npm - @zitadel/sdk-next - Versions diffs - 0.1.0-alpha.17 → 0.1.0-alpha.18 - Mend

@zitadel/sdk-next 0.1.0-alpha.17 → 0.1.0-alpha.18

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (45) hide show

package/README.md CHANGED Viewed

@@ -8,6 +8,23 @@ Next.js middleware and helpers for Nextgen Auth.
 pnpm add @zitadel/sdk-next
 ```
+## Entry points
+| Import                         | Runs in                          | Provides                                         |
+| ------------------------------ | -------------------------------- | ------------------------------------------------ |
+| `@zitadel/sdk-next/middleware` | Edge middleware                  | `nextgenMiddleware`, `createProxy`               |
+| `@zitadel/sdk-next/server`     | Server Components, Route Handlers | `auth()`, `NextgenProvider`                      |
+| `@zitadel/sdk-next/react`      | Client Components                | `useAuth()`, `AuthContextProvider`               |
+| `@zitadel/sdk-next/session`    | Client Components                | `getSession()`                                   |
+| `@zitadel/sdk-next/client`     | Client boundary                  | Web-component registration, `configureZitadel()` |
+The package root re-exports the server and client surfaces together for use
+in server modules. Do not import the root from a `"use client"` module: it
+pulls in the server-only `auth()`, which fails the build with an import trace
+(exactly how depends on the bundler's tree shaking — the supported client
+imports are `/react` and `/session`). `NextgenProvider` is itself server-only
+because it accepts the token-bearing `auth()` result — see section 3.
 ## Setup
 ### 1. Middleware
@@ -40,7 +57,7 @@ The middleware runs on every matched route and does three things in one pass:
 ### 2. Reading auth in a Server Component
 ```ts
-import { auth } from "@zitadel/sdk-next";
+import { auth } from "@zitadel/sdk-next/server";
 export default async function Page() {
   const session = await auth();
@@ -49,30 +66,65 @@ export default async function Page() {
 }
 ```
+`auth()` reads the token the middleware tunnelled into the request headers
+and **verifies it before trusting it** — JWTs cryptographically via JWKS,
+opaque tokens against the backend's `GET /sessions/me` (which also supplies
+the user's identity). A forged `x-nextgen-auth-token` header sent directly by
+a client to a route outside the middleware `matcher` is rejected. Two things
+follow:
+- `auth()` only reports a session on routes the `matcher` covers — on other
+  routes the token never reaches it (see section 4 for chrome on public
+  pages).
+- If the middleware runs with custom verification options (`audience`,
+  `allowedAlgorithms`, …), pass the same values to `auth()` so both layers
+  accept the same tokens.
+`session.token` is the raw session token, available server-side for calling
+upstream APIs. Never forward it into client components yourself —
+`NextgenProvider` strips it for you (next section).
 ### 3. Reading auth in a Client Component
-Wrap your app in `NextgenProvider` (e.g. in your root layout):
+Seed the client tree once in your root layout (a Server Component), then
+read the state with `useAuth()` anywhere below it:
 ```tsx
-import { NextgenProvider } from '@zitadel/sdk-next';
+import { auth, NextgenProvider } from '@zitadel/sdk-next/server';
 export default async function RootLayout({ children }) {
   const session = await auth();
   return (
     <html>
       <body>
-        <NextgenProvider value={session}>{children}</NextgenProvider>
+        <NextgenProvider session={session}>{children}</NextgenProvider>
       </body>
     </html>
   );
 }
 ```
+`NextgenProvider` converts the `auth()` result to the client-safe shape
+**before** it crosses the server→client boundary: client components receive
+`userId` / `email` / `name`, and the raw session token never enters the RSC
+flight payload, where any script on the page could read it.
+That strip only protects you while it runs on the server, which is why
+`NextgenProvider` is server-only and **must not be re-exported through a
+`"use client"` wrapper** (the common `providers.tsx` pattern): the wrapper
+would become the client boundary, and its still-unstripped `session` prop —
+token included — would serialise into the flight payload before the provider
+ever ran. The `server-only` guard turns that wrapper into a build error
+instead of a silent leak. To seed the context from client-side state (e.g. a
+`getSession()` read), render `AuthContextProvider` from
+`@zitadel/sdk-next/react` — it only accepts the token-less
+`ClientAuthResult`.
 Then in any client component:
 ```tsx
 'use client';
-import { useAuth } from '@zitadel/sdk-next';
+import { useAuth } from '@zitadel/sdk-next/react';
 export function UserBadge() {
   const auth = useAuth();
@@ -80,7 +132,58 @@ export function UserBadge() {
 }
 ```
-### 4. Login page
+`useAuth()` returns the same client-safe `ClientAuthResult` shape as
+`getSession()` and sdk-nuxt's `useAuth()`. It reflects what the server knew
+when the page rendered — which, like `auth()`, is only a live session on
+routes the middleware `matcher` covers.
+### 4. Session state for your own UI (any page)
+`auth()` only sees a session on routes the middleware `matcher` covers, and the
+scaffolded matcher covers just the proxy path and the protected routes — so a
+header on a public page would always look signed out. For your app's own chrome
+(header navigation, account menus), read the session client-side with
+`getSession()` from `@zitadel/sdk-next/session`. It fetches the same-origin
+`{proxyPath}/sessions/me` — the same read the `<zitadel-session>` card performs —
+so it works on every page and the answer is the server's:
+```tsx
+'use client';
+import { useEffect, useState } from 'react';
+import { getSession, type ClientAuthResult } from '@zitadel/sdk-next/session';
+export function HeaderNav() {
+  // undefined = not yet known — render neutral chrome, not "Sign in".
+  const [auth, setAuth] = useState<ClientAuthResult>();
+  const [error, setError] = useState<Error>();
+  useEffect(() => {
+    getSession().then(setAuth, setError);
+  }, []);
+  if (error) return <span role="alert">Session unavailable</span>;
+  if (!auth) return null;
+  return auth.isAuthenticated ? (
+    <a href="/profile">{auth.session.name ?? auth.session.email ?? 'Account'}</a>
+  ) : (
+    <a href="/login">Sign in</a>
+  );
+}
+```
+A rejected `getSession()` means the state is *unknown* (broken proxy, network,
+5xx) — render a neutral or error state, never the signed-out CTAs.
+A `200` with a non-empty `user_id` resolves to
+`{ isAuthenticated: true, session: { userId, email, name } }` (client-safe —
+no token); the canonical `401/auth.unauthorized`,
+`404/sess.not_found`, and anonymous sessions resolve to signed out. The request
+and response are both marked no-store. Any other response — including malformed
+JSON or a framework's HTML 404 page from a misrouted proxy — throws so a broken
+proxy doesn't silently render as signed out. Sign-in and sign-out navigate
+(`post-sign-in-url` / `post-sign-out-url`), so chrome re-reads on the next page
+load without extra wiring; to react in place, listen for the widgets'
+`zitadel-signout` / `zitadel-flow-complete` events.
+### 5. Login page
 The `<zitadel-login>` web component (from `@zitadel/components`) must be rendered client-side only. Split it into a server wrapper and a client widget:
@@ -136,6 +239,7 @@ export function LoginWidget() {
 | `allowedTokenTypes` | `string[]`           | `["JWT", "at+JWT"]`      | Accepted `typ` header values (case-insensitive). Set to `[]` to disable this check                                         |
 | `clockSkewMs`       | `number`             | `5000`                   | Clock skew tolerance in ms for `exp`, `nbf`, `iat`                                                                         |
 | `jwksTimeoutMs`     | `number`             | `5000`                   | Timeout in ms for JWKS endpoint requests. Token is rejected if the fetch exceeds this window                               |
+| `opaqueTokenTimeoutMs` | `number`          | `5000`                   | Timeout in ms for opaque (non-JWT) session validation via `GET /sessions/me`. Also accepted by `auth()`                    |
 | `audience`          | `string \| string[]` | not validated            | Expected `aud` claim value(s). When omitted, audience is not checked                                                       |
 ## How JWT verification works
@@ -144,9 +248,10 @@ export function LoginWidget() {
 2. The JWT header is decoded to extract `kid` and `alg`
 3. Tokens with an `alg` not in `allowedAlgorithms` (`RS256`, `ES256` by default) are rejected immediately — no JWKS fetch
 4. Tokens with a `typ` not in `allowedTokenTypes` are rejected immediately
-5. The public key is fetched from `{url}/oauth/v2/keys` (JWKS) using the Web Crypto API, with a 5 s timeout, and cached for 5 minutes per `kid`
+5. The public key is fetched from `{url}/auth/keys` (JWKS) using the Web Crypto API, with a 5 s timeout, and cached for 5 minutes per `kid`
 6. The signature is verified **before** any claim checks
 7. `iss` must be present and must equal `url` — tokens without an issuer are rejected
 8. `exp` must be present and must be in the future (with `clockSkewMs` tolerance) — tokens without an expiry are rejected
 9. `nbf` and `iat` are validated with `clockSkewMs` tolerance when present
 10. The `x-nextgen-auth-token` header is stripped from all proxied requests to prevent internal state leakage
+11. `auth()` re-applies the same verification to the tunnelled token in the server runtime — the header alone is never treated as proof of a session

package/dist/auth.d.ts CHANGED Viewed

@@ -1,17 +1,56 @@
-import { AuthResult } from '@zitadel/sdk-core/middleware';
+import "server-only";
+import type { AuthResult, NextgenMiddlewareOptions } from "./types.js";
+/**
+ * Options for {@link auth}.
+ *
+ * These mirror the token-verification subset of the middleware options. When
+ * the middleware runs with custom verification settings (a non-default
+ * `audience`, `allowedAlgorithms`, …), pass the same values here — otherwise
+ * a token the middleware accepted can fail re-verification in `auth()` and
+ * render as signed out.
+ */
+export type AuthOptions = Pick<NextgenMiddlewareOptions, "url" | "allowedAlgorithms" | "clockSkewMs" | "audience" | "allowedTokenTypes" | "jwksTimeoutMs" | "opaqueTokenTimeoutMs">;
 /**
  * Reads the auth state in a React Server Component or Next.js Route Handler.
  *
- * - **JWT tokens** are decoded locally (no backend round-trip).
- * - **Opaque encrypted tokens** have already been validated by the
- *   middleware via `GET /sessions/me`. If the `x-nextgen-auth-token`
- *   header is set, the session is authentic. Session details (email,
- *   name) are not available server-side for opaque tokens — use the
- *   `/__nextgen/sessions/me` proxy from a client component to fetch them.
+ * The session token arrives on the `x-nextgen-auth-token` request header,
+ * tunnelled there by the middleware — and `auth()` **verifies it before
+ * trusting it**:
+ *
+ * - **JWT tokens** are verified cryptographically (signature via JWKS,
+ *   issuer, expiry, algorithm and type allow-lists) using the same rules and
+ *   defaults as the middleware. The JWKS is cached in-process, so this does
+ *   not add a backend round-trip after the first call.
+ * - **Opaque encrypted tokens** are validated against the backend's
+ *   `GET /sessions/me`, which also supplies the user's identity (`userId`,
+ *   `email`, `name`). The lookup is deduplicated per render pass via React
+ *   `cache()`.
+ *
+ * The header alone is never proof of anything: on routes the middleware
+ * `matcher` does not cover, the middleware cannot neutralise a forged
+ * client-supplied header, so `auth()` re-verifies every value it reads.
+ * A header value that fails verification is treated as signed out.
+ *
+ * **Matcher precondition (read this):** the middleware only tunnels the
+ * session token on routes covered by its `matcher`. On uncovered routes the
+ * cookie never reaches `auth()`, so `auth()` reports signed out even when a
+ * live session exists. Either extend the `matcher` to every route that calls
+ * `auth()`, or — for app chrome like headers and account menus — read the
+ * session client-side with `getSession()` from `@zitadel/sdk-next/session`,
+ * which works on any page.
+ *
+ * The backend URL comes from `options.url`, falling back to the same
+ * `ZITADEL_URL` environment variable the middleware uses. If the middleware
+ * runs with custom verification options (`audience`, `allowedAlgorithms`, …),
+ * pass the same values here; see {@link AuthOptions}.
+ *
+ * This module is server-only: importing it (or the package root) from a
+ * client component fails at build time. Client components read auth state
+ * from `@zitadel/sdk-next/react` (`useAuth()`) or
+ * `@zitadel/sdk-next/session` (`getSession()`).
  *
  * ```ts
- * import { auth } from "@zitadel/sdk-next";
+ * import { auth } from "@zitadel/sdk-next/server";
  *
  * export default async function Page() {
  *   const session = await auth();
@@ -20,8 +59,10 @@ import { AuthResult } from '@zitadel/sdk-core/middleware';
  * }
  * ```
  *
- * @returns The current {@link AuthResult}.
+ * @param options - Optional verification settings; see {@link AuthOptions}.
+ * @returns The current {@link AuthResult}. `session.token` is the raw session
+ *   token for calling upstream APIs server-side — never forward it into
+ *   client components (the `NextgenProvider` strips it for you).
  */
-declare function auth(): Promise<AuthResult>;
-export { auth };
+export declare function auth(options?: AuthOptions): Promise<AuthResult>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAOrB,OAAO,KAAK,EAAE,UAAU,EAAiB,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAItF;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,IAAI,CAC5B,wBAAwB,EACtB,KAAK,GACL,mBAAmB,GACnB,aAAa,GACb,UAAU,GACV,mBAAmB,GACnB,eAAe,GACf,sBAAsB,CACzB,CAAC;AA8DF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,wBAAsB,IAAI,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CA6DzE"}

package/dist/auth.js CHANGED Viewed

@@ -1,7 +1,152 @@
-import {
-  auth
-} from "./chunk-WZU5OYIF.js";
-import "./chunk-KHTLEMQO.js";
-export {
-  auth
-};
+import "server-only";
+import { headers } from "next/headers";
+import { cache } from "react";
+import { isJwtShaped, verifyJwt } from "./lib/jwt.js";
+/**
+ * Validates an opaque (non-JWT) session token against the backend's
+ * `GET /sessions/me` and returns the client-safe identity, or `null` when the
+ * backend does not confirm a signed-in user.
+ *
+ * Wrapped in React's `cache()` so that many components calling `auth()` in
+ * the same render pass share a single backend round-trip. Arguments are
+ * primitives on purpose — `cache()` memoises by argument identity.
+ *
+ * Fail-closed: network errors, timeouts, and unexpected statuses all resolve
+ * to `null` (signed out). Unexpected failures are logged so a broken proxy or
+ * unreachable backend is distinguishable from a genuinely missing session.
+ */
+const validateOpaqueSession = cache(async (token, issuerUrl, timeoutMs) => {
+    try {
+        const res = await fetch(`${issuerUrl}/sessions/me`, {
+            method: "GET",
+            headers: { accept: "application/json", cookie: `__nextgen_session=${token}` },
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        // 401 = no/invalid session token, 404 = session gone (revoked/expired):
+        // both are the server's definitive "not signed in".
+        if (res.status === 401 || res.status === 404) {
+            return null;
+        }
+        if (!res.ok) {
+            console.warn(`[nextgen] auth(): session validation failed with HTTP ${res.status} from ` +
+                `${issuerUrl}/sessions/me — treating as signed out. If this persists, the ` +
+                `backend URL is likely misconfigured (ZITADEL_URL or the \`url\` option).`);
+            return null;
+        }
+        const session = (await res.json());
+        // An anonymous session (no verified user factor yet) has no user_id —
+        // for server-rendered UI that is "not signed in".
+        if (!session.user_id) {
+            return null;
+        }
+        return {
+            userId: session.user_id,
+            email: session.email ?? null,
+            name: session.name ?? null,
+        };
+    }
+    catch {
+        console.warn(`[nextgen] auth(): could not reach ${issuerUrl}/sessions/me to validate the ` +
+            `session token — treating as signed out.`);
+        return null;
+    }
+});
+/**
+ * Reads the auth state in a React Server Component or Next.js Route Handler.
+ *
+ * The session token arrives on the `x-nextgen-auth-token` request header,
+ * tunnelled there by the middleware — and `auth()` **verifies it before
+ * trusting it**:
+ *
+ * - **JWT tokens** are verified cryptographically (signature via JWKS,
+ *   issuer, expiry, algorithm and type allow-lists) using the same rules and
+ *   defaults as the middleware. The JWKS is cached in-process, so this does
+ *   not add a backend round-trip after the first call.
+ * - **Opaque encrypted tokens** are validated against the backend's
+ *   `GET /sessions/me`, which also supplies the user's identity (`userId`,
+ *   `email`, `name`). The lookup is deduplicated per render pass via React
+ *   `cache()`.
+ *
+ * The header alone is never proof of anything: on routes the middleware
+ * `matcher` does not cover, the middleware cannot neutralise a forged
+ * client-supplied header, so `auth()` re-verifies every value it reads.
+ * A header value that fails verification is treated as signed out.
+ *
+ * **Matcher precondition (read this):** the middleware only tunnels the
+ * session token on routes covered by its `matcher`. On uncovered routes the
+ * cookie never reaches `auth()`, so `auth()` reports signed out even when a
+ * live session exists. Either extend the `matcher` to every route that calls
+ * `auth()`, or — for app chrome like headers and account menus — read the
+ * session client-side with `getSession()` from `@zitadel/sdk-next/session`,
+ * which works on any page.
+ *
+ * The backend URL comes from `options.url`, falling back to the same
+ * `ZITADEL_URL` environment variable the middleware uses. If the middleware
+ * runs with custom verification options (`audience`, `allowedAlgorithms`, …),
+ * pass the same values here; see {@link AuthOptions}.
+ *
+ * This module is server-only: importing it (or the package root) from a
+ * client component fails at build time. Client components read auth state
+ * from `@zitadel/sdk-next/react` (`useAuth()`) or
+ * `@zitadel/sdk-next/session` (`getSession()`).
+ *
+ * ```ts
+ * import { auth } from "@zitadel/sdk-next/server";
+ *
+ * export default async function Page() {
+ *   const session = await auth();
+ *   if (!session.isAuthenticated) return <p>Not signed in</p>;
+ *   return <p>Hello {session.session.userId}</p>;
+ * }
+ * ```
+ *
+ * @param options - Optional verification settings; see {@link AuthOptions}.
+ * @returns The current {@link AuthResult}. `session.token` is the raw session
+ *   token for calling upstream APIs server-side — never forward it into
+ *   client components (the `NextgenProvider` strips it for you).
+ */
+export async function auth(options = {}) {
+    const headerStore = await headers();
+    const token = headerStore.get("x-nextgen-auth-token");
+    if (!token) {
+        return { isAuthenticated: false, session: null };
+    }
+    const { url = process.env.ZITADEL_URL ?? "http://localhost:8080", allowedAlgorithms = ["RS256", "ES256"], clockSkewMs = 5000, audience, allowedTokenTypes = ["JWT", "at+JWT"], jwksTimeoutMs, opaqueTokenTimeoutMs = 5000, } = options;
+    if (isJwtShaped(token)) {
+        const payload = await verifyJwt(token, {
+            issuerUrl: url,
+            allowedAlgorithms,
+            clockSkewMs,
+            audience,
+            allowedTokenTypes,
+            jwksTimeoutMs,
+        });
+        if (payload?.sub) {
+            return {
+                isAuthenticated: true,
+                session: {
+                    userId: payload.sub,
+                    email: payload.email ?? null,
+                    name: payload.name ?? null,
+                    token,
+                },
+            };
+        }
+        // A middleware-tunnelled JWT always verifies (the middleware applied the
+        // same checks moments earlier). Reaching this branch means the header was
+        // NOT vetted by the middleware — a route outside the `matcher` received a
+        // client-forged header — or the JWKS endpoint is unreachable from this
+        // runtime, or auth() runs with verification options that diverge from the
+        // middleware's.
+        console.warn("[nextgen] auth(): rejected an x-nextgen-auth-token header that failed JWT " +
+            "verification. If this route is not covered by the middleware matcher, this was " +
+            "a forged client header; otherwise check that auth() and the middleware use the " +
+            `same verification options and that the JWKS endpoint at ${url}/auth/keys is reachable.`);
+        return { isAuthenticated: false, session: null };
+    }
+    const session = await validateOpaqueSession(token, url, opaqueTokenTimeoutMs);
+    if (session) {
+        return { isAuthenticated: true, session: { ...session, token } };
+    }
+    return { isAuthenticated: false, session: null };
+}

package/dist/client.d.ts CHANGED Viewed

@@ -1,2 +1,23 @@
-export { ZitadelLogin, ZitadelLogout, ZitadelSession } from '@zitadel/components';
-export { ZitadelConfig, ZitadelProject, configureZitadel, getApi } from '@zitadel/api/config';
+/**
+ * Re-exports the `<zitadel-login>` and `<zitadel-logout>` Lit web components
+ * for use in Next.js apps.
+ *
+ * Import this inside a `"use client"` boundary (e.g. a dynamic import
+ * with `{ ssr: false }`) to register the custom elements with the
+ * browser's global registry:
+ *
+ * ```ts
+ * await import("@zitadel/sdk-next/client");
+ * ```
+ *
+ * SDK configuration is done via `configureZitadel()`, re-exported here so
+ * a consuming app that only declares `@zitadel/sdk-next` as a direct
+ * dependency can configure the SDK without reaching into
+ * `@zitadel/api/config` (which strict package managers would not
+ * resolve). Call it inside the same `"use client"` boundary before the
+ * components mount.
+ */
+export { ZitadelLogin, ZitadelLogout, ZitadelSession, businessLocales } from "@zitadel/components";
+export { configureZitadel, getApi } from "@zitadel/api/config";
+export type { ZitadelConfig, ZitadelProject } from "@zitadel/api/config";
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC/D,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/client.js CHANGED Viewed

@@ -1,10 +1,21 @@
-// src/client.ts
-import { ZitadelLogin, ZitadelLogout, ZitadelSession } from "@zitadel/components";
-import { configureZitadel, getApi } from "@zitadel/api/config";
-export {
-  ZitadelLogin,
-  ZitadelLogout,
-  ZitadelSession,
-  configureZitadel,
-  getApi
-};
+/**
+ * Re-exports the `<zitadel-login>` and `<zitadel-logout>` Lit web components
+ * for use in Next.js apps.
+ *
+ * Import this inside a `"use client"` boundary (e.g. a dynamic import
+ * with `{ ssr: false }`) to register the custom elements with the
+ * browser's global registry:
+ *
+ * ```ts
+ * await import("@zitadel/sdk-next/client");
+ * ```
+ *
+ * SDK configuration is done via `configureZitadel()`, re-exported here so
+ * a consuming app that only declares `@zitadel/sdk-next` as a direct
+ * dependency can configure the SDK without reaching into
+ * `@zitadel/api/config` (which strict package managers would not
+ * resolve). Call it inside the same `"use client"` boundary before the
+ * components mount.
+ */
+export { ZitadelLogin, ZitadelLogout, ZitadelSession, businessLocales } from "@zitadel/components";
+export { configureZitadel, getApi } from "@zitadel/api/config";

package/dist/context.d.ts CHANGED Viewed

@@ -1,11 +1,22 @@
-import * as react_jsx_runtime from 'react/jsx-runtime';
-import { ReactNode } from 'react';
-import { AuthResult, NextgenSession } from '@zitadel/sdk-core/middleware';
-declare function NextgenProvider({ session, children, }: {
-    session: AuthResult | NextgenSession | null;
+import { type ReactNode } from "react";
+import type { ClientAuthResult } from "./types.js";
+/**
+ * Client-side context carrier. In the standard server-seeded setup, render
+ * {@link NextgenProvider} from `@zitadel/sdk-next/server` instead — it
+ * normalises the server's `auth()` result to the client-safe shape (dropping
+ * the raw session token) *before* the value crosses the server→client
+ * component boundary, and its `server-only` guard keeps it out of client
+ * wrappers where that strip would come too late.
+ *
+ * Render this component directly only from client code that already holds a
+ * client-safe value — e.g. seeding from a `getSession()` read.
+ *
+ * The `value` prop is deliberately typed as {@link ClientAuthResult}: the
+ * raw session token must never enter client-side state.
+ */
+export declare function AuthContextProvider({ value, children, }: {
+    value: ClientAuthResult;
     children: ReactNode;
-}): react_jsx_runtime.JSX.Element;
-declare function useAuthContext(): AuthResult;
-export { NextgenProvider, useAuthContext };
+}): import("react/jsx-runtime").JSX.Element;
+export declare function useAuthContext(): ClientAuthResult;
+//# sourceMappingURL=context.d.ts.map

package/dist/context.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.tsx"],"names":[],"mappings":"AAEA,OAAO,EAA6B,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAElE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAMnD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,KAAK,EACL,QAAQ,GACT,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAC;IACxB,QAAQ,EAAE,SAAS,CAAC;CACrB,2CAEA;AAED,wBAAgB,cAAc,IAAI,gBAAgB,CAEjD"}

package/dist/context.js CHANGED Viewed

@@ -1,9 +1,25 @@
 "use client";
-import {
-  NextgenProvider,
-  useAuthContext
-} from "./chunk-2BFQLJQE.js";
-export {
-  NextgenProvider,
-  useAuthContext
-};
+import { jsx as _jsx } from "react/jsx-runtime";
+import { createContext, useContext } from "react";
+const defaultValue = { isAuthenticated: false, session: null };
+const NextgenAuthContext = createContext(defaultValue);
+/**
+ * Client-side context carrier. In the standard server-seeded setup, render
+ * {@link NextgenProvider} from `@zitadel/sdk-next/server` instead — it
+ * normalises the server's `auth()` result to the client-safe shape (dropping
+ * the raw session token) *before* the value crosses the server→client
+ * component boundary, and its `server-only` guard keeps it out of client
+ * wrappers where that strip would come too late.
+ *
+ * Render this component directly only from client code that already holds a
+ * client-safe value — e.g. seeding from a `getSession()` read.
+ *
+ * The `value` prop is deliberately typed as {@link ClientAuthResult}: the
+ * raw session token must never enter client-side state.
+ */
+export function AuthContextProvider({ value, children, }) {
+    return _jsx(NextgenAuthContext.Provider, { value: value, children: children });
+}
+export function useAuthContext() {
+    return useContext(NextgenAuthContext);
+}

package/dist/index.d.ts CHANGED Viewed

@@ -1,9 +1,16 @@
-export { AuthResult, AuthState, NextgenMiddlewareOptions, NextgenSession, UnauthState } from '@zitadel/sdk-core/middleware';
-export { ProxyHandler, ProxyOptions, createProxy, nextgenMiddleware } from './middleware.js';
-export { auth } from './auth.js';
-export { NextgenProvider, useAuthContext } from './context.js';
-export { useAuth } from './useAuth.js';
-import '@zitadel/api/config';
-import 'next/server';
-import 'react/jsx-runtime';
-import 'react';
+/**
+ * Package root — for **Server Components and server modules only**: it
+ * includes the server-only `auth()`, so importing it from a `"use client"`
+ * module fails at build time. Client components import from
+ * `@zitadel/sdk-next/react` (provider + hooks) or
+ * `@zitadel/sdk-next/session` (`getSession()`) instead.
+ */
+export * from "./types.js";
+export { nextgenMiddleware, createProxy } from "./middleware.js";
+export type { ProxyOptions, ProxyHandler } from "./middleware.js";
+export { auth } from "./auth.js";
+export type { AuthOptions } from "./auth.js";
+export { NextgenProvider } from "./provider.js";
+export { AuthContextProvider, useAuthContext } from "./context.js";
+export { useAuth } from "./useAuth.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACjE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js CHANGED Viewed

@@ -1,24 +1,13 @@
-import {
-  createProxy,
-  nextgenMiddleware
-} from "./chunk-7D5LORRL.js";
-import {
-  auth
-} from "./chunk-WZU5OYIF.js";
-import "./chunk-KHTLEMQO.js";
-import "./chunk-6F4PWJZI.js";
-import {
-  useAuth
-} from "./chunk-XTCHTAIQ.js";
-import {
-  NextgenProvider,
-  useAuthContext
-} from "./chunk-2BFQLJQE.js";
-export {
-  NextgenProvider,
-  auth,
-  createProxy,
-  nextgenMiddleware,
-  useAuth,
-  useAuthContext
-};
+/**
+ * Package root — for **Server Components and server modules only**: it
+ * includes the server-only `auth()`, so importing it from a `"use client"`
+ * module fails at build time. Client components import from
+ * `@zitadel/sdk-next/react` (provider + hooks) or
+ * `@zitadel/sdk-next/session` (`getSession()`) instead.
+ */
+export * from "./types.js";
+export { nextgenMiddleware, createProxy } from "./middleware.js";
+export { auth } from "./auth.js";
+export { NextgenProvider } from "./provider.js";
+export { AuthContextProvider, useAuthContext } from "./context.js";
+export { useAuth } from "./useAuth.js";

package/dist/jsx.d.ts ADDED Viewed

@@ -0,0 +1,5 @@
+// Types-only shim: scaffolded apps depend on @zitadel/sdk-next, not
+// @zitadel/components, so the React JSX declarations for the <zitadel-*>
+// elements are re-exposed here as `@zitadel/sdk-next/jsx`. Copied verbatim
+// into dist/ by the build script.
+/// <reference types="@zitadel/components/jsx" />

package/dist/lib/jwt.d.ts ADDED Viewed

@@ -0,0 +1,9 @@
+/**
+ * Re-exports shared JWT verification from `@zitadel/sdk-core`.
+ *
+ * The JWT module is runtime-agnostic (uses `atob` which is available in both
+ * Edge and Node.js 16+) and is defined once in sdk-core.
+ */
+export { JWKS_TTL_MS, base64UrlDecode, decodeJwt, isJwtShaped, verifyJwt, } from "@zitadel/sdk-core/jwt";
+export type { JwtPayload, JwtHeader, DecodedJwt, VerifyJwtOptions } from "@zitadel/sdk-core/jwt";
+//# sourceMappingURL=jwt.d.ts.map