@spfn/auth 0.3.0-beta.15 → 0.3.0-beta.17

package/dist/{session-DTHahDQ9.d.ts → session-Dfwu5g2W.d.ts}

@@ -1,5 +1,32 @@
 import { K as KeyAlgorithmType } from './types-DYyhze28.js';
 
+/**
+ * @spfn/auth - Return-path validation
+ *
+ * One rule for every flow that hands a caller-supplied destination back to the
+ * browser: the verified-email signup link, the password reset link, and the
+ * OAuth start/callback seams. Apps that build their own destination before
+ * calling an auth route import the same function rather than writing a second
+ * rule that drifts from this one.
+ *
+ * The module imports nothing on purpose — it is part of the client bundle
+ * (`@spfn/auth/nextjs/client`), which must not pull server code in behind it.
+ */
+/**
+ * Whether a return path can be handed back to the browser.
+ *
+ * Only a path within the app is allowed. The rejected shapes are the ones that
+ * turn a return path into an open redirect: an absolute URL, a protocol-relative
+ * `//host` that a browser reads as another origin, a backslash that some
+ * browsers normalize into a slash, any `..` traversal, and any character a URL
+ * parser strips before parsing (see above).
+ *
+ * The value is judged exactly as written: nothing is percent-decoded here. A
+ * `/a%0d%0a` is therefore a path containing those six literal characters and is
+ * accepted — no decoder downstream turns it back into header bytes.
+ */
+declare function isSafeReturnPath(returnPath: string): boolean;
+
 /**
  * @spfn/auth - Client Session Management
  *
@@ -50,4 +77,4 @@ declare function getSessionInfo(jwt: string): Promise<{
  */
 declare function shouldRefreshSession(jwt: string, thresholdHours?: number): Promise<boolean>;
 
-export { type SessionData as S, shouldRefreshSession as a, getSessionInfo as g, sealSession as s, unsealSession as u };
+export { type SessionData as S, shouldRefreshSession as a, getSessionInfo as g, isSafeReturnPath as i, sealSession as s, unsealSession as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spfn/auth",
-  "version": "0.3.0-beta.15",
+  "version": "0.3.0-beta.17",
   "type": "module",
   "description": "Authentication for a Next.js full-stack app: sessions, social login, OAuth, RBAC and admin roles, without assembling an auth stack yourself",
   "author": "Ray Im <rayim@fxy.global>",
@@ -135,9 +135,9 @@
     "@vitest/coverage-v8": "^4.0.6",
     "drizzle-kit": "1.0.0-rc.4",
     "drizzle-orm": "1.0.0-rc.4",
-    "hono": "^4.12.34",
+    "hono": "^4.13.5",
     "madge": "^8.0.0",
-    "next": "^16.2.11",
+    "next": "^16.3.3",
     "spfn": "workspace:*",
     "tsup": "^8.5.0",
     "tsx": "^4.20.6",
@@ -148,7 +148,7 @@
     "@spfn/core": ">=0.3.0-beta.8 <0.4.0",
     "@spfn/notification": ">=0.2.0-beta.5 <0.3.0",
     "drizzle-orm": ">=1.0.0-rc.4 <2",
-    "next": "^16.2.11"
+    "next": "^16.3.3"
   },
   "peerDependenciesMeta": {
     "next": {