@cosmoops/connect-sdk 0.6.0 → 0.9.0

package/dist/esm/client/components/user-menu.js

@@ -19,6 +19,28 @@ function initials(name, email) {
 function openExternal(url) {
     window.open(url, "_blank", "noopener,noreferrer");
 }
+/**
+ * Connect's profile page, with the context it needs to offer a way back here.
+ *
+ * Connect answers `/profile` for any signed-in user, so the bare URL works on
+ * its own - these two params only add the "Back to <your app>" banner. It
+ * validates `return_to` against this `client_id`'s registered redirect
+ * origins and silently drops the banner if they don't match, so a wrong or
+ * stale `appUrl`/`clientId` pairing degrades to what it did before rather
+ * than erroring.
+ *
+ * `window.location.href` rather than a configured home URL: the point is to
+ * come back to the page they left, and only the browser knows which one that
+ * is.
+ */
+function profileUrl(appUrl, clientId) {
+    const url = new URL("/profile", appUrl);
+    url.searchParams.set("client_id", clientId);
+    if (typeof window !== "undefined") {
+        url.searchParams.set("return_to", window.location.href);
+    }
+    return url.toString();
+}
 /**
  * The member's photo, with their initials underneath it.
  *
@@ -97,7 +119,7 @@ function DestinationTile({ icon, label, url, }) {
  * in place, which is why it sits alone in the footer rather than as a fourth
  * item in the same list as three navigations.
  *
- * The session list is account-wide, not scoped to this service - see
+ * The session list is account-wide, not scoped to this application - see
  * `ConnectUserSession`'s doc comment in `types.ts`. Appearance only renders
  * when both `theme` and `onThemeChange` are supplied.
  *
@@ -114,7 +136,7 @@ function DestinationTile({ icon, label, url, }) {
  * the modal programmatically; sign-out uses `slot="close"` instead.
  */
 export function ConnectUserMenu({ compact = false, onSignOut, className, theme, onThemeChange, }) {
-    const { session, isLoading, signOut, appUrl } = useConnect();
+    const { session, isLoading, signOut, appUrl, clientId } = useConnect();
     if (isLoading) {
         return (_jsxs("div", { className: `flex items-center gap-2 ${className ?? ""}`, children: [_jsx(Skeleton, { className: "size-8 shrink-0 rounded-full" }), !compact && _jsx(Skeleton, { className: "h-4 w-24" })] }));
     }
@@ -122,13 +144,13 @@ export function ConnectUserMenu({ compact = false, onSignOut, className, theme,
     if (!user)
         return null;
     const label = user.displayName ?? user.email ?? "Account";
-    const role = session?.serviceRole?.role;
+    const role = session?.applicationRole?.role;
     const planChip = subscriptionChip(session?.subscription ?? null);
     return (_jsxs(Modal, { children: [_jsxs(Button, { variant: "tertiary", "aria-label": `Account: ${label}`, 
                 // `pl-1` against the default right padding is optical, not sloppy: a
                 // circular avatar needs less inset than a text label to look evenly
                 // seated in the button.
-                className: `gap-2 pl-1 ${className ?? ""}`, children: [_jsx(UserAvatar, { user: user, size: "sm" }), !compact && _jsx("span", { className: "text-sm font-medium text-foreground", children: label })] }), _jsx(Modal.Backdrop, { children: _jsx(Modal.Container, { size: "md", scroll: "inside", children: _jsxs(Modal.Dialog, { children: [_jsx(Modal.CloseTrigger, {}), _jsx(Modal.Header, { children: _jsx(Modal.Heading, { children: "Account" }) }), _jsxs(Modal.Body, { className: "flex flex-col gap-5", children: [_jsxs("div", { className: `flex items-start gap-3 rounded-xl border border-border ${PANEL_FILL} p-4`, children: [_jsx(UserAvatar, { user: user, size: "lg" }), _jsxs("div", { className: "flex min-w-0 flex-1 flex-col gap-0.5", children: [_jsx("p", { className: "truncate text-sm font-semibold text-foreground", children: label }), user.email && _jsx("p", { className: "truncate text-xs text-muted", children: user.email }), _jsx("p", { className: "truncate text-xs text-muted", children: user.organizationName }), (role || planChip || !user.emailVerified) && (_jsxs("div", { className: "mt-1.5 flex flex-wrap items-center gap-1.5", children: [role && (_jsx(Chip, { size: "sm", variant: "soft", color: "accent", children: humanizeRole(role) })), planChip, !user.emailVerified && (_jsx(Chip, { size: "sm", variant: "soft", color: "warning", children: "Email unverified" }))] }))] })] }), _jsxs("div", { className: "grid grid-cols-3 gap-2", children: [_jsx(DestinationTile, { icon: _jsx(UserRound, { className: ICON, "aria-hidden": "true" }), label: "Profile", url: `${appUrl}/profile` }), _jsx(DestinationTile, { icon: _jsx(CreditCard, { className: ICON, "aria-hidden": "true" }), label: "Billing", url: `${appUrl}/billing` }), _jsx(DestinationTile, { icon: _jsx(ConnectMark, { className: ICON }), label: "Connect", url: appUrl })] }), theme && onThemeChange && (_jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("p", { className: "text-sm font-medium text-foreground", children: "Appearance" }), _jsx(ToggleButtonGroup, { fullWidth: true, "aria-label": "Theme", selectionMode: "single", disallowEmptySelection: true, selectedKeys: [theme], onSelectionChange: (keys) => {
+                className: `gap-2 pl-1 ${className ?? ""}`, children: [_jsx(UserAvatar, { user: user, size: "sm" }), !compact && _jsx("span", { className: "text-sm font-medium text-foreground", children: label })] }), _jsx(Modal.Backdrop, { children: _jsx(Modal.Container, { size: "md", scroll: "inside", children: _jsxs(Modal.Dialog, { children: [_jsx(Modal.CloseTrigger, {}), _jsx(Modal.Header, { children: _jsx(Modal.Heading, { children: "Account" }) }), _jsxs(Modal.Body, { className: "flex flex-col gap-5", children: [_jsxs("div", { className: `flex items-start gap-3 rounded-xl border border-border ${PANEL_FILL} p-4`, children: [_jsx(UserAvatar, { user: user, size: "lg" }), _jsxs("div", { className: "flex min-w-0 flex-1 flex-col gap-0.5", children: [_jsx("p", { className: "truncate text-sm font-semibold text-foreground", children: label }), user.email && _jsx("p", { className: "truncate text-xs text-muted", children: user.email }), _jsx("p", { className: "truncate text-xs text-muted", children: user.workspaceName }), (role || planChip || !user.emailVerified) && (_jsxs("div", { className: "mt-1.5 flex flex-wrap items-center gap-1.5", children: [role && (_jsx(Chip, { size: "sm", variant: "soft", color: "accent", children: humanizeRole(role) })), planChip, !user.emailVerified && (_jsx(Chip, { size: "sm", variant: "soft", color: "warning", children: "Email unverified" }))] }))] })] }), _jsxs("div", { className: "grid grid-cols-3 gap-2", children: [_jsx(DestinationTile, { icon: _jsx(UserRound, { className: ICON, "aria-hidden": "true" }), label: "Profile", url: profileUrl(appUrl, clientId) }), _jsx(DestinationTile, { icon: _jsx(CreditCard, { className: ICON, "aria-hidden": "true" }), label: "Billing", url: `${appUrl}/billing` }), _jsx(DestinationTile, { icon: _jsx(ConnectMark, { className: ICON }), label: "Connect", url: appUrl })] }), theme && onThemeChange && (_jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("p", { className: "text-sm font-medium text-foreground", children: "Appearance" }), _jsx(ToggleButtonGroup, { fullWidth: true, "aria-label": "Theme", selectionMode: "single", disallowEmptySelection: true, selectedKeys: [theme], onSelectionChange: (keys) => {
                                                     const [next] = [...keys];
                                                     if (typeof next === "string")
                                                         onThemeChange(next);
@@ -149,7 +171,7 @@ export function ConnectManageSubscriptionButton({ className }) {
  * Invoices and payment history, on Connect.
  *
  * A deep link rather than a component that lists them, and that is not a
- * placeholder: nothing in `/api/v1/service/*` exposes invoices, so an SDK-side
+ * placeholder: nothing in `/api/v1/application/*` exposes invoices, so an SDK-side
  * list would have nothing to read. It is also the right answer regardless -
  * a GST tax invoice is a legal document with a fixed format, downloadable and
  * emailed from one place, and a partner-rendered copy of one would be a second
@@ -167,13 +189,14 @@ export function ConnectInvoicesButton({ className }) {
  * `ConnectHomeButton`.
  *
  * It was reachable only from inside `ConnectUserMenu`, which meant an app that
- * builds its own account menu had to hardcode `${appUrl}/profile` to offer it.
+ * builds its own account menu had to hardcode `${appUrl}/profile` to offer it -
+ * and got no `return_to`, so the user had no way back.
  */
 export function ConnectProfileButton({ className }) {
-    const { session, appUrl } = useConnect();
+    const { session, appUrl, clientId } = useConnect();
     if (!session?.user)
         return null;
-    return (_jsxs(Button, { variant: "tertiary", className: className, onPress: () => openExternal(`${appUrl}/profile`), children: [_jsx(UserRound, { className: "size-4 shrink-0" }), "Profile", _jsx(ExternalLink, { className: "size-3.5 shrink-0 text-muted" })] }));
+    return (_jsxs(Button, { variant: "tertiary", className: className, onPress: () => openExternal(profileUrl(appUrl, clientId)), children: [_jsx(UserRound, { className: "size-4 shrink-0" }), "Profile", _jsx(ExternalLink, { className: "size-3.5 shrink-0 text-muted" })] }));
 }
 /** A plain "Open Connect" button, for a footer or a help menu. */
 export function ConnectHomeButton({ className }) {

package/dist/esm/client/components/workspace-type-gate.js

@@ -0,0 +1,45 @@
+"use client";
+import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
+import { useConnect } from "../provider.js";
+/**
+ * Renders `children` only for a workspace of the given type.
+ *
+ * ```tsx
+ * <ConnectWorkspaceTypeGate type="business">
+ *   <TeamMembersTable />
+ * </ConnectWorkspaceTypeGate>
+ * ```
+ *
+ * The point is dead controls, not access: an `"individual"` workspace has
+ * exactly one seat and can never have another, so a members table, an invite
+ * button and a seat meter are all things that can only ever fail there.
+ * Hiding them is a better answer than letting someone press one and read an
+ * error about an account shape they did not choose.
+ *
+ * This is emphatically **not** the audience gate. It does not know what your
+ * application is sold to and will happily render a business-only subtree to a
+ * business workspace that has no business being in your application at all -
+ * that is `<ConnectAccessGate>`'s job, off the `audience_mismatch` readiness
+ * blocker. Use this one *inside* an application both audiences can reach, to
+ * vary what each sees.
+ *
+ * Like every gate in this package it is a **UX gate, not a security
+ * boundary**: the browser can ignore it. Anything that must not happen for an
+ * individual workspace has to be refused on your server too.
+ *
+ * Renders `loading` - not `fallback` - while the session is unknown, so a
+ * business account never flickers through the individual-account layout.
+ */
+export function ConnectWorkspaceTypeGate({ type, children, fallback = null, loading = null, }) {
+    const { session, isLoading } = useConnect();
+    const workspaceType = session?.user?.workspaceType ?? null;
+    if (isLoading)
+        return _jsx(_Fragment, { children: loading });
+    // Signed out is not "the other type" - there is no workspace to be a type
+    // of yet, and rendering the fallback here would put an individual-account
+    // layout in front of a visitor who has not signed in.
+    if (!workspaceType)
+        return _jsx(_Fragment, { children: loading });
+    const accepted = Array.isArray(type) ? type : [type];
+    return _jsx(_Fragment, { children: accepted.includes(workspaceType) ? children : fallback });
+}

package/dist/esm/client/index.js

@@ -8,10 +8,10 @@
  *
  * Styling is HeroUI v3 semantic tokens only (`accent`, `muted`, `surface`,
  * `separator`, ...), never a hardcoded colour - so these components inherit
- * whatever theme the host service platform already configured, and one theme
+ * whatever theme the host application platform already configured, and one theme
  * change lands identically in all of them.
  */
-export { ConnectProvider, useConnect, useConnectUser, useConnectEntitlements, useConnectPlans, useConnectApps, useConnectAddonUsage, useConnectSessions, useConnectIntegrations, useConnectResource, CONNECT_APP_URL, } from "./provider.js";
+export { ConnectProvider, useConnect, useConnectUser, useConnectWorkspaceType, useConnectAudience, useConnectEntitlements, useConnectPlans, useConnectApps, useConnectAddonUsage, useConnectSessions, useConnectIntegrations, useConnectResource, CONNECT_APP_URL, } from "./provider.js";
 // Re-exported from the root entry rather than kept there alone: it is a pure
 // helper, but every caller is UI code, and making a component file reach two
 // entry points for one function is friction with nothing behind it.
@@ -28,7 +28,7 @@ export { ConnectAccountSessions } from "./components/account-sessions.js";
 // pieces it composes rather than in a section of its own - an integration
 // reaching for a sidebar wants to find the launcher and the account menu in
 // the same breath, since the shell already mounts both.
-export { ConnectAppShell } from "./components/app-shell.js";
+export { AppShell } from "./components/app-shell.js";
 export { ConnectSideNav } from "./components/side-nav.js";
 export { useActivePath } from "./use-active-path.js";
 // The nav model is plain data and pure functions - a host generating its nav
@@ -37,6 +37,16 @@ export { useActivePath } from "./use-active-path.js";
 // page title derived from it cannot disagree with the rail.
 export { normalizeNav, flattenNav, normalizePath, resolveActivePath, isNavItemActive, gateExemptPaths, } from "./components/nav.js";
 export { ConnectAppsGrid } from "./components/apps-grid.js";
+// `AppShell askAi` mounts this; exported for an app that wants the panel
+// without the frame, or wants it somewhere other than the shell's flex row
+// (at which point it overlays rather than pushes - see its doc comment).
+export { ConnectAskAi } from "./components/ask-ai.js";
+// The seven widgets an Ask AI answer can draw, and the formatter they share -
+// exported so a partner rendering Connect's chat somewhere else entirely (a
+// support console, an embedded assistant) gets the same table, chart and metric
+// tiles rather than reimplementing them from the wire types.
+export { AiTable, AiChart, AiMetrics, AiTimeline, AiDetails, AiSteps, AiSources, } from "./components/ai-widgets.js";
+export { formatAiValue, isNumericAiFormat, aiStatusTone, AI_EMPTY_VALUE, AI_TONE_CHIP, AI_TONE_DOT, } from "./components/ai-format.js";
 export { ConnectIntegrationsModal } from "./components/integrations-modal.js";
 export { ConnectPlans } from "./components/plans.js";
 export { ConnectSubscribeDialog } from "./components/subscribe-dialog.js";
@@ -49,6 +59,7 @@ export { ConnectSubscriptionGate, ConnectNoSubscriptionCard, ConnectSubscription
 export { ConnectReadinessBanner, ConnectReadinessGate } from "./components/readiness.js";
 export { ConnectAccessGate, useConnectAccessGate } from "./components/access-gate.js";
 export { ConnectFeatureGate, useConnectFeature } from "./components/feature-gate.js";
+export { ConnectWorkspaceTypeGate } from "./components/workspace-type-gate.js";
 export { ConnectUsageMeter } from "./components/usage-meter.js";
 export { ConnectPlansPage } from "./components/plans-page.js";
 export { useConnectCheckout, buildCheckoutUrl } from "./use-checkout.js";

package/dist/esm/client/mark.js

@@ -4,7 +4,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  * The Connect mark - concentric rings on a solid accent badge.
  *
  * Painted from `--accent` / `--accent-foreground`, the same HeroUI tokens the
- * host app themes, so the badge tracks whatever palette a service platform has
+ * host app themes, so the badge tracks whatever palette an application platform has
  * configured rather than carrying a hardcoded CosmoOps green into someone
  * else's brand.
  */

package/dist/esm/client/provider.js

@@ -111,6 +111,20 @@ export function ConnectProvider({ clientId = "", basePath = "/api/connect", redi
     const invalidateResource = useCallback((path) => {
         cache.current.delete(`${basePath}${path}`);
     }, [basePath]);
+    const streamResource = useCallback(async (path, body, options) => {
+        const response = await (fetchImpl ?? globalThis.fetch)(`${basePath}${path}`, {
+            method: "POST",
+            credentials: "same-origin",
+            headers: { accept: "text/event-stream", "content-type": "application/json" },
+            body: JSON.stringify(body),
+            signal: options?.signal,
+        });
+        if (!response.ok) {
+            const envelope = await response.json().catch(() => null);
+            throw new Error(envelope?.error?.message ?? `Connect bridge returned ${response.status}`);
+        }
+        return response;
+    }, [basePath, fetchImpl]);
     const refresh = useCallback(async () => {
         cache.current.clear();
         try {
@@ -122,7 +136,7 @@ export function ConnectProvider({ clientId = "", basePath = "/api/connect", redi
             // error, so a Login button still renders rather than the UI hanging on
             // skeletons forever.
             setResult({
-                session: { user: null, subscription: null, serviceRole: null },
+                session: { user: null, subscription: null, applicationRole: null, audience: null },
                 error: cause instanceof Error ? cause.message : "Could not reach Connect",
             });
         }
@@ -171,7 +185,7 @@ export function ConnectProvider({ clientId = "", basePath = "/api/connect", redi
             credentials: "same-origin",
         }).catch(() => { });
         cache.current.clear();
-        setResult({ session: { user: null, subscription: null, serviceRole: null }, error: null });
+        setResult({ session: { user: null, subscription: null, applicationRole: null, audience: null }, error: null });
     }, [basePath, fetchImpl]);
     const value = useMemo(() => ({
         clientId,
@@ -185,6 +199,7 @@ export function ConnectProvider({ clientId = "", basePath = "/api/connect", redi
         fetchResource,
         mutateResource,
         invalidateResource,
+        streamResource,
     }), [
         clientId,
         appUrl,
@@ -197,6 +212,7 @@ export function ConnectProvider({ clientId = "", basePath = "/api/connect", redi
         fetchResource,
         mutateResource,
         invalidateResource,
+        streamResource,
     ]);
     return _jsx(ConnectContext.Provider, { value: value, children: children });
 }
@@ -211,6 +227,31 @@ export function useConnect() {
 export function useConnectUser() {
     return useConnect().session?.user ?? null;
 }
+/**
+ * Whether the signed-in workspace is a one-seat personal account or a team -
+ * `null` while the session is loading or signed out.
+ *
+ * Branch on this to stop rendering team UI at a solo account: a members
+ * table, an invite button and a seat meter are all dead controls on an
+ * `"individual"` workspace, which has exactly one seat and cannot gain
+ * another. `<ConnectWorkspaceTypeGate>` is the declarative form.
+ */
+export function useConnectWorkspaceType() {
+    return useConnect().session?.user?.workspaceType ?? null;
+}
+/**
+ * Whether this account is the kind your application is sold to - `null` while
+ * the session is loading or signed out.
+ *
+ * `audience.matches === false` is a hard block, not a hint: readiness reports
+ * `audience_mismatch` and subscribing is refused. `<ConnectAccessGate>`
+ * already blocks the shell on it, so reach for this only when you need the
+ * verdict somewhere the gate does not run - a marketing page, say, or a
+ * sign-up CTA you would rather not show to an account that cannot complete it.
+ */
+export function useConnectAudience() {
+    return useConnect().session?.audience ?? null;
+}
 /** Readiness gates and the live subscription, fetched on first use. */
 export function useConnectEntitlements() {
     return useConnectResource("/entitlements");
@@ -218,28 +259,28 @@ export function useConnectEntitlements() {
 /**
  * What is left of every consumable add-on on this workspace's subscription.
  *
- * The read half of `client.billing.consumeAddon` - a service that meters its
+ * The read half of `client.billing.consumeAddon` - an application that meters its
  * own end users had no way to show them what remained until this existed.
  * Empty `addons` means there is nothing to meter, which is not an error.
  */
 export function useConnectAddonUsage() {
     return useConnectResource("/addons");
 }
-/** This service's plan catalog. */
+/** This application's plan catalog. */
 export function useConnectPlans() {
     return useConnectResource("/plans");
 }
-/** The apps this organization can open. */
+/** The apps this workspace can open. */
 export function useConnectApps() {
     return useConnectResource("/apps");
 }
-/** Enabled Composio-hosted toolkits and this organization's connection status for each. */
+/** Enabled Composio-hosted toolkits and this workspace's connection status for each. */
 export function useConnectIntegrations() {
     return useConnectResource("/integrations");
 }
 /**
  * This Connect account's own login sessions - account-wide, not scoped to
- * this service, see `SessionsListResponse`'s doc comment. The component
+ * this application, see `SessionsListResponse`'s doc comment. The component
  * that calls this is also the one that must own any revoke actions and call
  * the returned `refetch()` afterward - see `mutateResource`'s doc comment
  * for why nothing does that automatically.

package/dist/esm/client/use-checkout.js

@@ -152,15 +152,15 @@ export function buildCancelUrl({ appUrl, subscriptionId }) {
  * The Connect URL that completes a subscribe or a plan change.
  *
  * Both land on a modal Connect renders over the relevant page (an intercepted
- * parallel route - `app/@modal/(.)services/...` and
+ * parallel route - `app/@modal/(.)applications/...` and
  * `app/@modal/(.)billing/...`), so the customer arrives already looking at the
  * confirmation for the plan they picked here, not at a catalogue they have to
  * find it in again.
  */
-export function buildCheckoutUrl({ appUrl, serviceId, planId, subscriptionId, coupon, }) {
+export function buildCheckoutUrl({ appUrl, applicationId, planId, subscriptionId, coupon, }) {
     const path = subscriptionId
         ? `/billing/subscriptions/${encodeURIComponent(subscriptionId)}/change-plan/${encodeURIComponent(planId)}`
-        : `/services/${encodeURIComponent(serviceId)}/subscribe/${encodeURIComponent(planId)}`;
+        : `/applications/${encodeURIComponent(applicationId)}/subscribe/${encodeURIComponent(planId)}`;
     const url = new URL(path, appUrl);
     if (coupon?.trim())
         url.searchParams.set("coupon", coupon.trim());

package/dist/esm/errors.js

@@ -1,8 +1,8 @@
 /**
- * Every failure the Connect service API can report, as one class.
+ * Every failure the Connect application API can report, as one class.
  *
  * The API speaks two error dialects and this collapses them: the
- * `/api/v1/service/*` endpoints use `{ error: { code, message } }`, while the
+ * `/api/v1/application/*` endpoints use `{ error: { code, message } }`, while the
  * three `/sso/*` ones use OAuth2's `{ error, error_description }` (RFC 6749
  * §5.2). Both land here with `code` populated, so integrating code branches on
  * one field either way.
@@ -41,7 +41,7 @@ export class ConnectError extends Error {
      * Whether the user's Connect sign-in is over and they need to go back
      * through `identity.authorizeUrl()`. Collapses every session-side failure,
      * matching how the API reports them - unknown, expired, revoked, or issued
-     * to a different service all arrive as one `invalid_token`.
+     * to a different application all arrive as one `invalid_token`.
      */
     get isSessionExpired() {
         return this.code === "invalid_token";
@@ -55,7 +55,7 @@ export class ConnectError extends Error {
      * guessing keys. These two are the exception: reaching them required
      * presenting a key whose hash matched, so you already hold it, and what you
      * need to know is that no retry and no scope change will fix this - the key
-     * has to be reissued from the service's Integration tab.
+     * has to be reissued from the application's Integration tab.
      *
      * Worth alerting on. It is the one failure that will not resolve itself and
      * takes down every call your integration makes.

package/dist/esm/helpers.js

@@ -12,7 +12,7 @@ export function blockingBlockers(readiness) {
  * Coerces either wire shape into `PlanFeature[]`.
  *
  * A bare key becomes `{ key, name: key, description: "" }` - the same
- * fallback the server applies for a plan older than its service's feature
+ * fallback the server applies for a plan older than its application's feature
  * catalog, so an un-upgraded Connect renders exactly what it always did
  * rather than a column of blanks.
  *

package/dist/esm/index.js

@@ -1,6 +1,6 @@
 /**
  * `@cosmoops/connect-sdk` - the official client for the CosmoOps Connect
- * **service-partner API** (`/api/v1/service/*`).
+ * **application-partner API** (`/api/v1/application/*`).
  *
  * This root entry is the isomorphic surface: wire types, the error class, and
  * pure helpers. It pulls in neither Node-only code nor React, so it is safe to

package/dist/esm/next/index.js

@@ -38,7 +38,7 @@ import { createConnectHandler } from "../server/handler.js";
  * | `CONNECT_SESSION_COOKIE` | no | session cookie name |
  *
  * Register `{your origin}/api/connect/callback` as a redirect URI in the
- * service's Integration tab. That is the only step this cannot do for you.
+ * application's Integration tab. That is the only step this cannot do for you.
  *
  * No `next.config.ts` changes needed either, including `transpilePackages`:
  * `dist/` is already ES2022 with `"use client"` hoisted to the top of every
@@ -287,7 +287,7 @@ export async function getConnectSession(request, options = {}) {
  * A thin wrapper, not a framework of its own - reach for `getConnectSession`
  * plus your own check when "not signed in" isn't "redirect to sign-in"
  * (an API route returning 401, say). Role and entitlement checks stay
- * outside this function on purpose: `session.serviceRole.granted` and
+ * outside this function on purpose: `session.applicationRole.granted` and
  * `connect.entitlements.*` are one line each on top of the session this
  * already gives you, and where that line redirects (a plans page, a
  * "forbidden" screen) is a decision only your app can make - see

package/dist/esm/server/client.js

@@ -11,7 +11,7 @@ import { AnalyticsResource } from "./resources/analytics.js";
 import { OtpResource } from "./resources/otp.js";
 import { SessionsResource } from "./resources/sessions.js";
 export const DEFAULT_BASE_URL = "https://connect.cosmoops.com";
-const SERVICE_API_PREFIX = "/api/v1/service";
+const APPLICATION_API_PREFIX = "/api/v1/application";
 /**
  * Refuses to build a client in a browser.
  *
@@ -40,9 +40,9 @@ function assertNotBrowser() {
         "in browser code instead; it talks to your own origin and holds no credential.");
 }
 /**
- * The CosmoOps Connect service-partner API.
+ * The CosmoOps Connect application-partner API.
  *
- * Covers `/api/v1/service/*` and nothing else - the surface a service platform
+ * Covers `/api/v1/application/*` and nothing else - the surface an application platform
  * integrates against. Connect's internal API is not part of this package and
  * never will be.
  *
@@ -53,7 +53,7 @@ function assertNotBrowser() {
  * });
  *
  * const session = await connect.identity.exchangeCode({ code, redirectUri });
- * const { ready } = await connect.entitlements.getReadiness(session.user.organizationId);
+ * const { ready } = await connect.entitlements.getReadiness(session.user.workspaceId);
  * ```
  *
  * Every failure throws a `ConnectError` carrying a stable `code`. Nothing here
@@ -62,27 +62,27 @@ function assertNotBrowser() {
 export class ConnectClient {
     /** "Login with Connect" - the OAuth2 handshake and the session after it. */
     identity;
-    /** What a signed-in member may do on your service. */
+    /** What a signed-in member may do on your application. */
     access;
-    /** The services an organization can open - for a launcher grid. */
+    /** The applications a workspace can open - for a launcher grid. */
     apps;
-    /** Whether a workspace may use your service, and on what plan. */
+    /** Whether a workspace may use your application, and on what plan. */
     entitlements;
     /** Your plan catalog, and metering usage against add-on balances. */
     billing;
-    /** Files in an organization's Drive. */
+    /** Files in a workspace's Drive. */
     drive;
     /** RAG chat and structured extraction. */
     ai;
     /** WhatsApp/SMS phone verification. */
     otp;
-    /** Feature events into the Console's audit log, filterable to your service. */
+    /** Feature events into the Console's audit log, filterable to your application. */
     logs;
-    /** Emit product events and read back this service's aggregated numbers. */
+    /** Emit product events and read back this application's aggregated numbers. */
     analytics;
-    /** This Connect account's own login sessions - account-wide, not scoped to this service. Requires the `sessions:manage` scope. */
+    /** This Connect account's own login sessions - account-wide, not scoped to this application. Requires the `sessions:manage` scope. */
     sessions;
-    /** Composio-hosted third-party connections (Google Calendar, Slack, ...) an organization has connected. */
+    /** Composio-hosted third-party connections (Google Calendar, Slack, ...) a workspace has connected. */
     integrations;
     constructor(options) {
         assertNotBrowser();
@@ -91,7 +91,7 @@ export class ConnectClient {
         }
         const appBaseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
         const transport = {
-            baseUrl: `${appBaseUrl}${SERVICE_API_PREFIX}`,
+            baseUrl: `${appBaseUrl}${APPLICATION_API_PREFIX}`,
             apiKey: options.apiKey,
             timeoutMs: options.timeoutMs ?? 20_000,
             maxRetries: options.maxRetries ?? 2,
@@ -99,7 +99,7 @@ export class ConnectClient {
             userAgent: `cosmoops-connect-sdk/${SDK_VERSION}`,
         };
         // `authorizeUrl` points at the app, not the API prefix - it is a browser
-        // redirect, not a service call, so identity takes both.
+        // redirect, not an application call, so identity takes both.
         this.identity = new IdentityResource(transport, options.clientId ?? null, appBaseUrl);
         this.access = new AccessResource(transport);
         this.apps = new AppsResource(transport);
@@ -115,4 +115,4 @@ export class ConnectClient {
     }
 }
 /** Kept in step with `package.json` by `sdk.test.ts`. */
-export const SDK_VERSION = "0.6.0";
+export const SDK_VERSION = "0.9.0";

package/dist/esm/server/handler.js

@@ -91,9 +91,9 @@ function redirect(location, cookies = []) {
  * export { handler as GET, handler as POST };
  * ```
  *
- * Every route resolves the organization from the caller's *own* session, never
+ * Every route resolves the workspace from the caller's *own* session, never
  * from a query parameter. A browser must not be able to ask about an
- * organization it is not signed into, and a client-supplied `organizationId`
+ * workspace it is not signed into, and a client-supplied `workspaceId`
  * is exactly that hole.
  */
 export function createConnectHandler(options) {
@@ -160,7 +160,7 @@ export function createConnectHandler(options) {
         }
         return token;
     }
-    /** Signed-in identity plus the organization it belongs to - the first read every other route needs. */
+    /** Signed-in identity plus the workspace it belongs to - the first read every other route needs. */
     async function whoami(request) {
         return client.identity.getUser(await requireToken(request));
     }
@@ -170,32 +170,75 @@ export function createConnectHandler(options) {
             // Signed out is a normal state for a page rendering a Login button, not
             // an error - `user: null` rather than a 401 the client must catch.
             if (!token)
-                return json({ user: null, subscription: null, serviceRole: null });
+                return json({ user: null, subscription: null, applicationRole: null });
             return json(await client.identity.getUser(token));
         },
         "GET /entitlements": async (request) => {
             const { user } = await whoami(request);
             const [readiness, subscription] = await Promise.all([
-                client.entitlements.getReadiness(user.organizationId),
-                client.entitlements.getSubscription(user.organizationId),
+                client.entitlements.getReadiness(user.workspaceId),
+                client.entitlements.getSubscription(user.workspaceId),
             ]);
             return json({ readiness, subscription });
         },
         "GET /plans": async () => json(await client.billing.listPlans()),
-        // Organization comes from the caller's own session, same as every other
+        // Workspace comes from the caller's own session, same as every other
         // route here - a browser must not be able to ask what another workspace
         // has left.
         "GET /addons": async (request) => {
             const { user } = await whoami(request);
-            return json(await client.billing.getAddonUsage(user.organizationId));
+            return json(await client.billing.getAddonUsage(user.workspaceId));
         },
         "GET /apps": async (request) => {
             const { user } = await whoami(request);
-            return json({ apps: await client.apps.list(user.organizationId) });
+            return json({ apps: await client.apps.list(user.workspaceId) });
+        },
+        /**
+         * Ask AI. The one streaming route here, and the only one that does not
+         * answer JSON - it forwards Connect's server-sent event stream through
+         * untouched so `<ConnectAskAi>` can render tokens as they arrive.
+         *
+         * Same rule as every other route: the workspace comes from the caller's
+         * own session. It matters more here than anywhere else, because the
+         * answers are *retrieved from that workspace's Context Index* - a
+         * client-supplied `workspaceId` would be a read of another tenant's
+         * documents, laundered through a chat reply.
+         *
+         * Messages are forwarded as-is (part-based `UIMessage`s), and only their
+         * shape is checked: the conversation is the caller's own, and Connect
+         * validates it again on arrival.
+         */
+        "POST /ai/chat": async (request) => {
+            const { user } = await whoami(request);
+            const body = (await request.json().catch(() => null));
+            if (!Array.isArray(body?.messages)) {
+                throw new ConnectError({
+                    status: 400,
+                    code: "validation_error",
+                    message: "messages is required",
+                    endpoint: "POST /ai/chat",
+                });
+            }
+            const upstream = await client.ai.chat({
+                workspaceId: user.workspaceId,
+                messages: body.messages,
+            });
+            // `upstream.body` is piped, never buffered - awaiting it would collect
+            // the whole answer server-side and deliver it in one lump, which is the
+            // only thing streaming was for. The browser cancelling its read
+            // propagates down this pipe and stops generation upstream.
+            return new Response(upstream.body, {
+                status: upstream.status,
+                headers: {
+                    "content-type": upstream.headers.get("content-type") ?? "text/event-stream",
+                    "cache-control": "no-store",
+                    "x-content-type-options": "nosniff",
+                },
+            });
         },
         "GET /integrations": async (request) => {
             const { user } = await whoami(request);
-            return json({ toolkits: await client.integrations.list(user.organizationId) });
+            return json({ toolkits: await client.integrations.list(user.workspaceId) });
         },
         "POST /integrations/connect": async (request) => {
             const { user } = await whoami(request);
@@ -208,7 +251,7 @@ export function createConnectHandler(options) {
                     endpoint: "POST /integrations/connect",
                 });
             }
-            return json(await client.integrations.initiateConnect(user.organizationId, body.toolkitSlug, body.returnUrl));
+            return json(await client.integrations.initiateConnect(user.workspaceId, body.toolkitSlug, body.returnUrl));
         },
         "POST /integrations/disconnect": async (request) => {
             const { user } = await whoami(request);
@@ -221,10 +264,10 @@ export function createConnectHandler(options) {
                     endpoint: "POST /integrations/disconnect",
                 });
             }
-            await client.integrations.disconnect(user.organizationId, body.toolkitSlug);
+            await client.integrations.disconnect(user.workspaceId, body.toolkitSlug);
             return json({ ok: true });
         },
-        // Account-wide, not scoped to this service - see `SessionsResource`'s
+        // Account-wide, not scoped to this application - see `SessionsResource`'s
         // doc comment. `requireToken` alone identifies the caller; the target
         // `sessionId` on the revoke routes travels in the JSON body, not the
         // URL, so the exact-match routes table above never needs a dynamic