@bounded-sh/core 0.0.20 → 0.0.21

package/dist/index.mjs

@@ -10,8 +10,8 @@ let clientConfig = {
     // User configured settings
     name: '',
     logoUrl: '',
-    // Bounded production is the out-of-the-box default — a Bounded app needs only
-    // `{ appId }`. Pass `network: 'bounded-staging'` to target staging.
+    // Bounded production is the endpoint default. Apps still choose one explicit
+    // auth method at init time. Pass `network: 'bounded-staging'` to target staging.
     network: 'bounded-production',
     wsApiUrl: 'wss://realtime.bounded.sh',
     apiUrl: 'https://realtime.bounded.sh',
@@ -19,14 +19,15 @@ let clientConfig = {
     humanAuthApiUrl: 'https://auth.bounded.sh',
     functionsUrl: 'https://functions.bounded.sh',
     appId: '',
-    // 'email' = Bounded Auth human login (inline email OTP) — the out-of-box default
-    // for normal apps. Hosted OAuth/social uses loginWithRedirect/loginWithPopup.
+    // No hidden auth fallback: browser clients must pass authMethod explicitly
+    // (for example 'email', 'guest', 'phantom', 'privy', or 'privy-expo').
+    // Hosted OAuth/social uses loginWithRedirect/loginWithPopup with authMethod:'email'.
     // Text OTP is off by default and uses hosted/headless text helpers only when
     // Bounded explicitly enables it for the issuer. For
     // crypto/onchain wallet login use authMethod:'phantom' (Solana / Phantom), or
     // signInAnonymously() for zero-friction 'guest' accounts. ('wallet' is an
     // unimplemented stub; don't use.)
-    authMethod: 'email',
+    authMethod: 'none',
     chain: '',
     rpcUrl: '',
     skipBackendInit: true,
@@ -92,10 +93,14 @@ function init(newConfig) {
         }
         // Bounded is client-driven: defaults are Bounded production, `network`
         // switches the whole endpoint set (e.g. 'bounded-staging'), and anything
-        // passed explicitly wins. No `/config` round-trip — `init({ appId })` is
-        // synchronous and works out of the box.
+        // passed explicitly wins. No `/config` round-trip; browser SDKs still pass
+        // one explicit authMethod so there is no hidden auth-provider fallback.
         //   defaults (bounded-production) < network preset < explicit newConfig
-        const preset = (newConfig.network && BOUNDED_NETWORKS[newConfig.network]) || {};
+        if (newConfig.network !== undefined && !(newConfig.network in BOUNDED_NETWORKS)) {
+            reject(new Error(`Unsupported Bounded network "${String(newConfig.network)}". Expected bounded, bounded-staging, or bounded-production.`));
+            return;
+        }
+        const preset = newConfig.network ? BOUNDED_NETWORKS[newConfig.network] : {};
         clientConfig = Object.assign(Object.assign(Object.assign({}, clientConfig), preset), newConfig);
         isInitialized = true;
         resolve();