@cosmoops/connect-sdk 0.20.0 → 0.23.0

package/dist/types/client/components/one-tap.d.ts

@@ -0,0 +1,50 @@
+/**
+ * "Continue as …" - a signed-out visitor who is already signed into Connect is
+ * offered their account, and one tap signs them in **without leaving the page**.
+ *
+ * The prompt is the visible half; what makes it worth having is that finding
+ * out costs one `fetch` rather than a redirect. `ConnectProviderProps.silentSignIn`
+ * answers the same question by bouncing the browser to Connect and back, which
+ * means a visible full-page navigation on the first load of every signed-out
+ * visit, nothing shown to the visitor while it happens, and no way to say no.
+ *
+ * ```tsx
+ * <ConnectProvider>
+ *   <App />
+ *   <ConnectOneTap />
+ * </ConnectProvider>
+ * ```
+ *
+ * ### It only appears when it can actually help
+ *
+ * Nothing renders unless the visitor is signed out here, signed in to Connect,
+ * and has not recently dismissed the prompt or signed out of this application.
+ * A visitor with no Connect session sees nothing at all, ever - which is why
+ * this is safe to mount unconditionally, unlike `silentSignIn`, whose cost
+ * lands on exactly the people it cannot help.
+ *
+ * ### Two prompts, because consent is not assumed
+ *
+ * A visitor who has authorised this application before gets their name, email,
+ * workspace and photo, because Connect will release those to an application
+ * they have already agreed to. A visitor who has not gets an impersonal prompt
+ * and a tap that leads to the real consent screen - Connect does not hand over
+ * so much as a first name until that has happened once.
+ *
+ * ### Placement
+ *
+ * Bottom of the viewport on a phone, bottom-right from `sm:` up. Deliberately
+ * not top-right: on a phone that is where the browser chrome and the
+ * application's own header live, and this must never cover the thing the
+ * visitor came to use.
+ */
+export interface ConnectOneTapProps {
+    /**
+     * Where to send someone whose tap needs the interactive screen - the first
+     * connection to this application, or an account that has an MFA or
+     * subscription step outstanding. Defaults to the bridge's own `/signin`.
+     */
+    onInteractiveSignIn?: () => void;
+    className?: string;
+}
+export declare function ConnectOneTap({ onInteractiveSignIn, className }: ConnectOneTapProps): import("react").JSX.Element | null;

package/dist/types/client/components/plan-pricing.d.ts

@@ -117,3 +117,26 @@ export declare function annualSaving(monthly: Plan | null | undefined, annual: P
 export type PlanAction = "current" | "upgrade" | "downgrade" | "switch-to-annual" | "switch-to-monthly" | "subscribe";
 export declare function resolveAction(plan: Plan, current: SubscriptionResponse | null): PlanAction;
 export declare const ACTION_LABEL: Record<PlanAction, string>;
+/**
+ * The subscription id a checkout hand-off should carry for `action` - or
+ * `null`, meaning "send them to Connect's *subscribe* screen".
+ *
+ * Paired with `resolveAction` deliberately: the button's label and the URL it
+ * opens are one decision, and deriving the URL from the mere *presence* of a
+ * subscription row instead is what sent a card reading "Subscribe" to
+ * Connect's change-plan screen, which answered `notFound()`.
+ *
+ * The gap is real rather than hypothetical. `resolveAction` needs the
+ * **current plan** to classify a change and answers `"subscribe"` without
+ * one - and `SubscriptionResponse` carries `plan: null` beside a perfectly
+ * live `subscription` whenever that plan has been deleted from the catalogue
+ * out from under it, which a re-seeded application does. Connect's change-plan
+ * route is stuck in the same place for the same reason: it cannot prorate
+ * against a price it cannot read.
+ *
+ * Sending those to `/apps/.../subscribe/...` is a real hand-off, not a guess:
+ * that route re-reads the workspace's live subscriptions server-side and
+ * redirects to the change-plan screen itself when there genuinely is one to
+ * change. Connect decides, so the grid does not have to be sure.
+ */
+export declare function checkoutSubscriptionId(action: PlanAction, current: SubscriptionResponse | null): string | null;

package/dist/types/client/index.d.ts

@@ -11,7 +11,7 @@
  * change lands identically in all of them.
  */
 export { ConnectProvider, useConnect, useConnectUser, useConnectWorkspaceType, useConnectAudience, useConnectPlatformAccess, useConnectEntitlements, useConnectPlans, useConnectApps, useConnectCompanyProfile, useConnectAddonUsage, useConnectSessions, useConnectIntegrations, useConnectResource, CONNECT_APP_URL, } from "./provider.js";
-export type { ConnectProviderProps, ConnectContextValue, ConnectSession } from "./provider.js";
+export type { ConnectProviderProps, ConnectContextValue, ConnectSession, ConnectOneTapHint, ConnectOneTapFailure, UseConnectResourceOptions, } from "./provider.js";
 export { blockingBlockers, normalizePlanFeatures } from "../helpers.js";
 export type { WirePlanFeature } from "../helpers.js";
 export { ConnectError, isConnectError } from "../errors.js";
@@ -23,6 +23,8 @@ export { ConnectLogo } from "./components/logo.js";
 export type { ConnectLogoProps } from "./components/logo.js";
 export { ConnectLoginButton, ConnectRegisterButton } from "./components/auth-buttons.js";
 export type { ConnectAuthButtonProps } from "./components/auth-buttons.js";
+export { ConnectOneTap } from "./components/one-tap.js";
+export type { ConnectOneTapProps } from "./components/one-tap.js";
 export { ConnectUserButton, ConnectProfileModal, 
 /** @deprecated Renamed to `ConnectUserButton`. */
 ConnectUserMenu, ConnectManageSubscriptionButton, ConnectInvoicesButton, ConnectProfileButton, ConnectHomeButton, ConnectSignOutButton, } from "./components/user-menu.js";
@@ -82,7 +84,7 @@ export { ConnectFilterTabs } from "./components/filter-tabs.js";
 export type { ConnectFilterTabsProps, ConnectFilterTabsOption } from "./components/filter-tabs.js";
 export { useConnectCheckout, buildCheckoutUrl } from "./use-checkout.js";
 export type { ConnectCheckoutStatus, ConnectCheckoutState, ConnectEntitlements, StartCheckoutOptions, CheckoutUrlOptions, } from "./use-checkout.js";
-export { formatPrice, monthlyOf, resolveAction, annualSaving, discountLabel, ACTION_LABEL, isFreePlan, groupPlansByTier, resolvePlanGroup, } from "./components/plan-pricing.js";
+export { formatPrice, monthlyOf, resolveAction, checkoutSubscriptionId, annualSaving, discountLabel, ACTION_LABEL, isFreePlan, groupPlansByTier, resolvePlanGroup, } from "./components/plan-pricing.js";
 export type { PlanAction, PlanTier, ComparablePlan } from "./components/plan-pricing.js";
 export { ConnectWorkspaceSwitcher } from "./components/workspace-switcher.js";
 export type { ConnectWorkspaceSwitcherProps } from "./components/workspace-switcher.js";

package/dist/types/client/provider.d.ts

@@ -20,7 +20,52 @@ export interface ConnectSession {
      * `null` on a signed-in session.
      */
     audience: SessionAudience | null;
+    /**
+     * Where the browser may ask Connect about the visitor, or `null` when this
+     * deployment cannot run One Tap - see `IdentityResource.oneTapEndpoints`.
+     *
+     * Delivered on the session read the provider already makes, so discovering
+     * One Tap costs no extra request. Optional because an older bridge will not
+     * send it.
+     */
+    oneTap?: {
+        hintUrl: string;
+        authorizeUrl: string;
+    } | null;
 }
+/**
+ * What Connect says about the visitor, before anything has been signed.
+ *
+ * Note what is *not* here when `consented` is `false`: no name, no email, no
+ * photo. Connect withholds all of it until the visitor has authorised this
+ * application at least once, so the first prompt an application ever shows is
+ * necessarily the impersonal one.
+ */
+export interface ConnectOneTapHint {
+    status: "signed_out" | "signed_in";
+    consented?: boolean;
+    user?: {
+        displayName: string | null;
+        email: string | null;
+        photoUrl: string | null;
+    };
+    workspace?: {
+        name: string;
+    } | null;
+    application?: {
+        name: string;
+        iconUrl: string | null;
+    };
+}
+/**
+ * Why a tap did not end in a session.
+ *
+ * Every one of these is ordinary traffic rather than a fault, which is why
+ * `oneTapSignIn` reports them as a value instead of throwing: `consent_required`
+ * and `interaction_required` both mean "this needs the interactive screen", and
+ * that is a hand-off, not an error to show anybody.
+ */
+export type ConnectOneTapFailure = "unavailable" | "login_required" | "consent_required" | "interaction_required" | "rate_limited" | "failed";
 export interface ConnectContextValue {
     /**
      * Public OAuth client id, if `clientId` was passed to `<ConnectProvider>` -
@@ -89,6 +134,42 @@ export interface ConnectContextValue {
     streamResource(path: string, body: unknown, options?: {
         signal?: AbortSignal;
     }): Promise<Response>;
+    /**
+     * Asks Connect whether this visitor is already signed in there, without
+     * navigating anywhere.
+     *
+     * This is the read `<ConnectOneTap>` is built on, and the reason One Tap
+     * beats `silentSignIn`: one credentialed `fetch` answers the question that
+     * used to cost a full-page redirect to Connect and back.
+     *
+     * It only works when the application is served from the **same site** as
+     * Connect - a `cosmoops.com` subdomain. `SameSite` is judged on the
+     * registrable domain, so the visitor's Connect session cookie rides along
+     * from `crm.cosmoops.com` and does not from anywhere else. Off-site
+     * deployments get `signed_out`, which is why every caller treats that answer
+     * as "say nothing" rather than "this visitor has no account".
+     *
+     * Resolves to `null` when the bridge offers no One Tap endpoints, or when the
+     * request itself fails - a Connect that cannot be reached says nothing about
+     * whether anyone is signed into it.
+     */
+    readOneTapHint(): Promise<ConnectOneTapHint | null>;
+    /**
+     * Completes a One Tap sign-in, with no navigation at any point.
+     *
+     * Three requests: the bridge mints a PKCE pair and keeps the verifier, Connect
+     * hands back an authorization code, the bridge exchanges it and stores the
+     * session. The page only ever holds the code, which is worthless without the
+     * verifier it never sees.
+     *
+     * Refreshes the session on success, so consumers re-render signed in.
+     */
+    oneTapSignIn(): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: ConnectOneTapFailure;
+    }>;
 }
 export interface ConnectProviderProps {
     /**
@@ -375,13 +456,30 @@ export declare function useConnectSessions(): {
      */
     refetch(): void;
 };
+/** Options for {@link useConnectResource}. */
+export interface UseConnectResourceOptions {
+    /**
+     * Whether the read has to wait for a session. `true` by default, and right
+     * for every route but one.
+     *
+     * Pass `false` only for a bridge route that takes neither a session nor a
+     * workspace - today that is `GET /company-profile` alone, and its handler
+     * says why. Passing it for anything else does not widen access (the bridge
+     * still refuses), it just buys a guaranteed 401 sooner.
+     */
+    requiresSession?: boolean;
+}
 /**
  * One bridge read, shared through the provider's cache.
  *
- * Only fetches once a user is known: every resource route needs a session, so
- * firing before one exists just buys a guaranteed 401.
+ * Waits for a session by default: every resource route but one needs it, so
+ * firing before one exists just buys a guaranteed 401. `requiresSession:
+ * false` opts out, and the reason it exists is the grievance notice - a
+ * statutory contact is at its most useful on a public page a signed-out
+ * visitor is reading, so a hook that answered `null` until someone logged in
+ * would render nothing at exactly the moment that matters.
  */
-export declare function useConnectResource<T>(path: string): {
+export declare function useConnectResource<T>(path: string, options?: Readonly<UseConnectResourceOptions>): {
     data: T | null;
     isLoading: boolean;
     error: string | null;

package/dist/types/client/use-checkout.d.ts

@@ -64,6 +64,15 @@ export interface CheckoutUrlOptions {
      * plan on this subscription"; absent means "subscribe for the first time" -
      * and the two are separate screens in Connect, because only one of them can
      * price proration against a cycle already paid for.
+     *
+     * Pass it only when you know **which plan the subscription is on today**,
+     * which is what makes the change classifiable. `checkoutSubscriptionId`
+     * derives it from the action you are already showing on the button; a bare
+     * `subscription?.subscription?.id` does not, and a live subscription whose
+     * plan has been deleted from the catalogue is the case where the two differ
+     * and the change-plan screen answers `notFound()`. Leaving it `null` is
+     * always safe: the subscribe route redirects to the change-plan screen
+     * itself when Connect finds a subscription to change.
      */
     subscriptionId?: string | null;
     /** Carried into Connect's checkout, where it is validated against the real cart. */

package/dist/types/server/client.d.ts

@@ -2,10 +2,13 @@ import type { FetchLike } from "./http.js";
 import { AccessResource } from "./resources/access.js";
 import { AppsResource } from "./resources/apps.js";
 import { AiResource } from "./resources/ai.js";
+import { EnrichmentResource } from "./resources/enrichment.js";
 import { DataResource } from "./resources/data.js";
 import { WorkspacesResource } from "./resources/workspaces.js";
 import { SchedulingResource } from "./resources/scheduling.js";
 import { ContactsResource } from "./resources/contacts.js";
+import { ChannelsResource } from "./resources/channels.js";
+import { CallsResource } from "./resources/calls.js";
 import { KvResource } from "./resources/kv.js";
 import { BillingResource } from "./resources/billing.js";
 import { DriveResource } from "./resources/drive.js";
@@ -81,8 +84,13 @@ export declare class ConnectClient {
     readonly scheduling: SchedulingResource;
     /** Who a workspace already knows how to reach, by phone or by id. */
     readonly contacts: ContactsResource;
+    /** The phone numbers Connect has assigned to your application, and where each one routes. */
+    readonly channels: ChannelsResource;
+    /** The calls that arrived on those channels, with their transcripts. */
+    readonly calls: CallsResource;
     /** RAG chat and structured extraction. */
     readonly ai: AiResource;
+    readonly enrichment: EnrichmentResource;
     /** Your application's own document store - see `DataResource`. */
     readonly data: DataResource;
     /** Your application's key/value store - see `KvResource`. */
@@ -115,4 +123,4 @@ export declare class ConnectClient {
     constructor(options: ConnectClientOptions);
 }
 /** Kept in step with `package.json` by `sdk.test.ts`. */
-export declare const SDK_VERSION = "0.20.0";
+export declare const SDK_VERSION = "0.23.0";

package/dist/types/server/index.d.ts

@@ -18,6 +18,7 @@ export type { AppsResource } from "./resources/apps.js";
 export type { EntitlementsResource } from "./resources/entitlements.js";
 export type { BillingResource } from "./resources/billing.js";
 export type { AiResource } from "./resources/ai.js";
+export type { EnrichmentResource } from "./resources/enrichment.js";
 export type { DataResource } from "./resources/data.js";
 export type { KvResource } from "./resources/kv.js";
 export type { WorkspacesResource } from "./resources/workspaces.js";
@@ -29,6 +30,8 @@ export type { ExecuteIntegrationActionInput, IntegrationsResource } from "./reso
 export type { PlatformResource } from "./resources/platform.js";
 export type { SchedulingResource, FindSlotsInput, ListBookingsInput, CreateBookingInput, RescheduleBookingInput, } from "./resources/scheduling.js";
 export type { ContactsResource, LookupContactInput } from "./resources/contacts.js";
+export type { ChannelsResource, ListChannelsInput, ClaimChannelInput, } from "./resources/channels.js";
+export type { CallsResource, ListCallsInput } from "./resources/calls.js";
 /**
  * Webhook verification and a ready-made POST route. Server-only for the
  * obvious reason: the signing secret must never reach a browser bundle.

package/dist/types/server/resources/calls.d.ts

@@ -0,0 +1,45 @@
+import { type TransportOptions } from "../http.js";
+import type { CallDetail, CallsPage } from "../../types.js";
+export interface ListCallsInput {
+    /** Narrow to one channel. A channel belonging to another application simply matches nothing. */
+    channelId?: string;
+    /** From a previous page's `nextCursor`. */
+    cursor?: string;
+    /** 1-100, default 50. */
+    limit?: number;
+}
+/**
+ * Every call that arrived on a channel assigned to your application.
+ *
+ * The application is resolved from your API key and is never a parameter, so
+ * there is no request that reads another partner's calls.
+ *
+ * `channelId` is the only filter, and that is a budget decision rather than an
+ * oversight: each filter costs a Firestore composite index against a project
+ * already near its ceiling. Filter the rest client-side, or read the
+ * aggregates from `analytics`.
+ */
+export declare class CallsResource {
+    private readonly transport;
+    constructor(transport: TransportOptions);
+    /**
+     * Your calls, newest first, across all of your subscribing workspaces.
+     *
+     * **Page until `hasMore` is `false`; do not stop on an empty `items`.** A
+     * page can come back empty with more behind it.
+     */
+    list(input?: ListCallsInput): Promise<CallsPage>;
+    /**
+     * One call and every transcript turn, ordered by `sequence` - which is the
+     * sort to trust, since two turns can share a millisecond.
+     *
+     * `recordingFileId` and `transcriptFileId` are Drive file ids, readable with
+     * a `drive:read` key. Both are `null` until the carrier posts the audio,
+     * which is the normal state for a call that has only just ended - branch on
+     * `recordingStatus` rather than treating `null` as a failure.
+     *
+     * Throws `ConnectError` with `code: "not_found"` for a call that does not
+     * exist *or* belongs to another application.
+     */
+    get(callId: string): Promise<CallDetail>;
+}

package/dist/types/server/resources/channels.d.ts

@@ -0,0 +1,91 @@
+import { type TransportOptions } from "../http.js";
+import type { ChannelKind, ChannelRoutingRecord, ChannelsPage, ClaimedChannel, ConnectChannel } from "../../types.js";
+export interface ListChannelsInput {
+    /** Narrow to one workspace. Omit to list every channel assigned to your application. */
+    workspaceId?: string;
+    /** From a previous page's `nextCursor`. */
+    cursor?: string;
+    /** 1-100, default 50. */
+    limit?: number;
+}
+export interface ClaimChannelInput {
+    workspaceId: string;
+    /** Defaults to `"voice"`, the only kind Connect stocks inventory for today. */
+    kind?: ChannelKind;
+}
+/**
+ * The phone numbers Connect has assigned to your application.
+ *
+ * **Inventory is platform-owned.** A number is a regulated asset bought under
+ * Connect's carrier account and reassignable between workspaces, so your
+ * application never provisions, prices or releases one - it claims from a pool
+ * it cannot see, and reads back what it was given. That is why `claim` takes a
+ * workspace and a kind rather than a number, and why nothing here exposes a
+ * carrier, a provider reference or a monthly rate.
+ *
+ * The application is resolved from your API key and is never a parameter, so
+ * no request shape here can reach another partner's channels. A channel
+ * belonging to someone else answers `404`, not `403` - confirming it exists
+ * would make these reads an oracle for enumerating their channel ids.
+ */
+export declare class ChannelsResource {
+    private readonly transport;
+    constructor(transport: TransportOptions);
+    /**
+     * Every channel assigned to your application, across all of your subscribing
+     * workspaces.
+     *
+     * Page until `hasMore` is `false`.
+     */
+    list(input?: ListChannelsInput): Promise<ChannelsPage>;
+    /**
+     * The channel behind an id you already hold - a webhook's `channelId`, or a
+     * call record's.
+     *
+     * Throws `ConnectError` with `code: "not_found"` for an id that does not
+     * exist *or* belongs to another application.
+     */
+    get(channelId: string): Promise<ConnectChannel>;
+    /**
+     * Takes a number out of Connect's inventory and binds it to one of your
+     * subscribing workspaces.
+     *
+     * **You do not pick the number.** A workspace may hold exactly one, across
+     * every application it uses, and it is then fixed for the life of the
+     * engagement - there is no re-claim and no swap. Only a Connect operator can
+     * unassign one.
+     *
+     * Two different `409`s, and they need different handling: the workspace
+     * already holds a channel of this kind (fix the call), or the pool is empty
+     * right now (retry - Connect is notified, and this is not permanent).
+     *
+     * The claimed channel comes back without routing, because it has none yet.
+     * Call `setRouting` next, or the number refuses every call that reaches it.
+     */
+    claim(input: ClaimChannelInput): Promise<ClaimedChannel>;
+    /**
+     * Points a channel at wherever inbound conversations should go.
+     *
+     * `destination` is yours: Connect stores it verbatim and never reads into
+     * it. It **replaces** the stored record rather than merging, so send the
+     * whole destination each time; it must serialize to 16 KB or fewer.
+     *
+     * Throws `code: "conflict"` when the channel is suspended or released - use
+     * `clearRouting` to stop a suspended number answering, which is deliberately
+     * still allowed.
+     */
+    setRouting(channelId: string, destination: Record<string, unknown>): Promise<ChannelRoutingRecord>;
+    /**
+     * Takes a number out of service without giving it up - the channel stays
+     * assigned to you and stays billable, and inbound calls are refused until
+     * you write routing again.
+     *
+     * This is the only way to say "stop answering": overwriting `destination`
+     * can only ever point the number somewhere *else*, and unassigning it is a
+     * Console action that returns the number to Connect's inventory.
+     *
+     * Idempotent - clearing already-clear routing answers `200` with
+     * `routing: null`, so a retry after a lost response is safe.
+     */
+    clearRouting(channelId: string): Promise<ChannelRoutingRecord>;
+}

package/dist/types/server/resources/enrichment.d.ts

@@ -0,0 +1,44 @@
+import { type TransportOptions } from "../http.js";
+import type { CompanyEnrichmentResult } from "../../types.js";
+/**
+ * What Connect knows about the company at a domain.
+ *
+ * The thing behind "the account filled itself in": a record holding nothing
+ * but `priya@acme.com` can offer a name, an industry, a size band and an
+ * address instead of an empty form.
+ *
+ * Two properties are worth knowing before you wire it in, because they decide
+ * how you should render the result:
+ *
+ * - **Every value is cited, and nothing is recalled.** Connect reads the
+ *   company's own website and returns the URL each claim came from. A field
+ *   the pages never stated comes back `null` rather than as a plausible guess.
+ * - **It is a suggestion, not a save.** Nothing is written to your store, and
+ *   nothing should be written to it without the person in front of it
+ *   agreeing - which is also how HubSpot and Zoho present the same feature.
+ */
+export declare class EnrichmentResource {
+    private readonly transport;
+    constructor(transport: TransportOptions);
+    /**
+     * Look a company up from a work email address or a domain.
+     *
+     * Send whichever you hold; `domain` wins when both are given. A consumer
+     * address (`founder@gmail.com`) is answered with
+     * `{ status: "skipped", reason: "consumer_domain" }` rather than an error -
+     * it names a person, not an employer.
+     *
+     * `asUser` attributes the generation to the signed-in caller's workspace,
+     * resolved from their session token. Without it the call is attributed to
+     * your application.
+     */
+    company(input: {
+        email?: string;
+        domain?: string;
+        asUser?: string;
+        /** Re-read the site even if Connect has a fresh profile cached. For an operator pressing "refresh" - not for automatic calls, which should take the cache. */
+        refresh?: boolean;
+    }, options?: {
+        signal?: AbortSignal;
+    }): Promise<CompanyEnrichmentResult>;
+}

package/dist/types/server/resources/identity.d.ts

@@ -27,6 +27,24 @@ export interface ExchangeCodeInput {
 }
 /** A URL-safe random string, suitable for `state` or a PKCE verifier. */
 export declare function createState(byteLength?: number): string;
+/** One Tap's PKCE pair - `challenge` is `BASE64URL(SHA256(verifier))`, RFC 7636 S256. */
+export interface PkcePair {
+    verifier: string;
+    challenge: string;
+}
+/**
+ * Mints a PKCE pair for the One Tap flow.
+ *
+ * The redirect flow can take PKCE or leave it, because the code is delivered
+ * to the application's server on a redirect the browser only forwards. One Tap
+ * hands the code *to the page*, so the verifier is the thing that makes a
+ * stolen code worthless - it stays in an `HttpOnly` cookie on the application's
+ * own origin and is never sent to the browser.
+ *
+ * `crypto.subtle` rather than a Node hash, so this stays isomorphic and the
+ * `./next` entry keeps loading on the edge runtime as well as Node.
+ */
+export declare function createPkcePair(): Promise<PkcePair>;
 /**
  * "Login with Connect" - the OAuth2 handshake, and the session that outlives
  * it.
@@ -42,6 +60,23 @@ export declare class IdentityResource {
     constructor(transport: TransportOptions, clientId: string | null, appBaseUrl: string);
     /** Step 1 - the URL to send the user's browser to. */
     authorizeUrl(input: AuthorizeUrlInput): string;
+    /**
+     * The two Connect endpoints One Tap talks to **from the browser**, or `null`
+     * when this client has no `clientId` configured and the flow cannot run.
+     *
+     * Handed out by the bridge rather than built in the page, so One Tap needs no
+     * client-side configuration at all - a `./next` application sets
+     * `CONNECT_CLIENT_ID` server-side and nothing else. Both URLs carry only the
+     * public `client_id`; neither is a credential.
+     *
+     * Returning `null` rather than throwing (as `authorizeUrl` does) because this
+     * is read on the `/session` route, which must keep answering for an
+     * application that has no OAuth client configured at all.
+     */
+    oneTapEndpoints(): {
+        hintUrl: string;
+        authorizeUrl: string;
+    } | null;
     /** Step 2 - trade the one-time `code` for a session. Server-side only. */
     exchangeCode(input: ExchangeCodeInput): Promise<TokenResponse>;
     /**

package/dist/types/server/resources/workspaces.d.ts

@@ -1,8 +1,8 @@
 import { type TransportOptions } from "../http.js";
-import type { ConnectWorkspaceMember, UserWorkspace, WorkspaceSwitchResult } from "../../types.js";
+import type { ConnectInvitation, ConnectMemberAccess, ConnectMemberAccessResult, ConnectWorkspaceMember, UserWorkspace, WorkspaceSwitchResult } from "../../types.js";
 /**
- * Which workspaces the signed-in user belongs to, moving between them, and who
- * else is on the team.
+ * Which workspaces the signed-in user belongs to, moving between them, who
+ * else is on the team, and inviting or granting access to your application.
  *
  * **Every call here needs `asUser`** - the signed-in user's opaque
  * `sessionToken`. There is no application-wide form of any of these: they take
@@ -52,4 +52,64 @@ export declare class WorkspacesResource {
     members(options: {
         asUser: string;
     }): Promise<ConnectWorkspaceMember[]>;
+    /**
+     * Seats, what the caller may do with them, and the invitations already
+     * holding one - everything a team screen needs to decide what to draw.
+     *
+     * Behind `members:manage` rather than `workspaces:read`, and gated on the
+     * caller's own `member:invite`: it names people who are not members yet.
+     */
+    access(options: {
+        asUser: string;
+    }): Promise<ConnectMemberAccess>;
+    /**
+     * Invite someone into the workspace, with access to your application.
+     *
+     * `roleKey` names a role from your own catalog (or the reserved `"admin"`);
+     * omit it to add someone to the workspace with no access to your
+     * application. You cannot send a Connect role - the grant is built server
+     * side as `[member, app:<yourKey>:<roleKey>]`, so nothing this method can
+     * express reaches outside your application.
+     *
+     * Spends a member seat when the invitation is created, not when it is
+     * accepted. Throws `ConnectError` with status 409 and a message written to
+     * be shown when there is no seat, and 403 when the caller is inviting
+     * someone with access they do not hold themselves.
+     */
+    invite(input: {
+        inviteeEmail: string;
+        roleKey?: string | null;
+    }, options: {
+        asUser: string;
+    }): Promise<ConnectInvitation>;
+    /**
+     * Grant or revoke **your application's** role for an existing member.
+     * `roleKey: null` revokes it.
+     *
+     * Moves only your own grant: Connect recomputes the member's roles as what
+     * they hold now, minus any grant naming your application, plus the one you
+     * asked for. Their workspace role and every other application they use are
+     * untouched, and there is no form of this that removes them from the
+     * workspace.
+     *
+     * Re-sending the role they already have is a no-op rather than an error, so
+     * a form that submits whatever is on screen is safe.
+     */
+    setAccess(input: {
+        userId: string;
+        roleKey: string | null;
+    }, options: {
+        asUser: string;
+    }): Promise<ConnectMemberAccessResult>;
+    /**
+     * Withdraw a pending invitation your application sent, freeing its seat.
+     *
+     * Only yours - an invitation carrying another application's grant is a 404,
+     * deliberately indistinguishable from one that does not exist.
+     */
+    revokeInvitation(input: {
+        invitationId: string;
+    }, options: {
+        asUser: string;
+    }): Promise<void>;
 }