@palbase/web 1.9.0 → 2.0.0

package/README.md

@@ -34,8 +34,9 @@ wires `import './palbe.gen';` into your app entry, and adds a `predev`/`prebuild
 hook that keeps the types in sync. **Commit `palbe.gen.ts`** — it's the typed
 client your app imports, not a build artifact.
 
-The generated file calls `__configure(...)` with your project's URL and anon API
-key at module load, so importing it once at startup is all the setup there is.
+The generated file calls `__configure(...)` with your project's URL, app ID, and
+anon API key at module load, so importing it once at startup is all the setup
+there is.
 If you forget to import it, every `pb` call throws a guided `BackendError`
 (`kind: 'notConfigured'`).
 

package/dist/{analytics-facade-DsvKx5A5.d.ts → analytics-facade-DMtGDGfd.d.ts}

@@ -620,18 +620,10 @@ interface PalbeOAuthConfig {
 interface PalbeConfig {
     url: string;
     apiKey: string;
+    /** Registered app identity persisted by `palbase web link`. */
+    appId: string;
     /** Informational — url+apiKey are already branch-specific (endpointRef embeds the branch slug); gen bakes all three consistently. */
     branch?: string;
-    /**
-     * F2 app-registration: the registered app `identifier` from
-     * `palbase-config.json` — for web this is the declared ORIGIN (e.g.
-     * `https://app.example.com`). When non-empty, `configure` REFUSES to build the
-     * runtime if `window.location.origin` does not match (SDK-REFUSES), and the
-     * value rides on `X-Palbase-Bundle` on EVERY request so the Kong gate can match
-     * it (the IDENTICAL header + value the iOS SDK sends). Empty/absent → legacy /
-     * tooling: no guard, no header.
-     */
-    identifier?: string;
     oauth?: PalbeOAuthConfig;
     /** Refresh-token persistence. Default: endpoint-scoped localStorage in browsers, memory elsewhere. */
     storage?: SessionStorageAdapter;
@@ -1690,14 +1682,6 @@ declare class PalbeRealtime {
 
 interface PalbeRuntime {
     config: PalbeConfig;
-    /**
-     * F2 app-registration: the registered app `identifier` (web ORIGIN) stashed at
-     * configure. Rides on `X-Palbase-Bundle` on EVERY request (request.ts) so the
-     * Kong gate can match it. Empty string when the binding is unconfigured/tooling
-     * (no header is sent). Origin-match is enforced in `buildRuntime` BEFORE this
-     * runtime is returned — a mismatch throws there and no runtime is built.
-     */
-    appIdentifier: string;
     http: HttpClient$1;
     tokenManager: TokenManager$1;
     authClient: AuthClient;
@@ -1978,4 +1962,4 @@ declare class PalbeAnalytics {
     private post;
 }
 
-export { type AnalyticsProperties as A, type PresenceState as B, Call as C, type RealtimeConnectionState as D, type RealtimeHandler as E, type FlagsView as F, type RealtimePayload as G, type RealtimeStatus as H, type RealtimeStatusSnapshot as I, type RealtimeSubscription as J, type ResolvedMention as K, type ResolvedReply as L, type MagicLinkResult as M, type NotifyScope as N, type OAuthExchangeResult as O, PalbeAnalytics as P, type Unsubscribe as Q, RealtimeChannel as R, type SentReceipt as S, type PalbeRuntime as T, type UnreadView as U, buildRuntime as V, PalbePerf as W, type AuthChangeEvent as a, type AuthState as b, type AuthSuccess as c, type AuthUser as d, type CallChangeCallback as e, type CallParticipant as f, type CallState as g, Chat as h, type ChatBackend as i, type ChatDraft as j, type ChatKind as k, type ChatMember as l, type ChatMessage as m, type ChatMessageKind as n, type ChatRole as o, type ChatState as p, type CommsPrefs as q, type MentionRange as r, type MessageDirection as s, PalbeAuth as t, PalbeCalls as u, type PalbeConfig as v, PalbeFlags as w, PalbeMessaging as x, type PalbeOAuthConfig as y, PalbeRealtime as z };
+export { type AuthUser as A, PalbeMessaging as B, Chat as C, type PalbeOAuthConfig as D, PalbeRealtime as E, type FlagsView as F, type PresenceState as G, RealtimeChannel as H, type RealtimeHandler as I, type RealtimeStatus as J, type RealtimeStatusSnapshot as K, type RealtimeSubscription as L, type MagicLinkResult as M, type NotifyScope as N, type OAuthExchangeResult as O, type PalbeConfig as P, type ResolvedMention as Q, type RealtimeConnectionState as R, type ResolvedReply as S, type SentReceipt as T, type UnreadView as U, type Unsubscribe as V, PalbePerf as W, type RealtimePayload as a, type ChatMember as b, type ChatMessage as c, type PalbeRuntime as d, buildRuntime as e, type AnalyticsProperties as f, type AuthChangeEvent as g, type AuthState as h, type AuthSuccess as i, Call as j, type CallChangeCallback as k, type CallParticipant as l, type CallState as m, type ChatBackend as n, type ChatDraft as o, type ChatKind as p, type ChatMessageKind as q, type ChatRole as r, type ChatState as s, type CommsPrefs as t, type MentionRange as u, type MessageDirection as v, PalbeAnalytics as w, PalbeAuth as x, PalbeCalls as y, PalbeFlags as z };

package/dist/{analytics-facade-DFd5LB3_.d.cts → analytics-facade-ovP0pF2P.d.cts}

@@ -620,18 +620,10 @@ interface PalbeOAuthConfig {
 interface PalbeConfig {
     url: string;
     apiKey: string;
+    /** Registered app identity persisted by `palbase web link`. */
+    appId: string;
     /** Informational — url+apiKey are already branch-specific (endpointRef embeds the branch slug); gen bakes all three consistently. */
     branch?: string;
-    /**
-     * F2 app-registration: the registered app `identifier` from
-     * `palbase-config.json` — for web this is the declared ORIGIN (e.g.
-     * `https://app.example.com`). When non-empty, `configure` REFUSES to build the
-     * runtime if `window.location.origin` does not match (SDK-REFUSES), and the
-     * value rides on `X-Palbase-Bundle` on EVERY request so the Kong gate can match
-     * it (the IDENTICAL header + value the iOS SDK sends). Empty/absent → legacy /
-     * tooling: no guard, no header.
-     */
-    identifier?: string;
     oauth?: PalbeOAuthConfig;
     /** Refresh-token persistence. Default: endpoint-scoped localStorage in browsers, memory elsewhere. */
     storage?: SessionStorageAdapter;
@@ -1690,14 +1682,6 @@ declare class PalbeRealtime {
 
 interface PalbeRuntime {
     config: PalbeConfig;
-    /**
-     * F2 app-registration: the registered app `identifier` (web ORIGIN) stashed at
-     * configure. Rides on `X-Palbase-Bundle` on EVERY request (request.ts) so the
-     * Kong gate can match it. Empty string when the binding is unconfigured/tooling
-     * (no header is sent). Origin-match is enforced in `buildRuntime` BEFORE this
-     * runtime is returned — a mismatch throws there and no runtime is built.
-     */
-    appIdentifier: string;
     http: HttpClient$1;
     tokenManager: TokenManager$1;
     authClient: AuthClient;
@@ -1978,4 +1962,4 @@ declare class PalbeAnalytics {
     private post;
 }
 
-export { type AnalyticsProperties as A, type PresenceState as B, Call as C, type RealtimeConnectionState as D, type RealtimeHandler as E, type FlagsView as F, type RealtimePayload as G, type RealtimeStatus as H, type RealtimeStatusSnapshot as I, type RealtimeSubscription as J, type ResolvedMention as K, type ResolvedReply as L, type MagicLinkResult as M, type NotifyScope as N, type OAuthExchangeResult as O, PalbeAnalytics as P, type Unsubscribe as Q, RealtimeChannel as R, type SentReceipt as S, type PalbeRuntime as T, type UnreadView as U, buildRuntime as V, PalbePerf as W, type AuthChangeEvent as a, type AuthState as b, type AuthSuccess as c, type AuthUser as d, type CallChangeCallback as e, type CallParticipant as f, type CallState as g, Chat as h, type ChatBackend as i, type ChatDraft as j, type ChatKind as k, type ChatMember as l, type ChatMessage as m, type ChatMessageKind as n, type ChatRole as o, type ChatState as p, type CommsPrefs as q, type MentionRange as r, type MessageDirection as s, PalbeAuth as t, PalbeCalls as u, type PalbeConfig as v, PalbeFlags as w, PalbeMessaging as x, type PalbeOAuthConfig as y, PalbeRealtime as z };
+export { type AuthUser as A, PalbeMessaging as B, Chat as C, type PalbeOAuthConfig as D, PalbeRealtime as E, type FlagsView as F, type PresenceState as G, RealtimeChannel as H, type RealtimeHandler as I, type RealtimeStatus as J, type RealtimeStatusSnapshot as K, type RealtimeSubscription as L, type MagicLinkResult as M, type NotifyScope as N, type OAuthExchangeResult as O, type PalbeConfig as P, type ResolvedMention as Q, type RealtimeConnectionState as R, type ResolvedReply as S, type SentReceipt as T, type UnreadView as U, type Unsubscribe as V, PalbePerf as W, type RealtimePayload as a, type ChatMember as b, type ChatMessage as c, type PalbeRuntime as d, buildRuntime as e, type AnalyticsProperties as f, type AuthChangeEvent as g, type AuthState as h, type AuthSuccess as i, Call as j, type CallChangeCallback as k, type CallParticipant as l, type CallState as m, type ChatBackend as n, type ChatDraft as o, type ChatKind as p, type ChatMessageKind as q, type ChatRole as r, type ChatState as s, type CommsPrefs as t, type MentionRange as u, type MessageDirection as v, PalbeAnalytics as w, PalbeAuth as x, PalbeCalls as y, PalbeFlags as z };

package/dist/chunk-PZ5AY32C.js

@@ -0,0 +1,10 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+export {
+  __export
+};
+//# sourceMappingURL=chunk-PZ5AY32C.js.map

package/dist/chunk-PZ5AY32C.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/{chunk-I3ZMB7XM.js → chunk-V6VTX65P.js}

@@ -1,8 +1,6 @@
-var __defProp = Object.defineProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
+import {
+  __export
+} from "./chunk-PZ5AY32C.js";
 
 // ../core/dist/index.js
 var CACHE_TTL_MS = 5 * 60 * 1e3;
@@ -422,12 +420,6 @@ async function palbeRequest(rt, method, path, spec = {}) {
   if (MUTATING.has(method) && !callerHasKey) {
     headers["Idempotency-Key"] = crypto.randomUUID();
   }
-  if (rt.appIdentifier !== "") {
-    const callerHasBundle = Object.keys(headers).some(
-      (k) => k.toLowerCase() === "x-palbase-bundle"
-    );
-    if (!callerHasBundle) headers["X-Palbase-Bundle"] = rt.appIdentifier;
-  }
   const attempt = async () => {
     try {
       return await rt.http.request(method, path, {
@@ -1411,23 +1403,6 @@ var PalbeAnalytics = class {
   }
 };
 
-// src/app-config.ts
-function loadAppConfig(raw) {
-  if (typeof raw !== "object" || raw === null) {
-    throw new Error("app_config_invalid: expected a JSON object");
-  }
-  const r = raw;
-  const str = (k) => typeof r[k] === "string" ? r[k] : "";
-  return { appId: str("app_id"), identifier: str("identifier"), envPreset: str("env_preset") };
-}
-function assertOriginMatches(cfg, runtimeOrigin) {
-  if (cfg.identifier === "") return;
-  if (runtimeOrigin === "") return;
-  if (runtimeOrigin !== cfg.identifier) {
-    throw new Error(`app_config_mismatch: expected origin ${cfg.identifier}, got ${runtimeOrigin}`);
-  }
-}
-
 // src/auth-wire.ts
 function asWireAuthResult(raw) {
   if (typeof raw !== "object" || raw === null) return null;
@@ -8241,6 +8216,14 @@ function observeWebVitals(record) {
   };
 }
 
+// src/runtime-metadata.ts
+var APP_METADATA_HEADER = "X-Palbase-Bundle";
+function applyBrowserOriginHeader(headers) {
+  if (Object.keys(headers).some((key) => key.toLowerCase() === "x-palbase-bundle")) return;
+  const origin = typeof window !== "undefined" && typeof window.location !== "undefined" ? window.location.origin : "";
+  if (origin !== "") headers[APP_METADATA_HEADER] = origin;
+}
+
 // src/realtime/anon-token.ts
 var REFRESH_SKEW_MS = 6e4;
 var AnonTokenProvider = class {
@@ -8283,11 +8266,16 @@ var AnonTokenProvider = class {
    */
   async mint() {
     const base = this.rt.config.url.replace(/\/+$/, "");
+    const headers = {
+      apikey: this.rt.config.apiKey,
+      ...this.rt.config.headers
+    };
+    applyBrowserOriginHeader(headers);
     let response;
     try {
       response = await fetch(`${base}/auth/anonymous`, {
         method: "POST",
-        headers: { apikey: this.rt.config.apiKey }
+        headers
       });
     } catch (e) {
       throw new BackendError("network", {
@@ -8928,17 +8916,15 @@ function defaultSessionStorage(key) {
 }
 
 // src/version.ts
-var VERSION = "1.9.0";
+var VERSION = "2.0.0";
 
 // src/runtime.ts
 function buildRuntime(config) {
-  const appIdentifier = config.identifier ?? "";
-  const runtimeOrigin = typeof window !== "undefined" && typeof window.location !== "undefined" ? window.location.origin : "";
-  assertOriginMatches(loadAppConfig({ identifier: appIdentifier }), runtimeOrigin);
   const http = new HttpClient(config.apiKey, {
     url: config.url,
     headers: { "X-Client-Info": `palbe-web/${VERSION}`, ...config.headers }
   });
+  http.addInterceptor(({ headers }) => applyBrowserOriginHeader(headers));
   const tokenManager = new TokenManager();
   http.tokenManager = tokenManager;
   const authClient = new AuthClient(http, tokenManager);
@@ -8987,7 +8973,6 @@ function buildRuntime(config) {
   let perf;
   const rt = {
     config,
-    appIdentifier,
     http,
     tokenManager,
     authClient,
@@ -9146,7 +9131,9 @@ async function buildHeaders(rt, extra) {
   if (token) headers.Authorization = `Bearer ${token}`;
   const callerHasKey = Object.keys(extra ?? {}).some((k) => k.toLowerCase() === "idempotency-key");
   if (!callerHasKey) headers["Idempotency-Key"] = crypto.randomUUID();
-  return { ...headers, ...extra };
+  const merged = { ...headers, ...extra };
+  applyBrowserOriginHeader(merged);
+  return merged;
 }
 function buildForm(options) {
   const form = new FormData();
@@ -9342,4 +9329,4 @@ export {
   pb,
   createBoundClient
 };
-//# sourceMappingURL=chunk-I3ZMB7XM.js.map
+//# sourceMappingURL=chunk-V6VTX65P.js.map