{"_id":"@aegiskit/next","name":"@aegiskit/next","dist-tags":{"latest":"0.1.0"},"versions":{"0.1.0":{"name":"@aegiskit/next","version":"0.1.0","description":"Next.js (App Router) security adapters for Aegis: secure() middleware, secureRoute() handler wrapper, getNonce(), and a server-only env boundary.","license":"MIT","type":"module","sideEffects":false,"main":"./dist/index.js","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"},"./env":{"types":"./dist/env.d.ts","import":"./dist/env.js"}},"dependencies":{"server-only":"^0.0.1","zod":"^4.4.3","@aegiskit/core":"0.1.0"},"peerDependencies":{"next":">=15","react":">=18"},"devDependencies":{"@types/node":"^24.0.0","@types/react":"^19.0.0","fast-check":"^4.8.0","next":"^16.2.9","react":"^19.2.7","react-dom":"^19.2.7","tsup":"^8.5.1","typescript":"^6.0.3","vitest":"^4.1.9"},"engines":{"node":">=24.0.0"},"keywords":["security","nextjs","app-router","csp","middleware","csrf","security-headers","appsec"],"author":{"name":"tomodahinata"},"homepage":"https://github.com/tomodahinata/aegis/tree/main/packages/next#readme","repository":{"type":"git","url":"git+https://github.com/tomodahinata/aegis.git","directory":"packages/next"},"bugs":{"url":"https://github.com/tomodahinata/aegis/issues"},"publishConfig":{"access":"public"},"scripts":{"build":"tsup","typecheck":"tsc --noEmit"},"_id":"@aegiskit/next@0.1.0","_integrity":"sha512-A6tdUkjucdalCsLzlXPVAA/l3sLiP/q/AiFv2gdVKjHY8NtCIFaGvOGnLOmgqLWyQEr0NL5iS0qNXfxyB4gkgw==","_resolved":"/tmp/e49838c1970b1b20e7315712cc8979de/aegiskit-next-0.1.0.tgz","_from":"file:aegiskit-next-0.1.0.tgz","_nodeVersion":"24.17.0","_npmVersion":"11.13.0","dist":{"integrity":"sha512-A6tdUkjucdalCsLzlXPVAA/l3sLiP/q/AiFv2gdVKjHY8NtCIFaGvOGnLOmgqLWyQEr0NL5iS0qNXfxyB4gkgw==","shasum":"c3652291b7a1367b062ef70acd4bef9522a51e0b","tarball":"https://registry.npmjs.org/@aegiskit/next/-/next-0.1.0.tgz","fileCount":7,"unpackedSize":25986,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQCfHkNlfPOIe3dpvqyJr35m6bSDfmSEI6hUcG1cadUDEAIgHA4fpEFb09C/z+dzW5LTMlkMkSQ/53ifiU7gD8vck1Q="}]},"_npmUser":{"name":"tomodahinata","email":"hikaru.hinata.hikari@icloud.com"},"directories":{},"maintainers":[{"name":"tomodahinata","email":"hikaru.hinata.hikari@icloud.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/next_0.1.0_1782540504132_0.1053312980121568"},"_hasShrinkwrap":false}},"time":{"created":"2026-06-27T06:08:23.996Z","0.1.0":"2026-06-27T06:08:24.269Z","modified":"2026-06-27T06:08:24.477Z"},"maintainers":[{"name":"tomodahinata","email":"hikaru.hinata.hikari@icloud.com"}],"description":"Next.js (App Router) security adapters for Aegis: secure() middleware, secureRoute() handler wrapper, getNonce(), and a server-only env boundary.","homepage":"https://github.com/tomodahinata/aegis/tree/main/packages/next#readme","keywords":["security","nextjs","app-router","csp","middleware","csrf","security-headers","appsec"],"repository":{"type":"git","url":"git+https://github.com/tomodahinata/aegis.git","directory":"packages/next"},"author":{"name":"tomodahinata"},"bugs":{"url":"https://github.com/tomodahinata/aegis/issues"},"license":"MIT","readme":"# @aegiskit/next\n\nNext.js (App Router) security adapters for [Aegis](https://github.com/your-org/aegis). One middleware file gives you a hardened, nonce-based CSP, security headers, rate limiting, and origin/CSRF protection.\n\n> **Honest scope:** this closes the common, high-impact gaps automatically; it does not make your app \"completely secure\". Pair it with `@aegiskit/scanner` (for what a library can't auto-fix) and sound authorization design.\n\n## Install\n\n```bash\npnpm add @aegiskit/next @aegiskit/core\n```\n\n## 1. Middleware — the single CSP emitter\n\n`middleware.ts` (or `proxy.ts` in Next 16 — identical):\n\n```ts\nimport { secure } from '@aegiskit/next';\n\nexport default secure();\n\nexport const config = {\n  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],\n};\n```\n\n> **Migration:** remove any `Content-Security-Policy` from `next.config` — `secure()` is the **only** place CSP is emitted. (A static config CSP shadowing a per-request nonce is the exact bug this prevents.)\n\nRead the nonce in a Server Component to allow your own inline scripts:\n\n```tsx\n// app/layout.tsx\nimport { getNonce } from '@aegiskit/next';\n\nexport default async function RootLayout({ children }: { children: React.ReactNode }) {\n  const nonce = await getNonce();\n  return (\n    <html>\n      <body>\n        {children}\n        <script nonce={nonce} dangerouslySetInnerHTML={{ __html: '/* ... */' }} />\n      </body>\n    </html>\n  );\n}\n```\n\n`secure()` accepts a config: `csp`, `cspMode` (defaults to `report-only`; to drive it from an env var, pass `resolveCspMode(env.NEXT_PUBLIC_CSP_MODE)` resolved from your own typed env), `headers`, `rateLimit` (with a `RateLimiter` from `@aegiskit/core`), `origin`, `sink` (security events), and `chain` (compose your existing session/i18n middleware).\n\n## 2. Route handlers — `secureRoute`\n\nCustom Route Handlers get **no** CSRF protection by default. `secureRoute` adds method enforcement → origin check → rate limit → typed Zod validation:\n\n```ts\nimport { secureRoute } from '@aegiskit/next';\nimport { RateLimiter, RATE_LIMIT_PRESETS } from '@aegiskit/core';\nimport { createUpstashStore } from '@aegiskit/store-upstash';\nimport { Redis } from '@upstash/redis';\nimport { z } from 'zod';\n\nconst limiter = new RateLimiter({ store: createUpstashStore({ redis: Redis.fromEnv() }) });\n\nexport const POST = secureRoute(\n  {\n    method: 'POST',\n    body: z.object({ message: z.string().max(2000) }),\n    rateLimit: { limiter, rule: RATE_LIMIT_PRESETS.ai },\n  },\n  async ({ body }) => {\n    // `body` is fully typed: { message: string }\n    return Response.json({ echo: body.message });\n  },\n);\n```\n\n## 3. Typed env — `@aegiskit/next/env`\n\nImporting this module from a Client Component is a **build error** (it carries `server-only`), structurally preventing server-secret leaks:\n\n```ts\n// env.server.ts\nimport { defineServerEnv } from '@aegiskit/next/env';\nimport { z } from 'zod';\n\nexport const env = defineServerEnv({\n  server: { SUPABASE_SERVICE_ROLE_KEY: z.string().min(1) },\n  client: { NEXT_PUBLIC_SUPABASE_URL: z.string().url() },\n});\n```\n\n## Trade-off: nonce CSP forces dynamic rendering\n\nReading the nonce makes a route dynamic. Apply nonce-CSP to your authenticated (already-dynamic) segment, and keep static/marketing routes on a nonce-free policy or `csp: false`.\n\n## Composes with the platform\n\nThis is the **application** layer. It complements your platform's network-layer WAF/bot protection (e.g. Vercel Firewall/BotID) — they handle volumetric DDoS and known-bad bots; Aegis handles per-identity rate limits, CSRF on specific handlers, CSP, and typed validation.\n\n## License\n\nMIT\n","readmeFilename":"README.md","_rev":"1-ac0e673567cee12668e97e8b415e862a"}