@cosmoops/connect-sdk 0.20.0 → 0.21.0

package/dist/cjs/server/handler.js

@@ -105,6 +105,7 @@ function createConnectHandler(options) {
     const defaultRedirect = options.defaultRedirect ?? "/";
     const stateCookieName = options.stateCookieName ?? "connect_oauth_state";
     const silentCookieName = `${stateCookieName}_silent`;
+    const pkceCookieName = `${stateCookieName}_pkce`;
     const callbackPath = `${basePath}/callback`;
     /**
      * Short-lived, httpOnly, and `SameSite=Lax` - `Strict` would not be sent on
@@ -151,6 +152,35 @@ function createConnectHandler(options) {
             .filter(Boolean)
             .join("; ");
     }
+    /**
+     * Holds the One Tap PKCE **verifier** for the few seconds between the tap and
+     * the exchange.
+     *
+     * This is the cookie the whole no-navigation flow rests on. Connect hands the
+     * authorization code to the *page*, so the code alone must not be enough to
+     * mint a session - the verifier is what completes it, and it never leaves
+     * this origin's cookie jar. `SameSite=Lax` is sufficient and correct: unlike
+     * the state cookie there is no cross-site redirect that has to carry it, and
+     * `Lax` additionally means a cross-site `POST` to `/one-tap/complete` arrives
+     * without it and simply fails.
+     *
+     * Five minutes, not the state cookie's fifteen: it is minted on the tap and
+     * spent on the next request, so a long window is only a longer chance for a
+     * stale one to be lying around.
+     */
+    function pkceCookie(value, secure) {
+        const cleared = value === "";
+        return [
+            `${pkceCookieName}=${encodeURIComponent(value)}`,
+            `Path=${basePath}`,
+            "HttpOnly",
+            "SameSite=Lax",
+            secure ? "Secure" : "",
+            cleared ? "Max-Age=0" : "Max-Age=300",
+        ]
+            .filter(Boolean)
+            .join("; ");
+    }
     async function requireToken(request) {
         const token = await session.read(request);
         if (!token) {
@@ -258,6 +288,14 @@ function createConnectHandler(options) {
             },
         });
     }
+    /**
+     * Where the browser asks Connect about the visitor, and where it asks for a
+     * code once they tap - or `null` when this deployment cannot run One Tap at
+     * all (no `clientId`, or a session store that cannot `write`, in which case
+     * `/one-tap/complete` does not exist and offering the prompt would strand
+     * anyone who used it).
+     */
+    const oneTapEndpoints = session.write ? client.identity.oneTapEndpoints() : null;
     const routes = {
         "GET /session": async (request) => {
             const token = await session.read(request);
@@ -267,9 +305,21 @@ function createConnectHandler(options) {
             // the client never has to tell "signed out" from "signed in with no
             // role" by which keys happen to be present.
             if (!token) {
-                return json({ user: null, subscription: null, role: null, permissions: [], staff: false });
+                return json({
+                    user: null,
+                    subscription: null,
+                    role: null,
+                    permissions: [],
+                    staff: false,
+                    // Carried on the read the provider already makes on mount, so One Tap
+                    // costs no extra round trip to discover where to ask. Present on both
+                    // branches even though only the signed-out one can use it: a response
+                    // whose shape depends on the answer is a response consumers start
+                    // testing for key presence instead of value.
+                    oneTap: oneTapEndpoints,
+                });
             }
-            return json(await client.identity.getUser(token));
+            return json({ ...(await client.identity.getUser(token)), oneTap: oneTapEndpoints });
         },
         "GET /entitlements": async (request) => {
             const { workspaceId } = await requireWorkspace(request);
@@ -704,6 +754,74 @@ function createConnectHandler(options) {
             await session.write(request, response, result.sessionToken);
             return response;
         },
+        /**
+         * One Tap, step one: mint the PKCE pair, keep the verifier here, hand the
+         * challenge to the page.
+         *
+         * Called on the *tap*, not on mount, so the five-minute verifier is minted
+         * seconds before it is spent rather than sitting in a cookie for as long as
+         * someone leaves the prompt on screen.
+         *
+         * A `POST` despite reading nothing: it sets a cookie, and a `GET` that
+         * changes state is both wrong and prefetchable - a link prefetcher or a
+         * scanner would silently rotate the verifier out from under an open prompt.
+         */
+        "POST /one-tap/start": async (request) => {
+            const url = new URL(request.url);
+            const { verifier, challenge } = await (0, identity_js_1.createPkcePair)();
+            const response = json({
+                codeChallenge: challenge,
+                // The already-registered callback URI. One Tap never navigates to it -
+                // it is the value the code is *bound* to, and it must be byte-identical
+                // at `/one-tap/complete`, so both ends derive it the same way the
+                // redirect flow does rather than accepting it from the page.
+                redirectUri: `${url.origin}${callbackPath}`,
+            });
+            response.headers.append("set-cookie", pkceCookie(verifier, url.protocol === "https:"));
+            return response;
+        },
+        /**
+         * One Tap, step two: trade the page's code for a session, using the
+         * verifier the page never saw.
+         *
+         * This is `GET /callback`'s body without the navigation - same exchange,
+         * same verify-before-store ordering, same session store. The verifier is
+         * what makes the difference: a code lifted out of the browser cannot be
+         * redeemed anywhere else, because the exchange is refused without it.
+         */
+        "POST /one-tap/complete": async (request) => {
+            const url = new URL(request.url);
+            const secure = url.protocol === "https:";
+            const clearPkce = pkceCookie("", secure);
+            const verifier = readCookie(request, pkceCookieName);
+            if (!verifier) {
+                // The prompt sat unanswered past the cookie's life, or a cross-site
+                // `POST` arrived without it. Either way there is nothing to complete,
+                // and the client falls back to the interactive flow.
+                const expired = json({ error: "expired" }, 400);
+                expired.headers.append("set-cookie", clearPkce);
+                return expired;
+            }
+            const body = (await request.json().catch(() => null));
+            const code = typeof body?.code === "string" ? body.code : null;
+            if (!code) {
+                const invalid = json({ error: "invalid_request" }, 400);
+                invalid.headers.append("set-cookie", clearPkce);
+                return invalid;
+            }
+            const result = await client.identity.exchangeCode({
+                code,
+                redirectUri: `${url.origin}${callbackPath}`,
+                codeVerifier: verifier,
+            });
+            // Verified before the session is stored, exactly as the callback does -
+            // an unverifiable token must never become a signed-in user.
+            await client.identity.verifyIdToken(result.idToken);
+            const response = json({ ok: true });
+            response.headers.append("set-cookie", clearPkce);
+            await session.write(request, response, result.sessionToken);
+            return response;
+        },
         "POST /logout": async (request) => {
             const token = await session.read(request);
             const response = json({ ok: true });
@@ -722,6 +840,12 @@ function createConnectHandler(options) {
     if (!session.write) {
         delete routes["GET /signin"];
         delete routes["GET /callback"];
+        // Same reason, and `oneTapEndpoints` is already `null` above so the client
+        // never offers the prompt in the first place - this is the second half of
+        // that, so a hand-written call cannot reach a route that would throw on
+        // `session.write!`.
+        delete routes["POST /one-tap/start"];
+        delete routes["POST /one-tap/complete"];
         // A switch rotates the session token. Without somewhere to persist the new
         // one, the old one would be revoked and the user silently signed out - so
         // the route does not exist rather than working once and breaking.

package/dist/cjs/server/resources/calls.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CallsResource = void 0;
+const http_js_1 = require("../http.js");
+/**
+ * Every call that arrived on a channel assigned to your application.
+ *
+ * The application is resolved from your API key and is never a parameter, so
+ * there is no request that reads another partner's calls.
+ *
+ * `channelId` is the only filter, and that is a budget decision rather than an
+ * oversight: each filter costs a Firestore composite index against a project
+ * already near its ceiling. Filter the rest client-side, or read the
+ * aggregates from `analytics`.
+ */
+class CallsResource {
+    transport;
+    constructor(transport) {
+        this.transport = transport;
+    }
+    /**
+     * Your calls, newest first, across all of your subscribing workspaces.
+     *
+     * **Page until `hasMore` is `false`; do not stop on an empty `items`.** A
+     * page can come back empty with more behind it.
+     */
+    list(input = {}) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "GET",
+            path: "/calls",
+            query: {
+                channelId: input.channelId,
+                cursor: input.cursor,
+                limit: input.limit === undefined ? undefined : String(input.limit),
+            },
+        });
+    }
+    /**
+     * One call and every transcript turn, ordered by `sequence` - which is the
+     * sort to trust, since two turns can share a millisecond.
+     *
+     * `recordingFileId` and `transcriptFileId` are Drive file ids, readable with
+     * a `drive:read` key. Both are `null` until the carrier posts the audio,
+     * which is the normal state for a call that has only just ended - branch on
+     * `recordingStatus` rather than treating `null` as a failure.
+     *
+     * Throws `ConnectError` with `code: "not_found"` for a call that does not
+     * exist *or* belongs to another application.
+     */
+    get(callId) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "GET",
+            path: `/calls/${encodeURIComponent(callId)}`,
+        });
+    }
+}
+exports.CallsResource = CallsResource;

package/dist/cjs/server/resources/channels.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChannelsResource = void 0;
+const http_js_1 = require("../http.js");
+/**
+ * The phone numbers Connect has assigned to your application.
+ *
+ * **Inventory is platform-owned.** A number is a regulated asset bought under
+ * Connect's carrier account and reassignable between workspaces, so your
+ * application never provisions, prices or releases one - it claims from a pool
+ * it cannot see, and reads back what it was given. That is why `claim` takes a
+ * workspace and a kind rather than a number, and why nothing here exposes a
+ * carrier, a provider reference or a monthly rate.
+ *
+ * The application is resolved from your API key and is never a parameter, so
+ * no request shape here can reach another partner's channels. A channel
+ * belonging to someone else answers `404`, not `403` - confirming it exists
+ * would make these reads an oracle for enumerating their channel ids.
+ */
+class ChannelsResource {
+    transport;
+    constructor(transport) {
+        this.transport = transport;
+    }
+    /**
+     * Every channel assigned to your application, across all of your subscribing
+     * workspaces.
+     *
+     * Page until `hasMore` is `false`.
+     */
+    list(input = {}) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "GET",
+            path: "/channels",
+            query: {
+                workspaceId: input.workspaceId,
+                cursor: input.cursor,
+                limit: input.limit === undefined ? undefined : String(input.limit),
+            },
+        });
+    }
+    /**
+     * The channel behind an id you already hold - a webhook's `channelId`, or a
+     * call record's.
+     *
+     * Throws `ConnectError` with `code: "not_found"` for an id that does not
+     * exist *or* belongs to another application.
+     */
+    get(channelId) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "GET",
+            path: `/channels/${encodeURIComponent(channelId)}`,
+        });
+    }
+    /**
+     * Takes a number out of Connect's inventory and binds it to one of your
+     * subscribing workspaces.
+     *
+     * **You do not pick the number.** A workspace may hold exactly one, across
+     * every application it uses, and it is then fixed for the life of the
+     * engagement - there is no re-claim and no swap. Only a Connect operator can
+     * unassign one.
+     *
+     * Two different `409`s, and they need different handling: the workspace
+     * already holds a channel of this kind (fix the call), or the pool is empty
+     * right now (retry - Connect is notified, and this is not permanent).
+     *
+     * The claimed channel comes back without routing, because it has none yet.
+     * Call `setRouting` next, or the number refuses every call that reaches it.
+     */
+    claim(input) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "POST",
+            path: "/channels/claim",
+            json: { workspaceId: input.workspaceId, kind: input.kind ?? "voice" },
+        });
+    }
+    /**
+     * Points a channel at wherever inbound conversations should go.
+     *
+     * `destination` is yours: Connect stores it verbatim and never reads into
+     * it. It **replaces** the stored record rather than merging, so send the
+     * whole destination each time; it must serialize to 16 KB or fewer.
+     *
+     * Throws `code: "conflict"` when the channel is suspended or released - use
+     * `clearRouting` to stop a suspended number answering, which is deliberately
+     * still allowed.
+     */
+    setRouting(channelId, destination) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "PUT",
+            path: `/channels/${encodeURIComponent(channelId)}/routing`,
+            json: { destination },
+        });
+    }
+    /**
+     * Takes a number out of service without giving it up - the channel stays
+     * assigned to you and stays billable, and inbound calls are refused until
+     * you write routing again.
+     *
+     * This is the only way to say "stop answering": overwriting `destination`
+     * can only ever point the number somewhere *else*, and unassigning it is a
+     * Console action that returns the number to Connect's inventory.
+     *
+     * Idempotent - clearing already-clear routing answers `200` with
+     * `routing: null`, so a retry after a lost response is safe.
+     */
+    clearRouting(channelId) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "DELETE",
+            path: `/channels/${encodeURIComponent(channelId)}/routing`,
+        });
+    }
+}
+exports.ChannelsResource = ChannelsResource;

package/dist/cjs/server/resources/identity.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.IdentityResource = void 0;
 exports.createState = createState;
+exports.createPkcePair = createPkcePair;
 const errors_js_1 = require("../../errors.js");
 const http_js_1 = require("../http.js");
 /** A URL-safe random string, suitable for `state` or a PKCE verifier. */
@@ -16,6 +17,23 @@ function base64UrlEncode(bytes) {
         binary += String.fromCharCode(byte);
     return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
+/**
+ * Mints a PKCE pair for the One Tap flow.
+ *
+ * The redirect flow can take PKCE or leave it, because the code is delivered
+ * to the application's server on a redirect the browser only forwards. One Tap
+ * hands the code *to the page*, so the verifier is the thing that makes a
+ * stolen code worthless - it stays in an `HttpOnly` cookie on the application's
+ * own origin and is never sent to the browser.
+ *
+ * `crypto.subtle` rather than a Node hash, so this stays isomorphic and the
+ * `./next` entry keeps loading on the edge runtime as well as Node.
+ */
+async function createPkcePair() {
+    const verifier = createState(32);
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+    return { verifier, challenge: base64UrlEncode(new Uint8Array(digest)) };
+}
 function base64UrlDecode(value) {
     const padded = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
     const binary = atob(padded);
@@ -54,6 +72,28 @@ class IdentityResource {
         }
         return url.toString();
     }
+    /**
+     * The two Connect endpoints One Tap talks to **from the browser**, or `null`
+     * when this client has no `clientId` configured and the flow cannot run.
+     *
+     * Handed out by the bridge rather than built in the page, so One Tap needs no
+     * client-side configuration at all - a `./next` application sets
+     * `CONNECT_CLIENT_ID` server-side and nothing else. Both URLs carry only the
+     * public `client_id`; neither is a credential.
+     *
+     * Returning `null` rather than throwing (as `authorizeUrl` does) because this
+     * is read on the `/session` route, which must keep answering for an
+     * application that has no OAuth client configured at all.
+     */
+    oneTapEndpoints() {
+        if (!this.clientId)
+            return null;
+        const hint = new URL("/api/sso/session-hint", this.appBaseUrl);
+        hint.searchParams.set("client_id", this.clientId);
+        const authorize = new URL("/api/sso/authorize/one-tap", this.appBaseUrl);
+        authorize.searchParams.set("client_id", this.clientId);
+        return { hintUrl: hint.toString(), authorizeUrl: authorize.toString() };
+    }
     /** Step 2 - trade the one-time `code` for a session. Server-side only. */
     async exchangeCode(input) {
         const wire = await this.post("/sso/token", {

package/dist/esm/client/components/identity.js

@@ -0,0 +1,21 @@
+/**
+ * How a person is rendered when there is no photo to render.
+ *
+ * Shared rather than copied because two surfaces showing *different* initials
+ * for the same account reads as a bug in the account, not in the component -
+ * and the One Tap prompt and the user menu are frequently on screen within
+ * seconds of each other.
+ */
+/**
+ * Up to two letters standing for a person.
+ *
+ * Splits on the punctuation an email address uses as well as whitespace, so
+ * `priya.nair@acme.test` yields `PN` rather than `PR` - an account with no
+ * display name is exactly the case the fallback exists for, and taking the
+ * first two characters of a local part would make it useless there.
+ */
+export function initials(name, email = null) {
+    const source = name?.trim() || email?.trim() || "";
+    const parts = source.split(/[\s@._-]+/).filter(Boolean);
+    return (parts.slice(0, 2).map((part) => part[0]).join("") || "?").toUpperCase();
+}

package/dist/esm/client/components/one-tap-state.js

@@ -0,0 +1,90 @@
+/**
+ * How long One Tap stays quiet, and why.
+ *
+ * A prompt that reappears on every page load after being closed is not a
+ * convenience, it is an interstitial. Two things silence it, both stored in the
+ * application's own `localStorage` - nothing here leaves the browser, and
+ * nothing here is a security control:
+ *
+ * - **Dismissal, escalating.** Closing it once is "not now"; closing it three
+ *   times is "stop asking". The backoff says that back.
+ * - **Signing out.** Someone who has just signed out of this application does
+ *   not want to be offered the same account back on the next render. That is a
+ *   different fact from a dismissal, so it does not consume a dismissal, but it
+ *   buys a day of quiet.
+ *
+ * Every access is wrapped: `localStorage` throws outright in some embedded and
+ * privacy-restricted contexts, and a prompt is never worth breaking a page for.
+ * A read that fails reads as "not suppressed", which is the same state a fresh
+ * browser is in.
+ */
+const STORAGE_KEY = "connect_one_tap";
+/** Escalating quiet after 1, 2, and 3-or-more dismissals. */
+const DISMISS_BACKOFF_MS = [2 * 60 * 60 * 1000, 24 * 60 * 60 * 1000, 7 * 24 * 60 * 60 * 1000];
+const SIGN_OUT_QUIET_MS = 24 * 60 * 60 * 1000;
+function read() {
+    const empty = { dismissals: 0, until: 0 };
+    if (typeof window === "undefined")
+        return empty;
+    try {
+        const raw = window.localStorage.getItem(STORAGE_KEY);
+        if (!raw)
+            return empty;
+        const parsed = JSON.parse(raw);
+        return {
+            dismissals: typeof parsed.dismissals === "number" ? parsed.dismissals : 0,
+            until: typeof parsed.until === "number" ? parsed.until : 0,
+        };
+    }
+    catch {
+        return empty;
+    }
+}
+function write(state) {
+    if (typeof window === "undefined")
+        return;
+    try {
+        window.localStorage.setItem(STORAGE_KEY, JSON.stringify(state));
+    }
+    catch {
+        // Storage is full, blocked, or unavailable. The prompt simply keeps its
+        // default behaviour rather than the page failing.
+    }
+}
+/**
+ * Whether the prompt may be shown at all.
+ *
+ * Read once when the component mounts, never during render: `localStorage` is
+ * external mutable state, and reading it in a render body is impure - with the
+ * React Compiler on, exactly the kind of thing that can be hoisted into the
+ * wrong answer. Same reasoning as `ConnectProvider`'s `silentAttemptSpent`.
+ */
+export function oneTapSuppressed() {
+    return Date.now() < read().until;
+}
+/** Records a close, and escalates how long the next quiet period lasts. */
+export function dismissOneTap() {
+    const { dismissals } = read();
+    const next = dismissals + 1;
+    const backoff = DISMISS_BACKOFF_MS[Math.min(next, DISMISS_BACKOFF_MS.length) - 1];
+    write({ dismissals: next, until: Date.now() + backoff });
+}
+/**
+ * Silences the prompt after an explicit sign-out, without spending a dismissal.
+ * Signing out is not a complaint about the prompt, so it must not push someone
+ * closer to the seven-day backoff.
+ */
+export function suppressOneTapAfterSignOut() {
+    write({ dismissals: read().dismissals, until: Date.now() + SIGN_OUT_QUIET_MS });
+}
+/** Clears the record once a sign-in actually happens - the prompt did its job. */
+export function clearOneTapSuppression() {
+    if (typeof window === "undefined")
+        return;
+    try {
+        window.localStorage.removeItem(STORAGE_KEY);
+    }
+    catch {
+        // See `write`.
+    }
+}

package/dist/esm/client/components/one-tap.js

@@ -0,0 +1,103 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useCallback, useEffect, useState } from "react";
+import { X } from "lucide-react";
+import { Avatar, Button, Card } from "@heroui/react";
+import { useConnect } from "../provider.js";
+import { ConnectMark } from "../mark.js";
+import { initials } from "./identity.js";
+import { ENTER, m, MotionProvider } from "./motion.js";
+import { dismissOneTap, oneTapSuppressed } from "./one-tap-state.js";
+export function ConnectOneTap({ onInteractiveSignIn, className = "" }) {
+    const { session, isLoading, signIn, readOneTapHint, oneTapSignIn } = useConnect();
+    const [hint, setHint] = useState(null);
+    const [phase, setPhase] = useState("hidden");
+    /**
+     * Sampled once at mount rather than read during render, for the same reason
+     * `ConnectProvider` samples its silent-attempt marker that way: `localStorage`
+     * is external mutable state and reading it in a render body is impure.
+     * `false` on the server, which is correct - nothing renders until the hint
+     * has resolved on the client anyway.
+     */
+    const [suppressed] = useState(() => typeof window !== "undefined" && oneTapSuppressed());
+    const signedOut = !isLoading && !session?.user;
+    const askable = signedOut && !suppressed && Boolean(session?.oneTap);
+    useEffect(() => {
+        if (!askable)
+            return;
+        // Nothing here is a synchronous `setState` in an effect: every write
+        // happens after awaiting the network. The flag is what stops a late answer
+        // landing on a component that has already unmounted.
+        let cancelled = false;
+        void readOneTapHint().then((answer) => {
+            if (cancelled)
+                return;
+            // A visitor Connect does not recognise is the common case and gets
+            // nothing - no prompt, no flicker, no trace that a question was asked.
+            if (!answer || answer.status !== "signed_in")
+                return;
+            setHint(answer);
+            setPhase("offered");
+        });
+        return () => {
+            cancelled = true;
+        };
+    }, [askable, readOneTapHint]);
+    const handoff = useCallback(() => {
+        setPhase("hidden");
+        if (onInteractiveSignIn)
+            onInteractiveSignIn();
+        else
+            signIn();
+    }, [onInteractiveSignIn, signIn]);
+    const accept = useCallback(async () => {
+        // A visitor who has never authorised this application cannot be signed in
+        // silently and Connect would refuse anyway, so the tap goes straight to the
+        // screen that can ask them properly.
+        if (!hint?.consented) {
+            handoff();
+            return;
+        }
+        setPhase("working");
+        const result = await oneTapSignIn();
+        if (result.ok) {
+            // The provider has already refreshed the session; this component
+            // disappears because `signedOut` is now false.
+            setPhase("hidden");
+            return;
+        }
+        // `consent_required` and `interaction_required` both mean a screen is
+        // genuinely needed. `login_required` means the Connect session went away
+        // between the hint and the tap. All three are handed to the interactive
+        // flow, which can explain itself; a rate limit or a transport failure just
+        // closes the prompt rather than blaming the visitor for tapping.
+        if (result.reason === "consent_required" ||
+            result.reason === "interaction_required" ||
+            result.reason === "login_required") {
+            handoff();
+            return;
+        }
+        setPhase("hidden");
+    }, [handoff, hint, oneTapSignIn]);
+    const dismiss = useCallback(() => {
+        dismissOneTap();
+        setPhase("hidden");
+    }, []);
+    if (phase === "hidden" || !hint)
+        return null;
+    const displayName = hint.user?.displayName ?? hint.user?.email ?? null;
+    const applicationName = hint.application?.name;
+    const busy = phase === "working";
+    return (_jsx(MotionProvider, { children: _jsx(m.div, { initial: { opacity: 0, y: 12 }, animate: { opacity: 1, y: 0 }, transition: ENTER, role: "dialog", "aria-label": applicationName ? `Continue to ${applicationName} with CosmoOps` : "Continue with CosmoOps", 
+            // Fixed, above ordinary content but below a modal: this is an offer,
+            // and it must never sit on top of something the visitor opened
+            // themselves.
+            className: `fixed inset-x-3 bottom-3 z-40 sm:inset-x-auto sm:right-4 sm:bottom-4 sm:w-80 ${className}`, onKeyDown: (event) => {
+                if (event.key === "Escape")
+                    dismiss();
+            }, children: _jsxs(Card, { className: "p-4 shadow-lg", children: [_jsxs("div", { className: "flex items-start gap-3", children: [hint.consented ? (_jsxs(Avatar, { size: "md", color: "accent", variant: "soft", className: "shrink-0 rounded-full", children: [hint.user?.photoUrl && (_jsx(Avatar.Image, { alt: displayName ?? "Your account", src: hint.user.photoUrl })), _jsx(Avatar.Fallback, { children: initials(hint.user?.displayName ?? null, hint.user?.email ?? null) })] })) : (_jsx(ConnectMark, { className: "mt-0.5 size-8 shrink-0" })), _jsxs("div", { className: "min-w-0 flex-1", children: [_jsx("p", { className: "truncate text-sm font-medium text-foreground", children: hint.consented ? `Continue as ${displayName ?? "your account"}` : "You're signed in to CosmoOps" }), _jsx("p", { className: "truncate text-xs text-muted", children: hint.consented
+                                            ? [hint.user?.email, hint.workspace?.name].filter(Boolean).join(" · ")
+                                            : applicationName
+                                                ? `Continue to ${applicationName}`
+                                                : "Continue with your account" })] }), _jsx(Button, { variant: "tertiary", size: "sm", isIconOnly: true, "aria-label": "Not now", onPress: dismiss, isDisabled: busy, children: _jsx(X, { className: "size-4" }) })] }), _jsxs(Button, { variant: "secondary", className: "mt-3 w-full", onPress: () => void accept(), isPending: busy, children: [_jsx(ConnectMark, { className: "size-4" }), busy ? "Signing you in…" : "Continue"] })] }) }) }));
+}

package/dist/esm/client/components/user-menu.js

@@ -4,6 +4,7 @@ import { Avatar, Button, Chip, Modal, Skeleton, ToggleButton, ToggleButtonGroup,
 import { ChevronsUpDown, CreditCard, ExternalLink, Laptop, LogOut, Moon, ReceiptText, Sun, UserRound, } from "lucide-react";
 import { useConnect } from "../provider.js";
 import { ConnectMark } from "../mark.js";
+import { initials } from "./identity.js";
 import { ConnectAccountSessions } from "./account-sessions.js";
 import { m } from "./motion.js";
 import { SidebarLabel, sidebarRowClass, useConnectShell } from "./shell-context.js";
@@ -13,11 +14,6 @@ const THEME_OPTIONS = [
     { value: "dark", label: "Dark", icon: Moon },
     { value: "system", label: "System", icon: Laptop },
 ];
-function initials(name, email) {
-    const source = name?.trim() || email?.trim() || "";
-    const parts = source.split(/[\s@._-]+/).filter(Boolean);
-    return (parts.slice(0, 2).map((part) => part[0]).join("") || "?").toUpperCase();
-}
 function openExternal(url) {
     window.open(url, "_blank", "noopener,noreferrer");
 }

package/dist/esm/client/index.js

@@ -21,6 +21,7 @@ export { ConnectGrievanceNotice } from "./components/grievance-notice.js";
 export { ConnectMark } from "./mark.js";
 export { ConnectLogo } from "./components/logo.js";
 export { ConnectLoginButton, ConnectRegisterButton } from "./components/auth-buttons.js";
+export { ConnectOneTap } from "./components/one-tap.js";
 export { ConnectUserButton, ConnectProfileModal, 
 /** @deprecated Renamed to `ConnectUserButton`. */
 ConnectUserMenu, ConnectManageSubscriptionButton, ConnectInvoicesButton, ConnectProfileButton, ConnectHomeButton, ConnectSignOutButton, } from "./components/user-menu.js";