@bounded-sh/core 0.0.20 → 0.0.21

package/dist/client/config.d.ts

@@ -2,12 +2,13 @@ import { AuthProvider } from '../types';
 export interface ClientConfig {
     name: string;
     logoUrl: string;
-    /** Auth method. 'email' = Bounded Auth human login (email OTP, inline) —
-     *  the default for most apps. OAuth/social uses loginWithRedirect/
+    /** Auth method. Configure exactly one method at init time.
+     *  'email' = Bounded Auth human login (email OTP, inline).
+     *  OAuth/social uses loginWithRedirect/
      *  loginWithPopup rather than authMethod. Text OTP uses hosted/headless OTP
      *  helpers only when explicitly enabled by the Bounded issuer. 'phantom' = connect a Solana wallet (Phantom), for
-     *  crypto/onchain apps that need a real @user.address. 'guest' = zero-config
-     *  anonymous (device keypair). All coexist. */
+     *  crypto/onchain apps that need a real @user.address. 'guest' = anonymous
+     *  device-key auth. */
     authMethod: 'none' | 'email' | 'guest' | 'wallet' | 'rainbowkit' | 'coinbase-smart-wallet' | 'onboard' | 'phantom' | 'mobile-wallet-adapter' | 'privy' | 'privy-expo';
     wsApiUrl: string;
     apiUrl: string;

package/dist/index.js

@@ -30,8 +30,8 @@ let clientConfig = {
     // User configured settings
     name: '',
     logoUrl: '',
-    // Bounded production is the out-of-the-box default — a Bounded app needs only
-    // `{ appId }`. Pass `network: 'bounded-staging'` to target staging.
+    // Bounded production is the endpoint default. Apps still choose one explicit
+    // auth method at init time. Pass `network: 'bounded-staging'` to target staging.
     network: 'bounded-production',
     wsApiUrl: 'wss://realtime.bounded.sh',
     apiUrl: 'https://realtime.bounded.sh',
@@ -39,14 +39,15 @@ let clientConfig = {
     humanAuthApiUrl: 'https://auth.bounded.sh',
     functionsUrl: 'https://functions.bounded.sh',
     appId: '',
-    // 'email' = Bounded Auth human login (inline email OTP) — the out-of-box default
-    // for normal apps. Hosted OAuth/social uses loginWithRedirect/loginWithPopup.
+    // No hidden auth fallback: browser clients must pass authMethod explicitly
+    // (for example 'email', 'guest', 'phantom', 'privy', or 'privy-expo').
+    // Hosted OAuth/social uses loginWithRedirect/loginWithPopup with authMethod:'email'.
     // Text OTP is off by default and uses hosted/headless text helpers only when
     // Bounded explicitly enables it for the issuer. For
     // crypto/onchain wallet login use authMethod:'phantom' (Solana / Phantom), or
     // signInAnonymously() for zero-friction 'guest' accounts. ('wallet' is an
     // unimplemented stub; don't use.)
-    authMethod: 'email',
+    authMethod: 'none',
     chain: '',
     rpcUrl: '',
     skipBackendInit: true,
@@ -112,10 +113,14 @@ function init(newConfig) {
         }
         // Bounded is client-driven: defaults are Bounded production, `network`
         // switches the whole endpoint set (e.g. 'bounded-staging'), and anything
-        // passed explicitly wins. No `/config` round-trip — `init({ appId })` is
-        // synchronous and works out of the box.
+        // passed explicitly wins. No `/config` round-trip; browser SDKs still pass
+        // one explicit authMethod so there is no hidden auth-provider fallback.
         //   defaults (bounded-production) < network preset < explicit newConfig
-        const preset = (newConfig.network && BOUNDED_NETWORKS[newConfig.network]) || {};
+        if (newConfig.network !== undefined && !(newConfig.network in BOUNDED_NETWORKS)) {
+            reject(new Error(`Unsupported Bounded network "${String(newConfig.network)}". Expected bounded, bounded-staging, or bounded-production.`));
+            return;
+        }
+        const preset = newConfig.network ? BOUNDED_NETWORKS[newConfig.network] : {};
         clientConfig = Object.assign(Object.assign(Object.assign({}, clientConfig), preset), newConfig);
         isInitialized = true;
         resolve();