@vibedash/client 0.3.0 → 0.4.1

package/dist/duckdb-singleton.js

@@ -30,8 +30,23 @@ async function initDuckDB() {
         async loadParquet(name, url, forceReload = false) {
             if (loadedTables.has(name) && !forceReload)
                 return;
+            // Validate URL origin — only allow same-origin or *.vibedash.xyz
+            const parsed = new URL(url, window.location.origin);
+            const isSameOrigin = parsed.origin === window.location.origin;
+            const isVibedash = parsed.hostname.endsWith(".vibedash.xyz");
+            if (!isSameOrigin && !isVibedash) {
+                throw new Error("Parquet URL origin not allowed");
+            }
             // Fetch the Parquet file and register it
             const response = await fetch(url);
+            if (!response.ok) {
+                throw new Error(`Failed to fetch Parquet: ${response.status}`);
+            }
+            // Reject files larger than 100MB to prevent browser OOM
+            const contentLength = response.headers.get("Content-Length");
+            if (contentLength && parseInt(contentLength, 10) > 100 * 1024 * 1024) {
+                throw new Error("Parquet file too large (>100MB)");
+            }
             const buffer = await response.arrayBuffer();
             await db.registerFileBuffer(`${name}.parquet`, new Uint8Array(buffer));
             // Drop existing table on force reload so we pick up the new data

package/dist/provider.d.ts

@@ -1,11 +1,13 @@
 import type { VibeDashConfig } from "./types";
 type RefetchFn = () => Promise<void>;
-interface VibeDashContextValue extends VibeDashConfig {
+interface VibeDashContextValue extends Omit<VibeDashConfig, "apiUrl"> {
+    apiUrl: string;
+    useCredentials: boolean;
     registerQuery: (name: string, fn: RefetchFn, cachedAt: Date | null) => void;
     unregisterQuery: (name: string) => void;
     refreshAll: () => Promise<void>;
 }
-export declare function VibeDashProvider({ apiUrl, projectSlug, dashboardSlug, apiKey, children, }: VibeDashConfig & {
+export declare function VibeDashProvider({ apiUrl: apiUrlProp, projectSlug, dashboardSlug, apiKey, children, }: VibeDashConfig & {
     children: React.ReactNode;
 }): import("react/jsx-runtime").JSX.Element;
 export declare function useVibeDash(): VibeDashContextValue;

package/dist/provider.js

@@ -1,9 +1,29 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { createContext, useContext, useCallback, useRef, useEffect, useState, } from "react";
+const HUB_API_URL = "https://vibedash.xyz/api";
+function resolveApiConfig(apiUrlProp, apiKey) {
+    // Explicit override — backward compat for existing dashboards
+    if (apiUrlProp) {
+        return { apiUrl: apiUrlProp, useCredentials: !apiKey };
+    }
+    // SSR guard
+    if (typeof window === "undefined") {
+        return { apiUrl: HUB_API_URL, useCredentials: false };
+    }
+    const hostname = window.location.hostname;
+    const isLocalhost = hostname === "localhost" || hostname === "127.0.0.1";
+    if (isLocalhost) {
+        // Local dev — Hub API directly with Bearer token
+        return { apiUrl: HUB_API_URL, useCredentials: false };
+    }
+    // Production (*.vibedash.xyz or custom domain) — Worker proxy
+    return { apiUrl: "/_api", useCredentials: true };
+}
 const VibeDashContext = createContext(null);
 const POLL_INTERVAL_ACTIVE = 30000; // 30s when caching is on
 const POLL_INTERVAL_IDLE = 300000; // 5min when caching is off
-export function VibeDashProvider({ apiUrl, projectSlug, dashboardSlug, apiKey, children, }) {
+export function VibeDashProvider({ apiUrl: apiUrlProp, projectSlug, dashboardSlug, apiKey, children, }) {
+    const { apiUrl, useCredentials } = resolveApiConfig(apiUrlProp, apiKey);
     const queryMap = useRef(new Map());
     const [pollInterval, setPollInterval] = useState(POLL_INTERVAL_IDLE);
     const registerQuery = useCallback((name, fn, cachedAt) => {
@@ -35,7 +55,7 @@ export function VibeDashProvider({ apiUrl, projectSlug, dashboardSlug, apiKey, c
                 const res = await fetch(`${apiUrl}/query/status`, {
                     method: "POST",
                     headers,
-                    credentials: apiKey ? "omit" : "include",
+                    credentials: useCredentials ? "include" : "omit",
                     body: JSON.stringify({
                         project_slug: projectSlug,
                         dashboard_slug: dashboardSlug,
@@ -78,12 +98,13 @@ export function VibeDashProvider({ apiUrl, projectSlug, dashboardSlug, apiKey, c
             cancelled = true;
             clearTimeout(timeoutId);
         };
-    }, [apiUrl, projectSlug, dashboardSlug, apiKey, pollInterval]);
+    }, [apiUrl, projectSlug, dashboardSlug, apiKey, useCredentials, pollInterval]);
     return (_jsx(VibeDashContext.Provider, { value: {
             apiUrl,
             projectSlug,
             dashboardSlug,
             apiKey,
+            useCredentials,
             registerQuery,
             unregisterQuery,
             refreshAll,
@@ -93,7 +114,7 @@ export function useVibeDash() {
     const ctx = useContext(VibeDashContext);
     if (!ctx) {
         throw new Error("useVibeDash must be used within a <VibeDashProvider>. " +
-            'Wrap your app in <VibeDashProvider apiUrl="..." projectSlug="...">.');
+            'Wrap your app in <VibeDashProvider projectSlug="...">.');
     }
     return ctx;
 }

package/dist/types.d.ts

@@ -1,6 +1,10 @@
 export interface VibeDashConfig {
-    /** The Vibe Dash API URL (defaults to https://hub.vibedash.xyz/api) */
-    apiUrl: string;
+    /**
+     * API URL override. If omitted, auto-detected:
+     *   - *.vibedash.xyz or custom domain → "/_api" (Worker proxy)
+     *   - localhost / 127.0.0.1 → "https://vibedash.xyz/api" (direct)
+     */
+    apiUrl?: string;
     /** The project slug (e.g. "data-man") */
     projectSlug: string;
     /** The dashboard slug — enables auto-polling for live cache updates */

package/dist/use-query.js

@@ -26,7 +26,7 @@ import { useVibeDash } from "./provider";
  * ```
  */
 export function useQuery(queryName, options) {
-    const { apiUrl, projectSlug, apiKey, registerQuery, unregisterQuery } = useVibeDash();
+    const { apiUrl, projectSlug, apiKey, useCredentials, registerQuery, unregisterQuery } = useVibeDash();
     const [data, setData] = useState(null);
     const [loading, setLoading] = useState(false);
     const [error, setError] = useState(null);
@@ -48,7 +48,7 @@ export function useQuery(queryName, options) {
             const res = await fetch(`${apiUrl}/query`, {
                 method: "POST",
                 headers,
-                credentials: apiKey ? "omit" : "include",
+                credentials: useCredentials ? "include" : "omit",
                 body: JSON.stringify({
                     project_slug: projectSlug,
                     query_name: queryName,
@@ -92,7 +92,7 @@ export function useQuery(queryName, options) {
         finally {
             setLoading(false);
         }
-    }, [apiUrl, projectSlug, queryName, apiKey]);
+    }, [apiUrl, projectSlug, queryName, apiKey, useCredentials]);
     // Register this query by name so the provider can:
     // 1. Call refetch via useRefreshAll()
     // 2. Detect stale data via auto-polling and trigger refetch

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibedash/client",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "React hooks for Vibe Dash dashboards — useQuery() with optional DuckDB-WASM caching",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",