@cosmoops/connect-sdk 0.7.0 → 0.9.0

package/dist/cjs/client/provider.js

@@ -5,6 +5,8 @@ exports.CONNECT_APP_URL = void 0;
 exports.ConnectProvider = ConnectProvider;
 exports.useConnect = useConnect;
 exports.useConnectUser = useConnectUser;
+exports.useConnectWorkspaceType = useConnectWorkspaceType;
+exports.useConnectAudience = useConnectAudience;
 exports.useConnectEntitlements = useConnectEntitlements;
 exports.useConnectAddonUsage = useConnectAddonUsage;
 exports.useConnectPlans = useConnectPlans;
@@ -124,6 +126,20 @@ function ConnectProvider({ clientId = "", basePath = "/api/connect", redirectUri
     const invalidateResource = (0, react_1.useCallback)((path) => {
         cache.current.delete(`${basePath}${path}`);
     }, [basePath]);
+    const streamResource = (0, react_1.useCallback)(async (path, body, options) => {
+        const response = await (fetchImpl ?? globalThis.fetch)(`${basePath}${path}`, {
+            method: "POST",
+            credentials: "same-origin",
+            headers: { accept: "text/event-stream", "content-type": "application/json" },
+            body: JSON.stringify(body),
+            signal: options?.signal,
+        });
+        if (!response.ok) {
+            const envelope = await response.json().catch(() => null);
+            throw new Error(envelope?.error?.message ?? `Connect bridge returned ${response.status}`);
+        }
+        return response;
+    }, [basePath, fetchImpl]);
     const refresh = (0, react_1.useCallback)(async () => {
         cache.current.clear();
         try {
@@ -135,7 +151,7 @@ function ConnectProvider({ clientId = "", basePath = "/api/connect", redirectUri
             // error, so a Login button still renders rather than the UI hanging on
             // skeletons forever.
             setResult({
-                session: { user: null, subscription: null, applicationRole: null },
+                session: { user: null, subscription: null, applicationRole: null, audience: null },
                 error: cause instanceof Error ? cause.message : "Could not reach Connect",
             });
         }
@@ -184,7 +200,7 @@ function ConnectProvider({ clientId = "", basePath = "/api/connect", redirectUri
             credentials: "same-origin",
         }).catch(() => { });
         cache.current.clear();
-        setResult({ session: { user: null, subscription: null, applicationRole: null }, error: null });
+        setResult({ session: { user: null, subscription: null, applicationRole: null, audience: null }, error: null });
     }, [basePath, fetchImpl]);
     const value = (0, react_1.useMemo)(() => ({
         clientId,
@@ -198,6 +214,7 @@ function ConnectProvider({ clientId = "", basePath = "/api/connect", redirectUri
         fetchResource,
         mutateResource,
         invalidateResource,
+        streamResource,
     }), [
         clientId,
         appUrl,
@@ -210,6 +227,7 @@ function ConnectProvider({ clientId = "", basePath = "/api/connect", redirectUri
         fetchResource,
         mutateResource,
         invalidateResource,
+        streamResource,
     ]);
     return (0, jsx_runtime_1.jsx)(ConnectContext.Provider, { value: value, children: children });
 }
@@ -224,6 +242,31 @@ function useConnect() {
 function useConnectUser() {
     return useConnect().session?.user ?? null;
 }
+/**
+ * Whether the signed-in workspace is a one-seat personal account or a team -
+ * `null` while the session is loading or signed out.
+ *
+ * Branch on this to stop rendering team UI at a solo account: a members
+ * table, an invite button and a seat meter are all dead controls on an
+ * `"individual"` workspace, which has exactly one seat and cannot gain
+ * another. `<ConnectWorkspaceTypeGate>` is the declarative form.
+ */
+function useConnectWorkspaceType() {
+    return useConnect().session?.user?.workspaceType ?? null;
+}
+/**
+ * Whether this account is the kind your application is sold to - `null` while
+ * the session is loading or signed out.
+ *
+ * `audience.matches === false` is a hard block, not a hint: readiness reports
+ * `audience_mismatch` and subscribing is refused. `<ConnectAccessGate>`
+ * already blocks the shell on it, so reach for this only when you need the
+ * verdict somewhere the gate does not run - a marketing page, say, or a
+ * sign-up CTA you would rather not show to an account that cannot complete it.
+ */
+function useConnectAudience() {
+    return useConnect().session?.audience ?? null;
+}
 /** Readiness gates and the live subscription, fetched on first use. */
 function useConnectEntitlements() {
     return useConnectResource("/entitlements");

package/dist/cjs/server/client.js

@@ -119,4 +119,4 @@ class ConnectClient {
 }
 exports.ConnectClient = ConnectClient;
 /** Kept in step with `package.json` by `sdk.test.ts`. */
-exports.SDK_VERSION = "0.7.0";
+exports.SDK_VERSION = "0.9.0";

package/dist/cjs/server/handler.js

@@ -196,6 +196,49 @@ function createConnectHandler(options) {
             const { user } = await whoami(request);
             return json({ apps: await client.apps.list(user.workspaceId) });
         },
+        /**
+         * Ask AI. The one streaming route here, and the only one that does not
+         * answer JSON - it forwards Connect's server-sent event stream through
+         * untouched so `<ConnectAskAi>` can render tokens as they arrive.
+         *
+         * Same rule as every other route: the workspace comes from the caller's
+         * own session. It matters more here than anywhere else, because the
+         * answers are *retrieved from that workspace's Context Index* - a
+         * client-supplied `workspaceId` would be a read of another tenant's
+         * documents, laundered through a chat reply.
+         *
+         * Messages are forwarded as-is (part-based `UIMessage`s), and only their
+         * shape is checked: the conversation is the caller's own, and Connect
+         * validates it again on arrival.
+         */
+        "POST /ai/chat": async (request) => {
+            const { user } = await whoami(request);
+            const body = (await request.json().catch(() => null));
+            if (!Array.isArray(body?.messages)) {
+                throw new errors_js_1.ConnectError({
+                    status: 400,
+                    code: "validation_error",
+                    message: "messages is required",
+                    endpoint: "POST /ai/chat",
+                });
+            }
+            const upstream = await client.ai.chat({
+                workspaceId: user.workspaceId,
+                messages: body.messages,
+            });
+            // `upstream.body` is piped, never buffered - awaiting it would collect
+            // the whole answer server-side and deliver it in one lump, which is the
+            // only thing streaming was for. The browser cancelling its read
+            // propagates down this pipe and stops generation upstream.
+            return new Response(upstream.body, {
+                status: upstream.status,
+                headers: {
+                    "content-type": upstream.headers.get("content-type") ?? "text/event-stream",
+                    "cache-control": "no-store",
+                    "x-content-type-options": "nosniff",
+                },
+            });
+        },
         "GET /integrations": async (request) => {
             const { user } = await whoami(request);
             return json({ toolkits: await client.integrations.list(user.workspaceId) });

package/dist/cjs/server/http.js

@@ -128,33 +128,55 @@ async function request(options, spec) {
             // request for minutes.
             await sleep(Math.min(lastError?.retryAfterMs ?? 250 * 2 ** (attempt - 1), 8_000));
         }
-        const timeout = AbortSignal.timeout(options.timeoutMs);
-        const signal = spec.signal ? AbortSignal.any([spec.signal, timeout]) : timeout;
-        let response;
+        // A cancellable timer rather than `AbortSignal.timeout`, because the
+        // timeout has to be *stopped* once this attempt is done reading - and a
+        // timeout signal cannot be cleared.
+        //
+        // That distinction is the whole point for a streaming endpoint. `fetch`
+        // resolves the moment the headers land, but its signal keeps governing
+        // the body: an `AbortSignal.timeout(20_000)` handed to `ai.chat` tears the
+        // SSE stream down mid-answer, twenty seconds in, on every conversation
+        // long enough to matter. Clearing the timer in `finally` bounds the
+        // request the same way it always did (a `raw` caller still gets its
+        // timeout on *reaching* Connect, and a JSON caller still gets it across
+        // the body read, which happens inside the `try`) while leaving a stream
+        // that has actually started to run as long as it needs. A caller that
+        // wants to bound the stream itself passes `spec.signal`.
+        const timeoutController = new AbortController();
+        const timer = setTimeout(() => timeoutController.abort(), options.timeoutMs);
+        const signal = spec.signal
+            ? AbortSignal.any([spec.signal, timeoutController.signal])
+            : timeoutController.signal;
         try {
-            response = await options.fetch(url.toString(), { method: spec.method, headers, body, signal });
+            let response;
+            try {
+                response = await options.fetch(url.toString(), { method: spec.method, headers, body, signal });
+            }
+            catch (cause) {
+                // A caller-supplied abort is a decision, not a fault - never retried.
+                if (spec.signal?.aborted)
+                    throw cause;
+                lastError = new errors_js_1.ConnectError({
+                    status: 0,
+                    code: "network_error",
+                    message: `${endpoint} could not reach Connect`,
+                    endpoint,
+                    cause,
+                });
+                continue;
+            }
+            if (response.ok) {
+                if (spec.raw)
+                    return response;
+                return (await readBody(response));
+            }
+            lastError = toConnectError(response, await readBody(response), endpoint);
+            if (!RETRYABLE_STATUS.has(response.status))
+                throw lastError;
         }
-        catch (cause) {
-            // A caller-supplied abort is a decision, not a fault - never retried.
-            if (spec.signal?.aborted)
-                throw cause;
-            lastError = new errors_js_1.ConnectError({
-                status: 0,
-                code: "network_error",
-                message: `${endpoint} could not reach Connect`,
-                endpoint,
-                cause,
-            });
-            continue;
+        finally {
+            clearTimeout(timer);
         }
-        if (response.ok) {
-            if (spec.raw)
-                return response;
-            return (await readBody(response));
-        }
-        lastError = toConnectError(response, await readBody(response), endpoint);
-        if (!RETRYABLE_STATUS.has(response.status))
-            throw lastError;
     }
     throw lastError;
 }

package/dist/cjs/server/resources/entitlements.js

@@ -45,5 +45,46 @@ class EntitlementsResource {
         const result = await this.getSubscription(workspaceId);
         return result.hasActiveSubscription && (result.plan?.features.includes(feature) ?? false);
     }
+    /**
+     * One page of the workspaces subscribed to your application, newest first.
+     *
+     * The inverse of `getSubscription`, which asks about one workspace you
+     * already know. This asks who your subscribers *are* - what a partner
+     * dashboard, an MRR total or a churn report is built on.
+     *
+     * Rate-limited far more tightly than the per-workspace read (10/min per
+     * key, against 60): it walks your whole subscriber base and is a reporting
+     * call, not a per-request gate. Use `getSubscription` in a hot path.
+     *
+     * Your application is resolved from the API key, so there is no parameter
+     * for it and no way to ask about anyone else's.
+     */
+    listSubscribers(options = {}) {
+        return (0, http_js_1.request)(this.transport, {
+            method: "GET",
+            path: "/subscriptions",
+            query: { status: options.status, before: options.before, limit: options.limit },
+        });
+    }
+    /**
+     * Every subscriber, paged through for you.
+     *
+     * An async generator rather than an array: a large subscriber base is
+     * exactly where an accidental full materialisation hurts, and `for await`
+     * reads the same as a loop over one page.
+     */
+    async *iterateSubscribers(options = {}) {
+        let before;
+        do {
+            const page = await this.listSubscribers({
+                status: options.status,
+                limit: options.pageSize,
+                before,
+            });
+            for (const item of page.items)
+                yield item;
+            before = page.nextBefore ?? undefined;
+        } while (before);
+    }
 }
 exports.EntitlementsResource = EntitlementsResource;

package/dist/cjs/server/resources/identity.js

@@ -71,6 +71,7 @@ class IdentityResource {
             user: wire.user,
             subscription: wire.subscription,
             applicationRole: wire.applicationRole,
+            audience: wire.audience,
         };
     }
     /**
@@ -141,6 +142,7 @@ class IdentityResource {
             user: wire.user,
             subscription: wire.subscription,
             applicationRole: wire.applicationRole,
+            audience: wire.audience,
             sessionExpiresAt: wire.session_expires_at,
         };
     }

package/dist/esm/client/components/access-gate.js

@@ -1,7 +1,7 @@
 "use client";
 import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 import { useState } from "react";
-import { Ban, AlertTriangle, Clock, CreditCard, ExternalLink, X } from "lucide-react";
+import { Ban, AlertTriangle, Building2, Clock, CreditCard, ExternalLink, User, X } from "lucide-react";
 import { Button, Card, Skeleton } from "@heroui/react";
 import { blockingBlockers } from "../../helpers.js";
 import { useConnect, useConnectEntitlements } from "../provider.js";
@@ -21,9 +21,17 @@ function formatDate(iso) {
  * `ConnectReadinessGate`/`ConnectReadinessBanner` already use. `ConnectAccessGate`
  * is a priority ordering over the same data, not a second opinion about it.
  *
- * Priority, first match wins: `suspended` > `no_subscription` >
- * `onboarding_pending` > any other blocking code (`blocked`) >
- * `payment_retry` (advisory - `children` still render) > `clear`.
+ * Priority, first match wins: `suspended` > `audience_mismatch` >
+ * `no_subscription` > `onboarding_pending` > any other blocking code
+ * (`blocked`) > `payment_retry` (advisory - `children` still render) >
+ * `clear`.
+ *
+ * `audience_mismatch` outranks `no_subscription` deliberately, and the
+ * ordering is the whole point of it: a workspace of the wrong account type
+ * carries BOTH blockers at once, and showing the subscription one first sent
+ * the customer to a plan picker whose subscribe call
+ * (`ActivateSubscriptionUseCase`) rejects them for the audience anyway. The
+ * account type is the reason; the missing subscription is a consequence.
  */
 export function useConnectAccessGate() {
     const { session, isLoading: sessionLoading } = useConnect();
@@ -46,6 +54,10 @@ export function useConnectAccessGate() {
     const suspended = blocking.find((b) => b.code === "workspace_suspended");
     if (suspended)
         return { state: "suspended", blocker: suspended, paymentRetry: null };
+    const audienceMismatch = blocking.find((b) => b.code === "audience_mismatch");
+    if (audienceMismatch) {
+        return { state: "audience_mismatch", blocker: audienceMismatch, paymentRetry: null };
+    }
     const noSubscription = blocking.find((b) => b.code === "subscription_missing");
     if (noSubscription)
         return { state: "no_subscription", blocker: noSubscription, paymentRetry: null };
@@ -105,6 +117,29 @@ export function ConnectAccessGate({ children, fallback, loading, className }) {
     return (_jsx(_Fragment, { children: fallback ?? _jsx(AccessGateFallback, { state: gate.state, blocker: gate.blocker, className: className }) }));
 }
 function AccessGateFallback({ state, blocker, className, }) {
+    if (state === "audience_mismatch") {
+        // `requiredWorkspaceType` rather than the message, which is documented as
+        // human-facing and subject to rewording - the title has to name the right
+        // account type even after someone rephrases the sentence below it.
+        const required = blocker?.requiredWorkspaceType ?? null;
+        return (_jsx(GateCard, { icon: required === "individual" ? User : Building2, iconClassName: "text-muted", title: required === "business"
+                ? "Business account required"
+                : required === "individual"
+                    ? "Individual account required"
+                    : "Not available for this account type", 
+            // The server names the application in its own message, which reads
+            // better than anything composable here; the fallback covers a blocker
+            // that arrived without one.
+            message: blocker?.message ??
+                (required
+                    ? `This application is only available to ${required} accounts.`
+                    : "This application isn't available to this account's type."), 
+            // Deliberately no action, even if one were sent: `Workspace.type` is
+            // set at sign-up and no screen changes it, so any button here would
+            // only move the dead end somewhere else. Switching means a different
+            // account, which is a conversation with support, not a link.
+            resolveUrl: null, className: className }));
+    }
     if (state === "no_subscription") {
         return (_jsx(GateCard, { icon: CreditCard, iconClassName: "text-accent", title: "Choose a plan to continue", message: blocker?.message ?? "This workspace isn't subscribed to this application yet.", actionLabel: "See plans", resolveUrl: blocker?.resolveUrl ?? null, className: className }));
     }
@@ -114,7 +149,7 @@ function AccessGateFallback({ state, blocker, className, }) {
     if (state === "onboarding_pending") {
         return (_jsx(GateCard, { icon: Clock, iconClassName: "text-muted", title: "Waiting on approval", message: blocker?.message ?? "This workspace is waiting on approval before it can use this application.", resolveUrl: null, className: className }));
     }
-    // "blocked" - any other blocking code (verification, audience, seats, ...).
+    // "blocked" - any other blocking code (verification, seats, ...).
     // Full fidelity for a code this component doesn't special-case: the same
     // banner-in-a-card `ConnectReadinessGate` falls back to, rather than
     // `GateCard`'s single-blocker shape - there can be more than one of these

package/dist/esm/client/components/ai-format.js

@@ -0,0 +1,129 @@
+/**
+ * The one place a model-supplied value becomes a string.
+ *
+ * Ask AI's presentation tools send raw values with a `format` tag beside them
+ * rather than pre-formatted strings (see `AiValueFormat`), and this is the half
+ * that makes that worth doing: an amount renders in the viewer's own locale, a
+ * table sorts numerically, and the same figure reads identically on a chart
+ * axis, in a tooltip and in a metric tile.
+ *
+ * Every branch is total. A value that cannot be formatted the way it was
+ * tagged - a `date` that is not a date, a `currency` that is not a number -
+ * falls back to its plain string rather than throwing inside a render.
+ */
+/** Renders in place of a missing value - an em dash, not the word "null". */
+export const AI_EMPTY_VALUE = "—";
+const NUMBER = new Intl.NumberFormat("en-IN");
+const PERCENT = new Intl.NumberFormat("en-IN", { style: "percent", maximumFractionDigits: 1 });
+/**
+ * Rupees, not paise - the tool contract says so, because the model is emitting
+ * a figure a person would say out loud. `formatPrice` in `plan-pricing.ts` is
+ * the paise-denominated twin, for amounts that came out of Connect's billing.
+ */
+const CURRENCY = new Intl.NumberFormat("en-IN", {
+    style: "currency",
+    currency: "INR",
+    maximumFractionDigits: 2,
+});
+const DATE = new Intl.DateTimeFormat("en-IN", { day: "numeric", month: "short", year: "numeric" });
+const DATE_TIME = new Intl.DateTimeFormat("en-IN", {
+    day: "numeric",
+    month: "short",
+    year: "numeric",
+    hour: "numeric",
+    minute: "2-digit",
+});
+function formatBytes(bytes) {
+    const units = ["B", "KB", "MB", "GB", "TB"];
+    let value = bytes;
+    let unit = 0;
+    while (value >= 1024 && unit < units.length - 1) {
+        value /= 1024;
+        unit++;
+    }
+    return `${value >= 10 || unit === 0 ? Math.round(value) : value.toFixed(1)} ${units[unit]}`;
+}
+function formatDuration(seconds) {
+    if (seconds < 60)
+        return `${Math.round(seconds)}s`;
+    const minutes = Math.floor(seconds / 60);
+    if (minutes < 60)
+        return `${minutes}m`;
+    const hours = Math.floor(minutes / 60);
+    const remainder = minutes % 60;
+    if (hours < 24)
+        return remainder ? `${hours}h ${remainder}m` : `${hours}h`;
+    return `${Math.floor(hours / 24)}d ${hours % 24}h`;
+}
+function asDate(value) {
+    if (typeof value !== "string" && typeof value !== "number")
+        return null;
+    const date = new Date(value);
+    return Number.isNaN(date.getTime()) ? null : date;
+}
+export function formatAiValue(value, format = "text") {
+    if (value === null || value === undefined || value === "")
+        return AI_EMPTY_VALUE;
+    switch (format) {
+        case "number":
+            return typeof value === "number" ? NUMBER.format(value) : String(value);
+        case "currency":
+            return typeof value === "number" ? CURRENCY.format(value) : String(value);
+        case "percent":
+            return typeof value === "number" ? PERCENT.format(value) : String(value);
+        case "bytes":
+            return typeof value === "number" ? formatBytes(value) : String(value);
+        case "duration":
+            return typeof value === "number" ? formatDuration(value) : String(value);
+        case "date": {
+            const date = asDate(value);
+            return date ? DATE.format(date) : String(value);
+        }
+        case "datetime": {
+            const date = asDate(value);
+            return date ? DATE_TIME.format(date) : String(value);
+        }
+        default:
+            return String(value);
+    }
+}
+/** Numeric columns read far better right-aligned; everything else stays with the text. */
+export function isNumericAiFormat(format = "text") {
+    return (format === "number" ||
+        format === "currency" ||
+        format === "percent" ||
+        format === "bytes" ||
+        format === "duration");
+}
+/**
+ * A status word to a tone. A small keyword list rather than an enum on the
+ * wire, because the model names states from the partner's own domain
+ * ("provisioning", "in transit") - and anything unrecognised is neutral, which
+ * is the right answer for a word nobody can interpret.
+ */
+const POSITIVE = new Set(["active", "paid", "succeeded", "success", "complete", "completed", "approved", "healthy", "live", "enabled", "delivered", "on", "yes"]);
+const WARNING = new Set(["pending", "processing", "trialing", "trial", "grace", "review", "queued", "partial", "draft", "in_transit"]);
+const DANGER = new Set(["failed", "error", "overdue", "suspended", "cancelled", "canceled", "rejected", "expired", "past_due", "blocked", "disabled", "off"]);
+export function aiStatusTone(value) {
+    const word = String(value ?? "").trim().toLowerCase().replace(/\s+/g, "_");
+    if (POSITIVE.has(word))
+        return "positive";
+    if (WARNING.has(word))
+        return "warning";
+    if (DANGER.has(word))
+        return "danger";
+    return "neutral";
+}
+/** HeroUI semantic tokens only, so these inherit whatever theme the host defined. */
+export const AI_TONE_CHIP = {
+    neutral: "bg-surface-tertiary text-foreground",
+    positive: "bg-success/15 text-success",
+    warning: "bg-warning/20 text-warning",
+    danger: "bg-danger/15 text-danger",
+};
+export const AI_TONE_DOT = {
+    neutral: "bg-muted",
+    positive: "bg-success",
+    warning: "bg-warning",
+    danger: "bg-danger",
+};