@poly-x/next 0.1.0-alpha.12 → 0.1.0-alpha.14

package/dist/proxy.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-require("./server-session-BpRaJCz9.cjs");
+require("./server-session-QJLA_Tz-.cjs");
 let next_server = require("next/server");
 //#region src/proxy.ts
 /**

package/dist/proxy.mjs

@@ -1,4 +1,4 @@
-import "./server-session-DedPwl4b.mjs";
+import "./server-session-CjP44zFC.mjs";
 import { NextResponse } from "next/server";
 //#region src/proxy.ts
 /**

package/dist/{server-session-DedPwl4b.mjs → server-session-CjP44zFC.mjs}

@@ -85,11 +85,12 @@ var ServerSession = class {
 		this.cookieName = options.cookieName ?? "polyx_session";
 		this.secure = options.secure ?? true;
 	}
-	async establishFromCode(code, codeVerifier, redirectUri) {
+	async establishFromCode(code, codeVerifier, redirectUri, forwardedHeaders) {
 		const stored = await this.authClient.exchangeCode({
 			code,
 			codeVerifier,
-			redirectUri
+			redirectUri,
+			forwardedHeaders
 		});
 		await this.write(stored);
 		return stored;

package/dist/{server-session-BpRaJCz9.cjs → server-session-QJLA_Tz-.cjs}

@@ -85,11 +85,12 @@ var ServerSession = class {
 		this.cookieName = options.cookieName ?? "polyx_session";
 		this.secure = options.secure ?? true;
 	}
-	async establishFromCode(code, codeVerifier, redirectUri) {
+	async establishFromCode(code, codeVerifier, redirectUri, forwardedHeaders) {
 		const stored = await this.authClient.exchangeCode({
 			code,
 			codeVerifier,
-			redirectUri
+			redirectUri,
+			forwardedHeaders
 		});
 		await this.write(stored);
 		return stored;

package/dist/server.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_server_session = require("./server-session-BpRaJCz9.cjs");
+const require_server_session = require("./server-session-QJLA_Tz-.cjs");
 let _poly_x_core = require("@poly-x/core");
 let next_headers = require("next/headers");
 //#region src/config.ts
@@ -72,6 +72,47 @@ function resolveCookieSecure(request, config) {
 		return true;
 	}
 }
+/** Browser request headers the platform reads for session device attribution. */
+const FORWARDED_DEVICE_HEADERS = [
+	"user-agent",
+	"accept-language",
+	"sec-ch-ua",
+	"sec-ch-ua-platform",
+	"sec-ch-ua-mobile",
+	"sec-ch-ua-model"
+];
+/**
+* The end user's IP as observed by THIS BFF's own infrastructure — the left-most
+* entry of the inbound `x-forwarded-for` (what the platform/proxy in front of the
+* app set), falling back to `x-real-ip`. Returns undefined on localhost/dev where
+* neither is present, letting the platform fall back to its own resolution rather
+* than recording a blank. (This trusts the infra-set forwarded chain, not a value
+* the browser could set on the same-origin BFF request.)
+*/
+function resolveClientIp(request) {
+	const first = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
+	if (first) return first;
+	return request.headers.get("x-real-ip")?.trim() || void 0;
+}
+/**
+* Curate the browser context to forward on the session-creating token exchange.
+* In a BFF deployment the outbound call to poly-auth is made by Node, so without
+* this the platform attributes the session to the server ("node"/Unknown UA, the
+* server's IP). We forward a fixed allowlist of the browser's own request headers
+* plus the observed client IP (as `x-forwarded-for`). Only headers actually
+* present are forwarded — never blank values that would clobber the platform's
+* own fallback resolution.
+*/
+function collectForwardedDeviceHeaders(request) {
+	const forwarded = {};
+	for (const name of FORWARDED_DEVICE_HEADERS) {
+		const value = request.headers.get(name);
+		if (value) forwarded[name] = value;
+	}
+	const clientIp = resolveClientIp(request);
+	if (clientIp) forwarded["x-forwarded-for"] = clientIp;
+	return forwarded;
+}
 /** Read the current session — safe in Server Components (no cookie write). */
 async function auth(overrides) {
 	const config = resolveNextConfig(overrides);
@@ -149,7 +190,7 @@ function createAuthHandlers(handlersConfig = {}) {
 				});
 				switch (outcome.type) {
 					case "authorized":
-						await newSession(adapt(await (0, next_headers.cookies)()), config, secure).establishFromCode(outcome.code, verifier, redirectUri);
+						await newSession(adapt(await (0, next_headers.cookies)()), config, secure).establishFromCode(outcome.code, verifier, redirectUri, collectForwardedDeviceHeaders(request));
 						return Response.json({
 							status: "success",
 							redirectTo: afterSignInPath
@@ -249,7 +290,7 @@ function createAuthHandlers(handlersConfig = {}) {
 			if (!code || !state || !raw) return Response.redirect(home, 302);
 			const tx = JSON.parse(raw);
 			if (tx.state !== state) return Response.redirect(home, 302);
-			await newSession(adapt(store), config, secure).establishFromCode(code, tx.verifier, tx.redirectUri);
+			await newSession(adapt(store), config, secure).establishFromCode(code, tx.verifier, tx.redirectUri, collectForwardedDeviceHeaders(request));
 			return Response.redirect(home, 302);
 		},
 		async refresh(request) {

package/dist/server.d.cts

@@ -58,7 +58,7 @@ declare class ServerSession {
   private readonly cookieName;
   private readonly secure;
   constructor(options: ServerSessionOptions);
-  establishFromCode(code: string, codeVerifier: string, redirectUri: string): Promise<StoredSession>;
+  establishFromCode(code: string, codeVerifier: string, redirectUri: string, forwardedHeaders?: Record<string, string>): Promise<StoredSession>;
   read(): Promise<StoredSession | null>;
   /** Rotate the tokens; clears the cookie (returns null) on a terminal refresh failure. */
   refresh(): Promise<StoredSession | null>;

package/dist/server.d.mts

@@ -58,7 +58,7 @@ declare class ServerSession {
   private readonly cookieName;
   private readonly secure;
   constructor(options: ServerSessionOptions);
-  establishFromCode(code: string, codeVerifier: string, redirectUri: string): Promise<StoredSession>;
+  establishFromCode(code: string, codeVerifier: string, redirectUri: string, forwardedHeaders?: Record<string, string>): Promise<StoredSession>;
   read(): Promise<StoredSession | null>;
   /** Rotate the tokens; clears the cookie (returns null) on a terminal refresh failure. */
   refresh(): Promise<StoredSession | null>;

package/dist/server.mjs

@@ -1,4 +1,4 @@
-import { a as sealSession, i as openSession, n as ServerSession, r as toAuthContext, t as DEFAULT_SESSION_COOKIE } from "./server-session-DedPwl4b.mjs";
+import { a as sealSession, i as openSession, n as ServerSession, r as toAuthContext, t as DEFAULT_SESSION_COOKIE } from "./server-session-CjP44zFC.mjs";
 import { AuthClient, FetchTransport, generatePkce, randomState, resolveConfig } from "@poly-x/core";
 import { cookies } from "next/headers";
 //#region src/config.ts
@@ -71,6 +71,47 @@ function resolveCookieSecure(request, config) {
 		return true;
 	}
 }
+/** Browser request headers the platform reads for session device attribution. */
+const FORWARDED_DEVICE_HEADERS = [
+	"user-agent",
+	"accept-language",
+	"sec-ch-ua",
+	"sec-ch-ua-platform",
+	"sec-ch-ua-mobile",
+	"sec-ch-ua-model"
+];
+/**
+* The end user's IP as observed by THIS BFF's own infrastructure — the left-most
+* entry of the inbound `x-forwarded-for` (what the platform/proxy in front of the
+* app set), falling back to `x-real-ip`. Returns undefined on localhost/dev where
+* neither is present, letting the platform fall back to its own resolution rather
+* than recording a blank. (This trusts the infra-set forwarded chain, not a value
+* the browser could set on the same-origin BFF request.)
+*/
+function resolveClientIp(request) {
+	const first = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
+	if (first) return first;
+	return request.headers.get("x-real-ip")?.trim() || void 0;
+}
+/**
+* Curate the browser context to forward on the session-creating token exchange.
+* In a BFF deployment the outbound call to poly-auth is made by Node, so without
+* this the platform attributes the session to the server ("node"/Unknown UA, the
+* server's IP). We forward a fixed allowlist of the browser's own request headers
+* plus the observed client IP (as `x-forwarded-for`). Only headers actually
+* present are forwarded — never blank values that would clobber the platform's
+* own fallback resolution.
+*/
+function collectForwardedDeviceHeaders(request) {
+	const forwarded = {};
+	for (const name of FORWARDED_DEVICE_HEADERS) {
+		const value = request.headers.get(name);
+		if (value) forwarded[name] = value;
+	}
+	const clientIp = resolveClientIp(request);
+	if (clientIp) forwarded["x-forwarded-for"] = clientIp;
+	return forwarded;
+}
 /** Read the current session — safe in Server Components (no cookie write). */
 async function auth(overrides) {
 	const config = resolveNextConfig(overrides);
@@ -148,7 +189,7 @@ function createAuthHandlers(handlersConfig = {}) {
 				});
 				switch (outcome.type) {
 					case "authorized":
-						await newSession(adapt(await cookies()), config, secure).establishFromCode(outcome.code, verifier, redirectUri);
+						await newSession(adapt(await cookies()), config, secure).establishFromCode(outcome.code, verifier, redirectUri, collectForwardedDeviceHeaders(request));
 						return Response.json({
 							status: "success",
 							redirectTo: afterSignInPath
@@ -248,7 +289,7 @@ function createAuthHandlers(handlersConfig = {}) {
 			if (!code || !state || !raw) return Response.redirect(home, 302);
 			const tx = JSON.parse(raw);
 			if (tx.state !== state) return Response.redirect(home, 302);
-			await newSession(adapt(store), config, secure).establishFromCode(code, tx.verifier, tx.redirectUri);
+			await newSession(adapt(store), config, secure).establishFromCode(code, tx.verifier, tx.redirectUri, collectForwardedDeviceHeaders(request));
 			return Response.redirect(home, 302);
 		},
 		async refresh(request) {

package/dist/styles.css

@@ -10,8 +10,33 @@
  * (`:root`, a wrapper div, …) — that is the supported theming surface. Dark mode
  * follows the OS by default and defers to an explicit `.dark` / `[data-theme]`
  * on a host ancestor when one is present.
+ *
+ * ---------------------------------------------------------------------------
+ * Cascade: everything here lives in the `polyx` layer, and that is load-bearing.
+ *
+ * Unlayered CSS beats layered CSS outright — not by specificity, but by rank; no
+ * import order or selector weight changes it. Shipping these rules unlayered
+ * therefore beat every Tailwind utility a host wrote (Tailwind emits utilities
+ * into `@layer utilities`), so `className`/`triggerClassName` silently did
+ * nothing and hosts were pushed toward `!important`. Layering hands that control
+ * back: a host's utilities and unlayered CSS both outrank us now.
+ *
+ * The statement below fixes where `polyx` sits. It must land AFTER `base` —
+ * Tailwind's preflight puts `*, ::before, ::after { border: 0 solid }` there, and
+ * that would erase our own borders if we ranked lower — and BEFORE `utilities`,
+ * so host utilities still win. Naming Tailwind's layers costs nothing when the
+ * host doesn't use Tailwind: the names simply resolve to empty layers.
+ *
+ * Layer order is set by first declaration, so this only holds if our stylesheet
+ * is imported BEFORE the host's Tailwind entry. Import it later and `polyx` is
+ * appended last, which puts us back to outranking utilities — no worse than the
+ * unlayered behaviour, but not the fix either. Import us first.
  */
 
+@layer theme, base, polyx, components, utilities;
+
+@layer polyx {
+
 .polyx-signin {
 	/* Colors */
 	--polyx-brand: #4f46e5;
@@ -683,3 +708,8 @@
 	height: 1rem;
 	color: var(--polyx-muted-fg);
 }
+
+/* Closes `@layer polyx` — opened at the top of the file. The rules above are left
+   unindented deliberately: wrapping the sheet in a layer is a cascade change, not a
+   reformat, and re-indenting 600 lines would bury it in the diff. */
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poly-x/next",
-  "version": "0.1.0-alpha.12",
+  "version": "0.1.0-alpha.14",
   "description": "PolyX SDK for Next.js App Router - components plus server helpers",
   "license": "MIT",
   "type": "module",
@@ -47,8 +47,8 @@
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.cts",
   "dependencies": {
-    "@poly-x/core": "0.1.0-alpha.12",
-    "@poly-x/react": "0.1.0-alpha.12"
+    "@poly-x/core": "0.1.0-alpha.14",
+    "@poly-x/react": "0.1.0-alpha.14"
   },
   "peerDependencies": {
     "next": ">=14",