@tidecloak/nextjs 0.13.30 → 0.13.32

package/README.md

@@ -46,9 +46,12 @@ npm install @tidecloak/nextjs
 - `useTideCloak()` - Hook for auth state and actions
 - `<Authenticated>` / `<Unauthenticated>` - UI guards
 - `createTideCloakMiddleware()` - Edge middleware for route protection
+- `createTideCloakProxy()` - Node.js proxy for route protection (recommended on Next.js 16+)
 - `verifyTideCloakToken()` - Server-side JWT verification
 - `doEncrypt()` / `doDecrypt()` - Tag-based encryption
 
+> **DPoP is enabled and enforced by default** (sender-constrained tokens). Pass `useDPoP: false` or `useDPoP: { mode: "auto" }` in your provider config to relax it — see the [`@tidecloak/js` DPoP docs](../tidecloak-js/docs/FRONT_CHANNEL.md#dpop-on-by-default).
+
 ---
 
 ## Mode-Specific Guides

package/dist/cjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}

package/dist/cjs/server/routerMatcher.js

@@ -13,10 +13,20 @@ function normalizePattern(pattern) {
     if (pattern === 'OPTIONS')
         return (_path, req) => req.method === 'OPTIONS';
     if (typeof pattern === 'string' && pattern.includes('*')) {
-        // Escape regex chars, then replace '*' with '.*'
-        const escaped = pattern
-            .replace(/[-/\\^$+?.()|[\]{}]/g, '\\$&')
-            .replace(/\\\*/g, '.*');
+        // Build the regex by escaping every literal segment between '*' wildcards and
+        // joining them with '.*'. (Escaping the whole string first does NOT work,
+        // because '*' is not a character we escape, so a later "\\*"->".*" pass would
+        // never match and the wildcard would be left as a literal regex quantifier.)
+        let escaped = pattern
+            .split('*')
+            .map((seg) => seg.replace(/[-/\\^$+?.()|[\]{}]/g, '\\$&'))
+            .join('.*');
+        // A trailing "/*" wildcard should also match the bare base path, so that
+        // e.g. "/admin/*" protects "/admin" as well as "/admin/anything". Without
+        // this the base path itself bypasses the role check.
+        if (pattern.endsWith('/*')) {
+            escaped = escaped.replace(/\\\/\.\*$/, '(?:\\/.*)?');
+        }
         const regex = new RegExp(`^${escaped}$`);
         return (path) => regex.test(path);
     }

package/dist/cjs/server/tidecloakMiddleware.js

@@ -6,8 +6,7 @@ const verify_1 = require("@tidecloak/verify");
 const routerMatcher_1 = require("./routerMatcher");
 const DEFAULTS = {
     protectedRoutes: {},
-    onRequest: undefined,
-    onSuccess: undefined,
+    cookieName: 'kcToken',
 };
 /**
  * Returns a Next.js Edge Middleware function enforcing TideCloak auth.
@@ -16,9 +15,9 @@ const DEFAULTS = {
  *
  * ```ts
  * import tidecloakConfig from './tidecloakAdapter.json'
- * import { createTideMiddleware } from 'tidecloak-nextjs/server/tidecloakMiddleware'
+ * import { createTideCloakMiddleware } from '@tidecloak/nextjs/server'
  *
- * export default createTideMiddleware({
+ * export default createTideCloakMiddleware({
  *   config: tidecloakConfig,
  *   protectedRoutes: {
  *     '/admin/*': ['admin'],
@@ -44,7 +43,7 @@ function createTideCloakMiddleware(opts) {
         const path = req.nextUrl.pathname;
         try {
             // Extract the raw JWT from the specified cookie
-            const token = ((_a = req.cookies.get("kcToken")) === null || _a === void 0 ? void 0 : _a.value) || null;
+            const token = ((_a = req.cookies.get(settings.cookieName)) === null || _a === void 0 ? void 0 : _a.value) || null;
             // Allow custom logic before auth checks
             if (settings.onRequest) {
                 const result = settings.onRequest({ token }, req);
@@ -57,10 +56,14 @@ function createTideCloakMiddleware(opts) {
                     // Verify signature, issuer, and presence of at least one allowed role
                     const payload = await (0, verify_1.verifyTideCloakToken)(settings.config, token, roles);
                     if (!payload) {
-                        // Custom onFailure hook or default redirect
-                        const result = settings.onFailure({ token }, req);
-                        if (result)
-                            return result;
+                        // Custom onFailure hook if provided; otherwise fall through to the
+                        // default 403. (onFailure is optional, so it must be guarded — calling
+                        // it unconditionally would throw on the common no-hook configuration.)
+                        if (settings.onFailure) {
+                            const result = settings.onFailure({ token }, req);
+                            if (result)
+                                return result;
+                        }
                         return server_1.NextResponse.json({ error: '[TideCloak Middleware] Access forbidden: invalid token' }, { status: 403 });
                     }
                     // Custom onSuccess hook if provided

package/dist/cjs/server/tidecloakProxy.js

@@ -6,8 +6,7 @@ const verify_1 = require("@tidecloak/verify");
 const routerMatcher_1 = require("./routerMatcher");
 const DEFAULTS = {
     protectedRoutes: {},
-    onRequest: undefined,
-    onSuccess: undefined,
+    cookieName: 'kcToken',
 };
 /**
  * Returns a Next.js 16+ Proxy function enforcing TideCloak auth.
@@ -44,7 +43,7 @@ function createTideCloakProxy(opts) {
         const path = req.nextUrl.pathname;
         try {
             // Extract the raw JWT from the specified cookie
-            const token = ((_a = req.cookies.get("kcToken")) === null || _a === void 0 ? void 0 : _a.value) || null;
+            const token = ((_a = req.cookies.get(settings.cookieName)) === null || _a === void 0 ? void 0 : _a.value) || null;
             // Allow custom logic before auth checks
             if (settings.onRequest) {
                 const result = settings.onRequest({ token }, req);

package/dist/esm/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/dist/esm/server/routerMatcher.js

@@ -9,10 +9,20 @@ export function normalizePattern(pattern) {
     if (pattern === 'OPTIONS')
         return (_path, req) => req.method === 'OPTIONS';
     if (typeof pattern === 'string' && pattern.includes('*')) {
-        // Escape regex chars, then replace '*' with '.*'
-        const escaped = pattern
-            .replace(/[-/\\^$+?.()|[\]{}]/g, '\\$&')
-            .replace(/\\\*/g, '.*');
+        // Build the regex by escaping every literal segment between '*' wildcards and
+        // joining them with '.*'. (Escaping the whole string first does NOT work,
+        // because '*' is not a character we escape, so a later "\\*"->".*" pass would
+        // never match and the wildcard would be left as a literal regex quantifier.)
+        let escaped = pattern
+            .split('*')
+            .map((seg) => seg.replace(/[-/\\^$+?.()|[\]{}]/g, '\\$&'))
+            .join('.*');
+        // A trailing "/*" wildcard should also match the bare base path, so that
+        // e.g. "/admin/*" protects "/admin" as well as "/admin/anything". Without
+        // this the base path itself bypasses the role check.
+        if (pattern.endsWith('/*')) {
+            escaped = escaped.replace(/\\\/\.\*$/, '(?:\\/.*)?');
+        }
         const regex = new RegExp(`^${escaped}$`);
         return (path) => regex.test(path);
     }

package/dist/esm/server/tidecloakMiddleware.js

@@ -3,8 +3,7 @@ import { verifyTideCloakToken } from '@tidecloak/verify';
 import { normalizeProtectedRoutes } from './routerMatcher';
 const DEFAULTS = {
     protectedRoutes: {},
-    onRequest: undefined,
-    onSuccess: undefined,
+    cookieName: 'kcToken',
 };
 /**
  * Returns a Next.js Edge Middleware function enforcing TideCloak auth.
@@ -13,9 +12,9 @@ const DEFAULTS = {
  *
  * ```ts
  * import tidecloakConfig from './tidecloakAdapter.json'
- * import { createTideMiddleware } from 'tidecloak-nextjs/server/tidecloakMiddleware'
+ * import { createTideCloakMiddleware } from '@tidecloak/nextjs/server'
  *
- * export default createTideMiddleware({
+ * export default createTideCloakMiddleware({
  *   config: tidecloakConfig,
  *   protectedRoutes: {
  *     '/admin/*': ['admin'],
@@ -41,7 +40,7 @@ export function createTideCloakMiddleware(opts) {
         const path = req.nextUrl.pathname;
         try {
             // Extract the raw JWT from the specified cookie
-            const token = ((_a = req.cookies.get("kcToken")) === null || _a === void 0 ? void 0 : _a.value) || null;
+            const token = ((_a = req.cookies.get(settings.cookieName)) === null || _a === void 0 ? void 0 : _a.value) || null;
             // Allow custom logic before auth checks
             if (settings.onRequest) {
                 const result = settings.onRequest({ token }, req);
@@ -54,10 +53,14 @@ export function createTideCloakMiddleware(opts) {
                     // Verify signature, issuer, and presence of at least one allowed role
                     const payload = await verifyTideCloakToken(settings.config, token, roles);
                     if (!payload) {
-                        // Custom onFailure hook or default redirect
-                        const result = settings.onFailure({ token }, req);
-                        if (result)
-                            return result;
+                        // Custom onFailure hook if provided; otherwise fall through to the
+                        // default 403. (onFailure is optional, so it must be guarded — calling
+                        // it unconditionally would throw on the common no-hook configuration.)
+                        if (settings.onFailure) {
+                            const result = settings.onFailure({ token }, req);
+                            if (result)
+                                return result;
+                        }
                         return NextResponse.json({ error: '[TideCloak Middleware] Access forbidden: invalid token' }, { status: 403 });
                     }
                     // Custom onSuccess hook if provided

package/dist/esm/server/tidecloakProxy.js

@@ -3,8 +3,7 @@ import { verifyTideCloakToken } from '@tidecloak/verify';
 import { normalizeProtectedRoutes } from './routerMatcher';
 const DEFAULTS = {
     protectedRoutes: {},
-    onRequest: undefined,
-    onSuccess: undefined,
+    cookieName: 'kcToken',
 };
 /**
  * Returns a Next.js 16+ Proxy function enforcing TideCloak auth.
@@ -41,7 +40,7 @@ export function createTideCloakProxy(opts) {
         const path = req.nextUrl.pathname;
         try {
             // Extract the raw JWT from the specified cookie
-            const token = ((_a = req.cookies.get("kcToken")) === null || _a === void 0 ? void 0 : _a.value) || null;
+            const token = ((_a = req.cookies.get(settings.cookieName)) === null || _a === void 0 ? void 0 : _a.value) || null;
             // Allow custom logic before auth checks
             if (settings.onRequest) {
                 const result = settings.onRequest({ token }, req);

package/dist/types/server/routerMatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routerMatcher.d.ts","sourceRoot":"","sources":["../../../src/server/routerMatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC;;GAEG;AACH,MAAM,MAAM,YAAY,GACpB,MAAM,GACN,MAAM,GACN,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,CAAA;AAErD;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;AAEzD;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,YAAY,GACpB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAcjD;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,kBAAuB,GAC3B,KAAK,CAAC;IACP,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC;IACtD,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC,CAKD"}
+{"version":3,"file":"routerMatcher.d.ts","sourceRoot":"","sources":["../../../src/server/routerMatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC;;GAEG;AACH,MAAM,MAAM,YAAY,GACpB,MAAM,GACN,MAAM,GACN,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,CAAA;AAErD;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;AAEzD;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,YAAY,GACpB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAwBjD;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,kBAAuB,GAC3B,KAAK,CAAC;IACP,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC;IACtD,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC,CAKD"}

package/dist/types/server/tidecloakMiddleware.d.ts

@@ -3,10 +3,14 @@ import { ProtectedRoutesMap } from './routerMatcher';
 interface JWK {
     kid: string;
     kty: string;
-    alg: string;
-    use: string;
-    crv: string;
-    x: string;
+    alg?: string;
+    use?: string;
+    crv?: string;
+    x?: string;
+    y?: string;
+    n?: string;
+    e?: string;
+    [key: string]: unknown;
 }
 export interface TidecloakConfig {
     realm: string;
@@ -32,6 +36,8 @@ export interface TideMiddlewareOptions {
     config: TidecloakConfig;
     /** Routes requiring a verified token and specific roles */
     protectedRoutes?: ProtectedRoutesMap;
+    /** Name of the cookie that holds the access token (defaults to `"kcToken"`) */
+    cookieName?: string;
     /** Called before any auth logic; return a Response to short‑circuit */
     onRequest?: (ctx: {
         token: string | null;
@@ -54,9 +60,9 @@ export interface TideMiddlewareOptions {
  *
  * ```ts
  * import tidecloakConfig from './tidecloakAdapter.json'
- * import { createTideMiddleware } from 'tidecloak-nextjs/server/tidecloakMiddleware'
+ * import { createTideCloakMiddleware } from '@tidecloak/nextjs/server'
  *
- * export default createTideMiddleware({
+ * export default createTideCloakMiddleware({
  *   config: tidecloakConfig,
  *   protectedRoutes: {
  *     '/admin/*': ['admin'],

package/dist/types/server/tidecloakMiddleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tidecloakMiddleware.d.ts","sourceRoot":"","sources":["../../../src/server/tidecloakMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAEvD,OAAO,EAEL,kBAAkB,EACnB,MAAM,iBAAiB,CAAA;AAExB,UAAU,GAAG;IACT,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,EAAE;QACH,IAAI,EAAE,GAAG,EAAE,CAAC;KACb,CAAC;IAEF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,oFAAoF;IACpF,MAAM,EAAE,eAAe,CAAA;IACvB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,kBAAkB,CAAA;IACpC,uEAAuE;IACvE,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,GAAG,EAAE,WAAW,KAAK,YAAY,GAAG,IAAI,CAAA;IACpF,kFAAkF;IAClF,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KAAE,EAAE,GAAG,EAAE,WAAW,KAAK,YAAY,GAAG,IAAI,CAAA;IAC5F,0EAA0E;IAC1E,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,GAAG,EAAE,WAAW,KAAK,YAAY,GAAG,IAAI,CAAA;IACpF,wDAAwD;IACxD,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,WAAW,KAAK,YAAY,CAAA;CACvD;AAQD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,qBAAqB,IAMlC,KAAK,WAAW,oCAoDlD"}
+{"version":3,"file":"tidecloakMiddleware.d.ts","sourceRoot":"","sources":["../../../src/server/tidecloakMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAEvD,OAAO,EAEL,kBAAkB,EACnB,MAAM,iBAAiB,CAAA;AAExB,UAAU,GAAG;IACT,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IAEX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IAEX,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,EAAE;QACH,IAAI,EAAE,GAAG,EAAE,CAAC;KACb,CAAC;IAEF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,oFAAoF;IACpF,MAAM,EAAE,eAAe,CAAA;IACvB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,kBAAkB,CAAA;IACpC,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uEAAuE;IACvE,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,GAAG,EAAE,WAAW,KAAK,YAAY,GAAG,IAAI,CAAA;IACpF,kFAAkF;IAClF,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KAAE,EAAE,GAAG,EAAE,WAAW,KAAK,YAAY,GAAG,IAAI,CAAA;IAC5F,0EAA0E;IAC1E,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,GAAG,EAAE,WAAW,KAAK,YAAY,GAAG,IAAI,CAAA;IACpF,wDAAwD;IACxD,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,WAAW,KAAK,YAAY,CAAA;CACvD;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,qBAAqB,IAMlC,KAAK,WAAW,oCAwDlD"}

package/dist/types/server/tidecloakProxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tidecloakProxy.d.ts","sourceRoot":"","sources":["../../../src/server/tidecloakProxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAMvD,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAGnF,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAA;AAEtD;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,qBAAqB,CAAA;AAQpD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,IAM7B,KAAK,WAAW,oCAqD7C"}
+{"version":3,"file":"tidecloakProxy.d.ts","sourceRoot":"","sources":["../../../src/server/tidecloakProxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAMvD,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAGnF,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAA;AAEtD;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,qBAAqB,CAAA;AAOpD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,IAM7B,KAAK,WAAW,oCAqD7C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tidecloak/nextjs",
-  "version": "0.13.30",
+  "version": "0.13.32",
   "description": "TideCloak nextjs SDK",
   "exports": {
     ".": {
@@ -41,18 +41,19 @@
     "nextjs"
   ],
   "peerDependencies": {
-    "next": "^16.0.1",
-    "react": "^19.2.0"
+    "next": ">=13.5.0",
+    "react": ">=18.0.0"
   },
   "scripts": {
     "build:cjs": "tsc -p tsconfig.cjs.json",
     "build:esm": "tsc -p tsconfig.esm.json",
-    "build": "npm run build:cjs && npm run build:esm",
+    "build": "npm run build:cjs && npm run build:esm && node scripts/postbuild.cjs",
+    "test": "npm run build && node --test test/*.test.mjs",
     "prepare": "npm run build"
   },
   "dependencies": {
-    "@tidecloak/react": "^0.13.30",
-    "@tidecloak/verify": "^0.13.30"
+    "@tidecloak/react": "^0.13.32",
+    "@tidecloak/verify": "^0.13.32"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",