@githat/nextjs 0.3.1 → 0.4.0

package/dist/middleware.d.mts

@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
 
-interface AuthMiddlewareOptions {
+interface AuthHandlerOptions {
     /**
      * Routes that don't require authentication.
      * Supports exact paths ('/') and path prefixes ('/public/*').
@@ -42,6 +42,38 @@ interface AuthMiddlewareOptions {
      */
     secretKey?: string;
 }
-declare function authMiddleware(options?: AuthMiddlewareOptions): (request: NextRequest) => Promise<NextResponse<unknown>>;
 
-export { authMiddleware };
+/**
+ * Options for the authMiddleware function.
+ * @see AuthHandlerOptions for detailed property documentation.
+ */
+interface AuthMiddlewareOptions extends AuthHandlerOptions {
+}
+/**
+ * Creates an auth middleware handler for Next.js 14/15.
+ *
+ * @deprecated For Next.js 16+, use `authProxy` from `@githat/nextjs/proxy` instead.
+ * Next.js 16 renamed middleware.ts to proxy.ts. This export continues to work
+ * for Next.js 14/15 applications.
+ *
+ * @example
+ * ```typescript
+ * // middleware.ts (Next.js 14/15)
+ * import { authMiddleware } from '@githat/nextjs/middleware';
+ *
+ * export default authMiddleware({
+ *   publicRoutes: ['/', '/about', '/pricing'],
+ *   signInUrl: '/sign-in',
+ * });
+ *
+ * export const config = {
+ *   matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
+ * };
+ * ```
+ *
+ * @param options - Configuration options for the auth middleware
+ * @returns A middleware function compatible with Next.js 14/15 middleware.ts convention
+ */
+declare function authMiddleware(options?: AuthMiddlewareOptions): (request: NextRequest) => Promise<NextResponse>;
+
+export { type AuthHandlerOptions, type AuthMiddlewareOptions as AuthMiddlewareConfig, type AuthMiddlewareOptions, authMiddleware };

package/dist/middleware.d.ts

@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
 
-interface AuthMiddlewareOptions {
+interface AuthHandlerOptions {
     /**
      * Routes that don't require authentication.
      * Supports exact paths ('/') and path prefixes ('/public/*').
@@ -42,6 +42,38 @@ interface AuthMiddlewareOptions {
      */
     secretKey?: string;
 }
-declare function authMiddleware(options?: AuthMiddlewareOptions): (request: NextRequest) => Promise<NextResponse<unknown>>;
 
-export { authMiddleware };
+/**
+ * Options for the authMiddleware function.
+ * @see AuthHandlerOptions for detailed property documentation.
+ */
+interface AuthMiddlewareOptions extends AuthHandlerOptions {
+}
+/**
+ * Creates an auth middleware handler for Next.js 14/15.
+ *
+ * @deprecated For Next.js 16+, use `authProxy` from `@githat/nextjs/proxy` instead.
+ * Next.js 16 renamed middleware.ts to proxy.ts. This export continues to work
+ * for Next.js 14/15 applications.
+ *
+ * @example
+ * ```typescript
+ * // middleware.ts (Next.js 14/15)
+ * import { authMiddleware } from '@githat/nextjs/middleware';
+ *
+ * export default authMiddleware({
+ *   publicRoutes: ['/', '/about', '/pricing'],
+ *   signInUrl: '/sign-in',
+ * });
+ *
+ * export const config = {
+ *   matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
+ * };
+ * ```
+ *
+ * @param options - Configuration options for the auth middleware
+ * @returns A middleware function compatible with Next.js 14/15 middleware.ts convention
+ */
+declare function authMiddleware(options?: AuthMiddlewareOptions): (request: NextRequest) => Promise<NextResponse>;
+
+export { type AuthHandlerOptions, type AuthMiddlewareOptions as AuthMiddlewareConfig, type AuthMiddlewareOptions, authMiddleware };

package/dist/middleware.js

@@ -33,6 +33,8 @@ __export(middleware_exports, {
   authMiddleware: () => authMiddleware
 });
 module.exports = __toCommonJS(middleware_exports);
+
+// src/lib/auth-handler.ts
 var import_server = require("next/server");
 var jose = __toESM(require("jose"));
 function decodeJwtPayload(token) {
@@ -56,7 +58,7 @@ async function verifyJwt(token, secretKey) {
     return null;
   }
 }
-function authMiddleware(options = {}) {
+async function handleAuthRequest(request, options = {}) {
   const {
     publicRoutes = ["/"],
     signInUrl = "/sign-in",
@@ -65,63 +67,68 @@ function authMiddleware(options = {}) {
     injectHeaders = false,
     secretKey
   } = options;
-  return async function middleware(request) {
-    const { pathname } = request.nextUrl;
-    const isPublic = publicRoutes.some((route) => {
-      if (route.endsWith("/*")) {
-        const prefix = route.slice(0, -1);
-        return pathname === prefix.slice(0, -1) || pathname.startsWith(prefix);
-      }
-      return pathname === route;
-    });
-    if (isPublic) {
-      return import_server.NextResponse.next();
-    }
-    if (pathname.startsWith("/_next") || pathname.startsWith("/api") || pathname.includes(".")) {
-      return import_server.NextResponse.next();
+  const { pathname } = request.nextUrl;
+  const isPublic = publicRoutes.some((route) => {
+    if (route.endsWith("/*")) {
+      const prefix = route.slice(0, -1);
+      return pathname === prefix.slice(0, -1) || pathname.startsWith(prefix);
     }
-    let token = request.cookies.get(tokenCookie)?.value;
-    if (!token) {
-      token = request.cookies.get(legacyTokenCookie)?.value;
-    }
-    if (!token) {
+    return pathname === route;
+  });
+  if (isPublic) {
+    return import_server.NextResponse.next();
+  }
+  if (pathname.startsWith("/_next") || pathname.startsWith("/api") || pathname.includes(".")) {
+    return import_server.NextResponse.next();
+  }
+  let token = request.cookies.get(tokenCookie)?.value;
+  if (!token) {
+    token = request.cookies.get(legacyTokenCookie)?.value;
+  }
+  if (!token) {
+    const signInUrlObj = new URL(signInUrl, request.url);
+    signInUrlObj.searchParams.set("redirect_url", pathname);
+    return import_server.NextResponse.redirect(signInUrlObj);
+  }
+  if (!injectHeaders) {
+    return import_server.NextResponse.next();
+  }
+  let payload = null;
+  if (secretKey) {
+    payload = await verifyJwt(token, secretKey);
+    if (!payload) {
       const signInUrlObj = new URL(signInUrl, request.url);
       signInUrlObj.searchParams.set("redirect_url", pathname);
       return import_server.NextResponse.redirect(signInUrlObj);
     }
-    if (!injectHeaders) {
-      return import_server.NextResponse.next();
+  } else {
+    payload = decodeJwtPayload(token);
+  }
+  const response = import_server.NextResponse.next();
+  if (payload) {
+    if (payload.userId) {
+      response.headers.set("x-githat-user-id", String(payload.userId));
+    }
+    if (payload.email) {
+      response.headers.set("x-githat-email", String(payload.email));
     }
-    let payload = null;
-    if (secretKey) {
-      payload = await verifyJwt(token, secretKey);
-      if (!payload) {
-        const signInUrlObj = new URL(signInUrl, request.url);
-        signInUrlObj.searchParams.set("redirect_url", pathname);
-        return import_server.NextResponse.redirect(signInUrlObj);
-      }
-    } else {
-      payload = decodeJwtPayload(token);
+    if (payload.orgId) {
+      response.headers.set("x-githat-org-id", String(payload.orgId));
     }
-    const response = import_server.NextResponse.next();
-    if (payload) {
-      if (payload.userId) {
-        response.headers.set("x-githat-user-id", String(payload.userId));
-      }
-      if (payload.email) {
-        response.headers.set("x-githat-email", String(payload.email));
-      }
-      if (payload.orgId) {
-        response.headers.set("x-githat-org-id", String(payload.orgId));
-      }
-      if (payload.orgSlug) {
-        response.headers.set("x-githat-org-slug", String(payload.orgSlug));
-      }
-      if (payload.orgRole) {
-        response.headers.set("x-githat-role", String(payload.orgRole));
-      }
+    if (payload.orgSlug) {
+      response.headers.set("x-githat-org-slug", String(payload.orgSlug));
     }
-    return response;
+    if (payload.orgRole) {
+      response.headers.set("x-githat-role", String(payload.orgRole));
+    }
+  }
+  return response;
+}
+
+// src/middleware/index.ts
+function authMiddleware(options = {}) {
+  return async function middleware(request) {
+    return handleAuthRequest(request, options);
   };
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/middleware/index.ts"],"sourcesContent":["import { NextResponse } from 'next/server';\nimport type { NextRequest } from 'next/server';\nimport * as jose from 'jose';\n\ninterface AuthMiddlewareOptions {\n  /**\n   * Routes that don't require authentication.\n   * Supports exact paths ('/') and path prefixes ('/public/*').\n   */\n  publicRoutes?: string[];\n\n  /**\n   * URL to redirect to when authentication is required but not present.\n   * @default '/sign-in'\n   */\n  signInUrl?: string;\n\n  /**\n   * Cookie name for the access token.\n   * @default 'githat_access'\n   */\n  tokenCookie?: string;\n\n  /**\n   * Legacy localStorage token cookie name (for backward compatibility).\n   * @default 'githat_access_token'\n   */\n  legacyTokenCookie?: string;\n\n  /**\n   * When true, decode the JWT and inject x-githat-* headers into the request.\n   * This allows downstream API routes to access user/org info without re-verifying.\n   *\n   * Injected headers:\n   * - x-githat-user-id: User's unique ID\n   * - x-githat-email: User's email address\n   * - x-githat-org-id: Current org ID (if any)\n   * - x-githat-org-slug: Current org slug (if any)\n   * - x-githat-role: User's role in the org (owner/admin/member)\n   *\n   * @default false\n   */\n  injectHeaders?: boolean;\n\n  /**\n   * Secret key for local JWT verification when injectHeaders is true.\n   * If not provided, headers are populated from the decoded (unverified) token payload.\n   * For production, always provide the secret key for full verification.\n   */\n  secretKey?: string;\n}\n\n/**\n * Decode a JWT without verifying the signature.\n * Used when secretKey is not provided but we still want header injection.\n */\nfunction decodeJwtPayload(token: string): Record<string, unknown> | null {\n  try {\n    const parts = token.split('.');\n    if (parts.length !== 3) return null;\n    const payload = JSON.parse(atob(parts[1]));\n    return payload;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Verify a JWT and return the payload.\n * Uses jose for proper signature verification.\n */\nasync function verifyJwt(\n  token: string,\n  secretKey: string\n): Promise<Record<string, unknown> | null> {\n  try {\n    const secret = new TextEncoder().encode(secretKey);\n    const { payload } = await jose.jwtVerify(token, secret, {\n      algorithms: ['HS256'],\n    });\n    return payload as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\nexport function authMiddleware(options: AuthMiddlewareOptions = {}) {\n  const {\n    publicRoutes = ['/'],\n    signInUrl = '/sign-in',\n    tokenCookie = 'githat_access',\n    legacyTokenCookie = 'githat_access_token',\n    injectHeaders = false,\n    secretKey,\n  } = options;\n\n  return async function middleware(request: NextRequest) {\n    const { pathname } = request.nextUrl;\n\n    // Allow public routes (exact match or prefix with /*)\n    const isPublic = publicRoutes.some((route) => {\n      if (route.endsWith('/*')) {\n        const prefix = route.slice(0, -1); // Remove the *\n        return pathname === prefix.slice(0, -1) || pathname.startsWith(prefix);\n      }\n      return pathname === route;\n    });\n\n    if (isPublic) {\n      return NextResponse.next();\n    }\n\n    // Allow static files, Next.js internals, and API routes\n    if (\n      pathname.startsWith('/_next') ||\n      pathname.startsWith('/api') ||\n      pathname.includes('.')\n    ) {\n      return NextResponse.next();\n    }\n\n    // Check for token in cookies (try new httpOnly cookie first, then legacy)\n    let token = request.cookies.get(tokenCookie)?.value;\n    if (!token) {\n      token = request.cookies.get(legacyTokenCookie)?.value;\n    }\n\n    // No token — redirect to sign-in\n    if (!token) {\n      const signInUrlObj = new URL(signInUrl, request.url);\n      signInUrlObj.searchParams.set('redirect_url', pathname);\n      return NextResponse.redirect(signInUrlObj);\n    }\n\n    // If not injecting headers, just let the request through\n    if (!injectHeaders) {\n      return NextResponse.next();\n    }\n\n    // Decode or verify the token to inject headers\n    let payload: Record<string, unknown> | null = null;\n\n    if (secretKey) {\n      // Full verification with secret key\n      payload = await verifyJwt(token, secretKey);\n      if (!payload) {\n        // Token verification failed — redirect to sign-in\n        const signInUrlObj = new URL(signInUrl, request.url);\n        signInUrlObj.searchParams.set('redirect_url', pathname);\n        return NextResponse.redirect(signInUrlObj);\n      }\n    } else {\n      // Decode without verification (less secure, but works without secret)\n      payload = decodeJwtPayload(token);\n    }\n\n    // Create a new response with injected headers\n    const response = NextResponse.next();\n\n    if (payload) {\n      // Inject user/org info as headers\n      if (payload.userId) {\n        response.headers.set('x-githat-user-id', String(payload.userId));\n      }\n      if (payload.email) {\n        response.headers.set('x-githat-email', String(payload.email));\n      }\n      if (payload.orgId) {\n        response.headers.set('x-githat-org-id', String(payload.orgId));\n      }\n      if (payload.orgSlug) {\n        response.headers.set('x-githat-org-slug', String(payload.orgSlug));\n      }\n      if (payload.orgRole) {\n        response.headers.set('x-githat-role', String(payload.orgRole));\n      }\n    }\n\n    return response;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAA6B;AAE7B,WAAsB;AAsDtB,SAAS,iBAAiB,OAA+C;AACvE,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,UAAU,KAAK,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC;AACzC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAe,UACb,OACA,WACyC;AACzC,MAAI;AACF,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,UAAM,EAAE,QAAQ,IAAI,MAAW,eAAU,OAAO,QAAQ;AAAA,MACtD,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,eAAe,UAAiC,CAAC,GAAG;AAClE,QAAM;AAAA,IACJ,eAAe,CAAC,GAAG;AAAA,IACnB,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,oBAAoB;AAAA,IACpB,gBAAgB;AAAA,IAChB;AAAA,EACF,IAAI;AAEJ,SAAO,eAAe,WAAW,SAAsB;AACrD,UAAM,EAAE,SAAS,IAAI,QAAQ;AAG7B,UAAM,WAAW,aAAa,KAAK,CAAC,UAAU;AAC5C,UAAI,MAAM,SAAS,IAAI,GAAG;AACxB,cAAM,SAAS,MAAM,MAAM,GAAG,EAAE;AAChC,eAAO,aAAa,OAAO,MAAM,GAAG,EAAE,KAAK,SAAS,WAAW,MAAM;AAAA,MACvE;AACA,aAAO,aAAa;AAAA,IACtB,CAAC;AAED,QAAI,UAAU;AACZ,aAAO,2BAAa,KAAK;AAAA,IAC3B;AAGA,QACE,SAAS,WAAW,QAAQ,KAC5B,SAAS,WAAW,MAAM,KAC1B,SAAS,SAAS,GAAG,GACrB;AACA,aAAO,2BAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,QAAQ,QAAQ,QAAQ,IAAI,WAAW,GAAG;AAC9C,QAAI,CAAC,OAAO;AACV,cAAQ,QAAQ,QAAQ,IAAI,iBAAiB,GAAG;AAAA,IAClD;AAGA,QAAI,CAAC,OAAO;AACV,YAAM,eAAe,IAAI,IAAI,WAAW,QAAQ,GAAG;AACnD,mBAAa,aAAa,IAAI,gBAAgB,QAAQ;AACtD,aAAO,2BAAa,SAAS,YAAY;AAAA,IAC3C;AAGA,QAAI,CAAC,eAAe;AAClB,aAAO,2BAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,UAA0C;AAE9C,QAAI,WAAW;AAEb,gBAAU,MAAM,UAAU,OAAO,SAAS;AAC1C,UAAI,CAAC,SAAS;AAEZ,cAAM,eAAe,IAAI,IAAI,WAAW,QAAQ,GAAG;AACnD,qBAAa,aAAa,IAAI,gBAAgB,QAAQ;AACtD,eAAO,2BAAa,SAAS,YAAY;AAAA,MAC3C;AAAA,IACF,OAAO;AAEL,gBAAU,iBAAiB,KAAK;AAAA,IAClC;AAGA,UAAM,WAAW,2BAAa,KAAK;AAEnC,QAAI,SAAS;AAEX,UAAI,QAAQ,QAAQ;AAClB,iBAAS,QAAQ,IAAI,oBAAoB,OAAO,QAAQ,MAAM,CAAC;AAAA,MACjE;AACA,UAAI,QAAQ,OAAO;AACjB,iBAAS,QAAQ,IAAI,kBAAkB,OAAO,QAAQ,KAAK,CAAC;AAAA,MAC9D;AACA,UAAI,QAAQ,OAAO;AACjB,iBAAS,QAAQ,IAAI,mBAAmB,OAAO,QAAQ,KAAK,CAAC;AAAA,MAC/D;AACA,UAAI,QAAQ,SAAS;AACnB,iBAAS,QAAQ,IAAI,qBAAqB,OAAO,QAAQ,OAAO,CAAC;AAAA,MACnE;AACA,UAAI,QAAQ,SAAS;AACnB,iBAAS,QAAQ,IAAI,iBAAiB,OAAO,QAAQ,OAAO,CAAC;AAAA,MAC/D;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../src/middleware/index.ts","../src/lib/auth-handler.ts"],"sourcesContent":["import type { NextRequest } from 'next/server';\nimport type { NextResponse } from 'next/server';\nimport { handleAuthRequest, AuthHandlerOptions } from '../lib/auth-handler';\n\n/**\n * Options for the authMiddleware function.\n * @see AuthHandlerOptions for detailed property documentation.\n */\nexport interface AuthMiddlewareOptions extends AuthHandlerOptions {}\n\n/**\n * Creates an auth middleware handler for Next.js 14/15.\n *\n * @deprecated For Next.js 16+, use `authProxy` from `@githat/nextjs/proxy` instead.\n * Next.js 16 renamed middleware.ts to proxy.ts. This export continues to work\n * for Next.js 14/15 applications.\n *\n * @example\n * ```typescript\n * // middleware.ts (Next.js 14/15)\n * import { authMiddleware } from '@githat/nextjs/middleware';\n *\n * export default authMiddleware({\n *   publicRoutes: ['/', '/about', '/pricing'],\n *   signInUrl: '/sign-in',\n * });\n *\n * export const config = {\n *   matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],\n * };\n * ```\n *\n * @param options - Configuration options for the auth middleware\n * @returns A middleware function compatible with Next.js 14/15 middleware.ts convention\n */\nexport function authMiddleware(options: AuthMiddlewareOptions = {}) {\n  return async function middleware(request: NextRequest): Promise<NextResponse> {\n    return handleAuthRequest(request, options);\n  };\n}\n\n// Re-export types for convenience\nexport type { AuthMiddlewareOptions as AuthMiddlewareConfig };\nexport type { AuthHandlerOptions };\n","import { NextResponse } from 'next/server';\nimport type { NextRequest } from 'next/server';\nimport * as jose from 'jose';\n\nexport interface AuthHandlerOptions {\n  /**\n   * Routes that don't require authentication.\n   * Supports exact paths ('/') and path prefixes ('/public/*').\n   */\n  publicRoutes?: string[];\n\n  /**\n   * URL to redirect to when authentication is required but not present.\n   * @default '/sign-in'\n   */\n  signInUrl?: string;\n\n  /**\n   * Cookie name for the access token.\n   * @default 'githat_access'\n   */\n  tokenCookie?: string;\n\n  /**\n   * Legacy localStorage token cookie name (for backward compatibility).\n   * @default 'githat_access_token'\n   */\n  legacyTokenCookie?: string;\n\n  /**\n   * When true, decode the JWT and inject x-githat-* headers into the request.\n   * This allows downstream API routes to access user/org info without re-verifying.\n   *\n   * Injected headers:\n   * - x-githat-user-id: User's unique ID\n   * - x-githat-email: User's email address\n   * - x-githat-org-id: Current org ID (if any)\n   * - x-githat-org-slug: Current org slug (if any)\n   * - x-githat-role: User's role in the org (owner/admin/member)\n   *\n   * @default false\n   */\n  injectHeaders?: boolean;\n\n  /**\n   * Secret key for local JWT verification when injectHeaders is true.\n   * If not provided, headers are populated from the decoded (unverified) token payload.\n   * For production, always provide the secret key for full verification.\n   */\n  secretKey?: string;\n}\n\n/**\n * Decode a JWT without verifying the signature.\n * Used when secretKey is not provided but we still want header injection.\n */\nfunction decodeJwtPayload(token: string): Record<string, unknown> | null {\n  try {\n    const parts = token.split('.');\n    if (parts.length !== 3) return null;\n    const payload = JSON.parse(atob(parts[1]));\n    return payload;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Verify a JWT and return the payload.\n * Uses jose for proper signature verification.\n */\nasync function verifyJwt(\n  token: string,\n  secretKey: string\n): Promise<Record<string, unknown> | null> {\n  try {\n    const secret = new TextEncoder().encode(secretKey);\n    const { payload } = await jose.jwtVerify(token, secret, {\n      algorithms: ['HS256'],\n    });\n    return payload as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Shared auth handling logic for both middleware (Next.js 14/15) and proxy (Next.js 16+).\n * Validates authentication tokens and optionally injects headers with user/org info.\n */\nexport async function handleAuthRequest(\n  request: NextRequest,\n  options: AuthHandlerOptions = {}\n): Promise<NextResponse> {\n  const {\n    publicRoutes = ['/'],\n    signInUrl = '/sign-in',\n    tokenCookie = 'githat_access',\n    legacyTokenCookie = 'githat_access_token',\n    injectHeaders = false,\n    secretKey,\n  } = options;\n\n  const { pathname } = request.nextUrl;\n\n  // Allow public routes (exact match or prefix with /*)\n  const isPublic = publicRoutes.some((route) => {\n    if (route.endsWith('/*')) {\n      const prefix = route.slice(0, -1); // Remove the *\n      return pathname === prefix.slice(0, -1) || pathname.startsWith(prefix);\n    }\n    return pathname === route;\n  });\n\n  if (isPublic) {\n    return NextResponse.next();\n  }\n\n  // Allow static files, Next.js internals, and API routes\n  if (\n    pathname.startsWith('/_next') ||\n    pathname.startsWith('/api') ||\n    pathname.includes('.')\n  ) {\n    return NextResponse.next();\n  }\n\n  // Check for token in cookies (try new httpOnly cookie first, then legacy)\n  let token = request.cookies.get(tokenCookie)?.value;\n  if (!token) {\n    token = request.cookies.get(legacyTokenCookie)?.value;\n  }\n\n  // No token — redirect to sign-in\n  if (!token) {\n    const signInUrlObj = new URL(signInUrl, request.url);\n    signInUrlObj.searchParams.set('redirect_url', pathname);\n    return NextResponse.redirect(signInUrlObj);\n  }\n\n  // If not injecting headers, just let the request through\n  if (!injectHeaders) {\n    return NextResponse.next();\n  }\n\n  // Decode or verify the token to inject headers\n  let payload: Record<string, unknown> | null = null;\n\n  if (secretKey) {\n    // Full verification with secret key\n    payload = await verifyJwt(token, secretKey);\n    if (!payload) {\n      // Token verification failed — redirect to sign-in\n      const signInUrlObj = new URL(signInUrl, request.url);\n      signInUrlObj.searchParams.set('redirect_url', pathname);\n      return NextResponse.redirect(signInUrlObj);\n    }\n  } else {\n    // Decode without verification (less secure, but works without secret)\n    payload = decodeJwtPayload(token);\n  }\n\n  // Create a new response with injected headers\n  const response = NextResponse.next();\n\n  if (payload) {\n    // Inject user/org info as headers\n    if (payload.userId) {\n      response.headers.set('x-githat-user-id', String(payload.userId));\n    }\n    if (payload.email) {\n      response.headers.set('x-githat-email', String(payload.email));\n    }\n    if (payload.orgId) {\n      response.headers.set('x-githat-org-id', String(payload.orgId));\n    }\n    if (payload.orgSlug) {\n      response.headers.set('x-githat-org-slug', String(payload.orgSlug));\n    }\n    if (payload.orgRole) {\n      response.headers.set('x-githat-role', String(payload.orgRole));\n    }\n  }\n\n  return response;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,oBAA6B;AAE7B,WAAsB;AAsDtB,SAAS,iBAAiB,OAA+C;AACvE,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,UAAU,KAAK,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC;AACzC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAe,UACb,OACA,WACyC;AACzC,MAAI;AACF,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,UAAM,EAAE,QAAQ,IAAI,MAAW,eAAU,OAAO,QAAQ;AAAA,MACtD,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAsB,kBACpB,SACA,UAA8B,CAAC,GACR;AACvB,QAAM;AAAA,IACJ,eAAe,CAAC,GAAG;AAAA,IACnB,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,oBAAoB;AAAA,IACpB,gBAAgB;AAAA,IAChB;AAAA,EACF,IAAI;AAEJ,QAAM,EAAE,SAAS,IAAI,QAAQ;AAG7B,QAAM,WAAW,aAAa,KAAK,CAAC,UAAU;AAC5C,QAAI,MAAM,SAAS,IAAI,GAAG;AACxB,YAAM,SAAS,MAAM,MAAM,GAAG,EAAE;AAChC,aAAO,aAAa,OAAO,MAAM,GAAG,EAAE,KAAK,SAAS,WAAW,MAAM;AAAA,IACvE;AACA,WAAO,aAAa;AAAA,EACtB,CAAC;AAED,MAAI,UAAU;AACZ,WAAO,2BAAa,KAAK;AAAA,EAC3B;AAGA,MACE,SAAS,WAAW,QAAQ,KAC5B,SAAS,WAAW,MAAM,KAC1B,SAAS,SAAS,GAAG,GACrB;AACA,WAAO,2BAAa,KAAK;AAAA,EAC3B;AAGA,MAAI,QAAQ,QAAQ,QAAQ,IAAI,WAAW,GAAG;AAC9C,MAAI,CAAC,OAAO;AACV,YAAQ,QAAQ,QAAQ,IAAI,iBAAiB,GAAG;AAAA,EAClD;AAGA,MAAI,CAAC,OAAO;AACV,UAAM,eAAe,IAAI,IAAI,WAAW,QAAQ,GAAG;AACnD,iBAAa,aAAa,IAAI,gBAAgB,QAAQ;AACtD,WAAO,2BAAa,SAAS,YAAY;AAAA,EAC3C;AAGA,MAAI,CAAC,eAAe;AAClB,WAAO,2BAAa,KAAK;AAAA,EAC3B;AAGA,MAAI,UAA0C;AAE9C,MAAI,WAAW;AAEb,cAAU,MAAM,UAAU,OAAO,SAAS;AAC1C,QAAI,CAAC,SAAS;AAEZ,YAAM,eAAe,IAAI,IAAI,WAAW,QAAQ,GAAG;AACnD,mBAAa,aAAa,IAAI,gBAAgB,QAAQ;AACtD,aAAO,2BAAa,SAAS,YAAY;AAAA,IAC3C;AAAA,EACF,OAAO;AAEL,cAAU,iBAAiB,KAAK;AAAA,EAClC;AAGA,QAAM,WAAW,2BAAa,KAAK;AAEnC,MAAI,SAAS;AAEX,QAAI,QAAQ,QAAQ;AAClB,eAAS,QAAQ,IAAI,oBAAoB,OAAO,QAAQ,MAAM,CAAC;AAAA,IACjE;AACA,QAAI,QAAQ,OAAO;AACjB,eAAS,QAAQ,IAAI,kBAAkB,OAAO,QAAQ,KAAK,CAAC;AAAA,IAC9D;AACA,QAAI,QAAQ,OAAO;AACjB,eAAS,QAAQ,IAAI,mBAAmB,OAAO,QAAQ,KAAK,CAAC;AAAA,IAC/D;AACA,QAAI,QAAQ,SAAS;AACnB,eAAS,QAAQ,IAAI,qBAAqB,OAAO,QAAQ,OAAO,CAAC;AAAA,IACnE;AACA,QAAI,QAAQ,SAAS;AACnB,eAAS,QAAQ,IAAI,iBAAiB,OAAO,QAAQ,OAAO,CAAC;AAAA,IAC/D;AAAA,EACF;AAEA,SAAO;AACT;;;ADtJO,SAAS,eAAe,UAAiC,CAAC,GAAG;AAClE,SAAO,eAAe,WAAW,SAA6C;AAC5E,WAAO,kBAAkB,SAAS,OAAO;AAAA,EAC3C;AACF;","names":[]}

package/dist/middleware.mjs

@@ -1,4 +1,4 @@
-// src/middleware/index.ts
+// src/lib/auth-handler.ts
 import { NextResponse } from "next/server";
 import * as jose from "jose";
 function decodeJwtPayload(token) {
@@ -22,7 +22,7 @@ async function verifyJwt(token, secretKey) {
     return null;
   }
 }
-function authMiddleware(options = {}) {
+async function handleAuthRequest(request, options = {}) {
   const {
     publicRoutes = ["/"],
     signInUrl = "/sign-in",
@@ -31,63 +31,68 @@ function authMiddleware(options = {}) {
     injectHeaders = false,
     secretKey
   } = options;
-  return async function middleware(request) {
-    const { pathname } = request.nextUrl;
-    const isPublic = publicRoutes.some((route) => {
-      if (route.endsWith("/*")) {
-        const prefix = route.slice(0, -1);
-        return pathname === prefix.slice(0, -1) || pathname.startsWith(prefix);
-      }
-      return pathname === route;
-    });
-    if (isPublic) {
-      return NextResponse.next();
-    }
-    if (pathname.startsWith("/_next") || pathname.startsWith("/api") || pathname.includes(".")) {
-      return NextResponse.next();
+  const { pathname } = request.nextUrl;
+  const isPublic = publicRoutes.some((route) => {
+    if (route.endsWith("/*")) {
+      const prefix = route.slice(0, -1);
+      return pathname === prefix.slice(0, -1) || pathname.startsWith(prefix);
     }
-    let token = request.cookies.get(tokenCookie)?.value;
-    if (!token) {
-      token = request.cookies.get(legacyTokenCookie)?.value;
-    }
-    if (!token) {
+    return pathname === route;
+  });
+  if (isPublic) {
+    return NextResponse.next();
+  }
+  if (pathname.startsWith("/_next") || pathname.startsWith("/api") || pathname.includes(".")) {
+    return NextResponse.next();
+  }
+  let token = request.cookies.get(tokenCookie)?.value;
+  if (!token) {
+    token = request.cookies.get(legacyTokenCookie)?.value;
+  }
+  if (!token) {
+    const signInUrlObj = new URL(signInUrl, request.url);
+    signInUrlObj.searchParams.set("redirect_url", pathname);
+    return NextResponse.redirect(signInUrlObj);
+  }
+  if (!injectHeaders) {
+    return NextResponse.next();
+  }
+  let payload = null;
+  if (secretKey) {
+    payload = await verifyJwt(token, secretKey);
+    if (!payload) {
       const signInUrlObj = new URL(signInUrl, request.url);
       signInUrlObj.searchParams.set("redirect_url", pathname);
       return NextResponse.redirect(signInUrlObj);
     }
-    if (!injectHeaders) {
-      return NextResponse.next();
+  } else {
+    payload = decodeJwtPayload(token);
+  }
+  const response = NextResponse.next();
+  if (payload) {
+    if (payload.userId) {
+      response.headers.set("x-githat-user-id", String(payload.userId));
+    }
+    if (payload.email) {
+      response.headers.set("x-githat-email", String(payload.email));
     }
-    let payload = null;
-    if (secretKey) {
-      payload = await verifyJwt(token, secretKey);
-      if (!payload) {
-        const signInUrlObj = new URL(signInUrl, request.url);
-        signInUrlObj.searchParams.set("redirect_url", pathname);
-        return NextResponse.redirect(signInUrlObj);
-      }
-    } else {
-      payload = decodeJwtPayload(token);
+    if (payload.orgId) {
+      response.headers.set("x-githat-org-id", String(payload.orgId));
     }
-    const response = NextResponse.next();
-    if (payload) {
-      if (payload.userId) {
-        response.headers.set("x-githat-user-id", String(payload.userId));
-      }
-      if (payload.email) {
-        response.headers.set("x-githat-email", String(payload.email));
-      }
-      if (payload.orgId) {
-        response.headers.set("x-githat-org-id", String(payload.orgId));
-      }
-      if (payload.orgSlug) {
-        response.headers.set("x-githat-org-slug", String(payload.orgSlug));
-      }
-      if (payload.orgRole) {
-        response.headers.set("x-githat-role", String(payload.orgRole));
-      }
+    if (payload.orgSlug) {
+      response.headers.set("x-githat-org-slug", String(payload.orgSlug));
     }
-    return response;
+    if (payload.orgRole) {
+      response.headers.set("x-githat-role", String(payload.orgRole));
+    }
+  }
+  return response;
+}
+
+// src/middleware/index.ts
+function authMiddleware(options = {}) {
+  return async function middleware(request) {
+    return handleAuthRequest(request, options);
   };
 }
 export {

package/dist/middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/middleware/index.ts"],"sourcesContent":["import { NextResponse } from 'next/server';\nimport type { NextRequest } from 'next/server';\nimport * as jose from 'jose';\n\ninterface AuthMiddlewareOptions {\n  /**\n   * Routes that don't require authentication.\n   * Supports exact paths ('/') and path prefixes ('/public/*').\n   */\n  publicRoutes?: string[];\n\n  /**\n   * URL to redirect to when authentication is required but not present.\n   * @default '/sign-in'\n   */\n  signInUrl?: string;\n\n  /**\n   * Cookie name for the access token.\n   * @default 'githat_access'\n   */\n  tokenCookie?: string;\n\n  /**\n   * Legacy localStorage token cookie name (for backward compatibility).\n   * @default 'githat_access_token'\n   */\n  legacyTokenCookie?: string;\n\n  /**\n   * When true, decode the JWT and inject x-githat-* headers into the request.\n   * This allows downstream API routes to access user/org info without re-verifying.\n   *\n   * Injected headers:\n   * - x-githat-user-id: User's unique ID\n   * - x-githat-email: User's email address\n   * - x-githat-org-id: Current org ID (if any)\n   * - x-githat-org-slug: Current org slug (if any)\n   * - x-githat-role: User's role in the org (owner/admin/member)\n   *\n   * @default false\n   */\n  injectHeaders?: boolean;\n\n  /**\n   * Secret key for local JWT verification when injectHeaders is true.\n   * If not provided, headers are populated from the decoded (unverified) token payload.\n   * For production, always provide the secret key for full verification.\n   */\n  secretKey?: string;\n}\n\n/**\n * Decode a JWT without verifying the signature.\n * Used when secretKey is not provided but we still want header injection.\n */\nfunction decodeJwtPayload(token: string): Record<string, unknown> | null {\n  try {\n    const parts = token.split('.');\n    if (parts.length !== 3) return null;\n    const payload = JSON.parse(atob(parts[1]));\n    return payload;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Verify a JWT and return the payload.\n * Uses jose for proper signature verification.\n */\nasync function verifyJwt(\n  token: string,\n  secretKey: string\n): Promise<Record<string, unknown> | null> {\n  try {\n    const secret = new TextEncoder().encode(secretKey);\n    const { payload } = await jose.jwtVerify(token, secret, {\n      algorithms: ['HS256'],\n    });\n    return payload as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\nexport function authMiddleware(options: AuthMiddlewareOptions = {}) {\n  const {\n    publicRoutes = ['/'],\n    signInUrl = '/sign-in',\n    tokenCookie = 'githat_access',\n    legacyTokenCookie = 'githat_access_token',\n    injectHeaders = false,\n    secretKey,\n  } = options;\n\n  return async function middleware(request: NextRequest) {\n    const { pathname } = request.nextUrl;\n\n    // Allow public routes (exact match or prefix with /*)\n    const isPublic = publicRoutes.some((route) => {\n      if (route.endsWith('/*')) {\n        const prefix = route.slice(0, -1); // Remove the *\n        return pathname === prefix.slice(0, -1) || pathname.startsWith(prefix);\n      }\n      return pathname === route;\n    });\n\n    if (isPublic) {\n      return NextResponse.next();\n    }\n\n    // Allow static files, Next.js internals, and API routes\n    if (\n      pathname.startsWith('/_next') ||\n      pathname.startsWith('/api') ||\n      pathname.includes('.')\n    ) {\n      return NextResponse.next();\n    }\n\n    // Check for token in cookies (try new httpOnly cookie first, then legacy)\n    let token = request.cookies.get(tokenCookie)?.value;\n    if (!token) {\n      token = request.cookies.get(legacyTokenCookie)?.value;\n    }\n\n    // No token — redirect to sign-in\n    if (!token) {\n      const signInUrlObj = new URL(signInUrl, request.url);\n      signInUrlObj.searchParams.set('redirect_url', pathname);\n      return NextResponse.redirect(signInUrlObj);\n    }\n\n    // If not injecting headers, just let the request through\n    if (!injectHeaders) {\n      return NextResponse.next();\n    }\n\n    // Decode or verify the token to inject headers\n    let payload: Record<string, unknown> | null = null;\n\n    if (secretKey) {\n      // Full verification with secret key\n      payload = await verifyJwt(token, secretKey);\n      if (!payload) {\n        // Token verification failed — redirect to sign-in\n        const signInUrlObj = new URL(signInUrl, request.url);\n        signInUrlObj.searchParams.set('redirect_url', pathname);\n        return NextResponse.redirect(signInUrlObj);\n      }\n    } else {\n      // Decode without verification (less secure, but works without secret)\n      payload = decodeJwtPayload(token);\n    }\n\n    // Create a new response with injected headers\n    const response = NextResponse.next();\n\n    if (payload) {\n      // Inject user/org info as headers\n      if (payload.userId) {\n        response.headers.set('x-githat-user-id', String(payload.userId));\n      }\n      if (payload.email) {\n        response.headers.set('x-githat-email', String(payload.email));\n      }\n      if (payload.orgId) {\n        response.headers.set('x-githat-org-id', String(payload.orgId));\n      }\n      if (payload.orgSlug) {\n        response.headers.set('x-githat-org-slug', String(payload.orgSlug));\n      }\n      if (payload.orgRole) {\n        response.headers.set('x-githat-role', String(payload.orgRole));\n      }\n    }\n\n    return response;\n  };\n}\n"],"mappings":";AAAA,SAAS,oBAAoB;AAE7B,YAAY,UAAU;AAsDtB,SAAS,iBAAiB,OAA+C;AACvE,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,UAAU,KAAK,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC;AACzC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAe,UACb,OACA,WACyC;AACzC,MAAI;AACF,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,UAAM,EAAE,QAAQ,IAAI,MAAW,eAAU,OAAO,QAAQ;AAAA,MACtD,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,eAAe,UAAiC,CAAC,GAAG;AAClE,QAAM;AAAA,IACJ,eAAe,CAAC,GAAG;AAAA,IACnB,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,oBAAoB;AAAA,IACpB,gBAAgB;AAAA,IAChB;AAAA,EACF,IAAI;AAEJ,SAAO,eAAe,WAAW,SAAsB;AACrD,UAAM,EAAE,SAAS,IAAI,QAAQ;AAG7B,UAAM,WAAW,aAAa,KAAK,CAAC,UAAU;AAC5C,UAAI,MAAM,SAAS,IAAI,GAAG;AACxB,cAAM,SAAS,MAAM,MAAM,GAAG,EAAE;AAChC,eAAO,aAAa,OAAO,MAAM,GAAG,EAAE,KAAK,SAAS,WAAW,MAAM;AAAA,MACvE;AACA,aAAO,aAAa;AAAA,IACtB,CAAC;AAED,QAAI,UAAU;AACZ,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,QACE,SAAS,WAAW,QAAQ,KAC5B,SAAS,WAAW,MAAM,KAC1B,SAAS,SAAS,GAAG,GACrB;AACA,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,QAAQ,QAAQ,QAAQ,IAAI,WAAW,GAAG;AAC9C,QAAI,CAAC,OAAO;AACV,cAAQ,QAAQ,QAAQ,IAAI,iBAAiB,GAAG;AAAA,IAClD;AAGA,QAAI,CAAC,OAAO;AACV,YAAM,eAAe,IAAI,IAAI,WAAW,QAAQ,GAAG;AACnD,mBAAa,aAAa,IAAI,gBAAgB,QAAQ;AACtD,aAAO,aAAa,SAAS,YAAY;AAAA,IAC3C;AAGA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,UAA0C;AAE9C,QAAI,WAAW;AAEb,gBAAU,MAAM,UAAU,OAAO,SAAS;AAC1C,UAAI,CAAC,SAAS;AAEZ,cAAM,eAAe,IAAI,IAAI,WAAW,QAAQ,GAAG;AACnD,qBAAa,aAAa,IAAI,gBAAgB,QAAQ;AACtD,eAAO,aAAa,SAAS,YAAY;AAAA,MAC3C;AAAA,IACF,OAAO;AAEL,gBAAU,iBAAiB,KAAK;AAAA,IAClC;AAGA,UAAM,WAAW,aAAa,KAAK;AAEnC,QAAI,SAAS;AAEX,UAAI,QAAQ,QAAQ;AAClB,iBAAS,QAAQ,IAAI,oBAAoB,OAAO,QAAQ,MAAM,CAAC;AAAA,MACjE;AACA,UAAI,QAAQ,OAAO;AACjB,iBAAS,QAAQ,IAAI,kBAAkB,OAAO,QAAQ,KAAK,CAAC;AAAA,MAC9D;AACA,UAAI,QAAQ,OAAO;AACjB,iBAAS,QAAQ,IAAI,mBAAmB,OAAO,QAAQ,KAAK,CAAC;AAAA,MAC/D;AACA,UAAI,QAAQ,SAAS;AACnB,iBAAS,QAAQ,IAAI,qBAAqB,OAAO,QAAQ,OAAO,CAAC;AAAA,MACnE;AACA,UAAI,QAAQ,SAAS;AACnB,iBAAS,QAAQ,IAAI,iBAAiB,OAAO,QAAQ,OAAO,CAAC;AAAA,MAC/D;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../src/lib/auth-handler.ts","../src/middleware/index.ts"],"sourcesContent":["import { NextResponse } from 'next/server';\nimport type { NextRequest } from 'next/server';\nimport * as jose from 'jose';\n\nexport interface AuthHandlerOptions {\n  /**\n   * Routes that don't require authentication.\n   * Supports exact paths ('/') and path prefixes ('/public/*').\n   */\n  publicRoutes?: string[];\n\n  /**\n   * URL to redirect to when authentication is required but not present.\n   * @default '/sign-in'\n   */\n  signInUrl?: string;\n\n  /**\n   * Cookie name for the access token.\n   * @default 'githat_access'\n   */\n  tokenCookie?: string;\n\n  /**\n   * Legacy localStorage token cookie name (for backward compatibility).\n   * @default 'githat_access_token'\n   */\n  legacyTokenCookie?: string;\n\n  /**\n   * When true, decode the JWT and inject x-githat-* headers into the request.\n   * This allows downstream API routes to access user/org info without re-verifying.\n   *\n   * Injected headers:\n   * - x-githat-user-id: User's unique ID\n   * - x-githat-email: User's email address\n   * - x-githat-org-id: Current org ID (if any)\n   * - x-githat-org-slug: Current org slug (if any)\n   * - x-githat-role: User's role in the org (owner/admin/member)\n   *\n   * @default false\n   */\n  injectHeaders?: boolean;\n\n  /**\n   * Secret key for local JWT verification when injectHeaders is true.\n   * If not provided, headers are populated from the decoded (unverified) token payload.\n   * For production, always provide the secret key for full verification.\n   */\n  secretKey?: string;\n}\n\n/**\n * Decode a JWT without verifying the signature.\n * Used when secretKey is not provided but we still want header injection.\n */\nfunction decodeJwtPayload(token: string): Record<string, unknown> | null {\n  try {\n    const parts = token.split('.');\n    if (parts.length !== 3) return null;\n    const payload = JSON.parse(atob(parts[1]));\n    return payload;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Verify a JWT and return the payload.\n * Uses jose for proper signature verification.\n */\nasync function verifyJwt(\n  token: string,\n  secretKey: string\n): Promise<Record<string, unknown> | null> {\n  try {\n    const secret = new TextEncoder().encode(secretKey);\n    const { payload } = await jose.jwtVerify(token, secret, {\n      algorithms: ['HS256'],\n    });\n    return payload as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Shared auth handling logic for both middleware (Next.js 14/15) and proxy (Next.js 16+).\n * Validates authentication tokens and optionally injects headers with user/org info.\n */\nexport async function handleAuthRequest(\n  request: NextRequest,\n  options: AuthHandlerOptions = {}\n): Promise<NextResponse> {\n  const {\n    publicRoutes = ['/'],\n    signInUrl = '/sign-in',\n    tokenCookie = 'githat_access',\n    legacyTokenCookie = 'githat_access_token',\n    injectHeaders = false,\n    secretKey,\n  } = options;\n\n  const { pathname } = request.nextUrl;\n\n  // Allow public routes (exact match or prefix with /*)\n  const isPublic = publicRoutes.some((route) => {\n    if (route.endsWith('/*')) {\n      const prefix = route.slice(0, -1); // Remove the *\n      return pathname === prefix.slice(0, -1) || pathname.startsWith(prefix);\n    }\n    return pathname === route;\n  });\n\n  if (isPublic) {\n    return NextResponse.next();\n  }\n\n  // Allow static files, Next.js internals, and API routes\n  if (\n    pathname.startsWith('/_next') ||\n    pathname.startsWith('/api') ||\n    pathname.includes('.')\n  ) {\n    return NextResponse.next();\n  }\n\n  // Check for token in cookies (try new httpOnly cookie first, then legacy)\n  let token = request.cookies.get(tokenCookie)?.value;\n  if (!token) {\n    token = request.cookies.get(legacyTokenCookie)?.value;\n  }\n\n  // No token — redirect to sign-in\n  if (!token) {\n    const signInUrlObj = new URL(signInUrl, request.url);\n    signInUrlObj.searchParams.set('redirect_url', pathname);\n    return NextResponse.redirect(signInUrlObj);\n  }\n\n  // If not injecting headers, just let the request through\n  if (!injectHeaders) {\n    return NextResponse.next();\n  }\n\n  // Decode or verify the token to inject headers\n  let payload: Record<string, unknown> | null = null;\n\n  if (secretKey) {\n    // Full verification with secret key\n    payload = await verifyJwt(token, secretKey);\n    if (!payload) {\n      // Token verification failed — redirect to sign-in\n      const signInUrlObj = new URL(signInUrl, request.url);\n      signInUrlObj.searchParams.set('redirect_url', pathname);\n      return NextResponse.redirect(signInUrlObj);\n    }\n  } else {\n    // Decode without verification (less secure, but works without secret)\n    payload = decodeJwtPayload(token);\n  }\n\n  // Create a new response with injected headers\n  const response = NextResponse.next();\n\n  if (payload) {\n    // Inject user/org info as headers\n    if (payload.userId) {\n      response.headers.set('x-githat-user-id', String(payload.userId));\n    }\n    if (payload.email) {\n      response.headers.set('x-githat-email', String(payload.email));\n    }\n    if (payload.orgId) {\n      response.headers.set('x-githat-org-id', String(payload.orgId));\n    }\n    if (payload.orgSlug) {\n      response.headers.set('x-githat-org-slug', String(payload.orgSlug));\n    }\n    if (payload.orgRole) {\n      response.headers.set('x-githat-role', String(payload.orgRole));\n    }\n  }\n\n  return response;\n}\n","import type { NextRequest } from 'next/server';\nimport type { NextResponse } from 'next/server';\nimport { handleAuthRequest, AuthHandlerOptions } from '../lib/auth-handler';\n\n/**\n * Options for the authMiddleware function.\n * @see AuthHandlerOptions for detailed property documentation.\n */\nexport interface AuthMiddlewareOptions extends AuthHandlerOptions {}\n\n/**\n * Creates an auth middleware handler for Next.js 14/15.\n *\n * @deprecated For Next.js 16+, use `authProxy` from `@githat/nextjs/proxy` instead.\n * Next.js 16 renamed middleware.ts to proxy.ts. This export continues to work\n * for Next.js 14/15 applications.\n *\n * @example\n * ```typescript\n * // middleware.ts (Next.js 14/15)\n * import { authMiddleware } from '@githat/nextjs/middleware';\n *\n * export default authMiddleware({\n *   publicRoutes: ['/', '/about', '/pricing'],\n *   signInUrl: '/sign-in',\n * });\n *\n * export const config = {\n *   matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],\n * };\n * ```\n *\n * @param options - Configuration options for the auth middleware\n * @returns A middleware function compatible with Next.js 14/15 middleware.ts convention\n */\nexport function authMiddleware(options: AuthMiddlewareOptions = {}) {\n  return async function middleware(request: NextRequest): Promise<NextResponse> {\n    return handleAuthRequest(request, options);\n  };\n}\n\n// Re-export types for convenience\nexport type { AuthMiddlewareOptions as AuthMiddlewareConfig };\nexport type { AuthHandlerOptions };\n"],"mappings":";AAAA,SAAS,oBAAoB;AAE7B,YAAY,UAAU;AAsDtB,SAAS,iBAAiB,OAA+C;AACvE,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,UAAU,KAAK,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC;AACzC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAe,UACb,OACA,WACyC;AACzC,MAAI;AACF,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,UAAM,EAAE,QAAQ,IAAI,MAAW,eAAU,OAAO,QAAQ;AAAA,MACtD,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAsB,kBACpB,SACA,UAA8B,CAAC,GACR;AACvB,QAAM;AAAA,IACJ,eAAe,CAAC,GAAG;AAAA,IACnB,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,oBAAoB;AAAA,IACpB,gBAAgB;AAAA,IAChB;AAAA,EACF,IAAI;AAEJ,QAAM,EAAE,SAAS,IAAI,QAAQ;AAG7B,QAAM,WAAW,aAAa,KAAK,CAAC,UAAU;AAC5C,QAAI,MAAM,SAAS,IAAI,GAAG;AACxB,YAAM,SAAS,MAAM,MAAM,GAAG,EAAE;AAChC,aAAO,aAAa,OAAO,MAAM,GAAG,EAAE,KAAK,SAAS,WAAW,MAAM;AAAA,IACvE;AACA,WAAO,aAAa;AAAA,EACtB,CAAC;AAED,MAAI,UAAU;AACZ,WAAO,aAAa,KAAK;AAAA,EAC3B;AAGA,MACE,SAAS,WAAW,QAAQ,KAC5B,SAAS,WAAW,MAAM,KAC1B,SAAS,SAAS,GAAG,GACrB;AACA,WAAO,aAAa,KAAK;AAAA,EAC3B;AAGA,MAAI,QAAQ,QAAQ,QAAQ,IAAI,WAAW,GAAG;AAC9C,MAAI,CAAC,OAAO;AACV,YAAQ,QAAQ,QAAQ,IAAI,iBAAiB,GAAG;AAAA,EAClD;AAGA,MAAI,CAAC,OAAO;AACV,UAAM,eAAe,IAAI,IAAI,WAAW,QAAQ,GAAG;AACnD,iBAAa,aAAa,IAAI,gBAAgB,QAAQ;AACtD,WAAO,aAAa,SAAS,YAAY;AAAA,EAC3C;AAGA,MAAI,CAAC,eAAe;AAClB,WAAO,aAAa,KAAK;AAAA,EAC3B;AAGA,MAAI,UAA0C;AAE9C,MAAI,WAAW;AAEb,cAAU,MAAM,UAAU,OAAO,SAAS;AAC1C,QAAI,CAAC,SAAS;AAEZ,YAAM,eAAe,IAAI,IAAI,WAAW,QAAQ,GAAG;AACnD,mBAAa,aAAa,IAAI,gBAAgB,QAAQ;AACtD,aAAO,aAAa,SAAS,YAAY;AAAA,IAC3C;AAAA,EACF,OAAO;AAEL,cAAU,iBAAiB,KAAK;AAAA,EAClC;AAGA,QAAM,WAAW,aAAa,KAAK;AAEnC,MAAI,SAAS;AAEX,QAAI,QAAQ,QAAQ;AAClB,eAAS,QAAQ,IAAI,oBAAoB,OAAO,QAAQ,MAAM,CAAC;AAAA,IACjE;AACA,QAAI,QAAQ,OAAO;AACjB,eAAS,QAAQ,IAAI,kBAAkB,OAAO,QAAQ,KAAK,CAAC;AAAA,IAC9D;AACA,QAAI,QAAQ,OAAO;AACjB,eAAS,QAAQ,IAAI,mBAAmB,OAAO,QAAQ,KAAK,CAAC;AAAA,IAC/D;AACA,QAAI,QAAQ,SAAS;AACnB,eAAS,QAAQ,IAAI,qBAAqB,OAAO,QAAQ,OAAO,CAAC;AAAA,IACnE;AACA,QAAI,QAAQ,SAAS;AACnB,eAAS,QAAQ,IAAI,iBAAiB,OAAO,QAAQ,OAAO,CAAC;AAAA,IAC/D;AAAA,EACF;AAEA,SAAO;AACT;;;ACtJO,SAAS,eAAe,UAAiC,CAAC,GAAG;AAClE,SAAO,eAAe,WAAW,SAA6C;AAC5E,WAAO,kBAAkB,SAAS,OAAO;AAAA,EAC3C;AACF;","names":[]}

package/dist/proxy.d.mts

@@ -0,0 +1,78 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+interface AuthHandlerOptions {
+    /**
+     * Routes that don't require authentication.
+     * Supports exact paths ('/') and path prefixes ('/public/*').
+     */
+    publicRoutes?: string[];
+    /**
+     * URL to redirect to when authentication is required but not present.
+     * @default '/sign-in'
+     */
+    signInUrl?: string;
+    /**
+     * Cookie name for the access token.
+     * @default 'githat_access'
+     */
+    tokenCookie?: string;
+    /**
+     * Legacy localStorage token cookie name (for backward compatibility).
+     * @default 'githat_access_token'
+     */
+    legacyTokenCookie?: string;
+    /**
+     * When true, decode the JWT and inject x-githat-* headers into the request.
+     * This allows downstream API routes to access user/org info without re-verifying.
+     *
+     * Injected headers:
+     * - x-githat-user-id: User's unique ID
+     * - x-githat-email: User's email address
+     * - x-githat-org-id: Current org ID (if any)
+     * - x-githat-org-slug: Current org slug (if any)
+     * - x-githat-role: User's role in the org (owner/admin/member)
+     *
+     * @default false
+     */
+    injectHeaders?: boolean;
+    /**
+     * Secret key for local JWT verification when injectHeaders is true.
+     * If not provided, headers are populated from the decoded (unverified) token payload.
+     * For production, always provide the secret key for full verification.
+     */
+    secretKey?: string;
+}
+
+/**
+ * Options for the authProxy function.
+ * @see AuthHandlerOptions for detailed property documentation.
+ */
+interface AuthProxyOptions extends AuthHandlerOptions {
+}
+/**
+ * Creates an auth proxy handler for Next.js 16+.
+ *
+ * Next.js 16 renamed middleware.ts to proxy.ts and the export from
+ * `export default middleware` to `export const proxy`.
+ *
+ * @example
+ * ```typescript
+ * // proxy.ts (Next.js 16+)
+ * import { authProxy } from '@githat/nextjs/proxy';
+ *
+ * export const proxy = authProxy({
+ *   publicRoutes: ['/', '/about', '/pricing'],
+ *   signInUrl: '/sign-in',
+ * });
+ *
+ * export const config = {
+ *   matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
+ * };
+ * ```
+ *
+ * @param options - Configuration options for the auth proxy
+ * @returns A proxy function compatible with Next.js 16+ proxy.ts convention
+ */
+declare function authProxy(options?: AuthProxyOptions): (request: NextRequest) => Promise<NextResponse>;
+
+export { type AuthHandlerOptions, type AuthProxyOptions as AuthProxyConfig, type AuthProxyOptions, authProxy };

package/dist/proxy.d.ts

@@ -0,0 +1,78 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+interface AuthHandlerOptions {
+    /**
+     * Routes that don't require authentication.
+     * Supports exact paths ('/') and path prefixes ('/public/*').
+     */
+    publicRoutes?: string[];
+    /**
+     * URL to redirect to when authentication is required but not present.
+     * @default '/sign-in'
+     */
+    signInUrl?: string;
+    /**
+     * Cookie name for the access token.
+     * @default 'githat_access'
+     */
+    tokenCookie?: string;
+    /**
+     * Legacy localStorage token cookie name (for backward compatibility).
+     * @default 'githat_access_token'
+     */
+    legacyTokenCookie?: string;
+    /**
+     * When true, decode the JWT and inject x-githat-* headers into the request.
+     * This allows downstream API routes to access user/org info without re-verifying.
+     *
+     * Injected headers:
+     * - x-githat-user-id: User's unique ID
+     * - x-githat-email: User's email address
+     * - x-githat-org-id: Current org ID (if any)
+     * - x-githat-org-slug: Current org slug (if any)
+     * - x-githat-role: User's role in the org (owner/admin/member)
+     *
+     * @default false
+     */
+    injectHeaders?: boolean;
+    /**
+     * Secret key for local JWT verification when injectHeaders is true.
+     * If not provided, headers are populated from the decoded (unverified) token payload.
+     * For production, always provide the secret key for full verification.
+     */
+    secretKey?: string;
+}
+
+/**
+ * Options for the authProxy function.
+ * @see AuthHandlerOptions for detailed property documentation.
+ */
+interface AuthProxyOptions extends AuthHandlerOptions {
+}
+/**
+ * Creates an auth proxy handler for Next.js 16+.
+ *
+ * Next.js 16 renamed middleware.ts to proxy.ts and the export from
+ * `export default middleware` to `export const proxy`.
+ *
+ * @example
+ * ```typescript
+ * // proxy.ts (Next.js 16+)
+ * import { authProxy } from '@githat/nextjs/proxy';
+ *
+ * export const proxy = authProxy({
+ *   publicRoutes: ['/', '/about', '/pricing'],
+ *   signInUrl: '/sign-in',
+ * });
+ *
+ * export const config = {
+ *   matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
+ * };
+ * ```
+ *
+ * @param options - Configuration options for the auth proxy
+ * @returns A proxy function compatible with Next.js 16+ proxy.ts convention
+ */
+declare function authProxy(options?: AuthProxyOptions): (request: NextRequest) => Promise<NextResponse>;
+
+export { type AuthHandlerOptions, type AuthProxyOptions as AuthProxyConfig, type AuthProxyOptions, authProxy };

package/dist/proxy.js

@@ -0,0 +1,138 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/proxy/index.ts
+var proxy_exports = {};
+__export(proxy_exports, {
+  authProxy: () => authProxy
+});
+module.exports = __toCommonJS(proxy_exports);
+
+// src/lib/auth-handler.ts
+var import_server = require("next/server");
+var jose = __toESM(require("jose"));
+function decodeJwtPayload(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    const payload = JSON.parse(atob(parts[1]));
+    return payload;
+  } catch {
+    return null;
+  }
+}
+async function verifyJwt(token, secretKey) {
+  try {
+    const secret = new TextEncoder().encode(secretKey);
+    const { payload } = await jose.jwtVerify(token, secret, {
+      algorithms: ["HS256"]
+    });
+    return payload;
+  } catch {
+    return null;
+  }
+}
+async function handleAuthRequest(request, options = {}) {
+  const {
+    publicRoutes = ["/"],
+    signInUrl = "/sign-in",
+    tokenCookie = "githat_access",
+    legacyTokenCookie = "githat_access_token",
+    injectHeaders = false,
+    secretKey
+  } = options;
+  const { pathname } = request.nextUrl;
+  const isPublic = publicRoutes.some((route) => {
+    if (route.endsWith("/*")) {
+      const prefix = route.slice(0, -1);
+      return pathname === prefix.slice(0, -1) || pathname.startsWith(prefix);
+    }
+    return pathname === route;
+  });
+  if (isPublic) {
+    return import_server.NextResponse.next();
+  }
+  if (pathname.startsWith("/_next") || pathname.startsWith("/api") || pathname.includes(".")) {
+    return import_server.NextResponse.next();
+  }
+  let token = request.cookies.get(tokenCookie)?.value;
+  if (!token) {
+    token = request.cookies.get(legacyTokenCookie)?.value;
+  }
+  if (!token) {
+    const signInUrlObj = new URL(signInUrl, request.url);
+    signInUrlObj.searchParams.set("redirect_url", pathname);
+    return import_server.NextResponse.redirect(signInUrlObj);
+  }
+  if (!injectHeaders) {
+    return import_server.NextResponse.next();
+  }
+  let payload = null;
+  if (secretKey) {
+    payload = await verifyJwt(token, secretKey);
+    if (!payload) {
+      const signInUrlObj = new URL(signInUrl, request.url);
+      signInUrlObj.searchParams.set("redirect_url", pathname);
+      return import_server.NextResponse.redirect(signInUrlObj);
+    }
+  } else {
+    payload = decodeJwtPayload(token);
+  }
+  const response = import_server.NextResponse.next();
+  if (payload) {
+    if (payload.userId) {
+      response.headers.set("x-githat-user-id", String(payload.userId));
+    }
+    if (payload.email) {
+      response.headers.set("x-githat-email", String(payload.email));
+    }
+    if (payload.orgId) {
+      response.headers.set("x-githat-org-id", String(payload.orgId));
+    }
+    if (payload.orgSlug) {
+      response.headers.set("x-githat-org-slug", String(payload.orgSlug));
+    }
+    if (payload.orgRole) {
+      response.headers.set("x-githat-role", String(payload.orgRole));
+    }
+  }
+  return response;
+}
+
+// src/proxy/index.ts
+function authProxy(options = {}) {
+  return async function proxy(request) {
+    return handleAuthRequest(request, options);
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  authProxy
+});
+//# sourceMappingURL=proxy.js.map

package/dist/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/proxy/index.ts","../src/lib/auth-handler.ts"],"sourcesContent":["import type { NextRequest } from 'next/server';\nimport type { NextResponse } from 'next/server';\nimport { handleAuthRequest, AuthHandlerOptions } from '../lib/auth-handler';\n\n/**\n * Options for the authProxy function.\n * @see AuthHandlerOptions for detailed property documentation.\n */\nexport interface AuthProxyOptions extends AuthHandlerOptions {}\n\n/**\n * Creates an auth proxy handler for Next.js 16+.\n *\n * Next.js 16 renamed middleware.ts to proxy.ts and the export from\n * `export default middleware` to `export const proxy`.\n *\n * @example\n * ```typescript\n * // proxy.ts (Next.js 16+)\n * import { authProxy } from '@githat/nextjs/proxy';\n *\n * export const proxy = authProxy({\n *   publicRoutes: ['/', '/about', '/pricing'],\n *   signInUrl: '/sign-in',\n * });\n *\n * export const config = {\n *   matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],\n * };\n * ```\n *\n * @param options - Configuration options for the auth proxy\n * @returns A proxy function compatible with Next.js 16+ proxy.ts convention\n */\nexport function authProxy(options: AuthProxyOptions = {}) {\n  return async function proxy(request: NextRequest): Promise<NextResponse> {\n    return handleAuthRequest(request, options);\n  };\n}\n\n// Re-export types for convenience\nexport type { AuthProxyOptions as AuthProxyConfig };\nexport type { AuthHandlerOptions };\n","import { NextResponse } from 'next/server';\nimport type { NextRequest } from 'next/server';\nimport * as jose from 'jose';\n\nexport interface AuthHandlerOptions {\n  /**\n   * Routes that don't require authentication.\n   * Supports exact paths ('/') and path prefixes ('/public/*').\n   */\n  publicRoutes?: string[];\n\n  /**\n   * URL to redirect to when authentication is required but not present.\n   * @default '/sign-in'\n   */\n  signInUrl?: string;\n\n  /**\n   * Cookie name for the access token.\n   * @default 'githat_access'\n   */\n  tokenCookie?: string;\n\n  /**\n   * Legacy localStorage token cookie name (for backward compatibility).\n   * @default 'githat_access_token'\n   */\n  legacyTokenCookie?: string;\n\n  /**\n   * When true, decode the JWT and inject x-githat-* headers into the request.\n   * This allows downstream API routes to access user/org info without re-verifying.\n   *\n   * Injected headers:\n   * - x-githat-user-id: User's unique ID\n   * - x-githat-email: User's email address\n   * - x-githat-org-id: Current org ID (if any)\n   * - x-githat-org-slug: Current org slug (if any)\n   * - x-githat-role: User's role in the org (owner/admin/member)\n   *\n   * @default false\n   */\n  injectHeaders?: boolean;\n\n  /**\n   * Secret key for local JWT verification when injectHeaders is true.\n   * If not provided, headers are populated from the decoded (unverified) token payload.\n   * For production, always provide the secret key for full verification.\n   */\n  secretKey?: string;\n}\n\n/**\n * Decode a JWT without verifying the signature.\n * Used when secretKey is not provided but we still want header injection.\n */\nfunction decodeJwtPayload(token: string): Record<string, unknown> | null {\n  try {\n    const parts = token.split('.');\n    if (parts.length !== 3) return null;\n    const payload = JSON.parse(atob(parts[1]));\n    return payload;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Verify a JWT and return the payload.\n * Uses jose for proper signature verification.\n */\nasync function verifyJwt(\n  token: string,\n  secretKey: string\n): Promise<Record<string, unknown> | null> {\n  try {\n    const secret = new TextEncoder().encode(secretKey);\n    const { payload } = await jose.jwtVerify(token, secret, {\n      algorithms: ['HS256'],\n    });\n    return payload as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Shared auth handling logic for both middleware (Next.js 14/15) and proxy (Next.js 16+).\n * Validates authentication tokens and optionally injects headers with user/org info.\n */\nexport async function handleAuthRequest(\n  request: NextRequest,\n  options: AuthHandlerOptions = {}\n): Promise<NextResponse> {\n  const {\n    publicRoutes = ['/'],\n    signInUrl = '/sign-in',\n    tokenCookie = 'githat_access',\n    legacyTokenCookie = 'githat_access_token',\n    injectHeaders = false,\n    secretKey,\n  } = options;\n\n  const { pathname } = request.nextUrl;\n\n  // Allow public routes (exact match or prefix with /*)\n  const isPublic = publicRoutes.some((route) => {\n    if (route.endsWith('/*')) {\n      const prefix = route.slice(0, -1); // Remove the *\n      return pathname === prefix.slice(0, -1) || pathname.startsWith(prefix);\n    }\n    return pathname === route;\n  });\n\n  if (isPublic) {\n    return NextResponse.next();\n  }\n\n  // Allow static files, Next.js internals, and API routes\n  if (\n    pathname.startsWith('/_next') ||\n    pathname.startsWith('/api') ||\n    pathname.includes('.')\n  ) {\n    return NextResponse.next();\n  }\n\n  // Check for token in cookies (try new httpOnly cookie first, then legacy)\n  let token = request.cookies.get(tokenCookie)?.value;\n  if (!token) {\n    token = request.cookies.get(legacyTokenCookie)?.value;\n  }\n\n  // No token — redirect to sign-in\n  if (!token) {\n    const signInUrlObj = new URL(signInUrl, request.url);\n    signInUrlObj.searchParams.set('redirect_url', pathname);\n    return NextResponse.redirect(signInUrlObj);\n  }\n\n  // If not injecting headers, just let the request through\n  if (!injectHeaders) {\n    return NextResponse.next();\n  }\n\n  // Decode or verify the token to inject headers\n  let payload: Record<string, unknown> | null = null;\n\n  if (secretKey) {\n    // Full verification with secret key\n    payload = await verifyJwt(token, secretKey);\n    if (!payload) {\n      // Token verification failed — redirect to sign-in\n      const signInUrlObj = new URL(signInUrl, request.url);\n      signInUrlObj.searchParams.set('redirect_url', pathname);\n      return NextResponse.redirect(signInUrlObj);\n    }\n  } else {\n    // Decode without verification (less secure, but works without secret)\n    payload = decodeJwtPayload(token);\n  }\n\n  // Create a new response with injected headers\n  const response = NextResponse.next();\n\n  if (payload) {\n    // Inject user/org info as headers\n    if (payload.userId) {\n      response.headers.set('x-githat-user-id', String(payload.userId));\n    }\n    if (payload.email) {\n      response.headers.set('x-githat-email', String(payload.email));\n    }\n    if (payload.orgId) {\n      response.headers.set('x-githat-org-id', String(payload.orgId));\n    }\n    if (payload.orgSlug) {\n      response.headers.set('x-githat-org-slug', String(payload.orgSlug));\n    }\n    if (payload.orgRole) {\n      response.headers.set('x-githat-role', String(payload.orgRole));\n    }\n  }\n\n  return response;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,oBAA6B;AAE7B,WAAsB;AAsDtB,SAAS,iBAAiB,OAA+C;AACvE,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,UAAU,KAAK,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC;AACzC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAe,UACb,OACA,WACyC;AACzC,MAAI;AACF,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,UAAM,EAAE,QAAQ,IAAI,MAAW,eAAU,OAAO,QAAQ;AAAA,MACtD,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAsB,kBACpB,SACA,UAA8B,CAAC,GACR;AACvB,QAAM;AAAA,IACJ,eAAe,CAAC,GAAG;AAAA,IACnB,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,oBAAoB;AAAA,IACpB,gBAAgB;AAAA,IAChB;AAAA,EACF,IAAI;AAEJ,QAAM,EAAE,SAAS,IAAI,QAAQ;AAG7B,QAAM,WAAW,aAAa,KAAK,CAAC,UAAU;AAC5C,QAAI,MAAM,SAAS,IAAI,GAAG;AACxB,YAAM,SAAS,MAAM,MAAM,GAAG,EAAE;AAChC,aAAO,aAAa,OAAO,MAAM,GAAG,EAAE,KAAK,SAAS,WAAW,MAAM;AAAA,IACvE;AACA,WAAO,aAAa;AAAA,EACtB,CAAC;AAED,MAAI,UAAU;AACZ,WAAO,2BAAa,KAAK;AAAA,EAC3B;AAGA,MACE,SAAS,WAAW,QAAQ,KAC5B,SAAS,WAAW,MAAM,KAC1B,SAAS,SAAS,GAAG,GACrB;AACA,WAAO,2BAAa,KAAK;AAAA,EAC3B;AAGA,MAAI,QAAQ,QAAQ,QAAQ,IAAI,WAAW,GAAG;AAC9C,MAAI,CAAC,OAAO;AACV,YAAQ,QAAQ,QAAQ,IAAI,iBAAiB,GAAG;AAAA,EAClD;AAGA,MAAI,CAAC,OAAO;AACV,UAAM,eAAe,IAAI,IAAI,WAAW,QAAQ,GAAG;AACnD,iBAAa,aAAa,IAAI,gBAAgB,QAAQ;AACtD,WAAO,2BAAa,SAAS,YAAY;AAAA,EAC3C;AAGA,MAAI,CAAC,eAAe;AAClB,WAAO,2BAAa,KAAK;AAAA,EAC3B;AAGA,MAAI,UAA0C;AAE9C,MAAI,WAAW;AAEb,cAAU,MAAM,UAAU,OAAO,SAAS;AAC1C,QAAI,CAAC,SAAS;AAEZ,YAAM,eAAe,IAAI,IAAI,WAAW,QAAQ,GAAG;AACnD,mBAAa,aAAa,IAAI,gBAAgB,QAAQ;AACtD,aAAO,2BAAa,SAAS,YAAY;AAAA,IAC3C;AAAA,EACF,OAAO;AAEL,cAAU,iBAAiB,KAAK;AAAA,EAClC;AAGA,QAAM,WAAW,2BAAa,KAAK;AAEnC,MAAI,SAAS;AAEX,QAAI,QAAQ,QAAQ;AAClB,eAAS,QAAQ,IAAI,oBAAoB,OAAO,QAAQ,MAAM,CAAC;AAAA,IACjE;AACA,QAAI,QAAQ,OAAO;AACjB,eAAS,QAAQ,IAAI,kBAAkB,OAAO,QAAQ,KAAK,CAAC;AAAA,IAC9D;AACA,QAAI,QAAQ,OAAO;AACjB,eAAS,QAAQ,IAAI,mBAAmB,OAAO,QAAQ,KAAK,CAAC;AAAA,IAC/D;AACA,QAAI,QAAQ,SAAS;AACnB,eAAS,QAAQ,IAAI,qBAAqB,OAAO,QAAQ,OAAO,CAAC;AAAA,IACnE;AACA,QAAI,QAAQ,SAAS;AACnB,eAAS,QAAQ,IAAI,iBAAiB,OAAO,QAAQ,OAAO,CAAC;AAAA,IAC/D;AAAA,EACF;AAEA,SAAO;AACT;;;ADvJO,SAAS,UAAU,UAA4B,CAAC,GAAG;AACxD,SAAO,eAAe,MAAM,SAA6C;AACvE,WAAO,kBAAkB,SAAS,OAAO;AAAA,EAC3C;AACF;","names":[]}

package/dist/proxy.mjs

@@ -0,0 +1,101 @@
+// src/lib/auth-handler.ts
+import { NextResponse } from "next/server";
+import * as jose from "jose";
+function decodeJwtPayload(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    const payload = JSON.parse(atob(parts[1]));
+    return payload;
+  } catch {
+    return null;
+  }
+}
+async function verifyJwt(token, secretKey) {
+  try {
+    const secret = new TextEncoder().encode(secretKey);
+    const { payload } = await jose.jwtVerify(token, secret, {
+      algorithms: ["HS256"]
+    });
+    return payload;
+  } catch {
+    return null;
+  }
+}
+async function handleAuthRequest(request, options = {}) {
+  const {
+    publicRoutes = ["/"],
+    signInUrl = "/sign-in",
+    tokenCookie = "githat_access",
+    legacyTokenCookie = "githat_access_token",
+    injectHeaders = false,
+    secretKey
+  } = options;
+  const { pathname } = request.nextUrl;
+  const isPublic = publicRoutes.some((route) => {
+    if (route.endsWith("/*")) {
+      const prefix = route.slice(0, -1);
+      return pathname === prefix.slice(0, -1) || pathname.startsWith(prefix);
+    }
+    return pathname === route;
+  });
+  if (isPublic) {
+    return NextResponse.next();
+  }
+  if (pathname.startsWith("/_next") || pathname.startsWith("/api") || pathname.includes(".")) {
+    return NextResponse.next();
+  }
+  let token = request.cookies.get(tokenCookie)?.value;
+  if (!token) {
+    token = request.cookies.get(legacyTokenCookie)?.value;
+  }
+  if (!token) {
+    const signInUrlObj = new URL(signInUrl, request.url);
+    signInUrlObj.searchParams.set("redirect_url", pathname);
+    return NextResponse.redirect(signInUrlObj);
+  }
+  if (!injectHeaders) {
+    return NextResponse.next();
+  }
+  let payload = null;
+  if (secretKey) {
+    payload = await verifyJwt(token, secretKey);
+    if (!payload) {
+      const signInUrlObj = new URL(signInUrl, request.url);
+      signInUrlObj.searchParams.set("redirect_url", pathname);
+      return NextResponse.redirect(signInUrlObj);
+    }
+  } else {
+    payload = decodeJwtPayload(token);
+  }
+  const response = NextResponse.next();
+  if (payload) {
+    if (payload.userId) {
+      response.headers.set("x-githat-user-id", String(payload.userId));
+    }
+    if (payload.email) {
+      response.headers.set("x-githat-email", String(payload.email));
+    }
+    if (payload.orgId) {
+      response.headers.set("x-githat-org-id", String(payload.orgId));
+    }
+    if (payload.orgSlug) {
+      response.headers.set("x-githat-org-slug", String(payload.orgSlug));
+    }
+    if (payload.orgRole) {
+      response.headers.set("x-githat-role", String(payload.orgRole));
+    }
+  }
+  return response;
+}
+
+// src/proxy/index.ts
+function authProxy(options = {}) {
+  return async function proxy(request) {
+    return handleAuthRequest(request, options);
+  };
+}
+export {
+  authProxy
+};
+//# sourceMappingURL=proxy.mjs.map

package/dist/proxy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/auth-handler.ts","../src/proxy/index.ts"],"sourcesContent":["import { NextResponse } from 'next/server';\nimport type { NextRequest } from 'next/server';\nimport * as jose from 'jose';\n\nexport interface AuthHandlerOptions {\n  /**\n   * Routes that don't require authentication.\n   * Supports exact paths ('/') and path prefixes ('/public/*').\n   */\n  publicRoutes?: string[];\n\n  /**\n   * URL to redirect to when authentication is required but not present.\n   * @default '/sign-in'\n   */\n  signInUrl?: string;\n\n  /**\n   * Cookie name for the access token.\n   * @default 'githat_access'\n   */\n  tokenCookie?: string;\n\n  /**\n   * Legacy localStorage token cookie name (for backward compatibility).\n   * @default 'githat_access_token'\n   */\n  legacyTokenCookie?: string;\n\n  /**\n   * When true, decode the JWT and inject x-githat-* headers into the request.\n   * This allows downstream API routes to access user/org info without re-verifying.\n   *\n   * Injected headers:\n   * - x-githat-user-id: User's unique ID\n   * - x-githat-email: User's email address\n   * - x-githat-org-id: Current org ID (if any)\n   * - x-githat-org-slug: Current org slug (if any)\n   * - x-githat-role: User's role in the org (owner/admin/member)\n   *\n   * @default false\n   */\n  injectHeaders?: boolean;\n\n  /**\n   * Secret key for local JWT verification when injectHeaders is true.\n   * If not provided, headers are populated from the decoded (unverified) token payload.\n   * For production, always provide the secret key for full verification.\n   */\n  secretKey?: string;\n}\n\n/**\n * Decode a JWT without verifying the signature.\n * Used when secretKey is not provided but we still want header injection.\n */\nfunction decodeJwtPayload(token: string): Record<string, unknown> | null {\n  try {\n    const parts = token.split('.');\n    if (parts.length !== 3) return null;\n    const payload = JSON.parse(atob(parts[1]));\n    return payload;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Verify a JWT and return the payload.\n * Uses jose for proper signature verification.\n */\nasync function verifyJwt(\n  token: string,\n  secretKey: string\n): Promise<Record<string, unknown> | null> {\n  try {\n    const secret = new TextEncoder().encode(secretKey);\n    const { payload } = await jose.jwtVerify(token, secret, {\n      algorithms: ['HS256'],\n    });\n    return payload as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Shared auth handling logic for both middleware (Next.js 14/15) and proxy (Next.js 16+).\n * Validates authentication tokens and optionally injects headers with user/org info.\n */\nexport async function handleAuthRequest(\n  request: NextRequest,\n  options: AuthHandlerOptions = {}\n): Promise<NextResponse> {\n  const {\n    publicRoutes = ['/'],\n    signInUrl = '/sign-in',\n    tokenCookie = 'githat_access',\n    legacyTokenCookie = 'githat_access_token',\n    injectHeaders = false,\n    secretKey,\n  } = options;\n\n  const { pathname } = request.nextUrl;\n\n  // Allow public routes (exact match or prefix with /*)\n  const isPublic = publicRoutes.some((route) => {\n    if (route.endsWith('/*')) {\n      const prefix = route.slice(0, -1); // Remove the *\n      return pathname === prefix.slice(0, -1) || pathname.startsWith(prefix);\n    }\n    return pathname === route;\n  });\n\n  if (isPublic) {\n    return NextResponse.next();\n  }\n\n  // Allow static files, Next.js internals, and API routes\n  if (\n    pathname.startsWith('/_next') ||\n    pathname.startsWith('/api') ||\n    pathname.includes('.')\n  ) {\n    return NextResponse.next();\n  }\n\n  // Check for token in cookies (try new httpOnly cookie first, then legacy)\n  let token = request.cookies.get(tokenCookie)?.value;\n  if (!token) {\n    token = request.cookies.get(legacyTokenCookie)?.value;\n  }\n\n  // No token — redirect to sign-in\n  if (!token) {\n    const signInUrlObj = new URL(signInUrl, request.url);\n    signInUrlObj.searchParams.set('redirect_url', pathname);\n    return NextResponse.redirect(signInUrlObj);\n  }\n\n  // If not injecting headers, just let the request through\n  if (!injectHeaders) {\n    return NextResponse.next();\n  }\n\n  // Decode or verify the token to inject headers\n  let payload: Record<string, unknown> | null = null;\n\n  if (secretKey) {\n    // Full verification with secret key\n    payload = await verifyJwt(token, secretKey);\n    if (!payload) {\n      // Token verification failed — redirect to sign-in\n      const signInUrlObj = new URL(signInUrl, request.url);\n      signInUrlObj.searchParams.set('redirect_url', pathname);\n      return NextResponse.redirect(signInUrlObj);\n    }\n  } else {\n    // Decode without verification (less secure, but works without secret)\n    payload = decodeJwtPayload(token);\n  }\n\n  // Create a new response with injected headers\n  const response = NextResponse.next();\n\n  if (payload) {\n    // Inject user/org info as headers\n    if (payload.userId) {\n      response.headers.set('x-githat-user-id', String(payload.userId));\n    }\n    if (payload.email) {\n      response.headers.set('x-githat-email', String(payload.email));\n    }\n    if (payload.orgId) {\n      response.headers.set('x-githat-org-id', String(payload.orgId));\n    }\n    if (payload.orgSlug) {\n      response.headers.set('x-githat-org-slug', String(payload.orgSlug));\n    }\n    if (payload.orgRole) {\n      response.headers.set('x-githat-role', String(payload.orgRole));\n    }\n  }\n\n  return response;\n}\n","import type { NextRequest } from 'next/server';\nimport type { NextResponse } from 'next/server';\nimport { handleAuthRequest, AuthHandlerOptions } from '../lib/auth-handler';\n\n/**\n * Options for the authProxy function.\n * @see AuthHandlerOptions for detailed property documentation.\n */\nexport interface AuthProxyOptions extends AuthHandlerOptions {}\n\n/**\n * Creates an auth proxy handler for Next.js 16+.\n *\n * Next.js 16 renamed middleware.ts to proxy.ts and the export from\n * `export default middleware` to `export const proxy`.\n *\n * @example\n * ```typescript\n * // proxy.ts (Next.js 16+)\n * import { authProxy } from '@githat/nextjs/proxy';\n *\n * export const proxy = authProxy({\n *   publicRoutes: ['/', '/about', '/pricing'],\n *   signInUrl: '/sign-in',\n * });\n *\n * export const config = {\n *   matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],\n * };\n * ```\n *\n * @param options - Configuration options for the auth proxy\n * @returns A proxy function compatible with Next.js 16+ proxy.ts convention\n */\nexport function authProxy(options: AuthProxyOptions = {}) {\n  return async function proxy(request: NextRequest): Promise<NextResponse> {\n    return handleAuthRequest(request, options);\n  };\n}\n\n// Re-export types for convenience\nexport type { AuthProxyOptions as AuthProxyConfig };\nexport type { AuthHandlerOptions };\n"],"mappings":";AAAA,SAAS,oBAAoB;AAE7B,YAAY,UAAU;AAsDtB,SAAS,iBAAiB,OAA+C;AACvE,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,UAAU,KAAK,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC;AACzC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAe,UACb,OACA,WACyC;AACzC,MAAI;AACF,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,UAAM,EAAE,QAAQ,IAAI,MAAW,eAAU,OAAO,QAAQ;AAAA,MACtD,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAsB,kBACpB,SACA,UAA8B,CAAC,GACR;AACvB,QAAM;AAAA,IACJ,eAAe,CAAC,GAAG;AAAA,IACnB,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,oBAAoB;AAAA,IACpB,gBAAgB;AAAA,IAChB;AAAA,EACF,IAAI;AAEJ,QAAM,EAAE,SAAS,IAAI,QAAQ;AAG7B,QAAM,WAAW,aAAa,KAAK,CAAC,UAAU;AAC5C,QAAI,MAAM,SAAS,IAAI,GAAG;AACxB,YAAM,SAAS,MAAM,MAAM,GAAG,EAAE;AAChC,aAAO,aAAa,OAAO,MAAM,GAAG,EAAE,KAAK,SAAS,WAAW,MAAM;AAAA,IACvE;AACA,WAAO,aAAa;AAAA,EACtB,CAAC;AAED,MAAI,UAAU;AACZ,WAAO,aAAa,KAAK;AAAA,EAC3B;AAGA,MACE,SAAS,WAAW,QAAQ,KAC5B,SAAS,WAAW,MAAM,KAC1B,SAAS,SAAS,GAAG,GACrB;AACA,WAAO,aAAa,KAAK;AAAA,EAC3B;AAGA,MAAI,QAAQ,QAAQ,QAAQ,IAAI,WAAW,GAAG;AAC9C,MAAI,CAAC,OAAO;AACV,YAAQ,QAAQ,QAAQ,IAAI,iBAAiB,GAAG;AAAA,EAClD;AAGA,MAAI,CAAC,OAAO;AACV,UAAM,eAAe,IAAI,IAAI,WAAW,QAAQ,GAAG;AACnD,iBAAa,aAAa,IAAI,gBAAgB,QAAQ;AACtD,WAAO,aAAa,SAAS,YAAY;AAAA,EAC3C;AAGA,MAAI,CAAC,eAAe;AAClB,WAAO,aAAa,KAAK;AAAA,EAC3B;AAGA,MAAI,UAA0C;AAE9C,MAAI,WAAW;AAEb,cAAU,MAAM,UAAU,OAAO,SAAS;AAC1C,QAAI,CAAC,SAAS;AAEZ,YAAM,eAAe,IAAI,IAAI,WAAW,QAAQ,GAAG;AACnD,mBAAa,aAAa,IAAI,gBAAgB,QAAQ;AACtD,aAAO,aAAa,SAAS,YAAY;AAAA,IAC3C;AAAA,EACF,OAAO;AAEL,cAAU,iBAAiB,KAAK;AAAA,EAClC;AAGA,QAAM,WAAW,aAAa,KAAK;AAEnC,MAAI,SAAS;AAEX,QAAI,QAAQ,QAAQ;AAClB,eAAS,QAAQ,IAAI,oBAAoB,OAAO,QAAQ,MAAM,CAAC;AAAA,IACjE;AACA,QAAI,QAAQ,OAAO;AACjB,eAAS,QAAQ,IAAI,kBAAkB,OAAO,QAAQ,KAAK,CAAC;AAAA,IAC9D;AACA,QAAI,QAAQ,OAAO;AACjB,eAAS,QAAQ,IAAI,mBAAmB,OAAO,QAAQ,KAAK,CAAC;AAAA,IAC/D;AACA,QAAI,QAAQ,SAAS;AACnB,eAAS,QAAQ,IAAI,qBAAqB,OAAO,QAAQ,OAAO,CAAC;AAAA,IACnE;AACA,QAAI,QAAQ,SAAS;AACnB,eAAS,QAAQ,IAAI,iBAAiB,OAAO,QAAQ,OAAO,CAAC;AAAA,IAC/D;AAAA,EACF;AAEA,SAAO;AACT;;;ACvJO,SAAS,UAAU,UAA4B,CAAC,GAAG;AACxD,SAAO,eAAe,MAAM,SAA6C;AACvE,WAAO,kBAAkB,SAAS,OAAO;AAAA,EAC3C;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githat/nextjs",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "GitHat identity SDK for Next.js applications",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -16,6 +16,11 @@
       "import": "./dist/middleware.mjs",
       "require": "./dist/middleware.js"
     },
+    "./proxy": {
+      "types": "./dist/proxy.d.ts",
+      "import": "./dist/proxy.mjs",
+      "require": "./dist/proxy.js"
+    },
     "./server": {
       "types": "./dist/server.d.ts",
       "import": "./dist/server.mjs",