azirid-react 0.13.2 → 0.14.1

package/dist/next-proxy.cjs

@@ -1,25 +1,41 @@
 'use strict';
 
 var server = require('next/server');
+var jose = require('jose');
 
 // src/next-proxy.ts
+var jwks = null;
+function getJwks(jwksUrl) {
+  if (jwks) return jwks;
+  const url = jwksUrl ?? `${process.env.AZIRID_API_URL ?? "https://api.azirid.com"}/v1/.well-known/jwks.json`;
+  jwks = jose.createRemoteJWKSet(new URL(url));
+  return jwks;
+}
 function createRequestInterceptor(options) {
   const cookieName = options?.cookieName ?? "__session";
   const loginUrl = options?.loginUrl ?? "/login";
   const defaultPublic = ["/login", "/signup", "/auth/handoff"];
   const publicRoutes = options?.publicRoutes ? [.../* @__PURE__ */ new Set([...options.publicRoutes, "/auth/handoff"])] : defaultPublic;
   const protectedRoutes = options?.protectedRoutes;
-  return function handler(request) {
+  return async function handler(request) {
     const { pathname } = request.nextUrl;
     const token = request.cookies.get(cookieName)?.value;
     const response = server.NextResponse.next();
     if (token) {
-      response.headers.set("x-azirid-token", token);
+      try {
+        const keySet = getJwks(options?.jwksUrl);
+        const { payload } = await jose.jwtVerify(token, keySet);
+        response.headers.set("x-azirid-token", token);
+        if (payload.sub) response.headers.set("x-azirid-user-id", payload.sub);
+      } catch {
+        response.headers.set("Set-Cookie", `${cookieName}=; Path=/; Max-Age=0; SameSite=Lax`);
+      }
     }
     if (protectedRoutes) {
+      const hasValidToken = response.headers.has("x-azirid-token");
       const isPublic = publicRoutes.some((r) => pathname.startsWith(r));
       const isProtected = protectedRoutes.some((r) => pathname.startsWith(r));
-      if (isProtected && !isPublic && !token) {
+      if (isProtected && !isPublic && !hasValidToken) {
         const url = request.nextUrl.clone();
         url.pathname = loginUrl;
         url.searchParams.set("redirect", pathname);

package/dist/next-proxy.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/next-proxy.ts"],"names":["NextResponse"],"mappings":";;;;;AA0CA,SAAS,yBAAyB,OAAA,EAA8B;AAC9D,EAAA,MAAM,UAAA,GAAa,SAAS,UAAA,IAAc,WAAA;AAC1C,EAAA,MAAM,QAAA,GAAW,SAAS,QAAA,IAAY,QAAA;AACtC,EAAA,MAAM,aAAA,GAAgB,CAAC,QAAA,EAAU,SAAA,EAAW,eAAe,CAAA;AAC3D,EAAA,MAAM,YAAA,GAAe,OAAA,EAAS,YAAA,GAC1B,CAAC,mBAAG,IAAI,GAAA,CAAI,CAAC,GAAG,OAAA,CAAQ,YAAA,EAAc,eAAe,CAAC,CAAC,CAAA,GACvD,aAAA;AACJ,EAAA,MAAM,kBAAkB,OAAA,EAAS,eAAA;AAEjC,EAAA,OAAO,SAAS,QAAQ,OAAA,EAAsB;AAC5C,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,OAAA,CAAQ,OAAA;AAC7B,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA,EAAG,KAAA;AAE/C,IAAA,MAAM,QAAA,GAAWA,oBAAa,IAAA,EAAK;AAGnC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAA,EAAkB,KAAK,CAAA;AAAA,IAC9C;AAGA,IAAA,IAAI,eAAA,EAAiB;AACnB,MAAA,MAAM,QAAA,GAAW,aAAa,IAAA,CAAK,CAAC,MAAM,QAAA,CAAS,UAAA,CAAW,CAAC,CAAC,CAAA;AAChE,MAAA,MAAM,WAAA,GAAc,gBAAgB,IAAA,CAAK,CAAC,MAAM,QAAA,CAAS,UAAA,CAAW,CAAC,CAAC,CAAA;AAEtE,MAAA,IAAI,WAAA,IAAe,CAAC,QAAA,IAAY,CAAC,KAAA,EAAO;AACtC,QAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAM;AAClC,QAAA,GAAA,CAAI,QAAA,GAAW,QAAA;AACf,QAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,UAAA,EAAY,QAAQ,CAAA;AACzC,QAAA,OAAOA,mBAAA,CAAa,SAAS,GAAG,CAAA;AAAA,MAClC;AAAA,IACF;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AAyBO,SAAS,kBAAkB,OAAA,EAA8B;AAC9D,EAAA,OAAO,yBAAyB,OAAO,CAAA;AACzC;AAGO,IAAM,cAAc,iBAAA","file":"next-proxy.cjs","sourcesContent":["/**\n * Next.js proxy and middleware utilities for Azirid Access.\n *\n * This entry point requires `next/server` and provides request interception\n * for route protection and token forwarding.\n *\n * @example Next.js 16+ (proxy.ts)\n * ```ts\n * // proxy.ts\n * export { aziridProxy as proxy } from \"azirid-react/next/proxy\";\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @example Next.js 16+ with custom options\n * ```ts\n * // proxy.ts\n * import { createAziridProxy } from \"azirid-react/next/proxy\";\n * export const proxy = createAziridProxy({ protectedRoutes: [\"/dashboard\"] });\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @packageDocumentation\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\n\n// ─── Proxy / Middleware Options ──────────────────────────────\n\nexport interface AziridProxyOptions {\n  /** Cookie name (default: \"__session\") */\n  cookieName?: string\n  /** Routes that require authentication (glob patterns via startsWith) */\n  protectedRoutes?: string[]\n  /** Route to redirect to when not authenticated (default: \"/login\") */\n  loginUrl?: string\n  /** Routes that are always public (default: [\"/login\", \"/signup\"]) */\n  publicRoutes?: string[]\n}\n\n\n// ─── Shared proxy/middleware logic ───────────────────────────\n\nfunction createRequestInterceptor(options?: AziridProxyOptions) {\n  const cookieName = options?.cookieName ?? '__session'\n  const loginUrl = options?.loginUrl ?? '/login'\n  const defaultPublic = ['/login', '/signup', '/auth/handoff']\n  const publicRoutes = options?.publicRoutes\n    ? [...new Set([...options.publicRoutes, '/auth/handoff'])]\n    : defaultPublic\n  const protectedRoutes = options?.protectedRoutes\n\n  return function handler(request: NextRequest) {\n    const { pathname } = request.nextUrl\n    const token = request.cookies.get(cookieName)?.value\n\n    const response = NextResponse.next()\n\n    // Expose token as internal header for server components\n    if (token) {\n      response.headers.set('x-azirid-token', token)\n    }\n\n    // Route protection (only when protectedRoutes is configured)\n    if (protectedRoutes) {\n      const isPublic = publicRoutes.some((r) => pathname.startsWith(r))\n      const isProtected = protectedRoutes.some((r) => pathname.startsWith(r))\n\n      if (isProtected && !isPublic && !token) {\n        const url = request.nextUrl.clone()\n        url.pathname = loginUrl\n        url.searchParams.set('redirect', pathname)\n        return NextResponse.redirect(url)\n      }\n    }\n\n    return response\n  }\n}\n\n// ─── Proxy (Next.js 16+) ────────────────────────────────────\n\n/**\n * Create a customized Azirid proxy for Next.js 16+.\n *\n * In Next.js 16, `middleware.ts` is renamed to `proxy.ts` and the\n * exported function must be named `proxy`.\n *\n * @example Default (one line)\n * ```ts\n * // proxy.ts\n * export { aziridProxy as proxy } from \"azirid-react/next/proxy\";\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @example Custom options\n * ```ts\n * // proxy.ts\n * import { createAziridProxy } from \"azirid-react/next/proxy\";\n * export const proxy = createAziridProxy({ protectedRoutes: [\"/dashboard\"] });\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n */\nexport function createAziridProxy(options?: AziridProxyOptions) {\n  return createRequestInterceptor(options)\n}\n\n/** Default proxy export for Next.js 16+ (no route protection, only forwards token) */\nexport const aziridProxy = createAziridProxy()\n\n"]}
+{"version":3,"sources":["../src/next-proxy.ts"],"names":["createRemoteJWKSet","NextResponse","jwtVerify"],"mappings":";;;;;;AA+CA,IAAI,IAAA,GAAqD,IAAA;AAEzD,SAAS,QAAQ,OAAA,EAAyD;AACxE,EAAA,IAAI,MAAM,OAAO,IAAA;AACjB,EAAA,MAAM,MACJ,OAAA,IACA,CAAA,EAAG,OAAA,CAAQ,GAAA,CAAI,kBAAkB,wBAAwB,CAAA,yBAAA,CAAA;AAC3D,EAAA,IAAA,GAAOA,uBAAA,CAAmB,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AACtC,EAAA,OAAO,IAAA;AACT;AAIA,SAAS,yBAAyB,OAAA,EAA8B;AAC9D,EAAA,MAAM,UAAA,GAAa,SAAS,UAAA,IAAc,WAAA;AAC1C,EAAA,MAAM,QAAA,GAAW,SAAS,QAAA,IAAY,QAAA;AACtC,EAAA,MAAM,aAAA,GAAgB,CAAC,QAAA,EAAU,SAAA,EAAW,eAAe,CAAA;AAC3D,EAAA,MAAM,YAAA,GAAe,OAAA,EAAS,YAAA,GAC1B,CAAC,mBAAG,IAAI,GAAA,CAAI,CAAC,GAAG,OAAA,CAAQ,YAAA,EAAc,eAAe,CAAC,CAAC,CAAA,GACvD,aAAA;AACJ,EAAA,MAAM,kBAAkB,OAAA,EAAS,eAAA;AAEjC,EAAA,OAAO,eAAe,QAAQ,OAAA,EAAsB;AAClD,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,OAAA,CAAQ,OAAA;AAC7B,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA,EAAG,KAAA;AAE/C,IAAA,MAAM,QAAA,GAAWC,oBAAa,IAAA,EAAK;AAEnC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AACvC,QAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAMC,cAAA,CAAU,OAAO,MAAM,CAAA;AAEjD,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAA,EAAkB,KAAK,CAAA;AAC5C,QAAA,IAAI,QAAQ,GAAA,EAAK,QAAA,CAAS,QAAQ,GAAA,CAAI,kBAAA,EAAoB,QAAQ,GAAG,CAAA;AAAA,MACvE,CAAA,CAAA,MAAQ;AAEN,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,YAAA,EAAc,CAAA,EAAG,UAAU,CAAA,kCAAA,CAAoC,CAAA;AAAA,MACtF;AAAA,IACF;AAGA,IAAA,IAAI,eAAA,EAAiB;AACnB,MAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC3D,MAAA,MAAM,QAAA,GAAW,aAAa,IAAA,CAAK,CAAC,MAAM,QAAA,CAAS,UAAA,CAAW,CAAC,CAAC,CAAA;AAChE,MAAA,MAAM,WAAA,GAAc,gBAAgB,IAAA,CAAK,CAAC,MAAM,QAAA,CAAS,UAAA,CAAW,CAAC,CAAC,CAAA;AAEtE,MAAA,IAAI,WAAA,IAAe,CAAC,QAAA,IAAY,CAAC,aAAA,EAAe;AAC9C,QAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAM;AAClC,QAAA,GAAA,CAAI,QAAA,GAAW,QAAA;AACf,QAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,UAAA,EAAY,QAAQ,CAAA;AACzC,QAAA,OAAOD,mBAAA,CAAa,SAAS,GAAG,CAAA;AAAA,MAClC;AAAA,IACF;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AAyBO,SAAS,kBAAkB,OAAA,EAA8B;AAC9D,EAAA,OAAO,yBAAyB,OAAO,CAAA;AACzC;AAGO,IAAM,cAAc,iBAAA","file":"next-proxy.cjs","sourcesContent":["/**\n * Next.js middleware for Azirid Access.\n *\n * Validates the `__session` JWT cookie using JWKS and provides\n * route protection and token forwarding for server components.\n *\n * @example Next.js 16+ (proxy.ts)\n * ```ts\n * // proxy.ts\n * export { aziridProxy as proxy } from \"azirid-react/next/proxy\";\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @example Next.js 16+ with custom options\n * ```ts\n * // proxy.ts\n * import { createAziridProxy } from \"azirid-react/next/proxy\";\n * export const proxy = createAziridProxy({\n *   protectedRoutes: [\"/dashboard\"],\n *   loginUrl: \"/login\",\n * });\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @packageDocumentation\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { createRemoteJWKSet, jwtVerify } from 'jose'\n\n// ─── Options ────────────────────────────────────────────────\n\nexport interface AziridProxyOptions {\n  /** Cookie name that carries the access token JWT (default: \"__session\") */\n  cookieName?: string\n  /** Routes that require authentication (matched via startsWith) */\n  protectedRoutes?: string[]\n  /** Route to redirect to when not authenticated (default: \"/login\") */\n  loginUrl?: string\n  /** Routes that are always public (default: [\"/login\", \"/signup\"]) */\n  publicRoutes?: string[]\n  /** JWKS endpoint URL. Default: `${AZIRID_API_URL}/v1/.well-known/jwks.json` */\n  jwksUrl?: string\n}\n\n// ─── JWKS (lazy-initialized, cached by jose internally) ─────\n\nlet jwks: ReturnType<typeof createRemoteJWKSet> | null = null\n\nfunction getJwks(jwksUrl?: string): ReturnType<typeof createRemoteJWKSet> {\n  if (jwks) return jwks\n  const url =\n    jwksUrl ??\n    `${process.env.AZIRID_API_URL ?? 'https://api.azirid.com'}/v1/.well-known/jwks.json`\n  jwks = createRemoteJWKSet(new URL(url))\n  return jwks\n}\n\n// ─── Middleware logic ───────────────────────────────────────\n\nfunction createRequestInterceptor(options?: AziridProxyOptions) {\n  const cookieName = options?.cookieName ?? '__session'\n  const loginUrl = options?.loginUrl ?? '/login'\n  const defaultPublic = ['/login', '/signup', '/auth/handoff']\n  const publicRoutes = options?.publicRoutes\n    ? [...new Set([...options.publicRoutes, '/auth/handoff'])]\n    : defaultPublic\n  const protectedRoutes = options?.protectedRoutes\n\n  return async function handler(request: NextRequest) {\n    const { pathname } = request.nextUrl\n    const token = request.cookies.get(cookieName)?.value\n\n    const response = NextResponse.next()\n\n    if (token) {\n      try {\n        const keySet = getJwks(options?.jwksUrl)\n        const { payload } = await jwtVerify(token, keySet)\n        // Valid token — expose for server components via headers\n        response.headers.set('x-azirid-token', token)\n        if (payload.sub) response.headers.set('x-azirid-user-id', payload.sub)\n      } catch {\n        // Invalid or expired JWT — clear corrupted cookie\n        response.headers.set('Set-Cookie', `${cookieName}=; Path=/; Max-Age=0; SameSite=Lax`)\n      }\n    }\n\n    // Route protection (only when protectedRoutes is configured)\n    if (protectedRoutes) {\n      const hasValidToken = response.headers.has('x-azirid-token')\n      const isPublic = publicRoutes.some((r) => pathname.startsWith(r))\n      const isProtected = protectedRoutes.some((r) => pathname.startsWith(r))\n\n      if (isProtected && !isPublic && !hasValidToken) {\n        const url = request.nextUrl.clone()\n        url.pathname = loginUrl\n        url.searchParams.set('redirect', pathname)\n        return NextResponse.redirect(url)\n      }\n    }\n\n    return response\n  }\n}\n\n// ─── Proxy (Next.js 16+) ────────────────────────────────────\n\n/**\n * Create a customized Azirid middleware for Next.js 16+.\n *\n * @example Default (one line)\n * ```ts\n * // proxy.ts\n * export { aziridProxy as proxy } from \"azirid-react/next/proxy\";\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @example Custom options\n * ```ts\n * // proxy.ts\n * import { createAziridProxy } from \"azirid-react/next/proxy\";\n * export const proxy = createAziridProxy({\n *   protectedRoutes: [\"/dashboard\"],\n *   loginUrl: \"/login\",\n * });\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n */\nexport function createAziridProxy(options?: AziridProxyOptions) {\n  return createRequestInterceptor(options)\n}\n\n/** Default proxy export for Next.js 16+ (no route protection, only validates + forwards token) */\nexport const aziridProxy = createAziridProxy()\n"]}

package/dist/next-proxy.d.cts

@@ -1,10 +1,10 @@
 import { NextRequest, NextResponse } from 'next/server';
 
 /**
- * Next.js proxy and middleware utilities for Azirid Access.
+ * Next.js middleware for Azirid Access.
  *
- * This entry point requires `next/server` and provides request interception
- * for route protection and token forwarding.
+ * Validates the `__session` JWT cookie using JWKS and provides
+ * route protection and token forwarding for server components.
  *
  * @example Next.js 16+ (proxy.ts)
  * ```ts
@@ -17,7 +17,10 @@ import { NextRequest, NextResponse } from 'next/server';
  * ```ts
  * // proxy.ts
  * import { createAziridProxy } from "azirid-react/next/proxy";
- * export const proxy = createAziridProxy({ protectedRoutes: ["/dashboard"] });
+ * export const proxy = createAziridProxy({
+ *   protectedRoutes: ["/dashboard"],
+ *   loginUrl: "/login",
+ * });
  * export const config = { matcher: ["/((?!_next|favicon.ico|api/).*)"] };
  * ```
  *
@@ -25,20 +28,19 @@ import { NextRequest, NextResponse } from 'next/server';
  */
 
 interface AziridProxyOptions {
-    /** Cookie name (default: "__session") */
+    /** Cookie name that carries the access token JWT (default: "__session") */
     cookieName?: string;
-    /** Routes that require authentication (glob patterns via startsWith) */
+    /** Routes that require authentication (matched via startsWith) */
     protectedRoutes?: string[];
     /** Route to redirect to when not authenticated (default: "/login") */
     loginUrl?: string;
     /** Routes that are always public (default: ["/login", "/signup"]) */
     publicRoutes?: string[];
+    /** JWKS endpoint URL. Default: `${AZIRID_API_URL}/v1/.well-known/jwks.json` */
+    jwksUrl?: string;
 }
 /**
- * Create a customized Azirid proxy for Next.js 16+.
- *
- * In Next.js 16, `middleware.ts` is renamed to `proxy.ts` and the
- * exported function must be named `proxy`.
+ * Create a customized Azirid middleware for Next.js 16+.
  *
  * @example Default (one line)
  * ```ts
@@ -51,12 +53,15 @@ interface AziridProxyOptions {
  * ```ts
  * // proxy.ts
  * import { createAziridProxy } from "azirid-react/next/proxy";
- * export const proxy = createAziridProxy({ protectedRoutes: ["/dashboard"] });
+ * export const proxy = createAziridProxy({
+ *   protectedRoutes: ["/dashboard"],
+ *   loginUrl: "/login",
+ * });
  * export const config = { matcher: ["/((?!_next|favicon.ico|api/).*)"] };
  * ```
  */
-declare function createAziridProxy(options?: AziridProxyOptions): (request: NextRequest) => NextResponse;
-/** Default proxy export for Next.js 16+ (no route protection, only forwards token) */
-declare const aziridProxy: (request: NextRequest) => NextResponse;
+declare function createAziridProxy(options?: AziridProxyOptions): (request: NextRequest) => Promise<NextResponse>;
+/** Default proxy export for Next.js 16+ (no route protection, only validates + forwards token) */
+declare const aziridProxy: (request: NextRequest) => Promise<NextResponse>;
 
 export { type AziridProxyOptions, aziridProxy, createAziridProxy };

package/dist/next-proxy.d.ts

@@ -1,10 +1,10 @@
 import { NextRequest, NextResponse } from 'next/server';
 
 /**
- * Next.js proxy and middleware utilities for Azirid Access.
+ * Next.js middleware for Azirid Access.
  *
- * This entry point requires `next/server` and provides request interception
- * for route protection and token forwarding.
+ * Validates the `__session` JWT cookie using JWKS and provides
+ * route protection and token forwarding for server components.
  *
  * @example Next.js 16+ (proxy.ts)
  * ```ts
@@ -17,7 +17,10 @@ import { NextRequest, NextResponse } from 'next/server';
  * ```ts
  * // proxy.ts
  * import { createAziridProxy } from "azirid-react/next/proxy";
- * export const proxy = createAziridProxy({ protectedRoutes: ["/dashboard"] });
+ * export const proxy = createAziridProxy({
+ *   protectedRoutes: ["/dashboard"],
+ *   loginUrl: "/login",
+ * });
  * export const config = { matcher: ["/((?!_next|favicon.ico|api/).*)"] };
  * ```
  *
@@ -25,20 +28,19 @@ import { NextRequest, NextResponse } from 'next/server';
  */
 
 interface AziridProxyOptions {
-    /** Cookie name (default: "__session") */
+    /** Cookie name that carries the access token JWT (default: "__session") */
     cookieName?: string;
-    /** Routes that require authentication (glob patterns via startsWith) */
+    /** Routes that require authentication (matched via startsWith) */
     protectedRoutes?: string[];
     /** Route to redirect to when not authenticated (default: "/login") */
     loginUrl?: string;
     /** Routes that are always public (default: ["/login", "/signup"]) */
     publicRoutes?: string[];
+    /** JWKS endpoint URL. Default: `${AZIRID_API_URL}/v1/.well-known/jwks.json` */
+    jwksUrl?: string;
 }
 /**
- * Create a customized Azirid proxy for Next.js 16+.
- *
- * In Next.js 16, `middleware.ts` is renamed to `proxy.ts` and the
- * exported function must be named `proxy`.
+ * Create a customized Azirid middleware for Next.js 16+.
  *
  * @example Default (one line)
  * ```ts
@@ -51,12 +53,15 @@ interface AziridProxyOptions {
  * ```ts
  * // proxy.ts
  * import { createAziridProxy } from "azirid-react/next/proxy";
- * export const proxy = createAziridProxy({ protectedRoutes: ["/dashboard"] });
+ * export const proxy = createAziridProxy({
+ *   protectedRoutes: ["/dashboard"],
+ *   loginUrl: "/login",
+ * });
  * export const config = { matcher: ["/((?!_next|favicon.ico|api/).*)"] };
  * ```
  */
-declare function createAziridProxy(options?: AziridProxyOptions): (request: NextRequest) => NextResponse;
-/** Default proxy export for Next.js 16+ (no route protection, only forwards token) */
-declare const aziridProxy: (request: NextRequest) => NextResponse;
+declare function createAziridProxy(options?: AziridProxyOptions): (request: NextRequest) => Promise<NextResponse>;
+/** Default proxy export for Next.js 16+ (no route protection, only validates + forwards token) */
+declare const aziridProxy: (request: NextRequest) => Promise<NextResponse>;
 
 export { type AziridProxyOptions, aziridProxy, createAziridProxy };

package/dist/next-proxy.js

@@ -1,23 +1,39 @@
 import { NextResponse } from 'next/server';
+import { jwtVerify, createRemoteJWKSet } from 'jose';
 
 // src/next-proxy.ts
+var jwks = null;
+function getJwks(jwksUrl) {
+  if (jwks) return jwks;
+  const url = jwksUrl ?? `${process.env.AZIRID_API_URL ?? "https://api.azirid.com"}/v1/.well-known/jwks.json`;
+  jwks = createRemoteJWKSet(new URL(url));
+  return jwks;
+}
 function createRequestInterceptor(options) {
   const cookieName = options?.cookieName ?? "__session";
   const loginUrl = options?.loginUrl ?? "/login";
   const defaultPublic = ["/login", "/signup", "/auth/handoff"];
   const publicRoutes = options?.publicRoutes ? [.../* @__PURE__ */ new Set([...options.publicRoutes, "/auth/handoff"])] : defaultPublic;
   const protectedRoutes = options?.protectedRoutes;
-  return function handler(request) {
+  return async function handler(request) {
     const { pathname } = request.nextUrl;
     const token = request.cookies.get(cookieName)?.value;
     const response = NextResponse.next();
     if (token) {
-      response.headers.set("x-azirid-token", token);
+      try {
+        const keySet = getJwks(options?.jwksUrl);
+        const { payload } = await jwtVerify(token, keySet);
+        response.headers.set("x-azirid-token", token);
+        if (payload.sub) response.headers.set("x-azirid-user-id", payload.sub);
+      } catch {
+        response.headers.set("Set-Cookie", `${cookieName}=; Path=/; Max-Age=0; SameSite=Lax`);
+      }
     }
     if (protectedRoutes) {
+      const hasValidToken = response.headers.has("x-azirid-token");
       const isPublic = publicRoutes.some((r) => pathname.startsWith(r));
       const isProtected = protectedRoutes.some((r) => pathname.startsWith(r));
-      if (isProtected && !isPublic && !token) {
+      if (isProtected && !isPublic && !hasValidToken) {
         const url = request.nextUrl.clone();
         url.pathname = loginUrl;
         url.searchParams.set("redirect", pathname);

package/dist/next-proxy.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/next-proxy.ts"],"names":[],"mappings":";;;AA0CA,SAAS,yBAAyB,OAAA,EAA8B;AAC9D,EAAA,MAAM,UAAA,GAAa,SAAS,UAAA,IAAc,WAAA;AAC1C,EAAA,MAAM,QAAA,GAAW,SAAS,QAAA,IAAY,QAAA;AACtC,EAAA,MAAM,aAAA,GAAgB,CAAC,QAAA,EAAU,SAAA,EAAW,eAAe,CAAA;AAC3D,EAAA,MAAM,YAAA,GAAe,OAAA,EAAS,YAAA,GAC1B,CAAC,mBAAG,IAAI,GAAA,CAAI,CAAC,GAAG,OAAA,CAAQ,YAAA,EAAc,eAAe,CAAC,CAAC,CAAA,GACvD,aAAA;AACJ,EAAA,MAAM,kBAAkB,OAAA,EAAS,eAAA;AAEjC,EAAA,OAAO,SAAS,QAAQ,OAAA,EAAsB;AAC5C,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,OAAA,CAAQ,OAAA;AAC7B,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA,EAAG,KAAA;AAE/C,IAAA,MAAM,QAAA,GAAW,aAAa,IAAA,EAAK;AAGnC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAA,EAAkB,KAAK,CAAA;AAAA,IAC9C;AAGA,IAAA,IAAI,eAAA,EAAiB;AACnB,MAAA,MAAM,QAAA,GAAW,aAAa,IAAA,CAAK,CAAC,MAAM,QAAA,CAAS,UAAA,CAAW,CAAC,CAAC,CAAA;AAChE,MAAA,MAAM,WAAA,GAAc,gBAAgB,IAAA,CAAK,CAAC,MAAM,QAAA,CAAS,UAAA,CAAW,CAAC,CAAC,CAAA;AAEtE,MAAA,IAAI,WAAA,IAAe,CAAC,QAAA,IAAY,CAAC,KAAA,EAAO;AACtC,QAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAM;AAClC,QAAA,GAAA,CAAI,QAAA,GAAW,QAAA;AACf,QAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,UAAA,EAAY,QAAQ,CAAA;AACzC,QAAA,OAAO,YAAA,CAAa,SAAS,GAAG,CAAA;AAAA,MAClC;AAAA,IACF;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AAyBO,SAAS,kBAAkB,OAAA,EAA8B;AAC9D,EAAA,OAAO,yBAAyB,OAAO,CAAA;AACzC;AAGO,IAAM,cAAc,iBAAA","file":"next-proxy.js","sourcesContent":["/**\n * Next.js proxy and middleware utilities for Azirid Access.\n *\n * This entry point requires `next/server` and provides request interception\n * for route protection and token forwarding.\n *\n * @example Next.js 16+ (proxy.ts)\n * ```ts\n * // proxy.ts\n * export { aziridProxy as proxy } from \"azirid-react/next/proxy\";\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @example Next.js 16+ with custom options\n * ```ts\n * // proxy.ts\n * import { createAziridProxy } from \"azirid-react/next/proxy\";\n * export const proxy = createAziridProxy({ protectedRoutes: [\"/dashboard\"] });\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @packageDocumentation\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\n\n// ─── Proxy / Middleware Options ──────────────────────────────\n\nexport interface AziridProxyOptions {\n  /** Cookie name (default: \"__session\") */\n  cookieName?: string\n  /** Routes that require authentication (glob patterns via startsWith) */\n  protectedRoutes?: string[]\n  /** Route to redirect to when not authenticated (default: \"/login\") */\n  loginUrl?: string\n  /** Routes that are always public (default: [\"/login\", \"/signup\"]) */\n  publicRoutes?: string[]\n}\n\n\n// ─── Shared proxy/middleware logic ───────────────────────────\n\nfunction createRequestInterceptor(options?: AziridProxyOptions) {\n  const cookieName = options?.cookieName ?? '__session'\n  const loginUrl = options?.loginUrl ?? '/login'\n  const defaultPublic = ['/login', '/signup', '/auth/handoff']\n  const publicRoutes = options?.publicRoutes\n    ? [...new Set([...options.publicRoutes, '/auth/handoff'])]\n    : defaultPublic\n  const protectedRoutes = options?.protectedRoutes\n\n  return function handler(request: NextRequest) {\n    const { pathname } = request.nextUrl\n    const token = request.cookies.get(cookieName)?.value\n\n    const response = NextResponse.next()\n\n    // Expose token as internal header for server components\n    if (token) {\n      response.headers.set('x-azirid-token', token)\n    }\n\n    // Route protection (only when protectedRoutes is configured)\n    if (protectedRoutes) {\n      const isPublic = publicRoutes.some((r) => pathname.startsWith(r))\n      const isProtected = protectedRoutes.some((r) => pathname.startsWith(r))\n\n      if (isProtected && !isPublic && !token) {\n        const url = request.nextUrl.clone()\n        url.pathname = loginUrl\n        url.searchParams.set('redirect', pathname)\n        return NextResponse.redirect(url)\n      }\n    }\n\n    return response\n  }\n}\n\n// ─── Proxy (Next.js 16+) ────────────────────────────────────\n\n/**\n * Create a customized Azirid proxy for Next.js 16+.\n *\n * In Next.js 16, `middleware.ts` is renamed to `proxy.ts` and the\n * exported function must be named `proxy`.\n *\n * @example Default (one line)\n * ```ts\n * // proxy.ts\n * export { aziridProxy as proxy } from \"azirid-react/next/proxy\";\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @example Custom options\n * ```ts\n * // proxy.ts\n * import { createAziridProxy } from \"azirid-react/next/proxy\";\n * export const proxy = createAziridProxy({ protectedRoutes: [\"/dashboard\"] });\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n */\nexport function createAziridProxy(options?: AziridProxyOptions) {\n  return createRequestInterceptor(options)\n}\n\n/** Default proxy export for Next.js 16+ (no route protection, only forwards token) */\nexport const aziridProxy = createAziridProxy()\n\n"]}
+{"version":3,"sources":["../src/next-proxy.ts"],"names":[],"mappings":";;;;AA+CA,IAAI,IAAA,GAAqD,IAAA;AAEzD,SAAS,QAAQ,OAAA,EAAyD;AACxE,EAAA,IAAI,MAAM,OAAO,IAAA;AACjB,EAAA,MAAM,MACJ,OAAA,IACA,CAAA,EAAG,OAAA,CAAQ,GAAA,CAAI,kBAAkB,wBAAwB,CAAA,yBAAA,CAAA;AAC3D,EAAA,IAAA,GAAO,kBAAA,CAAmB,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AACtC,EAAA,OAAO,IAAA;AACT;AAIA,SAAS,yBAAyB,OAAA,EAA8B;AAC9D,EAAA,MAAM,UAAA,GAAa,SAAS,UAAA,IAAc,WAAA;AAC1C,EAAA,MAAM,QAAA,GAAW,SAAS,QAAA,IAAY,QAAA;AACtC,EAAA,MAAM,aAAA,GAAgB,CAAC,QAAA,EAAU,SAAA,EAAW,eAAe,CAAA;AAC3D,EAAA,MAAM,YAAA,GAAe,OAAA,EAAS,YAAA,GAC1B,CAAC,mBAAG,IAAI,GAAA,CAAI,CAAC,GAAG,OAAA,CAAQ,YAAA,EAAc,eAAe,CAAC,CAAC,CAAA,GACvD,aAAA;AACJ,EAAA,MAAM,kBAAkB,OAAA,EAAS,eAAA;AAEjC,EAAA,OAAO,eAAe,QAAQ,OAAA,EAAsB;AAClD,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,OAAA,CAAQ,OAAA;AAC7B,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA,EAAG,KAAA;AAE/C,IAAA,MAAM,QAAA,GAAW,aAAa,IAAA,EAAK;AAEnC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AACvC,QAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,SAAA,CAAU,OAAO,MAAM,CAAA;AAEjD,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAA,EAAkB,KAAK,CAAA;AAC5C,QAAA,IAAI,QAAQ,GAAA,EAAK,QAAA,CAAS,QAAQ,GAAA,CAAI,kBAAA,EAAoB,QAAQ,GAAG,CAAA;AAAA,MACvE,CAAA,CAAA,MAAQ;AAEN,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,YAAA,EAAc,CAAA,EAAG,UAAU,CAAA,kCAAA,CAAoC,CAAA;AAAA,MACtF;AAAA,IACF;AAGA,IAAA,IAAI,eAAA,EAAiB;AACnB,MAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC3D,MAAA,MAAM,QAAA,GAAW,aAAa,IAAA,CAAK,CAAC,MAAM,QAAA,CAAS,UAAA,CAAW,CAAC,CAAC,CAAA;AAChE,MAAA,MAAM,WAAA,GAAc,gBAAgB,IAAA,CAAK,CAAC,MAAM,QAAA,CAAS,UAAA,CAAW,CAAC,CAAC,CAAA;AAEtE,MAAA,IAAI,WAAA,IAAe,CAAC,QAAA,IAAY,CAAC,aAAA,EAAe;AAC9C,QAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAM;AAClC,QAAA,GAAA,CAAI,QAAA,GAAW,QAAA;AACf,QAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,UAAA,EAAY,QAAQ,CAAA;AACzC,QAAA,OAAO,YAAA,CAAa,SAAS,GAAG,CAAA;AAAA,MAClC;AAAA,IACF;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AAyBO,SAAS,kBAAkB,OAAA,EAA8B;AAC9D,EAAA,OAAO,yBAAyB,OAAO,CAAA;AACzC;AAGO,IAAM,cAAc,iBAAA","file":"next-proxy.js","sourcesContent":["/**\n * Next.js middleware for Azirid Access.\n *\n * Validates the `__session` JWT cookie using JWKS and provides\n * route protection and token forwarding for server components.\n *\n * @example Next.js 16+ (proxy.ts)\n * ```ts\n * // proxy.ts\n * export { aziridProxy as proxy } from \"azirid-react/next/proxy\";\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @example Next.js 16+ with custom options\n * ```ts\n * // proxy.ts\n * import { createAziridProxy } from \"azirid-react/next/proxy\";\n * export const proxy = createAziridProxy({\n *   protectedRoutes: [\"/dashboard\"],\n *   loginUrl: \"/login\",\n * });\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @packageDocumentation\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { createRemoteJWKSet, jwtVerify } from 'jose'\n\n// ─── Options ────────────────────────────────────────────────\n\nexport interface AziridProxyOptions {\n  /** Cookie name that carries the access token JWT (default: \"__session\") */\n  cookieName?: string\n  /** Routes that require authentication (matched via startsWith) */\n  protectedRoutes?: string[]\n  /** Route to redirect to when not authenticated (default: \"/login\") */\n  loginUrl?: string\n  /** Routes that are always public (default: [\"/login\", \"/signup\"]) */\n  publicRoutes?: string[]\n  /** JWKS endpoint URL. Default: `${AZIRID_API_URL}/v1/.well-known/jwks.json` */\n  jwksUrl?: string\n}\n\n// ─── JWKS (lazy-initialized, cached by jose internally) ─────\n\nlet jwks: ReturnType<typeof createRemoteJWKSet> | null = null\n\nfunction getJwks(jwksUrl?: string): ReturnType<typeof createRemoteJWKSet> {\n  if (jwks) return jwks\n  const url =\n    jwksUrl ??\n    `${process.env.AZIRID_API_URL ?? 'https://api.azirid.com'}/v1/.well-known/jwks.json`\n  jwks = createRemoteJWKSet(new URL(url))\n  return jwks\n}\n\n// ─── Middleware logic ───────────────────────────────────────\n\nfunction createRequestInterceptor(options?: AziridProxyOptions) {\n  const cookieName = options?.cookieName ?? '__session'\n  const loginUrl = options?.loginUrl ?? '/login'\n  const defaultPublic = ['/login', '/signup', '/auth/handoff']\n  const publicRoutes = options?.publicRoutes\n    ? [...new Set([...options.publicRoutes, '/auth/handoff'])]\n    : defaultPublic\n  const protectedRoutes = options?.protectedRoutes\n\n  return async function handler(request: NextRequest) {\n    const { pathname } = request.nextUrl\n    const token = request.cookies.get(cookieName)?.value\n\n    const response = NextResponse.next()\n\n    if (token) {\n      try {\n        const keySet = getJwks(options?.jwksUrl)\n        const { payload } = await jwtVerify(token, keySet)\n        // Valid token — expose for server components via headers\n        response.headers.set('x-azirid-token', token)\n        if (payload.sub) response.headers.set('x-azirid-user-id', payload.sub)\n      } catch {\n        // Invalid or expired JWT — clear corrupted cookie\n        response.headers.set('Set-Cookie', `${cookieName}=; Path=/; Max-Age=0; SameSite=Lax`)\n      }\n    }\n\n    // Route protection (only when protectedRoutes is configured)\n    if (protectedRoutes) {\n      const hasValidToken = response.headers.has('x-azirid-token')\n      const isPublic = publicRoutes.some((r) => pathname.startsWith(r))\n      const isProtected = protectedRoutes.some((r) => pathname.startsWith(r))\n\n      if (isProtected && !isPublic && !hasValidToken) {\n        const url = request.nextUrl.clone()\n        url.pathname = loginUrl\n        url.searchParams.set('redirect', pathname)\n        return NextResponse.redirect(url)\n      }\n    }\n\n    return response\n  }\n}\n\n// ─── Proxy (Next.js 16+) ────────────────────────────────────\n\n/**\n * Create a customized Azirid middleware for Next.js 16+.\n *\n * @example Default (one line)\n * ```ts\n * // proxy.ts\n * export { aziridProxy as proxy } from \"azirid-react/next/proxy\";\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @example Custom options\n * ```ts\n * // proxy.ts\n * import { createAziridProxy } from \"azirid-react/next/proxy\";\n * export const proxy = createAziridProxy({\n *   protectedRoutes: [\"/dashboard\"],\n *   loginUrl: \"/login\",\n * });\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n */\nexport function createAziridProxy(options?: AziridProxyOptions) {\n  return createRequestInterceptor(options)\n}\n\n/** Default proxy export for Next.js 16+ (no route protection, only validates + forwards token) */\nexport const aziridProxy = createAziridProxy()\n"]}

package/dist/server.cjs

@@ -17,42 +17,7 @@ function createServerAccess(options) {
     getAccessToken: getSessionToken
   };
 }
-function createSessionSyncHandler(options) {
-  const name = options?.cookieName ?? "__session";
-  const secure = options?.secure ?? false;
-  const maxAge = options?.maxAge ?? 3600;
-  return {
-    async POST(req) {
-      const { token } = await req.json();
-      if (!token || typeof token !== "string") {
-        return new Response(JSON.stringify({ error: "Missing token" }), {
-          status: 400,
-          headers: { "Content-Type": "application/json" }
-        });
-      }
-      const parts = [`${name}=${token}`, "Path=/", "HttpOnly", "SameSite=Lax", `Max-Age=${maxAge}`];
-      if (secure) parts.push("Secure");
-      return new Response(JSON.stringify({ ok: true }), {
-        headers: {
-          "Content-Type": "application/json",
-          "Set-Cookie": parts.join("; ")
-        }
-      });
-    },
-    async DELETE() {
-      const parts = [`${name}=`, "Path=/", "HttpOnly", "SameSite=Lax", "Max-Age=0"];
-      if (secure) parts.push("Secure");
-      return new Response(JSON.stringify({ ok: true }), {
-        headers: {
-          "Content-Type": "application/json",
-          "Set-Cookie": parts.join("; ")
-        }
-      });
-    }
-  };
-}
 
 exports.createServerAccess = createServerAccess;
-exports.createSessionSyncHandler = createSessionSyncHandler;
 //# sourceMappingURL=server.cjs.map
 //# sourceMappingURL=server.cjs.map

package/dist/server.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server.ts"],"names":[],"mappings":";;;AAgFO,SAAS,mBAAmB,OAAA,EAA4C;AAC7E,EAAA,MAAM,EAAE,OAAA,EAAS,UAAA,GAAa,WAAA,EAAY,GAAI,OAAA;AAE9C,EAAA,eAAe,eAAA,GAA0C;AACvD,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,OAAA,EAAQ;AAEvB,MAAA,MAAM,WAAA,GAAc,MAAA,YAAkB,OAAA,GAAU,MAAM,MAAA,GAAS,MAAA;AAC/D,MAAA,OAAO,WAAA,CAAY,GAAA,CAAI,UAAU,CAAA,EAAG,KAAA,IAAS,IAAA;AAAA,IAC/C,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,eAAA;AAAA,IACA,cAAA,EAAgB;AAAA,GAClB;AACF;AAyBO,SAAS,yBAAyB,OAAA,EAA8B;AACrE,EAAA,MAAM,IAAA,GAAO,SAAS,UAAA,IAAc,WAAA;AACpC,EAAA,MAAM,MAAA,GAAS,SAAS,MAAA,IAAU,KAAA;AAClC,EAAA,MAAM,MAAA,GAAS,SAAS,MAAA,IAAU,IAAA;AAElC,EAAA,OAAO;AAAA,IACL,MAAM,KAAK,GAAA,EAAc;AACvB,MAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,IAAI,IAAA,EAAK;AACjC,MAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,QAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,eAAA,EAAiB,CAAA,EAAG;AAAA,UAC9D,MAAA,EAAQ,GAAA;AAAA,UACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,SAC/C,CAAA;AAAA,MACH;AACA,MAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA,EAAI,QAAA,EAAU,UAAA,EAAY,cAAA,EAAgB,CAAA,QAAA,EAAW,MAAM,CAAA,CAAE,CAAA;AAC5F,MAAA,IAAI,MAAA,EAAQ,KAAA,CAAM,IAAA,CAAK,QAAQ,CAAA;AAC/B,MAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,EAAA,EAAI,IAAA,EAAM,CAAA,EAAG;AAAA,QAChD,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,YAAA,EAAc,KAAA,CAAM,IAAA,CAAK,IAAI;AAAA;AAC/B,OACD,CAAA;AAAA,IACH,CAAA;AAAA,IACA,MAAM,MAAA,GAAS;AACb,MAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,EAAG,IAAI,KAAK,QAAA,EAAU,UAAA,EAAY,gBAAgB,WAAW,CAAA;AAC5E,MAAA,IAAI,MAAA,EAAQ,KAAA,CAAM,IAAA,CAAK,QAAQ,CAAA;AAC/B,MAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,EAAA,EAAI,IAAA,EAAM,CAAA,EAAG;AAAA,QAChD,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,YAAA,EAAc,KAAA,CAAM,IAAA,CAAK,IAAI;AAAA;AAC/B,OACD,CAAA;AAAA,IACH;AAAA,GACF;AACF","file":"server.cjs","sourcesContent":["/**\n * Server-side utilities for Next.js (App Router).\n *\n * Use this entry point in Server Components, Server Actions, and Route Handlers\n * to read the authenticated user's session token from the httpOnly `__session` cookie.\n *\n * @example\n * ```ts\n * // lib/access-server.ts\n * import { cookies } from \"next/headers\";\n * import { createServerAccess } from \"azirid-react/server\";\n * export const { getSessionToken } = createServerAccess({ cookies });\n * ```\n *\n * ```ts\n * // app/actions/profile.ts\n * \"use server\";\n * import { getSessionToken } from \"@/lib/access-server\";\n *\n * export async function getProfile() {\n *   const token = await getSessionToken();\n *   if (!token) throw new Error(\"Not authenticated\");\n *\n *   const res = await fetch(\"https://api.myapp.com/v1/users/auth/me\", {\n *     headers: { Authorization: `Bearer ${token}` },\n *   });\n *   return res.json();\n * }\n * ```\n *\n * @packageDocumentation\n */\n\n/** Minimal cookie store interface (subset of Next.js ReadonlyRequestCookies) */\ninterface CookieStore {\n  get(name: string): { value: string } | undefined\n}\n\n/** The `cookies` function from `next/headers` */\ntype CookiesFn = () => CookieStore | Promise<CookieStore>\n\nexport interface ServerAccessOptions {\n  /**\n   * The `cookies` function imported from `next/headers`.\n   * Required — pass it explicitly to avoid bundler issues with dynamic imports.\n   *\n   * @example\n   * ```ts\n   * import { cookies } from \"next/headers\";\n   * createServerAccess({ cookies });\n   * ```\n   */\n  cookies: CookiesFn\n\n  /**\n   * Name of the httpOnly cookie that carries the access token.\n   * Must match the cookie set by the Azirid API.\n   * @default \"__session\"\n   */\n  cookieName?: string\n}\n\nexport interface ServerAccess {\n  /**\n   * Read the raw JWT access token from the session cookie.\n   * Returns `null` when no cookie is present or when called\n   * outside a Next.js server context.\n   */\n  getSessionToken: () => Promise<string | null>\n\n  /** Alias for {@link getSessionToken}. */\n  getAccessToken: () => Promise<string | null>\n}\n\n/**\n * Create server-side helpers bound to the session cookie.\n *\n * Call once at module scope, then use the returned functions\n * in any Server Component, Server Action, or Route Handler.\n */\nexport function createServerAccess(options: ServerAccessOptions): ServerAccess {\n  const { cookies, cookieName = '__session' } = options\n\n  async function getSessionToken(): Promise<string | null> {\n    try {\n      const result = cookies()\n      // Next.js 15+: cookies() returns a Promise\n      const cookieStore = result instanceof Promise ? await result : result\n      return cookieStore.get(cookieName)?.value ?? null\n    } catch {\n      return null\n    }\n  }\n\n  return {\n    getSessionToken,\n    getAccessToken: getSessionToken,\n  }\n}\n\n// ─── Session Sync Handler (cross-origin dev support) ─────────\n\nexport interface SessionSyncOptions {\n  /** Cookie name (default: \"__session\") */\n  cookieName?: string\n  /** Set Secure flag on cookie (default: false) */\n  secure?: boolean\n  /** Cookie max age in seconds (default: 3600 = 1h) */\n  maxAge?: number\n}\n\n/**\n * Create a route handler that syncs the access token to a local httpOnly cookie.\n *\n * Use this in a Next.js App Router route to bridge cross-origin sessions:\n *\n * @example\n * ```ts\n * // app/api/auth/session/route.ts\n * import { createSessionSyncHandler } from \"azirid-react/server\";\n * export const { POST, DELETE } = createSessionSyncHandler();\n * ```\n */\nexport function createSessionSyncHandler(options?: SessionSyncOptions) {\n  const name = options?.cookieName ?? '__session'\n  const secure = options?.secure ?? false\n  const maxAge = options?.maxAge ?? 3600\n\n  return {\n    async POST(req: Request) {\n      const { token } = await req.json()\n      if (!token || typeof token !== 'string') {\n        return new Response(JSON.stringify({ error: 'Missing token' }), {\n          status: 400,\n          headers: { 'Content-Type': 'application/json' },\n        })\n      }\n      const parts = [`${name}=${token}`, 'Path=/', 'HttpOnly', 'SameSite=Lax', `Max-Age=${maxAge}`]\n      if (secure) parts.push('Secure')\n      return new Response(JSON.stringify({ ok: true }), {\n        headers: {\n          'Content-Type': 'application/json',\n          'Set-Cookie': parts.join('; '),\n        },\n      })\n    },\n    async DELETE() {\n      const parts = [`${name}=`, 'Path=/', 'HttpOnly', 'SameSite=Lax', 'Max-Age=0']\n      if (secure) parts.push('Secure')\n      return new Response(JSON.stringify({ ok: true }), {\n        headers: {\n          'Content-Type': 'application/json',\n          'Set-Cookie': parts.join('; '),\n        },\n      })\n    },\n  }\n}\n"]}
+{"version":3,"sources":["../src/server.ts"],"names":[],"mappings":";;;AAgFO,SAAS,mBAAmB,OAAA,EAA4C;AAC7E,EAAA,MAAM,EAAE,OAAA,EAAS,UAAA,GAAa,WAAA,EAAY,GAAI,OAAA;AAE9C,EAAA,eAAe,eAAA,GAA0C;AACvD,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,OAAA,EAAQ;AAEvB,MAAA,MAAM,WAAA,GAAc,MAAA,YAAkB,OAAA,GAAU,MAAM,MAAA,GAAS,MAAA;AAC/D,MAAA,OAAO,WAAA,CAAY,GAAA,CAAI,UAAU,CAAA,EAAG,KAAA,IAAS,IAAA;AAAA,IAC/C,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,eAAA;AAAA,IACA,cAAA,EAAgB;AAAA,GAClB;AACF","file":"server.cjs","sourcesContent":["/**\n * Server-side utilities for Next.js (App Router).\n *\n * Use this entry point in Server Components, Server Actions, and Route Handlers\n * to read the authenticated user's session token from the httpOnly `__session` cookie.\n *\n * @example\n * ```ts\n * // lib/access-server.ts\n * import { cookies } from \"next/headers\";\n * import { createServerAccess } from \"azirid-react/server\";\n * export const { getSessionToken } = createServerAccess({ cookies });\n * ```\n *\n * ```ts\n * // app/actions/profile.ts\n * \"use server\";\n * import { getSessionToken } from \"@/lib/access-server\";\n *\n * export async function getProfile() {\n *   const token = await getSessionToken();\n *   if (!token) throw new Error(\"Not authenticated\");\n *\n *   const res = await fetch(\"https://api.myapp.com/v1/users/auth/me\", {\n *     headers: { Authorization: `Bearer ${token}` },\n *   });\n *   return res.json();\n * }\n * ```\n *\n * @packageDocumentation\n */\n\n/** Minimal cookie store interface (subset of Next.js ReadonlyRequestCookies) */\ninterface CookieStore {\n  get(name: string): { value: string } | undefined\n}\n\n/** The `cookies` function from `next/headers` */\ntype CookiesFn = () => CookieStore | Promise<CookieStore>\n\nexport interface ServerAccessOptions {\n  /**\n   * The `cookies` function imported from `next/headers`.\n   * Required — pass it explicitly to avoid bundler issues with dynamic imports.\n   *\n   * @example\n   * ```ts\n   * import { cookies } from \"next/headers\";\n   * createServerAccess({ cookies });\n   * ```\n   */\n  cookies: CookiesFn\n\n  /**\n   * Name of the httpOnly cookie that carries the access token.\n   * Must match the cookie set by the Azirid API.\n   * @default \"__session\"\n   */\n  cookieName?: string\n}\n\nexport interface ServerAccess {\n  /**\n   * Read the raw JWT access token from the session cookie.\n   * Returns `null` when no cookie is present or when called\n   * outside a Next.js server context.\n   */\n  getSessionToken: () => Promise<string | null>\n\n  /** Alias for {@link getSessionToken}. */\n  getAccessToken: () => Promise<string | null>\n}\n\n/**\n * Create server-side helpers bound to the session cookie.\n *\n * Call once at module scope, then use the returned functions\n * in any Server Component, Server Action, or Route Handler.\n */\nexport function createServerAccess(options: ServerAccessOptions): ServerAccess {\n  const { cookies, cookieName = '__session' } = options\n\n  async function getSessionToken(): Promise<string | null> {\n    try {\n      const result = cookies()\n      // Next.js 15+: cookies() returns a Promise\n      const cookieStore = result instanceof Promise ? await result : result\n      return cookieStore.get(cookieName)?.value ?? null\n    } catch {\n      return null\n    }\n  }\n\n  return {\n    getSessionToken,\n    getAccessToken: getSessionToken,\n  }\n}\n\n"]}

package/dist/server.d.cts

@@ -74,29 +74,5 @@ interface ServerAccess {
  * in any Server Component, Server Action, or Route Handler.
  */
 declare function createServerAccess(options: ServerAccessOptions): ServerAccess;
-interface SessionSyncOptions {
-    /** Cookie name (default: "__session") */
-    cookieName?: string;
-    /** Set Secure flag on cookie (default: false) */
-    secure?: boolean;
-    /** Cookie max age in seconds (default: 3600 = 1h) */
-    maxAge?: number;
-}
-/**
- * Create a route handler that syncs the access token to a local httpOnly cookie.
- *
- * Use this in a Next.js App Router route to bridge cross-origin sessions:
- *
- * @example
- * ```ts
- * // app/api/auth/session/route.ts
- * import { createSessionSyncHandler } from "azirid-react/server";
- * export const { POST, DELETE } = createSessionSyncHandler();
- * ```
- */
-declare function createSessionSyncHandler(options?: SessionSyncOptions): {
-    POST(req: Request): Promise<Response>;
-    DELETE(): Promise<Response>;
-};
 
-export { type ServerAccess, type ServerAccessOptions, type SessionSyncOptions, createServerAccess, createSessionSyncHandler };
+export { type ServerAccess, type ServerAccessOptions, createServerAccess };

package/dist/server.d.ts

@@ -74,29 +74,5 @@ interface ServerAccess {
  * in any Server Component, Server Action, or Route Handler.
  */
 declare function createServerAccess(options: ServerAccessOptions): ServerAccess;
-interface SessionSyncOptions {
-    /** Cookie name (default: "__session") */
-    cookieName?: string;
-    /** Set Secure flag on cookie (default: false) */
-    secure?: boolean;
-    /** Cookie max age in seconds (default: 3600 = 1h) */
-    maxAge?: number;
-}
-/**
- * Create a route handler that syncs the access token to a local httpOnly cookie.
- *
- * Use this in a Next.js App Router route to bridge cross-origin sessions:
- *
- * @example
- * ```ts
- * // app/api/auth/session/route.ts
- * import { createSessionSyncHandler } from "azirid-react/server";
- * export const { POST, DELETE } = createSessionSyncHandler();
- * ```
- */
-declare function createSessionSyncHandler(options?: SessionSyncOptions): {
-    POST(req: Request): Promise<Response>;
-    DELETE(): Promise<Response>;
-};
 
-export { type ServerAccess, type ServerAccessOptions, type SessionSyncOptions, createServerAccess, createSessionSyncHandler };
+export { type ServerAccess, type ServerAccessOptions, createServerAccess };

package/dist/server.js

@@ -15,41 +15,7 @@ function createServerAccess(options) {
     getAccessToken: getSessionToken
   };
 }
-function createSessionSyncHandler(options) {
-  const name = options?.cookieName ?? "__session";
-  const secure = options?.secure ?? false;
-  const maxAge = options?.maxAge ?? 3600;
-  return {
-    async POST(req) {
-      const { token } = await req.json();
-      if (!token || typeof token !== "string") {
-        return new Response(JSON.stringify({ error: "Missing token" }), {
-          status: 400,
-          headers: { "Content-Type": "application/json" }
-        });
-      }
-      const parts = [`${name}=${token}`, "Path=/", "HttpOnly", "SameSite=Lax", `Max-Age=${maxAge}`];
-      if (secure) parts.push("Secure");
-      return new Response(JSON.stringify({ ok: true }), {
-        headers: {
-          "Content-Type": "application/json",
-          "Set-Cookie": parts.join("; ")
-        }
-      });
-    },
-    async DELETE() {
-      const parts = [`${name}=`, "Path=/", "HttpOnly", "SameSite=Lax", "Max-Age=0"];
-      if (secure) parts.push("Secure");
-      return new Response(JSON.stringify({ ok: true }), {
-        headers: {
-          "Content-Type": "application/json",
-          "Set-Cookie": parts.join("; ")
-        }
-      });
-    }
-  };
-}
 
-export { createServerAccess, createSessionSyncHandler };
+export { createServerAccess };
 //# sourceMappingURL=server.js.map
 //# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server.ts"],"names":[],"mappings":";AAgFO,SAAS,mBAAmB,OAAA,EAA4C;AAC7E,EAAA,MAAM,EAAE,OAAA,EAAS,UAAA,GAAa,WAAA,EAAY,GAAI,OAAA;AAE9C,EAAA,eAAe,eAAA,GAA0C;AACvD,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,OAAA,EAAQ;AAEvB,MAAA,MAAM,WAAA,GAAc,MAAA,YAAkB,OAAA,GAAU,MAAM,MAAA,GAAS,MAAA;AAC/D,MAAA,OAAO,WAAA,CAAY,GAAA,CAAI,UAAU,CAAA,EAAG,KAAA,IAAS,IAAA;AAAA,IAC/C,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,eAAA;AAAA,IACA,cAAA,EAAgB;AAAA,GAClB;AACF;AAyBO,SAAS,yBAAyB,OAAA,EAA8B;AACrE,EAAA,MAAM,IAAA,GAAO,SAAS,UAAA,IAAc,WAAA;AACpC,EAAA,MAAM,MAAA,GAAS,SAAS,MAAA,IAAU,KAAA;AAClC,EAAA,MAAM,MAAA,GAAS,SAAS,MAAA,IAAU,IAAA;AAElC,EAAA,OAAO;AAAA,IACL,MAAM,KAAK,GAAA,EAAc;AACvB,MAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,IAAI,IAAA,EAAK;AACjC,MAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,QAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,eAAA,EAAiB,CAAA,EAAG;AAAA,UAC9D,MAAA,EAAQ,GAAA;AAAA,UACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,SAC/C,CAAA;AAAA,MACH;AACA,MAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA,EAAI,QAAA,EAAU,UAAA,EAAY,cAAA,EAAgB,CAAA,QAAA,EAAW,MAAM,CAAA,CAAE,CAAA;AAC5F,MAAA,IAAI,MAAA,EAAQ,KAAA,CAAM,IAAA,CAAK,QAAQ,CAAA;AAC/B,MAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,EAAA,EAAI,IAAA,EAAM,CAAA,EAAG;AAAA,QAChD,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,YAAA,EAAc,KAAA,CAAM,IAAA,CAAK,IAAI;AAAA;AAC/B,OACD,CAAA;AAAA,IACH,CAAA;AAAA,IACA,MAAM,MAAA,GAAS;AACb,MAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,EAAG,IAAI,KAAK,QAAA,EAAU,UAAA,EAAY,gBAAgB,WAAW,CAAA;AAC5E,MAAA,IAAI,MAAA,EAAQ,KAAA,CAAM,IAAA,CAAK,QAAQ,CAAA;AAC/B,MAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,EAAA,EAAI,IAAA,EAAM,CAAA,EAAG;AAAA,QAChD,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,YAAA,EAAc,KAAA,CAAM,IAAA,CAAK,IAAI;AAAA;AAC/B,OACD,CAAA;AAAA,IACH;AAAA,GACF;AACF","file":"server.js","sourcesContent":["/**\n * Server-side utilities for Next.js (App Router).\n *\n * Use this entry point in Server Components, Server Actions, and Route Handlers\n * to read the authenticated user's session token from the httpOnly `__session` cookie.\n *\n * @example\n * ```ts\n * // lib/access-server.ts\n * import { cookies } from \"next/headers\";\n * import { createServerAccess } from \"azirid-react/server\";\n * export const { getSessionToken } = createServerAccess({ cookies });\n * ```\n *\n * ```ts\n * // app/actions/profile.ts\n * \"use server\";\n * import { getSessionToken } from \"@/lib/access-server\";\n *\n * export async function getProfile() {\n *   const token = await getSessionToken();\n *   if (!token) throw new Error(\"Not authenticated\");\n *\n *   const res = await fetch(\"https://api.myapp.com/v1/users/auth/me\", {\n *     headers: { Authorization: `Bearer ${token}` },\n *   });\n *   return res.json();\n * }\n * ```\n *\n * @packageDocumentation\n */\n\n/** Minimal cookie store interface (subset of Next.js ReadonlyRequestCookies) */\ninterface CookieStore {\n  get(name: string): { value: string } | undefined\n}\n\n/** The `cookies` function from `next/headers` */\ntype CookiesFn = () => CookieStore | Promise<CookieStore>\n\nexport interface ServerAccessOptions {\n  /**\n   * The `cookies` function imported from `next/headers`.\n   * Required — pass it explicitly to avoid bundler issues with dynamic imports.\n   *\n   * @example\n   * ```ts\n   * import { cookies } from \"next/headers\";\n   * createServerAccess({ cookies });\n   * ```\n   */\n  cookies: CookiesFn\n\n  /**\n   * Name of the httpOnly cookie that carries the access token.\n   * Must match the cookie set by the Azirid API.\n   * @default \"__session\"\n   */\n  cookieName?: string\n}\n\nexport interface ServerAccess {\n  /**\n   * Read the raw JWT access token from the session cookie.\n   * Returns `null` when no cookie is present or when called\n   * outside a Next.js server context.\n   */\n  getSessionToken: () => Promise<string | null>\n\n  /** Alias for {@link getSessionToken}. */\n  getAccessToken: () => Promise<string | null>\n}\n\n/**\n * Create server-side helpers bound to the session cookie.\n *\n * Call once at module scope, then use the returned functions\n * in any Server Component, Server Action, or Route Handler.\n */\nexport function createServerAccess(options: ServerAccessOptions): ServerAccess {\n  const { cookies, cookieName = '__session' } = options\n\n  async function getSessionToken(): Promise<string | null> {\n    try {\n      const result = cookies()\n      // Next.js 15+: cookies() returns a Promise\n      const cookieStore = result instanceof Promise ? await result : result\n      return cookieStore.get(cookieName)?.value ?? null\n    } catch {\n      return null\n    }\n  }\n\n  return {\n    getSessionToken,\n    getAccessToken: getSessionToken,\n  }\n}\n\n// ─── Session Sync Handler (cross-origin dev support) ─────────\n\nexport interface SessionSyncOptions {\n  /** Cookie name (default: \"__session\") */\n  cookieName?: string\n  /** Set Secure flag on cookie (default: false) */\n  secure?: boolean\n  /** Cookie max age in seconds (default: 3600 = 1h) */\n  maxAge?: number\n}\n\n/**\n * Create a route handler that syncs the access token to a local httpOnly cookie.\n *\n * Use this in a Next.js App Router route to bridge cross-origin sessions:\n *\n * @example\n * ```ts\n * // app/api/auth/session/route.ts\n * import { createSessionSyncHandler } from \"azirid-react/server\";\n * export const { POST, DELETE } = createSessionSyncHandler();\n * ```\n */\nexport function createSessionSyncHandler(options?: SessionSyncOptions) {\n  const name = options?.cookieName ?? '__session'\n  const secure = options?.secure ?? false\n  const maxAge = options?.maxAge ?? 3600\n\n  return {\n    async POST(req: Request) {\n      const { token } = await req.json()\n      if (!token || typeof token !== 'string') {\n        return new Response(JSON.stringify({ error: 'Missing token' }), {\n          status: 400,\n          headers: { 'Content-Type': 'application/json' },\n        })\n      }\n      const parts = [`${name}=${token}`, 'Path=/', 'HttpOnly', 'SameSite=Lax', `Max-Age=${maxAge}`]\n      if (secure) parts.push('Secure')\n      return new Response(JSON.stringify({ ok: true }), {\n        headers: {\n          'Content-Type': 'application/json',\n          'Set-Cookie': parts.join('; '),\n        },\n      })\n    },\n    async DELETE() {\n      const parts = [`${name}=`, 'Path=/', 'HttpOnly', 'SameSite=Lax', 'Max-Age=0']\n      if (secure) parts.push('Secure')\n      return new Response(JSON.stringify({ ok: true }), {\n        headers: {\n          'Content-Type': 'application/json',\n          'Set-Cookie': parts.join('; '),\n        },\n      })\n    },\n  }\n}\n"]}
+{"version":3,"sources":["../src/server.ts"],"names":[],"mappings":";AAgFO,SAAS,mBAAmB,OAAA,EAA4C;AAC7E,EAAA,MAAM,EAAE,OAAA,EAAS,UAAA,GAAa,WAAA,EAAY,GAAI,OAAA;AAE9C,EAAA,eAAe,eAAA,GAA0C;AACvD,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,OAAA,EAAQ;AAEvB,MAAA,MAAM,WAAA,GAAc,MAAA,YAAkB,OAAA,GAAU,MAAM,MAAA,GAAS,MAAA;AAC/D,MAAA,OAAO,WAAA,CAAY,GAAA,CAAI,UAAU,CAAA,EAAG,KAAA,IAAS,IAAA;AAAA,IAC/C,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,eAAA;AAAA,IACA,cAAA,EAAgB;AAAA,GAClB;AACF","file":"server.js","sourcesContent":["/**\n * Server-side utilities for Next.js (App Router).\n *\n * Use this entry point in Server Components, Server Actions, and Route Handlers\n * to read the authenticated user's session token from the httpOnly `__session` cookie.\n *\n * @example\n * ```ts\n * // lib/access-server.ts\n * import { cookies } from \"next/headers\";\n * import { createServerAccess } from \"azirid-react/server\";\n * export const { getSessionToken } = createServerAccess({ cookies });\n * ```\n *\n * ```ts\n * // app/actions/profile.ts\n * \"use server\";\n * import { getSessionToken } from \"@/lib/access-server\";\n *\n * export async function getProfile() {\n *   const token = await getSessionToken();\n *   if (!token) throw new Error(\"Not authenticated\");\n *\n *   const res = await fetch(\"https://api.myapp.com/v1/users/auth/me\", {\n *     headers: { Authorization: `Bearer ${token}` },\n *   });\n *   return res.json();\n * }\n * ```\n *\n * @packageDocumentation\n */\n\n/** Minimal cookie store interface (subset of Next.js ReadonlyRequestCookies) */\ninterface CookieStore {\n  get(name: string): { value: string } | undefined\n}\n\n/** The `cookies` function from `next/headers` */\ntype CookiesFn = () => CookieStore | Promise<CookieStore>\n\nexport interface ServerAccessOptions {\n  /**\n   * The `cookies` function imported from `next/headers`.\n   * Required — pass it explicitly to avoid bundler issues with dynamic imports.\n   *\n   * @example\n   * ```ts\n   * import { cookies } from \"next/headers\";\n   * createServerAccess({ cookies });\n   * ```\n   */\n  cookies: CookiesFn\n\n  /**\n   * Name of the httpOnly cookie that carries the access token.\n   * Must match the cookie set by the Azirid API.\n   * @default \"__session\"\n   */\n  cookieName?: string\n}\n\nexport interface ServerAccess {\n  /**\n   * Read the raw JWT access token from the session cookie.\n   * Returns `null` when no cookie is present or when called\n   * outside a Next.js server context.\n   */\n  getSessionToken: () => Promise<string | null>\n\n  /** Alias for {@link getSessionToken}. */\n  getAccessToken: () => Promise<string | null>\n}\n\n/**\n * Create server-side helpers bound to the session cookie.\n *\n * Call once at module scope, then use the returned functions\n * in any Server Component, Server Action, or Route Handler.\n */\nexport function createServerAccess(options: ServerAccessOptions): ServerAccess {\n  const { cookies, cookieName = '__session' } = options\n\n  async function getSessionToken(): Promise<string | null> {\n    try {\n      const result = cookies()\n      // Next.js 15+: cookies() returns a Promise\n      const cookieStore = result instanceof Promise ? await result : result\n      return cookieStore.get(cookieName)?.value ?? null\n    } catch {\n      return null\n    }\n  }\n\n  return {\n    getSessionToken,\n    getAccessToken: getSessionToken,\n  }\n}\n\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "azirid-react",
-  "version": "0.13.2",
+  "version": "0.14.1",
   "description": "Authentication components for React and Next.js — Login, Register, powered by TanStack Query and Zod.",
   "author": "Azirid",
   "license": "MIT",
@@ -38,10 +38,12 @@
   "types": "./dist/index.d.ts",
   "typesVersions": {
     "*": {
-      "next/handlers": ["./dist/next-handlers.d.ts"],
-      "next/proxy": ["./dist/next-proxy.d.ts"],
-      "next": ["./dist/next.d.ts"],
-      "server": ["./dist/server.d.ts"]
+      "next/proxy": [
+        "./dist/next-proxy.d.ts"
+      ],
+      "server": [
+        "./dist/server.d.ts"
+      ]
     }
   },
   "exports": {
@@ -65,16 +67,6 @@
         "default": "./dist/server.cjs"
       }
     },
-    "./next/handlers": {
-      "import": {
-        "types": "./dist/next-handlers.d.ts",
-        "default": "./dist/next-handlers.js"
-      },
-      "require": {
-        "types": "./dist/next-handlers.d.cts",
-        "default": "./dist/next-handlers.cjs"
-      }
-    },
     "./next/proxy": {
       "import": {
         "types": "./dist/next-proxy.d.ts",
@@ -85,16 +77,6 @@
         "default": "./dist/next-proxy.cjs"
       }
     },
-    "./next": {
-      "import": {
-        "types": "./dist/next.d.ts",
-        "default": "./dist/next.js"
-      },
-      "require": {
-        "types": "./dist/next.d.cts",
-        "default": "./dist/next.cjs"
-      }
-    },
     "./styles.css": "./dist/styles.css"
   },
   "files": [
@@ -122,6 +104,7 @@
     "@hookform/resolvers": "^4.1.3",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.0",
+    "jose": "^5.10.0",
     "radix-ui": "^1.4.3",
     "react-hook-form": "^7.71.2",
     "tailwind-merge": "^2.3.0",