@geekapps/auth-nextjs 0.14.0 → 0.15.0

package/dist/actions.d.ts

@@ -0,0 +1,15 @@
+import { ConnectedAccount, User, Organization } from './client.js';
+import 'react';
+
+declare function getMe(): Promise<{
+    user: User | null;
+}>;
+declare function getAccounts(): Promise<{
+    accounts: ConnectedAccount[];
+}>;
+declare function getOrganizations(): Promise<{
+    organizations: Organization[];
+    currentOrgId?: string | null;
+}>;
+
+export { getAccounts, getMe, getOrganizations };

package/dist/client.d.ts

@@ -0,0 +1,610 @@
+import { MouseEvent, ReactNode, ReactElement } from 'react';
+
+/**
+ * A sessão não vale mais: expirou ou foi revogada. O estado local já foi
+ * limpo quando este erro é lançado — o tratamento normal é levar ao login.
+ */
+declare class GeekappsSessionExpiredError extends Error {
+    readonly code: "session_expired";
+    constructor(message?: string);
+}
+type UserStatus = "active" | "inactive" | "suspended";
+type OrganizationStatus = "active" | "inactive" | "suspended";
+type OAuthClientType = "public" | "confidential";
+type AuthResult<T = unknown> = {
+    success: true;
+    data: T;
+} | {
+    success: false;
+    error: string;
+    status?: number;
+};
+type User = {
+    id: string;
+    email: string;
+    name: string | null;
+    phone: string | null;
+    imageUrl: string | null;
+    status?: UserStatus;
+    createdAt?: string | Date;
+    updatedAt?: string | Date;
+};
+type ConnectedAccount = {
+    id: string;
+    sessionId?: string;
+    isActive: boolean;
+    user: User;
+};
+type Permission = {
+    id: string;
+    applicationId?: string | null;
+    key: string;
+    name: string;
+    description: string | null;
+    category: string | null;
+    isSystem: boolean;
+    isActive: boolean;
+    createdAt?: string | Date;
+    updatedAt?: string | Date;
+};
+type RolePermission = {
+    permissionDefinition: Permission;
+};
+type Role = {
+    id: string;
+    applicationId?: string | null;
+    /** Present only on custom roles */
+    organizationId?: string | null;
+    /** "system" | "custom" */
+    type?: string;
+    key: string;
+    name: string;
+    description: string | null;
+    isSystem?: boolean;
+    isDefault?: boolean;
+    isActive: boolean;
+    permissions: RolePermission[];
+    createdAt?: string | Date;
+    updatedAt?: string | Date;
+};
+type RoleAssignment = {
+    id: string;
+    roleDefinitionId?: string | null;
+    customRoleId?: string | null;
+    roleDefinition?: Role | null;
+    customRole?: Role | null;
+};
+type OrganizationMember = {
+    id: string;
+    organizationId?: string;
+    userId?: string;
+    createdAt?: string | Date;
+    user: User;
+    roleAssignments?: RoleAssignment[];
+};
+type OrganizationInvite = {
+    id: string;
+    organizationId: string;
+    email: string;
+    /**
+     * Role que o convidado assume ao aceitar. Vem aninhada do auth-server (não
+     * como roleId solto) — null quando o convite não fixa nenhuma e o membro
+     * cai na role default da organização.
+     */
+    role: {
+        id: string;
+        key: string;
+        name: string;
+    } | null;
+    /** @deprecated use `role.id` — o auth-server não devolve este campo. */
+    roleId?: string | null;
+    status: "pending" | "accepted" | "expired" | "revoked";
+    expiresAt: string | Date;
+    acceptedAt?: string | Date | null;
+    createdAt?: string | Date;
+    redirectUri?: string | null;
+    emailTitle?: string | null;
+    emailSubtitle?: string | null;
+    emailMessage?: string | null;
+};
+type MemberInviteInput = {
+    email: string;
+    roleId?: string;
+    /**
+     * URI pra onde o link do e-mail manda o usuário — precisa estar cadastrada
+     * em Application.redirectUris (mesma validação do /authorize). Este app
+     * deve expor uma rota nessa URI que trata o `?invite_token=` anexado (ver
+     * useJoinRequests/inviteApi.preview|accept|reject abaixo).
+     */
+    redirectUri: string;
+    emailTitle?: string;
+    emailSubtitle?: string;
+    emailMessage?: string;
+};
+type AddMemberInput = {
+    userId: string;
+    roleId?: string;
+};
+type UpdateMemberInput = {
+    status?: "active" | "inactive" | "suspended";
+    roleId?: string | null;
+};
+/** @deprecated use UpdateMemberInput */
+type UpdateMemberRoleInput = {
+    roleId: string;
+};
+type PublicOrganization = {
+    id: string;
+    name: string;
+    slug: string;
+    description: string | null;
+    imageUrl: string | null;
+    createdAt: string | Date;
+};
+type OrganizationInvitePreview = {
+    alreadyAccepted: true;
+    organizationId: string;
+    organizationName: string;
+    applicationName: string;
+    applicationImageUrl: string | null;
+    applicationImageFileId: string | null;
+    organizationImageUrl: string | null;
+    organizationImageFileId: string | null;
+    websiteUrl: string | null;
+} | {
+    alreadyAccepted?: false;
+    email: string;
+    organizationId: string;
+    organizationName: string;
+    applicationName: string;
+    applicationId: string;
+    applicationImageUrl: string | null;
+    applicationImageFileId: string | null;
+    organizationImageUrl: string | null;
+    organizationImageFileId: string | null;
+    websiteUrl: string | null;
+    redirectUri: string | null;
+    appStoreUrl: string | null;
+    playStoreUrl: string | null;
+    currentAccount: {
+        email: string;
+        name: string | null;
+    } | null;
+};
+type AcceptInviteResult = {
+    success: true;
+    organizationId: string;
+    organizationName: string;
+    websiteUrl: string | null;
+} | {
+    success: false;
+    wrongAccount: true;
+    currentEmail: string;
+    invitedEmail: string;
+} | {
+    success: false;
+    wrongAccount: false;
+    loginRequired: true;
+} | {
+    success: false;
+    wrongAccount: false;
+    loginRequired: false;
+    error: string;
+};
+type JoinRequestStatus = "pending" | "approved" | "rejected" | "cancelled";
+type OrganizationJoinRequest = {
+    id: string;
+    organizationId: string;
+    userId: string;
+    status: JoinRequestStatus;
+    message: string | null;
+    reviewedByUserId: string | null;
+    reviewedAt: string | null;
+    createdAt: string | Date;
+    updatedAt: string | Date;
+};
+type OrganizationOwnedApplication = {
+    id: string;
+    name: string;
+    description: string | null;
+    imageUrl: string | null;
+    type?: OAuthClientType;
+    organizationId: string;
+    isFirstParty: boolean;
+    ssoEnabled: boolean;
+    status?: "active" | "inactive" | "suspended";
+    createdAt?: string | Date;
+    updatedAt?: string | Date;
+};
+type Organization = {
+    id: string;
+    name: string;
+    description: string | null;
+    slug: string;
+    domain: string | null;
+    imageUrl: string | null;
+    faviconUrl: string | null;
+    status: OrganizationStatus;
+    /** "private" (padrão) nunca sai em listPublicOrganizations(); "public" sai, e aceita join requests. */
+    visibility?: "public" | "private";
+    members?: OrganizationMember[];
+    ownedApplications?: OrganizationOwnedApplication[];
+    applicationLinks?: Array<{
+        id: string;
+        status: OrganizationStatus;
+        createdAt?: string | Date;
+        application: OrganizationOwnedApplication;
+    }>;
+    createdAt: string | Date;
+    updatedAt: string | Date;
+};
+type SessionApplication = {
+    id: string;
+    createdAt: string | Date;
+    expiresAt: string | Date;
+    application: {
+        id: string;
+        name: string;
+        organizationId: string;
+    };
+};
+type UserSession = {
+    id: string;
+    userId: string;
+    organizationId: string | null;
+    deviceAgent: string | null;
+    deviceId: string | null;
+    deviceName: string | null;
+    ip: string | null;
+    authState?: unknown;
+    authTime?: string | Date;
+    expiresAt: string | Date;
+    createdAt: string | Date;
+    updatedAt: string | Date;
+    user?: User;
+    applicationSessions?: SessionApplication[];
+};
+type UserInput = {
+    name?: string | null;
+    email?: string;
+    phone?: string | null;
+    imageUrl?: string | null;
+    password?: string;
+    organizationId?: string | null;
+    status?: UserStatus;
+};
+type OrganizationInput = {
+    name: string;
+    description?: string | null;
+    slug: string;
+    domain?: string | null;
+    imageUrl?: string | null;
+    faviconUrl?: string | null;
+};
+type OrganizationUpdateInput = Partial<OrganizationInput> & {
+    status?: OrganizationStatus;
+};
+type RoleInput = {
+    /** Opcional: sem ele, usa a organização ativa. */
+    organizationId?: string;
+    applicationId?: string | null;
+    key: string;
+    name: string;
+    description?: string | null;
+    permissionDefinitionIds?: string[];
+};
+type RoleUpdateInput = {
+    name?: string;
+    description?: string | null;
+    isActive?: boolean;
+    permissionDefinitionIds?: string[];
+};
+type PermissionInput = {
+    applicationId?: string | null;
+    key: string;
+    name: string;
+    description?: string | null;
+    category?: string | null;
+};
+type PermissionUpdateInput = {
+    name?: string;
+    description?: string | null;
+    category?: string | null;
+    isActive?: boolean;
+};
+/**
+ * OIDC `prompt` values understood by the Geekapps Auth Server. These control
+ * whether — and how — the IDP shows UI during `signIn()`/`signUp()`/`addAccount()`.
+ *
+ * - `"login"` — Forces the login screen, even if the user already has an active
+ *   session. Use this for a fresh login, unrelated to whatever session already
+ *   exists (equivalent to the old `silentLogin: false`).
+ * - `"select_account"` — Shows the account picker so the user can choose among
+ *   their connected accounts, or add a new one. Use this when you want to let
+ *   the user switch accounts explicitly.
+ * - `"none"` — Never shows any UI. The IDP authenticates silently if there is
+ *   exactly one active session (and no other interaction — like consent or a
+ *   security check — is pending); otherwise it fails immediately with an OIDC
+ *   error (`login_required`, `account_selection_required`, `consent_required`,
+ *   or `interaction_required`) instead of prompting the user. Use this for
+ *   silent-auth checks (e.g. "is the user still logged in?") where you don't
+ *   want to interrupt them with a screen.
+ * - `"consent"` — Forces the consent screen even if the user already granted
+ *   the requested scopes before.
+ *
+ * Omitting `prompt` entirely runs the IDP's default flow: reuse a single
+ * existing session silently, ask the user to pick when there are multiple
+ * connected accounts, or show the login screen when there's none.
+ */
+type OidcPrompt = "login" | "select_account" | "none" | "consent";
+type SignInOptions = {
+    redirectTo?: string;
+    authorizationFlowId?: string;
+    /**
+     * Controls whether the IDP shows UI, and which screen, during sign-in. See
+     * {@link OidcPrompt} for what each value does. Omit it to run the default flow.
+     */
+    prompt?: OidcPrompt;
+    /**
+     * @deprecated Use `prompt: "login"` instead. Kept for backwards compatibility —
+     * `silentLogin: false` is equivalent to `prompt: "login"`.
+     */
+    silentLogin?: boolean;
+};
+type SignInInput = SignInOptions | MouseEvent<HTMLElement>;
+type CallbackUrlOptions = SignInOptions & {
+    callbackUrl?: string;
+};
+type PermissionCheckOptions = {
+    permission: string;
+    organizationId?: string | null;
+    applicationId?: string | null;
+    resourceId?: string | null;
+};
+type LoginResponse = {
+    user: User;
+    redirectTo?: string | null;
+};
+type RegisterResponse = User;
+type GeekappsAuthProviderProps = {
+    children: ReactNode;
+    basePath?: string;
+    initialUser?: User | null;
+    initialOrganizations?: Organization[];
+    initialCurrentOrgId?: string | null;
+};
+type RequestOptions = {
+    body?: unknown;
+    method?: "GET" | "POST" | "PATCH" | "DELETE";
+};
+type ClientActionOptions = {
+    basePath?: string;
+};
+declare function loginWithPassword(params: {
+    identifier?: string;
+    email?: string;
+    phone?: string;
+    password: string;
+    authorizationFlowId?: string;
+    redirectTo?: string;
+}, options?: ClientActionOptions): Promise<AuthResult<LoginResponse>>;
+declare function registerWithPassword(params: {
+    name: string;
+    email: string;
+    phone?: string;
+    imageUrl?: string;
+    address?: Record<string, unknown>;
+    password: string;
+    redirectTo?: string;
+}, options?: ClientActionOptions): Promise<AuthResult<RegisterResponse>>;
+declare function startGoogleLogin(params?: CallbackUrlOptions, options?: ClientActionOptions): void;
+declare function requestPasswordlessLink(params: {
+    email: string;
+    authorizationFlowId?: string;
+    redirectTo?: string;
+    callbackUrl?: string;
+}, options?: ClientActionOptions): Promise<AuthResult>;
+type GeekappsAuthContextValue = {
+    basePath: string;
+    user: User | null;
+    isAuthenticated: boolean;
+    isLoading: boolean;
+    accounts: ConnectedAccount[];
+    isLoadingAccounts: boolean;
+    organizations: Organization[];
+    currentOrg: Organization | null;
+    currentOrgId: string | null;
+    isLoadingOrganizations: boolean;
+    request: <T>(path: string, options?: RequestOptions) => Promise<T>;
+    signIn: (options?: SignInInput) => Promise<void>;
+    signUp: (options?: SignInInput) => Promise<void>;
+    addAccount: (options?: SignInInput) => Promise<void>;
+    signOut: () => Promise<void>;
+    signOutAll: () => Promise<void>;
+    refreshUser: () => Promise<void>;
+    refreshAccounts: () => Promise<void>;
+    switchAccount: (sessionId: string, options?: SignInOptions) => Promise<void>;
+    loginWithPassword: (params: {
+        identifier?: string;
+        email?: string;
+        phone?: string;
+        password: string;
+        authorizationFlowId?: string;
+        redirectTo?: string;
+    }) => Promise<AuthResult<LoginResponse>>;
+    registerWithPassword: (params: {
+        name: string;
+        email: string;
+        phone?: string;
+        imageUrl?: string;
+        address?: Record<string, unknown>;
+        password: string;
+        redirectTo?: string;
+    }) => Promise<AuthResult<RegisterResponse>>;
+    startGoogleLogin: (params?: CallbackUrlOptions) => void;
+    requestPasswordlessLink: (params: {
+        email: string;
+        authorizationFlowId?: string;
+        redirectTo?: string;
+        callbackUrl?: string;
+    }) => Promise<AuthResult>;
+    refreshOrganizations: () => Promise<void>;
+    setCurrentOrg: (organizationId: string | null) => Promise<void>;
+    createOrganization: (input: OrganizationInput) => Promise<AuthResult<Organization>>;
+    updateOrganization: (id: string, input: OrganizationUpdateInput) => Promise<AuthResult<Organization>>;
+    deleteOrganization: (id: string) => Promise<AuthResult<null>>;
+    hasPermission: (options: PermissionCheckOptions) => Promise<boolean>;
+    /** Organizações públicas e ativas deste app — nunca inclui privadas, não exige membership. Separado de `organizations` (só as do próprio usuário). */
+    listPublicOrganizations: () => Promise<PublicOrganization[]>;
+    requestToJoin: (organizationId: string, input?: {
+        message?: string | null;
+    }) => Promise<AuthResult<OrganizationJoinRequest>>;
+    getMyJoinRequest: (organizationId: string) => Promise<OrganizationJoinRequest | null>;
+    cancelJoinRequest: (organizationId: string) => Promise<AuthResult<null>>;
+    listJoinRequests: (organizationId: string) => Promise<OrganizationJoinRequest[]>;
+    approveJoinRequest: (organizationId: string, requestId: string) => Promise<AuthResult<OrganizationJoinRequest>>;
+    rejectJoinRequest: (organizationId: string, requestId: string) => Promise<AuthResult<OrganizationJoinRequest>>;
+    /** Preview do convite por token — funciona com ou sem sessão (currentAccount vem null se deslogado). */
+    getInvitePreview: (token: string) => Promise<OrganizationInvitePreview>;
+    /** Aceita o convite. loginRequired:true significa que signIn() precisa rodar antes. */
+    acceptInvite: (token: string) => Promise<AcceptInviteResult>;
+    /** Recusa o convite — não exige estar logado. */
+    rejectInvite: (token: string) => Promise<{
+        success: true;
+    } | {
+        success: false;
+        error: string;
+    }>;
+    listUsers: (params?: {
+        organizationId?: string | null;
+    }) => Promise<User[]>;
+    getUser: (id: string) => Promise<User>;
+    createUser: (input: UserInput) => Promise<AuthResult<User>>;
+    updateUser: (id: string, input: UserInput) => Promise<AuthResult<User>>;
+    deleteUser: (id: string) => Promise<AuthResult<null>>;
+    /**
+     * Roles da organização. `organizationId` é opcional: sem ele, usa a
+     * organização ativa. `applicationId`/`type` são aceitos por
+     * compatibilidade e não filtram nada — a separação system/custom vem no
+     * próprio retorno.
+     */
+    listRoles: (params?: {
+        organizationId?: string;
+        applicationId?: string;
+        type?: "system" | "custom" | "all";
+    }) => Promise<{
+        systemRoles: Role[];
+        customRoles: Role[];
+    }>;
+    getRole: (id: string, type?: "system" | "custom", organizationId?: string) => Promise<Role>;
+    createRole: (input: RoleInput) => Promise<AuthResult<Role>>;
+    updateRole: (id: string, input: RoleUpdateInput, organizationId?: string) => Promise<AuthResult<Role>>;
+    deleteRole: (id: string, organizationId?: string) => Promise<AuthResult<null>>;
+    listPermissions: (params?: {
+        applicationId?: string;
+        roleId?: string | null;
+    }) => Promise<Permission[]>;
+    createPermission: (input: PermissionInput) => Promise<AuthResult<Permission>>;
+    updatePermission: (id: string, input: PermissionUpdateInput) => Promise<AuthResult<Permission>>;
+    deletePermission: (id: string) => Promise<AuthResult<null>>;
+    listUserSessions: (params?: {
+        userId?: string;
+        organizationId?: string | null;
+    }) => Promise<UserSession[]>;
+    revokeUserSession: (sessionId: string) => Promise<AuthResult<null>>;
+    listMembers: (organizationId: string) => Promise<OrganizationMember[]>;
+    getMember: (organizationId: string, memberId: string) => Promise<OrganizationMember>;
+    addMember: (organizationId: string, input: AddMemberInput) => Promise<AuthResult<OrganizationMember>>;
+    updateMember: (organizationId: string, memberId: string, input: UpdateMemberInput) => Promise<AuthResult<OrganizationMember>>;
+    /** @deprecated use updateMember */
+    updateMemberRole: (organizationId: string, memberId: string, input: UpdateMemberRoleInput) => Promise<AuthResult<OrganizationMember>>;
+    removeMember: (organizationId: string, memberId: string) => Promise<AuthResult<null>>;
+    inviteMember: (organizationId: string, input: MemberInviteInput) => Promise<AuthResult<OrganizationInvite>>;
+    listInvites: (organizationId: string) => Promise<OrganizationInvite[]>;
+    revokeInvite: (organizationId: string, inviteId: string) => Promise<AuthResult<null>>;
+};
+type UseOrgResult = Pick<GeekappsAuthContextValue, "organizations" | "currentOrg" | "currentOrgId" | "isLoadingOrganizations" | "refreshOrganizations" | "setCurrentOrg" | "createOrganization" | "updateOrganization" | "deleteOrganization" | "hasPermission">;
+type UseAccountsResult = Pick<GeekappsAuthContextValue, "accounts" | "addAccount" | "isLoadingAccounts" | "refreshAccounts" | "switchAccount">;
+type UseUsersResult = Pick<GeekappsAuthContextValue, "listUsers" | "getUser" | "createUser" | "updateUser" | "deleteUser">;
+type UseRolesResult = Pick<GeekappsAuthContextValue, "listRoles" | "getRole" | "createRole" | "updateRole" | "deleteRole">;
+type UsePermissionsResult = Pick<GeekappsAuthContextValue, "listPermissions" | "createPermission" | "updatePermission" | "deletePermission">;
+type UseSessionsResult = Pick<GeekappsAuthContextValue, "listUserSessions" | "revokeUserSession">;
+type UseMembersResult = Pick<GeekappsAuthContextValue, "listMembers" | "getMember" | "addMember" | "updateMember" | "updateMemberRole" | "removeMember" | "inviteMember" | "listInvites" | "revokeInvite">;
+type UsePublicOrganizationsResult = Pick<GeekappsAuthContextValue, "listPublicOrganizations">;
+type UseJoinRequestsResult = Pick<GeekappsAuthContextValue, "requestToJoin" | "getMyJoinRequest" | "cancelJoinRequest" | "listJoinRequests" | "approveJoinRequest" | "rejectJoinRequest">;
+type UseInvitesResult = Pick<GeekappsAuthContextValue, "getInvitePreview" | "acceptInvite" | "rejectInvite">;
+declare function GeekappsAuthProvider({ children, basePath, initialUser, initialOrganizations, initialCurrentOrgId, }: GeekappsAuthProviderProps): ReactElement;
+declare function useAuth(): GeekappsAuthContextValue;
+declare function useOrg(): UseOrgResult;
+declare function useAccounts(): UseAccountsResult;
+declare function useUsers(): UseUsersResult;
+declare function useRoles(): UseRolesResult;
+declare function usePermissions(): UsePermissionsResult;
+declare function useSessions(): UseSessionsResult;
+declare function useMembers(): UseMembersResult;
+/**
+ * Descoberta de organizações PÚBLICAS do app — bem separado de `useOrg()`,
+ * que lida com as organizações do próprio usuário (as que ele já é
+ * membro/dono). `usePublicOrganizations()` nunca retorna organizações
+ * privadas, e não exige que o usuário já pertença a elas.
+ */
+declare function usePublicOrganizations(): UsePublicOrganizationsResult;
+/**
+ * Solicitações de entrada em organizações públicas: um usuário pede pra
+ * entrar (requestToJoin) e um admin da organização aprova/rejeita
+ * (approveJoinRequest/rejectJoinRequest, exigem permissão org:members:add).
+ */
+declare function useJoinRequests(): UseJoinRequestsResult;
+/**
+ * Aceite/recusa de convite por email — chamadas a partir do ?invite_token=
+ * que este app recebe na sua própria redirectUri (a que foi passada em
+ * useMembers().inviteMember). getInvitePreview funciona sem sessão
+ * (currentAccount vem null); rejectInvite não exige login; acceptInvite
+ * retorna loginRequired:true se não houver sessão.
+ */
+declare function useInvites(): UseInvitesResult;
+type ServiceAccount = {
+    id: string;
+    membershipId: string;
+    organizationId: string;
+    applicationId: string | null;
+    name: string;
+    status: "active" | "inactive" | "suspended";
+    serviceId: string | null;
+    roleAssignment: {
+        role: {
+            id: string;
+            key: string;
+            name: string;
+        };
+    } | null;
+    createdAt: string;
+    updatedAt: string;
+};
+type ServiceAccountWithSecret = ServiceAccount & {
+    serviceSecret: string;
+};
+type CreateServiceAccountInput = {
+    organizationId: string;
+    applicationId?: string;
+    name: string;
+    description?: string;
+    roleId?: string;
+};
+type UseServiceAccountResult = {
+    listServiceAccounts: (params: {
+        organizationId: string;
+        applicationId?: string;
+    }) => Promise<ServiceAccount[]>;
+    createServiceAccount: (input: CreateServiceAccountInput) => Promise<ServiceAccountWithSecret>;
+    updateServiceAccountRole: (id: string, roleId: string | null) => Promise<void>;
+    revokeServiceAccount: (id: string) => Promise<void>;
+    rotateServiceAccountSecret: (id: string) => Promise<{
+        serviceId: string;
+        serviceSecret: string;
+    }>;
+    deleteServiceAccount: (id: string) => Promise<void>;
+};
+declare function useServiceAccount(): UseServiceAccountResult;
+
+export { type AcceptInviteResult, type AddMemberInput, type AuthResult, type CallbackUrlOptions, type ConnectedAccount, type CreateServiceAccountInput, type GeekappsAuthContextValue, GeekappsAuthProvider, type GeekappsAuthProviderProps, GeekappsSessionExpiredError, type JoinRequestStatus, type LoginResponse, type MemberInviteInput, type OAuthClientType, type OidcPrompt, type Organization, type OrganizationInput, type OrganizationInvite, type OrganizationInvitePreview, type OrganizationJoinRequest, type OrganizationMember, type OrganizationOwnedApplication, type OrganizationStatus, type OrganizationUpdateInput, type Permission, type PermissionCheckOptions, type PermissionInput, type PermissionUpdateInput, type PublicOrganization, type RegisterResponse, type Role, type RoleAssignment, type RoleInput, type RolePermission, type RoleUpdateInput, type ServiceAccount, type ServiceAccountWithSecret, type SessionApplication, type SignInInput, type SignInOptions, type UpdateMemberInput, type UpdateMemberRoleInput, type UseAccountsResult, type UseInvitesResult, type UseJoinRequestsResult, type UseMembersResult, type UseOrgResult, type UsePermissionsResult, type UsePublicOrganizationsResult, type UseRolesResult, type UseServiceAccountResult, type UseSessionsResult, type UseUsersResult, type User, type UserInput, type UserSession, type UserStatus, loginWithPassword, registerWithPassword, requestPasswordlessLink, startGoogleLogin, useAccounts, useAuth, useInvites, useJoinRequests, useMembers, useOrg, usePermissions, usePublicOrganizations, useRoles, useServiceAccount, useSessions, useUsers };

package/dist/connections.d.ts

@@ -0,0 +1,113 @@
+/**
+ * App Connections — chamar ações de negócio de OUTRA Application.
+ *
+ * Uma conexão liga um USUÁRIO desta app (X) a uma app alvo (Y). Ele a aprova
+ * uma vez no consent, escolhendo as ações liberadas e a organização dentro do
+ * Y sob a qual elas rodam. A chamada vai com o access token desse usuário (o
+ * da sessão, por padrão): é ele que diz ao proxy qual conexão usar.
+ *
+ * Nada aqui fala com a API do Y diretamente: tudo passa pelo proxy do
+ * auth-server, que valida a conexão e injeta a credencial. Esta app nunca vê
+ * essa credencial — é esse o ponto do proxy.
+ *
+ * O catálogo tipado (`GeekappsConnections`) vem do arquivo gerado por
+ * `npx geekapps-connections`.
+ */
+/** Opções por chamada. Sem `userToken`, usa o access token do usuário logado na sessão. */
+type ConnectionCallOptions = {
+    userToken?: string;
+};
+type AppConnectionsConfig = {
+    issuer?: string;
+    /** client_id/secret desta app (a consumidora, X). */
+    clientId?: string;
+    clientSecret?: string;
+};
+/**
+ * Preenchida por declaration merging no arquivo gerado
+ * (`geekapps-connections.d.ts`). Vazia aqui de propósito: o SDK não sabe
+ * quais apps existem — quem sabe é o auth-server, no momento da geração.
+ */
+interface GeekappsConnections {
+}
+/** Erro de uma chamada de proxy — carrega o status HTTP para dar pra tratar. */
+declare class AppConnectionError extends Error {
+    readonly status: number;
+    readonly code: string | undefined;
+    readonly body: unknown;
+    constructor(message: string, status: number, code: string | undefined, body: unknown);
+}
+/**
+ * A chamada crua do proxy, para quando não há catálogo gerado. `targetAppId` é
+ * o client_id da app alvo e `actionKey` é a AppAction.key — o mesmo valor que
+ * aparece como scope no consent.
+ */
+declare function callAppConnection<T = unknown>(params: {
+    targetAppId: string;
+    actionKey: string;
+    payload?: unknown;
+    /** Access token do usuário dono da conexão. Padrão: o do usuário logado. */
+    userToken?: string;
+    config?: AppConnectionsConfig;
+}): Promise<T>;
+type ConnectionRegistryEntry = {
+    appId: string;
+    actions: Record<string, string>;
+};
+/** Chamado por arquivos gerados no formato antigo. Não é necessário no fluxo automático. */
+declare function registerConnections(entries: Record<string, ConnectionRegistryEntry>): void;
+/**
+ * Sem tipos gerados (primeira execução), qualquer `app.ação` é aceita. Assim
+ * que o SDK escreve `geekapps-connections.d.ts`, a interface estendida passa a
+ * valer e o TypeScript confere payload e retorno.
+ */
+type AppConnectionsClient = keyof GeekappsConnections extends never ? Record<string, Record<string, (payload?: unknown, options?: ConnectionCallOptions) => Promise<unknown>>> : GeekappsConnections;
+/** Cliente com config explícita — para quem não usa as env vars padrão. */
+declare function createAppConnections(config?: AppConnectionsConfig): AppConnectionsClient;
+/** Catálogo explícito, como o gerado por `npx geekapps-connections` (`geekappsConnectionsCatalog`). */
+type ConnectionsCatalog = Record<string, {
+    readonly appId: string;
+    readonly actions: Readonly<Record<string, string>>;
+}>;
+/**
+ * Opcional: usa um catálogo fixo em vez de consultar o auth-server. Útil em
+ * testes ou quando a app não pode falar com o servidor em runtime.
+ *
+ *   const connections = defineAppConnections<GeekappsConnections>(geekappsConnectionsCatalog);
+ */
+declare function defineAppConnections<T>(catalog: ConnectionsCatalog, config?: AppConnectionsConfig): T;
+/** Cliente padrão, lendo GEEKAPPS_AUTH_CLIENT_ID / _SECRET do ambiente. */
+declare const appConnections: AppConnectionsClient;
+type ConnectAppParams = {
+    /** client_id da app ALVO (a que expõe as ações). */
+    targetAppId: string;
+    /** AppAction.key das ações pedidas — as mesmas que aparecem no consent. */
+    actions: string[];
+    /** URL desta app que recebe o retorno do consent (rota que chama `completeAppConnection`). Precisa estar nos redirect URIs desta app. */
+    redirectUri: string;
+    /** Para onde `completeAppConnection` manda o usuário depois (padrão "/"). */
+    returnTo?: string;
+    /** Nome desta app exibido no consent. */
+    displayName?: string;
+    config?: AppConnectionsConfig;
+};
+/**
+ * Inicia a conexão desta app com `targetAppId`: guarda PKCE/state em cookies
+ * httpOnly e redireciona para o consent. Chame de um Server Action ou Route
+ * Handler — não retorna (o `redirect` do Next interrompe a execução).
+ */
+declare function connectApp(params: ConnectAppParams): Promise<never>;
+/**
+ * Fecha o fluxo de `connectApp`. Chame no callback com o `code` e o `state`
+ * da query; devolve o `returnTo` para você redirecionar. Lança
+ * AppConnectionError se o state não bater ou o auth-server recusar.
+ */
+declare function completeAppConnection(params: {
+    code: string;
+    state: string;
+    config?: AppConnectionsConfig;
+}): Promise<{
+    returnTo: string;
+}>;
+
+export { AppConnectionError, type AppConnectionsClient, type AppConnectionsConfig, type ConnectAppParams, type ConnectionCallOptions, type ConnectionsCatalog, type GeekappsConnections, appConnections, callAppConnection, completeAppConnection, connectApp, createAppConnections, defineAppConnections, registerConnections };

package/dist/middleware.d.ts

@@ -0,0 +1,22 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+type AuthMiddlewareConfig = {
+    issuer?: string;
+    basePath?: string;
+    /**
+     * @deprecated cookiePrefix is now auto-derived from GEEKAPPS_AUTH_CLIENT_ID.
+     * This field is kept for backwards compatibility but is ignored.
+     */
+    cookiePrefix?: string;
+    secureCookies?: boolean;
+    /** Base URL of this app (e.g. "https://meuapp.com"). Overrides the GEEKAPPS_APP_URL env var. */
+    appUrl?: string;
+    /**
+     * When true, unauthenticated requests are redirected to sign-in.
+     * Defaults to false — the app controls its own auth-gating.
+     */
+    forceLoginOnUnauthenticated?: boolean;
+};
+declare function createAuthMiddleware(input?: AuthMiddlewareConfig): (request: NextRequest) => Promise<NextResponse>;
+
+export { type AuthMiddlewareConfig, createAuthMiddleware };

package/dist/server.d.ts

@@ -0,0 +1,138 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { JWTPayload } from 'jose';
+
+/**
+ * A sessão não vale mais: expirou, foi revogada no painel ou o refresh token
+ * foi invalidado. Os cookies já foram limpos quando este erro é lançado, então
+ * o tratamento normal é redirecionar para o login.
+ */
+declare class GeekappsSessionExpiredError extends Error {
+    readonly code: "session_expired";
+    constructor(message?: string);
+}
+/**
+ * Fixed URL of the Geekapps Auth Server (OIDC issuer + API). This never
+ * changes per-environment, so it is hardcoded rather than read from env.
+ */
+declare const GEEKAPPS_AUTH_SERVER_URL = "https://accounts-api.geekapps.com.br";
+type GeekappsAuthConfig = {
+    /**
+     * Auth Server (OIDC) issuer URL. Defaults to GEEKAPPS_AUTH_SERVER_URL and
+     * should not need overriding in normal use.
+     *
+     * Deprecated (still supported as a fallback): GEEKAPPS_AUTH_SERVER_ISSUER,
+     * GEEKAPPS_AUTH_ISSUER, GEEKAPPS_AUTH_SERVER_URL env, GEEKAPPS_AUTH_API_URL
+     */
+    issuer?: string;
+    /**
+     * OAuth client id. Optional when GEEKAPPS_AUTH_CLIENT_ID is defined.
+     */
+    clientId?: string;
+    /**
+     * OAuth client secret for confidential clients. Optional when
+     * GEEKAPPS_AUTH_CLIENT_SECRET is defined.
+     */
+    clientSecret?: string;
+    /**
+     * Callback URL. Optional when GEEKAPPS_AUTH_REDIRECT_URI is defined.
+     * If omitted, it is inferred from the current request origin + basePath/callback.
+     */
+    redirectUri?: string;
+    scopes?: string[];
+    basePath?: string;
+    /**
+     * @deprecated cookiePrefix is now auto-derived from clientId.
+     * This field is kept for backwards compatibility but is ignored.
+     */
+    cookiePrefix?: string;
+    secureCookies?: boolean;
+    /**
+     * Friendly alias used by apps. Same as afterSignInRedirectTo.
+     */
+    redirectTo?: string;
+    afterSignInRedirectTo?: string;
+    afterSignOutRedirectTo?: string;
+};
+type SessionTokens = {
+    accessToken: string | null;
+    refreshToken: string | null;
+    idToken: string | null;
+    sessionId: string | null;
+};
+type StoredAccount = {
+    /** Stable identifier — `sub` from id_token or fallback to sessionId. */
+    id: string;
+    accessToken: string;
+    refreshToken: string | null;
+    idToken: string | null;
+    sessionId: string | null;
+    user: {
+        sub: string;
+        name?: string | null;
+        email?: string | null;
+        picture?: string | null;
+        phone?: string | null;
+    };
+};
+type ServerAuthApiClient = {
+    get: <T>(path: string) => Promise<T>;
+    post: <T>(path: string, body?: unknown) => Promise<T>;
+    patch: <T>(path: string, body?: unknown) => Promise<T>;
+    put: <T>(path: string, body?: unknown) => Promise<T>;
+    delete: <T>(path: string) => Promise<T>;
+};
+type ServiceAccountConfig = {
+    issuer?: string;
+    clientId?: string;
+    clientSecret?: string;
+};
+/**
+ * Returns a service account access token.
+ * The issuer is always the Geekapps Auth Server (GEEKAPPS_AUTH_SERVER_URL) —
+ * it does not need to be configured. Reads GEEKAPPS_SERVICE_ACCOUNT_CLIENT_ID,
+ * GEEKAPPS_SERVICE_ACCOUNT_CLIENT_SECRET by default.
+ * Any field can be overridden via the optional config argument.
+ * Tokens are cached per client and auto-renewed before expiry (~7 min TTL).
+ */
+declare function getServiceAccountToken(override?: ServiceAccountConfig): Promise<string | null>;
+declare function verifyToken(token: string, issuer: string): Promise<JWTPayload | null>;
+declare function configureGeekappsAuth(input?: GeekappsAuthConfig): {
+    handlers: {
+        GET: (request: NextRequest) => Promise<NextResponse<any>>;
+        POST: (request: NextRequest) => Promise<NextResponse<any>>;
+        PATCH: (request: NextRequest) => Promise<NextResponse<any>>;
+        DELETE: (request: NextRequest) => Promise<NextResponse<any>>;
+    };
+    GetSession: () => Promise<SessionTokens | null>;
+    GetUser: () => Promise<StoredAccount["user"] | null>;
+    GetUserById: (userId: string, applicationId?: string) => Promise<unknown | null>;
+    GetOrganizations: () => Promise<{
+        organizations: unknown[];
+        currentOrgId: string | null;
+    }>;
+    SaveSession: (tokens: SessionTokens) => Promise<void>;
+    GetAccessToken: () => Promise<string | null>;
+    GetRefreshToken: () => Promise<string | null>;
+    IsAuthenticated: () => Promise<boolean>;
+    TryRefreshTokens: () => Promise<string | null>;
+    RequireUser: (options?: {
+        redirectTo?: string;
+    }) => Promise<string>;
+    CreateAuthApiClient: () => ServerAuthApiClient;
+    cookiePrefix: string;
+    VerifyToken: (token: string) => Promise<JWTPayload | null>;
+    SignInUrl: (redirectTo?: string) => Promise<string>;
+};
+declare function handlers(options?: GeekappsAuthConfig): {
+    GET: (request: NextRequest) => Promise<NextResponse<any>>;
+    POST: (request: NextRequest) => Promise<NextResponse<any>>;
+    PATCH: (request: NextRequest) => Promise<NextResponse<any>>;
+    DELETE: (request: NextRequest) => Promise<NextResponse<any>>;
+};
+/**
+ * Returns true if the current request has a valid access token in cookies.
+ * Safe to call in Server Components, Server Actions, and Route Handlers.
+ */
+declare function isAuthenticated(options?: GeekappsAuthConfig): Promise<boolean>;
+
+export { GEEKAPPS_AUTH_SERVER_URL, type GeekappsAuthConfig, GeekappsSessionExpiredError, type ServerAuthApiClient, type SessionTokens, type StoredAccount, configureGeekappsAuth, getServiceAccountToken, handlers, isAuthenticated, verifyToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geekapps/auth-nextjs",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "type": "module",
   "sideEffects": false,
   "types": "/dist",
@@ -31,7 +31,9 @@
     "README.md"
   ],
   "scripts": {
-    "build": "tsup"
+    "prebuild": "npm run build --prefix ../auth-cli",
+    "build": "tsup",
+    "prepublishOnly": "npm run build && node -e \"const fs=require('fs');const p=require('./package.json');const miss=Object.values(p.exports||{}).map(e=>e.types).filter(t=>t&&!fs.existsSync(t));if(miss.length){console.error('Faltam declaracoes:',miss.join(', '));process.exit(1)}\""
   },
   "dependencies": {
     "jose": "^6.2.3",