@urun-sh/next 0.2.26 → 0.2.29

package/README.md

@@ -3,27 +3,62 @@
 Next.js on-ramp for uRun **scoped client tokens** — never ship your org API
 key to the browser.
 
-## One import, one line
+## Zero-config: the entire connection story
+
+With only `URUN_API_KEY` in the server env (raw `pnpm dev` / `pnpm build`,
+no CLI), this is a complete uRun frontend:
+
+```ts
+// app/api/urun-token/route.ts — the entire server leg
+import { createTokenRoute } from '@urun-sh/next'
+export const POST = createTokenRoute()
+```
+
+```tsx
+// Client code: hardcode YOUR app name, mirroring the backend's App("...").
+// Sessions bind by method call — no function-name strings.
+<UrunProvider app="rolling-sink">…</UrunProvider>
+// const app = useApp(); const session = app.rolling_sink()
+```
+
+`<UrunProvider>` (from `@urun-sh/react`) POSTs `/api/urun-token` after mount;
+the route answers `{ token, expiresAt, orgId, gatewayUrl }` — org derived from
+the key, gateway the platform front door (never user configuration). Nothing
+else is set anywhere: no org id, no gateway URL, no `NEXT_PUBLIC_*`.
+
+`createTokenRoute()` mints for ANY caller by default (the public-demo
+posture — a server-side warning reminds you once); pass
+`createTokenRoute({ authorize })` to restrict minting to your authenticated
+users. All the scoping options below apply to it as well.
+
+## App Router (explicit authorization)
 
 ```ts
 // app/api/urun-token/route.ts
 import { urunTokenRoute } from '@urun-sh/next'
-export const POST = urunTokenRoute()
+
+export const POST = urunTokenRoute({
+  authorize: (req) => Boolean(getSessionUser(req)), // required: do not mint for anonymous callers
+  subject: (req) => getSessionUser(req)?.id,        // stable per-end-user identity
+})
 ```
 
-Set the `URUN_API_KEY` env secret and you are done: the route mints
-short-lived tokens the browser passes to the SDK through the existing `jwt` /
-`getAccessToken` auth options.
+Set the `URUN_API_KEY` env secret and provide an `authorize` callback that
+returns `true` only for an authenticated application user/session. The route
+mints short-lived tokens the browser passes to the SDK through the existing
+`jwt` / `getAccessToken` auth options. Requests are rejected with `401` before
+minting when `authorize` is omitted or returns false.
 
 ## Scoping
 
 ```ts
 export const POST = urunTokenRoute({
+  authorize: (req) => Boolean(getSessionUser(req)),
   allowedFunctions: ['zimage/generate'],       // only these app/functions
   allowedOrigins: ['https://app.example.com'], // only from these Origins
   maxSessionS: 900,                            // per-session length cap
   expiresIn: 120,                              // token start-window (max 3600)
-  subject: (req) => getUserId(req),            // stable per-end-user identity
+  subject: (req) => getSessionUser(req)?.id,   // stable per-end-user identity
 })
 ```
 
@@ -40,9 +75,43 @@ cap (folded with the function's own `max_session_s`).
 ```ts
 // pages/api/urun-token.ts
 import { urunTokenPagesHandler } from '@urun-sh/next'
-export default urunTokenPagesHandler()
+
+export default urunTokenPagesHandler({
+  authorize: (req) => Boolean(getSessionUserFromPagesReq(req)),
+})
 ```
 
+## Session config — hardcode nothing
+
+The other half of the on-ramp: `urun deploy` derives your frontend's
+session-plane config from the deploy (gateway from your login, app id +
+function from the deployed app) and writes it to `frontend/.env.local`.
+`urunSessionConfig()` reads it back so the frontend hardcodes **nothing**:
+
+```ts
+// app/page.tsx — a Server Component
+import { urunSessionConfig } from '@urun-sh/next'
+import { Client } from './client'
+
+export default function Page() {
+  const { baseUrl, appId, functionName } = urunSessionConfig()
+  return <Client baseUrl={baseUrl} appId={appId} functionName={functionName} />
+}
+```
+
+The **org id and auth provider are never here** — a frontend never hardcodes
+its org. They are derived server-side from `URUN_API_KEY` when the token route
+mints the token: the minted token carries the org claim, and `createClientToken`
+returns the resolved `orgId` (in the `{ token, expiresAt, orgId }` response) for
+the browser to hand to `<UrunProvider orgId=… jwt=… />`. The gateway ignores the
+auth provider for platform-minted client tokens, so no `authProvider` is needed.
+
+The end state: a user sets only `URUN_API_KEY` and runs `urun deploy` — no
+`NEXT_PUBLIC_SESSION_*` editing.
+
+Canonical env vars (plain server env, not `NEXT_PUBLIC_*`): `URUN_GATEWAY_URL`
+(default `https://api.urun.sh`), `URUN_APP`, `URUN_FUNCTION`.
+
 ## Server SDK
 
 The underlying mint call is `createClientToken(apiKey, options)` from

package/dist/index.cjs

@@ -1 +1 @@
-"use strict";var l=Object.defineProperty;var y=Object.getOwnPropertyDescriptor;var k=Object.getOwnPropertyNames;var x=Object.prototype.hasOwnProperty;var b=(e,n)=>{for(var r in n)l(e,r,{get:n[r],enumerable:!0})},R=(e,n,r,o)=>{if(n&&typeof n=="object"||typeof n=="function")for(let t of k(n))!x.call(e,t)&&t!==r&&l(e,t,{get:()=>n[t],enumerable:!(o=y(n,t))||o.enumerable});return e};var S=e=>R(l({},"__esModule",{value:!0}),e);var P={};b(P,{URUN_API_KEY_ENV:()=>w,urunTokenPagesHandler:()=>U,urunTokenRoute:()=>O});module.exports=S(P);var d=require("@urun-sh/core"),w="URUN_API_KEY",I=60,a=class extends Error{};function h(e){return Array.isArray(e)&&e.every(n=>typeof n=="string")}function T(e,n){let r=n&&typeof n=="object"&&!Array.isArray(n)?n:{},o={expiresIn:e.expiresIn,allowedFunctions:e.allowedFunctions,allowedOrigins:e.allowedOrigins,maxSessionS:e.maxSessionS},t=r.expiresIn;if(t!==void 0){if(typeof t!="number"||!Number.isInteger(t)||t<1)throw new a("expiresIn must be a positive integer");let u=e.expiresIn??I;if(t>u)throw new a(`expiresIn may not exceed the configured ${u}s`);o.expiresIn=t}let s=(u,c,f)=>{if(u===void 0)return c;if(!h(u))throw new a(`${f} must be an array of strings`);if(c){let g=u.filter(p=>!c.includes(p));if(g.length>0)throw new a(`${f} may only narrow the configured allowlist (rejected: ${g.join(", ")})`)}return u};o.allowedFunctions=s(r.allowedFunctions,e.allowedFunctions,"allowedFunctions"),o.allowedOrigins=s(r.allowedOrigins,e.allowedOrigins,"allowedOrigins");let i=r.maxSessionS;if(i!==void 0){if(typeof i!="number"||!Number.isInteger(i)||i<1)throw new a("maxSessionS must be a positive integer");o.maxSessionS=e.maxSessionS===void 0?i:Math.min(e.maxSessionS,i)}return o}async function m(e,n,r){let o=e.apiKey??process.env[w];if(!o)return console.error(`[urun] token route: no API key \u2014 set ${w} or pass options.apiKey`),{status:500,body:{message:"token route not configured"}};let t;try{t=T(e,n)}catch(s){if(s instanceof a)return{status:400,body:{message:s.message}};throw s}try{let s=await(0,d.createClientToken)(o,{baseUrl:e.baseUrl,expiresIn:t.expiresIn,allowedFunctions:t.allowedFunctions,allowedOrigins:t.allowedOrigins,maxSessionS:t.maxSessionS,metadata:e.metadata,subject:r,fetch:e.fetch});return{status:200,body:{token:s.token,expiresAt:s.expiresAt.toISOString(),orgId:s.orgId}}}catch(s){let i=s instanceof d.ClientTokenError?`${s.message} (status ${s.status??"n/a"})`:s instanceof Error?s.message:String(s);return console.error(`[urun] token route: mint failed: ${i}`),{status:502,body:{message:"token mint failed"}}}}function O(e={}){return async n=>{let r;try{r=await n.json()}catch{r=void 0}let o=e.subject?await e.subject(n):void 0,{status:t,body:s}=await m(e,r,o);return new Response(JSON.stringify(s),{status:t,headers:{"content-type":"application/json"}})}}function U(e={}){return async(n,r)=>{if((n.method??"GET").toUpperCase()!=="POST"){r.status(405).json({message:"method not allowed"});return}let{status:o,body:t}=await m(e,n.body,void 0);r.status(o).json(t)}}0&&(module.exports={URUN_API_KEY_ENV,urunTokenPagesHandler,urunTokenRoute});
+"use strict";var f=Object.defineProperty;var h=Object.getOwnPropertyDescriptor;var x=Object.getOwnPropertyNames;var T=Object.prototype.hasOwnProperty;var S=(e,n)=>{for(var o in n)f(e,o,{get:n[o],enumerable:!0})},O=(e,n,o,r)=>{if(n&&typeof n=="object"||typeof n=="function")for(let t of x(n))!T.call(e,t)&&t!==o&&f(e,t,{get:()=>n[t],enumerable:!(r=h(n,t))||r.enumerable});return e};var N=e=>O(f({},"__esModule",{value:!0}),e);var q={};S(q,{URUN_API_KEY_ENV:()=>l,URUN_APP_ENV:()=>m,URUN_FUNCTION_ENV:()=>k,URUN_GATEWAY_URL_ENV:()=>g,createTokenRoute:()=>C,urunSessionConfig:()=>I,urunTokenPagesHandler:()=>E,urunTokenRoute:()=>_});module.exports=N(q);var d=require("@urun-sh/core"),l="URUN_API_KEY",g="URUN_GATEWAY_URL",m="URUN_APP",k="URUN_FUNCTION";function I(e=process.env){return{baseUrl:e[g]?.trim()||d.DEFAULT_GATEWAY_URL,appId:e[m]?.trim()||void 0,functionName:e[k]?.trim()||void 0}}var P=60,u=class extends Error{};function A(e){return Array.isArray(e)&&e.every(n=>typeof n=="string")}function j(e,n){let o=n&&typeof n=="object"&&!Array.isArray(n)?n:{},r={expiresIn:e.expiresIn,allowedFunctions:e.allowedFunctions,allowedOrigins:e.allowedOrigins,maxSessionS:e.maxSessionS},t=o.expiresIn;if(t!==void 0){if(typeof t!="number"||!Number.isInteger(t)||t<1)throw new u("expiresIn must be a positive integer");let a=e.expiresIn??P;if(t>a)throw new u(`expiresIn may not exceed the configured ${a}s`);r.expiresIn=t}let s=(a,c,w)=>{if(a===void 0)return c;if(!A(a))throw new u(`${w} must be an array of strings`);if(c){let y=a.filter(b=>!c.includes(b));if(y.length>0)throw new u(`${w} may only narrow the configured allowlist (rejected: ${y.join(", ")})`)}return a};r.allowedFunctions=s(o.allowedFunctions,e.allowedFunctions,"allowedFunctions"),r.allowedOrigins=s(o.allowedOrigins,e.allowedOrigins,"allowedOrigins");let i=o.maxSessionS;if(i!==void 0){if(typeof i!="number"||!Number.isInteger(i)||i<1)throw new u("maxSessionS must be a positive integer");r.maxSessionS=e.maxSessionS===void 0?i:Math.min(e.maxSessionS,i)}return r}async function U(e,n){return e.authorize?await e.authorize(n)?void 0:{status:401,body:{message:"unauthorized"}}:(console.error("[urun] token route: options.authorize is required before minting"),{status:401,body:{message:"unauthorized"}})}async function p(e,n,o){let r=e.apiKey??process.env[l];if(!r)return console.error(`[urun] token route: no API key \u2014 set ${l} or pass options.apiKey`),{status:500,body:{message:"token route not configured"}};let t;try{t=j(e,n)}catch(s){if(s instanceof u)return{status:400,body:{message:s.message}};throw s}try{let s=await(0,d.createClientToken)(r,{baseUrl:e.baseUrl,expiresIn:t.expiresIn,allowedFunctions:t.allowedFunctions,allowedOrigins:t.allowedOrigins,maxSessionS:t.maxSessionS,metadata:e.metadata,subject:o,fetch:e.fetch});return{status:200,body:{token:s.token,expiresAt:s.expiresAt.toISOString(),orgId:s.orgId}}}catch(s){let i=s instanceof d.ClientTokenError?`${s.message} (status ${s.status??"n/a"})`:s instanceof Error?s.message:String(s);return console.error(`[urun] token route: mint failed: ${i}`),{status:502,body:{message:"token mint failed"}}}}function _(e){return async n=>{let o;try{o=await n.json()}catch{o=void 0}let r=await U(e,n);if(r)return new Response(JSON.stringify(r.body),{status:r.status,headers:{"content-type":"application/json"}});let t=e.subject?await e.subject(n):void 0,{status:s,body:i}=await p(e,o,t);return new Response(JSON.stringify(i),{status:s,headers:{"content-type":"application/json"}})}}function z(){return(process.env[g]?.trim()||d.DEFAULT_GATEWAY_URL).replace(/\/+$/,"")}var R=!1;function C(e={}){return async n=>{let o;try{o=await n.json()}catch{o=void 0}if(e.authorize){if(!await e.authorize(n))return new Response(JSON.stringify({message:"unauthorized"}),{status:401,headers:{"content-type":"application/json"}})}else R||(R=!0,console.warn("[urun] createTokenRoute: minting for ANY caller \u2014 pass { authorize } to restrict the endpoint to your authenticated users"));let r=e.subject?await e.subject(n):void 0,t=z(),{status:s,body:i}=await p({...e,baseUrl:t},o,r);if(s!==200)return new Response(JSON.stringify(i),{status:s,headers:{"content-type":"application/json"}});let a={...i,gatewayUrl:t};return new Response(JSON.stringify(a),{status:200,headers:{"content-type":"application/json"}})}}function E(e){return async(n,o)=>{if((n.method??"GET").toUpperCase()!=="POST"){o.status(405).json({message:"method not allowed"});return}let r=await U(e,n);if(r){o.status(r.status).json(r.body);return}let{status:t,body:s}=await p(e,n.body,void 0);o.status(t).json(s)}}0&&(module.exports={URUN_API_KEY_ENV,URUN_APP_ENV,URUN_FUNCTION_ENV,URUN_GATEWAY_URL_ENV,createTokenRoute,urunSessionConfig,urunTokenPagesHandler,urunTokenRoute});

package/dist/index.d.cts

@@ -3,11 +3,8 @@ import { CreateClientTokenOptions } from '@urun-sh/core';
 /**
  * @urun-sh/next — the Next.js on-ramp for uRun scoped client tokens.
  *
- * The whole integration is ONE import + ONE line:
- *
- *   // app/api/urun-token/route.ts
- *   import { urunTokenRoute } from '@urun-sh/next'
- *   export const POST = urunTokenRoute()
+ * The integration requires an application authorization callback so the
+ * token endpoint is never public by default.
  *
  * The route mints short-lived scoped client tokens with your org API key
  * (the standard `URUN_API_KEY` env secret) via `createClientToken` from
@@ -21,13 +18,60 @@ import { CreateClientTokenOptions } from '@urun-sh/core';
  * never widen anything, and it can never choose its own `subject` (identity
  * is server-derived via `options.subject`, defaulting to a random subject per
  * token so distinct end-users never share a session).
+ *
+ * SECURITY MODEL of the route itself: `options.authorize` is required and
+ * must return true before the route mints a token.
  */
 
 /** The standard env secret the route reads the org API key from. */
 declare const URUN_API_KEY_ENV = "URUN_API_KEY";
+/**
+ * Canonical env var names carrying a frontend's session-plane config — the
+ * values `urun deploy` writes into `frontend/.env.local` and `urun dev`
+ * injects into the frontend dev server. Plain server env (NOT `NEXT_PUBLIC_*`):
+ * read them in a Server Component / route handler and pass them to your client
+ * provider as props.
+ */
+declare const URUN_GATEWAY_URL_ENV = "URUN_GATEWAY_URL";
+declare const URUN_APP_ENV = "URUN_APP";
+declare const URUN_FUNCTION_ENV = "URUN_FUNCTION";
+/** The frontend's resolved session-plane config (see {@link urunSessionConfig}). */
+interface UrunSessionConfig {
+    /** Session gateway base URL — `URUN_GATEWAY_URL`, default the public gateway. */
+    baseUrl: string;
+    /** Deployed app id — `URUN_APP`; undefined until `urun deploy` emits it. */
+    appId?: string;
+    /** Session function name — `URUN_FUNCTION`; undefined until emitted. */
+    functionName?: string;
+}
+/**
+ * Read a frontend's session-plane config from the environment.
+ *
+ * This is the READER half of the CLI on-ramp: `urun deploy` derives these
+ * values from your deploy (gateway from your login, app id + function from the
+ * deployed app) and writes them to `frontend/.env.local`; this reads them back
+ * so the frontend hardcodes nothing.
+ *
+ * The org id and auth provider are DELIBERATELY absent — a frontend never
+ * hardcodes its org. They are derived SERVER-SIDE from `URUN_API_KEY` when the
+ * token route mints the client token: the minted token already carries the org
+ * claim, and {@link createClientToken} returns the resolved `orgId` for the
+ * browser to hand to the provider. The gateway ignores the auth provider for
+ * these platform-minted client tokens (trust = JWKS verify + org-claim match),
+ * so the provider's default is correct and no `authProvider` need be set.
+ *
+ * Read this SERVER-SIDE (plain env, not `NEXT_PUBLIC_*`) and pass the values
+ * to your client provider as props.
+ */
+declare function urunSessionConfig(env?: Record<string, string | undefined>): UrunSessionConfig;
 interface UrunTokenRouteOptions extends Omit<CreateClientTokenOptions, 'fetch' | 'subject'> {
     /** Org API key (default: `process.env.URUN_API_KEY`). */
     apiKey?: string;
+    /**
+     * Authorize the caller before minting. Return true only for an
+     * authenticated application user/session that may receive a client token.
+     */
+    authorize: (request: Request | UrunTokenPagesRequest) => boolean | Promise<boolean>;
     /**
      * Derive a STABLE per-end-user subject from the request (e.g. your auth
      * session). A stable subject coalesces one user's tabs into one session;
@@ -38,17 +82,6 @@ interface UrunTokenRouteOptions extends Omit<CreateClientTokenOptions, 'fetch' |
     /** Fetch override (tests / custom agents). */
     fetch?: typeof fetch;
 }
-/** The JSON shape a successful token response carries to the browser. */
-interface UrunTokenResponseBody {
-    token: string;
-    expiresAt: string;
-    orgId: string;
-}
-/**
- * A fully-built Next.js App Router route handler that mints scoped client
- * tokens: `export const POST = urunTokenRoute()`.
- */
-declare function urunTokenRoute(options?: UrunTokenRouteOptions): (request: Request) => Promise<Response>;
 /**
  * Structural Pages Router types — no dependency on `next` itself, so the
  * package builds/tests standalone and works with any Next version.
@@ -56,16 +89,73 @@ declare function urunTokenRoute(options?: UrunTokenRouteOptions): (request: Requ
 interface UrunTokenPagesRequest {
     method?: string;
     body?: unknown;
+    headers?: Record<string, string | string[] | undefined>;
 }
 interface UrunTokenPagesResponse {
     status(code: number): UrunTokenPagesResponse;
     json(body: unknown): void;
 }
+/** The JSON shape a successful token response carries to the browser. */
+interface UrunTokenResponseBody {
+    token: string;
+    expiresAt: string;
+    orgId: string;
+}
+/**
+ * A fully-built Next.js App Router route handler that mints scoped client
+ * tokens after the required authorization callback approves the caller.
+ */
+declare function urunTokenRoute(options: UrunTokenRouteOptions): (request: Request) => Promise<Response>;
+interface CreateTokenRouteOptions extends Omit<UrunTokenRouteOptions, 'authorize' | 'baseUrl'> {
+    /**
+     * OPTIONAL here (unlike {@link urunTokenRoute}, where it is required): the
+     * zero-config on-ramp exists precisely for public demo frontends where an
+     * anonymous browser legitimately receives a scoped short-lived token. When
+     * omitted, every caller mints (a server-side warning is logged once);
+     * provide it to restrict minting to your authenticated users.
+     */
+    authorize?: UrunTokenRouteOptions['authorize'];
+}
+/**
+ * The zero-config response: everything the API KEY implies, and nothing more.
+ * The app identity is deliberately ABSENT — the frontend hardcodes its app
+ * name (`<UrunProvider app="rolling-sink">`) exactly like the backend's
+ * `App("rolling-sink")`. Owner ruling 2026-07-15: no app introspection, no
+ * inference — an app author knows their own app.
+ */
+interface CreateTokenRouteResponseBody extends UrunTokenResponseBody {
+    /**
+     * The platform endpoint the browser should connect to. NOT user
+     * configuration: the package hardcodes the public gateway, and the browser
+     * merely receives the server's resolution (owner ruling 2026-07-15: the
+     * gateway IS the platform front door, not something to discover or
+     * configure — users never see or set it).
+     */
+    gatewayUrl: string;
+}
+/**
+ * The ENTIRE server leg of a uRun frontend, zero-config:
+ *
+ * ```ts
+ * // app/api/urun-token/route.ts
+ * export const POST = createTokenRoute()
+ * ```
+ *
+ * With only `URUN_API_KEY` in the server env (raw `pnpm dev` / `pnpm build`,
+ * no urun CLI), the route mints a scoped client token and answers
+ * `{ token, expiresAt, orgId, gatewayUrl }` — org derived from the key,
+ * gateway the hardcoded platform front door (internal dev-cluster override
+ * via the buried `URUN_GATEWAY_URL` server env, never user config). The
+ * browser side is `<UrunProvider app="your-app">` — the app name is
+ * HARDCODED in app code, mirroring the backend's `App("your-app")` (owner
+ * ruling: no introspection, no inference). The API key never ships to the
+ * browser.
+ */
+declare function createTokenRoute(options?: CreateTokenRouteOptions): (request: Request) => Promise<Response>;
 /**
- * The Pages Router variant: `export default urunTokenPagesHandler()`.
- * NOTE: `options.subject` receives no Request here (Pages req is structural);
- * derive identity inside your own wrapper if you need it on Pages Router.
+ * The Pages Router variant. Wrap this handler if Pages-specific subject
+ * derivation is needed; authorization receives the structural Pages request.
  */
-declare function urunTokenPagesHandler(options?: UrunTokenRouteOptions): (req: UrunTokenPagesRequest, res: UrunTokenPagesResponse) => Promise<void>;
+declare function urunTokenPagesHandler(options: UrunTokenRouteOptions): (req: UrunTokenPagesRequest, res: UrunTokenPagesResponse) => Promise<void>;
 
-export { URUN_API_KEY_ENV, type UrunTokenPagesRequest, type UrunTokenPagesResponse, type UrunTokenResponseBody, type UrunTokenRouteOptions, urunTokenPagesHandler, urunTokenRoute };
+export { type CreateTokenRouteOptions, type CreateTokenRouteResponseBody, URUN_API_KEY_ENV, URUN_APP_ENV, URUN_FUNCTION_ENV, URUN_GATEWAY_URL_ENV, type UrunSessionConfig, type UrunTokenPagesRequest, type UrunTokenPagesResponse, type UrunTokenResponseBody, type UrunTokenRouteOptions, createTokenRoute, urunSessionConfig, urunTokenPagesHandler, urunTokenRoute };

package/dist/index.d.ts

@@ -1,32 +1,61 @@
 import { CreateClientTokenOptions } from '@urun-sh/core';
 
 declare const URUN_API_KEY_ENV = "URUN_API_KEY";
+
+declare const URUN_GATEWAY_URL_ENV = "URUN_GATEWAY_URL";
+declare const URUN_APP_ENV = "URUN_APP";
+declare const URUN_FUNCTION_ENV = "URUN_FUNCTION";
+
+interface UrunSessionConfig {
+    
+    baseUrl: string;
+    
+    appId?: string;
+    
+    functionName?: string;
+}
+
+declare function urunSessionConfig(env?: Record<string, string | undefined>): UrunSessionConfig;
 interface UrunTokenRouteOptions extends Omit<CreateClientTokenOptions, 'fetch' | 'subject'> {
     
     apiKey?: string;
     
+    authorize: (request: Request | UrunTokenPagesRequest) => boolean | Promise<boolean>;
+    
     subject?: (request: Request) => string | undefined | Promise<string | undefined>;
     
     fetch?: typeof fetch;
 }
 
-interface UrunTokenResponseBody {
-    token: string;
-    expiresAt: string;
-    orgId: string;
-}
-
-declare function urunTokenRoute(options?: UrunTokenRouteOptions): (request: Request) => Promise<Response>;
-
 interface UrunTokenPagesRequest {
     method?: string;
     body?: unknown;
+    headers?: Record<string, string | string[] | undefined>;
 }
 interface UrunTokenPagesResponse {
     status(code: number): UrunTokenPagesResponse;
     json(body: unknown): void;
 }
 
-declare function urunTokenPagesHandler(options?: UrunTokenRouteOptions): (req: UrunTokenPagesRequest, res: UrunTokenPagesResponse) => Promise<void>;
+interface UrunTokenResponseBody {
+    token: string;
+    expiresAt: string;
+    orgId: string;
+}
+
+declare function urunTokenRoute(options: UrunTokenRouteOptions): (request: Request) => Promise<Response>;
+interface CreateTokenRouteOptions extends Omit<UrunTokenRouteOptions, 'authorize' | 'baseUrl'> {
+    
+    authorize?: UrunTokenRouteOptions['authorize'];
+}
+
+interface CreateTokenRouteResponseBody extends UrunTokenResponseBody {
+    
+    gatewayUrl: string;
+}
+
+declare function createTokenRoute(options?: CreateTokenRouteOptions): (request: Request) => Promise<Response>;
+
+declare function urunTokenPagesHandler(options: UrunTokenRouteOptions): (req: UrunTokenPagesRequest, res: UrunTokenPagesResponse) => Promise<void>;
 
-export { URUN_API_KEY_ENV, type UrunTokenPagesRequest, type UrunTokenPagesResponse, type UrunTokenResponseBody, type UrunTokenRouteOptions, urunTokenPagesHandler, urunTokenRoute };
+export { type CreateTokenRouteOptions, type CreateTokenRouteResponseBody, URUN_API_KEY_ENV, URUN_APP_ENV, URUN_FUNCTION_ENV, URUN_GATEWAY_URL_ENV, type UrunSessionConfig, type UrunTokenPagesRequest, type UrunTokenPagesResponse, type UrunTokenResponseBody, type UrunTokenRouteOptions, createTokenRoute, urunSessionConfig, urunTokenPagesHandler, urunTokenRoute };

package/dist/index.js

@@ -1 +1 @@
-import{createClientToken as m,ClientTokenError as p}from"@urun-sh/core";var w="URUN_API_KEY",y=60,a=class extends Error{};function k(e){return Array.isArray(e)&&e.every(s=>typeof s=="string")}function x(e,s){let r=s&&typeof s=="object"&&!Array.isArray(s)?s:{},o={expiresIn:e.expiresIn,allowedFunctions:e.allowedFunctions,allowedOrigins:e.allowedOrigins,maxSessionS:e.maxSessionS},t=r.expiresIn;if(t!==void 0){if(typeof t!="number"||!Number.isInteger(t)||t<1)throw new a("expiresIn must be a positive integer");let u=e.expiresIn??y;if(t>u)throw new a(`expiresIn may not exceed the configured ${u}s`);o.expiresIn=t}let n=(u,d,c)=>{if(u===void 0)return d;if(!k(u))throw new a(`${c} must be an array of strings`);if(d){let l=u.filter(g=>!d.includes(g));if(l.length>0)throw new a(`${c} may only narrow the configured allowlist (rejected: ${l.join(", ")})`)}return u};o.allowedFunctions=n(r.allowedFunctions,e.allowedFunctions,"allowedFunctions"),o.allowedOrigins=n(r.allowedOrigins,e.allowedOrigins,"allowedOrigins");let i=r.maxSessionS;if(i!==void 0){if(typeof i!="number"||!Number.isInteger(i)||i<1)throw new a("maxSessionS must be a positive integer");o.maxSessionS=e.maxSessionS===void 0?i:Math.min(e.maxSessionS,i)}return o}async function f(e,s,r){let o=e.apiKey??process.env[w];if(!o)return console.error(`[urun] token route: no API key \u2014 set ${w} or pass options.apiKey`),{status:500,body:{message:"token route not configured"}};let t;try{t=x(e,s)}catch(n){if(n instanceof a)return{status:400,body:{message:n.message}};throw n}try{let n=await m(o,{baseUrl:e.baseUrl,expiresIn:t.expiresIn,allowedFunctions:t.allowedFunctions,allowedOrigins:t.allowedOrigins,maxSessionS:t.maxSessionS,metadata:e.metadata,subject:r,fetch:e.fetch});return{status:200,body:{token:n.token,expiresAt:n.expiresAt.toISOString(),orgId:n.orgId}}}catch(n){let i=n instanceof p?`${n.message} (status ${n.status??"n/a"})`:n instanceof Error?n.message:String(n);return console.error(`[urun] token route: mint failed: ${i}`),{status:502,body:{message:"token mint failed"}}}}function R(e={}){return async s=>{let r;try{r=await s.json()}catch{r=void 0}let o=e.subject?await e.subject(s):void 0,{status:t,body:n}=await f(e,r,o);return new Response(JSON.stringify(n),{status:t,headers:{"content-type":"application/json"}})}}function S(e={}){return async(s,r)=>{if((s.method??"GET").toUpperCase()!=="POST"){r.status(405).json({message:"method not allowed"});return}let{status:o,body:t}=await f(e,s.body,void 0);r.status(o).json(t)}}export{w as URUN_API_KEY_ENV,S as urunTokenPagesHandler,R as urunTokenRoute};
+import{createClientToken as k,ClientTokenError as U,DEFAULT_GATEWAY_URL as w}from"@urun-sh/core";var g="URUN_API_KEY",y="URUN_GATEWAY_URL",b="URUN_APP",h="URUN_FUNCTION";function I(e=process.env){return{baseUrl:e[y]?.trim()||w,appId:e[b]?.trim()||void 0,functionName:e[h]?.trim()||void 0}}var x=60,u=class extends Error{};function T(e){return Array.isArray(e)&&e.every(t=>typeof t=="string")}function S(e,t){let o=t&&typeof t=="object"&&!Array.isArray(t)?t:{},r={expiresIn:e.expiresIn,allowedFunctions:e.allowedFunctions,allowedOrigins:e.allowedOrigins,maxSessionS:e.maxSessionS},s=o.expiresIn;if(s!==void 0){if(typeof s!="number"||!Number.isInteger(s)||s<1)throw new u("expiresIn must be a positive integer");let a=e.expiresIn??x;if(s>a)throw new u(`expiresIn may not exceed the configured ${a}s`);r.expiresIn=s}let n=(a,d,f)=>{if(a===void 0)return d;if(!T(a))throw new u(`${f} must be an array of strings`);if(d){let l=a.filter(m=>!d.includes(m));if(l.length>0)throw new u(`${f} may only narrow the configured allowlist (rejected: ${l.join(", ")})`)}return a};r.allowedFunctions=n(o.allowedFunctions,e.allowedFunctions,"allowedFunctions"),r.allowedOrigins=n(o.allowedOrigins,e.allowedOrigins,"allowedOrigins");let i=o.maxSessionS;if(i!==void 0){if(typeof i!="number"||!Number.isInteger(i)||i<1)throw new u("maxSessionS must be a positive integer");r.maxSessionS=e.maxSessionS===void 0?i:Math.min(e.maxSessionS,i)}return r}async function R(e,t){return e.authorize?await e.authorize(t)?void 0:{status:401,body:{message:"unauthorized"}}:(console.error("[urun] token route: options.authorize is required before minting"),{status:401,body:{message:"unauthorized"}})}async function c(e,t,o){let r=e.apiKey??process.env[g];if(!r)return console.error(`[urun] token route: no API key \u2014 set ${g} or pass options.apiKey`),{status:500,body:{message:"token route not configured"}};let s;try{s=S(e,t)}catch(n){if(n instanceof u)return{status:400,body:{message:n.message}};throw n}try{let n=await k(r,{baseUrl:e.baseUrl,expiresIn:s.expiresIn,allowedFunctions:s.allowedFunctions,allowedOrigins:s.allowedOrigins,maxSessionS:s.maxSessionS,metadata:e.metadata,subject:o,fetch:e.fetch});return{status:200,body:{token:n.token,expiresAt:n.expiresAt.toISOString(),orgId:n.orgId}}}catch(n){let i=n instanceof U?`${n.message} (status ${n.status??"n/a"})`:n instanceof Error?n.message:String(n);return console.error(`[urun] token route: mint failed: ${i}`),{status:502,body:{message:"token mint failed"}}}}function P(e){return async t=>{let o;try{o=await t.json()}catch{o=void 0}let r=await R(e,t);if(r)return new Response(JSON.stringify(r.body),{status:r.status,headers:{"content-type":"application/json"}});let s=e.subject?await e.subject(t):void 0,{status:n,body:i}=await c(e,o,s);return new Response(JSON.stringify(i),{status:n,headers:{"content-type":"application/json"}})}}function O(){return(process.env[y]?.trim()||w).replace(/\/+$/,"")}var p=!1;function A(e={}){return async t=>{let o;try{o=await t.json()}catch{o=void 0}if(e.authorize){if(!await e.authorize(t))return new Response(JSON.stringify({message:"unauthorized"}),{status:401,headers:{"content-type":"application/json"}})}else p||(p=!0,console.warn("[urun] createTokenRoute: minting for ANY caller \u2014 pass { authorize } to restrict the endpoint to your authenticated users"));let r=e.subject?await e.subject(t):void 0,s=O(),{status:n,body:i}=await c({...e,baseUrl:s},o,r);if(n!==200)return new Response(JSON.stringify(i),{status:n,headers:{"content-type":"application/json"}});let a={...i,gatewayUrl:s};return new Response(JSON.stringify(a),{status:200,headers:{"content-type":"application/json"}})}}function j(e){return async(t,o)=>{if((t.method??"GET").toUpperCase()!=="POST"){o.status(405).json({message:"method not allowed"});return}let r=await R(e,t);if(r){o.status(r.status).json(r.body);return}let{status:s,body:n}=await c(e,t.body,void 0);o.status(s).json(n)}}export{g as URUN_API_KEY_ENV,b as URUN_APP_ENV,h as URUN_FUNCTION_ENV,y as URUN_GATEWAY_URL_ENV,A as createTokenRoute,I as urunSessionConfig,j as urunTokenPagesHandler,P as urunTokenRoute};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@urun-sh/next",
-  "version": "0.2.26",
+  "version": "0.2.29",
   "description": "Next.js on-ramp for uRun scoped client tokens — a fully-built token route in one import and one line.",
   "repository": {
     "type": "git",
@@ -31,22 +31,23 @@
   "files": [
     "dist"
   ],
+  "scripts": {
+    "build": "tsup && node ../../scripts/sanitize-dist.mjs .",
+    "prepack": "pnpm build",
+    "test": "vitest run",
+    "dev": "tsup --watch"
+  },
   "peerDependencies": {
-    "@urun-sh/core": "^0.2.26"
+    "@urun-sh/core": "^0.2.2"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",
+    "@urun-sh/core": "workspace:*",
     "tsup": "^8.5.0",
     "typescript": "^5.3.0",
-    "vitest": "^3.0.0",
-    "@urun-sh/core": "0.2.26"
+    "vitest": "^3.0.0"
   },
   "publishConfig": {
     "access": "public"
-  },
-  "scripts": {
-    "build": "tsup && node ../../scripts/sanitize-dist.mjs .",
-    "test": "vitest run",
-    "dev": "tsup --watch"
   }
-}
+}

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 urun contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.