@foir/sdk 0.2.0 → 0.4.0

package/README.md

@@ -24,7 +24,9 @@ pnpm add yjs y-websocket    # for @foir/sdk/realtime
 | --- | --- | --- |
 | `@foir/sdk` | Editor iframe client — `EditorProvider`, `useEditor`, `useAutoResize`, `createPlatformClient`, host↔editor message protocol | `react` |
 | `@foir/sdk/client` | Client-agnostic GraphQL transport for SSR/edge loaders — `foirRequest`, `isFoirPreview`, `absolutiseFoirMediaUrl` | `graphql` |
-| `@foir/sdk/auth` | Framework-agnostic customer auth — login/register/OTP/provider flows, token lifecycle (`SessionAdapter`), `authedRequest`, guards | `graphql` |
+| `@foir/sdk/auth` | Framework-agnostic customer auth — login/register/OTP/provider flows, token lifecycle (`SessionAdapter`), `createFoirSessionClient` (Foir-hosted cookie sessions), `authedRequest`, guards | `graphql` |
+| `@foir/sdk/react` | Drop-in React auth — `<FoirProvider>` (token or `hostedSession` mode), `useFoirSession`/`useFoirUser`/`useFoirAuth`, `<SignIn>`, `<OAuthButtons>`, `<UserButton>` | `react`, `graphql` |
+| `@foir/sdk/next` | Next.js App Router BFF auth — `createFoirCookieAdapter`, `getFoirSession`, `foirSignIn*`, `completeFoirProviderLogin`, `createFoirMiddleware` | `graphql` |
 | `@foir/sdk/server` | Server-side helpers for extension/config API backends — `createServerClient`, `verifyWebhookSignature`, `verifyScopedToken`, callback client | — |
 | `@foir/sdk/media` | Progressive media — `ProgressiveMedia`, `BlurhashCanvas`, `useProgressiveLoad`, variant-tier adapters | `react` (`hls.js`, `blurhash` optional) |
 | `@foir/sdk/content` | Content-rendering primitives — `createContentRenderer` block dispatch + Lexical `RichTextRenderer` | `react` |
@@ -72,6 +74,110 @@ const customer = await loginWithPassword(adapter, env, { email, password });
 const { myProfile } = await authedRequest(adapter, env, MyProfileDocument);
 ```
 
+### React
+
+`@foir/sdk/react` builds the reactive layer on top of `@foir/sdk/auth`. Wrap
+your app once, then read the session with hooks or drop in the components. The
+default session store is `localStorage`; pass your own `adapter` for cookies.
+
+```tsx
+'use client';
+import { FoirProvider, SignIn, UserButton, useFoirSession } from '@foir/sdk/react';
+
+const env = {
+  PLATFORM_API_URL: process.env.NEXT_PUBLIC_PLATFORM_API_URL,
+  PLATFORM_API_KEY: process.env.NEXT_PUBLIC_PLATFORM_API_KEY, // a publishable pk_ key
+};
+
+export function App() {
+  return (
+    <FoirProvider env={env}>
+      <Header />
+      <SignIn afterSignInUrl="/dashboard" />
+    </FoirProvider>
+  );
+}
+
+function Header() {
+  const { isAuthenticated, isLoading } = useFoirSession();
+  if (isLoading) return null;
+  return isAuthenticated ? <UserButton afterSignOutUrl="/" /> : null;
+}
+```
+
+For a custom form, use `useFoirAuth()` (`signIn`, `register`, `signInWithOtp`,
+`requestOtp`, `signInWithProvider`, `signOut`, `getToken`) and `useFoirUser()`.
+
+### Backend-less SPA (Foir-hosted sessions)
+
+By default `<FoirProvider>` stores tokens in `localStorage`. If your SPA has no
+backend but you have a **verified custom login domain** on the same registrable
+domain (`app.acme.com` + `login.acme.com`), prefer `hostedSession`: the durable
+credential becomes an HttpOnly cookie Foir sets on your domain, and the 15-minute
+access token lives only in memory. Nothing authentication-related is reachable
+from JS, so XSS has nothing to exfiltrate — the BFF security posture without a
+backend.
+
+```tsx
+<FoirProvider
+  env={{ PLATFORM_API_URL: 'https://api.foir.dev/graphql', PLATFORM_API_KEY: 'pk_…' }}
+  hostedSession={{ loginOrigin: 'https://login.acme.com' }}
+>
+  <App />
+</FoirProvider>
+```
+
+Sign-in is a redirect, not a form — `useFoirAuth().hostedSignInUrl()` gives you
+the URL (the password/OTP actions throw in this mode). `getToken()` exchanges the
+cookie and re-exchanges it silently before expiry; `signOut()` revokes the session
+server-side. Everything else — `useFoirSession`, `useFoirUser`, `<UserButton>` —
+behaves the same.
+
+Framework-agnostic equivalent:
+
+```ts
+import { createFoirSessionClient } from '@foir/sdk/auth';
+
+const session = createFoirSessionClient({ loginOrigin: 'https://login.acme.com' });
+const token = await session.getToken(); // null when signed out
+```
+
+### Next.js (App Router, BFF)
+
+`@foir/sdk/next` keeps the tokens in HttpOnly cookies server-side. Protect
+routes with the middleware, read the session in a server component, and sign in
+from a route handler.
+
+```ts
+// middleware.ts
+import { createFoirMiddleware } from '@foir/sdk/next';
+export const middleware = createFoirMiddleware({ signInUrl: '/sign-in' });
+export const config = { matcher: ['/dashboard/:path*'] };
+```
+
+```ts
+// app/dashboard/page.tsx (Server Component)
+import { cookies } from 'next/headers';
+import { getFoirSession } from '@foir/sdk/next';
+
+export default async function Dashboard() {
+  const customer = await getFoirSession(await cookies());
+  return <p>Signed in as {customer?.email}</p>;
+}
+```
+
+```ts
+// app/sign-in/route.ts (Route Handler)
+import { cookies } from 'next/headers';
+import { foirSignInWithPassword } from '@foir/sdk/next';
+
+export async function POST(req: Request) {
+  const { email, password } = await req.json();
+  await foirSignInWithPassword({ env, store: await cookies(), email, password });
+  return Response.json({ ok: true });
+}
+```
+
 ### Codegen
 
 ```ts

package/dist/auth.d.ts

@@ -302,4 +302,81 @@ interface HostedSession {
  */
 declare function fetchHostedSession(request: Request, config: HostedLoginConfig): Promise<HostedSession | null>;
 
-export { type AuthProviderPublic, AuthProvidersDocument, type CustomerAuthResult, CustomerLoginDocument, CustomerLoginOTPDocument, CustomerLoginWithProviderDocument, CustomerProviderCallbackDocument, CustomerProviderVerifyOTPDocument, CustomerRefreshTokenDocument, CustomerRegisterDocument, CustomerRequestOTPDocument, type FoirAuthTokens, type FoirCustomer, type FoirUser, type HostedLoginConfig, type HostedSession, type ProviderCallbackInput, type ProviderLoginInput, type ProviderLoginResult, type ProviderOTPVerifyInput, type RequireAdminOptions, type RequireAuthOptions, type SessionAdapter, authedRequest, clearSession, customerLogin, customerLoginOTP, customerLoginWithProvider, customerProviderCallback, customerProviderVerifyOTP, customerRefreshToken, customerRegister, customerRequestOTP, fetchHostedSession, getAuthProviders, getSessionCustomer, getSessionToken, hostedLoginUrl, loginWithOTP, loginWithPassword, refreshSession, registerWithPassword, requireAdmin, requireAuth, saveSession };
+/**
+ * Foir-hosted first-party sessions, from the browser — the model for a
+ * backend-less SPA (Vite, CRA, a static site) that wants no tokens in JS.
+ *
+ * The sibling `fetchHostedSession` in ./hosted does the same exchange from a
+ * SERVER: it reads the cookie off an incoming request and forwards it by hand.
+ * A browser cannot set a `Cookie` header, so that function is unusable from an
+ * SPA by construction. This one lets the browser send the cookie the only way it
+ * can — `credentials: 'include'` — and keeps the resulting bearer in memory.
+ *
+ * How the pieces divide:
+ *
+ *   cookie  — long-lived (30d), HttpOnly, first-party on your registrable
+ *             domain, set by Foir when hosted login finalizes. JS cannot read
+ *             it, so XSS cannot exfiltrate it.
+ *   bearer  — 15 minutes, held in a closure here. Never written to
+ *             localStorage/sessionStorage/IndexedDB, never in a cookie of ours.
+ *
+ * There is no refresh token in this flow. Re-exchanging the cookie IS the
+ * refresh, which is why nothing here needs rotation or reuse-detection: the
+ * durable credential is an opaque server-side session handle, revocable at any
+ * time from the admin panel or `signOut()`.
+ *
+ * REQUIRES a verified custom login domain that shares a registrable domain with
+ * your app (app.acme.com + login.acme.com). That is what makes the cookie
+ * first-party and lets `SameSite=Lax` send it. The same endpoints exist on
+ * api.foir.dev but a browser cannot reach them there — the cookie would be
+ * cross-site, and that CORS surface deliberately refuses credentials.
+ */
+interface FoirSessionConfig {
+    /**
+     * Your verified custom login domain, e.g. `https://login.acme.com`. Must share
+     * a registrable domain with the app calling it.
+     */
+    loginOrigin: string;
+    /** Session-exchange path. Default `/session/token`. */
+    sessionPath?: string;
+    /** Logout path. Default `/session/logout`. */
+    logoutPath?: string;
+    /** Seconds before expiry to re-exchange. Default 60. */
+    refreshSkewSeconds?: number;
+    /**
+     * Called when the session goes away — the cookie expired, was revoked, or
+     * `signOut()` ran. Use it to redirect to `signInUrl()`.
+     */
+    onSignOut?: () => void;
+}
+/** The identity behind the current session. */
+interface FoirSessionUser {
+    customerId: string;
+    email: string;
+}
+interface FoirSessionClient {
+    /**
+     * The current access token, exchanging or re-exchanging the cookie as needed.
+     * Null when there is no session. Concurrent callers share one in-flight
+     * exchange. Call this before each API request — do not cache the result.
+     */
+    getToken(): Promise<string | null>;
+    /** The signed-in customer, or null. Exchanges if the session isn't loaded yet. */
+    getUser(): Promise<FoirSessionUser | null>;
+    /** Revoke the session server-side and clear the cookie. Idempotent. */
+    signOut(): Promise<void>;
+    /** Where to send the browser to sign in. */
+    signInUrl(returnTo?: string): string;
+    /** Observe session changes. Returns an unsubscribe function. */
+    subscribe(listener: (user: FoirSessionUser | null) => void): () => void;
+    /** Cancel the refresh timer. Call on unmount. */
+    destroy(): void;
+}
+/**
+ * Create a session client. Safe to call during SSR — it does nothing until a
+ * method is invoked, and `getToken()` on the server returns null rather than
+ * throwing (there is no cookie jar to draw on).
+ */
+declare function createFoirSessionClient(config: FoirSessionConfig): FoirSessionClient;
+
+export { type AuthProviderPublic, AuthProvidersDocument, type CustomerAuthResult, CustomerLoginDocument, CustomerLoginOTPDocument, CustomerLoginWithProviderDocument, CustomerProviderCallbackDocument, CustomerProviderVerifyOTPDocument, CustomerRefreshTokenDocument, CustomerRegisterDocument, CustomerRequestOTPDocument, type FoirAuthTokens, type FoirCustomer, type FoirSessionClient, type FoirSessionConfig, type FoirSessionUser, type FoirUser, type HostedLoginConfig, type HostedSession, type ProviderCallbackInput, type ProviderLoginInput, type ProviderLoginResult, type ProviderOTPVerifyInput, type RequireAdminOptions, type RequireAuthOptions, type SessionAdapter, authedRequest, clearSession, createFoirSessionClient, customerLogin, customerLoginOTP, customerLoginWithProvider, customerProviderCallback, customerProviderVerifyOTP, customerRefreshToken, customerRegister, customerRequestOTP, fetchHostedSession, getAuthProviders, getSessionCustomer, getSessionToken, hostedLoginUrl, loginWithOTP, loginWithPassword, refreshSession, registerWithPassword, requireAdmin, requireAuth, saveSession };

package/dist/auth.js

@@ -274,6 +274,141 @@ async function fetchHostedSession(request, config) {
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+
+// src/auth/session-client.ts
+var DEFAULT_SESSION_PATH2 = "/session/token";
+var DEFAULT_LOGOUT_PATH = "/session/logout";
+var DEFAULT_REFRESH_SKEW_SECONDS = 60;
+var MIN_REFRESH_DELAY_MS = 5e3;
+var CSRF_HEADER = { "X-Foir-Session": "1" };
+function createFoirSessionClient(config) {
+  const sessionUrl = `${trimSlash(config.loginOrigin)}${config.sessionPath ?? DEFAULT_SESSION_PATH2}`;
+  const logoutUrl = `${trimSlash(config.loginOrigin)}${config.logoutPath ?? DEFAULT_LOGOUT_PATH}`;
+  const skewMs = (config.refreshSkewSeconds ?? DEFAULT_REFRESH_SKEW_SECONDS) * 1e3;
+  let cached = null;
+  let inflight = null;
+  let timer = null;
+  let destroyed = false;
+  const listeners = /* @__PURE__ */ new Set();
+  function emit(user) {
+    for (const l of listeners) l(user);
+  }
+  function clearTimer() {
+    if (timer !== null) {
+      clearTimeout(timer);
+      timer = null;
+    }
+  }
+  function scheduleRefresh(expiresAt) {
+    clearTimer();
+    if (destroyed || typeof setTimeout === "undefined") return;
+    const delay = Math.max(expiresAt - Date.now() - skewMs, MIN_REFRESH_DELAY_MS);
+    timer = setTimeout(() => {
+      void exchange();
+    }, delay);
+    timer.unref?.();
+  }
+  function forget() {
+    const had = cached !== null;
+    cached = null;
+    clearTimer();
+    if (had) emit(null);
+  }
+  function exchange() {
+    if (inflight) return inflight;
+    const pending = (async () => {
+      let res;
+      try {
+        res = await fetch(sessionUrl, {
+          method: "GET",
+          // The whole point: send the first-party cookie cross-origin (but
+          // same-site) to the login domain. Without this the cookie is not sent.
+          credentials: "include",
+          headers: { ...CSRF_HEADER }
+        });
+      } catch {
+        return cached;
+      }
+      if (res.status === 401) {
+        forget();
+        config.onSignOut?.();
+        return null;
+      }
+      if (!res.ok) return cached;
+      let json;
+      try {
+        json = await res.json();
+      } catch {
+        return cached;
+      }
+      if (!json.access_token || !json.customer_id) return cached;
+      const expiresIn = typeof json.expires_in === "number" ? json.expires_in : 0;
+      const next = {
+        token: json.access_token,
+        expiresAt: Date.now() + expiresIn * 1e3,
+        user: { customerId: json.customer_id, email: json.email ?? "" }
+      };
+      const changed = cached?.user.customerId !== next.user.customerId;
+      cached = next;
+      scheduleRefresh(next.expiresAt);
+      if (changed) emit(next.user);
+      return next;
+    })();
+    inflight = pending;
+    void pending.finally(() => {
+      if (inflight === pending) inflight = null;
+    });
+    return pending;
+  }
+  function fresh() {
+    if (!cached) return null;
+    return Date.now() < cached.expiresAt - skewMs ? cached : null;
+  }
+  return {
+    async getToken() {
+      const hit = fresh();
+      if (hit) return hit.token;
+      const got = await exchange();
+      return got?.token ?? null;
+    },
+    async getUser() {
+      const hit = fresh();
+      if (hit) return hit.user;
+      const got = await exchange();
+      return got?.user ?? null;
+    },
+    async signOut() {
+      try {
+        await fetch(logoutUrl, {
+          method: "POST",
+          credentials: "include",
+          headers: { ...CSRF_HEADER }
+        });
+      } catch {
+      }
+      forget();
+      config.onSignOut?.();
+    },
+    signInUrl(returnTo) {
+      const dest = new URL(trimSlash(config.loginOrigin));
+      const target = returnTo ?? (typeof window !== "undefined" ? window.location.href : void 0);
+      if (target && target !== "/") dest.searchParams.set("returnTo", target);
+      return dest.toString();
+    },
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+    destroy() {
+      destroyed = true;
+      clearTimer();
+      listeners.clear();
+    }
+  };
+}
+function trimSlash(s) {
+  return s.replace(/\/+$/, "");
+}
 export {
   AuthProvidersDocument,
   CustomerLoginDocument,
@@ -286,6 +421,7 @@ export {
   CustomerRequestOTPDocument,
   authedRequest,
   clearSession,
+  createFoirSessionClient,
   customerLogin,
   customerLoginOTP,
   customerLoginWithProvider,

package/dist/next.d.ts

@@ -0,0 +1,178 @@
+/**
+ * Foir GraphQL client — a single typed fetch wrapper for SSR/edge loaders.
+ *
+ * No GraphQL client (Apollo/urql) required: the Foir public API is a plain
+ * `POST` with an `x-api-key` header, and the dominant consumers (Hydrogen on
+ * Oxygen, React Router loaders, TanStack Start on CF Workers) fetch in
+ * server-only loaders and render — so Apollo's `InMemoryCache`/`useQuery`
+ * reactivity is dead weight, and a shared cache on a stateless multi-tenant
+ * edge worker is a cross-tenant hazard. This helper carries only the
+ * Foir-specific transport concerns (auth header, preview schema channel,
+ * error shape). Consumers on a GraphQL client (Apollo / urql / react-query /
+ * graphql-request) use the generated `TypedDocumentNode`s directly with their
+ * own client and replicate the two Foir-specific headers below — the
+ * `x-api-key` and, in preview, `X-Foir-Schema-Channel: draft`.
+ *
+ * Deduplicates the hand-copied `lib/foir/client.ts` that shipped identically
+ * across the Foir storefronts.
+ */
+
+interface FoirEnv {
+    PLATFORM_API_URL?: string;
+    PLATFORM_API_KEY?: string;
+    PLATFORM_PREVIEW_API_KEY?: string;
+    FOIR_PREVIEW?: string;
+}
+
+/**
+ * Foir customer auth — framework-agnostic flows, token lifecycle, and guards.
+ *
+ * Session I/O is injected via {@link SessionAdapter} (no Hydrogen/React-Router
+ * coupling). Pre-login flows authenticate with the project `x-api-key`;
+ * post-login reads add the customer bearer. The project-specific profile (e.g.
+ * `isAdmin`) is resolved by a consumer-supplied `resolveUser` — the SDK never
+ * hardcodes the per-project customer profile shape.
+ */
+
+/** The customer identity carried by an auth result. */
+interface FoirCustomer {
+    id: string;
+    email: string;
+}
+/**
+ * Injected session store. Methods may be sync or async so consumers can plug
+ * in a cookie session (Hydrogen/Remix), a KV store, etc.
+ */
+interface SessionAdapter {
+    get(key: string): string | null | undefined | Promise<string | null | undefined>;
+    set(key: string, value: string): void | Promise<void>;
+    unset(key: string): void | Promise<void>;
+}
+
+/**
+ * The minimal cookie-store shape this adapter needs. It's satisfied by Next's
+ * `cookies()` (route handlers / server actions — `await cookies()` on Next 15),
+ * and by `NextResponse.cookies` in middleware. Kept structural on purpose so the
+ * SDK doesn't import (or pin a version of) `next/headers`.
+ */
+interface FoirCookieStore {
+    get(name: string): {
+        value: string;
+    } | undefined;
+    set(name: string, value: string, options?: Record<string, unknown>): void;
+    delete(name: string): void;
+}
+interface CookieAdapterOptions {
+    /** Cookie attributes for writes, merged over the secure defaults. */
+    cookieOptions?: Record<string, unknown>;
+}
+declare function foirCookieName(key: string): string;
+/**
+ * A {@link SessionAdapter} backed by an HttpOnly cookie store — the seam for
+ * server-side (BFF) Foir sessions in Next.js. Pass the cookie store from a route
+ * handler / server action (`await cookies()`) for reads and writes; a Server
+ * Component's `cookies()` is read-only, so use it only for reads there.
+ */
+declare function createFoirCookieAdapter(store: FoirCookieStore, opts?: CookieAdapterOptions): SessionAdapter;
+
+/**
+ * Server-side session helpers for the Next.js BFF pattern. Each takes the Next
+ * cookie store (`await cookies()` in a route handler / server action, or the
+ * read-only `cookies()` in a Server Component for reads).
+ *
+ * Note on "verification": the customer access token is opaque to your app and
+ * validated by the Foir API on use, so `getFoirSession` returns the identity
+ * stored in the cookies rather than locally verifying a JWT. A rejected/expired
+ * bearer surfaces when you call the API (and `@foir/sdk/auth`'s `authedRequest`
+ * transparently refreshes it).
+ */
+/** The signed-in customer from the session cookies, or null. */
+declare function getFoirSession(store: FoirCookieStore): Promise<FoirCustomer | null>;
+/** The current access token from the session cookies, or null. */
+declare function getFoirToken(store: FoirCookieStore): Promise<string | null>;
+/** Clear the session cookies (sign out). */
+declare function foirSignOut(store: FoirCookieStore, opts?: CookieAdapterOptions): Promise<void>;
+interface PasswordArgs {
+    env: FoirEnv;
+    store: FoirCookieStore;
+    email: string;
+    password: string;
+    cookieOptions?: CookieAdapterOptions['cookieOptions'];
+}
+/** Password sign-in in a route handler; persists the session to cookies. */
+declare function foirSignInWithPassword({ env, store, email, password, cookieOptions, }: PasswordArgs): Promise<FoirCustomer>;
+/** Register a customer in a route handler; persists the session to cookies. */
+declare function foirRegisterWithPassword({ env, store, email, password, cookieOptions, }: PasswordArgs): Promise<FoirCustomer>;
+/** Complete an OTP sign-in in a route handler; persists the session to cookies. */
+declare function foirSignInWithOtp({ env, store, email, otp, cookieOptions, }: {
+    env: FoirEnv;
+    store: FoirCookieStore;
+    email: string;
+    otp: string;
+    cookieOptions?: CookieAdapterOptions['cookieOptions'];
+}): Promise<FoirCustomer>;
+/**
+ * Complete a provider (OAuth/OIDC) login in your callback route handler:
+ * exchange the `code` + `state` for tokens and persist them to the session
+ * cookies. Returns the customer.
+ */
+declare function completeFoirProviderLogin(opts: {
+    env: FoirEnv;
+    store: FoirCookieStore;
+    providerKey: string;
+    code?: string;
+    state?: string;
+    cookieOptions?: CookieAdapterOptions['cookieOptions'];
+}): Promise<FoirCustomer>;
+
+/**
+ * The slice of `NextRequest` the middleware reads. Typed structurally so the SDK
+ * doesn't need `next` installed to build — a real `NextRequest` satisfies it, so
+ * the returned function drops straight into `export const middleware`.
+ */
+interface FoirMiddlewareRequest {
+    cookies: {
+        get(name: string): {
+            value: string;
+        } | undefined;
+    };
+    nextUrl: {
+        pathname: string;
+        search: string;
+    };
+    url: string;
+}
+interface FoirMiddlewareConfig {
+    /** Where to send unauthenticated requests (path or absolute URL). */
+    signInUrl: string;
+    /**
+     * The session cookie whose presence means "signed in". Defaults to the
+     * access-token cookie the cookie adapter writes (`foir_token`).
+     */
+    cookieName?: string;
+    /**
+     * Return true for requests that require auth. Omit to protect every request
+     * the middleware `matcher` passes through.
+     */
+    isProtected?(request: FoirMiddlewareRequest): boolean;
+    /** Query param carrying the original path on the sign-in URL. Default `returnTo`. */
+    returnParam?: string;
+}
+/**
+ * Build a Next.js middleware that redirects unauthenticated requests to your
+ * sign-in URL. Edge-safe: it checks for the presence of the session cookie only
+ * — the bearer itself is validated server-side when you call the Foir API — so
+ * pair it with a real `getFoirSession` check in protected route handlers /
+ * server components. Returns a standard `Response` (redirect) or `undefined`
+ * (continue), both of which Next.js middleware accepts.
+ *
+ * ```ts
+ * // middleware.ts
+ * import { createFoirMiddleware } from '@foir/sdk/next';
+ * export const middleware = createFoirMiddleware({ signInUrl: '/sign-in' });
+ * export const config = { matcher: ['/dashboard/:path*'] };
+ * ```
+ */
+declare function createFoirMiddleware(config: FoirMiddlewareConfig): (request: FoirMiddlewareRequest) => Response | undefined;
+
+export { type CookieAdapterOptions, type FoirCookieStore, type FoirCustomer, type FoirEnv, type FoirMiddlewareConfig, type FoirMiddlewareRequest, type SessionAdapter, completeFoirProviderLogin, createFoirCookieAdapter, createFoirMiddleware, foirCookieName, foirRegisterWithPassword, foirSignInWithOtp, foirSignInWithPassword, foirSignOut, getFoirSession, getFoirToken };