@bounded-sh/core 0.0.26 → 0.0.35

package/dist/index.mjs

@@ -19,14 +19,10 @@ let clientConfig = {
     humanAuthApiUrl: 'https://auth.bounded.sh',
     functionsUrl: 'https://functions.bounded.sh',
     appId: '',
-    // No hidden auth fallback: browser clients must pass authMethod explicitly
-    // (for example 'email', 'guest', 'phantom', 'privy', or 'privy-expo').
-    // Hosted OAuth/social uses loginWithRedirect/loginWithPopup with authMethod:'email'.
-    // Text OTP is off by default and uses hosted/headless text helpers only when
-    // Bounded explicitly enables it for the issuer. For
-    // crypto/onchain wallet login use authMethod:'phantom' (Solana / Phantom), or
-    // signInAnonymously() for zero-friction 'guest' accounts. ('wallet' is an
-    // unimplemented stub; don't use.)
+    // No hidden modal fallback: browser clients start hosted Bounded Auth with
+    // loginWithRedirect/loginWithPopup. For crypto/onchain wallet login use
+    // authMethod:'phantom' (Solana / Phantom), and use signInAnonymously() for
+    // zero-friction guest accounts. ('wallet' is an unimplemented stub; don't use.)
     authMethod: 'none',
     chain: '',
     rpcUrl: '',
@@ -2806,6 +2802,7 @@ async function genAuthNonce() {
 // from 'phantom' and couldn't be gated or flagged.
 const SIGNATURE_AUTH_METHODS = new Set(['phantom', 'mobile-wallet-adapter', 'guest']);
 async function createSessionWithSignature(address, message, signature) {
+    var _a, _b;
     const client = await getAxiosAuthClient();
     const config = await getConfig();
     const appId = config.appId;
@@ -2815,14 +2812,30 @@ async function createSessionWithSignature(address, message, signature) {
     // for a signature exchange. This is what makes the server SDK + guest device
     // keypair work under the email-default config.
     const authMethod = SIGNATURE_AUTH_METHODS.has(config.authMethod) ? config.authMethod : 'phantom';
-    const response = await client.post('/session', {
-        appId,
-        address,
-        message,
-        signature,
-        authMethod
-    });
-    return response.data;
+    try {
+        const response = await client.post('/session', {
+            appId,
+            address,
+            message,
+            signature,
+            authMethod
+        });
+        return response.data;
+    }
+    catch (err) {
+        // Surface the issuer's actionable message (e.g. "Anonymous auth is not enabled for
+        // this app. Add \"auth\": { \"anonymous\": true } to policy.json and redeploy.")
+        // instead of axios's generic "Request failed with status code 403".
+        const d = (_a = err === null || err === void 0 ? void 0 : err.response) === null || _a === void 0 ? void 0 : _a.data;
+        if (d && (d.message || d.error)) {
+            const e = new Error(String(d.message || d.error));
+            e.code = d.error;
+            e.status = (_b = err === null || err === void 0 ? void 0 : err.response) === null || _b === void 0 ? void 0 : _b.status;
+            e.hint = d.hint;
+            throw e;
+        }
+        throw err;
+    }
 }
 // Deduplicate concurrent refreshSession calls to prevent multiple code paths
 // (WebSocket reconnection, periodic refresh, API 401 retry) from all hitting
@@ -6542,7 +6555,30 @@ async function wsIntent(appId, roomRoutePath, intent, isServer) {
     if (!connection || !connection.ws || connection.ws.readyState !== WS_READY_STATE_OPEN || connection.isAuthenticating) {
         return false;
     }
-    if (!(await canSendAuthenticatedLiveIntent(connection, isServer))) {
+    // Identity-aware send gate. The server attributes intents to the
+    // CONNECTION's authenticated principal, so the only correct reasons to
+    // refuse the socket are identity ones:
+    //   - the socket is anonymous while the user is now authenticated, or
+    //   - the current principal DIFFERS from the socket principal.
+    // A mere token rotation for the SAME principal, or a transiently-null
+    // token mid-refresh, must NOT reroute a 30Hz command stream to
+    // per-command HTTP — that collapses delivery rate and unbounds the game's
+    // ack lag (field-debugged: server 500+ commands behind).
+    const currentToken = await getIdToken(isServer).catch(() => null);
+    if (!currentToken) {
+        // Mid-refresh: the socket principal still governs server-side.
+        if (!connection.authTokenFingerprint && !connection.authPrincipal)
+            return false;
+    }
+    else if (!connection.authTokenFingerprint && !connection.authPrincipal) {
+        // Anonymous socket + authenticated user: do not attribute this user's
+        // input to the anon principal. Reauth the socket; caller may fall back.
+        void maybeReauthRoomConnection(connection);
+        return false;
+    }
+    else if (!connectionMatchesAuthToken(connection, currentToken)) {
+        // Different principal (identity switch): never send as the old user.
+        void maybeReauthRoomConnection(connection);
         return false;
     }
     try {
@@ -6553,6 +6589,26 @@ async function wsIntent(appId, roomRoutePath, intent, isServer) {
         return false;
     }
 }
+// Debounced background reauth: when the client's current token no longer
+// matches the connection's auth fingerprint (token rotation), refresh the
+// socket auth ONCE rather than degrading every subsequent send.
+const reauthInFlight = new WeakSet();
+async function maybeReauthRoomConnection(connection, isServer) {
+    try {
+        if (reauthInFlight.has(connection))
+            return;
+        reauthInFlight.add(connection);
+        try {
+            await reconnectWithNewAuthV2();
+        }
+        finally {
+            reauthInFlight.delete(connection);
+        }
+    }
+    catch (_a) {
+        // Best-effort: the next send retries; the server still enforces auth.
+    }
+}
 /**
  * Send a live-room intent over the EXISTING per-room socket and AWAIT the server
  * ack — so a policy/auth denial (401/403/404/503) REJECTS instead of being
@@ -7120,8 +7176,8 @@ async function status(roomPath, opts = {}) {
  * claims); pass `opts.userId` to override. Returns the unsubscribe function
  * (a Promise<() => Promise<void>>, same as `subscribe`).
  *
- * Note: this is a browser-first helper (the WS subscription manager is
- * browser-oriented). Server consumers should use `live.intent`.
+ * Server/agent consumers: use `WalletClient.live.subscribeView` (it supplies
+ * the wallet session + view id); browser apps just call this directly.
  */
 async function subscribeView(roomPath, opts) {
     if (!roomPath || typeof roomPath !== 'string') {
@@ -7151,7 +7207,7 @@ async function subscribeView(roomPath, opts) {
     // derives the room from the `?path=` the connection carries). Without this the
     // subscription lands on the app-level project DO and never sees the room's
     // ephemeral view writes.
-    return subscribeV2(viewPath, { onData: opts.onData, onError: opts.onError }, normalizedRoomPath);
+    return subscribeV2(viewPath, { onData: opts.onData, onError: opts.onError, _overrides: opts._overrides }, normalizedRoomPath);
 }
 /** The `bounded.live` namespace surface. */
 const live = { intent, status, subscribeView };