@cosmoops/connect-sdk 0.21.0 → 0.24.0

package/CHANGELOG.md

@@ -3,6 +3,207 @@
 `@cosmoops/connect-sdk` follows semver, with the 0.x convention that **minor
 versions may carry breaking changes** and patch versions never do.
 
+## 0.24.0
+
+### Fixed
+
+- **`connect.integrations.initiateConnect()` could never succeed.** Connect's
+  `POST /integrations/connect` requires a `userId` - it stores it as the
+  connection's `connectedByUserId` - and the SDK sent `workspaceId`,
+  `toolkitSlug` and `returnUrl` and nothing else. Every call 400'd, including
+  the one `createConnectHandler`'s own `POST /integrations/connect` route
+  makes, so **`<ConnectIntegrationsModal />`'s Connect button was broken too**:
+  the browser reached the bridge, the bridge reached Connect, and Connect
+  refused with `Invalid input: expected string, received undefined` - a Zod
+  message that names no field, which is most of why this survived.
+
+  The conformance suite pinned the *response* shape and not the request, so
+  nothing failed the build. It now pins the request body against the
+  use-case command, and `src/conformance.test.ts` fails to compile if the
+  route grows a fourth required field.
+
+### Changed
+
+- **`initiateConnect` takes an input object** - `initiateConnect(workspaceId,
+  { toolkitSlug, returnUrl, userId })`, replacing the three positional
+  strings. Breaking in name only: the old signature had no working call to
+  break. The object shape matches `execute()` on the same resource, and it is
+  what keeps `returnUrl` and `userId` from being silently transposable.
+
+  `userId` is the signed-in member starting the connection. Take it from your
+  own session, never from a form: the toolkit connection is shared by the
+  whole workspace, so this attribution is the only record of who turned it on.
+  The bridge already does this for you - it reads the session's user, and a
+  `userId` in the request body is ignored, the same way a crafted
+  `workspaceId` always was.
+
+- **`InitiateIntegrationConnectionInput` is exported** from
+  `@cosmoops/connect-sdk/server`, beside `ExecuteIntegrationActionInput`.
+
+## 0.23.0
+
+### Added
+
+- **`CompanyProfile.legalJurisdiction`** - the seat a governing-law clause
+  names, e.g. `"Chennai, Tamil Nadu"`.
+
+  **This is not the registered address**, and that is why it is its own field
+  rather than something to derive. An entity registered in one state routinely
+  names another as the venue for disputes, and the applications that kept
+  their own copies of this had reached for the registered address instead -
+  publishing two different venues on two terms pages operated by the same
+  company. `null` when the operator has not published one, in which case a
+  terms page should omit the venue rather than substitute anything.
+
+- **`CompanyProfile.brandName` is now editable by the platform operator.** The
+  field is unchanged on the wire; what changed is that Connect served it from
+  a hardcoded constant until now, which made it the one company fact nobody
+  could correct without a deploy.
+
+### Changed
+
+- **`GET /company-profile` can now answer `503 unavailable`.** Connect used to
+  resolve every field against hardcoded defaults, so this endpoint always
+  answered - including with a legal name and grievance officer that nobody had
+  checked against the operator's own record. Those defaults are gone, and an
+  unconfigured platform refuses the read instead.
+
+  Nothing you wrote needs changing: `<ConnectGrievanceNotice />` already
+  renders `null` on failure, and `useConnectCompanyProfile()` surfaces it as
+  an error like any other. **Do not add a fallback of your own** - a copy kept
+  for outages is still a copy, and going stale is the failure this endpoint
+  exists to prevent.
+
+- **`connect.enrichment.company()`** - fill an account in from a work email
+  address, instead of asking somebody to type it.
+
+  ```ts
+  const result = await connect.enrichment.company({ email: "priya@acme.test" });
+  if (result.status === "enriched") {
+    form.setValues(result.profile); // then let the person confirm it
+  }
+  ```
+
+  Connect reads the company's **own website** - the domain your input yields,
+  plus About/Contact pages linked from its homepage - and returns what it found
+  with `citations` naming the URL each claim came from. It does not search the
+  web, and it never answers from a model's recall: a field the pages did not
+  state comes back `null`. An invented industry is indistinguishable from a
+  real one, and an invented address reaches an invoice.
+
+  `status: "skipped"` is a normal 200, not an error - most records legitimately
+  have nothing to enrich. `consumer_domain` (a `gmail.com` address names a
+  person, not an employer) and `blocked_domain` will never succeed on a retry;
+  `unreachable` and `no_signal` may. `confidence` is derived from how many
+  fields the pages actually supported, not from the model's opinion of itself,
+  so `low` means "offer this" and `high` means "safe to pre-fill".
+
+  Needs an API key scoped to the new **`enrichment:read`**. That is separate
+  from `ai:extract` because the two differ in what they touch rather than only
+  in what they cost: extraction reads a file you already hold, this makes
+  Connect fetch a third-party website on a string that reached you from a
+  stranger.
+
+- **`connect.workspaces.access()`, `.invite()`, `.setAccess()` and
+  `.revokeInvitation()`** - manage the customer's roster from inside your own
+  application, instead of sending them to Connect's team page.
+
+  `members()` has always been a read, so a partner's own team screen could
+  show who had access and then had to hand off to Connect for every change.
+  These four close that loop, and all of them take `asUser`: the workspace and
+  the actor come from the caller's session token, never from a parameter.
+
+  ```ts
+  const { capacity, viewer } = await connect.workspaces.access({ asUser: token });
+  if (viewer.canInvite && capacity.canAdd) {
+    await connect.workspaces.invite({ inviteeEmail: "priya@acme.test", roleKey: "rep" }, { asUser: token });
+  }
+  await connect.workspaces.setAccess({ userId, roleKey: null }, { asUser: token }); // revoke
+  ```
+
+  **You can only ever move your own application's grant.** The wire carries a
+  `roleKey` from your catalog rather than a roles array, and Connect computes
+  the member's next roles as *what they hold now, minus any grant naming your
+  application, plus yours* - so nothing these methods can express reaches a
+  workspace-wide Connect role, another application's access, or removes
+  someone from the workspace.
+
+  Two gates apply on top of the API key's new `members:manage` scope, and both
+  are about the person rather than your application: the signed-in caller must
+  hold Connect's own `member:invite` / `member:update` on the workspace, and
+  they cannot grant access they do not hold themselves. `viewer` on the
+  `access()` response is the first of those, resolved, so you can render your
+  controls from it instead of letting a button 403.
+
+  **Seats are the workspace's, not your plan's.** `capacity.included` is a
+  baseline plus every active subscription's member allowance folded across
+  applications, and `used` counts pending invitations as well as members,
+  because an invitation is a seat already spoken for. `reason` separates "no
+  plan grants member seats" (`no_allowance` - sell them one) from "every seat
+  is taken" (`exhausted` - an upgrade, or a removal); those read alike and
+  need different words on screen. The read is advisory - the authoritative
+  check runs inside `invite()`, which is where two people claiming the last
+  seat at once is settled.
+
+  `revokeInvitation()` is not optional decoration: an invitation sent to a
+  mistyped address holds a seat for its full seven days, and an application
+  that can spend one but not release it leaves a customer paying for a seat
+  nobody can use.
+
+  **Server-side only, deliberately.** None of the four is exposed through
+  `createConnectHandler`, which stays four fixed reads plus sign-out and the
+  workspace switch. A bridge route is a capability handed to any script
+  running in your page, and "grant this account admin" is the highest-value
+  one there is; call these from your own server, where the API key already
+  lives.
+
+## 0.22.0
+
+### Fixed
+
+- **`<ConnectGrievanceNotice />` rendered nothing for a signed-out visitor -
+  which is most of the people who read a privacy page.**
+
+  The bridge route `GET /company-profile` is deliberately unauthenticated: the
+  answer is a fact about the platform operator, identical for every caller and
+  already on the public web, and requiring a session would hide the redressal
+  channel at the one moment it most needs to be legible. The browser half
+  never got that exemption. `useConnectCompanyProfile` goes through
+  `useConnectResource`, which waits for `session.user` before it reads - right
+  for every other route, and the reason this component was blank on exactly
+  the public page the docs recommend putting it on.
+
+  `useConnectResource` now takes `{ requiresSession: false }`, and the company
+  profile is its only caller. It widens no access - the bridge decides that,
+  not the hook.
+
+- **`<ConnectPlans />`: a card reading "Subscribe" opened Connect's *change
+  plan* screen, which answered a 404.**
+
+  The label and the URL were two separate decisions. `resolveAction` needs the
+  **current plan** to classify a change and falls back to `"subscribe"`
+  without one; the checkout URL was built from the mere presence of a
+  subscription *row*. Those disagree in a state Connect reports routinely:
+  `SubscriptionResponse` carries `plan: null` beside a live `subscription`
+  whenever that plan has been deleted from the application's catalogue - which
+  re-seeding an application does. The button then said "Subscribe" and opened
+  `/billing/subscriptions/{id}/change-plan/{planId}`, where Connect could not
+  read the current price either and rendered its not-found page.
+
+  Both now come from the same `PlanAction`. When the grid cannot classify a
+  change it hands off to the subscribe route, which re-reads the workspace's
+  live subscriptions server-side and redirects to the change-plan screen
+  itself when there is genuinely one to change - so Connect decides, and the
+  grid does not have to be sure.
+
+### Added
+
+- **`checkoutSubscriptionId(action, current)`** - the other half of
+  `resolveAction`, exported alongside it. A partner writing its own pricing
+  grid has to turn that action into a checkout URL, and reading the
+  subscription id straight off the entitlements response is exactly the bug
+  above. Pass its result as `buildCheckoutUrl`'s `subscriptionId`.
+
 ## 0.21.0
 
 ### Added

package/dist/cjs/client/components/plan-pricing.js

@@ -28,6 +28,7 @@ exports.resolvePlanGroup = resolvePlanGroup;
 exports.groupPlansByTier = groupPlansByTier;
 exports.annualSaving = annualSaving;
 exports.resolveAction = resolveAction;
+exports.checkoutSubscriptionId = checkoutSubscriptionId;
 /**
  * Whether a plan costs nothing - the SDK's copy of Connect's `isFreeSelection`
  * (`packages/data/src/payments/free-plan.ts`), which is what the server
@@ -207,3 +208,30 @@ exports.ACTION_LABEL = {
     "switch-to-monthly": "Switch to monthly",
     subscribe: "Subscribe",
 };
+/**
+ * The subscription id a checkout hand-off should carry for `action` - or
+ * `null`, meaning "send them to Connect's *subscribe* screen".
+ *
+ * Paired with `resolveAction` deliberately: the button's label and the URL it
+ * opens are one decision, and deriving the URL from the mere *presence* of a
+ * subscription row instead is what sent a card reading "Subscribe" to
+ * Connect's change-plan screen, which answered `notFound()`.
+ *
+ * The gap is real rather than hypothetical. `resolveAction` needs the
+ * **current plan** to classify a change and answers `"subscribe"` without
+ * one - and `SubscriptionResponse` carries `plan: null` beside a perfectly
+ * live `subscription` whenever that plan has been deleted from the catalogue
+ * out from under it, which a re-seeded application does. Connect's change-plan
+ * route is stuck in the same place for the same reason: it cannot prorate
+ * against a price it cannot read.
+ *
+ * Sending those to `/apps/.../subscribe/...` is a real hand-off, not a guess:
+ * that route re-reads the workspace's live subscriptions server-side and
+ * redirects to the change-plan screen itself when there genuinely is one to
+ * change. Connect decides, so the grid does not have to be sure.
+ */
+function checkoutSubscriptionId(action, current) {
+    if (action === "subscribe")
+        return null;
+    return current?.subscription?.id ?? null;
+}

package/dist/cjs/client/components/plans.js

@@ -83,8 +83,13 @@ function ConnectPlans({ planIds, hideCoupon = false, className }) {
      * created in `"created"` and only flips to active when the payment webhook
      * lands, which can be minutes later. Holding a customer on a spinner until
      * then would misreport a completed checkout as an abandoned one.
+     *
+     * `action` is threaded through rather than re-derived: it is the same
+     * decision the card's label came from, and `checkoutSubscriptionId` is what
+     * keeps the two from disagreeing - see its doc comment for the 404 that
+     * disagreement produced.
      */
-    function startCheckout(plan) {
+    function startCheckout(plan, action) {
         if (!applicationId)
             return;
         checkout.start({
@@ -92,7 +97,7 @@ function ConnectPlans({ planIds, hideCoupon = false, className }) {
                 appUrl,
                 applicationId,
                 planId: plan.id,
-                subscriptionId: subscription?.subscription?.id ?? null,
+                subscriptionId: (0, plan_pricing_js_1.checkoutSubscriptionId)(action, subscription),
                 coupon,
             }),
             isSettled: (next) => next.subscription.plan?.id === plan.id,
@@ -142,7 +147,7 @@ function ConnectPlans({ planIds, hideCoupon = false, className }) {
                                             // plan would race the first and one of them would be
                                             // rejected on arrival.
                                             isDisabled: isCurrent || checkout.status === "waiting", onPress: () => setPending({ plan, action }), children: [plan_pricing_js_1.ACTION_LABEL[action], !isCurrent && (0, jsx_runtime_1.jsx)(lucide_react_1.ExternalLink, { className: "size-3.5" })] }) })] }) }, tier.planGroup));
-                    }) }), subscription?.subscription && ((0, jsx_runtime_1.jsx)(ConnectUnsubscribeRow, { subscription: subscription.subscription, appUrl: appUrl, checkout: checkout })), (0, jsx_runtime_1.jsx)(subscribe_dialog_js_1.ConnectSubscribeDialog, { plan: pending?.plan ?? null, action: pending?.action ?? "subscribe", current: subscription, coupon: hideCoupon ? undefined : coupon, onClose: () => setPending(null), onConfirm: () => pending && startCheckout(pending.plan) })] }) }));
+                    }) }), subscription?.subscription && ((0, jsx_runtime_1.jsx)(ConnectUnsubscribeRow, { subscription: subscription.subscription, appUrl: appUrl, checkout: checkout })), (0, jsx_runtime_1.jsx)(subscribe_dialog_js_1.ConnectSubscribeDialog, { plan: pending?.plan ?? null, action: pending?.action ?? "subscribe", current: subscription, coupon: hideCoupon ? undefined : coupon, onClose: () => setPending(null), onConfirm: () => pending && startCheckout(pending.plan, pending.action) })] }) }));
 }
 /**
  * What the page says while the customer is off in Connect, and after.

package/dist/cjs/client/index.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.flattenNav = exports.normalizeNav = exports.useActivePath = exports.ConnectSideNav = exports.ConnectSidebarNav = exports.RAIL_EXPANDED = exports.RAIL_COLLAPSED = exports.sidebarRowClass = exports.useConnectShell = exports.ConnectShellProvider = exports.ConnectSidebarRow = exports.ConnectSidebarFooter = exports.ConnectSidebarBody = exports.ConnectSidebarHeader = exports.ConnectSidebar = exports.AppShell = exports.ConnectAccountSessions = exports.ConnectSignOutButton = exports.ConnectHomeButton = exports.ConnectProfileButton = exports.ConnectInvoicesButton = exports.ConnectManageSubscriptionButton = exports.ConnectUserMenu = exports.ConnectProfileModal = exports.ConnectUserButton = exports.ConnectOneTap = exports.ConnectRegisterButton = exports.ConnectLoginButton = exports.ConnectLogo = exports.ConnectMark = exports.ConnectGrievanceNotice = exports.isConnectError = exports.ConnectError = exports.normalizePlanFeatures = exports.blockingBlockers = exports.CONNECT_APP_URL = exports.useConnectResource = exports.useConnectIntegrations = exports.useConnectSessions = exports.useConnectAddonUsage = exports.useConnectCompanyProfile = exports.useConnectApps = exports.useConnectPlans = exports.useConnectEntitlements = exports.useConnectPlatformAccess = exports.useConnectAudience = exports.useConnectWorkspaceType = exports.useConnectUser = exports.useConnect = exports.ConnectProvider = void 0;
 exports.resolveAction = exports.monthlyOf = exports.formatPrice = exports.buildCheckoutUrl = exports.useConnectCheckout = exports.ConnectFilterTabs = exports.ConnectCursorPagination = exports.ConnectConfirmDialog = exports.ConnectLinkButton = exports.ConnectPlansPage = exports.ConnectUsageMeter = exports.ConnectPlatformGate = exports.ConnectWorkspaceTypeGate = exports.useConnectFeature = exports.ConnectFeatureGate = exports.useConnectAccessGate = exports.ConnectAccessGate = exports.ConnectReadinessGate = exports.ConnectReadinessBanner = exports.resolveSubscriptionState = exports.ConnectSeatUsage = exports.ConnectTrialBanner = exports.ConnectSubscriptionCard = exports.ConnectNoSubscriptionCard = exports.ConnectSubscriptionGate = exports.ConnectSubscribeDialog = exports.ConnectPlans = exports.ConnectIntegrationsModal = exports.AI_TONE_DOT = exports.AI_TONE_CHIP = exports.AI_EMPTY_VALUE = exports.aiStatusTone = exports.isNumericAiFormat = exports.formatAiValue = exports.AiSources = exports.AiSteps = exports.AiDetails = exports.AiTimeline = exports.AiMetrics = exports.AiChart = exports.AiTable = exports.ConnectAskAi = exports.ConnectAppsGrid = exports.isLinkableConnectScreen = exports.matchConnectScreen = exports.filterNavForAudience = exports.gateExemptPaths = exports.isNavItemActive = exports.resolveActivePath = exports.normalizePath = void 0;
-exports.zonedInstant = exports.dayColumns = exports.layoutBookings = exports.useBookingActions = exports.useBookings = exports.useAvailableSlots = exports.useBookableEventTypes = exports.ConnectBookingDetail = exports.ConnectBookingDialog = exports.ConnectBookingCalendar = exports.useConnectWorkspaceMembers = exports.useConnectWorkspaces = exports.ConnectWorkspaceSwitcher = exports.resolvePlanGroup = exports.groupPlansByTier = exports.isFreePlan = exports.ACTION_LABEL = exports.discountLabel = exports.annualSaving = void 0;
+exports.zonedInstant = exports.dayColumns = exports.layoutBookings = exports.useBookingActions = exports.useBookings = exports.useAvailableSlots = exports.useBookableEventTypes = exports.ConnectBookingDetail = exports.ConnectBookingDialog = exports.ConnectBookingCalendar = exports.useConnectWorkspaceMembers = exports.useConnectWorkspaces = exports.ConnectWorkspaceSwitcher = exports.resolvePlanGroup = exports.groupPlansByTier = exports.isFreePlan = exports.ACTION_LABEL = exports.discountLabel = exports.annualSaving = exports.checkoutSubscriptionId = void 0;
 /**
  * Browser half of `@cosmoops/connect-sdk` - React components and hooks.
  *
@@ -210,6 +210,12 @@ var plan_pricing_js_1 = require("./components/plan-pricing.js");
 Object.defineProperty(exports, "formatPrice", { enumerable: true, get: function () { return plan_pricing_js_1.formatPrice; } });
 Object.defineProperty(exports, "monthlyOf", { enumerable: true, get: function () { return plan_pricing_js_1.monthlyOf; } });
 Object.defineProperty(exports, "resolveAction", { enumerable: true, get: function () { return plan_pricing_js_1.resolveAction; } });
+// The other half of `resolveAction`, and exported with it deliberately: a
+// partner writing its own pricing grid has to turn that action into a
+// checkout URL, and reading the subscription id straight off the
+// entitlements response instead is what sent a "Subscribe" button to
+// Connect's change-plan screen. See its doc comment.
+Object.defineProperty(exports, "checkoutSubscriptionId", { enumerable: true, get: function () { return plan_pricing_js_1.checkoutSubscriptionId; } });
 Object.defineProperty(exports, "annualSaving", { enumerable: true, get: function () { return plan_pricing_js_1.annualSaving; } });
 Object.defineProperty(exports, "discountLabel", { enumerable: true, get: function () { return plan_pricing_js_1.discountLabel; } });
 Object.defineProperty(exports, "ACTION_LABEL", { enumerable: true, get: function () { return plan_pricing_js_1.ACTION_LABEL; } });

package/dist/cjs/client/provider.js

@@ -408,7 +408,7 @@ function useConnectPlans() {
  * `CompanyProfile`. `<ConnectGrievanceNotice>` renders it for you.
  */
 function useConnectCompanyProfile() {
-    return useConnectResource("/company-profile");
+    return useConnectResource("/company-profile", { requiresSession: false });
 }
 /** The apps this workspace can open. */
 function useConnectApps() {
@@ -449,10 +449,15 @@ function useConnectSessions() {
 /**
  * One bridge read, shared through the provider's cache.
  *
- * Only fetches once a user is known: every resource route needs a session, so
- * firing before one exists just buys a guaranteed 401.
+ * Waits for a session by default: every resource route but one needs it, so
+ * firing before one exists just buys a guaranteed 401. `requiresSession:
+ * false` opts out, and the reason it exists is the grievance notice - a
+ * statutory contact is at its most useful on a public page a signed-out
+ * visitor is reading, so a hook that answered `null` until someone logged in
+ * would render nothing at exactly the moment that matters.
  */
-function useConnectResource(path) {
+function useConnectResource(path, options) {
+    const requiresSession = options?.requiresSession ?? true;
     const { fetchResource, session, isLoading: sessionLoading } = useConnect();
     // Stamped with the `path` it belongs to, so switching paths reports loading
     // without a synchronous `setIsLoading(true)` - and, more usefully, so a
@@ -463,7 +468,7 @@ function useConnectResource(path) {
         // Signed out is handled by derivation below rather than by writing state
         // here - a synchronous setState inside an effect costs an extra render pass
         // and is what `react-hooks/set-state-in-effect` exists to catch.
-        if (sessionLoading || !session?.user)
+        if (requiresSession && (sessionLoading || !session?.user))
             return;
         let active = true;
         fetchResource(path)
@@ -482,8 +487,10 @@ function useConnectResource(path) {
         // `version` is otherwise unread - it exists purely to force this effect
         // to re-run on `refetch()`, after the caller has already evicted this
         // path's cache entry via `mutateResource`.
-    }, [fetchResource, path, session?.user, sessionLoading, version]);
-    const signedOut = !sessionLoading && !session?.user;
+    }, [fetchResource, path, requiresSession, session?.user, sessionLoading, version]);
+    // A public read is never settled by the absence of a session - it is
+    // genuinely pending until the fetch lands.
+    const signedOut = requiresSession && !sessionLoading && !session?.user;
     const loaded = entry?.path === path ? entry : null;
     return {
         data: loaded?.data ?? null,

package/dist/cjs/server/client.js

@@ -4,6 +4,7 @@ exports.SDK_VERSION = exports.ConnectClient = exports.DEFAULT_BASE_URL = void 0;
 const access_js_1 = require("./resources/access.js");
 const apps_js_1 = require("./resources/apps.js");
 const ai_js_1 = require("./resources/ai.js");
+const enrichment_js_1 = require("./resources/enrichment.js");
 const data_js_1 = require("./resources/data.js");
 const workspaces_js_1 = require("./resources/workspaces.js");
 const scheduling_js_1 = require("./resources/scheduling.js");
@@ -93,6 +94,7 @@ class ConnectClient {
     calls;
     /** RAG chat and structured extraction. */
     ai;
+    enrichment;
     /** Your application's own document store - see `DataResource`. */
     data;
     /** Your application's key/value store - see `KvResource`. */
@@ -144,6 +146,7 @@ class ConnectClient {
         this.channels = new channels_js_1.ChannelsResource(transport);
         this.calls = new calls_js_1.CallsResource(transport);
         this.ai = new ai_js_1.AiResource(transport);
+        this.enrichment = new enrichment_js_1.EnrichmentResource(transport);
         this.data = new data_js_1.DataResource(transport);
         this.kv = new kv_js_1.KvResource(transport);
         this.otp = new otp_js_1.OtpResource(transport);
@@ -158,4 +161,4 @@ class ConnectClient {
 }
 exports.ConnectClient = ConnectClient;
 /** Kept in step with `package.json` by `sdk.test.ts`. */
-exports.SDK_VERSION = "0.21.0";
+exports.SDK_VERSION = "0.24.0";

package/dist/cjs/server/handler.js

@@ -605,8 +605,14 @@ function createConnectHandler(options) {
             const { workspaceId } = await requireWorkspace(request);
             return json({ toolkits: await client.integrations.list(workspaceId) });
         },
+        /*
+         * `userId` comes from the session alongside `workspaceId`, never from the
+         * body - it is stored as `connectedByUserId`, so letting the browser name
+         * it would let anyone sign a workspace-shared connection with someone
+         * else's name.
+         */
         "POST /integrations/connect": async (request) => {
-            const { workspaceId } = await requireWorkspace(request);
+            const { workspaceId, user } = await requireWorkspace(request);
             const body = (await request.json().catch(() => null));
             if (!body?.toolkitSlug || !body?.returnUrl) {
                 throw new errors_js_1.ConnectError({
@@ -616,7 +622,11 @@ function createConnectHandler(options) {
                     endpoint: "POST /integrations/connect",
                 });
             }
-            return json(await client.integrations.initiateConnect(workspaceId, body.toolkitSlug, body.returnUrl));
+            return json(await client.integrations.initiateConnect(workspaceId, {
+                toolkitSlug: body.toolkitSlug,
+                returnUrl: body.returnUrl,
+                userId: user.userId,
+            }));
         },
         "POST /integrations/disconnect": async (request) => {
             const { workspaceId } = await requireWorkspace(request);

package/dist/cjs/server/resources/enrichment.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnrichmentResource = void 0;
+const acting_as_js_1 = require("./acting-as.js");
+const http_js_1 = require("../http.js");
+/**
+ * What Connect knows about the company at a domain.
+ *
+ * The thing behind "the account filled itself in": a record holding nothing
+ * but `priya@acme.com` can offer a name, an industry, a size band and an
+ * address instead of an empty form.
+ *
+ * Two properties are worth knowing before you wire it in, because they decide
+ * how you should render the result:
+ *
+ * - **Every value is cited, and nothing is recalled.** Connect reads the
+ *   company's own website and returns the URL each claim came from. A field
+ *   the pages never stated comes back `null` rather than as a plausible guess.
+ * - **It is a suggestion, not a save.** Nothing is written to your store, and
+ *   nothing should be written to it without the person in front of it
+ *   agreeing - which is also how HubSpot and Zoho present the same feature.
+ */
+class EnrichmentResource {
+    transport;
+    constructor(transport) {
+        this.transport = transport;
+    }
+    /**
+     * Look a company up from a work email address or a domain.
+     *
+     * Send whichever you hold; `domain` wins when both are given. A consumer
+     * address (`founder@gmail.com`) is answered with
+     * `{ status: "skipped", reason: "consumer_domain" }` rather than an error -
+     * it names a person, not an employer.
+     *
+     * `asUser` attributes the generation to the signed-in caller's workspace,
+     * resolved from their session token. Without it the call is attributed to
+     * your application.
+     */
+    company(input, options = {}) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "POST",
+            path: "/enrichment/company",
+            // `asUser` never reaches the body - it is a credential, and Connect
+            // reads it from the header.
+            json: {
+                ...(input.email ? { email: input.email } : {}),
+                ...(input.domain ? { domain: input.domain } : {}),
+                ...(input.refresh ? { refresh: true } : {}),
+            },
+            headers: (0, acting_as_js_1.actingAs)(input.asUser),
+            signal: options.signal,
+        });
+    }
+}
+exports.EnrichmentResource = EnrichmentResource;

package/dist/cjs/server/resources/integrations.js

@@ -35,15 +35,17 @@ class IntegrationsResource {
      * itself. Reconnecting a disconnected/failed toolkit calls this same
      * method - there is no separate reconnect.
      *
-     * Meant to be called on behalf of a signed-in workspace admin (this is what the
-     * bridge's fixed `POST /integrations/connect` route does), not as a bare
-     * background action with no admin present to complete the OAuth screen.
+     * Meant to be called on behalf of a signed-in workspace admin (this is what
+     * the bridge's fixed `POST /integrations/connect` route does), not as a bare
+     * background action with no admin present to complete the OAuth screen. That
+     * is why `userId` is part of the input rather than inferred - see
+     * `InitiateIntegrationConnectionInput`.
      */
-    async initiateConnect(workspaceId, toolkitSlug, returnUrl) {
+    async initiateConnect(workspaceId, input) {
         return (0, http_js_1.request)(this.transport, {
             method: "POST",
             path: "/integrations/connect",
-            json: { workspaceId, toolkitSlug, returnUrl },
+            json: { workspaceId, ...input },
         });
     }
     /** Idempotent - disconnecting a toolkit that was never connected, or is already disconnected, is a success. */

package/dist/cjs/server/resources/workspaces.js

@@ -4,8 +4,8 @@ exports.WorkspacesResource = void 0;
 const acting_as_js_1 = require("./acting-as.js");
 const http_js_1 = require("../http.js");
 /**
- * Which workspaces the signed-in user belongs to, moving between them, and who
- * else is on the team.
+ * Which workspaces the signed-in user belongs to, moving between them, who
+ * else is on the team, and inviting or granting access to your application.
  *
  * **Every call here needs `asUser`** - the signed-in user's opaque
  * `sessionToken`. There is no application-wide form of any of these: they take
@@ -70,5 +70,76 @@ class WorkspacesResource {
         });
         return result.members;
     }
+    /**
+     * Seats, what the caller may do with them, and the invitations already
+     * holding one - everything a team screen needs to decide what to draw.
+     *
+     * Behind `members:manage` rather than `workspaces:read`, and gated on the
+     * caller's own `member:invite`: it names people who are not members yet.
+     */
+    access(options) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "GET",
+            path: "/workspaces/members/access",
+            headers: (0, acting_as_js_1.actingAs)(options.asUser),
+        });
+    }
+    /**
+     * Invite someone into the workspace, with access to your application.
+     *
+     * `roleKey` names a role from your own catalog (or the reserved `"admin"`);
+     * omit it to add someone to the workspace with no access to your
+     * application. You cannot send a Connect role - the grant is built server
+     * side as `[member, app:<yourKey>:<roleKey>]`, so nothing this method can
+     * express reaches outside your application.
+     *
+     * Spends a member seat when the invitation is created, not when it is
+     * accepted. Throws `ConnectError` with status 409 and a message written to
+     * be shown when there is no seat, and 403 when the caller is inviting
+     * someone with access they do not hold themselves.
+     */
+    invite(input, options) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "POST",
+            path: "/workspaces/members/invite",
+            headers: (0, acting_as_js_1.actingAs)(options.asUser),
+            json: input,
+        });
+    }
+    /**
+     * Grant or revoke **your application's** role for an existing member.
+     * `roleKey: null` revokes it.
+     *
+     * Moves only your own grant: Connect recomputes the member's roles as what
+     * they hold now, minus any grant naming your application, plus the one you
+     * asked for. Their workspace role and every other application they use are
+     * untouched, and there is no form of this that removes them from the
+     * workspace.
+     *
+     * Re-sending the role they already have is a no-op rather than an error, so
+     * a form that submits whatever is on screen is safe.
+     */
+    setAccess(input, options) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "POST",
+            path: "/workspaces/members/access",
+            headers: (0, acting_as_js_1.actingAs)(options.asUser),
+            json: input,
+        });
+    }
+    /**
+     * Withdraw a pending invitation your application sent, freeing its seat.
+     *
+     * Only yours - an invitation carrying another application's grant is a 404,
+     * deliberately indistinguishable from one that does not exist.
+     */
+    async revokeInvitation(input, options) {
+        await (0, http_js_1.request)(this.transport, {
+            method: "POST",
+            path: "/workspaces/invitations/revoke",
+            headers: (0, acting_as_js_1.actingAs)(options.asUser),
+            json: input,
+        });
+    }
 }
 exports.WorkspacesResource = WorkspacesResource;

package/dist/esm/client/components/plan-pricing.js

@@ -194,3 +194,30 @@ export const ACTION_LABEL = {
     "switch-to-monthly": "Switch to monthly",
     subscribe: "Subscribe",
 };
+/**
+ * The subscription id a checkout hand-off should carry for `action` - or
+ * `null`, meaning "send them to Connect's *subscribe* screen".
+ *
+ * Paired with `resolveAction` deliberately: the button's label and the URL it
+ * opens are one decision, and deriving the URL from the mere *presence* of a
+ * subscription row instead is what sent a card reading "Subscribe" to
+ * Connect's change-plan screen, which answered `notFound()`.
+ *
+ * The gap is real rather than hypothetical. `resolveAction` needs the
+ * **current plan** to classify a change and answers `"subscribe"` without
+ * one - and `SubscriptionResponse` carries `plan: null` beside a perfectly
+ * live `subscription` whenever that plan has been deleted from the catalogue
+ * out from under it, which a re-seeded application does. Connect's change-plan
+ * route is stuck in the same place for the same reason: it cannot prorate
+ * against a price it cannot read.
+ *
+ * Sending those to `/apps/.../subscribe/...` is a real hand-off, not a guess:
+ * that route re-reads the workspace's live subscriptions server-side and
+ * redirects to the change-plan screen itself when there genuinely is one to
+ * change. Connect decides, so the grid does not have to be sure.
+ */
+export function checkoutSubscriptionId(action, current) {
+    if (action === "subscribe")
+        return null;
+    return current?.subscription?.id ?? null;
+}