@palbase/web 1.10.0 → 2.0.0

package/README.md

@@ -34,8 +34,9 @@ wires `import './palbe.gen';` into your app entry, and adds a `predev`/`prebuild
 hook that keeps the types in sync. **Commit `palbe.gen.ts`** — it's the typed
 client your app imports, not a build artifact.
 
-The generated file calls `__configure(...)` with your project's URL and anon API
-key at module load, so importing it once at startup is all the setup there is.
+The generated file calls `__configure(...)` with your project's URL, app ID, and
+anon API key at module load, so importing it once at startup is all the setup
+there is.
 If you forget to import it, every `pb` call throws a guided `BackendError`
 (`kind: 'notConfigured'`).
 

package/dist/{analytics-facade-CHh5EGC2.d.ts → analytics-facade-DMtGDGfd.d.ts}

@@ -620,18 +620,10 @@ interface PalbeOAuthConfig {
 interface PalbeConfig {
     url: string;
     apiKey: string;
+    /** Registered app identity persisted by `palbase web link`. */
+    appId: string;
     /** Informational — url+apiKey are already branch-specific (endpointRef embeds the branch slug); gen bakes all three consistently. */
     branch?: string;
-    /**
-     * F2 app-registration: the registered app `identifier` from
-     * `palbase-config.json` — for web this is the declared ORIGIN (e.g.
-     * `https://app.example.com`). When non-empty, `configure` REFUSES to build the
-     * runtime if `window.location.origin` does not match (SDK-REFUSES), and the
-     * value rides on `X-Palbase-Bundle` on EVERY request so the Kong gate can match
-     * it (the IDENTICAL header + value the iOS SDK sends). Empty/absent → legacy /
-     * tooling: no guard, no header.
-     */
-    identifier?: string;
     oauth?: PalbeOAuthConfig;
     /** Refresh-token persistence. Default: endpoint-scoped localStorage in browsers, memory elsewhere. */
     storage?: SessionStorageAdapter;
@@ -1690,14 +1682,6 @@ declare class PalbeRealtime {
 
 interface PalbeRuntime {
     config: PalbeConfig;
-    /**
-     * F2 app-registration: the registered app `identifier` (web ORIGIN) stashed at
-     * configure. Rides on `X-Palbase-Bundle` on EVERY request (request.ts) so the
-     * Kong gate can match it. Empty string when the binding is unconfigured/tooling
-     * (no header is sent). Origin-match is enforced in `buildRuntime` BEFORE this
-     * runtime is returned — a mismatch throws there and no runtime is built.
-     */
-    appIdentifier: string;
     http: HttpClient$1;
     tokenManager: TokenManager$1;
     authClient: AuthClient;

package/dist/{analytics-facade-B7vujhPJ.d.cts → analytics-facade-ovP0pF2P.d.cts}

@@ -620,18 +620,10 @@ interface PalbeOAuthConfig {
 interface PalbeConfig {
     url: string;
     apiKey: string;
+    /** Registered app identity persisted by `palbase web link`. */
+    appId: string;
     /** Informational — url+apiKey are already branch-specific (endpointRef embeds the branch slug); gen bakes all three consistently. */
     branch?: string;
-    /**
-     * F2 app-registration: the registered app `identifier` from
-     * `palbase-config.json` — for web this is the declared ORIGIN (e.g.
-     * `https://app.example.com`). When non-empty, `configure` REFUSES to build the
-     * runtime if `window.location.origin` does not match (SDK-REFUSES), and the
-     * value rides on `X-Palbase-Bundle` on EVERY request so the Kong gate can match
-     * it (the IDENTICAL header + value the iOS SDK sends). Empty/absent → legacy /
-     * tooling: no guard, no header.
-     */
-    identifier?: string;
     oauth?: PalbeOAuthConfig;
     /** Refresh-token persistence. Default: endpoint-scoped localStorage in browsers, memory elsewhere. */
     storage?: SessionStorageAdapter;
@@ -1690,14 +1682,6 @@ declare class PalbeRealtime {
 
 interface PalbeRuntime {
     config: PalbeConfig;
-    /**
-     * F2 app-registration: the registered app `identifier` (web ORIGIN) stashed at
-     * configure. Rides on `X-Palbase-Bundle` on EVERY request (request.ts) so the
-     * Kong gate can match it. Empty string when the binding is unconfigured/tooling
-     * (no header is sent). Origin-match is enforced in `buildRuntime` BEFORE this
-     * runtime is returned — a mismatch throws there and no runtime is built.
-     */
-    appIdentifier: string;
     http: HttpClient$1;
     tokenManager: TokenManager$1;
     authClient: AuthClient;

package/dist/{chunk-4ZJHHXD3.js → chunk-V6VTX65P.js}

@@ -420,12 +420,6 @@ async function palbeRequest(rt, method, path, spec = {}) {
   if (MUTATING.has(method) && !callerHasKey) {
     headers["Idempotency-Key"] = crypto.randomUUID();
   }
-  if (rt.appIdentifier !== "") {
-    const callerHasBundle = Object.keys(headers).some(
-      (k) => k.toLowerCase() === "x-palbase-bundle"
-    );
-    if (!callerHasBundle) headers["X-Palbase-Bundle"] = rt.appIdentifier;
-  }
   const attempt = async () => {
     try {
       return await rt.http.request(method, path, {
@@ -1409,23 +1403,6 @@ var PalbeAnalytics = class {
   }
 };
 
-// src/app-config.ts
-function loadAppConfig(raw) {
-  if (typeof raw !== "object" || raw === null) {
-    throw new Error("app_config_invalid: expected a JSON object");
-  }
-  const r = raw;
-  const str = (k) => typeof r[k] === "string" ? r[k] : "";
-  return { appId: str("app_id"), identifier: str("identifier"), envPreset: str("env_preset") };
-}
-function assertOriginMatches(cfg, runtimeOrigin) {
-  if (cfg.identifier === "") return;
-  if (runtimeOrigin === "") return;
-  if (runtimeOrigin !== cfg.identifier) {
-    throw new Error(`app_config_mismatch: expected origin ${cfg.identifier}, got ${runtimeOrigin}`);
-  }
-}
-
 // src/auth-wire.ts
 function asWireAuthResult(raw) {
   if (typeof raw !== "object" || raw === null) return null;
@@ -8239,6 +8216,14 @@ function observeWebVitals(record) {
   };
 }
 
+// src/runtime-metadata.ts
+var APP_METADATA_HEADER = "X-Palbase-Bundle";
+function applyBrowserOriginHeader(headers) {
+  if (Object.keys(headers).some((key) => key.toLowerCase() === "x-palbase-bundle")) return;
+  const origin = typeof window !== "undefined" && typeof window.location !== "undefined" ? window.location.origin : "";
+  if (origin !== "") headers[APP_METADATA_HEADER] = origin;
+}
+
 // src/realtime/anon-token.ts
 var REFRESH_SKEW_MS = 6e4;
 var AnonTokenProvider = class {
@@ -8281,11 +8266,16 @@ var AnonTokenProvider = class {
    */
   async mint() {
     const base = this.rt.config.url.replace(/\/+$/, "");
+    const headers = {
+      apikey: this.rt.config.apiKey,
+      ...this.rt.config.headers
+    };
+    applyBrowserOriginHeader(headers);
     let response;
     try {
       response = await fetch(`${base}/auth/anonymous`, {
         method: "POST",
-        headers: { apikey: this.rt.config.apiKey }
+        headers
       });
     } catch (e) {
       throw new BackendError("network", {
@@ -8926,17 +8916,15 @@ function defaultSessionStorage(key) {
 }
 
 // src/version.ts
-var VERSION = "1.10.0";
+var VERSION = "2.0.0";
 
 // src/runtime.ts
 function buildRuntime(config) {
-  const appIdentifier = config.identifier ?? "";
-  const runtimeOrigin = typeof window !== "undefined" && typeof window.location !== "undefined" ? window.location.origin : "";
-  assertOriginMatches(loadAppConfig({ identifier: appIdentifier }), runtimeOrigin);
   const http = new HttpClient(config.apiKey, {
     url: config.url,
     headers: { "X-Client-Info": `palbe-web/${VERSION}`, ...config.headers }
   });
+  http.addInterceptor(({ headers }) => applyBrowserOriginHeader(headers));
   const tokenManager = new TokenManager();
   http.tokenManager = tokenManager;
   const authClient = new AuthClient(http, tokenManager);
@@ -8985,7 +8973,6 @@ function buildRuntime(config) {
   let perf;
   const rt = {
     config,
-    appIdentifier,
     http,
     tokenManager,
     authClient,
@@ -9144,7 +9131,9 @@ async function buildHeaders(rt, extra) {
   if (token) headers.Authorization = `Bearer ${token}`;
   const callerHasKey = Object.keys(extra ?? {}).some((k) => k.toLowerCase() === "idempotency-key");
   if (!callerHasKey) headers["Idempotency-Key"] = crypto.randomUUID();
-  return { ...headers, ...extra };
+  const merged = { ...headers, ...extra };
+  applyBrowserOriginHeader(merged);
+  return merged;
 }
 function buildForm(options) {
   const form = new FormData();
@@ -9340,4 +9329,4 @@ export {
   pb,
   createBoundClient
 };
-//# sourceMappingURL=chunk-4ZJHHXD3.js.map
+//# sourceMappingURL=chunk-V6VTX65P.js.map