@bounded-sh/core 0.0.26 → 0.0.34

package/dist/index.mjs

@@ -19,14 +19,10 @@ let clientConfig = {
     humanAuthApiUrl: 'https://auth.bounded.sh',
     functionsUrl: 'https://functions.bounded.sh',
     appId: '',
-    // No hidden auth fallback: browser clients must pass authMethod explicitly
-    // (for example 'email', 'guest', 'phantom', 'privy', or 'privy-expo').
-    // Hosted OAuth/social uses loginWithRedirect/loginWithPopup with authMethod:'email'.
-    // Text OTP is off by default and uses hosted/headless text helpers only when
-    // Bounded explicitly enables it for the issuer. For
-    // crypto/onchain wallet login use authMethod:'phantom' (Solana / Phantom), or
-    // signInAnonymously() for zero-friction 'guest' accounts. ('wallet' is an
-    // unimplemented stub; don't use.)
+    // No hidden modal fallback: browser clients start hosted Bounded Auth with
+    // loginWithRedirect/loginWithPopup. For crypto/onchain wallet login use
+    // authMethod:'phantom' (Solana / Phantom), and use signInAnonymously() for
+    // zero-friction guest accounts. ('wallet' is an unimplemented stub; don't use.)
     authMethod: 'none',
     chain: '',
     rpcUrl: '',
@@ -2806,6 +2802,7 @@ async function genAuthNonce() {
 // from 'phantom' and couldn't be gated or flagged.
 const SIGNATURE_AUTH_METHODS = new Set(['phantom', 'mobile-wallet-adapter', 'guest']);
 async function createSessionWithSignature(address, message, signature) {
+    var _a, _b;
     const client = await getAxiosAuthClient();
     const config = await getConfig();
     const appId = config.appId;
@@ -2815,14 +2812,30 @@ async function createSessionWithSignature(address, message, signature) {
     // for a signature exchange. This is what makes the server SDK + guest device
     // keypair work under the email-default config.
     const authMethod = SIGNATURE_AUTH_METHODS.has(config.authMethod) ? config.authMethod : 'phantom';
-    const response = await client.post('/session', {
-        appId,
-        address,
-        message,
-        signature,
-        authMethod
-    });
-    return response.data;
+    try {
+        const response = await client.post('/session', {
+            appId,
+            address,
+            message,
+            signature,
+            authMethod
+        });
+        return response.data;
+    }
+    catch (err) {
+        // Surface the issuer's actionable message (e.g. "Anonymous auth is not enabled for
+        // this app. Add \"auth\": { \"anonymous\": true } to policy.json and redeploy.")
+        // instead of axios's generic "Request failed with status code 403".
+        const d = (_a = err === null || err === void 0 ? void 0 : err.response) === null || _a === void 0 ? void 0 : _a.data;
+        if (d && (d.message || d.error)) {
+            const e = new Error(String(d.message || d.error));
+            e.code = d.error;
+            e.status = (_b = err === null || err === void 0 ? void 0 : err.response) === null || _b === void 0 ? void 0 : _b.status;
+            e.hint = d.hint;
+            throw e;
+        }
+        throw err;
+    }
 }
 // Deduplicate concurrent refreshSession calls to prevent multiple code paths
 // (WebSocket reconnection, periodic refresh, API 401 retry) from all hitting
@@ -7120,8 +7133,8 @@ async function status(roomPath, opts = {}) {
  * claims); pass `opts.userId` to override. Returns the unsubscribe function
  * (a Promise<() => Promise<void>>, same as `subscribe`).
  *
- * Note: this is a browser-first helper (the WS subscription manager is
- * browser-oriented). Server consumers should use `live.intent`.
+ * Server/agent consumers: use `WalletClient.live.subscribeView` (it supplies
+ * the wallet session + view id); browser apps just call this directly.
  */
 async function subscribeView(roomPath, opts) {
     if (!roomPath || typeof roomPath !== 'string') {
@@ -7151,7 +7164,7 @@ async function subscribeView(roomPath, opts) {
     // derives the room from the `?path=` the connection carries). Without this the
     // subscription lands on the app-level project DO and never sees the room's
     // ephemeral view writes.
-    return subscribeV2(viewPath, { onData: opts.onData, onError: opts.onError }, normalizedRoomPath);
+    return subscribeV2(viewPath, { onData: opts.onData, onError: opts.onError, _overrides: opts._overrides }, normalizedRoomPath);
 }
 /** The `bounded.live` namespace surface. */
 const live = { intent, status, subscribeView };