@picked/app-kit 0.0.1-dev.1794447047683 → 0.0.117-next.3

package/dist/cjs/server.d.ts

@@ -0,0 +1,167 @@
+/**
+ * @file The app server: a fetch-style handler that checks Picked's signature and routes
+ * lifecycle events, app events, tool calls and MCP requests, plus the responses its pages
+ * and APIs answer with.
+ */
+import { type AppEvent, type AppManifest, type InstallationCreatedEvent, type InstallationDeletedEvent, type InstallationRef, type InstallationUpgradedEvent, type PublicKeySet, type SessionClaims, type ToolCall } from '@picked/app-protocol';
+export * from '@picked/app-protocol';
+export * from './client.js';
+export * from './link.js';
+/** A tool's body: given the call, returns what the manifest's `output` declares. */
+export type ToolHandler = (call: ToolCall) => Promise<Record<string, unknown>>;
+/** What an app server handles. */
+export interface AppHandlerOptions {
+    /** Picked's public keys, which every request Picked sends must be signed by. */
+    pickedKeys: PublicKeySet;
+    /** The path the manifest's `endpoint` points at, such as `/picked`. Empty by default. */
+    basePath?: string;
+    /** Called when the app is installed on a project. */
+    onInstall?: (event: InstallationCreatedEvent) => Promise<void> | void;
+    /** Called when an installation moves to another version. */
+    onUpgrade?: (event: InstallationUpgradedEvent) => Promise<void> | void;
+    /** Called when the app is removed from a project. */
+    onUninstall?: (event: InstallationDeletedEvent) => Promise<void> | void;
+    /** Called with each event the manifest's `events` subscribes to. */
+    onEvent?: (event: AppEvent) => Promise<void> | void;
+    /** The tool bodies, by the names the manifest declares. */
+    tools?: Record<string, ToolHandler>;
+    /** The MCP server at the manifest's `mcp.url`, and the handler for the signed requests to it. */
+    mcp?: {
+        /** The pathname of the manifest's `mcp.url`, such as `/mcp`, matched against the full path. */
+        path: string;
+        handle: (request: Request, installation: InstallationRef) => Promise<Response>;
+    };
+    /** The app's manifest, which the handler serves at `GET /manifest.json`. */
+    manifest?: AppManifest;
+    /** Everything else the app serves, such as its frame pages. */
+    fallback?: (request: Request) => Promise<Response> | Response;
+}
+/**
+ * Answers JSON.
+ *
+ * @param {unknown} body - The body.
+ * @param {number} [status] - The status; 200 by default.
+ * @returns {Response} The response.
+ * @example json({ ok: true })
+ */
+export declare function json(body: unknown, status?: number): Response;
+/**
+ * Answers an HTML page the dashboard may frame and no other site may.
+ *
+ * @param {string} html - The page.
+ * @param {object} options - Who may frame it.
+ * @param {string[]} options.frameAncestors - The dashboard origins, such as `https://app.picked.app`.
+ * @returns {Response} The response.
+ * @example page(settingsPage(), { frameAncestors: ['https://app.picked.app'] })
+ */
+export declare function page(html: string, options: {
+    frameAncestors: string[];
+}): Response;
+/**
+ * Builds the handler for an app's endpoint.
+ *
+ * @param {AppHandlerOptions} options - What the app handles.
+ * @returns {(request: Request) => Promise<Response>} A fetch-style handler.
+ * @example serve(createAppHandler({ pickedKeys: environment.pickedKeys, tools: { ping: async () => ({ ok: true }) } }))
+ */
+export declare function createAppHandler(options: AppHandlerOptions): (request: Request) => Promise<Response>;
+/**
+ * Reads the raw session token a frame sends as `Authorization: Bearer <token>`, which an
+ * installation client passes on as `sessionToken` to mint a token for that user's request.
+ *
+ * @param {Request} request - The frame's request to the app's own server.
+ * @returns {string | null} The token, or null when the request carries none.
+ * @example createInstallationClient({ ...options, sessionToken: sessionTokenOf(request) ?? undefined })
+ */
+export declare function sessionTokenOf(request: Request): string | null;
+/**
+ * Reads the session token a frame sends as `Authorization: Bearer <token>`.
+ *
+ * @param {Request} request - The frame's request to the app's own server.
+ * @param {PublicKeySet} pickedKeys - Picked's public keys, which sign session tokens.
+ * @returns {Promise<SessionClaims | null>} Who is asking, or null without a valid token.
+ * @example const session = await readSession(request, environment.pickedKeys)
+ */
+export declare function readSession(request: Request, pickedKeys: PublicKeySet): Promise<SessionClaims | null>;
+/** What every app server reads from its environment. */
+export interface AppEnvironment {
+    /** `PICKED_APP_PRIVATE_KEY`: the app's Ed25519 private key, as the base64 of its PKCS#8 DER or a PKCS#8 PEM. */
+    privateKey: string;
+    /** `PICKED_API_URL`: the Picked API the app trusts, whose public keys verify Picked's requests. */
+    pickedUrl: string;
+    /** Picked's public keys, read from `pickedUrl`. */
+    pickedKeys: PublicKeySet;
+    /** `APP_PUBLIC_URL`: the origin the app is served at, which its manifest's endpoint names. */
+    publicUrl: string;
+    /**
+     * The dashboard origins the environment names: `PICKED_DASHBOARD_ORIGINS`, or `DASHBOARD_PORT`
+     * on localhost; empty when it names none.
+     */
+    frameAncestors: string[];
+    /**
+     * The dashboard origins that may frame the app's pages, the dashboard's own first, which an
+     * app links people to as `installationLinkUrl`'s `dashboardOrigin`: `frameAncestors`, or the
+     * ones Picked's app config at `pickedUrl` lists when the environment names none.
+     */
+    dashboardOrigins: () => Promise<string[]>;
+    /**
+     * `PICKED_APP_ID`: the app's ID on the Picked it trusts, which `picked app deploy` prints, or
+     * null when it is unset or not an app ID.
+     */
+    appId: string | null;
+}
+/**
+ * The dashboard origins Picked's app config lists. It fetches the config on first use, on every
+ * use until a fetch succeeds, and again on a use once `refreshAfterMs` has passed since the last
+ * success. A fetch that takes longer than `timeoutMs` is abandoned. It keeps the origins it last
+ * read when a fetch fails, and holds none before any fetch succeeds.
+ *
+ * @param {object} options - Where the config lives.
+ * @param {string} options.url - The config's URL.
+ * @param {typeof fetch} [options.fetch] - The fetch to read it with.
+ * @param {number} [options.refreshAfterMs] - The least time between fetches; five minutes by default.
+ * @param {number} [options.timeoutMs] - The longest a fetch may take; five seconds by default.
+ * @returns {() => Promise<string[]>} Reads the origins.
+ * @example remoteDashboardOrigins({ url: 'https://api.picked.app/.well-known/picked-app-config.json' })
+ */
+export declare function remoteDashboardOrigins(options: {
+    url: string;
+    fetch?: typeof fetch;
+    refreshAfterMs?: number;
+    timeoutMs?: number;
+}): () => Promise<string[]>;
+/**
+ * Reads an app server's environment. An origin the environment leaves unset comes from
+ * Vercel when the app runs there: Picked's API from the related project `picked-api`, and the
+ * public URL from `VERCEL_PROJECT_PRODUCTION_URL` in production and `VERCEL_BRANCH_URL`
+ * elsewhere, so a preview targets the API deployed from its own branch. Locally, Picked's API
+ * defaults to `API_PORT` on localhost, the public URL to the app's port and the frame
+ * ancestors to the dashboard's port. The dashboard origins are the frame ancestors, or, when the
+ * environment names none, the ones in the app config Picked's API publishes: the dashboard's
+ * own origin first, then every tenant host.
+ *
+ * @param {Record<string, string | undefined>} env - The environment.
+ * @param {string} port - The port the app listens on locally.
+ * @param {object} [options] - How Picked's documents are read.
+ * @param {typeof fetch} [options.fetch] - The fetch Picked's keys and app config are read with.
+ * @param {number} [options.refreshAfterMs] - The least time between reads of Picked's app config.
+ * @param {number} [options.timeoutMs] - The longest a read of Picked's app config may take.
+ * @returns {AppEnvironment} The environment.
+ * @throws {Error} When `PICKED_APP_PRIVATE_KEY` or `PICKED_API_URL` is unset.
+ * @example readAppEnvironment(process.env, process.env.APP_PORT ?? '4101')
+ */
+export declare function readAppEnvironment(env: Record<string, string | undefined>, port: string, options?: {
+    fetch?: typeof fetch;
+    refreshAfterMs?: number;
+    timeoutMs?: number;
+}): AppEnvironment;
+/**
+ * Serves a handler behind a Vercel rewrite of every path to `/api?__path=/:path*`, restoring
+ * the path the request was sent to.
+ *
+ * @param {(request: Request) => Promise<Response>} handler - The app's handler.
+ * @returns {(request: Request) => Promise<Response>} The handler for `api/index.ts`.
+ * @example export default { fetch: withRewrittenPath(handler) }
+ */
+export declare function withRewrittenPath(handler: (request: Request) => Promise<Response>): (request: Request) => Promise<Response>;
+//# sourceMappingURL=server.d.ts.map

package/dist/cjs/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EASL,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,QAAQ,EAEd,MAAM,sBAAsB,CAAA;AAG7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,UAAU,CAAA;AACxB,cAAc,QAAQ,CAAA;AAEtB,oFAAoF;AACpF,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;AAE9E,kCAAkC;AAClC,MAAM,WAAW,iBAAiB;IAChC,gFAAgF;IAChF,UAAU,EAAE,YAAY,CAAA;IACxB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qDAAqD;IACrD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,wBAAwB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACrE,4DAA4D;IAC5D,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,yBAAyB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACtE,qDAAqD;IACrD,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,wBAAwB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACvE,oEAAoE;IACpE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACnD,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACnC,iGAAiG;IACjG,GAAG,CAAC,EAAE;QACJ,+FAA+F;QAC/F,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;KAC/E,CAAA;IACD,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,WAAW,CAAA;IACtB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAA;CAC9D;AAED;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,SAAM,GAAG,QAAQ,CAK1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,cAAc,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,QAAQ,CAUlF;AA0JD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,iBAAiB,GACzB,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAsCzC;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAK9D;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,YAAY,GACvB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAG/B;AAED,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,gHAAgH;IAChH,UAAU,EAAE,MAAM,CAAA;IAClB,mGAAmG;IACnG,SAAS,EAAE,MAAM,CAAA;IACjB,mDAAmD;IACnD,UAAU,EAAE,YAAY,CAAA;IACxB,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACzC;;;OAGG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAwFD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IACpB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAyB1B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAClF,cAAc,CAoDhB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAC/C,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAUzC"}

package/dist/cjs/testing.d.ts

@@ -0,0 +1,84 @@
+/**
+ * @file Test doubles for app servers: a fake Picked API that answers the GraphQL operations the
+ * installation client sends, mints tokens for app assertions signed with the app's key (for an
+ * installation without offline access, only alongside a session token it signed), keeps
+ * installation labels and publishes Picked's public keys; and helpers that build the requests
+ * Picked and the dashboard send an app, signed with the fake's Picked key.
+ */
+import { type InstallationRef, type PublicKeySet, type ToolCall } from '@picked/app-protocol';
+import type { AppLabel } from './client.js';
+/** A GraphQL operation the fake received. */
+export interface ReceivedOperation {
+    operationName: string;
+    variables: Record<string, unknown>;
+}
+/** A fake Picked API for one app. */
+export interface FakePicked {
+    /** The fake's API origin. */
+    apiUrl: string;
+    /** The fetch to hand the app as its Picked sender. */
+    fetch: typeof fetch;
+    /** Picked's public keys, as an app verifies Picked's requests with them. */
+    pickedKeys: PublicKeySet;
+    /** Each installation's labels, by installation id, then by `<namespace>.<key>`. */
+    labels: Map<string, Map<string, AppLabel>>;
+    /** Every GraphQL operation received, in order. */
+    received: ReceivedOperation[];
+    /** Mints a token for an installation, as Picked sends one with each request. */
+    tokenFor: (installationId: string) => Promise<{
+        token: string;
+        expiresAt: string;
+    }>;
+    /**
+     * Names an installation as a request from Picked does: on the fake's API, with a fresh token,
+     * in organisation `org` and project `proj_1` unless the overrides say otherwise.
+     */
+    installationRef: (installationId: string, overrides?: Partial<Pick<InstallationRef, 'organizationId' | 'projectId'>>) => Promise<InstallationRef>;
+    /** Builds a request Picked sends the app, signed with Picked's key. */
+    signedRequest: (url: string, payload: unknown) => Promise<Request>;
+    /** Builds an MCP request Picked forwards to the app, signed with Picked's key. */
+    mcpRequest: (url: string, ref: InstallationRef, payload: unknown) => Promise<Request>;
+    /** Builds a request from a dashboard user viewing an installation's frame. */
+    sessionRequest: (params: {
+        ref: InstallationRef;
+        url: string;
+        method?: string;
+        body?: unknown;
+    }) => Promise<Request>;
+}
+/**
+ * Builds a fake Picked API that trusts one app's key.
+ *
+ * @param {object} options - The app.
+ * @param {string} options.appPrivateKey - The app's private key, whose public half the fake trusts.
+ * @param {string} [options.apiUrl] - The fake's API origin.
+ * @param {boolean} [options.offlineAccess] - Whether every installation holds offline access.
+ * @returns {Promise<FakePicked>} The fake.
+ * @example const picked = await createFakePicked({ appPrivateKey: privateKey })
+ */
+export declare function createFakePicked(options: {
+    appPrivateKey: string;
+    apiUrl?: string;
+    offlineAccess?: boolean;
+}): Promise<FakePicked>;
+/**
+ * Builds a workflow tool call to an installation.
+ *
+ * @param {InstallationRef} ref - The installation.
+ * @param {string} tool - The tool.
+ * @param {Record<string, unknown>} args - Its arguments.
+ * @param {boolean} [test] - Whether the call belongs to a test run.
+ * @returns {ToolCall} The call.
+ * @example toolCall(ref, 'create_lead', { lastName: 'Lovelace' })
+ */
+export declare function toolCall(ref: InstallationRef, tool: string, args: Record<string, unknown>, test?: boolean): ToolCall;
+/**
+ * Reads the cookie an OAuth start set, as the `cookie` header the browser sends with the
+ * provider's callback.
+ *
+ * @param {Response} response - The answer to `POST /oauth/start`.
+ * @returns {string} The `<name>=<value>` pair, or an empty string when it set none.
+ * @example new Request(callbackUrl, { headers: { cookie: oauthCookie(started) } })
+ */
+export declare function oauthCookie(response: Response): string;
+//# sourceMappingURL=testing.d.ts.map

package/dist/cjs/testing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAaL,KAAK,eAAe,EACpB,KAAK,YAAY,EAEjB,KAAK,QAAQ,EACd,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,UAAU,CAAA;AAErE,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED,qCAAqC;AACrC,MAAM,WAAW,UAAU;IACzB,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,sDAAsD;IACtD,KAAK,EAAE,OAAO,KAAK,CAAA;IACnB,4EAA4E;IAC5E,UAAU,EAAE,YAAY,CAAA;IACxB,mFAAmF;IACnF,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC1C,kDAAkD;IAClD,QAAQ,EAAE,iBAAiB,EAAE,CAAA;IAC7B,gFAAgF;IAChF,QAAQ,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACnF;;;OAGG;IACH,eAAe,EAAE,CACf,cAAc,EAAE,MAAM,EACtB,SAAS,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,gBAAgB,GAAG,WAAW,CAAC,CAAC,KACvE,OAAO,CAAC,eAAe,CAAC,CAAA;IAC7B,uEAAuE;IACvE,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAClE,kFAAkF;IAClF,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACrF,8EAA8E;IAC9E,cAAc,EAAE,CAAC,MAAM,EAAE;QACvB,GAAG,EAAE,eAAe,CAAA;QACpB,GAAG,EAAE,MAAM,CAAA;QACX,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,OAAO,CAAA;KACf,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACvB;AAuKD;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB,GAAG,OAAO,CAAC,UAAU,CAAC,CAgItB;AAED;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CACtB,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,UAAQ,GACX,QAAQ,CASV;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAEtD"}

package/dist/types/index.d.ts

@@ -6,5 +6,5 @@
  * `@picked/app-kit/frame` runs inside a dashboard slot's iframe.
  */
 export * from '@picked/app-protocol';
-export type { FrameContext, FrameToHostMessage, HostToFrameMessage } from './frame';
+export type { FrameContext, FrameToHostMessage, HostToFrameMessage } from './frame.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/server.d.ts

@@ -5,8 +5,8 @@
  */
 import { type AppEvent, type AppManifest, type InstallationCreatedEvent, type InstallationDeletedEvent, type InstallationRef, type InstallationUpgradedEvent, type PublicKeySet, type SessionClaims, type ToolCall } from '@picked/app-protocol';
 export * from '@picked/app-protocol';
-export * from './client';
-export * from './link';
+export * from './client.js';
+export * from './link.js';
 /** A tool's body: given the call, returns what the manifest's `output` declares. */
 export type ToolHandler = (call: ToolCall) => Promise<Record<string, unknown>>;
 /** What an app server handles. */

package/dist/types/testing.d.ts

@@ -6,7 +6,7 @@
  * Picked and the dashboard send an app, signed with the fake's Picked key.
  */
 import { type InstallationRef, type PublicKeySet, type ToolCall } from '@picked/app-protocol';
-import type { AppLabel } from './client';
+import type { AppLabel } from './client.js';
 /** A GraphQL operation the fake received. */
 export interface ReceivedOperation {
     operationName: string;

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@picked/app-kit",
   "description": "Build Picked apps: the manifest, request signing, server handlers and the dashboard frame handshake",
-  "version": "0.0.1-dev.1794447047683",
+  "version": "0.0.117-next.3",
   "dependencies": {
-    "@picked/admin-api-client": "0.0.1-dev.1794447047683",
-    "@picked/app-protocol": "0.0.1-dev.1794447047683"
+    "@picked/admin-api-client": "0.0.117-next.3",
+    "@picked/app-protocol": "0.0.117-next.3"
   },
   "devDependencies": {
     "@repo/eslint-config": "workspace:*",
@@ -18,39 +18,69 @@
   },
   "exports": {
     ".": {
-      "types": "./dist/types/index.d.ts",
-      "import": "./dist/esm/index.js",
-      "require": "./dist/cjs/index.js",
+      "import": {
+        "types": "./dist/types/index.d.ts",
+        "default": "./dist/esm/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/index.d.ts",
+        "default": "./dist/cjs/index.js"
+      },
       "default": "./dist/esm/index.js"
     },
     "./server": {
-      "types": "./dist/types/server.d.ts",
-      "import": "./dist/esm/server.js",
-      "require": "./dist/cjs/server.js",
+      "import": {
+        "types": "./dist/types/server.d.ts",
+        "default": "./dist/esm/server.js"
+      },
+      "require": {
+        "types": "./dist/cjs/server.d.ts",
+        "default": "./dist/cjs/server.js"
+      },
       "default": "./dist/esm/server.js"
     },
     "./node": {
-      "types": "./dist/types/node.d.ts",
-      "import": "./dist/esm/node.js",
-      "require": "./dist/cjs/node.js",
+      "import": {
+        "types": "./dist/types/node.d.ts",
+        "default": "./dist/esm/node.js"
+      },
+      "require": {
+        "types": "./dist/cjs/node.d.ts",
+        "default": "./dist/cjs/node.js"
+      },
       "default": "./dist/esm/node.js"
     },
     "./frame": {
-      "types": "./dist/types/frame.d.ts",
-      "import": "./dist/esm/frame.js",
-      "require": "./dist/cjs/frame.js",
+      "import": {
+        "types": "./dist/types/frame.d.ts",
+        "default": "./dist/esm/frame.js"
+      },
+      "require": {
+        "types": "./dist/cjs/frame.d.ts",
+        "default": "./dist/cjs/frame.js"
+      },
       "default": "./dist/esm/frame.js"
     },
     "./oauth": {
-      "types": "./dist/types/oauth.d.ts",
-      "import": "./dist/esm/oauth.js",
-      "require": "./dist/cjs/oauth.js",
+      "import": {
+        "types": "./dist/types/oauth.d.ts",
+        "default": "./dist/esm/oauth.js"
+      },
+      "require": {
+        "types": "./dist/cjs/oauth.d.ts",
+        "default": "./dist/cjs/oauth.js"
+      },
       "default": "./dist/esm/oauth.js"
     },
     "./testing": {
-      "types": "./dist/types/testing.d.ts",
-      "import": "./dist/esm/testing.js",
-      "require": "./dist/cjs/testing.js",
+      "import": {
+        "types": "./dist/types/testing.d.ts",
+        "default": "./dist/esm/testing.js"
+      },
+      "require": {
+        "types": "./dist/cjs/testing.d.ts",
+        "default": "./dist/cjs/testing.js"
+      },
       "default": "./dist/esm/testing.js"
     }
   },
@@ -82,13 +112,14 @@
     "access": "public"
   },
   "scripts": {
-    "build": "vite build && tsgo -p tsconfig.build.json",
+    "build": "vite build && tsgo -p tsconfig.build.json && node ../../scripts/sdk-dist.mjs",
     "dev": "node ../../scripts/sdk-watch-build.mjs",
     "lint": "eslint .",
     "lint-files": "eslint",
     "lint:report": "eslint . -o './.reports/eslint.json' -f json || true",
     "test": "vitest run --passWithNoTests",
     "test:coverage": "../../scripts/vitest-coverage.sh",
+    "test:packaged-types": "attw --pack --profile node16",
     "type-check": "tsgo -p . --noEmit"
   },
   "type": "module",