najm-auth 2.0.13 → 2.0.15

package/dist/{NajmAuthClient-0yzFb9CR.d.ts → NajmAuthClient-Cn9bObLB.d.ts}

@@ -222,6 +222,14 @@ declare class NajmAuthClient {
      */
     hydrate(session: HydrateSession | null): void;
     isHydrated(): boolean;
+    /**
+     * A fresh client with the same config — unhydrated, and without tab sync.
+     *
+     * Server rendering needs one client per request. A single process serves
+     * every user, so the hydration latch on a shared client would otherwise pin
+     * every later render to the first request's session.
+     */
+    fork(): NajmAuthClient;
     on<K extends AuthEvent>(event: K, handler: AuthEventHandler<K>): void;
     off<K extends AuthEvent>(event: K, handler: AuthEventHandler<K>): void;
     subscribe(listener: (state: AuthState) => void): () => void;

package/dist/client/index.d.ts

@@ -1,5 +1,5 @@
-import { D as DecodedToken, T as TabSyncMessage, S as SyncPayload } from '../NajmAuthClient-0yzFb9CR.js';
-export { A as AuthClientConfig, a as AuthError, b as AuthEvent, c as AuthEventHandler, d as AuthEventMap, e as AuthState, f as AuthUser, F as FetchClient, H as HydrateSession, N as NajmAuthClient, O as OAuthLoginOptions, g as OAuthProvider, R as RequestOptions, h as RetryConfig, i as ServerResponse, j as TokenPair, k as createAuthClient } from '../NajmAuthClient-0yzFb9CR.js';
+import { D as DecodedToken, T as TabSyncMessage, S as SyncPayload } from '../NajmAuthClient-Cn9bObLB.js';
+export { A as AuthClientConfig, a as AuthError, b as AuthEvent, c as AuthEventHandler, d as AuthEventMap, e as AuthState, f as AuthUser, F as FetchClient, H as HydrateSession, N as NajmAuthClient, O as OAuthLoginOptions, g as OAuthProvider, R as RequestOptions, h as RetryConfig, i as ServerResponse, j as TokenPair, k as createAuthClient } from '../NajmAuthClient-Cn9bObLB.js';
 
 /**
  * Decode a JWT token payload without verification.

package/dist/client/index.js

@@ -422,6 +422,16 @@ var NajmAuthClient = class _NajmAuthClient {
   isHydrated() {
     return this._hydrated;
   }
+  /**
+   * A fresh client with the same config — unhydrated, and without tab sync.
+   *
+   * Server rendering needs one client per request. A single process serves
+   * every user, so the hydration latch on a shared client would otherwise pin
+   * every later render to the first request's session.
+   */
+  fork() {
+    return new _NajmAuthClient({ ...this.config, tabSync: false });
+  }
   // =========================================================================
   // Events
   // =========================================================================
@@ -505,6 +515,7 @@ var NajmAuthClient = class _NajmAuthClient {
   }
   scheduleRefresh(decoded) {
     this.clearRefreshTimer();
+    if (typeof window === "undefined") return;
     const ttl = getTokenTTL(decoded);
     if (ttl <= 0) return;
     const delay = ttl * this.threshold * 1e3;

package/dist/client/react/index.d.ts

@@ -1,7 +1,7 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import * as react from 'react';
 import { ReactNode, CSSProperties, ReactElement } from 'react';
-import { N as NajmAuthClient, H as HydrateSession, e as AuthState, f as AuthUser, a as AuthError, O as OAuthLoginOptions, b as AuthEvent, d as AuthEventMap } from '../../NajmAuthClient-0yzFb9CR.js';
+import { N as NajmAuthClient, H as HydrateSession, e as AuthState, f as AuthUser, a as AuthError, O as OAuthLoginOptions, b as AuthEvent, d as AuthEventMap } from '../../NajmAuthClient-Cn9bObLB.js';
 
 interface AuthProviderProps {
     client: NajmAuthClient;

package/dist/client/react/index.js

@@ -3,7 +3,7 @@ var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
 // src/client/react/AuthProvider.tsx
-import { useEffect, useRef } from "react";
+import { useEffect, useRef, useState } from "react";
 
 // src/client/react/context.ts
 import { createContext, useContext } from "react";
@@ -49,12 +49,15 @@ function AuthProvider({
   initialSession,
   autoRefresh = true
 }) {
+  const [active] = useState(
+    () => typeof window === "undefined" && initialSession !== void 0 ? client.fork() : client
+  );
   const hydrated = useRef(false);
   if (!hydrated.current && initialSession !== void 0) {
-    client.hydrate(initialSession);
+    active.hydrate(initialSession);
     hydrated.current = true;
   }
-  return /* @__PURE__ */ jsxs(AuthClientContext.Provider, { value: client, children: [
+  return /* @__PURE__ */ jsxs(AuthClientContext.Provider, { value: active, children: [
     autoRefresh ? /* @__PURE__ */ jsx(AutoRefresh, {}) : null,
     children
   ] });
@@ -98,11 +101,11 @@ function useUser() {
 __name(useUser, "useUser");
 
 // src/client/react/useSession.ts
-import { useEffect as useEffect2, useRef as useRef2, useState } from "react";
+import { useEffect as useEffect2, useRef as useRef2, useState as useState2 } from "react";
 function useSession(opts) {
   const client = useAuthClient();
   const state = useAuth();
-  const [isLoading, setIsLoading] = useState(() => !client.isHydrated());
+  const [isLoading, setIsLoading] = useState2(() => !client.isHydrated());
   const didInit = useRef2(false);
   useEffect2(() => {
     if (didInit.current) return;
@@ -145,11 +148,11 @@ function usePermissions() {
 __name(usePermissions, "usePermissions");
 
 // src/client/react/useLogin.ts
-import { useCallback, useState as useState2 } from "react";
+import { useCallback, useState as useState3 } from "react";
 function useLogin(opts) {
   const client = useAuthClient();
-  const [isLoading, setIsLoading] = useState2(false);
-  const [error, setError] = useState2(null);
+  const [isLoading, setIsLoading] = useState3(false);
+  const [error, setError] = useState3(null);
   const login = useCallback(async (credentials) => {
     setIsLoading(true);
     setError(null);
@@ -169,11 +172,11 @@ function useLogin(opts) {
 __name(useLogin, "useLogin");
 
 // src/client/react/useRegister.ts
-import { useCallback as useCallback2, useState as useState3 } from "react";
+import { useCallback as useCallback2, useState as useState4 } from "react";
 function useRegister(opts) {
   const client = useAuthClient();
-  const [isLoading, setIsLoading] = useState3(false);
-  const [error, setError] = useState3(null);
+  const [isLoading, setIsLoading] = useState4(false);
+  const [error, setError] = useState4(null);
   const register = useCallback2(async (data) => {
     setIsLoading(true);
     setError(null);
@@ -193,10 +196,10 @@ function useRegister(opts) {
 __name(useRegister, "useRegister");
 
 // src/client/react/useLogout.ts
-import { useCallback as useCallback3, useState as useState4 } from "react";
+import { useCallback as useCallback3, useState as useState5 } from "react";
 function useLogout(opts) {
   const client = useAuthClient();
-  const [isLoading, setIsLoading] = useState4(false);
+  const [isLoading, setIsLoading] = useState5(false);
   const logout = useCallback3(async () => {
     setIsLoading(true);
     try {
@@ -218,12 +221,12 @@ function useLogout(opts) {
 __name(useLogout, "useLogout");
 
 // src/client/react/useForgotPassword.ts
-import { useCallback as useCallback4, useState as useState5 } from "react";
+import { useCallback as useCallback4, useState as useState6 } from "react";
 function useForgotPassword(opts) {
   const client = useAuthClient();
-  const [isLoading, setIsLoading] = useState5(false);
-  const [error, setError] = useState5(null);
-  const [isSuccess, setIsSuccess] = useState5(false);
+  const [isLoading, setIsLoading] = useState6(false);
+  const [error, setError] = useState6(null);
+  const [isSuccess, setIsSuccess] = useState6(false);
   const forgotPassword = useCallback4(async (data) => {
     setIsLoading(true);
     setError(null);
@@ -249,12 +252,12 @@ function useForgotPassword(opts) {
 __name(useForgotPassword, "useForgotPassword");
 
 // src/client/react/useResetPassword.ts
-import { useCallback as useCallback5, useState as useState6 } from "react";
+import { useCallback as useCallback5, useState as useState7 } from "react";
 function useResetPassword(opts) {
   const client = useAuthClient();
-  const [isLoading, setIsLoading] = useState6(false);
-  const [error, setError] = useState6(null);
-  const [isSuccess, setIsSuccess] = useState6(false);
+  const [isLoading, setIsLoading] = useState7(false);
+  const [error, setError] = useState7(null);
+  const [isSuccess, setIsSuccess] = useState7(false);
   const resetPassword = useCallback5(async (data) => {
     setIsLoading(true);
     setError(null);
@@ -280,12 +283,12 @@ function useResetPassword(opts) {
 __name(useResetPassword, "useResetPassword");
 
 // src/client/react/useChangePassword.ts
-import { useCallback as useCallback6, useState as useState7 } from "react";
+import { useCallback as useCallback6, useState as useState8 } from "react";
 function useChangePassword(opts) {
   const client = useAuthClient();
-  const [isLoading, setIsLoading] = useState7(false);
-  const [error, setError] = useState7(null);
-  const [isSuccess, setIsSuccess] = useState7(false);
+  const [isLoading, setIsLoading] = useState8(false);
+  const [error, setError] = useState8(null);
+  const [isSuccess, setIsSuccess] = useState8(false);
   const changePassword = useCallback6(async (data) => {
     setIsLoading(true);
     setError(null);
@@ -311,11 +314,11 @@ function useChangePassword(opts) {
 __name(useChangePassword, "useChangePassword");
 
 // src/client/react/useGoogleLogin.ts
-import { useCallback as useCallback7, useState as useState8 } from "react";
+import { useCallback as useCallback7, useState as useState9 } from "react";
 function useGoogleLogin(options) {
   const client = useAuthClient();
-  const [isRedirecting, setIsRedirecting] = useState8(false);
-  const [error, setError] = useState8(null);
+  const [isRedirecting, setIsRedirecting] = useState9(false);
+  const [error, setError] = useState9(null);
   const fail = useCallback7((value) => {
     const next = value instanceof Error ? value : new Error(String(value));
     setIsRedirecting(false);
@@ -345,12 +348,12 @@ function useGoogleLogin(options) {
 __name(useGoogleLogin, "useGoogleLogin");
 
 // src/client/react/useOAuthCallback.ts
-import { useCallback as useCallback8, useRef as useRef3, useState as useState9 } from "react";
+import { useCallback as useCallback8, useRef as useRef3, useState as useState10 } from "react";
 function useOAuthCallback(options) {
   const client = useAuthClient();
   const promise = useRef3(null);
-  const [isLoading, setIsLoading] = useState9(false);
-  const [error, setError] = useState9(null);
+  const [isLoading, setIsLoading] = useState10(false);
+  const [error, setError] = useState10(null);
   const complete = useCallback8(async () => {
     if (promise.current) return promise.current;
     setIsLoading(true);
@@ -388,7 +391,7 @@ function useAuthEvent(event, handler) {
 __name(useAuthEvent, "useAuthEvent");
 
 // src/client/react/useAuthEvents.ts
-import { useEffect as useEffect4, useRef as useRef5, useState as useState10 } from "react";
+import { useEffect as useEffect4, useRef as useRef5, useState as useState11 } from "react";
 var ALL_EVENTS = [
   "login",
   "logout",
@@ -401,7 +404,7 @@ var ALL_EVENTS = [
 function useAuthEvents(opts) {
   const client = useAuthClient();
   const max = opts?.maxEntries ?? 100;
-  const [entries, setEntries] = useState10([]);
+  const [entries, setEntries] = useState11([]);
   const maxRef = useRef5(max);
   maxRef.current = max;
   useEffect4(() => {

package/dist/client/server/index.d.ts

@@ -1,4 +1,4 @@
-import { f as AuthUser, F as FetchClient, N as NajmAuthClient, h as RetryConfig } from '../../NajmAuthClient-0yzFb9CR.js';
+import { f as AuthUser, F as FetchClient, N as NajmAuthClient, h as RetryConfig } from '../../NajmAuthClient-Cn9bObLB.js';
 import { SessionRecoveryFailure } from '../edge.js';
 export { SessionRecoveryErrorDetails, SessionRecoveryFailureReason, withAuthMiddleware } from '../edge.js';
 import 'next/server';
@@ -169,6 +169,16 @@ interface DefineAuthConfig {
     loginRoute?: string;
     /** Route to redirect after login (default: '/dashboard') */
     afterLoginRoute?: string;
+    /**
+     * Where an *authenticated* user goes when their role is not allowed
+     * (default: '/forbidden').
+     *
+     * Distinct from `loginRoute` on purpose. Sending them to the login form says
+     * "prove who you are" to someone who already has; they log in again, land
+     * back on the same page, and get bounced again. A forbidden page is the only
+     * response that terminates.
+     */
+    forbiddenRoute?: string;
     /** Routes that are always public (glob patterns) */
     publicRoutes?: string[];
     /** Routes that require authentication (glob patterns) */
@@ -212,6 +222,15 @@ interface AuthKit {
     getSession: (opts?: Pick<GetSessionConfig, 'mode'>) => Promise<ServerSession | null>;
     /** Require session — throws if unauthenticated */
     requireSession: () => Promise<ServerSession>;
+    /**
+     * Require one of `roles` — redirects to `loginRoute` when unauthenticated and
+     * to `forbiddenRoute` when authenticated as the wrong role.
+     *
+     * ```ts
+     * const session = await auth.requireRole(['admin', 'operator']);
+     * ```
+     */
+    requireRole: (roles: string[]) => Promise<ServerSession>;
     /** Generated Next.js middleware function */
     middleware: (request: Request) => Promise<Response>;
     /** Next.js middleware config with matcher */
@@ -232,4 +251,78 @@ interface AuthKit {
 }
 declare function defineAuth(authConfig?: DefineAuthConfig): AuthKit;
 
-export { AuthConfigError, type AuthKit, AuthTransportError, type DefineAuthConfig, type GetSessionConfig, NoSessionError, type ServerSession, SessionRecoveryFailure, type WithAuthOptions, type WithAuthProps, createServerClient, defineAuth, getServerSession, getSession, withAuth };
+interface SafeRedirectOptions {
+    /** Where to send anything rejected. Defaults to `/dashboard`. */
+    fallback?: string;
+    /**
+     * Path prefixes that are never a valid destination. Defaults to `/api`,
+     * `/login` and `/_next`.
+     *
+     * `/login` is on the list because bouncing back to it is the redirect loop
+     * this parameter causes most often: a user who just authenticated is sent
+     * straight back to the form they came from.
+     */
+    blockedPrefixes?: string[];
+}
+/**
+ * Reduces an untrusted `?next=` value to a path that is safe to redirect to.
+ *
+ * Only same-origin *paths* survive. An absolute URL is rejected outright rather
+ * than parsed and compared, because the comparison is where this goes wrong:
+ * `//evil.test` is a protocol-relative URL that browsers resolve off-site while
+ * a naive `startsWith('/')` check reads it as local. Anything that is not a
+ * single leading slash followed by a path is refused.
+ *
+ * ```ts
+ * redirect(getSafeRedirectPath(searchParams.next, { fallback: '/home' }));
+ * ```
+ */
+declare function getSafeRedirectPath(value: string | string[] | undefined | null, options?: SafeRedirectOptions | string): string;
+
+type RequestHandler = (request: Request) => Promise<Response>;
+interface AuthCookiePersistenceOptions {
+    /**
+     * Cookies whose lifetime this rewrites. Defaults to the two najm-auth issues.
+     * Anything not named here is passed through untouched.
+     */
+    authCookieNames?: string[];
+    /** Where the one-bit choice is stored. Defaults to `najm.remember`. */
+    rememberCookieName?: string;
+    /** How long a remembered choice lasts. Defaults to 7 days. */
+    maxAgeSeconds?: number;
+    /** Paths whose JSON body carries `rememberMe`. Defaults to `/api/auth/login`. */
+    loginPaths?: string[];
+    /** Paths that end a session and clear the choice. Defaults to `/api/auth/logout`. */
+    logoutPaths?: string[];
+    /** Paths that reissue cookies and must reapply the stored choice. */
+    refreshPaths?: string[];
+    /**
+     * Recognizes a response that has *not* issued a usable session because the
+     * user must still set up credentials.
+     *
+     * Such a response may carry auth cookies anyway, and persisting them would
+     * leave a half-authenticated browser that skips the setup step on reload.
+     * Returning `true` strips them and clears the stored choice.
+     */
+    isSetupResponse?: (payload: unknown) => boolean;
+}
+/**
+ * Strips the lifetime attributes so the browser drops the cookie when it closes.
+ *
+ * Only the named auth cookies are touched — rewriting an unrelated `Set-Cookie`
+ * from the same response would be a silent side effect on someone else's state.
+ */
+declare function makeSessionCookie(setCookie: string, authCookieNames?: string[]): string;
+/**
+ * Wraps a request handler so the auth cookies it issues match the user's
+ * "remember me" choice.
+ *
+ * ```ts
+ * // app/api/[...route]/route.ts
+ * const handler = withAuthCookiePersistence((req) => server.fetch(req));
+ * export { handler as GET, handler as POST };
+ * ```
+ */
+declare function withAuthCookiePersistence(handler: RequestHandler, options?: AuthCookiePersistenceOptions): RequestHandler;
+
+export { AuthConfigError, type AuthCookiePersistenceOptions, type AuthKit, AuthTransportError, type DefineAuthConfig, type GetSessionConfig, NoSessionError, type SafeRedirectOptions, type ServerSession, SessionRecoveryFailure, type WithAuthOptions, type WithAuthProps, createServerClient, defineAuth, getSafeRedirectPath, getServerSession, getSession, makeSessionCookie, withAuth, withAuthCookiePersistence };

package/dist/client/server/index.js

@@ -382,7 +382,7 @@ function requestOriginFromHeaders(headers) {
   }
 }
 async function getSession(config = {}) {
-  const cookieName = config.cookieName ?? "refreshToken";
+  const cookieName2 = config.cookieName ?? "refreshToken";
   const sessionCookieName = config.sessionCookieName ?? "najm.session";
   const baseURL = config.baseURL ?? defaultBaseURL();
   const prefix = config.authPrefix ?? "/auth";
@@ -395,7 +395,7 @@ async function getSession(config = {}) {
     const mod = await import("next/headers");
     const cookieStore = await mod.cookies();
     sessionCookieValue = cookieStore.get(sessionCookieName)?.value;
-    refreshCookieValue = cookieStore.get(cookieName)?.value;
+    refreshCookieValue = cookieStore.get(cookieName2)?.value;
     if (typeof mod.headers === "function") {
       requestOrigin = requestOriginFromHeaders(await mod.headers());
     }
@@ -434,7 +434,7 @@ async function getSession(config = {}) {
     endpoint,
     requestOrigin,
     allowLoopbackEndpoint: internalRecoveryURL !== void 0,
-    refreshCookieName: cookieName,
+    refreshCookieName: cookieName2,
     refreshCookieValue,
     sessionCookieName,
     sessionSecret: secret,
@@ -700,7 +700,7 @@ function withAuthMiddleware(config) {
     publicRoutes = [],
     loginRoute = "/login",
     roleRoutes = {},
-    cookieName = "refreshToken",
+    cookieName: cookieName2 = "refreshToken",
     apiBaseURL = "/api",
     authPrefix = "/auth",
     sessionCookieName = "najm.session",
@@ -719,7 +719,7 @@ function withAuthMiddleware(config) {
       loginUrl.searchParams.set("from", returnPath2);
       const res = NextResponse.redirect(loginUrl);
       if (clearCookies.includes("refresh")) {
-        res.cookies.delete(cookieName);
+        res.cookies.delete(cookieName2);
       }
       if (clearCookies.includes("session")) {
         res.cookies.delete(sessionCookieName);
@@ -746,7 +746,7 @@ function withAuthMiddleware(config) {
     }) : null;
     let recovery = null;
     if (!session || verifyAlways) {
-      const refreshCookie = readCookieValue(cookie, cookieName);
+      const refreshCookie = readCookieValue(cookie, cookieName2);
       if (!refreshCookie || recoveryURL === false && !resolvedInternalRecoveryURL) {
         return redirectToLogin(returnPath, ["refresh", "session"]);
       }
@@ -755,7 +755,7 @@ function withAuthMiddleware(config) {
         endpoint,
         requestOrigin: url.origin,
         allowLoopbackEndpoint: resolvedInternalRecoveryURL !== void 0,
-        refreshCookieName: cookieName,
+        refreshCookieName: cookieName2,
         refreshCookieValue: refreshCookie,
         sessionCookieName,
         sessionSecret: secret,
@@ -1119,6 +1119,16 @@ var NajmAuthClient = class _NajmAuthClient {
   isHydrated() {
     return this._hydrated;
   }
+  /**
+   * A fresh client with the same config — unhydrated, and without tab sync.
+   *
+   * Server rendering needs one client per request. A single process serves
+   * every user, so the hydration latch on a shared client would otherwise pin
+   * every later render to the first request's session.
+   */
+  fork() {
+    return new _NajmAuthClient({ ...this.config, tabSync: false });
+  }
   // =========================================================================
   // Events
   // =========================================================================
@@ -1202,6 +1212,7 @@ var NajmAuthClient = class _NajmAuthClient {
   }
   scheduleRefresh(decoded) {
     this.clearRefreshTimer();
+    if (typeof window === "undefined") return;
     const ttl = getTokenTTL(decoded);
     if (ttl <= 0) return;
     const delay = ttl * this.threshold * 1e3;
@@ -1313,10 +1324,11 @@ function defineAuth(authConfig = {}) {
     apiBaseURL = "/api",
     authPrefix = "/auth",
     loginRoute = "/login",
+    forbiddenRoute = "/forbidden",
     publicRoutes = [],
     protectedRoutes = [],
     roleRoutes = {},
-    cookieName = "refreshToken",
+    cookieName: cookieName2 = "refreshToken",
     sessionCookieName = "najm.session",
     sessionSecret,
     sessionMaxAge,
@@ -1334,7 +1346,7 @@ function defineAuth(authConfig = {}) {
   const sessionConfig = {
     baseURL: apiBaseURL,
     authPrefix,
-    cookieName,
+    cookieName: cookieName2,
     sessionCookieName,
     sessionSecret,
     sessionMaxAge,
@@ -1382,12 +1394,21 @@ function defineAuth(authConfig = {}) {
       throw err;
     }
   }, "requireSession");
+  const requireRole = /* @__PURE__ */ __name(async (roles) => {
+    const session = await requireSession();
+    const held = session.roles ?? (session.user.role ? [session.user.role] : []);
+    if (!held.some((role) => roles.includes(role))) {
+      const { redirect } = await import("next/navigation");
+      redirect(forbiddenRoute);
+    }
+    return session;
+  }, "requireRole");
   const middleware = withAuthMiddleware({
     protectedRoutes,
     publicRoutes,
     loginRoute,
     roleRoutes,
-    cookieName,
+    cookieName: cookieName2,
     apiBaseURL,
     authPrefix,
     sessionCookieName,
@@ -1409,7 +1430,7 @@ function defineAuth(authConfig = {}) {
         const userRoles = session.roles ?? (session.user.role ? [session.user.role] : []);
         if (!userRoles.includes(options.role)) {
           const { redirect } = await import("next/navigation");
-          redirect(loginRoute);
+          redirect(forbiddenRoute);
         }
       }
       if (options?.permission) {
@@ -1417,7 +1438,7 @@ function defineAuth(authConfig = {}) {
         const perms = session.permissions ?? session.user.permissions ?? [];
         if (!matchPermission2(perms, options.permission)) {
           const { redirect } = await import("next/navigation");
-          redirect(loginRoute);
+          redirect(forbiddenRoute);
         }
       }
       return Page({ session, ...props });
@@ -1432,20 +1453,173 @@ function defineAuth(authConfig = {}) {
     },
     getSession: getSession2,
     requireSession,
+    requireRole,
     middleware,
     config: { matcher },
     protect
   };
 }
 __name(defineAuth, "defineAuth");
+
+// src/client/server/safeRedirect.ts
+var DEFAULT_BLOCKED_PREFIXES = ["/api", "/login", "/_next"];
+var ASSET_EXTENSIONS = /\.(?:css|gif|ico|jpe?g|js|json|map|png|svg|webmanifest|webp)$/i;
+function getSafeRedirectPath(value, options = {}) {
+  const {
+    fallback = "/dashboard",
+    blockedPrefixes = DEFAULT_BLOCKED_PREFIXES
+  } = typeof options === "string" ? { fallback: options } : options;
+  const path = Array.isArray(value) ? value[0] : value;
+  if (!path || !path.startsWith("/") || // Protocol-relative: the browser treats `//host/x` as off-site.
+  path.startsWith("//") || // A backslash is normalized to a forward slash by some browsers, so
+  // `/\evil.test` is another way to spell the case above.
+  path.startsWith("/\\") || blockedPrefixes.some((prefix) => path.startsWith(prefix)) || ASSET_EXTENSIONS.test(path.split("?")[0] ?? path)) {
+    return fallback;
+  }
+  return path;
+}
+__name(getSafeRedirectPath, "getSafeRedirectPath");
+
+// src/client/server/authCookiePersistence.ts
+var DEFAULTS = {
+  authCookieNames: ["refreshToken", "najm.session"],
+  rememberCookieName: "najm.remember",
+  maxAgeSeconds: 7 * 24 * 60 * 60,
+  loginPaths: ["/api/auth/login"],
+  logoutPaths: ["/api/auth/logout"],
+  refreshPaths: ["/api/auth/refresh", "/api/auth/session/recover"]
+};
+function cookieValue(header, name) {
+  for (const part of header.split(";")) {
+    const separator = part.indexOf("=");
+    if (separator < 0) continue;
+    if (part.slice(0, separator).trim() !== name) continue;
+    return part.slice(separator + 1).trim();
+  }
+  return void 0;
+}
+__name(cookieValue, "cookieValue");
+function cookieName(setCookie) {
+  const separator = setCookie.indexOf("=");
+  return separator < 0 ? "" : setCookie.slice(0, separator).trim();
+}
+__name(cookieName, "cookieName");
+function makeSessionCookie(setCookie, authCookieNames = DEFAULTS.authCookieNames) {
+  if (!authCookieNames.includes(cookieName(setCookie))) return setCookie;
+  return setCookie.split(";").filter((part) => !/^\s*(?:expires|max-age)=/i.test(part)).join(";");
+}
+__name(makeSessionCookie, "makeSessionCookie");
+function isDeletionCookie(setCookie) {
+  if (/^[^=]+=\s*(?:;|$)/.test(setCookie)) return true;
+  if (/(?:^|;)\s*max-age=0(?:;|$)/i.test(setCookie)) return true;
+  const expires = /(?:^|;)\s*expires=([^;]+)/i.exec(setCookie)?.[1];
+  return expires ? new Date(expires).getTime() <= Date.now() : false;
+}
+__name(isDeletionCookie, "isDeletionCookie");
+function rememberCookie(name, mode, secure, maxAgeSeconds) {
+  const attributes = [
+    `${name}=${mode === "persistent" ? "1" : "0"}`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax"
+  ];
+  if (secure) attributes.push("Secure");
+  if (mode === "persistent") attributes.push(`Max-Age=${maxAgeSeconds}`);
+  return attributes.join("; ");
+}
+__name(rememberCookie, "rememberCookie");
+function clearedRememberCookie(name, secure) {
+  return [
+    `${name}=`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax",
+    ...secure ? ["Secure"] : [],
+    "Max-Age=0"
+  ].join("; ");
+}
+__name(clearedRememberCookie, "clearedRememberCookie");
+function withAuthCookiePersistence(handler, options = {}) {
+  const {
+    authCookieNames = DEFAULTS.authCookieNames,
+    rememberCookieName = DEFAULTS.rememberCookieName,
+    maxAgeSeconds = DEFAULTS.maxAgeSeconds,
+    loginPaths = DEFAULTS.loginPaths,
+    logoutPaths = DEFAULTS.logoutPaths,
+    refreshPaths = DEFAULTS.refreshPaths,
+    isSetupResponse
+  } = options;
+  const resolveAction = /* @__PURE__ */ __name(async (request) => {
+    const { pathname } = new URL(request.url);
+    if (loginPaths.includes(pathname)) {
+      const body = await request.clone().json().catch(() => null);
+      return {
+        type: "apply",
+        mode: body?.rememberMe === true ? "persistent" : "session"
+      };
+    }
+    if (logoutPaths.includes(pathname)) return { type: "clear" };
+    if (refreshPaths.includes(pathname)) {
+      const remembered = cookieValue(
+        request.headers.get("cookie") ?? "",
+        rememberCookieName
+      );
+      if (remembered === "0") return { type: "apply", mode: "session" };
+      if (remembered === "1") return { type: "apply", mode: "persistent" };
+    }
+    return null;
+  }, "resolveAction");
+  const applyAction = /* @__PURE__ */ __name((response, action, secure) => {
+    const headers = new Headers(response.headers);
+    const setCookies = headers.getSetCookie();
+    headers.delete("set-cookie");
+    for (const setCookie of setCookies) {
+      if (action.type === "setup" && authCookieNames.includes(cookieName(setCookie)) && !isDeletionCookie(setCookie)) {
+        continue;
+      }
+      headers.append(
+        "set-cookie",
+        action.type === "apply" && action.mode === "session" ? makeSessionCookie(setCookie, authCookieNames) : setCookie
+      );
+    }
+    headers.append(
+      "set-cookie",
+      action.type === "clear" || action.type === "setup" ? clearedRememberCookie(rememberCookieName, secure) : rememberCookie(rememberCookieName, action.mode, secure, maxAgeSeconds)
+    );
+    return new Response(response.body, {
+      headers,
+      status: response.status,
+      statusText: response.statusText
+    });
+  }, "applyAction");
+  return async (request) => {
+    let action = await resolveAction(request);
+    const response = await handler(request);
+    if (!response.ok) return response;
+    if (action?.type === "apply" && isSetupResponse) {
+      const payload = await response.clone().json().catch(() => null);
+      if (isSetupResponse(payload)) action = { type: "setup" };
+    }
+    if (!action) return response;
+    return applyAction(
+      response,
+      action,
+      new URL(request.url).protocol === "https:"
+    );
+  };
+}
+__name(withAuthCookiePersistence, "withAuthCookiePersistence");
 export {
   AuthConfigError,
   AuthTransportError,
   NoSessionError,
   createServerClient,
   defineAuth,
+  getSafeRedirectPath,
   getServerSession,
   getSession,
+  makeSessionCookie,
   withAuth,
+  withAuthCookiePersistence,
   withAuthMiddleware
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "2.0.13",
+  "version": "2.0.15",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [
@@ -78,10 +78,10 @@
   "dependencies": {
     "bcryptjs": "^3.0.2",
     "najm-cookies": "^2.0.2",
-    "najm-core": "^2.0.4",
+    "najm-core": "^2.0.5",
     "najm-database": "^2.0.3",
     "najm-guard": "^2.0.2",
-    "najm-i18n": "^2.0.2",
+    "najm-i18n": "^2.0.3",
     "najm-cache": "^2.0.2",
     "najm-email": "^2.0.2",
     "najm-rate": "^2.0.2",