@tappify/extension-sdk 2.1.0-beta.2 → 2.1.0

package/dist/server.mjs

@@ -1,20 +1,17 @@
-import {
-  sendEvent,
-  sendWorkEvent,
-  signWebhook
-} from "./chunk-QJMZRV7A.mjs";
 import {
   DEFAULT_JWKS_URL,
   INTERNAL_MESSAGE,
   SERVER_ERROR_CODES,
   createTappifyHandler,
+  readRecord,
+  readText,
   verifyTappifyToken,
   wireError
-} from "./chunk-KZ5NGFUP.mjs";
-import "./chunk-SGCYEEXD.mjs";
+} from "./chunk-C3YNVHBP.mjs";
+import "./chunk-MNDVYPEP.mjs";
 import {
   TapServerError
-} from "./chunk-QXD7WVKK.mjs";
+} from "./chunk-CSTYBKZC.mjs";
 import "./chunk-J5LGTIGS.mjs";
 
 // src/server/adapters.ts
@@ -144,13 +141,68 @@ function toNode(handler) {
     });
   };
 }
+
+// src/server/events.ts
+var DEFAULT_BASE_URL = "https://api.tappify.ai";
+function toHex(buffer) {
+  return Array.from(new Uint8Array(buffer)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function signWebhook(secret, body) {
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(body));
+  return toHex(signature);
+}
+async function rejectionCode(response) {
+  try {
+    const payload = await response.json();
+    return readText(readRecord(payload, "error"), "code");
+  } catch {
+    return null;
+  }
+}
+async function sendEvent(name, payload, options) {
+  const envelope = {
+    event: name,
+    source: options.extensionId,
+    occurredAt: options.occurredAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    dedupeKey: options.dedupeKey ?? crypto.randomUUID(),
+    payload: { ...payload }
+  };
+  if (options.build !== void 0) envelope.build = options.build;
+  const body = JSON.stringify(envelope);
+  const signature = await signWebhook(options.secret, body);
+  const url = options.endpoint ?? `${options.baseUrl ?? DEFAULT_BASE_URL}/api/v1/extensions/hooks/${options.extensionId}/${options.installId}`;
+  const send = options.fetch ?? fetch;
+  const response = await send(url, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      "x-tappify-signature": signature
+    },
+    body
+  });
+  if (!response.ok) {
+    const rejection = await rejectionCode(response);
+    throw new TapServerError(
+      SERVER_ERROR_CODES.WEBHOOK_REJECTED,
+      `Tappify answered ${String(response.status)}${rejection === null ? "" : ` (${rejection})`} for ${name}. Check the inbound signing secret on the extension's Server page, and that the event is declared under contributes.webhooks.`,
+      response.status
+    );
+  }
+}
 export {
   DEFAULT_JWKS_URL,
   SERVER_ERROR_CODES,
   TapServerError,
   createTappifyHandler,
   sendEvent,
-  sendWorkEvent,
   signWebhook,
   toExpress,
   toNode,

package/dist/server.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/adapters.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http';\nimport { TapServerError } from '../client/errors';\nimport { SERVER_ERROR_CODES } from './codes';\nimport type { TappifyFetchHandler } from './handler';\nimport { INTERNAL_MESSAGE, wireError } from './wire';\n\n/**\n * The part of a Node readable stream the adapters use, so neither adapter has to\n * name a framework's own request type.\n */\nexport interface BodyStream {\n  /** Each chunk of the body, in order. */\n  on(event: 'data', listener: (chunk: Uint8Array) => void): unknown;\n  /** The body is complete. */\n  on(event: 'end', listener: () => void): unknown;\n  /** The stream failed; the adapter rejects with the error. */\n  on(event: 'error', listener: (error: Error) => void): unknown;\n}\n\n/** The part of an Express request `toExpress` reads. */\nexport interface ExpressLikeRequest {\n  method: string;\n  /** Preferred over `url`, so a router-mounted path keeps its prefix. */\n  originalUrl?: string;\n  url?: string;\n  headers: Record<string, string | string[] | undefined>;\n  /** A parsed body from `express.json()`, or a raw string. */\n  body?: unknown;\n  /** Used as the scheme of the url handed to the handler. Defaults to `https`. */\n  protocol?: string;\n  /** Present when no parser has consumed the stream, which is then read as-is. */\n  on?: BodyStream['on'];\n}\n\n/** The part of an Express response `toExpress` writes. */\nexport interface ExpressLikeResponse {\n  /** Sets the status and returns the response, so the call chains into `send`. */\n  status(code: number): ExpressLikeResponse;\n  /** Called once per header the handler's response carries. */\n  setHeader(name: string, value: string): void;\n  /** Called once, with the handler's response body as text. */\n  send(body: string): void;\n}\n\n/** What `toExpress` returns: an Express middleware over the three arguments. */\nexport type ExpressMiddleware = (\n  request: ExpressLikeRequest,\n  response: ExpressLikeResponse,\n  next: (error?: unknown) => void,\n) => void;\n\n/** What `toNode` returns: a listener for `http.createServer`. */\nexport type NodeRequestListener = (\n  request: IncomingMessage,\n  response: ServerResponse,\n) => void;\n\nfunction toHeaders(\n  raw: Record<string, string | string[] | undefined>,\n): Headers {\n  const headers = new Headers();\n  for (const [name, value] of Object.entries(raw)) {\n    if (typeof value === 'string') headers.set(name, value);\n    else if (Array.isArray(value)) headers.set(name, value.join(','));\n  }\n  return headers;\n}\n\nfunction originOf(\n  headers: Record<string, string | string[] | undefined>,\n  protocol: string,\n): string {\n  const host = headers.host;\n  return `${protocol}://${typeof host === 'string' ? host : 'localhost'}`;\n}\n\nfunction hasBody(method: string): boolean {\n  return method !== 'GET' && method !== 'HEAD';\n}\n\nfunction readStream(stream: BodyStream): Promise<ArrayBuffer> {\n  return new Promise((resolve, reject) => {\n    const chunks: Uint8Array[] = [];\n    let size = 0;\n\n    stream.on('data', chunk => {\n      chunks.push(chunk);\n      size += chunk.byteLength;\n    });\n\n    stream.on('end', () => {\n      const body = new Uint8Array(size);\n      let offset = 0;\n      for (const chunk of chunks) {\n        body.set(chunk, offset);\n        offset += chunk.byteLength;\n      }\n      resolve(body.buffer);\n    });\n\n    stream.on('error', reject);\n  });\n}\n\nfunction isReadable(\n  request: ExpressLikeRequest,\n): request is ExpressLikeRequest & BodyStream {\n  return typeof request.on === 'function';\n}\n\nasync function expressBody(\n  request: ExpressLikeRequest,\n): Promise<BodyInit | undefined> {\n  if (typeof request.body === 'string') return request.body;\n  if (request.body !== undefined && request.body !== null) {\n    return JSON.stringify(request.body);\n  }\n\n  if (!isReadable(request)) {\n    throw new TapServerError(\n      SERVER_ERROR_CODES.BODY_INVALID,\n      'The Express request carried no parsed body and no readable stream, so the call would have run against an empty body. Mount express.json() before the Tappify middleware, or mount the middleware before any parser that consumes the stream.',\n      400,\n    );\n  }\n\n  const bytes = await readStream(request);\n  return bytes.byteLength > 0 ? bytes : undefined;\n}\n\nasync function write(\n  response: ExpressLikeResponse,\n  webResponse: Response,\n): Promise<void> {\n  webResponse.headers.forEach((value, name) => {\n    response.setHeader(name, value);\n  });\n  response.status(webResponse.status).send(await webResponse.text());\n}\n\n/**\n * Wraps the handler as Express middleware, for a server that speaks Express\n * rather than `fetch`.\n *\n * @remarks\n * It builds the url from `originalUrl` and the `host` header, forwards every\n * header, and takes the body from `request.body` when a parser has already read\n * it or from the stream when none has. A request with neither — a parser that\n * consumed the stream without leaving a body — fails with a `TapServerError`\n * carrying `TAP_BODY_INVALID` rather than calling your handler against an empty\n * body, so mount `express.json()` before this middleware or mount this one first.\n * A `TapServerError` is written as the handler's own JSON error; anything else\n * goes to `next`, so your own error middleware sees it.\n *\n * @example\n * ```ts\n * import { createTappifyHandler, toExpress } from '@tappify/extension-sdk/server';\n *\n * const middleware = toExpress(\n *   createTappifyHandler({ extensionId: 'starter', health: () => ({ ok: true }) }),\n * );\n * ```\n */\nexport function toExpress(handler: TappifyFetchHandler): ExpressMiddleware {\n  return (request, response, next) => {\n    void (async () => {\n      const url = new URL(\n        request.originalUrl ?? request.url ?? '/',\n        originOf(request.headers, request.protocol ?? 'https'),\n      );\n\n      const init: RequestInit = {\n        method: request.method,\n        headers: toHeaders(request.headers),\n      };\n\n      if (hasBody(request.method)) {\n        init.body = await expressBody(request);\n      }\n\n      await write(response, await handler(new Request(url, init)));\n    })().catch((error: unknown) => {\n      if (TapServerError.is(error)) {\n        void write(\n          response,\n          wireError(error.code, error.message, error.status ?? 400),\n        );\n        return;\n      }\n      next(error);\n    });\n  };\n}\n\n/**\n * Wraps the handler as a listener for Node's own `http.createServer`, with no\n * framework in between.\n *\n * @remarks\n * It builds the url from `request.url` and the `host` header over `http`, forwards\n * every header, and reads the body straight off the stream, so nothing may have\n * consumed it first. It answers the whole response itself: a `TapServerError`\n * becomes its own code and status, and anything else becomes 500\n * `TAP_INTERNAL_ERROR`. Put it behind a TLS-terminating proxy in production; the\n * scheme it builds is only what the handler sees in `request.url`.\n *\n * @example\n * ```ts\n * import { createTappifyHandler, toNode } from '@tappify/extension-sdk/server';\n * import { createServer } from 'node:http';\n *\n * const listener = toNode(\n *   createTappifyHandler({ extensionId: 'starter', health: () => ({ ok: true }) }),\n * );\n * const server = createServer(listener);\n * ```\n */\nexport function toNode(handler: TappifyFetchHandler): NodeRequestListener {\n  return (request, response) => {\n    void (async () => {\n      const method = request.method ?? 'GET';\n      const url = new URL(\n        request.url ?? '/',\n        originOf(request.headers, 'http'),\n      );\n\n      const init: RequestInit = {\n        method,\n        headers: toHeaders(request.headers),\n      };\n\n      if (hasBody(method)) {\n        const bytes = await readStream(request);\n        if (bytes.byteLength > 0) init.body = bytes;\n      }\n\n      const webResponse = await handler(new Request(url, init));\n      const headers: Record<string, string> = {};\n      webResponse.headers.forEach((value, name) => {\n        headers[name] = value;\n      });\n\n      response.writeHead(webResponse.status, headers);\n      response.end(await webResponse.text());\n    })().catch((error: unknown) => {\n      const wire = TapServerError.is(error)\n        ? {\n            code: error.code,\n            message: error.message,\n            status: error.status ?? 400,\n          }\n        : {\n            code: SERVER_ERROR_CODES.INTERNAL_ERROR,\n            message: INTERNAL_MESSAGE,\n            status: 500,\n          };\n\n      response.writeHead(wire.status, { 'content-type': 'application/json' });\n      response.end(\n        JSON.stringify({ error: { code: wire.code, message: wire.message } }),\n      );\n    });\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAyDA,SAAS,UACP,KACS;AACT,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC/C,QAAI,OAAO,UAAU,SAAU,SAAQ,IAAI,MAAM,KAAK;AAAA,aAC7C,MAAM,QAAQ,KAAK,EAAG,SAAQ,IAAI,MAAM,MAAM,KAAK,GAAG,CAAC;AAAA,EAClE;AACA,SAAO;AACT;AAEA,SAAS,SACP,SACA,UACQ;AACR,QAAM,OAAO,QAAQ;AACrB,SAAO,GAAG,QAAQ,MAAM,OAAO,SAAS,WAAW,OAAO,WAAW;AACvE;AAEA,SAAS,QAAQ,QAAyB;AACxC,SAAO,WAAW,SAAS,WAAW;AACxC;AAEA,SAAS,WAAW,QAA0C;AAC5D,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAuB,CAAC;AAC9B,QAAI,OAAO;AAEX,WAAO,GAAG,QAAQ,WAAS;AACzB,aAAO,KAAK,KAAK;AACjB,cAAQ,MAAM;AAAA,IAChB,CAAC;AAED,WAAO,GAAG,OAAO,MAAM;AACrB,YAAM,OAAO,IAAI,WAAW,IAAI;AAChC,UAAI,SAAS;AACb,iBAAW,SAAS,QAAQ;AAC1B,aAAK,IAAI,OAAO,MAAM;AACtB,kBAAU,MAAM;AAAA,MAClB;AACA,cAAQ,KAAK,MAAM;AAAA,IACrB,CAAC;AAED,WAAO,GAAG,SAAS,MAAM;AAAA,EAC3B,CAAC;AACH;AAEA,SAAS,WACP,SAC4C;AAC5C,SAAO,OAAO,QAAQ,OAAO;AAC/B;AAEA,eAAe,YACb,SAC+B;AAC/B,MAAI,OAAO,QAAQ,SAAS,SAAU,QAAO,QAAQ;AACrD,MAAI,QAAQ,SAAS,UAAa,QAAQ,SAAS,MAAM;AACvD,WAAO,KAAK,UAAU,QAAQ,IAAI;AAAA,EACpC;AAEA,MAAI,CAAC,WAAW,OAAO,GAAG;AACxB,UAAM,IAAI;AAAA,MACR,mBAAmB;AAAA,MACnB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,WAAW,OAAO;AACtC,SAAO,MAAM,aAAa,IAAI,QAAQ;AACxC;AAEA,eAAe,MACb,UACA,aACe;AACf,cAAY,QAAQ,QAAQ,CAAC,OAAO,SAAS;AAC3C,aAAS,UAAU,MAAM,KAAK;AAAA,EAChC,CAAC;AACD,WAAS,OAAO,YAAY,MAAM,EAAE,KAAK,MAAM,YAAY,KAAK,CAAC;AACnE;AAyBO,SAAS,UAAU,SAAiD;AACzE,SAAO,CAAC,SAAS,UAAU,SAAS;AAClC,UAAM,YAAY;AAChB,YAAM,MAAM,IAAI;AAAA,QACd,QAAQ,eAAe,QAAQ,OAAO;AAAA,QACtC,SAAS,QAAQ,SAAS,QAAQ,YAAY,OAAO;AAAA,MACvD;AAEA,YAAM,OAAoB;AAAA,QACxB,QAAQ,QAAQ;AAAA,QAChB,SAAS,UAAU,QAAQ,OAAO;AAAA,MACpC;AAEA,UAAI,QAAQ,QAAQ,MAAM,GAAG;AAC3B,aAAK,OAAO,MAAM,YAAY,OAAO;AAAA,MACvC;AAEA,YAAM,MAAM,UAAU,MAAM,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC;AAAA,IAC7D,GAAG,EAAE,MAAM,CAAC,UAAmB;AAC7B,UAAI,eAAe,GAAG,KAAK,GAAG;AAC5B,aAAK;AAAA,UACH;AAAA,UACA,UAAU,MAAM,MAAM,MAAM,SAAS,MAAM,UAAU,GAAG;AAAA,QAC1D;AACA;AAAA,MACF;AACA,WAAK,KAAK;AAAA,IACZ,CAAC;AAAA,EACH;AACF;AAyBO,SAAS,OAAO,SAAmD;AACxE,SAAO,CAAC,SAAS,aAAa;AAC5B,UAAM,YAAY;AAChB,YAAM,SAAS,QAAQ,UAAU;AACjC,YAAM,MAAM,IAAI;AAAA,QACd,QAAQ,OAAO;AAAA,QACf,SAAS,QAAQ,SAAS,MAAM;AAAA,MAClC;AAEA,YAAM,OAAoB;AAAA,QACxB;AAAA,QACA,SAAS,UAAU,QAAQ,OAAO;AAAA,MACpC;AAEA,UAAI,QAAQ,MAAM,GAAG;AACnB,cAAM,QAAQ,MAAM,WAAW,OAAO;AACtC,YAAI,MAAM,aAAa,EAAG,MAAK,OAAO;AAAA,MACxC;AAEA,YAAM,cAAc,MAAM,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC;AACxD,YAAM,UAAkC,CAAC;AACzC,kBAAY,QAAQ,QAAQ,CAAC,OAAO,SAAS;AAC3C,gBAAQ,IAAI,IAAI;AAAA,MAClB,CAAC;AAED,eAAS,UAAU,YAAY,QAAQ,OAAO;AAC9C,eAAS,IAAI,MAAM,YAAY,KAAK,CAAC;AAAA,IACvC,GAAG,EAAE,MAAM,CAAC,UAAmB;AAC7B,YAAM,OAAO,eAAe,GAAG,KAAK,IAChC;AAAA,QACE,MAAM,MAAM;AAAA,QACZ,SAAS,MAAM;AAAA,QACf,QAAQ,MAAM,UAAU;AAAA,MAC1B,IACA;AAAA,QACE,MAAM,mBAAmB;AAAA,QACzB,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAEJ,eAAS,UAAU,KAAK,QAAQ,EAAE,gBAAgB,mBAAmB,CAAC;AACtE,eAAS;AAAA,QACP,KAAK,UAAU,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,QAAQ,EAAE,CAAC;AAAA,MACtE;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":[]}
+{"version":3,"sources":["../src/server/adapters.ts","../src/server/events.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http';\nimport { TapServerError } from '../client/errors';\nimport { SERVER_ERROR_CODES } from './codes';\nimport type { TappifyFetchHandler } from './handler';\nimport { INTERNAL_MESSAGE, wireError } from './wire';\n\n/**\n * The part of a Node readable stream the adapters use, so neither adapter has to\n * name a framework's own request type.\n */\nexport interface BodyStream {\n  /** Each chunk of the body, in order. */\n  on(event: 'data', listener: (chunk: Uint8Array) => void): unknown;\n  /** The body is complete. */\n  on(event: 'end', listener: () => void): unknown;\n  /** The stream failed; the adapter rejects with the error. */\n  on(event: 'error', listener: (error: Error) => void): unknown;\n}\n\n/** The part of an Express request `toExpress` reads. */\nexport interface ExpressLikeRequest {\n  method: string;\n  /** Preferred over `url`, so a router-mounted path keeps its prefix. */\n  originalUrl?: string;\n  url?: string;\n  headers: Record<string, string | string[] | undefined>;\n  /** A parsed body from `express.json()`, or a raw string. */\n  body?: unknown;\n  /** Used as the scheme of the url handed to the handler. Defaults to `https`. */\n  protocol?: string;\n  /** Present when no parser has consumed the stream, which is then read as-is. */\n  on?: BodyStream['on'];\n}\n\n/** The part of an Express response `toExpress` writes. */\nexport interface ExpressLikeResponse {\n  /** Sets the status and returns the response, so the call chains into `send`. */\n  status(code: number): ExpressLikeResponse;\n  /** Called once per header the handler's response carries. */\n  setHeader(name: string, value: string): void;\n  /** Called once, with the handler's response body as text. */\n  send(body: string): void;\n}\n\n/** What `toExpress` returns: an Express middleware over the three arguments. */\nexport type ExpressMiddleware = (\n  request: ExpressLikeRequest,\n  response: ExpressLikeResponse,\n  next: (error?: unknown) => void,\n) => void;\n\n/** What `toNode` returns: a listener for `http.createServer`. */\nexport type NodeRequestListener = (\n  request: IncomingMessage,\n  response: ServerResponse,\n) => void;\n\nfunction toHeaders(\n  raw: Record<string, string | string[] | undefined>,\n): Headers {\n  const headers = new Headers();\n  for (const [name, value] of Object.entries(raw)) {\n    if (typeof value === 'string') headers.set(name, value);\n    else if (Array.isArray(value)) headers.set(name, value.join(','));\n  }\n  return headers;\n}\n\nfunction originOf(\n  headers: Record<string, string | string[] | undefined>,\n  protocol: string,\n): string {\n  const host = headers.host;\n  return `${protocol}://${typeof host === 'string' ? host : 'localhost'}`;\n}\n\nfunction hasBody(method: string): boolean {\n  return method !== 'GET' && method !== 'HEAD';\n}\n\nfunction readStream(stream: BodyStream): Promise<ArrayBuffer> {\n  return new Promise((resolve, reject) => {\n    const chunks: Uint8Array[] = [];\n    let size = 0;\n\n    stream.on('data', chunk => {\n      chunks.push(chunk);\n      size += chunk.byteLength;\n    });\n\n    stream.on('end', () => {\n      const body = new Uint8Array(size);\n      let offset = 0;\n      for (const chunk of chunks) {\n        body.set(chunk, offset);\n        offset += chunk.byteLength;\n      }\n      resolve(body.buffer);\n    });\n\n    stream.on('error', reject);\n  });\n}\n\nfunction isReadable(\n  request: ExpressLikeRequest,\n): request is ExpressLikeRequest & BodyStream {\n  return typeof request.on === 'function';\n}\n\nasync function expressBody(\n  request: ExpressLikeRequest,\n): Promise<BodyInit | undefined> {\n  if (typeof request.body === 'string') return request.body;\n  if (request.body !== undefined && request.body !== null) {\n    return JSON.stringify(request.body);\n  }\n\n  if (!isReadable(request)) {\n    throw new TapServerError(\n      SERVER_ERROR_CODES.BODY_INVALID,\n      'The Express request carried no parsed body and no readable stream, so the call would have run against an empty body. Mount express.json() before the Tappify middleware, or mount the middleware before any parser that consumes the stream.',\n      400,\n    );\n  }\n\n  const bytes = await readStream(request);\n  return bytes.byteLength > 0 ? bytes : undefined;\n}\n\nasync function write(\n  response: ExpressLikeResponse,\n  webResponse: Response,\n): Promise<void> {\n  webResponse.headers.forEach((value, name) => {\n    response.setHeader(name, value);\n  });\n  response.status(webResponse.status).send(await webResponse.text());\n}\n\n/**\n * Wraps the handler as Express middleware, for a server that speaks Express\n * rather than `fetch`.\n *\n * @remarks\n * It builds the url from `originalUrl` and the `host` header, forwards every\n * header, and takes the body from `request.body` when a parser has already read\n * it or from the stream when none has. A request with neither — a parser that\n * consumed the stream without leaving a body — fails with a `TapServerError`\n * carrying `TAP_BODY_INVALID` rather than calling your handler against an empty\n * body, so mount `express.json()` before this middleware or mount this one first.\n * A `TapServerError` is written as the handler's own JSON error; anything else\n * goes to `next`, so your own error middleware sees it.\n *\n * @example\n * ```ts\n * import { createTappifyHandler, toExpress } from '@tappify/extension-sdk/server';\n *\n * const middleware = toExpress(\n *   createTappifyHandler({ extensionId: 'starter', health: () => ({ ok: true }) }),\n * );\n * ```\n */\nexport function toExpress(handler: TappifyFetchHandler): ExpressMiddleware {\n  return (request, response, next) => {\n    void (async () => {\n      const url = new URL(\n        request.originalUrl ?? request.url ?? '/',\n        originOf(request.headers, request.protocol ?? 'https'),\n      );\n\n      const init: RequestInit = {\n        method: request.method,\n        headers: toHeaders(request.headers),\n      };\n\n      if (hasBody(request.method)) {\n        init.body = await expressBody(request);\n      }\n\n      await write(response, await handler(new Request(url, init)));\n    })().catch((error: unknown) => {\n      if (TapServerError.is(error)) {\n        void write(\n          response,\n          wireError(error.code, error.message, error.status ?? 400),\n        );\n        return;\n      }\n      next(error);\n    });\n  };\n}\n\n/**\n * Wraps the handler as a listener for Node's own `http.createServer`, with no\n * framework in between.\n *\n * @remarks\n * It builds the url from `request.url` and the `host` header over `http`, forwards\n * every header, and reads the body straight off the stream, so nothing may have\n * consumed it first. It answers the whole response itself: a `TapServerError`\n * becomes its own code and status, and anything else becomes 500\n * `TAP_INTERNAL_ERROR`. Put it behind a TLS-terminating proxy in production; the\n * scheme it builds is only what the handler sees in `request.url`.\n *\n * @example\n * ```ts\n * import { createTappifyHandler, toNode } from '@tappify/extension-sdk/server';\n * import { createServer } from 'node:http';\n *\n * const listener = toNode(\n *   createTappifyHandler({ extensionId: 'starter', health: () => ({ ok: true }) }),\n * );\n * const server = createServer(listener);\n * ```\n */\nexport function toNode(handler: TappifyFetchHandler): NodeRequestListener {\n  return (request, response) => {\n    void (async () => {\n      const method = request.method ?? 'GET';\n      const url = new URL(\n        request.url ?? '/',\n        originOf(request.headers, 'http'),\n      );\n\n      const init: RequestInit = {\n        method,\n        headers: toHeaders(request.headers),\n      };\n\n      if (hasBody(method)) {\n        const bytes = await readStream(request);\n        if (bytes.byteLength > 0) init.body = bytes;\n      }\n\n      const webResponse = await handler(new Request(url, init));\n      const headers: Record<string, string> = {};\n      webResponse.headers.forEach((value, name) => {\n        headers[name] = value;\n      });\n\n      response.writeHead(webResponse.status, headers);\n      response.end(await webResponse.text());\n    })().catch((error: unknown) => {\n      const wire = TapServerError.is(error)\n        ? {\n            code: error.code,\n            message: error.message,\n            status: error.status ?? 400,\n          }\n        : {\n            code: SERVER_ERROR_CODES.INTERNAL_ERROR,\n            message: INTERNAL_MESSAGE,\n            status: 500,\n          };\n\n      response.writeHead(wire.status, { 'content-type': 'application/json' });\n      response.end(\n        JSON.stringify({ error: { code: wire.code, message: wire.message } }),\n      );\n    });\n  };\n}\n","import { TapServerError } from '../client/errors';\nimport type { WebhookName, WebhookPayload } from '../client/types';\nimport { SERVER_ERROR_CODES } from './codes';\nimport { readRecord, readText } from './wire';\n\n/** The body `sendEvent` posts to Tappify, and the body the signature covers. */\nexport interface WebhookEnvelope {\n  /** The declared webhook name. */\n  event: string;\n  /** The extension id the event came from. */\n  source: string;\n  /** When the event happened, as an ISO timestamp. */\n  occurredAt: string;\n  /** The build the event belongs to, when it belongs to one. */\n  build?: string;\n  /** The key Tappify deduplicates on, so a retry is not counted twice. */\n  dedupeKey: string;\n  payload: Record<string, unknown>;\n}\n\n/** The third argument of `sendEvent`. */\nexport interface SendEventOptions {\n  /** Which install the event belongs to. */\n  installId: string;\n  extensionId: string;\n  /** The inbound signing secret from the extension's Server page. */\n  secret: string;\n  /** A full url to post to, which replaces `baseUrl` and the built path. */\n  endpoint?: string;\n  /** The Tappify origin to build the path under. Defaults to production. */\n  baseUrl?: string;\n  /** Defaults to a fresh UUID, so give your own to make a retry idempotent. */\n  dedupeKey?: string;\n  build?: string;\n  /** Defaults to now, in ISO form. */\n  occurredAt?: string;\n  /** A `fetch` of your own, for a test or a proxy. Defaults to the global one. */\n  fetch?: typeof fetch;\n}\n\nconst DEFAULT_BASE_URL = 'https://api.tappify.ai';\n\nfunction toHex(buffer: ArrayBuffer): string {\n  return Array.from(new Uint8Array(buffer))\n    .map(byte => byte.toString(16).padStart(2, '0'))\n    .join('');\n}\n\n/**\n * Returns the hex HMAC-SHA-256 of a raw body under a shared secret.\n *\n * @remarks\n * This is the value `sendEvent` sends as `X-Tappify-Signature`, computed over the\n * exact bytes of the body it posts. Call it directly only when you build the\n * request yourself, and sign the serialised string you send rather than\n * re-serialising the object, because a different key order is a different\n * signature. Uses Web Crypto, so it runs on Node, Cloudflare Workers and Vercel\n * alike.\n *\n * @example\n * ```ts\n * import { signWebhook } from '@tappify/extension-sdk/server';\n *\n * async function signed(body: string): Promise<Record<string, string>> {\n *   return { 'x-tappify-signature': await signWebhook('whsec_test', body) };\n * }\n * ```\n */\nexport async function signWebhook(\n  secret: string,\n  body: string,\n): Promise<string> {\n  const encoder = new TextEncoder();\n  const key = await crypto.subtle.importKey(\n    'raw',\n    encoder.encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  );\n  const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(body));\n  return toHex(signature);\n}\n\nasync function rejectionCode(response: Response): Promise<string | null> {\n  try {\n    const payload: unknown = await response.json();\n    return readText(readRecord(payload, 'error'), 'code');\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Posts one of your declared webhook events to Tappify, signed with the install's\n * inbound secret.\n *\n * @remarks\n * The name and the payload are narrowed by the `TapWebhookMap` augmentation\n * `tappify extension types` writes. It builds the envelope, signs the serialised\n * body and posts it to the install's hook path under `baseUrl`, or to `endpoint`\n * when you give one. A response Tappify did not accept rejects with a\n * `TapServerError` whose `code` is always `TAP_WEBHOOK_REJECTED`, carrying the HTTP\n * status, and with Tappify's own code in the message text rather than in `code`;\n * the two usual causes are the wrong signing\n * secret and an event the manifest does not declare. Pass your own `dedupeKey` to\n * make a retry idempotent, because the default is a fresh UUID.\n *\n * @example\n * ```ts\n * import { sendEvent } from '@tappify/extension-sdk/server';\n *\n * async function reportAnomaly(installId: string, why: string): Promise<void> {\n *   await sendEvent('anomaly.detected', { why }, {\n *     installId,\n *     extensionId: 'starter',\n *     secret: process.env.TAPPIFY_INBOUND_SECRET ?? '',\n *     dedupeKey: `anomaly-${installId}-${why}`,\n *   });\n * }\n * ```\n */\nexport async function sendEvent<E extends WebhookName>(\n  name: E,\n  payload: WebhookPayload<E>,\n  options: SendEventOptions,\n): Promise<void> {\n  const envelope: WebhookEnvelope = {\n    event: name,\n    source: options.extensionId,\n    occurredAt: options.occurredAt ?? new Date().toISOString(),\n    dedupeKey: options.dedupeKey ?? crypto.randomUUID(),\n    payload: { ...payload },\n  };\n\n  if (options.build !== undefined) envelope.build = options.build;\n\n  const body = JSON.stringify(envelope);\n  const signature = await signWebhook(options.secret, body);\n  const url =\n    options.endpoint ??\n    `${options.baseUrl ?? DEFAULT_BASE_URL}/api/v1/extensions/hooks/${options.extensionId}/${options.installId}`;\n\n  const send = options.fetch ?? fetch;\n  const response = await send(url, {\n    method: 'POST',\n    headers: {\n      'content-type': 'application/json',\n      'x-tappify-signature': signature,\n    },\n    body,\n  });\n\n  if (!response.ok) {\n    const rejection = await rejectionCode(response);\n    throw new TapServerError(\n      SERVER_ERROR_CODES.WEBHOOK_REJECTED,\n      `Tappify answered ${String(response.status)}${rejection === null ? '' : ` (${rejection})`} for ${name}. Check the inbound signing secret on the extension's Server page, and that the event is declared under contributes.webhooks.`,\n      response.status,\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAyDA,SAAS,UACP,KACS;AACT,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC/C,QAAI,OAAO,UAAU,SAAU,SAAQ,IAAI,MAAM,KAAK;AAAA,aAC7C,MAAM,QAAQ,KAAK,EAAG,SAAQ,IAAI,MAAM,MAAM,KAAK,GAAG,CAAC;AAAA,EAClE;AACA,SAAO;AACT;AAEA,SAAS,SACP,SACA,UACQ;AACR,QAAM,OAAO,QAAQ;AACrB,SAAO,GAAG,QAAQ,MAAM,OAAO,SAAS,WAAW,OAAO,WAAW;AACvE;AAEA,SAAS,QAAQ,QAAyB;AACxC,SAAO,WAAW,SAAS,WAAW;AACxC;AAEA,SAAS,WAAW,QAA0C;AAC5D,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAuB,CAAC;AAC9B,QAAI,OAAO;AAEX,WAAO,GAAG,QAAQ,WAAS;AACzB,aAAO,KAAK,KAAK;AACjB,cAAQ,MAAM;AAAA,IAChB,CAAC;AAED,WAAO,GAAG,OAAO,MAAM;AACrB,YAAM,OAAO,IAAI,WAAW,IAAI;AAChC,UAAI,SAAS;AACb,iBAAW,SAAS,QAAQ;AAC1B,aAAK,IAAI,OAAO,MAAM;AACtB,kBAAU,MAAM;AAAA,MAClB;AACA,cAAQ,KAAK,MAAM;AAAA,IACrB,CAAC;AAED,WAAO,GAAG,SAAS,MAAM;AAAA,EAC3B,CAAC;AACH;AAEA,SAAS,WACP,SAC4C;AAC5C,SAAO,OAAO,QAAQ,OAAO;AAC/B;AAEA,eAAe,YACb,SAC+B;AAC/B,MAAI,OAAO,QAAQ,SAAS,SAAU,QAAO,QAAQ;AACrD,MAAI,QAAQ,SAAS,UAAa,QAAQ,SAAS,MAAM;AACvD,WAAO,KAAK,UAAU,QAAQ,IAAI;AAAA,EACpC;AAEA,MAAI,CAAC,WAAW,OAAO,GAAG;AACxB,UAAM,IAAI;AAAA,MACR,mBAAmB;AAAA,MACnB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,WAAW,OAAO;AACtC,SAAO,MAAM,aAAa,IAAI,QAAQ;AACxC;AAEA,eAAe,MACb,UACA,aACe;AACf,cAAY,QAAQ,QAAQ,CAAC,OAAO,SAAS;AAC3C,aAAS,UAAU,MAAM,KAAK;AAAA,EAChC,CAAC;AACD,WAAS,OAAO,YAAY,MAAM,EAAE,KAAK,MAAM,YAAY,KAAK,CAAC;AACnE;AAyBO,SAAS,UAAU,SAAiD;AACzE,SAAO,CAAC,SAAS,UAAU,SAAS;AAClC,UAAM,YAAY;AAChB,YAAM,MAAM,IAAI;AAAA,QACd,QAAQ,eAAe,QAAQ,OAAO;AAAA,QACtC,SAAS,QAAQ,SAAS,QAAQ,YAAY,OAAO;AAAA,MACvD;AAEA,YAAM,OAAoB;AAAA,QACxB,QAAQ,QAAQ;AAAA,QAChB,SAAS,UAAU,QAAQ,OAAO;AAAA,MACpC;AAEA,UAAI,QAAQ,QAAQ,MAAM,GAAG;AAC3B,aAAK,OAAO,MAAM,YAAY,OAAO;AAAA,MACvC;AAEA,YAAM,MAAM,UAAU,MAAM,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC;AAAA,IAC7D,GAAG,EAAE,MAAM,CAAC,UAAmB;AAC7B,UAAI,eAAe,GAAG,KAAK,GAAG;AAC5B,aAAK;AAAA,UACH;AAAA,UACA,UAAU,MAAM,MAAM,MAAM,SAAS,MAAM,UAAU,GAAG;AAAA,QAC1D;AACA;AAAA,MACF;AACA,WAAK,KAAK;AAAA,IACZ,CAAC;AAAA,EACH;AACF;AAyBO,SAAS,OAAO,SAAmD;AACxE,SAAO,CAAC,SAAS,aAAa;AAC5B,UAAM,YAAY;AAChB,YAAM,SAAS,QAAQ,UAAU;AACjC,YAAM,MAAM,IAAI;AAAA,QACd,QAAQ,OAAO;AAAA,QACf,SAAS,QAAQ,SAAS,MAAM;AAAA,MAClC;AAEA,YAAM,OAAoB;AAAA,QACxB;AAAA,QACA,SAAS,UAAU,QAAQ,OAAO;AAAA,MACpC;AAEA,UAAI,QAAQ,MAAM,GAAG;AACnB,cAAM,QAAQ,MAAM,WAAW,OAAO;AACtC,YAAI,MAAM,aAAa,EAAG,MAAK,OAAO;AAAA,MACxC;AAEA,YAAM,cAAc,MAAM,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC;AACxD,YAAM,UAAkC,CAAC;AACzC,kBAAY,QAAQ,QAAQ,CAAC,OAAO,SAAS;AAC3C,gBAAQ,IAAI,IAAI;AAAA,MAClB,CAAC;AAED,eAAS,UAAU,YAAY,QAAQ,OAAO;AAC9C,eAAS,IAAI,MAAM,YAAY,KAAK,CAAC;AAAA,IACvC,GAAG,EAAE,MAAM,CAAC,UAAmB;AAC7B,YAAM,OAAO,eAAe,GAAG,KAAK,IAChC;AAAA,QACE,MAAM,MAAM;AAAA,QACZ,SAAS,MAAM;AAAA,QACf,QAAQ,MAAM,UAAU;AAAA,MAC1B,IACA;AAAA,QACE,MAAM,mBAAmB;AAAA,QACzB,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAEJ,eAAS,UAAU,KAAK,QAAQ,EAAE,gBAAgB,mBAAmB,CAAC;AACtE,eAAS;AAAA,QACP,KAAK,UAAU,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,QAAQ,EAAE,CAAC;AAAA,MACtE;AAAA,IACF,CAAC;AAAA,EACH;AACF;;;AC/NA,IAAM,mBAAmB;AAEzB,SAAS,MAAM,QAA6B;AAC1C,SAAO,MAAM,KAAK,IAAI,WAAW,MAAM,CAAC,EACrC,IAAI,UAAQ,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC9C,KAAK,EAAE;AACZ;AAsBA,eAAsB,YACpB,QACA,MACiB;AACjB,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,QAAQ,OAAO,MAAM;AAAA,IACrB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,YAAY,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,IAAI,CAAC;AAC5E,SAAO,MAAM,SAAS;AACxB;AAEA,eAAe,cAAc,UAA4C;AACvE,MAAI;AACF,UAAM,UAAmB,MAAM,SAAS,KAAK;AAC7C,WAAO,SAAS,WAAW,SAAS,OAAO,GAAG,MAAM;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AA+BA,eAAsB,UACpB,MACA,SACA,SACe;AACf,QAAM,WAA4B;AAAA,IAChC,OAAO;AAAA,IACP,QAAQ,QAAQ;AAAA,IAChB,YAAY,QAAQ,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,IACzD,WAAW,QAAQ,aAAa,OAAO,WAAW;AAAA,IAClD,SAAS,EAAE,GAAG,QAAQ;AAAA,EACxB;AAEA,MAAI,QAAQ,UAAU,OAAW,UAAS,QAAQ,QAAQ;AAE1D,QAAM,OAAO,KAAK,UAAU,QAAQ;AACpC,QAAM,YAAY,MAAM,YAAY,QAAQ,QAAQ,IAAI;AACxD,QAAM,MACJ,QAAQ,YACR,GAAG,QAAQ,WAAW,gBAAgB,4BAA4B,QAAQ,WAAW,IAAI,QAAQ,SAAS;AAE5G,QAAM,OAAO,QAAQ,SAAS;AAC9B,QAAM,WAAW,MAAM,KAAK,KAAK;AAAA,IAC/B,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,IACzB;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,YAAY,MAAM,cAAc,QAAQ;AAC9C,UAAM,IAAI;AAAA,MACR,mBAAmB;AAAA,MACnB,oBAAoB,OAAO,SAAS,MAAM,CAAC,GAAG,cAAc,OAAO,KAAK,KAAK,SAAS,GAAG,QAAQ,IAAI;AAAA,MACrG,SAAS;AAAA,IACX;AAAA,EACF;AACF;","names":[]}

package/dist/styles.css

@@ -0,0 +1,367 @@
+.tap-root {
+  font-family: var(--font-sans, system-ui, -apple-system, sans-serif);
+  color: var(--fg-default, #121212);
+  container-type: inline-size;
+  container-name: tap-mount;
+  line-height: 1.45;
+  font-size: 13px;
+}
+
+.tap-root *,
+.tap-root *::before,
+.tap-root *::after {
+  box-sizing: border-box;
+}
+
+.tap-stack {
+  display: flex;
+  flex-direction: column;
+  gap: var(--tap-space, 8px);
+}
+
+.tap-row {
+  display: flex;
+  align-items: center;
+  gap: var(--tap-space, 8px);
+}
+
+.tap-btn {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 6px;
+  border: 1px solid transparent;
+  border-radius: var(--tap-radius, 6px);
+  font: inherit;
+  font-weight: 500;
+  cursor: pointer;
+  padding: 6px 12px;
+  transition:
+    background-color 120ms ease,
+    border-color 120ms ease;
+}
+
+.tap-btn:disabled {
+  opacity: 0.55;
+  cursor: not-allowed;
+}
+
+.tap-btn:focus-visible {
+  outline: 2px solid var(--tap-accent, #4f46e5);
+  outline-offset: 2px;
+}
+
+.tap-btn--sm {
+  padding: 3px 8px;
+  font-size: 12px;
+}
+
+.tap-btn--primary {
+  background: var(--tap-accent, #4f46e5);
+  color: var(--tap-accent-fg, #ffffff);
+}
+
+.tap-btn--secondary {
+  background: var(--bg-raised, #ffffff);
+  color: var(--fg-default, #121212);
+  border-color: var(--divider, rgba(18, 18, 18, 0.12));
+}
+
+.tap-btn--ghost {
+  background: transparent;
+  color: var(--fg-muted, rgba(18, 18, 18, 0.6));
+}
+
+.tap-btn--danger {
+  background: var(--tap-danger, #b42318);
+  color: var(--tap-accent-fg, #ffffff);
+}
+
+.tap-card {
+  background: var(--bg-raised, #ffffff);
+  border: 1px solid var(--divider, rgba(18, 18, 18, 0.12));
+  border-radius: var(--tap-radius, 6px);
+  display: flex;
+  flex-direction: column;
+  min-width: 0;
+}
+
+.tap-card__head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: var(--tap-space, 8px);
+  padding: 10px 12px;
+  border-bottom: 1px solid var(--divider, rgba(18, 18, 18, 0.12));
+  font-weight: 600;
+}
+
+.tap-card__body {
+  padding: 12px;
+  min-width: 0;
+}
+
+.tap-card__foot {
+  padding: 8px 12px;
+  border-top: 1px solid var(--divider, rgba(18, 18, 18, 0.12));
+  color: var(--fg-muted, rgba(18, 18, 18, 0.6));
+}
+
+.tap-page-header {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: var(--tap-space, 8px);
+  padding-bottom: 12px;
+  border-bottom: 1px solid var(--divider, rgba(18, 18, 18, 0.12));
+  margin-bottom: 16px;
+}
+
+.tap-page-header__title {
+  margin: 0;
+  font-size: 18px;
+  font-weight: 600;
+}
+
+.tap-page-header__description {
+  margin: 4px 0 0;
+  color: var(--fg-muted, rgba(18, 18, 18, 0.6));
+}
+
+.tap-skeleton {
+  display: block;
+  height: 12px;
+  border-radius: 4px;
+  background: var(--bg-subtle, rgba(18, 18, 18, 0.06));
+  animation: tap-pulse 1.4s ease-in-out infinite;
+}
+
+.tap-skeleton + .tap-skeleton {
+  margin-top: 6px;
+}
+
+@keyframes tap-pulse {
+  0%,
+  100% {
+    opacity: 1;
+  }
+  50% {
+    opacity: 0.5;
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .tap-skeleton {
+    animation: none;
+  }
+}
+
+.tap-state {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 6px;
+  text-align: center;
+  padding: 24px 16px;
+  color: var(--fg-muted, rgba(18, 18, 18, 0.6));
+}
+
+.tap-state__title {
+  color: var(--fg-default, #121212);
+  font-weight: 600;
+}
+
+.tap-state--error .tap-state__title {
+  color: var(--tap-danger, #b42318);
+}
+
+.tap-state__code {
+  font-family: var(--font-mono, ui-monospace, SFMono-Regular, monospace);
+  font-size: 11px;
+}
+
+.tap-stat {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  min-width: 0;
+}
+
+.tap-stat__label {
+  color: var(--fg-muted, rgba(18, 18, 18, 0.6));
+  font-size: 11px;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+}
+
+.tap-stat__value {
+  font-size: 22px;
+  font-weight: 600;
+  font-variant-numeric: tabular-nums;
+  line-height: 1.1;
+}
+
+.tap-stat__delta--up {
+  color: var(--tap-accent, #4f46e5);
+}
+
+.tap-stat__delta--down {
+  color: var(--tap-danger, #b42318);
+}
+
+.tap-field {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+}
+
+.tap-field__label {
+  font-weight: 500;
+}
+
+.tap-field__hint,
+.tap-field__error {
+  font-size: 11px;
+}
+
+.tap-field__hint {
+  color: var(--fg-muted, rgba(18, 18, 18, 0.6));
+}
+
+.tap-field__error {
+  color: var(--tap-danger, #b42318);
+}
+
+.tap-control {
+  font: inherit;
+  color: inherit;
+  background: var(--bg-base, #ffffff);
+  border: 1px solid var(--divider, rgba(18, 18, 18, 0.12));
+  border-radius: var(--tap-radius, 6px);
+  padding: 6px 8px;
+  width: 100%;
+  min-width: 0;
+}
+
+.tap-control:focus-visible {
+  outline: 2px solid var(--tap-accent, #4f46e5);
+  outline-offset: 1px;
+}
+
+.tap-control--invalid {
+  border-color: var(--tap-danger, #b42318);
+}
+
+.tap-control--checkbox {
+  width: auto;
+}
+
+textarea.tap-control {
+  min-height: 76px;
+  resize: vertical;
+}
+
+.tap-table-wrap {
+  overflow-x: auto;
+}
+
+.tap-table {
+  width: 100%;
+  border-collapse: collapse;
+}
+
+.tap-table th,
+.tap-table td {
+  text-align: start;
+  padding: 6px 8px;
+  border-bottom: 1px solid var(--divider, rgba(18, 18, 18, 0.12));
+  white-space: nowrap;
+}
+
+.tap-table th {
+  color: var(--fg-muted, rgba(18, 18, 18, 0.6));
+  font-size: 11px;
+  font-weight: 500;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+}
+
+.tap-table__end {
+  text-align: end;
+  font-variant-numeric: tabular-nums;
+}
+
+.tap-table tr[data-clickable='true'] {
+  cursor: pointer;
+}
+
+.tap-table tr[data-clickable='true']:hover td {
+  background: var(--bg-subtle, rgba(18, 18, 18, 0.04));
+}
+
+.tap-dialog-scrim {
+  position: fixed;
+  inset: 0;
+  background: var(--tap-scrim, rgba(18, 18, 18, 0.7));
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 24px;
+  z-index: 1;
+}
+
+.tap-dialog {
+  background: var(--bg-raised, #ffffff);
+  color: var(--fg-default, #121212);
+  border-radius: var(--tap-radius, 6px);
+  border: 1px solid var(--divider, rgba(18, 18, 18, 0.12));
+  width: min(520px, 100%);
+  max-height: 100%;
+  display: flex;
+  flex-direction: column;
+  overflow: hidden;
+}
+
+.tap-dialog__head {
+  padding: 12px 16px;
+  border-bottom: 1px solid var(--divider, rgba(18, 18, 18, 0.12));
+  font-weight: 600;
+}
+
+.tap-dialog__body {
+  padding: 16px;
+  overflow: auto;
+}
+
+.tap-dialog__foot {
+  padding: 12px 16px;
+  border-top: 1px solid var(--divider, rgba(18, 18, 18, 0.12));
+  display: flex;
+  justify-content: flex-end;
+  gap: 8px;
+}
+
+.tap-form {
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+}
+
+.tap-form__actions {
+  display: flex;
+  justify-content: flex-end;
+  gap: 8px;
+}
+
+@container tap-mount (max-width: 360px) {
+  .tap-page-header,
+  .tap-form__actions,
+  .tap-dialog__foot {
+    flex-direction: column;
+    align-items: stretch;
+  }
+
+  .tap-stat__value {
+    font-size: 18px;
+  }
+}

package/dist/testing/index.cjs

@@ -2,7 +2,6 @@
 
 
 
-var _chunkO357OJXLcjs = require('../chunk-O357OJXL.cjs');
 
 
 
@@ -15,27 +14,25 @@ var _chunkO357OJXLcjs = require('../chunk-O357OJXL.cjs');
 
 
 
+var _chunkNFUPPCX4cjs = require('../chunk-NFUPPCX4.cjs');
 
 
 
+var _chunk5AAPD5WVcjs = require('../chunk-5AAPD5WV.cjs');
 
-var _chunkBPCGXXMDcjs = require('../chunk-BPCGXXMD.cjs');
 
+var _chunkJMUK3K47cjs = require('../chunk-JMUK3K47.cjs');
+require('../chunk-OPPYEA7F.cjs');
+require('../chunk-G7XZSN2Q.cjs');
 
 
-var _chunkGAUZYBXEcjs = require('../chunk-GAUZYBXE.cjs');
+var _chunkPYJMJF44cjs = require('../chunk-PYJMJF44.cjs');
 
 
-var _chunkVV7ELNRWcjs = require('../chunk-VV7ELNRW.cjs');
-require('../chunk-PRCZMOLD.cjs');
 
 
-var _chunkEB5XWQAUcjs = require('../chunk-EB5XWQAU.cjs');
-require('../chunk-A74HCO6T.cjs');
-
-
-var _chunk7YKH4LZNcjs = require('../chunk-7YKH4LZN.cjs');
-require('../chunk-6HETNZJY.cjs');
+var _chunk3YWVYA42cjs = require('../chunk-3YWVYA42.cjs');
+require('../chunk-2DBSVKAU.cjs');
 require('../chunk-Q7SFCCGT.cjs');
 
 // src/testing/render.tsx
@@ -45,18 +42,18 @@ var _reactquery = require('@tanstack/react-query');
 var _react = require('@testing-library/react');
 var _jsxruntime = require('react/jsx-runtime');
 function renderWithTap(ui, options = {}) {
-  const mock = _nullishCoalesce(options.mock, () => ( _chunkBPCGXXMDcjs.createTapMock.call(void 0, options)));
+  const mock = _nullishCoalesce(options.mock, () => ( _chunkNFUPPCX4cjs.createTapMock.call(void 0, options)));
   const queryClient = _nullishCoalesce(options.queryClient, () => ( new (0, _reactquery.QueryClient)({
     defaultOptions: { queries: { retry: false, gcTime: 0 } }
   })));
   const installId = mock.tap.extension.installId;
   mock.tap.invalidate = (name) => {
     void queryClient.invalidateQueries({
-      queryKey: name === void 0 ? _chunkGAUZYBXEcjs.installPrefix.call(void 0, installId) : _chunkGAUZYBXEcjs.procedurePrefix.call(void 0, installId, name)
+      queryKey: name === void 0 ? _chunk5AAPD5WVcjs.installPrefix.call(void 0, installId) : _chunk5AAPD5WVcjs.procedurePrefix.call(void 0, installId, name)
     });
   };
   function Wrapper({ children }) {
-    return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _reactquery.QueryClientProvider, { client: queryClient, children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkVV7ELNRWcjs.TapHostProvider, { tap: mock.tap, children }) });
+    return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _reactquery.QueryClientProvider, { client: queryClient, children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkJMUK3K47cjs.TapHostProvider, { tap: mock.tap, children }) });
   }
   const result = _react.render.call(void 0, ui, { wrapper: Wrapper, container: options.container });
   result.baseElement.append(mock.portal);
@@ -124,67 +121,11 @@ function validateToolResponse(value, returns) {
       `A "${returns}" tool returns an object the host draws as a card, not ${typeof value}.`
     ];
   }
-  return _chunk7YKH4LZNcjs.CARD_KEYS[returns].filter((key) => !(key in body)).map(
+  return _chunkPYJMJF44cjs.CARD_KEYS[returns].filter((key) => !(key in body)).map(
     (key) => `A "${returns}" tool response needs a "${key}" key; the host draws the card from it.`
   );
 }
 
-// src/testing/work-events.ts
-function workCommentCreatedFixture(overrides = {}) {
-  return {
-    type: "comment.created",
-    externalItemId: "item_test",
-    providerEventId: "event_comment_test",
-    occurredAt: "2026-10-15T12:00:00.000Z",
-    dedupeKey: "item_test:event_comment_test",
-    comment: {
-      externalCommentId: "comment_test",
-      body: "A provider comment.",
-      author: { id: "author_test", displayName: "Sam" },
-      createdAt: "2026-10-15T12:00:00.000Z"
-    },
-    ...overrides
-  };
-}
-function workStatusChangedFixture(overrides = {}) {
-  return {
-    type: "status.changed",
-    externalItemId: "item_test",
-    providerEventId: "event_status_test",
-    occurredAt: "2026-10-15T12:00:00.000Z",
-    dedupeKey: "item_test:event_status_test",
-    status: { id: "resolved_test", label: "Resolved", stage: "done" },
-    ...overrides
-  };
-}
-function workItemDeletedFixture(overrides = {}) {
-  return {
-    type: "item.deleted",
-    externalItemId: "item_test",
-    providerEventId: "event_deleted_test",
-    occurredAt: "2026-10-15T12:00:00.000Z",
-    dedupeKey: "item_test:event_deleted_test",
-    ...overrides
-  };
-}
-async function signedWorkEventRequest(event, options) {
-  let request;
-  await _chunkEB5XWQAUcjs.sendWorkEvent.call(void 0, event, {
-    ...options,
-    fetch: (input, init) => {
-      request = new Request(input, init);
-      return Promise.resolve(new Response(null, { status: 202 }));
-    }
-  });
-  if (!request)
-    throw new Error("The work event sender did not produce a request.");
-  return request;
-}
-
-
-
-
-
 
 
 
@@ -206,5 +147,5 @@ async function signedWorkEventRequest(event, options) {
 
 
 
-exports.answerFixtureQuery = _chunkBPCGXXMDcjs.answerFixtureQuery; exports.createTapMock = _chunkBPCGXXMDcjs.createTapMock; exports.createTestClient = _chunkBPCGXXMDcjs.createTestClient; exports.fixtureApps = _chunkBPCGXXMDcjs.fixtureApps; exports.fixtureCrashes = _chunkBPCGXXMDcjs.fixtureCrashes; exports.fixtureKeywords = _chunkBPCGXXMDcjs.fixtureKeywords; exports.fixtureListings = _chunkBPCGXXMDcjs.fixtureListings; exports.fixtureProject = _chunkBPCGXXMDcjs.fixtureProject; exports.fixtureReleases = _chunkBPCGXXMDcjs.fixtureReleases; exports.fixtureRevenue = _chunkBPCGXXMDcjs.fixtureRevenue; exports.fixtureReviews = _chunkBPCGXXMDcjs.fixtureReviews; exports.fixtureSeries = _chunkBPCGXXMDcjs.fixtureSeries; exports.fixtures = _chunkBPCGXXMDcjs.fixtures; exports.installHostTheme = _chunkO357OJXLcjs.installHostTheme; exports.registerTapMatchers = _chunkO357OJXLcjs.registerTapMatchers; exports.renderWithTap = renderWithTap; exports.signTestToken = _chunkBPCGXXMDcjs.signTestToken; exports.signedWorkEventRequest = signedWorkEventRequest; exports.tapMatchers = _chunkO357OJXLcjs.tapMatchers; exports.testJwks = _chunkBPCGXXMDcjs.testJwks; exports.validateMetricsResponse = validateMetricsResponse; exports.validateToolResponse = validateToolResponse; exports.workCommentCreatedFixture = workCommentCreatedFixture; exports.workItemDeletedFixture = workItemDeletedFixture; exports.workStatusChangedFixture = workStatusChangedFixture;
+exports.answerFixtureQuery = _chunkNFUPPCX4cjs.answerFixtureQuery; exports.createTapMock = _chunkNFUPPCX4cjs.createTapMock; exports.createTestClient = _chunkNFUPPCX4cjs.createTestClient; exports.fixtureApps = _chunkNFUPPCX4cjs.fixtureApps; exports.fixtureCrashes = _chunkNFUPPCX4cjs.fixtureCrashes; exports.fixtureKeywords = _chunkNFUPPCX4cjs.fixtureKeywords; exports.fixtureListings = _chunkNFUPPCX4cjs.fixtureListings; exports.fixtureProject = _chunkNFUPPCX4cjs.fixtureProject; exports.fixtureReleases = _chunkNFUPPCX4cjs.fixtureReleases; exports.fixtureRevenue = _chunkNFUPPCX4cjs.fixtureRevenue; exports.fixtureReviews = _chunkNFUPPCX4cjs.fixtureReviews; exports.fixtureSeries = _chunkNFUPPCX4cjs.fixtureSeries; exports.fixtures = _chunkNFUPPCX4cjs.fixtures; exports.installHostTheme = _chunk3YWVYA42cjs.installHostTheme; exports.registerTapMatchers = _chunk3YWVYA42cjs.registerTapMatchers; exports.renderWithTap = renderWithTap; exports.signTestToken = _chunkNFUPPCX4cjs.signTestToken; exports.tapMatchers = _chunk3YWVYA42cjs.tapMatchers; exports.testJwks = _chunkNFUPPCX4cjs.testJwks; exports.validateMetricsResponse = validateMetricsResponse; exports.validateToolResponse = validateToolResponse;
 //# sourceMappingURL=index.cjs.map