@poly-x/next 0.1.0-alpha.17 → 0.1.0-alpha.19

package/dist/server.cjs

@@ -131,6 +131,20 @@ function geoHeadersFromBody(geo) {
 	if (g.consent === "granted" || g.consent === "denied" || g.consent === "revoked") headers["x-polyx-geo-consent"] = g.consent;
 	return headers;
 }
+/**
+* Build the device-context headers (`x-timezone` / `x-screen-resolution`) from the browser's login
+* body (v6). These are not automatic request headers — the browser captures them client-side and
+* posts them; the platform reads them for session device attribution. Only well-formed values are
+* forwarded (a sane timezone string, a `WxH` resolution) so junk never reaches the platform.
+*/
+function deviceContextHeadersFromBody(deviceContext) {
+	const headers = {};
+	if (!deviceContext || typeof deviceContext !== "object") return headers;
+	const d = deviceContext;
+	if (typeof d.timezone === "string" && d.timezone.length > 0 && d.timezone.length <= 64) headers["x-timezone"] = d.timezone;
+	if (typeof d.screenResolution === "string" && /^\d{1,5}x\d{1,5}$/.test(d.screenResolution)) headers["x-screen-resolution"] = d.screenResolution;
+	return headers;
+}
 /** Read the current session — safe in Server Components (no cookie write). */
 async function auth(overrides) {
 	const config = resolveNextConfig(overrides);
@@ -188,6 +202,7 @@ function createAuthHandlers(handlersConfig = {}) {
 				return Response.json({ status: "invalid_request" }, { status: 400 });
 			}
 			const geoHeaders = geoHeadersFromBody(payload.geo);
+			const deviceContextHeaders = deviceContextHeadersFromBody(payload.deviceContext);
 			const email = typeof payload.email === "string" ? payload.email : "";
 			const password = typeof payload.password === "string" ? payload.password : "";
 			if (!email || !password) return Response.json({ status: "invalid_request" }, { status: 400 });
@@ -211,7 +226,8 @@ function createAuthHandlers(handlersConfig = {}) {
 					case "authorized":
 						await newSession(adapt(await (0, next_headers.cookies)()), config, secure).establishFromCode(outcome.code, verifier, redirectUri, {
 							...collectForwardedDeviceHeaders(request),
-							...geoHeaders
+							...geoHeaders,
+							...deviceContextHeaders
 						});
 						return Response.json({
 							status: "success",
@@ -341,6 +357,19 @@ function createAuthHandlers(handlersConfig = {}) {
 		},
 		async session() {
 			return Response.json(await auth(handlersConfig));
+		},
+		async subscriptionCredential() {
+			const config = resolveNextConfig(handlersConfig);
+			const current = await new require_server_session.ServerSession({
+				authClient: buildServerAuthClient(config),
+				secret: config.secret,
+				cookies: await requestCookies()
+			}).read();
+			if (!current) return Response.json({ status: "signed_out" }, { status: 401 });
+			return Response.json({
+				token: current.tokens.accessToken,
+				organizationId: current.session.claims.organizationId
+			});
 		}
 	};
 }

package/dist/server.d.cts

@@ -127,6 +127,14 @@ interface AuthHandlers {
    * server truth instead. Never carries a token.
    */
   session(request: Request): Promise<Response>;
+  /**
+   * v2 (ADR-0008): a session-derived credential for the real-time `authz:changed` channel. Returns
+   * `{ token, organizationId }` read from the sealed session server-side — the token is for the
+   * socket handshake only (in-memory; never persisted), per the pragmatic custody decision. A
+   * signed-out caller gets `401` with no token. This is the one place a token leaves the BFF, and
+   * only to open the live-authz subscription.
+   */
+  subscriptionCredential(request: Request): Promise<Response>;
 }
 /** The JSON the `forgotPassword` handler returns — always uniform (no enumeration). */
 type ForgotPasswordResult = {

package/dist/server.d.mts

@@ -127,6 +127,14 @@ interface AuthHandlers {
    * server truth instead. Never carries a token.
    */
   session(request: Request): Promise<Response>;
+  /**
+   * v2 (ADR-0008): a session-derived credential for the real-time `authz:changed` channel. Returns
+   * `{ token, organizationId }` read from the sealed session server-side — the token is for the
+   * socket handshake only (in-memory; never persisted), per the pragmatic custody decision. A
+   * signed-out caller gets `401` with no token. This is the one place a token leaves the BFF, and
+   * only to open the live-authz subscription.
+   */
+  subscriptionCredential(request: Request): Promise<Response>;
 }
 /** The JSON the `forgotPassword` handler returns — always uniform (no enumeration). */
 type ForgotPasswordResult = {

package/dist/server.mjs

@@ -130,6 +130,20 @@ function geoHeadersFromBody(geo) {
 	if (g.consent === "granted" || g.consent === "denied" || g.consent === "revoked") headers["x-polyx-geo-consent"] = g.consent;
 	return headers;
 }
+/**
+* Build the device-context headers (`x-timezone` / `x-screen-resolution`) from the browser's login
+* body (v6). These are not automatic request headers — the browser captures them client-side and
+* posts them; the platform reads them for session device attribution. Only well-formed values are
+* forwarded (a sane timezone string, a `WxH` resolution) so junk never reaches the platform.
+*/
+function deviceContextHeadersFromBody(deviceContext) {
+	const headers = {};
+	if (!deviceContext || typeof deviceContext !== "object") return headers;
+	const d = deviceContext;
+	if (typeof d.timezone === "string" && d.timezone.length > 0 && d.timezone.length <= 64) headers["x-timezone"] = d.timezone;
+	if (typeof d.screenResolution === "string" && /^\d{1,5}x\d{1,5}$/.test(d.screenResolution)) headers["x-screen-resolution"] = d.screenResolution;
+	return headers;
+}
 /** Read the current session — safe in Server Components (no cookie write). */
 async function auth(overrides) {
 	const config = resolveNextConfig(overrides);
@@ -187,6 +201,7 @@ function createAuthHandlers(handlersConfig = {}) {
 				return Response.json({ status: "invalid_request" }, { status: 400 });
 			}
 			const geoHeaders = geoHeadersFromBody(payload.geo);
+			const deviceContextHeaders = deviceContextHeadersFromBody(payload.deviceContext);
 			const email = typeof payload.email === "string" ? payload.email : "";
 			const password = typeof payload.password === "string" ? payload.password : "";
 			if (!email || !password) return Response.json({ status: "invalid_request" }, { status: 400 });
@@ -210,7 +225,8 @@ function createAuthHandlers(handlersConfig = {}) {
 					case "authorized":
 						await newSession(adapt(await cookies()), config, secure).establishFromCode(outcome.code, verifier, redirectUri, {
 							...collectForwardedDeviceHeaders(request),
-							...geoHeaders
+							...geoHeaders,
+							...deviceContextHeaders
 						});
 						return Response.json({
 							status: "success",
@@ -340,6 +356,19 @@ function createAuthHandlers(handlersConfig = {}) {
 		},
 		async session() {
 			return Response.json(await auth(handlersConfig));
+		},
+		async subscriptionCredential() {
+			const config = resolveNextConfig(handlersConfig);
+			const current = await new ServerSession({
+				authClient: buildServerAuthClient(config),
+				secret: config.secret,
+				cookies: await requestCookies()
+			}).read();
+			if (!current) return Response.json({ status: "signed_out" }, { status: 401 });
+			return Response.json({
+				token: current.tokens.accessToken,
+				organizationId: current.session.claims.organizationId
+			});
 		}
 	};
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poly-x/next",
-  "version": "0.1.0-alpha.17",
+  "version": "0.1.0-alpha.19",
   "description": "PolyX SDK for Next.js App Router - components plus server helpers",
   "license": "MIT",
   "type": "module",
@@ -47,8 +47,8 @@
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.cts",
   "dependencies": {
-    "@poly-x/core": "0.1.0-alpha.17",
-    "@poly-x/react": "0.1.0-alpha.17"
+    "@poly-x/core": "0.1.0-alpha.19",
+    "@poly-x/react": "0.1.0-alpha.19"
   },
   "peerDependencies": {
     "next": ">=14",