@fluid-app/droplet-sdk 0.2.0

package/README.md

@@ -0,0 +1,184 @@
+# @fluid-app/droplet-sdk
+
+Signature verification and tenant resolution for Fluid droplet callbacks and
+webhooks. Zero runtime dependencies.
+
+Fluid signs each callback with `HMAC-SHA256` over `{timestamp}.{body}` and sends
+the registration's own verification token alongside it. This package verifies
+that, and resolves which tenant the request belongs to from the registration
+rather than from anything in the payload.
+
+## Install
+
+Public on npmjs, so there is no `.npmrc`, no token, and nothing to configure in
+CI or in a Dockerfile:
+
+```bash
+pnpm add @fluid-app/droplet-sdk
+```
+
+## Verifying a callback
+
+```ts
+import { withFluidCallback } from "@fluid-app/droplet-sdk/next";
+import { createPrismaCallbackStore } from "@fluid-app/droplet-sdk/prisma";
+
+const callbackStore = createPrismaCallbackStore(
+  prisma.fluidCallbackRegistration,
+);
+
+export const POST = withFluidCallback(
+  {
+    definitions: ["cart_item_added"],
+    store: callbackStore,
+    resolvePrincipal: async ({ registration }) =>
+      registration.dri
+        ? prisma.company.findFirst({
+            where: { dropletInstallationUuid: registration.dri, active: true },
+          })
+        : null,
+  },
+  async ({ payload, principal, definition }) => {
+    // `principal` is the verified tenant. `definition` is the one the
+    // registration was issued for — not a field the caller declared.
+    return { success: true };
+  },
+);
+```
+
+The store needs one table. A Prisma fragment ships with the package at
+`@fluid-app/droplet-sdk/schema/callback-registrations.prisma`; the token is
+stored as a **digest**, never in the clear.
+
+## Before you enforce: populating the token store
+
+Verification matches the token presented on a request against a digest this
+droplet has stored. An installation that predates the store has none, so every
+callback would be rejected the moment verification is switched on.
+
+`backfillCallbackTokens` fills it. Fluid returns `verification_token` on its
+registration listing as well as on create, so existing registrations can be
+adopted without re-registering and without a reinstall:
+
+```ts
+import { backfillCallbackTokens } from "@fluid-app/droplet-sdk";
+
+const result = await backfillCallbackTokens({
+  client, // anything with listCallbacks({ page, per_page })
+  store, // your CallbackTokenStore
+  dri: installation.dropletInstallationUuid,
+  dropletUrl: process.env.FLUID_DROPLET_URL!,
+  // Every callback url this droplet registers. Matched exactly: the listing is
+  // company-scoped and includes other droplets' registrations, so this is what
+  // decides which tokens are yours to adopt.
+  ownUrls: callbacks.map((c) => `${process.env.FLUID_DROPLET_URL}${c.url}`),
+});
+```
+
+Run it for every active installation **before** deploying the wrapped routes. A
+partial backfill means the installations it missed start being refused.
+
+"Succeeded" is not "did not throw", and a count is not coverage. Two
+token-bearing registrations for one definition and none for another gives
+`stored: 2` with an empty `missingToken` — which looks complete and is not.
+Check the definitions actually adopted:
+
+```ts
+// `definition_name` is the field Fluid uses, and what droplet configs carry.
+const expected = callbacks
+  .filter((c) => c.enabled !== false)
+  .map((c) => c.definition_name);
+
+if (result.missingToken.length > 0) {
+  // These registrations exist but the listing returned no token for them, so
+  // they cannot be adopted. They need re-registering, not a retry.
+  throw new Error(
+    `${dri}: no token listed for ${result.missingToken.join(", ")}`,
+  );
+}
+
+const covered = new Set(result.adopted.map((r) => r.definitionName));
+const uncovered = expected.filter((d) => !covered.has(d));
+if (uncovered.length > 0) {
+  throw new Error(`${dri}: no stored token for ${uncovered.join(", ")}`);
+}
+```
+
+Require that for every installation and treat a failure as a blocker on the
+deploy, not something to fix afterwards.
+
+One limit remains, and it is about what stays behind rather than what the check
+sees. `adopted` reflects the current listing, so a stale row cannot satisfy the
+check — but the store is upsert-only, so that stale row is still there, and it
+will still verify a token Fluid no longer issues for a registration that has
+been replaced. Nothing is refused because of it; it is a credential that outlives
+its registration.
+
+`CallbackTokenStore` exposes `deleteForInstallation`, so the way to be certain
+an installation holds exactly its current registrations is to clear it and
+backfill again, in that order, for that installation only:
+
+```ts
+await store.deleteForInstallation(dri);
+const result = await backfillCallbackTokens({ ...opts, dri });
+// then assert coverage as above
+```
+
+Do that when a definition has been re-registered. A plain backfill is enough
+otherwise.
+
+## The three things most likely to bite you
+
+**`resolvePrincipal` must not read the payload.** A valid signature proves only
+_which registration_ signed — not who the request is about. Taking the tenant
+from `body.company.id` or `x-fluid-shop` lets the holder of tenant A's token
+sign a request naming tenant B. Resolve from `registration.dri` and return
+`null` if it does not resolve; `null` is treated as an auth failure.
+
+**Fail-open routes answer 200 for every outcome.** Callbacks on the checkout
+path must not reject — Fluid blocks the storefront request on the response, so a
+401 is a broken cart. Give those routes an `onAuthFailure` that returns their
+neutral shape:
+
+```ts
+onAuthFailure: () => Response.json({ tax_total: 0, lines: [] }),
+```
+
+which means status tells you nothing. **Alert on the `[fluid-callback:…]
+rejected` log line, never on the status code.**
+
+**A webhook `resolve` must return `null` for "unknown", and throw only for
+"could not find out".** The wrapper treats the two differently because Fluid
+does: a 4xx is recorded as a permanent rejection and never redelivered, while a
+5xx and a 429 are retried. So `null` answers 401, and a thrown error answers 503
+via `onResolveError`.
+
+Getting this backwards is quiet and expensive. A `resolve` that swallows its own
+database errors and returns `null` turns an outage into a wall of permanent
+rejections — and if one of them is `droplet.installed`, that company has no row,
+no webhook of theirs will ever resolve again, and the only trace is a 401. Let
+the error propagate:
+
+```ts
+resolve: async ({ dri }) => {
+  const company = await db.company.findUnique({ where: { dri } }); // may throw
+  if (!company?.webhookVerificationToken) return null; // settled: no such tenant
+  return { secret: company.webhookVerificationToken, principal: company.id };
+},
+```
+
+## Exports
+
+| Subpath    | Contents                                                                                                               |
+| ---------- | ---------------------------------------------------------------------------------------------------------------------- |
+| `.`        | `verifySignature`, `tokenDigest`, `backfillCallbackTokens`, `describeError`, store types                               |
+| `/next`    | `withFluidCallback`, `withFluidWebhook`                                                                                |
+| `/prisma`  | `createPrismaCallbackStore`                                                                                            |
+| `/drizzle` | `createDrizzleCallbackStore` — structurally typed, takes `eq` injected, so this package never depends on `drizzle-orm` |
+
+## License
+
+`UNLICENSED` — deliberately. This package is public on npmjs so that the
+standalone droplet repos can install it without a registry token, which is the
+only reason it is published at all. Public availability is not a grant of
+rights: no permission to use, copy, modify or redistribute is given.

package/dist/backfill.d.mts

@@ -0,0 +1,108 @@
+import { CallbackTokenStore } from "./store/types.mjs";
+import { Logger } from "./redact.mjs";
+
+//#region src/backfill.d.ts
+/**
+* The subset of a Fluid client this backfill needs.
+*
+* Structural, so any client exposing this method satisfies it and the package
+* does not depend on a particular client implementation.
+*/
+interface CallbackListingClient {
+  /**
+  * `GET /api/callback/registrations`.
+  *
+  * The params are optional so a zero-argument `listCallbacks()` still
+  * satisfies this type — but a client that ignores them caps the backfill at
+  * Fluid's default page size, so prefer one that forwards them.
+  */
+  listCallbacks(params?: {
+    page?: number;
+    per_page?: number;
+  }): Promise<{
+    callback_registrations: Array<{
+      uuid: string;
+      definition_name: string;
+      url: string;
+      verification_token?: string;
+    }>;
+  }>;
+}
+interface BackfillResult {
+  stored: number;
+  skipped: number;
+  /** definition_name values whose registration carried no token. */
+  missingToken: string[];
+  /** Registrations belonging to a different droplet, skipped. */
+  foreign: number;
+  /**
+  * What was actually adopted, in the order it was stored.
+  *
+  * `stored` alone cannot establish coverage: two token-bearing registrations
+  * for one definition and none for another give `stored: 2` with an empty
+  * `missingToken`, which looks complete and is not. Callers that need to know
+  * every expected definition is covered — which is every caller about to
+  * enable verification — have to compare the definitions adopted against the
+  * definitions they expect.
+  */
+  adopted: Array<{
+    uuid: string;
+    definitionName: string;
+    url: string;
+  }>;
+}
+/**
+* Populates the callback token store for an installation that predates the SDK.
+*
+* Fluid returns `verification_token` on its registration listing as well as on
+* create, so existing registrations are adopted without re-registering and
+* without a reinstall.
+*
+* Until this has run an installation has no stored tokens, every lookup misses,
+* and enforcing verification would reject its callbacks. Run it, for every
+* installation, before deploying wrapped routes.
+*
+* `ownUrls` must list the exact callback urls this droplet registers. The
+* listing is company-scoped and includes other droplets' registrations, so this
+* is what decides which tokens may be adopted; anything else is counted in
+* `foreign` and skipped. Set `FLUID_DROPLET_ALT_URL` if the same service is
+* also served on a second address.
+*
+* @returns counts of what was `stored`, `skipped` and `foreign`, plus
+* `missingToken` — definitions whose registration carried no token and which
+* therefore cannot be adopted at all.
+*/
+declare function backfillCallbackTokens({
+  client,
+  store,
+  dri,
+  dropletUrl,
+  ownUrls,
+  logger
+}: {
+  client: CallbackListingClient;
+  store: CallbackTokenStore;
+  dri: string;
+  /**
+  * This droplet's public base URL (`FLUID_DROPLET_URL`).
+  *
+  * Required, and validated: without it there is no way to tell our
+  * registrations from another droplet's, and defaulting to "adopt everything"
+  * would hand us their tokens. An absent value is a misconfiguration, so it
+  * throws rather than quietly adopting the lot.
+  */
+  dropletUrl: string;
+  /**
+  * The exact callback URLs this droplet registers. Only registrations whose
+  * url is in this set are adopted.
+  *
+  * Required, and must not be empty. Matching on origin alone is not
+  * sufficient: it accepts ANY path on this host, so a co-installed droplet
+  * could register one of our definitions at a path we do not serve and have
+  * its token adopted as ours.
+  */
+  ownUrls: string[];
+  logger?: Logger;
+}): Promise<BackfillResult>;
+//#endregion
+export { BackfillResult, CallbackListingClient, backfillCallbackTokens };

package/dist/backfill.mjs

@@ -0,0 +1,112 @@
+import { tokenDigest } from "./signatures.mjs";
+import { consoleLogger, describeError } from "./redact.mjs";
+//#region src/backfill.ts
+const PAGE_SIZE = 100;
+const MAX_PAGES = 50;
+function canonicalUrl(url) {
+	try {
+		const parsed = new URL(url);
+		parsed.pathname = parsed.pathname.replace(/\/{2,}/g, "/");
+		return parsed.toString();
+	} catch {
+		return url;
+	}
+}
+function siblingOriginFromEnv() {
+	const alt = process.env.FLUID_DROPLET_ALT_URL?.trim();
+	if (!alt) return null;
+	try {
+		const parsed = new URL(alt);
+		if (parsed.protocol !== "https:") return null;
+		return parsed.origin;
+	} catch {
+		return null;
+	}
+}
+async function backfillCallbackTokens({ client, store, dri, dropletUrl, ownUrls, logger = consoleLogger }) {
+	const ownOrigin = originOf(dropletUrl);
+	if (!ownOrigin) throw new Error("backfillCallbackTokens requires dropletUrl (FLUID_DROPLET_URL) to be a valid absolute URL; without it, another droplet's registrations cannot be told apart from ours");
+	const siblingOrigin = siblingOriginFromEnv();
+	const withSibling = (url) => {
+		if (!siblingOrigin) return [url];
+		let parsed;
+		try {
+			parsed = new URL(url);
+		} catch {
+			return [url];
+		}
+		if (parsed.origin !== ownOrigin) return [url];
+		return [url, canonicalUrl(`${siblingOrigin}${parsed.pathname}${parsed.search}${parsed.hash}`)];
+	};
+	if (!ownUrls || ownUrls.length === 0) throw new Error("backfillCallbackTokens requires ownUrls: the exact callback urls this droplet registers. Without them there is no safe way to tell our registrations from a co-installed droplet's on the same host");
+	const ownUrlSet = new Set(ownUrls.map(canonicalUrl).flatMap(withSibling));
+	const result = {
+		stored: 0,
+		skipped: 0,
+		adopted: [],
+		missingToken: [],
+		foreign: 0
+	};
+	const registrations = [];
+	const seen = new Set();
+	try {
+		for (let page = 1; page <= MAX_PAGES; page++) {
+			const batch = (await client.listCallbacks({
+				page,
+				per_page: PAGE_SIZE
+			})).callback_registrations ?? [];
+			const fresh = batch.filter((r) => !seen.has(r.uuid));
+			fresh.forEach((r) => seen.add(r.uuid));
+			registrations.push(...fresh);
+			if (batch.length === 0 || fresh.length === 0) break;
+			if (page === MAX_PAGES) logger.warn("[backfill] stopped at the page limit; some registrations may not be stored", {
+				pages: MAX_PAGES,
+				collected: registrations.length
+			});
+		}
+	} catch (error) {
+		logger.error("[backfill] could not list callback registrations", describeError(error));
+		throw error;
+	}
+	for (const registration of registrations) {
+		if (!ownUrlSet.has(registration.url)) {
+			result.foreign++;
+			continue;
+		}
+		if (!registration.verification_token || !registration.uuid) {
+			result.skipped++;
+			result.missingToken.push(registration.definition_name);
+			continue;
+		}
+		await store.upsert({
+			uuid: registration.uuid,
+			dri,
+			definitionName: registration.definition_name,
+			tokenDigest: tokenDigest(registration.verification_token),
+			url: registration.url
+		});
+		result.adopted.push({
+			uuid: registration.uuid,
+			definitionName: registration.definition_name,
+			url: registration.url
+		});
+		result.stored++;
+	}
+	if (result.missingToken.length > 0) logger.warn("[backfill] registrations returned without a verification_token; these cannot be verified until re-registered", { definitions: result.missingToken });
+	logger.info("[backfill] complete", {
+		stored: result.stored,
+		skipped: result.skipped,
+		foreign: result.foreign
+	});
+	return result;
+}
+function originOf(url) {
+	if (!url) return null;
+	try {
+		return new URL(url).origin;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+export { backfillCallbackTokens };

package/dist/checkout.d.mts

@@ -0,0 +1,41 @@
+//#region src/checkout.d.ts
+/**
+* The published shape is declared, not inferred.
+*
+* Deriving the exported type with `z.infer` made the package's public API a
+* function of whichever zod version resolved at build time, and it is also
+* what `isolatedDeclarations` refuses — the declaration emitter cannot write
+* this type without type-checking the schema. Declaring it and annotating the
+* schema against it inverts that: the interface is the contract, and the
+* validator has to satisfy it or the build fails.
+*/
+interface CheckoutCartChange {
+  cart_token: string;
+  sequence: number;
+  email: string | null;
+  state: string | null;
+}
+interface HostMessage {
+  source: unknown;
+  origin: string;
+  data: unknown;
+}
+interface CheckoutMessageTarget {
+  parent: {
+    postMessage(message: unknown, origin: string): void;
+  };
+  addEventListener(type: "message", listener: (event: HostMessage) => void): void;
+  removeEventListener(type: "message", listener: (event: HostMessage) => void): void;
+  document?: {
+    readonly visibilityState: string;
+    addEventListener(type: "visibilitychange", listener: () => void): void;
+    removeEventListener(type: "visibilitychange", listener: () => void): void;
+  };
+}
+declare function watchCheckoutCart(options: {
+  cartToken: string;
+  refresh: (change?: CheckoutCartChange) => void | Promise<void>;
+  target: CheckoutMessageTarget;
+}): () => void;
+//#endregion
+export { CheckoutCartChange, CheckoutMessageTarget, watchCheckoutCart };

package/dist/checkout.mjs

@@ -0,0 +1,98 @@
+import { z } from "zod";
+//#region src/checkout.ts
+const checkoutCartEventSchema = z.object({
+	type: z.literal("FLUID_CART_UPDATED"),
+	version: z.literal(1),
+	payload: z.object({
+		cart_token: z.string(),
+		sequence: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+		email: z.string().nullable(),
+		state: z.string().nullable()
+	})
+});
+function watchCheckoutCart(options) {
+	if (!options.cartToken.trim()) return () => {};
+	const target = options.target;
+	let stopped = false;
+	let running = false;
+	let pending = false;
+	let latest;
+	let retries = 0;
+	let retryTimer;
+	const refresh = async () => {
+		if (stopped) return;
+		if (target.document?.visibilityState === "hidden" || running) {
+			pending = true;
+			return;
+		}
+		clearTimeout(retryTimer);
+		running = true;
+		try {
+			await options.refresh(latest);
+			retries = 0;
+		} catch {
+			if (!stopped && retries < 2) retryTimer = setTimeout(() => {
+				refresh();
+			}, [1e3, 3e3][retries++]);
+		} finally {
+			running = false;
+			if (pending && !stopped) {
+				pending = false;
+				refresh();
+			}
+		}
+	};
+	const announceReady = () => target.parent.postMessage({
+		type: "FLUID_CART_READY",
+		version: 1,
+		cart_token: options.cartToken
+	}, "*");
+	const fallback = setInterval(() => {
+		refresh();
+	}, 3e4);
+	const receive = (event) => {
+		if (event.source !== target.parent || !trustedCheckoutOrigin(event.origin)) return;
+		const parsed = checkoutCartEventSchema.safeParse(event.data);
+		if (!parsed.success || parsed.data.payload.cart_token !== options.cartToken) return;
+		const change = parsed.data.payload;
+		clearInterval(fallback);
+		if (latest && change.sequence <= latest.sequence) return;
+		latest = change;
+		retries = 0;
+		clearTimeout(retryTimer);
+		refresh();
+	};
+	target.addEventListener("message", receive);
+	const resume = () => {
+		if (target.document?.visibilityState === "hidden") return;
+		if (pending) {
+			pending = false;
+			refresh();
+		}
+		announceReady();
+	};
+	target.document?.addEventListener("visibilitychange", resume);
+	refresh();
+	announceReady();
+	return () => {
+		stopped = true;
+		clearInterval(fallback);
+		clearTimeout(retryTimer);
+		target.removeEventListener("message", receive);
+		target.document?.removeEventListener("visibilitychange", resume);
+	};
+}
+function trustedCheckoutOrigin(origin) {
+	try {
+		const url = new URL(origin);
+		return url.protocol === "https:" && (url.hostname === "fluid.app" || url.hostname.endsWith(".fluid.app")) || [
+			"localhost",
+			"127.0.0.1",
+			"checkout.fluid.test"
+		].includes(url.hostname) && ["http:", "https:"].includes(url.protocol);
+	} catch {
+		return false;
+	}
+}
+//#endregion
+export { watchCheckoutCart };

package/dist/drizzle.d.mts

@@ -0,0 +1,2 @@
+import { DrizzleCallbackTable, DrizzleLike, EqFn, createDrizzleCallbackStore } from "./store/drizzle.mjs";
+export { type DrizzleCallbackTable, type DrizzleLike, type EqFn, createDrizzleCallbackStore };

package/dist/drizzle.mjs

@@ -0,0 +1,2 @@
+import { createDrizzleCallbackStore } from "./store/drizzle.mjs";
+export { createDrizzleCallbackStore };

package/dist/index.d.mts

@@ -0,0 +1,6 @@
+import { CallbackTokenStore, StoredRegistration } from "./store/types.mjs";
+import { MAX_SIGNATURE_AGE_SECONDS, SignatureFailureReason, SignatureResult, VerifySignatureInput, tokenDigest, verifySignature } from "./signatures.mjs";
+import { Logger, consoleLogger, describeError, redactValue } from "./redact.mjs";
+import { BackfillResult, CallbackListingClient, backfillCallbackTokens } from "./backfill.mjs";
+import { CallbackVerificationReadiness, reportCallbackVerificationReadiness } from "./readiness.mjs";
+export { type BackfillResult, type CallbackListingClient, type CallbackTokenStore, type CallbackVerificationReadiness, type Logger, MAX_SIGNATURE_AGE_SECONDS, type SignatureFailureReason, type SignatureResult, type StoredRegistration, type VerifySignatureInput, backfillCallbackTokens, consoleLogger, describeError, redactValue, reportCallbackVerificationReadiness, tokenDigest, verifySignature };

package/dist/index.mjs

@@ -0,0 +1,5 @@
+import { MAX_SIGNATURE_AGE_SECONDS, tokenDigest, verifySignature } from "./signatures.mjs";
+import { consoleLogger, describeError, redactValue } from "./redact.mjs";
+import { backfillCallbackTokens } from "./backfill.mjs";
+import { reportCallbackVerificationReadiness } from "./readiness.mjs";
+export { MAX_SIGNATURE_AGE_SECONDS, backfillCallbackTokens, consoleLogger, describeError, redactValue, reportCallbackVerificationReadiness, tokenDigest, verifySignature };

package/dist/next/callbacks.d.mts

@@ -0,0 +1,81 @@
+import { CallbackTokenStore, StoredRegistration } from "../store/types.mjs";
+import { Logger } from "../redact.mjs";
+
+//#region src/next/callbacks.d.ts
+interface CallbackContext<Principal> {
+  /** Parsed body. Only reached after the signature verified. */
+  payload: unknown;
+  /** Which of the configured definitions this registration serves. */
+  definition: string;
+  /** App-resolved tenant. Trustworthy; do not re-derive from payload. */
+  principal: Principal;
+  /**
+  * The registration whose token verified this request.
+  *
+  * Never null: every path that leaves it unresolved returns before the handler
+  * runs.
+  */
+  registration: StoredRegistration;
+  /** The body stream is consumed by the wrapper, so these are passed explicitly. */
+  headers: Headers;
+  signal: AbortSignal;
+  rawBody: string;
+}
+interface CallbackFailure {
+  stage: "auth" | "body" | "handler";
+  reason: string;
+  /** Present only for handler failures. */
+  error?: unknown;
+}
+interface WithFluidCallbackConfig<Principal> {
+  /**
+  * Definition names this route serves.
+  *
+  * An array because one route legitimately serves several — a single
+  * cart-item-changed handler may be registered under five definitions. A token
+  * issued for a definition this route does not serve is rejected.
+  */
+  definitions: string[];
+  store: CallbackTokenStore;
+  /**
+  * Resolves the tenant *after* the signature verifies.
+  *
+  * Returning null is treated as an auth failure — an authenticated
+  * registration whose tenant cannot be resolved is not safe to run.
+  */
+  resolvePrincipal: (input: {
+    registration: StoredRegistration;
+    payload: unknown;
+    headers: Headers;
+  }) => Promise<Principal | null>;
+  logger?: Logger;
+  /** Label used in log lines. Defaults to the first definition. */
+  name?: string;
+  /**
+  * Failure policy. Defaults fail closed with 401/400/500.
+  *
+  * Routes on the checkout path must override these — a tax droplet answers a
+  * failed calculation with a zero-tax object, and returning a 401 there would
+  * break the cart rather than protect it.
+  */
+  onAuthFailure?: (failure: CallbackFailure) => Response;
+  onInvalidBody?: (failure: CallbackFailure) => Response;
+  onHandlerError?: (failure: CallbackFailure) => Response;
+}
+type CallbackHandler<Principal> = (context: CallbackContext<Principal>) => Promise<Response | unknown>;
+/**
+* Wraps a Fluid callback route with signature verification.
+*
+* Order of operations matters and is the reason this wrapper exists:
+*
+*   1. read the raw body (the exact bytes Fluid signed)
+*   2. locate the registration by digest of the presented token
+*   3. verify the signature against the *stored* registration
+*   4. only then parse, resolve the tenant, and run the handler
+*
+* Step 1 is why every route cannot simply keep calling `request.json()`:
+* re-serialising a parsed object does not reliably reproduce the signed bytes.
+*/
+declare function withFluidCallback<Principal>(config: WithFluidCallbackConfig<Principal>, handler: CallbackHandler<Principal>): (request: Request) => Promise<Response>;
+//#endregion
+export { CallbackContext, CallbackFailure, CallbackHandler, WithFluidCallbackConfig, withFluidCallback };