@smritix.ai/nextjs 0.1.0

package/dist/index.d.mts

@@ -0,0 +1,4 @@
+export { AuthMiddlewareOptions, AuthResult, authMiddleware } from './middleware.mjs';
+export { AuthObject, auth, currentOrg, currentUser, protect } from './server.mjs';
+export { ChallengeType, OrganizationSwitcher, RiskLevel, SessionClaims, SignIn, SignUp, UserButton, VaultixContextValue, VaultixOrganization, VaultixProvider, VaultixProviderProps, VaultixSession, VaultixUser, useOrganization, useSession, useUser, useVaultix } from '@smritix.ai/react';
+import 'next/server';

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { AuthMiddlewareOptions, AuthResult, authMiddleware } from './middleware.js';
+export { AuthObject, auth, currentOrg, currentUser, protect } from './server.js';
+export { ChallengeType, OrganizationSwitcher, RiskLevel, SessionClaims, SignIn, SignUp, UserButton, VaultixContextValue, VaultixOrganization, VaultixProvider, VaultixProviderProps, VaultixSession, VaultixUser, useOrganization, useSession, useUser, useVaultix } from '@smritix.ai/react';
+import 'next/server';

package/dist/index.js

@@ -0,0 +1,222 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  OrganizationSwitcher: () => import_react.OrganizationSwitcher,
+  SignIn: () => import_react.SignIn,
+  SignUp: () => import_react.SignUp,
+  UserButton: () => import_react.UserButton,
+  VaultixProvider: () => import_react.VaultixProvider,
+  auth: () => auth,
+  authMiddleware: () => authMiddleware,
+  currentOrg: () => currentOrg,
+  currentUser: () => currentUser,
+  protect: () => protect,
+  useOrganization: () => import_react.useOrganization,
+  useSession: () => import_react.useSession,
+  useUser: () => import_react.useUser,
+  useVaultix: () => import_react.useVaultix
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/middleware.ts
+var import_jose = require("jose");
+var import_server = require("next/server");
+var HEADER_USER_ID = "x-vaultix-user-id";
+var HEADER_ORG_ID = "x-vaultix-org-id";
+var HEADER_ORG_ROLE = "x-vaultix-org-role";
+var HEADER_SESSION_ID = "x-vaultix-session-id";
+var HEADER_RISK_LEVEL = "x-vaultix-risk-level";
+var cachedKey = null;
+var cachedPem = null;
+async function getPublicKey() {
+  const pem = process.env.VAULTIX_JWT_PUBLIC_KEY;
+  if (!pem) return null;
+  if (cachedKey && cachedPem === pem) return cachedKey;
+  try {
+    cachedKey = await (0, import_jose.importSPKI)(pem, "RS256");
+    cachedPem = pem;
+    return cachedKey;
+  } catch {
+    return null;
+  }
+}
+function isPublic(pathname, rules) {
+  return rules.some((rule) => {
+    if (typeof rule === "string") {
+      return pathname === rule || pathname.startsWith(rule);
+    }
+    return rule.test(pathname);
+  });
+}
+function authMiddleware(options = {}) {
+  const {
+    publicRoutes = [],
+    signInUrl = "/sign-in",
+    afterAuth
+  } = options;
+  return async function middleware(req) {
+    const { pathname } = req.nextUrl;
+    const publicRoute = isPublic(pathname, publicRoutes);
+    let result = {
+      userId: null,
+      orgId: null,
+      orgRole: null,
+      sessionId: null,
+      riskLevel: null,
+      isSignedIn: false,
+      isPublicRoute: publicRoute
+    };
+    const sessionCookie = req.cookies.get("vaultix-session")?.value ?? extractBearer(req.headers.get("authorization") ?? "");
+    if (sessionCookie) {
+      const key = await getPublicKey();
+      if (key) {
+        try {
+          const { payload } = await (0, import_jose.jwtVerify)(sessionCookie, key, {
+            algorithms: ["RS256"]
+          });
+          result = {
+            userId: payload["uid"] ?? null,
+            orgId: payload["org"] ?? null,
+            orgRole: payload["rol"] ?? null,
+            sessionId: payload["sid"] ?? null,
+            riskLevel: payload["risk"] ?? "low",
+            isSignedIn: true,
+            isPublicRoute: publicRoute
+          };
+        } catch {
+        }
+      }
+    }
+    if (afterAuth) {
+      const override = afterAuth(result, req);
+      if (override) return override;
+    }
+    if (!result.isSignedIn && !publicRoute) {
+      const dest = new URL(signInUrl, req.url);
+      dest.searchParams.set("redirect_url", req.url);
+      return import_server.NextResponse.redirect(dest);
+    }
+    const next = new Headers(req.headers);
+    if (result.userId) {
+      next.set(HEADER_USER_ID, result.userId);
+      next.set(HEADER_ORG_ID, result.orgId ?? "");
+      next.set(HEADER_ORG_ROLE, result.orgRole ?? "");
+      next.set(HEADER_SESSION_ID, result.sessionId ?? "");
+      next.set(HEADER_RISK_LEVEL, result.riskLevel ?? "low");
+    } else {
+      [HEADER_USER_ID, HEADER_ORG_ID, HEADER_ORG_ROLE, HEADER_SESSION_ID, HEADER_RISK_LEVEL].forEach((h) => next.delete(h));
+    }
+    return import_server.NextResponse.next({ request: { headers: next } });
+  };
+}
+function extractBearer(header) {
+  return header.startsWith("Bearer ") ? header.slice(7) : "";
+}
+
+// src/server.ts
+var import_headers = require("next/headers");
+var import_navigation = require("next/navigation");
+async function auth() {
+  const h = await (0, import_headers.headers)();
+  const userId = h.get(HEADER_USER_ID);
+  if (!userId) {
+    return {
+      userId: null,
+      orgId: null,
+      orgRole: null,
+      sessionId: null,
+      riskLevel: null,
+      isSignedIn: false
+    };
+  }
+  return {
+    userId,
+    orgId: h.get(HEADER_ORG_ID) || null,
+    orgRole: h.get(HEADER_ORG_ROLE) || null,
+    sessionId: h.get(HEADER_SESSION_ID) || null,
+    riskLevel: h.get(HEADER_RISK_LEVEL) ?? "low",
+    isSignedIn: true
+  };
+}
+async function protect(redirectTo = "/sign-in") {
+  const authObj = await auth();
+  if (!authObj.isSignedIn) {
+    (0, import_navigation.redirect)(redirectTo);
+  }
+  return authObj;
+}
+async function currentUser() {
+  const { userId } = await auth();
+  if (!userId) return null;
+  const apiUrl = process.env["VAULTIX_API_URL"];
+  const secret = process.env["VAULTIX_SECRET_KEY"];
+  if (!apiUrl || !secret) return null;
+  try {
+    const res = await fetch(`${apiUrl}/v1/users/${userId}`, {
+      headers: { Authorization: `Bearer ${secret}` },
+      cache: "no-store"
+    });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+async function currentOrg() {
+  const { orgId } = await auth();
+  if (!orgId) return null;
+  const apiUrl = process.env["VAULTIX_API_URL"];
+  const secret = process.env["VAULTIX_SECRET_KEY"];
+  if (!apiUrl || !secret) return null;
+  try {
+    const orgFetchInit = {
+      headers: { Authorization: `Bearer ${secret}` },
+      next: { revalidate: 30 }
+    };
+    const res = await fetch(`${apiUrl}/v1/orgs/${orgId}`, orgFetchInit);
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+
+// src/index.ts
+var import_react = require("@smritix.ai/react");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OrganizationSwitcher,
+  SignIn,
+  SignUp,
+  UserButton,
+  VaultixProvider,
+  auth,
+  authMiddleware,
+  currentOrg,
+  currentUser,
+  protect,
+  useOrganization,
+  useSession,
+  useUser,
+  useVaultix
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/middleware.ts","../src/server.ts"],"sourcesContent":["// @smritix.ai/nextjs — barrel export\n// Safe to import in all contexts (client, server, middleware).\n// For server-only utilities: import from \"@smritix.ai/nextjs/server\"\n// For the middleware factory: import from \"@smritix.ai/nextjs/middleware\"\n\n// ── Middleware ────────────────────────────────────────────────────────────────\nexport { authMiddleware } from \"./middleware\";\nexport type { AuthMiddlewareOptions, AuthResult } from \"./middleware\";\n\n// ── Server helpers ────────────────────────────────────────────────────────────\n// Re-exported for convenience; callers on client must use the explicit subpath.\nexport { auth, currentOrg, currentUser, protect } from \"./server\";\nexport type { AuthObject } from \"./server\";\n\n// ── Client SDK re-exports ─────────────────────────────────────────────────────\n// VaultixProvider, hooks, and UI components — safe for Client Components.\nexport {\n  OrganizationSwitcher,\n  SignIn,\n  SignUp,\n  VaultixProvider,\n  UserButton,\n  useOrganization,\n  useSession,\n  useVaultix,\n  useUser,\n} from \"@smritix.ai/react\";\n\nexport type {\n  ChallengeType,\n  RiskLevel,\n  SessionClaims,\n  VaultixContextValue,\n  VaultixOrganization,\n  VaultixProviderProps,\n  VaultixSession,\n  VaultixUser,\n} from \"@smritix.ai/react\";\n","// Edge-runtime compatible. Uses jose (not Node crypto) for JWT verification.\nimport { importSPKI, jwtVerify, type KeyLike } from \"jose\";\nimport { NextRequest, NextResponse } from \"next/server\";\n\n// ─── Types ────────────────────────────────────────────────────────────────────\n\nexport interface AuthResult {\n  /** Authenticated user ID (`sub` claim), or null if unauthenticated. */\n  userId: string | null;\n  orgId: string | null;\n  orgRole: string | null;\n  sessionId: string | null;\n  riskLevel: string | null;\n  isSignedIn: boolean;\n  isPublicRoute: boolean;\n}\n\nexport interface AuthMiddlewareOptions {\n  /**\n   * Routes that do not require authentication.\n   * Strings are matched by exact path or prefix (e.g. \"/sign-in\" or \"/api/public/\").\n   * RegExps are tested against `pathname`.\n   */\n  publicRoutes?: Array<string | RegExp>;\n\n  /** Where to redirect unauthenticated users. Default: \"/sign-in\". */\n  signInUrl?: string;\n\n  /**\n   * Custom logic after auth state is determined.\n   * Return a `NextResponse` to short-circuit the default redirect behaviour;\n   * return `undefined` to continue with defaults.\n   */\n  afterAuth?: (\n    auth: AuthResult,\n    req: NextRequest,\n  ) => NextResponse | Response | undefined | void;\n}\n\n// ─── Header names injected into RSC requests ──────────────────────────────────\n\nexport const HEADER_USER_ID   = \"x-vaultix-user-id\";\nexport const HEADER_ORG_ID    = \"x-vaultix-org-id\";\nexport const HEADER_ORG_ROLE  = \"x-vaultix-org-role\";\nexport const HEADER_SESSION_ID = \"x-vaultix-session-id\";\nexport const HEADER_RISK_LEVEL = \"x-vaultix-risk-level\";\n\n// ─── Public-key cache ─────────────────────────────────────────────────────────\n// Importing an RSA public key is CPU-bound work; cache it across invocations.\n\nlet cachedKey: KeyLike | null = null;\nlet cachedPem: string | null = null;\n\nasync function getPublicKey(): Promise<KeyLike | null> {\n  const pem = process.env.VAULTIX_JWT_PUBLIC_KEY;\n  if (!pem) return null;\n  if (cachedKey && cachedPem === pem) return cachedKey;\n\n  try {\n    cachedKey = await importSPKI(pem, \"RS256\");\n    cachedPem = pem;\n    return cachedKey;\n  } catch {\n    return null;\n  }\n}\n\n// ─── Route matching ───────────────────────────────────────────────────────────\n\nfunction isPublic(pathname: string, rules: Array<string | RegExp>): boolean {\n  return rules.some((rule) => {\n    if (typeof rule === \"string\") {\n      return pathname === rule || pathname.startsWith(rule);\n    }\n    return rule.test(pathname);\n  });\n}\n\n// ─── authMiddleware factory ───────────────────────────────────────────────────\n\n/**\n * authMiddleware wraps your Next.js middleware.ts export.\n *\n * @example\n * // middleware.ts\n * import { authMiddleware } from \"@smritix.ai/nextjs/middleware\";\n * export default authMiddleware({ publicRoutes: [\"/sign-in\", \"/sign-up\"] });\n * export const config = { matcher: [\"/((?!_next|.*\\\\..*).*)\"] };\n */\nexport function authMiddleware(options: AuthMiddlewareOptions = {}) {\n  const {\n    publicRoutes = [],\n    signInUrl = \"/sign-in\",\n    afterAuth,\n  } = options;\n\n  return async function middleware(req: NextRequest): Promise<NextResponse> {\n    const { pathname } = req.nextUrl;\n    const publicRoute = isPublic(pathname, publicRoutes);\n\n    // Attempt to verify the session cookie.\n    let result: AuthResult = {\n      userId: null,\n      orgId: null,\n      orgRole: null,\n      sessionId: null,\n      riskLevel: null,\n      isSignedIn: false,\n      isPublicRoute: publicRoute,\n    };\n\n    const sessionCookie =\n      req.cookies.get(\"vaultix-session\")?.value ??\n      extractBearer(req.headers.get(\"authorization\") ?? \"\");\n\n    if (sessionCookie) {\n      const key = await getPublicKey();\n      if (key) {\n        try {\n          const { payload } = await jwtVerify(sessionCookie, key, {\n            algorithms: [\"RS256\"],\n          });\n\n          result = {\n            userId:    (payload[\"uid\"]  as string) ?? null,\n            orgId:     (payload[\"org\"]  as string) ?? null,\n            orgRole:   (payload[\"rol\"]  as string) ?? null,\n            sessionId: (payload[\"sid\"]  as string) ?? null,\n            riskLevel: (payload[\"risk\"] as string) ?? \"low\",\n            isSignedIn: true,\n            isPublicRoute: publicRoute,\n          };\n        } catch {\n          // Expired or tampered token → treat as signed-out.\n        }\n      }\n    }\n\n    // Let callers override the default redirect logic.\n    if (afterAuth) {\n      const override = afterAuth(result, req);\n      if (override) return override as NextResponse;\n    }\n\n    // Default: redirect unauthenticated requests to the sign-in page.\n    if (!result.isSignedIn && !publicRoute) {\n      const dest = new URL(signInUrl, req.url);\n      dest.searchParams.set(\"redirect_url\", req.url);\n      return NextResponse.redirect(dest);\n    }\n\n    // Propagate auth claims to Server Components via request headers.\n    const next = new Headers(req.headers);\n    if (result.userId) {\n      next.set(HEADER_USER_ID,    result.userId);\n      next.set(HEADER_ORG_ID,     result.orgId ?? \"\");\n      next.set(HEADER_ORG_ROLE,   result.orgRole ?? \"\");\n      next.set(HEADER_SESSION_ID, result.sessionId ?? \"\");\n      next.set(HEADER_RISK_LEVEL, result.riskLevel ?? \"low\");\n    } else {\n      // Clear any previously-set headers (defence-in-depth).\n      [HEADER_USER_ID, HEADER_ORG_ID, HEADER_ORG_ROLE, HEADER_SESSION_ID, HEADER_RISK_LEVEL]\n        .forEach((h) => next.delete(h));\n    }\n\n    return NextResponse.next({ request: { headers: next } });\n  };\n}\n\nfunction extractBearer(header: string): string {\n  return header.startsWith(\"Bearer \") ? header.slice(7) : \"\";\n}\n","// This file is server-only. Import from \"@smritix.ai/nextjs/server\".\n// Do NOT import in Client Components — it will throw at runtime.\nimport { headers } from \"next/headers\";\nimport { redirect } from \"next/navigation\";\nimport type { VaultixOrganization, VaultixUser } from \"@smritix.ai/react\";\nimport {\n  HEADER_ORG_ID,\n  HEADER_ORG_ROLE,\n  HEADER_RISK_LEVEL,\n  HEADER_SESSION_ID,\n  HEADER_USER_ID,\n} from \"./middleware\";\n\n// Next.js extends RequestInit with cache and next options for its data cache.\ntype NextRequestInit = RequestInit & {\n  cache?: RequestCache;\n  next?: { revalidate?: number | false; tags?: string[] };\n};\n\n// ─── Types ────────────────────────────────────────────────────────────────────\n\nexport interface AuthObject {\n  userId: string | null;\n  orgId: string | null;\n  orgRole: string | null;\n  sessionId: string | null;\n  riskLevel: \"low\" | \"medium\" | \"high\" | \"critical\" | null;\n  isSignedIn: boolean;\n}\n\n// ─── auth() ───────────────────────────────────────────────────────────────────\n\n/**\n * Returns the current auth state by reading the headers injected by\n * `authMiddleware`. Call this in Server Components, Route Handlers, and\n * Server Actions — never in Client Components.\n *\n * @example\n * import { auth } from \"@smritix.ai/nextjs/server\";\n * export default async function Page() {\n *   const { userId, orgId } = await auth();\n *   …\n * }\n */\nexport async function auth(): Promise<AuthObject> {\n  const h = await headers();\n  const userId = h.get(HEADER_USER_ID);\n\n  if (!userId) {\n    return {\n      userId: null,\n      orgId: null,\n      orgRole: null,\n      sessionId: null,\n      riskLevel: null,\n      isSignedIn: false,\n    };\n  }\n\n  return {\n    userId,\n    orgId:     h.get(HEADER_ORG_ID)     || null,\n    orgRole:   h.get(HEADER_ORG_ROLE)   || null,\n    sessionId: h.get(HEADER_SESSION_ID) || null,\n    riskLevel: (h.get(HEADER_RISK_LEVEL) ?? \"low\") as AuthObject[\"riskLevel\"],\n    isSignedIn: true,\n  };\n}\n\n// ─── protect() ────────────────────────────────────────────────────────────────\n\n/**\n * Asserts that the current user is authenticated. Redirects to `/sign-in`\n * if not. Returns the auth object for convenience.\n *\n * @example\n * export default async function ProtectedPage() {\n *   const { userId } = await protect();\n *   …\n * }\n */\nexport async function protect(redirectTo = \"/sign-in\"): Promise<AuthObject> {\n  const authObj = await auth();\n  if (!authObj.isSignedIn) {\n    redirect(redirectTo);\n  }\n  return authObj;\n}\n\n// ─── currentUser() ────────────────────────────────────────────────────────────\n\n/**\n * Fetches the full `VaultixUser` record from the auth engine using server-to-server\n * credentials (`VAULTIX_API_URL` + `VAULTIX_SECRET_KEY` env vars).\n * Returns null when unauthenticated or when env vars are missing.\n *\n * Responses are never cached (`cache: \"no-store\"`) — user data must be fresh.\n */\nexport async function currentUser(): Promise<VaultixUser | null> {\n  const { userId } = await auth();\n  if (!userId) return null;\n\n  const apiUrl = process.env[\"VAULTIX_API_URL\"];\n  const secret = process.env[\"VAULTIX_SECRET_KEY\"];\n  if (!apiUrl || !secret) return null;\n\n  try {\n    const res = await fetch(`${apiUrl}/v1/users/${userId}`, {\n      headers: { Authorization: `Bearer ${secret}` },\n      cache: \"no-store\",\n    });\n    if (!res.ok) return null;\n    return (await res.json()) as VaultixUser;\n  } catch {\n    return null;\n  }\n}\n\n// ─── currentOrg() ────────────────────────────────────────────────────────────\n\n/**\n * Fetches the active `VaultixOrganization` from the auth engine.\n * Returns null when the user has no active org or env vars are missing.\n *\n * Responses are cached for 30 seconds — org data changes infrequently.\n */\nexport async function currentOrg(): Promise<VaultixOrganization | null> {\n  const { orgId } = await auth();\n  if (!orgId) return null;\n\n  const apiUrl = process.env[\"VAULTIX_API_URL\"];\n  const secret = process.env[\"VAULTIX_SECRET_KEY\"];\n  if (!apiUrl || !secret) return null;\n\n  try {\n    const orgFetchInit: NextRequestInit = {\n      headers: { Authorization: `Bearer ${secret}` },\n      next: { revalidate: 30 },\n    };\n    const res = await fetch(`${apiUrl}/v1/orgs/${orgId}`, orgFetchInit as RequestInit);\n    if (!res.ok) return null;\n    return (await res.json()) as VaultixOrganization;\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACCA,kBAAoD;AACpD,oBAA0C;AAuCnC,IAAM,iBAAmB;AACzB,IAAM,gBAAmB;AACzB,IAAM,kBAAmB;AACzB,IAAM,oBAAoB;AAC1B,IAAM,oBAAoB;AAKjC,IAAI,YAA4B;AAChC,IAAI,YAA2B;AAE/B,eAAe,eAAwC;AACrD,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,aAAa,cAAc,IAAK,QAAO;AAE3C,MAAI;AACF,gBAAY,UAAM,wBAAW,KAAK,OAAO;AACzC,gBAAY;AACZ,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,SAAS,SAAS,UAAkB,OAAwC;AAC1E,SAAO,MAAM,KAAK,CAAC,SAAS;AAC1B,QAAI,OAAO,SAAS,UAAU;AAC5B,aAAO,aAAa,QAAQ,SAAS,WAAW,IAAI;AAAA,IACtD;AACA,WAAO,KAAK,KAAK,QAAQ;AAAA,EAC3B,CAAC;AACH;AAaO,SAAS,eAAe,UAAiC,CAAC,GAAG;AAClE,QAAM;AAAA,IACJ,eAAe,CAAC;AAAA,IAChB,YAAY;AAAA,IACZ;AAAA,EACF,IAAI;AAEJ,SAAO,eAAe,WAAW,KAAyC;AACxE,UAAM,EAAE,SAAS,IAAI,IAAI;AACzB,UAAM,cAAc,SAAS,UAAU,YAAY;AAGnD,QAAI,SAAqB;AAAA,MACvB,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,SAAS;AAAA,MACT,WAAW;AAAA,MACX,WAAW;AAAA,MACX,YAAY;AAAA,MACZ,eAAe;AAAA,IACjB;AAEA,UAAM,gBACJ,IAAI,QAAQ,IAAI,iBAAiB,GAAG,SACpC,cAAc,IAAI,QAAQ,IAAI,eAAe,KAAK,EAAE;AAEtD,QAAI,eAAe;AACjB,YAAM,MAAM,MAAM,aAAa;AAC/B,UAAI,KAAK;AACP,YAAI;AACF,gBAAM,EAAE,QAAQ,IAAI,UAAM,uBAAU,eAAe,KAAK;AAAA,YACtD,YAAY,CAAC,OAAO;AAAA,UACtB,CAAC;AAED,mBAAS;AAAA,YACP,QAAY,QAAQ,KAAK,KAAiB;AAAA,YAC1C,OAAY,QAAQ,KAAK,KAAiB;AAAA,YAC1C,SAAY,QAAQ,KAAK,KAAiB;AAAA,YAC1C,WAAY,QAAQ,KAAK,KAAiB;AAAA,YAC1C,WAAY,QAAQ,MAAM,KAAgB;AAAA,YAC1C,YAAY;AAAA,YACZ,eAAe;AAAA,UACjB;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAGA,QAAI,WAAW;AACb,YAAM,WAAW,UAAU,QAAQ,GAAG;AACtC,UAAI,SAAU,QAAO;AAAA,IACvB;AAGA,QAAI,CAAC,OAAO,cAAc,CAAC,aAAa;AACtC,YAAM,OAAO,IAAI,IAAI,WAAW,IAAI,GAAG;AACvC,WAAK,aAAa,IAAI,gBAAgB,IAAI,GAAG;AAC7C,aAAO,2BAAa,SAAS,IAAI;AAAA,IACnC;AAGA,UAAM,OAAO,IAAI,QAAQ,IAAI,OAAO;AACpC,QAAI,OAAO,QAAQ;AACjB,WAAK,IAAI,gBAAmB,OAAO,MAAM;AACzC,WAAK,IAAI,eAAmB,OAAO,SAAS,EAAE;AAC9C,WAAK,IAAI,iBAAmB,OAAO,WAAW,EAAE;AAChD,WAAK,IAAI,mBAAmB,OAAO,aAAa,EAAE;AAClD,WAAK,IAAI,mBAAmB,OAAO,aAAa,KAAK;AAAA,IACvD,OAAO;AAEL,OAAC,gBAAgB,eAAe,iBAAiB,mBAAmB,iBAAiB,EAClF,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;AAAA,IAClC;AAEA,WAAO,2BAAa,KAAK,EAAE,SAAS,EAAE,SAAS,KAAK,EAAE,CAAC;AAAA,EACzD;AACF;AAEA,SAAS,cAAc,QAAwB;AAC7C,SAAO,OAAO,WAAW,SAAS,IAAI,OAAO,MAAM,CAAC,IAAI;AAC1D;;;ACzKA,qBAAwB;AACxB,wBAAyB;AAyCzB,eAAsB,OAA4B;AAChD,QAAM,IAAI,UAAM,wBAAQ;AACxB,QAAM,SAAS,EAAE,IAAI,cAAc;AAEnC,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,SAAS;AAAA,MACT,WAAW;AAAA,MACX,WAAW;AAAA,MACX,YAAY;AAAA,IACd;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,OAAW,EAAE,IAAI,aAAa,KAAS;AAAA,IACvC,SAAW,EAAE,IAAI,eAAe,KAAO;AAAA,IACvC,WAAW,EAAE,IAAI,iBAAiB,KAAK;AAAA,IACvC,WAAY,EAAE,IAAI,iBAAiB,KAAK;AAAA,IACxC,YAAY;AAAA,EACd;AACF;AAcA,eAAsB,QAAQ,aAAa,YAAiC;AAC1E,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAQ,YAAY;AACvB,oCAAS,UAAU;AAAA,EACrB;AACA,SAAO;AACT;AAWA,eAAsB,cAA2C;AAC/D,QAAM,EAAE,OAAO,IAAI,MAAM,KAAK;AAC9B,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,QAAQ,IAAI,iBAAiB;AAC5C,QAAM,SAAS,QAAQ,IAAI,oBAAoB;AAC/C,MAAI,CAAC,UAAU,CAAC,OAAQ,QAAO;AAE/B,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,MAAM,aAAa,MAAM,IAAI;AAAA,MACtD,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG;AAAA,MAC7C,OAAO;AAAA,IACT,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUA,eAAsB,aAAkD;AACtE,QAAM,EAAE,MAAM,IAAI,MAAM,KAAK;AAC7B,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,SAAS,QAAQ,IAAI,iBAAiB;AAC5C,QAAM,SAAS,QAAQ,IAAI,oBAAoB;AAC/C,MAAI,CAAC,UAAU,CAAC,OAAQ,QAAO;AAE/B,MAAI;AACF,UAAM,eAAgC;AAAA,MACpC,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG;AAAA,MAC7C,MAAM,EAAE,YAAY,GAAG;AAAA,IACzB;AACA,UAAM,MAAM,MAAM,MAAM,GAAG,MAAM,YAAY,KAAK,IAAI,YAA2B;AACjF,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AFjIA,mBAUO;","names":[]}

package/dist/index.mjs

@@ -0,0 +1,192 @@
+// src/middleware.ts
+import { importSPKI, jwtVerify } from "jose";
+import { NextResponse } from "next/server";
+var HEADER_USER_ID = "x-vaultix-user-id";
+var HEADER_ORG_ID = "x-vaultix-org-id";
+var HEADER_ORG_ROLE = "x-vaultix-org-role";
+var HEADER_SESSION_ID = "x-vaultix-session-id";
+var HEADER_RISK_LEVEL = "x-vaultix-risk-level";
+var cachedKey = null;
+var cachedPem = null;
+async function getPublicKey() {
+  const pem = process.env.VAULTIX_JWT_PUBLIC_KEY;
+  if (!pem) return null;
+  if (cachedKey && cachedPem === pem) return cachedKey;
+  try {
+    cachedKey = await importSPKI(pem, "RS256");
+    cachedPem = pem;
+    return cachedKey;
+  } catch {
+    return null;
+  }
+}
+function isPublic(pathname, rules) {
+  return rules.some((rule) => {
+    if (typeof rule === "string") {
+      return pathname === rule || pathname.startsWith(rule);
+    }
+    return rule.test(pathname);
+  });
+}
+function authMiddleware(options = {}) {
+  const {
+    publicRoutes = [],
+    signInUrl = "/sign-in",
+    afterAuth
+  } = options;
+  return async function middleware(req) {
+    const { pathname } = req.nextUrl;
+    const publicRoute = isPublic(pathname, publicRoutes);
+    let result = {
+      userId: null,
+      orgId: null,
+      orgRole: null,
+      sessionId: null,
+      riskLevel: null,
+      isSignedIn: false,
+      isPublicRoute: publicRoute
+    };
+    const sessionCookie = req.cookies.get("vaultix-session")?.value ?? extractBearer(req.headers.get("authorization") ?? "");
+    if (sessionCookie) {
+      const key = await getPublicKey();
+      if (key) {
+        try {
+          const { payload } = await jwtVerify(sessionCookie, key, {
+            algorithms: ["RS256"]
+          });
+          result = {
+            userId: payload["uid"] ?? null,
+            orgId: payload["org"] ?? null,
+            orgRole: payload["rol"] ?? null,
+            sessionId: payload["sid"] ?? null,
+            riskLevel: payload["risk"] ?? "low",
+            isSignedIn: true,
+            isPublicRoute: publicRoute
+          };
+        } catch {
+        }
+      }
+    }
+    if (afterAuth) {
+      const override = afterAuth(result, req);
+      if (override) return override;
+    }
+    if (!result.isSignedIn && !publicRoute) {
+      const dest = new URL(signInUrl, req.url);
+      dest.searchParams.set("redirect_url", req.url);
+      return NextResponse.redirect(dest);
+    }
+    const next = new Headers(req.headers);
+    if (result.userId) {
+      next.set(HEADER_USER_ID, result.userId);
+      next.set(HEADER_ORG_ID, result.orgId ?? "");
+      next.set(HEADER_ORG_ROLE, result.orgRole ?? "");
+      next.set(HEADER_SESSION_ID, result.sessionId ?? "");
+      next.set(HEADER_RISK_LEVEL, result.riskLevel ?? "low");
+    } else {
+      [HEADER_USER_ID, HEADER_ORG_ID, HEADER_ORG_ROLE, HEADER_SESSION_ID, HEADER_RISK_LEVEL].forEach((h) => next.delete(h));
+    }
+    return NextResponse.next({ request: { headers: next } });
+  };
+}
+function extractBearer(header) {
+  return header.startsWith("Bearer ") ? header.slice(7) : "";
+}
+
+// src/server.ts
+import { headers } from "next/headers";
+import { redirect } from "next/navigation";
+async function auth() {
+  const h = await headers();
+  const userId = h.get(HEADER_USER_ID);
+  if (!userId) {
+    return {
+      userId: null,
+      orgId: null,
+      orgRole: null,
+      sessionId: null,
+      riskLevel: null,
+      isSignedIn: false
+    };
+  }
+  return {
+    userId,
+    orgId: h.get(HEADER_ORG_ID) || null,
+    orgRole: h.get(HEADER_ORG_ROLE) || null,
+    sessionId: h.get(HEADER_SESSION_ID) || null,
+    riskLevel: h.get(HEADER_RISK_LEVEL) ?? "low",
+    isSignedIn: true
+  };
+}
+async function protect(redirectTo = "/sign-in") {
+  const authObj = await auth();
+  if (!authObj.isSignedIn) {
+    redirect(redirectTo);
+  }
+  return authObj;
+}
+async function currentUser() {
+  const { userId } = await auth();
+  if (!userId) return null;
+  const apiUrl = process.env["VAULTIX_API_URL"];
+  const secret = process.env["VAULTIX_SECRET_KEY"];
+  if (!apiUrl || !secret) return null;
+  try {
+    const res = await fetch(`${apiUrl}/v1/users/${userId}`, {
+      headers: { Authorization: `Bearer ${secret}` },
+      cache: "no-store"
+    });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+async function currentOrg() {
+  const { orgId } = await auth();
+  if (!orgId) return null;
+  const apiUrl = process.env["VAULTIX_API_URL"];
+  const secret = process.env["VAULTIX_SECRET_KEY"];
+  if (!apiUrl || !secret) return null;
+  try {
+    const orgFetchInit = {
+      headers: { Authorization: `Bearer ${secret}` },
+      next: { revalidate: 30 }
+    };
+    const res = await fetch(`${apiUrl}/v1/orgs/${orgId}`, orgFetchInit);
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+
+// src/index.ts
+import {
+  OrganizationSwitcher,
+  SignIn,
+  SignUp,
+  VaultixProvider,
+  UserButton,
+  useOrganization,
+  useSession,
+  useVaultix,
+  useUser
+} from "@smritix.ai/react";
+export {
+  OrganizationSwitcher,
+  SignIn,
+  SignUp,
+  UserButton,
+  VaultixProvider,
+  auth,
+  authMiddleware,
+  currentOrg,
+  currentUser,
+  protect,
+  useOrganization,
+  useSession,
+  useUser,
+  useVaultix
+};
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/middleware.ts","../src/server.ts","../src/index.ts"],"sourcesContent":["// Edge-runtime compatible. Uses jose (not Node crypto) for JWT verification.\nimport { importSPKI, jwtVerify, type KeyLike } from \"jose\";\nimport { NextRequest, NextResponse } from \"next/server\";\n\n// ─── Types ────────────────────────────────────────────────────────────────────\n\nexport interface AuthResult {\n  /** Authenticated user ID (`sub` claim), or null if unauthenticated. */\n  userId: string | null;\n  orgId: string | null;\n  orgRole: string | null;\n  sessionId: string | null;\n  riskLevel: string | null;\n  isSignedIn: boolean;\n  isPublicRoute: boolean;\n}\n\nexport interface AuthMiddlewareOptions {\n  /**\n   * Routes that do not require authentication.\n   * Strings are matched by exact path or prefix (e.g. \"/sign-in\" or \"/api/public/\").\n   * RegExps are tested against `pathname`.\n   */\n  publicRoutes?: Array<string | RegExp>;\n\n  /** Where to redirect unauthenticated users. Default: \"/sign-in\". */\n  signInUrl?: string;\n\n  /**\n   * Custom logic after auth state is determined.\n   * Return a `NextResponse` to short-circuit the default redirect behaviour;\n   * return `undefined` to continue with defaults.\n   */\n  afterAuth?: (\n    auth: AuthResult,\n    req: NextRequest,\n  ) => NextResponse | Response | undefined | void;\n}\n\n// ─── Header names injected into RSC requests ──────────────────────────────────\n\nexport const HEADER_USER_ID   = \"x-vaultix-user-id\";\nexport const HEADER_ORG_ID    = \"x-vaultix-org-id\";\nexport const HEADER_ORG_ROLE  = \"x-vaultix-org-role\";\nexport const HEADER_SESSION_ID = \"x-vaultix-session-id\";\nexport const HEADER_RISK_LEVEL = \"x-vaultix-risk-level\";\n\n// ─── Public-key cache ─────────────────────────────────────────────────────────\n// Importing an RSA public key is CPU-bound work; cache it across invocations.\n\nlet cachedKey: KeyLike | null = null;\nlet cachedPem: string | null = null;\n\nasync function getPublicKey(): Promise<KeyLike | null> {\n  const pem = process.env.VAULTIX_JWT_PUBLIC_KEY;\n  if (!pem) return null;\n  if (cachedKey && cachedPem === pem) return cachedKey;\n\n  try {\n    cachedKey = await importSPKI(pem, \"RS256\");\n    cachedPem = pem;\n    return cachedKey;\n  } catch {\n    return null;\n  }\n}\n\n// ─── Route matching ───────────────────────────────────────────────────────────\n\nfunction isPublic(pathname: string, rules: Array<string | RegExp>): boolean {\n  return rules.some((rule) => {\n    if (typeof rule === \"string\") {\n      return pathname === rule || pathname.startsWith(rule);\n    }\n    return rule.test(pathname);\n  });\n}\n\n// ─── authMiddleware factory ───────────────────────────────────────────────────\n\n/**\n * authMiddleware wraps your Next.js middleware.ts export.\n *\n * @example\n * // middleware.ts\n * import { authMiddleware } from \"@smritix.ai/nextjs/middleware\";\n * export default authMiddleware({ publicRoutes: [\"/sign-in\", \"/sign-up\"] });\n * export const config = { matcher: [\"/((?!_next|.*\\\\..*).*)\"] };\n */\nexport function authMiddleware(options: AuthMiddlewareOptions = {}) {\n  const {\n    publicRoutes = [],\n    signInUrl = \"/sign-in\",\n    afterAuth,\n  } = options;\n\n  return async function middleware(req: NextRequest): Promise<NextResponse> {\n    const { pathname } = req.nextUrl;\n    const publicRoute = isPublic(pathname, publicRoutes);\n\n    // Attempt to verify the session cookie.\n    let result: AuthResult = {\n      userId: null,\n      orgId: null,\n      orgRole: null,\n      sessionId: null,\n      riskLevel: null,\n      isSignedIn: false,\n      isPublicRoute: publicRoute,\n    };\n\n    const sessionCookie =\n      req.cookies.get(\"vaultix-session\")?.value ??\n      extractBearer(req.headers.get(\"authorization\") ?? \"\");\n\n    if (sessionCookie) {\n      const key = await getPublicKey();\n      if (key) {\n        try {\n          const { payload } = await jwtVerify(sessionCookie, key, {\n            algorithms: [\"RS256\"],\n          });\n\n          result = {\n            userId:    (payload[\"uid\"]  as string) ?? null,\n            orgId:     (payload[\"org\"]  as string) ?? null,\n            orgRole:   (payload[\"rol\"]  as string) ?? null,\n            sessionId: (payload[\"sid\"]  as string) ?? null,\n            riskLevel: (payload[\"risk\"] as string) ?? \"low\",\n            isSignedIn: true,\n            isPublicRoute: publicRoute,\n          };\n        } catch {\n          // Expired or tampered token → treat as signed-out.\n        }\n      }\n    }\n\n    // Let callers override the default redirect logic.\n    if (afterAuth) {\n      const override = afterAuth(result, req);\n      if (override) return override as NextResponse;\n    }\n\n    // Default: redirect unauthenticated requests to the sign-in page.\n    if (!result.isSignedIn && !publicRoute) {\n      const dest = new URL(signInUrl, req.url);\n      dest.searchParams.set(\"redirect_url\", req.url);\n      return NextResponse.redirect(dest);\n    }\n\n    // Propagate auth claims to Server Components via request headers.\n    const next = new Headers(req.headers);\n    if (result.userId) {\n      next.set(HEADER_USER_ID,    result.userId);\n      next.set(HEADER_ORG_ID,     result.orgId ?? \"\");\n      next.set(HEADER_ORG_ROLE,   result.orgRole ?? \"\");\n      next.set(HEADER_SESSION_ID, result.sessionId ?? \"\");\n      next.set(HEADER_RISK_LEVEL, result.riskLevel ?? \"low\");\n    } else {\n      // Clear any previously-set headers (defence-in-depth).\n      [HEADER_USER_ID, HEADER_ORG_ID, HEADER_ORG_ROLE, HEADER_SESSION_ID, HEADER_RISK_LEVEL]\n        .forEach((h) => next.delete(h));\n    }\n\n    return NextResponse.next({ request: { headers: next } });\n  };\n}\n\nfunction extractBearer(header: string): string {\n  return header.startsWith(\"Bearer \") ? header.slice(7) : \"\";\n}\n","// This file is server-only. Import from \"@smritix.ai/nextjs/server\".\n// Do NOT import in Client Components — it will throw at runtime.\nimport { headers } from \"next/headers\";\nimport { redirect } from \"next/navigation\";\nimport type { VaultixOrganization, VaultixUser } from \"@smritix.ai/react\";\nimport {\n  HEADER_ORG_ID,\n  HEADER_ORG_ROLE,\n  HEADER_RISK_LEVEL,\n  HEADER_SESSION_ID,\n  HEADER_USER_ID,\n} from \"./middleware\";\n\n// Next.js extends RequestInit with cache and next options for its data cache.\ntype NextRequestInit = RequestInit & {\n  cache?: RequestCache;\n  next?: { revalidate?: number | false; tags?: string[] };\n};\n\n// ─── Types ────────────────────────────────────────────────────────────────────\n\nexport interface AuthObject {\n  userId: string | null;\n  orgId: string | null;\n  orgRole: string | null;\n  sessionId: string | null;\n  riskLevel: \"low\" | \"medium\" | \"high\" | \"critical\" | null;\n  isSignedIn: boolean;\n}\n\n// ─── auth() ───────────────────────────────────────────────────────────────────\n\n/**\n * Returns the current auth state by reading the headers injected by\n * `authMiddleware`. Call this in Server Components, Route Handlers, and\n * Server Actions — never in Client Components.\n *\n * @example\n * import { auth } from \"@smritix.ai/nextjs/server\";\n * export default async function Page() {\n *   const { userId, orgId } = await auth();\n *   …\n * }\n */\nexport async function auth(): Promise<AuthObject> {\n  const h = await headers();\n  const userId = h.get(HEADER_USER_ID);\n\n  if (!userId) {\n    return {\n      userId: null,\n      orgId: null,\n      orgRole: null,\n      sessionId: null,\n      riskLevel: null,\n      isSignedIn: false,\n    };\n  }\n\n  return {\n    userId,\n    orgId:     h.get(HEADER_ORG_ID)     || null,\n    orgRole:   h.get(HEADER_ORG_ROLE)   || null,\n    sessionId: h.get(HEADER_SESSION_ID) || null,\n    riskLevel: (h.get(HEADER_RISK_LEVEL) ?? \"low\") as AuthObject[\"riskLevel\"],\n    isSignedIn: true,\n  };\n}\n\n// ─── protect() ────────────────────────────────────────────────────────────────\n\n/**\n * Asserts that the current user is authenticated. Redirects to `/sign-in`\n * if not. Returns the auth object for convenience.\n *\n * @example\n * export default async function ProtectedPage() {\n *   const { userId } = await protect();\n *   …\n * }\n */\nexport async function protect(redirectTo = \"/sign-in\"): Promise<AuthObject> {\n  const authObj = await auth();\n  if (!authObj.isSignedIn) {\n    redirect(redirectTo);\n  }\n  return authObj;\n}\n\n// ─── currentUser() ────────────────────────────────────────────────────────────\n\n/**\n * Fetches the full `VaultixUser` record from the auth engine using server-to-server\n * credentials (`VAULTIX_API_URL` + `VAULTIX_SECRET_KEY` env vars).\n * Returns null when unauthenticated or when env vars are missing.\n *\n * Responses are never cached (`cache: \"no-store\"`) — user data must be fresh.\n */\nexport async function currentUser(): Promise<VaultixUser | null> {\n  const { userId } = await auth();\n  if (!userId) return null;\n\n  const apiUrl = process.env[\"VAULTIX_API_URL\"];\n  const secret = process.env[\"VAULTIX_SECRET_KEY\"];\n  if (!apiUrl || !secret) return null;\n\n  try {\n    const res = await fetch(`${apiUrl}/v1/users/${userId}`, {\n      headers: { Authorization: `Bearer ${secret}` },\n      cache: \"no-store\",\n    });\n    if (!res.ok) return null;\n    return (await res.json()) as VaultixUser;\n  } catch {\n    return null;\n  }\n}\n\n// ─── currentOrg() ────────────────────────────────────────────────────────────\n\n/**\n * Fetches the active `VaultixOrganization` from the auth engine.\n * Returns null when the user has no active org or env vars are missing.\n *\n * Responses are cached for 30 seconds — org data changes infrequently.\n */\nexport async function currentOrg(): Promise<VaultixOrganization | null> {\n  const { orgId } = await auth();\n  if (!orgId) return null;\n\n  const apiUrl = process.env[\"VAULTIX_API_URL\"];\n  const secret = process.env[\"VAULTIX_SECRET_KEY\"];\n  if (!apiUrl || !secret) return null;\n\n  try {\n    const orgFetchInit: NextRequestInit = {\n      headers: { Authorization: `Bearer ${secret}` },\n      next: { revalidate: 30 },\n    };\n    const res = await fetch(`${apiUrl}/v1/orgs/${orgId}`, orgFetchInit as RequestInit);\n    if (!res.ok) return null;\n    return (await res.json()) as VaultixOrganization;\n  } catch {\n    return null;\n  }\n}\n","// @smritix.ai/nextjs — barrel export\n// Safe to import in all contexts (client, server, middleware).\n// For server-only utilities: import from \"@smritix.ai/nextjs/server\"\n// For the middleware factory: import from \"@smritix.ai/nextjs/middleware\"\n\n// ── Middleware ────────────────────────────────────────────────────────────────\nexport { authMiddleware } from \"./middleware\";\nexport type { AuthMiddlewareOptions, AuthResult } from \"./middleware\";\n\n// ── Server helpers ────────────────────────────────────────────────────────────\n// Re-exported for convenience; callers on client must use the explicit subpath.\nexport { auth, currentOrg, currentUser, protect } from \"./server\";\nexport type { AuthObject } from \"./server\";\n\n// ── Client SDK re-exports ─────────────────────────────────────────────────────\n// VaultixProvider, hooks, and UI components — safe for Client Components.\nexport {\n  OrganizationSwitcher,\n  SignIn,\n  SignUp,\n  VaultixProvider,\n  UserButton,\n  useOrganization,\n  useSession,\n  useVaultix,\n  useUser,\n} from \"@smritix.ai/react\";\n\nexport type {\n  ChallengeType,\n  RiskLevel,\n  SessionClaims,\n  VaultixContextValue,\n  VaultixOrganization,\n  VaultixProviderProps,\n  VaultixSession,\n  VaultixUser,\n} from \"@smritix.ai/react\";\n"],"mappings":";AACA,SAAS,YAAY,iBAA+B;AACpD,SAAsB,oBAAoB;AAuCnC,IAAM,iBAAmB;AACzB,IAAM,gBAAmB;AACzB,IAAM,kBAAmB;AACzB,IAAM,oBAAoB;AAC1B,IAAM,oBAAoB;AAKjC,IAAI,YAA4B;AAChC,IAAI,YAA2B;AAE/B,eAAe,eAAwC;AACrD,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,aAAa,cAAc,IAAK,QAAO;AAE3C,MAAI;AACF,gBAAY,MAAM,WAAW,KAAK,OAAO;AACzC,gBAAY;AACZ,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,SAAS,SAAS,UAAkB,OAAwC;AAC1E,SAAO,MAAM,KAAK,CAAC,SAAS;AAC1B,QAAI,OAAO,SAAS,UAAU;AAC5B,aAAO,aAAa,QAAQ,SAAS,WAAW,IAAI;AAAA,IACtD;AACA,WAAO,KAAK,KAAK,QAAQ;AAAA,EAC3B,CAAC;AACH;AAaO,SAAS,eAAe,UAAiC,CAAC,GAAG;AAClE,QAAM;AAAA,IACJ,eAAe,CAAC;AAAA,IAChB,YAAY;AAAA,IACZ;AAAA,EACF,IAAI;AAEJ,SAAO,eAAe,WAAW,KAAyC;AACxE,UAAM,EAAE,SAAS,IAAI,IAAI;AACzB,UAAM,cAAc,SAAS,UAAU,YAAY;AAGnD,QAAI,SAAqB;AAAA,MACvB,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,SAAS;AAAA,MACT,WAAW;AAAA,MACX,WAAW;AAAA,MACX,YAAY;AAAA,MACZ,eAAe;AAAA,IACjB;AAEA,UAAM,gBACJ,IAAI,QAAQ,IAAI,iBAAiB,GAAG,SACpC,cAAc,IAAI,QAAQ,IAAI,eAAe,KAAK,EAAE;AAEtD,QAAI,eAAe;AACjB,YAAM,MAAM,MAAM,aAAa;AAC/B,UAAI,KAAK;AACP,YAAI;AACF,gBAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,eAAe,KAAK;AAAA,YACtD,YAAY,CAAC,OAAO;AAAA,UACtB,CAAC;AAED,mBAAS;AAAA,YACP,QAAY,QAAQ,KAAK,KAAiB;AAAA,YAC1C,OAAY,QAAQ,KAAK,KAAiB;AAAA,YAC1C,SAAY,QAAQ,KAAK,KAAiB;AAAA,YAC1C,WAAY,QAAQ,KAAK,KAAiB;AAAA,YAC1C,WAAY,QAAQ,MAAM,KAAgB;AAAA,YAC1C,YAAY;AAAA,YACZ,eAAe;AAAA,UACjB;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAGA,QAAI,WAAW;AACb,YAAM,WAAW,UAAU,QAAQ,GAAG;AACtC,UAAI,SAAU,QAAO;AAAA,IACvB;AAGA,QAAI,CAAC,OAAO,cAAc,CAAC,aAAa;AACtC,YAAM,OAAO,IAAI,IAAI,WAAW,IAAI,GAAG;AACvC,WAAK,aAAa,IAAI,gBAAgB,IAAI,GAAG;AAC7C,aAAO,aAAa,SAAS,IAAI;AAAA,IACnC;AAGA,UAAM,OAAO,IAAI,QAAQ,IAAI,OAAO;AACpC,QAAI,OAAO,QAAQ;AACjB,WAAK,IAAI,gBAAmB,OAAO,MAAM;AACzC,WAAK,IAAI,eAAmB,OAAO,SAAS,EAAE;AAC9C,WAAK,IAAI,iBAAmB,OAAO,WAAW,EAAE;AAChD,WAAK,IAAI,mBAAmB,OAAO,aAAa,EAAE;AAClD,WAAK,IAAI,mBAAmB,OAAO,aAAa,KAAK;AAAA,IACvD,OAAO;AAEL,OAAC,gBAAgB,eAAe,iBAAiB,mBAAmB,iBAAiB,EAClF,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;AAAA,IAClC;AAEA,WAAO,aAAa,KAAK,EAAE,SAAS,EAAE,SAAS,KAAK,EAAE,CAAC;AAAA,EACzD;AACF;AAEA,SAAS,cAAc,QAAwB;AAC7C,SAAO,OAAO,WAAW,SAAS,IAAI,OAAO,MAAM,CAAC,IAAI;AAC1D;;;ACzKA,SAAS,eAAe;AACxB,SAAS,gBAAgB;AAyCzB,eAAsB,OAA4B;AAChD,QAAM,IAAI,MAAM,QAAQ;AACxB,QAAM,SAAS,EAAE,IAAI,cAAc;AAEnC,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,SAAS;AAAA,MACT,WAAW;AAAA,MACX,WAAW;AAAA,MACX,YAAY;AAAA,IACd;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,OAAW,EAAE,IAAI,aAAa,KAAS;AAAA,IACvC,SAAW,EAAE,IAAI,eAAe,KAAO;AAAA,IACvC,WAAW,EAAE,IAAI,iBAAiB,KAAK;AAAA,IACvC,WAAY,EAAE,IAAI,iBAAiB,KAAK;AAAA,IACxC,YAAY;AAAA,EACd;AACF;AAcA,eAAsB,QAAQ,aAAa,YAAiC;AAC1E,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAQ,YAAY;AACvB,aAAS,UAAU;AAAA,EACrB;AACA,SAAO;AACT;AAWA,eAAsB,cAA2C;AAC/D,QAAM,EAAE,OAAO,IAAI,MAAM,KAAK;AAC9B,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,QAAQ,IAAI,iBAAiB;AAC5C,QAAM,SAAS,QAAQ,IAAI,oBAAoB;AAC/C,MAAI,CAAC,UAAU,CAAC,OAAQ,QAAO;AAE/B,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,MAAM,aAAa,MAAM,IAAI;AAAA,MACtD,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG;AAAA,MAC7C,OAAO;AAAA,IACT,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUA,eAAsB,aAAkD;AACtE,QAAM,EAAE,MAAM,IAAI,MAAM,KAAK;AAC7B,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,SAAS,QAAQ,IAAI,iBAAiB;AAC5C,QAAM,SAAS,QAAQ,IAAI,oBAAoB;AAC/C,MAAI,CAAC,UAAU,CAAC,OAAQ,QAAO;AAE/B,MAAI;AACF,UAAM,eAAgC;AAAA,MACpC,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG;AAAA,MAC7C,MAAM,EAAE,YAAY,GAAG;AAAA,IACzB;AACA,UAAM,MAAM,MAAM,MAAM,GAAG,MAAM,YAAY,KAAK,IAAI,YAA2B;AACjF,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACjIA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;","names":[]}

package/dist/middleware.d.mts

@@ -0,0 +1,45 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+interface AuthResult {
+    /** Authenticated user ID (`sub` claim), or null if unauthenticated. */
+    userId: string | null;
+    orgId: string | null;
+    orgRole: string | null;
+    sessionId: string | null;
+    riskLevel: string | null;
+    isSignedIn: boolean;
+    isPublicRoute: boolean;
+}
+interface AuthMiddlewareOptions {
+    /**
+     * Routes that do not require authentication.
+     * Strings are matched by exact path or prefix (e.g. "/sign-in" or "/api/public/").
+     * RegExps are tested against `pathname`.
+     */
+    publicRoutes?: Array<string | RegExp>;
+    /** Where to redirect unauthenticated users. Default: "/sign-in". */
+    signInUrl?: string;
+    /**
+     * Custom logic after auth state is determined.
+     * Return a `NextResponse` to short-circuit the default redirect behaviour;
+     * return `undefined` to continue with defaults.
+     */
+    afterAuth?: (auth: AuthResult, req: NextRequest) => NextResponse | Response | undefined | void;
+}
+declare const HEADER_USER_ID = "x-vaultix-user-id";
+declare const HEADER_ORG_ID = "x-vaultix-org-id";
+declare const HEADER_ORG_ROLE = "x-vaultix-org-role";
+declare const HEADER_SESSION_ID = "x-vaultix-session-id";
+declare const HEADER_RISK_LEVEL = "x-vaultix-risk-level";
+/**
+ * authMiddleware wraps your Next.js middleware.ts export.
+ *
+ * @example
+ * // middleware.ts
+ * import { authMiddleware } from "@smritix.ai/nextjs/middleware";
+ * export default authMiddleware({ publicRoutes: ["/sign-in", "/sign-up"] });
+ * export const config = { matcher: ["/((?!_next|.*\\..*).*)"] };
+ */
+declare function authMiddleware(options?: AuthMiddlewareOptions): (req: NextRequest) => Promise<NextResponse>;
+
+export { type AuthMiddlewareOptions, type AuthResult, HEADER_ORG_ID, HEADER_ORG_ROLE, HEADER_RISK_LEVEL, HEADER_SESSION_ID, HEADER_USER_ID, authMiddleware };

package/dist/middleware.d.ts

@@ -0,0 +1,45 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+interface AuthResult {
+    /** Authenticated user ID (`sub` claim), or null if unauthenticated. */
+    userId: string | null;
+    orgId: string | null;
+    orgRole: string | null;
+    sessionId: string | null;
+    riskLevel: string | null;
+    isSignedIn: boolean;
+    isPublicRoute: boolean;
+}
+interface AuthMiddlewareOptions {
+    /**
+     * Routes that do not require authentication.
+     * Strings are matched by exact path or prefix (e.g. "/sign-in" or "/api/public/").
+     * RegExps are tested against `pathname`.
+     */
+    publicRoutes?: Array<string | RegExp>;
+    /** Where to redirect unauthenticated users. Default: "/sign-in". */
+    signInUrl?: string;
+    /**
+     * Custom logic after auth state is determined.
+     * Return a `NextResponse` to short-circuit the default redirect behaviour;
+     * return `undefined` to continue with defaults.
+     */
+    afterAuth?: (auth: AuthResult, req: NextRequest) => NextResponse | Response | undefined | void;
+}
+declare const HEADER_USER_ID = "x-vaultix-user-id";
+declare const HEADER_ORG_ID = "x-vaultix-org-id";
+declare const HEADER_ORG_ROLE = "x-vaultix-org-role";
+declare const HEADER_SESSION_ID = "x-vaultix-session-id";
+declare const HEADER_RISK_LEVEL = "x-vaultix-risk-level";
+/**
+ * authMiddleware wraps your Next.js middleware.ts export.
+ *
+ * @example
+ * // middleware.ts
+ * import { authMiddleware } from "@smritix.ai/nextjs/middleware";
+ * export default authMiddleware({ publicRoutes: ["/sign-in", "/sign-up"] });
+ * export const config = { matcher: ["/((?!_next|.*\\..*).*)"] };
+ */
+declare function authMiddleware(options?: AuthMiddlewareOptions): (req: NextRequest) => Promise<NextResponse>;
+
+export { type AuthMiddlewareOptions, type AuthResult, HEADER_ORG_ID, HEADER_ORG_ROLE, HEADER_RISK_LEVEL, HEADER_SESSION_ID, HEADER_USER_ID, authMiddleware };

package/dist/middleware.js

@@ -0,0 +1,133 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/middleware.ts
+var middleware_exports = {};
+__export(middleware_exports, {
+  HEADER_ORG_ID: () => HEADER_ORG_ID,
+  HEADER_ORG_ROLE: () => HEADER_ORG_ROLE,
+  HEADER_RISK_LEVEL: () => HEADER_RISK_LEVEL,
+  HEADER_SESSION_ID: () => HEADER_SESSION_ID,
+  HEADER_USER_ID: () => HEADER_USER_ID,
+  authMiddleware: () => authMiddleware
+});
+module.exports = __toCommonJS(middleware_exports);
+var import_jose = require("jose");
+var import_server = require("next/server");
+var HEADER_USER_ID = "x-vaultix-user-id";
+var HEADER_ORG_ID = "x-vaultix-org-id";
+var HEADER_ORG_ROLE = "x-vaultix-org-role";
+var HEADER_SESSION_ID = "x-vaultix-session-id";
+var HEADER_RISK_LEVEL = "x-vaultix-risk-level";
+var cachedKey = null;
+var cachedPem = null;
+async function getPublicKey() {
+  const pem = process.env.VAULTIX_JWT_PUBLIC_KEY;
+  if (!pem) return null;
+  if (cachedKey && cachedPem === pem) return cachedKey;
+  try {
+    cachedKey = await (0, import_jose.importSPKI)(pem, "RS256");
+    cachedPem = pem;
+    return cachedKey;
+  } catch {
+    return null;
+  }
+}
+function isPublic(pathname, rules) {
+  return rules.some((rule) => {
+    if (typeof rule === "string") {
+      return pathname === rule || pathname.startsWith(rule);
+    }
+    return rule.test(pathname);
+  });
+}
+function authMiddleware(options = {}) {
+  const {
+    publicRoutes = [],
+    signInUrl = "/sign-in",
+    afterAuth
+  } = options;
+  return async function middleware(req) {
+    const { pathname } = req.nextUrl;
+    const publicRoute = isPublic(pathname, publicRoutes);
+    let result = {
+      userId: null,
+      orgId: null,
+      orgRole: null,
+      sessionId: null,
+      riskLevel: null,
+      isSignedIn: false,
+      isPublicRoute: publicRoute
+    };
+    const sessionCookie = req.cookies.get("vaultix-session")?.value ?? extractBearer(req.headers.get("authorization") ?? "");
+    if (sessionCookie) {
+      const key = await getPublicKey();
+      if (key) {
+        try {
+          const { payload } = await (0, import_jose.jwtVerify)(sessionCookie, key, {
+            algorithms: ["RS256"]
+          });
+          result = {
+            userId: payload["uid"] ?? null,
+            orgId: payload["org"] ?? null,
+            orgRole: payload["rol"] ?? null,
+            sessionId: payload["sid"] ?? null,
+            riskLevel: payload["risk"] ?? "low",
+            isSignedIn: true,
+            isPublicRoute: publicRoute
+          };
+        } catch {
+        }
+      }
+    }
+    if (afterAuth) {
+      const override = afterAuth(result, req);
+      if (override) return override;
+    }
+    if (!result.isSignedIn && !publicRoute) {
+      const dest = new URL(signInUrl, req.url);
+      dest.searchParams.set("redirect_url", req.url);
+      return import_server.NextResponse.redirect(dest);
+    }
+    const next = new Headers(req.headers);
+    if (result.userId) {
+      next.set(HEADER_USER_ID, result.userId);
+      next.set(HEADER_ORG_ID, result.orgId ?? "");
+      next.set(HEADER_ORG_ROLE, result.orgRole ?? "");
+      next.set(HEADER_SESSION_ID, result.sessionId ?? "");
+      next.set(HEADER_RISK_LEVEL, result.riskLevel ?? "low");
+    } else {
+      [HEADER_USER_ID, HEADER_ORG_ID, HEADER_ORG_ROLE, HEADER_SESSION_ID, HEADER_RISK_LEVEL].forEach((h) => next.delete(h));
+    }
+    return import_server.NextResponse.next({ request: { headers: next } });
+  };
+}
+function extractBearer(header) {
+  return header.startsWith("Bearer ") ? header.slice(7) : "";
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  HEADER_ORG_ID,
+  HEADER_ORG_ROLE,
+  HEADER_RISK_LEVEL,
+  HEADER_SESSION_ID,
+  HEADER_USER_ID,
+  authMiddleware
+});
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/middleware.ts"],"sourcesContent":["// Edge-runtime compatible. Uses jose (not Node crypto) for JWT verification.\nimport { importSPKI, jwtVerify, type KeyLike } from \"jose\";\nimport { NextRequest, NextResponse } from \"next/server\";\n\n// ─── Types ────────────────────────────────────────────────────────────────────\n\nexport interface AuthResult {\n  /** Authenticated user ID (`sub` claim), or null if unauthenticated. */\n  userId: string | null;\n  orgId: string | null;\n  orgRole: string | null;\n  sessionId: string | null;\n  riskLevel: string | null;\n  isSignedIn: boolean;\n  isPublicRoute: boolean;\n}\n\nexport interface AuthMiddlewareOptions {\n  /**\n   * Routes that do not require authentication.\n   * Strings are matched by exact path or prefix (e.g. \"/sign-in\" or \"/api/public/\").\n   * RegExps are tested against `pathname`.\n   */\n  publicRoutes?: Array<string | RegExp>;\n\n  /** Where to redirect unauthenticated users. Default: \"/sign-in\". */\n  signInUrl?: string;\n\n  /**\n   * Custom logic after auth state is determined.\n   * Return a `NextResponse` to short-circuit the default redirect behaviour;\n   * return `undefined` to continue with defaults.\n   */\n  afterAuth?: (\n    auth: AuthResult,\n    req: NextRequest,\n  ) => NextResponse | Response | undefined | void;\n}\n\n// ─── Header names injected into RSC requests ──────────────────────────────────\n\nexport const HEADER_USER_ID   = \"x-vaultix-user-id\";\nexport const HEADER_ORG_ID    = \"x-vaultix-org-id\";\nexport const HEADER_ORG_ROLE  = \"x-vaultix-org-role\";\nexport const HEADER_SESSION_ID = \"x-vaultix-session-id\";\nexport const HEADER_RISK_LEVEL = \"x-vaultix-risk-level\";\n\n// ─── Public-key cache ─────────────────────────────────────────────────────────\n// Importing an RSA public key is CPU-bound work; cache it across invocations.\n\nlet cachedKey: KeyLike | null = null;\nlet cachedPem: string | null = null;\n\nasync function getPublicKey(): Promise<KeyLike | null> {\n  const pem = process.env.VAULTIX_JWT_PUBLIC_KEY;\n  if (!pem) return null;\n  if (cachedKey && cachedPem === pem) return cachedKey;\n\n  try {\n    cachedKey = await importSPKI(pem, \"RS256\");\n    cachedPem = pem;\n    return cachedKey;\n  } catch {\n    return null;\n  }\n}\n\n// ─── Route matching ───────────────────────────────────────────────────────────\n\nfunction isPublic(pathname: string, rules: Array<string | RegExp>): boolean {\n  return rules.some((rule) => {\n    if (typeof rule === \"string\") {\n      return pathname === rule || pathname.startsWith(rule);\n    }\n    return rule.test(pathname);\n  });\n}\n\n// ─── authMiddleware factory ───────────────────────────────────────────────────\n\n/**\n * authMiddleware wraps your Next.js middleware.ts export.\n *\n * @example\n * // middleware.ts\n * import { authMiddleware } from \"@smritix.ai/nextjs/middleware\";\n * export default authMiddleware({ publicRoutes: [\"/sign-in\", \"/sign-up\"] });\n * export const config = { matcher: [\"/((?!_next|.*\\\\..*).*)\"] };\n */\nexport function authMiddleware(options: AuthMiddlewareOptions = {}) {\n  const {\n    publicRoutes = [],\n    signInUrl = \"/sign-in\",\n    afterAuth,\n  } = options;\n\n  return async function middleware(req: NextRequest): Promise<NextResponse> {\n    const { pathname } = req.nextUrl;\n    const publicRoute = isPublic(pathname, publicRoutes);\n\n    // Attempt to verify the session cookie.\n    let result: AuthResult = {\n      userId: null,\n      orgId: null,\n      orgRole: null,\n      sessionId: null,\n      riskLevel: null,\n      isSignedIn: false,\n      isPublicRoute: publicRoute,\n    };\n\n    const sessionCookie =\n      req.cookies.get(\"vaultix-session\")?.value ??\n      extractBearer(req.headers.get(\"authorization\") ?? \"\");\n\n    if (sessionCookie) {\n      const key = await getPublicKey();\n      if (key) {\n        try {\n          const { payload } = await jwtVerify(sessionCookie, key, {\n            algorithms: [\"RS256\"],\n          });\n\n          result = {\n            userId:    (payload[\"uid\"]  as string) ?? null,\n            orgId:     (payload[\"org\"]  as string) ?? null,\n            orgRole:   (payload[\"rol\"]  as string) ?? null,\n            sessionId: (payload[\"sid\"]  as string) ?? null,\n            riskLevel: (payload[\"risk\"] as string) ?? \"low\",\n            isSignedIn: true,\n            isPublicRoute: publicRoute,\n          };\n        } catch {\n          // Expired or tampered token → treat as signed-out.\n        }\n      }\n    }\n\n    // Let callers override the default redirect logic.\n    if (afterAuth) {\n      const override = afterAuth(result, req);\n      if (override) return override as NextResponse;\n    }\n\n    // Default: redirect unauthenticated requests to the sign-in page.\n    if (!result.isSignedIn && !publicRoute) {\n      const dest = new URL(signInUrl, req.url);\n      dest.searchParams.set(\"redirect_url\", req.url);\n      return NextResponse.redirect(dest);\n    }\n\n    // Propagate auth claims to Server Components via request headers.\n    const next = new Headers(req.headers);\n    if (result.userId) {\n      next.set(HEADER_USER_ID,    result.userId);\n      next.set(HEADER_ORG_ID,     result.orgId ?? \"\");\n      next.set(HEADER_ORG_ROLE,   result.orgRole ?? \"\");\n      next.set(HEADER_SESSION_ID, result.sessionId ?? \"\");\n      next.set(HEADER_RISK_LEVEL, result.riskLevel ?? \"low\");\n    } else {\n      // Clear any previously-set headers (defence-in-depth).\n      [HEADER_USER_ID, HEADER_ORG_ID, HEADER_ORG_ROLE, HEADER_SESSION_ID, HEADER_RISK_LEVEL]\n        .forEach((h) => next.delete(h));\n    }\n\n    return NextResponse.next({ request: { headers: next } });\n  };\n}\n\nfunction extractBearer(header: string): string {\n  return header.startsWith(\"Bearer \") ? header.slice(7) : \"\";\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,kBAAoD;AACpD,oBAA0C;AAuCnC,IAAM,iBAAmB;AACzB,IAAM,gBAAmB;AACzB,IAAM,kBAAmB;AACzB,IAAM,oBAAoB;AAC1B,IAAM,oBAAoB;AAKjC,IAAI,YAA4B;AAChC,IAAI,YAA2B;AAE/B,eAAe,eAAwC;AACrD,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,aAAa,cAAc,IAAK,QAAO;AAE3C,MAAI;AACF,gBAAY,UAAM,wBAAW,KAAK,OAAO;AACzC,gBAAY;AACZ,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,SAAS,SAAS,UAAkB,OAAwC;AAC1E,SAAO,MAAM,KAAK,CAAC,SAAS;AAC1B,QAAI,OAAO,SAAS,UAAU;AAC5B,aAAO,aAAa,QAAQ,SAAS,WAAW,IAAI;AAAA,IACtD;AACA,WAAO,KAAK,KAAK,QAAQ;AAAA,EAC3B,CAAC;AACH;AAaO,SAAS,eAAe,UAAiC,CAAC,GAAG;AAClE,QAAM;AAAA,IACJ,eAAe,CAAC;AAAA,IAChB,YAAY;AAAA,IACZ;AAAA,EACF,IAAI;AAEJ,SAAO,eAAe,WAAW,KAAyC;AACxE,UAAM,EAAE,SAAS,IAAI,IAAI;AACzB,UAAM,cAAc,SAAS,UAAU,YAAY;AAGnD,QAAI,SAAqB;AAAA,MACvB,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,SAAS;AAAA,MACT,WAAW;AAAA,MACX,WAAW;AAAA,MACX,YAAY;AAAA,MACZ,eAAe;AAAA,IACjB;AAEA,UAAM,gBACJ,IAAI,QAAQ,IAAI,iBAAiB,GAAG,SACpC,cAAc,IAAI,QAAQ,IAAI,eAAe,KAAK,EAAE;AAEtD,QAAI,eAAe;AACjB,YAAM,MAAM,MAAM,aAAa;AAC/B,UAAI,KAAK;AACP,YAAI;AACF,gBAAM,EAAE,QAAQ,IAAI,UAAM,uBAAU,eAAe,KAAK;AAAA,YACtD,YAAY,CAAC,OAAO;AAAA,UACtB,CAAC;AAED,mBAAS;AAAA,YACP,QAAY,QAAQ,KAAK,KAAiB;AAAA,YAC1C,OAAY,QAAQ,KAAK,KAAiB;AAAA,YAC1C,SAAY,QAAQ,KAAK,KAAiB;AAAA,YAC1C,WAAY,QAAQ,KAAK,KAAiB;AAAA,YAC1C,WAAY,QAAQ,MAAM,KAAgB;AAAA,YAC1C,YAAY;AAAA,YACZ,eAAe;AAAA,UACjB;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAGA,QAAI,WAAW;AACb,YAAM,WAAW,UAAU,QAAQ,GAAG;AACtC,UAAI,SAAU,QAAO;AAAA,IACvB;AAGA,QAAI,CAAC,OAAO,cAAc,CAAC,aAAa;AACtC,YAAM,OAAO,IAAI,IAAI,WAAW,IAAI,GAAG;AACvC,WAAK,aAAa,IAAI,gBAAgB,IAAI,GAAG;AAC7C,aAAO,2BAAa,SAAS,IAAI;AAAA,IACnC;AAGA,UAAM,OAAO,IAAI,QAAQ,IAAI,OAAO;AACpC,QAAI,OAAO,QAAQ;AACjB,WAAK,IAAI,gBAAmB,OAAO,MAAM;AACzC,WAAK,IAAI,eAAmB,OAAO,SAAS,EAAE;AAC9C,WAAK,IAAI,iBAAmB,OAAO,WAAW,EAAE;AAChD,WAAK,IAAI,mBAAmB,OAAO,aAAa,EAAE;AAClD,WAAK,IAAI,mBAAmB,OAAO,aAAa,KAAK;AAAA,IACvD,OAAO;AAEL,OAAC,gBAAgB,eAAe,iBAAiB,mBAAmB,iBAAiB,EAClF,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;AAAA,IAClC;AAEA,WAAO,2BAAa,KAAK,EAAE,SAAS,EAAE,SAAS,KAAK,EAAE,CAAC;AAAA,EACzD;AACF;AAEA,SAAS,cAAc,QAAwB;AAC7C,SAAO,OAAO,WAAW,SAAS,IAAI,OAAO,MAAM,CAAC,IAAI;AAC1D;","names":[]}

package/dist/middleware.mjs

@@ -0,0 +1,103 @@
+// src/middleware.ts
+import { importSPKI, jwtVerify } from "jose";
+import { NextResponse } from "next/server";
+var HEADER_USER_ID = "x-vaultix-user-id";
+var HEADER_ORG_ID = "x-vaultix-org-id";
+var HEADER_ORG_ROLE = "x-vaultix-org-role";
+var HEADER_SESSION_ID = "x-vaultix-session-id";
+var HEADER_RISK_LEVEL = "x-vaultix-risk-level";
+var cachedKey = null;
+var cachedPem = null;
+async function getPublicKey() {
+  const pem = process.env.VAULTIX_JWT_PUBLIC_KEY;
+  if (!pem) return null;
+  if (cachedKey && cachedPem === pem) return cachedKey;
+  try {
+    cachedKey = await importSPKI(pem, "RS256");
+    cachedPem = pem;
+    return cachedKey;
+  } catch {
+    return null;
+  }
+}
+function isPublic(pathname, rules) {
+  return rules.some((rule) => {
+    if (typeof rule === "string") {
+      return pathname === rule || pathname.startsWith(rule);
+    }
+    return rule.test(pathname);
+  });
+}
+function authMiddleware(options = {}) {
+  const {
+    publicRoutes = [],
+    signInUrl = "/sign-in",
+    afterAuth
+  } = options;
+  return async function middleware(req) {
+    const { pathname } = req.nextUrl;
+    const publicRoute = isPublic(pathname, publicRoutes);
+    let result = {
+      userId: null,
+      orgId: null,
+      orgRole: null,
+      sessionId: null,
+      riskLevel: null,
+      isSignedIn: false,
+      isPublicRoute: publicRoute
+    };
+    const sessionCookie = req.cookies.get("vaultix-session")?.value ?? extractBearer(req.headers.get("authorization") ?? "");
+    if (sessionCookie) {
+      const key = await getPublicKey();
+      if (key) {
+        try {
+          const { payload } = await jwtVerify(sessionCookie, key, {
+            algorithms: ["RS256"]
+          });
+          result = {
+            userId: payload["uid"] ?? null,
+            orgId: payload["org"] ?? null,
+            orgRole: payload["rol"] ?? null,
+            sessionId: payload["sid"] ?? null,
+            riskLevel: payload["risk"] ?? "low",
+            isSignedIn: true,
+            isPublicRoute: publicRoute
+          };
+        } catch {
+        }
+      }
+    }
+    if (afterAuth) {
+      const override = afterAuth(result, req);
+      if (override) return override;
+    }
+    if (!result.isSignedIn && !publicRoute) {
+      const dest = new URL(signInUrl, req.url);
+      dest.searchParams.set("redirect_url", req.url);
+      return NextResponse.redirect(dest);
+    }
+    const next = new Headers(req.headers);
+    if (result.userId) {
+      next.set(HEADER_USER_ID, result.userId);
+      next.set(HEADER_ORG_ID, result.orgId ?? "");
+      next.set(HEADER_ORG_ROLE, result.orgRole ?? "");
+      next.set(HEADER_SESSION_ID, result.sessionId ?? "");
+      next.set(HEADER_RISK_LEVEL, result.riskLevel ?? "low");
+    } else {
+      [HEADER_USER_ID, HEADER_ORG_ID, HEADER_ORG_ROLE, HEADER_SESSION_ID, HEADER_RISK_LEVEL].forEach((h) => next.delete(h));
+    }
+    return NextResponse.next({ request: { headers: next } });
+  };
+}
+function extractBearer(header) {
+  return header.startsWith("Bearer ") ? header.slice(7) : "";
+}
+export {
+  HEADER_ORG_ID,
+  HEADER_ORG_ROLE,
+  HEADER_RISK_LEVEL,
+  HEADER_SESSION_ID,
+  HEADER_USER_ID,
+  authMiddleware
+};
+//# sourceMappingURL=middleware.mjs.map

package/dist/middleware.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/middleware.ts"],"sourcesContent":["// Edge-runtime compatible. Uses jose (not Node crypto) for JWT verification.\nimport { importSPKI, jwtVerify, type KeyLike } from \"jose\";\nimport { NextRequest, NextResponse } from \"next/server\";\n\n// ─── Types ────────────────────────────────────────────────────────────────────\n\nexport interface AuthResult {\n  /** Authenticated user ID (`sub` claim), or null if unauthenticated. */\n  userId: string | null;\n  orgId: string | null;\n  orgRole: string | null;\n  sessionId: string | null;\n  riskLevel: string | null;\n  isSignedIn: boolean;\n  isPublicRoute: boolean;\n}\n\nexport interface AuthMiddlewareOptions {\n  /**\n   * Routes that do not require authentication.\n   * Strings are matched by exact path or prefix (e.g. \"/sign-in\" or \"/api/public/\").\n   * RegExps are tested against `pathname`.\n   */\n  publicRoutes?: Array<string | RegExp>;\n\n  /** Where to redirect unauthenticated users. Default: \"/sign-in\". */\n  signInUrl?: string;\n\n  /**\n   * Custom logic after auth state is determined.\n   * Return a `NextResponse` to short-circuit the default redirect behaviour;\n   * return `undefined` to continue with defaults.\n   */\n  afterAuth?: (\n    auth: AuthResult,\n    req: NextRequest,\n  ) => NextResponse | Response | undefined | void;\n}\n\n// ─── Header names injected into RSC requests ──────────────────────────────────\n\nexport const HEADER_USER_ID   = \"x-vaultix-user-id\";\nexport const HEADER_ORG_ID    = \"x-vaultix-org-id\";\nexport const HEADER_ORG_ROLE  = \"x-vaultix-org-role\";\nexport const HEADER_SESSION_ID = \"x-vaultix-session-id\";\nexport const HEADER_RISK_LEVEL = \"x-vaultix-risk-level\";\n\n// ─── Public-key cache ─────────────────────────────────────────────────────────\n// Importing an RSA public key is CPU-bound work; cache it across invocations.\n\nlet cachedKey: KeyLike | null = null;\nlet cachedPem: string | null = null;\n\nasync function getPublicKey(): Promise<KeyLike | null> {\n  const pem = process.env.VAULTIX_JWT_PUBLIC_KEY;\n  if (!pem) return null;\n  if (cachedKey && cachedPem === pem) return cachedKey;\n\n  try {\n    cachedKey = await importSPKI(pem, \"RS256\");\n    cachedPem = pem;\n    return cachedKey;\n  } catch {\n    return null;\n  }\n}\n\n// ─── Route matching ───────────────────────────────────────────────────────────\n\nfunction isPublic(pathname: string, rules: Array<string | RegExp>): boolean {\n  return rules.some((rule) => {\n    if (typeof rule === \"string\") {\n      return pathname === rule || pathname.startsWith(rule);\n    }\n    return rule.test(pathname);\n  });\n}\n\n// ─── authMiddleware factory ───────────────────────────────────────────────────\n\n/**\n * authMiddleware wraps your Next.js middleware.ts export.\n *\n * @example\n * // middleware.ts\n * import { authMiddleware } from \"@smritix.ai/nextjs/middleware\";\n * export default authMiddleware({ publicRoutes: [\"/sign-in\", \"/sign-up\"] });\n * export const config = { matcher: [\"/((?!_next|.*\\\\..*).*)\"] };\n */\nexport function authMiddleware(options: AuthMiddlewareOptions = {}) {\n  const {\n    publicRoutes = [],\n    signInUrl = \"/sign-in\",\n    afterAuth,\n  } = options;\n\n  return async function middleware(req: NextRequest): Promise<NextResponse> {\n    const { pathname } = req.nextUrl;\n    const publicRoute = isPublic(pathname, publicRoutes);\n\n    // Attempt to verify the session cookie.\n    let result: AuthResult = {\n      userId: null,\n      orgId: null,\n      orgRole: null,\n      sessionId: null,\n      riskLevel: null,\n      isSignedIn: false,\n      isPublicRoute: publicRoute,\n    };\n\n    const sessionCookie =\n      req.cookies.get(\"vaultix-session\")?.value ??\n      extractBearer(req.headers.get(\"authorization\") ?? \"\");\n\n    if (sessionCookie) {\n      const key = await getPublicKey();\n      if (key) {\n        try {\n          const { payload } = await jwtVerify(sessionCookie, key, {\n            algorithms: [\"RS256\"],\n          });\n\n          result = {\n            userId:    (payload[\"uid\"]  as string) ?? null,\n            orgId:     (payload[\"org\"]  as string) ?? null,\n            orgRole:   (payload[\"rol\"]  as string) ?? null,\n            sessionId: (payload[\"sid\"]  as string) ?? null,\n            riskLevel: (payload[\"risk\"] as string) ?? \"low\",\n            isSignedIn: true,\n            isPublicRoute: publicRoute,\n          };\n        } catch {\n          // Expired or tampered token → treat as signed-out.\n        }\n      }\n    }\n\n    // Let callers override the default redirect logic.\n    if (afterAuth) {\n      const override = afterAuth(result, req);\n      if (override) return override as NextResponse;\n    }\n\n    // Default: redirect unauthenticated requests to the sign-in page.\n    if (!result.isSignedIn && !publicRoute) {\n      const dest = new URL(signInUrl, req.url);\n      dest.searchParams.set(\"redirect_url\", req.url);\n      return NextResponse.redirect(dest);\n    }\n\n    // Propagate auth claims to Server Components via request headers.\n    const next = new Headers(req.headers);\n    if (result.userId) {\n      next.set(HEADER_USER_ID,    result.userId);\n      next.set(HEADER_ORG_ID,     result.orgId ?? \"\");\n      next.set(HEADER_ORG_ROLE,   result.orgRole ?? \"\");\n      next.set(HEADER_SESSION_ID, result.sessionId ?? \"\");\n      next.set(HEADER_RISK_LEVEL, result.riskLevel ?? \"low\");\n    } else {\n      // Clear any previously-set headers (defence-in-depth).\n      [HEADER_USER_ID, HEADER_ORG_ID, HEADER_ORG_ROLE, HEADER_SESSION_ID, HEADER_RISK_LEVEL]\n        .forEach((h) => next.delete(h));\n    }\n\n    return NextResponse.next({ request: { headers: next } });\n  };\n}\n\nfunction extractBearer(header: string): string {\n  return header.startsWith(\"Bearer \") ? header.slice(7) : \"\";\n}\n"],"mappings":";AACA,SAAS,YAAY,iBAA+B;AACpD,SAAsB,oBAAoB;AAuCnC,IAAM,iBAAmB;AACzB,IAAM,gBAAmB;AACzB,IAAM,kBAAmB;AACzB,IAAM,oBAAoB;AAC1B,IAAM,oBAAoB;AAKjC,IAAI,YAA4B;AAChC,IAAI,YAA2B;AAE/B,eAAe,eAAwC;AACrD,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,aAAa,cAAc,IAAK,QAAO;AAE3C,MAAI;AACF,gBAAY,MAAM,WAAW,KAAK,OAAO;AACzC,gBAAY;AACZ,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,SAAS,SAAS,UAAkB,OAAwC;AAC1E,SAAO,MAAM,KAAK,CAAC,SAAS;AAC1B,QAAI,OAAO,SAAS,UAAU;AAC5B,aAAO,aAAa,QAAQ,SAAS,WAAW,IAAI;AAAA,IACtD;AACA,WAAO,KAAK,KAAK,QAAQ;AAAA,EAC3B,CAAC;AACH;AAaO,SAAS,eAAe,UAAiC,CAAC,GAAG;AAClE,QAAM;AAAA,IACJ,eAAe,CAAC;AAAA,IAChB,YAAY;AAAA,IACZ;AAAA,EACF,IAAI;AAEJ,SAAO,eAAe,WAAW,KAAyC;AACxE,UAAM,EAAE,SAAS,IAAI,IAAI;AACzB,UAAM,cAAc,SAAS,UAAU,YAAY;AAGnD,QAAI,SAAqB;AAAA,MACvB,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,SAAS;AAAA,MACT,WAAW;AAAA,MACX,WAAW;AAAA,MACX,YAAY;AAAA,MACZ,eAAe;AAAA,IACjB;AAEA,UAAM,gBACJ,IAAI,QAAQ,IAAI,iBAAiB,GAAG,SACpC,cAAc,IAAI,QAAQ,IAAI,eAAe,KAAK,EAAE;AAEtD,QAAI,eAAe;AACjB,YAAM,MAAM,MAAM,aAAa;AAC/B,UAAI,KAAK;AACP,YAAI;AACF,gBAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,eAAe,KAAK;AAAA,YACtD,YAAY,CAAC,OAAO;AAAA,UACtB,CAAC;AAED,mBAAS;AAAA,YACP,QAAY,QAAQ,KAAK,KAAiB;AAAA,YAC1C,OAAY,QAAQ,KAAK,KAAiB;AAAA,YAC1C,SAAY,QAAQ,KAAK,KAAiB;AAAA,YAC1C,WAAY,QAAQ,KAAK,KAAiB;AAAA,YAC1C,WAAY,QAAQ,MAAM,KAAgB;AAAA,YAC1C,YAAY;AAAA,YACZ,eAAe;AAAA,UACjB;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAGA,QAAI,WAAW;AACb,YAAM,WAAW,UAAU,QAAQ,GAAG;AACtC,UAAI,SAAU,QAAO;AAAA,IACvB;AAGA,QAAI,CAAC,OAAO,cAAc,CAAC,aAAa;AACtC,YAAM,OAAO,IAAI,IAAI,WAAW,IAAI,GAAG;AACvC,WAAK,aAAa,IAAI,gBAAgB,IAAI,GAAG;AAC7C,aAAO,aAAa,SAAS,IAAI;AAAA,IACnC;AAGA,UAAM,OAAO,IAAI,QAAQ,IAAI,OAAO;AACpC,QAAI,OAAO,QAAQ;AACjB,WAAK,IAAI,gBAAmB,OAAO,MAAM;AACzC,WAAK,IAAI,eAAmB,OAAO,SAAS,EAAE;AAC9C,WAAK,IAAI,iBAAmB,OAAO,WAAW,EAAE;AAChD,WAAK,IAAI,mBAAmB,OAAO,aAAa,EAAE;AAClD,WAAK,IAAI,mBAAmB,OAAO,aAAa,KAAK;AAAA,IACvD,OAAO;AAEL,OAAC,gBAAgB,eAAe,iBAAiB,mBAAmB,iBAAiB,EAClF,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;AAAA,IAClC;AAEA,WAAO,aAAa,KAAK,EAAE,SAAS,EAAE,SAAS,KAAK,EAAE,CAAC;AAAA,EACzD;AACF;AAEA,SAAS,cAAc,QAAwB;AAC7C,SAAO,OAAO,WAAW,SAAS,IAAI,OAAO,MAAM,CAAC,IAAI;AAC1D;","names":[]}

package/dist/server.d.mts

@@ -0,0 +1,51 @@
+import { VaultixOrganization, VaultixUser } from '@smritix.ai/react';
+
+interface AuthObject {
+    userId: string | null;
+    orgId: string | null;
+    orgRole: string | null;
+    sessionId: string | null;
+    riskLevel: "low" | "medium" | "high" | "critical" | null;
+    isSignedIn: boolean;
+}
+/**
+ * Returns the current auth state by reading the headers injected by
+ * `authMiddleware`. Call this in Server Components, Route Handlers, and
+ * Server Actions — never in Client Components.
+ *
+ * @example
+ * import { auth } from "@smritix.ai/nextjs/server";
+ * export default async function Page() {
+ *   const { userId, orgId } = await auth();
+ *   …
+ * }
+ */
+declare function auth(): Promise<AuthObject>;
+/**
+ * Asserts that the current user is authenticated. Redirects to `/sign-in`
+ * if not. Returns the auth object for convenience.
+ *
+ * @example
+ * export default async function ProtectedPage() {
+ *   const { userId } = await protect();
+ *   …
+ * }
+ */
+declare function protect(redirectTo?: string): Promise<AuthObject>;
+/**
+ * Fetches the full `VaultixUser` record from the auth engine using server-to-server
+ * credentials (`VAULTIX_API_URL` + `VAULTIX_SECRET_KEY` env vars).
+ * Returns null when unauthenticated or when env vars are missing.
+ *
+ * Responses are never cached (`cache: "no-store"`) — user data must be fresh.
+ */
+declare function currentUser(): Promise<VaultixUser | null>;
+/**
+ * Fetches the active `VaultixOrganization` from the auth engine.
+ * Returns null when the user has no active org or env vars are missing.
+ *
+ * Responses are cached for 30 seconds — org data changes infrequently.
+ */
+declare function currentOrg(): Promise<VaultixOrganization | null>;
+
+export { type AuthObject, auth, currentOrg, currentUser, protect };

package/dist/server.d.ts

@@ -0,0 +1,51 @@
+import { VaultixOrganization, VaultixUser } from '@smritix.ai/react';
+
+interface AuthObject {
+    userId: string | null;
+    orgId: string | null;
+    orgRole: string | null;
+    sessionId: string | null;
+    riskLevel: "low" | "medium" | "high" | "critical" | null;
+    isSignedIn: boolean;
+}
+/**
+ * Returns the current auth state by reading the headers injected by
+ * `authMiddleware`. Call this in Server Components, Route Handlers, and
+ * Server Actions — never in Client Components.
+ *
+ * @example
+ * import { auth } from "@smritix.ai/nextjs/server";
+ * export default async function Page() {
+ *   const { userId, orgId } = await auth();
+ *   …
+ * }
+ */
+declare function auth(): Promise<AuthObject>;
+/**
+ * Asserts that the current user is authenticated. Redirects to `/sign-in`
+ * if not. Returns the auth object for convenience.
+ *
+ * @example
+ * export default async function ProtectedPage() {
+ *   const { userId } = await protect();
+ *   …
+ * }
+ */
+declare function protect(redirectTo?: string): Promise<AuthObject>;
+/**
+ * Fetches the full `VaultixUser` record from the auth engine using server-to-server
+ * credentials (`VAULTIX_API_URL` + `VAULTIX_SECRET_KEY` env vars).
+ * Returns null when unauthenticated or when env vars are missing.
+ *
+ * Responses are never cached (`cache: "no-store"`) — user data must be fresh.
+ */
+declare function currentUser(): Promise<VaultixUser | null>;
+/**
+ * Fetches the active `VaultixOrganization` from the auth engine.
+ * Returns null when the user has no active org or env vars are missing.
+ *
+ * Responses are cached for 30 seconds — org data changes infrequently.
+ */
+declare function currentOrg(): Promise<VaultixOrganization | null>;
+
+export { type AuthObject, auth, currentOrg, currentUser, protect };

package/dist/server.js

@@ -0,0 +1,113 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server.ts
+var server_exports = {};
+__export(server_exports, {
+  auth: () => auth,
+  currentOrg: () => currentOrg,
+  currentUser: () => currentUser,
+  protect: () => protect
+});
+module.exports = __toCommonJS(server_exports);
+var import_headers = require("next/headers");
+var import_navigation = require("next/navigation");
+
+// src/middleware.ts
+var import_jose = require("jose");
+var import_server = require("next/server");
+var HEADER_USER_ID = "x-vaultix-user-id";
+var HEADER_ORG_ID = "x-vaultix-org-id";
+var HEADER_ORG_ROLE = "x-vaultix-org-role";
+var HEADER_SESSION_ID = "x-vaultix-session-id";
+var HEADER_RISK_LEVEL = "x-vaultix-risk-level";
+
+// src/server.ts
+async function auth() {
+  const h = await (0, import_headers.headers)();
+  const userId = h.get(HEADER_USER_ID);
+  if (!userId) {
+    return {
+      userId: null,
+      orgId: null,
+      orgRole: null,
+      sessionId: null,
+      riskLevel: null,
+      isSignedIn: false
+    };
+  }
+  return {
+    userId,
+    orgId: h.get(HEADER_ORG_ID) || null,
+    orgRole: h.get(HEADER_ORG_ROLE) || null,
+    sessionId: h.get(HEADER_SESSION_ID) || null,
+    riskLevel: h.get(HEADER_RISK_LEVEL) ?? "low",
+    isSignedIn: true
+  };
+}
+async function protect(redirectTo = "/sign-in") {
+  const authObj = await auth();
+  if (!authObj.isSignedIn) {
+    (0, import_navigation.redirect)(redirectTo);
+  }
+  return authObj;
+}
+async function currentUser() {
+  const { userId } = await auth();
+  if (!userId) return null;
+  const apiUrl = process.env["VAULTIX_API_URL"];
+  const secret = process.env["VAULTIX_SECRET_KEY"];
+  if (!apiUrl || !secret) return null;
+  try {
+    const res = await fetch(`${apiUrl}/v1/users/${userId}`, {
+      headers: { Authorization: `Bearer ${secret}` },
+      cache: "no-store"
+    });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+async function currentOrg() {
+  const { orgId } = await auth();
+  if (!orgId) return null;
+  const apiUrl = process.env["VAULTIX_API_URL"];
+  const secret = process.env["VAULTIX_SECRET_KEY"];
+  if (!apiUrl || !secret) return null;
+  try {
+    const orgFetchInit = {
+      headers: { Authorization: `Bearer ${secret}` },
+      next: { revalidate: 30 }
+    };
+    const res = await fetch(`${apiUrl}/v1/orgs/${orgId}`, orgFetchInit);
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  auth,
+  currentOrg,
+  currentUser,
+  protect
+});
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server.ts","../src/middleware.ts"],"sourcesContent":["// This file is server-only. Import from \"@smritix.ai/nextjs/server\".\n// Do NOT import in Client Components — it will throw at runtime.\nimport { headers } from \"next/headers\";\nimport { redirect } from \"next/navigation\";\nimport type { VaultixOrganization, VaultixUser } from \"@smritix.ai/react\";\nimport {\n  HEADER_ORG_ID,\n  HEADER_ORG_ROLE,\n  HEADER_RISK_LEVEL,\n  HEADER_SESSION_ID,\n  HEADER_USER_ID,\n} from \"./middleware\";\n\n// Next.js extends RequestInit with cache and next options for its data cache.\ntype NextRequestInit = RequestInit & {\n  cache?: RequestCache;\n  next?: { revalidate?: number | false; tags?: string[] };\n};\n\n// ─── Types ────────────────────────────────────────────────────────────────────\n\nexport interface AuthObject {\n  userId: string | null;\n  orgId: string | null;\n  orgRole: string | null;\n  sessionId: string | null;\n  riskLevel: \"low\" | \"medium\" | \"high\" | \"critical\" | null;\n  isSignedIn: boolean;\n}\n\n// ─── auth() ───────────────────────────────────────────────────────────────────\n\n/**\n * Returns the current auth state by reading the headers injected by\n * `authMiddleware`. Call this in Server Components, Route Handlers, and\n * Server Actions — never in Client Components.\n *\n * @example\n * import { auth } from \"@smritix.ai/nextjs/server\";\n * export default async function Page() {\n *   const { userId, orgId } = await auth();\n *   …\n * }\n */\nexport async function auth(): Promise<AuthObject> {\n  const h = await headers();\n  const userId = h.get(HEADER_USER_ID);\n\n  if (!userId) {\n    return {\n      userId: null,\n      orgId: null,\n      orgRole: null,\n      sessionId: null,\n      riskLevel: null,\n      isSignedIn: false,\n    };\n  }\n\n  return {\n    userId,\n    orgId:     h.get(HEADER_ORG_ID)     || null,\n    orgRole:   h.get(HEADER_ORG_ROLE)   || null,\n    sessionId: h.get(HEADER_SESSION_ID) || null,\n    riskLevel: (h.get(HEADER_RISK_LEVEL) ?? \"low\") as AuthObject[\"riskLevel\"],\n    isSignedIn: true,\n  };\n}\n\n// ─── protect() ────────────────────────────────────────────────────────────────\n\n/**\n * Asserts that the current user is authenticated. Redirects to `/sign-in`\n * if not. Returns the auth object for convenience.\n *\n * @example\n * export default async function ProtectedPage() {\n *   const { userId } = await protect();\n *   …\n * }\n */\nexport async function protect(redirectTo = \"/sign-in\"): Promise<AuthObject> {\n  const authObj = await auth();\n  if (!authObj.isSignedIn) {\n    redirect(redirectTo);\n  }\n  return authObj;\n}\n\n// ─── currentUser() ────────────────────────────────────────────────────────────\n\n/**\n * Fetches the full `VaultixUser` record from the auth engine using server-to-server\n * credentials (`VAULTIX_API_URL` + `VAULTIX_SECRET_KEY` env vars).\n * Returns null when unauthenticated or when env vars are missing.\n *\n * Responses are never cached (`cache: \"no-store\"`) — user data must be fresh.\n */\nexport async function currentUser(): Promise<VaultixUser | null> {\n  const { userId } = await auth();\n  if (!userId) return null;\n\n  const apiUrl = process.env[\"VAULTIX_API_URL\"];\n  const secret = process.env[\"VAULTIX_SECRET_KEY\"];\n  if (!apiUrl || !secret) return null;\n\n  try {\n    const res = await fetch(`${apiUrl}/v1/users/${userId}`, {\n      headers: { Authorization: `Bearer ${secret}` },\n      cache: \"no-store\",\n    });\n    if (!res.ok) return null;\n    return (await res.json()) as VaultixUser;\n  } catch {\n    return null;\n  }\n}\n\n// ─── currentOrg() ────────────────────────────────────────────────────────────\n\n/**\n * Fetches the active `VaultixOrganization` from the auth engine.\n * Returns null when the user has no active org or env vars are missing.\n *\n * Responses are cached for 30 seconds — org data changes infrequently.\n */\nexport async function currentOrg(): Promise<VaultixOrganization | null> {\n  const { orgId } = await auth();\n  if (!orgId) return null;\n\n  const apiUrl = process.env[\"VAULTIX_API_URL\"];\n  const secret = process.env[\"VAULTIX_SECRET_KEY\"];\n  if (!apiUrl || !secret) return null;\n\n  try {\n    const orgFetchInit: NextRequestInit = {\n      headers: { Authorization: `Bearer ${secret}` },\n      next: { revalidate: 30 },\n    };\n    const res = await fetch(`${apiUrl}/v1/orgs/${orgId}`, orgFetchInit as RequestInit);\n    if (!res.ok) return null;\n    return (await res.json()) as VaultixOrganization;\n  } catch {\n    return null;\n  }\n}\n","// Edge-runtime compatible. Uses jose (not Node crypto) for JWT verification.\nimport { importSPKI, jwtVerify, type KeyLike } from \"jose\";\nimport { NextRequest, NextResponse } from \"next/server\";\n\n// ─── Types ────────────────────────────────────────────────────────────────────\n\nexport interface AuthResult {\n  /** Authenticated user ID (`sub` claim), or null if unauthenticated. */\n  userId: string | null;\n  orgId: string | null;\n  orgRole: string | null;\n  sessionId: string | null;\n  riskLevel: string | null;\n  isSignedIn: boolean;\n  isPublicRoute: boolean;\n}\n\nexport interface AuthMiddlewareOptions {\n  /**\n   * Routes that do not require authentication.\n   * Strings are matched by exact path or prefix (e.g. \"/sign-in\" or \"/api/public/\").\n   * RegExps are tested against `pathname`.\n   */\n  publicRoutes?: Array<string | RegExp>;\n\n  /** Where to redirect unauthenticated users. Default: \"/sign-in\". */\n  signInUrl?: string;\n\n  /**\n   * Custom logic after auth state is determined.\n   * Return a `NextResponse` to short-circuit the default redirect behaviour;\n   * return `undefined` to continue with defaults.\n   */\n  afterAuth?: (\n    auth: AuthResult,\n    req: NextRequest,\n  ) => NextResponse | Response | undefined | void;\n}\n\n// ─── Header names injected into RSC requests ──────────────────────────────────\n\nexport const HEADER_USER_ID   = \"x-vaultix-user-id\";\nexport const HEADER_ORG_ID    = \"x-vaultix-org-id\";\nexport const HEADER_ORG_ROLE  = \"x-vaultix-org-role\";\nexport const HEADER_SESSION_ID = \"x-vaultix-session-id\";\nexport const HEADER_RISK_LEVEL = \"x-vaultix-risk-level\";\n\n// ─── Public-key cache ─────────────────────────────────────────────────────────\n// Importing an RSA public key is CPU-bound work; cache it across invocations.\n\nlet cachedKey: KeyLike | null = null;\nlet cachedPem: string | null = null;\n\nasync function getPublicKey(): Promise<KeyLike | null> {\n  const pem = process.env.VAULTIX_JWT_PUBLIC_KEY;\n  if (!pem) return null;\n  if (cachedKey && cachedPem === pem) return cachedKey;\n\n  try {\n    cachedKey = await importSPKI(pem, \"RS256\");\n    cachedPem = pem;\n    return cachedKey;\n  } catch {\n    return null;\n  }\n}\n\n// ─── Route matching ───────────────────────────────────────────────────────────\n\nfunction isPublic(pathname: string, rules: Array<string | RegExp>): boolean {\n  return rules.some((rule) => {\n    if (typeof rule === \"string\") {\n      return pathname === rule || pathname.startsWith(rule);\n    }\n    return rule.test(pathname);\n  });\n}\n\n// ─── authMiddleware factory ───────────────────────────────────────────────────\n\n/**\n * authMiddleware wraps your Next.js middleware.ts export.\n *\n * @example\n * // middleware.ts\n * import { authMiddleware } from \"@smritix.ai/nextjs/middleware\";\n * export default authMiddleware({ publicRoutes: [\"/sign-in\", \"/sign-up\"] });\n * export const config = { matcher: [\"/((?!_next|.*\\\\..*).*)\"] };\n */\nexport function authMiddleware(options: AuthMiddlewareOptions = {}) {\n  const {\n    publicRoutes = [],\n    signInUrl = \"/sign-in\",\n    afterAuth,\n  } = options;\n\n  return async function middleware(req: NextRequest): Promise<NextResponse> {\n    const { pathname } = req.nextUrl;\n    const publicRoute = isPublic(pathname, publicRoutes);\n\n    // Attempt to verify the session cookie.\n    let result: AuthResult = {\n      userId: null,\n      orgId: null,\n      orgRole: null,\n      sessionId: null,\n      riskLevel: null,\n      isSignedIn: false,\n      isPublicRoute: publicRoute,\n    };\n\n    const sessionCookie =\n      req.cookies.get(\"vaultix-session\")?.value ??\n      extractBearer(req.headers.get(\"authorization\") ?? \"\");\n\n    if (sessionCookie) {\n      const key = await getPublicKey();\n      if (key) {\n        try {\n          const { payload } = await jwtVerify(sessionCookie, key, {\n            algorithms: [\"RS256\"],\n          });\n\n          result = {\n            userId:    (payload[\"uid\"]  as string) ?? null,\n            orgId:     (payload[\"org\"]  as string) ?? null,\n            orgRole:   (payload[\"rol\"]  as string) ?? null,\n            sessionId: (payload[\"sid\"]  as string) ?? null,\n            riskLevel: (payload[\"risk\"] as string) ?? \"low\",\n            isSignedIn: true,\n            isPublicRoute: publicRoute,\n          };\n        } catch {\n          // Expired or tampered token → treat as signed-out.\n        }\n      }\n    }\n\n    // Let callers override the default redirect logic.\n    if (afterAuth) {\n      const override = afterAuth(result, req);\n      if (override) return override as NextResponse;\n    }\n\n    // Default: redirect unauthenticated requests to the sign-in page.\n    if (!result.isSignedIn && !publicRoute) {\n      const dest = new URL(signInUrl, req.url);\n      dest.searchParams.set(\"redirect_url\", req.url);\n      return NextResponse.redirect(dest);\n    }\n\n    // Propagate auth claims to Server Components via request headers.\n    const next = new Headers(req.headers);\n    if (result.userId) {\n      next.set(HEADER_USER_ID,    result.userId);\n      next.set(HEADER_ORG_ID,     result.orgId ?? \"\");\n      next.set(HEADER_ORG_ROLE,   result.orgRole ?? \"\");\n      next.set(HEADER_SESSION_ID, result.sessionId ?? \"\");\n      next.set(HEADER_RISK_LEVEL, result.riskLevel ?? \"low\");\n    } else {\n      // Clear any previously-set headers (defence-in-depth).\n      [HEADER_USER_ID, HEADER_ORG_ID, HEADER_ORG_ROLE, HEADER_SESSION_ID, HEADER_RISK_LEVEL]\n        .forEach((h) => next.delete(h));\n    }\n\n    return NextResponse.next({ request: { headers: next } });\n  };\n}\n\nfunction extractBearer(header: string): string {\n  return header.startsWith(\"Bearer \") ? header.slice(7) : \"\";\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,qBAAwB;AACxB,wBAAyB;;;ACFzB,kBAAoD;AACpD,oBAA0C;AAuCnC,IAAM,iBAAmB;AACzB,IAAM,gBAAmB;AACzB,IAAM,kBAAmB;AACzB,IAAM,oBAAoB;AAC1B,IAAM,oBAAoB;;;ADDjC,eAAsB,OAA4B;AAChD,QAAM,IAAI,UAAM,wBAAQ;AACxB,QAAM,SAAS,EAAE,IAAI,cAAc;AAEnC,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,SAAS;AAAA,MACT,WAAW;AAAA,MACX,WAAW;AAAA,MACX,YAAY;AAAA,IACd;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,OAAW,EAAE,IAAI,aAAa,KAAS;AAAA,IACvC,SAAW,EAAE,IAAI,eAAe,KAAO;AAAA,IACvC,WAAW,EAAE,IAAI,iBAAiB,KAAK;AAAA,IACvC,WAAY,EAAE,IAAI,iBAAiB,KAAK;AAAA,IACxC,YAAY;AAAA,EACd;AACF;AAcA,eAAsB,QAAQ,aAAa,YAAiC;AAC1E,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAQ,YAAY;AACvB,oCAAS,UAAU;AAAA,EACrB;AACA,SAAO;AACT;AAWA,eAAsB,cAA2C;AAC/D,QAAM,EAAE,OAAO,IAAI,MAAM,KAAK;AAC9B,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,QAAQ,IAAI,iBAAiB;AAC5C,QAAM,SAAS,QAAQ,IAAI,oBAAoB;AAC/C,MAAI,CAAC,UAAU,CAAC,OAAQ,QAAO;AAE/B,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,MAAM,aAAa,MAAM,IAAI;AAAA,MACtD,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG;AAAA,MAC7C,OAAO;AAAA,IACT,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUA,eAAsB,aAAkD;AACtE,QAAM,EAAE,MAAM,IAAI,MAAM,KAAK;AAC7B,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,SAAS,QAAQ,IAAI,iBAAiB;AAC5C,QAAM,SAAS,QAAQ,IAAI,oBAAoB;AAC/C,MAAI,CAAC,UAAU,CAAC,OAAQ,QAAO;AAE/B,MAAI;AACF,UAAM,eAAgC;AAAA,MACpC,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG;AAAA,MAC7C,MAAM,EAAE,YAAY,GAAG;AAAA,IACzB;AACA,UAAM,MAAM,MAAM,MAAM,GAAG,MAAM,YAAY,KAAK,IAAI,YAA2B;AACjF,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/server.mjs

@@ -0,0 +1,85 @@
+// src/server.ts
+import { headers } from "next/headers";
+import { redirect } from "next/navigation";
+
+// src/middleware.ts
+import { importSPKI, jwtVerify } from "jose";
+import { NextResponse } from "next/server";
+var HEADER_USER_ID = "x-vaultix-user-id";
+var HEADER_ORG_ID = "x-vaultix-org-id";
+var HEADER_ORG_ROLE = "x-vaultix-org-role";
+var HEADER_SESSION_ID = "x-vaultix-session-id";
+var HEADER_RISK_LEVEL = "x-vaultix-risk-level";
+
+// src/server.ts
+async function auth() {
+  const h = await headers();
+  const userId = h.get(HEADER_USER_ID);
+  if (!userId) {
+    return {
+      userId: null,
+      orgId: null,
+      orgRole: null,
+      sessionId: null,
+      riskLevel: null,
+      isSignedIn: false
+    };
+  }
+  return {
+    userId,
+    orgId: h.get(HEADER_ORG_ID) || null,
+    orgRole: h.get(HEADER_ORG_ROLE) || null,
+    sessionId: h.get(HEADER_SESSION_ID) || null,
+    riskLevel: h.get(HEADER_RISK_LEVEL) ?? "low",
+    isSignedIn: true
+  };
+}
+async function protect(redirectTo = "/sign-in") {
+  const authObj = await auth();
+  if (!authObj.isSignedIn) {
+    redirect(redirectTo);
+  }
+  return authObj;
+}
+async function currentUser() {
+  const { userId } = await auth();
+  if (!userId) return null;
+  const apiUrl = process.env["VAULTIX_API_URL"];
+  const secret = process.env["VAULTIX_SECRET_KEY"];
+  if (!apiUrl || !secret) return null;
+  try {
+    const res = await fetch(`${apiUrl}/v1/users/${userId}`, {
+      headers: { Authorization: `Bearer ${secret}` },
+      cache: "no-store"
+    });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+async function currentOrg() {
+  const { orgId } = await auth();
+  if (!orgId) return null;
+  const apiUrl = process.env["VAULTIX_API_URL"];
+  const secret = process.env["VAULTIX_SECRET_KEY"];
+  if (!apiUrl || !secret) return null;
+  try {
+    const orgFetchInit = {
+      headers: { Authorization: `Bearer ${secret}` },
+      next: { revalidate: 30 }
+    };
+    const res = await fetch(`${apiUrl}/v1/orgs/${orgId}`, orgFetchInit);
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+export {
+  auth,
+  currentOrg,
+  currentUser,
+  protect
+};
+//# sourceMappingURL=server.mjs.map

package/dist/server.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server.ts","../src/middleware.ts"],"sourcesContent":["// This file is server-only. Import from \"@smritix.ai/nextjs/server\".\n// Do NOT import in Client Components — it will throw at runtime.\nimport { headers } from \"next/headers\";\nimport { redirect } from \"next/navigation\";\nimport type { VaultixOrganization, VaultixUser } from \"@smritix.ai/react\";\nimport {\n  HEADER_ORG_ID,\n  HEADER_ORG_ROLE,\n  HEADER_RISK_LEVEL,\n  HEADER_SESSION_ID,\n  HEADER_USER_ID,\n} from \"./middleware\";\n\n// Next.js extends RequestInit with cache and next options for its data cache.\ntype NextRequestInit = RequestInit & {\n  cache?: RequestCache;\n  next?: { revalidate?: number | false; tags?: string[] };\n};\n\n// ─── Types ────────────────────────────────────────────────────────────────────\n\nexport interface AuthObject {\n  userId: string | null;\n  orgId: string | null;\n  orgRole: string | null;\n  sessionId: string | null;\n  riskLevel: \"low\" | \"medium\" | \"high\" | \"critical\" | null;\n  isSignedIn: boolean;\n}\n\n// ─── auth() ───────────────────────────────────────────────────────────────────\n\n/**\n * Returns the current auth state by reading the headers injected by\n * `authMiddleware`. Call this in Server Components, Route Handlers, and\n * Server Actions — never in Client Components.\n *\n * @example\n * import { auth } from \"@smritix.ai/nextjs/server\";\n * export default async function Page() {\n *   const { userId, orgId } = await auth();\n *   …\n * }\n */\nexport async function auth(): Promise<AuthObject> {\n  const h = await headers();\n  const userId = h.get(HEADER_USER_ID);\n\n  if (!userId) {\n    return {\n      userId: null,\n      orgId: null,\n      orgRole: null,\n      sessionId: null,\n      riskLevel: null,\n      isSignedIn: false,\n    };\n  }\n\n  return {\n    userId,\n    orgId:     h.get(HEADER_ORG_ID)     || null,\n    orgRole:   h.get(HEADER_ORG_ROLE)   || null,\n    sessionId: h.get(HEADER_SESSION_ID) || null,\n    riskLevel: (h.get(HEADER_RISK_LEVEL) ?? \"low\") as AuthObject[\"riskLevel\"],\n    isSignedIn: true,\n  };\n}\n\n// ─── protect() ────────────────────────────────────────────────────────────────\n\n/**\n * Asserts that the current user is authenticated. Redirects to `/sign-in`\n * if not. Returns the auth object for convenience.\n *\n * @example\n * export default async function ProtectedPage() {\n *   const { userId } = await protect();\n *   …\n * }\n */\nexport async function protect(redirectTo = \"/sign-in\"): Promise<AuthObject> {\n  const authObj = await auth();\n  if (!authObj.isSignedIn) {\n    redirect(redirectTo);\n  }\n  return authObj;\n}\n\n// ─── currentUser() ────────────────────────────────────────────────────────────\n\n/**\n * Fetches the full `VaultixUser` record from the auth engine using server-to-server\n * credentials (`VAULTIX_API_URL` + `VAULTIX_SECRET_KEY` env vars).\n * Returns null when unauthenticated or when env vars are missing.\n *\n * Responses are never cached (`cache: \"no-store\"`) — user data must be fresh.\n */\nexport async function currentUser(): Promise<VaultixUser | null> {\n  const { userId } = await auth();\n  if (!userId) return null;\n\n  const apiUrl = process.env[\"VAULTIX_API_URL\"];\n  const secret = process.env[\"VAULTIX_SECRET_KEY\"];\n  if (!apiUrl || !secret) return null;\n\n  try {\n    const res = await fetch(`${apiUrl}/v1/users/${userId}`, {\n      headers: { Authorization: `Bearer ${secret}` },\n      cache: \"no-store\",\n    });\n    if (!res.ok) return null;\n    return (await res.json()) as VaultixUser;\n  } catch {\n    return null;\n  }\n}\n\n// ─── currentOrg() ────────────────────────────────────────────────────────────\n\n/**\n * Fetches the active `VaultixOrganization` from the auth engine.\n * Returns null when the user has no active org or env vars are missing.\n *\n * Responses are cached for 30 seconds — org data changes infrequently.\n */\nexport async function currentOrg(): Promise<VaultixOrganization | null> {\n  const { orgId } = await auth();\n  if (!orgId) return null;\n\n  const apiUrl = process.env[\"VAULTIX_API_URL\"];\n  const secret = process.env[\"VAULTIX_SECRET_KEY\"];\n  if (!apiUrl || !secret) return null;\n\n  try {\n    const orgFetchInit: NextRequestInit = {\n      headers: { Authorization: `Bearer ${secret}` },\n      next: { revalidate: 30 },\n    };\n    const res = await fetch(`${apiUrl}/v1/orgs/${orgId}`, orgFetchInit as RequestInit);\n    if (!res.ok) return null;\n    return (await res.json()) as VaultixOrganization;\n  } catch {\n    return null;\n  }\n}\n","// Edge-runtime compatible. Uses jose (not Node crypto) for JWT verification.\nimport { importSPKI, jwtVerify, type KeyLike } from \"jose\";\nimport { NextRequest, NextResponse } from \"next/server\";\n\n// ─── Types ────────────────────────────────────────────────────────────────────\n\nexport interface AuthResult {\n  /** Authenticated user ID (`sub` claim), or null if unauthenticated. */\n  userId: string | null;\n  orgId: string | null;\n  orgRole: string | null;\n  sessionId: string | null;\n  riskLevel: string | null;\n  isSignedIn: boolean;\n  isPublicRoute: boolean;\n}\n\nexport interface AuthMiddlewareOptions {\n  /**\n   * Routes that do not require authentication.\n   * Strings are matched by exact path or prefix (e.g. \"/sign-in\" or \"/api/public/\").\n   * RegExps are tested against `pathname`.\n   */\n  publicRoutes?: Array<string | RegExp>;\n\n  /** Where to redirect unauthenticated users. Default: \"/sign-in\". */\n  signInUrl?: string;\n\n  /**\n   * Custom logic after auth state is determined.\n   * Return a `NextResponse` to short-circuit the default redirect behaviour;\n   * return `undefined` to continue with defaults.\n   */\n  afterAuth?: (\n    auth: AuthResult,\n    req: NextRequest,\n  ) => NextResponse | Response | undefined | void;\n}\n\n// ─── Header names injected into RSC requests ──────────────────────────────────\n\nexport const HEADER_USER_ID   = \"x-vaultix-user-id\";\nexport const HEADER_ORG_ID    = \"x-vaultix-org-id\";\nexport const HEADER_ORG_ROLE  = \"x-vaultix-org-role\";\nexport const HEADER_SESSION_ID = \"x-vaultix-session-id\";\nexport const HEADER_RISK_LEVEL = \"x-vaultix-risk-level\";\n\n// ─── Public-key cache ─────────────────────────────────────────────────────────\n// Importing an RSA public key is CPU-bound work; cache it across invocations.\n\nlet cachedKey: KeyLike | null = null;\nlet cachedPem: string | null = null;\n\nasync function getPublicKey(): Promise<KeyLike | null> {\n  const pem = process.env.VAULTIX_JWT_PUBLIC_KEY;\n  if (!pem) return null;\n  if (cachedKey && cachedPem === pem) return cachedKey;\n\n  try {\n    cachedKey = await importSPKI(pem, \"RS256\");\n    cachedPem = pem;\n    return cachedKey;\n  } catch {\n    return null;\n  }\n}\n\n// ─── Route matching ───────────────────────────────────────────────────────────\n\nfunction isPublic(pathname: string, rules: Array<string | RegExp>): boolean {\n  return rules.some((rule) => {\n    if (typeof rule === \"string\") {\n      return pathname === rule || pathname.startsWith(rule);\n    }\n    return rule.test(pathname);\n  });\n}\n\n// ─── authMiddleware factory ───────────────────────────────────────────────────\n\n/**\n * authMiddleware wraps your Next.js middleware.ts export.\n *\n * @example\n * // middleware.ts\n * import { authMiddleware } from \"@smritix.ai/nextjs/middleware\";\n * export default authMiddleware({ publicRoutes: [\"/sign-in\", \"/sign-up\"] });\n * export const config = { matcher: [\"/((?!_next|.*\\\\..*).*)\"] };\n */\nexport function authMiddleware(options: AuthMiddlewareOptions = {}) {\n  const {\n    publicRoutes = [],\n    signInUrl = \"/sign-in\",\n    afterAuth,\n  } = options;\n\n  return async function middleware(req: NextRequest): Promise<NextResponse> {\n    const { pathname } = req.nextUrl;\n    const publicRoute = isPublic(pathname, publicRoutes);\n\n    // Attempt to verify the session cookie.\n    let result: AuthResult = {\n      userId: null,\n      orgId: null,\n      orgRole: null,\n      sessionId: null,\n      riskLevel: null,\n      isSignedIn: false,\n      isPublicRoute: publicRoute,\n    };\n\n    const sessionCookie =\n      req.cookies.get(\"vaultix-session\")?.value ??\n      extractBearer(req.headers.get(\"authorization\") ?? \"\");\n\n    if (sessionCookie) {\n      const key = await getPublicKey();\n      if (key) {\n        try {\n          const { payload } = await jwtVerify(sessionCookie, key, {\n            algorithms: [\"RS256\"],\n          });\n\n          result = {\n            userId:    (payload[\"uid\"]  as string) ?? null,\n            orgId:     (payload[\"org\"]  as string) ?? null,\n            orgRole:   (payload[\"rol\"]  as string) ?? null,\n            sessionId: (payload[\"sid\"]  as string) ?? null,\n            riskLevel: (payload[\"risk\"] as string) ?? \"low\",\n            isSignedIn: true,\n            isPublicRoute: publicRoute,\n          };\n        } catch {\n          // Expired or tampered token → treat as signed-out.\n        }\n      }\n    }\n\n    // Let callers override the default redirect logic.\n    if (afterAuth) {\n      const override = afterAuth(result, req);\n      if (override) return override as NextResponse;\n    }\n\n    // Default: redirect unauthenticated requests to the sign-in page.\n    if (!result.isSignedIn && !publicRoute) {\n      const dest = new URL(signInUrl, req.url);\n      dest.searchParams.set(\"redirect_url\", req.url);\n      return NextResponse.redirect(dest);\n    }\n\n    // Propagate auth claims to Server Components via request headers.\n    const next = new Headers(req.headers);\n    if (result.userId) {\n      next.set(HEADER_USER_ID,    result.userId);\n      next.set(HEADER_ORG_ID,     result.orgId ?? \"\");\n      next.set(HEADER_ORG_ROLE,   result.orgRole ?? \"\");\n      next.set(HEADER_SESSION_ID, result.sessionId ?? \"\");\n      next.set(HEADER_RISK_LEVEL, result.riskLevel ?? \"low\");\n    } else {\n      // Clear any previously-set headers (defence-in-depth).\n      [HEADER_USER_ID, HEADER_ORG_ID, HEADER_ORG_ROLE, HEADER_SESSION_ID, HEADER_RISK_LEVEL]\n        .forEach((h) => next.delete(h));\n    }\n\n    return NextResponse.next({ request: { headers: next } });\n  };\n}\n\nfunction extractBearer(header: string): string {\n  return header.startsWith(\"Bearer \") ? header.slice(7) : \"\";\n}\n"],"mappings":";AAEA,SAAS,eAAe;AACxB,SAAS,gBAAgB;;;ACFzB,SAAS,YAAY,iBAA+B;AACpD,SAAsB,oBAAoB;AAuCnC,IAAM,iBAAmB;AACzB,IAAM,gBAAmB;AACzB,IAAM,kBAAmB;AACzB,IAAM,oBAAoB;AAC1B,IAAM,oBAAoB;;;ADDjC,eAAsB,OAA4B;AAChD,QAAM,IAAI,MAAM,QAAQ;AACxB,QAAM,SAAS,EAAE,IAAI,cAAc;AAEnC,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,SAAS;AAAA,MACT,WAAW;AAAA,MACX,WAAW;AAAA,MACX,YAAY;AAAA,IACd;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,OAAW,EAAE,IAAI,aAAa,KAAS;AAAA,IACvC,SAAW,EAAE,IAAI,eAAe,KAAO;AAAA,IACvC,WAAW,EAAE,IAAI,iBAAiB,KAAK;AAAA,IACvC,WAAY,EAAE,IAAI,iBAAiB,KAAK;AAAA,IACxC,YAAY;AAAA,EACd;AACF;AAcA,eAAsB,QAAQ,aAAa,YAAiC;AAC1E,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAQ,YAAY;AACvB,aAAS,UAAU;AAAA,EACrB;AACA,SAAO;AACT;AAWA,eAAsB,cAA2C;AAC/D,QAAM,EAAE,OAAO,IAAI,MAAM,KAAK;AAC9B,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,QAAQ,IAAI,iBAAiB;AAC5C,QAAM,SAAS,QAAQ,IAAI,oBAAoB;AAC/C,MAAI,CAAC,UAAU,CAAC,OAAQ,QAAO;AAE/B,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,MAAM,aAAa,MAAM,IAAI;AAAA,MACtD,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG;AAAA,MAC7C,OAAO;AAAA,IACT,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUA,eAAsB,aAAkD;AACtE,QAAM,EAAE,MAAM,IAAI,MAAM,KAAK;AAC7B,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,SAAS,QAAQ,IAAI,iBAAiB;AAC5C,QAAM,SAAS,QAAQ,IAAI,oBAAoB;AAC/C,MAAI,CAAC,UAAU,CAAC,OAAQ,QAAO;AAE/B,MAAI;AACF,UAAM,eAAgC;AAAA,MACpC,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG;AAAA,MAC7C,MAAM,EAAE,YAAY,GAAG;AAAA,IACzB;AACA,UAAM,MAAM,MAAM,MAAM,GAAG,MAAM,YAAY,KAAK,IAAI,YAA2B;AACjF,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@smritix.ai/nextjs",
+  "version": "0.1.0",
+  "description": "Vaultix-ID Next.js SDK — edge middleware and server utilities",
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "files": ["dist"],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.mjs",
+      "require": "./dist/server.js"
+    },
+    "./middleware": {
+      "types": "./dist/middleware.d.ts",
+      "import": "./dist/middleware.mjs",
+      "require": "./dist/middleware.js"
+    }
+  },
+  "scripts": {
+    "build": "tsup --format esm,cjs --dts",
+    "dev": "tsup --format esm,cjs --dts --watch",
+    "lint": "tsc --noEmit",
+    "test": "jest --passWithNoTests",
+    "test:coverage": "jest --coverage"
+  },
+  "peerDependencies": {
+    "next": ">=14.0.0"
+  },
+  "dependencies": {
+    "@smritix.ai/react": "^0.1.0",
+    "jose": "^5.6.0"
+  },
+  "devDependencies": {
+    "@vaultix/config-ts": "workspace:*",
+    "next": "^14.2.0",
+    "typescript": "^5.5.0",
+    "tsup": "^8.0.0",
+    "jest": "^29.0.0",
+    "jest-environment-jsdom": "^29.0.0"
+  }
+}