@cosmoops/connect-sdk 0.21.0 → 0.24.0

package/dist/esm/client/components/plans.js

@@ -7,7 +7,7 @@ import { useConnect, useConnectEntitlements, useConnectPlans } from "../provider
 import { buildCancelUrl, buildCheckoutUrl, useConnectCheckout, } from "../use-checkout.js";
 import { AnimatePresence, ENTER, m, MotionProvider } from "./motion.js";
 import { ConnectSubscribeDialog } from "./subscribe-dialog.js";
-import { ACTION_LABEL, discountLabel, formatPrice, groupPlansByTier, intervalLabel, isFreePlan, pricePerLabel, resolveAction, } from "./plan-pricing.js";
+import { ACTION_LABEL, checkoutSubscriptionId, discountLabel, formatPrice, groupPlansByTier, intervalLabel, isFreePlan, pricePerLabel, resolveAction, } from "./plan-pricing.js";
 /**
  * The plan table: monthly/annual toggle, features, add-ons, the discount
  * actually in effect, and the subscribe / upgrade / downgrade flows.
@@ -80,8 +80,13 @@ export function ConnectPlans({ planIds, hideCoupon = false, className }) {
      * created in `"created"` and only flips to active when the payment webhook
      * lands, which can be minutes later. Holding a customer on a spinner until
      * then would misreport a completed checkout as an abandoned one.
+     *
+     * `action` is threaded through rather than re-derived: it is the same
+     * decision the card's label came from, and `checkoutSubscriptionId` is what
+     * keeps the two from disagreeing - see its doc comment for the 404 that
+     * disagreement produced.
      */
-    function startCheckout(plan) {
+    function startCheckout(plan, action) {
         if (!applicationId)
             return;
         checkout.start({
@@ -89,7 +94,7 @@ export function ConnectPlans({ planIds, hideCoupon = false, className }) {
                 appUrl,
                 applicationId,
                 planId: plan.id,
-                subscriptionId: subscription?.subscription?.id ?? null,
+                subscriptionId: checkoutSubscriptionId(action, subscription),
                 coupon,
             }),
             isSettled: (next) => next.subscription.plan?.id === plan.id,
@@ -139,7 +144,7 @@ export function ConnectPlans({ planIds, hideCoupon = false, className }) {
                                             // plan would race the first and one of them would be
                                             // rejected on arrival.
                                             isDisabled: isCurrent || checkout.status === "waiting", onPress: () => setPending({ plan, action }), children: [ACTION_LABEL[action], !isCurrent && _jsx(ExternalLink, { className: "size-3.5" })] }) })] }) }, tier.planGroup));
-                    }) }), subscription?.subscription && (_jsx(ConnectUnsubscribeRow, { subscription: subscription.subscription, appUrl: appUrl, checkout: checkout })), _jsx(ConnectSubscribeDialog, { plan: pending?.plan ?? null, action: pending?.action ?? "subscribe", current: subscription, coupon: hideCoupon ? undefined : coupon, onClose: () => setPending(null), onConfirm: () => pending && startCheckout(pending.plan) })] }) }));
+                    }) }), subscription?.subscription && (_jsx(ConnectUnsubscribeRow, { subscription: subscription.subscription, appUrl: appUrl, checkout: checkout })), _jsx(ConnectSubscribeDialog, { plan: pending?.plan ?? null, action: pending?.action ?? "subscribe", current: subscription, coupon: hideCoupon ? undefined : coupon, onClose: () => setPending(null), onConfirm: () => pending && startCheckout(pending.plan, pending.action) })] }) }));
 }
 /**
  * What the page says while the customer is off in Connect, and after.

package/dist/esm/client/index.js

@@ -105,7 +105,13 @@ export { ConnectConfirmDialog } from "./components/confirm-dialog.js";
 export { ConnectCursorPagination } from "./components/cursor-pagination.js";
 export { ConnectFilterTabs } from "./components/filter-tabs.js";
 export { useConnectCheckout, buildCheckoutUrl } from "./use-checkout.js";
-export { formatPrice, monthlyOf, resolveAction, annualSaving, discountLabel, ACTION_LABEL, 
+export { formatPrice, monthlyOf, resolveAction, 
+// The other half of `resolveAction`, and exported with it deliberately: a
+// partner writing its own pricing grid has to turn that action into a
+// checkout URL, and reading the subscription id straight off the
+// entitlements response instead is what sent a "Subscribe" button to
+// Connect's change-plan screen. See its doc comment.
+checkoutSubscriptionId, annualSaving, discountLabel, ACTION_LABEL, 
 // Exported for the same reason `groupPlansByTier` is: a partner writing its
 // own pricing grid has to draw a ₹0 plan as "Free" rather than as a price
 // with a cadence and a GST rate attached, and re-deriving "is this free"

package/dist/esm/client/provider.js

@@ -389,7 +389,7 @@ export function useConnectPlans() {
  * `CompanyProfile`. `<ConnectGrievanceNotice>` renders it for you.
  */
 export function useConnectCompanyProfile() {
-    return useConnectResource("/company-profile");
+    return useConnectResource("/company-profile", { requiresSession: false });
 }
 /** The apps this workspace can open. */
 export function useConnectApps() {
@@ -430,10 +430,15 @@ export function useConnectSessions() {
 /**
  * One bridge read, shared through the provider's cache.
  *
- * Only fetches once a user is known: every resource route needs a session, so
- * firing before one exists just buys a guaranteed 401.
+ * Waits for a session by default: every resource route but one needs it, so
+ * firing before one exists just buys a guaranteed 401. `requiresSession:
+ * false` opts out, and the reason it exists is the grievance notice - a
+ * statutory contact is at its most useful on a public page a signed-out
+ * visitor is reading, so a hook that answered `null` until someone logged in
+ * would render nothing at exactly the moment that matters.
  */
-export function useConnectResource(path) {
+export function useConnectResource(path, options) {
+    const requiresSession = options?.requiresSession ?? true;
     const { fetchResource, session, isLoading: sessionLoading } = useConnect();
     // Stamped with the `path` it belongs to, so switching paths reports loading
     // without a synchronous `setIsLoading(true)` - and, more usefully, so a
@@ -444,7 +449,7 @@ export function useConnectResource(path) {
         // Signed out is handled by derivation below rather than by writing state
         // here - a synchronous setState inside an effect costs an extra render pass
         // and is what `react-hooks/set-state-in-effect` exists to catch.
-        if (sessionLoading || !session?.user)
+        if (requiresSession && (sessionLoading || !session?.user))
             return;
         let active = true;
         fetchResource(path)
@@ -463,8 +468,10 @@ export function useConnectResource(path) {
         // `version` is otherwise unread - it exists purely to force this effect
         // to re-run on `refetch()`, after the caller has already evicted this
         // path's cache entry via `mutateResource`.
-    }, [fetchResource, path, session?.user, sessionLoading, version]);
-    const signedOut = !sessionLoading && !session?.user;
+    }, [fetchResource, path, requiresSession, session?.user, sessionLoading, version]);
+    // A public read is never settled by the absence of a session - it is
+    // genuinely pending until the fetch lands.
+    const signedOut = requiresSession && !sessionLoading && !session?.user;
     const loaded = entry?.path === path ? entry : null;
     return {
         data: loaded?.data ?? null,

package/dist/esm/server/client.js

@@ -1,6 +1,7 @@
 import { AccessResource } from "./resources/access.js";
 import { AppsResource } from "./resources/apps.js";
 import { AiResource } from "./resources/ai.js";
+import { EnrichmentResource } from "./resources/enrichment.js";
 import { DataResource, storePassthrough } from "./resources/data.js";
 import { WorkspacesResource } from "./resources/workspaces.js";
 import { SchedulingResource } from "./resources/scheduling.js";
@@ -90,6 +91,7 @@ export class ConnectClient {
     calls;
     /** RAG chat and structured extraction. */
     ai;
+    enrichment;
     /** Your application's own document store - see `DataResource`. */
     data;
     /** Your application's key/value store - see `KvResource`. */
@@ -141,6 +143,7 @@ export class ConnectClient {
         this.channels = new ChannelsResource(transport);
         this.calls = new CallsResource(transport);
         this.ai = new AiResource(transport);
+        this.enrichment = new EnrichmentResource(transport);
         this.data = new DataResource(transport);
         this.kv = new KvResource(transport);
         this.otp = new OtpResource(transport);
@@ -154,4 +157,4 @@ export class ConnectClient {
     }
 }
 /** Kept in step with `package.json` by `sdk.test.ts`. */
-export const SDK_VERSION = "0.21.0";
+export const SDK_VERSION = "0.24.0";

package/dist/esm/server/handler.js

@@ -602,8 +602,14 @@ export function createConnectHandler(options) {
             const { workspaceId } = await requireWorkspace(request);
             return json({ toolkits: await client.integrations.list(workspaceId) });
         },
+        /*
+         * `userId` comes from the session alongside `workspaceId`, never from the
+         * body - it is stored as `connectedByUserId`, so letting the browser name
+         * it would let anyone sign a workspace-shared connection with someone
+         * else's name.
+         */
         "POST /integrations/connect": async (request) => {
-            const { workspaceId } = await requireWorkspace(request);
+            const { workspaceId, user } = await requireWorkspace(request);
             const body = (await request.json().catch(() => null));
             if (!body?.toolkitSlug || !body?.returnUrl) {
                 throw new ConnectError({
@@ -613,7 +619,11 @@ export function createConnectHandler(options) {
                     endpoint: "POST /integrations/connect",
                 });
             }
-            return json(await client.integrations.initiateConnect(workspaceId, body.toolkitSlug, body.returnUrl));
+            return json(await client.integrations.initiateConnect(workspaceId, {
+                toolkitSlug: body.toolkitSlug,
+                returnUrl: body.returnUrl,
+                userId: user.userId,
+            }));
         },
         "POST /integrations/disconnect": async (request) => {
             const { workspaceId } = await requireWorkspace(request);

package/dist/esm/server/resources/enrichment.js

@@ -0,0 +1,52 @@
+import { actingAs } from "./acting-as.js";
+import { request } from "../http.js";
+/**
+ * What Connect knows about the company at a domain.
+ *
+ * The thing behind "the account filled itself in": a record holding nothing
+ * but `priya@acme.com` can offer a name, an industry, a size band and an
+ * address instead of an empty form.
+ *
+ * Two properties are worth knowing before you wire it in, because they decide
+ * how you should render the result:
+ *
+ * - **Every value is cited, and nothing is recalled.** Connect reads the
+ *   company's own website and returns the URL each claim came from. A field
+ *   the pages never stated comes back `null` rather than as a plausible guess.
+ * - **It is a suggestion, not a save.** Nothing is written to your store, and
+ *   nothing should be written to it without the person in front of it
+ *   agreeing - which is also how HubSpot and Zoho present the same feature.
+ */
+export class EnrichmentResource {
+    transport;
+    constructor(transport) {
+        this.transport = transport;
+    }
+    /**
+     * Look a company up from a work email address or a domain.
+     *
+     * Send whichever you hold; `domain` wins when both are given. A consumer
+     * address (`founder@gmail.com`) is answered with
+     * `{ status: "skipped", reason: "consumer_domain" }` rather than an error -
+     * it names a person, not an employer.
+     *
+     * `asUser` attributes the generation to the signed-in caller's workspace,
+     * resolved from their session token. Without it the call is attributed to
+     * your application.
+     */
+    company(input, options = {}) {
+        return request(this.transport, {
+            method: "POST",
+            path: "/enrichment/company",
+            // `asUser` never reaches the body - it is a credential, and Connect
+            // reads it from the header.
+            json: {
+                ...(input.email ? { email: input.email } : {}),
+                ...(input.domain ? { domain: input.domain } : {}),
+                ...(input.refresh ? { refresh: true } : {}),
+            },
+            headers: actingAs(input.asUser),
+            signal: options.signal,
+        });
+    }
+}

package/dist/esm/server/resources/integrations.js

@@ -32,15 +32,17 @@ export class IntegrationsResource {
      * itself. Reconnecting a disconnected/failed toolkit calls this same
      * method - there is no separate reconnect.
      *
-     * Meant to be called on behalf of a signed-in workspace admin (this is what the
-     * bridge's fixed `POST /integrations/connect` route does), not as a bare
-     * background action with no admin present to complete the OAuth screen.
+     * Meant to be called on behalf of a signed-in workspace admin (this is what
+     * the bridge's fixed `POST /integrations/connect` route does), not as a bare
+     * background action with no admin present to complete the OAuth screen. That
+     * is why `userId` is part of the input rather than inferred - see
+     * `InitiateIntegrationConnectionInput`.
      */
-    async initiateConnect(workspaceId, toolkitSlug, returnUrl) {
+    async initiateConnect(workspaceId, input) {
         return request(this.transport, {
             method: "POST",
             path: "/integrations/connect",
-            json: { workspaceId, toolkitSlug, returnUrl },
+            json: { workspaceId, ...input },
         });
     }
     /** Idempotent - disconnecting a toolkit that was never connected, or is already disconnected, is a success. */

package/dist/esm/server/resources/workspaces.js

@@ -1,8 +1,8 @@
 import { actingAs } from "./acting-as.js";
 import { request } from "../http.js";
 /**
- * Which workspaces the signed-in user belongs to, moving between them, and who
- * else is on the team.
+ * Which workspaces the signed-in user belongs to, moving between them, who
+ * else is on the team, and inviting or granting access to your application.
  *
  * **Every call here needs `asUser`** - the signed-in user's opaque
  * `sessionToken`. There is no application-wide form of any of these: they take
@@ -67,4 +67,75 @@ export class WorkspacesResource {
         });
         return result.members;
     }
+    /**
+     * Seats, what the caller may do with them, and the invitations already
+     * holding one - everything a team screen needs to decide what to draw.
+     *
+     * Behind `members:manage` rather than `workspaces:read`, and gated on the
+     * caller's own `member:invite`: it names people who are not members yet.
+     */
+    access(options) {
+        return request(this.transport, {
+            method: "GET",
+            path: "/workspaces/members/access",
+            headers: actingAs(options.asUser),
+        });
+    }
+    /**
+     * Invite someone into the workspace, with access to your application.
+     *
+     * `roleKey` names a role from your own catalog (or the reserved `"admin"`);
+     * omit it to add someone to the workspace with no access to your
+     * application. You cannot send a Connect role - the grant is built server
+     * side as `[member, app:<yourKey>:<roleKey>]`, so nothing this method can
+     * express reaches outside your application.
+     *
+     * Spends a member seat when the invitation is created, not when it is
+     * accepted. Throws `ConnectError` with status 409 and a message written to
+     * be shown when there is no seat, and 403 when the caller is inviting
+     * someone with access they do not hold themselves.
+     */
+    invite(input, options) {
+        return request(this.transport, {
+            method: "POST",
+            path: "/workspaces/members/invite",
+            headers: actingAs(options.asUser),
+            json: input,
+        });
+    }
+    /**
+     * Grant or revoke **your application's** role for an existing member.
+     * `roleKey: null` revokes it.
+     *
+     * Moves only your own grant: Connect recomputes the member's roles as what
+     * they hold now, minus any grant naming your application, plus the one you
+     * asked for. Their workspace role and every other application they use are
+     * untouched, and there is no form of this that removes them from the
+     * workspace.
+     *
+     * Re-sending the role they already have is a no-op rather than an error, so
+     * a form that submits whatever is on screen is safe.
+     */
+    setAccess(input, options) {
+        return request(this.transport, {
+            method: "POST",
+            path: "/workspaces/members/access",
+            headers: actingAs(options.asUser),
+            json: input,
+        });
+    }
+    /**
+     * Withdraw a pending invitation your application sent, freeing its seat.
+     *
+     * Only yours - an invitation carrying another application's grant is a 404,
+     * deliberately indistinguishable from one that does not exist.
+     */
+    async revokeInvitation(input, options) {
+        await request(this.transport, {
+            method: "POST",
+            path: "/workspaces/invitations/revoke",
+            headers: actingAs(options.asUser),
+            json: input,
+        });
+    }
 }

package/dist/types/client/components/plan-pricing.d.ts

@@ -117,3 +117,26 @@ export declare function annualSaving(monthly: Plan | null | undefined, annual: P
 export type PlanAction = "current" | "upgrade" | "downgrade" | "switch-to-annual" | "switch-to-monthly" | "subscribe";
 export declare function resolveAction(plan: Plan, current: SubscriptionResponse | null): PlanAction;
 export declare const ACTION_LABEL: Record<PlanAction, string>;
+/**
+ * The subscription id a checkout hand-off should carry for `action` - or
+ * `null`, meaning "send them to Connect's *subscribe* screen".
+ *
+ * Paired with `resolveAction` deliberately: the button's label and the URL it
+ * opens are one decision, and deriving the URL from the mere *presence* of a
+ * subscription row instead is what sent a card reading "Subscribe" to
+ * Connect's change-plan screen, which answered `notFound()`.
+ *
+ * The gap is real rather than hypothetical. `resolveAction` needs the
+ * **current plan** to classify a change and answers `"subscribe"` without
+ * one - and `SubscriptionResponse` carries `plan: null` beside a perfectly
+ * live `subscription` whenever that plan has been deleted from the catalogue
+ * out from under it, which a re-seeded application does. Connect's change-plan
+ * route is stuck in the same place for the same reason: it cannot prorate
+ * against a price it cannot read.
+ *
+ * Sending those to `/apps/.../subscribe/...` is a real hand-off, not a guess:
+ * that route re-reads the workspace's live subscriptions server-side and
+ * redirects to the change-plan screen itself when there genuinely is one to
+ * change. Connect decides, so the grid does not have to be sure.
+ */
+export declare function checkoutSubscriptionId(action: PlanAction, current: SubscriptionResponse | null): string | null;

package/dist/types/client/index.d.ts

@@ -11,7 +11,7 @@
  * change lands identically in all of them.
  */
 export { ConnectProvider, useConnect, useConnectUser, useConnectWorkspaceType, useConnectAudience, useConnectPlatformAccess, useConnectEntitlements, useConnectPlans, useConnectApps, useConnectCompanyProfile, useConnectAddonUsage, useConnectSessions, useConnectIntegrations, useConnectResource, CONNECT_APP_URL, } from "./provider.js";
-export type { ConnectProviderProps, ConnectContextValue, ConnectSession, ConnectOneTapHint, ConnectOneTapFailure, } from "./provider.js";
+export type { ConnectProviderProps, ConnectContextValue, ConnectSession, ConnectOneTapHint, ConnectOneTapFailure, UseConnectResourceOptions, } from "./provider.js";
 export { blockingBlockers, normalizePlanFeatures } from "../helpers.js";
 export type { WirePlanFeature } from "../helpers.js";
 export { ConnectError, isConnectError } from "../errors.js";
@@ -84,7 +84,7 @@ export { ConnectFilterTabs } from "./components/filter-tabs.js";
 export type { ConnectFilterTabsProps, ConnectFilterTabsOption } from "./components/filter-tabs.js";
 export { useConnectCheckout, buildCheckoutUrl } from "./use-checkout.js";
 export type { ConnectCheckoutStatus, ConnectCheckoutState, ConnectEntitlements, StartCheckoutOptions, CheckoutUrlOptions, } from "./use-checkout.js";
-export { formatPrice, monthlyOf, resolveAction, annualSaving, discountLabel, ACTION_LABEL, isFreePlan, groupPlansByTier, resolvePlanGroup, } from "./components/plan-pricing.js";
+export { formatPrice, monthlyOf, resolveAction, checkoutSubscriptionId, annualSaving, discountLabel, ACTION_LABEL, isFreePlan, groupPlansByTier, resolvePlanGroup, } from "./components/plan-pricing.js";
 export type { PlanAction, PlanTier, ComparablePlan } from "./components/plan-pricing.js";
 export { ConnectWorkspaceSwitcher } from "./components/workspace-switcher.js";
 export type { ConnectWorkspaceSwitcherProps } from "./components/workspace-switcher.js";

package/dist/types/client/provider.d.ts

@@ -456,13 +456,30 @@ export declare function useConnectSessions(): {
      */
     refetch(): void;
 };
+/** Options for {@link useConnectResource}. */
+export interface UseConnectResourceOptions {
+    /**
+     * Whether the read has to wait for a session. `true` by default, and right
+     * for every route but one.
+     *
+     * Pass `false` only for a bridge route that takes neither a session nor a
+     * workspace - today that is `GET /company-profile` alone, and its handler
+     * says why. Passing it for anything else does not widen access (the bridge
+     * still refuses), it just buys a guaranteed 401 sooner.
+     */
+    requiresSession?: boolean;
+}
 /**
  * One bridge read, shared through the provider's cache.
  *
- * Only fetches once a user is known: every resource route needs a session, so
- * firing before one exists just buys a guaranteed 401.
+ * Waits for a session by default: every resource route but one needs it, so
+ * firing before one exists just buys a guaranteed 401. `requiresSession:
+ * false` opts out, and the reason it exists is the grievance notice - a
+ * statutory contact is at its most useful on a public page a signed-out
+ * visitor is reading, so a hook that answered `null` until someone logged in
+ * would render nothing at exactly the moment that matters.
  */
-export declare function useConnectResource<T>(path: string): {
+export declare function useConnectResource<T>(path: string, options?: Readonly<UseConnectResourceOptions>): {
     data: T | null;
     isLoading: boolean;
     error: string | null;

package/dist/types/client/use-checkout.d.ts

@@ -64,6 +64,15 @@ export interface CheckoutUrlOptions {
      * plan on this subscription"; absent means "subscribe for the first time" -
      * and the two are separate screens in Connect, because only one of them can
      * price proration against a cycle already paid for.
+     *
+     * Pass it only when you know **which plan the subscription is on today**,
+     * which is what makes the change classifiable. `checkoutSubscriptionId`
+     * derives it from the action you are already showing on the button; a bare
+     * `subscription?.subscription?.id` does not, and a live subscription whose
+     * plan has been deleted from the catalogue is the case where the two differ
+     * and the change-plan screen answers `notFound()`. Leaving it `null` is
+     * always safe: the subscribe route redirects to the change-plan screen
+     * itself when Connect finds a subscription to change.
      */
     subscriptionId?: string | null;
     /** Carried into Connect's checkout, where it is validated against the real cart. */

package/dist/types/server/client.d.ts

@@ -2,6 +2,7 @@ import type { FetchLike } from "./http.js";
 import { AccessResource } from "./resources/access.js";
 import { AppsResource } from "./resources/apps.js";
 import { AiResource } from "./resources/ai.js";
+import { EnrichmentResource } from "./resources/enrichment.js";
 import { DataResource } from "./resources/data.js";
 import { WorkspacesResource } from "./resources/workspaces.js";
 import { SchedulingResource } from "./resources/scheduling.js";
@@ -89,6 +90,7 @@ export declare class ConnectClient {
     readonly calls: CallsResource;
     /** RAG chat and structured extraction. */
     readonly ai: AiResource;
+    readonly enrichment: EnrichmentResource;
     /** Your application's own document store - see `DataResource`. */
     readonly data: DataResource;
     /** Your application's key/value store - see `KvResource`. */
@@ -121,4 +123,4 @@ export declare class ConnectClient {
     constructor(options: ConnectClientOptions);
 }
 /** Kept in step with `package.json` by `sdk.test.ts`. */
-export declare const SDK_VERSION = "0.21.0";
+export declare const SDK_VERSION = "0.24.0";

package/dist/types/server/index.d.ts

@@ -18,6 +18,7 @@ export type { AppsResource } from "./resources/apps.js";
 export type { EntitlementsResource } from "./resources/entitlements.js";
 export type { BillingResource } from "./resources/billing.js";
 export type { AiResource } from "./resources/ai.js";
+export type { EnrichmentResource } from "./resources/enrichment.js";
 export type { DataResource } from "./resources/data.js";
 export type { KvResource } from "./resources/kv.js";
 export type { WorkspacesResource } from "./resources/workspaces.js";
@@ -25,7 +26,7 @@ export type { OtpResource } from "./resources/otp.js";
 export type { LogsResource } from "./resources/logs.js";
 export type { AnalyticsResource } from "./resources/analytics.js";
 export type { SessionsResource } from "./resources/sessions.js";
-export type { ExecuteIntegrationActionInput, IntegrationsResource } from "./resources/integrations.js";
+export type { ExecuteIntegrationActionInput, InitiateIntegrationConnectionInput, IntegrationsResource, } from "./resources/integrations.js";
 export type { PlatformResource } from "./resources/platform.js";
 export type { SchedulingResource, FindSlotsInput, ListBookingsInput, CreateBookingInput, RescheduleBookingInput, } from "./resources/scheduling.js";
 export type { ContactsResource, LookupContactInput } from "./resources/contacts.js";

package/dist/types/server/resources/enrichment.d.ts

@@ -0,0 +1,44 @@
+import { type TransportOptions } from "../http.js";
+import type { CompanyEnrichmentResult } from "../../types.js";
+/**
+ * What Connect knows about the company at a domain.
+ *
+ * The thing behind "the account filled itself in": a record holding nothing
+ * but `priya@acme.com` can offer a name, an industry, a size band and an
+ * address instead of an empty form.
+ *
+ * Two properties are worth knowing before you wire it in, because they decide
+ * how you should render the result:
+ *
+ * - **Every value is cited, and nothing is recalled.** Connect reads the
+ *   company's own website and returns the URL each claim came from. A field
+ *   the pages never stated comes back `null` rather than as a plausible guess.
+ * - **It is a suggestion, not a save.** Nothing is written to your store, and
+ *   nothing should be written to it without the person in front of it
+ *   agreeing - which is also how HubSpot and Zoho present the same feature.
+ */
+export declare class EnrichmentResource {
+    private readonly transport;
+    constructor(transport: TransportOptions);
+    /**
+     * Look a company up from a work email address or a domain.
+     *
+     * Send whichever you hold; `domain` wins when both are given. A consumer
+     * address (`founder@gmail.com`) is answered with
+     * `{ status: "skipped", reason: "consumer_domain" }` rather than an error -
+     * it names a person, not an employer.
+     *
+     * `asUser` attributes the generation to the signed-in caller's workspace,
+     * resolved from their session token. Without it the call is attributed to
+     * your application.
+     */
+    company(input: {
+        email?: string;
+        domain?: string;
+        asUser?: string;
+        /** Re-read the site even if Connect has a fresh profile cached. For an operator pressing "refresh" - not for automatic calls, which should take the cache. */
+        refresh?: boolean;
+    }, options?: {
+        signal?: AbortSignal;
+    }): Promise<CompanyEnrichmentResult>;
+}

package/dist/types/server/resources/integrations.d.ts

@@ -1,5 +1,19 @@
 import { type TransportOptions } from "../http.js";
 import type { DisconnectIntegrationResponse, ExecuteIntegrationActionResponse, InitiateIntegrationConnectionResponse, IntegrationsListResponse } from "../../types.js";
+export interface InitiateIntegrationConnectionInput {
+    toolkitSlug: string;
+    returnUrl: string;
+    /**
+     * The signed-in member starting the connection, recorded by Connect as
+     * `connectedByUserId`.
+     *
+     * Required, and deliberately not defaulted: the connection is *shared by
+     * the whole workspace*, so "who turned this on" is the only attribution
+     * anyone gets - and a call that cannot name a person is one where nobody
+     * is present to finish the OAuth screen either.
+     */
+    userId: string;
+}
 export interface ExecuteIntegrationActionInput {
     toolkitSlug: string;
     actionSlug: string;
@@ -28,11 +42,13 @@ export declare class IntegrationsResource {
      * itself. Reconnecting a disconnected/failed toolkit calls this same
      * method - there is no separate reconnect.
      *
-     * Meant to be called on behalf of a signed-in workspace admin (this is what the
-     * bridge's fixed `POST /integrations/connect` route does), not as a bare
-     * background action with no admin present to complete the OAuth screen.
+     * Meant to be called on behalf of a signed-in workspace admin (this is what
+     * the bridge's fixed `POST /integrations/connect` route does), not as a bare
+     * background action with no admin present to complete the OAuth screen. That
+     * is why `userId` is part of the input rather than inferred - see
+     * `InitiateIntegrationConnectionInput`.
      */
-    initiateConnect(workspaceId: string, toolkitSlug: string, returnUrl: string): Promise<InitiateIntegrationConnectionResponse>;
+    initiateConnect(workspaceId: string, input: InitiateIntegrationConnectionInput): Promise<InitiateIntegrationConnectionResponse>;
     /** Idempotent - disconnecting a toolkit that was never connected, or is already disconnected, is a success. */
     disconnect(workspaceId: string, toolkitSlug: string): Promise<DisconnectIntegrationResponse>;
     /** Calls a Composio action against this workspace's connected account for the named toolkit. */

package/dist/types/server/resources/workspaces.d.ts

@@ -1,8 +1,8 @@
 import { type TransportOptions } from "../http.js";
-import type { ConnectWorkspaceMember, UserWorkspace, WorkspaceSwitchResult } from "../../types.js";
+import type { ConnectInvitation, ConnectMemberAccess, ConnectMemberAccessResult, ConnectWorkspaceMember, UserWorkspace, WorkspaceSwitchResult } from "../../types.js";
 /**
- * Which workspaces the signed-in user belongs to, moving between them, and who
- * else is on the team.
+ * Which workspaces the signed-in user belongs to, moving between them, who
+ * else is on the team, and inviting or granting access to your application.
  *
  * **Every call here needs `asUser`** - the signed-in user's opaque
  * `sessionToken`. There is no application-wide form of any of these: they take
@@ -52,4 +52,64 @@ export declare class WorkspacesResource {
     members(options: {
         asUser: string;
     }): Promise<ConnectWorkspaceMember[]>;
+    /**
+     * Seats, what the caller may do with them, and the invitations already
+     * holding one - everything a team screen needs to decide what to draw.
+     *
+     * Behind `members:manage` rather than `workspaces:read`, and gated on the
+     * caller's own `member:invite`: it names people who are not members yet.
+     */
+    access(options: {
+        asUser: string;
+    }): Promise<ConnectMemberAccess>;
+    /**
+     * Invite someone into the workspace, with access to your application.
+     *
+     * `roleKey` names a role from your own catalog (or the reserved `"admin"`);
+     * omit it to add someone to the workspace with no access to your
+     * application. You cannot send a Connect role - the grant is built server
+     * side as `[member, app:<yourKey>:<roleKey>]`, so nothing this method can
+     * express reaches outside your application.
+     *
+     * Spends a member seat when the invitation is created, not when it is
+     * accepted. Throws `ConnectError` with status 409 and a message written to
+     * be shown when there is no seat, and 403 when the caller is inviting
+     * someone with access they do not hold themselves.
+     */
+    invite(input: {
+        inviteeEmail: string;
+        roleKey?: string | null;
+    }, options: {
+        asUser: string;
+    }): Promise<ConnectInvitation>;
+    /**
+     * Grant or revoke **your application's** role for an existing member.
+     * `roleKey: null` revokes it.
+     *
+     * Moves only your own grant: Connect recomputes the member's roles as what
+     * they hold now, minus any grant naming your application, plus the one you
+     * asked for. Their workspace role and every other application they use are
+     * untouched, and there is no form of this that removes them from the
+     * workspace.
+     *
+     * Re-sending the role they already have is a no-op rather than an error, so
+     * a form that submits whatever is on screen is safe.
+     */
+    setAccess(input: {
+        userId: string;
+        roleKey: string | null;
+    }, options: {
+        asUser: string;
+    }): Promise<ConnectMemberAccessResult>;
+    /**
+     * Withdraw a pending invitation your application sent, freeing its seat.
+     *
+     * Only yours - an invitation carrying another application's grant is a 404,
+     * deliberately indistinguishable from one that does not exist.
+     */
+    revokeInvitation(input: {
+        invitationId: string;
+    }, options: {
+        asUser: string;
+    }): Promise<void>;
 }