@bounded-sh/client 0.0.25 → 0.0.27

package/REACT_NATIVE.md

@@ -0,0 +1,144 @@
+# React Native / Expo support - `@bounded-sh/client`
+
+The SDK ships a dedicated React Native entry (`react-native` condition ->
+`dist/index.native.js`) and a platform-abstraction layer so the same
+`@bounded-sh/client` package runs on web and React Native.
+
+## 1. One-time setup before `init()`
+
+React Native has no `localStorage`, no `document`, and no reliable browser
+base64 helpers, so configure the SDK platform once at app startup:
+
+```ts
+import "react-native-get-random-values";
+import "react-native-url-polyfill/auto";
+import { setPlatform, ReactNativeSessionManager } from "@bounded-sh/client";
+import { createMMKV } from "react-native-mmkv";
+import { decode as atob, encode as btoa } from "base-64";
+
+const store = createMMKV();
+const storage = {
+  getItem: (key: string) => store.getString(key) ?? null,
+  setItem: (key: string, value: string) => store.set(key, value),
+  removeItem: (key: string) => store.remove(key),
+};
+
+setPlatform({ storage, sessionStorage: storage, atob, btoa, hasDOM: false });
+ReactNativeSessionManager.configure({ storage, atob });
+```
+
+`setPlatform` fills general browser API gaps. `ReactNativeSessionManager.configure`
+selects the RN token store used by login, restore, logout, and authenticated
+requests.
+
+## 2. Hosted email / social login
+
+Human login runs through the hosted Bounded issuer. The retired app-origin OTP
+helpers (`sendEmailOtp`, `verifyEmailOtp`, `sendTextOtp`, `verifyTextOtp`) throw
+migration errors.
+
+Install the Expo optional peers if your RN app uses hosted login:
+
+```sh
+npx expo install expo-web-browser expo-crypto
+```
+
+Use an https universal link as your redirect URI and register that origin in the
+Bounded app's `allowedOrigins`:
+
+```ts
+import { init, loginWithRedirect, getCurrentUser } from "@bounded-sh/client";
+
+await init({ appId: "YOUR_APP_ID" });
+
+const user = await loginWithRedirect({
+  redirectUri: "https://yourapp.com/auth/callback",
+  methods: ["email"],
+});
+
+const restored = await getCurrentUser();
+```
+
+On native, `loginWithRedirect()` opens the system/in-app browser and resolves
+with the user when the callback returns to the app. `completeLoginFromRedirect()`
+is for web callback pages.
+
+## 3. Guest login
+
+Anonymous auth is fully native and does not require Expo browser packages:
+
+```ts
+import { init, signInAnonymously, getCurrentUser } from "@bounded-sh/client";
+
+await init({ appId: "YOUR_APP_ID" });
+await signInAnonymously();
+const user = await getCurrentUser();
+```
+
+The device-local ed25519 keypair is stored in the RN storage adapter, so the
+guest identity survives app restarts until `logout()` clears it.
+
+## 4. Privy on React Native (`privy-expo`)
+
+`@privy-io/expo` is hook-based, so the host app renders `<PrivyProvider>` and
+bridges the hooks into a `PrivyExpoProvider` instance.
+
+```bash
+npm i @privy-io/expo @privy-io/expo-native-extensions
+```
+
+```tsx
+import { PrivyProvider, usePrivy, useEmbeddedSolanaWallet, useIdentityToken } from "@privy-io/expo";
+import { PrivyExpoProvider, init, loginWithPrivy } from "@bounded-sh/client";
+
+const provider = new PrivyExpoProvider(PRIVY_APP_ID, SOLANA_RPC_URL);
+
+function PrivyBridge() {
+  const privy = usePrivy();
+  const wallet = useEmbeddedSolanaWallet();
+  const { getIdentityToken } = useIdentityToken();
+
+  useEffect(() => {
+    provider.setPrivyMethods({
+      isReady: privy.isReady,
+      isAuthenticated: !!privy.user,
+      user: privy.user,
+      login: privy.login,
+      logout: privy.logout,
+      getAccessToken: privy.getAccessToken,
+      getIdentityToken,
+      getWalletProvider: async () => {
+        const solanaWallet = wallet.wallets?.[0];
+        if (!solanaWallet) return null;
+        const solanaProvider = await solanaWallet.getProvider();
+        return {
+          address: solanaWallet.address,
+          signMessage: solanaProvider.signMessage,
+          signTransaction: solanaProvider.signTransaction,
+          signAndSendTransaction: solanaProvider.signAndSendTransaction,
+        };
+      },
+    });
+  }, [privy.isReady, privy.user, wallet.wallets]);
+
+  return null;
+}
+
+await init({
+  appId,
+  authMethod: "privy-expo",
+  privyExpoProvider: provider,
+  rpcUrl: SOLANA_RPC_URL,
+});
+
+await loginWithPrivy();
+```
+
+## 5. Metro notes
+
+The default client entry no longer imports Phantom, web Privy, mobile wallet
+adapter, or `react-dom` provider implementations. Apps that only use hosted login
+or guest login should not need Metro stubs for those optional peers.
+
+For Solana signing paths, keep `react-native-get-random-values` at app entry and
+make sure `buffer` is polyfilled if your bundler setup does not provide it.

package/README.md

@@ -1,8 +1,10 @@
 
-# Tarobase JS SDK
-Tarobase is the web3 alternative to firebase. It is a powerful platform that simplifies the integration of hybrid on-chain actions and data for modern web and mobile applications.
+# Bounded JS SDK
+Bounded is a provable realtime backend for web and React Native applications.
 
-Welcome to the **Tarobase JavaScript SDK**! This SDK allows you to interact with the Tarobase platform seamlessly from your JavaScript or TypeScript applications. Whether you're building a web app, a Node.js service, or a React Native application (support coming soon), the Tarobase JS SDK provides the tools you need.
+Welcome to the **Bounded JavaScript SDK**. This SDK lets JavaScript and
+TypeScript applications authenticate users, read and write policy-governed data,
+subscribe to realtime updates, and call Bounded services.
 
 
 ## Table of Contents
@@ -66,28 +68,26 @@ yarn add @bounded-sh/client
 
   
 
-Before using the SDK, initialize it with your **Application ID** and the one auth method this app intends to use. Missing `authMethod` fails closed so examples do not silently select the wrong identity path. Use `authMethod: 'email'` for Bounded Auth email OTP, `authMethod: 'phantom'` for Solana wallet auth, or `authMethod: 'none'` for public unauthenticated reads only.
+Before using the SDK, initialize it with your **Application ID**. Hosted Bounded
+Auth email login is the default human-login provider.
 
   
 ```typescript
 import { init } from '@bounded-sh/client';
 
-await init({ appId: 'YOUR_APP_ID', authMethod: 'email' });
+await init({ appId: 'YOUR_APP_ID' });
 ```  
 
 ### Authentication
 
-For email OTP, initialize with `authMethod: 'email'` and call `login()` for the
-inline email-code modal. OAuth/social providers use the hosted redirect or popup
-helpers, which bind the returned token to the app id and registered redirect URI.
+Human login runs through the hosted redirect or popup helpers, which bind the
+returned token to the app id and registered redirect URI. Inline app-origin OTP
+helpers are retired.
 
 ```typescript
-import { login, loginWithRedirect, completeLoginFromRedirect } from '@bounded-sh/client';
+import { loginWithRedirect, completeLoginFromRedirect } from '@bounded-sh/client';
 
-// Email OTP:
-await login();
-
-// Hosted OAuth/social or hosted chooser:
+// Start hosted login:
 await loginWithRedirect({ redirectUri: 'https://yourapp.com/auth/callback', methods: ['email'] });
 
 // On your callback page, on load:
@@ -99,13 +99,16 @@ You can also listen for authentication state changes:
 ```typescript
 import { onAuthStateChanged } from '@bounded-sh/client';
 
-onAuthStateChanged((user) => {
+const unsubscribe = onAuthStateChanged((user) => {
 	if (user) {
 		console.log('User logged in:', user.address);
 	} else {
 		console.log('User logged out');
 	}
 });
+
+// Later:
+unsubscribe();
 ```
 
   
@@ -291,16 +294,19 @@ For more comprehensive examples, detailed guides, and API references, please vis
 - [API Reference](https://docs.tarobase.com/api)
 
 
-### React Native Support  
-Support for **React Native** is coming soon! Stay tuned for updates, and feel free to check back on our [documentation site](https://docs.tarobase.com) for the latest information.
+### React Native Support
+React Native and Expo are supported through the same `@bounded-sh/client`
+package. See [REACT_NATIVE.md](./REACT_NATIVE.md) for platform setup, hosted
+login, and guest login examples.
 
 ### Contributing
 Contributions are welcome! Please open an issue or submit a pull request on GitHub.
 
 ### License
-This Tarobase JS SDK project is licensed under the MIT License.
+This Bounded JS SDK project is licensed under the MIT License.
 
 * * * * *
   
 
-Thank you for using the Tarobase JS SDK! If you have any questions or need further assistance, feel free to crete an issue.
+Thank you for using the Bounded JS SDK. If you have questions or need help,
+please create an issue.

package/dist/auth/index.d.ts

@@ -31,11 +31,11 @@ export declare function signInAnonymously(): Promise<User | null>;
  * Log in with Privy as a co-equal route — selectable at runtime alongside
  * `login()` (email/wallet) and `signInAnonymously()`, without re-`init()`.
  *
- * On WEB it lazy-loads the @privy-io/react-auth-backed PrivyWalletProvider from
- * `config.privyConfig`. On REACT NATIVE the host must have created a
- * PrivyExpoProvider and bridged the Privy hooks via setPrivyMethods() (pass it as
- * `config.privyExpoProvider` to init()) — RN can't construct it here because the
- * Privy hooks live in the app's component tree.
+ * On REACT NATIVE the host must have created a PrivyExpoProvider and bridged the
+ * Privy hooks via setPrivyMethods() (pass it as `config.privyExpoProvider` to
+ * init()) — RN can't construct it here because the Privy hooks live in the app's
+ * component tree. Web Privy is no longer loaded through the default client entry;
+ * opt into a dedicated provider entry when your app needs it.
  *
  * Either way the Privy Solana wallet signs the SIWS challenge, so the session is
  * minted via the same wallet path as Phantom and shares the unified session store
@@ -43,40 +43,37 @@ export declare function signInAnonymously(): Promise<User | null>;
  */
 export declare function loginWithPrivy(options?: LoginOptions): Promise<User | null>;
 /**
- * Send a 6-digit login code to `email` (Bounded Better Auth). Step 1 of the
- * inline email flow — build your own email/code UI, or just call `login()` for
- * the built-in modal. Works on web AND React Native (no DOM needed).
+ * @deprecated Inline app-origin OTP is retired. Use
+ * `loginWithRedirect({ redirectUri, methods: ["email"] })` so the credential is
+ * entered on the Bounded hosted issuer.
  */
 export declare function sendEmailOtp(email: string): Promise<{
     ok: true;
     expiresInSeconds?: number;
 }>;
 /**
- * Send a 6-digit login code by text message. Requires the configured Bounded
- * auth issuer to have text OTP explicitly enabled and SMS delivery configured.
- * Works on web AND React Native.
+ * @deprecated Inline app-origin text OTP is retired. Use hosted login with
+ * `provider: "text"` or `methods: ["text"]` when text OTP is enabled.
  */
 export declare function sendTextOtp(phoneNumber: string): Promise<{
     ok: true;
     expiresInSeconds?: number;
 }>;
 /**
- * Verify the `code` for `email`, establish the session, and return the user.
- * Step 2 of the inline email flow. Coexists with signInAnonymously()/wallets.
+ * @deprecated Inline app-origin OTP is retired. Finish hosted login with
+ * `completeLoginFromRedirect()` on web; React Native `loginWithRedirect()`
+ * resolves inline.
  */
 export declare function verifyEmailOtp(email: string, code: string): Promise<User | null>;
 /**
- * Verify the text-message `code`, establish the session, and return the user.
- * Phone-only users have no `user.email`; use `user.id` for app identity.
+ * @deprecated Inline app-origin text OTP is retired. Finish hosted login with
+ * `completeLoginFromRedirect()` on web; React Native `loginWithRedirect()`
+ * resolves inline.
  */
 export declare function verifyTextOtp(phoneNumber: string, code: string): Promise<User | null>;
 /**
- * UPGRADE the current anonymous (guest) session by linking an email — Firebase
- * `linkWithCredential` parity. Send the code first with `sendEmailOtp(email)`,
- * then call `linkEmail(email, code)`. If the email is brand-new the guest's
- * `@user.id` (and its data) is preserved; if the email already exists the user
- * just signs into it (no merge). After it resolves, `getCurrentUser().isAnonymous`
- * is `false`. Requires an active guest session (`signInAnonymously()` first).
+ * @deprecated Inline app-origin guest upgrade is retired. Send the user through
+ * hosted login and transfer guest-owned data explicitly.
  */
 export declare function linkEmail(email: string, code: string): Promise<User | null>;
 export declare function login(options?: LoginOptions): Promise<User | null>;

package/dist/auth/oidc-auth.d.ts

@@ -16,6 +16,13 @@ export interface OidcLoginOptions {
      * when the issuer explicitly enables text OTP.
      */
     provider?: HostedAuthMethod;
+    /**
+     * Standard OIDC `prompt`. Pass `'login'` to FORCE a fresh sign-in even if the
+     * issuer already has a session — so the user can choose a DIFFERENT account
+     * (e.g. retry with another email after an access denial) instead of being
+     * silently re-signed-in as the same one. `'select_account'` behaves the same.
+     */
+    prompt?: 'login' | 'select_account' | 'consent' | 'none' | (string & {});
 }
 export interface PopupLoginOptions extends OidcLoginOptions {
     width?: number;

package/dist/auth/providers/email-auth-provider.d.ts

@@ -1,33 +1,22 @@
 import type { AuthProvider, User, TransactionResult, SolTransaction, EVMTransaction, SetOptions } from '@bounded-sh/core';
-import { Transaction, VersionedTransaction } from '@solana/web3.js';
-/** Send a login code to `email`. Step 1 of the inline email-OTP flow. */
+import type { Transaction, VersionedTransaction } from '@solana/web3.js';
+/** @deprecated Inline app-origin OTP is retired. Use loginWithRedirect(). */
 export declare function sendEmailOtp(email: string): Promise<{
     ok: true;
     expiresInSeconds?: number;
 }>;
-/** Send a login code by text message. Requires the Bounded issuer to have text OTP explicitly enabled and SMS configured. */
+/** @deprecated Inline app-origin text OTP is retired. Use loginWithRedirect(). */
 export declare function sendTextOtp(phoneNumber: string): Promise<{
     ok: true;
     expiresInSeconds?: number;
 }>;
-/**
- * Verify the code for `email` and establish the session. Step 2 of the flow.
- * Stores the Bounded id token (the realtime bearer) and sets the current user.
- */
+/** @deprecated Inline app-origin OTP is retired. Use hosted loginWithRedirect(). */
 export declare function verifyEmailOtp(email: string, otp: string): Promise<User>;
-/**
- * Verify the text-message code for `phoneNumber` and establish the session.
- * Phone-only users have `user.email === null`; use `user.id` for ownership.
- */
+/** @deprecated Inline app-origin text OTP is retired. Use hosted loginWithRedirect(). */
 export declare function verifyTextOtp(phoneNumber: string, otp: string): Promise<User>;
 /**
- * UPGRADE an anonymous (guest) session by LINKING an email credential — Firebase
- * `linkWithCredential` parity. The guest's `guestToken` is sent to the auth issuer
- * which, IF the email is brand-new, makes the new account ADOPT the guest's id so
- * `@user.id` is preserved and the guest's data carries over. If the email already
- * exists, the user just signs into it (stays separate; `linked:false`). On success
- * the upgraded session replaces the guest session and the user is no longer
- * anonymous. `guestToken` is captured by the caller BEFORE switching auth methods.
+ * @deprecated Inline app-origin guest upgrade is retired. Use hosted login and
+ * transfer guest-owned data explicitly.
  */
 export declare function linkEmailWithGuest(email: string, otp: string, guestToken: string): Promise<{
     user: User;
@@ -40,7 +29,7 @@ export declare class EmailAuthProvider implements AuthProvider {
     logout(): Promise<void>;
     signMessage(_message: string): Promise<string>;
     runTransaction(_evm?: EVMTransaction, _sol?: SolTransaction, _options?: SetOptions): Promise<TransactionResult>;
-    signTransaction(_t: Transaction | VersionedTransaction): Promise<Transaction | VersionedTransaction>;
+    signTransaction(_transaction: Transaction | VersionedTransaction): Promise<Transaction | VersionedTransaction>;
     signAndSubmitTransaction(): Promise<string>;
     getNativeMethods(): Promise<any>;
 }

package/dist/auth/providers/privy-expo-provider.d.ts

@@ -10,7 +10,7 @@
  *   1. Install polyfills: fast-text-encoding, react-native-get-random-values
  *   2. Install @privy-io/expo, @privy-io/expo-native-extensions
  *   3. Call ReactNativeSessionManager.configure({ storage, atob }) at startup
- *   4. Call setPlatform({ ... }) from @bounded-sh/web at startup
+ *   4. Call setPlatform({ ... }) from @bounded-sh/client at startup
  *   5. Wrap their app tree with PrivyProvider from @privy-io/expo
  *   6. Create this provider and pass the Privy hooks/methods via setPrivyMethods()
  *

package/dist/global.d.ts

@@ -1,8 +1,8 @@
 import { AuthProvider, User, ClientConfig } from '@bounded-sh/core';
 import { LoginOptions } from './auth';
 export declare function init(newConfig: Partial<ClientConfig>): Promise<void>;
-export declare function onAuthStateChanged(callback: (user: User | null) => void): void;
-export declare function onAuthLoadingChanged(callback: (loading: boolean) => void): void;
+export declare function onAuthStateChanged(callback: (user: User | null) => void): () => void;
+export declare function onAuthLoadingChanged(callback: (loading: boolean) => void): () => void;
 export declare function setAuthLoading(loading: boolean): void;
 export declare function getAuthLoading(): boolean;
 export declare function login(options?: LoginOptions): Promise<User | null>;

package/dist/index.d.ts

@@ -15,9 +15,6 @@ export { deserializeTransaction } from "./auth/providers/sol/sol-utils";
 export { getIdToken } from "./utils";
 export { setPlatform, getPlatform } from "./platform";
 export type { PlatformAdapter, StorageAdapter } from "./platform";
-export { PhantomWalletProvider, PhantomWalletConfig, PhantomProviderType, } from "./auth/providers/phantom-wallet-provider";
 export { OffchainAuthProvider, OffchainAuthProviderConfig, } from "./auth/providers/offchain-auth-provider";
-export { SolanaMobileWalletProvider, SolanaMobileWalletConfig, isMobileWalletAvailable, registerMobileWalletAdapter, } from "./auth/providers/solana-mobile-wallet-provider";
-export { PrivyWalletProvider } from "./auth/providers/privy-wallet-provider";
 export { PrivyExpoProvider } from "./auth/providers/privy-expo-provider";
 export type { PrivyExpoMethods } from "./auth/providers/privy-expo-provider";