Version Packages

packages/nk-auth/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @ingram-tech/nk-auth
 
+## 0.15.0
+
+### Minor Changes
+
+- 907585f: Make `next` preservation composable, and loud when it is missing.
+
+  Until now `?next=` only survived a sign-in redirect if a site adopted both
+  `createAuthMiddleware` and `requireUser` verbatim: the middleware was the only
+  thing that set the `x-nk-auth-path` header, the guard's sign-in URL builder was
+  private, and a site that deviated from either lost `next` with no error. Every
+  "sign in to see this page" landed on the default page instead.
+
+  - `@ingram-tech/nk-auth/middleware` exports the two halves of the middleware on
+    their own: `withAuthPathHeader(request, requestHeaders)` sets the header from
+    a custom proxy in one line (the same `requestHeaders` shape as nk-i18n's
+    `localeProxy`), and `clearStaleSession(request, config)` is the stale-cookie
+    handshake. `createAuthMiddleware`'s middleware also accepts
+    `{ requestHeaders }` so a site can forward its own headers through it.
+  - `createAuthHelpers` exports `signInTarget()`, the sign-in URL with `next` and
+    `stale` computed, so a site's own guard wrapper does
+    `redirect(await signInTarget())` instead of re-deriving it.
+  - Both accept `nextParam` (default `next`) and `isSafeNext` (default the
+    internal-path validator), for a site with an existing param name or a
+    trusted-origin allow-list.
+  - Outside production, `signInTarget()` warns once when the header is absent,
+    naming the two ways to wire it.
+
 ## 0.14.1
 
 ### Patch Changes

packages/nk-auth/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@ingram-tech/nk-auth",
-	"version": "0.14.1",
+	"version": "0.15.0",
 	"description": "The Ingram Better Auth foundation: composable presets (org, dual-shape JWT, active-org hooks, pg pool) for Next.js sites.",
 	"license": "MIT",
 	"type": "module",

packages/nk-dev/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @ingram-tech/nk-dev
 
+## 0.14.0
+
+### Minor Changes
+
+- 50efdf8: `nk doctor` warns when a site binds `createAuthHelpers` but nothing sets the
+  `x-nk-auth-path` header (neither `createAuthMiddleware` nor
+  `withAuthPathHeader`): the guards' `?next=` is lost silently in that shape.
+  `guide.md` names the composable nk-auth middleware pieces.
+
 ## 0.13.1
 
 ### Patch Changes

packages/nk-dev/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@ingram-tech/nk-dev",
-	"version": "0.13.1",
+	"version": "0.14.0",
 	"description": "The nextkit dev toolchain in one package: the `nk` CLI plus shared oxlint/oxfmt, TypeScript, and Vitest config, the format-on-commit hook, and the AI agent guide. `nk init` scaffolds a site to use it.",
 	"license": "MIT",
 	"type": "module",