@poly-x/next 0.1.1 → 0.2.0

package/dist/session-cookie-AEnY4PVW.d.cts

@@ -0,0 +1,21 @@
+//#region src/session-cookie.d.ts
+/**
+ * The session cookie's name, in a module with NO imports (F015 / FR-SESS-4).
+ *
+ * Both consuming apps hard-code `"polyx_session"` rather than importing it, and the
+ * reason is mechanical: it lived in `server-session.ts`, so importing it from the edge
+ * dragged server-only code into the edge runtime. A hard-coded copy in each app is a
+ * silent breakage waiting to happen — if the SDK ever changed the name, route gating
+ * would fail open or closed with nothing to point at.
+ *
+ * This module is safe to import anywhere: edge middleware, the browser, the server.
+ */
+/** The cookie the SDK seals the session into. */
+declare const DEFAULT_SESSION_COOKIE = "polyx_session";
+/**
+ * Read the sealed session value out of a raw `Cookie` header, without unsealing it.
+ * Useful at the edge, where presence is all that can be checked cheaply.
+ */
+declare function readSessionCookie(cookieHeader: string | null | undefined, cookieName?: string): string | undefined;
+//#endregion
+export { readSessionCookie as n, DEFAULT_SESSION_COOKIE as t };

package/dist/session-cookie-AEnY4PVW.d.mts

@@ -0,0 +1,21 @@
+//#region src/session-cookie.d.ts
+/**
+ * The session cookie's name, in a module with NO imports (F015 / FR-SESS-4).
+ *
+ * Both consuming apps hard-code `"polyx_session"` rather than importing it, and the
+ * reason is mechanical: it lived in `server-session.ts`, so importing it from the edge
+ * dragged server-only code into the edge runtime. A hard-coded copy in each app is a
+ * silent breakage waiting to happen — if the SDK ever changed the name, route gating
+ * would fail open or closed with nothing to point at.
+ *
+ * This module is safe to import anywhere: edge middleware, the browser, the server.
+ */
+/** The cookie the SDK seals the session into. */
+declare const DEFAULT_SESSION_COOKIE = "polyx_session";
+/**
+ * Read the sealed session value out of a raw `Cookie` header, without unsealing it.
+ * Useful at the edge, where presence is all that can be checked cheaply.
+ */
+declare function readSessionCookie(cookieHeader: string | null | undefined, cookieName?: string): string | undefined;
+//#endregion
+export { readSessionCookie as n, DEFAULT_SESSION_COOKIE as t };

package/dist/session-cookie-BQD10B3D.cjs

@@ -0,0 +1,34 @@
+//#region src/session-cookie.ts
+/**
+* The session cookie's name, in a module with NO imports (F015 / FR-SESS-4).
+*
+* Both consuming apps hard-code `"polyx_session"` rather than importing it, and the
+* reason is mechanical: it lived in `server-session.ts`, so importing it from the edge
+* dragged server-only code into the edge runtime. A hard-coded copy in each app is a
+* silent breakage waiting to happen — if the SDK ever changed the name, route gating
+* would fail open or closed with nothing to point at.
+*
+* This module is safe to import anywhere: edge middleware, the browser, the server.
+*/
+/** The cookie the SDK seals the session into. */
+const DEFAULT_SESSION_COOKIE = "polyx_session";
+/**
+* Read the sealed session value out of a raw `Cookie` header, without unsealing it.
+* Useful at the edge, where presence is all that can be checked cheaply.
+*/
+function readSessionCookie(cookieHeader, cookieName = DEFAULT_SESSION_COOKIE) {
+	return cookieHeader?.split(";").map((part) => part.trim()).find((part) => part.startsWith(`${cookieName}=`))?.slice(cookieName.length + 1);
+}
+//#endregion
+Object.defineProperty(exports, "DEFAULT_SESSION_COOKIE", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_SESSION_COOKIE;
+	}
+});
+Object.defineProperty(exports, "readSessionCookie", {
+	enumerable: true,
+	get: function() {
+		return readSessionCookie;
+	}
+});

package/dist/session-cookie-C23WspJZ.mjs

@@ -0,0 +1,23 @@
+//#region src/session-cookie.ts
+/**
+* The session cookie's name, in a module with NO imports (F015 / FR-SESS-4).
+*
+* Both consuming apps hard-code `"polyx_session"` rather than importing it, and the
+* reason is mechanical: it lived in `server-session.ts`, so importing it from the edge
+* dragged server-only code into the edge runtime. A hard-coded copy in each app is a
+* silent breakage waiting to happen — if the SDK ever changed the name, route gating
+* would fail open or closed with nothing to point at.
+*
+* This module is safe to import anywhere: edge middleware, the browser, the server.
+*/
+/** The cookie the SDK seals the session into. */
+const DEFAULT_SESSION_COOKIE = "polyx_session";
+/**
+* Read the sealed session value out of a raw `Cookie` header, without unsealing it.
+* Useful at the edge, where presence is all that can be checked cheaply.
+*/
+function readSessionCookie(cookieHeader, cookieName = DEFAULT_SESSION_COOKIE) {
+	return cookieHeader?.split(";").map((part) => part.trim()).find((part) => part.startsWith(`${cookieName}=`))?.slice(cookieName.length + 1);
+}
+//#endregion
+export { readSessionCookie as n, DEFAULT_SESSION_COOKIE as t };

package/dist/styles.css

@@ -709,6 +709,157 @@
 	color: var(--polyx-muted-fg);
 }
 
+/* --- User profile dialog (v0.4) ------------------------------------------ */
+
+.polyx-userprofile__trigger {
+	font: inherit;
+	font-size: 0.875rem;
+	color: var(--polyx-fg);
+	background: none;
+	border: none;
+	padding: 0;
+	cursor: pointer;
+}
+
+.polyx-userprofile__overlay {
+	position: fixed;
+	inset: 0;
+	z-index: 50;
+	display: flex;
+	align-items: center;
+	justify-content: center;
+	padding: 1rem;
+	background: rgb(0 0 0 / 0.45);
+	overflow-y: auto;
+}
+
+.polyx-userprofile__dialog {
+	width: 100%;
+	max-width: 28rem;
+	padding: 1.5rem;
+	background: var(--polyx-bg);
+	color: var(--polyx-fg);
+	border: 1px solid var(--polyx-border);
+	border-radius: var(--polyx-radius);
+	box-shadow: var(--polyx-shadow);
+}
+
+.polyx-userprofile__header {
+	margin-bottom: 1.25rem;
+}
+
+.polyx-userprofile__title {
+	margin: 0;
+	font-size: 1.0625rem;
+	font-weight: 600;
+}
+
+.polyx-userprofile__description {
+	margin: 0.25rem 0 0;
+	font-size: 0.8125rem;
+	color: var(--polyx-muted-fg);
+}
+
+.polyx-userprofile__status {
+	margin: 0;
+	font-size: 0.875rem;
+	color: var(--polyx-muted-fg);
+}
+
+.polyx-userprofile__photo {
+	display: flex;
+	align-items: center;
+	gap: 0.875rem;
+}
+
+.polyx-userprofile__photo-actions {
+	display: flex;
+	flex-direction: column;
+	gap: 0.25rem;
+}
+
+.polyx-userprofile__photo-button {
+	font: inherit;
+	font-size: 0.8125rem;
+	font-weight: 500;
+	color: var(--polyx-brand);
+	background: none;
+	border: none;
+	padding: 0;
+	text-align: left;
+	cursor: pointer;
+}
+
+/* Hidden from sight but not from assistive technology — the visible control is the button. */
+.polyx-userprofile__file {
+	position: absolute;
+	width: 1px;
+	height: 1px;
+	padding: 0;
+	margin: -1px;
+	overflow: hidden;
+	clip: rect(0, 0, 0, 0);
+	white-space: nowrap;
+	border: 0;
+}
+
+.polyx-userprofile__row {
+	display: grid;
+	grid-template-columns: 1fr 1fr;
+	gap: 0.75rem;
+}
+
+@media (max-width: 24rem) {
+	.polyx-userprofile__row {
+		grid-template-columns: 1fr;
+	}
+}
+
+.polyx-userprofile__optional {
+	font-weight: 400;
+	color: var(--polyx-muted-fg);
+}
+
+.polyx-userprofile__field-error {
+	margin: 0;
+	font-size: 0.8125rem;
+	color: var(--polyx-danger);
+}
+
+.polyx-userprofile__success {
+	margin: 0;
+	padding: 0.625rem 0.75rem;
+	font-size: 0.8125rem;
+	color: var(--polyx-fg);
+	background: var(--polyx-panel-bg);
+	border: 1px solid var(--polyx-border);
+	border-radius: var(--polyx-radius-sm);
+}
+
+.polyx-userprofile__actions {
+	display: flex;
+	justify-content: flex-end;
+	gap: 0.625rem;
+}
+
+.polyx-userprofile__cancel {
+	font: inherit;
+	font-size: 0.875rem;
+	font-weight: 500;
+	height: 2.5rem;
+	padding: 0 0.875rem;
+	color: var(--polyx-fg);
+	background: none;
+	border: 1px solid var(--polyx-border);
+	border-radius: var(--polyx-radius-sm);
+	cursor: pointer;
+}
+
+.polyx-userprofile__actions .polyx-signin__submit {
+	width: auto;
+	padding: 0 1.125rem;
+}
+
 /* Closes `@layer polyx` — opened at the top of the file. The rules above are left
    unindented deliberately: wrapping the sheet in a layer is a cascade change, not a
    reformat, and re-indenting 600 lines would bury it in the diff. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poly-x/next",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "PolyX SDK for Next.js App Router - components plus server helpers",
   "license": "MIT",
   "type": "module",
@@ -47,8 +47,8 @@
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.cts",
   "dependencies": {
-    "@poly-x/core": "0.1.1",
-    "@poly-x/react": "0.1.1"
+    "@poly-x/core": "0.2.0",
+    "@poly-x/react": "0.2.0"
   },
   "peerDependencies": {
     "next": ">=14",

package/dist/server-session-Df9HXl_5.cjs

@@ -1,254 +0,0 @@
-let _poly_x_core = require("@poly-x/core");
-//#region src/cookie-codec.ts
-/**
-* AES-GCM sealing of the session cookie (F007 / ADR-0004). The key is derived
-* (SHA-256) from the consumer's `POLYX_SESSION_SECRET`; AES-GCM gives
-* confidentiality + tamper-detection together, so any corruption, truncation,
-* or wrong-secret input decrypts to `null` rather than a partial session.
-* Web Crypto is universal (Node ≥20 + edge runtimes), so this runs anywhere a
-* Next route handler runs.
-*/
-const IV_BYTES = 12;
-/**
-* Browsers cap a single cookie at roughly 4096 bytes for the whole `Set-Cookie` pair —
-* name, value and attributes together — and enforce it by DISCARDING the cookie without
-* an error. For a session cookie that failure is invisible and badly misleading: the
-* platform authenticates, the handler answers 200, and the user is bounced back to
-* sign-in on the next request because the cookie was never stored.
-*
-* poly-x-sdk/ADR-0006 measured a live Odin session at 2628 bytes and recorded the missing
-* guard as an open follow-up; a per-tenant flag that inflates the JWT is enough to cross
-* the line. We fail loudly here instead.
-*/
-const SESSION_COOKIE_MAX_BYTES = 4096;
-/** Attributes `buildSessionCookieOptions` always sets: `Path=/; HttpOnly; Secure; SameSite=Lax`. */
-const COOKIE_ATTRIBUTE_BYTES = 45;
-/** Bytes the whole `Set-Cookie` pair will occupy for this value under this cookie name. */
-function sealedCookieByteLength(value, cookieName = "polyx_session") {
-	return new TextEncoder().encode(cookieName).length + 1 + value.length + COOKIE_ATTRIBUTE_BYTES;
-}
-/**
-* Thrown when a sealed session would exceed what a browser will store. Never includes the
-* session itself — the claims that caused the overflow are exactly the data we must not log.
-*/
-var SessionCookieTooLargeError = class extends _poly_x_core.PolyXError {
-	bytes;
-	limit;
-	constructor(bytes, limit, cookieName) {
-		super(`PolyX session cookie is ${bytes} bytes, over the ~${limit}-byte browser limit for "${cookieName}". The browser would discard it silently and the user would appear signed out. Reduce what the platform puts in the session — the usual cause is a tenant configured to embed full permissions in the JWT (includeFullPermissionInJwt).`, { code: "SESSION_COOKIE_TOO_LARGE" });
-		this.bytes = bytes;
-		this.limit = limit;
-	}
-};
-function base64UrlEncode(bytes) {
-	let binary = "";
-	for (const byte of bytes) binary += String.fromCharCode(byte);
-	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function base64UrlDecode(text) {
-	const base64 = text.replace(/-/g, "+").replace(/_/g, "/");
-	const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
-	const binary = atob(padded);
-	const bytes = new Uint8Array(binary.length);
-	for (let i = 0; i < binary.length; i += 1) bytes[i] = binary.charCodeAt(i);
-	return bytes;
-}
-async function deriveKey(secret) {
-	const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret));
-	return crypto.subtle.importKey("raw", hash, "AES-GCM", false, ["encrypt", "decrypt"]);
-}
-async function sealSession(session, secret, options = {}) {
-	const key = await deriveKey(secret);
-	const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
-	const plaintext = new TextEncoder().encode(JSON.stringify(session));
-	const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
-		name: "AES-GCM",
-		iv
-	}, key, plaintext));
-	const packed = new Uint8Array(iv.length + ciphertext.length);
-	packed.set(iv);
-	packed.set(ciphertext, iv.length);
-	const sealed = base64UrlEncode(packed);
-	const cookieName = options.cookieName ?? "polyx_session";
-	const bytes = sealedCookieByteLength(sealed, cookieName);
-	if (bytes > 4096) throw new SessionCookieTooLargeError(bytes, SESSION_COOKIE_MAX_BYTES, cookieName);
-	return sealed;
-}
-async function openSession(token, secret) {
-	try {
-		const packed = base64UrlDecode(token);
-		if (packed.length <= IV_BYTES) return null;
-		const iv = packed.slice(0, IV_BYTES);
-		const ciphertext = packed.slice(IV_BYTES);
-		const key = await deriveKey(secret);
-		const plaintext = await crypto.subtle.decrypt({
-			name: "AES-GCM",
-			iv
-		}, key, ciphertext);
-		return JSON.parse(new TextDecoder().decode(plaintext));
-	} catch {
-		return null;
-	}
-}
-//#endregion
-//#region src/cookie-adapter.ts
-/**
-* Attributes for the session cookie (ADR-0004 secure custody). `secure` is decided at
-* write time from the actual transport: a `Secure` cookie is silently dropped by the
-* browser over plain http, so http/localhost dev must set `secure:false` while https
-* always sets `secure:true`. This is not a downgrade — `Secure` carries no meaning on
-* http; setting it there just breaks the session. httpOnly/sameSite/path are unchanged.
-*/
-function buildSessionCookieOptions(secure) {
-	return {
-		httpOnly: true,
-		secure,
-		sameSite: "lax",
-		path: "/"
-	};
-}
-//#endregion
-//#region src/server-session.ts
-/**
-* The framework-agnostic BFF session controller (F007): tokens sealed in an
-* httpOnly cookie on the consumer's domain, exchanged/refreshed server-side.
-* Composes core's AuthClient with a CookieAdapter seam; fully unit-testable.
-*/
-const DEFAULT_SESSION_COOKIE = "polyx_session";
-var ServerSession = class {
-	authClient;
-	secret;
-	cookies;
-	cookieName;
-	secure;
-	constructor(options) {
-		this.authClient = options.authClient;
-		this.secret = options.secret;
-		this.cookies = options.cookies;
-		this.cookieName = options.cookieName ?? "polyx_session";
-		this.secure = options.secure ?? true;
-	}
-	async establishFromCode(code, codeVerifier, redirectUri, forwardedHeaders) {
-		const stored = await this.authClient.exchangeCode({
-			code,
-			codeVerifier,
-			redirectUri,
-			forwardedHeaders
-		});
-		await this.write(stored);
-		return stored;
-	}
-	async read() {
-		const raw = this.cookies.get(this.cookieName);
-		if (!raw) return null;
-		return openSession(raw, this.secret);
-	}
-	/** Rotate the tokens; clears the cookie (returns null) on a terminal refresh failure. */
-	async refresh() {
-		const current = await this.read();
-		if (!current) return null;
-		try {
-			const next = await this.authClient.createRefresher()(current);
-			await this.write(next);
-			return next;
-		} catch (error) {
-			if (error instanceof _poly_x_core.SessionRevokedError || error instanceof _poly_x_core.SessionExpiredError) {
-				this.clear();
-				return null;
-			}
-			if (error instanceof SessionCookieTooLargeError) {
-				console.error(`[polyx] ${error.message}`);
-				this.clear();
-				return null;
-			}
-			throw error;
-		}
-	}
-	/**
-	* End the session upstream, then locally. `device` revokes this session; `everywhere`
-	* revokes every session for the user (FR-SSO-5).
-	*
-	* Order is load-bearing: revocation is authenticated with the access token sealed in the
-	* cookie, so the cookie must be read before it is dropped. The upstream call is
-	* best-effort — an unreachable platform must not strand the user half-signed-in — but the
-	* call itself is real: the ecosystem logout the SDK used before resolves its session from
-	* a browser cookie, which a server-to-server fetch never carries, so it silently revoked
-	* nothing and answered 200.
-	*/
-	async revoke(scope = "device") {
-		const current = await this.read();
-		if (current) try {
-			await this.authClient.revokeSession(current.tokens.accessToken, scope);
-		} catch {}
-		this.clear();
-	}
-	clear() {
-		this.cookies.delete(this.cookieName);
-	}
-	async write(session) {
-		const sealed = await sealSession(session, this.secret, { cookieName: this.cookieName });
-		this.cookies.set(this.cookieName, sealed, buildSessionCookieOptions(this.secure));
-	}
-};
-function toAuthContext(session) {
-	if (!session) return {
-		isSignedIn: false,
-		userId: null,
-		claims: null
-	};
-	return {
-		isSignedIn: true,
-		userId: session.session.claims.userId,
-		organizationId: session.session.claims.organizationId,
-		claims: session.session.claims
-	};
-}
-//#endregion
-Object.defineProperty(exports, "DEFAULT_SESSION_COOKIE", {
-	enumerable: true,
-	get: function() {
-		return DEFAULT_SESSION_COOKIE;
-	}
-});
-Object.defineProperty(exports, "SESSION_COOKIE_MAX_BYTES", {
-	enumerable: true,
-	get: function() {
-		return SESSION_COOKIE_MAX_BYTES;
-	}
-});
-Object.defineProperty(exports, "ServerSession", {
-	enumerable: true,
-	get: function() {
-		return ServerSession;
-	}
-});
-Object.defineProperty(exports, "SessionCookieTooLargeError", {
-	enumerable: true,
-	get: function() {
-		return SessionCookieTooLargeError;
-	}
-});
-Object.defineProperty(exports, "openSession", {
-	enumerable: true,
-	get: function() {
-		return openSession;
-	}
-});
-Object.defineProperty(exports, "sealSession", {
-	enumerable: true,
-	get: function() {
-		return sealSession;
-	}
-});
-Object.defineProperty(exports, "sealedCookieByteLength", {
-	enumerable: true,
-	get: function() {
-		return sealedCookieByteLength;
-	}
-});
-Object.defineProperty(exports, "toAuthContext", {
-	enumerable: true,
-	get: function() {
-		return toAuthContext;
-	}
-});