@every-app/sdk 0.0.8 → 0.0.10

package/dist/cloudflare/getLocalD1Url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getLocalD1Url.d.ts","sourceRoot":"","sources":["../../src/cloudflare/getLocalD1Url.ts"],"names":[],"mappings":"AAWA,wBAAgB,aAAa,kBAoD5B"}

package/dist/cloudflare/index.d.ts

@@ -0,0 +1,2 @@
+export { lazyInitForWorkers } from "./lazyInit";
+//# sourceMappingURL=index.d.ts.map

package/dist/cloudflare/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC"}

package/dist/cloudflare/index.js

@@ -0,0 +1 @@
+export { lazyInitForWorkers } from "./lazyInit";

package/dist/{client/lazyInitForWorkers.d.ts → cloudflare/lazyInit.d.ts}

@@ -19,4 +19,4 @@
  * ```
  */
 export declare function lazyInitForWorkers<T extends object>(factory: () => T): T;
-//# sourceMappingURL=lazyInitForWorkers.d.ts.map
+//# sourceMappingURL=lazyInit.d.ts.map

package/dist/cloudflare/lazyInit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lazyInit.d.ts","sourceRoot":"","sources":["../../src/cloudflare/lazyInit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CA8CxE"}

package/dist/cloudflare/server/index.d.ts

@@ -0,0 +1,2 @@
+export { getLocalD1Url } from "../getLocalD1Url";
+//# sourceMappingURL=index.d.ts.map

package/dist/cloudflare/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cloudflare/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/cloudflare/server/index.js

@@ -0,0 +1 @@
+export { getLocalD1Url } from "../getLocalD1Url";

package/dist/core/authenticatedFetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticatedFetch.d.ts","sourceRoot":"","sources":["../../src/core/authenticatedFetch.ts"],"names":[],"mappings":"AAQA;;GAEG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CAevD;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,QAAQ,CAAC,CAUnB"}

package/dist/core/index.d.ts

@@ -0,0 +1,4 @@
+export { SessionManager, isRunningInIframe } from "./sessionManager";
+export type { SessionManagerConfig } from "./sessionManager";
+export { authenticatedFetch, getSessionToken } from "./authenticatedFetch";
+//# sourceMappingURL=index.d.ts.map

package/dist/core/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrE,YAAY,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/core/index.js

@@ -0,0 +1,2 @@
+export { SessionManager, isRunningInIframe } from "./sessionManager";
+export { authenticatedFetch, getSessionToken } from "./authenticatedFetch";

package/dist/{client/session-manager.d.ts → core/sessionManager.d.ts}

@@ -30,4 +30,4 @@ export declare class SessionManager {
         email: string;
     } | null;
 }
-//# sourceMappingURL=session-manager.d.ts.map
+//# sourceMappingURL=sessionManager.d.ts.map

package/dist/core/sessionManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionManager.d.ts","sourceRoot":"","sources":["../../src/core/sessionManager.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;CACf;AAMD;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAQ3C;AAED,qBAAa,cAAc;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAE7B,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,cAAc,CAAgC;gBAE1C,MAAM,EAAE,oBAAoB;IAqBxC,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,uBAAuB;IAuCzB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IA8ClC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;IAOjC,aAAa,IAAI;QACf,MAAM,EAAE,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,CAAC;QACxD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;KACtB;IAgBD;;;OAGG;IACH,OAAO,IAAI;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;CAwBpD"}

package/dist/{client → tanstack}/EmbeddedAppProvider.d.ts

@@ -1,5 +1,5 @@
 import React from "react";
-import { SessionManagerConfig } from "./session-manager";
+import { SessionManagerConfig } from "../core/sessionManager";
 interface EmbeddedProviderConfig extends SessionManagerConfig {
     children: React.ReactNode;
 }

package/dist/tanstack/EmbeddedAppProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmbeddedAppProvider.d.ts","sourceRoot":"","sources":["../../src/tanstack/EmbeddedAppProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA6C,MAAM,OAAO,CAAC;AAClE,OAAO,EAAkB,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAK9E,UAAU,sBAAuB,SAAQ,oBAAoB;IAC3D,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAUD,wBAAgB,mBAAmB,CAAC,EAClC,QAAQ,EACR,GAAG,MAAM,EACV,EAAE,sBAAsB,kDA6BxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,IAAI;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAmBzE"}

package/dist/{client → tanstack}/EmbeddedAppProvider.js

@@ -1,7 +1,7 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { createContext, useContext, useMemo } from "react";
 import { useEveryAppSession } from "./_internal/useEveryAppSession";
-import { useEveryAppRouter } from "./_internal/useEveryAppRouter";
+import { useEveryAppRouter } from "./useEveryAppRouter";
 import { GatewayRequiredError } from "./GatewayRequiredError";
 const EmbeddedAppContext = createContext(null);
 export function EmbeddedAppProvider({ children, ...config }) {

package/dist/tanstack/GatewayRequiredError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GatewayRequiredError.d.ts","sourceRoot":"","sources":["../../src/tanstack/GatewayRequiredError.tsx"],"names":[],"mappings":"AAEA,UAAU,yBAAyB;IACjC;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAmFD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,aAAa,EACb,KAAK,GACN,EAAE,yBAAyB,2CA6C3B"}

package/dist/{client → tanstack}/GatewayRequiredError.js

@@ -36,7 +36,7 @@ const styles = {
         colorScheme: "light dark",
     },
     content: {
-        maxWidth: "380px",
+        maxWidth: "520px",
         width: "100%",
         textAlign: "left",
     },
@@ -64,19 +64,17 @@ const styles = {
         color: "var(--gateway-text-muted, oklch(40% 0 0))",
         marginBottom: "20px",
     },
-    link: {
-        display: "inline-flex",
-        alignItems: "center",
-        gap: "8px",
+    urlText: {
         fontSize: "14px",
-        fontWeight: 500,
-        lineHeight: "24px",
+        lineHeight: 1.5,
+        color: "var(--gateway-text-muted, oklch(40% 0 0))",
+        wordBreak: "break-all",
+    },
+    urlLink: {
         color: "rgb(168, 162, 158)",
         textDecoration: "underline",
         textDecorationColor: "rgb(87, 83, 78)",
-        textUnderlineOffset: "4px",
-        cursor: "pointer",
-        transition: "color, background-color, border-color, text-decoration-color, fill, stroke 0.15s cubic-bezier(0.4, 0, 0.2, 1)",
+        textUnderlineOffset: "2px",
     },
 };
 /**
@@ -87,6 +85,7 @@ const styles = {
  * the app through the Gateway and provides a link to do so.
  */
 export function GatewayRequiredError({ gatewayOrigin, appId, }) {
-    const gatewayUrl = `${gatewayOrigin}/apps/${appId}${window.location.pathname}`;
-    return (_jsxs("div", { style: styles.container, children: [_jsx("style", { children: CSS_VARIABLES }), _jsxs("div", { style: styles.content, children: [_jsx("div", { style: styles.iconContainer, children: _jsxs("svg", { width: "22", height: "22", viewBox: "0 0 24 24", fill: "none", stroke: "var(--gateway-icon-stroke, oklch(55% 0.22 25))", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", children: [_jsx("path", { d: "M10.29 3.86L1.82 18a2 2 0 0 0 1.71 3h16.94a2 2 0 0 0 1.71-3L13.71 3.86a2 2 0 0 0-3.42 0z" }), _jsx("line", { x1: "12", y1: "9", x2: "12", y2: "13" }), _jsx("line", { x1: "12", y1: "17", x2: "12.01", y2: "17" })] }) }), _jsx("h1", { style: styles.title, children: "Open in Gateway" }), _jsx("p", { style: styles.description, children: "The Gateway handles sign in and user auth. Access your app from there so that this works properly." }), _jsxs("a", { href: gatewayUrl, style: styles.link, children: ["Go to Gateway", _jsxs("svg", { width: "16", height: "16", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", children: [_jsx("line", { x1: "5", y1: "12", x2: "19", y2: "12" }), _jsx("polyline", { points: "12 5 19 12 12 19" })] })] })] })] }));
+    const isLocalhost = window.location.hostname === "localhost";
+    const gatewayUrl = `${gatewayOrigin}/apps/${appId}${window.location.pathname}${isLocalhost ? "dev" : ""}`;
+    return (_jsxs("div", { style: styles.container, children: [_jsx("style", { children: CSS_VARIABLES }), _jsxs("div", { style: styles.content, children: [_jsx("div", { style: styles.iconContainer, children: _jsxs("svg", { width: "22", height: "22", viewBox: "0 0 24 24", fill: "none", stroke: "var(--gateway-icon-stroke, oklch(55% 0.22 25))", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", children: [_jsx("path", { d: "M10.29 3.86L1.82 18a2 2 0 0 0 1.71 3h16.94a2 2 0 0 0 1.71-3L13.71 3.86a2 2 0 0 0-3.42 0z" }), _jsx("line", { x1: "12", y1: "9", x2: "12", y2: "13" }), _jsx("line", { x1: "12", y1: "17", x2: "12.01", y2: "17" })] }) }), _jsx("h1", { style: styles.title, children: "Open in Gateway" }), _jsx("p", { style: styles.description, children: "The Gateway handles sign in and user auth. Access your app from there so this works properly." }), _jsxs("p", { style: styles.urlText, children: ["Go to", " ", _jsx("a", { href: gatewayUrl, style: styles.urlLink, children: gatewayUrl })] })] })] }));
 }

package/dist/{client → tanstack}/_internal/useEveryAppSession.d.ts

@@ -1,4 +1,4 @@
-import { SessionManager, SessionManagerConfig } from "../session-manager";
+import { SessionManager, SessionManagerConfig } from "../../core/sessionManager";
 interface UseEveryAppSessionParams {
     sessionManagerConfig: SessionManagerConfig;
 }

package/dist/tanstack/_internal/useEveryAppSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useEveryAppSession.d.ts","sourceRoot":"","sources":["../../../src/tanstack/_internal/useEveryAppSession.tsx"],"names":[],"mappings":"AACA,OAAO,EACL,cAAc,EACd,oBAAoB,EACrB,MAAM,2BAA2B,CAAC;AAEnC,UAAU,wBAAwB;IAChC,oBAAoB,EAAE,oBAAoB,CAAC;CAC5C;AAED,wBAAgB,kBAAkB,CAAC,EACjC,oBAAoB,GACrB,EAAE,wBAAwB;;;;;;EAyC1B"}

package/dist/{client → tanstack}/_internal/useEveryAppSession.js

@@ -1,5 +1,5 @@
 import { useEffect, useRef, useState } from "react";
-import { SessionManager } from "../session-manager";
+import { SessionManager, } from "../../core/sessionManager";
 export function useEveryAppSession({ sessionManagerConfig, }) {
     const sessionManagerRef = useRef(null);
     const [sessionTokenState, setSessionTokenState] = useState({

package/dist/tanstack/index.d.ts

@@ -0,0 +1,4 @@
+export { useSessionTokenClientMiddleware } from "./useSessionTokenClientMiddleware";
+export { useEveryAppRouter } from "./useEveryAppRouter";
+export { EmbeddedAppProvider, useCurrentUser } from "./EmbeddedAppProvider";
+//# sourceMappingURL=index.d.ts.map

package/dist/tanstack/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tanstack/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/tanstack/index.js

@@ -0,0 +1,3 @@
+export { useSessionTokenClientMiddleware } from "./useSessionTokenClientMiddleware";
+export { useEveryAppRouter } from "./useEveryAppRouter";
+export { EmbeddedAppProvider, useCurrentUser } from "./EmbeddedAppProvider";

package/dist/{server/auth-config.d.ts → tanstack/server/authConfig.d.ts}

@@ -1,3 +1,3 @@
 import type { AuthConfig } from "./types";
 export declare function getAuthConfig(): AuthConfig;
-//# sourceMappingURL=auth-config.d.ts.map
+//# sourceMappingURL=authConfig.d.ts.map

package/dist/tanstack/server/authConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authConfig.d.ts","sourceRoot":"","sources":["../../../src/tanstack/server/authConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,wBAAgB,aAAa,IAAI,UAAU,CAK1C"}

package/dist/{server → tanstack/server}/authenticateRequest.d.ts

@@ -1,12 +1,20 @@
 import type { AuthConfig } from "./types";
+/**
+ * JWT payload structure for embedded app session tokens.
+ * Contains minimal claims for security - only what's needed for authentication.
+ */
 interface SessionTokenPayload {
+    /** User ID (subject claim) */
     sub: string;
+    /** Gateway URL (issuer claim) */
     iss: string;
+    /** App ID (audience claim) - scopes token to specific app */
     aud: string;
+    /** Expiration timestamp */
     exp: number;
+    /** Issued at timestamp */
     iat: number;
-    appId?: string;
-    permissions?: string[];
+    /** User email - used for user provisioning in apps */
     email?: string;
 }
 export declare function authenticateRequest(authConfig: AuthConfig, providedRequest?: Request): Promise<SessionTokenPayload | null>;

package/dist/tanstack/server/authenticateRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticateRequest.d.ts","sourceRoot":"","sources":["../../../src/tanstack/server/authenticateRequest.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C;;;GAGG;AACH,UAAU,mBAAmB;IAC3B,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,UAAU,EACtB,eAAe,CAAC,EAAE,OAAO,GACxB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CA+BrC;AAyCD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAK3E"}

package/dist/{server → tanstack/server}/index.d.ts

@@ -1,4 +1,4 @@
 export { authenticateRequest } from "./authenticateRequest";
 export type { AuthConfig } from "./types";
-export { getAuthConfig } from "./auth-config";
+export { getAuthConfig } from "./authConfig";
 //# sourceMappingURL=index.d.ts.map

package/dist/tanstack/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tanstack/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}

package/dist/{server → tanstack/server}/index.js

@@ -1,2 +1,2 @@
 export { authenticateRequest } from "./authenticateRequest";
-export { getAuthConfig } from "./auth-config";
+export { getAuthConfig } from "./authConfig";

package/dist/tanstack/server/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/tanstack/server/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB"}

package/dist/{client/_internal → tanstack}/useEveryAppRouter.d.ts

@@ -1,4 +1,4 @@
-import { SessionManager } from "../session-manager";
+import { SessionManager } from "../core/sessionManager";
 interface UseEveryAppRouterParams {
     sessionManager: SessionManager | null;
 }

package/dist/tanstack/useEveryAppRouter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useEveryAppRouter.d.ts","sourceRoot":"","sources":["../../src/tanstack/useEveryAppRouter.tsx"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAGxD,UAAU,uBAAuB;IAC/B,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;CACvC;AAED,wBAAgB,iBAAiB,CAAC,EAAE,cAAc,EAAE,EAAE,uBAAuB,QAmE5E"}

package/dist/tanstack/useSessionTokenClientMiddleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useSessionTokenClientMiddleware.d.ts","sourceRoot":"","sources":["../../src/tanstack/useSessionTokenClientMiddleware.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,+BAA+B,6GA2B1C,CAAC"}

package/package.json

@@ -1,21 +1,27 @@
 {
   "name": "@every-app/sdk",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "type": "module",
-  "main": "./dist/client/index.js",
-  "types": "./dist/client/index.d.ts",
   "exports": {
-    "./client": {
-      "types": "./dist/client/index.d.ts",
-      "default": "./dist/client/index.js"
+    "./core": {
+      "types": "./dist/core/index.d.ts",
+      "default": "./dist/core/index.js"
     },
-    "./server": {
-      "types": "./dist/server/index.d.ts",
-      "default": "./dist/server/index.js"
+    "./tanstack": {
+      "types": "./dist/tanstack/index.d.ts",
+      "default": "./dist/tanstack/index.js"
     },
-    "./server/getLocalD1Url": {
-      "types": "./dist/server/getLocalD1Url.d.ts",
-      "default": "./dist/server/getLocalD1Url.js"
+    "./tanstack/server": {
+      "types": "./dist/tanstack/server/index.d.ts",
+      "default": "./dist/tanstack/server/index.js"
+    },
+    "./cloudflare": {
+      "types": "./dist/cloudflare/index.d.ts",
+      "default": "./dist/cloudflare/index.js"
+    },
+    "./cloudflare/server": {
+      "types": "./dist/cloudflare/server/index.d.ts",
+      "default": "./dist/cloudflare/server/index.js"
     }
   },
   "files": [

package/src/cloudflare/index.ts

@@ -0,0 +1 @@
+export { lazyInitForWorkers } from "./lazyInit";

package/src/cloudflare/server/index.ts

@@ -0,0 +1 @@
+export { getLocalD1Url } from "../getLocalD1Url";

package/src/core/index.ts

@@ -0,0 +1,4 @@
+export { SessionManager, isRunningInIframe } from "./sessionManager";
+export type { SessionManagerConfig } from "./sessionManager";
+
+export { authenticatedFetch, getSessionToken } from "./authenticatedFetch";

package/src/{client/session-manager.test.ts → core/sessionManager.test.ts}

@@ -4,7 +4,7 @@ import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 vi.stubEnv("VITE_GATEWAY_URL", "https://gateway.example.com");
 
 describe("SessionManager", () => {
-  let SessionManager: typeof import("./session-manager").SessionManager;
+  let SessionManager: typeof import("./sessionManager").SessionManager;
   let mockPostMessage: ReturnType<typeof vi.fn>;
   let messageHandler: ((event: MessageEvent) => void) | null = null;
   let addEventListenerSpy: ReturnType<typeof vi.fn>;
@@ -74,7 +74,7 @@ describe("SessionManager", () => {
     });
 
     // Import fresh module
-    const module = await import("./session-manager");
+    const module = await import("./sessionManager");
     SessionManager = module.SessionManager;
   });
 
@@ -97,7 +97,7 @@ describe("SessionManager", () => {
       vi.resetModules();
       vi.stubEnv("VITE_GATEWAY_URL", "");
 
-      const module = await import("./session-manager");
+      const module = await import("./sessionManager");
 
       expect(() => new module.SessionManager({ appId: "test-app" })).toThrow(
         "[SessionManager] VITE_GATEWAY_URL env var is required.",
@@ -108,7 +108,7 @@ describe("SessionManager", () => {
       vi.resetModules();
       vi.stubEnv("VITE_GATEWAY_URL", "not-a-valid-url");
 
-      const module = await import("./session-manager");
+      const module = await import("./sessionManager");
 
       expect(() => new module.SessionManager({ appId: "test-app" })).toThrow(
         "[SessionManager] Invalid gateway URL: not-a-valid-url",

package/src/{client → tanstack}/EmbeddedAppProvider.tsx

@@ -1,7 +1,7 @@
 import React, { createContext, useContext, useMemo } from "react";
-import { SessionManager, SessionManagerConfig } from "./session-manager";
+import { SessionManager, SessionManagerConfig } from "../core/sessionManager";
 import { useEveryAppSession } from "./_internal/useEveryAppSession";
-import { useEveryAppRouter } from "./_internal/useEveryAppRouter";
+import { useEveryAppRouter } from "./useEveryAppRouter";
 import { GatewayRequiredError } from "./GatewayRequiredError";
 
 interface EmbeddedProviderConfig extends SessionManagerConfig {

package/src/{client → tanstack}/GatewayRequiredError.tsx

@@ -50,7 +50,7 @@ const styles = {
     colorScheme: "light dark",
   } satisfies CSSProperties,
   content: {
-    maxWidth: "380px",
+    maxWidth: "520px",
     width: "100%",
     textAlign: "left",
   } satisfies CSSProperties,
@@ -78,20 +78,17 @@ const styles = {
     color: "var(--gateway-text-muted, oklch(40% 0 0))",
     marginBottom: "20px",
   } satisfies CSSProperties,
-  link: {
-    display: "inline-flex",
-    alignItems: "center",
-    gap: "8px",
+  urlText: {
     fontSize: "14px",
-    fontWeight: 500,
-    lineHeight: "24px",
+    lineHeight: 1.5,
+    color: "var(--gateway-text-muted, oklch(40% 0 0))",
+    wordBreak: "break-all",
+  } satisfies CSSProperties,
+  urlLink: {
     color: "rgb(168, 162, 158)",
     textDecoration: "underline",
     textDecorationColor: "rgb(87, 83, 78)",
-    textUnderlineOffset: "4px",
-    cursor: "pointer",
-    transition:
-      "color, background-color, border-color, text-decoration-color, fill, stroke 0.15s cubic-bezier(0.4, 0, 0.2, 1)",
+    textUnderlineOffset: "2px",
   } satisfies CSSProperties,
 };
 
@@ -106,7 +103,8 @@ export function GatewayRequiredError({
   gatewayOrigin,
   appId,
 }: GatewayRequiredErrorProps) {
-  const gatewayUrl = `${gatewayOrigin}/apps/${appId}${window.location.pathname}`;
+  const isLocalhost = window.location.hostname === "localhost";
+  const gatewayUrl = `${gatewayOrigin}/apps/${appId}${window.location.pathname}${isLocalhost ? "dev" : ""}`;
 
   return (
     <div style={styles.container}>
@@ -139,23 +137,13 @@ export function GatewayRequiredError({
           so this works properly.
         </p>
 
-        {/* Redirect Link */}
-        <a href={gatewayUrl} style={styles.link}>
-          Go to Gateway
-          <svg
-            width="16"
-            height="16"
-            viewBox="0 0 24 24"
-            fill="none"
-            stroke="currentColor"
-            strokeWidth="2"
-            strokeLinecap="round"
-            strokeLinejoin="round"
-          >
-            <line x1="5" y1="12" x2="19" y2="12" />
-            <polyline points="12 5 19 12 12 19" />
-          </svg>
-        </a>
+        {/* URL Link */}
+        <p style={styles.urlText}>
+          Go to{" "}
+          <a href={gatewayUrl} style={styles.urlLink}>
+            {gatewayUrl}
+          </a>
+        </p>
       </div>
     </div>
   );

package/src/{client → tanstack}/_internal/useEveryAppSession.tsx

@@ -1,5 +1,8 @@
 import { useEffect, useRef, useState } from "react";
-import { SessionManager, SessionManagerConfig } from "../session-manager";
+import {
+  SessionManager,
+  SessionManagerConfig,
+} from "../../core/sessionManager";
 
 interface UseEveryAppSessionParams {
   sessionManagerConfig: SessionManagerConfig;

package/src/tanstack/index.ts

@@ -0,0 +1,3 @@
+export { useSessionTokenClientMiddleware } from "./useSessionTokenClientMiddleware";
+export { useEveryAppRouter } from "./useEveryAppRouter";
+export { EmbeddedAppProvider, useCurrentUser } from "./EmbeddedAppProvider";

package/src/{server → tanstack/server}/authenticateRequest.test.ts

@@ -59,10 +59,10 @@ describe("authenticateRequest", () => {
   });
 
   async function createValidToken(overrides: Record<string, unknown> = {}) {
+    // Token now only contains minimal claims: sub, email, iss, aud, exp, iat
+    // appId is represented by aud claim, permissions and embeddedApp were removed
     const jwt = await new SignJWT({
       email: "user@example.com",
-      appId: "test-app",
-      permissions: ["read", "write"],
       ...overrides,
     })
       .setProtectedHeader({ alg: "RS256" })
@@ -127,9 +127,8 @@ describe("authenticateRequest", () => {
       expect(result).not.toBeNull();
       expect(result!.sub).toBe("user-123");
       expect(result!.email).toBe("user@example.com");
-      expect(result!.appId).toBe("test-app");
-      expect(result!.permissions).toEqual(["read", "write"]);
       expect(result!.iss).toBe(authConfig.issuer);
+      // audience contains the appId
       expect(result!.aud).toBe(authConfig.audience);
     });
 

package/src/{server → tanstack/server}/authenticateRequest.ts

@@ -9,14 +9,22 @@ import {
 import type { AuthConfig } from "./types";
 import { env } from "cloudflare:workers";
 
+/**
+ * JWT payload structure for embedded app session tokens.
+ * Contains minimal claims for security - only what's needed for authentication.
+ */
 interface SessionTokenPayload {
+  /** User ID (subject claim) */
   sub: string;
+  /** Gateway URL (issuer claim) */
   iss: string;
+  /** App ID (audience claim) - scopes token to specific app */
   aud: string;
+  /** Expiration timestamp */
   exp: number;
+  /** Issued at timestamp */
   iat: number;
-  appId?: string;
-  permissions?: string[];
+  /** User email - used for user provisioning in apps */
   email?: string;
 }
 

package/src/{server → tanstack/server}/index.ts

@@ -1,3 +1,3 @@
 export { authenticateRequest } from "./authenticateRequest";
 export type { AuthConfig } from "./types";
-export { getAuthConfig } from "./auth-config";
+export { getAuthConfig } from "./authConfig";

package/src/{client/_internal → tanstack}/useEveryAppRouter.tsx

@@ -1,10 +1,11 @@
 import { useEffect } from "react";
-import { SessionManager } from "../session-manager";
+import { SessionManager } from "../core/sessionManager";
 import { useRouter } from "@tanstack/react-router";
 
 interface UseEveryAppRouterParams {
   sessionManager: SessionManager | null;
 }
+
 export function useEveryAppRouter({ sessionManager }: UseEveryAppRouterParams) {
   const router = useRouter();
   // Route synchronization effect

package/src/{client → tanstack}/useSessionTokenClientMiddleware.ts

@@ -1,5 +1,5 @@
 import { createMiddleware } from "@tanstack/react-start";
-import type { SessionManager } from "./session-manager";
+import type { SessionManager } from "../core/sessionManager";
 
 export const useSessionTokenClientMiddleware = createMiddleware({
   type: "function",

package/dist/client/EmbeddedAppProvider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"EmbeddedAppProvider.d.ts","sourceRoot":"","sources":["../../src/client/EmbeddedAppProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA6C,MAAM,OAAO,CAAC;AAClE,OAAO,EAAkB,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAKzE,UAAU,sBAAuB,SAAQ,oBAAoB;IAC3D,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAUD,wBAAgB,mBAAmB,CAAC,EAClC,QAAQ,EACR,GAAG,MAAM,EACV,EAAE,sBAAsB,kDA6BxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,IAAI;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAmBzE"}

package/dist/client/GatewayRequiredError.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"GatewayRequiredError.d.ts","sourceRoot":"","sources":["../../src/client/GatewayRequiredError.tsx"],"names":[],"mappings":"AAEA,UAAU,yBAAyB;IACjC;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAuFD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,aAAa,EACb,KAAK,GACN,EAAE,yBAAyB,2CAsD3B"}

package/dist/client/_internal/useEveryAppRouter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"useEveryAppRouter.d.ts","sourceRoot":"","sources":["../../../src/client/_internal/useEveryAppRouter.tsx"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGpD,UAAU,uBAAuB;IAC/B,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;CACvC;AACD,wBAAgB,iBAAiB,CAAC,EAAE,cAAc,EAAE,EAAE,uBAAuB,QAmE5E"}

package/dist/client/_internal/useEveryAppSession.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"useEveryAppSession.d.ts","sourceRoot":"","sources":["../../../src/client/_internal/useEveryAppSession.tsx"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1E,UAAU,wBAAwB;IAChC,oBAAoB,EAAE,oBAAoB,CAAC;CAC5C;AAED,wBAAgB,kBAAkB,CAAC,EACjC,oBAAoB,GACrB,EAAE,wBAAwB;;;;;;EAyC1B"}

package/dist/client/authenticatedFetch.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authenticatedFetch.d.ts","sourceRoot":"","sources":["../../src/client/authenticatedFetch.ts"],"names":[],"mappings":"AAQA;;GAEG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CAevD;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,QAAQ,CAAC,CAUnB"}

package/dist/client/index.d.ts

@@ -1,8 +0,0 @@
-export { SessionManager, isRunningInIframe } from "./session-manager";
-export type { SessionManagerConfig } from "./session-manager";
-export { useSessionTokenClientMiddleware } from "./useSessionTokenClientMiddleware";
-export { EmbeddedAppProvider, useCurrentUser } from "./EmbeddedAppProvider";
-export { GatewayRequiredError } from "./GatewayRequiredError";
-export { lazyInitForWorkers } from "./lazyInitForWorkers";
-export { authenticatedFetch, getSessionToken } from "./authenticatedFetch";
-//# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtE,YAAY,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AAEpF,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/client/index.js

@@ -1,6 +0,0 @@
-export { SessionManager, isRunningInIframe } from "./session-manager";
-export { useSessionTokenClientMiddleware } from "./useSessionTokenClientMiddleware";
-export { EmbeddedAppProvider, useCurrentUser } from "./EmbeddedAppProvider";
-export { GatewayRequiredError } from "./GatewayRequiredError";
-export { lazyInitForWorkers } from "./lazyInitForWorkers";
-export { authenticatedFetch, getSessionToken } from "./authenticatedFetch";

package/dist/client/lazyInitForWorkers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"lazyInitForWorkers.d.ts","sourceRoot":"","sources":["../../src/client/lazyInitForWorkers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CA8CxE"}

package/dist/client/session-manager.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-manager.d.ts","sourceRoot":"","sources":["../../src/client/session-manager.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;CACf;AAMD;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAQ3C;AAED,qBAAa,cAAc;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAE7B,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,cAAc,CAAgC;gBAE1C,MAAM,EAAE,oBAAoB;IAqBxC,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,uBAAuB;IAuCzB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IA8ClC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;IAOjC,aAAa,IAAI;QACf,MAAM,EAAE,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,CAAC;QACxD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;KACtB;IAgBD;;;OAGG;IACH,OAAO,IAAI;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;CAwBpD"}

package/dist/client/useSessionTokenClientMiddleware.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"useSessionTokenClientMiddleware.d.ts","sourceRoot":"","sources":["../../src/client/useSessionTokenClientMiddleware.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,+BAA+B,6GA2B1C,CAAC"}

package/dist/server/auth-config.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-config.d.ts","sourceRoot":"","sources":["../../src/server/auth-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,wBAAgB,aAAa,IAAI,UAAU,CAK1C"}

package/dist/server/authenticateRequest.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authenticateRequest.d.ts","sourceRoot":"","sources":["../../src/server/authenticateRequest.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,UAAU,mBAAmB;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,UAAU,EACtB,eAAe,CAAC,EAAE,OAAO,GACxB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CA+BrC;AAyCD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAK3E"}

package/dist/server/getLocalD1Url.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"getLocalD1Url.d.ts","sourceRoot":"","sources":["../../src/server/getLocalD1Url.ts"],"names":[],"mappings":"AAWA,wBAAgB,aAAa,kBAoD5B"}

package/dist/server/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC"}

package/dist/server/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/server/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB"}

package/src/client/index.ts

@@ -1,10 +0,0 @@
-export { SessionManager, isRunningInIframe } from "./session-manager";
-export type { SessionManagerConfig } from "./session-manager";
-export { useSessionTokenClientMiddleware } from "./useSessionTokenClientMiddleware";
-
-export { EmbeddedAppProvider, useCurrentUser } from "./EmbeddedAppProvider";
-export { GatewayRequiredError } from "./GatewayRequiredError";
-
-export { lazyInitForWorkers } from "./lazyInitForWorkers";
-
-export { authenticatedFetch, getSessionToken } from "./authenticatedFetch";