@useupup/next 3.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Devino
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,113 @@
+# @useupup/next
+
+Next.js integration for the [upup](https://github.com/DevinoSolutions/upup) uploader. One install gives you the client UI and the server handlers, split across two entry points so the AWS SDK never reaches your client bundle.
+
+## Install
+
+```sh
+npm i @useupup/next
+```
+
+## Client (App Router or Pages Router)
+
+```tsx
+import { UpupUploader } from '@useupup/next'
+import '@useupup/next/styles'
+
+export default function Page() {
+    return <UpupUploader mode="server" serverUrl="/api/upup" />
+}
+```
+
+`@useupup/next` re-exports the full `@useupup/react` client, so client mode
+(`<UpupUploader provider="aws" uploadEndpoint="/api/upload-token" />`, no
+`@useupup/server`) works too.
+
+## Server — App Router (`app/api/upup/[...path]/route.ts`)
+
+```ts
+import { createUpupNextHandler, defineUpupConfig } from '@useupup/next/server'
+
+export const dynamic = 'force-dynamic'
+export const maxDuration = 60
+
+export const { GET, POST, PUT, DELETE } = createUpupNextHandler(
+    defineUpupConfig({
+        storage: {
+            type: 'aws',
+            bucket: process.env.S3_BUCKET!,
+            region: process.env.S3_REGION! /* creds... */,
+        },
+        // REQUIRED — HMAC-signs upload tokens. Must be ≥16 chars and identical
+        // on every instance; the handler THROWS at construction time without it.
+        uploadTokenSecret: process.env.UPUP_UPLOAD_TOKEN_SECRET!,
+    }),
+)
+```
+
+## Server — Pages Router (`pages/api/upup/[...path].ts`)
+
+```ts
+import { createUpupPagesHandler, defineUpupConfig } from '@useupup/next/server'
+
+export const config = { api: { bodyParser: false } } // REQUIRED — we read the raw body
+
+export default createUpupPagesHandler(
+    defineUpupConfig({
+        storage: {
+            type: 'aws',
+            bucket: process.env.S3_BUCKET!,
+            region: process.env.S3_REGION!,
+        },
+        // REQUIRED (≥16 chars) — the handler throws at construction without it.
+        uploadTokenSecret: process.env.UPUP_UPLOAD_TOKEN_SECRET!,
+    }),
+)
+```
+
+## Deploying to serverless (Vercel / Lambda / Netlify)
+
+- **Persist OAuth state + tokens.** The default `InMemoryTokenStore` keeps OAuth
+  `state` and drive tokens in a process-local `Map`. On serverless the redirect and
+  callback can hit different instances, so login fails with `400 "Invalid or expired
+state"`. Implement the `TokenStore { get, set, delete }` interface against Redis /
+  Upstash / KV and pass it as `config.tokenStore`.
+- **Function timeout.** Server-mode drive→S3 transfer streams _through_ the function.
+  Set `maxDuration` (App Router segment config) and raise it toward your platform max
+  for large files. (Direct local uploads bypass the function via presigned PUT.)
+- **Memory.** Server-mode drive→S3 transfers stream in fixed 5 MiB chunks (files
+  ≤ 5 MiB upload as a single PUT), so the per-transfer memory envelope is one chunk
+  regardless of file size — even 128–256 MB functions are fine. This bound is not
+  configurable by design.
+- **Proxy/CDN origin.** Behind a proxy, pass `createUpupNextHandler(config, { baseUrl })`
+  (or `{ trustProxy: true }` to read `x-forwarded-*`) so the OAuth callback URL is
+  correct. No-op on Vercel App Router (`req.url` is already public).
+- **OAuth redirect URIs.** Register your deployed callback URL
+  (`https://<your-domain>/api/upup/auth/<provider>/cb`) in each drive provider's OAuth
+  app (Google / Dropbox / OneDrive / Box). It must match the origin that
+  `baseUrl`/`trustProxy` resolves to, or login fails with `redirect_uri_mismatch`.
+- **Bundling.** Add `serverExternalPackages: ['@aws-sdk/client-s3', '@aws-sdk/s3-request-presigner']`
+  to `next.config`.
+
+## Self-hosted (`next start` / Docker)
+
+- The in-memory store works for a single instance but breaks across replicas/restarts
+  — use a shared `TokenStore` when scaling horizontally.
+- No function timeout, so large transfers are fine; memory stays bounded at ~5 MiB
+  per concurrent transfer.
+
+## S3 bucket CORS
+
+Presigned uploads go browser→S3 directly, so the bucket's CORS policy must allow your
+site origin for `PUT` (and `GET` for previews). This is bucket configuration, not
+`@useupup/next` code.
+
+## Links
+
+- [Next.js quickstart](https://useupup.com/docs/quickstarts/next)
+- [Documentation](https://useupup.com/docs/)
+- [Source & monorepo](https://github.com/DevinoSolutions/upup)
+
+## License
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,27 @@
+"use client";
+"use strict";
+"use client";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+module.exports = __toCommonJS(index_exports);
+__reExport(index_exports, require("@useupup/react"), module.exports);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ...require("@useupup/react")
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["'use client'\r\nexport * from '@useupup/react'\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AACA,0BAAc,2BADd;","names":[]}

package/dist/index.d.cts

@@ -0,0 +1 @@
+export * from '@useupup/react';

package/dist/index.d.ts

@@ -0,0 +1 @@
+export * from '@useupup/react';

package/dist/index.js

@@ -0,0 +1,6 @@
+"use client";
+"use client";
+
+// src/index.ts
+export * from "@useupup/react";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["'use client'\r\nexport * from '@useupup/react'\r\n"],"mappings":";;;;AACA,cAAc;","names":[]}

package/dist/server.cjs

@@ -0,0 +1,112 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server.ts
+var server_exports = {};
+__export(server_exports, {
+  InMemoryTokenStore: () => import_server2.InMemoryTokenStore,
+  createUpupNextHandler: () => import_next.createUpupNextHandler,
+  createUpupPagesHandler: () => createUpupPagesHandler,
+  defineUpupConfig: () => defineUpupConfig,
+  normalizeRequestOrigin: () => import_next.normalizeRequestOrigin,
+  resolveOrigin: () => import_next.resolveOrigin
+});
+module.exports = __toCommonJS(server_exports);
+var import_next = require("@useupup/server/next");
+
+// src/pages-handler.ts
+var import_server = require("@useupup/server");
+var import_node_bridge = require("@useupup/server/node-bridge");
+function firstHeaderValue(value) {
+  const raw = Array.isArray(value) ? value[0] : value;
+  if (!raw) return void 0;
+  const first = raw.split(",")[0]?.trim();
+  return first || void 0;
+}
+function resolveBase(req, opts) {
+  if (opts?.baseUrl) return new URL(opts.baseUrl).origin;
+  const xfHost = firstHeaderValue(req.headers["x-forwarded-host"]);
+  const host = opts?.trustProxy && xfHost || req.headers.host || "localhost";
+  const xfProto = firstHeaderValue(req.headers["x-forwarded-proto"]);
+  const isLocal = host.startsWith("localhost") || host.startsWith("127.");
+  const proto = opts?.trustProxy && xfProto || (isLocal ? "http" : "https");
+  return `${proto}://${host}`;
+}
+async function readBody(req) {
+  const method = (req.method ?? "GET").toUpperCase();
+  if (method === "GET" || method === "HEAD") return void 0;
+  const chunks = [];
+  for await (const chunk of req) {
+    chunks.push(
+      typeof chunk === "string" ? Buffer.from(chunk) : chunk
+    );
+  }
+  return chunks.length ? new Uint8Array(Buffer.concat(chunks)) : void 0;
+}
+function createUpupPagesHandler(config, opts) {
+  const handler = (0, import_server.createUpupHandler)(config);
+  return async (req, res) => {
+    try {
+      const base = resolveBase(req, opts);
+      const body = await readBody(req);
+      const webReq = (0, import_node_bridge.toWebRequest)({
+        url: new URL(req.url ?? "/", base).toString(),
+        method: req.method ?? "GET",
+        headers: req.headers,
+        body
+      });
+      const webRes = await handler(webReq);
+      await (0, import_node_bridge.writeWebResponse)(
+        {
+          status: (c) => {
+            res.status(c);
+          },
+          setHeader: (k, v) => {
+            res.setHeader(k, v);
+          },
+          send: (b) => {
+            res.send(b);
+          }
+        },
+        webRes
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Internal error";
+      res.status(500).json({ error: message });
+    }
+  };
+}
+
+// src/define-config.ts
+function defineUpupConfig(config) {
+  return config;
+}
+
+// src/server.ts
+var import_server2 = require("@useupup/server");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  InMemoryTokenStore,
+  createUpupNextHandler,
+  createUpupPagesHandler,
+  defineUpupConfig,
+  normalizeRequestOrigin,
+  resolveOrigin
+});
+//# sourceMappingURL=server.cjs.map

package/dist/server.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server.ts","../src/pages-handler.ts","../src/define-config.ts"],"sourcesContent":["// App Router handler + origin utilities live in @useupup/server/next; this entry\r\n// re-exports them and adds the Pages Router adapter + config helper (Node-only).\r\nexport {\r\n    createUpupNextHandler,\r\n    normalizeRequestOrigin,\r\n    resolveOrigin,\r\n} from '@useupup/server/next'\r\nexport type { UpupNextOptions } from '@useupup/server/next'\r\n\r\nexport { createUpupPagesHandler } from './pages-handler'\r\nexport { defineUpupConfig } from './define-config'\r\n\r\n// Token-store utilities surfaced for the persistent-store guidance.\r\nexport { InMemoryTokenStore } from '@useupup/server'\r\nexport type { UpupServerConfig, TokenStore, DriveTokens } from '@useupup/server'\r\n","import type { NextApiRequest, NextApiResponse } from 'next'\r\nimport { createUpupHandler } from '@useupup/server'\r\nimport type { UpupServerConfig } from '@useupup/server'\r\nimport type { UpupNextOptions } from '@useupup/server/next'\r\nimport { toWebRequest, writeWebResponse } from '@useupup/server/node-bridge'\r\n\r\nfunction firstHeaderValue(\r\n    value: string | string[] | undefined,\r\n): string | undefined {\r\n    const raw = Array.isArray(value) ? value[0] : value\r\n    if (!raw) return undefined\r\n    const first = raw.split(',')[0]?.trim()\r\n    return first || undefined\r\n}\r\n\r\n/** Resolve the public origin for the Web Request we hand to the core handler. */\r\nfunction resolveBase(req: NextApiRequest, opts?: UpupNextOptions): string {\r\n    if (opts?.baseUrl) return new URL(opts.baseUrl).origin\r\n    const xfHost = firstHeaderValue(req.headers['x-forwarded-host'])\r\n    const host = (opts?.trustProxy && xfHost) || req.headers.host || 'localhost'\r\n    const xfProto = firstHeaderValue(req.headers['x-forwarded-proto'])\r\n    const isLocal = host.startsWith('localhost') || host.startsWith('127.')\r\n    const proto = (opts?.trustProxy && xfProto) || (isLocal ? 'http' : 'https')\r\n    return `${proto}://${host}`\r\n}\r\n\r\n/**\r\n * Yields the raw body as a plain `Uint8Array`, never the `Buffer` we assemble.\r\n * Under @types/node >=22 a `Buffer` types as `Buffer<ArrayBufferLike>`, which is\r\n * not assignable to `BodyInit` — copying into a fresh `Uint8Array` yields\r\n * `Uint8Array<ArrayBuffer>`, which every @types/node version accepts. The return\r\n * type is `RequestInit['body']` (the bridge's own parameter type) rather than a\r\n * bare `Uint8Array`, because bare `Uint8Array` means `Uint8Array<ArrayBufferLike>`\r\n * and would reintroduce the same mismatch at the annotation.\r\n */\r\nasync function readBody(\r\n    req: NextApiRequest,\r\n): Promise<RequestInit['body'] | undefined> {\r\n    const method = (req.method ?? 'GET').toUpperCase()\r\n    if (method === 'GET' || method === 'HEAD') return undefined\r\n    const chunks: Buffer[] = []\r\n    for await (const chunk of req) {\r\n        chunks.push(\r\n            typeof chunk === 'string' ? Buffer.from(chunk) : (chunk as Buffer),\r\n        )\r\n    }\r\n    return chunks.length ? new Uint8Array(Buffer.concat(chunks)) : undefined\r\n}\r\n\r\n/**\r\n * Pages Router (`pages/api/...`) adapter. Bridges Node req/res to the\r\n * framework-agnostic Web handler. The route MUST set\r\n * `export const config = { api: { bodyParser: false } }` so we receive the\r\n * raw request body. `opts.baseUrl` / `trustProxy` correct the OAuth callback\r\n * origin behind a proxy/CDN.\r\n */\r\nexport function createUpupPagesHandler(\r\n    config: UpupServerConfig,\r\n    opts?: UpupNextOptions,\r\n): (req: NextApiRequest, res: NextApiResponse) => Promise<void> {\r\n    const handler = createUpupHandler(config)\r\n    return async (req, res) => {\r\n        try {\r\n            const base = resolveBase(req, opts)\r\n            const body = await readBody(req)\r\n            const webReq = toWebRequest({\r\n                url: new URL(req.url ?? '/', base).toString(),\r\n                method: req.method ?? 'GET',\r\n                headers: req.headers,\r\n                body,\r\n            })\r\n            const webRes = await handler(webReq)\r\n            await writeWebResponse(\r\n                {\r\n                    status: c => {\r\n                        res.status(c)\r\n                    },\r\n                    setHeader: (k, v) => {\r\n                        res.setHeader(k, v)\r\n                    },\r\n                    send: b => {\r\n                        res.send(b)\r\n                    },\r\n                },\r\n                webRes,\r\n            )\r\n        } catch (err: unknown) {\r\n            // upup-catch: Pages Router top-level catch — maps handler errors to 500 JSON\r\n            const message =\r\n                err instanceof Error ? err.message : 'Internal error'\r\n            res.status(500).json({ error: message })\r\n        }\r\n    }\r\n}\r\n","import type { UpupServerConfig } from '@useupup/server'\r\n\r\n/**\r\n * Typed helper for authoring a server config with full editor autocomplete and\r\n * type-checking. Returns the config unchanged — a thin pass-through.\r\n *\r\n * Required-field validation is intentionally NOT performed here (F-852): it\r\n * lives at construct time inside @useupup/server's `createUpupHandler`, so it runs\r\n * for EVERY caller — including apps that call `createUpupNextHandler({...})`\r\n * directly without this wrapper (playground/landing did exactly that). A\r\n * `defineUpupConfig` that validated on its own left those direct callers\r\n * unprotected, which was the original bug this fold-in closes.\r\n */\r\nexport function defineUpupConfig(config: UpupServerConfig): UpupServerConfig {\r\n    return config\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,kBAIO;;;ACLP,oBAAkC;AAGlC,yBAA+C;AAE/C,SAAS,iBACL,OACkB;AAClB,QAAM,MAAM,MAAM,QAAQ,KAAK,IAAI,MAAM,CAAC,IAAI;AAC9C,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,QAAQ,IAAI,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACtC,SAAO,SAAS;AACpB;AAGA,SAAS,YAAY,KAAqB,MAAgC;AACtE,MAAI,MAAM,QAAS,QAAO,IAAI,IAAI,KAAK,OAAO,EAAE;AAChD,QAAM,SAAS,iBAAiB,IAAI,QAAQ,kBAAkB,CAAC;AAC/D,QAAM,OAAQ,MAAM,cAAc,UAAW,IAAI,QAAQ,QAAQ;AACjE,QAAM,UAAU,iBAAiB,IAAI,QAAQ,mBAAmB,CAAC;AACjE,QAAM,UAAU,KAAK,WAAW,WAAW,KAAK,KAAK,WAAW,MAAM;AACtE,QAAM,QAAS,MAAM,cAAc,YAAa,UAAU,SAAS;AACnE,SAAO,GAAG,KAAK,MAAM,IAAI;AAC7B;AAWA,eAAe,SACX,KACwC;AACxC,QAAM,UAAU,IAAI,UAAU,OAAO,YAAY;AACjD,MAAI,WAAW,SAAS,WAAW,OAAQ,QAAO;AAClD,QAAM,SAAmB,CAAC;AAC1B,mBAAiB,SAAS,KAAK;AAC3B,WAAO;AAAA,MACH,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAK;AAAA,IACtD;AAAA,EACJ;AACA,SAAO,OAAO,SAAS,IAAI,WAAW,OAAO,OAAO,MAAM,CAAC,IAAI;AACnE;AASO,SAAS,uBACZ,QACA,MAC4D;AAC5D,QAAM,cAAU,iCAAkB,MAAM;AACxC,SAAO,OAAO,KAAK,QAAQ;AACvB,QAAI;AACA,YAAM,OAAO,YAAY,KAAK,IAAI;AAClC,YAAM,OAAO,MAAM,SAAS,GAAG;AAC/B,YAAM,aAAS,iCAAa;AAAA,QACxB,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,IAAI,EAAE,SAAS;AAAA,QAC5C,QAAQ,IAAI,UAAU;AAAA,QACtB,SAAS,IAAI;AAAA,QACb;AAAA,MACJ,CAAC;AACD,YAAM,SAAS,MAAM,QAAQ,MAAM;AACnC,gBAAM;AAAA,QACF;AAAA,UACI,QAAQ,OAAK;AACT,gBAAI,OAAO,CAAC;AAAA,UAChB;AAAA,UACA,WAAW,CAAC,GAAG,MAAM;AACjB,gBAAI,UAAU,GAAG,CAAC;AAAA,UACtB;AAAA,UACA,MAAM,OAAK;AACP,gBAAI,KAAK,CAAC;AAAA,UACd;AAAA,QACJ;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,SAAS,KAAc;AAEnB,YAAM,UACF,eAAe,QAAQ,IAAI,UAAU;AACzC,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,QAAQ,CAAC;AAAA,IAC3C;AAAA,EACJ;AACJ;;;AChFO,SAAS,iBAAiB,QAA4C;AACzE,SAAO;AACX;;;AFFA,IAAAA,iBAAmC;","names":["import_server"]}

package/dist/server.d.cts

@@ -0,0 +1,29 @@
+import { UpupNextOptions } from '@useupup/server/next';
+export { UpupNextOptions, createUpupNextHandler, normalizeRequestOrigin, resolveOrigin } from '@useupup/server/next';
+import { NextApiRequest, NextApiResponse } from 'next';
+import { UpupServerConfig } from '@useupup/server';
+export { DriveTokens, InMemoryTokenStore, TokenStore, UpupServerConfig } from '@useupup/server';
+
+/**
+ * Pages Router (`pages/api/...`) adapter. Bridges Node req/res to the
+ * framework-agnostic Web handler. The route MUST set
+ * `export const config = { api: { bodyParser: false } }` so we receive the
+ * raw request body. `opts.baseUrl` / `trustProxy` correct the OAuth callback
+ * origin behind a proxy/CDN.
+ */
+declare function createUpupPagesHandler(config: UpupServerConfig, opts?: UpupNextOptions): (req: NextApiRequest, res: NextApiResponse) => Promise<void>;
+
+/**
+ * Typed helper for authoring a server config with full editor autocomplete and
+ * type-checking. Returns the config unchanged — a thin pass-through.
+ *
+ * Required-field validation is intentionally NOT performed here (F-852): it
+ * lives at construct time inside @useupup/server's `createUpupHandler`, so it runs
+ * for EVERY caller — including apps that call `createUpupNextHandler({...})`
+ * directly without this wrapper (playground/landing did exactly that). A
+ * `defineUpupConfig` that validated on its own left those direct callers
+ * unprotected, which was the original bug this fold-in closes.
+ */
+declare function defineUpupConfig(config: UpupServerConfig): UpupServerConfig;
+
+export { createUpupPagesHandler, defineUpupConfig };

package/dist/server.d.ts

@@ -0,0 +1,29 @@
+import { UpupNextOptions } from '@useupup/server/next';
+export { UpupNextOptions, createUpupNextHandler, normalizeRequestOrigin, resolveOrigin } from '@useupup/server/next';
+import { NextApiRequest, NextApiResponse } from 'next';
+import { UpupServerConfig } from '@useupup/server';
+export { DriveTokens, InMemoryTokenStore, TokenStore, UpupServerConfig } from '@useupup/server';
+
+/**
+ * Pages Router (`pages/api/...`) adapter. Bridges Node req/res to the
+ * framework-agnostic Web handler. The route MUST set
+ * `export const config = { api: { bodyParser: false } }` so we receive the
+ * raw request body. `opts.baseUrl` / `trustProxy` correct the OAuth callback
+ * origin behind a proxy/CDN.
+ */
+declare function createUpupPagesHandler(config: UpupServerConfig, opts?: UpupNextOptions): (req: NextApiRequest, res: NextApiResponse) => Promise<void>;
+
+/**
+ * Typed helper for authoring a server config with full editor autocomplete and
+ * type-checking. Returns the config unchanged — a thin pass-through.
+ *
+ * Required-field validation is intentionally NOT performed here (F-852): it
+ * lives at construct time inside @useupup/server's `createUpupHandler`, so it runs
+ * for EVERY caller — including apps that call `createUpupNextHandler({...})`
+ * directly without this wrapper (playground/landing did exactly that). A
+ * `defineUpupConfig` that validated on its own left those direct callers
+ * unprotected, which was the original bug this fold-in closes.
+ */
+declare function defineUpupConfig(config: UpupServerConfig): UpupServerConfig;
+
+export { createUpupPagesHandler, defineUpupConfig };

package/dist/server.js

@@ -0,0 +1,86 @@
+// src/server.ts
+import {
+  createUpupNextHandler,
+  normalizeRequestOrigin,
+  resolveOrigin
+} from "@useupup/server/next";
+
+// src/pages-handler.ts
+import { createUpupHandler } from "@useupup/server";
+import { toWebRequest, writeWebResponse } from "@useupup/server/node-bridge";
+function firstHeaderValue(value) {
+  const raw = Array.isArray(value) ? value[0] : value;
+  if (!raw) return void 0;
+  const first = raw.split(",")[0]?.trim();
+  return first || void 0;
+}
+function resolveBase(req, opts) {
+  if (opts?.baseUrl) return new URL(opts.baseUrl).origin;
+  const xfHost = firstHeaderValue(req.headers["x-forwarded-host"]);
+  const host = opts?.trustProxy && xfHost || req.headers.host || "localhost";
+  const xfProto = firstHeaderValue(req.headers["x-forwarded-proto"]);
+  const isLocal = host.startsWith("localhost") || host.startsWith("127.");
+  const proto = opts?.trustProxy && xfProto || (isLocal ? "http" : "https");
+  return `${proto}://${host}`;
+}
+async function readBody(req) {
+  const method = (req.method ?? "GET").toUpperCase();
+  if (method === "GET" || method === "HEAD") return void 0;
+  const chunks = [];
+  for await (const chunk of req) {
+    chunks.push(
+      typeof chunk === "string" ? Buffer.from(chunk) : chunk
+    );
+  }
+  return chunks.length ? new Uint8Array(Buffer.concat(chunks)) : void 0;
+}
+function createUpupPagesHandler(config, opts) {
+  const handler = createUpupHandler(config);
+  return async (req, res) => {
+    try {
+      const base = resolveBase(req, opts);
+      const body = await readBody(req);
+      const webReq = toWebRequest({
+        url: new URL(req.url ?? "/", base).toString(),
+        method: req.method ?? "GET",
+        headers: req.headers,
+        body
+      });
+      const webRes = await handler(webReq);
+      await writeWebResponse(
+        {
+          status: (c) => {
+            res.status(c);
+          },
+          setHeader: (k, v) => {
+            res.setHeader(k, v);
+          },
+          send: (b) => {
+            res.send(b);
+          }
+        },
+        webRes
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Internal error";
+      res.status(500).json({ error: message });
+    }
+  };
+}
+
+// src/define-config.ts
+function defineUpupConfig(config) {
+  return config;
+}
+
+// src/server.ts
+import { InMemoryTokenStore } from "@useupup/server";
+export {
+  InMemoryTokenStore,
+  createUpupNextHandler,
+  createUpupPagesHandler,
+  defineUpupConfig,
+  normalizeRequestOrigin,
+  resolveOrigin
+};
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server.ts","../src/pages-handler.ts","../src/define-config.ts"],"sourcesContent":["// App Router handler + origin utilities live in @useupup/server/next; this entry\r\n// re-exports them and adds the Pages Router adapter + config helper (Node-only).\r\nexport {\r\n    createUpupNextHandler,\r\n    normalizeRequestOrigin,\r\n    resolveOrigin,\r\n} from '@useupup/server/next'\r\nexport type { UpupNextOptions } from '@useupup/server/next'\r\n\r\nexport { createUpupPagesHandler } from './pages-handler'\r\nexport { defineUpupConfig } from './define-config'\r\n\r\n// Token-store utilities surfaced for the persistent-store guidance.\r\nexport { InMemoryTokenStore } from '@useupup/server'\r\nexport type { UpupServerConfig, TokenStore, DriveTokens } from '@useupup/server'\r\n","import type { NextApiRequest, NextApiResponse } from 'next'\r\nimport { createUpupHandler } from '@useupup/server'\r\nimport type { UpupServerConfig } from '@useupup/server'\r\nimport type { UpupNextOptions } from '@useupup/server/next'\r\nimport { toWebRequest, writeWebResponse } from '@useupup/server/node-bridge'\r\n\r\nfunction firstHeaderValue(\r\n    value: string | string[] | undefined,\r\n): string | undefined {\r\n    const raw = Array.isArray(value) ? value[0] : value\r\n    if (!raw) return undefined\r\n    const first = raw.split(',')[0]?.trim()\r\n    return first || undefined\r\n}\r\n\r\n/** Resolve the public origin for the Web Request we hand to the core handler. */\r\nfunction resolveBase(req: NextApiRequest, opts?: UpupNextOptions): string {\r\n    if (opts?.baseUrl) return new URL(opts.baseUrl).origin\r\n    const xfHost = firstHeaderValue(req.headers['x-forwarded-host'])\r\n    const host = (opts?.trustProxy && xfHost) || req.headers.host || 'localhost'\r\n    const xfProto = firstHeaderValue(req.headers['x-forwarded-proto'])\r\n    const isLocal = host.startsWith('localhost') || host.startsWith('127.')\r\n    const proto = (opts?.trustProxy && xfProto) || (isLocal ? 'http' : 'https')\r\n    return `${proto}://${host}`\r\n}\r\n\r\n/**\r\n * Yields the raw body as a plain `Uint8Array`, never the `Buffer` we assemble.\r\n * Under @types/node >=22 a `Buffer` types as `Buffer<ArrayBufferLike>`, which is\r\n * not assignable to `BodyInit` — copying into a fresh `Uint8Array` yields\r\n * `Uint8Array<ArrayBuffer>`, which every @types/node version accepts. The return\r\n * type is `RequestInit['body']` (the bridge's own parameter type) rather than a\r\n * bare `Uint8Array`, because bare `Uint8Array` means `Uint8Array<ArrayBufferLike>`\r\n * and would reintroduce the same mismatch at the annotation.\r\n */\r\nasync function readBody(\r\n    req: NextApiRequest,\r\n): Promise<RequestInit['body'] | undefined> {\r\n    const method = (req.method ?? 'GET').toUpperCase()\r\n    if (method === 'GET' || method === 'HEAD') return undefined\r\n    const chunks: Buffer[] = []\r\n    for await (const chunk of req) {\r\n        chunks.push(\r\n            typeof chunk === 'string' ? Buffer.from(chunk) : (chunk as Buffer),\r\n        )\r\n    }\r\n    return chunks.length ? new Uint8Array(Buffer.concat(chunks)) : undefined\r\n}\r\n\r\n/**\r\n * Pages Router (`pages/api/...`) adapter. Bridges Node req/res to the\r\n * framework-agnostic Web handler. The route MUST set\r\n * `export const config = { api: { bodyParser: false } }` so we receive the\r\n * raw request body. `opts.baseUrl` / `trustProxy` correct the OAuth callback\r\n * origin behind a proxy/CDN.\r\n */\r\nexport function createUpupPagesHandler(\r\n    config: UpupServerConfig,\r\n    opts?: UpupNextOptions,\r\n): (req: NextApiRequest, res: NextApiResponse) => Promise<void> {\r\n    const handler = createUpupHandler(config)\r\n    return async (req, res) => {\r\n        try {\r\n            const base = resolveBase(req, opts)\r\n            const body = await readBody(req)\r\n            const webReq = toWebRequest({\r\n                url: new URL(req.url ?? '/', base).toString(),\r\n                method: req.method ?? 'GET',\r\n                headers: req.headers,\r\n                body,\r\n            })\r\n            const webRes = await handler(webReq)\r\n            await writeWebResponse(\r\n                {\r\n                    status: c => {\r\n                        res.status(c)\r\n                    },\r\n                    setHeader: (k, v) => {\r\n                        res.setHeader(k, v)\r\n                    },\r\n                    send: b => {\r\n                        res.send(b)\r\n                    },\r\n                },\r\n                webRes,\r\n            )\r\n        } catch (err: unknown) {\r\n            // upup-catch: Pages Router top-level catch — maps handler errors to 500 JSON\r\n            const message =\r\n                err instanceof Error ? err.message : 'Internal error'\r\n            res.status(500).json({ error: message })\r\n        }\r\n    }\r\n}\r\n","import type { UpupServerConfig } from '@useupup/server'\r\n\r\n/**\r\n * Typed helper for authoring a server config with full editor autocomplete and\r\n * type-checking. Returns the config unchanged — a thin pass-through.\r\n *\r\n * Required-field validation is intentionally NOT performed here (F-852): it\r\n * lives at construct time inside @useupup/server's `createUpupHandler`, so it runs\r\n * for EVERY caller — including apps that call `createUpupNextHandler({...})`\r\n * directly without this wrapper (playground/landing did exactly that). A\r\n * `defineUpupConfig` that validated on its own left those direct callers\r\n * unprotected, which was the original bug this fold-in closes.\r\n */\r\nexport function defineUpupConfig(config: UpupServerConfig): UpupServerConfig {\r\n    return config\r\n}\r\n"],"mappings":";AAEA;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,OACG;;;ACLP,SAAS,yBAAyB;AAGlC,SAAS,cAAc,wBAAwB;AAE/C,SAAS,iBACL,OACkB;AAClB,QAAM,MAAM,MAAM,QAAQ,KAAK,IAAI,MAAM,CAAC,IAAI;AAC9C,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,QAAQ,IAAI,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACtC,SAAO,SAAS;AACpB;AAGA,SAAS,YAAY,KAAqB,MAAgC;AACtE,MAAI,MAAM,QAAS,QAAO,IAAI,IAAI,KAAK,OAAO,EAAE;AAChD,QAAM,SAAS,iBAAiB,IAAI,QAAQ,kBAAkB,CAAC;AAC/D,QAAM,OAAQ,MAAM,cAAc,UAAW,IAAI,QAAQ,QAAQ;AACjE,QAAM,UAAU,iBAAiB,IAAI,QAAQ,mBAAmB,CAAC;AACjE,QAAM,UAAU,KAAK,WAAW,WAAW,KAAK,KAAK,WAAW,MAAM;AACtE,QAAM,QAAS,MAAM,cAAc,YAAa,UAAU,SAAS;AACnE,SAAO,GAAG,KAAK,MAAM,IAAI;AAC7B;AAWA,eAAe,SACX,KACwC;AACxC,QAAM,UAAU,IAAI,UAAU,OAAO,YAAY;AACjD,MAAI,WAAW,SAAS,WAAW,OAAQ,QAAO;AAClD,QAAM,SAAmB,CAAC;AAC1B,mBAAiB,SAAS,KAAK;AAC3B,WAAO;AAAA,MACH,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAK;AAAA,IACtD;AAAA,EACJ;AACA,SAAO,OAAO,SAAS,IAAI,WAAW,OAAO,OAAO,MAAM,CAAC,IAAI;AACnE;AASO,SAAS,uBACZ,QACA,MAC4D;AAC5D,QAAM,UAAU,kBAAkB,MAAM;AACxC,SAAO,OAAO,KAAK,QAAQ;AACvB,QAAI;AACA,YAAM,OAAO,YAAY,KAAK,IAAI;AAClC,YAAM,OAAO,MAAM,SAAS,GAAG;AAC/B,YAAM,SAAS,aAAa;AAAA,QACxB,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,IAAI,EAAE,SAAS;AAAA,QAC5C,QAAQ,IAAI,UAAU;AAAA,QACtB,SAAS,IAAI;AAAA,QACb;AAAA,MACJ,CAAC;AACD,YAAM,SAAS,MAAM,QAAQ,MAAM;AACnC,YAAM;AAAA,QACF;AAAA,UACI,QAAQ,OAAK;AACT,gBAAI,OAAO,CAAC;AAAA,UAChB;AAAA,UACA,WAAW,CAAC,GAAG,MAAM;AACjB,gBAAI,UAAU,GAAG,CAAC;AAAA,UACtB;AAAA,UACA,MAAM,OAAK;AACP,gBAAI,KAAK,CAAC;AAAA,UACd;AAAA,QACJ;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,SAAS,KAAc;AAEnB,YAAM,UACF,eAAe,QAAQ,IAAI,UAAU;AACzC,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,QAAQ,CAAC;AAAA,IAC3C;AAAA,EACJ;AACJ;;;AChFO,SAAS,iBAAiB,QAA4C;AACzE,SAAO;AACX;;;AFFA,SAAS,0BAA0B;","names":[]}

package/dist/styles.d.ts

@@ -0,0 +1,4 @@
+// Generated by scripts/emit-styles-dts.mjs — do not edit.
+// Declares the './styles' subpath (runtime target: ./tailwind-prefixed.css) so
+// TypeScript 6+ can resolve `import '@useupup/<framework>/styles'`.
+export {}