@cosmoops/connect-sdk 0.1.0

package/dist/esm/server/client.js

@@ -0,0 +1,110 @@
+import { AccessResource } from "./resources/access.js";
+import { AppsResource } from "./resources/apps.js";
+import { AiResource } from "./resources/ai.js";
+import { BillingResource } from "./resources/billing.js";
+import { DriveResource } from "./resources/drive.js";
+import { EntitlementsResource } from "./resources/entitlements.js";
+import { IdentityResource } from "./resources/identity.js";
+import { LogsResource } from "./resources/logs.js";
+import { OtpResource } from "./resources/otp.js";
+import { SessionsResource } from "./resources/sessions.js";
+export const DEFAULT_BASE_URL = "https://connect.cosmoops.com";
+const SERVICE_API_PREFIX = "/api/v1/service";
+/**
+ * Refuses to build a client in a browser.
+ *
+ * This class holds the API key, which is also the OAuth `client_secret` and the
+ * `id_token` HMAC key - one credential with three jobs, so a copy that reaches
+ * a browser bundle is a full compromise of the integration, not a leaked read
+ * token. The entry-point split (`/server` versus `/client`) is what is supposed
+ * to prevent that, but an import is one keystroke and a bundler will happily
+ * follow it. This is the runtime backstop for when it does.
+ *
+ * The test is deliberately narrower than `typeof window !== "undefined"`.
+ * jsdom and happy-dom put a `window` on an ordinary Node process, and a test
+ * suite running server code under a DOM environment is not a leak - failing
+ * there would only teach people to work around this. A bundler may also shim
+ * `process` for the browser, but it never has `process.versions.node`, so that
+ * is what actually separates the two.
+ */
+function assertNotBrowser() {
+    if (typeof window === "undefined" || typeof window.document === "undefined")
+        return;
+    const versions = globalThis.process?.versions;
+    if (typeof versions?.node === "string")
+        return;
+    throw new TypeError("ConnectClient was constructed in a browser. It holds your API key - which is also your OAuth client_secret " +
+        "and id_token signing key - so it must only ever run on your server. Import `@cosmoops/connect-sdk/client` " +
+        "in browser code instead; it talks to your own origin and holds no credential.");
+}
+/**
+ * The CosmoOps Connect service-partner API.
+ *
+ * Covers `/api/v1/service/*` and nothing else - the surface a service platform
+ * integrates against. Connect's internal API is not part of this package and
+ * never will be.
+ *
+ * ```ts
+ * const connect = new ConnectClient({
+ *   apiKey: process.env.CONNECT_API_KEY!,
+ *   clientId: process.env.CONNECT_CLIENT_ID,
+ * });
+ *
+ * const session = await connect.identity.exchangeCode({ code, redirectUri });
+ * const { ready } = await connect.entitlements.getReadiness(session.user.organizationId);
+ * ```
+ *
+ * Every failure throws a `ConnectError` carrying a stable `code`. Nothing here
+ * holds state between calls, so one client can be built once and shared.
+ */
+export class ConnectClient {
+    /** "Login with Connect" - the OAuth2 handshake and the session after it. */
+    identity;
+    /** What a signed-in member may do on your service. */
+    access;
+    /** The services an organization can open - for a launcher grid. */
+    apps;
+    /** Whether a workspace may use your service, and on what plan. */
+    entitlements;
+    /** Your plan catalog, and metering usage against add-on balances. */
+    billing;
+    /** Files in an organization's Drive. */
+    drive;
+    /** RAG chat and structured extraction. */
+    ai;
+    /** WhatsApp/SMS phone verification. */
+    otp;
+    /** Feature events into the Console's audit log, filterable to your service. */
+    logs;
+    /** This Connect account's own login sessions - account-wide, not scoped to this service. Requires the `sessions:manage` scope. */
+    sessions;
+    constructor(options) {
+        assertNotBrowser();
+        if (!options.apiKey) {
+            throw new TypeError("ConnectClient requires `apiKey` - the plaintext shown once in the Setup tab.");
+        }
+        const appBaseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+        const transport = {
+            baseUrl: `${appBaseUrl}${SERVICE_API_PREFIX}`,
+            apiKey: options.apiKey,
+            timeoutMs: options.timeoutMs ?? 20_000,
+            maxRetries: options.maxRetries ?? 2,
+            fetch: options.fetch ?? ((input, init) => globalThis.fetch(input, init)),
+            userAgent: `cosmoops-connect-sdk/${SDK_VERSION}`,
+        };
+        // `authorizeUrl` points at the app, not the API prefix - it is a browser
+        // redirect, not a service call, so identity takes both.
+        this.identity = new IdentityResource(transport, options.clientId ?? null, appBaseUrl);
+        this.access = new AccessResource(transport);
+        this.apps = new AppsResource(transport);
+        this.entitlements = new EntitlementsResource(transport);
+        this.billing = new BillingResource(transport);
+        this.drive = new DriveResource(transport);
+        this.ai = new AiResource(transport);
+        this.otp = new OtpResource(transport);
+        this.logs = new LogsResource(transport);
+        this.sessions = new SessionsResource(transport, options.clientId ?? null);
+    }
+}
+/** Kept in step with `package.json` by `sdk.test.ts`. */
+export const SDK_VERSION = "0.1.0";

package/dist/esm/server/handler.js

@@ -0,0 +1,330 @@
+import { ConnectError } from "../errors.js";
+import { createState } from "./resources/identity.js";
+/**
+ * A sentinel origin to resolve a candidate destination against. Never reached -
+ * `.invalid` is reserved by RFC 2606 precisely so it cannot resolve.
+ */
+const SAME_ORIGIN_PROBE = "https://connect.invalid";
+/**
+ * Only same-origin paths are accepted as a post-login destination.
+ *
+ * `next` arrives from a URL anyone can craft, and handing it to a redirect
+ * unchecked is an open redirect - the classic way a login flow is turned into
+ * a credible phishing hop.
+ *
+ * **This resolves the candidate with the URL parser instead of matching its
+ * prefix, and the difference is not cosmetic.** String checks judge the bytes
+ * we received; the browser judges what its *own* parser makes of them, and the
+ * two disagree. Per the WHATWG URL standard a browser strips every ASCII tab,
+ * LF and CR from a URL before resolving it - so `/\t/evil.test` passes any
+ * `startsWith("//")` test, and then leaves the browser as `//evil.test`, a
+ * protocol-relative jump to another origin. Backslashes are the same trap from
+ * the other side: the parser treats `\` as `/` in a special scheme, so
+ * `/\evil.test` is off-origin too.
+ *
+ * Resolving against a sentinel origin and comparing `origin` asks the one
+ * question that matters - "where will the browser actually end up" - and gets
+ * tab-stripping, backslash folding, dot-segment collapsing and scheme handling
+ * from the parser rather than from a list of prefixes we thought of. It also
+ * neutralises a CRLF in the destination: the parser drops those characters, so
+ * they can no longer reach a `Location` header and make the runtime reject the
+ * whole response.
+ */
+function safeRedirect(candidate, fallback) {
+    if (!candidate)
+        return fallback;
+    let resolved;
+    try {
+        resolved = new URL(candidate, SAME_ORIGIN_PROBE);
+    }
+    catch {
+        return fallback;
+    }
+    if (resolved.origin !== SAME_ORIGIN_PROBE)
+        return fallback;
+    // Rebuilt from the parsed parts, not echoed back, so what we redirect to is
+    // the same string the check was performed on.
+    return `${resolved.pathname}${resolved.search}${resolved.hash}`;
+}
+/** Timing-independent compare for the CSRF state - lengths differ, so check that first. */
+function sameState(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+function readCookie(request, name) {
+    const header = request.headers.get("cookie");
+    if (!header)
+        return null;
+    for (const part of header.split(";")) {
+        const [key, ...rest] = part.trim().split("=");
+        if (key === name)
+            return decodeURIComponent(rest.join("="));
+    }
+    return null;
+}
+function redirect(location, cookies = []) {
+    const response = new Response(null, { status: 302, headers: { location } });
+    for (const cookie of cookies)
+        response.headers.append("set-cookie", cookie);
+    return response;
+}
+/**
+ * The browser half of this SDK cannot hold an API key - so it does not.
+ *
+ * `@cosmoops/connect-sdk/client` talks only to your own origin, and this
+ * handler is what answers. It lives in your backend, holds the key, and
+ * exposes a fixed, named set of reads plus sign-out and session revocation.
+ * Nothing here proxies arbitrary paths: a generic passthrough would hand the
+ * browser your whole API surface under your credentials, which is the same
+ * leak with extra steps.
+ *
+ * Framework-agnostic - `Request` in, `Response` out, so it mounts anywhere
+ * that shape exists.
+ *
+ * ```ts
+ * // app/api/connect/[...route]/route.ts
+ * const handler = createConnectHandler({ client, session });
+ * export { handler as GET, handler as POST };
+ * ```
+ *
+ * Every route resolves the organization from the caller's *own* session, never
+ * from a query parameter. A browser must not be able to ask about an
+ * organization it is not signed into, and a client-supplied `organizationId`
+ * is exactly that hole.
+ */
+export function createConnectHandler(options) {
+    const basePath = (options.basePath ?? "/api/connect").replace(/\/+$/, "");
+    const { client, session } = options;
+    const defaultRedirect = options.defaultRedirect ?? "/";
+    const stateCookieName = options.stateCookieName ?? "connect_oauth_state";
+    const callbackPath = `${basePath}/callback`;
+    /**
+     * Short-lived, httpOnly, and `SameSite=Lax` - `Strict` would not be sent on
+     * the cross-site redirect back from Connect, which is the one request that
+     * has to read it. Scoped to `basePath` so it is never attached to ordinary
+     * page loads.
+     */
+    function stateCookie(value, secure) {
+        const cleared = value === "";
+        return [
+            `${stateCookieName}=${encodeURIComponent(value)}`,
+            `Path=${basePath}`,
+            "HttpOnly",
+            "SameSite=Lax",
+            secure ? "Secure" : "",
+            cleared ? "Max-Age=0" : "Max-Age=900",
+        ]
+            .filter(Boolean)
+            .join("; ");
+    }
+    async function requireToken(request) {
+        const token = await session.read(request);
+        if (!token) {
+            throw new ConnectError({
+                status: 401,
+                code: "invalid_token",
+                message: "No Connect session",
+                endpoint: "bridge",
+            });
+        }
+        return token;
+    }
+    /** Signed-in identity plus the organization it belongs to - the first read every other route needs. */
+    async function whoami(request) {
+        return client.identity.getUser(await requireToken(request));
+    }
+    const routes = {
+        "GET /session": async (request) => {
+            const token = await session.read(request);
+            // Signed out is a normal state for a page rendering a Login button, not
+            // an error - `user: null` rather than a 401 the client must catch.
+            if (!token)
+                return json({ user: null, subscription: null, serviceRole: null });
+            return json(await client.identity.getUser(token));
+        },
+        "GET /entitlements": async (request) => {
+            const { user } = await whoami(request);
+            const [readiness, subscription] = await Promise.all([
+                client.entitlements.getReadiness(user.organizationId),
+                client.entitlements.getSubscription(user.organizationId),
+            ]);
+            return json({ readiness, subscription });
+        },
+        "GET /plans": async () => json(await client.billing.listPlans()),
+        // Organization comes from the caller's own session, same as every other
+        // route here - a browser must not be able to ask what another workspace
+        // has left.
+        "GET /addons": async (request) => {
+            const { user } = await whoami(request);
+            return json(await client.billing.getAddonUsage(user.organizationId));
+        },
+        "GET /apps": async (request) => {
+            const { user } = await whoami(request);
+            return json({ apps: await client.apps.list(user.organizationId) });
+        },
+        // Account-wide, not scoped to this service - see `SessionsResource`'s
+        // doc comment. `requireToken` alone identifies the caller; the target
+        // `sessionId` on the revoke routes travels in the JSON body, not the
+        // URL, so the exact-match routes table above never needs a dynamic
+        // segment for it.
+        "GET /sessions": async (request) => {
+            const items = await client.sessions.list(await requireToken(request));
+            return json({ items });
+        },
+        "POST /sessions/revoke": async (request) => {
+            const body = (await request.json().catch(() => null));
+            if (!body?.sessionId) {
+                throw new ConnectError({
+                    status: 400,
+                    code: "validation_error",
+                    message: "sessionId is required",
+                    endpoint: "POST /sessions/revoke",
+                });
+            }
+            await client.sessions.revoke(await requireToken(request), body.sessionId);
+            return json({ ok: true });
+        },
+        "POST /sessions/revoke-others": async (request) => {
+            const result = await client.sessions.revokeOthers(await requireToken(request));
+            return json(result);
+        },
+        /**
+         * Starts the round trip: mints the CSRF `state`, parks it in a cookie
+         * alongside the post-login destination, and bounces the browser to
+         * Connect.
+         *
+         * Registered only when the session store can `write` - without that, the
+         * callback would have nowhere to put the session it just earned.
+         */
+        "GET /signin": async (request) => {
+            const url = new URL(request.url);
+            const secure = url.protocol === "https:";
+            const state = createState();
+            const next = safeRedirect(url.searchParams.get("next"), defaultRedirect);
+            const authorizeUrl = client.identity.authorizeUrl({
+                redirectUri: `${url.origin}${callbackPath}`,
+                state,
+                ...(url.searchParams.get("prompt") === "create" ? { prompt: "create" } : {}),
+            });
+            // State and destination travel together in one cookie so the callback
+            // cannot end up with one and not the other.
+            return redirect(authorizeUrl, [stateCookie(`${state}:${next}`, secure)]);
+        },
+        /**
+         * The other end of the round trip. Verifies `state`, exchanges the code,
+         * checks the `id_token`, hands the session to the store, and returns the
+         * user where they were going.
+         */
+        "GET /callback": async (request) => {
+            const url = new URL(request.url);
+            const secure = url.protocol === "https:";
+            const [cookieState, ...destinationParts] = (readCookie(request, stateCookieName) ?? "").split(":");
+            const next = safeRedirect(destinationParts.join(":") || null, defaultRedirect);
+            const clearState = stateCookie("", secure);
+            const returnedState = url.searchParams.get("state") ?? "";
+            if (!cookieState || !sameState(cookieState, returnedState)) {
+                // Either a forged callback or a genuinely stale tab. Neither should
+                // mint a session, and neither is worth an error page.
+                return redirect(`${next}${next.includes("?") ? "&" : "?"}connect_error=state_mismatch`, [clearState]);
+            }
+            const error = url.searchParams.get("error");
+            if (error) {
+                // `login_required` is normal traffic, not a fault: a new account gets
+                // pulled out to their inbox to verify, and the ~15 minute request
+                // expires before they return. Connect has already signed them in, so
+                // one silent retry completes in a single hop. `connect_retry` bounds
+                // it - a genuine loop must surface, not spin.
+                if (error === "login_required" && url.searchParams.get("connect_retry") !== "1") {
+                    const retry = new URL(`${url.origin}${basePath}/signin`);
+                    retry.searchParams.set("next", next);
+                    retry.searchParams.set("connect_retry", "1");
+                    return redirect(retry.toString(), [clearState]);
+                }
+                return redirect(`${next}${next.includes("?") ? "&" : "?"}connect_error=${encodeURIComponent(error)}`, [
+                    clearState,
+                ]);
+            }
+            const code = url.searchParams.get("code");
+            if (!code) {
+                return redirect(`${next}${next.includes("?") ? "&" : "?"}connect_error=missing_code`, [clearState]);
+            }
+            const result = await client.identity.exchangeCode({
+                code,
+                redirectUri: `${url.origin}${callbackPath}`,
+            });
+            // Verified before the session is stored, not after - an unverifiable
+            // token must never become a signed-in user.
+            await client.identity.verifyIdToken(result.idToken);
+            const response = redirect(next, [clearState]);
+            await session.write(request, response, result.sessionToken);
+            return response;
+        },
+        "POST /logout": async (request) => {
+            const token = await session.read(request);
+            const response = json({ ok: true });
+            await session.clear?.(request, response);
+            // Connect is told last, and a failure is swallowed: the user's own
+            // session is already gone, and surfacing an error would leave them
+            // looking at a signed-in UI they can no longer use.
+            if (token)
+                await client.identity.logout(token).catch(() => { });
+            return response;
+        },
+    };
+    // Without a `write`, the callback has nowhere to put the session it earns -
+    // so the two flow routes simply do not exist rather than failing at the last
+    // step of a real sign-in.
+    if (!session.write) {
+        delete routes["GET /signin"];
+        delete routes["GET /callback"];
+    }
+    return async function handle(request) {
+        const path = new URL(request.url).pathname;
+        const route = (path.startsWith(basePath) ? path.slice(basePath.length) : path).replace(/\/+$/, "") || "/";
+        const handler = routes[`${request.method} ${route}`];
+        if (!handler) {
+            return json({ error: { code: "not_found", message: `No Connect bridge route for ${route}` } }, 404);
+        }
+        try {
+            return await handler(request);
+        }
+        catch (error) {
+            // A `ConnectError` already carries a code the browser half understands;
+            // anything else is ours and must not leak its message outward.
+            if (error instanceof ConnectError) {
+                return json({ error: { code: error.code, message: error.message } }, error.status || 502);
+            }
+            console.error("[connect bridge] unhandled failure:", error);
+            // The message is withheld in production - an unexpected throw can carry a
+            // DSN, a stack, or a credential, and none of that belongs in a browser.
+            // In development it is included, because the alternative is what this
+            // guard originally produced: a bare "Something went wrong" on a callback,
+            // with the only real explanation buried in a terminal the developer had
+            // no reason to be watching.
+            const detail = process.env.NODE_ENV === "development" && error instanceof Error ? error.message : null;
+            return json({
+                error: {
+                    code: "internal_error",
+                    message: detail ? `Something went wrong: ${detail}` : "Something went wrong",
+                },
+            }, 500);
+        }
+    };
+}
+function json(body, status = 200) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: {
+            "content-type": "application/json",
+            "cache-control": "no-store",
+            // Every one of these carries session-derived data. `nosniff` stops a
+            // browser second-guessing the declared type and executing a response as
+            // script, which is the shape a JSON endpoint gets turned into an XSS.
+            "x-content-type-options": "nosniff",
+        },
+    });
+}

package/dist/esm/server/http.js

@@ -0,0 +1,156 @@
+import { ConnectError } from "../errors.js";
+const RETRYABLE_STATUS = new Set([408, 429, 500, 502, 503, 504]);
+/**
+ * One id, safe to interpolate into a request path.
+ *
+ * `encodeURIComponent` alone is not enough, and the gap is easy to miss: it
+ * leaves `.` untouched, so an id of `".."` survives into the URL and the URL
+ * parser then collapses the segment *before* it - `/drive/files/../url`
+ * resolves to `/drive/url`, a different endpoint reached under the same API
+ * key. Slashes are encoded, so the traversal cannot chain past one segment,
+ * but one is already an endpoint the caller did not ask for.
+ *
+ * Relevant whenever an id reaches the SDK from a partner's own end users,
+ * which is the normal case for a file id.
+ */
+export function pathSegment(value, name) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new ConnectError({
+            status: 0,
+            code: "validation_error",
+            message: `${name} is required`,
+            endpoint: "client",
+        });
+    }
+    if (value === "." || value === "..") {
+        throw new ConnectError({
+            status: 0,
+            code: "validation_error",
+            message: `${name} must not be "." or ".." - those collapse a path segment in the request URL.`,
+            endpoint: "client",
+        });
+    }
+    return encodeURIComponent(value);
+}
+function parseRetryAfterMs(response) {
+    const header = response.headers.get("retry-after");
+    if (!header)
+        return null;
+    const seconds = Number(header);
+    return Number.isFinite(seconds) ? Math.max(0, seconds) * 1000 : null;
+}
+/**
+ * Both error dialects, one shape. `/api/v1/service/*` answers
+ * `{ error: { code, message } }`; the `/sso/*` endpoints answer OAuth2's
+ * `{ error, error_description }`.
+ */
+function toConnectError(response, body, endpoint) {
+    const envelope = (body ?? {});
+    const nested = typeof envelope.error === "object" ? envelope.error : null;
+    return new ConnectError({
+        status: response.status,
+        code: nested?.code ?? (typeof envelope.error === "string" ? envelope.error : "unknown_error"),
+        message: nested?.message ??
+            envelope.error_description ??
+            `${endpoint} failed with HTTP ${response.status}`,
+        endpoint,
+        retryAfterMs: parseRetryAfterMs(response),
+        body,
+    });
+}
+async function readBody(response) {
+    const text = await response.text().catch(() => "");
+    if (!text)
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * The one place a request leaves this SDK: builds it, applies the per-attempt
+ * timeout, retries what is safe to retry, and turns every failure into a
+ * `ConnectError`.
+ *
+ * **On retries.** Only idempotent requests are retried without a caller
+ * opt-in: every `GET`, plus any `POST` carrying an `Idempotency-Key` (the
+ * resources that mutate - `billing.consumeAddon`, `otp.send` - always set
+ * one). A bare `POST` is attempted exactly once, because a 429 or a 504 says
+ * nothing about whether the server already did the work.
+ */
+export async function request(options, spec) {
+    const endpoint = `${spec.method} ${spec.path}`;
+    const url = new URL(`${options.baseUrl}${spec.path}`);
+    for (const [key, value] of Object.entries(spec.query ?? {})) {
+        if (value !== undefined)
+            url.searchParams.set(key, String(value));
+    }
+    const headers = {
+        accept: "application/json",
+        "user-agent": options.userAgent,
+        ...spec.headers,
+    };
+    if ((spec.auth ?? "bearer") === "bearer") {
+        headers.authorization = `Bearer ${options.apiKey}`;
+    }
+    let body;
+    if (spec.multipart) {
+        // Deliberately no content-type: the runtime sets it with the boundary.
+        body = spec.multipart;
+    }
+    else if (spec.form) {
+        const form = new URLSearchParams();
+        for (const [key, value] of Object.entries(spec.form)) {
+            if (value !== undefined)
+                form.set(key, value);
+        }
+        headers["content-type"] = "application/x-www-form-urlencoded";
+        body = form.toString();
+    }
+    else if (spec.json !== undefined) {
+        headers["content-type"] = "application/json";
+        body = JSON.stringify(spec.json);
+    }
+    const idempotent = spec.method === "GET" || headers["idempotency-key"] !== undefined;
+    const attempts = idempotent ? options.maxRetries + 1 : 1;
+    let lastError;
+    for (let attempt = 0; attempt < attempts; attempt++) {
+        if (attempt > 0) {
+            // Honour the server's own Retry-After when it sent one; otherwise back
+            // off exponentially from 250ms, capped so a long outage doesn't park a
+            // request for minutes.
+            await sleep(Math.min(lastError?.retryAfterMs ?? 250 * 2 ** (attempt - 1), 8_000));
+        }
+        const timeout = AbortSignal.timeout(options.timeoutMs);
+        const signal = spec.signal ? AbortSignal.any([spec.signal, timeout]) : timeout;
+        let response;
+        try {
+            response = await options.fetch(url.toString(), { method: spec.method, headers, body, signal });
+        }
+        catch (cause) {
+            // A caller-supplied abort is a decision, not a fault - never retried.
+            if (spec.signal?.aborted)
+                throw cause;
+            lastError = new ConnectError({
+                status: 0,
+                code: "network_error",
+                message: `${endpoint} could not reach Connect`,
+                endpoint,
+                cause,
+            });
+            continue;
+        }
+        if (response.ok) {
+            if (spec.raw)
+                return response;
+            return (await readBody(response));
+        }
+        lastError = toConnectError(response, await readBody(response), endpoint);
+        if (!RETRYABLE_STATUS.has(response.status))
+            throw lastError;
+    }
+    throw lastError;
+}

package/dist/esm/server/index.js

@@ -0,0 +1,10 @@
+/**
+ * Server-only half of `@cosmoops/connect-sdk`.
+ *
+ * Everything here handles the API key, so none of it may run in a browser.
+ * The browser half is `@cosmoops/connect-sdk/client`, which talks to your own
+ * origin and reaches Connect through `createConnectHandler` below.
+ */
+export { ConnectClient, DEFAULT_BASE_URL, SDK_VERSION } from "./client.js";
+export { createConnectHandler } from "./handler.js";
+export { createState } from "./resources/identity.js";

package/dist/esm/server/resources/access.js

@@ -0,0 +1,24 @@
+import { pathSegment, request } from "../http.js";
+/** What a signed-in member may do on your service, and the role catalog behind it. */
+export class AccessResource {
+    transport;
+    constructor(transport) {
+        this.transport = transport;
+    }
+    /**
+     * Re-check one member's role and granted permissions, live. The same block
+     * `identity.getUser()` returns - use this when you need only the role axis
+     * and already know who the user is.
+     */
+    getUserRoles(userId, input) {
+        return request(this.transport, {
+            method: "GET",
+            path: `/rbac/users/${pathSegment(userId, "userId")}/roles`,
+            query: { organizationId: input.organizationId },
+        });
+    }
+    /** Your service's own permission catalog and role definitions - the definitions `getUserRoles` resolves against. */
+    listRoles() {
+        return request(this.transport, { method: "GET", path: "/roles" });
+    }
+}

package/dist/esm/server/resources/ai.js

@@ -0,0 +1,32 @@
+import { request } from "../http.js";
+/** RAG chat and structured extraction against an organization's data. */
+export class AiResource {
+    transport;
+    constructor(transport) {
+        this.transport = transport;
+    }
+    /**
+     * RAG-grounded chat. Returns the raw streaming `Response` rather than a
+     * parsed body - this endpoint answers with server-sent events, and buffering
+     * it here would throw away the only reason to stream. Pipe
+     * `response.body` onward, or hand it to the AI SDK's own reader.
+     */
+    chat(input, options = {}) {
+        return request(this.transport, {
+            method: "POST",
+            path: "/ai/chat",
+            json: input,
+            raw: true,
+            signal: options.signal,
+        });
+    }
+    /** Extract structured JSON from a file or image URL, against a platform extraction schema referenced by id. */
+    async extract(input) {
+        const result = await request(this.transport, {
+            method: "POST",
+            path: "/ai/extract",
+            json: input,
+        });
+        return result.data;
+    }
+}