@imtbl/auth-next-server 2.12.5-alpha.13 → 2.12.5-alpha.14

package/dist/browser/index.js

@@ -0,0 +1,7 @@
+import A from 'next-auth';
+import { NextResponse } from 'next/server';
+import x from 'next-auth/providers/credentials';
+
+var m="https://auth.immutable.com";var k="immutable";function E(n,t=60){return typeof n!="number"||Number.isNaN(n)?!0:Date.now()>=n-t*1e3}var y=x.default||x;async function w(n,t){try{let r=await fetch(`${t}/userinfo`,{method:"GET",headers:{Authorization:`Bearer ${n}`}});return r.ok?await r.json():(console.error("[auth-next-server] Token validation failed:",r.status,r.statusText),null)}catch(r){return console.error("[auth-next-server] Token validation error:",r),null}}function d(n){let t=n.authenticationDomain||m;return {providers:[y({id:k,name:"Immutable",credentials:{tokens:{label:"Tokens",type:"text"}},async authorize(r){if(!r?.tokens||typeof r.tokens!="string")return null;let e;try{e=JSON.parse(r.tokens);}catch(a){return console.error("[auth-next-server] Failed to parse token data:",a),null}if(!e.accessToken||typeof e.accessToken!="string"||!e.profile||typeof e.profile!="object"||!e.profile.sub||typeof e.profile.sub!="string"||typeof e.accessTokenExpires!="number"||Number.isNaN(e.accessTokenExpires))return console.error("[auth-next-server] Invalid token data structure - missing required fields"),null;let o=await w(e.accessToken,t);return o?o.sub!==e.profile.sub?(console.error("[auth-next-server] User ID mismatch - userinfo sub:",o.sub,"provided sub:",e.profile.sub),null):{id:o.sub,sub:o.sub,email:o.email??e.profile.email,nickname:o.nickname??e.profile.nickname,accessToken:e.accessToken,refreshToken:e.refreshToken,idToken:e.idToken,accessTokenExpires:e.accessTokenExpires,zkEvm:e.zkEvm}:(console.error("[auth-next-server] Token validation failed - rejecting authentication"),null)}})],callbacks:{async jwt({token:r,user:e,trigger:o,session:a}){if(e)return {...r,sub:e.sub,email:e.email,nickname:e.nickname,accessToken:e.accessToken,refreshToken:e.refreshToken,idToken:e.idToken,accessTokenExpires:e.accessTokenExpires,zkEvm:e.zkEvm};if(o==="update"&&a){let s=a;return {...r,...s.accessToken?{accessToken:s.accessToken}:{},...s.refreshToken?{refreshToken:s.refreshToken}:{},...s.idToken?{idToken:s.idToken}:{},...s.accessTokenExpires?{accessTokenExpires:s.accessTokenExpires}:{},...s.zkEvm?{zkEvm:s.zkEvm}:{},error:void 0}}return E(r.accessTokenExpires)?{...r,error:"TokenExpired"}:r},async session({session:r,token:e}){return {...r,user:{...r.user,sub:e.sub,email:e.email,nickname:e.nickname},accessToken:e.accessToken,refreshToken:e.refreshToken,idToken:e.idToken,accessTokenExpires:e.accessTokenExpires,zkEvm:e.zkEvm,...e.error&&{error:e.error}}}},session:{strategy:"jwt",maxAge:31536e3}}}var I=d;function T(n,t){if(n===t)return !0;let r=t.endsWith("/")?t:`${t}/`;return n.startsWith(r)}var g=A.default||A;function Q(n,t){let r=d(n);if(!t)return g(r);let{callbacks:e,...o}=t,a={...r.callbacks};if(e){if(e.jwt){let c=r.callbacks?.jwt,l=e.jwt;a.jwt=async i=>{let u=c?await c(i):i.token;return l({...i,token:u})};}if(e.session){let c=r.callbacks?.session,l=e.session;a.session=async i=>{let u=c?await c(i):i.session;return l({...i,session:u})};}e.signIn&&(a.signIn=e.signIn),e.redirect&&(a.redirect=e.redirect),e.authorized&&(a.authorized=e.authorized);}let s={...r,...o,callbacks:a};return g(s)}async function D(n){let t=await n();return t?t.error==="TokenExpired"?{session:null,ssr:!1}:t.error?{session:null,ssr:!1,authError:t.error}:{session:t,ssr:!0}:{session:null,ssr:!1}}async function F(n,t){let r=await n();if(!r)return {session:null,ssr:!1,data:null};if(r.error==="TokenExpired")return {session:null,ssr:!1,data:null};if(r.error)return {session:null,ssr:!1,data:null,authError:r.error};try{let e=await t(r.accessToken);return {session:r,ssr:!0,data:e}}catch(e){let o=e instanceof Error?e.message:String(e);return {session:r,ssr:!0,data:null,fetchError:o}}}async function U(n){let t=await n();return t?t.error?t.error==="TokenExpired"?{status:"token_expired",session:t}:{status:"error",session:t,error:t.error}:{status:"authenticated",session:t}:{status:"unauthenticated",session:null}}function _(n,t){return async function(e){let o=await F(n,e);o.authError&&t(o.authError);let{authError:a,...s}=o;return s}}function S(n,t){return async function(){let e=await D(n);e.authError&&t(e.authError);let{authError:o,...a}=e;return a}}function q(n,t){return {getAuthProps:S(n,t),getData:_(n,t)}}async function ee(n,t,r={}){let e=await U(n);switch(e.status){case"authenticated":return t(e.session);case"token_expired":return r.onTokenExpired!==void 0?typeof r.onTokenExpired=="function"?r.onTokenExpired():r.onTokenExpired:t(e.session);case"unauthenticated":if(r.onUnauthenticated!==void 0)return typeof r.onUnauthenticated=="function"?r.onUnauthenticated():r.onUnauthenticated;throw new Error("Unauthorized: No active session");case"error":if(r.onError!==void 0)return typeof r.onError=="function"?r.onError(e.error):r.onError;throw new Error(`Unauthorized: ${e.error}`);default:throw new Error("Unknown auth state")}}function re(n,t={}){let{loginUrl:r="/login",protectedPaths:e,publicPaths:o}=t;return async function(s){let{pathname:c}=s.nextUrl;if(o&&o.some(u=>typeof u=="string"?T(c,u):u.test(c)))return NextResponse.next();if(e&&!e.some(u=>typeof u=="string"?T(c,u):u.test(c)))return NextResponse.next();let l=await n();if(!l){let i=new URL(r,s.url),u=s.nextUrl.search?`${c}${s.nextUrl.search}`:c;return i.searchParams.set("returnTo",u),NextResponse.redirect(i)}if(l.error&&l.error!=="TokenExpired"){let i=new URL(r,s.url),u=s.nextUrl.search?`${c}${s.nextUrl.search}`:c;return i.searchParams.set("returnTo",u),i.searchParams.set("error",l.error),NextResponse.redirect(i)}return NextResponse.next()}}function te(n,t){return async(...r)=>{let e=await n();if(!e)throw new Error("Unauthorized: No active session");if(e.error&&e.error!=="TokenExpired")throw new Error(`Unauthorized: ${e.error}`);return t(e,...r)}}
+
+export { d as createAuthConfig, re as createAuthMiddleware, I as createAuthOptions, Q as createImmutableAuth, S as createProtectedAuthProps, _ as createProtectedDataFetcher, q as createProtectedFetchers, D as getAuthProps, F as getAuthenticatedData, U as getValidSession, te as withAuth, ee as withServerAuth };

package/dist/node/index.cjs

@@ -1,436 +1,25 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+'use strict';
 
-// src/index.ts
-var src_exports = {};
-__export(src_exports, {
-  createAuthConfig: () => createAuthConfig,
-  createAuthMiddleware: () => createAuthMiddleware,
-  createAuthOptions: () => createAuthOptions,
-  createImmutableAuth: () => createImmutableAuth,
-  createProtectedAuthProps: () => createProtectedAuthProps,
-  createProtectedDataFetcher: () => createProtectedDataFetcher,
-  createProtectedFetchers: () => createProtectedFetchers,
-  getAuthProps: () => getAuthProps,
-  getAuthenticatedData: () => getAuthenticatedData,
-  getValidSession: () => getValidSession,
-  withAuth: () => withAuth,
-  withServerAuth: () => withServerAuth
-});
-module.exports = __toCommonJS(src_exports);
-var import_next_auth = __toESM(require("next-auth"), 1);
-var import_server = require("next/server");
+var E = require('next-auth');
+var server = require('next/server');
+var k = require('next-auth/providers/credentials');
 
-// src/config.ts
-var import_credentials = __toESM(require("next-auth/providers/credentials"), 1);
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
-// src/constants.ts
-var DEFAULT_AUTH_DOMAIN = "https://auth.immutable.com";
-var IMMUTABLE_PROVIDER_ID = "immutable";
-var DEFAULT_TOKEN_EXPIRY_SECONDS = 900;
-var DEFAULT_TOKEN_EXPIRY_MS = DEFAULT_TOKEN_EXPIRY_SECONDS * 1e3;
-var TOKEN_EXPIRY_BUFFER_SECONDS = 60;
-var DEFAULT_SESSION_MAX_AGE_SECONDS = 365 * 24 * 60 * 60;
+var E__default = /*#__PURE__*/_interopDefault(E);
+var k__default = /*#__PURE__*/_interopDefault(k);
 
-// src/refresh.ts
-function isTokenExpired(accessTokenExpires, bufferSeconds = TOKEN_EXPIRY_BUFFER_SECONDS) {
-  if (typeof accessTokenExpires !== "number" || Number.isNaN(accessTokenExpires)) {
-    return true;
-  }
-  return Date.now() >= accessTokenExpires - bufferSeconds * 1e3;
-}
+var d="https://auth.immutable.com";var T="immutable";function m(n,t=60){return typeof n!="number"||Number.isNaN(n)?!0:Date.now()>=n-t*1e3}var P=k__default.default.default||k__default.default;async function b(n,t){try{let r=await fetch(`${t}/userinfo`,{method:"GET",headers:{Authorization:`Bearer ${n}`}});return r.ok?await r.json():(console.error("[auth-next-server] Token validation failed:",r.status,r.statusText),null)}catch(r){return console.error("[auth-next-server] Token validation error:",r),null}}function f(n){let t=n.authenticationDomain||d;return {providers:[P({id:T,name:"Immutable",credentials:{tokens:{label:"Tokens",type:"text"}},async authorize(r){if(!r?.tokens||typeof r.tokens!="string")return null;let e;try{e=JSON.parse(r.tokens);}catch(a){return console.error("[auth-next-server] Failed to parse token data:",a),null}if(!e.accessToken||typeof e.accessToken!="string"||!e.profile||typeof e.profile!="object"||!e.profile.sub||typeof e.profile.sub!="string"||typeof e.accessTokenExpires!="number"||Number.isNaN(e.accessTokenExpires))return console.error("[auth-next-server] Invalid token data structure - missing required fields"),null;let o=await b(e.accessToken,t);return o?o.sub!==e.profile.sub?(console.error("[auth-next-server] User ID mismatch - userinfo sub:",o.sub,"provided sub:",e.profile.sub),null):{id:o.sub,sub:o.sub,email:o.email??e.profile.email,nickname:o.nickname??e.profile.nickname,accessToken:e.accessToken,refreshToken:e.refreshToken,idToken:e.idToken,accessTokenExpires:e.accessTokenExpires,zkEvm:e.zkEvm}:(console.error("[auth-next-server] Token validation failed - rejecting authentication"),null)}})],callbacks:{async jwt({token:r,user:e,trigger:o,session:a}){if(e)return {...r,sub:e.sub,email:e.email,nickname:e.nickname,accessToken:e.accessToken,refreshToken:e.refreshToken,idToken:e.idToken,accessTokenExpires:e.accessTokenExpires,zkEvm:e.zkEvm};if(o==="update"&&a){let s=a;return {...r,...s.accessToken?{accessToken:s.accessToken}:{},...s.refreshToken?{refreshToken:s.refreshToken}:{},...s.idToken?{idToken:s.idToken}:{},...s.accessTokenExpires?{accessTokenExpires:s.accessTokenExpires}:{},...s.zkEvm?{zkEvm:s.zkEvm}:{},error:void 0}}return m(r.accessTokenExpires)?{...r,error:"TokenExpired"}:r},async session({session:r,token:e}){return {...r,user:{...r.user,sub:e.sub,email:e.email,nickname:e.nickname},accessToken:e.accessToken,refreshToken:e.refreshToken,idToken:e.idToken,accessTokenExpires:e.accessTokenExpires,zkEvm:e.zkEvm,...e.error&&{error:e.error}}}},session:{strategy:"jwt",maxAge:31536e3}}}var y=f;function p(n,t){if(n===t)return !0;let r=t.endsWith("/")?t:`${t}/`;return n.startsWith(r)}var x=E__default.default.default||E__default.default;function $(n,t){let r=f(n);if(!t)return x(r);let{callbacks:e,...o}=t,a={...r.callbacks};if(e){if(e.jwt){let c=r.callbacks?.jwt,l=e.jwt;a.jwt=async i=>{let u=c?await c(i):i.token;return l({...i,token:u})};}if(e.session){let c=r.callbacks?.session,l=e.session;a.session=async i=>{let u=c?await c(i):i.session;return l({...i,session:u})};}e.signIn&&(a.signIn=e.signIn),e.redirect&&(a.redirect=e.redirect),e.authorized&&(a.authorized=e.authorized);}let s={...r,...o,callbacks:a};return x(s)}async function w(n){let t=await n();return t?t.error==="TokenExpired"?{session:null,ssr:!1}:t.error?{session:null,ssr:!1,authError:t.error}:{session:t,ssr:!0}:{session:null,ssr:!1}}async function I(n,t){let r=await n();if(!r)return {session:null,ssr:!1,data:null};if(r.error==="TokenExpired")return {session:null,ssr:!1,data:null};if(r.error)return {session:null,ssr:!1,data:null,authError:r.error};try{let e=await t(r.accessToken);return {session:r,ssr:!0,data:e}}catch(e){let o=e instanceof Error?e.message:String(e);return {session:r,ssr:!0,data:null,fetchError:o}}}async function D(n){let t=await n();return t?t.error?t.error==="TokenExpired"?{status:"token_expired",session:t}:{status:"error",session:t,error:t.error}:{status:"authenticated",session:t}:{status:"unauthenticated",session:null}}function F(n,t){return async function(e){let o=await I(n,e);o.authError&&t(o.authError);let{authError:a,...s}=o;return s}}function U(n,t){return async function(){let e=await w(n);e.authError&&t(e.authError);let{authError:o,...a}=e;return a}}function H(n,t){return {getAuthProps:U(n,t),getData:F(n,t)}}async function X(n,t,r={}){let e=await D(n);switch(e.status){case"authenticated":return t(e.session);case"token_expired":return r.onTokenExpired!==void 0?typeof r.onTokenExpired=="function"?r.onTokenExpired():r.onTokenExpired:t(e.session);case"unauthenticated":if(r.onUnauthenticated!==void 0)return typeof r.onUnauthenticated=="function"?r.onUnauthenticated():r.onUnauthenticated;throw new Error("Unauthorized: No active session");case"error":if(r.onError!==void 0)return typeof r.onError=="function"?r.onError(e.error):r.onError;throw new Error(`Unauthorized: ${e.error}`);default:throw new Error("Unknown auth state")}}function B(n,t={}){let{loginUrl:r="/login",protectedPaths:e,publicPaths:o}=t;return async function(s){let{pathname:c}=s.nextUrl;if(o&&o.some(u=>typeof u=="string"?p(c,u):u.test(c)))return server.NextResponse.next();if(e&&!e.some(u=>typeof u=="string"?p(c,u):u.test(c)))return server.NextResponse.next();let l=await n();if(!l){let i=new URL(r,s.url),u=s.nextUrl.search?`${c}${s.nextUrl.search}`:c;return i.searchParams.set("returnTo",u),server.NextResponse.redirect(i)}if(l.error&&l.error!=="TokenExpired"){let i=new URL(r,s.url),u=s.nextUrl.search?`${c}${s.nextUrl.search}`:c;return i.searchParams.set("returnTo",u),i.searchParams.set("error",l.error),server.NextResponse.redirect(i)}return server.NextResponse.next()}}function K(n,t){return async(...r)=>{let e=await n();if(!e)throw new Error("Unauthorized: No active session");if(e.error&&e.error!=="TokenExpired")throw new Error(`Unauthorized: ${e.error}`);return t(e,...r)}}
 
-// src/config.ts
-var Credentials = import_credentials.default.default || import_credentials.default;
-async function validateTokens(accessToken, authDomain) {
-  try {
-    const response = await fetch(`${authDomain}/userinfo`, {
-      method: "GET",
-      headers: {
-        Authorization: `Bearer ${accessToken}`
-      }
-    });
-    if (!response.ok) {
-      console.error("[auth-next-server] Token validation failed:", response.status, response.statusText);
-      return null;
-    }
-    return await response.json();
-  } catch (error) {
-    console.error("[auth-next-server] Token validation error:", error);
-    return null;
-  }
-}
-function createAuthConfig(config) {
-  const authDomain = config.authenticationDomain || DEFAULT_AUTH_DOMAIN;
-  return {
-    providers: [
-      Credentials({
-        id: IMMUTABLE_PROVIDER_ID,
-        name: "Immutable",
-        credentials: {
-          tokens: { label: "Tokens", type: "text" }
-        },
-        async authorize(credentials) {
-          if (!credentials?.tokens || typeof credentials.tokens !== "string") {
-            return null;
-          }
-          let tokenData;
-          try {
-            tokenData = JSON.parse(credentials.tokens);
-          } catch (error) {
-            console.error("[auth-next-server] Failed to parse token data:", error);
-            return null;
-          }
-          if (!tokenData.accessToken || typeof tokenData.accessToken !== "string" || !tokenData.profile || typeof tokenData.profile !== "object" || !tokenData.profile.sub || typeof tokenData.profile.sub !== "string" || typeof tokenData.accessTokenExpires !== "number" || Number.isNaN(tokenData.accessTokenExpires)) {
-            console.error("[auth-next-server] Invalid token data structure - missing required fields");
-            return null;
-          }
-          const userInfo = await validateTokens(tokenData.accessToken, authDomain);
-          if (!userInfo) {
-            console.error("[auth-next-server] Token validation failed - rejecting authentication");
-            return null;
-          }
-          if (userInfo.sub !== tokenData.profile.sub) {
-            console.error(
-              "[auth-next-server] User ID mismatch - userinfo sub:",
-              userInfo.sub,
-              "provided sub:",
-              tokenData.profile.sub
-            );
-            return null;
-          }
-          return {
-            id: userInfo.sub,
-            sub: userInfo.sub,
-            email: userInfo.email ?? tokenData.profile.email,
-            nickname: userInfo.nickname ?? tokenData.profile.nickname,
-            accessToken: tokenData.accessToken,
-            refreshToken: tokenData.refreshToken,
-            idToken: tokenData.idToken,
-            accessTokenExpires: tokenData.accessTokenExpires,
-            zkEvm: tokenData.zkEvm
-          };
-        }
-      })
-    ],
-    callbacks: {
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      async jwt({
-        token,
-        user,
-        trigger,
-        session: sessionUpdate
-      }) {
-        if (user) {
-          return {
-            ...token,
-            sub: user.sub,
-            email: user.email,
-            nickname: user.nickname,
-            accessToken: user.accessToken,
-            refreshToken: user.refreshToken,
-            idToken: user.idToken,
-            accessTokenExpires: user.accessTokenExpires,
-            zkEvm: user.zkEvm
-          };
-        }
-        if (trigger === "update" && sessionUpdate) {
-          const update = sessionUpdate;
-          return {
-            ...token,
-            ...update.accessToken ? { accessToken: update.accessToken } : {},
-            ...update.refreshToken ? { refreshToken: update.refreshToken } : {},
-            ...update.idToken ? { idToken: update.idToken } : {},
-            ...update.accessTokenExpires ? { accessTokenExpires: update.accessTokenExpires } : {},
-            ...update.zkEvm ? { zkEvm: update.zkEvm } : {},
-            // Clear any stale error when valid tokens are synced from client-side
-            error: void 0
-          };
-        }
-        if (!isTokenExpired(token.accessTokenExpires)) {
-          return token;
-        }
-        return {
-          ...token,
-          error: "TokenExpired"
-        };
-      },
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      async session({ session, token }) {
-        return {
-          ...session,
-          user: {
-            ...session.user,
-            sub: token.sub,
-            email: token.email,
-            nickname: token.nickname
-          },
-          accessToken: token.accessToken,
-          refreshToken: token.refreshToken,
-          idToken: token.idToken,
-          accessTokenExpires: token.accessTokenExpires,
-          zkEvm: token.zkEvm,
-          ...token.error && { error: token.error }
-        };
-      }
-    },
-    session: {
-      strategy: "jwt",
-      // Session max age in seconds (365 days default)
-      maxAge: DEFAULT_SESSION_MAX_AGE_SECONDS
-    }
-  };
-}
-var createAuthOptions = createAuthConfig;
-
-// src/utils/pathMatch.ts
-function matchPathPrefix(pathname, pattern) {
-  if (pathname === pattern) return true;
-  const prefix = pattern.endsWith("/") ? pattern : `${pattern}/`;
-  return pathname.startsWith(prefix);
-}
-
-// src/index.ts
-var NextAuth = import_next_auth.default.default || import_next_auth.default;
-function createImmutableAuth(config, overrides) {
-  const baseConfig = createAuthConfig(config);
-  if (!overrides) {
-    return NextAuth(baseConfig);
-  }
-  const { callbacks: overrideCallbacks, ...otherOverrides } = overrides;
-  const composedCallbacks = { ...baseConfig.callbacks };
-  if (overrideCallbacks) {
-    if (overrideCallbacks.jwt) {
-      const baseJwt = baseConfig.callbacks?.jwt;
-      const userJwt = overrideCallbacks.jwt;
-      composedCallbacks.jwt = async (params) => {
-        const result = baseJwt ? await baseJwt(params) : params.token;
-        return userJwt({ ...params, token: result });
-      };
-    }
-    if (overrideCallbacks.session) {
-      const baseSession = baseConfig.callbacks?.session;
-      const userSession = overrideCallbacks.session;
-      composedCallbacks.session = async (params) => {
-        const result = baseSession ? await baseSession(params) : params.session;
-        return userSession({ ...params, session: result });
-      };
-    }
-    if (overrideCallbacks.signIn) {
-      composedCallbacks.signIn = overrideCallbacks.signIn;
-    }
-    if (overrideCallbacks.redirect) {
-      composedCallbacks.redirect = overrideCallbacks.redirect;
-    }
-    if (overrideCallbacks.authorized) {
-      composedCallbacks.authorized = overrideCallbacks.authorized;
-    }
-  }
-  const mergedConfig = {
-    ...baseConfig,
-    ...otherOverrides,
-    callbacks: composedCallbacks
-  };
-  return NextAuth(mergedConfig);
-}
-async function getAuthProps(auth) {
-  const session = await auth();
-  if (!session) {
-    return { session: null, ssr: false };
-  }
-  if (session.error === "TokenExpired") {
-    return { session: null, ssr: false };
-  }
-  if (session.error) {
-    return { session: null, ssr: false, authError: session.error };
-  }
-  return { session, ssr: true };
-}
-async function getAuthenticatedData(auth, fetcher) {
-  const session = await auth();
-  if (!session) {
-    return { session: null, ssr: false, data: null };
-  }
-  if (session.error === "TokenExpired") {
-    return { session: null, ssr: false, data: null };
-  }
-  if (session.error) {
-    return {
-      session: null,
-      ssr: false,
-      data: null,
-      authError: session.error
-    };
-  }
-  try {
-    const data = await fetcher(session.accessToken);
-    return { session, ssr: true, data };
-  } catch (err) {
-    const errorMessage = err instanceof Error ? err.message : String(err);
-    return {
-      session,
-      ssr: true,
-      data: null,
-      fetchError: errorMessage
-    };
-  }
-}
-async function getValidSession(auth) {
-  const session = await auth();
-  if (!session) {
-    return { status: "unauthenticated", session: null };
-  }
-  if (!session.error) {
-    return { status: "authenticated", session };
-  }
-  if (session.error === "TokenExpired") {
-    return { status: "token_expired", session };
-  }
-  return { status: "error", session, error: session.error };
-}
-function createProtectedDataFetcher(auth, onAuthError) {
-  return async function getProtectedData(fetcher) {
-    const result = await getAuthenticatedData(auth, fetcher);
-    if (result.authError) {
-      onAuthError(result.authError);
-    }
-    const { authError: handledAuthError, ...props } = result;
-    return props;
-  };
-}
-function createProtectedAuthProps(auth, onAuthError) {
-  return async function getProtectedAuth() {
-    const result = await getAuthProps(auth);
-    if (result.authError) {
-      onAuthError(result.authError);
-    }
-    const { authError: handledAuthError, ...props } = result;
-    return props;
-  };
-}
-function createProtectedFetchers(auth, onAuthError) {
-  return {
-    getAuthProps: createProtectedAuthProps(auth, onAuthError),
-    getData: createProtectedDataFetcher(auth, onAuthError)
-  };
-}
-async function withServerAuth(auth, serverRender, options = {}) {
-  const result = await getValidSession(auth);
-  switch (result.status) {
-    case "authenticated":
-      return serverRender(result.session);
-    case "token_expired":
-      if (options.onTokenExpired !== void 0) {
-        return typeof options.onTokenExpired === "function" ? options.onTokenExpired() : options.onTokenExpired;
-      }
-      return serverRender(result.session);
-    case "unauthenticated":
-      if (options.onUnauthenticated !== void 0) {
-        return typeof options.onUnauthenticated === "function" ? options.onUnauthenticated() : options.onUnauthenticated;
-      }
-      throw new Error("Unauthorized: No active session");
-    case "error":
-      if (options.onError !== void 0) {
-        return typeof options.onError === "function" ? options.onError(result.error) : options.onError;
-      }
-      throw new Error(`Unauthorized: ${result.error}`);
-    default:
-      throw new Error("Unknown auth state");
-  }
-}
-function createAuthMiddleware(auth, options = {}) {
-  const { loginUrl = "/login", protectedPaths, publicPaths } = options;
-  return async function middleware(request) {
-    const { pathname } = request.nextUrl;
-    if (publicPaths) {
-      const isPublic = publicPaths.some((pattern) => {
-        if (typeof pattern === "string") {
-          return matchPathPrefix(pathname, pattern);
-        }
-        return pattern.test(pathname);
-      });
-      if (isPublic) {
-        return import_server.NextResponse.next();
-      }
-    }
-    if (protectedPaths) {
-      const isProtected = protectedPaths.some((pattern) => {
-        if (typeof pattern === "string") {
-          return matchPathPrefix(pathname, pattern);
-        }
-        return pattern.test(pathname);
-      });
-      if (!isProtected) {
-        return import_server.NextResponse.next();
-      }
-    }
-    const session = await auth();
-    if (!session) {
-      const url = new URL(loginUrl, request.url);
-      const returnTo = request.nextUrl.search ? `${pathname}${request.nextUrl.search}` : pathname;
-      url.searchParams.set("returnTo", returnTo);
-      return import_server.NextResponse.redirect(url);
-    }
-    if (session.error && session.error !== "TokenExpired") {
-      const url = new URL(loginUrl, request.url);
-      const returnTo = request.nextUrl.search ? `${pathname}${request.nextUrl.search}` : pathname;
-      url.searchParams.set("returnTo", returnTo);
-      url.searchParams.set("error", session.error);
-      return import_server.NextResponse.redirect(url);
-    }
-    return import_server.NextResponse.next();
-  };
-}
-function withAuth(auth, handler) {
-  return async (...args) => {
-    const session = await auth();
-    if (!session) {
-      throw new Error("Unauthorized: No active session");
-    }
-    if (session.error && session.error !== "TokenExpired") {
-      throw new Error(`Unauthorized: ${session.error}`);
-    }
-    return handler(session, ...args);
-  };
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  createAuthConfig,
-  createAuthMiddleware,
-  createAuthOptions,
-  createImmutableAuth,
-  createProtectedAuthProps,
-  createProtectedDataFetcher,
-  createProtectedFetchers,
-  getAuthProps,
-  getAuthenticatedData,
-  getValidSession,
-  withAuth,
-  withServerAuth
-});
+exports.createAuthConfig = f;
+exports.createAuthMiddleware = B;
+exports.createAuthOptions = y;
+exports.createImmutableAuth = $;
+exports.createProtectedAuthProps = U;
+exports.createProtectedDataFetcher = F;
+exports.createProtectedFetchers = H;
+exports.getAuthProps = w;
+exports.getAuthenticatedData = I;
+exports.getValidSession = D;
+exports.withAuth = K;
+exports.withServerAuth = X;

package/dist/node/index.js

@@ -1,390 +1,7 @@
-// src/index.ts
-import NextAuthImport from "next-auth";
-import { NextResponse } from "next/server";
+import E from 'next-auth';
+import { NextResponse } from 'next/server';
+import k from 'next-auth/providers/credentials';
 
-// src/config.ts
-import CredentialsImport from "next-auth/providers/credentials";
+var d="https://auth.immutable.com";var T="immutable";function m(n,t=60){return typeof n!="number"||Number.isNaN(n)?!0:Date.now()>=n-t*1e3}var P=k.default||k;async function b(n,t){try{let r=await fetch(`${t}/userinfo`,{method:"GET",headers:{Authorization:`Bearer ${n}`}});return r.ok?await r.json():(console.error("[auth-next-server] Token validation failed:",r.status,r.statusText),null)}catch(r){return console.error("[auth-next-server] Token validation error:",r),null}}function f(n){let t=n.authenticationDomain||d;return {providers:[P({id:T,name:"Immutable",credentials:{tokens:{label:"Tokens",type:"text"}},async authorize(r){if(!r?.tokens||typeof r.tokens!="string")return null;let e;try{e=JSON.parse(r.tokens);}catch(a){return console.error("[auth-next-server] Failed to parse token data:",a),null}if(!e.accessToken||typeof e.accessToken!="string"||!e.profile||typeof e.profile!="object"||!e.profile.sub||typeof e.profile.sub!="string"||typeof e.accessTokenExpires!="number"||Number.isNaN(e.accessTokenExpires))return console.error("[auth-next-server] Invalid token data structure - missing required fields"),null;let o=await b(e.accessToken,t);return o?o.sub!==e.profile.sub?(console.error("[auth-next-server] User ID mismatch - userinfo sub:",o.sub,"provided sub:",e.profile.sub),null):{id:o.sub,sub:o.sub,email:o.email??e.profile.email,nickname:o.nickname??e.profile.nickname,accessToken:e.accessToken,refreshToken:e.refreshToken,idToken:e.idToken,accessTokenExpires:e.accessTokenExpires,zkEvm:e.zkEvm}:(console.error("[auth-next-server] Token validation failed - rejecting authentication"),null)}})],callbacks:{async jwt({token:r,user:e,trigger:o,session:a}){if(e)return {...r,sub:e.sub,email:e.email,nickname:e.nickname,accessToken:e.accessToken,refreshToken:e.refreshToken,idToken:e.idToken,accessTokenExpires:e.accessTokenExpires,zkEvm:e.zkEvm};if(o==="update"&&a){let s=a;return {...r,...s.accessToken?{accessToken:s.accessToken}:{},...s.refreshToken?{refreshToken:s.refreshToken}:{},...s.idToken?{idToken:s.idToken}:{},...s.accessTokenExpires?{accessTokenExpires:s.accessTokenExpires}:{},...s.zkEvm?{zkEvm:s.zkEvm}:{},error:void 0}}return m(r.accessTokenExpires)?{...r,error:"TokenExpired"}:r},async session({session:r,token:e}){return {...r,user:{...r.user,sub:e.sub,email:e.email,nickname:e.nickname},accessToken:e.accessToken,refreshToken:e.refreshToken,idToken:e.idToken,accessTokenExpires:e.accessTokenExpires,zkEvm:e.zkEvm,...e.error&&{error:e.error}}}},session:{strategy:"jwt",maxAge:31536e3}}}var y=f;function p(n,t){if(n===t)return !0;let r=t.endsWith("/")?t:`${t}/`;return n.startsWith(r)}var x=E.default||E;function $(n,t){let r=f(n);if(!t)return x(r);let{callbacks:e,...o}=t,a={...r.callbacks};if(e){if(e.jwt){let c=r.callbacks?.jwt,l=e.jwt;a.jwt=async i=>{let u=c?await c(i):i.token;return l({...i,token:u})};}if(e.session){let c=r.callbacks?.session,l=e.session;a.session=async i=>{let u=c?await c(i):i.session;return l({...i,session:u})};}e.signIn&&(a.signIn=e.signIn),e.redirect&&(a.redirect=e.redirect),e.authorized&&(a.authorized=e.authorized);}let s={...r,...o,callbacks:a};return x(s)}async function w(n){let t=await n();return t?t.error==="TokenExpired"?{session:null,ssr:!1}:t.error?{session:null,ssr:!1,authError:t.error}:{session:t,ssr:!0}:{session:null,ssr:!1}}async function I(n,t){let r=await n();if(!r)return {session:null,ssr:!1,data:null};if(r.error==="TokenExpired")return {session:null,ssr:!1,data:null};if(r.error)return {session:null,ssr:!1,data:null,authError:r.error};try{let e=await t(r.accessToken);return {session:r,ssr:!0,data:e}}catch(e){let o=e instanceof Error?e.message:String(e);return {session:r,ssr:!0,data:null,fetchError:o}}}async function D(n){let t=await n();return t?t.error?t.error==="TokenExpired"?{status:"token_expired",session:t}:{status:"error",session:t,error:t.error}:{status:"authenticated",session:t}:{status:"unauthenticated",session:null}}function F(n,t){return async function(e){let o=await I(n,e);o.authError&&t(o.authError);let{authError:a,...s}=o;return s}}function U(n,t){return async function(){let e=await w(n);e.authError&&t(e.authError);let{authError:o,...a}=e;return a}}function H(n,t){return {getAuthProps:U(n,t),getData:F(n,t)}}async function X(n,t,r={}){let e=await D(n);switch(e.status){case"authenticated":return t(e.session);case"token_expired":return r.onTokenExpired!==void 0?typeof r.onTokenExpired=="function"?r.onTokenExpired():r.onTokenExpired:t(e.session);case"unauthenticated":if(r.onUnauthenticated!==void 0)return typeof r.onUnauthenticated=="function"?r.onUnauthenticated():r.onUnauthenticated;throw new Error("Unauthorized: No active session");case"error":if(r.onError!==void 0)return typeof r.onError=="function"?r.onError(e.error):r.onError;throw new Error(`Unauthorized: ${e.error}`);default:throw new Error("Unknown auth state")}}function B(n,t={}){let{loginUrl:r="/login",protectedPaths:e,publicPaths:o}=t;return async function(s){let{pathname:c}=s.nextUrl;if(o&&o.some(u=>typeof u=="string"?p(c,u):u.test(c)))return NextResponse.next();if(e&&!e.some(u=>typeof u=="string"?p(c,u):u.test(c)))return NextResponse.next();let l=await n();if(!l){let i=new URL(r,s.url),u=s.nextUrl.search?`${c}${s.nextUrl.search}`:c;return i.searchParams.set("returnTo",u),NextResponse.redirect(i)}if(l.error&&l.error!=="TokenExpired"){let i=new URL(r,s.url),u=s.nextUrl.search?`${c}${s.nextUrl.search}`:c;return i.searchParams.set("returnTo",u),i.searchParams.set("error",l.error),NextResponse.redirect(i)}return NextResponse.next()}}function K(n,t){return async(...r)=>{let e=await n();if(!e)throw new Error("Unauthorized: No active session");if(e.error&&e.error!=="TokenExpired")throw new Error(`Unauthorized: ${e.error}`);return t(e,...r)}}
 
-// src/constants.ts
-var DEFAULT_AUTH_DOMAIN = "https://auth.immutable.com";
-var IMMUTABLE_PROVIDER_ID = "immutable";
-var DEFAULT_TOKEN_EXPIRY_SECONDS = 900;
-var DEFAULT_TOKEN_EXPIRY_MS = DEFAULT_TOKEN_EXPIRY_SECONDS * 1e3;
-var TOKEN_EXPIRY_BUFFER_SECONDS = 60;
-var DEFAULT_SESSION_MAX_AGE_SECONDS = 365 * 24 * 60 * 60;
-
-// src/refresh.ts
-function isTokenExpired(accessTokenExpires, bufferSeconds = TOKEN_EXPIRY_BUFFER_SECONDS) {
-  if (typeof accessTokenExpires !== "number" || Number.isNaN(accessTokenExpires)) {
-    return true;
-  }
-  return Date.now() >= accessTokenExpires - bufferSeconds * 1e3;
-}
-
-// src/config.ts
-var Credentials = CredentialsImport.default || CredentialsImport;
-async function validateTokens(accessToken, authDomain) {
-  try {
-    const response = await fetch(`${authDomain}/userinfo`, {
-      method: "GET",
-      headers: {
-        Authorization: `Bearer ${accessToken}`
-      }
-    });
-    if (!response.ok) {
-      console.error("[auth-next-server] Token validation failed:", response.status, response.statusText);
-      return null;
-    }
-    return await response.json();
-  } catch (error) {
-    console.error("[auth-next-server] Token validation error:", error);
-    return null;
-  }
-}
-function createAuthConfig(config) {
-  const authDomain = config.authenticationDomain || DEFAULT_AUTH_DOMAIN;
-  return {
-    providers: [
-      Credentials({
-        id: IMMUTABLE_PROVIDER_ID,
-        name: "Immutable",
-        credentials: {
-          tokens: { label: "Tokens", type: "text" }
-        },
-        async authorize(credentials) {
-          if (!credentials?.tokens || typeof credentials.tokens !== "string") {
-            return null;
-          }
-          let tokenData;
-          try {
-            tokenData = JSON.parse(credentials.tokens);
-          } catch (error) {
-            console.error("[auth-next-server] Failed to parse token data:", error);
-            return null;
-          }
-          if (!tokenData.accessToken || typeof tokenData.accessToken !== "string" || !tokenData.profile || typeof tokenData.profile !== "object" || !tokenData.profile.sub || typeof tokenData.profile.sub !== "string" || typeof tokenData.accessTokenExpires !== "number" || Number.isNaN(tokenData.accessTokenExpires)) {
-            console.error("[auth-next-server] Invalid token data structure - missing required fields");
-            return null;
-          }
-          const userInfo = await validateTokens(tokenData.accessToken, authDomain);
-          if (!userInfo) {
-            console.error("[auth-next-server] Token validation failed - rejecting authentication");
-            return null;
-          }
-          if (userInfo.sub !== tokenData.profile.sub) {
-            console.error(
-              "[auth-next-server] User ID mismatch - userinfo sub:",
-              userInfo.sub,
-              "provided sub:",
-              tokenData.profile.sub
-            );
-            return null;
-          }
-          return {
-            id: userInfo.sub,
-            sub: userInfo.sub,
-            email: userInfo.email ?? tokenData.profile.email,
-            nickname: userInfo.nickname ?? tokenData.profile.nickname,
-            accessToken: tokenData.accessToken,
-            refreshToken: tokenData.refreshToken,
-            idToken: tokenData.idToken,
-            accessTokenExpires: tokenData.accessTokenExpires,
-            zkEvm: tokenData.zkEvm
-          };
-        }
-      })
-    ],
-    callbacks: {
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      async jwt({
-        token,
-        user,
-        trigger,
-        session: sessionUpdate
-      }) {
-        if (user) {
-          return {
-            ...token,
-            sub: user.sub,
-            email: user.email,
-            nickname: user.nickname,
-            accessToken: user.accessToken,
-            refreshToken: user.refreshToken,
-            idToken: user.idToken,
-            accessTokenExpires: user.accessTokenExpires,
-            zkEvm: user.zkEvm
-          };
-        }
-        if (trigger === "update" && sessionUpdate) {
-          const update = sessionUpdate;
-          return {
-            ...token,
-            ...update.accessToken ? { accessToken: update.accessToken } : {},
-            ...update.refreshToken ? { refreshToken: update.refreshToken } : {},
-            ...update.idToken ? { idToken: update.idToken } : {},
-            ...update.accessTokenExpires ? { accessTokenExpires: update.accessTokenExpires } : {},
-            ...update.zkEvm ? { zkEvm: update.zkEvm } : {},
-            // Clear any stale error when valid tokens are synced from client-side
-            error: void 0
-          };
-        }
-        if (!isTokenExpired(token.accessTokenExpires)) {
-          return token;
-        }
-        return {
-          ...token,
-          error: "TokenExpired"
-        };
-      },
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      async session({ session, token }) {
-        return {
-          ...session,
-          user: {
-            ...session.user,
-            sub: token.sub,
-            email: token.email,
-            nickname: token.nickname
-          },
-          accessToken: token.accessToken,
-          refreshToken: token.refreshToken,
-          idToken: token.idToken,
-          accessTokenExpires: token.accessTokenExpires,
-          zkEvm: token.zkEvm,
-          ...token.error && { error: token.error }
-        };
-      }
-    },
-    session: {
-      strategy: "jwt",
-      // Session max age in seconds (365 days default)
-      maxAge: DEFAULT_SESSION_MAX_AGE_SECONDS
-    }
-  };
-}
-var createAuthOptions = createAuthConfig;
-
-// src/utils/pathMatch.ts
-function matchPathPrefix(pathname, pattern) {
-  if (pathname === pattern) return true;
-  const prefix = pattern.endsWith("/") ? pattern : `${pattern}/`;
-  return pathname.startsWith(prefix);
-}
-
-// src/index.ts
-var NextAuth = NextAuthImport.default || NextAuthImport;
-function createImmutableAuth(config, overrides) {
-  const baseConfig = createAuthConfig(config);
-  if (!overrides) {
-    return NextAuth(baseConfig);
-  }
-  const { callbacks: overrideCallbacks, ...otherOverrides } = overrides;
-  const composedCallbacks = { ...baseConfig.callbacks };
-  if (overrideCallbacks) {
-    if (overrideCallbacks.jwt) {
-      const baseJwt = baseConfig.callbacks?.jwt;
-      const userJwt = overrideCallbacks.jwt;
-      composedCallbacks.jwt = async (params) => {
-        const result = baseJwt ? await baseJwt(params) : params.token;
-        return userJwt({ ...params, token: result });
-      };
-    }
-    if (overrideCallbacks.session) {
-      const baseSession = baseConfig.callbacks?.session;
-      const userSession = overrideCallbacks.session;
-      composedCallbacks.session = async (params) => {
-        const result = baseSession ? await baseSession(params) : params.session;
-        return userSession({ ...params, session: result });
-      };
-    }
-    if (overrideCallbacks.signIn) {
-      composedCallbacks.signIn = overrideCallbacks.signIn;
-    }
-    if (overrideCallbacks.redirect) {
-      composedCallbacks.redirect = overrideCallbacks.redirect;
-    }
-    if (overrideCallbacks.authorized) {
-      composedCallbacks.authorized = overrideCallbacks.authorized;
-    }
-  }
-  const mergedConfig = {
-    ...baseConfig,
-    ...otherOverrides,
-    callbacks: composedCallbacks
-  };
-  return NextAuth(mergedConfig);
-}
-async function getAuthProps(auth) {
-  const session = await auth();
-  if (!session) {
-    return { session: null, ssr: false };
-  }
-  if (session.error === "TokenExpired") {
-    return { session: null, ssr: false };
-  }
-  if (session.error) {
-    return { session: null, ssr: false, authError: session.error };
-  }
-  return { session, ssr: true };
-}
-async function getAuthenticatedData(auth, fetcher) {
-  const session = await auth();
-  if (!session) {
-    return { session: null, ssr: false, data: null };
-  }
-  if (session.error === "TokenExpired") {
-    return { session: null, ssr: false, data: null };
-  }
-  if (session.error) {
-    return {
-      session: null,
-      ssr: false,
-      data: null,
-      authError: session.error
-    };
-  }
-  try {
-    const data = await fetcher(session.accessToken);
-    return { session, ssr: true, data };
-  } catch (err) {
-    const errorMessage = err instanceof Error ? err.message : String(err);
-    return {
-      session,
-      ssr: true,
-      data: null,
-      fetchError: errorMessage
-    };
-  }
-}
-async function getValidSession(auth) {
-  const session = await auth();
-  if (!session) {
-    return { status: "unauthenticated", session: null };
-  }
-  if (!session.error) {
-    return { status: "authenticated", session };
-  }
-  if (session.error === "TokenExpired") {
-    return { status: "token_expired", session };
-  }
-  return { status: "error", session, error: session.error };
-}
-function createProtectedDataFetcher(auth, onAuthError) {
-  return async function getProtectedData(fetcher) {
-    const result = await getAuthenticatedData(auth, fetcher);
-    if (result.authError) {
-      onAuthError(result.authError);
-    }
-    const { authError: handledAuthError, ...props } = result;
-    return props;
-  };
-}
-function createProtectedAuthProps(auth, onAuthError) {
-  return async function getProtectedAuth() {
-    const result = await getAuthProps(auth);
-    if (result.authError) {
-      onAuthError(result.authError);
-    }
-    const { authError: handledAuthError, ...props } = result;
-    return props;
-  };
-}
-function createProtectedFetchers(auth, onAuthError) {
-  return {
-    getAuthProps: createProtectedAuthProps(auth, onAuthError),
-    getData: createProtectedDataFetcher(auth, onAuthError)
-  };
-}
-async function withServerAuth(auth, serverRender, options = {}) {
-  const result = await getValidSession(auth);
-  switch (result.status) {
-    case "authenticated":
-      return serverRender(result.session);
-    case "token_expired":
-      if (options.onTokenExpired !== void 0) {
-        return typeof options.onTokenExpired === "function" ? options.onTokenExpired() : options.onTokenExpired;
-      }
-      return serverRender(result.session);
-    case "unauthenticated":
-      if (options.onUnauthenticated !== void 0) {
-        return typeof options.onUnauthenticated === "function" ? options.onUnauthenticated() : options.onUnauthenticated;
-      }
-      throw new Error("Unauthorized: No active session");
-    case "error":
-      if (options.onError !== void 0) {
-        return typeof options.onError === "function" ? options.onError(result.error) : options.onError;
-      }
-      throw new Error(`Unauthorized: ${result.error}`);
-    default:
-      throw new Error("Unknown auth state");
-  }
-}
-function createAuthMiddleware(auth, options = {}) {
-  const { loginUrl = "/login", protectedPaths, publicPaths } = options;
-  return async function middleware(request) {
-    const { pathname } = request.nextUrl;
-    if (publicPaths) {
-      const isPublic = publicPaths.some((pattern) => {
-        if (typeof pattern === "string") {
-          return matchPathPrefix(pathname, pattern);
-        }
-        return pattern.test(pathname);
-      });
-      if (isPublic) {
-        return NextResponse.next();
-      }
-    }
-    if (protectedPaths) {
-      const isProtected = protectedPaths.some((pattern) => {
-        if (typeof pattern === "string") {
-          return matchPathPrefix(pathname, pattern);
-        }
-        return pattern.test(pathname);
-      });
-      if (!isProtected) {
-        return NextResponse.next();
-      }
-    }
-    const session = await auth();
-    if (!session) {
-      const url = new URL(loginUrl, request.url);
-      const returnTo = request.nextUrl.search ? `${pathname}${request.nextUrl.search}` : pathname;
-      url.searchParams.set("returnTo", returnTo);
-      return NextResponse.redirect(url);
-    }
-    if (session.error && session.error !== "TokenExpired") {
-      const url = new URL(loginUrl, request.url);
-      const returnTo = request.nextUrl.search ? `${pathname}${request.nextUrl.search}` : pathname;
-      url.searchParams.set("returnTo", returnTo);
-      url.searchParams.set("error", session.error);
-      return NextResponse.redirect(url);
-    }
-    return NextResponse.next();
-  };
-}
-function withAuth(auth, handler) {
-  return async (...args) => {
-    const session = await auth();
-    if (!session) {
-      throw new Error("Unauthorized: No active session");
-    }
-    if (session.error && session.error !== "TokenExpired") {
-      throw new Error(`Unauthorized: ${session.error}`);
-    }
-    return handler(session, ...args);
-  };
-}
-export {
-  createAuthConfig,
-  createAuthMiddleware,
-  createAuthOptions,
-  createImmutableAuth,
-  createProtectedAuthProps,
-  createProtectedDataFetcher,
-  createProtectedFetchers,
-  getAuthProps,
-  getAuthenticatedData,
-  getValidSession,
-  withAuth,
-  withServerAuth
-};
+export { f as createAuthConfig, B as createAuthMiddleware, y as createAuthOptions, $ as createImmutableAuth, U as createProtectedAuthProps, F as createProtectedDataFetcher, H as createProtectedFetchers, w as getAuthProps, I as getAuthenticatedData, D as getValidSession, K as withAuth, X as withServerAuth };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@imtbl/auth-next-server",
-  "version": "2.12.5-alpha.13",
+  "version": "2.12.5-alpha.14",
   "description": "Immutable Auth.js v5 integration for Next.js - Server-side utilities",
   "author": "Immutable",
   "license": "Apache-2.0",
@@ -11,7 +11,7 @@
   "type": "module",
   "main": "./dist/node/index.cjs",
   "module": "./dist/node/index.js",
-  "types": "./dist/node/index.d.ts",
+  "types": "./dist/types/index.d.ts",
   "exports": {
     ".": {
       "development": {
@@ -20,7 +20,7 @@
         "default": "./dist/node/index.js"
       },
       "default": {
-        "types": "./dist/node/index.d.ts",
+        "types": "./dist/types/index.d.ts",
         "require": "./dist/node/index.cjs",
         "default": "./dist/node/index.js"
       }
@@ -51,10 +51,12 @@
     "typescript": "^5.6.2"
   },
   "scripts": {
-    "build": "tsup && pnpm build:types",
-    "build:types": "tsc --project tsconfig.types.json",
-    "clean": "rm -rf dist",
-    "lint": "eslint src/**/*.ts --max-warnings=0",
+    "build": "pnpm transpile && pnpm typegen",
+    "transpile": "tsup src/index.ts --config ../../tsup.config.js",
+    "typegen": "tsc --customConditions default --emitDeclarationOnly --outDir dist/types",
+    "pack:root": "pnpm pack --pack-destination $(dirname $(pnpm root -w))",
+    "lint": "eslint ./src --ext .ts,.jsx,.tsx --max-warnings=0",
+    "typecheck": "tsc --customConditions default --noEmit --jsx preserve",
     "test": "jest --passWithNoTests"
   }
 }