@poly-x/next 0.1.0 → 0.1.1

package/dist/proxy.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-require("./server-session-QJLA_Tz-.cjs");
+require("./server-session-Df9HXl_5.cjs");
 let next_server = require("next/server");
 //#region src/proxy.ts
 /**

package/dist/proxy.mjs

@@ -1,4 +1,4 @@
-import "./server-session-CjP44zFC.mjs";
+import "./server-session-pY-nzh5x.mjs";
 import { NextResponse } from "next/server";
 //#region src/proxy.ts
 /**

package/dist/{server-session-QJLA_Tz-.cjs → server-session-Df9HXl_5.cjs}

@@ -1,23 +1,45 @@
 let _poly_x_core = require("@poly-x/core");
-//#region src/cookie-adapter.ts
+//#region src/cookie-codec.ts
 /**
-* Attributes for the session cookie (ADR-0004 secure custody). `secure` is decided at
-* write time from the actual transport: a `Secure` cookie is silently dropped by the
-* browser over plain http, so http/localhost dev must set `secure:false` while https
-* always sets `secure:true`. This is not a downgrade — `Secure` carries no meaning on
-* http; setting it there just breaks the session. httpOnly/sameSite/path are unchanged.
+* AES-GCM sealing of the session cookie (F007 / ADR-0004). The key is derived
+* (SHA-256) from the consumer's `POLYX_SESSION_SECRET`; AES-GCM gives
+* confidentiality + tamper-detection together, so any corruption, truncation,
+* or wrong-secret input decrypts to `null` rather than a partial session.
+* Web Crypto is universal (Node ≥20 + edge runtimes), so this runs anywhere a
+* Next route handler runs.
 */
-function buildSessionCookieOptions(secure) {
-	return {
-		httpOnly: true,
-		secure,
-		sameSite: "lax",
-		path: "/"
-	};
-}
-//#endregion
-//#region src/cookie-codec.ts
 const IV_BYTES = 12;
+/**
+* Browsers cap a single cookie at roughly 4096 bytes for the whole `Set-Cookie` pair —
+* name, value and attributes together — and enforce it by DISCARDING the cookie without
+* an error. For a session cookie that failure is invisible and badly misleading: the
+* platform authenticates, the handler answers 200, and the user is bounced back to
+* sign-in on the next request because the cookie was never stored.
+*
+* poly-x-sdk/ADR-0006 measured a live Odin session at 2628 bytes and recorded the missing
+* guard as an open follow-up; a per-tenant flag that inflates the JWT is enough to cross
+* the line. We fail loudly here instead.
+*/
+const SESSION_COOKIE_MAX_BYTES = 4096;
+/** Attributes `buildSessionCookieOptions` always sets: `Path=/; HttpOnly; Secure; SameSite=Lax`. */
+const COOKIE_ATTRIBUTE_BYTES = 45;
+/** Bytes the whole `Set-Cookie` pair will occupy for this value under this cookie name. */
+function sealedCookieByteLength(value, cookieName = "polyx_session") {
+	return new TextEncoder().encode(cookieName).length + 1 + value.length + COOKIE_ATTRIBUTE_BYTES;
+}
+/**
+* Thrown when a sealed session would exceed what a browser will store. Never includes the
+* session itself — the claims that caused the overflow are exactly the data we must not log.
+*/
+var SessionCookieTooLargeError = class extends _poly_x_core.PolyXError {
+	bytes;
+	limit;
+	constructor(bytes, limit, cookieName) {
+		super(`PolyX session cookie is ${bytes} bytes, over the ~${limit}-byte browser limit for "${cookieName}". The browser would discard it silently and the user would appear signed out. Reduce what the platform puts in the session — the usual cause is a tenant configured to embed full permissions in the JWT (includeFullPermissionInJwt).`, { code: "SESSION_COOKIE_TOO_LARGE" });
+		this.bytes = bytes;
+		this.limit = limit;
+	}
+};
 function base64UrlEncode(bytes) {
 	let binary = "";
 	for (const byte of bytes) binary += String.fromCharCode(byte);
@@ -35,7 +57,7 @@ async function deriveKey(secret) {
 	const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret));
 	return crypto.subtle.importKey("raw", hash, "AES-GCM", false, ["encrypt", "decrypt"]);
 }
-async function sealSession(session, secret) {
+async function sealSession(session, secret, options = {}) {
 	const key = await deriveKey(secret);
 	const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
 	const plaintext = new TextEncoder().encode(JSON.stringify(session));
@@ -46,7 +68,11 @@ async function sealSession(session, secret) {
 	const packed = new Uint8Array(iv.length + ciphertext.length);
 	packed.set(iv);
 	packed.set(ciphertext, iv.length);
-	return base64UrlEncode(packed);
+	const sealed = base64UrlEncode(packed);
+	const cookieName = options.cookieName ?? "polyx_session";
+	const bytes = sealedCookieByteLength(sealed, cookieName);
+	if (bytes > 4096) throw new SessionCookieTooLargeError(bytes, SESSION_COOKIE_MAX_BYTES, cookieName);
+	return sealed;
 }
 async function openSession(token, secret) {
 	try {
@@ -65,6 +91,23 @@ async function openSession(token, secret) {
 	}
 }
 //#endregion
+//#region src/cookie-adapter.ts
+/**
+* Attributes for the session cookie (ADR-0004 secure custody). `secure` is decided at
+* write time from the actual transport: a `Secure` cookie is silently dropped by the
+* browser over plain http, so http/localhost dev must set `secure:false` while https
+* always sets `secure:true`. This is not a downgrade — `Secure` carries no meaning on
+* http; setting it there just breaks the session. httpOnly/sameSite/path are unchanged.
+*/
+function buildSessionCookieOptions(secure) {
+	return {
+		httpOnly: true,
+		secure,
+		sameSite: "lax",
+		path: "/"
+	};
+}
+//#endregion
 //#region src/server-session.ts
 /**
 * The framework-agnostic BFF session controller (F007): tokens sealed in an
@@ -113,6 +156,11 @@ var ServerSession = class {
 				this.clear();
 				return null;
 			}
+			if (error instanceof SessionCookieTooLargeError) {
+				console.error(`[polyx] ${error.message}`);
+				this.clear();
+				return null;
+			}
 			throw error;
 		}
 	}
@@ -138,7 +186,7 @@ var ServerSession = class {
 		this.cookies.delete(this.cookieName);
 	}
 	async write(session) {
-		const sealed = await sealSession(session, this.secret);
+		const sealed = await sealSession(session, this.secret, { cookieName: this.cookieName });
 		this.cookies.set(this.cookieName, sealed, buildSessionCookieOptions(this.secure));
 	}
 };
@@ -162,12 +210,24 @@ Object.defineProperty(exports, "DEFAULT_SESSION_COOKIE", {
 		return DEFAULT_SESSION_COOKIE;
 	}
 });
+Object.defineProperty(exports, "SESSION_COOKIE_MAX_BYTES", {
+	enumerable: true,
+	get: function() {
+		return SESSION_COOKIE_MAX_BYTES;
+	}
+});
 Object.defineProperty(exports, "ServerSession", {
 	enumerable: true,
 	get: function() {
 		return ServerSession;
 	}
 });
+Object.defineProperty(exports, "SessionCookieTooLargeError", {
+	enumerable: true,
+	get: function() {
+		return SessionCookieTooLargeError;
+	}
+});
 Object.defineProperty(exports, "openSession", {
 	enumerable: true,
 	get: function() {
@@ -180,6 +240,12 @@ Object.defineProperty(exports, "sealSession", {
 		return sealSession;
 	}
 });
+Object.defineProperty(exports, "sealedCookieByteLength", {
+	enumerable: true,
+	get: function() {
+		return sealedCookieByteLength;
+	}
+});
 Object.defineProperty(exports, "toAuthContext", {
 	enumerable: true,
 	get: function() {

package/dist/{server-session-CjP44zFC.mjs → server-session-pY-nzh5x.mjs}

@@ -1,23 +1,45 @@
-import { SessionExpiredError, SessionRevokedError } from "@poly-x/core";
-//#region src/cookie-adapter.ts
+import { PolyXError, SessionExpiredError, SessionRevokedError } from "@poly-x/core";
+//#region src/cookie-codec.ts
 /**
-* Attributes for the session cookie (ADR-0004 secure custody). `secure` is decided at
-* write time from the actual transport: a `Secure` cookie is silently dropped by the
-* browser over plain http, so http/localhost dev must set `secure:false` while https
-* always sets `secure:true`. This is not a downgrade — `Secure` carries no meaning on
-* http; setting it there just breaks the session. httpOnly/sameSite/path are unchanged.
+* AES-GCM sealing of the session cookie (F007 / ADR-0004). The key is derived
+* (SHA-256) from the consumer's `POLYX_SESSION_SECRET`; AES-GCM gives
+* confidentiality + tamper-detection together, so any corruption, truncation,
+* or wrong-secret input decrypts to `null` rather than a partial session.
+* Web Crypto is universal (Node ≥20 + edge runtimes), so this runs anywhere a
+* Next route handler runs.
 */
-function buildSessionCookieOptions(secure) {
-	return {
-		httpOnly: true,
-		secure,
-		sameSite: "lax",
-		path: "/"
-	};
-}
-//#endregion
-//#region src/cookie-codec.ts
 const IV_BYTES = 12;
+/**
+* Browsers cap a single cookie at roughly 4096 bytes for the whole `Set-Cookie` pair —
+* name, value and attributes together — and enforce it by DISCARDING the cookie without
+* an error. For a session cookie that failure is invisible and badly misleading: the
+* platform authenticates, the handler answers 200, and the user is bounced back to
+* sign-in on the next request because the cookie was never stored.
+*
+* poly-x-sdk/ADR-0006 measured a live Odin session at 2628 bytes and recorded the missing
+* guard as an open follow-up; a per-tenant flag that inflates the JWT is enough to cross
+* the line. We fail loudly here instead.
+*/
+const SESSION_COOKIE_MAX_BYTES = 4096;
+/** Attributes `buildSessionCookieOptions` always sets: `Path=/; HttpOnly; Secure; SameSite=Lax`. */
+const COOKIE_ATTRIBUTE_BYTES = 45;
+/** Bytes the whole `Set-Cookie` pair will occupy for this value under this cookie name. */
+function sealedCookieByteLength(value, cookieName = "polyx_session") {
+	return new TextEncoder().encode(cookieName).length + 1 + value.length + COOKIE_ATTRIBUTE_BYTES;
+}
+/**
+* Thrown when a sealed session would exceed what a browser will store. Never includes the
+* session itself — the claims that caused the overflow are exactly the data we must not log.
+*/
+var SessionCookieTooLargeError = class extends PolyXError {
+	bytes;
+	limit;
+	constructor(bytes, limit, cookieName) {
+		super(`PolyX session cookie is ${bytes} bytes, over the ~${limit}-byte browser limit for "${cookieName}". The browser would discard it silently and the user would appear signed out. Reduce what the platform puts in the session — the usual cause is a tenant configured to embed full permissions in the JWT (includeFullPermissionInJwt).`, { code: "SESSION_COOKIE_TOO_LARGE" });
+		this.bytes = bytes;
+		this.limit = limit;
+	}
+};
 function base64UrlEncode(bytes) {
 	let binary = "";
 	for (const byte of bytes) binary += String.fromCharCode(byte);
@@ -35,7 +57,7 @@ async function deriveKey(secret) {
 	const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret));
 	return crypto.subtle.importKey("raw", hash, "AES-GCM", false, ["encrypt", "decrypt"]);
 }
-async function sealSession(session, secret) {
+async function sealSession(session, secret, options = {}) {
 	const key = await deriveKey(secret);
 	const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
 	const plaintext = new TextEncoder().encode(JSON.stringify(session));
@@ -46,7 +68,11 @@ async function sealSession(session, secret) {
 	const packed = new Uint8Array(iv.length + ciphertext.length);
 	packed.set(iv);
 	packed.set(ciphertext, iv.length);
-	return base64UrlEncode(packed);
+	const sealed = base64UrlEncode(packed);
+	const cookieName = options.cookieName ?? "polyx_session";
+	const bytes = sealedCookieByteLength(sealed, cookieName);
+	if (bytes > 4096) throw new SessionCookieTooLargeError(bytes, SESSION_COOKIE_MAX_BYTES, cookieName);
+	return sealed;
 }
 async function openSession(token, secret) {
 	try {
@@ -65,6 +91,23 @@ async function openSession(token, secret) {
 	}
 }
 //#endregion
+//#region src/cookie-adapter.ts
+/**
+* Attributes for the session cookie (ADR-0004 secure custody). `secure` is decided at
+* write time from the actual transport: a `Secure` cookie is silently dropped by the
+* browser over plain http, so http/localhost dev must set `secure:false` while https
+* always sets `secure:true`. This is not a downgrade — `Secure` carries no meaning on
+* http; setting it there just breaks the session. httpOnly/sameSite/path are unchanged.
+*/
+function buildSessionCookieOptions(secure) {
+	return {
+		httpOnly: true,
+		secure,
+		sameSite: "lax",
+		path: "/"
+	};
+}
+//#endregion
 //#region src/server-session.ts
 /**
 * The framework-agnostic BFF session controller (F007): tokens sealed in an
@@ -113,6 +156,11 @@ var ServerSession = class {
 				this.clear();
 				return null;
 			}
+			if (error instanceof SessionCookieTooLargeError) {
+				console.error(`[polyx] ${error.message}`);
+				this.clear();
+				return null;
+			}
 			throw error;
 		}
 	}
@@ -138,7 +186,7 @@ var ServerSession = class {
 		this.cookies.delete(this.cookieName);
 	}
 	async write(session) {
-		const sealed = await sealSession(session, this.secret);
+		const sealed = await sealSession(session, this.secret, { cookieName: this.cookieName });
 		this.cookies.set(this.cookieName, sealed, buildSessionCookieOptions(this.secure));
 	}
 };
@@ -156,4 +204,4 @@ function toAuthContext(session) {
 	};
 }
 //#endregion
-export { sealSession as a, openSession as i, ServerSession as n, toAuthContext as r, DEFAULT_SESSION_COOKIE as t };
+export { SessionCookieTooLargeError as a, sealedCookieByteLength as c, SESSION_COOKIE_MAX_BYTES as i, ServerSession as n, openSession as o, toAuthContext as r, sealSession as s, DEFAULT_SESSION_COOKIE as t };

package/dist/server.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_server_session = require("./server-session-QJLA_Tz-.cjs");
+const require_server_session = require("./server-session-Df9HXl_5.cjs");
 let _poly_x_core = require("@poly-x/core");
 let next_headers = require("next/headers");
 //#region src/config.ts
@@ -223,16 +223,30 @@ function createAuthHandlers(handlersConfig = {}) {
 					tenantId
 				});
 				switch (outcome.type) {
-					case "authorized":
-						await newSession(adapt(await (0, next_headers.cookies)()), config, secure).establishFromCode(outcome.code, verifier, redirectUri, {
-							...collectForwardedDeviceHeaders(request),
-							...geoHeaders,
-							...deviceContextHeaders
-						});
+					case "authorized": {
+						const store = await (0, next_headers.cookies)();
+						try {
+							await newSession(adapt(store), config, secure).establishFromCode(outcome.code, verifier, redirectUri, {
+								...collectForwardedDeviceHeaders(request),
+								...geoHeaders,
+								...deviceContextHeaders
+							});
+						} catch (error) {
+							if (error instanceof require_server_session.SessionCookieTooLargeError) {
+								console.error(`[polyx] ${error.message}`);
+								return Response.json({
+									status: "session_too_large",
+									bytes: error.bytes,
+									limit: error.limit
+								}, { status: 500 });
+							}
+							throw error;
+						}
 						return Response.json({
 							status: "success",
 							redirectTo: afterSignInPath
 						});
+					}
 					case "select_tenant": return Response.json({
 						status: "select_tenant",
 						tenants: outcome.tenants,
@@ -328,7 +342,15 @@ function createAuthHandlers(handlersConfig = {}) {
 			if (!code || !state || !raw) return Response.redirect(home, 302);
 			const tx = JSON.parse(raw);
 			if (tx.state !== state) return Response.redirect(home, 302);
-			await newSession(adapt(store), config, secure).establishFromCode(code, tx.verifier, tx.redirectUri, collectForwardedDeviceHeaders(request));
+			try {
+				await newSession(adapt(store), config, secure).establishFromCode(code, tx.verifier, tx.redirectUri, collectForwardedDeviceHeaders(request));
+			} catch (error) {
+				if (error instanceof require_server_session.SessionCookieTooLargeError) {
+					console.error(`[polyx] ${error.message}`);
+					return Response.redirect(home, 302);
+				}
+				throw error;
+			}
 			return Response.redirect(home, 302);
 		},
 		async refresh(request) {
@@ -375,9 +397,12 @@ function createAuthHandlers(handlersConfig = {}) {
 }
 //#endregion
 exports.DEFAULT_SESSION_COOKIE = require_server_session.DEFAULT_SESSION_COOKIE;
+exports.SESSION_COOKIE_MAX_BYTES = require_server_session.SESSION_COOKIE_MAX_BYTES;
 exports.ServerSession = require_server_session.ServerSession;
+exports.SessionCookieTooLargeError = require_server_session.SessionCookieTooLargeError;
 exports.auth = auth;
 exports.createAuthHandlers = createAuthHandlers;
 exports.openSession = require_server_session.openSession;
 exports.resolveNextConfig = resolveNextConfig;
 exports.sealSession = require_server_session.sealSession;
+exports.sealedCookieByteLength = require_server_session.sealedCookieByteLength;

package/dist/server.d.cts

@@ -1,4 +1,4 @@
-import { AuthClient, StoredSession } from "@poly-x/core";
+import { AuthClient, PolyXError, StoredSession } from "@poly-x/core";
 
 //#region src/config.d.ts
 interface NextServerConfig {
@@ -85,7 +85,34 @@ interface AuthContext {
 }
 //#endregion
 //#region src/cookie-codec.d.ts
-declare function sealSession(session: StoredSession, secret: string): Promise<string>;
+/**
+ * Browsers cap a single cookie at roughly 4096 bytes for the whole `Set-Cookie` pair —
+ * name, value and attributes together — and enforce it by DISCARDING the cookie without
+ * an error. For a session cookie that failure is invisible and badly misleading: the
+ * platform authenticates, the handler answers 200, and the user is bounced back to
+ * sign-in on the next request because the cookie was never stored.
+ *
+ * poly-x-sdk/ADR-0006 measured a live Odin session at 2628 bytes and recorded the missing
+ * guard as an open follow-up; a per-tenant flag that inflates the JWT is enough to cross
+ * the line. We fail loudly here instead.
+ */
+declare const SESSION_COOKIE_MAX_BYTES = 4096;
+/** Bytes the whole `Set-Cookie` pair will occupy for this value under this cookie name. */
+declare function sealedCookieByteLength(value: string, cookieName?: string): number;
+/**
+ * Thrown when a sealed session would exceed what a browser will store. Never includes the
+ * session itself — the claims that caused the overflow are exactly the data we must not log.
+ */
+declare class SessionCookieTooLargeError extends PolyXError {
+  readonly bytes: number;
+  readonly limit: number;
+  constructor(bytes: number, limit: number, cookieName: string);
+}
+interface SealSessionOptions {
+  /** The cookie name the value will be stored under; counted against the browser budget. */
+  cookieName?: string;
+}
+declare function sealSession(session: StoredSession, secret: string, options?: SealSessionOptions): Promise<string>;
 declare function openSession(token: string, secret: string): Promise<StoredSession | null>;
 //#endregion
 //#region src/server.d.ts
@@ -175,9 +202,13 @@ type AuthenticateResult = {
   status: "no_access";
 } | {
   status: "invalid_credentials";
+} /** Credentials were correct, but the sealed session exceeds what a browser will store. */ | {
+  status: "session_too_large";
+  bytes: number;
+  limit: number;
 } | {
   status: "invalid_request";
 };
 declare function createAuthHandlers(handlersConfig?: AuthHandlersConfig): AuthHandlers;
 //#endregion
-export { type AuthContext, AuthHandlers, AuthHandlersConfig, AuthenticateResult, type CookieAdapter, type CookieSetOptions, DEFAULT_SESSION_COOKIE, ForgotPasswordResult, type NextServerConfig, ResetPasswordResult, ServerSession, auth, createAuthHandlers, openSession, resolveNextConfig, sealSession };
+export { type AuthContext, AuthHandlers, AuthHandlersConfig, AuthenticateResult, type CookieAdapter, type CookieSetOptions, DEFAULT_SESSION_COOKIE, ForgotPasswordResult, type NextServerConfig, ResetPasswordResult, SESSION_COOKIE_MAX_BYTES, ServerSession, SessionCookieTooLargeError, auth, createAuthHandlers, openSession, resolveNextConfig, sealSession, sealedCookieByteLength };

package/dist/server.d.mts

@@ -1,4 +1,4 @@
-import { AuthClient, StoredSession } from "@poly-x/core";
+import { AuthClient, PolyXError, StoredSession } from "@poly-x/core";
 
 //#region src/config.d.ts
 interface NextServerConfig {
@@ -85,7 +85,34 @@ interface AuthContext {
 }
 //#endregion
 //#region src/cookie-codec.d.ts
-declare function sealSession(session: StoredSession, secret: string): Promise<string>;
+/**
+ * Browsers cap a single cookie at roughly 4096 bytes for the whole `Set-Cookie` pair —
+ * name, value and attributes together — and enforce it by DISCARDING the cookie without
+ * an error. For a session cookie that failure is invisible and badly misleading: the
+ * platform authenticates, the handler answers 200, and the user is bounced back to
+ * sign-in on the next request because the cookie was never stored.
+ *
+ * poly-x-sdk/ADR-0006 measured a live Odin session at 2628 bytes and recorded the missing
+ * guard as an open follow-up; a per-tenant flag that inflates the JWT is enough to cross
+ * the line. We fail loudly here instead.
+ */
+declare const SESSION_COOKIE_MAX_BYTES = 4096;
+/** Bytes the whole `Set-Cookie` pair will occupy for this value under this cookie name. */
+declare function sealedCookieByteLength(value: string, cookieName?: string): number;
+/**
+ * Thrown when a sealed session would exceed what a browser will store. Never includes the
+ * session itself — the claims that caused the overflow are exactly the data we must not log.
+ */
+declare class SessionCookieTooLargeError extends PolyXError {
+  readonly bytes: number;
+  readonly limit: number;
+  constructor(bytes: number, limit: number, cookieName: string);
+}
+interface SealSessionOptions {
+  /** The cookie name the value will be stored under; counted against the browser budget. */
+  cookieName?: string;
+}
+declare function sealSession(session: StoredSession, secret: string, options?: SealSessionOptions): Promise<string>;
 declare function openSession(token: string, secret: string): Promise<StoredSession | null>;
 //#endregion
 //#region src/server.d.ts
@@ -175,9 +202,13 @@ type AuthenticateResult = {
   status: "no_access";
 } | {
   status: "invalid_credentials";
+} /** Credentials were correct, but the sealed session exceeds what a browser will store. */ | {
+  status: "session_too_large";
+  bytes: number;
+  limit: number;
 } | {
   status: "invalid_request";
 };
 declare function createAuthHandlers(handlersConfig?: AuthHandlersConfig): AuthHandlers;
 //#endregion
-export { type AuthContext, AuthHandlers, AuthHandlersConfig, AuthenticateResult, type CookieAdapter, type CookieSetOptions, DEFAULT_SESSION_COOKIE, ForgotPasswordResult, type NextServerConfig, ResetPasswordResult, ServerSession, auth, createAuthHandlers, openSession, resolveNextConfig, sealSession };
+export { type AuthContext, AuthHandlers, AuthHandlersConfig, AuthenticateResult, type CookieAdapter, type CookieSetOptions, DEFAULT_SESSION_COOKIE, ForgotPasswordResult, type NextServerConfig, ResetPasswordResult, SESSION_COOKIE_MAX_BYTES, ServerSession, SessionCookieTooLargeError, auth, createAuthHandlers, openSession, resolveNextConfig, sealSession, sealedCookieByteLength };

package/dist/server.mjs

@@ -1,4 +1,4 @@
-import { a as sealSession, i as openSession, n as ServerSession, r as toAuthContext, t as DEFAULT_SESSION_COOKIE } from "./server-session-CjP44zFC.mjs";
+import { a as SessionCookieTooLargeError, c as sealedCookieByteLength, i as SESSION_COOKIE_MAX_BYTES, n as ServerSession, o as openSession, r as toAuthContext, s as sealSession, t as DEFAULT_SESSION_COOKIE } from "./server-session-pY-nzh5x.mjs";
 import { AuthClient, FetchTransport, generatePkce, randomState, resolveConfig } from "@poly-x/core";
 import { cookies } from "next/headers";
 //#region src/config.ts
@@ -222,16 +222,30 @@ function createAuthHandlers(handlersConfig = {}) {
 					tenantId
 				});
 				switch (outcome.type) {
-					case "authorized":
-						await newSession(adapt(await cookies()), config, secure).establishFromCode(outcome.code, verifier, redirectUri, {
-							...collectForwardedDeviceHeaders(request),
-							...geoHeaders,
-							...deviceContextHeaders
-						});
+					case "authorized": {
+						const store = await cookies();
+						try {
+							await newSession(adapt(store), config, secure).establishFromCode(outcome.code, verifier, redirectUri, {
+								...collectForwardedDeviceHeaders(request),
+								...geoHeaders,
+								...deviceContextHeaders
+							});
+						} catch (error) {
+							if (error instanceof SessionCookieTooLargeError) {
+								console.error(`[polyx] ${error.message}`);
+								return Response.json({
+									status: "session_too_large",
+									bytes: error.bytes,
+									limit: error.limit
+								}, { status: 500 });
+							}
+							throw error;
+						}
 						return Response.json({
 							status: "success",
 							redirectTo: afterSignInPath
 						});
+					}
 					case "select_tenant": return Response.json({
 						status: "select_tenant",
 						tenants: outcome.tenants,
@@ -327,7 +341,15 @@ function createAuthHandlers(handlersConfig = {}) {
 			if (!code || !state || !raw) return Response.redirect(home, 302);
 			const tx = JSON.parse(raw);
 			if (tx.state !== state) return Response.redirect(home, 302);
-			await newSession(adapt(store), config, secure).establishFromCode(code, tx.verifier, tx.redirectUri, collectForwardedDeviceHeaders(request));
+			try {
+				await newSession(adapt(store), config, secure).establishFromCode(code, tx.verifier, tx.redirectUri, collectForwardedDeviceHeaders(request));
+			} catch (error) {
+				if (error instanceof SessionCookieTooLargeError) {
+					console.error(`[polyx] ${error.message}`);
+					return Response.redirect(home, 302);
+				}
+				throw error;
+			}
 			return Response.redirect(home, 302);
 		},
 		async refresh(request) {
@@ -373,4 +395,4 @@ function createAuthHandlers(handlersConfig = {}) {
 	};
 }
 //#endregion
-export { DEFAULT_SESSION_COOKIE, ServerSession, auth, createAuthHandlers, openSession, resolveNextConfig, sealSession };
+export { DEFAULT_SESSION_COOKIE, SESSION_COOKIE_MAX_BYTES, ServerSession, SessionCookieTooLargeError, auth, createAuthHandlers, openSession, resolveNextConfig, sealSession, sealedCookieByteLength };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poly-x/next",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "PolyX SDK for Next.js App Router - components plus server helpers",
   "license": "MIT",
   "type": "module",
@@ -47,8 +47,8 @@
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.cts",
   "dependencies": {
-    "@poly-x/core": "0.1.0",
-    "@poly-x/react": "0.1.0"
+    "@poly-x/core": "0.1.1",
+    "@poly-x/react": "0.1.1"
   },
   "peerDependencies": {
     "next": ">=14",