@merit-systems/echo-next-sdk 0.0.1

package/README.md

@@ -0,0 +1,34 @@
+# Echo TypeScript SDK
+
+The official TypeScript SDK for the Echo platform, providing easy access to Echo APIs and a command-line interface for managing your Echo applications.
+
+## Installation
+
+```bash
+pnpm install @merit-systems/echo-typescript-sdk
+```
+
+## Programmatic Usage
+
+```typescript
+import { EchoClient } from '@merit-systems/echo-typescript-sdk';
+
+// Initialize with API key
+const client = new EchoClient({
+  apiKey: 'echo_your_api_key_here',
+});
+
+// Or use stored credentials from CLI
+const client = new EchoClient();
+
+// Get account balance
+const balance = await client.getBalance();
+console.log(`Balance: $${balance.balance}`);
+
+// Create a payment link
+const paymentResponse = await client.createPaymentLink({
+  amount: 10.0, // $10.00
+  description: 'Credits for my account',
+});
+console.log('Payment URL:', paymentResponse.paymentLink.url);
+```

package/dist/client.d.ts

@@ -0,0 +1,10 @@
+interface EchoClientConfig {
+    basePath?: string;
+}
+/**
+ * Sign in to Echo (client-side only)
+ */
+declare function signIn(config?: EchoClientConfig): void;
+declare function refreshToken(config?: EchoClientConfig): void;
+
+export { type EchoClientConfig, refreshToken, signIn };

package/dist/client.js

@@ -0,0 +1,22 @@
+// src/client.ts
+function signIn(config) {
+  if (typeof window === "undefined") {
+    console.warn("signIn() can only be called in client components");
+    return;
+  }
+  const basePath = config?.basePath || "/api/echo";
+  window.location.href = `${window.location.origin}${basePath}/signin`;
+}
+function refreshToken(config) {
+  if (typeof window === "undefined") {
+    console.warn("refreshToken() can only be called in client components");
+    return;
+  }
+  const basePath = config?.basePath || "/api/echo";
+  window.location.href = `${window.location.origin}${basePath}/refresh`;
+}
+export {
+  refreshToken,
+  signIn
+};
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client.ts"],"sourcesContent":["export interface EchoClientConfig {\n  basePath?: string;\n}\n\n/**\n * Sign in to Echo (client-side only)\n */\nexport function signIn(config?: EchoClientConfig) {\n  if (typeof window === 'undefined') {\n    console.warn('signIn() can only be called in client components');\n    return;\n  }\n\n  const basePath = config?.basePath || '/api/echo';\n  window.location.href = `${window.location.origin}${basePath}/signin`;\n}\n\nexport function refreshToken(config?: EchoClientConfig) {\n  if (typeof window === 'undefined') {\n    console.warn('refreshToken() can only be called in client components');\n    return;\n  }\n\n  const basePath = config?.basePath || '/api/echo';\n  window.location.href = `${window.location.origin}${basePath}/refresh`;\n}\n"],"mappings":";AAOO,SAAS,OAAO,QAA2B;AAChD,MAAI,OAAO,WAAW,aAAa;AACjC,YAAQ,KAAK,kDAAkD;AAC/D;AAAA,EACF;AAEA,QAAM,WAAW,QAAQ,YAAY;AACrC,SAAO,SAAS,OAAO,GAAG,OAAO,SAAS,MAAM,GAAG,QAAQ;AAC7D;AAEO,SAAS,aAAa,QAA2B;AACtD,MAAI,OAAO,WAAW,aAAa;AACjC,YAAQ,KAAK,wDAAwD;AACrE;AAAA,EACF;AAEA,QAAM,WAAW,QAAQ,YAAY;AACrC,SAAO,SAAS,OAAO,GAAG,OAAO,SAAS,MAAM,GAAG,QAAQ;AAC7D;","names":[]}

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+import { User, EchoOpenAIProvider, EchoAnthropicProvider } from '@merit-systems/echo-typescript-sdk';
+import { NextRequest } from 'next/server';
+
+interface EchoConfig {
+    appId: string;
+    basePath?: string;
+    baseRouterUrl?: string;
+}
+type AppRouteHandlers = Record<'GET' | 'POST', (req: NextRequest) => Promise<Response>>;
+type EchoResult = {
+    handlers: AppRouteHandlers;
+    getUser: () => Promise<User | null>;
+    isSignedIn: () => Promise<boolean>;
+    openai: EchoOpenAIProvider;
+    anthropic: EchoAnthropicProvider;
+};
+
+/**
+ * Echo SDK for Next.js
+ * Provides OAuth authentication and token management for Echo API integration
+ */
+declare function Echo(config: EchoConfig): EchoResult;
+
+export { Echo as default };

package/dist/index.js

@@ -0,0 +1,306 @@
+// src/index.ts
+import { NextResponse as NextResponse2 } from "next/server";
+
+// src/auth/token-manager.ts
+import {
+  EchoClient,
+  ECHO_BASE_URL
+} from "@merit-systems/echo-typescript-sdk";
+import { cookies as getCookies } from "next/headers";
+
+// src/auth/jwt-utils.ts
+import { jwtDecode } from "jwt-decode";
+function shouldRefreshToken(token) {
+  try {
+    const decoded = jwtDecode(token);
+    if (!decoded.exp) return true;
+    const now = Math.floor(Date.now() / 1e3);
+    const bufferTime = 30;
+    return decoded.exp <= now + bufferTime;
+  } catch {
+    return true;
+  }
+}
+
+// src/auth/token-manager.ts
+async function performTokenRefresh(refreshToken, appId) {
+  return fetch(`${ECHO_BASE_URL}/api/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: appId
+    })
+  }).then(async (r) => {
+    if (r.ok) {
+      const tokenData = await r.json();
+      return tokenData;
+    }
+    return Promise.reject(new Error(await r.text()));
+  });
+}
+async function getEchoToken(appId) {
+  const cookies2 = await getCookies();
+  const accessToken = cookies2.get("echo_access_token")?.value;
+  if (!accessToken || shouldRefreshToken(accessToken)) {
+    const refreshToken = cookies2.get("echo_refresh_token")?.value;
+    if (!refreshToken) {
+      console.log("No refresh token found");
+      return null;
+    }
+    try {
+      const refreshResult = await performTokenRefresh(refreshToken, appId);
+      cookies2.set("echo_access_token", refreshResult.access_token, {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === "production",
+        sameSite: "lax",
+        maxAge: refreshResult.expires_in,
+        path: "/"
+      });
+      cookies2.set("echo_refresh_token", refreshResult.refresh_token, {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === "production",
+        sameSite: "lax",
+        maxAge: refreshResult.refresh_token_expires_in,
+        path: "/"
+      });
+      cookies2.set(
+        "echo_refresh_token_expires",
+        String(
+          Math.floor(Date.now() / 1e3) + refreshResult.refresh_token_expires_in
+        ),
+        {
+          httpOnly: true,
+          secure: process.env.NODE_ENV === "production",
+          sameSite: "lax",
+          maxAge: refreshResult.refresh_token_expires_in,
+          path: "/"
+        }
+      );
+      return refreshResult.access_token;
+    } catch (error) {
+      console.error("Token refresh failed:", refreshToken, error);
+      return null;
+    }
+  }
+  return accessToken;
+}
+
+// src/providers/anthropic.ts
+import {
+  createEchoAnthropic as createEchoAnthropicBase,
+  ROUTER_BASE_URL
+} from "@merit-systems/echo-typescript-sdk";
+function createEchoAnthropic({
+  appId,
+  baseRouterUrl = ROUTER_BASE_URL
+}) {
+  return createEchoAnthropicBase(
+    { appId, baseRouterUrl },
+    async () => getEchoToken(appId)
+  );
+}
+
+// src/auth/oauth-handlers.ts
+import { NextResponse } from "next/server";
+import { ECHO_BASE_URL as ECHO_BASE_URL2 } from "@merit-systems/echo-typescript-sdk";
+async function generateCodeChallenge() {
+  const codeVerifier = Array.from(crypto.getRandomValues(new Uint8Array(32))).map((b) => b.toString(16).padStart(2, "0")).join("");
+  const encoder = new TextEncoder();
+  const codeChallengeBuffer = await crypto.subtle.digest(
+    "SHA-256",
+    encoder.encode(codeVerifier)
+  );
+  const codeChallenge = btoa(
+    String.fromCharCode(...new Uint8Array(codeChallengeBuffer))
+  ).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  return { codeVerifier, codeChallenge };
+}
+async function handleSignIn(req, config) {
+  const { origin } = req.nextUrl;
+  const basePath = config.basePath || "/api/echo";
+  const redirectUrl = new URL(`${ECHO_BASE_URL2}/api/oauth/authorize`);
+  redirectUrl.searchParams.set("client_id", config.appId);
+  redirectUrl.searchParams.set("redirect_uri", `${origin}${basePath}/callback`);
+  redirectUrl.searchParams.set("response_type", "code");
+  const { codeVerifier, codeChallenge } = await generateCodeChallenge();
+  redirectUrl.searchParams.set("code_challenge", codeChallenge);
+  redirectUrl.searchParams.set("code_challenge_method", "S256");
+  const response = NextResponse.redirect(redirectUrl.toString());
+  response.cookies.set("echo_code_verifier", codeVerifier, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    maxAge: 300,
+    // 5 minutes - same as auth code TTL
+    path: "/"
+  });
+  return response;
+}
+async function handleCallback(req, config) {
+  const { origin } = req.nextUrl;
+  const basePath = config.basePath || "/api/echo";
+  const code = req.nextUrl.searchParams.get("code");
+  const state = req.nextUrl.searchParams.get("state");
+  if (!code || !state) {
+    return NextResponse.json({ error: "Invalid request" }, { status: 400 });
+  }
+  const codeVerifier = req.cookies.get("echo_code_verifier")?.value;
+  if (!codeVerifier) {
+    return NextResponse.json(
+      { error: "Code verifier not found. Please try signing in again." },
+      { status: 400 }
+    );
+  }
+  const tokenEndpoint = `${ECHO_BASE_URL2}/api/oauth/token`;
+  const params = new URLSearchParams();
+  params.set("grant_type", "authorization_code");
+  params.set("code", code);
+  params.set("redirect_uri", `${origin}${basePath}/callback`);
+  params.set("client_id", config.appId);
+  params.set("code_verifier", codeVerifier);
+  const tokenResponse = await fetch(tokenEndpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: params.toString()
+  });
+  if (!tokenResponse.ok) {
+    return NextResponse.json(
+      { error: "Token exchange failed" },
+      { status: 500 }
+    );
+  }
+  const tokenData = await tokenResponse.json();
+  const response = NextResponse.redirect(`${origin}`);
+  response.cookies.set("echo_code_verifier", "", {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    maxAge: 0,
+    // Expire immediately
+    path: "/"
+  });
+  response.cookies.set("echo_access_token", tokenData.access_token, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    maxAge: tokenData.expires_in,
+    // expires_in is typically in seconds
+    path: "/"
+  });
+  tokenData.refresh_token_expires_in;
+  response.cookies.set("echo_refresh_token", tokenData.refresh_token, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    maxAge: tokenData.refresh_token_expires_in,
+    path: "/"
+  });
+  response.cookies.set(
+    "echo_refresh_token_expires",
+    String(Math.floor(Date.now() / 1e3) + tokenData.refresh_token_expires_in),
+    {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === "production",
+      sameSite: "lax",
+      maxAge: tokenData.refresh_token_expires_in,
+      path: "/"
+    }
+  );
+  return response;
+}
+async function handleRefresh(req, config) {
+  try {
+    const token = await getEchoToken(config.appId);
+    if (!token) {
+      return NextResponse.json({ error: "No token found" }, { status: 401 });
+    }
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    console.error("Error refreshing token:", error);
+    return NextResponse.json(
+      { error: "Error refreshing token" },
+      { status: 500 }
+    );
+  }
+}
+
+// src/providers/openai.ts
+import {
+  createEchoOpenAI as createEchoOpenAIBase,
+  ROUTER_BASE_URL as ROUTER_BASE_URL2
+} from "@merit-systems/echo-typescript-sdk";
+function createEchoOpenAI({
+  appId,
+  baseRouterUrl = ROUTER_BASE_URL2
+}) {
+  return createEchoOpenAIBase(
+    { appId, baseRouterUrl },
+    async () => getEchoToken(appId)
+  );
+}
+
+// src/index.ts
+import { EchoClient as EchoClient2, ECHO_BASE_URL as ECHO_BASE_URL3 } from "@merit-systems/echo-typescript-sdk";
+import { cookies } from "next/headers";
+function Echo(config) {
+  const httpHandler = async (req) => {
+    const { pathname } = req.nextUrl;
+    const basePath = config.basePath || "/api/echo";
+    const path = pathname.replace(basePath, "");
+    switch (path) {
+      case "/signin":
+        return handleSignIn(req, config);
+      case "/callback":
+        return handleCallback(req, config);
+      case "/refresh":
+        return handleRefresh(req, config);
+      default:
+        return NextResponse2.error();
+    }
+  };
+  const getUser = async () => {
+    const cookieStore = await cookies();
+    const accessToken = cookieStore.get("echo_access_token")?.value;
+    if (!accessToken) {
+      return null;
+    }
+    const echo = new EchoClient2({
+      apiKey: accessToken,
+      baseUrl: ECHO_BASE_URL3
+    });
+    const user = await echo.users.getUserInfo();
+    return user;
+  };
+  const isSignedIn = async () => {
+    const cookieStore = await cookies();
+    const refreshTokenExpiry = cookieStore.get(
+      "echo_refresh_token_expires"
+    )?.value;
+    if (!refreshTokenExpiry) {
+      return false;
+    }
+    const expiryTime = parseInt(refreshTokenExpiry);
+    const now = Math.floor(Date.now() / 1e3);
+    return expiryTime > now;
+  };
+  return {
+    handlers: {
+      GET: httpHandler,
+      POST: httpHandler
+    },
+    // echo auth
+    getUser,
+    isSignedIn,
+    // providers
+    openai: createEchoOpenAI(config),
+    anthropic: createEchoAnthropic(config)
+  };
+}
+export {
+  Echo as default
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/auth/token-manager.ts","../src/auth/jwt-utils.ts","../src/providers/anthropic.ts","../src/auth/oauth-handlers.ts","../src/providers/openai.ts"],"sourcesContent":["import { NextRequest, NextResponse } from 'next/server';\nimport { createEchoAnthropic } from 'providers/anthropic';\nimport {\n  handleCallback,\n  handleRefresh,\n  handleSignIn,\n} from './auth/oauth-handlers';\nimport { createEchoOpenAI } from './providers/openai';\nimport { EchoConfig, EchoResult } from './types';\nimport { EchoClient, ECHO_BASE_URL } from '@merit-systems/echo-typescript-sdk';\nimport { cookies } from 'next/headers';\n\n/**\n * Echo SDK for Next.js\n * Provides OAuth authentication and token management for Echo API integration\n */\nexport default function Echo(config: EchoConfig): EchoResult {\n  /**\n   * HTTP handler for OAuth routes (signin and callback)\n   */\n  const httpHandler = async (req: NextRequest): Promise<Response> => {\n    const { pathname } = req.nextUrl;\n    const basePath = config.basePath || '/api/echo';\n    const path = pathname.replace(basePath, '');\n\n    switch (path) {\n      case '/signin':\n        return handleSignIn(req, config);\n\n      case '/callback':\n        return handleCallback(req, config);\n\n      case '/refresh':\n        return handleRefresh(req, config);\n\n      default:\n        return NextResponse.error();\n    }\n  };\n\n  /**\n   * Get current user info with automatic token refresh\n   */\n  const getUser = async () => {\n    // read only access token, if expired we are fucked\n    const cookieStore = await cookies();\n    const accessToken = cookieStore.get('echo_access_token')?.value;\n    if (!accessToken) {\n      return null;\n    }\n    const echo = new EchoClient({\n      apiKey: accessToken,\n      baseUrl: ECHO_BASE_URL,\n    });\n    const user = await echo.users.getUserInfo();\n    return user;\n  };\n\n  const isSignedIn = async () => {\n    const cookieStore = await cookies();\n    const refreshTokenExpiry = cookieStore.get(\n      'echo_refresh_token_expires'\n    )?.value;\n\n    if (!refreshTokenExpiry) {\n      return false; // No expiry stored\n    }\n\n    const expiryTime = parseInt(refreshTokenExpiry);\n    const now = Math.floor(Date.now() / 1000);\n\n    return expiryTime > now; // True if not expired\n  };\n\n  return {\n    handlers: {\n      GET: httpHandler,\n      POST: httpHandler,\n    },\n    // echo auth\n    getUser,\n    isSignedIn,\n    // providers\n    openai: createEchoOpenAI(config),\n    anthropic: createEchoAnthropic(config),\n  };\n}\n","import {\n  EchoClient,\n  ECHO_BASE_URL,\n  User,\n} from '@merit-systems/echo-typescript-sdk';\nimport { cookies as getCookies } from 'next/headers';\nimport { shouldRefreshToken } from './jwt-utils';\n\nexport interface RefreshTokenResponse {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  refresh_token_expires_in: number;\n  scope: string;\n  user: {\n    id: string;\n    email: string;\n    name: string;\n  };\n  echo_app: {\n    id: string;\n    name: string;\n    description: string;\n  };\n}\n\n/**\n * Refresh an access token using a refresh token\n * @param refreshToken - The refresh token to use\n * @param appId - The Echo app ID\n * @returns Promise resolving to the new token data\n */\nexport async function performTokenRefresh(\n  refreshToken: string,\n  appId: string\n): Promise<RefreshTokenResponse> {\n  return fetch(`${ECHO_BASE_URL}/api/oauth/token`, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      grant_type: 'refresh_token',\n      refresh_token: refreshToken,\n      client_id: appId,\n    }),\n  }).then(async r => {\n    if (r.ok) {\n      const tokenData = (await r.json()) as RefreshTokenResponse;\n      return tokenData;\n    }\n    return Promise.reject(new Error(await r.text()));\n  });\n}\n\n/**\n * Get a valid Echo token, refreshing if necessary\n * @param appId - The Echo app ID for token refresh\n * @returns Promise resolving to a valid access token or null if authentication failed\n */\nexport async function getEchoToken(appId: string): Promise<string | null> {\n  const cookies = await getCookies();\n  const accessToken = cookies.get('echo_access_token')?.value;\n\n  // Check if token needs refresh\n  if (!accessToken || shouldRefreshToken(accessToken)) {\n    const refreshToken = cookies.get('echo_refresh_token')?.value;\n\n    if (!refreshToken) {\n      console.log('No refresh token found');\n      return null;\n    }\n\n    try {\n      const refreshResult = await performTokenRefresh(refreshToken, appId);\n\n      // Set new tokens in cookies\n      cookies.set('echo_access_token', refreshResult.access_token, {\n        httpOnly: true,\n        secure: process.env.NODE_ENV === 'production',\n        sameSite: 'lax',\n        maxAge: refreshResult.expires_in,\n        path: '/',\n      });\n\n      cookies.set('echo_refresh_token', refreshResult.refresh_token, {\n        httpOnly: true,\n        secure: process.env.NODE_ENV === 'production',\n        sameSite: 'lax',\n        maxAge: refreshResult.refresh_token_expires_in,\n        path: '/',\n      });\n\n      // Store refresh token expiry time for checking\n      cookies.set(\n        'echo_refresh_token_expires',\n        String(\n          Math.floor(Date.now() / 1000) + refreshResult.refresh_token_expires_in\n        ),\n        {\n          httpOnly: true,\n          secure: process.env.NODE_ENV === 'production',\n          sameSite: 'lax',\n          maxAge: refreshResult.refresh_token_expires_in,\n          path: '/',\n        }\n      );\n\n      return refreshResult.access_token;\n    } catch (error) {\n      console.error('Token refresh failed:', refreshToken, error);\n      return null;\n    }\n  }\n\n  return accessToken;\n}\n\nexport async function getUser(appId: string): Promise<User> {\n  const echo = await getEchoClient(appId);\n  if (!echo) {\n    throw new Error('User not signed in');\n  }\n  return echo.users.getUserInfo();\n}\n\nexport async function getEchoClient(appId: string): Promise<EchoClient | null> {\n  const token = await getEchoToken(appId);\n  if (!token) {\n    return null;\n  }\n  return new EchoClient({\n    baseUrl: ECHO_BASE_URL,\n    apiKey: token,\n  });\n}\n","import { jwtDecode } from 'jwt-decode';\n\ninterface JwtPayload {\n  exp?: number;\n}\n\n/**\n * Check if a JWT token needs to be refreshed\n * @param token - The JWT access token to check\n * @returns true if token should be refreshed, false otherwise\n */\nexport function shouldRefreshToken(token: string): boolean {\n  try {\n    const decoded = jwtDecode<JwtPayload>(token);\n    if (!decoded.exp) return true;\n\n    const now = Math.floor(Date.now() / 1000);\n    // Refresh if token expires within 30 seconds\n    const bufferTime = 30;\n    return decoded.exp <= now + bufferTime;\n  } catch {\n    return true; // If we can't decode, assume it needs refresh\n  }\n}\n","import { getEchoToken } from '../auth/token-manager';\nimport {\n  createEchoAnthropic as createEchoAnthropicBase,\n  EchoAnthropicProvider,\n  EchoConfig,\n  ROUTER_BASE_URL,\n} from '@merit-systems/echo-typescript-sdk';\n\nexport function createEchoAnthropic({\n  appId,\n  baseRouterUrl = ROUTER_BASE_URL,\n}: EchoConfig): EchoAnthropicProvider {\n  return createEchoAnthropicBase({ appId, baseRouterUrl }, async () =>\n    getEchoToken(appId)\n  );\n}\n","import { NextRequest, NextResponse } from 'next/server';\nimport { getEchoToken, RefreshTokenResponse } from './token-manager';\nimport { EchoConfig, ECHO_BASE_URL } from '@merit-systems/echo-typescript-sdk';\n\n/**\n * Generate PKCE code challenge and verifier\n * @returns Object containing code verifier and challenge\n */\nasync function generateCodeChallenge(): Promise<{\n  codeVerifier: string;\n  codeChallenge: string;\n}> {\n  const codeVerifier = Array.from(crypto.getRandomValues(new Uint8Array(32)))\n    .map(b => b.toString(16).padStart(2, '0'))\n    .join('');\n\n  const encoder = new TextEncoder();\n  const codeChallengeBuffer = await crypto.subtle.digest(\n    'SHA-256',\n    encoder.encode(codeVerifier)\n  );\n\n  const codeChallenge = btoa(\n    String.fromCharCode(...new Uint8Array(codeChallengeBuffer))\n  )\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n\n  return { codeVerifier, codeChallenge };\n}\n\n/**\n * Handle OAuth signin request - redirect to Echo authorization server\n * @param req - The incoming Next.js request\n * @param config - Echo configuration\n * @returns NextResponse with redirect to authorization server\n */\nexport async function handleSignIn(\n  req: NextRequest,\n  config: EchoConfig\n): Promise<NextResponse> {\n  const { origin } = req.nextUrl;\n  const basePath = config.basePath || '/api/echo';\n\n  const redirectUrl = new URL(`${ECHO_BASE_URL}/api/oauth/authorize`);\n  redirectUrl.searchParams.set('client_id', config.appId);\n  redirectUrl.searchParams.set('redirect_uri', `${origin}${basePath}/callback`);\n  redirectUrl.searchParams.set('response_type', 'code');\n\n  const { codeVerifier, codeChallenge } = await generateCodeChallenge();\n\n  redirectUrl.searchParams.set('code_challenge', codeChallenge);\n  redirectUrl.searchParams.set('code_challenge_method', 'S256');\n\n  // Create response with redirect and set cookie for code verifier\n  const response = NextResponse.redirect(redirectUrl.toString());\n\n  // Set the code verifier in a secure cookie that will be available during callback\n  response.cookies.set('echo_code_verifier', codeVerifier, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    maxAge: 300, // 5 minutes - same as auth code TTL\n    path: '/',\n  });\n\n  return response;\n}\n\n/**\n * Handle OAuth callback - exchange authorization code for tokens\n * @param req - The incoming Next.js request\n * @param config - Echo configuration\n * @returns NextResponse with redirect to home page and tokens set as cookies\n */\nexport async function handleCallback(\n  req: NextRequest,\n  config: EchoConfig\n): Promise<NextResponse> {\n  const { origin } = req.nextUrl;\n  const basePath = config.basePath || '/api/echo';\n\n  const code = req.nextUrl.searchParams.get('code');\n  const state = req.nextUrl.searchParams.get('state');\n\n  if (!code || !state) {\n    return NextResponse.json({ error: 'Invalid request' }, { status: 400 });\n  }\n\n  // Retrieve the code verifier from the cookie\n  const codeVerifier = req.cookies.get('echo_code_verifier')?.value;\n\n  if (!codeVerifier) {\n    return NextResponse.json(\n      { error: 'Code verifier not found. Please try signing in again.' },\n      { status: 400 }\n    );\n  }\n\n  // Exchange the code for a token from the token endpoint\n  const tokenEndpoint = `${ECHO_BASE_URL}/api/oauth/token`;\n\n  const params = new URLSearchParams();\n  params.set('grant_type', 'authorization_code');\n  params.set('code', code);\n  params.set('redirect_uri', `${origin}${basePath}/callback`);\n  params.set('client_id', config.appId);\n  params.set('code_verifier', codeVerifier);\n\n  const tokenResponse = await fetch(tokenEndpoint, {\n    method: 'POST',\n    headers: {\n      'Content-Type': 'application/x-www-form-urlencoded',\n    },\n    body: params.toString(),\n  });\n\n  if (!tokenResponse.ok) {\n    return NextResponse.json(\n      { error: 'Token exchange failed' },\n      { status: 500 }\n    );\n  }\n\n  const tokenData = (await tokenResponse.json()) as RefreshTokenResponse;\n\n  const response = NextResponse.redirect(`${origin}`);\n\n  // Clear the code verifier cookie after successful token exchange\n  response.cookies.set('echo_code_verifier', '', {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    maxAge: 0, // Expire immediately\n    path: '/',\n  });\n\n  // Set the access token as a cookie\n  response.cookies.set('echo_access_token', tokenData.access_token, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    maxAge: tokenData.expires_in, // expires_in is typically in seconds\n    path: '/',\n  });\n\n  tokenData.refresh_token_expires_in;\n\n  response.cookies.set('echo_refresh_token', tokenData.refresh_token, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    maxAge: tokenData.refresh_token_expires_in,\n    path: '/',\n  });\n\n  // Store refresh token expiry time for checking\n  response.cookies.set(\n    'echo_refresh_token_expires',\n    String(Math.floor(Date.now() / 1000) + tokenData.refresh_token_expires_in),\n    {\n      httpOnly: true,\n      secure: process.env.NODE_ENV === 'production',\n      sameSite: 'lax',\n      maxAge: tokenData.refresh_token_expires_in,\n      path: '/',\n    }\n  );\n\n  return response;\n}\n\nexport async function handleRefresh(\n  req: NextRequest,\n  config: EchoConfig\n): Promise<NextResponse> {\n  try {\n    const token = await getEchoToken(config.appId);\n    if (!token) {\n      return NextResponse.json({ error: 'No token found' }, { status: 401 });\n    }\n\n    return NextResponse.json({ success: true });\n  } catch (error) {\n    console.error('Error refreshing token:', error);\n    return NextResponse.json(\n      { error: 'Error refreshing token' },\n      { status: 500 }\n    );\n  }\n}\n","import { getEchoToken } from '../auth/token-manager';\nimport {\n  createEchoOpenAI as createEchoOpenAIBase,\n  EchoConfig,\n  EchoOpenAIProvider,\n  ROUTER_BASE_URL,\n} from '@merit-systems/echo-typescript-sdk';\n\nexport function createEchoOpenAI({\n  appId,\n  baseRouterUrl = ROUTER_BASE_URL,\n}: EchoConfig): EchoOpenAIProvider {\n  return createEchoOpenAIBase({ appId, baseRouterUrl }, async () =>\n    getEchoToken(appId)\n  );\n}\n"],"mappings":";AAAA,SAAsB,gBAAAA,qBAAoB;;;ACA1C;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,WAAW,kBAAkB;;;ACLtC,SAAS,iBAAiB;AAWnB,SAAS,mBAAmB,OAAwB;AACzD,MAAI;AACF,UAAM,UAAU,UAAsB,KAAK;AAC3C,QAAI,CAAC,QAAQ,IAAK,QAAO;AAEzB,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAExC,UAAM,aAAa;AACnB,WAAO,QAAQ,OAAO,MAAM;AAAA,EAC9B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ADUA,eAAsB,oBACpB,cACA,OAC+B;AAC/B,SAAO,MAAM,GAAG,aAAa,oBAAoB;AAAA,IAC/C,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU;AAAA,MACnB,YAAY;AAAA,MACZ,eAAe;AAAA,MACf,WAAW;AAAA,IACb,CAAC;AAAA,EACH,CAAC,EAAE,KAAK,OAAM,MAAK;AACjB,QAAI,EAAE,IAAI;AACR,YAAM,YAAa,MAAM,EAAE,KAAK;AAChC,aAAO;AAAA,IACT;AACA,WAAO,QAAQ,OAAO,IAAI,MAAM,MAAM,EAAE,KAAK,CAAC,CAAC;AAAA,EACjD,CAAC;AACH;AAOA,eAAsB,aAAa,OAAuC;AACxE,QAAMC,WAAU,MAAM,WAAW;AACjC,QAAM,cAAcA,SAAQ,IAAI,mBAAmB,GAAG;AAGtD,MAAI,CAAC,eAAe,mBAAmB,WAAW,GAAG;AACnD,UAAM,eAAeA,SAAQ,IAAI,oBAAoB,GAAG;AAExD,QAAI,CAAC,cAAc;AACjB,cAAQ,IAAI,wBAAwB;AACpC,aAAO;AAAA,IACT;AAEA,QAAI;AACF,YAAM,gBAAgB,MAAM,oBAAoB,cAAc,KAAK;AAGnE,MAAAA,SAAQ,IAAI,qBAAqB,cAAc,cAAc;AAAA,QAC3D,UAAU;AAAA,QACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,QACjC,UAAU;AAAA,QACV,QAAQ,cAAc;AAAA,QACtB,MAAM;AAAA,MACR,CAAC;AAED,MAAAA,SAAQ,IAAI,sBAAsB,cAAc,eAAe;AAAA,QAC7D,UAAU;AAAA,QACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,QACjC,UAAU;AAAA,QACV,QAAQ,cAAc;AAAA,QACtB,MAAM;AAAA,MACR,CAAC;AAGD,MAAAA,SAAQ;AAAA,QACN;AAAA,QACA;AAAA,UACE,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,cAAc;AAAA,QAChD;AAAA,QACA;AAAA,UACE,UAAU;AAAA,UACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,UACjC,UAAU;AAAA,UACV,QAAQ,cAAc;AAAA,UACtB,MAAM;AAAA,QACR;AAAA,MACF;AAEA,aAAO,cAAc;AAAA,IACvB,SAAS,OAAO;AACd,cAAQ,MAAM,yBAAyB,cAAc,KAAK;AAC1D,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;;;AElHA;AAAA,EACE,uBAAuB;AAAA,EAGvB;AAAA,OACK;AAEA,SAAS,oBAAoB;AAAA,EAClC;AAAA,EACA,gBAAgB;AAClB,GAAsC;AACpC,SAAO;AAAA,IAAwB,EAAE,OAAO,cAAc;AAAA,IAAG,YACvD,aAAa,KAAK;AAAA,EACpB;AACF;;;ACfA,SAAsB,oBAAoB;AAE1C,SAAqB,iBAAAC,sBAAqB;AAM1C,eAAe,wBAGZ;AACD,QAAM,eAAe,MAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,CAAC,EACvE,IAAI,OAAK,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EACxC,KAAK,EAAE;AAEV,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,sBAAsB,MAAM,OAAO,OAAO;AAAA,IAC9C;AAAA,IACA,QAAQ,OAAO,YAAY;AAAA,EAC7B;AAEA,QAAM,gBAAgB;AAAA,IACpB,OAAO,aAAa,GAAG,IAAI,WAAW,mBAAmB,CAAC;AAAA,EAC5D,EACG,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AAEpB,SAAO,EAAE,cAAc,cAAc;AACvC;AAQA,eAAsB,aACpB,KACA,QACuB;AACvB,QAAM,EAAE,OAAO,IAAI,IAAI;AACvB,QAAM,WAAW,OAAO,YAAY;AAEpC,QAAM,cAAc,IAAI,IAAI,GAAGA,cAAa,sBAAsB;AAClE,cAAY,aAAa,IAAI,aAAa,OAAO,KAAK;AACtD,cAAY,aAAa,IAAI,gBAAgB,GAAG,MAAM,GAAG,QAAQ,WAAW;AAC5E,cAAY,aAAa,IAAI,iBAAiB,MAAM;AAEpD,QAAM,EAAE,cAAc,cAAc,IAAI,MAAM,sBAAsB;AAEpE,cAAY,aAAa,IAAI,kBAAkB,aAAa;AAC5D,cAAY,aAAa,IAAI,yBAAyB,MAAM;AAG5D,QAAM,WAAW,aAAa,SAAS,YAAY,SAAS,CAAC;AAG7D,WAAS,QAAQ,IAAI,sBAAsB,cAAc;AAAA,IACvD,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,QAAQ;AAAA;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AAED,SAAO;AACT;AAQA,eAAsB,eACpB,KACA,QACuB;AACvB,QAAM,EAAE,OAAO,IAAI,IAAI;AACvB,QAAM,WAAW,OAAO,YAAY;AAEpC,QAAM,OAAO,IAAI,QAAQ,aAAa,IAAI,MAAM;AAChD,QAAM,QAAQ,IAAI,QAAQ,aAAa,IAAI,OAAO;AAElD,MAAI,CAAC,QAAQ,CAAC,OAAO;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAGA,QAAM,eAAe,IAAI,QAAQ,IAAI,oBAAoB,GAAG;AAE5D,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,wDAAwD;AAAA,MACjE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAGA,QAAM,gBAAgB,GAAGA,cAAa;AAEtC,QAAM,SAAS,IAAI,gBAAgB;AACnC,SAAO,IAAI,cAAc,oBAAoB;AAC7C,SAAO,IAAI,QAAQ,IAAI;AACvB,SAAO,IAAI,gBAAgB,GAAG,MAAM,GAAG,QAAQ,WAAW;AAC1D,SAAO,IAAI,aAAa,OAAO,KAAK;AACpC,SAAO,IAAI,iBAAiB,YAAY;AAExC,QAAM,gBAAgB,MAAM,MAAM,eAAe;AAAA,IAC/C,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,OAAO,SAAS;AAAA,EACxB,CAAC;AAED,MAAI,CAAC,cAAc,IAAI;AACrB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,wBAAwB;AAAA,MACjC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAa,MAAM,cAAc,KAAK;AAE5C,QAAM,WAAW,aAAa,SAAS,GAAG,MAAM,EAAE;AAGlD,WAAS,QAAQ,IAAI,sBAAsB,IAAI;AAAA,IAC7C,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,QAAQ;AAAA;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AAGD,WAAS,QAAQ,IAAI,qBAAqB,UAAU,cAAc;AAAA,IAChE,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,QAAQ,UAAU;AAAA;AAAA,IAClB,MAAM;AAAA,EACR,CAAC;AAED,YAAU;AAEV,WAAS,QAAQ,IAAI,sBAAsB,UAAU,eAAe;AAAA,IAClE,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,QAAQ,UAAU;AAAA,IAClB,MAAM;AAAA,EACR,CAAC;AAGD,WAAS,QAAQ;AAAA,IACf;AAAA,IACA,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,UAAU,wBAAwB;AAAA,IACzE;AAAA,MACE,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ,UAAU;AAAA,MAClB,MAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO;AACT;AAEA,eAAsB,cACpB,KACA,QACuB;AACvB,MAAI;AACF,UAAM,QAAQ,MAAM,aAAa,OAAO,KAAK;AAC7C,QAAI,CAAC,OAAO;AACV,aAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACvE;AAEA,WAAO,aAAa,KAAK,EAAE,SAAS,KAAK,CAAC;AAAA,EAC5C,SAAS,OAAO;AACd,YAAQ,MAAM,2BAA2B,KAAK;AAC9C,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,yBAAyB;AAAA,MAClC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;;;AC9LA;AAAA,EACE,oBAAoB;AAAA,EAGpB,mBAAAC;AAAA,OACK;AAEA,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA,gBAAgBA;AAClB,GAAmC;AACjC,SAAO;AAAA,IAAqB,EAAE,OAAO,cAAc;AAAA,IAAG,YACpD,aAAa,KAAK;AAAA,EACpB;AACF;;;ALNA,SAAS,cAAAC,aAAY,iBAAAC,sBAAqB;AAC1C,SAAS,eAAe;AAMT,SAAR,KAAsB,QAAgC;AAI3D,QAAM,cAAc,OAAO,QAAwC;AACjE,UAAM,EAAE,SAAS,IAAI,IAAI;AACzB,UAAM,WAAW,OAAO,YAAY;AACpC,UAAM,OAAO,SAAS,QAAQ,UAAU,EAAE;AAE1C,YAAQ,MAAM;AAAA,MACZ,KAAK;AACH,eAAO,aAAa,KAAK,MAAM;AAAA,MAEjC,KAAK;AACH,eAAO,eAAe,KAAK,MAAM;AAAA,MAEnC,KAAK;AACH,eAAO,cAAc,KAAK,MAAM;AAAA,MAElC;AACE,eAAOC,cAAa,MAAM;AAAA,IAC9B;AAAA,EACF;AAKA,QAAM,UAAU,YAAY;AAE1B,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,cAAc,YAAY,IAAI,mBAAmB,GAAG;AAC1D,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,IACT;AACA,UAAM,OAAO,IAAIF,YAAW;AAAA,MAC1B,QAAQ;AAAA,MACR,SAASC;AAAA,IACX,CAAC;AACD,UAAM,OAAO,MAAM,KAAK,MAAM,YAAY;AAC1C,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,YAAY;AAC7B,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,qBAAqB,YAAY;AAAA,MACrC;AAAA,IACF,GAAG;AAEH,QAAI,CAAC,oBAAoB;AACvB,aAAO;AAAA,IACT;AAEA,UAAM,aAAa,SAAS,kBAAkB;AAC9C,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAExC,WAAO,aAAa;AAAA,EACtB;AAEA,SAAO;AAAA,IACL,UAAU;AAAA,MACR,KAAK;AAAA,MACL,MAAM;AAAA,IACR;AAAA;AAAA,IAEA;AAAA,IACA;AAAA;AAAA,IAEA,QAAQ,iBAAiB,MAAM;AAAA,IAC/B,WAAW,oBAAoB,MAAM;AAAA,EACvC;AACF;","names":["NextResponse","cookies","ECHO_BASE_URL","ROUTER_BASE_URL","EchoClient","ECHO_BASE_URL","NextResponse"]}

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@merit-systems/echo-next-sdk",
+  "version": "0.0.1",
+  "description": "Next.js SDK for Echo",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "import": "./dist/client.js"
+    }
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "lint": "pnpx eslint src/**/*.ts",
+    "lint:fix": "pnpx eslint src/**/*.ts --fix",
+    "type-check": "tsc --noEmit",
+    "format": "prettier --write src",
+    "test": "echo 'no tests'",
+    "test:unit": "echo 'no tests'",
+    "test:watch": "echo 'no tests'",
+    "prepublishOnly": "pnpm run build"
+  },
+  "keywords": [
+    "echo",
+    "typescript",
+    "sdk",
+    "api"
+  ],
+  "author": "Merit Systems",
+  "license": "MIT",
+  "dependencies": {
+    "@merit-systems/echo-typescript-sdk": "workspace:*",
+    "ai": "^5.0.17",
+    "jwt-decode": "^4.0.0"
+  },
+  "peerDependencies": {
+    "next": ">=15.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.3",
+    "@typescript-eslint/eslint-plugin": "^8.34.1",
+    "@typescript-eslint/parser": "^8.34.1",
+    "eslint": "^9.29.0",
+    "next": "^15.1.4",
+    "tsup": "^8.5.0",
+    "typescript": "^5.8.3",
+    "vitest": "^3.2.3"
+  },
+  "files": [
+    "dist/**/*"
+  ]
+}