@strivacity/sdk-next 4.0.0-beta.1 → 4.0.0-beta.2

package/README.md

@@ -106,7 +106,7 @@ export const sdkOptions: SDKInitConfig = {
 	redirectUri: 'https://your-app.example.com/callback', // callback URL after authentication
 	scopes: ['openid', 'profile', 'email'], // requested user permissions/data
 
-	// Omit this line entirely for client-managed sessions
+	// Omit these lines entirely for client-managed sessions
 	serverSessionUri: '/auth/login',
 };
 ```
@@ -148,10 +148,10 @@ export const DELETE = sdk.handler;
 | `GET`  | `/auth/register`             | Starts the registration flow and redirects to the IDP       | `302` redirect to IDP                        |
 | `GET`  | `/auth/callback`             | Completes authentication (handles the IDP callback)          | `302` redirect or popup close script         |
 | `GET`  | `/auth/refresh`              | Refreshes the access token                                   | `204 No Content` or `302` redirect           |
-| `GET`  | `/auth/revoke`               | Revokes tokens and clears the session                        | `204 No Content`                             |
-| `GET`  | `/auth/logout`               | Ends the session and redirects to the IDP logout page         | `302` redirect to IDP logout                 |
-| `GET`  | `/auth/entry`                | Handles external flow entry (e.g., password reset link) - embedded/native modes only | JSON with session data |
-| `POST` | `/auth/backchannel-logout`   | Processes back-channel logout requests from the IDP           | `204 No Content`                             |
+| `GET`  | `/auth/revoke`               | Revokes tokens and clears the session                        | `302` redirect to `postLogoutRedirectUri`    |
+| `GET`  | `/auth/logout`               | Ends the session and redirects to the IDP logout page; accepts a same-origin `?returnTo=` (default: `postLogoutRedirectUri`) | `302` to IDP logout (straight to `returnTo` when the session has no ID token)                 |
+| `GET`  | `/auth/entry`                | Handles external flow entry (e.g., password reset link) - embedded/native modes only | `302` redirect to `loginUri` |
+| `POST` | `/auth/backchannel-logout`   | Processes back-channel logout requests from the IDP           | `200 OK` (`400` invalid token, `501` storage without `deleteByLogoutToken`, `500` delete failed)   |
 
 > The `/auth` prefix and route names come from `authUrlPrefix` - see [Server configuration reference](#server-configuration-reference).
 
@@ -198,13 +198,14 @@ For server-managed sessions, fetch the session once in your root layout (a Serve
 ```tsx
 // app/layout.tsx
 import type { ReactNode } from 'react';
+import { toClientSession } from '@strivacity/sdk-next/server';
 import { AuthProvider } from '../lib/auth/provider';
 import { sdk } from '../lib/auth/server';
 
 export const dynamic = 'force-dynamic';
 
 export default async function RootLayout({ children }: { children: ReactNode }) {
-	const session = await sdk.getSession();
+	const session = toClientSession(await sdk.getSession());
 
 	return (
 		<html lang="en-US">
@@ -216,6 +217,8 @@ export default async function RootLayout({ children }: { children: ReactNode })
 }
 ```
 
+> **Note:** The session passed to the provider is serialized into the rendered HTML, so `toClientSession()` (exported from both `@strivacity/sdk-next/server` and `@strivacity/sdk-next/client`) removes the long-lived credentials before handing it over: the refresh token (refresh goes through `/auth/refresh` on the server) and the ID token (only the server-side `/auth/logout` route needs it).
+
 ---
 
 ## Client SDK
@@ -415,7 +418,7 @@ export default function LogoutPage() {
 
 **Server-managed sessions**:
 
-With `serverSessionUri` configured, redirect to `/auth/logout` instead - the Server SDK clears the session and redirects to the IDP end-session endpoint:
+With `serverSessionUri` configured, the `logout()` call above doesn't clear the server session cookie, so redirect to `/auth/logout` instead - the Server SDK clears the session and redirects to the IDP end-session endpoint, which then sends the user back to `postLogoutRedirectUri`. To land somewhere else, add a same-origin `?returnTo=` (e.g. `/auth/logout?returnTo=/goodbye`); a missing, invalid, or cross-origin value falls back to `postLogoutRedirectUri`. Whichever URL is used must be registered as an allowed post-logout redirect URI:
 
 ```tsx
 // app/logout/page.tsx
@@ -468,7 +471,7 @@ export function TokenPanel() {
 
 **Server-managed sessions**:
 
-With `serverSessionUri` configured, tokens are refreshed/revoked by the Server SDK - trigger it by navigating to the catch-all route, then let it redirect back:
+With `serverSessionUri` configured, tokens are refreshed/revoked by the Server SDK - trigger it by navigating to the catch-all route, then let it redirect back. `sdk.refresh({ returnTo: '/profile' })` (`sdk` from `useStrivacity()`) performs the same refresh navigation for you:
 
 ```tsx
 'use client';
@@ -568,11 +571,39 @@ Popup mode always needs client-side JavaScript to open the window, so there's no
 
 **Client-managed sessions**:
 
-The popup resolves automatically - no callback page is needed. Token exchange happens inside the popup and the result is posted back to the opener window.
+The pop-up still navigates to your `redirectUri`, so you still need a callback page there - without it nothing posts the result back to the opener. Call `handleCallback()` on that page; in popup mode it never resolves (the opener closes the pop-up once it receives the result), so don't rely on code after it running:
+
+```tsx
+// app/callback/page.tsx
+'use client';
+
+import { useEffect } from 'react';
+import { useStrivacity } from '@strivacity/sdk-next/client';
+
+export default function CallbackPage() {
+	const { loading, handleCallback } = useStrivacity();
+
+	useEffect(() => {
+		if (loading) {
+			return;
+		}
+
+		void handleCallback();
+	}, [loading]);
+
+	return (
+		<section>
+			<h1>Logging in...</h1>
+		</section>
+	);
+}
+```
+
+`login()` resolves in the opener once the result has been received and, for client-managed sessions, the tokens have been exchanged.
 
 **Server-managed sessions**:
 
-Same as client managed - the popup's internal callback request is also transparently proxied through `/auth/callback`, and the result is posted back to the opener window exactly the same way.
+The callback page must not call `handleCallback()`: forward the query string to `/auth/callback` instead, as in the server-managed redirect callback. The Server SDK exchanges the code, sets the session cookie and responds with a page that posts the result to the opener and closes the pop-up.
 
 ##### Registration
 
@@ -665,7 +696,7 @@ export default function LogoutPage() {
 
 **Server-managed sessions**:
 
-With `serverSessionUri` configured, redirect to `/auth/logout` instead - the Server SDK clears the session and redirects to the IDP end-session endpoint:
+With `serverSessionUri` configured, the `logout()` call above doesn't clear the server session cookie, so redirect to `/auth/logout` instead - the Server SDK clears the session and redirects to the IDP end-session endpoint, which then sends the user back to `postLogoutRedirectUri`. To land somewhere else, add a same-origin `?returnTo=` (e.g. `/auth/logout?returnTo=/goodbye`); a missing, invalid, or cross-origin value falls back to `postLogoutRedirectUri`. Whichever URL is used must be registered as an allowed post-logout redirect URI:
 
 ```tsx
 // app/logout/page.tsx
@@ -718,7 +749,7 @@ export function TokenPanel() {
 
 **Server-managed sessions**:
 
-With `serverSessionUri` configured, tokens are refreshed/revoked by the Server SDK - trigger it by navigating to the catch-all route, then let it redirect back:
+With `serverSessionUri` configured, tokens are refreshed/revoked by the Server SDK - trigger it by navigating to the catch-all route, then let it redirect back. `sdk.refresh({ returnTo: '/profile' })` (`sdk` from `useStrivacity()`) performs the same refresh navigation for you:
 
 ```tsx
 'use client';
@@ -1246,7 +1277,7 @@ export default function LogoutPage() {
 
 **Server-managed sessions**:
 
-With `serverSessionUri` configured, redirect to `/auth/logout` instead - the Server SDK clears the session and redirects to the IDP end-session endpoint:
+With `serverSessionUri` configured, the `logout()` call above doesn't clear the server session cookie, so redirect to `/auth/logout` instead - the Server SDK clears the session and redirects to the IDP end-session endpoint, which then sends the user back to `postLogoutRedirectUri`. To land somewhere else, add a same-origin `?returnTo=` (e.g. `/auth/logout?returnTo=/goodbye`); a missing, invalid, or cross-origin value falls back to `postLogoutRedirectUri`. Whichever URL is used must be registered as an allowed post-logout redirect URI:
 
 ```tsx
 // app/logout/page.tsx
@@ -1299,7 +1330,7 @@ export function TokenPanel() {
 
 **Server-managed sessions**:
 
-With `serverSessionUri` configured, tokens are refreshed/revoked by the Server SDK - trigger it by navigating to the catch-all route, then let it redirect back:
+With `serverSessionUri` configured, tokens are refreshed/revoked by the Server SDK - trigger it by navigating to the catch-all route, then let it redirect back. `sdk.refresh({ returnTo: '/profile' })` (`sdk` from `useStrivacity()`) performs the same refresh navigation for you:
 
 ```tsx
 'use client';
@@ -1353,7 +1384,6 @@ export default function LoginPage() {
 		params: {
 			prompt: 'login', // use 'create' to open the registration flow instead
 			language: 'en-US', // set the UI language (BCP 47 language tag)
-			sdk: 'web-minimal', // rendering mode: 'web-minimal' for simplified rendering, 'web' (default) for full rendering hints and branding
 			sessionId: searchParams.get('session_id'), // pass a session ID to resume an existing flow
 		},
 		onLogin: async () => {
@@ -1604,7 +1634,7 @@ export default function LogoutPage() {
 
 **Server-managed sessions**:
 
-With `serverSessionUri` configured, redirect to `/auth/logout` instead - the Server SDK clears the session and redirects to the IDP end-session endpoint:
+With `serverSessionUri` configured, the `logout()` call above doesn't clear the server session cookie, so redirect to `/auth/logout` instead - the Server SDK clears the session and redirects to the IDP end-session endpoint, which then sends the user back to `postLogoutRedirectUri`. To land somewhere else, add a same-origin `?returnTo=` (e.g. `/auth/logout?returnTo=/goodbye`); a missing, invalid, or cross-origin value falls back to `postLogoutRedirectUri`. Whichever URL is used must be registered as an allowed post-logout redirect URI:
 
 ```tsx
 // app/logout/page.tsx
@@ -1657,7 +1687,7 @@ export function TokenPanel() {
 
 **Server-managed sessions**:
 
-With `serverSessionUri` configured, tokens are refreshed/revoked by the Server SDK - trigger it by navigating to the catch-all route, then let it redirect back:
+With `serverSessionUri` configured, tokens are refreshed/revoked by the Server SDK - trigger it by navigating to the catch-all route, then let it redirect back. `sdk.refresh({ returnTo: '/profile' })` (`sdk` from `useStrivacity()`) performs the same refresh navigation for you:
 
 ```tsx
 'use client';
@@ -1702,23 +1732,31 @@ const ctx = useStrivacity<RedirectFlow>();
 ```ts
 {
 	// SDK instance (access any SDK method)
-	sdk: RedirectFlow | PopupFlow | EmbeddedFlow | NativeFlow;
+	readonly sdk: RedirectFlow | PopupFlow | EmbeddedFlow | NativeFlow;
 
 	// Reactive state (plain values - the component re-renders when they change)
-	loading: boolean; // True during initialization
-	isAuthenticated: boolean; // True if user has valid session
-	idTokenClaims: IdTokenClaims | null; // Decoded ID token claims
-	accessToken: string | null; // Current access token
-	refreshToken: string | null; // Current refresh token
-
-	// Methods (all are async)
-	login(params?: LoginParams): Promise<void>; // Start login flow
-	register(params?: LoginParams): Promise<void>; // Start registration flow
-	handleCallback(url?: string): Promise<void>; // Handle OAuth callback
+	readonly loading: boolean; // True during initialization
+	readonly language: string; // Current BCP 47 language code
+	readonly isAuthenticated: boolean; // True if user has valid session
+	readonly idTokenClaims: IdTokenClaims | null; // Decoded ID token claims
+	readonly accessToken: string | null; // Current access token
+	readonly refreshToken: string | null; // Current refresh token
+	readonly accessTokenExpired: boolean; // True once the access token has expired
+	readonly accessTokenExpirationDate: number | null; // Access token expiration timestamp
+
+	// Methods (same signatures as the underlying flow's methods)
+	init(): Promise<void>; // Initialize the SDK (load metadata, restore a persisted session)
+	checkAuthentication(params?: { autoRefresh: boolean }): Promise<boolean>; // Check the session, optionally refreshing the token (never when serverSessionUri is set)
+	login(params?: RedirectParams | PopupParams): Promise<void>; // Start login flow (redirect: `returnTo` sets where handleCallback() sends the user) (embedded/native: returns an EmbeddedLoginFlow/NativeLoginFlow instead)
+	register(params?: RedirectParams | PopupParams): Promise<void>; // Start registration flow (embedded/native: returns an EmbeddedLoginFlow/NativeLoginFlow instead)
+	handleCallback(url?: string | URL): Promise<{ returnTo?: string }>; // Handle OAuth callback; resolves to the `returnTo` given to login()
 	logout(params?: LogoutParams): Promise<void>; // End session
-	refresh(): Promise<void>; // Refresh access token
+	refresh(params?: { returnTo?: string }): Promise<void>; // Refresh access token (server-managed: navigates to the server's refresh route, `${authUrlPrefix}/refresh`, instead; `returnTo` sets where it returns, default: the current URL)
 	revoke(): Promise<void>; // Revoke tokens
-	entry(): Promise<EntryData>; // Handle external entry (embedded/native only)
+	tokenExchange(params?: Record<string, string>): Promise<void>; // Perform a token exchange
+	entry(url?: string | URL, params?: RedirectOptions): Promise<void | EntryResponse>; // Handle external entry (resolves to EntryResponse in embedded/native mode)
+	subscribeToEvent<T extends keyof EventFunctions>(eventName: T, callbackFn: (...params: Parameters<EventFunctions[T]>) => Promise<void> | void): { dispose: () => void }; // Subscribe to a single SDK event
+	subscribeToAllEvents(callbackFn: (...params: Array<unknown>) => Promise<void> | void): { dispose: () => void }; // Subscribe to all SDK events
 }
 ```
 
@@ -1744,10 +1782,10 @@ const ctx = useNativeLogin({
 {
 	params?: NativeParams; // Initial flow parameters
 	onLogin?: (session: SessionData) => void | Promise<void>; // Called on successful login
-	onClose?: () => void; // Called when user closes the flow
-	onError?: (error: unknown) => void; // Called on error
-	onFallback?: (error: FallbackError) => void; // Called when fallback needed
-	onGlobalMessage?: (message: NativeFlowMessage) => void; // Called for global messages
+	onClose?: () => void | Promise<void>; // Called when user closes the flow
+	onError?: (error: Error) => void | Promise<void>; // Called on error
+	onFallback?: (error: FallbackError) => void | Promise<void>; // Called when fallback needed
+	onGlobalMessage?: (message: NativeFlowMessage) => void | Promise<void>; // Called for global messages
 }
 ```
 
@@ -1770,9 +1808,19 @@ const ctx = useNativeLogin({
 }
 ```
 
+#### useNativeLoginContext
+
+Returns the context of the currently mounted `useNativeLogin()` from any component (e.g. your own widget components), without passing it down as props. Before `useNativeLogin()` has mounted it returns an empty default context (`loading: true`, no-op methods).
+
+```ts
+import { useNativeLoginContext } from '@strivacity/sdk-next/client';
+
+const { forms, messages, setFormValue, submitForm } = useNativeLoginContext();
+```
+
 #### withAuthGuard (client)
 
-Higher-order component that guards a component with authentication. Waits for the SDK to finish loading, checks the session, and redirects to the login page if the user is not authenticated. Not to be confused with the Server SDK's [`withAuthGuard`](#withauthguard), which guards a page/route server-side.
+Higher-order component that guards a component with authentication. Waits for the SDK to finish loading, checks the session, and redirects to the login page if the user is not authenticated (with the current path as `returnTo`, e.g. `/login?returnTo=%2Forders` - pass it on with `login({ returnTo })`). With server-managed sessions, an expired session is sent through the server's refresh route instead (`sdk.refresh()`, returning to the current URL). Not to be confused with the Server SDK's [`withAuthGuard`](#withauthguard), which guards a page/route server-side.
 
 ```tsx
 'use client';
@@ -1846,7 +1894,7 @@ export default async function handler(req: NextApiRequest, res: NextApiResponse)
 
 ### Accessing the session server-side
 
-Call `getSession()` from any Server Component, Route Handler, or `getServerSideProps` to read the current session without going through the client SDK:
+Call `getSession()` from any Server Component, Route Handler, or `getServerSideProps` (pass the request there: `sdk.getSession(ctx.req)`) to read the current session without going through the client SDK. In Server Components (no request) and for Pages Router requests it reads the stored session without refreshing, so the returned session can be expired: a rotated session could not be saved there. Use [`withAuthGuard`](#withauthguard), which sends an expiring session through `/auth/refresh`, or check `expires_at` yourself:
 
 ```tsx
 // app/profile/page.tsx (Server Component)
@@ -1864,10 +1912,25 @@ export default async function ProfilePage() {
 }
 ```
 
+With an App Router request - in Route Handlers, where cookies can be written - `getSession(req)` also refreshes: with `autoRefresh` (the default) it refreshes an expired (or within `refreshSkew`) session first when a refresh token exists, at most once per request (concurrent and later calls with the same `req` share the result), and resolves to `null` if the refresh fails.
+
+```ts
+// app/api/me/route.ts
+import type { NextRequest } from 'next/server';
+import { sdk } from '../../../lib/auth/server';
+
+export async function GET(req: NextRequest) {
+	const session = await sdk.getSession(req);
+	return session ? Response.json({ claims: session.claims }) : Response.json({ error: 'not_authenticated' }, { status: 401 });
+}
+```
+
 ### withAuthGuard
 
 Guards a page and injects a `session` prop, redirecting to `options.loginUri` (default `/login`) when there's no active session.
 
+The guard also checks expiry. When the access token has expired (or is within `refreshSkew` seconds of expiry) and the session has a refresh token, it redirects to `${authUrlPrefix}/refresh?returnTo=...` - the refresh route writes the rotated session cookie and redirects back. The `returnTo` is the guard's `returnTo` option, falling back to `postLoginRedirectUri` (App Router) or the requested page, `ctx.resolvedUrl` (Pages Router). An expired session without a refresh token - or any expired session with `autoRefresh: false` - is treated as no session and redirects to the login page.
+
 **App Router:**
 
 ```tsx
@@ -1893,7 +1956,7 @@ export default function ProfilePage({ session }: { session: SessionData }) {
 }
 ```
 
-Pass `returnTo` to redirect back to a specific page after login, or (Pages Router only) `getServerSideProps` to run your own data fetching alongside the guard:
+Pass `returnTo` to redirect back to a specific page after login or refresh, or (Pages Router only) `getServerSideProps` to run your own data fetching alongside the guard:
 
 ```ts
 export const getServerSideProps = sdk.withAuthGuard({
@@ -1938,7 +2001,7 @@ By default the Server SDK stores tokens encrypted in http-only cookies and login
 #### Built-in session storages
 
 - **`createEncryptedCookieStorage(secret, options?)`** - default storage that keeps the session encrypted in an http-only cookie.
-- **`createSessionIdCookieStorage(storage, options?)`** - puts only a small, random session-id cookie on the client and keeps the actual session payload in the `storage` you provide. This supports back-channel logout out of the box.
+- **`createSessionIdCookieStorage(storage, options?)`** - puts only a small, random session-id cookie on the client and keeps the actual session payload in the `storage` you provide. It supports back-channel logout when `storage` implements `deleteByLogoutToken`.
 
 ```ts
 // lib/auth/storage.ts
@@ -1967,37 +2030,40 @@ export const sdk = createServerSDK({
 
 #### Custom storage
 
-For example you can use Redis via [unstorage](https://npmjs.com/package/unstorage):
+For example you can use Redis via [unstorage](https://npmjs.com/package/unstorage).
+
+The SDK always reads and writes the session under the same key (`storageTokenName`), and passes the current request as the last argument. A storage that ignores the request would therefore share a single session across all users, so key the data per browser session instead. The easiest way is to wrap your key-value store with `createSessionIdCookieStorage`, which puts a random session id in a cookie and calls your store with that id as the key:
 
 ```ts
 // lib/auth/storage.ts
 import { createStorage } from 'unstorage';
 import redisDriver from 'unstorage/drivers/redis';
-import type { NextServerStorage, SDKStorage } from '@strivacity/sdk-next/server';
+import type { ServerStorage, SDKStorage } from '@strivacity/sdk-next/server';
 
 const unstorageInstance = createStorage({ driver: redisDriver({ url: process.env.REDIS_URL }) });
 
-// Custom session storage for tokens
-export const sessionStorage: NextServerStorage = {
+// Session payload store - `key` is the per-browser session id provided by `createSessionIdCookieStorage`
+// (raw get/set keep the serialized session string as-is)
+export const sessionStore: ServerStorage = {
 	async get(key) {
-		return unstorageInstance.getItem<string>(key);
+		return unstorageInstance.getItemRaw<string>(`session:${key}`);
 	},
 	async set(key, value) {
-		await unstorageInstance.setItem(key, value);
+		await unstorageInstance.setItemRaw(`session:${key}`, value);
 	},
 	async delete(key) {
-		await unstorageInstance.removeItem(key);
+		await unstorageInstance.removeItem(`session:${key}`);
 	},
 	// Required for back-channel logout support - see below.
-	// Scans all stored sessions and removes those matching the logout token's sid or sub claim.
+	// Scans all stored sessions and removes those whose ID token claims match the logout token's sid or sub claim.
 	async deleteByLogoutToken(logoutToken) {
-		const keys = await unstorageInstance.getKeys();
+		const keys = await unstorageInstance.getKeys('session');
 		await Promise.all(
 			keys.map(async (key) => {
-				const raw = await unstorageInstance.getItem<string>(key);
+				const raw = await unstorageInstance.getItemRaw<string>(key);
 				if (!raw) return;
 				const session = JSON.parse(raw);
-				if ((logoutToken.sid && session.sid === logoutToken.sid) || (logoutToken.sub && session.sub === logoutToken.sub)) {
+				if ((logoutToken.sid && session.claims?.sid === logoutToken.sid) || (logoutToken.sub && session.claims?.sub === logoutToken.sub)) {
 					await unstorageInstance.removeItem(key);
 				}
 			}),
@@ -2021,13 +2087,13 @@ export const stateStorage: SDKStorage = {
 
 ```ts
 // lib/auth/server.ts
-import { createServerSDK } from '@strivacity/sdk-next/server';
+import { createServerSDK, createSessionIdCookieStorage } from '@strivacity/sdk-next/server';
 import { sdkOptions } from './options';
-import { sessionStorage, stateStorage } from './storage';
+import { sessionStore, stateStorage } from './storage';
 
 export const sdk = createServerSDK({
 	...sdkOptions,
-	storage: sessionStorage, // Custom Redis-backed session storage
+	storage: createSessionIdCookieStorage(sessionStore), // Custom Redis-backed session storage, keyed by a session-id cookie
 	stateStorage, // Custom Redis-backed state storage
 });
 ```
@@ -2038,9 +2104,9 @@ export const sdk = createServerSDK({
 
 OIDC back-channel logout lets the authorization server terminate sessions server-to-server, without involving the browser. When the IDP sends a logout event (e.g. an admin terminates a session, or the user logs out from a different device), it POSTs a signed `logout_token` JWT to `/auth/backchannel-logout` - already wired up by the catch-all route from [Setup](#setup) - which routes it to `sdk.handleBackChannelLogout(req)`.
 
-The handler verifies the token's signature against the IDP's JWKS, validates the `iss`, `aud`, `iat` (freshness), and `jti` (replay protection) claims, requires the `http://schemas.openid.net/event/backchannel-logout` event and a `sid` or `sub` claim, then calls `storage.deleteByLogoutToken({ sid?, sub? })` to remove the matching session(s). It responds `200` on success, `400` for an invalid or malformed `logout_token`, and `501` if the configured storage doesn't implement `deleteByLogoutToken`.
+The handler verifies the token's signature against the IDP's JWKS, validates the `iss`, `aud`, `iat` (freshness), and `jti` (replay protection) claims, requires the `http://schemas.openid.net/event/backchannel-logout` event and a `sid` or `sub` claim, then calls `storage.deleteByLogoutToken({ sid?, sub? })` to remove the matching session(s). It responds `200` on success, `400` for an invalid or malformed `logout_token`, `501` if the configured storage doesn't implement `deleteByLogoutToken`, and `500` if deleting the session fails.
 
-> **The default encrypted-cookie storage does not support back-channel logout** because each cookie is bound to a single browser session - there is no server-side index to look up by `sid` or `sub`. To support back-channel logout, use [`createSessionIdCookieStorage`](#server-storages) with a `storage` that implements `deleteByLogoutToken` (e.g. `createServerMemoryStorage()` for local testing), or a fully custom server storage as shown in the [Custom storage](#server-storages) example above.
+> **The default encrypted-cookie storage does not support back-channel logout** because each cookie is bound to a single browser session - there is no server-side index to look up by `sid` or `sub`. To support back-channel logout, use [`createSessionIdCookieStorage`](#server-storages) with a `storage` that implements `deleteByLogoutToken`, e.g. `createServerMemoryStorage()` for local testing or the Redis-backed store from the [Custom storage](#server-storages) example above.
 
 Configure the **Back-channel logout URI** in your Strivacity application settings to:
 
@@ -2057,7 +2123,7 @@ For a complete explanation of the handshake and validation performed, see the co
 	options: ServerSDKOptions; // resolved server SDK configuration
 
 	// Session management
-	getSession(req?): Promise<SessionData | null>; // read the current session
+	getSession(req?): Promise<SessionData | null>; // read the current session; with an App Router request and `autoRefresh` (default) it refreshes an expired one first (once per request, null if the refresh fails). Without a request (Server Components) or with a Pages Router request it never refreshes
 	updateSession(session, req?): Promise<void>; // persist new session data
 	refreshSession(req?): Promise<SessionData>; // refresh tokens using the refresh token
 	revokeSession(req?): Promise<void>; // revoke tokens and clear the session
@@ -2093,8 +2159,8 @@ The Server SDK accepts the same configuration as the client SDK (see [Configurat
 | `stateStorage` | `SDKStorage` | No | In-memory `Map` | Custom OAuth2 state storage |
 | `authUrlPrefix` | `string` | No | `'/auth'` | URL prefix matched by `handler`/the catch-all route |
 | `loginUri` | `string` | No | `'/login'` | Page `withAuthGuard` redirects to when there's no session |
-| `postLoginRedirectUri` | `string` | No | - | Default redirect after login when no `?returnTo=` is given |
-| `postLogoutRedirectUri` | `string` | No | - | Default redirect after logout |
+| `postLoginRedirectUri` | `string` | No | origin of `redirectUri` | Default redirect after login when no `?returnTo=` is given |
+| `postLogoutRedirectUri` | `string` | No | origin of `redirectUri` | Default redirect after logout |
 | `cookieMaxAge` | `number` | No | `2592000` (30 days) | Max age of the session cookie in seconds |
 
 ---
@@ -2130,7 +2196,7 @@ The client SDK accepts the same configuration as the core SDK - see the [core SD
 
 ### Migrating to v4.0
 
-v4 replaces the SDK's class-based flow architecture with function-based architecture, and adds a first-class Server SDK for server-managed (BFF) sessions. `StyAuthProvider`, `useStrivacity()`, `useNativeLogin()`, and the built-in `redirect`/`popup`/`embedded`/`native` modes are unchanged - only apps that used `mode: 'custom'` or drove `native` mode through the old `NativeFlowHandler` need to update their code.
+v4 replaces the SDK's class-based flow architecture with function-based architecture, and adds a first-class Server SDK for server-managed (BFF) sessions. `StyAuthProvider`, `useStrivacity()`, and the built-in `redirect`/`popup`/`embedded`/`native` modes are unchanged (`useStrivacity()` no longer exposes `options` - use `sdk.options`). `useNativeLogin()` is new in v4: it replaces v3's `<StyLoginRenderer>` component (and `NativeFlowContext`), so `native` mode now renders your own widget components driven by [`useNativeLogin()`](#usenativelogin) and [`useNativeLoginContext()`](#usenativelogincontext). Apps that rendered `<StyLoginRenderer>`, used `mode: 'custom'`, or drove `native` mode through the old `NativeFlowHandler` need to update their code.
 
 #### Class-based flows replaced by functions
 
@@ -2157,7 +2223,7 @@ import type { SDKInitConfig, SDKOptions } from '@strivacity/sdk-core/types';
 
 export function createCustomFlow(initConfig: SDKInitConfig) {
 	const state = getDefaultFlowState();
-	const options = getSDKOptions<SDKOptions>(state, initConfig);
+	const options = getSDKOptions<SDKOptions>(initConfig);
 	const base = createBaseFlow(state, options);
 
 	async function refresh(): Promise<void> {

package/dist/server/handlers/api.cjs

@@ -1,2 +1,2 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../utils.cjs");let t=require("next/server");var n=n=>r=>async(i,a)=>{let o=i instanceof Request?e.toNextRequest(i):i;if(!await n.getSession(o))return t.NextResponse.json({error:`not_authenticated`,description:`The user does not have an active session or is not authenticated`},{status:401});let s=await r(o,a);return s instanceof t.NextResponse?s:new t.NextResponse(s.body,s)},r=e=>t=>async(n,r)=>{if(!await e.getSession(n))return r.status(401).json({error:`not_authenticated`,description:`The user does not have an active session or is not authenticated`});await t(n,r)};exports.apiAppRouteHandlerFactory=n,exports.apiPageRouteHandlerFactory=r;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../utils.cjs");let t=require("next/server");var n=n=>r=>async(i,a)=>{let o=i instanceof Request?e.toNextRequest(i):i;if(!await n.getSession(o))return t.NextResponse.json({error:`not_authenticated`,description:`The user does not have an active session or is not authenticated`},{status:401});let s=await r(o,a);return s instanceof t.NextResponse?s:new t.NextResponse(s.body,s)},r=e=>t=>async(n,r)=>{if(!await e.getSession(n,{autoRefresh:!1}))return r.status(401).json({error:`not_authenticated`,description:`The user does not have an active session or is not authenticated`});await t(n,r)};exports.apiAppRouteHandlerFactory=n,exports.apiPageRouteHandlerFactory=r;
 //# sourceMappingURL=api.cjs.map

package/dist/server/handlers/api.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"api.cjs","names":[],"sources":["../../../src/server/handlers/api.ts"],"sourcesContent":["import type { BaseServerSDK, PagesRouterRequest, WithApiAuthRequiredAppRoute, WithApiAuthRequiredPageRoute } from '../types';\nimport { NextRequest, NextResponse } from 'next/server';\nimport { toNextRequest } from '../utils';\n\nexport const apiAppRouteHandlerFactory =\n\t(sdk: BaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>): WithApiAuthRequiredAppRoute =>\n\t(apiRoute) =>\n\tasync (req: NextRequest | Request, params): Promise<NextResponse> => {\n\t\tconst nextReq = req instanceof Request ? toNextRequest(req) : req;\n\n\t\tconst session = await sdk.getSession(nextReq);\n\n\t\tif (!session) {\n\t\t\treturn NextResponse.json(\n\t\t\t\t{\n\t\t\t\t\terror: 'not_authenticated',\n\t\t\t\t\tdescription: 'The user does not have an active session or is not authenticated',\n\t\t\t\t},\n\t\t\t\t{ status: 401 },\n\t\t\t);\n\t\t}\n\n\t\tconst apiRes: NextResponse | Response = await apiRoute(nextReq, params);\n\t\tconst nextApiRes: NextResponse = apiRes instanceof NextResponse ? apiRes : new NextResponse(apiRes.body, apiRes);\n\n\t\treturn nextApiRes;\n\t};\n\nexport const apiPageRouteHandlerFactory =\n\t(sdk: BaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>): WithApiAuthRequiredPageRoute =>\n\t(apiRoute) =>\n\tasync (req, res) => {\n\t\tconst session = await sdk.getSession(req);\n\n\t\tif (!session) {\n\t\t\treturn res.status(401).json({\n\t\t\t\terror: 'not_authenticated',\n\t\t\t\tdescription: 'The user does not have an active session or is not authenticated',\n\t\t\t});\n\t\t}\n\n\t\tawait apiRoute(req, res);\n\t};\n"],"mappings":"gIAIA,IAAa,EACX,GACA,GACD,MAAO,EAA4B,IAAkC,CACpE,IAAM,EAAU,aAAe,QAAU,EAAA,cAAc,CAAG,EAAI,EAI9D,GAAI,CAAC,MAFiB,EAAI,WAAW,CAAO,EAG3C,OAAO,EAAA,aAAa,KACnB,CACC,MAAO,oBACP,YAAa,kEACd,EACA,CAAE,OAAQ,GAAI,CACf,EAGD,IAAM,EAAkC,MAAM,EAAS,EAAS,CAAM,EAGtE,OAFiC,aAAkB,EAAA,aAAe,EAAS,IAAI,EAAA,aAAa,EAAO,KAAM,CAAM,CAGhH,EAEY,EACX,GACA,GACD,MAAO,EAAK,IAAQ,CAGnB,GAAI,CAAC,MAFiB,EAAI,WAAW,CAAG,EAGvC,OAAO,EAAI,OAAO,GAAG,CAAC,CAAC,KAAK,CAC3B,MAAO,oBACP,YAAa,kEACd,CAAC,EAGF,MAAM,EAAS,EAAK,CAAG,CACxB"}
+{"version":3,"file":"api.cjs","names":[],"sources":["../../../src/server/handlers/api.ts"],"sourcesContent":["import type { BaseServerSDK, PagesRouterRequest, WithApiAuthRequiredAppRoute, WithApiAuthRequiredPageRoute } from '../types';\nimport { NextRequest, NextResponse } from 'next/server';\nimport { toNextRequest } from '../utils';\n\nexport const apiAppRouteHandlerFactory =\n\t(sdk: BaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>): WithApiAuthRequiredAppRoute =>\n\t(apiRoute) =>\n\tasync (req: NextRequest | Request, params): Promise<NextResponse> => {\n\t\tconst nextReq = req instanceof Request ? toNextRequest(req) : req;\n\n\t\tconst session = await sdk.getSession(nextReq);\n\n\t\tif (!session) {\n\t\t\treturn NextResponse.json(\n\t\t\t\t{\n\t\t\t\t\terror: 'not_authenticated',\n\t\t\t\t\tdescription: 'The user does not have an active session or is not authenticated',\n\t\t\t\t},\n\t\t\t\t{ status: 401 },\n\t\t\t);\n\t\t}\n\n\t\tconst apiRes: NextResponse | Response = await apiRoute(nextReq, params);\n\t\tconst nextApiRes: NextResponse = apiRes instanceof NextResponse ? apiRes : new NextResponse(apiRes.body, apiRes);\n\n\t\treturn nextApiRes;\n\t};\n\nexport const apiPageRouteHandlerFactory =\n\t(sdk: BaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>): WithApiAuthRequiredPageRoute =>\n\t(apiRoute) =>\n\tasync (req, res) => {\n\t\t// NOTE: Pages Router: no cookies() store to save a refreshed session in, so read it as stored\n\t\tconst session = await sdk.getSession(req, { autoRefresh: false });\n\n\t\tif (!session) {\n\t\t\treturn res.status(401).json({\n\t\t\t\terror: 'not_authenticated',\n\t\t\t\tdescription: 'The user does not have an active session or is not authenticated',\n\t\t\t});\n\t\t}\n\n\t\tawait apiRoute(req, res);\n\t};\n"],"mappings":"gIAIA,IAAa,EACX,GACA,GACD,MAAO,EAA4B,IAAkC,CACpE,IAAM,EAAU,aAAe,QAAU,EAAA,cAAc,CAAG,EAAI,EAI9D,GAAI,CAAC,MAFiB,EAAI,WAAW,CAAO,EAG3C,OAAO,EAAA,aAAa,KACnB,CACC,MAAO,oBACP,YAAa,kEACd,EACA,CAAE,OAAQ,GAAI,CACf,EAGD,IAAM,EAAkC,MAAM,EAAS,EAAS,CAAM,EAGtE,OAFiC,aAAkB,EAAA,aAAe,EAAS,IAAI,EAAA,aAAa,EAAO,KAAM,CAAM,CAGhH,EAEY,EACX,GACA,GACD,MAAO,EAAK,IAAQ,CAInB,GAAI,CAAC,MAFiB,EAAI,WAAW,EAAK,CAAE,YAAa,EAAM,CAAC,EAG/D,OAAO,EAAI,OAAO,GAAG,CAAC,CAAC,KAAK,CAC3B,MAAO,oBACP,YAAa,kEACd,CAAC,EAGF,MAAM,EAAS,EAAK,CAAG,CACxB"}

package/dist/server/handlers/api.mjs

@@ -1,2 +1,2 @@
-import{toNextRequest as e}from"../utils.mjs";import{NextResponse as t}from"next/server";var n=n=>r=>async(i,a)=>{let o=i instanceof Request?e(i):i;if(!await n.getSession(o))return t.json({error:`not_authenticated`,description:`The user does not have an active session or is not authenticated`},{status:401});let s=await r(o,a);return s instanceof t?s:new t(s.body,s)},r=e=>t=>async(n,r)=>{if(!await e.getSession(n))return r.status(401).json({error:`not_authenticated`,description:`The user does not have an active session or is not authenticated`});await t(n,r)};export{n as apiAppRouteHandlerFactory,r as apiPageRouteHandlerFactory};
+import{toNextRequest as e}from"../utils.mjs";import{NextResponse as t}from"next/server";var n=n=>r=>async(i,a)=>{let o=i instanceof Request?e(i):i;if(!await n.getSession(o))return t.json({error:`not_authenticated`,description:`The user does not have an active session or is not authenticated`},{status:401});let s=await r(o,a);return s instanceof t?s:new t(s.body,s)},r=e=>t=>async(n,r)=>{if(!await e.getSession(n,{autoRefresh:!1}))return r.status(401).json({error:`not_authenticated`,description:`The user does not have an active session or is not authenticated`});await t(n,r)};export{n as apiAppRouteHandlerFactory,r as apiPageRouteHandlerFactory};
 //# sourceMappingURL=api.mjs.map

package/dist/server/handlers/api.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"api.mjs","names":[],"sources":["../../../src/server/handlers/api.ts"],"sourcesContent":["import type { BaseServerSDK, PagesRouterRequest, WithApiAuthRequiredAppRoute, WithApiAuthRequiredPageRoute } from '../types';\nimport { NextRequest, NextResponse } from 'next/server';\nimport { toNextRequest } from '../utils';\n\nexport const apiAppRouteHandlerFactory =\n\t(sdk: BaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>): WithApiAuthRequiredAppRoute =>\n\t(apiRoute) =>\n\tasync (req: NextRequest | Request, params): Promise<NextResponse> => {\n\t\tconst nextReq = req instanceof Request ? toNextRequest(req) : req;\n\n\t\tconst session = await sdk.getSession(nextReq);\n\n\t\tif (!session) {\n\t\t\treturn NextResponse.json(\n\t\t\t\t{\n\t\t\t\t\terror: 'not_authenticated',\n\t\t\t\t\tdescription: 'The user does not have an active session or is not authenticated',\n\t\t\t\t},\n\t\t\t\t{ status: 401 },\n\t\t\t);\n\t\t}\n\n\t\tconst apiRes: NextResponse | Response = await apiRoute(nextReq, params);\n\t\tconst nextApiRes: NextResponse = apiRes instanceof NextResponse ? apiRes : new NextResponse(apiRes.body, apiRes);\n\n\t\treturn nextApiRes;\n\t};\n\nexport const apiPageRouteHandlerFactory =\n\t(sdk: BaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>): WithApiAuthRequiredPageRoute =>\n\t(apiRoute) =>\n\tasync (req, res) => {\n\t\tconst session = await sdk.getSession(req);\n\n\t\tif (!session) {\n\t\t\treturn res.status(401).json({\n\t\t\t\terror: 'not_authenticated',\n\t\t\t\tdescription: 'The user does not have an active session or is not authenticated',\n\t\t\t});\n\t\t}\n\n\t\tawait apiRoute(req, res);\n\t};\n"],"mappings":"wFAIA,IAAa,EACX,GACA,GACD,MAAO,EAA4B,IAAkC,CACpE,IAAM,EAAU,aAAe,QAAU,EAAc,CAAG,EAAI,EAI9D,GAAI,CAAC,MAFiB,EAAI,WAAW,CAAO,EAG3C,OAAO,EAAa,KACnB,CACC,MAAO,oBACP,YAAa,kEACd,EACA,CAAE,OAAQ,GAAI,CACf,EAGD,IAAM,EAAkC,MAAM,EAAS,EAAS,CAAM,EAGtE,OAFiC,aAAkB,EAAe,EAAS,IAAI,EAAa,EAAO,KAAM,CAAM,CAGhH,EAEY,EACX,GACA,GACD,MAAO,EAAK,IAAQ,CAGnB,GAAI,CAAC,MAFiB,EAAI,WAAW,CAAG,EAGvC,OAAO,EAAI,OAAO,GAAG,CAAC,CAAC,KAAK,CAC3B,MAAO,oBACP,YAAa,kEACd,CAAC,EAGF,MAAM,EAAS,EAAK,CAAG,CACxB"}
+{"version":3,"file":"api.mjs","names":[],"sources":["../../../src/server/handlers/api.ts"],"sourcesContent":["import type { BaseServerSDK, PagesRouterRequest, WithApiAuthRequiredAppRoute, WithApiAuthRequiredPageRoute } from '../types';\nimport { NextRequest, NextResponse } from 'next/server';\nimport { toNextRequest } from '../utils';\n\nexport const apiAppRouteHandlerFactory =\n\t(sdk: BaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>): WithApiAuthRequiredAppRoute =>\n\t(apiRoute) =>\n\tasync (req: NextRequest | Request, params): Promise<NextResponse> => {\n\t\tconst nextReq = req instanceof Request ? toNextRequest(req) : req;\n\n\t\tconst session = await sdk.getSession(nextReq);\n\n\t\tif (!session) {\n\t\t\treturn NextResponse.json(\n\t\t\t\t{\n\t\t\t\t\terror: 'not_authenticated',\n\t\t\t\t\tdescription: 'The user does not have an active session or is not authenticated',\n\t\t\t\t},\n\t\t\t\t{ status: 401 },\n\t\t\t);\n\t\t}\n\n\t\tconst apiRes: NextResponse | Response = await apiRoute(nextReq, params);\n\t\tconst nextApiRes: NextResponse = apiRes instanceof NextResponse ? apiRes : new NextResponse(apiRes.body, apiRes);\n\n\t\treturn nextApiRes;\n\t};\n\nexport const apiPageRouteHandlerFactory =\n\t(sdk: BaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>): WithApiAuthRequiredPageRoute =>\n\t(apiRoute) =>\n\tasync (req, res) => {\n\t\t// NOTE: Pages Router: no cookies() store to save a refreshed session in, so read it as stored\n\t\tconst session = await sdk.getSession(req, { autoRefresh: false });\n\n\t\tif (!session) {\n\t\t\treturn res.status(401).json({\n\t\t\t\terror: 'not_authenticated',\n\t\t\t\tdescription: 'The user does not have an active session or is not authenticated',\n\t\t\t});\n\t\t}\n\n\t\tawait apiRoute(req, res);\n\t};\n"],"mappings":"wFAIA,IAAa,EACX,GACA,GACD,MAAO,EAA4B,IAAkC,CACpE,IAAM,EAAU,aAAe,QAAU,EAAc,CAAG,EAAI,EAI9D,GAAI,CAAC,MAFiB,EAAI,WAAW,CAAO,EAG3C,OAAO,EAAa,KACnB,CACC,MAAO,oBACP,YAAa,kEACd,EACA,CAAE,OAAQ,GAAI,CACf,EAGD,IAAM,EAAkC,MAAM,EAAS,EAAS,CAAM,EAGtE,OAFiC,aAAkB,EAAe,EAAS,IAAI,EAAa,EAAO,KAAM,CAAM,CAGhH,EAEY,EACX,GACA,GACD,MAAO,EAAK,IAAQ,CAInB,GAAI,CAAC,MAFiB,EAAI,WAAW,EAAK,CAAE,YAAa,EAAM,CAAC,EAG/D,OAAO,EAAI,OAAO,GAAG,CAAC,CAAC,KAAK,CAC3B,MAAO,oBACP,YAAa,kEACd,CAAC,EAGF,MAAM,EAAS,EAAK,CAAG,CACxB"}

package/dist/server/handlers/route.cjs

@@ -1,2 +1,2 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=function(e,t,n){let r=Promise.resolve();function i(e){let t=new Event(`vite:preloadError`,{cancelable:!0});if(t.payload=e,window.dispatchEvent(t),!t.defaultPrevented)throw e}return r.then(t=>{for(let e of t||[])e.status===`rejected`&&i(e.reason);return e().catch(i)})},t=t=>(n,r={})=>async i=>{let a=await t.getSession();if(!a){let n=typeof r.returnTo==`function`?await r.returnTo(i):r.returnTo,{redirect:a}=await e(async()=>{let{redirect:e}=await import(`next/navigation`);return{redirect:e}},void 0);a(`${t.options.loginUri}${n?`?returnTo=${encodeURIComponent(n)}`:``}`)}return n({...i,session:a})},n=e=>({getServerSideProps:t,returnTo:n}={})=>async r=>{let i=await e.getSession();if(!i)return{redirect:{destination:`${e.options.loginUri}?returnTo=${encodeURIComponent(n||r.resolvedUrl)}`,permanent:!1}};let a={props:{}};if(t&&(a=await t(r)),a.props instanceof Promise){let e=await a.props;return{...a,props:{session:i,...e}}}return{...a,props:{session:i,...a.props}}};exports.appRouteHandlerFactory=t,exports.pageRouteHandlerFactory=n;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@strivacity/sdk-core/utils");var t=function(e,t,n){let r=Promise.resolve();function i(e){let t=new Event(`vite:preloadError`,{cancelable:!0});if(t.payload=e,window.dispatchEvent(t),!t.defaultPrevented)throw e}return r.then(t=>{for(let e of t||[])e.status===`rejected`&&i(e.reason);return e().catch(i)})};function n(e,t){return`${e.options.authUrlPrefix}/refresh?returnTo=${encodeURIComponent(t)}`}var r=r=>(i,a={})=>async o=>{let s=await r.getSession(void 0,{autoRefresh:!1});if(s&&(0,e.isSessionExpired)(s,r.options.refreshSkew)){if(s.refresh_token&&r.options.autoRefresh!==!1){let e=typeof a.returnTo==`function`?await a.returnTo(o):a.returnTo,{redirect:i}=await t(async()=>{let{redirect:e}=await import(`next/navigation`);return{redirect:e}},void 0);i(n(r,e||r.options.postLoginRedirectUri))}s=null}if(!s){let e=typeof a.returnTo==`function`?await a.returnTo(o):a.returnTo,{redirect:n}=await t(async()=>{let{redirect:e}=await import(`next/navigation`);return{redirect:e}},void 0);n(`${r.options.loginUri}${e?`?returnTo=${encodeURIComponent(e)}`:``}`)}return i({...o,session:s})},i=t=>({getServerSideProps:r,returnTo:i}={})=>async a=>{let o=await t.getSession(a.req,{autoRefresh:!1});if(o&&(0,e.isSessionExpired)(o,t.options.refreshSkew))return{redirect:{destination:o.refresh_token&&t.options.autoRefresh!==!1?n(t,i||a.resolvedUrl):`${t.options.loginUri}?returnTo=${encodeURIComponent(i||a.resolvedUrl)}`,permanent:!1}};if(!o)return{redirect:{destination:`${t.options.loginUri}?returnTo=${encodeURIComponent(i||a.resolvedUrl)}`,permanent:!1}};let s={props:{}};if(r&&(s=await r(a)),s.props instanceof Promise){let e=await s.props;return{...s,props:{session:o,...e}}}return{...s,props:{session:o,...s.props}}};exports.appRouteHandlerFactory=r,exports.pageRouteHandlerFactory=i;
 //# sourceMappingURL=route.cjs.map

package/dist/server/handlers/route.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"route.cjs","names":[],"sources":["../../../src/server/handlers/route.ts"],"sourcesContent":["import type { NextRequest } from 'next/server';\nimport type {\n\tAppRouterPageRoute,\n\tAppRouterPageRouteOpts,\n\tBaseServerSDK,\n\tPagesRouterRequest,\n\tWithAuthGuardAppRouter,\n\tWithAuthGuardAppRouterOptions,\n\tWithAuthGuardPageRouter,\n} from '../types';\n\nexport const appRouteHandlerFactory =\n\t(sdk: BaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>): WithAuthGuardAppRouter =>\n\t<P extends AppRouterPageRouteOpts = AppRouterPageRouteOpts>(handler: AppRouterPageRoute<P>, opts: WithAuthGuardAppRouterOptions<P> = {}) =>\n\tasync (params: P) => {\n\t\tconst session = await sdk.getSession();\n\n\t\tif (!session) {\n\t\t\tconst returnTo = typeof opts.returnTo === 'function' ? await opts.returnTo(params) : opts.returnTo;\n\t\t\tconst { redirect } = await import('next/navigation');\n\n\t\t\tredirect(`${sdk.options.loginUri}${returnTo ? `?returnTo=${encodeURIComponent(returnTo)}` : ''}`);\n\t\t}\n\n\t\treturn handler({ ...params, session });\n\t};\n\nexport const pageRouteHandlerFactory =\n\t(sdk: BaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>): WithAuthGuardPageRouter =>\n\t({ getServerSideProps, returnTo } = {}) =>\n\tasync (ctx) => {\n\t\tconst session = await sdk.getSession();\n\n\t\tif (!session) {\n\t\t\treturn {\n\t\t\t\tredirect: {\n\t\t\t\t\tdestination: `${sdk.options.loginUri}?returnTo=${encodeURIComponent(returnTo || ctx.resolvedUrl)}`,\n\t\t\t\t\tpermanent: false,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// eslint-disable-next-line @typescript-eslint/no-explicit-any\n\t\tlet ret: any = { props: {} };\n\n\t\tif (getServerSideProps) {\n\t\t\tret = await getServerSideProps(ctx);\n\t\t}\n\n\t\tif (ret.props instanceof Promise) {\n\t\t\tconst props = await ret.props;\n\n\t\t\treturn {\n\t\t\t\t...ret,\n\t\t\t\tprops: {\n\t\t\t\t\tsession,\n\t\t\t\t\t...props,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\treturn { ...ret, props: { session, ...ret.props } };\n\t};\n"],"mappings":"sVAWa,EACX,IAC2D,EAAgC,EAAyC,CAAC,IACtI,KAAO,IAAc,CACpB,IAAM,EAAU,MAAM,EAAI,WAAW,EAErC,GAAI,CAAC,EAAS,CACb,IAAM,EAAW,OAAO,EAAK,UAAa,WAAa,MAAM,EAAK,SAAS,CAAM,EAAI,EAAK,SACpF,CAAE,YAAA,MAAA,EAAA,SAAA,CAAF,GAAA,CAAE,YAAa,MAAM,OAAO,+CAElC,EAAS,GAAG,EAAI,QAAQ,WAAW,EAAW,aAAa,mBAAmB,CAAQ,IAAM,IAAI,CACjG,CAEA,OAAO,EAAQ,CAAE,GAAG,EAAQ,SAAQ,CAAC,CACtC,EAEY,EACX,IACA,CAAE,qBAAoB,YAAa,CAAC,IACrC,KAAO,IAAQ,CACd,IAAM,EAAU,MAAM,EAAI,WAAW,EAErC,GAAI,CAAC,EACJ,MAAO,CACN,SAAU,CACT,YAAa,GAAG,EAAI,QAAQ,SAAS,YAAY,mBAAmB,GAAY,EAAI,WAAW,IAC/F,UAAW,EACZ,CACD,EAID,IAAI,EAAW,CAAE,MAAO,CAAC,CAAE,EAM3B,GAJI,IACH,EAAM,MAAM,EAAmB,CAAG,GAG/B,EAAI,iBAAiB,QAAS,CACjC,IAAM,EAAQ,MAAM,EAAI,MAExB,MAAO,CACN,GAAG,EACH,MAAO,CACN,UACA,GAAG,CACJ,CACD,CACD,CAEA,MAAO,CAAE,GAAG,EAAK,MAAO,CAAE,UAAS,GAAG,EAAI,KAAM,CAAE,CACnD"}
+{"version":3,"file":"route.cjs","names":[],"sources":["../../../src/server/handlers/route.ts"],"sourcesContent":["import type { NextRequest } from 'next/server';\nimport type {\n\tAppRouterPageRoute,\n\tAppRouterPageRouteOpts,\n\tBaseServerSDK,\n\tPagesRouterRequest,\n\tWithAuthGuardAppRouter,\n\tWithAuthGuardAppRouterOptions,\n\tWithAuthGuardPageRouter,\n} from '../types';\nimport { isSessionExpired } from '@strivacity/sdk-core/utils';\n\n/**\n * Builds the Server SDK refresh route URL for an expired session. Guards cannot refresh in place: server components cannot set\n * cookies, so the rotated session would be lost. The refresh route writes the cookie and then redirects back to `returnTo`.\n *\n * @param {BaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>} sdk - The server SDK.\n * @param {string} returnTo - Where to return after the refresh.\n * @returns {string} The refresh route URL.\n */\nfunction refreshUrl(sdk: BaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>, returnTo: string): string {\n\treturn `${sdk.options.authUrlPrefix}/refresh?returnTo=${encodeURIComponent(returnTo)}`;\n}\n\nexport const appRouteHandlerFactory =\n\t(sdk: BaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>): WithAuthGuardAppRouter =>\n\t<P extends AppRouterPageRouteOpts = AppRouterPageRouteOpts>(handler: AppRouterPageRoute<P>, opts: WithAuthGuardAppRouterOptions<P> = {}) =>\n\tasync (params: P) => {\n\t\t// NOTE: Server Components cannot set cookies, so never refresh here: an expired session goes through the refresh route\n\t\tlet session = await sdk.getSession(undefined, { autoRefresh: false });\n\n\t\tif (session && isSessionExpired(session, sdk.options.refreshSkew)) {\n\t\t\tif (session.refresh_token && sdk.options.autoRefresh !== false) {\n\t\t\t\tconst returnTo = typeof opts.returnTo === 'function' ? await opts.returnTo(params) : opts.returnTo;\n\t\t\t\tconst { redirect } = await import('next/navigation');\n\n\t\t\t\tredirect(refreshUrl(sdk, returnTo || sdk.options.postLoginRedirectUri));\n\t\t\t}\n\n\t\t\tsession = null;\n\t\t}\n\n\t\tif (!session) {\n\t\t\tconst returnTo = typeof opts.returnTo === 'function' ? await opts.returnTo(params) : opts.returnTo;\n\t\t\tconst { redirect } = await import('next/navigation');\n\n\t\t\tredirect(`${sdk.options.loginUri}${returnTo ? `?returnTo=${encodeURIComponent(returnTo)}` : ''}`);\n\t\t}\n\n\t\treturn handler({ ...params, session });\n\t};\n\nexport const pageRouteHandlerFactory =\n\t(sdk: BaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>): WithAuthGuardPageRouter =>\n\t({ getServerSideProps, returnTo } = {}) =>\n\tasync (ctx) => {\n\t\t// NOTE: Server Components cannot set cookies, so never refresh here: an expired session goes through the refresh route\n\t\tconst session = await sdk.getSession(ctx.req, { autoRefresh: false });\n\n\t\tif (session && isSessionExpired(session, sdk.options.refreshSkew)) {\n\t\t\treturn {\n\t\t\t\tredirect: {\n\t\t\t\t\tdestination:\n\t\t\t\t\t\tsession.refresh_token && sdk.options.autoRefresh !== false\n\t\t\t\t\t\t\t? refreshUrl(sdk, returnTo || ctx.resolvedUrl)\n\t\t\t\t\t\t\t: `${sdk.options.loginUri}?returnTo=${encodeURIComponent(returnTo || ctx.resolvedUrl)}`,\n\t\t\t\t\tpermanent: false,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tif (!session) {\n\t\t\treturn {\n\t\t\t\tredirect: {\n\t\t\t\t\tdestination: `${sdk.options.loginUri}?returnTo=${encodeURIComponent(returnTo || ctx.resolvedUrl)}`,\n\t\t\t\t\tpermanent: false,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// eslint-disable-next-line @typescript-eslint/no-explicit-any\n\t\tlet ret: any = { props: {} };\n\n\t\tif (getServerSideProps) {\n\t\t\tret = await getServerSideProps(ctx);\n\t\t}\n\n\t\tif (ret.props instanceof Promise) {\n\t\t\tconst props = await ret.props;\n\n\t\t\treturn {\n\t\t\t\t...ret,\n\t\t\t\tprops: {\n\t\t\t\t\tsession,\n\t\t\t\t\t...props,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\treturn { ...ret, props: { session, ...ret.props } };\n\t};\n"],"mappings":"kYAoBA,SAAS,EAAW,EAA4E,EAA0B,CACzH,MAAO,GAAG,EAAI,QAAQ,cAAc,oBAAoB,mBAAmB,CAAQ,GACpF,CAEA,IAAa,EACX,IAC2D,EAAgC,EAAyC,CAAC,IACtI,KAAO,IAAc,CAEpB,IAAI,EAAU,MAAM,EAAI,WAAW,IAAA,GAAW,CAAE,YAAa,EAAM,CAAC,EAEpE,GAAI,IAAA,EAAW,EAAA,iBAAA,CAAiB,EAAS,EAAI,QAAQ,WAAW,EAAG,CAClE,GAAI,EAAQ,eAAiB,EAAI,QAAQ,cAAgB,GAAO,CAC/D,IAAM,EAAW,OAAO,EAAK,UAAa,WAAa,MAAM,EAAK,SAAS,CAAM,EAAI,EAAK,SACpF,CAAE,YAAA,MAAA,EAAA,SAAA,CAAF,GAAA,CAAE,YAAa,MAAM,OAAO,+CAElC,EAAS,EAAW,EAAK,GAAY,EAAI,QAAQ,oBAAoB,CAAC,CACvE,CAEA,EAAU,IACX,CAEA,GAAI,CAAC,EAAS,CACb,IAAM,EAAW,OAAO,EAAK,UAAa,WAAa,MAAM,EAAK,SAAS,CAAM,EAAI,EAAK,SACpF,CAAE,YAAA,MAAA,EAAA,SAAA,CAAF,GAAA,CAAE,YAAa,MAAM,OAAO,+CAElC,EAAS,GAAG,EAAI,QAAQ,WAAW,EAAW,aAAa,mBAAmB,CAAQ,IAAM,IAAI,CACjG,CAEA,OAAO,EAAQ,CAAE,GAAG,EAAQ,SAAQ,CAAC,CACtC,EAEY,EACX,IACA,CAAE,qBAAoB,YAAa,CAAC,IACrC,KAAO,IAAQ,CAEd,IAAM,EAAU,MAAM,EAAI,WAAW,EAAI,IAAK,CAAE,YAAa,EAAM,CAAC,EAEpE,GAAI,IAAA,EAAW,EAAA,iBAAA,CAAiB,EAAS,EAAI,QAAQ,WAAW,EAC/D,MAAO,CACN,SAAU,CACT,YACC,EAAQ,eAAiB,EAAI,QAAQ,cAAgB,GAClD,EAAW,EAAK,GAAY,EAAI,WAAW,EAC3C,GAAG,EAAI,QAAQ,SAAS,YAAY,mBAAmB,GAAY,EAAI,WAAW,IACtF,UAAW,EACZ,CACD,EAGD,GAAI,CAAC,EACJ,MAAO,CACN,SAAU,CACT,YAAa,GAAG,EAAI,QAAQ,SAAS,YAAY,mBAAmB,GAAY,EAAI,WAAW,IAC/F,UAAW,EACZ,CACD,EAID,IAAI,EAAW,CAAE,MAAO,CAAC,CAAE,EAM3B,GAJI,IACH,EAAM,MAAM,EAAmB,CAAG,GAG/B,EAAI,iBAAiB,QAAS,CACjC,IAAM,EAAQ,MAAM,EAAI,MAExB,MAAO,CACN,GAAG,EACH,MAAO,CACN,UACA,GAAG,CACJ,CACD,CACD,CAEA,MAAO,CAAE,GAAG,EAAK,MAAO,CAAE,UAAS,GAAG,EAAI,KAAM,CAAE,CACnD"}

package/dist/server/handlers/route.mjs

@@ -1,2 +1,2 @@
-var e=function(e){return`/`+e},t={},n=function(n,r,i){let a=Promise.resolve();if(r&&r.length>0){let n=document.getElementsByTagName(`link`),o=document.querySelector(`meta[property=csp-nonce]`),s=o?.nonce||o?.getAttribute(`nonce`);function c(e){return Promise.all(e.map(e=>Promise.resolve(e).then(e=>({status:`fulfilled`,value:e}),e=>({status:`rejected`,reason:e}))))}function l(e){return import.meta.resolve?import.meta.resolve(e):new URL(e,import.meta.url).href}a=c(r.map(r=>{if(r=e(r,i),r=l(r),r in t)return;t[r]=!0;let a=r.endsWith(`.css`);for(let e=n.length-1;e>=0;e--){let t=n[e];if(t.href===r&&(!a||t.rel===`stylesheet`))return}let o=document.createElement(`link`);if(o.rel=a?`stylesheet`:`modulepreload`,a||(o.as=`script`),o.crossOrigin=``,o.href=r,s&&o.setAttribute(`nonce`,s),document.head.appendChild(o),a)return new Promise((e,t)=>{o.addEventListener(`load`,e),o.addEventListener(`error`,()=>t(Error(`Unable to preload CSS for ${r}`)))})}))}function o(e){let t=new Event(`vite:preloadError`,{cancelable:!0});if(t.payload=e,window.dispatchEvent(t),!t.defaultPrevented)throw e}return a.then(e=>{for(let t of e||[])t.status===`rejected`&&o(t.reason);return n().catch(o)})},r=e=>(t,r={})=>async i=>{let a=await e.getSession();if(!a){let t=typeof r.returnTo==`function`?await r.returnTo(i):r.returnTo,{redirect:a}=await n(async()=>{let{redirect:e}=await import(`next/navigation`);return{redirect:e}},[]);a(`${e.options.loginUri}${t?`?returnTo=${encodeURIComponent(t)}`:``}`)}return t({...i,session:a})},i=e=>({getServerSideProps:t,returnTo:n}={})=>async r=>{let i=await e.getSession();if(!i)return{redirect:{destination:`${e.options.loginUri}?returnTo=${encodeURIComponent(n||r.resolvedUrl)}`,permanent:!1}};let a={props:{}};if(t&&(a=await t(r)),a.props instanceof Promise){let e=await a.props;return{...a,props:{session:i,...e}}}return{...a,props:{session:i,...a.props}}};export{r as appRouteHandlerFactory,i as pageRouteHandlerFactory};
+import{isSessionExpired as e}from"@strivacity/sdk-core/utils";var t=`modulepreload`,n=function(e){return`/`+e},r={},i=function(e,i,a){let o=Promise.resolve();if(i&&i.length>0){let e=document.getElementsByTagName(`link`),s=document.querySelector(`meta[property=csp-nonce]`),c=s?.nonce||s?.getAttribute(`nonce`);function l(e){return Promise.all(e.map(e=>Promise.resolve(e).then(e=>({status:`fulfilled`,value:e}),e=>({status:`rejected`,reason:e}))))}function u(e){return import.meta.resolve?import.meta.resolve(e):new URL(e,import.meta.url).href}o=l(i.map(i=>{if(i=n(i,a),i=u(i),i in r)return;r[i]=!0;let o=i.endsWith(`.css`);for(let t=e.length-1;t>=0;t--){let n=e[t];if(n.href===i&&(!o||n.rel===`stylesheet`))return}let s=document.createElement(`link`);if(s.rel=o?`stylesheet`:t,o||(s.as=`script`),s.crossOrigin=``,s.href=i,c&&s.setAttribute(`nonce`,c),document.head.appendChild(s),o)return new Promise((e,t)=>{s.addEventListener(`load`,e),s.addEventListener(`error`,()=>t(Error(`Unable to preload CSS for ${i}`)))})}))}function s(e){let t=new Event(`vite:preloadError`,{cancelable:!0});if(t.payload=e,window.dispatchEvent(t),!t.defaultPrevented)throw e}return o.then(t=>{for(let e of t||[])e.status===`rejected`&&s(e.reason);return e().catch(s)})};function a(e,t){return`${e.options.authUrlPrefix}/refresh?returnTo=${encodeURIComponent(t)}`}var o=t=>(n,r={})=>async o=>{let s=await t.getSession(void 0,{autoRefresh:!1});if(s&&e(s,t.options.refreshSkew)){if(s.refresh_token&&t.options.autoRefresh!==!1){let e=typeof r.returnTo==`function`?await r.returnTo(o):r.returnTo,{redirect:n}=await i(async()=>{let{redirect:e}=await import(`next/navigation`);return{redirect:e}},[]);n(a(t,e||t.options.postLoginRedirectUri))}s=null}if(!s){let e=typeof r.returnTo==`function`?await r.returnTo(o):r.returnTo,{redirect:n}=await i(async()=>{let{redirect:e}=await import(`next/navigation`);return{redirect:e}},[]);n(`${t.options.loginUri}${e?`?returnTo=${encodeURIComponent(e)}`:``}`)}return n({...o,session:s})},s=t=>({getServerSideProps:n,returnTo:r}={})=>async i=>{let o=await t.getSession(i.req,{autoRefresh:!1});if(o&&e(o,t.options.refreshSkew))return{redirect:{destination:o.refresh_token&&t.options.autoRefresh!==!1?a(t,r||i.resolvedUrl):`${t.options.loginUri}?returnTo=${encodeURIComponent(r||i.resolvedUrl)}`,permanent:!1}};if(!o)return{redirect:{destination:`${t.options.loginUri}?returnTo=${encodeURIComponent(r||i.resolvedUrl)}`,permanent:!1}};let s={props:{}};if(n&&(s=await n(i)),s.props instanceof Promise){let e=await s.props;return{...s,props:{session:o,...e}}}return{...s,props:{session:o,...s.props}}};export{o as appRouteHandlerFactory,s as pageRouteHandlerFactory};
 //# sourceMappingURL=route.mjs.map

package/dist/server/handlers/route.mjs.map

@@ -1 +1 @@
-{"version":3,"mappings":"6pCAWa,EACX,IAC2D,EAAgC,EAAyC,CAAC,IACtI,KAAO,IAAc,CACpB,IAAM,EAAU,MAAM,EAAI,WAAW,EAErC,GAAI,CAAC,EAAS,CACb,IAAM,EAAW,OAAO,EAAK,UAAa,WAAa,MAAM,EAAK,SAAS,CAAM,EAAI,EAAK,SACpF,CAAE,8BAAF,IAAE,YAAa,MAAM,OAAO,2CAElC,EAAS,GAAG,EAAI,QAAQ,WAAW,EAAW,aAAa,mBAAmB,CAAQ,IAAM,IAAI,CACjG,CAEA,OAAO,EAAQ,CAAE,GAAG,EAAQ,SAAQ,CAAC,CACtC,EAEY,EACX,IACA,CAAE,qBAAoB,YAAa,CAAC,IACrC,KAAO,IAAQ,CACd,IAAM,EAAU,MAAM,EAAI,WAAW,EAErC,GAAI,CAAC,EACJ,MAAO,CACN,SAAU,CACT,YAAa,GAAG,EAAI,QAAQ,SAAS,YAAY,mBAAmB,GAAY,EAAI,WAAW,IAC/F,UAAW,EACZ,CACD,EAID,IAAI,EAAW,CAAE,MAAO,CAAC,CAAE,EAM3B,GAJI,IACH,EAAM,MAAM,EAAmB,CAAG,GAG/B,EAAI,iBAAiB,QAAS,CACjC,IAAM,EAAQ,MAAM,EAAI,MAExB,MAAO,CACN,GAAG,EACH,MAAO,CACN,UACA,GAAG,CACJ,CACD,CACD,CAEA,MAAO,CAAE,GAAG,EAAK,MAAO,CAAE,UAAS,GAAG,EAAI,KAAM,CAAE,CACnD","names":[],"ignoreList":[],"sources":["../../../src/server/handlers/route.ts"],"sourcesContent":["import type { NextRequest } from 'next/server';\nimport type {\n\tAppRouterPageRoute,\n\tAppRouterPageRouteOpts,\n\tBaseServerSDK,\n\tPagesRouterRequest,\n\tWithAuthGuardAppRouter,\n\tWithAuthGuardAppRouterOptions,\n\tWithAuthGuardPageRouter,\n} from '../types';\n\nexport const appRouteHandlerFactory =\n\t(sdk: BaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>): WithAuthGuardAppRouter =>\n\t<P extends AppRouterPageRouteOpts = AppRouterPageRouteOpts>(handler: AppRouterPageRoute<P>, opts: WithAuthGuardAppRouterOptions<P> = {}) =>\n\tasync (params: P) => {\n\t\tconst session = await sdk.getSession();\n\n\t\tif (!session) {\n\t\t\tconst returnTo = typeof opts.returnTo === 'function' ? await opts.returnTo(params) : opts.returnTo;\n\t\t\tconst { redirect } = await import('next/navigation');\n\n\t\t\tredirect(`${sdk.options.loginUri}${returnTo ? `?returnTo=${encodeURIComponent(returnTo)}` : ''}`);\n\t\t}\n\n\t\treturn handler({ ...params, session });\n\t};\n\nexport const pageRouteHandlerFactory =\n\t(sdk: BaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>): WithAuthGuardPageRouter =>\n\t({ getServerSideProps, returnTo } = {}) =>\n\tasync (ctx) => {\n\t\tconst session = await sdk.getSession();\n\n\t\tif (!session) {\n\t\t\treturn {\n\t\t\t\tredirect: {\n\t\t\t\t\tdestination: `${sdk.options.loginUri}?returnTo=${encodeURIComponent(returnTo || ctx.resolvedUrl)}`,\n\t\t\t\t\tpermanent: false,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// eslint-disable-next-line @typescript-eslint/no-explicit-any\n\t\tlet ret: any = { props: {} };\n\n\t\tif (getServerSideProps) {\n\t\t\tret = await getServerSideProps(ctx);\n\t\t}\n\n\t\tif (ret.props instanceof Promise) {\n\t\t\tconst props = await ret.props;\n\n\t\t\treturn {\n\t\t\t\t...ret,\n\t\t\t\tprops: {\n\t\t\t\t\tsession,\n\t\t\t\t\t...props,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\treturn { ...ret, props: { session, ...ret.props } };\n\t};\n"],"file":"route.mjs"}
+{"version":3,"mappings":"+tCAoBA,SAAS,EAAW,EAA4E,EAA0B,CACzH,MAAO,GAAG,EAAI,QAAQ,cAAc,oBAAoB,mBAAmB,CAAQ,GACpF,CAEA,IAAa,EACX,IAC2D,EAAgC,EAAyC,CAAC,IACtI,KAAO,IAAc,CAEpB,IAAI,EAAU,MAAM,EAAI,WAAW,OAAW,CAAE,YAAa,EAAM,CAAC,EAEpE,GAAI,GAAW,EAAiB,EAAS,EAAI,QAAQ,WAAW,EAAG,CAClE,GAAI,EAAQ,eAAiB,EAAI,QAAQ,cAAgB,GAAO,CAC/D,IAAM,EAAW,OAAO,EAAK,UAAa,WAAa,MAAM,EAAK,SAAS,CAAM,EAAI,EAAK,SACpF,CAAE,8BAAF,IAAE,YAAa,MAAM,OAAO,2CAElC,EAAS,EAAW,EAAK,GAAY,EAAI,QAAQ,oBAAoB,CAAC,CACvE,CAEA,EAAU,IACX,CAEA,GAAI,CAAC,EAAS,CACb,IAAM,EAAW,OAAO,EAAK,UAAa,WAAa,MAAM,EAAK,SAAS,CAAM,EAAI,EAAK,SACpF,CAAE,8BAAF,IAAE,YAAa,MAAM,OAAO,2CAElC,EAAS,GAAG,EAAI,QAAQ,WAAW,EAAW,aAAa,mBAAmB,CAAQ,IAAM,IAAI,CACjG,CAEA,OAAO,EAAQ,CAAE,GAAG,EAAQ,SAAQ,CAAC,CACtC,EAEY,EACX,IACA,CAAE,qBAAoB,YAAa,CAAC,IACrC,KAAO,IAAQ,CAEd,IAAM,EAAU,MAAM,EAAI,WAAW,EAAI,IAAK,CAAE,YAAa,EAAM,CAAC,EAEpE,GAAI,GAAW,EAAiB,EAAS,EAAI,QAAQ,WAAW,EAC/D,MAAO,CACN,SAAU,CACT,YACC,EAAQ,eAAiB,EAAI,QAAQ,cAAgB,GAClD,EAAW,EAAK,GAAY,EAAI,WAAW,EAC3C,GAAG,EAAI,QAAQ,SAAS,YAAY,mBAAmB,GAAY,EAAI,WAAW,IACtF,UAAW,EACZ,CACD,EAGD,GAAI,CAAC,EACJ,MAAO,CACN,SAAU,CACT,YAAa,GAAG,EAAI,QAAQ,SAAS,YAAY,mBAAmB,GAAY,EAAI,WAAW,IAC/F,UAAW,EACZ,CACD,EAID,IAAI,EAAW,CAAE,MAAO,CAAC,CAAE,EAM3B,GAJI,IACH,EAAM,MAAM,EAAmB,CAAG,GAG/B,EAAI,iBAAiB,QAAS,CACjC,IAAM,EAAQ,MAAM,EAAI,MAExB,MAAO,CACN,GAAG,EACH,MAAO,CACN,UACA,GAAG,CACJ,CACD,CACD,CAEA,MAAO,CAAE,GAAG,EAAK,MAAO,CAAE,UAAS,GAAG,EAAI,KAAM,CAAE,CACnD","names":[],"ignoreList":[],"sources":["../../../src/server/handlers/route.ts"],"sourcesContent":["import type { NextRequest } from 'next/server';\nimport type {\n\tAppRouterPageRoute,\n\tAppRouterPageRouteOpts,\n\tBaseServerSDK,\n\tPagesRouterRequest,\n\tWithAuthGuardAppRouter,\n\tWithAuthGuardAppRouterOptions,\n\tWithAuthGuardPageRouter,\n} from '../types';\nimport { isSessionExpired } from '@strivacity/sdk-core/utils';\n\n/**\n * Builds the Server SDK refresh route URL for an expired session. Guards cannot refresh in place: server components cannot set\n * cookies, so the rotated session would be lost. The refresh route writes the cookie and then redirects back to `returnTo`.\n *\n * @param {BaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>} sdk - The server SDK.\n * @param {string} returnTo - Where to return after the refresh.\n * @returns {string} The refresh route URL.\n */\nfunction refreshUrl(sdk: BaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>, returnTo: string): string {\n\treturn `${sdk.options.authUrlPrefix}/refresh?returnTo=${encodeURIComponent(returnTo)}`;\n}\n\nexport const appRouteHandlerFactory =\n\t(sdk: BaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>): WithAuthGuardAppRouter =>\n\t<P extends AppRouterPageRouteOpts = AppRouterPageRouteOpts>(handler: AppRouterPageRoute<P>, opts: WithAuthGuardAppRouterOptions<P> = {}) =>\n\tasync (params: P) => {\n\t\t// NOTE: Server Components cannot set cookies, so never refresh here: an expired session goes through the refresh route\n\t\tlet session = await sdk.getSession(undefined, { autoRefresh: false });\n\n\t\tif (session && isSessionExpired(session, sdk.options.refreshSkew)) {\n\t\t\tif (session.refresh_token && sdk.options.autoRefresh !== false) {\n\t\t\t\tconst returnTo = typeof opts.returnTo === 'function' ? await opts.returnTo(params) : opts.returnTo;\n\t\t\t\tconst { redirect } = await import('next/navigation');\n\n\t\t\t\tredirect(refreshUrl(sdk, returnTo || sdk.options.postLoginRedirectUri));\n\t\t\t}\n\n\t\t\tsession = null;\n\t\t}\n\n\t\tif (!session) {\n\t\t\tconst returnTo = typeof opts.returnTo === 'function' ? await opts.returnTo(params) : opts.returnTo;\n\t\t\tconst { redirect } = await import('next/navigation');\n\n\t\t\tredirect(`${sdk.options.loginUri}${returnTo ? `?returnTo=${encodeURIComponent(returnTo)}` : ''}`);\n\t\t}\n\n\t\treturn handler({ ...params, session });\n\t};\n\nexport const pageRouteHandlerFactory =\n\t(sdk: BaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>): WithAuthGuardPageRouter =>\n\t({ getServerSideProps, returnTo } = {}) =>\n\tasync (ctx) => {\n\t\t// NOTE: Server Components cannot set cookies, so never refresh here: an expired session goes through the refresh route\n\t\tconst session = await sdk.getSession(ctx.req, { autoRefresh: false });\n\n\t\tif (session && isSessionExpired(session, sdk.options.refreshSkew)) {\n\t\t\treturn {\n\t\t\t\tredirect: {\n\t\t\t\t\tdestination:\n\t\t\t\t\t\tsession.refresh_token && sdk.options.autoRefresh !== false\n\t\t\t\t\t\t\t? refreshUrl(sdk, returnTo || ctx.resolvedUrl)\n\t\t\t\t\t\t\t: `${sdk.options.loginUri}?returnTo=${encodeURIComponent(returnTo || ctx.resolvedUrl)}`,\n\t\t\t\t\tpermanent: false,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tif (!session) {\n\t\t\treturn {\n\t\t\t\tredirect: {\n\t\t\t\t\tdestination: `${sdk.options.loginUri}?returnTo=${encodeURIComponent(returnTo || ctx.resolvedUrl)}`,\n\t\t\t\t\tpermanent: false,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// eslint-disable-next-line @typescript-eslint/no-explicit-any\n\t\tlet ret: any = { props: {} };\n\n\t\tif (getServerSideProps) {\n\t\t\tret = await getServerSideProps(ctx);\n\t\t}\n\n\t\tif (ret.props instanceof Promise) {\n\t\t\tconst props = await ret.props;\n\n\t\t\treturn {\n\t\t\t\t...ret,\n\t\t\t\tprops: {\n\t\t\t\t\tsession,\n\t\t\t\t\t...props,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\treturn { ...ret, props: { session, ...ret.props } };\n\t};\n"],"file":"route.mjs"}

package/dist/server/sdk.cjs

@@ -1,2 +1,2 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./storages.cjs"),t=require("./handlers/api.cjs"),n=require("./handlers/route.cjs");let r=require("@strivacity/sdk-core/utils/errors"),i=require("next/server"),a=require("@strivacity/sdk-core/server");function o(o){if(!o.storage){if(!o.secret)throw new r.ConfigurationError(`Secret is required for encrypted cookie storage`);o.cookieMaxAge??=2592e3,o.storage=e.createEncryptedCookieStorage(o.secret,{defaultCookieOptions:{maxAge:o.cookieMaxAge}})}let s=(0,a.createBaseServerSDK)({toRequest:e=>e,redirect:(e,t)=>i.NextResponse.redirect(e,t)},o);function c(e){return(n,r)=>n instanceof Request?t.apiAppRouteHandlerFactory(s)(e)(n,r??{}):t.apiPageRouteHandlerFactory(s)(e)(n,r)}function l(e,t){return typeof e==`function`?n.appRouteHandlerFactory(s)(e,t):n.pageRouteHandlerFactory(s)(e)}return{get options(){return s.options},withAuthGuard:l,withApiAuthRequired:c,getSession:e=>s.getSession(e),updateSession:(e,t)=>s.updateSession(e,t),refreshSession:e=>s.refreshSession(e),revokeSession:e=>s.revokeSession(e),getEntrySession:e=>s.getEntrySession(e),completeLogin:(e,t)=>s.completeLogin(e,t),logout:(e,t)=>s.logout(e,t),handleLogin:e=>s.handleLogin(e),handleRegister:e=>s.handleRegister(e),handleCallback:e=>s.handleCallback(e),handleRefresh:e=>s.handleRefresh(e),handleRevoke:e=>s.handleRevoke(e),handleEntry:e=>s.handleEntry(e),handleLogout:e=>s.handleLogout(e),handleBackChannelLogout:e=>s.handleBackChannelLogout(e),handler:async e=>await s.handler(e)??new i.NextResponse(`Not Found`,{status:404})}}exports.createServerSDK=o;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./storages.cjs"),t=require("./handlers/api.cjs"),n=require("./handlers/route.cjs");let r=require("@strivacity/sdk-core/utils/errors"),i=require("next/server"),a=require("@strivacity/sdk-core/server");function o(o){if(!o.storage){if(!o.secret)throw new r.ConfigurationError(`Secret is required for encrypted cookie storage`);o.cookieMaxAge??=2592e3,o.storage=e.createEncryptedCookieStorage(o.secret,{defaultCookieOptions:{maxAge:o.cookieMaxAge}})}let s=(0,a.createBaseServerSDK)({toRequest:e=>e,redirect:(e,t)=>i.NextResponse.redirect(e,t)},o);function c(e){return(n,r)=>n instanceof Request?t.apiAppRouteHandlerFactory(s)(e)(n,r??{}):t.apiPageRouteHandlerFactory(s)(e)(n,r)}function l(e,t){return typeof e==`function`?n.appRouteHandlerFactory(s)(e,t):n.pageRouteHandlerFactory(s)(e)}return{get options(){return s.options},withAuthGuard:l,withApiAuthRequired:c,getSession:(e,t)=>s.getSession(e,e instanceof Request?t:{autoRefresh:!1}),updateSession:(e,t)=>s.updateSession(e,t),refreshSession:e=>s.refreshSession(e),revokeSession:e=>s.revokeSession(e),getEntrySession:e=>s.getEntrySession(e),completeLogin:(e,t)=>s.completeLogin(e,t),logout:(e,t)=>s.logout(e,t),handleLogin:e=>s.handleLogin(e),handleRegister:e=>s.handleRegister(e),handleCallback:e=>s.handleCallback(e),handleRefresh:e=>s.handleRefresh(e),handleRevoke:e=>s.handleRevoke(e),handleEntry:e=>s.handleEntry(e),handleLogout:e=>s.handleLogout(e),handleBackChannelLogout:e=>s.handleBackChannelLogout(e),handler:async e=>await s.handler(e)??new i.NextResponse(`Not Found`,{status:404})}}exports.createServerSDK=o;
 //# sourceMappingURL=sdk.cjs.map

package/dist/server/sdk.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"sdk.cjs","names":[],"sources":["../../src/server/sdk.ts"],"sourcesContent":["import type { NextApiHandler, NextApiRequest, NextApiResponse } from 'next';\nimport type { ParsedUrlQuery } from 'node:querystring';\nimport type {\n\tNextServerSDK,\n\tNextServerSDKInitConfig,\n\tWithAuthGuardAppRouterOptions,\n\tWithAuthGuardPageRouterOptions,\n\tAppRouterPageRoute,\n\tAppRouterPageRouteOpts,\n\tPageRoute,\n\tAppRouteHandlerFn,\n\tAppRouteHandlerFnContext,\n\tPagesRouterRequest,\n} from './types';\nimport { NextResponse, type NextRequest } from 'next/server';\nimport { createBaseServerSDK } from '@strivacity/sdk-core/server';\nimport { ConfigurationError } from '@strivacity/sdk-core/utils/errors';\nimport { createEncryptedCookieStorage } from './storages';\nimport { apiAppRouteHandlerFactory, apiPageRouteHandlerFactory } from './handlers/api';\nimport { appRouteHandlerFactory, pageRouteHandlerFactory } from './handlers/route';\n\n/**\n * Creates a Next.js server SDK instance with the provided configuration.\n *\n * @param {NextServerSDKInitConfig} initConfig - The initialization configuration for the SDK.\n * @returns {NextServerSDK} The initialized Next.js server SDK instance.\n */\nexport function createServerSDK(initConfig: NextServerSDKInitConfig): NextServerSDK {\n\tif (!initConfig.storage) {\n\t\tif (!initConfig.secret) {\n\t\t\tthrow new ConfigurationError('Secret is required for encrypted cookie storage');\n\t\t}\n\n\t\tinitConfig.cookieMaxAge ??= 30 * 24 * 60 * 60;\n\t\tinitConfig.storage = createEncryptedCookieStorage(initConfig.secret, { defaultCookieOptions: { maxAge: initConfig.cookieMaxAge } });\n\t}\n\n\tconst base = createBaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>(\n\t\t{\n\t\t\ttoRequest: (req) => req as Request,\n\t\t\tredirect: (url, status) => NextResponse.redirect(url, status),\n\t\t},\n\t\tinitConfig,\n\t);\n\n\tfunction withApiAuthRequired(apiRoute: AppRouteHandlerFn): AppRouteHandlerFn;\n\tfunction withApiAuthRequired(apiRoute: NextApiHandler): NextApiHandler;\n\tfunction withApiAuthRequired(apiRoute: AppRouteHandlerFn | NextApiHandler): AppRouteHandlerFn | NextApiHandler {\n\t\treturn (req: NextRequest | Request | NextApiRequest, resOrCtx?: AppRouteHandlerFnContext | NextApiResponse) => {\n\t\t\tif (req instanceof Request) {\n\t\t\t\tconst appRouteHandler = apiAppRouteHandlerFactory(base);\n\t\t\t\tconst wrappedAppRoute = appRouteHandler(apiRoute as AppRouteHandlerFn);\n\t\t\t\treturn wrappedAppRoute(req, (resOrCtx ?? {}) as AppRouteHandlerFnContext);\n\t\t\t}\n\n\t\t\tconst pageRouteHandler = apiPageRouteHandlerFactory(base);\n\t\t\tconst wrappedPageRoute = pageRouteHandler(apiRoute as NextApiHandler);\n\t\t\treturn wrappedPageRoute(req, resOrCtx as NextApiResponse);\n\t\t};\n\t}\n\n\tfunction withAuthGuard(): PageRoute<Record<string, unknown>, ParsedUrlQuery>;\n\tfunction withAuthGuard<P extends Record<string, unknown> = Record<string, unknown>, Q extends ParsedUrlQuery = ParsedUrlQuery>(\n\t\topts: WithAuthGuardPageRouterOptions<P, Q>,\n\t): PageRoute<P, Q>;\n\tfunction withAuthGuard<P extends AppRouterPageRouteOpts = AppRouterPageRouteOpts>(\n\t\tfn: AppRouterPageRoute<P>,\n\t\topts?: WithAuthGuardAppRouterOptions<P>,\n\t): AppRouterPageRoute<P>;\n\tfunction withAuthGuard(\n\t\tfnOrOpts?: WithAuthGuardPageRouterOptions | AppRouterPageRoute,\n\t\topts?: WithAuthGuardAppRouterOptions,\n\t): PageRoute<Record<string, unknown>> | AppRouterPageRoute {\n\t\tif (typeof fnOrOpts === 'function') {\n\t\t\tconst appRouteHandler = appRouteHandlerFactory(base);\n\t\t\treturn appRouteHandler(fnOrOpts, opts);\n\t\t}\n\n\t\tconst pageRouteHandler = pageRouteHandlerFactory(base);\n\t\treturn pageRouteHandler(fnOrOpts);\n\t}\n\n\treturn {\n\t\tget options() {\n\t\t\treturn base.options;\n\t\t},\n\t\twithAuthGuard,\n\t\twithApiAuthRequired,\n\t\tgetSession: (req) => base.getSession(req),\n\t\tupdateSession: (event, session) => base.updateSession(event, session),\n\t\trefreshSession: (req) => base.refreshSession(req),\n\t\trevokeSession: (req) => base.revokeSession(req),\n\t\tgetEntrySession: (entryUrl) => base.getEntrySession(entryUrl),\n\t\tcompleteLogin: (params, req) => base.completeLogin(params, req),\n\t\tlogout: (postLogoutRedirectUri, req) => base.logout(postLogoutRedirectUri, req),\n\t\thandleLogin: (req) => base.handleLogin(req),\n\t\thandleRegister: (req) => base.handleRegister(req),\n\t\thandleCallback: (req) => base.handleCallback(req),\n\t\thandleRefresh: (req) => base.handleRefresh(req),\n\t\thandleRevoke: (req) => base.handleRevoke(req),\n\t\thandleEntry: (req) => base.handleEntry(req),\n\t\thandleLogout: (req) => base.handleLogout(req),\n\t\thandleBackChannelLogout: (req) => base.handleBackChannelLogout(req),\n\t\thandler: async (req) => (await base.handler(req)) ?? new NextResponse('Not Found', { status: 404 }),\n\t};\n}\n"],"mappings":"4RA2BA,SAAgB,EAAgB,EAAoD,CACnF,GAAI,CAAC,EAAW,QAAS,CACxB,GAAI,CAAC,EAAW,OACf,MAAM,IAAI,EAAA,mBAAmB,iDAAiD,EAG/E,EAAW,eAAiB,OAC5B,EAAW,QAAU,EAAA,6BAA6B,EAAW,OAAQ,CAAE,qBAAsB,CAAE,OAAQ,EAAW,YAAa,CAAE,CAAC,CACnI,CAEA,IAAM,GAAA,EAAO,EAAA,oBAAA,CACZ,CACC,UAAY,GAAQ,EACpB,UAAW,EAAK,IAAW,EAAA,aAAa,SAAS,EAAK,CAAM,CAC7D,EACA,CACD,EAIA,SAAS,EAAoB,EAAkF,CAC9G,OAAQ,EAA6C,IAChD,aAAe,QACM,EAAA,0BAA0B,CAC1B,CAAA,CAAgB,CACjC,CAAA,CAAgB,EAAM,GAAY,CAAC,CAA8B,EAGhD,EAAA,2BAA2B,CAC3B,CAAA,CAAiB,CACnC,CAAA,CAAiB,EAAK,CAA2B,CAE1D,CAUA,SAAS,EACR,EACA,EAC0D,CAO1D,OANI,OAAO,GAAa,WACC,EAAA,uBAAuB,CACxC,CAAA,CAAgB,EAAU,CAAI,EAGb,EAAA,wBAAwB,CAC1C,CAAA,CAAiB,CAAQ,CACjC,CAEA,MAAO,CACN,IAAI,SAAU,CACb,OAAO,EAAK,OACb,EACA,gBACA,sBACA,WAAa,GAAQ,EAAK,WAAW,CAAG,EACxC,eAAgB,EAAO,IAAY,EAAK,cAAc,EAAO,CAAO,EACpE,eAAiB,GAAQ,EAAK,eAAe,CAAG,EAChD,cAAgB,GAAQ,EAAK,cAAc,CAAG,EAC9C,gBAAkB,GAAa,EAAK,gBAAgB,CAAQ,EAC5D,eAAgB,EAAQ,IAAQ,EAAK,cAAc,EAAQ,CAAG,EAC9D,QAAS,EAAuB,IAAQ,EAAK,OAAO,EAAuB,CAAG,EAC9E,YAAc,GAAQ,EAAK,YAAY,CAAG,EAC1C,eAAiB,GAAQ,EAAK,eAAe,CAAG,EAChD,eAAiB,GAAQ,EAAK,eAAe,CAAG,EAChD,cAAgB,GAAQ,EAAK,cAAc,CAAG,EAC9C,aAAe,GAAQ,EAAK,aAAa,CAAG,EAC5C,YAAc,GAAQ,EAAK,YAAY,CAAG,EAC1C,aAAe,GAAQ,EAAK,aAAa,CAAG,EAC5C,wBAA0B,GAAQ,EAAK,wBAAwB,CAAG,EAClE,QAAS,KAAO,IAAS,MAAM,EAAK,QAAQ,CAAG,GAAM,IAAI,EAAA,aAAa,YAAa,CAAE,OAAQ,GAAI,CAAC,CACnG,CACD"}
+{"version":3,"file":"sdk.cjs","names":[],"sources":["../../src/server/sdk.ts"],"sourcesContent":["import type { NextApiHandler, NextApiRequest, NextApiResponse } from 'next';\nimport type { ParsedUrlQuery } from 'node:querystring';\nimport type {\n\tNextServerSDK,\n\tNextServerSDKInitConfig,\n\tWithAuthGuardAppRouterOptions,\n\tWithAuthGuardPageRouterOptions,\n\tAppRouterPageRoute,\n\tAppRouterPageRouteOpts,\n\tPageRoute,\n\tAppRouteHandlerFn,\n\tAppRouteHandlerFnContext,\n\tPagesRouterRequest,\n} from './types';\nimport { NextResponse, type NextRequest } from 'next/server';\nimport { createBaseServerSDK } from '@strivacity/sdk-core/server';\nimport { ConfigurationError } from '@strivacity/sdk-core/utils/errors';\nimport { createEncryptedCookieStorage } from './storages';\nimport { apiAppRouteHandlerFactory, apiPageRouteHandlerFactory } from './handlers/api';\nimport { appRouteHandlerFactory, pageRouteHandlerFactory } from './handlers/route';\n\n/**\n * Creates a Next.js server SDK instance with the provided configuration.\n *\n * @param {NextServerSDKInitConfig} initConfig - The initialization configuration for the SDK.\n * @returns {NextServerSDK} The initialized Next.js server SDK instance.\n */\nexport function createServerSDK(initConfig: NextServerSDKInitConfig): NextServerSDK {\n\tif (!initConfig.storage) {\n\t\tif (!initConfig.secret) {\n\t\t\tthrow new ConfigurationError('Secret is required for encrypted cookie storage');\n\t\t}\n\n\t\tinitConfig.cookieMaxAge ??= 30 * 24 * 60 * 60;\n\t\tinitConfig.storage = createEncryptedCookieStorage(initConfig.secret, { defaultCookieOptions: { maxAge: initConfig.cookieMaxAge } });\n\t}\n\n\tconst base = createBaseServerSDK<NextRequest | Request | PagesRouterRequest | undefined>(\n\t\t{\n\t\t\ttoRequest: (req) => req as Request,\n\t\t\tredirect: (url, status) => NextResponse.redirect(url, status),\n\t\t},\n\t\tinitConfig,\n\t);\n\n\tfunction withApiAuthRequired(apiRoute: AppRouteHandlerFn): AppRouteHandlerFn;\n\tfunction withApiAuthRequired(apiRoute: NextApiHandler): NextApiHandler;\n\tfunction withApiAuthRequired(apiRoute: AppRouteHandlerFn | NextApiHandler): AppRouteHandlerFn | NextApiHandler {\n\t\treturn (req: NextRequest | Request | NextApiRequest, resOrCtx?: AppRouteHandlerFnContext | NextApiResponse) => {\n\t\t\tif (req instanceof Request) {\n\t\t\t\tconst appRouteHandler = apiAppRouteHandlerFactory(base);\n\t\t\t\tconst wrappedAppRoute = appRouteHandler(apiRoute as AppRouteHandlerFn);\n\t\t\t\treturn wrappedAppRoute(req, (resOrCtx ?? {}) as AppRouteHandlerFnContext);\n\t\t\t}\n\n\t\t\tconst pageRouteHandler = apiPageRouteHandlerFactory(base);\n\t\t\tconst wrappedPageRoute = pageRouteHandler(apiRoute as NextApiHandler);\n\t\t\treturn wrappedPageRoute(req, resOrCtx as NextApiResponse);\n\t\t};\n\t}\n\n\tfunction withAuthGuard(): PageRoute<Record<string, unknown>, ParsedUrlQuery>;\n\tfunction withAuthGuard<P extends Record<string, unknown> = Record<string, unknown>, Q extends ParsedUrlQuery = ParsedUrlQuery>(\n\t\topts: WithAuthGuardPageRouterOptions<P, Q>,\n\t): PageRoute<P, Q>;\n\tfunction withAuthGuard<P extends AppRouterPageRouteOpts = AppRouterPageRouteOpts>(\n\t\tfn: AppRouterPageRoute<P>,\n\t\topts?: WithAuthGuardAppRouterOptions<P>,\n\t): AppRouterPageRoute<P>;\n\tfunction withAuthGuard(\n\t\tfnOrOpts?: WithAuthGuardPageRouterOptions | AppRouterPageRoute,\n\t\topts?: WithAuthGuardAppRouterOptions,\n\t): PageRoute<Record<string, unknown>> | AppRouterPageRoute {\n\t\tif (typeof fnOrOpts === 'function') {\n\t\t\tconst appRouteHandler = appRouteHandlerFactory(base);\n\t\t\treturn appRouteHandler(fnOrOpts, opts);\n\t\t}\n\n\t\tconst pageRouteHandler = pageRouteHandlerFactory(base);\n\t\treturn pageRouteHandler(fnOrOpts);\n\t}\n\n\treturn {\n\t\tget options() {\n\t\t\treturn base.options;\n\t\t},\n\t\twithAuthGuard,\n\t\twithApiAuthRequired,\n\t\t// NOTE: refreshes (with autoRefresh) only for App Router requests, whose route handlers can write the rotated cookie.\n\t\t// Server Components (no request) and Pages Router requests read the stored session: a refresh there could not be saved.\n\t\tgetSession: (req, params) => base.getSession(req, req instanceof Request ? params : { autoRefresh: false }),\n\t\tupdateSession: (session, req) => base.updateSession(session, req),\n\t\trefreshSession: (req) => base.refreshSession(req),\n\t\trevokeSession: (req) => base.revokeSession(req),\n\t\tgetEntrySession: (entryUrl) => base.getEntrySession(entryUrl),\n\t\tcompleteLogin: (params, req) => base.completeLogin(params, req),\n\t\tlogout: (postLogoutRedirectUri, req) => base.logout(postLogoutRedirectUri, req),\n\t\thandleLogin: (req) => base.handleLogin(req),\n\t\thandleRegister: (req) => base.handleRegister(req),\n\t\thandleCallback: (req) => base.handleCallback(req),\n\t\thandleRefresh: (req) => base.handleRefresh(req),\n\t\thandleRevoke: (req) => base.handleRevoke(req),\n\t\thandleEntry: (req) => base.handleEntry(req),\n\t\thandleLogout: (req) => base.handleLogout(req),\n\t\thandleBackChannelLogout: (req) => base.handleBackChannelLogout(req),\n\t\thandler: async (req) => (await base.handler(req)) ?? new NextResponse('Not Found', { status: 404 }),\n\t};\n}\n"],"mappings":"4RA2BA,SAAgB,EAAgB,EAAoD,CACnF,GAAI,CAAC,EAAW,QAAS,CACxB,GAAI,CAAC,EAAW,OACf,MAAM,IAAI,EAAA,mBAAmB,iDAAiD,EAG/E,EAAW,eAAiB,OAC5B,EAAW,QAAU,EAAA,6BAA6B,EAAW,OAAQ,CAAE,qBAAsB,CAAE,OAAQ,EAAW,YAAa,CAAE,CAAC,CACnI,CAEA,IAAM,GAAA,EAAO,EAAA,oBAAA,CACZ,CACC,UAAY,GAAQ,EACpB,UAAW,EAAK,IAAW,EAAA,aAAa,SAAS,EAAK,CAAM,CAC7D,EACA,CACD,EAIA,SAAS,EAAoB,EAAkF,CAC9G,OAAQ,EAA6C,IAChD,aAAe,QACM,EAAA,0BAA0B,CAC1B,CAAA,CAAgB,CACjC,CAAA,CAAgB,EAAM,GAAY,CAAC,CAA8B,EAGhD,EAAA,2BAA2B,CAC3B,CAAA,CAAiB,CACnC,CAAA,CAAiB,EAAK,CAA2B,CAE1D,CAUA,SAAS,EACR,EACA,EAC0D,CAO1D,OANI,OAAO,GAAa,WACC,EAAA,uBAAuB,CACxC,CAAA,CAAgB,EAAU,CAAI,EAGb,EAAA,wBAAwB,CAC1C,CAAA,CAAiB,CAAQ,CACjC,CAEA,MAAO,CACN,IAAI,SAAU,CACb,OAAO,EAAK,OACb,EACA,gBACA,sBAGA,YAAa,EAAK,IAAW,EAAK,WAAW,EAAK,aAAe,QAAU,EAAS,CAAE,YAAa,EAAM,CAAC,EAC1G,eAAgB,EAAS,IAAQ,EAAK,cAAc,EAAS,CAAG,EAChE,eAAiB,GAAQ,EAAK,eAAe,CAAG,EAChD,cAAgB,GAAQ,EAAK,cAAc,CAAG,EAC9C,gBAAkB,GAAa,EAAK,gBAAgB,CAAQ,EAC5D,eAAgB,EAAQ,IAAQ,EAAK,cAAc,EAAQ,CAAG,EAC9D,QAAS,EAAuB,IAAQ,EAAK,OAAO,EAAuB,CAAG,EAC9E,YAAc,GAAQ,EAAK,YAAY,CAAG,EAC1C,eAAiB,GAAQ,EAAK,eAAe,CAAG,EAChD,eAAiB,GAAQ,EAAK,eAAe,CAAG,EAChD,cAAgB,GAAQ,EAAK,cAAc,CAAG,EAC9C,aAAe,GAAQ,EAAK,aAAa,CAAG,EAC5C,YAAc,GAAQ,EAAK,YAAY,CAAG,EAC1C,aAAe,GAAQ,EAAK,aAAa,CAAG,EAC5C,wBAA0B,GAAQ,EAAK,wBAAwB,CAAG,EAClE,QAAS,KAAO,IAAS,MAAM,EAAK,QAAQ,CAAG,GAAM,IAAI,EAAA,aAAa,YAAa,CAAE,OAAQ,GAAI,CAAC,CACnG,CACD"}