@smartcrab/next 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/handlers.d.ts

@@ -0,0 +1,52 @@
+import type { ServerAuth } from "@smartcrab/server";
+/**
+ * Route-handler factories for Next.js App Router (design.md §3.1: "Next.js
+ * サーバー — Route Handler、Middleware、Server helper").
+ *
+ * Structural typing, no `next` dependency: Next's Route Handlers (the
+ * `route.ts` files under `app/`) receive a Web-standard `Request` and must
+ * return a Web-standard `Response`, which is exactly the surface
+ * @smartcrab/server already speaks. Wire them up like:
+ *
+ * ```ts
+ * // app/auth/login/route.ts
+ * import { auth } from "@/lib/auth"; // createServerAuth(...)
+ * export const { GET, POST } = createLoginRouteHandler(auth);
+ * ```
+ *
+ * ```ts
+ * // app/auth/callback/route.ts
+ * export const { GET } = createCallbackRouteHandler(auth);
+ * ```
+ *
+ * ```ts
+ * // app/auth/logout/route.ts
+ * export const { GET, POST } = createLogoutRouteHandler(auth);
+ * ```
+ *
+ * Origin/Referer and `state` validation happen inside the sdk-server
+ * handlers exactly as for any other runtime (design.md §32.2).
+ */
+export interface RouteHandler {
+    readonly GET: (request: Request) => Promise<Response>;
+    readonly POST?: (request: Request) => Promise<Response>;
+}
+/** Login start: GET (browser navigation) and POST (fetch-based clients, CSRF-checked). */
+export declare const createLoginRouteHandler: (auth: ServerAuth) => {
+    readonly GET: (request: Request) => Promise<Response>;
+    readonly POST: (request: Request) => Promise<Response>;
+};
+/** OAuth callback: GET only — the authorization response is always a redirect. */
+export declare const createCallbackRouteHandler: (auth: ServerAuth) => RouteHandler;
+/** Logout: GET (navigation) and POST (CSRF-checked). */
+export declare const createLogoutRouteHandler: (auth: ServerAuth) => {
+    readonly GET: (request: Request) => Promise<Response>;
+    readonly POST: (request: Request) => Promise<Response>;
+};
+export interface AuthRouteHandlers {
+    readonly login: ReturnType<typeof createLoginRouteHandler>;
+    readonly callback: ReturnType<typeof createCallbackRouteHandler>;
+    readonly logout: ReturnType<typeof createLogoutRouteHandler>;
+}
+/** All three factories in one call, for colocated route files. */
+export declare const createAuthRouteHandlers: (auth: ServerAuth) => AuthRouteHandlers;

package/dist/handlers.js

@@ -0,0 +1,20 @@
+/** Login start: GET (browser navigation) and POST (fetch-based clients, CSRF-checked). */
+export const createLoginRouteHandler = (auth) => ({
+    GET: (request) => auth.loginHandler(request),
+    POST: (request) => auth.loginHandler(request),
+});
+/** OAuth callback: GET only — the authorization response is always a redirect. */
+export const createCallbackRouteHandler = (auth) => ({
+    GET: (request) => auth.callbackHandler(request),
+});
+/** Logout: GET (navigation) and POST (CSRF-checked). */
+export const createLogoutRouteHandler = (auth) => ({
+    GET: (request) => auth.logoutHandler(request),
+    POST: (request) => auth.logoutHandler(request),
+});
+/** All three factories in one call, for colocated route files. */
+export const createAuthRouteHandlers = (auth) => ({
+    login: createLoginRouteHandler(auth),
+    callback: createCallbackRouteHandler(auth),
+    logout: createLogoutRouteHandler(auth),
+});

package/dist/helpers.d.ts

@@ -0,0 +1,33 @@
+import type { GetSessionOutcome, RequireSessionOptions, RequireSessionOutcome, ServerAuth } from "@smartcrab/server";
+/**
+ * Server-component / route helpers (design.md §3.1 "Server helper").
+ *
+ * They accept the incoming `Request` (route handlers, middleware), a plain
+ * `Headers` instance, or any object carrying `headers: Headers` — which is
+ * what `headers()` from `next/headers` structurally looks like in React
+ * Server Components, again without importing `next`.
+ *
+ * RSC caveat: when only headers are available there is no outgoing response
+ * to attach a refreshed session cookie to; the outcome still reports
+ * `setCookie`/`clearCookie` and callers that CAN write cookies (route
+ * handlers, Server Actions) should apply them. In RSC the middleware helper
+ * is the right place to perform refreshes.
+ */
+export type HeaderSource = Request | Headers | {
+    readonly headers: Headers;
+};
+/** Resolves the current session from a Request, Headers, or `{ headers }` source. */
+export declare const getSession: (auth: ServerAuth, source: HeaderSource) => Promise<GetSessionOutcome>;
+export interface NextRequireSessionOptions extends RequireSessionOptions {
+    /**
+     * Where the login redirect should return to, for header-only sources (RSC)
+     * that carry no URL. Sanitized like any other redirect target (relative
+     * paths or allowlisted URLs only); default `"/"`.
+     */
+    readonly returnTo?: string;
+}
+/**
+ * Like `getSession`, but produces the typed failure/redirect response for
+ * unauthenticated requests (see `ServerAuth.requireSession`).
+ */
+export declare const requireSession: (auth: ServerAuth, source: HeaderSource, options?: NextRequireSessionOptions) => Promise<RequireSessionOutcome>;

package/dist/helpers.js

@@ -0,0 +1,24 @@
+import { sanitizeRedirectTarget } from "@smartcrab/server";
+/** Synthetic origin for header-only sources; getSession never inspects it. */
+const HEADER_SOURCE_ORIGIN = "https://localhost";
+const toRequest = (source, path) => {
+    if (source instanceof Request)
+        return source;
+    const headers = source instanceof Headers ? source : source.headers;
+    return new Request(`${HEADER_SOURCE_ORIGIN}${path}`, { headers });
+};
+/** Resolves the current session from a Request, Headers, or `{ headers }` source. */
+export const getSession = (auth, source) => auth.getSession(toRequest(source, "/"));
+/**
+ * Like `getSession`, but produces the typed failure/redirect response for
+ * unauthenticated requests (see `ServerAuth.requireSession`).
+ */
+export const requireSession = (auth, source, options) => {
+    if (source instanceof Request) {
+        return auth.requireSession(source, options);
+    }
+    // Header-only source: build a synthetic request whose path is the sanitized
+    // return_to so the login redirect points back at a safe location.
+    const returnTo = sanitizeRedirectTarget(options?.returnTo ?? "/", [], "/");
+    return auth.requireSession(toRequest(source, returnTo), options);
+};

package/dist/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @smartcrab/next — Next.js helpers for the Web BFF auth SDK
+ * (design.md §3.1), built purely on Web-standard `Request`/`Response` so no
+ * `next` dependency is required. Next's Route Handlers accept/return Web
+ * `Request`/`Response` and `middleware.ts` may return any Web `Response`;
+ * this package is designed against those structural contracts.
+ */
+export { createAuthRouteHandlers, createCallbackRouteHandler, createLoginRouteHandler, createLogoutRouteHandler, } from "./handlers.js";
+export type { AuthRouteHandlers, RouteHandler } from "./handlers.js";
+export { createAuthMiddleware } from "./middleware.js";
+export type { AuthMiddlewareOptions, AuthMiddlewareResult } from "./middleware.js";
+export { getSession, requireSession } from "./helpers.js";
+export type { HeaderSource, NextRequireSessionOptions } from "./helpers.js";
+export type { GetSessionOutcome, RequireSessionOutcome, ServerAuth, ServerAuthConfig, Session, SessionUser, UnauthenticatedReason, } from "@smartcrab/server";

package/dist/index.js

@@ -0,0 +1,10 @@
+/**
+ * @smartcrab/next — Next.js helpers for the Web BFF auth SDK
+ * (design.md §3.1), built purely on Web-standard `Request`/`Response` so no
+ * `next` dependency is required. Next's Route Handlers accept/return Web
+ * `Request`/`Response` and `middleware.ts` may return any Web `Response`;
+ * this package is designed against those structural contracts.
+ */
+export { createAuthRouteHandlers, createCallbackRouteHandler, createLoginRouteHandler, createLogoutRouteHandler, } from "./handlers.js";
+export { createAuthMiddleware } from "./middleware.js";
+export { getSession, requireSession } from "./helpers.js";

package/dist/middleware.d.ts

@@ -0,0 +1,45 @@
+import type { ServerAuth } from "@smartcrab/server";
+/**
+ * Session-enforcement helper for Next.js `middleware.ts` (design.md §3.1) —
+ * built on Web-standard Request/Response only, so this package needs no
+ * `next` dependency. Next's middleware receives a `NextRequest` (a Web
+ * `Request` subclass) and may return any Web `Response`; the result contract
+ * here maps onto that model without importing Next:
+ *
+ * ```ts
+ * // middleware.ts
+ * import { NextResponse } from "next/server";
+ * import { authMiddleware } from "@/lib/auth-middleware"; // createAuthMiddleware(...)
+ *
+ * export default async function middleware(request: NextRequest) {
+ *   const result = await authMiddleware(request);
+ *   if (result.action === "respond") return result.response;   // redirect / 503
+ *   const response = NextResponse.next();
+ *   if (result.setCookie !== undefined) {
+ *     response.headers.append("set-cookie", result.setCookie); // rotated session
+ *   }
+ *   return response;
+ * }
+ * ```
+ *
+ * Unauthenticated requests to protected paths get the sdk-server
+ * `requireSession` redirect response (302 to the login handler with a safe
+ * `return_to`); a transient refresh failure yields a 503 problem response
+ * rather than a login loop (design.md §21.7).
+ */
+export interface AuthMiddlewareOptions {
+    /** Custom matcher — highest precedence. */
+    readonly protect?: (pathname: string) => boolean;
+    /** Path prefixes that require a session (e.g. `["/dashboard", "/api"]`). */
+    readonly protectedPrefixes?: readonly string[];
+}
+export type AuthMiddlewareResult = {
+    readonly action: "next";
+    /** Present when the session was refreshed — apply to the outgoing response. */
+    readonly setCookie?: string;
+} | {
+    /** Return this response to the client (302 login redirect or 503 problem). */
+    readonly action: "respond";
+    readonly response: Response;
+};
+export declare const createAuthMiddleware: (auth: ServerAuth, options?: AuthMiddlewareOptions) => ((request: Request) => Promise<AuthMiddlewareResult>);

package/dist/middleware.js

@@ -0,0 +1,21 @@
+export const createAuthMiddleware = (auth, options = {}) => {
+    const isProtected = (pathname) => {
+        if (options.protect !== undefined)
+            return options.protect(pathname);
+        return (options.protectedPrefixes ?? []).some((prefix) => pathname.startsWith(prefix));
+    };
+    return async (request) => {
+        const pathname = new URL(request.url).pathname;
+        if (!isProtected(pathname)) {
+            return { action: "next" };
+        }
+        const outcome = await auth.requireSession(request);
+        if (outcome.ok) {
+            return {
+                action: "next",
+                ...(outcome.setCookie !== undefined ? { setCookie: outcome.setCookie } : {}),
+            };
+        }
+        return { action: "respond", response: outcome.response };
+    };
+};

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@smartcrab/next",
+  "version": "0.1.0",
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "development": "./src/index.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./*": {
+      "types": "./src/*.ts",
+      "development": "./src/*.ts",
+      "import": "./dist/*.js",
+      "default": "./dist/*.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@smartcrab/server": "0.1.0"
+  },
+  "devDependencies": {
+    "typescript": "5.9.3",
+    "vitest": "4.1.11",
+    "@cloudflare/workers-types": "5.20260804.1"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests",
+    "build": "tsc -p tsconfig.build.json"
+  }
+}

package/src/handlers.ts

@@ -0,0 +1,75 @@
+import type { ServerAuth } from "@smartcrab/server";
+
+/**
+ * Route-handler factories for Next.js App Router (design.md §3.1: "Next.js
+ * サーバー — Route Handler、Middleware、Server helper").
+ *
+ * Structural typing, no `next` dependency: Next's Route Handlers (the
+ * `route.ts` files under `app/`) receive a Web-standard `Request` and must
+ * return a Web-standard `Response`, which is exactly the surface
+ * @smartcrab/server already speaks. Wire them up like:
+ *
+ * ```ts
+ * // app/auth/login/route.ts
+ * import { auth } from "@/lib/auth"; // createServerAuth(...)
+ * export const { GET, POST } = createLoginRouteHandler(auth);
+ * ```
+ *
+ * ```ts
+ * // app/auth/callback/route.ts
+ * export const { GET } = createCallbackRouteHandler(auth);
+ * ```
+ *
+ * ```ts
+ * // app/auth/logout/route.ts
+ * export const { GET, POST } = createLogoutRouteHandler(auth);
+ * ```
+ *
+ * Origin/Referer and `state` validation happen inside the sdk-server
+ * handlers exactly as for any other runtime (design.md §32.2).
+ */
+
+export interface RouteHandler {
+  readonly GET: (request: Request) => Promise<Response>;
+  readonly POST?: (request: Request) => Promise<Response>;
+}
+
+/** Login start: GET (browser navigation) and POST (fetch-based clients, CSRF-checked). */
+export const createLoginRouteHandler = (
+  auth: ServerAuth,
+): {
+  readonly GET: (request: Request) => Promise<Response>;
+  readonly POST: (request: Request) => Promise<Response>;
+} => ({
+  GET: (request) => auth.loginHandler(request),
+  POST: (request) => auth.loginHandler(request),
+});
+
+/** OAuth callback: GET only — the authorization response is always a redirect. */
+export const createCallbackRouteHandler = (auth: ServerAuth): RouteHandler => ({
+  GET: (request) => auth.callbackHandler(request),
+});
+
+/** Logout: GET (navigation) and POST (CSRF-checked). */
+export const createLogoutRouteHandler = (
+  auth: ServerAuth,
+): {
+  readonly GET: (request: Request) => Promise<Response>;
+  readonly POST: (request: Request) => Promise<Response>;
+} => ({
+  GET: (request) => auth.logoutHandler(request),
+  POST: (request) => auth.logoutHandler(request),
+});
+
+export interface AuthRouteHandlers {
+  readonly login: ReturnType<typeof createLoginRouteHandler>;
+  readonly callback: ReturnType<typeof createCallbackRouteHandler>;
+  readonly logout: ReturnType<typeof createLogoutRouteHandler>;
+}
+
+/** All three factories in one call, for colocated route files. */
+export const createAuthRouteHandlers = (auth: ServerAuth): AuthRouteHandlers => ({
+  login: createLoginRouteHandler(auth),
+  callback: createCallbackRouteHandler(auth),
+  logout: createLogoutRouteHandler(auth),
+});

package/src/helpers.ts

@@ -0,0 +1,64 @@
+import { sanitizeRedirectTarget } from "@smartcrab/server";
+import type {
+  GetSessionOutcome,
+  RequireSessionOptions,
+  RequireSessionOutcome,
+  ServerAuth,
+} from "@smartcrab/server";
+
+/**
+ * Server-component / route helpers (design.md §3.1 "Server helper").
+ *
+ * They accept the incoming `Request` (route handlers, middleware), a plain
+ * `Headers` instance, or any object carrying `headers: Headers` — which is
+ * what `headers()` from `next/headers` structurally looks like in React
+ * Server Components, again without importing `next`.
+ *
+ * RSC caveat: when only headers are available there is no outgoing response
+ * to attach a refreshed session cookie to; the outcome still reports
+ * `setCookie`/`clearCookie` and callers that CAN write cookies (route
+ * handlers, Server Actions) should apply them. In RSC the middleware helper
+ * is the right place to perform refreshes.
+ */
+
+export type HeaderSource = Request | Headers | { readonly headers: Headers };
+
+/** Synthetic origin for header-only sources; getSession never inspects it. */
+const HEADER_SOURCE_ORIGIN = "https://localhost";
+
+const toRequest = (source: HeaderSource, path: string): Request => {
+  if (source instanceof Request) return source;
+  const headers = source instanceof Headers ? source : source.headers;
+  return new Request(`${HEADER_SOURCE_ORIGIN}${path}`, { headers });
+};
+
+/** Resolves the current session from a Request, Headers, or `{ headers }` source. */
+export const getSession = (auth: ServerAuth, source: HeaderSource): Promise<GetSessionOutcome> =>
+  auth.getSession(toRequest(source, "/"));
+
+export interface NextRequireSessionOptions extends RequireSessionOptions {
+  /**
+   * Where the login redirect should return to, for header-only sources (RSC)
+   * that carry no URL. Sanitized like any other redirect target (relative
+   * paths or allowlisted URLs only); default `"/"`.
+   */
+  readonly returnTo?: string;
+}
+
+/**
+ * Like `getSession`, but produces the typed failure/redirect response for
+ * unauthenticated requests (see `ServerAuth.requireSession`).
+ */
+export const requireSession = (
+  auth: ServerAuth,
+  source: HeaderSource,
+  options?: NextRequireSessionOptions,
+): Promise<RequireSessionOutcome> => {
+  if (source instanceof Request) {
+    return auth.requireSession(source, options);
+  }
+  // Header-only source: build a synthetic request whose path is the sanitized
+  // return_to so the login redirect points back at a safe location.
+  const returnTo = sanitizeRedirectTarget(options?.returnTo ?? "/", [], "/");
+  return auth.requireSession(toRequest(source, returnTo), options);
+};

package/src/index.test.ts

@@ -0,0 +1,425 @@
+import { createServerAuth } from "@smartcrab/server";
+import type { FetchLike, ServerAuth } from "@smartcrab/server";
+import { describe, expect, test } from "vitest";
+import {
+  createAuthRouteHandlers,
+  createCallbackRouteHandler,
+  createLoginRouteHandler,
+  createLogoutRouteHandler,
+} from "./handlers.js";
+import { getSession, requireSession } from "./helpers.js";
+import { createAuthMiddleware } from "./middleware.js";
+
+/**
+ * Verifies the Next.js helpers against Web-standard Request/Response only —
+ * no `next` import anywhere (proven by construction: `next` is not installed
+ * for this package, and the import-scan test at the bottom asserts no source
+ * file references it). The Authorization Server is stubbed behind an
+ * injected fetch; ID tokens are real ES256 JWS signed via WebCrypto.
+ */
+
+const ISSUER = "https://id.example.com/e/env_test";
+const CLIENT_ID = "cli_testclient";
+const CLIENT_SECRET = "test_client_secret";
+const COOKIE_SECRET = "0123456789abcdef0123456789abcdef";
+const REDIRECT_URI = "https://app.example.com/auth/callback";
+const APP_ORIGIN = "https://app.example.com";
+const KID = "test-signing-key-1";
+const USER_SUB = "usr_testuser";
+
+// ---------------------------------------------------------------------------
+// WebCrypto-only test helpers (no extra dependencies in this package)
+// ---------------------------------------------------------------------------
+
+const BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+
+const base64UrlEncode = (bytes: Uint8Array): string => {
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const b0 = bytes[i] ?? 0;
+    const b1 = bytes[i + 1];
+    const b2 = bytes[i + 2];
+    out += BASE64URL_ALPHABET[b0 >> 2] ?? "";
+    out += BASE64URL_ALPHABET[((b0 & 0x03) << 4) | ((b1 ?? 0) >> 4)] ?? "";
+    if (b1 !== undefined) out += BASE64URL_ALPHABET[((b1 & 0x0f) << 2) | ((b2 ?? 0) >> 6)] ?? "";
+    if (b2 !== undefined) out += BASE64URL_ALPHABET[b2 & 0x3f] ?? "";
+  }
+  return out;
+};
+
+const textEncoder = new TextEncoder();
+
+const signJwt = async (
+  header: Record<string, unknown>,
+  payload: Record<string, unknown>,
+  key: CryptoKey,
+): Promise<string> => {
+  const data = `${base64UrlEncode(textEncoder.encode(JSON.stringify(header)))}.${base64UrlEncode(textEncoder.encode(JSON.stringify(payload)))}`;
+  const signature = await crypto.subtle.sign(
+    { name: "ECDSA", hash: "SHA-256" },
+    key,
+    textEncoder.encode(data),
+  );
+  return `${data}.${base64UrlEncode(new Uint8Array(signature))}`;
+};
+
+const cookieFragment = (setCookieHeader: string): string => setCookieHeader.split(";")[0] ?? "";
+
+const generatedKeyPair = await crypto.subtle.generateKey(
+  { name: "ECDSA", namedCurve: "P-256" },
+  true,
+  ["sign", "verify"],
+);
+if (!("publicKey" in generatedKeyPair) || !("privateKey" in generatedKeyPair)) {
+  throw new Error("expected an ECDSA key pair");
+}
+const signingKeyPair: CryptoKeyPair = generatedKeyPair;
+const exportedPublicJwk = await crypto.subtle.exportKey("jwk", signingKeyPair.publicKey);
+if (exportedPublicJwk instanceof ArrayBuffer) {
+  throw new Error("expected a JWK export");
+}
+const publicJwk = {
+  kty: exportedPublicJwk.kty,
+  crv: exportedPublicJwk.crv,
+  x: exportedPublicJwk.x,
+  y: exportedPublicJwk.y,
+  kid: KID,
+  alg: "ES256",
+  use: "sig",
+};
+
+const nowSeconds = (): number => Math.floor(Date.now() / 1000);
+
+const signIdToken = async (nonce: string): Promise<string> =>
+  signJwt(
+    { alg: "ES256", typ: "JWT", kid: KID },
+    {
+      iss: ISSUER,
+      sub: USER_SUB,
+      aud: CLIENT_ID,
+      iat: nowSeconds(),
+      exp: nowSeconds() + 300,
+      nonce,
+      email: "test@example.com",
+    },
+    signingKeyPair.privateKey,
+  );
+
+interface StubState {
+  currentNonce: string | null;
+}
+
+const jsonResponse = (body: unknown, status = 200): Response =>
+  new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+
+const createStubFetch = (state: StubState): FetchLike => {
+  return async (input, init) => {
+    const url =
+      typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+    if (url === `${ISSUER}/.well-known/openid-configuration`) {
+      return jsonResponse({
+        issuer: ISSUER,
+        authorization_endpoint: `${ISSUER}/oauth2/authorize`,
+        token_endpoint: `${ISSUER}/oauth2/token`,
+        userinfo_endpoint: `${ISSUER}/oauth2/userinfo`,
+        jwks_uri: `${ISSUER}/oauth2/jwks`,
+        revocation_endpoint: `${ISSUER}/oauth2/revoke`,
+        introspection_endpoint: `${ISSUER}/oauth2/introspect`,
+        end_session_endpoint: `${ISSUER}/oauth2/logout`,
+        response_types_supported: ["code"],
+        grant_types_supported: ["authorization_code", "refresh_token"],
+        code_challenge_methods_supported: ["S256"],
+        token_endpoint_auth_methods_supported: ["client_secret_basic"],
+        scopes_supported: ["openid", "profile", "email", "offline_access"],
+        subject_types_supported: ["public"],
+        id_token_signing_alg_values_supported: ["ES256"],
+        claims_supported: ["sub", "nonce", "email"],
+      });
+    }
+    if (url === `${ISSUER}/oauth2/jwks`) {
+      return jsonResponse({ keys: [publicJwk] });
+    }
+    if (url === `${ISSUER}/oauth2/token`) {
+      const body = typeof init?.body === "string" ? init.body : "";
+      const params = new URLSearchParams(body);
+      if (params.get("grant_type") === "authorization_code") {
+        return jsonResponse({
+          access_token: "atk_initial",
+          token_type: "Bearer",
+          expires_in: 300,
+          refresh_token: "rt_1",
+          id_token: await signIdToken(state.currentNonce ?? ""),
+          scope: "openid profile email offline_access",
+        });
+      }
+      return jsonResponse({
+        access_token: "atk_refreshed",
+        token_type: "Bearer",
+        expires_in: 300,
+        refresh_token: "rt_2",
+        scope: "openid profile email offline_access",
+      });
+    }
+    if (url === `${ISSUER}/oauth2/revoke`) {
+      return new Response(null, { status: 200 });
+    }
+    return new Response("not found", { status: 404 });
+  };
+};
+
+const createAuth = (
+  state: StubState,
+  overrides: { readonly refreshLeewaySeconds?: number } = {},
+): ServerAuth =>
+  createServerAuth({
+    issuer: ISSUER,
+    clientId: CLIENT_ID,
+    clientSecret: CLIENT_SECRET,
+    redirectUri: REDIRECT_URI,
+    cookieSecret: COOKIE_SECRET,
+    fetch: createStubFetch(state),
+    ...(overrides.refreshLeewaySeconds !== undefined
+      ? { refreshLeewaySeconds: overrides.refreshLeewaySeconds }
+      : {}),
+  });
+
+/** Runs the login flow through the route-handler factories. */
+const completeLogin = async (auth: ServerAuth, state: StubState): Promise<string> => {
+  const login = createLoginRouteHandler(auth);
+  const callback = createCallbackRouteHandler(auth);
+  const loginResponse = await login.GET(new Request(`${APP_ORIGIN}/auth/login`));
+  expect(loginResponse.status).toBe(302);
+  const location = new URL(loginResponse.headers.get("location") ?? "");
+  expect(location.origin + location.pathname).toBe(`${ISSUER}/oauth2/authorize`);
+  state.currentNonce = location.searchParams.get("nonce");
+  const pkce = cookieFragment(loginResponse.headers.getSetCookie()[0] ?? "");
+  const callbackResponse = await callback.GET(
+    new Request(
+      `${APP_ORIGIN}/auth/callback?code=ac_${"a".repeat(32)}&state=${location.searchParams.get("state") ?? ""}`,
+      { headers: { cookie: pkce } },
+    ),
+  );
+  expect(callbackResponse.status).toBe(302);
+  const sessionSet = callbackResponse.headers
+    .getSetCookie()
+    .find((value) => value.startsWith("__Host-auth-session="));
+  expect(sessionSet).toBeDefined();
+  return cookieFragment(sessionSet ?? "");
+};
+
+// ---------------------------------------------------------------------------
+// Route-handler factories
+// ---------------------------------------------------------------------------
+
+describe("route handler factories", () => {
+  test("login GET redirects to the authorize endpoint", async () => {
+    const state: StubState = { currentNonce: null };
+    const auth = createAuth(state);
+    const handler = createLoginRouteHandler(auth);
+    const response = await handler.GET(new Request(`${APP_ORIGIN}/auth/login`));
+    expect(response.status).toBe(302);
+    const location = new URL(response.headers.get("location") ?? "");
+    expect(location.searchParams.get("response_type")).toBe("code");
+    expect(location.searchParams.get("code_challenge_method")).toBe("S256");
+  });
+
+  test("login POST validates the Origin (CSRF)", async () => {
+    const state: StubState = { currentNonce: null };
+    const auth = createAuth(state);
+    const handler = createLoginRouteHandler(auth);
+    const evil = await handler.POST(
+      new Request(`${APP_ORIGIN}/auth/login`, {
+        method: "POST",
+        headers: { origin: "https://evil.example.com" },
+      }),
+    );
+    expect(evil.status).toBe(403);
+    const good = await handler.POST(
+      new Request(`${APP_ORIGIN}/auth/login`, {
+        method: "POST",
+        headers: { origin: APP_ORIGIN },
+      }),
+    );
+    expect(good.status).toBe(302);
+  });
+
+  test("callback validates state and issues the session cookie", async () => {
+    const state: StubState = { currentNonce: null };
+    const auth = createAuth(state);
+    const cookie = await completeLogin(auth, state);
+    expect(cookie.startsWith("__Host-auth-session=v1.")).toBe(true);
+  });
+
+  test("callback rejects a state mismatch", async () => {
+    const state: StubState = { currentNonce: null };
+    const auth = createAuth(state);
+    const login = createLoginRouteHandler(auth);
+    const callback = createCallbackRouteHandler(auth);
+    const loginResponse = await login.GET(new Request(`${APP_ORIGIN}/auth/login`));
+    const pkce = cookieFragment(loginResponse.headers.getSetCookie()[0] ?? "");
+    const response = await callback.GET(
+      new Request(`${APP_ORIGIN}/auth/callback?code=ac_${"a".repeat(32)}&state=wrong-state`, {
+        headers: { cookie: pkce },
+      }),
+    );
+    expect(response.status).toBe(400);
+  });
+
+  test("logout GET clears the session; logout POST validates Origin", async () => {
+    const state: StubState = { currentNonce: null };
+    const auth = createAuth(state);
+    const cookie = await completeLogin(auth, state);
+    const logout = createLogoutRouteHandler(auth);
+
+    const evil = await logout.POST(
+      new Request(`${APP_ORIGIN}/auth/logout`, {
+        method: "POST",
+        headers: { origin: "https://evil.example.com", cookie },
+      }),
+    );
+    expect(evil.status).toBe(403);
+
+    const response = await logout.GET(
+      new Request(`${APP_ORIGIN}/auth/logout`, { headers: { cookie } }),
+    );
+    expect(response.status).toBe(302);
+    const cleared = response.headers
+      .getSetCookie()
+      .find((value) => value.startsWith("__Host-auth-session="));
+    expect(cleared).toBeDefined();
+    expect(cleared ?? "").toContain("Max-Age=0");
+  });
+
+  test("createAuthRouteHandlers bundles all three", async () => {
+    const state: StubState = { currentNonce: null };
+    const auth = createAuth(state);
+    const handlers = createAuthRouteHandlers(auth);
+    expect(typeof handlers.login.GET).toBe("function");
+    expect(typeof handlers.login.POST).toBe("function");
+    expect(typeof handlers.callback.GET).toBe("function");
+    expect(typeof handlers.logout.GET).toBe("function");
+    expect(typeof handlers.logout.POST).toBe("function");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// middleware helper
+// ---------------------------------------------------------------------------
+
+describe("createAuthMiddleware", () => {
+  test("passes unprotected paths without touching the session", async () => {
+    const state: StubState = { currentNonce: null };
+    const auth = createAuth(state);
+    const middleware = createAuthMiddleware(auth, { protectedPrefixes: ["/app"] });
+    const result = await middleware(new Request(`${APP_ORIGIN}/`));
+    expect(result.action).toBe("next");
+    if (result.action === "next") {
+      expect(result.setCookie).toBeUndefined();
+    }
+  });
+
+  test("redirects unauthenticated requests to protected paths", async () => {
+    const state: StubState = { currentNonce: null };
+    const auth = createAuth(state);
+    const middleware = createAuthMiddleware(auth, { protectedPrefixes: ["/app"] });
+    const result = await middleware(new Request(`${APP_ORIGIN}/app/dashboard`));
+    expect(result.action).toBe("respond");
+    if (result.action !== "respond") return;
+    expect(result.response.status).toBe(302);
+    expect(result.response.headers.get("location")).toBe(
+      "/auth/login?return_to=%2Fapp%2Fdashboard",
+    );
+  });
+
+  test("passes authenticated requests through", async () => {
+    const state: StubState = { currentNonce: null };
+    const auth = createAuth(state);
+    const cookie = await completeLogin(auth, state);
+    const middleware = createAuthMiddleware(auth, { protectedPrefixes: ["/app"] });
+    const result = await middleware(
+      new Request(`${APP_ORIGIN}/app/dashboard`, { headers: { cookie } }),
+    );
+    expect(result.action).toBe("next");
+  });
+
+  test("surfaces the rotated session cookie after a refresh", async () => {
+    const state: StubState = { currentNonce: null };
+    const auth = createAuth(state, { refreshLeewaySeconds: 10_000 });
+    const cookie = await completeLogin(auth, state);
+    const middleware = createAuthMiddleware(auth, {
+      protect: (pathname) => pathname.startsWith("/app"),
+    });
+    const result = await middleware(
+      new Request(`${APP_ORIGIN}/app/dashboard`, { headers: { cookie } }),
+    );
+    expect(result.action).toBe("next");
+    if (result.action !== "next") return;
+    expect(result.setCookie).toBeDefined();
+    expect(result.setCookie ?? "").toContain("__Host-auth-session=");
+    expect(result.setCookie ?? "").toContain("HttpOnly");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// server helpers (Request / Headers / { headers })
+// ---------------------------------------------------------------------------
+
+describe("getSession / requireSession helpers", () => {
+  test("getSession accepts a Request", async () => {
+    const state: StubState = { currentNonce: null };
+    const auth = createAuth(state);
+    const cookie = await completeLogin(auth, state);
+    const outcome = await getSession(auth, new Request(`${APP_ORIGIN}/x`, { headers: { cookie } }));
+    expect(outcome.status).toBe("authenticated");
+  });
+
+  test("getSession accepts plain Headers and { headers } sources", async () => {
+    const state: StubState = { currentNonce: null };
+    const auth = createAuth(state);
+    const cookie = await completeLogin(auth, state);
+
+    const fromHeaders = await getSession(auth, new Headers({ cookie }));
+    expect(fromHeaders.status).toBe("authenticated");
+    if (fromHeaders.status === "authenticated") {
+      expect(fromHeaders.session.user.sub).toBe(USER_SUB);
+    }
+
+    // Structurally what `headers()` from next/headers looks like in RSC.
+    const fromHeadersLike = await getSession(auth, { headers: new Headers({ cookie }) });
+    expect(fromHeadersLike.status).toBe("authenticated");
+  });
+
+  test("getSession without a cookie is unauthenticated", async () => {
+    const state: StubState = { currentNonce: null };
+    const auth = createAuth(state);
+    const outcome = await getSession(auth, new Headers());
+    expect(outcome.status).toBe("unauthenticated");
+  });
+
+  test("requireSession redirects header-only sources with a sanitized return_to", async () => {
+    const state: StubState = { currentNonce: null };
+    const auth = createAuth(state);
+    const outcome = await requireSession(auth, new Headers(), { returnTo: "/app/settings" });
+    expect(outcome.ok).toBe(false);
+    if (outcome.ok) return;
+    expect(outcome.response.status).toBe(302);
+    expect(outcome.response.headers.get("location")).toBe(
+      "/auth/login?return_to=%2Fapp%2Fsettings",
+    );
+  });
+
+  test("requireSession never builds an open redirect from returnTo", async () => {
+    const state: StubState = { currentNonce: null };
+    const auth = createAuth(state);
+    const outcome = await requireSession(auth, new Headers(), {
+      returnTo: "https://evil.example.com",
+    });
+    expect(outcome.ok).toBe(false);
+    if (outcome.ok) return;
+    // Sanitized to "/" — never to the attacker-supplied absolute URL.
+    expect(outcome.response.headers.get("location")).toBe("/auth/login?return_to=%2F");
+  });
+});

package/src/index.ts

@@ -0,0 +1,27 @@
+/**
+ * @smartcrab/next — Next.js helpers for the Web BFF auth SDK
+ * (design.md §3.1), built purely on Web-standard `Request`/`Response` so no
+ * `next` dependency is required. Next's Route Handlers accept/return Web
+ * `Request`/`Response` and `middleware.ts` may return any Web `Response`;
+ * this package is designed against those structural contracts.
+ */
+export {
+  createAuthRouteHandlers,
+  createCallbackRouteHandler,
+  createLoginRouteHandler,
+  createLogoutRouteHandler,
+} from "./handlers.js";
+export type { AuthRouteHandlers, RouteHandler } from "./handlers.js";
+export { createAuthMiddleware } from "./middleware.js";
+export type { AuthMiddlewareOptions, AuthMiddlewareResult } from "./middleware.js";
+export { getSession, requireSession } from "./helpers.js";
+export type { HeaderSource, NextRequireSessionOptions } from "./helpers.js";
+export type {
+  GetSessionOutcome,
+  RequireSessionOutcome,
+  ServerAuth,
+  ServerAuthConfig,
+  Session,
+  SessionUser,
+  UnauthenticatedReason,
+} from "@smartcrab/server";

package/src/middleware.ts

@@ -0,0 +1,74 @@
+import type { ServerAuth } from "@smartcrab/server";
+
+/**
+ * Session-enforcement helper for Next.js `middleware.ts` (design.md §3.1) —
+ * built on Web-standard Request/Response only, so this package needs no
+ * `next` dependency. Next's middleware receives a `NextRequest` (a Web
+ * `Request` subclass) and may return any Web `Response`; the result contract
+ * here maps onto that model without importing Next:
+ *
+ * ```ts
+ * // middleware.ts
+ * import { NextResponse } from "next/server";
+ * import { authMiddleware } from "@/lib/auth-middleware"; // createAuthMiddleware(...)
+ *
+ * export default async function middleware(request: NextRequest) {
+ *   const result = await authMiddleware(request);
+ *   if (result.action === "respond") return result.response;   // redirect / 503
+ *   const response = NextResponse.next();
+ *   if (result.setCookie !== undefined) {
+ *     response.headers.append("set-cookie", result.setCookie); // rotated session
+ *   }
+ *   return response;
+ * }
+ * ```
+ *
+ * Unauthenticated requests to protected paths get the sdk-server
+ * `requireSession` redirect response (302 to the login handler with a safe
+ * `return_to`); a transient refresh failure yields a 503 problem response
+ * rather than a login loop (design.md §21.7).
+ */
+
+export interface AuthMiddlewareOptions {
+  /** Custom matcher — highest precedence. */
+  readonly protect?: (pathname: string) => boolean;
+  /** Path prefixes that require a session (e.g. `["/dashboard", "/api"]`). */
+  readonly protectedPrefixes?: readonly string[];
+}
+
+export type AuthMiddlewareResult =
+  | {
+      readonly action: "next";
+      /** Present when the session was refreshed — apply to the outgoing response. */
+      readonly setCookie?: string;
+    }
+  | {
+      /** Return this response to the client (302 login redirect or 503 problem). */
+      readonly action: "respond";
+      readonly response: Response;
+    };
+
+export const createAuthMiddleware = (
+  auth: ServerAuth,
+  options: AuthMiddlewareOptions = {},
+): ((request: Request) => Promise<AuthMiddlewareResult>) => {
+  const isProtected = (pathname: string): boolean => {
+    if (options.protect !== undefined) return options.protect(pathname);
+    return (options.protectedPrefixes ?? []).some((prefix) => pathname.startsWith(prefix));
+  };
+
+  return async (request) => {
+    const pathname = new URL(request.url).pathname;
+    if (!isProtected(pathname)) {
+      return { action: "next" };
+    }
+    const outcome = await auth.requireSession(request);
+    if (outcome.ok) {
+      return {
+        action: "next",
+        ...(outcome.setCookie !== undefined ? { setCookie: outcome.setCookie } : {}),
+      };
+    }
+    return { action: "respond", response: outcome.response };
+  };
+};

package/src/no-next-import.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, test } from "vitest";
+
+/**
+ * Dependency-boundary guarantee: @smartcrab/next must never import
+ * `next` (or `next/*`) — the helpers are designed against Web-standard
+ * Request/Response structurally, so the package works with any Next version
+ * and none of its types leak into our API. This scans every source file
+ * (including this test) for a forbidden import.
+ *
+ * The scan uses vite's `import.meta.glob` (vitest implements it) because
+ * this package intentionally carries no `@types/node` — indeed, a stray
+ * `import "next"` would also fail `tsc --noEmit` outright, since `next` is
+ * not installed for this package (proof by construction).
+ */
+
+declare global {
+  interface ImportMeta {
+    /** Subset of vite's glob import used for the raw-source scan. */
+    readonly glob: (
+      pattern: string,
+      options: { readonly eager: true; readonly query: "?raw"; readonly import: "default" },
+    ) => Record<string, unknown>;
+  }
+}
+
+// Line-anchored so doc-comment examples (which start with ` * `) never match.
+const NEXT_IMPORT_PATTERN = /^(?:import|export)\s[^;\n]*?from\s*["']next(?:\/[^"']*)?["']/m;
+const NEXT_DYNAMIC_IMPORT_PATTERN = /^import\s*\(\s*["']next(?:\/[^"']*)?["']/m;
+
+describe("no next dependency", () => {
+  test("no source file imports next or next/*", () => {
+    const sources = import.meta.glob("./*.ts", { eager: true, query: "?raw", import: "default" });
+    const offenders = Object.entries(sources)
+      .filter(
+        ([, content]) =>
+          typeof content === "string" &&
+          (NEXT_IMPORT_PATTERN.test(content) || NEXT_DYNAMIC_IMPORT_PATTERN.test(content)),
+      )
+      .map(([path]) => path);
+    expect(offenders).toEqual([]);
+  });
+
+  test("the glob scan actually sees the source files", () => {
+    const sources = import.meta.glob("./*.ts", { eager: true, query: "?raw", import: "default" });
+    expect(Object.keys(sources).length).toBeGreaterThanOrEqual(4);
+  });
+});