@urun-sh/next 0.2.32 → 0.2.33

package/dist/index.cjs

@@ -1 +1 @@
-"use strict";var f=Object.defineProperty;var h=Object.getOwnPropertyDescriptor;var x=Object.getOwnPropertyNames;var T=Object.prototype.hasOwnProperty;var S=(e,n)=>{for(var o in n)f(e,o,{get:n[o],enumerable:!0})},O=(e,n,o,r)=>{if(n&&typeof n=="object"||typeof n=="function")for(let t of x(n))!T.call(e,t)&&t!==o&&f(e,t,{get:()=>n[t],enumerable:!(r=h(n,t))||r.enumerable});return e};var N=e=>O(f({},"__esModule",{value:!0}),e);var q={};S(q,{URUN_API_KEY_ENV:()=>l,URUN_APP_ENV:()=>m,URUN_FUNCTION_ENV:()=>k,URUN_GATEWAY_URL_ENV:()=>g,createTokenRoute:()=>C,urunSessionConfig:()=>I,urunTokenPagesHandler:()=>E,urunTokenRoute:()=>_});module.exports=N(q);var d=require("@urun-sh/core"),l="URUN_API_KEY",g="URUN_GATEWAY_URL",m="URUN_APP",k="URUN_FUNCTION";function I(e=process.env){return{baseUrl:e[g]?.trim()||d.DEFAULT_GATEWAY_URL,appId:e[m]?.trim()||void 0,functionName:e[k]?.trim()||void 0}}var P=60,u=class extends Error{};function A(e){return Array.isArray(e)&&e.every(n=>typeof n=="string")}function j(e,n){let o=n&&typeof n=="object"&&!Array.isArray(n)?n:{},r={expiresIn:e.expiresIn,allowedFunctions:e.allowedFunctions,allowedOrigins:e.allowedOrigins,maxSessionS:e.maxSessionS},t=o.expiresIn;if(t!==void 0){if(typeof t!="number"||!Number.isInteger(t)||t<1)throw new u("expiresIn must be a positive integer");let a=e.expiresIn??P;if(t>a)throw new u(`expiresIn may not exceed the configured ${a}s`);r.expiresIn=t}let s=(a,c,w)=>{if(a===void 0)return c;if(!A(a))throw new u(`${w} must be an array of strings`);if(c){let y=a.filter(b=>!c.includes(b));if(y.length>0)throw new u(`${w} may only narrow the configured allowlist (rejected: ${y.join(", ")})`)}return a};r.allowedFunctions=s(o.allowedFunctions,e.allowedFunctions,"allowedFunctions"),r.allowedOrigins=s(o.allowedOrigins,e.allowedOrigins,"allowedOrigins");let i=o.maxSessionS;if(i!==void 0){if(typeof i!="number"||!Number.isInteger(i)||i<1)throw new u("maxSessionS must be a positive integer");r.maxSessionS=e.maxSessionS===void 0?i:Math.min(e.maxSessionS,i)}return r}async function U(e,n){return e.authorize?await e.authorize(n)?void 0:{status:401,body:{message:"unauthorized"}}:(console.error("[urun] token route: options.authorize is required before minting"),{status:401,body:{message:"unauthorized"}})}async function p(e,n,o){let r=e.apiKey??process.env[l];if(!r)return console.error(`[urun] token route: no API key \u2014 set ${l} or pass options.apiKey`),{status:500,body:{message:"token route not configured"}};let t;try{t=j(e,n)}catch(s){if(s instanceof u)return{status:400,body:{message:s.message}};throw s}try{let s=await(0,d.createClientToken)(r,{baseUrl:e.baseUrl,expiresIn:t.expiresIn,allowedFunctions:t.allowedFunctions,allowedOrigins:t.allowedOrigins,maxSessionS:t.maxSessionS,metadata:e.metadata,subject:o,fetch:e.fetch});return{status:200,body:{token:s.token,expiresAt:s.expiresAt.toISOString(),orgId:s.orgId}}}catch(s){let i=s instanceof d.ClientTokenError?`${s.message} (status ${s.status??"n/a"})`:s instanceof Error?s.message:String(s);return console.error(`[urun] token route: mint failed: ${i}`),{status:502,body:{message:"token mint failed"}}}}function _(e){return async n=>{let o;try{o=await n.json()}catch{o=void 0}let r=await U(e,n);if(r)return new Response(JSON.stringify(r.body),{status:r.status,headers:{"content-type":"application/json"}});let t=e.subject?await e.subject(n):void 0,{status:s,body:i}=await p(e,o,t);return new Response(JSON.stringify(i),{status:s,headers:{"content-type":"application/json"}})}}function z(){return(process.env[g]?.trim()||d.DEFAULT_GATEWAY_URL).replace(/\/+$/,"")}var R=!1;function C(e={}){return async n=>{let o;try{o=await n.json()}catch{o=void 0}if(e.authorize){if(!await e.authorize(n))return new Response(JSON.stringify({message:"unauthorized"}),{status:401,headers:{"content-type":"application/json"}})}else R||(R=!0,console.warn("[urun] createTokenRoute: minting for ANY caller \u2014 pass { authorize } to restrict the endpoint to your authenticated users"));let r=e.subject?await e.subject(n):void 0,t=z(),{status:s,body:i}=await p({...e,baseUrl:t},o,r);if(s!==200)return new Response(JSON.stringify(i),{status:s,headers:{"content-type":"application/json"}});let a={...i,gatewayUrl:t};return new Response(JSON.stringify(a),{status:200,headers:{"content-type":"application/json"}})}}function E(e){return async(n,o)=>{if((n.method??"GET").toUpperCase()!=="POST"){o.status(405).json({message:"method not allowed"});return}let r=await U(e,n);if(r){o.status(r.status).json(r.body);return}let{status:t,body:s}=await p(e,n.body,void 0);o.status(t).json(s)}}0&&(module.exports={URUN_API_KEY_ENV,URUN_APP_ENV,URUN_FUNCTION_ENV,URUN_GATEWAY_URL_ENV,createTokenRoute,urunSessionConfig,urunTokenPagesHandler,urunTokenRoute});
+"use strict";var I=Object.create;var g=Object.defineProperty;var v=Object.getOwnPropertyDescriptor;var P=Object.getOwnPropertyNames;var C=Object.getPrototypeOf,A=Object.prototype.hasOwnProperty;var E=(e,n)=>{for(var t in n)g(e,t,{get:n[t],enumerable:!0})},U=(e,n,t,o)=>{if(n&&typeof n=="object"||typeof n=="function")for(let r of P(n))!A.call(e,r)&&r!==t&&g(e,r,{get:()=>n[r],enumerable:!(o=v(n,r))||o.enumerable});return e};var p=(e,n,t)=>(t=e!=null?I(C(e)):{},U(n||!e||!e.__esModule?g(t,"default",{value:e,enumerable:!0}):t,e)),j=e=>U(g({},"__esModule",{value:!0}),e);var J={};E(J,{MissingCredentialError:()=>u,URUN_API_KEY_ENV:()=>b,URUN_API_URL_ENV:()=>N,URUN_APP_ENV:()=>T,URUN_FUNCTION_ENV:()=>_,URUN_GATEWAY_URL_ENV:()=>y,createTokenRoute:()=>B,resolveCredential:()=>f,urunSessionConfig:()=>z,urunTokenPagesHandler:()=>V,urunTokenRoute:()=>Y});module.exports=j(J);var l=require("@urun-sh/core");var u=class extends Error{constructor(){super("[urun] no credential \u2014 set URUN_API_KEY in the server env (e.g. frontend/.env.local) or run `urun login`"),this.name="MissingCredentialError"}};function F(e){return e.replace(/\/+$/,"").replace(/\/v\d+$/,"")||void 0}function K(e,n,t){let o=e.URUN_CONFIG_HOME?.trim();if(o)return t(o,"credentials.json");let r=e.XDG_CONFIG_HOME?.trim();return r?t(r,"urun","credentials.json"):t(n(),".config","urun","credentials.json")}var k;function h(e){k!==e&&(k=e,console.info(e))}async function f(e=process.env){let n=e.URUN_API_KEY?.trim();if(n)return h("[urun] token route: using URUN_API_KEY from the server environment"),{apiKey:n,source:"env"};if(e.NODE_ENV!=="development")throw new u;let[{readFile:t},{homedir:o},{join:r}]=await Promise.all([import("fs/promises"),import("os"),import("path")]),s=K(e,o,r),i;try{i=JSON.parse(await t(s,"utf8"))}catch{throw new u}let a=typeof i.api_key=="string"?i.api_key.trim():"";if(!a)throw new u;let d=typeof i.api_url=="string"?i.api_url.trim():"";return h(`[urun] token route: dev fallback \u2014 using the urun CLI login credential (${s})`),{apiKey:a,source:"urun-login",gatewayUrl:d?F(d):void 0}}var b="URUN_API_KEY",y="URUN_GATEWAY_URL",N="URUN_API_URL",T="URUN_APP",_="URUN_FUNCTION";function z(e=process.env){return{baseUrl:e[y]?.trim()||l.DEFAULT_GATEWAY_URL,appId:e[T]?.trim()||void 0,functionName:e[_]?.trim()||void 0}}var q=60,c=class extends Error{};function $(e){return Array.isArray(e)&&e.every(n=>typeof n=="string")}function L(e,n){let t=n&&typeof n=="object"&&!Array.isArray(n)?n:{},o={expiresIn:e.expiresIn,allowedFunctions:e.allowedFunctions,allowedOrigins:e.allowedOrigins,maxSessionS:e.maxSessionS},r=t.expiresIn;if(r!==void 0){if(typeof r!="number"||!Number.isInteger(r)||r<1)throw new c("expiresIn must be a positive integer");let a=e.expiresIn??q;if(r>a)throw new c(`expiresIn may not exceed the configured ${a}s`);o.expiresIn=r}let s=(a,d,w)=>{if(a===void 0)return d;if(!$(a))throw new c(`${w} must be an array of strings`);if(d){let R=a.filter(S=>!d.includes(S));if(R.length>0)throw new c(`${w} may only narrow the configured allowlist (rejected: ${R.join(", ")})`)}return a};o.allowedFunctions=s(t.allowedFunctions,e.allowedFunctions,"allowedFunctions"),o.allowedOrigins=s(t.allowedOrigins,e.allowedOrigins,"allowedOrigins");let i=t.maxSessionS;if(i!==void 0){if(typeof i!="number"||!Number.isInteger(i)||i<1)throw new c("maxSessionS must be a positive integer");o.maxSessionS=e.maxSessionS===void 0?i:Math.min(e.maxSessionS,i)}return o}async function O(e,n){return e.authorize?await e.authorize(n)?void 0:{status:401,body:{message:"unauthorized"}}:(console.error("[urun] token route: options.authorize is required before minting"),{status:401,body:{message:"unauthorized"}})}async function m(e,n,t){let o=e.apiKey;if(!o)try{o=(await f()).apiKey}catch(s){let i=s instanceof u?s.message:`[urun] token route: no API key \u2014 set ${b} or pass options.apiKey`;return console.error(i),{status:500,body:{message:process.env.NODE_ENV==="development"?i:"token route not configured"}}}let r;try{r=L(e,n)}catch(s){if(s instanceof c)return{status:400,body:{message:s.message}};throw s}try{let s=await(0,l.createClientToken)(o,{baseUrl:e.baseUrl,expiresIn:r.expiresIn,allowedFunctions:r.allowedFunctions,allowedOrigins:r.allowedOrigins,maxSessionS:r.maxSessionS,metadata:e.metadata,subject:t,fetch:e.fetch});return{status:200,body:{token:s.token,expiresAt:s.expiresAt.toISOString(),orgId:s.orgId}}}catch(s){let i=s instanceof l.ClientTokenError?`${s.message} (status ${s.status??"n/a"})`:s instanceof Error?s.message:String(s);return console.error(`[urun] token route: mint failed: ${i}`),{status:502,body:{message:"token mint failed"}}}}function Y(e){return async n=>{let t;try{t=await n.json()}catch{t=void 0}let o=await O(e,n);if(o)return new Response(JSON.stringify(o.body),{status:o.status,headers:{"content-type":"application/json"}});let r=e.subject?await e.subject(n):void 0,{status:s,body:i}=await m(e,t,r);return new Response(JSON.stringify(i),{status:s,headers:{"content-type":"application/json"}})}}function G(e){return(process.env[y]?.trim()||e?.gatewayUrl||l.DEFAULT_GATEWAY_URL).replace(/\/+$/,"")}function M(e){return(process.env[N]?.trim()||e?.gatewayUrl||l.DEFAULT_GATEWAY_URL).replace(/\/+$/,"").replace(/\/v1$/,"")}var x=!1;function B(e={}){return async n=>{let t;try{t=await n.json()}catch{t=void 0}if(e.authorize){if(!await e.authorize(n))return new Response(JSON.stringify({message:"unauthorized"}),{status:401,headers:{"content-type":"application/json"}})}else x||(x=!0,console.warn("[urun] createTokenRoute: minting for ANY caller \u2014 pass { authorize } to restrict the endpoint to your authenticated users"));let o=e.subject?await e.subject(n):void 0,r;if(!e.apiKey)try{r=await f()}catch{r=void 0}let s=G(r),{status:i,body:a}=await m({...e,apiKey:e.apiKey??r?.apiKey,baseUrl:M(r)},t,o);if(i!==200)return new Response(JSON.stringify(a),{status:i,headers:{"content-type":"application/json"}});let d={...a,gatewayUrl:s};return new Response(JSON.stringify(d),{status:200,headers:{"content-type":"application/json"}})}}function V(e){return async(n,t)=>{if((n.method??"GET").toUpperCase()!=="POST"){t.status(405).json({message:"method not allowed"});return}let o=await O(e,n);if(o){t.status(o.status).json(o.body);return}let{status:r,body:s}=await m(e,n.body,void 0);t.status(r).json(s)}}0&&(module.exports={MissingCredentialError,URUN_API_KEY_ENV,URUN_API_URL_ENV,URUN_APP_ENV,URUN_FUNCTION_ENV,URUN_GATEWAY_URL_ENV,createTokenRoute,resolveCredential,urunSessionConfig,urunTokenPagesHandler,urunTokenRoute});

package/dist/index.d.cts

@@ -1,5 +1,45 @@
 import { CreateClientTokenOptions } from '@urun-sh/core';
 
+/**
+ * LOCAL-DEV credential resolution for the token route (owner ruling
+ * 2026-07-15: raw `pnpm dev` works without the CLI).
+ *
+ * Precedence:
+ *   1. `URUN_API_KEY` in the server env — the production contract, always.
+ *   2. DEV ONLY (`NODE_ENV === 'development'`, i.e. `next dev`): the urun
+ *      CLI's own stored login credential, `~/.config/urun/credentials.json` —
+ *      the SAME file `urun login` writes (same path rules: `URUN_CONFIG_HOME`,
+ *      then `XDG_CONFIG_HOME/urun`, then `~/.config/urun`; same JSON shape:
+ *      `{ api_key, api_url, ... }`). Never a second format, never active in
+ *      production builds or deployed frontends.
+ *
+ * The login file also carries the control-plane `api_url`, from which the
+ * org's session gateway derives exactly like the CLI's `resolve_gateway_url`
+ * (strip a trailing `/v<N>` version segment) — so a dev-cluster login dials
+ * the dev gateway instead of silently defaulting to the prod front door.
+ */
+/** Thrown when no credential exists anywhere — carries the actionable fix. */
+declare class MissingCredentialError extends Error {
+    constructor();
+}
+interface ResolvedCredential {
+    apiKey: string;
+    /** Where the key came from — logged once, honestly. */
+    source: 'env' | 'urun-login';
+    /**
+     * Gateway derived FROM THE CREDENTIAL ITSELF (login-file `api_url` with the
+     * `/v<N>` control-plane path stripped). Undefined for env keys — the
+     * deployed contract stays `URUN_GATEWAY_URL`-or-platform-default.
+     */
+    gatewayUrl?: string;
+}
+/**
+ * Resolve the token route's org API key: env first, then (dev server only)
+ * the urun CLI login file. Exactly one honest log line states the source.
+ * Throws {@link MissingCredentialError} when neither exists.
+ */
+declare function resolveCredential(env?: Record<string, string | undefined>): Promise<ResolvedCredential>;
+
 /**
  * @urun-sh/next — the Next.js on-ramp for uRun scoped client tokens.
  *
@@ -33,6 +73,8 @@ declare const URUN_API_KEY_ENV = "URUN_API_KEY";
  * provider as props.
  */
 declare const URUN_GATEWAY_URL_ENV = "URUN_GATEWAY_URL";
+/** Server env var naming the API front door the token route MINTS against. */
+declare const URUN_API_URL_ENV = "URUN_API_URL";
 declare const URUN_APP_ENV = "URUN_APP";
 declare const URUN_FUNCTION_ENV = "URUN_FUNCTION";
 /** The frontend's resolved session-plane config (see {@link urunSessionConfig}). */
@@ -158,4 +200,4 @@ declare function createTokenRoute(options?: CreateTokenRouteOptions): (request:
  */
 declare function urunTokenPagesHandler(options: UrunTokenRouteOptions): (req: UrunTokenPagesRequest, res: UrunTokenPagesResponse) => Promise<void>;
 
-export { type CreateTokenRouteOptions, type CreateTokenRouteResponseBody, URUN_API_KEY_ENV, URUN_APP_ENV, URUN_FUNCTION_ENV, URUN_GATEWAY_URL_ENV, type UrunSessionConfig, type UrunTokenPagesRequest, type UrunTokenPagesResponse, type UrunTokenResponseBody, type UrunTokenRouteOptions, createTokenRoute, urunSessionConfig, urunTokenPagesHandler, urunTokenRoute };
+export { type CreateTokenRouteOptions, type CreateTokenRouteResponseBody, MissingCredentialError, URUN_API_KEY_ENV, URUN_API_URL_ENV, URUN_APP_ENV, URUN_FUNCTION_ENV, URUN_GATEWAY_URL_ENV, type UrunSessionConfig, type UrunTokenPagesRequest, type UrunTokenPagesResponse, type UrunTokenResponseBody, type UrunTokenRouteOptions, createTokenRoute, resolveCredential, urunSessionConfig, urunTokenPagesHandler, urunTokenRoute };

package/dist/index.d.ts

@@ -1,8 +1,23 @@
 import { CreateClientTokenOptions } from '@urun-sh/core';
 
+declare class MissingCredentialError extends Error {
+    constructor();
+}
+interface ResolvedCredential {
+    apiKey: string;
+    
+    source: 'env' | 'urun-login';
+    
+    gatewayUrl?: string;
+}
+
+declare function resolveCredential(env?: Record<string, string | undefined>): Promise<ResolvedCredential>;
+
 declare const URUN_API_KEY_ENV = "URUN_API_KEY";
 
 declare const URUN_GATEWAY_URL_ENV = "URUN_GATEWAY_URL";
+
+declare const URUN_API_URL_ENV = "URUN_API_URL";
 declare const URUN_APP_ENV = "URUN_APP";
 declare const URUN_FUNCTION_ENV = "URUN_FUNCTION";
 
@@ -58,4 +73,4 @@ declare function createTokenRoute(options?: CreateTokenRouteOptions): (request:
 
 declare function urunTokenPagesHandler(options: UrunTokenRouteOptions): (req: UrunTokenPagesRequest, res: UrunTokenPagesResponse) => Promise<void>;
 
-export { type CreateTokenRouteOptions, type CreateTokenRouteResponseBody, URUN_API_KEY_ENV, URUN_APP_ENV, URUN_FUNCTION_ENV, URUN_GATEWAY_URL_ENV, type UrunSessionConfig, type UrunTokenPagesRequest, type UrunTokenPagesResponse, type UrunTokenResponseBody, type UrunTokenRouteOptions, createTokenRoute, urunSessionConfig, urunTokenPagesHandler, urunTokenRoute };
+export { type CreateTokenRouteOptions, type CreateTokenRouteResponseBody, MissingCredentialError, URUN_API_KEY_ENV, URUN_API_URL_ENV, URUN_APP_ENV, URUN_FUNCTION_ENV, URUN_GATEWAY_URL_ENV, type UrunSessionConfig, type UrunTokenPagesRequest, type UrunTokenPagesResponse, type UrunTokenResponseBody, type UrunTokenRouteOptions, createTokenRoute, resolveCredential, urunSessionConfig, urunTokenPagesHandler, urunTokenRoute };

package/dist/index.js

@@ -1 +1 @@
-import{createClientToken as k,ClientTokenError as U,DEFAULT_GATEWAY_URL as w}from"@urun-sh/core";var g="URUN_API_KEY",y="URUN_GATEWAY_URL",b="URUN_APP",h="URUN_FUNCTION";function I(e=process.env){return{baseUrl:e[y]?.trim()||w,appId:e[b]?.trim()||void 0,functionName:e[h]?.trim()||void 0}}var x=60,u=class extends Error{};function T(e){return Array.isArray(e)&&e.every(t=>typeof t=="string")}function S(e,t){let o=t&&typeof t=="object"&&!Array.isArray(t)?t:{},r={expiresIn:e.expiresIn,allowedFunctions:e.allowedFunctions,allowedOrigins:e.allowedOrigins,maxSessionS:e.maxSessionS},s=o.expiresIn;if(s!==void 0){if(typeof s!="number"||!Number.isInteger(s)||s<1)throw new u("expiresIn must be a positive integer");let a=e.expiresIn??x;if(s>a)throw new u(`expiresIn may not exceed the configured ${a}s`);r.expiresIn=s}let n=(a,d,f)=>{if(a===void 0)return d;if(!T(a))throw new u(`${f} must be an array of strings`);if(d){let l=a.filter(m=>!d.includes(m));if(l.length>0)throw new u(`${f} may only narrow the configured allowlist (rejected: ${l.join(", ")})`)}return a};r.allowedFunctions=n(o.allowedFunctions,e.allowedFunctions,"allowedFunctions"),r.allowedOrigins=n(o.allowedOrigins,e.allowedOrigins,"allowedOrigins");let i=o.maxSessionS;if(i!==void 0){if(typeof i!="number"||!Number.isInteger(i)||i<1)throw new u("maxSessionS must be a positive integer");r.maxSessionS=e.maxSessionS===void 0?i:Math.min(e.maxSessionS,i)}return r}async function R(e,t){return e.authorize?await e.authorize(t)?void 0:{status:401,body:{message:"unauthorized"}}:(console.error("[urun] token route: options.authorize is required before minting"),{status:401,body:{message:"unauthorized"}})}async function c(e,t,o){let r=e.apiKey??process.env[g];if(!r)return console.error(`[urun] token route: no API key \u2014 set ${g} or pass options.apiKey`),{status:500,body:{message:"token route not configured"}};let s;try{s=S(e,t)}catch(n){if(n instanceof u)return{status:400,body:{message:n.message}};throw n}try{let n=await k(r,{baseUrl:e.baseUrl,expiresIn:s.expiresIn,allowedFunctions:s.allowedFunctions,allowedOrigins:s.allowedOrigins,maxSessionS:s.maxSessionS,metadata:e.metadata,subject:o,fetch:e.fetch});return{status:200,body:{token:n.token,expiresAt:n.expiresAt.toISOString(),orgId:n.orgId}}}catch(n){let i=n instanceof U?`${n.message} (status ${n.status??"n/a"})`:n instanceof Error?n.message:String(n);return console.error(`[urun] token route: mint failed: ${i}`),{status:502,body:{message:"token mint failed"}}}}function P(e){return async t=>{let o;try{o=await t.json()}catch{o=void 0}let r=await R(e,t);if(r)return new Response(JSON.stringify(r.body),{status:r.status,headers:{"content-type":"application/json"}});let s=e.subject?await e.subject(t):void 0,{status:n,body:i}=await c(e,o,s);return new Response(JSON.stringify(i),{status:n,headers:{"content-type":"application/json"}})}}function O(){return(process.env[y]?.trim()||w).replace(/\/+$/,"")}var p=!1;function A(e={}){return async t=>{let o;try{o=await t.json()}catch{o=void 0}if(e.authorize){if(!await e.authorize(t))return new Response(JSON.stringify({message:"unauthorized"}),{status:401,headers:{"content-type":"application/json"}})}else p||(p=!0,console.warn("[urun] createTokenRoute: minting for ANY caller \u2014 pass { authorize } to restrict the endpoint to your authenticated users"));let r=e.subject?await e.subject(t):void 0,s=O(),{status:n,body:i}=await c({...e,baseUrl:s},o,r);if(n!==200)return new Response(JSON.stringify(i),{status:n,headers:{"content-type":"application/json"}});let a={...i,gatewayUrl:s};return new Response(JSON.stringify(a),{status:200,headers:{"content-type":"application/json"}})}}function j(e){return async(t,o)=>{if((t.method??"GET").toUpperCase()!=="POST"){o.status(405).json({message:"method not allowed"});return}let r=await R(e,t);if(r){o.status(r.status).json(r.body);return}let{status:s,body:n}=await c(e,t.body,void 0);o.status(s).json(n)}}export{g as URUN_API_KEY_ENV,b as URUN_APP_ENV,h as URUN_FUNCTION_ENV,y as URUN_GATEWAY_URL_ENV,A as createTokenRoute,I as urunSessionConfig,j as urunTokenPagesHandler,P as urunTokenRoute};
+import{createClientToken as N,ClientTokenError as T,DEFAULT_GATEWAY_URL as f}from"@urun-sh/core";var d=class extends Error{constructor(){super("[urun] no credential \u2014 set URUN_API_KEY in the server env (e.g. frontend/.env.local) or run `urun login`"),this.name="MissingCredentialError"}};function x(e){return e.replace(/\/+$/,"").replace(/\/v\d+$/,"")||void 0}function b(e,n,s){let o=e.URUN_CONFIG_HOME?.trim();if(o)return s(o,"credentials.json");let r=e.XDG_CONFIG_HOME?.trim();return r?s(r,"urun","credentials.json"):s(n(),".config","urun","credentials.json")}var m;function w(e){m!==e&&(m=e,console.info(e))}async function l(e=process.env){let n=e.URUN_API_KEY?.trim();if(n)return w("[urun] token route: using URUN_API_KEY from the server environment"),{apiKey:n,source:"env"};if(e.NODE_ENV!=="development")throw new d;let[{readFile:s},{homedir:o},{join:r}]=await Promise.all([import("fs/promises"),import("os"),import("path")]),t=b(e,o,r),i;try{i=JSON.parse(await s(t,"utf8"))}catch{throw new d}let a=typeof i.api_key=="string"?i.api_key.trim():"";if(!a)throw new d;let u=typeof i.api_url=="string"?i.api_url.trim():"";return w(`[urun] token route: dev fallback \u2014 using the urun CLI login credential (${t})`),{apiKey:a,source:"urun-login",gatewayUrl:u?x(u):void 0}}var _="URUN_API_KEY",U="URUN_GATEWAY_URL",O="URUN_API_URL",S="URUN_APP",I="URUN_FUNCTION";function z(e=process.env){return{baseUrl:e[U]?.trim()||f,appId:e[S]?.trim()||void 0,functionName:e[I]?.trim()||void 0}}var v=60,c=class extends Error{};function P(e){return Array.isArray(e)&&e.every(n=>typeof n=="string")}function C(e,n){let s=n&&typeof n=="object"&&!Array.isArray(n)?n:{},o={expiresIn:e.expiresIn,allowedFunctions:e.allowedFunctions,allowedOrigins:e.allowedOrigins,maxSessionS:e.maxSessionS},r=s.expiresIn;if(r!==void 0){if(typeof r!="number"||!Number.isInteger(r)||r<1)throw new c("expiresIn must be a positive integer");let a=e.expiresIn??v;if(r>a)throw new c(`expiresIn may not exceed the configured ${a}s`);o.expiresIn=r}let t=(a,u,p)=>{if(a===void 0)return u;if(!P(a))throw new c(`${p} must be an array of strings`);if(u){let y=a.filter(h=>!u.includes(h));if(y.length>0)throw new c(`${p} may only narrow the configured allowlist (rejected: ${y.join(", ")})`)}return a};o.allowedFunctions=t(s.allowedFunctions,e.allowedFunctions,"allowedFunctions"),o.allowedOrigins=t(s.allowedOrigins,e.allowedOrigins,"allowedOrigins");let i=s.maxSessionS;if(i!==void 0){if(typeof i!="number"||!Number.isInteger(i)||i<1)throw new c("maxSessionS must be a positive integer");o.maxSessionS=e.maxSessionS===void 0?i:Math.min(e.maxSessionS,i)}return o}async function k(e,n){return e.authorize?await e.authorize(n)?void 0:{status:401,body:{message:"unauthorized"}}:(console.error("[urun] token route: options.authorize is required before minting"),{status:401,body:{message:"unauthorized"}})}async function g(e,n,s){let o=e.apiKey;if(!o)try{o=(await l()).apiKey}catch(t){let i=t instanceof d?t.message:`[urun] token route: no API key \u2014 set ${_} or pass options.apiKey`;return console.error(i),{status:500,body:{message:process.env.NODE_ENV==="development"?i:"token route not configured"}}}let r;try{r=C(e,n)}catch(t){if(t instanceof c)return{status:400,body:{message:t.message}};throw t}try{let t=await N(o,{baseUrl:e.baseUrl,expiresIn:r.expiresIn,allowedFunctions:r.allowedFunctions,allowedOrigins:r.allowedOrigins,maxSessionS:r.maxSessionS,metadata:e.metadata,subject:s,fetch:e.fetch});return{status:200,body:{token:t.token,expiresAt:t.expiresAt.toISOString(),orgId:t.orgId}}}catch(t){let i=t instanceof T?`${t.message} (status ${t.status??"n/a"})`:t instanceof Error?t.message:String(t);return console.error(`[urun] token route: mint failed: ${i}`),{status:502,body:{message:"token mint failed"}}}}function q(e){return async n=>{let s;try{s=await n.json()}catch{s=void 0}let o=await k(e,n);if(o)return new Response(JSON.stringify(o.body),{status:o.status,headers:{"content-type":"application/json"}});let r=e.subject?await e.subject(n):void 0,{status:t,body:i}=await g(e,s,r);return new Response(JSON.stringify(i),{status:t,headers:{"content-type":"application/json"}})}}function A(e){return(process.env[U]?.trim()||e?.gatewayUrl||f).replace(/\/+$/,"")}function E(e){return(process.env[O]?.trim()||e?.gatewayUrl||f).replace(/\/+$/,"").replace(/\/v1$/,"")}var R=!1;function $(e={}){return async n=>{let s;try{s=await n.json()}catch{s=void 0}if(e.authorize){if(!await e.authorize(n))return new Response(JSON.stringify({message:"unauthorized"}),{status:401,headers:{"content-type":"application/json"}})}else R||(R=!0,console.warn("[urun] createTokenRoute: minting for ANY caller \u2014 pass { authorize } to restrict the endpoint to your authenticated users"));let o=e.subject?await e.subject(n):void 0,r;if(!e.apiKey)try{r=await l()}catch{r=void 0}let t=A(r),{status:i,body:a}=await g({...e,apiKey:e.apiKey??r?.apiKey,baseUrl:E(r)},s,o);if(i!==200)return new Response(JSON.stringify(a),{status:i,headers:{"content-type":"application/json"}});let u={...a,gatewayUrl:t};return new Response(JSON.stringify(u),{status:200,headers:{"content-type":"application/json"}})}}function L(e){return async(n,s)=>{if((n.method??"GET").toUpperCase()!=="POST"){s.status(405).json({message:"method not allowed"});return}let o=await k(e,n);if(o){s.status(o.status).json(o.body);return}let{status:r,body:t}=await g(e,n.body,void 0);s.status(r).json(t)}}export{d as MissingCredentialError,_ as URUN_API_KEY_ENV,O as URUN_API_URL_ENV,S as URUN_APP_ENV,I as URUN_FUNCTION_ENV,U as URUN_GATEWAY_URL_ENV,$ as createTokenRoute,l as resolveCredential,z as urunSessionConfig,L as urunTokenPagesHandler,q as urunTokenRoute};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@urun-sh/next",
-  "version": "0.2.32",
+  "version": "0.2.33",
   "description": "Next.js on-ramp for uRun scoped client tokens — a fully-built token route in one import and one line.",
   "repository": {
     "type": "git",