@tidecloak/nextjs 0.9.11

package/LICENSE

@@ -0,0 +1,334 @@
+		Tide Community Open Code License
+
+	Preamble:
+	  The Tide Community Open Code License is a copyright License for 
+	software and other kinds of works designed to encourage the adoption 
+	of the Tide Protocol.  The aim of the Tide Protocol is to be the technological
+	infrastructure of a true zero-trust paradigm, addressing the data-breach
+	protection needs of platform vendors and their customers, the 
+	self-sovereign authority needs of online users, and replace the reliance 
+	on blind trust with proofs.
+
+	  To that end, the Tide Community Open Code License gives you the 
+	freedom to modify and distribute copies of software and other works 
+	for free, or for a fee, as long as you do so in accordance with these 
+	terms and the software adopts the Tide Protocol in full.
+
+	License Terms
+	Version: 2
+	Date of last revision: 1 December 2022
+
+	1	Acceptance of these terms
+	  (a)	These terms are between the copyright holder (“we”, “us” and 
+		“our”) identified in the notice embedded in or provided with 
+		the source code, technical documentation or other material 
+		relating to the Tide Foundation Limited’s (ACN 630 011 371) 
+		(“Tide”) data decryption and key management platform 
+		known as the “Tide Protocol” (“Tide Protocol”) and with which 
+		these terms are packaged (“Materials”) and the person or 
+		entity (“you” and “your”) accessing and/or using the Materials.
+	  (b)	By using, modifying or publishing the Materials or any Modified
+		Materials (as defined in clause 2(c) below), you agree to be 
+		bound by these terms.  If you are doing any of the foregoing in 
+		the context of your employment with your employer or on behalf 
+		of another entity, you are agreeing to be bound by these terms 
+		on behalf of that employer or other entity and you represent 
+		and warrant that you have the authority of that employer or 
+		other entity to enter into these terms on their behalf. In such 
+		circumstances, each reference in these terms “you” or “your” 
+		includes that employer or other entity. 
+	  (c)	These terms will remain in effect until terminated under 
+		clause 9.
+
+	2	Intellectual property rights
+	  (a)	In these terms, “Intellectual Property Rights” means all 
+		intellectual property rights of whatever nature throughout the 
+		world, including all rights conferred under statute, common 
+		law or equity, whether existing now or at any time in the 
+		future, including all rights in and to any patents, patent 
+		applications, business names, trade names, domain names, trade 
+		marks, copyright, trade secrets, circuit layout rights, 
+		designs, confidential information, know-how, technical 
+		information, data or developments. All of our Intellectual 
+		Property Rights are protected by the laws in force in 
+		Australia from time to time.
+	  (b)	You acknowledge and agree that we (or our licensors) retain all
+		right, title, and interest (including all Intellectual Property 
+		Rights) in and to the Materials, and nothing you do with or in 
+		relation to the Materials will transfer any right, title or 
+		interest (including Intellectual Property Rights) to you or 
+		License or otherwise permit you to exercise any Intellectual 
+		Property Rights except as expressly granted under these terms.
+	  (c)	In these terms, “Modified Materials” means any work based on 
+		one or more of the Materials, including a revision, 
+		modification, adaptation, subset, addition, enhancement, 
+		improvement, combination, translation, abridgment, 
+		condensation, expansion, collection, compilation or any other 
+		form in which such Materials may be recast, transformed or 
+		adapted or any other new material derived from the Materials.
+
+	3	Your License to the Materials 
+	  (a)	Subject to paragraph (c) below and your compliance with these 
+		terms, we grant you a limited, non-exclusive,  
+		non-sub-licensable, revocable, worldwide, royalty free License 
+		for the term of these terms to access, use, copy, modify, 
+		adapt, distribute, publish and exploit the Materials, provided 
+		that such License is exercised:
+		(i)	solely in connection with the adoption and use of the 
+			Tide Protocol;
+		(ii)	solely in a manner which requires any payment or 
+			exchange of value to be made via Tide Tokens (as 
+			defined in paragraph (c) below); and
+		(iii)	in accordance with clause 6 and on these terms in 
+			respect of the right to distribute and publish the 
+			Materials and Modified Materials.
+		The foregoing rights to distribute, publish and exploit the 
+		Materials include the right to do so for a fee and applies 
+		in respect of the Materials and the Modified Materials. 
+	  (b)	Any access, use, copy, modification, adaptation, distribution, 
+		publication or exploitation of any of the Materials for use 
+		with applications that do not fully use, adopt and implement 
+		the Tide Protocol is prohibited. This prohibition includes any 
+		use or adaptation of the Materials for the purposes of any 
+		protocol, system or platform competing with the Tide Protocol 
+		or which facilitates any form of payment or exchange of value 
+		other than through use of Tide Tokens (as defined in paragraph 
+		(c) below). 
+	  (c)	Without limiting paragraph (b), the License granted under 
+		paragraph (a) does not permit you to, and in exercising the 
+		rights granted to you under paragraph (a) you must not, under 
+		any circumstances:
+		(i)	remove, omit or in any way modify any component of the 
+			Materials, including source code components, which 
+			requires payment or exchange of value to be made via 
+			Tide cryptographic tokens designed for settling 
+			transactions entered into via the Tide Protocol (“Tide 
+			Tokens”); 
+		(ii)	use the Materials which are source code or object code:
+			(A)	in combination with any other code, script or 
+				software (whether in source or object code form), 
+				or otherwise in any manner, which would in any way 
+				circumvent the requirement for any payment or 
+				exchange of value to be made via Tide Tokens; or
+			(B)	in any other way which does not properly use, adopt 
+				and implement the Tide Protocol in its entirety, 
+				including for the purposes of both data decryption 
+				and key management;  
+		(iii)	violate any applicable laws or any rights of any person, 
+			or use or permit or facilitate the use of the Materials 
+			in any manner or for any purpose that is unlawful or is 
+			in breach of any laws of jurisdiction anywhere in the 
+			world;
+		(iv)	distribute viruses, spyware, corrupted files, or any 
+			other similar software or programs that may damage the 
+			operation of any computer hardware or software, or the 
+			Tide Protocol; or
+		(v)	engage in any other conduct that is improper or brings 
+			or is likely to bring us, the Materials, the Tide 
+			Protocol or Tide Tokens into disrepute,
+		and you must ensure that where any third party is being engaged 
+		to make modifications to the Materials on your behalf, their 
+		rights to do so are subject to terms which incorporate the 
+		restrictions in this clause 3.
+	  (d)	You must take your own precautions to ensure that the processes 
+		which you employ for accessing and using the Materials do not 
+		expose you to the risk of viruses, malicious computer code or 
+		other forms of interference which may damage your computer 
+		systems.  We recommend that you install and use up-to-date 
+		anti-virus, anti-spyware and firewall software on your computer 
+		systems.  
+
+	4	Data security and privacy	
+	  You are fully responsible for ensuring:
+	  (a)	any use, adoption or implementation of the Materials, any 
+		Modified Materials and/or the Tide Protocol appropriately 
+		protects, encrypts and stores data; and 
+	  (b)	all aspects of compliance with privacy and data protection laws. 
+	  We disclaim all warranties and liability regarding the same.
+	  
+	5	Modification of Tide Protocol and Materials 
+	  You acknowledge that Tide may at any time without notice to you change 
+	  or update the whole or any part of the Tide Protocol and/or any of the 
+	  Materials, including in a manner which may result in applications or 
+	  processes you may have developed or implemented no longer being 
+	  compatible or otherwise working in the same manner with the Tide 
+	  Protocol or any Material, including any software development kit. We 
+	  may also withdraw or remove any part of the Materials or the Tide 
+	  Protocol at any stage without notice to you.
+
+	6	Distribution 
+	  (a)	Without limiting clause 3, in exercising the rights granted to 
+		you under clause 3(a) to distribute or publish one or more 
+		copies of any Materials verbatim as you receive the Materials,
+		you may do so in any medium, provided that:
+		(i)	you provide all recipients of the Materials with a copy of 
+			these terms along with the Materials: 
+		(ii)	you keep intact and do not remove, omit, or in any way 
+			modify any of the following:
+			(A)	any notices stating that these License terms apply; 
+			(B)	any hyperlink to these License terms; and
+			(C)	any notices of the absence of any warranty;
+	  (b)	You may charge any price or no price for each copy of the 
+		Materials or Modified Materials that you distribute or publish,
+		and you may offer support or warranty protection for a fee.
+	  (c)	Without limiting clause 3, in exercising the rights granted to 
+		you under clause 3(a) to distribute or publish one or more 
+		copies of any Modified Materials you create or cause to be 
+		created, you may do so in any medium, provided that:
+		(i)	you provide all recipients of the Modified Materials with 
+			a copy of these terms along with the Modified Materials; 
+		(ii)	you keep intact and do not remove, omit, or in any way 
+			modify any of the following:
+			(A)	any notices stating that these License terms apply to 
+				the unmodified Materials;
+			(B)	any hyperlink to these License terms; and
+			(C)	any notices of the absence of any warranty in respect 
+				of the unmodified Materials; and
+		(iii)	the whole of any Modified Materials must be licensed under 
+			these terms (although this does not limit the operation of 
+			paragraph (d)), but you may impose further restrictions 
+			that do not conflict with or override these terms.
+	  (d)	Where you compile any source code Materials or Modified 
+		Materials in an aggregate with any proprietary program, the 
+		Materials remain governed by these License terms. For the 
+		purposes of the foregoing, a compilation of any Materials with 
+		other separate and independent works, which are not by their 
+		nature extensions of the Materials, and which are not combined 
+		with the Materials such as to form a larger program, in or on 
+		a volume of a storage or distribution medium, is an “aggregate” 
+		if the compilation and its resulting copyright are not used to 
+		limit the access or legal rights of the compilation's users 
+		beyond what the individual Materials permit. Inclusion of any 
+		Materials in an aggregate does not cause these terms to apply 
+		to the other parts of the aggregate.
+	  (e)	You may not initiate any proceedings or claims in respect of 
+		infringement of any patent rights in respect of the access, 
+		use, copy, modification, adaptation, distribution, publication 
+		or exploitation of any of the Materials or Modified Materials 
+		in accordance with these terms.
+
+	7	Liability
+	  (a)	All express or implied guarantees, warranties, representations, 
+		statements, terms or conditions relating to these terms or the 
+		Materials that are not contained in these terms, are excluded 
+		to the maximum extent permitted by law. Without limiting the 
+		foregoing:
+		(i)	the Materials are provided ‘as-is’ and neither we nor Tide 
+			warrant or represent that they will work in any way, that 
+			they are fit for any particular purpose, that your 
+			requirements will be met, that your use of the Materials 
+			will be uninterrupted or error free or that the Materials 
+			are free of viruses or other harmful components; and
+		(ii)	we and Tide are not responsible for any loss, corruption or 
+			interception of data which occurs in connection with your 
+			use or misuse of the Materials.
+	  (b)	Nothing in these terms excludes, restricts or modifies any 
+		guarantee, term, condition, warranty, or any right or remedy, 
+		implied or imposed by any law which cannot lawfully be excluded 
+		or limited. (a “Non-Excludable Provision”). If any guarantee, 
+		term, condition or warranty is implied into these terms under a 
+		Non-Excludable Provision and we or Tide can limit your remedy 
+		for a breach of the Non-Excludable Provision, then our and 
+		Tide’s liability for breach of the Non-Excludable Provision is 
+		limited to one or more of the following at our option:
+		(i)	in the case of goods, the replacement of the goods or the 
+			supply of equivalent goods, the repair of the goods, the 
+			payment of the cost of replacing the goods or of acquiring 
+			equivalent goods, or the payment of the cost of having the 
+			goods repaired; or
+		(ii)	in the case of services, the supplying of the services 
+			again, or the payment of the cost of having the services 
+			supplied again. 
+	  (c)	To the maximum extent permitted by law but despite any other 
+		clause in these terms, your use of the Materials is at your own 
+		risk and neither we nor Tide are liable to you for any loss or 
+		damage you (or any of your representatives or sub-licensees) 
+		suffer, sustain or incur in connection with these terms, 
+		exercise of any rights granted under these terms or otherwise 
+		in connection with any access or use of the Materials, including 
+		in respect of any loss, corruption or interception of data or 
+		breach of privacy or security.  
+	  (d)	Without limiting paragraph (c), to the maximum extent permitted 
+		by law, neither we nor Tide are not liable to you for and no 
+		measure of damages will under any circumstances include: 
+		(i)	special, indirect, consequential, incidental or punitive 
+			damages; or
+		(ii)	damages for loss of profits, revenue, goodwill, 
+			opportunity, anticipated savings or loss or corruption of 
+			data.
+	  (e)	The exclusions and limitations of liability in this clause 8 
+		apply regardless of the basis on which such liability arises, 
+		whether in contract, breach of warranty, tort (including 
+		negligence), in equity, under statute, under an indemnity or 
+		on any other basis.
+	  (f)	You will indemnify us and hold us, Tide and each of our 
+		directors, officers, employees and contractors harmless from 
+		and against any loss suffered or incurred by us or any of 
+		those indemnified, arising out of or in connection with: 
+		(i)	your or any of your sub-licensee’s access or use of any of 
+			the Materials or any other exercise of any of the rights 
+			granted to you under these terms in connection with any of 
+			the Materials;
+		(ii)	your negligence or breach of these terms; 
+		(iii)	your violation of any applicable law or infringement of any 
+			rights (including Intellectual Property Rights) of a third 
+			party; or
+		(iv)	any claim made by any third party arising out of or in 
+			connection with any Modified Materials, including any 
+			application developed using any of the Materials, and 
+			including in respect of infringement of any person’s 
+			Intellectual Property Rights. 
+	8	Termination
+	  (a)	Your License to use the Materials under clause 3(a) immediately 
+		and automatically terminates without the need for us to give 
+		notice to you if you breach these terms.
+	  (b)	You may terminate these terms at any time by ceasing all use 
+		and removing all implementations of the Materials and the Tide 
+		Protocol.
+	  (c)	Upon termination of these terms, all rights and Licenses 
+		granted to you under these terms will also terminate and you 
+		must immediately cease using the Materials and remove all 
+		implementations of the Materials. 
+	9	General
+	  (a)	You remain fully responsible and liable for the acts and 
+		omissions of any third party to whom you subcontract the 
+		exercise or performance any of your rights or obligations under 
+		these terms, as if such acts and omissions were your acts and 
+		omissions. 
+	  (b)	If any part of these terms is held to be unenforceable, the 
+		unenforceable part is to be given effect to the greatest extent 
+		possible and the remainder will remain in full force and effect.   
+	  (c)	No waiver, delay or failure by us to take any action shall 
+		constitute or be construed as a waiver of that or any other term, 
+		condition, option, privilege or right we may have.
+	  (d)	The word “including” when used in these terms is not a term of 
+		limitation.
+
+	====================
+	End of License terms
+	====================
+
+	If you develop a Modified Material and want to assert your copyright, 
+	attach the following notices to the Modified Material. It is best to 
+	attach them to the start of each source file to most effectively state 
+	the exclusion of warranty and each file should have at least the 
+	“copyright” line and a pointer to where the full notice is found.
+
+	<INSERT PROGRAM NAME and PURPOSE.>
+
+	Copyright (c) <year> <name of author>    
+
+	This program is free software and is subject to the terms of the Tide 
+	Community Open Code License as published by the Tide Foundation 
+	Limited. You may modify it and redistribute it in accordance with 
+	and subject to the terms of that License.
+
+	This program is distributed WITHOUT WARRANTY of any kind, including 
+	without any implied warranty of MERCHANTABILITY or FITNESS FOR A 
+	PARTICULAR PURPOSE.  See the Tide Community Open Code License for 
+	more details.
+
+	You should have received a copy of the Tide Community Open Code 
+	License along with this program.
+	
+	If not, see https://tide.org/licenses_tcoc2-0-0-en

package/README.md

@@ -0,0 +1,345 @@
+# TideCloak NextJS SDK
+
+Secure your Next.js app with TideCloak: authentication, session management, data encryption, and edge-middleware integration-all in minutes.
+
+---
+
+## 1. Prerequisites
+
+Before you begin, ensure you have:
+
+* Next.js 13.5.7 or later
+* React 18 or later
+* Node.js ≥18.17.0
+* A running TideCloak server
+* A registered client in your realm
+
+---
+
+## 2. Install the SDK
+
+Add the NextJS bundle to your project:
+
+```bash
+npm install @tidecloak/nextjs
+# or
+yarn add @tidecloak/nextjs
+```
+
+This bundle provides:
+
+* `<TideCloakProvider>` - application-level context
+* `useTideCloak()` hook - access tokens and auth actions
+* `verifyTideCloakToken()` - server-side JWT verification
+* `<Authenticated>` / `<Unauthenticated>` - UI guards
+* `doEncrypt()` / `doDecrypt()` - tag-based encryption/decryption
+* `createTideCloakMiddleware()` - Edge middleware for route protection (supports both Pages & App routers)
+
+---
+
+## 3. Initialize the Provider
+
+Wrap your root component in `<TideCloakProvider>` to load adapter settings and bootstrap auth:
+
+```tsx
+'use client'
+import React from 'react';
+import { TideCloakProvider } from '@tidecloak/nextjs';
+import adapter from '../tidecloakAdapter.json';
+
+export default function App() {
+  return (
+    <TideCloakProvider config={adapter}>
+      <YourApp />
+    </TideCloakProvider>
+  );
+}
+```
+
+**What it does:**
+
+* **Loads** your adapter JSON
+* **Initializes** internal auth flows and listeners
+* **Provides** auth state & methods via React Context
+
+---
+
+## 4. Using the `useTideCloak` Hook
+
+Use this hook anywhere to manage auth:
+
+```tsx
+'use client'
+import { useTideCloak } from '@tidecloak/nextjs';
+
+function Header() {
+  const {
+    authenticated,
+    login,
+    logout,
+    token,
+    tokenExp,
+    refreshToken,
+    getValueFromToken,
+    getValueFromIdToken,
+    hasRealmRole,
+    hasClientRole,
+    doEncrypt,
+    doDecrypt,
+  } = useTideCloak();
+
+  return (
+    <header>
+      {authenticated ? (
+        <>
+          <span>Logged in</span>
+          <button onClick={logout}>Log Out</button>
+        </>
+      ) : (
+        <button onClick={login}>Log In</button>
+      )}
+      {token && (
+        <small>Expires at {new Date(tokenExp * 1000).toLocaleTimeString()}</small>
+      )}
+    </header>
+  );
+}
+```
+
+| Name                                  | Type                                         | Description                                                             |
+| ------------------------------------- | -------------------------------------------- | ----------------------------------------------------------------------- |
+| `authenticated`                       | `boolean`                                    | Whether the user is logged in.                                          |
+| `login()` / `logout()`                | `() => void`                                 | Trigger the login or logout flows.                                      |
+| `token`, `tokenExp`                   | `string`, `number`                           | Access token and its expiration timestamp.                              |
+| Automatic token refresh               | built-in                                     | Tokens refresh silently on expiration-no manual setup needed.           |
+| `refreshToken()`                      | `() => Promise<boolean>`                     | Force a silent token renewal.                                           |
+| `getValueFromToken(key)`              | `(key: string) => any`                       | Read a custom claim from the access token.                              |
+| `getValueFromIdToken(key)`            | `(key: string) => any`                       | Read a custom claim from the ID token.                                  |
+| `hasRealmRole(role)`                  | `(role: string) => boolean`                  | Check a realm-level role.                                               |
+| `hasClientRole(role, client?)`        | `(role: string, client?: string) => boolean` | Check a client-level role; defaults to your app’s client ID if omitted. |
+| `doEncrypt(data)` / `doDecrypt(data)` | `(data: any) => Promise<any>`                | Encrypt or decrypt payloads via TideCloak’s built-in service.           |
+
+---
+
+## 5. Guard Components
+
+Use out-of-the-box components to show or hide content:
+
+```tsx
+'use client'
+import { Authenticated, Unauthenticated } from '@tidecloak/nextjs';
+
+function Dashboard() {
+  return (
+    <>
+      <Authenticated>
+        <h1>Dashboard</h1>
+        {/* Protected widgets */}
+      </Authenticated>
+
+      <Unauthenticated>
+        <p>Please log in to access the dashboard.</p>
+      </Unauthenticated>
+    </>
+  );
+}
+```
+
+* `<Authenticated>`: renders children only when `authenticated === true`
+* `<Unauthenticated>`: renders children only when `authenticated === false`
+
+---
+
+## 6. Encrypting & Decrypting Data
+
+TideCloak lets you protect sensitive fields with **tag-based** encryption. Pass in an array of `{ data, tags }` objects and receive encrypted strings (or vice versa).
+
+### Syntax Overview
+
+```ts
+// Encrypt payloads:
+const encryptedArray = await doEncrypt([
+  { data: /* any JSON-serializable value */, tags: ['tag1', 'tag2'] },
+  // …
+]);
+
+// Decrypt blobs:
+const decryptedArray = await doDecrypt([
+  { encrypted: /* string from encrypt() */, tags: ['tag1', 'tag2'] },
+  // …
+]);
+```
+
+> **Order guarantee**: the returned array matches the input order.
+
+### Permissions
+
+* **Encryption** requires roles `tide_<tag>.selfencrypt` for each tag.
+* **Decryption** requires roles `tide_<tag>.selfdecrypt` for each tag.
+
+---
+
+## 7. Edge Middleware with TideCloak
+
+TideCloak’s Edge middleware works seamlessly with both the **Pages Router** and the **App Router** in Next.js:
+
+* **Pages Router**: Place your `middleware.ts` file at the project root alongside `pages/`. The exported middleware will apply to both page and API routes.
+* **App Router**: Put `middleware.ts` at the project root (or inside `src/`). It integrates with `/app` routes and layouts, protecting both server components and route handlers.
+
+### 7.1 Installation
+
+No additional install-middleware is included in `@tidecloak/nextjs`.
+
+### 7.2 Options
+
+* **`config`** (`TidecloakConfig`): Your Keycloak adapter JSON (downloaded from your TideCloak client settings).
+* **`publicRoutes`** (`RoutePattern[]`): Paths to bypass authentication (strings/globs/regex/functions).
+* **`protectedRoutes`** (`ProtectedRoutesMap`): Map of path patterns to arrays of required roles.
+* **`onRequest`**<br>`(ctx: { token: string | null }, req: NextRequest) => NextResponse | void`<br>Hook before auth logic; can short-circuit by returning a `NextResponse`.
+* **`onSuccess`**<br>`(ctx: { payload: Record<string, any> }, req: NextRequest) => NextResponse | void`<br>Hook after successful auth & role checks; override the response by returning one.
+* **`onFailure`**<br>`(ctx: { token: string | null }, req: NextRequest) => NextResponse | void`<br>Hook when auth or role check fails; return a `NextResponse` to override.
+* **`onError`**<br>`(err: any, req: NextRequest) => NextResponse`<br>Hook for unexpected errors in middleware logic.
+
+### 7.3 Example Usage
+
+Place the following `middleware.ts` at your project root (works for both Pages and App routers) to protect both page routes and API handlers:
+
+```ts
+import { NextResponse } from 'next/server';
+import keycloakConfig from './tidecloak.config.json';
+import { createTideCloakMiddleware } from '@tidecloak/nextjs/server/tidecloakMiddleware';
+
+export default createTideCloakMiddleware({
+  config: keycloakConfig,
+  publicRoutes: ['/', '/about'],
+  protectedRoutes: {
+    '/admin/*': ['admin'],
+    '/api/private/*': ['user'],
+  },
+  onFailure: ({ token }, req) => NextResponse.redirect(new URL('/login', req.url)),
+  onError: (err, req) => NextResponse.rewrite(new URL('/error', req.url)),
+});
+
+export const config = {
+  matcher: [
+    '/((?!_next|[^?]*\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico)).*)',
+    '/api/(.*)',
+  ],
+  runtime: 'edge',
+};
+```
+
+**Flow:**
+
+1. Bypass any `publicRoutes`
+2. Read the `kcToken` cookie
+3. Invoke `onRequest` hook (if provided)
+4. Match path against `protectedRoutes` patterns
+5. Verify signature, issuer, and roles via `verifyTideCloakToken()`
+6. On success: `onSuccess` hook or `NextResponse.next()`
+7. On failure: `onFailure` hook or default 403 response
+8. On unexpected errors: `onError` hook
+
+---
+
+### 7.4. Server‑Side Token Verification
+
+You can verify TideCloak-issued JWTs on your server or API routes using `verifyTideCloakToken`:
+
+```ts
+import { verifyTideCloakToken } from '@tidecloak/nextjs/server';
+
+// Returns the decoded payload if valid and roles pass, otherwise null
+const payload = await verifyTideCloakToken(
+  config,       // Your TideCloak adapter JSON
+  token,        // Raw access token to verify
+  ['admin', 'user'] // Optional roles; user must have at least one
+);
+
+if (!payload) {
+  // Invalid token or insufficient roles
+}
+```
+
+Under the hood, it uses `jose` for cryptographic verification and key management:
+
+```ts
+import { jwtVerify, createLocalJWKSet, createRemoteJWKSet } from 'jose';
+
+export async function verifyTideCloakToken(config, token, allowedRoles = []) {
+  // Implementation checks token presence, issuer, signature,
+  // authorized party (azp), and at least one allowed role.
+}
+```
+
+**Parameters:**
+
+* `config` (`object`): Your TideCloak adapter JSON (parsed Keycloak config).
+* `token` (`string`): Access token string to verify.
+* `allowedRoles` (`string[]`, optional): Array of realm or client roles; user must have at least one.
+
+**Returns:**
+
+* `Promise<object | null>`: Decoded JWT payload if valid and role check passes; otherwise `null`.
+
+### Example: Protecting an API Route
+
+Protect your server-side endpoints by verifying the JWT before proceeding.
+
+#### Pages Router
+
+```ts
+// pages/api/secure.ts
+import type { NextApiRequest, NextApiResponse } from 'next';
+import { verifyTideCloakToken } from '@tidecloak/nextjs/server';
+import config from '../../tidecloakAdapter.json';
+
+export default async function handler(req: NextApiRequest, res: NextApiResponse) {
+  // Extract token from cookie or Authorization header
+  const token = req.cookies.kcToken || req.headers.authorization?.split(' ')[1] || '';
+
+  // Verify signature, issuer, and roles (e.g., 'user')
+  const payload = await verifyTideCloakToken(config, token, ['user']);
+  if (!payload) {
+    return res.status(401).json({ error: 'Unauthorized' });
+  }
+
+  // Proceed with secure logic
+  res.status(200).json({ data: 'Secure data response' });
+}
+```
+
+#### App Router
+
+```ts
+// app/api/secure/route.ts
+import { NextRequest, NextResponse } from 'next/server';
+import { verifyTideCloakToken } from '@tidecloak/nextjs/server';
+import config from '../../../tidecloakAdapter.json';
+
+export async function GET(req: NextRequest) {
+  // Extract token from cookie
+  const token = req.cookies.get('kcToken')?.value || '';
+
+  // Verify signature, issuer, and roles (e.g., 'user')
+  const payload = await verifyTideCloakToken(config, token, ['user']);
+  if (!payload) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  // Proceed with secure logic
+  return NextResponse.json({ data: 'Secure data response' });
+}
+```
+
+---
+
+## 8. Advanced & Best Practices
+
+* **Auto-Refresh**: built into the provider-no manual timers.
+* **Error Handling**: use the `initError` value from `useTideCloak`.
+* **Custom Claims**: read via `getValueFromToken()` / `getValueFromIdToken()`.
+* **Role-Based UI**: combine hooks & guard components for fine-grained control.
+* **Lazy Initialization**: wrap `<TideCloakProvider>` around only protected sections in large apps.
+
+---

package/dist/cjs/index.js

@@ -0,0 +1 @@
+export * from '@tidecloak/react';

package/dist/cjs/server/index.js

@@ -0,0 +1,2 @@
+export { createTideCloakMiddleware } from './tidecloakMiddleware';
+export { verifyTideCloakToken } from '@tidecloak/verify';

package/dist/cjs/server/routerMatcher.js

@@ -0,0 +1,30 @@
+/**
+ * Convert a single RoutePattern into a test function
+ */
+export function normalizePattern(pattern) {
+    if (typeof pattern === 'function')
+        return pattern;
+    if (pattern instanceof RegExp)
+        return (path) => pattern.test(path);
+    if (pattern === 'OPTIONS')
+        return (_path, req) => req.method === 'OPTIONS';
+    if (typeof pattern === 'string' && pattern.includes('*')) {
+        // Escape regex chars, then replace '*' with '.*'
+        const escaped = pattern
+            .replace(/[-/\\^$+?.()|[\]{}]/g, '\\$&')
+            .replace(/\\\*/g, '.*');
+        const regex = new RegExp(`^${escaped}$`);
+        return (path) => regex.test(path);
+    }
+    // Simple prefix match
+    return (path) => path.startsWith(pattern);
+}
+/**
+ * Convert a ProtectedRoutesMap into an array of { test, roles }
+ */
+export function normalizeProtectedRoutes(map = {}) {
+    return Object.entries(map).map(([pattern, roles]) => ({
+        test: normalizePattern(pattern),
+        roles,
+    }));
+}

package/dist/cjs/server/tidecloakMiddleware.js

@@ -0,0 +1,92 @@
+import { NextResponse } from 'next/server';
+import { verifyTideCloakToken } from '@tidecloak/verify';
+import { normalizePattern, normalizeProtectedRoutes } from './routerMatcher';
+const DEFAULTS = {
+    protectedRoutes: {},
+    onRequest: undefined,
+    onSuccess: undefined,
+};
+/**
+ * Returns a Next.js Edge Middleware function enforcing TideCloak auth.
+ *
+ * Example usage in your `middleware.ts`:
+ *
+ * ```ts
+ * import keycloakConfig from './tidecloak.config.json'
+ * import { createTideMiddleware } from 'tidecloak-nextjs/server/tidecloakMiddleware'
+ *
+ * export default createTideMiddleware({
+ *   config: keycloakConfig,
+ *   publicRoutes: ['/', '/about'],
+ *   protectedRoutes: {
+ *     '/admin/*': ['admin'],
+ *     '/api/private/*': ['user']
+ *   }
+ * })
+ *
+ * export const config = {
+ *   matcher: [
+ *     '/((?!_next|[^?]*\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico)).*)',
+ *     '/(api|trpc)(.*)'
+ *   ],
+ *   runtime: 'edge'
+ * }
+ * ```
+ */
+export function createTideCloakMiddleware(opts) {
+    var _a;
+    const settings = { ...DEFAULTS, ...opts };
+    // Prepare arrays of test functions for public and protected routes
+    const publicTests = ((_a = settings.publicRoutes) !== null && _a !== void 0 ? _a : []).map(normalizePattern);
+    const protectedTests = normalizeProtectedRoutes(settings.protectedRoutes);
+    return async function middleware(req) {
+        var _a;
+        const path = req.nextUrl.pathname;
+        try {
+            // Bypass auth entirely for configured public routes
+            if (publicTests.some(test => test(path, req))) {
+                return NextResponse.next();
+            }
+            // Extract the raw JWT from the specified cookie
+            const token = ((_a = req.cookies.get("kcToken")) === null || _a === void 0 ? void 0 : _a.value) || null;
+            // Allow custom logic before auth checks
+            if (settings.onRequest) {
+                const result = settings.onRequest({ token }, req);
+                if (result)
+                    return result;
+            }
+            // Iterate protected routes; the first match enforces a role check
+            for (const { test, roles } of protectedTests) {
+                if (test(path, req)) {
+                    // Verify signature, issuer, and presence of at least one allowed role
+                    const payload = await verifyTideCloakToken(settings.config, token, roles);
+                    if (!payload) {
+                        // Custom onFailure hook or default redirect
+                        const result = settings.onFailure({ token }, req);
+                        if (result)
+                            return result;
+                        return NextResponse.json({ error: '[TideCloak Middleware] Access forbidden: invalid token' }, { status: 403 });
+                    }
+                    // Custom onSuccess hook if provided
+                    if (settings.onSuccess) {
+                        const result = settings.onSuccess({ payload }, req);
+                        if (result)
+                            return result;
+                    }
+                    // Token valid and role check passed
+                    return NextResponse.next();
+                }
+            }
+            // No protected route matched; continue
+            return NextResponse.next();
+        }
+        catch (err) {
+            // Handle unexpected errors
+            if (settings.onError) {
+                return settings.onError(err, req);
+            }
+            console.error("[TideCloak Middleware] ", err);
+            throw err;
+        }
+    };
+}

package/dist/esm/index.js

@@ -0,0 +1 @@
+export * from '@tidecloak/react';

package/dist/esm/server/index.js

@@ -0,0 +1,2 @@
+export { createTideCloakMiddleware } from './tidecloakMiddleware';
+export { verifyTideCloakToken } from '@tidecloak/verify';

package/dist/esm/server/routerMatcher.js

@@ -0,0 +1,30 @@
+/**
+ * Convert a single RoutePattern into a test function
+ */
+export function normalizePattern(pattern) {
+    if (typeof pattern === 'function')
+        return pattern;
+    if (pattern instanceof RegExp)
+        return (path) => pattern.test(path);
+    if (pattern === 'OPTIONS')
+        return (_path, req) => req.method === 'OPTIONS';
+    if (typeof pattern === 'string' && pattern.includes('*')) {
+        // Escape regex chars, then replace '*' with '.*'
+        const escaped = pattern
+            .replace(/[-/\\^$+?.()|[\]{}]/g, '\\$&')
+            .replace(/\\\*/g, '.*');
+        const regex = new RegExp(`^${escaped}$`);
+        return (path) => regex.test(path);
+    }
+    // Simple prefix match
+    return (path) => path.startsWith(pattern);
+}
+/**
+ * Convert a ProtectedRoutesMap into an array of { test, roles }
+ */
+export function normalizeProtectedRoutes(map = {}) {
+    return Object.entries(map).map(([pattern, roles]) => ({
+        test: normalizePattern(pattern),
+        roles,
+    }));
+}

package/dist/esm/server/tidecloakMiddleware.js

@@ -0,0 +1,92 @@
+import { NextResponse } from 'next/server';
+import { verifyTideCloakToken } from '@tidecloak/verify';
+import { normalizePattern, normalizeProtectedRoutes } from './routerMatcher';
+const DEFAULTS = {
+    protectedRoutes: {},
+    onRequest: undefined,
+    onSuccess: undefined,
+};
+/**
+ * Returns a Next.js Edge Middleware function enforcing TideCloak auth.
+ *
+ * Example usage in your `middleware.ts`:
+ *
+ * ```ts
+ * import keycloakConfig from './tidecloak.config.json'
+ * import { createTideMiddleware } from 'tidecloak-nextjs/server/tidecloakMiddleware'
+ *
+ * export default createTideMiddleware({
+ *   config: keycloakConfig,
+ *   publicRoutes: ['/', '/about'],
+ *   protectedRoutes: {
+ *     '/admin/*': ['admin'],
+ *     '/api/private/*': ['user']
+ *   }
+ * })
+ *
+ * export const config = {
+ *   matcher: [
+ *     '/((?!_next|[^?]*\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico)).*)',
+ *     '/(api|trpc)(.*)'
+ *   ],
+ *   runtime: 'edge'
+ * }
+ * ```
+ */
+export function createTideCloakMiddleware(opts) {
+    var _a;
+    const settings = { ...DEFAULTS, ...opts };
+    // Prepare arrays of test functions for public and protected routes
+    const publicTests = ((_a = settings.publicRoutes) !== null && _a !== void 0 ? _a : []).map(normalizePattern);
+    const protectedTests = normalizeProtectedRoutes(settings.protectedRoutes);
+    return async function middleware(req) {
+        var _a;
+        const path = req.nextUrl.pathname;
+        try {
+            // Bypass auth entirely for configured public routes
+            if (publicTests.some(test => test(path, req))) {
+                return NextResponse.next();
+            }
+            // Extract the raw JWT from the specified cookie
+            const token = ((_a = req.cookies.get("kcToken")) === null || _a === void 0 ? void 0 : _a.value) || null;
+            // Allow custom logic before auth checks
+            if (settings.onRequest) {
+                const result = settings.onRequest({ token }, req);
+                if (result)
+                    return result;
+            }
+            // Iterate protected routes; the first match enforces a role check
+            for (const { test, roles } of protectedTests) {
+                if (test(path, req)) {
+                    // Verify signature, issuer, and presence of at least one allowed role
+                    const payload = await verifyTideCloakToken(settings.config, token, roles);
+                    if (!payload) {
+                        // Custom onFailure hook or default redirect
+                        const result = settings.onFailure({ token }, req);
+                        if (result)
+                            return result;
+                        return NextResponse.json({ error: '[TideCloak Middleware] Access forbidden: invalid token' }, { status: 403 });
+                    }
+                    // Custom onSuccess hook if provided
+                    if (settings.onSuccess) {
+                        const result = settings.onSuccess({ payload }, req);
+                        if (result)
+                            return result;
+                    }
+                    // Token valid and role check passed
+                    return NextResponse.next();
+                }
+            }
+            // No protected route matched; continue
+            return NextResponse.next();
+        }
+        catch (err) {
+            // Handle unexpected errors
+            if (settings.onError) {
+                return settings.onError(err, req);
+            }
+            console.error("[TideCloak Middleware] ", err);
+            throw err;
+        }
+    };
+}

package/dist/types/index.d.ts

@@ -0,0 +1,2 @@
+export * from '@tidecloak/react';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC"}

package/dist/types/server/index.d.ts

@@ -0,0 +1,3 @@
+export { createTideCloakMiddleware } from './tidecloakMiddleware';
+export { verifyTideCloakToken } from '@tidecloak/verify';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/types/server/routerMatcher.d.ts

@@ -0,0 +1,21 @@
+import { NextRequest } from 'next/server';
+/**
+ * A route matcher: prefix string, glob string, RegExp, or custom function
+ */
+export type RoutePattern = string | RegExp | ((pathname: string, req: NextRequest) => boolean);
+/**
+ * Map of protected routes: key = path pattern, value = allowed roles
+ */
+export type ProtectedRoutesMap = Record<string, string[]>;
+/**
+ * Convert a single RoutePattern into a test function
+ */
+export declare function normalizePattern(pattern: RoutePattern): (pathname: string, req: NextRequest) => boolean;
+/**
+ * Convert a ProtectedRoutesMap into an array of { test, roles }
+ */
+export declare function normalizeProtectedRoutes(map?: ProtectedRoutesMap): Array<{
+    test: (pathname: string, req: NextRequest) => boolean;
+    roles: string[];
+}>;
+//# sourceMappingURL=routerMatcher.d.ts.map

package/dist/types/server/routerMatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routerMatcher.d.ts","sourceRoot":"","sources":["../../../src/server/routerMatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC;;GAEG;AACH,MAAM,MAAM,YAAY,GACpB,MAAM,GACN,MAAM,GACN,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,CAAA;AAErD;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;AAEzD;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,YAAY,GACpB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAcjD;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,kBAAuB,GAC3B,KAAK,CAAC;IACP,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC;IACtD,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC,CAKD"}

package/dist/types/server/tidecloakMiddleware.d.ts

@@ -0,0 +1,82 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { RoutePattern, ProtectedRoutesMap } from './routerMatcher';
+interface JWK {
+    kid: string;
+    kty: string;
+    alg: string;
+    use: string;
+    crv: string;
+    x: string;
+}
+export interface TidecloakConfig {
+    realm: string;
+    "auth-server-url": string;
+    "ssl-required": string;
+    resource: string;
+    "public-client": boolean;
+    "confidential-port": number;
+    jwk: {
+        keys: JWK[];
+    };
+    [key: string]: unknown;
+}
+/**
+ * Configuration options for TideCloak middleware.
+ *
+ * - `config`: Your Keycloak client adapter JSON.
+ * - `publicRoutes`: Optional array of paths to exclude from auth, using globs, regex, or functions.
+ * - `protectedRoutes`: Map of path patterns to arrays of required roles.
+ * - `onRequest`, `onSuccess`, `onFailure`, `onError`: Lifecycle hooks for custom logic.
+ */
+export interface TideMiddlewareOptions {
+    /** Keycloak client adapter JSON (downloaded from your Keycloak realm settings) */
+    config: TidecloakConfig;
+    /** Routes that always bypass authentication */
+    publicRoutes?: RoutePattern[];
+    /** Routes requiring a verified token and specific roles */
+    protectedRoutes?: ProtectedRoutesMap;
+    /** Called before any auth logic; return a Response to short‑circuit */
+    onRequest?: (ctx: {
+        token: string | null;
+    }, req: NextRequest) => NextResponse | void;
+    /** Called after successful auth and role checks; return a Response to override */
+    onSuccess?: (ctx: {
+        payload: Record<string, any>;
+    }, req: NextRequest) => NextResponse | void;
+    /** Called when auth or role check fails; return a Response to override */
+    onFailure?: (ctx: {
+        token: string | null;
+    }, req: NextRequest) => NextResponse | void;
+    /** Fallback for unhandled errors in middleware logic */
+    onError?: (err: any, req: NextRequest) => NextResponse;
+}
+/**
+ * Returns a Next.js Edge Middleware function enforcing TideCloak auth.
+ *
+ * Example usage in your `middleware.ts`:
+ *
+ * ```ts
+ * import keycloakConfig from './tidecloak.config.json'
+ * import { createTideMiddleware } from 'tidecloak-nextjs/server/tidecloakMiddleware'
+ *
+ * export default createTideMiddleware({
+ *   config: keycloakConfig,
+ *   publicRoutes: ['/', '/about'],
+ *   protectedRoutes: {
+ *     '/admin/*': ['admin'],
+ *     '/api/private/*': ['user']
+ *   }
+ * })
+ *
+ * export const config = {
+ *   matcher: [
+ *     '/((?!_next|[^?]*\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico)).*)',
+ *     '/(api|trpc)(.*)'
+ *   ],
+ *   runtime: 'edge'
+ * }
+ * ```
+ */
+export declare function createTideCloakMiddleware(opts: TideMiddlewareOptions): (req: NextRequest) => Promise<NextResponse<unknown>>;
+export {};
+//# sourceMappingURL=tidecloakMiddleware.d.ts.map

package/dist/types/server/tidecloakMiddleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tidecloakMiddleware.d.ts","sourceRoot":"","sources":["../../../src/server/tidecloakMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAEvD,OAAO,EAGL,YAAY,EACZ,kBAAkB,EACnB,MAAM,iBAAiB,CAAA;AAExB,UAAU,GAAG;IACT,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,EAAE;QACH,IAAI,EAAE,GAAG,EAAE,CAAC;KACb,CAAC;IAEF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,kFAAkF;IAClF,MAAM,EAAE,eAAe,CAAA;IACvB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,YAAY,EAAE,CAAA;IAC7B,2DAA2D;IAC3D,eAAe,CAAC,EAAE,kBAAkB,CAAA;IACpC,uEAAuE;IACvE,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,GAAG,EAAE,WAAW,KAAK,YAAY,GAAG,IAAI,CAAA;IACpF,kFAAkF;IAClF,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KAAE,EAAE,GAAG,EAAE,WAAW,KAAK,YAAY,GAAG,IAAI,CAAA;IAC5F,0EAA0E;IAC1E,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,GAAG,EAAE,WAAW,KAAK,YAAY,GAAG,IAAI,CAAA;IACpF,wDAAwD;IACxD,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,WAAW,KAAK,YAAY,CAAA;CACvD;AAQD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,qBAAqB,IAOlC,KAAK,WAAW,oCAyDlD"}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@tidecloak/nextjs",
+  "version": "0.9.11",
+  "description": "TideCloak nextjs SDK",
+  "exports": {
+    ".": {
+      "import": "./dist/esm/index.js",
+      "types": "./dist/types/index.d.ts",
+      "require": "./dist/cjs/index.js"
+    },
+    "./server": {
+      "import": "./dist/esm/server/index.js",
+      "types": "./dist/types/server/index.d.ts",
+      "require": "./dist/cjs/server/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tide-foundation/tidecloak-js.git"
+  },
+  "author": "Tide",
+  "license": "https://tide.org/licenses_tcoc2-0-0-en",
+  "keywords": [
+    "security",
+    "tidecloak",
+    "tide",
+    "authentication",
+    "oidc",
+    "oauth2",
+    "authorization",
+    "react"
+  ],
+  "peerDependencies": {
+    "next": ">=13",
+    "react": ">=18.0.0"
+  },
+  "scripts": {
+    "build:cjs": "tsc -p tsconfig.cjs.json",
+    "build:esm": "tsc -p tsconfig.esm.json",
+    "build": "npm run build:cjs && npm run build:esm",
+    "prepare": "npm run build"
+  },
+  "dependencies": {
+    "@tidecloak/react": "^0.9.11",
+    "@tidecloak/verify": "^0.9.12"
+  },
+  "devDependencies": {
+    "@types/react": "^19.1.8",
+    "@types/react-dom": "^19.1.6"
+  }
+}