@octonodes/ui-extensions 0.2.12 → 0.2.16

package/README.md

@@ -102,7 +102,33 @@ Host the compiled JavaScript with CORS enabled for the Studio origin. Hash the e
 
 The five-minute `octo_app_` bearer is specific to the app installation, approved version, and opening user. Your backend must verify it on **every request** with `GET https://octonodes.com/api/apps/runtime/session`, then check that the returned `appId` equals your registered app ID. Use the verified workspace/user identity rather than values supplied by the browser. Never log the bearer or cache verification. Uninstall, consent changes, session expiry, and removed membership revoke subsequent access.
 
-For standalone pages, Octonode opens the registered application URL with `#octonode_session=…`. Read the fragment and immediately remove it using `history.replaceState`; keep the credential in memory. App backends can use `POST /api/apps/runtime/data` for consented project/table/row operations, and `POST /api/apps/runtime/executions` on the cloud gateway for workflow execution. Neither credential works as a general Octonode login. See the engine’s `docs/plugins.md` for request examples.
+## Hosted pages and routing
+
+Use `connectHostedApp()` once when the page mounts, subscribe to its snapshot, and
+call `dispose()` on unmount. Studio displays the hosted page inline and delivers
+short-lived sessions through an origin-checked, window-bound handshake. Tokens stay
+in memory. `app.fetch("/api/projects")` sends the bearer only to your own backend;
+that backend must still verify it with `connectAppServer` on every request.
+
+```ts
+import { connectHostedApp } from "@octonodes/ui-extensions/app";
+const app = connectHostedApp();
+const unsubscribe = app.subscribe(() => render(app.getSnapshot()));
+app.navigate("/products?sort=name");
+// On unmount: unsubscribe(); app.dispose();
+```
+
+Normal `history.pushState`, `replaceState`, and back/forward navigation work with
+browser routers. Embedded paths appear in Studio’s `appPath` query parameter;
+standalone pages use their own URL. Serve your app shell for nested page routes.
+Do not use Studio’s `/studio/apps/...` path as your app router basename.
+
+Development starts with zero data grants. Explicit administrator consent selects
+actions and projects for one hour; heartbeats extend only the ten-minute idle
+session, not the consent. Source edits on the same host retain consent; host or
+action changes clear it. See the [development guide](https://playbook.octonodes.com/docs/apps/development).
+
+For standalone fallback pages, Octonode opens the registered application URL with `#octonode_session=…`. Read the fragment and immediately remove it using `history.replaceState`; keep the credential in memory. App backends can use `POST /api/apps/runtime/data` for consented project/table/row operations, and `POST /api/apps/runtime/executions` on the cloud gateway for workflow execution. Neither credential works as a general Octonode login. See the engine’s `docs/plugins.md` for request examples.
 
 For legacy self-hosted v1 apps, developers host app backends and versioned extension assets themselves. Octonode-managed app hosting is reserved for a future paid service. App release metadata pins extension URLs and SHA-256 digests; publishing metadata does not deploy a backend.
 
@@ -139,9 +165,9 @@ The backend helper verifies the bearer on each `connectAppServer` call and uses
 ## End-to-end app guides
 
 The public Playbook is the source for the complete authoring path:
-[quickstart](https://playbook.octonodes.com/docs/apps-quickstart),
-[project configuration](https://playbook.octonodes.com/docs/apps-configuration),
-[SDK imports and permissions](https://playbook.octonodes.com/docs/apps-sdk),
-[hosting](https://playbook.octonodes.com/docs/apps-hosting), and
-[publishing and updates](https://playbook.octonodes.com/docs/apps-publishing).
+[quickstart](https://playbook.octonodes.com/docs/apps/quickstart),
+[project configuration](https://playbook.octonodes.com/docs/apps/configuration),
+[SDK imports and permissions](https://playbook.octonodes.com/docs/apps/sdk),
+[hosting](https://playbook.octonodes.com/docs/apps/hosting), and
+[publishing and updates](https://playbook.octonodes.com/docs/apps/publishing).
 The CLI scaffold supplies a runnable extension-only or full app example.

package/dist/app/constants.d.ts

@@ -0,0 +1,2 @@
+export declare const HOSTED_APP_PROTOCOL = "octonode-hosted-app/v1";
+//# sourceMappingURL=constants.d.ts.map

package/dist/app/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/app/constants.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,mBAAmB,2BAA2B,CAAC"}

package/dist/app/constants.js

@@ -0,0 +1,3 @@
+// Generated from packages/ui-extensions/src/app/constants.ts. Do not edit; run the Octonode SDK sync.
+export const HOSTED_APP_PROTOCOL = "octonode-hosted-app/v1";
+//# sourceMappingURL=constants.js.map

package/dist/app/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/app/constants.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC"}

package/dist/app/hosted.d.ts

@@ -0,0 +1,6 @@
+import type { HostedApp } from "./types.js";
+/** Only app-relative routes may cross the Studio boundary. */
+export declare function appRoute(value: unknown): string | null;
+/** Browser history remains the router. The bridge mirrors it into the Studio URL. */
+export declare function connectHostedApp(): HostedApp;
+//# sourceMappingURL=hosted.d.ts.map

package/dist/app/hosted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted.d.ts","sourceRoot":"","sources":["../../src/app/hosted.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAkB,MAAM,YAAY,CAAC;AAG5D,8DAA8D;AAC9D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAWtD;AAED,qFAAqF;AACrF,wBAAgB,gBAAgB,IAAI,SAAS,CAkJ5C"}

package/dist/app/hosted.js

@@ -0,0 +1,163 @@
+import { HOSTED_APP_PROTOCOL } from "./constants.js";
+/** Only app-relative routes may cross the Studio boundary. */
+export function appRoute(value) {
+    if (typeof value !== "string" || value.length > 4096 || !value.startsWith("/") || /[\\\s\p{Cc}]/u.test(value))
+        return null;
+    try {
+        const url = new URL(value, "https://app.invalid");
+        if (url.origin !== "https://app.invalid" || url.username || url.password || url.hash.includes("octonode_session"))
+            return null;
+        return url.pathname + url.search + url.hash;
+    }
+    catch {
+        return null;
+    }
+}
+/** Browser history remains the router. The bridge mirrors it into the Studio URL. */
+export function connectHostedApp() {
+    const fragment = new URLSearchParams(location.hash.slice(1));
+    const embedded = parent !== window;
+    // Only non-secret embedding coordinates survive a child reload.
+    let saved = null;
+    try {
+        if (embedded)
+            saved = sessionStorage.getItem("octonode.host");
+    }
+    catch {
+        /* Storage can be disabled in embedded browsers. */
+    }
+    const coordinates = saved ? new URLSearchParams(saved) : new URLSearchParams();
+    const origin = fragment.get("octonode_parent") ?? coordinates.get("origin");
+    const nonce = fragment.get("octonode_channel") ?? coordinates.get("channel");
+    if (embedded &&
+        (!origin ||
+            !nonce ||
+            new URL(origin).origin !== origin ||
+            !(origin.startsWith("https://") || /^http:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(origin))))
+        throw new Error("Open this app from Studio to establish a trusted session");
+    try {
+        if (embedded)
+            sessionStorage.setItem("octonode.host", new URLSearchParams({ origin: origin, channel: nonce }).toString());
+    }
+    catch {
+        /* The launch coordinates still establish this session. */
+    }
+    const token = embedded ? undefined : (fragment.get("octonode_session") ?? undefined);
+    if (fragment.has("octonode_parent") || token)
+        history.replaceState(history.state, "", appRoute(fragment.get("octonode_path")) ?? location.pathname + location.search);
+    const listeners = new Set();
+    let state = {
+        embedded,
+        status: token ? "ready" : embedded ? "connecting" : "standalone",
+        token,
+        path: location.pathname + location.search + location.hash,
+    };
+    let disposed = false;
+    const publish = (patch) => {
+        state = { ...state, ...patch };
+        listeners.forEach((listener) => listener());
+    };
+    const send = (message) => {
+        if (embedded && !disposed)
+            parent.postMessage({ ...message, octonode: HOSTED_APP_PROTOCOL, channel: nonce }, origin);
+    };
+    const push = history.pushState;
+    const replace = history.replaceState;
+    const routeChanged = (replaceRoute = false) => {
+        const path = location.pathname + location.search + location.hash;
+        publish({ path });
+        send({ type: "navigate", path, replace: replaceRoute });
+    };
+    const pushRoute = function (...args) {
+        push.apply(history, args);
+        routeChanged();
+    };
+    const replaceRoute = function (...args) {
+        replace.apply(history, args);
+        routeChanged(true);
+    };
+    history.pushState = pushRoute;
+    history.replaceState = replaceRoute;
+    const popped = () => routeChanged(true);
+    const receive = (event) => {
+        const message = event.data;
+        if (!embedded ||
+            event.source !== parent ||
+            event.origin !== origin ||
+            message?.octonode !== HOSTED_APP_PROTOCOL ||
+            message.channel !== nonce)
+            return;
+        if (message.type === "session" &&
+            typeof message.token === "string" &&
+            /^octo_app_[A-Za-z0-9_-]{43}$/.test(message.token) &&
+            Number.isFinite(message.expiresAt) &&
+            message.expiresAt > Date.now()) {
+            publish({ status: "ready", token: message.token, expiresAt: message.expiresAt });
+            send({ type: "ack" });
+        }
+        if (message.type === "expired")
+            publish({ status: "expired", token: undefined });
+        if (message.type === "route") {
+            const path = appRoute(message.path);
+            if (path && path !== state.path) {
+                replace.call(history, history.state, "", path);
+                publish({ path });
+                dispatchEvent(new PopStateEvent("popstate", { state: history.state }));
+            }
+        }
+    };
+    addEventListener("message", receive);
+    addEventListener("popstate", popped);
+    addEventListener("hashchange", popped);
+    const heartbeat = setInterval(() => {
+        if (state.expiresAt && state.expiresAt <= Date.now())
+            publish({ status: "expired", token: undefined });
+        send({ type: "ready" });
+    }, 1000);
+    send({ type: "ready" });
+    return {
+        getSnapshot: () => state,
+        subscribe(listener) {
+            listeners.add(listener);
+            return () => {
+                listeners.delete(listener);
+            };
+        },
+        navigate(path, options = {}) {
+            const route = appRoute(path);
+            if (!route)
+                throw new Error("Expected an app-relative route");
+            history[options.replace ? "replaceState" : "pushState"](null, "", route);
+            dispatchEvent(new PopStateEvent("popstate"));
+        },
+        async fetch(input, init) {
+            const url = new URL(input, location.href);
+            if (url.origin !== location.origin)
+                throw new Error("App bearer may only be sent to the app's own backend");
+            if (!state.token || (state.expiresAt && state.expiresAt <= Date.now()))
+                throw new Error("App session expired. Reopen the app from Studio.");
+            const headers = new Headers(init?.headers);
+            headers.set("authorization", `Bearer ${state.token}`);
+            const response = await fetch(url, { ...init, headers, redirect: "error" });
+            if (response.status === 401) {
+                publish({ status: "expired", token: undefined });
+                send({ type: "ready" });
+            }
+            return response;
+        },
+        dispose() {
+            disposed = true;
+            clearInterval(heartbeat);
+            removeEventListener("message", receive);
+            removeEventListener("popstate", popped);
+            removeEventListener("hashchange", popped);
+            if (history.pushState === pushRoute)
+                history.pushState = push;
+            if (history.replaceState === replaceRoute)
+                history.replaceState = replace;
+            listeners.clear();
+            state = { ...state, token: undefined };
+        },
+    };
+}
+//# sourceMappingURL=hosted.js.map

package/dist/app/hosted.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted.js","sourceRoot":"","sources":["../../src/app/hosted.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,8DAA8D;AAC9D,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3G,OAAO,IAAI,CAAC;IACd,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;QAClD,IAAI,GAAG,CAAC,MAAM,KAAK,qBAAqB,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YAC/G,OAAO,IAAI,CAAC;QACd,OAAO,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,MAAM,KAAK,MAAM,CAAC;IACnC,gEAAgE;IAChE,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,QAAQ;YAAE,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;IAC/E,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7E,IACE,QAAQ;QACR,CAAC,CAAC,MAAM;YACN,CAAC,KAAK;YACN,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,MAAM;YACjC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,4CAA4C,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAEhG,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,IAAI,QAAQ;YACV,cAAc,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,MAAO,EAAE,OAAO,EAAE,KAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClH,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC,CAAC;IACrF,IAAI,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,KAAK;QAC1C,OAAO,CAAC,YAAY,CAClB,OAAO,CAAC,KAAK,EACb,EAAE,EACF,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAC/E,CAAC;IACJ,MAAM,SAAS,GAAG,IAAI,GAAG,EAAc,CAAC;IACxC,IAAI,KAAK,GAAmB;QAC1B,QAAQ;QACR,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY;QAChE,KAAK;QACL,IAAI,EAAE,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI;KAC1D,CAAC;IACF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,OAAO,GAAG,CAAC,KAA8B,EAAE,EAAE;QACjD,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC;QAC/B,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,OAAgC,EAAE,EAAE;QAChD,IAAI,QAAQ,IAAI,CAAC,QAAQ;YACvB,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,MAAO,CAAC,CAAC;IAC/F,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC;IACrC,MAAM,YAAY,GAAG,CAAC,YAAY,GAAG,KAAK,EAAE,EAAE;QAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC;QACjE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAClB,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC;IACF,MAAM,SAAS,GAAyB,UAAU,GAAG,IAAI;QACvD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1B,YAAY,EAAE,CAAC;IACjB,CAAC,CAAC;IACF,MAAM,YAAY,GAA4B,UAAU,GAAG,IAAI;QAC7D,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7B,YAAY,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC;IACF,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAC9B,OAAO,CAAC,YAAY,GAAG,YAAY,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,CAAC,KAAmB,EAAE,EAAE;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;QAC3B,IACE,CAAC,QAAQ;YACT,KAAK,CAAC,MAAM,KAAK,MAAM;YACvB,KAAK,CAAC,MAAM,KAAK,MAAM;YACvB,OAAO,EAAE,QAAQ,KAAK,mBAAmB;YACzC,OAAO,CAAC,OAAO,KAAK,KAAK;YAEzB,OAAO;QACT,IACE,OAAO,CAAC,IAAI,KAAK,SAAS;YAC1B,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YACjC,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YAClD,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;YAClC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAC9B,CAAC;YACD,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;YACjF,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACjF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,IAAI,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;gBAC/C,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClB,aAAa,CAAC,IAAI,aAAa,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACrC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACrC,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;QACjC,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACvG,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1B,CAAC,EAAE,IAAI,CAAC,CAAC;IACT,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACxB,OAAO;QACL,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK;QACxB,SAAS,CAAC,QAAQ;YAChB,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,GAAG,EAAE;gBACV,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,EAAE;YACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAC9D,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;YACzE,aAAa,CAAC,IAAI,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI;YACrB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC5G,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACtD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;gBACjD,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1B,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO;YACL,QAAQ,GAAG,IAAI,CAAC;YAChB,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACxC,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACxC,mBAAmB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAC1C,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;gBAAE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;YAC9D,IAAI,OAAO,CAAC,YAAY,KAAK,YAAY;gBAAE,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC;YAC1E,SAAS,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/app/index.d.ts

@@ -1,5 +1,8 @@
 import type { AppContext } from "./types.js";
 export type { AppBridgeRequest, AppBridgeResponse, AppContext, AppExecution, AppGrant, AppProject } from "./types.js";
+export type { HostedApp, HostedAppState } from "./types.js";
+export { connectHostedApp, appRoute } from "./hosted.js";
+export { HOSTED_APP_PROTOCOL } from "./constants.js";
 /** Connects an installed extension to its live workspace and project grants. */
 export declare function connectApp(): Promise<AppContext>;
 //# sourceMappingURL=index.d.ts.map

package/dist/app/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/app/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAuC,UAAU,EAAY,MAAM,YAAY,CAAC;AAE5F,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA8CtH,gFAAgF;AAChF,wBAAsB,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,CAUtD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/app/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAuC,UAAU,EAAY,MAAM,YAAY,CAAC;AAE5F,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACtH,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AA8CrD,gFAAgF;AAChF,wBAAsB,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,CAUtD"}

package/dist/app/index.js

@@ -1,6 +1,8 @@
 // Generated from packages/ui-extensions/src/app/index.ts. Do not edit; run the Octonode SDK sync.
 import { getAppSession, UI_EXTENSION_API_VERSION } from "../index.js";
 import { appContext } from "./project.js";
+export { connectHostedApp, appRoute } from "./hosted.js";
+export { HOSTED_APP_PROTOCOL } from "./constants.js";
 function request(operation, body) {
     getAppSession();
     if (parent === window)

package/dist/app/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/app/index.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAK1C,SAAS,OAAO,CAAI,SAAwC,EAAE,IAAc;IAC1E,aAAa,EAAE,CAAC;IAChB,IAAI,MAAM,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACtC,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACpF,MAAM,KAAK,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,MAAM,OAAO,GAAG,CAAC,KAAmB,EAAE,EAAE;YACtC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAyC,CAAC;YAChE,IACE,KAAK,CAAC,MAAM,KAAK,MAAM;gBACvB,OAAO,EAAE,QAAQ,KAAK,cAAc;gBACpC,OAAO,CAAC,IAAI,KAAK,cAAc;gBAC/B,OAAO,CAAC,UAAU,KAAK,wBAAwB;gBAC/C,OAAO,CAAC,SAAS,KAAK,SAAS;gBAE/B,OAAO;YACT,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,mBAAmB,CAAC,EAAE,OAAO,CAAC,KAAU,CAAC,CAAC;QACvG,CAAC,CAAC;QACF,SAAS,MAAM,CAAC,KAAa,EAAE,KAAS;YACtC,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACxC,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;gBACpB,OAAO,CAAC,KAAU,CAAC,CAAC;QAC3B,CAAC;QACD,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrC,SAAS,IAAI;YACX,MAAM,CAAC,WAAW,CAChB;gBACE,QAAQ,EAAE,cAAc;gBACxB,UAAU,EAAE,wBAAwB;gBACpC,IAAI,EAAE,aAAa;gBACnB,SAAS;gBACT,SAAS;gBACT,IAAI;aACsB,EAC5B,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAM3B,SAAS,CAAC,CAAC;IACd,OAAO,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/app/index.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAK1C,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,SAAS,OAAO,CAAI,SAAwC,EAAE,IAAc;IAC1E,aAAa,EAAE,CAAC;IAChB,IAAI,MAAM,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACtC,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACpF,MAAM,KAAK,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,MAAM,OAAO,GAAG,CAAC,KAAmB,EAAE,EAAE;YACtC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAyC,CAAC;YAChE,IACE,KAAK,CAAC,MAAM,KAAK,MAAM;gBACvB,OAAO,EAAE,QAAQ,KAAK,cAAc;gBACpC,OAAO,CAAC,IAAI,KAAK,cAAc;gBAC/B,OAAO,CAAC,UAAU,KAAK,wBAAwB;gBAC/C,OAAO,CAAC,SAAS,KAAK,SAAS;gBAE/B,OAAO;YACT,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,mBAAmB,CAAC,EAAE,OAAO,CAAC,KAAU,CAAC,CAAC;QACvG,CAAC,CAAC;QACF,SAAS,MAAM,CAAC,KAAa,EAAE,KAAS;YACtC,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACxC,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;gBACpB,OAAO,CAAC,KAAU,CAAC,CAAC;QAC3B,CAAC;QACD,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrC,SAAS,IAAI;YACX,MAAM,CAAC,WAAW,CAChB;gBACE,QAAQ,EAAE,cAAc;gBACxB,UAAU,EAAE,wBAAwB;gBACpC,IAAI,EAAE,aAAa;gBACnB,SAAS;gBACT,SAAS;gBACT,IAAI;aACsB,EAC5B,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAM3B,SAAS,CAAC,CAAC;IACd,OAAO,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC"}

package/dist/app/server.d.ts

@@ -1,5 +1,9 @@
 import type { AppContext } from "./types.js";
 export type { AppContext, AppExecution, AppGrant, AppProject } from "./types.js";
+export declare class AppRequestError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
 /** Verify the browser's app bearer before using it from a developer-hosted backend. */
 export declare function connectAppServer(token: string, options: {
     appId: string;

package/dist/app/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/app/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAY,MAAM,YAAY,CAAC;AAEvD,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEjF,uFAAuF;AACvF,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9D,OAAO,CAAC,UAAU,CAAC,CAgCrB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/app/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAY,MAAM,YAAY,CAAC;AAEvD,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEjF,qBAAa,eAAgB,SAAQ,KAAK;aAGtB,MAAM,EAAE,MAAM;gBAD9B,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM;CAKjC;AAED,uFAAuF;AACvF,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9D,OAAO,CAAC,UAAU,CAAC,CAoCrB"}

package/dist/app/server.js

@@ -1,9 +1,17 @@
 // Generated from packages/ui-extensions/src/app/server.ts. Do not edit; run the Octonode SDK sync.
 import { appContext } from "./project.js";
+export class AppRequestError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = "AppRequestError";
+    }
+}
 /** Verify the browser's app bearer before using it from a developer-hosted backend. */
 export async function connectAppServer(token, options) {
     if (!/^octo_app_[A-Za-z0-9_-]{43}$/.test(token))
-        throw new Error("Invalid app session");
+        throw new AppRequestError("Invalid app session", 401);
     const base = new URL(options.baseUrl);
     if (base.protocol !== "https:" && !(base.protocol === "http:" && ["localhost", "127.0.0.1"].includes(base.hostname)))
         throw new Error("Octonode API URL must use HTTPS");
@@ -14,6 +22,8 @@ export async function connectAppServer(token, options) {
                 ? "/api/apps/runtime/data"
                 : "/api/apps/runtime/executions";
         const response = await fetch(new URL(path, base), {
+            redirect: "manual",
+            signal: AbortSignal.timeout(15_000),
             method: operation === "context" ? "GET" : "POST",
             headers: {
                 authorization: `Bearer ${token}`,
@@ -21,13 +31,15 @@ export async function connectAppServer(token, options) {
             },
             ...(operation === "context" ? {} : { body: JSON.stringify(body) }),
         });
+        if (response.status >= 300 && response.status < 400)
+            throw new AppRequestError("Octonode app API redirects are not allowed", 502);
         if (!response.ok)
-            throw new Error(`Octonode app request failed (${response.status})`);
+            throw new AppRequestError(`Octonode app request failed (${response.status})`, response.status);
         return response.json();
     };
     const verified = await request("context");
     if (verified.appId !== options.appId)
-        throw new Error("App session belongs to another app");
+        throw new AppRequestError("App session belongs to another app", 403);
     return appContext({ ...verified, projectId: options.projectId }, verified, request);
 }
 //# sourceMappingURL=server.js.map

package/dist/app/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/app/server.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,OAAO,EAAE,UAAU,EAAmB,MAAM,cAAc,CAAC;AAK3D,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,OAA+D;IAE/D,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClH,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAe,KAAK,EAAK,SAA8C,EAAE,IAAc,EAAc,EAAE;QAClH,MAAM,IAAI,GACR,SAAS,KAAK,SAAS;YACrB,CAAC,CAAC,2BAA2B;YAC7B,CAAC,CAAC,SAAS,KAAK,MAAM;gBACpB,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,8BAA8B,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE;YAChD,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;YAChD,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aAC3E;YACD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;SACnE,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACtF,OAAO,QAAQ,CAAC,IAAI,EAAgB,CAAC;IACvC,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAM3B,SAAS,CAAC,CAAC;IACd,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC5F,OAAO,UAAU,CAAC,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AACtF,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/app/server.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,OAAO,EAAE,UAAU,EAAmB,MAAM,cAAc,CAAC;AAK3D,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAGtB;IAFlB,YACE,OAAe,EACC,MAAc;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,WAAM,GAAN,MAAM,CAAQ;QAG9B,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,OAA+D;IAE/D,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IACvG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClH,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAe,KAAK,EAAK,SAA8C,EAAE,IAAc,EAAc,EAAE;QAClH,MAAM,IAAI,GACR,SAAS,KAAK,SAAS;YACrB,CAAC,CAAC,2BAA2B;YAC7B,CAAC,CAAC,SAAS,KAAK,MAAM;gBACpB,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,8BAA8B,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE;YAChD,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;YACnC,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;YAChD,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aAC3E;YACD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;SACnE,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;YACjD,MAAM,IAAI,eAAe,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,eAAe,CAAC,gCAAgC,QAAQ,CAAC,MAAM,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjH,OAAO,QAAQ,CAAC,IAAI,EAAgB,CAAC;IACvC,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAM3B,SAAS,CAAC,CAAC;IACd,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK;QAAE,MAAM,IAAI,eAAe,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;IAC3G,OAAO,UAAU,CAAC,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AACtF,CAAC"}

package/dist/app/types.d.ts

@@ -1,4 +1,20 @@
 import type { AppSession } from "../index.js";
+export type HostedAppState = {
+    embedded: boolean;
+    status: "connecting" | "ready" | "standalone" | "expired";
+    token?: string;
+    expiresAt?: number;
+    path: string;
+};
+export type HostedApp = {
+    getSnapshot(): HostedAppState;
+    subscribe(listener: () => void): () => void;
+    navigate(path: string, options?: {
+        replace?: boolean;
+    }): void;
+    fetch(input: string, init?: RequestInit): Promise<Response>;
+    dispose(): void;
+};
 export type AppGrant = {
     action: "projects:read" | "data:read" | "data:write" | "workflows:run";
     projectId: string;

package/dist/app/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/app/types.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,MAAM,QAAQ,GAAG;IACrB,MAAM,EAAE,eAAe,GAAG,WAAW,GAAG,YAAY,GAAG,eAAe,CAAC;IACvE,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,GAAG,aAAa,CAAC;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,IAAI,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,MAAM,EAAE;QACN,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;QACzB,IAAI,EAAE;YACJ,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBAAE,MAAM,CAAC,EAAE,MAAM,CAAC;gBAAC,KAAK,CAAC,EAAE,MAAM,CAAA;aAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YACrF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YACzE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YACjH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;SAC1D,CAAC;KACH,CAAC;IACF,EAAE,EAAE;QACF,GAAG,CACD,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,GAClD,OAAO,CAAC,YAAY,CAAC,CAAC;KAC1B,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3B,cAAc,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC5B,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,UAAU,GAAG,SAAS,CAAC;IAChC,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,GAAG,CAAC;IAChB,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,SAAS,GAAG,MAAM,GAAG,cAAc,CAAC;IAC/C,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,GAAG,CAAC;IAChB,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/app/types.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,YAAY,GAAG,OAAO,GAAG,YAAY,GAAG,SAAS,CAAC;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AACF,MAAM,MAAM,SAAS,GAAG;IACtB,WAAW,IAAI,cAAc,CAAC;IAC9B,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9D,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D,OAAO,IAAI,IAAI,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACrB,MAAM,EAAE,eAAe,GAAG,WAAW,GAAG,YAAY,GAAG,eAAe,CAAC;IACvE,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,GAAG,aAAa,CAAC;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,IAAI,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,MAAM,EAAE;QACN,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;QACzB,IAAI,EAAE;YACJ,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBAAE,MAAM,CAAC,EAAE,MAAM,CAAC;gBAAC,KAAK,CAAC,EAAE,MAAM,CAAA;aAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YACrF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YACzE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YACjH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;SAC1D,CAAC;KACH,CAAC;IACF,EAAE,EAAE;QACF,GAAG,CACD,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,GAClD,OAAO,CAAC,YAAY,CAAC,CAAC;KAC1B,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3B,cAAc,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC5B,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,UAAU,GAAG,SAAS,CAAC;IAChC,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,GAAG,CAAC;IAChB,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,SAAS,GAAG,MAAM,GAAG,cAAc,CAAC;IAC/C,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,GAAG,CAAC;IAChB,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@octonodes/ui-extensions",
-  "version": "0.2.12",
+  "version": "0.2.16",
   "type": "module",
   "license": "MIT",
   "description": "Portable contracts and React primitives for Octonode plugin UI extensions.",