@hosty-sdk/app 0.1.1 → 0.1.2

package/dist/embedder.js

@@ -6,7 +6,7 @@
 // re-run your normal open flow for that app (which mints a fresh launch code), rate-limited.
 // The re-open must take the full launch-code path — an "already open → reuse the URL
 // without a code" optimization must not short-circuit recovery.
-import { AUTH_REQUIRED_INTENT_TYPE } from "./index";
+import { AUTH_REQUIRED_INTENT_TYPE } from "./index.js";
 /**
  * Verifies that a `message` event is a genuine auth-required intent from the active app
  * frame. Every check is about facts only the embedder can know:

package/dist/react.d.ts

@@ -1,4 +1,4 @@
-import { type AppSessionStatus } from "./index";
+import { type AppSessionStatus } from "./index.js";
 /**
  * Tolerant probe reader: accepts both identity-route shapes in the fleet — a top-level
  * `status` (marketplace/telemetry) and a nested `appSession.status` (demo-app,

package/dist/react.js

@@ -4,7 +4,7 @@ import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-run
 // cards. Prop-less by design: the app id and browser-reachable Core origin arrive in the
 // probe response's `recovery` field (request-time values, never build-time props).
 import { useEffect, useState } from "react";
-import { buildCoreOpenUrl, decideRecoveryAction, detectLaunchMode, readRecoveryParams, } from "./index";
+import { buildCoreOpenUrl, decideRecoveryAction, detectLaunchMode, readRecoveryParams, } from "./index.js";
 // Once-per-tab guard so a standalone app that returns from Core still unauthorized does
 // not bounce through /open forever. Cleared on a successful code exchange.
 const RECOVERY_GUARD_KEY = "hosty.auth.recovery-attempted";

package/dist/server.d.ts

@@ -1,5 +1,5 @@
 import "server-only";
-import { type AppSessionFailureStatus, type AppSessionStatus, type SessionRecoveryParams } from "./index";
+import { type AppSessionFailureStatus, type AppSessionStatus, type SessionRecoveryParams } from "./index.js";
 /** Per-app parameters: everything that legitimately diverges between apps stays a
  * parameter — cookie namespaces and role models are per-app by decision, never unified. */
 export interface HostyAppConfig {

package/dist/server.js

@@ -1,7 +1,7 @@
 // Server slice: Next route-handler factories and Core revalidation. Never reaches a client
 // bundle — the service token lives here.
 import "server-only";
-import { classifyRevalidationHttpStatus, } from "./index";
+import { classifyRevalidationHttpStatus, } from "./index.js";
 // Core runs on the same host as the app services, so a short budget is plenty; a stalled
 // call must not hold a route open indefinitely.
 const CORE_AUTH_TIMEOUT_MS = 1_500;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hosty-sdk/app",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Hosty app auth: session state machine, recovery bridge, Core revalidation, and the embedder responder.",
   "license": "AGPL-3.0-only",
   "type": "module",
@@ -24,7 +24,7 @@
   },
   "scripts": {
     "test": "vitest run",
-    "build": "tsc -p tsconfig.build.json"
+    "build": "tsc -p tsconfig.build.json && node scripts/fix-dist-extensions.mjs"
   },
   "dependencies": {
     "server-only": "^0.0.1"