@usequeek/app-sdk 0.6.1 → 0.7.0

package/dist/store.js

@@ -50,19 +50,17 @@ const INSTALLATIONS_TABLE_SQLITE = `
  * built-in `node:sqlite` (`DatabaseSync` — synchronous, file-backed, WAL
  * mode).
  *
- * Why not better-sqlite3: its prebuilt binary segfaults on the project's
- * Node 22.12 runtime (observed, not theorised), and building from source
- * would force a C++ toolchain into every environment — dev Macs, CI, and
- * the slim alpine app images. `node:sqlite` is dependency-free with an
- * identical synchronous shape.
+ * Why not better-sqlite3: its prebuilt binary segfaults on Node 22.12, and
+ * building from source would force a C++ toolchain into every environment
+ * — dev Macs, CI, and slim alpine images. `node:sqlite` is
+ * dependency-free with an identical synchronous shape.
  *
- * `node:sqlite` needs no flag since Node 22.13.0 (pinned runtime 22.23.3;
- * an ExperimentalWarning on stderr remains — Stability 1.1). Devs on an
- * older 22 minor set `NODE_OPTIONS=--experimental-sqlite` in their shell.
- * Revisit when the apps run on a Node line where it is fully stable — the
- * swap is contained here, behind `InstallationStore`.
+ * `node:sqlite` needs no flag since Node 22.13.0 (an ExperimentalWarning on
+ * stderr remains — Stability 1.1). Devs on an older 22 minor set
+ * `NODE_OPTIONS=--experimental-sqlite` in their shell. The swap to another
+ * driver is contained here, behind `InstallationStore`.
  *
- * 0.1.x → 0.2.0 upgrade: databases created by SDK 0.1.x carry a legacy
+ * Legacy upgrade: databases created by SDK 0.1.x carry a legacy
  * `api_key_enc` column (the handoff no longer delivers that key, so its
  * value is dead — minted tokens replace it; resync restores connectivity).
  * Opening such a database adds the token-cache columns and drops
@@ -90,21 +88,21 @@ export class SqliteInstallationStore {
             // its ciphertext is dropped, never decrypted or re-encrypted.
             this.db.exec(`ALTER TABLE installations DROP COLUMN api_key_enc;`);
         }
-        // Schema v2 (B2 review r2): the persisted 409-pending mark. Existing
+        // Schema v2: the persisted 409-pending mark. Existing
         // rows backfill to 0 (not pending); fresh tables already carry the
         // column via the CREATE above, so this is a no-op for them.
         const live = new Set(this.db.prepare(`PRAGMA table_info(installations)`).all().map((column) => column.name));
         if (!live.has("pending")) {
             this.db.exec(`ALTER TABLE installations ADD COLUMN pending INTEGER NOT NULL DEFAULT 0;`);
         }
-        // Schema v3 (FA1): the installation proxy secret for slot-claim
+        // Schema v3: the installation proxy secret for slot-claim
         // signing. Existing rows backfill to NULL (no proxy secret known
         // until the next install/resync handoff); fresh tables already carry
         // the column via the CREATE above, so this is a no-op for them.
         if (!live.has("proxy_secret_enc")) {
             this.db.exec(`ALTER TABLE installations ADD COLUMN proxy_secret_enc TEXT;`);
         }
-        // Schema v4 (S4): the embed secret + app id that verify dashboard
+        // Schema v4: the embed secret + app id that verify dashboard
         // session tokens. Existing rows backfill to NULL until the next
         // install/resync handoff delivers them.
         if (!live.has("embed_secret_enc")) {
@@ -252,8 +250,7 @@ export class SqliteInstallationStore {
 }
 /**
  * Canonical integer-string form of a Queek `p_id`: the handoff contract
- * types p_ids as strings and the backend casts on the wire, but the
- * tolerance stays — a JSON integer would reach here as a JS number, and
+ * types p_ids as strings, but the tolerance stays — a JSON integer would reach here as a JS number, and
  * `node:sqlite` binds that number into a TEXT column as `"1021.0"`, which
  * never equals the proxy `kid` (`"1021"`). Non-numeric pids pass through
  * untouched.
@@ -418,17 +415,17 @@ export class PostgresInstallationStore {
             webhook_id TEXT PRIMARY KEY,
             seen_at BIGINT NOT NULL
           );
-          -- Schema v2 (B2 review r2): the persisted 409-pending mark.
+          -- Schema v2: the persisted 409-pending mark.
           -- Fresh tables already carry the column; this migrates v1
           -- databases in place (existing rows backfill to FALSE).
           ALTER TABLE installations
           ADD COLUMN IF NOT EXISTS pending BOOLEAN NOT NULL DEFAULT FALSE;
-          -- Schema v3 (FA1): the installation proxy secret for slot-claim
+          -- Schema v3: the installation proxy secret for slot-claim
           -- signing. Existing rows backfill to NULL (unknown until the
           -- next install/resync handoff).
           ALTER TABLE installations
           ADD COLUMN IF NOT EXISTS proxy_secret_enc TEXT;
-          -- Schema v4 (S4): the embed secret + app id that verify
+          -- Schema v4: the embed secret + app id that verify
           -- dashboard session tokens (NULL until the next handoff).
           ALTER TABLE installations
           ADD COLUMN IF NOT EXISTS embed_secret_enc TEXT;
@@ -717,4 +714,3 @@ export function createInstallationStore(options) {
         storeKey: options.storeKey,
     });
 }
-//# sourceMappingURL=store.js.map

package/dist/theme.d.ts

@@ -1,5 +1,5 @@
 /**
- * Dashboard-following theme (U7): dark when the dashboard is dark, light
+ * Dashboard-following theme: dark when the dashboard is dark, light
  * when light, switching live. First load carries `theme=light|dark` as a
  * plain UNSIGNED URL query param (dashboard `resolvedTheme`) so the app
  * server-renders `<html class="dark">` with no flash; live changes arrive
@@ -97,4 +97,3 @@ export interface ThemeListenerOptions {
  * Returns an unsubscribe function.
  */
 export declare function installThemeListener(options: ThemeListenerOptions): () => void;
-//# sourceMappingURL=theme.d.ts.map

package/dist/theme.js

@@ -1,5 +1,5 @@
 /**
- * Dashboard-following theme (U7): dark when the dashboard is dark, light
+ * Dashboard-following theme: dark when the dashboard is dark, light
  * when light, switching live. First load carries `theme=light|dark` as a
  * plain UNSIGNED URL query param (dashboard `resolvedTheme`) so the app
  * server-renders `<html class="dark">` with no flash; live changes arrive
@@ -159,4 +159,3 @@ export function installThemeListener(options) {
         },
     });
 }
-//# sourceMappingURL=theme.js.map

package/dist/tokens.d.ts

@@ -3,7 +3,7 @@ import { type MerchantPaths, QueekApiError, type QueekClient, type ResolvedPaths
 import { type Logger } from "./logger.js";
 import { type InstallationStore } from "./store.js";
 /**
- * Installation tokens (S1, SDK 0.2.0): the app holds ONE asymmetric app
+ * Installation tokens: the app holds ONE asymmetric app
  * credential and mints short-lived installation tokens from Queek on
  * demand, cached (encrypted) in its own database to near-expiry.
  *
@@ -13,7 +13,7 @@ import { type InstallationStore } from "./store.js";
  *   installation client goes through it.
  * - A merchant-API token refusal → drop it, re-mint once, retry once; a
  *   second refusal propagates. Token refusal = any 401, or a 403 with
- *   `api_key_revoked` / `api_key_expired` / `invalid_client_key` (rev 7).
+ *   `api_key_revoked` / `api_key_expired` / `invalid_client_key`.
  *   A merchant 403 `insufficient_scope` (stale grant) follows the same
  *   drop + re-mint-once + retry-once path. A merchant 403
  *   `app_token_revoked` is the app-wide kill switch (drop all + halt, no
@@ -22,17 +22,17 @@ import { type InstallationStore } from "./store.js";
  *   mint path below applies those rules.)
  * - Concurrent callers in one process share ONE in-flight mint per
  *   installation (single-flight). Across containers two mints are harmless
- *   by design: Queek keeps coexisting tokens valid (K=2 slots) and the
+ *   by design: Queek keeps coexisting tokens valid (two token slots) and the
  *   last write wins the shared cache row; a residual race self-heals via
  *   re-mint on 401.
- * - Error handling exactly per the wire contract: 401 `invalid_client`
+ * - Error handling by status and code: 401 `invalid_client`
  *   halts minting app-wide (loud log, no retry loop); 403 kill-switch
  *   drops ALL cached tokens and halts; 404 `app_installation_gone` purges
  *   the installation; 409 `app_installation_pending` retries later with
  *   backoff — NEVER purges, NEVER halts (the persisted pending mark keeps
  *   the row through restarts and resync's purge-absent step); 429 honors
- *   `Retry-After` +
- *   jitter with bounded retries; 5xx/network bounded exponential backoff.
+ *   `Retry-After` + jitter with bounded retries; 5xx/network bounded
+ *   exponential backoff.
  */
 /** Path of the app-credential API below the store host. */
 export declare const APP_API_PATH = "/api/v1/apps";
@@ -58,7 +58,7 @@ export interface TokenProviderOptions {
     fetchImpl?: typeof fetch;
     /** Sent as User-Agent on app-API calls. Defaults to `queek-app/1.0`. */
     userAgent?: string;
-    /** Extra allowed `apiBase` hosts (test/local backends). */
+    /** Extra allowed `apiBase` hosts (test/local API hosts). */
     allowedApiHosts?: string[];
     /** Loud halt/drop logs go here. Defaults to a `queek-app-tokens` logger (stderr on warn+). */
     logger?: Logger;
@@ -75,7 +75,14 @@ export interface TokenProviderOptions {
  * (`<origin>/api/v1/apps`). Throws `InvalidApiBaseError` before any fetch.
  */
 export declare function resolveAppApiBase(raw: string, allowedApiHosts?: string[]): string;
+/** The app-API path that mints a token for one installation. */
 export declare function mintPath(installationId: string): string;
+/**
+ * Mints, caches and refreshes installation tokens for one app. Tokens are
+ * minted with the app's RSA key, cached encrypted in the installation store,
+ * and shared by concurrent callers in one process. Build one with
+ * {@link createAppTokenProvider} and pass it to `createInstallationClient`.
+ */
 export declare class AppTokenProvider implements AppTokens {
     private readonly credential;
     private readonly store;
@@ -104,7 +111,7 @@ export declare class AppTokenProvider implements AppTokens {
     dropAllCachedTokens(): Promise<void>;
     /**
      * Persist the 409 `app_installation_pending` mark for this installation
-     * (store column — survives restarts, B2 review r2). Resync's purge-absent
+     * (store column — survives restarts). Resync's purge-absent
      * step keeps marked rows (the list covers active installations only).
      * Called by the mint path and by `resyncFromQueek`; idempotent, and a
      * no-op when the row is already gone.
@@ -151,8 +158,10 @@ export interface InstallationClientOptions {
     fetchImpl?: typeof fetch;
     /** Sent as User-Agent. Defaults to `queek-app/1.0`. */
     userAgent?: string;
-    /** Extra allowed `apiBase` hosts (test/local backends). */
+    /** Extra allowed `apiBase` hosts (test/local API hosts). */
     allowedApiHosts?: string[];
+    /** Time one attempt may take, in ms (default 30000). `0` disables the client timeout. */
+    timeoutMs?: number;
 }
 /**
  * A `QueekClient` whose every call goes through `acquireToken()`: the
@@ -174,4 +183,3 @@ export interface InstallationClientOptions {
  * does NOT auto-update (re-run codegen in the app; sunset signal at 1.0).
  */
 export declare function createInstallationClient<TPaths = MerchantPaths>(options: InstallationClientOptions): QueekClient<ResolvedPaths<TPaths>>;
-//# sourceMappingURL=tokens.d.ts.map

package/dist/tokens.js

@@ -1,9 +1,9 @@
 import { APP_TOKEN_REVOKED_CODE, AppMintHaltedError, INVALID_CLIENT_CODE, isAppTokenRevoked, isInstallationGone, isInstallationPending, isInsufficientScope, isTokenRefusal, MAX_MINT_ATTEMPTS, MINT_BACKOFF_BASE_MS, MINT_BACKOFF_MAX_MS, RETRY_JITTER_MAX_MS, signAppJwt, TOKEN_VALIDITY_SKEW_SECONDS, UnknownInstallationError, } from "./app-auth.js";
-import { createQueekClient, isWriteMethod, MERCHANT_API_PATH, newIdempotencyKey, QueekApiError, queekApiErrorFromResponse, resolveApiBase, } from "./client.js";
+import { createQueekClient, DEFAULT_REQUEST_TIMEOUT_MS, isWriteMethod, MERCHANT_API_PATH, newIdempotencyKey, parseSuccessBody, QueekApiError, queekApiErrorFromResponse, requestSignal, resolveApiBase, runWithRetry, transportError, tryParseJson, } from "./client.js";
 import { createLogger } from "./logger.js";
 import { defaultClearCachedTokenIfMatches } from "./store.js";
 /**
- * Installation tokens (S1, SDK 0.2.0): the app holds ONE asymmetric app
+ * Installation tokens: the app holds ONE asymmetric app
  * credential and mints short-lived installation tokens from Queek on
  * demand, cached (encrypted) in its own database to near-expiry.
  *
@@ -13,7 +13,7 @@ import { defaultClearCachedTokenIfMatches } from "./store.js";
  *   installation client goes through it.
  * - A merchant-API token refusal → drop it, re-mint once, retry once; a
  *   second refusal propagates. Token refusal = any 401, or a 403 with
- *   `api_key_revoked` / `api_key_expired` / `invalid_client_key` (rev 7).
+ *   `api_key_revoked` / `api_key_expired` / `invalid_client_key`.
  *   A merchant 403 `insufficient_scope` (stale grant) follows the same
  *   drop + re-mint-once + retry-once path. A merchant 403
  *   `app_token_revoked` is the app-wide kill switch (drop all + halt, no
@@ -22,17 +22,17 @@ import { defaultClearCachedTokenIfMatches } from "./store.js";
  *   mint path below applies those rules.)
  * - Concurrent callers in one process share ONE in-flight mint per
  *   installation (single-flight). Across containers two mints are harmless
- *   by design: Queek keeps coexisting tokens valid (K=2 slots) and the
+ *   by design: Queek keeps coexisting tokens valid (two token slots) and the
  *   last write wins the shared cache row; a residual race self-heals via
  *   re-mint on 401.
- * - Error handling exactly per the wire contract: 401 `invalid_client`
+ * - Error handling by status and code: 401 `invalid_client`
  *   halts minting app-wide (loud log, no retry loop); 403 kill-switch
  *   drops ALL cached tokens and halts; 404 `app_installation_gone` purges
  *   the installation; 409 `app_installation_pending` retries later with
  *   backoff — NEVER purges, NEVER halts (the persisted pending mark keeps
  *   the row through restarts and resync's purge-absent step); 429 honors
- *   `Retry-After` +
- *   jitter with bounded retries; 5xx/network bounded exponential backoff.
+ *   `Retry-After` + jitter with bounded retries; 5xx/network bounded
+ *   exponential backoff.
  */
 /** Path of the app-credential API below the store host. */
 export const APP_API_PATH = "/api/v1/apps";
@@ -48,9 +48,16 @@ export function resolveAppApiBase(raw, allowedApiHosts = []) {
     const merchant = resolveApiBase(raw, allowedApiHosts);
     return `${merchant.slice(0, merchant.length - MERCHANT_API_PATH.length)}${APP_API_PATH}`;
 }
+/** The app-API path that mints a token for one installation. */
 export function mintPath(installationId) {
     return `/installations/${encodeURIComponent(installationId)}/access_tokens`;
 }
+/**
+ * Mints, caches and refreshes installation tokens for one app. Tokens are
+ * minted with the app's RSA key, cached encrypted in the installation store,
+ * and shared by concurrent callers in one process. Build one with
+ * {@link createAppTokenProvider} and pass it to `createInstallationClient`.
+ */
 export class AppTokenProvider {
     credential;
     store;
@@ -148,7 +155,7 @@ export class AppTokenProvider {
     }
     /**
      * Persist the 409 `app_installation_pending` mark for this installation
-     * (store column — survives restarts, B2 review r2). Resync's purge-absent
+     * (store column — survives restarts). Resync's purge-absent
      * step keeps marked rows (the list covers active installations only).
      * Called by the mint path and by `resyncFromQueek`; idempotent, and a
      * no-op when the row is already gone.
@@ -239,8 +246,7 @@ export class AppTokenProvider {
                     await this.handleAppEndpointError(error, { id: installationId, pid: installationPid });
                 }
                 if (error.status === 409 && isInstallationPending(error.code)) {
-                    // Pending installation (rev 8, mark persisted per B2 review
-                    // r2): retry later with backoff — NEVER purge, NEVER halt. The
+                    // Pending installation: retry later with backoff — NEVER purge, NEVER halt. The
                     // persisted mark keeps the row through restarts and resync's
                     // purge-absent step (the list covers active rows only). After
                     // the bounded budget the 409 propagates to the caller, which
@@ -263,7 +269,7 @@ export class AppTokenProvider {
                     await this.sleep(this.jittered(error.retryAfterMs ?? MINT_BACKOFF_BASE_MS));
                     continue;
                 }
-                if (error.status >= 500 || error.code === "network_error") {
+                if (error.status >= 500 || error.code === "network_error" || error.code === "request_timeout") {
                     const backoff = Math.min(MINT_BACKOFF_MAX_MS, MINT_BACKOFF_BASE_MS * 2 ** attempt);
                     await this.sleep(this.jittered(backoff));
                     continue;
@@ -284,26 +290,23 @@ export class AppTokenProvider {
         headers.set("Authorization", `Bearer ${jwt}`);
         headers.set("Accept", "application/json");
         headers.set("User-Agent", this.userAgent);
+        const signal = requestSignal(undefined, DEFAULT_REQUEST_TIMEOUT_MS);
         let response;
+        let text;
         try {
-            response = await this.fetchImpl(url, { method: "POST", headers });
+            response = await this.fetchImpl(url, { method: "POST", headers, signal });
+            text = await response.text();
         }
         catch (cause) {
-            throw new QueekApiError({
-                status: 0,
-                code: "network_error",
-                message: cause instanceof Error ? `Could not reach Queek: ${cause.message}` : "Could not reach Queek.",
-            });
+            throw transportError(cause);
         }
-        const text = await response.text();
-        const parsed = text === "" ? null : tryParseJson(text);
         if (!response.ok) {
-            throw queekApiErrorFromResponse(response.status, parsed, response.headers);
+            throw queekApiErrorFromResponse(response.status, text === "" ? null : tryParseJson(text), response.headers);
         }
         if (response.status !== 201) {
-            throw new Error(`Unexpected mint status ${response.status} for installation ${installationPid} (expected 201).`);
+            throw new Error(`Unexpected mint status ${response.status} for installation ${installationPid} (expected 201). Check that apiBase is the Queek API host and retry; if it persists, report it with the request id.`);
         }
-        return parseMintBody(parsed, installationPid, this.credential.keyId);
+        return parseMintBody(parseSuccessBody(response, text), installationPid, this.credential.keyId);
     }
 }
 function parseMintBody(body, installationPid, kid) {
@@ -311,7 +314,7 @@ function parseMintBody(body, installationPid, kid) {
     const token = typeof record.token === "string" && record.token !== "" ? record.token : null;
     const expiresAt = typeof record.expires_at === "string" ? record.expires_at : null;
     if (token === null || expiresAt === null || Number.isNaN(Date.parse(expiresAt))) {
-        throw new Error(`Malformed mint response for installation ${installationPid}: expected {token, expires_at}.`);
+        throw new Error(`Malformed mint response for installation ${installationPid}: expected {token, expires_at}. Retry; if it persists, report it to Queek.`);
     }
     return { token, expiresAt, kid };
 }
@@ -340,8 +343,7 @@ export function createAppTokenProvider(options) {
  */
 export function createInstallationClient(options) {
     // Validated here, once, before any fetch — same rules as the static client.
-    const probe = resolveApiBase(options.apiBase, options.allowedApiHosts ?? []);
-    void probe;
+    resolveApiBase(options.apiBase, options.allowedApiHosts ?? []);
     const fetchImpl = options.fetchImpl ?? fetch;
     const userAgent = options.userAgent ?? "queek-app/1.0";
     const allowedApiHosts = options.allowedApiHosts ?? [];
@@ -356,6 +358,7 @@ export function createInstallationClient(options) {
                     fetchImpl,
                     userAgent,
                     allowedApiHosts,
+                    timeoutMs: options.timeoutMs,
                 }),
             };
         }
@@ -394,7 +397,7 @@ export function createInstallationClient(options) {
                 const fresh = await options.tokens.acquireToken(options.installationId);
                 return (await clientForToken(fresh)).request(method, path, attemptOptions);
             }
-            // Token refusals ONLY (rev 7): any 401, or a 403 carrying a
+            // Token refusals ONLY: any 401, or a 403 carrying a
             // revoked/expired-key code. Every other 403 (plan, mode) propagates
             // to the caller without burning a mint.
             if (!isTokenRefusal(error.status, error.code))
@@ -409,28 +412,9 @@ export function createInstallationClient(options) {
         }
     }
     async function requestWithRetry(method, path, retryOptions = {}) {
-        const maxAttempts = Math.max(1, Math.floor(retryOptions.maxAttempts ?? 3));
-        const baseDelayMs = retryOptions.baseDelayMs ?? 250;
-        const maxDelayMs = retryOptions.maxDelayMs ?? 5000;
-        const sleep = retryOptions.sleep ?? defaultSleep;
-        const idempotencyKey = retryOptions.idempotencyKey;
-        let lastError;
-        for (let attempt = 0; attempt < maxAttempts; attempt++) {
-            try {
-                return await request(method, path, { ...retryOptions, idempotencyKey });
-            }
-            catch (error) {
-                lastError = error;
-                const retryable = error instanceof QueekApiError && (error.isRateLimited || error.code === "network_error");
-                if (!retryable || attempt === maxAttempts - 1)
-                    throw error;
-                const delay = error instanceof QueekApiError && error.isRateLimited && error.retryAfterMs !== undefined
-                    ? error.retryAfterMs
-                    : Math.min(maxDelayMs, baseDelayMs * 2 ** attempt);
-                await sleep(delay);
-            }
-        }
-        throw lastError;
+        // One key for every attempt: without it each `request()` would mint its
+        // own and a retried write could run twice.
+        return runWithRetry(method, retryOptions, (idempotencyKey) => request(method, path, { ...retryOptions, idempotencyKey }));
     }
     return {
         getStore: (signal) => request("GET", "/store", { signal }),
@@ -438,12 +422,3 @@ export function createInstallationClient(options) {
         requestWithRetry,
     };
 }
-function tryParseJson(text) {
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return { message: text.slice(0, 500) };
-    }
-}
-//# sourceMappingURL=tokens.js.map

package/dist/webhooks.d.ts

@@ -1,9 +1,8 @@
-import { type CoreDelivery, type DeliveryResult } from "./delivery.js";
+import { type CoreDelivery, type DeliveryErrorHandler, type DeliveryResult } from "./delivery.js";
 import type { InstallationRecord, InstallationStore } from "./store.js";
 /**
- * Framework-agnostic receiver for Queek topic deliveries
- * (`DeliverWebhookJob` in queek_backend, one signed POST per installation
- * endpoint) in three thin layers: layer 1
+ * Framework-agnostic receiver for Queek topic deliveries (one signed POST
+ * per installation endpoint) in three thin layers: layer 1
  * `handleWebhookDelivery(input, options)` takes plain data (untouched body
  * bytes + headers) and returns a plain `{ status, body }` result — zero
  * request/response types, so whatever request object each framework
@@ -23,7 +22,7 @@ import type { InstallationRecord, InstallationStore } from "./store.js";
  * installations per app are few). Apps that carry their own routing hint
  * may pass `resolveSecret` instead.
  *
- * Dedupe: Queek retries a delivery for ~4h until it sees 2xx, so every
+ * Dedupe: Queek retries a delivery until it sees 2xx, so every
  * `webhook-id` is processed AT MOST once — the header id is claimed
  * atomically up front (exactly one concurrent same-id delivery runs the
  * handler) and a repeat answers 200 WITHOUT re-running it. A throwing
@@ -33,6 +32,7 @@ import type { InstallationRecord, InstallationStore } from "./store.js";
  * non-2xx.
  */
 export declare const QUEEK_TOPIC_HEADER = "X-Queek-Topic";
+/** The signed envelope of one topic delivery. `data` is the topic payload. */
 export interface QueekWebhookEnvelope<TData = unknown> {
     id: string;
     topic: string;
@@ -50,6 +50,7 @@ export interface SecretResolution {
     installationId: string;
     secret: string;
 }
+/** Options for the topic webhook receiver. `store` and `handlers` are required. */
 export interface WebhookHandlerOptions {
     store: InstallationStore;
     /** `topic → handler`, e.g. `{ "orders/updated": onOrderUpdated }`. */
@@ -62,11 +63,35 @@ export interface WebhookHandlerOptions {
     }) => Promise<SecretResolution | null>;
     nowSeconds?: number;
     maxSkewSeconds?: number;
+    /**
+     * Called with the error a handler threw, before the 500 goes back. Without
+     * it the error is logged to stderr (secrets redacted).
+     */
+    onError?: DeliveryErrorHandler;
 }
 /**
  * Layer 1: handle one signed Queek topic delivery from plain data — no
  * `Request`, no framework. Same options, same behaviour, same
  * errors/status codes at every layer.
+ *
+ * Answers 401 for a missing header, an unknown installation, a stale
+ * timestamp or a bad signature; 400 for a body that is not a JSON envelope;
+ * 200 for a handled, repeated or unhandled-topic delivery; 500 when your
+ * handler throws (the claim is released so Queek's retry can land).
+ *
+ * @example
+ * const result = await handleWebhookDelivery(
+ *   { rawBody, headers },
+ *   {
+ *     store,
+ *     handlers: {
+ *       "orders/updated": async (envelope, { installation }) => {
+ *         await syncOrder(installation.installationId, envelope.data);
+ *       },
+ *     },
+ *   },
+ * );
+ * // reply with result.status and result.body
  */
 export declare function handleWebhookDelivery(input: CoreDelivery, options: WebhookHandlerOptions): Promise<DeliveryResult>;
 /**
@@ -75,4 +100,3 @@ export declare function handleWebhookDelivery(input: CoreDelivery, options: Webh
  * `Response`. Only `POST` is served; anything else answers 405.
  */
 export declare function handleWebhookRequest(request: Request, options: WebhookHandlerOptions): Promise<Response>;
-//# sourceMappingURL=webhooks.d.ts.map

package/dist/webhooks.js

@@ -1,9 +1,8 @@
-import { decodeBody, readHeader, toResponse } from "./delivery.js";
-import { MAX_TIMESTAMP_SKEW_SECONDS, verifyQueekSignature, WEBHOOK_ID_HEADER, WEBHOOK_SIGNATURE_HEADER, WEBHOOK_TIMESTAMP_HEADER, } from "./signatures.js";
+import { decodeBody, readHeader, reportDeliveryFailure, toResponse, } from "./delivery.js";
+import { isFreshTimestamp, MAX_TIMESTAMP_SKEW_SECONDS, verifyQueekSignature, WEBHOOK_ID_HEADER, WEBHOOK_SIGNATURE_HEADER, WEBHOOK_TIMESTAMP_HEADER, } from "./signatures.js";
 /**
- * Framework-agnostic receiver for Queek topic deliveries
- * (`DeliverWebhookJob` in queek_backend, one signed POST per installation
- * endpoint) in three thin layers: layer 1
+ * Framework-agnostic receiver for Queek topic deliveries (one signed POST
+ * per installation endpoint) in three thin layers: layer 1
  * `handleWebhookDelivery(input, options)` takes plain data (untouched body
  * bytes + headers) and returns a plain `{ status, body }` result — zero
  * request/response types, so whatever request object each framework
@@ -23,7 +22,7 @@ import { MAX_TIMESTAMP_SKEW_SECONDS, verifyQueekSignature, WEBHOOK_ID_HEADER, WE
  * installations per app are few). Apps that carry their own routing hint
  * may pass `resolveSecret` instead.
  *
- * Dedupe: Queek retries a delivery for ~4h until it sees 2xx, so every
+ * Dedupe: Queek retries a delivery until it sees 2xx, so every
  * `webhook-id` is processed AT MOST once — the header id is claimed
  * atomically up front (exactly one concurrent same-id delivery runs the
  * handler) and a repeat answers 200 WITHOUT re-running it. A throwing
@@ -62,6 +61,25 @@ async function defaultResolveSecret(store, rawBody, headers, envelope) {
  * Layer 1: handle one signed Queek topic delivery from plain data — no
  * `Request`, no framework. Same options, same behaviour, same
  * errors/status codes at every layer.
+ *
+ * Answers 401 for a missing header, an unknown installation, a stale
+ * timestamp or a bad signature; 400 for a body that is not a JSON envelope;
+ * 200 for a handled, repeated or unhandled-topic delivery; 500 when your
+ * handler throws (the claim is released so Queek's retry can land).
+ *
+ * @example
+ * const result = await handleWebhookDelivery(
+ *   { rawBody, headers },
+ *   {
+ *     store,
+ *     handlers: {
+ *       "orders/updated": async (envelope, { installation }) => {
+ *         await syncOrder(installation.installationId, envelope.data);
+ *       },
+ *     },
+ *   },
+ * );
+ * // reply with result.status and result.body
  */
 export async function handleWebhookDelivery(input, options) {
     const maxSkew = options.maxSkewSeconds ?? MAX_TIMESTAMP_SKEW_SECONDS;
@@ -95,8 +113,7 @@ export async function handleWebhookDelivery(input, options) {
     // lookup above deliberately skips it so a stale delivery cannot be
     // misattributed before it is rejected.
     const now = options.nowSeconds ?? Math.floor(Date.now() / 1000);
-    const ts = Number(timestamp);
-    if (!Number.isFinite(ts) || Math.abs(now - ts) > maxSkew) {
+    if (!isFreshTimestamp(timestamp, now, maxSkew)) {
         return { status: 401, body: { ok: false, error: "stale timestamp" } };
     }
     // Freshness was enforced above; this re-checks the MAC only, so a
@@ -124,8 +141,9 @@ export async function handleWebhookDelivery(input, options) {
     try {
         await handler(envelope, { installation, topic, eventId: id });
     }
-    catch {
+    catch (error) {
         await options.store.releaseWebhookId(id);
+        reportDeliveryFailure(options.onError, error, { stage: "webhook", eventId: id, topic });
         return { status: 500, body: { ok: false, error: "handler_failed" } };
     }
     return { status: 200, body: { ok: true } };
@@ -144,4 +162,3 @@ export async function handleWebhookRequest(request, options) {
         headers: request.headers,
     }, options));
 }
-//# sourceMappingURL=webhooks.js.map

package/package.json

@@ -1,17 +1,33 @@
 {
   "name": "@usequeek/app-sdk",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "private": false,
   "license": "MIT",
-  "description": "SDK for Queek installable apps: webhook signature verification, install handlers, typed Merchant API client, webhook dispatch, encrypted installation store.",
+  "author": "Queekx Technology LTD",
+  "description": "SDK for Queek apps: signed install and webhook handlers, a typed Merchant API client with retries and pagination, installation tokens and an encrypted installation store.",
+  "keywords": [
+    "queek",
+    "queek-app",
+    "merchant-api",
+    "webhooks",
+    "webhook-signature",
+    "commerce",
+    "sdk",
+    "typescript"
+  ],
   "repository": {
     "type": "git",
     "url": "git+https://github.com/usequeek/app-sdk.git"
   },
+  "bugs": {
+    "url": "https://github.com/usequeek/app-sdk/issues"
+  },
+  "homepage": "https://docs.usequeek.com/docs/apps/sdk",
   "publishConfig": {
     "access": "public"
   },
   "type": "module",
+  "sideEffects": false,
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -46,7 +62,7 @@
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "typecheck:tests": "tsc --noEmit -p tsconfig.tests.json",
     "lint": "biome check .",
-    "test": "vitest run",
+    "test": "node scripts/check-public-text.mjs && node --test scripts/check-public-text.test.mjs && vitest run",
     "verify-package": "node scripts/verify-package.mjs",
     "gen:merchant": "node scripts/gen-merchant-types.mjs",
     "check:merchant-snapshot": "node scripts/check-merchant-snapshot.mjs",
@@ -70,13 +86,14 @@
     "@types/pg": "^8.23.1",
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
+    "esbuild": "0.28.2",
     "hono": "4.13.9",
     "jsdom": "^28.1.0",
     "openapi-typescript": "7.13.0",
     "react": "^19.3.0",
     "react-dom": "^19.3.0",
     "typescript": "5.9.3",
-    "vitest": "3.2.4"
+    "vitest": "4.1.11"
   },
   "engines": {
     "node": ">=22.14"

package/dist/app-auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"app-auth.d.ts","sourceRoot":"","sources":["../src/app-auth.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AAQH,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AACpD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAC1D,+EAA+E;AAC/E,eAAO,MAAM,0BAA0B,0BAA0B,CAAC;AAClE;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AACxE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AACtD,qDAAqD;AACrD,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAC1D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAE5D,wEAAwE;AACxE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEnE;AAED,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEjE;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEpE;AAED,sGAAsG;AACtG,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEvE;AAED,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAElE;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AACtD,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AACtD,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAE5D;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAMhF;AAED,mFAAmF;AACnF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAErF;AAMD,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,gGAAgG;AAChG,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,oGAAoG;AACpG,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C,yFAAyF;AACzF,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,mGAAmG;AACnG,eAAO,MAAM,oBAAoB,MAAM,CAAC;AACxC,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,OAAQ,CAAC;AACzC,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,OAAQ,CAAC;AAMzC,0FAA0F;AAC1F,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,4BAA4B;gBAE7B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,qBAAqB;IAClC,QAAQ,CAAC,MAAM,EAAE,OAAO,mBAAmB,GAAG,OAAO,sBAAsB,CAAC;gBAEhE,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM;CAKjE;AAED,gEAAgE;AAChE,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,0BAA0B;gBAE3B,cAAc,EAAE,MAAM;CAInC;AAED,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAC;IACd,kGAAkG;IAClG,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,mFACgD,CAAC;AAEnF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAYzD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,oBAAyB,GAAG,aAAa,CAqCnF;AAMD,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,aAAa,CAAC;IAC1B,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAkB7D"}

package/dist/app-auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"app-auth.js","sourceRoot":"","sources":["../src/app-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE3D;;;;;;;;;;;GAWG;AAEH,8EAA8E;AAC9E,0EAA0E;AAC1E,2EAA2E;AAC3E,4BAA4B;AAC5B,8EAA8E;AAE9E,wFAAwF;AACxF,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AACpD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAC1D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AAClE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AACxE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AACtD,qDAAqD;AACrD,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAC1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE5D,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACxD,OAAO,IAAI,KAAK,sBAAsB,CAAC;AACzC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,IAAwB;IACtD,OAAO,IAAI,KAAK,mBAAmB,CAAC;AACtC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,OAAO,IAAI,KAAK,0BAA0B,CAAC;AAC7C,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,OAAO,IAAI,KAAK,6BAA6B,CAAC;AAChD,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,gBAAgB,CAAC,IAAwB;IACvD,OAAO,IAAI,KAAK,oBAAoB,CAAC;AACvC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AACtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AACtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,IAAwB;IACrE,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,CACL,MAAM,KAAK,GAAG;QACd,CAAC,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,uBAAuB,CAAC,CACrG,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,IAAwB;IAC1E,OAAO,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,uBAAuB,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,4DAA4D;AAC5D,8EAA8E;AAE9E,iFAAiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,gGAAgG;AAChG,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,oGAAoG;AACpG,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAC/C,yFAAyF;AACzF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,mGAAmG;AACnG,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACxC,wFAAwF;AACxF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AACzC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAEzC,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,0FAA0F;AAC1F,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,GAAG,wBAAwB,CAAC;IAEzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,GAAG,iBAAiB,CAAC;IACzB,MAAM,CAA6D;IAE5E,YAAY,MAAoC,EAAE,MAAc;QAC9D,KAAK,CAAC,mBAAmB,MAAM,MAAM,MAAM,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,IAAI,GAAG,sBAAsB,CAAC;IAEvC,YAAY,cAAsB;QAChC,KAAK,CAAC,wBAAwB,cAAc,6CAA6C,CAAC,CAAC;QAC3F,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAkBD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,gFAAgF,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACrC,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,yBAAyB,CACjC,+EAA+E,qBAAqB,GAAG,CACxG,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAgC,EAAE;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,yBAAyB,CACjC,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,yBAAyB,CACjC,0GAA0G,CAC3G,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpF,IAAI,eAAe,KAAK,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,yBAAyB,CACjC,0GAA0G,qBAAqB,GAAG,CACnI,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;YACpC,MAAM,IAAI,yBAAyB,CACjC,mDAAmD,GAAG,CAAC,iBAAiB,IAAI,SAAS,aAAa,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,yBAAyB;YAAE,MAAM,KAAK,CAAC;QAC5D,MAAM,IAAI,yBAAyB,CACjC,6DAA6D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,sBAAsB,qBAAqB,GAAG,CAClK,CAAC;IACJ,CAAC;IACD,oEAAoE;IACpE,gEAAgE;IAChE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,SAAS,CAAC,KAAsB;IACvC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC5D,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,OAA0B;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,GAAG,GAAG,oBAAoB,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,GAAG,mBAAmB,CAAC;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACtG,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACzF,MAAM,YAAY,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;IAC5C,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACpC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,yBAAyB,CACjC,+EAA+E,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAC1L,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,YAAY,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC9D,CAAC"}

package/dist/auth-fetch.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-fetch.d.ts","sourceRoot":"","sources":["../src/auth-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAgC,MAAM,YAAY,CAAC;AAEvG;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAEhD,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,iEAAiE;IACjE,eAAe,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,+HAA+H;IAC/H,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChF,kFAAkF;IAClF,UAAU,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAChC,iFAAiF;IACjF,KAAK,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9B,kEAAkE;IAClE,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,6CAA6C;IAC7C,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAeD,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,MAA2B,GAAG,MAAM,GAAG,IAAI,CAO/F;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,MAA2B,GAAG,MAAM,GAAG,IAAI,CAWhG;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,GAAG,aAAa,CAqNzE"}