@bounded-sh/core 0.0.26 → 0.0.35

package/dist/client/config.d.ts

@@ -3,12 +3,11 @@ export interface ClientConfig {
     name: string;
     logoUrl: string;
     /** Auth method. Configure exactly one method at init time.
-     *  'email' = Bounded Auth human login (email OTP, inline).
-     *  OAuth/social uses loginWithRedirect/
-     *  loginWithPopup rather than authMethod. Text OTP uses hosted/headless OTP
-     *  helpers only when explicitly enabled by the Bounded issuer. 'phantom' = connect a Solana wallet (Phantom), for
-     *  crypto/onchain apps that need a real @user.address. 'guest' = anonymous
-     *  device-key auth. */
+     *  Bounded Auth is the default restore/logout surface; start email, social,
+     *  and optional text login with loginWithRedirect/loginWithPopup.
+     *  'phantom' = connect a Solana wallet (Phantom), for crypto/onchain apps
+     *  that need a real @user.address. Guests use signInAnonymously(), not
+     *  authMethod. */
     authMethod: 'none' | 'email' | 'guest' | 'wallet' | 'rainbowkit' | 'coinbase-smart-wallet' | 'onboard' | 'phantom' | 'mobile-wallet-adapter' | 'privy' | 'privy-expo';
     wsApiUrl: string;
     apiUrl: string;
@@ -21,10 +20,9 @@ export interface ClientConfig {
     appId: string;
     /** Wallet/SIWS issuer (wallet + guest providers sign challenges against this). */
     authApiUrl: string;
-    /** Human-login issuer (Bounded Better Auth — email OTP + OAuth, plus optional text OTP). The
-     *  inline 'email' provider calls {humanAuthApiUrl}/email + /verify; hosted
-     *  login and headless helpers can also use text OTP when the issuer enables it.
-     *  Defaults per network. */
+    /** Human-login issuer for hosted Bounded Auth: email OTP, OAuth/social, and
+     *  optional text OTP. App-origin OTP helpers are retired; use hosted
+     *  loginWithRedirect/loginWithPopup against this issuer. Defaults per network. */
     humanAuthApiUrl?: string;
     /**
      * Selects a Bounded backend preset. When set, the endpoint defaults

package/dist/client/live.d.ts

@@ -1,4 +1,5 @@
 import type { RequestOverrides } from './operations';
+import type { SubscriptionOptions } from '../types';
 export type LiveIntentOptions = {
     /** Per-call timeout (ms) for the HTTP request to the realtime worker. */
     timeoutMs?: number;
@@ -79,6 +80,14 @@ export type SubscribeViewOptions = {
     onData: (view: any) => void;
     /** Called on subscription error. */
     onError?: (error: any) => void;
+    /**
+     * @internal Per-subscription auth overrides (server `WalletClient` path).
+     * Lets a keypair-backed agent player subscribe to its live view under its
+     * own wallet session instead of any global session — the same override seam
+     * `subscribe()` already honors. Without this, a Node agent could send
+     * intents but never SEE its view (the documented agent-as-player pattern).
+     */
+    _overrides?: SubscriptionOptions['_overrides'];
 };
 /**
  * Subscribe to YOUR per-player view of a room. Thin sugar over:
@@ -89,8 +98,8 @@ export type SubscribeViewOptions = {
  * claims); pass `opts.userId` to override. Returns the unsubscribe function
  * (a Promise<() => Promise<void>>, same as `subscribe`).
  *
- * Note: this is a browser-first helper (the WS subscription manager is
- * browser-oriented). Server consumers should use `live.intent`.
+ * Server/agent consumers: use `WalletClient.live.subscribeView` (it supplies
+ * the wallet session + view id); browser apps just call this directly.
  */
 export declare function subscribeView(roomPath: string, opts: SubscribeViewOptions): Promise<() => Promise<void>>;
 /** The `bounded.live` namespace surface. */

package/dist/client/subscription-v2.d.ts

@@ -61,6 +61,8 @@ export declare function hasActiveConnection(): boolean;
  * client never names a destination.
  */
 export declare function wsIntent(appId: string, roomRoutePath: string, intent: unknown, isServer: boolean): Promise<boolean>;
+/** True when an OPEN room socket exists for this room path. */
+export declare function hasOpenRoomConnection(appId: string, roomRoutePath: string): boolean;
 /**
  * Send a live-room intent over the EXISTING per-room socket and AWAIT the server
  * ack — so a policy/auth denial (401/403/404/503) REJECTS instead of being

package/dist/index.js

@@ -39,14 +39,10 @@ let clientConfig = {
     humanAuthApiUrl: 'https://auth.bounded.sh',
     functionsUrl: 'https://functions.bounded.sh',
     appId: '',
-    // No hidden auth fallback: browser clients must pass authMethod explicitly
-    // (for example 'email', 'guest', 'phantom', 'privy', or 'privy-expo').
-    // Hosted OAuth/social uses loginWithRedirect/loginWithPopup with authMethod:'email'.
-    // Text OTP is off by default and uses hosted/headless text helpers only when
-    // Bounded explicitly enables it for the issuer. For
-    // crypto/onchain wallet login use authMethod:'phantom' (Solana / Phantom), or
-    // signInAnonymously() for zero-friction 'guest' accounts. ('wallet' is an
-    // unimplemented stub; don't use.)
+    // No hidden modal fallback: browser clients start hosted Bounded Auth with
+    // loginWithRedirect/loginWithPopup. For crypto/onchain wallet login use
+    // authMethod:'phantom' (Solana / Phantom), and use signInAnonymously() for
+    // zero-friction guest accounts. ('wallet' is an unimplemented stub; don't use.)
     authMethod: 'none',
     chain: '',
     rpcUrl: '',
@@ -2826,6 +2822,7 @@ async function genAuthNonce() {
 // from 'phantom' and couldn't be gated or flagged.
 const SIGNATURE_AUTH_METHODS = new Set(['phantom', 'mobile-wallet-adapter', 'guest']);
 async function createSessionWithSignature(address, message, signature) {
+    var _a, _b;
     const client = await getAxiosAuthClient();
     const config = await getConfig();
     const appId = config.appId;
@@ -2835,14 +2832,30 @@ async function createSessionWithSignature(address, message, signature) {
     // for a signature exchange. This is what makes the server SDK + guest device
     // keypair work under the email-default config.
     const authMethod = SIGNATURE_AUTH_METHODS.has(config.authMethod) ? config.authMethod : 'phantom';
-    const response = await client.post('/session', {
-        appId,
-        address,
-        message,
-        signature,
-        authMethod
-    });
-    return response.data;
+    try {
+        const response = await client.post('/session', {
+            appId,
+            address,
+            message,
+            signature,
+            authMethod
+        });
+        return response.data;
+    }
+    catch (err) {
+        // Surface the issuer's actionable message (e.g. "Anonymous auth is not enabled for
+        // this app. Add \"auth\": { \"anonymous\": true } to policy.json and redeploy.")
+        // instead of axios's generic "Request failed with status code 403".
+        const d = (_a = err === null || err === void 0 ? void 0 : err.response) === null || _a === void 0 ? void 0 : _a.data;
+        if (d && (d.message || d.error)) {
+            const e = new Error(String(d.message || d.error));
+            e.code = d.error;
+            e.status = (_b = err === null || err === void 0 ? void 0 : err.response) === null || _b === void 0 ? void 0 : _b.status;
+            e.hint = d.hint;
+            throw e;
+        }
+        throw err;
+    }
 }
 // Deduplicate concurrent refreshSession calls to prevent multiple code paths
 // (WebSocket reconnection, periodic refresh, API 401 retry) from all hitting
@@ -6562,7 +6575,30 @@ async function wsIntent(appId, roomRoutePath, intent, isServer) {
     if (!connection || !connection.ws || connection.ws.readyState !== WS_READY_STATE_OPEN || connection.isAuthenticating) {
         return false;
     }
-    if (!(await canSendAuthenticatedLiveIntent(connection, isServer))) {
+    // Identity-aware send gate. The server attributes intents to the
+    // CONNECTION's authenticated principal, so the only correct reasons to
+    // refuse the socket are identity ones:
+    //   - the socket is anonymous while the user is now authenticated, or
+    //   - the current principal DIFFERS from the socket principal.
+    // A mere token rotation for the SAME principal, or a transiently-null
+    // token mid-refresh, must NOT reroute a 30Hz command stream to
+    // per-command HTTP — that collapses delivery rate and unbounds the game's
+    // ack lag (field-debugged: server 500+ commands behind).
+    const currentToken = await getIdToken(isServer).catch(() => null);
+    if (!currentToken) {
+        // Mid-refresh: the socket principal still governs server-side.
+        if (!connection.authTokenFingerprint && !connection.authPrincipal)
+            return false;
+    }
+    else if (!connection.authTokenFingerprint && !connection.authPrincipal) {
+        // Anonymous socket + authenticated user: do not attribute this user's
+        // input to the anon principal. Reauth the socket; caller may fall back.
+        void maybeReauthRoomConnection(connection);
+        return false;
+    }
+    else if (!connectionMatchesAuthToken(connection, currentToken)) {
+        // Different principal (identity switch): never send as the old user.
+        void maybeReauthRoomConnection(connection);
         return false;
     }
     try {
@@ -6573,6 +6609,26 @@ async function wsIntent(appId, roomRoutePath, intent, isServer) {
         return false;
     }
 }
+// Debounced background reauth: when the client's current token no longer
+// matches the connection's auth fingerprint (token rotation), refresh the
+// socket auth ONCE rather than degrading every subsequent send.
+const reauthInFlight = new WeakSet();
+async function maybeReauthRoomConnection(connection, isServer) {
+    try {
+        if (reauthInFlight.has(connection))
+            return;
+        reauthInFlight.add(connection);
+        try {
+            await reconnectWithNewAuthV2();
+        }
+        finally {
+            reauthInFlight.delete(connection);
+        }
+    }
+    catch (_a) {
+        // Best-effort: the next send retries; the server still enforces auth.
+    }
+}
 /**
  * Send a live-room intent over the EXISTING per-room socket and AWAIT the server
  * ack — so a policy/auth denial (401/403/404/503) REJECTS instead of being
@@ -7140,8 +7196,8 @@ async function status(roomPath, opts = {}) {
  * claims); pass `opts.userId` to override. Returns the unsubscribe function
  * (a Promise<() => Promise<void>>, same as `subscribe`).
  *
- * Note: this is a browser-first helper (the WS subscription manager is
- * browser-oriented). Server consumers should use `live.intent`.
+ * Server/agent consumers: use `WalletClient.live.subscribeView` (it supplies
+ * the wallet session + view id); browser apps just call this directly.
  */
 async function subscribeView(roomPath, opts) {
     if (!roomPath || typeof roomPath !== 'string') {
@@ -7171,7 +7227,7 @@ async function subscribeView(roomPath, opts) {
     // derives the room from the `?path=` the connection carries). Without this the
     // subscription lands on the app-level project DO and never sees the room's
     // ephemeral view writes.
-    return subscribeV2(viewPath, { onData: opts.onData, onError: opts.onError }, normalizedRoomPath);
+    return subscribeV2(viewPath, { onData: opts.onData, onError: opts.onError, _overrides: opts._overrides }, normalizedRoomPath);
 }
 /** The `bounded.live` namespace surface. */
 const live = { intent, status, subscribeView };