@spawn-llc/auth 0.2.0 → 0.2.1

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.2.1
+
+**Fix: the session readers now force dynamic rendering before any early return.**
+
+`currentUser()`, `session()` and `rejectedEmail()` returned `null` when WorkOS was unconfigured
+*before* touching `headers()`. Every build runs without `WORKOS_*` env, so that short-circuit told
+Next the page was static — baking a signed-out verdict into HTML, and failing the build outright on
+any page that queries a database while prerendering. Found while migrating `admin`, whose own
+pre-migration code touched `headers()` first for exactly this reason.
+
 ## 0.2.0
 
 **Security — read this before upgrading an internal tool.**

package/dist/nextjs/index.d.ts

@@ -1,11 +1,6 @@
 import { U as User, S as Session } from '../domain-CmEhGW2N.js';
 import * as next_server from 'next/server';
 
-/**
- * The Spawn session seam for Next apps. ONE choke point: app code only ever calls `currentUser()` /
- * `requireUser()` / `session()` / `signOut()` — nothing outside this package knows it's WorkOS.
- * Generalized from admin's `@admin/auth` + audit's `lib/session.ts`.
- */
 /** The signed-in Spawn user, or null. Applies the optional email-domain gate. */
 declare function currentUser(): Promise<User | null>;
 /** The signed-in user; redirects to `/login` when absent. */

package/dist/nextjs/index.js

@@ -1,9 +1,13 @@
 import { isWorkosConfigured, isAllowedEmail, publicPaths, workosClientId } from '../chunk-ZIYU4K3F.js';
+import { headers, cookies } from 'next/headers';
 import { redirect } from 'next/navigation';
 import { authkitMiddleware, handleAuth, getWorkOS, saveSession } from '@workos-inc/authkit-nextjs';
-import { headers, cookies } from 'next/headers';
 
+async function markDynamic() {
+  await headers();
+}
 async function currentUser() {
+  await markDynamic();
   if (!isWorkosConfigured()) return null;
   const { withAuth } = await import('@workos-inc/authkit-nextjs');
   const { user } = await withAuth();
@@ -16,6 +20,7 @@ async function requireUser(redirectTo = "/login") {
   return user;
 }
 async function session() {
+  await markDynamic();
   if (!isWorkosConfigured()) return null;
   const { withAuth } = await import('@workos-inc/authkit-nextjs');
   const info = await withAuth();
@@ -27,6 +32,7 @@ async function session() {
   };
 }
 async function rejectedEmail() {
+  await markDynamic();
   if (!isWorkosConfigured()) return null;
   const { withAuth } = await import('@workos-inc/authkit-nextjs');
   const { user } = await withAuth();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spawn-llc/auth",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Spawn shared identity — headless auth for the whole Spawn suite. One WorkOS project (named \"Spawn\") backs every app; this is the only place that touches it. WorkOS is an invisible engine.",
   "license": "MIT",
   "type": "module",