@palbase/web 2.0.1 → 3.0.0

package/dist/internal.d.cts

@@ -1,7 +1,7 @@
-import { P as PalbeConfig, d as PalbeRuntime } from './analytics-facade-ChlBRcLZ.cjs';
-export { e as buildRuntime } from './analytics-facade-ChlBRcLZ.cjs';
+import { P as PalbeConfig, d as PalbeRuntime } from './analytics-facade-BOxQ8IP2.cjs';
+export { e as buildRuntime } from './analytics-facade-BOxQ8IP2.cjs';
 import { B as BackendError } from './errors-fDoNdTrJ.cjs';
-export { P as PB, c as createBoundClient } from './pb-B_6o5p79.cjs';
+export { P as PB, c as createBoundClient } from './pb-B3h3NIPE.cjs';
 import 'livekit-client';
 import './storage-BPaeSG8K.cjs';
 import './pooled-flags-4GtDtsiu.js';

package/dist/internal.d.ts

@@ -1,7 +1,7 @@
-import { P as PalbeConfig, d as PalbeRuntime } from './analytics-facade-G0il4NrT.js';
-export { e as buildRuntime } from './analytics-facade-G0il4NrT.js';
+import { P as PalbeConfig, d as PalbeRuntime } from './analytics-facade-yfMJ69vw.js';
+export { e as buildRuntime } from './analytics-facade-yfMJ69vw.js';
 import { B as BackendError } from './errors-fDoNdTrJ.js';
-export { P as PB, c as createBoundClient } from './pb-nPBhqhJr.js';
+export { P as PB, c as createBoundClient } from './pb-QRISxPd1.js';
 import 'livekit-client';
 import './storage-BPaeSG8K.js';
 import './pooled-flags-4GtDtsiu.js';

package/dist/internal.js

@@ -6,8 +6,8 @@ import {
   createBoundClient,
   getRuntime,
   onConfigured
-} from "./chunk-AIPUO4QX.js";
-import "./chunk-PZ5AY32C.js";
+} from "./chunk-3HVTEZ7N.js";
+import "./chunk-S7NAY3MW.js";
 export {
   __configure,
   __registerNamespaces,

package/dist/next/client.cjs

@@ -40,18 +40,9 @@ var PalbaseError = class extends Error {
   }
 };
 var PALBASE_DEFAULT_HOST = "api.palbase.studio";
-var REF_LEN = 8;
-var BASE62_RE = /^[0-9A-Za-z]+$/;
-function parseProjectRef(apiKey) {
-  if (apiKey.length < 13) return null;
-  if (!apiKey.startsWith("pb_")) return null;
-  if (apiKey[11] !== "_") return null;
-  const ref = apiKey.slice(3, 11);
-  if (ref.length !== REF_LEN) return null;
-  if (!BASE62_RE.test(ref)) return null;
-  const scope = apiKey[12];
-  if (scope !== "c") return null;
-  return ref;
+var API_KEY_RE = /^pb_([a-z0-9]+)_c[A-Za-z0-9]{20}$/;
+function parseEnvironmentRef(apiKey) {
+  return API_KEY_RE.exec(apiKey)?.[1] ?? null;
 }
 var MAX_RETRIES = 3;
 var INITIAL_BACKOFF_MS = 200;
@@ -81,8 +72,7 @@ var HttpClient = class _HttpClient {
    * with the parent at runtime — later changes on the parent propagate to
    * the scope and vice versa.
    *
-   * Typical use: tagging admin calls with `x-palbase-project: <ref>` so the
-   * gateway can route them to the correct project's data plane.
+   * Typical use: adding an Environment-routing header for an admin call.
    */
   withHeaders(extra) {
     const mergedHeaders = { ...this.options?.headers ?? {}, ...extra };
@@ -123,10 +113,10 @@ var HttpClient = class _HttpClient {
     if (this.options?.url) {
       return this.options.url;
     }
-    if (this.apiKey && parseProjectRef(this.apiKey) === null) {
+    if (this.apiKey && parseEnvironmentRef(this.apiKey) === null) {
       throw new PalbaseError(
         "invalid_api_key",
-        'Invalid API key format. Expected pb_{ref}_{scope}{random}. For dev/staging pass `url: "https://api.dev.palbase.studio"` via options.',
+        'Invalid API key format. Expected pb_{environment_ref}_c{20_base62_chars}. For dev/staging pass `url: "https://api.dev.palbase.studio"` via options.',
         0
       );
     }
@@ -139,10 +129,6 @@ var HttpClient = class _HttpClient {
     const effectiveKey = this.apiKey;
     if (effectiveKey) {
       headers["apikey"] = effectiveKey;
-      const ref = parseProjectRef(effectiveKey);
-      if (ref) {
-        headers["X-Project-Ref"] = ref;
-      }
     }
     const token = this.tokenManager?.getAccessToken();
     if (token) {
@@ -953,13 +939,6 @@ var AuthClient = class {
   }
 };
 
-// src/api-key.ts
-var API_KEY_RE = /^pb_([^_]+)_[cs][A-Za-z0-9]{20}$/;
-function endpointRefFromApiKey(apiKey) {
-  const m = API_KEY_RE.exec(apiKey);
-  return m ? m[1] ?? "" : "";
-}
-
 // src/analytics-facade.ts
 var EVENT_NAME_RE = /^[a-zA-Z$][a-zA-Z0-9_.:$-]{0,63}$/;
 var FLUSH_AT = 20;
@@ -1017,7 +996,7 @@ var AnalyticsState = class {
   idKey;
   optOutKey;
   constructor(rt) {
-    const ref = endpointRefFromApiKey(rt.config.apiKey);
+    const ref = rt.config.environmentRef;
     this.idKey = ref ? `palbe.analytics.id.${ref}` : "palbe.analytics.id";
     this.optOutKey = ref ? `palbe.analytics.optout.${ref}` : "palbe.analytics.optout";
     rt.auth.onAuthEvent((event) => {
@@ -1231,6 +1210,13 @@ var PalbeAnalytics = class {
   }
 };
 
+// src/api-key.ts
+var PUBLISHABLE_API_KEY_RE = /^pb_([a-z0-9]+)_c[A-Za-z0-9]{20}$/;
+function environmentRefFromPublishableApiKey(apiKey) {
+  const match = PUBLISHABLE_API_KEY_RE.exec(apiKey);
+  return match ? match[1] ?? "" : "";
+}
+
 // src/auth-wire.ts
 function asWireAuthResult(raw) {
   if (typeof raw !== "object" || raw === null) return null;
@@ -2371,7 +2357,7 @@ var PalbeFlags = class {
   constructor(rt) {
     this.transport = new FlagsClient(rt.http);
     const browser = typeof document !== "undefined";
-    const ref = endpointRefFromApiKey(rt.config.apiKey);
+    const ref = rt.config.environmentRef;
     const options = {
       auth: palbeAuthAdapter(rt.auth),
       ...ref ? { storageKey: `palbe.flags.${ref}` } : {},
@@ -8111,7 +8097,7 @@ var AnonTokenProvider = class {
   }
   /**
    * Raw fetch, deliberately NOT through HttpClient/palbeRequest: the mint
-   * must carry the project apikey and NEVER a Bearer (iOS keeps
+   * must carry the Environment API key and NEVER a Bearer (iOS keeps
    * `/auth/anonymous` on the unauthenticated-path list), and HttpClient's
    * pre-flight would try to refresh a stale session before an anon mint —
    * exactly the entanglement this provider exists to avoid.
@@ -8768,10 +8754,25 @@ function defaultSessionStorage(key) {
 }
 
 // src/version.ts
-var VERSION = "2.0.1";
+var VERSION = "3.0.0";
 
 // src/runtime.ts
 function buildRuntime(config) {
+  const keyEnvironmentRef = environmentRefFromPublishableApiKey(config.apiKey);
+  if (keyEnvironmentRef === "") {
+    throw new Error("PalbeConfig.apiKey does not contain a valid publishable Environment identity");
+  } else if (config.environmentRef !== keyEnvironmentRef) {
+    throw new Error("PalbeConfig.environmentRef must match the Environment identity in apiKey");
+  }
+  let runtimeURL;
+  try {
+    runtimeURL = new URL(config.url);
+  } catch {
+    throw new Error("PalbeConfig.url must be a valid URL");
+  }
+  if (runtimeURL.hostname.endsWith(".palbase.studio") && runtimeURL.hostname.split(".")[0] !== config.environmentRef) {
+    throw new Error("PalbeConfig.url must match environmentRef for palbase.studio");
+  }
   const http = new HttpClient(config.apiKey, {
     url: config.url,
     headers: { "X-Client-Info": `palbe-web/${VERSION}`, ...config.headers }
@@ -8780,7 +8781,7 @@ function buildRuntime(config) {
   const tokenManager = new TokenManager();
   http.tokenManager = tokenManager;
   const authClient = new AuthClient(http, tokenManager);
-  const ref = endpointRefFromApiKey(config.apiKey);
+  const ref = config.environmentRef;
   const storage = config.storage ?? defaultSessionStorage(ref ? `palbe.session.${ref}` : void 0);
   const persisted = storage.load();
   if (persisted) {
@@ -8938,11 +8939,11 @@ function getRuntime() {
 
 // src/next/cookie-codec.ts
 var MAX_COOKIE_VALUE = 3500;
-function sessionCookieName(endpointRef) {
-  return `palbe-session-${endpointRef}`;
+function sessionCookieName(environmentRef) {
+  return `palbe-session-${environmentRef}`;
 }
-function encodeSessionCookies(endpointRef, session) {
-  const name = sessionCookieName(endpointRef);
+function encodeSessionCookies(environmentRef, session) {
+  const name = sessionCookieName(environmentRef);
   const value = encodeURIComponent(
     JSON.stringify({ a: session.accessToken, r: session.refreshToken, e: session.expiresAt })
   );
@@ -8961,8 +8962,8 @@ function encodeSessionCookies(endpointRef, session) {
   }
   return { set: chunks, clear: [`${name}.${chunks.length}`] };
 }
-function decodeSessionCookies(get, endpointRef) {
-  const base = sessionCookieName(endpointRef);
+function decodeSessionCookies(get, environmentRef) {
+  const base = sessionCookieName(environmentRef);
   let encoded = get(base);
   if (encoded === void 0) {
     let joined = "";
@@ -8996,8 +8997,8 @@ function parseStoredSession(json) {
     return null;
   }
 }
-function clearedSessionCookieNames(endpointRef, present) {
-  const base = sessionCookieName(endpointRef);
+function clearedSessionCookieNames(environmentRef, present) {
+  const base = sessionCookieName(environmentRef);
   const names = [];
   if (present(base)) names.push(base);
   for (let i = 0; ; i++) {
@@ -9024,12 +9025,12 @@ function cookieJar() {
 function deleteCookie(name) {
   document.cookie = `${name}=; ${WRITE_ATTRS}; Max-Age=0`;
 }
-function cookieSessionStorage(endpointRef) {
+function cookieSessionStorage(environmentRef) {
   return {
     load() {
       if (typeof document === "undefined") return null;
       const jar = cookieJar();
-      const stored = decodeSessionCookies((name) => jar.get(name), endpointRef);
+      const stored = decodeSessionCookies((name) => jar.get(name), environmentRef);
       if (!stored) return null;
       return stored.accessToken && stored.expiresAt > 0 ? {
         refreshToken: stored.refreshToken,
@@ -9040,10 +9041,10 @@ function cookieSessionStorage(endpointRef) {
     save(session) {
       if (typeof document === "undefined") return;
       const jar = cookieJar();
-      for (const name of clearedSessionCookieNames(endpointRef, (n) => jar.has(n))) {
+      for (const name of clearedSessionCookieNames(environmentRef, (n) => jar.has(n))) {
         deleteCookie(name);
       }
-      const { set, clear } = encodeSessionCookies(endpointRef, {
+      const { set, clear } = encodeSessionCookies(environmentRef, {
         accessToken: session.accessToken ?? "",
         refreshToken: session.refreshToken,
         expiresAt: session.expiresAt ?? 0
@@ -9056,7 +9057,7 @@ function cookieSessionStorage(endpointRef) {
     clear() {
       if (typeof document === "undefined") return;
       const jar = cookieJar();
-      for (const name of clearedSessionCookieNames(endpointRef, (n) => jar.has(n))) {
+      for (const name of clearedSessionCookieNames(environmentRef, (n) => jar.has(n))) {
         deleteCookie(name);
       }
     }
@@ -9065,7 +9066,10 @@ function cookieSessionStorage(endpointRef) {
 function setupPalbeNext() {
   if (typeof document === "undefined") return;
   const config = getRuntime().config;
-  __configure({ ...config, storage: cookieSessionStorage(endpointRefFromApiKey(config.apiKey)) });
+  __configure({
+    ...config,
+    storage: cookieSessionStorage(config.environmentRef)
+  });
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {