@zitadel/sdk-core 0.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ZITADEL
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,3 @@
+# @zitadel/sdk-core
+
+Core public runtime types and mock flow helpers used by the v1 Zitadel setup CLI.

package/dist/index.d.ts

@@ -0,0 +1,22 @@
+export type { NextgenSession, AuthState, UnauthState, AuthResult, NextgenMiddlewareOptions } from "./types.js";
+export { HOP_BY_HOP, INTERNAL_HEADERS, matchesRoutes, filterResponseHeaders } from "./middleware.js";
+export { verifyJwt, decodeJwt, base64UrlDecode, JWKS_TTL_MS } from "./jwt.js";
+export type { JwtPayload, JwtHeader, DecodedJwt, VerifyJwtOptions } from "./jwt.js";
+export type ZitadelEnvironment = "development" | "preview" | "production";
+export type ZitadelRuntime = {
+    projectId: string;
+    environment: ZitadelEnvironment;
+    issuer?: string;
+};
+export type ZitadelRuntimeInput = {
+    projectId?: string;
+    environment?: ZitadelEnvironment;
+    issuer?: string;
+};
+export declare class ZitadelRuntimeError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare function resolveZitadelRuntimeEnv(env?: Record<string, string | undefined>): ZitadelRuntime;
+export declare function resolveZitadelRuntime(input: ZitadelRuntimeInput): ZitadelRuntime;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAC/G,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACrG,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC9E,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAEpF,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG,SAAS,GAAG,YAAY,CAAC;AAE1E,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,kBAAkB,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,YAAY,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAIxC;CACF;AAED,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAgB,GACrD,cAAc,CAMhB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAmBhF"}

package/dist/index.js

@@ -0,0 +1,36 @@
+import { HOP_BY_HOP as e, INTERNAL_HEADERS as t, filterResponseHeaders as n, matchesRoutes as r } from "./middleware.js";
+import { JWKS_TTL_MS as i, base64UrlDecode as a, decodeJwt as o, verifyJwt as s } from "./jwt.js";
+//#region src/index.ts
+var c = class extends Error {
+	code;
+	constructor(e, t) {
+		super(t), this.name = "ZitadelRuntimeError", this.code = e;
+	}
+};
+function l(e = f()) {
+	return u({
+		projectId: e.NEXT_PUBLIC_ZITADEL_PROJECT_ID ?? e.ZITADEL_PROJECT_ID,
+		environment: d(e.NEXT_PUBLIC_ZITADEL_ENVIRONMENT ?? e.ZITADEL_ENVIRONMENT),
+		issuer: e.NEXT_PUBLIC_ZITADEL_ISSUER ?? e.ZITADEL_ISSUER
+	});
+}
+function u(e) {
+	let t = e.environment ?? "development";
+	if (!e.projectId) throw new c("E_ZITADEL_CONFIG", "ZITADEL_PROJECT_ID is required for Zitadel runtime.");
+	if (t === "production" && !e.issuer) throw new c("E_ZITADEL_CONFIG", "ZITADEL_ISSUER is required in production.");
+	return {
+		projectId: e.projectId,
+		environment: t,
+		issuer: e.issuer
+	};
+}
+function d(e) {
+	if (!e || e === "development") return "development";
+	if (e === "preview" || e === "production") return e;
+	throw new c("E_ZITADEL_CONFIG", `Unsupported ZITADEL_ENVIRONMENT "${e}".`);
+}
+function f() {
+	return globalThis.process?.env ?? {};
+}
+//#endregion
+export { e as HOP_BY_HOP, t as INTERNAL_HEADERS, i as JWKS_TTL_MS, c as ZitadelRuntimeError, a as base64UrlDecode, o as decodeJwt, n as filterResponseHeaders, r as matchesRoutes, u as resolveZitadelRuntime, l as resolveZitadelRuntimeEnv, s as verifyJwt };

package/dist/jwt.d.ts

@@ -0,0 +1,264 @@
+/**
+ * @file lib/jwt.ts
+ *
+ * # JWT Verification
+ *
+ * Stateless JWT verification via JWKS, with in-process key caching.
+ *
+ * ## Anatomy of a JWT
+ *
+ * A compact JWT (JWS compact serialisation) is three Base64URL-encoded parts
+ * joined by dots:
+ *
+ * ```
+ * <header>.<payload>.<signature>
+ * ```
+ *
+ * - **Header** — metadata about the token: signing algorithm, key ID, token type.
+ * - **Payload** — the claims: user identity, expiry, issuer, audience, etc.
+ * - **Signature** — `SIGN(privateKey, "<header>.<payload>")`. Any party with the
+ *   matching public key can verify it without contacting the auth server.
+ *
+ * A valid signature proves two things:
+ *
+ * 1. **Authenticity** — the token was produced by the holder of the private key.
+ * 2. **Integrity** — neither the header nor the payload has been altered since signing.
+ *
+ * Signature verification alone is not sufficient. The claims inside the payload
+ * must also be checked (expiry, issuer, audience, …). Both steps are performed
+ * by {@link verifyJwt}.
+ *
+ * ---
+ *
+ * ## JWT Header fields
+ *
+ * The header is a JSON object Base64URL-encoded into the first segment.
+ *
+ * | Field | Purpose | Verified |
+ * |-------|---------|---------|
+ * | `alg` | Signing algorithm (`RS256`, `ES256`, …) | Checked against {@link VerifyJwtOptions.allowedAlgorithms} before JWKS is fetched |
+ * | `kid` | Key ID — selects the matching public key from the JWKS | Used for key lookup; falls back to the first JWKS key when absent |
+ * | `typ` | Token type (`JWT`, `at+JWT`, …) | Checked against {@link VerifyJwtOptions.allowedTokenTypes} (case-insensitive) |
+ * | ~~`enc`~~ | ~~Encryption algorithm — present in JWE (encrypted) tokens only~~ | ~~Not applicable — we verify JWS (signed) tokens, not JWE (encrypted)~~ |
+ * | ~~`cty`~~ | ~~Content type — describes the secured content media type~~ | ~~Not applicable — not set by standard OIDC/OAuth auth servers~~ |
+ *
+ * ---
+ *
+ * ## JWT Payload claims
+ *
+ * The payload is a JSON object Base64URL-encoded into the second segment.
+ *
+ * ### Validated claims
+ *
+ * | Claim | Purpose | How |
+ * |-------|---------|-----|
+ * | `iss` | Issuer — the URL of the auth server that issued the token | Must be present and must equal {@link VerifyJwtOptions.issuerUrl} |
+ * | `exp` | Expiration time — Unix timestamp after which the token is invalid | Must be present and in the future, allowing {@link VerifyJwtOptions.clockSkewMs} tolerance |
+ * | `nbf` | Not before — Unix timestamp before which the token must not be accepted | Must be in the past, allowing {@link VerifyJwtOptions.clockSkewMs} tolerance |
+ * | `iat` | Issued at — Unix timestamp when the token was created | Must not be in the future beyond {@link VerifyJwtOptions.clockSkewMs} |
+ * | `aud` | Audience — the intended recipient(s) of the token | Checked against {@link VerifyJwtOptions.audience} when that option is provided |
+ *
+ * ### Read-only claims (extracted into the session, not further validated)
+ *
+ * | Claim | Purpose |
+ * |-------|---------|
+ * | `sub` | Subject — the user's unique identifier |
+ * | `email` | User's email address |
+ * | `name` | User's display name |
+ *
+ * ### Not validated
+ *
+ * | Claim | Purpose | Why skipped |
+ * |-------|---------|-------------|
+ * | ~~`jti`~~ | ~~JWT ID — a unique identifier for this specific token instance~~ | ~~Revocation requires a server-side blocklist; not feasible in stateless edge middleware~~ |
+ * | ~~`azp`~~ | ~~Authorized party — the OAuth 2.0 client that requested the token~~ | ~~The proxy architecture means the browser never contacts the auth server directly, making cross-origin token replay a non-threat~~ |
+ * | ~~`nonce`~~ | ~~OIDC nonce — binds a token to a specific authorisation request~~ | ~~Not applicable in our password/cookie flow (no OIDC redirect round-trip)~~ |
+ * | ~~`acr`~~ | ~~Authentication class reference — describes the strength of the authentication~~ | ~~Not validated (future: require MFA for sensitive routes)~~ |
+ * | ~~`amr`~~ | ~~Authentication methods reference — list of methods used to authenticate~~ | ~~Not validated~~ |
+ * | ~~`scope`~~ | ~~OAuth 2.0 scopes granted to the token~~ | ~~Not validated (future: per-route scope enforcement)~~ |
+ *
+ * ---
+ *
+ * ## JWKS caching
+ *
+ * Public keys are expensive to fetch and import. They are cached in-process,
+ * keyed by `"${jwksUri}:${kid}"` (or `"${jwksUri}:__default__"` when `kid` is
+ * absent), for {@link JWKS_TTL_MS} milliseconds (default 5 minutes).
+ *
+ * Including the full JWKS URI in the cache key prevents a key imported for one
+ * issuer from being mistakenly served when a different issuer happens to use the
+ * same `kid` string — a scenario that can arise in multi-tenant deployments or
+ * during key-rotation incidents where two servers briefly share a key identifier.
+ *
+ * A cache miss — on first use or after TTL expiry — triggers a fresh fetch
+ * from `{issuerUrl}/auth/keys`.
+ *
+ * > **Note (serverless):** the cache is module-level. In serverless environments
+ * > each cold start gets a fresh cache; warm instances share it across requests.
+ *
+ * ---
+ *
+ * ## Runtime note
+ *
+ * This file is the **shared implementation** used by both `sdk-next` (Edge
+ * runtime) and `sdk-nuxt` (Node.js/Nitro). `base64UrlDecode` uses `atob`,
+ * which is available in both environments (Edge natively; Node.js since v16).
+ * The previous per-SDK copies (one using `atob`, one using `Buffer`) have
+ * been consolidated here.
+ */
+/** How long a cached JWKS key is considered fresh before re-fetching. */
+export declare const JWKS_TTL_MS: number;
+/**
+ * The subset of standard JWT payload claims this module reads or validates.
+ *
+ * All fields are `readonly`. Additional custom claims are preserved under
+ * the index signature and accessible via `payload["my-claim"]`.
+ *
+ * Refer to the module-level documentation for the full verification matrix.
+ */
+export interface JwtPayload {
+    /** Issuer (`iss`) — identifies the auth server that created the token. */
+    readonly iss?: string;
+    /** Subject (`sub`) — the user's unique identifier. */
+    readonly sub?: string;
+    /**
+     * Audience (`aud`) — the intended recipient(s).
+     * A single string or an array of strings per RFC 7519 §4.1.3.
+     */
+    readonly aud?: string | readonly string[];
+    /** Expiration time (`exp`) — seconds since Unix epoch. */
+    readonly exp?: number;
+    /** Not before (`nbf`) — seconds since Unix epoch. */
+    readonly nbf?: number;
+    /** Issued at (`iat`) — seconds since Unix epoch. */
+    readonly iat?: number;
+    /** User's email address (custom claim). */
+    readonly email?: string;
+    /** User's display name (custom claim). */
+    readonly name?: string;
+    readonly [key: string]: unknown;
+}
+/**
+ * The typed representation of a JWT header.
+ *
+ * The three fields below are the only ones this library reads. Additional
+ * header parameters are preserved under the index signature.
+ */
+export interface JwtHeader {
+    /** Signing algorithm (`alg`) — e.g. `"RS256"`, `"ES256"`. */
+    readonly alg?: string;
+    /** Token type (`typ`) — e.g. `"JWT"`, `"at+JWT"`. */
+    readonly typ?: string;
+    /** Key ID (`kid`) — selects the matching public key from the JWKS. */
+    readonly kid?: string;
+    readonly [key: string]: unknown;
+}
+/**
+ * The decoded, unverified parts of a compact-serialised JWT.
+ *
+ * **Do not act on these values before signature verification.**
+ * This type is returned by {@link decodeJwt} purely to carry the
+ * raw data into the next step.
+ */
+export interface DecodedJwt {
+    readonly header: JwtHeader;
+    readonly payload: JwtPayload;
+}
+/**
+ * Options for {@link verifyJwt}.
+ *
+ * All fields are `readonly` — this object is never mutated after construction.
+ */
+export interface VerifyJwtOptions {
+    /**
+     * Base URL of the auth backend.
+     *
+     * Serves two purposes:
+     * 1. Determines the JWKS endpoint: `{issuerUrl}/auth/keys`
+     * 2. Is compared against the `iss` claim when present in the token.
+     */
+    readonly issuerUrl: string;
+    /**
+     * Restrict accepted `alg` header values. Tokens whose algorithm is not in
+     * this list are rejected before the JWKS is fetched.
+     * When `undefined`, all algorithms are accepted (the middleware layer
+     * defaults to `["RS256", "ES256"]` before passing options here).
+     */
+    readonly allowedAlgorithms?: readonly string[];
+    /**
+     * Clock-skew tolerance in milliseconds, applied symmetrically to `exp`,
+     * `nbf`, and `iat` checks to accommodate minor differences between clocks.
+     */
+    readonly clockSkewMs: number;
+    /**
+     * Expected `aud` claim value(s). When `undefined`, audience is not
+     * validated. Provide a string or array when the auth server sets `aud`
+     * and you want to ensure the token was issued specifically for your app.
+     */
+    readonly audience?: string | readonly string[];
+    /**
+     * Accepted `typ` header values (case-insensitive).
+     *
+     * Guards against using a refresh token or ID token where an access token
+     * is expected. Set to an empty array (`[]`) to disable this check.
+     *
+     * @default ["JWT", "at+JWT"]
+     */
+    readonly allowedTokenTypes: readonly string[];
+    /**
+     * Timeout in milliseconds for JWKS endpoint requests.
+     * Requests that do not complete within this window are aborted and the
+     * token is rejected (function returns `null`).
+     * @default 5000
+     */
+    readonly jwksTimeoutMs?: number;
+}
+/**
+ * Decodes a Base64URL-encoded string into a `Uint8Array`.
+ *
+ * The Edge runtime has no `Buffer`, so this uses `atob` after translating the
+ * Base64URL alphabet (`-` → `+`, `_` → `/`) and padding to a multiple of four.
+ *
+ * @param input - A Base64URL-encoded string (padding is optional).
+ * @returns The decoded bytes.
+ */
+export declare function base64UrlDecode(input: string): Uint8Array<ArrayBuffer>;
+/**
+ * Decodes a compact-serialised JWT into its header and payload **without**
+ * verifying the signature.
+ *
+ * **Do not trust the result of this function alone.** Use it only as the first
+ * step of a full verification pipeline — the signature check in {@link verifyJwt}
+ * must follow before any claim can be trusted.
+ *
+ * @param token - A compact JWT string (`header.payload.signature`).
+ * @returns The decoded {@link DecodedJwt}.
+ * @throws {TypeError} When `token` has fewer than three dot-separated segments.
+ */
+export declare function decodeJwt(token: string): DecodedJwt;
+/**
+ * Verifies a compact-serialised JWT and returns its validated payload.
+ *
+ * ## Verification steps (in order)
+ *
+ * 1. Split the token — returns `null` immediately when fewer than three
+ *    dot-separated segments are present.
+ * 2. Reject if `alg` is not in {@link VerifyJwtOptions.allowedAlgorithms} (when set).
+ * 3. Reject if `typ` is not in {@link VerifyJwtOptions.allowedTokenTypes} (when non-empty).
+ * 4. Fetch (or retrieve from cache) the matching public key from the JWKS endpoint.
+ * 5. Verify the cryptographic signature over `header.payload`.
+ * 6. Reject if `iss` is absent or does not equal {@link VerifyJwtOptions.issuerUrl}.
+ * 7. Reject if {@link VerifyJwtOptions.audience} is set and `aud` does not contain it.
+ * 8. Reject if `exp` is absent or is in the past (minus clock-skew tolerance).
+ * 9. Reject if `nbf` is in the future (plus clock-skew tolerance).
+ * 10. Reject if `iat` is in the future (plus clock-skew tolerance).
+ *
+ * Returns `null` on any failure rather than throwing, so callers can treat a
+ * bad token identically to a missing one without try/catch at the call site.
+ *
+ * @param token - The raw compact-serialised JWT string.
+ * @param opts  - Verification options; see {@link VerifyJwtOptions}.
+ * @returns The verified {@link JwtPayload}, or `null` if verification fails.
+ */
+export declare function verifyJwt(token: string, opts: VerifyJwtOptions): Promise<JwtPayload | null>;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2GG;AAIH,yEAAyE;AACzE,eAAO,MAAM,WAAW,QAAiB,CAAC;AAI1C;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC1C,0DAA0D;IAC1D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;CAC9B;AAYD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE/C;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAE/C;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAE9C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AA8BD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAQtE;AA0BD;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAYnD;AAsHD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA6G5B"}

package/dist/jwt.js

@@ -0,0 +1,111 @@
+//#region src/jwt.ts
+var e = 300 * 1e3, t = /* @__PURE__ */ new Map(), n = new TextDecoder(), r = new TextEncoder();
+function i(e) {
+	let t = e.replace(/-/g, "+").replace(/_/g, "/"), n = t.padEnd(t.length + (4 - t.length % 4) % 4, "="), r = atob(n);
+	return Uint8Array.from(r, (e) => e.charCodeAt(0));
+}
+function a(e) {
+	let [t, n, r] = e.split(".");
+	return !t || !n || !r ? null : [
+		t,
+		n,
+		r
+	];
+}
+function o(e) {
+	let t = a(e);
+	if (!t) throw TypeError(`Invalid JWT: expected at least three dot-separated segments, received ${e.split(".").length}.`);
+	let [r, o] = t;
+	return {
+		header: JSON.parse(n.decode(i(r))),
+		payload: JSON.parse(n.decode(i(o)))
+	};
+}
+var s = {
+	RS256: {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-256"
+	},
+	RS384: {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-384"
+	},
+	RS512: {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-512"
+	},
+	ES256: {
+		name: "ECDSA",
+		namedCurve: "P-256"
+	},
+	ES384: {
+		name: "ECDSA",
+		namedCurve: "P-384"
+	},
+	ES512: {
+		name: "ECDSA",
+		namedCurve: "P-521"
+	}
+}, c = {
+	RS256: { name: "RSASSA-PKCS1-v1_5" },
+	RS384: { name: "RSASSA-PKCS1-v1_5" },
+	RS512: { name: "RSASSA-PKCS1-v1_5" },
+	ES256: {
+		name: "ECDSA",
+		hash: "SHA-256"
+	},
+	ES384: {
+		name: "ECDSA",
+		hash: "SHA-384"
+	},
+	ES512: {
+		name: "ECDSA",
+		hash: "SHA-512"
+	}
+};
+function l(e) {
+	if (!Object.hasOwn(s, e)) throw TypeError(`Unsupported JWT algorithm: "${e}". Supported algorithms are ${Object.keys(s).join(", ")}.`);
+}
+function u(e) {
+	return l(e), s[e];
+}
+function d(e) {
+	return l(e), c[e];
+}
+async function f(e, n, r) {
+	let i = `${e}:${n ?? "__default__"}`, a = t.get(i);
+	if (a && Date.now() - a.fetchedAt < 3e5) return a.key;
+	let o = await fetch(e, { signal: AbortSignal.timeout(r) });
+	if (!o.ok) return null;
+	let s = await o.json(), c = n ? s.keys.find((e) => e.kid === n) : s.keys[0];
+	if (!c) return null;
+	let l = c.alg ?? "RS256", d = await crypto.subtle.importKey("jwk", c, u(l), !1, ["verify"]);
+	return t.set(i, {
+		key: d,
+		fetchedAt: Date.now()
+	}), d;
+}
+async function p(e, t) {
+	try {
+		let { issuerUrl: o, allowedAlgorithms: s, clockSkewMs: c, audience: l, allowedTokenTypes: u, jwksTimeoutMs: p = 5e3 } = t, m = a(e);
+		if (!m) return null;
+		let [h, g, _] = m, v = JSON.parse(n.decode(i(h))), y = JSON.parse(n.decode(i(g))), b = v.alg;
+		if (!b || b.toLowerCase() === "none" || s?.length && !s.includes(b)) return null;
+		if (u.length > 0) {
+			let e = v.typ ?? "";
+			if (!u.some((t) => t.toLowerCase() === e.toLowerCase())) return null;
+		}
+		let x = v.kid, S = await f(`${o}/auth/keys`, x, p);
+		if (!S || !await crypto.subtle.verify(d(b), S, i(_), r.encode(`${h}.${g}`)) || y.iss !== o) return null;
+		if (l !== void 0) {
+			let e = y.aud === void 0 ? [] : [y.aud].flat();
+			if (![l].flat().some((t) => e.includes(t))) return null;
+		}
+		let C = Date.now();
+		return y.exp === void 0 || y.exp * 1e3 < C - c || y.nbf !== void 0 && y.nbf * 1e3 > C + c || y.iat !== void 0 && y.iat * 1e3 > C + c ? null : y;
+	} catch (e) {
+		return console.error("[nextgen] verifyJwt unexpected error:", e), null;
+	}
+}
+//#endregion
+export { e as JWKS_TTL_MS, i as base64UrlDecode, o as decodeJwt, p as verifyJwt };

package/dist/middleware.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Shared constants and utility functions for the SDK middleware proxy layer.
+ *
+ * These are consumed by both `sdk-next` and `sdk-nuxt` to avoid duplicating
+ * pure, framework-agnostic logic.
+ */
+/**
+ * Headers that must never be forwarded to an upstream service.
+ * These are connection-level headers that are meaningful only between
+ * two directly connected peers and become invalid when proxied.
+ */
+export declare const HOP_BY_HOP: ReadonlySet<string>;
+/**
+ * SDK-internal headers that must never be forwarded to the upstream backend.
+ * These headers carry session data between the middleware and server components;
+ * forwarding them upstream would expose internal state and allow header injection.
+ */
+export declare const INTERNAL_HEADERS: ReadonlySet<string>;
+/**
+ * Returns `true` when `pathname` matches at least one entry in `routes`.
+ *
+ * An entry ending with `*` matches any path that starts with the prefix
+ * before the `*`. All other entries require an exact match.
+ *
+ * @param pathname - The URL pathname to test.
+ * @param routes   - The list of route patterns to match against.
+ * @returns `true` if at least one pattern matches.
+ */
+export declare function matchesRoutes(pathname: string, routes: readonly string[]): boolean;
+/**
+ * Filters upstream response headers for proxying: strips hop-by-hop headers,
+ * `set-cookie` (handled separately via `getSetCookie()`), and `location`
+ * (prevents leaking internal upstream URLs).
+ *
+ * @param upstream - The upstream response headers.
+ * @returns A new `Headers` object with filtered headers.
+ */
+export declare function filterResponseHeaders(upstream: Headers): Headers;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,MAAM,CAazC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAE/C,CAAC;AAKH;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB,OAAO,CAUT;AAID;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAYhE"}

package/dist/middleware.js

@@ -0,0 +1,22 @@
+//#region src/middleware.ts
+var e = new Set([
+	"connection",
+	"host",
+	"keep-alive",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade"
+]), t = new Set(["x-nextgen-auth-token"]);
+function n(e, t) {
+	return t.length === 0 ? !1 : t.some((t) => t.endsWith("*") ? e.startsWith(t.slice(0, -1)) : e === t);
+}
+function r(t) {
+	let n = new Headers();
+	for (let [r, i] of t.entries()) !e.has(r.toLowerCase()) && r.toLowerCase() !== "set-cookie" && r.toLowerCase() !== "location" && n.set(r, i);
+	return n;
+}
+//#endregion
+export { e as HOP_BY_HOP, t as INTERNAL_HEADERS, r as filterResponseHeaders, n as matchesRoutes };

package/dist/tsconfig.lib.tsbuildinfo

@@ -0,0 +1 @@
+{"version":"7.0.0-dev.20260421.2","root":[[60,63]],"fileNames":["lib.es5.d.ts","lib.es2015.d.ts","lib.es2016.d.ts","lib.es2017.d.ts","lib.es2018.d.ts","lib.es2019.d.ts","lib.es2020.d.ts","lib.es2021.d.ts","lib.es2022.d.ts","lib.dom.d.ts","lib.dom.iterable.d.ts","lib.es2015.core.d.ts","lib.es2015.collection.d.ts","lib.es2015.generator.d.ts","lib.es2015.iterable.d.ts","lib.es2015.promise.d.ts","lib.es2015.proxy.d.ts","lib.es2015.reflect.d.ts","lib.es2015.symbol.d.ts","lib.es2015.symbol.wellknown.d.ts","lib.es2016.array.include.d.ts","lib.es2016.intl.d.ts","lib.es2017.arraybuffer.d.ts","lib.es2017.date.d.ts","lib.es2017.object.d.ts","lib.es2017.sharedmemory.d.ts","lib.es2017.string.d.ts","lib.es2017.intl.d.ts","lib.es2017.typedarrays.d.ts","lib.es2018.asyncgenerator.d.ts","lib.es2018.asynciterable.d.ts","lib.es2018.intl.d.ts","lib.es2018.promise.d.ts","lib.es2018.regexp.d.ts","lib.es2019.array.d.ts","lib.es2019.object.d.ts","lib.es2019.string.d.ts","lib.es2019.symbol.d.ts","lib.es2019.intl.d.ts","lib.es2020.bigint.d.ts","lib.es2020.date.d.ts","lib.es2020.promise.d.ts","lib.es2020.sharedmemory.d.ts","lib.es2020.string.d.ts","lib.es2020.symbol.wellknown.d.ts","lib.es2020.intl.d.ts","lib.es2020.number.d.ts","lib.es2021.promise.d.ts","lib.es2021.string.d.ts","lib.es2021.weakref.d.ts","lib.es2021.intl.d.ts","lib.es2022.array.d.ts","lib.es2022.error.d.ts","lib.es2022.intl.d.ts","lib.es2022.object.d.ts","lib.es2022.string.d.ts","lib.es2022.regexp.d.ts","lib.decorators.d.ts","lib.decorators.legacy.d.ts","../src/types.ts","../src/middleware.ts","../src/jwt.ts","../src/index.ts"],"fileInfos":[{"version":"a1aa1a5e065d48ef5c7bb99e38412f96","affectsGlobalScope":true,"impliedNodeFormat":1},"d4306fb2e47f74835e8674ffac07d76f","e437c5c1302869326c3bb93da85bbbcf","e4324975a566567b21d350615f1fc6ac","333b1b9a2a9ac3b8497dba5c63b5ba50","6cffacd662b6eb5fa7a36aa2ea366bfa","b4c34f9c23304dbef2d23698637ed638","e5cb86a5fc491796ecd1d2dd348d208f","feb6c6fb19cdb246a5d8acb36a6901c7",{"version":"aae8996e8b5684814785a42cbbefcd79","affectsGlobalScope":true,"impliedNodeFormat":1},"abad6dd56cc8caf095c165df8124d237",{"version":"01ac052ec4a79e87229f90466a9645f8","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"edba5df642941aa062a62f6328c6df3d","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"6344b55f26a4e81d9608777dbfb877dd","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"3c0ed28e53d3695b363e256ec1c023fd","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"4c2761daba7f17141c25baa0821ac5da","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"b87656acabd63e69379ff6ffcfe52fc7","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"597469522da047a5af5222cc6989f405","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"bb3a710cbcda0533bb127712927cbe37","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"55d97a8c6fbf34a30450a7b1e5f7a298","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"0ee05eb59426d33e374226d8dcfa708b","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"e347c14030993906efcfbb88915b6a05","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"b0231263857c9b6a03641acdc9280ceb","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"3b15c4a83b598cacb4067676e6f0abed","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"b417d97b7934cef63b1889abec0bbfbf","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"09a6cf4032ebba60ce22a501e663f881","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"7a42de379b489e8f7b647455bebfc576","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"e22cc07e3f3cc242ba52fa3f8ea1fc58","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"2c45da767a1bfbb220848df1bc4029e4","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"b44c3e0fbaf2130cdcf6ac38b120ffa1","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"b612fb5cf8e5d964b92063a75207632a","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"02705151a5e1551b9162a9ed8ab763f7","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"41025e398be9215d32e4337335da8f0b","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"52684c2b1f353a5538e4f275182a54cd","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"6dedb6a4f90d1df3a6fbe5693e44886c","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"ca3f36fe3562c07e0f0d71c2bebd3f6d","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"409974d6129befbb8226ddd1c6558568","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"4d9cfde2a1ae1b4925f1f9bc10848e5d","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"7e1daecc66dd564144e3bb1a0266b5fd","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"a8e1d9bb35fd0637f2f9fd2b2a54f2ec","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"4f168501772a6543182765bfd5f2fbfe","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"a19c80aad1b2162103496f5ba293a732","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"b69afa63cd5d059851c78adb2856ee09","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"ae2fc5d954e9b0f5feee3d481b953c27","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"1cfd3091a071d8b6feec15277643bafe","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"692bcd75364db0f65d428801c7884466","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"a0d87491913d843139e0c993650a3235","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"4ef72aa378127e7b7abba915b0110b1e","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"3ec74c6a7d4463f0254db3a74cf75646","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"84c2bdfa470d075526cce6322d81b0b6","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"0b3844c2b8c73e4e1ab91431411cad11","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"4fc71cf4a15b8d99675a31df77f26e07","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"d1b49564ddaeca3df5b6dbae925d2242","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"6a25be566d60ccfc2d6e8b7bfdeefa83","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"8a20e27646985dfd58c57ca6566553dd","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"9969f02ad3cdcbf4f709405cda44167f","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"9c9be4792a7a4f42c15ae7360bf28779","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"f64453cbf9671f28158677fa5c43967a","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"33f317af5428801f944a478d2c1e38e5","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"15066bf16fe04ec6d0316cdf19792ac6","signature":"115cce73bdd0821315dbb80c30b72867","impliedNodeFormat":99},{"version":"0ef9f01c1bd1aa2651b01c95d2939eeb","signature":"4395702c4db54aa3eb7c9e41e69dc921","impliedNodeFormat":99},{"version":"f3487fd2342ffcd57a681a7e2830440f","signature":"d7f410111bbbc4f358dcc07db3151877","impliedNodeFormat":99},{"version":"5beb6125d20dbc2c73e35a96973e834a","signature":"0528ac935bfd6a3063a9bfad4cbee925","impliedNodeFormat":99}],"fileIdsList":[[60,61,62]],"options":{"composite":true,"emitDeclarationOnly":true,"declarationMap":true,"importHelpers":true,"module":199,"noFallthroughCasesInSwitch":true,"noImplicitReturns":true,"noUncheckedIndexedAccess":true,"noEmitOnError":true,"noUnusedLocals":true,"noImplicitOverride":true,"outDir":"./","rootDir":"../src","skipLibCheck":true,"strict":true,"target":9,"tsBuildInfoFile":"./tsconfig.lib.tsbuildinfo"},"referencedMap":[[63,1]],"latestChangedDtsFile":"./index.d.ts"}

package/dist/types.d.ts

@@ -0,0 +1,199 @@
+/**
+ * Shared types for the Nextgen SDK middleware layer.
+ *
+ * These types are consumed by both `sdk-next` and `sdk-nuxt`. Each SDK
+ * re-exports them from its own public surface so consumers don't need
+ * to add a direct `sdk-core` dependency.
+ */
+/**
+ * The authenticated session for a signed-in user.
+ */
+export type NextgenSession = {
+    /** The user's unique identifier (`sub` claim). */
+    userId: string;
+    /** The user's email address, or `null` if not present in the token. */
+    email: string | null;
+    /** The user's display name, or `null` if not present in the token. */
+    name: string | null;
+    /** The raw verified JWT. */
+    token: string;
+};
+/** Auth state when the user is signed in. */
+export type AuthState = {
+    isAuthenticated: true;
+    session: NextgenSession;
+};
+/** Auth state when the user is not signed in. */
+export type UnauthState = {
+    isAuthenticated: false;
+    session: null;
+};
+/** Union of all possible auth states. */
+export type AuthResult = AuthState | UnauthState;
+/**
+ * Options passed to the SDK middleware factory (`nextgenMiddleware` in
+ * sdk-next, `createNextgenMiddleware` in sdk-nuxt).
+ */
+export type NextgenMiddlewareOptions = {
+    /**
+     * Full URL of the Zitadel auth backend.
+     * @default process.env.ZITADEL_URL ?? "http://localhost:8080"
+     */
+    url?: string;
+    /**
+     * URL path prefix that is reverse-proxied to the auth backend.
+     * @default "/__nextgen"
+     */
+    proxyPath?: string;
+    /**
+     * Pathnames that require a valid session. Requests to these routes without
+     * a valid token are redirected to {@link loginPath}.
+     * Entries ending with `*` match any sub-path (e.g. `"/admin*"`).
+     * @default []
+     */
+    protectedRoutes?: string[];
+    /**
+     * Pathnames that are completely skipped by the middleware — no JWT
+     * verification, no protection check, no header tunnelling.
+     * Useful for webhooks, health-check endpoints, or any route where
+     * running auth logic is undesirable.
+     * Entries ending with `*` match any sub-path (e.g. `"/public*"`).
+     * @default []
+     */
+    ignoredRoutes?: string[];
+    /**
+     * Pathname to redirect unauthenticated users to.
+     * A `next` query parameter is appended with the originally requested path.
+     * @default "/login"
+     */
+    loginPath?: string;
+    /**
+     * Reserved for future use. Local PEM public key for offline JWT verification.
+     */
+    jwtKey?: string;
+    /**
+     * Restrict accepted JWT `alg` header values. Tokens whose algorithm is not
+     * in this list are rejected before JWKS is fetched.
+     * @default ["RS256", "ES256"]
+     */
+    allowedAlgorithms?: string[];
+    /**
+     * Clock skew tolerance in milliseconds applied to `exp`, `nbf`, and `iat`
+     * claim validation.
+     * @default 5000
+     */
+    clockSkewMs?: number;
+    /**
+     * Expected value(s) of the `aud` claim. When omitted, audience is not
+     * validated. Pass a single string or an array when a token may carry
+     * multiple audiences.
+     */
+    audience?: string | string[];
+    /**
+     * Accepted values for the JWT header `typ` claim (case-insensitive).
+     * Tokens whose `typ` is not in this list are rejected.
+     * Set to `[]` to disable token-type checking entirely.
+     * @default ["JWT", "at+JWT"]
+     */
+    allowedTokenTypes?: string[];
+    /**
+     * Timeout in milliseconds for JWKS endpoint requests.
+     * Requests that do not complete within this window are aborted and the
+     * token is rejected, treating the request as unauthenticated.
+     * @default 5000
+     */
+    jwksTimeoutMs?: number;
+    /**
+     * Timeout in milliseconds for upstream proxy requests.
+     * Requests that do not complete within this window are aborted with a
+     * network error. Defaults to 5 000 ms.
+     * @default 5000
+     */
+    proxyTimeoutMs?: number;
+    /**
+     * Optional hook called when a `POST /sessions/exchange` response is
+     * proxied back to the browser. Receives the upstream `Response` after
+     * hop-by-hop stripping and cookie upgrading. Return a modified
+     * `Response` to add custom headers, extra `Set-Cookie` values, or
+     * transform the body.
+     *
+     * The callback runs on the server — it has access to the full response
+     * including `Set-Cookie` headers that are `HttpOnly` and invisible to
+     * client-side JavaScript. It fires **after** the upstream has processed
+     * the exchange; it cannot prevent the exchange itself (return a 403
+     * `Response` to block the browser from receiving it).
+     *
+     * **Capabilities:**
+     *
+     * - **Add or modify cookies** — append `Set-Cookie` headers for
+     *   user-preferences, analytics IDs, or any server-side state.
+     * - **Make additional fetch calls** — enrich the session by calling
+     *   your own backend, a profile service, or any external API. The
+     *   response body can be read with `response.json()` to extract
+     *   session details like `user_id`.
+     * - **Map or transform response properties** — reshape the JSON body
+     *   before it reaches the browser (e.g. strip internal fields, add
+     *   computed properties).
+     * - **Logging and auditing** — clone the response, read its body for
+     *   audit trails, and return the original unchanged.
+     *
+     * @example Add a cookie
+     * ```ts
+     * onExchangeResponse: async (response) => {
+     *   const headers = new Headers(response.headers);
+     *   headers.append("Set-Cookie", "theme=dark; Path=/; SameSite=Lax");
+     *   return new Response(response.body, {
+     *     status: response.status,
+     *     headers,
+     *   });
+     * },
+     * ```
+     *
+     * @example Fetch additional data and set a cookie from it
+     * ```ts
+     * onExchangeResponse: async (response) => {
+     *   const body = await response.json();
+     *   const profile = await fetch(
+     *     `https://api.example.com/users/${body.session.user_id}`,
+     *   );
+     *   const { locale } = await profile.json();
+     *   const headers = new Headers(response.headers);
+     *   headers.append("Set-Cookie", `locale=${locale}; Path=/; SameSite=Lax`);
+     *   return new Response(JSON.stringify(body), {
+     *     status: response.status,
+     *     headers,
+     *   });
+     * },
+     * ```
+     *
+     * @example Log the exchange for auditing (pass-through)
+     * ```ts
+     * onExchangeResponse: async (response) => {
+     *   const cloned = response.clone();
+     *   const body = await cloned.json();
+     *   await auditLog.record("session_exchange", body.session.session_id);
+     *   return response;
+     * },
+     * ```
+     *
+     * @example Modify existing cookies (e.g. tighten the session cookie path)
+     * ```ts
+     * onExchangeResponse: async (response) => {
+     *   const headers = new Headers();
+     *   for (const [key, value] of response.headers.entries()) {
+     *     if (key.toLowerCase() !== "set-cookie") headers.set(key, value);
+     *   }
+     *   for (const cookie of response.headers.getSetCookie()) {
+     *     if (cookie.startsWith("__nextgen_session=")) {
+     *       headers.append("set-cookie", cookie.replace("Path=/", "Path=/app"));
+     *     } else {
+     *       headers.append("set-cookie", cookie);
+     *     }
+     *   }
+     *   return new Response(response.body, { status: response.status, headers });
+     * },
+     * ```
+     */
+    onExchangeResponse?: (response: Response) => Response | Promise<Response>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,sEAAsE;IACtE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,SAAS,GAAG;IAAE,eAAe,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAE3E,iDAAiD;AACjD,MAAM,MAAM,WAAW,GAAG;IAAE,eAAe,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC;AAEpE,yCAAyC;AACzC,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,WAAW,CAAC;AAEjD;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE7B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE7B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmFG;IACH,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC3E,CAAC"}

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@zitadel/sdk-core",
+  "version": "0.0.0",
+  "description": "Core types and shared utilities for Zitadel SDKs",
+  "homepage": "https://github.com/zitadel/nextgen/tree/main/packages/sdk-core#readme",
+  "bugs": {
+    "url": "https://github.com/zitadel/nextgen/issues"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/zitadel/nextgen.git",
+    "directory": "packages/sdk-core"
+  },
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "@zitadel/source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./types": {
+      "@zitadel/source": "./src/types.ts",
+      "types": "./dist/types.d.ts",
+      "import": "./dist/types.js"
+    },
+    "./jwt": {
+      "@zitadel/source": "./src/jwt.ts",
+      "types": "./dist/jwt.d.ts",
+      "import": "./dist/jwt.js"
+    },
+    "./middleware": {
+      "@zitadel/source": "./src/middleware.ts",
+      "types": "./dist/middleware.d.ts",
+      "import": "./dist/middleware.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}