{"_id":"@sealed-api-gateway/core","_rev":"10-3cc8333b12ddc9b322470b050671c1f4","name":"@sealed-api-gateway/core","dist-tags":{"latest":"1.0.2"},"versions":{"0.1.1":{"name":"@sealed-api-gateway/core","version":"0.1.1","keywords":["nextjs","bff","api-gateway","encryption","ecdh","aes-gcm","network-tab","app-router"],"author":{"name":"JAINEEL PATEL"},"license":"MIT","_id":"@sealed-api-gateway/core@0.1.1","maintainers":[{"name":"jaineelpatel","email":"jaineelp2@gmail.com"}],"homepage":"https://github.com/JAINEELPATEL/sealed-api-gateway-npm#readme","bugs":{"url":"https://github.com/JAINEELPATEL/sealed-api-gateway-npm/issues"},"bin":{"sealed-gateway-key":"dist/cli.mjs"},"dist":{"shasum":"0e42dcc180180f2648aad14c48dbff2b34a7db97","tarball":"https://registry.npmjs.org/@sealed-api-gateway/core/-/core-0.1.1.tgz","fileCount":40,"integrity":"sha512-cd7XUATDOIyuaX9az0Q5Ghf6MTlLGuse8Nbl7EqBF5y4b+Fsw80NjSUVwFBlSLy+pzVfbuLEMve6uOmW8Z4+bQ==","signatures":[{"sig":"MEYCIQCQqT/9BWhc70BlAYB6BX7cn+P82HjPNBYoALoA9jsUCwIhAK4Mj2jQ0URY8X0a8Joju7MoKjh8S9UG7pyUx8UGA9RE","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":139525},"type":"module","types":"./dist/index.d.ts","engines":{"node":">=18.17"},"exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"},"./server":{"types":"./dist/server.d.ts","default":"./dist/server.js"},"./recorder":{"types":"./dist/recorder-entry.d.ts","default":"./dist/recorder-entry.js"},"./package.json":"./package.json"},"gitHead":"8e175a783b06efce9415b7140b2b8d88834f3f44","scripts":{"lint":"eslint .","test":"npm run build && node --import ./test/helpers/register-hooks.mjs --test \"test/*.test.mjs\"","build":"npm run clean && tsc -p tsconfig.build.json && node scripts/postbuild.mjs","check":"npm run lint && npm run type-check && npm run test && npm run verify && npm run verify:pack && npm run verify:publish","clean":"node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"","smoke":"npm run build && node scripts/smoke.mjs","verify":"node scripts/verify-dist.mjs","lint:fix":"eslint . --fix","test:watch":"node --import ./test/helpers/register-hooks.mjs --test --watch \"test/*.test.mjs\"","type-check":"tsc -p tsconfig.json --noEmit","verify:pack":"publint --strict && attw --pack . --ignore-rules cjs-resolves-to-esm","prepublishOnly":"npm run check","verify:publish":"node scripts/verify-publish.mjs"},"_npmUser":{"name":"jaineelpatel","email":"jaineelp2@gmail.com"},"repository":{"url":"git+https://github.com/JAINEELPATEL/sealed-api-gateway-npm.git","type":"git"},"_npmVersion":"11.16.0","description":"A same-origin BFF gateway for Next.js that seals every browser API call into one opaque POST. Zero dependencies, zero configuration.","directories":{},"sideEffects":false,"_nodeVersion":"24.18.0","publishConfig":{"access":"public"},"typesVersions":{"*":{"server":["./dist/server.d.ts"],"recorder":["./dist/recorder-entry.d.ts"]}},"_hasShrinkwrap":false,"devDependencies":{"next":"^16.2.12","react":"^19.2.0","eslint":"^9.39.1","publint":"^0.3.14","@eslint/js":"^9.39.1","typescript":"^5.9.2","@types/node":"^20.19.9","@types/react":"^19.0.0","typescript-eslint":"^8.46.4","@arethetypeswrong/cli":"^0.18.2"},"peerDependencies":{"next":">=13.4.0 <17","react":">=18.2.0 <20"},"_npmOperationalInternal":{"tmp":"tmp/core_0.1.1_1785768121622_0.4247072984289346","host":"s3://npm-registry-packages-npm-production"}},"0.2.1":{"name":"@sealed-api-gateway/core","version":"0.2.1","keywords":["nextjs","bff","api-gateway","encryption","ecdh","aes-gcm","network-tab","app-router"],"author":{"name":"JAINEEL PATEL"},"license":"MIT","_id":"@sealed-api-gateway/core@0.2.1","maintainers":[{"name":"jaineelpatel","email":"jaineelp2@gmail.com"}],"homepage":"https://github.com/JAINEELPATEL/sealed-api-gateway-npm#readme","bugs":{"url":"https://github.com/JAINEELPATEL/sealed-api-gateway-npm/issues"},"bin":{"sealed-gateway-key":"dist/cli.mjs"},"dist":{"shasum":"e7560ee828b80e6e5ddbd9d5a36f5f95683ce324","tarball":"https://registry.npmjs.org/@sealed-api-gateway/core/-/core-0.2.1.tgz","fileCount":40,"integrity":"sha512-MI6SkzN+JbuwE277D7ip83KjpyVsUk9Mku/ZWYj93el/tpfX1TAN6uD9MwiS4NuOPokEtWk6Zn/HwwwtFrzU6w==","signatures":[{"sig":"MEQCIGUlAmbyUu1Sv6L/NP0MpvMTVsSa/0sNSvmHyWSvkRIwAiA/RaXumN+ztyRY5RVUO026RWu+rDKCDwpgWdum4BooNg==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":139021},"type":"module","types":"./dist/index.d.ts","engines":{"node":">=18.17"},"exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"},"./server":{"types":"./dist/server.d.ts","default":"./dist/server.js"},"./recorder":{"types":"./dist/recorder-entry.d.ts","default":"./dist/recorder-entry.js"},"./package.json":"./package.json"},"gitHead":"8e175a783b06efce9415b7140b2b8d88834f3f44","scripts":{"build":"npm run clean && tsc -p tsconfig.build.json && node ../../scripts/postbuild.mjs","clean":"node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"","verify":"node ../../scripts/verify-dist.mjs","type-check":"tsc -p tsconfig.json --noEmit","verify:pack":"node ../../scripts/verify-pack.mjs","prepublishOnly":"npm run build && npm run verify && npm run verify:pack && npm run verify:publish","verify:publish":"node ../../scripts/verify-publish.mjs"},"_npmUser":{"name":"jaineelpatel","email":"jaineelp2@gmail.com"},"repository":{"url":"git+https://github.com/JAINEELPATEL/sealed-api-gateway-npm.git","type":"git","directory":"packages/core"},"_npmVersion":"11.16.0","description":"A same-origin BFF gateway for Next.js that seals every browser API call into one opaque POST. Zero dependencies, zero configuration.","directories":{},"sideEffects":false,"_nodeVersion":"24.18.0","publishConfig":{"access":"public"},"sealedGateway":{"copyToDist":["src/cli.mjs"],"clientModules":["dist/SecureApiGateway.js"],"serverOnlyModules":["dist/index.js"]},"typesVersions":{"*":{"server":["./dist/server.d.ts"],"recorder":["./dist/recorder-entry.d.ts"]}},"_hasShrinkwrap":false,"peerDependencies":{"next":">=13.4.0 <17","react":">=18.2.0 <20"},"_npmOperationalInternal":{"tmp":"tmp/core_0.2.1_1785778704504_0.8599024190026219","host":"s3://npm-registry-packages-npm-production"}},"0.3.0":{"name":"@sealed-api-gateway/core","version":"0.3.0","keywords":["nextjs","bff","api-gateway","encryption","ecdh","aes-gcm","network-tab","app-router"],"author":{"name":"JAINEEL PATEL"},"license":"MIT","_id":"@sealed-api-gateway/core@0.3.0","maintainers":[{"name":"jaineelpatel","email":"jaineelp2@gmail.com"}],"homepage":"https://github.com/JAINEELPATEL/sealed-api-gateway-npm#readme","bugs":{"url":"https://github.com/JAINEELPATEL/sealed-api-gateway-npm/issues"},"bin":{"sealed-gateway-key":"dist/cli.mjs","sealed-gateway-init":"dist/init.mjs"},"dist":{"shasum":"6a06b2df1aa66232c919638638ebc2f557e4db8a","tarball":"https://registry.npmjs.org/@sealed-api-gateway/core/-/core-0.3.0.tgz","fileCount":45,"integrity":"sha512-lz+vQYm52CIbKjmF9JHjrwWFSisXGcr4M84W1YHD9k++biyGm3ztK+Zfr9rGOHHrJKYO0xqYKdBv59JZg4iNZg==","signatures":[{"sig":"MEYCIQCLUBsJxj7BwVAF8Zy2+EMxx7JbUUVdssboZJ1iE92t2wIhAMVVOR9IhjCS5NrXZII20l5n4iVh5sc9Xnfgq2wA6jFm","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":158076},"type":"module","types":"./dist/index.d.ts","engines":{"node":">=18.17"},"exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"},"./server":{"types":"./dist/server.d.ts","default":"./dist/server.js"},"./recorder":{"types":"./dist/recorder-entry.d.ts","default":"./dist/recorder-entry.js"},"./package.json":"./package.json"},"gitHead":"8e175a783b06efce9415b7140b2b8d88834f3f44","scripts":{"build":"npm run clean && tsc -p tsconfig.build.json && node ../../scripts/postbuild.mjs","clean":"node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"","verify":"node ../../scripts/verify-dist.mjs","type-check":"tsc -p tsconfig.json --noEmit","verify:pack":"node ../../scripts/verify-pack.mjs","prepublishOnly":"npm run build && npm run verify && npm run verify:pack && npm run verify:publish","verify:publish":"node ../../scripts/verify-publish.mjs"},"_npmUser":{"name":"jaineelpatel","email":"jaineelp2@gmail.com"},"repository":{"url":"git+https://github.com/JAINEELPATEL/sealed-api-gateway-npm.git","type":"git","directory":"packages/core"},"_npmVersion":"11.16.0","description":"A same-origin BFF gateway for Next.js that seals every browser API call into one opaque POST. Zero dependencies, zero configuration.","directories":{},"sideEffects":false,"_nodeVersion":"24.18.0","publishConfig":{"access":"public"},"sealedGateway":{"copyToDist":["src/cli.mjs","src/init.mjs"],"clientModules":["dist/SecureApiGateway.js"],"serverOnlyModules":["dist/index.js"]},"typesVersions":{"*":{"server":["./dist/server.d.ts"],"recorder":["./dist/recorder-entry.d.ts"]}},"_hasShrinkwrap":false,"peerDependencies":{"next":">=13.4.0 <17","react":">=18.2.0 <20"},"_npmOperationalInternal":{"tmp":"tmp/core_0.3.0_1785780604706_0.6411165975049131","host":"s3://npm-registry-packages-npm-production"}},"0.4.0":{"name":"@sealed-api-gateway/core","version":"0.4.0","keywords":["nextjs","bff","api-gateway","encryption","ecdh","aes-gcm","network-tab","app-router"],"author":{"name":"JAINEEL PATEL"},"license":"MIT","_id":"@sealed-api-gateway/core@0.4.0","maintainers":[{"name":"jaineelpatel","email":"jaineelp2@gmail.com"}],"homepage":"https://github.com/JAINEELPATEL/sealed-api-gateway-npm#readme","bugs":{"url":"https://github.com/JAINEELPATEL/sealed-api-gateway-npm/issues"},"bin":{"sealed-gateway-key":"dist/cli.mjs","sealed-gateway-init":"dist/init.mjs"},"dist":{"shasum":"b0c5af5fd0ab304d3789627f9c69ed4bdff10341","tarball":"https://registry.npmjs.org/@sealed-api-gateway/core/-/core-0.4.0.tgz","fileCount":49,"integrity":"sha512-/YPFz+9XEuRJ0xrxUDfSS3EikLLlAilg1IdLh0bfpy7lLecbSrlMZ0UIrE0pDpeMRGZMqew3qUcmVICLcDw5WQ==","signatures":[{"sig":"MEUCIH+GIAfCxoDo650VzaLXO3JbXPGWC9saG7N0RLIdVkvSAiEAvLiGVRI266qsH2pAymA3mxS1qIHVAJ7uCeqMGogt9nI=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":168206},"type":"module","types":"./dist/index.d.ts","engines":{"node":">=18.17"},"exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"},"./server":{"types":"./dist/server.d.ts","default":"./dist/server.js"},"./recorder":{"types":"./dist/recorder-entry.d.ts","default":"./dist/recorder-entry.js"},"./package.json":"./package.json"},"gitHead":"8e175a783b06efce9415b7140b2b8d88834f3f44","scripts":{"build":"npm run clean && tsc -p tsconfig.build.json && node ../../scripts/postbuild.mjs","clean":"node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"","verify":"node ../../scripts/verify-dist.mjs","type-check":"tsc -p tsconfig.json --noEmit","verify:pack":"node ../../scripts/verify-pack.mjs","prepublishOnly":"npm run build && npm run verify && npm run verify:pack && npm run verify:publish","verify:publish":"node ../../scripts/verify-publish.mjs"},"_npmUser":{"name":"jaineelpatel","email":"jaineelp2@gmail.com"},"repository":{"url":"git+https://github.com/JAINEELPATEL/sealed-api-gateway-npm.git","type":"git","directory":"packages/core"},"_npmVersion":"11.16.0","description":"A same-origin BFF gateway for Next.js that seals every browser API call into one opaque POST. Zero dependencies, zero configuration.","directories":{},"sideEffects":false,"_nodeVersion":"24.18.0","publishConfig":{"access":"public"},"sealedGateway":{"copyToDist":["src/cli.mjs","src/init.mjs"],"clientModules":["dist/SecureApiGateway.js"],"serverOnlyModules":["dist/index.js"]},"typesVersions":{"*":{"server":["./dist/server.d.ts"],"recorder":["./dist/recorder-entry.d.ts"]}},"_hasShrinkwrap":false,"peerDependencies":{"next":">=13.4.0 <17","react":">=18.2.0 <20"},"_npmOperationalInternal":{"tmp":"tmp/core_0.4.0_1785785356846_0.9296398943286008","host":"s3://npm-registry-packages-npm-production"}},"1.0.0":{"name":"@sealed-api-gateway/core","version":"1.0.0","keywords":["nextjs","bff","api-gateway","encryption","ecdh","aes-gcm","network-tab","app-router"],"author":{"name":"JAINEEL PATEL"},"license":"MIT","_id":"@sealed-api-gateway/core@1.0.0","maintainers":[{"name":"jaineelpatel","email":"jaineelp2@gmail.com"}],"homepage":"https://github.com/JAINEELPATEL/sealed-api-gateway-npm#readme","bugs":{"url":"https://github.com/JAINEELPATEL/sealed-api-gateway-npm/issues"},"bin":{"sealed-gateway-key":"dist/cli.mjs","sealed-gateway-init":"dist/init.mjs"},"dist":{"shasum":"56b9a85ea5686786887852ea469d7cfaa3ddce81","tarball":"https://registry.npmjs.org/@sealed-api-gateway/core/-/core-1.0.0.tgz","fileCount":57,"integrity":"sha512-fjH7lqchZYt7WLKdrW6ZFfQ2BO/GcEgS7KbUsIepfgAPoNfhLXFiBSvn9pg0DgeOizFcRt9YSV0PepkT6TcIhg==","signatures":[{"sig":"MEUCIC/3Z7n/JxbR1Okz0F1zfkmcv3OhrkgiIJHY4WzoOuTlAiEArHdjyhF5/QK3xaD/9W4X3saBp8nB2/M7Cy8HX7PZW7w=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":197659},"type":"module","types":"./dist/index.d.ts","engines":{"node":">=18.17"},"exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"},"./server":{"types":"./dist/server.d.ts","default":"./dist/server.js"},"./recorder":{"types":"./dist/recorder-entry.d.ts","default":"./dist/recorder-entry.js"},"./package.json":"./package.json"},"gitHead":"8e175a783b06efce9415b7140b2b8d88834f3f44","scripts":{"build":"npm run clean && tsc -p tsconfig.build.json && node ../../scripts/postbuild.mjs","clean":"node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"","verify":"node ../../scripts/verify-dist.mjs","type-check":"tsc -p tsconfig.json --noEmit","verify:pack":"node ../../scripts/verify-pack.mjs","prepublishOnly":"npm run build && npm run verify && npm run verify:pack && npm run verify:publish","verify:publish":"node ../../scripts/verify-publish.mjs"},"_npmUser":{"name":"jaineelpatel","email":"jaineelp2@gmail.com"},"repository":{"url":"git+https://github.com/JAINEELPATEL/sealed-api-gateway-npm.git","type":"git","directory":"packages/core"},"_npmVersion":"11.16.0","description":"A same-origin BFF gateway for Next.js that seals every browser API call into one opaque POST. Zero dependencies, zero configuration.","directories":{},"sideEffects":false,"_nodeVersion":"24.18.0","publishConfig":{"access":"public"},"sealedGateway":{"copyToDist":["src/cli.mjs","src/init.mjs"],"clientModules":["dist/SecureApiGateway.js"],"serverOnlyModules":["dist/index.js","dist/actions.js","dist/transport.js"]},"typesVersions":{"*":{"server":["./dist/server.d.ts"],"recorder":["./dist/recorder-entry.d.ts"]}},"_hasShrinkwrap":false,"peerDependencies":{"next":">=13.4.0 <17","react":">=18.2.0 <20"},"_npmOperationalInternal":{"tmp":"tmp/core_1.0.0_1786114666886_0.7373814110402723","host":"s3://npm-registry-packages-npm-production"}},"1.0.1":{"name":"@sealed-api-gateway/core","version":"1.0.1","keywords":["nextjs","bff","api-gateway","encryption","ecdh","aes-gcm","network-tab","app-router"],"author":{"name":"JAINEEL PATEL"},"license":"MIT","_id":"@sealed-api-gateway/core@1.0.1","maintainers":[{"name":"jaineelpatel","email":"jaineelp2@gmail.com"}],"homepage":"https://github.com/JAINEELPATEL/sealed-api-gateway-npm#readme","bugs":{"url":"https://github.com/JAINEELPATEL/sealed-api-gateway-npm/issues"},"bin":{"sealed-gateway-key":"dist/cli.mjs","sealed-gateway-init":"dist/init.mjs"},"dist":{"shasum":"0bee31156900e1d24377ae7b535ffb6c18683a13","tarball":"https://registry.npmjs.org/@sealed-api-gateway/core/-/core-1.0.1.tgz","fileCount":57,"integrity":"sha512-7epQPcW3RPK5rxzpRzjV6UL6FJRzucKos3Zd4dIWAwOXvfE8zzdABq/TpN+czIFZOBacdrgjypmJXMLWB2juYA==","signatures":[{"sig":"MEUCIHKQxCxnjn/0EkISQ9k59Z5NUSLO5SpG/gUQ2dV8wPWoAiEA5CLll61iB8nLa8MT3E5e6ZA70z7Z5wtkxpiHXkUi/s8=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":199735},"type":"module","types":"./dist/index.d.ts","engines":{"node":">=18.17"},"exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"},"./server":{"types":"./dist/server.d.ts","default":"./dist/server.js"},"./recorder":{"types":"./dist/recorder-entry.d.ts","default":"./dist/recorder-entry.js"},"./package.json":"./package.json"},"gitHead":"8e175a783b06efce9415b7140b2b8d88834f3f44","scripts":{"build":"npm run clean && tsc -p tsconfig.build.json && node ../../scripts/postbuild.mjs","clean":"node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"","verify":"node ../../scripts/verify-dist.mjs","type-check":"tsc -p tsconfig.json --noEmit","verify:pack":"node ../../scripts/verify-pack.mjs","prepublishOnly":"npm run build && npm run verify && npm run verify:pack && npm run verify:publish","verify:publish":"node ../../scripts/verify-publish.mjs"},"_npmUser":{"name":"jaineelpatel","email":"jaineelp2@gmail.com"},"repository":{"url":"git+https://github.com/JAINEELPATEL/sealed-api-gateway-npm.git","type":"git","directory":"packages/core"},"_npmVersion":"11.16.0","description":"A same-origin BFF gateway for Next.js that seals every browser API call into one opaque POST. Zero dependencies, zero configuration.","directories":{},"sideEffects":false,"_nodeVersion":"24.18.0","publishConfig":{"access":"public"},"sealedGateway":{"copyToDist":["src/cli.mjs","src/init.mjs"],"clientModules":["dist/SecureApiGateway.js"],"serverOnlyModules":["dist/index.js","dist/actions.js","dist/transport.js"]},"typesVersions":{"*":{"server":["./dist/server.d.ts"],"recorder":["./dist/recorder-entry.d.ts"]}},"_hasShrinkwrap":false,"peerDependencies":{"next":">=13.4.0 <17","react":">=18.2.0 <20"},"_npmOperationalInternal":{"tmp":"tmp/core_1.0.1_1786115522434_0.6495659705445076","host":"s3://npm-registry-packages-npm-production"}},"1.0.2":{"name":"@sealed-api-gateway/core","version":"1.0.2","description":"A same-origin BFF gateway for Next.js that seals every browser API call into one opaque POST. Zero dependencies, zero configuration.","keywords":["nextjs","bff","api-gateway","encryption","ecdh","aes-gcm","network-tab","app-router"],"license":"MIT","author":{"name":"JAINEEL PATEL"},"repository":{"type":"git","url":"git+https://github.com/JAINEELPATEL/sealed-api-gateway-npm.git","directory":"packages/core"},"bugs":{"url":"https://github.com/JAINEELPATEL/sealed-api-gateway-npm/issues"},"homepage":"https://github.com/JAINEELPATEL/sealed-api-gateway-npm#readme","type":"module","sideEffects":false,"exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"},"./server":{"types":"./dist/server.d.ts","default":"./dist/server.js"},"./recorder":{"types":"./dist/recorder-entry.d.ts","default":"./dist/recorder-entry.js"},"./package.json":"./package.json"},"types":"./dist/index.d.ts","typesVersions":{"*":{"server":["./dist/server.d.ts"],"recorder":["./dist/recorder-entry.d.ts"]}},"bin":{"sealed-gateway-key":"dist/cli.mjs","sealed-gateway-init":"dist/init.mjs"},"engines":{"node":">=18.17"},"peerDependencies":{"next":">=13.4.0 <17","react":">=18.2.0 <20"},"scripts":{"clean":"node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"","build":"npm run clean && tsc -p tsconfig.build.json && node ../../scripts/postbuild.mjs","type-check":"tsc -p tsconfig.json --noEmit","verify":"node ../../scripts/verify-dist.mjs","verify:pack":"node ../../scripts/verify-pack.mjs","verify:publish":"node ../../scripts/verify-publish.mjs","prepublishOnly":"npm run build && npm run verify && npm run verify:pack && npm run verify:publish"},"publishConfig":{"access":"public"},"sealedGateway":{"clientModules":["dist/SecureApiGateway.js"],"serverOnlyModules":["dist/index.js","dist/actions.js","dist/transport.js"],"copyToDist":["src/cli.mjs","src/init.mjs"]},"gitHead":"8e175a783b06efce9415b7140b2b8d88834f3f44","_id":"@sealed-api-gateway/core@1.0.2","_nodeVersion":"24.18.0","_npmVersion":"11.16.0","dist":{"integrity":"sha512-QCsNvjnOnS0LO59Wt0EV3EnVmVEs8hAoNSPMU+ZJQxOAfDosrC4tHbeh3gE9/qU56oFh8gjxHei0o2Z5wkud2w==","shasum":"2a7abe4dc8930eb89567f1a1a82e010fb79ad4c5","tarball":"https://registry.npmjs.org/@sealed-api-gateway/core/-/core-1.0.2.tgz","fileCount":57,"unpackedSize":206093,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQDi9JjxTPDdKrN8hjkTz54xe1puJsJ/1F4DKPXhLftRIgIhAMxr6gJ3W2doZM/rsmXp11tH3Rg8qChafBRebYHnfrbp"}]},"_npmUser":{"name":"jaineelpatel","email":"jaineelp2@gmail.com"},"directories":{},"maintainers":[{"name":"jaineelpatel","email":"jaineelp2@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/core_1.0.2_1786118852099_0.639603669373985"},"_hasShrinkwrap":false}},"time":{"created":"2026-08-03T14:42:01.404Z","modified":"2026-08-07T16:07:32.465Z","0.1.0":"2026-08-02T12:23:56.621Z","0.1.1":"2026-08-03T14:42:01.788Z","0.2.1":"2026-08-03T17:38:24.650Z","0.3.0":"2026-08-03T18:10:04.860Z","0.4.0":"2026-08-03T19:29:17.023Z","1.0.0":"2026-08-07T14:57:47.012Z","1.0.1":"2026-08-07T15:12:02.599Z","1.0.2":"2026-08-07T16:07:32.228Z"},"bugs":{"url":"https://github.com/JAINEELPATEL/sealed-api-gateway-npm/issues"},"author":{"name":"JAINEEL PATEL"},"license":"MIT","homepage":"https://github.com/JAINEELPATEL/sealed-api-gateway-npm#readme","keywords":["nextjs","bff","api-gateway","encryption","ecdh","aes-gcm","network-tab","app-router"],"repository":{"type":"git","url":"git+https://github.com/JAINEELPATEL/sealed-api-gateway-npm.git","directory":"packages/core"},"description":"A same-origin BFF gateway for Next.js that seals every browser API call into one opaque POST. Zero dependencies, zero configuration.","maintainers":[{"name":"jaineelpatel","email":"jaineelp2@gmail.com"}],"readme":"<div align=\"center\">\n\n---\n\n## What it does\n\nWithout it, your Network tab tells anyone who opens DevTools exactly how your API works:\n\n```\nGET   https://api.example.com/v1/orders?page=2&status=pending    200\nPOST  https://api.example.com/v1/orders                          201\n      Authorization: Bearer eyJhbGciOi…\n```\n\nWith it, those same calls look like this:\n\n```\nPOST  /api/gw/_x    200\nPOST  /api/gw/_x    200\nPOST  /api/gw/_x    200\n```\n\nNo hostname. No path. No query string. No real status code. No response body. No `Cookie` or `Authorization` header.\n\nIt covers **every HTTP client at once** — `fetch`, `axios`, SWR, React Query — because it wraps the two browser primitives they all end up calling. Nothing in your own code changes.\n\n> [!IMPORTANT]\n> **This is obfuscation, not secrecy.** The browser has to decrypt in order to render, so anyone willing to read the running app gets the plaintext back, and your backend hostnames are still in the JavaScript bundle. It removes casual visibility; it does not make data secret. **Your backend must still authorize every request.** → [Threat model](#threat-model)\n\n---\n\n---\n\n## At a glance\n\n| | Supported |\n| --- | --- |\n| `fetch` | ✅ |\n| `axios` | ✅ |\n| React Query · SWR | ✅ |\n| Any client built on `fetch` or `XMLHttpRequest` | ✅ |\n| Next.js App Router | ✅ 13.4 – 16 |\n| Server Action transport (no route file) | ✅ default |\n| Route handler transport | ✅ fallback |\n| Automatic re-handshake and retry | ✅ |\n| Multi-instance / horizontal scaling | ✅ with `SECURE_GATEWAY_KEY` |\n| Zero runtime dependencies | ✅ |\n| Streaming responses | ❌ — [why](#design-decisions) |\n| Pages Router | ❌ |\n| Edge runtime | ❌ — [why](#design-decisions) |\n\n## Architecture\n\nBefore — every hop is visible in DevTools:\n\n```\n  Browser ──────────────────────────────▶ Backend\n           GET /v1/orders?page=2\n           Authorization: Bearer …\n```\n\nAfter — one opaque hop, and the second is server-to-server:\n\n```\n  Browser ──────────────▶ Your Next server ──────────────▶ Backend\n           POST (sealed)                    GET /v1/orders?page=2\n           no URL, no path,                 Authorization: Bearer …\n           no status, no headers\n```\n\nYour backend now only ever sees traffic from your own server, so it can be\nfirewalled to that single origin.\n\n\n## Contents\n\n- [Install](#install) · [Quick start](#quick-start)\n- [Configuration](#configuration) → [everything you can change](#everything-you-can-change)\n- [How it works](#how-it-works) · [Threat model](#threat-model)\n- [Compatibility](#compatibility) · [Troubleshooting](#troubleshooting)\n- [The debug console](#the-debug-console) · [API](#api)\n- [FAQ](#faq) · [Design decisions](#design-decisions) · [Security principles](#security-principles)\n- [Ecosystem](#ecosystem) · [Roadmap](#roadmap)\n\n---\n\n## Install\n\n```bash\nnpm i @sealed-api-gateway/core\n```\n\nPeers you almost certainly already have: `next` (≥ 13.4) and `react` (≥ 18.2). **Nothing else** — see [zero dependencies](#zero-dependencies).\n\n---\n\n## Quick start\n\n**Two steps.** No route file, no middleware change.\n\n### 1. Mount the component\n\n```tsx\n// app/layout.tsx\nimport { SecureApiGateway } from '@sealed-api-gateway/core';\n\nexport default function RootLayout({ children }: { children: React.ReactNode }) {\n  return (\n    <html lang=\"en\">\n      <body>\n        <SecureApiGateway />\n        {children}\n      </body>\n    </html>\n  );\n}\n```\n\n### 2. Point it at your backends\n\nAny one of these — they are additive, so use whichever matches how your project\nalready works:\n\n```bash\n# .env — if your backend URLs already live here, this is zero extra work\nNEXT_PUBLIC_API_URL=https://api.example.com\n\n# .env — an explicit list, if they do not\nSEALED_GATEWAY_ORIGINS=https://api.example.com,https://auth.example.com\n```\n\n```json\n// sealed-gateway.config.json — if you hardcode URLs in code\n{ \"origins\": [\"https://api.example.com\", \"https://auth.example.com\"] }\n```\n\nRestart, open DevTools, and your API calls are gone.\n\n> [!TIP]\n> No axios instance to rewire, no endpoint list, no per-call opt-in. Requests to\n> origins you have *not* declared — S3 presigned uploads, analytics, fonts — are\n> left completely untouched.\n\n---\n\n## Do I need a route file?\n\n**Usually not.** The gateway reaches its server half through **Server Actions**,\nfor which Next creates an endpoint automatically — nothing to add to your `app/`\ndirectory. On the wire that is a POST to the current page URL, so there is not\neven a `/api/gw/_x` to notice.\n\nYou need one in exactly three cases:\n\n| Situation | Why |\n| --- | --- |\n| **You installed [`@sealed-api-gateway/console`](https://www.npmjs.com/package/@sealed-api-gateway/console)** | It still reaches the gateway over HTTP for its handshake and unlock. |\n| **Next 13.4 / 13.5 without `experimental.serverActions`** | Server Actions are stable from Next 14; below that they need a config flag, and the route is the zero-config path. |\n| **You prefer a real endpoint** | Pass `transport=\"route\"` and it is used unconditionally. |\n\nIf any apply, the CLI writes it for you:\n\n```bash\nnpx sealed-gateway-init\n```\n\n```ts\n// app/api/gw/[...path]/route.ts        ← generated for you\nexport const dynamic = 'force-dynamic';\nexport const runtime = 'nodejs';\n\nexport { GET, POST } from '@sealed-api-gateway/core/server';\n```\n\n<details>\n<summary><b>Why a package cannot ship that file, and why the two literals matter</b></summary>\n\n<br>\n\nNext derives routes from the filesystem and offers no API for a library to\nregister one, so any route a package needs must physically exist in your project.\nThe CLI writes it so you never have to.\n\n**`dynamic` and `runtime` must be literal.** Next reads route-segment config by\nstatic analysis *before any code runs*, so a re-exported value is invisible to it.\nThe route would be statically optimised, and every visitor served one cached\nhandshake — containing the same ephemeral key. `runtime = 'nodejs'` is likewise\nrequired: the crypto uses Node APIs the Edge runtime does not provide.\n\n```bash\nnpx sealed-gateway-init --dry-run           # print it, write nothing\nnpx sealed-gateway-init --route /api/proxy  # mount somewhere else\nnpx sealed-gateway-init --dir src/app       # if auto-detection misses\n```\n\n</details>\n\n### Choosing the transport\n\n| `transport` | Behaviour |\n| --- | --- |\n| `'auto'` *(default)* | Prefer Server Actions; fall back to the route if unavailable. Decided by **trying**, not by checking versions — `experimental.serverActions` is not observable from the client, and a wrong guess would silently disable the gateway. |\n| `'action'` | Force Server Actions. Fails loudly if unusable. |\n| `'route'` | Force the mounted route. |\n\n```tsx\n<SecureApiGateway transport=\"route\" />\n```\n\n---\n\n## Configuration\n\nThe gateway needs **no configuration to work**. Everything below is optional.\n\n### The one thing you must declare: your backends\n\nThree sources, additive — use whichever suits your project:\n\n| Source | Declare it like | Best for |\n| --- | --- | --- |\n| `NEXT_PUBLIC_*` variables | `NEXT_PUBLIC_API_URL=https://api.example.com` | Projects already keeping backend URLs in the environment — zero extra work |\n| `SEALED_GATEWAY_ORIGINS` | `SEALED_GATEWAY_ORIGINS=https://a.example.com,https://b.example.com` | URLs that live nowhere in the environment |\n| `sealed-gateway.config.json` | `{ \"origins\": [\"https://api.example.com\"] }` | Projects that hardcode URLs in code and would rather declare them there |\n\nJSON rather than JS for the config file, deliberately: the server reads it at\nruntime from inside a security boundary, and a format that had to be *executed*\nwould mean running project code there. A malformed file throws naming the\noffending entry rather than being ignored.\n\n> [!WARNING]\n> **This list is the security boundary.** The browser names its own target inside the sealed envelope, so without an allowlist the gateway would be an open relay into whatever your server can reach. Because the list comes from the environment — which a caller cannot influence — only your declared backends are reachable; anything else is rejected with `403`.\n>\n> Only `http:` and `https:` are honoured. `file:`, `ftp:`, `data:` and `javascript:` all parse as valid URLs and are refused.\n\n### Everything you can change\n\nEvery value below has a working default. Set none of them and the gateway behaves exactly as documented.\n\n#### Environment variables — server-only\n\n| Variable                                  | Default           | What it changes                                                                                                |\n| ----------------------------------------- | ----------------- | -------------------------------------------------------------------------------------------------------------- |\n| `SECURE_GATEWAY_KEY`                    | generated at boot | Pins the encryption keypair.**Required for multi-instance deploys** → [why](#multi-instance-deployments) |\n| `SECURE_GATEWAY_PASSWORD`               | unset             | Switches on the[debug console](#the-debug-console). Unset ⇒ nothing is recorded anywhere.                      |\n| `SECURE_GATEWAY_TIMEOUT_MS`             | `30000`         | How long to wait for your backend. Range 1 000 – 300 000.                                                     |\n| `SECURE_GATEWAY_MAX_BODY_MB`            | `25`            | Largest sealed request accepted. Range 1 – 512. A memory guard, not a policy.                                 |\n| `SECURE_GATEWAY_RATE_LIMIT`             | `600`           | Requests per minute per IP against the sealed endpoint.                                                        |\n| `SECURE_GATEWAY_UNLOCK_TTL_HOURS`       | `8`             | How long a console unlock lasts. Range 1 – 720.                                                               |\n| `SECURE_GATEWAY_FORWARD_HEADERS`        | —                | **Extra** request headers to forward, comma-separated. `x-tenant-id,x-trace`                           |\n| `SECURE_GATEWAY_BLOCK_RESPONSE_HEADERS` | —                | **Extra** response headers to withhold, comma-separated.                                                 |\n\nA malformed value **throws at boot**, naming the variable and the value, rather than silently falling back. `SECURE_GATEWAY_TIMEOUT_MS=30s` quietly becoming 30 seconds would be indistinguishable from it working.\n\n#### Component props\n\n| Prop         | Type       | Default       | What it changes                                                                   |\n| ------------ | ---------- | ------------- | --------------------------------------------------------------------------------- |\n| `basePath` | `string` | `'/api/gw'` | Where you mounted the route. Must match the folder holding`[...path]/route.ts`. |\n\n```tsx\n<SecureApiGateway basePath=\"/api/proxy\" />\n```\n\n#### What you deliberately cannot change\n\n| Fixed behaviour                                                 | Why                                                                                                                                               |\n| --------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `set-cookie` is always stripped from responses                | An upstream setting cookies on*your* origin through the proxy is session fixation.                                                              |\n| `content-length` and `content-encoding` are always stripped | The body is re-serialised, so the original values would be lies the browser acts on.                                                              |\n| Forwarded headers are an**allowlist**, never a blocklist  | A header the browser can set and the gateway blindly relays is a path past your app into your own backend. You can add to it; you cannot open it. |\n| The wire carries only`GET` and `POST`                       | Every other verb travels*inside* the envelope. More verbs on the wire would be more for an observer to distinguish.                             |\n\n### Multi-instance deployments\n\nWithout `SECURE_GATEWAY_KEY`, each server process generates its own keypair. A browser that handshook with instance A gets a `409` from instance B, re-handshakes and retries — and across several instances a real share of requests exhaust their retries:\n\n| Instances | Calls that fail |\n| --------- | --------------- |\n| 1         | 0 %             |\n| 2         | ~13 %           |\n| 3         | ~30 %           |\n| 4         | ~42 %           |\n\n**Single process: skip it. PM2 cluster, Kubernetes replicas, or serverless: set it.**\n\n```bash\nnpx sealed-gateway-key >> .env     # then restart\n```\n\nThe generator strips any previous `SECURE_GATEWAY_KEY` line rather than accumulating them.\n\n> [!CAUTION]\n> `SECURE_GATEWAY_KEY` is **server-only**. Never prefix it with `NEXT_PUBLIC_` — that would inline the private key into the browser bundle and let anyone decrypt the traffic.\n\n---\n\n## How it works\n\n```\nbrowser ──POST /api/gw/_x──▶ your Next server ──GET https://api.example.com/v1/orders?page=2──▶ backend\n        ◀──200 (sealed)────                    ◀──200 { … }───────────────────────────────────\n```\n\nECIES-style, and **stateless on the server**:\n\n1. The server holds a P-256 keypair — from `SECURE_GATEWAY_KEY`, or generated at boot.\n2. `GET /api/gw/_pk` returns its **public** key plus the origin allowlist.\n3. The browser generates an ephemeral P-256 pair and ECDH-derives a shared **AES-GCM-256** key.\n4. Every request carries the browser's ephemeral public key, so the server re-derives the same key per request and needs **no session store** — it survives cold starts and horizontal scaling.\n5. Envelope on the wire: `base64( ephemeralPublicKey ‖ iv ‖ ciphertext )`.\n6. The response is sealed with the same key and a fresh IV. **The wire status is always `200`** — the real status is inside.\n\nA stale key yields `409`; the client re-handshakes and retries up to three times.\n\n---\n\n## Threat model\n\n### What it defends\n\n| Threat                                 | How                                                                                              |\n| -------------------------------------- | ------------------------------------------------------------------------------------------------ |\n| Casual enumeration of your API surface | Paths, query strings and statuses never appear on the wire                                       |\n| Token harvesting from the Network tab  | The token travels inside the ciphertext, not in a header or cookie                               |\n| Direct traffic to your backend         | It only ever receives requests from your Next server, so it can be firewalled to that one origin |\n| Scrapers built by reading DevTools     | The observable surface is one opaque endpoint                                                    |\n\n### What it does not\n\n| Not defended                                     | Why                                                                                                        |\n| ------------------------------------------------ | ---------------------------------------------------------------------------------------------------------- |\n| A determined operator of the browser             | Decryption is client-side by necessity — hook`fetch` before the gateway does and the plaintext is yours |\n| Discovery of backend hostnames                   | They ship in the client bundle, because the browser must know what to route                                |\n| An unauthenticated or over-permissive backend    | The gateway forwards requests; it does not authorize them                                                  |\n| That a request happened, its size, or its timing | Only the contents are hidden                                                                               |\n\n---\n\n## Compatibility\n\n|                   | Supported                                                                                                                                           |\n| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |\n| **Next.js** | 13.4 – 16, App Router                                                                                                                              |\n| **React**   | 18.2 – 19                                                                                                                                          |\n| **Node**    | ≥ 18.17 — the crypto uses`globalThis.crypto.subtle`                                                                                             |\n| **Runtime** | `nodejs`. Edge is not supported.                                                                                                                  |\n| **Context** | HTTPS or`localhost`. In a non-secure context `crypto.subtle` is unavailable and the module declines to patch anything rather than half-working. |\n\nOn Next 13/14 with React 19, npm needs `--legacy-peer-deps` — those versions declare `react: ^18.2.0`. It builds and runs; the metadata simply predates React 19.\n\n**Pages Router is not supported.** The route handler is App Router only.\n\n---\n\n## Zero dependencies\n\n`\"dependencies\": {}`, enforced by a test and by `prepublishOnly`. The crypto is `globalThis.crypto.subtle` directly — no `node-forge`, no `jose`, no polyfill. Your lockfile grows by one line.\n\n---\n\n## Limitations\n\nDesign consequences, not defects:\n\n- **Responses cannot stream.** A body must be complete before it can be encrypted.\n- **Upload and download progress events do not fire**, and `xhr.timeout` is not honoured on sealed calls.\n- **`Request` objects passed to `fetch` bypass sealing** — their body is a stream that cannot be re-read. Pass a URL and `init` instead.\n- **The rate limiter is per-process.** Serverless instances do not share the counter; put a real limiter at the edge if you need a hard guarantee.\n\n---\n\n## Troubleshooting\n\n| Symptom                                                     | Cause                                                 | Fix                                                    |\n| ----------------------------------------------------------- | ----------------------------------------------------- | ------------------------------------------------------ |\n| Real URLs still visible in the Network tab                  | Not a secure context, so the module declined to patch | Serve over HTTPS or`localhost`                       |\n| Everything 404s                                             | Route file missing or in the wrong folder             | `npx sealed-gateway-init`                            |\n| `403` on a request that should work                       | Target origin is not in the allowlist                 | Add it as a`NEXT_PUBLIC_*_URL` and restart           |\n| Intermittent failures under load                            | Multiple instances, each with its own keypair         | Set`SECURE_GATEWAY_KEY`                              |\n| A`fetch` call is not sealed                               | A`Request` object was passed                        | Pass a URL and`init` instead                         |\n| Server throws at boot naming a`SECURE_GATEWAY_*` variable | A tunable has a malformed value                       | Fix it — the message names the variable and the value |\n| npm refuses to install on Next 13/14 + React 19             | Peer-dependency metadata                              | `npm install --legacy-peer-deps`                     |\n\n---\n\n## The debug console\n\nThe gateway makes traffic unreadable in DevTools. [`@sealed-api-gateway/console`](https://www.npmjs.com/package/@sealed-api-gateway/console) is where you read it back — a Network-tab-style inspector with a folding JSON tree, binary preview, Copy-as-cURL and charts.\n\nIt needs **no route file of its own**; its unlock endpoint hangs off the route you already created.\n\n```tsx\n<SecureApiGateway />\n<GatewayConsole />\n```\n\n```bash\nSECURE_GATEWAY_PASSWORD=pick-something-long\n```\n\nThen Ctrl/Cmd + Shift + D on any page.\n\n---\n\n## API\n\n```ts\n// client\nimport { SecureApiGateway, DEFAULT_GATEWAY_ROOT, getGatewayRoot, setGatewayRoot } from '@sealed-api-gateway/core';\n\n// server — route handlers, the allowlist, the crypto primitives, the tunables\nimport { GET, POST, deriveOrigins, seal, open, timeoutMs, rateLimit } from '@sealed-api-gateway/core/server';\n\n// the plaintext log, shaped for useSyncExternalStore\nimport { subscribe, getEntries, getServerEntries } from '@sealed-api-gateway/core/recorder';\n```\n\n---\n\n---\n\n## FAQ\n\n**Does this replace authentication?**\nNo. The gateway forwards requests; it does not authorize them. An endpoint that\nis unsafe when called directly is equally unsafe through the gateway.\n\n**Does it stop attackers?**\nNo. It removes casual visibility from the Network tab. Treat it as defence in\ndepth, never as the defence.\n\n**Can backend URLs still be found?**\nYes — they are in the JavaScript bundle, because the browser has to know what to\nroute. The gateway hides them from the *network tab*, not from the bundle.\n\n**Are requests actually encrypted?**\nYes. ECDH P-256 key agreement, AES-GCM-256 per request with a fresh IV.\n\n**Does it work with axios / fetch / React Query / SWR?**\nAll of them, unmodified. It wraps `window.fetch` and `XMLHttpRequest`, which\nevery browser HTTP client ends up calling.\n\n**Does it affect SSR or Server Components?**\nNo. It patches browser globals only; server-side fetches are untouched.\n\n**Does it support streaming responses?**\nNo — see [design decisions](#design-decisions).\n\n**What happens if I set no password?**\nThe debug console does not exist, its endpoint 404s, and nothing is recorded\nanywhere. That is the default.\n\n**Can it run on Kubernetes / PM2 / serverless?**\nYes. Set `SECURE_GATEWAY_KEY` so every instance shares one keypair — without it\neach process generates its own and clients re-handshake on instance switches.\n\n**Does it work behind a reverse proxy or CDN?**\nYes. Forward `x-forwarded-for` if you want the per-IP rate limit to see real\nclient addresses rather than your proxy.\n\n---\n\n## Design decisions\n\nThe reasoning behind the choices most likely to raise an eyebrow.\n\n**Why only `GET` and `POST` on the wire?**\nEvery other verb travels *inside* the encrypted envelope and is reissued\nserver-side. Fewer observable request shapes make traffic less descriptive, and\nmore exported verbs would mean more surface for an observer to distinguish.\n\n**Why no streaming?**\nA body must be complete before it can be sealed — AES-GCM authenticates the whole\nmessage. Streaming and authenticated encryption of the full payload are mutually\nexclusive here, and silently shipping unauthenticated chunks would be worse than\nnot streaming.\n\n**Why AES-GCM?**\nIt is authenticated. A tampered ciphertext fails to decrypt rather than yielding\nplausible garbage, so a mangled body can never reach your application as data.\n\n**Why P-256 rather than X25519?**\n`crypto.subtle` supports P-256 in every browser and Node version in range.\nX25519 is cleaner but is not universally available, and a polyfill would break\nthe zero-dependency guarantee.\n\n**Why `nodejs` runtime, not Edge?**\nThe password check uses `node:crypto` for its timing-safe comparison, which Edge\ndoes not provide. A non-constant-time fallback would leak the password by timing.\n\n**Why zero dependencies?**\nThis is security-adjacent code. Every dependency is supply-chain risk and one\nmore thing an auditor has to read. The crypto is `globalThis.crypto.subtle`\ndirectly.\n\n**Why is the allowlist server-side and non-negotiable?**\nThe browser names its own target inside the envelope. If the client could add to\nthe allowlist, any caller could point the gateway at `169.254.169.254` and read\nyour cloud credentials. Fail-closed is the only safe default.\n\n---\n\n## Security principles\n\n- **Zero dependencies** — nothing to audit but this package.\n- **Stateless** — the shared key is re-derived per request; no session store,\n  survives cold starts and horizontal scaling.\n- **No cookies on sealed calls** — credentials travel inside the ciphertext.\n- **Per-request encryption** — a fresh IV every time.\n- **Explicit allowlist** — declared server-side, never by the client.\n- **Fail closed** — an unconfigured deployment grants nothing; a non-secure\n  context disables the module rather than half-working.\n- **Honest scope** — the README states what this does *not* protect, in the\n  first screen.\n\n---\n\n## Ecosystem\n\nWorks alongside, with no special configuration:\n\n| | |\n| --- | --- |\n| **Auth** | NextAuth · Auth.js · Clerk · your own |\n| **Data** | React Query · SWR · axios · `fetch` |\n| **Hosting** | Vercel · PM2 · Docker · Kubernetes · any Node host |\n\nAuth libraries are unaffected because the gateway operates below them: it patches\nthe transport, not the caller.\n\n---\n\n## Roadmap\n\n| Status | |\n| --- | --- |\n| ✅ | Gateway with Server Action and route transports |\n| ✅ | Password-gated debug console |\n| ✅ | Three ways to declare origins |\n| ☐ | Console on Server Actions, so it needs no route either |\n| ☐ | Wildcard origins — `https://*.example.com` |\n| ☐ | Deployment guides and worked examples |\n\n[Changelog](CHANGELOG.md) · [Issues](https://github.com/JAINEELPATEL/sealed-api-gateway-npm/issues) · [Contributing](https://github.com/JAINEELPATEL/sealed-api-gateway-npm/blob/main/CONTRIBUTING.md)\n\n\n## Licence\n\n[MIT](LICENSE) © 2026 JAINEEL PATEL\n","readmeFilename":"README.md"}