svelte-realtime 0.4.18 → 0.4.20

package/README.md

@@ -574,7 +574,7 @@ Same arguments return the same cached store instance. The cache is cleaned up wh
 
 ## Schema validation
 
-Use `live.validated(schema, fn)` to validate the first argument against a Zod or Valibot schema before the function runs.
+Use `live.validated(schema, fn)` to validate the first argument against a schema before the function runs. Any [Standard Schema](https://standardschema.dev/)-compatible validator is supported, including Zod, ArkType, Valibot, and others.
 
 ```js
 import { z } from 'zod';
@@ -592,7 +592,22 @@ export const addTodo = live.validated(CreateTodo, async (ctx, input) => {
 });
 ```
 
-On the client, validated exports work like regular `live()` calls. Validation errors are thrown as `RpcError` with `code: 'VALIDATION'` and an `issues` array. Valibot schemas are also supported -- the adapter detects the schema type automatically.
+Because `live.validated()` uses the [Standard Schema](https://standardschema.dev/) interface, you can swap in any compatible validator:
+
+```js
+import { type } from 'arktype';
+import { live } from 'svelte-realtime/server';
+
+const CreateTodo = type({ text: 'string>0', priority: '"low"|"medium"|"high"|undefined' });
+
+export const addTodo = live.validated(CreateTodo, async (ctx, input) => {
+  const todo = await db.todos.insert({ ...input, userId: ctx.user.id });
+  ctx.publish('todos', 'created', todo);
+  return todo;
+});
+```
+
+On the client, validated exports work like regular `live()` calls. Validation errors are thrown as `RpcError` with `code: 'VALIDATION'` and an `issues` array.
 
 ---
 
@@ -1266,6 +1281,10 @@ export function open(ws, { platform }) {
 }
 ```
 
+Without this call, derived streams will still serve their initial SSR data but will never receive live updates. In dev mode, a console warning is emitted when a client subscribes to a derived stream and `_activateDerived` has not been called.
+
+Dynamic derived compute functions receive `ctx.user` from the subscribing client, so auth checks like `if (orgId !== ctx.user.organization_id) throw new LiveError("FORBIDDEN")` work the same as they do in regular stream handlers.
+
 | Option | Default | Description |
 |---|---|---|
 | `merge` | `'set'` | Merge strategy for the derived topic |
@@ -1948,7 +1967,7 @@ Import from `svelte-realtime/server`.
 | `live.stream(topic, initFn, options?)` | Create a reactive stream |
 | `live.channel(topic, options?)` | Create an ephemeral pub/sub channel |
 | `live.binary(fn, options?)` | Mark a function as a binary RPC handler (`maxSize` limits payload, default 10MB) |
-| `live.validated(schema, fn)` | RPC with Zod/Valibot input validation |
+| `live.validated(schema, fn)` | RPC with [Standard Schema](https://standardschema.dev/) input validation (Zod, ArkType, Valibot, etc.) |
 | `live.cron(schedule, topic, fn)` | Server-side scheduled function |
 | `live.derived(sources, fn, options?)` | Server-side computed stream (static or dynamic sources) |
 | `live.effect(sources, fn, options?)` | Server-side reactive side effect |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svelte-realtime",
-  "version": "0.4.18",
+  "version": "0.4.20",
   "description": "Realtime RPC and reactive subscriptions for SvelteKit, built on svelte-adapter-uws",
   "author": "Kevin Radziszewski",
   "license": "MIT",

package/server.d.ts

@@ -370,18 +370,29 @@ export namespace live {
 	/**
 	 * Mark a function as RPC-callable with schema validation.
 	 * Validates args[0] against the schema before calling fn.
-	 * Supports Zod and Valibot schemas.
+	 * Supports any [Standard Schema](https://standardschema.dev/)-compatible schema,
+	 * including Zod, ArkType, Valibot v1+, and others.
 	 *
-	 * @param schema - Zod or Valibot schema
+	 * @param schema - Zod, ArkType, Valibot, or any Standard Schema-compatible schema
 	 * @param fn - Handler function (ctx, validatedInput, ...rest)
 	 *
 	 * @example
 	 * ```js
+	 * import { z } from 'zod';
 	 * const SendSchema = z.object({ text: z.string().min(1) });
 	 * export const send = live.validated(SendSchema, async (ctx, input) => {
 	 *   // input is validated and typed
 	 * });
 	 * ```
+	 *
+	 * @example
+	 * ```js
+	 * import { type } from 'arktype';
+	 * const SendSchema = type({ text: 'string>0' });
+	 * export const send = live.validated(SendSchema, async (ctx, input) => {
+	 *   // works with any Standard Schema-compatible validator
+	 * });
+	 * ```
 	 */
 	function validated<S, T extends (ctx: LiveContext<any>, input: any, ...args: any[]) => any>(
 		schema: S,

package/server.js

@@ -600,9 +600,10 @@ live.rateLimit = function rateLimit(config, fn) {
 /**
  * Mark a function as RPC-callable with schema validation.
  * Validates args[0] against the schema before calling fn.
- * Supports Zod (.safeParse method on schema) and Valibot (safeParse as standalone).
+ * Supports any Standard Schema-compatible schema (https://standardschema.dev/),
+ * including Zod, ArkType, Valibot v1+, and others.
  *
- * @param {any} schema - Zod or Valibot schema
+ * @param {any} schema - Zod, ArkType, Valibot, or any Standard Schema-compatible schema
  * @param {Function} fn - Handler function (ctx, validatedInput, ...rest)
  * @returns {Function}
  */
@@ -626,13 +627,36 @@ live.validated = function validated(schema, fn) {
 };
 
 /**
- * Validate input against a Zod or Valibot schema.
+ * Validate input against a Standard Schema-compatible schema, with legacy Zod/Valibot fallbacks.
  * @param {any} schema
  * @param {any} input
  * @returns {{ ok: true, data: any } | { ok: false, message: string, issues: Array<{ path: string[], message: string }> }}
  */
 function _validate(schema, input) {
-	// Zod-style: schema has .safeParse method
+	// Standard Schema: schema exposes `~standard.validate` (https://standardschema.dev/)
+	if (schema?.['~standard'] && typeof schema['~standard'].validate === 'function') {
+		const result = schema['~standard'].validate(input);
+		if (result instanceof Promise) {
+			return {
+				ok: false,
+				message: 'Async schemas are not supported in live.validated(). Use a synchronous schema.',
+				issues: [{ path: [], message: 'Async schema not supported' }]
+			};
+		}
+		if (result.issues == null) {
+			return { ok: true, data: result.value };
+		}
+		const issues = result.issues.map((/** @type {any} */ i) => ({
+			path: (i.path || []).map((/** @type {any} */ p) => {
+				const key = typeof p === 'object' && p !== null && 'key' in p ? p.key : p;
+				return key != null ? String(key) : '';
+			}).filter((k) => k !== ''),
+			message: i.message || 'Validation failed'
+		}));
+		return { ok: false, message: 'Validation failed', issues };
+	}
+
+	// Zod legacy fallback: schema has .safeParse method
 	if (typeof schema?.safeParse === 'function') {
 		const result = schema.safeParse(input);
 		if (result.success) {
@@ -649,7 +673,7 @@ function _validate(schema, input) {
 		};
 	}
 
-	// Valibot-style: schema is passed to a standalone safeParse
+	// Valibot legacy fallback: schema is passed to a standalone safeParse
 	// In Valibot v1, schemas have a ._run or .pipe method
 	// Try to use the schema directly as a Valibot schema
 	if (schema?._run || schema?.pipe || schema?.type) {
@@ -675,7 +699,7 @@ function _validate(schema, input) {
 	// Unknown schema type -- reject. Passing unvalidated input through is a security risk.
 	return {
 		ok: false,
-		message: 'Unrecognized schema type passed to live.validated(). Supported: Zod (.safeParse), Valibot (._run).',
+		message: 'Unrecognized schema type passed to live.validated(). Supported: Standard Schema (https://standardschema.dev/), Zod (.safeParse), Valibot (._run).',
 		issues: [{ path: [], message: 'Unrecognized schema type' }]
 	};
 }
@@ -754,7 +778,7 @@ live.derived = function derived(sources, fn, options) {
 		/** @type {Map<string, any[]>} */
 		const topicArgs = new Map();
 		const topicFn = (...args) => {
-			const t = baseTopic + '\x00' + args.map(a => String(a).replace(/\x00/g, '')).join('\x00');
+			const t = baseTopic + '~' + args.map(a => String(a).replace(/~/g, '')).join('~');
 			topicArgs.set(t, args);
 			if (topicArgs.size > 10000) {
 				const iter = topicArgs.keys();
@@ -767,7 +791,7 @@ live.derived = function derived(sources, fn, options) {
 		/** @type {any} */ (fn).__derivedTopicArgs = topicArgs;
 
 		/** @type {any} */ (fn).__onSubscribe = function (_ctx, resolvedTopic) {
-			_activateDynamicDerived(fn, resolvedTopic);
+			_activateDynamicDerived(fn, resolvedTopic, _ctx && _ctx.user);
 		};
 		/** @type {any} */ (fn).__onUnsubscribe = function (_ctx, resolvedTopic) {
 			_deactivateDynamicDerived(fn, resolvedTopic);
@@ -791,6 +815,12 @@ const _dynamicDerivedByFn = new Map();
 /** @type {import('svelte-adapter-uws').Platform | null} Captured platform for dynamic derived recomputation */
 let _derivedPlatform = null;
 
+/** @type {boolean} Whether _activateDerived has been called at least once */
+let _activateDerivedCalled = false;
+
+/** @type {boolean} Whether the missing _activateDerived warning has already fired */
+let _warnedActivateDerived = false;
+
 /** @type {Map<string, { sources: string[], fn: Function, debounce: number, timer: ReturnType<typeof setTimeout> | null }>} */
 const effectRegistry = new Map();
 
@@ -1363,6 +1393,7 @@ live.breaker = function breaker(options, fn) {
 export function __registerDerived(path, fn) {
 	if (/** @type {any} */ (fn).__lazy) {
 		_lazyQueue.push({ type: 'derived', path, loader: fn });
+		_hasDynamicDerived = true;
 		return;
 	}
 
@@ -1373,7 +1404,7 @@ export function __registerDerived(path, fn) {
 		/** @type {Map<string, any[]>} */
 		const topicArgs = new Map();
 		const topicFn = (...args) => {
-			const t = path + '\x00' + args.map(a => String(a).replace(/\x00/g, '')).join('\x00');
+			const t = path + '~' + args.map(a => String(a).replace(/~/g, '')).join('~');
 			topicArgs.set(t, args);
 			if (topicArgs.size > 10000) {
 				const iter = topicArgs.keys();
@@ -1419,6 +1450,7 @@ const _activatedPlatforms = new WeakSet();
 
 export function _activateDerived(platform) {
 	_derivedPlatform = platform;
+	_activateDerivedCalled = true;
 	if (_activatedPlatforms.has(platform)) return;
 
 	// Only wrap platform.publish if there are actual reactive registrations
@@ -1519,7 +1551,7 @@ async function _recomputeDerived(entry, platform) {
 		let result;
 		if (entry.args) {
 			const _h = _getCtxHelpers(platform);
-			const ctx = _buildCtx(null, null, platform, _h, null);
+			const ctx = _buildCtx(entry.user || null, null, platform, _h, null);
 			result = await entry.fn(ctx, ...entry.args);
 		} else {
 			result = await entry.fn();
@@ -1539,8 +1571,9 @@ async function _recomputeDerived(entry, platform) {
  * Wires the instance's resolved sources into _derivedBySource so publishes trigger recomputation.
  * @param {Function} fn - The derived compute function
  * @param {string} resolvedTopic - The resolved output topic (e.g. '__derived:5:org_123')
+ * @param {any} [user] - The subscribing client's user data, used for ctx during recomputation
  */
-function _activateDynamicDerived(fn, resolvedTopic) {
+function _activateDynamicDerived(fn, resolvedTopic, user) {
 	const entry = _dynamicDerivedByFn.get(fn);
 	if (!entry) return;
 
@@ -1576,7 +1609,8 @@ function _activateDynamicDerived(fn, resolvedTopic) {
 		resolvedSources,
 		debounce: entry.debounce,
 		timer: null,
-		refCount: 1
+		refCount: 1,
+		user: user || null
 	};
 
 	entry.instances.set(resolvedTopic, instance);
@@ -1828,6 +1862,8 @@ export function _prepareHmr() {
 	_streamsWithUnsubscribe.clear();
 	_hasDynamicDerived = false;
 	_dynamicDerivedByFn.clear();
+	_activateDerivedCalled = false;
+	_warnedActivateDerived = false;
 
 	return snap;
 }
@@ -2310,6 +2346,13 @@ async function _executeSingleRpc(ws, msg, platform, options) {
 				try { await /** @type {any} */ (fn).__onSubscribe(ctx, topic); } catch {}
 			}
 
+			if (/** @type {any} */ (fn).__isDerived && !_activateDerivedCalled && !_warnedActivateDerived) {
+				if (typeof process !== 'undefined' && process.env.NODE_ENV !== 'production') {
+					_warnedActivateDerived = true;
+					console.warn('[svelte-realtime] live.derived() subscribed but _activateDerived(platform) was never called. Derived streams will not receive live updates.\n  Call _activateDerived(platform) in your WebSocket open hook.\n  See: https://svti.me/derived');
+				}
+			}
+
 			// Channel fast-path
 			if (/** @type {any} */ (fn).__isChannel) {
 				const emptyValue = streamOpts.merge === 'set' ? null : [];