@githat/nextjs 0.3.0 → 0.3.1

package/dist/middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/middleware/index.ts"],"sourcesContent":["import { NextResponse } from 'next/server';\nimport type { NextRequest } from 'next/server';\n\ninterface AuthMiddlewareOptions {\n  publicRoutes?: string[];\n  signInUrl?: string;\n  tokenKey?: string;\n}\n\nexport function authMiddleware(options: AuthMiddlewareOptions = {}) {\n  const {\n    publicRoutes = ['/'],\n    signInUrl = '/sign-in',\n    tokenKey = 'githat_access_token',\n  } = options;\n\n  return function middleware(request: NextRequest) {\n    const { pathname } = request.nextUrl;\n\n    // Allow public routes\n    if (publicRoutes.some(route => pathname === route || pathname.startsWith(route + '/'))) {\n      return NextResponse.next();\n    }\n\n    // Allow static files and API routes\n    if (pathname.startsWith('/_next') || pathname.startsWith('/api') || pathname.includes('.')) {\n      return NextResponse.next();\n    }\n\n    // Check for token in cookies (set by client-side localStorage bridge)\n    // Note: since tokens are in localStorage (not cookies), middleware can only\n    // do a presence check. Real validation happens on API calls.\n    const token = request.cookies.get(tokenKey)?.value;\n    if (!token) {\n      const signInUrlObj = new URL(signInUrl, request.url);\n      signInUrlObj.searchParams.set('redirect_url', pathname);\n      return NextResponse.redirect(signInUrlObj);\n    }\n\n    return NextResponse.next();\n  };\n}\n"],"mappings":";AAAA,SAAS,oBAAoB;AAStB,SAAS,eAAe,UAAiC,CAAC,GAAG;AAClE,QAAM;AAAA,IACJ,eAAe,CAAC,GAAG;AAAA,IACnB,YAAY;AAAA,IACZ,WAAW;AAAA,EACb,IAAI;AAEJ,SAAO,SAAS,WAAW,SAAsB;AAC/C,UAAM,EAAE,SAAS,IAAI,QAAQ;AAG7B,QAAI,aAAa,KAAK,WAAS,aAAa,SAAS,SAAS,WAAW,QAAQ,GAAG,CAAC,GAAG;AACtF,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,SAAS,WAAW,QAAQ,KAAK,SAAS,WAAW,MAAM,KAAK,SAAS,SAAS,GAAG,GAAG;AAC1F,aAAO,aAAa,KAAK;AAAA,IAC3B;AAKA,UAAM,QAAQ,QAAQ,QAAQ,IAAI,QAAQ,GAAG;AAC7C,QAAI,CAAC,OAAO;AACV,YAAM,eAAe,IAAI,IAAI,WAAW,QAAQ,GAAG;AACnD,mBAAa,aAAa,IAAI,gBAAgB,QAAQ;AACtD,aAAO,aAAa,SAAS,YAAY;AAAA,IAC3C;AAEA,WAAO,aAAa,KAAK;AAAA,EAC3B;AACF;","names":[]}
+{"version":3,"sources":["../src/middleware/index.ts"],"sourcesContent":["import { NextResponse } from 'next/server';\nimport type { NextRequest } from 'next/server';\nimport * as jose from 'jose';\n\ninterface AuthMiddlewareOptions {\n  /**\n   * Routes that don't require authentication.\n   * Supports exact paths ('/') and path prefixes ('/public/*').\n   */\n  publicRoutes?: string[];\n\n  /**\n   * URL to redirect to when authentication is required but not present.\n   * @default '/sign-in'\n   */\n  signInUrl?: string;\n\n  /**\n   * Cookie name for the access token.\n   * @default 'githat_access'\n   */\n  tokenCookie?: string;\n\n  /**\n   * Legacy localStorage token cookie name (for backward compatibility).\n   * @default 'githat_access_token'\n   */\n  legacyTokenCookie?: string;\n\n  /**\n   * When true, decode the JWT and inject x-githat-* headers into the request.\n   * This allows downstream API routes to access user/org info without re-verifying.\n   *\n   * Injected headers:\n   * - x-githat-user-id: User's unique ID\n   * - x-githat-email: User's email address\n   * - x-githat-org-id: Current org ID (if any)\n   * - x-githat-org-slug: Current org slug (if any)\n   * - x-githat-role: User's role in the org (owner/admin/member)\n   *\n   * @default false\n   */\n  injectHeaders?: boolean;\n\n  /**\n   * Secret key for local JWT verification when injectHeaders is true.\n   * If not provided, headers are populated from the decoded (unverified) token payload.\n   * For production, always provide the secret key for full verification.\n   */\n  secretKey?: string;\n}\n\n/**\n * Decode a JWT without verifying the signature.\n * Used when secretKey is not provided but we still want header injection.\n */\nfunction decodeJwtPayload(token: string): Record<string, unknown> | null {\n  try {\n    const parts = token.split('.');\n    if (parts.length !== 3) return null;\n    const payload = JSON.parse(atob(parts[1]));\n    return payload;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Verify a JWT and return the payload.\n * Uses jose for proper signature verification.\n */\nasync function verifyJwt(\n  token: string,\n  secretKey: string\n): Promise<Record<string, unknown> | null> {\n  try {\n    const secret = new TextEncoder().encode(secretKey);\n    const { payload } = await jose.jwtVerify(token, secret, {\n      algorithms: ['HS256'],\n    });\n    return payload as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\nexport function authMiddleware(options: AuthMiddlewareOptions = {}) {\n  const {\n    publicRoutes = ['/'],\n    signInUrl = '/sign-in',\n    tokenCookie = 'githat_access',\n    legacyTokenCookie = 'githat_access_token',\n    injectHeaders = false,\n    secretKey,\n  } = options;\n\n  return async function middleware(request: NextRequest) {\n    const { pathname } = request.nextUrl;\n\n    // Allow public routes (exact match or prefix with /*)\n    const isPublic = publicRoutes.some((route) => {\n      if (route.endsWith('/*')) {\n        const prefix = route.slice(0, -1); // Remove the *\n        return pathname === prefix.slice(0, -1) || pathname.startsWith(prefix);\n      }\n      return pathname === route;\n    });\n\n    if (isPublic) {\n      return NextResponse.next();\n    }\n\n    // Allow static files, Next.js internals, and API routes\n    if (\n      pathname.startsWith('/_next') ||\n      pathname.startsWith('/api') ||\n      pathname.includes('.')\n    ) {\n      return NextResponse.next();\n    }\n\n    // Check for token in cookies (try new httpOnly cookie first, then legacy)\n    let token = request.cookies.get(tokenCookie)?.value;\n    if (!token) {\n      token = request.cookies.get(legacyTokenCookie)?.value;\n    }\n\n    // No token — redirect to sign-in\n    if (!token) {\n      const signInUrlObj = new URL(signInUrl, request.url);\n      signInUrlObj.searchParams.set('redirect_url', pathname);\n      return NextResponse.redirect(signInUrlObj);\n    }\n\n    // If not injecting headers, just let the request through\n    if (!injectHeaders) {\n      return NextResponse.next();\n    }\n\n    // Decode or verify the token to inject headers\n    let payload: Record<string, unknown> | null = null;\n\n    if (secretKey) {\n      // Full verification with secret key\n      payload = await verifyJwt(token, secretKey);\n      if (!payload) {\n        // Token verification failed — redirect to sign-in\n        const signInUrlObj = new URL(signInUrl, request.url);\n        signInUrlObj.searchParams.set('redirect_url', pathname);\n        return NextResponse.redirect(signInUrlObj);\n      }\n    } else {\n      // Decode without verification (less secure, but works without secret)\n      payload = decodeJwtPayload(token);\n    }\n\n    // Create a new response with injected headers\n    const response = NextResponse.next();\n\n    if (payload) {\n      // Inject user/org info as headers\n      if (payload.userId) {\n        response.headers.set('x-githat-user-id', String(payload.userId));\n      }\n      if (payload.email) {\n        response.headers.set('x-githat-email', String(payload.email));\n      }\n      if (payload.orgId) {\n        response.headers.set('x-githat-org-id', String(payload.orgId));\n      }\n      if (payload.orgSlug) {\n        response.headers.set('x-githat-org-slug', String(payload.orgSlug));\n      }\n      if (payload.orgRole) {\n        response.headers.set('x-githat-role', String(payload.orgRole));\n      }\n    }\n\n    return response;\n  };\n}\n"],"mappings":";AAAA,SAAS,oBAAoB;AAE7B,YAAY,UAAU;AAsDtB,SAAS,iBAAiB,OAA+C;AACvE,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,UAAU,KAAK,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC;AACzC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAe,UACb,OACA,WACyC;AACzC,MAAI;AACF,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,UAAM,EAAE,QAAQ,IAAI,MAAW,eAAU,OAAO,QAAQ;AAAA,MACtD,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,eAAe,UAAiC,CAAC,GAAG;AAClE,QAAM;AAAA,IACJ,eAAe,CAAC,GAAG;AAAA,IACnB,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,oBAAoB;AAAA,IACpB,gBAAgB;AAAA,IAChB;AAAA,EACF,IAAI;AAEJ,SAAO,eAAe,WAAW,SAAsB;AACrD,UAAM,EAAE,SAAS,IAAI,QAAQ;AAG7B,UAAM,WAAW,aAAa,KAAK,CAAC,UAAU;AAC5C,UAAI,MAAM,SAAS,IAAI,GAAG;AACxB,cAAM,SAAS,MAAM,MAAM,GAAG,EAAE;AAChC,eAAO,aAAa,OAAO,MAAM,GAAG,EAAE,KAAK,SAAS,WAAW,MAAM;AAAA,MACvE;AACA,aAAO,aAAa;AAAA,IACtB,CAAC;AAED,QAAI,UAAU;AACZ,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,QACE,SAAS,WAAW,QAAQ,KAC5B,SAAS,WAAW,MAAM,KAC1B,SAAS,SAAS,GAAG,GACrB;AACA,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,QAAQ,QAAQ,QAAQ,IAAI,WAAW,GAAG;AAC9C,QAAI,CAAC,OAAO;AACV,cAAQ,QAAQ,QAAQ,IAAI,iBAAiB,GAAG;AAAA,IAClD;AAGA,QAAI,CAAC,OAAO;AACV,YAAM,eAAe,IAAI,IAAI,WAAW,QAAQ,GAAG;AACnD,mBAAa,aAAa,IAAI,gBAAgB,QAAQ;AACtD,aAAO,aAAa,SAAS,YAAY;AAAA,IAC3C;AAGA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,UAA0C;AAE9C,QAAI,WAAW;AAEb,gBAAU,MAAM,UAAU,OAAO,SAAS;AAC1C,UAAI,CAAC,SAAS;AAEZ,cAAM,eAAe,IAAI,IAAI,WAAW,QAAQ,GAAG;AACnD,qBAAa,aAAa,IAAI,gBAAgB,QAAQ;AACtD,eAAO,aAAa,SAAS,YAAY;AAAA,MAC3C;AAAA,IACF,OAAO;AAEL,gBAAU,iBAAiB,KAAK;AAAA,IAClC;AAGA,UAAM,WAAW,aAAa,KAAK;AAEnC,QAAI,SAAS;AAEX,UAAI,QAAQ,QAAQ;AAClB,iBAAS,QAAQ,IAAI,oBAAoB,OAAO,QAAQ,MAAM,CAAC;AAAA,MACjE;AACA,UAAI,QAAQ,OAAO;AACjB,iBAAS,QAAQ,IAAI,kBAAkB,OAAO,QAAQ,KAAK,CAAC;AAAA,MAC9D;AACA,UAAI,QAAQ,OAAO;AACjB,iBAAS,QAAQ,IAAI,mBAAmB,OAAO,QAAQ,KAAK,CAAC;AAAA,MAC/D;AACA,UAAI,QAAQ,SAAS;AACnB,iBAAS,QAAQ,IAAI,qBAAqB,OAAO,QAAQ,OAAO,CAAC;AAAA,MACnE;AACA,UAAI,QAAQ,SAAS;AACnB,iBAAS,QAAQ,IAAI,iBAAiB,OAAO,QAAQ,OAAO,CAAC;AAAA,MAC/D;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/server.d.mts

@@ -0,0 +1,115 @@
+/**
+ * @githat/nextjs/server
+ *
+ * Server-side utilities for token verification in Next.js API routes and middleware.
+ * This module runs on the server only — do not import in client components.
+ */
+interface AuthPayload {
+    userId: string;
+    email: string;
+    orgId: string | null;
+    orgSlug: string | null;
+    role: 'owner' | 'admin' | 'member' | null;
+    tier: 'free' | 'basic' | 'pro' | 'enterprise' | null;
+}
+interface VerifyOptions {
+    /**
+     * Secret key for local JWT verification. If provided, tokens are verified
+     * locally without making an API call (~1ms vs ~50-100ms).
+     * Must match the JWT_SECRET used by the GitHat backend.
+     */
+    secretKey?: string;
+    /**
+     * API URL for remote token verification. Defaults to https://api.githat.io
+     */
+    apiUrl?: string;
+}
+interface OrgMetadata {
+    [key: string]: unknown;
+}
+declare const COOKIE_NAMES: {
+    readonly accessToken: "githat_access";
+    readonly refreshToken: "githat_refresh";
+};
+/**
+ * Verify a JWT token and return the decoded auth payload.
+ *
+ * Supports two verification modes:
+ * 1. Local verification (recommended for performance): Pass `secretKey` option
+ * 2. API-based verification: No secret key needed, calls api.githat.io/auth/verify
+ *
+ * @example Local verification (fast, ~1ms)
+ * ```ts
+ * const auth = await verifyToken(token, {
+ *   secretKey: process.env.GITHAT_SECRET_KEY
+ * });
+ * ```
+ *
+ * @example API-based verification (simpler setup)
+ * ```ts
+ * const auth = await verifyToken(token);
+ * ```
+ */
+declare function verifyToken(token: string, options?: VerifyOptions): Promise<AuthPayload>;
+/**
+ * Extract and verify the auth token from a Next.js request.
+ * Checks cookies first (for httpOnly cookie mode), then Authorization header.
+ *
+ * Returns null if no token is found (unauthenticated request).
+ * Throws if a token is found but is invalid/expired.
+ *
+ * @example In a Next.js API route
+ * ```ts
+ * import { getAuth } from '@githat/nextjs/server';
+ *
+ * export async function GET(request: Request) {
+ *   const auth = await getAuth(request, {
+ *     secretKey: process.env.GITHAT_SECRET_KEY
+ *   });
+ *
+ *   if (!auth) {
+ *     return Response.json({ error: 'Unauthorized' }, { status: 401 });
+ *   }
+ *
+ *   return Response.json({ userId: auth.userId });
+ * }
+ * ```
+ */
+declare function getAuth(request: Request, options?: VerifyOptions): Promise<AuthPayload | null>;
+/**
+ * Get organization metadata from the server.
+ *
+ * @example
+ * ```ts
+ * import { getOrgMetadata } from '@githat/nextjs/server';
+ *
+ * const meta = await getOrgMetadata(orgId, {
+ *   token: accessToken,
+ *   apiUrl: 'https://api.githat.io'
+ * });
+ * console.log(meta.stripeAccountId);
+ * ```
+ */
+declare function getOrgMetadata(orgId: string, options: {
+    token: string;
+    apiUrl?: string;
+}): Promise<OrgMetadata>;
+/**
+ * Update organization metadata from the server.
+ *
+ * @example
+ * ```ts
+ * import { updateOrgMetadata } from '@githat/nextjs/server';
+ *
+ * await updateOrgMetadata(orgId, { stripeAccountId: 'acct_xxx' }, {
+ *   token: accessToken,
+ *   apiUrl: 'https://api.githat.io'
+ * });
+ * ```
+ */
+declare function updateOrgMetadata(orgId: string, metadata: OrgMetadata, options: {
+    token: string;
+    apiUrl?: string;
+}): Promise<OrgMetadata>;
+
+export { type AuthPayload, COOKIE_NAMES, type OrgMetadata, type VerifyOptions, getAuth, getOrgMetadata, updateOrgMetadata, verifyToken };

package/dist/server.d.ts

@@ -0,0 +1,115 @@
+/**
+ * @githat/nextjs/server
+ *
+ * Server-side utilities for token verification in Next.js API routes and middleware.
+ * This module runs on the server only — do not import in client components.
+ */
+interface AuthPayload {
+    userId: string;
+    email: string;
+    orgId: string | null;
+    orgSlug: string | null;
+    role: 'owner' | 'admin' | 'member' | null;
+    tier: 'free' | 'basic' | 'pro' | 'enterprise' | null;
+}
+interface VerifyOptions {
+    /**
+     * Secret key for local JWT verification. If provided, tokens are verified
+     * locally without making an API call (~1ms vs ~50-100ms).
+     * Must match the JWT_SECRET used by the GitHat backend.
+     */
+    secretKey?: string;
+    /**
+     * API URL for remote token verification. Defaults to https://api.githat.io
+     */
+    apiUrl?: string;
+}
+interface OrgMetadata {
+    [key: string]: unknown;
+}
+declare const COOKIE_NAMES: {
+    readonly accessToken: "githat_access";
+    readonly refreshToken: "githat_refresh";
+};
+/**
+ * Verify a JWT token and return the decoded auth payload.
+ *
+ * Supports two verification modes:
+ * 1. Local verification (recommended for performance): Pass `secretKey` option
+ * 2. API-based verification: No secret key needed, calls api.githat.io/auth/verify
+ *
+ * @example Local verification (fast, ~1ms)
+ * ```ts
+ * const auth = await verifyToken(token, {
+ *   secretKey: process.env.GITHAT_SECRET_KEY
+ * });
+ * ```
+ *
+ * @example API-based verification (simpler setup)
+ * ```ts
+ * const auth = await verifyToken(token);
+ * ```
+ */
+declare function verifyToken(token: string, options?: VerifyOptions): Promise<AuthPayload>;
+/**
+ * Extract and verify the auth token from a Next.js request.
+ * Checks cookies first (for httpOnly cookie mode), then Authorization header.
+ *
+ * Returns null if no token is found (unauthenticated request).
+ * Throws if a token is found but is invalid/expired.
+ *
+ * @example In a Next.js API route
+ * ```ts
+ * import { getAuth } from '@githat/nextjs/server';
+ *
+ * export async function GET(request: Request) {
+ *   const auth = await getAuth(request, {
+ *     secretKey: process.env.GITHAT_SECRET_KEY
+ *   });
+ *
+ *   if (!auth) {
+ *     return Response.json({ error: 'Unauthorized' }, { status: 401 });
+ *   }
+ *
+ *   return Response.json({ userId: auth.userId });
+ * }
+ * ```
+ */
+declare function getAuth(request: Request, options?: VerifyOptions): Promise<AuthPayload | null>;
+/**
+ * Get organization metadata from the server.
+ *
+ * @example
+ * ```ts
+ * import { getOrgMetadata } from '@githat/nextjs/server';
+ *
+ * const meta = await getOrgMetadata(orgId, {
+ *   token: accessToken,
+ *   apiUrl: 'https://api.githat.io'
+ * });
+ * console.log(meta.stripeAccountId);
+ * ```
+ */
+declare function getOrgMetadata(orgId: string, options: {
+    token: string;
+    apiUrl?: string;
+}): Promise<OrgMetadata>;
+/**
+ * Update organization metadata from the server.
+ *
+ * @example
+ * ```ts
+ * import { updateOrgMetadata } from '@githat/nextjs/server';
+ *
+ * await updateOrgMetadata(orgId, { stripeAccountId: 'acct_xxx' }, {
+ *   token: accessToken,
+ *   apiUrl: 'https://api.githat.io'
+ * });
+ * ```
+ */
+declare function updateOrgMetadata(orgId: string, metadata: OrgMetadata, options: {
+    token: string;
+    apiUrl?: string;
+}): Promise<OrgMetadata>;
+
+export { type AuthPayload, COOKIE_NAMES, type OrgMetadata, type VerifyOptions, getAuth, getOrgMetadata, updateOrgMetadata, verifyToken };

package/dist/server.js

@@ -0,0 +1,186 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server.ts
+var server_exports = {};
+__export(server_exports, {
+  COOKIE_NAMES: () => COOKIE_NAMES,
+  getAuth: () => getAuth,
+  getOrgMetadata: () => getOrgMetadata,
+  updateOrgMetadata: () => updateOrgMetadata,
+  verifyToken: () => verifyToken
+});
+module.exports = __toCommonJS(server_exports);
+var jose = __toESM(require("jose"));
+
+// src/config.ts
+var DEFAULT_API_URL = "https://api.githat.io";
+
+// src/server.ts
+var COOKIE_NAMES = {
+  accessToken: "githat_access",
+  refreshToken: "githat_refresh"
+};
+async function verifyToken(token, options = {}) {
+  const { secretKey, apiUrl = DEFAULT_API_URL } = options;
+  if (secretKey) {
+    return verifyTokenLocally(token, secretKey);
+  }
+  return verifyTokenViaAPI(token, apiUrl);
+}
+async function verifyTokenLocally(token, secretKey) {
+  try {
+    const secret = new TextEncoder().encode(secretKey);
+    const { payload } = await jose.jwtVerify(token, secret, {
+      algorithms: ["HS256"]
+    });
+    if (payload.type && payload.type !== "user") {
+      throw new Error("Invalid token type");
+    }
+    if (payload.tokenType !== "access") {
+      throw new Error("Invalid token type");
+    }
+    return {
+      userId: payload.userId,
+      email: payload.email,
+      orgId: payload.orgId || null,
+      orgSlug: payload.orgSlug || null,
+      role: payload.orgRole || null,
+      tier: null
+      // Tier requires DB lookup, not available in local verification
+    };
+  } catch (err) {
+    if (err instanceof jose.errors.JWTExpired) {
+      throw new Error("Token expired");
+    }
+    if (err instanceof jose.errors.JWTClaimValidationFailed) {
+      throw new Error("Invalid token claims");
+    }
+    if (err instanceof jose.errors.JWTInvalid) {
+      throw new Error("Invalid token");
+    }
+    if (err instanceof jose.errors.JWSSignatureVerificationFailed) {
+      throw new Error("Invalid token signature");
+    }
+    throw err;
+  }
+}
+async function verifyTokenViaAPI(token, apiUrl) {
+  const response = await fetch(`${apiUrl}/auth/verify`, {
+    method: "GET",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json"
+    }
+  });
+  if (!response.ok) {
+    const data2 = await response.json().catch(() => ({}));
+    throw new Error(data2.error || "Token verification failed");
+  }
+  const data = await response.json();
+  return {
+    userId: data.userId,
+    email: data.email,
+    orgId: data.orgId,
+    orgSlug: data.orgSlug,
+    role: data.role,
+    tier: data.tier
+  };
+}
+async function getAuth(request, options = {}) {
+  const cookieHeader = request.headers.get("cookie");
+  let token = null;
+  if (cookieHeader) {
+    const cookies = parseCookies(cookieHeader);
+    token = cookies[COOKIE_NAMES.accessToken] || null;
+  }
+  if (!token) {
+    const authHeader = request.headers.get("authorization");
+    if (authHeader?.startsWith("Bearer ")) {
+      token = authHeader.slice(7);
+    }
+  }
+  if (!token) {
+    return null;
+  }
+  return verifyToken(token, options);
+}
+function parseCookies(cookieHeader) {
+  const cookies = {};
+  const pairs = cookieHeader.split(";");
+  for (const pair of pairs) {
+    const [name, ...rest] = pair.trim().split("=");
+    if (name) {
+      cookies[name] = rest.join("=");
+    }
+  }
+  return cookies;
+}
+async function getOrgMetadata(orgId, options) {
+  const { token, apiUrl = DEFAULT_API_URL } = options;
+  const response = await fetch(`${apiUrl}/orgs/${orgId}/metadata`, {
+    method: "GET",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json"
+    }
+  });
+  if (!response.ok) {
+    const data2 = await response.json().catch(() => ({}));
+    throw new Error(data2.error || "Failed to get org metadata");
+  }
+  const data = await response.json();
+  return data.metadata || {};
+}
+async function updateOrgMetadata(orgId, metadata, options) {
+  const { token, apiUrl = DEFAULT_API_URL } = options;
+  const response = await fetch(`${apiUrl}/orgs/${orgId}/metadata`, {
+    method: "PATCH",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify(metadata)
+  });
+  if (!response.ok) {
+    const data2 = await response.json().catch(() => ({}));
+    throw new Error(data2.error || "Failed to update org metadata");
+  }
+  const data = await response.json();
+  return data.metadata || {};
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  COOKIE_NAMES,
+  getAuth,
+  getOrgMetadata,
+  updateOrgMetadata,
+  verifyToken
+});
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server.ts","../src/config.ts"],"sourcesContent":["/**\n * @githat/nextjs/server\n *\n * Server-side utilities for token verification in Next.js API routes and middleware.\n * This module runs on the server only — do not import in client components.\n */\n\nimport * as jose from 'jose';\nimport { DEFAULT_API_URL } from './config';\n\n// ============================================================================\n// Types\n// ============================================================================\n\nexport interface AuthPayload {\n  userId: string;\n  email: string;\n  orgId: string | null;\n  orgSlug: string | null;\n  role: 'owner' | 'admin' | 'member' | null;\n  tier: 'free' | 'basic' | 'pro' | 'enterprise' | null;\n}\n\nexport interface VerifyOptions {\n  /**\n   * Secret key for local JWT verification. If provided, tokens are verified\n   * locally without making an API call (~1ms vs ~50-100ms).\n   * Must match the JWT_SECRET used by the GitHat backend.\n   */\n  secretKey?: string;\n\n  /**\n   * API URL for remote token verification. Defaults to https://api.githat.io\n   */\n  apiUrl?: string;\n}\n\nexport interface OrgMetadata {\n  [key: string]: unknown;\n}\n\n// ============================================================================\n// Cookie Names\n// ============================================================================\n\nexport const COOKIE_NAMES = {\n  accessToken: 'githat_access',\n  refreshToken: 'githat_refresh',\n} as const;\n\n// ============================================================================\n// Token Verification\n// ============================================================================\n\n/**\n * Verify a JWT token and return the decoded auth payload.\n *\n * Supports two verification modes:\n * 1. Local verification (recommended for performance): Pass `secretKey` option\n * 2. API-based verification: No secret key needed, calls api.githat.io/auth/verify\n *\n * @example Local verification (fast, ~1ms)\n * ```ts\n * const auth = await verifyToken(token, {\n *   secretKey: process.env.GITHAT_SECRET_KEY\n * });\n * ```\n *\n * @example API-based verification (simpler setup)\n * ```ts\n * const auth = await verifyToken(token);\n * ```\n */\nexport async function verifyToken(\n  token: string,\n  options: VerifyOptions = {}\n): Promise<AuthPayload> {\n  const { secretKey, apiUrl = DEFAULT_API_URL } = options;\n\n  if (secretKey) {\n    // Local verification using jose\n    return verifyTokenLocally(token, secretKey);\n  }\n\n  // API-based verification\n  return verifyTokenViaAPI(token, apiUrl);\n}\n\n/**\n * Verify token locally using the secret key (no network call)\n */\nasync function verifyTokenLocally(\n  token: string,\n  secretKey: string\n): Promise<AuthPayload> {\n  try {\n    const secret = new TextEncoder().encode(secretKey);\n    const { payload } = await jose.jwtVerify(token, secret, {\n      algorithms: ['HS256'],\n    });\n\n    // Validate this is a user access token\n    if (payload.type && payload.type !== 'user') {\n      throw new Error('Invalid token type');\n    }\n    if (payload.tokenType !== 'access') {\n      throw new Error('Invalid token type');\n    }\n\n    return {\n      userId: payload.userId as string,\n      email: payload.email as string,\n      orgId: (payload.orgId as string) || null,\n      orgSlug: (payload.orgSlug as string) || null,\n      role: (payload.orgRole as AuthPayload['role']) || null,\n      tier: null, // Tier requires DB lookup, not available in local verification\n    };\n  } catch (err) {\n    if (err instanceof jose.errors.JWTExpired) {\n      throw new Error('Token expired');\n    }\n    if (err instanceof jose.errors.JWTClaimValidationFailed) {\n      throw new Error('Invalid token claims');\n    }\n    if (err instanceof jose.errors.JWTInvalid) {\n      throw new Error('Invalid token');\n    }\n    // JWSSignatureVerificationFailed is used for invalid signatures\n    if (err instanceof jose.errors.JWSSignatureVerificationFailed) {\n      throw new Error('Invalid token signature');\n    }\n    throw err;\n  }\n}\n\n/**\n * Verify token via API call to api.githat.io/auth/verify\n */\nasync function verifyTokenViaAPI(\n  token: string,\n  apiUrl: string\n): Promise<AuthPayload> {\n  const response = await fetch(`${apiUrl}/auth/verify`, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${token}`,\n      'Content-Type': 'application/json',\n    },\n  });\n\n  if (!response.ok) {\n    const data = await response.json().catch(() => ({}));\n    throw new Error(data.error || 'Token verification failed');\n  }\n\n  const data = await response.json();\n  return {\n    userId: data.userId,\n    email: data.email,\n    orgId: data.orgId,\n    orgSlug: data.orgSlug,\n    role: data.role,\n    tier: data.tier,\n  };\n}\n\n// ============================================================================\n// Request Helpers\n// ============================================================================\n\n/**\n * Extract and verify the auth token from a Next.js request.\n * Checks cookies first (for httpOnly cookie mode), then Authorization header.\n *\n * Returns null if no token is found (unauthenticated request).\n * Throws if a token is found but is invalid/expired.\n *\n * @example In a Next.js API route\n * ```ts\n * import { getAuth } from '@githat/nextjs/server';\n *\n * export async function GET(request: Request) {\n *   const auth = await getAuth(request, {\n *     secretKey: process.env.GITHAT_SECRET_KEY\n *   });\n *\n *   if (!auth) {\n *     return Response.json({ error: 'Unauthorized' }, { status: 401 });\n *   }\n *\n *   return Response.json({ userId: auth.userId });\n * }\n * ```\n */\nexport async function getAuth(\n  request: Request,\n  options: VerifyOptions = {}\n): Promise<AuthPayload | null> {\n  // Try to get token from cookie first (httpOnly cookie mode)\n  const cookieHeader = request.headers.get('cookie');\n  let token: string | null = null;\n\n  if (cookieHeader) {\n    const cookies = parseCookies(cookieHeader);\n    token = cookies[COOKIE_NAMES.accessToken] || null;\n  }\n\n  // Fallback to Authorization header\n  if (!token) {\n    const authHeader = request.headers.get('authorization');\n    if (authHeader?.startsWith('Bearer ')) {\n      token = authHeader.slice(7);\n    }\n  }\n\n  // No token found — return null (unauthenticated)\n  if (!token) {\n    return null;\n  }\n\n  // Verify the token\n  return verifyToken(token, options);\n}\n\n/**\n * Parse cookies from a cookie header string\n */\nfunction parseCookies(cookieHeader: string): Record<string, string> {\n  const cookies: Record<string, string> = {};\n  const pairs = cookieHeader.split(';');\n\n  for (const pair of pairs) {\n    const [name, ...rest] = pair.trim().split('=');\n    if (name) {\n      cookies[name] = rest.join('=');\n    }\n  }\n\n  return cookies;\n}\n\n// ============================================================================\n// Org Metadata (Server-side)\n// ============================================================================\n\n/**\n * Get organization metadata from the server.\n *\n * @example\n * ```ts\n * import { getOrgMetadata } from '@githat/nextjs/server';\n *\n * const meta = await getOrgMetadata(orgId, {\n *   token: accessToken,\n *   apiUrl: 'https://api.githat.io'\n * });\n * console.log(meta.stripeAccountId);\n * ```\n */\nexport async function getOrgMetadata(\n  orgId: string,\n  options: { token: string; apiUrl?: string }\n): Promise<OrgMetadata> {\n  const { token, apiUrl = DEFAULT_API_URL } = options;\n\n  const response = await fetch(`${apiUrl}/orgs/${orgId}/metadata`, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${token}`,\n      'Content-Type': 'application/json',\n    },\n  });\n\n  if (!response.ok) {\n    const data = await response.json().catch(() => ({}));\n    throw new Error(data.error || 'Failed to get org metadata');\n  }\n\n  const data = await response.json();\n  return data.metadata || {};\n}\n\n/**\n * Update organization metadata from the server.\n *\n * @example\n * ```ts\n * import { updateOrgMetadata } from '@githat/nextjs/server';\n *\n * await updateOrgMetadata(orgId, { stripeAccountId: 'acct_xxx' }, {\n *   token: accessToken,\n *   apiUrl: 'https://api.githat.io'\n * });\n * ```\n */\nexport async function updateOrgMetadata(\n  orgId: string,\n  metadata: OrgMetadata,\n  options: { token: string; apiUrl?: string }\n): Promise<OrgMetadata> {\n  const { token, apiUrl = DEFAULT_API_URL } = options;\n\n  const response = await fetch(`${apiUrl}/orgs/${orgId}/metadata`, {\n    method: 'PATCH',\n    headers: {\n      Authorization: `Bearer ${token}`,\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify(metadata),\n  });\n\n  if (!response.ok) {\n    const data = await response.json().catch(() => ({}));\n    throw new Error(data.error || 'Failed to update org metadata');\n  }\n\n  const data = await response.json();\n  return data.metadata || {};\n}\n","import type { GitHatConfig } from './types';\n\nexport const DEFAULT_API_URL = 'https://api.githat.io';\n\nexport const TOKEN_KEYS = {\n  accessToken: 'githat_access_token',\n  refreshToken: 'githat_refresh_token',\n  user: 'githat_user',\n  org: 'githat_org',\n} as const;\n\nexport const COOKIE_NAMES = {\n  accessToken: 'githat_access',\n  refreshToken: 'githat_refresh',\n} as const;\n\nexport function resolveConfig(config: GitHatConfig): Required<GitHatConfig> {\n  return {\n    publishableKey: config.publishableKey,\n    apiUrl: config.apiUrl || DEFAULT_API_URL,\n    signInUrl: config.signInUrl || '/sign-in',\n    signUpUrl: config.signUpUrl || '/sign-up',\n    afterSignInUrl: config.afterSignInUrl || '/dashboard',\n    afterSignOutUrl: config.afterSignOutUrl || '/',\n    tokenStorage: config.tokenStorage || 'localStorage',\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,WAAsB;;;ACLf,IAAM,kBAAkB;;;AD2CxB,IAAM,eAAe;AAAA,EAC1B,aAAa;AAAA,EACb,cAAc;AAChB;AAyBA,eAAsB,YACpB,OACA,UAAyB,CAAC,GACJ;AACtB,QAAM,EAAE,WAAW,SAAS,gBAAgB,IAAI;AAEhD,MAAI,WAAW;AAEb,WAAO,mBAAmB,OAAO,SAAS;AAAA,EAC5C;AAGA,SAAO,kBAAkB,OAAO,MAAM;AACxC;AAKA,eAAe,mBACb,OACA,WACsB;AACtB,MAAI;AACF,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,UAAM,EAAE,QAAQ,IAAI,MAAW,eAAU,OAAO,QAAQ;AAAA,MACtD,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AAGD,QAAI,QAAQ,QAAQ,QAAQ,SAAS,QAAQ;AAC3C,YAAM,IAAI,MAAM,oBAAoB;AAAA,IACtC;AACA,QAAI,QAAQ,cAAc,UAAU;AAClC,YAAM,IAAI,MAAM,oBAAoB;AAAA,IACtC;AAEA,WAAO;AAAA,MACL,QAAQ,QAAQ;AAAA,MAChB,OAAO,QAAQ;AAAA,MACf,OAAQ,QAAQ,SAAoB;AAAA,MACpC,SAAU,QAAQ,WAAsB;AAAA,MACxC,MAAO,QAAQ,WAAmC;AAAA,MAClD,MAAM;AAAA;AAAA,IACR;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAoB,YAAO,YAAY;AACzC,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AACA,QAAI,eAAoB,YAAO,0BAA0B;AACvD,YAAM,IAAI,MAAM,sBAAsB;AAAA,IACxC;AACA,QAAI,eAAoB,YAAO,YAAY;AACzC,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,eAAoB,YAAO,gCAAgC;AAC7D,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC3C;AACA,UAAM;AAAA,EACR;AACF;AAKA,eAAe,kBACb,OACA,QACsB;AACtB,QAAM,WAAW,MAAM,MAAM,GAAG,MAAM,gBAAgB;AAAA,IACpD,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,UAAU,KAAK;AAAA,MAC9B,gBAAgB;AAAA,IAClB;AAAA,EACF,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAMA,QAAO,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACnD,UAAM,IAAI,MAAMA,MAAK,SAAS,2BAA2B;AAAA,EAC3D;AAEA,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb,OAAO,KAAK;AAAA,IACZ,OAAO,KAAK;AAAA,IACZ,SAAS,KAAK;AAAA,IACd,MAAM,KAAK;AAAA,IACX,MAAM,KAAK;AAAA,EACb;AACF;AA8BA,eAAsB,QACpB,SACA,UAAyB,CAAC,GACG;AAE7B,QAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ;AACjD,MAAI,QAAuB;AAE3B,MAAI,cAAc;AAChB,UAAM,UAAU,aAAa,YAAY;AACzC,YAAQ,QAAQ,aAAa,WAAW,KAAK;AAAA,EAC/C;AAGA,MAAI,CAAC,OAAO;AACV,UAAM,aAAa,QAAQ,QAAQ,IAAI,eAAe;AACtD,QAAI,YAAY,WAAW,SAAS,GAAG;AACrC,cAAQ,WAAW,MAAM,CAAC;AAAA,IAC5B;AAAA,EACF;AAGA,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AAGA,SAAO,YAAY,OAAO,OAAO;AACnC;AAKA,SAAS,aAAa,cAA8C;AAClE,QAAM,UAAkC,CAAC;AACzC,QAAM,QAAQ,aAAa,MAAM,GAAG;AAEpC,aAAW,QAAQ,OAAO;AACxB,UAAM,CAAC,MAAM,GAAG,IAAI,IAAI,KAAK,KAAK,EAAE,MAAM,GAAG;AAC7C,QAAI,MAAM;AACR,cAAQ,IAAI,IAAI,KAAK,KAAK,GAAG;AAAA,IAC/B;AAAA,EACF;AAEA,SAAO;AACT;AAoBA,eAAsB,eACpB,OACA,SACsB;AACtB,QAAM,EAAE,OAAO,SAAS,gBAAgB,IAAI;AAE5C,QAAM,WAAW,MAAM,MAAM,GAAG,MAAM,SAAS,KAAK,aAAa;AAAA,IAC/D,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,UAAU,KAAK;AAAA,MAC9B,gBAAgB;AAAA,IAClB;AAAA,EACF,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAMA,QAAO,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACnD,UAAM,IAAI,MAAMA,MAAK,SAAS,4BAA4B;AAAA,EAC5D;AAEA,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,SAAO,KAAK,YAAY,CAAC;AAC3B;AAeA,eAAsB,kBACpB,OACA,UACA,SACsB;AACtB,QAAM,EAAE,OAAO,SAAS,gBAAgB,IAAI;AAE5C,QAAM,WAAW,MAAM,MAAM,GAAG,MAAM,SAAS,KAAK,aAAa;AAAA,IAC/D,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,UAAU,KAAK;AAAA,MAC9B,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,KAAK,UAAU,QAAQ;AAAA,EAC/B,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAMA,QAAO,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACnD,UAAM,IAAI,MAAMA,MAAK,SAAS,+BAA+B;AAAA,EAC/D;AAEA,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,SAAO,KAAK,YAAY,CAAC;AAC3B;","names":["data"]}

package/dist/server.mjs

@@ -0,0 +1,147 @@
+// src/server.ts
+import * as jose from "jose";
+
+// src/config.ts
+var DEFAULT_API_URL = "https://api.githat.io";
+
+// src/server.ts
+var COOKIE_NAMES = {
+  accessToken: "githat_access",
+  refreshToken: "githat_refresh"
+};
+async function verifyToken(token, options = {}) {
+  const { secretKey, apiUrl = DEFAULT_API_URL } = options;
+  if (secretKey) {
+    return verifyTokenLocally(token, secretKey);
+  }
+  return verifyTokenViaAPI(token, apiUrl);
+}
+async function verifyTokenLocally(token, secretKey) {
+  try {
+    const secret = new TextEncoder().encode(secretKey);
+    const { payload } = await jose.jwtVerify(token, secret, {
+      algorithms: ["HS256"]
+    });
+    if (payload.type && payload.type !== "user") {
+      throw new Error("Invalid token type");
+    }
+    if (payload.tokenType !== "access") {
+      throw new Error("Invalid token type");
+    }
+    return {
+      userId: payload.userId,
+      email: payload.email,
+      orgId: payload.orgId || null,
+      orgSlug: payload.orgSlug || null,
+      role: payload.orgRole || null,
+      tier: null
+      // Tier requires DB lookup, not available in local verification
+    };
+  } catch (err) {
+    if (err instanceof jose.errors.JWTExpired) {
+      throw new Error("Token expired");
+    }
+    if (err instanceof jose.errors.JWTClaimValidationFailed) {
+      throw new Error("Invalid token claims");
+    }
+    if (err instanceof jose.errors.JWTInvalid) {
+      throw new Error("Invalid token");
+    }
+    if (err instanceof jose.errors.JWSSignatureVerificationFailed) {
+      throw new Error("Invalid token signature");
+    }
+    throw err;
+  }
+}
+async function verifyTokenViaAPI(token, apiUrl) {
+  const response = await fetch(`${apiUrl}/auth/verify`, {
+    method: "GET",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json"
+    }
+  });
+  if (!response.ok) {
+    const data2 = await response.json().catch(() => ({}));
+    throw new Error(data2.error || "Token verification failed");
+  }
+  const data = await response.json();
+  return {
+    userId: data.userId,
+    email: data.email,
+    orgId: data.orgId,
+    orgSlug: data.orgSlug,
+    role: data.role,
+    tier: data.tier
+  };
+}
+async function getAuth(request, options = {}) {
+  const cookieHeader = request.headers.get("cookie");
+  let token = null;
+  if (cookieHeader) {
+    const cookies = parseCookies(cookieHeader);
+    token = cookies[COOKIE_NAMES.accessToken] || null;
+  }
+  if (!token) {
+    const authHeader = request.headers.get("authorization");
+    if (authHeader?.startsWith("Bearer ")) {
+      token = authHeader.slice(7);
+    }
+  }
+  if (!token) {
+    return null;
+  }
+  return verifyToken(token, options);
+}
+function parseCookies(cookieHeader) {
+  const cookies = {};
+  const pairs = cookieHeader.split(";");
+  for (const pair of pairs) {
+    const [name, ...rest] = pair.trim().split("=");
+    if (name) {
+      cookies[name] = rest.join("=");
+    }
+  }
+  return cookies;
+}
+async function getOrgMetadata(orgId, options) {
+  const { token, apiUrl = DEFAULT_API_URL } = options;
+  const response = await fetch(`${apiUrl}/orgs/${orgId}/metadata`, {
+    method: "GET",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json"
+    }
+  });
+  if (!response.ok) {
+    const data2 = await response.json().catch(() => ({}));
+    throw new Error(data2.error || "Failed to get org metadata");
+  }
+  const data = await response.json();
+  return data.metadata || {};
+}
+async function updateOrgMetadata(orgId, metadata, options) {
+  const { token, apiUrl = DEFAULT_API_URL } = options;
+  const response = await fetch(`${apiUrl}/orgs/${orgId}/metadata`, {
+    method: "PATCH",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify(metadata)
+  });
+  if (!response.ok) {
+    const data2 = await response.json().catch(() => ({}));
+    throw new Error(data2.error || "Failed to update org metadata");
+  }
+  const data = await response.json();
+  return data.metadata || {};
+}
+export {
+  COOKIE_NAMES,
+  getAuth,
+  getOrgMetadata,
+  updateOrgMetadata,
+  verifyToken
+};
+//# sourceMappingURL=server.mjs.map

package/dist/server.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server.ts","../src/config.ts"],"sourcesContent":["/**\n * @githat/nextjs/server\n *\n * Server-side utilities for token verification in Next.js API routes and middleware.\n * This module runs on the server only — do not import in client components.\n */\n\nimport * as jose from 'jose';\nimport { DEFAULT_API_URL } from './config';\n\n// ============================================================================\n// Types\n// ============================================================================\n\nexport interface AuthPayload {\n  userId: string;\n  email: string;\n  orgId: string | null;\n  orgSlug: string | null;\n  role: 'owner' | 'admin' | 'member' | null;\n  tier: 'free' | 'basic' | 'pro' | 'enterprise' | null;\n}\n\nexport interface VerifyOptions {\n  /**\n   * Secret key for local JWT verification. If provided, tokens are verified\n   * locally without making an API call (~1ms vs ~50-100ms).\n   * Must match the JWT_SECRET used by the GitHat backend.\n   */\n  secretKey?: string;\n\n  /**\n   * API URL for remote token verification. Defaults to https://api.githat.io\n   */\n  apiUrl?: string;\n}\n\nexport interface OrgMetadata {\n  [key: string]: unknown;\n}\n\n// ============================================================================\n// Cookie Names\n// ============================================================================\n\nexport const COOKIE_NAMES = {\n  accessToken: 'githat_access',\n  refreshToken: 'githat_refresh',\n} as const;\n\n// ============================================================================\n// Token Verification\n// ============================================================================\n\n/**\n * Verify a JWT token and return the decoded auth payload.\n *\n * Supports two verification modes:\n * 1. Local verification (recommended for performance): Pass `secretKey` option\n * 2. API-based verification: No secret key needed, calls api.githat.io/auth/verify\n *\n * @example Local verification (fast, ~1ms)\n * ```ts\n * const auth = await verifyToken(token, {\n *   secretKey: process.env.GITHAT_SECRET_KEY\n * });\n * ```\n *\n * @example API-based verification (simpler setup)\n * ```ts\n * const auth = await verifyToken(token);\n * ```\n */\nexport async function verifyToken(\n  token: string,\n  options: VerifyOptions = {}\n): Promise<AuthPayload> {\n  const { secretKey, apiUrl = DEFAULT_API_URL } = options;\n\n  if (secretKey) {\n    // Local verification using jose\n    return verifyTokenLocally(token, secretKey);\n  }\n\n  // API-based verification\n  return verifyTokenViaAPI(token, apiUrl);\n}\n\n/**\n * Verify token locally using the secret key (no network call)\n */\nasync function verifyTokenLocally(\n  token: string,\n  secretKey: string\n): Promise<AuthPayload> {\n  try {\n    const secret = new TextEncoder().encode(secretKey);\n    const { payload } = await jose.jwtVerify(token, secret, {\n      algorithms: ['HS256'],\n    });\n\n    // Validate this is a user access token\n    if (payload.type && payload.type !== 'user') {\n      throw new Error('Invalid token type');\n    }\n    if (payload.tokenType !== 'access') {\n      throw new Error('Invalid token type');\n    }\n\n    return {\n      userId: payload.userId as string,\n      email: payload.email as string,\n      orgId: (payload.orgId as string) || null,\n      orgSlug: (payload.orgSlug as string) || null,\n      role: (payload.orgRole as AuthPayload['role']) || null,\n      tier: null, // Tier requires DB lookup, not available in local verification\n    };\n  } catch (err) {\n    if (err instanceof jose.errors.JWTExpired) {\n      throw new Error('Token expired');\n    }\n    if (err instanceof jose.errors.JWTClaimValidationFailed) {\n      throw new Error('Invalid token claims');\n    }\n    if (err instanceof jose.errors.JWTInvalid) {\n      throw new Error('Invalid token');\n    }\n    // JWSSignatureVerificationFailed is used for invalid signatures\n    if (err instanceof jose.errors.JWSSignatureVerificationFailed) {\n      throw new Error('Invalid token signature');\n    }\n    throw err;\n  }\n}\n\n/**\n * Verify token via API call to api.githat.io/auth/verify\n */\nasync function verifyTokenViaAPI(\n  token: string,\n  apiUrl: string\n): Promise<AuthPayload> {\n  const response = await fetch(`${apiUrl}/auth/verify`, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${token}`,\n      'Content-Type': 'application/json',\n    },\n  });\n\n  if (!response.ok) {\n    const data = await response.json().catch(() => ({}));\n    throw new Error(data.error || 'Token verification failed');\n  }\n\n  const data = await response.json();\n  return {\n    userId: data.userId,\n    email: data.email,\n    orgId: data.orgId,\n    orgSlug: data.orgSlug,\n    role: data.role,\n    tier: data.tier,\n  };\n}\n\n// ============================================================================\n// Request Helpers\n// ============================================================================\n\n/**\n * Extract and verify the auth token from a Next.js request.\n * Checks cookies first (for httpOnly cookie mode), then Authorization header.\n *\n * Returns null if no token is found (unauthenticated request).\n * Throws if a token is found but is invalid/expired.\n *\n * @example In a Next.js API route\n * ```ts\n * import { getAuth } from '@githat/nextjs/server';\n *\n * export async function GET(request: Request) {\n *   const auth = await getAuth(request, {\n *     secretKey: process.env.GITHAT_SECRET_KEY\n *   });\n *\n *   if (!auth) {\n *     return Response.json({ error: 'Unauthorized' }, { status: 401 });\n *   }\n *\n *   return Response.json({ userId: auth.userId });\n * }\n * ```\n */\nexport async function getAuth(\n  request: Request,\n  options: VerifyOptions = {}\n): Promise<AuthPayload | null> {\n  // Try to get token from cookie first (httpOnly cookie mode)\n  const cookieHeader = request.headers.get('cookie');\n  let token: string | null = null;\n\n  if (cookieHeader) {\n    const cookies = parseCookies(cookieHeader);\n    token = cookies[COOKIE_NAMES.accessToken] || null;\n  }\n\n  // Fallback to Authorization header\n  if (!token) {\n    const authHeader = request.headers.get('authorization');\n    if (authHeader?.startsWith('Bearer ')) {\n      token = authHeader.slice(7);\n    }\n  }\n\n  // No token found — return null (unauthenticated)\n  if (!token) {\n    return null;\n  }\n\n  // Verify the token\n  return verifyToken(token, options);\n}\n\n/**\n * Parse cookies from a cookie header string\n */\nfunction parseCookies(cookieHeader: string): Record<string, string> {\n  const cookies: Record<string, string> = {};\n  const pairs = cookieHeader.split(';');\n\n  for (const pair of pairs) {\n    const [name, ...rest] = pair.trim().split('=');\n    if (name) {\n      cookies[name] = rest.join('=');\n    }\n  }\n\n  return cookies;\n}\n\n// ============================================================================\n// Org Metadata (Server-side)\n// ============================================================================\n\n/**\n * Get organization metadata from the server.\n *\n * @example\n * ```ts\n * import { getOrgMetadata } from '@githat/nextjs/server';\n *\n * const meta = await getOrgMetadata(orgId, {\n *   token: accessToken,\n *   apiUrl: 'https://api.githat.io'\n * });\n * console.log(meta.stripeAccountId);\n * ```\n */\nexport async function getOrgMetadata(\n  orgId: string,\n  options: { token: string; apiUrl?: string }\n): Promise<OrgMetadata> {\n  const { token, apiUrl = DEFAULT_API_URL } = options;\n\n  const response = await fetch(`${apiUrl}/orgs/${orgId}/metadata`, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${token}`,\n      'Content-Type': 'application/json',\n    },\n  });\n\n  if (!response.ok) {\n    const data = await response.json().catch(() => ({}));\n    throw new Error(data.error || 'Failed to get org metadata');\n  }\n\n  const data = await response.json();\n  return data.metadata || {};\n}\n\n/**\n * Update organization metadata from the server.\n *\n * @example\n * ```ts\n * import { updateOrgMetadata } from '@githat/nextjs/server';\n *\n * await updateOrgMetadata(orgId, { stripeAccountId: 'acct_xxx' }, {\n *   token: accessToken,\n *   apiUrl: 'https://api.githat.io'\n * });\n * ```\n */\nexport async function updateOrgMetadata(\n  orgId: string,\n  metadata: OrgMetadata,\n  options: { token: string; apiUrl?: string }\n): Promise<OrgMetadata> {\n  const { token, apiUrl = DEFAULT_API_URL } = options;\n\n  const response = await fetch(`${apiUrl}/orgs/${orgId}/metadata`, {\n    method: 'PATCH',\n    headers: {\n      Authorization: `Bearer ${token}`,\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify(metadata),\n  });\n\n  if (!response.ok) {\n    const data = await response.json().catch(() => ({}));\n    throw new Error(data.error || 'Failed to update org metadata');\n  }\n\n  const data = await response.json();\n  return data.metadata || {};\n}\n","import type { GitHatConfig } from './types';\n\nexport const DEFAULT_API_URL = 'https://api.githat.io';\n\nexport const TOKEN_KEYS = {\n  accessToken: 'githat_access_token',\n  refreshToken: 'githat_refresh_token',\n  user: 'githat_user',\n  org: 'githat_org',\n} as const;\n\nexport const COOKIE_NAMES = {\n  accessToken: 'githat_access',\n  refreshToken: 'githat_refresh',\n} as const;\n\nexport function resolveConfig(config: GitHatConfig): Required<GitHatConfig> {\n  return {\n    publishableKey: config.publishableKey,\n    apiUrl: config.apiUrl || DEFAULT_API_URL,\n    signInUrl: config.signInUrl || '/sign-in',\n    signUpUrl: config.signUpUrl || '/sign-up',\n    afterSignInUrl: config.afterSignInUrl || '/dashboard',\n    afterSignOutUrl: config.afterSignOutUrl || '/',\n    tokenStorage: config.tokenStorage || 'localStorage',\n  };\n}\n"],"mappings":";AAOA,YAAY,UAAU;;;ACLf,IAAM,kBAAkB;;;AD2CxB,IAAM,eAAe;AAAA,EAC1B,aAAa;AAAA,EACb,cAAc;AAChB;AAyBA,eAAsB,YACpB,OACA,UAAyB,CAAC,GACJ;AACtB,QAAM,EAAE,WAAW,SAAS,gBAAgB,IAAI;AAEhD,MAAI,WAAW;AAEb,WAAO,mBAAmB,OAAO,SAAS;AAAA,EAC5C;AAGA,SAAO,kBAAkB,OAAO,MAAM;AACxC;AAKA,eAAe,mBACb,OACA,WACsB;AACtB,MAAI;AACF,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,UAAM,EAAE,QAAQ,IAAI,MAAW,eAAU,OAAO,QAAQ;AAAA,MACtD,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AAGD,QAAI,QAAQ,QAAQ,QAAQ,SAAS,QAAQ;AAC3C,YAAM,IAAI,MAAM,oBAAoB;AAAA,IACtC;AACA,QAAI,QAAQ,cAAc,UAAU;AAClC,YAAM,IAAI,MAAM,oBAAoB;AAAA,IACtC;AAEA,WAAO;AAAA,MACL,QAAQ,QAAQ;AAAA,MAChB,OAAO,QAAQ;AAAA,MACf,OAAQ,QAAQ,SAAoB;AAAA,MACpC,SAAU,QAAQ,WAAsB;AAAA,MACxC,MAAO,QAAQ,WAAmC;AAAA,MAClD,MAAM;AAAA;AAAA,IACR;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAoB,YAAO,YAAY;AACzC,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AACA,QAAI,eAAoB,YAAO,0BAA0B;AACvD,YAAM,IAAI,MAAM,sBAAsB;AAAA,IACxC;AACA,QAAI,eAAoB,YAAO,YAAY;AACzC,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,eAAoB,YAAO,gCAAgC;AAC7D,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC3C;AACA,UAAM;AAAA,EACR;AACF;AAKA,eAAe,kBACb,OACA,QACsB;AACtB,QAAM,WAAW,MAAM,MAAM,GAAG,MAAM,gBAAgB;AAAA,IACpD,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,UAAU,KAAK;AAAA,MAC9B,gBAAgB;AAAA,IAClB;AAAA,EACF,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAMA,QAAO,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACnD,UAAM,IAAI,MAAMA,MAAK,SAAS,2BAA2B;AAAA,EAC3D;AAEA,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb,OAAO,KAAK;AAAA,IACZ,OAAO,KAAK;AAAA,IACZ,SAAS,KAAK;AAAA,IACd,MAAM,KAAK;AAAA,IACX,MAAM,KAAK;AAAA,EACb;AACF;AA8BA,eAAsB,QACpB,SACA,UAAyB,CAAC,GACG;AAE7B,QAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ;AACjD,MAAI,QAAuB;AAE3B,MAAI,cAAc;AAChB,UAAM,UAAU,aAAa,YAAY;AACzC,YAAQ,QAAQ,aAAa,WAAW,KAAK;AAAA,EAC/C;AAGA,MAAI,CAAC,OAAO;AACV,UAAM,aAAa,QAAQ,QAAQ,IAAI,eAAe;AACtD,QAAI,YAAY,WAAW,SAAS,GAAG;AACrC,cAAQ,WAAW,MAAM,CAAC;AAAA,IAC5B;AAAA,EACF;AAGA,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AAGA,SAAO,YAAY,OAAO,OAAO;AACnC;AAKA,SAAS,aAAa,cAA8C;AAClE,QAAM,UAAkC,CAAC;AACzC,QAAM,QAAQ,aAAa,MAAM,GAAG;AAEpC,aAAW,QAAQ,OAAO;AACxB,UAAM,CAAC,MAAM,GAAG,IAAI,IAAI,KAAK,KAAK,EAAE,MAAM,GAAG;AAC7C,QAAI,MAAM;AACR,cAAQ,IAAI,IAAI,KAAK,KAAK,GAAG;AAAA,IAC/B;AAAA,EACF;AAEA,SAAO;AACT;AAoBA,eAAsB,eACpB,OACA,SACsB;AACtB,QAAM,EAAE,OAAO,SAAS,gBAAgB,IAAI;AAE5C,QAAM,WAAW,MAAM,MAAM,GAAG,MAAM,SAAS,KAAK,aAAa;AAAA,IAC/D,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,UAAU,KAAK;AAAA,MAC9B,gBAAgB;AAAA,IAClB;AAAA,EACF,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAMA,QAAO,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACnD,UAAM,IAAI,MAAMA,MAAK,SAAS,4BAA4B;AAAA,EAC5D;AAEA,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,SAAO,KAAK,YAAY,CAAC;AAC3B;AAeA,eAAsB,kBACpB,OACA,UACA,SACsB;AACtB,QAAM,EAAE,OAAO,SAAS,gBAAgB,IAAI;AAE5C,QAAM,WAAW,MAAM,MAAM,GAAG,MAAM,SAAS,KAAK,aAAa;AAAA,IAC/D,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,UAAU,KAAK;AAAA,MAC9B,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,KAAK,UAAU,QAAQ;AAAA,EAC/B,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAMA,QAAO,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACnD,UAAM,IAAI,MAAMA,MAAK,SAAS,+BAA+B;AAAA,EAC/D;AAEA,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,SAAO,KAAK,YAAY,CAAC;AAC3B;","names":["data"]}