@cosmoops/connect-sdk 0.7.0 → 0.9.0

package/dist/esm/client/components/side-nav.js

@@ -34,7 +34,7 @@ function NavRow({ item, isActive, hasActiveChild, collapsed, depth, renderLink,
  * The sidebar's nav column on its own - sections, items, one level of
  * children, and the active highlight.
  *
- * `ConnectAppShell` renders this inside its rail and its mobile drawer, and it
+ * `AppShell` renders this inside its rail and its mobile drawer, and it
  * is exported for a host that wants the shell's navigation without its
  * chrome: the same items, the same active resolution, dropped into a layout
  * you already have.

package/dist/esm/client/components/user-menu.js

@@ -19,6 +19,28 @@ function initials(name, email) {
 function openExternal(url) {
     window.open(url, "_blank", "noopener,noreferrer");
 }
+/**
+ * Connect's profile page, with the context it needs to offer a way back here.
+ *
+ * Connect answers `/profile` for any signed-in user, so the bare URL works on
+ * its own - these two params only add the "Back to <your app>" banner. It
+ * validates `return_to` against this `client_id`'s registered redirect
+ * origins and silently drops the banner if they don't match, so a wrong or
+ * stale `appUrl`/`clientId` pairing degrades to what it did before rather
+ * than erroring.
+ *
+ * `window.location.href` rather than a configured home URL: the point is to
+ * come back to the page they left, and only the browser knows which one that
+ * is.
+ */
+function profileUrl(appUrl, clientId) {
+    const url = new URL("/profile", appUrl);
+    url.searchParams.set("client_id", clientId);
+    if (typeof window !== "undefined") {
+        url.searchParams.set("return_to", window.location.href);
+    }
+    return url.toString();
+}
 /**
  * The member's photo, with their initials underneath it.
  *
@@ -114,7 +136,7 @@ function DestinationTile({ icon, label, url, }) {
  * the modal programmatically; sign-out uses `slot="close"` instead.
  */
 export function ConnectUserMenu({ compact = false, onSignOut, className, theme, onThemeChange, }) {
-    const { session, isLoading, signOut, appUrl } = useConnect();
+    const { session, isLoading, signOut, appUrl, clientId } = useConnect();
     if (isLoading) {
         return (_jsxs("div", { className: `flex items-center gap-2 ${className ?? ""}`, children: [_jsx(Skeleton, { className: "size-8 shrink-0 rounded-full" }), !compact && _jsx(Skeleton, { className: "h-4 w-24" })] }));
     }
@@ -128,7 +150,7 @@ export function ConnectUserMenu({ compact = false, onSignOut, className, theme,
                 // `pl-1` against the default right padding is optical, not sloppy: a
                 // circular avatar needs less inset than a text label to look evenly
                 // seated in the button.
-                className: `gap-2 pl-1 ${className ?? ""}`, children: [_jsx(UserAvatar, { user: user, size: "sm" }), !compact && _jsx("span", { className: "text-sm font-medium text-foreground", children: label })] }), _jsx(Modal.Backdrop, { children: _jsx(Modal.Container, { size: "md", scroll: "inside", children: _jsxs(Modal.Dialog, { children: [_jsx(Modal.CloseTrigger, {}), _jsx(Modal.Header, { children: _jsx(Modal.Heading, { children: "Account" }) }), _jsxs(Modal.Body, { className: "flex flex-col gap-5", children: [_jsxs("div", { className: `flex items-start gap-3 rounded-xl border border-border ${PANEL_FILL} p-4`, children: [_jsx(UserAvatar, { user: user, size: "lg" }), _jsxs("div", { className: "flex min-w-0 flex-1 flex-col gap-0.5", children: [_jsx("p", { className: "truncate text-sm font-semibold text-foreground", children: label }), user.email && _jsx("p", { className: "truncate text-xs text-muted", children: user.email }), _jsx("p", { className: "truncate text-xs text-muted", children: user.workspaceName }), (role || planChip || !user.emailVerified) && (_jsxs("div", { className: "mt-1.5 flex flex-wrap items-center gap-1.5", children: [role && (_jsx(Chip, { size: "sm", variant: "soft", color: "accent", children: humanizeRole(role) })), planChip, !user.emailVerified && (_jsx(Chip, { size: "sm", variant: "soft", color: "warning", children: "Email unverified" }))] }))] })] }), _jsxs("div", { className: "grid grid-cols-3 gap-2", children: [_jsx(DestinationTile, { icon: _jsx(UserRound, { className: ICON, "aria-hidden": "true" }), label: "Profile", url: `${appUrl}/profile` }), _jsx(DestinationTile, { icon: _jsx(CreditCard, { className: ICON, "aria-hidden": "true" }), label: "Billing", url: `${appUrl}/billing` }), _jsx(DestinationTile, { icon: _jsx(ConnectMark, { className: ICON }), label: "Connect", url: appUrl })] }), theme && onThemeChange && (_jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("p", { className: "text-sm font-medium text-foreground", children: "Appearance" }), _jsx(ToggleButtonGroup, { fullWidth: true, "aria-label": "Theme", selectionMode: "single", disallowEmptySelection: true, selectedKeys: [theme], onSelectionChange: (keys) => {
+                className: `gap-2 pl-1 ${className ?? ""}`, children: [_jsx(UserAvatar, { user: user, size: "sm" }), !compact && _jsx("span", { className: "text-sm font-medium text-foreground", children: label })] }), _jsx(Modal.Backdrop, { children: _jsx(Modal.Container, { size: "md", scroll: "inside", children: _jsxs(Modal.Dialog, { children: [_jsx(Modal.CloseTrigger, {}), _jsx(Modal.Header, { children: _jsx(Modal.Heading, { children: "Account" }) }), _jsxs(Modal.Body, { className: "flex flex-col gap-5", children: [_jsxs("div", { className: `flex items-start gap-3 rounded-xl border border-border ${PANEL_FILL} p-4`, children: [_jsx(UserAvatar, { user: user, size: "lg" }), _jsxs("div", { className: "flex min-w-0 flex-1 flex-col gap-0.5", children: [_jsx("p", { className: "truncate text-sm font-semibold text-foreground", children: label }), user.email && _jsx("p", { className: "truncate text-xs text-muted", children: user.email }), _jsx("p", { className: "truncate text-xs text-muted", children: user.workspaceName }), (role || planChip || !user.emailVerified) && (_jsxs("div", { className: "mt-1.5 flex flex-wrap items-center gap-1.5", children: [role && (_jsx(Chip, { size: "sm", variant: "soft", color: "accent", children: humanizeRole(role) })), planChip, !user.emailVerified && (_jsx(Chip, { size: "sm", variant: "soft", color: "warning", children: "Email unverified" }))] }))] })] }), _jsxs("div", { className: "grid grid-cols-3 gap-2", children: [_jsx(DestinationTile, { icon: _jsx(UserRound, { className: ICON, "aria-hidden": "true" }), label: "Profile", url: profileUrl(appUrl, clientId) }), _jsx(DestinationTile, { icon: _jsx(CreditCard, { className: ICON, "aria-hidden": "true" }), label: "Billing", url: `${appUrl}/billing` }), _jsx(DestinationTile, { icon: _jsx(ConnectMark, { className: ICON }), label: "Connect", url: appUrl })] }), theme && onThemeChange && (_jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("p", { className: "text-sm font-medium text-foreground", children: "Appearance" }), _jsx(ToggleButtonGroup, { fullWidth: true, "aria-label": "Theme", selectionMode: "single", disallowEmptySelection: true, selectedKeys: [theme], onSelectionChange: (keys) => {
                                                     const [next] = [...keys];
                                                     if (typeof next === "string")
                                                         onThemeChange(next);
@@ -167,13 +189,14 @@ export function ConnectInvoicesButton({ className }) {
  * `ConnectHomeButton`.
  *
  * It was reachable only from inside `ConnectUserMenu`, which meant an app that
- * builds its own account menu had to hardcode `${appUrl}/profile` to offer it.
+ * builds its own account menu had to hardcode `${appUrl}/profile` to offer it -
+ * and got no `return_to`, so the user had no way back.
  */
 export function ConnectProfileButton({ className }) {
-    const { session, appUrl } = useConnect();
+    const { session, appUrl, clientId } = useConnect();
     if (!session?.user)
         return null;
-    return (_jsxs(Button, { variant: "tertiary", className: className, onPress: () => openExternal(`${appUrl}/profile`), children: [_jsx(UserRound, { className: "size-4 shrink-0" }), "Profile", _jsx(ExternalLink, { className: "size-3.5 shrink-0 text-muted" })] }));
+    return (_jsxs(Button, { variant: "tertiary", className: className, onPress: () => openExternal(profileUrl(appUrl, clientId)), children: [_jsx(UserRound, { className: "size-4 shrink-0" }), "Profile", _jsx(ExternalLink, { className: "size-3.5 shrink-0 text-muted" })] }));
 }
 /** A plain "Open Connect" button, for a footer or a help menu. */
 export function ConnectHomeButton({ className }) {

package/dist/esm/client/components/workspace-type-gate.js

@@ -0,0 +1,45 @@
+"use client";
+import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
+import { useConnect } from "../provider.js";
+/**
+ * Renders `children` only for a workspace of the given type.
+ *
+ * ```tsx
+ * <ConnectWorkspaceTypeGate type="business">
+ *   <TeamMembersTable />
+ * </ConnectWorkspaceTypeGate>
+ * ```
+ *
+ * The point is dead controls, not access: an `"individual"` workspace has
+ * exactly one seat and can never have another, so a members table, an invite
+ * button and a seat meter are all things that can only ever fail there.
+ * Hiding them is a better answer than letting someone press one and read an
+ * error about an account shape they did not choose.
+ *
+ * This is emphatically **not** the audience gate. It does not know what your
+ * application is sold to and will happily render a business-only subtree to a
+ * business workspace that has no business being in your application at all -
+ * that is `<ConnectAccessGate>`'s job, off the `audience_mismatch` readiness
+ * blocker. Use this one *inside* an application both audiences can reach, to
+ * vary what each sees.
+ *
+ * Like every gate in this package it is a **UX gate, not a security
+ * boundary**: the browser can ignore it. Anything that must not happen for an
+ * individual workspace has to be refused on your server too.
+ *
+ * Renders `loading` - not `fallback` - while the session is unknown, so a
+ * business account never flickers through the individual-account layout.
+ */
+export function ConnectWorkspaceTypeGate({ type, children, fallback = null, loading = null, }) {
+    const { session, isLoading } = useConnect();
+    const workspaceType = session?.user?.workspaceType ?? null;
+    if (isLoading)
+        return _jsx(_Fragment, { children: loading });
+    // Signed out is not "the other type" - there is no workspace to be a type
+    // of yet, and rendering the fallback here would put an individual-account
+    // layout in front of a visitor who has not signed in.
+    if (!workspaceType)
+        return _jsx(_Fragment, { children: loading });
+    const accepted = Array.isArray(type) ? type : [type];
+    return _jsx(_Fragment, { children: accepted.includes(workspaceType) ? children : fallback });
+}

package/dist/esm/client/index.js

@@ -11,7 +11,7 @@
  * whatever theme the host application platform already configured, and one theme
  * change lands identically in all of them.
  */
-export { ConnectProvider, useConnect, useConnectUser, useConnectEntitlements, useConnectPlans, useConnectApps, useConnectAddonUsage, useConnectSessions, useConnectIntegrations, useConnectResource, CONNECT_APP_URL, } from "./provider.js";
+export { ConnectProvider, useConnect, useConnectUser, useConnectWorkspaceType, useConnectAudience, useConnectEntitlements, useConnectPlans, useConnectApps, useConnectAddonUsage, useConnectSessions, useConnectIntegrations, useConnectResource, CONNECT_APP_URL, } from "./provider.js";
 // Re-exported from the root entry rather than kept there alone: it is a pure
 // helper, but every caller is UI code, and making a component file reach two
 // entry points for one function is friction with nothing behind it.
@@ -28,7 +28,7 @@ export { ConnectAccountSessions } from "./components/account-sessions.js";
 // pieces it composes rather than in a section of its own - an integration
 // reaching for a sidebar wants to find the launcher and the account menu in
 // the same breath, since the shell already mounts both.
-export { ConnectAppShell } from "./components/app-shell.js";
+export { AppShell } from "./components/app-shell.js";
 export { ConnectSideNav } from "./components/side-nav.js";
 export { useActivePath } from "./use-active-path.js";
 // The nav model is plain data and pure functions - a host generating its nav
@@ -37,6 +37,16 @@ export { useActivePath } from "./use-active-path.js";
 // page title derived from it cannot disagree with the rail.
 export { normalizeNav, flattenNav, normalizePath, resolveActivePath, isNavItemActive, gateExemptPaths, } from "./components/nav.js";
 export { ConnectAppsGrid } from "./components/apps-grid.js";
+// `AppShell askAi` mounts this; exported for an app that wants the panel
+// without the frame, or wants it somewhere other than the shell's flex row
+// (at which point it overlays rather than pushes - see its doc comment).
+export { ConnectAskAi } from "./components/ask-ai.js";
+// The seven widgets an Ask AI answer can draw, and the formatter they share -
+// exported so a partner rendering Connect's chat somewhere else entirely (a
+// support console, an embedded assistant) gets the same table, chart and metric
+// tiles rather than reimplementing them from the wire types.
+export { AiTable, AiChart, AiMetrics, AiTimeline, AiDetails, AiSteps, AiSources, } from "./components/ai-widgets.js";
+export { formatAiValue, isNumericAiFormat, aiStatusTone, AI_EMPTY_VALUE, AI_TONE_CHIP, AI_TONE_DOT, } from "./components/ai-format.js";
 export { ConnectIntegrationsModal } from "./components/integrations-modal.js";
 export { ConnectPlans } from "./components/plans.js";
 export { ConnectSubscribeDialog } from "./components/subscribe-dialog.js";
@@ -49,6 +59,7 @@ export { ConnectSubscriptionGate, ConnectNoSubscriptionCard, ConnectSubscription
 export { ConnectReadinessBanner, ConnectReadinessGate } from "./components/readiness.js";
 export { ConnectAccessGate, useConnectAccessGate } from "./components/access-gate.js";
 export { ConnectFeatureGate, useConnectFeature } from "./components/feature-gate.js";
+export { ConnectWorkspaceTypeGate } from "./components/workspace-type-gate.js";
 export { ConnectUsageMeter } from "./components/usage-meter.js";
 export { ConnectPlansPage } from "./components/plans-page.js";
 export { useConnectCheckout, buildCheckoutUrl } from "./use-checkout.js";

package/dist/esm/client/provider.js

@@ -111,6 +111,20 @@ export function ConnectProvider({ clientId = "", basePath = "/api/connect", redi
     const invalidateResource = useCallback((path) => {
         cache.current.delete(`${basePath}${path}`);
     }, [basePath]);
+    const streamResource = useCallback(async (path, body, options) => {
+        const response = await (fetchImpl ?? globalThis.fetch)(`${basePath}${path}`, {
+            method: "POST",
+            credentials: "same-origin",
+            headers: { accept: "text/event-stream", "content-type": "application/json" },
+            body: JSON.stringify(body),
+            signal: options?.signal,
+        });
+        if (!response.ok) {
+            const envelope = await response.json().catch(() => null);
+            throw new Error(envelope?.error?.message ?? `Connect bridge returned ${response.status}`);
+        }
+        return response;
+    }, [basePath, fetchImpl]);
     const refresh = useCallback(async () => {
         cache.current.clear();
         try {
@@ -122,7 +136,7 @@ export function ConnectProvider({ clientId = "", basePath = "/api/connect", redi
             // error, so a Login button still renders rather than the UI hanging on
             // skeletons forever.
             setResult({
-                session: { user: null, subscription: null, applicationRole: null },
+                session: { user: null, subscription: null, applicationRole: null, audience: null },
                 error: cause instanceof Error ? cause.message : "Could not reach Connect",
             });
         }
@@ -171,7 +185,7 @@ export function ConnectProvider({ clientId = "", basePath = "/api/connect", redi
             credentials: "same-origin",
         }).catch(() => { });
         cache.current.clear();
-        setResult({ session: { user: null, subscription: null, applicationRole: null }, error: null });
+        setResult({ session: { user: null, subscription: null, applicationRole: null, audience: null }, error: null });
     }, [basePath, fetchImpl]);
     const value = useMemo(() => ({
         clientId,
@@ -185,6 +199,7 @@ export function ConnectProvider({ clientId = "", basePath = "/api/connect", redi
         fetchResource,
         mutateResource,
         invalidateResource,
+        streamResource,
     }), [
         clientId,
         appUrl,
@@ -197,6 +212,7 @@ export function ConnectProvider({ clientId = "", basePath = "/api/connect", redi
         fetchResource,
         mutateResource,
         invalidateResource,
+        streamResource,
     ]);
     return _jsx(ConnectContext.Provider, { value: value, children: children });
 }
@@ -211,6 +227,31 @@ export function useConnect() {
 export function useConnectUser() {
     return useConnect().session?.user ?? null;
 }
+/**
+ * Whether the signed-in workspace is a one-seat personal account or a team -
+ * `null` while the session is loading or signed out.
+ *
+ * Branch on this to stop rendering team UI at a solo account: a members
+ * table, an invite button and a seat meter are all dead controls on an
+ * `"individual"` workspace, which has exactly one seat and cannot gain
+ * another. `<ConnectWorkspaceTypeGate>` is the declarative form.
+ */
+export function useConnectWorkspaceType() {
+    return useConnect().session?.user?.workspaceType ?? null;
+}
+/**
+ * Whether this account is the kind your application is sold to - `null` while
+ * the session is loading or signed out.
+ *
+ * `audience.matches === false` is a hard block, not a hint: readiness reports
+ * `audience_mismatch` and subscribing is refused. `<ConnectAccessGate>`
+ * already blocks the shell on it, so reach for this only when you need the
+ * verdict somewhere the gate does not run - a marketing page, say, or a
+ * sign-up CTA you would rather not show to an account that cannot complete it.
+ */
+export function useConnectAudience() {
+    return useConnect().session?.audience ?? null;
+}
 /** Readiness gates and the live subscription, fetched on first use. */
 export function useConnectEntitlements() {
     return useConnectResource("/entitlements");

package/dist/esm/server/client.js

@@ -115,4 +115,4 @@ export class ConnectClient {
     }
 }
 /** Kept in step with `package.json` by `sdk.test.ts`. */
-export const SDK_VERSION = "0.7.0";
+export const SDK_VERSION = "0.9.0";

package/dist/esm/server/handler.js

@@ -193,6 +193,49 @@ export function createConnectHandler(options) {
             const { user } = await whoami(request);
             return json({ apps: await client.apps.list(user.workspaceId) });
         },
+        /**
+         * Ask AI. The one streaming route here, and the only one that does not
+         * answer JSON - it forwards Connect's server-sent event stream through
+         * untouched so `<ConnectAskAi>` can render tokens as they arrive.
+         *
+         * Same rule as every other route: the workspace comes from the caller's
+         * own session. It matters more here than anywhere else, because the
+         * answers are *retrieved from that workspace's Context Index* - a
+         * client-supplied `workspaceId` would be a read of another tenant's
+         * documents, laundered through a chat reply.
+         *
+         * Messages are forwarded as-is (part-based `UIMessage`s), and only their
+         * shape is checked: the conversation is the caller's own, and Connect
+         * validates it again on arrival.
+         */
+        "POST /ai/chat": async (request) => {
+            const { user } = await whoami(request);
+            const body = (await request.json().catch(() => null));
+            if (!Array.isArray(body?.messages)) {
+                throw new ConnectError({
+                    status: 400,
+                    code: "validation_error",
+                    message: "messages is required",
+                    endpoint: "POST /ai/chat",
+                });
+            }
+            const upstream = await client.ai.chat({
+                workspaceId: user.workspaceId,
+                messages: body.messages,
+            });
+            // `upstream.body` is piped, never buffered - awaiting it would collect
+            // the whole answer server-side and deliver it in one lump, which is the
+            // only thing streaming was for. The browser cancelling its read
+            // propagates down this pipe and stops generation upstream.
+            return new Response(upstream.body, {
+                status: upstream.status,
+                headers: {
+                    "content-type": upstream.headers.get("content-type") ?? "text/event-stream",
+                    "cache-control": "no-store",
+                    "x-content-type-options": "nosniff",
+                },
+            });
+        },
         "GET /integrations": async (request) => {
             const { user } = await whoami(request);
             return json({ toolkits: await client.integrations.list(user.workspaceId) });

package/dist/esm/server/http.js

@@ -124,33 +124,55 @@ export async function request(options, spec) {
             // request for minutes.
             await sleep(Math.min(lastError?.retryAfterMs ?? 250 * 2 ** (attempt - 1), 8_000));
         }
-        const timeout = AbortSignal.timeout(options.timeoutMs);
-        const signal = spec.signal ? AbortSignal.any([spec.signal, timeout]) : timeout;
-        let response;
+        // A cancellable timer rather than `AbortSignal.timeout`, because the
+        // timeout has to be *stopped* once this attempt is done reading - and a
+        // timeout signal cannot be cleared.
+        //
+        // That distinction is the whole point for a streaming endpoint. `fetch`
+        // resolves the moment the headers land, but its signal keeps governing
+        // the body: an `AbortSignal.timeout(20_000)` handed to `ai.chat` tears the
+        // SSE stream down mid-answer, twenty seconds in, on every conversation
+        // long enough to matter. Clearing the timer in `finally` bounds the
+        // request the same way it always did (a `raw` caller still gets its
+        // timeout on *reaching* Connect, and a JSON caller still gets it across
+        // the body read, which happens inside the `try`) while leaving a stream
+        // that has actually started to run as long as it needs. A caller that
+        // wants to bound the stream itself passes `spec.signal`.
+        const timeoutController = new AbortController();
+        const timer = setTimeout(() => timeoutController.abort(), options.timeoutMs);
+        const signal = spec.signal
+            ? AbortSignal.any([spec.signal, timeoutController.signal])
+            : timeoutController.signal;
         try {
-            response = await options.fetch(url.toString(), { method: spec.method, headers, body, signal });
+            let response;
+            try {
+                response = await options.fetch(url.toString(), { method: spec.method, headers, body, signal });
+            }
+            catch (cause) {
+                // A caller-supplied abort is a decision, not a fault - never retried.
+                if (spec.signal?.aborted)
+                    throw cause;
+                lastError = new ConnectError({
+                    status: 0,
+                    code: "network_error",
+                    message: `${endpoint} could not reach Connect`,
+                    endpoint,
+                    cause,
+                });
+                continue;
+            }
+            if (response.ok) {
+                if (spec.raw)
+                    return response;
+                return (await readBody(response));
+            }
+            lastError = toConnectError(response, await readBody(response), endpoint);
+            if (!RETRYABLE_STATUS.has(response.status))
+                throw lastError;
         }
-        catch (cause) {
-            // A caller-supplied abort is a decision, not a fault - never retried.
-            if (spec.signal?.aborted)
-                throw cause;
-            lastError = new ConnectError({
-                status: 0,
-                code: "network_error",
-                message: `${endpoint} could not reach Connect`,
-                endpoint,
-                cause,
-            });
-            continue;
+        finally {
+            clearTimeout(timer);
         }
-        if (response.ok) {
-            if (spec.raw)
-                return response;
-            return (await readBody(response));
-        }
-        lastError = toConnectError(response, await readBody(response), endpoint);
-        if (!RETRYABLE_STATUS.has(response.status))
-            throw lastError;
     }
     throw lastError;
 }

package/dist/esm/server/resources/entitlements.js

@@ -42,4 +42,45 @@ export class EntitlementsResource {
         const result = await this.getSubscription(workspaceId);
         return result.hasActiveSubscription && (result.plan?.features.includes(feature) ?? false);
     }
+    /**
+     * One page of the workspaces subscribed to your application, newest first.
+     *
+     * The inverse of `getSubscription`, which asks about one workspace you
+     * already know. This asks who your subscribers *are* - what a partner
+     * dashboard, an MRR total or a churn report is built on.
+     *
+     * Rate-limited far more tightly than the per-workspace read (10/min per
+     * key, against 60): it walks your whole subscriber base and is a reporting
+     * call, not a per-request gate. Use `getSubscription` in a hot path.
+     *
+     * Your application is resolved from the API key, so there is no parameter
+     * for it and no way to ask about anyone else's.
+     */
+    listSubscribers(options = {}) {
+        return request(this.transport, {
+            method: "GET",
+            path: "/subscriptions",
+            query: { status: options.status, before: options.before, limit: options.limit },
+        });
+    }
+    /**
+     * Every subscriber, paged through for you.
+     *
+     * An async generator rather than an array: a large subscriber base is
+     * exactly where an accidental full materialisation hurts, and `for await`
+     * reads the same as a loop over one page.
+     */
+    async *iterateSubscribers(options = {}) {
+        let before;
+        do {
+            const page = await this.listSubscribers({
+                status: options.status,
+                limit: options.pageSize,
+                before,
+            });
+            for (const item of page.items)
+                yield item;
+            before = page.nextBefore ?? undefined;
+        } while (before);
+    }
 }

package/dist/esm/server/resources/identity.js

@@ -67,6 +67,7 @@ export class IdentityResource {
             user: wire.user,
             subscription: wire.subscription,
             applicationRole: wire.applicationRole,
+            audience: wire.audience,
         };
     }
     /**
@@ -137,6 +138,7 @@ export class IdentityResource {
             user: wire.user,
             subscription: wire.subscription,
             applicationRole: wire.applicationRole,
+            audience: wire.audience,
             sessionExpiresAt: wire.session_expires_at,
         };
     }

package/dist/theme.css

@@ -110,3 +110,90 @@ body {
   background: var(--background);
   color: var(--foreground);
 }
+
+/* ---------------------------------------------------------------------------
+ * Ask AI: Streamdown token compatibility.
+ *
+ * `ConnectAskAi` renders markdown with Streamdown, which paints using
+ * shadcn/ui's token names. HeroUI defines a different set - four happen to line
+ * up already (`--background`, `--foreground`, `--border`, `--radius`), and the
+ * rest are aliased here so an answer inherits the platform's own theme instead
+ * of rendering with missing backgrounds and borders.
+ *
+ * This lives in the shipped theme rather than in each partner's CSS because it
+ * is a fact about how these two libraries name colours, not a design choice
+ * anyone should have to rediscover.
+ *
+ * Additive - HeroUI uses none of these names - with exactly one real collision,
+ * handled below.
+ * ------------------------------------------------------------------------ */
+:root,
+.light,
+.default,
+[data-theme="light"],
+[data-theme="default"],
+.dark,
+[data-theme="dark"] {
+  --card: var(--surface);
+  --card-foreground: var(--surface-foreground);
+  --input: var(--border);
+  --primary: var(--accent);
+  --primary-foreground: var(--accent-foreground);
+}
+
+/* ---------------------------------------------------------------------------
+ * The collision: `--muted` is a *surface* in shadcn (code-block fills, table
+ * header rows) and a *text colour* in HeroUI. Reading it as HeroUI's would
+ * paint every code block mid-grey and leave the text on it unreadable.
+ *
+ * So it is shadowed - but only inside the answer body, and only after the host
+ * element has captured HeroUI's value under shadcn's name for it. Splitting it
+ * across two elements is what makes this safe: `--muted-foreground` is computed
+ * on `.connect-ai-host`, where `--muted` still means HeroUI's text grey, and
+ * inherits that resolved colour downward. Both declarations on one element
+ * would resolve `var(--muted)` against the new value and lose the original.
+ * ------------------------------------------------------------------------ */
+.connect-ai-host {
+  --muted-foreground: var(--muted);
+}
+
+.connect-ai-host .connect-ai-body {
+  --muted: var(--surface-secondary);
+}
+
+/* ---------------------------------------------------------------------------
+ * The Ask AI "thinking" shimmer - a highlight sweeping through the label while
+ * the model works, rather than a spinner.
+ *
+ * A gradient clipped to the glyphs, so the motion is *in* the word instead of
+ * beside it. This is the one state where the panel has nothing at all to show:
+ * retrieval and the model's first thought take a second or two, and a static
+ * "Thinking" reads as frozen.
+ * ------------------------------------------------------------------------ */
+.connect-ai-shimmer {
+  background: linear-gradient(100deg, var(--muted) 32%, var(--accent) 48%, var(--muted) 64%);
+  background-size: 220% 100%;
+  -webkit-background-clip: text;
+  background-clip: text;
+  color: transparent;
+  animation: connect-ai-shimmer 1.7s linear infinite;
+}
+
+@keyframes connect-ai-shimmer {
+  from {
+    background-position: 180% 0;
+  }
+  to {
+    background-position: -40% 0;
+  }
+}
+
+/* Motion is the whole affordance here, so with it suppressed the label has to
+   go back to being a legible static word rather than a transparent one. */
+@media (prefers-reduced-motion: reduce) {
+  .connect-ai-shimmer {
+    background: none;
+    color: var(--muted);
+    animation: none;
+  }
+}

package/dist/types/client/components/access-gate.d.ts

@@ -5,6 +5,12 @@ export type ConnectAccessGateState = "loading"
  | "signed_out"
 /** `workspace_suspended` - a platform admin took this workspace offline. Hard block, no dismiss. */
  | "suspended"
+/**
+ * `audience_mismatch` - this application serves individual accounts and the
+ * workspace is a business, or the reverse. Hard block with nothing to
+ * offer: `Workspace.type` is fixed at sign-up.
+ */
+ | "audience_mismatch"
 /** `subscription_missing` - nothing to subscribe to yet. Hard block. */
  | "no_subscription"
 /** `onboarding_approval_pending` - waiting on a reviewer. Hard block, no action to offer. */
@@ -33,9 +39,17 @@ export interface ConnectAccessGateResult {
  * `ConnectReadinessGate`/`ConnectReadinessBanner` already use. `ConnectAccessGate`
  * is a priority ordering over the same data, not a second opinion about it.
  *
- * Priority, first match wins: `suspended` > `no_subscription` >
- * `onboarding_pending` > any other blocking code (`blocked`) >
- * `payment_retry` (advisory - `children` still render) > `clear`.
+ * Priority, first match wins: `suspended` > `audience_mismatch` >
+ * `no_subscription` > `onboarding_pending` > any other blocking code
+ * (`blocked`) > `payment_retry` (advisory - `children` still render) >
+ * `clear`.
+ *
+ * `audience_mismatch` outranks `no_subscription` deliberately, and the
+ * ordering is the whole point of it: a workspace of the wrong account type
+ * carries BOTH blockers at once, and showing the subscription one first sent
+ * the customer to a plan picker whose subscribe call
+ * (`ActivateSubscriptionUseCase`) rejects them for the audience anyway. The
+ * account type is the reason; the missing subscription is a consequence.
  */
 export declare function useConnectAccessGate(): ConnectAccessGateResult;
 export interface ConnectAccessGateProps {

package/dist/types/client/components/ai-format.d.ts

@@ -0,0 +1,24 @@
+import type { AiValue, AiValueFormat } from "../../types.js";
+/**
+ * The one place a model-supplied value becomes a string.
+ *
+ * Ask AI's presentation tools send raw values with a `format` tag beside them
+ * rather than pre-formatted strings (see `AiValueFormat`), and this is the half
+ * that makes that worth doing: an amount renders in the viewer's own locale, a
+ * table sorts numerically, and the same figure reads identically on a chart
+ * axis, in a tooltip and in a metric tile.
+ *
+ * Every branch is total. A value that cannot be formatted the way it was
+ * tagged - a `date` that is not a date, a `currency` that is not a number -
+ * falls back to its plain string rather than throwing inside a render.
+ */
+/** Renders in place of a missing value - an em dash, not the word "null". */
+export declare const AI_EMPTY_VALUE = "\u2014";
+export declare function formatAiValue(value: AiValue, format?: AiValueFormat): string;
+/** Numeric columns read far better right-aligned; everything else stays with the text. */
+export declare function isNumericAiFormat(format?: AiValueFormat): boolean;
+export type AiStatusTone = "neutral" | "positive" | "warning" | "danger";
+export declare function aiStatusTone(value: AiValue): AiStatusTone;
+/** HeroUI semantic tokens only, so these inherit whatever theme the host defined. */
+export declare const AI_TONE_CHIP: Record<AiStatusTone, string>;
+export declare const AI_TONE_DOT: Record<AiStatusTone, string>;

package/dist/types/client/components/ai-widgets.d.ts

@@ -0,0 +1,42 @@
+import { type ReactNode } from "react";
+import type { AiChartInput, AiDetailsInput, AiMetricsInput, AiSourcesInput, AiStepsInput, AiTableInput, AiTimelineInput } from "../../types.js";
+/**
+ * `showTable`. Sorting and CSV are what a table is *for* - once an answer is
+ * tabular the next thing anyone wants is to reorder it or take it elsewhere,
+ * and a markdown table can do neither. Both work off the raw values, so
+ * "₹12,500" sorts as 12500 and the export carries numbers a spreadsheet can add.
+ */
+export declare function AiTable({ title, columns, rows, caption }: Readonly<AiTableInput>): import("react").JSX.Element;
+/**
+ * `showChart`. Cartesian kinds are drawn as SVG against a fixed viewBox and
+ * scaled by the browser, which is why there is no resize observer here: the
+ * chart is resolution-independent, so "responsive" costs nothing at runtime.
+ *
+ * `pie` is deliberately *not* a pie. In a 400px column a pie plus its legend
+ * is smaller than the labels it needs, and reading angles is worse than
+ * reading lengths at any size - so proportions render as a labelled bar list,
+ * which answers the same question and stays legible.
+ */
+export declare function AiChart({ title, kind, xLabel, yLabel, valueFormat, series, caption }: Readonly<AiChartInput>): import("react").JSX.Element;
+/**
+ * `showMetrics`. A delta is coloured by `deltaMeaning`, not by its sign -
+ * churn rising is bad and revenue rising is good, and painting both green
+ * because the arrow points up is exactly the confidently-wrong signal a
+ * dashboard must never send. The arrow still shows direction, so meaning and
+ * direction stay two separate channels.
+ */
+export declare function AiMetrics({ title, metrics }: Readonly<AiMetricsInput>): import("react").JSX.Element;
+/** `showTimeline`: dated events, oldest first, on a single rail. */
+export declare function AiTimeline({ title, events }: Readonly<AiTimelineInput>): import("react").JSX.Element;
+/** `showDetails`: one entity's fields, as a definition list rather than a one-row table. */
+export declare function AiDetails({ title, fields }: Readonly<AiDetailsInput>): import("react").JSX.Element;
+/** `showSteps`: an ordered procedure. `renderDetail` is how the panel feeds each step back through its markdown renderer. */
+export declare function AiSteps({ title, steps, renderDetail, }: Readonly<AiStepsInput & {
+    renderDetail?: (markdown: string) => ReactNode;
+}>): import("react").JSX.Element;
+/**
+ * `showSources`: what a grounded answer actually rested on. The point of a
+ * citation is that it can be opened, so a source with a `uri` is a link and one
+ * without is still a named row - never a marker with nothing behind it.
+ */
+export declare function AiSources({ sources }: Readonly<AiSourcesInput>): import("react").JSX.Element;