@bounded-sh/client 0.0.33 → 0.0.35

package/REACT_NATIVE.md

@@ -33,9 +33,9 @@ requests.
 
 ## 2. Hosted email / social login
 
-Human login runs through the hosted Bounded issuer. The retired app-origin OTP
-helpers (`sendEmailOtp`, `verifyEmailOtp`, `sendTextOtp`, `verifyTextOtp`) throw
-migration errors.
+Human login runs through the hosted Bounded issuer. Retired app-origin OTP
+helpers (`sendEmailOtp`, `verifyEmailOtp`, `sendTextOtp`, `verifyTextOtp`) are
+not exported by the package.
 
 Install the Expo optional peers if your RN app uses hosted login:
 

package/dist/auth/index.d.ts

@@ -42,39 +42,8 @@ export declare function signInAnonymously(): Promise<User | null>;
  * (web localStorage / RN storage) and identity model. `init()` must have run first.
  */
 export declare function loginWithPrivy(options?: LoginOptions): Promise<User | null>;
-/**
- * Retired. Use `loginWithRedirect({ redirectUri, methods: ['email'] })` or
- * `loginWithPopup(...)`; app-origin OTP helpers fail closed.
- */
-export declare function sendEmailOtp(email: string): Promise<{
-    ok: true;
-    expiresInSeconds?: number;
-}>;
-/**
- * Retired. Use hosted login with `methods: ['text']` or `provider: 'text'`
- * when text OTP is enabled for the app.
- */
-export declare function sendTextOtp(phoneNumber: string): Promise<{
-    ok: true;
-    expiresInSeconds?: number;
-}>;
-/**
- * Retired. Complete hosted login on the callback page with
- * `completeLoginFromRedirect()`.
- */
-export declare function verifyEmailOtp(email: string, code: string): Promise<User | null>;
-/**
- * Retired. Complete hosted login on the callback page with
- * `completeLoginFromRedirect()`.
- */
-export declare function verifyTextOtp(phoneNumber: string, code: string): Promise<User | null>;
-/**
- * Retired. Guest upgrade is no longer an inline id-preserving auth operation;
- * send the user through hosted login and transfer data explicitly in app state.
- */
-export declare function linkEmail(email: string, code: string): Promise<User | null>;
 export declare function login(options?: LoginOptions): Promise<User | null>;
 export declare function getCurrentAuthMethod(): string | null;
 export declare function logout(): Promise<void>;
-export { loginWithRedirect, linkWithRedirect, completeLoginFromRedirect, loginWithPopup, completeLoginInPopup } from './oidc-auth';
+export { loginWithRedirect, completeLoginFromRedirect, loginWithPopup, completeLoginInPopup } from './oidc-auth';
 export type { HostedAuthMethod, OidcLoginOptions, PopupLoginOptions } from './oidc-auth';

package/dist/auth/oidc-auth.d.ts

@@ -46,26 +46,12 @@ export interface PopupLoginOptions extends OidcLoginOptions {
  *  (custom `myapp://` schemes are rejected by the issuer). Needs the optional peer deps
  *  expo-web-browser + (expo-crypto or react-native-get-random-values). */
 export declare function loginWithRedirect(opts: OidcLoginOptions): Promise<User | void>;
-/** UPGRADE the current anonymous (guest) session by linking a SOCIAL/redirect login
- *  (e.g. Google) — Firebase `linkWithPopup`/redirect parity. Carries the guest's signed
- *  id-token THROUGH the OIDC authorize request (as a single-use hint bound to the PKCE
- *  challenge), then runs the normal redirect login. The issuer completes the link during
- *  the standard code→token exchange: if the chosen account is brand-new the guest's
- *  `@user.id` is preserved (the returned id_token is minted under it), else the account
- *  stays separate (guest id discarded). Requires an active guest session.
- *
- *  Works on WEB (navigates, finish with completeLoginFromRedirect) and REACT NATIVE
- *  (opens expo-web-browser and resolves with the upgraded User inline). */
-export declare function linkWithRedirect(opts: OidcLoginOptions): Promise<User | void>;
 /** Finish login on the redirect_uri page (WEB ONLY): exchange ?code= for a token (PKCE-verified),
  *  store the session, and return the User. Idempotent: returns null if there's no ?code= in the URL.
- *  When the redirect was a guest UPGRADE (linkWithRedirect) and the issuer adopted the guest
- *  id, the exchanged id_token already carries the preserved `@user.id`, so the returned User
- *  reflects it automatically (no extra round-trip).
  *
  *  On REACT NATIVE this returns null and is a no-op: native login completes INLINE inside
- *  loginWithRedirect()/linkWithRedirect() (which resolve with the User), so there is no
- *  separate redirect page to finish from. Calling it on RN is harmless. */
+ *  loginWithRedirect() (which resolves with the User), so there is no separate redirect
+ *  page to finish from. Calling it on RN is harmless. */
 export declare function completeLoginFromRedirect(): Promise<User | null>;
 /** Popup variant: open the hosted login in a popup; resolves with the User once the popup's
  *  redirect_uri page posts the code back. The redirect_uri page just calls the usual

package/dist/auth/providers/email-auth-provider.d.ts

@@ -1,32 +1,5 @@
 import type { AuthProvider, User, TransactionResult, SolTransaction, EVMTransaction, SetOptions } from '@bounded-sh/core';
 import { Transaction, VersionedTransaction } from '@solana/web3.js';
-/** @internal Legacy issuer-owned helper. App code must use hosted login instead. */
-export declare function sendEmailOtp(email: string): Promise<{
-    ok: true;
-    expiresInSeconds?: number;
-}>;
-/** @internal Legacy issuer-owned helper. App code must use hosted login instead. */
-export declare function sendTextOtp(phoneNumber: string): Promise<{
-    ok: true;
-    expiresInSeconds?: number;
-}>;
-/**
- * @internal Legacy issuer-owned helper. App code must use hosted login instead.
- */
-export declare function verifyEmailOtp(email: string, otp: string): Promise<User>;
-/**
- * @internal Legacy issuer-owned helper. App code must use hosted login instead.
- */
-export declare function verifyTextOtp(phoneNumber: string, otp: string): Promise<User>;
-/**
- * @internal Legacy issuer-owned helper. Guest-to-real-account continuity should
- * be modeled as explicit app-data transfer after hosted login.
- */
-export declare function linkEmailWithGuest(email: string, otp: string, guestToken: string): Promise<{
-    user: User;
-    linked: boolean;
-    isNewAccount: boolean;
-}>;
 export declare class EmailAuthProvider implements AuthProvider {
     login(): Promise<User | null>;
     restoreSession(): Promise<User | null>;

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 export { init, getCurrentUser, onAuthStateChanged, onAuthLoadingChanged, getAuthLoading, login, logout, } from "./global";
 export type { LoginOptions } from "./global";
 export { getConfig } from "@bounded-sh/core";
-export { getAuthProvider, signInAnonymously, sendEmailOtp, sendTextOtp, verifyEmailOtp, verifyTextOtp, linkEmail, loginWithPrivy } from "./auth";
-export { loginWithRedirect, linkWithRedirect, completeLoginFromRedirect, loginWithPopup, completeLoginInPopup } from "./auth";
+export { getAuthProvider, signInAnonymously, loginWithPrivy } from "./auth";
+export { loginWithRedirect, completeLoginFromRedirect, loginWithPopup, completeLoginInPopup } from "./auth";
 export type { HostedAuthMethod, OidcLoginOptions, PopupLoginOptions } from "./auth";
 export { get, getMany, docId, set, setMany, setFile, getFiles, search, queryAggregate, runQuery, runQueryMany, runExpression, runExpressionMany, signMessage, signTransaction, signAndSubmitTransaction, count, aggregate, GetOptions, SearchOptions, SetOptions, CountOptions, AggregateOptions, AggregateOperation, AggregateResult, AggregateSpec, AggregateRow, QueryAggregateOptions, } from "@bounded-sh/core";
 export type { GetOptions as BoundedGetOptions } from "@bounded-sh/core";

package/dist/index.js

@@ -3791,7 +3791,7 @@ function appendHostedLoginHints(params, opts) {
 // native (expo-web-browser) path. The caller decides where the PkceState lives
 // (web → sessionStorage across the full-page redirect; native → in-memory across
 // the awaited browser session).
-async function buildAuthorize(opts, guestHint) {
+async function buildAuthorize(opts) {
     const cfg = await core.getConfig();
     if (!cfg.appId)
         throw new Error('appId is not configured (init the SDK with your appId)');
@@ -3808,35 +3808,8 @@ async function buildAuthorize(opts, guestHint) {
         code_challenge: challenge, code_challenge_method: 'S256', state,
     });
     appendHostedLoginHints(params, opts);
-    // Anonymous→real UPGRADE (linkWithRedirect): the issuer needs the guest identity bound to
-    // this request's PKCE code_challenge so the link completes single-use at the code→token
-    // exchange. We do NOT put the raw guest id-token in the URL (it would land in server logs /
-    // browser history — a replayable identity-capture primitive). Instead we exchange it for an
-    // OPAQUE single-use handle server-side and carry only that.
-    if (guestHint)
-        params.set('bounded_guest_hint', await guestHintFor(guestHint));
     return { url: `${base}/api/auth/oauth2/authorize?${params.toString()}`, pkce: { verifier, state, redirectUri } };
 }
-/** Exchange a guest id-token for an opaque single-use handle via the issuer, so the raw token
- *  never rides the authorize URL. Falls back to the raw token if the mint endpoint is
- *  unavailable — the issuer accepts both, so an upgrade never breaks during rollout. */
-async function guestHintFor(guestToken) {
-    try {
-        const base = await issuerBase();
-        const res = await fetch(`${base}/link/guest-handle`, {
-            method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ guestToken }),
-        });
-        if (res.ok) {
-            const data = await res.json().catch(() => null);
-            if (data && typeof data.handle === 'string' && data.handle)
-                return data.handle;
-        }
-    }
-    catch ( /* fall through to the raw-token fallback */_a) { /* fall through to the raw-token fallback */ }
-    return guestToken;
-}
 // Are we on React Native (no DOM)? OIDC dispatch uses this to choose the native
 // expo-web-browser driver vs. the web full-page-redirect/popup driver.
 function isNative() {
@@ -3886,9 +3859,9 @@ function parseCallbackParams(callbackUrl) {
 // universal-link callback, verify state, and run the SAME PKCE code→token exchange
 // as web. Returns the signed-in User (native completes inline — there's no separate
 // completeLoginFromRedirect() round-trip the way the web full-page redirect needs).
-async function runNativeLogin(opts, guestHint) {
+async function runNativeLogin(opts) {
     var _a, _b;
-    const { url, pkce } = await buildAuthorize(opts, guestHint);
+    const { url, pkce } = await buildAuthorize(opts);
     const WebBrowser = await loadExpoWebBrowser();
     const openAuthSession = WebBrowser.openAuthSessionAsync || ((_a = WebBrowser.default) === null || _a === void 0 ? void 0 : _a.openAuthSessionAsync);
     if (typeof openAuthSession !== 'function') {
@@ -3941,37 +3914,12 @@ async function loginWithRedirect(opts) {
     setAuthLoading(true); // reflect "signing in…" right up to navigation; the return page's
     window.location.href = url; // completeLoginFromRedirect() keeps it true until the user resolves.
 }
-/** UPGRADE the current anonymous (guest) session by linking a SOCIAL/redirect login
- *  (e.g. Google) — Firebase `linkWithPopup`/redirect parity. Carries the guest's signed
- *  id-token THROUGH the OIDC authorize request (as a single-use hint bound to the PKCE
- *  challenge), then runs the normal redirect login. The issuer completes the link during
- *  the standard code→token exchange: if the chosen account is brand-new the guest's
- *  `@user.id` is preserved (the returned id_token is minted under it), else the account
- *  stays separate (guest id discarded). Requires an active guest session.
- *
- *  Works on WEB (navigates, finish with completeLoginFromRedirect) and REACT NATIVE
- *  (opens expo-web-browser and resolves with the upgraded User inline). */
-async function linkWithRedirect(opts) {
-    const guestToken = sessionManager().getIdToken();
-    if (!guestToken)
-        throw new Error('linkWithRedirect requires an active anonymous session — call signInAnonymously() first.');
-    if (isNative())
-        return runNativeLogin(opts, guestToken);
-    if (!hasDOM())
-        throw new Error('linkWithRedirect requires a browser or a configured React Native platform');
-    const { url, pkce } = await buildAuthorize(opts, guestToken);
-    sessionStorage.setItem(PKCE_STORE_KEY, JSON.stringify(pkce));
-    window.location.href = url;
-}
 /** Finish login on the redirect_uri page (WEB ONLY): exchange ?code= for a token (PKCE-verified),
  *  store the session, and return the User. Idempotent: returns null if there's no ?code= in the URL.
- *  When the redirect was a guest UPGRADE (linkWithRedirect) and the issuer adopted the guest
- *  id, the exchanged id_token already carries the preserved `@user.id`, so the returned User
- *  reflects it automatically (no extra round-trip).
  *
  *  On REACT NATIVE this returns null and is a no-op: native login completes INLINE inside
- *  loginWithRedirect()/linkWithRedirect() (which resolve with the User), so there is no
- *  separate redirect page to finish from. Calling it on RN is harmless. */
+ *  loginWithRedirect() (which resolves with the User), so there is no separate redirect
+ *  page to finish from. Calling it on RN is harmless. */
 async function completeLoginFromRedirect() {
     if (!hasDOM())
         return null;
@@ -4341,12 +4289,6 @@ async function getAuthProvider(config) {
     currentAuthProviderConfigKey = nextProviderConfigKey;
     return currentAuthProvider;
 }
-function retiredInlineAuthError(method) {
-    return new Error(`bounded-sh: ${method} is retired. Human login must use the hosted OAuth2 + PKCE flow: ` +
-        `loginWithRedirect({ redirectUri }) or loginWithPopup({ redirectUri }). ` +
-        `For guests use signInAnonymously(); for guest-to-real-account data continuity, ` +
-        `transfer ownership in app data after hosted login.`);
-}
 /**
  * Browser/React-Native-only auth flows (guest, email) persist their session via
  * WebSessionManager, which is gated to environments that have `window` /
@@ -4430,41 +4372,6 @@ async function loginWithPrivy(options) {
     const result = await provider.login();
     return result ? Object.assign(Object.assign({}, result), { provider }) : null;
 }
-/**
- * Retired. Use `loginWithRedirect({ redirectUri, methods: ['email'] })` or
- * `loginWithPopup(...)`; app-origin OTP helpers fail closed.
- */
-async function sendEmailOtp(email) {
-    throw retiredInlineAuthError('sendEmailOtp');
-}
-/**
- * Retired. Use hosted login with `methods: ['text']` or `provider: 'text'`
- * when text OTP is enabled for the app.
- */
-async function sendTextOtp(phoneNumber) {
-    throw retiredInlineAuthError('sendTextOtp');
-}
-/**
- * Retired. Complete hosted login on the callback page with
- * `completeLoginFromRedirect()`.
- */
-async function verifyEmailOtp(email, code) {
-    throw retiredInlineAuthError('verifyEmailOtp');
-}
-/**
- * Retired. Complete hosted login on the callback page with
- * `completeLoginFromRedirect()`.
- */
-async function verifyTextOtp(phoneNumber, code) {
-    throw retiredInlineAuthError('verifyTextOtp');
-}
-/**
- * Retired. Guest upgrade is no longer an inline id-preserving auth operation;
- * send the user through hosted login and transfer data explicitly in app state.
- */
-async function linkEmail(email, code) {
-    throw retiredInlineAuthError('linkEmail');
-}
 async function login$1(options) {
     // Re-initialize provider if it was cleared by logout
     if (!currentAuthProvider && initConfig) {
@@ -5333,8 +5240,6 @@ exports.getCurrentUser = getCurrentUser;
 exports.getIdToken = getIdToken;
 exports.getPlatform = getPlatform;
 exports.init = init;
-exports.linkEmail = linkEmail;
-exports.linkWithRedirect = linkWithRedirect;
 exports.login = login;
 exports.loginWithPopup = loginWithPopup;
 exports.loginWithPrivy = loginWithPrivy;
@@ -5342,14 +5247,10 @@ exports.loginWithRedirect = loginWithRedirect;
 exports.logout = logout;
 exports.onAuthLoadingChanged = onAuthLoadingChanged;
 exports.onAuthStateChanged = onAuthStateChanged;
-exports.sendEmailOtp = sendEmailOtp;
-exports.sendTextOtp = sendTextOtp;
 exports.setPlatform = setPlatform;
 exports.signInAnonymously = signInAnonymously;
 exports.useAuth = useAuth;
 exports.useQuery = useQuery;
-exports.verifyEmailOtp = verifyEmailOtp;
-exports.verifyTextOtp = verifyTextOtp;
 Object.keys(core).forEach(function (k) {
     if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {
         enumerable: true,