@every-app/sdk 0.1.14 → 0.2.0

package/dist/shared/bypassGatewayLocalOnly.js

@@ -1,45 +0,0 @@
-export const BYPASS_GATEWAY_LOCAL_ONLY_TOKEN = "BYPASS_GATEWAY_LOCAL_ONLY";
-export const BYPASS_GATEWAY_LOCAL_ONLY_USER_ID = "demo-local-user";
-export const BYPASS_GATEWAY_LOCAL_ONLY_EMAIL = "demo-local-user@local";
-export function isBypassGatewayLocalOnlyClient() {
-    if (import.meta.env.PROD) {
-        return false;
-    }
-    const metaEnv = import.meta
-        .env;
-    return (metaEnv?.VITE_BYPASS_GATEWAY_LOCAL_ONLY === "true" ||
-        metaEnv?.BYPASS_GATEWAY_LOCAL_ONLY === "true");
-}
-export function isBypassGatewayLocalOnlyServer() {
-    if (import.meta.env.PROD) {
-        return false;
-    }
-    const metaEnv = import.meta
-        .env;
-    const metaValue = metaEnv?.BYPASS_GATEWAY_LOCAL_ONLY ??
-        metaEnv?.VITE_BYPASS_GATEWAY_LOCAL_ONLY;
-    if (metaValue === "true") {
-        return true;
-    }
-    if (typeof process !== "undefined" &&
-        process.env?.BYPASS_GATEWAY_LOCAL_ONLY === "true") {
-        return true;
-    }
-    return false;
-}
-export function createBypassGatewayLocalOnlySessionPayload(audience, orgId) {
-    const issuedAt = Math.floor(Date.now() / 1000);
-    const expiresAt = issuedAt + 60 * 60;
-    const payload = {
-        sub: BYPASS_GATEWAY_LOCAL_ONLY_USER_ID,
-        email: BYPASS_GATEWAY_LOCAL_ONLY_EMAIL,
-        iss: "local",
-        aud: audience,
-        iat: issuedAt,
-        exp: expiresAt,
-    };
-    return {
-        ...payload,
-        orgId,
-    };
-}

package/dist/shared/parseMessagePayload.d.ts

@@ -1,3 +0,0 @@
-export type MessagePayload = Record<string, unknown>;
-export declare function parseMessagePayload(data: unknown): MessagePayload | null;
-//# sourceMappingURL=parseMessagePayload.d.ts.map

package/dist/shared/parseMessagePayload.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"parseMessagePayload.d.ts","sourceRoot":"","sources":["../../src/shared/parseMessagePayload.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAErD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAmBxE"}

package/dist/shared/parseMessagePayload.js

@@ -1,18 +0,0 @@
-export function parseMessagePayload(data) {
-    if (data && typeof data === "object" && !Array.isArray(data)) {
-        return data;
-    }
-    if (typeof data !== "string") {
-        return null;
-    }
-    try {
-        const parsed = JSON.parse(data);
-        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-            return parsed;
-        }
-    }
-    catch {
-        return null;
-    }
-    return null;
-}

package/dist/tanstack/EmbeddedAppProvider.d.ts

@@ -1,30 +0,0 @@
-import React from "react";
-import { SessionManagerConfig } from "../core/sessionManager.js";
-interface EmbeddedProviderConfig extends SessionManagerConfig {
-    children: React.ReactNode;
-}
-export declare function EmbeddedAppProvider({ children, ...config }: EmbeddedProviderConfig): import("react/jsx-runtime").JSX.Element | null;
-/**
- * Hook to get the current authenticated user.
- * Returns the user's ID and email extracted from the JWT token,
- * or null if not authenticated.
- *
- * @example
- * ```tsx
- * function MyComponent() {
- *   const user = useCurrentUser();
- *
- *   if (!user) {
- *     return <div>Not authenticated</div>;
- *   }
- *
- *   return <div>Welcome, {user.email}</div>;
- * }
- * ```
- */
-export declare function useCurrentUser(): {
-    userId: string;
-    email: string;
-} | null;
-export {};
-//# sourceMappingURL=EmbeddedAppProvider.d.ts.map

package/dist/tanstack/EmbeddedAppProvider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"EmbeddedAppProvider.d.ts","sourceRoot":"","sources":["../../src/tanstack/EmbeddedAppProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA6C,MAAM,OAAO,CAAC;AAClE,OAAO,EAEL,oBAAoB,EACrB,MAAM,2BAA2B,CAAC;AAKnC,UAAU,sBAAuB,SAAQ,oBAAoB;IAC3D,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAUD,wBAAgB,mBAAmB,CAAC,EAClC,QAAQ,EACR,GAAG,MAAM,EACV,EAAE,sBAAsB,kDAgCxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,IAAI;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAmBzE"}

package/dist/tanstack/EmbeddedAppProvider.js

@@ -1,57 +0,0 @@
-import { jsx as _jsx } from "react/jsx-runtime";
-import { createContext, useContext, useMemo } from "react";
-import { useEveryAppSession } from "./_internal/useEveryAppSession.js";
-import { useEveryAppRouter } from "./useEveryAppRouter.js";
-import { GatewayRequiredError } from "./GatewayRequiredError.js";
-const EmbeddedAppContext = createContext(null);
-export function EmbeddedAppProvider({ children, ...config }) {
-    const { sessionManager, sessionTokenState } = useEveryAppSession({
-        sessionManagerConfig: config,
-    });
-    useEveryAppRouter({ sessionManager });
-    if (!sessionManager)
-        return null;
-    // Check if the app is running outside of the Gateway (iframe or React Native WebView)
-    if (!sessionManager.isEmbedded() &&
-        !sessionManager.isBypassGatewayLocalOnly) {
-        return (_jsx(GatewayRequiredError, { gatewayOrigin: sessionManager.parentOrigin, appId: config.appId }));
-    }
-    const value = {
-        sessionManager,
-        isAuthenticated: sessionTokenState.status === "VALID",
-        sessionTokenState,
-    };
-    return (_jsx(EmbeddedAppContext.Provider, { value: value, children: children }));
-}
-/**
- * Hook to get the current authenticated user.
- * Returns the user's ID and email extracted from the JWT token,
- * or null if not authenticated.
- *
- * @example
- * ```tsx
- * function MyComponent() {
- *   const user = useCurrentUser();
- *
- *   if (!user) {
- *     return <div>Not authenticated</div>;
- *   }
- *
- *   return <div>Welcome, {user.email}</div>;
- * }
- * ```
- */
-export function useCurrentUser() {
-    const context = useContext(EmbeddedAppContext);
-    if (!context) {
-        throw new Error("useCurrentUser must be used within an EmbeddedAppProvider");
-    }
-    const { sessionManager, sessionTokenState } = context;
-    return useMemo(() => {
-        // Only return user if we have a valid token
-        if (sessionTokenState.status !== "VALID") {
-            return null;
-        }
-        return sessionManager.getUser();
-    }, [sessionManager, sessionTokenState]);
-}

package/dist/tanstack/GatewayRequiredError.d.ts

@@ -1,20 +0,0 @@
-interface GatewayRequiredErrorProps {
-    /**
-     * The origin of the Gateway (e.g., "https://gateway.example.com").
-     */
-    gatewayOrigin: string;
-    /**
-     * The app ID used in the Gateway URL path.
-     */
-    appId: string;
-}
-/**
- * Error component displayed when an embedded app is accessed directly
- * instead of through the Every App Gateway.
- *
- * This component informs users that authentication requires accessing
- * the app through the Gateway and provides a link to do so.
- */
-export declare function GatewayRequiredError({ gatewayOrigin, appId, }: GatewayRequiredErrorProps): import("react/jsx-runtime").JSX.Element;
-export {};
-//# sourceMappingURL=GatewayRequiredError.d.ts.map

package/dist/tanstack/GatewayRequiredError.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"GatewayRequiredError.d.ts","sourceRoot":"","sources":["../../src/tanstack/GatewayRequiredError.tsx"],"names":[],"mappings":"AAEA,UAAU,yBAAyB;IACjC;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAmFD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,aAAa,EACb,KAAK,GACN,EAAE,yBAAyB,2CA6C3B"}

package/dist/tanstack/GatewayRequiredError.js

@@ -1,91 +0,0 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// CSS custom properties for theming
-const CSS_VARIABLES = `
-  @media (prefers-color-scheme: light) {
-    :root {
-      --gateway-bg: oklch(100% 0 0);
-      --gateway-text: oklch(0% 0 0);
-      --gateway-text-muted: oklch(40% 0 0);
-      --gateway-icon-bg: oklch(94% 0 0);
-      --gateway-icon-stroke: oklch(80% 0.18 90);
-      --gateway-border: oklch(94% 0 0);
-    }
-  }
-  @media (prefers-color-scheme: dark) {
-    :root {
-      --gateway-bg: #0a0f0d;
-      --gateway-text: oklch(92% 0 0);
-      --gateway-text-muted: oklch(60% 0 0);
-      --gateway-icon-bg: oklch(22% 0 0);
-      --gateway-icon-stroke: oklch(85% 0.18 90);
-      --gateway-border: oklch(30% 0 0);
-    }
-  }
-`;
-const styles = {
-    container: {
-        display: "flex",
-        flexDirection: "column",
-        alignItems: "center",
-        justifyContent: "center",
-        minHeight: "100vh",
-        padding: "24px",
-        fontFamily: '-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Oxygen", "Ubuntu", "Cantarell", "Fira Sans", "Droid Sans", "Helvetica Neue", sans-serif',
-        backgroundColor: "var(--gateway-bg, oklch(100% 0 0))",
-        color: "var(--gateway-text, oklch(0% 0 0))",
-        colorScheme: "light dark",
-    },
-    content: {
-        maxWidth: "520px",
-        width: "100%",
-        textAlign: "left",
-    },
-    iconContainer: {
-        width: "44px",
-        height: "44px",
-        marginBottom: "16px",
-        borderRadius: "0.25rem",
-        backgroundColor: "var(--gateway-icon-bg, oklch(94% 0 0))",
-        display: "flex",
-        alignItems: "center",
-        justifyContent: "center",
-        border: "1px solid var(--gateway-border, oklch(94% 0 0))",
-    },
-    title: {
-        fontSize: "18px",
-        fontWeight: 600,
-        marginBottom: "8px",
-        color: "var(--gateway-text, oklch(0% 0 0))",
-        letterSpacing: "-0.01em",
-    },
-    description: {
-        fontSize: "14px",
-        lineHeight: 1.5,
-        color: "var(--gateway-text-muted, oklch(40% 0 0))",
-        marginBottom: "20px",
-    },
-    urlText: {
-        fontSize: "14px",
-        lineHeight: 1.5,
-        color: "var(--gateway-text-muted, oklch(40% 0 0))",
-        wordBreak: "break-all",
-    },
-    urlLink: {
-        color: "rgb(168, 162, 158)",
-        textDecoration: "underline",
-        textDecorationColor: "rgb(87, 83, 78)",
-        textUnderlineOffset: "2px",
-    },
-};
-/**
- * Error component displayed when an embedded app is accessed directly
- * instead of through the Every App Gateway.
- *
- * This component informs users that authentication requires accessing
- * the app through the Gateway and provides a link to do so.
- */
-export function GatewayRequiredError({ gatewayOrigin, appId, }) {
-    const isLocalhost = window.location.hostname === "localhost";
-    const gatewayUrl = `${gatewayOrigin}/apps/${appId}${window.location.pathname}${isLocalhost ? "dev" : ""}`;
-    return (_jsxs("div", { style: styles.container, children: [_jsx("style", { children: CSS_VARIABLES }), _jsxs("div", { style: styles.content, children: [_jsx("div", { style: styles.iconContainer, children: _jsxs("svg", { width: "22", height: "22", viewBox: "0 0 24 24", fill: "none", stroke: "var(--gateway-icon-stroke, oklch(55% 0.22 25))", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", children: [_jsx("path", { d: "M10.29 3.86L1.82 18a2 2 0 0 0 1.71 3h16.94a2 2 0 0 0 1.71-3L13.71 3.86a2 2 0 0 0-3.42 0z" }), _jsx("line", { x1: "12", y1: "9", x2: "12", y2: "13" }), _jsx("line", { x1: "12", y1: "17", x2: "12.01", y2: "17" })] }) }), _jsx("h1", { style: styles.title, children: "Open in Gateway" }), _jsx("p", { style: styles.description, children: "The Gateway handles sign in and user auth. Access your app from there so this works properly." }), _jsxs("p", { style: styles.urlText, children: ["Go to", " ", _jsx("a", { href: gatewayUrl, style: styles.urlLink, children: gatewayUrl })] })] })] }));
-}

package/dist/tanstack/_internal/useEveryAppSession.d.ts

@@ -1,18 +0,0 @@
-import { SessionManager } from "../../core/sessionManager.js";
-interface SessionManagerConfig {
-    appId: string;
-}
-interface UseEveryAppSessionParams {
-    sessionManagerConfig: SessionManagerConfig;
-}
-type SessionBootstrapGate = Pick<SessionManager, "isEmbedded" | "isBypassGatewayLocalOnly">;
-export declare function shouldBootstrapSession(sessionManager: SessionBootstrapGate): boolean;
-export declare function useEveryAppSession({ sessionManagerConfig, }: UseEveryAppSessionParams): {
-    sessionManager: SessionManager | null;
-    sessionTokenState: {
-        status: "NO_TOKEN" | "VALID" | "EXPIRED" | "REFRESHING";
-        token: string | null;
-    };
-};
-export {};
-//# sourceMappingURL=useEveryAppSession.d.ts.map

package/dist/tanstack/_internal/useEveryAppSession.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"useEveryAppSession.d.ts","sourceRoot":"","sources":["../../../src/tanstack/_internal/useEveryAppSession.tsx"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,UAAU,oBAAoB;IAC5B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,UAAU,wBAAwB;IAChC,oBAAoB,EAAE,oBAAoB,CAAC;CAC5C;AAED,KAAK,oBAAoB,GAAG,IAAI,CAC9B,cAAc,EACd,YAAY,GAAG,0BAA0B,CAC1C,CAAC;AAEF,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,oBAAoB,GACnC,OAAO,CAKT;AAED,wBAAgB,kBAAkB,CAAC,EACjC,oBAAoB,GACrB,EAAE,wBAAwB;;;;;;EA8C1B"}

package/dist/tanstack/_internal/useEveryAppSession.js

@@ -1,47 +0,0 @@
-import { useEffect, useRef, useState } from "react";
-import { SessionManager } from "../../core/sessionManager.js";
-export function shouldBootstrapSession(sessionManager) {
-    // Bootstrapping should happen whenever the app is hosted by a trusted container.
-    // This intentionally keys off embedded environment semantics (iframe OR RN WebView),
-    // not iframe-only detection, so RN can initialize auth from pushed tokens.
-    return sessionManager.isEmbedded() || sessionManager.isBypassGatewayLocalOnly;
-}
-export function useEveryAppSession({ sessionManagerConfig, }) {
-    const sessionManagerRef = useRef(null);
-    const [sessionTokenState, setSessionTokenState] = useState({
-        status: "NO_TOKEN",
-        token: null,
-    });
-    if (!sessionManagerRef.current && typeof document !== "undefined") {
-        sessionManagerRef.current = new SessionManager(sessionManagerConfig);
-    }
-    const sessionManager = sessionManagerRef.current;
-    useEffect(() => {
-        if (!sessionManager)
-            return;
-        // Skip token bootstrap when not embedded (unless in demo mode) - the app will show GatewayRequiredError instead
-        if (!shouldBootstrapSession(sessionManager))
-            return;
-        const interval = setInterval(() => {
-            setSessionTokenState(sessionManager.getTokenState());
-        }, 5000);
-        sessionManager
-            .getToken()
-            .then(() => {
-            setSessionTokenState(sessionManager.getTokenState());
-        })
-            .catch((err) => {
-            console.error("[EmbeddedProvider] Initial token request failed:", err);
-        });
-        return () => {
-            clearInterval(interval);
-        };
-    }, [sessionManager]);
-    useEffect(() => {
-        if (!sessionManager)
-            return;
-        // Make sessionManager globally accessible for middleware
-        window.__embeddedSessionManager = sessionManager;
-    }, [sessionManager]);
-    return { sessionManager, sessionTokenState };
-}

package/dist/tanstack/index.d.ts

@@ -1,4 +0,0 @@
-export { useSessionTokenClientMiddleware } from "./useSessionTokenClientMiddleware.js";
-export { useEveryAppRouter } from "./useEveryAppRouter.js";
-export { EmbeddedAppProvider, useCurrentUser } from "./EmbeddedAppProvider.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/tanstack/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tanstack/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/tanstack/index.js

@@ -1,3 +0,0 @@
-export { useSessionTokenClientMiddleware } from "./useSessionTokenClientMiddleware.js";
-export { useEveryAppRouter } from "./useEveryAppRouter.js";
-export { EmbeddedAppProvider, useCurrentUser } from "./EmbeddedAppProvider.js";

package/dist/tanstack/server/authConfig.d.ts

@@ -1,3 +0,0 @@
-import type { AuthConfig } from "./types.js";
-export declare function getAuthConfig(): AuthConfig;
-//# sourceMappingURL=authConfig.d.ts.map

package/dist/tanstack/server/authConfig.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authConfig.d.ts","sourceRoot":"","sources":["../../../src/tanstack/server/authConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,wBAAgB,aAAa,IAAI,UAAU,CAc1C"}

package/dist/tanstack/server/authConfig.js

@@ -1,13 +0,0 @@
-import { env } from "cloudflare:workers";
-import { isBypassGatewayLocalOnlyServer } from "../../shared/bypassGatewayLocalOnly.js";
-export function getAuthConfig() {
-    const bypassGatewayLocalOnlyEnv = env.BYPASS_GATEWAY_LOCAL_ONLY;
-    const isBypassGatewayLocalOnly = import.meta.env.PROD !== true &&
-        (bypassGatewayLocalOnlyEnv === "true" ||
-            isBypassGatewayLocalOnlyServer() === true);
-    const issuer = env.GATEWAY_URL || (isBypassGatewayLocalOnly ? "local" : "");
-    return {
-        issuer,
-        audience: import.meta.env.VITE_APP_ID,
-    };
-}

package/dist/tanstack/server/authenticateRequest.d.ts

@@ -1,31 +0,0 @@
-import type { AuthConfig } from "./types.js";
-/**
- * JWT payload structure for embedded app session tokens.
- * Contains minimal claims for security - only what's needed for authentication.
- */
-interface SessionTokenPayload {
-    /** User ID (subject claim) */
-    sub: string;
-    /** Gateway URL (issuer claim) */
-    iss: string;
-    /** App ID (audience claim) - scopes token to specific app */
-    aud: string;
-    /** Expiration timestamp */
-    exp: number;
-    /** Issued at timestamp */
-    iat: number;
-    /** User email - used for user provisioning in apps */
-    email?: string;
-    /** Organization ID used for org-bound runtime enforcement */
-    orgId?: string;
-}
-export declare function authenticateRequest(authConfig: AuthConfig, providedRequest?: Request): Promise<SessionTokenPayload | null>;
-/**
- * Extracts the bearer token from an Authorization header.
- *
- * @param authHeader - The Authorization header value (e.g., "Bearer eyJ...")
- * @returns The token string if valid, null otherwise
- */
-export declare function extractBearerToken(authHeader: string | null): string | null;
-export {};
-//# sourceMappingURL=authenticateRequest.d.ts.map

package/dist/tanstack/server/authenticateRequest.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authenticateRequest.d.ts","sourceRoot":"","sources":["../../../src/tanstack/server/authenticateRequest.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAQ7C;;;GAGG;AACH,UAAU,mBAAmB;IAC3B,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAYD,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,UAAU,EACtB,eAAe,CAAC,EAAE,OAAO,GACxB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CA+FrC;AA8CD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAK3E"}

package/dist/tanstack/server/authenticateRequest.js

@@ -1,154 +0,0 @@
-import { getRequest } from "@tanstack/react-start/server";
-import { createLocalJWKSet, jwtVerify, } from "jose";
-import { env } from "cloudflare:workers";
-import { BYPASS_GATEWAY_LOCAL_ONLY_TOKEN, createBypassGatewayLocalOnlySessionPayload, isBypassGatewayLocalOnlyServer, } from "../../shared/bypassGatewayLocalOnly.js";
-export async function authenticateRequest(authConfig, providedRequest) {
-    const request = providedRequest || getRequest();
-    const authHeader = request.headers.get("authorization");
-    const expectedOrganizationId = getOptionalEnvValue("EVERY_APP_ORG_ID");
-    const appTenancyMode = getAppTenancyMode();
-    const isBypassGatewayLocalOnly = import.meta.env.PROD !== true &&
-        (getOptionalEnvValue("BYPASS_GATEWAY_LOCAL_ONLY") === "true" ||
-            isBypassGatewayLocalOnlyServer() === true);
-    if (!authHeader) {
-        return null;
-    }
-    const token = extractBearerToken(authHeader);
-    if (!token) {
-        return null;
-    }
-    if (isBypassGatewayLocalOnly) {
-        if (token !== BYPASS_GATEWAY_LOCAL_ONLY_TOKEN) {
-            return null;
-        }
-        if (!expectedOrganizationId) {
-            console.error(JSON.stringify({
-                message: "BYPASS_GATEWAY_LOCAL_ONLY requires EVERY_APP_ORG_ID to be set.",
-                audience: authConfig.audience,
-                appTenancyMode,
-            }));
-            return null;
-        }
-        const session = createBypassGatewayLocalOnlySessionPayload(authConfig.audience, expectedOrganizationId);
-        if (!validateOrganizationBinding({
-            session,
-            source: "bypass",
-            audience: authConfig.audience,
-            expectedOrganizationId,
-            appTenancyMode,
-        })) {
-            return null;
-        }
-        return session;
-    }
-    try {
-        const session = await verifySessionToken(token, authConfig);
-        if (!validateOrganizationBinding({
-            session,
-            source: "session",
-            audience: authConfig.audience,
-            expectedOrganizationId,
-            appTenancyMode,
-        })) {
-            return null;
-        }
-        return session;
-    }
-    catch (error) {
-        const isProd = import.meta.env.PROD === true;
-        console.error(JSON.stringify({
-            message: "Error verifying session token",
-            error: error instanceof Error ? error.message : String(error),
-            stack: isProd === true
-                ? undefined
-                : error instanceof Error
-                    ? error.stack
-                    : undefined,
-            errorType: error instanceof Error ? error.constructor.name : "Unknown",
-            issuer: authConfig.issuer,
-            audience: authConfig.audience,
-            expectedOrganizationId,
-            appTenancyMode,
-        }));
-        return null;
-    }
-}
-function getAppTenancyMode() {
-    const mode = getOptionalEnvValue("APP_TENANCY_MODE")?.toLowerCase();
-    return mode === "multi" ? "multi" : "single";
-}
-async function verifySessionToken(token, config) {
-    const { issuer, audience } = config;
-    if (!issuer) {
-        throw new Error("Issuer must be provided for token verification");
-    }
-    if (!audience) {
-        throw new Error("Audience must be provided for token verification");
-    }
-    // Fetch JWKS - use service binding in production, direct fetch in development
-    const jwksResponse = import.meta.env.PROD && env.EVERY_APP_GATEWAY
-        ? await env.EVERY_APP_GATEWAY.fetch("http://localhost/api/embedded/jwks")
-        : await fetch(`${env.GATEWAY_URL}/api/embedded/jwks`);
-    if (!jwksResponse.ok) {
-        throw new Error(`Failed to fetch JWKS: ${jwksResponse.status} ${jwksResponse.statusText}`);
-    }
-    const jwks = (await jwksResponse.json());
-    const localJWKS = createLocalJWKSet(jwks);
-    const options = {
-        issuer,
-        audience,
-        algorithms: ["RS256"],
-    };
-    const { payload } = await jwtVerify(token, localJWKS, options);
-    return payload;
-}
-/**
- * Extracts the bearer token from an Authorization header.
- *
- * @param authHeader - The Authorization header value (e.g., "Bearer eyJ...")
- * @returns The token string if valid, null otherwise
- */
-export function extractBearerToken(authHeader) {
-    if (!authHeader || !authHeader.startsWith("Bearer ")) {
-        return null;
-    }
-    return authHeader.substring(7);
-}
-function getOptionalEnvValue(key) {
-    const value = env[key];
-    const trimmed = value?.trim();
-    return trimmed || null;
-}
-function validateOrganizationBinding({ session, source, audience, expectedOrganizationId, appTenancyMode, }) {
-    if (!session.orgId) {
-        console.error(JSON.stringify({
-            message: source === "bypass"
-                ? "Bypass mode requires organization claim"
-                : "Session token is missing orgId. SDK v0.2.0 requires org-bound session tokens. Redeploy the app with EVERY_APP_ORG_ID configured and request a fresh session token.",
-            audience,
-            appTenancyMode,
-        }));
-        return false;
-    }
-    if (appTenancyMode === "single" && !expectedOrganizationId) {
-        console.error(JSON.stringify({
-            message: "EVERY_APP_ORG_ID is required when APP_TENANCY_MODE=single. Configure EVERY_APP_ORG_ID in worker secrets (for example via `every app deploy`) and retry.",
-            audience,
-            appTenancyMode,
-        }));
-        return false;
-    }
-    if (appTenancyMode === "single" && session.orgId !== expectedOrganizationId) {
-        console.error(JSON.stringify({
-            message: source === "bypass"
-                ? "Bypass mode organization mismatch"
-                : "Session token organization mismatch",
-            tokenOrgId: session.orgId,
-            expectedOrganizationId,
-            audience,
-            appTenancyMode,
-        }));
-        return false;
-    }
-    return true;
-}

package/dist/tanstack/server/index.d.ts

@@ -1,4 +0,0 @@
-export { authenticateRequest } from "./authenticateRequest.js";
-export type { AuthConfig } from "./types.js";
-export { getAuthConfig } from "./authConfig.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/tanstack/server/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tanstack/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/tanstack/server/index.js

@@ -1,2 +0,0 @@
-export { authenticateRequest } from "./authenticateRequest.js";
-export { getAuthConfig } from "./authConfig.js";

package/dist/tanstack/server/types.d.ts

@@ -1,5 +0,0 @@
-export interface AuthConfig {
-    issuer: string;
-    audience: string;
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/tanstack/server/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/tanstack/server/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB"}

package/dist/tanstack/server/types.js

@@ -1 +0,0 @@
-export {};

package/dist/tanstack/useEveryAppRouter.d.ts

@@ -1,7 +0,0 @@
-import { SessionManager } from "../core/sessionManager.js";
-interface UseEveryAppRouterParams {
-    sessionManager: SessionManager | null;
-}
-export declare function useEveryAppRouter({ sessionManager }: UseEveryAppRouterParams): void;
-export {};
-//# sourceMappingURL=useEveryAppRouter.d.ts.map

package/dist/tanstack/useEveryAppRouter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"useEveryAppRouter.d.ts","sourceRoot":"","sources":["../../src/tanstack/useEveryAppRouter.tsx"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAI3D,UAAU,uBAAuB;IAC/B,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;CACvC;AAED,wBAAgB,iBAAiB,CAAC,EAAE,cAAc,EAAE,EAAE,uBAAuB,QAyE5E"}