@bounded-sh/client 0.0.33 → 0.0.35

package/dist/index.mjs

@@ -3771,7 +3771,7 @@ function appendHostedLoginHints(params, opts) {
 // native (expo-web-browser) path. The caller decides where the PkceState lives
 // (web → sessionStorage across the full-page redirect; native → in-memory across
 // the awaited browser session).
-async function buildAuthorize(opts, guestHint) {
+async function buildAuthorize(opts) {
     const cfg = await getConfig();
     if (!cfg.appId)
         throw new Error('appId is not configured (init the SDK with your appId)');
@@ -3788,35 +3788,8 @@ async function buildAuthorize(opts, guestHint) {
         code_challenge: challenge, code_challenge_method: 'S256', state,
     });
     appendHostedLoginHints(params, opts);
-    // Anonymous→real UPGRADE (linkWithRedirect): the issuer needs the guest identity bound to
-    // this request's PKCE code_challenge so the link completes single-use at the code→token
-    // exchange. We do NOT put the raw guest id-token in the URL (it would land in server logs /
-    // browser history — a replayable identity-capture primitive). Instead we exchange it for an
-    // OPAQUE single-use handle server-side and carry only that.
-    if (guestHint)
-        params.set('bounded_guest_hint', await guestHintFor(guestHint));
     return { url: `${base}/api/auth/oauth2/authorize?${params.toString()}`, pkce: { verifier, state, redirectUri } };
 }
-/** Exchange a guest id-token for an opaque single-use handle via the issuer, so the raw token
- *  never rides the authorize URL. Falls back to the raw token if the mint endpoint is
- *  unavailable — the issuer accepts both, so an upgrade never breaks during rollout. */
-async function guestHintFor(guestToken) {
-    try {
-        const base = await issuerBase();
-        const res = await fetch(`${base}/link/guest-handle`, {
-            method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ guestToken }),
-        });
-        if (res.ok) {
-            const data = await res.json().catch(() => null);
-            if (data && typeof data.handle === 'string' && data.handle)
-                return data.handle;
-        }
-    }
-    catch ( /* fall through to the raw-token fallback */_a) { /* fall through to the raw-token fallback */ }
-    return guestToken;
-}
 // Are we on React Native (no DOM)? OIDC dispatch uses this to choose the native
 // expo-web-browser driver vs. the web full-page-redirect/popup driver.
 function isNative() {
@@ -3866,9 +3839,9 @@ function parseCallbackParams(callbackUrl) {
 // universal-link callback, verify state, and run the SAME PKCE code→token exchange
 // as web. Returns the signed-in User (native completes inline — there's no separate
 // completeLoginFromRedirect() round-trip the way the web full-page redirect needs).
-async function runNativeLogin(opts, guestHint) {
+async function runNativeLogin(opts) {
     var _a, _b;
-    const { url, pkce } = await buildAuthorize(opts, guestHint);
+    const { url, pkce } = await buildAuthorize(opts);
     const WebBrowser = await loadExpoWebBrowser();
     const openAuthSession = WebBrowser.openAuthSessionAsync || ((_a = WebBrowser.default) === null || _a === void 0 ? void 0 : _a.openAuthSessionAsync);
     if (typeof openAuthSession !== 'function') {
@@ -3921,37 +3894,12 @@ async function loginWithRedirect(opts) {
     setAuthLoading(true); // reflect "signing in…" right up to navigation; the return page's
     window.location.href = url; // completeLoginFromRedirect() keeps it true until the user resolves.
 }
-/** UPGRADE the current anonymous (guest) session by linking a SOCIAL/redirect login
- *  (e.g. Google) — Firebase `linkWithPopup`/redirect parity. Carries the guest's signed
- *  id-token THROUGH the OIDC authorize request (as a single-use hint bound to the PKCE
- *  challenge), then runs the normal redirect login. The issuer completes the link during
- *  the standard code→token exchange: if the chosen account is brand-new the guest's
- *  `@user.id` is preserved (the returned id_token is minted under it), else the account
- *  stays separate (guest id discarded). Requires an active guest session.
- *
- *  Works on WEB (navigates, finish with completeLoginFromRedirect) and REACT NATIVE
- *  (opens expo-web-browser and resolves with the upgraded User inline). */
-async function linkWithRedirect(opts) {
-    const guestToken = sessionManager().getIdToken();
-    if (!guestToken)
-        throw new Error('linkWithRedirect requires an active anonymous session — call signInAnonymously() first.');
-    if (isNative())
-        return runNativeLogin(opts, guestToken);
-    if (!hasDOM())
-        throw new Error('linkWithRedirect requires a browser or a configured React Native platform');
-    const { url, pkce } = await buildAuthorize(opts, guestToken);
-    sessionStorage.setItem(PKCE_STORE_KEY, JSON.stringify(pkce));
-    window.location.href = url;
-}
 /** Finish login on the redirect_uri page (WEB ONLY): exchange ?code= for a token (PKCE-verified),
  *  store the session, and return the User. Idempotent: returns null if there's no ?code= in the URL.
- *  When the redirect was a guest UPGRADE (linkWithRedirect) and the issuer adopted the guest
- *  id, the exchanged id_token already carries the preserved `@user.id`, so the returned User
- *  reflects it automatically (no extra round-trip).
  *
  *  On REACT NATIVE this returns null and is a no-op: native login completes INLINE inside
- *  loginWithRedirect()/linkWithRedirect() (which resolve with the User), so there is no
- *  separate redirect page to finish from. Calling it on RN is harmless. */
+ *  loginWithRedirect() (which resolves with the User), so there is no separate redirect
+ *  page to finish from. Calling it on RN is harmless. */
 async function completeLoginFromRedirect() {
     if (!hasDOM())
         return null;
@@ -4321,12 +4269,6 @@ async function getAuthProvider(config) {
     currentAuthProviderConfigKey = nextProviderConfigKey;
     return currentAuthProvider;
 }
-function retiredInlineAuthError(method) {
-    return new Error(`bounded-sh: ${method} is retired. Human login must use the hosted OAuth2 + PKCE flow: ` +
-        `loginWithRedirect({ redirectUri }) or loginWithPopup({ redirectUri }). ` +
-        `For guests use signInAnonymously(); for guest-to-real-account data continuity, ` +
-        `transfer ownership in app data after hosted login.`);
-}
 /**
  * Browser/React-Native-only auth flows (guest, email) persist their session via
  * WebSessionManager, which is gated to environments that have `window` /
@@ -4410,41 +4352,6 @@ async function loginWithPrivy(options) {
     const result = await provider.login();
     return result ? Object.assign(Object.assign({}, result), { provider }) : null;
 }
-/**
- * Retired. Use `loginWithRedirect({ redirectUri, methods: ['email'] })` or
- * `loginWithPopup(...)`; app-origin OTP helpers fail closed.
- */
-async function sendEmailOtp(email) {
-    throw retiredInlineAuthError('sendEmailOtp');
-}
-/**
- * Retired. Use hosted login with `methods: ['text']` or `provider: 'text'`
- * when text OTP is enabled for the app.
- */
-async function sendTextOtp(phoneNumber) {
-    throw retiredInlineAuthError('sendTextOtp');
-}
-/**
- * Retired. Complete hosted login on the callback page with
- * `completeLoginFromRedirect()`.
- */
-async function verifyEmailOtp(email, code) {
-    throw retiredInlineAuthError('verifyEmailOtp');
-}
-/**
- * Retired. Complete hosted login on the callback page with
- * `completeLoginFromRedirect()`.
- */
-async function verifyTextOtp(phoneNumber, code) {
-    throw retiredInlineAuthError('verifyTextOtp');
-}
-/**
- * Retired. Guest upgrade is no longer an inline id-preserving auth operation;
- * send the user through hosted login and transfer data explicitly in app state.
- */
-async function linkEmail(email, code) {
-    throw retiredInlineAuthError('linkEmail');
-}
 async function login$1(options) {
     // Re-initialize provider if it was cleared by logout
     if (!currentAuthProvider && initConfig) {
@@ -5222,5 +5129,5 @@ class PrivyExpoProvider {
     }
 }
 
-export { OffchainAuthProvider, PrivyExpoProvider, completeLoginFromRedirect, completeLoginInPopup, deserializeTransaction, getAuthLoading, getAuthProvider, getCurrentUser, getIdToken, getPlatform, init, linkEmail, linkWithRedirect, login, loginWithPopup, loginWithPrivy, loginWithRedirect, logout, onAuthLoadingChanged, onAuthStateChanged, sendEmailOtp, sendTextOtp, setPlatform, signInAnonymously, useAuth, useQuery, verifyEmailOtp, verifyTextOtp };
+export { OffchainAuthProvider, PrivyExpoProvider, completeLoginFromRedirect, completeLoginInPopup, deserializeTransaction, getAuthLoading, getAuthProvider, getCurrentUser, getIdToken, getPlatform, init, login, loginWithPopup, loginWithPrivy, loginWithRedirect, logout, onAuthLoadingChanged, onAuthStateChanged, setPlatform, signInAnonymously, useAuth, useQuery };
 //# sourceMappingURL=index.mjs.map