@insforge/nextjs 0.6.9 → 0.7.1

package/README.md

@@ -24,9 +24,13 @@
 ## Installation
 
 ```bash
-npm install @insforge/nextjs
+npm install @insforge/nextjs @insforge/sdk
 ```
 
+<Note>
+**SDK Integration**: `@insforge/nextjs` works seamlessly with `@insforge/sdk`. The SDK handles API calls, token management, and OAuth callback detection automatically. Always use SDK methods instead of raw `fetch` calls.
+</Note>
+
 ## Quick Start
 
 ### 1. Add InsforgeProvider
@@ -48,6 +52,8 @@ export default function RootLayout({ children }: { children: React.ReactNode })
 }
 ```
 
+> **✨ Auto-styled**: Component styles are automatically loaded when you add `InsforgeProvider`. No CSS imports needed!
+
 ### 2. Create API route (enables SSR)
 
 ```tsx
@@ -68,12 +74,17 @@ export const DELETE = handlers.DELETE;
 
 ### 3. Create callback page
 
+<Note>
+**SDK Integration**: This callback page uses `@insforge/sdk` to automatically detect and handle URL parameters. The SDK handles token storage automatically, making the callback page simpler and more reliable.
+</Note>
+
 ```tsx
 // app/auth/callback/page.tsx
 'use client';
 
 import { useEffect, useRef, Suspense } from 'react';
 import { useRouter, useSearchParams } from 'next/navigation';
+import { createClient } from '@insforge/sdk';
 
 function CallbackContent() {
   const router = useRouter();
@@ -85,28 +96,45 @@ function CallbackContent() {
       if (isProcessingRef.current) return;
       isProcessingRef.current = true;
 
-      const accessToken = searchParams.get('access_token');
       const error = searchParams.get('error');
-
       if (error) {
         router.push('/?error=' + encodeURIComponent(error));
         return;
       }
 
-      if (accessToken) {
-        localStorage.setItem('insforge-auth-token', accessToken);
-        
+      // Create SDK client - it automatically detects and stores URL parameters
+      // SDK's detectOAuthCallback() handles: access_token, user_id, email, name
+      // This automatically stores token in 'insforge-auth-token' and basic user info
+      const insforge = createClient({
+        baseUrl: process.env.NEXT_PUBLIC_INSFORGE_BASE_URL!,
+      });
+
+      // Fetch complete user data (including profile) using SDK method
+      const { data: userData, error: userError } = await insforge.auth.getCurrentUser();
+
+      if (userError || !userData) {
+        router.push('/?error=authentication_failed');
+        return;
+      }
+
+      // Store complete user profile for InsforgeProvider (enables instant UI updates)
+      localStorage.setItem('insforge-user-profile', JSON.stringify(userData));
+
+      // Sync token to HTTP-only cookie (for server-side middleware)
+      const token = localStorage.getItem('insforge-auth-token');
+      if (token) {
         await fetch('/api/auth', {
           method: 'POST',
           headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ action: 'sync-token', token: accessToken }),
+          body: JSON.stringify({ action: 'sync-token', token }),
         });
-        
-        const destination = sessionStorage.getItem('auth_destination') || '/dashboard';
-        sessionStorage.removeItem('auth_destination');
-        
-        setTimeout(() => router.push(destination), 100);
       }
+
+      // Clean up URL and redirect
+      window.history.replaceState({}, '', '/auth/callback');
+      const destination = sessionStorage.getItem('auth_destination') || '/';
+      sessionStorage.removeItem('auth_destination');
+      setTimeout(() => router.push(destination), 100);
     };
 
     processCallback();
@@ -131,7 +159,7 @@ export default function CallbackPage() {
 }
 ```
 
-> **Why?** Receives token from backend auth pages and syncs to localStorage + cookie.
+> **Why SDK?** The SDK automatically detects URL parameters (`access_token`, `user_id`, `email`, `name`) and stores them. Using SDK methods ensures consistency and reduces errors.
 
 ### 4. Add middleware (protects routes)
 
@@ -192,7 +220,7 @@ export default function Home() {
 
 **Why API route + callback?**
 - **API route**: Syncs tokens to HTTP-only cookies (enables server-side middleware)
-- **Callback page**: Receives tokens from backend auth pages (OAuth + email/password)
+- **Callback page**: Receives tokens from backend auth pages (OAuth + email/password) and uses SDK to handle them automatically
 
 ---
 
@@ -211,73 +239,6 @@ Provider automatically uses `NEXT_PUBLIC_INSFORGE_FRONTEND_URL` for auth redirec
 
 ---
 
-## Advanced: Custom Components
-
-Need custom branding? Disable built-in auth:
-
-```tsx
-// app/layout.tsx
-import { InsforgeProvider } from '@insforge/nextjs';
-import '@insforge/nextjs/styles.css';  // Required for custom components
-
-export default function RootLayout({ children }) {
-  return (
-    <InsforgeProvider 
-      baseUrl={process.env.NEXT_PUBLIC_INSFORGE_BASE_URL!}
-      useBuiltInAuth={false}
-    >
-      {children}
-    </InsforgeProvider>
-  );
-}
-```
-
-### Pre-built Components
-
-```tsx
-// app/sign-in/page.tsx
-import { SignIn } from '@insforge/nextjs';
-
-export default function SignInPage() {
-  return <SignIn afterSignInUrl="/dashboard" />;
-}
-```
-
-OAuth providers are auto-detected from your backend config.
-
-### Build from Primitives
-
-For complete control:
-
-```tsx
-import {
-  AuthContainer,
-  AuthHeader,
-  AuthFormField,
-  AuthPasswordField,
-  AuthSubmitButton,
-  AuthOAuthProviders,
-} from '@insforge/nextjs';
-
-function CustomSignIn() {
-  // Build your own auth UI with full control
-}
-```
-
-**Available primitives**: `AuthContainer`, `AuthHeader`, `AuthErrorBanner`, `AuthFormField`, `AuthPasswordField`, `AuthSubmitButton`, `AuthDivider`, `AuthLink`, `AuthOAuthProviders`, `AuthBranding`.
-
-### Update Middleware
-
-```ts
-// middleware.ts
-export default InsforgeMiddleware({
-  baseUrl: process.env.INSFORGE_BASE_URL!,
-  publicRoutes: ['/sign-in', '/sign-up', '/auth/callback', '/'],
-  signInUrl: '/sign-in',
-  useBuiltInAuth: false,  // Important!
-});
-```
-
 ---
 
 ## API Reference
@@ -286,29 +247,75 @@ export default InsforgeMiddleware({
 
 #### `useAuth()`
 
+Access authentication methods (uses SDK internally):
+
 ```tsx
 import { useAuth } from '@insforge/nextjs';
 
 function Component() {
-  const { user, isSignedIn, signOut } = useAuth();
-  return <div>{user?.email}</div>;
+  const { signIn, signUp, signOut, isSignedIn, isLoaded } = useAuth();
+  
+  async function handleSignIn(email: string, password: string) {
+    try {
+      await signIn(email, password); // Uses SDK internally
+    } catch (error) {
+      console.error('Sign in failed:', error);
+    }
+  }
+  
+  return (
+    <div>
+      {isSignedIn && <button onClick={() => signOut()}>Sign Out</button>}
+    </div>
+  );
 }
 ```
 
-**Returns**: `user`, `session`, `isLoaded`, `isSignedIn`, `signIn()`, `signUp()`, `signOut()`, `updateUser()`
+**Returns**: `signIn()`, `signUp()`, `signOut()`, `isLoaded`, `isSignedIn`
 
 #### `useUser()`
 
+Access current user data (from SDK-managed storage):
+
 ```tsx
-const { user, isLoaded } = useUser();
+import { useUser } from '@insforge/nextjs';
+
+function UserProfile() {
+  const { user, isLoaded, updateUser } = useUser();
+  
+  if (!isLoaded) return <div>Loading...</div>;
+  if (!user) return <div>Not signed in</div>;
+  
+  return (
+    <div>
+      <p>Email: {user.email}</p>
+      {user.nickname && <p>Nickname: {user.nickname}</p>}
+    </div>
+  );
+}
 ```
 
+**Returns**: `user`, `isLoaded`, `updateUser()`
+
 #### `useSession()`
 
+Access session data (from SDK-managed storage):
+
 ```tsx
-const { session, isSignedIn } = useSession();
+import { useSession } from '@insforge/nextjs';
+
+function SessionInfo() {
+  const { session, isLoaded } = useSession();
+  
+  if (!isLoaded) return <div>Loading...</div>;
+  if (!session) return <div>No active session</div>;
+  
+  return <div>User ID: {session.userId}</div>;
+}
 ```
 
+**Returns**: `session`, `isLoaded`
+
 ### Components
 
 #### `<SignIn>` / `<SignUp>`
@@ -325,9 +332,11 @@ Pre-built auth forms (only with `useBuiltInAuth={false}`):
 #### `<UserButton>`
 
 ```tsx
-<UserButton afterSignOutUrl="/" showEmail={true} />
+<UserButton afterSignOutUrl="/" mode="detailed" />
 ```
 
+**Props**: `afterSignOutUrl`, `mode` ('detailed' | 'simple'), `appearance`
+
 #### `<SignedIn>` / `<SignedOut>` / `<Protect>`
 
 ```tsx
@@ -342,39 +351,30 @@ Pre-built auth forms (only with `useBuiltInAuth={false}`):
 // app/dashboard/page.tsx (Server Component)
 import { headers } from 'next/headers';
 import { getAuthUserId, getAuthToken } from '@insforge/nextjs/middleware';
+import { createClient } from '@insforge/sdk';
 
 export default async function Dashboard() {
   const userId = getAuthUserId(headers());
   const token = getAuthToken(headers());
   
-  // Fetch user data server-side
-  return <div>User ID: {userId}</div>;
+  if (!userId) {
+    return <div>Not authenticated</div>;
+  }
+  
+  // Use SDK to fetch user data server-side
+  const insforge = createClient({
+    baseUrl: process.env.INSFORGE_BASE_URL!,
+    edgeFunctionToken: token || undefined,
+  });
+  
+  const { data: userData } = await insforge.auth.getCurrentUser();
+  
+  return <div>Welcome, {userData?.user.email}</div>;
 }
-
 ```
 
 ---
 
-## Customization
-
-### Styling (Custom Components Only)
-
-When using `useBuiltInAuth={false}`, import styles:
-
-```tsx
-import '@insforge/nextjs/styles.css';
-```
-
-Override with `appearance` prop or CSS classes:
-
-```tsx
-<SignIn appearance={{ container: { background: '#f5f5f5' } }} />
-```
-
-```css
-.insforge-btn-primary { background: #8b5cf6; }
-```
-
 ### Auth Callbacks
 
 ```tsx
@@ -386,11 +386,20 @@ Override with `appearance` prop or CSS classes:
 
 ---
 
+## SDK + Next.js Package = Complete Solution
+
+The `@insforge/nextjs` package works seamlessly with `@insforge/sdk`:
+
+- **SDK handles**: API calls, token management, OAuth callback detection, user data fetching
+- **Next.js package handles**: React components, hooks, middleware, SSR support
+
+Always use SDK methods (`insforge.auth.getCurrentUser()`, `insforge.auth.signIn()`, etc.) instead of raw `fetch` calls. This ensures consistency, type safety, and automatic error handling.
+
 ## Why @insforge/nextjs?
 
-**For Developers**: 5-minute auth setup instead of hours. Production-ready security and session management included.
+**For Developers**: 5-minute auth setup instead of hours. Production-ready security and session management included. SDK integration means less code to write and maintain.
 
-**For AI Agents**: Minimal code generation (5 files vs 20+ for custom auth). Reduced token usage. Consistent patterns across projects.
+**For AI Agents**: Minimal code generation (5 files vs 20+ for custom auth). SDK-first approach reduces errors. Consistent patterns across projects.
 
 ---
 

package/dist/api.d.mts

@@ -36,15 +36,4 @@ declare function createAuthRouteHandlers(config: AuthRouteConfig): {
     }>>;
 };
 
-interface ProfileHandlerConfig {
-    baseUrl: string;
-}
-declare function createProfileHandler(config: ProfileHandlerConfig): (request: NextRequest) => Promise<NextResponse<{
-    success: boolean;
-    error: string;
-}> | NextResponse<{
-    success: boolean;
-    user: any;
-}>>;
-
-export { type AuthRouteConfig, type ProfileHandlerConfig, createAuthRouteHandlers, createProfileHandler };
+export { type AuthRouteConfig, createAuthRouteHandlers };

package/dist/api.d.ts

@@ -36,15 +36,4 @@ declare function createAuthRouteHandlers(config: AuthRouteConfig): {
     }>>;
 };
 
-interface ProfileHandlerConfig {
-    baseUrl: string;
-}
-declare function createProfileHandler(config: ProfileHandlerConfig): (request: NextRequest) => Promise<NextResponse<{
-    success: boolean;
-    error: string;
-}> | NextResponse<{
-    success: boolean;
-    user: any;
-}>>;
-
-export { type AuthRouteConfig, type ProfileHandlerConfig, createAuthRouteHandlers, createProfileHandler };
+export { type AuthRouteConfig, createAuthRouteHandlers };

package/dist/api.js

@@ -20,8 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/api/index.ts
 var api_exports = {};
 __export(api_exports, {
-  createAuthRouteHandlers: () => createAuthRouteHandlers,
-  createProfileHandler: () => createProfileHandler
+  createAuthRouteHandlers: () => createAuthRouteHandlers
 });
 module.exports = __toCommonJS(api_exports);
 
@@ -92,7 +91,7 @@ function createAuthRouteHandlers(config) {
               { status: 401 }
             );
           }
-          if (!result.data) {
+          if (!result.data || !result.data.user) {
             return import_server.NextResponse.json(
               { error: "Authentication failed" },
               { status: 401 }
@@ -106,7 +105,7 @@ function createAuthRouteHandlers(config) {
               createdAt: (/* @__PURE__ */ new Date()).toISOString()
             }
           });
-          setAuthCookie(response, result.data.accessToken);
+          setAuthCookie(response, result.data.accessToken || "");
           return response;
         }
         case "sign-up": {
@@ -123,7 +122,7 @@ function createAuthRouteHandlers(config) {
               { status: 400 }
             );
           }
-          if (!result.data) {
+          if (!result.data || !result.data.user) {
             return import_server.NextResponse.json(
               { error: "Sign up failed" },
               { status: 400 }
@@ -137,7 +136,7 @@ function createAuthRouteHandlers(config) {
               createdAt: (/* @__PURE__ */ new Date()).toISOString()
             }
           });
-          setAuthCookie(response, result.data.accessToken);
+          setAuthCookie(response, result.data.accessToken || "");
           return response;
         }
         case "sync-token": {
@@ -261,63 +260,8 @@ function createAuthRouteHandlers(config) {
     DELETE
   };
 }
-
-// src/api/profile-handler.ts
-var import_server2 = require("next/server");
-function createProfileHandler(config) {
-  const { baseUrl } = config;
-  return async function POST(request) {
-    try {
-      const body = await request.json();
-      const { token } = body;
-      if (!token) {
-        return import_server2.NextResponse.json(
-          { success: false, error: "Token is required" },
-          { status: 400 }
-        );
-      }
-      console.log("[Profile Handler] Fetching user profile from backend");
-      const response = await fetch(`${baseUrl}/api/auth/sessions/current`, {
-        headers: {
-          Authorization: `Bearer ${token}`,
-          "Content-Type": "application/json"
-        }
-      });
-      if (!response.ok) {
-        const errorText = await response.text();
-        console.error("[Profile Handler] Backend error:", {
-          status: response.status,
-          error: errorText
-        });
-        return import_server2.NextResponse.json(
-          {
-            success: false,
-            error: `Failed to fetch profile: ${response.status} ${response.statusText}`
-          },
-          { status: response.status }
-        );
-      }
-      const userData = await response.json();
-      console.log("[Profile Handler] User profile fetched successfully");
-      return import_server2.NextResponse.json({
-        success: true,
-        user: userData
-      });
-    } catch (error) {
-      console.error("[Profile Handler] Error:", error);
-      return import_server2.NextResponse.json(
-        {
-          success: false,
-          error: error instanceof Error ? error.message : "Internal server error"
-        },
-        { status: 500 }
-      );
-    }
-  };
-}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  createAuthRouteHandlers,
-  createProfileHandler
+  createAuthRouteHandlers
 });
 //# sourceMappingURL=api.js.map

package/dist/api.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/api/index.ts","../src/api/route-handlers.ts","../src/api/profile-handler.ts"],"sourcesContent":["export { createAuthRouteHandlers } from './route-handlers';\r\nexport type { AuthRouteConfig } from './route-handlers';\r\n\r\n// Profile handler (server-side proxy for fetching user profile)\r\nexport { createProfileHandler } from './profile-handler';\r\nexport type { ProfileHandlerConfig } from './profile-handler';","import { NextRequest, NextResponse } from 'next/server';\r\nimport { createClient } from '@insforge/sdk';\r\n\r\nexport interface AuthRouteConfig {\r\n  /**\r\n   * Base URL of your Insforge backend\r\n   */\r\n  baseUrl: string;\r\n\r\n  /**\r\n   * Cookie name for the auth token\r\n   * @default 'insforge_token'\r\n   */\r\n  cookieName?: string;\r\n\r\n  /**\r\n   * Cookie max age in seconds (default: 7 days)\r\n   * @default 604800\r\n   */\r\n  cookieMaxAge?: number;\r\n\r\n  /**\r\n   * Whether to use secure cookies (HTTPS only)\r\n   * Auto-detected based on environment\r\n   */\r\n  secure?: boolean;\r\n}\r\n\r\n/**\r\n * Creates authentication route handlers for Next.js App Router\r\n * These handlers set HTTP-only cookies that can be read by middleware\r\n *\r\n * @example\r\n * ```ts\r\n * // app/api/auth/[...auth]/route.ts\r\n * import { createAuthRouteHandlers } from '@insforge/nextjs/api';\r\n *\r\n * const handlers = createAuthRouteHandlers({\r\n *   baseUrl: process.env.NEXT_PUBLIC_INSFORGE_BASE_URL!,\r\n * });\r\n *\r\n * export const POST = handlers.POST;\r\n * export const GET = handlers.GET;\r\n * export const DELETE = handlers.DELETE;\r\n * ```\r\n */\r\nexport function createAuthRouteHandlers(config: AuthRouteConfig) {\r\n  const {\r\n    baseUrl,\r\n    cookieName = 'insforge_token',\r\n    cookieMaxAge = 7 * 24 * 60 * 60, // 7 days\r\n  } = config;\r\n\r\n  const insforge = createClient({ baseUrl });\r\n\r\n  /**\r\n   * Helper to set auth cookie\r\n   */\r\n  function setAuthCookie(response: NextResponse, token: string) {\r\n    // NODE_ENV is automatically set by Next.js runtime ('development' | 'production' | 'test')\r\n    // In production, cookies are sent over HTTPS only (secure flag)\r\n    const isProduction = process.env.NODE_ENV === 'production';\r\n    const secure = config.secure ?? isProduction;\r\n\r\n    response.cookies.set({\r\n      name: cookieName,\r\n      value: token,\r\n      httpOnly: true, // Cannot be accessed by JavaScript\r\n      secure, // Only sent over HTTPS in production\r\n      sameSite: 'lax',\r\n      maxAge: cookieMaxAge,\r\n      path: '/',\r\n    });\r\n\r\n    return response;\r\n  }\r\n\r\n  /**\r\n   * Helper to clear auth cookie\r\n   */\r\n  function clearAuthCookie(response: NextResponse) {\r\n    response.cookies.set({\r\n      name: cookieName,\r\n      value: '',\r\n      httpOnly: true,\r\n      secure: config.secure ?? (process.env.NODE_ENV === 'production'),\r\n      sameSite: 'lax',\r\n      maxAge: 0,\r\n      path: '/',\r\n    });\r\n\r\n    return response;\r\n  }\r\n\r\n  /**\r\n   * POST handler for authentication actions\r\n   * Supports: sign-in, sign-up\r\n   */\r\n  async function POST(request: NextRequest) {\r\n    try {\r\n      const body = await request.json();\r\n      const { action, email, password } = body;\r\n\r\n      if (!action) {\r\n        return NextResponse.json(\r\n          { error: 'Action is required' },\r\n          { status: 400 }\r\n        );\r\n      }\r\n\r\n      switch (action) {\r\n        case 'sign-in': {\r\n          if (!email || !password) {\r\n            return NextResponse.json(\r\n              { error: 'Email and password are required' },\r\n              { status: 400 }\r\n            );\r\n          }\r\n\r\n          const result = await insforge.auth.signInWithPassword({\r\n            email,\r\n            password,\r\n          });\r\n\r\n          if (result.error) {\r\n            return NextResponse.json(\r\n              { error: result.error.message },\r\n              { status: 401 }\r\n            );\r\n          }\r\n\r\n          if (!result.data) {\r\n            return NextResponse.json(\r\n              { error: 'Authentication failed' },\r\n              { status: 401 }\r\n            );\r\n          }\r\n\r\n          const response = NextResponse.json({\r\n            user: result.data.user,\r\n            session: {\r\n              userId: result.data.user.id,\r\n              expiresAt: '',\r\n              createdAt: new Date().toISOString(),\r\n            },\r\n          });\r\n\r\n          setAuthCookie(response, result.data.accessToken);\r\n\r\n          return response;\r\n        }\r\n\r\n        case 'sign-up': {\r\n          if (!email || !password) {\r\n            return NextResponse.json(\r\n              { error: 'Email and password are required' },\r\n              { status: 400 }\r\n            );\r\n          }\r\n\r\n          const result = await insforge.auth.signUp({ email, password });\r\n\r\n          if (result.error) {\r\n            return NextResponse.json(\r\n              { error: result.error.message },\r\n              { status: 400 }\r\n            );\r\n          }\r\n\r\n          if (!result.data) {\r\n            return NextResponse.json(\r\n              { error: 'Sign up failed' },\r\n              { status: 400 }\r\n            );\r\n          }\r\n\r\n          const response = NextResponse.json({\r\n            user: result.data.user,\r\n            session: {\r\n              userId: result.data.user.id,\r\n              expiresAt: '',\r\n              createdAt: new Date().toISOString(),\r\n            },\r\n          });\r\n\r\n          setAuthCookie(response, result.data.accessToken);\r\n\r\n          return response;\r\n        }\r\n\r\n        case 'sync-token': {\r\n          // Syncs a token from localStorage to HTTP-only cookie\r\n          const { token } = body;\r\n\r\n          if (!token) {\r\n            return NextResponse.json(\r\n              { error: 'Token is required' },\r\n              { status: 400 }\r\n            );\r\n          }\r\n\r\n          // Verify the token is valid by checking with backend\r\n          try {\r\n            const response = await fetch(`${baseUrl}/api/auth/sessions/current`, {\r\n              headers: {\r\n                Authorization: `Bearer ${token}`,\r\n                'Content-Type': 'application/json',\r\n              },\r\n            });\r\n\r\n            if (!response.ok) {\r\n              const errorText = await response.text();\r\n              console.error('[Auth API] Token validation failed:', errorText);\r\n              return NextResponse.json(\r\n                { error: 'Invalid token', details: errorText },\r\n                { status: 401 }\r\n              );\r\n            }\r\n\r\n            const session = await response.json();\r\n\r\n            const nextResponse = NextResponse.json({\r\n              user: session.user,\r\n              session: {\r\n                userId: session.user.id,\r\n                expiresAt: '',\r\n                createdAt: new Date().toISOString(),\r\n              },\r\n            });\r\n\r\n            setAuthCookie(nextResponse, token);\r\n\r\n            return nextResponse;\r\n          } catch (error) {\r\n            console.error('[Auth API] Token validation error:', error);\r\n            return NextResponse.json(\r\n              { error: 'Token validation failed', details: String(error) },\r\n              { status: 401 }\r\n            );\r\n          }\r\n        }\r\n\r\n        default:\r\n          return NextResponse.json(\r\n            { error: 'Invalid action' },\r\n            { status: 400 }\r\n          );\r\n      }\r\n    } catch (error) {\r\n      console.error('[Auth API Error]:', error);\r\n      return NextResponse.json(\r\n        { error: 'Internal server error' },\r\n        { status: 500 }\r\n      );\r\n    }\r\n  }\r\n\r\n  /**\r\n   * GET handler to check current session\r\n   */\r\n  async function GET(request: NextRequest) {\r\n    try {\r\n      const token = request.cookies.get(cookieName)?.value;\r\n\r\n      if (!token) {\r\n        return NextResponse.json({ user: null, session: null });\r\n      }\r\n\r\n      // Verify token with backend\r\n      const response = await fetch(`${baseUrl}/api/auth/sessions/current`, {\r\n        headers: {\r\n          Authorization: `Bearer ${token}`,\r\n          'Content-Type': 'application/json',\r\n        },\r\n      });\r\n\r\n      if (!response.ok) {\r\n        const nextResponse = NextResponse.json({ user: null, session: null });\r\n        clearAuthCookie(nextResponse);\r\n        return nextResponse;\r\n      }\r\n\r\n      const session = await response.json();\r\n\r\n      return NextResponse.json({\r\n        user: session.user,\r\n        session: {\r\n          userId: session.user.id,\r\n          token,\r\n          expiresAt: '',\r\n          createdAt: new Date().toISOString(),\r\n        },\r\n      });\r\n    } catch (error) {\r\n      console.error('[Auth API Error]:', error);\r\n      return NextResponse.json({ user: null, session: null });\r\n    }\r\n  }\r\n\r\n  /**\r\n   * DELETE handler for sign out\r\n   */\r\n  async function DELETE(request: NextRequest) {\r\n    try {\r\n      const token = request.cookies.get(cookieName)?.value;\r\n\r\n      if (token) {\r\n        // Call backend sign out\r\n        try {\r\n          await fetch(`${baseUrl}/auth/sessions/current`, {\r\n            method: 'DELETE',\r\n            headers: {\r\n              Authorization: `Bearer ${token}`,\r\n              'Content-Type': 'application/json',\r\n            },\r\n          });\r\n        } catch (error) {\r\n          // Ignore backend errors during sign out\r\n          console.error('[Auth API] Sign out error:', error);\r\n        }\r\n      }\r\n\r\n      const response = NextResponse.json({ success: true });\r\n      clearAuthCookie(response);\r\n\r\n      return response;\r\n    } catch (error) {\r\n      console.error('[Auth API Error]:', error);\r\n      return NextResponse.json(\r\n        { error: 'Internal server error' },\r\n        { status: 500 }\r\n      );\r\n    }\r\n  }\r\n\r\n  return {\r\n    POST,\r\n    GET,\r\n    DELETE,\r\n  };\r\n}\r\n","import { NextRequest, NextResponse } from 'next/server';\r\n\r\nexport interface ProfileHandlerConfig {\r\n  /**\r\n   * Base URL of your Insforge backend\r\n   */\r\n  baseUrl: string;\r\n}\r\n\r\n/**\r\n * Creates a profile fetcher API route that acts as a proxy to your Insforge backend\r\n * \r\n * This handler accepts a token and fetches the user profile from the backend,\r\n * acting as a secure server-side proxy to avoid exposing backend URLs to clients.\r\n * \r\n * @param config - Configuration for the profile handler\r\n * @returns Next.js API route handler (POST method)\r\n * \r\n * @example\r\n * ```ts\r\n * // app/api/auth/profile/route.ts\r\n * import { createProfileHandler } from '@insforge/nextjs/api';\r\n * \r\n * export const POST = createProfileHandler({\r\n *   baseUrl: process.env.INSFORGE_BASE_URL!,\r\n * });\r\n * ```\r\n * \r\n * @example\r\n * ```tsx\r\n * // Usage in callback page (client-side)\r\n * const response = await fetch('/api/auth/profile', {\r\n *   method: 'POST',\r\n *   headers: { 'Content-Type': 'application/json' },\r\n *   body: JSON.stringify({ token: accessToken }),\r\n * });\r\n * \r\n * const result = await response.json();\r\n * if (result.success) {\r\n *   // Store user profile\r\n *   localStorage.setItem('insforge-user-profile', JSON.stringify(result.user));\r\n * }\r\n * ```\r\n */\r\nexport function createProfileHandler(config: ProfileHandlerConfig) {\r\n  const { baseUrl } = config;\r\n\r\n  return async function POST(request: NextRequest) {\r\n    try {\r\n      const body = await request.json();\r\n      const { token } = body;\r\n\r\n      if (!token) {\r\n        return NextResponse.json(\r\n          { success: false, error: 'Token is required' },\r\n          { status: 400 }\r\n        );\r\n      }\r\n\r\n      console.log('[Profile Handler] Fetching user profile from backend');\r\n\r\n      // Call Insforge backend to get user profile (proxy)\r\n      const response = await fetch(`${baseUrl}/api/auth/sessions/current`, {\r\n        headers: {\r\n          Authorization: `Bearer ${token}`,\r\n          'Content-Type': 'application/json',\r\n        },\r\n      });\r\n\r\n      if (!response.ok) {\r\n        const errorText = await response.text();\r\n        console.error('[Profile Handler] Backend error:', {\r\n          status: response.status,\r\n          error: errorText,\r\n        });\r\n        \r\n        return NextResponse.json(\r\n          { \r\n            success: false, \r\n            error: `Failed to fetch profile: ${response.status} ${response.statusText}` \r\n          },\r\n          { status: response.status }\r\n        );\r\n      }\r\n\r\n      const userData = await response.json();\r\n      console.log('[Profile Handler] User profile fetched successfully');\r\n\r\n      return NextResponse.json({\r\n        success: true,\r\n        user: userData,\r\n      });\r\n    } catch (error) {\r\n      console.error('[Profile Handler] Error:', error);\r\n      return NextResponse.json(\r\n        { \r\n          success: false, \r\n          error: error instanceof Error ? error.message : 'Internal server error' \r\n        },\r\n        { status: 500 }\r\n      );\r\n    }\r\n  };\r\n}\r\n\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,oBAA0C;AAC1C,iBAA6B;AA6CtB,SAAS,wBAAwB,QAAyB;AAC/D,QAAM;AAAA,IACJ;AAAA,IACA,aAAa;AAAA,IACb,eAAe,IAAI,KAAK,KAAK;AAAA;AAAA,EAC/B,IAAI;AAEJ,QAAM,eAAW,yBAAa,EAAE,QAAQ,CAAC;AAKzC,WAAS,cAAc,UAAwB,OAAe;AAG5D,UAAM,eAAe,QAAQ,IAAI,aAAa;AAC9C,UAAM,SAAS,OAAO,UAAU;AAEhC,aAAS,QAAQ,IAAI;AAAA,MACnB,MAAM;AAAA,MACN,OAAO;AAAA,MACP,UAAU;AAAA;AAAA,MACV;AAAA;AAAA,MACA,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAED,WAAO;AAAA,EACT;AAKA,WAAS,gBAAgB,UAAwB;AAC/C,aAAS,QAAQ,IAAI;AAAA,MACnB,MAAM;AAAA,MACN,OAAO;AAAA,MACP,UAAU;AAAA,MACV,QAAQ,OAAO,UAAW,QAAQ,IAAI,aAAa;AAAA,MACnD,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAED,WAAO;AAAA,EACT;AAMA,iBAAe,KAAK,SAAsB;AACxC,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,YAAM,EAAE,QAAQ,OAAO,SAAS,IAAI;AAEpC,UAAI,CAAC,QAAQ;AACX,eAAO,2BAAa;AAAA,UAClB,EAAE,OAAO,qBAAqB;AAAA,UAC9B,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAEA,cAAQ,QAAQ;AAAA,QACd,KAAK,WAAW;AACd,cAAI,CAAC,SAAS,CAAC,UAAU;AACvB,mBAAO,2BAAa;AAAA,cAClB,EAAE,OAAO,kCAAkC;AAAA,cAC3C,EAAE,QAAQ,IAAI;AAAA,YAChB;AAAA,UACF;AAEA,gBAAM,SAAS,MAAM,SAAS,KAAK,mBAAmB;AAAA,YACpD;AAAA,YACA;AAAA,UACF,CAAC;AAED,cAAI,OAAO,OAAO;AAChB,mBAAO,2BAAa;AAAA,cAClB,EAAE,OAAO,OAAO,MAAM,QAAQ;AAAA,cAC9B,EAAE,QAAQ,IAAI;AAAA,YAChB;AAAA,UACF;AAEA,cAAI,CAAC,OAAO,MAAM;AAChB,mBAAO,2BAAa;AAAA,cAClB,EAAE,OAAO,wBAAwB;AAAA,cACjC,EAAE,QAAQ,IAAI;AAAA,YAChB;AAAA,UACF;AAEA,gBAAM,WAAW,2BAAa,KAAK;AAAA,YACjC,MAAM,OAAO,KAAK;AAAA,YAClB,SAAS;AAAA,cACP,QAAQ,OAAO,KAAK,KAAK;AAAA,cACzB,WAAW;AAAA,cACX,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,YACpC;AAAA,UACF,CAAC;AAED,wBAAc,UAAU,OAAO,KAAK,WAAW;AAE/C,iBAAO;AAAA,QACT;AAAA,QAEA,KAAK,WAAW;AACd,cAAI,CAAC,SAAS,CAAC,UAAU;AACvB,mBAAO,2BAAa;AAAA,cAClB,EAAE,OAAO,kCAAkC;AAAA,cAC3C,EAAE,QAAQ,IAAI;AAAA,YAChB;AAAA,UACF;AAEA,gBAAM,SAAS,MAAM,SAAS,KAAK,OAAO,EAAE,OAAO,SAAS,CAAC;AAE7D,cAAI,OAAO,OAAO;AAChB,mBAAO,2BAAa;AAAA,cAClB,EAAE,OAAO,OAAO,MAAM,QAAQ;AAAA,cAC9B,EAAE,QAAQ,IAAI;AAAA,YAChB;AAAA,UACF;AAEA,cAAI,CAAC,OAAO,MAAM;AAChB,mBAAO,2BAAa;AAAA,cAClB,EAAE,OAAO,iBAAiB;AAAA,cAC1B,EAAE,QAAQ,IAAI;AAAA,YAChB;AAAA,UACF;AAEA,gBAAM,WAAW,2BAAa,KAAK;AAAA,YACjC,MAAM,OAAO,KAAK;AAAA,YAClB,SAAS;AAAA,cACP,QAAQ,OAAO,KAAK,KAAK;AAAA,cACzB,WAAW;AAAA,cACX,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,YACpC;AAAA,UACF,CAAC;AAED,wBAAc,UAAU,OAAO,KAAK,WAAW;AAE/C,iBAAO;AAAA,QACT;AAAA,QAEA,KAAK,cAAc;AAEjB,gBAAM,EAAE,MAAM,IAAI;AAElB,cAAI,CAAC,OAAO;AACV,mBAAO,2BAAa;AAAA,cAClB,EAAE,OAAO,oBAAoB;AAAA,cAC7B,EAAE,QAAQ,IAAI;AAAA,YAChB;AAAA,UACF;AAGA,cAAI;AACF,kBAAM,WAAW,MAAM,MAAM,GAAG,OAAO,8BAA8B;AAAA,cACnE,SAAS;AAAA,gBACP,eAAe,UAAU,KAAK;AAAA,gBAC9B,gBAAgB;AAAA,cAClB;AAAA,YACF,CAAC;AAED,gBAAI,CAAC,SAAS,IAAI;AAChB,oBAAM,YAAY,MAAM,SAAS,KAAK;AACtC,sBAAQ,MAAM,uCAAuC,SAAS;AAC9D,qBAAO,2BAAa;AAAA,gBAClB,EAAE,OAAO,iBAAiB,SAAS,UAAU;AAAA,gBAC7C,EAAE,QAAQ,IAAI;AAAA,cAChB;AAAA,YACF;AAEA,kBAAM,UAAU,MAAM,SAAS,KAAK;AAEpC,kBAAM,eAAe,2BAAa,KAAK;AAAA,cACrC,MAAM,QAAQ;AAAA,cACd,SAAS;AAAA,gBACP,QAAQ,QAAQ,KAAK;AAAA,gBACrB,WAAW;AAAA,gBACX,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,cACpC;AAAA,YACF,CAAC;AAED,0BAAc,cAAc,KAAK;AAEjC,mBAAO;AAAA,UACT,SAAS,OAAO;AACd,oBAAQ,MAAM,sCAAsC,KAAK;AACzD,mBAAO,2BAAa;AAAA,cAClB,EAAE,OAAO,2BAA2B,SAAS,OAAO,KAAK,EAAE;AAAA,cAC3D,EAAE,QAAQ,IAAI;AAAA,YAChB;AAAA,UACF;AAAA,QACF;AAAA,QAEA;AACE,iBAAO,2BAAa;AAAA,YAClB,EAAE,OAAO,iBAAiB;AAAA,YAC1B,EAAE,QAAQ,IAAI;AAAA,UAChB;AAAA,MACJ;AAAA,IACF,SAAS,OAAO;AACd,cAAQ,MAAM,qBAAqB,KAAK;AACxC,aAAO,2BAAa;AAAA,QAClB,EAAE,OAAO,wBAAwB;AAAA,QACjC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAKA,iBAAe,IAAI,SAAsB;AACvC,QAAI;AACF,YAAM,QAAQ,QAAQ,QAAQ,IAAI,UAAU,GAAG;AAE/C,UAAI,CAAC,OAAO;AACV,eAAO,2BAAa,KAAK,EAAE,MAAM,MAAM,SAAS,KAAK,CAAC;AAAA,MACxD;AAGA,YAAM,WAAW,MAAM,MAAM,GAAG,OAAO,8BAA8B;AAAA,QACnE,SAAS;AAAA,UACP,eAAe,UAAU,KAAK;AAAA,UAC9B,gBAAgB;AAAA,QAClB;AAAA,MACF,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,eAAe,2BAAa,KAAK,EAAE,MAAM,MAAM,SAAS,KAAK,CAAC;AACpE,wBAAgB,YAAY;AAC5B,eAAO;AAAA,MACT;AAEA,YAAM,UAAU,MAAM,SAAS,KAAK;AAEpC,aAAO,2BAAa,KAAK;AAAA,QACvB,MAAM,QAAQ;AAAA,QACd,SAAS;AAAA,UACP,QAAQ,QAAQ,KAAK;AAAA,UACrB;AAAA,UACA,WAAW;AAAA,UACX,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QACpC;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,qBAAqB,KAAK;AACxC,aAAO,2BAAa,KAAK,EAAE,MAAM,MAAM,SAAS,KAAK,CAAC;AAAA,IACxD;AAAA,EACF;AAKA,iBAAe,OAAO,SAAsB;AAC1C,QAAI;AACF,YAAM,QAAQ,QAAQ,QAAQ,IAAI,UAAU,GAAG;AAE/C,UAAI,OAAO;AAET,YAAI;AACF,gBAAM,MAAM,GAAG,OAAO,0BAA0B;AAAA,YAC9C,QAAQ;AAAA,YACR,SAAS;AAAA,cACP,eAAe,UAAU,KAAK;AAAA,cAC9B,gBAAgB;AAAA,YAClB;AAAA,UACF,CAAC;AAAA,QACH,SAAS,OAAO;AAEd,kBAAQ,MAAM,8BAA8B,KAAK;AAAA,QACnD;AAAA,MACF;AAEA,YAAM,WAAW,2BAAa,KAAK,EAAE,SAAS,KAAK,CAAC;AACpD,sBAAgB,QAAQ;AAExB,aAAO;AAAA,IACT,SAAS,OAAO;AACd,cAAQ,MAAM,qBAAqB,KAAK;AACxC,aAAO,2BAAa;AAAA,QAClB,EAAE,OAAO,wBAAwB;AAAA,QACjC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;ACpVA,IAAAA,iBAA0C;AA4CnC,SAAS,qBAAqB,QAA8B;AACjE,QAAM,EAAE,QAAQ,IAAI;AAEpB,SAAO,eAAe,KAAK,SAAsB;AAC/C,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,YAAM,EAAE,MAAM,IAAI;AAElB,UAAI,CAAC,OAAO;AACV,eAAO,4BAAa;AAAA,UAClB,EAAE,SAAS,OAAO,OAAO,oBAAoB;AAAA,UAC7C,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAEA,cAAQ,IAAI,sDAAsD;AAGlE,YAAM,WAAW,MAAM,MAAM,GAAG,OAAO,8BAA8B;AAAA,QACnE,SAAS;AAAA,UACP,eAAe,UAAU,KAAK;AAAA,UAC9B,gBAAgB;AAAA,QAClB;AAAA,MACF,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,gBAAQ,MAAM,oCAAoC;AAAA,UAChD,QAAQ,SAAS;AAAA,UACjB,OAAO;AAAA,QACT,CAAC;AAED,eAAO,4BAAa;AAAA,UAClB;AAAA,YACE,SAAS;AAAA,YACT,OAAO,4BAA4B,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,UAC3E;AAAA,UACA,EAAE,QAAQ,SAAS,OAAO;AAAA,QAC5B;AAAA,MACF;AAEA,YAAM,WAAW,MAAM,SAAS,KAAK;AACrC,cAAQ,IAAI,qDAAqD;AAEjE,aAAO,4BAAa,KAAK;AAAA,QACvB,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,4BAA4B,KAAK;AAC/C,aAAO,4BAAa;AAAA,QAClB;AAAA,UACE,SAAS;AAAA,UACT,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,QAClD;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AACF;","names":["import_server"]}
+{"version":3,"sources":["../src/api/index.ts","../src/api/route-handlers.ts"],"sourcesContent":["export { createAuthRouteHandlers } from './route-handlers';\r\nexport type { AuthRouteConfig } from './route-handlers';","import { NextRequest, NextResponse } from 'next/server';\nimport { createClient } from '@insforge/sdk';\n\nexport interface AuthRouteConfig {\n  /**\n   * Base URL of your Insforge backend\n   */\n  baseUrl: string;\n\n  /**\n   * Cookie name for the auth token\n   * @default 'insforge_token'\n   */\n  cookieName?: string;\n\n  /**\n   * Cookie max age in seconds (default: 7 days)\n   * @default 604800\n   */\n  cookieMaxAge?: number;\n\n  /**\n   * Whether to use secure cookies (HTTPS only)\n   * Auto-detected based on environment\n   */\n  secure?: boolean;\n}\n\n/**\n * Creates authentication route handlers for Next.js App Router\n * These handlers set HTTP-only cookies that can be read by middleware\n *\n * @example\n * ```ts\n * // app/api/auth/[...auth]/route.ts\n * import { createAuthRouteHandlers } from '@insforge/nextjs/api';\n *\n * const handlers = createAuthRouteHandlers({\n *   baseUrl: process.env.NEXT_PUBLIC_INSFORGE_BASE_URL!,\n * });\n *\n * export const POST = handlers.POST;\n * export const GET = handlers.GET;\n * export const DELETE = handlers.DELETE;\n * ```\n */\nexport function createAuthRouteHandlers(config: AuthRouteConfig) {\n  const {\n    baseUrl,\n    cookieName = 'insforge_token',\n    cookieMaxAge = 7 * 24 * 60 * 60, // 7 days\n  } = config;\n\n  const insforge = createClient({ baseUrl });\n\n  /**\n   * Helper to set auth cookie\n   */\n  function setAuthCookie(response: NextResponse, token: string) {\n    // NODE_ENV is automatically set by Next.js runtime ('development' | 'production' | 'test')\n    // In production, cookies are sent over HTTPS only (secure flag)\n    const isProduction = process.env.NODE_ENV === 'production';\n    const secure = config.secure ?? isProduction;\n\n    response.cookies.set({\n      name: cookieName,\n      value: token,\n      httpOnly: true, // Cannot be accessed by JavaScript\n      secure, // Only sent over HTTPS in production\n      sameSite: 'lax',\n      maxAge: cookieMaxAge,\n      path: '/',\n    });\n\n    return response;\n  }\n\n  /**\n   * Helper to clear auth cookie\n   */\n  function clearAuthCookie(response: NextResponse) {\n    response.cookies.set({\n      name: cookieName,\n      value: '',\n      httpOnly: true,\n      secure: config.secure ?? (process.env.NODE_ENV === 'production'),\n      sameSite: 'lax',\n      maxAge: 0,\n      path: '/',\n    });\n\n    return response;\n  }\n\n  /**\n   * POST handler for authentication actions\n   * Supports: sign-in, sign-up\n   */\n  async function POST(request: NextRequest) {\n    try {\n      const body = await request.json();\n      const { action, email, password } = body;\n\n      if (!action) {\n        return NextResponse.json(\n          { error: 'Action is required' },\n          { status: 400 }\n        );\n      }\n\n      switch (action) {\n        case 'sign-in': {\n          if (!email || !password) {\n            return NextResponse.json(\n              { error: 'Email and password are required' },\n              { status: 400 }\n            );\n          }\n\n          const result = await insforge.auth.signInWithPassword({\n            email,\n            password,\n          });\n\n          if (result.error) {\n            return NextResponse.json(\n              { error: result.error.message },\n              { status: 401 }\n            );\n          }\n\n        if (!result.data || !result.data.user) {\n          return NextResponse.json(\n            { error: 'Authentication failed' },\n            { status: 401 }\n          );\n        }\n\n        const response = NextResponse.json({\n          user: result.data.user,\n          session: {\n            userId: result.data.user.id,\n            expiresAt: '',\n            createdAt: new Date().toISOString(),\n          },\n        });\n\n          setAuthCookie(response, result.data.accessToken || '');\n\n          return response;\n        }\n\n        case 'sign-up': {\n          if (!email || !password) {\n            return NextResponse.json(\n              { error: 'Email and password are required' },\n              { status: 400 }\n            );\n          }\n\n          const result = await insforge.auth.signUp({ email, password });\n\n          if (result.error) {\n            return NextResponse.json(\n              { error: result.error.message },\n              { status: 400 }\n            );\n          }\n\n        if (!result.data || !result.data.user) {\n          return NextResponse.json(\n            { error: 'Sign up failed' },\n            { status: 400 }\n          );\n        }\n\n        const response = NextResponse.json({\n          user: result.data.user,\n          session: {\n            userId: result.data.user.id,\n            expiresAt: '',\n            createdAt: new Date().toISOString(),\n          },\n        });\n\n          setAuthCookie(response, result.data.accessToken || '');\n\n          return response;\n        }\n\n        case 'sync-token': {\n          // Syncs a token from localStorage to HTTP-only cookie\n          const { token } = body;\n\n          if (!token) {\n            return NextResponse.json(\n              { error: 'Token is required' },\n              { status: 400 }\n            );\n          }\n\n          // Verify the token is valid by checking with backend\n          try {\n            const response = await fetch(`${baseUrl}/api/auth/sessions/current`, {\n              headers: {\n                Authorization: `Bearer ${token}`,\n                'Content-Type': 'application/json',\n              },\n            });\n\n            if (!response.ok) {\n              const errorText = await response.text();\n              console.error('[Auth API] Token validation failed:', errorText);\n              return NextResponse.json(\n                { error: 'Invalid token', details: errorText },\n                { status: 401 }\n              );\n            }\n\n            const session = await response.json();\n\n            const nextResponse = NextResponse.json({\n              user: session.user,\n              session: {\n                userId: session.user.id,\n                expiresAt: '',\n                createdAt: new Date().toISOString(),\n              },\n            });\n\n            setAuthCookie(nextResponse, token);\n\n            return nextResponse;\n          } catch (error) {\n            console.error('[Auth API] Token validation error:', error);\n            return NextResponse.json(\n              { error: 'Token validation failed', details: String(error) },\n              { status: 401 }\n            );\n          }\n        }\n\n        default:\n          return NextResponse.json(\n            { error: 'Invalid action' },\n            { status: 400 }\n          );\n      }\n    } catch (error) {\n      console.error('[Auth API Error]:', error);\n      return NextResponse.json(\n        { error: 'Internal server error' },\n        { status: 500 }\n      );\n    }\n  }\n\n  /**\n   * GET handler to check current session\n   */\n  async function GET(request: NextRequest) {\n    try {\n      const token = request.cookies.get(cookieName)?.value;\n\n      if (!token) {\n        return NextResponse.json({ user: null, session: null });\n      }\n\n      // Verify token with backend\n      const response = await fetch(`${baseUrl}/api/auth/sessions/current`, {\n        headers: {\n          Authorization: `Bearer ${token}`,\n          'Content-Type': 'application/json',\n        },\n      });\n\n      if (!response.ok) {\n        const nextResponse = NextResponse.json({ user: null, session: null });\n        clearAuthCookie(nextResponse);\n        return nextResponse;\n      }\n\n      const session = await response.json();\n\n      return NextResponse.json({\n        user: session.user,\n        session: {\n          userId: session.user.id,\n          token,\n          expiresAt: '',\n          createdAt: new Date().toISOString(),\n        },\n      });\n    } catch (error) {\n      console.error('[Auth API Error]:', error);\n      return NextResponse.json({ user: null, session: null });\n    }\n  }\n\n  /**\n   * DELETE handler for sign out\n   */\n  async function DELETE(request: NextRequest) {\n    try {\n      const token = request.cookies.get(cookieName)?.value;\n\n      if (token) {\n        // Call backend sign out\n        try {\n          await fetch(`${baseUrl}/auth/sessions/current`, {\n            method: 'DELETE',\n            headers: {\n              Authorization: `Bearer ${token}`,\n              'Content-Type': 'application/json',\n            },\n          });\n        } catch (error) {\n          // Ignore backend errors during sign out\n          console.error('[Auth API] Sign out error:', error);\n        }\n      }\n\n      const response = NextResponse.json({ success: true });\n      clearAuthCookie(response);\n\n      return response;\n    } catch (error) {\n      console.error('[Auth API Error]:', error);\n      return NextResponse.json(\n        { error: 'Internal server error' },\n        { status: 500 }\n      );\n    }\n  }\n\n  return {\n    POST,\n    GET,\n    DELETE,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,oBAA0C;AAC1C,iBAA6B;AA6CtB,SAAS,wBAAwB,QAAyB;AAC/D,QAAM;AAAA,IACJ;AAAA,IACA,aAAa;AAAA,IACb,eAAe,IAAI,KAAK,KAAK;AAAA;AAAA,EAC/B,IAAI;AAEJ,QAAM,eAAW,yBAAa,EAAE,QAAQ,CAAC;AAKzC,WAAS,cAAc,UAAwB,OAAe;AAG5D,UAAM,eAAe,QAAQ,IAAI,aAAa;AAC9C,UAAM,SAAS,OAAO,UAAU;AAEhC,aAAS,QAAQ,IAAI;AAAA,MACnB,MAAM;AAAA,MACN,OAAO;AAAA,MACP,UAAU;AAAA;AAAA,MACV;AAAA;AAAA,MACA,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAED,WAAO;AAAA,EACT;AAKA,WAAS,gBAAgB,UAAwB;AAC/C,aAAS,QAAQ,IAAI;AAAA,MACnB,MAAM;AAAA,MACN,OAAO;AAAA,MACP,UAAU;AAAA,MACV,QAAQ,OAAO,UAAW,QAAQ,IAAI,aAAa;AAAA,MACnD,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAED,WAAO;AAAA,EACT;AAMA,iBAAe,KAAK,SAAsB;AACxC,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,YAAM,EAAE,QAAQ,OAAO,SAAS,IAAI;AAEpC,UAAI,CAAC,QAAQ;AACX,eAAO,2BAAa;AAAA,UAClB,EAAE,OAAO,qBAAqB;AAAA,UAC9B,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAEA,cAAQ,QAAQ;AAAA,QACd,KAAK,WAAW;AACd,cAAI,CAAC,SAAS,CAAC,UAAU;AACvB,mBAAO,2BAAa;AAAA,cAClB,EAAE,OAAO,kCAAkC;AAAA,cAC3C,EAAE,QAAQ,IAAI;AAAA,YAChB;AAAA,UACF;AAEA,gBAAM,SAAS,MAAM,SAAS,KAAK,mBAAmB;AAAA,YACpD;AAAA,YACA;AAAA,UACF,CAAC;AAED,cAAI,OAAO,OAAO;AAChB,mBAAO,2BAAa;AAAA,cAClB,EAAE,OAAO,OAAO,MAAM,QAAQ;AAAA,cAC9B,EAAE,QAAQ,IAAI;AAAA,YAChB;AAAA,UACF;AAEF,cAAI,CAAC,OAAO,QAAQ,CAAC,OAAO,KAAK,MAAM;AACrC,mBAAO,2BAAa;AAAA,cAClB,EAAE,OAAO,wBAAwB;AAAA,cACjC,EAAE,QAAQ,IAAI;AAAA,YAChB;AAAA,UACF;AAEA,gBAAM,WAAW,2BAAa,KAAK;AAAA,YACjC,MAAM,OAAO,KAAK;AAAA,YAClB,SAAS;AAAA,cACP,QAAQ,OAAO,KAAK,KAAK;AAAA,cACzB,WAAW;AAAA,cACX,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,YACpC;AAAA,UACF,CAAC;AAEC,wBAAc,UAAU,OAAO,KAAK,eAAe,EAAE;AAErD,iBAAO;AAAA,QACT;AAAA,QAEA,KAAK,WAAW;AACd,cAAI,CAAC,SAAS,CAAC,UAAU;AACvB,mBAAO,2BAAa;AAAA,cAClB,EAAE,OAAO,kCAAkC;AAAA,cAC3C,EAAE,QAAQ,IAAI;AAAA,YAChB;AAAA,UACF;AAEA,gBAAM,SAAS,MAAM,SAAS,KAAK,OAAO,EAAE,OAAO,SAAS,CAAC;AAE7D,cAAI,OAAO,OAAO;AAChB,mBAAO,2BAAa;AAAA,cAClB,EAAE,OAAO,OAAO,MAAM,QAAQ;AAAA,cAC9B,EAAE,QAAQ,IAAI;AAAA,YAChB;AAAA,UACF;AAEF,cAAI,CAAC,OAAO,QAAQ,CAAC,OAAO,KAAK,MAAM;AACrC,mBAAO,2BAAa;AAAA,cAClB,EAAE,OAAO,iBAAiB;AAAA,cAC1B,EAAE,QAAQ,IAAI;AAAA,YAChB;AAAA,UACF;AAEA,gBAAM,WAAW,2BAAa,KAAK;AAAA,YACjC,MAAM,OAAO,KAAK;AAAA,YAClB,SAAS;AAAA,cACP,QAAQ,OAAO,KAAK,KAAK;AAAA,cACzB,WAAW;AAAA,cACX,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,YACpC;AAAA,UACF,CAAC;AAEC,wBAAc,UAAU,OAAO,KAAK,eAAe,EAAE;AAErD,iBAAO;AAAA,QACT;AAAA,QAEA,KAAK,cAAc;AAEjB,gBAAM,EAAE,MAAM,IAAI;AAElB,cAAI,CAAC,OAAO;AACV,mBAAO,2BAAa;AAAA,cAClB,EAAE,OAAO,oBAAoB;AAAA,cAC7B,EAAE,QAAQ,IAAI;AAAA,YAChB;AAAA,UACF;AAGA,cAAI;AACF,kBAAM,WAAW,MAAM,MAAM,GAAG,OAAO,8BAA8B;AAAA,cACnE,SAAS;AAAA,gBACP,eAAe,UAAU,KAAK;AAAA,gBAC9B,gBAAgB;AAAA,cAClB;AAAA,YACF,CAAC;AAED,gBAAI,CAAC,SAAS,IAAI;AAChB,oBAAM,YAAY,MAAM,SAAS,KAAK;AACtC,sBAAQ,MAAM,uCAAuC,SAAS;AAC9D,qBAAO,2BAAa;AAAA,gBAClB,EAAE,OAAO,iBAAiB,SAAS,UAAU;AAAA,gBAC7C,EAAE,QAAQ,IAAI;AAAA,cAChB;AAAA,YACF;AAEA,kBAAM,UAAU,MAAM,SAAS,KAAK;AAEpC,kBAAM,eAAe,2BAAa,KAAK;AAAA,cACrC,MAAM,QAAQ;AAAA,cACd,SAAS;AAAA,gBACP,QAAQ,QAAQ,KAAK;AAAA,gBACrB,WAAW;AAAA,gBACX,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,cACpC;AAAA,YACF,CAAC;AAED,0BAAc,cAAc,KAAK;AAEjC,mBAAO;AAAA,UACT,SAAS,OAAO;AACd,oBAAQ,MAAM,sCAAsC,KAAK;AACzD,mBAAO,2BAAa;AAAA,cAClB,EAAE,OAAO,2BAA2B,SAAS,OAAO,KAAK,EAAE;AAAA,cAC3D,EAAE,QAAQ,IAAI;AAAA,YAChB;AAAA,UACF;AAAA,QACF;AAAA,QAEA;AACE,iBAAO,2BAAa;AAAA,YAClB,EAAE,OAAO,iBAAiB;AAAA,YAC1B,EAAE,QAAQ,IAAI;AAAA,UAChB;AAAA,MACJ;AAAA,IACF,SAAS,OAAO;AACd,cAAQ,MAAM,qBAAqB,KAAK;AACxC,aAAO,2BAAa;AAAA,QAClB,EAAE,OAAO,wBAAwB;AAAA,QACjC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAKA,iBAAe,IAAI,SAAsB;AACvC,QAAI;AACF,YAAM,QAAQ,QAAQ,QAAQ,IAAI,UAAU,GAAG;AAE/C,UAAI,CAAC,OAAO;AACV,eAAO,2BAAa,KAAK,EAAE,MAAM,MAAM,SAAS,KAAK,CAAC;AAAA,MACxD;AAGA,YAAM,WAAW,MAAM,MAAM,GAAG,OAAO,8BAA8B;AAAA,QACnE,SAAS;AAAA,UACP,eAAe,UAAU,KAAK;AAAA,UAC9B,gBAAgB;AAAA,QAClB;AAAA,MACF,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,eAAe,2BAAa,KAAK,EAAE,MAAM,MAAM,SAAS,KAAK,CAAC;AACpE,wBAAgB,YAAY;AAC5B,eAAO;AAAA,MACT;AAEA,YAAM,UAAU,MAAM,SAAS,KAAK;AAEpC,aAAO,2BAAa,KAAK;AAAA,QACvB,MAAM,QAAQ;AAAA,QACd,SAAS;AAAA,UACP,QAAQ,QAAQ,KAAK;AAAA,UACrB;AAAA,UACA,WAAW;AAAA,UACX,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QACpC;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,qBAAqB,KAAK;AACxC,aAAO,2BAAa,KAAK,EAAE,MAAM,MAAM,SAAS,KAAK,CAAC;AAAA,IACxD;AAAA,EACF;AAKA,iBAAe,OAAO,SAAsB;AAC1C,QAAI;AACF,YAAM,QAAQ,QAAQ,QAAQ,IAAI,UAAU,GAAG;AAE/C,UAAI,OAAO;AAET,YAAI;AACF,gBAAM,MAAM,GAAG,OAAO,0BAA0B;AAAA,YAC9C,QAAQ;AAAA,YACR,SAAS;AAAA,cACP,eAAe,UAAU,KAAK;AAAA,cAC9B,gBAAgB;AAAA,YAClB;AAAA,UACF,CAAC;AAAA,QACH,SAAS,OAAO;AAEd,kBAAQ,MAAM,8BAA8B,KAAK;AAAA,QACnD;AAAA,MACF;AAEA,YAAM,WAAW,2BAAa,KAAK,EAAE,SAAS,KAAK,CAAC;AACpD,sBAAgB,QAAQ;AAExB,aAAO;AAAA,IACT,SAAS,OAAO;AACd,cAAQ,MAAM,qBAAqB,KAAK;AACxC,aAAO,2BAAa;AAAA,QAClB,EAAE,OAAO,wBAAwB;AAAA,QACjC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/api.mjs

@@ -65,7 +65,7 @@ function createAuthRouteHandlers(config) {
               { status: 401 }
             );
           }
-          if (!result.data) {
+          if (!result.data || !result.data.user) {
             return NextResponse.json(
               { error: "Authentication failed" },
               { status: 401 }
@@ -79,7 +79,7 @@ function createAuthRouteHandlers(config) {
               createdAt: (/* @__PURE__ */ new Date()).toISOString()
             }
           });
-          setAuthCookie(response, result.data.accessToken);
+          setAuthCookie(response, result.data.accessToken || "");
           return response;
         }
         case "sign-up": {
@@ -96,7 +96,7 @@ function createAuthRouteHandlers(config) {
               { status: 400 }
             );
           }
-          if (!result.data) {
+          if (!result.data || !result.data.user) {
             return NextResponse.json(
               { error: "Sign up failed" },
               { status: 400 }
@@ -110,7 +110,7 @@ function createAuthRouteHandlers(config) {
               createdAt: (/* @__PURE__ */ new Date()).toISOString()
             }
           });
-          setAuthCookie(response, result.data.accessToken);
+          setAuthCookie(response, result.data.accessToken || "");
           return response;
         }
         case "sync-token": {
@@ -234,62 +234,7 @@ function createAuthRouteHandlers(config) {
     DELETE
   };
 }
-
-// src/api/profile-handler.ts
-import { NextResponse as NextResponse2 } from "next/server";
-function createProfileHandler(config) {
-  const { baseUrl } = config;
-  return async function POST(request) {
-    try {
-      const body = await request.json();
-      const { token } = body;
-      if (!token) {
-        return NextResponse2.json(
-          { success: false, error: "Token is required" },
-          { status: 400 }
-        );
-      }
-      console.log("[Profile Handler] Fetching user profile from backend");
-      const response = await fetch(`${baseUrl}/api/auth/sessions/current`, {
-        headers: {
-          Authorization: `Bearer ${token}`,
-          "Content-Type": "application/json"
-        }
-      });
-      if (!response.ok) {
-        const errorText = await response.text();
-        console.error("[Profile Handler] Backend error:", {
-          status: response.status,
-          error: errorText
-        });
-        return NextResponse2.json(
-          {
-            success: false,
-            error: `Failed to fetch profile: ${response.status} ${response.statusText}`
-          },
-          { status: response.status }
-        );
-      }
-      const userData = await response.json();
-      console.log("[Profile Handler] User profile fetched successfully");
-      return NextResponse2.json({
-        success: true,
-        user: userData
-      });
-    } catch (error) {
-      console.error("[Profile Handler] Error:", error);
-      return NextResponse2.json(
-        {
-          success: false,
-          error: error instanceof Error ? error.message : "Internal server error"
-        },
-        { status: 500 }
-      );
-    }
-  };
-}
 export {
-  createAuthRouteHandlers,
-  createProfileHandler
+  createAuthRouteHandlers
 };
 //# sourceMappingURL=api.mjs.map