@poly-x/core 0.1.0-alpha.13 → 0.1.0-alpha.14

package/dist/index.cjs

@@ -1043,6 +1043,7 @@ var AuthClient = class {
 		const response = await this.transport.request({
 			method: "POST",
 			url: this.config.baseUrl + ENDPOINTS.token,
+			...params.forwardedHeaders ? { headers: params.forwardedHeaders } : {},
 			body: {
 				grant_type: "authorization_code",
 				code: params.code,

package/dist/index.d.cts

@@ -557,6 +557,16 @@ interface ExchangeCodeParams {
   code: string;
   codeVerifier: string;
   redirectUri: string;
+  /**
+   * Browser context to attach to the token exchange (the call that creates the
+   * session). In a BFF deployment this request originates from Node, so without
+   * these the platform records the server's user-agent/IP ("node"/Unknown) instead
+   * of the end user's device. The BFF forwards a curated allowlist of the browser's
+   * request headers (user-agent, accept-language, the sec-ch-ua* client hints, and
+   * the observed client IP as x-forwarded-for). Optional and additive — omitting it
+   * preserves the prior behavior.
+   */
+  forwardedHeaders?: Record<string, string>;
 }
 interface SetPasswordParams {
   userId: string;

package/dist/index.d.mts

@@ -557,6 +557,16 @@ interface ExchangeCodeParams {
   code: string;
   codeVerifier: string;
   redirectUri: string;
+  /**
+   * Browser context to attach to the token exchange (the call that creates the
+   * session). In a BFF deployment this request originates from Node, so without
+   * these the platform records the server's user-agent/IP ("node"/Unknown) instead
+   * of the end user's device. The BFF forwards a curated allowlist of the browser's
+   * request headers (user-agent, accept-language, the sec-ch-ua* client hints, and
+   * the observed client IP as x-forwarded-for). Optional and additive — omitting it
+   * preserves the prior behavior.
+   */
+  forwardedHeaders?: Record<string, string>;
 }
 interface SetPasswordParams {
   userId: string;

package/dist/index.mjs

@@ -1042,6 +1042,7 @@ var AuthClient = class {
 		const response = await this.transport.request({
 			method: "POST",
 			url: this.config.baseUrl + ENDPOINTS.token,
+			...params.forwardedHeaders ? { headers: params.forwardedHeaders } : {},
 			body: {
 				grant_type: "authorization_code",
 				code: params.code,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poly-x/core",
-  "version": "0.1.0-alpha.13",
+  "version": "0.1.0-alpha.14",
   "description": "Framework-agnostic core of the PolyX SDK",
   "license": "MIT",
   "type": "module",