@bounded-sh/core 0.0.20 → 0.0.22

package/dist/client/config.d.ts

@@ -2,12 +2,13 @@ import { AuthProvider } from '../types';
 export interface ClientConfig {
     name: string;
     logoUrl: string;
-    /** Auth method. 'email' = Bounded Auth human login (email OTP, inline) —
-     *  the default for most apps. OAuth/social uses loginWithRedirect/
+    /** Auth method. Configure exactly one method at init time.
+     *  'email' = Bounded Auth human login (email OTP, inline).
+     *  OAuth/social uses loginWithRedirect/
      *  loginWithPopup rather than authMethod. Text OTP uses hosted/headless OTP
      *  helpers only when explicitly enabled by the Bounded issuer. 'phantom' = connect a Solana wallet (Phantom), for
-     *  crypto/onchain apps that need a real @user.address. 'guest' = zero-config
-     *  anonymous (device keypair). All coexist. */
+     *  crypto/onchain apps that need a real @user.address. 'guest' = anonymous
+     *  device-key auth. */
     authMethod: 'none' | 'email' | 'guest' | 'wallet' | 'rainbowkit' | 'coinbase-smart-wallet' | 'onboard' | 'phantom' | 'mobile-wallet-adapter' | 'privy' | 'privy-expo';
     wsApiUrl: string;
     apiUrl: string;

package/dist/client/subscription-v2.d.ts

@@ -60,7 +60,7 @@ export declare function hasActiveConnection(): boolean;
  * room authority — the connection is already routed to the room DO, so the
  * client never names a destination.
  */
-export declare function wsIntent(appId: string, roomRoutePath: string, intent: unknown): boolean;
+export declare function wsIntent(appId: string, roomRoutePath: string, intent: unknown, isServer: boolean): Promise<boolean>;
 /**
  * Send a live-room intent over the EXISTING per-room socket and AWAIT the server
  * ack — so a policy/auth denial (401/403/404/503) REJECTS instead of being
@@ -69,6 +69,6 @@ export declare function wsIntent(appId: string, roomRoutePath: string, intent: u
  * Promise that resolves on ack / rejects on error, or `undefined` if no live
  * socket exists yet (caller falls back to HTTP, which also surfaces errors).
  */
-export declare function wsIntentReliable(appId: string, roomRoutePath: string, intent: unknown): Promise<{
+export declare function wsIntentReliable(appId: string, roomRoutePath: string, intent: unknown, isServer: boolean): Promise<{
     ok: true;
-}> | undefined;
+} | undefined>;

package/dist/index.js

@@ -30,8 +30,8 @@ let clientConfig = {
     // User configured settings
     name: '',
     logoUrl: '',
-    // Bounded production is the out-of-the-box default — a Bounded app needs only
-    // `{ appId }`. Pass `network: 'bounded-staging'` to target staging.
+    // Bounded production is the endpoint default. Apps still choose one explicit
+    // auth method at init time. Pass `network: 'bounded-staging'` to target staging.
     network: 'bounded-production',
     wsApiUrl: 'wss://realtime.bounded.sh',
     apiUrl: 'https://realtime.bounded.sh',
@@ -39,14 +39,15 @@ let clientConfig = {
     humanAuthApiUrl: 'https://auth.bounded.sh',
     functionsUrl: 'https://functions.bounded.sh',
     appId: '',
-    // 'email' = Bounded Auth human login (inline email OTP) — the out-of-box default
-    // for normal apps. Hosted OAuth/social uses loginWithRedirect/loginWithPopup.
+    // No hidden auth fallback: browser clients must pass authMethod explicitly
+    // (for example 'email', 'guest', 'phantom', 'privy', or 'privy-expo').
+    // Hosted OAuth/social uses loginWithRedirect/loginWithPopup with authMethod:'email'.
     // Text OTP is off by default and uses hosted/headless text helpers only when
     // Bounded explicitly enables it for the issuer. For
     // crypto/onchain wallet login use authMethod:'phantom' (Solana / Phantom), or
     // signInAnonymously() for zero-friction 'guest' accounts. ('wallet' is an
     // unimplemented stub; don't use.)
-    authMethod: 'email',
+    authMethod: 'none',
     chain: '',
     rpcUrl: '',
     skipBackendInit: true,
@@ -112,10 +113,14 @@ function init(newConfig) {
         }
         // Bounded is client-driven: defaults are Bounded production, `network`
         // switches the whole endpoint set (e.g. 'bounded-staging'), and anything
-        // passed explicitly wins. No `/config` round-trip — `init({ appId })` is
-        // synchronous and works out of the box.
+        // passed explicitly wins. No `/config` round-trip; browser SDKs still pass
+        // one explicit authMethod so there is no hidden auth-provider fallback.
         //   defaults (bounded-production) < network preset < explicit newConfig
-        const preset = (newConfig.network && BOUNDED_NETWORKS[newConfig.network]) || {};
+        if (newConfig.network !== undefined && !(newConfig.network in BOUNDED_NETWORKS)) {
+            reject(new Error(`Unsupported Bounded network "${String(newConfig.network)}". Expected bounded, bounded-staging, or bounded-production.`));
+            return;
+        }
+        const preset = newConfig.network ? BOUNDED_NETWORKS[newConfig.network] : {};
         clientConfig = Object.assign(Object.assign(Object.assign({}, clientConfig), preset), newConfig);
         isInitialized = true;
         resolve();
@@ -5430,6 +5435,48 @@ function getCacheKey(path, prompt, shape, limit, cursor, filter, identity) {
 function principalFromIdToken(idToken) {
     return idToken ? `t${hashForKey(idToken)}` : null;
 }
+function livePrincipalFromIdToken(idToken) {
+    if (!idToken)
+        return null;
+    try {
+        const payload = JSON.parse(decodeBase64Url(idToken.split('.')[1]));
+        const userId = payload['custom:userId'];
+        if (typeof userId === 'string' && userId.length > 0)
+            return userId;
+        const walletAddress = payload['custom:walletAddress'];
+        if (typeof walletAddress === 'string' && walletAddress.length > 0)
+            return walletAddress;
+        const subject = payload.sub;
+        return typeof subject === 'string' && subject.length > 0 ? subject : null;
+    }
+    catch (_a) {
+        return null;
+    }
+}
+function authSnapshotFromToken(idToken) {
+    return {
+        tokenFingerprint: principalFromIdToken(idToken),
+        principal: livePrincipalFromIdToken(idToken),
+    };
+}
+function connectionMatchesAuthToken(connection, idToken) {
+    const current = authSnapshotFromToken(idToken);
+    if (!current.tokenFingerprint) {
+        return connection.authTokenFingerprint === null && connection.authPrincipal === null;
+    }
+    if (connection.authTokenFingerprint && connection.authTokenFingerprint === current.tokenFingerprint) {
+        return true;
+    }
+    return !!connection.authPrincipal && !!current.principal && connection.authPrincipal === current.principal;
+}
+async function canSendAuthenticatedLiveIntent(connection, isServer) {
+    const currentToken = await getIdToken(isServer);
+    if (!currentToken)
+        return false;
+    if (!connection.authTokenFingerprint && !connection.authPrincipal)
+        return false;
+    return connectionMatchesAuthToken(connection, currentToken);
+}
 async function getSubscriptionIdentity(effectiveAppId, isServer, overrides) {
     // Per-subscription wallet override (server WalletClient.subscribe): key by
     // the wallet's own opaque token material, mirroring getReadPrincipalKey. Do
@@ -5505,6 +5552,9 @@ function rememberAmbientAuthFailure(error) {
 function failConnectionAuth(connection, error) {
     connection.authFailure = error;
     connection.pendingAuthToken = null;
+    connection.pendingAuthSnapshot = null;
+    connection.authTokenFingerprint = null;
+    connection.authPrincipal = null;
     connection.isConnecting = false;
     connection.isConnected = false;
     connection.isAuthenticating = false;
@@ -5723,16 +5773,37 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
         if (connection.authFailure) {
             throw connection.authFailure;
         }
+        let currentAuthToken;
         try {
-            await getConnectionAuthToken(isServer, authTokenProvider);
+            currentAuthToken = await getConnectionAuthToken(isServer, authTokenProvider);
         }
         catch (error) {
             const authError = normalizeAuthExpiredError(error, 'Authentication expired and refresh failed');
             failConnectionAuth(connection, authError);
             throw authError;
         }
+        if (connection.isConnected &&
+            !connection.isAuthenticating &&
+            !connectionMatchesAuthToken(connection, currentAuthToken)) {
+            if (connection.tokenRefreshTimer) {
+                clearInterval(connection.tokenRefreshTimer);
+                connection.tokenRefreshTimer = null;
+            }
+            try {
+                connection.ws.close();
+            }
+            catch (_a) {
+                // Already closing.
+            }
+            connection.ws = null;
+            connection.isConnected = false;
+            connections.delete(connection.key);
+        }
+        else {
+            connection.authFailure = null;
+            return connection;
+        }
         connection.authFailure = null;
-        return connection;
     }
     let initialAuthToken = await getConnectionAuthToken(isServer, authTokenProvider);
     // Create new connection
@@ -5750,6 +5821,9 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
         routePath: roomKey ? routePath : undefined,
         authTokenProvider,
         pendingAuthToken: null,
+        pendingAuthSnapshot: null,
+        authTokenFingerprint: null,
+        authPrincipal: null,
         tokenRefreshTimer: null,
         consecutiveAuthFailures: 0,
         authFailure: null,
@@ -5787,6 +5861,7 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
             throw authError;
         }
         connection.pendingAuthToken = authToken || null;
+        connection.pendingAuthSnapshot = authSnapshotFromToken(authToken);
         if (authToken) {
             // Successful token acquisition — reset failure counter
             connection.consecutiveAuthFailures = 0;
@@ -5826,6 +5901,8 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
         }
         else {
             connection.isAuthenticating = false;
+            connection.authTokenFingerprint = null;
+            connection.authPrincipal = null;
             replaySubscriptions(connection);
         }
     });
@@ -5865,10 +5942,12 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
     return connection;
 }
 function handleServerMessage(connection, message) {
-    var _a;
+    var _a, _b, _c, _d, _e;
     switch (message.type) {
         case 'authenticated': {
             connection.isAuthenticating = false;
+            connection.authTokenFingerprint = (_b = (_a = connection.pendingAuthSnapshot) === null || _a === void 0 ? void 0 : _a.tokenFingerprint) !== null && _b !== void 0 ? _b : null;
+            connection.authPrincipal = (_d = (_c = connection.pendingAuthSnapshot) === null || _c === void 0 ? void 0 : _c.principal) !== null && _d !== void 0 ? _d : null;
             replaySubscriptions(connection);
             break;
         }
@@ -5939,7 +6018,7 @@ function handleServerMessage(connection, message) {
                 connection.pendingRequests.delete(message.requestId);
                 clearTimeout(pendingSet.timer);
                 if (message.statusCode >= 400) {
-                    pendingSet.reject(new Error(((_a = message.body) === null || _a === void 0 ? void 0 : _a.message) || `Set failed with status ${message.statusCode}`));
+                    pendingSet.reject(new Error(((_e = message.body) === null || _e === void 0 ? void 0 : _e.message) || `Set failed with status ${message.statusCode}`));
                 }
                 else {
                     pendingSet.resolve(message.body);
@@ -6467,13 +6546,16 @@ function hasActiveConnection() {
  * room authority — the connection is already routed to the room DO, so the
  * client never names a destination.
  */
-function wsIntent(appId, roomRoutePath, intent) {
+async function wsIntent(appId, roomRoutePath, intent, isServer) {
     const roomKey = roomKeyFromRoutePath(roomRoutePath);
     const connKey = roomKey ? `${appId}#room#${roomKey}` : appId;
     const connection = connections.get(connKey);
     if (!connection || !connection.ws || connection.ws.readyState !== WS_READY_STATE_OPEN || connection.isAuthenticating) {
         return false;
     }
+    if (!(await canSendAuthenticatedLiveIntent(connection, isServer))) {
+        return false;
+    }
     try {
         connection.ws.send(JSON.stringify({ type: 'intent', intent }));
         return true;
@@ -6490,13 +6572,16 @@ function wsIntent(appId, roomRoutePath, intent) {
  * Promise that resolves on ack / rejects on error, or `undefined` if no live
  * socket exists yet (caller falls back to HTTP, which also surfaces errors).
  */
-function wsIntentReliable(appId, roomRoutePath, intent) {
+async function wsIntentReliable(appId, roomRoutePath, intent, isServer) {
     const roomKey = roomKeyFromRoutePath(roomRoutePath);
     const connKey = roomKey ? `${appId}#room#${roomKey}` : appId;
     const connection = connections.get(connKey);
     if (!connection || !connection.ws || connection.ws.readyState !== WS_READY_STATE_OPEN || connection.isAuthenticating) {
         return undefined;
     }
+    if (!(await canSendAuthenticatedLiveIntent(connection, isServer))) {
+        return undefined;
+    }
     const requestId = generateRequestId();
     return new Promise((resolve, reject) => {
         const timer = setTimeout(() => {
@@ -6908,13 +6993,13 @@ async function intent(roomPath, intent, opts = {}) {
     const hasAuthOverride = !!((_a = opts._overrides) === null || _a === void 0 ? void 0 : _a._getAuthHeaders);
     if (!hasAuthOverride) {
         if (opts.fireAndForget) {
-            if (wsIntent(config.appId, normalizedRoomPath, intent))
+            if (await wsIntent(config.appId, normalizedRoomPath, intent, config.isServer))
                 return { ok: true };
         }
         else {
-            const ack = wsIntentReliable(config.appId, normalizedRoomPath, intent);
+            const ack = await wsIntentReliable(config.appId, normalizedRoomPath, intent, config.isServer);
             if (ack)
-                return await ack;
+                return ack;
         }
     }
     const base = realtimeHttpBase(config.wsApiUrl);