@lark-sh/client 0.1.15 → 0.1.17

package/dist/{chunk-EK7OYLDG.mjs → chunk-VLAAYUVX.mjs}

@@ -1,67 +1,3 @@
-// src/protocol/constants.ts
-var OnDisconnectAction = {
-  SET: "s",
-  UPDATE: "u",
-  DELETE: "d",
-  CANCEL: "c"
-};
-var ErrorCode = {
-  PERMISSION_DENIED: "permission_denied",
-  INVALID_DATA: "invalid_data",
-  NOT_FOUND: "not_found",
-  INVALID_PATH: "invalid_path",
-  INVALID_OPERATION: "invalid_operation",
-  INTERNAL_ERROR: "internal_error",
-  CONDITION_FAILED: "condition_failed",
-  INVALID_QUERY: "invalid_query",
-  AUTH_REQUIRED: "auth_required"
-};
-var DEFAULT_COORDINATOR_URL = "https://db.lark.sh";
-
-// src/connection/Coordinator.ts
-var Coordinator = class {
-  constructor(baseUrl = DEFAULT_COORDINATOR_URL) {
-    this.baseUrl = baseUrl.replace(/\/$/, "");
-  }
-  /**
-   * Request connection details from the coordinator.
-   *
-   * @param database - Database ID in format "project/database"
-   * @param options - Either a user token or anonymous flag
-   * @returns Connection details including host, port, and connection token
-   */
-  async connect(database, options = {}) {
-    const body = { database };
-    if (options.token) {
-      body.token = options.token;
-    } else if (options.anonymous) {
-      body.anonymous = true;
-    } else {
-      body.anonymous = true;
-    }
-    const response = await fetch(`${this.baseUrl}/connect`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify(body)
-    });
-    if (!response.ok) {
-      let errorMessage = `Coordinator request failed: ${response.status}`;
-      try {
-        const errorBody = await response.json();
-        if (errorBody.message) {
-          errorMessage = errorBody.message;
-        }
-      } catch {
-      }
-      throw new Error(errorMessage);
-    }
-    const data = await response.json();
-    return data;
-  }
-};
-
 // src/connection/WebSocketTransport.ts
 import WebSocketNode from "ws";
 var WebSocketImpl = typeof WebSocket !== "undefined" ? WebSocket : WebSocketNode;
@@ -1428,7 +1364,6 @@ var View = class {
   /**
    * Check if this View loads all data (no limits, no range filters).
    * A View that loads all data can serve as a "complete" cache for child paths.
-   * This matches Firebase's loadsAllData() semantics.
    */
   loadsAllData() {
     if (!this.queryParams) return true;
@@ -1844,8 +1779,8 @@ var SubscriptionManager = class {
   /**
    * Detect and fire child_moved events for children that changed position OR sort value.
    *
-   * Firebase fires child_moved for ANY priority/sort value change, regardless of whether
-   * the position actually changes. This is Case 2003 behavior.
+   * child_moved fires for ANY priority/sort value change, regardless of whether
+   * the position actually changes.
    *
    * IMPORTANT: child_moved should only fire for children whose VALUE or PRIORITY changed.
    * Children that are merely "displaced" by another child moving should NOT fire child_moved.
@@ -2048,9 +1983,6 @@ var SubscriptionManager = class {
    * A complete View has no limits and no range filters, so it contains all data
    * for its subtree. Child subscriptions can use the ancestor's data instead
    * of creating their own server subscription.
-   *
-   * This matches Firebase's behavior where child listeners don't need their own
-   * server subscription if an ancestor has an unlimited listener.
    */
   hasAncestorCompleteView(path) {
     const normalized = normalizePath(path);
@@ -2176,8 +2108,8 @@ var SubscriptionManager = class {
   /**
    * Recursively sort object keys for consistent comparison.
    * This ensures {a:1, b:2} and {b:2, a:1} compare as equal.
-   * Uses simple alphabetical sorting (not Firebase key sorting) since we're
-   * just checking data equality, not display order.
+   * Uses simple alphabetical sorting since we're just checking data equality,
+   * not display order.
    */
   sortKeysForComparison(value) {
     if (value === null || typeof value !== "object") {
@@ -2771,6 +2703,26 @@ var SubscriptionManager = class {
   }
 };
 
+// src/protocol/constants.ts
+var OnDisconnectAction = {
+  SET: "s",
+  UPDATE: "u",
+  DELETE: "d",
+  CANCEL: "c"
+};
+var ErrorCode = {
+  PERMISSION_DENIED: "permission_denied",
+  INVALID_DATA: "invalid_data",
+  NOT_FOUND: "not_found",
+  INVALID_PATH: "invalid_path",
+  INVALID_OPERATION: "invalid_operation",
+  INTERNAL_ERROR: "internal_error",
+  CONDITION_FAILED: "condition_failed",
+  INVALID_QUERY: "invalid_query",
+  AUTH_REQUIRED: "auth_required"
+};
+var DEFAULT_LARK_DOMAIN = "larkdb.net";
+
 // src/OnDisconnect.ts
 var OnDisconnect = class {
   constructor(db, path) {
@@ -2874,6 +2826,125 @@ function generatePushId() {
   return id;
 }
 
+// src/utils/validation.ts
+var MAX_KEY_BYTES = 768;
+var INVALID_KEY_CHARS = /[.#$\[\]\/]/;
+var CONTROL_CHARS = /[\x00-\x1f\x7f]/;
+function hasControlChars(str) {
+  return CONTROL_CHARS.test(str);
+}
+function getByteLength(str) {
+  if (typeof TextEncoder !== "undefined") {
+    return new TextEncoder().encode(str).length;
+  }
+  return Buffer.byteLength(str, "utf8");
+}
+function validateKey(key, context) {
+  const prefix = context ? `${context}: ` : "";
+  if (typeof key !== "string") {
+    throw new LarkError(
+      ErrorCode.INVALID_DATA,
+      `${prefix}key must be a string`
+    );
+  }
+  if (key.length === 0) {
+    throw new LarkError(
+      ErrorCode.INVALID_DATA,
+      `${prefix}key cannot be empty`
+    );
+  }
+  if (INVALID_KEY_CHARS.test(key)) {
+    throw new LarkError(
+      ErrorCode.INVALID_DATA,
+      `${prefix}key "${key}" contains invalid characters (. $ # [ ] / are not allowed)`
+    );
+  }
+  if (hasControlChars(key)) {
+    throw new LarkError(
+      ErrorCode.INVALID_DATA,
+      `${prefix}key "${key}" contains control characters (ASCII 0-31, 127 are not allowed)`
+    );
+  }
+  const byteLength = getByteLength(key);
+  if (byteLength > MAX_KEY_BYTES) {
+    throw new LarkError(
+      ErrorCode.INVALID_DATA,
+      `${prefix}key "${key.substring(0, 50)}..." exceeds maximum size of ${MAX_KEY_BYTES} bytes (got ${byteLength})`
+    );
+  }
+}
+function validatePath(path, context) {
+  if (typeof path !== "string") {
+    throw new LarkError(
+      ErrorCode.INVALID_PATH,
+      `${context ? `${context}: ` : ""}path must be a string`
+    );
+  }
+  if (path === "" || path === "/") {
+    return;
+  }
+  const segments = path.split("/").filter((s) => s.length > 0);
+  for (const segment of segments) {
+    if (segment === ".priority" || segment === ".value" || segment === ".sv" || segment === ".info") {
+      continue;
+    }
+    validateKey(segment, context);
+  }
+}
+function validateValue(value, context, path = "") {
+  const prefix = context ? `${context}: ` : "";
+  const location = path ? ` at "${path}"` : "";
+  if (value === null || value === void 0) {
+    return;
+  }
+  if (typeof value === "string") {
+    if (hasControlChars(value)) {
+      throw new LarkError(
+        ErrorCode.INVALID_DATA,
+        `${prefix}string value${location} contains control characters (ASCII 0-31, 127 are not allowed)`
+      );
+    }
+    return;
+  }
+  if (typeof value === "number" || typeof value === "boolean") {
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (let i = 0; i < value.length; i++) {
+      validateValue(value[i], context, path ? `${path}/${i}` : String(i));
+    }
+    return;
+  }
+  if (typeof value === "object") {
+    const obj = value;
+    const keys = Object.keys(obj);
+    if (".value" in obj) {
+      const otherKeys = keys.filter((k) => k !== ".value" && k !== ".priority");
+      if (otherKeys.length > 0) {
+        const loc = path || "/";
+        throw new LarkError(
+          ErrorCode.INVALID_DATA,
+          `${prefix}data at ${loc} contains ".value" alongside other children (${otherKeys.join(", ")}). ".value" can only be used with ".priority" for primitives with priority.`
+        );
+      }
+    }
+    for (const [key, childValue] of Object.entries(obj)) {
+      if (key !== ".priority" && key !== ".value" && key !== ".sv") {
+        validateKey(key, context);
+      }
+      validateValue(childValue, context, path ? `${path}/${key}` : key);
+    }
+    return;
+  }
+  throw new LarkError(
+    ErrorCode.INVALID_DATA,
+    `${prefix}invalid value type${location}: ${typeof value}`
+  );
+}
+function validateWriteData(value, context) {
+  validateValue(value, context);
+}
+
 // src/DatabaseReference.ts
 function isInfoPath(path) {
   return path === "/.info" || path.startsWith("/.info/");
@@ -2949,7 +3020,6 @@ var DatabaseReference = class _DatabaseReference {
    * For queries (created via orderBy*, limitTo*, startAt, etc.), this returns
    * a reference to the same path without query constraints.
    * For non-query references, this returns the reference itself.
-   * This matches Firebase's Query.ref behavior.
    */
   get ref() {
     if (Object.keys(this._query).length === 0) {
@@ -2974,7 +3044,7 @@ var DatabaseReference = class _DatabaseReference {
    * Returns "default" for non-query references (no constraints).
    * Returns a sorted JSON string of wire-format params for queries.
    *
-   * This matches Firebase's queryIdentifier format for wire compatibility.
+   * Used for wire protocol and subscription deduplication.
    */
   get queryIdentifier() {
     const queryObj = {};
@@ -3033,7 +3103,7 @@ var DatabaseReference = class _DatabaseReference {
   }
   /**
    * Get the data at this location. Alias for once('value').
-   * This is Firebase's newer API for reading data.
+   * Alternative to once('value') for reading data.
    */
   async get() {
     return this.once("value");
@@ -3045,6 +3115,7 @@ var DatabaseReference = class _DatabaseReference {
    * Get a reference to a child path.
    */
   child(path) {
+    validatePath(path, "child");
     const childPath = joinPath(this._path, path);
     return new _DatabaseReference(this._db, childPath);
   }
@@ -3061,6 +3132,7 @@ var DatabaseReference = class _DatabaseReference {
    */
   async set(value) {
     validateNotInfoPath(this._path, "set");
+    validateWriteData(value, "set");
     if (this._db.isVolatilePath(this._path)) {
       this._db._sendVolatileSet(this._path, value);
       return;
@@ -3070,7 +3142,7 @@ var DatabaseReference = class _DatabaseReference {
   /**
    * Update specific children at this location without overwriting other children.
    *
-   * Also supports Firebase-style multi-path updates when keys look like paths
+   * Also supports multi-path updates when keys look like paths
    * (start with '/'). In this mode, each path is written atomically as a transaction.
    *
    * @example
@@ -3090,6 +3162,16 @@ var DatabaseReference = class _DatabaseReference {
    */
   async update(values) {
     validateNotInfoPath(this._path, "update");
+    for (const [key, value] of Object.entries(values)) {
+      if (key.includes("/")) {
+        validatePath(key, "update");
+      } else {
+        validateKey(key, "update");
+      }
+      if (value !== null) {
+        validateWriteData(value, "update");
+      }
+    }
     const hasPathKeys = Object.keys(values).some((key) => key.startsWith("/"));
     if (hasPathKeys) {
       const ops = [];
@@ -3141,13 +3223,17 @@ var DatabaseReference = class _DatabaseReference {
    * For objects: injects `.priority` into the value object.
    * For primitives: wraps as `{ '.value': primitive, '.priority': priority }`.
    *
-   * This follows Firebase's wire format for primitives with priority.
+   * Uses { '.value': value, '.priority': priority } format for the wire protocol.
    *
    * @param value - The value to write
    * @param priority - The priority for ordering
    */
   async setWithPriority(value, priority) {
     validateNotInfoPath(this._path, "setWithPriority");
+    validateWriteData(value, "setWithPriority");
+    if (typeof priority === "string") {
+      validateWriteData(priority, "setWithPriority (priority)");
+    }
     if (value === null || value === void 0) {
       await this._db._sendSet(this._path, value);
       return;
@@ -3689,17 +3775,11 @@ var DatabaseReference = class _DatabaseReference {
     }
   }
   /**
-   * Validate that a key is a valid Firebase key format.
-   * Invalid characters: . $ # [ ] /
-   * Also cannot start or end with .
+   * Validate that a key is a valid key format.
+   * Delegates to the shared validation utility.
    */
   _validateKeyFormat(methodName, key) {
-    if (/[.#$\[\]\/]/.test(key)) {
-      throw new LarkError(
-        ErrorCode.INVALID_QUERY,
-        `Query.${methodName}: invalid key "${key}" - keys cannot contain . # $ [ ] /`
-      );
-    }
+    validateKey(key, `Query.${methodName}`);
   }
   // ============================================
   // Internal Helpers
@@ -3903,9 +3983,9 @@ var DataSnapshot = class _DataSnapshot {
    * Get a child snapshot at the specified path.
    *
    * Special handling:
-   * - `.priority` returns the priority value (Firebase compatible)
+   * - `.priority` returns the priority value
    * - For wrapped primitives, only `.priority` returns data; other paths return null
-   * - Non-existent paths return a snapshot with val() === null (Firebase compatible)
+   * - Non-existent paths return a snapshot with val() === null
    */
   child(path) {
     const childPath = joinPath(this._path, path);
@@ -4009,7 +4089,6 @@ var DataSnapshot = class _DataSnapshot {
   }
   /**
    * Check if this snapshot was from a volatile (high-frequency) update.
-   * This is a Lark extension not present in Firebase.
    */
   isVolatile() {
     return this._volatile;
@@ -4018,7 +4097,6 @@ var DataSnapshot = class _DataSnapshot {
    * Get the server timestamp for this snapshot (milliseconds since Unix epoch).
    * Only present on volatile value events. Use deltas between timestamps for
    * interpolation rather than absolute times to avoid clock sync issues.
-   * This is a Lark extension not present in Firebase.
    */
   getServerTimestamp() {
     return this._serverTimestamp;
@@ -4067,28 +4145,6 @@ function isVolatilePath(path, patterns) {
 }
 
 // src/LarkDatabase.ts
-function validateWriteData(data, path = "") {
-  if (!data || typeof data !== "object" || Array.isArray(data)) {
-    return;
-  }
-  const obj = data;
-  const keys = Object.keys(obj);
-  if (".value" in obj) {
-    const otherKeys = keys.filter((k) => k !== ".value" && k !== ".priority");
-    if (otherKeys.length > 0) {
-      const location = path || "/";
-      throw new LarkError(
-        "invalid_data",
-        `Data at ${location} contains ".value" alongside other children (${otherKeys.join(", ")}). ".value" can only be used with ".priority" for primitives with priority.`
-      );
-    }
-  }
-  for (const key of keys) {
-    if (key !== ".priority" && key !== ".value") {
-      validateWriteData(obj[key], path ? `${path}/${key}` : `/${key}`);
-    }
-  }
-}
 var RECONNECT_BASE_DELAY_MS = 1e3;
 var RECONNECT_MAX_DELAY_MS = 3e4;
 var RECONNECT_JITTER_FACTOR = 0.5;
@@ -4163,7 +4219,7 @@ var LarkDatabase = class {
     this._state = "disconnected";
     this._auth = null;
     this._databaseId = null;
-    this._coordinatorUrl = null;
+    this._domain = null;
     this._volatilePaths = [];
     this._transportType = null;
     // Auth state
@@ -4226,8 +4282,9 @@ var LarkDatabase = class {
    * @internal Get the base URL for reference toString().
    */
   _getBaseUrl() {
-    if (this._coordinatorUrl && this._databaseId) {
-      return `${this._coordinatorUrl}/${this._databaseId}`;
+    if (this._domain && this._databaseId) {
+      const projectId = this._databaseId.split("/")[0];
+      return `https://${projectId}.${this._domain}`;
     }
     return "lark://";
   }
@@ -4279,7 +4336,7 @@ var LarkDatabase = class {
    * Connect to a database.
    *
    * @param databaseId - Database ID in format "project/database"
-   * @param options - Connection options (token, anonymous, coordinator URL)
+   * @param options - Connection options (token, anonymous, domain)
    */
   async connect(databaseId, options = {}) {
     if (this._state !== "disconnected") {
@@ -4303,19 +4360,17 @@ var LarkDatabase = class {
     const previousState = this._state;
     this._state = isReconnect ? "reconnecting" : "connecting";
     this._databaseId = databaseId;
-    this._coordinatorUrl = options.coordinator || DEFAULT_COORDINATOR_URL;
+    this._domain = options.domain || DEFAULT_LARK_DOMAIN;
     if (!isReconnect) {
       this._currentToken = options.token || "";
       this._isAnonymous = !options.token && options.anonymous !== false;
     }
     try {
-      const coordinatorUrl = this._coordinatorUrl;
-      const coordinator = new Coordinator(coordinatorUrl);
-      const connectResponse = await coordinator.connect(databaseId, {
-        token: options.token,
-        anonymous: options.anonymous
-      });
-      const wsUrl = connectResponse.ws_url;
+      const projectId = databaseId.split("/")[0];
+      if (!projectId) {
+        throw new Error('Invalid database ID: must be in format "projectId/databaseName"');
+      }
+      const wsUrl = `wss://${projectId}.${this._domain}/ws`;
       const transportResult = await createTransport(
         wsUrl,
         {
@@ -4476,7 +4531,7 @@ var LarkDatabase = class {
     this._auth = null;
     this._databaseId = null;
     this._volatilePaths = [];
-    this._coordinatorUrl = null;
+    this._domain = null;
     this._connectionId = null;
     this._connectOptions = null;
     this._transportType = null;
@@ -4673,7 +4728,7 @@ var LarkDatabase = class {
    *
    * Supports two syntaxes:
    *
-   * **Object syntax** (like Firebase multi-path update):
+   * **Object syntax** (multi-path update):
    * ```javascript
    * await db.transaction({
    *   '/users/alice/name': 'Alice',
@@ -4711,14 +4766,20 @@ var LarkDatabase = class {
    */
   async convertToTxOp(op) {
     const path = normalizePath(op.path) || "/";
+    validatePath(op.path, "transaction");
     switch (op.op) {
       case "set":
+        validateWriteData(op.value, "transaction");
         return { o: "s", p: path, v: op.value };
       case "update":
+        validateWriteData(op.value, "transaction");
         return { o: "u", p: path, v: op.value };
       case "delete":
         return { o: "d", p: path };
       case "condition":
+        if (op.value !== void 0 && op.value !== null) {
+          validateWriteData(op.value, "transaction condition");
+        }
         if (isPrimitive(op.value)) {
           return { o: "c", p: path, v: op.value };
         } else {
@@ -4736,10 +4797,12 @@ var LarkDatabase = class {
   convertObjectToTxOps(obj) {
     const ops = [];
     for (const [path, value] of Object.entries(obj)) {
+      validatePath(path, "transaction");
       const normalizedPath = normalizePath(path) || "/";
       if (value === null) {
         ops.push({ o: "d", p: normalizedPath });
       } else {
+        validateWriteData(value, "transaction");
         ops.push({ o: "s", p: normalizedPath, v: value });
       }
     }
@@ -5285,4 +5348,4 @@ export {
   ServerValue,
   LarkDatabase
 };
-//# sourceMappingURL=chunk-EK7OYLDG.mjs.map
+//# sourceMappingURL=chunk-VLAAYUVX.mjs.map