@imtf/auth 2.0.0 → 3.0.0

package/README.md

@@ -27,7 +27,7 @@ This package supplies IMTF's `better-auth` configuration and a couple of OIDC-fl
 ```ts
 import "server-only";
 
-import { getBetterAuthOptions } from "@imtf/auth";
+import { getBetterAuthOptions } from "@imtf/auth/server";
 import { betterAuth, type BetterAuthOptions } from "better-auth";
 
 export const auth = betterAuth({
@@ -68,7 +68,7 @@ export const POST = handler;
 ### Federated sign-out route: `app/api/auth/sign-out-url/route.ts`
 
 ```ts
-import { getSignOutUrlRoute } from "@imtf/auth";
+import { getSignOutUrlRoute } from "@imtf/auth/server";
 import { headers } from "next/headers";
 import { auth } from "@/auth";
 
@@ -124,14 +124,14 @@ function SignOutButton() {
 
 ### Full export list
 
+The package has two entry points. `@imtf/auth` is safe to import from client components; `@imtf/auth/server` must only be imported from server code.
+
 ```ts
-import {
-  getBetterAuthOptions,
-  getBetterAuthClientOptions,
-  getSignOutUrlRoute,
-  useSignOut,
-  PROVIDER_ID,
-} from "@imtf/auth";
+// Client-safe — no `better-auth` server code in the module graph.
+import { getBetterAuthClientOptions, useSignOut, PROVIDER_ID } from "@imtf/auth";
+
+// Server only — pulls in `better-auth/next-js`, `better-auth/plugins` and `next/headers`.
+import { getBetterAuthOptions, getSignOutUrlRoute, PROVIDER_ID } from "@imtf/auth/server";
 ```
 
 > `getBetterAuthClientOptions` is deprecated as of `better-auth` 1.7 — generic OAuth sign-in no longer needs a client plugin, so `createAuthClient()` can be called with no options as shown above.
@@ -164,4 +164,5 @@ pnpm run test:coverage
 
 - **OAuth callback URL path changed.** The redirect URI that `better-auth` exposes for the generic OIDC provider moved from `{baseURL}/oauth2/callback/{providerId}` to `{baseURL}/callback/{providerId}` (e.g. `https://app.example.com/api/auth/oauth2/callback/oidc-provider` → `https://app.example.com/api/auth/callback/oidc-provider`). **You must update the redirect URI registered with your OIDC provider/IdP client** before deploying this upgrade, or sign-in will fail.
 - **`getSignOutUrlRoute` dropped its `providerId` option.** `better-auth`'s `getAccessToken` API no longer accepts `providerId` to select an account; it now resolves the account from the signed account cookie (`useAccountCookie: true`), matching this package's database-less, `storeAccountCookie: true` configuration. If you were passing `providerId` to `getSignOutUrlRoute`, remove it — it is no longer read.
+- **Server helpers moved to `@imtf/auth/server`.** `getBetterAuthOptions` and `getSignOutUrlRoute` are no longer exported from the package root; update those two imports to `@imtf/auth/server`. The root entry now exposes only the client-safe surface (`PROVIDER_ID`, `useSignOut`, `getBetterAuthClientOptions`). Previously the single barrel re-exported both halves, so any client component importing even a constant from `@imtf/auth` dragged `better-auth`'s server router into the browser bundle — including an unused OpenAPI reference page that loads a script from `cdn.jsdelivr.net`, which reads as a remote-script inclusion to security scanners.
 - **No client plugin is required for generic OAuth sign-in anymore.** `getBetterAuthClientOptions()` no longer registers `genericOAuthClient()` (removed upstream). Generic/custom OAuth providers now sign in through the standard `authClient.signIn.social({ provider })` / `authClient.linkSocial({ provider })` methods. No action needed on your end beyond upgrading — this package's exported options already reflect the change.

package/lib/index.esm.js

@@ -1,6 +1,4 @@
-import { PROVIDER_ID } from "./constants.esm.js";
-import { getBetterAuthOptions } from "./options/auth.esm.js";
 import { getBetterAuthClientOptions } from "./options/auth-client.esm.js";
-import { getSignOutUrlRoute } from "./routes/getSignOutUrlRoute.esm.js";
+import { PROVIDER_ID } from "./constants.esm.js";
 import { useSignOut } from "./hooks/useSignOut.esm.js";
-export { PROVIDER_ID, getBetterAuthClientOptions, getBetterAuthOptions, getSignOutUrlRoute, useSignOut };
+export { PROVIDER_ID, getBetterAuthClientOptions, useSignOut };

package/lib/server.esm.js

@@ -0,0 +1,4 @@
+import { PROVIDER_ID } from "./constants.esm.js";
+import { getBetterAuthOptions } from "./options/auth.esm.js";
+import { getSignOutUrlRoute } from "./routes/getSignOutUrlRoute.esm.js";
+export { PROVIDER_ID, getBetterAuthOptions, getSignOutUrlRoute };

package/lib/types/index.d.ts

@@ -1,5 +1,3 @@
-export { getBetterAuthOptions } from "./options/auth";
 export { getBetterAuthClientOptions } from "./options/auth-client";
-export { getSignOutUrlRoute } from "./routes/getSignOutUrlRoute";
 export { PROVIDER_ID } from "./constants";
 export { useSignOut } from "./hooks/useSignOut";

package/lib/types/server.d.ts

@@ -0,0 +1,3 @@
+export { getBetterAuthOptions } from "./options/auth";
+export { getSignOutUrlRoute } from "./routes/getSignOutUrlRoute";
+export { PROVIDER_ID } from "./constants";

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@imtf/auth",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "description": "Better auth wrapper for imtf usage",
   "license": "UNLICENSED",
   "author": "",
   "type": "module",
+  "sideEffects": false,
   "files": [
     "lib",
     "schemas"
@@ -15,10 +16,14 @@
     ".": {
       "types": "./lib/types/index.d.ts",
       "import": "./lib/index.esm.js"
+    },
+    "./server": {
+      "types": "./lib/types/server.d.ts",
+      "import": "./lib/server.esm.js"
     }
   },
   "dependencies": {
-    "@imtf/panache": "^6.0.0"
+    "@imtf/panache": "^6.0.1"
   },
   "peerDependencies": {
     "@mui/material": "^7.1.0 || ^9.4.0",