@cosmoops/connect-sdk 0.20.0 → 0.23.0

package/CHANGELOG.md

@@ -3,8 +3,289 @@
 `@cosmoops/connect-sdk` follows semver, with the 0.x convention that **minor
 versions may carry breaking changes** and patch versions never do.
 
+## 0.23.0
+
+### Added
+
+- **`CompanyProfile.legalJurisdiction`** - the seat a governing-law clause
+  names, e.g. `"Chennai, Tamil Nadu"`.
+
+  **This is not the registered address**, and that is why it is its own field
+  rather than something to derive. An entity registered in one state routinely
+  names another as the venue for disputes, and the applications that kept
+  their own copies of this had reached for the registered address instead -
+  publishing two different venues on two terms pages operated by the same
+  company. `null` when the operator has not published one, in which case a
+  terms page should omit the venue rather than substitute anything.
+
+- **`CompanyProfile.brandName` is now editable by the platform operator.** The
+  field is unchanged on the wire; what changed is that Connect served it from
+  a hardcoded constant until now, which made it the one company fact nobody
+  could correct without a deploy.
+
+### Changed
+
+- **`GET /company-profile` can now answer `503 unavailable`.** Connect used to
+  resolve every field against hardcoded defaults, so this endpoint always
+  answered - including with a legal name and grievance officer that nobody had
+  checked against the operator's own record. Those defaults are gone, and an
+  unconfigured platform refuses the read instead.
+
+  Nothing you wrote needs changing: `<ConnectGrievanceNotice />` already
+  renders `null` on failure, and `useConnectCompanyProfile()` surfaces it as
+  an error like any other. **Do not add a fallback of your own** - a copy kept
+  for outages is still a copy, and going stale is the failure this endpoint
+  exists to prevent.
+
+- **`connect.enrichment.company()`** - fill an account in from a work email
+  address, instead of asking somebody to type it.
+
+  ```ts
+  const result = await connect.enrichment.company({ email: "priya@acme.test" });
+  if (result.status === "enriched") {
+    form.setValues(result.profile); // then let the person confirm it
+  }
+  ```
+
+  Connect reads the company's **own website** - the domain your input yields,
+  plus About/Contact pages linked from its homepage - and returns what it found
+  with `citations` naming the URL each claim came from. It does not search the
+  web, and it never answers from a model's recall: a field the pages did not
+  state comes back `null`. An invented industry is indistinguishable from a
+  real one, and an invented address reaches an invoice.
+
+  `status: "skipped"` is a normal 200, not an error - most records legitimately
+  have nothing to enrich. `consumer_domain` (a `gmail.com` address names a
+  person, not an employer) and `blocked_domain` will never succeed on a retry;
+  `unreachable` and `no_signal` may. `confidence` is derived from how many
+  fields the pages actually supported, not from the model's opinion of itself,
+  so `low` means "offer this" and `high` means "safe to pre-fill".
+
+  Needs an API key scoped to the new **`enrichment:read`**. That is separate
+  from `ai:extract` because the two differ in what they touch rather than only
+  in what they cost: extraction reads a file you already hold, this makes
+  Connect fetch a third-party website on a string that reached you from a
+  stranger.
+
+- **`connect.workspaces.access()`, `.invite()`, `.setAccess()` and
+  `.revokeInvitation()`** - manage the customer's roster from inside your own
+  application, instead of sending them to Connect's team page.
+
+  `members()` has always been a read, so a partner's own team screen could
+  show who had access and then had to hand off to Connect for every change.
+  These four close that loop, and all of them take `asUser`: the workspace and
+  the actor come from the caller's session token, never from a parameter.
+
+  ```ts
+  const { capacity, viewer } = await connect.workspaces.access({ asUser: token });
+  if (viewer.canInvite && capacity.canAdd) {
+    await connect.workspaces.invite({ inviteeEmail: "priya@acme.test", roleKey: "rep" }, { asUser: token });
+  }
+  await connect.workspaces.setAccess({ userId, roleKey: null }, { asUser: token }); // revoke
+  ```
+
+  **You can only ever move your own application's grant.** The wire carries a
+  `roleKey` from your catalog rather than a roles array, and Connect computes
+  the member's next roles as *what they hold now, minus any grant naming your
+  application, plus yours* - so nothing these methods can express reaches a
+  workspace-wide Connect role, another application's access, or removes
+  someone from the workspace.
+
+  Two gates apply on top of the API key's new `members:manage` scope, and both
+  are about the person rather than your application: the signed-in caller must
+  hold Connect's own `member:invite` / `member:update` on the workspace, and
+  they cannot grant access they do not hold themselves. `viewer` on the
+  `access()` response is the first of those, resolved, so you can render your
+  controls from it instead of letting a button 403.
+
+  **Seats are the workspace's, not your plan's.** `capacity.included` is a
+  baseline plus every active subscription's member allowance folded across
+  applications, and `used` counts pending invitations as well as members,
+  because an invitation is a seat already spoken for. `reason` separates "no
+  plan grants member seats" (`no_allowance` - sell them one) from "every seat
+  is taken" (`exhausted` - an upgrade, or a removal); those read alike and
+  need different words on screen. The read is advisory - the authoritative
+  check runs inside `invite()`, which is where two people claiming the last
+  seat at once is settled.
+
+  `revokeInvitation()` is not optional decoration: an invitation sent to a
+  mistyped address holds a seat for its full seven days, and an application
+  that can spend one but not release it leaves a customer paying for a seat
+  nobody can use.
+
+  **Server-side only, deliberately.** None of the four is exposed through
+  `createConnectHandler`, which stays four fixed reads plus sign-out and the
+  workspace switch. A bridge route is a capability handed to any script
+  running in your page, and "grant this account admin" is the highest-value
+  one there is; call these from your own server, where the API key already
+  lives.
+
+## 0.22.0
+
+### Fixed
+
+- **`<ConnectGrievanceNotice />` rendered nothing for a signed-out visitor -
+  which is most of the people who read a privacy page.**
+
+  The bridge route `GET /company-profile` is deliberately unauthenticated: the
+  answer is a fact about the platform operator, identical for every caller and
+  already on the public web, and requiring a session would hide the redressal
+  channel at the one moment it most needs to be legible. The browser half
+  never got that exemption. `useConnectCompanyProfile` goes through
+  `useConnectResource`, which waits for `session.user` before it reads - right
+  for every other route, and the reason this component was blank on exactly
+  the public page the docs recommend putting it on.
+
+  `useConnectResource` now takes `{ requiresSession: false }`, and the company
+  profile is its only caller. It widens no access - the bridge decides that,
+  not the hook.
+
+- **`<ConnectPlans />`: a card reading "Subscribe" opened Connect's *change
+  plan* screen, which answered a 404.**
+
+  The label and the URL were two separate decisions. `resolveAction` needs the
+  **current plan** to classify a change and falls back to `"subscribe"`
+  without one; the checkout URL was built from the mere presence of a
+  subscription *row*. Those disagree in a state Connect reports routinely:
+  `SubscriptionResponse` carries `plan: null` beside a live `subscription`
+  whenever that plan has been deleted from the application's catalogue - which
+  re-seeding an application does. The button then said "Subscribe" and opened
+  `/billing/subscriptions/{id}/change-plan/{planId}`, where Connect could not
+  read the current price either and rendered its not-found page.
+
+  Both now come from the same `PlanAction`. When the grid cannot classify a
+  change it hands off to the subscribe route, which re-reads the workspace's
+  live subscriptions server-side and redirects to the change-plan screen
+  itself when there is genuinely one to change - so Connect decides, and the
+  grid does not have to be sure.
+
+### Added
+
+- **`checkoutSubscriptionId(action, current)`** - the other half of
+  `resolveAction`, exported alongside it. A partner writing its own pricing
+  grid has to turn that action into a checkout URL, and reading the
+  subscription id straight off the entitlements response is exactly the bug
+  above. Pass its result as `buildCheckoutUrl`'s `subscriptionId`.
+
+## 0.21.0
+
+### Added
+
+- **`<ConnectOneTap />`** - a signed-out visitor who is already signed into
+  Connect is offered their account, and one tap signs them in **without leaving
+  the page**.
+
+  ```tsx
+  <ConnectProvider>
+    <App />
+    <ConnectOneTap />
+  </ConnectProvider>
+  ```
+
+  That is the whole integration. It needs no `clientId` in the browser and no
+  configuration: the bridge already knows the client, and now tells the page
+  where to ask on the `/session` read it was making anyway, so discovering One
+  Tap costs no extra request.
+
+  **What it replaces.** `silentSignIn` answers the same question - *is this
+  visitor already signed into Connect?* - by bouncing the browser to Connect
+  and back with `prompt=none`. That costs a visible full-page navigation on the
+  first load of **every** signed-out visit, shows the visitor nothing while it
+  happens, and gives them no way to decline. One Tap asks with a single
+  `fetch`, names the account before anything is signed, and completes with no
+  navigation at all. `silentSignIn` still works and is unchanged; prefer this.
+
+  **It only appears when it can help.** A visitor Connect does not recognise
+  sees nothing, ever - no prompt, no flicker, no redirect - so this is safe to
+  mount unconditionally, which `silentSignIn` never was.
+
+  **Requires your application to be same-site with Connect** - a
+  `cosmoops.com` subdomain. `SameSite` is judged on the registrable domain, so
+  the visitor's Connect cookie rides along from `crm.cosmoops.com` and from
+  nowhere else. Deployed off-site, the prompt simply never appears and
+  `ConnectLoginButton` behaves exactly as before. No third-party cookie is
+  involved at any point, so this works in every browser rather than only in
+  Chromium.
+
+  **Two prompts, because consent is not assumed.** A visitor who has authorised
+  your application before gets their name, email, workspace and photo. One who
+  has not gets an impersonal prompt whose tap leads to the real consent
+  screen - Connect releases no identifying detail at all until that has
+  happened once.
+
+  **Dismissal is remembered.** Closing the prompt buys 2 hours of quiet, then a
+  day, then a week; signing out buys a day. All in your own origin's
+  `localStorage`, and none of it leaves the browser.
+
+- **`readOneTapHint()` and `oneTapSignIn()` on `useConnect()`** - the two calls
+  `<ConnectOneTap />` is built from, for applications that want to draw the
+  prompt themselves. Both report expected outcomes as values rather than
+  throwing: `consent_required` and `interaction_required` mean "hand off to the
+  interactive screen", which is a hand-off, not an error to show anybody.
+
+- **`ConnectSession.oneTap`** - where the browser may ask Connect about the
+  visitor, or `null` when this deployment cannot run One Tap (no `clientId`, or
+  a session store with no `write`). Present on the signed-in and signed-out
+  branches alike, so no consumer has to test for key presence.
+
+### Security
+
+- The One Tap exchange is **PKCE-bound, and the verifier never reaches the
+  page**. Connect hands the authorization code to the browser, so unlike the
+  redirect flow the code alone must not be redeemable: `/one-tap/start` mints
+  the pair and keeps the verifier in an `HttpOnly`, `SameSite=Lax` cookie on
+  your own origin, and `/one-tap/complete` is the only thing that can spend it.
+  A code lifted out of the browser, or replayed cross-site, is worthless.
+
 ## 0.20.0
 
+### Added
+
+- **`connect.channels` and `connect.calls`** - the phone numbers Connect has
+  assigned to your application, and the calls that arrived on them. Seven
+  endpoints that have been live on the API and reachable only by hand until
+  now.
+
+  ```ts
+  const { id } = await connect.channels.claim({ workspaceId });
+  await connect.channels.setRouting(id, { agent: "sales", afterHours: "voicemail" });
+
+  const { items } = await connect.calls.list({ channelId: id });
+  const { call, turns } = await connect.calls.get(items[0].id);
+  ```
+
+  **You never pick the number.** Inventory is a regulated asset bought under
+  Connect's carrier account, so `claim` takes a workspace and a kind and
+  Connect picks from a pool you cannot see - which is also why nothing here
+  exposes a carrier, a provider reference or a monthly rate. A workspace holds
+  exactly one number across every application it uses, and it is fixed for the
+  life of the engagement; only a Connect operator can unassign one. A `409`
+  means either "this workspace already has one" (fix the call) or "the pool is
+  empty right now" (retry - Connect is notified).
+
+  `setRouting`'s `destination` is an arbitrary JSON object Connect stores
+  verbatim and **never reads into**: which agent answers, business hours,
+  overflow and fallback are all your application's model. It replaces rather
+  than merges, and `clearRouting` is the only way to say "stop answering" -
+  overwriting a destination can only point the number somewhere else. Clearing
+  is idempotent and, unlike `setRouting`, is allowed on a suspended channel:
+  making a live number stop answering must never be the operation that is
+  unavailable.
+
+  `calls.list` filters on `channelId` and nothing else - each further filter
+  costs a Firestore composite index - and pages by cursor: **page until
+  `hasMore` is `false` rather than stopping on an empty `items`.**
+  `calls.get` adds the transcript, ordered by `sequence`, which is the sort to
+  trust since two turns can share a millisecond. `recordingFileId` and
+  `transcriptFileId` are Drive file ids readable with a `drive:read` key, and
+  are `null` until the carrier posts the audio - branch on `recordingStatus`
+  rather than reading `null` as a failure.
+
+  Scopes: `channels:read`, `channels:claim`, `channels:manage`, `calls:read`.
+  A channel or call belonging to another application answers `not_found`, not
+  `forbidden` - confirming it exists would make these reads an oracle for
+  enumerating another partner's ids.
+
 ### Changed
 
 - **The app launcher shows the whole catalogue, in two groups.**

package/README.md

@@ -343,6 +343,8 @@ try {
 | `billing` | `listPlans` · `getAddonUsage` · `consumeAddon` |
 | `drive` | `upload` · `getFileUrl` · `getPreviewUrl` |
 | `contacts` | `lookupByPhone` · `get` |
+| `channels` | `list` · `get` · `claim` · `setRouting` · `clearRouting` |
+| `calls` | `list` · `get` |
 | `scheduling` | `listEventTypes` · `findSlots` · `listBookings` · `createBooking` · `rescheduleBooking` · `cancelBooking` |
 | `ai` | `chat` · `extract` |
 | `otp` | `send` · `verify` |

package/dist/cjs/client/components/identity.js

@@ -0,0 +1,24 @@
+"use strict";
+/**
+ * How a person is rendered when there is no photo to render.
+ *
+ * Shared rather than copied because two surfaces showing *different* initials
+ * for the same account reads as a bug in the account, not in the component -
+ * and the One Tap prompt and the user menu are frequently on screen within
+ * seconds of each other.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initials = initials;
+/**
+ * Up to two letters standing for a person.
+ *
+ * Splits on the punctuation an email address uses as well as whitespace, so
+ * `priya.nair@acme.test` yields `PN` rather than `PR` - an account with no
+ * display name is exactly the case the fallback exists for, and taking the
+ * first two characters of a local part would make it useless there.
+ */
+function initials(name, email = null) {
+    const source = name?.trim() || email?.trim() || "";
+    const parts = source.split(/[\s@._-]+/).filter(Boolean);
+    return (parts.slice(0, 2).map((part) => part[0]).join("") || "?").toUpperCase();
+}

package/dist/cjs/client/components/one-tap-state.js

@@ -0,0 +1,96 @@
+"use strict";
+/**
+ * How long One Tap stays quiet, and why.
+ *
+ * A prompt that reappears on every page load after being closed is not a
+ * convenience, it is an interstitial. Two things silence it, both stored in the
+ * application's own `localStorage` - nothing here leaves the browser, and
+ * nothing here is a security control:
+ *
+ * - **Dismissal, escalating.** Closing it once is "not now"; closing it three
+ *   times is "stop asking". The backoff says that back.
+ * - **Signing out.** Someone who has just signed out of this application does
+ *   not want to be offered the same account back on the next render. That is a
+ *   different fact from a dismissal, so it does not consume a dismissal, but it
+ *   buys a day of quiet.
+ *
+ * Every access is wrapped: `localStorage` throws outright in some embedded and
+ * privacy-restricted contexts, and a prompt is never worth breaking a page for.
+ * A read that fails reads as "not suppressed", which is the same state a fresh
+ * browser is in.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oneTapSuppressed = oneTapSuppressed;
+exports.dismissOneTap = dismissOneTap;
+exports.suppressOneTapAfterSignOut = suppressOneTapAfterSignOut;
+exports.clearOneTapSuppression = clearOneTapSuppression;
+const STORAGE_KEY = "connect_one_tap";
+/** Escalating quiet after 1, 2, and 3-or-more dismissals. */
+const DISMISS_BACKOFF_MS = [2 * 60 * 60 * 1000, 24 * 60 * 60 * 1000, 7 * 24 * 60 * 60 * 1000];
+const SIGN_OUT_QUIET_MS = 24 * 60 * 60 * 1000;
+function read() {
+    const empty = { dismissals: 0, until: 0 };
+    if (typeof window === "undefined")
+        return empty;
+    try {
+        const raw = window.localStorage.getItem(STORAGE_KEY);
+        if (!raw)
+            return empty;
+        const parsed = JSON.parse(raw);
+        return {
+            dismissals: typeof parsed.dismissals === "number" ? parsed.dismissals : 0,
+            until: typeof parsed.until === "number" ? parsed.until : 0,
+        };
+    }
+    catch {
+        return empty;
+    }
+}
+function write(state) {
+    if (typeof window === "undefined")
+        return;
+    try {
+        window.localStorage.setItem(STORAGE_KEY, JSON.stringify(state));
+    }
+    catch {
+        // Storage is full, blocked, or unavailable. The prompt simply keeps its
+        // default behaviour rather than the page failing.
+    }
+}
+/**
+ * Whether the prompt may be shown at all.
+ *
+ * Read once when the component mounts, never during render: `localStorage` is
+ * external mutable state, and reading it in a render body is impure - with the
+ * React Compiler on, exactly the kind of thing that can be hoisted into the
+ * wrong answer. Same reasoning as `ConnectProvider`'s `silentAttemptSpent`.
+ */
+function oneTapSuppressed() {
+    return Date.now() < read().until;
+}
+/** Records a close, and escalates how long the next quiet period lasts. */
+function dismissOneTap() {
+    const { dismissals } = read();
+    const next = dismissals + 1;
+    const backoff = DISMISS_BACKOFF_MS[Math.min(next, DISMISS_BACKOFF_MS.length) - 1];
+    write({ dismissals: next, until: Date.now() + backoff });
+}
+/**
+ * Silences the prompt after an explicit sign-out, without spending a dismissal.
+ * Signing out is not a complaint about the prompt, so it must not push someone
+ * closer to the seven-day backoff.
+ */
+function suppressOneTapAfterSignOut() {
+    write({ dismissals: read().dismissals, until: Date.now() + SIGN_OUT_QUIET_MS });
+}
+/** Clears the record once a sign-in actually happens - the prompt did its job. */
+function clearOneTapSuppression() {
+    if (typeof window === "undefined")
+        return;
+    try {
+        window.localStorage.removeItem(STORAGE_KEY);
+    }
+    catch {
+        // See `write`.
+    }
+}

package/dist/cjs/client/components/one-tap.js

@@ -0,0 +1,106 @@
+"use client";
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConnectOneTap = ConnectOneTap;
+const jsx_runtime_1 = require("react/jsx-runtime");
+const react_1 = require("react");
+const lucide_react_1 = require("lucide-react");
+const react_2 = require("@heroui/react");
+const provider_js_1 = require("../provider.js");
+const mark_js_1 = require("../mark.js");
+const identity_js_1 = require("./identity.js");
+const motion_js_1 = require("./motion.js");
+const one_tap_state_js_1 = require("./one-tap-state.js");
+function ConnectOneTap({ onInteractiveSignIn, className = "" }) {
+    const { session, isLoading, signIn, readOneTapHint, oneTapSignIn } = (0, provider_js_1.useConnect)();
+    const [hint, setHint] = (0, react_1.useState)(null);
+    const [phase, setPhase] = (0, react_1.useState)("hidden");
+    /**
+     * Sampled once at mount rather than read during render, for the same reason
+     * `ConnectProvider` samples its silent-attempt marker that way: `localStorage`
+     * is external mutable state and reading it in a render body is impure.
+     * `false` on the server, which is correct - nothing renders until the hint
+     * has resolved on the client anyway.
+     */
+    const [suppressed] = (0, react_1.useState)(() => typeof window !== "undefined" && (0, one_tap_state_js_1.oneTapSuppressed)());
+    const signedOut = !isLoading && !session?.user;
+    const askable = signedOut && !suppressed && Boolean(session?.oneTap);
+    (0, react_1.useEffect)(() => {
+        if (!askable)
+            return;
+        // Nothing here is a synchronous `setState` in an effect: every write
+        // happens after awaiting the network. The flag is what stops a late answer
+        // landing on a component that has already unmounted.
+        let cancelled = false;
+        void readOneTapHint().then((answer) => {
+            if (cancelled)
+                return;
+            // A visitor Connect does not recognise is the common case and gets
+            // nothing - no prompt, no flicker, no trace that a question was asked.
+            if (!answer || answer.status !== "signed_in")
+                return;
+            setHint(answer);
+            setPhase("offered");
+        });
+        return () => {
+            cancelled = true;
+        };
+    }, [askable, readOneTapHint]);
+    const handoff = (0, react_1.useCallback)(() => {
+        setPhase("hidden");
+        if (onInteractiveSignIn)
+            onInteractiveSignIn();
+        else
+            signIn();
+    }, [onInteractiveSignIn, signIn]);
+    const accept = (0, react_1.useCallback)(async () => {
+        // A visitor who has never authorised this application cannot be signed in
+        // silently and Connect would refuse anyway, so the tap goes straight to the
+        // screen that can ask them properly.
+        if (!hint?.consented) {
+            handoff();
+            return;
+        }
+        setPhase("working");
+        const result = await oneTapSignIn();
+        if (result.ok) {
+            // The provider has already refreshed the session; this component
+            // disappears because `signedOut` is now false.
+            setPhase("hidden");
+            return;
+        }
+        // `consent_required` and `interaction_required` both mean a screen is
+        // genuinely needed. `login_required` means the Connect session went away
+        // between the hint and the tap. All three are handed to the interactive
+        // flow, which can explain itself; a rate limit or a transport failure just
+        // closes the prompt rather than blaming the visitor for tapping.
+        if (result.reason === "consent_required" ||
+            result.reason === "interaction_required" ||
+            result.reason === "login_required") {
+            handoff();
+            return;
+        }
+        setPhase("hidden");
+    }, [handoff, hint, oneTapSignIn]);
+    const dismiss = (0, react_1.useCallback)(() => {
+        (0, one_tap_state_js_1.dismissOneTap)();
+        setPhase("hidden");
+    }, []);
+    if (phase === "hidden" || !hint)
+        return null;
+    const displayName = hint.user?.displayName ?? hint.user?.email ?? null;
+    const applicationName = hint.application?.name;
+    const busy = phase === "working";
+    return ((0, jsx_runtime_1.jsx)(motion_js_1.MotionProvider, { children: (0, jsx_runtime_1.jsx)(motion_js_1.m.div, { initial: { opacity: 0, y: 12 }, animate: { opacity: 1, y: 0 }, transition: motion_js_1.ENTER, role: "dialog", "aria-label": applicationName ? `Continue to ${applicationName} with CosmoOps` : "Continue with CosmoOps", 
+            // Fixed, above ordinary content but below a modal: this is an offer,
+            // and it must never sit on top of something the visitor opened
+            // themselves.
+            className: `fixed inset-x-3 bottom-3 z-40 sm:inset-x-auto sm:right-4 sm:bottom-4 sm:w-80 ${className}`, onKeyDown: (event) => {
+                if (event.key === "Escape")
+                    dismiss();
+            }, children: (0, jsx_runtime_1.jsxs)(react_2.Card, { className: "p-4 shadow-lg", children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-start gap-3", children: [hint.consented ? ((0, jsx_runtime_1.jsxs)(react_2.Avatar, { size: "md", color: "accent", variant: "soft", className: "shrink-0 rounded-full", children: [hint.user?.photoUrl && ((0, jsx_runtime_1.jsx)(react_2.Avatar.Image, { alt: displayName ?? "Your account", src: hint.user.photoUrl })), (0, jsx_runtime_1.jsx)(react_2.Avatar.Fallback, { children: (0, identity_js_1.initials)(hint.user?.displayName ?? null, hint.user?.email ?? null) })] })) : ((0, jsx_runtime_1.jsx)(mark_js_1.ConnectMark, { className: "mt-0.5 size-8 shrink-0" })), (0, jsx_runtime_1.jsxs)("div", { className: "min-w-0 flex-1", children: [(0, jsx_runtime_1.jsx)("p", { className: "truncate text-sm font-medium text-foreground", children: hint.consented ? `Continue as ${displayName ?? "your account"}` : "You're signed in to CosmoOps" }), (0, jsx_runtime_1.jsx)("p", { className: "truncate text-xs text-muted", children: hint.consented
+                                            ? [hint.user?.email, hint.workspace?.name].filter(Boolean).join(" · ")
+                                            : applicationName
+                                                ? `Continue to ${applicationName}`
+                                                : "Continue with your account" })] }), (0, jsx_runtime_1.jsx)(react_2.Button, { variant: "tertiary", size: "sm", isIconOnly: true, "aria-label": "Not now", onPress: dismiss, isDisabled: busy, children: (0, jsx_runtime_1.jsx)(lucide_react_1.X, { className: "size-4" }) })] }), (0, jsx_runtime_1.jsxs)(react_2.Button, { variant: "secondary", className: "mt-3 w-full", onPress: () => void accept(), isPending: busy, children: [(0, jsx_runtime_1.jsx)(mark_js_1.ConnectMark, { className: "size-4" }), busy ? "Signing you in…" : "Continue"] })] }) }) }));
+}

package/dist/cjs/client/components/plan-pricing.js

@@ -28,6 +28,7 @@ exports.resolvePlanGroup = resolvePlanGroup;
 exports.groupPlansByTier = groupPlansByTier;
 exports.annualSaving = annualSaving;
 exports.resolveAction = resolveAction;
+exports.checkoutSubscriptionId = checkoutSubscriptionId;
 /**
  * Whether a plan costs nothing - the SDK's copy of Connect's `isFreeSelection`
  * (`packages/data/src/payments/free-plan.ts`), which is what the server
@@ -207,3 +208,30 @@ exports.ACTION_LABEL = {
     "switch-to-monthly": "Switch to monthly",
     subscribe: "Subscribe",
 };
+/**
+ * The subscription id a checkout hand-off should carry for `action` - or
+ * `null`, meaning "send them to Connect's *subscribe* screen".
+ *
+ * Paired with `resolveAction` deliberately: the button's label and the URL it
+ * opens are one decision, and deriving the URL from the mere *presence* of a
+ * subscription row instead is what sent a card reading "Subscribe" to
+ * Connect's change-plan screen, which answered `notFound()`.
+ *
+ * The gap is real rather than hypothetical. `resolveAction` needs the
+ * **current plan** to classify a change and answers `"subscribe"` without
+ * one - and `SubscriptionResponse` carries `plan: null` beside a perfectly
+ * live `subscription` whenever that plan has been deleted from the catalogue
+ * out from under it, which a re-seeded application does. Connect's change-plan
+ * route is stuck in the same place for the same reason: it cannot prorate
+ * against a price it cannot read.
+ *
+ * Sending those to `/apps/.../subscribe/...` is a real hand-off, not a guess:
+ * that route re-reads the workspace's live subscriptions server-side and
+ * redirects to the change-plan screen itself when there genuinely is one to
+ * change. Connect decides, so the grid does not have to be sure.
+ */
+function checkoutSubscriptionId(action, current) {
+    if (action === "subscribe")
+        return null;
+    return current?.subscription?.id ?? null;
+}

package/dist/cjs/client/components/plans.js

@@ -83,8 +83,13 @@ function ConnectPlans({ planIds, hideCoupon = false, className }) {
      * created in `"created"` and only flips to active when the payment webhook
      * lands, which can be minutes later. Holding a customer on a spinner until
      * then would misreport a completed checkout as an abandoned one.
+     *
+     * `action` is threaded through rather than re-derived: it is the same
+     * decision the card's label came from, and `checkoutSubscriptionId` is what
+     * keeps the two from disagreeing - see its doc comment for the 404 that
+     * disagreement produced.
      */
-    function startCheckout(plan) {
+    function startCheckout(plan, action) {
         if (!applicationId)
             return;
         checkout.start({
@@ -92,7 +97,7 @@ function ConnectPlans({ planIds, hideCoupon = false, className }) {
                 appUrl,
                 applicationId,
                 planId: plan.id,
-                subscriptionId: subscription?.subscription?.id ?? null,
+                subscriptionId: (0, plan_pricing_js_1.checkoutSubscriptionId)(action, subscription),
                 coupon,
             }),
             isSettled: (next) => next.subscription.plan?.id === plan.id,
@@ -142,7 +147,7 @@ function ConnectPlans({ planIds, hideCoupon = false, className }) {
                                             // plan would race the first and one of them would be
                                             // rejected on arrival.
                                             isDisabled: isCurrent || checkout.status === "waiting", onPress: () => setPending({ plan, action }), children: [plan_pricing_js_1.ACTION_LABEL[action], !isCurrent && (0, jsx_runtime_1.jsx)(lucide_react_1.ExternalLink, { className: "size-3.5" })] }) })] }) }, tier.planGroup));
-                    }) }), subscription?.subscription && ((0, jsx_runtime_1.jsx)(ConnectUnsubscribeRow, { subscription: subscription.subscription, appUrl: appUrl, checkout: checkout })), (0, jsx_runtime_1.jsx)(subscribe_dialog_js_1.ConnectSubscribeDialog, { plan: pending?.plan ?? null, action: pending?.action ?? "subscribe", current: subscription, coupon: hideCoupon ? undefined : coupon, onClose: () => setPending(null), onConfirm: () => pending && startCheckout(pending.plan) })] }) }));
+                    }) }), subscription?.subscription && ((0, jsx_runtime_1.jsx)(ConnectUnsubscribeRow, { subscription: subscription.subscription, appUrl: appUrl, checkout: checkout })), (0, jsx_runtime_1.jsx)(subscribe_dialog_js_1.ConnectSubscribeDialog, { plan: pending?.plan ?? null, action: pending?.action ?? "subscribe", current: subscription, coupon: hideCoupon ? undefined : coupon, onClose: () => setPending(null), onConfirm: () => pending && startCheckout(pending.plan, pending.action) })] }) }));
 }
 /**
  * What the page says while the customer is off in Connect, and after.

package/dist/cjs/client/components/user-menu.js

@@ -14,6 +14,7 @@ const react_1 = require("@heroui/react");
 const lucide_react_1 = require("lucide-react");
 const provider_js_1 = require("../provider.js");
 const mark_js_1 = require("../mark.js");
+const identity_js_1 = require("./identity.js");
 const account_sessions_js_1 = require("./account-sessions.js");
 const motion_js_1 = require("./motion.js");
 const shell_context_js_1 = require("./shell-context.js");
@@ -23,11 +24,6 @@ const THEME_OPTIONS = [
     { value: "dark", label: "Dark", icon: lucide_react_1.Moon },
     { value: "system", label: "System", icon: lucide_react_1.Laptop },
 ];
-function initials(name, email) {
-    const source = name?.trim() || email?.trim() || "";
-    const parts = source.split(/[\s@._-]+/).filter(Boolean);
-    return (parts.slice(0, 2).map((part) => part[0]).join("") || "?").toUpperCase();
-}
 function openExternal(url) {
     window.open(url, "_blank", "noopener,noreferrer");
 }
@@ -73,7 +69,7 @@ function UserAvatar({ user, size, }) {
     // squircle sitting beside circular status dots reads as a rendering fault
     // rather than a choice. The root is `overflow-hidden`, so rounding it here
     // rounds the image and the fallback with it.
-    (0, jsx_runtime_1.jsxs)(react_1.Avatar, { size: size, color: "accent", variant: "soft", className: "rounded-full", children: [user.photoUrl && (0, jsx_runtime_1.jsx)(react_1.Avatar.Image, { alt: "", src: user.photoUrl }), (0, jsx_runtime_1.jsx)(react_1.Avatar.Fallback, { children: initials(user.displayName, user.email) })] }));
+    (0, jsx_runtime_1.jsxs)(react_1.Avatar, { size: size, color: "accent", variant: "soft", className: "rounded-full", children: [user.photoUrl && (0, jsx_runtime_1.jsx)(react_1.Avatar.Image, { alt: "", src: user.photoUrl }), (0, jsx_runtime_1.jsx)(react_1.Avatar.Fallback, { children: (0, identity_js_1.initials)(user.displayName, user.email) })] }));
 }
 /** `dispatch_admin` / `billing-viewer` -> `Dispatch admin`. */
 function humanizeRole(role) {