najm-auth 3.0.0 → 3.1.1

package/dist/client/server/index.js

@@ -356,7 +356,8 @@ __export(getSession_exports, {
   AuthConfigError: () => AuthConfigError,
   AuthTransportError: () => AuthTransportError,
   NoSessionError: () => NoSessionError,
-  getSession: () => getSession
+  getSession: () => getSession,
+  resolveSessionOutcome: () => resolveSessionOutcome
 });
 function defaultBaseURL() {
   const explicit = typeof process !== "undefined" ? process.env.NAJM_AUTH_BASE_URL : void 0;
@@ -381,12 +382,11 @@ function requestOriginFromHeaders(headers) {
     return void 0;
   }
 }
-async function getSession(config = {}) {
+async function resolveSessionOutcome(config = {}) {
   const cookieName2 = config.cookieName ?? "refreshToken";
   const sessionCookieName = config.sessionCookieName ?? "najm.session";
   const baseURL = config.baseURL ?? defaultBaseURL();
   const prefix = config.authPrefix ?? "/auth";
-  const strict = config.mode === "strict";
   const internalRecoveryURL = resolveInternalRecoveryURL(config.internalRecoveryURL);
   let sessionCookieValue;
   let refreshCookieValue;
@@ -400,8 +400,7 @@ async function getSession(config = {}) {
       requestOrigin = requestOriginFromHeaders(await mod.headers());
     }
   } catch {
-    if (strict) throw new AuthConfigError("Failed to read cookies from Next.js headers()");
-    return null;
+    return failed(new AuthConfigError("Failed to read cookies from Next.js headers()"));
   }
   const secret = resolveSessionSecret(config.sessionSecret);
   if (sessionCookieValue && secret) {
@@ -410,24 +409,21 @@ async function getSession(config = {}) {
       maxAgeSeconds: config.sessionMaxAge
     });
     if (claims) {
-      return {
+      return authenticated({
         user: claims.user,
         roles: claims.roles,
         permissions: claims.permissions
-      };
+      });
     }
   }
   if (!secret) {
-    if (strict) throw new AuthConfigError("Session cookie secret is not configured");
-    return null;
+    return failed(new AuthConfigError("Session cookie secret is not configured"));
   }
   if (!refreshCookieValue || config.recoveryURL === false && !internalRecoveryURL) {
-    if (strict) throw new NoSessionError("No recoverable refresh session");
-    return null;
+    return unauthenticated("No recoverable refresh session");
   }
   if (!requestOrigin) {
-    if (strict) throw new AuthConfigError("Incoming request origin is unavailable");
-    return null;
+    return failed(new AuthConfigError("Incoming request origin is unavailable"));
   }
   const endpoint = internalRecoveryURL ?? (config.recoveryURL ? new URL(config.recoveryURL, requestOrigin).toString() : authEndpoint(baseURL, prefix, "/session/recover", requestOrigin));
   const recovery = await requestSessionRecovery({
@@ -442,24 +438,27 @@ async function getSession(config = {}) {
     onFailure: config.onRecoveryFailure
   });
   if (recovery.status === "recovered") {
-    return {
+    return authenticated({
       user: recovery.claims.user,
       roles: recovery.claims.roles,
       permissions: recovery.claims.permissions
-    };
+    });
   }
-  if (strict) {
-    if (recovery.status === "invalid") {
-      throw new NoSessionError("Refresh session is invalid or revoked");
-    }
-    throw new AuthTransportError(
-      "Session recovery endpoint was unavailable or returned an invalid session",
-      recovery.httpStatus
-    );
+  if (recovery.status === "invalid") {
+    return unauthenticated("Refresh session is invalid or revoked");
   }
+  return failed(new AuthTransportError(
+    "Session recovery endpoint was unavailable or returned an invalid session",
+    recovery.httpStatus
+  ));
+}
+async function getSession(config = {}) {
+  const outcome = await resolveSessionOutcome(config);
+  if (outcome.status === "authenticated") return outcome.session;
+  if (config.mode === "strict") throw outcome.error;
   return null;
 }
-var NoSessionError, AuthConfigError, AuthTransportError;
+var NoSessionError, AuthConfigError, AuthTransportError, authenticated, unauthenticated, failed;
 var init_getSession = __esm({
   "src/client/server/getSession.ts"() {
     init_sessionCookie();
@@ -498,6 +497,19 @@ var init_getSession = __esm({
     __name(defaultBaseURL, "defaultBaseURL");
     __name(firstForwardedValue, "firstForwardedValue");
     __name(requestOriginFromHeaders, "requestOriginFromHeaders");
+    authenticated = /* @__PURE__ */ __name((session) => ({
+      status: "authenticated",
+      session
+    }), "authenticated");
+    unauthenticated = /* @__PURE__ */ __name((message) => ({
+      status: "unauthenticated",
+      error: new NoSessionError(message)
+    }), "unauthenticated");
+    failed = /* @__PURE__ */ __name((error) => ({
+      status: "failed",
+      error
+    }), "failed");
+    __name(resolveSessionOutcome, "resolveSessionOutcome");
     __name(getSession, "getSession");
   }
 });
@@ -949,10 +961,10 @@ var NajmAuthClient = class _NajmAuthClient {
     if (setup) {
       return { ...setup };
     }
-    const authenticated = res.data;
-    this.applyTokens(authenticated);
-    if (authenticated.user) {
-      this.state = { ...this.state, user: authenticated.user };
+    const authenticated2 = res.data;
+    this.applyTokens(authenticated2);
+    if (authenticated2.user) {
+      this.state = { ...this.state, user: authenticated2.user };
       this.notify();
     } else {
       await this.fetchUser();
@@ -1325,6 +1337,29 @@ function createAuthClient(config) {
 }
 __name(createAuthClient, "createAuthClient");
 
+// src/client/server/internals.ts
+var REACT_SERVER_INTERNALS = Symbol.for("najm-auth.reactServerInternals");
+function redirectsToLogin(outcome) {
+  if (outcome.status === "unauthenticated") return true;
+  const { code, status } = outcome.error;
+  return code === "AUTH_TRANSPORT_ERROR" && (status === 401 || status === 403);
+}
+__name(redirectsToLogin, "redirectsToLogin");
+function heldRoles(session) {
+  return session.roles ?? (session.user.role ? [session.user.role] : []);
+}
+__name(heldRoles, "heldRoles");
+function attachReactServerInternals(kit, internals) {
+  Object.defineProperty(kit, REACT_SERVER_INTERNALS, {
+    value: internals,
+    enumerable: false,
+    configurable: false,
+    writable: false
+  });
+  return kit;
+}
+__name(attachReactServerInternals, "attachReactServerInternals");
+
 // src/client/server/defineAuth.ts
 function defineAuth(authConfig = {}) {
   const {
@@ -1379,32 +1414,22 @@ function defineAuth(authConfig = {}) {
     const { getSession: resolveSession } = await Promise.resolve().then(() => (init_getSession(), getSession_exports));
     return resolveSession({ ...sessionConfig, ...opts });
   }, "getSession");
+  const resolveSessionOutcome2 = /* @__PURE__ */ __name(async () => {
+    const { resolveSessionOutcome: resolve } = await Promise.resolve().then(() => (init_getSession(), getSession_exports));
+    return resolve(sessionConfig);
+  }, "resolveSessionOutcome");
   const requireSession = /* @__PURE__ */ __name(async () => {
-    const sessionModule = await Promise.resolve().then(() => (init_getSession(), getSession_exports));
-    const {
-      getSession: resolveSession,
-      NoSessionError: NoSessionError2,
-      AuthTransportError: AuthTransportError2
-    } = sessionModule;
-    try {
-      const session = await resolveSession({ ...sessionConfig, mode: "strict" });
-      return session;
-    } catch (err) {
-      if (err instanceof NoSessionError2) {
-        const { redirect } = await import("next/navigation");
-        redirect(loginRoute);
-      }
-      if (err instanceof AuthTransportError2 && (err.status === 401 || err.status === 403)) {
-        const { redirect } = await import("next/navigation");
-        redirect(loginRoute);
-      }
-      throw err;
+    const outcome = await resolveSessionOutcome2();
+    if (outcome.status === "authenticated") return outcome.session;
+    if (redirectsToLogin(outcome)) {
+      const { redirect } = await import("next/navigation");
+      redirect(loginRoute);
     }
+    throw outcome.error;
   }, "requireSession");
   const requireRole = /* @__PURE__ */ __name(async (roles) => {
     const session = await requireSession();
-    const held = session.roles ?? (session.user.role ? [session.user.role] : []);
-    if (!held.some((role) => roles.includes(role))) {
+    if (!heldRoles(session).some((role) => roles.includes(role))) {
       const { redirect } = await import("next/navigation");
       redirect(forbiddenRoute);
     }
@@ -1434,8 +1459,7 @@ function defineAuth(authConfig = {}) {
         redirect(loginRoute);
       }
       if (options?.role) {
-        const userRoles = session.roles ?? (session.user.role ? [session.user.role] : []);
-        if (!userRoles.includes(options.role)) {
+        if (!heldRoles(session).includes(options.role)) {
           const { redirect } = await import("next/navigation");
           redirect(forbiddenRoute);
         }
@@ -1451,7 +1475,7 @@ function defineAuth(authConfig = {}) {
       return Page({ session, ...props });
     }, "ProtectedPage");
   }, "protect");
-  return {
+  return attachReactServerInternals({
     get client() {
       return getClient();
     },
@@ -1464,7 +1488,7 @@ function defineAuth(authConfig = {}) {
     middleware,
     config: { matcher },
     protect
-  };
+  }, { resolveSessionOutcome: resolveSessionOutcome2, loginRoute, forbiddenRoute });
 }
 __name(defineAuth, "defineAuth");
 

package/dist/client/server/react.d.ts

@@ -0,0 +1,48 @@
+import { S as ServerSession } from '../../getSession-BthP85UA.js';
+import '../../types-BaSfgxqE.js';
+import '../../sessionRecovery-D5Fa0yZ1.js';
+
+/**
+ * The `defineAuth()` result.
+ *
+ * Declared structurally rather than as `AuthKit` on purpose: each entry point
+ * bundles its own declarations, and `AuthKit` reaches classes whose private
+ * members would make the two copies nominally incompatible.
+ */
+interface ReactServerAuthSource {
+    getSession(): Promise<ServerSession | null>;
+    requireSession(): Promise<ServerSession>;
+    requireRole(roles: string[]): Promise<ServerSession>;
+}
+interface ReactServerAuth {
+    /** The session for this request, or `null` when there is none. */
+    getSession(): Promise<ServerSession | null>;
+    /**
+     * The session for this request, redirecting to `loginRoute` when the visitor
+     * is unauthenticated.
+     *
+     * A recovery endpoint that is unreachable or a missing session secret is an
+     * operational fault, not an anonymous visitor: those stay visible errors
+     * rather than becoming a login redirect that hides the outage.
+     */
+    requireSession(): Promise<ServerSession>;
+    /**
+     * The session for this request, redirecting to `forbiddenRoute` when it holds
+     * none of `roles`. Not the login route — the visitor is already
+     * authenticated, so signing in again cannot change the answer.
+     */
+    requireRole(roles: string[]): Promise<ServerSession>;
+}
+/**
+ * Create the app's single request-scoped session accessor.
+ *
+ * Call this exactly once, at module scope, in a module the whole app imports.
+ * Calling it inside a layout, page, or component creates a fresh memoized
+ * resolver per call and shares nothing.
+ *
+ * Redirect routes and error classification come from the `defineAuth()` config
+ * that produced `auth`; they are not re-accepted here.
+ */
+declare function createReactServerAuth(auth: ReactServerAuthSource): ReactServerAuth;
+
+export { type ReactServerAuth, type ReactServerAuthSource, createReactServerAuth };

package/dist/client/server/react.js

@@ -0,0 +1,71 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+
+// src/client/server/react.ts
+import * as React from "react";
+
+// src/client/server/internals.ts
+var REACT_SERVER_INTERNALS = Symbol.for("najm-auth.reactServerInternals");
+function redirectsToLogin(outcome) {
+  if (outcome.status === "unauthenticated") return true;
+  const { code, status } = outcome.error;
+  return code === "AUTH_TRANSPORT_ERROR" && (status === 401 || status === 403);
+}
+__name(redirectsToLogin, "redirectsToLogin");
+function heldRoles(session) {
+  return session.roles ?? (session.user.role ? [session.user.role] : []);
+}
+__name(heldRoles, "heldRoles");
+function readReactServerInternals(auth) {
+  if (auth === null || typeof auth !== "object" && typeof auth !== "function") return void 0;
+  return auth[REACT_SERVER_INTERNALS];
+}
+__name(readReactServerInternals, "readReactServerInternals");
+
+// src/client/server/react.ts
+if (typeof window !== "undefined") {
+  throw new Error(
+    "najm-auth/client/server/react is a React Server Component module and cannot be imported from a Client Component. Import najm-auth/client/react instead."
+  );
+}
+function createReactServerAuth(auth) {
+  const internals = readReactServerInternals(auth);
+  if (!internals) {
+    throw new Error(
+      "createReactServerAuth() expects the object returned by defineAuth() from najm-auth/client/server. Check that both imports resolve to the same installed najm-auth version."
+    );
+  }
+  const cache2 = React.cache;
+  if (typeof cache2 !== "function") {
+    throw new Error(
+      "najm-auth/client/server/react requires a React version that exports cache() (React 18.3 or newer). Upgrade react, or use auth.getSession() directly."
+    );
+  }
+  const resolve = cache2(internals.resolveSessionOutcome);
+  const getSession = /* @__PURE__ */ __name(async () => {
+    const outcome = await resolve();
+    return outcome.status === "authenticated" ? outcome.session : null;
+  }, "getSession");
+  const requireSession = /* @__PURE__ */ __name(async () => {
+    const outcome = await resolve();
+    if (outcome.status === "authenticated") return outcome.session;
+    if (redirectsToLogin(outcome)) {
+      const { redirect } = await import("next/navigation");
+      redirect(internals.loginRoute);
+    }
+    throw outcome.error;
+  }, "requireSession");
+  const requireRole = /* @__PURE__ */ __name(async (roles) => {
+    const session = await requireSession();
+    if (!heldRoles(session).some((role) => roles.includes(role))) {
+      const { redirect } = await import("next/navigation");
+      redirect(internals.forbiddenRoute);
+    }
+    return session;
+  }, "requireRole");
+  return { getSession, requireSession, requireRole };
+}
+__name(createReactServerAuth, "createReactServerAuth");
+export {
+  createReactServerAuth
+};

package/dist/client/server/reactClientGuard.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/client/server/reactClientGuard.js

@@ -0,0 +1,4 @@
+// src/client/server/reactClientGuard.ts
+throw new Error(
+  "najm-auth/client/server/react is a React Server Component module. It cannot be imported from a Client Component, the Edge runtime, or any browser bundle. Use najm-auth/client/react for client components, and najm-auth/client/server for proxy and Edge code."
+);

package/dist/getSession-BthP85UA.d.ts

@@ -0,0 +1,68 @@
+import { A as AuthUser } from './types-BaSfgxqE.js';
+import { S as SessionRecoveryFailure } from './sessionRecovery-D5Fa0yZ1.js';
+
+interface ServerSession {
+    user: AuthUser;
+    roles?: string[];
+    permissions?: string[];
+}
+interface GetSessionConfig {
+    /**
+     * Base URL for auth endpoints.
+     * Defaults to `NEXT_PUBLIC_API_URL` or the same-origin `/api` path.
+     */
+    baseURL?: string;
+    /** Auth route prefix appended to baseURL (default: '/auth'). */
+    authPrefix?: string;
+    /** Refresh token cookie name (default: 'refreshToken'). */
+    cookieName?: string;
+    /** Signed session cookie name (default: 'najm.session'). */
+    sessionCookieName?: string;
+    /**
+     * Secret used to verify the session cookie HMAC signature.
+     * Falls back to NAJM_SESSION_SECRET or JWT_ACCESS_SECRET env vars.
+     */
+    sessionSecret?: string;
+    /**
+     * Maximum accepted session-cookie age in seconds.
+     * Must match the auth plugin's `session.maxAge`. Default: 300.
+     */
+    sessionMaxAge?: number;
+    /**
+     * Session-recovery endpoint. Defaults to
+     * `${baseURL}${authPrefix}/session/recover`. Set to false to disable fallback.
+     */
+    recoveryURL?: string | false;
+    /** Loopback-only recovery endpoint for self-hosted reverse-proxy setups. */
+    internalRecoveryURL?: string;
+    /**
+     * Error handling mode:
+     * - 'nullable' (default): returns null on any failure
+     * - 'strict': throws typed errors for debugging
+     */
+    mode?: 'nullable' | 'strict';
+    /** Secret-free diagnostic hook for failed recovery attempts. */
+    onRecoveryFailure?: (failure: SessionRecoveryFailure) => void;
+}
+declare class NoSessionError extends Error {
+    readonly code = "NO_SESSION";
+    constructor(message?: string);
+}
+declare class AuthConfigError extends Error {
+    readonly code = "AUTH_CONFIG_ERROR";
+    constructor(message: string);
+}
+declare class AuthTransportError extends Error {
+    readonly status?: number;
+    readonly code = "AUTH_TRANSPORT_ERROR";
+    constructor(message: string, status?: number);
+}
+/**
+ * Resolve a session in a Next.js Server Component, Route Handler, or Server
+ * Action. Recovery returns claims for the current render but cannot persist
+ * response cookies during Server Component rendering; middleware performs that
+ * persistence for protected navigation.
+ */
+declare function getSession(config?: GetSessionConfig): Promise<ServerSession | null>;
+
+export { AuthConfigError as A, type GetSessionConfig as G, NoSessionError as N, type ServerSession as S, AuthTransportError as a, getSession as g };

package/dist/sessionRecovery-D5Fa0yZ1.d.ts

@@ -0,0 +1,18 @@
+type SessionRecoveryFailureReason = 'invalid-cookie-name' | 'invalid-refresh-cookie' | 'invalid-endpoint' | 'fetch-error' | 'http-status' | 'missing-set-cookie' | 'session-cookie-parse' | 'session-cookie-hmac' | 'session-cookie-payload';
+interface SessionRecoveryErrorDetails {
+    name: string;
+    message: string;
+    code?: string;
+    cause?: {
+        name: string;
+        message: string;
+        code?: string;
+    };
+}
+interface SessionRecoveryFailure {
+    reason: SessionRecoveryFailureReason;
+    httpStatus?: number;
+    error?: SessionRecoveryErrorDetails;
+}
+
+export type { SessionRecoveryFailure as S, SessionRecoveryErrorDetails as a, SessionRecoveryFailureReason as b };

package/dist/types-BaSfgxqE.d.ts

@@ -0,0 +1,166 @@
+/**
+ * User data from the auth server
+ */
+interface AuthUser {
+    id: string;
+    email: string;
+    name?: string;
+    role?: string | null;
+    permissions?: string[];
+    [key: string]: unknown;
+}
+/**
+ * Full auth state snapshot
+ */
+interface AuthState {
+    user: AuthUser | null;
+    accessToken: string | null;
+    isAuthenticated: boolean;
+    isLoading: boolean;
+    roles: string[];
+    permissions: string[];
+}
+/**
+ * Decoded JWT payload (client-side, no verification)
+ */
+interface DecodedToken {
+    userId: string;
+    jti?: string;
+    sessionVersion?: number;
+    roles?: string[];
+    permissions?: string[];
+    exp?: number;
+    iat?: number;
+    [key: string]: unknown;
+}
+/**
+ * Server response envelope
+ */
+interface ServerResponse<T = unknown> {
+    data: T;
+    message?: string;
+    status?: string;
+}
+/**
+ * Token pair from login/refresh (internal — refresh token is httpOnly cookie)
+ */
+interface TokenPair {
+    accessToken: string;
+    refreshToken?: string;
+    accessTokenExpiresAt?: number;
+    refreshTokenExpiresAt?: number;
+}
+/**
+ * Login credentials. `identifier` accepts an email address or a phone number;
+ * `email` stays supported for existing callers.
+ */
+interface LoginCredentials {
+    identifier?: string;
+    email?: string;
+    password: string;
+    /** Persist the auth cookies past the browser closing. */
+    rememberMe?: boolean;
+    [key: string]: unknown;
+}
+/** The account must replace its credential before it gets a session. */
+interface CredentialSetupPending {
+    nextStep: 'credential_setup';
+    setupRequired: true;
+    purpose: string;
+    expiresAt: string;
+}
+interface AuthenticatedLogin {
+    nextStep: 'authenticated';
+    user: AuthUser;
+}
+/**
+ * Login answer. Branch on `nextStep`: `credential_setup` carries no tokens and
+ * leaves the client unauthenticated.
+ */
+type LoginResult = AuthenticatedLogin | CredentialSetupPending;
+/**
+ * Retry configuration
+ */
+interface RetryConfig {
+    maxRetries?: number;
+    backoff?: 'exponential' | 'linear';
+    baseDelay?: number;
+}
+/**
+ * Auth client configuration
+ */
+interface AuthClientConfig {
+    /** API base URL (e.g., '/api' or 'https://api.example.com') */
+    baseURL: string;
+    /** Auth endpoints prefix (default: '/auth') */
+    authPrefix?: string;
+    /** Proactive refresh at this fraction of token lifetime (default: 0.8) */
+    refreshThreshold?: number;
+    /** Enable multi-tab sync via BroadcastChannel (default: true) */
+    tabSync?: boolean;
+    /** BroadcastChannel name (default: 'najm-auth') */
+    channelName?: string;
+    /** Network retry configuration */
+    retry?: RetryConfig;
+    /** Request timeout in milliseconds (default: 30000) */
+    timeout?: number;
+}
+type OAuthProvider = 'google';
+interface OAuthLoginOptions {
+    /** Same-origin frontend path after OAuth completes. */
+    returnTo?: string;
+}
+/**
+ * Auth event types
+ */
+interface AuthEventMap {
+    login: AuthUser;
+    logout: null;
+    /** Emitted when server-side logout invalidation fails (state was already cleared) */
+    logoutError: unknown;
+    tokenRefresh: null;
+    sessionExpired: null;
+    stateChange: AuthState;
+    userUpdated: AuthUser;
+}
+type AuthEvent = keyof AuthEventMap;
+type AuthEventHandler<K extends AuthEvent = AuthEvent> = (data: AuthEventMap[K]) => void;
+/**
+ * Tab sync message types
+ */
+type TabSyncMessage = {
+    type: 'logout';
+} | {
+    type: 'sync';
+    state: SyncPayload;
+};
+interface SyncPayload {
+    accessToken: string | null;
+    user: AuthUser | null;
+    roles: string[];
+    permissions: string[];
+    isAuthenticated: boolean;
+}
+/**
+ * FetchClient request options
+ */
+interface RequestOptions {
+    body?: unknown;
+    headers?: Record<string, string>;
+    signal?: AbortSignal;
+    timeout?: number;
+    /** Skip auth header attachment (for public endpoints like /login, /register) */
+    skipAuth?: boolean;
+    /** @internal Prevents 401-refresh loop after a single retry */
+    _retried?: boolean;
+}
+/**
+ * Auth error thrown by the client
+ */
+declare class AuthError extends Error {
+    status: number;
+    body?: unknown;
+    constructor(status: number, message: string, body?: unknown);
+}
+
+export { type AuthUser as A, type CredentialSetupPending as C, type DecodedToken as D, type LoginCredentials as L, type OAuthProvider as O, type RetryConfig as R, type SyncPayload as S, type TabSyncMessage as T, type RequestOptions as a, type AuthClientConfig as b, type LoginResult as c, type OAuthLoginOptions as d, type AuthState as e, type AuthEvent as f, type AuthEventHandler as g, AuthError as h, type AuthEventMap as i, type AuthenticatedLogin as j, type ServerResponse as k, type TokenPair as l };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "3.0.0",
+  "version": "3.1.1",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [
@@ -34,6 +34,13 @@
       "import": "./dist/client/server/index.js",
       "default": "./dist/client/server/index.js"
     },
+    "./client/server/react": {
+      "types": "./dist/client/server/react.d.ts",
+      "react-server": "./dist/client/server/react.js",
+      "browser": "./dist/client/server/reactClientGuard.js",
+      "import": "./dist/client/server/react.js",
+      "default": "./dist/client/server/react.js"
+    },
     "./identity/ma": {
       "types": "./dist/identity/ma.d.ts",
       "import": "./dist/identity/ma.js",
@@ -52,7 +59,8 @@
   },
   "scripts": {
     "build": "tsup",
-    "test": "bun test",
+    "test": "bun test && bun run test:rsc",
+    "test:rsc": "bun test --conditions react-server test/react-server-auth.test.ts",
     "test:next16": "bun run build && bun integration/next16-proxy/run.ts",
     "test:watch": "bun test --watch",
     "start": "bun --watch src/main.ts",