@poly-x/next 0.1.0-alpha.16 → 0.1.0-alpha.18

package/dist/server.cjs

@@ -131,6 +131,20 @@ function geoHeadersFromBody(geo) {
 	if (g.consent === "granted" || g.consent === "denied" || g.consent === "revoked") headers["x-polyx-geo-consent"] = g.consent;
 	return headers;
 }
+/**
+* Build the device-context headers (`x-timezone` / `x-screen-resolution`) from the browser's login
+* body (v6). These are not automatic request headers — the browser captures them client-side and
+* posts them; the platform reads them for session device attribution. Only well-formed values are
+* forwarded (a sane timezone string, a `WxH` resolution) so junk never reaches the platform.
+*/
+function deviceContextHeadersFromBody(deviceContext) {
+	const headers = {};
+	if (!deviceContext || typeof deviceContext !== "object") return headers;
+	const d = deviceContext;
+	if (typeof d.timezone === "string" && d.timezone.length > 0 && d.timezone.length <= 64) headers["x-timezone"] = d.timezone;
+	if (typeof d.screenResolution === "string" && /^\d{1,5}x\d{1,5}$/.test(d.screenResolution)) headers["x-screen-resolution"] = d.screenResolution;
+	return headers;
+}
 /** Read the current session — safe in Server Components (no cookie write). */
 async function auth(overrides) {
 	const config = resolveNextConfig(overrides);
@@ -188,6 +202,7 @@ function createAuthHandlers(handlersConfig = {}) {
 				return Response.json({ status: "invalid_request" }, { status: 400 });
 			}
 			const geoHeaders = geoHeadersFromBody(payload.geo);
+			const deviceContextHeaders = deviceContextHeadersFromBody(payload.deviceContext);
 			const email = typeof payload.email === "string" ? payload.email : "";
 			const password = typeof payload.password === "string" ? payload.password : "";
 			if (!email || !password) return Response.json({ status: "invalid_request" }, { status: 400 });
@@ -211,7 +226,8 @@ function createAuthHandlers(handlersConfig = {}) {
 					case "authorized":
 						await newSession(adapt(await (0, next_headers.cookies)()), config, secure).establishFromCode(outcome.code, verifier, redirectUri, {
 							...collectForwardedDeviceHeaders(request),
-							...geoHeaders
+							...geoHeaders,
+							...deviceContextHeaders
 						});
 						return Response.json({
 							status: "success",

package/dist/server.mjs

@@ -130,6 +130,20 @@ function geoHeadersFromBody(geo) {
 	if (g.consent === "granted" || g.consent === "denied" || g.consent === "revoked") headers["x-polyx-geo-consent"] = g.consent;
 	return headers;
 }
+/**
+* Build the device-context headers (`x-timezone` / `x-screen-resolution`) from the browser's login
+* body (v6). These are not automatic request headers — the browser captures them client-side and
+* posts them; the platform reads them for session device attribution. Only well-formed values are
+* forwarded (a sane timezone string, a `WxH` resolution) so junk never reaches the platform.
+*/
+function deviceContextHeadersFromBody(deviceContext) {
+	const headers = {};
+	if (!deviceContext || typeof deviceContext !== "object") return headers;
+	const d = deviceContext;
+	if (typeof d.timezone === "string" && d.timezone.length > 0 && d.timezone.length <= 64) headers["x-timezone"] = d.timezone;
+	if (typeof d.screenResolution === "string" && /^\d{1,5}x\d{1,5}$/.test(d.screenResolution)) headers["x-screen-resolution"] = d.screenResolution;
+	return headers;
+}
 /** Read the current session — safe in Server Components (no cookie write). */
 async function auth(overrides) {
 	const config = resolveNextConfig(overrides);
@@ -187,6 +201,7 @@ function createAuthHandlers(handlersConfig = {}) {
 				return Response.json({ status: "invalid_request" }, { status: 400 });
 			}
 			const geoHeaders = geoHeadersFromBody(payload.geo);
+			const deviceContextHeaders = deviceContextHeadersFromBody(payload.deviceContext);
 			const email = typeof payload.email === "string" ? payload.email : "";
 			const password = typeof payload.password === "string" ? payload.password : "";
 			if (!email || !password) return Response.json({ status: "invalid_request" }, { status: 400 });
@@ -210,7 +225,8 @@ function createAuthHandlers(handlersConfig = {}) {
 					case "authorized":
 						await newSession(adapt(await cookies()), config, secure).establishFromCode(outcome.code, verifier, redirectUri, {
 							...collectForwardedDeviceHeaders(request),
-							...geoHeaders
+							...geoHeaders,
+							...deviceContextHeaders
 						});
 						return Response.json({
 							status: "success",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poly-x/next",
-  "version": "0.1.0-alpha.16",
+  "version": "0.1.0-alpha.18",
   "description": "PolyX SDK for Next.js App Router - components plus server helpers",
   "license": "MIT",
   "type": "module",
@@ -47,8 +47,8 @@
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.cts",
   "dependencies": {
-    "@poly-x/react": "0.1.0-alpha.16",
-    "@poly-x/core": "0.1.0-alpha.16"
+    "@poly-x/core": "0.1.0-alpha.18",
+    "@poly-x/react": "0.1.0-alpha.18"
   },
   "peerDependencies": {
     "next": ">=14",