@cosmoops/connect-sdk 0.20.0 → 0.23.0

package/dist/cjs/client/index.js

@@ -1,9 +1,9 @@
 "use client";
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.normalizePath = exports.flattenNav = exports.normalizeNav = exports.useActivePath = exports.ConnectSideNav = exports.ConnectSidebarNav = exports.RAIL_EXPANDED = exports.RAIL_COLLAPSED = exports.sidebarRowClass = exports.useConnectShell = exports.ConnectShellProvider = exports.ConnectSidebarRow = exports.ConnectSidebarFooter = exports.ConnectSidebarBody = exports.ConnectSidebarHeader = exports.ConnectSidebar = exports.AppShell = exports.ConnectAccountSessions = exports.ConnectSignOutButton = exports.ConnectHomeButton = exports.ConnectProfileButton = exports.ConnectInvoicesButton = exports.ConnectManageSubscriptionButton = exports.ConnectUserMenu = exports.ConnectProfileModal = exports.ConnectUserButton = exports.ConnectRegisterButton = exports.ConnectLoginButton = exports.ConnectLogo = exports.ConnectMark = exports.ConnectGrievanceNotice = exports.isConnectError = exports.ConnectError = exports.normalizePlanFeatures = exports.blockingBlockers = exports.CONNECT_APP_URL = exports.useConnectResource = exports.useConnectIntegrations = exports.useConnectSessions = exports.useConnectAddonUsage = exports.useConnectCompanyProfile = exports.useConnectApps = exports.useConnectPlans = exports.useConnectEntitlements = exports.useConnectPlatformAccess = exports.useConnectAudience = exports.useConnectWorkspaceType = exports.useConnectUser = exports.useConnect = exports.ConnectProvider = void 0;
-exports.annualSaving = exports.resolveAction = exports.monthlyOf = exports.formatPrice = exports.buildCheckoutUrl = exports.useConnectCheckout = exports.ConnectFilterTabs = exports.ConnectCursorPagination = exports.ConnectConfirmDialog = exports.ConnectLinkButton = exports.ConnectPlansPage = exports.ConnectUsageMeter = exports.ConnectPlatformGate = exports.ConnectWorkspaceTypeGate = exports.useConnectFeature = exports.ConnectFeatureGate = exports.useConnectAccessGate = exports.ConnectAccessGate = exports.ConnectReadinessGate = exports.ConnectReadinessBanner = exports.resolveSubscriptionState = exports.ConnectSeatUsage = exports.ConnectTrialBanner = exports.ConnectSubscriptionCard = exports.ConnectNoSubscriptionCard = exports.ConnectSubscriptionGate = exports.ConnectSubscribeDialog = exports.ConnectPlans = exports.ConnectIntegrationsModal = exports.AI_TONE_DOT = exports.AI_TONE_CHIP = exports.AI_EMPTY_VALUE = exports.aiStatusTone = exports.isNumericAiFormat = exports.formatAiValue = exports.AiSources = exports.AiSteps = exports.AiDetails = exports.AiTimeline = exports.AiMetrics = exports.AiChart = exports.AiTable = exports.ConnectAskAi = exports.ConnectAppsGrid = exports.isLinkableConnectScreen = exports.matchConnectScreen = exports.filterNavForAudience = exports.gateExemptPaths = exports.isNavItemActive = exports.resolveActivePath = void 0;
-exports.zonedInstant = exports.dayColumns = exports.layoutBookings = exports.useBookingActions = exports.useBookings = exports.useAvailableSlots = exports.useBookableEventTypes = exports.ConnectBookingDetail = exports.ConnectBookingDialog = exports.ConnectBookingCalendar = exports.useConnectWorkspaceMembers = exports.useConnectWorkspaces = exports.ConnectWorkspaceSwitcher = exports.resolvePlanGroup = exports.groupPlansByTier = exports.isFreePlan = exports.ACTION_LABEL = exports.discountLabel = void 0;
+exports.flattenNav = exports.normalizeNav = exports.useActivePath = exports.ConnectSideNav = exports.ConnectSidebarNav = exports.RAIL_EXPANDED = exports.RAIL_COLLAPSED = exports.sidebarRowClass = exports.useConnectShell = exports.ConnectShellProvider = exports.ConnectSidebarRow = exports.ConnectSidebarFooter = exports.ConnectSidebarBody = exports.ConnectSidebarHeader = exports.ConnectSidebar = exports.AppShell = exports.ConnectAccountSessions = exports.ConnectSignOutButton = exports.ConnectHomeButton = exports.ConnectProfileButton = exports.ConnectInvoicesButton = exports.ConnectManageSubscriptionButton = exports.ConnectUserMenu = exports.ConnectProfileModal = exports.ConnectUserButton = exports.ConnectOneTap = exports.ConnectRegisterButton = exports.ConnectLoginButton = exports.ConnectLogo = exports.ConnectMark = exports.ConnectGrievanceNotice = exports.isConnectError = exports.ConnectError = exports.normalizePlanFeatures = exports.blockingBlockers = exports.CONNECT_APP_URL = exports.useConnectResource = exports.useConnectIntegrations = exports.useConnectSessions = exports.useConnectAddonUsage = exports.useConnectCompanyProfile = exports.useConnectApps = exports.useConnectPlans = exports.useConnectEntitlements = exports.useConnectPlatformAccess = exports.useConnectAudience = exports.useConnectWorkspaceType = exports.useConnectUser = exports.useConnect = exports.ConnectProvider = void 0;
+exports.resolveAction = exports.monthlyOf = exports.formatPrice = exports.buildCheckoutUrl = exports.useConnectCheckout = exports.ConnectFilterTabs = exports.ConnectCursorPagination = exports.ConnectConfirmDialog = exports.ConnectLinkButton = exports.ConnectPlansPage = exports.ConnectUsageMeter = exports.ConnectPlatformGate = exports.ConnectWorkspaceTypeGate = exports.useConnectFeature = exports.ConnectFeatureGate = exports.useConnectAccessGate = exports.ConnectAccessGate = exports.ConnectReadinessGate = exports.ConnectReadinessBanner = exports.resolveSubscriptionState = exports.ConnectSeatUsage = exports.ConnectTrialBanner = exports.ConnectSubscriptionCard = exports.ConnectNoSubscriptionCard = exports.ConnectSubscriptionGate = exports.ConnectSubscribeDialog = exports.ConnectPlans = exports.ConnectIntegrationsModal = exports.AI_TONE_DOT = exports.AI_TONE_CHIP = exports.AI_EMPTY_VALUE = exports.aiStatusTone = exports.isNumericAiFormat = exports.formatAiValue = exports.AiSources = exports.AiSteps = exports.AiDetails = exports.AiTimeline = exports.AiMetrics = exports.AiChart = exports.AiTable = exports.ConnectAskAi = exports.ConnectAppsGrid = exports.isLinkableConnectScreen = exports.matchConnectScreen = exports.filterNavForAudience = exports.gateExemptPaths = exports.isNavItemActive = exports.resolveActivePath = exports.normalizePath = void 0;
+exports.zonedInstant = exports.dayColumns = exports.layoutBookings = exports.useBookingActions = exports.useBookings = exports.useAvailableSlots = exports.useBookableEventTypes = exports.ConnectBookingDetail = exports.ConnectBookingDialog = exports.ConnectBookingCalendar = exports.useConnectWorkspaceMembers = exports.useConnectWorkspaces = exports.ConnectWorkspaceSwitcher = exports.resolvePlanGroup = exports.groupPlansByTier = exports.isFreePlan = exports.ACTION_LABEL = exports.discountLabel = exports.annualSaving = exports.checkoutSubscriptionId = void 0;
 /**
  * Browser half of `@cosmoops/connect-sdk` - React components and hooks.
  *
@@ -50,6 +50,8 @@ Object.defineProperty(exports, "ConnectLogo", { enumerable: true, get: function
 var auth_buttons_js_1 = require("./components/auth-buttons.js");
 Object.defineProperty(exports, "ConnectLoginButton", { enumerable: true, get: function () { return auth_buttons_js_1.ConnectLoginButton; } });
 Object.defineProperty(exports, "ConnectRegisterButton", { enumerable: true, get: function () { return auth_buttons_js_1.ConnectRegisterButton; } });
+var one_tap_js_1 = require("./components/one-tap.js");
+Object.defineProperty(exports, "ConnectOneTap", { enumerable: true, get: function () { return one_tap_js_1.ConnectOneTap; } });
 var user_menu_js_1 = require("./components/user-menu.js");
 Object.defineProperty(exports, "ConnectUserButton", { enumerable: true, get: function () { return user_menu_js_1.ConnectUserButton; } });
 Object.defineProperty(exports, "ConnectProfileModal", { enumerable: true, get: function () { return user_menu_js_1.ConnectProfileModal; } });
@@ -208,6 +210,12 @@ var plan_pricing_js_1 = require("./components/plan-pricing.js");
 Object.defineProperty(exports, "formatPrice", { enumerable: true, get: function () { return plan_pricing_js_1.formatPrice; } });
 Object.defineProperty(exports, "monthlyOf", { enumerable: true, get: function () { return plan_pricing_js_1.monthlyOf; } });
 Object.defineProperty(exports, "resolveAction", { enumerable: true, get: function () { return plan_pricing_js_1.resolveAction; } });
+// The other half of `resolveAction`, and exported with it deliberately: a
+// partner writing its own pricing grid has to turn that action into a
+// checkout URL, and reading the subscription id straight off the
+// entitlements response instead is what sent a "Subscribe" button to
+// Connect's change-plan screen. See its doc comment.
+Object.defineProperty(exports, "checkoutSubscriptionId", { enumerable: true, get: function () { return plan_pricing_js_1.checkoutSubscriptionId; } });
 Object.defineProperty(exports, "annualSaving", { enumerable: true, get: function () { return plan_pricing_js_1.annualSaving; } });
 Object.defineProperty(exports, "discountLabel", { enumerable: true, get: function () { return plan_pricing_js_1.discountLabel; } });
 Object.defineProperty(exports, "ACTION_LABEL", { enumerable: true, get: function () { return plan_pricing_js_1.ACTION_LABEL; } });

package/dist/cjs/client/provider.js

@@ -20,6 +20,7 @@ exports.useConnectSessions = useConnectSessions;
 exports.useConnectResource = useConnectResource;
 const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = require("react");
+const one_tap_state_js_1 = require("./components/one-tap-state.js");
 exports.CONNECT_APP_URL = "https://connect.cosmoops.com";
 const ConnectContext = (0, react_1.createContext)(null);
 /** Marks that this tab has already spent its one silent attempt - see `ConnectProviderProps.silentSignIn`. */
@@ -204,8 +205,91 @@ function ConnectProvider({ clientId = "", basePath = "/api/connect", redirectUri
             credentials: "same-origin",
         }).catch(() => { });
         cache.current.clear();
+        // Someone who just signed out must not be offered the same account back on
+        // the next render - see `suppressOneTapAfterSignOut`.
+        (0, one_tap_state_js_1.suppressOneTapAfterSignOut)();
         setResult({ session: { user: null, subscription: null, role: null, permissions: [], staff: false, audience: null }, error: null });
     }, [basePath, fetchImpl]);
+    /**
+     * Where Connect answers One Tap, taken from the session read rather than
+     * assembled here - the bridge knows the `client_id` and the browser need not.
+     */
+    const oneTapEndpoints = result?.session.oneTap ?? null;
+    const readOneTapHint = (0, react_1.useCallback)(async () => {
+        if (!oneTapEndpoints)
+            return null;
+        try {
+            // `credentials: "include"` because this is the one request in the SDK
+            // that leaves the application's own origin. It carries the visitor's
+            // Connect cookie only when the two are same-site; everywhere else it is
+            // simply sent without one and comes back `signed_out`.
+            const response = await (fetchImpl ?? globalThis.fetch)(oneTapEndpoints.hintUrl, {
+                credentials: "include",
+                headers: { accept: "application/json" },
+            });
+            if (!response.ok)
+                return null;
+            return (await response.json());
+        }
+        catch {
+            // Offline, blocked, or Connect is down. None of those is evidence about
+            // whether this visitor has a session, so the honest answer is silence.
+            return null;
+        }
+    }, [fetchImpl, oneTapEndpoints]);
+    const oneTapSignIn = (0, react_1.useCallback)(async () => {
+        if (!oneTapEndpoints)
+            return { ok: false, reason: "unavailable" };
+        try {
+            // 1. The bridge mints the PKCE pair and keeps the verifier in an
+            //    `HttpOnly` cookie on this origin.
+            const start = await mutateResource("/one-tap/start");
+            // 2. Connect mints a code against that challenge. The custom header is
+            //    what forces the preflight, so an origin this client has not
+            //    registered is refused before the request is ever sent.
+            const authorize = await (fetchImpl ?? globalThis.fetch)(oneTapEndpoints.authorizeUrl, {
+                method: "POST",
+                credentials: "include",
+                headers: {
+                    accept: "application/json",
+                    "content-type": "application/json",
+                    "x-connect-one-tap": "1",
+                },
+                body: JSON.stringify({
+                    redirect_uri: start.redirectUri,
+                    code_challenge: start.codeChallenge,
+                }),
+            });
+            const body = (await authorize.json().catch(() => null));
+            if (!authorize.ok || !body?.code) {
+                // Connect names the reason, and each one has a different next step -
+                // `consent_required` wants the interactive screen, `rate_limited` wants
+                // to be left alone. Anything unrecognised is reported as a plain
+                // failure rather than guessed at.
+                const reason = body?.error;
+                return {
+                    ok: false,
+                    reason: reason === "login_required" ||
+                        reason === "consent_required" ||
+                        reason === "interaction_required" ||
+                        reason === "rate_limited"
+                        ? reason
+                        : "failed",
+                };
+            }
+            // 3. The bridge exchanges the code with the verifier the page never saw,
+            //    and stores the session.
+            await mutateResource("/one-tap/complete", { code: body.code });
+            // The prompt was accepted, so whatever backoff earlier dismissals had
+            // accumulated is spent - it described reluctance that no longer holds.
+            (0, one_tap_state_js_1.clearOneTapSuppression)();
+            await refresh();
+            return { ok: true };
+        }
+        catch {
+            return { ok: false, reason: "failed" };
+        }
+    }, [fetchImpl, mutateResource, oneTapEndpoints, refresh]);
     const value = (0, react_1.useMemo)(() => ({
         clientId,
         appUrl,
@@ -219,6 +303,8 @@ function ConnectProvider({ clientId = "", basePath = "/api/connect", redirectUri
         mutateResource,
         invalidateResource,
         streamResource,
+        readOneTapHint,
+        oneTapSignIn,
     }), [
         clientId,
         appUrl,
@@ -232,6 +318,8 @@ function ConnectProvider({ clientId = "", basePath = "/api/connect", redirectUri
         mutateResource,
         invalidateResource,
         streamResource,
+        readOneTapHint,
+        oneTapSignIn,
     ]);
     return (0, jsx_runtime_1.jsx)(ConnectContext.Provider, { value: value, children: children });
 }
@@ -320,7 +408,7 @@ function useConnectPlans() {
  * `CompanyProfile`. `<ConnectGrievanceNotice>` renders it for you.
  */
 function useConnectCompanyProfile() {
-    return useConnectResource("/company-profile");
+    return useConnectResource("/company-profile", { requiresSession: false });
 }
 /** The apps this workspace can open. */
 function useConnectApps() {
@@ -361,10 +449,15 @@ function useConnectSessions() {
 /**
  * One bridge read, shared through the provider's cache.
  *
- * Only fetches once a user is known: every resource route needs a session, so
- * firing before one exists just buys a guaranteed 401.
+ * Waits for a session by default: every resource route but one needs it, so
+ * firing before one exists just buys a guaranteed 401. `requiresSession:
+ * false` opts out, and the reason it exists is the grievance notice - a
+ * statutory contact is at its most useful on a public page a signed-out
+ * visitor is reading, so a hook that answered `null` until someone logged in
+ * would render nothing at exactly the moment that matters.
  */
-function useConnectResource(path) {
+function useConnectResource(path, options) {
+    const requiresSession = options?.requiresSession ?? true;
     const { fetchResource, session, isLoading: sessionLoading } = useConnect();
     // Stamped with the `path` it belongs to, so switching paths reports loading
     // without a synchronous `setIsLoading(true)` - and, more usefully, so a
@@ -375,7 +468,7 @@ function useConnectResource(path) {
         // Signed out is handled by derivation below rather than by writing state
         // here - a synchronous setState inside an effect costs an extra render pass
         // and is what `react-hooks/set-state-in-effect` exists to catch.
-        if (sessionLoading || !session?.user)
+        if (requiresSession && (sessionLoading || !session?.user))
             return;
         let active = true;
         fetchResource(path)
@@ -394,8 +487,10 @@ function useConnectResource(path) {
         // `version` is otherwise unread - it exists purely to force this effect
         // to re-run on `refetch()`, after the caller has already evicted this
         // path's cache entry via `mutateResource`.
-    }, [fetchResource, path, session?.user, sessionLoading, version]);
-    const signedOut = !sessionLoading && !session?.user;
+    }, [fetchResource, path, requiresSession, session?.user, sessionLoading, version]);
+    // A public read is never settled by the absence of a session - it is
+    // genuinely pending until the fetch lands.
+    const signedOut = requiresSession && !sessionLoading && !session?.user;
     const loaded = entry?.path === path ? entry : null;
     return {
         data: loaded?.data ?? null,

package/dist/cjs/server/client.js

@@ -4,10 +4,13 @@ exports.SDK_VERSION = exports.ConnectClient = exports.DEFAULT_BASE_URL = void 0;
 const access_js_1 = require("./resources/access.js");
 const apps_js_1 = require("./resources/apps.js");
 const ai_js_1 = require("./resources/ai.js");
+const enrichment_js_1 = require("./resources/enrichment.js");
 const data_js_1 = require("./resources/data.js");
 const workspaces_js_1 = require("./resources/workspaces.js");
 const scheduling_js_1 = require("./resources/scheduling.js");
 const contacts_js_1 = require("./resources/contacts.js");
+const channels_js_1 = require("./resources/channels.js");
+const calls_js_1 = require("./resources/calls.js");
 const kv_js_1 = require("./resources/kv.js");
 const billing_js_1 = require("./resources/billing.js");
 const drive_js_1 = require("./resources/drive.js");
@@ -85,8 +88,13 @@ class ConnectClient {
     scheduling;
     /** Who a workspace already knows how to reach, by phone or by id. */
     contacts;
+    /** The phone numbers Connect has assigned to your application, and where each one routes. */
+    channels;
+    /** The calls that arrived on those channels, with their transcripts. */
+    calls;
     /** RAG chat and structured extraction. */
     ai;
+    enrichment;
     /** Your application's own document store - see `DataResource`. */
     data;
     /** Your application's key/value store - see `KvResource`. */
@@ -135,7 +143,10 @@ class ConnectClient {
         this.drive = new drive_js_1.DriveResource(transport);
         this.scheduling = new scheduling_js_1.SchedulingResource(transport);
         this.contacts = new contacts_js_1.ContactsResource(transport);
+        this.channels = new channels_js_1.ChannelsResource(transport);
+        this.calls = new calls_js_1.CallsResource(transport);
         this.ai = new ai_js_1.AiResource(transport);
+        this.enrichment = new enrichment_js_1.EnrichmentResource(transport);
         this.data = new data_js_1.DataResource(transport);
         this.kv = new kv_js_1.KvResource(transport);
         this.otp = new otp_js_1.OtpResource(transport);
@@ -150,4 +161,4 @@ class ConnectClient {
 }
 exports.ConnectClient = ConnectClient;
 /** Kept in step with `package.json` by `sdk.test.ts`. */
-exports.SDK_VERSION = "0.20.0";
+exports.SDK_VERSION = "0.23.0";

package/dist/cjs/server/handler.js

@@ -105,6 +105,7 @@ function createConnectHandler(options) {
     const defaultRedirect = options.defaultRedirect ?? "/";
     const stateCookieName = options.stateCookieName ?? "connect_oauth_state";
     const silentCookieName = `${stateCookieName}_silent`;
+    const pkceCookieName = `${stateCookieName}_pkce`;
     const callbackPath = `${basePath}/callback`;
     /**
      * Short-lived, httpOnly, and `SameSite=Lax` - `Strict` would not be sent on
@@ -151,6 +152,35 @@ function createConnectHandler(options) {
             .filter(Boolean)
             .join("; ");
     }
+    /**
+     * Holds the One Tap PKCE **verifier** for the few seconds between the tap and
+     * the exchange.
+     *
+     * This is the cookie the whole no-navigation flow rests on. Connect hands the
+     * authorization code to the *page*, so the code alone must not be enough to
+     * mint a session - the verifier is what completes it, and it never leaves
+     * this origin's cookie jar. `SameSite=Lax` is sufficient and correct: unlike
+     * the state cookie there is no cross-site redirect that has to carry it, and
+     * `Lax` additionally means a cross-site `POST` to `/one-tap/complete` arrives
+     * without it and simply fails.
+     *
+     * Five minutes, not the state cookie's fifteen: it is minted on the tap and
+     * spent on the next request, so a long window is only a longer chance for a
+     * stale one to be lying around.
+     */
+    function pkceCookie(value, secure) {
+        const cleared = value === "";
+        return [
+            `${pkceCookieName}=${encodeURIComponent(value)}`,
+            `Path=${basePath}`,
+            "HttpOnly",
+            "SameSite=Lax",
+            secure ? "Secure" : "",
+            cleared ? "Max-Age=0" : "Max-Age=300",
+        ]
+            .filter(Boolean)
+            .join("; ");
+    }
     async function requireToken(request) {
         const token = await session.read(request);
         if (!token) {
@@ -258,6 +288,14 @@ function createConnectHandler(options) {
             },
         });
     }
+    /**
+     * Where the browser asks Connect about the visitor, and where it asks for a
+     * code once they tap - or `null` when this deployment cannot run One Tap at
+     * all (no `clientId`, or a session store that cannot `write`, in which case
+     * `/one-tap/complete` does not exist and offering the prompt would strand
+     * anyone who used it).
+     */
+    const oneTapEndpoints = session.write ? client.identity.oneTapEndpoints() : null;
     const routes = {
         "GET /session": async (request) => {
             const token = await session.read(request);
@@ -267,9 +305,21 @@ function createConnectHandler(options) {
             // the client never has to tell "signed out" from "signed in with no
             // role" by which keys happen to be present.
             if (!token) {
-                return json({ user: null, subscription: null, role: null, permissions: [], staff: false });
+                return json({
+                    user: null,
+                    subscription: null,
+                    role: null,
+                    permissions: [],
+                    staff: false,
+                    // Carried on the read the provider already makes on mount, so One Tap
+                    // costs no extra round trip to discover where to ask. Present on both
+                    // branches even though only the signed-out one can use it: a response
+                    // whose shape depends on the answer is a response consumers start
+                    // testing for key presence instead of value.
+                    oneTap: oneTapEndpoints,
+                });
             }
-            return json(await client.identity.getUser(token));
+            return json({ ...(await client.identity.getUser(token)), oneTap: oneTapEndpoints });
         },
         "GET /entitlements": async (request) => {
             const { workspaceId } = await requireWorkspace(request);
@@ -704,6 +754,74 @@ function createConnectHandler(options) {
             await session.write(request, response, result.sessionToken);
             return response;
         },
+        /**
+         * One Tap, step one: mint the PKCE pair, keep the verifier here, hand the
+         * challenge to the page.
+         *
+         * Called on the *tap*, not on mount, so the five-minute verifier is minted
+         * seconds before it is spent rather than sitting in a cookie for as long as
+         * someone leaves the prompt on screen.
+         *
+         * A `POST` despite reading nothing: it sets a cookie, and a `GET` that
+         * changes state is both wrong and prefetchable - a link prefetcher or a
+         * scanner would silently rotate the verifier out from under an open prompt.
+         */
+        "POST /one-tap/start": async (request) => {
+            const url = new URL(request.url);
+            const { verifier, challenge } = await (0, identity_js_1.createPkcePair)();
+            const response = json({
+                codeChallenge: challenge,
+                // The already-registered callback URI. One Tap never navigates to it -
+                // it is the value the code is *bound* to, and it must be byte-identical
+                // at `/one-tap/complete`, so both ends derive it the same way the
+                // redirect flow does rather than accepting it from the page.
+                redirectUri: `${url.origin}${callbackPath}`,
+            });
+            response.headers.append("set-cookie", pkceCookie(verifier, url.protocol === "https:"));
+            return response;
+        },
+        /**
+         * One Tap, step two: trade the page's code for a session, using the
+         * verifier the page never saw.
+         *
+         * This is `GET /callback`'s body without the navigation - same exchange,
+         * same verify-before-store ordering, same session store. The verifier is
+         * what makes the difference: a code lifted out of the browser cannot be
+         * redeemed anywhere else, because the exchange is refused without it.
+         */
+        "POST /one-tap/complete": async (request) => {
+            const url = new URL(request.url);
+            const secure = url.protocol === "https:";
+            const clearPkce = pkceCookie("", secure);
+            const verifier = readCookie(request, pkceCookieName);
+            if (!verifier) {
+                // The prompt sat unanswered past the cookie's life, or a cross-site
+                // `POST` arrived without it. Either way there is nothing to complete,
+                // and the client falls back to the interactive flow.
+                const expired = json({ error: "expired" }, 400);
+                expired.headers.append("set-cookie", clearPkce);
+                return expired;
+            }
+            const body = (await request.json().catch(() => null));
+            const code = typeof body?.code === "string" ? body.code : null;
+            if (!code) {
+                const invalid = json({ error: "invalid_request" }, 400);
+                invalid.headers.append("set-cookie", clearPkce);
+                return invalid;
+            }
+            const result = await client.identity.exchangeCode({
+                code,
+                redirectUri: `${url.origin}${callbackPath}`,
+                codeVerifier: verifier,
+            });
+            // Verified before the session is stored, exactly as the callback does -
+            // an unverifiable token must never become a signed-in user.
+            await client.identity.verifyIdToken(result.idToken);
+            const response = json({ ok: true });
+            response.headers.append("set-cookie", clearPkce);
+            await session.write(request, response, result.sessionToken);
+            return response;
+        },
         "POST /logout": async (request) => {
             const token = await session.read(request);
             const response = json({ ok: true });
@@ -722,6 +840,12 @@ function createConnectHandler(options) {
     if (!session.write) {
         delete routes["GET /signin"];
         delete routes["GET /callback"];
+        // Same reason, and `oneTapEndpoints` is already `null` above so the client
+        // never offers the prompt in the first place - this is the second half of
+        // that, so a hand-written call cannot reach a route that would throw on
+        // `session.write!`.
+        delete routes["POST /one-tap/start"];
+        delete routes["POST /one-tap/complete"];
         // A switch rotates the session token. Without somewhere to persist the new
         // one, the old one would be revoked and the user silently signed out - so
         // the route does not exist rather than working once and breaking.

package/dist/cjs/server/resources/calls.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CallsResource = void 0;
+const http_js_1 = require("../http.js");
+/**
+ * Every call that arrived on a channel assigned to your application.
+ *
+ * The application is resolved from your API key and is never a parameter, so
+ * there is no request that reads another partner's calls.
+ *
+ * `channelId` is the only filter, and that is a budget decision rather than an
+ * oversight: each filter costs a Firestore composite index against a project
+ * already near its ceiling. Filter the rest client-side, or read the
+ * aggregates from `analytics`.
+ */
+class CallsResource {
+    transport;
+    constructor(transport) {
+        this.transport = transport;
+    }
+    /**
+     * Your calls, newest first, across all of your subscribing workspaces.
+     *
+     * **Page until `hasMore` is `false`; do not stop on an empty `items`.** A
+     * page can come back empty with more behind it.
+     */
+    list(input = {}) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "GET",
+            path: "/calls",
+            query: {
+                channelId: input.channelId,
+                cursor: input.cursor,
+                limit: input.limit === undefined ? undefined : String(input.limit),
+            },
+        });
+    }
+    /**
+     * One call and every transcript turn, ordered by `sequence` - which is the
+     * sort to trust, since two turns can share a millisecond.
+     *
+     * `recordingFileId` and `transcriptFileId` are Drive file ids, readable with
+     * a `drive:read` key. Both are `null` until the carrier posts the audio,
+     * which is the normal state for a call that has only just ended - branch on
+     * `recordingStatus` rather than treating `null` as a failure.
+     *
+     * Throws `ConnectError` with `code: "not_found"` for a call that does not
+     * exist *or* belongs to another application.
+     */
+    get(callId) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "GET",
+            path: `/calls/${encodeURIComponent(callId)}`,
+        });
+    }
+}
+exports.CallsResource = CallsResource;

package/dist/cjs/server/resources/channels.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChannelsResource = void 0;
+const http_js_1 = require("../http.js");
+/**
+ * The phone numbers Connect has assigned to your application.
+ *
+ * **Inventory is platform-owned.** A number is a regulated asset bought under
+ * Connect's carrier account and reassignable between workspaces, so your
+ * application never provisions, prices or releases one - it claims from a pool
+ * it cannot see, and reads back what it was given. That is why `claim` takes a
+ * workspace and a kind rather than a number, and why nothing here exposes a
+ * carrier, a provider reference or a monthly rate.
+ *
+ * The application is resolved from your API key and is never a parameter, so
+ * no request shape here can reach another partner's channels. A channel
+ * belonging to someone else answers `404`, not `403` - confirming it exists
+ * would make these reads an oracle for enumerating their channel ids.
+ */
+class ChannelsResource {
+    transport;
+    constructor(transport) {
+        this.transport = transport;
+    }
+    /**
+     * Every channel assigned to your application, across all of your subscribing
+     * workspaces.
+     *
+     * Page until `hasMore` is `false`.
+     */
+    list(input = {}) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "GET",
+            path: "/channels",
+            query: {
+                workspaceId: input.workspaceId,
+                cursor: input.cursor,
+                limit: input.limit === undefined ? undefined : String(input.limit),
+            },
+        });
+    }
+    /**
+     * The channel behind an id you already hold - a webhook's `channelId`, or a
+     * call record's.
+     *
+     * Throws `ConnectError` with `code: "not_found"` for an id that does not
+     * exist *or* belongs to another application.
+     */
+    get(channelId) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "GET",
+            path: `/channels/${encodeURIComponent(channelId)}`,
+        });
+    }
+    /**
+     * Takes a number out of Connect's inventory and binds it to one of your
+     * subscribing workspaces.
+     *
+     * **You do not pick the number.** A workspace may hold exactly one, across
+     * every application it uses, and it is then fixed for the life of the
+     * engagement - there is no re-claim and no swap. Only a Connect operator can
+     * unassign one.
+     *
+     * Two different `409`s, and they need different handling: the workspace
+     * already holds a channel of this kind (fix the call), or the pool is empty
+     * right now (retry - Connect is notified, and this is not permanent).
+     *
+     * The claimed channel comes back without routing, because it has none yet.
+     * Call `setRouting` next, or the number refuses every call that reaches it.
+     */
+    claim(input) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "POST",
+            path: "/channels/claim",
+            json: { workspaceId: input.workspaceId, kind: input.kind ?? "voice" },
+        });
+    }
+    /**
+     * Points a channel at wherever inbound conversations should go.
+     *
+     * `destination` is yours: Connect stores it verbatim and never reads into
+     * it. It **replaces** the stored record rather than merging, so send the
+     * whole destination each time; it must serialize to 16 KB or fewer.
+     *
+     * Throws `code: "conflict"` when the channel is suspended or released - use
+     * `clearRouting` to stop a suspended number answering, which is deliberately
+     * still allowed.
+     */
+    setRouting(channelId, destination) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "PUT",
+            path: `/channels/${encodeURIComponent(channelId)}/routing`,
+            json: { destination },
+        });
+    }
+    /**
+     * Takes a number out of service without giving it up - the channel stays
+     * assigned to you and stays billable, and inbound calls are refused until
+     * you write routing again.
+     *
+     * This is the only way to say "stop answering": overwriting `destination`
+     * can only ever point the number somewhere *else*, and unassigning it is a
+     * Console action that returns the number to Connect's inventory.
+     *
+     * Idempotent - clearing already-clear routing answers `200` with
+     * `routing: null`, so a retry after a lost response is safe.
+     */
+    clearRouting(channelId) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "DELETE",
+            path: `/channels/${encodeURIComponent(channelId)}/routing`,
+        });
+    }
+}
+exports.ChannelsResource = ChannelsResource;

package/dist/cjs/server/resources/enrichment.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnrichmentResource = void 0;
+const acting_as_js_1 = require("./acting-as.js");
+const http_js_1 = require("../http.js");
+/**
+ * What Connect knows about the company at a domain.
+ *
+ * The thing behind "the account filled itself in": a record holding nothing
+ * but `priya@acme.com` can offer a name, an industry, a size band and an
+ * address instead of an empty form.
+ *
+ * Two properties are worth knowing before you wire it in, because they decide
+ * how you should render the result:
+ *
+ * - **Every value is cited, and nothing is recalled.** Connect reads the
+ *   company's own website and returns the URL each claim came from. A field
+ *   the pages never stated comes back `null` rather than as a plausible guess.
+ * - **It is a suggestion, not a save.** Nothing is written to your store, and
+ *   nothing should be written to it without the person in front of it
+ *   agreeing - which is also how HubSpot and Zoho present the same feature.
+ */
+class EnrichmentResource {
+    transport;
+    constructor(transport) {
+        this.transport = transport;
+    }
+    /**
+     * Look a company up from a work email address or a domain.
+     *
+     * Send whichever you hold; `domain` wins when both are given. A consumer
+     * address (`founder@gmail.com`) is answered with
+     * `{ status: "skipped", reason: "consumer_domain" }` rather than an error -
+     * it names a person, not an employer.
+     *
+     * `asUser` attributes the generation to the signed-in caller's workspace,
+     * resolved from their session token. Without it the call is attributed to
+     * your application.
+     */
+    company(input, options = {}) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "POST",
+            path: "/enrichment/company",
+            // `asUser` never reaches the body - it is a credential, and Connect
+            // reads it from the header.
+            json: {
+                ...(input.email ? { email: input.email } : {}),
+                ...(input.domain ? { domain: input.domain } : {}),
+                ...(input.refresh ? { refresh: true } : {}),
+            },
+            headers: (0, acting_as_js_1.actingAs)(input.asUser),
+            signal: options.signal,
+        });
+    }
+}
+exports.EnrichmentResource = EnrichmentResource;