@qontinui/ui-bridge 0.9.1 → 0.11.0

package/dist/react/index.d.mts

@@ -1616,6 +1616,30 @@ interface UseCommandRelayOptions {
      * build-time defaults baked into a static config).
      */
     version?: string;
+    /**
+     * Optional hook that returns the current session token (the raw token
+     * value, WITHOUT a `Bearer ` prefix). When supplied and returns a
+     * non-empty string, the SDK:
+     *
+     *   - attaches `Authorization: Bearer <value>` to outbound
+     *     `POST {basePath}/commands` and `POST {basePath}/heartbeat`;
+     *   - attaches `Authorization: Bearer <value>` to the SSE
+     *     `GET {basePath}/commands/stream` request as well — the stream is
+     *     consumed via `fetch` streaming, so the header rides on the request
+     *     (no token in the URL).
+     *
+     * Called fresh on every outbound request — implementations should read
+     * the token from a live source (e.g. `sessionStorage`) so a token
+     * rotation is picked up without remounting the listener. Returning
+     * `null` / `undefined` / empty string means "no auth this call" and
+     * the transport falls back to legacy unauth'd / cookie-based behavior
+     * (matching the SDK's pre-`authHeader` shape).
+     *
+     * Required to authenticate against any relay endpoint that enforces a
+     * session-bound auth gate (e.g. qontinui-web's
+     * `UI_BRIDGE_REQUIRE_AUTH=1` mode).
+     */
+    authHeader?: () => string | null | undefined;
 }
 /**
  * Hook that connects the browser to the server's command relay.
@@ -1660,6 +1684,14 @@ interface CommandRelayListenerProps {
      * defaults baked into the static config.
      */
     version?: string;
+    /**
+     * Optional hook returning the current session token (raw value, no
+     * `Bearer ` prefix). When supplied, the SDK attaches
+     * `Authorization: Bearer <value>` to outbound `POST /commands` and
+     * `POST /heartbeat` and appends `_auth=<value>` to the SSE URL.
+     * See `UseCommandRelayOptions.authHeader` for the full contract.
+     */
+    authHeader?: () => string | null | undefined;
 }
 declare function CommandRelayListener(props: CommandRelayListenerProps): null;
 

package/dist/react/index.d.ts

@@ -1616,6 +1616,30 @@ interface UseCommandRelayOptions {
      * build-time defaults baked into a static config).
      */
     version?: string;
+    /**
+     * Optional hook that returns the current session token (the raw token
+     * value, WITHOUT a `Bearer ` prefix). When supplied and returns a
+     * non-empty string, the SDK:
+     *
+     *   - attaches `Authorization: Bearer <value>` to outbound
+     *     `POST {basePath}/commands` and `POST {basePath}/heartbeat`;
+     *   - attaches `Authorization: Bearer <value>` to the SSE
+     *     `GET {basePath}/commands/stream` request as well — the stream is
+     *     consumed via `fetch` streaming, so the header rides on the request
+     *     (no token in the URL).
+     *
+     * Called fresh on every outbound request — implementations should read
+     * the token from a live source (e.g. `sessionStorage`) so a token
+     * rotation is picked up without remounting the listener. Returning
+     * `null` / `undefined` / empty string means "no auth this call" and
+     * the transport falls back to legacy unauth'd / cookie-based behavior
+     * (matching the SDK's pre-`authHeader` shape).
+     *
+     * Required to authenticate against any relay endpoint that enforces a
+     * session-bound auth gate (e.g. qontinui-web's
+     * `UI_BRIDGE_REQUIRE_AUTH=1` mode).
+     */
+    authHeader?: () => string | null | undefined;
 }
 /**
  * Hook that connects the browser to the server's command relay.
@@ -1660,6 +1684,14 @@ interface CommandRelayListenerProps {
      * defaults baked into the static config.
      */
     version?: string;
+    /**
+     * Optional hook returning the current session token (raw value, no
+     * `Bearer ` prefix). When supplied, the SDK attaches
+     * `Authorization: Bearer <value>` to outbound `POST /commands` and
+     * `POST /heartbeat` and appends `_auth=<value>` to the SSE URL.
+     * See `UseCommandRelayOptions.authHeader` for the full contract.
+     */
+    authHeader?: () => string | null | undefined;
 }
 declare function CommandRelayListener(props: CommandRelayListenerProps): null;
 

package/dist/react/index.js

@@ -24948,7 +24948,7 @@ function exposeProviderOnWindow(internals) {
   if (typeof window === "undefined") return;
   const w = window;
   const root = w.__UI_BRIDGE__ ?? (w.__UI_BRIDGE__ = {});
-  root.version = "0.9.1";
+  root.version = "0.11.0";
   root.specs = { getGlobalSpecStore };
   root.registry = internals.registry;
   root.browserCapture = internals.browserCapture;
@@ -32911,10 +32911,44 @@ function safeJsonStringify(value) {
   });
 }
 var HEARTBEAT_INTERVAL_MS = 1e4;
+function resolveAuthToken(authHeader) {
+  if (!authHeader) return null;
+  try {
+    const value = authHeader();
+    if (typeof value !== "string") return null;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : null;
+  } catch {
+    return null;
+  }
+}
+function transportHeaders(authHeader) {
+  const headers = {
+    "Content-Type": "application/json"
+  };
+  const token = resolveAuthToken(authHeader);
+  if (token) {
+    headers.Authorization = `Bearer ${token}`;
+  }
+  return headers;
+}
+function parseSSEDataBlock(block) {
+  const dataLines = [];
+  for (const line of block.split("\n")) {
+    if (line.startsWith(":")) continue;
+    if (!line.startsWith("data:")) continue;
+    let value = line.slice(5);
+    if (value.startsWith(" ")) value = value.slice(1);
+    dataLines.push(value);
+  }
+  return dataLines.length > 0 ? dataLines.join("\n") : null;
+}
 function useCommandRelay(options) {
   const enabled = options?.enabled ?? true;
   const basePath = options?.basePath ?? "/api/ui-bridge";
   const heartbeatIntervalMs = options?.heartbeatInterval ?? HEARTBEAT_INTERVAL_MS;
+  const authHeaderRef = react.useRef(void 0);
+  authHeaderRef.current = options?.authHeader;
   const uiBridge = useUIBridge();
   const context = useUIBridgeOptional();
   const bridge2 = react.useMemo(
@@ -32947,7 +32981,6 @@ function useCommandRelay(options) {
     }),
     [uiBridge, context]
   );
-  const eventSourceRef = react.useRef(null);
   const reconnectTimeoutRef = react.useRef(null);
   const processCommandRef = react.useRef(() => {
   });
@@ -32970,7 +33003,7 @@ function useCommandRelay(options) {
       try {
         await fetch(`${basePath}/commands`, {
           method: "POST",
-          headers: { "Content-Type": "application/json" },
+          headers: transportHeaders(authHeaderRef.current),
           body: safeJsonStringify({
             commandId,
             success: ok,
@@ -33023,10 +33056,6 @@ function useCommandRelay(options) {
   processCommandRef.current = processCommand;
   react.useEffect(() => {
     if (!enabled) {
-      if (eventSourceRef.current) {
-        eventSourceRef.current.close();
-        eventSourceRef.current = null;
-      }
       if (reconnectTimeoutRef.current) {
         clearTimeout(reconnectTimeoutRef.current);
         reconnectTimeoutRef.current = null;
@@ -33034,35 +33063,73 @@ function useCommandRelay(options) {
       return;
     }
     let isMounted = true;
+    let abortController = null;
+    const closeStream = () => {
+      if (abortController) {
+        abortController.abort();
+        abortController = null;
+      }
+    };
+    const scheduleReconnect = () => {
+      if (!isMounted) return;
+      if (reconnectTimeoutRef.current) return;
+      reconnectTimeoutRef.current = setTimeout(() => {
+        reconnectTimeoutRef.current = null;
+        if (isMounted) connect();
+      }, SSE_RECONNECT_DELAY_MS);
+    };
     const connect = () => {
       if (!isMounted) return;
-      const es = new EventSource(
-        `${basePath}/commands/stream${tabId ? `?tabId=${encodeURIComponent(tabId)}` : ""}`
-      );
-      eventSourceRef.current = es;
-      es.onmessage = (event) => {
-        try {
-          const data = JSON.parse(event.data);
-          if (data.type === "connected") return;
-          if (data.commandId && data.action) processCommandRef.current(data);
-        } catch (e) {
-          console.error("[UIBridge] Failed to parse SSE message:", e);
+      closeStream();
+      const controller = new AbortController();
+      abortController = controller;
+      const url = `${basePath}/commands/stream${tabId ? `?tabId=${encodeURIComponent(tabId)}` : ""}`;
+      const headers = { Accept: "text/event-stream" };
+      const token = resolveAuthToken(authHeaderRef.current);
+      if (token) headers.Authorization = `Bearer ${token}`;
+      fetch(url, { method: "GET", headers, signal: controller.signal, cache: "no-store" }).then(async (resp) => {
+        if (!resp.ok || !resp.body) {
+          if (abortController === controller) abortController = null;
+          scheduleReconnect();
+          return;
         }
-      };
-      es.onerror = () => {
-        es.close();
-        if (eventSourceRef.current === es) eventSourceRef.current = null;
-        if (isMounted) {
-          reconnectTimeoutRef.current = setTimeout(() => {
-            reconnectTimeoutRef.current = null;
-            if (isMounted) connect();
-          }, SSE_RECONNECT_DELAY_MS);
+        const reader = resp.body.getReader();
+        const decoder = new TextDecoder();
+        let buffer = "";
+        try {
+          for (; ; ) {
+            const { value, done } = await reader.read();
+            if (done) break;
+            buffer += decoder.decode(value, { stream: true });
+            let sep;
+            while ((sep = buffer.indexOf("\n\n")) !== -1) {
+              const block = buffer.slice(0, sep);
+              buffer = buffer.slice(sep + 2);
+              const data = parseSSEDataBlock(block);
+              if (data == null) continue;
+              try {
+                const parsed = JSON.parse(data);
+                if (parsed.type === "connected") continue;
+                if (parsed.commandId && parsed.action) {
+                  processCommandRef.current(parsed);
+                }
+              } catch (e) {
+                console.error("[UIBridge] Failed to parse SSE message:", e);
+              }
+            }
+          }
+        } catch {
         }
-      };
+        if (abortController === controller) abortController = null;
+        if (isMounted && !controller.signal.aborted) scheduleReconnect();
+      }).catch(() => {
+        if (abortController === controller) abortController = null;
+        if (isMounted && !controller.signal.aborted) scheduleReconnect();
+      });
     };
     const handleVisibility = () => {
       if (document.visibilityState === "visible") {
-        if (!eventSourceRef.current) {
+        if (!abortController) {
           if (reconnectTimeoutRef.current) {
             clearTimeout(reconnectTimeoutRef.current);
             reconnectTimeoutRef.current = null;
@@ -33075,10 +33142,7 @@ function useCommandRelay(options) {
     document.addEventListener("visibilitychange", handleVisibility);
     forceReconnectRef.current = () => {
       if (!isMounted) return;
-      if (eventSourceRef.current) {
-        eventSourceRef.current.close();
-        eventSourceRef.current = null;
-      }
+      closeStream();
       if (reconnectTimeoutRef.current) {
         clearTimeout(reconnectTimeoutRef.current);
         reconnectTimeoutRef.current = null;
@@ -33089,10 +33153,7 @@ function useCommandRelay(options) {
       isMounted = false;
       forceReconnectRef.current = () => {
       };
-      if (eventSourceRef.current) {
-        eventSourceRef.current.close();
-        eventSourceRef.current = null;
-      }
+      closeStream();
       if (reconnectTimeoutRef.current) {
         clearTimeout(reconnectTimeoutRef.current);
         reconnectTimeoutRef.current = null;
@@ -33125,7 +33186,7 @@ function useCommandRelay(options) {
         if (heartbeatVersion !== void 0) body.version = heartbeatVersion;
         const resp = await fetch(`${basePath}/heartbeat`, {
           method: "POST",
-          headers: { "Content-Type": "application/json" },
+          headers: transportHeaders(authHeaderRef.current),
           body: JSON.stringify(body)
         });
         if (resp.ok) {
@@ -33256,7 +33317,8 @@ function CommandRelayListener(props) {
     appType: props.appType,
     framework: props.framework,
     capabilities: props.capabilities,
-    version: props.version
+    version: props.version,
+    authHeader: props.authHeader
   };
   useCommandRelay(options);
   return null;