@fytkit/sdk 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,38 @@
+# Changelog
+
+All notable changes to `@fytkit/sdk` are documented in this file.
+Format: [Keep a Changelog 1.1.0](https://keepachangelog.com/en/1.1.0/).
+Versioning: [Semantic Versioning 2.0.0](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0] — 2026-05-18
+
+### Changed
+
+- First public stable pre-1.0 release. No public-surface changes since `0.1.0-pre.0`; the `pre` suffix is dropped now that the sample app at `examples/sdk-react/`, the Playwright e2e (`tests/e2e/sdk-react-sample-app.spec.ts`), and the developer docs are landed.
+
+### Added
+
+- Verified against a runnable sample app at `examples/sdk-react/` exercising every documented surface end-to-end.
+- CORS support on `/rpc` so cross-origin browser apps can call the SDK without proxying.
+
+## [0.1.0-pre.0] — 2026-05-18
+
+### Added
+
+- Initial pre-release of the vanilla TypeScript SDK.
+- `createFytkitClient({ clientId, baseUrl?, storage?, fetch? })` factory.
+- `auth` namespace: `signUp`, `signIn`, `signOut`, `getSession`, `onAuthStateChange`, `requestPasswordReset`, `confirmPasswordReset`, `confirmEmail`.
+- Data namespaces: `workouts`, `programs`, `recipes`, `nutrition`, `articles`, `enrollments`, `sessionLogs`, `progression`, `media`, `appConfig`, `subscription`.
+- `FytkitError` discriminated union with normalised error kinds.
+- Pluggable `TokenStorage` (default: `localStorage`; bundled in-memory adapter for SSR/tests).
+- Proactive refresh ~60 s before token expiry + reactive 401 retry-with-refresh.
+
+### Known issues
+
+- `signed_out_due_to_token_reuse` is reserved in the `AuthState` union but is never emitted by the current backend (no refresh-token rotation yet).
+
+[Unreleased]: https://github.com/cbarlow1993/fytkit-web/compare/@fytkit/sdk@0.1.0...HEAD
+[0.1.0]: https://github.com/cbarlow1993/fytkit-web/releases/tag/@fytkit/sdk@0.1.0
+[0.1.0-pre.0]: https://github.com/cbarlow1993/fytkit-web/releases/tag/@fytkit/sdk@0.1.0-pre.0

package/README.md

@@ -0,0 +1,70 @@
+# @fytkit/sdk
+
+Vanilla TypeScript SDK for the fytkit public API. Build a custom trainee-facing app on top of your fytkit programs, workouts, recipes, and Mux-protected video.
+
+> v0.1.x is a pre-1.0 release line. The shape of every exported type is documented in [`etc/sdk.api.md`](./etc/sdk.api.md); breaking changes are recorded in [`CHANGELOG.md`](./CHANGELOG.md).
+
+## Install
+
+```bash
+pnpm add @fytkit/sdk @orpc/client
+# or
+npm install @fytkit/sdk @orpc/client
+```
+
+Pin to an exact version while the SDK is pre-1.0:
+
+```bash
+pnpm add @fytkit/sdk@0.1.0 @orpc/client
+```
+
+Full install + version-pinning guidance: [`docs/developer/installation.md`](../../docs/developer/installation.md). Semver policy: [`docs/developer/concepts/versioning.md`](../../docs/developer/concepts/versioning.md).
+
+## 30-second quickstart
+
+```ts
+import { createFytkitClient } from "@fytkit/sdk";
+
+const fytkit = createFytkitClient({
+  clientId: "fk_app_xxxxxxxxxxxxxxxxx", // from /dashboard/developer
+});
+
+// Sign a trainee in (your own auth UI calls this)
+const session = await fytkit.auth.signIn({
+  email: "trainee@example.com",
+  password: "their-password",
+});
+
+// Fetch their workouts
+const { items } = await fytkit.workouts.list({ limit: 20 });
+
+// Subscribe to auth state (e.g. to redirect on sign-out)
+const off = fytkit.auth.onAuthStateChange((state) => {
+  if (state.type === "signed_out") window.location.assign("/sign-in");
+});
+
+// Sign out — revokes the server-side session and clears local storage
+await fytkit.auth.signOut();
+off();
+```
+
+## What's included in this preview
+
+- `auth.signUp` / `signIn` / `signOut` / `getSession` / `onAuthStateChange`
+- `auth.requestPasswordReset` / `confirmPasswordReset` / `confirmEmail`
+- Data namespaces: `workouts`, `programs`, `recipes`, `nutrition`, `articles`, `enrollments`, `sessionLogs`, `progression`, `media`, `appConfig`, `subscription`
+- Automatic header injection (`X-Fytkit-Client-Id`, `Authorization: Bearer …`)
+- Proactive refresh ~60 s before token expiry + reactive 401 retry
+- Pluggable token storage (`localStorage` default, in-memory + cookie for SSR)
+
+## Storage trade-off
+
+Access tokens land in `localStorage` by default, namespaced by `clientId`. Any script running on your origin can read them — ship a strict CSP and treat the SDK like any other auth-bearing dependency. Token TTL is ~15 minutes and refresh requires the server, so a leaked token has a short blast radius.
+
+Use `createMemoryStorageAdapter()` for SSR + tests.
+
+## Coming next
+
+- `@fytkit/react` — hooks + `<FytkitVideo>`
+- `examples/sdk-react` — runnable sample app
+- `docs/sdk/quickstart.md` — full guide