@bounded-sh/core 0.0.19 → 0.0.21

package/dist/client/config.d.ts

@@ -2,12 +2,13 @@ import { AuthProvider } from '../types';
 export interface ClientConfig {
     name: string;
     logoUrl: string;
-    /** Auth method. 'email' = Bounded Auth human login (email OTP, inline) —
-     *  the default for most apps. OAuth/social uses loginWithRedirect/
+    /** Auth method. Configure exactly one method at init time.
+     *  'email' = Bounded Auth human login (email OTP, inline).
+     *  OAuth/social uses loginWithRedirect/
      *  loginWithPopup rather than authMethod. Text OTP uses hosted/headless OTP
      *  helpers only when explicitly enabled by the Bounded issuer. 'phantom' = connect a Solana wallet (Phantom), for
-     *  crypto/onchain apps that need a real @user.address. 'guest' = zero-config
-     *  anonymous (device keypair). All coexist. */
+     *  crypto/onchain apps that need a real @user.address. 'guest' = anonymous
+     *  device-key auth. */
     authMethod: 'none' | 'email' | 'guest' | 'wallet' | 'rainbowkit' | 'coinbase-smart-wallet' | 'onboard' | 'phantom' | 'mobile-wallet-adapter' | 'privy' | 'privy-expo';
     wsApiUrl: string;
     apiUrl: string;
@@ -75,7 +76,6 @@ export interface ClientConfig {
         cluster?: string;
         theme?: 'light' | 'dark';
     };
-    mockAuth?: boolean;
 }
 export declare let clientConfig: ClientConfig;
 type BoundedEndpoints = Pick<ClientConfig, 'wsApiUrl' | 'apiUrl' | 'authApiUrl' | 'humanAuthApiUrl' | 'functionsUrl'>;

package/dist/index.js

@@ -30,8 +30,8 @@ let clientConfig = {
     // User configured settings
     name: '',
     logoUrl: '',
-    // Bounded production is the out-of-the-box default — a Bounded app needs only
-    // `{ appId }`. Pass `network: 'bounded-staging'` to target staging.
+    // Bounded production is the endpoint default. Apps still choose one explicit
+    // auth method at init time. Pass `network: 'bounded-staging'` to target staging.
     network: 'bounded-production',
     wsApiUrl: 'wss://realtime.bounded.sh',
     apiUrl: 'https://realtime.bounded.sh',
@@ -39,14 +39,15 @@ let clientConfig = {
     humanAuthApiUrl: 'https://auth.bounded.sh',
     functionsUrl: 'https://functions.bounded.sh',
     appId: '',
-    // 'email' = Bounded Auth human login (inline email OTP) — the out-of-box default
-    // for normal apps. Hosted OAuth/social uses loginWithRedirect/loginWithPopup.
+    // No hidden auth fallback: browser clients must pass authMethod explicitly
+    // (for example 'email', 'guest', 'phantom', 'privy', or 'privy-expo').
+    // Hosted OAuth/social uses loginWithRedirect/loginWithPopup with authMethod:'email'.
     // Text OTP is off by default and uses hosted/headless text helpers only when
     // Bounded explicitly enables it for the issuer. For
     // crypto/onchain wallet login use authMethod:'phantom' (Solana / Phantom), or
     // signInAnonymously() for zero-friction 'guest' accounts. ('wallet' is an
     // unimplemented stub; don't use.)
-    authMethod: 'email',
+    authMethod: 'none',
     chain: '',
     rpcUrl: '',
     skipBackendInit: true,
@@ -112,10 +113,14 @@ function init(newConfig) {
         }
         // Bounded is client-driven: defaults are Bounded production, `network`
         // switches the whole endpoint set (e.g. 'bounded-staging'), and anything
-        // passed explicitly wins. No `/config` round-trip — `init({ appId })` is
-        // synchronous and works out of the box.
+        // passed explicitly wins. No `/config` round-trip; browser SDKs still pass
+        // one explicit authMethod so there is no hidden auth-provider fallback.
         //   defaults (bounded-production) < network preset < explicit newConfig
-        const preset = (newConfig.network && BOUNDED_NETWORKS[newConfig.network]) || {};
+        if (newConfig.network !== undefined && !(newConfig.network in BOUNDED_NETWORKS)) {
+            reject(new Error(`Unsupported Bounded network "${String(newConfig.network)}". Expected bounded, bounded-staging, or bounded-production.`));
+            return;
+        }
+        const preset = newConfig.network ? BOUNDED_NETWORKS[newConfig.network] : {};
         clientConfig = Object.assign(Object.assign(Object.assign({}, clientConfig), preset), newConfig);
         isInitialized = true;
         resolve();
@@ -5169,11 +5174,8 @@ async function setMany(many, options) {
     async function handleOffchainTransaction(tx, authProvider, options) {
         var _a, _b, _c, _d, _e, _f;
         const config = await getConfig();
-        // 1. Sign the transaction message using mock signing for offchain transactions
-        // Use signMessageMock if available (OffchainAuthProvider), otherwise fall back to signMessage
-        const signature = authProvider.signMessageMock
-            ? await authProvider.signMessageMock(tx.message)
-            : await authProvider.signMessage(tx.message);
+        // 1. Sign the transaction message using the provider's canonical signer.
+        const signature = await authProvider.signMessage(tx.message);
         // 2. Create signed transaction
         const signedTx = {
             transaction: tx,