@bounded-sh/core 0.0.26 → 0.0.34

package/dist/client/config.d.ts

@@ -3,12 +3,11 @@ export interface ClientConfig {
     name: string;
     logoUrl: string;
     /** Auth method. Configure exactly one method at init time.
-     *  'email' = Bounded Auth human login (email OTP, inline).
-     *  OAuth/social uses loginWithRedirect/
-     *  loginWithPopup rather than authMethod. Text OTP uses hosted/headless OTP
-     *  helpers only when explicitly enabled by the Bounded issuer. 'phantom' = connect a Solana wallet (Phantom), for
-     *  crypto/onchain apps that need a real @user.address. 'guest' = anonymous
-     *  device-key auth. */
+     *  Bounded Auth is the default restore/logout surface; start email, social,
+     *  and optional text login with loginWithRedirect/loginWithPopup.
+     *  'phantom' = connect a Solana wallet (Phantom), for crypto/onchain apps
+     *  that need a real @user.address. Guests use signInAnonymously(), not
+     *  authMethod. */
     authMethod: 'none' | 'email' | 'guest' | 'wallet' | 'rainbowkit' | 'coinbase-smart-wallet' | 'onboard' | 'phantom' | 'mobile-wallet-adapter' | 'privy' | 'privy-expo';
     wsApiUrl: string;
     apiUrl: string;
@@ -21,10 +20,9 @@ export interface ClientConfig {
     appId: string;
     /** Wallet/SIWS issuer (wallet + guest providers sign challenges against this). */
     authApiUrl: string;
-    /** Human-login issuer (Bounded Better Auth — email OTP + OAuth, plus optional text OTP). The
-     *  inline 'email' provider calls {humanAuthApiUrl}/email + /verify; hosted
-     *  login and headless helpers can also use text OTP when the issuer enables it.
-     *  Defaults per network. */
+    /** Human-login issuer for hosted Bounded Auth: email OTP, OAuth/social, and
+     *  optional text OTP. App-origin OTP helpers are retired; use hosted
+     *  loginWithRedirect/loginWithPopup against this issuer. Defaults per network. */
     humanAuthApiUrl?: string;
     /**
      * Selects a Bounded backend preset. When set, the endpoint defaults

package/dist/client/live.d.ts

@@ -1,4 +1,5 @@
 import type { RequestOverrides } from './operations';
+import type { SubscriptionOptions } from '../types';
 export type LiveIntentOptions = {
     /** Per-call timeout (ms) for the HTTP request to the realtime worker. */
     timeoutMs?: number;
@@ -79,6 +80,14 @@ export type SubscribeViewOptions = {
     onData: (view: any) => void;
     /** Called on subscription error. */
     onError?: (error: any) => void;
+    /**
+     * @internal Per-subscription auth overrides (server `WalletClient` path).
+     * Lets a keypair-backed agent player subscribe to its live view under its
+     * own wallet session instead of any global session — the same override seam
+     * `subscribe()` already honors. Without this, a Node agent could send
+     * intents but never SEE its view (the documented agent-as-player pattern).
+     */
+    _overrides?: SubscriptionOptions['_overrides'];
 };
 /**
  * Subscribe to YOUR per-player view of a room. Thin sugar over:
@@ -89,8 +98,8 @@ export type SubscribeViewOptions = {
  * claims); pass `opts.userId` to override. Returns the unsubscribe function
  * (a Promise<() => Promise<void>>, same as `subscribe`).
  *
- * Note: this is a browser-first helper (the WS subscription manager is
- * browser-oriented). Server consumers should use `live.intent`.
+ * Server/agent consumers: use `WalletClient.live.subscribeView` (it supplies
+ * the wallet session + view id); browser apps just call this directly.
  */
 export declare function subscribeView(roomPath: string, opts: SubscribeViewOptions): Promise<() => Promise<void>>;
 /** The `bounded.live` namespace surface. */

package/dist/index.js

@@ -39,14 +39,10 @@ let clientConfig = {
     humanAuthApiUrl: 'https://auth.bounded.sh',
     functionsUrl: 'https://functions.bounded.sh',
     appId: '',
-    // No hidden auth fallback: browser clients must pass authMethod explicitly
-    // (for example 'email', 'guest', 'phantom', 'privy', or 'privy-expo').
-    // Hosted OAuth/social uses loginWithRedirect/loginWithPopup with authMethod:'email'.
-    // Text OTP is off by default and uses hosted/headless text helpers only when
-    // Bounded explicitly enables it for the issuer. For
-    // crypto/onchain wallet login use authMethod:'phantom' (Solana / Phantom), or
-    // signInAnonymously() for zero-friction 'guest' accounts. ('wallet' is an
-    // unimplemented stub; don't use.)
+    // No hidden modal fallback: browser clients start hosted Bounded Auth with
+    // loginWithRedirect/loginWithPopup. For crypto/onchain wallet login use
+    // authMethod:'phantom' (Solana / Phantom), and use signInAnonymously() for
+    // zero-friction guest accounts. ('wallet' is an unimplemented stub; don't use.)
     authMethod: 'none',
     chain: '',
     rpcUrl: '',
@@ -2826,6 +2822,7 @@ async function genAuthNonce() {
 // from 'phantom' and couldn't be gated or flagged.
 const SIGNATURE_AUTH_METHODS = new Set(['phantom', 'mobile-wallet-adapter', 'guest']);
 async function createSessionWithSignature(address, message, signature) {
+    var _a, _b;
     const client = await getAxiosAuthClient();
     const config = await getConfig();
     const appId = config.appId;
@@ -2835,14 +2832,30 @@ async function createSessionWithSignature(address, message, signature) {
     // for a signature exchange. This is what makes the server SDK + guest device
     // keypair work under the email-default config.
     const authMethod = SIGNATURE_AUTH_METHODS.has(config.authMethod) ? config.authMethod : 'phantom';
-    const response = await client.post('/session', {
-        appId,
-        address,
-        message,
-        signature,
-        authMethod
-    });
-    return response.data;
+    try {
+        const response = await client.post('/session', {
+            appId,
+            address,
+            message,
+            signature,
+            authMethod
+        });
+        return response.data;
+    }
+    catch (err) {
+        // Surface the issuer's actionable message (e.g. "Anonymous auth is not enabled for
+        // this app. Add \"auth\": { \"anonymous\": true } to policy.json and redeploy.")
+        // instead of axios's generic "Request failed with status code 403".
+        const d = (_a = err === null || err === void 0 ? void 0 : err.response) === null || _a === void 0 ? void 0 : _a.data;
+        if (d && (d.message || d.error)) {
+            const e = new Error(String(d.message || d.error));
+            e.code = d.error;
+            e.status = (_b = err === null || err === void 0 ? void 0 : err.response) === null || _b === void 0 ? void 0 : _b.status;
+            e.hint = d.hint;
+            throw e;
+        }
+        throw err;
+    }
 }
 // Deduplicate concurrent refreshSession calls to prevent multiple code paths
 // (WebSocket reconnection, periodic refresh, API 401 retry) from all hitting
@@ -7140,8 +7153,8 @@ async function status(roomPath, opts = {}) {
  * claims); pass `opts.userId` to override. Returns the unsubscribe function
  * (a Promise<() => Promise<void>>, same as `subscribe`).
  *
- * Note: this is a browser-first helper (the WS subscription manager is
- * browser-oriented). Server consumers should use `live.intent`.
+ * Server/agent consumers: use `WalletClient.live.subscribeView` (it supplies
+ * the wallet session + view id); browser apps just call this directly.
  */
 async function subscribeView(roomPath, opts) {
     if (!roomPath || typeof roomPath !== 'string') {
@@ -7171,7 +7184,7 @@ async function subscribeView(roomPath, opts) {
     // derives the room from the `?path=` the connection carries). Without this the
     // subscription lands on the app-level project DO and never sees the room's
     // ephemeral view writes.
-    return subscribeV2(viewPath, { onData: opts.onData, onError: opts.onError }, normalizedRoomPath);
+    return subscribeV2(viewPath, { onData: opts.onData, onError: opts.onError, _overrides: opts._overrides }, normalizedRoomPath);
 }
 /** The `bounded.live` namespace surface. */
 const live = { intent, status, subscribeView };