@poly-x/next 0.1.0-alpha.18 → 0.1.0-alpha.19

package/dist/server.cjs

@@ -357,6 +357,19 @@ function createAuthHandlers(handlersConfig = {}) {
 		},
 		async session() {
 			return Response.json(await auth(handlersConfig));
+		},
+		async subscriptionCredential() {
+			const config = resolveNextConfig(handlersConfig);
+			const current = await new require_server_session.ServerSession({
+				authClient: buildServerAuthClient(config),
+				secret: config.secret,
+				cookies: await requestCookies()
+			}).read();
+			if (!current) return Response.json({ status: "signed_out" }, { status: 401 });
+			return Response.json({
+				token: current.tokens.accessToken,
+				organizationId: current.session.claims.organizationId
+			});
 		}
 	};
 }

package/dist/server.d.cts

@@ -127,6 +127,14 @@ interface AuthHandlers {
    * server truth instead. Never carries a token.
    */
   session(request: Request): Promise<Response>;
+  /**
+   * v2 (ADR-0008): a session-derived credential for the real-time `authz:changed` channel. Returns
+   * `{ token, organizationId }` read from the sealed session server-side — the token is for the
+   * socket handshake only (in-memory; never persisted), per the pragmatic custody decision. A
+   * signed-out caller gets `401` with no token. This is the one place a token leaves the BFF, and
+   * only to open the live-authz subscription.
+   */
+  subscriptionCredential(request: Request): Promise<Response>;
 }
 /** The JSON the `forgotPassword` handler returns — always uniform (no enumeration). */
 type ForgotPasswordResult = {

package/dist/server.d.mts

@@ -127,6 +127,14 @@ interface AuthHandlers {
    * server truth instead. Never carries a token.
    */
   session(request: Request): Promise<Response>;
+  /**
+   * v2 (ADR-0008): a session-derived credential for the real-time `authz:changed` channel. Returns
+   * `{ token, organizationId }` read from the sealed session server-side — the token is for the
+   * socket handshake only (in-memory; never persisted), per the pragmatic custody decision. A
+   * signed-out caller gets `401` with no token. This is the one place a token leaves the BFF, and
+   * only to open the live-authz subscription.
+   */
+  subscriptionCredential(request: Request): Promise<Response>;
 }
 /** The JSON the `forgotPassword` handler returns — always uniform (no enumeration). */
 type ForgotPasswordResult = {

package/dist/server.mjs

@@ -356,6 +356,19 @@ function createAuthHandlers(handlersConfig = {}) {
 		},
 		async session() {
 			return Response.json(await auth(handlersConfig));
+		},
+		async subscriptionCredential() {
+			const config = resolveNextConfig(handlersConfig);
+			const current = await new ServerSession({
+				authClient: buildServerAuthClient(config),
+				secret: config.secret,
+				cookies: await requestCookies()
+			}).read();
+			if (!current) return Response.json({ status: "signed_out" }, { status: 401 });
+			return Response.json({
+				token: current.tokens.accessToken,
+				organizationId: current.session.claims.organizationId
+			});
 		}
 	};
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poly-x/next",
-  "version": "0.1.0-alpha.18",
+  "version": "0.1.0-alpha.19",
   "description": "PolyX SDK for Next.js App Router - components plus server helpers",
   "license": "MIT",
   "type": "module",
@@ -47,8 +47,8 @@
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.cts",
   "dependencies": {
-    "@poly-x/core": "0.1.0-alpha.18",
-    "@poly-x/react": "0.1.0-alpha.18"
+    "@poly-x/core": "0.1.0-alpha.19",
+    "@poly-x/react": "0.1.0-alpha.19"
   },
   "peerDependencies": {
     "next": ">=14",