@polymorfa/nextjs 0.1.0-dev.20260922094209

package/dist/template-builder-route.js

@@ -0,0 +1,187 @@
+/** Creates a Next.js App Router-compatible, application-mediated template route. */
+export function createTemplateBuilderRoute(options) {
+    validateOptions(options);
+    return async (request) => {
+        if (request.method !== "POST") {
+            return jsonError(405, "method_not_allowed", "Use POST for template builder actions.", { Allow: "POST" });
+        }
+        try {
+            const subject = await options.authorize(request);
+            if (subject === null) {
+                return jsonError(401, "unauthorized", "Authentication is required.");
+            }
+            if (typeof subject.userId !== "string" || subject.userId.length === 0) {
+                throw new RouteInputError("invalid_subject", "userId is required.");
+            }
+            const action = await readAction(request);
+            const projectSlug = await options.resolveProjectSlug(subject, request);
+            requireString(projectSlug, "project_slug_required");
+            const signalOptions = { signal: request.signal };
+            switch (action.action) {
+                case "list": {
+                    if (options.templates.list === undefined)
+                        throw new RouteInputError("invalid_action", "Template listing is not enabled.");
+                    const response = await options.templates.list(projectSlug, signalOptions);
+                    const templates = responseData(response);
+                    if (!Array.isArray(templates))
+                        throw new TypeError("The server SDK returned an invalid template list.");
+                    return json({ templates });
+                }
+                case "load": {
+                    const response = await options.templates.retrieve(projectSlug, action.templateId, signalOptions);
+                    return json({ template: responseData(response) });
+                }
+                case "save": {
+                    const response = action.templateId === undefined
+                        ? await options.templates.create(projectSlug, action.draft, signalOptions)
+                        : await options.templates.update(projectSlug, action.templateId, action.draft, signalOptions);
+                    return json({ template: responseData(response) });
+                }
+                case "preview": {
+                    const response = await options.templates.preview(projectSlug, action.templateId, {
+                        ...(action.values === undefined ? {} : { values: action.values }),
+                        ...(action.surface === undefined
+                            ? {}
+                            : { surface: action.surface }),
+                    }, signalOptions);
+                    return json({ preview: responseData(response) });
+                }
+                case "submit": {
+                    const session = await options.resolveSubmissionSession(subject, request);
+                    requireString(session, "submission_session_required");
+                    const response = await options.templates.submit(projectSlug, action.templateId, { session }, signalOptions);
+                    return json({ template: responseData(response) });
+                }
+                case "delete":
+                    await options.templates.delete(projectSlug, action.templateId, signalOptions);
+                    return json({ deleted: true });
+            }
+        }
+        catch (error) {
+            if (error instanceof RouteInputError) {
+                return jsonError(400, error.code, error.message);
+            }
+            return jsonError(500, "template_action_failed", "Unable to complete the template action.");
+        }
+    };
+}
+async function readAction(request) {
+    let value;
+    try {
+        value = await request.json();
+    }
+    catch {
+        throw new RouteInputError("invalid_json", "A JSON request body is required.");
+    }
+    if (!isRecord(value) || typeof value.action !== "string") {
+        throw new RouteInputError("invalid_action", "A template action is required.");
+    }
+    if (value.action === "list")
+        return { action: "list" };
+    if (value.action === "save") {
+        const draft = readDraft(value.draft);
+        const templateId = optionalString(value.templateId, "template_id_invalid");
+        return {
+            action: "save",
+            draft,
+            ...(templateId === undefined ? {} : { templateId }),
+        };
+    }
+    if (value.action !== "load" &&
+        value.action !== "preview" &&
+        value.action !== "submit" &&
+        value.action !== "delete") {
+        throw new RouteInputError("invalid_action", "Unknown template action.");
+    }
+    const templateId = requireString(value.templateId, "template_id_required");
+    if (value.action === "preview") {
+        return {
+            action: "preview",
+            templateId,
+            ...(value.values === undefined
+                ? {}
+                : { values: readValues(value.values) }),
+            ...(value.surface === undefined
+                ? {}
+                : { surface: readSurface(value.surface) }),
+        };
+    }
+    return { action: value.action, templateId };
+}
+function readDraft(value) {
+    if (!isRecord(value)) {
+        throw new RouteInputError("draft_required", "A template draft is required.");
+    }
+    const name = requireString(value.name, "template_name_required");
+    if (!isRecord(value.definition)) {
+        throw new RouteInputError("template_definition_required", "A template definition is required.");
+    }
+    return {
+        name,
+        definition: value.definition,
+        ...(value.sampleValues === undefined
+            ? {}
+            : { sampleValues: readValues(value.sampleValues) }),
+    };
+}
+function readValues(value) {
+    if (!isRecord(value) ||
+        Object.values(value).some((item) => typeof item !== "string")) {
+        throw new RouteInputError("template_values_invalid", "Template values must be strings.");
+    }
+    return value;
+}
+function readSurface(value) {
+    if (value !== "cloud" && value !== "whatsmeow" && value !== "sandbox") {
+        throw new RouteInputError("template_surface_invalid", "Unknown template surface.");
+    }
+    return value;
+}
+function responseData(response) {
+    if (!response?.data?.success || response.data.data === undefined) {
+        throw new TypeError("The server SDK returned an invalid template response.");
+    }
+    return response.data.data;
+}
+function validateOptions(options) {
+    if (typeof options.authorize !== "function" ||
+        typeof options.resolveProjectSlug !== "function" ||
+        typeof options.resolveSubmissionSession !== "function" ||
+        typeof options.templates?.create !== "function" ||
+        typeof options.templates?.retrieve !== "function" ||
+        typeof options.templates?.update !== "function" ||
+        typeof options.templates?.delete !== "function" ||
+        typeof options.templates?.preview !== "function" ||
+        typeof options.templates?.submit !== "function") {
+        throw new TypeError("Template route options are incomplete.");
+    }
+}
+function requireString(value, code) {
+    if (typeof value !== "string" || value.trim().length === 0) {
+        throw new RouteInputError(code, "A non-empty string is required.");
+    }
+    return value;
+}
+function optionalString(value, code) {
+    return value === undefined ? undefined : requireString(value, code);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+const privateHeaders = {
+    "Cache-Control": "no-store, private",
+    Vary: "Cookie, Authorization",
+};
+function json(value) {
+    return Response.json(value, { status: 200, headers: privateHeaders });
+}
+function jsonError(status, code, message, headers = {}) {
+    return Response.json({ error: { code, message } }, { status, headers: { ...privateHeaders, ...headers } });
+}
+class RouteInputError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}

package/dist/token-route.d.ts

@@ -0,0 +1,19 @@
+export interface ClientTokenSubject {
+    readonly userId: string;
+    readonly projectId?: string;
+    readonly organizationId?: string;
+}
+export interface ClientTokenClaims {
+    readonly value: string;
+    readonly audience: "browser";
+    readonly expiresAt: number;
+    readonly scopes?: readonly string[];
+}
+export type ClientTokenMint = (subject: ClientTokenSubject, request: Request) => Promise<ClientTokenClaims>;
+export interface ClientTokenRouteOptions {
+    readonly mint: ClientTokenMint;
+    readonly authorize: (request: Request) => Promise<ClientTokenSubject | null> | ClientTokenSubject | null;
+}
+/** Creates a Next.js App Router-compatible POST route without importing Next.js. */
+export declare function createClientTokenRoute(options: ClientTokenRouteOptions): (request: Request) => Promise<Response>;
+//# sourceMappingURL=token-route.d.ts.map

package/dist/token-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-route.d.ts","sourceRoot":"","sources":["../src/token-route.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,MAAM,eAAe,GAAG,CAC5B,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEhC,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,CAClB,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,GAAG,kBAAkB,GAAG,IAAI,CAAC;CACrE;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CA2CzC"}

package/dist/token-route.js

@@ -0,0 +1,60 @@
+/** Creates a Next.js App Router-compatible POST route without importing Next.js. */
+export function createClientTokenRoute(options) {
+    if (typeof options.authorize !== "function" ||
+        typeof options.mint !== "function") {
+        throw new TypeError("authorize and mint must be functions.");
+    }
+    return async (request) => {
+        if (request.method !== "POST") {
+            return jsonError(405, "method_not_allowed", "Use POST to mint a client token.", {
+                Allow: "POST",
+            });
+        }
+        try {
+            const subject = await options.authorize(request);
+            if (subject === null) {
+                return jsonError(401, "unauthorized", "Authentication is required.");
+            }
+            validateSubject(subject);
+            const token = await options.mint(subject, request);
+            validateToken(token);
+            return Response.json(token, {
+                status: 200,
+                headers: privateHeaders,
+            });
+        }
+        catch (error) {
+            if (error instanceof RouteInputError) {
+                return jsonError(400, error.code, error.message);
+            }
+            return jsonError(500, "token_mint_failed", "Unable to mint a client token.");
+        }
+    };
+}
+const privateHeaders = {
+    "Cache-Control": "no-store, private",
+    Vary: "Cookie, Authorization",
+};
+function jsonError(status, code, message, headers = {}) {
+    return Response.json({ error: { code, message } }, { status, headers: { ...privateHeaders, ...headers } });
+}
+function validateSubject(subject) {
+    if (typeof subject.userId !== "string" || subject.userId.length === 0) {
+        throw new RouteInputError("invalid_subject", "userId is required.");
+    }
+}
+function validateToken(token) {
+    if (!token.value.startsWith("pmfa_ct_") || token.audience !== "browser") {
+        throw new RouteInputError("invalid_client_token", "Mint returned an invalid client token.");
+    }
+    if (!Number.isFinite(token.expiresAt) || token.expiresAt <= Date.now()) {
+        throw new RouteInputError("invalid_client_token", "Mint returned an expired client token.");
+    }
+}
+class RouteInputError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}

package/dist/webhook.d.ts

@@ -0,0 +1,10 @@
+export type WebhookConstructor<TEvent> = (rawBody: ArrayBuffer, signature: string, secret: string) => Promise<TEvent>;
+export interface WebhookRequestOptions<TEvent> {
+    /** Pass `constructWebhookEvent` from `@polymorfa/sdk`. */
+    readonly constructEvent: WebhookConstructor<TEvent>;
+    readonly secret: string;
+    readonly signatureHeader?: string;
+}
+/** Reads the raw body exactly once, then delegates signature verification and parsing to the server SDK. */
+export declare function readVerifiedWebhook<TEvent>(request: Request, options: WebhookRequestOptions<TEvent>): Promise<TEvent>;
+//# sourceMappingURL=webhook.d.ts.map

package/dist/webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../src/webhook.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,CAAC,MAAM,IAAI,CACvC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC,MAAM,CAAC,CAAC;AAErB,MAAM,WAAW,qBAAqB,CAAC,MAAM;IAC3C,0DAA0D;IAC1D,QAAQ,CAAC,cAAc,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,4GAA4G;AAC5G,wBAAsB,mBAAmB,CAAC,MAAM,EAC9C,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,GACrC,OAAO,CAAC,MAAM,CAAC,CAcjB"}

package/dist/webhook.js

@@ -0,0 +1,16 @@
+/** Reads the raw body exactly once, then delegates signature verification and parsing to the server SDK. */
+export async function readVerifiedWebhook(request, options) {
+    if (request.bodyUsed) {
+        throw new TypeError("Webhook request body has already been consumed.");
+    }
+    if (options.secret.length === 0) {
+        throw new TypeError("Webhook secret must not be empty.");
+    }
+    const headerName = options.signatureHeader ?? "x-webhook-signature";
+    const signature = request.headers.get(headerName);
+    if (signature === null || signature.length === 0) {
+        throw new TypeError(`Missing webhook signature header: ${headerName}.`);
+    }
+    const rawBody = await request.arrayBuffer();
+    return options.constructEvent(rawBody, signature, options.secret);
+}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@polymorfa/nextjs",
+  "version": "0.1.0-dev.20260922094209",
+  "description": "Server-only helpers for Polymorfa: one catch-all handler for Next.js, Express and Hono, client tokens, webhooks and media",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/polymorfa/sdks.git",
+    "directory": "packages/nextjs"
+  },
+  "bugs": {
+    "url": "https://github.com/polymorfa/sdks/issues"
+  },
+  "homepage": "https://github.com/polymorfa/sdks#readme",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./express": {
+      "types": "./dist/express.d.ts",
+      "import": "./dist/express.js"
+    },
+    "./hono": {
+      "types": "./dist/hono.d.ts",
+      "import": "./dist/hono.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "peerDependencies": {
+    "@polymorfa/sdk": "0.1.0-dev.20260922094209"
+  },
+  "peerDependenciesMeta": {
+    "@polymorfa/sdk": {
+      "optional": true
+    }
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
+}