@bounded-sh/core 0.0.19 → 0.0.21

package/dist/index.mjs

@@ -10,8 +10,8 @@ let clientConfig = {
     // User configured settings
     name: '',
     logoUrl: '',
-    // Bounded production is the out-of-the-box default — a Bounded app needs only
-    // `{ appId }`. Pass `network: 'bounded-staging'` to target staging.
+    // Bounded production is the endpoint default. Apps still choose one explicit
+    // auth method at init time. Pass `network: 'bounded-staging'` to target staging.
     network: 'bounded-production',
     wsApiUrl: 'wss://realtime.bounded.sh',
     apiUrl: 'https://realtime.bounded.sh',
@@ -19,14 +19,15 @@ let clientConfig = {
     humanAuthApiUrl: 'https://auth.bounded.sh',
     functionsUrl: 'https://functions.bounded.sh',
     appId: '',
-    // 'email' = Bounded Auth human login (inline email OTP) — the out-of-box default
-    // for normal apps. Hosted OAuth/social uses loginWithRedirect/loginWithPopup.
+    // No hidden auth fallback: browser clients must pass authMethod explicitly
+    // (for example 'email', 'guest', 'phantom', 'privy', or 'privy-expo').
+    // Hosted OAuth/social uses loginWithRedirect/loginWithPopup with authMethod:'email'.
     // Text OTP is off by default and uses hosted/headless text helpers only when
     // Bounded explicitly enables it for the issuer. For
     // crypto/onchain wallet login use authMethod:'phantom' (Solana / Phantom), or
     // signInAnonymously() for zero-friction 'guest' accounts. ('wallet' is an
     // unimplemented stub; don't use.)
-    authMethod: 'email',
+    authMethod: 'none',
     chain: '',
     rpcUrl: '',
     skipBackendInit: true,
@@ -92,10 +93,14 @@ function init(newConfig) {
         }
         // Bounded is client-driven: defaults are Bounded production, `network`
         // switches the whole endpoint set (e.g. 'bounded-staging'), and anything
-        // passed explicitly wins. No `/config` round-trip — `init({ appId })` is
-        // synchronous and works out of the box.
+        // passed explicitly wins. No `/config` round-trip; browser SDKs still pass
+        // one explicit authMethod so there is no hidden auth-provider fallback.
         //   defaults (bounded-production) < network preset < explicit newConfig
-        const preset = (newConfig.network && BOUNDED_NETWORKS[newConfig.network]) || {};
+        if (newConfig.network !== undefined && !(newConfig.network in BOUNDED_NETWORKS)) {
+            reject(new Error(`Unsupported Bounded network "${String(newConfig.network)}". Expected bounded, bounded-staging, or bounded-production.`));
+            return;
+        }
+        const preset = newConfig.network ? BOUNDED_NETWORKS[newConfig.network] : {};
         clientConfig = Object.assign(Object.assign(Object.assign({}, clientConfig), preset), newConfig);
         isInitialized = true;
         resolve();
@@ -5149,11 +5154,8 @@ async function setMany(many, options) {
     async function handleOffchainTransaction(tx, authProvider, options) {
         var _a, _b, _c, _d, _e, _f;
         const config = await getConfig();
-        // 1. Sign the transaction message using mock signing for offchain transactions
-        // Use signMessageMock if available (OffchainAuthProvider), otherwise fall back to signMessage
-        const signature = authProvider.signMessageMock
-            ? await authProvider.signMessageMock(tx.message)
-            : await authProvider.signMessage(tx.message);
+        // 1. Sign the transaction message using the provider's canonical signer.
+        const signature = await authProvider.signMessage(tx.message);
         // 2. Create signed transaction
         const signedTx = {
             transaction: tx,