@apteva/web-sdk 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,14 @@
+# Changelog
+
+## 0.1.0 — 2026-05-13
+
+Initial release.
+
+- `ApteveClient` — base client with session-cookie + Bearer + `?api_key=` auth carriers, `credentials: include` for cross-origin cookie flow, configurable timeout, `onUnauthorized` hook.
+- `client.auth` namespace — `register`, `login`, `logout`, `me`, `status`, `changePassword`, `listKeys`, `createKey`, `deleteKey`.
+- `client.app(name)` — typed handle for any installed app: `get/post/put/patch/del` for HTTP routes + `tool(name, args)` for MCP calls. Generic type parameter for response shape.
+- `unwrapMCP` — exposed standalone for callers that want to handle the JSON-RPC envelope themselves.
+- Window helpers — `readAptevaInjection`, `pickKioskKey`, `pickBaseURL` for UIs hosted as static apps on apteva-server itself.
+- `client.sseURL` + `client.app(...).mcpURL` builders for `EventSource` / `<iframe>` / external clients that can't go through `fetch`.
+- `ApteveError` with `.status`, `.body`, `.code`, `.isUnauthorized()`, `.isNotFound()`.
+- 43 tests covering carriers, auth, app HTTP/MCP, envelope unwrap, window helpers.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Apteva
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,143 @@
+# @apteva/web-sdk
+
+Browser SDK for calling [apteva-server](https://github.com/apteva/server). Framework-agnostic. ~3 KB minified + gzipped.
+
+- **Auth** — session cookies, `Authorization: Bearer`, `X-API-Key`, `?api_key=` query — pick any, the SDK handles them.
+- **App data** — `client.app("crm").get("/contacts")` reverse-proxies through `/api/apps/<name>/*`.
+- **App tools** — `client.app("crm").tool("contacts_search", {…})` posts an MCP `tools/call`, unwraps the JSON-RPC envelope, returns the tool's natural shape.
+- **Static-app mode** — when the UI is hosted by apteva-server itself (`runtime.kind: static`), `pickBaseURL` and `pickKioskKey` read the `<script>window.__APTEVA_APP__</script>` block the server injects.
+
+## Install
+
+```sh
+bun add @apteva/web-sdk
+# or
+npm install @apteva/web-sdk
+```
+
+## Quick start
+
+```ts
+import { ApteveClient } from "@apteva/web-sdk";
+
+const apteva = new ApteveClient({
+  baseURL: "https://agents.example.com",
+  // Optional. Omit to rely on the session cookie (after auth.login).
+  apiKey: process.env.NEXT_PUBLIC_APTEVA_KEY,
+});
+
+// Sign in (sets the session cookie on the apteva-server domain).
+const me = await apteva.auth.login("you@example.com", "hunter2");
+
+// Read from any installed app's HTTP routes.
+const health = await apteva.app("flexylead").get("/healthz");
+
+// Call an MCP tool — the envelope is unwrapped for you.
+type Lead = { id: number; name: string; status: string };
+const { leads } = await apteva.app("flexylead").tool<{ leads: Lead[] }>(
+  "leads_list",
+  { limit: 25 },
+);
+```
+
+## Auth carriers
+
+The SDK sends `credentials: "include"` on every request, so a session cookie set by `auth.login` flows automatically — same-origin always, cross-origin when the apteva-server's `CORS_ORIGIN` allowlists your domain (the default `permissive` mode echoes any origin).
+
+You can layer on an API key by setting `apiKey` in the constructor or calling `client.setApiKey(...)` at runtime. Bearer-wins-over-cookie on the wire.
+
+```ts
+const apteva = new ApteveClient({
+  baseURL: "...",
+  apiKey: "sk-...",     // optional
+  onUnauthorized: () => router.push("/login"),  // fires once per 401
+  timeoutMs: 30_000,    // default, 0 disables
+});
+```
+
+## App HTTP routes
+
+`client.app(name)` returns a handle with `get / post / put / patch / del` that route to `/api/apps/<name>/<path>`. Same auth, same proxy, same error model.
+
+```ts
+await apteva.app("storage").post("/upload", { ... });
+const file = await apteva.app("storage").get<File>("/files/42");
+```
+
+## MCP tools
+
+`client.app(name).tool(toolName, args)` does the round-trip through `/api/apps/<name>/mcp`:
+
+```ts
+const result = await apteva.app("tables").tool<{ rows: Row[]; total: number }>(
+  "rows_search",
+  { table: "leads", limit: 50 },
+);
+```
+
+If the MCP call returns a JSON-RPC error, the SDK throws `ApteveError(-1, message, code)` — same `catch` block as HTTP errors.
+
+For lower-level usage, `client.callTool(appName, toolName, args)` and the standalone `unwrapMCP(envelope)` are both exported.
+
+## Error handling
+
+Every non-2xx response and every MCP error throws an `ApteveError`:
+
+```ts
+try {
+  await apteva.app("crm").tool("contacts_get", { id: 999 });
+} catch (err) {
+  if (err instanceof ApteveError) {
+    if (err.isUnauthorized()) ...      // 401
+    if (err.isNotFound()) ...          // 404
+    if (err.status === -1) ...         // MCP-level error
+    console.error(err.body);
+  }
+}
+```
+
+Network failures (no DNS, refused connection) surface as `ApteveError(0, "...")`. Timeouts surface as `ApteveError(0, "request timeout after Xms")`.
+
+## Hosted on apteva-server itself
+
+If your UI is installed as a `runtime.kind: static` app, apteva-server injects a config block. The SDK picks it up:
+
+```ts
+import { ApteveClient, pickBaseURL, pickKioskKey } from "@apteva/web-sdk";
+
+const apteva = new ApteveClient({
+  baseURL: pickBaseURL(),     // window.__APTEVA_APP__.api_base
+  apiKey:  pickKioskKey(),    // ?api_key=... > install config > undefined
+});
+```
+
+The same code also works fine when hosted externally (Vercel, etc.) — `pickBaseURL` returns `""` (same-origin) when nothing is injected, and `pickKioskKey` returns `undefined` (fall back to cookie auth).
+
+## SSE / EventSource
+
+Browsers can't set headers on `EventSource`, so an API key has to ride as `?api_key=`. The SDK has a helper:
+
+```ts
+const url = apteva.sseURL("/api/events", { project_id: "abc" });
+// → https://agents.example.com/api/events?project_id=abc&api_key=sk-...
+new EventSource(url);
+```
+
+## TypeScript
+
+Ships `.d.ts` types. `client.app<DefaultShape>(name).get<R>(path)` lets you type either per-call or per-app.
+
+## Example
+
+A complete React 19 + Tailwind v4 dashboard that signs in, reads leads from the Tables app, and browses arbitrary tables lives in [`examples/dashboard/`](./examples/dashboard) in the repo. Run with:
+
+```sh
+cd examples/dashboard
+bun install
+API_BASE=http://localhost:5280 bun run build
+bun run serve
+```
+
+## License
+
+MIT

package/dist/client.d.ts

@@ -0,0 +1,52 @@
+import type { ApteveClientOptions, AuthStatus, MCPCallResponse, User } from "./types.js";
+export declare class ApteveClient {
+    private readonly baseURL;
+    private apiKey?;
+    private readonly fetchImpl;
+    private readonly onUnauthorized?;
+    private readonly timeoutMs;
+    constructor(opts: ApteveClientOptions);
+    setApiKey(key: string | undefined): void;
+    getApiKey(): string | undefined;
+    readonly auth: {
+        register: (email: string, password: string, name?: string) => Promise<{
+            user: User;
+        }>;
+        login: (email: string, password: string) => Promise<User>;
+        logout: () => Promise<void>;
+        me: () => Promise<User>;
+        status: () => Promise<AuthStatus>;
+        changePassword: (current: string, next: string) => Promise<void>;
+        listKeys: () => Promise<{
+            id: number;
+            name: string;
+            created_at: string;
+        }[]>;
+        createKey: (name: string) => Promise<{
+            id: number;
+            key: string;
+        }>;
+        deleteKey: (id: number) => Promise<void>;
+    };
+    app<T = unknown>(name: string): AppHandle<T>;
+    callTool<R>(appName: string, toolName: string, args: Record<string, unknown>): Promise<R>;
+    get<R>(path: string, init?: RequestInit): Promise<R>;
+    post<R>(path: string, body?: unknown, init?: RequestInit): Promise<R>;
+    put<R>(path: string, body?: unknown, init?: RequestInit): Promise<R>;
+    patch<R>(path: string, body?: unknown, init?: RequestInit): Promise<R>;
+    del<R>(path: string, init?: RequestInit): Promise<R>;
+    sseURL(path: string, params?: Record<string, string | number | undefined>): string;
+    private request;
+}
+export declare function unwrapMCP<R>(env: MCPCallResponse<unknown>): R;
+export interface AppHandle<TDefault = unknown> {
+    readonly name: string;
+    get<R = TDefault>(path: string): Promise<R>;
+    post<R = TDefault>(path: string, body?: unknown): Promise<R>;
+    put<R = TDefault>(path: string, body?: unknown): Promise<R>;
+    patch<R = TDefault>(path: string, body?: unknown): Promise<R>;
+    del<R = TDefault>(path: string): Promise<R>;
+    tool<R = TDefault>(name: string, args?: Record<string, unknown>): Promise<R>;
+    mcpURL(queryParams?: Record<string, string>): string;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,mBAAmB,EACnB,UAAU,EACV,eAAe,EACf,IAAI,EACL,MAAM,YAAY,CAAC;AAIpB,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAa;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,IAAI,EAAE,mBAAmB;IAUrC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAIxC,SAAS,IAAI,MAAM,GAAG,SAAS;IAO/B,QAAQ,CAAC,IAAI;0BACO,MAAM,YAAY,MAAM,SAAS,MAAM;kBACrC,IAAI;;uBAET,MAAM,YAAY,MAAM;;;;kCASb,MAAM,QAAQ,MAAM;;gBAIvB,MAAM;kBAAQ,MAAM;wBAAc,MAAM;;0BAI7C,MAAM;gBACN,MAAM;iBAAO,MAAM;;wBAErB,MAAM;MACtB;IAOF,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IA4BtC,QAAQ,CAAC,CAAC,EACd,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,CAAC,CAAC;IAeb,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;IAGpD,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;IAGrE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;IAGpE,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;IAGtE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;IAOpD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM;YAepE,OAAO;CAyDtB;AAgBD,wBAAgB,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAgB7D;AAED,MAAM,WAAW,SAAS,CAAC,QAAQ,GAAG,OAAO;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7D,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5D,KAAK,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9D,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;CACtD"}

package/dist/client.js

@@ -0,0 +1,194 @@
+import { ApteveError } from "./errors.js";
+const DEFAULT_TIMEOUT_MS = 30_000;
+export class ApteveClient {
+    baseURL;
+    apiKey;
+    fetchImpl;
+    onUnauthorized;
+    timeoutMs;
+    constructor(opts) {
+        this.baseURL = opts.baseURL.replace(/\/+$/, "");
+        this.apiKey = opts.apiKey;
+        this.fetchImpl = opts.fetch ?? globalThis.fetch.bind(globalThis);
+        this.onUnauthorized = opts.onUnauthorized;
+        this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    }
+    // Swap the API key at runtime (e.g. after the user mints a fresh
+    // one in settings). Pass undefined to fall back to cookie auth.
+    setApiKey(key) {
+        this.apiKey = key;
+    }
+    getApiKey() {
+        return this.apiKey;
+    }
+    // Auth surface. Maps 1:1 onto /api/auth/*. login() sets a cookie
+    // on the server side that subsequent requests pick up automatically
+    // when credentials: "include" is sent.
+    auth = {
+        register: (email, password, name) => this.post("/api/auth/register", { email, password, name }),
+        login: (email, password) => this.post("/api/auth/login", { email, password }),
+        logout: () => this.post("/api/auth/logout", {}),
+        me: () => this.get("/api/auth/me"),
+        status: () => this.get("/api/auth/status"),
+        changePassword: (current, next) => this.post("/api/auth/password", { current, next }),
+        listKeys: () => this.get("/api/auth/keys"),
+        createKey: (name) => this.post("/api/auth/keys", { name }),
+        deleteKey: (id) => this.del(`/api/auth/keys/${id}`),
+    };
+    // Build a handle for one installed app. The returned object knows
+    // both the HTTP route surface (/api/apps/<name>/<route>) and the
+    // MCP tool surface (/api/apps/<name>/mcp). T is the default return
+    // type for typed route helpers — defaults to unknown so callers
+    // either pass a per-call generic or stick to `unknown`.
+    app(name) {
+        const base = `/api/apps/${encodeURIComponent(name)}`;
+        return {
+            name,
+            get: (path) => this.get(base + path),
+            post: (path, body) => this.post(base + path, body),
+            put: (path, body) => this.put(base + path, body),
+            patch: (path, body) => this.patch(base + path, body),
+            del: (path) => this.del(base + path),
+            tool: (toolName, args = {}) => this.callTool(name, toolName, args),
+            mcpURL: (queryParams) => {
+                const u = new URL(this.baseURL + base + "/mcp", "http://_");
+                if (queryParams) {
+                    for (const [k, v] of Object.entries(queryParams)) {
+                        u.searchParams.set(k, v);
+                    }
+                }
+                return this.baseURL ? this.baseURL + u.pathname + u.search : u.pathname + u.search;
+            },
+        };
+    }
+    // Lower-level direct MCP call. Most callers should use
+    // client.app("name").tool("name", args) which routes through this.
+    async callTool(appName, toolName, args) {
+        const path = `/api/apps/${encodeURIComponent(appName)}/mcp`;
+        const body = {
+            jsonrpc: "2.0",
+            id: 1,
+            method: "tools/call",
+            params: { name: toolName, arguments: args },
+        };
+        const env = await this.post(path, body);
+        return unwrapMCP(env);
+    }
+    // --- raw HTTP helpers (exposed so consumers can hit endpoints the
+    // SDK doesn't yet wrap) ---
+    get(path, init) {
+        return this.request("GET", path, undefined, init);
+    }
+    post(path, body, init) {
+        return this.request("POST", path, body, init);
+    }
+    put(path, body, init) {
+        return this.request("PUT", path, body, init);
+    }
+    patch(path, body, init) {
+        return this.request("PATCH", path, body, init);
+    }
+    del(path, init) {
+        return this.request("DELETE", path, undefined, init);
+    }
+    // Build a fully-qualified URL for an SSE endpoint (EventSource can't
+    // send custom headers, so an API key has to ride as ?api_key=).
+    // Cookie auth works on same-origin without query-string fallback.
+    sseURL(path, params) {
+        const url = new URL(this.baseURL + path, "http://_");
+        if (params) {
+            for (const [k, v] of Object.entries(params)) {
+                if (v !== undefined && v !== "")
+                    url.searchParams.set(k, String(v));
+            }
+        }
+        if (this.apiKey && !url.searchParams.has("api_key")) {
+            url.searchParams.set("api_key", this.apiKey);
+        }
+        return this.baseURL ? this.baseURL + url.pathname + url.search : url.pathname + url.search;
+    }
+    // --- internals ---
+    async request(method, path, body, init) {
+        const url = this.baseURL + path;
+        const headers = new Headers(init?.headers);
+        if (!headers.has("Accept"))
+            headers.set("Accept", "application/json");
+        if (body !== undefined && !headers.has("Content-Type")) {
+            headers.set("Content-Type", "application/json");
+        }
+        if (this.apiKey && !headers.has("Authorization")) {
+            headers.set("Authorization", `Bearer ${this.apiKey}`);
+        }
+        const ac = this.timeoutMs > 0 ? new AbortController() : undefined;
+        const timer = ac
+            ? setTimeout(() => ac.abort(), this.timeoutMs)
+            : undefined;
+        let res;
+        try {
+            res = await this.fetchImpl(url, {
+                method,
+                credentials: "include",
+                ...init,
+                headers,
+                body: body === undefined ? init?.body : JSON.stringify(body),
+                signal: ac?.signal ?? init?.signal,
+            });
+        }
+        catch (err) {
+            if (timer)
+                clearTimeout(timer);
+            if (err instanceof Error && err.name === "AbortError") {
+                throw new ApteveError(0, `request timeout after ${this.timeoutMs}ms`);
+            }
+            throw new ApteveError(0, err instanceof Error ? err.message : String(err));
+        }
+        if (timer)
+            clearTimeout(timer);
+        if (res.status === 401) {
+            this.onUnauthorized?.();
+            const text = await readBody(res);
+            throw new ApteveError(401, text || "unauthorized");
+        }
+        if (!res.ok) {
+            const text = await readBody(res);
+            throw new ApteveError(res.status, text || res.statusText);
+        }
+        const ct = res.headers.get("Content-Type") ?? "";
+        if (res.status === 204)
+            return undefined;
+        if (ct.includes("application/json")) {
+            return (await res.json());
+        }
+        return (await res.text());
+    }
+}
+async function readBody(res) {
+    try {
+        return await res.text();
+    }
+    catch {
+        return "";
+    }
+}
+// Strip the MCP JSON-RPC envelope so callers see the tool's natural
+// return shape. Mirrors app-sdk/caller.go::CallAppResult. Three cases:
+//   1. envelope.error  → throw ApteveError(-1, message, code)
+//   2. envelope.result.content[0].text  → JSON.parse(text), return it
+//   3. envelope has neither (the platform already short-circuited an
+//      unwrapped response) → cast and return
+export function unwrapMCP(env) {
+    if (env && env.error) {
+        throw new ApteveError(-1, env.error.message, env.error.code);
+    }
+    const text = env?.result?.content?.[0]?.text;
+    if (typeof text !== "string") {
+        return env;
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch (err) {
+        throw new ApteveError(-1, `MCP response was not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAQ1C,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,OAAO,YAAY;IACN,OAAO,CAAS;IACzB,MAAM,CAAU;IACP,SAAS,CAAe;IACxB,cAAc,CAAc;IAC5B,SAAS,CAAS;IAEnC,YAAY,IAAyB;QACnC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACxD,CAAC;IAED,iEAAiE;IACjE,gEAAgE;IAChE,SAAS,CAAC,GAAuB;QAC/B,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC;IACpB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,iEAAiE;IACjE,oEAAoE;IACpE,uCAAuC;IAC9B,IAAI,GAAG;QACd,QAAQ,EAAE,CAAC,KAAa,EAAE,QAAgB,EAAE,IAAa,EAAE,EAAE,CAC3D,IAAI,CAAC,IAAI,CAAiB,oBAAoB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAE5E,KAAK,EAAE,CAAC,KAAa,EAAE,QAAgB,EAAE,EAAE,CACzC,IAAI,CAAC,IAAI,CAAO,iBAAiB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAEzD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAO,kBAAkB,EAAE,EAAE,CAAC;QAErD,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAO,cAAc,CAAC;QAExC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAa,kBAAkB,CAAC;QAEtD,cAAc,EAAE,CAAC,OAAe,EAAE,IAAY,EAAE,EAAE,CAChD,IAAI,CAAC,IAAI,CAAO,oBAAoB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAE1D,QAAQ,EAAE,GAAG,EAAE,CACb,IAAI,CAAC,GAAG,CACN,gBAAgB,CACjB;QAEH,SAAS,EAAE,CAAC,IAAY,EAAE,EAAE,CAC1B,IAAI,CAAC,IAAI,CAA8B,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC;QAEpE,SAAS,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAO,kBAAkB,EAAE,EAAE,CAAC;KAClE,CAAC;IAEF,kEAAkE;IAClE,iEAAiE;IACjE,mEAAmE;IACnE,gEAAgE;IAChE,wDAAwD;IACxD,GAAG,CAAc,IAAY;QAC3B,MAAM,IAAI,GAAG,aAAa,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,OAAO;YACL,IAAI;YACJ,GAAG,EAAE,CAAQ,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAI,IAAI,GAAG,IAAI,CAAC;YACtD,IAAI,EAAE,CAAQ,IAAY,EAAE,IAAc,EAAE,EAAE,CAC5C,IAAI,CAAC,IAAI,CAAI,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;YACjC,GAAG,EAAE,CAAQ,IAAY,EAAE,IAAc,EAAE,EAAE,CAC3C,IAAI,CAAC,GAAG,CAAI,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;YAChC,KAAK,EAAE,CAAQ,IAAY,EAAE,IAAc,EAAE,EAAE,CAC7C,IAAI,CAAC,KAAK,CAAI,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;YAClC,GAAG,EAAE,CAAQ,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAI,IAAI,GAAG,IAAI,CAAC;YACtD,IAAI,EAAE,CAAQ,QAAgB,EAAE,OAAgC,EAAE,EAAE,EAAE,CACpE,IAAI,CAAC,QAAQ,CAAI,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC;YACxC,MAAM,EAAE,CAAC,WAAoC,EAAE,EAAE;gBAC/C,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,MAAM,EAAE,UAAU,CAAC,CAAC;gBAC5D,IAAI,WAAW,EAAE,CAAC;oBAChB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;wBACjD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;oBAC3B,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;YACrF,CAAC;SACF,CAAC;IACJ,CAAC;IAED,uDAAuD;IACvD,mEAAmE;IACnE,KAAK,CAAC,QAAQ,CACZ,OAAe,EACf,QAAgB,EAChB,IAA6B;QAE7B,MAAM,IAAI,GAAG,aAAa,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5D,MAAM,IAAI,GAAG;YACX,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,CAAC;YACL,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE;SACnC,CAAC;QACX,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAA2B,IAAI,EAAE,IAAI,CAAC,CAAC;QAClE,OAAO,SAAS,CAAI,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,mEAAmE;IACnE,4BAA4B;IAE5B,GAAG,CAAI,IAAY,EAAE,IAAkB;QACrC,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAI,IAAY,EAAE,IAAc,EAAE,IAAkB;QACtD,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,CAAC;IACD,GAAG,CAAI,IAAY,EAAE,IAAc,EAAE,IAAkB;QACrD,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,KAAK,CAAI,IAAY,EAAE,IAAc,EAAE,IAAkB;QACvD,OAAO,IAAI,CAAC,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,GAAG,CAAI,IAAY,EAAE,IAAkB;QACrC,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,qEAAqE;IACrE,gEAAgE;IAChE,kEAAkE;IAClE,MAAM,CAAC,IAAY,EAAE,MAAoD;QACvE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,UAAU,CAAC,CAAC;QACrD,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;oBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC;IAC7F,CAAC;IAED,oBAAoB;IAEZ,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,IAAa,EACb,IAAkB;QAElB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACtE,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAClE,MAAM,KAAK,GAAG,EAAE;YACd,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC;YAC9C,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;gBAC9B,MAAM;gBACN,WAAW,EAAE,SAAS;gBACtB,GAAG,IAAI;gBACP,OAAO;gBACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC5D,MAAM,EAAE,EAAE,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACtD,MAAM,IAAI,WAAW,CAAC,CAAC,EAAE,yBAAyB,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,IAAI,WAAW,CAAC,CAAC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAE/B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,IAAI,cAAc,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,IAAI,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;QACjC,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiB,CAAC;IAC5C,CAAC;CACF;AAED,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,uEAAuE;AACvE,8DAA8D;AAC9D,sEAAsE;AACtE,qEAAqE;AACrE,6CAA6C;AAC7C,MAAM,UAAU,SAAS,CAAI,GAA6B;IACxD,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAC7C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,GAAmB,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CACnB,CAAC,CAAC,EACF,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,9 @@
+export declare class ApteveError extends Error {
+    status: number;
+    body: string;
+    code?: number;
+    constructor(status: number, body: string, code?: number);
+    isUnauthorized(): boolean;
+    isNotFound(): boolean;
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAKA,qBAAa,WAAY,SAAQ,KAAK;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;gBAEF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;IAQvD,cAAc,IAAI,OAAO;IAIzB,UAAU,IAAI,OAAO;CAGtB"}

package/dist/errors.js

@@ -0,0 +1,24 @@
+// Thrown for every non-2xx HTTP response and every MCP-level error
+// from /api/apps/<name>/mcp. status is the HTTP status (or 0 for
+// network/transport failures, or -1 for JSON-RPC errors that came
+// back inside a 200 envelope). body is the raw response body (text)
+// or the JSON-RPC error.message — whichever was available.
+export class ApteveError extends Error {
+    status;
+    body;
+    code;
+    constructor(status, body, code) {
+        super(`HTTP ${status}: ${body}`);
+        this.name = "ApteveError";
+        this.status = status;
+        this.body = body;
+        this.code = code;
+    }
+    isUnauthorized() {
+        return this.status === 401;
+    }
+    isNotFound() {
+        return this.status === 404;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,iEAAiE;AACjE,kEAAkE;AAClE,oEAAoE;AACpE,2DAA2D;AAC3D,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,MAAM,CAAS;IACf,IAAI,CAAS;IACb,IAAI,CAAU;IAEd,YAAY,MAAc,EAAE,IAAY,EAAE,IAAa;QACrD,KAAK,CAAC,QAAQ,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC;IAC7B,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC;IAC7B,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { ApteveClient, unwrapMCP } from "./client.js";
+export type { AppHandle } from "./client.js";
+export { ApteveError } from "./errors.js";
+export { readAptevaInjection, pickKioskKey, pickBaseURL, } from "./window.js";
+export type { ApteveClientOptions, AuthCarrier, AuthBranding, AuthStatus, AptevaAppInjection, MCPCallRequest, MCPCallResponse, User, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACtD,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,mBAAmB,EACnB,WAAW,EACX,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,IAAI,GACL,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export { ApteveClient, unwrapMCP } from "./client.js";
+export { ApteveError } from "./errors.js";
+export { readAptevaInjection, pickKioskKey, pickBaseURL, } from "./window.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,WAAW,GACZ,MAAM,aAAa,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,69 @@
+export interface User {
+    user_id?: number;
+    id?: number;
+    email?: string;
+    name?: string;
+    role?: string;
+    onboarding_complete?: boolean;
+}
+export interface AuthStatus {
+    authenticated: boolean;
+    user?: User;
+    needs_setup?: boolean;
+}
+export interface AuthBranding {
+    title_template?: string;
+    logo?: string;
+    theme_css?: string;
+}
+export interface AptevaAppInjection {
+    base?: string;
+    api_base?: string;
+    app_name?: string;
+    install_id?: number;
+    default_project?: string;
+    kiosk_api_key?: string;
+    branding?: AuthBranding;
+    installed_apps?: string[];
+}
+declare global {
+    interface Window {
+        __APTEVA_APP__?: AptevaAppInjection;
+        __API_BASE__?: string;
+        __DEFAULT_PROJECT__?: string;
+    }
+}
+export type AuthCarrier = "cookie" | "apiKey";
+export interface ApteveClientOptions {
+    baseURL: string;
+    apiKey?: string;
+    fetch?: typeof fetch;
+    onUnauthorized?: () => void;
+    timeoutMs?: number;
+}
+export interface MCPCallRequest {
+    jsonrpc: "2.0";
+    id: number | string;
+    method: "tools/call";
+    params: {
+        name: string;
+        arguments: Record<string, unknown>;
+    };
+}
+export interface MCPCallResponse<T = unknown> {
+    jsonrpc: "2.0";
+    id: number | string;
+    result?: {
+        content: Array<{
+            type: "text";
+            text: string;
+        }>;
+        isError?: boolean;
+    };
+    error?: {
+        code: number;
+        message: string;
+        data?: T;
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,IAAI;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAKD,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,MAAM;QACd,cAAc,CAAC,EAAE,kBAAkB,CAAC;QACpC,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B;CACF;AAMD,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE9C,MAAM,WAAW,mBAAmB;IAIlC,OAAO,EAAE,MAAM,CAAC;IAGhB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAIrB,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;IAE5B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,CAAC;CACH;AAED,MAAM,WAAW,eAAe,CAAC,CAAC,GAAG,OAAO;IAC1C,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE;QACP,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,CAAA;KAAE,CAAC;CACrD"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/window.d.ts

@@ -0,0 +1,5 @@
+import type { AptevaAppInjection } from "./types.js";
+export declare function readAptevaInjection(): AptevaAppInjection | undefined;
+export declare function pickKioskKey(fallback?: string): string | undefined;
+export declare function pickBaseURL(explicit?: string): string;
+//# sourceMappingURL=window.d.ts.map

package/dist/window.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"window.d.ts","sourceRoot":"","sources":["../src/window.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAQrD,wBAAgB,mBAAmB,IAAI,kBAAkB,GAAG,SAAS,CAGpE;AAQD,wBAAgB,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWlE;AAOD,wBAAgB,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAUrD"}

package/dist/window.js

@@ -0,0 +1,60 @@
+// Returns the apteva-server injection block if this UI is being served
+// as a static app on the platform itself (apps_static.go writes a
+// <script>window.__APTEVA_APP__ = …</script> into the served HTML).
+// Returns undefined in any other environment (Vercel-hosted UI, Node,
+// SSR pre-hydrate, jsdom without seeding). Safe to call during module
+// init — guards against `window` being absent.
+export function readAptevaInjection() {
+    if (typeof window === "undefined")
+        return undefined;
+    return window.__APTEVA_APP__;
+}
+// Picks the API key to authenticate with, in precedence order:
+//   1. ?api_key=… in the URL — shareable kiosk links override everything
+//   2. install-config kiosk_api_key from window.__APTEVA_APP__
+//   3. explicit fallback passed by the caller (e.g. process.env.X)
+// Returns undefined when none are set; the caller then falls back to
+// cookie auth.
+export function pickKioskKey(fallback) {
+    if (typeof window !== "undefined") {
+        try {
+            const url = new URL(window.location.href);
+            const k = url.searchParams.get("api_key");
+            if (k)
+                return k;
+        }
+        catch { }
+        const inj = window.__APTEVA_APP__;
+        if (inj?.kiosk_api_key)
+            return inj.kiosk_api_key;
+    }
+    return fallback;
+}
+// Resolves the base URL the client should hit. Precedence:
+//   1. explicit arg — caller wins
+//   2. window.__API_BASE__ — legacy injection still respected
+//   3. window.__APTEVA_APP__.api_base
+//   4. same-origin "" — fetch() falls back to the current document origin
+export function pickBaseURL(explicit) {
+    if (explicit)
+        return explicit;
+    if (typeof window !== "undefined") {
+        if (typeof window.__API_BASE__ === "string" && window.__API_BASE__) {
+            return originFromApiBase(window.__API_BASE__);
+        }
+        const inj = window.__APTEVA_APP__;
+        if (inj?.api_base)
+            return originFromApiBase(inj.api_base);
+    }
+    return "";
+}
+// __API_BASE__ is historically "/api"; the SDK adds /api itself, so we
+// strip a trailing /api so concatenation doesn't double-suffix.
+function originFromApiBase(s) {
+    if (s === "/api")
+        return "";
+    if (s.endsWith("/api"))
+        return s.slice(0, -4);
+    return s;
+}
+//# sourceMappingURL=window.js.map

package/dist/window.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"window.js","sourceRoot":"","sources":["../src/window.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,kEAAkE;AAClE,oEAAoE;AACpE,sEAAsE;AACtE,sEAAsE;AACtE,+CAA+C;AAC/C,MAAM,UAAU,mBAAmB;IACjC,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,MAAM,CAAC,cAAc,CAAC;AAC/B,CAAC;AAED,+DAA+D;AAC/D,yEAAyE;AACzE,+DAA+D;AAC/D,mEAAmE;AACnE,qEAAqE;AACrE,eAAe;AACf,MAAM,UAAU,YAAY,CAAC,QAAiB;IAC5C,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1C,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,CAAC;QAClC,IAAI,GAAG,EAAE,aAAa;YAAE,OAAO,GAAG,CAAC,aAAa,CAAC;IACnD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2DAA2D;AAC3D,kCAAkC;AAClC,8DAA8D;AAC9D,sCAAsC;AACtC,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,QAAiB;IAC3C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACnE,OAAO,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,CAAC;QAClC,IAAI,GAAG,EAAE,QAAQ;YAAE,OAAO,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,uEAAuE;AACvE,gEAAgE;AAChE,SAAS,iBAAiB,CAAC,CAAS;IAClC,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9C,OAAO,CAAC,CAAC;AACX,CAAC"}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@apteva/web-sdk",
+  "version": "0.1.0",
+  "description": "Browser SDK for apteva-server. Handles auth (session cookie + API key + ?api_key=), wraps the /api/apps/<name>/* HTTP and MCP proxy, normalizes the MCP JSON-RPC envelope, and surfaces window.__APTEVA_APP__ when the UI is hosted on apteva-server itself. Framework-agnostic.",
+  "license": "MIT",
+  "author": "Apteva",
+  "homepage": "https://github.com/apteva/web-sdk",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/apteva/web-sdk"
+  },
+  "bugs": {
+    "url": "https://github.com/apteva/web-sdk/issues"
+  },
+  "keywords": [
+    "apteva",
+    "sdk",
+    "mcp",
+    "agents",
+    "auth",
+    "browser"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "test": "bun test",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "bun run typecheck && bun test && bun run build"
+  },
+  "devDependencies": {
+    "@types/bun": "^1.1.0",
+    "typescript": "^5.4.0"
+  }
+}