@usequeek/app-sdk 0.6.0 → 0.6.2

package/README.md

@@ -1,16 +1,39 @@
 # @usequeek/app-sdk
 
-> In development — not yet released. APIs may change before 1.0.
-
 The SDK for building a Queek app on the public Merchant API and signed webhooks. Framework-agnostic Web-standard handlers for the install handoff and topic webhooks (`Request` in, `Response` out — use them from Next.js route handlers, Express, or any runtime), a typed Merchant API client (types generated from the live contract), GitHub-style app credentials (one asymmetric key per app, short-lived per-installation tokens minted on demand), resync recovery, and an encrypted installation store (SQLite for local/test, Postgres in production). Optional Hono wrappers live under `@usequeek/app-sdk/hono`.
 
+Full guide: <https://docs.usequeek.com/docs/apps/sdk>.
+
+> Pre-1.0: the API can still change; pin the exact version (`npm i @usequeek/app-sdk@<version>`).
+
 ```sh
 npm i @usequeek/app-sdk pg
 ```
 
 Requires Node `>=22.14`. `pg` is a regular dependency (the production store). `hono` is an optional peer — install it (`npm i hono`) only if you use the Hono wrappers.
 
-The shape follows [`@shopify/shopify-api`](https://github.com/Shopify/shopify-app-js/blob/main/packages/apps/shopify-api/README.md): the core "doesn't rely on any specific framework, so you can include it alongside your preferred stack" (runtime differences are covered by adapters such as `@shopify/shopify-api/adapters/node`), and framework integrations are separate packages in the [shopify-app-js monorepo](https://github.com/Shopify/shopify-app-js) (e.g. `@shopify/shopify-app-express` and `@shopify/shopify-app-remix` build on `@shopify/shopify-api`).
+## Quick start for AI agents
+
+Register the app on the Queek Developer page, then use the CLI:
+
+1. Scaffold: `npm create @usequeek/app my-app` (same as `queek app init`).
+2. Develop: `queek app dev` — tunnel + dev-store install; mints credentials into `.queek/.env.local` on first run.
+3. Deploy: `queek app deploy` — pushes `queek.app.toml` as a new version (secret shown once, also written to `.queek/.env.local`). In CI, authenticate with a per-app App Automation Token from the Developer page (`QUEEK_APP_AUTOMATION_TOKEN`).
+4. Import from the entry table below: `@usequeek/app-sdk` for server code, `@usequeek/app-sdk/browser` (or `/react`) for browser code — never the main entry in a browser bundle.
+5. Serve the install/uninstall/settings handoff (`handleInstallRequest`) and topic webhooks (`handleWebhookRequest`), then call the Merchant API via `createInstallationClient`.
+6. Capabilities: the live list of scopes, webhook topics and other platform capabilities is served at `https://api.usequeek.com/docs/capabilities.json`; bridge capabilities are in the `queek-bridge` skill of [queek-ai-toolkit](https://github.com/usequeek/queek-ai-toolkit) (`references/bridge-spec.md`). Confirm scope and topic names with `queek app deploy`'s validator rather than a baked-in list.
+
+## Which entry do I import?
+
+| Import | For | Pulls in |
+| --- | --- | --- |
+| `@usequeek/app-sdk` (main) | Server / universal code: handlers, client, stores, verifiers | `node:crypto`, `pg` — NOT browser-bundlable |
+| `@usequeek/app-sdk/server` | Session-token verifier (`verifySessionToken`) | Server-only (`jose`) — never import in a browser bundle |
+| `@usequeek/app-sdk/hono` | Thin Hono wrappers (`hono` optional peer) | Server-only |
+| `@usequeek/app-sdk/react` | React apps (`<QueekProvider>`, `useQueek()`; `react` optional peer) | Browser-safe (built on the same bridge modules as `/browser`) |
+| `@usequeek/app-sdk/browser` | Plain-browser code: `installAuthFetch` + bridge/theme helpers, no framework | Browser-safe ONLY |
+
+Browser rule of thumb: if the code ships to the browser and does not need React, import it from `@usequeek/app-sdk/browser`. `installAuthFetch` is a browser-safe MODULE, but it is not browser-safe FROM THE MAIN ENTRY — the main barrel re-exports server modules (`app-auth` → `node:crypto`, `store` → `pg`), so a bundler resolving `installAuthFetch` from `@usequeek/app-sdk` still parses those Node-only files and fails (Vite/Rollup builds break).
 
 ## Example (any framework)
 
@@ -124,17 +147,15 @@ fastify.post("/api/webhooks", async (req, reply) => {
 
 ### Why the raw body matters
 
-Signature verification covers the exact bytes Queek sent (`{id}.{timestamp}.{body}`), not the parsed JSON value — so the SDK takes the untouched body bytes at every layer. A parsed-then-restringified body has different bytes (spacing, key order) and will NOT verify. A string `rawBody` is used verbatim, so only pass a string when it is already the exact UTF-8 text — otherwise prefer `Buffer`/`Uint8Array` straight from `express.raw`, Fastify's `parseAs: "buffer"`, or `await request.arrayBuffer()`. This is Stripe's model (`stripe.webhooks.constructEvent(rawBody, sigHeader, secret)`): [their docs](https://docs.stripe.com/webhooks) put it bluntly — "Stripe requires the raw body of the request to perform signature verification… Any manipulation to the raw body of the request causes the verification to fail." In practice: Express needs `express.raw(...)` (never `express.json()`) on webhook routes, Fastify needs `addContentTypeParser` with `parseAs: "buffer"`, and in Next.js you read `await request.arrayBuffer()` (the SDK's layer 2 already does) rather than `await request.json()`.
+Signature verification covers the exact bytes Queek sent (`{id}.{timestamp}.{body}`, as defined by the [Standard Webhooks](https://github.com/standard-webhooks/standard-webhooks/blob/main/spec/standard-webhooks.md) spec), not the parsed JSON value — so the SDK takes the untouched body bytes at every layer. A parsed-then-restringified body has different bytes (spacing, key order) and will NOT verify. A string `rawBody` is used verbatim, so only pass a string when it is already the exact UTF-8 text — otherwise prefer `Buffer`/`Uint8Array` straight from `express.raw`, Fastify's `parseAs: "buffer"`, or `await request.arrayBuffer()`. In practice: Express needs `express.raw(...)` (never `express.json()`) on webhook routes, Fastify needs `addContentTypeParser` with `parseAs: "buffer"`, and in Next.js you read `await request.arrayBuffer()` (the SDK's layer 2 already does) rather than `await request.json()`.
 
 ### Body-size posture
 
-The SDK itself imposes no maximum body size (`arrayBuffer` / `TextDecoder` / `JSON.parse` are unbounded) — the cap belongs to the framework parser in front of it, which already rejects oversized bodies before the SDK ever sees them. Queek deliveries are small JSON payloads, so the framework defaults are plenty; if you set them explicitly, `express.raw({ type: "application/json", limit: "1mb" })` and Fastify's default `bodyLimit` of 1 MiB are the recommended ceilings. No SDK option is needed unless Queek ever ships large deliveries.
-
-(If you already run Hono on Node, `@hono/node-server`'s `getRequestListener` bridges serving for you — but the adapters above need no extra dependency.)
+The SDK itself imposes no maximum body size (`arrayBuffer` / `TextDecoder` / `JSON.parse` are unbounded) — the cap belongs to the framework parser in front of it, which already rejects oversized bodies before the SDK ever sees them. Queek deliveries are small JSON payloads, so the framework defaults are plenty; if you set them explicitly, `express.raw({ type: "application/json", limit: "1mb" })` and Fastify's default `bodyLimit` of 1 MiB are the recommended ceilings. The SDK has no body-size option.
 
 ### Hono
 
-Prefer Hono? The thin wrappers under `@usequeek/app-sdk/hono` (same options, same behaviour, same errors/status codes) mount the same core:
+Prefer Hono? The thin wrappers under `@usequeek/app-sdk/hono` (same options, same behaviour, same errors/status codes) mount the same core. (If you already run Hono on Node, `@hono/node-server`'s `getRequestListener` bridges serving for you.)
 
 ```ts
 import { SqliteInstallationStore } from "@usequeek/app-sdk";
@@ -167,28 +188,33 @@ export default app;
 Every Merchant API call goes through `createInstallationClient({ installationId, apiBase, tokens })`,
 which resolves the installation's token via `acquireToken()` and sends it as `X-Client-Key`.
 
-## Credential lifecycle (S1: GitHub-style installation tokens)
+## Credential lifecycle (GitHub-style installation tokens)
 
-One asymmetric credential per app — no per-installation secrets cross the handoff any more.
+One asymmetric credential per app — no per-installation secrets cross the handoff.
 
-1. **Generate a keypair** (once, offline) and keep the private key in the founder's password
-   manager beside `APP_ENCRYPTION_KEY` (key + DB loss = working data lost — see below):
+1. **Keypair — two paths.** (a) Offline: generate locally, then upload the PUBLIC key on
+   the Developer page (Keys) — Queek never receives the private key:
 
    ```sh
    openssl genrsa -out app-private.pem 2048
    openssl rsa -in app-private.pem -pubout -out app-public.pem
    ```
 
-2. **Register the public key** (Queek side; the backend stores it under a `kid`):
-
-   ```sh
-   php artisan app:register --public-key=./app-public.pem
-   ```
-
-   Queek prints the app secret (`QUEEK_APP_SECRET`, verifies the handoff) and the key id
-   (`APP_KEY_ID`, rides the JWT `kid` header). Configure the app with `APP_SLUG` (= `iss`),
-   `APP_KEY_ID`, and `APP_PRIVATE_KEY` (base64 of the private key PEM, one line — the
-   Developer page shows it; raw PEM also accepted — never logged, never shipped to clients).
+   (b) Faster: `queek app dev` server-generates the pair and stores the kid + private key
+   (base64, one line) in `.queek/.env.local` (gitignored, 0600) — the private key is
+   returned once and never shown again; if lost, generate a new key. Either way, keep the
+   private key in your secrets manager beside `APP_ENCRYPTION_KEY` (key + DB loss = working
+   data lost — see below).
+
+2. **Register the app** on the Queek Developer page, then configure five values — each from
+   exactly one place: `APP_SLUG` is the slug in `queek.app.toml` (= JWT `iss`); `APP_KEY_ID`
+   is the kid from Keys (returned by generate/upload, or written by `queek app dev`);
+   `APP_PRIVATE_KEY` is the matching private key (your offline file, or the once-shown
+   server-generated one; raw PEM also accepted — never logged, never shipped to clients);
+   `QUEEK_APP_SECRET` verifies the handoff (shown once on first registration — `queek app
+   deploy` appends it to `.queek/.env.local`; `queek app dev` fetches it there; or Reveal
+   it on the dashboard) and is never rotated by dev; `APP_ENCRYPTION_KEY` is 32 local
+   random bytes, base64 or hex (`queek app dev` mints one into `.queek/.env.local`).
 
 3. **Acquire / cache / re-mint.** `acquireToken(installationId)` serves the cached token while
    its expiry is more than 5 minutes away; otherwise it signs an RS256 app JWT
@@ -197,14 +223,14 @@ One asymmetric credential per app — no per-installation secrets cross the hand
    `kid` (one shared cache row per installation — restarts never burst). Concurrent callers
    in one process share one in-flight mint; two containers minting at once is harmless by
    design (Queek keeps coexisting tokens valid; a residual race self-heals via re-mint).
-   Merchant refusal table (rev 7): any 401, or 403 `api_key_revoked` / `api_key_expired` /
+   Token refusals: any 401, or 403 `api_key_revoked` / `api_key_expired` /
    `invalid_client_key` → drop the token, re-mint once, retry once (a second refusal
    propagates); 403 `app_token_revoked` → drop ALL cached tokens and halt minting (kill
    switch / disabled app, no mint); every other 403 (scope, plan, mode) propagates to the
    caller without a mint.
 
-4. **Failures follow the wire contract exactly** (`app-auth.ts` holds each code in one
-   constant, confirmed against the backend build):
+4. **Failures are handled by status and code** (`app-auth.ts` holds each code in one
+   constant):
    - `401 invalid_client` — fatal for the app: loud log, minting stops, no retry loop.
    - `403 app_token_revoked` (kill switch / disabled app) — drops ALL cached tokens, stops
      minting, loud log. Minting resumes after the app is re-enabled + process restart
@@ -232,10 +258,10 @@ One asymmetric credential per app — no per-installation secrets cross the hand
    existing installation idempotently (secret + settings refresh, `installedAt` and the
    cached token kept).
 
-6. **Kill switch behaviour.** One backend operation revokes every token of an app across
-   every store on the next request. The SDK side: cached tokens are dropped, minting halts
-   with a loud log, and every call fails closed until the app is re-enabled and the
-   process restarts (or resumes). Rotation without drama: add a `kid` (both verify) →
+6. **Kill switch behaviour.** One operation on Queek's side (the kill switch) revokes every
+   token of an app across every store on the next request. The SDK side is the
+   `app_token_revoked` row of item 4: every call fails closed until the app is re-enabled
+   and the process restarts (or resumes). Key rotation: add a `kid` (both verify) →
    switch the app to it → wait one token TTL → remove the old `kid`.
 
 ## Data rule + backups
@@ -245,7 +271,7 @@ Business data lives in Queek. `resyncFromQueek` restores CONNECTIVITY with zero
 action — but app WORKING data (inbound tokens, order links, form tokens, app-side-only
 settings) does NOT come back from resync: it needs the per-app `pg_dump` backup
 (RPO ≤ 24 h) plus the `APP_ENCRYPTION_KEY` backup. Events missed beyond Queek's webhook
-retries (~4 h) are gone; resync cannot backfill them. Full runbook: `docs/deploy.md` + O1.
+retries (~4 h) are gone; resync cannot backfill them. Deploy reference: `queek app deploy --help`.
 
 ## Data deletion
 
@@ -261,8 +287,8 @@ topics, register explicit handlers for them — an unhandled topic only reports
 
 ## Storefront app-proxy (signed reads)
 
-Queek signs each storefront proxy fetch with the installation's `proxy_secret`
-(`AppProxyService::signQuery`); verify before answering the shopper:
+Queek signs each storefront proxy fetch with the installation's `proxy_secret`;
+verify before answering the shopper:
 
 ```ts
 import { handleProxyRequest } from "@usequeek/app-sdk";
@@ -281,7 +307,7 @@ The canonical string is `path + "\n" + shop + "\n" + ts + "\n" + sorted(k=v&...)
 (`sig` excluded), hex HMAC-SHA256 over the FULL `whsec_…` string — no base64 decode
 step. `kid` routes to the installation whose `proxy_secret` verifies (previous-secret
 grace: pass every active secret to `verifyProxyQuery`); timestamps skew at most 5
-minutes, each `jti` is single-use, and only `GET` is served (phase 1 is read-only).
+minutes, each `jti` is single-use, and only `GET` is served (proxy reads are read-only).
 Hono: mount `createProxyHandler({ store, path, onVerified })` from
 `@usequeek/app-sdk/hono`.
 
@@ -290,32 +316,31 @@ Hono: mount `createProxyHandler({ store, path, onVerified })` from
 - **app-auth** (`app-auth.ts`): `loadAppCredential` (`APP_SLUG`/`APP_KEY_ID`/`APP_PRIVATE_KEY`
   — base64 of the PEM, raw PEM, or `\n`-escaped one-line PEM; RSA validated at boot),
   `signAppJwt` (RS256, `iat` now − 60 s, `exp` window 540 s ≤ 600 s,
-  `kid` header), the wire-contract error codes in one place (`INVALID_CLIENT_CODE`,
+  `kid` header), the error codes in one place (`INVALID_CLIENT_CODE`,
   `APP_TOKEN_REVOKED_CODE`, `APP_INSTALLATION_GONE_CODE`, `APP_INSTALLATION_PENDING_CODE`,
   `RESYNC_COOLDOWN_CODE`, `TOO_MANY_REQUESTS_CODE`), `AppMintHaltedError`.
 - **tokens** (`tokens.ts`): `createAppTokenProvider({ credential, store, … })` —
-  `acquireToken` (cache → sign → mint → persist), single-flight per installation, the exact
-  contract error mapping (409 pending → backoff + bounded retry, marked, never purged);
+  `acquireToken` (cache → sign → mint → persist), single-flight per installation, with the
+  error handling in Credential lifecycle items 3–4;
   `createInstallationClient({ installationId, apiBase, tokens })` — the `QueekClient`
   every app call uses (re-mint once + retry once on token refusals only).
-- **resync** (`resync.ts`): `resyncFromQueek({ apiBase, tokens, store })` — list active
-  only (opaque keyset cursor) → resync each (409 pending → retry then skip + record;
-  429 `resync_cooldown` → skip + record; other 429 → backoff + retry) → drop tokens →
-  purge absent except known-pending. Connectivity scope only.
+- **resync** (`resync.ts`): `resyncFromQueek({ apiBase, tokens, store })` — the flow in
+  Credential lifecycle item 5. Connectivity scope only.
 - **verify** (`signatures.ts`): `verifyQueekSignature` — Standard Webhooks verification (`webhook-id`, `webhook-timestamp`, `webhook-signature` over `{id}.{timestamp}.{body}`, keyed by the decoded `whsec_…` bytes), with timestamp-skew enforcement.
 - **delivery core** (`delivery.ts`): `CoreDelivery` (`rawBody` + `headers`) / `InstallDelivery` (+ `method`/`path`) / `DeliveryResult` (`{ status, body }`) / `CoreHeaders`, plus `readHeader` (case-insensitive, array-tolerant), `decodeBody`, and `toResponse`. Zero request/response types.
 - **install handlers** (`install-handlers.ts`): layer 1 `handleInstallDelivery(input, { appSecret, store, onInstall?, onUninstall?, onSettings? })` serves the signed install/uninstall/settings handoff from raw bytes + headers (routes on the path's trailing segment); layer 2 `handleInstallRequest(request, …)` adapts `Request` → `Response` onto it. Defaults persist the installation (encrypted) in the store; a redelivered install for an existing installation merges idempotently (`saveResyncedInstallation`). The Hono wrapper `createInstallHandlers` lives under `@usequeek/app-sdk/hono` (`hono.ts`).
-- **client** (`client.ts`): `createQueekClient({ apiBase, apiKey })` — the low-level typed fetch client over the Merchant API (`X-Client-Key`), with `Idempotency-Key` on writes, typed `QueekApiError`s, and 429 retry helpers. Both it and `createInstallationClient({ installationId, apiBase, tokens })` are generic (`<AppPaths>`, default: the bundled `merchant-schema.ts` compat shim): pass the app's own codegen output for current types with zero SDK publish. The default does NOT auto-update (re-run codegen in the app; sunset signal at 1.0). `openapi/merchant.json` stays in-repo as `gen:merchant`'s reference input and is not shipped in the published package. Prefer `createInstallationClient` in apps.
+- **client** (`client.ts`): `createQueekClient({ apiBase, apiKey })` — the low-level typed fetch client over the Merchant API (`X-Client-Key`), with `Idempotency-Key` on writes, typed `QueekApiError`s, and 429 retry helpers. Both it and `createInstallationClient({ installationId, apiBase, tokens })` are generic (`<AppPaths>`, default: the bundled `merchant-schema.ts` compat shim): pass the app's own codegen output for current types without waiting for an SDK release. The default does NOT auto-update (re-run codegen in the app; sunset signal at 1.0). `openapi/merchant.json` stays in-repo as `gen:merchant`'s reference input and is not shipped in the published package. Prefer `createInstallationClient` in apps.
 - **webhooks** (`webhooks.ts`): layer 1 `handleWebhookDelivery(input, { store, handlers })` verifies each delivery against the installation's endpoint secret, dedupes on `webhook-id`, and dispatches `topic → handler` at most once; layer 2 `handleWebhookRequest(request, …)` adapts `Request` → `Response` onto it. The Hono wrapper `createWebhookHandler` lives under `@usequeek/app-sdk/hono` (`hono.ts`). Unknown topics answer 200 `unhandled` — see Data deletion before relying on that.
-- **proxy** (`proxy.ts`): `verifyProxyQuery` / `verifyProxyQueryDetailed` — app-proxy query verification byte-exact with the backend (`path\nshop\nts\nsorted(k=v&...)`, hex HMAC-SHA256 over the FULL `whsec_…` string, 5-minute skew floored at 60 s, `timingSafeEqual`, previous-secret grace over the secrets list); layer 1 `verifyProxyDelivery(input, { store, … })` resolves the installation from the store by `kid` and claims single-use `jti`; layer 2 `handleProxyRequest(request, { store, path, … }, onVerified)` serves GET only. The Hono wrapper `createProxyHandler` lives under `@usequeek/app-sdk/hono` (`hono.ts`).
+- **proxy** (`proxy.ts`): `verifyProxyQuery` / `verifyProxyQueryDetailed` — app-proxy query verification byte-exact with Queek's signer (`path\nshop\nts\nsorted(k=v&...)`, hex HMAC-SHA256 over the FULL `whsec_…` string, 5-minute skew floored at 60 s, `timingSafeEqual`, previous-secret grace over the secrets list); layer 1 `verifyProxyDelivery(input, { store, … })` resolves the installation from the store by `kid` and claims single-use `jti`; layer 2 `handleProxyRequest(request, { store, path, … }, onVerified)` serves GET only. The Hono wrapper `createProxyHandler` lives under `@usequeek/app-sdk/hono` (`hono.ts`).
 - **store** (`store.ts`): `SqliteInstallationStore` (local/dev/test) and `PostgresInstallationStore`
   (`pg`, pool max 2, advisory-locked schema + `schema_version` row so two containers boot
   safely) — installations encrypted at rest (AES-GCM via `APP_ENCRYPTION_KEY`), plus the
   persisted 409-pending mark (`pending` column, schema v2, migrated in place) and the
   seen-webhook-id claim table behind dedupe. Pick with `createInstallationStore()`
   (`DATABASE_URL` set → Postgres, else SQLite — which production REFUSES with a clear
-  message). Set once when the app is deployed; installs never change env: each install adds
-  a row to the app's database, with that store's token + webhook secret encrypted using this key.
+  message). `APP_ENCRYPTION_KEY` is set once when the app is deployed; installs never change env:
+  each install adds a row to the app's database, with that store's token + webhook secret
+  encrypted using this key.
 - **background** (`background.ts`): `detach` plus `runInstallationCatchup` — jittered
   per-installation cron (uniform 0–600 s start jitter, per-install error isolation,
   concurrency ≤ pool size, honors 429 once per installation).
@@ -325,15 +350,16 @@ Hono: mount `createProxyHandler({ store, path, onVerified })` from
   `verifySessionToken` — HS256 dashboard session tokens minted per installation
   (`embsec_…` secret, raw UTF-8 key bytes, 20 s clock tolerance, slug audience,
   issuer = the handoff `apiBase` verbatim (`installation.apiBase` — it equals the
-  bare `app.url` the backend signs as `iss`), full installation binding). The secret never enters a
+  bare `app.url` Queek signs as `iss`), full installation binding). There is one token
+  type: the dashboard puts the same token in the first-load URL param
+  (`queek_token`, stripped on arrival) and answers bridge `ready` requests with it,
+  so first-load and refresh tokens are verified by this one verifier — no purpose
+  split, extra claims are ignored. The secret never enters a
   browser bundle: the main entry does not export the verifier. The install
   and resync handoffs deliver `embed_secret` + `app_id`; the store keeps
   them on the installation (`embedSecret` encrypted, `appId`), and
   `sessionTokenInstallationId` reads the token's `installation_id` as an
   unverified routing hint so a server can load that row before verifying.
-  `verifyLaunchToken` checks the signed-first-load token the same way plus the purpose pin
-  (`purpose` must be `launch`, with the `store` p_id and `theme` hints) — a launch token is refused
-  as a bridge token and vice versa.
 - **frame** (`frame.ts`, browser-safe, no secret): the embedded-app bridge
   v1 — typed unions both directions (`ready{capabilities,sdkVersion}`,
   `theme`, `title`/`title-action`, `toast`, `save-bar`/`save-bar-action`,
@@ -363,8 +389,10 @@ Hono: mount `createProxyHandler({ store, path, onVerified })` from
   Each pick carries a `requestId` (on `pick-resource`); a dashboard that
   declares `pick-resource` MUST echo it on `resource-picked` / `resource-pick-cancelled` — answers with a
   different or missing id are dropped as stale.
-- **auth** (`auth-fetch.ts`, browser-safe, no secret): `installAuthFetch({ exchange })`
-  — reads the launch token (`queek_token` query param) from the signed first
+- **auth** (`auth-fetch.ts`, no secret — browser-safe as a module, but import it
+  from `@usequeek/app-sdk/browser` in browser bundles, never from the main
+  entry): `installAuthFetch({ exchange })`
+  — reads the dashboard token (`queek_token` query param) from the first
   load, strips it with `history.replaceState`, exchanges it once for the
   app's own session, attaches `Authorization: Bearer <session>` to
   same-origin fetch (cookies stay out), and re-establishes via the bridge
@@ -372,27 +400,25 @@ Hono: mount `createProxyHandler({ store, path, onVerified })` from
   window itself) and is not retried per request after a failed attempt — only
   after a later dashboard token arrives. Pass the same `capabilities`/
   `sdkVersion` as the provider so its refresh `ready` announces one consistent set. The app's
-  token-exchange endpoint receives the LAUNCH token on first load and a BRIDGE token on every
-  401 refresh through the same `exchange` callback, so it must try
-  `verifyLaunchTokenDetailed`/`verifyLaunchToken` first and fall back to `verifySessionToken`
-  (both purposes):
+  token-exchange endpoint receives the first-load token and every 401-refresh
+  token through the same `exchange` callback, so it verifies both with the
+  single `verifySessionToken` verifier:
 
   ```ts
-  import { verifyLaunchTokenDetailed, verifySessionTokenDetailed } from "@usequeek/app-sdk/server";
+  import { verifySessionTokenDetailed } from "@usequeek/app-sdk/server";
 
   async function exchange(token: string): Promise<string> {
     const options = { secret: installation.embedSecret!, audience: "my-app", issuer: installation.apiBase, expected };
-    const launch = await verifyLaunchTokenDetailed(token, options);
-    if (launch.ok) return mintAppSession(launch.claims);
-    const bridge = await verifySessionTokenDetailed(token, options);
-    if (bridge.ok) return mintAppSession(bridge.claims);
-    throw Object.assign(new Error("unauthorized"), { status: 401 });
+    const checked = await verifySessionTokenDetailed(token, options);
+    if (!checked.ok) throw Object.assign(new Error("unauthorized"), { status: 401 });
+    return mintAppSession(checked.claims);
   }
   ```
 - **theme** (`theme.ts`, browser-safe, no secret): `applyTheme(mode)` toggles
   `.dark` on `<html>` + `color-scheme` (shadcn's dark-mode mechanism);
-  `themeBootstrapScript()` returns the inline `<head>` snippet that reads
-  `theme` from the URL before first paint (no flash);
+  `themeBootstrapScript()` returns the inline `<head>` snippet that reads the
+  unsigned `theme` URL param before first paint (no flash — a first-paint hint
+  only, validated to `light`|`dark`, overwritten by the live bridge message);
   `installThemeListener` follows live bridge `theme{mode}` messages (only from
   `window.parent` by default; pass `expectSource` to override). The live mode is
   remembered in `sessionStorage`, and the bootstrap script falls back to it when
@@ -439,14 +465,14 @@ list you pass (the app surface exposes the grant but no declared list, so the
 split needs your manifest knowledge). `requestScopes` returns
 `/apps?app={slug}&view=scopes&scopes={a},{b}` (absolute under
 `dashboardOrigin` when configured) — open it via `sendOpen` or a redirect: it
-opens the merchant's consent screen in the dashboard (shipped with dashboard
-item 8). The link carries the slug + the scope list only; the dashboard
+opens the merchant's consent screen in the dashboard (requires a dashboard that
+supports the consent screen). The link carries the slug + the scope list only; the dashboard
 resolves the installation from the signed-in store. The grant reaches you as a
 signed `app/scopes_update` handoff, which the install/settings handlers apply
 like a resync (same verifier, same replay claim): cached grant refreshed,
 cached token dropped only when the grant moved.
 
-## Embedded merchant page (S4 stage 2)
+## Embedded merchant page
 
 The dashboard frames your app's granted merchant page in a
 `sandbox="allow-scripts allow-forms"` iframe and delivers the session token
@@ -454,29 +480,22 @@ by postMessage. Serve the page with a `frame-ancestors` policy naming ONLY
 your dashboard origin, for example:
 
 ```http
-Content-Security-Policy: frame-ancestors https://merchant.queek.com
+Content-Security-Policy: frame-ancestors https://dashboard.usequeek.com
 ```
 
 Replace the host with the dashboard origin you registered. `frame-ancestors`
-is a docs-only control the dashboard cannot enforce for you: without it any
-site may frame the page, and the token handshake (origin-bound) is your only
-remaining gate. Verify every token server-side before trusting calls that carry one:
-the token-exchange endpoint receives the LAUNCH token on first load and a BRIDGE token on
-every 401 refresh through the same `installAuthFetch({ exchange })` callback, so it must try
-`verifyLaunchTokenDetailed`/`verifyLaunchToken` first and fall back to `verifySessionToken`
-(both purposes — see the `auth` entry above).
+is a header only your server can set, so the dashboard cannot enforce it for you:
+without it any site may frame the page, and the token handshake (origin-bound) is
+your only remaining gate. Verify every token server-side before trusting calls that carry one
+(see the `auth` entry under API surface).
 
 ## Local development
 
-Point the client at a local backend with `QUEEK_DEV_API_HOSTS` (comma-separated hosts). It is refused when `NODE_ENV=production`, so it can never weaken a live app. See `devApiHostsFromEnv` in `client.ts`.
+Point the client at a local Queek API with `QUEEK_DEV_API_HOSTS` (comma-separated hosts). It is refused when `NODE_ENV=production`, so it can never weaken a live app. See `devApiHostsFromEnv` in `client.ts`.
 
 Postgres locally: any Postgres works — point `DATABASE_URL` at it and the pg suite runs
 (CI always runs it via a service container); without `DATABASE_URL` those tests skip cleanly.
 
-## Registration
-
-App registration is by the Queek team today: you ship Queek your manifest URL and receive the app secret + store key. There is no public self-serve registration yet.
-
 ## License
 
 MIT — see [LICENSE](./LICENSE).

package/dist/app-auth.d.ts

@@ -1,21 +1,19 @@
 /**
- * The app credential (S1, SDK 0.2.0): ONE asymmetric RS256 key per app.
- * Queek holds the PUBLIC keys (`apps.public_keys`, kid-capped); the app
- * holds the PRIVATE key in `APP_PRIVATE_KEY` and signs short-lived app
- * JWTs that mint per-installation tokens (`acquireToken()`).
+ * The app credential: ONE asymmetric RS256 key per app. Queek holds the
+ * PUBLIC keys (kid-capped); the app holds the PRIVATE key in
+ * `APP_PRIVATE_KEY` and signs short-lived app JWTs that mint
+ * per-installation tokens (`acquireToken()`).
  *
- * Wire contract (BINDING for B2 and S1): every call under `/api/v1/apps`
- * carries `Authorization: Bearer <app JWT>` (RS256, header `kid`, claims
- * `iss` = app slug, `iat`, `exp`, `exp − iat` ≤ 600 s). `node:crypto` only
- * — no new dependency. The JWT and the private key are NEVER logged (the
+ * Every call under `/api/v1/apps` carries `Authorization: Bearer <app JWT>`
+ * (RS256, header `kid`, claims `iss` = app slug, `iat`, `exp`,
+ * `exp − iat` ≤ 600 s). `node:crypto` only — no new dependency. The JWT and the private key are NEVER logged (the
  * logger redacts `Bearer …` values; signers below never emit them).
  */
 /** 401 on an app-credential call: bad/expired JWT or unknown kid. Fatal for the app. */
 export declare const INVALID_CLIENT_CODE = "invalid_client";
 /**
  * 403 on an app-credential call: the app is disabled or its token epoch was
- * bumped by `app:revoke-tokens` (kill switch). Confirmed against B1
- * (`ApiError::APP_TOKEN_REVOKED`, returned in both cases); matched in
+ * bumped (kill switch, returned in both cases); matched in
  * exactly one place (`isAppTokenRevoked`).
  */
 export declare const APP_TOKEN_REVOKED_CODE = "app_token_revoked";
@@ -55,10 +53,10 @@ export declare function isInstallationPending(code: string | undefined): boolean
 /** True when a resync 429 code is the per-installation rotation cooldown (skip, recorded). */
 export declare function isResyncCooldown(code: string | undefined): boolean;
 /**
- * Merchant-API token-refusal codes (rev 7): a token in one of these states
+ * Merchant-API token-refusal codes: a token in one of these states
  * is dead — drop it, re-mint once, retry once. `api_key_revoked` covers the
- * uninstalled store, the removed kid, and the replaced K-slot; the re-mint
- * then answers 404 `app_installation_gone` (purge) or 401 `invalid_client`
+ * uninstalled store, the removed kid, and a token replaced by a newer one;
+ * the re-mint then answers 404 `app_installation_gone` (purge) or 401 `invalid_client`
  * (halt) where applicable. Every OTHER merchant 403 (plan, mode)
  * propagates to the caller without a mint.
  */
@@ -112,7 +110,7 @@ export declare class UnknownInstallationError extends Error {
     constructor(installationId: string);
 }
 export interface AppCredential {
-    /** `iss`: the app slug (as registered with `app:register`). */
+    /** `iss`: the app slug (as registered on the Queek Developer page). */
     appSlug: string;
     /** `kid`: which of the app's public keys Queek verifies against (`APP_KEY_ID`). */
     keyId: string;
@@ -128,7 +126,8 @@ export interface AppCredentialOptions {
 /**
  * Accepted `APP_PRIVATE_KEY` forms (env files are one line per variable):
  * raw PEM text, one-line PEM with literal `\n` escapes, or base64 of the
- * full PEM text (one line, no wrapping — what the Developer page shows).
+ * full PEM text (one line, no wrapping — the form `queek app dev` writes to
+ * `.queek/.env.local`; a server-generated key is shown once, never again).
  */
 export declare const APP_PRIVATE_KEY_FORMS = "raw PEM text, one-line PEM with literal \\n escapes, or base64 of the PEM text";
 /**

package/dist/app-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-auth.d.ts","sourceRoot":"","sources":["../src/app-auth.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AAQH,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AACpD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAC1D,+EAA+E;AAC/E,eAAO,MAAM,0BAA0B,0BAA0B,CAAC;AAClE;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AACxE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AACtD,qDAAqD;AACrD,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAC1D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAE5D,wEAAwE;AACxE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEnE;AAED,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEjE;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEpE;AAED,sGAAsG;AACtG,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEvE;AAED,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAElE;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AACtD,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AACtD,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAE5D;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAMhF;AAED,mFAAmF;AACnF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAErF;AAMD,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,gGAAgG;AAChG,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,oGAAoG;AACpG,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C,yFAAyF;AACzF,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,mGAAmG;AACnG,eAAO,MAAM,oBAAoB,MAAM,CAAC;AACxC,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,OAAQ,CAAC;AACzC,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,OAAQ,CAAC;AAMzC,0FAA0F;AAC1F,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,4BAA4B;gBAE7B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,qBAAqB;IAClC,QAAQ,CAAC,MAAM,EAAE,OAAO,mBAAmB,GAAG,OAAO,sBAAsB,CAAC;gBAEhE,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM;CAKjE;AAED,gEAAgE;AAChE,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,0BAA0B;gBAE3B,cAAc,EAAE,MAAM;CAInC;AAED,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAC;IACd,kGAAkG;IAClG,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,mFACgD,CAAC;AAEnF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAYzD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,oBAAyB,GAAG,aAAa,CAqCnF;AAMD,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,aAAa,CAAC;IAC1B,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAkB7D"}
+{"version":3,"file":"app-auth.d.ts","sourceRoot":"","sources":["../src/app-auth.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AAOH,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AACpD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAC1D,+EAA+E;AAC/E,eAAO,MAAM,0BAA0B,0BAA0B,CAAC;AAClE;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AACxE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AACtD,qDAAqD;AACrD,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAC1D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAE5D,wEAAwE;AACxE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEnE;AAED,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEjE;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEpE;AAED,sGAAsG;AACtG,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEvE;AAED,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAElE;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AACtD,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AACtD,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAE5D;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAMhF;AAED,mFAAmF;AACnF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAErF;AAMD,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,gGAAgG;AAChG,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,oGAAoG;AACpG,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C,yFAAyF;AACzF,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,mGAAmG;AACnG,eAAO,MAAM,oBAAoB,MAAM,CAAC;AACxC,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,OAAQ,CAAC;AACzC,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,OAAQ,CAAC;AAMzC,0FAA0F;AAC1F,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,4BAA4B;gBAE7B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,qBAAqB;IAClC,QAAQ,CAAC,MAAM,EAAE,OAAO,mBAAmB,GAAG,OAAO,sBAAsB,CAAC;gBAEhE,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM;CAKjE;AAED,gEAAgE;AAChE,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,0BAA0B;gBAE3B,cAAc,EAAE,MAAM;CAMnC;AAED,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAC;IACd,kGAAkG;IAClG,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,mFACgD,CAAC;AAEnF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAYzD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,oBAAyB,GAAG,aAAa,CAqCnF;AAMD,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,aAAa,CAAC;IAC1B,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAkB7D"}

package/dist/app-auth.js

@@ -1,27 +1,24 @@
 import { createPrivateKey, createSign } from "node:crypto";
 /**
- * The app credential (S1, SDK 0.2.0): ONE asymmetric RS256 key per app.
- * Queek holds the PUBLIC keys (`apps.public_keys`, kid-capped); the app
- * holds the PRIVATE key in `APP_PRIVATE_KEY` and signs short-lived app
- * JWTs that mint per-installation tokens (`acquireToken()`).
+ * The app credential: ONE asymmetric RS256 key per app. Queek holds the
+ * PUBLIC keys (kid-capped); the app holds the PRIVATE key in
+ * `APP_PRIVATE_KEY` and signs short-lived app JWTs that mint
+ * per-installation tokens (`acquireToken()`).
  *
- * Wire contract (BINDING for B2 and S1): every call under `/api/v1/apps`
- * carries `Authorization: Bearer <app JWT>` (RS256, header `kid`, claims
- * `iss` = app slug, `iat`, `exp`, `exp − iat` ≤ 600 s). `node:crypto` only
- * — no new dependency. The JWT and the private key are NEVER logged (the
+ * Every call under `/api/v1/apps` carries `Authorization: Bearer <app JWT>`
+ * (RS256, header `kid`, claims `iss` = app slug, `iat`, `exp`,
+ * `exp − iat` ≤ 600 s). `node:crypto` only — no new dependency. The JWT and the private key are NEVER logged (the
  * logger redacts `Bearer …` values; signers below never emit them).
  */
 // ---------------------------------------------------------------------------
-// Wire-contract error codes. Each code the SDK reacts to lives in EXACTLY
-// one constant here, so a backend rename is a one-line change the parallel
-// B1/B2 build must confirm.
+// Error codes on the wire. Each code the SDK reacts to lives in EXACTLY
+// one constant here, so a rename on Queek's side is a one-line change.
 // ---------------------------------------------------------------------------
 /** 401 on an app-credential call: bad/expired JWT or unknown kid. Fatal for the app. */
 export const INVALID_CLIENT_CODE = "invalid_client";
 /**
  * 403 on an app-credential call: the app is disabled or its token epoch was
- * bumped by `app:revoke-tokens` (kill switch). Confirmed against B1
- * (`ApiError::APP_TOKEN_REVOKED`, returned in both cases); matched in
+ * bumped (kill switch, returned in both cases); matched in
  * exactly one place (`isAppTokenRevoked`).
  */
 export const APP_TOKEN_REVOKED_CODE = "app_token_revoked";
@@ -71,10 +68,10 @@ export function isResyncCooldown(code) {
     return code === RESYNC_COOLDOWN_CODE;
 }
 /**
- * Merchant-API token-refusal codes (rev 7): a token in one of these states
+ * Merchant-API token-refusal codes: a token in one of these states
  * is dead — drop it, re-mint once, retry once. `api_key_revoked` covers the
- * uninstalled store, the removed kid, and the replaced K-slot; the re-mint
- * then answers 404 `app_installation_gone` (purge) or 401 `invalid_client`
+ * uninstalled store, the removed kid, and a token replaced by a newer one;
+ * the re-mint then answers 404 `app_installation_gone` (purge) or 401 `invalid_client`
  * (halt) where applicable. Every OTHER merchant 403 (plan, mode)
  * propagates to the caller without a mint.
  */
@@ -146,14 +143,15 @@ export class AppMintHaltedError extends Error {
 export class UnknownInstallationError extends Error {
     code = "unknown_installation";
     constructor(installationId) {
-        super(`Unknown installation ${installationId}: no local row (resync or reinstall first).`);
+        super(`Unknown installation ${installationId}: no local row. Recover with resyncFromQueek() (lists the app's active installations from Queek) or reinstall the app on the store.`);
         this.name = "UnknownInstallationError";
     }
 }
 /**
  * Accepted `APP_PRIVATE_KEY` forms (env files are one line per variable):
  * raw PEM text, one-line PEM with literal `\n` escapes, or base64 of the
- * full PEM text (one line, no wrapping — what the Developer page shows).
+ * full PEM text (one line, no wrapping — the form `queek app dev` writes to
+ * `.queek/.env.local`; a server-generated key is shown once, never again).
  */
 export const APP_PRIVATE_KEY_FORMS = "raw PEM text, one-line PEM with literal \\n escapes, or base64 of the PEM text";
 /**
@@ -183,15 +181,15 @@ export function loadAppCredential(options = {}) {
     const env = options.env ?? process.env;
     const appSlug = (options.appSlug ?? env.APP_SLUG ?? "").trim();
     if (appSlug === "") {
-        throw new InvalidAppCredentialError("Missing app slug for `iss`: pass appSlug or set APP_SLUG to the slug registered with Queek.");
+        throw new InvalidAppCredentialError("Missing app slug for `iss`: pass appSlug or set APP_SLUG to the slug from the Queek Developer page (register the app there, or run `queek app dev` — it writes .queek/.env.local).");
     }
     const keyId = (options.keyId ?? env.APP_KEY_ID ?? "").trim();
     if (keyId === "") {
-        throw new InvalidAppCredentialError("Missing APP_KEY_ID: set it to the kid registered with Queek (`php artisan app:register --public-key=…`).");
+        throw new InvalidAppCredentialError("Missing APP_KEY_ID: set it to the key id shown on the Queek Developer page for this app (`queek app dev` writes it to .queek/.env.local on first run).");
     }
     const privateKeyInput = (options.privateKeyPem ?? env.APP_PRIVATE_KEY ?? "").trim();
     if (privateKeyInput === "") {
-        throw new InvalidAppCredentialError(`Missing APP_PRIVATE_KEY: set it to base64 of the app's RSA private key PEM (one line). Accepted forms: ${APP_PRIVATE_KEY_FORMS}.`);
+        throw new InvalidAppCredentialError(`Missing APP_PRIVATE_KEY: set it to the app's RSA private key — your offline-generated file, or the server-generated key (shown once on the Developer page; \`queek app dev\` stores it in .queek/.env.local). If lost, generate a new key. Accepted forms: ${APP_PRIVATE_KEY_FORMS}.`);
     }
     const privateKeyPem = decodePrivateKeyInput(privateKeyInput);
     try {

package/dist/app-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-auth.js","sourceRoot":"","sources":["../src/app-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE3D;;;;;;;;;;;GAWG;AAEH,8EAA8E;AAC9E,0EAA0E;AAC1E,2EAA2E;AAC3E,4BAA4B;AAC5B,8EAA8E;AAE9E,wFAAwF;AACxF,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AACpD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAC1D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AAClE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AACxE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AACtD,qDAAqD;AACrD,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAC1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE5D,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACxD,OAAO,IAAI,KAAK,sBAAsB,CAAC;AACzC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,IAAwB;IACtD,OAAO,IAAI,KAAK,mBAAmB,CAAC;AACtC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,OAAO,IAAI,KAAK,0BAA0B,CAAC;AAC7C,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,OAAO,IAAI,KAAK,6BAA6B,CAAC;AAChD,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,gBAAgB,CAAC,IAAwB;IACvD,OAAO,IAAI,KAAK,oBAAoB,CAAC;AACvC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AACtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AACtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,IAAwB;IACrE,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,CACL,MAAM,KAAK,GAAG;QACd,CAAC,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,uBAAuB,CAAC,CACrG,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,IAAwB;IAC1E,OAAO,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,uBAAuB,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,4DAA4D;AAC5D,8EAA8E;AAE9E,iFAAiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,gGAAgG;AAChG,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,oGAAoG;AACpG,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAC/C,yFAAyF;AACzF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,mGAAmG;AACnG,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACxC,wFAAwF;AACxF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AACzC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAEzC,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,0FAA0F;AAC1F,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,GAAG,wBAAwB,CAAC;IAEzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,GAAG,iBAAiB,CAAC;IACzB,MAAM,CAA6D;IAE5E,YAAY,MAAoC,EAAE,MAAc;QAC9D,KAAK,CAAC,mBAAmB,MAAM,MAAM,MAAM,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,IAAI,GAAG,sBAAsB,CAAC;IAEvC,YAAY,cAAsB;QAChC,KAAK,CAAC,wBAAwB,cAAc,6CAA6C,CAAC,CAAC;QAC3F,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAkBD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,gFAAgF,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACrC,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,yBAAyB,CACjC,+EAA+E,qBAAqB,GAAG,CACxG,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAgC,EAAE;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,yBAAyB,CACjC,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,yBAAyB,CACjC,0GAA0G,CAC3G,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpF,IAAI,eAAe,KAAK,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,yBAAyB,CACjC,0GAA0G,qBAAqB,GAAG,CACnI,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;YACpC,MAAM,IAAI,yBAAyB,CACjC,mDAAmD,GAAG,CAAC,iBAAiB,IAAI,SAAS,aAAa,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,yBAAyB;YAAE,MAAM,KAAK,CAAC;QAC5D,MAAM,IAAI,yBAAyB,CACjC,6DAA6D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,sBAAsB,qBAAqB,GAAG,CAClK,CAAC;IACJ,CAAC;IACD,oEAAoE;IACpE,gEAAgE;IAChE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,SAAS,CAAC,KAAsB;IACvC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC5D,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,OAA0B;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,GAAG,GAAG,oBAAoB,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,GAAG,mBAAmB,CAAC;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACtG,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACzF,MAAM,YAAY,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;IAC5C,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACpC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,yBAAyB,CACjC,+EAA+E,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAC1L,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,YAAY,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"app-auth.js","sourceRoot":"","sources":["../src/app-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE3D;;;;;;;;;;GAUG;AAEH,8EAA8E;AAC9E,wEAAwE;AACxE,uEAAuE;AACvE,8EAA8E;AAE9E,wFAAwF;AACxF,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AACpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAC1D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AAClE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AACxE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AACtD,qDAAqD;AACrD,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAC1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE5D,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACxD,OAAO,IAAI,KAAK,sBAAsB,CAAC;AACzC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,IAAwB;IACtD,OAAO,IAAI,KAAK,mBAAmB,CAAC;AACtC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,OAAO,IAAI,KAAK,0BAA0B,CAAC;AAC7C,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,OAAO,IAAI,KAAK,6BAA6B,CAAC;AAChD,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,gBAAgB,CAAC,IAAwB;IACvD,OAAO,IAAI,KAAK,oBAAoB,CAAC;AACvC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AACtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AACtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,IAAwB;IACrE,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,CACL,MAAM,KAAK,GAAG;QACd,CAAC,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,uBAAuB,CAAC,CACrG,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,IAAwB;IAC1E,OAAO,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,uBAAuB,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,4DAA4D;AAC5D,8EAA8E;AAE9E,iFAAiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,gGAAgG;AAChG,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,oGAAoG;AACpG,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAC/C,yFAAyF;AACzF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,mGAAmG;AACnG,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACxC,wFAAwF;AACxF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AACzC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAEzC,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,0FAA0F;AAC1F,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,GAAG,wBAAwB,CAAC;IAEzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,GAAG,iBAAiB,CAAC;IACzB,MAAM,CAA6D;IAE5E,YAAY,MAAoC,EAAE,MAAc;QAC9D,KAAK,CAAC,mBAAmB,MAAM,MAAM,MAAM,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,IAAI,GAAG,sBAAsB,CAAC;IAEvC,YAAY,cAAsB;QAChC,KAAK,CACH,wBAAwB,cAAc,qIAAqI,CAC5K,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAkBD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,gFAAgF,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACrC,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,yBAAyB,CACjC,+EAA+E,qBAAqB,GAAG,CACxG,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAgC,EAAE;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,yBAAyB,CACjC,oLAAoL,CACrL,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,yBAAyB,CACjC,wJAAwJ,CACzJ,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpF,IAAI,eAAe,KAAK,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,yBAAyB,CACjC,8PAA8P,qBAAqB,GAAG,CACvR,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;YACpC,MAAM,IAAI,yBAAyB,CACjC,mDAAmD,GAAG,CAAC,iBAAiB,IAAI,SAAS,aAAa,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,yBAAyB;YAAE,MAAM,KAAK,CAAC;QAC5D,MAAM,IAAI,yBAAyB,CACjC,6DAA6D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,sBAAsB,qBAAqB,GAAG,CAClK,CAAC;IACJ,CAAC;IACD,oEAAoE;IACpE,gEAAgE;IAChE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,SAAS,CAAC,KAAsB;IACvC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC5D,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,OAA0B;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,GAAG,GAAG,oBAAoB,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,GAAG,mBAAmB,CAAC;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACtG,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACzF,MAAM,YAAY,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;IAC5C,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACpC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,yBAAyB,CACjC,+EAA+E,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAC1L,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,YAAY,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC9D,CAAC"}