@botim/mp-debug-sdk 0.7.1 → 0.8.0

package/README.md

@@ -13,14 +13,14 @@ Mini-programs run on user devices in environments you can't easily attach a debu
 
 ## Install
 
-> **Heads-up — registry override required in BOTIM repos.**
-> Most BOTIM mini-program repos pin the `@botim` scope to the internal Artifactory mirror (`@botim:registry=https://artifactory.corp.algento.com/artifactory/api/npm/bot-npm/`). This SDK is **published to public npm**, so a plain `npm install @botim/mp-debug-sdk` in those repos will hit Artifactory, not find the package, and 404. Use the public registry explicitly for this one package:
+> **If your project's `.npmrc` pins the `@botim` scope to a private registry, override it for this package.**
+> This SDK is published to public npm. If your `.npmrc` contains a line like `@botim:registry=<private-mirror-url>`, plain `npm install @botim/mp-debug-sdk` will route to the private mirror, not find the package, and fail. Use:
 
 ```bash
 npm install @botim/mp-debug-sdk --registry=https://registry.npmjs.org/
 ```
 
-If your repo doesn't have an `@botim` scope override (rare), the flag is harmless — npm uses `registry.npmjs.org` by default. **Don't** add `@botim:registry=https://registry.npmjs.org/` to your `.npmrc`: it would shadow the internal Artifactory registry that other `@botim/*` packages (mp-framework, etc.) need.
+If your repo has no `@botim` scope override, the flag is harmless — npm uses `registry.npmjs.org` by default. Don't permanently re-pin the `@botim` scope to public npm in your `.npmrc`: it would shadow whatever private registry your other `@botim/*` packages come from.
 
 ## 1. Add the env config files
 
@@ -100,7 +100,14 @@ import { botimConfig } from 'virtual:botim/config';
 const handle = await enableRemoteDebug({
   // The relay URL the plugin baked in. Falls back to same-origin if you
   // didn't pass `relayUrl` to the plugin (e.g. you're using a dev proxy).
+  // For a gateway-hosted relay this is the gateway origin (optionally with a
+  // path prefix), e.g. 'https://proxy-uat-ae.botim.me/botim-cli-gateway'.
   endpoint: botimConfig.relayUrl ?? location.origin,
+  // Relay connect token (rdt_…). REQUIRED for gateway-hosted relays, which
+  // gate attach on `Authorization: Bearer rdt_…`. Mint one bound to this
+  // (mpId, env) with `botim-cli relay token --mp <id> --env uat` (24 h TTL).
+  // Omit for the legacy standalone relay, which ignores it.
+  token: import.meta.env.VITE_RELAY_TOKEN,
   config: botimConfig,
   // app is optional — plugin auto-fills from app_id + version in
   // botim.{env}.json. Override only when you want a different name/version
@@ -127,7 +134,7 @@ That's it — `console.*`, network calls, and uncaught errors now stream to the
 
 ### Cross-origin setup
 
-The SDK posts directly to `endpoint` — there's no proxy required. Your relay must allow the page's origin via CORS. The reference [`@botim/debug-relay`](https://github.com/botim/debug-relay) ships with `CORS_ORIGINS=*` by default; tighten via env when going to production:
+The SDK posts directly to `endpoint` — there's no proxy required. Your relay must allow the page's origin via CORS. A reference debug-relay implementation typically defaults to `CORS_ORIGINS=*` for development; tighten via env when going to production:
 
 ```bash
 CORS_ORIGINS=https://my-mp.example.com,https://staging.example.com
@@ -139,7 +146,7 @@ Once `enableRemoteDebug` returns, an attached agent can send a JS snippet to the
 
 ```bash
 # From any terminal that can reach your relay:
-curl -sX POST "https://debug.botim.dev/v1/mp/<MP_ID>/devices/<DEVICE_ID>/commands" \
+curl -sX POST "<RELAY_URL>/v1/mp/<MP_ID>/devices/<DEVICE_ID>/commands" \
   -H 'content-type: application/json' \
   -d '{"name":"exec","args":{"code":"console.log(\"hi\"); return window.location.href"}}'
 ```
@@ -222,7 +229,7 @@ console.log(handle.sid); // server-issued session id
 
 ## Debugging a live mini-program
 
-Once your build is wired and shipped, see **[`docs/live-debugging.md`](./docs/live-debugging.md)** for the end-to-end runbook against the shared demo relay at `https://aistudiodemo.ext.algento.com/mp-debug-relay`. It covers:
+Once your build is wired and shipped, see **[`docs/live-debugging.md`](./docs/live-debugging.md)** for the end-to-end runbook against your debug-relay deployment. It covers:
 
 - pointing the Vite plugin at the live relay URL,
 - pulling errors and tailing sessions from the admin UI,
@@ -255,3 +262,4 @@ cp -r .claude/skills/botim-debug-relay ~/.claude/skills/
 ## License
 
 [ISC](./LICENSE) © BOTIM
+

package/dist/index.cjs

@@ -440,7 +440,7 @@ function sleep(ms) {
 }
 
 // src/attach.ts
-async function attachDevice(endpoint, config, deviceInfo, consent) {
+async function attachDevice(endpoint, config, deviceInfo, consent, token) {
   const base = endpoint.replace(/\/$/, "");
   const url = `${base}/v1/attach`;
   const body = {
@@ -451,9 +451,11 @@ async function attachDevice(endpoint, config, deviceInfo, consent) {
     consent,
     schemaVersion: SCHEMA_VERSION
   };
+  const headers = { "Content-Type": "application/json" };
+  if (token) headers.Authorization = `Bearer ${token}`;
   const res = await fetch(url, {
     method: "POST",
-    headers: { "Content-Type": "application/json" },
+    headers,
     body: JSON.stringify(body)
   });
   if (!res.ok) {
@@ -1645,7 +1647,7 @@ async function enableRemoteDebug(options) {
   };
   const deviceInfo = detectDeviceInfo(app, options.device);
   const consent = options.consent ?? {};
-  const session = await attachDevice(options.endpoint, options.config, deviceInfo, consent);
+  const session = await attachDevice(options.endpoint, options.config, deviceInfo, consent, options.token);
   const buffer = new RingBuffer({
     capacity: options.bufferSize ?? DEFAULT_BUFFER_SIZE
   });