@vaultix.ai/nextjs 0.3.0 → 0.4.0

package/dist/server.d.mts

@@ -7,45 +7,58 @@ interface AuthObject {
     sessionId: string | null;
     riskLevel: "low" | "medium" | "high" | "critical" | null;
     isSignedIn: boolean;
+    /**
+     * Throws a redirect if the user is not authenticated.
+     * Usage: const { userId } = await auth(); — or call auth().then(a => a.protect())
+     */
+    protect: (redirectTo?: string) => void;
 }
 /**
- * Returns the current auth state by reading the headers injected by
- * `authMiddleware`. Call this in Server Components, Route Handlers, and
- * Server Actions — never in Client Components.
+ * Returns the current auth state. Works in Server Components, Route Handlers,
+ * and Server Actions. Falls back to verifying the session cookie directly
+ * if middleware headers are not present.
  *
  * @example
- * import { auth } from "@smritix.ai/nextjs/server";
+ * import { auth } from "@vaultix.ai/nextjs/server";
+ *
  * export default async function Page() {
- *   const { userId, orgId } = await auth();
- *   …
+ *   const { userId, protect } = await auth();
+ *   protect();                    // redirects to sign-in if not authenticated
+ *   return <div>Hello {userId}</div>;
  * }
  */
 declare function auth(): Promise<AuthObject>;
 /**
- * Asserts that the current user is authenticated. Redirects to `/sign-in`
- * if not. Returns the auth object for convenience.
+ * Returns the full user record for the currently signed-in user.
+ * Calls GET /api/v1/me using the session JWT from the cookie as a Bearer token.
+ * No extra env vars required.
  *
  * @example
- * export default async function ProtectedPage() {
- *   const { userId } = await protect();
- *   …
+ * import { currentUser } from "@vaultix.ai/nextjs/server";
+ *
+ * export default async function Page() {
+ *   const user = await currentUser();
+ *   if (!user) redirect("/sign-in");
+ *   return <div>Hello {user.email}</div>;
  * }
  */
-declare function protect(redirectTo?: string): Promise<AuthObject>;
+declare function currentUser(): Promise<VaultixUser | null>;
 /**
- * Fetches the full `VaultixUser` record from the auth engine using server-to-server
- * credentials (`VAULTIX_API_URL` + `VAULTIX_SECRET_KEY` env vars).
- * Returns null when unauthenticated or when env vars are missing.
- *
- * Responses are never cached (`cache: "no-store"`) — user data must be fresh.
+ * Returns the active organization for the current user.
+ * Requires VAULTIX_SECRET_KEY env var.
  */
-declare function currentUser(): Promise<VaultixUser | null>;
+declare function currentOrg(): Promise<VaultixOrganization | null>;
 /**
- * Fetches the active `VaultixOrganization` from the auth engine.
- * Returns null when the user has no active org or env vars are missing.
+ * Asserts the current user is authenticated. Redirects to sign-in if not.
+ * Prefer calling `protect()` from the auth object returned by `auth()`.
  *
- * Responses are cached for 30 seconds — org data changes infrequently.
+ * @example
+ * import { protect } from "@vaultix.ai/nextjs/server";
+ * export default async function Page() {
+ *   const { userId } = await protect();
+ *   return <div>{userId}</div>;
+ * }
  */
-declare function currentOrg(): Promise<VaultixOrganization | null>;
+declare function protect(redirectTo?: string): Promise<AuthObject>;
 
 export { type AuthObject, auth, currentOrg, currentUser, protect };

package/dist/server.d.ts

@@ -7,45 +7,58 @@ interface AuthObject {
     sessionId: string | null;
     riskLevel: "low" | "medium" | "high" | "critical" | null;
     isSignedIn: boolean;
+    /**
+     * Throws a redirect if the user is not authenticated.
+     * Usage: const { userId } = await auth(); — or call auth().then(a => a.protect())
+     */
+    protect: (redirectTo?: string) => void;
 }
 /**
- * Returns the current auth state by reading the headers injected by
- * `authMiddleware`. Call this in Server Components, Route Handlers, and
- * Server Actions — never in Client Components.
+ * Returns the current auth state. Works in Server Components, Route Handlers,
+ * and Server Actions. Falls back to verifying the session cookie directly
+ * if middleware headers are not present.
  *
  * @example
- * import { auth } from "@smritix.ai/nextjs/server";
+ * import { auth } from "@vaultix.ai/nextjs/server";
+ *
  * export default async function Page() {
- *   const { userId, orgId } = await auth();
- *   …
+ *   const { userId, protect } = await auth();
+ *   protect();                    // redirects to sign-in if not authenticated
+ *   return <div>Hello {userId}</div>;
  * }
  */
 declare function auth(): Promise<AuthObject>;
 /**
- * Asserts that the current user is authenticated. Redirects to `/sign-in`
- * if not. Returns the auth object for convenience.
+ * Returns the full user record for the currently signed-in user.
+ * Calls GET /api/v1/me using the session JWT from the cookie as a Bearer token.
+ * No extra env vars required.
  *
  * @example
- * export default async function ProtectedPage() {
- *   const { userId } = await protect();
- *   …
+ * import { currentUser } from "@vaultix.ai/nextjs/server";
+ *
+ * export default async function Page() {
+ *   const user = await currentUser();
+ *   if (!user) redirect("/sign-in");
+ *   return <div>Hello {user.email}</div>;
  * }
  */
-declare function protect(redirectTo?: string): Promise<AuthObject>;
+declare function currentUser(): Promise<VaultixUser | null>;
 /**
- * Fetches the full `VaultixUser` record from the auth engine using server-to-server
- * credentials (`VAULTIX_API_URL` + `VAULTIX_SECRET_KEY` env vars).
- * Returns null when unauthenticated or when env vars are missing.
- *
- * Responses are never cached (`cache: "no-store"`) — user data must be fresh.
+ * Returns the active organization for the current user.
+ * Requires VAULTIX_SECRET_KEY env var.
  */
-declare function currentUser(): Promise<VaultixUser | null>;
+declare function currentOrg(): Promise<VaultixOrganization | null>;
 /**
- * Fetches the active `VaultixOrganization` from the auth engine.
- * Returns null when the user has no active org or env vars are missing.
+ * Asserts the current user is authenticated. Redirects to sign-in if not.
+ * Prefer calling `protect()` from the auth object returned by `auth()`.
  *
- * Responses are cached for 30 seconds — org data changes infrequently.
+ * @example
+ * import { protect } from "@vaultix.ai/nextjs/server";
+ * export default async function Page() {
+ *   const { userId } = await protect();
+ *   return <div>{userId}</div>;
+ * }
  */
-declare function currentOrg(): Promise<VaultixOrganization | null>;
+declare function protect(redirectTo?: string): Promise<AuthObject>;
 
 export { type AuthObject, auth, currentOrg, currentUser, protect };

package/dist/server.js

@@ -28,6 +28,7 @@ __export(server_exports, {
 module.exports = __toCommonJS(server_exports);
 var import_headers = require("next/headers");
 var import_navigation = require("next/navigation");
+var import_jose2 = require("jose");
 
 // src/middleware.ts
 var import_jose = require("jose");
@@ -39,48 +40,124 @@ var HEADER_SESSION_ID = "x-vaultix-session-id";
 var HEADER_RISK_LEVEL = "x-vaultix-risk-level";
 
 // src/server.ts
+function resolveApiUrl() {
+  if (process.env.VAULTIX_API_URL) return process.env.VAULTIX_API_URL.replace(/\/$/, "");
+  const pk = process.env.NEXT_PUBLIC_VAULTIX_PUBLISHABLE_KEY ?? "";
+  if (!pk) return "";
+  try {
+    const parts = pk.split("_");
+    if (parts.length >= 4 && parts[0] === "vaultix" && parts[1] === "pk") {
+      return atob(parts.slice(3).join("_")).replace(/\/$/, "");
+    }
+  } catch {
+  }
+  return "";
+}
+var _remoteJwks = null;
+var _remoteJwksUrl = null;
+var _staticKey = null;
+var _staticPem = null;
+async function verifyJwt(token) {
+  const pem = process.env.VAULTIX_JWT_PUBLIC_KEY;
+  if (pem) {
+    const normalized = pem.replace(/\\n/g, "\n");
+    if (!_staticKey || _staticPem !== normalized) {
+      _staticKey = await (0, import_jose2.importSPKI)(normalized, "RS256");
+      _staticPem = normalized;
+    }
+    try {
+      const { payload } = await (0, import_jose2.jwtVerify)(token, _staticKey, { algorithms: ["RS256"] });
+      return payload;
+    } catch {
+      return null;
+    }
+  }
+  const apiUrl = resolveApiUrl();
+  if (!apiUrl) return null;
+  const jwksUrl = `${apiUrl}/api/v1/.well-known/jwks.json`;
+  if (!_remoteJwks || _remoteJwksUrl !== jwksUrl) {
+    _remoteJwks = (0, import_jose2.createRemoteJWKSet)(new URL(jwksUrl));
+    _remoteJwksUrl = jwksUrl;
+  }
+  try {
+    const { payload } = await (0, import_jose2.jwtVerify)(token, _remoteJwks, { algorithms: ["RS256"] });
+    return payload;
+  } catch {
+    return null;
+  }
+}
 async function auth() {
+  function makeProtect(isSignedIn) {
+    return (redirectTo) => {
+      if (!isSignedIn) {
+        const apiUrl = resolveApiUrl();
+        const dest = redirectTo ?? (apiUrl ? `${apiUrl}/auth/sign-in` : "/sign-in");
+        (0, import_navigation.redirect)(dest);
+      }
+    };
+  }
   const h = await (0, import_headers.headers)();
   const userId = h.get(HEADER_USER_ID);
-  if (!userId) {
+  if (userId) {
+    return {
+      userId,
+      orgId: h.get(HEADER_ORG_ID) || null,
+      orgRole: h.get(HEADER_ORG_ROLE) || null,
+      sessionId: h.get(HEADER_SESSION_ID) || null,
+      riskLevel: h.get(HEADER_RISK_LEVEL) ?? "low",
+      isSignedIn: true,
+      protect: makeProtect(true)
+    };
+  }
+  const jar = await (0, import_headers.cookies)();
+  const token = jar.get("vaultix-session")?.value;
+  if (!token) {
+    return {
+      userId: null,
+      orgId: null,
+      orgRole: null,
+      sessionId: null,
+      riskLevel: null,
+      isSignedIn: false,
+      protect: makeProtect(false)
+    };
+  }
+  const payload = await verifyJwt(token);
+  if (!payload) {
     return {
       userId: null,
       orgId: null,
       orgRole: null,
       sessionId: null,
       riskLevel: null,
-      isSignedIn: false
+      isSignedIn: false,
+      protect: makeProtect(false)
     };
   }
   return {
-    userId,
-    orgId: h.get(HEADER_ORG_ID) || null,
-    orgRole: h.get(HEADER_ORG_ROLE) || null,
-    sessionId: h.get(HEADER_SESSION_ID) || null,
-    riskLevel: h.get(HEADER_RISK_LEVEL) ?? "low",
-    isSignedIn: true
+    userId: payload["uid"] ?? null,
+    orgId: payload["org"] ?? null,
+    orgRole: payload["rol"] ?? null,
+    sessionId: payload["sid"] ?? null,
+    riskLevel: payload["risk"] ?? "low",
+    isSignedIn: true,
+    protect: makeProtect(true)
   };
 }
-async function protect(redirectTo = "/sign-in") {
-  const authObj = await auth();
-  if (!authObj.isSignedIn) {
-    (0, import_navigation.redirect)(redirectTo);
-  }
-  return authObj;
-}
 async function currentUser() {
-  const { userId } = await auth();
-  if (!userId) return null;
-  const apiUrl = process.env["VAULTIX_API_URL"];
-  const secret = process.env["VAULTIX_SECRET_KEY"];
-  if (!apiUrl || !secret) return null;
+  const jar = await (0, import_headers.cookies)();
+  const token = jar.get("vaultix-session")?.value;
+  if (!token) return null;
+  const apiUrl = resolveApiUrl();
+  if (!apiUrl) return null;
   try {
-    const res = await fetch(`${apiUrl}/v1/users/${userId}`, {
-      headers: { Authorization: `Bearer ${secret}` },
+    const res = await fetch(`${apiUrl}/api/v1/me`, {
+      headers: { Authorization: `Bearer ${token}` },
       cache: "no-store"
     });
     if (!res.ok) return null;
-    return await res.json();
+    const data = await res.json();
+    return data.user ?? null;
   } catch {
     return null;
   }
@@ -88,21 +165,25 @@ async function currentUser() {
 async function currentOrg() {
   const { orgId } = await auth();
   if (!orgId) return null;
-  const apiUrl = process.env["VAULTIX_API_URL"];
-  const secret = process.env["VAULTIX_SECRET_KEY"];
+  const apiUrl = resolveApiUrl();
+  const secret = process.env.VAULTIX_SECRET_KEY;
   if (!apiUrl || !secret) return null;
   try {
-    const orgFetchInit = {
+    const res = await fetch(`${apiUrl}/api/v1/orgs/${orgId}`, {
       headers: { Authorization: `Bearer ${secret}` },
       next: { revalidate: 30 }
-    };
-    const res = await fetch(`${apiUrl}/v1/orgs/${orgId}`, orgFetchInit);
+    });
     if (!res.ok) return null;
     return await res.json();
   } catch {
     return null;
   }
 }
+async function protect(redirectTo) {
+  const authObj = await auth();
+  authObj.protect(redirectTo);
+  return authObj;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   auth,

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server.ts","../src/middleware.ts"],"sourcesContent":["// This file is server-only. Import from \"@smritix.ai/nextjs/server\".\n// Do NOT import in Client Components — it will throw at runtime.\nimport { headers } from \"next/headers\";\nimport { redirect } from \"next/navigation\";\nimport type { VaultixOrganization, VaultixUser } from \"@vaultix.ai/react\";\nimport {\n  HEADER_ORG_ID,\n  HEADER_ORG_ROLE,\n  HEADER_RISK_LEVEL,\n  HEADER_SESSION_ID,\n  HEADER_USER_ID,\n} from \"./middleware\";\n\n// Next.js extends RequestInit with cache and next options for its data cache.\ntype NextRequestInit = RequestInit & {\n  cache?: RequestCache;\n  next?: { revalidate?: number | false; tags?: string[] };\n};\n\n// ─── Types ────────────────────────────────────────────────────────────────────\n\nexport interface AuthObject {\n  userId: string | null;\n  orgId: string | null;\n  orgRole: string | null;\n  sessionId: string | null;\n  riskLevel: \"low\" | \"medium\" | \"high\" | \"critical\" | null;\n  isSignedIn: boolean;\n}\n\n// ─── auth() ───────────────────────────────────────────────────────────────────\n\n/**\n * Returns the current auth state by reading the headers injected by\n * `authMiddleware`. Call this in Server Components, Route Handlers, and\n * Server Actions — never in Client Components.\n *\n * @example\n * import { auth } from \"@smritix.ai/nextjs/server\";\n * export default async function Page() {\n *   const { userId, orgId } = await auth();\n *   …\n * }\n */\nexport async function auth(): Promise<AuthObject> {\n  const h = await headers();\n  const userId = h.get(HEADER_USER_ID);\n\n  if (!userId) {\n    return {\n      userId: null,\n      orgId: null,\n      orgRole: null,\n      sessionId: null,\n      riskLevel: null,\n      isSignedIn: false,\n    };\n  }\n\n  return {\n    userId,\n    orgId:     h.get(HEADER_ORG_ID)     || null,\n    orgRole:   h.get(HEADER_ORG_ROLE)   || null,\n    sessionId: h.get(HEADER_SESSION_ID) || null,\n    riskLevel: (h.get(HEADER_RISK_LEVEL) ?? \"low\") as AuthObject[\"riskLevel\"],\n    isSignedIn: true,\n  };\n}\n\n// ─── protect() ────────────────────────────────────────────────────────────────\n\n/**\n * Asserts that the current user is authenticated. Redirects to `/sign-in`\n * if not. Returns the auth object for convenience.\n *\n * @example\n * export default async function ProtectedPage() {\n *   const { userId } = await protect();\n *   …\n * }\n */\nexport async function protect(redirectTo = \"/sign-in\"): Promise<AuthObject> {\n  const authObj = await auth();\n  if (!authObj.isSignedIn) {\n    redirect(redirectTo);\n  }\n  return authObj;\n}\n\n// ─── currentUser() ────────────────────────────────────────────────────────────\n\n/**\n * Fetches the full `VaultixUser` record from the auth engine using server-to-server\n * credentials (`VAULTIX_API_URL` + `VAULTIX_SECRET_KEY` env vars).\n * Returns null when unauthenticated or when env vars are missing.\n *\n * Responses are never cached (`cache: \"no-store\"`) — user data must be fresh.\n */\nexport async function currentUser(): Promise<VaultixUser | null> {\n  const { userId } = await auth();\n  if (!userId) return null;\n\n  const apiUrl = process.env[\"VAULTIX_API_URL\"];\n  const secret = process.env[\"VAULTIX_SECRET_KEY\"];\n  if (!apiUrl || !secret) return null;\n\n  try {\n    const res = await fetch(`${apiUrl}/v1/users/${userId}`, {\n      headers: { Authorization: `Bearer ${secret}` },\n      cache: \"no-store\",\n    });\n    if (!res.ok) return null;\n    return (await res.json()) as VaultixUser;\n  } catch {\n    return null;\n  }\n}\n\n// ─── currentOrg() ────────────────────────────────────────────────────────────\n\n/**\n * Fetches the active `VaultixOrganization` from the auth engine.\n * Returns null when the user has no active org or env vars are missing.\n *\n * Responses are cached for 30 seconds — org data changes infrequently.\n */\nexport async function currentOrg(): Promise<VaultixOrganization | null> {\n  const { orgId } = await auth();\n  if (!orgId) return null;\n\n  const apiUrl = process.env[\"VAULTIX_API_URL\"];\n  const secret = process.env[\"VAULTIX_SECRET_KEY\"];\n  if (!apiUrl || !secret) return null;\n\n  try {\n    const orgFetchInit: NextRequestInit = {\n      headers: { Authorization: `Bearer ${secret}` },\n      next: { revalidate: 30 },\n    };\n    const res = await fetch(`${apiUrl}/v1/orgs/${orgId}`, orgFetchInit as RequestInit);\n    if (!res.ok) return null;\n    return (await res.json()) as VaultixOrganization;\n  } catch {\n    return null;\n  }\n}\n","// Edge-runtime compatible. Uses jose for JWT verification.\nimport { createRemoteJWKSet, importSPKI, jwtVerify, type KeyLike } from \"jose\";\nimport { NextRequest, NextResponse } from \"next/server\";\n\n// ─── Types ────────────────────────────────────────────────────────────────────\n\nexport interface AuthResult {\n  userId: string | null;\n  orgId: string | null;\n  orgRole: string | null;\n  sessionId: string | null;\n  riskLevel: string | null;\n  isSignedIn: boolean;\n  isPublicRoute: boolean;\n}\n\nexport interface AuthMiddlewareOptions {\n  /**\n   * Routes that do not require authentication.\n   * Strings: exact match or prefix. RegExps: tested against pathname.\n   */\n  publicRoutes?: Array<string | RegExp>;\n\n  /**\n   * Where to redirect unauthenticated users.\n   * Defaults to the Vaultix hosted sign-in page (decoded from publishable key).\n   * Override with \"/sign-in\" to use your own page.\n   */\n  signInUrl?: string;\n\n  /**\n   * Vaultix API origin. Auto-decoded from NEXT_PUBLIC_VAULTIX_PUBLISHABLE_KEY.\n   * Only needed if you're not using the standard publishable key format.\n   */\n  apiUrl?: string;\n\n  /**\n   * Custom logic after auth state is resolved.\n   * Return a NextResponse to override default behaviour.\n   */\n  afterAuth?: (auth: AuthResult, req: NextRequest) => NextResponse | Response | undefined | void;\n}\n\n// ─── Header names ─────────────────────────────────────────────────────────────\n\nexport const HEADER_USER_ID    = \"x-vaultix-user-id\";\nexport const HEADER_ORG_ID     = \"x-vaultix-org-id\";\nexport const HEADER_ORG_ROLE   = \"x-vaultix-org-role\";\nexport const HEADER_SESSION_ID = \"x-vaultix-session-id\";\nexport const HEADER_RISK_LEVEL = \"x-vaultix-risk-level\";\n\n// ─── Publishable key → API URL ────────────────────────────────────────────────\n\nfunction decodeApiUrlFromKey(pk: string): string {\n  try {\n    const parts = pk.split(\"_\");\n    if (parts.length >= 4 && parts[0] === \"vaultix\" && parts[1] === \"pk\") {\n      return atob(parts.slice(3).join(\"_\")).replace(/\\/$/, \"\");\n    }\n  } catch {}\n  return \"\";\n}\n\nfunction resolveApiUrl(options: AuthMiddlewareOptions): string {\n  if (options.apiUrl) return options.apiUrl.replace(/\\/$/, \"\");\n  if (process.env.VAULTIX_API_URL) return process.env.VAULTIX_API_URL.replace(/\\/$/, \"\");\n  const pk = process.env.NEXT_PUBLIC_VAULTIX_PUBLISHABLE_KEY ?? \"\";\n  return decodeApiUrlFromKey(pk);\n}\n\n// ─── JWKS cache ───────────────────────────────────────────────────────────────\n// createRemoteJWKSet fetches and caches the key set, re-fetches on rotation.\n// Falls back to a static PEM key if VAULTIX_JWT_PUBLIC_KEY is set (backward compat).\n\nlet remoteJwks: ReturnType<typeof createRemoteJWKSet> | null = null;\nlet remoteJwksUrl: string | null = null;\n\nlet staticKey: KeyLike | null = null;\nlet staticPem: string | null = null;\n\nasync function getVerifyKey(apiUrl: string) {\n  // Prefer static PEM (set by env var) for zero-network-call verification\n  const pem = process.env.VAULTIX_JWT_PUBLIC_KEY;\n  if (pem) {\n    const normalized = pem.replace(/\\\\n/g, \"\\n\");\n    if (staticKey && staticPem === normalized) return { key: staticKey, mode: \"static\" as const };\n    staticKey = await importSPKI(normalized, \"RS256\");\n    staticPem = normalized;\n    return { key: staticKey, mode: \"static\" as const };\n  }\n\n  // Auto-fetch JWKS from the API — no env var needed\n  if (!apiUrl) return null;\n  const jwksUrl = `${apiUrl}/api/v1/.well-known/jwks.json`;\n  if (!remoteJwks || remoteJwksUrl !== jwksUrl) {\n    remoteJwks = createRemoteJWKSet(new URL(jwksUrl));\n    remoteJwksUrl = jwksUrl;\n  }\n  return { key: remoteJwks, mode: \"remote\" as const };\n}\n\n// ─── Route matching ───────────────────────────────────────────────────────────\n\nfunction isPublic(pathname: string, rules: Array<string | RegExp>): boolean {\n  return rules.some((rule) =>\n    typeof rule === \"string\"\n      ? pathname === rule || pathname.startsWith(rule)\n      : rule.test(pathname),\n  );\n}\n\n// ─── Handshake exchange ───────────────────────────────────────────────────────\n\nasync function handleHandshake(\n  req: NextRequest,\n  handshakeToken: string,\n  apiUrl: string,\n): Promise<NextResponse | null> {\n  try {\n    const res = await fetch(`${apiUrl}/api/v1/tokens/exchange`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({ handshake_token: handshakeToken }),\n    });\n    if (!res.ok) return null;\n\n    const { session_jwt } = (await res.json()) as { session_jwt: string };\n    const cleanUrl = req.nextUrl.clone();\n    cleanUrl.searchParams.delete(\"__vaultix_handshake\");\n\n    const response = NextResponse.redirect(cleanUrl);\n    response.cookies.set(\"vaultix-session\", session_jwt, {\n      httpOnly: true,\n      secure: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: 30 * 24 * 60 * 60,\n    });\n    return response;\n  } catch {\n    return null;\n  }\n}\n\n// ─── authMiddleware ───────────────────────────────────────────────────────────\n\n/**\n * Drop-in auth middleware — works with zero config when\n * NEXT_PUBLIC_VAULTIX_PUBLISHABLE_KEY is set.\n *\n * @example\n * // middleware.ts\n * import { authMiddleware } from \"@vaultix.ai/nextjs/middleware\";\n * export default authMiddleware({ publicRoutes: [\"/\", \"/about\"] });\n * export const config = { matcher: [\"/((?!_next|.*\\\\..*).*)\"] };\n */\nexport function authMiddleware(options: AuthMiddlewareOptions = {}) {\n  const { publicRoutes = [], afterAuth } = options;\n\n  return async function middleware(req: NextRequest): Promise<NextResponse> {\n    const { pathname } = req.nextUrl;\n    const publicRoute = isPublic(pathname, publicRoutes);\n\n    const apiUrl = resolveApiUrl(options);\n\n    // Default sign-in URL: hosted Vaultix page decoded from publishable key\n    const signInUrl =\n      options.signInUrl ?? (apiUrl ? `${apiUrl}/auth/sign-in` : \"/sign-in\");\n\n    // ── Handshake exchange ─────────────────────────────────────────────────\n    const handshakeToken = req.nextUrl.searchParams.get(\"__vaultix_handshake\");\n    if (handshakeToken && apiUrl) {\n      const response = await handleHandshake(req, handshakeToken, apiUrl);\n      if (response) return response;\n    }\n\n    // ── JWT verification ───────────────────────────────────────────────────\n    let result: AuthResult = {\n      userId: null, orgId: null, orgRole: null,\n      sessionId: null, riskLevel: null,\n      isSignedIn: false, isPublicRoute: publicRoute,\n    };\n\n    const token =\n      req.cookies.get(\"vaultix-session\")?.value ??\n      extractBearer(req.headers.get(\"authorization\") ?? \"\");\n\n    if (token) {\n      const verifyKey = await getVerifyKey(apiUrl);\n      if (verifyKey) {\n        try {\n          const { payload } = await jwtVerify(token, verifyKey.key as Parameters<typeof jwtVerify>[1], {\n            algorithms: [\"RS256\"],\n          });\n          result = {\n            userId:    (payload[\"uid\"]  as string) ?? null,\n            orgId:     (payload[\"org\"]  as string) ?? null,\n            orgRole:   (payload[\"rol\"]  as string) ?? null,\n            sessionId: (payload[\"sid\"]  as string) ?? null,\n            riskLevel: (payload[\"risk\"] as string) ?? \"low\",\n            isSignedIn: true,\n            isPublicRoute: publicRoute,\n          };\n        } catch {\n          // expired / tampered\n        }\n      }\n    }\n\n    // ── Custom afterAuth hook ──────────────────────────────────────────────\n    if (afterAuth) {\n      const override = afterAuth(result, req);\n      if (override) return override as NextResponse;\n    }\n\n    // ── Default: redirect unauthenticated to sign-in ───────────────────────\n    if (!result.isSignedIn && !publicRoute) {\n      const dest = new URL(signInUrl, req.url);\n      dest.searchParams.set(\"redirect_url\", req.url);\n      return NextResponse.redirect(dest);\n    }\n\n    // ── Inject auth headers for Server Components ──────────────────────────\n    const next = new Headers(req.headers);\n    if (result.userId) {\n      next.set(HEADER_USER_ID,    result.userId);\n      next.set(HEADER_ORG_ID,     result.orgId ?? \"\");\n      next.set(HEADER_ORG_ROLE,   result.orgRole ?? \"\");\n      next.set(HEADER_SESSION_ID, result.sessionId ?? \"\");\n      next.set(HEADER_RISK_LEVEL, result.riskLevel ?? \"low\");\n    } else {\n      [HEADER_USER_ID, HEADER_ORG_ID, HEADER_ORG_ROLE, HEADER_SESSION_ID, HEADER_RISK_LEVEL]\n        .forEach((h) => next.delete(h));\n    }\n\n    return NextResponse.next({ request: { headers: next } });\n  };\n}\n\nfunction extractBearer(header: string): string {\n  return header.startsWith(\"Bearer \") ? header.slice(7) : \"\";\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,qBAAwB;AACxB,wBAAyB;;;ACFzB,kBAAwE;AACxE,oBAA0C;AA2CnC,IAAM,iBAAoB;AAC1B,IAAM,gBAAoB;AAC1B,IAAM,kBAAoB;AAC1B,IAAM,oBAAoB;AAC1B,IAAM,oBAAoB;;;ADLjC,eAAsB,OAA4B;AAChD,QAAM,IAAI,UAAM,wBAAQ;AACxB,QAAM,SAAS,EAAE,IAAI,cAAc;AAEnC,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,SAAS;AAAA,MACT,WAAW;AAAA,MACX,WAAW;AAAA,MACX,YAAY;AAAA,IACd;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,OAAW,EAAE,IAAI,aAAa,KAAS;AAAA,IACvC,SAAW,EAAE,IAAI,eAAe,KAAO;AAAA,IACvC,WAAW,EAAE,IAAI,iBAAiB,KAAK;AAAA,IACvC,WAAY,EAAE,IAAI,iBAAiB,KAAK;AAAA,IACxC,YAAY;AAAA,EACd;AACF;AAcA,eAAsB,QAAQ,aAAa,YAAiC;AAC1E,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAQ,YAAY;AACvB,oCAAS,UAAU;AAAA,EACrB;AACA,SAAO;AACT;AAWA,eAAsB,cAA2C;AAC/D,QAAM,EAAE,OAAO,IAAI,MAAM,KAAK;AAC9B,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,QAAQ,IAAI,iBAAiB;AAC5C,QAAM,SAAS,QAAQ,IAAI,oBAAoB;AAC/C,MAAI,CAAC,UAAU,CAAC,OAAQ,QAAO;AAE/B,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,MAAM,aAAa,MAAM,IAAI;AAAA,MACtD,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG;AAAA,MAC7C,OAAO;AAAA,IACT,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUA,eAAsB,aAAkD;AACtE,QAAM,EAAE,MAAM,IAAI,MAAM,KAAK;AAC7B,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,SAAS,QAAQ,IAAI,iBAAiB;AAC5C,QAAM,SAAS,QAAQ,IAAI,oBAAoB;AAC/C,MAAI,CAAC,UAAU,CAAC,OAAQ,QAAO;AAE/B,MAAI;AACF,UAAM,eAAgC;AAAA,MACpC,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG;AAAA,MAC7C,MAAM,EAAE,YAAY,GAAG;AAAA,IACzB;AACA,UAAM,MAAM,MAAM,MAAM,GAAG,MAAM,YAAY,KAAK,IAAI,YAA2B;AACjF,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../src/server.ts","../src/middleware.ts"],"sourcesContent":["// Server-only. Import from \"@vaultix.ai/nextjs/server\".\n// Never import this in Client Components.\nimport { cookies, headers } from \"next/headers\";\nimport { redirect } from \"next/navigation\";\nimport { createRemoteJWKSet, importSPKI, jwtVerify } from \"jose\";\nimport type { VaultixOrganization, VaultixUser } from \"@vaultix.ai/react\";\nimport {\n  HEADER_USER_ID,\n  HEADER_ORG_ID,\n  HEADER_ORG_ROLE,\n  HEADER_SESSION_ID,\n  HEADER_RISK_LEVEL,\n} from \"./middleware\";\n\n// ─── Types ────────────────────────────────────────────────────────────────────\n\nexport interface AuthObject {\n  userId: string | null;\n  orgId: string | null;\n  orgRole: string | null;\n  sessionId: string | null;\n  riskLevel: \"low\" | \"medium\" | \"high\" | \"critical\" | null;\n  isSignedIn: boolean;\n  /**\n   * Throws a redirect if the user is not authenticated.\n   * Usage: const { userId } = await auth(); — or call auth().then(a => a.protect())\n   */\n  protect: (redirectTo?: string) => void;\n}\n\n// ─── API URL resolution (mirrors middleware logic) ────────────────────────────\n\nfunction resolveApiUrl(): string {\n  if (process.env.VAULTIX_API_URL) return process.env.VAULTIX_API_URL.replace(/\\/$/, \"\");\n  const pk = process.env.NEXT_PUBLIC_VAULTIX_PUBLISHABLE_KEY ?? \"\";\n  if (!pk) return \"\";\n  try {\n    const parts = pk.split(\"_\");\n    if (parts.length >= 4 && parts[0] === \"vaultix\" && parts[1] === \"pk\") {\n      return atob(parts.slice(3).join(\"_\")).replace(/\\/$/, \"\");\n    }\n  } catch {}\n  return \"\";\n}\n\n// ─── JWT verification (server-side, no edge constraints) ─────────────────────\n\nlet _remoteJwks: ReturnType<typeof createRemoteJWKSet> | null = null;\nlet _remoteJwksUrl: string | null = null;\nlet _staticKey: Awaited<ReturnType<typeof importSPKI>> | null = null;\nlet _staticPem: string | null = null;\n\nasync function verifyJwt(token: string) {\n  // 1. Static PEM key (fastest, no network call)\n  const pem = process.env.VAULTIX_JWT_PUBLIC_KEY;\n  if (pem) {\n    const normalized = pem.replace(/\\\\n/g, \"\\n\");\n    if (!_staticKey || _staticPem !== normalized) {\n      _staticKey = await importSPKI(normalized, \"RS256\");\n      _staticPem = normalized;\n    }\n    try {\n      const { payload } = await jwtVerify(token, _staticKey, { algorithms: [\"RS256\"] });\n      return payload;\n    } catch { return null; }\n  }\n\n  // 2. Remote JWKS (auto-fetched, cached)\n  const apiUrl = resolveApiUrl();\n  if (!apiUrl) return null;\n  const jwksUrl = `${apiUrl}/api/v1/.well-known/jwks.json`;\n  if (!_remoteJwks || _remoteJwksUrl !== jwksUrl) {\n    _remoteJwks = createRemoteJWKSet(new URL(jwksUrl));\n    _remoteJwksUrl = jwksUrl;\n  }\n  try {\n    const { payload } = await jwtVerify(token, _remoteJwks, { algorithms: [\"RS256\"] });\n    return payload;\n  } catch { return null; }\n}\n\n// ─── auth() ───────────────────────────────────────────────────────────────────\n\n/**\n * Returns the current auth state. Works in Server Components, Route Handlers,\n * and Server Actions. Falls back to verifying the session cookie directly\n * if middleware headers are not present.\n *\n * @example\n * import { auth } from \"@vaultix.ai/nextjs/server\";\n *\n * export default async function Page() {\n *   const { userId, protect } = await auth();\n *   protect();                    // redirects to sign-in if not authenticated\n *   return <div>Hello {userId}</div>;\n * }\n */\nexport async function auth(): Promise<AuthObject> {\n  function makeProtect(isSignedIn: boolean) {\n    return (redirectTo?: string) => {\n      if (!isSignedIn) {\n        const apiUrl = resolveApiUrl();\n        const dest = redirectTo ?? (apiUrl ? `${apiUrl}/auth/sign-in` : \"/sign-in\");\n        redirect(dest);\n      }\n    };\n  }\n\n  // ── Fast path: headers injected by authMiddleware ──────────────────────\n  const h = await headers();\n  const userId = h.get(HEADER_USER_ID);\n  if (userId) {\n    return {\n      userId,\n      orgId:     h.get(HEADER_ORG_ID)     || null,\n      orgRole:   h.get(HEADER_ORG_ROLE)   || null,\n      sessionId: h.get(HEADER_SESSION_ID) || null,\n      riskLevel: (h.get(HEADER_RISK_LEVEL) ?? \"low\") as AuthObject[\"riskLevel\"],\n      isSignedIn: true,\n      protect: makeProtect(true),\n    };\n  }\n\n  // ── Fallback: verify session cookie directly (no middleware needed) ────\n  const jar = await cookies();\n  const token = jar.get(\"vaultix-session\")?.value;\n  if (!token) {\n    return {\n      userId: null, orgId: null, orgRole: null,\n      sessionId: null, riskLevel: null, isSignedIn: false,\n      protect: makeProtect(false),\n    };\n  }\n\n  const payload = await verifyJwt(token);\n  if (!payload) {\n    return {\n      userId: null, orgId: null, orgRole: null,\n      sessionId: null, riskLevel: null, isSignedIn: false,\n      protect: makeProtect(false),\n    };\n  }\n\n  return {\n    userId:    (payload[\"uid\"]  as string) ?? null,\n    orgId:     (payload[\"org\"]  as string) ?? null,\n    orgRole:   (payload[\"rol\"]  as string) ?? null,\n    sessionId: (payload[\"sid\"]  as string) ?? null,\n    riskLevel: ((payload[\"risk\"] as string) ?? \"low\") as AuthObject[\"riskLevel\"],\n    isSignedIn: true,\n    protect: makeProtect(true),\n  };\n}\n\n// ─── currentUser() ────────────────────────────────────────────────────────────\n\n/**\n * Returns the full user record for the currently signed-in user.\n * Calls GET /api/v1/me using the session JWT from the cookie as a Bearer token.\n * No extra env vars required.\n *\n * @example\n * import { currentUser } from \"@vaultix.ai/nextjs/server\";\n *\n * export default async function Page() {\n *   const user = await currentUser();\n *   if (!user) redirect(\"/sign-in\");\n *   return <div>Hello {user.email}</div>;\n * }\n */\nexport async function currentUser(): Promise<VaultixUser | null> {\n  const jar = await cookies();\n  const token = jar.get(\"vaultix-session\")?.value;\n  if (!token) return null;\n\n  const apiUrl = resolveApiUrl();\n  if (!apiUrl) return null;\n\n  try {\n    const res = await fetch(`${apiUrl}/api/v1/me`, {\n      headers: { Authorization: `Bearer ${token}` },\n      cache: \"no-store\",\n    });\n    if (!res.ok) return null;\n    const data = await res.json() as { user: VaultixUser };\n    return data.user ?? null;\n  } catch {\n    return null;\n  }\n}\n\n// ─── currentOrg() ────────────────────────────────────────────────────────────\n\n/**\n * Returns the active organization for the current user.\n * Requires VAULTIX_SECRET_KEY env var.\n */\nexport async function currentOrg(): Promise<VaultixOrganization | null> {\n  const { orgId } = await auth();\n  if (!orgId) return null;\n\n  const apiUrl = resolveApiUrl();\n  const secret = process.env.VAULTIX_SECRET_KEY;\n  if (!apiUrl || !secret) return null;\n\n  try {\n    const res = await fetch(`${apiUrl}/api/v1/orgs/${orgId}`, {\n      headers: { Authorization: `Bearer ${secret}` },\n      next: { revalidate: 30 },\n    } as RequestInit);\n    if (!res.ok) return null;\n    return (await res.json()) as VaultixOrganization;\n  } catch {\n    return null;\n  }\n}\n\n// ─── protect() — standalone helper ───────────────────────────────────────────\n\n/**\n * Asserts the current user is authenticated. Redirects to sign-in if not.\n * Prefer calling `protect()` from the auth object returned by `auth()`.\n *\n * @example\n * import { protect } from \"@vaultix.ai/nextjs/server\";\n * export default async function Page() {\n *   const { userId } = await protect();\n *   return <div>{userId}</div>;\n * }\n */\nexport async function protect(redirectTo?: string): Promise<AuthObject> {\n  const authObj = await auth();\n  authObj.protect(redirectTo);\n  return authObj;\n}\n","// Edge-runtime compatible. Uses jose for JWT verification.\nimport { createRemoteJWKSet, importSPKI, jwtVerify, type KeyLike } from \"jose\";\nimport { NextRequest, NextResponse } from \"next/server\";\n\n// ─── Types ────────────────────────────────────────────────────────────────────\n\nexport interface AuthResult {\n  userId: string | null;\n  orgId: string | null;\n  orgRole: string | null;\n  sessionId: string | null;\n  riskLevel: string | null;\n  isSignedIn: boolean;\n  isPublicRoute: boolean;\n}\n\nexport interface AuthMiddlewareOptions {\n  /**\n   * Routes that do not require authentication.\n   * Strings: exact match or prefix. RegExps: tested against pathname.\n   */\n  publicRoutes?: Array<string | RegExp>;\n\n  /**\n   * Where to redirect unauthenticated users.\n   * Defaults to the Vaultix hosted sign-in page (decoded from publishable key).\n   * Override with \"/sign-in\" to use your own page.\n   */\n  signInUrl?: string;\n\n  /**\n   * Vaultix API origin. Auto-decoded from NEXT_PUBLIC_VAULTIX_PUBLISHABLE_KEY.\n   * Only needed if you're not using the standard publishable key format.\n   */\n  apiUrl?: string;\n\n  /**\n   * Custom logic after auth state is resolved.\n   * Return a NextResponse to override default behaviour.\n   */\n  afterAuth?: (auth: AuthResult, req: NextRequest) => NextResponse | Response | undefined | void;\n}\n\n// ─── Header names ─────────────────────────────────────────────────────────────\n\nexport const HEADER_USER_ID    = \"x-vaultix-user-id\";\nexport const HEADER_ORG_ID     = \"x-vaultix-org-id\";\nexport const HEADER_ORG_ROLE   = \"x-vaultix-org-role\";\nexport const HEADER_SESSION_ID = \"x-vaultix-session-id\";\nexport const HEADER_RISK_LEVEL = \"x-vaultix-risk-level\";\n\n// ─── Publishable key → API URL ────────────────────────────────────────────────\n\nfunction decodeApiUrlFromKey(pk: string): string {\n  try {\n    const parts = pk.split(\"_\");\n    if (parts.length >= 4 && parts[0] === \"vaultix\" && parts[1] === \"pk\") {\n      return atob(parts.slice(3).join(\"_\")).replace(/\\/$/, \"\");\n    }\n  } catch {}\n  return \"\";\n}\n\nfunction resolveApiUrl(options: AuthMiddlewareOptions): string {\n  if (options.apiUrl) return options.apiUrl.replace(/\\/$/, \"\");\n  if (process.env.VAULTIX_API_URL) return process.env.VAULTIX_API_URL.replace(/\\/$/, \"\");\n  const pk = process.env.NEXT_PUBLIC_VAULTIX_PUBLISHABLE_KEY ?? \"\";\n  return decodeApiUrlFromKey(pk);\n}\n\n// ─── JWKS cache ───────────────────────────────────────────────────────────────\n// createRemoteJWKSet fetches and caches the key set, re-fetches on rotation.\n// Falls back to a static PEM key if VAULTIX_JWT_PUBLIC_KEY is set (backward compat).\n\nlet remoteJwks: ReturnType<typeof createRemoteJWKSet> | null = null;\nlet remoteJwksUrl: string | null = null;\n\nlet staticKey: KeyLike | null = null;\nlet staticPem: string | null = null;\n\nasync function getVerifyKey(apiUrl: string) {\n  // Prefer static PEM (set by env var) for zero-network-call verification\n  const pem = process.env.VAULTIX_JWT_PUBLIC_KEY;\n  if (pem) {\n    const normalized = pem.replace(/\\\\n/g, \"\\n\");\n    if (staticKey && staticPem === normalized) return { key: staticKey, mode: \"static\" as const };\n    staticKey = await importSPKI(normalized, \"RS256\");\n    staticPem = normalized;\n    return { key: staticKey, mode: \"static\" as const };\n  }\n\n  // Auto-fetch JWKS from the API — no env var needed\n  if (!apiUrl) return null;\n  const jwksUrl = `${apiUrl}/api/v1/.well-known/jwks.json`;\n  if (!remoteJwks || remoteJwksUrl !== jwksUrl) {\n    remoteJwks = createRemoteJWKSet(new URL(jwksUrl));\n    remoteJwksUrl = jwksUrl;\n  }\n  return { key: remoteJwks, mode: \"remote\" as const };\n}\n\n// ─── Route matching ───────────────────────────────────────────────────────────\n\nfunction isPublic(pathname: string, rules: Array<string | RegExp>): boolean {\n  return rules.some((rule) =>\n    typeof rule === \"string\"\n      ? pathname === rule || pathname.startsWith(rule)\n      : rule.test(pathname),\n  );\n}\n\n// ─── Handshake exchange ───────────────────────────────────────────────────────\n\nasync function handleHandshake(\n  req: NextRequest,\n  handshakeToken: string,\n  apiUrl: string,\n): Promise<NextResponse | null> {\n  try {\n    const res = await fetch(`${apiUrl}/api/v1/tokens/exchange`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({ handshake_token: handshakeToken }),\n    });\n    if (!res.ok) return null;\n\n    const { session_jwt } = (await res.json()) as { session_jwt: string };\n    const cleanUrl = req.nextUrl.clone();\n    cleanUrl.searchParams.delete(\"__vaultix_handshake\");\n\n    const response = NextResponse.redirect(cleanUrl);\n    response.cookies.set(\"vaultix-session\", session_jwt, {\n      httpOnly: true,\n      secure: true,\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: 30 * 24 * 60 * 60,\n    });\n    return response;\n  } catch {\n    return null;\n  }\n}\n\n// ─── authMiddleware ───────────────────────────────────────────────────────────\n\n/**\n * Drop-in auth middleware — works with zero config when\n * NEXT_PUBLIC_VAULTIX_PUBLISHABLE_KEY is set.\n *\n * @example\n * // middleware.ts\n * import { authMiddleware } from \"@vaultix.ai/nextjs/middleware\";\n * export default authMiddleware({ publicRoutes: [\"/\", \"/about\"] });\n * export const config = { matcher: [\"/((?!_next|.*\\\\..*).*)\"] };\n */\nexport function authMiddleware(options: AuthMiddlewareOptions = {}) {\n  const { publicRoutes = [], afterAuth } = options;\n\n  return async function middleware(req: NextRequest): Promise<NextResponse> {\n    const { pathname } = req.nextUrl;\n    const publicRoute = isPublic(pathname, publicRoutes);\n\n    const apiUrl = resolveApiUrl(options);\n\n    // Default sign-in URL: hosted Vaultix page decoded from publishable key\n    const signInUrl =\n      options.signInUrl ?? (apiUrl ? `${apiUrl}/auth/sign-in` : \"/sign-in\");\n\n    // ── Handshake exchange ─────────────────────────────────────────────────\n    const handshakeToken = req.nextUrl.searchParams.get(\"__vaultix_handshake\");\n    if (handshakeToken && apiUrl) {\n      const response = await handleHandshake(req, handshakeToken, apiUrl);\n      if (response) return response;\n    }\n\n    // ── JWT verification ───────────────────────────────────────────────────\n    let result: AuthResult = {\n      userId: null, orgId: null, orgRole: null,\n      sessionId: null, riskLevel: null,\n      isSignedIn: false, isPublicRoute: publicRoute,\n    };\n\n    const token =\n      req.cookies.get(\"vaultix-session\")?.value ??\n      extractBearer(req.headers.get(\"authorization\") ?? \"\");\n\n    if (token) {\n      const verifyKey = await getVerifyKey(apiUrl);\n      if (verifyKey) {\n        try {\n          const { payload } = await jwtVerify(token, verifyKey.key as Parameters<typeof jwtVerify>[1], {\n            algorithms: [\"RS256\"],\n          });\n          result = {\n            userId:    (payload[\"uid\"]  as string) ?? null,\n            orgId:     (payload[\"org\"]  as string) ?? null,\n            orgRole:   (payload[\"rol\"]  as string) ?? null,\n            sessionId: (payload[\"sid\"]  as string) ?? null,\n            riskLevel: (payload[\"risk\"] as string) ?? \"low\",\n            isSignedIn: true,\n            isPublicRoute: publicRoute,\n          };\n        } catch {\n          // expired / tampered\n        }\n      }\n    }\n\n    // ── Custom afterAuth hook ──────────────────────────────────────────────\n    if (afterAuth) {\n      const override = afterAuth(result, req);\n      if (override) return override as NextResponse;\n    }\n\n    // ── Default: redirect unauthenticated to sign-in ───────────────────────\n    if (!result.isSignedIn && !publicRoute) {\n      const dest = new URL(signInUrl, req.url);\n      dest.searchParams.set(\"redirect_url\", req.url);\n      return NextResponse.redirect(dest);\n    }\n\n    // ── Inject auth headers for Server Components ──────────────────────────\n    const next = new Headers(req.headers);\n    if (result.userId) {\n      next.set(HEADER_USER_ID,    result.userId);\n      next.set(HEADER_ORG_ID,     result.orgId ?? \"\");\n      next.set(HEADER_ORG_ROLE,   result.orgRole ?? \"\");\n      next.set(HEADER_SESSION_ID, result.sessionId ?? \"\");\n      next.set(HEADER_RISK_LEVEL, result.riskLevel ?? \"low\");\n    } else {\n      [HEADER_USER_ID, HEADER_ORG_ID, HEADER_ORG_ROLE, HEADER_SESSION_ID, HEADER_RISK_LEVEL]\n        .forEach((h) => next.delete(h));\n    }\n\n    return NextResponse.next({ request: { headers: next } });\n  };\n}\n\nfunction extractBearer(header: string): string {\n  return header.startsWith(\"Bearer \") ? header.slice(7) : \"\";\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,qBAAiC;AACjC,wBAAyB;AACzB,IAAAA,eAA0D;;;ACH1D,kBAAwE;AACxE,oBAA0C;AA2CnC,IAAM,iBAAoB;AAC1B,IAAM,gBAAoB;AAC1B,IAAM,kBAAoB;AAC1B,IAAM,oBAAoB;AAC1B,IAAM,oBAAoB;;;ADjBjC,SAAS,gBAAwB;AAC/B,MAAI,QAAQ,IAAI,gBAAiB,QAAO,QAAQ,IAAI,gBAAgB,QAAQ,OAAO,EAAE;AACrF,QAAM,KAAK,QAAQ,IAAI,uCAAuC;AAC9D,MAAI,CAAC,GAAI,QAAO;AAChB,MAAI;AACF,UAAM,QAAQ,GAAG,MAAM,GAAG;AAC1B,QAAI,MAAM,UAAU,KAAK,MAAM,CAAC,MAAM,aAAa,MAAM,CAAC,MAAM,MAAM;AACpE,aAAO,KAAK,MAAM,MAAM,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,OAAO,EAAE;AAAA,IACzD;AAAA,EACF,QAAQ;AAAA,EAAC;AACT,SAAO;AACT;AAIA,IAAI,cAA4D;AAChE,IAAI,iBAAgC;AACpC,IAAI,aAA4D;AAChE,IAAI,aAA4B;AAEhC,eAAe,UAAU,OAAe;AAEtC,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,KAAK;AACP,UAAM,aAAa,IAAI,QAAQ,QAAQ,IAAI;AAC3C,QAAI,CAAC,cAAc,eAAe,YAAY;AAC5C,mBAAa,UAAM,yBAAW,YAAY,OAAO;AACjD,mBAAa;AAAA,IACf;AACA,QAAI;AACF,YAAM,EAAE,QAAQ,IAAI,UAAM,wBAAU,OAAO,YAAY,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC;AAChF,aAAO;AAAA,IACT,QAAQ;AAAE,aAAO;AAAA,IAAM;AAAA,EACzB;AAGA,QAAM,SAAS,cAAc;AAC7B,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAU,GAAG,MAAM;AACzB,MAAI,CAAC,eAAe,mBAAmB,SAAS;AAC9C,sBAAc,iCAAmB,IAAI,IAAI,OAAO,CAAC;AACjD,qBAAiB;AAAA,EACnB;AACA,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,UAAM,wBAAU,OAAO,aAAa,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC;AACjF,WAAO;AAAA,EACT,QAAQ;AAAE,WAAO;AAAA,EAAM;AACzB;AAkBA,eAAsB,OAA4B;AAChD,WAAS,YAAY,YAAqB;AACxC,WAAO,CAAC,eAAwB;AAC9B,UAAI,CAAC,YAAY;AACf,cAAM,SAAS,cAAc;AAC7B,cAAM,OAAO,eAAe,SAAS,GAAG,MAAM,kBAAkB;AAChE,wCAAS,IAAI;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAGA,QAAM,IAAI,UAAM,wBAAQ;AACxB,QAAM,SAAS,EAAE,IAAI,cAAc;AACnC,MAAI,QAAQ;AACV,WAAO;AAAA,MACL;AAAA,MACA,OAAW,EAAE,IAAI,aAAa,KAAS;AAAA,MACvC,SAAW,EAAE,IAAI,eAAe,KAAO;AAAA,MACvC,WAAW,EAAE,IAAI,iBAAiB,KAAK;AAAA,MACvC,WAAY,EAAE,IAAI,iBAAiB,KAAK;AAAA,MACxC,YAAY;AAAA,MACZ,SAAS,YAAY,IAAI;AAAA,IAC3B;AAAA,EACF;AAGA,QAAM,MAAM,UAAM,wBAAQ;AAC1B,QAAM,QAAQ,IAAI,IAAI,iBAAiB,GAAG;AAC1C,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,MACL,QAAQ;AAAA,MAAM,OAAO;AAAA,MAAM,SAAS;AAAA,MACpC,WAAW;AAAA,MAAM,WAAW;AAAA,MAAM,YAAY;AAAA,MAC9C,SAAS,YAAY,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,UAAU,KAAK;AACrC,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,MACL,QAAQ;AAAA,MAAM,OAAO;AAAA,MAAM,SAAS;AAAA,MACpC,WAAW;AAAA,MAAM,WAAW;AAAA,MAAM,YAAY;AAAA,MAC9C,SAAS,YAAY,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAY,QAAQ,KAAK,KAAiB;AAAA,IAC1C,OAAY,QAAQ,KAAK,KAAiB;AAAA,IAC1C,SAAY,QAAQ,KAAK,KAAiB;AAAA,IAC1C,WAAY,QAAQ,KAAK,KAAiB;AAAA,IAC1C,WAAa,QAAQ,MAAM,KAAgB;AAAA,IAC3C,YAAY;AAAA,IACZ,SAAS,YAAY,IAAI;AAAA,EAC3B;AACF;AAkBA,eAAsB,cAA2C;AAC/D,QAAM,MAAM,UAAM,wBAAQ;AAC1B,QAAM,QAAQ,IAAI,IAAI,iBAAiB,GAAG;AAC1C,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,SAAS,cAAc;AAC7B,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,MAAM,cAAc;AAAA,MAC7C,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,MAC5C,OAAO;AAAA,IACT,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,WAAO,KAAK,QAAQ;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,eAAsB,aAAkD;AACtE,QAAM,EAAE,MAAM,IAAI,MAAM,KAAK;AAC7B,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,SAAS,cAAc;AAC7B,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,UAAU,CAAC,OAAQ,QAAO;AAE/B,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,MAAM,gBAAgB,KAAK,IAAI;AAAA,MACxD,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG;AAAA,MAC7C,MAAM,EAAE,YAAY,GAAG;AAAA,IACzB,CAAgB;AAChB,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAeA,eAAsB,QAAQ,YAA0C;AACtE,QAAM,UAAU,MAAM,KAAK;AAC3B,UAAQ,QAAQ,UAAU;AAC1B,SAAO;AACT;","names":["import_jose"]}

package/dist/server.mjs

@@ -1,6 +1,7 @@
 // src/server.ts
-import { headers } from "next/headers";
+import { cookies, headers } from "next/headers";
 import { redirect } from "next/navigation";
+import { createRemoteJWKSet as createRemoteJWKSet2, importSPKI as importSPKI2, jwtVerify as jwtVerify2 } from "jose";
 
 // src/middleware.ts
 import { createRemoteJWKSet, importSPKI, jwtVerify } from "jose";
@@ -12,48 +13,124 @@ var HEADER_SESSION_ID = "x-vaultix-session-id";
 var HEADER_RISK_LEVEL = "x-vaultix-risk-level";
 
 // src/server.ts
+function resolveApiUrl() {
+  if (process.env.VAULTIX_API_URL) return process.env.VAULTIX_API_URL.replace(/\/$/, "");
+  const pk = process.env.NEXT_PUBLIC_VAULTIX_PUBLISHABLE_KEY ?? "";
+  if (!pk) return "";
+  try {
+    const parts = pk.split("_");
+    if (parts.length >= 4 && parts[0] === "vaultix" && parts[1] === "pk") {
+      return atob(parts.slice(3).join("_")).replace(/\/$/, "");
+    }
+  } catch {
+  }
+  return "";
+}
+var _remoteJwks = null;
+var _remoteJwksUrl = null;
+var _staticKey = null;
+var _staticPem = null;
+async function verifyJwt(token) {
+  const pem = process.env.VAULTIX_JWT_PUBLIC_KEY;
+  if (pem) {
+    const normalized = pem.replace(/\\n/g, "\n");
+    if (!_staticKey || _staticPem !== normalized) {
+      _staticKey = await importSPKI2(normalized, "RS256");
+      _staticPem = normalized;
+    }
+    try {
+      const { payload } = await jwtVerify2(token, _staticKey, { algorithms: ["RS256"] });
+      return payload;
+    } catch {
+      return null;
+    }
+  }
+  const apiUrl = resolveApiUrl();
+  if (!apiUrl) return null;
+  const jwksUrl = `${apiUrl}/api/v1/.well-known/jwks.json`;
+  if (!_remoteJwks || _remoteJwksUrl !== jwksUrl) {
+    _remoteJwks = createRemoteJWKSet2(new URL(jwksUrl));
+    _remoteJwksUrl = jwksUrl;
+  }
+  try {
+    const { payload } = await jwtVerify2(token, _remoteJwks, { algorithms: ["RS256"] });
+    return payload;
+  } catch {
+    return null;
+  }
+}
 async function auth() {
+  function makeProtect(isSignedIn) {
+    return (redirectTo) => {
+      if (!isSignedIn) {
+        const apiUrl = resolveApiUrl();
+        const dest = redirectTo ?? (apiUrl ? `${apiUrl}/auth/sign-in` : "/sign-in");
+        redirect(dest);
+      }
+    };
+  }
   const h = await headers();
   const userId = h.get(HEADER_USER_ID);
-  if (!userId) {
+  if (userId) {
+    return {
+      userId,
+      orgId: h.get(HEADER_ORG_ID) || null,
+      orgRole: h.get(HEADER_ORG_ROLE) || null,
+      sessionId: h.get(HEADER_SESSION_ID) || null,
+      riskLevel: h.get(HEADER_RISK_LEVEL) ?? "low",
+      isSignedIn: true,
+      protect: makeProtect(true)
+    };
+  }
+  const jar = await cookies();
+  const token = jar.get("vaultix-session")?.value;
+  if (!token) {
+    return {
+      userId: null,
+      orgId: null,
+      orgRole: null,
+      sessionId: null,
+      riskLevel: null,
+      isSignedIn: false,
+      protect: makeProtect(false)
+    };
+  }
+  const payload = await verifyJwt(token);
+  if (!payload) {
     return {
       userId: null,
       orgId: null,
       orgRole: null,
       sessionId: null,
       riskLevel: null,
-      isSignedIn: false
+      isSignedIn: false,
+      protect: makeProtect(false)
     };
   }
   return {
-    userId,
-    orgId: h.get(HEADER_ORG_ID) || null,
-    orgRole: h.get(HEADER_ORG_ROLE) || null,
-    sessionId: h.get(HEADER_SESSION_ID) || null,
-    riskLevel: h.get(HEADER_RISK_LEVEL) ?? "low",
-    isSignedIn: true
+    userId: payload["uid"] ?? null,
+    orgId: payload["org"] ?? null,
+    orgRole: payload["rol"] ?? null,
+    sessionId: payload["sid"] ?? null,
+    riskLevel: payload["risk"] ?? "low",
+    isSignedIn: true,
+    protect: makeProtect(true)
   };
 }
-async function protect(redirectTo = "/sign-in") {
-  const authObj = await auth();
-  if (!authObj.isSignedIn) {
-    redirect(redirectTo);
-  }
-  return authObj;
-}
 async function currentUser() {
-  const { userId } = await auth();
-  if (!userId) return null;
-  const apiUrl = process.env["VAULTIX_API_URL"];
-  const secret = process.env["VAULTIX_SECRET_KEY"];
-  if (!apiUrl || !secret) return null;
+  const jar = await cookies();
+  const token = jar.get("vaultix-session")?.value;
+  if (!token) return null;
+  const apiUrl = resolveApiUrl();
+  if (!apiUrl) return null;
   try {
-    const res = await fetch(`${apiUrl}/v1/users/${userId}`, {
-      headers: { Authorization: `Bearer ${secret}` },
+    const res = await fetch(`${apiUrl}/api/v1/me`, {
+      headers: { Authorization: `Bearer ${token}` },
       cache: "no-store"
     });
     if (!res.ok) return null;
-    return await res.json();
+    const data = await res.json();
+    return data.user ?? null;
   } catch {
     return null;
   }
@@ -61,21 +138,25 @@ async function currentUser() {
 async function currentOrg() {
   const { orgId } = await auth();
   if (!orgId) return null;
-  const apiUrl = process.env["VAULTIX_API_URL"];
-  const secret = process.env["VAULTIX_SECRET_KEY"];
+  const apiUrl = resolveApiUrl();
+  const secret = process.env.VAULTIX_SECRET_KEY;
   if (!apiUrl || !secret) return null;
   try {
-    const orgFetchInit = {
+    const res = await fetch(`${apiUrl}/api/v1/orgs/${orgId}`, {
       headers: { Authorization: `Bearer ${secret}` },
       next: { revalidate: 30 }
-    };
-    const res = await fetch(`${apiUrl}/v1/orgs/${orgId}`, orgFetchInit);
+    });
     if (!res.ok) return null;
     return await res.json();
   } catch {
     return null;
   }
 }
+async function protect(redirectTo) {
+  const authObj = await auth();
+  authObj.protect(redirectTo);
+  return authObj;
+}
 export {
   auth,
   currentOrg,