@usequeek/app-sdk 0.5.1 → 0.6.0

package/dist/scopes.js

@@ -0,0 +1,297 @@
+import { isInstallationGone, UnknownInstallationError } from "./app-auth.js";
+import { newIdempotencyKey, QueekApiError, queekApiErrorFromResponse } from "./client.js";
+import { isAllowedOpenTarget } from "./frame.js";
+import { installationScopesEqual } from "./install-handlers.js";
+import { resolveAppApiBase } from "./tokens.js";
+/**
+ * Optional scopes (plan item 6, Shopify `scopes.query / request / revoke`
+ * parity — symbol names cited only).
+ *
+ * - `queryScopes`: the cached effective grant split against the app's own
+ *   declared-optional list. Store-read only, never a fetch: the app-credential
+ *   surface exposes the effective grant but no declared-optional list, so
+ *   the split needs the app's manifest knowledge (passed at client
+ *   construction). No network, no guessing.
+ * - `requestScopes`: builds the dashboard deep link that opens the
+ *   merchant's consent screen in the dashboard. The SDK never renders
+ *   consent — it hands the app a link shaped like the bridge
+ *   `open`/`navigate` targets (dashboard-relative path, or an absolute URL
+ *   under a given dashboard origin) for the app to open via `sendOpen` or
+ *   redirect to. The consent screen itself ships with the dashboard (plan
+ *   item 8), which honours this link shape.
+ * - `revokeScopes`: `POST
+ *   /api/v1/apps/installations/{installation}/scopes/revoke` with the app
+ *   JWT (same credential as mint/resync — never auth:sanctum, never the
+ *   installation token). Body `{scopes[]}` (1–50, backend
+ *   `RevokeAppScopesRequest`); an `Idempotency-Key` rides the write for
+ *   discipline (generated when the caller does not supply one — the client
+ *   write discipline), though the route is naturally idempotent: revoking
+ *   a never-granted optional scope is 200 with no change. Required scopes
+ *   refuse 422 `app_scope_required` (surfaced as `AppScopeRequiredError`).
+ *   On 200 the cached grant is refreshed from the response and the cached
+ *   token dropped only when the grant moved (same compare-and-clear as the
+ *   scopes_update handler — the backend rewrites live token rows in place,
+ *   so the drop is backstop, not mechanism).
+ *
+ * Types here are hand-written: the revoke endpoint and the scopes_update
+ * handoff live on the app-credential surface, which the frozen
+ * `openapi/merchant.json` does not cover (types are generated app-side by
+ * `queek app codegen`; the merchant spec file is never hand-edited).
+ */
+/** 422 on the revoke endpoint: required scopes are never revocable (uninstall is the remedy). */
+export const APP_SCOPE_REQUIRED_CODE = "app_scope_required";
+/** 422 on the approve path: the scope is not declared by the live manifest version. */
+export const APP_SCOPE_UNDECLARED_CODE = "app_scope_undeclared";
+/** True for a required-scope refusal on the revoke endpoint (422 `app_scope_required`). */
+export function isAppScopeRequired(status, code) {
+    return status === 422 && code === APP_SCOPE_REQUIRED_CODE;
+}
+/**
+ * A required-scope refusal, typed so callers switch on the class (or
+ * `code`), never on `message`. Carries the offending scopes when the
+ * backend named them.
+ */
+export class AppScopeRequiredError extends QueekApiError {
+    scopes;
+    constructor(status, message, scopes) {
+        super({ status, code: APP_SCOPE_REQUIRED_CODE, message });
+        this.name = "AppScopeRequiredError";
+        this.scopes = scopes;
+    }
+}
+/** Build an `AppScopeRequiredError` from a parsed 422, tolerantly reading the named scopes. */
+export function appScopeRequiredFromError(error) {
+    return new AppScopeRequiredError(error.status, error.message, readErrorScopes(error.errors));
+}
+function readErrorScopes(errors) {
+    if (typeof errors !== "object" || errors === null)
+        return [];
+    const scopes = errors.scopes;
+    if (!Array.isArray(scopes))
+        return [];
+    return scopes.filter((entry) => typeof entry === "string" && entry !== "");
+}
+/** Thrown when a scope list fails client-side validation — before any fetch. */
+export class InvalidScopesError extends Error {
+    code = "invalid_scopes";
+    constructor(message) {
+        super(message);
+        this.name = "InvalidScopesError";
+    }
+}
+/** Backend `RevokeAppScopesRequest` bounds, mirrored client-side. */
+export const MAX_SCOPE_LIST = 50;
+export const MAX_SCOPE_LENGTH = 120;
+/**
+ * Validate + normalise a scope list (trim, drop empties, dedupe keeping
+ * first order). Mirrors the backend contract (`required array min:1
+ * max:50`, string items) so a malformed call fails before any fetch.
+ */
+export function normaliseScopeList(scopes) {
+    if (!Array.isArray(scopes)) {
+        throw new InvalidScopesError("Expected a scopes array.");
+    }
+    const cleaned = [];
+    for (const entry of scopes) {
+        if (typeof entry !== "string") {
+            throw new InvalidScopesError("Every scope must be a string.");
+        }
+        const trimmed = entry.trim();
+        if (trimmed === "" || cleaned.includes(trimmed))
+            continue;
+        if (trimmed.length > MAX_SCOPE_LENGTH) {
+            throw new InvalidScopesError(`Scope ${JSON.stringify(trimmed.slice(0, 40))} exceeds 120 characters.`);
+        }
+        cleaned.push(trimmed);
+    }
+    if (cleaned.length === 0) {
+        throw new InvalidScopesError("Name at least one scope.");
+    }
+    if (cleaned.length > MAX_SCOPE_LIST) {
+        throw new InvalidScopesError(`Too many scopes (max ${MAX_SCOPE_LIST}).`);
+    }
+    return cleaned;
+}
+/**
+ * Split a cached grant against the app's declared-optional list (the app's
+ * own manifest knowledge). Pure — no store, no network.
+ */
+export function splitInstallationScopes(granted, declaredOptional = []) {
+    const declared = new Set(declaredOptional);
+    return {
+        granted: [...granted],
+        optional: granted.filter((scope) => declared.has(scope)),
+    };
+}
+/** App-API path of the revoke endpoint below the app base (sibling of the mint path). */
+export function revokeScopesPath(installationId) {
+    return `/installations/${encodeURIComponent(installationId)}/scopes/revoke`;
+}
+/**
+ * Build the dashboard deep link that opens the merchant's consent screen
+ * in the dashboard. Pure — no store, no network. Shaped like the bridge
+ * `open` targets: a dashboard-relative path, or an absolute https URL
+ * under `dashboardOrigin` (refused exactly like `sendOpen` refuses a bad
+ * target).
+ *
+ * Link shape (the SDK↔dashboard contract the consent screen honours —
+ * the only query route the dashboard `AppsPage` serves):
+ * `/apps?app={slug}&view=scopes&scopes={a},{b}` (each scope
+ * URL-encoded, comma-separated). The link carries the slug + the scope
+ * list only: the dashboard resolves the installation from the signed-in
+ * store.
+ */
+export function buildScopeRequestLink(options) {
+    const slug = options.appSlug.trim();
+    if (slug === "" || slug.includes("/") || slug.includes("\\")) {
+        throw new InvalidScopesError("A dashboard app slug is required to build the scope-request link.");
+    }
+    const requested = normaliseScopeList(options.scopes);
+    const path = `/apps?app=${encodeURIComponent(slug)}&view=scopes&scopes=${requested.map((scope) => encodeURIComponent(scope)).join(",")}`;
+    const origin = options.dashboardOrigin?.trim();
+    if (!origin)
+        return path;
+    let url;
+    try {
+        url = new URL(path, origin);
+    }
+    catch {
+        throw new InvalidScopesError("The dashboard origin is not a valid URL.");
+    }
+    const link = url.toString();
+    if (!isAllowedOpenTarget(link, origin)) {
+        throw new InvalidScopesError("The dashboard origin refuses the scope-request link.");
+    }
+    return link;
+}
+export function createInstallationScopesClient(options) {
+    if (!options.installationId || options.installationId.trim() === "") {
+        throw new InvalidScopesError("An installation id is required.");
+    }
+    if (!options.store) {
+        throw new InvalidScopesError("An InstallationStore is required.");
+    }
+    if (typeof options.signJwt !== "function") {
+        throw new InvalidScopesError("An app-JWT signer is required (e.g. `() => provider.signJwt()`).");
+    }
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const userAgent = options.userAgent ?? "queek-app/1.0";
+    const allowedApiHosts = options.allowedApiHosts ?? [];
+    /**
+     * The cached grant split — store-read only, never a fetch. The optional
+     * half needs the app's declared-optional list (the app's own manifest
+     * knowledge: the app surface exposes the effective grant but no declared
+     * list), from the per-call option, the client option, or empty.
+     */
+    async function queryScopes(queryOptions = {}) {
+        const row = await options.store.getInstallation(options.installationId);
+        if (!row)
+            throw new UnknownInstallationError(options.installationId);
+        return splitInstallationScopes(row.scopes, queryOptions.optionalScopes ?? options.optionalScopes ?? []);
+    }
+    /**
+     * The dashboard deep link that opens the merchant's consent screen in
+     * the dashboard. Pure (no store, no network): the app opens it via
+     * `sendOpen` or a redirect and the merchant consents in the dashboard
+     * (shipped with dashboard item 8). Shaped like the bridge `open`
+     * targets — dashboard-relative, or absolute under the dashboard origin
+     * when one is configured.
+     */
+    function requestScopes(scopes, linkOptions = {}) {
+        const appSlug = linkOptions.appSlug ?? options.appSlug;
+        if (!appSlug) {
+            throw new InvalidScopesError("requestScopes needs the app slug: pass `appSlug` or per-call `appSlug`.");
+        }
+        return buildScopeRequestLink({
+            appSlug,
+            scopes,
+            dashboardOrigin: linkOptions.dashboardOrigin ?? options.dashboardOrigin,
+        });
+    }
+    /**
+     * App-initiated revoke of optional scopes (backend
+     * `AppInstallationController::revokeScopes`): the app JWT signs the call
+     * (same credential as mint/resync), an `Idempotency-Key` rides the write
+     * for discipline only (the route is naturally idempotent), and on 200
+     * the cached grant is refreshed from the response with the cached token
+     * dropped only when the grant moved (same compare-and-clear as the
+     * scopes_update handler — backstop, since the backend rewrites live
+     * token rows in place). A required scope refuses 422
+     * `app_scope_required` as `AppScopeRequiredError`; a gone installation
+     * purges the local row and rethrows; anything else propagates untouched.
+     * A 401 never halts here — the mint path owns that mapping and halts on
+     * its next call.
+     */
+    async function revokeScopes(scopes, revokeOptions = {}) {
+        const requested = normaliseScopeList(scopes);
+        const row = await options.store.getInstallation(options.installationId);
+        if (!row)
+            throw new UnknownInstallationError(options.installationId);
+        const appBase = resolveAppApiBase(row.apiBase, allowedApiHosts);
+        // Signed per attempt (never reused past its ≤10-min window, never logged).
+        const jwt = options.signJwt();
+        const url = `${appBase}${revokeScopesPath(options.installationId)}`;
+        const headers = new Headers();
+        headers.set("Authorization", `Bearer ${jwt}`);
+        headers.set("Accept", "application/json");
+        headers.set("Content-Type", "application/json");
+        headers.set("User-Agent", userAgent);
+        headers.set("Idempotency-Key", revokeOptions.idempotencyKey ?? newIdempotencyKey());
+        let response;
+        try {
+            response = await fetchImpl(url, {
+                method: "POST",
+                headers,
+                body: JSON.stringify({ scopes: requested }),
+                signal: revokeOptions.signal,
+            });
+        }
+        catch (cause) {
+            throw new QueekApiError({
+                status: 0,
+                code: "network_error",
+                message: cause instanceof Error ? `Could not reach Queek: ${cause.message}` : "Could not reach Queek.",
+            });
+        }
+        const text = await response.text();
+        const parsed = text === "" ? null : tryParseJson(text);
+        if (!response.ok) {
+            const error = queekApiErrorFromResponse(response.status, parsed, response.headers);
+            if (isAppScopeRequired(error.status, error.code))
+                throw appScopeRequiredFromError(error);
+            if (error.status === 404 && isInstallationGone(error.code)) {
+                await options.store.deleteInstallation(options.installationId);
+            }
+            throw error;
+        }
+        const updated = parseRevokeBody(parsed);
+        // Same compare-and-clear as the scopes_update handler: an unchanged
+        // grant (e.g. revoking a never-granted scope — idempotent 200) keeps
+        // the cached token, since it still matches the live grant.
+        const grantChanged = !installationScopesEqual(row.scopes, updated);
+        await options.store.saveInstallation({ ...row, scopes: updated, updatedAt: new Date().toISOString() });
+        if (grantChanged) {
+            await options.store.clearCachedToken(options.installationId);
+        }
+        return updated;
+    }
+    return { queryScopes, requestScopes, revokeScopes };
+}
+/** Read the 200 revoke response (`{installation: {p_id}, scopes}`) — the refreshed effective grant. */
+function parseRevokeBody(body) {
+    const record = (typeof body === "object" && body !== null ? body : {});
+    const scopes = record.scopes;
+    if (!Array.isArray(scopes) || !scopes.every((scope) => typeof scope === "string")) {
+        throw new Error("Malformed revoke response: expected {scopes: string[]}.");
+    }
+    return [...scopes];
+}
+function tryParseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return { message: text.slice(0, 500) };
+    }
+}
+//# sourceMappingURL=scopes.js.map

package/dist/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../src/scopes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC1F,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,iGAAiG;AACjG,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE5D,uFAAuF;AACvF,MAAM,CAAC,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAEhE,2FAA2F;AAC3F,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,IAAwB;IACzE,OAAO,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,uBAAuB,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,aAAa;IAC7C,MAAM,CAAW;IAE1B,YAAY,MAAc,EAAE,OAAe,EAAE,MAAgB;QAC3D,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,+FAA+F;AAC/F,MAAM,UAAU,yBAAyB,CAAC,KAAoB;IAC5D,OAAO,IAAI,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,eAAe,CAAC,MAAe;IACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAI,MAAkC,CAAC,MAAM,CAAC;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,gFAAgF;AAChF,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,GAAG,gBAAgB,CAAC;IAEjC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AACjC,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAEpC;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAe;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,kBAAkB,CAAC,0BAA0B,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACtC,MAAM,IAAI,kBAAkB,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAAC,0BAA0B,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QACpC,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,cAAc,IAAI,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAiB,EACjB,mBAA6B,EAAE;IAE/B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC3C,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;QACrB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,gBAAgB,CAAC,cAAsB;IACrD,OAAO,kBAAkB,kBAAkB,CAAC,cAAc,CAAC,gBAAgB,CAAC;AAC9E,CAAC;AAeD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgC;IACpE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,kBAAkB,CAAC,mEAAmE,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,aAAa,kBAAkB,CAAC,IAAI,CAAC,uBAAuB,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACzI,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,0CAA0C,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC5B,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,kBAAkB,CAAC,sDAAsD,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAsED,MAAM,UAAU,8BAA8B,CAC5C,OAAwC;IAExC,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACpE,MAAM,IAAI,kBAAkB,CAAC,iCAAiC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,kBAAkB,CAAC,mCAAmC,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,kBAAkB,CAAC,kEAAkE,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC;IACvD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IAEtD;;;;;OAKG;IACH,KAAK,UAAU,WAAW,CAAC,eAAmC,EAAE;QAC9D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACxE,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,wBAAwB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACrE,OAAO,uBAAuB,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,aAAa,CAAC,MAAgB,EAAE,cAAwC,EAAE;QACjF,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;QACvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,kBAAkB,CAAC,yEAAyE,CAAC,CAAC;QAC1G,CAAC;QACD,OAAO,qBAAqB,CAAC;YAC3B,OAAO;YACP,MAAM;YACN,eAAe,EAAE,WAAW,CAAC,eAAe,IAAI,OAAO,CAAC,eAAe;SACxE,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,UAAU,YAAY,CAAC,MAAgB,EAAE,gBAAqC,EAAE;QACnF,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACxE,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,wBAAwB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAChE,2EAA2E;QAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QACpE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,GAAG,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,cAAc,IAAI,iBAAiB,EAAE,CAAC,CAAC;QACpF,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;gBAC9B,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC3C,MAAM,EAAE,aAAa,CAAC,MAAM;aAC7B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,aAAa,CAAC;gBACtB,MAAM,EAAE,CAAC;gBACT,IAAI,EAAE,eAAe;gBACrB,OAAO,EACL,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,0BAA0B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,wBAAwB;aAChG,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAY,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,yBAAyB,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnF,IAAI,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;gBAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC;YACzF,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3D,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACxC,oEAAoE;QACpE,qEAAqE;QACrE,2DAA2D;QAC3D,MAAM,YAAY,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnE,MAAM,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACvG,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;AACtD,CAAC;AAED,uGAAuG;AACvG,SAAS,eAAe,CAAC,IAAa;IACpC,MAAM,MAAM,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IAClG,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACzC,CAAC;AACH,CAAC"}

package/dist/server.d.ts

@@ -4,6 +4,6 @@
  * bundle. Import the verifier from `@usequeek/app-sdk/server`, never from
  * the main entry.
  */
-export type { SessionTokenBinding, SessionTokenClaims, SessionTokenFailure, VerifySessionTokenOptions, } from "./session.js";
-export { EMBED_SECRET_PREFIX, SESSION_CLOCK_TOLERANCE_SECONDS, sessionTokenInstallationId, verifySessionToken, verifySessionTokenDetailed, } from "./session.js";
+export type { LaunchTokenClaims, SessionTokenBinding, SessionTokenClaims, SessionTokenFailure, VerifySessionTokenOptions, } from "./session.js";
+export { EMBED_SECRET_PREFIX, isBridgePurpose, SESSION_CLOCK_TOLERANCE_SECONDS, sessionTokenInstallationId, verifyLaunchToken, verifyLaunchTokenDetailed, verifySessionToken, verifySessionTokenDetailed, } from "./session.js";
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,0BAA0B,EAC1B,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,cAAc,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,+BAA+B,EAC/B,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,cAAc,CAAC"}

package/dist/server.js

@@ -4,5 +4,5 @@
  * bundle. Import the verifier from `@usequeek/app-sdk/server`, never from
  * the main entry.
  */
-export { EMBED_SECRET_PREFIX, SESSION_CLOCK_TOLERANCE_SECONDS, sessionTokenInstallationId, verifySessionToken, verifySessionTokenDetailed, } from "./session.js";
+export { EMBED_SECRET_PREFIX, isBridgePurpose, SESSION_CLOCK_TOLERANCE_SECONDS, sessionTokenInstallationId, verifyLaunchToken, verifyLaunchTokenDetailed, verifySessionToken, verifySessionTokenDetailed, } from "./session.js";
 //# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,0BAA0B,EAC1B,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,cAAc,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,+BAA+B,EAC/B,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,cAAc,CAAC"}

package/dist/session.d.ts

@@ -4,6 +4,16 @@
  * verifies them with the per-installation `embsec_…` secret before trusting
  * any call that carries one.
  *
+ * Purpose binding (backend contract, mirrored from
+ * `AppSessionTokenService::verify()`): absent or "session" is a bridge
+ * token, verified by `verifySessionToken`; "launch" is the signed
+ * first-load token, verified ONLY by `verifyLaunchToken` as the input to
+ * the app's launch exchange (exchange it once for the app's own session so
+ * the first paint needs no bridge round-trip). Each verifier refuses the
+ * other's purpose with the same failure path callers map to 401, so a
+ * launch token that rode a URL can never be replayed as a bridge token
+ * and vice versa.
+ *
  * Server-only: the secret must never enter a browser bundle, so this module
  * ships behind the `./server` export, not the main entry. Style mirrors
  * `signatures.ts` — a boolean fast path plus a detailed variant returning
@@ -14,7 +24,7 @@ export declare const EMBED_SECRET_PREFIX = "embsec_";
 export declare const SESSION_TOKEN_ALG = "HS256";
 /** Backend skew the verifier tolerates (matches the mint side). */
 export declare const SESSION_CLOCK_TOLERANCE_SECONDS = 20;
-export type SessionTokenFailure = "missing_token" | "missing_secret" | "wrong_algorithm" | "invalid_signature" | "expired" | "not_yet_valid" | "wrong_audience" | "wrong_issuer" | "binding_mismatch";
+export type SessionTokenFailure = "missing_token" | "missing_secret" | "wrong_algorithm" | "invalid_signature" | "expired" | "not_yet_valid" | "wrong_audience" | "wrong_issuer" | "wrong_purpose" | "binding_mismatch";
 export interface SessionTokenClaims {
     installationId: string;
     vendorId: string;
@@ -31,12 +41,27 @@ export interface SessionTokenBinding {
     appSlug: string;
     appId: string;
 }
+/**
+ * Launch-token claims: the bridge binding plus the launch-only hints the
+ * backend mints for the signed first load — the store p_id (the URL-safe
+ * store id) and the dashboard theme for a flash-free first paint. Both are
+ * hints, not auth: `storePid` is null when the mint carried none, `theme`
+ * is null unless the mint carried exactly `light` or `dark`.
+ */
+export interface LaunchTokenClaims extends SessionTokenClaims {
+    storePid: number | null;
+    theme: "light" | "dark" | null;
+}
 export interface VerifySessionTokenOptions {
     /** The per-installation `embsec_…` secret, raw UTF-8 bytes (never decoded). */
     secret: string;
     /** Single expected audience: the app slug. */
     audience: string;
-    /** Expected issuer: the Queek api_base. */
+    /**
+     * Expected issuer: the handoff `api_base` VERBATIM
+     * (`installation.apiBase` — it equals the bare `app.url` the backend
+     * signs as `iss`). Never a prefix or a suffix of it.
+     */
     issuer: string;
     /**
      * The installation row the token must belong to (the app backend's own
@@ -55,6 +80,24 @@ export declare function verifySessionTokenDetailed(token: string, options: Verif
     ok: false;
     reason: SessionTokenFailure;
 }>;
+/**
+ * Server-side launch exchange input (signed first load): verify a
+ * purpose=launch token with the SAME checks as the bridge verifier
+ * (signature, audience, issuer, installation binding, expiry) plus the
+ * purpose pin — anything but exactly `"launch"` is refused with
+ * `wrong_purpose`, so a bridge token can never open the exchange. On
+ * success the app mints its own session from the claims (subject, store,
+ * theme) and the first paint needs no bridge round-trip. Callers map every
+ * `{ ok: false }` to 401, mirroring the backend `verify()`.
+ */
+export declare function verifyLaunchToken(token: string, options: VerifySessionTokenOptions): Promise<boolean>;
+export declare function verifyLaunchTokenDetailed(token: string, options: VerifySessionTokenOptions): Promise<{
+    ok: true;
+    claims: LaunchTokenClaims;
+} | {
+    ok: false;
+    reason: SessionTokenFailure;
+}>;
 /**
  * ROUTING HINT ONLY — the `installation_id` claim read WITHOUT verifying
  * anything, so a server can load the installation whose embed secret then
@@ -63,4 +106,11 @@ export declare function verifySessionTokenDetailed(token: string, options: Verif
  * Null for anything that is not a decodable JWT carrying the claim.
  */
 export declare function sessionTokenInstallationId(token: string): string | null;
+/**
+ * True for the purposes the bridge verifier accepts: absent (legacy
+ * tokens) or "session". "launch" is the signed first-load token for the
+ * launch exchange (`verifyLaunchToken`) only, so the bridge verifier
+ * refuses it. Any other present value fails closed.
+ */
+export declare function isBridgePurpose(purpose: unknown): boolean;
 //# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AAEH,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC,mEAAmE;AACnE,eAAO,MAAM,+BAA+B,KAAK,CAAC;AAElD,MAAM,MAAM,mBAAmB,GAC3B,eAAe,GACf,gBAAgB,GAChB,iBAAiB,GACjB,mBAAmB,GACnB,SAAS,GACT,eAAe,GACf,gBAAgB,GAChB,cAAc,GACd,kBAAkB,CAAC;AAEvB,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,yBAAyB;IACxC,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,OAAO,CAAC,CAGlB;AAED,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAAC,CA2ChG;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOvE"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC,mEAAmE;AACnE,eAAO,MAAM,+BAA+B,KAAK,CAAC;AAElD,MAAM,MAAM,mBAAmB,GAC3B,eAAe,GACf,gBAAgB,GAChB,iBAAiB,GACjB,mBAAmB,GACnB,SAAS,GACT,eAAe,GACf,gBAAgB,GAChB,cAAc,GACd,eAAe,GACf,kBAAkB,CAAC;AAEvB,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;IAC3D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,yBAAyB;IACxC,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,OAAO,CAAC,CAGlB;AAED,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAAC,CAoBhG;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAG3G;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAAC,CAe/F;AAsED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOvE;AAgBD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAEzD"}

package/dist/session.js

@@ -5,6 +5,16 @@ import { decodeJwt, decodeProtectedHeader, jwtVerify } from "jose";
  * verifies them with the per-installation `embsec_…` secret before trusting
  * any call that carries one.
  *
+ * Purpose binding (backend contract, mirrored from
+ * `AppSessionTokenService::verify()`): absent or "session" is a bridge
+ * token, verified by `verifySessionToken`; "launch" is the signed
+ * first-load token, verified ONLY by `verifyLaunchToken` as the input to
+ * the app's launch exchange (exchange it once for the app's own session so
+ * the first paint needs no bridge round-trip). Each verifier refuses the
+ * other's purpose with the same failure path callers map to 401, so a
+ * launch token that rode a URL can never be replayed as a bridge token
+ * and vice versa.
+ *
  * Server-only: the secret must never enter a browser bundle, so this module
  * ships behind the `./server` export, not the main entry. Style mirrors
  * `signatures.ts` — a boolean fast path plus a detailed variant returning
@@ -20,6 +30,61 @@ export async function verifySessionToken(token, options) {
     return result.ok;
 }
 export async function verifySessionTokenDetailed(token, options) {
+    const envelope = await verifyTokenEnvelope(token, options);
+    if (!envelope.ok)
+        return envelope;
+    const { payload } = envelope;
+    // Purpose binding (backend contract): absent or "session" is a bridge
+    // token; "launch" belongs to the signed first-load exchange only and is
+    // refused here with the same failure path callers map to 401. Any other
+    // present purpose fails closed as well — the bridge verifier accepts
+    // exactly the bridge purposes, never a foreign one.
+    if (!isBridgePurpose(payload.purpose)) {
+        return { ok: false, reason: "wrong_purpose" };
+    }
+    const claims = readSessionClaims(payload);
+    const { expected } = options;
+    if (!claims || !bindingMatches(claims, expected)) {
+        return { ok: false, reason: "binding_mismatch" };
+    }
+    return { ok: true, claims };
+}
+/**
+ * Server-side launch exchange input (signed first load): verify a
+ * purpose=launch token with the SAME checks as the bridge verifier
+ * (signature, audience, issuer, installation binding, expiry) plus the
+ * purpose pin — anything but exactly `"launch"` is refused with
+ * `wrong_purpose`, so a bridge token can never open the exchange. On
+ * success the app mints its own session from the claims (subject, store,
+ * theme) and the first paint needs no bridge round-trip. Callers map every
+ * `{ ok: false }` to 401, mirroring the backend `verify()`.
+ */
+export async function verifyLaunchToken(token, options) {
+    const result = await verifyLaunchTokenDetailed(token, options);
+    return result.ok;
+}
+export async function verifyLaunchTokenDetailed(token, options) {
+    const envelope = await verifyTokenEnvelope(token, options);
+    if (!envelope.ok)
+        return envelope;
+    const { payload } = envelope;
+    if (payload.purpose !== "launch") {
+        return { ok: false, reason: "wrong_purpose" };
+    }
+    const claims = readSessionClaims(payload);
+    const { expected } = options;
+    if (!claims || !bindingMatches(claims, expected)) {
+        return { ok: false, reason: "binding_mismatch" };
+    }
+    return { ok: true, claims: { ...claims, ...readLaunchHints(payload) } };
+}
+/**
+ * Shared envelope verification for both purposes: presence, secret shape,
+ * algorithm pin, then signature + audience + issuer + expiry via jose.
+ * Purpose and binding checks stay with the caller — the only thing that
+ * differs between the bridge and launch verifiers.
+ */
+async function verifyTokenEnvelope(token, options) {
     if (!token) {
         return { ok: false, reason: "missing_token" };
     }
@@ -36,7 +101,6 @@ export async function verifySessionTokenDetailed(token, options) {
     if (headerAlg !== null && headerAlg !== SESSION_TOKEN_ALG) {
         return { ok: false, reason: "wrong_algorithm" };
     }
-    let payload;
     try {
         const verified = await jwtVerify(token, new TextEncoder().encode(secret), {
             algorithms: ["HS256"],
@@ -44,21 +108,35 @@ export async function verifySessionTokenDetailed(token, options) {
             issuer,
             clockTolerance: options.clockToleranceSeconds ?? SESSION_CLOCK_TOLERANCE_SECONDS,
         });
-        payload = verified.payload;
+        return { ok: true, payload: verified.payload };
     }
     catch (error) {
         return { ok: false, reason: classifyJoseError(error) };
     }
-    const claims = readSessionClaims(payload);
-    const { expected } = options;
-    if (!claims ||
-        claims.installationId !== expected.installationId ||
-        claims.vendorId !== expected.vendorId ||
-        claims.appSlug !== expected.appSlug ||
-        claims.appId !== expected.appId) {
-        return { ok: false, reason: "binding_mismatch" };
-    }
-    return { ok: true, claims };
+}
+function bindingMatches(claims, expected) {
+    return (claims.installationId === expected.installationId &&
+        claims.vendorId === expected.vendorId &&
+        claims.appSlug === expected.appSlug &&
+        claims.appId === expected.appId);
+}
+/**
+ * Launch-only hints off a verified payload. Tolerant by design (they steer
+ * first paint, never auth): `store` is the integer p_id or null, `theme`
+ * survives only as exactly `light` or `dark`.
+ *
+ * Boundary (deliberate, pinned both sides): this `store` claim is an INT,
+ * while install-handoff p_ids are STRINGS per the handoff contract — never
+ * accept a string here to "match" the handoff; a string claim nulls the
+ * hint (session.test.ts) exactly as the backend pins int (AppUiKitTest).
+ */
+function readLaunchHints(payload) {
+    const store = payload.store;
+    const theme = payload.theme;
+    return {
+        storePid: typeof store === "number" && Number.isInteger(store) && store >= 0 ? store : null,
+        theme: theme === "light" || theme === "dark" ? theme : null,
+    };
 }
 /**
  * ROUTING HINT ONLY — the `installation_id` claim read WITHOUT verifying
@@ -90,6 +168,15 @@ function readTokenAlg(token) {
         return null;
     }
 }
+/**
+ * True for the purposes the bridge verifier accepts: absent (legacy
+ * tokens) or "session". "launch" is the signed first-load token for the
+ * launch exchange (`verifyLaunchToken`) only, so the bridge verifier
+ * refuses it. Any other present value fails closed.
+ */
+export function isBridgePurpose(purpose) {
+    return purpose === undefined || purpose === null || purpose === "session";
+}
 function readSessionClaims(payload) {
     const pick = (key) => typeof payload[key] === "string" && payload[key].length > 0 ? payload[key] : null;
     const installationId = pick("installation_id");

package/dist/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEnE;;;;;;;;;;GAUG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE7C,kFAAkF;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAEzC,mEAAmE;AACnE,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAgDlD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,OAAkC;IAElC,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAa,EACb,OAAkC;IAElC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IACD,yEAAyE;IACzE,uEAAuE;IACvE,8DAA8D;IAC9D,wEAAwE;IACxE,yCAAyC;IACzC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YACxE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,QAAQ;YACR,MAAM;YACN,cAAc,EAAE,OAAO,CAAC,qBAAqB,IAAI,+BAA+B;SACjF,CAAC,CAAC;QACH,OAAO,GAAG,QAAQ,CAAC,OAAkC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC7B,IACE,CAAC,MAAM;QACP,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QACjD,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;QACrC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;QACnC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAC/B,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC;QAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QAC7C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgC;IACzD,MAAM,IAAI,GAAG,CAAC,GAAW,EAAiB,EAAE,CAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAK,OAAO,CAAC,GAAG,CAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,GAAG,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5G,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IACE,CAAC,cAAc;QACf,CAAC,QAAQ;QACT,CAAC,OAAO;QACR,CAAC,KAAK;QACN,CAAC,OAAO;QACR,CAAC,SAAS;QACV,QAAQ,KAAK,IAAI;QACjB,SAAS,KAAK,IAAI,EAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AAC/F,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAClE,iEAAiE;IACjE,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,2CAA2C;IAC3C,MAAM,MAAM,GAAG,KAA4D,CAAC;IAC5E,MAAM,KAAK,GAAG,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACxC,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE7C,kFAAkF;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAEzC,mEAAmE;AACnE,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAiElD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,OAAkC;IAElC,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAa,EACb,OAAkC;IAElC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAElC,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;IAC7B,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,qEAAqE;IACrE,oDAAoD;IACpD,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC7B,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa,EAAE,OAAkC;IACvF,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAa,EACb,OAAkC;IAElC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAElC,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;IAC7B,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC7B,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAChC,KAAa,EACb,OAAkC;IAElC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IACD,yEAAyE;IACzE,uEAAuE;IACvE,8DAA8D;IAC9D,wEAAwE;IACxE,yCAAyC;IACzC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YACxE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,QAAQ;YACR,MAAM;YACN,cAAc,EAAE,OAAO,CAAC,qBAAqB,IAAI,+BAA+B;SACjF,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAkC,EAAE,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAA0B,EAAE,QAA6B;IAC/E,OAAO,CACL,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QACjD,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;QACrC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;QACnC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,OAAgC;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,OAAO;QACL,QAAQ,EAAE,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QAC3F,KAAK,EAAE,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC;QAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QAC7C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,CAAC;AAC5E,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgC;IACzD,MAAM,IAAI,GAAG,CAAC,GAAW,EAAiB,EAAE,CAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAK,OAAO,CAAC,GAAG,CAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,GAAG,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5G,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IACE,CAAC,cAAc;QACf,CAAC,QAAQ;QACT,CAAC,OAAO;QACR,CAAC,KAAK;QACN,CAAC,OAAO;QACR,CAAC,SAAS;QACV,QAAQ,KAAK,IAAI;QACjB,SAAS,KAAK,IAAI,EAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AAC/F,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAClE,iEAAiE;IACjE,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,2CAA2C;IAC3C,MAAM,MAAM,GAAG,KAA4D,CAAC;IAC5E,MAAM,KAAK,GAAG,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACxC,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC"}