@proveanything/smartlinks 2.0.55 → 2.0.56

package/openapi.yaml

@@ -123,7 +123,7 @@ paths:
     get:
       tags:
         - realtime
-      summary: Get an Ably token for admin real-time communication.
+      summary: (subscribe only).
       operationId: realtime_getAdminToken
       security:
         - bearerAuth: []
@@ -13960,7 +13960,7 @@ paths:
     get:
       tags:
         - realtime
-      summary: realtime.getPublicToken
+      summary: "`collection:{collectionId}:*` (subscribe; publish only for the collection's admins)."
       operationId: realtime_getPublicToken
       security: []
       parameters:
@@ -14018,6 +14018,33 @@ paths:
           description: Unauthorized
         404:
           description: Not found
+  /public/realtime/publish:
+    post:
+      tags:
+        - realtime
+      summary: "One of your app's declared channels (manifest `realtime.channels`)."
+      operationId: realtime_channel
+      security: []
+      responses:
+        200:
+          description: Success
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        400:
+          description: Bad request
+        401:
+          description: Unauthorized
+        404:
+          description: Not found
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/RealtimeScope"
   /public/tags/{tagId}:
     get:
       tags:
@@ -19618,6 +19645,9 @@ components:
           $ref: "#/components/schemas/AppManifestExecutor"
         functions:
           $ref: "#/components/schemas/AppManifestFunctions"
+        realtime:
+          type: object
+          additionalProperties: true
         data:
           $ref: "#/components/schemas/AppDataDeclaration"
         headless:
@@ -29830,6 +29860,79 @@ components:
         - nonce
         - mac
         - clientId
+    RealtimeScope:
+      type: object
+      properties:
+        collectionId:
+          type: string
+        appId:
+          type: string
+      required:
+        - collectionId
+    RealtimeMessage:
+      type: object
+      properties:
+        channel:
+          type: string
+        event:
+          type: string
+        data: {}
+        at:
+          type: number
+      required:
+        - channel
+        - event
+        - data
+    RealtimeChangeEvent:
+      type: object
+      properties:
+        type:
+          type: string
+        id:
+          type: string
+        appId:
+          type: string
+        recordType:
+          type: string
+        productId:
+          type: string
+        proofId:
+          type: string
+        status:
+          type: string
+        at:
+          type: number
+      required:
+        - type
+        - at
+    RealtimeChangeFilter:
+      type: object
+      properties:
+        type:
+          type: string
+        id:
+          type: string
+        appId:
+          type: string
+        recordType:
+          type: string
+        productId:
+          type: string
+        proofId:
+          type: string
+    RealtimeChannelDeclaration:
+      type: object
+      properties:
+        name:
+          type: string
+        subscribe:
+          type: object
+          additionalProperties: true
+        publish:
+          type: object
+          additionalProperties: true
+      required:
+        - name
     RealtimeChannelPattern:
       type: string
     ResearchFetchRequest:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proveanything/smartlinks",
-  "version": "2.0.55",
+  "version": "2.0.56",
   "description": "Official JavaScript/TypeScript SDK for the Smartlinks API",
   "type": "module",
   "main": "dist/index.js",

package/scripts/doctor.mjs

@@ -313,6 +313,31 @@ if (meta.respectsHostTheme) {
   if (embeds && !handRolled.length && !blocked.size) console.log(`${GREEN}✓${RESET} embedded widgets ${DIM}— ${embeds} via the host's EmbeddedWidget${RESET}`);
 }
 
+// ---- realtime: SL.realtime, never a provider library or key in the app ---------------------------
+// SmartLinks Realtime (docs/realtime.md) hands out the stream and checks every publish; an app that talks
+// to the provider directly bypasses the channel rules (and a provider key in a bundle is a key for all).
+{
+  const EXT = /\.(tsx|ts|jsx|js)$/;
+  const SKIP = new Set(['node_modules', 'dist', '.git', 'public']);
+  const hitsRt = [];
+  (function walkRt(dir) {
+    let entries = [];
+    try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      if (e.isDirectory()) { if (!SKIP.has(e.name)) walkRt(join(dir, e.name)); }
+      else if (EXT.test(e.name)) {
+        const f = join(dir, e.name);
+        const text = readFileSync(f, 'utf8');
+        if (/from\s+['"]ably(\/[^'"]*)?['"]|require\(\s*['"]ably['"]\s*\)|ABLY_(API_)?KEY/.test(text)) hitsRt.push(f.startsWith(appDir) ? f.slice(appDir.length + 1) : f);
+      }
+    }
+  })(existsSync(join(appDir, 'src')) ? join(appDir, 'src') : appDir);
+  if (hitsRt.length) {
+    console.log(`${YELLOW}⚠${RESET} realtime — talks to the realtime provider directly in ${hitsRt.slice(0, 3).join(', ')}`);
+    warnings.push(`${hitsRt.join(', ')} use${hitsRt.length === 1 ? 's' : ''} the realtime provider (Ably) directly. Use SL.realtime instead — declare channels in the manifest (realtime.channels) and use realtime.channel() / onChange() (docs/realtime.md); never put a provider key in an app.`);
+  }
+}
+
 // ---- package.json scripts point at files that exist ------------------------------------------
 // An upgrade that copies a script LINE but not the script FILE breaks every build at that step
 // (e.g. `postbuild: node scripts/smartlinks-deploy.mjs` with no scripts/smartlinks-deploy.mjs).