@cas-system/nextjs-cas-client 1.0.0 → 1.0.1

package/dist/esm/handlers/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../../src/handlers/logout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAe,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAwB;IAC1D,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,GAAG,CAAC;IAEpD,OAAO,KAAK,UAAU,IAAI,CAAC,OAAoB;QAC7C,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;QAEpC,oDAAoD;QACpD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;QAEjD,sCAAsC;QACtC,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBACzC,yDAAyD;YAC3D,CAAC,CAAC,CAAC;QACL,CAAC;QAED,8BAA8B;QAC9B,eAAe,CAAC,WAAW,CAAC,CAAC;QAE7B,mEAAmE;QACnE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxC,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,qBAAqB;QACrB,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC;AACJ,CAAC"}

package/dist/esm/handlers/user.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @module @cas-system/nextjs-cas-client/handlers/user
+ * @description API route handler that returns the current CAS user from
+ * the session cookie.  This endpoint is called by the client-side
+ * `CasProvider` to hydrate the auth state.
+ *
+ * @example
+ * ```ts
+ * // app/api/cas/user/route.ts
+ * import { createUserHandler } from '@cas-system/nextjs-cas-client/handlers';
+ *
+ * const handler = createUserHandler();
+ * export { handler as GET };
+ * ```
+ */
+import { NextResponse } from 'next/server.js';
+/**
+ * Create a GET handler for `/api/cas/user`.
+ *
+ * Returns `{ user: CasUser }` when authenticated, or `401` otherwise.
+ * The response includes `Cache-Control: no-store` to prevent caching of
+ * auth state.
+ *
+ * @returns A Next.js App Router GET handler.
+ */
+export declare function createUserHandler(): () => Promise<NextResponse>;
+//# sourceMappingURL=user.d.ts.map

package/dist/esm/handlers/user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../src/handlers/user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAI9C;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,UACF,OAAO,CAAC,YAAY,CAAC,CAsBnD"}

package/dist/{handlers → esm/handlers}/user.js

@@ -13,9 +13,9 @@
  * export { handler as GET };
  * ```
  */
-import { NextResponse } from 'next/server';
-import { cookies } from 'next/headers';
-import { getCasSession } from '../server/auth';
+import { NextResponse } from 'next/server.js';
+import { cookies } from 'next/headers.js';
+import { getCasSession } from '../server/auth.js';
 /**
  * Create a GET handler for `/api/cas/user`.
  *

package/dist/esm/handlers/user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../../src/handlers/user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,KAAK,UAAU,GAAG;QACvB,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAC1C;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;aACzC,CACF,CAAC;QACJ,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EACtB;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;SACzC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/esm/hooks/useCasAuth.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @module @cas-system/nextjs-cas-client/hooks/useCasAuth
+ * @description Client-side hook for accessing CAS authentication state and
+ * actions (login, logout, refresh).
+ *
+ * @example
+ * ```tsx
+ * 'use client';
+ * import { useCasAuth } from '@cas-system/nextjs-cas-client';
+ *
+ * export function Navbar() {
+ *   const { user, isAuthenticated, login, logout } = useCasAuth();
+ *
+ *   return isAuthenticated ? (
+ *     <button onClick={logout}>Sign out ({user?.username})</button>
+ *   ) : (
+ *     <button onClick={() => login()}>Sign in</button>
+ *   );
+ * }
+ * ```
+ */
+import type { CasAuthContext } from '../types.js';
+/**
+ * Access CAS authentication state and actions.
+ *
+ * This is a convenience re-export of the context hook.  Must be used inside
+ * a `<CasProvider>`.
+ *
+ * @returns The full {@link CasAuthContext}.
+ */
+export declare function useCasAuth(): CasAuthContext;
+//# sourceMappingURL=useCasAuth.d.ts.map

package/dist/esm/hooks/useCasAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useCasAuth.d.ts","sourceRoot":"","sources":["../../../src/hooks/useCasAuth.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGlD;;;;;;;GAOG;AACH,wBAAgB,UAAU,IAAI,cAAc,CAE3C"}

package/dist/{hooks → esm/hooks}/useCasAuth.js

@@ -1,5 +1,5 @@
 'use client';
-import { useCasAuthContext } from '../CasProvider';
+import { useCasAuthContext } from '../CasProvider.js';
 /**
  * Access CAS authentication state and actions.
  *

package/dist/esm/hooks/useCasAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useCasAuth.js","sourceRoot":"","sources":["../../../src/hooks/useCasAuth.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAyBb,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC"}

package/dist/esm/hooks/useCasUser.d.ts

@@ -0,0 +1,33 @@
+import type { CasUser } from '../types.js';
+/** Return type of {@link useCasUser}. */
+export interface UseCasUserReturn {
+    /** The current user, or `null` when not authenticated. */
+    user: CasUser | null;
+    /** Whether the initial session fetch is still loading. */
+    isLoading: boolean;
+    /** Whether a valid session exists. */
+    isAuthenticated: boolean;
+    /**
+     * Check whether the current user has **all** of the specified roles.
+     *
+     * @param roles - Required roles.
+     * @returns `true` if the user possesses every role (or the list is empty).
+     */
+    hasRole: (...roles: string[]) => boolean;
+    /**
+     * Check whether the current user has **at least one** of the specified roles.
+     *
+     * @param roles - Roles to check.
+     * @returns `true` if the user possesses any one role.
+     */
+    hasAnyRole: (...roles: string[]) => boolean;
+    /** All roles assigned to the current user (empty array when unauthenticated). */
+    roles: string[];
+}
+/**
+ * Hook for accessing the current CAS user and performing role checks.
+ *
+ * Must be used inside a `<CasProvider>`.
+ */
+export declare function useCasUser(): UseCasUserReturn;
+//# sourceMappingURL=useCasUser.d.ts.map

package/dist/esm/hooks/useCasUser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useCasUser.d.ts","sourceRoot":"","sources":["../../../src/hooks/useCasUser.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAG3C,yCAAyC;AACzC,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IAErB,0DAA0D;IAC1D,SAAS,EAAE,OAAO,CAAC;IAEnB,sCAAsC;IACtC,eAAe,EAAE,OAAO,CAAC;IAEzB;;;;;OAKG;IACH,OAAO,EAAE,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAEzC;;;;;OAKG;IACH,UAAU,EAAE,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAE5C,iFAAiF;IACjF,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,IAAI,gBAAgB,CAsB7C"}

package/dist/{hooks → esm/hooks}/useCasUser.js

@@ -21,7 +21,7 @@
  * ```
  */
 import { useCallback, useMemo } from 'react';
-import { useCasAuthContext } from '../CasProvider';
+import { useCasAuthContext } from '../CasProvider.js';
 /**
  * Hook for accessing the current CAS user and performing role checks.
  *

package/dist/esm/hooks/useCasUser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useCasUser.js","sourceRoot":"","sources":["../../../src/hooks/useCasUser.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAiCtD;;;;GAIG;AACH,MAAM,UAAU,UAAU;IACxB,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,iBAAiB,EAAE,CAAC;IAEjE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvD,MAAM,OAAO,GAAG,WAAW,CACzB,CAAC,GAAG,QAAkB,EAAE,EAAE;QACxB,IAAI,CAAC,IAAI,EAAE,KAAK;YAAE,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;QAC/C,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,EACD,CAAC,IAAI,CAAC,CACP,CAAC;IAEF,MAAM,UAAU,GAAG,WAAW,CAC5B,CAAC,GAAG,UAAoB,EAAE,EAAE;QAC1B,IAAI,CAAC,IAAI,EAAE,KAAK;YAAE,OAAO,KAAK,CAAC;QAC/B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,EACD,CAAC,IAAI,CAAC,CACP,CAAC;IAEF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC1E,CAAC"}

package/dist/esm/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @module @cas-system/nextjs-cas-client
+ * @description Public entry point for the Next.js CAS Client SDK.
+ *
+ * Re-exports the client-side provider, hooks, components, and shared types.
+ * Server-only helpers live under `@cas-system/nextjs-cas-client/server`,
+ * route handlers under `/handlers`, and middleware under `/middleware`.
+ */
+export { CasProvider, useCasAuthContext } from './CasProvider.js';
+export type { CasProviderProps } from './CasProvider.js';
+export { useCasAuth } from './hooks/useCasAuth.js';
+export { useCasUser } from './hooks/useCasUser.js';
+export type { UseCasUserReturn } from './hooks/useCasUser.js';
+export { CasLoginButton } from './components/CasLoginButton.js';
+export type { CasLoginButtonProps } from './components/CasLoginButton.js';
+export { CasProtectedRoute } from './components/CasProtectedRoute.js';
+export type { CasProtectedRouteProps } from './components/CasProtectedRoute.js';
+export type { CasConfig, CasServerConfig, CasUser, CasSessionData, CasMiddlewareConfig, CasAuthContext, CasHandlerConfig, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAClE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGzD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,YAAY,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,YAAY,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAGhF,YAAY,EACV,SAAS,EACT,eAAe,EACf,OAAO,EACP,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,gBAAgB,GACjB,MAAM,YAAY,CAAC"}

package/dist/{index.js → esm/index.js}

@@ -7,11 +7,11 @@
  * route handlers under `/handlers`, and middleware under `/middleware`.
  */
 // Provider + context hook
-export { CasProvider, useCasAuthContext } from './CasProvider';
+export { CasProvider, useCasAuthContext } from './CasProvider.js';
 // Hooks
-export { useCasAuth } from './hooks/useCasAuth';
-export { useCasUser } from './hooks/useCasUser';
+export { useCasAuth } from './hooks/useCasAuth.js';
+export { useCasUser } from './hooks/useCasUser.js';
 // Components
-export { CasLoginButton } from './components/CasLoginButton';
-export { CasProtectedRoute } from './components/CasProtectedRoute';
+export { CasLoginButton } from './components/CasLoginButton.js';
+export { CasProtectedRoute } from './components/CasProtectedRoute.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,0BAA0B;AAC1B,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGlE,QAAQ;AACR,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGnD,aAAa;AACb,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC"}

package/dist/esm/middleware.d.ts

@@ -0,0 +1,40 @@
+/**
+ * @module @cas-system/nextjs-cas-client/middleware
+ * @description Factory for creating a Next.js middleware that guards routes
+ * behind CAS authentication.
+ *
+ * @example
+ * ```ts
+ * // middleware.ts (project root)
+ * import { createCasMiddleware } from '@cas-system/nextjs-cas-client/middleware';
+ *
+ * export default createCasMiddleware({
+ *   protectedPaths: ['/dashboard', '/admin', '/settings'],
+ *   publicPaths: ['/api/health'],
+ *   loginPath: '/login',
+ * });
+ *
+ * export const config = {
+ *   matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
+ * };
+ * ```
+ */
+import { NextRequest, NextResponse } from 'next/server.js';
+import type { CasMiddlewareConfig } from './types.js';
+/**
+ * Create a Next.js middleware function that enforces CAS authentication on
+ * the configured protected paths.
+ *
+ * @param config - Middleware configuration.
+ * @returns A Next.js-compatible middleware function.
+ *
+ * @remarks
+ * - If the request targets a **public path** it is always allowed through.
+ * - If the request targets a **protected path** and there is no valid CAS
+ *   session cookie, the user is redirected to either the `loginPath` (if
+ *   set) or the CAS server SSO login page.
+ * - The original URL is forwarded as a `?returnUrl=…` query parameter so
+ *   the login page can redirect back after authentication.
+ */
+export declare function createCasMiddleware(config: CasMiddlewareConfig): (request: NextRequest) => Promise<NextResponse>;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/esm/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAatD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,IAQ3D,SAAS,WAAW,KACnB,OAAO,CAAC,YAAY,CAAC,CA+EzB"}

package/dist/{middleware.js → esm/middleware.js}

@@ -19,8 +19,8 @@
  * };
  * ```
  */
-import { NextResponse } from 'next/server';
-import { getCasSessionFromRequest } from './server/auth';
+import { NextResponse } from 'next/server.js';
+import { getCasSessionFromRequest } from './server/auth.js';
 /**
  * Check whether `pathname` starts with any of the given prefixes.
  * @internal

package/dist/esm/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAe,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAE5D;;;GAGG;AACH,SAAS,UAAU,CAAC,QAAgB,EAAE,QAAkB;IACtD,OAAO,QAAQ,CAAC,IAAI,CAClB,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA2B;IAC7D,MAAM,EACJ,cAAc,EACd,WAAW,GAAG,EAAE,EAChB,SAAS,GACV,GAAG,MAAM,CAAC;IAEX,OAAO,KAAK,UAAU,aAAa,CACjC,OAAoB;QAEpB,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QAErC,oDAAoD;QACpD,IACE,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC;YAC7B,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;YAC/B,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EACtB,CAAC;YACD,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,0CAA0C;QAC1C,IAAI,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;YACtC,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,qDAAqD;QACrD,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,8CAA8C;QAC9C,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,OAAO,EAAE,CAAC;YACZ,oEAAoE;YACpE,sEAAsE;YACtE,cAAc;YACd,MAAM,cAAc,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACpD,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/D,cAAc,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YAElD,OAAO,YAAY,CAAC,IAAI,CAAC;gBACvB,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;aACrC,CAAC,CAAC;QACL,CAAC;QAED,2CAA2C;QAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QAEpE,IAAI,SAAS,EAAE,CAAC;YACd,uCAAuC;YACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACjD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAClD,OAAO,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QAED,+CAA+C;QAC/C,2EAA2E;QAC3E,sEAAsE;QACtE,4EAA4E;QAC5E,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAC9E,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QAC9C,MAAM,cAAc,GAClB,OAAO,CAAC,GAAG,CAAC,gBAAgB;YAC5B,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,mBAAmB,CAAC;QAE/C,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CACX,yEAAyE;gBACvE,kCAAkC,CACrC,CAAC;YACF,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,yEAAyE;QACzE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;QACnD,kBAAkB,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAE5D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,WAAW;YACtB,aAAa,EAAE,OAAO;YACtB,YAAY,EAAE,kBAAkB,CAAC,QAAQ,EAAE;SAC5C,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QACzF,OAAO,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC"}

package/dist/esm/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

package/dist/esm/server/auth.d.ts

@@ -0,0 +1,111 @@
+/**
+ * @module @cas-system/nextjs-cas-client/server/auth
+ * @description Server-side session helpers for reading / writing CAS session
+ * data to Next.js cookies.
+ *
+ * The session is stored as a base-64 encoded JSON blob (signed with HMAC)
+ * inside an `HttpOnly`, `Secure`, `SameSite=Lax` cookie.  This gives us
+ * tamper-proof cookies without requiring any external crypto library.
+ *
+ * **Security model:**
+ * - The cookie is `HttpOnly` — JavaScript in the browser cannot read it.
+ * - A separate HMAC signature cookie prevents tampering.
+ * - Token validation always happens server-side via {@link CasClient}.
+ */
+import type { ReadonlyRequestCookies } from 'next/dist/server/web/spec-extension/adapters/request-cookies';
+import type { CasUser, CasSessionData } from '../types.js';
+import { NextRequest, NextResponse } from 'next/server.js';
+/**
+ * Read the CAS session from Next.js **request** cookies.
+ *
+ * Works in Server Components, Route Handlers, and middleware — anywhere
+ * you have access to the Next.js `cookies()` helper.
+ *
+ * @param cookies - The Next.js `cookies()` read-only store.
+ * @returns The session data, or `null` if no valid session exists.
+ *
+ * @example
+ * ```ts
+ * import { cookies } from 'next/headers';
+ * import { getCasSession } from '@cas-system/nextjs-cas-client/server';
+ *
+ * export default async function DashboardPage() {
+ *   const session = await getCasSession(cookies());
+ *   if (!session) redirect('/login');
+ *   return <h1>Hello {session.user.username}</h1>;
+ * }
+ * ```
+ */
+export declare function getCasSession(cookies: ReadonlyRequestCookies): Promise<CasSessionData | null>;
+/**
+ * Write the CAS session into Next.js **response** cookies.
+ *
+ * @param cookies - The Next.js `cookies()` store (must be writable — only
+ *                  available inside Route Handlers and Server Actions).
+ * @param user    - The authenticated user.
+ * @param token   - The raw JWT token.
+ *
+ * @example
+ * ```ts
+ * import { cookies } from 'next/headers';
+ * import { setCasSession } from '@cas-system/nextjs-cas-client/server';
+ *
+ * await setCasSession(cookies(), user, token);
+ * ```
+ */
+export declare function setCasSession(cookies: ReadonlyRequestCookies, user: CasUser, token: string): Promise<void>;
+/**
+ * Delete the CAS session cookies.
+ *
+ * @param cookies - The Next.js `cookies()` store.
+ *
+ * @example
+ * ```ts
+ * import { cookies } from 'next/headers';
+ * import { clearCasSession } from '@cas-system/nextjs-cas-client/server';
+ *
+ * clearCasSession(cookies());
+ * ```
+ */
+export declare function clearCasSession(cookies: ReadonlyRequestCookies): void;
+/** Typed Next.js App Router route handler signature. */
+type RouteHandler = (req: NextRequest, ctx?: {
+    params?: Record<string, string>;
+}) => Promise<NextResponse | Response> | NextResponse | Response;
+/** A route handler that receives the authenticated user as a 3rd argument. */
+type AuthenticatedHandler = (req: NextRequest, ctx: {
+    params?: Record<string, string>;
+}, user: CasUser) => Promise<NextResponse | Response> | NextResponse | Response;
+/**
+ * Higher-order function that wraps a Next.js App Router route handler,
+ * automatically extracting and verifying the CAS session and injecting the
+ * `CasUser` into the handler.
+ *
+ * If no valid session exists, responds with `401 Unauthorized`.
+ *
+ * @param handler - The protected route handler.
+ * @returns A standard Next.js route handler.
+ *
+ * @example
+ * ```ts
+ * // app/api/admin/route.ts
+ * import { withCasAuth } from '@cas-system/nextjs-cas-client/server';
+ *
+ * export const GET = withCasAuth(async (req, ctx, user) => {
+ *   return NextResponse.json({ message: `Hello ${user.username}` });
+ * });
+ * ```
+ */
+export declare function withCasAuth(handler: AuthenticatedHandler): RouteHandler;
+/**
+ * Read the CAS session from a plain `NextRequest` (useful in middleware
+ * and edge functions where the `cookies()` helper is not available).
+ *
+ * @param request - The incoming Next.js request.
+ * @returns Session data or `null`.
+ *
+ * @internal
+ */
+export declare function getCasSessionFromRequest(request: NextRequest): Promise<CasSessionData | null>;
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/esm/server/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/server/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8DAA8D,CAAC;AAC3G,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AA8D3D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAuBhC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,sBAAsB,EAC/B,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAGrE;AAMD,wDAAwD;AACxD,KAAK,YAAY,GAAG,CAClB,GAAG,EAAE,WAAW,EAChB,GAAG,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KACtC,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC,GAAG,YAAY,GAAG,QAAQ,CAAC;AAEhE,8EAA8E;AAC9E,KAAK,oBAAoB,GAAG,CAC1B,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,EACxC,IAAI,EAAE,OAAO,KACV,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC,GAAG,YAAY,GAAG,QAAQ,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,oBAAoB,GAAG,YAAY,CAsCvE;AAED;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAehC"}

package/dist/{server → esm/server}/auth.js

@@ -12,7 +12,7 @@
  * - A separate HMAC signature cookie prevents tampering.
  * - Token validation always happens server-side via {@link CasClient}.
  */
-import { NextResponse } from 'next/server';
+import { NextResponse } from 'next/server.js';
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------

package/dist/esm/server/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/server/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAe,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE3D,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,0DAA0D;AAC1D,MAAM,cAAc,GAAG,aAAa,CAAC;AAErC,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAE3C,0EAA0E;AAC1E,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC9E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,yFAAyF;YACvF,8CAA8C,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,gBAAgB;AAChB,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,MAAc;IACxD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,gBAAgB;AAChB,KAAK,UAAU,aAAa,CAC1B,OAAe,EACf,SAAiB,EACjB,MAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,8DAA8D;IAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAChD,IAAI,CAAC,aAAa,EAAE,KAAK,IAAI,CAAC,SAAS,EAAE,KAAK;YAAE,OAAO,IAAI,CAAC;QAE5D,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,aAAa,CAAC,KAAK,EACnB,SAAS,CAAC,KAAK,EACf,MAAM,CACP,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA+B,EAC/B,IAAa,EACb,KAAa;IAEb,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACpE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAE/C,MAAM,aAAa,GAAG;QACpB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QAC7C,QAAQ,EAAE,KAAc;QACxB,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,SAAS;KACpC,CAAC;IAED,OAAe,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IAC5D,OAAe,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC5D,OAAe,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACvC,OAAe,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC5C,CAAC;AAmBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,WAAW,CAAC,OAA6B;IACvD,OAAO,KAAK,EAAE,GAAgB,EAAE,GAAyC,EAAE,EAAE;QAC3E,+EAA+E;QAC/E,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAEpD,IAAI,CAAC,aAAa,EAAE,KAAK,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAC/C,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,cAAc,EAAE,EACzB,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,aAAa,CAAC,KAAK,EACnB,SAAS,CAAC,KAAK,EACf,MAAM,CACP,CAAC;YACF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAC3C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;YAEnD,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,oCAAoC,EAAE,EAC/C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC;QAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC;QAC9D,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE5C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/esm/server/cas-client.d.ts

@@ -0,0 +1,93 @@
+/**
+ * @module @cas-system/nextjs-cas-client/server/cas-client
+ * @description Server-side CAS client for token validation, generation, and
+ * SSO login URL construction.  Uses only the built-in `fetch` API — zero
+ * external dependencies.
+ *
+ * **IMPORTANT:** This module must only run on the server. It requires the
+ * `clientSecret` which must never be sent to the browser.
+ */
+import type { CasServerConfig, CasUser } from '../types.js';
+/**
+ * Server-side CAS client.
+ *
+ * @example
+ * ```ts
+ * import { CasClient } from '@cas-system/nextjs-cas-client/server';
+ *
+ * const cas = new CasClient({
+ *   serverUrl: process.env.CAS_SERVER_URL!,
+ *   clientId: process.env.CAS_CLIENT_ID!,
+ *   clientSecret: process.env.CAS_CLIENT_SECRET!,
+ *   callbackUrl: process.env.CAS_CALLBACK_URL,
+ * });
+ *
+ * // Validate a token received from the callback
+ * const user = await cas.validateToken(token);
+ * ```
+ */
+export declare class CasClient {
+    private readonly config;
+    constructor(config: CasServerConfig);
+    /**
+     * Build the CAS SSO login URL.
+     *
+     * @param returnUrl - Optional URL to redirect back to after login.
+     *                    Falls back to `config.callbackUrl`.
+     * @returns Fully-qualified CAS login URL.
+     *
+     * @example
+     * ```ts
+     * const loginUrl = cas.getLoginUrl('/dashboard');
+     * redirect(loginUrl);
+     * ```
+     */
+    getLoginUrl(returnUrl?: string): string;
+    /**
+     * Validate a JWT token with the CAS server (server-to-server call).
+     *
+     * @param token - The JWT token received from the CAS callback.
+     * @returns The authenticated {@link CasUser} or `null` if invalid.
+     *
+     * @example
+     * ```ts
+     * const user = await cas.validateToken(token);
+     * if (!user) throw new Error('Invalid token');
+     * ```
+     */
+    validateToken(token: string): Promise<CasUser | null>;
+    /**
+     * Generate a JWT token for the given username (server-to-server).
+     *
+     * This is useful for machine-to-machine auth flows or impersonation
+     * when the calling service already knows the target user.
+     *
+     * @param username - The username to issue a token for.
+     * @returns The JWT string or `null` on failure.
+     */
+    generateToken(username: string): Promise<string | null>;
+    /**
+     * Notify the CAS server of a logout event.
+     *
+     * @param token - Optional token to invalidate on the server.
+     * @returns `true` if the server acknowledged the logout.
+     */
+    logout(token?: string): Promise<boolean>;
+    /**
+     * Check whether a user has **all** of the specified roles.
+     *
+     * @param user  - The CAS user.
+     * @param roles - Required roles.
+     * @returns `true` if the user possesses every role.
+     */
+    static hasRoles(user: CasUser, roles: string[]): boolean;
+    /**
+     * Check whether a user has **at least one** of the specified roles.
+     *
+     * @param user  - The CAS user.
+     * @param roles - Roles to check.
+     * @returns `true` if the user possesses any of the roles.
+     */
+    static hasAnyRole(user: CasUser, roles: string[]): boolean;
+}
+//# sourceMappingURL=cas-client.d.ts.map

package/dist/esm/server/cas-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cas-client.d.ts","sourceRoot":"","sources":["../../../src/server/cas-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,OAAO,EAGR,MAAM,aAAa,CAAC;AAkBrB;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;gBAErD,MAAM,EAAE,eAAe;IAgBnC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM;IAevC;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAuC3D;;;;;;;;OAQG;IACG,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAuC7D;;;;;OAKG;IACG,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgC9C;;;;;;OAMG;IACH,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO;IAKxD;;;;;;OAMG;IACH,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO;CAI3D"}

package/dist/esm/server/cas-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cas-client.js","sourceRoot":"","sources":["../../../src/server/cas-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AASH,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,SAAS;IAGpB,YAAY,MAAuB;QACjC,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,YAAY;YACtB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAE1D,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,MAAM;YACT,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC;SAC1C,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,YAAY;IACZ,0EAA0E;IAE1E;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,SAAkB;QAC5B,MAAM,WAAW,GACf,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,mBAAmB,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,OAAO;YACtB,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,cAAc,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACnE,CAAC;IAED,0EAA0E;IAC1E,mBAAmB;IACnB,0EAA0E;IAE1E;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,qBAAqB,EAC7C;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK;oBACL,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;oBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;iBACxC,CAAC;gBACF,KAAK,EAAE,UAAU;aAClB,CACF,CAAC;YAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CACX,qCAAqC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CACpE,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAE3C,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,mBAAmB;IACnB,0EAA0E;IAE1E;;;;;;;;OAQG;IACH,KAAK,CAAC,aAAa,CAAC,QAAgB;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,gBAAgB,EACxC;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;oBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;oBACvC,QAAQ;iBACT,CAAC;gBACF,KAAK,EAAE,UAAU;aAClB,CACF,CAAC;YAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CACX,qCAAqC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CACpE,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAE7B,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,SAAS;IACT,0EAA0E;IAE1E;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,KAAc;QACzB,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B;gBACtC,cAAc,EAAE,kBAAkB;aACnC,CAAC;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;YAC/C,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,aAAa,EACrC;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;iBAChC,CAAC;gBACF,KAAK,EAAE,UAAU;aAClB,CACF,CAAC;YAEF,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,eAAe;IACf,0EAA0E;IAE1E;;;;;;OAMG;IACH,MAAM,CAAC,QAAQ,CAAC,IAAa,EAAE,KAAe;QAC5C,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,UAAU,CAAC,IAAa,EAAE,KAAe;QAC9C,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/esm/server/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @module @cas-system/nextjs-cas-client/server
+ * @description Server-only entry point for the Next.js CAS Client SDK.
+ *
+ * Exposes the {@link CasClient} (token validation / generation / logout) and
+ * the cookie-based session helpers.  These modules require the
+ * `clientSecret` / cookie signing secret and must never run in the browser.
+ */
+export { CasClient } from './cas-client.js';
+export { getCasSession, setCasSession, clearCasSession, withCasAuth, getCasSessionFromRequest, } from './auth.js';
+export type { CasConfig, CasServerConfig, CasUser, CasSessionData, CasHandlerConfig, } from '../types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,aAAa,EACb,aAAa,EACb,eAAe,EACf,WAAW,EACX,wBAAwB,GACzB,MAAM,WAAW,CAAC;AAEnB,YAAY,EACV,SAAS,EACT,eAAe,EACf,OAAO,EACP,cAAc,EACd,gBAAgB,GACjB,MAAM,aAAa,CAAC"}

package/dist/{server → esm/server}/index.js

@@ -6,6 +6,6 @@
  * the cookie-based session helpers.  These modules require the
  * `clientSecret` / cookie signing secret and must never run in the browser.
  */
-export { CasClient } from './cas-client';
-export { getCasSession, setCasSession, clearCasSession, withCasAuth, getCasSessionFromRequest, } from './auth';
+export { CasClient } from './cas-client.js';
+export { getCasSession, setCasSession, clearCasSession, withCasAuth, getCasSessionFromRequest, } from './auth.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,aAAa,EACb,aAAa,EACb,eAAe,EACf,WAAW,EACX,wBAAwB,GACzB,MAAM,WAAW,CAAC"}