@cboxdk/id-js 0.18.0 → 0.20.0

package/dist/index.cjs

@@ -174,6 +174,7 @@ function assertSecureIssuer(issuer) {
 }
 
 // src/frontend.ts
+var SECOND_FACTOR_KINDS = /* @__PURE__ */ new Set(["totp", "sms", "recovery_code"]);
 var CboxIdFrontend = class {
   issuer;
   publishableKey;
@@ -188,7 +189,7 @@ var CboxIdFrontend = class {
    * fetches of the same immutable document is a waste the SDK should absorb rather than
    * ask every consumer to.
    */
-  configPromise = null;
+  configPromises = /* @__PURE__ */ new Map();
   constructor(options) {
     if (!options.issuer) {
       throw new ConfigurationError("issuer is required.");
@@ -215,13 +216,20 @@ var CboxIdFrontend = class {
    * Fetched once per client instance. The document is small and changes when somebody
    * edits it in the console, so a long-lived page picks changes up on its next full load
    * rather than mid-session — which is the right trade for something that decides layout.
+   * Each `organization` is fetched and cached on its own.
    */
-  async config() {
-    this.configPromise ??= this.get("/frontend/v1/config", {}, isFrontendConfig).catch((error) => {
-      this.configPromise = null;
-      throw error;
-    });
-    return this.configPromise;
+  async config(options = {}) {
+    const organization2 = options.organization ?? "";
+    let pending = this.configPromises.get(organization2);
+    if (pending === void 0) {
+      const path = organization2 === "" ? "/frontend/v1/config" : `/frontend/v1/config?${new URLSearchParams({ organization: organization2 }).toString()}`;
+      pending = this.get(path, {}, isFrontendConfig).catch((error) => {
+        this.configPromises.delete(organization2);
+        throw error;
+      });
+      this.configPromises.set(organization2, pending);
+    }
+    return pending;
   }
   /**
    * Who is signed in, given an access token your app already holds.
@@ -283,8 +291,12 @@ var CboxIdFrontend = class {
     if (body.status === "ok" && typeof body.login_ticket === "string") {
       return { status: "ok", loginTicket: body.login_ticket, expiresIn: body.expires_in ?? 60 };
     }
-    if ((body.status === "mfa_required" || body.status === "otp_required") && typeof body.mfa_token === "string") {
-      return { status: body.status, mfaToken: body.mfa_token };
+    if (body.status === "mfa_required" && typeof body.mfa_token === "string") {
+      const factors = Array.isArray(body.factors) ? body.factors.filter((f) => typeof f === "string" && SECOND_FACTOR_KINDS.has(f)) : void 0;
+      return { status: "mfa_required", mfaToken: body.mfa_token, ...factors ? { factors } : {} };
+    }
+    if (body.status === "otp_required" && typeof body.mfa_token === "string") {
+      return { status: "otp_required", mfaToken: body.mfa_token };
     }
     if (body.status === "sso_required") {
       return { status: "sso_required" };
@@ -301,6 +313,11 @@ var CboxIdFrontend = class {
    *
    * A wrong code costs an attempt, not the sign-in: five are allowed before the token
    * dies and the person starts from the password again.
+   *
+   * `method` says which challenge the code answers: `'mfa'` for an authenticator or
+   * recovery code, `'otp'` for an emailed code (`otp_required`), `'sms'` for a code sent
+   * with {@link sendSmsCode}. A texted code is six digits like an authenticator's, so the
+   * server cannot tell them apart by shape — answering one as the other is refused.
    */
   async submitSecondFactor(mfaToken, code, method = "mfa") {
     const response = await this.post("/frontend/v1/sign-in/factor", { mfa_token: mfaToken, code, method });
@@ -312,6 +329,41 @@ var CboxIdFrontend = class {
     }
     return body.status === "ok" && typeof body.login_ticket === "string" ? { status: "ok", loginTicket: body.login_ticket, expiresIn: body.expires_in ?? 60 } : { status: "invalid" };
   }
+  /**
+   * Text the person a sign-in code, when `mfa_required` listed `'sms'` in `factors`.
+   * Then finish with `submitSecondFactor(mfaToken, code, 'sms')`.
+   *
+   * Only call it when the person asks ("Text me a code"), never on page load: each send
+   * spends one of the token's five attempts — that is what bounds how many texts one
+   * proved password can cause — and every text costs the customer money.
+   *
+   * ```ts
+   * if (result.status === 'mfa_required' && result.factors?.includes('sms')) {
+   *   const sent = await frontend.sendSmsCode(result.mfaToken)
+   *   if (sent.status === 'sent') showCodeField(`We texted ${sent.to}`)
+   * }
+   * ```
+   */
+  async sendSmsCode(mfaToken) {
+    const response = await this.post("/frontend/v1/sign-in/factor/sms", { mfa_token: mfaToken });
+    let body;
+    try {
+      body = await response.json();
+    } catch {
+      throw new FrontendApiError("Cbox ID returned a body that is not JSON.", "malformed", response.status);
+    }
+    if (body.status === "sent" && typeof body.to === "string") {
+      return { status: "sent", to: body.to, expiresIn: typeof body.expires_in === "number" ? body.expires_in : 300 };
+    }
+    if (body.status === "rate_limited" || response.status === 429) {
+      const retryAfter = typeof body.retry_after === "number" ? body.retry_after : Number(response.headers.get("Retry-After") ?? "");
+      return { status: "rate_limited", retryAfter: Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter : void 0 };
+    }
+    if (body.status === "unavailable") {
+      return { status: "unavailable" };
+    }
+    return { status: "invalid" };
+  }
   /**
    * The WebAuthn options for a passkey sign-in, and the handle that carries the challenge.
    *
@@ -607,6 +659,14 @@ function hasRole(source, role) {
 function hasPermission(source, permission) {
   return permissions(source).includes(permission);
 }
+var FEATURE_FLAGS_SCOPE = "feature_flags";
+function featureFlags(source) {
+  const claim = claimsOf(source)["feature_flags"];
+  return Array.isArray(claim) ? stringList(claim) : null;
+}
+function hasFeature(source, key) {
+  return featureFlags(source)?.includes(key) ?? false;
+}
 var MAX_ACTOR_DEPTH = 8;
 function parseActor(claim, depth) {
   if (claim === void 0 || claim === null) {
@@ -615,11 +675,11 @@ function parseActor(claim, depth) {
   if (typeof claim !== "object" || Array.isArray(claim)) {
     return { sub: null, actor: null };
   }
-  const record = claim;
-  const sub = record["sub"];
+  const record2 = claim;
+  const sub = record2["sub"];
   return {
     sub: typeof sub === "string" && sub !== "" ? sub : null,
-    actor: depth + 1 < MAX_ACTOR_DEPTH ? parseActor(record["act"], depth + 1) : null
+    actor: depth + 1 < MAX_ACTOR_DEPTH ? parseActor(record2["act"], depth + 1) : null
   };
 }
 function stringList(claim) {
@@ -633,6 +693,43 @@ function isUser(source) {
 }
 
 // src/vault.ts
+function withConnectReturn(connectUrl, options = {}) {
+  const url = new URL(connectUrl);
+  if (options.clientId) url.searchParams.set("client_id", options.clientId);
+  if (options.returnTo) url.searchParams.set("return_to", options.returnTo);
+  return url.toString();
+}
+function pipeConnectUrl(issuer, provider, options = {}) {
+  return withConnectReturn(
+    `${issuer.replace(/\/$/, "")}/account/connected-services/${encodeURIComponent(provider)}/connect`,
+    options
+  );
+}
+var PipeLeaseError = class extends CboxIdError {
+  constructor(message, error, status, connectUrl = null, retryAfter = null) {
+    super(message);
+    this.error = error;
+    this.status = status;
+    this.connectUrl = connectUrl;
+    this.retryAfter = retryAfter;
+  }
+  error;
+  status;
+  connectUrl;
+  retryAfter;
+  /** `connectUrl` with your `client_id` and `return_to` on it, or null when there is none. */
+  connectUrlWith(options) {
+    return this.connectUrl === null ? null : withConnectReturn(this.connectUrl, options);
+  }
+};
+var PipeNotConnectedError = class extends PipeLeaseError {
+};
+var PipeReauthorizationRequiredError = class extends PipeLeaseError {
+};
+var PipeTemporarilyUnavailableError = class extends PipeLeaseError {
+};
+var PipeLeaseDeniedError = class extends PipeLeaseError {
+};
 var VaultClient = class {
   constructor(issuer, token, timeoutMs = 1e4) {
     this.token = token;
@@ -688,11 +785,69 @@ var VaultClient = class {
       return { secretId: r.secret_id, provider: r.provider, secret: r.secret, expiresAt: r.expires_at };
     });
   }
+  /**
+   * Lease a fresh access token for a person's connected account at `provider` (Pipes,
+   * scope `vault.lease`). The token is refreshed first when it is about to expire, so
+   * you never handle a refresh token.
+   *
+   * With a client-credentials token, name the person in `userId`. With a token issued to
+   * your app FOR a person, leave it out — the lease is theirs.
+   *
+   * ```ts
+   * try {
+   *   const { accessToken } = await vault.leasePipeToken('github', { userId, purpose: 'list-repos' })
+   * } catch (e) {
+   *   if (e instanceof PipeNotConnectedError || e instanceof PipeReauthorizationRequiredError) {
+   *     return redirect(e.connectUrlWith({ clientId, returnTo }))
+   *   }
+   *   throw e
+   * }
+   * ```
+   */
+  async leasePipeToken(provider, options) {
+    const path = `/pipes/${encodeURIComponent(provider)}/token`;
+    const response = await this.send("POST", path, {
+      purpose: options.purpose,
+      ...options.userId !== void 0 ? { user_id: options.userId } : {}
+    });
+    let body = {};
+    try {
+      const parsed = await response.json();
+      if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+        body = parsed;
+      }
+    } catch {
+    }
+    if (!response.ok) {
+      throw pipeLeaseError(response, body);
+    }
+    if (typeof body.access_token !== "string") {
+      throw new PipeLeaseError("The pipe lease answered without an access token.", null, response.status);
+    }
+    return {
+      accessToken: body.access_token,
+      tokenType: "Bearer",
+      provider: String(body.provider ?? provider),
+      userId: String(body.user_id ?? ""),
+      connectionId: String(body.connection_id ?? ""),
+      scopes: Array.isArray(body.scopes) ? body.scopes.filter((s) => typeof s === "string") : [],
+      expiresAt: typeof body.expires_at === "string" ? body.expires_at : null,
+      leaseExpiresAt: String(body.lease_expires_at ?? ""),
+      metadata: isStringRecord(body.metadata) ? body.metadata : {}
+    };
+  }
   async json(method, path, body) {
     const response = await this.request(method, path, body);
     return await response.json();
   }
   async request(method, path, body) {
+    const response = await this.send(method, path, body);
+    if (!response.ok) {
+      throw new AuthenticationError(`Vault ${method} ${path} failed with status ${response.status}.`);
+    }
+    return response;
+  }
+  async send(method, path, body) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
     try {
@@ -707,16 +862,35 @@ var VaultClient = class {
       if (body) {
         init.body = JSON.stringify(body);
       }
-      const response = await fetch(`${this.base}${path}`, init);
-      if (!response.ok) {
-        throw new AuthenticationError(`Vault ${method} ${path} failed with status ${response.status}.`);
-      }
-      return response;
+      return await fetch(`${this.base}${path}`, init);
     } finally {
       clearTimeout(timer);
     }
   }
 };
+function pipeLeaseError(response, body) {
+  const error = typeof body.error === "string" ? body.error : null;
+  const message = typeof body.message === "string" && body.message !== "" ? body.message : `The pipe lease failed with status ${response.status}.`;
+  const connectUrl = typeof body.connect_url === "string" && body.connect_url !== "" ? body.connect_url : null;
+  const header2 = response.headers.get("retry-after")?.trim() ?? "";
+  const retryAfter = /^\d+$/.test(header2) ? Number(header2) : null;
+  if (response.status === 404 && connectUrl !== null) {
+    return new PipeNotConnectedError(message, error, 404, connectUrl, retryAfter);
+  }
+  if (response.status === 409 && connectUrl !== null) {
+    return new PipeReauthorizationRequiredError(message, error, 409, connectUrl, retryAfter);
+  }
+  if (response.status === 503) {
+    return new PipeTemporarilyUnavailableError(message, error, 503, connectUrl, retryAfter);
+  }
+  if (response.status === 403 && error !== "insufficient_scope") {
+    return new PipeLeaseDeniedError(message, error, 403, connectUrl, retryAfter);
+  }
+  return new PipeLeaseError(message, error, response.status, connectUrl, retryAfter);
+}
+function isStringRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && Object.values(value).every((v) => typeof v === "string");
+}
 
 // src/webhook.ts
 function timingSafeEqual2(a, b) {
@@ -770,9 +944,9 @@ function header(headers, name) {
   if (typeof Headers !== "undefined" && headers instanceof Headers) {
     return headers.get(name) ?? void 0;
   }
-  const record = headers;
-  const key = Object.keys(record).find((k) => k.toLowerCase() === name);
-  const value = key === void 0 ? void 0 : record[key];
+  const record2 = headers;
+  const key = Object.keys(record2).find((k) => k.toLowerCase() === name);
+  const value = key === void 0 ? void 0 : record2[key];
   return Array.isArray(value) ? value.join(" ") : value;
 }
 function base64ToBytes(value) {
@@ -986,6 +1160,7 @@ var CboxIdClient = class {
       organization: organization(claims),
       roles: roles(claims),
       permissions: permissions(claims),
+      featureFlags: featureFlags(claims),
       actor: actor(claims),
       sessionId: sessionId(claims),
       // Only present when the instance emitted the claim (exactOptionalPropertyTypes).
@@ -1165,6 +1340,18 @@ var CboxIdClient = class {
    * registered. `organization` picks which of the person's organizations the keys act in;
    * omitted, the page uses the one they are in.
    */
+  /**
+   * The hosted page where the signed-in person connects their account at `provider`
+   * (Pipes) — `/account/connected-services/{provider}/connect`, preselected to this app.
+   * They come back to `returnTo` with `?provider=…&status=connected|cancelled|failed`,
+   * honoured only on an origin the app registered.
+   */
+  pipeConnectUrl(provider, returnTo) {
+    return pipeConnectUrl(this.config.issuer, provider, {
+      clientId: this.config.clientId,
+      ...returnTo !== void 0 ? { returnTo } : {}
+    });
+  }
   apiKeysUrl(options = {}) {
     const params = new URLSearchParams({ client_id: options.clientId ?? this.config.clientId });
     if (options.returnTo) {
@@ -1457,11 +1644,11 @@ function parseOrganizations(claim) {
     if (typeof entry !== "object" || entry === null) {
       continue;
     }
-    const record = entry;
-    const id = record["id"];
-    const name = record["name"];
+    const record2 = entry;
+    const id = record2["id"];
+    const name = record2["name"];
     if (typeof id === "string" && id !== "" && typeof name === "string" && name !== "") {
-      orgs.push({ id, name, role: typeof record["role"] === "string" ? record["role"] : null });
+      orgs.push({ id, name, role: typeof record2["role"] === "string" ? record2["role"] : null });
     }
   }
   return orgs;
@@ -1515,6 +1702,11 @@ async function publishManifest(config, declaration) {
     throw new ConfigurationError("Publishing a manifest needs issuer, clientId and clientSecret.");
   }
   const timeoutMs = config.timeoutMs ?? 1e4;
+  assertSecureIssuer(config.issuer);
+  const issuer = new URL(config.issuer);
+  if (issuer.username || issuer.password || issuer.search || issuer.hash) {
+    throw new ConfigurationError("The manifest issuer must not contain credentials, a query or a fragment.");
+  }
   const manifest = await buildManifest(declaration);
   const discovery = new Discovery(config.issuer, timeoutMs, 36e5);
   const token = await mintToken(config, discovery, timeoutMs);
@@ -1522,6 +1714,7 @@ async function publishManifest(config, declaration) {
     `${config.issuer.replace(/\/$/, "")}/api/v1/apps/manifest`,
     {
       method: "POST",
+      redirect: "error",
       headers: {
         authorization: `Bearer ${token}`,
         accept: "application/json",
@@ -1532,10 +1725,20 @@ async function publishManifest(config, declaration) {
     timeoutMs
   );
   if (!response.ok) {
-    throw new AuthenticationError(`Manifest push failed: HTTP ${response.status} ${await response.text()}`);
+    throw new AuthenticationError(`Manifest push failed: HTTP ${response.status}`);
+  }
+  const json2 = await response.json().catch(() => {
+    throw new AuthenticationError("Cbox ID returned an invalid manifest acknowledgement.");
+  });
+  const checksum = await sha256Hex(canonicalManifestJson(declaration.permissions ?? [], declaration.roles ?? []));
+  if (json2 === null || typeof json2 !== "object" || Array.isArray(json2)) {
+    throw new AuthenticationError("Cbox ID did not acknowledge the authorization manifest.");
+  }
+  const summary = json2;
+  if (summary.client_id !== config.clientId || summary.version !== manifest.version || summary.checksum !== checksum || typeof summary.unchanged !== "boolean" || !Number.isInteger(summary.roles_declared) || !Number.isInteger(summary.permissions_declared) || (summary.roles_declared ?? -1) < 0 || (summary.permissions_declared ?? -1) < 0 || !summary.unchanged && (summary.roles_declared !== manifest.roles.length || summary.permissions_declared !== manifest.permissions.length)) {
+    throw new AuthenticationError("Cbox ID did not acknowledge this app and its complete authorization manifest.");
   }
-  const json2 = await response.json();
-  return json2 !== null && typeof json2 === "object" ? json2 : {};
+  return summary;
 }
 async function mintToken(config, discovery, timeoutMs) {
   const response = await fetchWithTimeout(
@@ -1543,6 +1746,7 @@ async function mintToken(config, discovery, timeoutMs) {
     {
       method: "POST",
       headers: { "content-type": "application/x-www-form-urlencoded" },
+      redirect: "error",
       body: new URLSearchParams({
         grant_type: "client_credentials",
         client_id: config.clientId,
@@ -1553,7 +1757,7 @@ async function mintToken(config, discovery, timeoutMs) {
     timeoutMs
   );
   const json2 = await response.json().catch(() => ({}));
-  if (typeof json2.access_token !== "string" || json2.access_token === "") {
+  if (!response.ok || typeof json2.access_token !== "string" || json2.access_token === "") {
     throw new AuthenticationError(
       "Could not obtain an apps.manifest access token \u2014 check the client credentials and that the client holds the apps.manifest scope."
     );
@@ -1675,6 +1879,8 @@ async function fetchWithTimeout(url, init, timeoutMs) {
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
     return await fetch(url, { ...init, signal: controller.signal });
+  } catch {
+    throw new AuthenticationError("Cbox ID manifest publication could not be verified.");
   } finally {
     clearTimeout(timer);
   }
@@ -1688,30 +1894,134 @@ function assertLegacyLogin(legacy) {
   }
 }
 
+// src/decisions.ts
+var PermissionDecision = class {
+  constructor(subject, organization2, clientId, organizationRole, organizationActive, permissions2) {
+    this.subject = subject;
+    this.organization = organization2;
+    this.clientId = clientId;
+    this.organizationRole = organizationRole;
+    this.organizationActive = organizationActive;
+    this.permissions = permissions2;
+  }
+  subject;
+  organization;
+  clientId;
+  organizationRole;
+  organizationActive;
+  permissions;
+  allows(permission) {
+    return this.organizationActive && this.permissions[permission] === true;
+  }
+  allowed() {
+    const values = Object.values(this.permissions);
+    return this.organizationActive && values.length > 0 && values.every((value) => value === true);
+  }
+};
+async function checkPermissions(config, accessToken, subject, organization2, permissions2) {
+  assertSecureIssuer(config.issuer);
+  const issuer = new URL(config.issuer);
+  if (issuer.username || issuer.password || issuer.search || issuer.hash || !config.clientId || !subject || organization2 === "" || !accessToken || accessToken.length > 32768 || /[\x00-\x20\x7f]/.test(accessToken) || !permissions2.length || permissions2.length > 50 || permissions2.some((permission) => !permission.trim() || new TextEncoder().encode(permission).length > 255)) {
+    throw new ConfigurationError("Permission decision request is not configured or valid.");
+  }
+  const requested = [...new Set(permissions2)];
+  try {
+    const response = await fetch(`${config.issuer.replace(/\/$/, "")}/oauth/decisions`, {
+      method: "POST",
+      redirect: "error",
+      cache: "no-store",
+      signal: AbortSignal.timeout(Math.max(1, config.timeoutMs ?? 1e4)),
+      headers: { authorization: `Bearer ${accessToken}`, accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify({ subject, org: organization2, permission: requested })
+    });
+    if (response.status !== 200) {
+      await response.body?.cancel();
+      throw new AuthenticationError("Permission decision could not be verified.", void 0, void 0, response.status);
+    }
+    const reader = response.body?.getReader();
+    if (!reader) throw new AuthenticationError("Permission decision response is invalid.");
+    let size = 0;
+    let raw = "";
+    const decoder = new TextDecoder();
+    try {
+      for (; ; ) {
+        const { value, done } = await reader.read();
+        if (done) break;
+        size += value.byteLength;
+        if (size > 65536) throw new AuthenticationError("Permission decision response exceeded its limit.");
+        raw += decoder.decode(value, { stream: true });
+      }
+      raw += decoder.decode();
+    } finally {
+      await reader.cancel();
+      reader.releaseLock();
+    }
+    const data = JSON.parse(raw);
+    if (!record(data) || !record(data.subject) || data.mode !== "rbac" || data.subject.type !== "user" || data.subject.id !== subject || data.organization !== organization2 || data.client_id !== config.clientId || typeof data.organization_active !== "boolean" || typeof data.allowed !== "boolean" || !(data.org_role === null || typeof data.org_role === "string" && ["owner", "admin", "developer", "member", "viewer"].includes(data.org_role)) || !Array.isArray(data.results) || data.results.length !== requested.length) {
+      throw new AuthenticationError("Permission decision response binding is invalid.");
+    }
+    const checks = /* @__PURE__ */ Object.create(null);
+    for (const result of data.results) {
+      if (!record(result) || typeof result.permission !== "string" || typeof result.allowed !== "boolean" || !requested.includes(result.permission) || Object.hasOwn(checks, result.permission)) {
+        throw new AuthenticationError("Permission decision result is invalid.");
+      }
+      checks[result.permission] = result.allowed;
+    }
+    const decision = new PermissionDecision(
+      subject,
+      organization2,
+      config.clientId,
+      data.org_role,
+      data.organization_active,
+      Object.freeze(checks)
+    );
+    if (data.allowed !== decision.allowed()) throw new AuthenticationError("Permission decision result is inconsistent.");
+    return decision;
+  } catch (error) {
+    if (error instanceof AuthenticationError) throw error;
+    throw new AuthenticationError("Permission decision could not be verified.");
+  }
+}
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
 exports.AuthenticationError = AuthenticationError;
 exports.CboxIdClient = CboxIdClient;
 exports.CboxIdError = CboxIdError;
 exports.CboxIdFrontend = CboxIdFrontend;
 exports.ConfigurationError = ConfigurationError;
+exports.FEATURE_FLAGS_SCOPE = FEATURE_FLAGS_SCOPE;
 exports.FrontendApiError = FrontendApiError;
 exports.InvalidStateError = InvalidStateError;
+exports.PermissionDecision = PermissionDecision;
+exports.PipeLeaseDeniedError = PipeLeaseDeniedError;
+exports.PipeLeaseError = PipeLeaseError;
+exports.PipeNotConnectedError = PipeNotConnectedError;
+exports.PipeReauthorizationRequiredError = PipeReauthorizationRequiredError;
+exports.PipeTemporarilyUnavailableError = PipeTemporarilyUnavailableError;
 exports.VaultClient = VaultClient;
 exports.actor = actor;
 exports.buildManifest = buildManifest;
 exports.challenge = challenge;
+exports.checkPermissions = checkPermissions;
 exports.createLegacyVerifier = createLegacyVerifier;
 exports.createVerifier = createVerifier;
 exports.defineAuthz = defineAuthz;
+exports.featureFlags = featureFlags;
+exports.hasFeature = hasFeature;
 exports.hasPermission = hasPermission;
 exports.hasRole = hasRole;
 exports.isSupportSession = isSupportSession;
 exports.organization = organization;
 exports.permissions = permissions;
+exports.pipeConnectUrl = pipeConnectUrl;
 exports.publishManifest = publishManifest;
 exports.randomToken = randomToken;
 exports.roles = roles;
 exports.sessionId = sessionId;
 exports.verifyStandardWebhook = verifyStandardWebhook;
 exports.verifyWebhook = verifyWebhook;
+exports.withConnectReturn = withConnectReturn;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map