najm-auth 2.0.15 → 3.1.0

package/dist/client/server/index.d.ts

@@ -1,6 +1,10 @@
-import { f as AuthUser, F as FetchClient, N as NajmAuthClient, h as RetryConfig } from '../../NajmAuthClient-Cn9bObLB.js';
-import { SessionRecoveryFailure } from '../edge.js';
-export { SessionRecoveryErrorDetails, SessionRecoveryFailureReason, withAuthMiddleware } from '../edge.js';
+import { A as AuthUser, R as RetryConfig } from '../../types-BaSfgxqE.js';
+import { F as FetchClient, N as NajmAuthClient } from '../../NajmAuthClient-DqGucYXi.js';
+export { withAuthMiddleware } from '../edge.js';
+import { G as GetSessionConfig, S as ServerSession$1 } from '../../getSession-BthP85UA.js';
+export { A as AuthConfigError, a as AuthTransportError, N as NoSessionError, g as getSession } from '../../getSession-BthP85UA.js';
+import { S as SessionRecoveryFailure } from '../../sessionRecovery-D5Fa0yZ1.js';
+export { a as SessionRecoveryErrorDetails, b as SessionRecoveryFailureReason } from '../../sessionRecovery-D5Fa0yZ1.js';
 import 'next/server';
 
 interface GetServerSessionOptions {
@@ -11,7 +15,7 @@ interface GetServerSessionOptions {
     /** Additional headers to forward (e.g., Authorization) */
     headers?: Record<string, string>;
 }
-interface ServerSession$1 {
+interface ServerSession {
     user: AuthUser;
 }
 /**
@@ -35,7 +39,7 @@ interface ServerSession$1 {
  * }
  * ```
  */
-declare function getServerSession(opts: GetServerSessionOptions): Promise<ServerSession$1 | null>;
+declare function getServerSession(opts: GetServerSessionOptions): Promise<ServerSession | null>;
 
 interface ServerClientConfig {
     /** API base URL (e.g., 'http://localhost:3000/api') */
@@ -65,70 +69,6 @@ interface ServerClientConfig {
  */
 declare function createServerClient(config: ServerClientConfig): FetchClient;
 
-interface ServerSession {
-    user: AuthUser;
-    roles?: string[];
-    permissions?: string[];
-}
-interface GetSessionConfig {
-    /**
-     * Base URL for auth endpoints.
-     * Defaults to `NEXT_PUBLIC_API_URL` or the same-origin `/api` path.
-     */
-    baseURL?: string;
-    /** Auth route prefix appended to baseURL (default: '/auth'). */
-    authPrefix?: string;
-    /** Refresh token cookie name (default: 'refreshToken'). */
-    cookieName?: string;
-    /** Signed session cookie name (default: 'najm.session'). */
-    sessionCookieName?: string;
-    /**
-     * Secret used to verify the session cookie HMAC signature.
-     * Falls back to NAJM_SESSION_SECRET or JWT_ACCESS_SECRET env vars.
-     */
-    sessionSecret?: string;
-    /**
-     * Maximum accepted session-cookie age in seconds.
-     * Must match the auth plugin's `session.maxAge`. Default: 300.
-     */
-    sessionMaxAge?: number;
-    /**
-     * Session-recovery endpoint. Defaults to
-     * `${baseURL}${authPrefix}/session/recover`. Set to false to disable fallback.
-     */
-    recoveryURL?: string | false;
-    /** Loopback-only recovery endpoint for self-hosted reverse-proxy setups. */
-    internalRecoveryURL?: string;
-    /**
-     * Error handling mode:
-     * - 'nullable' (default): returns null on any failure
-     * - 'strict': throws typed errors for debugging
-     */
-    mode?: 'nullable' | 'strict';
-    /** Secret-free diagnostic hook for failed recovery attempts. */
-    onRecoveryFailure?: (failure: SessionRecoveryFailure) => void;
-}
-declare class NoSessionError extends Error {
-    readonly code = "NO_SESSION";
-    constructor(message?: string);
-}
-declare class AuthConfigError extends Error {
-    readonly code = "AUTH_CONFIG_ERROR";
-    constructor(message: string);
-}
-declare class AuthTransportError extends Error {
-    readonly status?: number;
-    readonly code = "AUTH_TRANSPORT_ERROR";
-    constructor(message: string, status?: number);
-}
-/**
- * Resolve a session in a Next.js Server Component, Route Handler, or Server
- * Action. Recovery returns claims for the current render but cannot persist
- * response cookies during Server Component rendering; middleware performs that
- * persistence for protected navigation.
- */
-declare function getSession(config?: GetSessionConfig): Promise<ServerSession | null>;
-
 interface WithAuthOptions extends GetSessionConfig {
     /** Where to redirect unauthenticated requests (default: '/login') */
     redirectTo?: string;
@@ -138,7 +78,7 @@ interface WithAuthOptions extends GetSessionConfig {
     permission?: string;
 }
 interface WithAuthProps<P> {
-    session: ServerSession;
+    session: ServerSession$1;
     props: P;
 }
 /**
@@ -219,9 +159,9 @@ interface AuthKit {
     /** Shortcut for `client.api` — the underlying FetchClient with auth attached. */
     readonly api: FetchClient;
     /** Resolve session — signed-cookie first, then non-rotating recovery. */
-    getSession: (opts?: Pick<GetSessionConfig, 'mode'>) => Promise<ServerSession | null>;
+    getSession: (opts?: Pick<GetSessionConfig, 'mode'>) => Promise<ServerSession$1 | null>;
     /** Require session — throws if unauthenticated */
-    requireSession: () => Promise<ServerSession>;
+    requireSession: () => Promise<ServerSession$1>;
     /**
      * Require one of `roles` — redirects to `loginRoute` when unauthenticated and
      * to `forbiddenRoute` when authenticated as the wrong role.
@@ -230,7 +170,7 @@ interface AuthKit {
      * const session = await auth.requireRole(['admin', 'operator']);
      * ```
      */
-    requireRole: (roles: string[]) => Promise<ServerSession>;
+    requireRole: (roles: string[]) => Promise<ServerSession$1>;
     /** Generated Next.js middleware function */
     middleware: (request: Request) => Promise<Response>;
     /** Next.js middleware config with matcher */
@@ -242,7 +182,7 @@ interface AuthKit {
      * Passes session to the wrapped component.
      */
     protect: <P extends Record<string, unknown> = Record<string, unknown>>(Page: (args: {
-        session: ServerSession;
+        session: ServerSession$1;
         children?: unknown;
     } & P) => Promise<unknown> | unknown, options?: {
         role?: string;
@@ -296,13 +236,20 @@ interface AuthCookiePersistenceOptions {
     logoutPaths?: string[];
     /** Paths that reissue cookies and must reapply the stored choice. */
     refreshPaths?: string[];
+    /**
+     * Paths that finish credential setup. The stored choice is cleared there:
+     * the login it was recorded for never produced a session.
+     */
+    setupCompletionPaths?: string[];
     /**
      * Recognizes a response that has *not* issued a usable session because the
      * user must still set up credentials.
      *
-     * Such a response may carry auth cookies anyway, and persisting them would
-     * leave a half-authenticated browser that skips the setup step on reload.
-     * Returning `true` strips them and clears the stored choice.
+     * Najm's own setup response is recognized without this — supply it only to
+     * cover an application-specific shape. Such a response may carry auth
+     * cookies anyway, and persisting them would leave a half-authenticated
+     * browser that skips the setup step on reload. Returning `true` strips them
+     * and clears the stored choice.
      */
     isSetupResponse?: (payload: unknown) => boolean;
 }
@@ -325,4 +272,4 @@ declare function makeSessionCookie(setCookie: string, authCookieNames?: string[]
  */
 declare function withAuthCookiePersistence(handler: RequestHandler, options?: AuthCookiePersistenceOptions): RequestHandler;
 
-export { AuthConfigError, type AuthCookiePersistenceOptions, type AuthKit, AuthTransportError, type DefineAuthConfig, type GetSessionConfig, NoSessionError, type SafeRedirectOptions, type ServerSession, SessionRecoveryFailure, type WithAuthOptions, type WithAuthProps, createServerClient, defineAuth, getSafeRedirectPath, getServerSession, getSession, makeSessionCookie, withAuth, withAuthCookiePersistence };
+export { type AuthCookiePersistenceOptions, type AuthKit, type DefineAuthConfig, GetSessionConfig, type SafeRedirectOptions, ServerSession$1 as ServerSession, SessionRecoveryFailure, type WithAuthOptions, type WithAuthProps, createServerClient, defineAuth, getSafeRedirectPath, getServerSession, makeSessionCookie, withAuth, withAuthCookiePersistence };

package/dist/client/server/index.js

@@ -356,7 +356,8 @@ __export(getSession_exports, {
   AuthConfigError: () => AuthConfigError,
   AuthTransportError: () => AuthTransportError,
   NoSessionError: () => NoSessionError,
-  getSession: () => getSession
+  getSession: () => getSession,
+  resolveSessionOutcome: () => resolveSessionOutcome
 });
 function defaultBaseURL() {
   const explicit = typeof process !== "undefined" ? process.env.NAJM_AUTH_BASE_URL : void 0;
@@ -381,12 +382,11 @@ function requestOriginFromHeaders(headers) {
     return void 0;
   }
 }
-async function getSession(config = {}) {
+async function resolveSessionOutcome(config = {}) {
   const cookieName2 = config.cookieName ?? "refreshToken";
   const sessionCookieName = config.sessionCookieName ?? "najm.session";
   const baseURL = config.baseURL ?? defaultBaseURL();
   const prefix = config.authPrefix ?? "/auth";
-  const strict = config.mode === "strict";
   const internalRecoveryURL = resolveInternalRecoveryURL(config.internalRecoveryURL);
   let sessionCookieValue;
   let refreshCookieValue;
@@ -400,8 +400,7 @@ async function getSession(config = {}) {
       requestOrigin = requestOriginFromHeaders(await mod.headers());
     }
   } catch {
-    if (strict) throw new AuthConfigError("Failed to read cookies from Next.js headers()");
-    return null;
+    return failed(new AuthConfigError("Failed to read cookies from Next.js headers()"));
   }
   const secret = resolveSessionSecret(config.sessionSecret);
   if (sessionCookieValue && secret) {
@@ -410,24 +409,21 @@ async function getSession(config = {}) {
       maxAgeSeconds: config.sessionMaxAge
     });
     if (claims) {
-      return {
+      return authenticated({
         user: claims.user,
         roles: claims.roles,
         permissions: claims.permissions
-      };
+      });
     }
   }
   if (!secret) {
-    if (strict) throw new AuthConfigError("Session cookie secret is not configured");
-    return null;
+    return failed(new AuthConfigError("Session cookie secret is not configured"));
   }
   if (!refreshCookieValue || config.recoveryURL === false && !internalRecoveryURL) {
-    if (strict) throw new NoSessionError("No recoverable refresh session");
-    return null;
+    return unauthenticated("No recoverable refresh session");
   }
   if (!requestOrigin) {
-    if (strict) throw new AuthConfigError("Incoming request origin is unavailable");
-    return null;
+    return failed(new AuthConfigError("Incoming request origin is unavailable"));
   }
   const endpoint = internalRecoveryURL ?? (config.recoveryURL ? new URL(config.recoveryURL, requestOrigin).toString() : authEndpoint(baseURL, prefix, "/session/recover", requestOrigin));
   const recovery = await requestSessionRecovery({
@@ -442,24 +438,27 @@ async function getSession(config = {}) {
     onFailure: config.onRecoveryFailure
   });
   if (recovery.status === "recovered") {
-    return {
+    return authenticated({
       user: recovery.claims.user,
       roles: recovery.claims.roles,
       permissions: recovery.claims.permissions
-    };
+    });
   }
-  if (strict) {
-    if (recovery.status === "invalid") {
-      throw new NoSessionError("Refresh session is invalid or revoked");
-    }
-    throw new AuthTransportError(
-      "Session recovery endpoint was unavailable or returned an invalid session",
-      recovery.httpStatus
-    );
+  if (recovery.status === "invalid") {
+    return unauthenticated("Refresh session is invalid or revoked");
   }
+  return failed(new AuthTransportError(
+    "Session recovery endpoint was unavailable or returned an invalid session",
+    recovery.httpStatus
+  ));
+}
+async function getSession(config = {}) {
+  const outcome = await resolveSessionOutcome(config);
+  if (outcome.status === "authenticated") return outcome.session;
+  if (config.mode === "strict") throw outcome.error;
   return null;
 }
-var NoSessionError, AuthConfigError, AuthTransportError;
+var NoSessionError, AuthConfigError, AuthTransportError, authenticated, unauthenticated, failed;
 var init_getSession = __esm({
   "src/client/server/getSession.ts"() {
     init_sessionCookie();
@@ -498,6 +497,19 @@ var init_getSession = __esm({
     __name(defaultBaseURL, "defaultBaseURL");
     __name(firstForwardedValue, "firstForwardedValue");
     __name(requestOriginFromHeaders, "requestOriginFromHeaders");
+    authenticated = /* @__PURE__ */ __name((session) => ({
+      status: "authenticated",
+      session
+    }), "authenticated");
+    unauthenticated = /* @__PURE__ */ __name((message) => ({
+      status: "unauthenticated",
+      error: new NoSessionError(message)
+    }), "unauthenticated");
+    failed = /* @__PURE__ */ __name((error) => ({
+      status: "failed",
+      error
+    }), "failed");
+    __name(resolveSessionOutcome, "resolveSessionOutcome");
     __name(getSession, "getSession");
   }
 });
@@ -888,6 +900,10 @@ var TabSync = class {
 };
 
 // src/client/NajmAuthClient.ts
+function isCredentialSetupPending(payload) {
+  return typeof payload === "object" && payload !== null && payload.nextStep === "credential_setup";
+}
+__name(isCredentialSetupPending, "isCredentialSetupPending");
 var INITIAL_STATE = {
   user: null,
   accessToken: null,
@@ -939,20 +955,23 @@ var NajmAuthClient = class _NajmAuthClient {
   // Auth Operations
   // =========================================================================
   async login(credentials) {
-    const res = await this.api.post(
-      `${this.prefix}/login`,
-      { body: credentials, skipAuth: true }
-    );
-    this.applyTokens(res.data);
-    if (res.data.user) {
-      this.state = { ...this.state, user: res.data.user };
+    const res = await this.api.post(`${this.prefix}/login`, { body: credentials, skipAuth: true });
+    this.resetRefreshFailures();
+    const setup = isCredentialSetupPending(res) ? res : isCredentialSetupPending(res.data) ? res.data : null;
+    if (setup) {
+      return { ...setup };
+    }
+    const authenticated2 = res.data;
+    this.applyTokens(authenticated2);
+    if (authenticated2.user) {
+      this.state = { ...this.state, user: authenticated2.user };
       this.notify();
     } else {
       await this.fetchUser();
     }
     this.tabSync?.broadcastSync(this.getSyncPayload());
     this.emit("login", this.state.user);
-    return this.state.user;
+    return { nextStep: "authenticated", user: this.state.user };
   }
   async register(data) {
     const res = await this.api.post(
@@ -1318,6 +1337,29 @@ function createAuthClient(config) {
 }
 __name(createAuthClient, "createAuthClient");
 
+// src/client/server/internals.ts
+var REACT_SERVER_INTERNALS = Symbol.for("najm-auth.reactServerInternals");
+function redirectsToLogin(outcome) {
+  if (outcome.status === "unauthenticated") return true;
+  const { code, status } = outcome.error;
+  return code === "AUTH_TRANSPORT_ERROR" && (status === 401 || status === 403);
+}
+__name(redirectsToLogin, "redirectsToLogin");
+function heldRoles(session) {
+  return session.roles ?? (session.user.role ? [session.user.role] : []);
+}
+__name(heldRoles, "heldRoles");
+function attachReactServerInternals(kit, internals) {
+  Object.defineProperty(kit, REACT_SERVER_INTERNALS, {
+    value: internals,
+    enumerable: false,
+    configurable: false,
+    writable: false
+  });
+  return kit;
+}
+__name(attachReactServerInternals, "attachReactServerInternals");
+
 // src/client/server/defineAuth.ts
 function defineAuth(authConfig = {}) {
   const {
@@ -1372,32 +1414,22 @@ function defineAuth(authConfig = {}) {
     const { getSession: resolveSession } = await Promise.resolve().then(() => (init_getSession(), getSession_exports));
     return resolveSession({ ...sessionConfig, ...opts });
   }, "getSession");
+  const resolveSessionOutcome2 = /* @__PURE__ */ __name(async () => {
+    const { resolveSessionOutcome: resolve } = await Promise.resolve().then(() => (init_getSession(), getSession_exports));
+    return resolve(sessionConfig);
+  }, "resolveSessionOutcome");
   const requireSession = /* @__PURE__ */ __name(async () => {
-    const sessionModule = await Promise.resolve().then(() => (init_getSession(), getSession_exports));
-    const {
-      getSession: resolveSession,
-      NoSessionError: NoSessionError2,
-      AuthTransportError: AuthTransportError2
-    } = sessionModule;
-    try {
-      const session = await resolveSession({ ...sessionConfig, mode: "strict" });
-      return session;
-    } catch (err) {
-      if (err instanceof NoSessionError2) {
-        const { redirect } = await import("next/navigation");
-        redirect(loginRoute);
-      }
-      if (err instanceof AuthTransportError2 && (err.status === 401 || err.status === 403)) {
-        const { redirect } = await import("next/navigation");
-        redirect(loginRoute);
-      }
-      throw err;
+    const outcome = await resolveSessionOutcome2();
+    if (outcome.status === "authenticated") return outcome.session;
+    if (redirectsToLogin(outcome)) {
+      const { redirect } = await import("next/navigation");
+      redirect(loginRoute);
     }
+    throw outcome.error;
   }, "requireSession");
   const requireRole = /* @__PURE__ */ __name(async (roles) => {
     const session = await requireSession();
-    const held = session.roles ?? (session.user.role ? [session.user.role] : []);
-    if (!held.some((role) => roles.includes(role))) {
+    if (!heldRoles(session).some((role) => roles.includes(role))) {
       const { redirect } = await import("next/navigation");
       redirect(forbiddenRoute);
     }
@@ -1427,8 +1459,7 @@ function defineAuth(authConfig = {}) {
         redirect(loginRoute);
       }
       if (options?.role) {
-        const userRoles = session.roles ?? (session.user.role ? [session.user.role] : []);
-        if (!userRoles.includes(options.role)) {
+        if (!heldRoles(session).includes(options.role)) {
           const { redirect } = await import("next/navigation");
           redirect(forbiddenRoute);
         }
@@ -1444,7 +1475,7 @@ function defineAuth(authConfig = {}) {
       return Page({ session, ...props });
     }, "ProtectedPage");
   }, "protect");
-  return {
+  return attachReactServerInternals({
     get client() {
       return getClient();
     },
@@ -1457,7 +1488,7 @@ function defineAuth(authConfig = {}) {
     middleware,
     config: { matcher },
     protect
-  };
+  }, { resolveSessionOutcome: resolveSessionOutcome2, loginRoute, forbiddenRoute });
 }
 __name(defineAuth, "defineAuth");
 
@@ -1487,8 +1518,17 @@ var DEFAULTS = {
   maxAgeSeconds: 7 * 24 * 60 * 60,
   loginPaths: ["/api/auth/login"],
   logoutPaths: ["/api/auth/logout"],
-  refreshPaths: ["/api/auth/refresh", "/api/auth/session/recover"]
+  refreshPaths: ["/api/auth/refresh", "/api/auth/session/recover"],
+  setupCompletionPaths: ["/api/auth/credential-setup/change"]
 };
+function isNajmSetupResponse(payload) {
+  if (typeof payload !== "object" || payload === null) return false;
+  const body = payload;
+  if (body.nextStep === "credential_setup") return true;
+  const data = body.data;
+  return typeof data === "object" && data !== null && data.nextStep === "credential_setup";
+}
+__name(isNajmSetupResponse, "isNajmSetupResponse");
 function cookieValue(header, name) {
   for (const part of header.split(";")) {
     const separator = part.indexOf("=");
@@ -1547,6 +1587,7 @@ function withAuthCookiePersistence(handler, options = {}) {
     loginPaths = DEFAULTS.loginPaths,
     logoutPaths = DEFAULTS.logoutPaths,
     refreshPaths = DEFAULTS.refreshPaths,
+    setupCompletionPaths = DEFAULTS.setupCompletionPaths,
     isSetupResponse
   } = options;
   const resolveAction = /* @__PURE__ */ __name(async (request) => {
@@ -1559,6 +1600,7 @@ function withAuthCookiePersistence(handler, options = {}) {
       };
     }
     if (logoutPaths.includes(pathname)) return { type: "clear" };
+    if (setupCompletionPaths.includes(pathname)) return { type: "clear" };
     if (refreshPaths.includes(pathname)) {
       const remembered = cookieValue(
         request.headers.get("cookie") ?? "",
@@ -1596,9 +1638,11 @@ function withAuthCookiePersistence(handler, options = {}) {
     let action = await resolveAction(request);
     const response = await handler(request);
     if (!response.ok) return response;
-    if (action?.type === "apply" && isSetupResponse) {
+    if (action?.type === "apply" && loginPaths.includes(new URL(request.url).pathname)) {
       const payload = await response.clone().json().catch(() => null);
-      if (isSetupResponse(payload)) action = { type: "setup" };
+      if (isNajmSetupResponse(payload) || isSetupResponse?.(payload)) {
+        action = { type: "setup" };
+      }
     }
     if (!action) return response;
     return applyAction(

package/dist/client/server/react.d.ts

@@ -0,0 +1,48 @@
+import { S as ServerSession } from '../../getSession-BthP85UA.js';
+import '../../types-BaSfgxqE.js';
+import '../../sessionRecovery-D5Fa0yZ1.js';
+
+/**
+ * The `defineAuth()` result.
+ *
+ * Declared structurally rather than as `AuthKit` on purpose: each entry point
+ * bundles its own declarations, and `AuthKit` reaches classes whose private
+ * members would make the two copies nominally incompatible.
+ */
+interface ReactServerAuthSource {
+    getSession(): Promise<ServerSession | null>;
+    requireSession(): Promise<ServerSession>;
+    requireRole(roles: string[]): Promise<ServerSession>;
+}
+interface ReactServerAuth {
+    /** The session for this request, or `null` when there is none. */
+    getSession(): Promise<ServerSession | null>;
+    /**
+     * The session for this request, redirecting to `loginRoute` when the visitor
+     * is unauthenticated.
+     *
+     * A recovery endpoint that is unreachable or a missing session secret is an
+     * operational fault, not an anonymous visitor: those stay visible errors
+     * rather than becoming a login redirect that hides the outage.
+     */
+    requireSession(): Promise<ServerSession>;
+    /**
+     * The session for this request, redirecting to `forbiddenRoute` when it holds
+     * none of `roles`. Not the login route — the visitor is already
+     * authenticated, so signing in again cannot change the answer.
+     */
+    requireRole(roles: string[]): Promise<ServerSession>;
+}
+/**
+ * Create the app's single request-scoped session accessor.
+ *
+ * Call this exactly once, at module scope, in a module the whole app imports.
+ * Calling it inside a layout, page, or component creates a fresh memoized
+ * resolver per call and shares nothing.
+ *
+ * Redirect routes and error classification come from the `defineAuth()` config
+ * that produced `auth`; they are not re-accepted here.
+ */
+declare function createReactServerAuth(auth: ReactServerAuthSource): ReactServerAuth;
+
+export { type ReactServerAuth, type ReactServerAuthSource, createReactServerAuth };

package/dist/client/server/react.js

@@ -0,0 +1,71 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+
+// src/client/server/react.ts
+import * as React from "react";
+
+// src/client/server/internals.ts
+var REACT_SERVER_INTERNALS = Symbol.for("najm-auth.reactServerInternals");
+function redirectsToLogin(outcome) {
+  if (outcome.status === "unauthenticated") return true;
+  const { code, status } = outcome.error;
+  return code === "AUTH_TRANSPORT_ERROR" && (status === 401 || status === 403);
+}
+__name(redirectsToLogin, "redirectsToLogin");
+function heldRoles(session) {
+  return session.roles ?? (session.user.role ? [session.user.role] : []);
+}
+__name(heldRoles, "heldRoles");
+function readReactServerInternals(auth) {
+  if (auth === null || typeof auth !== "object" && typeof auth !== "function") return void 0;
+  return auth[REACT_SERVER_INTERNALS];
+}
+__name(readReactServerInternals, "readReactServerInternals");
+
+// src/client/server/react.ts
+if (typeof window !== "undefined") {
+  throw new Error(
+    "najm-auth/client/server/react is a React Server Component module and cannot be imported from a Client Component. Import najm-auth/client/react instead."
+  );
+}
+function createReactServerAuth(auth) {
+  const internals = readReactServerInternals(auth);
+  if (!internals) {
+    throw new Error(
+      "createReactServerAuth() expects the object returned by defineAuth() from najm-auth/client/server. Check that both imports resolve to the same installed najm-auth version."
+    );
+  }
+  const cache2 = React.cache;
+  if (typeof cache2 !== "function") {
+    throw new Error(
+      "najm-auth/client/server/react requires a React version that exports cache() (React 18.3 or newer). Upgrade react, or use auth.getSession() directly."
+    );
+  }
+  const resolve = cache2(internals.resolveSessionOutcome);
+  const getSession = /* @__PURE__ */ __name(async () => {
+    const outcome = await resolve();
+    return outcome.status === "authenticated" ? outcome.session : null;
+  }, "getSession");
+  const requireSession = /* @__PURE__ */ __name(async () => {
+    const outcome = await resolve();
+    if (outcome.status === "authenticated") return outcome.session;
+    if (redirectsToLogin(outcome)) {
+      const { redirect } = await import("next/navigation");
+      redirect(internals.loginRoute);
+    }
+    throw outcome.error;
+  }, "requireSession");
+  const requireRole = /* @__PURE__ */ __name(async (roles) => {
+    const session = await requireSession();
+    if (!heldRoles(session).some((role) => roles.includes(role))) {
+      const { redirect } = await import("next/navigation");
+      redirect(internals.forbiddenRoute);
+    }
+    return session;
+  }, "requireRole");
+  return { getSession, requireSession, requireRole };
+}
+__name(createReactServerAuth, "createReactServerAuth");
+export {
+  createReactServerAuth
+};

package/dist/client/server/reactClientGuard.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/client/server/reactClientGuard.js

@@ -0,0 +1,4 @@
+// src/client/server/reactClientGuard.ts
+throw new Error(
+  "najm-auth/client/server/react is a React Server Component module. It cannot be imported from a Client Component, the Edge runtime, or any browser bundle. Use najm-auth/client/react for client components, and najm-auth/client/server for proxy and Edge code."
+);