@usequeek/app-sdk 0.6.0 → 0.6.1

package/README.md

@@ -10,6 +10,18 @@ npm i @usequeek/app-sdk pg
 
 Requires Node `>=22.14`. `pg` is a regular dependency (the production store). `hono` is an optional peer — install it (`npm i hono`) only if you use the Hono wrappers.
 
+## Which entry do I import?
+
+| Import | For | Pulls in |
+| --- | --- | --- |
+| `@usequeek/app-sdk` (main) | Server / universal code: handlers, client, stores, verifiers | `node:crypto`, `pg` — NOT browser-bundlable |
+| `@usequeek/app-sdk/server` | Session-token verifier (`verifySessionToken`) | Server-only (`jose`) — never import in a browser bundle |
+| `@usequeek/app-sdk/hono` | Thin Hono wrappers (`hono` optional peer) | Server-only |
+| `@usequeek/app-sdk/react` | React apps (`<QueekProvider>`, `useQueek()`; `react` optional peer) | Browser-safe (built on the same bridge modules as `/browser`) |
+| `@usequeek/app-sdk/browser` | Plain-browser code: `installAuthFetch` + bridge/theme helpers, no framework | Browser-safe ONLY — importing these helpers from the main entry drags in the whole barrel and breaks Vite/Rollup builds |
+
+Browser rule of thumb: if the code ships to the browser and does not need React, import it from `@usequeek/app-sdk/browser`. `installAuthFetch` is a browser-safe MODULE, but it is not browser-safe FROM THE MAIN ENTRY — the main barrel re-exports server modules (`app-auth` → `node:crypto`, `store` → `pg`), so a bundler resolving `installAuthFetch` from `@usequeek/app-sdk` still parses those Node-only files and fails.
+
 The shape follows [`@shopify/shopify-api`](https://github.com/Shopify/shopify-app-js/blob/main/packages/apps/shopify-api/README.md): the core "doesn't rely on any specific framework, so you can include it alongside your preferred stack" (runtime differences are covered by adapters such as `@shopify/shopify-api/adapters/node`), and framework integrations are separate packages in the [shopify-app-js monorepo](https://github.com/Shopify/shopify-app-js) (e.g. `@shopify/shopify-app-express` and `@shopify/shopify-app-remix` build on `@shopify/shopify-api`).
 
 ## Example (any framework)
@@ -325,15 +337,17 @@ Hono: mount `createProxyHandler({ store, path, onVerified })` from
   `verifySessionToken` — HS256 dashboard session tokens minted per installation
   (`embsec_…` secret, raw UTF-8 key bytes, 20 s clock tolerance, slug audience,
   issuer = the handoff `apiBase` verbatim (`installation.apiBase` — it equals the
-  bare `app.url` the backend signs as `iss`), full installation binding). The secret never enters a
+  bare `app.url` the backend signs as `iss`), full installation binding). One token
+  type, exactly Shopify's `id_token`: the dashboard puts the same token in the
+  first-load URL param (`queek_token`, stripped on arrival) and answers bridge
+  `ready` requests with it, so the app's exchange endpoint verifies first-load and
+  refresh tokens with this one verifier — no purpose split, extra claims are
+  ignored. The secret never enters a
   browser bundle: the main entry does not export the verifier. The install
   and resync handoffs deliver `embed_secret` + `app_id`; the store keeps
   them on the installation (`embedSecret` encrypted, `appId`), and
   `sessionTokenInstallationId` reads the token's `installation_id` as an
   unverified routing hint so a server can load that row before verifying.
-  `verifyLaunchToken` checks the signed-first-load token the same way plus the purpose pin
-  (`purpose` must be `launch`, with the `store` p_id and `theme` hints) — a launch token is refused
-  as a bridge token and vice versa.
 - **frame** (`frame.ts`, browser-safe, no secret): the embedded-app bridge
   v1 — typed unions both directions (`ready{capabilities,sdkVersion}`,
   `theme`, `title`/`title-action`, `toast`, `save-bar`/`save-bar-action`,
@@ -363,8 +377,10 @@ Hono: mount `createProxyHandler({ store, path, onVerified })` from
   Each pick carries a `requestId` (on `pick-resource`); a dashboard that
   declares `pick-resource` MUST echo it on `resource-picked` / `resource-pick-cancelled` — answers with a
   different or missing id are dropped as stale.
-- **auth** (`auth-fetch.ts`, browser-safe, no secret): `installAuthFetch({ exchange })`
-  — reads the launch token (`queek_token` query param) from the signed first
+- **auth** (`auth-fetch.ts`, no secret — browser-safe as a module, but import it
+  from `@usequeek/app-sdk/browser` in browser bundles, never from the main
+  entry): `installAuthFetch({ exchange })`
+  — reads the dashboard token (`queek_token` query param) from the first
   load, strips it with `history.replaceState`, exchanges it once for the
   app's own session, attaches `Authorization: Bearer <session>` to
   same-origin fetch (cookies stay out), and re-establishes via the bridge
@@ -372,27 +388,25 @@ Hono: mount `createProxyHandler({ store, path, onVerified })` from
   window itself) and is not retried per request after a failed attempt — only
   after a later dashboard token arrives. Pass the same `capabilities`/
   `sdkVersion` as the provider so its refresh `ready` announces one consistent set. The app's
-  token-exchange endpoint receives the LAUNCH token on first load and a BRIDGE token on every
-  401 refresh through the same `exchange` callback, so it must try
-  `verifyLaunchTokenDetailed`/`verifyLaunchToken` first and fall back to `verifySessionToken`
-  (both purposes):
+  token-exchange endpoint receives the first-load token and every 401-refresh
+  token through the same `exchange` callback — one token type, so it verifies
+  both with the single `verifySessionToken` verifier:
 
   ```ts
-  import { verifyLaunchTokenDetailed, verifySessionTokenDetailed } from "@usequeek/app-sdk/server";
+  import { verifySessionTokenDetailed } from "@usequeek/app-sdk/server";
 
   async function exchange(token: string): Promise<string> {
     const options = { secret: installation.embedSecret!, audience: "my-app", issuer: installation.apiBase, expected };
-    const launch = await verifyLaunchTokenDetailed(token, options);
-    if (launch.ok) return mintAppSession(launch.claims);
-    const bridge = await verifySessionTokenDetailed(token, options);
-    if (bridge.ok) return mintAppSession(bridge.claims);
-    throw Object.assign(new Error("unauthorized"), { status: 401 });
+    const checked = await verifySessionTokenDetailed(token, options);
+    if (!checked.ok) throw Object.assign(new Error("unauthorized"), { status: 401 });
+    return mintAppSession(checked.claims);
   }
   ```
 - **theme** (`theme.ts`, browser-safe, no secret): `applyTheme(mode)` toggles
   `.dark` on `<html>` + `color-scheme` (shadcn's dark-mode mechanism);
-  `themeBootstrapScript()` returns the inline `<head>` snippet that reads
-  `theme` from the URL before first paint (no flash);
+  `themeBootstrapScript()` returns the inline `<head>` snippet that reads the
+  unsigned `theme` URL param before first paint (no flash — a first-paint hint
+  only, validated to `light`|`dark`, overwritten by the live bridge message);
   `installThemeListener` follows live bridge `theme{mode}` messages (only from
   `window.parent` by default; pass `expectSource` to override). The live mode is
   remembered in `sessionStorage`, and the bootstrap script falls back to it when
@@ -461,10 +475,9 @@ Replace the host with the dashboard origin you registered. `frame-ancestors`
 is a docs-only control the dashboard cannot enforce for you: without it any
 site may frame the page, and the token handshake (origin-bound) is your only
 remaining gate. Verify every token server-side before trusting calls that carry one:
-the token-exchange endpoint receives the LAUNCH token on first load and a BRIDGE token on
-every 401 refresh through the same `installAuthFetch({ exchange })` callback, so it must try
-`verifyLaunchTokenDetailed`/`verifyLaunchToken` first and fall back to `verifySessionToken`
-(both purposes — see the `auth` entry above).
+the token-exchange endpoint receives the first-load token and every 401-refresh
+token through the same `installAuthFetch({ exchange })` callback — one token type,
+verified with the single `verifySessionToken` verifier (see the `auth` entry above).
 
 ## Local development
 

package/dist/auth-fetch.d.ts

@@ -1,31 +1,32 @@
 /**
  * Same-origin session carriage for embedded apps (U-validation "Auth
- * carriage"): `installAuthFetch()` reads the launch token from the signed
- * first load, exchanges it ONCE for the app's own session, and attaches
+ * carriage"): `installAuthFetch()` reads the dashboard token from the
+ * first-load URL (`?queek_token=`, stripped immediately), exchanges it
+ * ONCE for the app's own session, and attaches
  * `Authorization: Bearer <session>` to every same-origin fetch. A 401
  * re-establishes the session via the bridge `ready→token` flow and retries
  * once. Cookies stay out (`credentials: "omit"` on handled requests —
  * the cross-site iframe cannot rely on them anyway).
  *
  * The caller supplies `exchange(token) => session`: the app's own endpoint
- * that verifies the dashboard token server-side and mints the app
- * session — the exchange runs once on the signed first load so the first
- * paint needs no bridge round-trip, and again (same callback) with a
- * bridge token after every 401 refresh. The endpoint therefore receives
- * the LAUNCH token on first load and a BRIDGE token on every refresh, so
- * it must try `verifyLaunchTokenDetailed`/`verifyLaunchToken` first and
- * fall back to `verifySessionToken` (both purposes). This module never
- * sees secrets — it only carries opaque tokens.
+ * that verifies the dashboard token server-side with the single
+ * `verifySessionToken` verifier and mints the app session — the exchange
+ * runs once on the first load so the first paint needs no bridge
+ * round-trip, and again (same callback) with a fresh token of the same
+ * type after every 401 refresh. This module never sees secrets — it only
+ * carries opaque tokens.
  *
  * DOM-free by design (like `frame.ts`): location/history access is
  * injectable and defaults to the global window when present.
  */
 import { type EmbedEventTarget, type EmbedPostTarget } from "./frame.js";
 /**
- * Launch token query param on the signed first load. Matches the dashboard
- * frame src contract (`launchFrameUrl` in queek-merchant: the ONLY token
- * that may ride a URL, namespaced so it cannot collide with an app's own
- * `token` param).
+ * Dashboard token query param on the first load. Matches the dashboard
+ * frame src contract (the ONLY token that may ride a URL, namespaced so it
+ * cannot collide with an app's own `token` param). The token is the same
+ * type the bridge `ready→token` flow returns on refresh — first load and
+ * refresh differ only in transport (URL param vs postMessage), exactly
+ * Shopify's `id_token`.
  */
 export declare const LAUNCH_TOKEN_PARAM = "queek_token";
 /** How long to wait for the dashboard's token reply after a `ready`. */
@@ -33,15 +34,14 @@ export declare const BRIDGE_TOKEN_TIMEOUT_MS = 8000;
 export interface AuthFetchOptions {
     /**
      * Exchange a dashboard token for the app's own session (caller's endpoint).
-     * The endpoint receives the LAUNCH token on first load and a BRIDGE token
-     * on every 401 refresh through this same callback, so it must try
-     * `verifyLaunchTokenDetailed`/`verifyLaunchToken` first and fall back to
-     * `verifySessionToken` (both purposes).
+     * The endpoint receives the first-load token and every 401-refresh token
+     * through this same callback — one token type, so it verifies both with
+     * the single `verifySessionToken` verifier.
      */
     exchange: (token: string) => Promise<string>;
     /** Exact dashboard origin for the `ready→token` refresh flow. */
     dashboardOrigin: string;
-    /** Launch-token query param (default `queek_token`). */
+    /** First-load token query param (default `queek_token`). */
     param?: string;
     /** postMessage target for `ready` (defaults to the global window's parent). */
     postTarget?: EmbedPostTarget;
@@ -79,11 +79,12 @@ export interface InstalledAuth {
     /** Unsubscribe the bridge token listener. */
     dispose: () => void;
 }
-/** Read the launch token from a URL without touching it. */
+/** Read the first-load token from a URL without touching it. */
 export declare function readLaunchToken(href: string, param?: string): string | null;
 /**
- * Strip the launch token from a URL (every other param, plus the hash, is
- * preserved). Returns the stripped href, or null when no token is present.
+ * Strip the first-load token from a URL (every other param, plus the hash,
+ * is preserved). Returns the stripped href, or null when no token is
+ * present.
  */
 export declare function stripLaunchToken(href: string, param?: string): string | null;
 export declare function installAuthFetch(options: AuthFetchOptions): InstalledAuth;

package/dist/auth-fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-fetch.d.ts","sourceRoot":"","sources":["../src/auth-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAgC,MAAM,YAAY,CAAC;AAEvG;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAEhD,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,MAAM,WAAW,gBAAgB;IAC/B;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,iEAAiE;IACjE,eAAe,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,+HAA+H;IAC/H,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChF,kFAAkF;IAClF,UAAU,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAChC,iFAAiF;IACjF,KAAK,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9B,kEAAkE;IAClE,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,6CAA6C;IAC7C,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAeD,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,MAA2B,GAAG,MAAM,GAAG,IAAI,CAO/F;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,MAA2B,GAAG,MAAM,GAAG,IAAI,CAWhG;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,GAAG,aAAa,CAqNzE"}
+{"version":3,"file":"auth-fetch.d.ts","sourceRoot":"","sources":["../src/auth-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAgC,MAAM,YAAY,CAAC;AAEvG;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAEhD,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,iEAAiE;IACjE,eAAe,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,+HAA+H;IAC/H,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChF,kFAAkF;IAClF,UAAU,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAChC,iFAAiF;IACjF,KAAK,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9B,kEAAkE;IAClE,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,6CAA6C;IAC7C,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAeD,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,MAA2B,GAAG,MAAM,GAAG,IAAI,CAO/F;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,MAA2B,GAAG,MAAM,GAAG,IAAI,CAWhG;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,GAAG,aAAa,CAqNzE"}

package/dist/auth-fetch.js

@@ -1,31 +1,32 @@
 /**
  * Same-origin session carriage for embedded apps (U-validation "Auth
- * carriage"): `installAuthFetch()` reads the launch token from the signed
- * first load, exchanges it ONCE for the app's own session, and attaches
+ * carriage"): `installAuthFetch()` reads the dashboard token from the
+ * first-load URL (`?queek_token=`, stripped immediately), exchanges it
+ * ONCE for the app's own session, and attaches
  * `Authorization: Bearer <session>` to every same-origin fetch. A 401
  * re-establishes the session via the bridge `ready→token` flow and retries
  * once. Cookies stay out (`credentials: "omit"` on handled requests —
  * the cross-site iframe cannot rely on them anyway).
  *
  * The caller supplies `exchange(token) => session`: the app's own endpoint
- * that verifies the dashboard token server-side and mints the app
- * session — the exchange runs once on the signed first load so the first
- * paint needs no bridge round-trip, and again (same callback) with a
- * bridge token after every 401 refresh. The endpoint therefore receives
- * the LAUNCH token on first load and a BRIDGE token on every refresh, so
- * it must try `verifyLaunchTokenDetailed`/`verifyLaunchToken` first and
- * fall back to `verifySessionToken` (both purposes). This module never
- * sees secrets — it only carries opaque tokens.
+ * that verifies the dashboard token server-side with the single
+ * `verifySessionToken` verifier and mints the app session — the exchange
+ * runs once on the first load so the first paint needs no bridge
+ * round-trip, and again (same callback) with a fresh token of the same
+ * type after every 401 refresh. This module never sees secrets — it only
+ * carries opaque tokens.
  *
  * DOM-free by design (like `frame.ts`): location/history access is
  * injectable and defaults to the global window when present.
  */
 import { listenToDashboard, sendReady } from "./frame.js";
 /**
- * Launch token query param on the signed first load. Matches the dashboard
- * frame src contract (`launchFrameUrl` in queek-merchant: the ONLY token
- * that may ride a URL, namespaced so it cannot collide with an app's own
- * `token` param).
+ * Dashboard token query param on the first load. Matches the dashboard
+ * frame src contract (the ONLY token that may ride a URL, namespaced so it
+ * cannot collide with an app's own `token` param). The token is the same
+ * type the bridge `ready→token` flow returns on refresh — first load and
+ * refresh differ only in transport (URL param vs postMessage), exactly
+ * Shopify's `id_token`.
  */
 export const LAUNCH_TOKEN_PARAM = "queek_token";
 /** How long to wait for the dashboard's token reply after a `ready`. */
@@ -34,7 +35,7 @@ function globalWindow() {
     const scope = globalThis;
     return scope.window?.location !== undefined ? (scope.window ?? null) : null;
 }
-/** Read the launch token from a URL without touching it. */
+/** Read the first-load token from a URL without touching it. */
 export function readLaunchToken(href, param = LAUNCH_TOKEN_PARAM) {
     try {
         const token = new URL(href, "https://app.invalid").searchParams.get(param);
@@ -45,8 +46,9 @@ export function readLaunchToken(href, param = LAUNCH_TOKEN_PARAM) {
     }
 }
 /**
- * Strip the launch token from a URL (every other param, plus the hash, is
- * preserved). Returns the stripped href, or null when no token is present.
+ * Strip the first-load token from a URL (every other param, plus the hash,
+ * is preserved). Returns the stripped href, or null when no token is
+ * present.
  */
 export function stripLaunchToken(href, param = LAUNCH_TOKEN_PARAM) {
     try {
@@ -73,11 +75,11 @@ export function installAuthFetch(options) {
     const fetchFn = fetchImpl;
     const listenTarget = options.listenTarget ?? win ?? undefined;
     const postTarget = options.postTarget ?? win?.parent;
-    // Signed first load: read the launch token, strip it from the URL bar
+    // Signed first load: read the token, strip it from the URL bar
     // immediately (it must not linger in history), exchange it once.
     const href = getHref();
-    const launchToken = readLaunchToken(href, param);
-    const stripped = launchToken === null ? null : stripLaunchToken(href, param);
+    const firstLoadToken = readLaunchToken(href, param);
+    const stripped = firstLoadToken === null ? null : stripLaunchToken(href, param);
     if (stripped !== null) {
         try {
             replaceUrl(stripped);
@@ -104,7 +106,7 @@ export function installAuthFetch(options) {
         }
         return exchangePromise;
     };
-    const ready = launchToken === null ? Promise.resolve(null) : runExchange(launchToken).catch(() => null);
+    const ready = firstLoadToken === null ? Promise.resolve(null) : runExchange(firstLoadToken).catch(() => null);
     // A recovery only makes sense inside a dashboard frame: unframed, nothing
     // can ever answer the ready. After one failed recovery, later requests skip
     // it (no 8s stall per fetch) until a later token proves the dashboard is

package/dist/auth-fetch.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-fetch.js","sourceRoot":"","sources":["../src/auth-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAA+C,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAEhD,wEAAwE;AACxE,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AA6D5C,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,UAAgD,CAAC;IAC/D,OAAO,KAAK,CAAC,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9E,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,QAAgB,kBAAkB;IAC9E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3E,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,QAAgB,kBAAkB;IAC/E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAyB;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,kBAAkB,CAAC;IAClD,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IACrG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAK,UAAkD,CAAC,KAAK,IAAI,IAAI,CAAC;IACzG,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,OAAO,GAAiB,SAAS,CAAC;IACxC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAK,GAA0C,IAAI,SAAS,CAAC;IACtG,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,EAAE,MAAM,CAAC;IAErD,sEAAsE;IACtE,iEAAiE;IACjE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7E,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,eAAe,GAA2B,IAAI,CAAC;IACnD,IAAI,cAAc,GAA2B,IAAI,CAAC;IAElD,MAAM,WAAW,GAAG,CAAC,KAAa,EAAmB,EAAE;QACrD,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;YAC7B,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;gBACtD,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;YACH,2DAA2D;YAC3D,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE;gBACzB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,eAAe,GAAG,IAAI,CAAC;gBACzB,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC,CAAC;IAEF,MAAM,KAAK,GACT,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAE5F,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,WAAW;IACX,MAAM,MAAM,GAAG,UAAU,KAAK,SAAS,IAAI,UAAU,KAAM,GAAyC,CAAC;IACrG,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,IAAI,YAAY,GAAgF,IAAI,CAAC;IAErG,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,IAAI,SAAS,CAAC,CAAC;IAE5G,MAAM,aAAa,GAAG,iBAAiB,CAAC;QACtC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,MAAM,EAAE,YAAY;QACpB,YAAY,EAAE,YAAY,IAAI,SAAS;QACvC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,cAAc,GAAG,KAAK,CAAC;YACvB,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7B,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,kBAAkB,GAAG,GAAoB,EAAE,CAC/C,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,YAAY,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC;QACvE,YAAY,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACnC,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,UAAU,EAAE;YAC7C,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,YAAY,EAAE,OAAO,KAAK,OAAO,EAAE,CAAC;gBACtC,YAAY,GAAG,IAAI,CAAC;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC,EAAE,uBAAuB,CAAC,CAAC;QAC3B,KAA2C,CAAC,KAAK,EAAE,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;IAEL,MAAM,OAAO,GAAG,GAAoB,EAAE;QACpC,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,cAAc,GAAG,kBAAkB,EAAE;iBAClC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;gBACd,eAAe,GAAG,IAAI,CAAC;gBACvB,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC,CAAC,CAAC;QACP,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC,CAAC;IAEF;;;;;OAKG;IACH,MAAM,UAAU,GAAG,CAAC,KAA6B,EAAiB,EAAE;QAClE,IAAI,CAAC;YACH,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,KAAK,YAAY,OAAO,EAAE,CAAC;gBAC/D,OAAO,KAAK,CAAC,GAAG,CAAC;YACnB,CAAC;YACD,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC,IAAI,CAAC;YACpB,CAAC;YACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,GAAW,EAAW,EAAE;QAC5C,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,KAAK,EACvB,KAA6B,EAC7B,IAA6B,EAC7B,KAAa,EACM,EAAE;QACrB,wEAAwE;QACxE,uDAAuD;QACvD,MAAM,SAAS,GAAG,OAAO,OAAO,KAAK,WAAW,IAAI,KAAK,YAAY,OAAO,CAAC;QAC7E,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAE,KAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/D,kEAAkE;QAClE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAE,KAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAChF,IAAI,IAAI,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC/C,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,OAAO,CAAC,OAAiB,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/E,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,IAA4B,EAAE;QACjD,IAAI,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,EAAE,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,cAAc,GAAG,IAAI,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,EAAE,KAA6B,EAAE,IAAkB,EAAqB,EAAE;QAC/F,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,KAAe,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,uEAAuE;QACvE,0EAA0E;QAC1E,wCAAwC;QACxC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC,KAAe,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,qEAAqE;QACrE,wDAAwD;QACxD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACzC,OAAO,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,qEAAqE;QACrE,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAC7B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,cAAc,GAAG,IAAI,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,SAAS;QAChB,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO;QACzB,KAAK;QACL,OAAO;QACP,OAAO,EAAE,GAAG,EAAE;YACZ,YAAY,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;YAC5C,YAAY,GAAG,IAAI,CAAC;YACpB,aAAa,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth-fetch.js","sourceRoot":"","sources":["../src/auth-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAA+C,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAEhD,wEAAwE;AACxE,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AA4D5C,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,UAAgD,CAAC;IAC/D,OAAO,KAAK,CAAC,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9E,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,QAAgB,kBAAkB;IAC9E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3E,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,QAAgB,kBAAkB;IAC/E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAyB;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,kBAAkB,CAAC;IAClD,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IACrG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAK,UAAkD,CAAC,KAAK,IAAI,IAAI,CAAC;IACzG,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,OAAO,GAAiB,SAAS,CAAC;IACxC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAK,GAA0C,IAAI,SAAS,CAAC;IACtG,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,EAAE,MAAM,CAAC;IAErD,+DAA+D;IAC/D,iEAAiE;IACjE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,eAAe,GAA2B,IAAI,CAAC;IACnD,IAAI,cAAc,GAA2B,IAAI,CAAC;IAElD,MAAM,WAAW,GAAG,CAAC,KAAa,EAAmB,EAAE;QACrD,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;YAC7B,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;gBACtD,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;YACH,2DAA2D;YAC3D,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE;gBACzB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,eAAe,GAAG,IAAI,CAAC;gBACzB,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC,CAAC;IAEF,MAAM,KAAK,GACT,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAElG,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,WAAW;IACX,MAAM,MAAM,GAAG,UAAU,KAAK,SAAS,IAAI,UAAU,KAAM,GAAyC,CAAC;IACrG,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,IAAI,YAAY,GAAgF,IAAI,CAAC;IAErG,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,IAAI,SAAS,CAAC,CAAC;IAE5G,MAAM,aAAa,GAAG,iBAAiB,CAAC;QACtC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,MAAM,EAAE,YAAY;QACpB,YAAY,EAAE,YAAY,IAAI,SAAS;QACvC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,cAAc,GAAG,KAAK,CAAC;YACvB,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7B,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,kBAAkB,GAAG,GAAoB,EAAE,CAC/C,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,YAAY,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC;QACvE,YAAY,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACnC,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,UAAU,EAAE;YAC7C,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,YAAY,EAAE,OAAO,KAAK,OAAO,EAAE,CAAC;gBACtC,YAAY,GAAG,IAAI,CAAC;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC,EAAE,uBAAuB,CAAC,CAAC;QAC3B,KAA2C,CAAC,KAAK,EAAE,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;IAEL,MAAM,OAAO,GAAG,GAAoB,EAAE;QACpC,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,cAAc,GAAG,kBAAkB,EAAE;iBAClC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;gBACd,eAAe,GAAG,IAAI,CAAC;gBACvB,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC,CAAC,CAAC;QACP,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC,CAAC;IAEF;;;;;OAKG;IACH,MAAM,UAAU,GAAG,CAAC,KAA6B,EAAiB,EAAE;QAClE,IAAI,CAAC;YACH,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,KAAK,YAAY,OAAO,EAAE,CAAC;gBAC/D,OAAO,KAAK,CAAC,GAAG,CAAC;YACnB,CAAC;YACD,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC,IAAI,CAAC;YACpB,CAAC;YACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,GAAW,EAAW,EAAE;QAC5C,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,KAAK,EACvB,KAA6B,EAC7B,IAA6B,EAC7B,KAAa,EACM,EAAE;QACrB,wEAAwE;QACxE,uDAAuD;QACvD,MAAM,SAAS,GAAG,OAAO,OAAO,KAAK,WAAW,IAAI,KAAK,YAAY,OAAO,CAAC;QAC7E,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAE,KAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/D,kEAAkE;QAClE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAE,KAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAChF,IAAI,IAAI,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC/C,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,OAAO,CAAC,OAAiB,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/E,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,IAA4B,EAAE;QACjD,IAAI,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,EAAE,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,cAAc,GAAG,IAAI,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,EAAE,KAA6B,EAAE,IAAkB,EAAqB,EAAE;QAC/F,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,KAAe,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,uEAAuE;QACvE,0EAA0E;QAC1E,wCAAwC;QACxC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC,KAAe,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,qEAAqE;QACrE,wDAAwD;QACxD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACzC,OAAO,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,qEAAqE;QACrE,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAC7B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,cAAc,GAAG,IAAI,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,SAAS;QAChB,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO;QACzB,KAAK;QACL,OAAO;QACP,OAAO,EAAE,GAAG,EAAE;YACZ,YAAY,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;YAC5C,YAAY,GAAG,IAAI,CAAC;YACpB,aAAa,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/browser.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Plain-browser entry for `@usequeek/app-sdk` (Booking fix): the embedded-app
+ * bridge plus `installAuthFetch`, with ZERO Node-only modules.
+ *
+ * Import from `@usequeek/app-sdk/browser` in any browser bundle (Vite,
+ * Rollup, esbuild, …). Importing the same helpers from the MAIN entry pulls
+ * the whole barrel (`app-auth` → `node:crypto`, `store` → `pg`, …) and breaks
+ * browser builds — the main entry stays the server/universal entry on
+ * purpose (see README "Which entry do I import?").
+ *
+ * This module re-exports ONLY modules with no Node dependencies:
+ * `auth-fetch.js`, `frame.js`, `theme.js` (each imports at most each other).
+ * The scope consent-link builder (`buildScopeRequestLink`) is deliberately
+ * NOT here: it lives in `scopes.ts`, which imports `app-auth`/`client`/
+ * `store` (`node:crypto`, `pg`, `node:sqlite`) — open consent links from the
+ * browser with `sendOpen` instead (see README "Scopes").
+ *
+ * `tests/browser.test.ts` statically walks this file's transitive imports
+ * and fails if any of them ever gains a `node:*` / `pg` / `hono` / `jose` /
+ * `react` dependency, so this entry can never silently regress.
+ */
+export { type AuthFetchOptions, BRIDGE_TOKEN_TIMEOUT_MS, type InstalledAuth, installAuthFetch, LAUNCH_TOKEN_PARAM, readLaunchToken, stripLaunchToken, } from "./auth-fetch.js";
+export { APP_SOURCE, type AppInboundMessage, type AppOutboundMessage, BRIDGE_VERSION, type BridgeTheme, DASHBOARD_SOURCE, type EmbedEvent, type EmbedEventTarget, type EmbedPostTarget, type FrameBridgeOptions, listenToDashboard, type PickResourceRequest, type ReadyOptions, type ResourceItem, type SaveBarAction, type SaveBarState, sendNavigated, sendOpen, sendPickResource, sendReady, sendResize, sendSaveBar, sendTitle, type ThemeMode, type TitleActionDef, } from "./frame.js";
+export { applyTheme, getThemeModeFromUrl, installThemeListener, rememberThemeMode, syncThemeUrl, THEME_PARAM, THEME_STORAGE_KEY, type ThemeDocument, type ThemeDocumentElement, type ThemeListenerOptions, type ThemeStorage, type ThemeUrlOptions, themeBootstrapScript, } from "./theme.js";
+//# sourceMappingURL=browser.d.ts.map

package/dist/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,KAAK,gBAAgB,EACrB,uBAAuB,EACvB,KAAK,aAAa,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,UAAU,EACV,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,WAAW,EAChB,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,iBAAiB,EACjB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,aAAa,EACb,QAAQ,EACR,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,WAAW,EACX,SAAS,EACT,KAAK,SAAS,EACd,KAAK,cAAc,GACpB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,oBAAoB,GACrB,MAAM,YAAY,CAAC"}

package/dist/browser.js

@@ -0,0 +1,27 @@
+/**
+ * Plain-browser entry for `@usequeek/app-sdk` (Booking fix): the embedded-app
+ * bridge plus `installAuthFetch`, with ZERO Node-only modules.
+ *
+ * Import from `@usequeek/app-sdk/browser` in any browser bundle (Vite,
+ * Rollup, esbuild, …). Importing the same helpers from the MAIN entry pulls
+ * the whole barrel (`app-auth` → `node:crypto`, `store` → `pg`, …) and breaks
+ * browser builds — the main entry stays the server/universal entry on
+ * purpose (see README "Which entry do I import?").
+ *
+ * This module re-exports ONLY modules with no Node dependencies:
+ * `auth-fetch.js`, `frame.js`, `theme.js` (each imports at most each other).
+ * The scope consent-link builder (`buildScopeRequestLink`) is deliberately
+ * NOT here: it lives in `scopes.ts`, which imports `app-auth`/`client`/
+ * `store` (`node:crypto`, `pg`, `node:sqlite`) — open consent links from the
+ * browser with `sendOpen` instead (see README "Scopes").
+ *
+ * `tests/browser.test.ts` statically walks this file's transitive imports
+ * and fails if any of them ever gains a `node:*` / `pg` / `hono` / `jose` /
+ * `react` dependency, so this entry can never silently regress.
+ */
+export { BRIDGE_TOKEN_TIMEOUT_MS, installAuthFetch, LAUNCH_TOKEN_PARAM, readLaunchToken, stripLaunchToken, } from "./auth-fetch.js";
+export { APP_SOURCE, BRIDGE_VERSION, DASHBOARD_SOURCE, listenToDashboard, sendNavigated, sendOpen, sendPickResource, sendReady, sendResize, sendSaveBar, sendTitle, } from "./frame.js";
+// NOTE: ThemeMode comes from ./frame.js only — theme.js merely re-exports
+// it, so listing it here too would be ambiguous.
+export { applyTheme, getThemeModeFromUrl, installThemeListener, rememberThemeMode, syncThemeUrl, THEME_PARAM, THEME_STORAGE_KEY, themeBootstrapScript, } from "./theme.js";
+//# sourceMappingURL=browser.js.map

package/dist/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAEL,uBAAuB,EAEvB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,UAAU,EAGV,cAAc,EAEd,gBAAgB,EAKhB,iBAAiB,EAMjB,aAAa,EACb,QAAQ,EACR,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,WAAW,EACX,SAAS,GAGV,MAAM,YAAY,CAAC;AACpB,0EAA0E;AAC1E,iDAAiD;AACjD,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,iBAAiB,EAMjB,oBAAoB,GACrB,MAAM,YAAY,CAAC"}

package/dist/server.d.ts

@@ -1,9 +1,9 @@
 /**
- * Server-only entry (S4 stage 2): session-token verification needs the
+ * Server-only entry: session-token verification needs the
  * per-installation `embsec_…` secret, which must never enter a browser
  * bundle. Import the verifier from `@usequeek/app-sdk/server`, never from
  * the main entry.
  */
-export type { LaunchTokenClaims, SessionTokenBinding, SessionTokenClaims, SessionTokenFailure, VerifySessionTokenOptions, } from "./session.js";
-export { EMBED_SECRET_PREFIX, isBridgePurpose, SESSION_CLOCK_TOLERANCE_SECONDS, sessionTokenInstallationId, verifyLaunchToken, verifyLaunchTokenDetailed, verifySessionToken, verifySessionTokenDetailed, } from "./session.js";
+export type { SessionTokenBinding, SessionTokenClaims, SessionTokenFailure, VerifySessionTokenOptions, } from "./session.js";
+export { EMBED_SECRET_PREFIX, SESSION_CLOCK_TOLERANCE_SECONDS, sessionTokenInstallationId, verifySessionToken, verifySessionTokenDetailed, } from "./session.js";
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,+BAA+B,EAC/B,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,cAAc,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,0BAA0B,EAC1B,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,cAAc,CAAC"}

package/dist/server.js

@@ -1,8 +1,8 @@
 /**
- * Server-only entry (S4 stage 2): session-token verification needs the
+ * Server-only entry: session-token verification needs the
  * per-installation `embsec_…` secret, which must never enter a browser
  * bundle. Import the verifier from `@usequeek/app-sdk/server`, never from
  * the main entry.
  */
-export { EMBED_SECRET_PREFIX, isBridgePurpose, SESSION_CLOCK_TOLERANCE_SECONDS, sessionTokenInstallationId, verifyLaunchToken, verifyLaunchTokenDetailed, verifySessionToken, verifySessionTokenDetailed, } from "./session.js";
+export { EMBED_SECRET_PREFIX, SESSION_CLOCK_TOLERANCE_SECONDS, sessionTokenInstallationId, verifySessionToken, verifySessionTokenDetailed, } from "./session.js";
 //# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,+BAA+B,EAC/B,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,cAAc,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,0BAA0B,EAC1B,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,cAAc,CAAC"}

package/dist/session.d.ts

@@ -1,18 +1,16 @@
 /**
- * Dashboard session tokens (S4 stage 2): short-lived HS256 JWTs the backend
- * mints per installation for the framed merchant page. The app backend
- * verifies them with the per-installation `embsec_…` secret before trusting
- * any call that carries one.
+ * Dashboard session tokens: short-lived HS256 JWTs the backend mints per
+ * installation for the framed merchant page. The app backend verifies them
+ * with the per-installation `embsec_…` secret before trusting any call
+ * that carries one.
  *
- * Purpose binding (backend contract, mirrored from
- * `AppSessionTokenService::verify()`): absent or "session" is a bridge
- * token, verified by `verifySessionToken`; "launch" is the signed
- * first-load token, verified ONLY by `verifyLaunchToken` as the input to
- * the app's launch exchange (exchange it once for the app's own session so
- * the first paint needs no bridge round-trip). Each verifier refuses the
- * other's purpose with the same failure path callers map to 401, so a
- * launch token that rode a URL can never be replayed as a bridge token
- * and vice versa.
+ * ONE token type, exactly Shopify's `id_token` shape: the dashboard puts
+ * the same token in the first-load URL param (`queek_token`, stripped on
+ * arrival) and answers bridge `ready` requests with it, so the app's
+ * exchange endpoint verifies first-load and refresh tokens with this one
+ * verifier. No purpose split: extra claims the mint may carry are ignored,
+ * never gated — identity binding (installation, audience, issuer, expiry)
+ * is the whole check.
  *
  * Server-only: the secret must never enter a browser bundle, so this module
  * ships behind the `./server` export, not the main entry. Style mirrors
@@ -24,7 +22,7 @@ export declare const EMBED_SECRET_PREFIX = "embsec_";
 export declare const SESSION_TOKEN_ALG = "HS256";
 /** Backend skew the verifier tolerates (matches the mint side). */
 export declare const SESSION_CLOCK_TOLERANCE_SECONDS = 20;
-export type SessionTokenFailure = "missing_token" | "missing_secret" | "wrong_algorithm" | "invalid_signature" | "expired" | "not_yet_valid" | "wrong_audience" | "wrong_issuer" | "wrong_purpose" | "binding_mismatch";
+export type SessionTokenFailure = "missing_token" | "missing_secret" | "wrong_algorithm" | "invalid_signature" | "expired" | "not_yet_valid" | "wrong_audience" | "wrong_issuer" | "binding_mismatch";
 export interface SessionTokenClaims {
     installationId: string;
     vendorId: string;
@@ -41,17 +39,6 @@ export interface SessionTokenBinding {
     appSlug: string;
     appId: string;
 }
-/**
- * Launch-token claims: the bridge binding plus the launch-only hints the
- * backend mints for the signed first load — the store p_id (the URL-safe
- * store id) and the dashboard theme for a flash-free first paint. Both are
- * hints, not auth: `storePid` is null when the mint carried none, `theme`
- * is null unless the mint carried exactly `light` or `dark`.
- */
-export interface LaunchTokenClaims extends SessionTokenClaims {
-    storePid: number | null;
-    theme: "light" | "dark" | null;
-}
 export interface VerifySessionTokenOptions {
     /** The per-installation `embsec_…` secret, raw UTF-8 bytes (never decoded). */
     secret: string;
@@ -80,24 +67,6 @@ export declare function verifySessionTokenDetailed(token: string, options: Verif
     ok: false;
     reason: SessionTokenFailure;
 }>;
-/**
- * Server-side launch exchange input (signed first load): verify a
- * purpose=launch token with the SAME checks as the bridge verifier
- * (signature, audience, issuer, installation binding, expiry) plus the
- * purpose pin — anything but exactly `"launch"` is refused with
- * `wrong_purpose`, so a bridge token can never open the exchange. On
- * success the app mints its own session from the claims (subject, store,
- * theme) and the first paint needs no bridge round-trip. Callers map every
- * `{ ok: false }` to 401, mirroring the backend `verify()`.
- */
-export declare function verifyLaunchToken(token: string, options: VerifySessionTokenOptions): Promise<boolean>;
-export declare function verifyLaunchTokenDetailed(token: string, options: VerifySessionTokenOptions): Promise<{
-    ok: true;
-    claims: LaunchTokenClaims;
-} | {
-    ok: false;
-    reason: SessionTokenFailure;
-}>;
 /**
  * ROUTING HINT ONLY — the `installation_id` claim read WITHOUT verifying
  * anything, so a server can load the installation whose embed secret then
@@ -106,11 +75,4 @@ export declare function verifyLaunchTokenDetailed(token: string, options: Verify
  * Null for anything that is not a decodable JWT carrying the claim.
  */
 export declare function sessionTokenInstallationId(token: string): string | null;
-/**
- * True for the purposes the bridge verifier accepts: absent (legacy
- * tokens) or "session". "launch" is the signed first-load token for the
- * launch exchange (`verifyLaunchToken`) only, so the bridge verifier
- * refuses it. Any other present value fails closed.
- */
-export declare function isBridgePurpose(purpose: unknown): boolean;
 //# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC,mEAAmE;AACnE,eAAO,MAAM,+BAA+B,KAAK,CAAC;AAElD,MAAM,MAAM,mBAAmB,GAC3B,eAAe,GACf,gBAAgB,GAChB,iBAAiB,GACjB,mBAAmB,GACnB,SAAS,GACT,eAAe,GACf,gBAAgB,GAChB,cAAc,GACd,eAAe,GACf,kBAAkB,CAAC;AAEvB,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;IAC3D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,yBAAyB;IACxC,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,OAAO,CAAC,CAGlB;AAED,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAAC,CAoBhG;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAG3G;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAAC,CAe/F;AAsED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOvE;AAgBD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAEzD"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC,mEAAmE;AACnE,eAAO,MAAM,+BAA+B,KAAK,CAAC;AAElD,MAAM,MAAM,mBAAmB,GAC3B,eAAe,GACf,gBAAgB,GAChB,iBAAiB,GACjB,mBAAmB,GACnB,SAAS,GACT,eAAe,GACf,gBAAgB,GAChB,cAAc,GACd,kBAAkB,CAAC;AAEvB,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,yBAAyB;IACxC,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,OAAO,CAAC,CAGlB;AAED,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAAC,CAUhG;AAkDD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOvE"}

package/dist/session.js

@@ -1,19 +1,17 @@
 import { decodeJwt, decodeProtectedHeader, jwtVerify } from "jose";
 /**
- * Dashboard session tokens (S4 stage 2): short-lived HS256 JWTs the backend
- * mints per installation for the framed merchant page. The app backend
- * verifies them with the per-installation `embsec_…` secret before trusting
- * any call that carries one.
+ * Dashboard session tokens: short-lived HS256 JWTs the backend mints per
+ * installation for the framed merchant page. The app backend verifies them
+ * with the per-installation `embsec_…` secret before trusting any call
+ * that carries one.
  *
- * Purpose binding (backend contract, mirrored from
- * `AppSessionTokenService::verify()`): absent or "session" is a bridge
- * token, verified by `verifySessionToken`; "launch" is the signed
- * first-load token, verified ONLY by `verifyLaunchToken` as the input to
- * the app's launch exchange (exchange it once for the app's own session so
- * the first paint needs no bridge round-trip). Each verifier refuses the
- * other's purpose with the same failure path callers map to 401, so a
- * launch token that rode a URL can never be replayed as a bridge token
- * and vice versa.
+ * ONE token type, exactly Shopify's `id_token` shape: the dashboard puts
+ * the same token in the first-load URL param (`queek_token`, stripped on
+ * arrival) and answers bridge `ready` requests with it, so the app's
+ * exchange endpoint verifies first-load and refresh tokens with this one
+ * verifier. No purpose split: extra claims the mint may carry are ignored,
+ * never gated — identity binding (installation, audience, issuer, expiry)
+ * is the whole check.
  *
  * Server-only: the secret must never enter a browser bundle, so this module
  * ships behind the `./server` export, not the main entry. Style mirrors
@@ -33,16 +31,7 @@ export async function verifySessionTokenDetailed(token, options) {
     const envelope = await verifyTokenEnvelope(token, options);
     if (!envelope.ok)
         return envelope;
-    const { payload } = envelope;
-    // Purpose binding (backend contract): absent or "session" is a bridge
-    // token; "launch" belongs to the signed first-load exchange only and is
-    // refused here with the same failure path callers map to 401. Any other
-    // present purpose fails closed as well — the bridge verifier accepts
-    // exactly the bridge purposes, never a foreign one.
-    if (!isBridgePurpose(payload.purpose)) {
-        return { ok: false, reason: "wrong_purpose" };
-    }
-    const claims = readSessionClaims(payload);
+    const claims = readSessionClaims(envelope.payload);
     const { expected } = options;
     if (!claims || !bindingMatches(claims, expected)) {
         return { ok: false, reason: "binding_mismatch" };
@@ -50,39 +39,9 @@ export async function verifySessionTokenDetailed(token, options) {
     return { ok: true, claims };
 }
 /**
- * Server-side launch exchange input (signed first load): verify a
- * purpose=launch token with the SAME checks as the bridge verifier
- * (signature, audience, issuer, installation binding, expiry) plus the
- * purpose pin — anything but exactly `"launch"` is refused with
- * `wrong_purpose`, so a bridge token can never open the exchange. On
- * success the app mints its own session from the claims (subject, store,
- * theme) and the first paint needs no bridge round-trip. Callers map every
- * `{ ok: false }` to 401, mirroring the backend `verify()`.
- */
-export async function verifyLaunchToken(token, options) {
-    const result = await verifyLaunchTokenDetailed(token, options);
-    return result.ok;
-}
-export async function verifyLaunchTokenDetailed(token, options) {
-    const envelope = await verifyTokenEnvelope(token, options);
-    if (!envelope.ok)
-        return envelope;
-    const { payload } = envelope;
-    if (payload.purpose !== "launch") {
-        return { ok: false, reason: "wrong_purpose" };
-    }
-    const claims = readSessionClaims(payload);
-    const { expected } = options;
-    if (!claims || !bindingMatches(claims, expected)) {
-        return { ok: false, reason: "binding_mismatch" };
-    }
-    return { ok: true, claims: { ...claims, ...readLaunchHints(payload) } };
-}
-/**
- * Shared envelope verification for both purposes: presence, secret shape,
- * algorithm pin, then signature + audience + issuer + expiry via jose.
- * Purpose and binding checks stay with the caller — the only thing that
- * differs between the bridge and launch verifiers.
+ * Envelope verification: presence, secret shape, algorithm pin, then
+ * signature + audience + issuer + expiry via jose. Binding checks stay
+ * with the caller.
  */
 async function verifyTokenEnvelope(token, options) {
     if (!token) {
@@ -120,24 +79,6 @@ function bindingMatches(claims, expected) {
         claims.appSlug === expected.appSlug &&
         claims.appId === expected.appId);
 }
-/**
- * Launch-only hints off a verified payload. Tolerant by design (they steer
- * first paint, never auth): `store` is the integer p_id or null, `theme`
- * survives only as exactly `light` or `dark`.
- *
- * Boundary (deliberate, pinned both sides): this `store` claim is an INT,
- * while install-handoff p_ids are STRINGS per the handoff contract — never
- * accept a string here to "match" the handoff; a string claim nulls the
- * hint (session.test.ts) exactly as the backend pins int (AppUiKitTest).
- */
-function readLaunchHints(payload) {
-    const store = payload.store;
-    const theme = payload.theme;
-    return {
-        storePid: typeof store === "number" && Number.isInteger(store) && store >= 0 ? store : null,
-        theme: theme === "light" || theme === "dark" ? theme : null,
-    };
-}
 /**
  * ROUTING HINT ONLY — the `installation_id` claim read WITHOUT verifying
  * anything, so a server can load the installation whose embed secret then
@@ -168,15 +109,6 @@ function readTokenAlg(token) {
         return null;
     }
 }
-/**
- * True for the purposes the bridge verifier accepts: absent (legacy
- * tokens) or "session". "launch" is the signed first-load token for the
- * launch exchange (`verifyLaunchToken`) only, so the bridge verifier
- * refuses it. Any other present value fails closed.
- */
-export function isBridgePurpose(purpose) {
-    return purpose === undefined || purpose === null || purpose === "session";
-}
 function readSessionClaims(payload) {
     const pick = (key) => typeof payload[key] === "string" && payload[key].length > 0 ? payload[key] : null;
     const installationId = pick("installation_id");

package/dist/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE7C,kFAAkF;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAEzC,mEAAmE;AACnE,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAiElD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,OAAkC;IAElC,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAa,EACb,OAAkC;IAElC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAElC,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;IAC7B,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,qEAAqE;IACrE,oDAAoD;IACpD,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC7B,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa,EAAE,OAAkC;IACvF,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAa,EACb,OAAkC;IAElC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAElC,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;IAC7B,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC7B,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAChC,KAAa,EACb,OAAkC;IAElC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IACD,yEAAyE;IACzE,uEAAuE;IACvE,8DAA8D;IAC9D,wEAAwE;IACxE,yCAAyC;IACzC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YACxE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,QAAQ;YACR,MAAM;YACN,cAAc,EAAE,OAAO,CAAC,qBAAqB,IAAI,+BAA+B;SACjF,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAkC,EAAE,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAA0B,EAAE,QAA6B;IAC/E,OAAO,CACL,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QACjD,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;QACrC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;QACnC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,OAAgC;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,OAAO;QACL,QAAQ,EAAE,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QAC3F,KAAK,EAAE,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC;QAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QAC7C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,CAAC;AAC5E,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgC;IACzD,MAAM,IAAI,GAAG,CAAC,GAAW,EAAiB,EAAE,CAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAK,OAAO,CAAC,GAAG,CAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,GAAG,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5G,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IACE,CAAC,cAAc;QACf,CAAC,QAAQ;QACT,CAAC,OAAO;QACR,CAAC,KAAK;QACN,CAAC,OAAO;QACR,CAAC,SAAS;QACV,QAAQ,KAAK,IAAI;QACjB,SAAS,KAAK,IAAI,EAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AAC/F,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAClE,iEAAiE;IACjE,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,2CAA2C;IAC3C,MAAM,MAAM,GAAG,KAA4D,CAAC;IAC5E,MAAM,KAAK,GAAG,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACxC,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEnE;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE7C,kFAAkF;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAEzC,mEAAmE;AACnE,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAoDlD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,OAAkC;IAElC,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAa,EACb,OAAkC;IAElC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAElC,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC7B,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAChC,KAAa,EACb,OAAkC;IAElC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IACD,yEAAyE;IACzE,uEAAuE;IACvE,8DAA8D;IAC9D,wEAAwE;IACxE,yCAAyC;IACzC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YACxE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,QAAQ;YACR,MAAM;YACN,cAAc,EAAE,OAAO,CAAC,qBAAqB,IAAI,+BAA+B;SACjF,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAkC,EAAE,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAA0B,EAAE,QAA6B;IAC/E,OAAO,CACL,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QACjD,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;QACrC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;QACnC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAChC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC;QAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QAC7C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgC;IACzD,MAAM,IAAI,GAAG,CAAC,GAAW,EAAiB,EAAE,CAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAK,OAAO,CAAC,GAAG,CAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,GAAG,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5G,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IACE,CAAC,cAAc;QACf,CAAC,QAAQ;QACT,CAAC,OAAO;QACR,CAAC,KAAK;QACN,CAAC,OAAO;QACR,CAAC,SAAS;QACV,QAAQ,KAAK,IAAI;QACjB,SAAS,KAAK,IAAI,EAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AAC/F,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAClE,iEAAiE;IACjE,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,2CAA2C;IAC3C,MAAM,MAAM,GAAG,KAA4D,CAAC;IAC5E,MAAM,KAAK,GAAG,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACxC,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC"}

package/dist/theme.d.ts

@@ -1,10 +1,14 @@
 /**
  * Dashboard-following theme (U7): dark when the dashboard is dark, light
- * when light, switching live. First load carries `theme=light|dark` in the
- * frame URL (dashboard `resolvedTheme`) so the app server-renders
- * `<html class="dark">` with no flash; live changes arrive as bridge
- * `theme{mode}` messages and toggle the `dark` class — shadcn's own
- * dark-mode mechanism.
+ * when light, switching live. First load carries `theme=light|dark` as a
+ * plain UNSIGNED URL query param (dashboard `resolvedTheme`) so the app
+ * server-renders `<html class="dark">` with no flash; live changes arrive
+ * as bridge `theme{mode}` messages and toggle the `dark` class — shadcn's
+ * own dark-mode mechanism.
+ *
+ * The param is a first-paint hint only, never auth: it is validated
+ * (exactly `light` or `dark` — anything else is ignored) and the live
+ * bridge message overwrites it.
  *
  * DOM-free by design (structural minimal types, like `frame.ts`): pass a
  * document in, or let the helpers use the global one when present.

package/dist/theme.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"theme.d.ts","sourceRoot":"","sources":["../src/theme.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EAGpB,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,SAAS,EAAE,CAAC;AAE1B,qEAAqE;AACrE,eAAO,MAAM,WAAW,UAAU,CAAC;AAEnC,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAeD,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE;QAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;IAC3D,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,oBAAoB,CAAC;CACvC;AAOD,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,IAAI,CAUtF;AAeD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,MAAoB,EAC3B,OAAO,CAAC,EAAE,YAAY,GAAG,IAAI,GAC5B,SAAS,CAUX;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,GAAE,eAAoB,GAAG,IAAI,CA6BjF;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,aAAa,GAAG,IAAI,CAOrE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,GAAE,MAAoB,GAAG,MAAM,CAUxE;AAED,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,IAAI,CAAC;IACrC,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,gGAAgG;IAChG,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC9B,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,IAAI,CAe9E"}
+{"version":3,"file":"theme.d.ts","sourceRoot":"","sources":["../src/theme.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EAGpB,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,SAAS,EAAE,CAAC;AAE1B,qEAAqE;AACrE,eAAO,MAAM,WAAW,UAAU,CAAC;AAEnC,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAeD,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE;QAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;IAC3D,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,oBAAoB,CAAC;CACvC;AAOD,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,IAAI,CAUtF;AAeD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,MAAoB,EAC3B,OAAO,CAAC,EAAE,YAAY,GAAG,IAAI,GAC5B,SAAS,CAUX;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,GAAE,eAAoB,GAAG,IAAI,CA6BjF;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,aAAa,GAAG,IAAI,CAOrE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,GAAE,MAAoB,GAAG,MAAM,CAUxE;AAED,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,IAAI,CAAC;IACrC,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,gGAAgG;IAChG,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC9B,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,IAAI,CAe9E"}

package/dist/theme.js

@@ -1,10 +1,14 @@
 /**
  * Dashboard-following theme (U7): dark when the dashboard is dark, light
- * when light, switching live. First load carries `theme=light|dark` in the
- * frame URL (dashboard `resolvedTheme`) so the app server-renders
- * `<html class="dark">` with no flash; live changes arrive as bridge
- * `theme{mode}` messages and toggle the `dark` class — shadcn's own
- * dark-mode mechanism.
+ * when light, switching live. First load carries `theme=light|dark` as a
+ * plain UNSIGNED URL query param (dashboard `resolvedTheme`) so the app
+ * server-renders `<html class="dark">` with no flash; live changes arrive
+ * as bridge `theme{mode}` messages and toggle the `dark` class — shadcn's
+ * own dark-mode mechanism.
+ *
+ * The param is a first-paint hint only, never auth: it is validated
+ * (exactly `light` or `dark` — anything else is ignored) and the live
+ * bridge message overwrites it.
  *
  * DOM-free by design (structural minimal types, like `frame.ts`): pass a
  * document in, or let the helpers use the global one when present.

package/dist/theme.js.map

@@ -1 +1 @@
-{"version":3,"file":"theme.js","sourceRoot":"","sources":["../src/theme.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAGL,iBAAiB,EACjB,SAAS,GAEV,MAAM,YAAY,CAAC;AAIpB,qEAAqE;AACrE,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AAEnC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAO/C,SAAS,oBAAoB;IAC3B,IAAI,CAAC;QACH,MAAM,OAAO,GAAI,UAA2D,CAAC,cAAc,CAAC;QAC5F,OAAO,OAAO,IAAI,IAAI,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,OAAQ,UAA2D,CAAC,MAAM,EAAE,MAAM,CAAC;AACrF,CAAC;AAWD,SAAS,cAAc;IACrB,MAAM,GAAG,GAAI,UAAsD,CAAC,QAAQ,CAAC;IAC7E,OAAO,GAAG,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,IAAe,EAAE,OAA6B;IAC9E,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACxE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,OAAwC;IAC/D,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACxE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC/C,OAAO,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,QAAgB,WAAW,EAC3B,OAA6B;IAE7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,YAAY,CAAC;QACjE,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACzD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,eAAe,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;AAC7C,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAe,EAAE,UAA2B,EAAE;IACzE,IAAI,CAAC;QACH,MAAM,GAAG,GACP,UAMD,CAAC,MAAM,CAAC;QACT,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC;QACpF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YACzC,OAAO;QACT,CAAC;QACD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAe,EAAE,GAAmB;IAC7D,MAAM,MAAM,GAAG,GAAG,IAAI,cAAc,EAAE,CAAC;IACvC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO;IACT,CAAC;IACD,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC;IACjE,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB,WAAW;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACrD,OAAO,CACL,sDAAsD,GAAG,IAAI;QAC7D,6CAA6C,UAAU,eAAe;QACtE,mCAAmC,UAAU,yCAAyC;QACtF,kDAAkD;QAClD,8EAA8E,CAC/E,CAAC;AACJ,CAAC;AAuBD;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA6B;IAChE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC1G,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IAChG,SAAS,CAAC,eAAe,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;IACrE,OAAO,iBAAiB,CAAC;QACvB,eAAe;QACf,MAAM;QACN,YAAY,EAAE,YAAY,IAAI,SAAS;QACvC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC5B,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACvC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;YACvF,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"theme.js","sourceRoot":"","sources":["../src/theme.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAGL,iBAAiB,EACjB,SAAS,GAEV,MAAM,YAAY,CAAC;AAIpB,qEAAqE;AACrE,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AAEnC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAO/C,SAAS,oBAAoB;IAC3B,IAAI,CAAC;QACH,MAAM,OAAO,GAAI,UAA2D,CAAC,cAAc,CAAC;QAC5F,OAAO,OAAO,IAAI,IAAI,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,OAAQ,UAA2D,CAAC,MAAM,EAAE,MAAM,CAAC;AACrF,CAAC;AAWD,SAAS,cAAc;IACrB,MAAM,GAAG,GAAI,UAAsD,CAAC,QAAQ,CAAC;IAC7E,OAAO,GAAG,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,IAAe,EAAE,OAA6B;IAC9E,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACxE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,OAAwC;IAC/D,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACxE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC/C,OAAO,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,QAAgB,WAAW,EAC3B,OAA6B;IAE7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,YAAY,CAAC;QACjE,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACzD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,eAAe,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;AAC7C,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAe,EAAE,UAA2B,EAAE;IACzE,IAAI,CAAC;QACH,MAAM,GAAG,GACP,UAMD,CAAC,MAAM,CAAC;QACT,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC;QACpF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YACzC,OAAO;QACT,CAAC;QACD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAe,EAAE,GAAmB;IAC7D,MAAM,MAAM,GAAG,GAAG,IAAI,cAAc,EAAE,CAAC;IACvC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO;IACT,CAAC;IACD,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC;IACjE,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB,WAAW;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACrD,OAAO,CACL,sDAAsD,GAAG,IAAI;QAC7D,6CAA6C,UAAU,eAAe;QACtE,mCAAmC,UAAU,yCAAyC;QACtF,kDAAkD;QAClD,8EAA8E,CAC/E,CAAC;AACJ,CAAC;AAuBD;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA6B;IAChE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC1G,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IAChG,SAAS,CAAC,eAAe,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;IACrE,OAAO,iBAAiB,CAAC;QACvB,eAAe;QACf,MAAM;QACN,YAAY,EAAE,YAAY,IAAI,SAAS;QACvC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC5B,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACvC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;YACvF,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usequeek/app-sdk",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "private": false,
   "license": "MIT",
   "description": "SDK for Queek installable apps: webhook signature verification, install handlers, typed Merchant API client, webhook dispatch, encrypted installation store.",
@@ -30,6 +30,10 @@
     "./react": {
       "types": "./dist/react.d.ts",
       "default": "./dist/react.js"
+    },
+    "./browser": {
+      "types": "./dist/browser.d.ts",
+      "default": "./dist/browser.js"
     }
   },
   "files": [