@econneq/auth-nextjs 1.0.2

package/dist/index.d.mts

@@ -0,0 +1 @@
+export { AuthStage, AuthUser, EconneqAuthConfig, LoginInput, Tenant, defineAuthConfig } from '@econneq/auth-core';

package/dist/index.d.ts

@@ -0,0 +1 @@
+export { AuthStage, AuthUser, EconneqAuthConfig, LoginInput, Tenant, defineAuthConfig } from '@econneq/auth-core';

package/dist/index.js

@@ -0,0 +1,12 @@
+'use strict';
+
+var authCore = require('@econneq/auth-core');
+
+
+
+Object.defineProperty(exports, "defineAuthConfig", {
+  enumerable: true,
+  get: function () { return authCore.defineAuthConfig; }
+});
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js","sourcesContent":[]}

package/dist/index.mjs

@@ -0,0 +1,3 @@
+export { defineAuthConfig } from '@econneq/auth-core';
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.mjs","sourcesContent":[]}

package/dist/middleware/index.d.mts

@@ -0,0 +1,32 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { EconneqAuthConfig } from '@econneq/auth-core';
+
+/**
+ * @econneq/auth-react/middleware
+ * Drop-in auth middleware for Next.js App Router.
+ *
+ * Usage in proxy.ts / middleware.ts:
+ *
+ *   import { createAuthMiddleware } from '@econneq/auth-react/middleware'
+ *   import { authConfig } from './auth/auth.config'
+ *
+ *   export default createAuthMiddleware(authConfig, {
+ *     protectedRoutes: ['/dashboard', '/admin'],
+ *     publicRoutes:    ['/auth/login', '/auth/register'],
+ *     loginUrl:        '/auth/login',
+ *     tenantSelectUrl: '/auth/select-tenant',
+ *   })
+ *
+ *   export const config = { matcher: ['/((?!_next|favicon).*)'] }
+ */
+
+interface AuthMiddlewareOptions {
+    protectedRoutes?: string[];
+    publicRoutes?: string[];
+    loginUrl?: string;
+    tenantSelectUrl?: string;
+    afterLoginUrl?: string;
+}
+declare function createAuthMiddleware(config: EconneqAuthConfig, opts?: AuthMiddlewareOptions): (request: NextRequest) => NextResponse;
+
+export { type AuthMiddlewareOptions, createAuthMiddleware };

package/dist/middleware/index.d.ts

@@ -0,0 +1,32 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { EconneqAuthConfig } from '@econneq/auth-core';
+
+/**
+ * @econneq/auth-react/middleware
+ * Drop-in auth middleware for Next.js App Router.
+ *
+ * Usage in proxy.ts / middleware.ts:
+ *
+ *   import { createAuthMiddleware } from '@econneq/auth-react/middleware'
+ *   import { authConfig } from './auth/auth.config'
+ *
+ *   export default createAuthMiddleware(authConfig, {
+ *     protectedRoutes: ['/dashboard', '/admin'],
+ *     publicRoutes:    ['/auth/login', '/auth/register'],
+ *     loginUrl:        '/auth/login',
+ *     tenantSelectUrl: '/auth/select-tenant',
+ *   })
+ *
+ *   export const config = { matcher: ['/((?!_next|favicon).*)'] }
+ */
+
+interface AuthMiddlewareOptions {
+    protectedRoutes?: string[];
+    publicRoutes?: string[];
+    loginUrl?: string;
+    tenantSelectUrl?: string;
+    afterLoginUrl?: string;
+}
+declare function createAuthMiddleware(config: EconneqAuthConfig, opts?: AuthMiddlewareOptions): (request: NextRequest) => NextResponse;
+
+export { type AuthMiddlewareOptions, createAuthMiddleware };

package/dist/middleware/index.js

@@ -0,0 +1,62 @@
+'use strict';
+
+var server = require('next/server');
+var authCore = require('@econneq/auth-core');
+
+// src/middleware/index.ts
+var GLOBAL_TOKEN_COOKIE = "ea_global_token";
+var TENANT_TOKEN_COOKIE = "ea_tenant_token";
+function createAuthMiddleware(config, opts = {}) {
+  const {
+    protectedRoutes = ["/dashboard", "/app"],
+    publicRoutes = ["/auth/login", "/auth/register", "/auth/mfa"],
+    loginUrl = "/auth/login",
+    tenantSelectUrl = "/auth/select-tenant"
+  } = opts;
+  return function authMiddleware(request) {
+    const { pathname } = request.nextUrl;
+    if (publicRoutes.some((r) => pathname.startsWith(r)) || pathname.startsWith("/_next") || pathname.startsWith("/api") || /\.[a-zA-Z]{2,5}$/.test(pathname)) {
+      return server.NextResponse.next();
+    }
+    const isProtected = protectedRoutes.some((r) => pathname.startsWith(r));
+    if (!isProtected) return server.NextResponse.next();
+    const rawGlobal = request.cookies.get(GLOBAL_TOKEN_COOKIE)?.value;
+    const rawTenant = request.cookies.get(TENANT_TOKEN_COOKIE)?.value;
+    if (!rawGlobal) {
+      const loginRedirect = new URL(loginUrl, request.url);
+      loginRedirect.searchParams.set("next", pathname);
+      return server.NextResponse.redirect(loginRedirect);
+    }
+    try {
+      const globalToken = authCore.parseGlobalToken(rawGlobal);
+      if (authCore.isTokenExpired(globalToken.exp)) {
+        const loginRedirect = new URL(loginUrl, request.url);
+        loginRedirect.searchParams.set("next", pathname);
+        return server.NextResponse.redirect(loginRedirect);
+      }
+      if (config.tenantMode && !rawTenant) {
+        const tenantRedirect = new URL(tenantSelectUrl, request.url);
+        tenantRedirect.searchParams.set("next", pathname);
+        return server.NextResponse.redirect(tenantRedirect);
+      }
+      if (rawTenant) {
+        const tenantToken = authCore.parseTenantToken(rawTenant);
+        if (authCore.isTokenExpired(tenantToken.exp)) {
+          return server.NextResponse.redirect(new URL(tenantSelectUrl, request.url));
+        }
+        const res = server.NextResponse.next();
+        res.headers.set("x-auth-user-id", tenantToken.userId);
+        res.headers.set("x-auth-tenant-key", tenantToken.tenantKey);
+        res.headers.set("x-auth-roles", tenantToken.roles.join(","));
+        return res;
+      }
+      return server.NextResponse.next();
+    } catch {
+      return server.NextResponse.redirect(new URL(loginUrl, request.url));
+    }
+  };
+}
+
+exports.createAuthMiddleware = createAuthMiddleware;
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/middleware/index.ts"],"names":["NextResponse","parseGlobalToken","isTokenExpired","parseTenantToken"],"mappings":";;;;;;AAqBA,IAAM,mBAAA,GAAuB,iBAAA;AAC7B,IAAM,mBAAA,GAAuB,iBAAA;AAUtB,SAAS,oBAAA,CACd,MAAA,EACA,IAAA,GAA8B,EAAC,EAC/B;AACA,EAAA,MAAM;AAAA,IACJ,eAAA,GAAmB,CAAC,YAAA,EAAc,MAAM,CAAA;AAAA,IACxC,YAAA,GAAmB,CAAC,aAAA,EAAe,gBAAA,EAAkB,WAAW,CAAA;AAAA,IAChE,QAAA,GAAmB,aAAA;AAAA,IACnB,eAAA,GAAmB;AAAA,GACrB,GAAI,IAAA;AAEJ,EAAA,OAAO,SAAS,eAAe,OAAA,EAAoC;AACjE,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,OAAA,CAAQ,OAAA;AAG7B,IAAA,IACE,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,SAAS,UAAA,CAAW,CAAC,CAAC,CAAA,IAC/C,QAAA,CAAS,WAAW,QAAQ,CAAA,IAC5B,SAAS,UAAA,CAAW,MAAM,KAC1B,kBAAA,CAAmB,IAAA,CAAK,QAAQ,CAAA,EAChC;AACA,MAAA,OAAOA,oBAAa,IAAA,EAAK;AAAA,IAC3B;AAEA,IAAA,MAAM,WAAA,GAAc,gBAAgB,IAAA,CAAK,CAAC,MAAM,QAAA,CAAS,UAAA,CAAW,CAAC,CAAC,CAAA;AACtE,IAAA,IAAI,CAAC,WAAA,EAAa,OAAOA,mBAAA,CAAa,IAAA,EAAK;AAG3C,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAA,EAAG,KAAA;AAC5D,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAA,EAAG,KAAA;AAG5D,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,MAAM,aAAA,GAAgB,IAAI,GAAA,CAAI,QAAA,EAAU,QAAQ,GAAG,CAAA;AACnD,MAAA,aAAA,CAAc,YAAA,CAAa,GAAA,CAAI,MAAA,EAAQ,QAAQ,CAAA;AAC/C,MAAA,OAAOA,mBAAA,CAAa,SAAS,aAAa,CAAA;AAAA,IAC5C;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAcC,0BAAiB,SAAS,CAAA;AAC9C,MAAA,IAAIC,uBAAA,CAAe,WAAA,CAAY,GAAG,CAAA,EAAG;AACnC,QAAA,MAAM,aAAA,GAAgB,IAAI,GAAA,CAAI,QAAA,EAAU,QAAQ,GAAG,CAAA;AACnD,QAAA,aAAA,CAAc,YAAA,CAAa,GAAA,CAAI,MAAA,EAAQ,QAAQ,CAAA;AAC/C,QAAA,OAAOF,mBAAA,CAAa,SAAS,aAAa,CAAA;AAAA,MAC5C;AAGA,MAAA,IAAI,MAAA,CAAO,UAAA,IAAc,CAAC,SAAA,EAAW;AACnC,QAAA,MAAM,cAAA,GAAiB,IAAI,GAAA,CAAI,eAAA,EAAiB,QAAQ,GAAG,CAAA;AAC3D,QAAA,cAAA,CAAe,YAAA,CAAa,GAAA,CAAI,MAAA,EAAQ,QAAQ,CAAA;AAChD,QAAA,OAAOA,mBAAA,CAAa,SAAS,cAAc,CAAA;AAAA,MAC7C;AAEA,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,MAAM,WAAA,GAAcG,0BAAiB,SAAS,CAAA;AAC9C,QAAA,IAAID,uBAAA,CAAe,WAAA,CAAY,GAAG,CAAA,EAAG;AAEnC,UAAA,OAAOF,oBAAa,QAAA,CAAS,IAAI,IAAI,eAAA,EAAiB,OAAA,CAAQ,GAAG,CAAC,CAAA;AAAA,QACpE;AAEA,QAAA,MAAM,GAAA,GAAMA,oBAAa,IAAA,EAAK;AAC9B,QAAA,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,gBAAA,EAAqB,WAAA,CAAY,MAAM,CAAA;AACvD,QAAA,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,mBAAA,EAAqB,WAAA,CAAY,SAAS,CAAA;AAC1D,QAAA,GAAA,CAAI,QAAQ,GAAA,CAAI,cAAA,EAAqB,YAAY,KAAA,CAAM,IAAA,CAAK,GAAG,CAAC,CAAA;AAChE,QAAA,OAAO,GAAA;AAAA,MACT;AAEA,MAAA,OAAOA,oBAAa,IAAA,EAAK;AAAA,IAC3B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAOA,oBAAa,QAAA,CAAS,IAAI,IAAI,QAAA,EAAU,OAAA,CAAQ,GAAG,CAAC,CAAA;AAAA,IAC7D;AAAA,EACF,CAAA;AACF","file":"index.js","sourcesContent":["/**\n * @econneq/auth-react/middleware\n * Drop-in auth middleware for Next.js App Router.\n *\n * Usage in proxy.ts / middleware.ts:\n *\n *   import { createAuthMiddleware } from '@econneq/auth-react/middleware'\n *   import { authConfig } from './auth/auth.config'\n *\n *   export default createAuthMiddleware(authConfig, {\n *     protectedRoutes: ['/dashboard', '/admin'],\n *     publicRoutes:    ['/auth/login', '/auth/register'],\n *     loginUrl:        '/auth/login',\n *     tenantSelectUrl: '/auth/select-tenant',\n *   })\n *\n *   export const config = { matcher: ['/((?!_next|favicon).*)'] }\n */\nimport { NextRequest, NextResponse } from 'next/server'\nimport { parseGlobalToken, parseTenantToken, isTokenExpired, type EconneqAuthConfig } from '@econneq/auth-core'\n\nconst GLOBAL_TOKEN_COOKIE  = 'ea_global_token'\nconst TENANT_TOKEN_COOKIE  = 'ea_tenant_token'\n\nexport interface AuthMiddlewareOptions {\n  protectedRoutes?:  string[]\n  publicRoutes?:     string[]\n  loginUrl?:         string\n  tenantSelectUrl?:  string\n  afterLoginUrl?:    string\n}\n\nexport function createAuthMiddleware(\n  config: EconneqAuthConfig,\n  opts: AuthMiddlewareOptions = {},\n) {\n  const {\n    protectedRoutes  = ['/dashboard', '/app'],\n    publicRoutes     = ['/auth/login', '/auth/register', '/auth/mfa'],\n    loginUrl         = '/auth/login',\n    tenantSelectUrl  = '/auth/select-tenant',\n  } = opts\n\n  return function authMiddleware(request: NextRequest): NextResponse {\n    const { pathname } = request.nextUrl\n\n    // Always allow public routes and Next.js internals\n    if (\n      publicRoutes.some((r) => pathname.startsWith(r)) ||\n      pathname.startsWith('/_next') ||\n      pathname.startsWith('/api') ||\n      /\\.[a-zA-Z]{2,5}$/.test(pathname)\n    ) {\n      return NextResponse.next()\n    }\n\n    const isProtected = protectedRoutes.some((r) => pathname.startsWith(r))\n    if (!isProtected) return NextResponse.next()\n\n    // Read tokens from cookies (httpOnly cookies set by server)\n    const rawGlobal = request.cookies.get(GLOBAL_TOKEN_COOKIE)?.value\n    const rawTenant = request.cookies.get(TENANT_TOKEN_COOKIE)?.value\n\n    // No global token → redirect to login\n    if (!rawGlobal) {\n      const loginRedirect = new URL(loginUrl, request.url)\n      loginRedirect.searchParams.set('next', pathname)\n      return NextResponse.redirect(loginRedirect)\n    }\n\n    try {\n      const globalToken = parseGlobalToken(rawGlobal)\n      if (isTokenExpired(globalToken.exp)) {\n        const loginRedirect = new URL(loginUrl, request.url)\n        loginRedirect.searchParams.set('next', pathname)\n        return NextResponse.redirect(loginRedirect)\n      }\n\n      // Has global token but no tenant token → tenant selection\n      if (config.tenantMode && !rawTenant) {\n        const tenantRedirect = new URL(tenantSelectUrl, request.url)\n        tenantRedirect.searchParams.set('next', pathname)\n        return NextResponse.redirect(tenantRedirect)\n      }\n\n      if (rawTenant) {\n        const tenantToken = parseTenantToken(rawTenant)\n        if (isTokenExpired(tenantToken.exp)) {\n          // Tenant token expired — redirect to tenant selection for re-exchange\n          return NextResponse.redirect(new URL(tenantSelectUrl, request.url))\n        }\n        // Inject headers for server components\n        const res = NextResponse.next()\n        res.headers.set('x-auth-user-id',    tenantToken.userId)\n        res.headers.set('x-auth-tenant-key', tenantToken.tenantKey)\n        res.headers.set('x-auth-roles',      tenantToken.roles.join(','))\n        return res\n      }\n\n      return NextResponse.next()\n    } catch {\n      return NextResponse.redirect(new URL(loginUrl, request.url))\n    }\n  }\n}\n"]}

package/dist/middleware/index.mjs

@@ -0,0 +1,60 @@
+import { NextResponse } from 'next/server';
+import { parseGlobalToken, isTokenExpired, parseTenantToken } from '@econneq/auth-core';
+
+// src/middleware/index.ts
+var GLOBAL_TOKEN_COOKIE = "ea_global_token";
+var TENANT_TOKEN_COOKIE = "ea_tenant_token";
+function createAuthMiddleware(config, opts = {}) {
+  const {
+    protectedRoutes = ["/dashboard", "/app"],
+    publicRoutes = ["/auth/login", "/auth/register", "/auth/mfa"],
+    loginUrl = "/auth/login",
+    tenantSelectUrl = "/auth/select-tenant"
+  } = opts;
+  return function authMiddleware(request) {
+    const { pathname } = request.nextUrl;
+    if (publicRoutes.some((r) => pathname.startsWith(r)) || pathname.startsWith("/_next") || pathname.startsWith("/api") || /\.[a-zA-Z]{2,5}$/.test(pathname)) {
+      return NextResponse.next();
+    }
+    const isProtected = protectedRoutes.some((r) => pathname.startsWith(r));
+    if (!isProtected) return NextResponse.next();
+    const rawGlobal = request.cookies.get(GLOBAL_TOKEN_COOKIE)?.value;
+    const rawTenant = request.cookies.get(TENANT_TOKEN_COOKIE)?.value;
+    if (!rawGlobal) {
+      const loginRedirect = new URL(loginUrl, request.url);
+      loginRedirect.searchParams.set("next", pathname);
+      return NextResponse.redirect(loginRedirect);
+    }
+    try {
+      const globalToken = parseGlobalToken(rawGlobal);
+      if (isTokenExpired(globalToken.exp)) {
+        const loginRedirect = new URL(loginUrl, request.url);
+        loginRedirect.searchParams.set("next", pathname);
+        return NextResponse.redirect(loginRedirect);
+      }
+      if (config.tenantMode && !rawTenant) {
+        const tenantRedirect = new URL(tenantSelectUrl, request.url);
+        tenantRedirect.searchParams.set("next", pathname);
+        return NextResponse.redirect(tenantRedirect);
+      }
+      if (rawTenant) {
+        const tenantToken = parseTenantToken(rawTenant);
+        if (isTokenExpired(tenantToken.exp)) {
+          return NextResponse.redirect(new URL(tenantSelectUrl, request.url));
+        }
+        const res = NextResponse.next();
+        res.headers.set("x-auth-user-id", tenantToken.userId);
+        res.headers.set("x-auth-tenant-key", tenantToken.tenantKey);
+        res.headers.set("x-auth-roles", tenantToken.roles.join(","));
+        return res;
+      }
+      return NextResponse.next();
+    } catch {
+      return NextResponse.redirect(new URL(loginUrl, request.url));
+    }
+  };
+}
+
+export { createAuthMiddleware };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/dist/middleware/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/middleware/index.ts"],"names":[],"mappings":";;;;AAqBA,IAAM,mBAAA,GAAuB,iBAAA;AAC7B,IAAM,mBAAA,GAAuB,iBAAA;AAUtB,SAAS,oBAAA,CACd,MAAA,EACA,IAAA,GAA8B,EAAC,EAC/B;AACA,EAAA,MAAM;AAAA,IACJ,eAAA,GAAmB,CAAC,YAAA,EAAc,MAAM,CAAA;AAAA,IACxC,YAAA,GAAmB,CAAC,aAAA,EAAe,gBAAA,EAAkB,WAAW,CAAA;AAAA,IAChE,QAAA,GAAmB,aAAA;AAAA,IACnB,eAAA,GAAmB;AAAA,GACrB,GAAI,IAAA;AAEJ,EAAA,OAAO,SAAS,eAAe,OAAA,EAAoC;AACjE,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,OAAA,CAAQ,OAAA;AAG7B,IAAA,IACE,YAAA,CAAa,KAAK,CAAC,CAAA,KAAM,SAAS,UAAA,CAAW,CAAC,CAAC,CAAA,IAC/C,QAAA,CAAS,WAAW,QAAQ,CAAA,IAC5B,SAAS,UAAA,CAAW,MAAM,KAC1B,kBAAA,CAAmB,IAAA,CAAK,QAAQ,CAAA,EAChC;AACA,MAAA,OAAO,aAAa,IAAA,EAAK;AAAA,IAC3B;AAEA,IAAA,MAAM,WAAA,GAAc,gBAAgB,IAAA,CAAK,CAAC,MAAM,QAAA,CAAS,UAAA,CAAW,CAAC,CAAC,CAAA;AACtE,IAAA,IAAI,CAAC,WAAA,EAAa,OAAO,YAAA,CAAa,IAAA,EAAK;AAG3C,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAA,EAAG,KAAA;AAC5D,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAA,EAAG,KAAA;AAG5D,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,MAAM,aAAA,GAAgB,IAAI,GAAA,CAAI,QAAA,EAAU,QAAQ,GAAG,CAAA;AACnD,MAAA,aAAA,CAAc,YAAA,CAAa,GAAA,CAAI,MAAA,EAAQ,QAAQ,CAAA;AAC/C,MAAA,OAAO,YAAA,CAAa,SAAS,aAAa,CAAA;AAAA,IAC5C;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,iBAAiB,SAAS,CAAA;AAC9C,MAAA,IAAI,cAAA,CAAe,WAAA,CAAY,GAAG,CAAA,EAAG;AACnC,QAAA,MAAM,aAAA,GAAgB,IAAI,GAAA,CAAI,QAAA,EAAU,QAAQ,GAAG,CAAA;AACnD,QAAA,aAAA,CAAc,YAAA,CAAa,GAAA,CAAI,MAAA,EAAQ,QAAQ,CAAA;AAC/C,QAAA,OAAO,YAAA,CAAa,SAAS,aAAa,CAAA;AAAA,MAC5C;AAGA,MAAA,IAAI,MAAA,CAAO,UAAA,IAAc,CAAC,SAAA,EAAW;AACnC,QAAA,MAAM,cAAA,GAAiB,IAAI,GAAA,CAAI,eAAA,EAAiB,QAAQ,GAAG,CAAA;AAC3D,QAAA,cAAA,CAAe,YAAA,CAAa,GAAA,CAAI,MAAA,EAAQ,QAAQ,CAAA;AAChD,QAAA,OAAO,YAAA,CAAa,SAAS,cAAc,CAAA;AAAA,MAC7C;AAEA,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,MAAM,WAAA,GAAc,iBAAiB,SAAS,CAAA;AAC9C,QAAA,IAAI,cAAA,CAAe,WAAA,CAAY,GAAG,CAAA,EAAG;AAEnC,UAAA,OAAO,aAAa,QAAA,CAAS,IAAI,IAAI,eAAA,EAAiB,OAAA,CAAQ,GAAG,CAAC,CAAA;AAAA,QACpE;AAEA,QAAA,MAAM,GAAA,GAAM,aAAa,IAAA,EAAK;AAC9B,QAAA,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,gBAAA,EAAqB,WAAA,CAAY,MAAM,CAAA;AACvD,QAAA,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,mBAAA,EAAqB,WAAA,CAAY,SAAS,CAAA;AAC1D,QAAA,GAAA,CAAI,QAAQ,GAAA,CAAI,cAAA,EAAqB,YAAY,KAAA,CAAM,IAAA,CAAK,GAAG,CAAC,CAAA;AAChE,QAAA,OAAO,GAAA;AAAA,MACT;AAEA,MAAA,OAAO,aAAa,IAAA,EAAK;AAAA,IAC3B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,aAAa,QAAA,CAAS,IAAI,IAAI,QAAA,EAAU,OAAA,CAAQ,GAAG,CAAC,CAAA;AAAA,IAC7D;AAAA,EACF,CAAA;AACF","file":"index.mjs","sourcesContent":["/**\n * @econneq/auth-react/middleware\n * Drop-in auth middleware for Next.js App Router.\n *\n * Usage in proxy.ts / middleware.ts:\n *\n *   import { createAuthMiddleware } from '@econneq/auth-react/middleware'\n *   import { authConfig } from './auth/auth.config'\n *\n *   export default createAuthMiddleware(authConfig, {\n *     protectedRoutes: ['/dashboard', '/admin'],\n *     publicRoutes:    ['/auth/login', '/auth/register'],\n *     loginUrl:        '/auth/login',\n *     tenantSelectUrl: '/auth/select-tenant',\n *   })\n *\n *   export const config = { matcher: ['/((?!_next|favicon).*)'] }\n */\nimport { NextRequest, NextResponse } from 'next/server'\nimport { parseGlobalToken, parseTenantToken, isTokenExpired, type EconneqAuthConfig } from '@econneq/auth-core'\n\nconst GLOBAL_TOKEN_COOKIE  = 'ea_global_token'\nconst TENANT_TOKEN_COOKIE  = 'ea_tenant_token'\n\nexport interface AuthMiddlewareOptions {\n  protectedRoutes?:  string[]\n  publicRoutes?:     string[]\n  loginUrl?:         string\n  tenantSelectUrl?:  string\n  afterLoginUrl?:    string\n}\n\nexport function createAuthMiddleware(\n  config: EconneqAuthConfig,\n  opts: AuthMiddlewareOptions = {},\n) {\n  const {\n    protectedRoutes  = ['/dashboard', '/app'],\n    publicRoutes     = ['/auth/login', '/auth/register', '/auth/mfa'],\n    loginUrl         = '/auth/login',\n    tenantSelectUrl  = '/auth/select-tenant',\n  } = opts\n\n  return function authMiddleware(request: NextRequest): NextResponse {\n    const { pathname } = request.nextUrl\n\n    // Always allow public routes and Next.js internals\n    if (\n      publicRoutes.some((r) => pathname.startsWith(r)) ||\n      pathname.startsWith('/_next') ||\n      pathname.startsWith('/api') ||\n      /\\.[a-zA-Z]{2,5}$/.test(pathname)\n    ) {\n      return NextResponse.next()\n    }\n\n    const isProtected = protectedRoutes.some((r) => pathname.startsWith(r))\n    if (!isProtected) return NextResponse.next()\n\n    // Read tokens from cookies (httpOnly cookies set by server)\n    const rawGlobal = request.cookies.get(GLOBAL_TOKEN_COOKIE)?.value\n    const rawTenant = request.cookies.get(TENANT_TOKEN_COOKIE)?.value\n\n    // No global token → redirect to login\n    if (!rawGlobal) {\n      const loginRedirect = new URL(loginUrl, request.url)\n      loginRedirect.searchParams.set('next', pathname)\n      return NextResponse.redirect(loginRedirect)\n    }\n\n    try {\n      const globalToken = parseGlobalToken(rawGlobal)\n      if (isTokenExpired(globalToken.exp)) {\n        const loginRedirect = new URL(loginUrl, request.url)\n        loginRedirect.searchParams.set('next', pathname)\n        return NextResponse.redirect(loginRedirect)\n      }\n\n      // Has global token but no tenant token → tenant selection\n      if (config.tenantMode && !rawTenant) {\n        const tenantRedirect = new URL(tenantSelectUrl, request.url)\n        tenantRedirect.searchParams.set('next', pathname)\n        return NextResponse.redirect(tenantRedirect)\n      }\n\n      if (rawTenant) {\n        const tenantToken = parseTenantToken(rawTenant)\n        if (isTokenExpired(tenantToken.exp)) {\n          // Tenant token expired — redirect to tenant selection for re-exchange\n          return NextResponse.redirect(new URL(tenantSelectUrl, request.url))\n        }\n        // Inject headers for server components\n        const res = NextResponse.next()\n        res.headers.set('x-auth-user-id',    tenantToken.userId)\n        res.headers.set('x-auth-tenant-key', tenantToken.tenantKey)\n        res.headers.set('x-auth-roles',      tenantToken.roles.join(','))\n        return res\n      }\n\n      return NextResponse.next()\n    } catch {\n      return NextResponse.redirect(new URL(loginUrl, request.url))\n    }\n  }\n}\n"]}

package/dist/server/index.d.mts

@@ -0,0 +1,25 @@
+import { GlobalToken, TenantToken } from '@econneq/auth-core';
+
+declare function getGlobalToken(): Promise<GlobalToken | null>;
+declare function getTenantToken(): Promise<TenantToken | null>;
+/**
+ * Get the authenticated server user. Redirects to login if not authenticated.
+ */
+declare function getServerUser(loginUrl?: string): Promise<{
+    token: TenantToken;
+    userId: string;
+}>;
+/**
+ * Get the user's roles from the request headers (injected by middleware).
+ */
+declare function getServerRoles(): Promise<string[]>;
+/**
+ * Check permission server-side (use in Server Actions).
+ */
+declare function serverCan(permission: string): Promise<boolean>;
+/**
+ * Get the Authorization header value for outgoing server-side requests.
+ */
+declare function getServerAuthHeader(): Promise<string>;
+
+export { getGlobalToken, getServerAuthHeader, getServerRoles, getServerUser, getTenantToken, serverCan };

package/dist/server/index.d.ts

@@ -0,0 +1,25 @@
+import { GlobalToken, TenantToken } from '@econneq/auth-core';
+
+declare function getGlobalToken(): Promise<GlobalToken | null>;
+declare function getTenantToken(): Promise<TenantToken | null>;
+/**
+ * Get the authenticated server user. Redirects to login if not authenticated.
+ */
+declare function getServerUser(loginUrl?: string): Promise<{
+    token: TenantToken;
+    userId: string;
+}>;
+/**
+ * Get the user's roles from the request headers (injected by middleware).
+ */
+declare function getServerRoles(): Promise<string[]>;
+/**
+ * Check permission server-side (use in Server Actions).
+ */
+declare function serverCan(permission: string): Promise<boolean>;
+/**
+ * Get the Authorization header value for outgoing server-side requests.
+ */
+declare function getServerAuthHeader(): Promise<string>;
+
+export { getGlobalToken, getServerAuthHeader, getServerRoles, getServerUser, getTenantToken, serverCan };

package/dist/server/index.js

@@ -0,0 +1,55 @@
+'use strict';
+
+var headers = require('next/headers');
+var navigation = require('next/navigation');
+var authCore = require('@econneq/auth-core');
+
+// src/server/index.ts
+var GLOBAL_TOKEN_COOKIE = "ea_global_token";
+var TENANT_TOKEN_COOKIE = "ea_tenant_token";
+async function getGlobalToken() {
+  const raw = (await headers.cookies()).get(GLOBAL_TOKEN_COOKIE)?.value;
+  if (!raw) return null;
+  try {
+    const t = authCore.parseGlobalToken(raw);
+    return authCore.isTokenExpired(t.exp) ? null : t;
+  } catch {
+    return null;
+  }
+}
+async function getTenantToken() {
+  const raw = (await headers.cookies()).get(TENANT_TOKEN_COOKIE)?.value;
+  if (!raw) return null;
+  try {
+    const t = authCore.parseTenantToken(raw);
+    return authCore.isTokenExpired(t.exp) ? null : t;
+  } catch {
+    return null;
+  }
+}
+async function getServerUser(loginUrl = "/auth/login") {
+  const token = await getTenantToken();
+  if (!token) navigation.redirect(loginUrl);
+  return { token, userId: token.userId };
+}
+async function getServerRoles() {
+  const h = await headers.headers();
+  return h.get("x-auth-roles")?.split(",").filter(Boolean) ?? [];
+}
+async function serverCan(permission) {
+  const token = await getTenantToken();
+  return token?.permissions.includes(permission) ?? false;
+}
+async function getServerAuthHeader() {
+  const token = await getTenantToken() ?? await getGlobalToken();
+  return token ? `Bearer ${token.raw}` : "";
+}
+
+exports.getGlobalToken = getGlobalToken;
+exports.getServerAuthHeader = getServerAuthHeader;
+exports.getServerRoles = getServerRoles;
+exports.getServerUser = getServerUser;
+exports.getTenantToken = getTenantToken;
+exports.serverCan = serverCan;
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/server/index.ts"],"names":["cookies","parseGlobalToken","isTokenExpired","parseTenantToken","redirect","headers"],"mappings":";;;;;;;AAUA,IAAM,mBAAA,GAAuB,iBAAA;AAC7B,IAAM,mBAAA,GAAuB,iBAAA;AAI7B,eAAsB,cAAA,GAA8C;AAClE,EAAA,MAAM,OAAO,MAAMA,eAAA,EAAQ,EAAG,GAAA,CAAI,mBAAmB,CAAA,EAAG,KAAA;AACxD,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,IAAI;AACF,IAAA,MAAM,CAAA,GAAIC,0BAAiB,GAAG,CAAA;AAC9B,IAAA,OAAOC,uBAAA,CAAe,CAAA,CAAE,GAAG,CAAA,GAAI,IAAA,GAAO,CAAA;AAAA,EACxC,CAAA,CAAA,MAAQ;AAAE,IAAA,OAAO,IAAA;AAAA,EAAK;AACxB;AAEA,eAAsB,cAAA,GAA8C;AAClE,EAAA,MAAM,OAAO,MAAMF,eAAA,EAAQ,EAAG,GAAA,CAAI,mBAAmB,CAAA,EAAG,KAAA;AACxD,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,IAAI;AACF,IAAA,MAAM,CAAA,GAAIG,0BAAiB,GAAG,CAAA;AAC9B,IAAA,OAAOD,uBAAA,CAAe,CAAA,CAAE,GAAG,CAAA,GAAI,IAAA,GAAO,CAAA;AAAA,EACxC,CAAA,CAAA,MAAQ;AAAE,IAAA,OAAO,IAAA;AAAA,EAAK;AACxB;AAOA,eAAsB,aAAA,CAAc,WAAW,aAAA,EAAgE;AAC7G,EAAA,MAAM,KAAA,GAAQ,MAAM,cAAA,EAAe;AACnC,EAAA,IAAI,CAAC,KAAA,EAAOE,mBAAA,CAAS,QAAQ,CAAA;AAC7B,EAAA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAQ,KAAA,CAAM,MAAA,EAAO;AACvC;AAKA,eAAsB,cAAA,GAAoC;AACxD,EAAA,MAAM,CAAA,GAAI,MAAMC,eAAA,EAAQ;AACxB,EAAA,OAAO,CAAA,CAAE,GAAA,CAAI,cAAc,CAAA,EAAG,KAAA,CAAM,GAAG,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,IAAK,EAAC;AAC/D;AAKA,eAAsB,UAAU,UAAA,EAAsC;AACpE,EAAA,MAAM,KAAA,GAAQ,MAAM,cAAA,EAAe;AACnC,EAAA,OAAO,KAAA,EAAO,WAAA,CAAY,QAAA,CAAS,UAAU,CAAA,IAAK,KAAA;AACpD;AAKA,eAAsB,mBAAA,GAAuC;AAC3D,EAAA,MAAM,KAAA,GAAQ,MAAM,cAAA,EAAe,IAAK,MAAM,cAAA,EAAe;AAC7D,EAAA,OAAO,KAAA,GAAQ,CAAA,OAAA,EAAU,KAAA,CAAM,GAAG,CAAA,CAAA,GAAK,EAAA;AACzC","file":"index.js","sourcesContent":["/**\n * @econneq/auth-react/server\n * Server-side auth utilities for Next.js App Router.\n * Import only in Server Components, Server Actions, or Route Handlers.\n */\nimport { cookies, headers } from 'next/headers'\nimport { redirect } from 'next/navigation'\nimport { parseGlobalToken, parseTenantToken, isTokenExpired } from '@econneq/auth-core'\nimport type { GlobalToken, TenantToken, AuthUser } from '@econneq/auth-core'\n\nconst GLOBAL_TOKEN_COOKIE  = 'ea_global_token'\nconst TENANT_TOKEN_COOKIE  = 'ea_tenant_token'\n\n// ─── Token accessors ──────────────────────────────────────────────────────────\n\nexport async function getGlobalToken(): Promise<GlobalToken | null> {\n  const raw = (await cookies()).get(GLOBAL_TOKEN_COOKIE)?.value\n  if (!raw) return null\n  try {\n    const t = parseGlobalToken(raw)\n    return isTokenExpired(t.exp) ? null : t\n  } catch { return null }\n}\n\nexport async function getTenantToken(): Promise<TenantToken | null> {\n  const raw = (await cookies()).get(TENANT_TOKEN_COOKIE)?.value\n  if (!raw) return null\n  try {\n    const t = parseTenantToken(raw)\n    return isTokenExpired(t.exp) ? null : t\n  } catch { return null }\n}\n\n// ─── Server Component helpers ────────────────────────────────────────────────\n\n/**\n * Get the authenticated server user. Redirects to login if not authenticated.\n */\nexport async function getServerUser(loginUrl = '/auth/login'): Promise<{ token: TenantToken; userId: string }> {\n  const token = await getTenantToken()\n  if (!token) redirect(loginUrl)\n  return { token, userId: token.userId }\n}\n\n/**\n * Get the user's roles from the request headers (injected by middleware).\n */\nexport async function getServerRoles(): Promise<string[]> {\n  const h = await headers()\n  return h.get('x-auth-roles')?.split(',').filter(Boolean) ?? []\n}\n\n/**\n * Check permission server-side (use in Server Actions).\n */\nexport async function serverCan(permission: string): Promise<boolean> {\n  const token = await getTenantToken()\n  return token?.permissions.includes(permission) ?? false\n}\n\n/**\n * Get the Authorization header value for outgoing server-side requests.\n */\nexport async function getServerAuthHeader(): Promise<string> {\n  const token = await getTenantToken() ?? await getGlobalToken()\n  return token ? `Bearer ${token.raw}` : ''\n}\n"]}

package/dist/server/index.mjs

@@ -0,0 +1,48 @@
+import { cookies, headers } from 'next/headers';
+import { redirect } from 'next/navigation';
+import { parseGlobalToken, isTokenExpired, parseTenantToken } from '@econneq/auth-core';
+
+// src/server/index.ts
+var GLOBAL_TOKEN_COOKIE = "ea_global_token";
+var TENANT_TOKEN_COOKIE = "ea_tenant_token";
+async function getGlobalToken() {
+  const raw = (await cookies()).get(GLOBAL_TOKEN_COOKIE)?.value;
+  if (!raw) return null;
+  try {
+    const t = parseGlobalToken(raw);
+    return isTokenExpired(t.exp) ? null : t;
+  } catch {
+    return null;
+  }
+}
+async function getTenantToken() {
+  const raw = (await cookies()).get(TENANT_TOKEN_COOKIE)?.value;
+  if (!raw) return null;
+  try {
+    const t = parseTenantToken(raw);
+    return isTokenExpired(t.exp) ? null : t;
+  } catch {
+    return null;
+  }
+}
+async function getServerUser(loginUrl = "/auth/login") {
+  const token = await getTenantToken();
+  if (!token) redirect(loginUrl);
+  return { token, userId: token.userId };
+}
+async function getServerRoles() {
+  const h = await headers();
+  return h.get("x-auth-roles")?.split(",").filter(Boolean) ?? [];
+}
+async function serverCan(permission) {
+  const token = await getTenantToken();
+  return token?.permissions.includes(permission) ?? false;
+}
+async function getServerAuthHeader() {
+  const token = await getTenantToken() ?? await getGlobalToken();
+  return token ? `Bearer ${token.raw}` : "";
+}
+
+export { getGlobalToken, getServerAuthHeader, getServerRoles, getServerUser, getTenantToken, serverCan };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/dist/server/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/server/index.ts"],"names":[],"mappings":";;;;;AAUA,IAAM,mBAAA,GAAuB,iBAAA;AAC7B,IAAM,mBAAA,GAAuB,iBAAA;AAI7B,eAAsB,cAAA,GAA8C;AAClE,EAAA,MAAM,OAAO,MAAM,OAAA,EAAQ,EAAG,GAAA,CAAI,mBAAmB,CAAA,EAAG,KAAA;AACxD,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,IAAI;AACF,IAAA,MAAM,CAAA,GAAI,iBAAiB,GAAG,CAAA;AAC9B,IAAA,OAAO,cAAA,CAAe,CAAA,CAAE,GAAG,CAAA,GAAI,IAAA,GAAO,CAAA;AAAA,EACxC,CAAA,CAAA,MAAQ;AAAE,IAAA,OAAO,IAAA;AAAA,EAAK;AACxB;AAEA,eAAsB,cAAA,GAA8C;AAClE,EAAA,MAAM,OAAO,MAAM,OAAA,EAAQ,EAAG,GAAA,CAAI,mBAAmB,CAAA,EAAG,KAAA;AACxD,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,IAAI;AACF,IAAA,MAAM,CAAA,GAAI,iBAAiB,GAAG,CAAA;AAC9B,IAAA,OAAO,cAAA,CAAe,CAAA,CAAE,GAAG,CAAA,GAAI,IAAA,GAAO,CAAA;AAAA,EACxC,CAAA,CAAA,MAAQ;AAAE,IAAA,OAAO,IAAA;AAAA,EAAK;AACxB;AAOA,eAAsB,aAAA,CAAc,WAAW,aAAA,EAAgE;AAC7G,EAAA,MAAM,KAAA,GAAQ,MAAM,cAAA,EAAe;AACnC,EAAA,IAAI,CAAC,KAAA,EAAO,QAAA,CAAS,QAAQ,CAAA;AAC7B,EAAA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAQ,KAAA,CAAM,MAAA,EAAO;AACvC;AAKA,eAAsB,cAAA,GAAoC;AACxD,EAAA,MAAM,CAAA,GAAI,MAAM,OAAA,EAAQ;AACxB,EAAA,OAAO,CAAA,CAAE,GAAA,CAAI,cAAc,CAAA,EAAG,KAAA,CAAM,GAAG,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,IAAK,EAAC;AAC/D;AAKA,eAAsB,UAAU,UAAA,EAAsC;AACpE,EAAA,MAAM,KAAA,GAAQ,MAAM,cAAA,EAAe;AACnC,EAAA,OAAO,KAAA,EAAO,WAAA,CAAY,QAAA,CAAS,UAAU,CAAA,IAAK,KAAA;AACpD;AAKA,eAAsB,mBAAA,GAAuC;AAC3D,EAAA,MAAM,KAAA,GAAQ,MAAM,cAAA,EAAe,IAAK,MAAM,cAAA,EAAe;AAC7D,EAAA,OAAO,KAAA,GAAQ,CAAA,OAAA,EAAU,KAAA,CAAM,GAAG,CAAA,CAAA,GAAK,EAAA;AACzC","file":"index.mjs","sourcesContent":["/**\n * @econneq/auth-react/server\n * Server-side auth utilities for Next.js App Router.\n * Import only in Server Components, Server Actions, or Route Handlers.\n */\nimport { cookies, headers } from 'next/headers'\nimport { redirect } from 'next/navigation'\nimport { parseGlobalToken, parseTenantToken, isTokenExpired } from '@econneq/auth-core'\nimport type { GlobalToken, TenantToken, AuthUser } from '@econneq/auth-core'\n\nconst GLOBAL_TOKEN_COOKIE  = 'ea_global_token'\nconst TENANT_TOKEN_COOKIE  = 'ea_tenant_token'\n\n// ─── Token accessors ──────────────────────────────────────────────────────────\n\nexport async function getGlobalToken(): Promise<GlobalToken | null> {\n  const raw = (await cookies()).get(GLOBAL_TOKEN_COOKIE)?.value\n  if (!raw) return null\n  try {\n    const t = parseGlobalToken(raw)\n    return isTokenExpired(t.exp) ? null : t\n  } catch { return null }\n}\n\nexport async function getTenantToken(): Promise<TenantToken | null> {\n  const raw = (await cookies()).get(TENANT_TOKEN_COOKIE)?.value\n  if (!raw) return null\n  try {\n    const t = parseTenantToken(raw)\n    return isTokenExpired(t.exp) ? null : t\n  } catch { return null }\n}\n\n// ─── Server Component helpers ────────────────────────────────────────────────\n\n/**\n * Get the authenticated server user. Redirects to login if not authenticated.\n */\nexport async function getServerUser(loginUrl = '/auth/login'): Promise<{ token: TenantToken; userId: string }> {\n  const token = await getTenantToken()\n  if (!token) redirect(loginUrl)\n  return { token, userId: token.userId }\n}\n\n/**\n * Get the user's roles from the request headers (injected by middleware).\n */\nexport async function getServerRoles(): Promise<string[]> {\n  const h = await headers()\n  return h.get('x-auth-roles')?.split(',').filter(Boolean) ?? []\n}\n\n/**\n * Check permission server-side (use in Server Actions).\n */\nexport async function serverCan(permission: string): Promise<boolean> {\n  const token = await getTenantToken()\n  return token?.permissions.includes(permission) ?? false\n}\n\n/**\n * Get the Authorization header value for outgoing server-side requests.\n */\nexport async function getServerAuthHeader(): Promise<string> {\n  const token = await getTenantToken() ?? await getGlobalToken()\n  return token ? `Bearer ${token.raw}` : ''\n}\n"]}

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "@econneq/auth-nextjs",
+  "version": "1.0.2",
+  "description": "Next.js App Router integration — middleware, server actions, SSR auth",
+  "author": "Econneq",
+  "license": "MIT",
+  "keywords": [
+    "auth",
+    "nextjs",
+    "app-router",
+    "middleware",
+    "ssr",
+    "enterprise"
+  ],
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+    },
+    "./middleware": {
+      "types": "./dist/middleware/index.d.ts",
+      "import": "./dist/middleware/index.mjs",
+      "require": "./dist/middleware/index.js"
+    },
+    "./server": {
+      "types": "./dist/server/index.d.ts",
+      "import": "./dist/server/index.mjs",
+      "require": "./dist/server/index.js"
+    }
+  },
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "dependencies": {
+    "@econneq/auth-core": "1.0.1"
+  },
+  "peerDependencies": {
+    "next": ">=14.0.0",
+    "react": ">=18.0.0",
+    "react-dom": ">=18.0.0"
+  },
+  "devDependencies": {
+    "@types/react": "^18.3.0",
+    "next": "^15.0.0",
+    "tsup": "^8.5.1",
+    "typescript": "^5.4.0",
+    "rimraf": "^5.0.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "clean": "rimraf dist"
+  }
+}