@foir/sdk 0.1.0

package/dist/server.js

@@ -0,0 +1,296 @@
+// src/server/server-client.ts
+var ServerClientError = class extends Error {
+  constructor(message, status, response) {
+    super(message);
+    this.status = status;
+    this.response = response;
+    this.name = "ServerClientError";
+  }
+  status;
+  response;
+};
+function createServerClient(options) {
+  const { baseUrl, apiKey } = options;
+  async function request(url, init = {}) {
+    const res = await fetch(url, {
+      ...init,
+      headers: {
+        "Content-Type": "application/json",
+        "x-api-key": apiKey,
+        ...init.headers
+      }
+    });
+    const text = await res.text();
+    if (!res.ok) {
+      let body;
+      try {
+        body = JSON.parse(text);
+      } catch {
+        body = text;
+      }
+      throw new ServerClientError(
+        `Platform API error: ${res.status} ${res.statusText}`,
+        res.status,
+        body
+      );
+    }
+    if (!text) return void 0;
+    return JSON.parse(text);
+  }
+  return {
+    async query(query, variables) {
+      return request(`${baseUrl}/graphql`, {
+        method: "POST",
+        body: JSON.stringify({ query, variables })
+      });
+    }
+  };
+}
+
+// src/server/webhook-helpers.ts
+async function verifyWebhookSignature(payload, signature, secret) {
+  if (!signature || !secret) return false;
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signatureBytes = await crypto.subtle.sign(
+    "HMAC",
+    key,
+    encoder.encode(payload)
+  );
+  const computed = Array.from(new Uint8Array(signatureBytes)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  if (computed.length !== signature.length) return false;
+  let mismatch = 0;
+  for (let i = 0; i < computed.length; i++) {
+    mismatch |= computed.charCodeAt(i) ^ signature.charCodeAt(i);
+  }
+  return mismatch === 0;
+}
+
+// src/server/verify-scoped-token.ts
+var JWKS_CACHE_TTL_MS = 5 * 60 * 1e3;
+function getCache() {
+  const g = globalThis;
+  if (!g.__foirJwksCache) {
+    g.__foirJwksCache = /* @__PURE__ */ new Map();
+  }
+  return g.__foirJwksCache;
+}
+function base64UrlDecode(s) {
+  const padded = s.replace(/-/g, "+").replace(/_/g, "/").padEnd(s.length + (4 - s.length % 4) % 4, "=");
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+async function loadJwks(jwksUrl) {
+  const cache = getCache();
+  const cached = cache.get(jwksUrl);
+  if (cached && Date.now() - cached.fetchedAt < JWKS_CACHE_TTL_MS) {
+    return cached.keys;
+  }
+  const res = await fetch(jwksUrl);
+  if (!res.ok) throw new Error(`jwks fetch ${res.status}`);
+  const doc = await res.json();
+  const keys = /* @__PURE__ */ new Map();
+  for (const jwk of doc.keys) {
+    if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519") continue;
+    const raw = base64UrlDecode(jwk.x);
+    const key = await crypto.subtle.importKey(
+      "raw",
+      raw.buffer.slice(
+        raw.byteOffset,
+        raw.byteOffset + raw.byteLength
+      ),
+      { name: "Ed25519" },
+      false,
+      ["verify"]
+    );
+    keys.set(jwk.kid, key);
+  }
+  cache.set(jwksUrl, { keys, fetchedAt: Date.now() });
+  return keys;
+}
+function parseSubject(sub) {
+  const parts = sub.split("|");
+  if (parts.length !== 3) {
+    throw new Error(`malformed sub: expected 3 pipe-delimited segments, got ${parts.length}`);
+  }
+  const [tenantId, projectId, appName] = parts;
+  if (!tenantId || !projectId || !appName) {
+    throw new Error("malformed sub: empty segment");
+  }
+  return { tenantId, projectId, appName };
+}
+function recordsReadModels(claims) {
+  return claims.rrm ?? [];
+}
+function recordsWriteModels(claims) {
+  return claims.rwm ?? [];
+}
+async function verifyScopedToken(token, jwksUrl, options) {
+  const expectedIssuer = options?.expectedIssuer ?? "foir-platform";
+  const parts = token.split(".");
+  if (parts.length !== 3) throw new Error("malformed token");
+  const [rawHeader, rawPayload, rawSig] = parts;
+  const header = JSON.parse(
+    new TextDecoder().decode(base64UrlDecode(rawHeader))
+  );
+  if (header.alg !== "EdDSA") throw new Error(`unexpected alg ${header.alg}`);
+  if (!header.kid) throw new Error("missing kid");
+  const keys = await loadJwks(jwksUrl);
+  const key = keys.get(header.kid);
+  if (!key) throw new Error(`unknown kid ${header.kid}`);
+  const signingInput = new TextEncoder().encode(`${rawHeader}.${rawPayload}`);
+  const sig = base64UrlDecode(rawSig);
+  const ok = await crypto.subtle.verify(
+    { name: "Ed25519" },
+    key,
+    sig.buffer.slice(sig.byteOffset, sig.byteOffset + sig.byteLength),
+    signingInput.buffer.slice(
+      signingInput.byteOffset,
+      signingInput.byteOffset + signingInput.byteLength
+    )
+  );
+  if (!ok) throw new Error("signature invalid");
+  const claims = JSON.parse(
+    new TextDecoder().decode(base64UrlDecode(rawPayload))
+  );
+  const now = Math.floor(Date.now() / 1e3);
+  if (claims.iss !== expectedIssuer) throw new Error(`bad iss ${claims.iss}`);
+  if (typeof claims.exp !== "number" || claims.exp < now) {
+    throw new Error("token expired");
+  }
+  if (typeof claims.nbf === "number" && claims.nbf > now + 30) {
+    throw new Error("token not yet valid");
+  }
+  return claims;
+}
+function parseContextHeader(raw) {
+  if (!raw) return {};
+  const out = {};
+  for (const part of raw.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq < 0) continue;
+    const k = part.slice(0, eq).trim();
+    const v = part.slice(eq + 1).trim();
+    if (k) out[k] = v;
+  }
+  return out;
+}
+
+// src/server/callback-client.ts
+function createCallbackClient(callback, opts) {
+  const { executionId, signingSecret } = opts;
+  const fetchImpl = opts.fetch ?? globalThis.fetch;
+  if (!fetchImpl) {
+    throw new Error(
+      "createCallbackClient: no fetch available; pass opts.fetch on runtimes without a global fetch"
+    );
+  }
+  if (!executionId) throw new Error("createCallbackClient: executionId is required");
+  if (!signingSecret) throw new Error("createCallbackClient: signingSecret is required");
+  if (!callback?.token || !callback?.gqlEndpoint || !callback?.mutations) {
+    throw new Error("createCallbackClient: callback block is missing required fields");
+  }
+  const post = async (mutationName, fields, variables) => {
+    const query = `mutation ${mutationName}Mutation($id: String!${fieldArgsForMutation(mutationName, variables)}) { ${mutationName}(id: $id${fieldArgsCallSite(mutationName, variables)}) { ${fields} } }`;
+    const body = JSON.stringify({
+      query,
+      variables: { id: executionId, ...variables }
+    });
+    const signature = await hmacSha256Hex(signingSecret, body);
+    const resp = await fetchImpl(callback.gqlEndpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${callback.token}`,
+        "X-Foir-Signature": `sha256=${signature}`
+      },
+      body
+    });
+    if (!resp.ok) {
+      throw new Error(`callback ${mutationName} failed with HTTP ${resp.status}: ${await resp.text()}`);
+    }
+    const json = await resp.json();
+    if (json.errors?.length) {
+      throw new Error(`callback ${mutationName} GraphQL error: ${json.errors[0].message}`);
+    }
+    const out = json.data?.[mutationName];
+    if (!out) {
+      throw new Error(`callback ${mutationName} returned no data`);
+    }
+    return out;
+  };
+  return {
+    complete: (result) => post(callback.mutations.complete, "status cancelled", { result }),
+    fail: (code, message, options = {}) => post(callback.mutations.fail, "status cancelled", {
+      code,
+      message,
+      retryable: options.retryable,
+      details: options.details
+    }),
+    progress: (update) => post(callback.mutations.progress, "status cancelled applied", {
+      pct: update.pct,
+      message: update.message,
+      metadata: update.metadata
+    }),
+    cancel: () => post(callback.mutations.cancel, "status cancelled", {})
+  };
+}
+function fieldArgsForMutation(mutationName, vars) {
+  const parts = [];
+  for (const key of Object.keys(vars)) {
+    if (vars[key] === void 0) continue;
+    parts.push(`, $${key}: ${graphQLTypeFor(mutationName, key)}`);
+  }
+  return parts.join("");
+}
+function fieldArgsCallSite(_mutationName, vars) {
+  const parts = [];
+  for (const key of Object.keys(vars)) {
+    if (vars[key] === void 0) continue;
+    parts.push(`, ${key}: $${key}`);
+  }
+  return parts.join("");
+}
+function graphQLTypeFor(mutationName, key) {
+  if (key === "code" || key === "message") return "String!";
+  if (key === "pct") return "Int";
+  if (key === "retryable") return "Boolean";
+  if (key === "details" || key === "metadata") return "JSON";
+  if (key === "result") {
+    const base = mutationName.replace(/^complete/, "").replace(/Execution$/, "");
+    return `${base}ExecutionResultInput!`;
+  }
+  if (key === "message") return "String";
+  return "String";
+}
+async function hmacSha256Hex(secret, body) {
+  const enc = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    enc.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const sig = await crypto.subtle.sign("HMAC", key, enc.encode(body));
+  return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+export {
+  ServerClientError,
+  createCallbackClient,
+  createServerClient,
+  parseContextHeader,
+  parseSubject,
+  recordsReadModels,
+  recordsWriteModels,
+  verifyScopedToken,
+  verifyWebhookSignature
+};

package/dist/shared-DkWlEd2Z.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Shared introspection helpers for the Foir codegen plugins.
+ */
+
+interface BlockPluginConfig {
+    /**
+     * Union type name(s) to collect block members from. Defaults to `['Block']`
+     * (the canonical Foir block union). A project with a distinct content-field
+     * segment union lists it here too.
+     */
+    unions?: string[];
+    /** Import path for the codegen-generated types. Default `./graphql`. */
+    graphqlImport?: string;
+    /** Import path for the SDK content primitives. Default `@foir/sdk/content`. */
+    sdkImport?: string;
+}
+
+export type { BlockPluginConfig as B };

package/package.json

@@ -0,0 +1,136 @@
+{
+  "name": "@foir/sdk",
+  "version": "0.1.0",
+  "description": "Official Foir SDK — editor iframe client + server-side platform helpers",
+  "type": "module",
+  "publishConfig": {
+    "access": "public"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "import": "./dist/client.js"
+    },
+    "./media": {
+      "types": "./dist/media.d.ts",
+      "import": "./dist/media.js"
+    },
+    "./content": {
+      "types": "./dist/content.d.ts",
+      "import": "./dist/content.js"
+    },
+    "./auth": {
+      "types": "./dist/auth.d.ts",
+      "import": "./dist/auth.js"
+    },
+    "./realtime": {
+      "types": "./dist/realtime.d.ts",
+      "import": "./dist/realtime.js"
+    },
+    "./codegen": {
+      "types": "./dist/codegen/index.d.ts",
+      "import": "./dist/codegen/index.js"
+    },
+    "./codegen/block-registry": {
+      "types": "./dist/codegen/block-registry.d.ts",
+      "import": "./dist/codegen/block-registry.js"
+    },
+    "./codegen/block-scaffold": {
+      "types": "./dist/codegen/block-scaffold.d.ts",
+      "import": "./dist/codegen/block-scaffold.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "keywords": [
+    "foir",
+    "sdk",
+    "cms",
+    "editor",
+    "platform"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/eidestudio/foir-clients.git",
+    "directory": "packages/sdk"
+  },
+  "license": "MIT",
+  "dependencies": {
+    "@graphql-typed-document-node/core": "3.2.0"
+  },
+  "peerDependencies": {
+    "@graphql-codegen/cli": "^5.0.0",
+    "@graphql-codegen/client-preset": "^4.0.0",
+    "blurhash": "^2.0.0",
+    "graphql": "^16.0.0",
+    "hls.js": "^1.5.0",
+    "react": "^18.0.0 || ^19.0.0",
+    "y-websocket": "^3.0.0",
+    "yjs": "^13.6.0"
+  },
+  "peerDependenciesMeta": {
+    "@graphql-codegen/cli": {
+      "optional": true
+    },
+    "@graphql-codegen/client-preset": {
+      "optional": true
+    },
+    "blurhash": {
+      "optional": true
+    },
+    "graphql": {
+      "optional": true
+    },
+    "hls.js": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    },
+    "y-websocket": {
+      "optional": true
+    },
+    "yjs": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@graphql-codegen/cli": "^5.0.7",
+    "@types/react": "^19.2.0",
+    "@types/react-dom": "^19.2.0",
+    "blurhash": "^2.0.5",
+    "graphql": "^16.10.0",
+    "hls.js": "^1.6.16",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
+    "tsup": "^8.5.1",
+    "typescript": "5.9.2",
+    "vitest": "^3.2.4",
+    "y-websocket": "^3.0.0",
+    "yjs": "^13.6.30"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "check-types": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest watch",
+    "release:patch": "pnpm version patch",
+    "release:minor": "pnpm version minor",
+    "release:major": "pnpm version major"
+  }
+}