@foir/sdk 0.5.0 → 0.8.0

package/dist/server/require-scoped-token.d.ts

@@ -0,0 +1,76 @@
+/**
+ * requireScopedToken — the one-line ingress guard for BFF routes the
+ * platform dispatches operations to (EID-498).
+ *
+ * Operation endpoints must be publicly reachable (the platform's dispatcher
+ * refuses private networks), so "the BFF is never public-facing" is achieved
+ * by AUTHENTICATED ingress, not network privacy: every route the platform
+ * calls verifies the platform-minted `X-Foir-Token` before doing anything. A
+ * route that skips verification is an open endpoint anyone can call
+ * directly, bypassing the operation's scopes, quotas, and preconditions.
+ *
+ * ```ts
+ * // Hono / Workers / Hydrogen — any fetch-API request:
+ * const { claims, subject, context } = await requireScopedToken(request, {
+ *   expectedProjectId: env.FOIR_PROJECT_ID,
+ * });
+ * ```
+ *
+ * Throws {@link ScopedTokenError} with `status` 401 (missing/invalid token)
+ * or 403 (valid token for the wrong tenant/project) — map it to a response
+ * in one place:
+ *
+ * ```ts
+ * catch (err) {
+ *   if (err instanceof ScopedTokenError) {
+ *     return new Response(err.message, { status: err.status });
+ *   }
+ *   throw err;
+ * }
+ * ```
+ */
+import type { ScopedTokenClaims, ScopedTokenSubject, VerifyScopedTokenOptions } from './verify-scoped-token';
+/**
+ * Verification failure with the HTTP status the route should answer with:
+ * 401 for a missing or invalid token, 403 for a valid token bound to the
+ * wrong tenant or project.
+ */
+export declare class ScopedTokenError extends Error {
+    readonly status: 401 | 403;
+    constructor(message: string, status: 401 | 403);
+}
+/** The minimal request shape needed — satisfied by any fetch-API Request. */
+export interface HeaderCarrier {
+    headers: {
+        get(name: string): string | null;
+    };
+}
+export interface RequireScopedTokenOptions extends VerifyScopedTokenOptions {
+    /**
+     * JWKS endpoint to verify against. Defaults to the production platform
+     * (`https://api.foir.dev/.well-known/jwks.json`); point it at your dev
+     * host's `/.well-known/jwks.json` for non-production deployments.
+     */
+    jwksUrl?: string;
+    /**
+     * When set, a verified token whose subject names a different project is
+     * rejected with 403. Set this from your deploy's own config — it pins the
+     * route to its project even if a token minted for another project leaks.
+     */
+    expectedProjectId?: string;
+    /** Tenant analogue of {@link expectedProjectId}. */
+    expectedTenantId?: string;
+}
+export interface ScopedTokenIngress {
+    claims: ScopedTokenClaims;
+    subject: ScopedTokenSubject;
+    /** Parsed `X-Foir-Context` correlation metadata (empty when absent). */
+    context: Record<string, string>;
+}
+/**
+ * Verify the platform-minted scoped token on an inbound dispatch request.
+ * Returns the decoded claims, parsed subject, and dispatch context; throws
+ * {@link ScopedTokenError} otherwise. See the module doc for the catch
+ * pattern.
+ */
+export declare function requireScopedToken(request: HeaderCarrier, options?: RequireScopedTokenOptions): Promise<ScopedTokenIngress>;

package/dist/server/server-client.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Server-side client for runtime communication with the Foir platform.
+ *
+ * Used by config API backends (e.g., Hono servers) to query the platform
+ * GraphQL API at runtime. Provisioning (models, operations, schedules) is
+ * handled by `foir push`. Record writes from upstream sources go through
+ * the scoped-token `upsertRecord` GraphQL mutation served by the
+ * integrations gateway, not through this client.
+ *
+ * Auth: All requests use an API key (x-api-key header).
+ */
+import type { ServerClient, ServerClientOptions } from './types';
+/** Error thrown when a platform API request fails. */
+export declare class ServerClientError extends Error {
+    status?: number | undefined;
+    response?: unknown | undefined;
+    constructor(message: string, status?: number | undefined, response?: unknown | undefined);
+}
+/**
+ * Create a ServerClient for runtime platform communication.
+ *
+ * @example
+ * ```ts
+ * import { createServerClient } from '@foir/sdk/server';
+ *
+ * const client = createServerClient({
+ *   baseUrl: 'https://api.example.com',
+ *   apiKey: 'sk_project_xxx',
+ * });
+ *
+ * const { data } = await client.query('query { models { items { key } } }');
+ * ```
+ */
+export declare function createServerClient(options: ServerClientOptions): ServerClient;

package/dist/server/types.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Server-side types for Foir Editor SDK.
+ *
+ * Used by Hono API backends that communicate with the platform.
+ */
+/** Options for creating a ServerClient. */
+export interface ServerClientOptions {
+    /** Base URL for the platform API (e.g., 'https://api.example.com'). */
+    baseUrl: string;
+    /** Project-scoped API key (sk_* format). */
+    apiKey: string;
+    /**
+     * Optional config key. Retained for backwards compatibility with older
+     * extension scaffolds that pass it; the current client does not use it.
+     */
+    configKey?: string;
+}
+/**
+ * Where an editor iframe should appear in the admin record editor.
+ */
+export interface EditorPlacement {
+    /** 'main-editor' replaces / augments the content tab; 'sidebar' renders in the sidebar. */
+    type: 'main-editor' | 'sidebar';
+    /** Full URL of the editor iframe. */
+    url: string;
+    /** Allowed postMessage origin (defaults to url origin). */
+    allowedOrigin?: string;
+    /** Iframe height: 'auto' (resize via postMessage), 'fill' (100%), or fixed px. */
+    height?: 'auto' | 'fill' | number;
+    /** Tab label for main-editor placements (defaults to config name). */
+    tabName?: string;
+    /** When true, hides the standard Content tab (main-editor only). */
+    hideContentTab?: boolean;
+    /** Which model keys this placement applies to; omit for all models. */
+    modelKeys?: string[];
+}
+/** GraphQL response shape. */
+export interface GraphQLResponse<T = Record<string, unknown>> {
+    data: T | null;
+    errors?: Array<{
+        message: string;
+        locations?: Array<{
+            line: number;
+            column: number;
+        }>;
+        path?: Array<string | number>;
+        extensions?: Record<string, unknown>;
+    }>;
+}
+/** The ServerClient interface — runtime communication with the platform. */
+export interface ServerClient {
+    /** Execute a GraphQL query against the platform public API. */
+    query<T = Record<string, unknown>>(query: string, variables?: Record<string, unknown>): Promise<GraphQLResponse<T>>;
+}

package/dist/server/verify-scoped-token.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Verify a Foir scoped-token JWT (Ed25519, EdDSA) using Web Crypto.
+ *
+ * Operation handlers receive this token in the `X-Foir-Token` header (the
+ * dispatch token authenticating the inbound request) or embedded in the
+ * dispatch envelope's `callback.token` field (the callback token used as
+ * Bearer for mid-execution GraphQL calls back to api-public). Replaces the
+ * legacy HMAC + shared-secret verification for operation dispatches — the
+ * handler no longer needs `FOIR_SIGNING_SECRET` for the inbound path, only
+ * the URL of the platform's JWKS endpoint
+ * (`https://api.foir.dev/.well-known/jwks.json`).
+ *
+ * Lifted verbatim from the inline implementations in
+ * belstaff-translation-portal/src/lib/verify-scoped-token.ts and
+ * hydrogen-storefront/app/lib/foir/verify-scoped-token.ts so consumers can
+ * drop their copies in favor of the shared export. JWKS keys are cached
+ * per-isolate via `globalThis`; TTL matches the endpoint's
+ * Cache-Control max-age (5 minutes).
+ */
+export interface ScopedTokenClaims {
+    iss: string;
+    /**
+     * Pipe-delimited `<tenantId>|<projectId>|<appName>` triple. Use
+     * {@link parseSubject} to split into a typed object.
+     */
+    sub: string;
+    cap: Array<string>;
+    jti: string;
+    exp: number;
+    nbf: number;
+    iat: number;
+    ctx?: Record<string, string>;
+    /**
+     * Records-read model allow-list. Present when the operation declared one
+     * or more `records:read:<model>` capabilities. Pair with the
+     * `records:read` marker in {@link ScopedTokenClaims.cap} to authorize a
+     * record read for a specific model.
+     */
+    rrm?: Array<string>;
+    /**
+     * Records-write model allow-list. Present when the operation declared
+     * one or more `records:write:<model>` capabilities. Pair with the
+     * `records:write` marker in {@link ScopedTokenClaims.cap} to authorize
+     * a record write for a specific model.
+     */
+    rwm?: Array<string>;
+}
+export interface ScopedTokenSubject {
+    tenantId: string;
+    projectId: string;
+    appName: string;
+}
+/**
+ * Parse the pipe-delimited `sub` claim emitted by the platform's
+ * scoped-token minter into its three components. Throws on a missing or
+ * empty segment — the platform never emits a partially-populated subject,
+ * so a malformed sub indicates a forged or corrupt token.
+ *
+ * @example
+ * ```ts
+ * const { tenantId, projectId, appName } = parseSubject(claims.sub);
+ * ```
+ */
+export declare function parseSubject(sub: string): ScopedTokenSubject;
+/**
+ * Extract the `records:read:<model>` allow-list from a verified claim
+ * set. Returns an empty array when the token grants no per-model read
+ * capabilities. Convenience over reading {@link ScopedTokenClaims.rrm}
+ * directly, mirroring the platform's
+ * `scopedtoken.Claims.RecordsReadModels` field.
+ */
+export declare function recordsReadModels(claims: ScopedTokenClaims): Array<string>;
+/**
+ * Extract the `records:write:<model>` allow-list from a verified claim
+ * set. Returns an empty array when the token grants no per-model write
+ * capabilities. Mirror of {@link recordsReadModels} for the write side.
+ */
+export declare function recordsWriteModels(claims: ScopedTokenClaims): Array<string>;
+export interface VerifyScopedTokenOptions {
+    /**
+     * Expected `iss` claim. Defaults to `'foir-platform'`, the issuer the
+     * platform's scoped-token minter uses. Override only when verifying
+     * tokens from a non-default issuer (test harnesses, alternate deploys).
+     */
+    expectedIssuer?: string;
+}
+/**
+ * Verify a scoped-token JWT against the platform's JWKS.
+ *
+ * Throws on malformed header, unknown kid, bad signature, missing/expired
+ * exp, future nbf (with 30s skew tolerance), or mismatched iss. Returns
+ * the decoded claim set on success.
+ */
+export declare function verifyScopedToken(token: string, jwksUrl: string, options?: VerifyScopedTokenOptions): Promise<ScopedTokenClaims>;
+/**
+ * Parse the semicolon-delimited `X-Foir-Context` header the platform
+ * attaches to dispatched operation requests. Shape:
+ * `project=P;app=A;operation=O;triggered_by=T;execution_id=E;causation_chain=a,b,c`.
+ */
+export declare function parseContextHeader(raw: string | null): Record<string, string>;

package/dist/server/webhook-helpers.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Webhook verification helpers for extension API backends.
+ *
+ * Verifies HMAC-SHA256 signatures on incoming webhook requests
+ * from the EIDE platform.
+ *
+ * The platform sends two security headers:
+ * - `x-foir-signature`: HMAC-SHA256 hex signature of the request body
+ * - `x-foir-token`: Short-lived JWT (5min) containing extension context + API key
+ *
+ * Extensions should verify the signature and extract the API key from the token.
+ */
+/**
+ * Verify a webhook signature from the platform.
+ *
+ * The platform signs webhook payloads with HMAC-SHA256 using the
+ * extension's webhook secret. The signature is sent in the
+ * `x-foir-signature` header as a hex-encoded string.
+ *
+ * @example
+ * ```ts
+ * import { verifyWebhookSignature } from '@foir/sdk/server';
+ *
+ * app.post('/webhooks/entity-published', async (c) => {
+ *   const body = await c.req.text();
+ *   const signature = c.req.header('x-foir-signature') ?? '';
+ *
+ *   const valid = await verifyWebhookSignature(body, signature, WEBHOOK_SECRET);
+ *   if (!valid) return c.text('Invalid signature', 401);
+ *
+ *   const payload = JSON.parse(body);
+ *   // process webhook...
+ * });
+ * ```
+ */
+export declare function verifyWebhookSignature(payload: string, signature: string, secret: string): Promise<boolean>;

package/dist/server.js

@@ -344,11 +344,309 @@ async function hmacSha256Hex(secret, body) {
   const sig = await crypto.subtle.sign("HMAC", key, enc.encode(body));
   return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
+
+// src/transport/foir-http.ts
+var FoirRequestError = class extends Error {
+  /** HTTP status code, when the request failed at the HTTP layer. */
+  status;
+  /** GraphQL errors, when the request failed with a no-data error envelope. */
+  graphQLErrors;
+  cause;
+  constructor(message, options) {
+    super(message);
+    this.name = "FoirRequestError";
+    this.cause = options?.cause;
+    this.status = options?.status;
+    this.graphQLErrors = options?.graphQLErrors;
+  }
+  /**
+   * The code of the first error, if the response carried one.
+   *
+   * A getter rather than a stored field so it stays correct for an error
+   * constructed anywhere, including by a caller in a test.
+   */
+  get code() {
+    return this.graphQLErrors?.[0]?.extensions?.code;
+  }
+  /** The correlation id, if the response carried one. */
+  get requestId() {
+    return this.graphQLErrors?.[0]?.extensions?.requestId;
+  }
+  /**
+   * Whether retrying this request could succeed.
+   *
+   * The 429 is the one that has to be in here and is easy to leave out: it sits
+   * among the 4xx statuses that are otherwise permanent, so a policy written as
+   * "retry 5xx, never retry 4xx" excludes exactly the failure that clears on its
+   * own. A storefront wrote that policy, its key saturated, and every read
+   * failed on the first attempt for an hour.
+   */
+  get retryable() {
+    if (this.status === void 0) return true;
+    if (this.status === 429 || this.code === "RATE_LIMITED") return true;
+    if (this.status >= 500) return true;
+    return this.code === "UNAVAILABLE" || this.code === "TIMEOUT";
+  }
+  /**
+   * How long to wait before retrying, in milliseconds, when the server said.
+   * Undefined when it did not, which means the caller picks its own backoff.
+   */
+  get retryAfterMs() {
+    const seconds = this.graphQLErrors?.[0]?.extensions?.retryAfter;
+    return typeof seconds === "number" && seconds > 0 ? seconds * 1e3 : void 0;
+  }
+};
+function isFoirRateLimited(err) {
+  return err instanceof FoirRequestError && (err.status === 429 || err.code === "RATE_LIMITED");
+}
+function isFoirUnauthenticated(err) {
+  return err instanceof FoirRequestError && (err.status === 401 || err.code === "UNAUTHENTICATED");
+}
+function isFoirForbidden(err) {
+  return err instanceof FoirRequestError && (err.status === 403 || err.code === "PERMISSION_DENIED");
+}
+function isFoirNotFound(err) {
+  return err instanceof FoirRequestError && err.code === "NOT_FOUND";
+}
+function readFoirRetryAfterMs(headers) {
+  const seconds = Number(headers.get("Retry-After"));
+  return Number.isFinite(seconds) && seconds > 0 ? seconds * 1e3 : void 0;
+}
+function buildFoirHeaders(input) {
+  const headers = {
+    "Content-Type": "application/json",
+    "x-api-key": input.apiKey
+  };
+  if (input.draftChannel) {
+    headers["X-Foir-Schema-Channel"] = "draft";
+  }
+  if (input.bearerToken) {
+    headers["Authorization"] = `Bearer ${input.bearerToken}`;
+  }
+  if (input.extra) {
+    for (const [key, value] of Object.entries(input.extra)) {
+      headers[key] = value;
+    }
+  }
+  return headers;
+}
+function foirApiEndpoint(apiUrl, path) {
+  const base = apiUrl.trim().replace(/\/+$/, "").replace(/\/graphql$/i, "");
+  if (!base) {
+    throw new FoirRequestError("[foir] apiUrl is empty \u2014 pass the Foir API origin");
+  }
+  return base + path;
+}
+
+// src/server/events-client.ts
+var FOIR_EVENTS_PATH = "/v1/events";
+var FOIR_EVENTS_SCOPE = "events:list.project";
+var FOIR_EVENTS_RETENTION_DAYS = 90;
+var FoirEventCursorExpiredError = class extends FoirRequestError {
+  /**
+   * The cursor to resume from, accepting the gap — parsed out of the server's
+   * message, which names it.
+   *
+   * `undefined` only if the message ever stops naming one, in which case
+   * restarting from 0 and de-duplicating on `id` is the safe fallback. It is
+   * optional for that reason and not because the server omits it today; both
+   * refusal messages carry it, and both are pinned as fixtures in the tests.
+   */
+  resumeFrom;
+  /** The cursor that was rejected — whatever was passed as `after`. */
+  requestedCursor;
+  constructor(message, options) {
+    super(message, { status: options.status });
+    this.name = "FoirEventCursorExpiredError";
+    this.resumeFrom = options.resumeFrom;
+    this.requestedCursor = options.requestedCursor;
+  }
+};
+function isFoirEventCursorExpired(err) {
+  return err instanceof FoirRequestError && err.status === 410;
+}
+var RESUME_FROM = /resume from\s+(\d+)/i;
+function parseResumeFrom(message) {
+  const m = RESUME_FROM.exec(message);
+  if (!m) return void 0;
+  const n = Number(m[1]);
+  return Number.isSafeInteger(n) ? n : void 0;
+}
+function assertOperatorKey(apiKey) {
+  const key = apiKey?.trim() ?? "";
+  if (!key) {
+    throw new FoirRequestError(
+      `[foir] createEventsClient: apiKey is empty \u2014 pass an sk_ secret key holding ${FOIR_EVENTS_SCOPE}.`
+    );
+  }
+  if (key.startsWith("pk_")) {
+    throw new FoirRequestError(
+      `[foir] createEventsClient: the event log is an OPERATOR surface and a public (pk_) key can never hold ${FOIR_EVENTS_SCOPE} \u2014 it is not mintable on a public key. Use an sk_ secret key from a server-side runtime; a pk_ key is embeddable in browser bundles, and the log names which customer acted on records the bundle's reader cannot themselves read.`
+    );
+  }
+  if (!key.startsWith("sk_")) {
+    throw new FoirRequestError(
+      `[foir] createEventsClient: apiKey must be an sk_ secret key (sk_ or sk_t_), got a key starting "${key.slice(0, 4)}". The event log is reachable by an sk_ api key or an admin session only.`
+    );
+  }
+  return key;
+}
+function assertNoBearer(headers) {
+  if (!headers) return;
+  for (const name of Object.keys(headers)) {
+    if (name.toLowerCase() === "authorization") {
+      throw new FoirRequestError(
+        `[foir] createEventsClient: an Authorization header is not accepted. A customer bearer makes the customer the resolved authority on api-public, and no customer authority can contain ${FOIR_EVENTS_SCOPE}. The sk_ key alone is the credential for this surface.`
+      );
+    }
+  }
+}
+function readSeq(value, field) {
+  const n = typeof value === "number" ? value : Number(value ?? 0);
+  if (!Number.isSafeInteger(n)) {
+    throw new FoirRequestError(
+      `[foir] events: ${field} is not a safe integer (${String(value)}). A sequence number past 2^53 cannot be represented exactly in JSON, and an inexact cursor skips or repeats events.`
+    );
+  }
+  return n;
+}
+function toEvent(raw) {
+  return {
+    id: raw.id ?? "",
+    seq: readSeq(raw.seq, "event.seq"),
+    event: raw.event ?? "",
+    payload: raw.payload ?? {},
+    // `null` is preserved rather than defaulted to `{}`: "nobody was attributed"
+    // and "attributed to nothing in particular" are different facts, and the
+    // platform goes out of its way to keep them apart.
+    actor: raw.actor ?? null,
+    causationChain: raw.causation_chain ?? [],
+    createdAt: raw.created_at ?? ""
+  };
+}
+function toPage(raw) {
+  const retention = raw.retention ?? {};
+  return {
+    events: (raw.events ?? []).map(toEvent),
+    nextCursor: readSeq(raw.next_cursor, "next_cursor"),
+    hasMore: raw.has_more === true,
+    retention: {
+      windowDays: Number(retention.window_days ?? 0),
+      oldestRetainedAt: retention.oldest_retained_at ?? "",
+      oldestAvailableSeq: readSeq(retention.oldest_available_seq, "retention.oldest_available_seq")
+    }
+  };
+}
+var STATUS_CODES = {
+  400: "INVALID_ARGUMENT",
+  401: "UNAUTHENTICATED",
+  403: "PERMISSION_DENIED",
+  404: "NOT_FOUND",
+  410: "FAILED_PRECONDITION",
+  429: "RATE_LIMITED",
+  503: "UNAVAILABLE",
+  504: "TIMEOUT"
+};
+async function readErrorMessage(res) {
+  try {
+    const json = await res.json();
+    if (typeof json?.error === "string" && json.error) return json.error;
+    const first = json?.errors?.[0]?.message;
+    return typeof first === "string" && first ? first : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function createEventsClient(config) {
+  const apiKey = assertOperatorKey(config.apiKey);
+  assertNoBearer(config.headers);
+  const url = foirApiEndpoint(config.apiUrl, FOIR_EVENTS_PATH);
+  async function list(params = {}) {
+    const doFetch = config.fetch ?? globalThis.fetch;
+    const query = new URLSearchParams();
+    if (params.after !== void 0) query.set("after", String(readSeq(params.after, "after")));
+    if (params.limit !== void 0) query.set("limit", String(params.limit));
+    for (const name of params.events ?? []) {
+      if (name) query.append("event", name);
+    }
+    const qs = query.toString();
+    let res;
+    try {
+      res = await doFetch(qs ? `${url}?${qs}` : url, {
+        method: "GET",
+        headers: buildFoirHeaders({ apiKey, extra: config.headers }),
+        ...params.signal ? { signal: params.signal } : {},
+        ...config.requestInit
+      });
+    } catch (err) {
+      throw new FoirRequestError("[foir] events: network error", { cause: err });
+    }
+    if (!res.ok) {
+      const message = await readErrorMessage(res);
+      const detail = message ? `: ${message}` : "";
+      if (res.status === 410) {
+        throw new FoirEventCursorExpiredError(`[foir] events: cursor expired${detail}`, {
+          status: 410,
+          resumeFrom: message ? parseResumeFrom(message) : void 0,
+          requestedCursor: params.after
+        });
+      }
+      const extensions = {};
+      const code = STATUS_CODES[res.status] ?? (res.status >= 500 ? "INTERNAL" : void 0);
+      if (code) extensions.code = code;
+      const retryAfterMs = readFoirRetryAfterMs(res.headers);
+      if (retryAfterMs !== void 0) extensions.retryAfter = retryAfterMs / 1e3;
+      throw new FoirRequestError(`[foir] events: HTTP ${res.status} ${res.statusText}${detail}`, {
+        status: res.status,
+        graphQLErrors: [{ message: message ?? res.statusText, extensions }]
+      });
+    }
+    let body;
+    try {
+      body = await res.json();
+    } catch (err) {
+      throw new FoirRequestError("[foir] events: response was not JSON", {
+        cause: err,
+        status: res.status
+      });
+    }
+    return toPage(body);
+  }
+  async function* stream(params = {}) {
+    const { onPage, ...rest } = params;
+    let after = params.after ?? 0;
+    for (; ; ) {
+      const page = await list({ ...rest, after });
+      if (onPage) await onPage(page);
+      for (const event of page.events) yield event;
+      if (!page.hasMore) return;
+      if (page.nextCursor <= after) {
+        throw new FoirRequestError(
+          `[foir] events: the server reported has_more with a cursor that did not advance (${after} -> ${page.nextCursor}). Refusing to loop.`,
+          { status: 500 }
+        );
+      }
+      after = page.nextCursor;
+    }
+  }
+  return { list, stream };
+}
 export {
+  FOIR_EVENTS_PATH,
+  FOIR_EVENTS_RETENTION_DAYS,
+  FOIR_EVENTS_SCOPE,
+  FoirEventCursorExpiredError,
+  FoirRequestError,
   ScopedTokenError,
   ServerClientError,
   createCallbackClient,
+  createEventsClient,
   createServerClient,
+  isFoirEventCursorExpired,
+  isFoirForbidden,
+  isFoirNotFound,
+  isFoirRateLimited,
+  isFoirUnauthenticated,
   parseContextHeader,
   parseSubject,
   recordsReadModels,