@bounded-sh/client 0.0.3 → 0.0.5

package/dist/{index-2UpSvA7V.js → index-ZYhdEVCA.js}

@@ -10654,6 +10654,87 @@ const pendingRequests = {};
 const GET_CACHE_TTL = 500; // Adjust this value as needed (in milliseconds)
 // Last time we cleaned up the cache
 let lastCacheCleanup = Date.now();
+/**
+ * Return the leaf document key (last path segment) for a document path.
+ *
+ * Bounded rows carry `_id` (and `pathId`) set to the FULL document path
+ * (e.g. `"rooms/r1/prompts/8rd49se3sg"`). Apps that build a child path from a
+ * row naturally want the bare doc key, not the whole path — using the full path
+ * doubles it (`rooms/r1/prompts/rooms/r1/prompts/8rd.../votes/...`) → 403/404.
+ * `docId` extracts that leaf key. Tolerates leading slashes and a trailing `*`.
+ *
+ * @example docId("rooms/r1/prompts/8rd49se3sg") // "8rd49se3sg"
+ */
+function docId(path) {
+    if (typeof path !== 'string')
+        return '';
+    let p = path.startsWith('/') ? path.slice(1) : path;
+    if (p.endsWith('*') && p.length > 1)
+        p = p.slice(0, -1);
+    if (p.endsWith('/'))
+        p = p.slice(0, -1);
+    const segments = p.split('/').filter(Boolean);
+    return segments.length ? segments[segments.length - 1] : '';
+}
+/**
+ * Additively attach a convenience bare `id` (the leaf doc key) to a returned row.
+ *
+ * Rows already carry `_id`/`pathId` = the full document path; this leaves those
+ * untouched and adds `id` = the last path segment so `row.id` is the doc key apps
+ * expect. No-ops for non-objects, arrays, and rows that already define `id`
+ * (never clobber a user field named `id`). Source for the leaf is `_id` (falling
+ * back to `pathId`/`relativePath`/`absolutePath`).
+ */
+function withBareId(row) {
+    var _a, _b, _c;
+    if (!row || typeof row !== 'object' || Array.isArray(row))
+        return row;
+    const r = row;
+    if ('id' in r)
+        return row; // don't clobber an explicit user field
+    const source = (_c = (_b = (_a = r._id) !== null && _a !== void 0 ? _a : r.pathId) !== null && _b !== void 0 ? _b : r.relativePath) !== null && _c !== void 0 ? _c : r.absolutePath;
+    if (typeof source !== 'string' || source.length === 0)
+        return row;
+    const leaf = docId(source);
+    if (!leaf)
+        return row;
+    return Object.assign(Object.assign({}, r), { id: leaf });
+}
+/**
+ * Normalize a raw read response from the worker into the SDK's stable shape and
+ * attach the bare `id` to every returned row (Bug 1 + Bug 2).
+ *
+ * - Single-document path: returns EXACTLY ONE shape — the resolved document, or
+ *   `null` if missing (Firebase/Mongo convention). Unwraps the ambiguous
+ *   `{ data, status }` envelope the worker sometimes emits for a single doc so a
+ *   single-doc `get` never sometimes-returns the doc and sometimes the envelope.
+ * - Collection path: preserves the `{ data, nextCursor, ... }` envelope and maps
+ *   the bare `id` onto each row in `data`.
+ */
+function normalizeReadResult(responseData, pathIsDocument) {
+    if (pathIsDocument) {
+        let doc = responseData;
+        // Unwrap the single-doc envelope `{ data, status }` (Bug 2). A real document
+        // never has the exact shape `{ data, status }` with nothing else meaningful,
+        // so detect the envelope by `data` being present alongside a numeric `status`.
+        if (doc && typeof doc === 'object' && !Array.isArray(doc) &&
+            'data' in doc && 'status' in doc && typeof doc.status === 'number') {
+            doc = doc.data;
+        }
+        if (doc === undefined || doc === null)
+            return null;
+        return withBareId(doc);
+    }
+    // Collection read. The worker body is `{ data: rows[], nextCursor?, status? }`.
+    if (responseData && typeof responseData === 'object' && !Array.isArray(responseData) && Array.isArray(responseData.data)) {
+        return Object.assign(Object.assign({}, responseData), { data: responseData.data.map((row) => withBareId(row)) });
+    }
+    // Some paths return a bare array of rows — map id onto each.
+    if (Array.isArray(responseData)) {
+        return responseData.map((row) => withBareId(row));
+    }
+    return responseData;
+}
 function hashForKey$1(value) {
     let h = 5381;
     for (let i = 0; i < value.length; i++) {
@@ -11078,7 +11159,7 @@ async function get(path, opts = {}) {
                         if (hasActiveConnection()) {
                             if (pathIsDocument) {
                                 const wsResult = await wsGet(normalizedPath);
-                                const responseData = wsResult;
+                                const responseData = normalizeReadResult(wsResult, true);
                                 if (!opts.bypassCache) {
                                     getCache[cacheKey] = { data: responseData, expiresAt: now + GET_CACHE_TTL };
                                 }
@@ -11090,7 +11171,7 @@ async function get(path, opts = {}) {
                                     sort: undefined,
                                     includeSubPaths: opts.includeSubPaths,
                                 });
-                                const responseData = wsResult;
+                                const responseData = normalizeReadResult(wsResult, false);
                                 if (!opts.bypassCache) {
                                     getCache[cacheKey] = { data: responseData, expiresAt: now + GET_CACHE_TTL };
                                 }
@@ -11121,7 +11202,11 @@ async function get(path, opts = {}) {
                     const apiPath = `items?path=${path}${promptQueryParam}${filterParam}${sortParam}${includeSubPathsParam}${shapeParam}${limitParam}${cursorParam}`;
                     response = await makeApiRequest('GET', apiPath, null, opts._overrides);
                 }
-                const responseData = response.data;
+                // Normalize the worker's raw body into the SDK's stable shape:
+                //   - single-doc path → the resolved document or null (Bug 2), and
+                //   - collection path → `{ data, nextCursor }` preserved,
+                // with the bare `id` (leaf doc key) attached to every returned row (Bug 1).
+                const responseData = normalizeReadResult(response.data, pathIsDocument);
                 // Cache the response (unless bypassing cache)
                 if (!opts.bypassCache) {
                     getCache[cacheKey] = {
@@ -11219,11 +11304,16 @@ async function getMany(paths, opts = {}) {
                 const normalizedPath = uncachedPaths[i];
                 const serverResult = serverResultsMap.get(normalizedPath);
                 if (serverResult) {
-                    results[originalIndex] = serverResult;
-                    if (!serverResult.error && !opts.bypassCache) {
+                    // getMany batches single-doc paths — attach the bare `id` (leaf doc
+                    // key) to each returned doc, additive (Bug 1), matching get().
+                    const normalizedResult = serverResult.error
+                        ? serverResult
+                        : Object.assign(Object.assign({}, serverResult), { data: withBareId(serverResult.data) });
+                    results[originalIndex] = normalizedResult;
+                    if (!normalizedResult.error && !opts.bypassCache) {
                         const cacheKey = `${principalKey}|${normalizedPath}:`;
                         getCache[cacheKey] = {
-                            data: serverResult.data,
+                            data: normalizedResult.data,
                             expiresAt: now + GET_CACHE_TTL
                         };
                     }
@@ -11768,6 +11858,7 @@ var operations = /*#__PURE__*/Object.freeze({
     aggregate: aggregate,
     clearReadCacheForAuthChange: clearReadCacheForAuthChange,
     count: count,
+    docId: docId,
     get: get,
     getFiles: getFiles,
     getMany: getMany,
@@ -12355,14 +12446,46 @@ function handleServerMessage(connection, message) {
         }
     }
 }
+/**
+ * Additively attach the bare `id` (leaf doc key) to a subscription row (Bug 1).
+ * Rows carry `_id`/`pathId` = the full document path; this leaves those as-is and
+ * adds `id` = the last path segment so `row.id` is the doc key apps expect. No-ops
+ * for non-objects and rows that already define `id`.
+ */
+function withSubscriptionId(row) {
+    var _a, _b, _c;
+    if (!row || typeof row !== 'object' || Array.isArray(row))
+        return row;
+    if ('id' in row)
+        return row;
+    const source = (_c = (_b = (_a = row._id) !== null && _a !== void 0 ? _a : row.pathId) !== null && _b !== void 0 ? _b : row.relativePath) !== null && _c !== void 0 ? _c : row.absolutePath;
+    if (typeof source !== 'string' || source.length === 0)
+        return row;
+    const leaf = docId(source);
+    if (!leaf)
+        return row;
+    return Object.assign(Object.assign({}, row), { id: leaf });
+}
+/**
+ * The `onData` payload follows the path: a collection delivers a bare array of
+ * rows, a single-doc path delivers the document (or null). Attach the bare `id`
+ * to each returned row in either case, additive (Bug 1).
+ */
+function addIdsToSubscriptionData(data) {
+    if (Array.isArray(data))
+        return data.map(withSubscriptionId);
+    return withSubscriptionId(data);
+}
 function notifyCallbacks(subscription, data) {
     var _a;
+    // Attach the bare `id` (leaf doc key) to every delivered row (Bug 1).
+    const decorated = addIdsToSubscriptionData(data);
     // Snapshot the callbacks array so that unsubscriptions during
     // notification don't cause callbacks to be skipped.
     const callbacks = subscription.callbacks.slice();
     for (const callback of callbacks) {
         try {
-            (_a = callback.onData) === null || _a === void 0 ? void 0 : _a.call(callback, data);
+            (_a = callback.onData) === null || _a === void 0 ? void 0 : _a.call(callback, decorated);
         }
         catch (error) {
             console.error('[WS v2] Error in subscription callback:', error);
@@ -12453,7 +12576,7 @@ async function subscribeV2(path, subscriptionOptions, roomRoutePath) {
     if (cachedEntry && Date.now() - cachedEntry.timestamp < CACHE_TTL && subscriptionOptions.onData) {
         setTimeout(() => {
             var _a;
-            (_a = subscriptionOptions.onData) === null || _a === void 0 ? void 0 : _a.call(subscriptionOptions, cachedEntry.data);
+            (_a = subscriptionOptions.onData) === null || _a === void 0 ? void 0 : _a.call(subscriptionOptions, addIdsToSubscriptionData(cachedEntry.data));
         }, 0);
     }
     // Get or create connection for this routing target (room-scoped when a
@@ -12483,7 +12606,7 @@ async function subscribeV2(path, subscriptionOptions, roomRoutePath) {
         if (existingSubscription.lastData !== undefined && subscriptionOptions.onData) {
             setTimeout(() => {
                 var _a;
-                (_a = subscriptionOptions.onData) === null || _a === void 0 ? void 0 : _a.call(subscriptionOptions, existingSubscription.lastData);
+                (_a = subscriptionOptions.onData) === null || _a === void 0 ? void 0 : _a.call(subscriptionOptions, addIdsToSubscriptionData(existingSubscription.lastData));
             }, 0);
         }
         return async () => {
@@ -12991,6 +13114,73 @@ function serverTimestamp() {
     return { operation: 'time', value: 'now' };
 }
 
+/**
+ * Time units in Bounded — read this once and never get a 1000× timestamp bug.
+ *
+ * **Bounded's policy/proof layer is Unix SECONDS.** `@time.now` in a rule,
+ * `rollingSum` `windowSeconds`, `scheduledAt`, and any timestamp *field your
+ * policy compares against `@time.now`* are all **seconds**. (This is also what
+ * the chain uses — Solana's on-chain clock is `unix_timestamp` in seconds — so a
+ * single seconds unit works for both onchain and offchain rules.)
+ *
+ * **JavaScript is MILLISECONDS.** `Date.now()`, `new Date().getTime()`, and the
+ * auto-stamped system fields `_createdAt` / `_updatedAt` are all **ms**.
+ *
+ * Comparing across the two (e.g. `@time.now - myField` where `myField` was set
+ * from `Date.now()`) is 1000× off, so a freshness / TTL check silently treats
+ * every row as ancient (or far-future) and drops it — which reads as "realtime
+ * isn't delivering" when the data is actually fine.
+ *
+ * **The rules:**
+ * - To **write** a timestamp a policy will read, prefer **`serverTimestamp()`**
+ *   (from this package) — the *server* stamps it in seconds, so it matches
+ *   `@time.now` AND can't be forged by the client (use it for TTLs, rate windows,
+ *   anti-cheat). Use `now()` only when you need the value in client code before
+ *   the write.
+ * - To **compare** timestamps in client/render code, use `now()` (seconds), not
+ *   `Date.now()` (ms), and `toSeconds()` to convert the ms system fields
+ *   (`_createdAt`/`_updatedAt`) or any `Date.now()` value first.
+ */
+/**
+ * Current time as a **Unix timestamp in seconds** — the unit Bounded policy rules
+ * use (`@time.now`). Use this (not `Date.now()`) when you need a timestamp in
+ * client code (e.g. a freshness check). For a value you *store* and a policy
+ * reads, prefer the server-authoritative {@link serverTimestamp} instead.
+ *
+ * ```ts
+ * // stale if >15s old — seconds vs seconds ✓
+ * if (now() - doc.lastSeenSeconds > 15) renderStale();
+ * ```
+ */
+function now() {
+    return Math.floor(Date.now() / 1000);
+}
+/**
+ * Convert a JavaScript millisecond timestamp to Bounded's **seconds**. Accepts a
+ * `Date`, or an ms number such as `Date.now()` or a doc's `_createdAt` /
+ * `_updatedAt` system field.
+ *
+ * ```ts
+ * // doc is >15s old (compare the ms system field in seconds):
+ * if (now() - toSeconds(doc._updatedAt) > 15) renderStale();
+ * ```
+ */
+function toSeconds(msOrDate) {
+    const ms = msOrDate instanceof Date ? msOrDate.getTime() : msOrDate;
+    return Math.floor(ms / 1000);
+}
+/**
+ * Convert a Bounded **seconds** timestamp back to JavaScript **milliseconds** —
+ * e.g. to build a `Date` or do client-side date math/formatting.
+ *
+ * ```ts
+ * new Date(toMillis(doc.createdAtSeconds)).toLocaleString();
+ * ```
+ */
+function toMillis(seconds) {
+    return seconds * 1000;
+}
+
 // ---------------------------------------------------------------------------
 // realtime-store.ts — Client-side state manager for realtime apps.
 //
@@ -21559,17 +21749,17 @@ function setAuthProviderInstance(provider) {
     authProviderInstance = provider;
 }
 
-var _a;
+var _a$1;
 // Whether we're in a server-side rendering context (no hooks allowed).
 // React Native has no `window` but DOES support hooks.
 // We detect Node SSR specifically via process.versions.node to avoid
 // false positives from Node 21+ which defines `navigator` globally.
-const isSSR = typeof window === 'undefined'
+const isSSR$1 = typeof window === 'undefined'
     && typeof process !== 'undefined'
-    && !!((_a = process.versions) === null || _a === void 0 ? void 0 : _a.node);
+    && !!((_a$1 = process.versions) === null || _a$1 === void 0 ? void 0 : _a$1.node);
 function useAuth() {
     // Provide a fallback so server render doesn't break
-    if (isSSR) {
+    if (isSSR$1) {
         return {
             login: async () => undefined,
             logout: async () => undefined,
@@ -21629,6 +21819,66 @@ function useAuth() {
     };
 }
 
+var _a;
+// SSR guard (mirrors useAuth): no hooks/subscriptions during Node server render.
+// React Native has no `window` but DOES support hooks, so detect Node SSR
+// specifically via process.versions.node.
+const isSSR = typeof window === 'undefined'
+    && typeof process !== 'undefined'
+    && !!((_a = process.versions) === null || _a === void 0 ? void 0 : _a.node);
+function useQuery(path, options) {
+    if (isSSR) {
+        return { data: undefined, loading: true, error: null };
+    }
+    const [data, setData] = React__namespace.useState(undefined);
+    const [loading, setLoading] = React__namespace.useState(true);
+    const [error, setError] = React__namespace.useState(null);
+    // Re-subscribe only when the query actually changes (not on every render).
+    const optionsKey = options ? JSON.stringify(options) : '';
+    React__namespace.useEffect(() => {
+        if (!path) {
+            setData(undefined);
+            setLoading(false);
+            setError(null);
+            return;
+        }
+        let active = true;
+        let unsubscribe;
+        setLoading(true);
+        setError(null);
+        subscribe(path, Object.assign(Object.assign({}, options), { onData: (d) => {
+                if (!active)
+                    return;
+                setData(d);
+                setLoading(false);
+            }, onError: (e) => {
+                if (!active)
+                    return;
+                setError(e instanceof Error ? e : new Error(String(e)));
+                setLoading(false);
+            } }))
+            .then((unsub) => {
+            if (active)
+                unsubscribe = unsub;
+            else
+                void unsub(); // unmounted before subscribe resolved
+        })
+            .catch((e) => {
+            if (!active)
+                return;
+            setError(e instanceof Error ? e : new Error(String(e)));
+            setLoading(false);
+        });
+        return () => {
+            active = false;
+            void (unsubscribe === null || unsubscribe === void 0 ? void 0 : unsubscribe());
+        };
+        // optionsKey captures the option object's contents; path is the other input.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [path, optionsKey]);
+    return { data, loading, error };
+}
+
 async function deserializeTransaction(tx) {
     const buf = Buffer.isBuffer(tx) ? tx : Buffer.from(tx, 'base64');
     if ((buf[0] & 0x80) !== 0) {
@@ -21762,7 +22012,7 @@ async function loadDependencies() {
         const [reactModule, reactDomModule, phantomModule] = await Promise.all([
             import('react'),
             import('react-dom/client'),
-            Promise.resolve().then(function () { return require('./index-CYVVTWs4.js'); })
+            Promise.resolve().then(function () { return require('./index-CdqFc68L.js'); })
         ]);
         // Extract default export from ESM module namespace
         // Dynamic import() returns { default: Module, ...exports }, not the module directly
@@ -23663,7 +23913,7 @@ async function registerMobileWalletAdapter(config) {
     if (typeof window === 'undefined')
         return;
     try {
-        const walletStandardMobile = await Promise.resolve().then(function () { return require('./index.browser-BTJZmhY1.js'); });
+        const walletStandardMobile = await Promise.resolve().then(function () { return require('./index.browser-sADlt75X.js'); });
         const registerMwa = walletStandardMobile.registerMwa || ((_a = walletStandardMobile.default) === null || _a === void 0 ? void 0 : _a.registerMwa);
         if (!registerMwa) {
             console.warn('[SolanaMobileWallet] registerMwa not found in @solana-mobile/wallet-standard-mobile');
@@ -23802,7 +24052,7 @@ class SolanaMobileWalletProvider {
     async ensureWallet() {
         if (this.wallet)
             return this.wallet;
-        const mod = await Promise.resolve().then(function () { return require('./index.browser-BTJZmhY1.js'); });
+        const mod = await Promise.resolve().then(function () { return require('./index.browser-sADlt75X.js'); });
         const chain = mapChainToWalletStandard(this.cluster);
         this.wallet = new mod.LocalSolanaMobileWalletAdapterWallet({
             appIdentity: this.appIdentity,
@@ -25964,6 +26214,7 @@ exports.createSessionWithSignature = createSessionWithSignature;
 exports.defineLiveModule = defineLiveModule;
 exports.deriveUserIdentityFromIdToken = deriveUserIdentityFromIdToken;
 exports.deserializeTransaction = deserializeTransaction;
+exports.docId = docId;
 exports.functions = functions;
 exports.genAuthNonce = genAuthNonce;
 exports.genSolanaMessage = genSolanaMessage;
@@ -25996,6 +26247,7 @@ exports.loginWithPopup = loginWithPopup;
 exports.loginWithPrivy = loginWithPrivy;
 exports.loginWithRedirect = loginWithRedirect;
 exports.logout = logout;
+exports.now = now;
 exports.onAuthLoadingChanged = onAuthLoadingChanged;
 exports.onAuthStateChanged = onAuthStateChanged;
 exports.queryAggregate = queryAggregate;
@@ -26023,7 +26275,10 @@ exports.signTransaction = signTransaction;
 exports.status = status;
 exports.subscribe = subscribe;
 exports.subscribeView = subscribeView;
+exports.toMillis = toMillis;
+exports.toSeconds = toSeconds;
 exports.useAuth = useAuth;
+exports.useQuery = useQuery;
 exports.verifyEmailOtp = verifyEmailOtp;
 exports.withEffects = withEffects;
 exports.wsDelete = wsDelete;
@@ -26031,4 +26286,4 @@ exports.wsGet = wsGet;
 exports.wsGetMany = wsGetMany;
 exports.wsQuery = wsQuery;
 exports.wsSet = wsSet;
-//# sourceMappingURL=index-2UpSvA7V.js.map
+//# sourceMappingURL=index-ZYhdEVCA.js.map