@hosty-sdk/app 0.21.2 → 0.23.0

package/dist/session-types.js

@@ -0,0 +1,15 @@
+// Shared session types with no DOM or framework dependency.
+/**
+ * Recovery classification of an app session, per the platform identity error contract:
+ * - `not-present`: no token at all (recoverable — same handling as `expired`).
+ * - `active`: token revalidated OK.
+ * - `expired`: Core 401 — recoverable; re-authorize via the Shell (embedded) or Core `/open`
+ *   (standalone).
+ * - `forbidden`: Core 403 or a token minted for a different app — terminal; never
+ *   auto-redirect (it would loop).
+ * - `unavailable`: Core unreachable, slow, or answering garbage — transient; keep the
+ *   cookie and offer a retry.
+ * - `misconfigured`: the app itself is broken (no service token / no Core origin) — an
+ *   operator problem; signing in cannot fix it, so never offer a login.
+ */
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hosty-sdk/app",
-  "version": "0.21.2",
+  "version": "0.23.0",
   "description": "Hosty app auth: session state machine, recovery bridge, Core revalidation, and the embedder responder.",
   "license": "AGPL-3.0-only",
   "type": "module",
@@ -13,6 +13,10 @@
       "types": "./dist/server.d.ts",
       "default": "./dist/server.js"
     },
+    "./session/server": {
+      "types": "./dist/session-server.d.ts",
+      "default": "./dist/session-server.js"
+    },
     "./browser-auth": {
       "types": "./dist/browser-auth.d.ts",
       "default": "./dist/browser-auth.js"
@@ -92,7 +96,8 @@
   },
   "peerDependencies": {
     "next": "^16.3.8",
-    "react": "^19.2.8"
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8"
   },
   "peerDependenciesMeta": {
     "next": {
@@ -100,6 +105,9 @@
     },
     "react": {
       "optional": true
+    },
+    "react-dom": {
+      "optional": true
     }
   },
   "devDependencies": {