@bounded-sh/core 0.0.1 → 0.0.3

package/dist/index.js

@@ -95,7 +95,7 @@ function getWebhookKeysUrl() {
 /**
  * True when init() configured a Bounded network (the Cloudflare-native stack).
  * Synchronous + non-blocking. Used to route reads/writes that behave differently
- * on Bounded vs the legacy Tarobase backend (e.g. `count`/`aggregate`, which on
+ * on Bounded vs the legacy backend (e.g. `count`/`aggregate`, which on
  * Bounded must use the deterministic server aggregation, not the legacy AI query).
  */
 function isBoundedNetwork() {
@@ -2950,7 +2950,7 @@ class WebSessionManager {
         // the RIGHT /session/refresh. Email overrides with humanAuthApiUrl; all
         // wallet/guest/signature flows default to authApiUrl (the bounded-auth issuer).
         const sessionIssuer = (issuer || config.authApiUrl || "").replace(/\/$/, "");
-        localStorage.setItem(this.TAROBASE_SESSION_STORAGE_KEY, JSON.stringify(Object.assign({ address,
+        localStorage.setItem(this.BOUNDED_SESSION_STORAGE_KEY, JSON.stringify(Object.assign({ address,
             accessToken,
             idToken,
             refreshToken, appId: currentAppId }, (sessionIssuer ? { issuer: sessionIssuer } : {}))));
@@ -2961,7 +2961,7 @@ class WebSessionManager {
     static async getSession() {
         if (typeof window === "undefined")
             return null;
-        const session = localStorage.getItem(this.TAROBASE_SESSION_STORAGE_KEY);
+        const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
         if (!session)
             return null;
         const sessionObj = JSON.parse(session);
@@ -2985,7 +2985,7 @@ class WebSessionManager {
                     // Persist the ROTATED refresh token — the old one is now
                     // single-use spent; reusing it would revoke the family.
                     refreshed.refreshToken);
-                    const newSession = localStorage.getItem(this.TAROBASE_SESSION_STORAGE_KEY);
+                    const newSession = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
                     if (!newSession)
                         return null;
                     const newObj = JSON.parse(newSession);
@@ -3009,14 +3009,14 @@ class WebSessionManager {
     static clearSession() {
         if (typeof window === "undefined")
             return;
-        localStorage.removeItem(this.TAROBASE_SESSION_STORAGE_KEY);
+        localStorage.removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
     }
     /* ------------------------------------------------------------------ */
     /* IS-AUTH                                                            */
     /* ------------------------------------------------------------------ */
     static isAuthenticated() {
         // NOTE: this remains synchronous to stay backward compatible
-        return !!localStorage.getItem(this.TAROBASE_SESSION_STORAGE_KEY);
+        return !!localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
     }
     /* ------------------------------------------------------------------ */
     /* TOKEN HELPERS                                                      */
@@ -3024,13 +3024,13 @@ class WebSessionManager {
     static getIdToken() {
         if (typeof window === "undefined")
             return null;
-        const session = localStorage.getItem(this.TAROBASE_SESSION_STORAGE_KEY);
+        const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
         return session ? JSON.parse(session).idToken : null;
     }
     static getRefreshToken() {
         if (typeof window === "undefined")
             return null;
-        const session = localStorage.getItem(this.TAROBASE_SESSION_STORAGE_KEY);
+        const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
         return session ? JSON.parse(session).refreshToken : null;
     }
     /** The issuer base that minted this session (for routing silent refresh). */
@@ -3038,7 +3038,7 @@ class WebSessionManager {
         var _a;
         if (typeof window === "undefined")
             return null;
-        const session = localStorage.getItem(this.TAROBASE_SESSION_STORAGE_KEY);
+        const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
         return session ? ((_a = JSON.parse(session).issuer) !== null && _a !== void 0 ? _a : null) : null;
     }
     /* ------------------------------------------------------------------ */
@@ -3048,7 +3048,7 @@ class WebSessionManager {
         var _a;
         if (typeof window === "undefined")
             return;
-        const session = localStorage.getItem(this.TAROBASE_SESSION_STORAGE_KEY);
+        const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
         if (!session)
             return;
         const sessionObj = JSON.parse(session);
@@ -3065,10 +3065,10 @@ class WebSessionManager {
             sessionObj.refreshToken = refreshToken;
         }
         (_a = sessionObj.appId) !== null && _a !== void 0 ? _a : (sessionObj.appId = config.appId);
-        localStorage.setItem(this.TAROBASE_SESSION_STORAGE_KEY, JSON.stringify(sessionObj));
+        localStorage.setItem(this.BOUNDED_SESSION_STORAGE_KEY, JSON.stringify(sessionObj));
     }
 }
-WebSessionManager.TAROBASE_SESSION_STORAGE_KEY = "tarobase_session_storage";
+WebSessionManager.BOUNDED_SESSION_STORAGE_KEY = "bounded_session_storage";
 
 let _config = null;
 class ReactNativeSessionManager {
@@ -3161,7 +3161,7 @@ class ReactNativeSessionManager {
         // Issuer base for silent refresh (email overrides w/ humanAuthApiUrl; wallet/
         // guest default to authApiUrl). See WebSessionManager for the rationale.
         const sessionIssuer = (issuer || config.authApiUrl || "").replace(/\/$/, "");
-        this.getStorage().setItem(this.TAROBASE_SESSION_STORAGE_KEY, JSON.stringify(Object.assign({ address,
+        this.getStorage().setItem(this.BOUNDED_SESSION_STORAGE_KEY, JSON.stringify(Object.assign({ address,
             accessToken,
             idToken,
             refreshToken, appId: currentAppId }, (sessionIssuer ? { issuer: sessionIssuer } : {}))));
@@ -3170,7 +3170,7 @@ class ReactNativeSessionManager {
     /* GET                                                                */
     /* ------------------------------------------------------------------ */
     static async getSession() {
-        const session = this.getStorage().getItem(this.TAROBASE_SESSION_STORAGE_KEY);
+        const session = this.getStorage().getItem(this.BOUNDED_SESSION_STORAGE_KEY);
         if (!session)
             return null;
         const sessionObj = JSON.parse(session);
@@ -3191,7 +3191,7 @@ class ReactNativeSessionManager {
                 const refreshed = await refreshSession(refreshToken, sessionObj.issuer);
                 if ((refreshed === null || refreshed === void 0 ? void 0 : refreshed.idToken) && (refreshed === null || refreshed === void 0 ? void 0 : refreshed.accessToken)) {
                     await this.updateIdTokenAndAccessToken(refreshed.idToken, refreshed.accessToken, refreshed.refreshToken);
-                    const newSession = this.getStorage().getItem(this.TAROBASE_SESSION_STORAGE_KEY);
+                    const newSession = this.getStorage().getItem(this.BOUNDED_SESSION_STORAGE_KEY);
                     if (!newSession)
                         return null;
                     const newObj = JSON.parse(newSession);
@@ -3213,20 +3213,20 @@ class ReactNativeSessionManager {
     /* CLEAR                                                              */
     /* ------------------------------------------------------------------ */
     static clearSession() {
-        this.getStorage().removeItem(this.TAROBASE_SESSION_STORAGE_KEY);
+        this.getStorage().removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
     }
     /* ------------------------------------------------------------------ */
     /* IS-AUTH                                                            */
     /* ------------------------------------------------------------------ */
     static isAuthenticated() {
-        return !!this.getStorage().getItem(this.TAROBASE_SESSION_STORAGE_KEY);
+        return !!this.getStorage().getItem(this.BOUNDED_SESSION_STORAGE_KEY);
     }
     /* ------------------------------------------------------------------ */
     /* TOKEN HELPERS                                                      */
     /* ------------------------------------------------------------------ */
     static getIdToken() {
         try {
-            const session = this.getStorage().getItem(this.TAROBASE_SESSION_STORAGE_KEY);
+            const session = this.getStorage().getItem(this.BOUNDED_SESSION_STORAGE_KEY);
             return session ? JSON.parse(session).idToken : null;
         }
         catch (_a) {
@@ -3237,7 +3237,7 @@ class ReactNativeSessionManager {
     static getIssuer() {
         var _a;
         try {
-            const session = this.getStorage().getItem(this.TAROBASE_SESSION_STORAGE_KEY);
+            const session = this.getStorage().getItem(this.BOUNDED_SESSION_STORAGE_KEY);
             return session ? ((_a = JSON.parse(session).issuer) !== null && _a !== void 0 ? _a : null) : null;
         }
         catch (_b) {
@@ -3246,7 +3246,7 @@ class ReactNativeSessionManager {
     }
     static getRefreshToken() {
         try {
-            const session = this.getStorage().getItem(this.TAROBASE_SESSION_STORAGE_KEY);
+            const session = this.getStorage().getItem(this.BOUNDED_SESSION_STORAGE_KEY);
             return session ? JSON.parse(session).refreshToken : null;
         }
         catch (_a) {
@@ -3258,7 +3258,7 @@ class ReactNativeSessionManager {
     /* ------------------------------------------------------------------ */
     static async updateIdTokenAndAccessToken(idToken, accessToken, refreshToken) {
         var _a;
-        const session = this.getStorage().getItem(this.TAROBASE_SESSION_STORAGE_KEY);
+        const session = this.getStorage().getItem(this.BOUNDED_SESSION_STORAGE_KEY);
         if (!session)
             return;
         const sessionObj = JSON.parse(session);
@@ -3274,10 +3274,10 @@ class ReactNativeSessionManager {
             sessionObj.refreshToken = refreshToken;
         }
         (_a = sessionObj.appId) !== null && _a !== void 0 ? _a : (sessionObj.appId = config.appId);
-        this.getStorage().setItem(this.TAROBASE_SESSION_STORAGE_KEY, JSON.stringify(sessionObj));
+        this.getStorage().setItem(this.BOUNDED_SESSION_STORAGE_KEY, JSON.stringify(sessionObj));
     }
 }
-ReactNativeSessionManager.TAROBASE_SESSION_STORAGE_KEY = "tarobase_session_storage";
+ReactNativeSessionManager.BOUNDED_SESSION_STORAGE_KEY = "bounded_session_storage";
 
 /**
  * Return the active CLIENT session manager for the current runtime.
@@ -3798,9 +3798,9 @@ async function buildSetDocumentsTransaction(connection, idl, anchorProvider, pay
 /*  ENV helpers                                                       */
 /* ------------------------------------------------------------------ */
 // Canonical `BOUNDED_PRIVATE_KEY` (matches the CLI); legacy
-// `TAROBASE_SOLANA_KEYPAIR` still honored. Only consulted when no explicit
+// `BOUNDED_SOLANA_KEYPAIR` still honored. Only consulted when no explicit
 // keypair was provided (createWalletClient passes one).
-const ENV_KEYPAIRS = ["BOUNDED_PRIVATE_KEY", "TAROBASE_SOLANA_KEYPAIR"];
+const ENV_KEYPAIRS = ["BOUNDED_PRIVATE_KEY", "BOUNDED_SOLANA_KEYPAIR"];
 function loadKeypairFromEnv() {
     let secret;
     let found;
@@ -3923,7 +3923,7 @@ var serverSessionManager = /*#__PURE__*/Object.freeze({
 });
 
 /**
- * Safe base64 helpers for tarobase-core.
+ * Safe base64 helpers for bounded-core.
  *
  * Uses the global atob/btoa when available (browser, RN with polyfill),
  * falls back to the 'buffer' package (Node.js / SSR / RN without polyfill).
@@ -4103,7 +4103,7 @@ axiosRetry(apiClient, {
     shouldResetTimeout: true,
     onRetry: (retryCount, error, requestConfig) => {
         var _a;
-        console.warn(`[tarobase-sdk] retry ${retryCount} for ${(_a = requestConfig.method) === null || _a === void 0 ? void 0 : _a.toUpperCase()} ${requestConfig.url} — ${error.code || error.message}`);
+        console.warn(`[bounded-sdk] retry ${retryCount} for ${(_a = requestConfig.method) === null || _a === void 0 ? void 0 : _a.toUpperCase()} ${requestConfig.url} — ${error.code || error.message}`);
     },
 });
 const refreshInFlight = new Map();
@@ -4162,8 +4162,8 @@ async function makeApiRequest(method, urlPath, data, _overrides) {
             : await createAuthHeader(config.isServer);
         const headers = Object.assign({ "Content-Type": "application/json", "X-Public-App-Id": config.appId, "X-App-Id": config.appId }, authHeader);
         if (typeof window !== "undefined" &&
-            window.CUSTOM_TAROBASE_APP_ID_HEADER) {
-            const customAppId = window.CUSTOM_TAROBASE_APP_ID_HEADER;
+            window.CUSTOM_BOUNDED_APP_ID_HEADER) {
+            const customAppId = window.CUSTOM_BOUNDED_APP_ID_HEADER;
             if (customAppId) {
                 headers["X-App-Id"] = customAppId;
             }
@@ -4422,7 +4422,7 @@ function parseAggregateValue(result) {
  * Count items in a collection path. Returns a numeric result.
  *
  * This uses the AI query engine with a count-specific prompt prefix,
- * so TaroBase will generate a $count aggregation pipeline and return
+ * so Bounded will generate a $count aggregation pipeline and return
  * just the count rather than full documents.
  *
  * IMPORTANT: This only works for collections where the read policy is "true".
@@ -4929,6 +4929,13 @@ async function runExpressionMany(many) {
         throw error;
     }
 }
+/**
+ * Write a document at `path`. Sugar for a one-element {@link setMany}.
+ *
+ * **Delete:** pass `null` as the document to delete it — `set(path, null)` is
+ * the delete (there is no separate `del`/`remove`). It is routed through the
+ * collection's policy `delete` rule and broadcasts a delete to subscribers.
+ */
 async function set(path, document, options) {
     const result = await setMany([{ path, document }], options);
     // Clear cache entries that might be affected by this update
@@ -4947,10 +4954,10 @@ async function setMany(many, options) {
         let documents = [];
         const pathsToInvalidate = new Set();
         for (const { path, document: documentWithReservedFields } of many) {
-            // for setting, we should remove any pieces of the document that start with 'tarobase_' as they are internal and shouldn't be updated. The API would block it if it is one of the reserved ones
+            // for setting, we should remove any pieces of the document that start with '_' as they are internal and shouldn't be updated. The API would block it if it is one of the reserved ones
             let document = documentWithReservedFields;
             if (documentWithReservedFields) {
-                document = Object.fromEntries(Object.entries(documentWithReservedFields).filter(([key]) => !key.startsWith('tarobase_')));
+                document = Object.fromEntries(Object.entries(documentWithReservedFields).filter(([key]) => !key.startsWith('_')));
             }
             const normalizedPath = path.startsWith("/") ? path.slice(1) : path;
             pathsToInvalidate.add(normalizedPath);
@@ -5074,7 +5081,7 @@ async function setMany(many, options) {
         var _a, _b, _c, _d, _e;
         // NOTE (backwards-compat revert): a program-allowlist on server-supplied
         // `preInstructions` was tried here for the audit-8 SOL-drain concern, but it
-        // broke legitimate onchain DeFi flows — tarobase routes Phoenix, Jupiter/swap,
+        // broke legitimate onchain DeFi flows — bounded routes Phoenix, Jupiter/swap,
         // SPL-Token and ATA-creation instructions through standard-path preInstructions
         // (see sol-helper remaining-accounts-extractor). A correct audit-8 fix must be
         // DeFi-aware (e.g. block ONLY a raw System Transfer/TransferWithSeed, never a
@@ -5158,10 +5165,10 @@ async function setMany(many, options) {
         const transaction = web3_js.VersionedTransaction.deserialize(txBytes);
         // Validate the transaction before signing: ensure only allowed programs
         // and no unauthorized System program instructions (e.g., SOL transfers)
-        const TAROBASE_PROGRAM = 'poof4b5pk1L9tmThvBmaABjcyjfhFGbMbQP5BXk2QZp';
+        const BOUNDED_PROGRAM = 'poof4b5pk1L9tmThvBmaABjcyjfhFGbMbQP5BXk2QZp';
         const COMPUTE_BUDGET = 'ComputeBudget111111111111111111111111111111';
         const SYSTEM_PROGRAM = '11111111111111111111111111111111';
-        const ALLOWED_PROGRAMS = new Set([TAROBASE_PROGRAM, COMPUTE_BUDGET, SYSTEM_PROGRAM]);
+        const ALLOWED_PROGRAMS = new Set([BOUNDED_PROGRAM, COMPUTE_BUDGET, SYSTEM_PROGRAM]);
         // System program instruction discriminators (first 4 bytes, little-endian u32)
         const SYSTEM_TRANSFER = 2; // Transfer instruction index
         const SYSTEM_TRANSFER_WITH_SEED = 11;
@@ -5755,8 +5762,8 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
         if (appId && appId !== config.appId) {
             wsUrl.searchParams.append('appId', appId);
         }
-        else if (typeof window !== 'undefined' && window.CUSTOM_TAROBASE_APP_ID_HEADER) {
-            wsUrl.searchParams.append('appId', window.CUSTOM_TAROBASE_APP_ID_HEADER);
+        else if (typeof window !== 'undefined' && window.CUSTOM_BOUNDED_APP_ID_HEADER) {
+            wsUrl.searchParams.append('appId', window.CUSTOM_BOUNDED_APP_ID_HEADER);
         }
         else {
             wsUrl.searchParams.append('appId', config.appId);
@@ -6616,7 +6623,7 @@ function serverTimestamp() {
 // ---------------------------------------------------------------------------
 // IDB helpers (lazy-loaded, non-blocking)
 // ---------------------------------------------------------------------------
-const IDB_NAME = 'tarobase-realtime';
+const IDB_NAME = 'bounded-realtime';
 const IDB_STORE = 'subscriptions';
 const IDB_VERSION = 1;
 let idbPromise = null;
@@ -7054,10 +7061,10 @@ class RealtimeStore {
         const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
         const collectionPath = this.getCollectionPath(normalizedPath);
         const optimisticDoc = Object.assign(Object.assign({ _id: normalizedPath, pathId: normalizedPath }, resolvedDoc), { 
-            // System timestamp field name differs by stack: the Bounded worker stamps
-            // the neutral `_updatedAt`; legacy Tarobase stamps `tarobase_updated_at`.
+            // System timestamp field name: the Bounded worker stamps the neutral
+            // `_updatedAt`; the underscore-prefixed `_updated_at` metadata mirror.
             // Match it so the optimistic doc lines up with the server's confirmation.
-            [isBoundedNetwork() ? '_updatedAt' : 'tarobase_updated_at']: Date.now() });
+            [isBoundedNetwork() ? '_updatedAt' : '_updated_at']: Date.now() });
         const sub = this.findSubscriptionByPath(collectionPath);
         let prevDoc = null;
         if (sub) {
@@ -7510,6 +7517,7 @@ const functions = { invoke };
 // collection. This file is the consumer surface around that runtime:
 //
 //   bounded.live.intent(roomPath, intent)  -> POST {realtime}/live/intent
+//   bounded.live.status(roomPath)          -> GET  {realtime}/live/status
 //
 // It mirrors `functions.invoke` exactly: it attaches the caller's session token
 // AUTOMATICALLY (the same token the SDK uses for data reads/writes), and throws
@@ -7522,18 +7530,14 @@ const functions = { invoke };
 // Addressing: clients address rooms BY PATH (the `path` field in the body). The
 // worker derives the roomId from `body.path` and sets X-Room-Id internally;
 // clients NEVER set X-Room-Id. The caller's address is taken server-side from
-// the Authorization header (auth.userAddress) — it is NOT sent in the body.
+// the Authorization header (auth.userId/userAddress) — it is NOT sent in the
+// body.
 //
 // Subscribing to your view: a per-player view doc lives at
-// `<roomPath>/view/<myAddress>` (the policy declares
-// `rooms/$roomId/view/$addr` ephemeral with `read: $addr == @user.address`).
-// That path has an EVEN segment count, so it is an ordinary document path —
-// plain `subscribe('<roomPath>/view/<myAddress>', { onData })` already works.
-// `subscribeView()` below is thin sugar over that (path construction + address
-// defaulting); it adds zero new transport.
-//
-// Status polling (GET /live/status?path=<sessionCollection>/<roomId>) is out of
-// scope for this piece — see follow-up.
+// `<roomPath>/view/<myUserId>` (the policy declares
+// `rooms/$roomId/view/$userId` ephemeral with `read: $userId == @user.id`).
+// Wallet-address keyed view paths remain supported through opts.address for
+// older policies, but new live rooms should key views by @user.id.
 // ---------------------------------------------------------------------------
 class LiveIntentError extends Error {
     constructor(message, statusCode, details) {
@@ -7614,7 +7618,7 @@ async function intent(roomPath, intent, opts = {}) {
         res = await fetch(`${base}/live/intent`, {
             method: 'POST',
             headers,
-            body: JSON.stringify({ path: roomPath, intent }),
+            body: JSON.stringify({ path: normalizedRoomPath, intent }),
             signal: controller.signal,
         });
     }
@@ -7642,43 +7646,95 @@ async function intent(roomPath, intent, opts = {}) {
     }
     return (body !== null && body !== void 0 ? body : { ok: true });
 }
+/**
+ * Fetch the runtime status for a live room.
+ *
+ *   const s = await bounded.live.status('rooms/abc');
+ *   console.log(s.running, s.stopReason, s.generation, s.etag);
+ *
+ * This is diagnostic/ops surface. It reports whether the room facet exists,
+ * whether it is currently ticking, why it last stopped, which module etag is
+ * loaded, and the current generation used after terminal restarts.
+ */
+async function status(roomPath, opts = {}) {
+    var _a, _b, _c, _d, _e;
+    if (!roomPath || typeof roomPath !== 'string') {
+        throw new LiveIntentError('A room path is required');
+    }
+    const normalizedRoomPath = roomPath.replace(/\/$/, '');
+    const config = await getConfig();
+    const base = realtimeHttpBase(config.wsApiUrl);
+    const headers = Object.assign({ 'X-App-Id': config.appId, 'X-Public-App-Id': config.appId }, ((_a = opts.headers) !== null && _a !== void 0 ? _a : {}));
+    const controller = new AbortController();
+    const timeoutMs = (_b = opts.timeoutMs) !== null && _b !== void 0 ? _b : 15000;
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let res;
+    try {
+        res = await fetch(`${base}/live/status?path=${encodeURIComponent(normalizedRoomPath)}`, {
+            method: 'GET',
+            headers,
+            signal: controller.signal,
+        });
+    }
+    catch (err) {
+        clearTimeout(timer);
+        if ((err === null || err === void 0 ? void 0 : err.name) === 'AbortError') {
+            throw new LiveIntentError(`Live status for "${normalizedRoomPath}" timed out after ${timeoutMs}ms`);
+        }
+        throw new LiveIntentError(`Failed to reach the realtime worker: ${(_c = err === null || err === void 0 ? void 0 : err.message) !== null && _c !== void 0 ? _c : String(err)}`);
+    }
+    clearTimeout(timer);
+    let body = null;
+    const text = await res.text();
+    if (text) {
+        try {
+            body = JSON.parse(text);
+        }
+        catch (_f) {
+            body = { raw: text };
+        }
+    }
+    if (!res.ok) {
+        const message = (_e = (_d = body === null || body === void 0 ? void 0 : body.error) !== null && _d !== void 0 ? _d : body === null || body === void 0 ? void 0 : body.message) !== null && _e !== void 0 ? _e : `Live status failed with HTTP ${res.status}`;
+        throw new LiveIntentError(message, res.status, body);
+    }
+    return body;
+}
 /**
  * Subscribe to YOUR per-player view of a room. Thin sugar over:
  *
- *   subscribe('<roomPath>/view/<myAddress>', { onData, onError })
+ *   subscribe('<roomPath>/view/<myUserId>', { onData, onError })
  *
- * The address defaults to the logged-in user's address (from the session
- * token's claims); pass `opts.address` to override. Returns the unsubscribe
+ * The view id defaults to the logged-in user's @user.id (from the session token
+ * claims); pass `opts.userId` to override. `opts.address` is kept as a legacy
+ * alias for older wallet-address keyed policies. Returns the unsubscribe
  * function (a Promise<() => Promise<void>>, same as `subscribe`).
  *
  * Note: this is a browser-first helper (the WS subscription manager is
  * browser-oriented). Server consumers should use `live.intent`.
  */
 async function subscribeView(roomPath, opts) {
-    var _a;
+    var _a, _b, _c;
     if (!roomPath || typeof roomPath !== 'string') {
         throw new LiveIntentError('A room path is required');
     }
     if (!opts || typeof opts.onData !== 'function') {
         throw new LiveIntentError('subscribeView requires an onData callback');
     }
-    let address = opts.address;
-    if (!address) {
+    let viewUserId = (_a = opts.userId) !== null && _a !== void 0 ? _a : opts.address;
+    if (!viewUserId) {
         const config = await getConfig();
         const info = await getUserInfo(config.isServer);
-        // getUserInfo returns the RAW idToken payload — the wallet address lives in
-        // the `custom:walletAddress` claim, NOT a flat `address` field. Reading only
-        // `.address` meant auto-resolution NEVER worked, forcing every caller (browser
-        // AND server) to pass opts.address — the client having to hand the backend an
-        // identity it already authenticated. Resolve it from the actual claim so a
-        // logged-in caller never needs to pass its own address.
-        address = (_a = info === null || info === void 0 ? void 0 : info.address) !== null && _a !== void 0 ? _a : info === null || info === void 0 ? void 0 : info['custom:walletAddress'];
+        // getUserInfo returns the RAW idToken payload. The universal live view key
+        // is @user.id (`custom:userId`); wallet-address keyed views are still
+        // resolved as a compatibility fallback for older policies.
+        viewUserId = (_c = (_b = info === null || info === void 0 ? void 0 : info['custom:userId']) !== null && _b !== void 0 ? _b : info === null || info === void 0 ? void 0 : info['custom:walletAddress']) !== null && _c !== void 0 ? _c : info === null || info === void 0 ? void 0 : info.address;
     }
-    if (!address || typeof address !== 'string') {
-        throw new LiveIntentError('Could not resolve a player address for subscribeView; pass opts.address or log in first');
+    if (!viewUserId || typeof viewUserId !== 'string') {
+        throw new LiveIntentError('Could not resolve a player view id for subscribeView; pass opts.userId or log in first');
     }
     const normalizedRoomPath = roomPath.replace(/\/$/, '');
-    const viewPath = `${normalizedRoomPath}/view/${address}`;
+    const viewPath = `${normalizedRoomPath}/view/${viewUserId}`;
     // This is a LIVE/room subscription by construction (the caller hands us the
     // room path), so we route its connection to the per-room DO where the live
     // view fan-out runs. App code passes NO routing — the room path is the helper's
@@ -7689,7 +7745,7 @@ async function subscribeView(roomPath, opts) {
     return subscribeV2(viewPath, { onData: opts.onData, onError: opts.onError }, normalizedRoomPath);
 }
 /** The `bounded.live` namespace surface. */
-const live = { intent, subscribeView };
+const live = { intent, status, subscribeView };
 
 // ---------------------------------------------------------------------------
 // live-effects.ts -- AUTHOR-facing types + helpers for writing a Bounded live
@@ -7778,6 +7834,7 @@ exports.invokeFunction = invoke;
 exports.isEffectResult = isEffectResult;
 exports.live = live;
 exports.liveIntent = intent;
+exports.liveStatus = status;
 exports.queryAggregate = queryAggregate;
 exports.reconnectWithNewAuth = reconnectWithNewAuth;
 exports.refreshSession = refreshSession;