@merit-systems/echo-next-sdk 0.0.6 → 0.0.9

package/dist/client.d.ts

@@ -7,6 +7,7 @@ interface EchoClientConfig {
  * Sign in to Echo (client-side only)
  */
 declare function signIn(config?: EchoClientConfig): void;
+declare function signOut(config?: EchoClientConfig): void;
 /**
  * Create an Echo client for client-side usage (React components, hooks)
  * Uses relative URLs that work in the browser
@@ -23,4 +24,4 @@ declare const echoClient: EchoClient;
  */
 declare function useEcho(config?: EchoConfig): EchoClient;
 
-export { type EchoClientConfig, createEchoClient, echoClient, signIn, useEcho };
+export { type EchoClientConfig, createEchoClient, echoClient, signIn, signOut, useEcho };

package/dist/client.js

@@ -8,6 +8,14 @@ function signIn(config) {
   const basePath = config?.basePath || "/api/echo";
   window.location.href = `${window.location.origin}${basePath}/signin`;
 }
+function signOut(config) {
+  if (typeof window === "undefined") {
+    console.warn("signOut() can only be called in client components");
+    return;
+  }
+  const basePath = config?.basePath || "/api/echo";
+  window.location.href = `${window.location.origin}${basePath}/signout`;
+}
 function createEchoClient(config) {
   const proxyPath = config?.basePath ? `${config.basePath}/proxy` : "/api/echo/proxy";
   return new EchoClient({
@@ -27,6 +35,7 @@ export {
   createEchoClient,
   echoClient,
   signIn,
+  signOut,
   useEcho
 };
 //# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client.ts"],"sourcesContent":["import { EchoClient, EchoConfig } from '@merit-systems/echo-typescript-sdk';\n\nexport interface EchoClientConfig {\n  basePath?: string;\n}\n\n/**\n * Sign in to Echo (client-side only)\n */\nexport function signIn(config?: EchoClientConfig) {\n  if (typeof window === 'undefined') {\n    console.warn('signIn() can only be called in client components');\n    return;\n  }\n\n  const basePath = config?.basePath || '/api/echo';\n  window.location.href = `${window.location.origin}${basePath}/signin`;\n}\n\n/**\n * Create an Echo client for client-side usage (React components, hooks)\n * Uses relative URLs that work in the browser\n */\nexport function createEchoClient(config?: EchoConfig): EchoClient {\n  const proxyPath = config?.basePath\n    ? `${config.basePath}/proxy`\n    : '/api/echo/proxy';\n\n  return new EchoClient({\n    baseUrl: proxyPath,\n    // No apiKey needed - proxy handles authentication automatically\n    apiKey: 'next-sdk-proxy',\n  });\n}\n\n/**\n * Pre-configured Echo client for client-side usage\n * Ready to use in React components\n */\nexport const echoClient = createEchoClient();\n\n/**\n * React hook to get the Echo client\n * Provides a consistent way to access the client in components\n */\nexport function useEcho(config?: EchoConfig): EchoClient {\n  if (config) {\n    return createEchoClient(config);\n  }\n  return echoClient;\n}\n"],"mappings":";AAAA,SAAS,kBAA8B;AAShC,SAAS,OAAO,QAA2B;AAChD,MAAI,OAAO,WAAW,aAAa;AACjC,YAAQ,KAAK,kDAAkD;AAC/D;AAAA,EACF;AAEA,QAAM,WAAW,QAAQ,YAAY;AACrC,SAAO,SAAS,OAAO,GAAG,OAAO,SAAS,MAAM,GAAG,QAAQ;AAC7D;AAMO,SAAS,iBAAiB,QAAiC;AAChE,QAAM,YAAY,QAAQ,WACtB,GAAG,OAAO,QAAQ,WAClB;AAEJ,SAAO,IAAI,WAAW;AAAA,IACpB,SAAS;AAAA;AAAA,IAET,QAAQ;AAAA,EACV,CAAC;AACH;AAMO,IAAM,aAAa,iBAAiB;AAMpC,SAAS,QAAQ,QAAiC;AACvD,MAAI,QAAQ;AACV,WAAO,iBAAiB,MAAM;AAAA,EAChC;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/client.ts"],"sourcesContent":["import { EchoClient, EchoConfig } from '@merit-systems/echo-typescript-sdk';\n\nexport interface EchoClientConfig {\n  basePath?: string;\n}\n\n/**\n * Sign in to Echo (client-side only)\n */\nexport function signIn(config?: EchoClientConfig) {\n  if (typeof window === 'undefined') {\n    console.warn('signIn() can only be called in client components');\n    return;\n  }\n\n  const basePath = config?.basePath || '/api/echo';\n  window.location.href = `${window.location.origin}${basePath}/signin`;\n}\n\nexport function signOut(config?: EchoClientConfig) {\n  if (typeof window === 'undefined') {\n    console.warn('signOut() can only be called in client components');\n    return;\n  }\n  const basePath = config?.basePath || '/api/echo';\n  window.location.href = `${window.location.origin}${basePath}/signout`;\n}\n\n/**\n * Create an Echo client for client-side usage (React components, hooks)\n * Uses relative URLs that work in the browser\n */\nexport function createEchoClient(config?: EchoConfig): EchoClient {\n  const proxyPath = config?.basePath\n    ? `${config.basePath}/proxy`\n    : '/api/echo/proxy';\n\n  return new EchoClient({\n    baseUrl: proxyPath,\n    // No apiKey needed - proxy handles authentication automatically\n    apiKey: 'next-sdk-proxy',\n  });\n}\n\n/**\n * Pre-configured Echo client for client-side usage\n * Ready to use in React components\n */\nexport const echoClient = createEchoClient();\n\n/**\n * React hook to get the Echo client\n * Provides a consistent way to access the client in components\n */\nexport function useEcho(config?: EchoConfig): EchoClient {\n  if (config) {\n    return createEchoClient(config);\n  }\n  return echoClient;\n}\n"],"mappings":";AAAA,SAAS,kBAA8B;AAShC,SAAS,OAAO,QAA2B;AAChD,MAAI,OAAO,WAAW,aAAa;AACjC,YAAQ,KAAK,kDAAkD;AAC/D;AAAA,EACF;AAEA,QAAM,WAAW,QAAQ,YAAY;AACrC,SAAO,SAAS,OAAO,GAAG,OAAO,SAAS,MAAM,GAAG,QAAQ;AAC7D;AAEO,SAAS,QAAQ,QAA2B;AACjD,MAAI,OAAO,WAAW,aAAa;AACjC,YAAQ,KAAK,mDAAmD;AAChE;AAAA,EACF;AACA,QAAM,WAAW,QAAQ,YAAY;AACrC,SAAO,SAAS,OAAO,GAAG,OAAO,SAAS,MAAM,GAAG,QAAQ;AAC7D;AAMO,SAAS,iBAAiB,QAAiC;AAChE,QAAM,YAAY,QAAQ,WACtB,GAAG,OAAO,QAAQ,WAClB;AAEJ,SAAO,IAAI,WAAW;AAAA,IACpB,SAAS;AAAA;AAAA,IAET,QAAQ;AAAA,EACV,CAAC;AACH;AAMO,IAAM,aAAa,iBAAiB;AAMpC,SAAS,QAAQ,QAAiC;AACvD,MAAI,QAAQ;AACV,WAAO,iBAAiB,MAAM;AAAA,EAChC;AACA,SAAO;AACT;","names":[]}

package/dist/index.js

@@ -19,6 +19,18 @@ function resolveEchoBaseUrl(config) {
   return config.baseEchoUrl || ECHO_BASE_URL;
 }
 
+// src/auth/cookie-names.ts
+var ECHO_COOKIE = {
+  ACCESS_TOKEN: "echo_access_token",
+  REFRESH_TOKEN: "echo_refresh_token",
+  REFRESH_TOKEN_EXPIRES: "echo_refresh_token_expires",
+  USER_INFO: "echo_user_info",
+  CODE_VERIFIER: "echo_code_verifier"
+};
+function namespacedCookie(name, appId) {
+  return `${name}_${appId}`;
+}
+
 // src/auth/jwt-utils.ts
 import { jwtDecode } from "jwt-decode";
 function shouldRefreshToken(token) {
@@ -53,31 +65,43 @@ async function performTokenRefresh(refreshToken, config) {
 }
 async function getEchoToken(config) {
   const cookies2 = await getCookies();
-  const accessToken = cookies2.get("echo_access_token")?.value;
+  const accessToken = cookies2.get(
+    namespacedCookie(ECHO_COOKIE.ACCESS_TOKEN, config.appId)
+  )?.value;
   if (!accessToken || shouldRefreshToken(accessToken)) {
-    const refreshToken = cookies2.get("echo_refresh_token")?.value;
+    const refreshToken = cookies2.get(
+      namespacedCookie(ECHO_COOKIE.REFRESH_TOKEN, config.appId)
+    )?.value;
     if (!refreshToken) {
       console.log("No refresh token found");
       return null;
     }
     try {
       const refreshResult = await performTokenRefresh(refreshToken, config);
-      cookies2.set("echo_access_token", refreshResult.access_token, {
-        httpOnly: true,
-        secure: process.env.NODE_ENV === "production",
-        sameSite: "lax",
-        maxAge: refreshResult.expires_in,
-        path: "/"
-      });
-      cookies2.set("echo_refresh_token", refreshResult.refresh_token, {
-        httpOnly: true,
-        secure: process.env.NODE_ENV === "production",
-        sameSite: "lax",
-        maxAge: refreshResult.refresh_token_expires_in,
-        path: "/"
-      });
       cookies2.set(
-        "echo_refresh_token_expires",
+        namespacedCookie(ECHO_COOKIE.ACCESS_TOKEN, config.appId),
+        refreshResult.access_token,
+        {
+          httpOnly: true,
+          secure: process.env.NODE_ENV === "production",
+          sameSite: "lax",
+          maxAge: refreshResult.expires_in,
+          path: "/"
+        }
+      );
+      cookies2.set(
+        namespacedCookie(ECHO_COOKIE.REFRESH_TOKEN, config.appId),
+        refreshResult.refresh_token,
+        {
+          httpOnly: true,
+          secure: process.env.NODE_ENV === "production",
+          sameSite: "lax",
+          maxAge: refreshResult.refresh_token_expires_in,
+          path: "/"
+        }
+      );
+      cookies2.set(
+        namespacedCookie(ECHO_COOKIE.REFRESH_TOKEN_EXPIRES, config.appId),
         String(
           Math.floor(Date.now() / 1e3) + refreshResult.refresh_token_expires_in
         ),
@@ -143,7 +167,10 @@ async function handleEchoClientProxy(req, config) {
     const response = await fetch(targetUrl, {
       method: req.method,
       headers,
-      ...req.method !== "GET" && req.method !== "HEAD" && { body: req.body }
+      ...req.method !== "GET" && req.method !== "HEAD" && {
+        body: req.body,
+        duplex: "half"
+      }
     });
     return response;
   } catch (error) {
@@ -181,14 +208,35 @@ async function handleSignIn(req, config) {
   redirectUrl.searchParams.set("code_challenge", codeChallenge);
   redirectUrl.searchParams.set("code_challenge_method", "S256");
   const response = NextResponse2.redirect(redirectUrl.toString());
-  response.cookies.set("echo_code_verifier", codeVerifier, {
-    httpOnly: true,
-    secure: process.env.NODE_ENV === "production",
-    sameSite: "lax",
-    maxAge: 300,
-    // 5 minutes - same as auth code TTL
-    path: "/"
-  });
+  response.cookies.set(
+    namespacedCookie(ECHO_COOKIE.CODE_VERIFIER, config.appId),
+    codeVerifier,
+    {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === "production",
+      sameSite: "lax",
+      maxAge: 300,
+      // 5 minutes - same as auth code TTL
+      path: "/"
+    }
+  );
+  return response;
+}
+async function handleSignOut(req, config) {
+  const { origin } = req.nextUrl;
+  const response = NextResponse2.redirect(`${origin}`);
+  response.cookies.delete(
+    namespacedCookie(ECHO_COOKIE.ACCESS_TOKEN, config.appId)
+  );
+  response.cookies.delete(
+    namespacedCookie(ECHO_COOKIE.REFRESH_TOKEN, config.appId)
+  );
+  response.cookies.delete(
+    namespacedCookie(ECHO_COOKIE.USER_INFO, config.appId)
+  );
+  response.cookies.delete(
+    namespacedCookie(ECHO_COOKIE.REFRESH_TOKEN_EXPIRES, config.appId)
+  );
   return response;
 }
 async function handleCallback(req, config) {
@@ -199,7 +247,9 @@ async function handleCallback(req, config) {
   if (!code || !state) {
     return NextResponse2.json({ error: "Invalid request" }, { status: 400 });
   }
-  const codeVerifier = req.cookies.get("echo_code_verifier")?.value;
+  const codeVerifier = req.cookies.get(
+    namespacedCookie(ECHO_COOKIE.CODE_VERIFIER, config.appId)
+  )?.value;
   if (!codeVerifier) {
     return NextResponse2.json(
       { error: "Code verifier not found. Please try signing in again." },
@@ -230,39 +280,54 @@ async function handleCallback(req, config) {
   }
   const tokenData = await tokenResponse.json();
   const response = NextResponse2.redirect(`${origin}`);
-  response.cookies.set("echo_code_verifier", "", {
-    httpOnly: true,
-    secure: process.env.NODE_ENV === "production",
-    sameSite: "lax",
-    maxAge: 0,
-    // Expire immediately
-    path: "/"
-  });
-  response.cookies.set("echo_access_token", tokenData.access_token, {
-    httpOnly: true,
-    secure: process.env.NODE_ENV === "production",
-    sameSite: "lax",
-    maxAge: tokenData.expires_in,
-    // expires_in is typically in seconds
-    path: "/"
-  });
-  tokenData.refresh_token_expires_in;
-  response.cookies.set("echo_refresh_token", tokenData.refresh_token, {
-    httpOnly: true,
-    secure: process.env.NODE_ENV === "production",
-    sameSite: "lax",
-    maxAge: tokenData.refresh_token_expires_in,
-    path: "/"
-  });
-  response.cookies.set("echo_user_info", JSON.stringify(tokenData.user), {
-    httpOnly: true,
-    secure: process.env.NODE_ENV === "production",
-    sameSite: "lax",
-    maxAge: tokenData.refresh_token_expires_in,
-    path: "/"
-  });
   response.cookies.set(
-    "echo_refresh_token_expires",
+    namespacedCookie(ECHO_COOKIE.CODE_VERIFIER, config.appId),
+    "",
+    {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === "production",
+      sameSite: "lax",
+      maxAge: 0,
+      // Expire immediately
+      path: "/"
+    }
+  );
+  response.cookies.set(
+    namespacedCookie(ECHO_COOKIE.ACCESS_TOKEN, config.appId),
+    tokenData.access_token,
+    {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === "production",
+      sameSite: "lax",
+      maxAge: tokenData.expires_in,
+      // expires_in is typically in seconds
+      path: "/"
+    }
+  );
+  response.cookies.set(
+    namespacedCookie(ECHO_COOKIE.REFRESH_TOKEN, config.appId),
+    tokenData.refresh_token,
+    {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === "production",
+      sameSite: "lax",
+      maxAge: tokenData.refresh_token_expires_in,
+      path: "/"
+    }
+  );
+  response.cookies.set(
+    namespacedCookie(ECHO_COOKIE.USER_INFO, config.appId),
+    JSON.stringify(tokenData.user),
+    {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === "production",
+      sameSite: "lax",
+      maxAge: tokenData.refresh_token_expires_in,
+      path: "/"
+    }
+  );
+  response.cookies.set(
+    namespacedCookie(ECHO_COOKIE.REFRESH_TOKEN_EXPIRES, config.appId),
     String(Math.floor(Date.now() / 1e3) + tokenData.refresh_token_expires_in),
     {
       httpOnly: true,
@@ -303,6 +368,8 @@ function Echo(config) {
       // all the auth stuff
       case "/signin":
         return handleSignIn(req, config);
+      case "/signout":
+        return handleSignOut(req, config);
       case "/callback":
         return handleCallback(req, config);
       case "/refresh":
@@ -314,7 +381,9 @@ function Echo(config) {
   };
   const getUser = async () => {
     const cookieStore = await cookies();
-    const userInfo = cookieStore.get("echo_user_info")?.value;
+    const userInfo = cookieStore.get(
+      namespacedCookie(ECHO_COOKIE.USER_INFO, config.appId)
+    )?.value;
     if (!userInfo) {
       return null;
     }
@@ -324,7 +393,7 @@ function Echo(config) {
   const isSignedIn = async () => {
     const cookieStore = await cookies();
     const refreshTokenExpiry = cookieStore.get(
-      "echo_refresh_token_expires"
+      namespacedCookie(ECHO_COOKIE.REFRESH_TOKEN_EXPIRES, config.appId)
     )?.value;
     if (!refreshTokenExpiry) {
       return false;

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/providers/anthropic.ts","../src/auth/token-manager.ts","../src/config.ts","../src/auth/jwt-utils.ts","../src/providers/google.ts","../src/providers/openai.ts","../src/proxy/index.ts","../src/auth/oauth-handlers.ts"],"sourcesContent":["import { cookies } from 'next/headers';\nimport { NextRequest, NextResponse } from 'next/server';\n\nimport { EchoConfig, EchoResult } from './types';\n\nimport { createEchoAnthropic } from 'providers/anthropic';\nimport { createEchoGoogle } from 'providers/google';\nimport { createEchoOpenAI } from 'providers/openai';\n\nimport { RefreshTokenResponse } from 'auth/token-manager';\nimport { handleEchoClientProxy } from 'proxy';\nimport {\n  handleCallback,\n  handleRefresh,\n  handleSignIn,\n} from './auth/oauth-handlers';\n\n/**\n * Echo SDK for Next.js\n * Provides OAuth authentication and token management for Echo API integration\n */\nexport default function Echo(config: EchoConfig): EchoResult {\n  /**\n   * HTTP handler for OAuth routes (signin and callback)\n   */\n  const httpHandler = async (req: NextRequest): Promise<Response> => {\n    const { pathname } = req.nextUrl;\n    const basePath = config.basePath || '/api/echo';\n    const path = pathname.replace(basePath, '');\n\n    if (path.startsWith('/proxy')) {\n      return handleEchoClientProxy(req, config);\n    }\n\n    switch (path) {\n      // all the auth stuff\n      case '/signin':\n        return handleSignIn(req, config);\n\n      case '/callback':\n        return handleCallback(req, config);\n\n      case '/refresh':\n        return handleRefresh(req, config);\n\n      default:\n        console.error('Unknown path', path);\n        return NextResponse.error();\n    }\n  };\n\n  /**\n   * Get current user info with automatic token refresh\n   */\n  const getUser = async () => {\n    // read only access token, if expired we are fucked\n    const cookieStore = await cookies();\n    const userInfo = cookieStore.get('echo_user_info')?.value;\n    if (!userInfo) {\n      return null;\n    }\n    const user = JSON.parse(userInfo) as RefreshTokenResponse['user'];\n    return user;\n  };\n\n  const isSignedIn = async () => {\n    const cookieStore = await cookies();\n    const refreshTokenExpiry = cookieStore.get(\n      'echo_refresh_token_expires'\n    )?.value;\n\n    if (!refreshTokenExpiry) {\n      return false; // No expiry stored\n    }\n\n    const expiryTime = parseInt(refreshTokenExpiry);\n    const now = Math.floor(Date.now() / 1000);\n\n    return expiryTime > now; // True if not expired\n  };\n\n  return {\n    // HTTP handlers for Next.js API routes\n    handlers: {\n      GET: httpHandler,\n      POST: httpHandler,\n    },\n\n    // Authentication utilities (server-side only)\n    getUser,\n    isSignedIn,\n\n    // AI provider clients\n    openai: createEchoOpenAI(config),\n    anthropic: createEchoAnthropic(config),\n    google: createEchoGoogle(config),\n  };\n}\n","import {\n  AnthropicProvider,\n  createEchoAnthropic as createEchoAnthropicBase,\n  EchoConfig,\n} from '@merit-systems/echo-typescript-sdk';\nimport { getEchoToken } from '../auth/token-manager';\n\nexport function createEchoAnthropic(config: EchoConfig): AnthropicProvider {\n  return createEchoAnthropicBase(config, async () => getEchoToken(config));\n}\n","import {\n  EchoClient,\n  EchoConfig,\n  User,\n} from '@merit-systems/echo-typescript-sdk';\nimport { cookies as getCookies } from 'next/headers';\nimport { resolveEchoBaseUrl } from '../config';\nimport { shouldRefreshToken } from './jwt-utils';\n\nexport interface RefreshTokenResponse {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  refresh_token_expires_in: number;\n  scope: string;\n  user: {\n    id: string;\n    email: string;\n    name: string;\n  };\n  echo_app: {\n    id: string;\n    name: string;\n    description: string;\n  };\n}\n\n/**\n * Refresh an access token using a refresh token\n * @param refreshToken - The refresh token to use\n * @param appId - The Echo app ID\n * @returns Promise resolving to the new token data\n */\nexport async function performTokenRefresh(\n  refreshToken: string,\n  config: EchoConfig\n): Promise<RefreshTokenResponse> {\n  return fetch(`${resolveEchoBaseUrl(config)}/api/oauth/token`, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      grant_type: 'refresh_token',\n      refresh_token: refreshToken,\n      client_id: config.appId,\n    }),\n  }).then(async r => {\n    if (r.ok) {\n      const tokenData = (await r.json()) as RefreshTokenResponse;\n      return tokenData;\n    }\n    return Promise.reject(new Error(await r.text()));\n  });\n}\n\n/**\n * Get a valid Echo token, refreshing if necessary\n * @param appId - The Echo app ID for token refresh\n * @returns Promise resolving to a valid access token or null if authentication failed\n */\nexport async function getEchoToken(config: EchoConfig): Promise<string | null> {\n  const cookies = await getCookies();\n  const accessToken = cookies.get('echo_access_token')?.value;\n\n  // Check if token needs refresh\n  if (!accessToken || shouldRefreshToken(accessToken)) {\n    const refreshToken = cookies.get('echo_refresh_token')?.value;\n\n    if (!refreshToken) {\n      console.log('No refresh token found');\n      return null;\n    }\n\n    try {\n      const refreshResult = await performTokenRefresh(refreshToken, config);\n\n      // Set new tokens in cookies\n      cookies.set('echo_access_token', refreshResult.access_token, {\n        httpOnly: true,\n        secure: process.env.NODE_ENV === 'production',\n        sameSite: 'lax',\n        maxAge: refreshResult.expires_in,\n        path: '/',\n      });\n\n      cookies.set('echo_refresh_token', refreshResult.refresh_token, {\n        httpOnly: true,\n        secure: process.env.NODE_ENV === 'production',\n        sameSite: 'lax',\n        maxAge: refreshResult.refresh_token_expires_in,\n        path: '/',\n      });\n\n      // Store refresh token expiry time for checking\n      cookies.set(\n        'echo_refresh_token_expires',\n        String(\n          Math.floor(Date.now() / 1000) + refreshResult.refresh_token_expires_in\n        ),\n        {\n          httpOnly: true,\n          secure: process.env.NODE_ENV === 'production',\n          sameSite: 'lax',\n          maxAge: refreshResult.refresh_token_expires_in,\n          path: '/',\n        }\n      );\n\n      return refreshResult.access_token;\n    } catch (error) {\n      console.error('Token refresh failed:', refreshToken, error);\n      return null;\n    }\n  }\n\n  return accessToken;\n}\n\nexport async function getUser(config: EchoConfig): Promise<User> {\n  const echo = await getEchoClient(config);\n  if (!echo) {\n    throw new Error('User not signed in');\n  }\n  return echo.users.getUserInfo();\n}\n\nexport async function getEchoClient(\n  config: EchoConfig\n): Promise<EchoClient | null> {\n  const token = await getEchoToken(config);\n  if (!token) {\n    return null;\n  }\n  return new EchoClient({\n    baseUrl: resolveEchoBaseUrl(config),\n    apiKey: token,\n  });\n}\n","import { ECHO_BASE_URL } from '@merit-systems/echo-typescript-sdk';\nimport type { EchoConfig } from './types';\n\nexport function resolveEchoBaseUrl(config: EchoConfig): string {\n  return config.baseEchoUrl || ECHO_BASE_URL;\n}\n","import { jwtDecode } from 'jwt-decode';\n\ninterface JwtPayload {\n  exp?: number;\n}\n\n/**\n * Check if a JWT token needs to be refreshed\n * @param token - The JWT access token to check\n * @returns true if token should be refreshed, false otherwise\n */\nexport function shouldRefreshToken(token: string): boolean {\n  try {\n    const decoded = jwtDecode<JwtPayload>(token);\n    if (!decoded.exp) return true;\n\n    const now = Math.floor(Date.now() / 1000);\n    // Refresh if token expires within 30 seconds\n    const bufferTime = 30;\n    return decoded.exp <= now + bufferTime;\n  } catch {\n    return true; // If we can't decode, assume it needs refresh\n  }\n}\n","import {\n  createEchoGoogle as createEchoGoogleBase,\n  EchoConfig,\n  GoogleGenerativeAIProvider,\n} from '@merit-systems/echo-typescript-sdk';\nimport { getEchoToken } from '../auth/token-manager';\n\nexport function createEchoGoogle(\n  config: EchoConfig\n): GoogleGenerativeAIProvider {\n  return createEchoGoogleBase(config, async () => getEchoToken(config));\n}\n","import { getEchoToken } from '../auth/token-manager';\nimport {\n  createEchoOpenAI as createEchoOpenAIBase,\n  EchoConfig,\n  OpenAIProvider,\n} from '@merit-systems/echo-typescript-sdk';\n\nexport function createEchoOpenAI(config: EchoConfig): OpenAIProvider {\n  return createEchoOpenAIBase(config, async () => getEchoToken(config));\n}\n","import { NextRequest, NextResponse } from 'next/server';\nimport { getEchoToken } from '../auth/token-manager';\nimport { EchoConfig } from '../types';\n\n/**\n * Proxy requests to Echo service with automatic authentication\n */\nexport async function handleEchoClientProxy(\n  req: NextRequest,\n  config: EchoConfig\n): Promise<Response> {\n  const proxyPath = req.nextUrl.pathname.replace(/^.*\\/proxy/, '');\n  const baseUrl = config.baseEchoUrl || 'https://echo.merit.systems';\n  const targetUrl = `${baseUrl}${proxyPath}`;\n\n  const headers = new Headers(req.headers);\n  headers.delete('host');\n  // Don't ask upstream to compress\n  headers.delete('accept-encoding');\n  headers.set('accept-encoding', 'identity');\n\n  // Optional: also drop conditional headers to avoid weirdness\n  headers.delete('if-none-match');\n  headers.delete('if-modified-since');\n\n  // Get valid token using existing function (handles refresh automatically)\n  const accessToken = await getEchoToken(config);\n\n  if (!accessToken) {\n    return NextResponse.json(\n      { error: 'Authentication required' },\n      { status: 401 }\n    );\n  }\n  // Inject the valid token\n  headers.set('Authorization', `Bearer ${accessToken}`);\n  try {\n    const response = await fetch(targetUrl, {\n      method: req.method,\n      headers,\n      ...(req.method !== 'GET' && req.method !== 'HEAD' && { body: req.body }),\n    });\n\n    return response;\n  } catch (error) {\n    console.error('Proxy request failed:', error);\n    return NextResponse.json(\n      { error: 'Proxy request failed' },\n      { status: 500 }\n    );\n  }\n}\n","import { EchoConfig } from '@merit-systems/echo-typescript-sdk';\nimport { NextRequest, NextResponse } from 'next/server';\nimport { resolveEchoBaseUrl } from '../config';\nimport { getEchoToken, RefreshTokenResponse } from './token-manager';\n\n/**\n * Generate PKCE code challenge and verifier\n * @returns Object containing code verifier and challenge\n */\nasync function generateCodeChallenge(): Promise<{\n  codeVerifier: string;\n  codeChallenge: string;\n}> {\n  const codeVerifier = Array.from(crypto.getRandomValues(new Uint8Array(32)))\n    .map(b => b.toString(16).padStart(2, '0'))\n    .join('');\n\n  const encoder = new TextEncoder();\n  const codeChallengeBuffer = await crypto.subtle.digest(\n    'SHA-256',\n    encoder.encode(codeVerifier)\n  );\n\n  const codeChallenge = btoa(\n    String.fromCharCode(...new Uint8Array(codeChallengeBuffer))\n  )\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n\n  return { codeVerifier, codeChallenge };\n}\n\n/**\n * Handle OAuth signin request - redirect to Echo authorization server\n * @param req - The incoming Next.js request\n * @param config - Echo configuration\n * @returns NextResponse with redirect to authorization server\n */\nexport async function handleSignIn(\n  req: NextRequest,\n  config: EchoConfig\n): Promise<NextResponse> {\n  const { origin } = req.nextUrl;\n  const basePath = config.basePath || '/api/echo';\n\n  const baseUrl = resolveEchoBaseUrl(config);\n\n  const redirectUrl = new URL(`${baseUrl}/api/oauth/authorize`);\n  redirectUrl.searchParams.set('client_id', config.appId);\n  redirectUrl.searchParams.set('redirect_uri', `${origin}${basePath}/callback`);\n  redirectUrl.searchParams.set('response_type', 'code');\n\n  const { codeVerifier, codeChallenge } = await generateCodeChallenge();\n\n  redirectUrl.searchParams.set('code_challenge', codeChallenge);\n  redirectUrl.searchParams.set('code_challenge_method', 'S256');\n\n  // Create response with redirect and set cookie for code verifier\n  const response = NextResponse.redirect(redirectUrl.toString());\n\n  // Set the code verifier in a secure cookie that will be available during callback\n  response.cookies.set('echo_code_verifier', codeVerifier, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    maxAge: 300, // 5 minutes - same as auth code TTL\n    path: '/',\n  });\n\n  return response;\n}\n\n/**\n * Handle OAuth callback - exchange authorization code for tokens\n * @param req - The incoming Next.js request\n * @param config - Echo configuration\n * @returns NextResponse with redirect to home page and tokens set as cookies\n */\nexport async function handleCallback(\n  req: NextRequest,\n  config: EchoConfig\n): Promise<NextResponse> {\n  const { origin } = req.nextUrl;\n  const basePath = config.basePath || '/api/echo';\n\n  const code = req.nextUrl.searchParams.get('code');\n  const state = req.nextUrl.searchParams.get('state');\n\n  if (!code || !state) {\n    return NextResponse.json({ error: 'Invalid request' }, { status: 400 });\n  }\n\n  // Retrieve the code verifier from the cookie\n  const codeVerifier = req.cookies.get('echo_code_verifier')?.value;\n\n  if (!codeVerifier) {\n    return NextResponse.json(\n      { error: 'Code verifier not found. Please try signing in again.' },\n      { status: 400 }\n    );\n  }\n\n  // Exchange the code for a token from the token endpoint\n  const tokenEndpoint = `${resolveEchoBaseUrl(config)}/api/oauth/token`;\n\n  const params = new URLSearchParams();\n  params.set('grant_type', 'authorization_code');\n  params.set('code', code);\n  params.set('redirect_uri', `${origin}${basePath}/callback`);\n  params.set('client_id', config.appId);\n  params.set('code_verifier', codeVerifier);\n\n  const tokenResponse = await fetch(tokenEndpoint, {\n    method: 'POST',\n    headers: {\n      'Content-Type': 'application/x-www-form-urlencoded',\n      'x-client-user-agent': req.headers.get('user-agent') || '',\n      'x-client-ip':\n        req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || '',\n    },\n    body: params.toString(),\n  });\n\n  if (!tokenResponse.ok) {\n    return NextResponse.json(\n      { error: 'Token exchange failed' },\n      { status: 500 }\n    );\n  }\n\n  const tokenData = (await tokenResponse.json()) as RefreshTokenResponse;\n\n  const response = NextResponse.redirect(`${origin}`);\n\n  // Clear the code verifier cookie after successful token exchange\n  response.cookies.set('echo_code_verifier', '', {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    maxAge: 0, // Expire immediately\n    path: '/',\n  });\n\n  // Set the access token as a cookie\n  response.cookies.set('echo_access_token', tokenData.access_token, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    maxAge: tokenData.expires_in, // expires_in is typically in seconds\n    path: '/',\n  });\n\n  tokenData.refresh_token_expires_in;\n\n  response.cookies.set('echo_refresh_token', tokenData.refresh_token, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    maxAge: tokenData.refresh_token_expires_in,\n    path: '/',\n  });\n\n  response.cookies.set('echo_user_info', JSON.stringify(tokenData.user), {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    maxAge: tokenData.refresh_token_expires_in,\n    path: '/',\n  });\n\n  // Store refresh token expiry time for checking\n  response.cookies.set(\n    'echo_refresh_token_expires',\n    String(Math.floor(Date.now() / 1000) + tokenData.refresh_token_expires_in),\n    {\n      httpOnly: true,\n      secure: process.env.NODE_ENV === 'production',\n      sameSite: 'lax',\n      maxAge: tokenData.refresh_token_expires_in,\n      path: '/',\n    }\n  );\n\n  return response;\n}\n\nexport async function handleRefresh(\n  req: NextRequest,\n  config: EchoConfig\n): Promise<NextResponse> {\n  try {\n    const token = await getEchoToken(config);\n    if (!token) {\n      return NextResponse.json({ error: 'No token found' }, { status: 401 });\n    }\n\n    return NextResponse.json({ success: true });\n  } catch (error) {\n    console.error('Error refreshing token:', error);\n    return NextResponse.json(\n      { error: 'Error refreshing token' },\n      { status: 500 }\n    );\n  }\n}\n"],"mappings":";AAAA,SAAS,eAAe;AACxB,SAAsB,gBAAAA,qBAAoB;;;ACD1C;AAAA,EAEE,uBAAuB;AAAA,OAElB;;;ACJP;AAAA,EACE;AAAA,OAGK;AACP,SAAS,WAAW,kBAAkB;;;ACLtC,SAAS,qBAAqB;AAGvB,SAAS,mBAAmB,QAA4B;AAC7D,SAAO,OAAO,eAAe;AAC/B;;;ACLA,SAAS,iBAAiB;AAWnB,SAAS,mBAAmB,OAAwB;AACzD,MAAI;AACF,UAAM,UAAU,UAAsB,KAAK;AAC3C,QAAI,CAAC,QAAQ,IAAK,QAAO;AAEzB,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAExC,UAAM,aAAa;AACnB,WAAO,QAAQ,OAAO,MAAM;AAAA,EAC9B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AFWA,eAAsB,oBACpB,cACA,QAC+B;AAC/B,SAAO,MAAM,GAAG,mBAAmB,MAAM,CAAC,oBAAoB;AAAA,IAC5D,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU;AAAA,MACnB,YAAY;AAAA,MACZ,eAAe;AAAA,MACf,WAAW,OAAO;AAAA,IACpB,CAAC;AAAA,EACH,CAAC,EAAE,KAAK,OAAM,MAAK;AACjB,QAAI,EAAE,IAAI;AACR,YAAM,YAAa,MAAM,EAAE,KAAK;AAChC,aAAO;AAAA,IACT;AACA,WAAO,QAAQ,OAAO,IAAI,MAAM,MAAM,EAAE,KAAK,CAAC,CAAC;AAAA,EACjD,CAAC;AACH;AAOA,eAAsB,aAAa,QAA4C;AAC7E,QAAMC,WAAU,MAAM,WAAW;AACjC,QAAM,cAAcA,SAAQ,IAAI,mBAAmB,GAAG;AAGtD,MAAI,CAAC,eAAe,mBAAmB,WAAW,GAAG;AACnD,UAAM,eAAeA,SAAQ,IAAI,oBAAoB,GAAG;AAExD,QAAI,CAAC,cAAc;AACjB,cAAQ,IAAI,wBAAwB;AACpC,aAAO;AAAA,IACT;AAEA,QAAI;AACF,YAAM,gBAAgB,MAAM,oBAAoB,cAAc,MAAM;AAGpE,MAAAA,SAAQ,IAAI,qBAAqB,cAAc,cAAc;AAAA,QAC3D,UAAU;AAAA,QACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,QACjC,UAAU;AAAA,QACV,QAAQ,cAAc;AAAA,QACtB,MAAM;AAAA,MACR,CAAC;AAED,MAAAA,SAAQ,IAAI,sBAAsB,cAAc,eAAe;AAAA,QAC7D,UAAU;AAAA,QACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,QACjC,UAAU;AAAA,QACV,QAAQ,cAAc;AAAA,QACtB,MAAM;AAAA,MACR,CAAC;AAGD,MAAAA,SAAQ;AAAA,QACN;AAAA,QACA;AAAA,UACE,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,cAAc;AAAA,QAChD;AAAA,QACA;AAAA,UACE,UAAU;AAAA,UACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,UACjC,UAAU;AAAA,UACV,QAAQ,cAAc;AAAA,UACtB,MAAM;AAAA,QACR;AAAA,MACF;AAEA,aAAO,cAAc;AAAA,IACvB,SAAS,OAAO;AACd,cAAQ,MAAM,yBAAyB,cAAc,KAAK;AAC1D,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;;;AD7GO,SAAS,oBAAoB,QAAuC;AACzE,SAAO,wBAAwB,QAAQ,YAAY,aAAa,MAAM,CAAC;AACzE;;;AITA;AAAA,EACE,oBAAoB;AAAA,OAGf;AAGA,SAAS,iBACd,QAC4B;AAC5B,SAAO,qBAAqB,QAAQ,YAAY,aAAa,MAAM,CAAC;AACtE;;;ACVA;AAAA,EACE,oBAAoB;AAAA,OAGf;AAEA,SAAS,iBAAiB,QAAoC;AACnE,SAAO,qBAAqB,QAAQ,YAAY,aAAa,MAAM,CAAC;AACtE;;;ACTA,SAAsB,oBAAoB;AAO1C,eAAsB,sBACpB,KACA,QACmB;AACnB,QAAM,YAAY,IAAI,QAAQ,SAAS,QAAQ,cAAc,EAAE;AAC/D,QAAM,UAAU,OAAO,eAAe;AACtC,QAAM,YAAY,GAAG,OAAO,GAAG,SAAS;AAExC,QAAM,UAAU,IAAI,QAAQ,IAAI,OAAO;AACvC,UAAQ,OAAO,MAAM;AAErB,UAAQ,OAAO,iBAAiB;AAChC,UAAQ,IAAI,mBAAmB,UAAU;AAGzC,UAAQ,OAAO,eAAe;AAC9B,UAAQ,OAAO,mBAAmB;AAGlC,QAAM,cAAc,MAAM,aAAa,MAAM;AAE7C,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,0BAA0B;AAAA,MACnC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,UAAQ,IAAI,iBAAiB,UAAU,WAAW,EAAE;AACpD,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,WAAW;AAAA,MACtC,QAAQ,IAAI;AAAA,MACZ;AAAA,MACA,GAAI,IAAI,WAAW,SAAS,IAAI,WAAW,UAAU,EAAE,MAAM,IAAI,KAAK;AAAA,IACxE,CAAC;AAED,WAAO;AAAA,EACT,SAAS,OAAO;AACd,YAAQ,MAAM,yBAAyB,KAAK;AAC5C,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uBAAuB;AAAA,MAChC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;;;AClDA,SAAsB,gBAAAC,qBAAoB;AAQ1C,eAAe,wBAGZ;AACD,QAAM,eAAe,MAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,CAAC,EACvE,IAAI,OAAK,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EACxC,KAAK,EAAE;AAEV,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,sBAAsB,MAAM,OAAO,OAAO;AAAA,IAC9C;AAAA,IACA,QAAQ,OAAO,YAAY;AAAA,EAC7B;AAEA,QAAM,gBAAgB;AAAA,IACpB,OAAO,aAAa,GAAG,IAAI,WAAW,mBAAmB,CAAC;AAAA,EAC5D,EACG,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AAEpB,SAAO,EAAE,cAAc,cAAc;AACvC;AAQA,eAAsB,aACpB,KACA,QACuB;AACvB,QAAM,EAAE,OAAO,IAAI,IAAI;AACvB,QAAM,WAAW,OAAO,YAAY;AAEpC,QAAM,UAAU,mBAAmB,MAAM;AAEzC,QAAM,cAAc,IAAI,IAAI,GAAG,OAAO,sBAAsB;AAC5D,cAAY,aAAa,IAAI,aAAa,OAAO,KAAK;AACtD,cAAY,aAAa,IAAI,gBAAgB,GAAG,MAAM,GAAG,QAAQ,WAAW;AAC5E,cAAY,aAAa,IAAI,iBAAiB,MAAM;AAEpD,QAAM,EAAE,cAAc,cAAc,IAAI,MAAM,sBAAsB;AAEpE,cAAY,aAAa,IAAI,kBAAkB,aAAa;AAC5D,cAAY,aAAa,IAAI,yBAAyB,MAAM;AAG5D,QAAM,WAAWC,cAAa,SAAS,YAAY,SAAS,CAAC;AAG7D,WAAS,QAAQ,IAAI,sBAAsB,cAAc;AAAA,IACvD,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,QAAQ;AAAA;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AAED,SAAO;AACT;AAQA,eAAsB,eACpB,KACA,QACuB;AACvB,QAAM,EAAE,OAAO,IAAI,IAAI;AACvB,QAAM,WAAW,OAAO,YAAY;AAEpC,QAAM,OAAO,IAAI,QAAQ,aAAa,IAAI,MAAM;AAChD,QAAM,QAAQ,IAAI,QAAQ,aAAa,IAAI,OAAO;AAElD,MAAI,CAAC,QAAQ,CAAC,OAAO;AACnB,WAAOA,cAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAGA,QAAM,eAAe,IAAI,QAAQ,IAAI,oBAAoB,GAAG;AAE5D,MAAI,CAAC,cAAc;AACjB,WAAOA,cAAa;AAAA,MAClB,EAAE,OAAO,wDAAwD;AAAA,MACjE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAGA,QAAM,gBAAgB,GAAG,mBAAmB,MAAM,CAAC;AAEnD,QAAM,SAAS,IAAI,gBAAgB;AACnC,SAAO,IAAI,cAAc,oBAAoB;AAC7C,SAAO,IAAI,QAAQ,IAAI;AACvB,SAAO,IAAI,gBAAgB,GAAG,MAAM,GAAG,QAAQ,WAAW;AAC1D,SAAO,IAAI,aAAa,OAAO,KAAK;AACpC,SAAO,IAAI,iBAAiB,YAAY;AAExC,QAAM,gBAAgB,MAAM,MAAM,eAAe;AAAA,IAC/C,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,uBAAuB,IAAI,QAAQ,IAAI,YAAY,KAAK;AAAA,MACxD,eACE,IAAI,QAAQ,IAAI,iBAAiB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAAK;AAAA,IACjE;AAAA,IACA,MAAM,OAAO,SAAS;AAAA,EACxB,CAAC;AAED,MAAI,CAAC,cAAc,IAAI;AACrB,WAAOA,cAAa;AAAA,MAClB,EAAE,OAAO,wBAAwB;AAAA,MACjC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAa,MAAM,cAAc,KAAK;AAE5C,QAAM,WAAWA,cAAa,SAAS,GAAG,MAAM,EAAE;AAGlD,WAAS,QAAQ,IAAI,sBAAsB,IAAI;AAAA,IAC7C,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,QAAQ;AAAA;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AAGD,WAAS,QAAQ,IAAI,qBAAqB,UAAU,cAAc;AAAA,IAChE,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,QAAQ,UAAU;AAAA;AAAA,IAClB,MAAM;AAAA,EACR,CAAC;AAED,YAAU;AAEV,WAAS,QAAQ,IAAI,sBAAsB,UAAU,eAAe;AAAA,IAClE,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,QAAQ,UAAU;AAAA,IAClB,MAAM;AAAA,EACR,CAAC;AAED,WAAS,QAAQ,IAAI,kBAAkB,KAAK,UAAU,UAAU,IAAI,GAAG;AAAA,IACrE,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,QAAQ,UAAU;AAAA,IAClB,MAAM;AAAA,EACR,CAAC;AAGD,WAAS,QAAQ;AAAA,IACf;AAAA,IACA,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,UAAU,wBAAwB;AAAA,IACzE;AAAA,MACE,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ,UAAU;AAAA,MAClB,MAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO;AACT;AAEA,eAAsB,cACpB,KACA,QACuB;AACvB,MAAI;AACF,UAAM,QAAQ,MAAM,aAAa,MAAM;AACvC,QAAI,CAAC,OAAO;AACV,aAAOA,cAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACvE;AAEA,WAAOA,cAAa,KAAK,EAAE,SAAS,KAAK,CAAC;AAAA,EAC5C,SAAS,OAAO;AACd,YAAQ,MAAM,2BAA2B,KAAK;AAC9C,WAAOA,cAAa;AAAA,MAClB,EAAE,OAAO,yBAAyB;AAAA,MAClC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;;;ARxLe,SAAR,KAAsB,QAAgC;AAI3D,QAAM,cAAc,OAAO,QAAwC;AACjE,UAAM,EAAE,SAAS,IAAI,IAAI;AACzB,UAAM,WAAW,OAAO,YAAY;AACpC,UAAM,OAAO,SAAS,QAAQ,UAAU,EAAE;AAE1C,QAAI,KAAK,WAAW,QAAQ,GAAG;AAC7B,aAAO,sBAAsB,KAAK,MAAM;AAAA,IAC1C;AAEA,YAAQ,MAAM;AAAA;AAAA,MAEZ,KAAK;AACH,eAAO,aAAa,KAAK,MAAM;AAAA,MAEjC,KAAK;AACH,eAAO,eAAe,KAAK,MAAM;AAAA,MAEnC,KAAK;AACH,eAAO,cAAc,KAAK,MAAM;AAAA,MAElC;AACE,gBAAQ,MAAM,gBAAgB,IAAI;AAClC,eAAOC,cAAa,MAAM;AAAA,IAC9B;AAAA,EACF;AAKA,QAAM,UAAU,YAAY;AAE1B,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,WAAW,YAAY,IAAI,gBAAgB,GAAG;AACpD,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,IACT;AACA,UAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,YAAY;AAC7B,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,qBAAqB,YAAY;AAAA,MACrC;AAAA,IACF,GAAG;AAEH,QAAI,CAAC,oBAAoB;AACvB,aAAO;AAAA,IACT;AAEA,UAAM,aAAa,SAAS,kBAAkB;AAC9C,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAExC,WAAO,aAAa;AAAA,EACtB;AAEA,SAAO;AAAA;AAAA,IAEL,UAAU;AAAA,MACR,KAAK;AAAA,MACL,MAAM;AAAA,IACR;AAAA;AAAA,IAGA;AAAA,IACA;AAAA;AAAA,IAGA,QAAQ,iBAAiB,MAAM;AAAA,IAC/B,WAAW,oBAAoB,MAAM;AAAA,IACrC,QAAQ,iBAAiB,MAAM;AAAA,EACjC;AACF;","names":["NextResponse","cookies","NextResponse","NextResponse","NextResponse"]}
+{"version":3,"sources":["../src/index.ts","../src/providers/anthropic.ts","../src/auth/token-manager.ts","../src/config.ts","../src/auth/cookie-names.ts","../src/auth/jwt-utils.ts","../src/providers/google.ts","../src/providers/openai.ts","../src/proxy/index.ts","../src/auth/oauth-handlers.ts"],"sourcesContent":["import { cookies } from 'next/headers';\nimport { NextRequest, NextResponse } from 'next/server';\n\nimport { EchoConfig, EchoResult } from './types';\n\nimport { createEchoAnthropic } from 'providers/anthropic';\nimport { createEchoGoogle } from 'providers/google';\nimport { createEchoOpenAI } from 'providers/openai';\n\nimport { ECHO_COOKIE, namespacedCookie } from 'auth/cookie-names';\nimport { RefreshTokenResponse } from 'auth/token-manager';\nimport { handleEchoClientProxy } from 'proxy';\nimport {\n  handleCallback,\n  handleRefresh,\n  handleSignIn,\n  handleSignOut,\n} from './auth/oauth-handlers';\n\n/**\n * Echo SDK for Next.js\n * Provides OAuth authentication and token management for Echo API integration\n */\nexport default function Echo(config: EchoConfig): EchoResult {\n  /**\n   * HTTP handler for OAuth routes (signin and callback)\n   */\n  const httpHandler = async (req: NextRequest): Promise<Response> => {\n    const { pathname } = req.nextUrl;\n    const basePath = config.basePath || '/api/echo';\n    const path = pathname.replace(basePath, '');\n\n    if (path.startsWith('/proxy')) {\n      return handleEchoClientProxy(req, config);\n    }\n\n    switch (path) {\n      // all the auth stuff\n      case '/signin':\n        return handleSignIn(req, config);\n\n      case '/signout':\n        return handleSignOut(req, config);\n\n      case '/callback':\n        return handleCallback(req, config);\n\n      case '/refresh':\n        return handleRefresh(req, config);\n\n      default:\n        console.error('Unknown path', path);\n        return NextResponse.error();\n    }\n  };\n\n  /**\n   * Get current user info with automatic token refresh\n   */\n  const getUser = async () => {\n    // read only access token, if expired we are fucked\n    const cookieStore = await cookies();\n    const userInfo = cookieStore.get(\n      namespacedCookie(ECHO_COOKIE.USER_INFO, config.appId)\n    )?.value;\n    if (!userInfo) {\n      return null;\n    }\n    const user = JSON.parse(userInfo) as RefreshTokenResponse['user'];\n    return user;\n  };\n\n  const isSignedIn = async () => {\n    const cookieStore = await cookies();\n    const refreshTokenExpiry = cookieStore.get(\n      namespacedCookie(ECHO_COOKIE.REFRESH_TOKEN_EXPIRES, config.appId)\n    )?.value;\n\n    if (!refreshTokenExpiry) {\n      return false; // No expiry stored\n    }\n\n    const expiryTime = parseInt(refreshTokenExpiry);\n    const now = Math.floor(Date.now() / 1000);\n\n    return expiryTime > now; // True if not expired\n  };\n\n  return {\n    // HTTP handlers for Next.js API routes\n    handlers: {\n      GET: httpHandler,\n      POST: httpHandler,\n    },\n\n    // Authentication utilities (server-side only)\n    getUser,\n    isSignedIn,\n\n    // AI provider clients\n    openai: createEchoOpenAI(config),\n    anthropic: createEchoAnthropic(config),\n    google: createEchoGoogle(config),\n  };\n}\n","import {\n  AnthropicProvider,\n  createEchoAnthropic as createEchoAnthropicBase,\n  EchoConfig,\n} from '@merit-systems/echo-typescript-sdk';\nimport { getEchoToken } from '../auth/token-manager';\n\nexport function createEchoAnthropic(config: EchoConfig): AnthropicProvider {\n  return createEchoAnthropicBase(config, async () => getEchoToken(config));\n}\n","import {\n  EchoClient,\n  EchoConfig,\n  User,\n} from '@merit-systems/echo-typescript-sdk';\nimport { cookies as getCookies } from 'next/headers';\nimport { resolveEchoBaseUrl } from '../config';\nimport { ECHO_COOKIE, namespacedCookie } from './cookie-names';\nimport { shouldRefreshToken } from './jwt-utils';\n\nexport interface RefreshTokenResponse {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  refresh_token_expires_in: number;\n  scope: string;\n  user: {\n    id: string;\n    email: string;\n    name: string;\n  };\n  echo_app: {\n    id: string;\n    name: string;\n    description: string;\n  };\n}\n\n/**\n * Refresh an access token using a refresh token\n * @param refreshToken - The refresh token to use\n * @param appId - The Echo app ID\n * @returns Promise resolving to the new token data\n */\nexport async function performTokenRefresh(\n  refreshToken: string,\n  config: EchoConfig\n): Promise<RefreshTokenResponse> {\n  return fetch(`${resolveEchoBaseUrl(config)}/api/oauth/token`, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      grant_type: 'refresh_token',\n      refresh_token: refreshToken,\n      client_id: config.appId,\n    }),\n  }).then(async r => {\n    if (r.ok) {\n      const tokenData = (await r.json()) as RefreshTokenResponse;\n      return tokenData;\n    }\n    return Promise.reject(new Error(await r.text()));\n  });\n}\n\n/**\n * Get a valid Echo token, refreshing if necessary\n * @param appId - The Echo app ID for token refresh\n * @returns Promise resolving to a valid access token or null if authentication failed\n */\nexport async function getEchoToken(config: EchoConfig): Promise<string | null> {\n  const cookies = await getCookies();\n  const accessToken = cookies.get(\n    namespacedCookie(ECHO_COOKIE.ACCESS_TOKEN, config.appId)\n  )?.value;\n\n  // Check if token needs refresh\n  if (!accessToken || shouldRefreshToken(accessToken)) {\n    const refreshToken = cookies.get(\n      namespacedCookie(ECHO_COOKIE.REFRESH_TOKEN, config.appId)\n    )?.value;\n\n    if (!refreshToken) {\n      console.log('No refresh token found');\n      return null;\n    }\n\n    try {\n      const refreshResult = await performTokenRefresh(refreshToken, config);\n\n      // Set new tokens in cookies\n      cookies.set(\n        namespacedCookie(ECHO_COOKIE.ACCESS_TOKEN, config.appId),\n        refreshResult.access_token,\n        {\n          httpOnly: true,\n          secure: process.env.NODE_ENV === 'production',\n          sameSite: 'lax',\n          maxAge: refreshResult.expires_in,\n          path: '/',\n        }\n      );\n\n      cookies.set(\n        namespacedCookie(ECHO_COOKIE.REFRESH_TOKEN, config.appId),\n        refreshResult.refresh_token,\n        {\n          httpOnly: true,\n          secure: process.env.NODE_ENV === 'production',\n          sameSite: 'lax',\n          maxAge: refreshResult.refresh_token_expires_in,\n          path: '/',\n        }\n      );\n\n      // Store refresh token expiry time for checking\n      cookies.set(\n        namespacedCookie(ECHO_COOKIE.REFRESH_TOKEN_EXPIRES, config.appId),\n        String(\n          Math.floor(Date.now() / 1000) + refreshResult.refresh_token_expires_in\n        ),\n        {\n          httpOnly: true,\n          secure: process.env.NODE_ENV === 'production',\n          sameSite: 'lax',\n          maxAge: refreshResult.refresh_token_expires_in,\n          path: '/',\n        }\n      );\n\n      return refreshResult.access_token;\n    } catch (error) {\n      console.error('Token refresh failed:', refreshToken, error);\n      return null;\n    }\n  }\n\n  return accessToken;\n}\n\nexport async function getUser(config: EchoConfig): Promise<User> {\n  const echo = await getEchoClient(config);\n  if (!echo) {\n    throw new Error('User not signed in');\n  }\n  return echo.users.getUserInfo();\n}\n\nexport async function getEchoClient(\n  config: EchoConfig\n): Promise<EchoClient | null> {\n  const token = await getEchoToken(config);\n  if (!token) {\n    return null;\n  }\n  return new EchoClient({\n    baseUrl: resolveEchoBaseUrl(config),\n    apiKey: token,\n  });\n}\n","import { ECHO_BASE_URL } from '@merit-systems/echo-typescript-sdk';\nimport type { EchoConfig } from './types';\n\nexport function resolveEchoBaseUrl(config: EchoConfig): string {\n  return config.baseEchoUrl || ECHO_BASE_URL;\n}\n","export const ECHO_COOKIE = {\n  ACCESS_TOKEN: 'echo_access_token',\n  REFRESH_TOKEN: 'echo_refresh_token',\n  REFRESH_TOKEN_EXPIRES: 'echo_refresh_token_expires',\n  USER_INFO: 'echo_user_info',\n  CODE_VERIFIER: 'echo_code_verifier',\n} as const;\n\nexport type EchoCookieName = (typeof ECHO_COOKIE)[keyof typeof ECHO_COOKIE];\n\nexport function namespacedCookie(name: EchoCookieName, appId: string): string {\n  // Ensure consistent delimiter and avoid accidental double underscores\n  return `${name}_${appId}`;\n}\n","import { jwtDecode } from 'jwt-decode';\n\ninterface JwtPayload {\n  exp?: number;\n}\n\n/**\n * Check if a JWT token needs to be refreshed\n * @param token - The JWT access token to check\n * @returns true if token should be refreshed, false otherwise\n */\nexport function shouldRefreshToken(token: string): boolean {\n  try {\n    const decoded = jwtDecode<JwtPayload>(token);\n    if (!decoded.exp) return true;\n\n    const now = Math.floor(Date.now() / 1000);\n    // Refresh if token expires within 30 seconds\n    const bufferTime = 30;\n    return decoded.exp <= now + bufferTime;\n  } catch {\n    return true; // If we can't decode, assume it needs refresh\n  }\n}\n","import {\n  createEchoGoogle as createEchoGoogleBase,\n  EchoConfig,\n  GoogleGenerativeAIProvider,\n} from '@merit-systems/echo-typescript-sdk';\nimport { getEchoToken } from '../auth/token-manager';\n\nexport function createEchoGoogle(\n  config: EchoConfig\n): GoogleGenerativeAIProvider {\n  return createEchoGoogleBase(config, async () => getEchoToken(config));\n}\n","import { getEchoToken } from '../auth/token-manager';\nimport {\n  createEchoOpenAI as createEchoOpenAIBase,\n  EchoConfig,\n  OpenAIProvider,\n} from '@merit-systems/echo-typescript-sdk';\n\nexport function createEchoOpenAI(config: EchoConfig): OpenAIProvider {\n  return createEchoOpenAIBase(config, async () => getEchoToken(config));\n}\n","import { NextRequest, NextResponse } from 'next/server';\nimport { getEchoToken } from '../auth/token-manager';\nimport { EchoConfig } from '../types';\n/**\n * Proxy requests to Echo service with automatic authentication\n */\nexport async function handleEchoClientProxy(\n  req: NextRequest,\n  config: EchoConfig\n): Promise<Response> {\n  const proxyPath = req.nextUrl.pathname.replace(/^.*\\/proxy/, '');\n  const baseUrl = config.baseEchoUrl || 'https://echo.merit.systems';\n  const targetUrl = `${baseUrl}${proxyPath}`;\n\n  const headers = new Headers(req.headers);\n  headers.delete('host');\n  // Don't ask upstream to compress\n  headers.delete('accept-encoding');\n  headers.set('accept-encoding', 'identity');\n\n  // Optional: also drop conditional headers to avoid weirdness\n  headers.delete('if-none-match');\n  headers.delete('if-modified-since');\n\n  // Get valid token using existing function (handles refresh automatically)\n  const accessToken = await getEchoToken(config);\n\n  if (!accessToken) {\n    return NextResponse.json(\n      { error: 'Authentication required' },\n      { status: 401 }\n    );\n  }\n  // Inject the valid token\n  headers.set('Authorization', `Bearer ${accessToken}`);\n  try {\n    const response = await fetch(targetUrl, {\n      method: req.method,\n      headers,\n      ...(req.method !== 'GET' &&\n        req.method !== 'HEAD' && {\n          body: req.body,\n          duplex: 'half',\n        }),\n    });\n\n    return response;\n  } catch (error) {\n    console.error('Proxy request failed:', error);\n    return NextResponse.json(\n      { error: 'Proxy request failed' },\n      { status: 500 }\n    );\n  }\n}\n","import { EchoConfig } from '@merit-systems/echo-typescript-sdk';\nimport { NextRequest, NextResponse } from 'next/server';\nimport { resolveEchoBaseUrl } from '../config';\nimport { ECHO_COOKIE, namespacedCookie } from './cookie-names';\nimport { getEchoToken, RefreshTokenResponse } from './token-manager';\n\n/**\n * Generate PKCE code challenge and verifier\n * @returns Object containing code verifier and challenge\n */\nasync function generateCodeChallenge(): Promise<{\n  codeVerifier: string;\n  codeChallenge: string;\n}> {\n  const codeVerifier = Array.from(crypto.getRandomValues(new Uint8Array(32)))\n    .map(b => b.toString(16).padStart(2, '0'))\n    .join('');\n\n  const encoder = new TextEncoder();\n  const codeChallengeBuffer = await crypto.subtle.digest(\n    'SHA-256',\n    encoder.encode(codeVerifier)\n  );\n\n  const codeChallenge = btoa(\n    String.fromCharCode(...new Uint8Array(codeChallengeBuffer))\n  )\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n\n  return { codeVerifier, codeChallenge };\n}\n\n/**\n * Handle OAuth signin request - redirect to Echo authorization server\n * @param req - The incoming Next.js request\n * @param config - Echo configuration\n * @returns NextResponse with redirect to authorization server\n */\nexport async function handleSignIn(\n  req: NextRequest,\n  config: EchoConfig\n): Promise<NextResponse> {\n  const { origin } = req.nextUrl;\n  const basePath = config.basePath || '/api/echo';\n\n  const baseUrl = resolveEchoBaseUrl(config);\n\n  const redirectUrl = new URL(`${baseUrl}/api/oauth/authorize`);\n  redirectUrl.searchParams.set('client_id', config.appId);\n  redirectUrl.searchParams.set('redirect_uri', `${origin}${basePath}/callback`);\n  redirectUrl.searchParams.set('response_type', 'code');\n\n  const { codeVerifier, codeChallenge } = await generateCodeChallenge();\n\n  redirectUrl.searchParams.set('code_challenge', codeChallenge);\n  redirectUrl.searchParams.set('code_challenge_method', 'S256');\n\n  // Create response with redirect and set cookie for code verifier\n  const response = NextResponse.redirect(redirectUrl.toString());\n\n  // Set the code verifier in a secure cookie that will be available during callback\n  response.cookies.set(\n    namespacedCookie(ECHO_COOKIE.CODE_VERIFIER, config.appId),\n    codeVerifier,\n    {\n      httpOnly: true,\n      secure: process.env.NODE_ENV === 'production',\n      sameSite: 'lax',\n      maxAge: 300, // 5 minutes - same as auth code TTL\n      path: '/',\n    }\n  );\n\n  return response;\n}\n\n/**\n * Handle OAuth signout request - redirect to home page and clear cookies\n * @param req - The incoming Next.js request\n * @param config - Echo configuration\n * @returns NextResponse with redirect to home page and cookies cleared\n */\nexport async function handleSignOut(\n  req: NextRequest,\n  config: EchoConfig\n): Promise<NextResponse> {\n  const { origin } = req.nextUrl;\n  const response = NextResponse.redirect(`${origin}`);\n\n  response.cookies.delete(\n    namespacedCookie(ECHO_COOKIE.ACCESS_TOKEN, config.appId)\n  );\n  response.cookies.delete(\n    namespacedCookie(ECHO_COOKIE.REFRESH_TOKEN, config.appId)\n  );\n  response.cookies.delete(\n    namespacedCookie(ECHO_COOKIE.USER_INFO, config.appId)\n  );\n  response.cookies.delete(\n    namespacedCookie(ECHO_COOKIE.REFRESH_TOKEN_EXPIRES, config.appId)\n  );\n\n  return response;\n}\n\n/**\n * Handle OAuth callback - exchange authorization code for tokens\n * @param req - The incoming Next.js request\n * @param config - Echo configuration\n\n  response.cookies.set('echo_access_token', '', {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    maxAge: 0,\n    path: '/',\n  });\n * @returns NextResponse with redirect to home page and tokens set as cookies\n */\nexport async function handleCallback(\n  req: NextRequest,\n  config: EchoConfig\n): Promise<NextResponse> {\n  const { origin } = req.nextUrl;\n  const basePath = config.basePath || '/api/echo';\n\n  const code = req.nextUrl.searchParams.get('code');\n  const state = req.nextUrl.searchParams.get('state');\n\n  if (!code || !state) {\n    return NextResponse.json({ error: 'Invalid request' }, { status: 400 });\n  }\n\n  // Retrieve the code verifier from the cookie\n  const codeVerifier = req.cookies.get(\n    namespacedCookie(ECHO_COOKIE.CODE_VERIFIER, config.appId)\n  )?.value;\n\n  if (!codeVerifier) {\n    return NextResponse.json(\n      { error: 'Code verifier not found. Please try signing in again.' },\n      { status: 400 }\n    );\n  }\n\n  // Exchange the code for a token from the token endpoint\n  const tokenEndpoint = `${resolveEchoBaseUrl(config)}/api/oauth/token`;\n\n  const params = new URLSearchParams();\n  params.set('grant_type', 'authorization_code');\n  params.set('code', code);\n  params.set('redirect_uri', `${origin}${basePath}/callback`);\n  params.set('client_id', config.appId);\n  params.set('code_verifier', codeVerifier);\n\n  const tokenResponse = await fetch(tokenEndpoint, {\n    method: 'POST',\n    headers: {\n      'Content-Type': 'application/x-www-form-urlencoded',\n      'x-client-user-agent': req.headers.get('user-agent') || '',\n      'x-client-ip':\n        req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || '',\n    },\n    body: params.toString(),\n  });\n\n  if (!tokenResponse.ok) {\n    return NextResponse.json(\n      { error: 'Token exchange failed' },\n      { status: 500 }\n    );\n  }\n\n  const tokenData = (await tokenResponse.json()) as RefreshTokenResponse;\n\n  const response = NextResponse.redirect(`${origin}`);\n\n  // Clear the code verifier cookie after successful token exchange\n  response.cookies.set(\n    namespacedCookie(ECHO_COOKIE.CODE_VERIFIER, config.appId),\n    '',\n    {\n      httpOnly: true,\n      secure: process.env.NODE_ENV === 'production',\n      sameSite: 'lax',\n      maxAge: 0, // Expire immediately\n      path: '/',\n    }\n  );\n\n  // Set the access token as a cookie\n  response.cookies.set(\n    namespacedCookie(ECHO_COOKIE.ACCESS_TOKEN, config.appId),\n    tokenData.access_token,\n    {\n      httpOnly: true,\n      secure: process.env.NODE_ENV === 'production',\n      sameSite: 'lax',\n      maxAge: tokenData.expires_in, // expires_in is typically in seconds\n      path: '/',\n    }\n  );\n\n  response.cookies.set(\n    namespacedCookie(ECHO_COOKIE.REFRESH_TOKEN, config.appId),\n    tokenData.refresh_token,\n    {\n      httpOnly: true,\n      secure: process.env.NODE_ENV === 'production',\n      sameSite: 'lax',\n      maxAge: tokenData.refresh_token_expires_in,\n      path: '/',\n    }\n  );\n\n  response.cookies.set(\n    namespacedCookie(ECHO_COOKIE.USER_INFO, config.appId),\n    JSON.stringify(tokenData.user),\n    {\n      httpOnly: true,\n      secure: process.env.NODE_ENV === 'production',\n      sameSite: 'lax',\n      maxAge: tokenData.refresh_token_expires_in,\n      path: '/',\n    }\n  );\n\n  // Store refresh token expiry time for checking\n  response.cookies.set(\n    namespacedCookie(ECHO_COOKIE.REFRESH_TOKEN_EXPIRES, config.appId),\n    String(Math.floor(Date.now() / 1000) + tokenData.refresh_token_expires_in),\n    {\n      httpOnly: true,\n      secure: process.env.NODE_ENV === 'production',\n      sameSite: 'lax',\n      maxAge: tokenData.refresh_token_expires_in,\n      path: '/',\n    }\n  );\n\n  return response;\n}\n\nexport async function handleRefresh(\n  req: NextRequest,\n  config: EchoConfig\n): Promise<NextResponse> {\n  try {\n    const token = await getEchoToken(config);\n    if (!token) {\n      return NextResponse.json({ error: 'No token found' }, { status: 401 });\n    }\n\n    return NextResponse.json({ success: true });\n  } catch (error) {\n    console.error('Error refreshing token:', error);\n    return NextResponse.json(\n      { error: 'Error refreshing token' },\n      { status: 500 }\n    );\n  }\n}\n"],"mappings":";AAAA,SAAS,eAAe;AACxB,SAAsB,gBAAAA,qBAAoB;;;ACD1C;AAAA,EAEE,uBAAuB;AAAA,OAElB;;;ACJP;AAAA,EACE;AAAA,OAGK;AACP,SAAS,WAAW,kBAAkB;;;ACLtC,SAAS,qBAAqB;AAGvB,SAAS,mBAAmB,QAA4B;AAC7D,SAAO,OAAO,eAAe;AAC/B;;;ACLO,IAAM,cAAc;AAAA,EACzB,cAAc;AAAA,EACd,eAAe;AAAA,EACf,uBAAuB;AAAA,EACvB,WAAW;AAAA,EACX,eAAe;AACjB;AAIO,SAAS,iBAAiB,MAAsB,OAAuB;AAE5E,SAAO,GAAG,IAAI,IAAI,KAAK;AACzB;;;ACbA,SAAS,iBAAiB;AAWnB,SAAS,mBAAmB,OAAwB;AACzD,MAAI;AACF,UAAM,UAAU,UAAsB,KAAK;AAC3C,QAAI,CAAC,QAAQ,IAAK,QAAO;AAEzB,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAExC,UAAM,aAAa;AACnB,WAAO,QAAQ,OAAO,MAAM;AAAA,EAC9B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AHYA,eAAsB,oBACpB,cACA,QAC+B;AAC/B,SAAO,MAAM,GAAG,mBAAmB,MAAM,CAAC,oBAAoB;AAAA,IAC5D,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU;AAAA,MACnB,YAAY;AAAA,MACZ,eAAe;AAAA,MACf,WAAW,OAAO;AAAA,IACpB,CAAC;AAAA,EACH,CAAC,EAAE,KAAK,OAAM,MAAK;AACjB,QAAI,EAAE,IAAI;AACR,YAAM,YAAa,MAAM,EAAE,KAAK;AAChC,aAAO;AAAA,IACT;AACA,WAAO,QAAQ,OAAO,IAAI,MAAM,MAAM,EAAE,KAAK,CAAC,CAAC;AAAA,EACjD,CAAC;AACH;AAOA,eAAsB,aAAa,QAA4C;AAC7E,QAAMC,WAAU,MAAM,WAAW;AACjC,QAAM,cAAcA,SAAQ;AAAA,IAC1B,iBAAiB,YAAY,cAAc,OAAO,KAAK;AAAA,EACzD,GAAG;AAGH,MAAI,CAAC,eAAe,mBAAmB,WAAW,GAAG;AACnD,UAAM,eAAeA,SAAQ;AAAA,MAC3B,iBAAiB,YAAY,eAAe,OAAO,KAAK;AAAA,IAC1D,GAAG;AAEH,QAAI,CAAC,cAAc;AACjB,cAAQ,IAAI,wBAAwB;AACpC,aAAO;AAAA,IACT;AAEA,QAAI;AACF,YAAM,gBAAgB,MAAM,oBAAoB,cAAc,MAAM;AAGpE,MAAAA,SAAQ;AAAA,QACN,iBAAiB,YAAY,cAAc,OAAO,KAAK;AAAA,QACvD,cAAc;AAAA,QACd;AAAA,UACE,UAAU;AAAA,UACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,UACjC,UAAU;AAAA,UACV,QAAQ,cAAc;AAAA,UACtB,MAAM;AAAA,QACR;AAAA,MACF;AAEA,MAAAA,SAAQ;AAAA,QACN,iBAAiB,YAAY,eAAe,OAAO,KAAK;AAAA,QACxD,cAAc;AAAA,QACd;AAAA,UACE,UAAU;AAAA,UACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,UACjC,UAAU;AAAA,UACV,QAAQ,cAAc;AAAA,UACtB,MAAM;AAAA,QACR;AAAA,MACF;AAGA,MAAAA,SAAQ;AAAA,QACN,iBAAiB,YAAY,uBAAuB,OAAO,KAAK;AAAA,QAChE;AAAA,UACE,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,cAAc;AAAA,QAChD;AAAA,QACA;AAAA,UACE,UAAU;AAAA,UACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,UACjC,UAAU;AAAA,UACV,QAAQ,cAAc;AAAA,UACtB,MAAM;AAAA,QACR;AAAA,MACF;AAEA,aAAO,cAAc;AAAA,IACvB,SAAS,OAAO;AACd,cAAQ,MAAM,yBAAyB,cAAc,KAAK;AAC1D,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;;;AD1HO,SAAS,oBAAoB,QAAuC;AACzE,SAAO,wBAAwB,QAAQ,YAAY,aAAa,MAAM,CAAC;AACzE;;;AKTA;AAAA,EACE,oBAAoB;AAAA,OAGf;AAGA,SAAS,iBACd,QAC4B;AAC5B,SAAO,qBAAqB,QAAQ,YAAY,aAAa,MAAM,CAAC;AACtE;;;ACVA;AAAA,EACE,oBAAoB;AAAA,OAGf;AAEA,SAAS,iBAAiB,QAAoC;AACnE,SAAO,qBAAqB,QAAQ,YAAY,aAAa,MAAM,CAAC;AACtE;;;ACTA,SAAsB,oBAAoB;AAM1C,eAAsB,sBACpB,KACA,QACmB;AACnB,QAAM,YAAY,IAAI,QAAQ,SAAS,QAAQ,cAAc,EAAE;AAC/D,QAAM,UAAU,OAAO,eAAe;AACtC,QAAM,YAAY,GAAG,OAAO,GAAG,SAAS;AAExC,QAAM,UAAU,IAAI,QAAQ,IAAI,OAAO;AACvC,UAAQ,OAAO,MAAM;AAErB,UAAQ,OAAO,iBAAiB;AAChC,UAAQ,IAAI,mBAAmB,UAAU;AAGzC,UAAQ,OAAO,eAAe;AAC9B,UAAQ,OAAO,mBAAmB;AAGlC,QAAM,cAAc,MAAM,aAAa,MAAM;AAE7C,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,0BAA0B;AAAA,MACnC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,UAAQ,IAAI,iBAAiB,UAAU,WAAW,EAAE;AACpD,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,WAAW;AAAA,MACtC,QAAQ,IAAI;AAAA,MACZ;AAAA,MACA,GAAI,IAAI,WAAW,SACjB,IAAI,WAAW,UAAU;AAAA,QACvB,MAAM,IAAI;AAAA,QACV,QAAQ;AAAA,MACV;AAAA,IACJ,CAAC;AAED,WAAO;AAAA,EACT,SAAS,OAAO;AACd,YAAQ,MAAM,yBAAyB,KAAK;AAC5C,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uBAAuB;AAAA,MAChC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;;;ACrDA,SAAsB,gBAAAC,qBAAoB;AAS1C,eAAe,wBAGZ;AACD,QAAM,eAAe,MAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,CAAC,EACvE,IAAI,OAAK,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EACxC,KAAK,EAAE;AAEV,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,sBAAsB,MAAM,OAAO,OAAO;AAAA,IAC9C;AAAA,IACA,QAAQ,OAAO,YAAY;AAAA,EAC7B;AAEA,QAAM,gBAAgB;AAAA,IACpB,OAAO,aAAa,GAAG,IAAI,WAAW,mBAAmB,CAAC;AAAA,EAC5D,EACG,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AAEpB,SAAO,EAAE,cAAc,cAAc;AACvC;AAQA,eAAsB,aACpB,KACA,QACuB;AACvB,QAAM,EAAE,OAAO,IAAI,IAAI;AACvB,QAAM,WAAW,OAAO,YAAY;AAEpC,QAAM,UAAU,mBAAmB,MAAM;AAEzC,QAAM,cAAc,IAAI,IAAI,GAAG,OAAO,sBAAsB;AAC5D,cAAY,aAAa,IAAI,aAAa,OAAO,KAAK;AACtD,cAAY,aAAa,IAAI,gBAAgB,GAAG,MAAM,GAAG,QAAQ,WAAW;AAC5E,cAAY,aAAa,IAAI,iBAAiB,MAAM;AAEpD,QAAM,EAAE,cAAc,cAAc,IAAI,MAAM,sBAAsB;AAEpE,cAAY,aAAa,IAAI,kBAAkB,aAAa;AAC5D,cAAY,aAAa,IAAI,yBAAyB,MAAM;AAG5D,QAAM,WAAWC,cAAa,SAAS,YAAY,SAAS,CAAC;AAG7D,WAAS,QAAQ;AAAA,IACf,iBAAiB,YAAY,eAAe,OAAO,KAAK;AAAA,IACxD;AAAA,IACA;AAAA,MACE,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ;AAAA;AAAA,MACR,MAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO;AACT;AAQA,eAAsB,cACpB,KACA,QACuB;AACvB,QAAM,EAAE,OAAO,IAAI,IAAI;AACvB,QAAM,WAAWA,cAAa,SAAS,GAAG,MAAM,EAAE;AAElD,WAAS,QAAQ;AAAA,IACf,iBAAiB,YAAY,cAAc,OAAO,KAAK;AAAA,EACzD;AACA,WAAS,QAAQ;AAAA,IACf,iBAAiB,YAAY,eAAe,OAAO,KAAK;AAAA,EAC1D;AACA,WAAS,QAAQ;AAAA,IACf,iBAAiB,YAAY,WAAW,OAAO,KAAK;AAAA,EACtD;AACA,WAAS,QAAQ;AAAA,IACf,iBAAiB,YAAY,uBAAuB,OAAO,KAAK;AAAA,EAClE;AAEA,SAAO;AACT;AAgBA,eAAsB,eACpB,KACA,QACuB;AACvB,QAAM,EAAE,OAAO,IAAI,IAAI;AACvB,QAAM,WAAW,OAAO,YAAY;AAEpC,QAAM,OAAO,IAAI,QAAQ,aAAa,IAAI,MAAM;AAChD,QAAM,QAAQ,IAAI,QAAQ,aAAa,IAAI,OAAO;AAElD,MAAI,CAAC,QAAQ,CAAC,OAAO;AACnB,WAAOA,cAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAGA,QAAM,eAAe,IAAI,QAAQ;AAAA,IAC/B,iBAAiB,YAAY,eAAe,OAAO,KAAK;AAAA,EAC1D,GAAG;AAEH,MAAI,CAAC,cAAc;AACjB,WAAOA,cAAa;AAAA,MAClB,EAAE,OAAO,wDAAwD;AAAA,MACjE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAGA,QAAM,gBAAgB,GAAG,mBAAmB,MAAM,CAAC;AAEnD,QAAM,SAAS,IAAI,gBAAgB;AACnC,SAAO,IAAI,cAAc,oBAAoB;AAC7C,SAAO,IAAI,QAAQ,IAAI;AACvB,SAAO,IAAI,gBAAgB,GAAG,MAAM,GAAG,QAAQ,WAAW;AAC1D,SAAO,IAAI,aAAa,OAAO,KAAK;AACpC,SAAO,IAAI,iBAAiB,YAAY;AAExC,QAAM,gBAAgB,MAAM,MAAM,eAAe;AAAA,IAC/C,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,uBAAuB,IAAI,QAAQ,IAAI,YAAY,KAAK;AAAA,MACxD,eACE,IAAI,QAAQ,IAAI,iBAAiB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAAK;AAAA,IACjE;AAAA,IACA,MAAM,OAAO,SAAS;AAAA,EACxB,CAAC;AAED,MAAI,CAAC,cAAc,IAAI;AACrB,WAAOA,cAAa;AAAA,MAClB,EAAE,OAAO,wBAAwB;AAAA,MACjC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAa,MAAM,cAAc,KAAK;AAE5C,QAAM,WAAWA,cAAa,SAAS,GAAG,MAAM,EAAE;AAGlD,WAAS,QAAQ;AAAA,IACf,iBAAiB,YAAY,eAAe,OAAO,KAAK;AAAA,IACxD;AAAA,IACA;AAAA,MACE,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ;AAAA;AAAA,MACR,MAAM;AAAA,IACR;AAAA,EACF;AAGA,WAAS,QAAQ;AAAA,IACf,iBAAiB,YAAY,cAAc,OAAO,KAAK;AAAA,IACvD,UAAU;AAAA,IACV;AAAA,MACE,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ,UAAU;AAAA;AAAA,MAClB,MAAM;AAAA,IACR;AAAA,EACF;AAEA,WAAS,QAAQ;AAAA,IACf,iBAAiB,YAAY,eAAe,OAAO,KAAK;AAAA,IACxD,UAAU;AAAA,IACV;AAAA,MACE,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ,UAAU;AAAA,MAClB,MAAM;AAAA,IACR;AAAA,EACF;AAEA,WAAS,QAAQ;AAAA,IACf,iBAAiB,YAAY,WAAW,OAAO,KAAK;AAAA,IACpD,KAAK,UAAU,UAAU,IAAI;AAAA,IAC7B;AAAA,MACE,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ,UAAU;AAAA,MAClB,MAAM;AAAA,IACR;AAAA,EACF;AAGA,WAAS,QAAQ;AAAA,IACf,iBAAiB,YAAY,uBAAuB,OAAO,KAAK;AAAA,IAChE,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,UAAU,wBAAwB;AAAA,IACzE;AAAA,MACE,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ,UAAU;AAAA,MAClB,MAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO;AACT;AAEA,eAAsB,cACpB,KACA,QACuB;AACvB,MAAI;AACF,UAAM,QAAQ,MAAM,aAAa,MAAM;AACvC,QAAI,CAAC,OAAO;AACV,aAAOA,cAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACvE;AAEA,WAAOA,cAAa,KAAK,EAAE,SAAS,KAAK,CAAC;AAAA,EAC5C,SAAS,OAAO;AACd,YAAQ,MAAM,2BAA2B,KAAK;AAC9C,WAAOA,cAAa;AAAA,MAClB,EAAE,OAAO,yBAAyB;AAAA,MAClC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;;;AThPe,SAAR,KAAsB,QAAgC;AAI3D,QAAM,cAAc,OAAO,QAAwC;AACjE,UAAM,EAAE,SAAS,IAAI,IAAI;AACzB,UAAM,WAAW,OAAO,YAAY;AACpC,UAAM,OAAO,SAAS,QAAQ,UAAU,EAAE;AAE1C,QAAI,KAAK,WAAW,QAAQ,GAAG;AAC7B,aAAO,sBAAsB,KAAK,MAAM;AAAA,IAC1C;AAEA,YAAQ,MAAM;AAAA;AAAA,MAEZ,KAAK;AACH,eAAO,aAAa,KAAK,MAAM;AAAA,MAEjC,KAAK;AACH,eAAO,cAAc,KAAK,MAAM;AAAA,MAElC,KAAK;AACH,eAAO,eAAe,KAAK,MAAM;AAAA,MAEnC,KAAK;AACH,eAAO,cAAc,KAAK,MAAM;AAAA,MAElC;AACE,gBAAQ,MAAM,gBAAgB,IAAI;AAClC,eAAOC,cAAa,MAAM;AAAA,IAC9B;AAAA,EACF;AAKA,QAAM,UAAU,YAAY;AAE1B,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,WAAW,YAAY;AAAA,MAC3B,iBAAiB,YAAY,WAAW,OAAO,KAAK;AAAA,IACtD,GAAG;AACH,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,IACT;AACA,UAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,YAAY;AAC7B,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,qBAAqB,YAAY;AAAA,MACrC,iBAAiB,YAAY,uBAAuB,OAAO,KAAK;AAAA,IAClE,GAAG;AAEH,QAAI,CAAC,oBAAoB;AACvB,aAAO;AAAA,IACT;AAEA,UAAM,aAAa,SAAS,kBAAkB;AAC9C,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAExC,WAAO,aAAa;AAAA,EACtB;AAEA,SAAO;AAAA;AAAA,IAEL,UAAU;AAAA,MACR,KAAK;AAAA,MACL,MAAM;AAAA,IACR;AAAA;AAAA,IAGA;AAAA,IACA;AAAA;AAAA,IAGA,QAAQ,iBAAiB,MAAM;AAAA,IAC/B,WAAW,oBAAoB,MAAM;AAAA,IACrC,QAAQ,iBAAiB,MAAM;AAAA,EACjC;AACF;","names":["NextResponse","cookies","NextResponse","NextResponse","NextResponse"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@merit-systems/echo-next-sdk",
-  "version": "0.0.6",
+  "version": "0.0.9",
   "description": "Next.js SDK for Echo",
   "type": "module",
   "main": "./dist/index.js",
@@ -37,7 +37,7 @@
   "author": "Merit Systems",
   "license": "MIT",
   "dependencies": {
-    "@merit-systems/echo-typescript-sdk": "1.0.13",
+    "@merit-systems/echo-typescript-sdk": "1.0.14",
     "ai": "^5.0.17",
     "jwt-decode": "^4.0.0"
   },