@foir/sdk 0.11.0 → 0.12.0

package/dist/transport/foir-http.d.ts

@@ -211,6 +211,12 @@ export interface FoirRequestOptions {
      * (e.g. `myProfile`). Used by `@foir/sdk/auth`'s post-login profile fetch.
      */
     bearerToken?: string;
+    /**
+     * Refuse an answer served without the bearer this request sent: throw
+     * {@link FoirAuthDowngradedError} instead of returning the anonymous data.
+     * `authedRequest` sets it, so it can refresh and ask again.
+     */
+    rejectDowngrade?: boolean;
     /**
      * The organization this request acts in, sent as `X-Org-Id`. For a
      * project-scoped key: the server resolves it to an active organization of
@@ -283,6 +289,11 @@ export interface FoirKeyHeaderInput {
      * Set from `FoirClientConfig.orgUrl` / `FoirRequestOptions.orgUrl`.
      */
     orgUrl?: string;
+    /**
+     * The address of the visitor a server rendering pages is calling for
+     * (`X-Foir-Visitor-IP`). Set from `FoirClientConfig.visitor`.
+     */
+    visitorAddress?: string;
     dispatchToken?: never;
     dispatchContext?: never;
     /** Caller-supplied extras, applied last so a caller can override. */
@@ -329,6 +340,19 @@ export declare function refuseCredentialHeaders(extra: Readonly<Record<string, s
  * optional customer bearer, organization and channel), or an operation's
  * dispatch token. A dispatch request never writes `x-api-key`.
  */
+/** The header a server names the visitor it calls for in. */
+export declare const FOIR_VISITOR_IP_HEADER = "X-Foir-Visitor-IP";
+/**
+ * The address of the visitor a server rendering pages is calling for, or a
+ * function that resolves it for each request.
+ *
+ * The SDK does not read it off a request, because which request header holds
+ * the visitor's real address, and whether a visitor can forge it, depends on
+ * what sits in front of your server. Your host says which one its edge sets and
+ * strips; that value, and only that, belongs here. A function that yields
+ * nothing sends nothing, and the API counts the request as your server's own.
+ */
+export type FoirVisitorSource = string | (() => string | null | undefined | Promise<string | null | undefined>);
 export declare function buildFoirHeaders(input: FoirHeaderInput): Record<string, string>;
 /**
  * Build a `/v1/...` URL from whatever the caller put in `apiUrl`.
@@ -371,6 +395,29 @@ export interface FoirAuthDowngrade {
     /** The authority the request actually ran under. */
     servedAs: string;
 }
+/**
+ * A request that sent a customer token was served without it.
+ *
+ * Thrown only to a caller that asked (`rejectDowngrade`): one that sent the
+ * token because it wants the signed-in answer, and would otherwise be handed the
+ * anonymous one as though nothing had happened. `downgrade.reason` says whether
+ * refreshing could help: `expired` can be refreshed, `invalid` and
+ * `wrong_project` cannot.
+ */
+export declare class FoirAuthDowngradedError extends FoirRequestError {
+    readonly downgrade: FoirAuthDowngrade;
+    constructor(downgrade: FoirAuthDowngrade);
+}
+/**
+ * The customer's session is over: its token was rejected and could not be
+ * refreshed. It is what a signed-in request gets in place of the anonymous
+ * answer. Send the customer to sign in again.
+ */
+export declare class FoirSessionExpiredError extends FoirRequestError {
+    constructor(options?: {
+        cause?: unknown;
+    });
+}
 export interface FoirResponseEnvelope<T> {
     data?: T;
     errors?: Array<FoirGraphQLErrorItem>;
@@ -384,4 +431,5 @@ export interface FoirResponseEnvelope<T> {
 }
 export declare function readFoirEnvelope<T>(json: FoirResponseEnvelope<T>, options?: {
     strict?: boolean;
+    rejectDowngrade?: boolean;
 }): T;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foir/sdk",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Official Foir SDK — editor iframe client + server-side platform helpers",
   "type": "module",
   "publishConfig": {
@@ -45,6 +45,18 @@
       "types": "./dist/auth/index.d.ts",
       "import": "./dist/auth.js"
     },
+    "./placement": {
+      "types": "./dist/placement/index.d.ts",
+      "import": "./dist/placement.js"
+    },
+    "./app": {
+      "types": "./dist/app/index.d.ts",
+      "import": "./dist/app.js"
+    },
+    "./app/contract": {
+      "types": "./dist/app/contract/index.d.ts",
+      "import": "./dist/app-contract.js"
+    },
     "./auth/session": {
       "types": "./dist/auth/session-client.d.ts",
       "import": "./dist/auth-session.js"
@@ -107,6 +119,7 @@
     "@graphql-typed-document-node/core": "3.2.0"
   },
   "peerDependencies": {
+    "@bufbuild/protobuf": "^2.12.0",
     "@graphql-codegen/cli": "^5.0.0",
     "@graphql-codegen/client-preset": "^4.0.0",
     "blurhash": "^2.0.0",
@@ -117,6 +130,9 @@
     "yjs": "^13.6.0"
   },
   "peerDependenciesMeta": {
+    "@bufbuild/protobuf": {
+      "optional": true
+    },
     "@graphql-codegen/cli": {
       "optional": true
     },
@@ -143,6 +159,7 @@
     }
   },
   "devDependencies": {
+    "@bufbuild/protobuf": "^2.0.0",
     "@graphql-codegen/cli": "^5.0.7",
     "@testing-library/react": "^16.2.0",
     "@types/react": "^19.2.0",
@@ -159,18 +176,19 @@
     "vitest": "^3.2.4",
     "ws": "^8.18.0",
     "y-websocket": "^3.0.0",
-    "yjs": "^13.6.30"
+    "yjs": "^13.6.30",
+    "@foir/proto-ts": "0.109.0"
   },
   "engines": {
     "node": ">=18.0.0"
   },
   "scripts": {
-    "build": "node scripts/clean-dist.mjs && tsup && tsc -p tsconfig.build.json && node scripts/assert-export-types.mjs && node scripts/assert-public-exports.mjs",
+    "build": "node scripts/generate-app-vocabulary.mjs && node scripts/clean-dist.mjs && tsup && tsc -p tsconfig.build.json && node scripts/bundle-app-contract-types.mjs && node scripts/assert-export-types.mjs && node scripts/assert-public-exports.mjs",
     "snapshot:exports": "node scripts/assert-public-exports.mjs --update",
     "dev": "node scripts/dev-watch.mjs",
-    "check-types": "tsc --noEmit",
-    "test": "vitest run",
-    "test:watch": "vitest watch",
+    "check-types": "node scripts/generate-app-vocabulary.mjs && tsc --noEmit",
+    "test": "node scripts/generate-app-vocabulary.mjs && vitest run",
+    "test:watch": "node scripts/generate-app-vocabulary.mjs && vitest watch",
     "release:patch": "pnpm version patch",
     "release:minor": "pnpm version minor",
     "release:major": "pnpm version major"