@palbase/web 7.2.2 → 7.3.0

package/dist/{analytics-facade-DLfnVVwL.d.ts → analytics-facade-BER0EyYT.d.ts}

@@ -653,10 +653,8 @@ interface PalbeOAuthConfig {
 interface PalbeConfig {
     url: string;
     apiKey: string;
-    /** Registered app identity persisted by `palbase web link`. */
+    /** Registered app identity persisted by `palbase link`. */
     appId: string;
-    /** Stable reference of the linked Palbase Environment. */
-    environmentRef: string;
     oauth?: PalbeOAuthConfig;
     /**
      * Refresh-token persistence. Default: environment-scoped localStorage in
@@ -1640,6 +1638,13 @@ declare class PalbeRealtime {
 
 interface PalbeRuntime {
     config: PalbeConfig;
+    /**
+     * The project this runtime talks to, read from the publishable key.
+     *
+     * Exposed here so every consumer takes it from ONE derivation. It used to be
+     * a field on the config that had to equal the key's — see buildRuntime.
+     */
+    projectRef: string;
     http: HttpClient$1;
     tokenManager: TokenManager$1;
     authClient: AuthClient;

package/dist/{analytics-facade-jyXv7Cu4.d.cts → analytics-facade-CQXCQSoF.d.cts}

@@ -653,10 +653,8 @@ interface PalbeOAuthConfig {
 interface PalbeConfig {
     url: string;
     apiKey: string;
-    /** Registered app identity persisted by `palbase web link`. */
+    /** Registered app identity persisted by `palbase link`. */
     appId: string;
-    /** Stable reference of the linked Palbase Environment. */
-    environmentRef: string;
     oauth?: PalbeOAuthConfig;
     /**
      * Refresh-token persistence. Default: environment-scoped localStorage in
@@ -1640,6 +1638,13 @@ declare class PalbeRealtime {
 
 interface PalbeRuntime {
     config: PalbeConfig;
+    /**
+     * The project this runtime talks to, read from the publishable key.
+     *
+     * Exposed here so every consumer takes it from ONE derivation. It used to be
+     * a field on the config that had to equal the key's — see buildRuntime.
+     */
+    projectRef: string;
     http: HttpClient$1;
     tokenManager: TokenManager$1;
     authClient: AuthClient;

package/dist/{chunk-IREKQSHT.js → chunk-YBURINUN.js}

@@ -33,6 +33,47 @@ function redactUrl(rawUrl) {
   return path.split("/").map((seg2) => isSensitiveSegment(seg2) ? ":id" : seg2).join("/");
 }
 
+// src/pow.ts
+var POW_CHALLENGE_ID_HEADER = "X-PoW-Challenge-ID";
+var POW_NONCE_HEADER = "X-PoW-Nonce";
+function asPowChallenge(details) {
+  if (typeof details !== "object" || details === null) return null;
+  const env = details;
+  if (env.error !== "pow_required") return null;
+  const c = env.challenge;
+  if (typeof c !== "object" || c === null) return null;
+  const { id, prefix, difficulty } = c;
+  if (typeof id !== "string" || typeof prefix !== "string") return null;
+  if (typeof difficulty !== "number" || !Number.isInteger(difficulty) || difficulty < 0) return null;
+  return { id, prefix, difficulty };
+}
+var encoder = new TextEncoder();
+function leadingZeroBits(hash) {
+  let bits = 0;
+  for (const byte of hash) {
+    if (byte === 0) {
+      bits += 8;
+      continue;
+    }
+    return bits + Math.clz32(byte) - 24;
+  }
+  return bits;
+}
+async function solvePowChallenge(challenge, maxIterations = 1 << 24) {
+  for (let nonce = 0; nonce < maxIterations; nonce++) {
+    const digest = await crypto.subtle.digest("SHA-256", encoder.encode(challenge.prefix + nonce));
+    if (leadingZeroBits(new Uint8Array(digest)) >= challenge.difficulty) {
+      return {
+        [POW_CHALLENGE_ID_HEADER]: challenge.id,
+        [POW_NONCE_HEADER]: String(nonce)
+      };
+    }
+  }
+  throw new Error(
+    `proof-of-work: no nonce found for difficulty ${challenge.difficulty} within ${maxIterations} attempts`
+  );
+}
+
 // src/request.ts
 var MUTATING = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
 var PERF_EXCLUDED_PREFIX = "/v1/analytics/";
@@ -56,11 +97,11 @@ async function palbeRequest(rt, method, path, spec = {}) {
   if (MUTATING.has(method) && !callerHasKey) {
     headers["Idempotency-Key"] = crypto.randomUUID();
   }
-  const attempt = async () => {
+  const attempt = async (extra) => {
     try {
       return await rt.http.request(method, path, {
         body: spec.body,
-        headers,
+        headers: extra ? { ...headers, ...extra } : headers,
         signal: spec.signal
       });
     } catch (e) {
@@ -95,6 +136,12 @@ async function palbeRequest(rt, method, path, spec = {}) {
       }
       res = await attempt();
     }
+    if (res.error?.status === 403 && res.error.code === "pow_required") {
+      const challenge = asPowChallenge(res.error.details);
+      if (challenge) {
+        res = await attempt(await solvePowChallenge(challenge));
+      }
+    }
   } catch (e) {
     if (!isAbort(e)) record(asPalbaseError(e)?.status ?? 0);
     throw e;
@@ -835,7 +882,7 @@ var AnalyticsState = class {
   idKey;
   optOutKey;
   constructor(rt) {
-    const ref = rt.config.environmentRef;
+    const ref = rt.projectRef;
     this.idKey = ref ? `palbe.analytics.id.${ref}` : "palbe.analytics.id";
     this.optOutKey = ref ? `palbe.analytics.optout.${ref}` : "palbe.analytics.optout";
     rt.auth.onAuthEvent((event) => {
@@ -2474,7 +2521,7 @@ var PalbeFlags = class {
   constructor(rt) {
     this.transport = new FlagsClient(rt.http);
     const browser = typeof document !== "undefined";
-    const ref = rt.config.environmentRef;
+    const ref = rt.projectRef;
     const options = {
       auth: palbeAuthAdapter(rt.auth),
       ...ref ? { storageKey: `palbe.flags.${ref}` } : {},
@@ -8873,15 +8920,13 @@ function defaultSessionStorage(key) {
 }
 
 // src/version.ts
-var VERSION = "7.2.2";
+var VERSION = "7.3.0";
 
 // src/runtime.ts
 function buildRuntime(config) {
-  const keyEnvironmentRef = environmentRefFromPublishableApiKey(config.apiKey);
-  if (keyEnvironmentRef === "") {
-    throw new Error("PalbeConfig.apiKey does not contain a valid publishable Environment identity");
-  } else if (config.environmentRef !== keyEnvironmentRef) {
-    throw new Error("PalbeConfig.environmentRef must match the Environment identity in apiKey");
+  const projectRef = environmentRefFromPublishableApiKey(config.apiKey);
+  if (projectRef === "") {
+    throw new Error("PalbeConfig.apiKey does not contain a valid publishable project identity");
   }
   let runtimeURL;
   try {
@@ -8889,8 +8934,8 @@ function buildRuntime(config) {
   } catch {
     throw new Error("PalbeConfig.url must be a valid URL");
   }
-  if (runtimeURL.hostname.endsWith(".palbase.studio") && runtimeURL.hostname.split(".")[0] !== config.environmentRef) {
-    throw new Error("PalbeConfig.url must match environmentRef for palbase.studio");
+  if (runtimeURL.hostname.endsWith(".palbase.studio") && runtimeURL.hostname.split(".")[0] !== projectRef) {
+    throw new Error("PalbeConfig.url must match the project identity in apiKey for palbase.studio");
   }
   const http = new HttpClient(config.apiKey, {
     url: config.url,
@@ -8900,7 +8945,7 @@ function buildRuntime(config) {
   const tokenManager = new TokenManager();
   http.tokenManager = tokenManager;
   const authClient = new AuthClient(http, tokenManager);
-  const ref = config.environmentRef;
+  const ref = projectRef;
   const storage = config.storage ?? defaultSessionStorage(ref ? `palbe.session.${ref}` : void 0);
   const persisted = storage.load();
   if (persisted) {
@@ -8945,6 +8990,7 @@ function buildRuntime(config) {
   let perf;
   const rt = {
     config,
+    projectRef,
     http,
     tokenManager,
     authClient,
@@ -9298,4 +9344,4 @@ export {
   pb,
   createBoundClient
 };
-//# sourceMappingURL=chunk-IREKQSHT.js.map
+//# sourceMappingURL=chunk-YBURINUN.js.map