@zitadel/sdk-nuxt 0.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ZITADEL
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,146 @@
+# @zitadel/sdk-nuxt
+
+Nuxt middleware and helpers for Nextgen Auth.
+
+## Installation
+
+```bash
+pnpm add @zitadel/sdk-nuxt
+```
+
+## Setup
+
+### 1. Server middleware
+
+Create `server/middleware/auth.ts`:
+
+```ts
+import { createNextgenMiddleware } from '@zitadel/sdk-nuxt/server';
+
+const { nextgen } = useRuntimeConfig();
+
+export default createNextgenMiddleware({
+  url: nextgen.url,
+  protectedRoutes: ['/admin', '/dashboard*'],
+  loginPath: '/login',
+});
+```
+
+The middleware runs on every request and does three things in one pass:
+
+1. **Proxies** `/__nextgen/*` requests to the auth backend
+2. **Verifies** the session JWT via JWKS using the Web Crypto API
+3. **Redirects** unauthenticated requests to `loginPath` for protected routes
+
+Add the issuer URL to `nuxt.config.ts`:
+
+```ts
+export default defineNuxtConfig({
+  runtimeConfig: {
+    nextgen: {
+      url: process.env.ZITADEL_URL ?? 'http://localhost:4000',
+    },
+  },
+});
+```
+
+### 2. Plugin
+
+Create `plugins/auth.server.ts` to make auth state available in pages:
+
+```ts
+import { defineNuxtPlugin, useRequestEvent, useState } from '#imports';
+
+export default defineNuxtPlugin(() => {
+  const event = useRequestEvent();
+  const auth = event?.context.nextgenAuth ?? {
+    isAuthenticated: false as const,
+    session: null,
+  };
+  useState('nextgen-auth', () => auth);
+});
+```
+
+### 3. Reading auth in a page
+
+```vue
+<script setup lang="ts">
+const auth = useState('nextgen-auth');
+if (auth.value?.isAuthenticated) {
+  await navigateTo('/admin');
+}
+</script>
+
+<template>
+  <p>{{ auth.isAuthenticated ? auth.session.email : 'Not signed in' }}</p>
+</template>
+```
+
+### 4. Register components (client only)
+
+Create `plugins/zitadel-components.client.ts` — do **not** import
+`@zitadel/components` from page `<script setup>` (that runs during SSR):
+
+```ts
+import "@zitadel/components";
+
+export default defineNuxtPlugin(() => {});
+```
+
+Set `body { margin: 0; font-family: sans-serif; }` in `app.vue` (see
+[`apps/demo-nuxt`](../../apps/demo-nuxt/README.md)). Arimo loads from
+`branding.font_url` inside `<zitadel-login>` when the mock/API supplies it.
+
+### 5. Login page
+
+Render `<zitadel-login>` inside `<ClientOnly>`:
+
+```vue
+<template>
+  <main>
+    <ClientOnly>
+      <zitadel-login api-base="/__nextgen" project-id="demo" post-sign-in-url="/admin" />
+    </ClientOnly>
+  </main>
+</template>
+```
+
+### 6. Reading auth in a server route
+
+```ts
+import { getAuth } from '@zitadel/sdk-nuxt/server';
+
+export default defineEventHandler((event) => {
+  const auth = getAuth(event);
+  if (!auth.isAuthenticated) throw createError({ statusCode: 401 });
+  return { userId: auth.session.userId };
+});
+```
+
+## Middleware options
+
+| Option              | Type                 | Default                  | Description                                                                                                                |
+| ------------------- | -------------------- | ------------------------ | -------------------------------------------------------------------------------------------------------------------------- |
+| `url`                 | `string`             | `ZITADEL_URL` env        | Full URL of the Zitadel auth backend                                                                                       |
+| `proxyPath`         | `string`             | `"/__nextgen"`           | Path prefix proxied to the auth backend                                                                                    |
+| `protectedRoutes`   | `string[]`           | `[]`                     | Paths requiring a valid session. Trailing `*` matches sub-paths                                                            |
+| `ignoredRoutes`     | `string[]`           | `[]`                     | Paths skipped entirely — no JWT check, no tunnelling. Useful for webhooks or health checks. Trailing `*` matches sub-paths |
+| `loginPath`         | `string`             | `"/login"`               | Where to redirect unauthenticated users                                                                                    |
+| `allowedAlgorithms` | `string[]`           | `["RS256", "ES256"]`     | JWT `alg` values to accept. Tokens with any other algorithm are rejected before JWKS is fetched                            |
+| `allowedTokenTypes` | `string[]`           | `["JWT", "at+JWT"]`      | Accepted `typ` header values (case-insensitive). Set to `[]` to disable this check                                         |
+| `clockSkewMs`       | `number`             | `5000`                   | Clock skew tolerance in ms for `exp`, `nbf`, `iat`                                                                         |
+| `jwksTimeoutMs`     | `number`             | `5000`                   | Timeout in ms for JWKS endpoint requests. Token is rejected if the fetch exceeds this window                               |
+| `audience`          | `string \| string[]` | not validated            | Expected `aud` claim value(s). When omitted, audience is not checked                                                       |
+
+## How JWT verification works
+
+1. Bearer token from `Authorization` header is checked first; `__nextgen_session` cookie is the fallback
+2. The JWT header is decoded to extract `kid` and `alg`
+3. Tokens with an `alg` not in `allowedAlgorithms` (`RS256`, `ES256` by default) are rejected immediately — no JWKS fetch
+4. Tokens with a `typ` not in `allowedTokenTypes` are rejected immediately
+5. The public key is fetched from `{url}/auth/keys` (JWKS) using the Web Crypto API, with a 5 s timeout, and cached for 5 minutes per `kid`
+6. The signature is verified **before** any claim checks
+7. `iss` must be present and must equal `url` — tokens without an issuer are rejected
+8. `exp` must be present and must be in the future (with `clockSkewMs` tolerance) — tokens without an expiry are rejected
+9. `nbf` and `iat` are validated with `clockSkewMs` tolerance when present
+10. The `x-nextgen-auth-token` header is stripped from all proxied requests to prevent internal state leakage

package/dist/chunk-J2P7YNGG.js

@@ -0,0 +1,199 @@
+// src/runtime/server/middleware.ts
+import {
+  HOP_BY_HOP,
+  INTERNAL_HEADERS,
+  filterResponseHeaders,
+  matchesRoutes
+} from "@zitadel/sdk-core/middleware";
+import {
+  defineEventHandler,
+  getCookie,
+  parseCookies,
+  deleteCookie,
+  sendRedirect,
+  getRequestURL,
+  getRequestHeader,
+  readRawBody
+} from "h3";
+
+// src/runtime/lib/jwt.ts
+import {
+  JWKS_TTL_MS,
+  base64UrlDecode,
+  decodeJwt,
+  verifyJwt
+} from "@zitadel/sdk-core/jwt";
+
+// src/runtime/server/middleware.ts
+function buildUpstreamHeaders(event) {
+  const headers = new Headers();
+  for (const [key, value] of Object.entries(event.node.req.headers)) {
+    const lower = key.toLowerCase();
+    if (!value || HOP_BY_HOP.has(lower) || INTERNAL_HEADERS.has(lower)) {
+      continue;
+    }
+    headers.set(key, Array.isArray(value) ? value.join(", ") : value);
+  }
+  const url = getRequestURL(event);
+  const socketIp = event.node.req.socket?.remoteAddress;
+  if (socketIp) {
+    const existingXff = headers.get("x-forwarded-for");
+    headers.set(
+      "x-forwarded-for",
+      existingXff ? `${existingXff}, ${socketIp}` : socketIp
+    );
+  }
+  if (!headers.has("x-forwarded-host")) {
+    headers.set("x-forwarded-host", url.host);
+  }
+  if (!headers.has("x-forwarded-proto")) {
+    headers.set("x-forwarded-proto", url.protocol.replace(":", ""));
+  }
+  return headers;
+}
+function createNextgenMiddleware(options = {}) {
+  const {
+    url = process.env.ZITADEL_URL ?? "http://localhost:8080",
+    proxyPath = "/__nextgen",
+    protectedRoutes = [],
+    ignoredRoutes = [],
+    loginPath = "/login",
+    allowedAlgorithms = ["RS256", "ES256"],
+    clockSkewMs = 5e3,
+    audience,
+    allowedTokenTypes = ["JWT", "at+JWT"],
+    jwksTimeoutMs,
+    proxyTimeoutMs = 5e3,
+    onExchangeResponse
+  } = options;
+  if (!loginPath.startsWith("/") || loginPath.startsWith("//")) {
+    throw new Error(
+      `[nextgen] loginPath must be a relative path starting with a single "/". Received: "${loginPath}". Using an absolute or protocol-relative URL would allow open-redirect attacks.`
+    );
+  }
+  return defineEventHandler(async (event) => {
+    const urlObj = getRequestURL(event);
+    const { pathname } = urlObj;
+    if (matchesRoutes(pathname, ignoredRoutes)) {
+      delete event.node.req.headers["x-nextgen-auth-token"];
+      return;
+    }
+    if (pathname === proxyPath || pathname.startsWith(`${proxyPath}/`)) {
+      return proxyRequest(
+        event,
+        url,
+        proxyPath,
+        urlObj,
+        proxyTimeoutMs,
+        onExchangeResponse
+      );
+    }
+    return handleAuth(event, {
+      url,
+      protectedRoutes,
+      loginPath,
+      allowedAlgorithms,
+      clockSkewMs,
+      audience,
+      allowedTokenTypes,
+      jwksTimeoutMs,
+      pathname
+    });
+  });
+}
+async function proxyRequest(event, authUrl, proxyPath, url, proxyTimeoutMs, onExchangeResponse) {
+  const suffix = url.pathname.slice(proxyPath.length);
+  const target = `${authUrl}${suffix}${url.search}`;
+  const method = event.node.req.method ?? "GET";
+  const hasBody = !["GET", "HEAD"].includes(method);
+  const rawBody = hasBody ? await readRawBody(event, false) : void 0;
+  const body = rawBody != null ? new Uint8Array(rawBody) : void 0;
+  const upstream = await fetch(target, {
+    method,
+    headers: buildUpstreamHeaders(event),
+    body,
+    redirect: "manual",
+    signal: AbortSignal.timeout(proxyTimeoutMs)
+  });
+  const responseHeaders = filterResponseHeaders(upstream.headers);
+  const setCookieHeaders = upstream.headers.getSetCookie?.() ?? [];
+  for (const cookie of setCookieHeaders) {
+    responseHeaders.append("set-cookie", cookie);
+  }
+  let response = new Response(upstream.body, {
+    status: upstream.status,
+    headers: responseHeaders
+  });
+  const isExchange = method === "POST" && suffix.startsWith("/sessions/exchange");
+  if (isExchange && onExchangeResponse) {
+    response = await onExchangeResponse(response);
+  }
+  event.node.res.statusCode = response.status;
+  for (const [key, value] of response.headers.entries()) {
+    if (key.toLowerCase() === "set-cookie") continue;
+    event.node.res.setHeader(key, value);
+  }
+  const finalCookies = response.headers.getSetCookie?.() ?? [];
+  for (const cookie of finalCookies) {
+    event.node.res.appendHeader("set-cookie", cookie);
+  }
+  return response.body;
+}
+async function handleAuth(event, opts) {
+  const {
+    url,
+    protectedRoutes,
+    loginPath,
+    allowedAlgorithms,
+    clockSkewMs,
+    audience,
+    allowedTokenTypes,
+    jwksTimeoutMs,
+    pathname
+  } = opts;
+  delete event.node.req.headers["x-nextgen-auth-token"];
+  const authHeader = getRequestHeader(event, "authorization");
+  const bearerToken = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
+  const cookieToken = getCookie(event, "__nextgen_session") ?? null;
+  const token = bearerToken ?? cookieToken;
+  const payload = token ? await verifyJwt(token, {
+    issuerUrl: url,
+    allowedAlgorithms,
+    clockSkewMs,
+    audience,
+    allowedTokenTypes,
+    jwksTimeoutMs
+  }) : null;
+  if (payload && token && payload.sub) {
+    event.context.nextgenAuth = {
+      isAuthenticated: true,
+      session: {
+        userId: payload.sub,
+        email: payload.email ?? null,
+        name: payload.name ?? null,
+        token
+      }
+    };
+    return;
+  }
+  event.context.nextgenAuth = { isAuthenticated: false, session: null };
+  for (const name of Object.keys(parseCookies(event))) {
+    if (name.startsWith("__nextgen")) {
+      deleteCookie(event, name);
+    }
+  }
+  if (matchesRoutes(pathname, protectedRoutes)) {
+    const loginUrl = new URL(loginPath, getRequestURL(event));
+    loginUrl.searchParams.set("next", pathname);
+    await sendRedirect(event, loginUrl.toString(), 302);
+    return;
+  }
+}
+function getAuth(event) {
+  return event.context.nextgenAuth ?? { isAuthenticated: false, session: null };
+}
+
+export {
+  createNextgenMiddleware,
+  getAuth
+};

package/dist/index.d.ts

@@ -0,0 +1,32 @@
+export { ZitadelLogin, ZitadelLogout } from '@zitadel/components';
+export { createNextgenMiddleware, getAuth } from './runtime/server/middleware.js';
+import { ZitadelProject } from '@zitadel/api/config';
+export { ClientAuthResult } from './runtime/types.js';
+export { AuthResult, NextgenMiddlewareOptions } from '@zitadel/sdk-core/types';
+import 'h3';
+
+/**
+ * Returns the current Zitadel project handle.
+ *
+ * Reads from the global config set by `configureZitadel()` in the
+ * Nextgen Nuxt plugin. Pass the returned handle to web components
+ * via the `:project` prop for explicit data flow.
+ *
+ * ```vue
+ * <script setup lang="ts">
+ * import { useZitadelProject } from '@zitadel/sdk-nuxt';
+ *
+ * const project = useZitadelProject();
+ * </script>
+ *
+ * <template>
+ *   <zitadel-login :project="project" post-sign-in-url="/admin" />
+ * </template>
+ * ```
+ *
+ * @returns The current {@link ZitadelProject}, or `null` if the plugin
+ *          has not been configured (e.g. missing `projectId`).
+ */
+declare function useZitadelProject(): ZitadelProject | null;
+
+export { useZitadelProject };

package/dist/index.js

@@ -0,0 +1,21 @@
+import "./chunk-ZNXAFGLP.js";
+import {
+  createNextgenMiddleware,
+  getAuth
+} from "./chunk-J2P7YNGG.js";
+
+// src/index.ts
+import { ZitadelLogin, ZitadelLogout } from "@zitadel/components";
+
+// src/runtime/composables/useZitadelProject.ts
+import { getZitadelConfig } from "@zitadel/api/config";
+function useZitadelProject() {
+  return getZitadelConfig();
+}
+export {
+  ZitadelLogin,
+  ZitadelLogout,
+  createNextgenMiddleware,
+  getAuth,
+  useZitadelProject
+};

package/dist/module.js

@@ -0,0 +1,40 @@
+// src/module.ts
+import {
+  defineNuxtModule,
+  addPlugin,
+  addServerHandler,
+  addImportsDir,
+  createResolver
+} from "@nuxt/kit";
+var module_default = defineNuxtModule({
+  meta: {
+    name: "@zitadel/sdk-nuxt",
+    configKey: "nextgen"
+  },
+  defaults: {
+    url: process.env.ZITADEL_URL ?? "http://localhost:8080",
+    proxyPath: "/__nextgen",
+    protectedRoutes: [],
+    loginPath: "/login"
+  },
+  setup(options, nuxt) {
+    const { resolve } = createResolver(import.meta.url);
+    nuxt.options.runtimeConfig.nextgen = {
+      url: options.url ?? "http://localhost:4000",
+      loginPath: options.loginPath ?? "/login",
+      protectedRoutes: options.protectedRoutes ?? [],
+      jwtKey: options.jwtKey
+    };
+    nuxt.options.runtimeConfig.public.zitadelProxyPath = options.proxyPath ?? "/__nextgen";
+    nuxt.options.runtimeConfig.public.nextgenProxyPath = options.proxyPath ?? "/__nextgen";
+    addPlugin(resolve("./runtime/plugin"));
+    addServerHandler({
+      middleware: true,
+      handler: resolve("./runtime/server/handler")
+    });
+    addImportsDir(resolve("./runtime/composables"));
+  }
+});
+export {
+  module_default as default
+};

package/dist/runtime/composables/useAuth.js

@@ -0,0 +1,9 @@
+// src/runtime/composables/useAuth.ts
+import { useState } from "#imports";
+var useAuth = () => useState("nextgen-auth", () => ({
+  isAuthenticated: false,
+  session: null
+})).value;
+export {
+  useAuth
+};

package/dist/runtime/plugin.js

@@ -0,0 +1,35 @@
+// src/runtime/plugin.ts
+import {
+  defineNuxtPlugin,
+  useRequestEvent,
+  useRuntimeConfig,
+  useState
+} from "#imports";
+import { configureZitadel } from "@zitadel/api/config";
+var plugin_default = defineNuxtPlugin(() => {
+  const event = useRequestEvent();
+  const auth = event?.context.nextgenAuth ?? {
+    isAuthenticated: false,
+    session: null
+  };
+  const clientAuth = auth.isAuthenticated ? {
+    isAuthenticated: true,
+    session: {
+      userId: auth.session.userId,
+      email: auth.session.email,
+      name: auth.session.name
+    }
+  } : { isAuthenticated: false, session: null };
+  useState("nextgen-auth", () => clientAuth);
+  const runtimeConfig = useRuntimeConfig();
+  const publicConfig = runtimeConfig.public;
+  const proxyPath = publicConfig.zitadelProxyPath ?? publicConfig.nextgenProxyPath ?? publicConfig.nextgenApiBase ?? "/__nextgen";
+  const projectId = publicConfig.zitadelProjectId ?? "";
+  const url = runtimeConfig.nextgen?.url ?? runtimeConfig.nextgen?.issuerUrl ?? "http://localhost:4000";
+  if (proxyPath && projectId) {
+    configureZitadel({ proxyPath, projectId, url });
+  }
+});
+export {
+  plugin_default as default
+};

package/dist/runtime/server/handler.d.ts

@@ -0,0 +1,11 @@
+import * as h3 from 'h3';
+
+/**
+ * Default Nitro/H3 event handler registered by the `@zitadel/sdk-nuxt` module
+ * via {@link addServerHandler}. Reads middleware options from Nuxt runtime
+ * config (`nuxt.config.ts → nextgen`) so consumers do not need to create
+ * their own `server/middleware/auth.ts` when using the module.
+ */
+declare const _default: h3.EventHandler<h3.EventHandlerRequest, any>;
+
+export { _default as default };

package/dist/runtime/server/handler.js

@@ -0,0 +1,14 @@
+import {
+  createNextgenMiddleware
+} from "../../chunk-J2P7YNGG.js";
+
+// src/runtime/server/handler.ts
+var config = useRuntimeConfig();
+var handler_default = createNextgenMiddleware({
+  url: config.nextgen?.url ?? config.nextgen?.issuerUrl ?? "http://localhost:4000",
+  loginPath: config.nextgen?.loginPath ?? "/login",
+  protectedRoutes: config.nextgen?.protectedRoutes ?? []
+});
+export {
+  handler_default as default
+};

package/dist/runtime/server/middleware.d.ts

@@ -0,0 +1,49 @@
+import { AuthResult, NextgenMiddlewareOptions } from '@zitadel/sdk-core/types';
+import { EventHandler, H3Event } from 'h3';
+
+declare module 'h3' {
+    interface H3EventContext {
+        nextgenAuth: AuthResult;
+    }
+}
+/**
+ * Creates an H3 event handler that handles proxying, JWT verification, and
+ * route protection in a single pass.
+ *
+ * Register it as a Nitro server middleware in `server/middleware/auth.ts`:
+ *
+ * ```ts
+ * import { createNextgenMiddleware } from "@zitadel/sdk-nuxt/server";
+ *
+ * export default createNextgenMiddleware({
+ *   url: process.env.ZITADEL_URL,
+ *   protectedRoutes: ["/admin*", "/dashboard*"],
+ *   loginPath: "/login",
+ * });
+ * ```
+ *
+ * @param options - Middleware configuration options.
+ * @returns An H3 event handler suitable for use as a global server middleware.
+ */
+declare function createNextgenMiddleware(options?: NextgenMiddlewareOptions): EventHandler;
+/**
+ * Reads the auth state from a Nitro/H3 event context.
+ *
+ * Call this inside any server route or API handler after the middleware has run:
+ *
+ * ```ts
+ * import { getAuth } from "@zitadel/sdk-nuxt/server";
+ *
+ * export default defineEventHandler((event) => {
+ *   const auth = getAuth(event);
+ *   if (!auth.isAuthenticated) throw createError({ statusCode: 401 });
+ *   return { userId: auth.session.userId };
+ * });
+ * ```
+ *
+ * @param event - The current H3 event.
+ * @returns The current {@link AuthResult}.
+ */
+declare function getAuth(event: H3Event): AuthResult;
+
+export { createNextgenMiddleware, getAuth };

package/dist/runtime/server/middleware.js

@@ -0,0 +1,8 @@
+import {
+  createNextgenMiddleware,
+  getAuth
+} from "../../chunk-J2P7YNGG.js";
+export {
+  createNextgenMiddleware,
+  getAuth
+};

package/dist/runtime/types.d.ts

@@ -0,0 +1,37 @@
+import { UnauthState } from '@zitadel/sdk-core/types';
+export { AuthResult, AuthState, NextgenMiddlewareOptions, NextgenSession, UnauthState } from '@zitadel/sdk-core/types';
+
+/**
+ * Re-exports shared SDK types from `@zitadel/sdk-core`.
+ *
+ * These types are defined once in sdk-core and shared by both sdk-next
+ * and sdk-nuxt.
+ */
+
+/**
+ * The client-safe session exposed to Vue components via {@link useAuth}.
+ * Identical to {@link NextgenSession} but omits `token` — the raw JWT must
+ * not be serialised into the Nuxt SSR payload where third-party scripts can
+ * read it.
+ */
+type ClientSession = {
+    /** The user's unique identifier (`sub` claim). */
+    userId: string;
+    /** The user's email address, or `null` if not present in the token. */
+    email: string | null;
+    /** The user's display name, or `null` if not present in the token. */
+    name: string | null;
+};
+/** Client-safe auth state when the user is signed in. */
+type ClientAuthState = {
+    isAuthenticated: true;
+    session: ClientSession;
+};
+/**
+ * Union of all possible auth states returned by {@link useAuth}.
+ * Token is intentionally absent — use {@link getAuth} server-side when the
+ * raw JWT is needed.
+ */
+type ClientAuthResult = ClientAuthState | UnauthState;
+
+export type { ClientAuthResult, ClientAuthState, ClientSession };

package/dist/server.d.ts

@@ -0,0 +1,3 @@
+export { createNextgenMiddleware, getAuth } from './runtime/server/middleware.js';
+import '@zitadel/sdk-core/types';
+import 'h3';

package/dist/server.js

@@ -0,0 +1,9 @@
+import "./chunk-ZNXAFGLP.js";
+import {
+  createNextgenMiddleware,
+  getAuth
+} from "./chunk-J2P7YNGG.js";
+export {
+  createNextgenMiddleware,
+  getAuth
+};

package/package.json

@@ -0,0 +1,69 @@
+{
+  "name": "@zitadel/sdk-nuxt",
+  "version": "0.0.0",
+  "description": "Nuxt proxy middleware and helpers for Nextgen Auth",
+  "homepage": "https://github.com/zitadel/nextgen/tree/main/packages/sdk-nuxt#readme",
+  "bugs": {
+    "url": "https://github.com/zitadel/nextgen/issues"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/zitadel/nextgen.git",
+    "directory": "packages/sdk-nuxt"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./module": {
+      "import": "./dist/module.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@zitadel/api": "0.0.0",
+    "@zitadel/components": "0.0.0",
+    "@zitadel/sdk-core": "0.0.0"
+  },
+  "peerDependencies": {
+    "h3": ">=1",
+    "nuxt": ">=4"
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.0.0",
+    "@eslint/json": "^0.11.0",
+    "@eslint/markdown": "^6.0.0",
+    "@nuxt/eslint-plugin": "^0.7.0",
+    "eslint": "^9.0.0",
+    "eslint-config-prettier": "^10.0.0",
+    "eslint-import-resolver-typescript": "^3.7.0",
+    "eslint-plugin-import": "^2.31.0",
+    "eslint-plugin-perfectionist": "^4.0.0",
+    "eslint-plugin-prettier": "^5.0.0",
+    "h3": "^1.15.3",
+    "prettier": "^3.0.0",
+    "tsup": "^8.3.5",
+    "typescript": "^5.7.3",
+    "typescript-eslint": "^8.0.0",
+    "vitest": "^3.0.0"
+  },
+  "scripts": {
+    "build": "tsup src/index.ts src/server.ts src/runtime/types.ts src/runtime/server/middleware.ts src/runtime/server/handler.ts --format esm --dts --clean && tsup src/runtime/plugin.ts src/runtime/composables/useAuth.ts src/module.ts --format esm --no-clean --external @nuxt/kit --external '#imports'",
+    "dev": "tsup src/index.ts src/server.ts --format esm --dts --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests",
+    "lint": "eslint ."
+  }
+}