@assembly-js/app-foundation 0.0.0 → 0.0.1-rc.1

package/dist/api-errors.d.ts

@@ -0,0 +1,5 @@
+import { NextResponse } from 'next/server';
+export declare function badRequest(message: string): NextResponse;
+export declare function notFound(message?: string): NextResponse;
+export declare function internalError(message?: string): NextResponse;
+export declare function handleRouteError(err: unknown, fallback?: string): NextResponse;

package/dist/api-errors.js

@@ -0,0 +1,33 @@
+import { NextResponse } from 'next/server';
+export function badRequest(message) {
+    return NextResponse.json({ error: message }, { status: 400 });
+}
+export function notFound(message = 'Not found') {
+    return NextResponse.json({ error: message }, { status: 404 });
+}
+export function internalError(message = 'Something went wrong') {
+    return NextResponse.json({ error: message }, { status: 500 });
+}
+// Postgres 22P02 — invalid_text_representation (e.g. "foo" against a uuid column).
+const INVALID_INPUT_PG_CODE = '22P02';
+function isInvalidInputDbError(err) {
+    if (!err || typeof err !== 'object')
+        return false;
+    const e = err;
+    if (e.code === INVALID_INPUT_PG_CODE)
+        return true;
+    if (typeof e.message === 'string' && e.message.includes('invalid input syntax for type uuid')) {
+        return true;
+    }
+    return false;
+}
+// Map known DB failures to safe client responses. Log the real error server-side;
+// never return err.message from a catch block — Postgres and driver strings leak
+// to the UI when handlers do that.
+export function handleRouteError(err, fallback = 'Something went wrong') {
+    console.error(err);
+    if (isInvalidInputDbError(err)) {
+        return badRequest('Invalid request');
+    }
+    return internalError(fallback);
+}

package/dist/app-storage.d.ts

@@ -0,0 +1,7 @@
+export declare function getUploadUrl(fileName: string): Promise<{
+    key: string;
+    uploadUrl: string;
+}>;
+export declare function getDownloadUrl(key: string): Promise<{
+    downloadUrl: string;
+}>;

package/dist/app-storage.js

@@ -0,0 +1,22 @@
+import { getAssembly } from './assembly';
+// fileName must be a bare file name (e.g. 'invoice.pdf'), never a path:
+// the platform rejects any value containing '/' or '..'. Do NOT prefix
+// folders or construct the S3 key yourself — the platform scopes the key
+// to the workspace and makes it unique. Store the key it returns.
+export async function getUploadUrl(fileName) {
+    const assembly = await getAssembly();
+    const res = await assembly.fetch('/v1/app-storage/upload-url', {
+        method: 'POST',
+        body: JSON.stringify({ fileName }),
+    });
+    if (!res.ok)
+        throw new Error('Upload URL request failed: ' + res.status);
+    return res.json();
+}
+export async function getDownloadUrl(key) {
+    const assembly = await getAssembly();
+    const res = await assembly.fetch('/v1/app-storage/download-url?key=' + encodeURIComponent(key));
+    if (!res.ok)
+        throw new Error('Download URL request failed: ' + res.status);
+    return res.json();
+}

package/dist/assembly.d.ts

@@ -0,0 +1,49 @@
+import { type AssemblyAPI } from '@assembly-js/node-sdk';
+import { NextRequest, NextResponse } from 'next/server';
+import { type ExchangedSession } from './session-exchange';
+type AssemblyInput = {
+    token?: string;
+} | string | undefined;
+export declare function getSessionIdentity(): Promise<ExchangedSession | null>;
+/**
+ * Thrown when a session token is required but missing, or was supplied but
+ * could not be decoded (almost always expiry or truncation). Enforced here in
+ * the foundation (rather than the SDK) so a missing or bad token never yields a
+ * client that silently falls back to the bare, unscoped workspace API key.
+ * Recognizable by `name`/`code` in `lib/auth.ts` (same-server, pre-redaction);
+ * across the Server Action boundary in production those are redacted, so
+ * `assembly-context.tsx` recovers via re-exchange-on-any-error rather than by
+ * matching this error.
+ */
+export declare class TokenInvalidError extends Error {
+    readonly code = "TOKEN_INVALID";
+    constructor(message?: string);
+}
+export declare function getAssembly(input?: AssemblyInput): Promise<AssemblyAPI>;
+/**
+ * OFFLINE / BACKGROUND ONLY — cron jobs, webhook handlers, and any other code
+ * path where there is NO user in the loop and thus no session token or bearer
+ * cookie to read. Do NOT use this for user-facing requests; those resolve the
+ * viewer's own bearer via {@link getAssembly} / {@link getAssemblyForRequest}.
+ *
+ * Mints a short-lived, APP-scoped bearer from the app API key alone (client-
+ * credentials) and returns a bearer-only SDK client: the bearer is sent as
+ * `Authorization: Bearer` on every call and NO X-API-Key is ever sent. The app
+ * key is used solely to mint the bearer — it never travels on a data call.
+ *
+ * Throws (rather than returning null) on a missing app key or a failed mint:
+ * this is server-side background code, so there is no client to re-exchange and
+ * proceeding without a credential would be a silent failure.
+ *
+ * @example
+ *   // app/api/cron/digest/route.ts (Vercel cron / webhook handler)
+ *   export async function GET() {
+ *     const assembly = await getOfflineAssembly();
+ *     const clients = await assembly.listClients();
+ *     // …send the digest…
+ *     return Response.json({ ok: true });
+ *   }
+ */
+export declare function getOfflineAssembly(): Promise<AssemblyAPI>;
+export declare function getAssemblyForRequest(req: NextRequest): Promise<AssemblyAPI | NextResponse>;
+export {};

package/dist/assembly.js

@@ -0,0 +1,235 @@
+import { assemblyApi } from '@assembly-js/node-sdk';
+import { cookies, headers } from 'next/headers';
+import { NextResponse } from 'next/server';
+import { BEARER_COOKIE_NAME, BEARER_HEADER_NAME, decodeBearer, isSessionExchangeEnabled, } from './session-exchange';
+import { mintBearerFromAppKey } from './mint-bearer';
+// Trusted API origin for this stack, supplied by the build environment — NOT by
+// a token claim. Empty in prod/shared-staging (the SDK's env default is already
+// correct); set to a per-dev private stack's platform-api URL otherwise. Passed
+// to the SDK as `baseUrl` so tokenless (cookie-only) calls reach the right stack.
+const trustedBaseUrl = process.env.ASSEMBLY_API_BASE_URL || undefined;
+// Reads the viewer bearer for the current request, independent of the exchange
+// flag. First the header the proxy forwards on first load (the exchange just
+// minted it; the Set-Cookie isn't yet visible), then the HttpOnly cookie on every
+// later request. Returns undefined outside a request scope (e.g. build-time
+// prerender) — not an error. Used both to resolve identity and, in
+// getOfflineAssembly, to detect that a viewer is present.
+async function readViewerBearer() {
+    try {
+        const fromProxy = (await headers()).get(BEARER_HEADER_NAME);
+        if (fromProxy && decodeBearer(fromProxy))
+            return fromProxy;
+        const fromCookie = (await cookies()).get(BEARER_COOKIE_NAME)?.value;
+        if (fromCookie && decodeBearer(fromCookie))
+            return fromCookie;
+    }
+    catch {
+        return undefined;
+    }
+    return undefined;
+}
+// Viewer bearer for request-scoped auth: only consulted when the exchange flow is
+// on (the legacy path carries identity in proxy headers, not a bearer cookie).
+async function resolveRequestBearer() {
+    if (!isSessionExchangeEnabled())
+        return undefined;
+    return readViewerBearer();
+}
+// Legacy (exchange-off) viewer signals. Route handlers carry the raw session
+// token; the proxy stamps the workspace id onto every resolved legacy render.
+// Both are absent in true offline/background contexts (cron, webhooks).
+const LEGACY_TOKEN_HEADER = 'x-assembly-token';
+const LEGACY_WORKSPACE_HEADER = 'x-assembly-workspace-id';
+// True when the current request carries viewer identity in EITHER auth mode.
+// Exchange path: the mere PRESENCE of the bearer header/cookie — even a stale or
+// undecodable one — marks a user-triggered request, so the guard must reject it
+// rather than fall through to the app-scoped mint (decoding is not required here;
+// only detecting that a viewer credential accompanied the request). Legacy path:
+// the session-token header or the proxy-injected workspace-id header. Returns
+// false outside a request scope (e.g. cron/webhook), where headers() throws. Used
+// by getOfflineAssembly to refuse to run inside a user-facing request regardless
+// of which auth mode the app is built with.
+async function hasViewerRequest() {
+    try {
+        const [requestHeaders, requestCookies] = await Promise.all([
+            headers(),
+            cookies(),
+        ]);
+        return Boolean(requestHeaders.get(BEARER_HEADER_NAME) ||
+            requestCookies.get(BEARER_COOKIE_NAME)?.value ||
+            requestHeaders.get(LEGACY_TOKEN_HEADER) ||
+            requestHeaders.get(LEGACY_WORKSPACE_HEADER));
+    }
+    catch {
+        return false;
+    }
+}
+// Server-only: the current user's identity, resolved from the bearer (the
+// proxy-forwarded header on first load, else the HttpOnly cookie). This is how
+// the app learns who the viewer is — workspace, client/company, internal user —
+// without ever handling the raw session token. Used to seed the client provider
+// and by server components. Returns null when unauthenticated or when the
+// exchange is disabled (the legacy path carries identity in proxy headers).
+export async function getSessionIdentity() {
+    const bearer = await resolveRequestBearer();
+    return bearer ? decodeBearer(bearer) : null;
+}
+/**
+ * Thrown when a session token is required but missing, or was supplied but
+ * could not be decoded (almost always expiry or truncation). Enforced here in
+ * the foundation (rather than the SDK) so a missing or bad token never yields a
+ * client that silently falls back to the bare, unscoped workspace API key.
+ * Recognizable by `name`/`code` in `lib/auth.ts` (same-server, pre-redaction);
+ * across the Server Action boundary in production those are redacted, so
+ * `assembly-context.tsx` recovers via re-exchange-on-any-error rather than by
+ * matching this error.
+ */
+export class TokenInvalidError extends Error {
+    code = 'TOKEN_INVALID';
+    constructor(message = 'Assembly session token is invalid or expired') {
+        super(message);
+        this.name = 'TokenInvalidError';
+    }
+}
+export async function getAssembly(input) {
+    const token = typeof input === 'string' ? input : input?.token;
+    // Exchange enabled ⇒ this is a bearer-capable app, and it authenticates via
+    // the exchanged bearer ALONE. The raw session token is a one-time bootstrap
+    // credential the proxy already consumed for the cookie; it is never a request
+    // credential here (any `input` token is ignored). The SDK is initialised with
+    // the bearer only — no apiKey, no token — so every call carries
+    // `Authorization: Bearer` and NEVER an X-API-Key. No bearer means the request
+    // is unauthenticated, or is replaying a consumed token that still decrypts —
+    // either way refuse, so the client re-exchanges instead of rendering.
+    if (isSessionExchangeEnabled()) {
+        const bearer = await resolveRequestBearer();
+        if (!bearer) {
+            throw new TokenInvalidError('Assembly bearer is required');
+        }
+        const assembly = await assemblyApi({ bearer, baseUrl: trustedBaseUrl });
+        const payload = await assembly.getTokenPayload?.();
+        if (!payload?.workspaceId) {
+            throw new TokenInvalidError();
+        }
+        // The published SDK's bearer-mode payload maps only the identity claims,
+        // so overlay the embed-context claims here to keep getTokenPayload()'s
+        // documented contract (payload.notificationId marks the Notification
+        // Center surface) intact for exchange-capable apps. Becomes a harmless
+        // no-op once the SDK maps these claims natively.
+        const session = decodeBearer(bearer);
+        if (session?.notificationId || session?.instanceId) {
+            const merged = {
+                ...payload,
+                notificationId: session.notificationId,
+                instanceId: session.instanceId,
+            };
+            assembly.getTokenPayload = () => Promise.resolve(merged);
+        }
+        return assembly;
+    }
+    // Exchange disabled (legacy apps built before this feature, or a rollback):
+    // the raw session token is the credential and is sent as X-API-Key, exactly
+    // as before. A generated app has no valid unauthenticated call, so a missing
+    // token is invalid — never let the SDK fall back to the bare, unscoped
+    // workspace API key.
+    if (!token) {
+        throw new TokenInvalidError('Assembly session token is required');
+    }
+    const assembly = await assemblyApi({
+        apiKey: process.env.ASSEMBLY_API_KEY ?? '',
+        token,
+        baseUrl: trustedBaseUrl,
+    });
+    const payload = await assembly.getTokenPayload?.();
+    if (!payload?.workspaceId) {
+        throw new TokenInvalidError();
+    }
+    return assembly;
+}
+// Duplicated from lib/auth.ts to avoid a circular import.
+function tokenExpiredResponse() {
+    return NextResponse.json({ error: 'Unauthorized', code: 'token_expired' }, { status: 401, headers: { 'x-assembly-token-expired': '1' } });
+}
+// Builds a bearer-only SDK client. The SDK's native `bearer` option sends
+// Authorization: Bearer on every request — generated service methods and fetch
+// alike — and, with no apiKey supplied, sends NO X-API-Key. Identity comes from
+// the bearer's own signed claims (getTokenPayload() reads them); the API origin
+// comes from the trusted build-env baseUrl, never a token/bearer claim.
+async function getBearerAssembly(bearer) {
+    return assemblyApi({ bearer, baseUrl: trustedBaseUrl });
+}
+/**
+ * OFFLINE / BACKGROUND ONLY — cron jobs, webhook handlers, and any other code
+ * path where there is NO user in the loop and thus no session token or bearer
+ * cookie to read. Do NOT use this for user-facing requests; those resolve the
+ * viewer's own bearer via {@link getAssembly} / {@link getAssemblyForRequest}.
+ *
+ * Mints a short-lived, APP-scoped bearer from the app API key alone (client-
+ * credentials) and returns a bearer-only SDK client: the bearer is sent as
+ * `Authorization: Bearer` on every call and NO X-API-Key is ever sent. The app
+ * key is used solely to mint the bearer — it never travels on a data call.
+ *
+ * Throws (rather than returning null) on a missing app key or a failed mint:
+ * this is server-side background code, so there is no client to re-exchange and
+ * proceeding without a credential would be a silent failure.
+ *
+ * @example
+ *   // app/api/cron/digest/route.ts (Vercel cron / webhook handler)
+ *   export async function GET() {
+ *     const assembly = await getOfflineAssembly();
+ *     const clients = await assembly.listClients();
+ *     // …send the digest…
+ *     return Response.json({ ok: true });
+ *   }
+ */
+export async function getOfflineAssembly() {
+    // Boundary: refuse to run inside a user request that carries viewer identity,
+    // in EITHER auth mode — the exchange bearer OR legacy request identity. The
+    // app-scoped bearer acts as the app/installer, so using it on a user-facing
+    // path would bypass the viewer's own scoped claims. User-facing routes must use
+    // getAssembly() / getAssemblyForRequest() instead.
+    if (await hasViewerRequest()) {
+        throw new Error('getOfflineAssembly must not be called within a user request (viewer identity is present); use getAssembly() or getAssemblyForRequest() for user-facing routes');
+    }
+    if (!process.env.ASSEMBLY_API_KEY) {
+        throw new Error('getOfflineAssembly: ASSEMBLY_API_KEY is not set — cannot mint an app-scoped bearer');
+    }
+    const minted = await mintBearerFromAppKey();
+    if (!minted) {
+        throw new Error('getOfflineAssembly: failed to mint an app-scoped bearer from the app API key');
+    }
+    return getBearerAssembly(minted.bearer);
+}
+// Returns a request-scoped SDK client authenticated for the current user.
+//
+// Exchange enabled: bearer-only. A valid bearer (proxy header or cookie) yields
+// a client that carries Authorization: Bearer on every request; a missing or
+// undecodable bearer yields a 401 NextResponse so the client re-exchanges via
+// the x-assembly-token-expired convention. There is no session-token fallback.
+// Exchange disabled: the legacy session-token (X-API-Key) path.
+export async function getAssemblyForRequest(req) {
+    if (isSessionExchangeEnabled()) {
+        // Bearer-only: the proxy-forwarded header on first load, else the HttpOnly
+        // cookie. Its signed claims carry identity for SDK init. No bearer (or an
+        // undecodable/expired one) ⇒ 401 marker so the client re-exchanges; there
+        // is no X-API-Key / session-token fallback for a bearer-capable app.
+        const bearer = req.headers.get(BEARER_HEADER_NAME) ??
+            req.cookies.get(BEARER_COOKIE_NAME)?.value;
+        if (!bearer || !decodeBearer(bearer)) {
+            return tokenExpiredResponse();
+        }
+        return getBearerAssembly(bearer);
+    }
+    // Legacy (exchange disabled): authenticate from the session-token header,
+    // sent as X-API-Key. Missing token ⇒ 401 marker.
+    const headerToken = req.headers.get('x-assembly-token');
+    if (!headerToken) {
+        return tokenExpiredResponse();
+    }
+    try {
+        return await getAssembly(headerToken);
+    }
+    catch {
+        return tokenExpiredResponse();
+    }
+}

package/dist/auth.d.ts

@@ -0,0 +1,17 @@
+import type { AssemblyAPI } from '@assembly-js/node-sdk';
+import { NextRequest, NextResponse } from 'next/server';
+export interface TokenPayload {
+    workspaceId: string;
+    internalUserId?: string;
+    clientId?: string;
+    companyId?: string;
+    notificationId?: string;
+    instanceId?: string;
+    baseUrl?: string;
+    tokenId?: string;
+}
+export declare function requireAuth(req: NextRequest): Promise<TokenPayload | NextResponse>;
+export declare function requireCompanyScope(payload: TokenPayload, resource: {
+    companyId: string | null;
+    clientId?: string | null;
+}, tokenOrAssembly?: string | AssemblyAPI): Promise<NextResponse | null>;

package/dist/auth.js

@@ -0,0 +1,118 @@
+import { NextResponse } from 'next/server';
+import { getAssembly } from './assembly';
+import { BEARER_COOKIE_NAME, BEARER_HEADER_NAME, decodeBearer, isSessionExchangeEnabled, } from './session-exchange';
+// Detect an expired/undecryptable-token error from the SDK by shape rather than
+// by importing a concrete class — the foundation builds against whatever SDK
+// version is published, which may not export the error type.
+function isTokenInvalid(err) {
+    if (!err || typeof err !== 'object')
+        return false;
+    const e = err;
+    return e.name === 'TokenInvalidError' || e.code === 'TOKEN_INVALID';
+}
+function tokenExpiredResponse() {
+    return NextResponse.json({ error: 'Unauthorized', code: 'token_expired' }, { status: 401, headers: { 'x-assembly-token-expired': '1' } });
+}
+// Resolves the current viewer's identity for a route handler.
+// Exchange on: bearer-only — decodes the bearer (proxy-forwarded header on first
+// load, else the HttpOnly cookie); a missing/undecodable bearer returns a 401
+// with the x-assembly-token-expired marker so the client re-exchanges. There is
+// no session-token fallback for a bearer-capable app.
+// Exchange off (legacy): reads and decodes the x-assembly-token header.
+export async function requireAuth(req) {
+    if (isSessionExchangeEnabled()) {
+        const bearer = req.headers.get(BEARER_HEADER_NAME) ??
+            req.cookies.get(BEARER_COOKIE_NAME)?.value;
+        const session = bearer ? decodeBearer(bearer) : null;
+        if (!session) {
+            return tokenExpiredResponse();
+        }
+        return {
+            workspaceId: session.workspaceId,
+            clientId: session.clientId,
+            internalUserId: session.internalUserId,
+            companyId: session.companyId,
+            notificationId: session.notificationId,
+            instanceId: session.instanceId,
+        };
+    }
+    const token = req.headers.get('x-assembly-token');
+    if (!token) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+    try {
+        const assembly = await getAssembly(token);
+        // getTokenPayload is optional on the SDK instance; a falsy payload means
+        // the token didn't resolve — treat it as expired/invalid.
+        const payload = await assembly.getTokenPayload?.();
+        if (!payload) {
+            return tokenExpiredResponse();
+        }
+        if (!payload.workspaceId) {
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+        return payload;
+    }
+    catch (err) {
+        if (isTokenInvalid(err)) {
+            return tokenExpiredResponse();
+        }
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+}
+// Asserts the viewer can access a resource scoped to a company OR to a client.
+// Internal users always pass. For a company-scoped resource (companyId set),
+// clients must belong to that company: if payload.companyId is present it must
+// match; otherwise membership is confirmed by fetching the client record.
+// For a client-scoped resource (companyId null), pass the resource's clientId
+// so the owning client can be matched against the viewer — without it a
+// client-scoped record 404s for the very client it is assigned to.
+// Pass a session token string (legacy path) or a bearer-authenticated AssemblyAPI
+// instance from getAssemblyForRequest (bearer path) to enable the membership lookup.
+// Returns null on success, or a 403/404 NextResponse on mismatch.
+export async function requireCompanyScope(payload, resource, tokenOrAssembly) {
+    if (payload.internalUserId)
+        return null;
+    if (!payload.clientId) {
+        return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
+    }
+    if (!resource.companyId) {
+        // Client-scoped resource: the viewer passes iff it is theirs.
+        return resource.clientId && resource.clientId === payload.clientId
+            ? null
+            : NextResponse.json({ error: 'Not found' }, { status: 404 });
+    }
+    if (payload.companyId) {
+        return payload.companyId === resource.companyId
+            ? null
+            : NextResponse.json({ error: 'Not found' }, { status: 404 });
+    }
+    // No companyId in payload: client has multiple companies, verify membership.
+    if (!tokenOrAssembly) {
+        return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
+    }
+    try {
+        // Bearer path: pass the bearer-authenticated client from getAssemblyForRequest.
+        // Legacy (exchange-off) path: pass the session token string, from which we
+        // build the client. Either way a service method authenticates correctly —
+        // the SDK sends Authorization: Bearer (or the legacy X-API-Key) on every call.
+        const assembly = typeof tokenOrAssembly === 'string'
+            ? await getAssembly(tokenOrAssembly)
+            : tokenOrAssembly;
+        const client = await assembly.retrieveClient({ id: payload.clientId });
+        const ids = client.companyIds ?? (client.companyId ? [client.companyId] : []);
+        return ids.includes(resource.companyId)
+            ? null
+            : NextResponse.json({ error: 'Not found' }, { status: 404 });
+    }
+    catch (err) {
+        // Distinguish 'client not found' from infrastructure failures so callers
+        // can retry on 500 rather than treating every error as a permanent 404.
+        // Propagate 401 as a token-expired signal so the client can re-exchange
+        // rather than receiving a confusing 500.
+        const status = typeof err === 'object' && err !== null ? err.status : undefined;
+        if (status === 401)
+            return tokenExpiredResponse();
+        return NextResponse.json({ error: status === 404 ? 'Not found' : 'Internal server error' }, { status: status === 404 ? 404 : 500 });
+    }
+}

package/dist/client-companies.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Expands clients into one row per company so each duplicated row can carry its
+ * own `AvatarSub` company badge.
+ *
+ * Generic over the caller's row type because callers render reshaped client
+ * records (joined, picked, extended) rather than raw SDK objects; the constraint
+ * names the only field this reads.
+ *
+ * `displayCompanyId` is null for clients with 0 or 1 companies: a single
+ * membership needs no disambiguation, so those rows render without a badge.
+ */
+export declare function expandClientsByCompany<T extends {
+    companyIds?: string[];
+}>(clients: T[]): Array<T & {
+    displayCompanyId: string | null;
+}>;

package/dist/client-companies.js

@@ -0,0 +1,23 @@
+/**
+ * Expands clients into one row per company so each duplicated row can carry its
+ * own `AvatarSub` company badge.
+ *
+ * Generic over the caller's row type because callers render reshaped client
+ * records (joined, picked, extended) rather than raw SDK objects; the constraint
+ * names the only field this reads.
+ *
+ * `displayCompanyId` is null for clients with 0 or 1 companies: a single
+ * membership needs no disambiguation, so those rows render without a badge.
+ */
+export function expandClientsByCompany(clients) {
+    return clients.flatMap((client) => {
+        const companyIds = client.companyIds ?? [];
+        if (companyIds.length < 2) {
+            return [{ ...client, displayCompanyId: null }];
+        }
+        return companyIds.map((companyId) => ({
+            ...client,
+            displayCompanyId: companyId,
+        }));
+    });
+}

package/dist/client.d.ts

@@ -1,2 +1,5 @@
-/** Version of this package, for provenance checks in the sandbox. */
-export declare const APP_FOUNDATION_VERSION = "0.0.0";
+export * from './session-exchange';
+export * from './network-capture';
+export * from './client-companies';
+export * from './theme';
+export * from './resource-resolution';

package/dist/client.js

@@ -1,6 +1,17 @@
 // Client-safe entry point: modules here must never touch secrets or
 // `next/headers`, because they can be pulled into a browser bundle.
 //
-// Empty for now — see ./server.ts.
-/** Version of this package, for provenance checks in the sandbox. */
-export const APP_FOUNDATION_VERSION = '0.0.0';
+// `session-exchange` qualifies despite reading `process.env`: the read is a
+// string compare against a build-time-inlined flag rather than a secret, and its
+// JWT decode is written on Web APIs only (atob/TextDecoder) so the same module
+// also runs in the Edge middleware runtime that proxy.ts uses.
+export * from './session-exchange';
+export * from './network-capture';
+export * from './client-companies';
+export * from './theme';
+// Pure data-shaping over resolver responses — no imports, no secrets, no
+// next/headers. It lives here rather than in ./server because <ResourcePicker>
+// is a 'use client' component: today it imports only the types, which are erased
+// at compile time, but a value import from ./server would trip the server-only
+// guard for no reason.
+export * from './resource-resolution';

package/dist/labels.d.ts

@@ -0,0 +1,9 @@
+export interface WorkspaceLabels {
+    clientOne: string;
+    clientMany: string;
+    companyOne: string;
+    companyMany: string;
+}
+declare const DEFAULTS: WorkspaceLabels;
+export declare function getLabels(): Promise<WorkspaceLabels>;
+export { DEFAULTS as DEFAULT_LABELS };

package/dist/labels.js

@@ -0,0 +1,17 @@
+import { headers } from 'next/headers';
+const DEFAULTS = {
+    clientOne: 'Client',
+    clientMany: 'Clients',
+    companyOne: 'Company',
+    companyMany: 'Companies',
+};
+export async function getLabels() {
+    const hdrs = await headers();
+    return {
+        clientOne: hdrs.get('x-assembly-label-client-one') || DEFAULTS.clientOne,
+        clientMany: hdrs.get('x-assembly-label-client-many') || DEFAULTS.clientMany,
+        companyOne: hdrs.get('x-assembly-label-company-one') || DEFAULTS.companyOne,
+        companyMany: hdrs.get('x-assembly-label-company-many') || DEFAULTS.companyMany,
+    };
+}
+export { DEFAULTS as DEFAULT_LABELS };

package/dist/mint-bearer.d.ts

@@ -0,0 +1,18 @@
+import { type ExchangedSession, type MintFailure } from './session-exchange';
+export interface MintedBearer {
+    bearer: string;
+    bearerExpiresAt: number;
+    session: ExchangedSession;
+}
+export type MintOutcome = ({
+    ok: true;
+} & MintedBearer) | {
+    ok: false;
+    reason: MintFailure;
+};
+export declare function mintBearerFromSessionToken(token: string): Promise<MintOutcome>;
+export interface MintedAppBearer {
+    bearer: string;
+    bearerExpiresAt: number;
+}
+export declare function mintBearerFromAppKey(): Promise<MintedAppBearer | null>;