@bounded-sh/core 0.0.7 → 0.0.8

package/dist/index.mjs

@@ -20,10 +20,13 @@ let clientConfig = {
     humanAuthApiUrl: 'https://auth.bounded.sh',
     functionsUrl: 'https://functions.bounded.sh',
     appId: '',
-    // 'email' = Bounded Better Auth human login (inline OTP) — the out-of-box default
-    // for most apps. For wallet login use authMethod:'phantom' (Solana / Phantom, the
-    // recommended wallet option), or signInAnonymously() for zero-friction 'guest'
-    // accounts — all coexist. ('wallet' is an unimplemented stub; don't use.)
+    // 'email' = Bounded Auth human login (inline email OTP) — the out-of-box default
+    // for normal apps. Hosted OAuth/social uses loginWithRedirect/loginWithPopup.
+    // Text OTP is off by default and uses hosted/headless text helpers only when
+    // Bounded explicitly enables it for the issuer. For
+    // crypto/onchain wallet login use authMethod:'phantom' (Solana / Phantom), or
+    // signInAnonymously() for zero-friction 'guest' accounts. ('wallet' is an
+    // unimplemented stub; don't use.)
     authMethod: 'email',
     chain: '',
     rpcUrl: '',
@@ -4223,7 +4226,7 @@ async function makeApiRequest(method, urlPath, data, _overrides) {
     }
 }
 
-var __rest = (undefined && undefined.__rest) || function (s, e) {
+var __rest$1 = (undefined && undefined.__rest) || function (s, e) {
     var t = {};
     for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
         t[p] = s[p];
@@ -4698,7 +4701,7 @@ async function search(path, query, opts = {}) {
         normalizedPath = normalizedPath.slice(0, -1);
     }
     if (!normalizedPath || normalizedPath.length === 0) {
-        return new Error("Invalid path provided.");
+        throw new Error("Invalid path provided.");
     }
     if (typeof query !== "string" || query.trim().length === 0) {
         throw new Error("search query must be a non-empty string");
@@ -4725,7 +4728,7 @@ async function get(path, opts = {}) {
             normalizedPath = normalizedPath.slice(0, -1);
         }
         if (!normalizedPath || normalizedPath.length === 0) {
-            return new Error("Invalid path provided.");
+            throw new Error("Invalid path provided.");
         }
         // Create cache key combining path, prompt, filter, sort, includeSubPaths,
         // shape, limit, cursor — and (H1) the caller's appId + principal fingerprint,
@@ -4853,6 +4856,23 @@ function cleanupExpiredCache() {
     });
     lastCacheCleanup = now;
 }
+function classifyGetManyBatchError(error) {
+    var _a, _b, _c;
+    const err = error;
+    const status = (_b = (_a = err === null || err === void 0 ? void 0 : err.status) !== null && _a !== void 0 ? _a : err === null || err === void 0 ? void 0 : err.statusCode) !== null && _b !== void 0 ? _b : (_c = err === null || err === void 0 ? void 0 : err.response) === null || _c === void 0 ? void 0 : _c.status;
+    const message = error instanceof Error
+        ? error.message
+        : typeof (err === null || err === void 0 ? void 0 : err.message) === 'string'
+            ? err.message
+            : 'Unknown error';
+    if (status === 401 || status === 403) {
+        return { code: 'UNAUTHORIZED', message };
+    }
+    if (status === 400) {
+        return { code: 'INVALID_PATH', message };
+    }
+    return { code: 'REQUEST_FAILED', message };
+}
 async function getMany(paths, opts = {}) {
     var _a, _b, _c, _d, _e;
     if (paths.length === 0) {
@@ -4897,6 +4917,11 @@ async function getMany(paths, opts = {}) {
     if (uncachedPaths.length > 0) {
         try {
             const response = await makeApiRequest('POST', 'items/batch', { paths: uncachedPaths }, opts._overrides);
+            if (response.status === 404 && response.data == null) {
+                const endpointError = new Error('Batch read endpoint returned 404');
+                endpointError.status = 404;
+                throw endpointError;
+            }
             // makeApiRequest returns `{ data: <httpBody> }`, and the worker's items/batch
             // httpBody is `{ data: { results: [...] }, status }` — so the results are
             // double-nested at response.data.data.results. (Reading response.data.results
@@ -4939,11 +4964,12 @@ async function getMany(paths, opts = {}) {
             }
         }
         catch (error) {
+            const batchError = classifyGetManyBatchError(error);
             for (const originalIndex of uncachedIndices) {
                 results[originalIndex] = {
                     path: normalizedPaths[originalIndex],
                     data: null,
-                    error: { code: 'NOT_FOUND', message: error instanceof Error ? error.message : 'Unknown error' }
+                    error: batchError,
                 };
             }
         }
@@ -5105,26 +5131,23 @@ async function setMany(many, options) {
                 return Object.assign(Object.assign({}, documents.map(d => d.document)), { transactionId: transactionResult.signature, signedTransaction: transactionResult.signedTransaction });
             }
             // Handle Solana on-chain transaction flow
-            let lastTxSignature = undefined;
-            let signedTransaction = undefined;
-            for (let i = 0; i < transactions.length; i++) {
-                const curTx = transactions[i];
-                let transactionResult;
-                if (curTx.serializedTransaction) {
-                    transactionResult = await handlePreBuiltTransaction(curTx, authProvider, options);
-                }
-                else {
-                    transactionResult = await handleSolanaTransaction(curTx, authProvider, options);
-                }
-                lastTxSignature = transactionResult.transactionSignature;
-                signedTransaction = transactionResult.signedTransaction;
+            if (!Array.isArray(transactions) || transactions.length !== 1) {
+                throw new Error(`Expected exactly one on-chain transaction, received ${Array.isArray(transactions) ? transactions.length : 0}`);
+            }
+            const curTx = transactions[0];
+            let transactionResult;
+            if (curTx.serializedTransaction) {
+                transactionResult = await handlePreBuiltTransaction(curTx, authProvider, options);
+            }
+            else {
+                transactionResult = await handleSolanaTransaction(curTx, authProvider, options);
             }
             // Sync items after all transactions are confirmed
             // Wait for 1.5 seconds to ensure all transactions are confirmed
             await new Promise(resolve => setTimeout(resolve, 1500));
             await syncItems(many.map(m => m.path), options);
             // TODO: Should we wait here or do the optimistic subscription updates like below?
-            return Object.assign(Object.assign({}, documents.map(d => d.document)), { transactionId: lastTxSignature, signedTransaction: signedTransaction });
+            return Object.assign(Object.assign({}, documents.map(d => d.document)), { transactionId: transactionResult.transactionSignature, signedTransaction: transactionResult.signedTransaction });
         }
         else if (setResponse.status === 200) {
             // This means that the document was set successfully.
@@ -5137,7 +5160,7 @@ async function setMany(many, options) {
             else if (setResponse.data &&
                 typeof setResponse.data === 'object' &&
                 setResponse.data.success === true) {
-                const _k = setResponse.data, { success: _success } = _k, rest = __rest(_k, ["success"]);
+                const _k = setResponse.data, { success: _success } = _k, rest = __rest$1(_k, ["success"]);
                 return Object.assign(Object.assign(Object.assign({}, documents.map(d => d.document)), rest), { transactionId: null });
             }
             else {
@@ -5373,7 +5396,7 @@ async function getFiles(path, options) {
     try {
         const normalizedPath = path.startsWith("/") ? path.slice(1) : path;
         if (!normalizedPath || normalizedPath.length === 0) {
-            return new Error("Invalid path provided.");
+            throw new Error("Invalid path provided.");
         }
         const apiPath = `storage?path=${normalizedPath}`;
         const response = await makeApiRequest('GET', apiPath, null, options === null || options === void 0 ? void 0 : options._overrides);
@@ -5793,6 +5816,12 @@ function roomKeyFromRoutePath(routePath) {
         return null;
     return `${segs[0]}/${segs[1]}`;
 }
+function replaySubscriptions(connection) {
+    for (const sub of connection.subscriptions.values()) {
+        sub.lastData = undefined;
+        sendSubscribe(connection, sub);
+    }
+}
 async function getOrCreateConnection(appId, isServer, routePath, authTokenProvider, principalKey) {
     attachBrowserReconnectHooksOnce();
     // A per-room subscription gets its OWN connection routed to the room DO; all
@@ -5818,10 +5847,12 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
         pendingRequests: new Map(),
         isConnecting: false,
         isConnected: false,
+        isAuthenticating: false,
         appId,
         key: connKey,
         routePath: roomKey ? routePath : undefined,
         authTokenProvider,
+        pendingAuthToken: null,
         tokenRefreshTimer: null,
         consecutiveAuthFailures: 0,
     };
@@ -5846,16 +5877,17 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
         // Per-room connection: carry the room path so the worker routes this WS
         // to the room DO (appId#room#roomId) where the live view fan-out lives.
         if (connection.routePath) {
-            wsUrl.searchParams.append('path', connection.routePath);
+            wsUrl.searchParams.append('routePath', connection.routePath);
         }
-        // Add auth token if available. A wallet-scoped connection resolves its
-        // token from the wallet's own session (self-refreshing); all others use
-        // the ambient env/web session.
+        // Resolve auth token if available. A wallet-scoped connection resolves
+        // its token from the wallet's own session (self-refreshing); all others
+        // use the ambient env/web session. The token is sent as the first WS
+        // frame after open, never as a URL query parameter.
         const authToken = connection.authTokenProvider
             ? await connection.authTokenProvider().catch(() => null)
             : await getFreshAuthToken(isServer);
+        connection.pendingAuthToken = authToken || null;
         if (authToken) {
-            wsUrl.searchParams.append('authorization', authToken);
             // Successful token acquisition — reset failure counter
             connection.consecutiveAuthFailures = 0;
         }
@@ -5881,6 +5913,7 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
     connection.ws = ws;
     // Handle connection open
     ws.addEventListener('open', () => {
+        var _a, _b;
         connection.isConnecting = false;
         connection.isConnected = true;
         // NOTE: Do NOT reset consecutiveAuthFailures here. It is reset when a
@@ -5895,10 +5928,26 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
         // urlProvider skips straight to unauthenticated connection.
         // Schedule periodic token freshness checks
         scheduleTokenRefresh(connection, isServer);
-        // Re-subscribe to all existing subscriptions after reconnect
-        for (const sub of connection.subscriptions.values()) {
-            sub.lastData = undefined;
-            sendSubscribe(connection, sub);
+        if (connection.pendingAuthToken) {
+            connection.isAuthenticating = true;
+            try {
+                (_a = connection.ws) === null || _a === void 0 ? void 0 : _a.send(JSON.stringify({ type: 'auth', token: connection.pendingAuthToken }));
+            }
+            catch (error) {
+                connection.isAuthenticating = false;
+                connection.isConnected = false;
+                console.error('[WS v2] Error sending auth message:', error);
+                try {
+                    (_b = connection.ws) === null || _b === void 0 ? void 0 : _b.close(1008, 'Authentication send failed');
+                }
+                catch (_c) {
+                    // Already closed.
+                }
+            }
+        }
+        else {
+            connection.isAuthenticating = false;
+            replaySubscriptions(connection);
         }
     });
     // Handle incoming messages
@@ -5922,6 +5971,7 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
     // Handle close
     ws.addEventListener('close', () => {
         connection.isConnected = false;
+        connection.isAuthenticating = false;
         if (connection.tokenRefreshTimer) {
             clearInterval(connection.tokenRefreshTimer);
             connection.tokenRefreshTimer = null;
@@ -5938,6 +5988,11 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
 function handleServerMessage(connection, message) {
     var _a, _b;
     switch (message.type) {
+        case 'authenticated': {
+            connection.isAuthenticating = false;
+            replaySubscriptions(connection);
+            break;
+        }
         case 'subscribed': {
             const subscription = connection.subscriptions.get(message.subscriptionId);
             if (subscription) {
@@ -6238,7 +6293,7 @@ async function subscribeV2(path, subscriptionOptions, roomRoutePath) {
     };
     connection.subscriptions.set(subscriptionId, subscription);
     // Send subscribe message if connected
-    if (connection.isConnected) {
+    if (connection.isConnected && !connection.isAuthenticating) {
         // Create a promise to wait for subscription confirmation
         const subscriptionPromise = new Promise((resolve, reject) => {
             connection.pendingSubscriptions.set(subscriptionId, { resolve, reject });
@@ -6276,7 +6331,7 @@ async function removeCallbackFromSubscription(connection, subscriptionId, callba
     }
     // No more callbacks, unsubscribe from server
     connection.subscriptions.delete(subscriptionId);
-    if (connection.isConnected) {
+    if (connection.isConnected && !connection.isAuthenticating) {
         // Create a promise to wait for unsubscription confirmation
         const unsubscribePromise = new Promise((resolve, reject) => {
             connection.pendingUnsubscriptions.set(subscriptionId, { resolve, reject });
@@ -6452,12 +6507,59 @@ function generateRequestId() {
  */
 function hasActiveConnection() {
     for (const connection of connections.values()) {
-        if (connection.ws && connection.isConnected) {
+        if (connection.ws && connection.isConnected && !connection.isAuthenticating) {
             return true;
         }
     }
     return false;
 }
+async function waitForConnectionAuthenticated(connection) {
+    if (!connection.isAuthenticating || !connection.ws)
+        return;
+    const ws = connection.ws;
+    await new Promise((resolve, reject) => {
+        let timeout;
+        let cleanup = () => { };
+        const onMessage = (event) => {
+            try {
+                const message = JSON.parse(event.data);
+                if ((message === null || message === void 0 ? void 0 : message.type) === 'authenticated') {
+                    cleanup();
+                    resolve();
+                }
+            }
+            catch (_a) {
+                // Other frames are handled by the main listener.
+            }
+        };
+        const onClose = () => {
+            cleanup();
+            reject(new Error('WebSocket disconnected during authentication'));
+        };
+        const onError = () => {
+            cleanup();
+            reject(new Error('WebSocket authentication failed'));
+        };
+        cleanup = () => {
+            clearTimeout(timeout);
+            ws.removeEventListener('message', onMessage);
+            ws.removeEventListener('close', onClose);
+            ws.removeEventListener('error', onError);
+        };
+        timeout = setTimeout(() => {
+            cleanup();
+            reject(new Error('WebSocket authentication timeout'));
+        }, 10000);
+        if (!connection.isAuthenticating) {
+            cleanup();
+            resolve();
+            return;
+        }
+        ws.addEventListener('message', onMessage);
+        ws.addEventListener('close', onClose);
+        ws.addEventListener('error', onError);
+    });
+}
 async function sendRequest(msgBuilder) {
     const config = await getConfig();
     const appId = config.appId;
@@ -6483,6 +6585,7 @@ async function sendRequest(msgBuilder) {
     if (!connection.ws || !connection.isConnected) {
         throw new Error('WebSocket connection not available');
     }
+    await waitForConnectionAuthenticated(connection);
     const requestId = generateRequestId();
     const message = msgBuilder(requestId);
     return new Promise((resolve, reject) => {
@@ -6519,7 +6622,7 @@ function wsIntent(appId, roomRoutePath, intent) {
     const roomKey = roomKeyFromRoutePath(roomRoutePath);
     const connKey = roomKey ? `${appId}#room#${roomKey}` : appId;
     const connection = connections.get(connKey);
-    if (!connection || !connection.ws || connection.ws.readyState !== WS_READY_STATE_OPEN) {
+    if (!connection || !connection.ws || connection.ws.readyState !== WS_READY_STATE_OPEN || connection.isAuthenticating) {
         return false;
     }
     try {
@@ -6542,7 +6645,7 @@ function wsIntentReliable(appId, roomRoutePath, intent) {
     const roomKey = roomKeyFromRoutePath(roomRoutePath);
     const connKey = roomKey ? `${appId}#room#${roomKey}` : appId;
     const connection = connections.get(connKey);
-    if (!connection || !connection.ws || connection.ws.readyState !== WS_READY_STATE_OPEN) {
+    if (!connection || !connection.ws || connection.ws.readyState !== WS_READY_STATE_OPEN || connection.isAuthenticating) {
         return undefined;
     }
     const requestId = generateRequestId();
@@ -6869,6 +6972,7 @@ class RealtimeStore {
         this.idbDirtyKeys = new Set();
         this.closed = false;
         this.authToken = null;
+        this.authenticating = false;
         this.isServer = false;
         this.tokenRefreshTimer = null;
         // -----------------------------------------------------------------------
@@ -6916,7 +7020,7 @@ class RealtimeStore {
                 this.initPromise = this.init();
             await this.initPromise;
         }
-        if (((_a = this.ws) === null || _a === void 0 ? void 0 : _a.readyState) === WebSocket.OPEN)
+        if (((_a = this.ws) === null || _a === void 0 ? void 0 : _a.readyState) === WebSocket.OPEN && !this.authenticating)
             return;
         if (this.connectPromise)
             return this.connectPromise;
@@ -6931,21 +7035,52 @@ class RealtimeStore {
             }
             const params = new URLSearchParams();
             params.set('apiKey', this.appId);
-            if (this.authToken)
-                params.set('authorization', this.authToken);
-            // Note: token in URL is required until DO server supports subprotocol auth.
-            // WSS encrypts the full URL including query params on the wire.
             const url = `${this.wsUrl}?${params.toString()}`;
             const ws = new WebSocket(url);
             this.ws = ws;
-            const onOpen = () => {
+            let authTimer = null;
+            const finishConnected = () => {
+                if (authTimer) {
+                    clearTimeout(authTimer);
+                    authTimer = null;
+                }
+                this.authenticating = false;
                 ws.removeEventListener('error', onError);
                 this.reconnectDelay = 1000;
                 this.connectPromise = null;
                 this.resubscribeAll();
                 resolve();
             };
+            const onOpen = () => {
+                if (!this.authToken) {
+                    finishConnected();
+                    return;
+                }
+                this.authenticating = true;
+                authTimer = setTimeout(() => {
+                    this.authenticating = false;
+                    this.connectPromise = null;
+                    try {
+                        ws.close(1008, 'Authentication timeout');
+                    }
+                    catch ( /* ignore */_a) { /* ignore */ }
+                    reject(new Error('WebSocket authentication timeout'));
+                }, 10000);
+                try {
+                    ws.send(JSON.stringify({ type: 'auth', token: this.authToken }));
+                }
+                catch (e) {
+                    if (authTimer)
+                        clearTimeout(authTimer);
+                    this.authenticating = false;
+                    this.connectPromise = null;
+                    reject(e);
+                }
+            };
             const onError = (e) => {
+                if (authTimer)
+                    clearTimeout(authTimer);
+                this.authenticating = false;
                 ws.removeEventListener('open', onOpen);
                 this.connectPromise = null;
                 reject(new Error('WebSocket connection failed'));
@@ -6953,9 +7088,22 @@ class RealtimeStore {
             ws.addEventListener('open', onOpen, { once: true });
             ws.addEventListener('error', onError, { once: true });
             ws.addEventListener('message', (event) => {
+                if (this.authenticating) {
+                    try {
+                        const msg = JSON.parse(typeof event.data === 'string' ? event.data : new TextDecoder().decode(event.data));
+                        if ((msg === null || msg === void 0 ? void 0 : msg.type) === 'authenticated') {
+                            finishConnected();
+                            return;
+                        }
+                    }
+                    catch ( /* fall through to normal handling */_a) { /* fall through to normal handling */ }
+                }
                 this.handleMessage(event.data);
             });
             ws.addEventListener('close', () => {
+                if (authTimer)
+                    clearTimeout(authTimer);
+                this.authenticating = false;
                 this.ws = null;
                 this.connectPromise = null;
                 this.rejectAllPending('WebSocket closed');
@@ -7008,6 +7156,8 @@ class RealtimeStore {
                 break;
             case 'pong':
                 break;
+            case 'authenticated':
+                break;
             // v1 compat: handle legacy message types during transition
             case 'subscribed':
                 this.handleSnapshot(Object.assign(Object.assign({}, msg), { type: 'snapshot', docs: msg.data }));
@@ -7609,6 +7759,17 @@ function resetRealtimeStore() {
 // rule, and dispatches to the function — returning its JSON, or throwing on
 // 403 / error.
 // ---------------------------------------------------------------------------
+var __rest = (undefined && undefined.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
 /** Prod functions dispatcher; overridable via init({ functionsUrl }) or network preset. */
 const DEFAULT_FUNCTIONS_URL = 'https://functions.bounded.sh';
 class FunctionInvokeError extends Error {
@@ -7619,6 +7780,12 @@ class FunctionInvokeError extends Error {
         this.name = 'FunctionInvokeError';
     }
 }
+function stripAuthHeaders(headers) {
+    if (!headers)
+        return undefined;
+    const { Authorization, authorization } = headers, rest = __rest(headers, ["Authorization", "authorization"]);
+    return Object.keys(rest).length > 0 ? rest : undefined;
+}
 /**
  * Invoke a deployed Bounded Function by name. Returns the function's JSON.
  *
@@ -7641,7 +7808,7 @@ async function invoke(name, args = {}, opts = {}) {
     const authHeader = ((_a = opts._overrides) === null || _a === void 0 ? void 0 : _a._getAuthHeaders)
         ? await opts._overrides._getAuthHeaders()
         : await createAuthHeader(config.isServer);
-    const headers = Object.assign(Object.assign({ 'Content-Type': 'application/json', 'X-App-Id': config.appId, 'X-Public-App-Id': config.appId }, (authHeader !== null && authHeader !== void 0 ? authHeader : {})), ((_b = opts.headers) !== null && _b !== void 0 ? _b : {}));
+    const headers = Object.assign(Object.assign({ 'Content-Type': 'application/json', 'X-App-Id': config.appId, 'X-Public-App-Id': config.appId }, ((_b = stripAuthHeaders(opts.headers)) !== null && _b !== void 0 ? _b : {})), (authHeader !== null && authHeader !== void 0 ? authHeader : {}));
     const controller = new AbortController();
     const timeoutMs = (_c = opts.timeoutMs) !== null && _c !== void 0 ? _c : 60000;
     const timer = setTimeout(() => controller.abort(), timeoutMs);