@zitadel/sdk-core 0.1.0-alpha.4 → 0.1.0-alpha.8

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAC/G,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACrG,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC9E,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAEpF,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG,SAAS,GAAG,YAAY,CAAC;AAE1E,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,kBAAkB,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,YAAY,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAIxC;CACF;AAED,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAgB,GACrD,cAAc,CAMhB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAmBhF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAC/G,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACrG,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC9E,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAEpF,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG,SAAS,GAAG,YAAY,CAAC;AAE1E,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,kBAAkB,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAED,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAgB,GACrD,cAAc,CAMhB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAmBhF"}

package/dist/index.js

@@ -1,36 +1,51 @@
-import { HOP_BY_HOP as e, INTERNAL_HEADERS as t, filterResponseHeaders as n, matchesRoutes as r } from "./middleware.js";
-import { JWKS_TTL_MS as i, base64UrlDecode as a, decodeJwt as o, verifyJwt as s } from "./jwt.js";
-//#region src/index.ts
-var c = class extends Error {
-	code;
-	constructor(e, t) {
-		super(t), this.name = "ZitadelRuntimeError", this.code = e;
-	}
-};
-function l(e = f()) {
-	return u({
-		projectId: e.NEXT_PUBLIC_ZITADEL_PROJECT_ID ?? e.ZITADEL_PROJECT_ID,
-		environment: d(e.NEXT_PUBLIC_ZITADEL_ENVIRONMENT ?? e.ZITADEL_ENVIRONMENT),
-		issuer: e.NEXT_PUBLIC_ZITADEL_ISSUER ?? e.ZITADEL_ISSUER
-	});
+export { HOP_BY_HOP, INTERNAL_HEADERS, matchesRoutes, filterResponseHeaders } from "./middleware.js";
+export { verifyJwt, decodeJwt, base64UrlDecode, JWKS_TTL_MS } from "./jwt.js";
+export class ZitadelRuntimeError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "ZitadelRuntimeError";
+        this.code = code;
+    }
 }
-function u(e) {
-	let t = e.environment ?? "development";
-	if (!e.projectId) throw new c("E_ZITADEL_CONFIG", "ZITADEL_PROJECT_ID is required for Zitadel runtime.");
-	if (t === "production" && !e.issuer) throw new c("E_ZITADEL_CONFIG", "ZITADEL_ISSUER is required in production.");
-	return {
-		projectId: e.projectId,
-		environment: t,
-		issuer: e.issuer
-	};
+export function resolveZitadelRuntimeEnv(env = currentEnv()) {
+    return resolveZitadelRuntime({
+        projectId: env.NEXT_PUBLIC_ZITADEL_PROJECT_ID ?? env.ZITADEL_PROJECT_ID,
+        environment: parseEnvironment(env.NEXT_PUBLIC_ZITADEL_ENVIRONMENT ?? env.ZITADEL_ENVIRONMENT),
+        issuer: env.NEXT_PUBLIC_ZITADEL_ISSUER ?? env.ZITADEL_ISSUER,
+    });
 }
-function d(e) {
-	if (!e || e === "development") return "development";
-	if (e === "preview" || e === "production") return e;
-	throw new c("E_ZITADEL_CONFIG", `Unsupported ZITADEL_ENVIRONMENT "${e}".`);
+export function resolveZitadelRuntime(input) {
+    const environment = input.environment ?? "development";
+    if (!input.projectId) {
+        throw new ZitadelRuntimeError("E_ZITADEL_CONFIG", "ZITADEL_PROJECT_ID is required for Zitadel runtime.");
+    }
+    if (environment === "production" && !input.issuer) {
+        throw new ZitadelRuntimeError("E_ZITADEL_CONFIG", "ZITADEL_ISSUER is required in production.");
+    }
+    return {
+        projectId: input.projectId,
+        environment,
+        issuer: input.issuer,
+    };
 }
-function f() {
-	return globalThis.process?.env ?? {};
+function parseEnvironment(value) {
+    if (!value || value === "development")
+        return "development";
+    if (value === "preview" || value === "production")
+        return value;
+    throw new ZitadelRuntimeError("E_ZITADEL_CONFIG", `Unsupported ZITADEL_ENVIRONMENT "${value}".`);
+}
+// @ts-expect-error will be used later
+// oxlint-disable-next-line no-unused-vars
+function requireEnv(env, key) {
+    const value = env[key];
+    if (!value) {
+        throw new ZitadelRuntimeError("E_ZITADEL_CONFIG", `${key} is required for Zitadel runtime.`);
+    }
+    return value;
+}
+function currentEnv() {
+    const scope = globalThis;
+    return scope.process?.env ?? {};
 }
-//#endregion
-export { e as HOP_BY_HOP, t as INTERNAL_HEADERS, i as JWKS_TTL_MS, c as ZitadelRuntimeError, a as base64UrlDecode, o as decodeJwt, n as filterResponseHeaders, r as matchesRoutes, u as resolveZitadelRuntime, l as resolveZitadelRuntimeEnv, s as verifyJwt };

package/dist/jwt.js

@@ -1,111 +1,383 @@
-//#region src/jwt.ts
-var e = 300 * 1e3, t = /* @__PURE__ */ new Map(), n = new TextDecoder(), r = new TextEncoder();
-function i(e) {
-	let t = e.replace(/-/g, "+").replace(/_/g, "/"), n = t.padEnd(t.length + (4 - t.length % 4) % 4, "="), r = atob(n);
-	return Uint8Array.from(r, (e) => e.charCodeAt(0));
+/**
+ * @file lib/jwt.ts
+ *
+ * # JWT Verification
+ *
+ * Stateless JWT verification via JWKS, with in-process key caching.
+ *
+ * ## Anatomy of a JWT
+ *
+ * A compact JWT (JWS compact serialisation) is three Base64URL-encoded parts
+ * joined by dots:
+ *
+ * ```
+ * <header>.<payload>.<signature>
+ * ```
+ *
+ * - **Header** — metadata about the token: signing algorithm, key ID, token type.
+ * - **Payload** — the claims: user identity, expiry, issuer, audience, etc.
+ * - **Signature** — `SIGN(privateKey, "<header>.<payload>")`. Any party with the
+ *   matching public key can verify it without contacting the auth server.
+ *
+ * A valid signature proves two things:
+ *
+ * 1. **Authenticity** — the token was produced by the holder of the private key.
+ * 2. **Integrity** — neither the header nor the payload has been altered since signing.
+ *
+ * Signature verification alone is not sufficient. The claims inside the payload
+ * must also be checked (expiry, issuer, audience, …). Both steps are performed
+ * by {@link verifyJwt}.
+ *
+ * ---
+ *
+ * ## JWT Header fields
+ *
+ * The header is a JSON object Base64URL-encoded into the first segment.
+ *
+ * | Field | Purpose | Verified |
+ * |-------|---------|---------|
+ * | `alg` | Signing algorithm (`RS256`, `ES256`, …) | Checked against {@link VerifyJwtOptions.allowedAlgorithms} before JWKS is fetched |
+ * | `kid` | Key ID — selects the matching public key from the JWKS | Used for key lookup; falls back to the first JWKS key when absent |
+ * | `typ` | Token type (`JWT`, `at+JWT`, …) | Checked against {@link VerifyJwtOptions.allowedTokenTypes} (case-insensitive) |
+ * | ~~`enc`~~ | ~~Encryption algorithm — present in JWE (encrypted) tokens only~~ | ~~Not applicable — we verify JWS (signed) tokens, not JWE (encrypted)~~ |
+ * | ~~`cty`~~ | ~~Content type — describes the secured content media type~~ | ~~Not applicable — not set by standard OIDC/OAuth auth servers~~ |
+ *
+ * ---
+ *
+ * ## JWT Payload claims
+ *
+ * The payload is a JSON object Base64URL-encoded into the second segment.
+ *
+ * ### Validated claims
+ *
+ * | Claim | Purpose | How |
+ * |-------|---------|-----|
+ * | `iss` | Issuer — the URL of the auth server that issued the token | Must be present and must equal {@link VerifyJwtOptions.issuerUrl} |
+ * | `exp` | Expiration time — Unix timestamp after which the token is invalid | Must be present and in the future, allowing {@link VerifyJwtOptions.clockSkewMs} tolerance |
+ * | `nbf` | Not before — Unix timestamp before which the token must not be accepted | Must be in the past, allowing {@link VerifyJwtOptions.clockSkewMs} tolerance |
+ * | `iat` | Issued at — Unix timestamp when the token was created | Must not be in the future beyond {@link VerifyJwtOptions.clockSkewMs} |
+ * | `aud` | Audience — the intended recipient(s) of the token | Checked against {@link VerifyJwtOptions.audience} when that option is provided |
+ *
+ * ### Read-only claims (extracted into the session, not further validated)
+ *
+ * | Claim | Purpose |
+ * |-------|---------|
+ * | `sub` | Subject — the user's unique identifier |
+ * | `email` | User's email address |
+ * | `name` | User's display name |
+ *
+ * ### Not validated
+ *
+ * | Claim | Purpose | Why skipped |
+ * |-------|---------|-------------|
+ * | ~~`jti`~~ | ~~JWT ID — a unique identifier for this specific token instance~~ | ~~Revocation requires a server-side blocklist; not feasible in stateless edge middleware~~ |
+ * | ~~`azp`~~ | ~~Authorized party — the OAuth 2.0 client that requested the token~~ | ~~The proxy architecture means the browser never contacts the auth server directly, making cross-origin token replay a non-threat~~ |
+ * | ~~`nonce`~~ | ~~OIDC nonce — binds a token to a specific authorisation request~~ | ~~Not applicable in our password/cookie flow (no OIDC redirect round-trip)~~ |
+ * | ~~`acr`~~ | ~~Authentication class reference — describes the strength of the authentication~~ | ~~Not validated (future: require MFA for sensitive routes)~~ |
+ * | ~~`amr`~~ | ~~Authentication methods reference — list of methods used to authenticate~~ | ~~Not validated~~ |
+ * | ~~`scope`~~ | ~~OAuth 2.0 scopes granted to the token~~ | ~~Not validated (future: per-route scope enforcement)~~ |
+ *
+ * ---
+ *
+ * ## JWKS caching
+ *
+ * Public keys are expensive to fetch and import. They are cached in-process,
+ * keyed by `"${jwksUri}:${kid}"` (or `"${jwksUri}:__default__"` when `kid` is
+ * absent), for {@link JWKS_TTL_MS} milliseconds (default 5 minutes).
+ *
+ * Including the full JWKS URI in the cache key prevents a key imported for one
+ * issuer from being mistakenly served when a different issuer happens to use the
+ * same `kid` string — a scenario that can arise in multi-tenant deployments or
+ * during key-rotation incidents where two servers briefly share a key identifier.
+ *
+ * A cache miss — on first use or after TTL expiry — triggers a fresh fetch
+ * from `{issuerUrl}/auth/keys`.
+ *
+ * > **Note (serverless):** the cache is module-level. In serverless environments
+ * > each cold start gets a fresh cache; warm instances share it across requests.
+ *
+ * ---
+ *
+ * ## Runtime note
+ *
+ * This file is the **shared implementation** used by both `sdk-next` (Edge
+ * runtime) and `sdk-nuxt` (Node.js/Nitro). `base64UrlDecode` uses `atob`,
+ * which is available in both environments (Edge natively; Node.js since v16).
+ * The previous per-SDK copies (one using `atob`, one using `Buffer`) have
+ * been consolidated here.
+ */
+// ─── Constants ───────────────────────────────────────────────────────────────
+/** How long a cached JWKS key is considered fresh before re-fetching. */
+export const JWKS_TTL_MS = 5 * 60 * 1_000;
+// ─── JWKS cache ───────────────────────────────────────────────────────────────
+/**
+ * In-memory JWKS key cache.
+ *
+ * Keys are of the form `"${jwksUri}:${kid}"`, or `"${jwksUri}:__default__"`
+ * when the JWT carries no `kid`. Including the full JWKS URI prevents a cached
+ * key from one issuer being returned for a request targeting a different issuer
+ * that happens to share the same `kid` string — a scenario that can arise in
+ * multi-tenant deployments or during key-rotation incidents.
+ *
+ * Cache entries are immutable once written; the cache itself grows up to one
+ * entry per distinct `(jwksUri, kid)` pair seen in the lifetime of the process.
+ *
+ * The cache is intentionally unbounded. In practice the number of distinct
+ * (jwksUri, kid) pairs is bounded by the number of key rotations during the
+ * process lifetime — typically a handful. A bounded LRU eviction policy could
+ * be added if memory growth becomes a concern for very long-lived processes
+ * with frequent key rotations, but is omitted here to keep the implementation
+ * dependency-free.
+ */
+const jwksCache = new Map();
+const DECODER = new TextDecoder();
+const ENCODER = new TextEncoder();
+// ─── Base64URL ────────────────────────────────────────────────────────────────
+/**
+ * Decodes a Base64URL-encoded string into a `Uint8Array`.
+ *
+ * The Edge runtime has no `Buffer`, so this uses `atob` after translating the
+ * Base64URL alphabet (`-` → `+`, `_` → `/`) and padding to a multiple of four.
+ *
+ * @param input - A Base64URL-encoded string (padding is optional).
+ * @returns The decoded bytes.
+ */
+export function base64UrlDecode(input) {
+    const base64 = input.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');
+    const binary = atob(padded);
+    return Uint8Array.from(binary, (c) => c.charCodeAt(0));
 }
-function a(e) {
-	let [t, n, r] = e.split(".");
-	return !t || !n || !r ? null : [
-		t,
-		n,
-		r
-	];
+// ─── JWT splitting ────────────────────────────────────────────────────────────
+/**
+ * Splits a compact JWT string into its three raw Base64URL segments without
+ * decoding or verifying any of them.
+ *
+ * Tokens with more than three segments (e.g. nested JWTs) are accepted; only
+ * the first three parts are returned. Tokens with fewer than three segments are
+ * structurally invalid compact JWTs and cannot be verified.
+ *
+ * @param token - The compact JWT string.
+ * @returns A `[header, payload, signature]` tuple, or `null` when the token
+ *   has fewer than three dot-separated segments.
+ */
+function splitToken(token) {
+    const [h, p, s] = token.split('.');
+    if (!h || !p || !s) {
+        return null;
+    }
+    return [h, p, s];
 }
-function o(e) {
-	let t = a(e);
-	if (!t) throw TypeError(`Invalid JWT: expected at least three dot-separated segments, received ${e.split(".").length}.`);
-	let [r, o] = t;
-	return {
-		header: JSON.parse(n.decode(i(r))),
-		payload: JSON.parse(n.decode(i(o)))
-	};
+// ─── JWT decode ───────────────────────────────────────────────────────────────
+/**
+ * Decodes a compact-serialised JWT into its header and payload **without**
+ * verifying the signature.
+ *
+ * **Do not trust the result of this function alone.** Use it only as the first
+ * step of a full verification pipeline — the signature check in {@link verifyJwt}
+ * must follow before any claim can be trusted.
+ *
+ * @param token - A compact JWT string (`header.payload.signature`).
+ * @returns The decoded {@link DecodedJwt}.
+ * @throws {TypeError} When `token` has fewer than three dot-separated segments.
+ */
+export function decodeJwt(token) {
+    const segments = splitToken(token);
+    if (!segments) {
+        throw new TypeError(`Invalid JWT: expected at least three dot-separated segments, received ${token.split('.').length}.`);
+    }
+    const [h, p] = segments;
+    return {
+        header: JSON.parse(DECODER.decode(base64UrlDecode(h))),
+        payload: JSON.parse(DECODER.decode(base64UrlDecode(p))),
+    };
 }
-var s = {
-	RS256: {
-		name: "RSASSA-PKCS1-v1_5",
-		hash: "SHA-256"
-	},
-	RS384: {
-		name: "RSASSA-PKCS1-v1_5",
-		hash: "SHA-384"
-	},
-	RS512: {
-		name: "RSASSA-PKCS1-v1_5",
-		hash: "SHA-512"
-	},
-	ES256: {
-		name: "ECDSA",
-		namedCurve: "P-256"
-	},
-	ES384: {
-		name: "ECDSA",
-		namedCurve: "P-384"
-	},
-	ES512: {
-		name: "ECDSA",
-		namedCurve: "P-521"
-	}
-}, c = {
-	RS256: { name: "RSASSA-PKCS1-v1_5" },
-	RS384: { name: "RSASSA-PKCS1-v1_5" },
-	RS512: { name: "RSASSA-PKCS1-v1_5" },
-	ES256: {
-		name: "ECDSA",
-		hash: "SHA-256"
-	},
-	ES384: {
-		name: "ECDSA",
-		hash: "SHA-384"
-	},
-	ES512: {
-		name: "ECDSA",
-		hash: "SHA-512"
-	}
+// ─── Algorithm helpers ────────────────────────────────────────────────────────
+/**
+ * Web Crypto parameters for importing a public key from JWKS, keyed by JWT
+ * `alg` header value. The keys of this object are the only supported algorithms;
+ * anything not present throws {@link TypeError}.
+ */
+const IMPORT_PARAMS = {
+    RS256: { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },
+    RS384: { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-384' },
+    RS512: { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-512' },
+    ES256: { name: 'ECDSA', namedCurve: 'P-256' },
+    ES384: { name: 'ECDSA', namedCurve: 'P-384' },
+    ES512: { name: 'ECDSA', namedCurve: 'P-521' },
 };
-function l(e) {
-	if (!Object.hasOwn(s, e)) throw TypeError(`Unsupported JWT algorithm: "${e}". Supported algorithms are ${Object.keys(s).join(", ")}.`);
+/**
+ * Web Crypto parameters for verifying a JWT signature, keyed by JWT `alg`
+ * header value.
+ */
+const VERIFY_PARAMS = {
+    RS256: { name: 'RSASSA-PKCS1-v1_5' },
+    RS384: { name: 'RSASSA-PKCS1-v1_5' },
+    RS512: { name: 'RSASSA-PKCS1-v1_5' },
+    ES256: { name: 'ECDSA', hash: 'SHA-256' },
+    ES384: { name: 'ECDSA', hash: 'SHA-384' },
+    ES512: { name: 'ECDSA', hash: 'SHA-512' },
+};
+function assertSupportedAlgorithm(alg) {
+    if (!Object.hasOwn(IMPORT_PARAMS, alg)) {
+        throw new TypeError(`Unsupported JWT algorithm: "${alg}". Supported algorithms are ${Object.keys(IMPORT_PARAMS).join(', ')}.`);
+    }
 }
-function u(e) {
-	return l(e), s[e];
+function resolveImportAlgorithm(alg) {
+    assertSupportedAlgorithm(alg);
+    return IMPORT_PARAMS[alg];
 }
-function d(e) {
-	return l(e), c[e];
+function resolveVerifyAlgorithm(alg) {
+    assertSupportedAlgorithm(alg);
+    return VERIFY_PARAMS[alg];
 }
-async function f(e, n, r) {
-	let i = `${e}:${n ?? "__default__"}`, a = t.get(i);
-	if (a && Date.now() - a.fetchedAt < 3e5) return a.key;
-	let o = await fetch(e, { signal: AbortSignal.timeout(r) });
-	if (!o.ok) return null;
-	let s = await o.json(), c = n ? s.keys.find((e) => e.kid === n) : s.keys[0];
-	if (!c) return null;
-	let l = c.alg ?? "RS256", d = await crypto.subtle.importKey("jwk", c, u(l), !1, ["verify"]);
-	return t.set(i, {
-		key: d,
-		fetchedAt: Date.now()
-	}), d;
+// ─── JWKS fetch ───────────────────────────────────────────────────────────────
+/**
+ * Fetches the JWKS from `jwksUri`, imports the key matching `kid`, and caches
+ * it for {@link JWKS_TTL_MS} milliseconds.
+ *
+ * The cache key is `"${jwksUri}:${kid ?? '__default__'}"`. Scoping the key to
+ * the full endpoint URL ensures that two issuers that happen to publish keys
+ * under the same `kid` string are never confused with one another.
+ *
+ * Behaviour:
+ * - When the cached entry for the `(jwksUri, kid)` pair is still within TTL,
+ *   it is returned immediately with no network request.
+ * - When `kid` is absent, the first key in the JWKS is used and cached under
+ *   the `"__default__"` sentinel combined with the endpoint URI.
+ * - Returns `null` when the JWKS endpoint returns a non-OK status, no matching
+ *   key is found, or key import fails.
+ *
+ * @param jwksUri - Full URL of the JWKS endpoint.
+ * @param kid     - The `kid` header value from the JWT, or `undefined`.
+ */
+async function fetchAndCacheJwks(jwksUri, kid, timeoutMs) {
+    const cacheKey = `${jwksUri}:${kid ?? '__default__'}`;
+    const cached = jwksCache.get(cacheKey);
+    if (cached && Date.now() - cached.fetchedAt < JWKS_TTL_MS) {
+        return cached.key;
+    }
+    const res = await fetch(jwksUri, { signal: AbortSignal.timeout(timeoutMs) });
+    if (!res.ok) {
+        return null;
+    }
+    const json = (await res.json());
+    const jwk = kid ? json.keys.find((k) => k.kid === kid) : json.keys[0];
+    if (!jwk) {
+        return null;
+    }
+    // RFC 7517 §4.4 makes 'alg' optional in a JWK — the key material (kty, n/e
+    // for RSA; kty/crv/x/y for EC) determines the key type. Fall back to RS256
+    // when absent. The actual algorithm enforcement happens in verifyJwt via the
+    // JWT header's 'alg' claim, not here.
+    const alg = jwk.alg ?? 'RS256';
+    const cryptoKey = await crypto.subtle.importKey('jwk', jwk, resolveImportAlgorithm(alg), false, ['verify']);
+    jwksCache.set(cacheKey, { key: cryptoKey, fetchedAt: Date.now() });
+    return cryptoKey;
 }
-async function p(e, t) {
-	try {
-		let { issuerUrl: o, allowedAlgorithms: s, clockSkewMs: c, audience: l, allowedTokenTypes: u, jwksTimeoutMs: p = 5e3 } = t, m = a(e);
-		if (!m) return null;
-		let [h, g, _] = m, v = JSON.parse(n.decode(i(h))), y = JSON.parse(n.decode(i(g))), b = v.alg;
-		if (!b || b.toLowerCase() === "none" || s?.length && !s.includes(b)) return null;
-		if (u.length > 0) {
-			let e = v.typ ?? "";
-			if (!u.some((t) => t.toLowerCase() === e.toLowerCase())) return null;
-		}
-		let x = v.kid, S = await f(`${o}/auth/keys`, x, p);
-		if (!S || !await crypto.subtle.verify(d(b), S, i(_), r.encode(`${h}.${g}`)) || y.iss !== o) return null;
-		if (l !== void 0) {
-			let e = y.aud === void 0 ? [] : [y.aud].flat();
-			if (![l].flat().some((t) => e.includes(t))) return null;
-		}
-		let C = Date.now();
-		return y.exp === void 0 || y.exp * 1e3 < C - c || y.nbf !== void 0 && y.nbf * 1e3 > C + c || y.iat !== void 0 && y.iat * 1e3 > C + c ? null : y;
-	} catch (e) {
-		return e instanceof SyntaxError || console.error("[nextgen] verifyJwt unexpected error:", e), null;
-	}
+// ─── Verification ─────────────────────────────────────────────────────────────
+/**
+ * Verifies a compact-serialised JWT and returns its validated payload.
+ *
+ * ## Verification steps (in order)
+ *
+ * 1. Split the token — returns `null` immediately when fewer than three
+ *    dot-separated segments are present.
+ * 2. Reject if `alg` is not in {@link VerifyJwtOptions.allowedAlgorithms} (when set).
+ * 3. Reject if `typ` is not in {@link VerifyJwtOptions.allowedTokenTypes} (when non-empty).
+ * 4. Fetch (or retrieve from cache) the matching public key from the JWKS endpoint.
+ * 5. Verify the cryptographic signature over `header.payload`.
+ * 6. Reject if `iss` is absent or does not equal {@link VerifyJwtOptions.issuerUrl}.
+ * 7. Reject if {@link VerifyJwtOptions.audience} is set and `aud` does not contain it.
+ * 8. Reject if `exp` is absent or is in the past (minus clock-skew tolerance).
+ * 9. Reject if `nbf` is in the future (plus clock-skew tolerance).
+ * 10. Reject if `iat` is in the future (plus clock-skew tolerance).
+ *
+ * Returns `null` on any failure rather than throwing, so callers can treat a
+ * bad token identically to a missing one without try/catch at the call site.
+ *
+ * @param token - The raw compact-serialised JWT string.
+ * @param opts  - Verification options; see {@link VerifyJwtOptions}.
+ * @returns The verified {@link JwtPayload}, or `null` if verification fails.
+ */
+export async function verifyJwt(token, opts) {
+    try {
+        const { issuerUrl, allowedAlgorithms, clockSkewMs, audience, allowedTokenTypes, jwksTimeoutMs = 5000, } = opts;
+        const segments = splitToken(token);
+        if (!segments) {
+            return null;
+        }
+        const [rawHeader, rawPayload, rawSig] = segments;
+        const header = JSON.parse(DECODER.decode(base64UrlDecode(rawHeader)));
+        const payload = JSON.parse(DECODER.decode(base64UrlDecode(rawPayload)));
+        // RFC 7515 §4.1.1 requires 'alg' in the JWT header. A token that omits it
+        // is structurally invalid — we reject it rather than guessing an algorithm.
+        const alg = header.alg;
+        if (!alg) {
+            return null;
+        }
+        // Unconditionally reject the 'none' algorithm regardless of the allowlist.
+        // 'none' means the token is unsigned; accepting it would allow anyone to
+        // forge arbitrary claims without a key. The comparison is case-insensitive
+        // so that "None", "NONE", or any other casing variant is also rejected.
+        if (alg.toLowerCase() === 'none') {
+            return null;
+        }
+        if (allowedAlgorithms?.length && !allowedAlgorithms.includes(alg)) {
+            return null;
+        }
+        if (allowedTokenTypes.length > 0) {
+            const typ = header.typ ?? '';
+            if (!allowedTokenTypes.some((t) => t.toLowerCase() === typ.toLowerCase())) {
+                return null;
+            }
+        }
+        const kid = header.kid;
+        const cryptoKey = await fetchAndCacheJwks(`${issuerUrl}/auth/keys`, kid, jwksTimeoutMs);
+        if (!cryptoKey) {
+            return null;
+        }
+        const valid = await crypto.subtle.verify(resolveVerifyAlgorithm(alg), cryptoKey, base64UrlDecode(rawSig), ENCODER.encode(`${rawHeader}.${rawPayload}`));
+        if (!valid) {
+            return null;
+        }
+        // Strict equality is intentional: the issuer URL must match exactly as
+        // configured. We deliberately do not normalise trailing slashes, case, or
+        // surrounding whitespace — any difference is either a misconfiguration or
+        // a token issued by a different server and must be rejected.
+        if (payload.iss !== issuerUrl) {
+            return null;
+        }
+        if (audience !== undefined) {
+            const audList = payload.aud !== undefined ? [payload.aud].flat() : [];
+            const expectedList = [audience].flat();
+            if (!expectedList.some((a) => audList.includes(a))) {
+                return null;
+            }
+        }
+        const now = Date.now();
+        if (payload.exp === undefined || payload.exp * 1000 < now - clockSkewMs) {
+            return null;
+        }
+        if (payload.nbf !== undefined && payload.nbf * 1000 > now + clockSkewMs) {
+            return null;
+        }
+        if (payload.iat !== undefined && payload.iat * 1000 > now + clockSkewMs) {
+            return null;
+        }
+        return payload;
+    }
+    catch (err) {
+        // SyntaxError from JSON.parse means the token segments are not JSON —
+        // this is an opaque (non-JWT) token. Return null silently; the middleware
+        // will fall back to opaque token validation via the backend.
+        if (err instanceof SyntaxError) {
+            return null;
+        }
+        // Any other unexpected error (network failure, malformed JWKS, Web Crypto
+        // exception) is worth logging so operators can distinguish infrastructure
+        // failures from genuine bad tokens.
+        console.error('[nextgen] verifyJwt unexpected error:', err);
+        return null;
+    }
 }
-//#endregion
-export { e as JWKS_TTL_MS, i as base64UrlDecode, o as decodeJwt, p as verifyJwt };

package/dist/middleware.js

@@ -1,22 +1,76 @@
-//#region src/middleware.ts
-var e = new Set([
-	"connection",
-	"host",
-	"keep-alive",
-	"proxy-authenticate",
-	"proxy-authorization",
-	"te",
-	"trailer",
-	"transfer-encoding",
-	"upgrade"
-]), t = new Set(["x-nextgen-auth-token"]);
-function n(e, t) {
-	return t.length === 0 ? !1 : t.some((t) => t.endsWith("*") ? e.startsWith(t.slice(0, -1)) : e === t);
+/**
+ * Shared constants and utility functions for the SDK middleware proxy layer.
+ *
+ * These are consumed by both `sdk-next` and `sdk-nuxt` to avoid duplicating
+ * pure, framework-agnostic logic.
+ */
+// ─── Constants ────────────────────────────────────────────────────────────────
+/**
+ * Headers that must never be forwarded to an upstream service.
+ * These are connection-level headers that are meaningful only between
+ * two directly connected peers and become invalid when proxied.
+ */
+export const HOP_BY_HOP = new Set([
+    'connection',
+    // host is not a hop-by-hop header per RFC 7230, but it must be stripped so
+    // the fetch implementation derives the correct Host from the upstream URL
+    // rather than forwarding the client's Host and causing SNI/vhost mismatches.
+    'host',
+    'keep-alive',
+    'proxy-authenticate',
+    'proxy-authorization',
+    'te',
+    'trailer',
+    'transfer-encoding',
+    'upgrade',
+]);
+/**
+ * SDK-internal headers that must never be forwarded to the upstream backend.
+ * These headers carry session data between the middleware and server components;
+ * forwarding them upstream would expose internal state and allow header injection.
+ */
+export const INTERNAL_HEADERS = new Set([
+    'x-nextgen-auth-token',
+]);
+// ─── Route matching ──────────────────────────────────────────────────────────
+/**
+ * Returns `true` when `pathname` matches at least one entry in `routes`.
+ *
+ * An entry ending with `*` matches any path that starts with the prefix
+ * before the `*`. All other entries require an exact match.
+ *
+ * @param pathname - The URL pathname to test.
+ * @param routes   - The list of route patterns to match against.
+ * @returns `true` if at least one pattern matches.
+ */
+export function matchesRoutes(pathname, routes) {
+    if (routes.length === 0) {
+        return false;
+    }
+    return routes.some((pattern) => {
+        if (pattern.endsWith('*')) {
+            return pathname.startsWith(pattern.slice(0, -1));
+        }
+        return pathname === pattern;
+    });
 }
-function r(t) {
-	let n = new Headers();
-	for (let [r, i] of t.entries()) !e.has(r.toLowerCase()) && r.toLowerCase() !== "set-cookie" && r.toLowerCase() !== "location" && n.set(r, i);
-	return n;
+// ─── Response header filtering ───────────────────────────────────────────────
+/**
+ * Filters upstream response headers for proxying: strips hop-by-hop headers,
+ * `set-cookie` (handled separately via `getSetCookie()`), and `location`
+ * (prevents leaking internal upstream URLs).
+ *
+ * @param upstream - The upstream response headers.
+ * @returns A new `Headers` object with filtered headers.
+ */
+export function filterResponseHeaders(upstream) {
+    const filtered = new Headers();
+    for (const [key, value] of upstream.entries()) {
+        if (!HOP_BY_HOP.has(key.toLowerCase()) &&
+            key.toLowerCase() !== 'set-cookie' &&
+            key.toLowerCase() !== 'location') {
+            filtered.set(key, value);
+        }
+    }
+    return filtered;
 }
-//#endregion
-export { e as HOP_BY_HOP, t as INTERNAL_HEADERS, r as filterResponseHeaders, n as matchesRoutes };

package/dist/tsconfig.lib.tsbuildinfo

@@ -1 +1 @@
-{"version":"7.0.0-dev.20260421.2","root":[[60,63]],"fileNames":["lib.es5.d.ts","lib.es2015.d.ts","lib.es2016.d.ts","lib.es2017.d.ts","lib.es2018.d.ts","lib.es2019.d.ts","lib.es2020.d.ts","lib.es2021.d.ts","lib.es2022.d.ts","lib.dom.d.ts","lib.dom.iterable.d.ts","lib.es2015.core.d.ts","lib.es2015.collection.d.ts","lib.es2015.generator.d.ts","lib.es2015.iterable.d.ts","lib.es2015.promise.d.ts","lib.es2015.proxy.d.ts","lib.es2015.reflect.d.ts","lib.es2015.symbol.d.ts","lib.es2015.symbol.wellknown.d.ts","lib.es2016.array.include.d.ts","lib.es2016.intl.d.ts","lib.es2017.arraybuffer.d.ts","lib.es2017.date.d.ts","lib.es2017.object.d.ts","lib.es2017.sharedmemory.d.ts","lib.es2017.string.d.ts","lib.es2017.intl.d.ts","lib.es2017.typedarrays.d.ts","lib.es2018.asyncgenerator.d.ts","lib.es2018.asynciterable.d.ts","lib.es2018.intl.d.ts","lib.es2018.promise.d.ts","lib.es2018.regexp.d.ts","lib.es2019.array.d.ts","lib.es2019.object.d.ts","lib.es2019.string.d.ts","lib.es2019.symbol.d.ts","lib.es2019.intl.d.ts","lib.es2020.bigint.d.ts","lib.es2020.date.d.ts","lib.es2020.promise.d.ts","lib.es2020.sharedmemory.d.ts","lib.es2020.string.d.ts","lib.es2020.symbol.wellknown.d.ts","lib.es2020.intl.d.ts","lib.es2020.number.d.ts","lib.es2021.promise.d.ts","lib.es2021.string.d.ts","lib.es2021.weakref.d.ts","lib.es2021.intl.d.ts","lib.es2022.array.d.ts","lib.es2022.error.d.ts","lib.es2022.intl.d.ts","lib.es2022.object.d.ts","lib.es2022.string.d.ts","lib.es2022.regexp.d.ts","lib.decorators.d.ts","lib.decorators.legacy.d.ts","../src/types.ts","../src/middleware.ts","../src/jwt.ts","../src/index.ts"],"fileInfos":[{"version":"a1aa1a5e065d48ef5c7bb99e38412f96","affectsGlobalScope":true,"impliedNodeFormat":1},"d4306fb2e47f74835e8674ffac07d76f","e437c5c1302869326c3bb93da85bbbcf","e4324975a566567b21d350615f1fc6ac","333b1b9a2a9ac3b8497dba5c63b5ba50","6cffacd662b6eb5fa7a36aa2ea366bfa","b4c34f9c23304dbef2d23698637ed638","e5cb86a5fc491796ecd1d2dd348d208f","feb6c6fb19cdb246a5d8acb36a6901c7",{"version":"aae8996e8b5684814785a42cbbefcd79","affectsGlobalScope":true,"impliedNodeFormat":1},"abad6dd56cc8caf095c165df8124d237",{"version":"01ac052ec4a79e87229f90466a9645f8","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"edba5df642941aa062a62f6328c6df3d","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"6344b55f26a4e81d9608777dbfb877dd","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"3c0ed28e53d3695b363e256ec1c023fd","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"4c2761daba7f17141c25baa0821ac5da","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"b87656acabd63e69379ff6ffcfe52fc7","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"597469522da047a5af5222cc6989f405","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"bb3a710cbcda0533bb127712927cbe37","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"55d97a8c6fbf34a30450a7b1e5f7a298","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"0ee05eb59426d33e374226d8dcfa708b","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"e347c14030993906efcfbb88915b6a05","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"b0231263857c9b6a03641acdc9280ceb","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"3b15c4a83b598cacb4067676e6f0abed","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"b417d97b7934cef63b1889abec0bbfbf","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"09a6cf4032ebba60ce22a501e663f881","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"7a42de379b489e8f7b647455bebfc576","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"e22cc07e3f3cc242ba52fa3f8ea1fc58","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"2c45da767a1bfbb220848df1bc4029e4","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"b44c3e0fbaf2130cdcf6ac38b120ffa1","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"b612fb5cf8e5d964b92063a75207632a","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"02705151a5e1551b9162a9ed8ab763f7","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"41025e398be9215d32e4337335da8f0b","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"52684c2b1f353a5538e4f275182a54cd","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"6dedb6a4f90d1df3a6fbe5693e44886c","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"ca3f36fe3562c07e0f0d71c2bebd3f6d","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"409974d6129befbb8226ddd1c6558568","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"4d9cfde2a1ae1b4925f1f9bc10848e5d","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"7e1daecc66dd564144e3bb1a0266b5fd","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"a8e1d9bb35fd0637f2f9fd2b2a54f2ec","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"4f168501772a6543182765bfd5f2fbfe","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"a19c80aad1b2162103496f5ba293a732","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"b69afa63cd5d059851c78adb2856ee09","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"ae2fc5d954e9b0f5feee3d481b953c27","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"1cfd3091a071d8b6feec15277643bafe","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"692bcd75364db0f65d428801c7884466","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"a0d87491913d843139e0c993650a3235","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"4ef72aa378127e7b7abba915b0110b1e","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"3ec74c6a7d4463f0254db3a74cf75646","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"84c2bdfa470d075526cce6322d81b0b6","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"0b3844c2b8c73e4e1ab91431411cad11","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"4fc71cf4a15b8d99675a31df77f26e07","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"d1b49564ddaeca3df5b6dbae925d2242","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"6a25be566d60ccfc2d6e8b7bfdeefa83","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"8a20e27646985dfd58c57ca6566553dd","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"9969f02ad3cdcbf4f709405cda44167f","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"9c9be4792a7a4f42c15ae7360bf28779","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"f64453cbf9671f28158677fa5c43967a","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"33f317af5428801f944a478d2c1e38e5","affectsGlobalScope":true,"impliedNodeFormat":1},{"version":"272e60fa2dbb319658aee0aab5753e09","signature":"e37837f9b58ad0013e1083d5a9164007","impliedNodeFormat":99},{"version":"0ef9f01c1bd1aa2651b01c95d2939eeb","signature":"4395702c4db54aa3eb7c9e41e69dc921","impliedNodeFormat":99},{"version":"4fecb65617e72438d639383e0795f326","signature":"d7f410111bbbc4f358dcc07db3151877","impliedNodeFormat":99},{"version":"5beb6125d20dbc2c73e35a96973e834a","signature":"0528ac935bfd6a3063a9bfad4cbee925","impliedNodeFormat":99}],"fileIdsList":[[60,61,62]],"options":{"composite":true,"emitDeclarationOnly":true,"declarationMap":true,"importHelpers":true,"module":199,"noFallthroughCasesInSwitch":true,"noImplicitReturns":true,"noUncheckedIndexedAccess":true,"noEmitOnError":true,"noUnusedLocals":true,"noImplicitOverride":true,"outDir":"./","rootDir":"../src","skipLibCheck":true,"strict":true,"target":9,"tsBuildInfoFile":"./tsconfig.lib.tsbuildinfo"},"referencedMap":[[63,1]],"latestChangedDtsFile":"./index.d.ts"}
+{"fileNames":["../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es5.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2015.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2016.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2017.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2018.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2019.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2020.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2021.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2022.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.dom.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.dom.iterable.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2015.core.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2015.collection.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2015.generator.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2015.iterable.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2015.promise.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2015.proxy.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2015.reflect.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2015.symbol.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2015.symbol.wellknown.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2016.array.include.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2016.intl.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2017.arraybuffer.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2017.date.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2017.object.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2017.sharedmemory.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2017.string.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2017.intl.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2017.typedarrays.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2018.asyncgenerator.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2018.asynciterable.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2018.intl.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2018.promise.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2018.regexp.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2019.array.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2019.object.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2019.string.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2019.symbol.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2019.intl.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2020.bigint.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2020.date.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2020.promise.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2020.sharedmemory.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2020.string.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2020.symbol.wellknown.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2020.intl.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2020.number.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2021.promise.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2021.string.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2021.weakref.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2021.intl.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2022.array.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2022.error.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2022.intl.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2022.object.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2022.string.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.es2022.regexp.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.decorators.d.ts","../../../node_modules/.pnpm/typescript@6.0.3/node_modules/typescript/lib/lib.decorators.legacy.d.ts","../src/types.ts","../src/middleware.ts","../src/jwt.ts","../src/index.ts"],"fileIdsList":[[60,61,62]],"fileInfos":[{"version":"bcd24271a113971ba9eb71ff8cb01bc6b0f872a85c23fdbe5d93065b375933cd","affectsGlobalScope":true,"impliedFormat":1},{"version":"3f88bedbeb09c6f5a6645cb24c7c55f1aa22d19ae96c8e6959cbd8b85a707bc6","impliedFormat":1},{"version":"7fe93b39b810eadd916be8db880dd7f0f7012a5cc6ffb62de8f62a2117fa6f1f","impliedFormat":1},{"version":"bb0074cc08b84a2374af33d8bf044b80851ccc9e719a5e202eacf40db2c31600","impliedFormat":1},{"version":"1a7daebe4f45fb03d9ec53d60008fbf9ac45a697fdc89e4ce218bc94b94f94d6","impliedFormat":1},{"version":"f94b133a3cb14a288803be545ac2683e0d0ff6661bcd37e31aaaec54fc382aed","impliedFormat":1},{"version":"f59d0650799f8782fd74cf73c19223730c6d1b9198671b1c5b3a38e1188b5953","impliedFormat":1},{"version":"8a15b4607d9a499e2dbeed9ec0d3c0d7372c850b2d5f1fb259e8f6d41d468a84","impliedFormat":1},{"version":"26e0fe14baee4e127f4365d1ae0b276f400562e45e19e35fd2d4c296684715e6","impliedFormat":1},{"version":"d6b1eba8496bdd0eed6fc8a685768fe01b2da4a0388b5fe7df558290bffcf32f","affectsGlobalScope":true,"impliedFormat":1},{"version":"7f57fc4404ff020bc45b9c620aff2b40f700b95fe31164024c453a5e3c163c54","impliedFormat":1},{"version":"eadcffda2aa84802c73938e589b9e58248d74c59cb7fcbca6474e3435ac15504","affectsGlobalScope":true,"impliedFormat":1},{"version":"105ba8ff7ba746404fe1a2e189d1d3d2e0eb29a08c18dded791af02f29fb4711","affectsGlobalScope":true,"impliedFormat":1},{"version":"00343ca5b2e3d48fa5df1db6e32ea2a59afab09590274a6cccb1dbae82e60c7c","affectsGlobalScope":true,"impliedFormat":1},{"version":"ebd9f816d4002697cb2864bea1f0b70a103124e18a8cd9645eeccc09bdf80ab4","affectsGlobalScope":true,"impliedFormat":1},{"version":"2c1afac30a01772cd2a9a298a7ce7706b5892e447bb46bdbeef720f7b5da77ad","affectsGlobalScope":true,"impliedFormat":1},{"version":"7b0225f483e4fa685625ebe43dd584bb7973bbd84e66a6ba7bbe175ee1048b4f","affectsGlobalScope":true,"impliedFormat":1},{"version":"c0a4b8ac6ce74679c1da2b3795296f5896e31c38e888469a8e0f99dc3305de60","affectsGlobalScope":true,"impliedFormat":1},{"version":"3084a7b5f569088e0146533a00830e206565de65cae2239509168b11434cd84f","affectsGlobalScope":true,"impliedFormat":1},{"version":"c5079c53f0f141a0698faa903e76cb41cd664e3efb01cc17a5c46ec2eb0bef42","affectsGlobalScope":true,"impliedFormat":1},{"version":"32cafbc484dea6b0ab62cf8473182bbcb23020d70845b406f80b7526f38ae862","affectsGlobalScope":true,"impliedFormat":1},{"version":"fca4cdcb6d6c5ef18a869003d02c9f0fd95df8cfaf6eb431cd3376bc034cad36","affectsGlobalScope":true,"impliedFormat":1},{"version":"b93ec88115de9a9dc1b602291b85baf825c85666bf25985cc5f698073892b467","affectsGlobalScope":true,"impliedFormat":1},{"version":"f5c06dcc3fe849fcb297c247865a161f995cc29de7aa823afdd75aaaddc1419b","affectsGlobalScope":true,"impliedFormat":1},{"version":"b77e16112127a4b169ef0b8c3a4d730edf459c5f25fe52d5e436a6919206c4d7","affectsGlobalScope":true,"impliedFormat":1},{"version":"fbffd9337146eff822c7c00acbb78b01ea7ea23987f6c961eba689349e744f8c","affectsGlobalScope":true,"impliedFormat":1},{"version":"a995c0e49b721312f74fdfb89e4ba29bd9824c770bbb4021d74d2bf560e4c6bd","affectsGlobalScope":true,"impliedFormat":1},{"version":"c7b3542146734342e440a84b213384bfa188835537ddbda50d30766f0593aff9","affectsGlobalScope":true,"impliedFormat":1},{"version":"ce6180fa19b1cccd07ee7f7dbb9a367ac19c0ed160573e4686425060b6df7f57","affectsGlobalScope":true,"impliedFormat":1},{"version":"3f02e2476bccb9dbe21280d6090f0df17d2f66b74711489415a8aa4df73c9675","affectsGlobalScope":true,"impliedFormat":1},{"version":"45e3ab34c1c013c8ab2dc1ba4c80c780744b13b5676800ae2e3be27ae862c40c","affectsGlobalScope":true,"impliedFormat":1},{"version":"805c86f6cca8d7702a62a844856dbaa2a3fd2abef0536e65d48732441dde5b5b","affectsGlobalScope":true,"impliedFormat":1},{"version":"e42e397f1a5a77994f0185fd1466520691456c772d06bf843e5084ceb879a0ad","affectsGlobalScope":true,"impliedFormat":1},{"version":"f4c2b41f90c95b1c532ecc874bd3c111865793b23aebcc1c3cbbabcd5d76ffb0","affectsGlobalScope":true,"impliedFormat":1},{"version":"ab26191cfad5b66afa11b8bf935ef1cd88fabfcb28d30b2dfa6fad877d050332","affectsGlobalScope":true,"impliedFormat":1},{"version":"2088bc26531e38fb05eedac2951480db5309f6be3fa4a08d2221abb0f5b4200d","affectsGlobalScope":true,"impliedFormat":1},{"version":"cb9d366c425fea79716a8fb3af0d78e6b22ebbab3bd64d25063b42dc9f531c1e","affectsGlobalScope":true,"impliedFormat":1},{"version":"500934a8089c26d57ebdb688fc9757389bb6207a3c8f0674d68efa900d2abb34","affectsGlobalScope":true,"impliedFormat":1},{"version":"689da16f46e647cef0d64b0def88910e818a5877ca5379ede156ca3afb780ac3","affectsGlobalScope":true,"impliedFormat":1},{"version":"bc21cc8b6fee4f4c2440d08035b7ea3c06b3511314c8bab6bef7a92de58a2593","affectsGlobalScope":true,"impliedFormat":1},{"version":"7ca53d13d2957003abb47922a71866ba7cb2068f8d154877c596d63c359fed25","affectsGlobalScope":true,"impliedFormat":1},{"version":"54725f8c4df3d900cb4dac84b64689ce29548da0b4e9b7c2de61d41c79293611","affectsGlobalScope":true,"impliedFormat":1},{"version":"e5594bc3076ac29e6c1ebda77939bc4c8833de72f654b6e376862c0473199323","affectsGlobalScope":true,"impliedFormat":1},{"version":"2f3eb332c2d73e729f3364fcc0c2b375e72a121e8157d25a82d67a138c83a95c","affectsGlobalScope":true,"impliedFormat":1},{"version":"6f4427f9642ce8d500970e4e69d1397f64072ab73b97e476b4002a646ac743b1","affectsGlobalScope":true,"impliedFormat":1},{"version":"48915f327cd1dea4d7bd358d9dc7732f58f9e1626a29cc0c05c8c692419d9bb7","affectsGlobalScope":true,"impliedFormat":1},{"version":"b7bf9377723203b5a6a4b920164df22d56a43f593269ba6ae1fdc97774b68855","affectsGlobalScope":true,"impliedFormat":1},{"version":"db9709688f82c9e5f65a119c64d835f906efe5f559d08b11642d56eb85b79357","affectsGlobalScope":true,"impliedFormat":1},{"version":"4b25b8c874acd1a4cf8444c3617e037d444d19080ac9f634b405583fd10ce1f7","affectsGlobalScope":true,"impliedFormat":1},{"version":"37be57d7c90cf1f8112ee2636a068d8fd181289f82b744160ec56a7dc158a9f5","affectsGlobalScope":true,"impliedFormat":1},{"version":"a917a49ac94cd26b754ab84e113369a75d1a47a710661d7cd25e961cc797065f","affectsGlobalScope":true,"impliedFormat":1},{"version":"6d3261badeb7843d157ef3e6f5d1427d0eeb0af0cf9df84a62cfd29fd47ac86e","affectsGlobalScope":true,"impliedFormat":1},{"version":"195daca651dde22f2167ac0d0a05e215308119a3100f5e6268e8317d05a92526","affectsGlobalScope":true,"impliedFormat":1},{"version":"8b11e4285cd2bb164a4dc09248bdec69e9842517db4ca47c1ba913011e44ff2f","affectsGlobalScope":true,"impliedFormat":1},{"version":"0508571a52475e245b02bc50fa1394065a0a3d05277fbf5120c3784b85651799","affectsGlobalScope":true,"impliedFormat":1},{"version":"8f9af488f510c3015af3cc8c267a9e9d96c4dd38a1fdff0e11dc5a544711415b","affectsGlobalScope":true,"impliedFormat":1},{"version":"fc611fea8d30ea72c6bbfb599c9b4d393ce22e2f5bfef2172534781e7d138104","affectsGlobalScope":true,"impliedFormat":1},{"version":"1ce14b81c5cc821994aa8ec1d42b220dd41b27fcc06373bce3958af7421b77d4","affectsGlobalScope":true,"impliedFormat":1},{"version":"b3a048b3e9302ef9a34ef4ebb9aecfb28b66abb3bce577206a79fee559c230da","affectsGlobalScope":true,"impliedFormat":1},{"version":"67c8d6b4a00fdd968ab54288e7dbefe088f8466c71609afc9e5bf5c58baad943","signature":"cb2a014455a28c33ff7121c94aa835563226796204466fcd6371c783851ef0f5","impliedFormat":99},{"version":"d8f9a793ef8eebd91cfaa19d8a62e6bd05314563d725799e08c4ddc2c8837dc5","signature":"808f2f3727dd8d4d91a46ea45b4457764da16fd9a0e1d8e523b293f0e4ab6704","impliedFormat":99},{"version":"55c476210b58acc4bb22045d8e82fdc91d6d103b3124269a9beb924b7dca82ad","signature":"720645b75e737dd913a52f88be1d511b7b1588d7682ec238653aa94342face28","impliedFormat":99},{"version":"279186bfad2e46f4ac5cc6d81f02daf74fb46eede846423c1ab773409eac3094","signature":"4b977c6a69b68df4547497acf80e8262506e27195166f6e179e4f02bf5deca1f","impliedFormat":99}],"root":[[60,63]],"options":{"composite":true,"declarationMap":true,"emitDeclarationOnly":false,"importHelpers":true,"module":199,"noEmitOnError":true,"noFallthroughCasesInSwitch":true,"noImplicitOverride":true,"noImplicitReturns":true,"noUncheckedIndexedAccess":true,"noUnusedLocals":true,"outDir":"./","rootDir":"../src","skipLibCheck":true,"strict":true,"target":9,"tsBuildInfoFile":"./tsconfig.lib.tsbuildinfo"},"referencedMap":[[63,1]],"latestChangedDtsFile":"./index.d.ts","version":"6.0.3"}

package/dist/types.js

@@ -0,0 +1,8 @@
+/**
+ * Shared types for the Nextgen SDK middleware layer.
+ *
+ * These types are consumed by both `sdk-next` and `sdk-nuxt`. Each SDK
+ * re-exports them from its own public surface so consumers don't need
+ * to add a direct `sdk-core` dependency.
+ */
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zitadel/sdk-core",
-  "version": "0.1.0-alpha.4",
+  "version": "0.1.0-alpha.8",
   "description": "Core types and shared utilities for Zitadel SDKs",
   "homepage": "https://github.com/zitadel/nextgen/tree/main/packages/sdk-core#readme",
   "bugs": {
@@ -40,5 +40,11 @@
   },
   "publishConfig": {
     "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.lib.json",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "test": "vitest run",
+    "lint": "oxlint ."
   }
 }