@geekapps/auth-nextjs 0.16.0 → 0.17.0

package/dist/connections.js

@@ -1,6 +1,5 @@
 // src/connections.ts
 import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
-import { buildModel, fetchRemoteCatalog, renderAugmentation, toRegistry } from "@geekapps/auth-cli/lib";
 import { cookies as cookies2 } from "next/headers";
 import { redirect as redirect2 } from "next/navigation";
 
@@ -10,794 +9,7 @@ import { cookies, headers } from "next/headers";
 import { redirect } from "next/navigation";
 import { NextResponse } from "next/server";
 import { createRemoteJWKSet, jwtVerify } from "jose";
-var GeekappsSessionExpiredError = class extends Error {
-  code = "session_expired";
-  constructor(message = "A sess\xE3o expirou ou foi revogada. Entre novamente.") {
-    super(message);
-    this.name = "GeekappsSessionExpiredError";
-  }
-};
 var GEEKAPPS_AUTH_SERVER_URL = "https://accounts-api.geekapps.com.br";
-var MAX_ACCOUNTS = 8;
-function normalizeBaseUrl(url) {
-  return url.replace(/\/$/, "");
-}
-function normalizeBasePath(path = "/api/auth") {
-  if (!path.startsWith("/")) return `/${path}`;
-  return path.replace(/\/$/, "");
-}
-function createUrl(baseUrl, path) {
-  if (/^https?:\/\//.test(path)) return path;
-  const normalizedPath = path.startsWith("/") ? path : `/${path}`;
-  return `${normalizeBaseUrl(baseUrl)}${normalizedPath}`;
-}
-function env(name) {
-  const value = process.env[name];
-  return value && value.trim().length > 0 ? value : void 0;
-}
-function resolveIssuer(input) {
-  return normalizeBaseUrl(
-    input.issuer ?? env("GEEKAPPS_AUTH_SERVER_ISSUER") ?? env("GEEKAPPS_AUTH_SERVER_URL") ?? // Deprecated: kept for backwards compatibility during the auth-server rename.
-    env("GEEKAPPS_AUTH_ISSUER") ?? env("GEEKAPPS_AUTH_API_URL") ?? GEEKAPPS_AUTH_SERVER_URL
-  );
-}
-function resolveClientId(input) {
-  return input.clientId ?? env("GEEKAPPS_AUTH_CLIENT_ID") ?? "";
-}
-function resolveClientSecret(input) {
-  return input.clientSecret ?? env("GEEKAPPS_AUTH_CLIENT_SECRET");
-}
-function applyClientCredentials(url, config) {
-  if (!config.clientId || !config.clientSecret) return;
-  url.searchParams.set("client_id", config.clientId);
-  url.searchParams.set("client_secret", config.clientSecret);
-}
-function resolveConfiguredRedirectUri(input) {
-  return input.redirectUri ?? env("GEEKAPPS_AUTH_REDIRECT_URI");
-}
-function hashClientId(clientId) {
-  let h = 5381;
-  for (let i = 0; i < clientId.length; i++) {
-    h = (h << 5) + h ^ clientId.charCodeAt(i) & 255;
-    h = h >>> 0;
-  }
-  return h.toString(16).padStart(8, "0");
-}
-function deriveCookiePrefix(clientId) {
-  if (!clientId) return "gk";
-  return `gk_${hashClientId(clientId)}`;
-}
-function requestOrigin(request) {
-  const configured = env("GEEKAPPS_APP_URL");
-  if (configured) return configured.replace(/\/$/, "");
-  if (request.nextUrl?.origin) return request.nextUrl.origin;
-  throw new Error(
-    "Cannot determine app origin. Set GEEKAPPS_APP_URL or ensure request.nextUrl is available."
-  );
-}
-function resolveRedirectUri(config, request) {
-  return config.redirectUri ?? `${requestOrigin(request)}${config.basePath}/callback`;
-}
-function tokenFromResponse(data) {
-  return {
-    accessToken: data.accessToken ?? data.access_token ?? data.tokens?.accessToken ?? data.tokens?.access_token ?? null,
-    refreshToken: data.refreshToken ?? data.refresh_token ?? data.tokens?.refreshToken ?? data.tokens?.refresh_token ?? null,
-    idToken: data.idToken ?? data.id_token ?? data.tokens?.idToken ?? data.tokens?.id_token ?? null,
-    sessionId: data.sessionId ?? data.session_id ?? data.tokens?.sessionId ?? data.tokens?.session_id ?? null
-  };
-}
-function decodeJwtPayload(token) {
-  try {
-    const parts = token.split(".");
-    if (parts.length < 2) return null;
-    const payload = parts[1];
-    if (!payload) return null;
-    return JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-  } catch {
-    return null;
-  }
-}
-function parseAccountFromJwt(tokens) {
-  if (!tokens.accessToken) return null;
-  const jwtToParse = tokens.idToken ?? tokens.accessToken;
-  const payload = decodeJwtPayload(jwtToParse);
-  if (!payload) return null;
-  const sub = typeof payload.sub === "string" ? payload.sub : null;
-  const id = sub ?? tokens.sessionId;
-  if (!id) return null;
-  return {
-    id,
-    accessToken: tokens.accessToken,
-    refreshToken: tokens.refreshToken,
-    idToken: tokens.idToken ?? null,
-    sessionId: tokens.sessionId,
-    user: {
-      sub: id,
-      name: typeof payload.name === "string" ? payload.name : null,
-      email: typeof payload.email === "string" ? payload.email : null,
-      picture: typeof payload.picture === "string" ? payload.picture : null,
-      phone: typeof payload.phone_number === "string" ? payload.phone_number : null
-    }
-  };
-}
-function getCookieNames(prefix) {
-  return {
-    active: `${prefix}_active`,
-    count: `${prefix}_count`,
-    activeOrganizationId: `${prefix}_ao`,
-    tokenPub: `${prefix}_tp`,
-    pkceVerifier: `${prefix}_pkce`,
-    slotMeta: (n) => `${prefix}_m${n}`,
-    slotAt: (n) => `${prefix}_at${n}`,
-    slotRt: (n) => `${prefix}_rt${n}`
-  };
-}
-function generateCodeVerifier() {
-  return randomBytes(64).toString("base64url");
-}
-function createCodeChallenge(codeVerifier) {
-  return createHash("sha256").update(codeVerifier).digest("base64url");
-}
-function encodeMeta(account) {
-  const m = { id: account.id };
-  if (account.sessionId) m.sid = account.sessionId;
-  if (account.user.name) m.n = account.user.name;
-  if (account.user.email) m.e = account.user.email;
-  if (account.user.picture) m.p = account.user.picture;
-  return Buffer.from(JSON.stringify(m), "utf8").toString("base64url");
-}
-function decodeMeta(value) {
-  try {
-    const m = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
-    return m.id ? m : null;
-  } catch {
-    return null;
-  }
-}
-function getCookieOptions(config) {
-  return {
-    httpOnly: true,
-    secure: config.secureCookies ?? process.env.NODE_ENV === "production",
-    sameSite: "lax",
-    path: "/"
-  };
-}
-async function readBody(request) {
-  const text = await request.text();
-  if (!text) return void 0;
-  try {
-    return JSON.parse(text);
-  } catch {
-    return text;
-  }
-}
-function appendSearchParams(url, request) {
-  const target = new URL(url);
-  request.nextUrl.searchParams.forEach((value, key) => {
-    target.searchParams.set(key, value);
-  });
-  return target.toString();
-}
-function routeFromRequest(request, basePath) {
-  const pathname = request.nextUrl.pathname;
-  if (!pathname.startsWith(basePath)) return pathname;
-  const route = pathname.slice(basePath.length);
-  return route || "/";
-}
-function isJsonResponse(response) {
-  return response.headers.get("content-type")?.includes("application/json");
-}
-async function responseFromApi(response) {
-  if (response.status === 204) return new NextResponse(null, { status: 204 });
-  const body = isJsonResponse(response) ? await response.json().catch(() => null) : await response.text();
-  return NextResponse.json(body, { status: response.status });
-}
-var _remoteJWKSCache = /* @__PURE__ */ new Map();
-function getRemoteJWKS(issuer) {
-  if (!_remoteJWKSCache.has(issuer)) {
-    _remoteJWKSCache.set(issuer, createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`)));
-  }
-  return _remoteJWKSCache.get(issuer);
-}
-async function verifyToken(token, issuer) {
-  try {
-    const { payload } = await jwtVerify(token, getRemoteJWKS(issuer), {
-      algorithms: ["RS256"],
-      issuer
-    });
-    return payload;
-  } catch {
-    return null;
-  }
-}
-function configureGeekappsAuth(input = {}) {
-  const clientId = resolveClientId(input);
-  const config = {
-    ...input,
-    issuer: resolveIssuer(input),
-    clientId,
-    clientSecret: resolveClientSecret(input),
-    redirectUri: resolveConfiguredRedirectUri(input),
-    afterSignInRedirectTo: input.afterSignInRedirectTo ?? input.redirectTo ?? "/",
-    basePath: normalizeBasePath(input.basePath),
-    cookiePrefix: deriveCookiePrefix(clientId)
-  };
-  const cn = getCookieNames(config.cookiePrefix);
-  async function getCount() {
-    const cookieStore = await cookies();
-    const raw = cookieStore.get(cn.count)?.value;
-    const n = raw ? Number.parseInt(raw, 10) : 0;
-    return Number.isNaN(n) ? 0 : n;
-  }
-  async function getActiveIndex() {
-    const cookieStore = await cookies();
-    const raw = cookieStore.get(cn.active)?.value;
-    if (!raw) return 0;
-    const n = Number.parseInt(raw, 10);
-    return Number.isNaN(n) ? 0 : n;
-  }
-  function readSlot(cookieStore, n) {
-    const at = cookieStore.get(cn.slotAt(n))?.value;
-    if (!at) return null;
-    const meta = decodeMeta(cookieStore.get(cn.slotMeta(n))?.value ?? "");
-    if (!meta) return null;
-    return {
-      id: meta.id,
-      accessToken: at,
-      refreshToken: cookieStore.get(cn.slotRt(n))?.value ?? null,
-      idToken: null,
-      // not stored in cookies; claims are in meta
-      sessionId: meta.sid ?? null,
-      user: {
-        sub: meta.id,
-        name: meta.n ?? null,
-        email: meta.e ?? null,
-        picture: meta.p ?? null
-      }
-    };
-  }
-  function writeSlot(cookieStore, n, account) {
-    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };
-    cookieStore.set(cn.slotMeta(n), encodeMeta(account), opts);
-    cookieStore.set(cn.slotAt(n), account.accessToken, opts);
-    if (account.refreshToken) cookieStore.set(cn.slotRt(n), account.refreshToken, opts);
-  }
-  function clearSlot(cookieStore, n) {
-    const clear = { ...getCookieOptions(config), maxAge: 0 };
-    cookieStore.set(cn.slotMeta(n), "", clear);
-    cookieStore.set(cn.slotAt(n), "", clear);
-    cookieStore.set(cn.slotRt(n), "", clear);
-  }
-  async function getAccountsList() {
-    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);
-    const accounts = [];
-    for (let i = 1; i <= count; i++) {
-      const slot = readSlot(cookieStore, i);
-      if (slot) accounts.push(slot);
-    }
-    return accounts;
-  }
-  async function getActiveAccount() {
-    const [cookieStore, activeIdx, count] = await Promise.all([cookies(), getActiveIndex(), getCount()]);
-    if (count === 0) return null;
-    if (activeIdx >= 1 && activeIdx <= count) {
-      const slot = readSlot(cookieStore, activeIdx);
-      if (slot) return slot;
-    }
-    return readSlot(cookieStore, 1);
-  }
-  async function getAccessToken() {
-    try {
-      const hdrs = await headers();
-      const auth = hdrs.get("authorization");
-      if (auth?.startsWith("Bearer ")) return auth.slice(7);
-    } catch {
-    }
-    const active = await getActiveAccount();
-    return active?.accessToken ?? null;
-  }
-  async function getRefreshToken() {
-    const active = await getActiveAccount();
-    return active?.refreshToken ?? null;
-  }
-  async function getSession() {
-    const active = await getActiveAccount();
-    if (!active) return null;
-    return {
-      accessToken: active.accessToken,
-      refreshToken: active.refreshToken,
-      idToken: active.idToken,
-      sessionId: active.sessionId
-    };
-  }
-  async function getUser() {
-    const active = await getActiveAccount();
-    return active?.user ?? null;
-  }
-  async function getUserById(userId, applicationId) {
-    const qs = new URLSearchParams({ ...applicationId ? { applicationId } : {} });
-    try {
-      return await apiRequest(`/users/${userId}?${qs}`);
-    } catch {
-      return null;
-    }
-  }
-  async function getOrganizations() {
-    const cookieStore = await cookies();
-    const currentOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;
-    try {
-      const data = await apiRequest("/organizations");
-      const organizations = Array.isArray(data) ? data : data.organizations;
-      return { organizations, currentOrgId };
-    } catch {
-      return { organizations: [], currentOrgId };
-    }
-  }
-  function clearPublicTokenCookie(cookieStore) {
-    if (cookieStore.get(cn.tokenPub)?.value) {
-      cookieStore.set(cn.tokenPub, "", { httpOnly: false, maxAge: 0, path: "/" });
-    }
-  }
-  async function saveAccountToList(tokens) {
-    const account = parseAccountFromJwt(tokens);
-    if (!account) return;
-    const cookieStore = await cookies();
-    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };
-    const count = await getCount();
-    let targetSlot = 0;
-    for (let i = 1; i <= count; i++) {
-      const existing = readSlot(cookieStore, i);
-      if (existing?.id === account.id) {
-        targetSlot = i;
-        break;
-      }
-    }
-    if (targetSlot === 0) {
-      if (count >= MAX_ACCOUNTS) return;
-      targetSlot = count + 1;
-      cookieStore.set(cn.count, String(targetSlot), opts);
-    }
-    writeSlot(cookieStore, targetSlot, account);
-    cookieStore.set(cn.active, String(targetSlot), opts);
-    clearPublicTokenCookie(cookieStore);
-  }
-  const setSessionCookies = saveAccountToList;
-  async function switchAccount(accountId) {
-    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);
-    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };
-    for (let i = 1; i <= count; i++) {
-      const slot = readSlot(cookieStore, i);
-      if (slot && (slot.id === accountId || slot.sessionId === accountId)) {
-        cookieStore.set(cn.active, String(i), opts);
-        clearPublicTokenCookie(cookieStore);
-        return true;
-      }
-    }
-    return false;
-  }
-  async function removeActiveAccount() {
-    const [cookieStore, activeIdx, count] = await Promise.all([cookies(), getActiveIndex(), getCount()]);
-    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };
-    const clear = { ...getCookieOptions(config), maxAge: 0 };
-    if (count === 0) return;
-    const remaining = [];
-    for (let i = 1; i <= count; i++) {
-      if (i === activeIdx) continue;
-      const slot = readSlot(cookieStore, i);
-      if (slot) remaining.push(slot);
-    }
-    for (let i = 1; i <= count; i++) {
-      clearSlot(cookieStore, i);
-    }
-    if (remaining.length === 0) {
-      cookieStore.set(cn.count, "0", clear);
-      cookieStore.set(cn.active, "0", clear);
-      await clearPublicTokenCookie(cookieStore);
-      return;
-    }
-    for (let i = 0; i < remaining.length; i++) {
-      await writeSlot(cookieStore, i + 1, remaining[i]);
-    }
-    cookieStore.set(cn.count, String(remaining.length), opts);
-    cookieStore.set(cn.active, "1", opts);
-    clearPublicTokenCookie(cookieStore);
-  }
-  async function clearAllSessionCookies() {
-    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);
-    const clear = { ...getCookieOptions(config), maxAge: 0 };
-    for (let i = 1; i <= count; i++) {
-      clearSlot(cookieStore, i);
-    }
-    cookieStore.set(cn.count, "0", clear);
-    cookieStore.set(cn.active, "0", clear);
-    clearPublicTokenCookie(cookieStore);
-  }
-  async function tryRefreshTokens() {
-    const refreshToken = await getRefreshToken();
-    if (!refreshToken || !config.clientId) return null;
-    const basicAuth = Buffer.from(`${config.clientId}:${config.clientSecret ?? ""}`).toString("base64");
-    const response = await fetch(createUrl(config.issuer, "/auth/token"), {
-      method: "POST",
-      headers: {
-        "content-type": "application/x-www-form-urlencoded",
-        authorization: `Basic ${basicAuth}`
-      },
-      body: new URLSearchParams({
-        grant_type: "refresh_token",
-        refresh_token: refreshToken
-      }),
-      cache: "no-store"
-    });
-    if (!response.ok) return null;
-    const data = await response.json().catch(() => null);
-    if (!data) return null;
-    const tokens = tokenFromResponse(data);
-    if (!tokens.accessToken) return null;
-    await saveAccountToList(tokens);
-    return tokens.accessToken;
-  }
-  async function apiRequest(path, init = {}) {
-    const accessToken = await getAccessToken();
-    const requestHeaders = new Headers(init.headers);
-    if (accessToken) requestHeaders.set("authorization", `Bearer ${accessToken}`);
-    if (init.body !== void 0 && !requestHeaders.has("content-type")) {
-      requestHeaders.set("content-type", "application/json");
-    }
-    const url = new URL(createUrl(config.issuer, path));
-    applyClientCredentials(url, config);
-    const response = await fetch(url, {
-      ...init,
-      headers: requestHeaders,
-      cache: "no-store"
-    });
-    if (response.status === 401) {
-      const newAccessToken = await tryRefreshTokens();
-      if (!newAccessToken) {
-        await clearAllSessionCookies().catch(() => {
-        });
-        throw new GeekappsSessionExpiredError();
-      }
-      if (newAccessToken) {
-        const retryHeaders = new Headers(init.headers);
-        retryHeaders.set("authorization", `Bearer ${newAccessToken}`);
-        if (init.body !== void 0 && !retryHeaders.has("content-type")) {
-          retryHeaders.set("content-type", "application/json");
-        }
-        const retryUrl = new URL(createUrl(config.issuer, path));
-        applyClientCredentials(retryUrl, config);
-        const retryResponse = await fetch(retryUrl, {
-          ...init,
-          headers: retryHeaders,
-          cache: "no-store"
-        });
-        if (!retryResponse.ok) {
-          const error = await retryResponse.json().catch(() => null);
-          throw new Error(error?.error_description ?? error?.error ?? error?.message ?? `Auth API error ${retryResponse.status}`);
-        }
-        if (retryResponse.status === 204) return null;
-        return await retryResponse.json();
-      }
-    }
-    if (!response.ok) {
-      const error = await response.json().catch(() => null);
-      throw new Error(error?.error_description ?? error?.error ?? error?.message ?? `Auth API error ${response.status}`);
-    }
-    if (response.status === 204) return null;
-    return await response.json();
-  }
-  function createApiClient() {
-    return {
-      get: (path) => apiRequest(path),
-      post: (path, body) => apiRequest(path, { method: "POST", body: body === void 0 ? void 0 : JSON.stringify(body) }),
-      patch: (path, body) => apiRequest(path, { method: "PATCH", body: body === void 0 ? void 0 : JSON.stringify(body) }),
-      put: (path, body) => apiRequest(path, { method: "PUT", body: body === void 0 ? void 0 : JSON.stringify(body) }),
-      delete: (path) => apiRequest(path, { method: "DELETE" })
-    };
-  }
-  async function requireUser(options = {}) {
-    const accessToken = await getAccessToken();
-    if (!accessToken) {
-      redirect(options.redirectTo ?? "/");
-    }
-    return accessToken;
-  }
-  function escapeHtml(str) {
-    return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-  }
-  function sanitizeRedirectTo(value) {
-    const raw = value ?? "/";
-    if (raw.startsWith(config.basePath)) return "/";
-    if (raw.startsWith("/") && !raw.startsWith("//")) return raw;
-    return "/";
-  }
-  async function createAuthorizeRedirect(request, mode) {
-    const redirectTo = sanitizeRedirectTo(request.nextUrl.searchParams.get("redirectTo") ?? config.afterSignInRedirectTo);
-    const flowId = request.nextUrl.searchParams.get("flow_id");
-    const url = new URL(createUrl(config.issuer, mode === "google" ? "/auth/google" : "/authorize"));
-    if (!config.clientId) {
-      return NextResponse.json(
-        { error: "missing_client_id", message: "Missing GEEKAPPS_AUTH_CLIENT_ID or clientId." },
-        { status: 500 }
-      );
-    }
-    url.searchParams.set("client_id", config.clientId);
-    url.searchParams.set("redirect_uri", resolveRedirectUri(config, request));
-    url.searchParams.set("response_type", "code");
-    const scopes = config.scopes ?? ["openid", "profile", "email"];
-    if (!scopes.includes("offline_access")) scopes.push("offline_access");
-    url.searchParams.set("scope", scopes.join(" "));
-    url.searchParams.set("state", Buffer.from(JSON.stringify({ redirectTo, mode })).toString("base64url"));
-    if (mode === "register") url.searchParams.set("screen_hint", "signup");
-    if (mode === "add-account") {
-      url.searchParams.set("prompt", "login");
-    } else {
-      const prompt = request.nextUrl.searchParams.get("prompt");
-      const silentLogin = request.nextUrl.searchParams.get("silentLogin");
-      const resolvedPrompt = prompt ?? (silentLogin === "false" ? "login" : null);
-      if (resolvedPrompt) url.searchParams.set("prompt", resolvedPrompt);
-    }
-    if (flowId) url.searchParams.set("flow_id", flowId);
-    const codeVerifier = generateCodeVerifier();
-    url.searchParams.set("code_challenge", createCodeChallenge(codeVerifier));
-    url.searchParams.set("code_challenge_method", "S256");
-    const response = NextResponse.redirect(url);
-    const cn2 = getCookieNames(config.cookiePrefix);
-    response.cookies.set(cn2.pkceVerifier, codeVerifier, {
-      ...getCookieOptions(config),
-      maxAge: 60 * 10
-    });
-    return response;
-  }
-  async function exchangeCode(request) {
-    const code = request.nextUrl.searchParams.get("code");
-    const state = request.nextUrl.searchParams.get("state");
-    const origin = requestOrigin(request);
-    if (!code) {
-      const err = request.nextUrl.searchParams.get("error") ?? "missing_code";
-      const desc = request.nextUrl.searchParams.get("error_description") ?? request.nextUrl.searchParams.get("error_message") ?? "No authorization code received";
-      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=${encodeURIComponent(err)}&error_description=${encodeURIComponent(desc)}`, origin));
-    }
-    if (!config.clientId) {
-      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=missing_client_id&error_description=Auth+client+is+not+configured`, origin));
-    }
-    const basicAuth = Buffer.from(
-      `${config.clientId}:${config.clientSecret ?? ""}`
-    ).toString("base64");
-    const cn2 = getCookieNames(config.cookiePrefix);
-    const cookieStore = await cookies();
-    const codeVerifier = cookieStore.get(cn2.pkceVerifier)?.value;
-    cookieStore.set(cn2.pkceVerifier, "", { ...getCookieOptions(config), maxAge: 0 });
-    const tokenBody = new URLSearchParams({
-      grant_type: "authorization_code",
-      code,
-      redirect_uri: resolveRedirectUri(config, request)
-    });
-    if (codeVerifier) tokenBody.set("code_verifier", codeVerifier);
-    const response = await fetch(createUrl(config.issuer, "/auth/token"), {
-      method: "POST",
-      headers: {
-        "content-type": "application/x-www-form-urlencoded",
-        authorization: `Basic ${basicAuth}`
-      },
-      body: tokenBody,
-      cache: "no-store"
-    });
-    const data = await response.json().catch(() => ({}));
-    if (!response.ok) {
-      const error = encodeURIComponent(data.error ?? "token_exchange_failed");
-      const desc = encodeURIComponent(data.error_description ?? `Token exchange failed with status ${response.status}`);
-      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=${error}&error_description=${desc}`, origin));
-    }
-    await saveAccountToList(tokenFromResponse(data));
-    let redirectTo = sanitizeRedirectTo(config.afterSignInRedirectTo);
-    if (state) {
-      try {
-        const parsed = JSON.parse(Buffer.from(state, "base64url").toString("utf8"));
-        redirectTo = sanitizeRedirectTo(parsed.redirectTo);
-      } catch {
-      }
-    }
-    return NextResponse.redirect(new URL(redirectTo, origin));
-  }
-  function mapLocalPathToApiPath(route) {
-    if (route === "/me") return "/auth/me";
-    if (route === "/accounts/switch") return "/auth/accounts/switch";
-    if (route === "/organizations/active") return "/auth/organizations/active";
-    if (route === "/permissions/check") return "/auth/permissions/check";
-    if (route === "/login/password") return "/auth/login/password";
-    if (route === "/register/password") return "/auth/register/password";
-    if (route === "/passwordless/link") return "/auth/passwordless/link";
-    return route;
-  }
-  async function handleAccountsLocal() {
-    const [accounts, activeIdx] = await Promise.all([getAccountsList(), getActiveIndex()]);
-    return NextResponse.json({
-      accounts: accounts.map((a, i) => ({
-        id: a.id,
-        sessionId: a.sessionId ?? a.id,
-        isActive: i + 1 === activeIdx,
-        user: {
-          id: a.user.sub,
-          name: a.user.name ?? null,
-          email: a.user.email ?? null,
-          imageUrl: a.user.picture ?? null,
-          phone: a.user.phone ?? null
-        }
-      }))
-    });
-  }
-  async function handleOrganizationsLocal() {
-    const cookieStore = await cookies();
-    const activeOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;
-    try {
-      const data = await apiRequest("/organizations");
-      const organizations = Array.isArray(data) ? data : data.organizations;
-      return NextResponse.json({ organizations, currentOrgId: activeOrgId });
-    } catch {
-      return NextResponse.json({ organizations: [], currentOrgId: activeOrgId });
-    }
-  }
-  async function handleSwitchAccountLocal(request) {
-    const body = await readBody(request);
-    const targetId = body && typeof body === "object" ? String(
-      body.accountId ?? body.sessionId ?? ""
-    ) : "";
-    if (!targetId) {
-      return NextResponse.json({ error: "accountId required" }, { status: 400 });
-    }
-    const switched = await switchAccount(targetId);
-    if (!switched) {
-      return NextResponse.json({ error: "Account not found" }, { status: 404 });
-    }
-    return NextResponse.json({ ok: true });
-  }
-  async function proxy(request, route) {
-    const accessToken = await getAccessToken();
-    const body = ["GET", "HEAD"].includes(request.method) ? void 0 : await readBody(request);
-    const url = new URL(appendSearchParams(createUrl(config.issuer, mapLocalPathToApiPath(route)), request));
-    applyClientCredentials(url, config);
-    const requestHeaders = new Headers();
-    if (accessToken) requestHeaders.set("authorization", `Bearer ${accessToken}`);
-    if (body !== void 0) requestHeaders.set("content-type", "application/json");
-    let response = await fetch(url, {
-      method: request.method,
-      headers: requestHeaders,
-      body: body === void 0 ? void 0 : typeof body === "string" ? body : JSON.stringify(body),
-      cache: "no-store"
-    });
-    if (response.status === 401) {
-      const refreshed = await tryRefreshTokens();
-      if (refreshed) {
-        requestHeaders.set("authorization", `Bearer ${refreshed}`);
-        response = await fetch(url, {
-          method: request.method,
-          headers: requestHeaders,
-          body: body === void 0 ? void 0 : typeof body === "string" ? body : JSON.stringify(body),
-          cache: "no-store"
-        });
-      } else {
-        await clearAllSessionCookies().catch(() => {
-        });
-        return NextResponse.json(
-          { error: "session_expired" },
-          { status: 401 }
-        );
-      }
-    }
-    const data = isJsonResponse(response) ? await response.json().catch(() => null) : null;
-    if (data) {
-      const tokens = tokenFromResponse(data);
-      if (tokens.accessToken || tokens.refreshToken || tokens.idToken || tokens.sessionId) {
-        await saveAccountToList(tokens);
-      }
-      return NextResponse.json(data, { status: response.status });
-    }
-    return responseFromApi(response);
-  }
-  async function handle(request) {
-    const route = routeFromRequest(request, config.basePath);
-    if (request.method === "GET" && route === "/sign-in") return createAuthorizeRedirect(request, "login");
-    if (request.method === "GET" && route === "/sign-up") return createAuthorizeRedirect(request, "register");
-    if (request.method === "GET" && route === "/add-account") return createAuthorizeRedirect(request, "add-account");
-    if (request.method === "GET" && route === "/login/google") return createAuthorizeRedirect(request, "google");
-    if (request.method === "GET" && route === "/callback") {
-      const error = request.nextUrl.searchParams.get("error");
-      if (error) {
-        const description = request.nextUrl.searchParams.get("error_description") ?? request.nextUrl.searchParams.get("error_message") ?? "An authentication error occurred.";
-        return new NextResponse(
-          `<!doctype html><html><head><meta charset="utf-8"><title>Authentication Error</title></head><body style="font-family:sans-serif;max-width:480px;margin:80px auto;padding:0 16px"><h2>Authentication Error</h2><p><strong>${escapeHtml(error)}</strong></p><p>${escapeHtml(description)}</p><a href="/">Go back</a></body></html>`,
-          { status: 400, headers: { "content-type": "text/html; charset=utf-8" } }
-        );
-      }
-      return exchangeCode(request);
-    }
-    if (request.method === "GET" && route === "/token") {
-      const accessToken = await getAccessToken();
-      if (!accessToken) return NextResponse.json({ error: "missing_token" }, { status: 401 });
-      return NextResponse.json({ accessToken });
-    }
-    if (request.method === "GET" && route === "/accounts") return handleAccountsLocal();
-    if (request.method === "POST" && route === "/accounts/switch") return handleSwitchAccountLocal(request);
-    if (request.method === "GET" && route === "/organizations") return handleOrganizationsLocal();
-    if (request.method === "POST" && route === "/organizations") {
-      const accessToken = await getAccessToken();
-      const body = await readBody(request);
-      if (body && accessToken && !body.applicationId) {
-        const claims = decodeJwtPayload(accessToken);
-        const applicationId = (typeof claims?.application_id === "string" ? claims.application_id : null) ?? (typeof claims?.client_id === "string" ? claims.client_id : null) ?? (typeof claims?.applicationId === "string" ? claims.applicationId : null);
-        if (applicationId) body.applicationId = applicationId;
-      }
-      const orgUrl = new URL(createUrl(config.issuer, "/organizations"));
-      applyClientCredentials(orgUrl, config);
-      const requestHeaders = new Headers();
-      if (accessToken) requestHeaders.set("authorization", `Bearer ${accessToken}`);
-      if (body !== void 0) requestHeaders.set("content-type", "application/json");
-      const response = await fetch(orgUrl, {
-        method: "POST",
-        headers: requestHeaders,
-        body: JSON.stringify(body),
-        cache: "no-store"
-      });
-      return responseFromApi(response);
-    }
-    if (request.method === "POST" && route === "/sign-out") {
-      await apiRequest("/auth/sign-out", { method: "POST" }).catch(() => null);
-      await removeActiveAccount();
-      return NextResponse.json({ ok: true });
-    }
-    if (request.method === "POST" && route === "/sign-out-all") {
-      await apiRequest("/auth/sign-out-all", { method: "POST" }).catch(() => null);
-      await clearAllSessionCookies();
-      return NextResponse.json({ ok: true });
-    }
-    if (request.method === "POST" && route === "/organizations/active") {
-      const body = await readBody(request);
-      const organizationId = body && typeof body === "object" && "organizationId" in body ? body.organizationId : null;
-      const response = NextResponse.json({ ok: true });
-      if (typeof organizationId === "string") {
-        const cookieOpts = {
-          httpOnly: true,
-          sameSite: "lax",
-          path: "/",
-          secure: process.env.NODE_ENV === "production",
-          maxAge: 60 * 60 * 24 * 7
-        };
-        response.cookies.set(cn.activeOrganizationId, organizationId, cookieOpts);
-      }
-      return response;
-    }
-    return proxy(request, route);
-  }
-  return {
-    handlers: {
-      GET: handle,
-      POST: handle,
-      PATCH: handle,
-      DELETE: handle
-    },
-    GetSession: getSession,
-    GetUser: getUser,
-    GetUserById: getUserById,
-    GetOrganizations: getOrganizations,
-    SaveSession: saveAccountToList,
-    GetAccessToken: getAccessToken,
-    GetRefreshToken: getRefreshToken,
-    IsAuthenticated: async () => await getAccessToken() !== null,
-    TryRefreshTokens: tryRefreshTokens,
-    RequireUser: requireUser,
-    CreateAuthApiClient: createApiClient,
-    cookiePrefix: config.cookiePrefix,
-    VerifyToken: (token) => verifyToken(token, config.issuer),
-    SignInUrl: async (redirectTo) => {
-      const configured = env("GEEKAPPS_APP_URL");
-      if (!configured) throw new Error("Cannot determine app origin. Set GEEKAPPS_APP_URL.");
-      const origin = configured.replace(/\/$/, "");
-      const url = new URL(`${origin}${config.basePath}/sign-in`);
-      if (redirectTo) url.searchParams.set("redirectTo", redirectTo);
-      return url.toString();
-    }
-  };
-}
 
 // src/connections.ts
 var AppConnectionError = class extends Error {
@@ -812,169 +24,28 @@ var AppConnectionError = class extends Error {
     this.body = body;
   }
 };
-function env2(name) {
+function env(name) {
   const value = process.env[name];
   return value && value.trim().length > 0 ? value : void 0;
 }
 function resolveConfig(config) {
-  const issuer = (config.issuer ?? env2("GEEKAPPS_AUTH_SERVER_ISSUER") ?? env2("GEEKAPPS_AUTH_SERVER_URL") ?? GEEKAPPS_AUTH_SERVER_URL).replace(/\/$/, "");
+  const issuer = (config.issuer ?? env("GEEKAPPS_AUTH_SERVER_ISSUER") ?? env("GEEKAPPS_AUTH_SERVER_URL") ?? GEEKAPPS_AUTH_SERVER_URL).replace(/\/$/, "");
   return {
     issuer,
-    clientId: config.clientId ?? env2("GEEKAPPS_AUTH_CLIENT_ID") ?? "",
-    clientSecret: config.clientSecret ?? env2("GEEKAPPS_AUTH_CLIENT_SECRET") ?? ""
+    clientId: config.clientId ?? env("GEEKAPPS_AUTH_CLIENT_ID") ?? "",
+    clientSecret: config.clientSecret ?? env("GEEKAPPS_AUTH_CLIENT_SECRET") ?? ""
   };
 }
-async function callAppConnection(params) {
-  const { issuer, clientId, clientSecret } = resolveConfig(params.config ?? {});
-  if (!clientId || !clientSecret) {
-    throw new Error(
-      "App Connections: defina GEEKAPPS_AUTH_CLIENT_ID e GEEKAPPS_AUTH_CLIENT_SECRET \u2014 \xE9 com essas credenciais que o proxy identifica a app que est\xE1 chamando."
-    );
-  }
-  const userToken = params.userToken ?? await configureGeekappsAuth().GetAccessToken();
-  if (!userToken) {
-    throw new AppConnectionError(
-      "App Connections: n\xE3o h\xE1 usu\xE1rio logado \u2014 a conex\xE3o \xE9 do usu\xE1rio, a chamada precisa do access token dele.",
-      401,
-      "user_token_required",
-      null
-    );
-  }
-  const url = `${issuer}/connections/${encodeURIComponent(params.targetAppId)}/actions/${encodeURIComponent(params.actionKey)}`;
-  const response = await fetch(url, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    // Credenciais da app e token do usuário vão no corpo, não em headers.
-    body: JSON.stringify({
-      client_id: clientId,
-      client_secret: clientSecret,
-      user_token: userToken,
-      ...params.payload === void 0 ? {} : { payload: params.payload }
-    }),
-    cache: "no-store"
-  });
-  const body = await response.json().catch(() => null);
-  if (!response.ok) {
-    const code = body && typeof body === "object" && typeof body.error === "string" ? body.error : void 0;
-    throw new AppConnectionError(
-      `App Connections: ${params.actionKey} falhou (${response.status}${code ? ` ${code}` : ""})`,
-      response.status,
-      code,
-      body
-    );
-  }
-  return body;
-}
-var _registry = /* @__PURE__ */ new Map();
-function registerConnections(entries) {
-  for (const [name, entry] of Object.entries(entries)) _registry.set(name, entry);
-}
-var TYPES_MODULE = "@geekapps/auth-nextjs/connections";
-var TYPES_FILE = "geekapps-connections.d.ts";
-var REFRESH_MIN_INTERVAL_MS = 5e3;
-var _remote = /* @__PURE__ */ new Map();
-var _inflight = /* @__PURE__ */ new Map();
-async function writeTypesInDev(model) {
-  if (process.env.NODE_ENV !== "development" || process.env.GEEKAPPS_CONNECTIONS_TYPES === "off") return;
-  try {
-    const { existsSync, readFileSync, writeFileSync } = await import("fs");
-    const { resolve } = await import("path");
-    const file = resolve(process.cwd(), TYPES_FILE);
-    const content = renderAugmentation(model, TYPES_MODULE);
-    if (existsSync(file) && readFileSync(file, "utf-8") === content) return;
-    writeFileSync(file, content, "utf-8");
-  } catch {
-  }
-}
-async function loadRemoteRegistry(config, force = false) {
-  const { issuer, clientId, clientSecret } = resolveConfig(config);
-  if (!clientId || !clientSecret) {
-    throw new Error(
-      "App Connections: defina GEEKAPPS_AUTH_CLIENT_ID e GEEKAPPS_AUTH_CLIENT_SECRET \u2014 \xE9 com essas credenciais que o SDK descobre as apps conect\xE1veis."
-    );
-  }
-  const cacheKey = `${issuer}|${clientId}`;
-  const ttl = process.env.NODE_ENV === "development" ? 3e4 : 5 * 6e4;
-  const cached = _remote.get(cacheKey);
-  const age = cached ? Date.now() - cached.at : Infinity;
-  if (cached && (force ? age < REFRESH_MIN_INTERVAL_MS : age < ttl)) return cached.registry;
-  const pending = _inflight.get(cacheKey);
-  if (pending) return pending;
-  const request = (async () => {
-    try {
-      const model = buildModel(await fetchRemoteCatalog({ issuer, clientId, clientSecret }));
-      const registry = new Map(Object.entries(toRegistry(model)));
-      _remote.set(cacheKey, { at: Date.now(), registry });
-      void writeTypesInDev(model);
-      return registry;
-    } catch (error) {
-      if (cached) return cached.registry;
-      throw new AppConnectionError(`App Connections: ${error.message}`, 502, "catalog_unavailable", null);
-    } finally {
-      _inflight.delete(cacheKey);
-    }
-  })();
-  _inflight.set(cacheKey, request);
-  return request;
-}
-async function resolveTarget(provider, appName, actionName) {
-  for (const force of [false, true]) {
-    const registry = await provider(force);
-    const entry = registry.get(appName);
-    const key = entry?.actions[actionName];
-    if (entry && key) return { appId: entry.appId, key };
+function requireCredentials(config) {
+  const resolved = resolveConfig(config);
+  if (!resolved.clientId || !resolved.clientSecret) {
+    throw new Error("App Connections: defina GEEKAPPS_AUTH_CLIENT_ID e GEEKAPPS_AUTH_CLIENT_SECRET.");
   }
-  throw new Error(
-    `App Connections: "${appName}.${actionName}" n\xE3o existe no cat\xE1logo. Confira se a app alvo cadastrou a a\xE7\xE3o (geekapps-actions sync).`
-  );
-}
-function createCatalog(config, provider) {
-  return new Proxy(/* @__PURE__ */ Object.create(null), {
-    get(_target, appName) {
-      if (typeof appName !== "string") return void 0;
-      return new Proxy(/* @__PURE__ */ Object.create(null), {
-        get(_t, actionName) {
-          if (typeof actionName !== "string") return void 0;
-          return async (payload, options) => {
-            const target = await resolveTarget(provider, appName, actionName);
-            return callAppConnection({
-              targetAppId: target.appId,
-              actionKey: target.key,
-              payload,
-              userToken: options?.userToken,
-              config
-            });
-          };
-        }
-      });
-    }
-  });
-}
-var _devRefresh = /* @__PURE__ */ new Set();
-function startDevRefresh(config) {
-  if (process.env.NODE_ENV !== "development") return;
-  const { issuer, clientId, clientSecret } = resolveConfig(config);
-  if (!clientId || !clientSecret) return;
-  const key = `${issuer}|${clientId}`;
-  if (_devRefresh.has(key)) return;
-  _devRefresh.add(key);
-  const tick = () => void loadRemoteRegistry(config, true).catch(() => void 0);
-  tick();
-  setInterval(tick, 3e4).unref?.();
-}
-function createAppConnections(config = {}) {
-  startDevRefresh(config);
-  const provider = async (force) => {
-    const remote = await loadRemoteRegistry(config, force);
-    return new Map([..._registry, ...remote]);
-  };
-  return createCatalog(config, provider);
+  return resolved;
 }
-function defineAppConnections(catalog, config = {}) {
-  const registry = new Map(Object.entries(catalog));
-  return createCatalog(config, async () => registry);
+function errorCode(body) {
+  return body && typeof body === "object" && typeof body.error === "string" ? body.error : void 0;
 }
-var appConnections = createAppConnections();
 var CONNECT_COOKIES = {
   verifier: "gk_conn_pkce",
   state: "gk_conn_state",
@@ -986,9 +57,6 @@ async function connectApp(params) {
   if (!clientId) {
     throw new Error("App Connections: defina GEEKAPPS_AUTH_CLIENT_ID \u2014 \xE9 o client_id desta app, a que pede a conex\xE3o.");
   }
-  if (params.actions.length === 0) {
-    throw new Error("App Connections: informe ao menos uma a\xE7\xE3o em `actions`.");
-  }
   const codeVerifier = randomBytes2(64).toString("base64url");
   const state = randomBytes2(24).toString("base64url");
   const store = await cookies2();
@@ -1001,7 +69,7 @@ async function connectApp(params) {
   url.searchParams.set("client_id", clientId);
   url.searchParams.set("redirect_uri", params.redirectUri);
   url.searchParams.set("response_type", "code");
-  url.searchParams.set("scope", `openid ${params.actions.join(" ")}`);
+  url.searchParams.set("scope", "openid");
   url.searchParams.set("state", state);
   url.searchParams.set("code_challenge", createHash2("sha256").update(codeVerifier).digest("base64url"));
   url.searchParams.set("code_challenge_method", "S256");
@@ -1011,10 +79,7 @@ async function connectApp(params) {
   redirect2(url.toString());
 }
 async function completeAppConnection(params) {
-  const { issuer, clientId, clientSecret } = resolveConfig(params.config ?? {});
-  if (!clientId || !clientSecret) {
-    throw new Error("App Connections: defina GEEKAPPS_AUTH_CLIENT_ID e GEEKAPPS_AUTH_CLIENT_SECRET.");
-  }
+  const { issuer, clientId, clientSecret } = requireCredentials(params.config ?? {});
   const store = await cookies2();
   const read = (name) => store.get(name)?.value;
   const expectedState = read(CONNECT_COOKIES.state);
@@ -1039,9 +104,9 @@ async function completeAppConnection(params) {
     }),
     cache: "no-store"
   });
-  if (!response.ok) {
-    const body = await response.json().catch(() => null);
-    const code = body && typeof body.error === "string" ? body.error : void 0;
+  const body = await response.json().catch(() => null);
+  if (!response.ok || !body?.connection_token) {
+    const code = errorCode(body);
     throw new AppConnectionError(
       `App Connections: n\xE3o foi poss\xEDvel concluir a conex\xE3o (${response.status}${code ? ` ${code}` : ""})`,
       response.status,
@@ -1049,16 +114,83 @@ async function completeAppConnection(params) {
       body
     );
   }
-  return { returnTo };
+  return {
+    returnTo,
+    connection: {
+      token: body.connection_token,
+      connectionId: body.connection_id,
+      expiresAt: body.connection_expires_at ?? null,
+      organizationId: body.connection_organization_id,
+      targetAppId: body.connection_target_app_id
+    }
+  };
+}
+var _jwtCache = /* @__PURE__ */ new Map();
+async function postToAuthServer(path, connectionToken, config) {
+  const { issuer, clientId, clientSecret } = requireCredentials(config);
+  const response = await fetch(`${issuer}${path}`, {
+    method: "POST",
+    headers: {
+      authorization: `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify({ connection_token: connectionToken }),
+    cache: "no-store"
+  });
+  const body = await response.json().catch(() => null);
+  if (!response.ok) {
+    const code = errorCode(body);
+    throw new AppConnectionError(
+      `App Connections: ${path} falhou (${response.status}${code ? ` ${code}` : ""})`,
+      response.status,
+      code,
+      body
+    );
+  }
+  return body;
+}
+async function getConnectionAccessToken(params) {
+  const cached = _jwtCache.get(params.connectionToken);
+  if (cached && cached.expiresAt > Date.now() + 3e4) return cached.value;
+  const data = await postToAuthServer("/connections/token", params.connectionToken, params.config ?? {});
+  const value = {
+    accessToken: data.access_token,
+    expiresIn: data.expires_in,
+    organizationId: data.organization_id,
+    targetAppId: data.target_app_id,
+    targetApiBaseUrl: data.target_api_base_url
+  };
+  _jwtCache.set(params.connectionToken, { value, expiresAt: Date.now() + data.expires_in * 1e3 });
+  return value;
+}
+async function connectionFetch(params) {
+  const { accessToken, targetApiBaseUrl } = await getConnectionAccessToken({
+    connectionToken: params.connectionToken,
+    config: params.config
+  });
+  const isAbsolute = /^https?:\/\//i.test(params.path);
+  if (!isAbsolute && !targetApiBaseUrl) {
+    throw new Error("App Connections: a app alvo n\xE3o declarou apiBaseUrl \u2014 passe `path` como URL absoluta.");
+  }
+  const headers2 = new Headers(params.init?.headers);
+  headers2.set("authorization", `Bearer ${accessToken}`);
+  return fetch(isAbsolute ? params.path : new URL(params.path, targetApiBaseUrl), { ...params.init, headers: headers2 });
+}
+async function rotateConnectionToken(params) {
+  const data = await postToAuthServer(
+    "/connections/token/rotate",
+    params.connectionToken,
+    params.config ?? {}
+  );
+  _jwtCache.delete(params.connectionToken);
+  return { token: data.connection_token, expiresAt: data.expires_at };
 }
 export {
   AppConnectionError,
-  appConnections,
-  callAppConnection,
   completeAppConnection,
   connectApp,
-  createAppConnections,
-  defineAppConnections,
-  registerConnections
+  connectionFetch,
+  getConnectionAccessToken,
+  rotateConnectionToken
 };
 //# sourceMappingURL=connections.js.map