@qontinui/ui-bridge 0.9.1 → 0.10.0

package/dist/react/index.d.mts

@@ -1616,6 +1616,29 @@ interface UseCommandRelayOptions {
      * build-time defaults baked into a static config).
      */
     version?: string;
+    /**
+     * Optional hook that returns the current session token (the raw token
+     * value, WITHOUT a `Bearer ` prefix). When supplied and returns a
+     * non-empty string, the SDK:
+     *
+     *   - attaches `Authorization: Bearer <value>` to outbound
+     *     `POST {basePath}/commands` and `POST {basePath}/heartbeat`;
+     *   - appends a `_auth=<value>` query parameter to the SSE URL
+     *     `GET {basePath}/commands/stream` (EventSource cannot set custom
+     *     headers per the WhatWG spec).
+     *
+     * Called fresh on every outbound request — implementations should read
+     * the token from a live source (e.g. `sessionStorage`) so a token
+     * rotation is picked up without remounting the listener. Returning
+     * `null` / `undefined` / empty string means "no auth this call" and
+     * the transport falls back to legacy unauth'd / cookie-based behavior
+     * (matching the SDK's pre-`authHeader` shape).
+     *
+     * Required to authenticate against any relay endpoint that enforces a
+     * session-bound auth gate (e.g. qontinui-web's
+     * `UI_BRIDGE_REQUIRE_AUTH=1` mode).
+     */
+    authHeader?: () => string | null | undefined;
 }
 /**
  * Hook that connects the browser to the server's command relay.
@@ -1660,6 +1683,14 @@ interface CommandRelayListenerProps {
      * defaults baked into the static config.
      */
     version?: string;
+    /**
+     * Optional hook returning the current session token (raw value, no
+     * `Bearer ` prefix). When supplied, the SDK attaches
+     * `Authorization: Bearer <value>` to outbound `POST /commands` and
+     * `POST /heartbeat` and appends `_auth=<value>` to the SSE URL.
+     * See `UseCommandRelayOptions.authHeader` for the full contract.
+     */
+    authHeader?: () => string | null | undefined;
 }
 declare function CommandRelayListener(props: CommandRelayListenerProps): null;
 

package/dist/react/index.d.ts

@@ -1616,6 +1616,29 @@ interface UseCommandRelayOptions {
      * build-time defaults baked into a static config).
      */
     version?: string;
+    /**
+     * Optional hook that returns the current session token (the raw token
+     * value, WITHOUT a `Bearer ` prefix). When supplied and returns a
+     * non-empty string, the SDK:
+     *
+     *   - attaches `Authorization: Bearer <value>` to outbound
+     *     `POST {basePath}/commands` and `POST {basePath}/heartbeat`;
+     *   - appends a `_auth=<value>` query parameter to the SSE URL
+     *     `GET {basePath}/commands/stream` (EventSource cannot set custom
+     *     headers per the WhatWG spec).
+     *
+     * Called fresh on every outbound request — implementations should read
+     * the token from a live source (e.g. `sessionStorage`) so a token
+     * rotation is picked up without remounting the listener. Returning
+     * `null` / `undefined` / empty string means "no auth this call" and
+     * the transport falls back to legacy unauth'd / cookie-based behavior
+     * (matching the SDK's pre-`authHeader` shape).
+     *
+     * Required to authenticate against any relay endpoint that enforces a
+     * session-bound auth gate (e.g. qontinui-web's
+     * `UI_BRIDGE_REQUIRE_AUTH=1` mode).
+     */
+    authHeader?: () => string | null | undefined;
 }
 /**
  * Hook that connects the browser to the server's command relay.
@@ -1660,6 +1683,14 @@ interface CommandRelayListenerProps {
      * defaults baked into the static config.
      */
     version?: string;
+    /**
+     * Optional hook returning the current session token (raw value, no
+     * `Bearer ` prefix). When supplied, the SDK attaches
+     * `Authorization: Bearer <value>` to outbound `POST /commands` and
+     * `POST /heartbeat` and appends `_auth=<value>` to the SSE URL.
+     * See `UseCommandRelayOptions.authHeader` for the full contract.
+     */
+    authHeader?: () => string | null | undefined;
 }
 declare function CommandRelayListener(props: CommandRelayListenerProps): null;
 

package/dist/react/index.js

@@ -24948,7 +24948,7 @@ function exposeProviderOnWindow(internals) {
   if (typeof window === "undefined") return;
   const w = window;
   const root = w.__UI_BRIDGE__ ?? (w.__UI_BRIDGE__ = {});
-  root.version = "0.9.1";
+  root.version = "0.10.0";
   root.specs = { getGlobalSpecStore };
   root.registry = internals.registry;
   root.browserCapture = internals.browserCapture;
@@ -32911,10 +32911,39 @@ function safeJsonStringify(value) {
   });
 }
 var HEARTBEAT_INTERVAL_MS = 1e4;
+function resolveAuthToken(authHeader) {
+  if (!authHeader) return null;
+  try {
+    const value = authHeader();
+    if (typeof value !== "string") return null;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : null;
+  } catch {
+    return null;
+  }
+}
+function transportHeaders(authHeader) {
+  const headers = {
+    "Content-Type": "application/json"
+  };
+  const token = resolveAuthToken(authHeader);
+  if (token) {
+    headers.Authorization = `Bearer ${token}`;
+  }
+  return headers;
+}
+function appendAuthQuery(url, authHeader) {
+  const token = resolveAuthToken(authHeader);
+  if (!token) return url;
+  const sep = url.includes("?") ? "&" : "?";
+  return `${url}${sep}_auth=${encodeURIComponent(token)}`;
+}
 function useCommandRelay(options) {
   const enabled = options?.enabled ?? true;
   const basePath = options?.basePath ?? "/api/ui-bridge";
   const heartbeatIntervalMs = options?.heartbeatInterval ?? HEARTBEAT_INTERVAL_MS;
+  const authHeaderRef = react.useRef(void 0);
+  authHeaderRef.current = options?.authHeader;
   const uiBridge = useUIBridge();
   const context = useUIBridgeOptional();
   const bridge2 = react.useMemo(
@@ -32970,7 +32999,7 @@ function useCommandRelay(options) {
       try {
         await fetch(`${basePath}/commands`, {
           method: "POST",
-          headers: { "Content-Type": "application/json" },
+          headers: transportHeaders(authHeaderRef.current),
           body: safeJsonStringify({
             commandId,
             success: ok,
@@ -33036,9 +33065,8 @@ function useCommandRelay(options) {
     let isMounted = true;
     const connect = () => {
       if (!isMounted) return;
-      const es = new EventSource(
-        `${basePath}/commands/stream${tabId ? `?tabId=${encodeURIComponent(tabId)}` : ""}`
-      );
+      const baseUrl = `${basePath}/commands/stream${tabId ? `?tabId=${encodeURIComponent(tabId)}` : ""}`;
+      const es = new EventSource(appendAuthQuery(baseUrl, authHeaderRef.current));
       eventSourceRef.current = es;
       es.onmessage = (event) => {
         try {
@@ -33125,7 +33153,7 @@ function useCommandRelay(options) {
         if (heartbeatVersion !== void 0) body.version = heartbeatVersion;
         const resp = await fetch(`${basePath}/heartbeat`, {
           method: "POST",
-          headers: { "Content-Type": "application/json" },
+          headers: transportHeaders(authHeaderRef.current),
           body: JSON.stringify(body)
         });
         if (resp.ok) {
@@ -33256,7 +33284,8 @@ function CommandRelayListener(props) {
     appType: props.appType,
     framework: props.framework,
     capabilities: props.capabilities,
-    version: props.version
+    version: props.version,
+    authHeader: props.authHeader
   };
   useCommandRelay(options);
   return null;