@orbit-work/block-sdk 0.0.0-stage → 0.2.0

package/README.md

@@ -1,3 +1,81 @@
-# Temporary Holding Version
+# JSON block SDK
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+`@orbit-work/block-sdk` is an independent, publishable npm package with an ESM
+entry and TypeScript declarations. It has no runtime dependencies or knowledge,
+identity, UI or React behavior.
+
+```ts
+import { getBlockData } from "@orbit-work/block-sdk"
+
+const data = await getBlockData<unknown>("my-config", {
+  env: "pre", // uat | pre | prod
+  signal: controller.signal,
+  timeoutMs: 3000,
+})
+```
+
+The key is a standalone path identifier, unrelated to app IDs. Requests read
+`https://s.fzcdn1.com/cdn/h5-data/<configKey>/<env>/data.json` with anonymous GET,
+`credentials: "omit"`, `cache: "no-store"`, and no redirects. The default timeout
+is three seconds and covers the response body. There is no persistent cache or
+offline fallback. `BlockDataError.code` distinguishes `invalid-options`, `network`,
+`http` (with `status`), `timeout`, `cancelled`, and `json` failures.
+
+The generic is a TypeScript return type, not runtime validation. Each consumer
+validates its own JSON fields and handles failures.
+
+The browser and Node.js 20+ use their native Fetch API. Each host may configure an
+isolated client for all of its blocks:
+
+```ts
+import { createBlockClient, BLOCK_DEV_PROXY_PATH } from "@orbit-work/block-sdk"
+
+export const blocks = createBlockClient({
+  baseUrl: import.meta.env.DEV ? BLOCK_DEV_PROXY_PATH : undefined,
+})
+const features = await blocks.getBlockData("orbit-features-preview", { env: "prod" })
+const other = await blocks.getBlockData("another-block", { env: "uat" })
+```
+
+`baseUrl` accepts a root-relative path or an absolute HTTPS base, without
+credentials, queries, fragments or traversal segments. Its default is the public
+CDN base. Client configuration does not mutate `getBlockData` or other clients;
+environment selection remains explicit on every read. The core has no Vite,
+Node-only, UI or authentication imports.
+
+## Local Vite development
+
+Add the optional Vite 8 plugin to the application's Vite config:
+
+```ts
+import { blockDataDevProxy } from "@orbit-work/block-sdk/vite"
+
+export default defineConfig({ plugins: [blockDataDevProxy()] })
+```
+
+The development server serves `GET /__orbit_blocks__/<key>/<uat|pre|prod>/data.json`
+and fetches the real public CDN on the server. The browser reads its own origin,
+so localhost needs no additional CDN CORS registration. All legal keys use this
+same transport. The plugin validates the entire path and method, accepts no target
+URL, forwards no incoming headers or credentials, follows no redirects and
+forwards no upstream cookies. Responses use `Cache-Control: no-store`.
+
+The upstream timeout defaults to three seconds, includes body streaming and can be
+set with `blockDataDevProxy({ timeoutMs: 5000 })`. A caller disconnect cancels the
+upstream read. Network/timeout failures return bounded JSON with 502/504; upstream
+HTTP failures retain their status without exposing their response body. Consumers
+still own schema validation and recovery policy.
+
+The plugin installs only development middleware, with no production build or
+preview endpoint. Production clients with no `baseUrl` continue using the CDN.
+Use localhost HTTP for the existing local login registration; custom hosts still
+need trusted HTTPS and their own identity callback registration for login.
+
+Build and test with `pnpm --filter @orbit-work/block-sdk test`.
+`pnpm --filter @orbit-work/block-sdk pack` builds an installable tarball; it does
+not publish to the registry.
+
+Both the core and `/vite` entries are included in the tarball. Tests exercise an
+isolated npm consumer as well as real Vite middleware for multiple keys and
+environments, anonymity, invalid routes, failure recovery, body timeout,
+disconnection and production preview isolation.

package/dist/chunk-MCUJICYI.js

@@ -0,0 +1,11 @@
+// src/paths.ts
+var BLOCK_CDN_BASE_URL = "https://s.fzcdn1.com/cdn/h5-data";
+var BLOCK_DEV_PROXY_PATH = "/__orbit_blocks__";
+var BLOCK_KEY = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+
+export {
+  BLOCK_CDN_BASE_URL,
+  BLOCK_DEV_PROXY_PATH,
+  BLOCK_KEY
+};
+//# sourceMappingURL=chunk-MCUJICYI.js.map

package/dist/chunk-MCUJICYI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/paths.ts"],"sourcesContent":["export const BLOCK_CDN_BASE_URL = \"https://s.fzcdn1.com/cdn/h5-data\"\nexport const BLOCK_DEV_PROXY_PATH = \"/__orbit_blocks__\"\n\nexport const BLOCK_KEY = /^[A-Za-z0-9][A-Za-z0-9_-]*$/\n"],"mappings":";AAAO,IAAM,qBAAqB;AAC3B,IAAM,uBAAuB;AAE7B,IAAM,YAAY;","names":[]}

package/dist/index.d.ts

@@ -0,0 +1,26 @@
+declare const BLOCK_DEV_PROXY_PATH = "/__orbit_blocks__";
+
+type BlockEnvironment = "uat" | "pre" | "prod";
+type GetBlockDataOptions = {
+    env: BlockEnvironment;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+};
+type BlockClientOptions = {
+    baseUrl?: string;
+};
+type BlockClient = {
+    getBlockData: typeof getBlockData;
+};
+type BlockErrorCode = "invalid-options" | "network" | "http" | "timeout" | "cancelled" | "json";
+declare class BlockDataError extends Error {
+    readonly code: BlockErrorCode;
+    readonly status?: number;
+    constructor(code: BlockErrorCode, status?: number);
+}
+/** Dora's config key identifies a block, independently of any application ID. */
+declare function getBlockData<T = unknown>(configKey: string, options: GetBlockDataOptions): Promise<T>;
+/** Configure one isolated client for all of a host's blocks, without global or framework state. */
+declare function createBlockClient(options?: BlockClientOptions): BlockClient;
+
+export { BLOCK_DEV_PROXY_PATH, type BlockClient, type BlockClientOptions, BlockDataError, type BlockEnvironment, type BlockErrorCode, type GetBlockDataOptions, createBlockClient, getBlockData };

package/dist/index.js

@@ -0,0 +1,91 @@
+import {
+  BLOCK_CDN_BASE_URL,
+  BLOCK_DEV_PROXY_PATH,
+  BLOCK_KEY
+} from "./chunk-MCUJICYI.js";
+
+// src/index.ts
+var BlockDataError = class extends Error {
+  code;
+  status;
+  constructor(code, status) {
+    super(`Block data request failed: ${code}`);
+    this.name = "BlockDataError";
+    this.code = code;
+    this.status = status;
+  }
+};
+async function getBlockData(configKey, options) {
+  return readBlock(BLOCK_CDN_BASE_URL, configKey, options);
+}
+function createBlockClient(options = {}) {
+  const baseUrl = normalizeBaseUrl(options.baseUrl);
+  return {
+    getBlockData: (key, options2) => readBlock(baseUrl, key, options2)
+  };
+}
+function normalizeBaseUrl(value) {
+  if (value === void 0) return BLOCK_CDN_BASE_URL;
+  if (typeof value !== "string" || !value || /[\\\s?#%]/.test(value)) throw new BlockDataError("invalid-options");
+  const path = value.startsWith("/") ? value : value.replace(/^https:\/\/[^/]+/, "");
+  if (path.split("/").some((part) => part === "." || part === "..")) throw new BlockDataError("invalid-options");
+  if (/^\/(?!\/)[A-Za-z0-9_/-]*$/.test(value)) return value.replace(/\/+$/, "");
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "https:" || url.username || url.password) throw new Error();
+    return url.href.replace(/\/+$/, "");
+  } catch {
+    throw new BlockDataError("invalid-options");
+  }
+}
+async function readBlock(baseUrl, configKey, options) {
+  const timeoutMs = options.timeoutMs ?? 3e3;
+  if (typeof configKey !== "string" || !BLOCK_KEY.test(configKey) || !["uat", "pre", "prod"].includes(options.env) || !Number.isFinite(timeoutMs) || timeoutMs <= 0)
+    throw new BlockDataError("invalid-options");
+  const controller = new AbortController();
+  let timedOut = false;
+  const cancel = () => controller.abort();
+  if (options.signal?.aborted) throw new BlockDataError("cancelled");
+  options.signal?.addEventListener("abort", cancel, { once: true });
+  const timer = setTimeout(() => {
+    timedOut = true;
+    controller.abort();
+  }, timeoutMs);
+  try {
+    let response;
+    try {
+      response = await fetch(`${baseUrl}/${configKey}/${options.env}/data.json`, {
+        method: "GET",
+        credentials: "omit",
+        cache: "no-store",
+        redirect: "error",
+        referrerPolicy: "no-referrer",
+        signal: controller.signal
+      });
+    } catch {
+      throw new BlockDataError("network");
+    }
+    if (!response.ok) throw new BlockDataError("http", response.status);
+    try {
+      const data = await response.json();
+      if (controller.signal.aborted) throw new BlockDataError("cancelled");
+      return data;
+    } catch {
+      throw new BlockDataError("json");
+    }
+  } catch (error) {
+    if (options.signal?.aborted) throw new BlockDataError("cancelled");
+    if (timedOut) throw new BlockDataError("timeout");
+    throw error instanceof BlockDataError ? error : new BlockDataError("network");
+  } finally {
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", cancel);
+  }
+}
+export {
+  BLOCK_DEV_PROXY_PATH,
+  BlockDataError,
+  createBlockClient,
+  getBlockData
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { BLOCK_CDN_BASE_URL, BLOCK_KEY } from \"./paths\"\n\nexport { BLOCK_DEV_PROXY_PATH } from \"./paths\"\n\nexport type BlockEnvironment = \"uat\" | \"pre\" | \"prod\"\n\nexport type GetBlockDataOptions = { env: BlockEnvironment; signal?: AbortSignal; timeoutMs?: number }\n\nexport type BlockClientOptions = { baseUrl?: string }\nexport type BlockClient = { getBlockData: typeof getBlockData }\n\nexport type BlockErrorCode = \"invalid-options\" | \"network\" | \"http\" | \"timeout\" | \"cancelled\" | \"json\"\n\nexport class BlockDataError extends Error {\n  readonly code: BlockErrorCode\n  readonly status?: number\n  constructor(code: BlockErrorCode, status?: number) {\n    super(`Block data request failed: ${code}`)\n    this.name = \"BlockDataError\"\n    this.code = code\n    this.status = status\n  }\n}\n\n/** Dora's config key identifies a block, independently of any application ID. */\nexport async function getBlockData<T = unknown>(configKey: string, options: GetBlockDataOptions): Promise<T> {\n  return readBlock<T>(BLOCK_CDN_BASE_URL, configKey, options)\n}\n\n/** Configure one isolated client for all of a host's blocks, without global or framework state. */\nexport function createBlockClient(options: BlockClientOptions = {}): BlockClient {\n  const baseUrl = normalizeBaseUrl(options.baseUrl)\n  return {\n    getBlockData: <T = unknown>(key: string, options: GetBlockDataOptions) => readBlock<T>(baseUrl, key, options),\n  }\n}\n\nfunction normalizeBaseUrl(value: string | undefined): string {\n  if (value === undefined) return BLOCK_CDN_BASE_URL\n  if (typeof value !== \"string\" || !value || /[\\\\\\s?#%]/.test(value)) throw new BlockDataError(\"invalid-options\")\n  const path = value.startsWith(\"/\") ? value : value.replace(/^https:\\/\\/[^/]+/, \"\")\n  if (path.split(\"/\").some((part) => part === \".\" || part === \"..\")) throw new BlockDataError(\"invalid-options\")\n  if (/^\\/(?!\\/)[A-Za-z0-9_/-]*$/.test(value)) return value.replace(/\\/+$/, \"\")\n  try {\n    const url = new URL(value)\n    if (url.protocol !== \"https:\" || url.username || url.password) throw new Error()\n    return url.href.replace(/\\/+$/, \"\")\n  } catch {\n    throw new BlockDataError(\"invalid-options\")\n  }\n}\n\nasync function readBlock<T>(baseUrl: string, configKey: string, options: GetBlockDataOptions): Promise<T> {\n  const timeoutMs = options.timeoutMs ?? 3000\n  if (\n    typeof configKey !== \"string\" ||\n    !BLOCK_KEY.test(configKey) ||\n    ![\"uat\", \"pre\", \"prod\"].includes(options.env) ||\n    !Number.isFinite(timeoutMs) ||\n    timeoutMs <= 0\n  )\n    throw new BlockDataError(\"invalid-options\")\n\n  const controller = new AbortController()\n  let timedOut = false\n  const cancel = () => controller.abort()\n  if (options.signal?.aborted) throw new BlockDataError(\"cancelled\")\n  options.signal?.addEventListener(\"abort\", cancel, { once: true })\n  const timer = setTimeout(() => {\n    timedOut = true\n    controller.abort()\n  }, timeoutMs)\n  try {\n    let response: Response\n    try {\n      response = await fetch(`${baseUrl}/${configKey}/${options.env}/data.json`, {\n        method: \"GET\",\n        credentials: \"omit\",\n        cache: \"no-store\",\n        redirect: \"error\",\n        referrerPolicy: \"no-referrer\",\n        signal: controller.signal,\n      })\n    } catch {\n      throw new BlockDataError(\"network\")\n    }\n    if (!response.ok) throw new BlockDataError(\"http\", response.status)\n    try {\n      const data = (await response.json()) as T\n      if (controller.signal.aborted) throw new BlockDataError(\"cancelled\")\n      return data\n    } catch {\n      throw new BlockDataError(\"json\")\n    }\n  } catch (error) {\n    if (options.signal?.aborted) throw new BlockDataError(\"cancelled\")\n    if (timedOut) throw new BlockDataError(\"timeout\")\n    throw error instanceof BlockDataError ? error : new BlockDataError(\"network\")\n  } finally {\n    clearTimeout(timer)\n    options.signal?.removeEventListener(\"abort\", cancel)\n  }\n}\n"],"mappings":";;;;;;;AAaO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EAC/B;AAAA,EACA;AAAA,EACT,YAAY,MAAsB,QAAiB;AACjD,UAAM,8BAA8B,IAAI,EAAE;AAC1C,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAGA,eAAsB,aAA0B,WAAmB,SAA0C;AAC3G,SAAO,UAAa,oBAAoB,WAAW,OAAO;AAC5D;AAGO,SAAS,kBAAkB,UAA8B,CAAC,GAAgB;AAC/E,QAAM,UAAU,iBAAiB,QAAQ,OAAO;AAChD,SAAO;AAAA,IACL,cAAc,CAAc,KAAaA,aAAiC,UAAa,SAAS,KAAKA,QAAO;AAAA,EAC9G;AACF;AAEA,SAAS,iBAAiB,OAAmC;AAC3D,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,OAAO,UAAU,YAAY,CAAC,SAAS,YAAY,KAAK,KAAK,EAAG,OAAM,IAAI,eAAe,iBAAiB;AAC9G,QAAM,OAAO,MAAM,WAAW,GAAG,IAAI,QAAQ,MAAM,QAAQ,oBAAoB,EAAE;AACjF,MAAI,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,SAAS,SAAS,OAAO,SAAS,IAAI,EAAG,OAAM,IAAI,eAAe,iBAAiB;AAC7G,MAAI,4BAA4B,KAAK,KAAK,EAAG,QAAO,MAAM,QAAQ,QAAQ,EAAE;AAC5E,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,IAAI,aAAa,YAAY,IAAI,YAAY,IAAI,SAAU,OAAM,IAAI,MAAM;AAC/E,WAAO,IAAI,KAAK,QAAQ,QAAQ,EAAE;AAAA,EACpC,QAAQ;AACN,UAAM,IAAI,eAAe,iBAAiB;AAAA,EAC5C;AACF;AAEA,eAAe,UAAa,SAAiB,WAAmB,SAA0C;AACxG,QAAM,YAAY,QAAQ,aAAa;AACvC,MACE,OAAO,cAAc,YACrB,CAAC,UAAU,KAAK,SAAS,KACzB,CAAC,CAAC,OAAO,OAAO,MAAM,EAAE,SAAS,QAAQ,GAAG,KAC5C,CAAC,OAAO,SAAS,SAAS,KAC1B,aAAa;AAEb,UAAM,IAAI,eAAe,iBAAiB;AAE5C,QAAM,aAAa,IAAI,gBAAgB;AACvC,MAAI,WAAW;AACf,QAAM,SAAS,MAAM,WAAW,MAAM;AACtC,MAAI,QAAQ,QAAQ,QAAS,OAAM,IAAI,eAAe,WAAW;AACjE,UAAQ,QAAQ,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;AAChE,QAAM,QAAQ,WAAW,MAAM;AAC7B,eAAW;AACX,eAAW,MAAM;AAAA,EACnB,GAAG,SAAS;AACZ,MAAI;AACF,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,GAAG,OAAO,IAAI,SAAS,IAAI,QAAQ,GAAG,cAAc;AAAA,QACzE,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,OAAO;AAAA,QACP,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,QAAQ,WAAW;AAAA,MACrB,CAAC;AAAA,IACH,QAAQ;AACN,YAAM,IAAI,eAAe,SAAS;AAAA,IACpC;AACA,QAAI,CAAC,SAAS,GAAI,OAAM,IAAI,eAAe,QAAQ,SAAS,MAAM;AAClE,QAAI;AACF,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,UAAI,WAAW,OAAO,QAAS,OAAM,IAAI,eAAe,WAAW;AACnE,aAAO;AAAA,IACT,QAAQ;AACN,YAAM,IAAI,eAAe,MAAM;AAAA,IACjC;AAAA,EACF,SAAS,OAAO;AACd,QAAI,QAAQ,QAAQ,QAAS,OAAM,IAAI,eAAe,WAAW;AACjE,QAAI,SAAU,OAAM,IAAI,eAAe,SAAS;AAChD,UAAM,iBAAiB,iBAAiB,QAAQ,IAAI,eAAe,SAAS;AAAA,EAC9E,UAAE;AACA,iBAAa,KAAK;AAClB,YAAQ,QAAQ,oBAAoB,SAAS,MAAM;AAAA,EACrD;AACF;","names":["options"]}

package/dist/vite.d.ts

@@ -0,0 +1,9 @@
+import { Plugin } from 'vite';
+
+type BlockDataDevProxyOptions = {
+    timeoutMs?: number;
+};
+/** Anonymous development transport only. Production build and preview install no middleware. */
+declare function blockDataDevProxy(options?: BlockDataDevProxyOptions): Plugin;
+
+export { type BlockDataDevProxyOptions, blockDataDevProxy };

package/dist/vite.js

@@ -0,0 +1,97 @@
+import {
+  BLOCK_CDN_BASE_URL,
+  BLOCK_DEV_PROXY_PATH
+} from "./chunk-MCUJICYI.js";
+
+// src/vite.ts
+import { once } from "events";
+function blockDataDevProxy(options = {}) {
+  const timeoutMs = options.timeoutMs ?? 3e3;
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) throw new Error("Invalid block proxy timeout");
+  return {
+    name: "orbit-block-data-dev-proxy",
+    apply: "serve",
+    configureServer(server) {
+      server.middlewares.use((request, response, next) => {
+        const path = request.url ?? "";
+        const pathname = path.split("?")[0];
+        if (pathname !== BLOCK_DEV_PROXY_PATH && !pathname.startsWith(`${BLOCK_DEV_PROXY_PATH}/`)) return next();
+        response.setHeader("Cache-Control", "no-store");
+        const reply = (status, error) => {
+          response.statusCode = status;
+          response.setHeader("Content-Type", "application/json; charset=utf-8");
+          response.end(JSON.stringify({ error }));
+        };
+        if (request.method !== "GET") {
+          response.setHeader("Allow", "GET");
+          reply(405, "method-not-allowed");
+          return;
+        }
+        const match = /^\/__orbit_blocks__\/([A-Za-z0-9][A-Za-z0-9_-]*)\/(uat|pre|prod)\/data\.json$/.exec(path);
+        if (!match) {
+          reply(400, "invalid-block-path");
+          return;
+        }
+        const controller = new AbortController();
+        let timedOut = false;
+        const cancel = () => controller.abort();
+        request.once("aborted", cancel);
+        response.once("close", cancel);
+        const timer = setTimeout(() => {
+          timedOut = true;
+          cancel();
+        }, timeoutMs);
+        timer.unref();
+        void (async () => {
+          try {
+            const upstream = await fetch(`${BLOCK_CDN_BASE_URL}/${match[1]}/${match[2]}/data.json`, {
+              method: "GET",
+              credentials: "omit",
+              cache: "no-store",
+              redirect: "error",
+              referrerPolicy: "no-referrer",
+              signal: controller.signal
+            });
+            if (controller.signal.aborted) throw new Error("cancelled");
+            if (!upstream.ok) {
+              await upstream.body?.cancel();
+              reply(upstream.status, "block-http");
+              return;
+            }
+            response.statusCode = upstream.status;
+            response.setHeader("Content-Type", "application/json; charset=utf-8");
+            await forwardBody(upstream, response, controller.signal);
+            response.end();
+          } catch {
+            if (response.destroyed) return;
+            if (response.headersSent) response.destroy();
+            else reply(timedOut ? 504 : 502, timedOut ? "block-timeout" : "block-network");
+          } finally {
+            clearTimeout(timer);
+            request.off("aborted", cancel);
+            response.off("close", cancel);
+          }
+        })();
+      });
+    }
+  };
+}
+async function forwardBody(upstream, response, signal) {
+  const reader = upstream.body?.getReader();
+  if (!reader) return;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (signal.aborted) throw new Error("cancelled");
+      if (done) return;
+      if (!response.write(value)) await once(response, "drain", { signal });
+    }
+  } finally {
+    await reader.cancel().catch(() => void 0);
+    reader.releaseLock();
+  }
+}
+export {
+  blockDataDevProxy
+};
+//# sourceMappingURL=vite.js.map

package/dist/vite.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/vite.ts"],"sourcesContent":["import { once } from \"node:events\"\nimport type { ServerResponse } from \"node:http\"\nimport type { Plugin } from \"vite\"\nimport { BLOCK_CDN_BASE_URL, BLOCK_DEV_PROXY_PATH } from \"./paths\"\n\nexport type BlockDataDevProxyOptions = { timeoutMs?: number }\n\n/** Anonymous development transport only. Production build and preview install no middleware. */\nexport function blockDataDevProxy(options: BlockDataDevProxyOptions = {}): Plugin {\n  const timeoutMs = options.timeoutMs ?? 3000\n  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) throw new Error(\"Invalid block proxy timeout\")\n  return {\n    name: \"orbit-block-data-dev-proxy\",\n    apply: \"serve\",\n    configureServer(server) {\n      server.middlewares.use((request, response, next) => {\n        const path = request.url ?? \"\"\n        const pathname = path.split(\"?\")[0]\n        if (pathname !== BLOCK_DEV_PROXY_PATH && !pathname.startsWith(`${BLOCK_DEV_PROXY_PATH}/`)) return next()\n        response.setHeader(\"Cache-Control\", \"no-store\")\n        const reply = (status: number, error: string) => {\n          response.statusCode = status\n          response.setHeader(\"Content-Type\", \"application/json; charset=utf-8\")\n          response.end(JSON.stringify({ error }))\n        }\n        if (request.method !== \"GET\") {\n          response.setHeader(\"Allow\", \"GET\")\n          reply(405, \"method-not-allowed\")\n          return\n        }\n        const match = /^\\/__orbit_blocks__\\/([A-Za-z0-9][A-Za-z0-9_-]*)\\/(uat|pre|prod)\\/data\\.json$/.exec(path)\n        if (!match) {\n          reply(400, \"invalid-block-path\")\n          return\n        }\n        const controller = new AbortController()\n        let timedOut = false\n        const cancel = () => controller.abort()\n        request.once(\"aborted\", cancel)\n        response.once(\"close\", cancel)\n        const timer = setTimeout(() => {\n          timedOut = true\n          cancel()\n        }, timeoutMs)\n        timer.unref()\n        void (async () => {\n          try {\n            // Construct the destination here; never forward request headers, a target URL, cookies or redirects.\n            const upstream = await fetch(`${BLOCK_CDN_BASE_URL}/${match[1]}/${match[2]}/data.json`, {\n              method: \"GET\",\n              credentials: \"omit\",\n              cache: \"no-store\",\n              redirect: \"error\",\n              referrerPolicy: \"no-referrer\",\n              signal: controller.signal,\n            })\n            if (controller.signal.aborted) throw new Error(\"cancelled\")\n            if (!upstream.ok) {\n              await upstream.body?.cancel()\n              reply(upstream.status, \"block-http\")\n              return\n            }\n            response.statusCode = upstream.status\n            response.setHeader(\"Content-Type\", \"application/json; charset=utf-8\")\n            await forwardBody(upstream, response, controller.signal)\n            response.end()\n          } catch {\n            if (response.destroyed) return\n            if (response.headersSent) response.destroy()\n            else reply(timedOut ? 504 : 502, timedOut ? \"block-timeout\" : \"block-network\")\n          } finally {\n            clearTimeout(timer)\n            request.off(\"aborted\", cancel)\n            response.off(\"close\", cancel)\n          }\n        })()\n      })\n    },\n  }\n}\n\nasync function forwardBody(upstream: Response, response: ServerResponse, signal: AbortSignal) {\n  const reader = upstream.body?.getReader()\n  if (!reader) return\n  try {\n    while (true) {\n      const { done, value } = await reader.read()\n      if (signal.aborted) throw new Error(\"cancelled\")\n      if (done) return\n      if (!response.write(value)) await once(response, \"drain\", { signal })\n    }\n  } finally {\n    await reader.cancel().catch(() => undefined)\n    reader.releaseLock()\n  }\n}\n"],"mappings":";;;;;;AAAA,SAAS,YAAY;AAQd,SAAS,kBAAkB,UAAoC,CAAC,GAAW;AAChF,QAAM,YAAY,QAAQ,aAAa;AACvC,MAAI,CAAC,OAAO,SAAS,SAAS,KAAK,aAAa,EAAG,OAAM,IAAI,MAAM,6BAA6B;AAChG,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IACP,gBAAgB,QAAQ;AACtB,aAAO,YAAY,IAAI,CAAC,SAAS,UAAU,SAAS;AAClD,cAAM,OAAO,QAAQ,OAAO;AAC5B,cAAM,WAAW,KAAK,MAAM,GAAG,EAAE,CAAC;AAClC,YAAI,aAAa,wBAAwB,CAAC,SAAS,WAAW,GAAG,oBAAoB,GAAG,EAAG,QAAO,KAAK;AACvG,iBAAS,UAAU,iBAAiB,UAAU;AAC9C,cAAM,QAAQ,CAAC,QAAgB,UAAkB;AAC/C,mBAAS,aAAa;AACtB,mBAAS,UAAU,gBAAgB,iCAAiC;AACpE,mBAAS,IAAI,KAAK,UAAU,EAAE,MAAM,CAAC,CAAC;AAAA,QACxC;AACA,YAAI,QAAQ,WAAW,OAAO;AAC5B,mBAAS,UAAU,SAAS,KAAK;AACjC,gBAAM,KAAK,oBAAoB;AAC/B;AAAA,QACF;AACA,cAAM,QAAQ,gFAAgF,KAAK,IAAI;AACvG,YAAI,CAAC,OAAO;AACV,gBAAM,KAAK,oBAAoB;AAC/B;AAAA,QACF;AACA,cAAM,aAAa,IAAI,gBAAgB;AACvC,YAAI,WAAW;AACf,cAAM,SAAS,MAAM,WAAW,MAAM;AACtC,gBAAQ,KAAK,WAAW,MAAM;AAC9B,iBAAS,KAAK,SAAS,MAAM;AAC7B,cAAM,QAAQ,WAAW,MAAM;AAC7B,qBAAW;AACX,iBAAO;AAAA,QACT,GAAG,SAAS;AACZ,cAAM,MAAM;AACZ,cAAM,YAAY;AAChB,cAAI;AAEF,kBAAM,WAAW,MAAM,MAAM,GAAG,kBAAkB,IAAI,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,cAAc;AAAA,cACtF,QAAQ;AAAA,cACR,aAAa;AAAA,cACb,OAAO;AAAA,cACP,UAAU;AAAA,cACV,gBAAgB;AAAA,cAChB,QAAQ,WAAW;AAAA,YACrB,CAAC;AACD,gBAAI,WAAW,OAAO,QAAS,OAAM,IAAI,MAAM,WAAW;AAC1D,gBAAI,CAAC,SAAS,IAAI;AAChB,oBAAM,SAAS,MAAM,OAAO;AAC5B,oBAAM,SAAS,QAAQ,YAAY;AACnC;AAAA,YACF;AACA,qBAAS,aAAa,SAAS;AAC/B,qBAAS,UAAU,gBAAgB,iCAAiC;AACpE,kBAAM,YAAY,UAAU,UAAU,WAAW,MAAM;AACvD,qBAAS,IAAI;AAAA,UACf,QAAQ;AACN,gBAAI,SAAS,UAAW;AACxB,gBAAI,SAAS,YAAa,UAAS,QAAQ;AAAA,gBACtC,OAAM,WAAW,MAAM,KAAK,WAAW,kBAAkB,eAAe;AAAA,UAC/E,UAAE;AACA,yBAAa,KAAK;AAClB,oBAAQ,IAAI,WAAW,MAAM;AAC7B,qBAAS,IAAI,SAAS,MAAM;AAAA,UAC9B;AAAA,QACF,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,eAAe,YAAY,UAAoB,UAA0B,QAAqB;AAC5F,QAAM,SAAS,SAAS,MAAM,UAAU;AACxC,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,WAAO,MAAM;AACX,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,OAAO,QAAS,OAAM,IAAI,MAAM,WAAW;AAC/C,UAAI,KAAM;AACV,UAAI,CAAC,SAAS,MAAM,KAAK,EAAG,OAAM,KAAK,UAAU,SAAS,EAAE,OAAO,CAAC;AAAA,IACtE;AAAA,EACF,UAAE;AACA,UAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC3C,WAAO,YAAY;AAAA,EACrB;AACF;","names":[]}

package/package.json

@@ -1,6 +1,45 @@
 {
   "name": "@orbit-work/block-sdk",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "Anonymous JSON block client for CDN-published Dora data.",
+  "type": "module",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./vite": {
+      "types": "./dist/vite.d.ts",
+      "import": "./dist/vite.js"
+    }
+  },
+  "files": ["dist"],
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsup",
+    "prepack": "npm run build",
+    "typecheck": "tsc --noEmit",
+    "test": "pnpm run build && node --test \"src/**/*.test.mjs\""
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.2",
+    "tsup": "^8.5.1",
+    "typescript": "^5.6.3",
+    "vite": "^8.3.0"
+  },
+  "peerDependencies": {
+    "vite": "^8.3.0"
+  },
+  "peerDependenciesMeta": {
+    "vite": { "optional": true }
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  }
+}