@picked/app-kit 0.0.0-stage → 0.0.1-dev.1794447047683

package/dist/cjs/oauth.js

@@ -0,0 +1,56 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@picked/app-protocol");var t=600,n=`picked-app:oauth-result`,r=`picked-app:oauth-start-ready`,i=`picked-app:oauth-start`,a=`/oauth/start`,o=12;async function s(n,r){let i={...r,exp:Math.floor(Date.now()/1e3)+t},a=globalThis.crypto.getRandomValues(new Uint8Array(o)),s=await globalThis.crypto.subtle.encrypt({name:`AES-GCM`,iv:a},await(0,e.deriveSecretKey)(n,`oauth-state`),new TextEncoder().encode(JSON.stringify(i))),c=new Uint8Array(o+s.byteLength);return c.set(a),c.set(new Uint8Array(s),o),(0,e.toBase64url)(c)}async function c(t,n){try{let r=(0,e.fromBase64url)(n),i=await globalThis.crypto.subtle.decrypt({name:`AES-GCM`,iv:r.slice(0,o)},await(0,e.deriveSecretKey)(t,`oauth-state`),r.slice(o));return JSON.parse(new TextDecoder().decode(i))}catch{return null}}async function l(e,t,n){if(t===null||t===``)return null;let r=await c(e,t);if(typeof r!=`object`||!r)return null;let i=e=>Reflect.get(r,e),[a,o,s,l,u,d]=[i(`installationId`),i(`apiUrl`),i(`connection`),i(`exp`),i(`nonce`),i(`sessionToken`)];return typeof a!=`string`||typeof o!=`string`||typeof s!=`string`||typeof l!=`number`||typeof u!=`string`||u!==n||typeof d!=`string`||l<Date.now()/1e3?null:{installationId:a,apiUrl:o,connection:s,exp:l,nonce:u,sessionToken:d}}function u(e){return e.replaceAll(`&`,`&amp;`).replaceAll(`<`,`&lt;`).replaceAll(`>`,`&gt;`).replaceAll(`"`,`&quot;`).replaceAll(`'`,`&#39;`)}function d(e){return JSON.stringify(e).replaceAll(`<`,String.raw`\u003c`)}function f(e){let t=d({type:n,...e});return`<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8" /><title>${u(e.message)}</title></head>
+<body style="font: 14px system-ui, sans-serif; padding: 24px">
+<p>${u(e.message)}</p>
+<p id="close" hidden>You can close this window and return to Picked.</p>
+<script>
+  if (window.opener) {
+    window.opener.postMessage(${t}, window.location.origin)
+    window.close()
+  } else {
+    document.getElementById('close').hidden = false
+  }
+<\/script>
+</body>
+</html>`}function p(){return`<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8" /><title>Connecting…</title></head>
+<body style="font: 14px system-ui, sans-serif; padding: 24px">
+<p id="status">Connecting…</p>
+<script>
+  const status = document.getElementById('status')
+  const fail = (message) => {
+    status.textContent = message
+    if (!window.opener) return
+    window.opener.postMessage({ type: ${d(n)}, ok: false, message }, window.location.origin)
+    window.close()
+  }
+  let started = false
+  window.addEventListener('message', async (event) => {
+    if (event.origin !== window.location.origin || event.source !== window.opener) return
+    const data = event.data
+    if (started || !data || data.type !== ${d(i)} || typeof data.sessionToken !== 'string') return
+    started = true
+    try {
+      const response = await fetch(window.location.pathname, {
+        method: 'POST',
+        headers: { authorization: 'Bearer ' + data.sessionToken, 'content-type': 'application/json' },
+        body: JSON.stringify(data.params ?? null),
+      })
+      const answer = await response.json()
+      const url = typeof answer.url === 'string' ? new URL(answer.url) : null
+      if (!response.ok || url === null || (url.protocol !== 'https:' && url.protocol !== 'http:')) {
+        fail(answer.error?.message ?? 'The app answered ' + response.status)
+        return
+      }
+      window.location.replace(url.href)
+    } catch {
+      fail('The app could not start connecting')
+    }
+  })
+  if (window.opener) window.opener.postMessage({ type: ${d(r)} }, window.location.origin)
+  else status.textContent = 'Start connecting from the app’s page in Picked.'
+<\/script>
+</body>
+</html>`}var m=new Set([`localhost`,`127.0.0.1`,`[::1]`]);function h(e){let t=new URL(e.url),n=e.headers.get(`host`)??t.host,r=e.headers.get(`x-forwarded-proto`)?.split(`,`)[0]?.trim(),i=r===`https`||r===`http`?r:t.protocol.slice(0,-1);try{return new URL(`${i}://${n}`)}catch{return t}}function g(e){let t=h(e);return t.protocol===`http:`&&m.has(t.hostname)?{name:`picked-oauth-${t.port||`80`}`,attributes:`Path=/; HttpOnly; SameSite=Lax`}:{name:`__Host-picked-oauth`,attributes:`Path=/; HttpOnly; SameSite=Lax; Secure`}}function _(e,t){for(let n of(e.headers.get(`cookie`)??``).split(`;`)){let e=n.indexOf(`=`);if(e!==-1&&n.slice(0,e).trim()===t)return n.slice(e+1).trim()}return null}var v={"cache-control":`no-store`,"x-content-type-options":`nosniff`};function y(e,t={}){return new Response(e,{headers:{...v,"content-type":`text/html; charset=utf-8`,"content-security-policy":`frame-ancestors 'none'`,"referrer-policy":`no-referrer`,...t}})}function b(e,t,n={}){return new Response(JSON.stringify(e),{status:t,headers:{...v,"content-type":`application/json`,...n}})}async function x(n,r){if(n.method===`GET`)return y(p());if(n.method!==`POST`)return b({error:{message:`Method not allowed`}},405,{allow:`GET, POST`});let i=n.headers.get(`authorization`)??``,a=i.startsWith(`Bearer `)?i.slice(7):``,o=a===``?null:await(0,e.verifySessionToken)(r.pickedKeys,a);if(o===null)return b({error:{message:`Sign in again`}},401);let c=await n.json().catch(()=>null),l=globalThis.crypto.randomUUID(),u=await r.authorize({session:o,sessionToken:a,params:c,state:e=>s(r.privateKey,{installationId:o.installationId,apiUrl:o.apiUrl,connection:e,sessionToken:a,nonce:l})});if(u instanceof Response)return u;let d=g(n);return b({url:u},200,{"set-cookie":`${d.name}=${l}; ${d.attributes}; Max-Age=${String(t)}`})}async function S(e,t){let n=new URL(e.url),r=g(e),i=await l(t.privateKey,n.searchParams.get(`state`),_(e,r.name));return i===null?y(f({ok:!1,message:`This connection link has expired or was opened in another browser; start again`})):y(f(await t.complete({state:i,url:n})),{"set-cookie":`${r.name}=; ${r.attributes}; Max-Age=0`})}exports.OAUTH_RESULT_MESSAGE=n,exports.OAUTH_START_MESSAGE=i,exports.OAUTH_START_PATH=a,exports.OAUTH_START_READY_MESSAGE=r,exports.finishAuthorization=S,exports.oauthCallbackPage=f,exports.oauthStartPage=p,exports.startAuthorization=x;

package/dist/cjs/server.js

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@picked/app-protocol"),t=require("@picked/admin-api-client");var n=/^app_[a-z0-9]+$/;function r(e){return n.test(e)}var i=/^[a-z0-9_-]{1,64}$/;function a(e){if(!r(e.appId))throw TypeError(`${e.appId} is not an app ID`);if(!i.test(e.namespace)||!i.test(e.key))throw TypeError(`${e.namespace}.${e.key} is not a label namespace and key`);let t=new URL(`/apps/${e.appId}/open`,new URL(e.dashboardOrigin).origin);return t.searchParams.set(`label`,`${e.namespace}.${e.key}`),t.searchParams.set(`value`,e.value),t.toString()}var o=6e4,s=class extends Error{userErrors;constructor(e){super(e.map(e=>`${e.field.join(`.`)}: ${e.message}`).join(`; `)),this.name=`LabelWriteError`,this.userErrors=e}},c={TEXT:`text`,NUMBER:`number`,BOOLEAN:`boolean`,JSON:`json`},l={text:`TEXT`,number:`NUMBER`,boolean:`BOOLEAN`,json:`JSON`};function u(e){return{...e,type:c[e.type]}}function d(e){if(e.length!==0)throw new s(e.map(e=>({field:e.field??[],message:e.message,code:e.code})))}function f(n){let r=(0,e.trimTrailing)(n.apiUrl,`/`),i=(0,t.createAdminApiClient)({apiUrl:r,...n.fetch===void 0?{}:{fetch:n.fetch}}),{installationId:a}=n,s=n.token===void 0||n.tokenExpiresAt===void 0?void 0:{token:n.token,expiresAt:Date.parse(n.tokenExpiresAt)},c=async()=>{if(s!==void 0&&s.expiresAt-o>Date.now())return s.token;let c=await(0,e.createAppAssertion)(await(0,e.signerFor)(n.privateKey),{installationId:a,audience:r}),{appInstallationTokenCreate:l}=await i.request(t.AppInstallationTokenCreateDocument,{input:{installationId:a,...n.sessionToken===void 0?{}:{sessionToken:n.sessionToken}}},{headers:{[e.APP_ASSERTION_HEADER]:c}});return s={token:l.token,expiresAt:Date.parse(l.expiresAt)},l.token},f=async(e,t,n={})=>i.request(e,t,{...n,headers:{...n.headers,"x-api-key":await c()}}),p={ownerType:`APP_INSTALLATION`,ownerId:a},m={async list(){return((await f(t.AppInstallationLabelsDocument,{id:a})).appInstallation?.labels??[]).map(u)},async get(e,t){return(await m.list()).find(n=>n.namespace===e&&n.key===t)},async set(e,n={}){let{labelsSet:r}=await f(t.LabelsSetDocument,{input:{...p,labels:e.map(e=>({...e,type:l[e.type]})),atomic:n.atomic??!1}});return d(r.userErrors),{labels:r.labels.map(u),skipped:r.skipped.map(u)}},async delete(e){let{labelsDelete:n}=await f(t.LabelsDeleteDocument,{input:{...p,labels:[...e]}});return d(n.userErrors),n.deletedLabelIds}};return{labels:m,token:c,request:f}}function p(e,t){return f({apiUrl:e.apiUrl,installationId:e.installationId,privateKey:t.privateKey,...e.token===void 0||e.tokenExpiresAt===void 0?{}:{token:e.token,tokenExpiresAt:e.tokenExpiresAt},...t.sessionToken==null?{}:{sessionToken:t.sessionToken},...t.fetch===void 0?{}:{fetch:t.fetch}})}function m(e,t=200){return new Response(JSON.stringify(e),{status:t,headers:{"content-type":`application/json`}})}function h(e,t){let n=t.frameAncestors.length>0?t.frameAncestors.join(` `):`'none'`;return new Response(e,{headers:{"content-type":`text/html; charset=utf-8`,"content-security-policy":`frame-ancestors ${n}`,"referrer-policy":`strict-origin`,"x-content-type-options":`nosniff`}})}function g(e,t){return typeof e==`object`&&!!e&&`type`in e&&e.type===t}function _(e){return g(e,`workflow_tool.call`)}function v(e){return g(e,`installation.created`)}function y(e){return g(e,`installation.upgraded`)}function b(e){return g(e,`workspace.published`)}function x(e){return g(e,`installation.deleted`)}async function S(e,t){try{return m({output:await e(t)})}catch(e){return m({error:{message:e instanceof Error?e.message:String(e)}},422)}}function C(e,t,n,r){return r!==void 0&&t===r?{kind:`mcp`}:e===`POST`?n===`/lifecycle`?{kind:`lifecycle`}:n===`/events`?{kind:`event`}:n.startsWith(`/tools/`)?{kind:`tool`,name:n.slice(7)}:null:null}async function w(e,t,n){let r=n===``?null:JSON.parse(n);if(t.kind===`lifecycle`)return v(r)?await e.onInstall?.(r):y(r)?await e.onUpgrade?.(r):x(r)&&await e.onUninstall?.(r),m({ok:!0});if(t.kind===`event`)return b(r)&&await e.onEvent?.(r),m({ok:!0});let i=t.kind===`tool`?t.name:``,a=e.tools?.[i];return a===void 0||!_(r)?m({error:{message:`Unknown tool ${i}`}},404):S(a,r)}function T(t){let n=(0,e.trimTrailing)(t.basePath??``,`/`);return async r=>{let i=new URL(r.url).pathname,a=n!==``&&i.startsWith(n)?i.slice(n.length):i,o=C(r.method,i,a,t.mcp?.path);if(o===null&&t.manifest!==void 0&&a===`/manifest.json`)return m(t.manifest);if(o===null)return t.fallback===void 0?m({error:`not_found`},404):t.fallback(r);let s=r.method===`GET`?``:await r.text();if(o.kind!==`mcp`||t.mcp===void 0)return await(0,e.verifyBody)(t.pickedKeys,s,r.headers.get(e.SIGNATURE_HEADER))?w(t,o,s):m({error:`invalid_signature`},401);let c=await(0,e.verifyMcpRequest)(t.pickedKeys,r.headers,s);return c===null?m({error:`invalid_signature`},401):t.mcp.handle(new Request(r.url,{method:r.method,headers:r.headers,...r.method===`GET`?{}:{body:s}}),c)}}function E(e){let t=e.headers.get(`authorization`)??``;return t.startsWith(`Bearer `)&&t.length>7?t.slice(7):null}async function D(t,n){let r=E(t);return r===null?null:(0,e.verifySessionToken)(n,r)}function O(e,t){let n=e?.trim()??``;if(n===``)throw Error(t);return n}var k=`picked-api`;function A(e,t){if(typeof e!=`object`||!e)return;let n=Reflect.get(e,t);return typeof n==`string`&&n!==``?n:void 0}function j(e,t){let n;try{n=JSON.parse(e.VERCEL_RELATED_PROJECTS??`[]`)}catch{return}if(!Array.isArray(n))return;let r=n.find(e=>A(Reflect.get(Object(e),`project`),`name`)===t);if(r===void 0)return;let i=Reflect.get(Object(r),`preview`),a=Reflect.get(Object(r),`production`),o;return e.VERCEL_ENV===`preview`?o=A(i,`customEnvironment`)??A(i,`branch`):e.VERCEL_ENV===`production`&&(o=A(a,`alias`)??A(a,`url`)),o===void 0?void 0:`https://${o}`}function M(e){if(typeof e!=`object`||!e)return;let t=Reflect.get(e,`dashboardOrigins`);if(Array.isArray(t))return t.filter(e=>typeof e==`string`)}function N(e){let t=e.fetch??fetch,n=e.refreshAfterMs??3e5,r=e.timeoutMs??5e3,i=[],a,o,s=async()=>{let n=await t(e.url,{signal:AbortSignal.timeout(r)});if(!n.ok)return;let o=M(await n.json());o!==void 0&&(i=o,a=Date.now())};return async()=>(a!==void 0&&Date.now()-a<n||(o??=s().finally(()=>{o=void 0}),await o.catch(()=>void 0)),[...i])}function P(t,n,i={}){let a=O(t.PICKED_APP_PRIVATE_KEY,"Set PICKED_APP_PRIVATE_KEY to the app's private key, from `picked app keys generate`"),o=t.API_PORT===void 0?void 0:`http://localhost:${t.API_PORT}`,s=(0,e.trimTrailing)(O(t.PICKED_API_URL??j(t,k)??o,`Set PICKED_API_URL to the Picked API the app trusts`),`/`),c=(t.PICKED_DASHBOARD_ORIGINS??``).split(`,`).map(e=>e.trim()).filter(e=>e!==``),l=t.DASHBOARD_PORT,u=c;u.length===0&&l!==void 0&&(u=[`http://localhost:${l}`,`http://127.0.0.1:${l}`]);let d=t.VERCEL_ENV===`production`?t.VERCEL_PROJECT_PRODUCTION_URL:t.VERCEL_BRANCH_URL,f=d===void 0||d===``?void 0:`https://${d}`,p=t.PICKED_APP_ID?.trim()??``,m=i.fetch===void 0?{}:{fetch:i.fetch};return{privateKey:a,pickedUrl:s,pickedKeys:(0,e.remoteKeySet)({url:`${s}${e.PICKED_KEYS_PATH}`,...m}),publicUrl:(0,e.trimTrailing)(t.APP_PUBLIC_URL?.trim()||f||`http://localhost:${n}`,`/`),frameAncestors:[...u],dashboardOrigins:u.length>0?()=>Promise.resolve([...u]):N({url:`${s}${e.PICKED_CONFIG_PATH}`,...m,...i.refreshAfterMs===void 0?{}:{refreshAfterMs:i.refreshAfterMs},...i.timeoutMs===void 0?{}:{timeoutMs:i.timeoutMs}}),appId:r(p)?p:null}}function F(e){return async t=>{let n=new URL(t.url),r=n.searchParams.get(`__path`);if(r===null)return e(t);n.searchParams.delete(`__path`),n.pathname=r.startsWith(`/`)?r:`/${r}`;let i=t.method===`GET`||t.method===`HEAD`?null:await t.text();return e(new Request(n,{method:t.method,headers:t.headers,body:i}))}}exports.LabelWriteError=s,exports.createAppHandler=T,exports.createInstallationClient=f,exports.installationClientFor=p,exports.installationLinkUrl=a,exports.isAppId=r,exports.json=m,exports.page=h,exports.readAppEnvironment=P,exports.readSession=D,exports.remoteDashboardOrigins=N,exports.sessionTokenOf=E,exports.withRewrittenPath=F,Object.keys(e).forEach(function(t){t!=="default"&&!Object.prototype.hasOwnProperty.call(exports,t)&&Object.defineProperty(exports,t,{enumerable:!0,get:function(){return e[t]}})});

package/dist/cjs/testing.js

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@picked/app-protocol");var t=/^[a-z0-9_-]{1,64}$/;function n(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function r(e){return e===`TEXT`?`text`:e===`NUMBER`?`number`:e===`BOOLEAN`?`boolean`:e===`JSON`?`json`:null}function i(e){if(!n(e))return null;let{namespace:t,key:i,value:a,increment:o,expiresIn:s,onlyIfAbsent:c,secret:l}=e,u=r(e.type);return typeof t!=`string`||typeof i!=`string`||u===null?null:{namespace:t,key:i,type:u,...typeof a==`string`?{value:a}:{},...typeof o==`number`?{increment:o}:{},...typeof s==`number`?{expiresIn:s}:{},...c===!0?{onlyIfAbsent:c}:{},...l===!0?{secret:l}:{}}}function a(e,t){let n=`${t.namespace}.${t.key}`,r=e.get(n);if(t.onlyIfAbsent===!0&&r!==void 0)return{label:r,skipped:r.value!==t.value};let i=t.increment===void 0?t.value??``:String(Number(r?.value??`0`)+t.increment),a={namespace:t.namespace,key:t.key,type:t.type,value:i,secret:t.secret===!0,expiresAt:t.expiresIn===void 0?null:new Date(Date.now()+t.expiresIn*1e3).toISOString(),updatedAt:new Date().toISOString()};return e.set(n,a),{label:a,skipped:!1}}function o(e){return{...e,type:e.type.toUpperCase()}}function s(e,t){return Response.json({data:null,errors:[{message:e,extensions:{code:t}}]})}function c(e,r,s){let c=Array.isArray(s.labels)?s.labels:[];if(r===`AppInstallationLabelsDelete`){let t=c.flatMap(e=>n(e)?[`${String(e.namespace)}.${String(e.key)}`]:[]).filter(t=>e.delete(t));return Response.json({data:{labelsDelete:{deletedLabelIds:t,userErrors:[]}}})}let l=c.map(i),u=l.findIndex(e=>e===null||!t.test(e.namespace)||!t.test(e.key));if(u!==-1){let e=[{field:[`labels`,String(u),`key`],message:`Key is invalid.`,code:`KEY_INVALID`}];return Response.json({data:{labelsSet:{labels:[],skipped:[],userErrors:e}}})}let d=l.flatMap(t=>t===null?[]:[a(e,t)]);return Response.json({data:{labelsSet:{labels:d.filter(e=>!e.skipped).map(e=>o(e.label)),skipped:d.filter(e=>e.skipped).map(e=>o(e.label)),userErrors:[]}}})}async function l(t){let r=t.apiUrl??`https://api.picked.test`,i=(0,e.staticKeySet)([await(0,e.createSigner)(t.appPrivateKey)]),a=await(0,e.createSigner)((await(0,e.generateKeyPair)()).privateKey),l=new Map,u=new Map,d=[],f=e=>{let t=`appt_fake_${String(u.size+1)}`;return u.set(t,e),Promise.resolve({token:t,expiresAt:new Date(Date.now()+36e5).toISOString()})},p=async(n,o)=>{let c=n.get(e.APP_ASSERTION_HEADER)??``,l=await(0,e.verifyAppAssertion)(i,c,{audience:r});if(l===null||l.installationId!==o.installationId)return s(`The app assertion does not verify`,`UNAUTHENTICATED`);let u=typeof o.sessionToken==`string`?await(0,e.verifySessionToken)((0,e.staticKeySet)([a]),o.sessionToken):null;return t.offlineAccess!==!0&&u?.installationId!==l.installationId?s(`The installation has no offline access; use the token Picked sends with each request`,`FORBIDDEN`):Response.json({data:{appInstallationTokenCreate:await f(l.installationId)}})},m=async(e,t)=>{let r=JSON.parse(t),i=n(r)&&typeof r.operationName==`string`?r.operationName:``,a=n(r)&&n(r.variables)?r.variables:{};d.push({operationName:i,variables:a});let f=n(a.input)?a.input:{};if(i===`AppInstallationTokenCreate`)return p(e,f);let m=u.get(e.get(`x-api-key`)??``);if(m===void 0)return s(`Authentication failed: Invalid API key`,`UNAUTHENTICATED`);let h=l.get(m)??new Map;if(l.set(m,h),i===`AppInstallationLabels`){let e=a.id===m;return Response.json({data:{appInstallation:e?{labels:[...h.values()].map(o)}:null}})}return f.ownerType!==`APP_INSTALLATION`||f.ownerId!==m?s(`Forbidden`,`FORBIDDEN`):c(h,i,f)};return{apiUrl:r,fetch:async(t,n)=>{let r=new URL(t instanceof Request?t.url:t);return r.pathname===e.PICKED_KEYS_PATH?Response.json((0,e.toJwks)([a])):r.pathname===`/api/graphql`?m(new Headers(n?.headers),typeof n?.body==`string`?n.body:`{}`):Response.json({error:{message:`Not found`}},{status:404})},pickedKeys:(0,e.staticKeySet)([a]),labels:l,received:d,tokenFor:f,async installationRef(e,t={}){let{token:n,expiresAt:i}=await f(e);return{installationId:e,organizationId:`org`,projectId:`proj_1`,apiUrl:r,...t,token:n,tokenExpiresAt:i}},async signedRequest(t,n){let r=JSON.stringify(n);return new Request(t,{method:`POST`,body:r,headers:{[e.SIGNATURE_HEADER]:await(0,e.signBody)(a,r)}})},async mcpRequest(t,n,r){let i=JSON.stringify(r);return new Request(t,{method:`POST`,body:i,headers:{"content-type":`application/json`,...await(0,e.signMcpRequest)(a,n,i)}})},async sessionRequest(t){let n=await(0,e.createSessionToken)(a,{...t.ref,userId:`user-test`,exp:Math.floor(Date.now()/1e3)+60});return new Request(t.url,{method:t.method??`GET`,headers:{authorization:`Bearer ${n}`,"content-type":`application/json`},...t.body===void 0?{}:{body:JSON.stringify(t.body)}})}}}function u(e,t,n,r=!1){return{type:`workflow_tool.call`,...e,tool:t,arguments:n,idempotencyKey:`wrun_test:${t}`,run:{runId:r?`test_wrun`:`wrun_test`,nodeId:`n1`,test:r}}}function d(e){return(e.headers.get(`set-cookie`)??``).split(`;`)[0]??``}exports.createFakePicked=l,exports.oauthCookie=d,exports.toolCall=u;

package/dist/esm/frame.js

@@ -0,0 +1,132 @@
+//#region src/frame.ts
+function e(e) {
+	return typeof e == "object" && !!e && "type" in e && e.type === "picked:context" && "context" in e;
+}
+function t(e) {
+	window.parent.postMessage(e, i());
+}
+function n() {
+	try {
+		return new URL(document.referrer).origin;
+	} catch {
+		return window.location.origin;
+	}
+}
+var r;
+function i() {
+	return r ??= n(), r;
+}
+function a(n) {
+	if (window.parent === window) throw Error("connect() works only inside the Picked dashboard, which frames the page");
+	let r = (t) => {
+		t.source === window.parent && t.origin === i() && e(t.data) && (window.removeEventListener("message", r), n(t.data.context));
+	};
+	return window.addEventListener("message", r), t({ type: "picked:ready" }), () => window.removeEventListener("message", r);
+}
+function o(e = {}) {
+	return e.dashboardOrigin !== void 0 && (r = e.dashboardOrigin), new Promise((e) => {
+		a(e);
+	});
+}
+var s = 24e4;
+function c(e, t) {
+	let n = e.split(".")[1] ?? "", r;
+	try {
+		let e = atob(n.replaceAll("-", "+").replaceAll("_", "/"));
+		r = Reflect.get(Object(JSON.parse(e)), "exp");
+	} catch {
+		r = void 0;
+	}
+	let i = typeof r == "number" ? r * 1e3 - 12e4 - t : s;
+	return Math.min(s, Math.max(6e4, i));
+}
+function l() {
+	return new Promise((e) => {
+		let t = () => void 0, n = setTimeout(() => {
+			t(), e(void 0);
+		}, 1e4);
+		try {
+			t = a((t) => {
+				clearTimeout(n), e(t);
+			});
+		} catch {
+			clearTimeout(n), e(void 0);
+		}
+	});
+}
+async function u(e = {}) {
+	let t = await o(e), n = Date.now() + c(t.sessionToken, Date.now()), r = !1, i = !1, a = async () => {
+		if (r || i || Date.now() < n) return;
+		r = !0;
+		let e = await l();
+		r = !1, e === void 0 ? n = Date.now() + 15e3 : (t = e, n = Date.now() + c(e.sessionToken, Date.now()));
+	}, s = () => {
+		document.visibilityState === "visible" && a();
+	}, u = setInterval(() => void a(), 15e3);
+	return window.addEventListener("focus", s), document.addEventListener("visibilitychange", s), {
+		context: () => t,
+		stop: () => {
+			i = !0, clearInterval(u), window.removeEventListener("focus", s), document.removeEventListener("visibilitychange", s);
+		}
+	};
+}
+function d(e) {
+	t({
+		type: "picked:resize",
+		height: Math.ceil(e)
+	});
+}
+function f() {
+	let e = new ResizeObserver(() => d(document.documentElement.scrollHeight));
+	return e.observe(document.body), d(document.documentElement.scrollHeight), () => e.disconnect();
+}
+var p = {
+	intervalMs: 1e3,
+	attempts: 30
+};
+function m(e, t) {
+	return typeof e == "object" && !!e && "type" in e && e.type === t;
+}
+function h(e) {
+	return m(e, "picked-app:oauth-result") && "ok" in e && typeof e.ok == "boolean" && "message" in e && typeof e.message == "string";
+}
+function g(e) {
+	let t = window.open("/oauth/start", "picked-app-authorize", "width=520,height=720");
+	if (t === null) return Promise.resolve({
+		ok: !1,
+		message: "Allow pop-ups to connect"
+	});
+	let { origin: n } = window.location;
+	return new Promise((r) => {
+		let i = (e) => {
+			window.removeEventListener("message", c), window.removeEventListener("focus", u), window.clearInterval(d), r(e);
+		}, a = {
+			ok: !1,
+			message: "The connection window closed. If you finished connecting there, it shows here"
+		}, o = !1, s = (e) => {
+			o || (o = !0, i(e));
+		}, c = (r) => {
+			r.source === t && r.origin === n && (m(r.data, "picked-app:oauth-start-ready") ? t.postMessage({
+				type: "picked-app:oauth-start",
+				sessionToken: e.sessionToken,
+				params: e.params ?? null
+			}, n) : h(r.data) && s({
+				ok: r.data.ok,
+				message: r.data.message
+			}));
+		}, l = async (t) => {
+			let n = await e.connected?.().catch(() => null);
+			o || (typeof n == "string" ? s({
+				ok: !0,
+				message: n
+			}) : t + 1 >= p.attempts ? s(a) : window.setTimeout(() => void l(t + 1), p.intervalMs));
+		}, u = () => {
+			e.connected === void 0 ? s(a) : l(0);
+		}, d = window.setInterval(() => {
+			t.closed && (window.clearInterval(d), document.hasFocus() ? u() : window.addEventListener("focus", u, { once: !0 }));
+		}, 500);
+		window.addEventListener("message", c);
+	});
+}
+//#endregion
+export { g as authorizeInPopup, f as autoResize, o as connect, u as keepConnected, d as resize };

package/dist/esm/index.js

@@ -0,0 +1,2 @@
+export * from "@picked/app-protocol";
+export {};

package/dist/esm/node.js

@@ -0,0 +1,40 @@
+import { readFile as e } from "node:fs/promises";
+import { createServer as t } from "node:http";
+//#region src/node.ts
+async function n(e) {
+	let t = [];
+	for await (let n of e) t.push(Buffer.isBuffer(n) ? n : Buffer.from(String(n)));
+	return Buffer.concat(t);
+}
+async function r(e, t) {
+	let r = new Headers();
+	for (let [t, n] of Object.entries(e.headers)) typeof n == "string" ? r.set(t, n) : Array.isArray(n) && r.set(t, n.join(", "));
+	let i = e.method ?? "GET", a = i === "GET" || i === "HEAD" ? null : new Uint8Array(await n(e));
+	return new Request(`http://localhost:${t}${e.url ?? "/"}`, {
+		method: i,
+		headers: r,
+		body: a
+	});
+}
+async function i(e, t) {
+	t.statusCode = e.status, e.headers.forEach((e, n) => t.setHeader(n, e)), t.end(Buffer.from(await e.arrayBuffer()));
+}
+function a(e, n) {
+	let a = t((t, a) => {
+		(async () => {
+			try {
+				let o = await e(await r(t, n));
+				console.log(`${t.method ?? ""} ${t.url ?? ""} ${o.status}`), await i(o, a);
+			} catch (e) {
+				console.error(e), a.statusCode = 500, a.end("Internal error");
+			}
+		})();
+	});
+	return a.listen(n, () => console.log(`Listening on http://localhost:${n}`)), a;
+}
+async function o() {
+	let t = await e(new URL("../esm/frame.js", "" + import.meta.url), "utf8");
+	return new Response(t, { headers: { "content-type": "text/javascript" } });
+}
+//#endregion
+export { o as frameScript, a as serve };

package/dist/esm/oauth.js

@@ -0,0 +1,202 @@
+import { deriveSecretKey as e, fromBase64url as t, toBase64url as n, verifySessionToken as r } from "@picked/app-protocol";
+//#region src/oauth.ts
+var i = 600, a = "picked-app:oauth-result", o = "picked-app:oauth-start-ready", s = "picked-app:oauth-start", c = "/oauth/start", l = 12;
+async function u(t, r) {
+	let a = {
+		...r,
+		exp: Math.floor(Date.now() / 1e3) + i
+	}, o = globalThis.crypto.getRandomValues(new Uint8Array(l)), s = await globalThis.crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv: o
+	}, await e(t, "oauth-state"), new TextEncoder().encode(JSON.stringify(a))), c = new Uint8Array(l + s.byteLength);
+	return c.set(o), c.set(new Uint8Array(s), l), n(c);
+}
+async function d(n, r) {
+	try {
+		let i = t(r), a = await globalThis.crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: i.slice(0, l)
+		}, await e(n, "oauth-state"), i.slice(l));
+		return JSON.parse(new TextDecoder().decode(a));
+	} catch {
+		return null;
+	}
+}
+async function f(e, t, n) {
+	if (t === null || t === "") return null;
+	let r = await d(e, t);
+	if (typeof r != "object" || !r) return null;
+	let i = (e) => Reflect.get(r, e), [a, o, s, c, l, u] = [
+		i("installationId"),
+		i("apiUrl"),
+		i("connection"),
+		i("exp"),
+		i("nonce"),
+		i("sessionToken")
+	];
+	return typeof a != "string" || typeof o != "string" || typeof s != "string" || typeof c != "number" || typeof l != "string" || l !== n || typeof u != "string" || c < Date.now() / 1e3 ? null : {
+		installationId: a,
+		apiUrl: o,
+		connection: s,
+		exp: c,
+		nonce: l,
+		sessionToken: u
+	};
+}
+function p(e) {
+	return e.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&#39;");
+}
+function m(e) {
+	return JSON.stringify(e).replaceAll("<", String.raw`\u003c`);
+}
+function h(e) {
+	let t = m({
+		type: a,
+		...e
+	});
+	return `<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8" /><title>${p(e.message)}</title></head>
+<body style="font: 14px system-ui, sans-serif; padding: 24px">
+<p>${p(e.message)}</p>
+<p id="close" hidden>You can close this window and return to Picked.</p>
+<script>
+  if (window.opener) {
+    window.opener.postMessage(${t}, window.location.origin)
+    window.close()
+  } else {
+    document.getElementById('close').hidden = false
+  }
+<\/script>
+</body>
+</html>`;
+}
+function g() {
+	return `<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8" /><title>Connecting…</title></head>
+<body style="font: 14px system-ui, sans-serif; padding: 24px">
+<p id="status">Connecting…</p>
+<script>
+  const status = document.getElementById('status')
+  const fail = (message) => {
+    status.textContent = message
+    if (!window.opener) return
+    window.opener.postMessage({ type: ${m(a)}, ok: false, message }, window.location.origin)
+    window.close()
+  }
+  let started = false
+  window.addEventListener('message', async (event) => {
+    if (event.origin !== window.location.origin || event.source !== window.opener) return
+    const data = event.data
+    if (started || !data || data.type !== ${m(s)} || typeof data.sessionToken !== 'string') return
+    started = true
+    try {
+      const response = await fetch(window.location.pathname, {
+        method: 'POST',
+        headers: { authorization: 'Bearer ' + data.sessionToken, 'content-type': 'application/json' },
+        body: JSON.stringify(data.params ?? null),
+      })
+      const answer = await response.json()
+      const url = typeof answer.url === 'string' ? new URL(answer.url) : null
+      if (!response.ok || url === null || (url.protocol !== 'https:' && url.protocol !== 'http:')) {
+        fail(answer.error?.message ?? 'The app answered ' + response.status)
+        return
+      }
+      window.location.replace(url.href)
+    } catch {
+      fail('The app could not start connecting')
+    }
+  })
+  if (window.opener) window.opener.postMessage({ type: ${m(o)} }, window.location.origin)
+  else status.textContent = 'Start connecting from the app’s page in Picked.'
+<\/script>
+</body>
+</html>`;
+}
+var _ = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+]);
+function v(e) {
+	let t = new URL(e.url), n = e.headers.get("host") ?? t.host, r = e.headers.get("x-forwarded-proto")?.split(",")[0]?.trim(), i = r === "https" || r === "http" ? r : t.protocol.slice(0, -1);
+	try {
+		return new URL(`${i}://${n}`);
+	} catch {
+		return t;
+	}
+}
+function y(e) {
+	let t = v(e);
+	return t.protocol === "http:" && _.has(t.hostname) ? {
+		name: `picked-oauth-${t.port || "80"}`,
+		attributes: "Path=/; HttpOnly; SameSite=Lax"
+	} : {
+		name: "__Host-picked-oauth",
+		attributes: "Path=/; HttpOnly; SameSite=Lax; Secure"
+	};
+}
+function b(e, t) {
+	for (let n of (e.headers.get("cookie") ?? "").split(";")) {
+		let e = n.indexOf("=");
+		if (e !== -1 && n.slice(0, e).trim() === t) return n.slice(e + 1).trim();
+	}
+	return null;
+}
+var x = {
+	"cache-control": "no-store",
+	"x-content-type-options": "nosniff"
+};
+function S(e, t = {}) {
+	return new Response(e, { headers: {
+		...x,
+		"content-type": "text/html; charset=utf-8",
+		"content-security-policy": "frame-ancestors 'none'",
+		"referrer-policy": "no-referrer",
+		...t
+	} });
+}
+function C(e, t, n = {}) {
+	return new Response(JSON.stringify(e), {
+		status: t,
+		headers: {
+			...x,
+			"content-type": "application/json",
+			...n
+		}
+	});
+}
+async function w(e, t) {
+	if (e.method === "GET") return S(g());
+	if (e.method !== "POST") return C({ error: { message: "Method not allowed" } }, 405, { allow: "GET, POST" });
+	let n = e.headers.get("authorization") ?? "", a = n.startsWith("Bearer ") ? n.slice(7) : "", o = a === "" ? null : await r(t.pickedKeys, a);
+	if (o === null) return C({ error: { message: "Sign in again" } }, 401);
+	let s = await e.json().catch(() => null), c = globalThis.crypto.randomUUID(), l = await t.authorize({
+		session: o,
+		sessionToken: a,
+		params: s,
+		state: (e) => u(t.privateKey, {
+			installationId: o.installationId,
+			apiUrl: o.apiUrl,
+			connection: e,
+			sessionToken: a,
+			nonce: c
+		})
+	});
+	if (l instanceof Response) return l;
+	let d = y(e);
+	return C({ url: l }, 200, { "set-cookie": `${d.name}=${c}; ${d.attributes}; Max-Age=${String(i)}` });
+}
+async function T(e, t) {
+	let n = new URL(e.url), r = y(e), i = await f(t.privateKey, n.searchParams.get("state"), b(e, r.name));
+	return i === null ? S(h({
+		ok: !1,
+		message: "This connection link has expired or was opened in another browser; start again"
+	})) : S(h(await t.complete({
+		state: i,
+		url: n
+	})), { "set-cookie": `${r.name}=; ${r.attributes}; Max-Age=0` });
+}
+//#endregion
+export { a as OAUTH_RESULT_MESSAGE, s as OAUTH_START_MESSAGE, c as OAUTH_START_PATH, o as OAUTH_START_READY_MESSAGE, T as finishAuthorization, h as oauthCallbackPage, g as oauthStartPage, w as startAuthorization };