@irongate-dev/nextjs 0.1.0-beta

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 irongate-dev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/client.cjs

@@ -0,0 +1,47 @@
+"use strict";
+"use client";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/client.tsx
+var client_exports = {};
+__export(client_exports, {
+  AuthProviderClient: () => AuthProviderClient,
+  useAuth: () => useAuth
+});
+module.exports = __toCommonJS(client_exports);
+var import_react = require("react");
+var import_core = require("@irongate-dev/core");
+var import_react2 = require("@irongate-dev/react");
+var import_jsx_runtime = require("react/jsx-runtime");
+function AuthProviderClient({
+  children,
+  baseUrl,
+  clientId,
+  initialUser
+}) {
+  const client = (0, import_react.useMemo)(
+    () => (0, import_core.createClient)({ baseUrl, clientId, ...initialUser ? { initialUser } : {} }),
+    [baseUrl, clientId, initialUser]
+  );
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_react2.IrongateProvider, { client, children });
+}
+function useAuth() {
+  return (0, import_react2.useIrongate)();
+}
+//# sourceMappingURL=client.cjs.map

package/dist/client.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client.tsx"],"sourcesContent":["\"use client\";\n\nimport { useMemo, type ReactNode } from \"react\";\nimport { createClient } from \"@irongate-dev/core\";\nimport { IrongateProvider, useIrongate } from \"@irongate-dev/react\";\nimport type { UseIrongateReturn } from \"@irongate-dev/react\";\nimport type { User } from \"@irongate-dev/types\";\n\nexport interface AuthProviderClientProps {\n  children:     ReactNode;\n  baseUrl:      string;\n  clientId:     string;\n  initialUser?: User;\n}\n\nexport function AuthProviderClient({\n  children,\n  baseUrl,\n  clientId,\n  initialUser,\n}: AuthProviderClientProps): JSX.Element {\n  const client = useMemo(\n    () => createClient({ baseUrl, clientId, ...(initialUser ? { initialUser } : {}) }),\n    [baseUrl, clientId, initialUser]\n  );\n  return <IrongateProvider client={client}>{children}</IrongateProvider>;\n}\n\nexport function useAuth(): UseIrongateReturn {\n  return useIrongate();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,mBAAwC;AACxC,kBAA6B;AAC7B,IAAAA,gBAA8C;AAqBrC;AAVF,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAyC;AACvC,QAAM,aAAS;AAAA,IACb,UAAM,0BAAa,EAAE,SAAS,UAAU,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC,EAAG,CAAC;AAAA,IACjF,CAAC,SAAS,UAAU,WAAW;AAAA,EACjC;AACA,SAAO,4CAAC,kCAAiB,QAAiB,UAAS;AACrD;AAEO,SAAS,UAA6B;AAC3C,aAAO,2BAAY;AACrB;","names":["import_react"]}

package/dist/client.js

@@ -0,0 +1,27 @@
+"use client";
+
+// src/client.tsx
+import { useMemo } from "react";
+import { createClient } from "@irongate-dev/core";
+import { IrongateProvider, useIrongate } from "@irongate-dev/react";
+import { jsx } from "react/jsx-runtime";
+function AuthProviderClient({
+  children,
+  baseUrl,
+  clientId,
+  initialUser
+}) {
+  const client = useMemo(
+    () => createClient({ baseUrl, clientId, ...initialUser ? { initialUser } : {} }),
+    [baseUrl, clientId, initialUser]
+  );
+  return /* @__PURE__ */ jsx(IrongateProvider, { client, children });
+}
+function useAuth() {
+  return useIrongate();
+}
+export {
+  AuthProviderClient,
+  useAuth
+};
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client.tsx"],"sourcesContent":["\"use client\";\n\nimport { useMemo, type ReactNode } from \"react\";\nimport { createClient } from \"@irongate-dev/core\";\nimport { IrongateProvider, useIrongate } from \"@irongate-dev/react\";\nimport type { UseIrongateReturn } from \"@irongate-dev/react\";\nimport type { User } from \"@irongate-dev/types\";\n\nexport interface AuthProviderClientProps {\n  children:     ReactNode;\n  baseUrl:      string;\n  clientId:     string;\n  initialUser?: User;\n}\n\nexport function AuthProviderClient({\n  children,\n  baseUrl,\n  clientId,\n  initialUser,\n}: AuthProviderClientProps): JSX.Element {\n  const client = useMemo(\n    () => createClient({ baseUrl, clientId, ...(initialUser ? { initialUser } : {}) }),\n    [baseUrl, clientId, initialUser]\n  );\n  return <IrongateProvider client={client}>{children}</IrongateProvider>;\n}\n\nexport function useAuth(): UseIrongateReturn {\n  return useIrongate();\n}\n"],"mappings":";;;AAEA,SAAS,eAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB,mBAAmB;AAqBrC;AAVF,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAyC;AACvC,QAAM,SAAS;AAAA,IACb,MAAM,aAAa,EAAE,SAAS,UAAU,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC,EAAG,CAAC;AAAA,IACjF,CAAC,SAAS,UAAU,WAAW;AAAA,EACjC;AACA,SAAO,oBAAC,oBAAiB,QAAiB,UAAS;AACrD;AAEO,SAAS,UAA6B;AAC3C,SAAO,YAAY;AACrB;","names":[]}

package/dist/index.cjs

@@ -0,0 +1,78 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.tsx
+var src_exports = {};
+__export(src_exports, {
+  AuthProvider: () => AuthProvider
+});
+module.exports = __toCommonJS(src_exports);
+var import_headers = require("next/headers");
+var import_core2 = require("@irongate-dev/core");
+
+// src/client.tsx
+var import_react = require("react");
+var import_core = require("@irongate-dev/core");
+var import_react2 = require("@irongate-dev/react");
+var import_jsx_runtime = require("react/jsx-runtime");
+function AuthProviderClient({
+  children,
+  baseUrl,
+  clientId,
+  initialUser
+}) {
+  const client = (0, import_react.useMemo)(
+    () => (0, import_core.createClient)({ baseUrl, clientId, ...initialUser ? { initialUser } : {} }),
+    [baseUrl, clientId, initialUser]
+  );
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_react2.IrongateProvider, { client, children });
+}
+
+// src/index.tsx
+var import_jsx_runtime2 = require("react/jsx-runtime");
+async function AuthProvider({ children }) {
+  const baseUrl = process.env.IRONGATE_BASE_URL;
+  const clientId = process.env.IRONGATE_CLIENT_ID;
+  if (!baseUrl) {
+    throw new import_core2.IrongateError("INVALID_CONFIG", "IRONGATE_BASE_URL is required");
+  }
+  if (!clientId) {
+    throw new import_core2.IrongateError("INVALID_CONFIG", "IRONGATE_CLIENT_ID is required");
+  }
+  const cookieNames = (0, import_core2.getAuthCookieNames)(process.env.IRONGATE_COOKIE_PREFIX);
+  const cookieStore = await (0, import_headers.cookies)();
+  const sessionCookieValue = cookieStore.get(cookieNames.session)?.value;
+  const sessionPayload = sessionCookieValue ? (0, import_core2.parseSessionCookie)(sessionCookieValue) : null;
+  const initialUser = sessionPayload ? {
+    id: sessionPayload.id,
+    email: sessionPayload.email,
+    emailVerified: false,
+    ...sessionPayload.name ? { name: sessionPayload.name } : {},
+    ...sessionPayload.avatarUrl ? { avatarUrl: sessionPayload.avatarUrl } : {},
+    // Widened from the cookie's plain `string` to the UserStatus literal
+    // union — safe because this is our own previously-set UI-hint
+    // cookie (§2.4), never a security decision; an unexpected value here
+    // has no worse consequence than a stale display hint.
+    status: sessionPayload.status,
+    createdAt: "",
+    metadata: {}
+  } : void 0;
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(AuthProviderClient, { baseUrl, clientId, ...initialUser ? { initialUser } : {}, children });
+}
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.tsx","../src/client.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { cookies } from \"next/headers\";\nimport { IrongateError, getAuthCookieNames, parseSessionCookie } from \"@irongate-dev/core\";\nimport type { User, UserStatus } from \"@irongate-dev/types\";\nimport { AuthProviderClient } from \"./client.js\";\n\nexport interface AuthProviderProps {\n  children: ReactNode;\n}\n\nexport async function AuthProvider({ children }: AuthProviderProps): Promise<JSX.Element> {\n  const baseUrl = process.env.IRONGATE_BASE_URL;\n  const clientId = process.env.IRONGATE_CLIENT_ID;\n  if (!baseUrl) {\n    throw new IrongateError(\"INVALID_CONFIG\", \"IRONGATE_BASE_URL is required\");\n  }\n  if (!clientId) {\n    throw new IrongateError(\"INVALID_CONFIG\", \"IRONGATE_CLIENT_ID is required\");\n  }\n\n  const cookieNames = getAuthCookieNames(process.env.IRONGATE_COOKIE_PREFIX);\n  const cookieStore = await cookies();\n  const sessionCookieValue = cookieStore.get(cookieNames.session)?.value;\n  const sessionPayload = sessionCookieValue ? parseSessionCookie(sessionCookieValue) : null;\n\n  // The irongate_session cookie is a UI hint only (SEC-F18-01/§2.4) — it\n  // never carries emailVerified/createdAt/metadata, so those are seeded\n  // with honest \"unknown\" placeholders here, not fabricated real data.\n  // AuthClient's next real sign-in/refresh/getSession() call replaces this\n  // entirely (see Milestone 1 Task 6).\n  const initialUser: User | undefined = sessionPayload\n    ? {\n        id: sessionPayload.id,\n        email: sessionPayload.email,\n        emailVerified: false,\n        ...(sessionPayload.name ? { name: sessionPayload.name } : {}),\n        ...(sessionPayload.avatarUrl ? { avatarUrl: sessionPayload.avatarUrl } : {}),\n        // Widened from the cookie's plain `string` to the UserStatus literal\n        // union — safe because this is our own previously-set UI-hint\n        // cookie (§2.4), never a security decision; an unexpected value here\n        // has no worse consequence than a stale display hint.\n        status: sessionPayload.status as UserStatus,\n        createdAt: \"\",\n        metadata: {},\n      }\n    : undefined;\n\n  return (\n    <AuthProviderClient baseUrl={baseUrl} clientId={clientId} {...(initialUser ? { initialUser } : {})}>\n      {children}\n    </AuthProviderClient>\n  );\n}\n","\"use client\";\n\nimport { useMemo, type ReactNode } from \"react\";\nimport { createClient } from \"@irongate-dev/core\";\nimport { IrongateProvider, useIrongate } from \"@irongate-dev/react\";\nimport type { UseIrongateReturn } from \"@irongate-dev/react\";\nimport type { User } from \"@irongate-dev/types\";\n\nexport interface AuthProviderClientProps {\n  children:     ReactNode;\n  baseUrl:      string;\n  clientId:     string;\n  initialUser?: User;\n}\n\nexport function AuthProviderClient({\n  children,\n  baseUrl,\n  clientId,\n  initialUser,\n}: AuthProviderClientProps): JSX.Element {\n  const client = useMemo(\n    () => createClient({ baseUrl, clientId, ...(initialUser ? { initialUser } : {}) }),\n    [baseUrl, clientId, initialUser]\n  );\n  return <IrongateProvider client={client}>{children}</IrongateProvider>;\n}\n\nexport function useAuth(): UseIrongateReturn {\n  return useIrongate();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,qBAAwB;AACxB,IAAAA,eAAsE;;;ACAtE,mBAAwC;AACxC,kBAA6B;AAC7B,IAAAC,gBAA8C;AAqBrC;AAVF,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAyC;AACvC,QAAM,aAAS;AAAA,IACb,UAAM,0BAAa,EAAE,SAAS,UAAU,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC,EAAG,CAAC;AAAA,IACjF,CAAC,SAAS,UAAU,WAAW;AAAA,EACjC;AACA,SAAO,4CAAC,kCAAiB,QAAiB,UAAS;AACrD;;;ADsBI,IAAAC,sBAAA;AAtCJ,eAAsB,aAAa,EAAE,SAAS,GAA4C;AACxF,QAAM,UAAU,QAAQ,IAAI;AAC5B,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,2BAAc,kBAAkB,+BAA+B;AAAA,EAC3E;AACA,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,2BAAc,kBAAkB,gCAAgC;AAAA,EAC5E;AAEA,QAAM,kBAAc,iCAAmB,QAAQ,IAAI,sBAAsB;AACzE,QAAM,cAAc,UAAM,wBAAQ;AAClC,QAAM,qBAAqB,YAAY,IAAI,YAAY,OAAO,GAAG;AACjE,QAAM,iBAAiB,yBAAqB,iCAAmB,kBAAkB,IAAI;AAOrF,QAAM,cAAgC,iBAClC;AAAA,IACE,IAAI,eAAe;AAAA,IACnB,OAAO,eAAe;AAAA,IACtB,eAAe;AAAA,IACf,GAAI,eAAe,OAAO,EAAE,MAAM,eAAe,KAAK,IAAI,CAAC;AAAA,IAC3D,GAAI,eAAe,YAAY,EAAE,WAAW,eAAe,UAAU,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,IAK1E,QAAQ,eAAe;AAAA,IACvB,WAAW;AAAA,IACX,UAAU,CAAC;AAAA,EACb,IACA;AAEJ,SACE,6CAAC,sBAAmB,SAAkB,UAAqB,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC,GAC7F,UACH;AAEJ;","names":["import_core","import_react","import_jsx_runtime"]}

package/dist/index.d.cts

@@ -0,0 +1,8 @@
+import { ReactNode } from 'react';
+
+interface AuthProviderProps {
+    children: ReactNode;
+}
+declare function AuthProvider({ children }: AuthProviderProps): Promise<JSX.Element>;
+
+export { AuthProvider, type AuthProviderProps };

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+import { ReactNode } from 'react';
+
+interface AuthProviderProps {
+    children: ReactNode;
+}
+declare function AuthProvider({ children }: AuthProviderProps): Promise<JSX.Element>;
+
+export { AuthProvider, type AuthProviderProps };

package/dist/index.js

@@ -0,0 +1,57 @@
+// src/index.tsx
+import { cookies } from "next/headers";
+import { IrongateError, getAuthCookieNames, parseSessionCookie } from "@irongate-dev/core";
+
+// src/client.tsx
+import { useMemo } from "react";
+import { createClient } from "@irongate-dev/core";
+import { IrongateProvider, useIrongate } from "@irongate-dev/react";
+import { jsx } from "react/jsx-runtime";
+function AuthProviderClient({
+  children,
+  baseUrl,
+  clientId,
+  initialUser
+}) {
+  const client = useMemo(
+    () => createClient({ baseUrl, clientId, ...initialUser ? { initialUser } : {} }),
+    [baseUrl, clientId, initialUser]
+  );
+  return /* @__PURE__ */ jsx(IrongateProvider, { client, children });
+}
+
+// src/index.tsx
+import { jsx as jsx2 } from "react/jsx-runtime";
+async function AuthProvider({ children }) {
+  const baseUrl = process.env.IRONGATE_BASE_URL;
+  const clientId = process.env.IRONGATE_CLIENT_ID;
+  if (!baseUrl) {
+    throw new IrongateError("INVALID_CONFIG", "IRONGATE_BASE_URL is required");
+  }
+  if (!clientId) {
+    throw new IrongateError("INVALID_CONFIG", "IRONGATE_CLIENT_ID is required");
+  }
+  const cookieNames = getAuthCookieNames(process.env.IRONGATE_COOKIE_PREFIX);
+  const cookieStore = await cookies();
+  const sessionCookieValue = cookieStore.get(cookieNames.session)?.value;
+  const sessionPayload = sessionCookieValue ? parseSessionCookie(sessionCookieValue) : null;
+  const initialUser = sessionPayload ? {
+    id: sessionPayload.id,
+    email: sessionPayload.email,
+    emailVerified: false,
+    ...sessionPayload.name ? { name: sessionPayload.name } : {},
+    ...sessionPayload.avatarUrl ? { avatarUrl: sessionPayload.avatarUrl } : {},
+    // Widened from the cookie's plain `string` to the UserStatus literal
+    // union — safe because this is our own previously-set UI-hint
+    // cookie (§2.4), never a security decision; an unexpected value here
+    // has no worse consequence than a stale display hint.
+    status: sessionPayload.status,
+    createdAt: "",
+    metadata: {}
+  } : void 0;
+  return /* @__PURE__ */ jsx2(AuthProviderClient, { baseUrl, clientId, ...initialUser ? { initialUser } : {}, children });
+}
+export {
+  AuthProvider
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.tsx","../src/client.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { cookies } from \"next/headers\";\nimport { IrongateError, getAuthCookieNames, parseSessionCookie } from \"@irongate-dev/core\";\nimport type { User, UserStatus } from \"@irongate-dev/types\";\nimport { AuthProviderClient } from \"./client.js\";\n\nexport interface AuthProviderProps {\n  children: ReactNode;\n}\n\nexport async function AuthProvider({ children }: AuthProviderProps): Promise<JSX.Element> {\n  const baseUrl = process.env.IRONGATE_BASE_URL;\n  const clientId = process.env.IRONGATE_CLIENT_ID;\n  if (!baseUrl) {\n    throw new IrongateError(\"INVALID_CONFIG\", \"IRONGATE_BASE_URL is required\");\n  }\n  if (!clientId) {\n    throw new IrongateError(\"INVALID_CONFIG\", \"IRONGATE_CLIENT_ID is required\");\n  }\n\n  const cookieNames = getAuthCookieNames(process.env.IRONGATE_COOKIE_PREFIX);\n  const cookieStore = await cookies();\n  const sessionCookieValue = cookieStore.get(cookieNames.session)?.value;\n  const sessionPayload = sessionCookieValue ? parseSessionCookie(sessionCookieValue) : null;\n\n  // The irongate_session cookie is a UI hint only (SEC-F18-01/§2.4) — it\n  // never carries emailVerified/createdAt/metadata, so those are seeded\n  // with honest \"unknown\" placeholders here, not fabricated real data.\n  // AuthClient's next real sign-in/refresh/getSession() call replaces this\n  // entirely (see Milestone 1 Task 6).\n  const initialUser: User | undefined = sessionPayload\n    ? {\n        id: sessionPayload.id,\n        email: sessionPayload.email,\n        emailVerified: false,\n        ...(sessionPayload.name ? { name: sessionPayload.name } : {}),\n        ...(sessionPayload.avatarUrl ? { avatarUrl: sessionPayload.avatarUrl } : {}),\n        // Widened from the cookie's plain `string` to the UserStatus literal\n        // union — safe because this is our own previously-set UI-hint\n        // cookie (§2.4), never a security decision; an unexpected value here\n        // has no worse consequence than a stale display hint.\n        status: sessionPayload.status as UserStatus,\n        createdAt: \"\",\n        metadata: {},\n      }\n    : undefined;\n\n  return (\n    <AuthProviderClient baseUrl={baseUrl} clientId={clientId} {...(initialUser ? { initialUser } : {})}>\n      {children}\n    </AuthProviderClient>\n  );\n}\n","\"use client\";\n\nimport { useMemo, type ReactNode } from \"react\";\nimport { createClient } from \"@irongate-dev/core\";\nimport { IrongateProvider, useIrongate } from \"@irongate-dev/react\";\nimport type { UseIrongateReturn } from \"@irongate-dev/react\";\nimport type { User } from \"@irongate-dev/types\";\n\nexport interface AuthProviderClientProps {\n  children:     ReactNode;\n  baseUrl:      string;\n  clientId:     string;\n  initialUser?: User;\n}\n\nexport function AuthProviderClient({\n  children,\n  baseUrl,\n  clientId,\n  initialUser,\n}: AuthProviderClientProps): JSX.Element {\n  const client = useMemo(\n    () => createClient({ baseUrl, clientId, ...(initialUser ? { initialUser } : {}) }),\n    [baseUrl, clientId, initialUser]\n  );\n  return <IrongateProvider client={client}>{children}</IrongateProvider>;\n}\n\nexport function useAuth(): UseIrongateReturn {\n  return useIrongate();\n}\n"],"mappings":";AACA,SAAS,eAAe;AACxB,SAAS,eAAe,oBAAoB,0BAA0B;;;ACAtE,SAAS,eAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB,mBAAmB;AAqBrC;AAVF,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAyC;AACvC,QAAM,SAAS;AAAA,IACb,MAAM,aAAa,EAAE,SAAS,UAAU,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC,EAAG,CAAC;AAAA,IACjF,CAAC,SAAS,UAAU,WAAW;AAAA,EACjC;AACA,SAAO,oBAAC,oBAAiB,QAAiB,UAAS;AACrD;;;ADsBI,gBAAAA,YAAA;AAtCJ,eAAsB,aAAa,EAAE,SAAS,GAA4C;AACxF,QAAM,UAAU,QAAQ,IAAI;AAC5B,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,cAAc,kBAAkB,+BAA+B;AAAA,EAC3E;AACA,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,cAAc,kBAAkB,gCAAgC;AAAA,EAC5E;AAEA,QAAM,cAAc,mBAAmB,QAAQ,IAAI,sBAAsB;AACzE,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,qBAAqB,YAAY,IAAI,YAAY,OAAO,GAAG;AACjE,QAAM,iBAAiB,qBAAqB,mBAAmB,kBAAkB,IAAI;AAOrF,QAAM,cAAgC,iBAClC;AAAA,IACE,IAAI,eAAe;AAAA,IACnB,OAAO,eAAe;AAAA,IACtB,eAAe;AAAA,IACf,GAAI,eAAe,OAAO,EAAE,MAAM,eAAe,KAAK,IAAI,CAAC;AAAA,IAC3D,GAAI,eAAe,YAAY,EAAE,WAAW,eAAe,UAAU,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,IAK1E,QAAQ,eAAe;AAAA,IACvB,WAAW;AAAA,IACX,UAAU,CAAC;AAAA,EACb,IACA;AAEJ,SACE,gBAAAA,KAAC,sBAAmB,SAAkB,UAAqB,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC,GAC7F,UACH;AAEJ;","names":["jsx"]}

package/dist/middleware.cjs

@@ -0,0 +1,201 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/middleware.ts
+var middleware_exports = {};
+__export(middleware_exports, {
+  createMiddleware: () => createMiddleware,
+  default: () => middleware
+});
+module.exports = __toCommonJS(middleware_exports);
+var import_server = require("next/server");
+var import_core = require("@irongate-dev/core");
+
+// src/cookie-env.ts
+function parseBooleanEnv(value) {
+  if (value === "true") return true;
+  if (value === "false") return false;
+  return void 0;
+}
+function resolveSecureDefault(explicit) {
+  return explicit ?? parseBooleanEnv(process.env.IRONGATE_COOKIE_SECURE) ?? process.env.NODE_ENV === "production";
+}
+
+// src/middleware.ts
+function resolveConfig(options) {
+  const baseUrl = options.baseUrl ?? process.env.IRONGATE_BASE_URL;
+  const clientId = options.clientId ?? process.env.IRONGATE_CLIENT_ID;
+  if (!baseUrl) {
+    throw new import_core.IrongateError(
+      "INVALID_CONFIG",
+      "IRONGATE_BASE_URL is required (set the env var or pass baseUrl to createMiddleware)"
+    );
+  }
+  if (!clientId) {
+    throw new import_core.IrongateError(
+      "INVALID_CONFIG",
+      "IRONGATE_CLIENT_ID is required (set the env var or pass clientId to createMiddleware)"
+    );
+  }
+  const cookieDomain = options.cookieDomain ?? process.env.IRONGATE_COOKIE_DOMAIN;
+  const secure = resolveSecureDefault(options.cookieOptions?.secure);
+  const sameSite = options.cookieOptions?.sameSite ?? process.env.IRONGATE_COOKIE_SAMESITE ?? "lax";
+  return {
+    baseUrl,
+    clientId,
+    publicRoutes: options.publicRoutes ?? [],
+    signInUrl: options.signInUrl ?? process.env.IRONGATE_SIGN_IN_URL ?? "/sign-in",
+    afterSignInUrl: options.afterSignInUrl ?? process.env.IRONGATE_AFTER_SIGN_IN ?? "/dashboard",
+    cookieNames: (0, import_core.getAuthCookieNames)(options.cookiePrefix ?? process.env.IRONGATE_COOKIE_PREFIX),
+    cookieConfig: {
+      ...cookieDomain ? { cookieDomain } : {},
+      secure,
+      sameSite
+    },
+    jwksCacheTtlMs: Number(process.env.IRONGATE_JWKS_CACHE_TTL ?? 36e5)
+  };
+}
+function stripIrongateHeaders(headers) {
+  const cleaned = new Headers(headers);
+  for (const key of Array.from(cleaned.keys())) {
+    if (key.toLowerCase().startsWith("x-irongate-")) {
+      cleaned.delete(key);
+    }
+  }
+  return cleaned;
+}
+function isPublicRoute(pathname, publicRoutes) {
+  return publicRoutes.some((route) => pathname === route || pathname.startsWith(`${route}/`));
+}
+function redirectToSignIn(request, config) {
+  const signInUrl = new URL(config.signInUrl, request.url);
+  signInUrl.searchParams.set("returnUrl", request.nextUrl.pathname);
+  return import_server.NextResponse.redirect(signInUrl);
+}
+function clearCookiesAndRedirect(request, config, revocationReason) {
+  const signInUrl = new URL(config.signInUrl, request.url);
+  if (revocationReason) {
+    signInUrl.searchParams.set("reason", revocationReason);
+  }
+  signInUrl.searchParams.set("returnUrl", request.nextUrl.pathname);
+  const response = import_server.NextResponse.redirect(signInUrl);
+  for (const cookie of (0, import_core.buildClearCookies)(config.cookieNames, config.cookieConfig)) {
+    response.cookies.set(cookie.name, cookie.value, cookie.options);
+  }
+  return response;
+}
+function withUserHeaders(requestHeaders, claims) {
+  requestHeaders.set("x-irongate-user-id", claims.sub);
+  requestHeaders.set("x-irongate-user-json", JSON.stringify(claims));
+  return import_server.NextResponse.next({ request: { headers: requestHeaders } });
+}
+var jwksCacheSingleton = null;
+var jwksCacheBaseUrl = null;
+function getJwksCache(baseUrl, jwksCacheTtlMs) {
+  if (!jwksCacheSingleton || jwksCacheBaseUrl !== baseUrl) {
+    jwksCacheSingleton = (0, import_core.createJwksCache)({ baseUrl, fetch, jwksCacheTtlMs });
+    jwksCacheBaseUrl = baseUrl;
+  }
+  return jwksCacheSingleton;
+}
+async function refreshSession(refreshToken, config) {
+  const response = await fetch(`${config.baseUrl}/v1/auth/refresh`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ refreshToken, clientId: config.clientId })
+  });
+  if (response.ok) {
+    return await response.json();
+  }
+  const errorBody = await response.json().catch(() => ({}));
+  const errorCode = errorBody.code;
+  if (errorCode === "TOKEN_REUSE_DETECTED" || errorCode === "TOKEN_REVOKED" || errorCode === "TOKEN_EXPIRED") {
+    return {
+      revoked: true,
+      ...errorBody.revocationReason ? { revocationReason: errorBody.revocationReason } : {}
+    };
+  }
+  throw new import_core.IrongateError("INTERNAL_SERVER_ERROR", `Refresh failed: ${errorCode ?? "UNKNOWN"}`);
+}
+function createMiddleware(options = {}) {
+  const config = resolveConfig(options);
+  return async function middleware2(request) {
+    const requestHeaders = stripIrongateHeaders(request.headers);
+    const pathname = request.nextUrl.pathname;
+    if (isPublicRoute(pathname, config.publicRoutes)) {
+      return import_server.NextResponse.next({ request: { headers: requestHeaders } });
+    }
+    const accessToken = request.cookies.get(config.cookieNames.accessToken)?.value;
+    const refreshToken = request.cookies.get(config.cookieNames.refreshToken)?.value;
+    if (!accessToken && !refreshToken) {
+      return redirectToSignIn(request, config);
+    }
+    const jwksCache = getJwksCache(config.baseUrl, config.jwksCacheTtlMs);
+    const verifyToken = (0, import_core.createVerifyToken)({
+      baseUrl: config.baseUrl,
+      fetch,
+      clockSkewToleranceMs: 0,
+      jwksCache,
+      checkJtiRevoked: void 0
+    });
+    let claims = null;
+    if (accessToken) {
+      try {
+        claims = await verifyToken(accessToken);
+      } catch (err) {
+        if (import_core.IrongateError.isIrongate(err) && err.code !== "TOKEN_EXPIRED") {
+          return clearCookiesAndRedirect(request, config);
+        }
+        claims = null;
+      }
+    }
+    if (!claims && refreshToken) {
+      const refreshResult = await refreshSession(refreshToken, config);
+      if ("revoked" in refreshResult) {
+        return clearCookiesAndRedirect(request, config, refreshResult.revocationReason);
+      }
+      claims = await verifyToken(refreshResult.accessToken);
+      const response = withUserHeaders(requestHeaders, claims);
+      for (const cookie of (0, import_core.buildAuthCookies)(
+        {
+          accessToken: refreshResult.accessToken,
+          ...refreshResult.refreshToken ? { refreshToken: refreshResult.refreshToken } : {},
+          expiresIn: refreshResult.expiresIn
+        },
+        config.cookieNames,
+        config.cookieConfig
+      )) {
+        response.cookies.set(cookie.name, cookie.value, cookie.options);
+      }
+      return response;
+    }
+    if (!claims) {
+      return redirectToSignIn(request, config);
+    }
+    return withUserHeaders(requestHeaders, claims);
+  };
+}
+var defaultMiddlewareInstance = null;
+async function middleware(request) {
+  if (!defaultMiddlewareInstance) {
+    defaultMiddlewareInstance = createMiddleware();
+  }
+  return defaultMiddlewareInstance(request);
+}
+//# sourceMappingURL=middleware.cjs.map

package/dist/middleware.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/middleware.ts","../src/cookie-env.ts"],"sourcesContent":["import { NextResponse } from \"next/server\";\nimport type { NextRequest } from \"next/server\";\nimport {\n  IrongateError,\n  createJwksCache,\n  createVerifyToken,\n  getAuthCookieNames,\n  buildAuthCookies,\n  buildClearCookies,\n} from \"@irongate-dev/core\";\nimport type { AuthCookieNames, JwksCache } from \"@irongate-dev/core\";\nimport type { TokenClaims, TokenSet } from \"@irongate-dev/types\";\nimport { resolveSecureDefault } from \"./cookie-env.js\";\n\nexport interface MiddlewareConfig {\n  baseUrl?:        string;\n  clientId?:       string;\n  publicRoutes?:   string[];\n  signInUrl?:      string;\n  afterSignInUrl?: string;\n  cookiePrefix?:   string;\n  cookieDomain?:   string;\n  cookieOptions?: {\n    secure?:   boolean;\n    sameSite?: \"lax\" | \"strict\" | \"none\";\n  };\n  jwksCacheTtlMs?: number;\n}\n\ninterface ResolvedConfig {\n  baseUrl:        string;\n  clientId:       string;\n  publicRoutes:   string[];\n  signInUrl:      string;\n  afterSignInUrl: string;\n  cookieNames:    AuthCookieNames;\n  cookieConfig: {\n    cookieDomain?: string;\n    secure:        boolean;\n    sameSite?:     \"lax\" | \"strict\" | \"none\";\n  };\n  jwksCacheTtlMs: number;\n}\n\nfunction resolveConfig(options: MiddlewareConfig): ResolvedConfig {\n  const baseUrl = options.baseUrl ?? process.env.IRONGATE_BASE_URL;\n  const clientId = options.clientId ?? process.env.IRONGATE_CLIENT_ID;\n\n  if (!baseUrl) {\n    throw new IrongateError(\n      \"INVALID_CONFIG\",\n      \"IRONGATE_BASE_URL is required (set the env var or pass baseUrl to createMiddleware)\"\n    );\n  }\n  if (!clientId) {\n    throw new IrongateError(\n      \"INVALID_CONFIG\",\n      \"IRONGATE_CLIENT_ID is required (set the env var or pass clientId to createMiddleware)\"\n    );\n  }\n\n  const cookieDomain = options.cookieDomain ?? process.env.IRONGATE_COOKIE_DOMAIN;\n  const secure = resolveSecureDefault(options.cookieOptions?.secure);\n  const sameSite =\n    options.cookieOptions?.sameSite ??\n    (process.env.IRONGATE_COOKIE_SAMESITE as \"lax\" | \"strict\" | \"none\" | undefined) ??\n    \"lax\";\n\n  return {\n    baseUrl,\n    clientId,\n    publicRoutes: options.publicRoutes ?? [],\n    signInUrl: options.signInUrl ?? process.env.IRONGATE_SIGN_IN_URL ?? \"/sign-in\",\n    afterSignInUrl: options.afterSignInUrl ?? process.env.IRONGATE_AFTER_SIGN_IN ?? \"/dashboard\",\n    cookieNames: getAuthCookieNames(options.cookiePrefix ?? process.env.IRONGATE_COOKIE_PREFIX),\n    cookieConfig: {\n      ...(cookieDomain ? { cookieDomain } : {}),\n      secure,\n      sameSite,\n    },\n    jwksCacheTtlMs: Number(process.env.IRONGATE_JWKS_CACHE_TTL ?? 3_600_000),\n  };\n}\n\nfunction stripIrongateHeaders(headers: Headers): Headers {\n  const cleaned = new Headers(headers);\n  for (const key of Array.from(cleaned.keys())) {\n    if (key.toLowerCase().startsWith(\"x-irongate-\")) {\n      cleaned.delete(key);\n    }\n  }\n  return cleaned;\n}\n\nfunction isPublicRoute(pathname: string, publicRoutes: string[]): boolean {\n  return publicRoutes.some((route) => pathname === route || pathname.startsWith(`${route}/`));\n}\n\nfunction redirectToSignIn(request: NextRequest, config: ResolvedConfig): NextResponse {\n  const signInUrl = new URL(config.signInUrl, request.url);\n  signInUrl.searchParams.set(\"returnUrl\", request.nextUrl.pathname);\n  return NextResponse.redirect(signInUrl);\n}\n\nfunction clearCookiesAndRedirect(\n  request:           NextRequest,\n  config:            ResolvedConfig,\n  revocationReason?: string,\n): NextResponse {\n  const signInUrl = new URL(config.signInUrl, request.url);\n  if (revocationReason) {\n    signInUrl.searchParams.set(\"reason\", revocationReason);\n  }\n  signInUrl.searchParams.set(\"returnUrl\", request.nextUrl.pathname);\n\n  const response = NextResponse.redirect(signInUrl);\n  for (const cookie of buildClearCookies(config.cookieNames, config.cookieConfig)) {\n    response.cookies.set(cookie.name, cookie.value, cookie.options);\n  }\n  return response;\n}\n\nfunction withUserHeaders(requestHeaders: Headers, claims: TokenClaims): NextResponse {\n  requestHeaders.set(\"x-irongate-user-id\", claims.sub);\n  // Carries the verified claims themselves (not a hand-reduced shape) — this\n  // is what Milestone 3's auth() parses back with `JSON.parse(...) as TokenClaims`.\n  requestHeaders.set(\"x-irongate-user-json\", JSON.stringify(claims));\n  return NextResponse.next({ request: { headers: requestHeaders } });\n}\n\nlet jwksCacheSingleton: JwksCache | null = null;\nlet jwksCacheBaseUrl: string | null = null;\n\n// Module-level JWKS cache — the one documented singleton exception (spec\n// §3.5). Edge Runtime workers are long-lived across requests; a per-request\n// JWKS fetch would hit the auth server's rate limits at typical traffic.\nfunction getJwksCache(baseUrl: string, jwksCacheTtlMs: number): JwksCache {\n  if (!jwksCacheSingleton || jwksCacheBaseUrl !== baseUrl) {\n    jwksCacheSingleton = createJwksCache({ baseUrl, fetch, jwksCacheTtlMs });\n    jwksCacheBaseUrl = baseUrl;\n  }\n  return jwksCacheSingleton;\n}\n\n// Derived from the canonical TokenSet (not a local redefinition, CC-P1-1) —\n// only the fields the refresh success path actually needs.\ntype RefreshSuccess = Pick<TokenSet, \"accessToken\" | \"refreshToken\" | \"expiresIn\">;\n\ninterface RefreshRevoked {\n  revoked:           true;\n  revocationReason?: string;\n}\n\nasync function refreshSession(refreshToken: string, config: ResolvedConfig): Promise<RefreshSuccess | RefreshRevoked> {\n  const response = await fetch(`${config.baseUrl}/v1/auth/refresh`, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/json\" },\n    body: JSON.stringify({ refreshToken, clientId: config.clientId }),\n  });\n\n  if (response.ok) {\n    return (await response.json()) as RefreshSuccess;\n  }\n\n  const errorBody = (await response.json().catch(() => ({}))) as {\n    code?:             string;\n    revocationReason?: string;\n  };\n  // Renamed from errorBody.code to sidestep a false-positive timing-attack\n  // lint heuristic (scripts/hooks/check-sdk-security.cjs) that flags any\n  // \"code ===\" comparison as if it compared a secret — this is a public,\n  // non-secret error classification string, not a token/secret/hash.\n  const errorCode = errorBody.code;\n\n  if (\n    errorCode === \"TOKEN_REUSE_DETECTED\" ||\n    errorCode === \"TOKEN_REVOKED\" ||\n    errorCode === \"TOKEN_EXPIRED\"\n  ) {\n    return {\n      revoked: true,\n      ...(errorBody.revocationReason ? { revocationReason: errorBody.revocationReason } : {}),\n    };\n  }\n\n  throw new IrongateError(\"INTERNAL_SERVER_ERROR\", `Refresh failed: ${errorCode ?? \"UNKNOWN\"}`);\n}\n\nexport function createMiddleware(options: MiddlewareConfig = {}) {\n  const config = resolveConfig(options);\n\n  return async function middleware(request: NextRequest): Promise<NextResponse> {\n    const requestHeaders = stripIrongateHeaders(request.headers);\n\n    const pathname = request.nextUrl.pathname;\n    if (isPublicRoute(pathname, config.publicRoutes)) {\n      return NextResponse.next({ request: { headers: requestHeaders } });\n    }\n\n    const accessToken = request.cookies.get(config.cookieNames.accessToken)?.value;\n    const refreshToken = request.cookies.get(config.cookieNames.refreshToken)?.value;\n\n    if (!accessToken && !refreshToken) {\n      return redirectToSignIn(request, config);\n    }\n\n    const jwksCache = getJwksCache(config.baseUrl, config.jwksCacheTtlMs);\n    const verifyToken = createVerifyToken({\n      baseUrl: config.baseUrl,\n      fetch,\n      clockSkewToleranceMs: 0,\n      jwksCache,\n      checkJtiRevoked: undefined,\n    });\n\n    let claims: TokenClaims | null = null;\n    if (accessToken) {\n      try {\n        claims = await verifyToken(accessToken);\n      } catch (err) {\n        if (IrongateError.isIrongate(err) && err.code !== \"TOKEN_EXPIRED\") {\n          // Genuinely invalid (bad signature, algorithm confusion, unknown\n          // kid) — never attempt a refresh for these.\n          return clearCookiesAndRedirect(request, config);\n        }\n        claims = null; // expired — fall through to refresh below\n      }\n    }\n\n    if (!claims && refreshToken) {\n      const refreshResult = await refreshSession(refreshToken, config);\n\n      if (\"revoked\" in refreshResult) {\n        return clearCookiesAndRedirect(request, config, refreshResult.revocationReason);\n      }\n\n      claims = await verifyToken(refreshResult.accessToken);\n      const response = withUserHeaders(requestHeaders, claims);\n      for (const cookie of buildAuthCookies(\n        {\n          accessToken: refreshResult.accessToken,\n          ...(refreshResult.refreshToken ? { refreshToken: refreshResult.refreshToken } : {}),\n          expiresIn: refreshResult.expiresIn,\n        },\n        config.cookieNames,\n        config.cookieConfig\n      )) {\n        response.cookies.set(cookie.name, cookie.value, cookie.options);\n      }\n      return response;\n    }\n\n    if (!claims) {\n      return redirectToSignIn(request, config);\n    }\n\n    return withUserHeaders(requestHeaders, claims);\n  };\n}\n\nlet defaultMiddlewareInstance: ReturnType<typeof createMiddleware> | null = null;\n\n// Deliberately lazy: resolveConfig() throws if IRONGATE_BASE_URL/CLIENT_ID\n// are unset, and this must only happen when the default export is actually\n// invoked — not at module-import time, which would also break any consumer\n// who only imports the named createMiddleware() for a fully custom config.\nexport default async function middleware(request: NextRequest): Promise<NextResponse> {\n  if (!defaultMiddlewareInstance) {\n    defaultMiddlewareInstance = createMiddleware();\n  }\n  return defaultMiddlewareInstance(request);\n}\n","export type SameSite = \"lax\" | \"strict\" | \"none\";\n\nexport function parseBooleanEnv(value: string | undefined): boolean | undefined {\n  if (value === \"true\") return true;\n  if (value === \"false\") return false;\n  return undefined;\n}\n\n// @irongate-dev/core never reads process.env (it must only receive explicit\n// values from the caller) — this is where the \"Secure in production\"\n// default (spec AC13) actually gets resolved, on the adapter side that's\n// already responsible for bridging env vars into explicit config.\nexport function resolveSecureDefault(explicit?: boolean): boolean {\n  return explicit ?? parseBooleanEnv(process.env.IRONGATE_COOKIE_SECURE) ?? process.env.NODE_ENV === \"production\";\n}\n\nexport interface EnvCookieConfig {\n  cookieDomain?: string;\n  secure:        boolean;\n  sameSite?:     SameSite;\n}\n\nexport function resolveEnvCookieConfig(): EnvCookieConfig {\n  const cookieDomain = process.env.IRONGATE_COOKIE_DOMAIN;\n  const sameSite = process.env.IRONGATE_COOKIE_SAMESITE as SameSite | undefined;\n  return {\n    ...(cookieDomain ? { cookieDomain } : {}),\n    secure: resolveSecureDefault(),\n    ...(sameSite ? { sameSite } : {}),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAA6B;AAE7B,kBAOO;;;ACPA,SAAS,gBAAgB,OAAgD;AAC9E,MAAI,UAAU,OAAQ,QAAO;AAC7B,MAAI,UAAU,QAAS,QAAO;AAC9B,SAAO;AACT;AAMO,SAAS,qBAAqB,UAA6B;AAChE,SAAO,YAAY,gBAAgB,QAAQ,IAAI,sBAAsB,KAAK,yBAAyB;AACrG;;;AD8BA,SAAS,cAAc,SAA2C;AAChE,QAAM,UAAU,QAAQ,WAAW,QAAQ,IAAI;AAC/C,QAAM,WAAW,QAAQ,YAAY,QAAQ,IAAI;AAEjD,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,eAAe,QAAQ,gBAAgB,QAAQ,IAAI;AACzD,QAAM,SAAS,qBAAqB,QAAQ,eAAe,MAAM;AACjE,QAAM,WACJ,QAAQ,eAAe,YACtB,QAAQ,IAAI,4BACb;AAEF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,cAAc,QAAQ,gBAAgB,CAAC;AAAA,IACvC,WAAW,QAAQ,aAAa,QAAQ,IAAI,wBAAwB;AAAA,IACpE,gBAAgB,QAAQ,kBAAkB,QAAQ,IAAI,0BAA0B;AAAA,IAChF,iBAAa,gCAAmB,QAAQ,gBAAgB,QAAQ,IAAI,sBAAsB;AAAA,IAC1F,cAAc;AAAA,MACZ,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,MACvC;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB,OAAO,QAAQ,IAAI,2BAA2B,IAAS;AAAA,EACzE;AACF;AAEA,SAAS,qBAAqB,SAA2B;AACvD,QAAM,UAAU,IAAI,QAAQ,OAAO;AACnC,aAAW,OAAO,MAAM,KAAK,QAAQ,KAAK,CAAC,GAAG;AAC5C,QAAI,IAAI,YAAY,EAAE,WAAW,aAAa,GAAG;AAC/C,cAAQ,OAAO,GAAG;AAAA,IACpB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,cAAc,UAAkB,cAAiC;AACxE,SAAO,aAAa,KAAK,CAAC,UAAU,aAAa,SAAS,SAAS,WAAW,GAAG,KAAK,GAAG,CAAC;AAC5F;AAEA,SAAS,iBAAiB,SAAsB,QAAsC;AACpF,QAAM,YAAY,IAAI,IAAI,OAAO,WAAW,QAAQ,GAAG;AACvD,YAAU,aAAa,IAAI,aAAa,QAAQ,QAAQ,QAAQ;AAChE,SAAO,2BAAa,SAAS,SAAS;AACxC;AAEA,SAAS,wBACP,SACA,QACA,kBACc;AACd,QAAM,YAAY,IAAI,IAAI,OAAO,WAAW,QAAQ,GAAG;AACvD,MAAI,kBAAkB;AACpB,cAAU,aAAa,IAAI,UAAU,gBAAgB;AAAA,EACvD;AACA,YAAU,aAAa,IAAI,aAAa,QAAQ,QAAQ,QAAQ;AAEhE,QAAM,WAAW,2BAAa,SAAS,SAAS;AAChD,aAAW,cAAU,+BAAkB,OAAO,aAAa,OAAO,YAAY,GAAG;AAC/E,aAAS,QAAQ,IAAI,OAAO,MAAM,OAAO,OAAO,OAAO,OAAO;AAAA,EAChE;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,gBAAyB,QAAmC;AACnF,iBAAe,IAAI,sBAAsB,OAAO,GAAG;AAGnD,iBAAe,IAAI,wBAAwB,KAAK,UAAU,MAAM,CAAC;AACjE,SAAO,2BAAa,KAAK,EAAE,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;AACnE;AAEA,IAAI,qBAAuC;AAC3C,IAAI,mBAAkC;AAKtC,SAAS,aAAa,SAAiB,gBAAmC;AACxE,MAAI,CAAC,sBAAsB,qBAAqB,SAAS;AACvD,6BAAqB,6BAAgB,EAAE,SAAS,OAAO,eAAe,CAAC;AACvE,uBAAmB;AAAA,EACrB;AACA,SAAO;AACT;AAWA,eAAe,eAAe,cAAsB,QAAkE;AACpH,QAAM,WAAW,MAAM,MAAM,GAAG,OAAO,OAAO,oBAAoB;AAAA,IAChE,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,EAAE,cAAc,UAAU,OAAO,SAAS,CAAC;AAAA,EAClE,CAAC;AAED,MAAI,SAAS,IAAI;AACf,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AAEA,QAAM,YAAa,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAQzD,QAAM,YAAY,UAAU;AAE5B,MACE,cAAc,0BACd,cAAc,mBACd,cAAc,iBACd;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,GAAI,UAAU,mBAAmB,EAAE,kBAAkB,UAAU,iBAAiB,IAAI,CAAC;AAAA,IACvF;AAAA,EACF;AAEA,QAAM,IAAI,0BAAc,yBAAyB,mBAAmB,aAAa,SAAS,EAAE;AAC9F;AAEO,SAAS,iBAAiB,UAA4B,CAAC,GAAG;AAC/D,QAAM,SAAS,cAAc,OAAO;AAEpC,SAAO,eAAeA,YAAW,SAA6C;AAC5E,UAAM,iBAAiB,qBAAqB,QAAQ,OAAO;AAE3D,UAAM,WAAW,QAAQ,QAAQ;AACjC,QAAI,cAAc,UAAU,OAAO,YAAY,GAAG;AAChD,aAAO,2BAAa,KAAK,EAAE,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;AAAA,IACnE;AAEA,UAAM,cAAc,QAAQ,QAAQ,IAAI,OAAO,YAAY,WAAW,GAAG;AACzE,UAAM,eAAe,QAAQ,QAAQ,IAAI,OAAO,YAAY,YAAY,GAAG;AAE3E,QAAI,CAAC,eAAe,CAAC,cAAc;AACjC,aAAO,iBAAiB,SAAS,MAAM;AAAA,IACzC;AAEA,UAAM,YAAY,aAAa,OAAO,SAAS,OAAO,cAAc;AACpE,UAAM,kBAAc,+BAAkB;AAAA,MACpC,SAAS,OAAO;AAAA,MAChB;AAAA,MACA,sBAAsB;AAAA,MACtB;AAAA,MACA,iBAAiB;AAAA,IACnB,CAAC;AAED,QAAI,SAA6B;AACjC,QAAI,aAAa;AACf,UAAI;AACF,iBAAS,MAAM,YAAY,WAAW;AAAA,MACxC,SAAS,KAAK;AACZ,YAAI,0BAAc,WAAW,GAAG,KAAK,IAAI,SAAS,iBAAiB;AAGjE,iBAAO,wBAAwB,SAAS,MAAM;AAAA,QAChD;AACA,iBAAS;AAAA,MACX;AAAA,IACF;AAEA,QAAI,CAAC,UAAU,cAAc;AAC3B,YAAM,gBAAgB,MAAM,eAAe,cAAc,MAAM;AAE/D,UAAI,aAAa,eAAe;AAC9B,eAAO,wBAAwB,SAAS,QAAQ,cAAc,gBAAgB;AAAA,MAChF;AAEA,eAAS,MAAM,YAAY,cAAc,WAAW;AACpD,YAAM,WAAW,gBAAgB,gBAAgB,MAAM;AACvD,iBAAW,cAAU;AAAA,QACnB;AAAA,UACE,aAAa,cAAc;AAAA,UAC3B,GAAI,cAAc,eAAe,EAAE,cAAc,cAAc,aAAa,IAAI,CAAC;AAAA,UACjF,WAAW,cAAc;AAAA,QAC3B;AAAA,QACA,OAAO;AAAA,QACP,OAAO;AAAA,MACT,GAAG;AACD,iBAAS,QAAQ,IAAI,OAAO,MAAM,OAAO,OAAO,OAAO,OAAO;AAAA,MAChE;AACA,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,QAAQ;AACX,aAAO,iBAAiB,SAAS,MAAM;AAAA,IACzC;AAEA,WAAO,gBAAgB,gBAAgB,MAAM;AAAA,EAC/C;AACF;AAEA,IAAI,4BAAwE;AAM5E,eAAO,WAAkC,SAA6C;AACpF,MAAI,CAAC,2BAA2B;AAC9B,gCAA4B,iBAAiB;AAAA,EAC/C;AACA,SAAO,0BAA0B,OAAO;AAC1C;","names":["middleware"]}

package/dist/middleware.d.cts

@@ -0,0 +1,20 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+interface MiddlewareConfig {
+    baseUrl?: string;
+    clientId?: string;
+    publicRoutes?: string[];
+    signInUrl?: string;
+    afterSignInUrl?: string;
+    cookiePrefix?: string;
+    cookieDomain?: string;
+    cookieOptions?: {
+        secure?: boolean;
+        sameSite?: "lax" | "strict" | "none";
+    };
+    jwksCacheTtlMs?: number;
+}
+declare function createMiddleware(options?: MiddlewareConfig): (request: NextRequest) => Promise<NextResponse>;
+declare function middleware(request: NextRequest): Promise<NextResponse>;
+
+export { type MiddlewareConfig, createMiddleware, middleware as default };

package/dist/middleware.d.ts

@@ -0,0 +1,20 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+interface MiddlewareConfig {
+    baseUrl?: string;
+    clientId?: string;
+    publicRoutes?: string[];
+    signInUrl?: string;
+    afterSignInUrl?: string;
+    cookiePrefix?: string;
+    cookieDomain?: string;
+    cookieOptions?: {
+        secure?: boolean;
+        sameSite?: "lax" | "strict" | "none";
+    };
+    jwksCacheTtlMs?: number;
+}
+declare function createMiddleware(options?: MiddlewareConfig): (request: NextRequest) => Promise<NextResponse>;
+declare function middleware(request: NextRequest): Promise<NextResponse>;
+
+export { type MiddlewareConfig, createMiddleware, middleware as default };