@hosty-sdk/app 0.1.1 → 0.2.0

package/dist/embedder.js

@@ -6,7 +6,7 @@
 // re-run your normal open flow for that app (which mints a fresh launch code), rate-limited.
 // The re-open must take the full launch-code path — an "already open → reuse the URL
 // without a code" optimization must not short-circuit recovery.
-import { AUTH_REQUIRED_INTENT_TYPE } from "./index";
+import { AUTH_REQUIRED_INTENT_TYPE } from "./index.js";
 /**
  * Verifies that a `message` event is a genuine auth-required intent from the active app
  * frame. Every check is about facts only the embedder can know:

package/dist/react.d.ts

@@ -1,4 +1,4 @@
-import { type AppSessionStatus } from "./index";
+import { type AppSessionStatus } from "./index.js";
 /**
  * Tolerant probe reader: accepts both identity-route shapes in the fleet — a top-level
  * `status` (marketplace/telemetry) and a nested `appSession.status` (demo-app,

package/dist/react.js

@@ -4,7 +4,7 @@ import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-run
 // cards. Prop-less by design: the app id and browser-reachable Core origin arrive in the
 // probe response's `recovery` field (request-time values, never build-time props).
 import { useEffect, useState } from "react";
-import { buildCoreOpenUrl, decideRecoveryAction, detectLaunchMode, readRecoveryParams, } from "./index";
+import { buildCoreOpenUrl, decideRecoveryAction, detectLaunchMode, readRecoveryParams, } from "./index.js";
 // Once-per-tab guard so a standalone app that returns from Core still unauthorized does
 // not bounce through /open forever. Cleared on a successful code exchange.
 const RECOVERY_GUARD_KEY = "hosty.auth.recovery-attempted";

package/dist/server.d.ts

@@ -1,5 +1,5 @@
 import "server-only";
-import { type AppSessionFailureStatus, type AppSessionStatus, type SessionRecoveryParams } from "./index";
+import { type AppSessionFailureStatus, type AppSessionStatus, type SessionRecoveryParams } from "./index.js";
 /** Per-app parameters: everything that legitimately diverges between apps stays a
  * parameter — cookie namespaces and role models are per-app by decision, never unified. */
 export interface HostyAppConfig {
@@ -22,11 +22,21 @@ export interface HostIdentity {
     appRole: string | null;
     expiresAt: string | null;
 }
+/** Structured detail for a failed resolution: the Core HTTP status (null when Core was
+ * never reached) plus a machine-readable code and human-readable message. Codes pass
+ * through from Core's error body where one exists; classification never branches on them
+ * (decision 10) — they exist for diagnostics and API responses. */
+export interface ResolutionError {
+    status: number | null;
+    code: string;
+    message: string;
+}
 export type AppSessionResolution = {
     status: "active";
     identity: HostIdentity;
 } | {
     status: AppSessionFailureStatus;
+    error?: ResolutionError;
 };
 export declare function getAppId(config: HostyAppConfig): string;
 export declare function getCoreOrigin(): string | null;

package/dist/server.js

@@ -1,7 +1,7 @@
 // Server slice: Next route-handler factories and Core revalidation. Never reaches a client
 // bundle — the service token lives here.
 import "server-only";
-import { classifyRevalidationHttpStatus, } from "./index";
+import { classifyRevalidationHttpStatus, } from "./index.js";
 // Core runs on the same host as the app services, so a short budget is plenty; a stalled
 // call must not hold a route open indefinitely.
 const CORE_AUTH_TIMEOUT_MS = 1_500;
@@ -91,7 +91,12 @@ export async function resolveAppSession(token, config) {
     const serviceToken = getServiceToken();
     const coreOrigin = getCoreOrigin();
     if (!serviceToken || !coreOrigin) {
-        return { status: "misconfigured" };
+        return {
+            status: "misconfigured",
+            error: serviceToken
+                ? { status: null, code: "core_origin_missing", message: "HOSTY_CORE_ORIGIN is not configured." }
+                : { status: null, code: "app_service_token_missing", message: "HOSTY_APP_SERVICE_TOKEN is not configured." },
+        };
     }
     const now = Date.now();
     const cached = revalidationCache.get(token);
@@ -120,7 +125,10 @@ async function revalidateWithCore(token, coreOrigin, serviceToken, config) {
         endpoint = new URL("/api/auth/apps/revalidate", coreOrigin).toString();
     }
     catch {
-        return { status: "misconfigured" };
+        return {
+            status: "misconfigured",
+            error: { status: null, code: "core_origin_invalid", message: "HOSTY_CORE_ORIGIN is not a valid URL." },
+        };
     }
     let response;
     try {
@@ -135,12 +143,28 @@ async function revalidateWithCore(token, coreOrigin, serviceToken, config) {
             signal: AbortSignal.timeout(CORE_AUTH_TIMEOUT_MS),
         });
     }
-    catch {
+    catch (error) {
         // Network failure or timeout — transient either way; never cached.
-        return { status: "unavailable" };
+        const timeout = error instanceof DOMException && (error.name === "AbortError" || error.name === "TimeoutError");
+        return {
+            status: "unavailable",
+            error: {
+                status: null,
+                code: timeout ? "core_revalidation_timeout" : "app_session_revalidation_error",
+                message: error instanceof Error ? error.message : "Core identity revalidation failed.",
+            },
+        };
     }
     if (!response.ok) {
-        return { status: classifyRevalidationHttpStatus(response.status) };
+        const body = (await response.json().catch(() => null));
+        return {
+            status: classifyRevalidationHttpStatus(response.status),
+            error: {
+                status: response.status,
+                code: readErrorField(body, "code") ?? "app_session_revalidation_failed",
+                message: readErrorField(body, "message") ?? `Core revalidation returned HTTP ${response.status}.`,
+            },
+        };
     }
     let payload;
     try {
@@ -148,12 +172,18 @@ async function revalidateWithCore(token, coreOrigin, serviceToken, config) {
     }
     catch {
         // A non-JSON / truncated body means the session is unverifiable, not proof it is invalid.
-        return { status: "unavailable" };
+        return {
+            status: "unavailable",
+            error: { status: response.status, code: "core_response_invalid", message: "Core returned an unreadable revalidation body." },
+        };
     }
     const appId = readString(payload?.appId);
     if (appId && appId !== getAppId(config)) {
         // A token minted for a different app is Core's token_app_mismatch — terminal, like 403.
-        return { status: "forbidden" };
+        return {
+            status: "forbidden",
+            error: { status: response.status, code: "app_identity_app_mismatch", message: "Identity token was issued for a different app." },
+        };
     }
     const userId = readString(payload?.userId);
     // An "active" grant without a subject is unusable; classify it as recoverable so a probe
@@ -329,6 +359,16 @@ function readCookie(cookieHeader, name) {
     }
     return null;
 }
+function readErrorField(payload, field) {
+    if (!payload || typeof payload !== "object") {
+        return null;
+    }
+    const nested = payload.error;
+    if (nested && typeof nested === "object") {
+        return readString(nested[field]);
+    }
+    return readString(payload[field]);
+}
 function readString(value) {
     return typeof value === "string" && value.trim() ? value.trim() : null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hosty-sdk/app",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Hosty app auth: session state machine, recovery bridge, Core revalidation, and the embedder responder.",
   "license": "AGPL-3.0-only",
   "type": "module",
@@ -24,7 +24,7 @@
   },
   "scripts": {
     "test": "vitest run",
-    "build": "tsc -p tsconfig.build.json"
+    "build": "tsc -p tsconfig.build.json && node scripts/fix-dist-extensions.mjs"
   },
   "dependencies": {
     "server-only": "^0.0.1"