feat(sdk): Frontend @gonext/sdk — slug detection, REST shims, Trusted Types

[tayebmokni]

Closes #214.

`@gonext/sdk`: the browser-side TS package plugin authors import.

• `getSlug()` auto-detects from the loading import-map URL
• `host.{posts,users,media,cache}` REST shims hit `/api/plugins/{slug}/...`
• `defineBlock()` forwards to BLOCK_REGISTRY
• `i18n` wrapper
• Trusted Types compatible
• tsup build: ESM + CJS + .d.ts

Surface

Export	Purpose
`getSlug() / setSlug() / SlugRequiredError`	Plugin identity — auto-detect from the loading import-map URL, with fallbacks to page `<script>` tags, a JSON context block, and `window.GN_PLUGIN_SLUG`.
`host.posts.{list,get}`	Read `/wp-json/wp/v2/posts`.
`host.users.{list,get,me}`	Read `/wp-json/wp/v2/users` (incl. `/users/me`).
`host.media.{list,get}`	Read `/wp-json/wp/v2/media`.
`host.cache.invalidate(tags)`	POST to `/api/plugins/{slug}/cache/invalidate`.
`HostFetchError`	Typed error with `status` + parsed `responseBody`.
`defineBlock(spec)`	Forwards to `GN_BLOCK_REGISTRY` (or legacy `BLOCK_REGISTRY`) when present, else captures for later drain.
`i18n.t(key, args)`	Translation lookup with `{placeholder}` interpolation.
`i18n.load(locale)`	Preload a catalogue.
`setHTML(el, html)`	Trusted-Types-safe `innerHTML` via the host's `gn-plugin` policy.

Build pipeline

`tsup` emits ESM (`dist/index.mjs`), CJS (`dist/index.cjs`), and rolled-up types (`dist/index.d.ts`). `sideEffects: false`, zero runtime dependencies — the SRI hash in the host's import map stays stable.

Tests

69 Vitest cases on jsdom, covering:

• Slug detection across all four strategies (script src, JSON context block, window global, override) + priority + memoization
• REST shim transport: header defaults (`Accept`, `Content-Type`), `credentials: include`, AbortSignal forwarding, 204 handling, error envelope parsing, camel→snake query mapping
• Trusted Types compat: installed factory routing, identity fallback, `createPolicy` refusal fallback
• Block registry: forward to global, fallback to legacy name, local capture + drain + replace, name validation
• i18n: catalogue cache reuse, in-flight promise sharing, malformed input filtering, missing-key fallback, missing-slug fallback

Files

• `packages/ts/sdk/src/` — 6 source modules + 5 test files
• `packages/ts/sdk/tsup.config.ts`, `tsconfig.json`, `vitest.config.ts`, `vitest.setup.ts`
• `packages/ts/sdk/README.md` — 10-line hello-world plus surface table
• `packages/ts/sdk/package.json` — proper `exports` map, `sideEffects: false`, MIT/Apache-2.0 license, types pointer

🤖 Generated with Claude Code

[github-actions]

Heads up — this PR touches strings that often signal a security disclosure (vulnerab, CVE-, exploit, bypass, or auth bypass).

If this PR fixes or describes a real vulnerability that has not yet been publicly disclosed, please stop and use the private path:

1. Open a private security advisory, or
2. Email security@gonext.io with subject [SECURITY] GoNext - <summary>.

See /SECURITY.md for the full disclosure flow and /docs/16-bug-bounty.md for bounty terms.

If this is a false positive (test fixture, doc update, release notes, etc.) please ignore this comment — the check is advisory only and does not block the PR.

Matched files:

• packages/ts/sdk/src/host.ts