@cosmoops/connect-sdk 0.20.0 → 0.23.0

package/dist/cjs/server/resources/identity.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.IdentityResource = void 0;
 exports.createState = createState;
+exports.createPkcePair = createPkcePair;
 const errors_js_1 = require("../../errors.js");
 const http_js_1 = require("../http.js");
 /** A URL-safe random string, suitable for `state` or a PKCE verifier. */
@@ -16,6 +17,23 @@ function base64UrlEncode(bytes) {
         binary += String.fromCharCode(byte);
     return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
+/**
+ * Mints a PKCE pair for the One Tap flow.
+ *
+ * The redirect flow can take PKCE or leave it, because the code is delivered
+ * to the application's server on a redirect the browser only forwards. One Tap
+ * hands the code *to the page*, so the verifier is the thing that makes a
+ * stolen code worthless - it stays in an `HttpOnly` cookie on the application's
+ * own origin and is never sent to the browser.
+ *
+ * `crypto.subtle` rather than a Node hash, so this stays isomorphic and the
+ * `./next` entry keeps loading on the edge runtime as well as Node.
+ */
+async function createPkcePair() {
+    const verifier = createState(32);
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+    return { verifier, challenge: base64UrlEncode(new Uint8Array(digest)) };
+}
 function base64UrlDecode(value) {
     const padded = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
     const binary = atob(padded);
@@ -54,6 +72,28 @@ class IdentityResource {
         }
         return url.toString();
     }
+    /**
+     * The two Connect endpoints One Tap talks to **from the browser**, or `null`
+     * when this client has no `clientId` configured and the flow cannot run.
+     *
+     * Handed out by the bridge rather than built in the page, so One Tap needs no
+     * client-side configuration at all - a `./next` application sets
+     * `CONNECT_CLIENT_ID` server-side and nothing else. Both URLs carry only the
+     * public `client_id`; neither is a credential.
+     *
+     * Returning `null` rather than throwing (as `authorizeUrl` does) because this
+     * is read on the `/session` route, which must keep answering for an
+     * application that has no OAuth client configured at all.
+     */
+    oneTapEndpoints() {
+        if (!this.clientId)
+            return null;
+        const hint = new URL("/api/sso/session-hint", this.appBaseUrl);
+        hint.searchParams.set("client_id", this.clientId);
+        const authorize = new URL("/api/sso/authorize/one-tap", this.appBaseUrl);
+        authorize.searchParams.set("client_id", this.clientId);
+        return { hintUrl: hint.toString(), authorizeUrl: authorize.toString() };
+    }
     /** Step 2 - trade the one-time `code` for a session. Server-side only. */
     async exchangeCode(input) {
         const wire = await this.post("/sso/token", {

package/dist/cjs/server/resources/workspaces.js

@@ -4,8 +4,8 @@ exports.WorkspacesResource = void 0;
 const acting_as_js_1 = require("./acting-as.js");
 const http_js_1 = require("../http.js");
 /**
- * Which workspaces the signed-in user belongs to, moving between them, and who
- * else is on the team.
+ * Which workspaces the signed-in user belongs to, moving between them, who
+ * else is on the team, and inviting or granting access to your application.
  *
  * **Every call here needs `asUser`** - the signed-in user's opaque
  * `sessionToken`. There is no application-wide form of any of these: they take
@@ -70,5 +70,76 @@ class WorkspacesResource {
         });
         return result.members;
     }
+    /**
+     * Seats, what the caller may do with them, and the invitations already
+     * holding one - everything a team screen needs to decide what to draw.
+     *
+     * Behind `members:manage` rather than `workspaces:read`, and gated on the
+     * caller's own `member:invite`: it names people who are not members yet.
+     */
+    access(options) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "GET",
+            path: "/workspaces/members/access",
+            headers: (0, acting_as_js_1.actingAs)(options.asUser),
+        });
+    }
+    /**
+     * Invite someone into the workspace, with access to your application.
+     *
+     * `roleKey` names a role from your own catalog (or the reserved `"admin"`);
+     * omit it to add someone to the workspace with no access to your
+     * application. You cannot send a Connect role - the grant is built server
+     * side as `[member, app:<yourKey>:<roleKey>]`, so nothing this method can
+     * express reaches outside your application.
+     *
+     * Spends a member seat when the invitation is created, not when it is
+     * accepted. Throws `ConnectError` with status 409 and a message written to
+     * be shown when there is no seat, and 403 when the caller is inviting
+     * someone with access they do not hold themselves.
+     */
+    invite(input, options) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "POST",
+            path: "/workspaces/members/invite",
+            headers: (0, acting_as_js_1.actingAs)(options.asUser),
+            json: input,
+        });
+    }
+    /**
+     * Grant or revoke **your application's** role for an existing member.
+     * `roleKey: null` revokes it.
+     *
+     * Moves only your own grant: Connect recomputes the member's roles as what
+     * they hold now, minus any grant naming your application, plus the one you
+     * asked for. Their workspace role and every other application they use are
+     * untouched, and there is no form of this that removes them from the
+     * workspace.
+     *
+     * Re-sending the role they already have is a no-op rather than an error, so
+     * a form that submits whatever is on screen is safe.
+     */
+    setAccess(input, options) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "POST",
+            path: "/workspaces/members/access",
+            headers: (0, acting_as_js_1.actingAs)(options.asUser),
+            json: input,
+        });
+    }
+    /**
+     * Withdraw a pending invitation your application sent, freeing its seat.
+     *
+     * Only yours - an invitation carrying another application's grant is a 404,
+     * deliberately indistinguishable from one that does not exist.
+     */
+    async revokeInvitation(input, options) {
+        await (0, http_js_1.request)(this.transport, {
+            method: "POST",
+            path: "/workspaces/invitations/revoke",
+            headers: (0, acting_as_js_1.actingAs)(options.asUser),
+            json: input,
+        });
+    }
 }
 exports.WorkspacesResource = WorkspacesResource;

package/dist/esm/client/components/identity.js

@@ -0,0 +1,21 @@
+/**
+ * How a person is rendered when there is no photo to render.
+ *
+ * Shared rather than copied because two surfaces showing *different* initials
+ * for the same account reads as a bug in the account, not in the component -
+ * and the One Tap prompt and the user menu are frequently on screen within
+ * seconds of each other.
+ */
+/**
+ * Up to two letters standing for a person.
+ *
+ * Splits on the punctuation an email address uses as well as whitespace, so
+ * `priya.nair@acme.test` yields `PN` rather than `PR` - an account with no
+ * display name is exactly the case the fallback exists for, and taking the
+ * first two characters of a local part would make it useless there.
+ */
+export function initials(name, email = null) {
+    const source = name?.trim() || email?.trim() || "";
+    const parts = source.split(/[\s@._-]+/).filter(Boolean);
+    return (parts.slice(0, 2).map((part) => part[0]).join("") || "?").toUpperCase();
+}

package/dist/esm/client/components/one-tap-state.js

@@ -0,0 +1,90 @@
+/**
+ * How long One Tap stays quiet, and why.
+ *
+ * A prompt that reappears on every page load after being closed is not a
+ * convenience, it is an interstitial. Two things silence it, both stored in the
+ * application's own `localStorage` - nothing here leaves the browser, and
+ * nothing here is a security control:
+ *
+ * - **Dismissal, escalating.** Closing it once is "not now"; closing it three
+ *   times is "stop asking". The backoff says that back.
+ * - **Signing out.** Someone who has just signed out of this application does
+ *   not want to be offered the same account back on the next render. That is a
+ *   different fact from a dismissal, so it does not consume a dismissal, but it
+ *   buys a day of quiet.
+ *
+ * Every access is wrapped: `localStorage` throws outright in some embedded and
+ * privacy-restricted contexts, and a prompt is never worth breaking a page for.
+ * A read that fails reads as "not suppressed", which is the same state a fresh
+ * browser is in.
+ */
+const STORAGE_KEY = "connect_one_tap";
+/** Escalating quiet after 1, 2, and 3-or-more dismissals. */
+const DISMISS_BACKOFF_MS = [2 * 60 * 60 * 1000, 24 * 60 * 60 * 1000, 7 * 24 * 60 * 60 * 1000];
+const SIGN_OUT_QUIET_MS = 24 * 60 * 60 * 1000;
+function read() {
+    const empty = { dismissals: 0, until: 0 };
+    if (typeof window === "undefined")
+        return empty;
+    try {
+        const raw = window.localStorage.getItem(STORAGE_KEY);
+        if (!raw)
+            return empty;
+        const parsed = JSON.parse(raw);
+        return {
+            dismissals: typeof parsed.dismissals === "number" ? parsed.dismissals : 0,
+            until: typeof parsed.until === "number" ? parsed.until : 0,
+        };
+    }
+    catch {
+        return empty;
+    }
+}
+function write(state) {
+    if (typeof window === "undefined")
+        return;
+    try {
+        window.localStorage.setItem(STORAGE_KEY, JSON.stringify(state));
+    }
+    catch {
+        // Storage is full, blocked, or unavailable. The prompt simply keeps its
+        // default behaviour rather than the page failing.
+    }
+}
+/**
+ * Whether the prompt may be shown at all.
+ *
+ * Read once when the component mounts, never during render: `localStorage` is
+ * external mutable state, and reading it in a render body is impure - with the
+ * React Compiler on, exactly the kind of thing that can be hoisted into the
+ * wrong answer. Same reasoning as `ConnectProvider`'s `silentAttemptSpent`.
+ */
+export function oneTapSuppressed() {
+    return Date.now() < read().until;
+}
+/** Records a close, and escalates how long the next quiet period lasts. */
+export function dismissOneTap() {
+    const { dismissals } = read();
+    const next = dismissals + 1;
+    const backoff = DISMISS_BACKOFF_MS[Math.min(next, DISMISS_BACKOFF_MS.length) - 1];
+    write({ dismissals: next, until: Date.now() + backoff });
+}
+/**
+ * Silences the prompt after an explicit sign-out, without spending a dismissal.
+ * Signing out is not a complaint about the prompt, so it must not push someone
+ * closer to the seven-day backoff.
+ */
+export function suppressOneTapAfterSignOut() {
+    write({ dismissals: read().dismissals, until: Date.now() + SIGN_OUT_QUIET_MS });
+}
+/** Clears the record once a sign-in actually happens - the prompt did its job. */
+export function clearOneTapSuppression() {
+    if (typeof window === "undefined")
+        return;
+    try {
+        window.localStorage.removeItem(STORAGE_KEY);
+    }
+    catch {
+        // See `write`.
+    }
+}

package/dist/esm/client/components/one-tap.js

@@ -0,0 +1,103 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useCallback, useEffect, useState } from "react";
+import { X } from "lucide-react";
+import { Avatar, Button, Card } from "@heroui/react";
+import { useConnect } from "../provider.js";
+import { ConnectMark } from "../mark.js";
+import { initials } from "./identity.js";
+import { ENTER, m, MotionProvider } from "./motion.js";
+import { dismissOneTap, oneTapSuppressed } from "./one-tap-state.js";
+export function ConnectOneTap({ onInteractiveSignIn, className = "" }) {
+    const { session, isLoading, signIn, readOneTapHint, oneTapSignIn } = useConnect();
+    const [hint, setHint] = useState(null);
+    const [phase, setPhase] = useState("hidden");
+    /**
+     * Sampled once at mount rather than read during render, for the same reason
+     * `ConnectProvider` samples its silent-attempt marker that way: `localStorage`
+     * is external mutable state and reading it in a render body is impure.
+     * `false` on the server, which is correct - nothing renders until the hint
+     * has resolved on the client anyway.
+     */
+    const [suppressed] = useState(() => typeof window !== "undefined" && oneTapSuppressed());
+    const signedOut = !isLoading && !session?.user;
+    const askable = signedOut && !suppressed && Boolean(session?.oneTap);
+    useEffect(() => {
+        if (!askable)
+            return;
+        // Nothing here is a synchronous `setState` in an effect: every write
+        // happens after awaiting the network. The flag is what stops a late answer
+        // landing on a component that has already unmounted.
+        let cancelled = false;
+        void readOneTapHint().then((answer) => {
+            if (cancelled)
+                return;
+            // A visitor Connect does not recognise is the common case and gets
+            // nothing - no prompt, no flicker, no trace that a question was asked.
+            if (!answer || answer.status !== "signed_in")
+                return;
+            setHint(answer);
+            setPhase("offered");
+        });
+        return () => {
+            cancelled = true;
+        };
+    }, [askable, readOneTapHint]);
+    const handoff = useCallback(() => {
+        setPhase("hidden");
+        if (onInteractiveSignIn)
+            onInteractiveSignIn();
+        else
+            signIn();
+    }, [onInteractiveSignIn, signIn]);
+    const accept = useCallback(async () => {
+        // A visitor who has never authorised this application cannot be signed in
+        // silently and Connect would refuse anyway, so the tap goes straight to the
+        // screen that can ask them properly.
+        if (!hint?.consented) {
+            handoff();
+            return;
+        }
+        setPhase("working");
+        const result = await oneTapSignIn();
+        if (result.ok) {
+            // The provider has already refreshed the session; this component
+            // disappears because `signedOut` is now false.
+            setPhase("hidden");
+            return;
+        }
+        // `consent_required` and `interaction_required` both mean a screen is
+        // genuinely needed. `login_required` means the Connect session went away
+        // between the hint and the tap. All three are handed to the interactive
+        // flow, which can explain itself; a rate limit or a transport failure just
+        // closes the prompt rather than blaming the visitor for tapping.
+        if (result.reason === "consent_required" ||
+            result.reason === "interaction_required" ||
+            result.reason === "login_required") {
+            handoff();
+            return;
+        }
+        setPhase("hidden");
+    }, [handoff, hint, oneTapSignIn]);
+    const dismiss = useCallback(() => {
+        dismissOneTap();
+        setPhase("hidden");
+    }, []);
+    if (phase === "hidden" || !hint)
+        return null;
+    const displayName = hint.user?.displayName ?? hint.user?.email ?? null;
+    const applicationName = hint.application?.name;
+    const busy = phase === "working";
+    return (_jsx(MotionProvider, { children: _jsx(m.div, { initial: { opacity: 0, y: 12 }, animate: { opacity: 1, y: 0 }, transition: ENTER, role: "dialog", "aria-label": applicationName ? `Continue to ${applicationName} with CosmoOps` : "Continue with CosmoOps", 
+            // Fixed, above ordinary content but below a modal: this is an offer,
+            // and it must never sit on top of something the visitor opened
+            // themselves.
+            className: `fixed inset-x-3 bottom-3 z-40 sm:inset-x-auto sm:right-4 sm:bottom-4 sm:w-80 ${className}`, onKeyDown: (event) => {
+                if (event.key === "Escape")
+                    dismiss();
+            }, children: _jsxs(Card, { className: "p-4 shadow-lg", children: [_jsxs("div", { className: "flex items-start gap-3", children: [hint.consented ? (_jsxs(Avatar, { size: "md", color: "accent", variant: "soft", className: "shrink-0 rounded-full", children: [hint.user?.photoUrl && (_jsx(Avatar.Image, { alt: displayName ?? "Your account", src: hint.user.photoUrl })), _jsx(Avatar.Fallback, { children: initials(hint.user?.displayName ?? null, hint.user?.email ?? null) })] })) : (_jsx(ConnectMark, { className: "mt-0.5 size-8 shrink-0" })), _jsxs("div", { className: "min-w-0 flex-1", children: [_jsx("p", { className: "truncate text-sm font-medium text-foreground", children: hint.consented ? `Continue as ${displayName ?? "your account"}` : "You're signed in to CosmoOps" }), _jsx("p", { className: "truncate text-xs text-muted", children: hint.consented
+                                            ? [hint.user?.email, hint.workspace?.name].filter(Boolean).join(" · ")
+                                            : applicationName
+                                                ? `Continue to ${applicationName}`
+                                                : "Continue with your account" })] }), _jsx(Button, { variant: "tertiary", size: "sm", isIconOnly: true, "aria-label": "Not now", onPress: dismiss, isDisabled: busy, children: _jsx(X, { className: "size-4" }) })] }), _jsxs(Button, { variant: "secondary", className: "mt-3 w-full", onPress: () => void accept(), isPending: busy, children: [_jsx(ConnectMark, { className: "size-4" }), busy ? "Signing you in…" : "Continue"] })] }) }) }));
+}

package/dist/esm/client/components/plan-pricing.js

@@ -194,3 +194,30 @@ export const ACTION_LABEL = {
     "switch-to-monthly": "Switch to monthly",
     subscribe: "Subscribe",
 };
+/**
+ * The subscription id a checkout hand-off should carry for `action` - or
+ * `null`, meaning "send them to Connect's *subscribe* screen".
+ *
+ * Paired with `resolveAction` deliberately: the button's label and the URL it
+ * opens are one decision, and deriving the URL from the mere *presence* of a
+ * subscription row instead is what sent a card reading "Subscribe" to
+ * Connect's change-plan screen, which answered `notFound()`.
+ *
+ * The gap is real rather than hypothetical. `resolveAction` needs the
+ * **current plan** to classify a change and answers `"subscribe"` without
+ * one - and `SubscriptionResponse` carries `plan: null` beside a perfectly
+ * live `subscription` whenever that plan has been deleted from the catalogue
+ * out from under it, which a re-seeded application does. Connect's change-plan
+ * route is stuck in the same place for the same reason: it cannot prorate
+ * against a price it cannot read.
+ *
+ * Sending those to `/apps/.../subscribe/...` is a real hand-off, not a guess:
+ * that route re-reads the workspace's live subscriptions server-side and
+ * redirects to the change-plan screen itself when there genuinely is one to
+ * change. Connect decides, so the grid does not have to be sure.
+ */
+export function checkoutSubscriptionId(action, current) {
+    if (action === "subscribe")
+        return null;
+    return current?.subscription?.id ?? null;
+}

package/dist/esm/client/components/plans.js

@@ -7,7 +7,7 @@ import { useConnect, useConnectEntitlements, useConnectPlans } from "../provider
 import { buildCancelUrl, buildCheckoutUrl, useConnectCheckout, } from "../use-checkout.js";
 import { AnimatePresence, ENTER, m, MotionProvider } from "./motion.js";
 import { ConnectSubscribeDialog } from "./subscribe-dialog.js";
-import { ACTION_LABEL, discountLabel, formatPrice, groupPlansByTier, intervalLabel, isFreePlan, pricePerLabel, resolveAction, } from "./plan-pricing.js";
+import { ACTION_LABEL, checkoutSubscriptionId, discountLabel, formatPrice, groupPlansByTier, intervalLabel, isFreePlan, pricePerLabel, resolveAction, } from "./plan-pricing.js";
 /**
  * The plan table: monthly/annual toggle, features, add-ons, the discount
  * actually in effect, and the subscribe / upgrade / downgrade flows.
@@ -80,8 +80,13 @@ export function ConnectPlans({ planIds, hideCoupon = false, className }) {
      * created in `"created"` and only flips to active when the payment webhook
      * lands, which can be minutes later. Holding a customer on a spinner until
      * then would misreport a completed checkout as an abandoned one.
+     *
+     * `action` is threaded through rather than re-derived: it is the same
+     * decision the card's label came from, and `checkoutSubscriptionId` is what
+     * keeps the two from disagreeing - see its doc comment for the 404 that
+     * disagreement produced.
      */
-    function startCheckout(plan) {
+    function startCheckout(plan, action) {
         if (!applicationId)
             return;
         checkout.start({
@@ -89,7 +94,7 @@ export function ConnectPlans({ planIds, hideCoupon = false, className }) {
                 appUrl,
                 applicationId,
                 planId: plan.id,
-                subscriptionId: subscription?.subscription?.id ?? null,
+                subscriptionId: checkoutSubscriptionId(action, subscription),
                 coupon,
             }),
             isSettled: (next) => next.subscription.plan?.id === plan.id,
@@ -139,7 +144,7 @@ export function ConnectPlans({ planIds, hideCoupon = false, className }) {
                                             // plan would race the first and one of them would be
                                             // rejected on arrival.
                                             isDisabled: isCurrent || checkout.status === "waiting", onPress: () => setPending({ plan, action }), children: [ACTION_LABEL[action], !isCurrent && _jsx(ExternalLink, { className: "size-3.5" })] }) })] }) }, tier.planGroup));
-                    }) }), subscription?.subscription && (_jsx(ConnectUnsubscribeRow, { subscription: subscription.subscription, appUrl: appUrl, checkout: checkout })), _jsx(ConnectSubscribeDialog, { plan: pending?.plan ?? null, action: pending?.action ?? "subscribe", current: subscription, coupon: hideCoupon ? undefined : coupon, onClose: () => setPending(null), onConfirm: () => pending && startCheckout(pending.plan) })] }) }));
+                    }) }), subscription?.subscription && (_jsx(ConnectUnsubscribeRow, { subscription: subscription.subscription, appUrl: appUrl, checkout: checkout })), _jsx(ConnectSubscribeDialog, { plan: pending?.plan ?? null, action: pending?.action ?? "subscribe", current: subscription, coupon: hideCoupon ? undefined : coupon, onClose: () => setPending(null), onConfirm: () => pending && startCheckout(pending.plan, pending.action) })] }) }));
 }
 /**
  * What the page says while the customer is off in Connect, and after.

package/dist/esm/client/components/user-menu.js

@@ -4,6 +4,7 @@ import { Avatar, Button, Chip, Modal, Skeleton, ToggleButton, ToggleButtonGroup,
 import { ChevronsUpDown, CreditCard, ExternalLink, Laptop, LogOut, Moon, ReceiptText, Sun, UserRound, } from "lucide-react";
 import { useConnect } from "../provider.js";
 import { ConnectMark } from "../mark.js";
+import { initials } from "./identity.js";
 import { ConnectAccountSessions } from "./account-sessions.js";
 import { m } from "./motion.js";
 import { SidebarLabel, sidebarRowClass, useConnectShell } from "./shell-context.js";
@@ -13,11 +14,6 @@ const THEME_OPTIONS = [
     { value: "dark", label: "Dark", icon: Moon },
     { value: "system", label: "System", icon: Laptop },
 ];
-function initials(name, email) {
-    const source = name?.trim() || email?.trim() || "";
-    const parts = source.split(/[\s@._-]+/).filter(Boolean);
-    return (parts.slice(0, 2).map((part) => part[0]).join("") || "?").toUpperCase();
-}
 function openExternal(url) {
     window.open(url, "_blank", "noopener,noreferrer");
 }

package/dist/esm/client/index.js

@@ -21,6 +21,7 @@ export { ConnectGrievanceNotice } from "./components/grievance-notice.js";
 export { ConnectMark } from "./mark.js";
 export { ConnectLogo } from "./components/logo.js";
 export { ConnectLoginButton, ConnectRegisterButton } from "./components/auth-buttons.js";
+export { ConnectOneTap } from "./components/one-tap.js";
 export { ConnectUserButton, ConnectProfileModal, 
 /** @deprecated Renamed to `ConnectUserButton`. */
 ConnectUserMenu, ConnectManageSubscriptionButton, ConnectInvoicesButton, ConnectProfileButton, ConnectHomeButton, ConnectSignOutButton, } from "./components/user-menu.js";
@@ -104,7 +105,13 @@ export { ConnectConfirmDialog } from "./components/confirm-dialog.js";
 export { ConnectCursorPagination } from "./components/cursor-pagination.js";
 export { ConnectFilterTabs } from "./components/filter-tabs.js";
 export { useConnectCheckout, buildCheckoutUrl } from "./use-checkout.js";
-export { formatPrice, monthlyOf, resolveAction, annualSaving, discountLabel, ACTION_LABEL, 
+export { formatPrice, monthlyOf, resolveAction, 
+// The other half of `resolveAction`, and exported with it deliberately: a
+// partner writing its own pricing grid has to turn that action into a
+// checkout URL, and reading the subscription id straight off the
+// entitlements response instead is what sent a "Subscribe" button to
+// Connect's change-plan screen. See its doc comment.
+checkoutSubscriptionId, annualSaving, discountLabel, ACTION_LABEL, 
 // Exported for the same reason `groupPlansByTier` is: a partner writing its
 // own pricing grid has to draw a ₹0 plan as "Free" rather than as a price
 // with a cadence and a GST rate attached, and re-deriving "is this free"

package/dist/esm/client/provider.js

@@ -1,6 +1,7 @@
 "use client";
 import { jsx as _jsx } from "react/jsx-runtime";
 import { createContext, useCallback, useContext, useEffect, useMemo, useRef, useState } from "react";
+import { clearOneTapSuppression, suppressOneTapAfterSignOut } from "./components/one-tap-state.js";
 export const CONNECT_APP_URL = "https://connect.cosmoops.com";
 const ConnectContext = createContext(null);
 /** Marks that this tab has already spent its one silent attempt - see `ConnectProviderProps.silentSignIn`. */
@@ -185,8 +186,91 @@ export function ConnectProvider({ clientId = "", basePath = "/api/connect", redi
             credentials: "same-origin",
         }).catch(() => { });
         cache.current.clear();
+        // Someone who just signed out must not be offered the same account back on
+        // the next render - see `suppressOneTapAfterSignOut`.
+        suppressOneTapAfterSignOut();
         setResult({ session: { user: null, subscription: null, role: null, permissions: [], staff: false, audience: null }, error: null });
     }, [basePath, fetchImpl]);
+    /**
+     * Where Connect answers One Tap, taken from the session read rather than
+     * assembled here - the bridge knows the `client_id` and the browser need not.
+     */
+    const oneTapEndpoints = result?.session.oneTap ?? null;
+    const readOneTapHint = useCallback(async () => {
+        if (!oneTapEndpoints)
+            return null;
+        try {
+            // `credentials: "include"` because this is the one request in the SDK
+            // that leaves the application's own origin. It carries the visitor's
+            // Connect cookie only when the two are same-site; everywhere else it is
+            // simply sent without one and comes back `signed_out`.
+            const response = await (fetchImpl ?? globalThis.fetch)(oneTapEndpoints.hintUrl, {
+                credentials: "include",
+                headers: { accept: "application/json" },
+            });
+            if (!response.ok)
+                return null;
+            return (await response.json());
+        }
+        catch {
+            // Offline, blocked, or Connect is down. None of those is evidence about
+            // whether this visitor has a session, so the honest answer is silence.
+            return null;
+        }
+    }, [fetchImpl, oneTapEndpoints]);
+    const oneTapSignIn = useCallback(async () => {
+        if (!oneTapEndpoints)
+            return { ok: false, reason: "unavailable" };
+        try {
+            // 1. The bridge mints the PKCE pair and keeps the verifier in an
+            //    `HttpOnly` cookie on this origin.
+            const start = await mutateResource("/one-tap/start");
+            // 2. Connect mints a code against that challenge. The custom header is
+            //    what forces the preflight, so an origin this client has not
+            //    registered is refused before the request is ever sent.
+            const authorize = await (fetchImpl ?? globalThis.fetch)(oneTapEndpoints.authorizeUrl, {
+                method: "POST",
+                credentials: "include",
+                headers: {
+                    accept: "application/json",
+                    "content-type": "application/json",
+                    "x-connect-one-tap": "1",
+                },
+                body: JSON.stringify({
+                    redirect_uri: start.redirectUri,
+                    code_challenge: start.codeChallenge,
+                }),
+            });
+            const body = (await authorize.json().catch(() => null));
+            if (!authorize.ok || !body?.code) {
+                // Connect names the reason, and each one has a different next step -
+                // `consent_required` wants the interactive screen, `rate_limited` wants
+                // to be left alone. Anything unrecognised is reported as a plain
+                // failure rather than guessed at.
+                const reason = body?.error;
+                return {
+                    ok: false,
+                    reason: reason === "login_required" ||
+                        reason === "consent_required" ||
+                        reason === "interaction_required" ||
+                        reason === "rate_limited"
+                        ? reason
+                        : "failed",
+                };
+            }
+            // 3. The bridge exchanges the code with the verifier the page never saw,
+            //    and stores the session.
+            await mutateResource("/one-tap/complete", { code: body.code });
+            // The prompt was accepted, so whatever backoff earlier dismissals had
+            // accumulated is spent - it described reluctance that no longer holds.
+            clearOneTapSuppression();
+            await refresh();
+            return { ok: true };
+        }
+        catch {
+            return { ok: false, reason: "failed" };
+        }
+    }, [fetchImpl, mutateResource, oneTapEndpoints, refresh]);
     const value = useMemo(() => ({
         clientId,
         appUrl,
@@ -200,6 +284,8 @@ export function ConnectProvider({ clientId = "", basePath = "/api/connect", redi
         mutateResource,
         invalidateResource,
         streamResource,
+        readOneTapHint,
+        oneTapSignIn,
     }), [
         clientId,
         appUrl,
@@ -213,6 +299,8 @@ export function ConnectProvider({ clientId = "", basePath = "/api/connect", redi
         mutateResource,
         invalidateResource,
         streamResource,
+        readOneTapHint,
+        oneTapSignIn,
     ]);
     return _jsx(ConnectContext.Provider, { value: value, children: children });
 }
@@ -301,7 +389,7 @@ export function useConnectPlans() {
  * `CompanyProfile`. `<ConnectGrievanceNotice>` renders it for you.
  */
 export function useConnectCompanyProfile() {
-    return useConnectResource("/company-profile");
+    return useConnectResource("/company-profile", { requiresSession: false });
 }
 /** The apps this workspace can open. */
 export function useConnectApps() {
@@ -342,10 +430,15 @@ export function useConnectSessions() {
 /**
  * One bridge read, shared through the provider's cache.
  *
- * Only fetches once a user is known: every resource route needs a session, so
- * firing before one exists just buys a guaranteed 401.
+ * Waits for a session by default: every resource route but one needs it, so
+ * firing before one exists just buys a guaranteed 401. `requiresSession:
+ * false` opts out, and the reason it exists is the grievance notice - a
+ * statutory contact is at its most useful on a public page a signed-out
+ * visitor is reading, so a hook that answered `null` until someone logged in
+ * would render nothing at exactly the moment that matters.
  */
-export function useConnectResource(path) {
+export function useConnectResource(path, options) {
+    const requiresSession = options?.requiresSession ?? true;
     const { fetchResource, session, isLoading: sessionLoading } = useConnect();
     // Stamped with the `path` it belongs to, so switching paths reports loading
     // without a synchronous `setIsLoading(true)` - and, more usefully, so a
@@ -356,7 +449,7 @@ export function useConnectResource(path) {
         // Signed out is handled by derivation below rather than by writing state
         // here - a synchronous setState inside an effect costs an extra render pass
         // and is what `react-hooks/set-state-in-effect` exists to catch.
-        if (sessionLoading || !session?.user)
+        if (requiresSession && (sessionLoading || !session?.user))
             return;
         let active = true;
         fetchResource(path)
@@ -375,8 +468,10 @@ export function useConnectResource(path) {
         // `version` is otherwise unread - it exists purely to force this effect
         // to re-run on `refetch()`, after the caller has already evicted this
         // path's cache entry via `mutateResource`.
-    }, [fetchResource, path, session?.user, sessionLoading, version]);
-    const signedOut = !sessionLoading && !session?.user;
+    }, [fetchResource, path, requiresSession, session?.user, sessionLoading, version]);
+    // A public read is never settled by the absence of a session - it is
+    // genuinely pending until the fetch lands.
+    const signedOut = requiresSession && !sessionLoading && !session?.user;
     const loaded = entry?.path === path ? entry : null;
     return {
         data: loaded?.data ?? null,