@palbase/web 5.0.1 → 7.0.0

package/README.md

@@ -49,10 +49,10 @@ If you forget to import it, every `pb` call throws a guided `BackendError`
 
 ## Calling your backend
 
-Codegen turns each backend controller into a typed namespace on `pb`. A
-controller method `todos.create` becomes `pb.todos.create(input)`; a top-level
-endpoint `getHello` becomes `pb.getHello()`. Path params come first, the request
-body/query second:
+Codegen turns each backend controller into a typed namespace on `pb`. The
+operation id is `<controller>.<method>` — `TodosController.create` becomes
+`pb.todos.create(input)`, `HelloController.greet` becomes `pb.hello.greet()`.
+Path params come first, the request body/query second:
 
 ```ts
 import { pb } from '@palbase/web';
@@ -206,8 +206,8 @@ specific failures a given endpoint documents.
 ## Next.js — `@palbase/web/next`
 
 The Next.js App Router adapter shares one session cookie between the browser and
-the server so Server Components, Route Handlers and middleware all see the same
-auth state.
+the server so Server Components, Route Handlers and the proxy all see the same
+auth state. Requires `next >= 16` (the `proxy` file convention).
 
 **1. Configure the browser client** (a client provider/component):
 
@@ -225,15 +225,15 @@ export function PalbeProvider({ children }: { children: React.ReactNode }) {
 `setupPalbeNext()` swaps in `cookieSessionStorage` so the session is written to a
 cookie the server can read.
 
-**2. Refresh the session in middleware** (required for session-bearing RSC apps):
+**2. Refresh the session in the proxy** (required for session-bearing RSC apps):
 
 ```ts
-// middleware.ts
-import { palbeMiddleware } from '@palbase/web/next/middleware';
+// proxy.ts
+import { palbeProxy } from '@palbase/web/next/proxy';
 import type { NextRequest } from 'next/server';
 
-export function middleware(request: NextRequest) {
-  return palbeMiddleware(request, {
+export function proxy(request: NextRequest) {
+  return palbeProxy(request, {
     url: 'https://<environmentRef>.palbase.studio',
     apiKey: 'pb_<environmentRef>_c...',
   });
@@ -247,15 +247,15 @@ export const config = { matcher: ['/((?!_next/static|_next/image|favicon.ico).*)
 
 Two rules the shape above encodes:
 
-- **Import `@palbase/web/next/middleware`, not `@palbase/web/next`.** Next
-  compiles middleware into a separate Edge bundle, and the full adapter graph
-  reaches `WebAssembly.compile`, which Next rejects there with a build error.
+- **Import `@palbase/web/next/proxy`, not `@palbase/web/next`.** Next compiles
+  the proxy into its own bundle, and the full adapter graph reaches
+  `livekit-client` and the MLS WASM loader — megabytes on every request path.
   This entry reaches none of it.
 - **Pass the config explicitly; do not `import './palbe.gen'` here.** That
   import would pull the same graph back in. It also means `config`/`matcher`
   must be declared in this file — Next reads `export const config` off this
   file's own AST, so a re-exported or imported one is silently ignored and the
-  middleware degrades to matching every request.
+  proxy degrades to matching every request.
 
 **3. Read data in Server Components** with `pbServer()` — a per-request,
 session-isolated client:

package/dist/{analytics-facade-Cp3d4QI-.d.ts → analytics-facade-CdTK9Y0s.d.ts}

@@ -15,6 +15,15 @@ interface PalbaseResponse$1<T> {
     status: number;
 }
 interface HttpClientOptions$1 {
+    /**
+     * The host application's own version, sent as `X-Palbase-Client-Version` and
+     * readable in flag targeting as `client.app_version`.
+     *
+     * Opt-in because the SDK cannot discover it on the web — there is no bundle
+     * to read a version out of. iOS fills the same header automatically from
+     * CFBundleShortVersionString.
+     */
+    appVersion?: string;
     url?: string;
     headers?: Record<string, string>;
 }
@@ -104,6 +113,15 @@ interface PalbaseResponse<T> {
     status: number;
 }
 interface HttpClientOptions {
+    /**
+     * The host application's own version, sent as `X-Palbase-Client-Version` and
+     * readable in flag targeting as `client.app_version`.
+     *
+     * Opt-in because the SDK cannot discover it on the web — there is no bundle
+     * to read a version out of. iOS fills the same header automatically from
+     * CFBundleShortVersionString.
+     */
+    appVersion?: string;
     url?: string;
     headers?: Record<string, string>;
 }
@@ -1648,6 +1666,19 @@ interface AuthUser {
     emailVerified: boolean;
     createdAt: string;
 }
+/** What `pb.auth.getSignInMethods()` reports about an account's credentials. */
+interface SignInMethods {
+    /** A local password exists — offer "change password", not "set password". */
+    password: boolean;
+    /** An MFA factor is enrolled. */
+    mfa: boolean;
+    /**
+     * Linked OAuth providers, e.g. `['google']`. `[]` means none are linked;
+     * `null` means the server could not determine it (social login is not
+     * configured, or the lookup failed) — treat null as unknown, not as none.
+     */
+    providers: string[] | null;
+}
 interface AuthSuccess {
     user: AuthUser;
     session: Session$1;
@@ -1716,6 +1747,16 @@ declare class PalbeAuth {
         erasureId: string;
     }>;
     getUser(): Promise<AuthUser>;
+    /**
+     * Which credentials this account actually has.
+     *
+     * An account reached through Google has no password, so showing it a
+     * "current password" field gives the user something they can never fill —
+     * and `getUser()` cannot tell you, because GET /auth/user carries no
+     * credential information. Read this before rendering any re-auth or
+     * change-password form.
+     */
+    getSignInMethods(): Promise<SignInMethods>;
     refreshUser(): Promise<AuthUser>;
     /**
      * Restore the user after a session was rehydrated from storage (page reload).
@@ -1906,4 +1947,4 @@ declare class PalbeAnalytics {
     private post;
 }
 
-export { type AuthUser as A, PalbeMessaging as B, Chat as C, type PalbeOAuthConfig as D, PalbeRealtime as E, type FlagsView as F, type PresenceState as G, RealtimeChannel as H, type RealtimeHandler as I, type RealtimeStatus as J, type RealtimeStatusSnapshot as K, type RealtimeSubscription as L, type MagicLinkResult as M, type NotifyScope as N, type OAuthExchangeResult as O, type PalbeConfig as P, type ResolvedMention as Q, type RealtimeConnectionState as R, type ResolvedReply as S, type SentReceipt as T, type UnreadView as U, type Unsubscribe as V, PalbePerf as W, type RealtimePayload as a, type ChatMember as b, type ChatMessage as c, type PalbeRuntime as d, buildRuntime as e, type AnalyticsProperties as f, type AuthChangeEvent as g, type AuthState as h, type AuthSuccess as i, Call as j, type CallChangeCallback as k, type CallParticipant as l, type CallState as m, type ChatBackend as n, type ChatDraft as o, type ChatKind as p, type ChatMessageKind as q, type ChatRole as r, type ChatState as s, type CommsPrefs as t, type MentionRange as u, type MessageDirection as v, PalbeAnalytics as w, PalbeAuth as x, PalbeCalls as y, PalbeFlags as z };
+export { type AuthUser as A, PalbeMessaging as B, Chat as C, type PalbeOAuthConfig as D, PalbeRealtime as E, type FlagsView as F, type PresenceState as G, RealtimeChannel as H, type RealtimeHandler as I, type RealtimeStatus as J, type RealtimeStatusSnapshot as K, type RealtimeSubscription as L, type MagicLinkResult as M, type NotifyScope as N, type OAuthExchangeResult as O, type PalbeConfig as P, type ResolvedMention as Q, type RealtimeConnectionState as R, type ResolvedReply as S, type SentReceipt as T, type SignInMethods as U, type UnreadView as V, type Unsubscribe as W, PalbePerf as X, type RealtimePayload as a, type ChatMember as b, type ChatMessage as c, type PalbeRuntime as d, buildRuntime as e, type AnalyticsProperties as f, type AuthChangeEvent as g, type AuthState as h, type AuthSuccess as i, Call as j, type CallChangeCallback as k, type CallParticipant as l, type CallState as m, type ChatBackend as n, type ChatDraft as o, type ChatKind as p, type ChatMessageKind as q, type ChatRole as r, type ChatState as s, type CommsPrefs as t, type MentionRange as u, type MessageDirection as v, PalbeAnalytics as w, PalbeAuth as x, PalbeCalls as y, PalbeFlags as z };

package/dist/{analytics-facade-CaluA4bW.d.cts → analytics-facade-TB-D4ww8.d.cts}

@@ -15,6 +15,15 @@ interface PalbaseResponse$1<T> {
     status: number;
 }
 interface HttpClientOptions$1 {
+    /**
+     * The host application's own version, sent as `X-Palbase-Client-Version` and
+     * readable in flag targeting as `client.app_version`.
+     *
+     * Opt-in because the SDK cannot discover it on the web — there is no bundle
+     * to read a version out of. iOS fills the same header automatically from
+     * CFBundleShortVersionString.
+     */
+    appVersion?: string;
     url?: string;
     headers?: Record<string, string>;
 }
@@ -104,6 +113,15 @@ interface PalbaseResponse<T> {
     status: number;
 }
 interface HttpClientOptions {
+    /**
+     * The host application's own version, sent as `X-Palbase-Client-Version` and
+     * readable in flag targeting as `client.app_version`.
+     *
+     * Opt-in because the SDK cannot discover it on the web — there is no bundle
+     * to read a version out of. iOS fills the same header automatically from
+     * CFBundleShortVersionString.
+     */
+    appVersion?: string;
     url?: string;
     headers?: Record<string, string>;
 }
@@ -1648,6 +1666,19 @@ interface AuthUser {
     emailVerified: boolean;
     createdAt: string;
 }
+/** What `pb.auth.getSignInMethods()` reports about an account's credentials. */
+interface SignInMethods {
+    /** A local password exists — offer "change password", not "set password". */
+    password: boolean;
+    /** An MFA factor is enrolled. */
+    mfa: boolean;
+    /**
+     * Linked OAuth providers, e.g. `['google']`. `[]` means none are linked;
+     * `null` means the server could not determine it (social login is not
+     * configured, or the lookup failed) — treat null as unknown, not as none.
+     */
+    providers: string[] | null;
+}
 interface AuthSuccess {
     user: AuthUser;
     session: Session$1;
@@ -1716,6 +1747,16 @@ declare class PalbeAuth {
         erasureId: string;
     }>;
     getUser(): Promise<AuthUser>;
+    /**
+     * Which credentials this account actually has.
+     *
+     * An account reached through Google has no password, so showing it a
+     * "current password" field gives the user something they can never fill —
+     * and `getUser()` cannot tell you, because GET /auth/user carries no
+     * credential information. Read this before rendering any re-auth or
+     * change-password form.
+     */
+    getSignInMethods(): Promise<SignInMethods>;
     refreshUser(): Promise<AuthUser>;
     /**
      * Restore the user after a session was rehydrated from storage (page reload).
@@ -1906,4 +1947,4 @@ declare class PalbeAnalytics {
     private post;
 }
 
-export { type AuthUser as A, PalbeMessaging as B, Chat as C, type PalbeOAuthConfig as D, PalbeRealtime as E, type FlagsView as F, type PresenceState as G, RealtimeChannel as H, type RealtimeHandler as I, type RealtimeStatus as J, type RealtimeStatusSnapshot as K, type RealtimeSubscription as L, type MagicLinkResult as M, type NotifyScope as N, type OAuthExchangeResult as O, type PalbeConfig as P, type ResolvedMention as Q, type RealtimeConnectionState as R, type ResolvedReply as S, type SentReceipt as T, type UnreadView as U, type Unsubscribe as V, PalbePerf as W, type RealtimePayload as a, type ChatMember as b, type ChatMessage as c, type PalbeRuntime as d, buildRuntime as e, type AnalyticsProperties as f, type AuthChangeEvent as g, type AuthState as h, type AuthSuccess as i, Call as j, type CallChangeCallback as k, type CallParticipant as l, type CallState as m, type ChatBackend as n, type ChatDraft as o, type ChatKind as p, type ChatMessageKind as q, type ChatRole as r, type ChatState as s, type CommsPrefs as t, type MentionRange as u, type MessageDirection as v, PalbeAnalytics as w, PalbeAuth as x, PalbeCalls as y, PalbeFlags as z };
+export { type AuthUser as A, PalbeMessaging as B, Chat as C, type PalbeOAuthConfig as D, PalbeRealtime as E, type FlagsView as F, type PresenceState as G, RealtimeChannel as H, type RealtimeHandler as I, type RealtimeStatus as J, type RealtimeStatusSnapshot as K, type RealtimeSubscription as L, type MagicLinkResult as M, type NotifyScope as N, type OAuthExchangeResult as O, type PalbeConfig as P, type ResolvedMention as Q, type RealtimeConnectionState as R, type ResolvedReply as S, type SentReceipt as T, type SignInMethods as U, type UnreadView as V, type Unsubscribe as W, PalbePerf as X, type RealtimePayload as a, type ChatMember as b, type ChatMessage as c, type PalbeRuntime as d, buildRuntime as e, type AnalyticsProperties as f, type AuthChangeEvent as g, type AuthState as h, type AuthSuccess as i, Call as j, type CallChangeCallback as k, type CallParticipant as l, type CallState as m, type ChatBackend as n, type ChatDraft as o, type ChatKind as p, type ChatMessageKind as q, type ChatRole as r, type ChatState as s, type CommsPrefs as t, type MentionRange as u, type MessageDirection as v, PalbeAnalytics as w, PalbeAuth as x, PalbeCalls as y, PalbeFlags as z };

package/dist/{chunk-QKFPPZLF.js → chunk-7SNSLY5M.js}

@@ -8,7 +8,7 @@ import {
   fromPalbaseError,
   isBackendError,
   unwrap
-} from "./chunk-BNAGRUIQ.js";
+} from "./chunk-ACCJV6FV.js";
 import {
   environmentRefFromPublishableApiKey
 } from "./chunk-CFDU23TB.js";
@@ -1184,6 +1184,23 @@ var PalbeAuth = class {
     const raw = await palbeRequest(this.rt, "GET", "/auth/user");
     return mapWireUser(raw);
   }
+  /**
+   * Which credentials this account actually has.
+   *
+   * An account reached through Google has no password, so showing it a
+   * "current password" field gives the user something they can never fill —
+   * and `getUser()` cannot tell you, because GET /auth/user carries no
+   * credential information. Read this before rendering any re-auth or
+   * change-password form.
+   */
+  async getSignInMethods() {
+    const raw = await palbeRequest(this.rt, "GET", "/auth/me");
+    return {
+      password: raw.has_password,
+      mfa: raw.has_mfa,
+      providers: raw.providers ?? null
+    };
+  }
   async refreshUser() {
     const user = await this.getUser();
     const changed = !usersEqual(user, this.cachedUser);
@@ -8633,7 +8650,7 @@ function defaultSessionStorage(key) {
 }
 
 // src/version.ts
-var VERSION = "5.0.1";
+var VERSION = "7.0.0";
 
 // src/runtime.ts
 function buildRuntime(config) {
@@ -9058,4 +9075,4 @@ export {
   pb,
   createBoundClient
 };
-//# sourceMappingURL=chunk-QKFPPZLF.js.map
+//# sourceMappingURL=chunk-7SNSLY5M.js.map