@coreiam/auth 1.0.392-beta.11 → 1.0.392-beta.12

package/dist/core/index.d.ts

@@ -56,6 +56,16 @@ export class CoreIAM {
     if (!this.baseUrl) throw new Error('CoreIAM: Missing Gateway URL (COREIAM_API_URL)');
   }
 */
+/** Default gateway labels (the retired coreiam.e-qalam.com is never a default). */
+export declare const COREIAM_DEV_GATEWAY_URL = "https://dev.e-qalam.com";
+export declare const COREIAM_LIVE_GATEWAY_URL = "https://api.e-qalam.com";
+/** Default by key prefix: pk_dev_ → dev label, anything else → live. */
+export declare function defaultGatewayUrlForKey(apiKey: string): string;
+/** Resolution order: explicit baseUrl > COREIAM_API_URL > key-prefix default. */
+export declare function resolveGatewayUrl(config?: {
+    baseUrl?: string;
+    apiKey?: string;
+}): string;
 export declare class CoreIAM {
     private apiKey;
     private baseUrl;

package/dist/core/index.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAUTH_PROVIDERS = exports.CSRF_PROTECTED_PATHS = exports.CoreIAM = void 0;
+exports.OAUTH_PROVIDERS = exports.CSRF_PROTECTED_PATHS = exports.CoreIAM = exports.COREIAM_LIVE_GATEWAY_URL = exports.COREIAM_DEV_GATEWAY_URL = void 0;
 exports.toIdentity = toIdentity;
 exports.retryAfterSeconds = retryAfterSeconds;
+exports.defaultGatewayUrlForKey = defaultGatewayUrlForKey;
+exports.resolveGatewayUrl = resolveGatewayUrl;
 // src/core/index.ts
 const jose_1 = require("jose");
 /** Maps gateway token claims → CoreIAMIdentity (same shape the Next.js middleware injects). */
@@ -39,6 +41,21 @@ export class CoreIAM {
     if (!this.baseUrl) throw new Error('CoreIAM: Missing Gateway URL (COREIAM_API_URL)');
   }
 */
+// ── K13c: config layer ──────────────────────────────────────────────
+/** Default gateway labels (the retired coreiam.e-qalam.com is never a default). */
+exports.COREIAM_DEV_GATEWAY_URL = 'https://dev.e-qalam.com';
+exports.COREIAM_LIVE_GATEWAY_URL = 'https://api.e-qalam.com';
+/** Default by key prefix: pk_dev_ → dev label, anything else → live. */
+function defaultGatewayUrlForKey(apiKey) {
+    return (apiKey || '').startsWith('pk_dev_') ? exports.COREIAM_DEV_GATEWAY_URL : exports.COREIAM_LIVE_GATEWAY_URL;
+}
+/** Resolution order: explicit baseUrl > COREIAM_API_URL > key-prefix default. */
+function resolveGatewayUrl(config) {
+    const explicit = (config?.baseUrl || process.env.COREIAM_API_URL || '').replace(/\/+$/, '');
+    if (explicit)
+        return explicit;
+    return defaultGatewayUrlForKey(config?.apiKey || process.env.COREIAM_API_KEY || '');
+}
 class CoreIAM {
     apiKey = '';
     baseUrl = '';
@@ -50,7 +67,7 @@ class CoreIAM {
     refreshInFlight = null;
     constructor(config) {
         this.apiKey = config?.apiKey || process.env.COREIAM_API_KEY || '';
-        this.baseUrl = (config?.baseUrl || process.env.COREIAM_API_URL || '').replace(/\/+$/, '');
+        this.baseUrl = resolveGatewayUrl(config);
         this.issuer = config?.issuer ?? 'coreiam';
         this.audience = config?.audience;
         this.sessionCookieName = config?.sessionCookieName ?? 'jwt';

package/dist/express/index.js

@@ -16,7 +16,7 @@ function coreIamExpress(options) {
     const authPath = (options.authPath ?? '/api/auth').replace(/\/+$/, '');
     const successUrl = options.successUrl ?? '/';
     const signInUrl = options.signInUrl ?? '/login';
-    const gatewayUrl = (options.baseUrl || process.env.COREIAM_API_URL || '').replace(/\/+$/, '');
+    const gatewayUrl = (0, core_1.resolveGatewayUrl)(options);
     const isProd = process.env.NODE_ENV === 'production';
     const iam = new core_1.CoreIAM(options);
     const router = (0, express_1.Router)();

package/dist/nextjs/middleware.js

@@ -126,7 +126,7 @@ exports.coreIamMiddleware = coreIamMiddleware;
 const server_1 = require("next/server");
 //import { jwtVerify, createRemoteJWKSet } from 'jose';
 const core_1 = require("../core");
-const gatewayUrl = process.env.COREIAM_API_URL;
+const gatewayUrl = (0, core_1.resolveGatewayUrl)({ apiKey: process.env.COREIAM_API_KEY || '' });
 /**
 const JWKS = gatewayUrl
   ? createRemoteJWKSet(new URL(`${gatewayUrl}/.well-known/jwks.json`))
@@ -235,7 +235,7 @@ async function coreIamAuth(request) {
         const iam = getIam();
         if (!iam) {
             return {
-                response: new server_1.NextResponse('CoreIAM is not configured (COREIAM_API_URL / COREIAM_API_KEY)', { status: 500 }),
+                response: new server_1.NextResponse('CoreIAM is not configured (COREIAM_API_KEY required; gateway URL defaults by key prefix)', { status: 500 }),
                 isAuthenticated: false,
             };
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreiam/auth",
-  "version": "1.0.392-beta.11",
+  "version": "1.0.392-beta.12",
   "main": "./dist/core/index.js",
   "types": "./dist/core/index.d.ts",
   "exports": {
@@ -40,7 +40,8 @@
   ],
   "scripts": {
     "build": "tsc",
-    "test": "vitest run"
+    "test": "vitest run",
+    "prepublishOnly": "grep -q dev.e-qalam.com dist/core/index.js && grep -q api.e-qalam.com dist/core/index.js || { echo \"STALE DIST: rebuild before publish (beta.11 lesson)\"; exit 1; }"
   },
   "keywords": [
     "coreiam",