@payez/next-mvp 3.9.1 → 4.0.1

package/dist/routes/auth/viability.js

@@ -1,201 +0,0 @@
-"use strict";
-/**
- * Ready-to-Use Session Viability Route
- *
- * Checks if the current session is viable (valid and not expired).
- * Used by client-side code to determine if a refresh is needed.
- *
- * @example
- * ```typescript
- * // app/api/session/viability/route.ts
- * export { GET } from '@payez/next-mvp/routes/auth/viability';
- * ```
- *
- * @version 2.0.0
- * @since auth-ready-v2
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.GET = GET;
-const server_1 = require("next/server");
-const jwt_1 = require("next-auth/jwt");
-const session_store_1 = require("../../lib/session-store");
-const app_slug_1 = require("../../lib/app-slug");
-const idp_client_config_1 = require("../../lib/idp-client-config");
-/**
- * Get NextAuth secret from IDP config (cached).
- * NEVER use process.env.NEXTAUTH_SECRET at module level - it may not be set yet.
- */
-async function getNextAuthSecret() {
-    const config = await (0, idp_client_config_1.getIDPClientConfig)();
-    return config.nextAuthSecret || '';
-}
-/**
- * Get tenant-wide 2FA requirement from cached client config (from broker handshake)
- */
-async function getTenantRequiresTwoFactor() {
-    try {
-        const config = await (0, idp_client_config_1.getIDPClientConfig)();
-        return config.authSettings?.require2FA ?? true; // Default to true for security
-    }
-    catch {
-        console.warn('[VIABILITY] Could not get client config, defaulting tenantRequiresTwoFactor to true');
-        return true;
-    }
-}
-/**
- * GET /api/session/viability - Check if session is viable
- *
- * Returns:
- * - viable: boolean - Whether the session can be used
- * - needsRefresh: boolean - Whether a refresh is recommended
- * - expiresIn: number - Seconds until token expires
- */
-async function GET(req) {
-    try {
-        const cookieName = (0, app_slug_1.getJwtCookieName)();
-        const secret = await getNextAuthSecret();
-        const token = await (0, jwt_1.getToken)({ req, secret, cookieName });
-        if (!token) {
-            return server_1.NextResponse.json({
-                viable: false,
-                needsRefresh: false,
-                authenticated: false,
-                reason: 'No session found'
-            });
-        }
-        // Support both field names: sessionToken (auth.ts JWT) and redisSessionId (legacy)
-        const sessionToken = token.sessionToken || token.redisSessionId;
-        const session = sessionToken ? await (0, session_store_1.getSession)(sessionToken) : null;
-        // CRITICAL: Detect stale cookie state (JWT exists but Redis session missing)
-        if (sessionToken && !session) {
-            console.warn('[VIABILITY] Stale cookie detected - session not in Redis');
-            return server_1.NextResponse.json({
-                viable: false,
-                needsRefresh: false,
-                authenticated: false,
-                sessionToken, // Return sessionToken so middleware can detect and clear stale cookie
-                reason: 'Stale session - cookie exists but session not found in Redis'
-            });
-        }
-        // Check access token expiry
-        const now = Math.floor(Date.now() / 1000);
-        const accessTokenExpires = token.accessTokenExpires || token.exp;
-        if (!accessTokenExpires) {
-            // No expiry info, assume viable but recommend refresh
-            const tenantRequiresTwoFactor = await getTenantRequiresTwoFactor();
-            // CRITICAL: Check if MFA has expired (2FA TTL enforcement)
-            const mfaExpiresAt = session?.mfaExpiresAt || 0;
-            const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
-            // Check mfaVerified (normalized name) with fallback to twoFactorComplete for compatibility
-            const mfaVerifiedInSession = session?.mfaVerified ?? session?.twoFactorComplete ?? false;
-            // User has completed 2FA requirements if: they verified AND it hasn't expired
-            const userHasCompletedTenantTwoFactorRequirements = mfaVerifiedInSession && !mfaExpired;
-            // userStillNeedsTwoFactor = inverse of completed (matches session callback logic)
-            const userStillNeedsTwoFactor = !userHasCompletedTenantTwoFactorRequirements;
-            return server_1.NextResponse.json({
-                viable: true,
-                needsRefresh: true,
-                authenticated: true,
-                sessionToken,
-                // Clear names for middleware decision-making
-                tenantRequiresTwoFactor,
-                userHasCompletedTenantTwoFactorRequirements,
-                userStillNeedsTwoFactor,
-                // Legacy field names for backwards compatibility
-                requires2FA: tenantRequiresTwoFactor,
-                twoFactorComplete: userHasCompletedTenantTwoFactorRequirements,
-                accessTokenExpired: false,
-                reason: 'No expiry information'
-            });
-        }
-        // Convert to seconds if needed
-        const expiryTime = accessTokenExpires > 1000000000000
-            ? Math.floor(accessTokenExpires / 1000)
-            : accessTokenExpires;
-        const expiresIn = expiryTime - now;
-        const isExpired = expiresIn <= 0;
-        const needsRefresh = expiresIn <= 300; // 5 minutes buffer
-        // Check if we have refresh capability (check normalized field name first)
-        const hasRefreshToken = !!(session?.idpRefreshToken || session?.refreshToken || token.refreshToken);
-        // CLEAR NAMING: Tenant-wide 2FA requirement from client config
-        const tenantRequiresTwoFactor = await getTenantRequiresTwoFactor();
-        // CRITICAL: Check if MFA has expired (2FA TTL enforcement)
-        // The session may have mfaVerified=true from days ago, but if mfaExpiresAt
-        // has passed, we must treat 2FA as incomplete to force re-verification.
-        const mfaExpiresAt = session?.mfaExpiresAt || 0;
-        const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
-        // Check mfaVerified (normalized name) with fallback to twoFactorComplete for compatibility
-        const mfaVerifiedInSession = session?.mfaVerified ?? session?.twoFactorComplete ?? false;
-        // DEBUG: Log what we're reading from the session
-        console.log('[VIABILITY] Session 2FA state:', {
-            sessionToken: sessionToken?.substring(0, 8) + '...',
-            'session.mfaVerified': session?.mfaVerified,
-            'session.twoFactorComplete': session?.twoFactorComplete,
-            mfaVerifiedInSession,
-            mfaExpiresAt,
-            mfaExpired,
-            hasRefreshToken,
-            'session.idpRefreshToken': !!session?.idpRefreshToken,
-            'session.refreshToken': !!session?.refreshToken,
-        });
-        // CLEAR NAMING: User has completed 2FA requirements if: they verified AND it hasn't expired
-        const userHasCompletedTenantTwoFactorRequirements = mfaVerifiedInSession && !mfaExpired;
-        // userStillNeedsTwoFactor = inverse of completed (matches session callback logic)
-        const userStillNeedsTwoFactor = !userHasCompletedTenantTwoFactorRequirements;
-        if (mfaExpired && mfaVerifiedInSession) {
-            console.warn('[VIABILITY] MFA expired - forcing 2FA re-verification');
-        }
-        if (isExpired) {
-            return server_1.NextResponse.json({
-                viable: false,
-                needsRefresh: hasRefreshToken,
-                expiresIn: 0,
-                hasRefreshToken,
-                authenticated: true,
-                sessionToken,
-                // Clear names
-                tenantRequiresTwoFactor,
-                userHasCompletedTenantTwoFactorRequirements,
-                userStillNeedsTwoFactor,
-                // Legacy names for backwards compatibility
-                requires2FA: tenantRequiresTwoFactor,
-                twoFactorComplete: userHasCompletedTenantTwoFactorRequirements,
-                accessTokenExpired: true,
-                reason: 'Token expired',
-                // RBAC fields
-                roles: session?.roles || [],
-                clientId: session?.idpClientId || process.env.IDP_CLIENT_ID || '',
-            });
-        }
-        return server_1.NextResponse.json({
-            viable: true,
-            needsRefresh,
-            expiresIn,
-            hasRefreshToken,
-            authenticated: true,
-            sessionToken,
-            // Clear names
-            tenantRequiresTwoFactor,
-            userHasCompletedTenantTwoFactorRequirements,
-            userStillNeedsTwoFactor,
-            // Legacy names for backwards compatibility
-            requires2FA: tenantRequiresTwoFactor,
-            twoFactorComplete: userHasCompletedTenantTwoFactorRequirements,
-            accessTokenExpired: false,
-            expiresAt: new Date(expiryTime * 1000).toISOString(),
-            // RBAC fields
-            roles: session?.roles || [],
-            clientId: session?.idpClientId || process.env.IDP_CLIENT_ID || '',
-        });
-    }
-    catch (error) {
-        console.error('[VIABILITY_ROUTE] Error checking session viability:', error);
-        return server_1.NextResponse.json({
-            viable: false,
-            needsRefresh: false,
-            authenticated: false,
-            error: 'Failed to check session',
-            details: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
-    }
-}

package/dist/routes/index.d.ts

@@ -1,12 +0,0 @@
-/**
- * @payez/next-mvp Route Module Exports
- *
- * Ready-to-use route handlers for quick integration
- *
- * @version 2.3.0
- * @since auth-ready-v2
- */
-export * from './auth';
-export * from './account';
-export * as auth from './auth';
-export * as account from './account';

package/dist/routes/index.js

@@ -1,54 +0,0 @@
-"use strict";
-/**
- * @payez/next-mvp Route Module Exports
- *
- * Ready-to-use route handlers for quick integration
- *
- * @version 2.3.0
- * @since auth-ready-v2
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.account = exports.auth = void 0;
-// Export auth routes
-__exportStar(require("./auth"), exports);
-// Export account/2FA routes
-__exportStar(require("./account"), exports);
-// Namespace exports for cleaner imports
-exports.auth = __importStar(require("./auth"));
-exports.account = __importStar(require("./account"));

package/dist/routes/session/index.d.ts

@@ -1,6 +0,0 @@
-/**
- * Session Routes Index
- *
- * Re-exports all session-related route handlers for easy importing.
- */
-export { GET as refreshViabilityGET } from './refresh-viability';

package/dist/routes/session/index.js

@@ -1,10 +0,0 @@
-"use strict";
-/**
- * Session Routes Index
- *
- * Re-exports all session-related route handlers for easy importing.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.refreshViabilityGET = void 0;
-var refresh_viability_1 = require("./refresh-viability");
-Object.defineProperty(exports, "refreshViabilityGET", { enumerable: true, get: function () { return refresh_viability_1.GET; } });

package/dist/routes/session/refresh-viability.d.ts

@@ -1,16 +0,0 @@
-/**
- * Ready-to-Use Refresh Viability Route
- *
- * Checks if a session has a valid refresh token for automatic refresh.
- * Used by middleware to decide whether to attempt refresh or redirect to login.
- *
- * @example
- * ```typescript
- * // app/api/session/refresh-viability/route.ts
- * export { GET } from '@payez/next-mvp/routes/session/refresh-viability';
- * ```
- *
- * @version 2.0.0
- * @since auth-ready-v2
- */
-export { GET } from '../../api-handlers/session/refresh-viability';

package/dist/routes/session/refresh-viability.js

@@ -1,20 +0,0 @@
-"use strict";
-/**
- * Ready-to-Use Refresh Viability Route
- *
- * Checks if a session has a valid refresh token for automatic refresh.
- * Used by middleware to decide whether to attempt refresh or redirect to login.
- *
- * @example
- * ```typescript
- * // app/api/session/refresh-viability/route.ts
- * export { GET } from '@payez/next-mvp/routes/session/refresh-viability';
- * ```
- *
- * @version 2.0.0
- * @since auth-ready-v2
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.GET = void 0;
-var refresh_viability_1 = require("../../api-handlers/session/refresh-viability");
-Object.defineProperty(exports, "GET", { enumerable: true, get: function () { return refresh_viability_1.GET; } });

package/dist/server/auth-guard.d.ts

@@ -1,46 +0,0 @@
-/**
- * Server-Side Auth Guard for Layouts
- *
- * Replaces middleware's self-fetch auth checks with direct Redis/function calls.
- * Call from server-component layouts to protect routes.
- *
- * Zero HTTP self-fetches. ~8ms total (Redis + in-memory checks).
- */
-import 'server-only';
-import type { SessionData } from '../lib/session-store';
-export interface AuthGuardOptions {
-    /** Custom checks to run after standard auth validation */
-    checks?: AuthCheck[];
-    /** Override login redirect URL (default: /account-auth/login) */
-    loginUrl?: string;
-    /** Override 2FA redirect URL (default: /account-auth/verify-code) */
-    verifyCodeUrl?: string;
-    /** Override service unavailable URL (default: /service-unavailable) */
-    serviceUnavailableUrl?: string;
-}
-export interface AuthCheck {
-    /** Name for logging */
-    name: string;
-    /** Returns redirect URL if check fails, null if passes */
-    check: (session: SessionData, pathname: string) => Promise<string | null>;
-}
-export interface AuthGuardResult {
-    userId: string;
-    email: string;
-    roles: string[];
-    sessionData: SessionData;
-    accessToken?: string;
-}
-/**
- * Server-side auth guard. Call from async server layouts.
- *
- * Redirects (via next/navigation redirect()) if:
- * - No session cookie / invalid JWT
- * - Session not in Redis (stale)
- * - Session force-invalidated
- * - 2FA required but not completed / expired
- * - Any custom check fails
- *
- * Returns the authenticated user's session data on success.
- */
-export declare function authGuard(options?: AuthGuardOptions): Promise<AuthGuardResult>;

package/dist/server/auth-guard.js

@@ -1,128 +0,0 @@
-"use strict";
-/**
- * Server-Side Auth Guard for Layouts
- *
- * Replaces middleware's self-fetch auth checks with direct Redis/function calls.
- * Call from server-component layouts to protect routes.
- *
- * Zero HTTP self-fetches. ~8ms total (Redis + in-memory checks).
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.authGuard = authGuard;
-require("server-only");
-const navigation_1 = require("next/navigation");
-const headers_1 = require("next/headers");
-const decode_session_1 = require("./decode-session");
-const idp_client_config_1 = require("../lib/idp-client-config");
-// =============================================================================
-// CONSTANTS
-// =============================================================================
-const LOGIN_PAGE = '/account-auth/login';
-const VERIFY_CODE_PAGE = '/account-auth/verify-code';
-const SERVICE_UNAVAILABLE_PAGE = '/service-unavailable';
-// =============================================================================
-// MAIN
-// =============================================================================
-/**
- * Server-side auth guard. Call from async server layouts.
- *
- * Redirects (via next/navigation redirect()) if:
- * - No session cookie / invalid JWT
- * - Session not in Redis (stale)
- * - Session force-invalidated
- * - 2FA required but not completed / expired
- * - Any custom check fails
- *
- * Returns the authenticated user's session data on success.
- */
-async function authGuard(options) {
-    const loginUrl = options?.loginUrl || LOGIN_PAGE;
-    const verifyCodeUrl = options?.verifyCodeUrl || VERIFY_CODE_PAGE;
-    const serviceUnavailableUrl = options?.serviceUnavailableUrl || SERVICE_UNAVAILABLE_PAGE;
-    // Get current pathname from headers (set by Next.js)
-    const headerStore = await (0, headers_1.headers)();
-    const pathname = headerStore.get('x-next-pathname') ||
-        headerStore.get('x-invoke-path') ||
-        headerStore.get('x-matched-path') ||
-        '/';
-    const callbackUrl = encodeURIComponent(pathname);
-    // --- Decode session (cookie → JWT → Redis) ---
-    let decoded;
-    try {
-        decoded = await (0, decode_session_1.decodeSession)();
-    }
-    catch (error) {
-        // Redis unreachable or startup failure → fail closed
-        console.error('[AUTH-GUARD] Session decode failed (service error):', error instanceof Error ? error.message : String(error));
-        (0, navigation_1.redirect)(serviceUnavailableUrl);
-    }
-    // No session at all → redirect to login
-    if (!decoded) {
-        (0, navigation_1.redirect)(`${loginUrl}?callbackUrl=${callbackUrl}`);
-    }
-    const { sessionData } = decoded;
-    // --- Force-invalidated session (admin action, password change) ---
-    if (sessionData.forceInvalidated) {
-        console.warn('[AUTH-GUARD] Session force-invalidated', {
-            userId: sessionData.userId,
-            pathname,
-        });
-        (0, navigation_1.redirect)(`${loginUrl}?callbackUrl=${callbackUrl}&reason=invalidated`);
-    }
-    // --- 2FA check ---
-    try {
-        const config = await (0, idp_client_config_1.getIDPClientConfig)();
-        const requires2FA = config.authSettings?.require2FA ?? true;
-        if (requires2FA) {
-            const mfaVerified = sessionData.mfaVerified ?? sessionData.twoFactorComplete ?? false;
-            const mfaExpiresAt = sessionData.mfaExpiresAt || 0;
-            const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
-            if (!mfaVerified || mfaExpired) {
-                console.log('[AUTH-GUARD] 2FA required', {
-                    mfaVerified,
-                    mfaExpired,
-                    userId: sessionData.userId,
-                    pathname,
-                });
-                (0, navigation_1.redirect)(`${verifyCodeUrl}?callbackUrl=${callbackUrl}`);
-            }
-        }
-    }
-    catch (error) {
-        // If we can't check 2FA config, fail closed
-        console.error('[AUTH-GUARD] 2FA config check failed:', error instanceof Error ? error.message : String(error));
-        (0, navigation_1.redirect)(serviceUnavailableUrl);
-    }
-    // --- Custom checks (beta, admin, etc.) ---
-    if (options?.checks) {
-        for (const check of options.checks) {
-            try {
-                const redirectUrl = await check.check(sessionData, pathname);
-                if (redirectUrl) {
-                    console.log(`[AUTH-GUARD] Custom check "${check.name}" failed`, {
-                        userId: sessionData.userId,
-                        pathname,
-                        redirectUrl,
-                    });
-                    (0, navigation_1.redirect)(redirectUrl);
-                }
-            }
-            catch (error) {
-                // If the error is a redirect (from next/navigation), re-throw it
-                if (error && typeof error === 'object' && 'digest' in error) {
-                    throw error;
-                }
-                console.error(`[AUTH-GUARD] Custom check "${check.name}" error:`, error instanceof Error ? error.message : String(error));
-                (0, navigation_1.redirect)(serviceUnavailableUrl);
-            }
-        }
-    }
-    // --- All checks passed ---
-    return {
-        userId: sessionData.userId,
-        email: sessionData.email,
-        roles: sessionData.roles || [],
-        sessionData,
-        accessToken: sessionData.idpAccessToken,
-    };
-}

package/dist/server/decode-session.d.ts

@@ -1,30 +0,0 @@
-/**
- * Server-Side Session Decoder
- *
- * Reads the JWT session cookie, decodes it with jose, and fetches the
- * full session from Redis. Used by authGuard (layouts) and withAuth (API routes).
- *
- * Zero HTTP self-fetches. Direct Redis reads only.
- */
-import 'server-only';
-import { type JWTPayload } from 'jose';
-import { type SessionData } from '../lib/session-store';
-export interface DecodedSession {
-    sessionData: SessionData;
-    jwtPayload: JWTPayload & {
-        sessionToken?: string;
-        redisSessionId?: string;
-    };
-}
-/**
- * Decode the session from cookies and Redis.
- * Returns null if no valid session exists.
- *
- * @param requestCookies Optional cookie getter for API route context (NextRequest.cookies).
- *                       If omitted, uses next/headers cookies() for server components.
- */
-export declare function decodeSession(requestCookies?: {
-    get: (name: string) => {
-        value: string;
-    } | undefined;
-}): Promise<DecodedSession | null>;

package/dist/server/decode-session.js

@@ -1,78 +0,0 @@
-"use strict";
-/**
- * Server-Side Session Decoder
- *
- * Reads the JWT session cookie, decodes it with jose, and fetches the
- * full session from Redis. Used by authGuard (layouts) and withAuth (API routes).
- *
- * Zero HTTP self-fetches. Direct Redis reads only.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.decodeSession = decodeSession;
-require("server-only");
-const headers_1 = require("next/headers");
-const jose_1 = require("jose");
-const session_store_1 = require("../lib/session-store");
-const idp_client_config_1 = require("../lib/idp-client-config");
-const app_slug_1 = require("../lib/app-slug");
-const startup_init_1 = require("../lib/startup-init");
-/**
- * Decode the session from cookies and Redis.
- * Returns null if no valid session exists.
- *
- * @param requestCookies Optional cookie getter for API route context (NextRequest.cookies).
- *                       If omitted, uses next/headers cookies() for server components.
- */
-async function decodeSession(requestCookies) {
-    try {
-        // Ensure startup initialization is complete (Redis, IDP config, etc.)
-        await (0, startup_init_1.ensureInitialized)();
-        // Get the JWT cookie value
-        const cookieStore = requestCookies || (await (0, headers_1.cookies)());
-        const sessionCookieName = (0, app_slug_1.getSessionCookieName)();
-        const secureCookieName = (0, app_slug_1.getSecureSessionCookieName)();
-        const cookieValue = cookieStore.get(secureCookieName)?.value ||
-            cookieStore.get(sessionCookieName)?.value;
-        if (!cookieValue) {
-            return null;
-        }
-        // Get the NextAuth secret from IDP config
-        const config = await (0, idp_client_config_1.getIDPClientConfig)();
-        const secret = config.nextAuthSecret;
-        if (!secret) {
-            console.error('[DECODE-SESSION] No nextAuthSecret available from IDP config');
-            return null;
-        }
-        // Decode the JWT (same pattern as test-aware-get-token.ts)
-        const secretKey = new TextEncoder().encode(secret);
-        let payload;
-        try {
-            const result = await (0, jose_1.jwtVerify)(cookieValue, secretKey);
-            payload = result.payload;
-        }
-        catch (jwtError) {
-            // JWT decode failed - cookie may be corrupted or secret rotated
-            console.warn('[DECODE-SESSION] JWT verification failed:', jwtError instanceof Error ? jwtError.message : String(jwtError));
-            return null;
-        }
-        // Extract the Redis session ID from JWT payload
-        const sessionToken = payload.sessionToken || payload.redisSessionId;
-        if (!sessionToken) {
-            console.warn('[DECODE-SESSION] JWT payload missing sessionToken/redisSessionId');
-            return null;
-        }
-        // Fetch session from Redis (direct, no HTTP)
-        const sessionData = await (0, session_store_1.getSession)(sessionToken);
-        if (!sessionData) {
-            return null;
-        }
-        return {
-            sessionData,
-            jwtPayload: payload,
-        };
-    }
-    catch (error) {
-        console.error('[DECODE-SESSION] Error:', error instanceof Error ? error.message : String(error));
-        return null;
-    }
-}

package/dist/server/slim-middleware.d.ts

@@ -1,23 +0,0 @@
-/**
- * Slim Middleware — Cookie-Only Auth Check
- *
- * Replaces the self-fetching middleware with a cookie existence check.
- * All real auth validation happens in server-side layouts (authGuard).
- *
- * Zero self-fetches. Zero Redis calls. Zero JWT decoding.
- * Just: does the session cookie exist? Yes → pass through. No → redirect to login.
- */
-import { NextRequest, NextResponse } from 'next/server';
-export interface SlimMiddlewareOptions {
-    /** Routes that don't require authentication (glob-style patterns) */
-    publicRoutes?: string[];
-    /** Login page URL (default: /account-auth/login) */
-    loginUrl?: string;
-    /** Additional paths to always bypass (e.g., /api/auth/, /api/session/) */
-    bypassPrefixes?: string[];
-}
-/**
- * Create a slim middleware that only checks cookie existence.
- * Auth validation is deferred to server-side layouts (authGuard).
- */
-export declare function createSlimMiddleware(options?: SlimMiddlewareOptions): (request: NextRequest) => NextResponse;