@fanvue/builder-sdk 0.3.0 → 0.4.0

package/README.md

@@ -6,7 +6,7 @@ this SDK covers both:
 
 | Building an... | Import | What you get | Docs |
 |---|---|---|---|
-| **Embedded App** (runs inside Fanvue, in an iframe) | `@fanvue/builder-sdk/nextjs/embedded-app` + `@fanvue/builder-sdk/react` | Session-token exchange handler, `useEmbeddedAuth` hook, Bearer sessions with auto refresh | [Overview](https://api.fanvue.com/docs/app-store/embedded-apps/overview) · [Integration guide](https://api.fanvue.com/docs/app-store/embedded-apps/integration-guide) |
+| **Embedded App** (runs inside Fanvue, in an iframe) | `@fanvue/builder-sdk/nextjs/embedded-app` + `@fanvue/builder-sdk/react` | Session-token exchange handler, `useEmbeddedAuth` hook, Bearer sessions with auto refresh, analytics through the host page | [Overview](https://api.fanvue.com/docs/app-store/embedded-apps/overview) · [Integration guide](https://api.fanvue.com/docs/app-store/embedded-apps/integration-guide) |
 | **Off-Platform App** ("Login with Fanvue" on your own domain) | `@fanvue/builder-sdk/nextjs/off-platform` | Full-page redirect flow, httpOnly cookie sessions, auto token refresh | [Auth overview](https://api.fanvue.com/docs/authentication/overview) · [Implementation guide](https://api.fanvue.com/docs/authentication/implementation-guide) |
 
 Building something else (Node, Deno, a custom server)? The core `@fanvue/builder-sdk`
@@ -138,6 +138,70 @@ export const { POST } = createSessionExchangeHandler(createConfig(), {
 See the [embedded apps integration guide](https://api.fanvue.com/docs/app-store/embedded-apps/integration-guide)
 for the full walkthrough, including app registration in the Builder.
 
+### Analytics (embedded apps)
+
+Embedded apps can fire product analytics through the Fanvue page hosting them,
+so events land in Fanvue's analytics stitched into the viewer's session --
+without your app ever handling identity data.
+
+```tsx
+"use client";
+import { useFanvueAnalytics } from "@fanvue/builder-sdk/react";
+
+export function CreateCourseButton() {
+  const { track } = useFanvueAnalytics();
+  return <button onClick={() => track("course_created", { chapters: 4 })}>Create course</button>;
+}
+```
+
+That is the whole integration -- no provider, no configuration. `track` is
+fire-and-forget: it never throws, and outside Fanvue (local dev, previews, a
+standalone deployment) it silently does nothing, so you can call it
+unconditionally.
+
+**Rules your events must follow:**
+
+- Event names match `/^[a-z0-9_]{1,64}$/`. Fanvue emits them prefixed with
+  `embedded_app_`, so `course_created` arrives as `embedded_app_course_created`,
+  attributed to your app automatically.
+- Properties are a flat record of at most 20 keys (max 64 characters each) with
+  `string` (max 256 characters), `number` or `boolean` values. No nesting.
+- Identity is Fanvue's to set: `user_id`, `device_id`, `revenue` and any
+  `$`-prefixed key are rejected.
+
+Analytics is granted per app by Fanvue, so `track` may legitimately be a no-op
+for your app. `isEnabled` tells you which:
+
+```tsx
+const { track, isEnabled } = useFanvueAnalytics();
+```
+
+**Outside React**, connect to the bridge directly:
+
+```ts
+import { connectFanvueBridge } from "@fanvue/builder-sdk/bridge";
+
+const result = await connectFanvueBridge();
+if (result.isOk() && result.value.has("analytics")) {
+  await result.value.analytics.track("course_created", { chapters: 4 });
+}
+```
+
+`connectFanvueBridge` handshakes with the host page: your app announces itself,
+Fanvue verifies your registered embed origin and replies with the capabilities
+it granted plus a private `MessagePort` carrying all further traffic. It fails
+with `NOT_EMBEDDED` when the app is not in an iframe and `TIMEOUT` when no
+`hello` arrives within the timeout (default 3s) -- neither is exceptional, and
+apps are expected to keep working standalone.
+
+> [!NOTE]
+> Host support for the bridge is being rolled out per environment. Until it is
+> enabled for the environment your app is running in, the handshake times out
+> and every `track` call no-ops -- exactly as it does outside Fanvue. So a
+> timeout does not necessarily mean your app is misconfigured. If events are not
+> arriving from a live embedded surface, confirm the bridge is enabled there
+> before you go looking for a bug in your integration.
+
 ### Off-Platform App ("Login with Fanvue")
 
 The fastest path: create a config file and three route handlers.
@@ -400,6 +464,18 @@ Error types: `OAuthError` (token exchange/refresh), `EmbeddedAuthError` (delegat
 | `AuthProvider` | Context provider. Manages JWT storage in `sessionStorage`. |
 | `useAuth()` | Returns `{ jwt, isAuthenticated, setJwt, clearJwt, authFetch }` |
 | `useEmbeddedAuth(opts?)` | Returns `{ status, error, theme }`. Exchanges the embedded session token on mount; `theme` is the creator's colour scheme (`'light' \| 'dark' \| null`). |
+| `useFanvueAnalytics()` | Returns `{ track, isEnabled }`. Fires events through the host page; no-ops outside Fanvue. |
+
+### Bridge (`@fanvue/builder-sdk/bridge`)
+
+The host-to-app capability protocol. Most apps only need `useFanvueAnalytics`.
+
+| Export | Description |
+|---|---|
+| `connectFanvueBridge(opts?)` | Handshakes with the host page. Returns `Result<FanvueBridge, BridgeConnectError>` (`NOT_EMBEDDED` or `TIMEOUT`) |
+| `FanvueBridge` | `{ capabilities, has(capability), analytics.track(eventName, properties?) }` |
+| `analyticsTrackPayloadSchema` | Zod schema for the `analytics.track` payload -- the same schema the host validates against |
+| Protocol constants and schemas | `BRIDGE_VERSION`, `BRIDGE_READY_TYPE`, `BRIDGE_HELLO_TYPE`, `bridgeRequestSchema`, `bridgeResponseSchema` |
 
 ## Examples
 

package/dist/bridge/index.d.ts

@@ -0,0 +1,2 @@
+import { C as bridgeCapabilitySchema, D as bridgeRequestSchema, E as bridgeReadyMessageSchema, O as bridgeResponseSchema, S as analyticsTrackPayloadSchema, T as bridgeHelloMessageSchema, _ as BridgeReadyMessage, a as FanvueBridge, b as analyticsEventNameSchema, c as ANALYTICS_TRACK_METHOD, d as BRIDGE_HELLO_TYPE, f as BRIDGE_READY_TYPE, g as BridgeHelloMessage, h as BridgeErrorCode, i as BridgeRequestError, l as AnalyticsProperties, m as BridgeCapability, n as ConnectFanvueBridgeOptions, o as FanvueBridgeAnalytics, p as BRIDGE_VERSION, r as connectFanvueBridge, s as ANALYTICS_CAPABILITY, t as BridgeConnectError, u as AnalyticsTrackPayload, v as BridgeRequest, w as bridgeErrorCodeSchema, x as analyticsPropertiesSchema, y as BridgeResponse } from "../index-BRDYLBlc.js";
+export { ANALYTICS_CAPABILITY, ANALYTICS_TRACK_METHOD, AnalyticsProperties, AnalyticsTrackPayload, BRIDGE_HELLO_TYPE, BRIDGE_READY_TYPE, BRIDGE_VERSION, BridgeCapability, BridgeConnectError, BridgeErrorCode, BridgeHelloMessage, BridgeReadyMessage, BridgeRequest, BridgeRequestError, BridgeResponse, ConnectFanvueBridgeOptions, FanvueBridge, FanvueBridgeAnalytics, analyticsEventNameSchema, analyticsPropertiesSchema, analyticsTrackPayloadSchema, bridgeCapabilitySchema, bridgeErrorCodeSchema, bridgeHelloMessageSchema, bridgeReadyMessageSchema, bridgeRequestSchema, bridgeResponseSchema, connectFanvueBridge };

package/dist/bridge/index.js

@@ -0,0 +1,3 @@
+import "../schemas-DbyHF7Xi.js";
+import { a as BRIDGE_READY_TYPE, c as analyticsPropertiesSchema, d as bridgeErrorCodeSchema, f as bridgeHelloMessageSchema, h as bridgeResponseSchema, i as BRIDGE_HELLO_TYPE, l as analyticsTrackPayloadSchema, m as bridgeRequestSchema, n as ANALYTICS_CAPABILITY, o as BRIDGE_VERSION, p as bridgeReadyMessageSchema, r as ANALYTICS_TRACK_METHOD, s as analyticsEventNameSchema, t as connectFanvueBridge, u as bridgeCapabilitySchema } from "../bridge-CGVtI3hr.js";
+export { ANALYTICS_CAPABILITY, ANALYTICS_TRACK_METHOD, BRIDGE_HELLO_TYPE, BRIDGE_READY_TYPE, BRIDGE_VERSION, analyticsEventNameSchema, analyticsPropertiesSchema, analyticsTrackPayloadSchema, bridgeCapabilitySchema, bridgeErrorCodeSchema, bridgeHelloMessageSchema, bridgeReadyMessageSchema, bridgeRequestSchema, bridgeResponseSchema, connectFanvueBridge };

package/dist/bridge-CGVtI3hr.js

@@ -0,0 +1,336 @@
+import { a as number, c as string, d as prettifyError, f as require_index_cjs, i as literal, l as union, n as array, o as object, r as boolean, s as record, t as _enum, u as unknown } from "./schemas-DbyHF7Xi.js";
+//#region src/bridge/protocol.ts
+/**
+* The bridge protocol version spoken by this SDK.
+*
+* Both sides send it on every message. Changes within a version must be
+* additive; anything breaking increments the version, and the host answers the
+* handshake with the highest version both sides speak.
+*/
+const BRIDGE_VERSION = 1;
+/**
+* Message type the embedded app posts to the host to open a handshake.
+*
+* An app may re-announce (it re-posts `ready` until a `hello` lands, in case
+* the host attached its listener late).
+*/
+const BRIDGE_READY_TYPE = "fanvue:bridge:ready";
+/**
+* Message type the host posts back, carrying the granted capabilities and the port.
+*
+* The host answers each verified `ready` with a fresh `hello` and port,
+* closing the prior port; the app adopts the newest `hello`.
+*/
+const BRIDGE_HELLO_TYPE = "fanvue:bridge:hello";
+/** Capability namespace for analytics (`analytics.track`). */
+const ANALYTICS_CAPABILITY = "analytics";
+/** Method name for tracking an analytics event. */
+const ANALYTICS_TRACK_METHOD = "track";
+/** The host capabilities an app can be granted. Grants are resolved server-side. */
+const bridgeCapabilitySchema = _enum([ANALYTICS_CAPABILITY]);
+/**
+* Error codes the host can return for a request.
+*
+* - `capability_denied` — the app was not granted the requested capability.
+* - `invalid_payload` — the payload failed the host's schema for the method.
+* - `rate_limited` — the app exceeded the host's budget for the method.
+* - `internal` — the host handler failed unexpectedly.
+*/
+const bridgeErrorCodeSchema = _enum([
+	"capability_denied",
+	"invalid_payload",
+	"rate_limited",
+	"internal"
+]);
+/** Schema for the `ready` message an app posts to `window.parent`. */
+const bridgeReadyMessageSchema = object({
+	type: literal(BRIDGE_READY_TYPE),
+	v: literal(1)
+});
+/** Schema for the `hello` message the host posts back with the transferred port. */
+const bridgeHelloMessageSchema = object({
+	type: literal(BRIDGE_HELLO_TYPE),
+	v: literal(1),
+	capabilities: array(bridgeCapabilitySchema)
+});
+/**
+* Schema for a request sent app → host over the port.
+*
+* Capability and method names are bounded so a misbehaving sender cannot make
+* either side hold or log arbitrarily large strings.
+*/
+const bridgeRequestSchema = object({
+	v: literal(1),
+	id: string().min(1).max(64),
+	kind: literal("request"),
+	capability: string().min(1).max(64),
+	method: string().min(1).max(64),
+	payload: unknown()
+});
+/**
+* Schema for a response sent host → app over the port.
+*
+* The `id` and `error.message` are bounded like the request fields, so a
+* misbehaving host cannot push oversized strings into the app.
+*/
+const bridgeResponseSchema = object({
+	v: literal(1),
+	id: string().max(64),
+	kind: literal("response"),
+	ok: boolean(),
+	result: unknown().optional(),
+	error: object({
+		code: bridgeErrorCodeSchema,
+		message: string().max(1024)
+	}).optional()
+});
+/**
+* Event names an app may emit.
+*
+* The host prefixes every name with `embedded_app_` before it reaches
+* Amplitude, so an app can never emit a core platform event. Names are
+* snake_case to match the platform's tracking-plan convention.
+*/
+const analyticsEventNameSchema = string().regex(/^[a-z0-9_]{1,64}$/);
+/**
+* Property keys reserved by the host.
+*
+* Identity and revenue are host-owned: the host page's Amplitude client is
+* already identified as the viewer, and an app must not be able to overwrite
+* that or fabricate revenue.
+*/
+const ANALYTICS_RESERVED_PROPERTY_KEYS = [
+	"user_id",
+	"device_id",
+	"revenue"
+];
+/** Maximum number of properties on a single event. */
+const ANALYTICS_MAX_PROPERTY_KEYS = 20;
+/** Whether a property key is one an app is allowed to set. */
+function isAllowedAnalyticsPropertyKey(key) {
+	return !ANALYTICS_RESERVED_PROPERTY_KEYS.includes(key) && !key.startsWith("$");
+}
+/**
+* Properties attached to an analytics event: a flat record of short scalars.
+*
+* Nesting is rejected so the payload stays cheap to validate and to read in
+* Amplitude, and `$`-prefixed keys are rejected because Amplitude reserves them.
+* Numbers must be finite — `Infinity` and `NaN` do not survive serialisation.
+*/
+const analyticsPropertiesSchema = record(string().min(1).max(64), union([
+	string().max(256),
+	number().finite(),
+	boolean()
+])).refine((properties) => Object.keys(properties).length <= ANALYTICS_MAX_PROPERTY_KEYS, { message: `An event may carry at most ${ANALYTICS_MAX_PROPERTY_KEYS} properties` }).refine((properties) => Object.keys(properties).every(isAllowedAnalyticsPropertyKey), { message: `Properties may not use a reserved key (${ANALYTICS_RESERVED_PROPERTY_KEYS.join(", ")}) or a key starting with "$"` });
+/** Schema for the payload of `analytics.track`. */
+const analyticsTrackPayloadSchema = object({
+	eventName: analyticsEventNameSchema,
+	properties: analyticsPropertiesSchema.optional()
+});
+//#endregion
+//#region src/bridge/bridge.ts
+var import_index_cjs = require_index_cjs();
+/**
+* Builds the {@link FanvueBridge} served over an established port.
+*
+* Requests are correlated to responses by `id`; anything arriving on the port
+* that is not a well-formed response for a request still in flight is ignored,
+* so a misbehaving host cannot resolve a request twice or crash the app.
+*
+* Apps get this from {@link connectFanvueBridge} rather than calling it directly.
+*
+* @param ctx - The port, granted capabilities, and per-request timeout.
+* @returns The bridge exposed to the app.
+*/
+function createFanvueBridge(ctx) {
+	const { capabilities, requestTimeoutMs } = ctx;
+	const pending = /* @__PURE__ */ new Map();
+	let requestSequence = 0;
+	let port = ctx.port;
+	function onPortMessage(event) {
+		const parsed = bridgeResponseSchema.safeParse(event.data);
+		if (!parsed.success) return;
+		const inFlight = pending.get(parsed.data.id);
+		if (!inFlight) return;
+		pending.delete(parsed.data.id);
+		clearTimeout(inFlight.timer);
+		inFlight.resolve(parsed.data);
+	}
+	function attach(next) {
+		next.addEventListener("message", onPortMessage);
+		next.start();
+	}
+	attach(port);
+	function adoptPort(next) {
+		port.close();
+		port = next;
+		attach(next);
+	}
+	function has(capability) {
+		return capabilities.includes(capability);
+	}
+	async function request(capability, method, payload) {
+		if (!has(capability)) return (0, import_index_cjs.err)({
+			code: "capability_denied",
+			message: `The host did not grant the "${capability}" capability to this app.`
+		});
+		requestSequence += 1;
+		const id = `${capability}-${requestSequence}`;
+		const message = {
+			v: 1,
+			id,
+			kind: "request",
+			capability,
+			method,
+			payload
+		};
+		try {
+			port.postMessage(message);
+		} catch (error) {
+			return (0, import_index_cjs.err)({
+				code: "PORT_CLOSED",
+				message: `Could not send the request to the host: ${error instanceof Error ? error.message : String(error)}`
+			});
+		}
+		const settled = await new Promise((resolve) => {
+			const timer = setTimeout(() => {
+				pending.delete(id);
+				resolve(null);
+			}, requestTimeoutMs);
+			pending.set(id, {
+				resolve,
+				timer
+			});
+		});
+		if (settled === null) return (0, import_index_cjs.err)({
+			code: "TIMEOUT",
+			message: `The host did not answer "${capability}.${method}" within ${requestTimeoutMs}ms.`
+		});
+		if (!settled.ok) return (0, import_index_cjs.err)({
+			code: settled.error?.code ?? "internal",
+			message: settled.error?.message ?? "The host rejected the request without a reason."
+		});
+		return (0, import_index_cjs.ok)(settled.result);
+	}
+	async function track(eventName, properties) {
+		const payload = analyticsTrackPayloadSchema.safeParse(properties === void 0 ? { eventName } : {
+			eventName,
+			properties
+		});
+		if (!payload.success) return (0, import_index_cjs.err)({
+			code: "invalid_payload",
+			message: prettifyError(payload.error)
+		});
+		return (await request(ANALYTICS_CAPABILITY, ANALYTICS_TRACK_METHOD, payload.data)).map(() => void 0);
+	}
+	return {
+		capabilities,
+		has,
+		analytics: { track },
+		adoptPort
+	};
+}
+//#endregion
+//#region src/bridge/connect.ts
+/** How long to wait for the host's `hello` before giving up. */
+const DEFAULT_CONNECT_TIMEOUT_MS = 3e3;
+/** How long to wait for a response to a single request once connected. */
+const REQUEST_TIMEOUT_MS = 3e3;
+/**
+* How often to re-post `ready` until the handshake settles.
+*
+* The host attaches its listener asynchronously (its capability grants come
+* from a query), so a single `ready` posted right after the iframe loads can
+* arrive before anyone is listening. Re-announcing until a `hello` lands (or
+* the timeout fires) closes that race.
+*/
+const READY_REANNOUNCE_INTERVAL_MS = 500;
+/**
+* Opens the capability bridge to the Fanvue page hosting this app.
+*
+* Posts `fanvue:bridge:ready` to `window.parent` and waits for the host's
+* `fanvue:bridge:hello`, which names the granted capabilities and transfers the
+* `MessagePort` all later traffic flows over. The host verifies the frame's
+* origin before replying, so a page framed by anything other than its
+* registered Fanvue surface simply times out.
+*
+* `ready` is re-posted every 500ms until a `hello` lands (or the timeout
+* fires), because the host may attach its listener after the app's first
+* announce. The host answers each verified `ready` with a fresh `hello` and
+* port, closing the prior port — so the bridge keeps listening for the
+* lifetime of the connection and adopts the newest `hello` by swapping onto
+* its port. Requests in flight on a superseded port fail by their timeouts.
+*
+* Calling this again is safe and is how an app reconnects after the iframe
+* reloads: the host closes the previous port and re-handshakes.
+*
+* Failure is not exceptional — apps are expected to keep working standalone
+* (local dev, previews) where the connection never succeeds.
+*
+* @param options - Optional overrides (e.g. a shorter `timeoutMs`).
+* @returns A `Result` with the connected {@link FanvueBridge}, or a
+*   {@link BridgeConnectError} when there is no host to talk to.
+*
+* @example
+* const result = await connectFanvueBridge();
+* if (result.isOk() && result.value.has('analytics')) {
+*   await result.value.analytics.track('course_created', { chapters: 4 });
+* }
+*/
+function connectFanvueBridge(options) {
+	const timeoutMs = options?.timeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS;
+	if (typeof window === "undefined" || window.parent === window) return Promise.resolve((0, import_index_cjs.err)({
+		code: "NOT_EMBEDDED",
+		message: "The app is not running inside a Fanvue iframe, so there is no host to connect to."
+	}));
+	const host = window.parent;
+	return new Promise((resolve) => {
+		let settled = false;
+		let bridge = null;
+		const timer = setTimeout(() => {
+			finish((0, import_index_cjs.err)({
+				code: "TIMEOUT",
+				message: `The Fanvue host did not complete the handshake within ${timeoutMs}ms.`
+			}));
+		}, timeoutMs);
+		const reannounce = setInterval(postReady, READY_REANNOUNCE_INTERVAL_MS);
+		function finish(result) {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			clearInterval(reannounce);
+			if (result.isErr()) window.removeEventListener("message", onMessage);
+			resolve(result);
+		}
+		function onMessage(event) {
+			if (event.source !== host) return;
+			const hello = bridgeHelloMessageSchema.safeParse(event.data);
+			if (!hello.success) return;
+			const port = event.ports[0];
+			if (!port) return;
+			if (bridge) {
+				bridge.adoptPort(port);
+				return;
+			}
+			bridge = createFanvueBridge({
+				port,
+				capabilities: hello.data.capabilities,
+				requestTimeoutMs: REQUEST_TIMEOUT_MS
+			});
+			finish((0, import_index_cjs.ok)(bridge));
+		}
+		window.addEventListener("message", onMessage);
+		function postReady() {
+			const ready = {
+				type: BRIDGE_READY_TYPE,
+				v: 1
+			};
+			host.postMessage(ready, "*");
+		}
+		postReady();
+	});
+}
+//#endregion
+export { BRIDGE_READY_TYPE as a, analyticsPropertiesSchema as c, bridgeErrorCodeSchema as d, bridgeHelloMessageSchema as f, bridgeResponseSchema as h, BRIDGE_HELLO_TYPE as i, analyticsTrackPayloadSchema as l, bridgeRequestSchema as m, ANALYTICS_CAPABILITY as n, BRIDGE_VERSION as o, bridgeReadyMessageSchema as p, ANALYTICS_TRACK_METHOD as r, analyticsEventNameSchema as s, connectFanvueBridge as t, bridgeCapabilitySchema as u };
+
+//# sourceMappingURL=bridge-CGVtI3hr.js.map

package/dist/bridge-CGVtI3hr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-CGVtI3hr.js","names":["z.enum","z.object","z.literal","z.array","z.string","z.unknown","z.boolean","z\n  .record","z.union","z.number","z.prettifyError"],"sources":["../src/bridge/protocol.ts","../src/bridge/bridge.ts","../src/bridge/connect.ts"],"sourcesContent":["import { z } from 'zod';\n\n/**\n * The bridge protocol version spoken by this SDK.\n *\n * Both sides send it on every message. Changes within a version must be\n * additive; anything breaking increments the version, and the host answers the\n * handshake with the highest version both sides speak.\n */\nexport const BRIDGE_VERSION = 1;\n\n/**\n * Message type the embedded app posts to the host to open a handshake.\n *\n * An app may re-announce (it re-posts `ready` until a `hello` lands, in case\n * the host attached its listener late).\n */\nexport const BRIDGE_READY_TYPE = 'fanvue:bridge:ready';\n\n/**\n * Message type the host posts back, carrying the granted capabilities and the port.\n *\n * The host answers each verified `ready` with a fresh `hello` and port,\n * closing the prior port; the app adopts the newest `hello`.\n */\nexport const BRIDGE_HELLO_TYPE = 'fanvue:bridge:hello';\n\n/** Capability namespace for analytics (`analytics.track`). */\nexport const ANALYTICS_CAPABILITY = 'analytics';\n\n/** Method name for tracking an analytics event. */\nexport const ANALYTICS_TRACK_METHOD = 'track';\n\n/** The host capabilities an app can be granted. Grants are resolved server-side. */\nexport const bridgeCapabilitySchema = z.enum([ANALYTICS_CAPABILITY]);\n\n/** A host capability an app can be granted. */\nexport type BridgeCapability = z.infer<typeof bridgeCapabilitySchema>;\n\n/**\n * Error codes the host can return for a request.\n *\n * - `capability_denied` — the app was not granted the requested capability.\n * - `invalid_payload` — the payload failed the host's schema for the method.\n * - `rate_limited` — the app exceeded the host's budget for the method.\n * - `internal` — the host handler failed unexpectedly.\n */\nexport const bridgeErrorCodeSchema = z.enum([\n  'capability_denied',\n  'invalid_payload',\n  'rate_limited',\n  'internal',\n]);\n\n/** An error code the host can return for a request. */\nexport type BridgeErrorCode = z.infer<typeof bridgeErrorCodeSchema>;\n\n/** Schema for the `ready` message an app posts to `window.parent`. */\nexport const bridgeReadyMessageSchema = z.object({\n  type: z.literal(BRIDGE_READY_TYPE),\n  v: z.literal(BRIDGE_VERSION),\n});\n\n/** The `ready` message an app posts to `window.parent` to open a handshake. */\nexport type BridgeReadyMessage = z.infer<typeof bridgeReadyMessageSchema>;\n\n/** Schema for the `hello` message the host posts back with the transferred port. */\nexport const bridgeHelloMessageSchema = z.object({\n  type: z.literal(BRIDGE_HELLO_TYPE),\n  v: z.literal(BRIDGE_VERSION),\n  capabilities: z.array(bridgeCapabilitySchema),\n});\n\n/** The `hello` message the host posts back, alongside the transferred port. */\nexport type BridgeHelloMessage = z.infer<typeof bridgeHelloMessageSchema>;\n\n/**\n * Schema for a request sent app → host over the port.\n *\n * Capability and method names are bounded so a misbehaving sender cannot make\n * either side hold or log arbitrarily large strings.\n */\nexport const bridgeRequestSchema = z.object({\n  v: z.literal(BRIDGE_VERSION),\n  id: z.string().min(1).max(64),\n  kind: z.literal('request'),\n  capability: z.string().min(1).max(64),\n  method: z.string().min(1).max(64),\n  payload: z.unknown(),\n});\n\n/** A request sent app → host over the port, correlated to a response by `id`. */\nexport type BridgeRequest = z.infer<typeof bridgeRequestSchema>;\n\n/**\n * Schema for a response sent host → app over the port.\n *\n * The `id` and `error.message` are bounded like the request fields, so a\n * misbehaving host cannot push oversized strings into the app.\n */\nexport const bridgeResponseSchema = z.object({\n  v: z.literal(BRIDGE_VERSION),\n  id: z.string().max(64),\n  kind: z.literal('response'),\n  ok: z.boolean(),\n  result: z.unknown().optional(),\n  error: z.object({ code: bridgeErrorCodeSchema, message: z.string().max(1024) }).optional(),\n});\n\n/** A response sent host → app over the port, correlated to a request by `id`. */\nexport type BridgeResponse = z.infer<typeof bridgeResponseSchema>;\n\n/**\n * Event names an app may emit.\n *\n * The host prefixes every name with `embedded_app_` before it reaches\n * Amplitude, so an app can never emit a core platform event. Names are\n * snake_case to match the platform's tracking-plan convention.\n */\nexport const analyticsEventNameSchema = z.string().regex(/^[a-z0-9_]{1,64}$/);\n\n/**\n * Property keys reserved by the host.\n *\n * Identity and revenue are host-owned: the host page's Amplitude client is\n * already identified as the viewer, and an app must not be able to overwrite\n * that or fabricate revenue.\n */\nconst ANALYTICS_RESERVED_PROPERTY_KEYS: readonly string[] = ['user_id', 'device_id', 'revenue'];\n\n/** Maximum number of properties on a single event. */\nconst ANALYTICS_MAX_PROPERTY_KEYS = 20;\n\n/** Whether a property key is one an app is allowed to set. */\nfunction isAllowedAnalyticsPropertyKey(key: string): boolean {\n  return !ANALYTICS_RESERVED_PROPERTY_KEYS.includes(key) && !key.startsWith('$');\n}\n\n/**\n * Properties attached to an analytics event: a flat record of short scalars.\n *\n * Nesting is rejected so the payload stays cheap to validate and to read in\n * Amplitude, and `$`-prefixed keys are rejected because Amplitude reserves them.\n * Numbers must be finite — `Infinity` and `NaN` do not survive serialisation.\n */\nexport const analyticsPropertiesSchema = z\n  .record(\n    z.string().min(1).max(64),\n    z.union([z.string().max(256), z.number().finite(), z.boolean()]),\n  )\n  .refine((properties) => Object.keys(properties).length <= ANALYTICS_MAX_PROPERTY_KEYS, {\n    message: `An event may carry at most ${ANALYTICS_MAX_PROPERTY_KEYS} properties`,\n  })\n  .refine((properties) => Object.keys(properties).every(isAllowedAnalyticsPropertyKey), {\n    message: `Properties may not use a reserved key (${ANALYTICS_RESERVED_PROPERTY_KEYS.join(', ')}) or a key starting with \"$\"`,\n  });\n\n/** Schema for the payload of `analytics.track`. */\nexport const analyticsTrackPayloadSchema = z.object({\n  eventName: analyticsEventNameSchema,\n  properties: analyticsPropertiesSchema.optional(),\n});\n\n/** The payload of `analytics.track`. */\nexport type AnalyticsTrackPayload = z.infer<typeof analyticsTrackPayloadSchema>;\n\n/** Properties attached to an analytics event. */\nexport type AnalyticsProperties = z.infer<typeof analyticsPropertiesSchema>;\n","import { err, ok } from 'neverthrow';\nimport { z } from 'zod';\n\nimport {\n  ANALYTICS_CAPABILITY,\n  ANALYTICS_TRACK_METHOD,\n  BRIDGE_VERSION,\n  analyticsTrackPayloadSchema,\n  bridgeResponseSchema,\n  type AnalyticsProperties,\n  type BridgeCapability,\n  type BridgeErrorCode,\n  type BridgeRequest,\n  type BridgeResponse,\n} from './protocol.js';\n\nimport type { Result } from 'neverthrow';\n\n/**\n * Why a bridge request failed.\n *\n * Beyond the codes the host can return, the SDK adds `TIMEOUT` (the host never\n * answered) and `PORT_CLOSED` (the message could not be put on the port —\n * in practice the payload was not structured-cloneable). Note that\n * `postMessage` on a closed port silently drops rather than throwing, so a\n * torn-down host surfaces as `TIMEOUT`, not `PORT_CLOSED`.\n */\nexport interface BridgeRequestError {\n  code: BridgeErrorCode | 'TIMEOUT' | 'PORT_CLOSED';\n  message: string;\n}\n\n/** The analytics capability, as exposed on a connected bridge. */\nexport interface FanvueBridgeAnalytics {\n  track: (\n    eventName: string,\n    properties?: AnalyticsProperties,\n  ) => Promise<Result<void, BridgeRequestError>>;\n}\n\n/**\n * A live connection to the Fanvue host page.\n *\n * @property capabilities - The capabilities the host granted this app.\n * @property has - Whether a given capability was granted. Checking is\n *   optional: calling a capability without checking is safe and returns\n *   `capability_denied`.\n * @property analytics - Fires events through the host page's Amplitude client.\n */\nexport interface FanvueBridge {\n  capabilities: readonly BridgeCapability[];\n  has: (capability: BridgeCapability) => boolean;\n  analytics: FanvueBridgeAnalytics;\n}\n\n/**\n * A {@link FanvueBridge} plus the internals `connectFanvueBridge` drives.\n *\n * Not exported from the public entry: apps only ever see {@link FanvueBridge}.\n *\n * @property adoptPort - Swaps the underlying port for the one carried by a\n *   newer `hello`, closing the old port. Requests in flight on the old port\n *   fail by their existing timeouts.\n */\nexport interface InternalFanvueBridge extends FanvueBridge {\n  adoptPort: (port: MessagePort) => void;\n}\n\n/**\n * Everything {@link createFanvueBridge} needs to serve requests.\n *\n * @property port - The `MessagePort` transferred by the host in its `hello`.\n * @property capabilities - The capabilities named in the host's `hello`.\n * @property requestTimeoutMs - How long to wait for a response before failing.\n */\nexport interface FanvueBridgeContext {\n  port: MessagePort;\n  capabilities: readonly BridgeCapability[];\n  requestTimeoutMs: number;\n}\n\ninterface PendingRequest {\n  resolve: (response: BridgeResponse) => void;\n  timer: ReturnType<typeof setTimeout>;\n}\n\n/**\n * Builds the {@link FanvueBridge} served over an established port.\n *\n * Requests are correlated to responses by `id`; anything arriving on the port\n * that is not a well-formed response for a request still in flight is ignored,\n * so a misbehaving host cannot resolve a request twice or crash the app.\n *\n * Apps get this from {@link connectFanvueBridge} rather than calling it directly.\n *\n * @param ctx - The port, granted capabilities, and per-request timeout.\n * @returns The bridge exposed to the app.\n */\nexport function createFanvueBridge(ctx: FanvueBridgeContext): InternalFanvueBridge {\n  const { capabilities, requestTimeoutMs } = ctx;\n  const pending = new Map<string, PendingRequest>();\n  let requestSequence = 0;\n  let port = ctx.port;\n\n  function onPortMessage(event: MessageEvent): void {\n    const parsed = bridgeResponseSchema.safeParse(event.data);\n    if (!parsed.success) return;\n\n    const inFlight = pending.get(parsed.data.id);\n    if (!inFlight) return;\n\n    pending.delete(parsed.data.id);\n    clearTimeout(inFlight.timer);\n    inFlight.resolve(parsed.data);\n  }\n\n  function attach(next: MessagePort): void {\n    next.addEventListener('message', onPortMessage);\n    next.start();\n  }\n  attach(port);\n\n  function adoptPort(next: MessagePort): void {\n    // The host closes its end of the superseded port when it re-answers a\n    // ready; close this end too and route all later requests over the new\n    // port. Requests still in flight on the old port fail by their timeouts.\n    port.close();\n    port = next;\n    attach(next);\n  }\n\n  function has(capability: BridgeCapability): boolean {\n    return capabilities.includes(capability);\n  }\n\n  async function request(\n    capability: BridgeCapability,\n    method: string,\n    payload: unknown,\n  ): Promise<Result<unknown, BridgeRequestError>> {\n    if (!has(capability)) {\n      return err({\n        code: 'capability_denied',\n        message: `The host did not grant the \"${capability}\" capability to this app.`,\n      });\n    }\n\n    requestSequence += 1;\n    const id = `${capability}-${requestSequence}`;\n    const message: BridgeRequest = {\n      v: BRIDGE_VERSION,\n      id,\n      kind: 'request',\n      capability,\n      method,\n      payload,\n    };\n\n    try {\n      port.postMessage(message);\n    } catch (error) {\n      return err({\n        code: 'PORT_CLOSED',\n        message: `Could not send the request to the host: ${error instanceof Error ? error.message : String(error)}`,\n      });\n    }\n\n    // Registered after the send: port delivery is always queued as a task, so\n    // no response can arrive before this synchronous block finishes.\n    const settled = await new Promise<BridgeResponse | null>((resolve) => {\n      const timer = setTimeout(() => {\n        pending.delete(id);\n        resolve(null);\n      }, requestTimeoutMs);\n      pending.set(id, { resolve, timer });\n    });\n    if (settled === null) {\n      return err({\n        code: 'TIMEOUT',\n        message: `The host did not answer \"${capability}.${method}\" within ${requestTimeoutMs}ms.`,\n      });\n    }\n\n    if (!settled.ok) {\n      return err({\n        code: settled.error?.code ?? 'internal',\n        message: settled.error?.message ?? 'The host rejected the request without a reason.',\n      });\n    }\n\n    return ok(settled.result);\n  }\n\n  async function track(\n    eventName: string,\n    properties?: AnalyticsProperties,\n  ): Promise<Result<void, BridgeRequestError>> {\n    // Validate before sending so a malformed call fails immediately with a\n    // readable message; the host validates again as the authoritative check.\n    const payload = analyticsTrackPayloadSchema.safeParse(\n      properties === undefined ? { eventName } : { eventName, properties },\n    );\n    if (!payload.success) {\n      return err({ code: 'invalid_payload', message: z.prettifyError(payload.error) });\n    }\n\n    const result = await request(ANALYTICS_CAPABILITY, ANALYTICS_TRACK_METHOD, payload.data);\n    return result.map((): void => undefined);\n  }\n\n  return {\n    capabilities,\n    has,\n    analytics: { track },\n    adoptPort,\n  };\n}\n","import { err, ok } from 'neverthrow';\n\nimport { createFanvueBridge, type FanvueBridge, type InternalFanvueBridge } from './bridge.js';\nimport {\n  BRIDGE_READY_TYPE,\n  BRIDGE_VERSION,\n  bridgeHelloMessageSchema,\n  type BridgeReadyMessage,\n} from './protocol.js';\n\nimport type { Result } from 'neverthrow';\n\n/** How long to wait for the host's `hello` before giving up. */\nconst DEFAULT_CONNECT_TIMEOUT_MS = 3000;\n\n/** How long to wait for a response to a single request once connected. */\nconst REQUEST_TIMEOUT_MS = 3000;\n\n/**\n * How often to re-post `ready` until the handshake settles.\n *\n * The host attaches its listener asynchronously (its capability grants come\n * from a query), so a single `ready` posted right after the iframe loads can\n * arrive before anyone is listening. Re-announcing until a `hello` lands (or\n * the timeout fires) closes that race.\n */\nconst READY_REANNOUNCE_INTERVAL_MS = 500;\n\n/**\n * Why connecting to the host failed.\n *\n * - `NOT_EMBEDDED` — the app is not running in an iframe, so there is no host.\n * - `TIMEOUT` — no `hello` arrived. The page is framed by something other than\n *   Fanvue, or Fanvue refused the handshake (unregistered embed origin).\n */\nexport interface BridgeConnectError {\n  code: 'NOT_EMBEDDED' | 'TIMEOUT';\n  message: string;\n}\n\n/**\n * Options for {@link connectFanvueBridge}.\n *\n * @property timeoutMs - How long to wait for the host's `hello`. Defaults to 3000.\n */\nexport interface ConnectFanvueBridgeOptions {\n  timeoutMs?: number;\n}\n\n/**\n * Opens the capability bridge to the Fanvue page hosting this app.\n *\n * Posts `fanvue:bridge:ready` to `window.parent` and waits for the host's\n * `fanvue:bridge:hello`, which names the granted capabilities and transfers the\n * `MessagePort` all later traffic flows over. The host verifies the frame's\n * origin before replying, so a page framed by anything other than its\n * registered Fanvue surface simply times out.\n *\n * `ready` is re-posted every 500ms until a `hello` lands (or the timeout\n * fires), because the host may attach its listener after the app's first\n * announce. The host answers each verified `ready` with a fresh `hello` and\n * port, closing the prior port — so the bridge keeps listening for the\n * lifetime of the connection and adopts the newest `hello` by swapping onto\n * its port. Requests in flight on a superseded port fail by their timeouts.\n *\n * Calling this again is safe and is how an app reconnects after the iframe\n * reloads: the host closes the previous port and re-handshakes.\n *\n * Failure is not exceptional — apps are expected to keep working standalone\n * (local dev, previews) where the connection never succeeds.\n *\n * @param options - Optional overrides (e.g. a shorter `timeoutMs`).\n * @returns A `Result` with the connected {@link FanvueBridge}, or a\n *   {@link BridgeConnectError} when there is no host to talk to.\n *\n * @example\n * const result = await connectFanvueBridge();\n * if (result.isOk() && result.value.has('analytics')) {\n *   await result.value.analytics.track('course_created', { chapters: 4 });\n * }\n */\nexport function connectFanvueBridge(\n  options?: ConnectFanvueBridgeOptions,\n): Promise<Result<FanvueBridge, BridgeConnectError>> {\n  const timeoutMs = options?.timeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS;\n\n  if (typeof window === 'undefined' || window.parent === window) {\n    return Promise.resolve(\n      err({\n        code: 'NOT_EMBEDDED',\n        message:\n          'The app is not running inside a Fanvue iframe, so there is no host to connect to.',\n      }),\n    );\n  }\n  const host = window.parent;\n\n  return new Promise((resolve) => {\n    let settled = false;\n    let bridge: InternalFanvueBridge | null = null;\n\n    const timer = setTimeout(() => {\n      finish(\n        err({\n          code: 'TIMEOUT',\n          message: `The Fanvue host did not complete the handshake within ${timeoutMs}ms.`,\n        }),\n      );\n    }, timeoutMs);\n\n    // Re-announce until the handshake settles, in case the host attached its\n    // listener after the first `ready`.\n    const reannounce = setInterval(postReady, READY_REANNOUNCE_INTERVAL_MS);\n\n    function finish(result: Result<FanvueBridge, BridgeConnectError>): void {\n      if (settled) return;\n      settled = true;\n      clearTimeout(timer);\n      clearInterval(reannounce);\n      // Only a failed handshake stops listening. After a `hello` the listener\n      // lives for the lifetime of the bridge: the host may answer more than\n      // one `ready` (it closes the prior port each time), and the bridge must\n      // adopt the newest port to stay on the one the host is serving.\n      if (result.isErr()) window.removeEventListener('message', onMessage);\n      resolve(result);\n    }\n\n    function onMessage(event: MessageEvent): void {\n      // The host is the only window that can hold this frame's port; anything\n      // else on the window channel belongs to another protocol.\n      if (event.source !== host) return;\n\n      const hello = bridgeHelloMessageSchema.safeParse(event.data);\n      if (!hello.success) return;\n\n      const port = event.ports[0];\n      if (!port) return;\n\n      if (bridge) {\n        bridge.adoptPort(port);\n        return;\n      }\n\n      bridge = createFanvueBridge({\n        port,\n        capabilities: hello.data.capabilities,\n        requestTimeoutMs: REQUEST_TIMEOUT_MS,\n      });\n      finish(ok(bridge));\n    }\n\n    window.addEventListener('message', onMessage);\n\n    function postReady(): void {\n      const ready: BridgeReadyMessage = { type: BRIDGE_READY_TYPE, v: BRIDGE_VERSION };\n      // Targets \"*\" because the app cannot know the host's origin before the\n      // handshake, and `ready` carries nothing but the protocol version.\n      host.postMessage(ready, '*');\n    }\n    postReady();\n  });\n}\n"],"mappings":";;;;;;;;;AASA,MAAa,iBAAiB;;;;;;;AAQ9B,MAAa,oBAAoB;;;;;;;AAQjC,MAAa,oBAAoB;;AAGjC,MAAa,uBAAuB;;AAGpC,MAAa,yBAAyB;;AAGtC,MAAa,yBAAyBA,MAAO,CAAC,qBAAqB,CAAC;;;;;;;;;AAapE,MAAa,wBAAwBA,MAAO;CAC1C;CACA;CACA;CACA;CACD,CAAC;;AAMF,MAAa,2BAA2BC,OAAS;CAC/C,MAAMC,QAAU,kBAAkB;CAClC,GAAGA,QAAAA,EAAyB;CAC7B,CAAC;;AAMF,MAAa,2BAA2BD,OAAS;CAC/C,MAAMC,QAAU,kBAAkB;CAClC,GAAGA,QAAAA,EAAyB;CAC5B,cAAcC,MAAQ,uBAAuB;CAC9C,CAAC;;;;;;;AAWF,MAAa,sBAAsBF,OAAS;CAC1C,GAAGC,QAAAA,EAAyB;CAC5B,IAAIE,QAAU,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG;CAC7B,MAAMF,QAAU,UAAU;CAC1B,YAAYE,QAAU,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG;CACrC,QAAQA,QAAU,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG;CACjC,SAASC,SAAW;CACrB,CAAC;;;;;;;AAWF,MAAa,uBAAuBJ,OAAS;CAC3C,GAAGC,QAAAA,EAAyB;CAC5B,IAAIE,QAAU,CAAC,IAAI,GAAG;CACtB,MAAMF,QAAU,WAAW;CAC3B,IAAII,SAAW;CACf,QAAQD,SAAW,CAAC,UAAU;CAC9B,OAAOJ,OAAS;EAAE,MAAM;EAAuB,SAASG,QAAU,CAAC,IAAI,KAAK;EAAE,CAAC,CAAC,UAAU;CAC3F,CAAC;;;;;;;;AAYF,MAAa,2BAA2BA,QAAU,CAAC,MAAM,oBAAoB;;;;;;;;AAS7E,MAAM,mCAAsD;CAAC;CAAW;CAAa;CAAU;;AAG/F,MAAM,8BAA8B;;AAGpC,SAAS,8BAA8B,KAAsB;AAC3D,QAAO,CAAC,iCAAiC,SAAS,IAAI,IAAI,CAAC,IAAI,WAAW,IAAI;;;;;;;;;AAUhF,MAAa,4BAA4BG,OAErCH,QAAU,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,EACzBI,MAAQ;CAACJ,QAAU,CAAC,IAAI,IAAI;CAAEK,QAAU,CAAC,QAAQ;CAAEH,SAAW;CAAC,CAAC,CACjE,CACA,QAAQ,eAAe,OAAO,KAAK,WAAW,CAAC,UAAU,6BAA6B,EACrF,SAAS,8BAA8B,4BAA4B,cACpE,CAAC,CACD,QAAQ,eAAe,OAAO,KAAK,WAAW,CAAC,MAAM,8BAA8B,EAAE,EACpF,SAAS,0CAA0C,iCAAiC,KAAK,KAAK,CAAC,+BAChG,CAAC;;AAGJ,MAAa,8BAA8BL,OAAS;CAClD,WAAW;CACX,YAAY,0BAA0B,UAAU;CACjD,CAAC;;;;;;;;;;;;;;;;AC/DF,SAAgB,mBAAmB,KAAgD;CACjF,MAAM,EAAE,cAAc,qBAAqB;CAC3C,MAAM,0BAAU,IAAI,KAA6B;CACjD,IAAI,kBAAkB;CACtB,IAAI,OAAO,IAAI;CAEf,SAAS,cAAc,OAA2B;EAChD,MAAM,SAAS,qBAAqB,UAAU,MAAM,KAAK;AACzD,MAAI,CAAC,OAAO,QAAS;EAErB,MAAM,WAAW,QAAQ,IAAI,OAAO,KAAK,GAAG;AAC5C,MAAI,CAAC,SAAU;AAEf,UAAQ,OAAO,OAAO,KAAK,GAAG;AAC9B,eAAa,SAAS,MAAM;AAC5B,WAAS,QAAQ,OAAO,KAAK;;CAG/B,SAAS,OAAO,MAAyB;AACvC,OAAK,iBAAiB,WAAW,cAAc;AAC/C,OAAK,OAAO;;AAEd,QAAO,KAAK;CAEZ,SAAS,UAAU,MAAyB;AAI1C,OAAK,OAAO;AACZ,SAAO;AACP,SAAO,KAAK;;CAGd,SAAS,IAAI,YAAuC;AAClD,SAAO,aAAa,SAAS,WAAW;;CAG1C,eAAe,QACb,YACA,QACA,SAC8C;AAC9C,MAAI,CAAC,IAAI,WAAW,CAClB,SAAA,GAAA,iBAAA,KAAW;GACT,MAAM;GACN,SAAS,+BAA+B,WAAW;GACpD,CAAC;AAGJ,qBAAmB;EACnB,MAAM,KAAK,GAAG,WAAW,GAAG;EAC5B,MAAM,UAAyB;GAC7B,GAAA;GACA;GACA,MAAM;GACN;GACA;GACA;GACD;AAED,MAAI;AACF,QAAK,YAAY,QAAQ;WAClB,OAAO;AACd,WAAA,GAAA,iBAAA,KAAW;IACT,MAAM;IACN,SAAS,2CAA2C,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;IAC3G,CAAC;;EAKJ,MAAM,UAAU,MAAM,IAAI,SAAgC,YAAY;GACpE,MAAM,QAAQ,iBAAiB;AAC7B,YAAQ,OAAO,GAAG;AAClB,YAAQ,KAAK;MACZ,iBAAiB;AACpB,WAAQ,IAAI,IAAI;IAAE;IAAS;IAAO,CAAC;IACnC;AACF,MAAI,YAAY,KACd,SAAA,GAAA,iBAAA,KAAW;GACT,MAAM;GACN,SAAS,4BAA4B,WAAW,GAAG,OAAO,WAAW,iBAAiB;GACvF,CAAC;AAGJ,MAAI,CAAC,QAAQ,GACX,SAAA,GAAA,iBAAA,KAAW;GACT,MAAM,QAAQ,OAAO,QAAQ;GAC7B,SAAS,QAAQ,OAAO,WAAW;GACpC,CAAC;AAGJ,UAAA,GAAA,iBAAA,IAAU,QAAQ,OAAO;;CAG3B,eAAe,MACb,WACA,YAC2C;EAG3C,MAAM,UAAU,4BAA4B,UAC1C,eAAe,KAAA,IAAY,EAAE,WAAW,GAAG;GAAE;GAAW;GAAY,CACrE;AACD,MAAI,CAAC,QAAQ,QACX,SAAA,GAAA,iBAAA,KAAW;GAAE,MAAM;GAAmB,SAASS,cAAgB,QAAQ,MAAM;GAAE,CAAC;AAIlF,UADe,MAAM,QAAQ,sBAAsB,wBAAwB,QAAQ,KAAK,EAC1E,UAAgB,KAAA,EAAU;;AAG1C,QAAO;EACL;EACA;EACA,WAAW,EAAE,OAAO;EACpB;EACD;;;;;AC1MH,MAAM,6BAA6B;;AAGnC,MAAM,qBAAqB;;;;;;;;;AAU3B,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDrC,SAAgB,oBACd,SACmD;CACnD,MAAM,YAAY,SAAS,aAAa;AAExC,KAAI,OAAO,WAAW,eAAe,OAAO,WAAW,OACrD,QAAO,QAAQ,SAAA,GAAA,iBAAA,KACT;EACF,MAAM;EACN,SACE;EACH,CAAC,CACH;CAEH,MAAM,OAAO,OAAO;AAEpB,QAAO,IAAI,SAAS,YAAY;EAC9B,IAAI,UAAU;EACd,IAAI,SAAsC;EAE1C,MAAM,QAAQ,iBAAiB;AAC7B,WAAA,GAAA,iBAAA,KACM;IACF,MAAM;IACN,SAAS,yDAAyD,UAAU;IAC7E,CAAC,CACH;KACA,UAAU;EAIb,MAAM,aAAa,YAAY,WAAW,6BAA6B;EAEvE,SAAS,OAAO,QAAwD;AACtE,OAAI,QAAS;AACb,aAAU;AACV,gBAAa,MAAM;AACnB,iBAAc,WAAW;AAKzB,OAAI,OAAO,OAAO,CAAE,QAAO,oBAAoB,WAAW,UAAU;AACpE,WAAQ,OAAO;;EAGjB,SAAS,UAAU,OAA2B;AAG5C,OAAI,MAAM,WAAW,KAAM;GAE3B,MAAM,QAAQ,yBAAyB,UAAU,MAAM,KAAK;AAC5D,OAAI,CAAC,MAAM,QAAS;GAEpB,MAAM,OAAO,MAAM,MAAM;AACzB,OAAI,CAAC,KAAM;AAEX,OAAI,QAAQ;AACV,WAAO,UAAU,KAAK;AACtB;;AAGF,YAAS,mBAAmB;IAC1B;IACA,cAAc,MAAM,KAAK;IACzB,kBAAkB;IACnB,CAAC;AACF,WAAA,GAAA,iBAAA,IAAU,OAAO,CAAC;;AAGpB,SAAO,iBAAiB,WAAW,UAAU;EAE7C,SAAS,YAAkB;GACzB,MAAM,QAA4B;IAAE,MAAM;IAAmB,GAAA;IAAmB;AAGhF,QAAK,YAAY,OAAO,IAAI;;AAE9B,aAAW;GACX"}

package/dist/core/index.d.ts

@@ -1,2 +1,2 @@
-import { A as DEFAULT_ISSUER_URL, C as OAuthConfig, D as TokenResponse, E as SessionVerifyError, F as HEADER_UPDATED_SESSION, M as DEFAULT_SCOPES, N as assertFanvueDomain, O as API_VERSION, P as BEARER_PREFIX, S as JsonParseError, T as SessionPayload, _ as refreshAccessToken, a as SessionPayloadSchema, b as EmbeddedAuthError, c as FanvueTheme, d as getThemeFromUrl, f as requestAuthorizationCodeOnBehalf, g as exchangeCodeForToken, h as createAuthorizationUrl, i as FanvueUserSchema, j as DEFAULT_PLATFORM_URL, k as DEFAULT_API_BASE_URL, l as exchangeSessionToken, m as verifySessionJwt, n as createFanvueClient, o as TokenResponseSchema, p as createSessionJwt, r as AuthorizeOnBehalfResponseSchema, s as safeJsonParse, t as FanvueClient, u as getSessionTokenFromUrl, v as ApiError, w as OAuthError, x as FanvueUser, y as EmbeddedAuthConfig } from "../index-pS9wR5yg.js";
+import { A as DEFAULT_ISSUER_URL, C as OAuthConfig, D as TokenResponse, E as SessionVerifyError, F as HEADER_UPDATED_SESSION, M as DEFAULT_SCOPES, N as assertFanvueDomain, O as API_VERSION, P as BEARER_PREFIX, S as JsonParseError, T as SessionPayload, _ as refreshAccessToken, a as SessionPayloadSchema, b as EmbeddedAuthError, c as FanvueTheme, d as getThemeFromUrl, f as requestAuthorizationCodeOnBehalf, g as exchangeCodeForToken, h as createAuthorizationUrl, i as FanvueUserSchema, j as DEFAULT_PLATFORM_URL, k as DEFAULT_API_BASE_URL, l as exchangeSessionToken, m as verifySessionJwt, n as createFanvueClient, o as TokenResponseSchema, p as createSessionJwt, r as AuthorizeOnBehalfResponseSchema, s as safeJsonParse, t as FanvueClient, u as getSessionTokenFromUrl, v as ApiError, w as OAuthError, x as FanvueUser, y as EmbeddedAuthConfig } from "../index-ClbZoV_Z.js";
 export { API_VERSION, ApiError, AuthorizeOnBehalfResponseSchema, BEARER_PREFIX, DEFAULT_API_BASE_URL, DEFAULT_ISSUER_URL, DEFAULT_PLATFORM_URL, DEFAULT_SCOPES, EmbeddedAuthConfig, EmbeddedAuthError, FanvueClient, FanvueTheme, FanvueUser, FanvueUserSchema, HEADER_UPDATED_SESSION, JsonParseError, OAuthConfig, OAuthError, SessionPayload, SessionPayloadSchema, SessionVerifyError, TokenResponse, TokenResponseSchema, assertFanvueDomain, createAuthorizationUrl, createFanvueClient, createSessionJwt, exchangeCodeForToken, exchangeSessionToken, getSessionTokenFromUrl, getThemeFromUrl, refreshAccessToken, requestAuthorizationCodeOnBehalf, safeJsonParse, verifySessionJwt };

package/dist/core/index.js

@@ -1,2 +1,3 @@
-import { C as assertFanvueDomain, S as DEFAULT_SCOPES, T as HEADER_UPDATED_SESSION, _ as safeJsonParse, a as requestAuthorizationCodeOnBehalf, b as DEFAULT_ISSUER_URL, c as createAuthorizationUrl, d as AuthorizeOnBehalfResponseSchema, f as FanvueUserSchema, i as getThemeFromUrl, l as exchangeCodeForToken, m as TokenResponseSchema, n as exchangeSessionToken, o as createSessionJwt, p as SessionPayloadSchema, r as getSessionTokenFromUrl, s as verifySessionJwt, t as createFanvueClient, u as refreshAccessToken, v as API_VERSION, w as BEARER_PREFIX, x as DEFAULT_PLATFORM_URL, y as DEFAULT_API_BASE_URL } from "../core-CvVOMyqr.js";
+import "../schemas-DbyHF7Xi.js";
+import { C as HEADER_UPDATED_SESSION, S as BEARER_PREFIX, _ as DEFAULT_API_BASE_URL, a as requestAuthorizationCodeOnBehalf, b as DEFAULT_SCOPES, c as createAuthorizationUrl, d as AuthorizeOnBehalfResponseSchema, f as FanvueUserSchema, g as API_VERSION, h as safeJsonParse, i as getThemeFromUrl, l as exchangeCodeForToken, m as TokenResponseSchema, n as exchangeSessionToken, o as createSessionJwt, p as SessionPayloadSchema, r as getSessionTokenFromUrl, s as verifySessionJwt, t as createFanvueClient, u as refreshAccessToken, v as DEFAULT_ISSUER_URL, x as assertFanvueDomain, y as DEFAULT_PLATFORM_URL } from "../core-BqdYUMrJ.js";
 export { API_VERSION, AuthorizeOnBehalfResponseSchema, BEARER_PREFIX, DEFAULT_API_BASE_URL, DEFAULT_ISSUER_URL, DEFAULT_PLATFORM_URL, DEFAULT_SCOPES, FanvueUserSchema, HEADER_UPDATED_SESSION, SessionPayloadSchema, TokenResponseSchema, assertFanvueDomain, createAuthorizationUrl, createFanvueClient, createSessionJwt, exchangeCodeForToken, exchangeSessionToken, getSessionTokenFromUrl, getThemeFromUrl, refreshAccessToken, requestAuthorizationCodeOnBehalf, safeJsonParse, verifySessionJwt };