@sprigr/apps-app-sdk 0.23.0 → 0.25.0

package/README.md

@@ -75,11 +75,13 @@ export default {
 - `fetchWithRetry` — rate-limit-header-aware, jittered retry
 - `constantTimeEqual(a, b)` — bearer-secret verification
 - `encodeState` / `decodeState` — OAuth state base64url
+- `encodeStateWithinEnvelope(state, { installId, appSlug, optional? })` — `encodeState` that leaves room for the platform's signed envelope (500 chars, decision 0190). An optional field (default `returnTo`) that does not fit is left out whole, never shortened, with a `console.warn` naming the lengths; without `returnTo` the bouncer lands the user on the install's dashboard. Use it for any state that carries a caller-supplied value. `oauthStateEnvelopeOverhead` and `OAUTH_STATE_ENVELOPE_MAX_CHARS` expose the arithmetic.
 - `parseActor` / `actorKey` / `ownerFromActorKey` — per-actor token scoping
 - `putAppFile` / `putAppFileStream` / `appFileUrl` / `getAppFile` / `listAppFiles` / `deleteAppFile` — durable app-scoped file storage from outside the injected bridge
 - `fetchFileBytes` / `fetchFileAsBase64` / `bytesToBase64` / `base64ToBytes` — file byte helpers
 - `readableStoredKey(appKey, downloadUrl)` / `agentFileKeyFromUrl` — turn the install-relative key your app stored a file under into the absolute key the platform's `read_file` tool opens (read off the signed URL `appFileUrl` minted). Return it as a tool's `file_key` so an agent can open the file. `appKeyFromCallerKey` / `callerKeyRefusal` go the other way, for a key an agent hands back to your tool (0.17.0)
 - `readFileRef(env, { file_key } | { file_url }, { maxBytes })` / `resolveFileRef`: accept a file an agent hands your tool. `resolveFileRef` only validates (run it before an approval card): a key in this install's store in any form, or an https link on `files.sprigr.com` (a link into this install is read as its key; a company link must be signed and in this company; workspace keys, other installs and every other host are refused with a `FileRefError` whose message says what to pass instead). `readFileRef` then reads the bytes with a size cap, a 20 s time cap and no redirects; `openFileRef` does the same as a stream, for a large attachment passed on without buffering. `FILE_REF_SOURCES_HELP` is the agent-facing list of accepted sources, for a tool's input description (0.21.0)
+- `getCompanyTimezone(env)`: the company's IANA zone from the platform's `COMPANY_TIMEZONE` binding, or `undefined` when the company has none or the value is not a zone `Intl` accepts. Never throws and never defaults; the app picks its own fallback (0.24.0)
 
 Full platform semantics: [`docs/platform-reference.md`](../../docs/platform-reference.md).
 

package/dist/index.d.ts

@@ -74,6 +74,53 @@ interface OAuthState {
 }
 declare function encodeState(state: OAuthState): string;
 declare function decodeState(encoded: string): OAuthState;
+/**
+ * Longest platform-signed state the platform sends to a provider. Dropbox
+ * documents 500 bytes, the tightest cap among the marketplace's providers.
+ * Mirrors OAUTH_STATE_ENVELOPE_MAX_CHARS in sprigr-team
+ * packages/shared/src/utils/oauth-state-envelope.ts (decision 0190): a state
+ * whose envelope would pass it is sent UNSIGNED, and a slug on the bouncer's
+ * enforce list then refuses the connect.
+ */
+declare const OAUTH_STATE_ENVELOPE_MAX_CHARS = 500;
+/**
+ * Characters the platform's signed envelope adds around an app's state.
+ * The wire shape is `sps1.<inner>.<payload>.<sig>`: payload is base64url JSON
+ * `{ i: installId, a: appSlug, t: <ms> }` and sig is 16 HMAC bytes, 22
+ * base64url characters (mintOAuthStateEnvelope in sprigr-team). `t` is the
+ * platform's signing time; any 13-digit ms timestamp gives the same length.
+ */
+declare function oauthStateEnvelopeOverhead(installId: string, appSlug: string, t?: number): number;
+interface EncodeStateWithinEnvelopeOptions {
+    /** The install the platform signs into the envelope (env.INSTALL_ID). */
+    installId: string;
+    /** This app's marketplace slug, also signed into the envelope. */
+    appSlug: string;
+    /**
+     * Fields that may be left out, WHOLE, when the state would not fit, tried
+     * in this order. Default `['returnTo']`. List only fields the callback can
+     * do without: without returnTo the bouncer lands the user on the install's
+     * dashboard instead of the requested page.
+     */
+    optional?: ReadonlyArray<keyof OAuthState>;
+}
+interface EncodedStateWithinEnvelope {
+    /** The encoded state to put on the authorize URL. */
+    state: string;
+    /** Optional fields left out to make it fit, in the order they were dropped. */
+    omitted: string[];
+    /** False when even the state without its optional fields is too long; it is then returned in full and the platform will send it unsigned. */
+    fits: boolean;
+}
+/**
+ * encodeState, but leaving room for the platform's signed envelope
+ * (sprigr-apps#3190). An optional field that does not fit is left out whole,
+ * never shortened: a cut returnTo is a broken landing page, and an absent one
+ * falls back to the install's dashboard. Each omission is logged with the
+ * field's length and the state's length before and after, so the cause of a
+ * dashboard landing is findable.
+ */
+declare function encodeStateWithinEnvelope(state: OAuthState, opts: EncodeStateWithinEnvelopeOptions): EncodedStateWithinEnvelope;
 
 /**
  * fetchWithRetry — rate-limit-header-aware retry wrapper around fetch.
@@ -2924,6 +2971,31 @@ declare function purgeIndexByPrefix(env: WfpBridgeEnv, prefixes: readonly IdPref
     chunk?: number;
 }): Promise<PurgeResult>;
 
+/**
+ * The install's company, as the platform binds it (sprigr-team#11006).
+ *
+ * `COMPANY_TIMEZONE` is a plain_text binding stamped at upload
+ * (sprigr-team#11038): the company's IANA zone, so an app can compute the
+ * tenant's "today" or a local cut-off without guessing. The platform binds it
+ * only when the company has a valid zone, and never a default, so an install
+ * whose company has none simply has no binding. A value written before a
+ * zone change stays until the install's next build.
+ */
+/** The env slice this module reads. Optional: older installs lack it. */
+interface CompanyTimezoneEnv {
+    COMPANY_TIMEZONE?: string;
+}
+/**
+ * The company's IANA zone, or `undefined` when there is none.
+ *
+ * Returns the bound value (trimmed) only when `Intl` accepts it as a time
+ * zone, so the result can be handed straight to `Intl.DateTimeFormat`. Never
+ * throws and never invents a zone: `undefined` means "the platform does not
+ * know", and the app decides its own fallback (a per-user zone, UTC, or
+ * asking).
+ */
+declare function getCompanyTimezone(env: CompanyTimezoneEnv | null | undefined): string | undefined;
+
 /**
  * @sprigr/apps-app-sdk
  *
@@ -3498,4 +3570,4 @@ interface ExecutionContextLike {
 }
 type HandlerFn<TArgs, TResult> = (args: TArgs, env: Record<string, unknown>, ctx?: ExecutionContextLike) => Promise<TResult>;
 
-export { ACTOR_RETIRED_HOOK_TOOL, ACTOR_RETIRE_REASONS, APPROVAL_GRANTED_KEY, APPROVAL_PREVIEW_MAX, APP_FILES_ROOT, APP_OWNER_SEGMENT, type Actor, type ActorRetireReason, type ActorRetired, type ActorRetiredHookBody, type ActorRetiredResult, type AppApprovalEnvelope, type AppFileListItem, type AppFileUrlArgs, type AppFileUrlResult, type AppFilesEnv, type AppToolEffectsDeclaration, type AppUndoEnvelope, type ApplyPoliciesOptions, type ApprovalCoverage, type ApprovalGateOptions, type ApprovalSpec, type ArchiveOfferOptions, type ArchiveOfferRefusal, type CallerKeyResolution, type CaptureJournal, type ConfirmCondition, type ConfirmRule, type ConfirmationPolicy, type ConnectCompleteRequest, type ConnectCompleteResult, type D1Like, type D1PreparedStatementLike, DATA_DELETE_MAX_IDS, DATA_PARTIAL_UPDATE_PATH, DEFAULT_EMIT_TIMEOUT_MS, DEFAULT_FILE_READ_TIMEOUT_MS, DEFAULT_LOG_TIMEOUT_MS, DEFAULT_MAX_FILE_BYTES, DEFAULT_MONEY_FIELDS, DEFAULT_WRITE_PREFIXES, type DataClient, type DataIdsOpts, type DataListIdsResult, type DataTransport, type DerivePolicyOptions, type DerivedPolicy, type DispatcherApprovalGate, type DispatcherApprovalOptions, type EmitMarketplaceEventOptions, type EmitResult, type EmitTransport, type EventArgs, type ExecutionContextLike, FILE_REF_SOURCES_HELP, type FetchFileResult, type FetchWithRetryOptions, type FileRef, type FileRefContent, type FileRefEnv, FileRefError, type FileRefErrorCode, type FileRefStream, type FileRefVia, type GetAppFileResult, type HandlerFn, INBOX_SEND_CONTRACT_V1, type IdPrefixSpec, type IdSnapshot, type InboxAddress, type InboxAppendRequest, type InboxAppendResult, type InboxChannelDeclaration, type InboxFoldersRequest, type InboxFoldersResult, type InboxOwner, type InboxSendConnection, type InboxSendHandlerImpl, InboxSendRefusal, type InboxSendSupports, type InboxSendV1Args, type InboxSendV1Result, type InstallBridge, InvalidUndoEnvelopeError, type JournalRowLike, type LogToPlatformOptions, type ManifestDispatchBlock, type ManifestLike, type ManifestToolLike, type MarketplaceEventEmitOpts, type MarketplaceEventSourceIntegration, NotConnectedError, type OAuthBouncerSignals, type OAuthState, type OfferUndoArgs, type PartialUpdateDataOptions, type PlatformHostEnv, type PolicyCheckInput, type PolicySource, type PurgeResult, type PutAppFileArgs, type PutAppFileResult, type PutAppFileStreamArgs, type ReadFileRefOptions, type RequireApprovalOptions, type ResolveFileRefOptions, type ResolveViewerOptions, type ResolvedFileRef, type RestoreResult, type RestoreSpec, SPRIGR_DATA_MAX_OBJECTS_PER_CALL, SPRIGR_FILE_HOSTS, SPRIGR_LOG_LEVELS, SPRIGR_LOG_LIMITS, type ScheduleArgs, type SprigrDataAggregationCell, type SprigrDataAggregationResult, type SprigrDataAggregationSpec, type SprigrDataApi, type SprigrDataImportOpts, type SprigrDataIndexOpts, type SprigrDataPartialUpdateBody, type SprigrDataPartialUpdateOpts, type SprigrDataPartialUpdateResult, type SprigrDataPatch, type SprigrDataSearchOpts, type SprigrDataSearchResult, SprigrDataValidationError, type SprigrFilesApi, type SprigrFilesApiWithEdit, type SprigrFilesCreateInput, type SprigrFilesCreateResult, type SprigrFilesEditInput, type SprigrFilesEditResult, type SprigrFilesJobResult, type SprigrFilesListItem, type SprigrFilesListResult, type SprigrInboxApi, type SprigrLogEntry, type SprigrLogFn, type SprigrLogLevel, type SprigrLogResult, SprigrLogValidationError, type SyncedAttachment, type SyncedMessage, type ToolArgs, type ToolHandler, type ToolResult, type ToolWrapperOptions, UNIT_SEP, type UndoApplyOptions, type UndoApplyResult, type UndoCaptureSpec, type UndoFidelity, VIEWER_ANONYMOUS, VIEWER_CONTEXT_HEADER, VIEWER_PLATFORM_USER_ID_HEADER, VIEWER_ROLE_HEADER, VIEWER_USER_ID_HEADER, type VerbRule, type ViewerContext, type ViewerContextFailure, type ViewerContextVerification, type ViewerEnv, WORKSPACE_FILE_HOW_TO, type WebhookArgs, type WfpBridgeEnv, type WfpEmitReply, actorKey, actorRetiredHook, actorTool, agentFileKeyFromUrl, appFileUrl, appKeyFromCallerKey, applyConfirmationPolicies, approvalHash, approvalPreview, approvalRecipients, archiveOfferRefusal, attendedFindings, base64ToBytes, buildConfirmationPolicy, buildMarketplaceWebhookUrl, buildPartialUpdateBody, bytesToBase64, callerKeyRefusal, canEmit, canLog, canPartialUpdate, checkConfirmationPolicy, commonDestructiveVerbs, connectComplete, connectDisconnect, constantTimeEqual, createMarketplaceEmitter, createToolWrappers, decodeState, defineInboxSendHandler, deleteAppFile, deleteSnapshotIds, deriveConfirmationPolicy, describeMissingBridge, dispatcherApproval, emitMarketplaceEvent, encodeState, fetchFileAsBase64, fetchFileBytes, fetchWithRetry, fullWarning, getAppFile, hmacSha256Hex, installTokenPost, isNotConnectedError, isStagingHost, listAppFiles, logToPlatform, makeDataClient, manifestIsFresh, offerUndo, openFileRef, overlaySprigr, ownerFromActorKey, parseActor, parseActorRetiredArgs, partialUpdateData, purgeIndexByPrefix, putAppFile, putAppFileStream, randomHex, readFileRef, readableStoredKey, recreatedWarning, refuseWithoutForce, requireApproval, resolveFileRef, resolveInstallBridge, resolveOAuthBouncerBase, resolveOAuthBouncerCallbackUrl, resolvePlatformWebhookBase, resolveViewerContext, resolveViewerUserId, runUndoApply, safeCapture, seq, serializeManifest, set, snapshotIndexIds, tool, undoEnvelope, validateLogEntries, validateLogEntry, verifyViewerToken, withSprigrEmitFallback, withSprigrInboxFallback, withSprigrLogFallback };
+export { ACTOR_RETIRED_HOOK_TOOL, ACTOR_RETIRE_REASONS, APPROVAL_GRANTED_KEY, APPROVAL_PREVIEW_MAX, APP_FILES_ROOT, APP_OWNER_SEGMENT, type Actor, type ActorRetireReason, type ActorRetired, type ActorRetiredHookBody, type ActorRetiredResult, type AppApprovalEnvelope, type AppFileListItem, type AppFileUrlArgs, type AppFileUrlResult, type AppFilesEnv, type AppToolEffectsDeclaration, type AppUndoEnvelope, type ApplyPoliciesOptions, type ApprovalCoverage, type ApprovalGateOptions, type ApprovalSpec, type ArchiveOfferOptions, type ArchiveOfferRefusal, type CallerKeyResolution, type CaptureJournal, type CompanyTimezoneEnv, type ConfirmCondition, type ConfirmRule, type ConfirmationPolicy, type ConnectCompleteRequest, type ConnectCompleteResult, type D1Like, type D1PreparedStatementLike, DATA_DELETE_MAX_IDS, DATA_PARTIAL_UPDATE_PATH, DEFAULT_EMIT_TIMEOUT_MS, DEFAULT_FILE_READ_TIMEOUT_MS, DEFAULT_LOG_TIMEOUT_MS, DEFAULT_MAX_FILE_BYTES, DEFAULT_MONEY_FIELDS, DEFAULT_WRITE_PREFIXES, type DataClient, type DataIdsOpts, type DataListIdsResult, type DataTransport, type DerivePolicyOptions, type DerivedPolicy, type DispatcherApprovalGate, type DispatcherApprovalOptions, type EmitMarketplaceEventOptions, type EmitResult, type EmitTransport, type EncodeStateWithinEnvelopeOptions, type EncodedStateWithinEnvelope, type EventArgs, type ExecutionContextLike, FILE_REF_SOURCES_HELP, type FetchFileResult, type FetchWithRetryOptions, type FileRef, type FileRefContent, type FileRefEnv, FileRefError, type FileRefErrorCode, type FileRefStream, type FileRefVia, type GetAppFileResult, type HandlerFn, INBOX_SEND_CONTRACT_V1, type IdPrefixSpec, type IdSnapshot, type InboxAddress, type InboxAppendRequest, type InboxAppendResult, type InboxChannelDeclaration, type InboxFoldersRequest, type InboxFoldersResult, type InboxOwner, type InboxSendConnection, type InboxSendHandlerImpl, InboxSendRefusal, type InboxSendSupports, type InboxSendV1Args, type InboxSendV1Result, type InstallBridge, InvalidUndoEnvelopeError, type JournalRowLike, type LogToPlatformOptions, type ManifestDispatchBlock, type ManifestLike, type ManifestToolLike, type MarketplaceEventEmitOpts, type MarketplaceEventSourceIntegration, NotConnectedError, OAUTH_STATE_ENVELOPE_MAX_CHARS, type OAuthBouncerSignals, type OAuthState, type OfferUndoArgs, type PartialUpdateDataOptions, type PlatformHostEnv, type PolicyCheckInput, type PolicySource, type PurgeResult, type PutAppFileArgs, type PutAppFileResult, type PutAppFileStreamArgs, type ReadFileRefOptions, type RequireApprovalOptions, type ResolveFileRefOptions, type ResolveViewerOptions, type ResolvedFileRef, type RestoreResult, type RestoreSpec, SPRIGR_DATA_MAX_OBJECTS_PER_CALL, SPRIGR_FILE_HOSTS, SPRIGR_LOG_LEVELS, SPRIGR_LOG_LIMITS, type ScheduleArgs, type SprigrDataAggregationCell, type SprigrDataAggregationResult, type SprigrDataAggregationSpec, type SprigrDataApi, type SprigrDataImportOpts, type SprigrDataIndexOpts, type SprigrDataPartialUpdateBody, type SprigrDataPartialUpdateOpts, type SprigrDataPartialUpdateResult, type SprigrDataPatch, type SprigrDataSearchOpts, type SprigrDataSearchResult, SprigrDataValidationError, type SprigrFilesApi, type SprigrFilesApiWithEdit, type SprigrFilesCreateInput, type SprigrFilesCreateResult, type SprigrFilesEditInput, type SprigrFilesEditResult, type SprigrFilesJobResult, type SprigrFilesListItem, type SprigrFilesListResult, type SprigrInboxApi, type SprigrLogEntry, type SprigrLogFn, type SprigrLogLevel, type SprigrLogResult, SprigrLogValidationError, type SyncedAttachment, type SyncedMessage, type ToolArgs, type ToolHandler, type ToolResult, type ToolWrapperOptions, UNIT_SEP, type UndoApplyOptions, type UndoApplyResult, type UndoCaptureSpec, type UndoFidelity, VIEWER_ANONYMOUS, VIEWER_CONTEXT_HEADER, VIEWER_PLATFORM_USER_ID_HEADER, VIEWER_ROLE_HEADER, VIEWER_USER_ID_HEADER, type VerbRule, type ViewerContext, type ViewerContextFailure, type ViewerContextVerification, type ViewerEnv, WORKSPACE_FILE_HOW_TO, type WebhookArgs, type WfpBridgeEnv, type WfpEmitReply, actorKey, actorRetiredHook, actorTool, agentFileKeyFromUrl, appFileUrl, appKeyFromCallerKey, applyConfirmationPolicies, approvalHash, approvalPreview, approvalRecipients, archiveOfferRefusal, attendedFindings, base64ToBytes, buildConfirmationPolicy, buildMarketplaceWebhookUrl, buildPartialUpdateBody, bytesToBase64, callerKeyRefusal, canEmit, canLog, canPartialUpdate, checkConfirmationPolicy, commonDestructiveVerbs, connectComplete, connectDisconnect, constantTimeEqual, createMarketplaceEmitter, createToolWrappers, decodeState, defineInboxSendHandler, deleteAppFile, deleteSnapshotIds, deriveConfirmationPolicy, describeMissingBridge, dispatcherApproval, emitMarketplaceEvent, encodeState, encodeStateWithinEnvelope, fetchFileAsBase64, fetchFileBytes, fetchWithRetry, fullWarning, getAppFile, getCompanyTimezone, hmacSha256Hex, installTokenPost, isNotConnectedError, isStagingHost, listAppFiles, logToPlatform, makeDataClient, manifestIsFresh, oauthStateEnvelopeOverhead, offerUndo, openFileRef, overlaySprigr, ownerFromActorKey, parseActor, parseActorRetiredArgs, partialUpdateData, purgeIndexByPrefix, putAppFile, putAppFileStream, randomHex, readFileRef, readableStoredKey, recreatedWarning, refuseWithoutForce, requireApproval, resolveFileRef, resolveInstallBridge, resolveOAuthBouncerBase, resolveOAuthBouncerCallbackUrl, resolvePlatformWebhookBase, resolveViewerContext, resolveViewerUserId, runUndoApply, safeCapture, seq, serializeManifest, set, snapshotIndexIds, tool, undoEnvelope, validateLogEntries, validateLogEntry, verifyViewerToken, withSprigrEmitFallback, withSprigrInboxFallback, withSprigrLogFallback };

package/dist/index.js

@@ -48,6 +48,36 @@ function decodeState(encoded) {
   const json = new TextDecoder().decode(bytes);
   return JSON.parse(json);
 }
+var OAUTH_STATE_ENVELOPE_MAX_CHARS = 500;
+function oauthStateEnvelopeOverhead(installId, appSlug, t = Date.now()) {
+  const payloadBytes = new TextEncoder().encode(JSON.stringify({ i: installId, a: appSlug, t })).length;
+  const payloadChars = Math.ceil(payloadBytes * 4 / 3);
+  return "sps1.".length + 1 + payloadChars + 1 + 22;
+}
+function encodeStateWithinEnvelope(state, opts) {
+  const budget = OAUTH_STATE_ENVELOPE_MAX_CHARS - oauthStateEnvelopeOverhead(opts.installId, opts.appSlug);
+  const full = encodeState(state);
+  if (full.length <= budget) return { state: full, omitted: [], fits: true };
+  const trimmed = { ...state };
+  const omitted = [];
+  for (const key of opts.optional ?? ["returnTo"]) {
+    if (!(key in trimmed) || trimmed[key] === void 0) continue;
+    const value = trimmed[key];
+    delete trimmed[key];
+    omitted.push(key);
+    const candidate = encodeState(trimmed);
+    if (candidate.length <= budget) {
+      console.warn(
+        `[oauth-state] ${opts.appSlug}: left ${omitted.join(", ")} out of the OAuth state so it can be signed (${String(key)} was ${typeof value === "string" ? value.length : JSON.stringify(value).length} chars; state ${full.length} -> ${candidate.length} chars, room ${budget}). The connect lands on the install's dashboard.`
+      );
+      return { state: candidate, omitted, fits: true };
+    }
+  }
+  console.warn(
+    `[oauth-state] ${opts.appSlug}: the OAuth state is ${full.length} chars and only ${budget} fit inside the signed envelope even without its optional fields, so the platform will send it unsigned.`
+  );
+  return { state: full, omitted: [], fits: false };
+}
 
 // src/fetch.ts
 var DEFAULT_OPTS = {
@@ -2194,6 +2224,20 @@ async function deleteSnapshotIds(env, snapshot, opts) {
 async function purgeIndexByPrefix(env, prefixes, opts) {
   return deleteSnapshotIds(env, await snapshotIndexIds(env, prefixes), opts);
 }
+
+// src/company.ts
+function getCompanyTimezone(env) {
+  const raw = env?.COMPANY_TIMEZONE;
+  if (typeof raw !== "string") return void 0;
+  const zone = raw.trim();
+  if (!zone) return void 0;
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: zone });
+    return zone;
+  } catch {
+    return void 0;
+  }
+}
 export {
   ACTOR_RETIRED_HOOK_TOOL,
   ACTOR_RETIRE_REASONS,
@@ -2215,6 +2259,7 @@ export {
   InboxSendRefusal,
   InvalidUndoEnvelopeError,
   NotConnectedError,
+  OAUTH_STATE_ENVELOPE_MAX_CHARS,
   SPRIGR_DATA_MAX_OBJECTS_PER_CALL,
   SPRIGR_FILE_HOSTS,
   SPRIGR_LOG_LEVELS,
@@ -2265,11 +2310,13 @@ export {
   dispatcherApproval,
   emitMarketplaceEvent,
   encodeState,
+  encodeStateWithinEnvelope,
   fetchFileAsBase64,
   fetchFileBytes,
   fetchWithRetry,
   fullWarning,
   getAppFile,
+  getCompanyTimezone,
   hmacSha256Hex,
   installTokenPost,
   isNotConnectedError,
@@ -2278,6 +2325,7 @@ export {
   logToPlatform,
   makeDataClient,
   manifestIsFresh,
+  oauthStateEnvelopeOverhead,
   offerUndo,
   openFileRef,
   overlaySprigr,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sprigr/apps-app-sdk",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",