@poly-x/next 0.1.0-alpha.8 → 0.1.0-alpha.9

package/dist/proxy.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-require("./server-session-YbnXBt3c.cjs");
+require("./server-session-DmR0ZJqP.cjs");
 let next_server = require("next/server");
 //#region src/proxy.ts
 /**

package/dist/proxy.mjs

@@ -1,4 +1,4 @@
-import "./server-session-B3zJ7CS8.mjs";
+import "./server-session-CXVB1Rgx.mjs";
 import { NextResponse } from "next/server";
 //#region src/proxy.ts
 /**

package/dist/{server-session-B3zJ7CS8.mjs → server-session-CXVB1Rgx.mjs}

@@ -1,12 +1,20 @@
 import { SessionExpiredError, SessionRevokedError } from "@poly-x/core";
 //#region src/cookie-adapter.ts
-/** Default attributes for the session cookie (ADR-0004 secure custody). */
-const SESSION_COOKIE_OPTIONS = {
-	httpOnly: true,
-	secure: true,
-	sameSite: "lax",
-	path: "/"
-};
+/**
+* Attributes for the session cookie (ADR-0004 secure custody). `secure` is decided at
+* write time from the actual transport: a `Secure` cookie is silently dropped by the
+* browser over plain http, so http/localhost dev must set `secure:false` while https
+* always sets `secure:true`. This is not a downgrade — `Secure` carries no meaning on
+* http; setting it there just breaks the session. httpOnly/sameSite/path are unchanged.
+*/
+function buildSessionCookieOptions(secure) {
+	return {
+		httpOnly: true,
+		secure,
+		sameSite: "lax",
+		path: "/"
+	};
+}
 //#endregion
 //#region src/cookie-codec.ts
 const IV_BYTES = 12;
@@ -69,11 +77,13 @@ var ServerSession = class {
 	secret;
 	cookies;
 	cookieName;
+	secure;
 	constructor(options) {
 		this.authClient = options.authClient;
 		this.secret = options.secret;
 		this.cookies = options.cookies;
 		this.cookieName = options.cookieName ?? "polyx_session";
+		this.secure = options.secure ?? true;
 	}
 	async establishFromCode(code, codeVerifier, redirectUri) {
 		const stored = await this.authClient.exchangeCode({
@@ -110,7 +120,7 @@ var ServerSession = class {
 	}
 	async write(session) {
 		const sealed = await sealSession(session, this.secret);
-		this.cookies.set(this.cookieName, sealed, SESSION_COOKIE_OPTIONS);
+		this.cookies.set(this.cookieName, sealed, buildSessionCookieOptions(this.secure));
 	}
 };
 function toAuthContext(session) {

package/dist/{server-session-YbnXBt3c.cjs → server-session-DmR0ZJqP.cjs}

@@ -1,12 +1,20 @@
 let _poly_x_core = require("@poly-x/core");
 //#region src/cookie-adapter.ts
-/** Default attributes for the session cookie (ADR-0004 secure custody). */
-const SESSION_COOKIE_OPTIONS = {
-	httpOnly: true,
-	secure: true,
-	sameSite: "lax",
-	path: "/"
-};
+/**
+* Attributes for the session cookie (ADR-0004 secure custody). `secure` is decided at
+* write time from the actual transport: a `Secure` cookie is silently dropped by the
+* browser over plain http, so http/localhost dev must set `secure:false` while https
+* always sets `secure:true`. This is not a downgrade — `Secure` carries no meaning on
+* http; setting it there just breaks the session. httpOnly/sameSite/path are unchanged.
+*/
+function buildSessionCookieOptions(secure) {
+	return {
+		httpOnly: true,
+		secure,
+		sameSite: "lax",
+		path: "/"
+	};
+}
 //#endregion
 //#region src/cookie-codec.ts
 const IV_BYTES = 12;
@@ -69,11 +77,13 @@ var ServerSession = class {
 	secret;
 	cookies;
 	cookieName;
+	secure;
 	constructor(options) {
 		this.authClient = options.authClient;
 		this.secret = options.secret;
 		this.cookies = options.cookies;
 		this.cookieName = options.cookieName ?? "polyx_session";
+		this.secure = options.secure ?? true;
 	}
 	async establishFromCode(code, codeVerifier, redirectUri) {
 		const stored = await this.authClient.exchangeCode({
@@ -110,7 +120,7 @@ var ServerSession = class {
 	}
 	async write(session) {
 		const sealed = await sealSession(session, this.secret);
-		this.cookies.set(this.cookieName, sealed, SESSION_COOKIE_OPTIONS);
+		this.cookies.set(this.cookieName, sealed, buildSessionCookieOptions(this.secure));
 	}
 };
 function toAuthContext(session) {

package/dist/server.cjs

@@ -1,8 +1,15 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_server_session = require("./server-session-YbnXBt3c.cjs");
+const require_server_session = require("./server-session-DmR0ZJqP.cjs");
 let _poly_x_core = require("@poly-x/core");
 let next_headers = require("next/headers");
 //#region src/config.ts
+/** Parse a boolean-ish env var; undefined when unset/unrecognized (→ auto-derive). */
+function parseBoolEnv(value) {
+	if (value === void 0) return void 0;
+	const v = value.trim().toLowerCase();
+	if (v === "true" || v === "1") return true;
+	if (v === "false" || v === "0") return false;
+}
 function resolveNextConfig(overrides = {}) {
 	const publishableKey = overrides.publishableKey ?? process.env.NEXT_PUBLIC_POLYX_PUBLISHABLE_KEY;
 	const secret = overrides.secret ?? process.env.POLYX_SESSION_SECRET;
@@ -12,7 +19,8 @@ function resolveNextConfig(overrides = {}) {
 		publishableKey,
 		secret,
 		baseUrl: overrides.baseUrl ?? process.env.POLYX_BASE_URL,
-		signInUrl: overrides.signInUrl ?? process.env.NEXT_PUBLIC_POLYX_SIGN_IN_URL
+		signInUrl: overrides.signInUrl ?? process.env.NEXT_PUBLIC_POLYX_SIGN_IN_URL,
+		cookieSecure: overrides.cookieSecure ?? parseBoolEnv(process.env.POLYX_COOKIE_SECURE)
 	};
 }
 function buildServerAuthClient(config) {
@@ -48,6 +56,22 @@ function adapt(store) {
 async function requestCookies() {
 	return adapt(await (0, next_headers.cookies)());
 }
+/**
+* Decide the cookie `Secure` attribute for this request. An explicit `cookieSecure`
+* (from `POLYX_COOKIE_SECURE` or code) wins; otherwise derive from the transport —
+* `x-forwarded-proto` (proxied TLS) then the request URL — and fail secure if unknown.
+* A Secure cookie is dropped by the browser over http, so http/localhost must be false.
+*/
+function resolveCookieSecure(request, config) {
+	if (config.cookieSecure !== void 0) return config.cookieSecure;
+	const forwarded = request.headers.get("x-forwarded-proto");
+	if (forwarded) return forwarded.split(",")[0].trim() === "https";
+	try {
+		return new URL(request.url).protocol === "https:";
+	} catch {
+		return true;
+	}
+}
 /** Read the current session — safe in Server Components (no cookie write). */
 async function auth(overrides) {
 	const config = resolveNextConfig(overrides);
@@ -60,16 +84,18 @@ async function auth(overrides) {
 function createAuthHandlers(handlersConfig = {}) {
 	const callbackPath = handlersConfig.callbackPath ?? "/api/polyx/callback";
 	const afterSignInPath = handlersConfig.afterSignInPath ?? "/";
-	function newSession(store, config) {
+	function newSession(store, config, secure) {
 		return new require_server_session.ServerSession({
 			authClient: buildServerAuthClient(config),
 			secret: config.secret,
-			cookies: store
+			cookies: store,
+			secure
 		});
 	}
 	return {
 		async signin(request) {
 			const config = resolveNextConfig(handlersConfig);
+			const secure = resolveCookieSecure(request, config);
 			const redirectUri = `${new URL(request.url).origin}${callbackPath}`;
 			const { verifier, challenge } = await (0, _poly_x_core.generatePkce)();
 			const state = (0, _poly_x_core.randomState)();
@@ -79,7 +105,7 @@ function createAuthHandlers(handlersConfig = {}) {
 				redirectUri
 			}), {
 				httpOnly: true,
-				secure: true,
+				secure,
 				sameSite: "lax",
 				path: "/",
 				maxAge: VERIFIER_MAX_AGE
@@ -93,6 +119,7 @@ function createAuthHandlers(handlersConfig = {}) {
 		},
 		async authenticate(request) {
 			const config = resolveNextConfig(handlersConfig);
+			const secure = resolveCookieSecure(request, config);
 			const redirectUri = `${new URL(request.url).origin}${callbackPath}`;
 			const client = buildServerAuthClient(config);
 			let payload;
@@ -122,7 +149,7 @@ function createAuthHandlers(handlersConfig = {}) {
 				});
 				switch (outcome.type) {
 					case "authorized":
-						await newSession(adapt(await (0, next_headers.cookies)()), config).establishFromCode(outcome.code, verifier, redirectUri);
+						await newSession(adapt(await (0, next_headers.cookies)()), config, secure).establishFromCode(outcome.code, verifier, redirectUri);
 						return Response.json({
 							status: "success",
 							redirectTo: afterSignInPath
@@ -211,6 +238,7 @@ function createAuthHandlers(handlersConfig = {}) {
 		},
 		async callback(request) {
 			const config = resolveNextConfig(handlersConfig);
+			const secure = resolveCookieSecure(request, config);
 			const url = new URL(request.url);
 			const code = url.searchParams.get("code");
 			const state = url.searchParams.get("state");
@@ -221,17 +249,19 @@ function createAuthHandlers(handlersConfig = {}) {
 			if (!code || !state || !raw) return Response.redirect(home, 302);
 			const tx = JSON.parse(raw);
 			if (tx.state !== state) return Response.redirect(home, 302);
-			await newSession(adapt(store), config).establishFromCode(code, tx.verifier, tx.redirectUri);
+			await newSession(adapt(store), config, secure).establishFromCode(code, tx.verifier, tx.redirectUri);
 			return Response.redirect(home, 302);
 		},
-		async refresh() {
+		async refresh(request) {
 			const config = resolveNextConfig(handlersConfig);
-			const session = await newSession(await requestCookies(), config).refresh();
+			const secure = resolveCookieSecure(request, config);
+			const session = await newSession(await requestCookies(), config, secure).refresh();
 			return Response.json({ isSignedIn: session !== null }, { status: session ? 200 : 401 });
 		},
 		async signout(request) {
 			const config = resolveNextConfig(handlersConfig);
-			newSession(adapt(await (0, next_headers.cookies)()), config).clear();
+			const secure = resolveCookieSecure(request, config);
+			newSession(adapt(await (0, next_headers.cookies)()), config, secure).clear();
 			try {
 				await buildServerAuthClient(config).logout("device");
 			} catch {}

package/dist/server.d.cts

@@ -8,6 +8,13 @@ interface NextServerConfig {
   baseUrl?: string;
   /** Hosted sign-in page URL the signin route redirects to. */
   signInUrl?: string;
+  /**
+   * Force the session/verifier cookie `Secure` attribute. Leave undefined (default) to
+   * derive it from the request transport (https → true, http/localhost → false). Set via
+   * `POLYX_COOKIE_SECURE=true|false` only for edge cases (e.g. a TLS-terminating proxy
+   * that doesn't forward `x-forwarded-proto`).
+   */
+  cookieSecure?: boolean;
 }
 declare function resolveNextConfig(overrides?: Partial<NextServerConfig>): NextServerConfig;
 //#endregion
@@ -37,12 +44,19 @@ interface ServerSessionOptions {
   secret: string;
   cookies: CookieAdapter;
   cookieName?: string;
+  /**
+   * Whether to set the `Secure` attribute on the session cookie. Defaults to `true`
+   * (fail secure). Handlers derive it from the request transport so http/localhost dev
+   * works (a Secure cookie is dropped over http). See buildSessionCookieOptions.
+   */
+  secure?: boolean;
 }
 declare class ServerSession {
   private readonly authClient;
   private readonly secret;
   private readonly cookies;
   private readonly cookieName;
+  private readonly secure;
   constructor(options: ServerSessionOptions);
   establishFromCode(code: string, codeVerifier: string, redirectUri: string): Promise<StoredSession>;
   read(): Promise<StoredSession | null>;

package/dist/server.d.mts

@@ -8,6 +8,13 @@ interface NextServerConfig {
   baseUrl?: string;
   /** Hosted sign-in page URL the signin route redirects to. */
   signInUrl?: string;
+  /**
+   * Force the session/verifier cookie `Secure` attribute. Leave undefined (default) to
+   * derive it from the request transport (https → true, http/localhost → false). Set via
+   * `POLYX_COOKIE_SECURE=true|false` only for edge cases (e.g. a TLS-terminating proxy
+   * that doesn't forward `x-forwarded-proto`).
+   */
+  cookieSecure?: boolean;
 }
 declare function resolveNextConfig(overrides?: Partial<NextServerConfig>): NextServerConfig;
 //#endregion
@@ -37,12 +44,19 @@ interface ServerSessionOptions {
   secret: string;
   cookies: CookieAdapter;
   cookieName?: string;
+  /**
+   * Whether to set the `Secure` attribute on the session cookie. Defaults to `true`
+   * (fail secure). Handlers derive it from the request transport so http/localhost dev
+   * works (a Secure cookie is dropped over http). See buildSessionCookieOptions.
+   */
+  secure?: boolean;
 }
 declare class ServerSession {
   private readonly authClient;
   private readonly secret;
   private readonly cookies;
   private readonly cookieName;
+  private readonly secure;
   constructor(options: ServerSessionOptions);
   establishFromCode(code: string, codeVerifier: string, redirectUri: string): Promise<StoredSession>;
   read(): Promise<StoredSession | null>;

package/dist/server.mjs

@@ -1,7 +1,14 @@
-import { a as sealSession, i as openSession, n as ServerSession, r as toAuthContext, t as DEFAULT_SESSION_COOKIE } from "./server-session-B3zJ7CS8.mjs";
+import { a as sealSession, i as openSession, n as ServerSession, r as toAuthContext, t as DEFAULT_SESSION_COOKIE } from "./server-session-CXVB1Rgx.mjs";
 import { AuthClient, FetchTransport, generatePkce, randomState, resolveConfig } from "@poly-x/core";
 import { cookies } from "next/headers";
 //#region src/config.ts
+/** Parse a boolean-ish env var; undefined when unset/unrecognized (→ auto-derive). */
+function parseBoolEnv(value) {
+	if (value === void 0) return void 0;
+	const v = value.trim().toLowerCase();
+	if (v === "true" || v === "1") return true;
+	if (v === "false" || v === "0") return false;
+}
 function resolveNextConfig(overrides = {}) {
 	const publishableKey = overrides.publishableKey ?? process.env.NEXT_PUBLIC_POLYX_PUBLISHABLE_KEY;
 	const secret = overrides.secret ?? process.env.POLYX_SESSION_SECRET;
@@ -11,7 +18,8 @@ function resolveNextConfig(overrides = {}) {
 		publishableKey,
 		secret,
 		baseUrl: overrides.baseUrl ?? process.env.POLYX_BASE_URL,
-		signInUrl: overrides.signInUrl ?? process.env.NEXT_PUBLIC_POLYX_SIGN_IN_URL
+		signInUrl: overrides.signInUrl ?? process.env.NEXT_PUBLIC_POLYX_SIGN_IN_URL,
+		cookieSecure: overrides.cookieSecure ?? parseBoolEnv(process.env.POLYX_COOKIE_SECURE)
 	};
 }
 function buildServerAuthClient(config) {
@@ -47,6 +55,22 @@ function adapt(store) {
 async function requestCookies() {
 	return adapt(await cookies());
 }
+/**
+* Decide the cookie `Secure` attribute for this request. An explicit `cookieSecure`
+* (from `POLYX_COOKIE_SECURE` or code) wins; otherwise derive from the transport —
+* `x-forwarded-proto` (proxied TLS) then the request URL — and fail secure if unknown.
+* A Secure cookie is dropped by the browser over http, so http/localhost must be false.
+*/
+function resolveCookieSecure(request, config) {
+	if (config.cookieSecure !== void 0) return config.cookieSecure;
+	const forwarded = request.headers.get("x-forwarded-proto");
+	if (forwarded) return forwarded.split(",")[0].trim() === "https";
+	try {
+		return new URL(request.url).protocol === "https:";
+	} catch {
+		return true;
+	}
+}
 /** Read the current session — safe in Server Components (no cookie write). */
 async function auth(overrides) {
 	const config = resolveNextConfig(overrides);
@@ -59,16 +83,18 @@ async function auth(overrides) {
 function createAuthHandlers(handlersConfig = {}) {
 	const callbackPath = handlersConfig.callbackPath ?? "/api/polyx/callback";
 	const afterSignInPath = handlersConfig.afterSignInPath ?? "/";
-	function newSession(store, config) {
+	function newSession(store, config, secure) {
 		return new ServerSession({
 			authClient: buildServerAuthClient(config),
 			secret: config.secret,
-			cookies: store
+			cookies: store,
+			secure
 		});
 	}
 	return {
 		async signin(request) {
 			const config = resolveNextConfig(handlersConfig);
+			const secure = resolveCookieSecure(request, config);
 			const redirectUri = `${new URL(request.url).origin}${callbackPath}`;
 			const { verifier, challenge } = await generatePkce();
 			const state = randomState();
@@ -78,7 +104,7 @@ function createAuthHandlers(handlersConfig = {}) {
 				redirectUri
 			}), {
 				httpOnly: true,
-				secure: true,
+				secure,
 				sameSite: "lax",
 				path: "/",
 				maxAge: VERIFIER_MAX_AGE
@@ -92,6 +118,7 @@ function createAuthHandlers(handlersConfig = {}) {
 		},
 		async authenticate(request) {
 			const config = resolveNextConfig(handlersConfig);
+			const secure = resolveCookieSecure(request, config);
 			const redirectUri = `${new URL(request.url).origin}${callbackPath}`;
 			const client = buildServerAuthClient(config);
 			let payload;
@@ -121,7 +148,7 @@ function createAuthHandlers(handlersConfig = {}) {
 				});
 				switch (outcome.type) {
 					case "authorized":
-						await newSession(adapt(await cookies()), config).establishFromCode(outcome.code, verifier, redirectUri);
+						await newSession(adapt(await cookies()), config, secure).establishFromCode(outcome.code, verifier, redirectUri);
 						return Response.json({
 							status: "success",
 							redirectTo: afterSignInPath
@@ -210,6 +237,7 @@ function createAuthHandlers(handlersConfig = {}) {
 		},
 		async callback(request) {
 			const config = resolveNextConfig(handlersConfig);
+			const secure = resolveCookieSecure(request, config);
 			const url = new URL(request.url);
 			const code = url.searchParams.get("code");
 			const state = url.searchParams.get("state");
@@ -220,17 +248,19 @@ function createAuthHandlers(handlersConfig = {}) {
 			if (!code || !state || !raw) return Response.redirect(home, 302);
 			const tx = JSON.parse(raw);
 			if (tx.state !== state) return Response.redirect(home, 302);
-			await newSession(adapt(store), config).establishFromCode(code, tx.verifier, tx.redirectUri);
+			await newSession(adapt(store), config, secure).establishFromCode(code, tx.verifier, tx.redirectUri);
 			return Response.redirect(home, 302);
 		},
-		async refresh() {
+		async refresh(request) {
 			const config = resolveNextConfig(handlersConfig);
-			const session = await newSession(await requestCookies(), config).refresh();
+			const secure = resolveCookieSecure(request, config);
+			const session = await newSession(await requestCookies(), config, secure).refresh();
 			return Response.json({ isSignedIn: session !== null }, { status: session ? 200 : 401 });
 		},
 		async signout(request) {
 			const config = resolveNextConfig(handlersConfig);
-			newSession(adapt(await cookies()), config).clear();
+			const secure = resolveCookieSecure(request, config);
+			newSession(adapt(await cookies()), config, secure).clear();
 			try {
 				await buildServerAuthClient(config).logout("device");
 			} catch {}

package/dist/styles.css

@@ -208,6 +208,13 @@
 	margin-bottom: 0.75rem;
 }
 
+/* Branding logo fetched from the app's tokens (FR-BRND). */
+.polyx-signin__brand-logo {
+	max-height: 2.25rem;
+	width: auto;
+	object-fit: contain;
+}
+
 .polyx-signin__heading {
 	margin: 0;
 	font-size: 1.375rem;
@@ -270,6 +277,56 @@
 	cursor: not-allowed;
 }
 
+/* --- Password reveal toggle --------------------------------------------- */
+
+.polyx-signin__input-wrap {
+	position: relative;
+	display: flex;
+	align-items: center;
+}
+
+/* Leave room for the reveal button so masked text never slides under it. */
+.polyx-signin__input--has-reveal {
+	padding-right: 2.75rem;
+}
+
+.polyx-signin__reveal {
+	position: absolute;
+	right: 0.25rem;
+	display: inline-flex;
+	align-items: center;
+	justify-content: center;
+	width: 2rem;
+	height: 2rem;
+	padding: 0;
+	color: var(--polyx-muted-fg);
+	background: transparent;
+	border: none;
+	border-radius: var(--polyx-radius-sm);
+	cursor: pointer;
+	transition: color 0.15s ease, box-shadow 0.15s ease;
+}
+
+.polyx-signin__reveal:hover:not(:disabled) {
+	color: var(--polyx-fg);
+}
+
+.polyx-signin__reveal:focus-visible {
+	outline: none;
+	color: var(--polyx-fg);
+	box-shadow: 0 0 0 3px var(--polyx-ring);
+}
+
+.polyx-signin__reveal:disabled {
+	cursor: not-allowed;
+	opacity: 0.6;
+}
+
+.polyx-signin__reveal svg {
+	width: 1.125rem;
+	height: 1.125rem;
+}
+
 /* --- Buttons ------------------------------------------------------------- */
 
 .polyx-signin__submit,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poly-x/next",
-  "version": "0.1.0-alpha.8",
+  "version": "0.1.0-alpha.9",
   "description": "PolyX SDK for Next.js App Router - components plus server helpers",
   "license": "MIT",
   "type": "module",
@@ -47,8 +47,8 @@
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.cts",
   "dependencies": {
-    "@poly-x/core": "0.1.0-alpha.8",
-    "@poly-x/react": "0.1.0-alpha.8"
+    "@poly-x/core": "0.1.0-alpha.9",
+    "@poly-x/react": "0.1.0-alpha.9"
   },
   "peerDependencies": {
     "next": ">=14",