@hosty-sdk/app 0.12.0 → 0.13.0

package/dist/react.d.ts

@@ -1,3 +1,4 @@
+import type { ReactNode } from "react";
 import { type AppLaunchMode, type AppSessionStatus } from "./index.js";
 import { type HostyResolvedTheme, type HostyThemePreference } from "./theme.js";
 /**
@@ -25,11 +26,28 @@ export declare function HostLaunchBridge(): null;
  * express the decision.
  */
 export declare function useLaunchMode(): AppLaunchMode | null;
+export type AppIdentityBridgeState = {
+    kind: "recovering";
+} | {
+    kind: "active";
+} | {
+    kind: "signin";
+    openUrl: string | null;
+    embedded: boolean;
+} | {
+    kind: "denied";
+} | {
+    kind: "unavailable";
+} | {
+    kind: "misconfigured";
+};
 export interface AppIdentityBridgeProps {
     /** Probe endpoint returning a session status + recovery params. */
     probePath?: string;
     /** Code-exchange endpoint. */
     appCodePath?: string;
+    /** Optional app-owned rendering, including loading and active content. Recovery remains SDK-owned. */
+    renderState?: (state: AppIdentityBridgeState) => ReactNode;
 }
 /**
  * Mount once at the top of the root layout body. On first load it consumes a `?code` from
@@ -38,7 +56,7 @@ export interface AppIdentityBridgeProps {
  * redirect through Core `/open` when standalone, and cards only in fallback/terminal states
  * — never a login UI while recovery is still running.
  */
-export declare function AppIdentityBridge({ probePath, appCodePath, }?: AppIdentityBridgeProps): import("react").JSX.Element | null;
+export declare function AppIdentityBridge({ probePath, appCodePath, renderState, }?: AppIdentityBridgeProps): string | number | bigint | boolean | Iterable<ReactNode> | Promise<string | number | bigint | boolean | import("react").ReactPortal | import("react").ReactElement<unknown, string | import("react").JSXElementConstructor<any>> | Iterable<ReactNode> | null | undefined> | import("react").JSX.Element | null | undefined;
 export interface HostThemeBridgeProps {
     /**
      * Whether the operating system decides the theme while no shell has spoken — `true` unless the

package/dist/react.js

@@ -148,8 +148,11 @@ export function useLaunchMode() {
  * redirect through Core `/open` when standalone, and cards only in fallback/terminal states
  * — never a login UI while recovery is still running.
  */
-export function AppIdentityBridge({ probePath = "/api/auth/identity", appCodePath = "/api/auth/app-code", } = {}) {
-    const [ui, setUi] = useState({ kind: "hidden" });
+export function AppIdentityBridge({ probePath = "/api/auth/identity", appCodePath = "/api/auth/app-code", renderState, } = {}) {
+    const [ui, setUi] = useState({ kind: "recovering" });
+    // A launch code is single-use. Strict Mode replays the effect after the URL is cleaned;
+    // keep its exchange alive and let the replacement effect await the same response.
+    const exchangeRef = useRef(null);
     useEffect(() => {
         let cancelled = false;
         const controller = new AbortController();
@@ -198,7 +201,7 @@ export function AppIdentityBridge({ probePath = "/api/auth/identity", appCodePat
                 });
             switch (action.kind) {
                 case "none":
-                    setUi({ kind: "hidden" });
+                    setUi({ kind: "active" });
                     return;
                 case "post-auth-required": {
                     // The payload carries no secret, so targetOrigin "*" is safe — the Shell verifies
@@ -235,12 +238,18 @@ export function AppIdentityBridge({ probePath = "/api/auth/identity", appCodePat
         if (code) {
             url.searchParams.delete("code");
             window.history.replaceState(null, "", `${url.pathname}${url.search}${url.hash}`);
-            void fetch(appCodePath, {
-                method: "POST",
-                headers: { "Content-Type": "application/json" },
-                body: JSON.stringify({ code }),
-                signal: controller.signal,
-            })
+            exchangeRef.current = {
+                path: appCodePath,
+                response: fetch(appCodePath, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json" },
+                    body: JSON.stringify({ code }),
+                }),
+            };
+        }
+        const exchange = exchangeRef.current;
+        if (exchange && exchange.path === appCodePath) {
+            void exchange.response
                 .then((response) => {
                 if (cancelled) {
                     return;
@@ -250,11 +259,13 @@ export function AppIdentityBridge({ probePath = "/api/auth/identity", appCodePat
                     window.location.reload();
                 }
                 else {
+                    exchangeRef.current = null;
                     void probeAndRecover();
                 }
             })
                 .catch(() => {
                 if (!cancelled) {
+                    exchangeRef.current = null;
                     void probeAndRecover();
                 }
             });
@@ -267,7 +278,9 @@ export function AppIdentityBridge({ probePath = "/api/auth/identity", appCodePat
             controller.abort();
         };
     }, [probePath, appCodePath]);
-    if (ui.kind === "hidden") {
+    if (renderState)
+        return renderState(ui);
+    if (ui.kind === "recovering" || ui.kind === "active") {
         return null;
     }
     return (_jsx("div", { role: "status", style: barStyle, children: ui.kind === "signin" ? (_jsxs(_Fragment, { children: [_jsx("span", { children: "Your Hosty session ended." }), ui.openUrl ? (_jsx("a", { href: ui.openUrl, ...(ui.embedded ? { target: "_blank", rel: "noopener noreferrer" } : {}), style: actionStyle, children: "Sign in via Hosty" })) : (_jsx("span", { children: "Open this app from the machine running Hosty, or configure a public origin." }))] })) : ui.kind === "denied" ? (_jsx("span", { children: "You are signed in to Hosty but are not allowed to use this app." })) : ui.kind === "misconfigured" ? (_jsx("span", { children: "This app is not configured correctly on the host. Contact the administrator." })) : (_jsxs(_Fragment, { children: [_jsx("span", { children: "Can\u2019t reach Hosty right now." }), _jsx("button", { type: "button", onClick: () => window.location.reload(), style: actionStyle, children: "Retry" })] })) }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hosty-sdk/app",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Hosty app auth: session state machine, recovery bridge, Core revalidation, and the embedder responder.",
   "license": "AGPL-3.0-only",
   "type": "module",
@@ -46,7 +46,7 @@
     "server-only": "^0.0.1"
   },
   "peerDependencies": {
-    "next": "^16.3.3",
+    "next": "^16.3.4",
     "react": "^19.2.8"
   },
   "peerDependenciesMeta": {
@@ -61,7 +61,7 @@
     "@types/node": "^24",
     "@types/react": "^19.2.18",
     "typescript": "^6",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.0"
   },
   "repository": {
     "type": "git",