@zitadel/sdk-next 0.1.0-alpha.9 → 1.0.0-alpha.21

package/dist/session.d.ts

@@ -0,0 +1,61 @@
+import type { ClientAuthResult } from "./types.js";
+/** Options for {@link getSession}. */
+export type GetSessionOptions = {
+    /**
+     * Proxy path the scaffolded request boundary forwards to the Zitadel
+     * backend. Defaults to the path from `configureZitadel()` when it has run
+     * on this page, else `"/__nextgen"` (the scaffold default).
+     */
+    proxyPath?: string;
+};
+/**
+ * Reads the current session state from the browser — the supported way for
+ * an app's own UI (header navigation, account menus) to know whether a user
+ * is signed in and who they are.
+ *
+ * Fetches the same-origin `{proxyPath}/sessions/me` with credentials and
+ * `cache: "no-store"` — the same read the `<zitadel-session>` card performs —
+ * so the answer is the server's, not a client-side guess. Works on any page:
+ * unlike server-side `auth()`, it does not require the route to be covered by
+ * the middleware `matcher` (only the proxy path itself must be matched, which
+ * the scaffolded request boundary always does), and it does not require
+ * `configureZitadel()` to have run.
+ *
+ * - `200` with an authenticated user → `{ isAuthenticated: true, session }`
+ *   with the client-safe identity (`userId`, `email`, `name` — no token).
+ * - `200` for an anonymous session, `401` with `auth.unauthorized`, or `404`
+ *   with `sess.not_found` → signed out.
+ * - Any other response throws — including a framework's HTML 404 page from
+ *   a misrouted proxy: a failing proxy is a misconfiguration and must not
+ *   silently render as "signed out". Treat a rejection as "unknown" —
+ *   distinct from signed-out — as the example does.
+ *
+ * ```tsx
+ * "use client";
+ * import { getSession, type ClientAuthResult } from "@zitadel/sdk-next/session";
+ *
+ * export function HeaderNav() {
+ *   // undefined = not yet known — render neutral chrome, not "Sign in".
+ *   const [auth, setAuth] = useState<ClientAuthResult>();
+ *   const [failed, setFailed] = useState(false);
+ *   useEffect(() => {
+ *     getSession().then(setAuth, () => setFailed(true));
+ *   }, []);
+ *   if (failed) return <span role="alert">Session unavailable</span>;
+ *   if (!auth) return null;
+ *   return auth.isAuthenticated
+ *     ? <a href="/profile">{auth.session.display ?? auth.session.identifier ?? "Account"}</a>
+ *     : <a href="/login">Sign in</a>;
+ * }
+ * ```
+ *
+ * The transitions need no extra wiring in the scaffolded posture: sign-in
+ * (`post-sign-in-url`) and sign-out (`post-sign-out-url`) both navigate, so
+ * chrome re-reads on the next page load. To react in place instead, listen
+ * for the widgets' `zitadel-signout` / `zitadel-flow-complete` events.
+ *
+ * @returns The current {@link ClientAuthResult}.
+ */
+export declare function getSession(options?: GetSessionOptions): Promise<ClientAuthResult>;
+export type { ClientAuthResult, ClientAuthState, ClientSession } from "./types.js";
+//# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAKnD,sCAAsC;AACtC,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAsB,UAAU,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA2D3F;AAED,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/session.js

@@ -0,0 +1,116 @@
+import { getZitadelConfig } from "@zitadel/api/config";
+/** Matches the `configureZitadel()` default so zero-config apps agree with the scaffold. */
+const DEFAULT_PROXY_PATH = "/__nextgen";
+/**
+ * Reads the current session state from the browser — the supported way for
+ * an app's own UI (header navigation, account menus) to know whether a user
+ * is signed in and who they are.
+ *
+ * Fetches the same-origin `{proxyPath}/sessions/me` with credentials and
+ * `cache: "no-store"` — the same read the `<zitadel-session>` card performs —
+ * so the answer is the server's, not a client-side guess. Works on any page:
+ * unlike server-side `auth()`, it does not require the route to be covered by
+ * the middleware `matcher` (only the proxy path itself must be matched, which
+ * the scaffolded request boundary always does), and it does not require
+ * `configureZitadel()` to have run.
+ *
+ * - `200` with an authenticated user → `{ isAuthenticated: true, session }`
+ *   with the client-safe identity (`userId`, `email`, `name` — no token).
+ * - `200` for an anonymous session, `401` with `auth.unauthorized`, or `404`
+ *   with `sess.not_found` → signed out.
+ * - Any other response throws — including a framework's HTML 404 page from
+ *   a misrouted proxy: a failing proxy is a misconfiguration and must not
+ *   silently render as "signed out". Treat a rejection as "unknown" —
+ *   distinct from signed-out — as the example does.
+ *
+ * ```tsx
+ * "use client";
+ * import { getSession, type ClientAuthResult } from "@zitadel/sdk-next/session";
+ *
+ * export function HeaderNav() {
+ *   // undefined = not yet known — render neutral chrome, not "Sign in".
+ *   const [auth, setAuth] = useState<ClientAuthResult>();
+ *   const [failed, setFailed] = useState(false);
+ *   useEffect(() => {
+ *     getSession().then(setAuth, () => setFailed(true));
+ *   }, []);
+ *   if (failed) return <span role="alert">Session unavailable</span>;
+ *   if (!auth) return null;
+ *   return auth.isAuthenticated
+ *     ? <a href="/profile">{auth.session.display ?? auth.session.identifier ?? "Account"}</a>
+ *     : <a href="/login">Sign in</a>;
+ * }
+ * ```
+ *
+ * The transitions need no extra wiring in the scaffolded posture: sign-in
+ * (`post-sign-in-url`) and sign-out (`post-sign-out-url`) both navigate, so
+ * chrome re-reads on the next page load. To react in place instead, listen
+ * for the widgets' `zitadel-signout` / `zitadel-flow-complete` events.
+ *
+ * @returns The current {@link ClientAuthResult}.
+ */
+export async function getSession(options = {}) {
+    if (typeof window === "undefined") {
+        throw new Error("[nextgen] getSession() reads the session from the browser. " +
+            "In Server Components and Route Handlers use auth() from @zitadel/sdk-next/server " +
+            "(requires the route to be covered by the middleware matcher).");
+    }
+    // Strip trailing slashes so "/__nextgen/" doesn't produce a double-slash
+    // URL that misses the request-boundary matcher — same normalization the
+    // typed API client applies to its base URL.
+    let proxyPath = options.proxyPath ?? getZitadelConfig()?.proxyPath ?? DEFAULT_PROXY_PATH;
+    while (proxyPath.endsWith("/")) {
+        proxyPath = proxyPath.slice(0, -1);
+    }
+    const response = await fetch(`${proxyPath}/sessions/me`, {
+        cache: "no-store",
+        credentials: "include",
+        headers: { accept: "application/json" },
+    });
+    // Only the backend's canonical error envelope is definitive signed-out.
+    // A framework route, gateway, or WAF can also return 401/404; accepting the
+    // status or content type alone would turn a broken proxy into signed-out.
+    if (response.status === 401 || response.status === 404) {
+        const error = await readErrorEnvelope(response);
+        const isSignedOut = (response.status === 401 && error?.code === "auth.unauthorized") ||
+            (response.status === 404 && error?.code === "sess.not_found");
+        if (isSignedOut) {
+            return { isAuthenticated: false, session: null };
+        }
+    }
+    if (!response.ok) {
+        throw new Error(`[nextgen] Session read failed: HTTP ${response.status} from ${proxyPath}/sessions/me`);
+    }
+    const session = (await response.json());
+    // An anonymous session (no verified user factor yet) has no user_id —
+    // for app chrome that is "not signed in".
+    if (!session.user_id) {
+        return { isAuthenticated: false, session: null };
+    }
+    return {
+        isAuthenticated: true,
+        session: {
+            userId: session.user_id,
+            identifier: session.user?.identifier ?? null,
+            identifierProperty: session.user?.identifier_property ?? null,
+            display: session.user?.display ?? null,
+        },
+    };
+}
+async function readErrorEnvelope(response) {
+    try {
+        const body = (await response.json());
+        if (typeof body === "object" &&
+            body !== null &&
+            "code" in body &&
+            typeof body.code === "string" &&
+            "message" in body &&
+            typeof body.message === "string") {
+            return { code: body.code, message: body.message };
+        }
+    }
+    catch {
+        // The caller reports the HTTP failure below; parsing details are untrusted.
+    }
+    return undefined;
+}

package/dist/types.d.ts

@@ -1,3 +1,8 @@
-export { AuthResult, AuthState, NextgenMiddlewareOptions, NextgenSession, UnauthState } from '@zitadel/sdk-core/types';
-import '@zitadel/components';
-import '@zitadel/api/config';
+/**
+ * Re-exports shared SDK types from `@zitadel/sdk-core`.
+ *
+ * These types are defined once in sdk-core and shared by both sdk-next
+ * and sdk-nuxt.
+ */
+export type { NextgenSession, AuthState, UnauthState, AuthResult, NextgenMiddlewareOptions, ClientSession, ClientAuthState, ClientAuthResult, } from "@zitadel/sdk-core/middleware";
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,YAAY,EACV,cAAc,EACd,SAAS,EACT,WAAW,EACX,UAAU,EACV,wBAAwB,EAGxB,aAAa,EACb,eAAe,EACf,gBAAgB,GACjB,MAAM,8BAA8B,CAAC"}

package/dist/types.js

@@ -1 +1 @@
-import "./chunk-6F4PWJZI.js";
+export {};

package/dist/useAuth.d.ts

@@ -1,5 +1,17 @@
-import { AuthResult } from '@zitadel/sdk-core/types';
-
-declare function useAuth(): AuthResult;
-
-export { useAuth };
+import type { ClientAuthResult } from "./types.js";
+/**
+ * Reads the auth state seeded by {@link NextgenProvider} in a client
+ * component.
+ *
+ * Returns the client-safe {@link ClientAuthResult} (`userId` / `email` /
+ * `name`) — the raw session token is stripped server-side by the provider
+ * and is never available client-side. This is the same shape sdk-nuxt's
+ * `useAuth()` and `getSession()` return.
+ *
+ * The value reflects what the server knew when the page rendered. For chrome
+ * on pages outside the middleware `matcher` (where `auth()` reports signed
+ * out), read the session live with `getSession()` from
+ * `@zitadel/sdk-next/session` instead.
+ */
+export declare function useAuth(): ClientAuthResult;
+//# sourceMappingURL=useAuth.d.ts.map

package/dist/useAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../src/useAuth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAInD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,OAAO,IAAI,gBAAgB,CAE1C"}

package/dist/useAuth.js

@@ -1,8 +1,19 @@
 "use client";
-import {
-  useAuth
-} from "./chunk-XTCHTAIQ.js";
-import "./chunk-2BFQLJQE.js";
-export {
-  useAuth
-};
+import { useAuthContext } from "./context.js";
+/**
+ * Reads the auth state seeded by {@link NextgenProvider} in a client
+ * component.
+ *
+ * Returns the client-safe {@link ClientAuthResult} (`userId` / `email` /
+ * `name`) — the raw session token is stripped server-side by the provider
+ * and is never available client-side. This is the same shape sdk-nuxt's
+ * `useAuth()` and `getSession()` return.
+ *
+ * The value reflects what the server knew when the page rendered. For chrome
+ * on pages outside the middleware `matcher` (where `auth()` reports signed
+ * out), read the session live with `getSession()` from
+ * `@zitadel/sdk-next/session` instead.
+ */
+export function useAuth() {
+    return useAuthContext();
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zitadel/sdk-next",
-  "version": "0.1.0-alpha.9",
+  "version": "1.0.0-alpha.21",
   "description": "Next.js helpers and mock auth UI for Zitadel",
   "homepage": "https://github.com/zitadel/nextgen/tree/main/packages/sdk-next#readme",
   "bugs": {
@@ -16,6 +16,11 @@
     "dist"
   ],
   "type": "module",
+  "sideEffects": [
+    "./dist/client.js",
+    "./dist/auth.js",
+    "./dist/provider.js"
+  ],
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -29,9 +34,20 @@
       "types": "./dist/client.d.ts",
       "import": "./dist/client.js"
     },
+    "./react": {
+      "types": "./dist/react.d.ts",
+      "import": "./dist/react.js"
+    },
     "./middleware": {
       "types": "./dist/middleware.d.ts",
       "import": "./dist/middleware.js"
+    },
+    "./jsx": {
+      "types": "./dist/jsx.d.ts"
+    },
+    "./session": {
+      "types": "./dist/session.d.ts",
+      "import": "./dist/session.js"
     }
   },
   "publishConfig": {
@@ -39,23 +55,21 @@
   },
   "dependencies": {
     "server-only": "^0.0.1",
-    "@zitadel/api": "0.1.0-alpha.9",
-    "@zitadel/components": "0.1.0-alpha.9",
-    "@zitadel/sdk-core": "0.1.0-alpha.9"
+    "@zitadel/sdk-core": "1.0.0-alpha.21",
+    "@zitadel/api": "1.0.0-alpha.21",
+    "@zitadel/components": "1.0.0-alpha.21"
   },
   "peerDependencies": {
-    "next": ">=14",
+    "next": ">=15",
     "react": ">=18",
     "react-dom": ">=18"
   },
   "devDependencies": {
     "@eslint/js": "^9.0.0",
-    "tsup": "^8.3.5",
-    "typescript": "^5.7.3",
     "@eslint/json": "^0.11.0",
     "@eslint/markdown": "^6.0.0",
-    "@testing-library/react": "^16.0.0",
-    "@testing-library/user-event": "^14.0.0",
+    "@testing-library/react": "^16.3.2",
+    "@testing-library/user-event": "^14.6.1",
     "@types/react": "^19.2.14",
     "eslint": "^9.0.0",
     "eslint-config-prettier": "^10.0.0",
@@ -67,15 +81,16 @@
     "eslint-plugin-react": "^7.37.0",
     "eslint-plugin-react-hooks": "^5.0.0",
     "eslint-plugin-testing-library": "^7.0.0",
-    "jsdom": "^26.0.0",
-    "next": "^16.2.4",
+    "jsdom": "^29.0.2",
+    "next": "^16.2.11",
     "prettier": "^3.0.0",
+    "typescript": "^5.7.3",
     "typescript-eslint": "^8.0.0",
     "vitest": "^3.0.0"
   },
   "scripts": {
-    "build": "tsup src/middleware.ts src/auth.ts src/context.tsx src/useAuth.ts src/types.ts src/index.ts src/server.ts src/client.ts --format esm --dts --clean --tsconfig tsconfig.build.json",
-    "typecheck": "tsc --noEmit",
+    "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.build.json && node -e \"require('node:fs').copyFileSync('src/jsx.d.ts', 'dist/jsx.d.ts')\"",
+    "typecheck": "tsc --build tsconfig.json",
     "test": "vitest run --passWithNoTests",
     "lint": "eslint ."
   }

package/dist/chunk-2BFQLJQE.js

@@ -1,27 +0,0 @@
-// src/context.tsx
-import { createContext, useContext } from "react";
-import { jsx } from "react/jsx-runtime";
-var defaultValue = { isAuthenticated: false, session: null };
-var NextgenAuthContext = createContext(defaultValue);
-function NextgenProvider({
-  session,
-  children
-}) {
-  let value;
-  if (!session) {
-    value = { isAuthenticated: false, session: null };
-  } else if ("isAuthenticated" in session) {
-    value = session;
-  } else {
-    value = { isAuthenticated: true, session };
-  }
-  return /* @__PURE__ */ jsx(NextgenAuthContext.Provider, { value, children });
-}
-function useAuthContext() {
-  return useContext(NextgenAuthContext);
-}
-
-export {
-  NextgenProvider,
-  useAuthContext
-};

package/dist/chunk-4KENHIG4.js

@@ -1,222 +0,0 @@
-import {
-  base64UrlDecode,
-  verifyJwt
-} from "./chunk-OCZMYSFX.js";
-
-// src/middleware.ts
-import {
-  HOP_BY_HOP,
-  INTERNAL_HEADERS,
-  filterResponseHeaders,
-  matchesRoutes
-} from "@zitadel/sdk-core/middleware";
-import { NextResponse } from "next/server";
-function tunnelHeaders(req, extra) {
-  const headers = new Headers(req.headers);
-  headers.delete("x-middleware-override-headers");
-  const injectedNames = [];
-  for (const [name, value] of Object.entries(extra)) {
-    headers.set(name, value);
-    headers.set(`x-middleware-request-${name}`, value);
-    injectedNames.push(name);
-  }
-  headers.set("x-middleware-override-headers", injectedNames.join(","));
-  return headers;
-}
-async function nextgenMiddleware(req, options = {}) {
-  const {
-    url = process.env.ZITADEL_URL ?? "http://localhost:8080",
-    proxyPath = "/__nextgen",
-    protectedRoutes = [],
-    ignoredRoutes = [],
-    loginPath = "/login",
-    allowedAlgorithms = ["RS256", "ES256"],
-    clockSkewMs = 5e3,
-    audience,
-    allowedTokenTypes = ["JWT", "at+JWT"],
-    jwksTimeoutMs,
-    proxyTimeoutMs = 5e3,
-    onExchangeResponse
-  } = options;
-  if (!loginPath.startsWith("/") || loginPath.startsWith("//")) {
-    throw new Error(
-      `[nextgen] loginPath must be a relative path starting with a single "/". Received: "${loginPath}". Using an absolute or protocol-relative URL would allow open-redirect attacks.`
-    );
-  }
-  const { pathname } = new URL(req.url);
-  if (matchesRoutes(pathname, ignoredRoutes)) {
-    const headers = tunnelHeaders(req, { "x-nextgen-auth-token": "" });
-    return NextResponse.next({ request: { headers } });
-  }
-  if (pathname === proxyPath || pathname.startsWith(`${proxyPath}/`)) {
-    return proxyRequest(
-      req,
-      url,
-      proxyPath,
-      proxyTimeoutMs,
-      onExchangeResponse
-    );
-  }
-  return handleAuth(req, {
-    url,
-    protectedRoutes,
-    loginPath,
-    allowedAlgorithms,
-    clockSkewMs,
-    audience,
-    allowedTokenTypes,
-    jwksTimeoutMs,
-    pathname
-  });
-}
-var DECODER = new TextDecoder();
-function isJwtShaped(token) {
-  const parts = token.split(".");
-  if (parts.length < 3 || !parts[0]) return false;
-  try {
-    const header = JSON.parse(
-      DECODER.decode(base64UrlDecode(parts[0]))
-    );
-    return typeof header?.alg === "string" && !("enc" in header);
-  } catch {
-    return false;
-  }
-}
-async function validateOpaqueSessionToken(token, issuerUrl, timeoutMs) {
-  try {
-    const res = await fetch(`${issuerUrl}/sessions/me`, {
-      method: "GET",
-      headers: { cookie: `__nextgen_session=${token}` },
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-    return res.ok;
-  } catch {
-    return false;
-  }
-}
-async function proxyRequest(req, authUrl, proxyPath, proxyTimeoutMs, onExchangeResponse) {
-  const url = new URL(req.url);
-  const suffix = url.pathname.slice(proxyPath.length);
-  const target = `${authUrl}${suffix}${url.search}`;
-  const upstreamHeaders = new Headers();
-  for (const [key, value] of req.headers.entries()) {
-    const lower = key.toLowerCase();
-    if (!HOP_BY_HOP.has(lower) && !INTERNAL_HEADERS.has(lower)) {
-      upstreamHeaders.set(key, value);
-    }
-  }
-  const directIp = req.ip ?? req.headers.get("x-real-ip");
-  if (directIp) {
-    const existingXff = upstreamHeaders.get("x-forwarded-for");
-    upstreamHeaders.set(
-      "x-forwarded-for",
-      existingXff ? `${existingXff}, ${directIp}` : directIp
-    );
-  }
-  if (!upstreamHeaders.has("x-forwarded-host")) {
-    upstreamHeaders.set("x-forwarded-host", url.host);
-  }
-  if (!upstreamHeaders.has("x-forwarded-proto")) {
-    upstreamHeaders.set("x-forwarded-proto", url.protocol.replace(":", ""));
-  }
-  const hasBody = !["GET", "HEAD"].includes(req.method);
-  const isExchangeRequest = req.method === "POST" && suffix.startsWith("/sessions/exchange");
-  if (isExchangeRequest && !upstreamHeaders.has("authorization")) {
-    const projectId = url.searchParams.get("project_id");
-    if (projectId) {
-      upstreamHeaders.set("authorization", `Bearer sk_${projectId}`);
-    }
-  }
-  const bodyBuffer = hasBody ? await req.arrayBuffer() : void 0;
-  const upstream = await fetch(target, {
-    method: req.method,
-    headers: upstreamHeaders,
-    body: bodyBuffer,
-    redirect: "manual",
-    signal: AbortSignal.timeout(proxyTimeoutMs)
-  });
-  const responseHeaders = filterResponseHeaders(upstream.headers);
-  const setCookies = upstream.headers.getSetCookie?.() ?? [];
-  for (const cookie of setCookies) {
-    responseHeaders.append("set-cookie", cookie);
-  }
-  let response = new Response(upstream.body, {
-    status: upstream.status,
-    headers: responseHeaders
-  });
-  if (isExchangeRequest && onExchangeResponse) {
-    response = await onExchangeResponse(response);
-  }
-  return response;
-}
-async function handleAuth(req, opts) {
-  const {
-    url,
-    protectedRoutes,
-    loginPath,
-    allowedAlgorithms,
-    clockSkewMs,
-    audience,
-    allowedTokenTypes,
-    jwksTimeoutMs,
-    pathname
-  } = opts;
-  const authHeader = req.headers.get("authorization");
-  const bearerToken = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
-  const cookieToken = req.cookies.get("__nextgen_session")?.value ?? null;
-  const token = bearerToken ?? cookieToken;
-  const payload = token ? await verifyJwt(token, {
-    issuerUrl: url,
-    allowedAlgorithms,
-    clockSkewMs,
-    audience,
-    allowedTokenTypes,
-    jwksTimeoutMs
-  }) : null;
-  if (payload && token && payload.sub) {
-    const tunnelled2 = tunnelHeaders(req, { "x-nextgen-auth-token": token });
-    return NextResponse.next({ request: { headers: tunnelled2 } });
-  }
-  if (!payload && cookieToken && !isJwtShaped(cookieToken)) {
-    const isValid = await validateOpaqueSessionToken(
-      cookieToken,
-      url,
-      jwksTimeoutMs ?? 5e3
-    );
-    if (isValid) {
-      const tunnelled2 = tunnelHeaders(req, {
-        "x-nextgen-auth-token": cookieToken
-      });
-      return NextResponse.next({ request: { headers: tunnelled2 } });
-    }
-  }
-  const tunnelled = tunnelHeaders(req, { "x-nextgen-auth-token": "" });
-  const staleNextgenCookies = req.cookies.getAll().filter((c) => c.name.startsWith("__nextgen"));
-  if (matchesRoutes(pathname, protectedRoutes)) {
-    const loginUrl = new URL(loginPath, req.url);
-    loginUrl.searchParams.set("next", pathname);
-    const redirect = NextResponse.redirect(loginUrl, { status: 302 });
-    for (const cookie of staleNextgenCookies) {
-      redirect.cookies.delete(cookie.name);
-    }
-    return redirect;
-  }
-  const response = NextResponse.next({ request: { headers: tunnelled } });
-  for (const cookie of staleNextgenCookies) {
-    response.cookies.delete(cookie.name);
-  }
-  return response;
-}
-function createProxy(config, options = {}) {
-  const mergedOptions = {
-    ...options,
-    proxyPath: config.proxyPath,
-    url: config.url
-  };
-  return (req) => nextgenMiddleware(req, mergedOptions);
-}
-
-export {
-  nextgenMiddleware,
-  createProxy
-};

package/dist/chunk-B7S6XMT3.js

@@ -1,41 +0,0 @@
-import {
-  decodeJwt
-} from "./chunk-OCZMYSFX.js";
-
-// src/auth.ts
-import { headers } from "next/headers";
-async function auth() {
-  const headerStore = await headers();
-  const token = headerStore.get("x-nextgen-auth-token");
-  if (!token) {
-    return { isAuthenticated: false, session: null };
-  }
-  try {
-    const { payload } = decodeJwt(token);
-    if (payload.sub) {
-      return {
-        isAuthenticated: true,
-        session: {
-          userId: payload.sub,
-          email: payload.email ?? null,
-          name: payload.name ?? null,
-          token
-        }
-      };
-    }
-  } catch {
-  }
-  return {
-    isAuthenticated: true,
-    session: {
-      userId: "unknown",
-      email: null,
-      name: null,
-      token
-    }
-  };
-}
-
-export {
-  auth
-};

package/dist/chunk-OCZMYSFX.js

@@ -1,13 +0,0 @@
-// src/lib/jwt.ts
-import {
-  JWKS_TTL_MS,
-  base64UrlDecode,
-  decodeJwt,
-  verifyJwt
-} from "@zitadel/sdk-core/jwt";
-
-export {
-  base64UrlDecode,
-  decodeJwt,
-  verifyJwt
-};

package/dist/chunk-XTCHTAIQ.js

@@ -1,12 +0,0 @@
-import {
-  useAuthContext
-} from "./chunk-2BFQLJQE.js";
-
-// src/useAuth.ts
-function useAuth() {
-  return useAuthContext();
-}
-
-export {
-  useAuth
-};