naystack 1.7.41 → 1.8.1

package/dist/auth/instagram/utils.d.ts

@@ -21,18 +21,22 @@ declare function getLongLivedToken(code: string, redirectURL: string, clientId:
  * The state token is passed back by Instagram after authorization and is used to link
  * the Instagram account to the logged-in user.
  *
- * Reads `NEXT_PUBLIC_INSTAGRAM_CLIENT_ID` and `NEXT_PUBLIC_INSTAGRAM_AUTH_ENDPOINT` from the environment.
+ * Reads `INSTAGRAM_CLIENT_ID` and `NEXT_PUBLIC_INSTAGRAM_AUTH_ENDPOINT` from the environment.
+ *
+ * **Server-only** — reads the non-public `INSTAGRAM_CLIENT_ID`, so it must be
+ * called from server code (e.g. the Instagram auth route), not the client. The
+ * OAuth `client_id` still ends up in the redirect URL the browser follows; it is
+ * simply built on the server instead of shipped in the client bundle.
  *
  * @param token - The state token to embed in the authorization URL (typically the user's session or access token).
  * @returns The full Instagram OAuth authorization URL.
  *
  * @example
  * ```ts
- * import { getInstagramAuthorizationURL } from "naystack/auth/instagram/client";
+ * // In a server route handler:
+ * import { getInstagramAuthorizationURL } from "naystack/auth";
  *
- * const url = getInstagramAuthorizationURL(userAccessToken);
- * // => "https://www.instagram.com/oauth/authorize?client_id=...&state=...&redirect_uri=..."
- * window.location.href = url;
+ * return NextResponse.redirect(getInstagramAuthorizationURL(state), 302);
  * ```
  *
  * @category Auth

package/dist/auth/instagram/utils.esm.js

@@ -20,8 +20,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:
@@ -85,7 +85,7 @@ async function getLongLivedToken(code, redirectURL, clientId, clientSecret) {
   }
 }
 var getInstagramAuthorizationURL = (token) => `https://www.instagram.com/oauth/authorize?client_id=${getEnv(
-  "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */
+  "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */
 )}&response_type=code&enable_fb_login=0&force_authentication=1&scope=instagram_business_basic&state=${token}&redirect_uri=${getEnv("NEXT_PUBLIC_INSTAGRAM_AUTH_ENDPOINT" /* NEXT_PUBLIC_INSTAGRAM_AUTH_ENDPOINT */)}`;
 export {
   getInstagramAuthorizationURL,

package/dist/env.cjs.js

@@ -36,7 +36,7 @@ var EnvVariable = /* @__PURE__ */ ((EnvVariable2) => {
   EnvVariable2["REFRESH_KEY"] = "REFRESH_KEY";
   EnvVariable2["SIGNING_KEY"] = "SIGNING_KEY";
   EnvVariable2["INSTAGRAM_CLIENT_SECRET"] = "INSTAGRAM_CLIENT_SECRET";
-  EnvVariable2["NEXT_PUBLIC_INSTAGRAM_CLIENT_ID"] = "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID";
+  EnvVariable2["INSTAGRAM_CLIENT_ID"] = "INSTAGRAM_CLIENT_ID";
   EnvVariable2["GOOGLE_CLIENT_SECRET"] = "GOOGLE_CLIENT_SECRET";
   EnvVariable2["GOOGLE_CLIENT_ID"] = "GOOGLE_CLIENT_ID";
   EnvVariable2["TURNSTILE_KEY"] = "TURNSTILE_KEY";
@@ -72,8 +72,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:

package/dist/env.d.mts

@@ -23,8 +23,9 @@ declare enum EnvVariable {
     SIGNING_KEY = "SIGNING_KEY",
     /** Instagram app client secret (from Meta Developer Portal). */
     INSTAGRAM_CLIENT_SECRET = "INSTAGRAM_CLIENT_SECRET",
-    /** Instagram app client id (from Meta Developer Portal). */
-    NEXT_PUBLIC_INSTAGRAM_CLIENT_ID = "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID",
+    /** Instagram app client id (from Meta Developer Portal). Server-only — the
+     * authorization URL is built server-side, so it is not exposed to the client. */
+    INSTAGRAM_CLIENT_ID = "INSTAGRAM_CLIENT_ID",
     /** Google OAuth client secret (from Google Cloud Console). */
     GOOGLE_CLIENT_SECRET = "GOOGLE_CLIENT_SECRET",
     /** Google OAuth client id (from Google Cloud Console). */

package/dist/env.d.ts

@@ -23,8 +23,9 @@ declare enum EnvVariable {
     SIGNING_KEY = "SIGNING_KEY",
     /** Instagram app client secret (from Meta Developer Portal). */
     INSTAGRAM_CLIENT_SECRET = "INSTAGRAM_CLIENT_SECRET",
-    /** Instagram app client id (from Meta Developer Portal). */
-    NEXT_PUBLIC_INSTAGRAM_CLIENT_ID = "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID",
+    /** Instagram app client id (from Meta Developer Portal). Server-only — the
+     * authorization URL is built server-side, so it is not exposed to the client. */
+    INSTAGRAM_CLIENT_ID = "INSTAGRAM_CLIENT_ID",
     /** Google OAuth client secret (from Google Cloud Console). */
     GOOGLE_CLIENT_SECRET = "GOOGLE_CLIENT_SECRET",
     /** Google OAuth client id (from Google Cloud Console). */

package/dist/env.esm.js

@@ -9,7 +9,7 @@ var EnvVariable = /* @__PURE__ */ ((EnvVariable2) => {
   EnvVariable2["REFRESH_KEY"] = "REFRESH_KEY";
   EnvVariable2["SIGNING_KEY"] = "SIGNING_KEY";
   EnvVariable2["INSTAGRAM_CLIENT_SECRET"] = "INSTAGRAM_CLIENT_SECRET";
-  EnvVariable2["NEXT_PUBLIC_INSTAGRAM_CLIENT_ID"] = "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID";
+  EnvVariable2["INSTAGRAM_CLIENT_ID"] = "INSTAGRAM_CLIENT_ID";
   EnvVariable2["GOOGLE_CLIENT_SECRET"] = "GOOGLE_CLIENT_SECRET";
   EnvVariable2["GOOGLE_CLIENT_ID"] = "GOOGLE_CLIENT_ID";
   EnvVariable2["TURNSTILE_KEY"] = "TURNSTILE_KEY";
@@ -45,8 +45,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:

package/dist/file/client.cjs.js

@@ -47,8 +47,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:

package/dist/file/client.esm.js

@@ -23,8 +23,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:

package/dist/file/index.cjs.js

@@ -65,8 +65,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:

package/dist/file/index.esm.js

@@ -35,8 +35,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:

package/dist/file/put.cjs.js

@@ -59,8 +59,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:

package/dist/file/put.esm.js

@@ -35,8 +35,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:

package/dist/file/setup.cjs.js

@@ -61,8 +61,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:

package/dist/file/setup.esm.js

@@ -35,8 +35,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:

package/dist/file/utils.cjs.js

@@ -52,8 +52,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:

package/dist/file/utils.esm.js

@@ -28,8 +28,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:

package/dist/graphql/client.cjs.js

@@ -63,8 +63,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:

package/dist/graphql/client.esm.js

@@ -38,8 +38,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:

package/dist/graphql/index.cjs.js

@@ -601,8 +601,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:
@@ -770,8 +770,16 @@ function resolver(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getAuthCaller(fn),
-    call: options.authorized ? getAuthCaller(fn) : getCaller(fn)
+    authCall: getAuthCaller(
+      fn,
+      options.authorized
+    ),
+    call: options.authorized ? getAuthCaller(
+      fn,
+      options.authorized
+    ) : getCaller(
+      fn
+    )
   };
 }
 var getUserId = async () => {
@@ -779,11 +787,13 @@ var getUserId = async () => {
   const refresh = Cookie.get(REFRESH_COOKIE_NAME)?.value;
   return refresh ? getUserIdFromRefreshToken(refresh) : null;
 };
-function getAuthCaller(fn) {
+function getAuthCaller(fn, authorized) {
   return (0, import_react.cache)(
     async (data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(ctx, data);
@@ -801,11 +811,13 @@ function getCaller(fn) {
     }
   );
 }
-function getFieldAuthCaller(fn) {
+function getFieldAuthCaller(fn, authorized) {
   return (0, import_react.cache)(
     async (root, data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(root, ctx, data);
@@ -827,8 +839,8 @@ function field(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getFieldAuthCaller(fn),
-    call: options.authorized ? getFieldAuthCaller(fn) : getFieldCaller(
+    authCall: getFieldAuthCaller(fn, options.authorized),
+    call: options.authorized ? getFieldAuthCaller(fn, options.authorized) : getFieldCaller(
       fn
     )
   };
@@ -903,8 +915,12 @@ function FieldLibrary(type, queries) {
     const def = queries[key];
     if (!def) continue;
     Object.defineProperty(GeneratedResolver.prototype, key, {
+      // `alwaysResolve` fields must run `fn` even when the parent pre-hydrated
+      // `root[key]`: they gate on `ctx`, and the short-circuit would return the
+      // pre-hydrated value without ever applying that check. Such a resolver is
+      // responsible for reusing `root[key]` itself, so the N+1 win is preserved.
       value: async function(root, ctx, input) {
-        if (root[key]) return root[key];
+        if (!def.alwaysResolve && root[key]) return root[key];
         return def.fn(root, ctx, input);
       },
       writable: false

package/dist/graphql/index.esm.js

@@ -586,8 +586,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:
@@ -764,8 +764,16 @@ function resolver(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getAuthCaller(fn),
-    call: options.authorized ? getAuthCaller(fn) : getCaller(fn)
+    authCall: getAuthCaller(
+      fn,
+      options.authorized
+    ),
+    call: options.authorized ? getAuthCaller(
+      fn,
+      options.authorized
+    ) : getCaller(
+      fn
+    )
   };
 }
 var getUserId = async () => {
@@ -773,11 +781,13 @@ var getUserId = async () => {
   const refresh = Cookie.get(REFRESH_COOKIE_NAME)?.value;
   return refresh ? getUserIdFromRefreshToken(refresh) : null;
 };
-function getAuthCaller(fn) {
+function getAuthCaller(fn, authorized) {
   return cache(
     async (data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(ctx, data);
@@ -795,11 +805,13 @@ function getCaller(fn) {
     }
   );
 }
-function getFieldAuthCaller(fn) {
+function getFieldAuthCaller(fn, authorized) {
   return cache(
     async (root, data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(root, ctx, data);
@@ -821,8 +833,8 @@ function field(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getFieldAuthCaller(fn),
-    call: options.authorized ? getFieldAuthCaller(fn) : getFieldCaller(
+    authCall: getFieldAuthCaller(fn, options.authorized),
+    call: options.authorized ? getFieldAuthCaller(fn, options.authorized) : getFieldCaller(
       fn
     )
   };
@@ -897,8 +909,12 @@ function FieldLibrary(type, queries) {
     const def = queries[key];
     if (!def) continue;
     Object.defineProperty(GeneratedResolver.prototype, key, {
+      // `alwaysResolve` fields must run `fn` even when the parent pre-hydrated
+      // `root[key]`: they gate on `ctx`, and the short-circuit would return the
+      // pre-hydrated value without ever applying that check. Such a resolver is
+      // responsible for reusing `root[key]` itself, so the N+1 win is preserved.
       value: async function(root, ctx, input) {
-        if (root[key]) return root[key];
+        if (!def.alwaysResolve && root[key]) return root[key];
         return def.fn(root, ctx, input);
       },
       writable: false

package/dist/graphql/init.cjs.js

@@ -52,8 +52,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:

package/dist/graphql/init.esm.js

@@ -33,8 +33,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:

package/dist/graphql/next.cjs.js

@@ -60,8 +60,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:

package/dist/graphql/next.esm.js

@@ -31,8 +31,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:

package/dist/graphql/server.cjs.js

@@ -62,8 +62,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:

package/dist/graphql/server.esm.js

@@ -31,8 +31,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:

package/dist/graphql/utils.cjs.js

@@ -70,8 +70,8 @@ var getEnvValue = (key) => {
       return process.env.SIGNING_KEY;
     case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
       return process.env.INSTAGRAM_CLIENT_SECRET;
-    case "NEXT_PUBLIC_INSTAGRAM_CLIENT_ID" /* NEXT_PUBLIC_INSTAGRAM_CLIENT_ID */:
-      return process.env.NEXT_PUBLIC_INSTAGRAM_CLIENT_ID;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
     case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
       return process.env.GOOGLE_CLIENT_SECRET;
     case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:
@@ -117,8 +117,16 @@ function resolver(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getAuthCaller(fn),
-    call: options.authorized ? getAuthCaller(fn) : getCaller(fn)
+    authCall: getAuthCaller(
+      fn,
+      options.authorized
+    ),
+    call: options.authorized ? getAuthCaller(
+      fn,
+      options.authorized
+    ) : getCaller(
+      fn
+    )
   };
 }
 var getUserId = async () => {
@@ -126,11 +134,13 @@ var getUserId = async () => {
   const refresh = Cookie.get(REFRESH_COOKIE_NAME)?.value;
   return refresh ? getUserIdFromRefreshToken(refresh) : null;
 };
-function getAuthCaller(fn) {
+function getAuthCaller(fn, authorized) {
   return (0, import_react.cache)(
     async (data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(ctx, data);
@@ -148,11 +158,13 @@ function getCaller(fn) {
     }
   );
 }
-function getFieldAuthCaller(fn) {
+function getFieldAuthCaller(fn, authorized) {
   return (0, import_react.cache)(
     async (root, data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(root, ctx, data);
@@ -174,8 +186,8 @@ function field(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getFieldAuthCaller(fn),
-    call: options.authorized ? getFieldAuthCaller(fn) : getFieldCaller(
+    authCall: getFieldAuthCaller(fn, options.authorized),
+    call: options.authorized ? getFieldAuthCaller(fn, options.authorized) : getFieldCaller(
       fn
     )
   };
@@ -250,8 +262,12 @@ function FieldLibrary(type, queries) {
     const def = queries[key];
     if (!def) continue;
     Object.defineProperty(GeneratedResolver.prototype, key, {
+      // `alwaysResolve` fields must run `fn` even when the parent pre-hydrated
+      // `root[key]`: they gate on `ctx`, and the short-circuit would return the
+      // pre-hydrated value without ever applying that check. Such a resolver is
+      // responsible for reusing `root[key]` itself, so the N+1 win is preserved.
       value: async function(root, ctx, input) {
-        if (root[key]) return root[key];
+        if (!def.alwaysResolve && root[key]) return root[key];
         return def.fn(root, ctx, input);
       },
       writable: false