@fluid-app/droplet-sdk 0.2.0

package/dist/store/drizzle.d.mts

@@ -0,0 +1,50 @@
+import { CallbackTokenStore, StoredRegistration } from "./types.mjs";
+
+//#region src/store/drizzle.d.ts
+/**
+* Minimal surface of the Drizzle table and database this adapter needs.
+*
+* Typed structurally so the package does not depend on a specific Drizzle
+* version or dialect, and so a Prisma-backed and a Drizzle-backed droplet can
+* use the same store interface.
+*/
+interface DrizzleCallbackTable {
+  uuid: unknown;
+  dri: unknown;
+  definitionName: unknown;
+  tokenDigest: unknown;
+  url: unknown;
+}
+interface DrizzleLike {
+  select(): {
+    from(table: DrizzleCallbackTable): {
+      where(condition: unknown): {
+        limit(n: number): Promise<StoredRegistration[]>;
+      };
+    };
+  };
+  insert(table: DrizzleCallbackTable): {
+    values(row: StoredRegistration): {
+      onConflictDoUpdate(args: {
+        target: unknown;
+        set: Omit<StoredRegistration, "uuid">;
+      }): Promise<unknown>;
+    };
+  };
+  delete(table: DrizzleCallbackTable): {
+    where(condition: unknown): Promise<unknown>;
+  };
+}
+/** `eq` from drizzle-orm, injected so the package need not depend on it directly. */
+type EqFn = (column: unknown, value: unknown) => unknown;
+/**
+* Wraps a Drizzle table as a CallbackTokenStore.
+*
+* Usage:
+*
+*   import { eq } from "drizzle-orm";
+*   createDrizzleCallbackStore(db, fluidCallbackRegistrations, eq)
+*/
+declare function createDrizzleCallbackStore(db: DrizzleLike, table: DrizzleCallbackTable, eq: EqFn): CallbackTokenStore;
+//#endregion
+export { DrizzleCallbackTable, DrizzleLike, EqFn, createDrizzleCallbackStore };

package/dist/store/drizzle.mjs

@@ -0,0 +1,20 @@
+//#region src/store/drizzle.ts
+function createDrizzleCallbackStore(db, table, eq) {
+	return {
+		async findByTokenDigest(digest) {
+			return (await db.select().from(table).where(eq(table.tokenDigest, digest)).limit(1))[0] ?? null;
+		},
+		async upsert(registration) {
+			const { uuid, ...rest } = registration;
+			await db.insert(table).values(registration).onConflictDoUpdate({
+				target: table.uuid,
+				set: rest
+			});
+		},
+		async deleteForInstallation(dri) {
+			await db.delete(table).where(eq(table.dri, dri));
+		}
+	};
+}
+//#endregion
+export { createDrizzleCallbackStore };

package/dist/store/prisma.d.mts

@@ -0,0 +1,46 @@
+import { CallbackTokenStore, StoredRegistration } from "./types.mjs";
+
+//#region src/store/prisma.d.ts
+/**
+* The delegate shape this adapter needs.
+*
+* Structural rather than importing a generated Prisma client: each droplet
+* names the model differently, and the package must not depend on any one
+* droplet's generated types.
+*/
+interface PrismaCallbackDelegate {
+  findUnique(args: {
+    where: {
+      tokenDigest: string;
+    };
+  }): Promise<StoredRegistration | null>;
+  upsert(args: {
+    where: {
+      uuid: string;
+    };
+    create: StoredRegistration;
+    update: Omit<StoredRegistration, "uuid">;
+  }): Promise<unknown>;
+  deleteMany(args: {
+    where: {
+      dri: string;
+    };
+  }): Promise<unknown>;
+  count(args: {
+    where: {
+      definitionName: {
+        in: string[];
+      };
+    };
+  }): Promise<number>;
+}
+/**
+* Wraps a Prisma model delegate as a CallbackTokenStore.
+*
+* Usage:
+*
+*   createPrismaCallbackStore(prisma.fluidCallbackRegistration)
+*/
+declare function createPrismaCallbackStore(delegate: PrismaCallbackDelegate): CallbackTokenStore;
+//#endregion
+export { PrismaCallbackDelegate, createPrismaCallbackStore };

package/dist/store/prisma.mjs

@@ -0,0 +1,21 @@
+//#region src/store/prisma.ts
+function createPrismaCallbackStore(delegate) {
+	return {
+		async findByTokenDigest(digest) {
+			return delegate.findUnique({ where: { tokenDigest: digest } });
+		},
+		async upsert(registration) {
+			const { uuid, ...rest } = registration;
+			await delegate.upsert({
+				where: { uuid },
+				create: registration,
+				update: rest
+			});
+		},
+		async deleteForInstallation(dri) {
+			await delegate.deleteMany({ where: { dri } });
+		}
+	};
+}
+//#endregion
+export { createPrismaCallbackStore };

package/dist/store/types.d.mts

@@ -0,0 +1,26 @@
+//#region src/store/types.d.ts
+/**
+* Storage port for callback verification tokens.
+*
+* Deliberately narrow: this package owns one table and nothing else.
+* Installation and company storage stay app-owned.
+*/
+interface StoredRegistration {
+  /** Fluid's `cbr_` registration uuid. */
+  uuid: string;
+  /** droplet_installation_uuid (`dri_`) this registration belongs to. */
+  dri: string;
+  /** Which callback definition this registration serves. */
+  definitionName: string;
+  /** sha256 of the `cvt_` token. Never the token itself. */
+  tokenDigest: string;
+  url: string;
+}
+interface CallbackTokenStore {
+  /** Locate a registration by the digest of a presented token. Must be an indexed lookup. */
+  findByTokenDigest(digest: string): Promise<StoredRegistration | null>;
+  upsert(registration: StoredRegistration): Promise<void>;
+  deleteForInstallation(dri: string): Promise<void>;
+}
+//#endregion
+export { CallbackTokenStore, StoredRegistration };

package/package.json

@@ -0,0 +1,75 @@
+{
+  "name": "@fluid-app/droplet-sdk",
+  "version": "0.2.0",
+  "description": "Signature verification and tenancy for Fluid droplet callbacks and webhooks",
+  "type": "module",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/fluid-commerce/fluid.git",
+    "directory": "packages/platform/droplet-sdk"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "schema"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "default": "./dist/index.mjs"
+    },
+    "./next": {
+      "types": "./dist/next.d.mts",
+      "default": "./dist/next.mjs"
+    },
+    "./prisma": {
+      "types": "./dist/prisma.d.mts",
+      "default": "./dist/prisma.mjs"
+    },
+    "./drizzle": {
+      "types": "./dist/drizzle.d.mts",
+      "default": "./dist/drizzle.mjs"
+    },
+    "./schema/callback-registrations.prisma": "./schema/callback-registrations.prisma",
+    "./checkout": {
+      "types": "./dist/checkout.d.mts",
+      "default": "./dist/checkout.mjs"
+    }
+  },
+  "peerDependencies": {
+    "typescript": "^5"
+  },
+  "peerDependenciesMeta": {
+    "typescript": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "zod": "4.3.5"
+  },
+  "devDependencies": {
+    "@electric-sql/pglite": "^0.5.5",
+    "@fluid-app/typescript-config": "0.0.0",
+    "@types/node": "24.10.12",
+    "drizzle-orm": "^0.45.2",
+    "tsdown": "^0.21.0",
+    "typescript": "^5",
+    "vitest": "^4.0.18"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "dev": "tsdown --watch",
+    "lint": "oxlint",
+    "lint:fix": "oxlint --fix",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsgo --noEmit",
+    "vectors:generate": "ruby vectors/generate.rb ../../../apps/rails > vectors/fluid-signing.json",
+    "vectors:check": "ruby vectors/generate.rb ../../../apps/rails | diff -u vectors/fluid-signing.json -",
+    "check:publish-shape": "node scripts/check-publish-shape.mjs"
+  }
+}

package/schema/callback-registrations.prisma

@@ -0,0 +1,21 @@
+// Callback verification tokens, owned by @fluid-app/droplet-sdk.
+//
+// Paste into a droplet's schema.prisma. The shape is deliberately fixed, so it
+// stays identical wherever it is used and does not depend on the ORM.
+//
+// Only the digest is stored: Fluid presents the plaintext token on every
+// request, so a digest is enough to locate the registration, and a database
+// dump then yields no working callback credentials.
+model FluidCallbackRegistration {
+  uuid           String @id
+  dri            String
+  definitionName String @map("definition_name")
+  tokenDigest    String @unique @map("token_digest")
+  url            String
+
+  createdAt DateTime @default(now()) @map("created_at")
+  updatedAt DateTime @updatedAt @map("updated_at")
+
+  @@index([dri])
+  @@map("fluid_callback_registrations")
+}