AACvE,MAAI,CAAC,SAAS;AACZ,WAAOA,cAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAEA,QAAM,aAAa,MAAM,uBAAuB,SAAS,QAAQ;AAGjE,MAAI,eAAe,QAAQ,SAAS,KAAK,QAAQ,cAAc;AAC7D,UAAM,gBAAgB,MAAM,mBAAmB,YAAY;AAAA,MACzD,cAAc,QAAQ;AAAA,MACtB,UAAU,SAAS;AAAA,IACrB,CAAC;AACD,cAAU;AAAA,MACR,aAAa,cAAc;AAAA,MAC3B,cAAc,cAAc,iBAAiB,QAAQ;AAAA,MACrD,SAAS,cAAc,YAAY,QAAQ;AAAA,MAC3C,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,cAAc;AAAA,IAC3D;AAAA,EACF;AAGA,QAAM,cAAc,MAAM,MAAM,WAAW,mBAAmB;AAAA,IAC5D,SAAS,EAAE,eAAe,UAAU,QAAQ,WAAW,GAAG;AAAA,EAC5D,CAAC;AAED,MAAI,CAAC,YAAY,IAAI;AACnB,WAAOA,cAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EACvF;AAEA,QAAM,MAAO,MAAM,YAAY,KAAK;AACpC,QAAM,WAAqB,cAAc,GAAG;AAE5C,QAAM,WAAWA,cAAa,KAAK,QAAQ;AAG3C,QAAM,YAAY,mBAAmB,SAAS,YAAY,SAAS,SAAS,aAAa;AACzF,WAAS,QAAQ,IAAI,UAAU,MAAM,UAAU,OAAO;AAAA,IACpD,UAAU,UAAU;AAAA,IACpB,QAAQ,UAAU;AAAA,IAClB,UAAU,UAAU;AAAA,IACpB,MAAM,UAAU;AAAA,IAChB,QAAQ,UAAU;AAAA,EACpB,CAAC;AAED,SAAO;AACT;;;ACnEA,SAAS,gBAAAC,qBAAsC;AAS/C,IAAM,gBAAgB,IAAI,IAAY,OAAO,OAAO,IAAI,CAAC;AAEzD,eAAsB,WACpB,SACA,QACuB;AACvB,QAAM,WAAW,cAAc,MAAM;AAErC,QAAM,YAAY,QAAQ,QAAQ,aAAa,IAAI,MAAM;AACzD,MAAI,CAAC,aAAa,CAAC,cAAc,IAAI,SAAS,GAAG;AAC/C,WAAOC,cAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,qBAAqB,QAAQ,QAAQ,IAAI,SAAS,UAAU,GAAG;AACrE,MAAI,CAAC,oBAAoB;AACvB,WAAOA,cAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,cAAc,eAAe,oBAAoB,SAAS,aAAa;AAC7E,MAAI,CAAC,aAAa;AAChB,WAAOA,cAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,MAAI,CAAC,YAAY,cAAc;AAC7B,WAAOA,cAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AAEA,QAAM,aAAa,MAAM,uBAAuB,SAAS,QAAQ;AAEjE,MAAI;AACJ,MAAI;AACF,UAAM,gBAAgB,MAAM;AAAA,MAC1B,SAAS;AAAA,MACT,YAAY;AAAA,IACd;AACA,wBAAoB,cAAc;AAAA,EACpC,QAAQ;AACN,WAAOA,cAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,MAAM,aAAa,YAAY;AAAA,IACnC,UAAU,SAAS;AAAA,IACnB,iBAAiB;AAAA,IACjB,YAAY;AAAA,IACZ,QAAQ,SAAS;AAAA,EACnB,CAAC;AAED,SAAOA,cAAa,SAAS,KAAK,GAAG;AACvC;;;AN/BO,SAAS,uBAAuB,QAAwB;AAC7D,iBAAe,IACb,SACA,EAAE,OAAO,GACc;AACvB,UAAM,EAAE,SAAS,IAAI,MAAM;AAC3B,UAAM,SAAS,WAAW,CAAC;AAE3B,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,eAAO,YAAY,SAAS,MAAM;AAAA,MACpC,KAAK;AACH,eAAO,eAAe,SAAS,MAAM;AAAA,MACvC,KAAK;AACH,eAAO,aAAa,SAAS,MAAM;AAAA,MACrC,KAAK;AACH,eAAO,eAAe,SAAS,MAAM;AAAA,MACvC,KAAK;AACH,eAAO,WAAW,SAAS,MAAM;AAAA,MACnC;AACE,eAAOC,cAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpE;AAAA,EACF;AAEA,iBAAe,KACb,SACA,EAAE,OAAO,GACc;AACvB,UAAM,EAAE,SAAS,IAAI,MAAM;AAC3B,UAAM,SAAS,WAAW,CAAC;AAE3B,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,eAAO,cAAc,SAAS,MAAM;AAAA,MACtC;AACE,eAAOA,cAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpE;AAAA,EACF;AAEA,SAAO,EAAE,KAAK,KAAK;AACrB;","names":["NextResponse","NextResponse","NextResponse","NextResponse","NextResponse","NextResponse","NextResponse","NextResponse","NextResponse","NextResponse","NextResponse","NextResponse"]}

package/dist/proxy.d.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { A as AuthgearConfig } from './types-Cx-gnfE7.js';
+import { A as AuthgearConfig } from './types-D6m4Hact.js';
 
 interface AuthgearProxyOptions extends AuthgearConfig {
     /**

package/dist/proxy.js

@@ -5,8 +5,8 @@ import {
   isTokenExpired,
   refreshAccessToken,
   resolveConfig
-} from "./chunk-UERNRN5J.js";
-import "./chunk-CCQOLKXU.js";
+} from "./chunk-LPGVCNZ6.js";
+import "./chunk-AJJAXXPI.js";
 
 // src/proxy.ts
 import { NextResponse } from "next/server";

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { A as AuthgearConfig, S as Session, U as UserInfo, P as Page, J as JWTPayload } from './types-Cx-gnfE7.js';
-export { a as PromptOption, c as SessionState } from './types-Cx-gnfE7.js';
+import { A as AuthgearConfig, S as Session, U as UserInfo, P as Page, J as JWTPayload } from './types-D6m4Hact.js';
+export { a as PromptOption, c as SessionState } from './types-D6m4Hact.js';
 
 /**
  * Read the current session in a Server Component, Route Handler, or Server Action.

package/dist/server.js

@@ -11,12 +11,12 @@ import {
   isTokenExpired,
   refreshAccessToken,
   resolveConfig
-} from "./chunk-UERNRN5J.js";
+} from "./chunk-LPGVCNZ6.js";
 import {
   Page,
   PromptOption,
   SessionState
-} from "./chunk-CCQOLKXU.js";
+} from "./chunk-AJJAXXPI.js";
 
 // src/server.ts
 import "server-only";

package/dist/{types-Cx-gnfE7.d.ts → types-D6m4Hact.d.ts}

@@ -24,7 +24,9 @@ interface AuthgearConfig {
     isSSOEnabled?: boolean;
 }
 /**
- * Pages that can be opened via `getOpenURL` from `@authgear/nextjs/server`.
+ * Pages that can be opened in a new tab with the current user pre-authenticated.
+ * Used by `getOpenURL` from `@authgear/nextjs/server` and by `openPage` / `<UserSettingsButton>`
+ * from `@authgear/nextjs/client`.
  */
 declare enum Page {
     Settings = "/settings"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authgear/nextjs",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Authgear SDK for Next.js 16 - OAuth authentication, session management, and JWT verification",
   "type": "module",
   "exports": {

package/dist/chunk-CCQOLKXU.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/types.ts"],"sourcesContent":["export interface AuthgearConfig {\n  /** Authgear endpoint, e.g. \"https://myapp.authgear.cloud\" */\n  endpoint: string;\n  /** OAuth client ID */\n  clientID: string;\n  /** Redirect URI for OAuth callback, e.g. \"http://localhost:3000/api/auth/callback\" */\n  redirectURI: string;\n  /** Where to redirect after logout */\n  postLogoutRedirectURI?: string;\n  /** OAuth scopes. Defaults to [\"openid\", \"offline_access\", \"https://authgear.com/scopes/full-userinfo\"] */\n  scopes?: string[];\n  /** Secret key for encrypting session cookie (min 32 chars) */\n  sessionSecret: string;\n  /** Session cookie name. Defaults to \"authgear.session\" */\n  cookieName?: string;\n  /**\n   * Whether to enable SSO (Single Sign-On) with other apps on the same Authgear tenant.\n   * When `true` (default), Authgear silently reuses its server-side session if the user\n   * is already logged in, so users are not prompted for credentials again.\n   * Set to `false` to always show the login form (`prompt=login`), which is recommended\n   * for single-app deployments where silent sign-in feels unexpected to the user.\n   * Defaults to `true`.\n   */\n  isSSOEnabled?: boolean;\n}\n\n/**\n * Pages that can be opened via `getOpenURL` from `@authgear/nextjs/server`.\n */\nexport enum Page {\n  Settings = \"/settings\",\n}\n\n/**\n * OIDC `prompt` parameter values.\n * Pass to `signIn({ prompt })` or `SignInButton signInOptions={{ prompt }}` to control\n * whether Authgear shows the login form for a specific authentication call.\n *\n * @see https://docs.authgear.com/authentication-and-access/single-sign-on/force-authgear-to-show-login-page\n */\nexport enum PromptOption {\n  /** Always show the login form, even if the user has an active Authgear session. */\n  Login = \"login\",\n  /** Never show the login form; return an error if the user is not already authenticated. */\n  None = \"none\",\n}\n\nexport const DEFAULT_SCOPES = [\n  \"openid\",\n  \"offline_access\",\n  \"https://authgear.com/scopes/full-userinfo\",\n];\n\nexport enum SessionState {\n  Unknown = \"UNKNOWN\",\n  NoSession = \"NO_SESSION\",\n  Authenticated = \"AUTHENTICATED\",\n}\n\nexport interface SessionData {\n  accessToken: string;\n  refreshToken: string | null;\n  idToken: string | null;\n  expiresAt: number;\n}\n\nexport interface Session {\n  state: SessionState;\n  accessToken: string | null;\n  refreshToken: string | null;\n  idToken: string | null;\n  expiresAt: number | null;\n  user: UserInfo | null;\n}\n\nexport interface UserInfo {\n  sub: string;\n  email?: string;\n  emailVerified?: boolean;\n  phoneNumber?: string;\n  phoneNumberVerified?: boolean;\n  preferredUsername?: string;\n  givenName?: string;\n  familyName?: string;\n  name?: string;\n  picture?: string;\n  roles?: string[];\n  isAnonymous?: boolean;\n  isVerified?: boolean;\n  canReauthenticate?: boolean;\n  customAttributes?: Record<string, unknown>;\n  raw: Record<string, unknown>;\n}\n\nexport interface JWTPayload {\n  sub: string;\n  iss: string;\n  aud: string | string[];\n  exp: number;\n  iat: number;\n  jti?: string;\n  client_id?: string;\n  \"https://authgear.com/claims/user/is_anonymous\"?: boolean;\n  \"https://authgear.com/claims/user/is_verified\"?: boolean;\n  \"https://authgear.com/claims/user/can_reauthenticate\"?: boolean;\n  \"https://authgear.com/claims/user/roles\"?: string[];\n  [key: string]: unknown;\n}\n\nexport interface TokenResponse {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token?: string;\n  id_token?: string;\n}\n\nexport interface AppSessionTokenResponse {\n  app_session_token: string;\n  expire_at: string;\n}\n\nexport interface OIDCConfiguration {\n  authorization_endpoint: string;\n  token_endpoint: string;\n  userinfo_endpoint: string;\n  revocation_endpoint: string;\n  end_session_endpoint: string;\n  jwks_uri: string;\n  issuer: string;\n}\n"],"mappings":";AA6BO,IAAK,OAAL,kBAAKA,UAAL;AACL,EAAAA,MAAA,cAAW;AADD,SAAAA;AAAA,GAAA;AAWL,IAAK,eAAL,kBAAKC,kBAAL;AAEL,EAAAA,cAAA,WAAQ;AAER,EAAAA,cAAA,UAAO;AAJG,SAAAA;AAAA,GAAA;AAOL,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAK,eAAL,kBAAKC,kBAAL;AACL,EAAAA,cAAA,aAAU;AACV,EAAAA,cAAA,eAAY;AACZ,EAAAA,cAAA,mBAAgB;AAHN,SAAAA;AAAA,GAAA;","names":["Page","PromptOption","SessionState"]}