@cosmoops/connect-sdk 0.30.1 → 0.32.0

package/CHANGELOG.md

@@ -3,6 +3,133 @@
 `@cosmoops/connect-sdk` follows semver, with the 0.x convention that **minor
 versions may carry breaking changes** and patch versions never do.
 
+## 0.32.0
+
+Push notifications: `connect.push.send()` on the server, `useConnectPush()` in
+the browser.
+
+**The point is what your application no longer holds.** It holds no VAPID key,
+stores no push endpoint, and needs no notification table of its own. It names
+a workspace, some members and three strings; Connect resolves those members'
+devices, applies each member's own preferences, and signs the payload.
+
+Two things follow that are worth more than the code saved:
+
+- **A member grants the browser prompt once for the platform**, not once per
+  app. The same device receives your notifications, every other app's, and
+  Connect's own — and one switch in their Connect profile silences the lot.
+  That matters because a browser will not re-prompt once it has been told no,
+  so every app asking separately is a queue of chances to lose the permission
+  for all of them.
+- **You never learn who has a device.** There is no read that answers it, by
+  design. A send reports a fan-out; it does not report an audience.
+
+```ts
+// Your server — a task fell due.
+await connect.push.send({
+  workspaceId,
+  userIds: [ownerId],
+  title: "A task is due",
+  body: "Follow up with Priya Sharma",
+  url: "https://crm.example.com/tasks",
+});
+```
+
+```tsx
+// Your browser — registering this device.
+const { status, enable, error } = useConnectPush("/sw.js");
+```
+
+Three things to know before wiring it up:
+
+**`delivered: 0` is a success.** The member may have registered no device,
+silenced notifications from their apps, or denied the prompt — all ordinary. A
+caller that retries on zero retries forever against somebody who opted out.
+Treat a notification as a nudge toward something already true in your own data,
+and never let a send failure fail the thing that triggered it.
+
+**`url` must be absolute and on an origin you registered as an SSO redirect
+URI.** Connect refuses anything else: a URL it did not check is an open
+redirect delivered to a lock screen, wearing the styling of an app the person
+trusts.
+
+**You supply the service worker.** The SDK does not install one — a worker is a
+site-wide concern with caching implications only you can decide. It needs to
+handle `push` and `notificationclick`; the payload is `{title, body, url, tag}`.
+
+`status` has five values rather than being a boolean, and the one that matters
+is `denied`: it cannot be undone by script, only from the browser's own site
+settings. A control that silently does nothing when pressed is the worst
+version of that screen, so the state is surfaced for you to explain.
+
+Requires the `push:send` scope on your API key.
+
+## 0.31.0
+
+`connect.enrichment.company()` tells you what a company *does*. This adds
+`connect.enrichment.brand()`, which tells you what it *looks like*: its logo,
+its palette, its typefaces, and the radius, spacing and breakpoint scales its
+own stylesheets declare.
+
+The reason this needed building rather than prompting: **these values are
+measured, not generated.** Ask any model for a company's brand colour and it
+answers `#3B82F6` with complete confidence, because that is the median of
+every site it has ever seen. Every hex in this response was parsed out of a
+real stylesheet, every scale step is a count of real declarations, and
+`palette[].source` tells you which parse produced it — a `css-var` entry is
+the company naming its own colour in its own tokens, a `frequency` entry is a
+ranked count and much weaker. A model is involved in exactly two places:
+writing the prose fields, and assigning a `role` to a value it was shown.
+
+`officialName` follows the same discipline the company lookup applies to
+`legalName`. It is filled only from a legal disclosure the company published
+itself — a footer copyright line, or the entity named on its Terms page —
+matched against a corporate suffix by code and cited. `officialNameSource`
+says which. It is never a model's recollection of a company register.
+
+### Added
+
+- **`connect.enrichment.brand()`** — read a company's brand kit and design
+  system from its domain.
+
+  ```ts
+  const result = await connect.enrichment.brand({ domain: "acme.com" });
+  if (result.status === "extracted") {
+    const primary = result.profile.brandKit.palette.find((c) => c.role === "primary");
+    const body = result.profile.brandKit.typography.find((t) => t.role === "body");
+  }
+  ```
+
+  Needs an API key scoped to the new **`enrichment:brand`**. That is separate
+  from `enrichment:read` because the cost differs by an order of magnitude: a
+  company lookup is three page fetches, a brand read crawls stylesheets, may
+  drive a headless browser, and caches image bytes.
+
+  Three sharp edges, in the order they will bite you:
+
+  **Set your HTTP client timeout to at least 90 seconds.** A cold read runs
+  the full extraction before answering and can take up to a minute. Many
+  clients — including `undici` and most `axios` setups — default to 30s and
+  will abandon a request that was about to succeed. Cached reads return in
+  milliseconds, and cached is the normal case: profiles are platform-owned
+  and held for 90 days, so you pay the cold path roughly once per domain
+  across all of your users.
+
+  **Never persist `brandKit.logos[].url`.** It is a short-lived signed URL,
+  minted fresh on every read. Stored in your own database or baked into a
+  cached page it becomes a broken image with a plausible-looking address.
+  Render it directly, or re-read the profile. `sourceUrl` is the stable value
+  and points at the company's own site — though it is theirs, so it can move.
+
+  **A `skipped` status is a normal 200.** `no_stylesheet` is the one new
+  reason worth handling specially: the site answered and said things, but
+  shipped no CSS this reader could measure.
+
+  `designSystem.framework` is worth reading first. It tells you how to
+  interpret everything else — a Tailwind site's spacing scale is Tailwind's
+  defaults rather than a considered choice, and a palette full of `--bs-*` is
+  Bootstrap's.
+
 ## 0.30.1
 
 `ConnectAppShell` was putting **462 KB** of markdown renderer on every page of

package/dist/cjs/client/index.js

@@ -1,9 +1,9 @@
 "use client";
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.flattenNav = exports.normalizeNav = exports.useActivePath = exports.ConnectSideNav = exports.ConnectSidebarNav = exports.RAIL_EXPANDED = exports.RAIL_COLLAPSED = exports.sidebarRowClass = exports.useConnectShell = exports.ConnectShellProvider = exports.ConnectSidebarRow = exports.ConnectSidebarFooter = exports.ConnectSidebarBody = exports.ConnectSidebarHeader = exports.ConnectSidebar = exports.AppShell = exports.ConnectAccountSessions = exports.ConnectSignOutButton = exports.ConnectHomeButton = exports.ConnectProfileButton = exports.ConnectInvoicesButton = exports.ConnectManageSubscriptionButton = exports.ConnectUserMenu = exports.ConnectProfileModal = exports.ConnectUserButton = exports.ConnectOneTap = exports.ConnectRegisterButton = exports.ConnectLoginButton = exports.ConnectLogo = exports.ConnectMark = exports.ConnectGrievanceNotice = exports.isConnectError = exports.ConnectError = exports.normalizePlanFeatures = exports.blockingBlockers = exports.CONNECT_APP_URL = exports.useConnectResource = exports.useConnectIntegrations = exports.useConnectSessions = exports.useConnectAddonUsage = exports.useConnectCompanyProfile = exports.useConnectApps = exports.useConnectPlans = exports.useConnectEntitlements = exports.useConnectPlatformAccess = exports.useConnectAudience = exports.useConnectWorkspaceType = exports.useConnectUser = exports.useConnect = exports.ConnectProvider = void 0;
-exports.resolveAction = exports.monthlyOf = exports.formatPrice = exports.buildCheckoutUrl = exports.useConnectCheckout = exports.ConnectFilterTabs = exports.ConnectCursorPagination = exports.ConnectConfirmDialog = exports.ConnectLinkButton = exports.ConnectPlansPage = exports.ConnectUsageMeter = exports.ConnectPlatformGate = exports.ConnectWorkspaceTypeGate = exports.useConnectFeature = exports.ConnectFeatureGate = exports.useConnectAccessGate = exports.ConnectAccessGate = exports.ConnectReadinessGate = exports.ConnectReadinessBanner = exports.resolveSubscriptionState = exports.ConnectSeatUsage = exports.ConnectTrialBanner = exports.ConnectSubscriptionCard = exports.ConnectNoSubscriptionCard = exports.ConnectSubscriptionGate = exports.ConnectSubscribeDialog = exports.ConnectPlans = exports.ConnectIntegrationsModal = exports.AI_TONE_DOT = exports.AI_TONE_CHIP = exports.AI_EMPTY_VALUE = exports.aiStatusTone = exports.isNumericAiFormat = exports.formatAiValue = exports.AiSources = exports.AiSteps = exports.AiDetails = exports.AiTimeline = exports.AiMetrics = exports.AiChart = exports.AiTable = exports.ConnectAskAi = exports.ConnectAppsGrid = exports.isLinkableConnectScreen = exports.matchConnectScreen = exports.filterNavForAudience = exports.gateExemptPaths = exports.isNavItemActive = exports.resolveActivePath = exports.normalizePath = void 0;
-exports.zonedInstant = exports.dayColumns = exports.layoutBookings = exports.useBookingActions = exports.useBookings = exports.useAvailableSlots = exports.useBookableEventTypes = exports.ConnectBookingDetail = exports.ConnectBookingDialog = exports.ConnectBookingCalendar = exports.useConnectWorkspaceMembers = exports.useConnectWorkspaces = exports.ConnectWorkspaceSwitcher = exports.resolvePlanGroup = exports.groupPlansByTier = exports.isFreePlan = exports.ACTION_LABEL = exports.discountLabel = exports.annualSaving = exports.checkoutSubscriptionId = void 0;
+exports.normalizeNav = exports.useConnectPush = exports.useActivePath = exports.ConnectSideNav = exports.ConnectSidebarNav = exports.RAIL_EXPANDED = exports.RAIL_COLLAPSED = exports.sidebarRowClass = exports.useConnectShell = exports.ConnectShellProvider = exports.ConnectSidebarRow = exports.ConnectSidebarFooter = exports.ConnectSidebarBody = exports.ConnectSidebarHeader = exports.ConnectSidebar = exports.AppShell = exports.ConnectAccountSessions = exports.ConnectSignOutButton = exports.ConnectHomeButton = exports.ConnectProfileButton = exports.ConnectInvoicesButton = exports.ConnectManageSubscriptionButton = exports.ConnectUserMenu = exports.ConnectProfileModal = exports.ConnectUserButton = exports.ConnectOneTap = exports.ConnectRegisterButton = exports.ConnectLoginButton = exports.ConnectLogo = exports.ConnectMark = exports.ConnectGrievanceNotice = exports.isConnectError = exports.ConnectError = exports.normalizePlanFeatures = exports.blockingBlockers = exports.CONNECT_APP_URL = exports.useConnectResource = exports.useConnectIntegrations = exports.useConnectSessions = exports.useConnectAddonUsage = exports.useConnectCompanyProfile = exports.useConnectApps = exports.useConnectPlans = exports.useConnectEntitlements = exports.useConnectPlatformAccess = exports.useConnectAudience = exports.useConnectWorkspaceType = exports.useConnectUser = exports.useConnect = exports.ConnectProvider = void 0;
+exports.monthlyOf = exports.formatPrice = exports.buildCheckoutUrl = exports.useConnectCheckout = exports.ConnectFilterTabs = exports.ConnectCursorPagination = exports.ConnectConfirmDialog = exports.ConnectLinkButton = exports.ConnectPlansPage = exports.ConnectUsageMeter = exports.ConnectPlatformGate = exports.ConnectWorkspaceTypeGate = exports.useConnectFeature = exports.ConnectFeatureGate = exports.useConnectAccessGate = exports.ConnectAccessGate = exports.ConnectReadinessGate = exports.ConnectReadinessBanner = exports.resolveSubscriptionState = exports.ConnectSeatUsage = exports.ConnectTrialBanner = exports.ConnectSubscriptionCard = exports.ConnectNoSubscriptionCard = exports.ConnectSubscriptionGate = exports.ConnectSubscribeDialog = exports.ConnectPlans = exports.ConnectIntegrationsModal = exports.AI_TONE_DOT = exports.AI_TONE_CHIP = exports.AI_EMPTY_VALUE = exports.aiStatusTone = exports.isNumericAiFormat = exports.formatAiValue = exports.AiSources = exports.AiSteps = exports.AiDetails = exports.AiTimeline = exports.AiMetrics = exports.AiChart = exports.AiTable = exports.ConnectAskAi = exports.ConnectAppsGrid = exports.isLinkableConnectScreen = exports.matchConnectScreen = exports.filterNavForAudience = exports.gateExemptPaths = exports.isNavItemActive = exports.resolveActivePath = exports.normalizePath = exports.flattenNav = void 0;
+exports.zonedInstant = exports.dayColumns = exports.layoutBookings = exports.useBookingActions = exports.useBookings = exports.useAvailableSlots = exports.useBookableEventTypes = exports.ConnectBookingDetail = exports.ConnectBookingDialog = exports.ConnectBookingCalendar = exports.useConnectWorkspaceMembers = exports.useConnectWorkspaces = exports.ConnectWorkspaceSwitcher = exports.resolvePlanGroup = exports.groupPlansByTier = exports.isFreePlan = exports.ACTION_LABEL = exports.discountLabel = exports.annualSaving = exports.checkoutSubscriptionId = exports.resolveAction = void 0;
 /**
  * Browser half of `@cosmoops/connect-sdk` - React components and hooks.
  *
@@ -104,6 +104,13 @@ Object.defineProperty(exports, "ConnectSidebarNav", { enumerable: true, get: fun
 Object.defineProperty(exports, "ConnectSideNav", { enumerable: true, get: function () { return side_nav_js_1.ConnectSideNav; } });
 var use_active_path_js_1 = require("./use-active-path.js");
 Object.defineProperty(exports, "useActivePath", { enumerable: true, get: function () { return use_active_path_js_1.useActivePath; } });
+/**
+ * Web Push. The hook owns the browser half - permission, the worker, the
+ * subscription - and Connect owns the keys, the devices and the member's
+ * preferences. Sending is server-side, through `connect.push.send`.
+ */
+var use_push_js_1 = require("./use-push.js");
+Object.defineProperty(exports, "useConnectPush", { enumerable: true, get: function () { return use_push_js_1.useConnectPush; } });
 // The nav model is plain data and pure functions - a host generating its nav
 // from its own route table needs the types, and `resolveActivePath` is the
 // same longest-prefix rule the sidebar highlights with, so a breadcrumb or a

package/dist/cjs/client/use-push.js

@@ -0,0 +1,139 @@
+"use client";
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.useConnectPush = useConnectPush;
+const react_1 = require("react");
+const provider_js_1 = require("./provider.js");
+/**
+ * Read the browser's own permission as external state.
+ *
+ * Not `useState` in an effect: the permission belongs to the browser, it can
+ * change from the address bar while the page is open, and it does not exist
+ * during a server render. `useSyncExternalStore` is the primitive for exactly
+ * that - a server snapshot of `"checking"` and a live client one.
+ */
+function subscribeToPermission(onChange) {
+    let status = null;
+    let cancelled = false;
+    // Absent on some Safari builds, and throws on others. Neither is fatal:
+    // without the subscription the snapshot is still correct on every render, it
+    // simply will not update by itself.
+    navigator.permissions
+        ?.query({ name: "notifications" })
+        .then((result) => {
+        if (cancelled)
+            return;
+        status = result;
+        result.addEventListener("change", onChange);
+    })
+        .catch(() => { });
+    return () => {
+        cancelled = true;
+        status?.removeEventListener("change", onChange);
+    };
+}
+function permissionSnapshot() {
+    if (typeof navigator === "undefined" ||
+        !("serviceWorker" in navigator) ||
+        typeof window === "undefined" ||
+        !("PushManager" in window) ||
+        !("Notification" in window)) {
+        return "unsupported";
+    }
+    if (Notification.permission === "denied")
+        return "denied";
+    return Notification.permission === "granted" ? "granted" : "prompt";
+}
+const serverSnapshot = () => "checking";
+/**
+ * Register this browser for the platform's notifications.
+ *
+ * The subscription is **Connect's, not your application's**: a member who
+ * turns notifications on in one app has turned them on for the platform, and
+ * the same device receives every other app's notifications and Connect's own.
+ * That is the point of centralising it - one browser prompt instead of one per
+ * app, and one place to turn everything off.
+ *
+ * Your application needs a service worker at its own origin that handles the
+ * `push` event; the SDK does not install one, because a worker is a
+ * site-wide concern with caching implications only the host can decide.
+ *
+ * @param serviceWorkerUrl Where your worker lives. Root-scoped by convention.
+ */
+function useConnectPush(serviceWorkerUrl = "/sw.js") {
+    const { fetchResource, mutateResource } = (0, provider_js_1.useConnect)();
+    const permission = (0, react_1.useSyncExternalStore)(subscribeToPermission, permissionSnapshot, serverSnapshot);
+    const [isEnabling, setIsEnabling] = (0, react_1.useState)(false);
+    const [error, setError] = (0, react_1.useState)(null);
+    const [unconfigured, setUnconfigured] = (0, react_1.useState)(false);
+    const enable = (0, react_1.useCallback)(async () => {
+        setError(null);
+        setIsEnabling(true);
+        try {
+            /*
+             * The key first, and the order matters: if the platform cannot send,
+             * asking for permission spends the member's one prompt on a feature
+             * that will never deliver - and a denial cannot be re-asked.
+             */
+            const key = await fetchResource("/push/key");
+            if (!key.configured || !key.publicKey) {
+                setUnconfigured(true);
+                return null;
+            }
+            if ((await Notification.requestPermission()) !== "granted")
+                return null;
+            const registration = await navigator.serviceWorker.register(serviceWorkerUrl);
+            // `ready` rather than the registration itself: one that is still
+            // installing has no `pushManager`, and subscribing against it throws in
+            // a way that reads as a permission problem.
+            await navigator.serviceWorker.ready;
+            const subscription = await registration.pushManager.subscribe({
+                // Required, and it may not be false - a silent push is reserved for
+                // sites with a far higher engagement bar, and asking for one here has
+                // the browser refuse the subscription outright.
+                userVisibleOnly: true,
+                applicationServerKey: base64UrlToBytes(key.publicKey),
+            });
+            const json = subscription.toJSON();
+            const registered = await mutateResource("/push/subscribe", {
+                endpoint: json.endpoint,
+                keys: { p256dh: json.keys?.p256dh, auth: json.keys?.auth },
+            });
+            return registered.id;
+        }
+        catch {
+            setError("This browser would not register for notifications. Reload the page and try again.");
+            return null;
+        }
+        finally {
+            setIsEnabling(false);
+        }
+    }, [fetchResource, mutateResource, serviceWorkerUrl]);
+    const disable = (0, react_1.useCallback)(async (deviceId) => {
+        await mutateResource("/push/unsubscribe", { id: deviceId });
+    }, [mutateResource]);
+    return {
+        status: unconfigured && permission !== "denied" ? "unconfigured" : permission,
+        isEnabling,
+        error,
+        enable,
+        disable,
+    };
+}
+/**
+ * The VAPID public key as the bytes `pushManager.subscribe()` wants.
+ *
+ * It travels base64url and the API takes a `BufferSource`. Spelled out rather
+ * than inlined because getting it wrong produces an `InvalidAccessError` that
+ * reads as a permissions fault rather than an encoding one - and the explicit
+ * `ArrayBuffer` matters too: `Uint8Array.from` widens to `ArrayBufferLike`,
+ * which `applicationServerKey` will not accept.
+ */
+function base64UrlToBytes(base64) {
+    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), "=");
+    const raw = atob(padded.replace(/-/g, "+").replace(/_/g, "/"));
+    const bytes = new Uint8Array(new ArrayBuffer(raw.length));
+    for (let index = 0; index < raw.length; index += 1)
+        bytes[index] = raw.charCodeAt(index);
+    return bytes;
+}

package/dist/cjs/server/client.js

@@ -23,6 +23,7 @@ const analytics_js_1 = require("./resources/analytics.js");
 const otp_js_1 = require("./resources/otp.js");
 const sessions_js_1 = require("./resources/sessions.js");
 const platform_js_1 = require("./resources/platform.js");
+const push_js_1 = require("./resources/push.js");
 exports.DEFAULT_BASE_URL = "https://connect.cosmoops.com";
 const APPLICATION_API_PREFIX = "/api/v1/application";
 /**
@@ -116,6 +117,11 @@ class ConnectClient {
     workspaces;
     /** The platform's own legal identity and DPDP grievance channel - see `PlatformResource`. */
     platform;
+    /**
+     * Web Push. Connect holds the VAPID keys, the devices and the member's own
+     * preferences; you supply a title, a body and a URL. See `PushResource`.
+     */
+    push;
     /**
      * Relays one `/data/*` or `/kv/*` request verbatim - `createConnectHandler`'s
      * store route and nothing else. See `storePassthrough`.
@@ -160,9 +166,10 @@ class ConnectClient {
         this.integrations = new integrations_js_1.IntegrationsResource(transport);
         this.workspaces = new workspaces_js_1.WorkspacesResource(transport);
         this.platform = new platform_js_1.PlatformResource(transport);
+        this.push = new push_js_1.PushResource(transport);
         this.storeRelay = (spec) => (0, data_js_1.storePassthrough)(transport, spec);
     }
 }
 exports.ConnectClient = ConnectClient;
 /** Kept in step with `package.json` by `sdk.test.ts`. */
-exports.SDK_VERSION = "0.30.1";
+exports.SDK_VERSION = "0.32.0";

package/dist/cjs/server/handler.js

@@ -516,6 +516,60 @@ function createConnectHandler(options) {
          * switching is simply absent for them rather than half-working - the same
          * treatment `/signin` and `/callback` already get.
          */
+        /*
+         * Push notifications - the browser half, and deliberately only that half.
+         *
+         * **There is no `POST /push` here**, and its absence is the design: a
+         * notification anybody can trigger from a devtools console is one an
+         * attacker can trigger from a compromised page, wearing the styling of an
+         * app the person trusts. Sending is a server-to-server act with your API
+         * key; Connect's own route refuses the session-token path outright.
+         *
+         * What a browser legitimately does is register itself, because
+         * `pushManager.subscribe()` produces a subscription no server can make on
+         * its behalf. All three routes resolve the member from their session, so
+         * there is no `userId` anywhere on this surface - a page cannot register a
+         * device against somebody else's account, nor list theirs.
+         */
+        "GET /push/key": async (request) => json(await client.push.key({ asUser: await requireToken(request) })),
+        "POST /push/subscribe": async (request) => {
+            const token = await requireToken(request);
+            const body = (await request.json().catch(() => null));
+            // Shape-checked here rather than relayed blindly, so a malformed
+            // subscription fails with a sentence naming what is missing instead of
+            // a Zod message from a server the page cannot see.
+            if (typeof body?.endpoint !== "string" ||
+                typeof body.keys?.p256dh !== "string" ||
+                typeof body.keys?.auth !== "string") {
+                throw new errors_js_1.ConnectError({
+                    status: 400,
+                    code: "validation_error",
+                    message: "endpoint and keys.p256dh/keys.auth are required",
+                    endpoint: "POST /push/subscribe",
+                });
+            }
+            return json(await client.push.registerDevice({
+                endpoint: body.endpoint,
+                keys: { p256dh: body.keys.p256dh, auth: body.keys.auth },
+                // Taken from the request rather than the body: a page can put
+                // anything in a field, and this one is shown back on a device
+                // list where a spoofed entry would be the point of spoofing it.
+                userAgent: (request.headers.get("user-agent") ?? "").slice(0, 512),
+            }, { asUser: token }));
+        },
+        "POST /push/unsubscribe": async (request) => {
+            const token = await requireToken(request);
+            const body = (await request.json().catch(() => null));
+            if (typeof body?.id !== "string") {
+                throw new errors_js_1.ConnectError({
+                    status: 400,
+                    code: "validation_error",
+                    message: "id is required",
+                    endpoint: "POST /push/unsubscribe",
+                });
+            }
+            return json(await client.push.revokeDevice(body.id, { asUser: token }));
+        },
         "GET /workspaces": async (request) => json({ workspaces: await client.workspaces.list({ asUser: await requireToken(request) }) }),
         "GET /workspaces/members": async (request) => json({ members: await client.workspaces.members({ asUser: await requireToken(request) }) }),
         "POST /workspaces/switch": async (request) => {

package/dist/cjs/server/resources/ai.js

@@ -107,5 +107,40 @@ class AiResource {
         });
         return result.data;
     }
+    /**
+     * Draft every section of a platform-defined assessment from one sentence.
+     *
+     * The intended flow is draft first, then let the person correct it section
+     * by section: a blank questionnaire is the reason most people abandon one,
+     * and editing a strawman is a far smaller ask than authoring from nothing.
+     *
+     * Unattributed - assessments run against platform-wide definitions and the
+     * first consumers run before anyone has signed in, so there is no `asUser`
+     * and no workspace here.
+     */
+    async draftAssessment(input) {
+        const result = await (0, http_js_1.request)(this.transport, {
+            method: "POST",
+            path: "/ai/assessment/draft",
+            json: input,
+        });
+        return result.data;
+    }
+    /**
+     * Critique a completed assessment - the tensions between sections, the
+     * riskiest assumption, and a coarse score.
+     *
+     * Unknown section keys in `answers` are ignored rather than rejected, so a
+     * definition changing under a half-finished assessment costs the reader
+     * nothing.
+     */
+    async reviewAssessment(input) {
+        const result = await (0, http_js_1.request)(this.transport, {
+            method: "POST",
+            path: "/ai/assessment/review",
+            json: input,
+        });
+        return result.data;
+    }
 }
 exports.AiResource = AiResource;

package/dist/cjs/server/resources/enrichment.js

@@ -52,5 +52,53 @@ class EnrichmentResource {
             signal: options.signal,
         });
     }
+    /**
+     * What the company at a domain **looks like** - logo, palette, typefaces,
+     * and the radius, spacing and breakpoint scales its own stylesheets declare.
+     *
+     * The sibling of `company()` above: that one answers what a company does,
+     * this one answers what it looks like. Useful for white-labelling a portal
+     * to a customer's brand, pre-filling a design brief, or showing a real
+     * account card instead of a grey placeholder.
+     *
+     * Needs an API key scoped to **`enrichment:brand`** - separate from
+     * `enrichment:read` because it is far more expensive: it crawls
+     * stylesheets, may render the page in a headless browser, and caches image
+     * bytes.
+     *
+     * ```ts
+     * const result = await connect.enrichment.brand({ domain: "acme.com" });
+     * if (result.status === "extracted") {
+     *   const primary = result.profile.brandKit.palette.find((c) => c.role === "primary");
+     * }
+     * ```
+     *
+     * Three things to know before wiring it in:
+     *
+     * - **Set your client timeout to at least 90 seconds.** A cold read runs
+     *   the whole extraction before answering and can take up to a minute; many
+     *   HTTP clients default to 30s and abandon a request that was about to
+     *   succeed. Cached reads return in milliseconds, and cached is the normal
+     *   case - profiles are held for 90 days, so you pay the cold path roughly
+     *   once per domain.
+     * - **Never store `brandKit.logos[].url`.** It is a short-lived signed URL
+     *   minted per read. Render it directly or re-read the profile; persist
+     *   `sourceUrl` if you need something stable.
+     * - **The values were measured, not generated.** Check `palette[].source` -
+     *   a `css-var` entry is the company naming its own colour, a `frequency`
+     *   entry is a ranked count and much weaker.
+     */
+    brand(input, options = {}) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "POST",
+            path: "/enrichment/brand",
+            json: {
+                domain: input.domain,
+                ...(input.refresh ? { refresh: true } : {}),
+            },
+            headers: (0, acting_as_js_1.actingAs)(input.asUser),
+            signal: options.signal,
+        });
+    }
 }
 exports.EnrichmentResource = EnrichmentResource;

package/dist/cjs/server/resources/push.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PushResource = void 0;
+const http_js_1 = require("../http.js");
+const acting_as_js_1 = require("./acting-as.js");
+/**
+ * Web Push, with Connect holding everything that makes it work.
+ *
+ * Your application supplies a title, a body, a URL and the members to reach.
+ * Connect owns the VAPID keys it signs with, the devices each member has
+ * registered across every application on the platform, that member's own
+ * notification preferences, and the bookkeeping when a browser goes away.
+ *
+ * So you never hold a push credential, never store an endpoint, and cannot
+ * reach anybody who is not an active member of the workspace you name -
+ * membership is re-checked on every send rather than trusted from the ids you
+ * pass.
+ *
+ * ## Two halves, and only `send` belongs on your server
+ *
+ * Registering a device happens in the **browser**, because a subscription is
+ * produced by `pushManager.subscribe()` against the member's own browser and
+ * no server can make one for them. `registerDevice` and `revokeDevice` below
+ * therefore take a session token and are what the SDK bridge calls on the
+ * browser's behalf - see `createConnectHandler`. You will normally reach them
+ * through `useConnectPush()` in `@cosmoops/connect-sdk/client` rather than
+ * directly.
+ */
+class PushResource {
+    transport;
+    constructor(transport) {
+        this.transport = transport;
+    }
+    /**
+     * Notify members of a workspace.
+     *
+     * **`delivered: 0` is a success, not a failure.** The member may have
+     * registered no device, silenced notifications from their apps, or denied
+     * the browser prompt - all ordinary. A caller that retries on zero will
+     * retry forever against somebody who has opted out.
+     *
+     * Treat every send as a nudge toward something already true in your own
+     * data, and never let a failure here fail the thing that triggered it: the
+     * reminder is worth less than the record it is about.
+     *
+     * `url` must be absolute and on an origin this application registered as an
+     * SSO redirect URI. Connect refuses anything else, because a URL it did not
+     * check is an open redirect delivered to a lock screen.
+     */
+    send(input) {
+        return (0, http_js_1.request)(this.transport, { method: "POST", path: "/push", json: input });
+    }
+    /**
+     * The VAPID public key a browser needs before it can subscribe, and whether
+     * the platform can send at all.
+     *
+     * Safe to hand to any signed-in caller: it is the verification half of the
+     * pair, so holding it lets a browser *receive* what Connect signs and never
+     * send anything.
+     */
+    key(options) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "GET",
+            path: "/push/subscriptions",
+            headers: (0, acting_as_js_1.actingAs)(options.asUser),
+        });
+    }
+    /** Register one browser, from a subscription that browser just produced. */
+    registerDevice(input, options) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "POST",
+            path: "/push/subscriptions",
+            json: input,
+            headers: (0, acting_as_js_1.actingAs)(options.asUser),
+        });
+    }
+    /**
+     * Stop notifications on one browser.
+     *
+     * The id is the one `registerDevice` returned. Connect re-checks that it
+     * belongs to the calling member, so a guessed id is a refusal rather than
+     * somebody else's device going quiet.
+     */
+    revokeDevice(id, options) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "DELETE",
+            path: `/push/subscriptions?id=${encodeURIComponent(id)}`,
+            headers: (0, acting_as_js_1.actingAs)(options.asUser),
+        });
+    }
+}
+exports.PushResource = PushResource;

package/dist/esm/client/index.js

@@ -52,6 +52,12 @@ export { ConnectSidebar, ConnectSidebarHeader, ConnectSidebarBody, ConnectSideba
 export { ConnectShellProvider, useConnectShell, sidebarRowClass, RAIL_COLLAPSED, RAIL_EXPANDED, } from "./components/shell-context.js";
 export { ConnectSidebarNav, ConnectSideNav } from "./components/side-nav.js";
 export { useActivePath } from "./use-active-path.js";
+/**
+ * Web Push. The hook owns the browser half - permission, the worker, the
+ * subscription - and Connect owns the keys, the devices and the member's
+ * preferences. Sending is server-side, through `connect.push.send`.
+ */
+export { useConnectPush } from "./use-push.js";
 // The nav model is plain data and pure functions - a host generating its nav
 // from its own route table needs the types, and `resolveActivePath` is the
 // same longest-prefix rule the sidebar highlights with, so a breadcrumb or a