@classytic/arc-next 0.7.1 → 0.9.0

package/dist/api.d.ts

@@ -1,4 +1,4 @@
-import { ArcClient } from "./client.js";
+import { ArcClient, NextFetchOptions } from "./client.js";
 import { AggregatePaginationResult, KeysetPaginationResult, OffsetPaginationResult, PaginatedResult } from "@classytic/repo-core/pagination";
 import { AggResult, AggRow, BulkCreateResult, DeleteManyResult, DeleteResult, UpdateManyResult } from "@classytic/repo-core/repository";
 import { BracketOperator, BracketOperator as BracketOperator$1 } from "@classytic/repo-core/query-parser";
@@ -50,8 +50,14 @@ interface RequestOptions {
   token?: string | null;
   organizationId?: string | null;
   cache?: RequestCache;
-  revalidate?: number;
+  /** Flattened Next `revalidate`. `false` = cache indefinitely. */
+  revalidate?: number | false;
   tags?: string[];
+  /**
+   * Idiomatic Next App Router fetch config — passed to `fetch(url, { next })`.
+   * Merged with the flattened `revalidate`/`tags`. Prefer this from Next hosts.
+   */
+  next?: NextFetchOptions;
   headerOptions?: Record<string, string>;
   responseType?: 'json' | 'blob' | 'text';
   signal?: AbortSignal;
@@ -87,6 +93,23 @@ declare class BaseApi<TDoc = Record<string, unknown>, TCreate = Partial<TDoc>, T
   constructor(entity: string, config?: BaseApiConfig);
   /** Merge per-instance headers into request options */
   private withHeaders;
+  /**
+   * Apply the instance's default `cache` to a per-call options object — but
+   * ONLY when the caller expressed no caching intent of their own.
+   *
+   * A per-call `revalidate`/`next` (time-based ISR) or an explicit `cache`
+   * takes precedence. The default is `no-store`; forcing it alongside a
+   * `revalidate` makes Next.js throw ("cache: 'no-store' and revalidate are
+   * contradictory") and otherwise silently pins the route to dynamic
+   * rendering — so a consumer can never opt a single read into ISR. Gating the
+   * default here lets `getBySlug({ slug, options: { revalidate: 60 } })` become
+   * statically cacheable without every other call losing its no-store default.
+   *
+   * Framework-agnostic: `cache` / `revalidate` / `next` are inert pass-throughs
+   * on runtimes (React Native, plain browser fetch) that don't implement the
+   * Next.js fetch extensions, so this never assumes a Next host.
+   */
+  private withCacheDefault;
   createQueryString(params?: Record<string, unknown>): string;
   prepareParams(params?: QueryParams): Record<string, unknown>;
   getAll({
@@ -259,8 +282,16 @@ declare class BaseApi<TDoc = Record<string, unknown>, TCreate = Partial<TDoc>, T
 }
 declare function createCrudApi<TDoc = Record<string, unknown>, TCreate = Partial<TDoc>, TUpdate = Partial<TDoc>>(entity: string, config?: BaseApiConfig): BaseApi<TDoc, TCreate, TUpdate>;
 type ExtractDoc<T> = T extends PaginatedResult<infer D> ? D : never;
+/** Any preset-augmented BaseApi — the constraint preset factories accept. */
+type AnyBaseApi = BaseApi<any, any, any>;
+/** Document type of a (possibly augmented) BaseApi. */
+type DocOf<A> = A extends BaseApi<infer D, any, any> ? D : never;
+/** Create-payload type of a (possibly augmented) BaseApi. */
+type CreateOf<A> = A extends BaseApi<any, infer C, any> ? C : never;
+/** Update-payload type of a (possibly augmented) BaseApi. */
+type UpdateOf<A> = A extends BaseApi<any, any, infer U> ? U : never;
 declare function isOffsetPagination<T>(response: PaginatedResult<T>): response is OffsetPaginationResult<T>;
 declare function isKeysetPagination<T>(response: PaginatedResult<T>): response is KeysetPaginationResult<T>;
 declare function isAggregatePagination<T>(response: PaginatedResult<T>): response is AggregatePaginationResult<T>;
 //#endregion
-export { type AggResult, type AggRow, BaseApi, BaseApiConfig, type BracketOperator, type BulkCreateResult, type DeleteManyResult, type DeleteResult, ExtractDoc, FilterOperator, PopulateOption, QueryParams, RequestOptions, ScopedArgs, SortDirection, SortSpec, type UpdateManyResult, createCrudApi, isAggregatePagination, isKeysetPagination, isOffsetPagination };
+export { type AggResult, type AggRow, AnyBaseApi, BaseApi, BaseApiConfig, type BracketOperator, type BulkCreateResult, CreateOf, type DeleteManyResult, type DeleteResult, DocOf, ExtractDoc, FilterOperator, PopulateOption, QueryParams, RequestOptions, ScopedArgs, SortDirection, SortSpec, type UpdateManyResult, UpdateOf, createCrudApi, isAggregatePagination, isKeysetPagination, isOffsetPagination };

package/dist/api.js

@@ -33,6 +33,29 @@ var BaseApi = class {
 			}
 		};
 	}
+	/**
+	* Apply the instance's default `cache` to a per-call options object — but
+	* ONLY when the caller expressed no caching intent of their own.
+	*
+	* A per-call `revalidate`/`next` (time-based ISR) or an explicit `cache`
+	* takes precedence. The default is `no-store`; forcing it alongside a
+	* `revalidate` makes Next.js throw ("cache: 'no-store' and revalidate are
+	* contradictory") and otherwise silently pins the route to dynamic
+	* rendering — so a consumer can never opt a single read into ISR. Gating the
+	* default here lets `getBySlug({ slug, options: { revalidate: 60 } })` become
+	* statically cacheable without every other call losing its no-store default.
+	*
+	* Framework-agnostic: `cache` / `revalidate` / `next` are inert pass-throughs
+	* on runtimes (React Native, plain browser fetch) that don't implement the
+	* Next.js fetch extensions, so this never assumes a Next host.
+	*/
+	withCacheDefault(options = {}) {
+		if (options.cache !== void 0 || options.revalidate !== void 0 || options.next !== void 0) return options;
+		return {
+			cache: this.config.cache,
+			...options
+		};
+	}
 	createQueryString(params = {}) {
 		return createQueryString(params);
 	}
@@ -77,10 +100,7 @@ var BaseApi = class {
 		};
 		const processedParams = this.prepareParams(mergedParams);
 		const queryString = this.createQueryString(processedParams);
-		const requestOptions = {
-			cache: this.config.cache,
-			...options
-		};
+		const requestOptions = { ...this.withCacheDefault(options) };
 		if (token) requestOptions.token = token;
 		if (organizationId) requestOptions.organizationId = organizationId;
 		return this.requestFn("GET", `${this.baseUrl}?${queryString}`, this.withHeaders(requestOptions));
@@ -89,10 +109,7 @@ var BaseApi = class {
 		if (!id) throw new Error("ID is required");
 		const queryString = this.createQueryString(params);
 		const url = queryString ? `${this.baseUrl}/${id}?${queryString}` : `${this.baseUrl}/${id}`;
-		const requestOptions = {
-			cache: this.config.cache,
-			...options
-		};
+		const requestOptions = { ...this.withCacheDefault(options) };
 		if (token) requestOptions.token = token;
 		if (organizationId) requestOptions.organizationId = organizationId;
 		return this.requestFn("GET", url, this.withHeaders(requestOptions));
@@ -142,8 +159,7 @@ var BaseApi = class {
 		}
 		const requestOptions = {
 			body: data,
-			cache: this.config.cache,
-			...options
+			...this.withCacheDefault(options)
 		};
 		if (token) requestOptions.token = token;
 		if (organizationId) requestOptions.organizationId = organizationId;

package/dist/client.d.ts

@@ -171,6 +171,39 @@ declare function isValidationError(error: unknown): error is ArcApiError;
  * Prisma P2002 → `arc.conflict` (with `details[].code === 'duplicate_key'`).
  */
 declare function isDuplicateKeyError(error: unknown): error is ArcApiError;
+/**
+ * Application-Layer Encryption (ALE) config — the client half of
+ * `@classytic/arc/encryption`. Lets the SDK decrypt JWE response bodies and
+ * (optionally) encrypt JSON request bodies, transparently to callers and to
+ * the repo-core wire contracts (decryption happens BEFORE error / pagination
+ * parsing, so the parsed shape is identical to an unencrypted response).
+ *
+ * `decrypt` / `encrypt` are host-supplied so the core SDK pulls no crypto
+ * dependency. Use `createJoseEncryption()` from `@classytic/arc-next/encryption`
+ * for a ready-made JWE implementation, or wire your own (KMS proxy, WebCrypto).
+ */
+interface ClientEncryptionConfig {
+  /**
+   * Decrypt an encrypted response body (JWE compact string) → plaintext JSON
+   * string. Required — this is what makes encrypted responses readable.
+   */
+  decrypt: (payload: string) => string | Promise<string>;
+  /**
+   * Encrypt a serialized JSON request body string → JWE compact string.
+   * Required only when `encryptRequests` is true.
+   */
+  encrypt?: (json: string) => string | Promise<string>;
+  /**
+   * Encrypt outbound JSON request bodies. Default `false` — responses are
+   * still decrypted regardless (the common case: server encrypts responses,
+   * client posts plaintext over TLS).
+   */
+  encryptRequests?: boolean;
+  /** Response media type signalling an encrypted body. Default `'application/jose'`. */
+  responseContentType?: string;
+  /** Content-Type set on encrypted outbound requests. Default `'application/jose'`. */
+  requestContentType?: string;
+}
 interface ClientConfig {
   baseUrl: string;
   internalApiKey?: string;
@@ -253,6 +286,13 @@ interface ClientConfig {
    * });
    */
   afterResponse?: AfterResponseInterceptor;
+  /**
+   * Application-Layer Encryption. When set, the SDK decrypts `application/jose`
+   * response bodies (and, with `encryptRequests`, encrypts JSON request bodies)
+   * — the client counterpart to `@classytic/arc/encryption` on the backend.
+   * Transparent to repo-core wire contracts. See {@link ClientEncryptionConfig}.
+   */
+  encryption?: ClientEncryptionConfig;
 }
 interface RetryConfig {
   /** Total attempts including the first. `attempts: 3` means 1 try + 2 retries. Default: 0 (off). */
@@ -562,13 +602,40 @@ interface TextResponse {
   data: string;
   response: Response;
 }
+/**
+ * Next.js App Router `fetch` cache directives — forwarded verbatim as
+ * `fetch(url, { next })`. This is the idiomatic Next shape; a host using the
+ * App Router can pass it 1:1 with what they'd hand to `fetch`. The flattened
+ * `revalidate` / `tags` options remain for back-compat and are merged into
+ * this object before the request (flattened values win / append).
+ *
+ * @see https://nextjs.org/docs/app/api-reference/functions/fetch
+ */
+interface NextFetchOptions {
+  /**
+   * Seconds before the cached response is considered stale and revalidated.
+   * `false` caches indefinitely (Next's `force-cache` semantics); `0` opts
+   * out of caching. Omit to inherit the route's default.
+   */
+  revalidate?: number | false;
+  /** Cache tags for on-demand `revalidateTag(tag)` invalidation. */
+  tags?: string[];
+}
 interface ApiRequestOptions {
   body?: unknown;
   token?: string | null;
   organizationId?: string | null;
-  revalidate?: number;
+  /** Flattened Next `revalidate` (see `next`). `false` = cache indefinitely. */
+  revalidate?: number | false;
   headerOptions?: Record<string, string>;
+  /** Flattened Next cache `tags` (see `next`). */
   tags?: string[];
+  /**
+   * Idiomatic Next App Router fetch cache config — passed straight to
+   * `fetch(url, { next })`. Prefer this over the flattened `revalidate`/`tags`
+   * when a Next host wants full control; both are merged.
+   */
+  next?: NextFetchOptions;
   cache?: RequestCache;
   signal?: AbortSignal;
   /** Explicit idempotency key for this request. Sent as `Idempotency-Key` header. */
@@ -725,10 +792,12 @@ interface ArcFetchOptions extends Omit<RequestInit, 'body' | 'headers'> {
   elevated?: boolean;
   /** Per-call `Idempotency-Key` header. */
   idempotencyKey?: string;
-  /** Next.js fetch `revalidate` pass-through. */
-  revalidate?: number;
-  /** Next.js fetch `tags` pass-through. */
+  /** Flattened Next `revalidate` pass-through. `false` = cache indefinitely. */
+  revalidate?: number | false;
+  /** Flattened Next cache `tags` pass-through. */
   tags?: string[];
+  /** Idiomatic Next App Router fetch config — merged with `revalidate`/`tags`. */
+  next?: NextFetchOptions;
   /** `cache` pass-through (browser fetch + Next.js). */
   cache?: RequestCache;
   /**
@@ -795,4 +864,4 @@ declare const arc: {
   delete: <T = unknown>(path: string, opts?: ArcFetchOptions) => Promise<T>;
 };
 //#endregion
-export { AfterResponseContext, AfterResponseInterceptor, ApiRequestOptions, ArcApiError, ArcApiErrorOptions, ArcClient, ArcClientConfig, ArcErrorCode, ArcFetchOptions, AuthConfig, AuthErrorContext, AuthErrorHandler, BeforeRequestContext, BeforeRequestInterceptor, BlobResponse, ClientConfig, HttpMethod, KNOWN_ARC_ERROR_CODES, RetryConfig, StreamUrlProtocol, TextResponse, ToastHandler, UseRouterHook, _getAuthErrorHandler, _isAuthRecoverable, _resetArcFetchClient, _resetAuthRecovery, _resetAuthWarnings, _resolveRefreshedToken, _runAuthRecovery, arc, arcAuthHeaders, arcFetch, buildStreamUrl, configureAuth, configureClient, createAuthAwareClient, createAuthRefreshHandler, createClient, createQueryString, getAuthContext, getAuthMode, getBaseUrl, getClientAuthContext, handleApiRequest, hasGlobalStaticAuth, isAbortError, isArcApiError, isArcErrorCode, isAutoIdempotency, isDuplicateKeyError, isOrgContextRequiredError, isValidationError };
+export { AfterResponseContext, AfterResponseInterceptor, ApiRequestOptions, ArcApiError, ArcApiErrorOptions, ArcClient, ArcClientConfig, ArcErrorCode, ArcFetchOptions, AuthConfig, AuthErrorContext, AuthErrorHandler, BeforeRequestContext, BeforeRequestInterceptor, BlobResponse, ClientConfig, ClientEncryptionConfig, HttpMethod, KNOWN_ARC_ERROR_CODES, NextFetchOptions, RetryConfig, StreamUrlProtocol, TextResponse, ToastHandler, UseRouterHook, _getAuthErrorHandler, _isAuthRecoverable, _resetArcFetchClient, _resetAuthRecovery, _resetAuthWarnings, _resolveRefreshedToken, _runAuthRecovery, arc, arcAuthHeaders, arcFetch, buildStreamUrl, configureAuth, configureClient, createAuthAwareClient, createAuthRefreshHandler, createClient, createQueryString, getAuthContext, getAuthMode, getBaseUrl, getClientAuthContext, handleApiRequest, hasGlobalStaticAuth, isAbortError, isArcApiError, isArcErrorCode, isAutoIdempotency, isDuplicateKeyError, isOrgContextRequiredError, isValidationError };

package/dist/client.js

@@ -738,7 +738,7 @@ function sleepAbortable(ms, signal) {
 }
 /** A single fetch attempt — used by executeRequest's retry loop. */
 async function executeAttempt(config, method, endpoint, options, attempt) {
-	const { body, token, organizationId, revalidate, headerOptions, tags, cache, signal, idempotencyKey, elevated } = options;
+	const { body, token, organizationId, revalidate, headerOptions, tags, next, cache, signal, idempotencyKey, elevated } = options;
 	const startTime = Date.now();
 	try {
 		let headers = {
@@ -763,6 +763,11 @@ async function executeAttempt(config, method, endpoint, options, attempt) {
 		const credentials = config.credentials ?? (config.authMode === "cookie" ? "include" : "same-origin");
 		let serializedBody = void 0;
 		if (body !== void 0 && body !== null) serializedBody = isNonJsonBody(body) ? body : JSON.stringify(body);
+		const encryption = config.encryption;
+		if (encryption?.encryptRequests && encryption.encrypt && typeof serializedBody === "string") {
+			serializedBody = await encryption.encrypt(serializedBody);
+			headers["Content-Type"] = encryption.requestContentType ?? "application/jose";
+		}
 		if (config.beforeRequest) {
 			const ctx = await config.beforeRequest({
 				method,
@@ -783,14 +788,10 @@ async function executeAttempt(config, method, endpoint, options, attempt) {
 		};
 		if (serializedBody !== void 0) fetchOptions.body = serializedBody;
 		if (cache) fetchOptions.cache = cache;
-		if (revalidate !== void 0) fetchOptions.next = {
-			...fetchOptions.next,
-			revalidate
-		};
-		if (tags) fetchOptions.next = {
-			...fetchOptions.next,
-			tags
-		};
+		const nextCfg = { ...next };
+		if (revalidate !== void 0) nextCfg.revalidate = revalidate;
+		if (tags) nextCfg.tags = nextCfg.tags ? [...nextCfg.tags, ...tags] : tags;
+		if (nextCfg.revalidate !== void 0 || nextCfg.tags) fetchOptions.next = nextCfg;
 		if (!/^https?:\/\//i.test(endpoint) && !config.baseUrl) throw new Error(`[arc-next] handleApiRequest(${method} ${endpoint}): baseUrl is empty. Call configureClient({ baseUrl: '...' }) BEFORE the first request. If you use createAuthAwareClient() at module top-level, make sure the Providers component runs configureClient() first (e.g. in a useState() initializer, before the children render).`);
 		const response = await fetch(`${config.baseUrl}${endpoint}`, fetchOptions);
 		if (!response.ok) {
@@ -799,7 +800,7 @@ async function executeAttempt(config, method, endpoint, options, attempt) {
 			try {
 				json = await response.clone().json();
 				const j = json;
-				errorMessage = typeof j?.error === "string" && j.error || typeof j?.message === "string" && j.message || response.statusText;
+				errorMessage = typeof j?.error === "string" && j.error || typeof j?.meta?.message === "string" && j.meta.message || typeof j?.message === "string" && j.message || response.statusText;
 			} catch {
 				try {
 					const text = await response.text();
@@ -819,7 +820,12 @@ async function executeAttempt(config, method, endpoint, options, attempt) {
 		}
 		const contentType = response.headers.get("Content-Type");
 		let data;
-		if (contentType?.includes("application/json")) data = await response.json();
+		const decryptCt = encryption ? encryption.responseContentType ?? "application/jose" : void 0;
+		if (encryption && decryptCt && contentType?.includes(decryptCt)) {
+			const cipher = await response.text();
+			const plaintext = cipher.length > 0 ? await encryption.decrypt(cipher) : "";
+			data = plaintext.length > 0 ? JSON.parse(plaintext) : void 0;
+		} else if (contentType?.includes("application/json")) data = await response.json();
 		else if (contentType?.includes("application/pdf") || contentType?.includes("image/")) data = {
 			data: await response.blob(),
 			response
@@ -1052,7 +1058,7 @@ function sanitizeUserHeaders(headers) {
 * const result = await arc.post<{ ok: true }>('/api/statements', statements);
 */
 function arcFetch(path, options = {}) {
-	const { method = "GET", body, headers, signal, elevated, idempotencyKey, revalidate, tags, cache, client } = options;
+	const { method = "GET", body, headers, signal, elevated, idempotencyKey, revalidate, tags, next, cache, client } = options;
 	const transport = client ?? getDefaultArcFetchClient();
 	const apiOptions = {
 		body,
@@ -1062,6 +1068,7 @@ function arcFetch(path, options = {}) {
 		...idempotencyKey ? { idempotencyKey } : {},
 		...revalidate !== void 0 ? { revalidate } : {},
 		...tags ? { tags } : {},
+		...next ? { next } : {},
 		...cache ? { cache } : {}
 	};
 	return transport.request(method, path, apiOptions);

package/dist/encryption.d.ts

@@ -0,0 +1,36 @@
+import { ClientEncryptionConfig } from "./client.js";
+
+//#region src/encryption.d.ts
+/** Key material accepted by jose in browser + Node (Web Crypto). */
+type JoseKey = CryptoKey | Uint8Array;
+interface JoseEncryptionOptions {
+  /** Single decryption key (private/secret) used for every response. */
+  decryptionKey?: JoseKey;
+  /**
+   * Decryption keys indexed by `kid` (rotation). When set, the inbound JWE's
+   * `kid` header selects the key — keep 2–3 entries across a rotation so
+   * in-flight responses signed with the previous `kid` still decrypt.
+   */
+  decryptionKeys?: Record<string, JoseKey>;
+  /** Public/secret key + `kid` used to encrypt outbound requests. */
+  encryptionKey?: {
+    kid: string;
+    key: JoseKey;
+    alg?: string;
+  };
+  /** Key-management algorithm. Default `'RSA-OAEP-256'`. */
+  alg?: string;
+  /** Content-encryption algorithm. Default `'A256GCM'`. */
+  enc?: string;
+  /** Inbound-decryption allowlists (anti-downgrade). Default `[alg]` / `[enc]`. */
+  allowedAlgs?: string[];
+  allowedEncs?: string[];
+}
+/**
+ * Build the `encrypt` / `decrypt` half of a {@link ClientEncryptionConfig}
+ * using `jose`. Spread the result into `encryption` and add `encryptRequests`
+ * / content-type overrides as needed.
+ */
+declare function createJoseEncryption(options: JoseEncryptionOptions): Pick<ClientEncryptionConfig, 'encrypt' | 'decrypt'>;
+//#endregion
+export { JoseEncryptionOptions, createJoseEncryption };

package/dist/encryption.js

@@ -0,0 +1,75 @@
+import { CompactEncrypt, compactDecrypt } from "jose";
+
+//#region src/encryption.ts
+/**
+* `@classytic/arc-next/encryption` — JWE helper for the client SDK.
+*
+* A ready-made `ClientEncryptionConfig` backed by `jose` (panva) — the same
+* library `@classytic/arc/encryption` uses server-side. Works in the browser
+* and Node (jose runs on Web Crypto). `jose` is an OPTIONAL peer: import this
+* subpath only when you want JWE; the core SDK pulls no crypto dependency.
+*
+* Asymmetric key model (mirrors Visa MLE / the arc backend plugin):
+*   - Decrypt RESPONSES with the client's PRIVATE key (the recipient).
+*   - Encrypt REQUESTS with the SERVER's PUBLIC key, tagged by `kid`.
+*
+* @example
+* ```ts
+* import { configureClient } from "@classytic/arc-next/client";
+* import { createJoseEncryption } from "@classytic/arc-next/encryption";
+* import { importPKCS8, importSPKI } from "jose";
+*
+* configureClient({
+*   baseUrl: "https://api.example.com",
+*   encryption: {
+*     ...createJoseEncryption({
+*       decryptionKeys: { "client-1": await importPKCS8(clientPrivPem, "RSA-OAEP-256") },
+*       encryptionKey: { kid: "server-1", key: await importSPKI(serverPubPem, "RSA-OAEP-256") },
+*     }),
+*     encryptRequests: true,
+*   },
+* });
+* ```
+*/
+/**
+* Build the `encrypt` / `decrypt` half of a {@link ClientEncryptionConfig}
+* using `jose`. Spread the result into `encryption` and add `encryptRequests`
+* / content-type overrides as needed.
+*/
+function createJoseEncryption(options) {
+	const alg = options.alg ?? "RSA-OAEP-256";
+	const enc = options.enc ?? "A256GCM";
+	const allowedAlgs = options.allowedAlgs ?? [alg];
+	const allowedEncs = options.allowedEncs ?? [enc];
+	const decoder = new TextDecoder();
+	const encoder = new TextEncoder();
+	const decrypt = async (payload) => {
+		const { plaintext } = await compactDecrypt(payload, async (header) => {
+			if (options.decryptionKeys) {
+				const key = header.kid ? options.decryptionKeys[header.kid] : void 0;
+				if (!key) throw new Error(`[arc-next/encryption] no decryption key for kid '${header.kid ?? "<none>"}'`);
+				return key;
+			}
+			if (!options.decryptionKey) throw new Error("[arc-next/encryption] no decryption key configured");
+			return options.decryptionKey;
+		}, {
+			keyManagementAlgorithms: allowedAlgs,
+			contentEncryptionAlgorithms: allowedEncs
+		});
+		return decoder.decode(plaintext);
+	};
+	const encryptionKey = options.encryptionKey;
+	if (!encryptionKey) return { decrypt };
+	const encrypt = async (json) => new CompactEncrypt(encoder.encode(json)).setProtectedHeader({
+		alg: encryptionKey.alg ?? alg,
+		enc,
+		kid: encryptionKey.kid
+	}).encrypt(encryptionKey.key);
+	return {
+		encrypt,
+		decrypt
+	};
+}
+
+//#endregion
+export { createJoseEncryption };

package/dist/hooks.d.ts

@@ -180,6 +180,18 @@ interface CrudHooksReturn<T, TCreate, TUpdate> {
     /** New signature — auto-injects token from configureAuth() context */(id: string | null, options?: DetailQueryOptions<T>): DetailQueryResult<T>; /** Legacy signature — explicit token */
     (id: string | null, token: string | null, options?: DetailQueryOptions<T>): DetailQueryResult<T>;
   };
+  /**
+   * Suspense variant of `useList` for Suspense / streaming-SSR routes. Always
+   * fetches and SUSPENDS until resolved — wrap the subtree in `<Suspense>` and
+   * an error boundary. No `enabled` gate and no `keepPreviousData` preview
+   * (TanStack forbids both on suspense queries); `isLoading` is always `false`.
+   */
+  useSuspenseList: (params?: Record<string, unknown>, options?: Omit<ListQueryOptions<T>, "enabled">) => ListQueryResult<T>;
+  /**
+   * Suspense variant of `useDetail`. `id` must be present (it always fetches).
+   * Suspends until resolved; no list→detail `placeholderData` preview.
+   */
+  useSuspenseDetail: (id: string, options?: Omit<DetailQueryOptions<T>, "enabled">) => DetailQueryResult<T>;
   useInfiniteList: {
     /** New signature — auto-injects token/orgId from configureAuth() context */(params?: Record<string, unknown>, options?: InfiniteListQueryOptions): InfiniteListQueryResult<T>; /** Legacy signature — explicit token */
     (token: string | null, params?: Record<string, unknown>, options?: InfiniteListQueryOptions): InfiniteListQueryResult<T>;

package/dist/hooks.js

@@ -3,7 +3,7 @@
 import { getAuthMode, getClientAuthContext, hasGlobalStaticAuth } from "./client.js";
 import { isKeysetPagination, isOffsetPagination } from "./api.js";
 import { DEFAULT_QUERY_CONFIG, createCacheUtils, createQueryKeys, extractItem, getItemId, syncDetailToLists, updateListCache } from "./cache.js";
-import { findItemInListCache, useDetailQuery, useInfiniteListQuery, useListQuery } from "./query.js";
+import { findItemInListCache, useDetailQuery, useInfiniteListQuery, useListQuery, useSuspenseDetailQuery, useSuspenseListQuery } from "./query.js";
 import { useMutationWithTransition, useOptimisticMutation } from "./mutation.js";
 import { subscribeToEvents } from "./sse.js";
 import { connectWs } from "./ws.js";
@@ -176,6 +176,82 @@ function createCrudHooks({ api, entityKey, singular, plural, idField, defaults =
 		]);
 		return detailResult;
 	}
+	function useSuspenseList(params = {}, options = {}) {
+		const auth = resolveAuth();
+		const token = auth.token;
+		let resolvedParams = params;
+		if (auth.organizationId && !resolvedParams.organizationId) resolvedParams = {
+			...resolvedParams,
+			organizationId: auth.organizationId
+		};
+		const { organizationId, ...restParams } = resolvedParams;
+		const scope = options._scope || (organizationId ? "tenant" : "super-admin");
+		const { request: requestOpts, ...queryOpts } = options;
+		return useSuspenseListQuery({
+			queryKey: KEYS.scopedList(scope, {
+				organizationId,
+				...restParams
+			}),
+			queryFn: ({ signal }) => api.getAll({
+				token,
+				organizationId,
+				params: restParams,
+				options: {
+					signal,
+					...requestOpts
+				}
+			}),
+			options: {
+				staleTime: queryOpts.staleTime ?? config.staleTime,
+				gcTime: queryOpts.gcTime ?? config.gcTime,
+				refetchOnWindowFocus: queryOpts.refetchOnWindowFocus ?? config.refetchOnWindowFocus,
+				structuralSharing: queryOpts.structuralSharing ?? config.structuralSharing,
+				refetchInterval: queryOpts.refetchInterval,
+				refetchIntervalInBackground: queryOpts.refetchIntervalInBackground
+			},
+			select: queryOpts.select
+		});
+	}
+	function useSuspenseDetail(id, options = {}) {
+		const auth = resolveAuth();
+		const token = auth.token;
+		let opts = options;
+		if (auth.organizationId && !opts.organizationId) opts = {
+			...opts,
+			organizationId: auth.organizationId
+		};
+		const { organizationId, params: queryParams, request: requestOpts, ...restOptions } = opts;
+		const detailKey = KEYS.scopedDetail(id, organizationId ?? null);
+		const fullDetailKey = queryParams ? [...detailKey, queryParams] : detailKey;
+		const queryClient = useQueryClient();
+		const detailResult = useSuspenseDetailQuery({
+			queryKey: fullDetailKey,
+			queryFn: ({ signal }) => api.getById({
+				id,
+				token,
+				organizationId,
+				params: queryParams,
+				options: {
+					signal,
+					...requestOpts
+				}
+			}),
+			options: {
+				staleTime: restOptions.staleTime ?? config.staleTime,
+				gcTime: restOptions.gcTime ?? config.gcTime,
+				refetchOnWindowFocus: restOptions.refetchOnWindowFocus ?? config.refetchOnWindowFocus,
+				structuralSharing: restOptions.structuralSharing ?? config.structuralSharing,
+				refetchInterval: restOptions.refetchInterval,
+				refetchIntervalInBackground: restOptions.refetchIntervalInBackground
+			},
+			select: restOptions.select
+		});
+		useEffect(() => {
+			if (!detailResult.item) return;
+			syncDetailToLists(queryClient, KEYS.lists(), detailResult.item, idField ? { idField } : {});
+		}, [detailResult.item, queryClient]);
+		return detailResult;
+	}
 	function useActions() {
 		const queryClient = useQueryClient();
 		const silentRef = useRef(false);
@@ -956,6 +1032,8 @@ function createCrudHooks({ api, entityKey, singular, plural, idField, defaults =
 		cache,
 		useList,
 		useDetail,
+		useSuspenseList,
+		useSuspenseDetail,
 		useInfiniteList,
 		useActions,
 		useBulkActions,

package/dist/prefetch.d.ts

@@ -11,7 +11,24 @@ interface PrefetchAuthContext {
 }
 interface PrefetchOptions extends PrefetchAuthContext {
   staleTime?: number;
+  /**
+   * Next.js fetch caching forwarded to the underlying API call. A Server
+   * Component that prefetches with `revalidate` lets that data participate in
+   * ISR — without it the SDK's default `no-store` pins the whole route to
+   * dynamic rendering (e.g. a shared layout prefetch silently disables ISR on
+   * every page under it). Inert off-Next (React Native / plain browser fetch).
+   */
+  cache?: RequestCache;
+  revalidate?: number | false;
+  tags?: string[];
 }
+/** Per-call API `options` the prefetcher forwards (caching + custom headers). */
+type ForwardedApiOptions = {
+  headerOptions?: Record<string, string>;
+  cache?: RequestCache;
+  revalidate?: number | false;
+  tags?: string[];
+};
 interface PrefetchDetailOptions extends PrefetchOptions {
   /** Query params (select, populate) — key must match useDetail's params to share cache */
   params?: {
@@ -107,51 +124,39 @@ declare function createCrudPrefetcher(api: {
     params?: Record<string, unknown>;
     token?: string | null;
     organizationId?: string | null;
-    options?: {
-      headerOptions?: Record<string, string>;
-    };
+    options?: ForwardedApiOptions;
   }) => Promise<unknown>;
   getById: (opts: {
     id: string;
     token?: string | null;
     organizationId?: string | null;
-    options?: {
-      headerOptions?: Record<string, string>;
-    };
+    options?: ForwardedApiOptions;
   }) => Promise<unknown>;
   getBySlug?: (opts: {
     slug: string;
     token?: string | null;
     organizationId?: string | null;
     params?: Record<string, unknown>;
-    options?: {
-      headerOptions?: Record<string, string>;
-    };
+    options?: ForwardedApiOptions;
   }) => Promise<unknown>;
   getDeleted?: (opts: {
     params?: Record<string, unknown>;
     token?: string | null;
     organizationId?: string | null;
-    options?: {
-      headerOptions?: Record<string, string>;
-    };
+    options?: ForwardedApiOptions;
   }) => Promise<unknown>;
   aggregate?: (opts: {
     name: string;
     filter?: Record<string, unknown>;
     token?: string | null;
     organizationId?: string | null;
-    options?: {
-      headerOptions?: Record<string, string>;
-    };
+    options?: ForwardedApiOptions;
   }) => Promise<unknown>;
   getTree?: (opts: {
     params?: Record<string, unknown>;
     token?: string | null;
     organizationId?: string | null;
-    options?: {
-      headerOptions?: Record<string, string>;
-    };
+    options?: ForwardedApiOptions;
   }) => Promise<unknown>;
 }, entityKey: string): CrudPrefetcher;
 //#endregion

package/dist/prefetch.js

@@ -29,6 +29,14 @@ import { HydrationBoundary, dehydrate } from "@tanstack/react-query";
 */
 function createCrudPrefetcher(api, entityKey) {
 	const KEYS = createQueryKeys(entityKey);
+	const apiOptions = (o) => {
+		const opt = {};
+		if (o.headers) opt.headerOptions = o.headers;
+		if (o.cache !== void 0) opt.cache = o.cache;
+		if (o.revalidate !== void 0) opt.revalidate = o.revalidate;
+		if (o.tags !== void 0) opt.tags = o.tags;
+		return Object.keys(opt).length ? { options: opt } : {};
+	};
 	return {
 		async prefetchList(queryClient, params = {}, options = {}) {
 			const { organizationId: paramOrgId, ...restParams } = params;
@@ -44,7 +52,7 @@ function createCrudPrefetcher(api, entityKey) {
 					params: restParams,
 					token: options.token ?? null,
 					organizationId: orgId,
-					...options.headers ? { options: { headerOptions: options.headers } } : {}
+					...apiOptions(options)
 				}),
 				staleTime: options.staleTime
 			});
@@ -60,7 +68,7 @@ function createCrudPrefetcher(api, entityKey) {
 					token: token ?? null,
 					organizationId: organizationId ?? null,
 					...params ? { params } : {},
-					...options.headers ? { options: { headerOptions: options.headers } } : {}
+					...apiOptions(options)
 				}),
 				staleTime
 			});
@@ -76,7 +84,7 @@ function createCrudPrefetcher(api, entityKey) {
 					token: token ?? null,
 					organizationId: organizationId ?? null,
 					...params ? { params } : {},
-					...options.headers ? { options: { headerOptions: options.headers } } : {}
+					...apiOptions(options)
 				}),
 				staleTime
 			});
@@ -95,7 +103,7 @@ function createCrudPrefetcher(api, entityKey) {
 					params: restParams,
 					token: options.token ?? null,
 					organizationId: orgId,
-					...options.headers ? { options: { headerOptions: options.headers } } : {}
+					...apiOptions(options)
 				}),
 				staleTime: options.staleTime
 			});
@@ -115,7 +123,7 @@ function createCrudPrefetcher(api, entityKey) {
 					filter,
 					token: options.token ?? null,
 					organizationId: orgId,
-					...options.headers ? { options: { headerOptions: options.headers } } : {}
+					...apiOptions(options)
 				}),
 				staleTime: options.staleTime
 			});
@@ -134,7 +142,7 @@ function createCrudPrefetcher(api, entityKey) {
 					params: restParams,
 					token: options.token ?? null,
 					organizationId: orgId,
-					...options.headers ? { options: { headerOptions: options.headers } } : {}
+					...apiOptions(options)
 				}),
 				staleTime: options.staleTime
 			});
@@ -156,7 +164,7 @@ function createCrudPrefetcher(api, entityKey) {
 					},
 					token: options.token ?? null,
 					organizationId: orgId,
-					...options.headers ? { options: { headerOptions: options.headers } } : {}
+					...apiOptions(options)
 				}),
 				initialPageParam: 1,
 				getNextPageParam: () => void 0,

package/dist/presets/bulk.d.ts

@@ -1,4 +1,4 @@
-import { BaseApi, ScopedArgs } from "../api.js";
+import { AnyBaseApi, CreateOf, DocOf, ScopedArgs, UpdateOf } from "../api.js";
 import { BulkCreateResult, DeleteManyResult, UpdateManyResult } from "@classytic/repo-core/repository";
 
 //#region src/presets/bulk.d.ts
@@ -38,6 +38,6 @@ interface BulkMethods<TDoc, TCreate = Partial<TDoc>, TUpdate = Partial<TDoc>> {
  * await todos.bulkUpdate({ filter: { status: 'pending' }, data: { status: 'archived' } });
  * await todos.bulkDelete({ filter: { archivedBefore: '2024-01-01' } });
  */
-declare function withBulk<TDoc, TCreate, TUpdate>(api: BaseApi<TDoc, TCreate, TUpdate>): BaseApi<TDoc, TCreate, TUpdate> & BulkMethods<TDoc, TCreate, TUpdate>;
+declare function withBulk<TApi extends AnyBaseApi>(api: TApi): TApi & BulkMethods<DocOf<TApi>, CreateOf<TApi>, UpdateOf<TApi>>;
 //#endregion
 export { BulkMethods, withBulk };

package/dist/presets/search.d.ts

@@ -1,4 +1,4 @@
-import { BaseApi, ScopedArgs } from "../api.js";
+import { AnyBaseApi, DocOf, ScopedArgs } from "../api.js";
 import { PaginatedResult } from "@classytic/repo-core/pagination";
 
 //#region src/presets/search.d.ts
@@ -51,6 +51,6 @@ interface SearchPresetMethods<TDoc> {
  * await places.searchSimilar({ vector: [0.1, 0.2, ...], body: { topK: 5 } });
  * await places.embed({ input: 'hello world' });
  */
-declare function withSearchPreset<TDoc, TCreate, TUpdate>(api: BaseApi<TDoc, TCreate, TUpdate>): BaseApi<TDoc, TCreate, TUpdate> & SearchPresetMethods<TDoc>;
+declare function withSearchPreset<TApi extends AnyBaseApi>(api: TApi): TApi & SearchPresetMethods<DocOf<TApi>>;
 //#endregion
 export { SearchPresetMethods, withSearchPreset };

package/dist/presets/slug.d.ts

@@ -1,4 +1,4 @@
-import { BaseApi, ScopedArgs } from "../api.js";
+import { AnyBaseApi, DocOf, ScopedArgs } from "../api.js";
 
 //#region src/presets/slug.d.ts
 interface SlugLookupMethods<TDoc> {
@@ -23,6 +23,6 @@ interface SlugLookupMethods<TDoc> {
  *
  * const cat = await categories.getBySlug({ slug: 'engineering' });
  */
-declare function withSlugLookup<TDoc, TCreate, TUpdate>(api: BaseApi<TDoc, TCreate, TUpdate>): BaseApi<TDoc, TCreate, TUpdate> & SlugLookupMethods<TDoc>;
+declare function withSlugLookup<TApi extends AnyBaseApi>(api: TApi): TApi & SlugLookupMethods<DocOf<TApi>>;
 //#endregion
 export { SlugLookupMethods, withSlugLookup };

package/dist/presets/soft-delete.d.ts

@@ -1,4 +1,4 @@
-import { BaseApi, QueryParams, ScopedArgs } from "../api.js";
+import { AnyBaseApi, DocOf, QueryParams, ScopedArgs } from "../api.js";
 import { PaginatedResult } from "@classytic/repo-core/pagination";
 
 //#region src/presets/soft-delete.d.ts
@@ -29,6 +29,6 @@ interface SoftDeleteMethods<TDoc> {
  * await todos.restore({ id });            // undo
  * const trash = await todos.getDeleted();
  */
-declare function withSoftDelete<TDoc, TCreate, TUpdate>(api: BaseApi<TDoc, TCreate, TUpdate>): BaseApi<TDoc, TCreate, TUpdate> & SoftDeleteMethods<TDoc>;
+declare function withSoftDelete<TApi extends AnyBaseApi>(api: TApi): TApi & SoftDeleteMethods<DocOf<TApi>>;
 //#endregion
 export { SoftDeleteMethods, withSoftDelete };

package/dist/presets/tree.d.ts

@@ -1,4 +1,4 @@
-import { BaseApi, QueryParams, ScopedArgs } from "../api.js";
+import { AnyBaseApi, DocOf, QueryParams, ScopedArgs } from "../api.js";
 import { PaginatedResult } from "@classytic/repo-core/pagination";
 
 //#region src/presets/tree.d.ts
@@ -27,6 +27,6 @@ interface TreeMethods<TDoc> {
  * const root = await categories.getTree();
  * const kids = await categories.getChildren({ parentId: 'engineering' });
  */
-declare function withTree<TDoc, TCreate, TUpdate>(api: BaseApi<TDoc, TCreate, TUpdate>): BaseApi<TDoc, TCreate, TUpdate> & TreeMethods<TDoc>;
+declare function withTree<TApi extends AnyBaseApi>(api: TApi): TApi & TreeMethods<DocOf<TApi>>;
 //#endregion
 export { TreeMethods, withTree };

package/dist/query.d.ts

@@ -195,6 +195,20 @@ declare function useDetailQuery<T>({
   select,
   placeholderData
 }: CreateDetailQueryConfig<T>): DetailQueryResult<T>;
+/** Suspense variant of {@link useListQuery}. Always enabled; suspends until resolved. */
+declare function useSuspenseListQuery<T>({
+  queryKey,
+  queryFn,
+  options,
+  select
+}: Omit<CreateListQueryConfig, "enabled">): ListQueryResult<T>;
+/** Suspense variant of {@link useDetailQuery}. Always enabled; suspends until resolved. */
+declare function useSuspenseDetailQuery<T>({
+  queryKey,
+  queryFn,
+  options,
+  select
+}: Omit<CreateDetailQueryConfig<T>, "enabled" | "placeholderData">): DetailQueryResult<T>;
 interface InfiniteListQueryOptions {
   public?: boolean;
   enabled?: boolean;
@@ -337,4 +351,4 @@ declare function useApiQuery<TResponse = unknown, TData = ExtractData<TResponse>
   options
 }: UseApiQueryConfig<TResponse, TData>): UseApiQueryResult<TData>;
 //#endregion
-export { type CacheUtils, CreateDetailQueryConfig, CreateInfiniteListQueryConfig, CreateListQueryConfig, DEFAULT_QUERY_CONFIG, DetailQueryOptions, DetailQueryResult, ExtractData, InfiniteListQueryOptions, InfiniteListQueryResult, ListQueryOptions, ListQueryResult, type PaginationData, QUERY_CONFIGS, QueryFreshness, type QueryKeys, RequestPassthrough, UseApiQueryConfig, UseApiQueryOptions, UseApiQueryResult, createCacheUtils, createQueryKeys, extractItem, extractItems, findItemInListCache, getItemId, normalizePagination, updateListCache, useApiQuery, useDetailQuery, useInfiniteListQuery, useListQuery };
+export { type CacheUtils, CreateDetailQueryConfig, CreateInfiniteListQueryConfig, CreateListQueryConfig, DEFAULT_QUERY_CONFIG, DetailQueryOptions, DetailQueryResult, ExtractData, InfiniteListQueryOptions, InfiniteListQueryResult, ListQueryOptions, ListQueryResult, type PaginationData, QUERY_CONFIGS, QueryFreshness, type QueryKeys, RequestPassthrough, UseApiQueryConfig, UseApiQueryOptions, UseApiQueryResult, createCacheUtils, createQueryKeys, extractItem, extractItems, findItemInListCache, getItemId, normalizePagination, updateListCache, useApiQuery, useDetailQuery, useInfiniteListQuery, useListQuery, useSuspenseDetailQuery, useSuspenseListQuery };

package/dist/query.js

@@ -1,7 +1,7 @@
 "use client";
 
 import { DEFAULT_QUERY_CONFIG, QUERY_CONFIGS, createCacheUtils, createQueryKeys, extractItem, extractItems, getItemId, normalizePagination, updateListCache } from "./cache.js";
-import { keepPreviousData, useInfiniteQuery, useQuery } from "@tanstack/react-query";
+import { keepPreviousData, useInfiniteQuery, useQuery, useSuspenseQuery } from "@tanstack/react-query";
 import { useCallback, useMemo, useRef } from "react";
 
 //#region src/query.ts
@@ -99,6 +99,48 @@ function useDetailQuery({ queryKey, queryFn, enabled = true, options = {}, selec
 		refetch: query.refetch
 	};
 }
+/** Suspense variant of {@link useListQuery}. Always enabled; suspends until resolved. */
+function useSuspenseListQuery({ queryKey, queryFn, options = {}, select }) {
+	const query = useSuspenseQuery({
+		queryKey,
+		queryFn: ({ signal }) => queryFn({ signal }),
+		...DEFAULT_QUERY_CONFIG,
+		...options,
+		...select ? { select } : {}
+	});
+	return {
+		items: useMemo(() => extractItems(query.data), [query.data]),
+		pagination: useMemo(() => normalizePagination(query.data), [query.data]),
+		isLoading: false,
+		isFetching: query.isFetching,
+		isError: query.isError,
+		isSuccess: query.isSuccess,
+		isStale: query.isStale,
+		error: query.error,
+		refetch: query.refetch
+	};
+}
+/** Suspense variant of {@link useDetailQuery}. Always enabled; suspends until resolved. */
+function useSuspenseDetailQuery({ queryKey, queryFn, options = {}, select }) {
+	const query = useSuspenseQuery({
+		queryKey,
+		queryFn: ({ signal }) => queryFn({ signal }),
+		...DEFAULT_QUERY_CONFIG,
+		...options,
+		...select ? { select } : {}
+	});
+	return {
+		item: extractItem(query.data),
+		isLoading: false,
+		isFetching: query.isFetching,
+		isError: query.isError,
+		isSuccess: query.isSuccess,
+		isStale: query.isStale,
+		isPlaceholderData: false,
+		error: query.error,
+		refetch: query.refetch
+	};
+}
 function useInfiniteListQuery({ queryKey, queryFn, enabled = true, options = {}, initialPageParam = 1, getNextPageParam, getPreviousPageParam, maxPages }) {
 	const query = useInfiniteQuery({
 		queryKey,
@@ -189,4 +231,4 @@ function useApiQuery({ queryKey, queryFn, enabled = true, freshness, select, opt
 }
 
 //#endregion
-export { DEFAULT_QUERY_CONFIG, QUERY_CONFIGS, createCacheUtils, createQueryKeys, extractItem, extractItems, findItemInListCache, getItemId, normalizePagination, updateListCache, useApiQuery, useDetailQuery, useInfiniteListQuery, useListQuery };
+export { DEFAULT_QUERY_CONFIG, QUERY_CONFIGS, createCacheUtils, createQueryKeys, extractItem, extractItems, findItemInListCache, getItemId, normalizePagination, updateListCache, useApiQuery, useDetailQuery, useInfiniteListQuery, useListQuery, useSuspenseDetailQuery, useSuspenseListQuery };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classytic/arc-next",
-  "version": "0.7.1",
+  "version": "0.9.0",
   "description": "React + TanStack Query SDK for Arc resources",
   "type": "module",
   "sideEffects": false,
@@ -38,6 +38,10 @@
       "types": "./dist/client.d.ts",
       "default": "./dist/client.js"
     },
+    "./encryption": {
+      "types": "./dist/encryption.d.ts",
+      "default": "./dist/encryption.js"
+    },
     "./api": {
       "types": "./dist/api.d.ts",
       "default": "./dist/api.js"
@@ -119,17 +123,28 @@
     "push": "classytic-push",
     "release:tag": "node -e \"require('child_process').execSync('npm run push -- v'+require('./package.json').version,{stdio:'inherit'})\"",
     "release": "npm run push -- main && npm run release:tag && npm publish",
-    "prepublishOnly": "npm run typecheck && npm test && npm run build"
+    "prepublishOnly": "npm run typecheck && npm test && npm run build",
+    "typecheck:tests": "tsc --noEmit -p tsconfig.test.json"
   },
   "peerDependencies": {
     "@classytic/repo-core": ">=0.4.0",
     "@tanstack/react-query": ">=5.62.0",
+    "jose": ">=5.0.0",
     "react": ">=19.0.0"
   },
   "peerDependenciesMeta": {
-    "react": { "optional": false },
-    "@tanstack/react-query": { "optional": false },
-    "@classytic/repo-core": { "optional": false }
+    "react": {
+      "optional": false
+    },
+    "@tanstack/react-query": {
+      "optional": false
+    },
+    "@classytic/repo-core": {
+      "optional": false
+    },
+    "jose": {
+      "optional": true
+    }
   },
   "devDependencies": {
     "@classytic/dev-tools": "^0.2.0",
@@ -139,6 +154,7 @@
     "@testing-library/react": "^16.3.2",
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
+    "jose": "^6.2.3",
     "jsdom": "^29.0.2",
     "react": "^19.2.5",
     "react-dom": "^19.2.5",