@zitadel/sdk-next 0.1.0-alpha.9 → 0.1.0

package/dist/provider.d.ts

@@ -0,0 +1,52 @@
+import "server-only";
+import type { ReactNode } from "react";
+import type { AuthResult, ClientAuthResult, ClientSession, NextgenSession } from "./types.js";
+/**
+ * Seeds client components (the `useAuth()` hook) with the server-known auth
+ * state. Render it in a Server Component — typically the root layout — and
+ * pass the `auth()` result directly:
+ *
+ * ```tsx
+ * import { auth, NextgenProvider } from "@zitadel/sdk-next/server";
+ *
+ * export default async function RootLayout({ children }) {
+ *   const session = await auth();
+ *   return (
+ *     <html>
+ *       <body>
+ *         <NextgenProvider session={session}>{children}</NextgenProvider>
+ *       </body>
+ *     </html>
+ *   );
+ * }
+ * ```
+ *
+ * Executed in a Server Component, it converts the input to the client-safe
+ * {@link ClientAuthResult} — dropping the raw session token — and only the
+ * stripped value is serialised across the server→client boundary. Passing the
+ * full `auth()` result straight into a `"use client"` component would embed
+ * the raw token in the RSC flight payload, readable by any script running on
+ * the page. (sdk-nuxt strips the token before seeding client state for the
+ * same reason.)
+ *
+ * This module is **server-only, on purpose**. The strip only protects the
+ * boundary when it runs on the server: if this component could be imported
+ * into a `"use client"` wrapper (the common `providers.tsx` pattern), the
+ * *wrapper* would become the boundary and its still-unstripped `session`
+ * prop — token included — would serialise into the flight payload before
+ * this code ever ran. The `server-only` import turns that wrapper into a
+ * build error instead of a silent leak. For a client-seeded tree (e.g. state
+ * from `getSession()`), use `AuthContextProvider` from
+ * `@zitadel/sdk-next/react`, which only accepts the token-less
+ * {@link ClientAuthResult}.
+ *
+ * Client components therefore only ever see `userId` / `email` / `name`. When
+ * the raw token is needed server-side (e.g. to call an upstream API), read it
+ * from `auth()` in a Server Component or Route Handler — never through this
+ * provider.
+ */
+export declare function NextgenProvider({ session, children, }: {
+    session: AuthResult | ClientAuthResult | ClientSession | NextgenSession | null;
+    children: ReactNode;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=provider.d.ts.map

package/dist/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.tsx"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC,OAAO,KAAK,EACV,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,cAAc,EAEf,MAAM,YAAY,CAAC;AAmBpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,wBAAgB,eAAe,CAAC,EAC9B,OAAO,EACP,QAAQ,GACT,EAAE;IACD,OAAO,EAAE,UAAU,GAAG,gBAAgB,GAAG,aAAa,GAAG,cAAc,GAAG,IAAI,CAAC;IAC/E,QAAQ,EAAE,SAAS,CAAC;CACrB,2CAaA"}

package/dist/provider.js

@@ -0,0 +1,75 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import "server-only";
+import { AuthContextProvider } from "./context.js";
+const signedOut = { isAuthenticated: false, session: null };
+/**
+ * Explicit field pick — never a spread. The raw session token (and any future
+ * server-only field) must not survive the conversion to the client shape.
+ */
+function toClientSession(session) {
+    return {
+        userId: session.userId,
+        identifier: session.identifier,
+        identifierProperty: session.identifierProperty,
+        display: session.display,
+    };
+}
+/**
+ * Seeds client components (the `useAuth()` hook) with the server-known auth
+ * state. Render it in a Server Component — typically the root layout — and
+ * pass the `auth()` result directly:
+ *
+ * ```tsx
+ * import { auth, NextgenProvider } from "@zitadel/sdk-next/server";
+ *
+ * export default async function RootLayout({ children }) {
+ *   const session = await auth();
+ *   return (
+ *     <html>
+ *       <body>
+ *         <NextgenProvider session={session}>{children}</NextgenProvider>
+ *       </body>
+ *     </html>
+ *   );
+ * }
+ * ```
+ *
+ * Executed in a Server Component, it converts the input to the client-safe
+ * {@link ClientAuthResult} — dropping the raw session token — and only the
+ * stripped value is serialised across the server→client boundary. Passing the
+ * full `auth()` result straight into a `"use client"` component would embed
+ * the raw token in the RSC flight payload, readable by any script running on
+ * the page. (sdk-nuxt strips the token before seeding client state for the
+ * same reason.)
+ *
+ * This module is **server-only, on purpose**. The strip only protects the
+ * boundary when it runs on the server: if this component could be imported
+ * into a `"use client"` wrapper (the common `providers.tsx` pattern), the
+ * *wrapper* would become the boundary and its still-unstripped `session`
+ * prop — token included — would serialise into the flight payload before
+ * this code ever ran. The `server-only` import turns that wrapper into a
+ * build error instead of a silent leak. For a client-seeded tree (e.g. state
+ * from `getSession()`), use `AuthContextProvider` from
+ * `@zitadel/sdk-next/react`, which only accepts the token-less
+ * {@link ClientAuthResult}.
+ *
+ * Client components therefore only ever see `userId` / `email` / `name`. When
+ * the raw token is needed server-side (e.g. to call an upstream API), read it
+ * from `auth()` in a Server Component or Route Handler — never through this
+ * provider.
+ */
+export function NextgenProvider({ session, children, }) {
+    let value;
+    if (!session) {
+        value = signedOut;
+    }
+    else if ("isAuthenticated" in session) {
+        value = session.isAuthenticated
+            ? { isAuthenticated: true, session: toClientSession(session.session) }
+            : signedOut;
+    }
+    else {
+        value = { isAuthenticated: true, session: toClientSession(session) };
+    }
+    return _jsx(AuthContextProvider, { value: value, children: children });
+}

package/dist/react.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Client-safe React bindings for `@zitadel/sdk-next`.
+ *
+ * This is the entry point for `"use client"` components. It pulls in no
+ * server-only modules (`next/headers`, `auth()`, `NextgenProvider`), so it is
+ * safe to import anywhere.
+ *
+ * ```tsx
+ * "use client";
+ * import { useAuth } from "@zitadel/sdk-next/react";
+ * ```
+ *
+ * `NextgenProvider` is deliberately **not** exported here: it accepts the
+ * token-bearing `auth()` result, so it must execute in a Server Component —
+ * wrapping it in a `"use client"` file would serialise the raw token across
+ * the boundary before the provider strips it. Import it from
+ * `@zitadel/sdk-next/server` (or the package root) instead; the `server-only`
+ * guard turns a client-side import into a build error. To seed the context
+ * from client-side state (e.g. a `getSession()` read), render
+ * {@link AuthContextProvider}, which only accepts the token-less
+ * `ClientAuthResult`.
+ */
+export { AuthContextProvider, useAuthContext } from "./context.js";
+export { useAuth } from "./useAuth.js";
+export type { AuthResult, AuthState, ClientAuthResult, ClientAuthState, ClientSession, NextgenSession, UnauthState, } from "./types.js";
+//# sourceMappingURL=react.d.ts.map

package/dist/react.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,YAAY,EACV,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,cAAc,EACd,WAAW,GACZ,MAAM,YAAY,CAAC"}

package/dist/react.js

@@ -0,0 +1,24 @@
+/**
+ * Client-safe React bindings for `@zitadel/sdk-next`.
+ *
+ * This is the entry point for `"use client"` components. It pulls in no
+ * server-only modules (`next/headers`, `auth()`, `NextgenProvider`), so it is
+ * safe to import anywhere.
+ *
+ * ```tsx
+ * "use client";
+ * import { useAuth } from "@zitadel/sdk-next/react";
+ * ```
+ *
+ * `NextgenProvider` is deliberately **not** exported here: it accepts the
+ * token-bearing `auth()` result, so it must execute in a Server Component —
+ * wrapping it in a `"use client"` file would serialise the raw token across
+ * the boundary before the provider strips it. Import it from
+ * `@zitadel/sdk-next/server` (or the package root) instead; the `server-only`
+ * guard turns a client-side import into a build error. To seed the context
+ * from client-side state (e.g. a `getSession()` read), render
+ * {@link AuthContextProvider}, which only accepts the token-less
+ * `ClientAuthResult`.
+ */
+export { AuthContextProvider, useAuthContext } from "./context.js";
+export { useAuth } from "./useAuth.js";

package/dist/server.d.ts

@@ -1,2 +1,13 @@
-export { auth } from './auth.js';
-import '@zitadel/sdk-core/types';
+/**
+ * Server-side surface of `@zitadel/sdk-next`: everything here is guarded by
+ * `server-only` and fails the build if pulled into a `"use client"` graph.
+ *
+ * ```tsx
+ * import { auth, NextgenProvider } from "@zitadel/sdk-next/server";
+ * ```
+ */
+export { auth } from "./auth.js";
+export type { AuthOptions } from "./auth.js";
+export { NextgenProvider } from "./provider.js";
+export type { AuthResult, AuthState, UnauthState, NextgenSession, ClientAuthResult, NextgenMiddlewareOptions, } from "./types.js";
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,YAAY,EACV,UAAU,EACV,SAAS,EACT,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,YAAY,CAAC"}

package/dist/server.js

@@ -1,7 +1,10 @@
-import {
-  auth
-} from "./chunk-B7S6XMT3.js";
-import "./chunk-OCZMYSFX.js";
-export {
-  auth
-};
+/**
+ * Server-side surface of `@zitadel/sdk-next`: everything here is guarded by
+ * `server-only` and fails the build if pulled into a `"use client"` graph.
+ *
+ * ```tsx
+ * import { auth, NextgenProvider } from "@zitadel/sdk-next/server";
+ * ```
+ */
+export { auth } from "./auth.js";
+export { NextgenProvider } from "./provider.js";

package/dist/session.d.ts

@@ -0,0 +1,77 @@
+import type { ClientAuthResult } from "./types.js";
+/** Options for {@link getSession}. */
+export type GetSessionOptions = {
+    /**
+     * Proxy path the scaffolded request boundary forwards to the Zitadel
+     * backend. Defaults to the path from `configureZitadel()` when it has run
+     * on this page, else `"/__nextgen"` (the scaffold default).
+     */
+    proxyPath?: string;
+    /**
+     * The project this app signs its users in to. A session of another project
+     * reads as signed out. Defaults to the project from `configureZitadel()`
+     * when it has run on this page, else `NEXT_PUBLIC_ZITADEL_PROJECT_ID`. With
+     * none, nobody reads as signed in, as on the server.
+     */
+    projectId?: string;
+};
+/**
+ * Reads the current session state from the browser — the supported way for
+ * an app's own UI (header navigation, account menus) to know whether a user
+ * is signed in and who they are.
+ *
+ * Fetches the same-origin `{proxyPath}/sessions/me?project_id=…` with
+ * credentials and `cache: "no-store"` — the same read the `<zitadel-session>`
+ * card performs — so the answer is the server's, not a client-side guess.
+ * Works on any page: unlike server-side `auth()`, it does not require the
+ * route to be covered by the middleware `matcher` (only the proxy path itself
+ * must be matched, which the scaffolded request boundary always does).
+ *
+ * A session counts only in the app's own project: `options.projectId`, else
+ * the project of `configureZitadel()`, else `NEXT_PUBLIC_ZITADEL_PROJECT_ID`.
+ * With none of them, it reads as signed out without asking the server.
+ *
+ * - `200` with an authenticated user → `{ isAuthenticated: true, session }`
+ *   with the client-safe identity (`userId`, `email`, `name` — no token).
+ * - `200` for an anonymous session, `401` with `auth.unauthorized`, `403`
+ *   with `sess.project_mismatch`, or `404` with `sess.not_found` → signed out.
+ *   The `403` answers a session of another project on the same server, and a
+ *   `200` naming another project (from a server that predates the parameter)
+ *   reads as signed out too.
+ * - Any other response throws — including a framework's HTML 404 page from
+ *   a misrouted proxy: a failing proxy is a misconfiguration and must not
+ *   silently render as "signed out". Treat a rejection as "unknown" —
+ *   distinct from signed-out — as the example does.
+ *
+ * ```tsx
+ * "use client";
+ * import { getSession, type ClientAuthResult } from "@zitadel/sdk-next/session";
+ *
+ * export function HeaderNav() {
+ *   // undefined = not yet known — render neutral chrome, not "Sign in".
+ *   const [auth, setAuth] = useState<ClientAuthResult>();
+ *   const [failed, setFailed] = useState(false);
+ *   useEffect(() => {
+ *     getSession({ projectId: process.env.NEXT_PUBLIC_ZITADEL_PROJECT_ID }).then(
+ *       setAuth,
+ *       () => setFailed(true),
+ *     );
+ *   }, []);
+ *   if (failed) return <span role="alert">Session unavailable</span>;
+ *   if (!auth) return null;
+ *   return auth.isAuthenticated
+ *     ? <a href="/profile">{auth.session.display ?? auth.session.identifier ?? "Account"}</a>
+ *     : <a href="/login">Sign in</a>;
+ * }
+ * ```
+ *
+ * The transitions need no extra wiring in the scaffolded posture: sign-in
+ * (`post-sign-in-url`) and sign-out (`post-sign-out-url`) both navigate, so
+ * chrome re-reads on the next page load. To react in place instead, listen
+ * for the widgets' `zitadel-signout` / `zitadel-flow-complete` events.
+ *
+ * @returns The current {@link ClientAuthResult}.
+ */
+export declare function getSession(options?: GetSessionOptions): Promise<ClientAuthResult>;
+export type { ClientAuthResult, ClientAuthState, ClientSession } from "./types.js";
+//# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAKnD,sCAAsC;AACtC,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AA8BF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,wBAAsB,UAAU,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAqE3F;AAED,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/session.js

@@ -0,0 +1,156 @@
+import { getZitadelConfig } from "@zitadel/api/config";
+/** Matches the `configureZitadel()` default so zero-config apps agree with the scaffold. */
+const DEFAULT_PROXY_PATH = "/__nextgen";
+/**
+ * `NEXT_PUBLIC_ZITADEL_PROJECT_ID`, which Next.js inlines into client bundles
+ * at build time. Read defensively: where it was not inlined, `process` may not
+ * exist in the browser.
+ */
+function publicProjectId() {
+    try {
+        return process.env.NEXT_PUBLIC_ZITADEL_PROJECT_ID || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+let warnedMissingProject = false;
+/** Says once per page why `getSession()` signs no one in: no project is known. */
+function warnMissingProject() {
+    if (warnedMissingProject) {
+        return;
+    }
+    warnedMissingProject = true;
+    console.warn("[nextgen] getSession(): no project id is known, so no session counts as signed in. " +
+        "Pass `projectId` (e.g. process.env.NEXT_PUBLIC_ZITADEL_PROJECT_ID) or call " +
+        "configureZitadel() first.");
+}
+/**
+ * Reads the current session state from the browser — the supported way for
+ * an app's own UI (header navigation, account menus) to know whether a user
+ * is signed in and who they are.
+ *
+ * Fetches the same-origin `{proxyPath}/sessions/me?project_id=…` with
+ * credentials and `cache: "no-store"` — the same read the `<zitadel-session>`
+ * card performs — so the answer is the server's, not a client-side guess.
+ * Works on any page: unlike server-side `auth()`, it does not require the
+ * route to be covered by the middleware `matcher` (only the proxy path itself
+ * must be matched, which the scaffolded request boundary always does).
+ *
+ * A session counts only in the app's own project: `options.projectId`, else
+ * the project of `configureZitadel()`, else `NEXT_PUBLIC_ZITADEL_PROJECT_ID`.
+ * With none of them, it reads as signed out without asking the server.
+ *
+ * - `200` with an authenticated user → `{ isAuthenticated: true, session }`
+ *   with the client-safe identity (`userId`, `email`, `name` — no token).
+ * - `200` for an anonymous session, `401` with `auth.unauthorized`, `403`
+ *   with `sess.project_mismatch`, or `404` with `sess.not_found` → signed out.
+ *   The `403` answers a session of another project on the same server, and a
+ *   `200` naming another project (from a server that predates the parameter)
+ *   reads as signed out too.
+ * - Any other response throws — including a framework's HTML 404 page from
+ *   a misrouted proxy: a failing proxy is a misconfiguration and must not
+ *   silently render as "signed out". Treat a rejection as "unknown" —
+ *   distinct from signed-out — as the example does.
+ *
+ * ```tsx
+ * "use client";
+ * import { getSession, type ClientAuthResult } from "@zitadel/sdk-next/session";
+ *
+ * export function HeaderNav() {
+ *   // undefined = not yet known — render neutral chrome, not "Sign in".
+ *   const [auth, setAuth] = useState<ClientAuthResult>();
+ *   const [failed, setFailed] = useState(false);
+ *   useEffect(() => {
+ *     getSession({ projectId: process.env.NEXT_PUBLIC_ZITADEL_PROJECT_ID }).then(
+ *       setAuth,
+ *       () => setFailed(true),
+ *     );
+ *   }, []);
+ *   if (failed) return <span role="alert">Session unavailable</span>;
+ *   if (!auth) return null;
+ *   return auth.isAuthenticated
+ *     ? <a href="/profile">{auth.session.display ?? auth.session.identifier ?? "Account"}</a>
+ *     : <a href="/login">Sign in</a>;
+ * }
+ * ```
+ *
+ * The transitions need no extra wiring in the scaffolded posture: sign-in
+ * (`post-sign-in-url`) and sign-out (`post-sign-out-url`) both navigate, so
+ * chrome re-reads on the next page load. To react in place instead, listen
+ * for the widgets' `zitadel-signout` / `zitadel-flow-complete` events.
+ *
+ * @returns The current {@link ClientAuthResult}.
+ */
+export async function getSession(options = {}) {
+    if (typeof window === "undefined") {
+        throw new Error("[nextgen] getSession() reads the session from the browser. " +
+            "In Server Components and Route Handlers use auth() from @zitadel/sdk-next/server " +
+            "(requires the route to be covered by the middleware matcher).");
+    }
+    // Strip trailing slashes so "/__nextgen/" doesn't produce a double-slash
+    // URL that misses the request-boundary matcher — same normalization the
+    // typed API client applies to its base URL.
+    let proxyPath = options.proxyPath ?? getZitadelConfig()?.proxyPath ?? DEFAULT_PROXY_PATH;
+    while (proxyPath.endsWith("/")) {
+        proxyPath = proxyPath.slice(0, -1);
+    }
+    const projectId = options.projectId || getZitadelConfig()?.projectId || publicProjectId();
+    if (!projectId) {
+        warnMissingProject();
+        return { isAuthenticated: false, session: null };
+    }
+    const response = await fetch(`${proxyPath}/sessions/me?project_id=${encodeURIComponent(projectId)}`, {
+        cache: "no-store",
+        credentials: "include",
+        headers: { accept: "application/json" },
+    });
+    // Only the backend's canonical error envelope is definitive signed-out.
+    // A framework route, gateway, or WAF can also return 401/404; accepting the
+    // status or content type alone would turn a broken proxy into signed-out.
+    if (response.status === 401 || response.status === 403 || response.status === 404) {
+        const error = await readErrorEnvelope(response);
+        const isSignedOut = (response.status === 401 && error?.code === "auth.unauthorized") ||
+            (response.status === 403 && error?.code === "sess.project_mismatch") ||
+            (response.status === 404 && error?.code === "sess.not_found");
+        if (isSignedOut) {
+            return { isAuthenticated: false, session: null };
+        }
+    }
+    if (!response.ok) {
+        throw new Error(`[nextgen] Session read failed: HTTP ${response.status} from ${proxyPath}/sessions/me`);
+    }
+    const session = (await response.json());
+    // An anonymous session (no verified user factor yet) has no user_id, and a
+    // backend that predates `project_id` answers for any project: for app
+    // chrome, either is "not signed in".
+    if (!session.user_id || session.project_id !== projectId) {
+        return { isAuthenticated: false, session: null };
+    }
+    return {
+        isAuthenticated: true,
+        session: {
+            userId: session.user_id,
+            identifier: session.user?.identifier ?? null,
+            identifierProperty: session.user?.identifier_property ?? null,
+            display: session.user?.display ?? null,
+        },
+    };
+}
+async function readErrorEnvelope(response) {
+    try {
+        const body = (await response.json());
+        if (typeof body === "object" &&
+            body !== null &&
+            "code" in body &&
+            typeof body.code === "string" &&
+            "message" in body &&
+            typeof body.message === "string") {
+            return { code: body.code, message: body.message };
+        }
+    }
+    catch {
+        // The caller reports the HTTP failure below; parsing details are untrusted.
+    }
+    return undefined;
+}

package/dist/types.d.ts

@@ -1,3 +1,8 @@
-export { AuthResult, AuthState, NextgenMiddlewareOptions, NextgenSession, UnauthState } from '@zitadel/sdk-core/types';
-import '@zitadel/components';
-import '@zitadel/api/config';
+/**
+ * Re-exports shared SDK types from `@zitadel/sdk-core`.
+ *
+ * These types are defined once in sdk-core and shared by both sdk-next
+ * and sdk-nuxt.
+ */
+export type { NextgenSession, AuthState, UnauthState, AuthResult, NextgenMiddlewareOptions, ClientSession, ClientAuthState, ClientAuthResult, } from "@zitadel/sdk-core/middleware";
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,YAAY,EACV,cAAc,EACd,SAAS,EACT,WAAW,EACX,UAAU,EACV,wBAAwB,EAGxB,aAAa,EACb,eAAe,EACf,gBAAgB,GACjB,MAAM,8BAA8B,CAAC"}

package/dist/types.js

@@ -1 +1 @@
-import "./chunk-6F4PWJZI.js";
+export {};

package/dist/useAuth.d.ts

@@ -1,5 +1,17 @@
-import { AuthResult } from '@zitadel/sdk-core/types';
-
-declare function useAuth(): AuthResult;
-
-export { useAuth };
+import type { ClientAuthResult } from "./types.js";
+/**
+ * Reads the auth state seeded by {@link NextgenProvider} in a client
+ * component.
+ *
+ * Returns the client-safe {@link ClientAuthResult} (`userId` / `email` /
+ * `name`) — the raw session token is stripped server-side by the provider
+ * and is never available client-side. This is the same shape sdk-nuxt's
+ * `useAuth()` and `getSession()` return.
+ *
+ * The value reflects what the server knew when the page rendered. For chrome
+ * on pages outside the middleware `matcher` (where `auth()` reports signed
+ * out), read the session live with `getSession()` from
+ * `@zitadel/sdk-next/session` instead.
+ */
+export declare function useAuth(): ClientAuthResult;
+//# sourceMappingURL=useAuth.d.ts.map

package/dist/useAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../src/useAuth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAInD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,OAAO,IAAI,gBAAgB,CAE1C"}

package/dist/useAuth.js

@@ -1,8 +1,19 @@
 "use client";
-import {
-  useAuth
-} from "./chunk-XTCHTAIQ.js";
-import "./chunk-2BFQLJQE.js";
-export {
-  useAuth
-};
+import { useAuthContext } from "./context.js";
+/**
+ * Reads the auth state seeded by {@link NextgenProvider} in a client
+ * component.
+ *
+ * Returns the client-safe {@link ClientAuthResult} (`userId` / `email` /
+ * `name`) — the raw session token is stripped server-side by the provider
+ * and is never available client-side. This is the same shape sdk-nuxt's
+ * `useAuth()` and `getSession()` return.
+ *
+ * The value reflects what the server knew when the page rendered. For chrome
+ * on pages outside the middleware `matcher` (where `auth()` reports signed
+ * out), read the session live with `getSession()` from
+ * `@zitadel/sdk-next/session` instead.
+ */
+export function useAuth() {
+    return useAuthContext();
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zitadel/sdk-next",
-  "version": "0.1.0-alpha.9",
+  "version": "0.1.0",
   "description": "Next.js helpers and mock auth UI for Zitadel",
   "homepage": "https://github.com/zitadel/nextgen/tree/main/packages/sdk-next#readme",
   "bugs": {
@@ -16,6 +16,12 @@
     "dist"
   ],
   "type": "module",
+  "sideEffects": [
+    "./dist/client.js",
+    "./dist/components.js",
+    "./dist/auth.js",
+    "./dist/provider.js"
+  ],
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -29,54 +35,63 @@
       "types": "./dist/client.d.ts",
       "import": "./dist/client.js"
     },
+    "./components": {
+      "types": "./dist/components.d.ts",
+      "import": "./dist/components.js"
+    },
+    "./react": {
+      "types": "./dist/react.d.ts",
+      "import": "./dist/react.js"
+    },
     "./middleware": {
       "types": "./dist/middleware.d.ts",
       "import": "./dist/middleware.js"
+    },
+    "./jsx": {
+      "types": "./dist/jsx.d.ts"
+    },
+    "./session": {
+      "types": "./dist/session.d.ts",
+      "import": "./dist/session.js"
     }
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
+    "@zitadel/api": "0.1.0",
+    "@zitadel/components": "0.1.0",
+    "@zitadel/sdk-core": "0.1.0",
+    "@zitadel/sdk-react": "0.1.0",
     "server-only": "^0.0.1",
-    "@zitadel/api": "0.1.0-alpha.9",
-    "@zitadel/components": "0.1.0-alpha.9",
-    "@zitadel/sdk-core": "0.1.0-alpha.9"
+    "ufo": "^1.6.4"
   },
   "peerDependencies": {
-    "next": ">=14",
+    "next": ">=15.2.3",
     "react": ">=18",
     "react-dom": ">=18"
   },
   "devDependencies": {
-    "@eslint/js": "^9.0.0",
-    "tsup": "^8.3.5",
-    "typescript": "^5.7.3",
-    "@eslint/json": "^0.11.0",
-    "@eslint/markdown": "^6.0.0",
-    "@testing-library/react": "^16.0.0",
-    "@testing-library/user-event": "^14.0.0",
+    "@edge-runtime/vm": "^5.0.0",
+    "@testing-library/react": "^16.3.2",
+    "@testing-library/user-event": "^14.6.1",
+    "@types/node": "^24.19.1",
     "@types/react": "^19.2.14",
-    "eslint": "^9.0.0",
-    "eslint-config-prettier": "^10.0.0",
-    "eslint-import-resolver-typescript": "^3.7.0",
-    "eslint-plugin-import": "^2.31.0",
-    "eslint-plugin-jsx-a11y": "^6.10.0",
-    "eslint-plugin-perfectionist": "^4.0.0",
-    "eslint-plugin-prettier": "^5.0.0",
-    "eslint-plugin-react": "^7.37.0",
-    "eslint-plugin-react-hooks": "^5.0.0",
-    "eslint-plugin-testing-library": "^7.0.0",
-    "jsdom": "^26.0.0",
-    "next": "^16.2.4",
-    "prettier": "^3.0.0",
-    "typescript-eslint": "^8.0.0",
-    "vitest": "^3.0.0"
+    "@types/react-dom": "^19.2.3",
+    "@vitest/coverage-v8": "^4.1.11",
+    "jsdom": "^29.0.2",
+    "next": "^16.3.8",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.11"
   },
   "scripts": {
-    "build": "tsup src/middleware.ts src/auth.ts src/context.tsx src/useAuth.ts src/types.ts src/index.ts src/server.ts src/client.ts --format esm --dts --clean --tsconfig tsconfig.build.json",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run --passWithNoTests",
-    "lint": "eslint ."
+    "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.build.json && node -e \"require('node:fs').copyFileSync('src/jsx.d.ts', 'dist/jsx.d.ts')\"",
+    "typecheck": "tsc --noEmit -p tsconfig.lib.json && tsc --noEmit -p tsconfig.spec.json",
+    "test": "vitest run",
+    "test:all": "pnpm run test",
+    "lint": "biome check .",
+    "build-release": "node ../../scripts/release-clean.mjs local-dist && pnpm run build"
   }
 }