@palbase/web 4.0.1 → 5.0.0

package/dist/next/client.js

@@ -6,8 +6,9 @@ import {
 import {
   __configure,
   getRuntime
-} from "../chunk-TGDS6VMT.js";
-import "../chunk-NXEPAEF5.js";
+} from "../chunk-XTQXFZUP.js";
+import "../chunk-BNAGRUIQ.js";
+import "../chunk-CFDU23TB.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/next/client.ts

package/dist/next/client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/next/client.ts"],"sourcesContent":["/**\n * '@palbase/web/next/client' — the browser half of the Next.js adapter. This entry\n * must NEVER import 'next' (it runs in plain client bundles); the cookie jar\n * is document.cookie itself, written with the shared codec so the server\n * side (pbServer / middleware / callback) reads the same bytes.\n */\nimport { __configure, getRuntime } from '../internal.js';\nimport type { PersistedSession, SessionStorageAdapter } from '../storage.js';\nimport {\n  clearedSessionCookieNames,\n  decodeSessionCookies,\n  encodeSessionCookies,\n} from './cookie-codec.js';\n\n/** 30 days — the refresh-token TTL (P3 design contract). */\nconst SESSION_MAX_AGE_S = 2_592_000;\n\n// Secure is unconditional, INCLUDING http://localhost: browsers treat\n// localhost as a potentially-trustworthy origin, so document.cookie accepts\n// Secure cookies there — no dev-mode special case needed. KNOWN LIMITATION:\n// plain-http origins OTHER than localhost — e.g. LAN-IP device testing on\n// http://192.168.x.x — are NOT trustworthy, so the browser silently DROPS\n// these Secure cookie writes and the session won't persist; use https (or a\n// localhost tunnel/port-forward) for on-device testing. NOT HttpOnly by\n// design: the browser SDK must read/write the session (Supabase-paradigm\n// tradeoff, documented in the P3 plan).\nconst WRITE_ATTRS = 'Path=/; SameSite=Lax; Secure';\n\n/** Parse document.cookie (\"a=1; b=2\") into a name → raw-value map. */\nfunction cookieJar(): Map<string, string> {\n  const jar = new Map<string, string>();\n  for (const part of document.cookie.split(';')) {\n    const eq = part.indexOf('=');\n    if (eq === -1) continue;\n    const name = part.slice(0, eq).trim();\n    if (name) jar.set(name, part.slice(eq + 1).trim());\n  }\n  return jar;\n}\n\nfunction deleteCookie(name: string): void {\n  // biome-ignore lint/suspicious/noDocumentCookie: SessionStorageAdapter is a SYNC contract; the async Cookie Store API can't back it (and isn't universal).\n  document.cookie = `${name}=; ${WRITE_ATTRS}; Max-Age=0`;\n}\n\n/**\n * document.cookie-backed SessionStorageAdapter. `load` returns the EXTENDED\n * PersistedSession (access token + expiry ride along) so hydration adopts\n * the full session without a refresh round-trip.\n */\nexport function cookieSessionStorage(environmentRef: string): SessionStorageAdapter {\n  return {\n    load(): PersistedSession | null {\n      if (typeof document === 'undefined') return null;\n      const jar = cookieJar();\n      const stored = decodeSessionCookies((name) => jar.get(name), environmentRef);\n      if (!stored) return null;\n      // A refresh-only save round-trips as a:'' / e:0 — normalize back to\n      // the legacy shape so hydration takes the expired-trick path cleanly.\n      return stored.accessToken && stored.expiresAt > 0\n        ? {\n            refreshToken: stored.refreshToken,\n            accessToken: stored.accessToken,\n            expiresAt: stored.expiresAt,\n          }\n        : { refreshToken: stored.refreshToken };\n    },\n    save(session: PersistedSession): void {\n      if (typeof document === 'undefined') return;\n      const jar = cookieJar();\n      // Delete every currently-present session cookie first (stale chunks of\n      // a previously-larger session, or a stale base when the new write\n      // chunks), then set the new cookie(s).\n      for (const name of clearedSessionCookieNames(environmentRef, (n) => jar.has(n))) {\n        deleteCookie(name);\n      }\n      const { set, clear } = encodeSessionCookies(environmentRef, {\n        accessToken: session.accessToken ?? '',\n        refreshToken: session.refreshToken,\n        expiresAt: session.expiresAt ?? 0,\n      });\n      for (const { name, value } of set) {\n        // biome-ignore lint/suspicious/noDocumentCookie: SessionStorageAdapter is a SYNC contract; the async Cookie Store API can't back it (and isn't universal).\n        document.cookie = `${name}=${value}; ${WRITE_ATTRS}; Max-Age=${SESSION_MAX_AGE_S}`;\n      }\n      // Overflow guard (codec contract): delete one-past-the-end so a stale\n      // orphan chunk behind a gap can never join a future chunk run.\n      for (const name of clear) deleteCookie(name);\n    },\n    clear(): void {\n      if (typeof document === 'undefined') return;\n      const jar = cookieJar();\n      for (const name of clearedSessionCookieNames(environmentRef, (n) => jar.has(n))) {\n        deleteCookie(name);\n      }\n    },\n  };\n}\n\n/**\n * One-liner for a client component/provider: re-configure the already-loaded\n * gen config (palbe.gen.ts must be imported first — throws the guided\n * notConfigured error otherwise) with cookie-backed session storage so the\n * browser and the server share the session. Calling it again simply\n * re-configures (safe, e.g. under fast refresh). When Next evaluates the\n * client component module server-side there is no document — no-op.\n */\nexport function setupPalbeNext(): void {\n  if (typeof document === 'undefined') return;\n  const config = getRuntime().config;\n  __configure({\n    ...config,\n    storage: cookieSessionStorage(config.environmentRef),\n  });\n}\n"],"mappings":";;;;;;;;;;;;;AAeA,IAAM,oBAAoB;AAW1B,IAAM,cAAc;AAGpB,SAAS,YAAiC;AACxC,QAAM,MAAM,oBAAI,IAAoB;AACpC,aAAW,QAAQ,SAAS,OAAO,MAAM,GAAG,GAAG;AAC7C,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,OAAO,GAAI;AACf,UAAM,OAAO,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK;AACpC,QAAI,KAAM,KAAI,IAAI,MAAM,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,EACnD;AACA,SAAO;AACT;AAEA,SAAS,aAAa,MAAoB;AAExC,WAAS,SAAS,GAAG,IAAI,MAAM,WAAW;AAC5C;AAOO,SAAS,qBAAqB,gBAA+C;AAClF,SAAO;AAAA,IACL,OAAgC;AAC9B,UAAI,OAAO,aAAa,YAAa,QAAO;AAC5C,YAAM,MAAM,UAAU;AACtB,YAAM,SAAS,qBAAqB,CAAC,SAAS,IAAI,IAAI,IAAI,GAAG,cAAc;AAC3E,UAAI,CAAC,OAAQ,QAAO;AAGpB,aAAO,OAAO,eAAe,OAAO,YAAY,IAC5C;AAAA,QACE,cAAc,OAAO;AAAA,QACrB,aAAa,OAAO;AAAA,QACpB,WAAW,OAAO;AAAA,MACpB,IACA,EAAE,cAAc,OAAO,aAAa;AAAA,IAC1C;AAAA,IACA,KAAK,SAAiC;AACpC,UAAI,OAAO,aAAa,YAAa;AACrC,YAAM,MAAM,UAAU;AAItB,iBAAW,QAAQ,0BAA0B,gBAAgB,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,GAAG;AAC/E,qBAAa,IAAI;AAAA,MACnB;AACA,YAAM,EAAE,KAAK,MAAM,IAAI,qBAAqB,gBAAgB;AAAA,QAC1D,aAAa,QAAQ,eAAe;AAAA,QACpC,cAAc,QAAQ;AAAA,QACtB,WAAW,QAAQ,aAAa;AAAA,MAClC,CAAC;AACD,iBAAW,EAAE,MAAM,MAAM,KAAK,KAAK;AAEjC,iBAAS,SAAS,GAAG,IAAI,IAAI,KAAK,KAAK,WAAW,aAAa,iBAAiB;AAAA,MAClF;AAGA,iBAAW,QAAQ,MAAO,cAAa,IAAI;AAAA,IAC7C;AAAA,IACA,QAAc;AACZ,UAAI,OAAO,aAAa,YAAa;AACrC,YAAM,MAAM,UAAU;AACtB,iBAAW,QAAQ,0BAA0B,gBAAgB,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,GAAG;AAC/E,qBAAa,IAAI;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AACF;AAUO,SAAS,iBAAuB;AACrC,MAAI,OAAO,aAAa,YAAa;AACrC,QAAM,SAAS,WAAW,EAAE;AAC5B,cAAY;AAAA,IACV,GAAG;AAAA,IACH,SAAS,qBAAqB,OAAO,cAAc;AAAA,EACrD,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../../src/next/client.ts"],"sourcesContent":["/**\n * '@palbase/web/next/client' — the browser half of the Next.js adapter. This entry\n * must NEVER import 'next' (it runs in plain client bundles); the cookie jar\n * is document.cookie itself, written with the shared codec so the server\n * side (pbServer / middleware / callback) reads the same bytes.\n */\nimport { __configure, getRuntime } from '../internal.js';\nimport type { PersistedSession, SessionStorageAdapter } from '../storage.js';\nimport {\n  clearedSessionCookieNames,\n  decodeSessionCookies,\n  encodeSessionCookies,\n} from './cookie-codec.js';\n\n/** 30 days — the refresh-token TTL (P3 design contract). */\nconst SESSION_MAX_AGE_S = 2_592_000;\n\n// Secure is unconditional, INCLUDING http://localhost: browsers treat\n// localhost as a potentially-trustworthy origin, so document.cookie accepts\n// Secure cookies there — no dev-mode special case needed. KNOWN LIMITATION:\n// plain-http origins OTHER than localhost — e.g. LAN-IP device testing on\n// http://192.168.x.x — are NOT trustworthy, so the browser silently DROPS\n// these Secure cookie writes and the session won't persist; use https (or a\n// localhost tunnel/port-forward) for on-device testing. NOT HttpOnly by\n// design: the browser SDK must read/write the session (Supabase-paradigm\n// tradeoff, documented in the P3 plan).\nconst WRITE_ATTRS = 'Path=/; SameSite=Lax; Secure';\n\n/** Parse document.cookie (\"a=1; b=2\") into a name → raw-value map. */\nfunction cookieJar(): Map<string, string> {\n  const jar = new Map<string, string>();\n  for (const part of document.cookie.split(';')) {\n    const eq = part.indexOf('=');\n    if (eq === -1) continue;\n    const name = part.slice(0, eq).trim();\n    if (name) jar.set(name, part.slice(eq + 1).trim());\n  }\n  return jar;\n}\n\nfunction deleteCookie(name: string): void {\n  // biome-ignore lint/suspicious/noDocumentCookie: SessionStorageAdapter is a SYNC contract; the async Cookie Store API can't back it (and isn't universal).\n  document.cookie = `${name}=; ${WRITE_ATTRS}; Max-Age=0`;\n}\n\n/**\n * document.cookie-backed SessionStorageAdapter. `load` returns the EXTENDED\n * PersistedSession (access token + expiry ride along) so hydration adopts\n * the full session without a refresh round-trip.\n */\nexport function cookieSessionStorage(environmentRef: string): SessionStorageAdapter {\n  return {\n    load(): PersistedSession | null {\n      if (typeof document === 'undefined') return null;\n      const jar = cookieJar();\n      const stored = decodeSessionCookies((name) => jar.get(name), environmentRef);\n      if (!stored) return null;\n      // A refresh-only save round-trips as a:'' / e:0 — normalize back to\n      // the legacy shape so hydration takes the expired-trick path cleanly.\n      return stored.accessToken && stored.expiresAt > 0\n        ? {\n            refreshToken: stored.refreshToken,\n            accessToken: stored.accessToken,\n            expiresAt: stored.expiresAt,\n          }\n        : { refreshToken: stored.refreshToken };\n    },\n    save(session: PersistedSession): void {\n      if (typeof document === 'undefined') return;\n      const jar = cookieJar();\n      // Delete every currently-present session cookie first (stale chunks of\n      // a previously-larger session, or a stale base when the new write\n      // chunks), then set the new cookie(s).\n      for (const name of clearedSessionCookieNames(environmentRef, (n) => jar.has(n))) {\n        deleteCookie(name);\n      }\n      const { set, clear } = encodeSessionCookies(environmentRef, {\n        accessToken: session.accessToken ?? '',\n        refreshToken: session.refreshToken,\n        expiresAt: session.expiresAt ?? 0,\n      });\n      for (const { name, value } of set) {\n        // biome-ignore lint/suspicious/noDocumentCookie: SessionStorageAdapter is a SYNC contract; the async Cookie Store API can't back it (and isn't universal).\n        document.cookie = `${name}=${value}; ${WRITE_ATTRS}; Max-Age=${SESSION_MAX_AGE_S}`;\n      }\n      // Overflow guard (codec contract): delete one-past-the-end so a stale\n      // orphan chunk behind a gap can never join a future chunk run.\n      for (const name of clear) deleteCookie(name);\n    },\n    clear(): void {\n      if (typeof document === 'undefined') return;\n      const jar = cookieJar();\n      for (const name of clearedSessionCookieNames(environmentRef, (n) => jar.has(n))) {\n        deleteCookie(name);\n      }\n    },\n  };\n}\n\n/**\n * One-liner for a client component/provider: re-configure the already-loaded\n * gen config (palbe.gen.ts must be imported first — throws the guided\n * notConfigured error otherwise) with cookie-backed session storage so the\n * browser and the server share the session. Calling it again simply\n * re-configures (safe, e.g. under fast refresh). When Next evaluates the\n * client component module server-side there is no document — no-op.\n */\nexport function setupPalbeNext(): void {\n  if (typeof document === 'undefined') return;\n  const config = getRuntime().config;\n  __configure({\n    ...config,\n    storage: cookieSessionStorage(config.environmentRef),\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;AAeA,IAAM,oBAAoB;AAW1B,IAAM,cAAc;AAGpB,SAAS,YAAiC;AACxC,QAAM,MAAM,oBAAI,IAAoB;AACpC,aAAW,QAAQ,SAAS,OAAO,MAAM,GAAG,GAAG;AAC7C,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,OAAO,GAAI;AACf,UAAM,OAAO,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK;AACpC,QAAI,KAAM,KAAI,IAAI,MAAM,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,EACnD;AACA,SAAO;AACT;AAEA,SAAS,aAAa,MAAoB;AAExC,WAAS,SAAS,GAAG,IAAI,MAAM,WAAW;AAC5C;AAOO,SAAS,qBAAqB,gBAA+C;AAClF,SAAO;AAAA,IACL,OAAgC;AAC9B,UAAI,OAAO,aAAa,YAAa,QAAO;AAC5C,YAAM,MAAM,UAAU;AACtB,YAAM,SAAS,qBAAqB,CAAC,SAAS,IAAI,IAAI,IAAI,GAAG,cAAc;AAC3E,UAAI,CAAC,OAAQ,QAAO;AAGpB,aAAO,OAAO,eAAe,OAAO,YAAY,IAC5C;AAAA,QACE,cAAc,OAAO;AAAA,QACrB,aAAa,OAAO;AAAA,QACpB,WAAW,OAAO;AAAA,MACpB,IACA,EAAE,cAAc,OAAO,aAAa;AAAA,IAC1C;AAAA,IACA,KAAK,SAAiC;AACpC,UAAI,OAAO,aAAa,YAAa;AACrC,YAAM,MAAM,UAAU;AAItB,iBAAW,QAAQ,0BAA0B,gBAAgB,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,GAAG;AAC/E,qBAAa,IAAI;AAAA,MACnB;AACA,YAAM,EAAE,KAAK,MAAM,IAAI,qBAAqB,gBAAgB;AAAA,QAC1D,aAAa,QAAQ,eAAe;AAAA,QACpC,cAAc,QAAQ;AAAA,QACtB,WAAW,QAAQ,aAAa;AAAA,MAClC,CAAC;AACD,iBAAW,EAAE,MAAM,MAAM,KAAK,KAAK;AAEjC,iBAAS,SAAS,GAAG,IAAI,IAAI,KAAK,KAAK,WAAW,aAAa,iBAAiB;AAAA,MAClF;AAGA,iBAAW,QAAQ,MAAO,cAAa,IAAI;AAAA,IAC7C;AAAA,IACA,QAAc;AACZ,UAAI,OAAO,aAAa,YAAa;AACrC,YAAM,MAAM,UAAU;AACtB,iBAAW,QAAQ,0BAA0B,gBAAgB,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,GAAG;AAC/E,qBAAa,IAAI;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AACF;AAUO,SAAS,iBAAuB;AACrC,MAAI,OAAO,aAAa,YAAa;AACrC,QAAM,SAAS,WAAW,EAAE;AAC5B,cAAY;AAAA,IACV,GAAG;AAAA,IACH,SAAS,qBAAqB,OAAO,cAAc;AAAA,EACrD,CAAC;AACH;","names":[]}

package/dist/next/index.cjs

@@ -37,7 +37,6 @@ __export(next_exports, {
   encodeSessionCookiesDecoded: () => encodeSessionCookiesDecoded,
   environmentRefFromApiKey: () => environmentRefFromApiKey,
   handleAuthCallback: () => handleAuthCallback,
-  palbeMiddleware: () => palbeMiddleware,
   pbServer: () => pbServer,
   sessionCookieName: () => sessionCookieName
 });
@@ -57,8 +56,8 @@ function asWireAuthResult(raw) {
 }
 
 // src/api-key.ts
-var API_KEY_RE = /^pb_([a-z0-9]+)_[cs][A-Za-z0-9]{20}$/;
-var PUBLISHABLE_API_KEY_RE = /^pb_([a-z0-9]+)_c[A-Za-z0-9]{20}$/;
+var API_KEY_RE = /^pb_([a-z0-9]{4,24})_[cs][A-Za-z0-9]{20}$/;
+var PUBLISHABLE_API_KEY_RE = /^pb_([a-z0-9]{4,24})_c[A-Za-z0-9]{20}$/;
 function environmentRefFromApiKey(apiKey) {
   const m = API_KEY_RE.exec(apiKey);
   return m ? m[1] ?? "" : "";
@@ -168,7 +167,7 @@ var PalbaseError = class extends Error {
   }
 };
 var PALBASE_DEFAULT_HOST = "api.palbase.studio";
-var API_KEY_RE2 = /^pb_([a-z0-9]+)_c[A-Za-z0-9]{20}$/;
+var API_KEY_RE2 = /^pb_([a-z0-9]{4,24})_c[A-Za-z0-9]{20}$/;
 function parseEnvironmentRef(apiKey) {
   return API_KEY_RE2.exec(apiKey)?.[1] ?? null;
 }
@@ -545,6 +544,11 @@ var PERF_EXCLUDED_PREFIX = "/v1/analytics/";
 function isSelfTraced(path) {
   return path.startsWith(PERF_EXCLUDED_PREFIX);
 }
+function isSessionKilled(status, code) {
+  if (status === 401) return code === "session_revoked";
+  if (status === 403) return code === "subject_fenced" || code === "subject_erased";
+  return false;
+}
 function nowMs() {
   return typeof performance !== "undefined" && typeof performance.now === "function" ? performance.now() : Date.now();
 }
@@ -580,7 +584,7 @@ async function palbeRequest(rt, method, path, spec = {}) {
   let res;
   try {
     res = await attempt();
-    if (res.error?.status === 401 && rt.tokenManager.getRefreshToken() && rt.tokenManager.refreshFunction) {
+    if (res.error?.status === 401 && res.error.code !== "session_revoked" && rt.tokenManager.getRefreshToken() && rt.tokenManager.refreshFunction) {
       try {
         await rt.tokenManager.refreshSession();
       } catch (refreshErr) {
@@ -600,6 +604,9 @@ async function palbeRequest(rt, method, path, spec = {}) {
     if (!isAbort(e)) record(asPalbaseError(e)?.status ?? 0);
     throw e;
   }
+  if (res.error && isSessionKilled(res.error.status, res.error.code)) {
+    rt.auth.reactiveTeardown();
+  }
   record(res.error?.status ?? 200);
   return unwrap(res);
 }
@@ -1478,7 +1485,8 @@ var PalbeAuth = class {
         if (!this.signedInState) return;
         this.signedInState = false;
         this.cachedUser = null;
-        const reason = this.signingOut ? "userInitiated" : "sessionExpired";
+        const reason = this.nextSignOutReason ?? (this.signingOut ? "userInitiated" : "sessionExpired");
+        this.nextSignOutReason = null;
         this.emitState({ status: "signedOut" });
         this.emitEvent({ type: "signedOut", reason });
       } else if (event === "TOKEN_REFRESHED") {
@@ -1491,6 +1499,10 @@ var PalbeAuth = class {
   rt;
   cachedUser = null;
   signingOut = false;
+  // Explicit signedOut reason pinned for the NEXT session clear (deleteAccount /
+  // reactiveTeardown set it before clearSession; the SIGNED_OUT handler consumes
+  // it exactly once, then resets to null → normal signOut/expiry split resumes).
+  nextSignOutReason = null;
   signingIn = false;
   // suppresses AuthClient's TOKEN_REFRESHED during re-signIn
   signedInState = false;
@@ -1538,6 +1550,45 @@ var PalbeAuth = class {
       this.cachedUser = null;
     }
   }
+  /**
+   * Self-service account erasure ("right to be forgotten"). Calls palauth
+   * `DELETE /auth/user` (session-authed + fresh re-auth): password users pass
+   * `{ password }`; passwordless/OAuth users rely on a freshly stepped-up
+   * session. On 202 the erasure workflow is durably queued AND every session is
+   * already revoked server-side — so we tear down local state (mirroring
+   * `signOut()`'s clear, minus the pointless `/logout`) and emit
+   * `signedOut{reason:'accountDeleted'}`.
+   *
+   * On 401 `reauth_required` / 503 `not_configured` (or `erasure_unavailable`)
+   * the request throws BEFORE the teardown line, so the local session is left
+   * fully intact — the deletion did not happen and the user is still signed in.
+   */
+  async deleteAccount(params = {}) {
+    const res = await palbeRequest(this.rt, "DELETE", "/auth/user", {
+      body: params.password ? { password: params.password } : {}
+    });
+    this.nextSignOutReason = "accountDeleted";
+    this.rt.tokenManager.clearSession();
+    this.rt.storage.clear();
+    this.cachedUser = null;
+    return { erasureId: res.erasure_id };
+  }
+  /**
+   * @internal — invoked by the transport choke point (`request.ts`), not app code.
+   * Reactive teardown when the server reports the session is gone: a 403
+   * `subject_fenced`/`subject_erased` (subject being erased) or a 401
+   * `session_revoked`. Clears local state and emits
+   * `signedOut{reason:'sessionInvalid'}` exactly once (deduped by
+   * `signedInState`). An ordinary 403 authz denial does NOT reach here —
+   * `request.ts` matches only the exact session-kill codes.
+   */
+  reactiveTeardown() {
+    if (!this.signedInState) return;
+    this.nextSignOutReason = "sessionInvalid";
+    this.rt.tokenManager.clearSession();
+    this.rt.storage.clear();
+    this.cachedUser = null;
+  }
   async getUser() {
     const raw = await palbeRequest(this.rt, "GET", "/auth/user");
     return mapWireUser(raw);
@@ -8986,7 +9037,7 @@ function defaultSessionStorage(key) {
 }
 
 // src/version.ts
-var VERSION = "4.0.1";
+var VERSION = "5.0.0";
 
 // src/runtime.ts
 function buildRuntime(config) {
@@ -9366,7 +9417,7 @@ function getRuntime() {
   return rt;
 }
 
-// src/next/shared.ts
+// src/next/global-config.ts
 function requireGlobalConfig(hint) {
   try {
     return getRuntime().config;
@@ -9377,6 +9428,8 @@ function requireGlobalConfig(hint) {
     });
   }
 }
+
+// src/next/shared.ts
 var nextServerModule;
 async function importNextServer(caller) {
   nextServerModule ??= import("next/server");
@@ -9482,90 +9535,6 @@ function handleAuthCallback(opts) {
   };
 }
 
-// src/next/middleware.ts
-var DEFAULT_REFRESH_MARGIN_MS = 6e4;
-var inflightRefreshes = /* @__PURE__ */ new Map();
-function refreshSingleFlight(config, refreshToken) {
-  const existing = inflightRefreshes.get(refreshToken);
-  if (existing) return existing;
-  const pending = refresh(config, refreshToken).finally(() => {
-    inflightRefreshes.delete(refreshToken);
-  });
-  inflightRefreshes.set(refreshToken, pending);
-  return pending;
-}
-async function refresh(config, refreshToken) {
-  try {
-    const res = await fetch(`${config.url}/auth/token/refresh`, {
-      method: "POST",
-      headers: { apikey: config.apiKey, "content-type": "application/json" },
-      body: JSON.stringify({ refresh_token: refreshToken })
-    });
-    if (res.status === 400 || res.status === 401 || res.status === 403) {
-      return { kind: "terminal" };
-    }
-    if (!res.ok) return { kind: "transient" };
-    const raw = await res.json();
-    if (typeof raw === "object" && raw !== null) {
-      const obj = raw;
-      if (typeof obj.access_token === "string" && typeof obj.refresh_token === "string" && typeof obj.expires_in === "number") {
-        return {
-          kind: "rotated",
-          session: {
-            accessToken: obj.access_token,
-            refreshToken: obj.refresh_token,
-            expiresAt: Date.now() + obj.expires_in * 1e3
-          }
-        };
-      }
-    }
-    return { kind: "transient" };
-  } catch {
-    return { kind: "transient" };
-  }
-}
-async function palbeMiddleware(request, opts) {
-  const config = requireGlobalConfig(
-    "import the generated palbe.gen.ts at the top of middleware.ts \u2014 Next bundles middleware as its own module graph, so the layout.tsx import does not reach it."
-  );
-  const { NextResponse } = await importNextServer("palbeMiddleware");
-  const passThrough = () => opts?.response ?? NextResponse.next({ request });
-  const ref = config.environmentRef;
-  const session = decodeSessionCookies((name) => request.cookies.get(name)?.value, ref);
-  if (!session) return passThrough();
-  if (session.expiresAt - Date.now() > (opts?.refreshMarginMs ?? DEFAULT_REFRESH_MARGIN_MS)) {
-    return passThrough();
-  }
-  const outcome = await refreshSingleFlight(config, session.refreshToken);
-  if (outcome.kind === "transient") return passThrough();
-  const staleNames = clearedSessionCookieNames(ref, (name) => request.cookies.has(name));
-  if (outcome.kind === "terminal") {
-    for (const name of staleNames) request.cookies.delete(name);
-    const response2 = opts?.response ?? NextResponse.next({ request });
-    for (const name of staleNames) {
-      response2.cookies.set(name, "", { ...SESSION_COOKIE_ATTRS, maxAge: 0 });
-    }
-    response2.headers.set("cache-control", "private, no-store");
-    return response2;
-  }
-  const write = encodeSessionCookiesDecoded(ref, outcome.session);
-  for (const name of staleNames) request.cookies.delete(name);
-  for (const { name, value } of write.set) request.cookies.set(name, value);
-  for (const name of write.clear) request.cookies.delete(name);
-  const response = opts?.response ?? NextResponse.next({ request });
-  const written = new Set(write.set.map((c) => c.name));
-  for (const { name, value } of write.set) {
-    response.cookies.set(name, value, SESSION_COOKIE_ATTRS);
-  }
-  for (const name of /* @__PURE__ */ new Set([...write.clear, ...staleNames])) {
-    if (!written.has(name)) {
-      response.cookies.set(name, "", { ...SESSION_COOKIE_ATTRS, maxAge: 0 });
-    }
-  }
-  response.headers.set("cache-control", "private, no-store");
-  return response;
-}
-
 // src/next/server.ts
 function nextRequired(cause) {
   const detail = cause instanceof Error && cause.message ? ` (${cause.message})` : "";
@@ -9655,7 +9624,6 @@ async function pbServer(opts) {
   encodeSessionCookiesDecoded,
   environmentRefFromApiKey,
   handleAuthCallback,
-  palbeMiddleware,
   pbServer,
   sessionCookieName
 });