@zitadel/sdk-next 0.1.0-alpha.9 → 1.0.0-alpha.21

package/dist/index.js

@@ -1,24 +1,13 @@
-import {
-  createProxy,
-  nextgenMiddleware
-} from "./chunk-4KENHIG4.js";
-import {
-  auth
-} from "./chunk-B7S6XMT3.js";
-import "./chunk-OCZMYSFX.js";
-import "./chunk-6F4PWJZI.js";
-import {
-  useAuth
-} from "./chunk-XTCHTAIQ.js";
-import {
-  NextgenProvider,
-  useAuthContext
-} from "./chunk-2BFQLJQE.js";
-export {
-  NextgenProvider,
-  auth,
-  createProxy,
-  nextgenMiddleware,
-  useAuth,
-  useAuthContext
-};
+/**
+ * Package root — for **Server Components and server modules only**: it
+ * includes the server-only `auth()`, so importing it from a `"use client"`
+ * module fails at build time. Client components import from
+ * `@zitadel/sdk-next/react` (provider + hooks) or
+ * `@zitadel/sdk-next/session` (`getSession()`) instead.
+ */
+export * from "./types.js";
+export { nextgenMiddleware, createProxy } from "./middleware.js";
+export { auth } from "./auth.js";
+export { NextgenProvider } from "./provider.js";
+export { AuthContextProvider, useAuthContext } from "./context.js";
+export { useAuth } from "./useAuth.js";

package/dist/jsx.d.ts

@@ -0,0 +1,5 @@
+// Types-only shim: scaffolded apps depend on @zitadel/sdk-next, not
+// @zitadel/components, so the React JSX declarations for the <zitadel-*>
+// elements are re-exposed here as `@zitadel/sdk-next/jsx`. Copied verbatim
+// into dist/ by the build script.
+/// <reference types="@zitadel/components/jsx" />

package/dist/lib/jwt.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Re-exports shared JWT verification from `@zitadel/sdk-core`.
+ *
+ * The JWT module is runtime-agnostic (uses `atob` which is available in both
+ * Edge and Node.js 16+) and is defined once in sdk-core.
+ */
+export { JWKS_TTL_MS, base64UrlDecode, decodeJwt, isJwtShaped, verifyJwt, } from "@zitadel/sdk-core/jwt";
+export type { JwtPayload, JwtHeader, DecodedJwt, VerifyJwtOptions } from "@zitadel/sdk-core/jwt";
+//# sourceMappingURL=jwt.d.ts.map

package/dist/lib/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/lib/jwt.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,WAAW,EACX,eAAe,EACf,SAAS,EACT,WAAW,EACX,SAAS,GACV,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/lib/jwt.js

@@ -0,0 +1,7 @@
+/**
+ * Re-exports shared JWT verification from `@zitadel/sdk-core`.
+ *
+ * The JWT module is runtime-agnostic (uses `atob` which is available in both
+ * Edge and Node.js 16+) and is defined once in sdk-core.
+ */
+export { JWKS_TTL_MS, base64UrlDecode, decodeJwt, isJwtShaped, verifyJwt, } from "@zitadel/sdk-core/jwt";

package/dist/middleware.d.ts

@@ -1,7 +1,7 @@
-import { ZitadelProject } from '@zitadel/api/config';
-import { NextgenMiddlewareOptions } from '@zitadel/sdk-core/types';
-import { NextRequest, NextResponse } from 'next/server';
-
+import type { ZitadelProject } from "@zitadel/api/config";
+import type { NextgenMiddlewareOptions } from "@zitadel/sdk-core/middleware";
+import type { NextRequest } from "next/server";
+import { NextResponse } from "next/server";
 /**
  * Next.js Edge middleware that handles proxying, JWT verification, and route
  * protection in a single pass.
@@ -29,7 +29,7 @@ import { NextRequest, NextResponse } from 'next/server';
  * @param options - Middleware configuration options.
  * @returns A `NextResponse` or `Response` to continue, redirect, or proxy.
  */
-declare function nextgenMiddleware(req: NextRequest, options?: NextgenMiddlewareOptions): Promise<NextResponse | Response>;
+export declare function nextgenMiddleware(req: NextRequest, options?: NextgenMiddlewareOptions): Promise<NextResponse | Response>;
 /**
  * Options for {@link createProxy} that are separate from the shared
  * {@link ZitadelConfig}. These configure route protection, login
@@ -38,11 +38,11 @@ declare function nextgenMiddleware(req: NextRequest, options?: NextgenMiddleware
  * `proxyPath` and `url` are omitted because they come from the
  * {@link ZitadelConfig} passed as the first argument.
  */
-type ProxyOptions = Omit<NextgenMiddlewareOptions, 'proxyPath' | 'url'>;
+export type ProxyOptions = Omit<NextgenMiddlewareOptions, "proxyPath" | "url">;
 /**
  * A pre-configured middleware handler returned by {@link createProxy}.
  */
-type ProxyHandler = (req: NextRequest) => Promise<NextResponse | Response>;
+export type ProxyHandler = (req: NextRequest) => Promise<NextResponse | Response>;
 /**
  * Creates a pre-configured middleware handler from the SDK config
  * returned by `configureZitadel()`. This is the derived-service
@@ -75,6 +75,5 @@ type ProxyHandler = (req: NextRequest) => Promise<NextResponse | Response>;
  * @param options - Route protection and JWT options.
  * @returns A middleware handler function.
  */
-declare function createProxy(config: ZitadelProject, options?: ProxyOptions): ProxyHandler;
-
-export { type ProxyHandler, type ProxyOptions, createProxy, nextgenMiddleware };
+export declare function createProxy(config: ZitadelProject, options?: ProxyOptions): ProxyHandler;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAQ/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAmC3C;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,WAAW,EAChB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC,CAqDlC;AAqPD;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,wBAAwB,EAAE,WAAW,GAAG,KAAK,CAAC,CAAC;AAE/E;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,GAAE,YAAiB,GAAG,YAAY,CAO5F"}

package/dist/middleware.js

@@ -1,9 +1,294 @@
-import {
-  createProxy,
-  nextgenMiddleware
-} from "./chunk-4KENHIG4.js";
-import "./chunk-OCZMYSFX.js";
-export {
-  createProxy,
-  nextgenMiddleware
-};
+import { HOP_BY_HOP, INTERNAL_HEADERS, filterResponseHeaders, matchesRoutes, } from "@zitadel/sdk-core/middleware";
+import { NextResponse } from "next/server";
+import { verifyJwt, isJwtShaped } from "./lib/jwt.js";
+/**
+ * Clones the incoming request headers, injects `extra` key/value pairs,
+ * and registers them with the Next.js header-tunnelling mechanism so that
+ * server components can read them via `headers()`.
+ *
+ * @param req   - The incoming edge request.
+ * @param extra - Additional headers to inject (e.g. `x-nextgen-auth-token`).
+ * @returns A new `Headers` instance with the injected values registered.
+ */
+function tunnelHeaders(req, extra) {
+    const headers = new Headers(req.headers);
+    // Security: strip any x-middleware-override-headers the client may have sent.
+    // Preserving the client value would allow an attacker to inject arbitrary
+    // header names into the Next.js override list, potentially bypassing the
+    // internal header-tunnelling safety checks. We always build this header from
+    // scratch using only the names we inject ourselves.
+    headers.delete("x-middleware-override-headers");
+    const injectedNames = [];
+    for (const [name, value] of Object.entries(extra)) {
+        headers.set(name, value);
+        headers.set(`x-middleware-request-${name}`, value);
+        injectedNames.push(name);
+    }
+    headers.set("x-middleware-override-headers", injectedNames.join(","));
+    return headers;
+}
+/**
+ * Next.js Edge middleware that handles proxying, JWT verification, and route
+ * protection in a single pass.
+ *
+ * Place this in your `middleware.ts` file:
+ *
+ * ```ts
+ * import { nextgenMiddleware } from "@zitadel/sdk-next/middleware";
+ * import type { NextRequest } from "next/server";
+ *
+ * export function middleware(req: NextRequest) {
+ *   return nextgenMiddleware(req, {
+ *     url: process.env.ZITADEL_URL,
+ *     protectedRoutes: ["/profile"],
+ *     loginPath: "/login",
+ *   });
+ * }
+ *
+ * export const config = {
+ *   matcher: ["/__nextgen/:path*", "/profile/:path*"],
+ * };
+ * ```
+ *
+ * @param req     - The incoming Next.js edge request.
+ * @param options - Middleware configuration options.
+ * @returns A `NextResponse` or `Response` to continue, redirect, or proxy.
+ */
+export async function nextgenMiddleware(req, options = {}) {
+    const { url = process.env.ZITADEL_URL ?? "http://localhost:8080", proxyPath = "/__nextgen", protectedRoutes = [], ignoredRoutes = [], loginPath = "/login", allowedAlgorithms = ["RS256", "ES256"], clockSkewMs = 5000, audience, allowedTokenTypes = ["JWT", "at+JWT"], jwksTimeoutMs, proxyTimeoutMs = 5000, opaqueTokenTimeoutMs = 5000, } = options;
+    // Guard against open-redirect: loginPath must be a relative path. An absolute
+    // URL (e.g. "https://evil.com/phish") or a protocol-relative URL
+    // (e.g. "//evil.com") would redirect the browser to an external host.
+    if (!loginPath.startsWith("/") || loginPath.startsWith("//")) {
+        throw new Error(`[nextgen] loginPath must be a relative path starting with a single "/". ` +
+            `Received: "${loginPath}". Using an absolute or protocol-relative URL ` +
+            `would allow open-redirect attacks.`);
+    }
+    const { pathname } = new URL(req.url);
+    if (matchesRoutes(pathname, ignoredRoutes)) {
+        // Neutralise any client-supplied x-nextgen-auth-token on ignored routes.
+        // handleAuth is skipped for ignored routes, so we must strip the header
+        // here to prevent a forged value from reaching server components.
+        const headers = tunnelHeaders(req, { "x-nextgen-auth-token": "" });
+        return NextResponse.next({ request: { headers } });
+    }
+    if (pathname === proxyPath || pathname.startsWith(`${proxyPath}/`)) {
+        return proxyRequest(req, url, proxyPath, proxyTimeoutMs);
+    }
+    return handleAuth(req, {
+        url,
+        protectedRoutes,
+        loginPath,
+        allowedAlgorithms,
+        clockSkewMs,
+        audience,
+        allowedTokenTypes,
+        jwksTimeoutMs,
+        opaqueTokenTimeoutMs,
+        pathname,
+    });
+}
+/**
+ * Validates an opaque (non-JWT) session token by calling the backend's
+ * `/sessions/me` endpoint. Returns `true` when the backend confirms the
+ * session is live (HTTP 200), `false` otherwise.
+ *
+ * This is the fallback path for backends that issue encrypted opaque tokens
+ * rather than self-contained JWTs.
+ */
+async function validateOpaqueSessionToken(token, issuerUrl, timeoutMs) {
+    try {
+        const res = await fetch(`${issuerUrl}/sessions/me`, {
+            method: "GET",
+            headers: { cookie: `__nextgen_session=${token}` },
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Forwards a `/__nextgen/*` request to the upstream auth backend and streams
+ * the response back verbatim, stripping hop-by-hop headers in both directions.
+ *
+ * All non-hop-by-hop headers from the incoming request are forwarded, including
+ * any `X-Forwarded-For` chain already set by an upstream CDN or load balancer.
+ * When `X-Forwarded-For` is absent (direct connection with no upstream proxy),
+ * it is initialised from the runtime-provided client IP so the auth server
+ * always receives origin information. `X-Forwarded-Host` and `X-Forwarded-Proto`
+ * are set only when absent, preserving values injected by an upstream CDN.
+ *
+ * @param req        - The incoming edge request.
+ * @param authUrl    - Base URL of the auth backend.
+ * @param proxyPath  - The path prefix being proxied (e.g. `"/__nextgen"`).
+ * @returns The proxied upstream `Response`.
+ */
+async function proxyRequest(req, authUrl, proxyPath, proxyTimeoutMs) {
+    const url = new URL(req.url);
+    const suffix = url.pathname.slice(proxyPath.length);
+    const target = `${authUrl}${suffix}${url.search}`;
+    const upstreamHeaders = new Headers();
+    for (const [key, value] of req.headers.entries()) {
+        const lower = key.toLowerCase();
+        if (!HOP_BY_HOP.has(lower) && !INTERNAL_HEADERS.has(lower)) {
+            upstreamHeaders.set(key, value);
+        }
+    }
+    // Always append the direct client IP to the X-Forwarded-For chain so the
+    // upstream auth server sees the full proxy path. We never skip this even when
+    // a chain is already present — a CDN or load balancer may have set XFF before
+    // the request reached this edge node, and our hop must still be recorded.
+    const directIp = req.ip ?? req.headers.get("x-real-ip");
+    if (directIp) {
+        const existingXff = upstreamHeaders.get("x-forwarded-for");
+        upstreamHeaders.set("x-forwarded-for", existingXff ? `${existingXff}, ${directIp}` : directIp);
+    }
+    if (!upstreamHeaders.has("x-forwarded-host")) {
+        upstreamHeaders.set("x-forwarded-host", url.host);
+    }
+    if (!upstreamHeaders.has("x-forwarded-proto")) {
+        upstreamHeaders.set("x-forwarded-proto", url.protocol.replace(":", ""));
+    }
+    const hasBody = !["GET", "HEAD"].includes(req.method);
+    // ADR 036: the current browser flow needs the confidential project secret
+    // only for the handoff exchange. Stamping it onto every proxied operation
+    // turns this public request boundary into an operator-capable open relay.
+    // Preserve an explicit caller credential so the exchange can use the future
+    // publishable-key plane without being overwritten.
+    if (requiresProjectSecret(req.method, suffix) && !upstreamHeaders.has("authorization")) {
+        const secret = process.env.ZITADEL_PROJECT_SECRET;
+        if (secret) {
+            upstreamHeaders.set("authorization", `Bearer ${secret}`);
+        }
+    }
+    // Read body eagerly so undici receives a concrete buffer rather than a
+    // WinterCG ReadableStream, which is incompatible with Node.js fetch body
+    // extraction.
+    const bodyBuffer = hasBody ? await req.arrayBuffer() : undefined;
+    const upstream = await fetch(target, {
+        method: req.method,
+        headers: upstreamHeaders,
+        body: bodyBuffer,
+        redirect: "manual",
+        signal: AbortSignal.timeout(proxyTimeoutMs),
+    });
+    const responseHeaders = filterResponseHeaders(upstream.headers);
+    const setCookies = upstream.headers.getSetCookie?.() ?? [];
+    for (const cookie of setCookies) {
+        responseHeaders.append("set-cookie", cookie);
+    }
+    return new Response(upstream.body, {
+        status: upstream.status,
+        headers: responseHeaders,
+    });
+}
+function requiresProjectSecret(method, pathname) {
+    return method.toUpperCase() === "POST" && pathname === "/sessions/exchange";
+}
+/**
+ * Verifies the session token and tunnels the result to server components via
+ * a request header. Redirects to the login page when the token is absent or
+ * invalid on a protected route.
+ *
+ * @param req  - The incoming edge request.
+ * @param opts - Auth handler options.
+ * @returns A `NextResponse` to continue or redirect.
+ */
+async function handleAuth(req, opts) {
+    const { url, protectedRoutes, loginPath, allowedAlgorithms, clockSkewMs, audience, allowedTokenTypes, jwksTimeoutMs, opaqueTokenTimeoutMs, pathname, } = opts;
+    const authHeader = req.headers.get("authorization");
+    const bearerToken = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
+    const cookieToken = req.cookies.get("__nextgen_session")?.value ?? null;
+    // Bearer token takes explicit precedence over the session cookie. API clients
+    // (e.g. mobile apps, CLIs) use Authorization headers while browsers use
+    // cookies; when both are present the caller clearly intended the Bearer token.
+    const token = bearerToken ?? cookieToken;
+    const payload = token
+        ? await verifyJwt(token, {
+            issuerUrl: url,
+            allowedAlgorithms,
+            clockSkewMs,
+            audience,
+            allowedTokenTypes,
+            jwksTimeoutMs,
+        })
+        : null;
+    if (payload && token && payload.sub) {
+        const tunnelled = tunnelHeaders(req, { "x-nextgen-auth-token": token });
+        return NextResponse.next({ request: { headers: tunnelled } });
+    }
+    // The backend issues opaque encrypted session tokens rather than JWTs.
+    // Only fall back to /sessions/me validation when the token is definitively
+    // not a JWT (non-JSON segments). A token with a valid JWT structure that
+    // failed verification (bad sig, wrong typ/alg) must be rejected — never
+    // accepted by a backend call that doesn't re-check the JWT claims.
+    if (!payload && cookieToken && !isJwtShaped(cookieToken)) {
+        const isValid = await validateOpaqueSessionToken(cookieToken, url, opaqueTokenTimeoutMs);
+        if (isValid) {
+            const tunnelled = tunnelHeaders(req, {
+                "x-nextgen-auth-token": cookieToken,
+            });
+            return NextResponse.next({ request: { headers: tunnelled } });
+        }
+    }
+    const tunnelled = tunnelHeaders(req, { "x-nextgen-auth-token": "" });
+    const staleNextgenCookies = req.cookies
+        .getAll()
+        .filter((c) => c.name.startsWith("__nextgen"));
+    if (matchesRoutes(pathname, protectedRoutes)) {
+        const loginUrl = new URL(loginPath, req.url);
+        loginUrl.searchParams.set("next", pathname);
+        const redirect = NextResponse.redirect(loginUrl, { status: 302 });
+        for (const cookie of staleNextgenCookies) {
+            redirect.cookies.delete(cookie.name);
+        }
+        return redirect;
+    }
+    const response = NextResponse.next({ request: { headers: tunnelled } });
+    for (const cookie of staleNextgenCookies) {
+        response.cookies.delete(cookie.name);
+    }
+    return response;
+}
+/**
+ * Creates a pre-configured middleware handler from the SDK config
+ * returned by `configureZitadel()`. This is the derived-service
+ * derived service pattern:
+ *
+ * ```ts
+ * // src/zitadel.ts
+ * import { configureZitadel } from "@zitadel/api/config";
+ * import { createProxy } from "@zitadel/sdk-next/middleware";
+ *
+ * const zitadel = configureZitadel({
+ *   projectId: "demo",
+ *   url: process.env.ZITADEL_URL,
+ * });
+ *
+ * export const proxy = createProxy(zitadel, {
+ *   protectedRoutes: ["/admin*"],
+ *   loginPath: "/login",
+ * });
+ * ```
+ *
+ * Then in middleware.ts:
+ *
+ * ```ts
+ * import { proxy } from "./zitadel";
+ * export const middleware = proxy;
+ * ```
+ *
+ * @param config  - The SDK handle from `configureZitadel()`.
+ * @param options - Route protection and JWT options.
+ * @returns A middleware handler function.
+ */
+export function createProxy(config, options = {}) {
+    const mergedOptions = {
+        ...options,
+        proxyPath: config.proxyPath,
+        url: config.url,
+    };
+    return (req) => nextgenMiddleware(req, mergedOptions);
+}

package/dist/provider.d.ts

@@ -0,0 +1,52 @@
+import "server-only";
+import type { ReactNode } from "react";
+import type { AuthResult, ClientAuthResult, ClientSession, NextgenSession } from "./types.js";
+/**
+ * Seeds client components (the `useAuth()` hook) with the server-known auth
+ * state. Render it in a Server Component — typically the root layout — and
+ * pass the `auth()` result directly:
+ *
+ * ```tsx
+ * import { auth, NextgenProvider } from "@zitadel/sdk-next/server";
+ *
+ * export default async function RootLayout({ children }) {
+ *   const session = await auth();
+ *   return (
+ *     <html>
+ *       <body>
+ *         <NextgenProvider session={session}>{children}</NextgenProvider>
+ *       </body>
+ *     </html>
+ *   );
+ * }
+ * ```
+ *
+ * Executed in a Server Component, it converts the input to the client-safe
+ * {@link ClientAuthResult} — dropping the raw session token — and only the
+ * stripped value is serialised across the server→client boundary. Passing the
+ * full `auth()` result straight into a `"use client"` component would embed
+ * the raw token in the RSC flight payload, readable by any script running on
+ * the page. (sdk-nuxt strips the token before seeding client state for the
+ * same reason.)
+ *
+ * This module is **server-only, on purpose**. The strip only protects the
+ * boundary when it runs on the server: if this component could be imported
+ * into a `"use client"` wrapper (the common `providers.tsx` pattern), the
+ * *wrapper* would become the boundary and its still-unstripped `session`
+ * prop — token included — would serialise into the flight payload before
+ * this code ever ran. The `server-only` import turns that wrapper into a
+ * build error instead of a silent leak. For a client-seeded tree (e.g. state
+ * from `getSession()`), use `AuthContextProvider` from
+ * `@zitadel/sdk-next/react`, which only accepts the token-less
+ * {@link ClientAuthResult}.
+ *
+ * Client components therefore only ever see `userId` / `email` / `name`. When
+ * the raw token is needed server-side (e.g. to call an upstream API), read it
+ * from `auth()` in a Server Component or Route Handler — never through this
+ * provider.
+ */
+export declare function NextgenProvider({ session, children, }: {
+    session: AuthResult | ClientAuthResult | ClientSession | NextgenSession | null;
+    children: ReactNode;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=provider.d.ts.map

package/dist/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.tsx"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC,OAAO,KAAK,EACV,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,cAAc,EAEf,MAAM,YAAY,CAAC;AAmBpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,wBAAgB,eAAe,CAAC,EAC9B,OAAO,EACP,QAAQ,GACT,EAAE;IACD,OAAO,EAAE,UAAU,GAAG,gBAAgB,GAAG,aAAa,GAAG,cAAc,GAAG,IAAI,CAAC;IAC/E,QAAQ,EAAE,SAAS,CAAC;CACrB,2CAaA"}

package/dist/provider.js

@@ -0,0 +1,75 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import "server-only";
+import { AuthContextProvider } from "./context.js";
+const signedOut = { isAuthenticated: false, session: null };
+/**
+ * Explicit field pick — never a spread. The raw session token (and any future
+ * server-only field) must not survive the conversion to the client shape.
+ */
+function toClientSession(session) {
+    return {
+        userId: session.userId,
+        identifier: session.identifier,
+        identifierProperty: session.identifierProperty,
+        display: session.display,
+    };
+}
+/**
+ * Seeds client components (the `useAuth()` hook) with the server-known auth
+ * state. Render it in a Server Component — typically the root layout — and
+ * pass the `auth()` result directly:
+ *
+ * ```tsx
+ * import { auth, NextgenProvider } from "@zitadel/sdk-next/server";
+ *
+ * export default async function RootLayout({ children }) {
+ *   const session = await auth();
+ *   return (
+ *     <html>
+ *       <body>
+ *         <NextgenProvider session={session}>{children}</NextgenProvider>
+ *       </body>
+ *     </html>
+ *   );
+ * }
+ * ```
+ *
+ * Executed in a Server Component, it converts the input to the client-safe
+ * {@link ClientAuthResult} — dropping the raw session token — and only the
+ * stripped value is serialised across the server→client boundary. Passing the
+ * full `auth()` result straight into a `"use client"` component would embed
+ * the raw token in the RSC flight payload, readable by any script running on
+ * the page. (sdk-nuxt strips the token before seeding client state for the
+ * same reason.)
+ *
+ * This module is **server-only, on purpose**. The strip only protects the
+ * boundary when it runs on the server: if this component could be imported
+ * into a `"use client"` wrapper (the common `providers.tsx` pattern), the
+ * *wrapper* would become the boundary and its still-unstripped `session`
+ * prop — token included — would serialise into the flight payload before
+ * this code ever ran. The `server-only` import turns that wrapper into a
+ * build error instead of a silent leak. For a client-seeded tree (e.g. state
+ * from `getSession()`), use `AuthContextProvider` from
+ * `@zitadel/sdk-next/react`, which only accepts the token-less
+ * {@link ClientAuthResult}.
+ *
+ * Client components therefore only ever see `userId` / `email` / `name`. When
+ * the raw token is needed server-side (e.g. to call an upstream API), read it
+ * from `auth()` in a Server Component or Route Handler — never through this
+ * provider.
+ */
+export function NextgenProvider({ session, children, }) {
+    let value;
+    if (!session) {
+        value = signedOut;
+    }
+    else if ("isAuthenticated" in session) {
+        value = session.isAuthenticated
+            ? { isAuthenticated: true, session: toClientSession(session.session) }
+            : signedOut;
+    }
+    else {
+        value = { isAuthenticated: true, session: toClientSession(session) };
+    }
+    return _jsx(AuthContextProvider, { value: value, children: children });
+}

package/dist/react.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Client-safe React bindings for `@zitadel/sdk-next`.
+ *
+ * This is the entry point for `"use client"` components. It pulls in no
+ * server-only modules (`next/headers`, `auth()`, `NextgenProvider`), so it is
+ * safe to import anywhere.
+ *
+ * ```tsx
+ * "use client";
+ * import { useAuth } from "@zitadel/sdk-next/react";
+ * ```
+ *
+ * `NextgenProvider` is deliberately **not** exported here: it accepts the
+ * token-bearing `auth()` result, so it must execute in a Server Component —
+ * wrapping it in a `"use client"` file would serialise the raw token across
+ * the boundary before the provider strips it. Import it from
+ * `@zitadel/sdk-next/server` (or the package root) instead; the `server-only`
+ * guard turns a client-side import into a build error. To seed the context
+ * from client-side state (e.g. a `getSession()` read), render
+ * {@link AuthContextProvider}, which only accepts the token-less
+ * `ClientAuthResult`.
+ */
+export { AuthContextProvider, useAuthContext } from "./context.js";
+export { useAuth } from "./useAuth.js";
+export type { AuthResult, AuthState, ClientAuthResult, ClientAuthState, ClientSession, NextgenSession, UnauthState, } from "./types.js";
+//# sourceMappingURL=react.d.ts.map

package/dist/react.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,YAAY,EACV,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,cAAc,EACd,WAAW,GACZ,MAAM,YAAY,CAAC"}

package/dist/react.js

@@ -0,0 +1,24 @@
+/**
+ * Client-safe React bindings for `@zitadel/sdk-next`.
+ *
+ * This is the entry point for `"use client"` components. It pulls in no
+ * server-only modules (`next/headers`, `auth()`, `NextgenProvider`), so it is
+ * safe to import anywhere.
+ *
+ * ```tsx
+ * "use client";
+ * import { useAuth } from "@zitadel/sdk-next/react";
+ * ```
+ *
+ * `NextgenProvider` is deliberately **not** exported here: it accepts the
+ * token-bearing `auth()` result, so it must execute in a Server Component —
+ * wrapping it in a `"use client"` file would serialise the raw token across
+ * the boundary before the provider strips it. Import it from
+ * `@zitadel/sdk-next/server` (or the package root) instead; the `server-only`
+ * guard turns a client-side import into a build error. To seed the context
+ * from client-side state (e.g. a `getSession()` read), render
+ * {@link AuthContextProvider}, which only accepts the token-less
+ * `ClientAuthResult`.
+ */
+export { AuthContextProvider, useAuthContext } from "./context.js";
+export { useAuth } from "./useAuth.js";

package/dist/server.d.ts

@@ -1,2 +1,12 @@
-export { auth } from './auth.js';
-import '@zitadel/sdk-core/types';
+/**
+ * Server-side surface of `@zitadel/sdk-next`: everything here is guarded by
+ * `server-only` and fails the build if pulled into a `"use client"` graph.
+ *
+ * ```tsx
+ * import { auth, NextgenProvider } from "@zitadel/sdk-next/server";
+ * ```
+ */
+export { auth } from "./auth.js";
+export type { AuthOptions } from "./auth.js";
+export { NextgenProvider } from "./provider.js";
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC"}

package/dist/server.js

@@ -1,7 +1,10 @@
-import {
-  auth
-} from "./chunk-B7S6XMT3.js";
-import "./chunk-OCZMYSFX.js";
-export {
-  auth
-};
+/**
+ * Server-side surface of `@zitadel/sdk-next`: everything here is guarded by
+ * `server-only` and fails the build if pulled into a `"use client"` graph.
+ *
+ * ```tsx
+ * import { auth, NextgenProvider } from "@zitadel/sdk-next/server";
+ * ```
+ */
+export { auth } from "./auth.js";
+export { NextgenProvider } from "./provider.js";