From 684cd0288bfe6b4ba30e6bf50bd231a3749dc464 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 29 Aug 2026 22:04:41 +0000 Subject: [PATCH] Version Packages --- .changeset/nk-auth-composable-next.md | 26 -------------------------- .changeset/nk-dev-doctor-auth-next.md | 8 -------- packages/nk-auth/CHANGELOG.md | 27 +++++++++++++++++++++++++++ packages/nk-auth/package.json | 2 +- packages/nk-dev/CHANGELOG.md | 9 +++++++++ packages/nk-dev/package.json | 2 +- 6 files changed, 38 insertions(+), 36 deletions(-) delete mode 100644 .changeset/nk-auth-composable-next.md delete mode 100644 .changeset/nk-dev-doctor-auth-next.md diff --git a/.changeset/nk-auth-composable-next.md b/.changeset/nk-auth-composable-next.md deleted file mode 100644 index 3899b8a..0000000 --- a/.changeset/nk-auth-composable-next.md +++ /dev/null @@ -1,26 +0,0 @@ ---- -"@ingram-tech/nk-auth": minor ---- - -Make `next` preservation composable, and loud when it is missing. - -Until now `?next=` only survived a sign-in redirect if a site adopted both -`createAuthMiddleware` and `requireUser` verbatim: the middleware was the only -thing that set the `x-nk-auth-path` header, the guard's sign-in URL builder was -private, and a site that deviated from either lost `next` with no error. Every -"sign in to see this page" landed on the default page instead. - -- `@ingram-tech/nk-auth/middleware` exports the two halves of the middleware on - their own: `withAuthPathHeader(request, requestHeaders)` sets the header from - a custom proxy in one line (the same `requestHeaders` shape as nk-i18n's - `localeProxy`), and `clearStaleSession(request, config)` is the stale-cookie - handshake. `createAuthMiddleware`'s middleware also accepts - `{ requestHeaders }` so a site can forward its own headers through it. -- `createAuthHelpers` exports `signInTarget()`, the sign-in URL with `next` and - `stale` computed, so a site's own guard wrapper does - `redirect(await signInTarget())` instead of re-deriving it. -- Both accept `nextParam` (default `next`) and `isSafeNext` (default the - internal-path validator), for a site with an existing param name or a - trusted-origin allow-list. -- Outside production, `signInTarget()` warns once when the header is absent, - naming the two ways to wire it. diff --git a/.changeset/nk-dev-doctor-auth-next.md b/.changeset/nk-dev-doctor-auth-next.md deleted file mode 100644 index e70e663..0000000 --- a/.changeset/nk-dev-doctor-auth-next.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@ingram-tech/nk-dev": minor ---- - -`nk doctor` warns when a site binds `createAuthHelpers` but nothing sets the -`x-nk-auth-path` header (neither `createAuthMiddleware` nor -`withAuthPathHeader`): the guards' `?next=` is lost silently in that shape. -`guide.md` names the composable nk-auth middleware pieces. diff --git a/packages/nk-auth/CHANGELOG.md b/packages/nk-auth/CHANGELOG.md index c803890..8f31d08 100644 --- a/packages/nk-auth/CHANGELOG.md +++ b/packages/nk-auth/CHANGELOG.md @@ -1,5 +1,32 @@ # @ingram-tech/nk-auth +## 0.15.0 + +### Minor Changes + +- 907585f: Make `next` preservation composable, and loud when it is missing. + + Until now `?next=` only survived a sign-in redirect if a site adopted both + `createAuthMiddleware` and `requireUser` verbatim: the middleware was the only + thing that set the `x-nk-auth-path` header, the guard's sign-in URL builder was + private, and a site that deviated from either lost `next` with no error. Every + "sign in to see this page" landed on the default page instead. + + - `@ingram-tech/nk-auth/middleware` exports the two halves of the middleware on + their own: `withAuthPathHeader(request, requestHeaders)` sets the header from + a custom proxy in one line (the same `requestHeaders` shape as nk-i18n's + `localeProxy`), and `clearStaleSession(request, config)` is the stale-cookie + handshake. `createAuthMiddleware`'s middleware also accepts + `{ requestHeaders }` so a site can forward its own headers through it. + - `createAuthHelpers` exports `signInTarget()`, the sign-in URL with `next` and + `stale` computed, so a site's own guard wrapper does + `redirect(await signInTarget())` instead of re-deriving it. + - Both accept `nextParam` (default `next`) and `isSafeNext` (default the + internal-path validator), for a site with an existing param name or a + trusted-origin allow-list. + - Outside production, `signInTarget()` warns once when the header is absent, + naming the two ways to wire it. + ## 0.14.1 ### Patch Changes diff --git a/packages/nk-auth/package.json b/packages/nk-auth/package.json index b3d2ae3..9004bef 100644 --- a/packages/nk-auth/package.json +++ b/packages/nk-auth/package.json @@ -1,6 +1,6 @@ { "name": "@ingram-tech/nk-auth", - "version": "0.14.1", + "version": "0.15.0", "description": "The Ingram Better Auth foundation: composable presets (org, dual-shape JWT, active-org hooks, pg pool) for Next.js sites.", "license": "MIT", "type": "module", diff --git a/packages/nk-dev/CHANGELOG.md b/packages/nk-dev/CHANGELOG.md index 66db708..83f7fab 100644 --- a/packages/nk-dev/CHANGELOG.md +++ b/packages/nk-dev/CHANGELOG.md @@ -1,5 +1,14 @@ # @ingram-tech/nk-dev +## 0.14.0 + +### Minor Changes + +- 50efdf8: `nk doctor` warns when a site binds `createAuthHelpers` but nothing sets the + `x-nk-auth-path` header (neither `createAuthMiddleware` nor + `withAuthPathHeader`): the guards' `?next=` is lost silently in that shape. + `guide.md` names the composable nk-auth middleware pieces. + ## 0.13.1 ### Patch Changes diff --git a/packages/nk-dev/package.json b/packages/nk-dev/package.json index a5aa995..413fbfb 100644 --- a/packages/nk-dev/package.json +++ b/packages/nk-dev/package.json @@ -1,6 +1,6 @@ { "name": "@ingram-tech/nk-dev", - "version": "0.13.1", + "version": "0.14.0", "description": "The nextkit dev toolchain in one package: the `nk` CLI plus shared oxlint/oxfmt, TypeScript, and Vitest config, the format-on-commit hook, and the AI agent guide. `nk init` scaffolds a site to use it.", "license": "MIT", "type": "module",