@opengeni/sdk 3.3.2 → 3.4.0

package/dist/workspace-integrations.d.ts

@@ -0,0 +1,74 @@
+import type { CredentialProviderRequest, WorkspaceWebhookEvent } from "@opengeni/contracts";
+import type { OpenGeniClient } from "./client.js";
+import type { CreateOrganizationWebhookRequest, CreateOrganizationWebhookResponse, GetOrganizationCredentialProviderResponse, ListOrganizationWebhookDeliveriesResponse, ListOrganizationWebhooksResponse, OrganizationWebhook, OrganizationWebhookDelivery, PutOrganizationCredentialProviderRequest, PutOrganizationCredentialProviderResponse, RotateWorkspaceCredentialProviderSecretResponse, RotateOrganizationCredentialProviderSecretResponse, RotateWorkspaceWebhookSecretResponse, RotateOrganizationWebhookSecretResponse, TestWorkspaceCredentialProviderResponse, TestWorkspaceWebhookResponse, UpdateOrganizationWebhookRequest, WorkspaceInheritedIntegrationsResponse, WorkspaceWebhook } from "@opengeni/contracts";
+export type { CreateOrganizationWebhookRequest, CreateOrganizationWebhookResponse, CreateWorkspaceWebhookRequest, CreateWorkspaceWebhookResponse, CredentialProviderRequest, CredentialProviderInitiatorContext, CredentialProviderResponse, CredentialProviderMcpHeaders, CredentialProviderMcpMaterial, GetOrganizationCredentialProviderResponse, GetWorkspaceCredentialProviderResponse, InitiatingHuman, IntegrationEndpointTestResult, IntegrationWorkspaceFilter, ListOrganizationWebhookDeliveriesResponse, ListOrganizationWebhooksResponse, ListWorkspaceWebhookDeliveriesResponse, ListWorkspaceWebhooksResponse, PutWorkspaceCredentialProviderRequest, PutWorkspaceCredentialProviderResponse, PutOrganizationCredentialProviderRequest, PutOrganizationCredentialProviderResponse, RotateWorkspaceCredentialProviderSecretResponse, RotateOrganizationCredentialProviderSecretResponse, RotateWorkspaceWebhookSecretResponse, RotateOrganizationWebhookSecretResponse, TestWorkspaceCredentialProviderResponse, TestWorkspaceWebhookResponse, OrganizationCredentialProvider, OrganizationWebhook, OrganizationWebhookDelivery, UpdateOrganizationWebhookRequest, UpdateWorkspaceWebhookRequest, WorkspaceCredentialProvider, WorkspaceInheritedIntegrationsResponse, WorkspaceTestWebhookEvent, WorkspaceWebhook, WorkspaceWebhookDelivery, WorkspaceWebhookEvent, WorkspaceWebhookEventType, SessionWorkspaceWebhookEvent, WorkspaceUsageWebhookEvent, } from "@opengeni/contracts";
+export { OPENGENI_DELIVERY_ID_HEADER, OPENGENI_EVENT_ID_HEADER, OPENGENI_SIGNATURE_HEADER, OPENGENI_TEST_REQUEST_NIL_ID, OPENGENI_WEBHOOK_TEST_EVENT_TYPE, WORKSPACE_WEBHOOK_EVENT_TYPES, signOpenGeniPayload, verifyOpenGeniSignature, } from "@opengeni/contracts/workspace-integration-wire";
+export type WorkspaceSandboxImages = {
+    images: string[];
+    selected: string | null;
+};
+export declare class OpenGeniSignatureError extends Error {
+    constructor();
+}
+type SignedRequest = {
+    /** The exact raw request body. Parse it only after verification. */
+    body: string;
+    headers: Headers | Record<string, string | string[] | undefined>;
+    secret: string;
+    toleranceSeconds?: number;
+};
+/**
+ * Verify and parse one webhook delivery. Delivery is at least once: dedupe on
+ * `event.id` (also sent as the `OpenGeni-Event-Id` header). A `webhook.test`
+ * event (from "Send test event") names no session: acknowledge it with 2xx.
+ */
+export declare function verifyWebhookEvent(input: SignedRequest): Promise<{
+    event: WorkspaceWebhookEvent;
+    deliveryId: string | null;
+}>;
+/**
+ * Verify the exact bytes and parse a provider request, including its frozen
+ * initiatorContext when sent by an upgraded worker. Provenance grants no access.
+ */
+export declare function verifyCredentialProviderRequest(input: SignedRequest): Promise<CredentialProviderRequest>;
+/** Identity header names, for receivers that log or dedupe. */
+export declare const OPENGENI_WEBHOOK_HEADERS: {
+    readonly signature: "OpenGeni-Signature";
+    readonly eventId: "OpenGeni-Event-Id";
+    readonly deliveryId: "OpenGeni-Delivery-Id";
+};
+/** Server-side integration administration is opt-in, outside the eager browser client. */
+export declare function getOrganizationCredentialProvider(client: Pick<OpenGeniClient, "requestJson">, organizationId: string): Promise<GetOrganizationCredentialProviderResponse>;
+/** Replace configuration; explicit filter required. Store the first returned signing secret. */
+export declare function putOrganizationCredentialProvider(client: Pick<OpenGeniClient, "requestJson">, organizationId: string, request: PutOrganizationCredentialProviderRequest): Promise<PutOrganizationCredentialProviderResponse>;
+export declare function deleteOrganizationCredentialProvider(client: Pick<OpenGeniClient, "requestJson">, organizationId: string): Promise<void>;
+export declare function listOrganizationWebhooks(client: Pick<OpenGeniClient, "requestJson">, organizationId: string): Promise<ListOrganizationWebhooksResponse>;
+/** Create a webhook and return its signing secret once. */
+export declare function createOrganizationWebhook(client: Pick<OpenGeniClient, "requestJson">, organizationId: string, request: CreateOrganizationWebhookRequest): Promise<CreateOrganizationWebhookResponse>;
+export declare function getOrganizationWebhook(client: Pick<OpenGeniClient, "requestJson">, organizationId: string, webhookId: string): Promise<OrganizationWebhook>;
+export declare function updateOrganizationWebhook(client: Pick<OpenGeniClient, "requestJson">, organizationId: string, webhookId: string, request: UpdateOrganizationWebhookRequest): Promise<OrganizationWebhook>;
+export declare function deleteOrganizationWebhook(client: Pick<OpenGeniClient, "requestJson">, organizationId: string, webhookId: string): Promise<void>;
+export declare function listOrganizationWebhookDeliveries(client: Pick<OpenGeniClient, "requestJson">, organizationId: string, webhookId: string, options?: {
+    limit?: number;
+}): Promise<ListOrganizationWebhookDeliveriesResponse>;
+/** Requeue a settled delivery with a fresh attempt budget. */
+export declare function redeliverOrganizationWebhookDelivery(client: Pick<OpenGeniClient, "requestJson">, organizationId: string, webhookId: string, deliveryId: string): Promise<OrganizationWebhookDelivery>;
+export declare function getWorkspaceWebhook(client: Pick<OpenGeniClient, "requestJson">, workspaceId: string, webhookId: string): Promise<WorkspaceWebhook>;
+/** Rotate immediately. Store the new secret; the old signing secret stops working. */
+export declare function rotateWorkspaceCredentialProviderSecret(client: Pick<OpenGeniClient, "requestJson">, workspaceId: string): Promise<RotateWorkspaceCredentialProviderSecretResponse>;
+export declare function rotateOrganizationCredentialProviderSecret(client: Pick<OpenGeniClient, "requestJson">, organizationId: string): Promise<RotateOrganizationCredentialProviderSecretResponse>;
+export declare function rotateOrganizationWebhookSecret(client: Pick<OpenGeniClient, "requestJson">, organizationId: string, webhookId: string): Promise<RotateOrganizationWebhookSecretResponse>;
+export declare function rotateWorkspaceWebhookSecret(client: Pick<OpenGeniClient, "requestJson">, workspaceId: string, webhookId: string): Promise<RotateWorkspaceWebhookSecretResponse>;
+/**
+ * Send one signed `webhook.test` event to a workspace webhook now and return
+ * what the endpoint answered. Nothing is queued or retried.
+ */
+export declare function testWorkspaceWebhook(client: Pick<OpenGeniClient, "requestJson">, workspaceId: string, webhookId: string): Promise<TestWorkspaceWebhookResponse>;
+/**
+ * Send one signed `purpose: "test"` request to the credential provider this
+ * workspace's runs use (its own, else the organization's). Only the names of
+ * returned credentials come back, never their values.
+ */
+export declare function testWorkspaceCredentialProvider(client: Pick<OpenGeniClient, "requestJson">, workspaceId: string): Promise<TestWorkspaceCredentialProviderResponse>;
+/** Organization registrations that reach this workspace. Workspace administrators only. */
+export declare function getWorkspaceInheritedIntegrations(client: Pick<OpenGeniClient, "requestJson">, workspaceId: string): Promise<WorkspaceInheritedIntegrationsResponse>;

package/dist/workspace-integrations.js

@@ -0,0 +1,67 @@
+import {
+  OPENGENI_WEBHOOK_HEADERS,
+  OpenGeniSignatureError,
+  createOrganizationWebhook,
+  deleteOrganizationCredentialProvider,
+  deleteOrganizationWebhook,
+  getOrganizationCredentialProvider,
+  getOrganizationWebhook,
+  getWorkspaceInheritedIntegrations,
+  getWorkspaceWebhook,
+  listOrganizationWebhookDeliveries,
+  listOrganizationWebhooks,
+  putOrganizationCredentialProvider,
+  redeliverOrganizationWebhookDelivery,
+  rotateOrganizationCredentialProviderSecret,
+  rotateOrganizationWebhookSecret,
+  rotateWorkspaceCredentialProviderSecret,
+  rotateWorkspaceWebhookSecret,
+  testWorkspaceCredentialProvider,
+  testWorkspaceWebhook,
+  updateOrganizationWebhook,
+  verifyCredentialProviderRequest,
+  verifyWebhookEvent
+} from "./chunk-VT4YM4XQ.js";
+import {
+  OPENGENI_DELIVERY_ID_HEADER,
+  OPENGENI_EVENT_ID_HEADER,
+  OPENGENI_SIGNATURE_HEADER,
+  OPENGENI_TEST_REQUEST_NIL_ID,
+  OPENGENI_WEBHOOK_TEST_EVENT_TYPE,
+  WORKSPACE_WEBHOOK_EVENT_TYPES,
+  signOpenGeniPayload,
+  verifyOpenGeniSignature
+} from "./chunk-KGEABAID.js";
+export {
+  OPENGENI_DELIVERY_ID_HEADER,
+  OPENGENI_EVENT_ID_HEADER,
+  OPENGENI_SIGNATURE_HEADER,
+  OPENGENI_TEST_REQUEST_NIL_ID,
+  OPENGENI_WEBHOOK_HEADERS,
+  OPENGENI_WEBHOOK_TEST_EVENT_TYPE,
+  OpenGeniSignatureError,
+  WORKSPACE_WEBHOOK_EVENT_TYPES,
+  createOrganizationWebhook,
+  deleteOrganizationCredentialProvider,
+  deleteOrganizationWebhook,
+  getOrganizationCredentialProvider,
+  getOrganizationWebhook,
+  getWorkspaceInheritedIntegrations,
+  getWorkspaceWebhook,
+  listOrganizationWebhookDeliveries,
+  listOrganizationWebhooks,
+  putOrganizationCredentialProvider,
+  redeliverOrganizationWebhookDelivery,
+  rotateOrganizationCredentialProviderSecret,
+  rotateOrganizationWebhookSecret,
+  rotateWorkspaceCredentialProviderSecret,
+  rotateWorkspaceWebhookSecret,
+  signOpenGeniPayload,
+  testWorkspaceCredentialProvider,
+  testWorkspaceWebhook,
+  updateOrganizationWebhook,
+  verifyCredentialProviderRequest,
+  verifyOpenGeniSignature,
+  verifyWebhookEvent
+};
+//# sourceMappingURL=workspace-integrations.js.map

package/dist/workspace-integrations.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/workspace-state.d.ts

@@ -1,41 +1,4 @@
 import type { WorkspaceInstructionPolicyKind, WorkspaceInstructionPolicyProvenanceSource, WorkspaceInstructionPolicyScope } from "./workspace-instruction-policies.js";
-export type WorkspaceStateDocumentStatusCounts = {
-    queued: number;
-    indexing: number;
-    ready: number;
-    failed: number;
-};
-export type WorkspaceStateSourceKindCounts = {
-    manual_upload: number;
-    meeting_transcript: number;
-    repository: number;
-    email: number;
-    chat: number;
-    document: number;
-    web: number;
-    other: number;
-};
-export type WorkspaceStateDocumentAuthorityKindCounts = {
-    organization: number;
-    workspace: number;
-    personal: number;
-};
-export type WorkspaceStateMemoryStatusCounts = {
-    proposed: number;
-    approved: number;
-    rejected: number;
-    active: number;
-    superseded: number;
-    archived: number;
-};
-export type WorkspaceStateMemoryKindCounts = {
-    semantic: number;
-    episodic: number;
-    procedural: number;
-    decision: number;
-    preference: number;
-};
-export type WorkspaceStateGapCode = "no_document_bases" | "no_visible_documents" | "failed_documents" | "processing_documents" | "missing_topic_coverage" | "no_memory_records" | "pending_memory_review" | "partial_inventory";
 export type WorkspaceStateGovernanceDriftStatus = "identical" | "changed" | "superseded" | "missing" | "unavailable" | "truncated";
 export type WorkspaceStateGetOptions = {
     attemptId?: string;
@@ -164,42 +127,16 @@ export type WorkspaceStateResponse = {
         requiredPermission: "documents:search";
     } | {
         availability: "available";
+        authority: "knowledge_entries";
         coverage: "complete" | "partial";
-        baseCount: number;
-        bases: Array<{
+        sampleLimit: 50;
+        entries: Array<{
             id: string;
-            name: string;
-            visibleDocumentCount: number;
-            statusCounts: WorkspaceStateDocumentStatusCounts;
-            latestUpdatedAt: string | null;
-        }>;
-        basesTruncated: boolean;
-        inspectedVisibleDocumentCount: number;
-        documentStatusCounts: WorkspaceStateDocumentStatusCounts;
-        sourceKindCounts: WorkspaceStateSourceKindCounts;
-        authorityKindCounts: WorkspaceStateDocumentAuthorityKindCounts;
-        topics: Array<{
-            name: string;
-            documentCount: number;
-        }>;
-        topicsTruncated: boolean;
-        latestDocumentUpdatedAt: string | null;
-        memorySample: {
-            recordCount: number;
-            sampleLimit: 100;
-            limitReached: boolean;
-            statusCounts: WorkspaceStateMemoryStatusCounts;
-            kindCounts: WorkspaceStateMemoryKindCounts;
-            preferenceAuthority: {
-                kindCountSource: "knowledge_memories_legacy_observations";
-                activeAuthority: "structured_preference_registry";
-            };
-            latestUpdatedAt: string | null;
-        };
-        gaps: Array<{
-            code: WorkspaceStateGapCode;
-            severity: "info" | "warning";
-            relatedCount: number | null;
+            revisionId: string;
+            title: string;
+            kind: "source" | "fact" | "decision" | "requirement" | "incident" | "note" | "group";
+            scope: "organization" | "workspace" | "personal";
+            updatedAt: string;
         }>;
     };
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@opengeni/sdk",
-  "version": "3.3.2",
-  "description": "Framework-agnostic TypeScript SDK for the OpenGeni API: typed client, session lifecycle, SSE event streaming with reconnect + replay-by-sequence, and proxy re-streaming helpers.",
+  "version": "3.4.0",
+  "description": "Framework-agnostic TypeScript SDK for the Opengeni API: typed client, session lifecycle, SSE event streaming with reconnect + replay-by-sequence, and proxy re-streaming helpers.",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -22,6 +22,14 @@
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
+    "./allowance-refusal": {
+      "types": "./dist/allowance-refusal.d.ts",
+      "import": "./dist/allowance-refusal.js"
+    },
+    "./app-links": {
+      "types": "./dist/app-links.d.ts",
+      "import": "./dist/app-links.js"
+    },
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
@@ -34,6 +42,50 @@
       "types": "./dist/browser.d.ts",
       "import": "./dist/browser.js"
     },
+    "./site-document": {
+      "types": "./dist/site-document.d.ts",
+      "import": "./dist/site-document.js"
+    },
+    "./site": {
+      "types": "./dist/site.d.ts",
+      "import": "./dist/site.js"
+    },
+    "./site-bridge-host": {
+      "types": "./dist/site-bridge-host.d.ts",
+      "import": "./dist/site-bridge-host.js"
+    },
+    "./github-repositories": {
+      "types": "./dist/github-repositories.d.ts",
+      "import": "./dist/github-repositories.js"
+    },
+    "./knowledge": {
+      "types": "./dist/knowledge.d.ts",
+      "import": "./dist/knowledge.js"
+    },
+    "./usage-allowances": {
+      "types": "./dist/usage-allowances.d.ts",
+      "import": "./dist/usage-allowances.js"
+    },
+    "./session-usage-limits": {
+      "types": "./dist/session-usage-limits.d.ts",
+      "import": "./dist/session-usage-limits.js"
+    },
+    "./insights-usage": {
+      "types": "./dist/insights-usage.d.ts",
+      "import": "./dist/insights-usage.js"
+    },
+    "./workspace-integrations": {
+      "types": "./dist/workspace-integrations.d.ts",
+      "import": "./dist/workspace-integrations.js"
+    },
+    "./external-vault-receiver": {
+      "types": "./dist/external-vault-receiver.d.ts",
+      "import": "./dist/external-vault-receiver.js"
+    },
+    "./session-history-import": {
+      "types": "./dist/session-history-import.d.ts",
+      "import": "./dist/session-history-import.js"
+    },
     "./document-authority": {
       "types": "./dist/document-authority.d.ts",
       "import": "./dist/document-authority.js"
@@ -58,6 +110,10 @@
       "types": "./dist/pr-review.d.ts",
       "import": "./dist/pr-review.js"
     },
+    "./organization-integration-policy": {
+      "types": "./dist/organization-integration-policy.d.ts",
+      "import": "./dist/organization-integration-policy.js"
+    },
     "./organization-private-session-settings": {
       "types": "./dist/organization-private-session-settings.d.ts",
       "import": "./dist/organization-private-session-settings.js"
@@ -89,7 +145,48 @@
     "./gateway-realtime-transport": {
       "types": "./dist/gateway-realtime-transport.d.ts",
       "import": "./dist/gateway-realtime-transport.js"
-    }
+    },
+    "./model-picker-order": {
+      "types": "./dist/model-picker-order.d.ts",
+      "import": "./dist/model-picker-order.js"
+    },
+    "./model-display": {
+      "types": "./dist/model-display.d.ts",
+      "import": "./dist/model-display.js"
+    },
+    "./chat": {
+      "types": "./dist/chat/index.d.ts",
+      "import": "./dist/chat/index.js"
+    },
+    "./tenant-workspaces": {
+      "types": "./dist/tenant-workspaces.d.ts",
+      "import": "./dist/tenant-workspaces.js"
+    },
+    "./session-proxy": {
+      "types": "./dist/session-proxy.d.ts",
+      "import": "./dist/session-proxy.js"
+    },
+    "./tool-auth": {
+      "types": "./dist/tool-auth.d.ts",
+      "import": "./dist/tool-auth.js"
+    },
+    "./next": {
+      "types": "./dist/adapters/next.d.ts",
+      "import": "./dist/adapters/next.js"
+    },
+    "./express": {
+      "types": "./dist/adapters/express.d.ts",
+      "import": "./dist/adapters/express.js"
+    },
+    "./hono": {
+      "types": "./dist/adapters/hono.d.ts",
+      "import": "./dist/adapters/hono.js"
+    },
+    "./session-list-entries": {
+      "types": "./dist/session-list-entries.d.ts",
+      "import": "./dist/session-list-entries.js"
+    },
+    "./package.json": "./package.json"
   },
   "publishConfig": {
     "access": "public",
@@ -97,11 +194,12 @@
   },
   "scripts": {
     "typecheck": "tsc --noEmit",
-    "build": "bun ../../scripts/build-typescript-package.ts",
+    "build": "bun ../../scripts/generate-site-browser-runtime.ts && bun ../../scripts/build-typescript-package.ts",
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/contracts": "^2.9.2"
+    "@opengeni/connect": "3.4.0",
+    "@opengeni/contracts": "3.4.0"
   },
   "engines": {
     "node": ">=18"

package/src/adapters/express.ts

@@ -0,0 +1,136 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { Readable } from "node:stream";
+
+/** Any web-standard handler: `createSessionProxyHandler`, `createChatHandler`, or your own. */
+export type WebHandler = (request: Request) => Promise<Response>;
+
+/** Express/Connect request: Node's `IncomingMessage` plus what those frameworks add. */
+export type NodeRequestLike = IncomingMessage & {
+  originalUrl?: string | undefined;
+  /** Set when a body parser (for example `express.json()`) already consumed the body. */
+  body?: unknown;
+  protocol?: string | undefined;
+};
+
+export type NodeMiddleware = (
+  request: NodeRequestLike,
+  response: ServerResponse,
+  next?: (error?: unknown) => void,
+) => void;
+
+export type NodeMiddlewareOptions = {
+  /** Origin used to build the request URL. Defaults to the Host header over http(s). */
+  origin?: string | undefined;
+};
+
+/**
+ * Expose a web-standard handler as Express/Connect (or plain `node:http`)
+ * middleware. Mount it with the same path the browser client uses:
+ *
+ * ```ts
+ * app.use("/api/opengeni", toNodeMiddleware(handler));
+ * ```
+ *
+ * The full original URL is forwarded (Express strips the mount path from
+ * `req.url`), bodies stream through unless a body parser already consumed
+ * them, responses (including SSE) are written as they arrive, and a client
+ * disconnect aborts the request signal.
+ */
+export function toNodeMiddleware(
+  handler: WebHandler,
+  options: NodeMiddlewareOptions = {},
+): NodeMiddleware {
+  return (request, response, next) => {
+    void (async () => {
+      const abort = new AbortController();
+      response.once("close", () => {
+        if (!response.writableFinished) abort.abort();
+      });
+      const web = await handler(toWebRequest(request, abort.signal, options));
+      await writeWebResponse(web, response);
+    })().catch((error: unknown) => {
+      if (next) next(error);
+      else if (!response.headersSent) {
+        response.statusCode = 500;
+        response.end();
+      } else response.destroy(error instanceof Error ? error : undefined);
+    });
+  };
+}
+
+/** Express/Connect naming alias. */
+export const toExpressMiddleware = toNodeMiddleware;
+
+function toWebRequest(
+  request: NodeRequestLike,
+  signal: AbortSignal,
+  options: NodeMiddlewareOptions,
+): Request {
+  const encrypted = (request.socket as { encrypted?: boolean } | undefined)?.encrypted === true;
+  const origin =
+    options.origin?.replace(/\/+$/, "") ??
+    `${request.protocol ?? (encrypted ? "https" : "http")}://${request.headers.host ?? "localhost"}`;
+  const url = new URL(request.originalUrl ?? request.url ?? "/", origin);
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(request.headers)) {
+    if (value === undefined) continue;
+    if (Array.isArray(value)) for (const item of value) headers.append(name, item);
+    else headers.set(name, value);
+  }
+  const method = request.method ?? "GET";
+  let body: BodyInit | undefined;
+  if (method !== "GET" && method !== "HEAD") {
+    if (request.body !== undefined && (request.readableEnded || request.complete)) {
+      // A body parser consumed the stream: forward what it parsed.
+      body =
+        typeof request.body === "string" || request.body instanceof Uint8Array
+          ? (request.body as string | Uint8Array<ArrayBuffer>)
+          : JSON.stringify(request.body);
+      headers.delete("content-length");
+    } else {
+      body = Readable.toWeb(request) as unknown as ReadableStream<Uint8Array>;
+    }
+  }
+  return new Request(url, {
+    method,
+    headers,
+    signal,
+    ...(body !== undefined ? { body, duplex: "half" } : {}),
+  } as RequestInit);
+}
+
+async function writeWebResponse(web: Response, response: ServerResponse): Promise<void> {
+  response.statusCode = web.status;
+  const cookies = web.headers.getSetCookie?.() ?? [];
+  web.headers.forEach((value, name) => {
+    if (name.toLowerCase() !== "set-cookie") response.setHeader(name, value);
+  });
+  if (cookies.length > 0) response.setHeader("set-cookie", cookies);
+  if (!web.body) {
+    response.end();
+    return;
+  }
+  // Send headers now so SSE clients see the stream open before the first event.
+  response.flushHeaders();
+  const reader = web.body.getReader();
+  response.once("close", () => {
+    void reader.cancel().catch(() => undefined);
+  });
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (!response.write(value)) {
+      await new Promise<void>((resolve) => {
+        const settle = () => {
+          response.off("drain", settle);
+          response.off("close", settle);
+          resolve();
+        };
+        response.once("drain", settle);
+        response.once("close", settle);
+      });
+    }
+    if (response.destroyed) break;
+  }
+  response.end();
+}

package/src/adapters/hono.ts

@@ -0,0 +1,18 @@
+/** Any web-standard handler: `createSessionProxyHandler`, `createChatHandler`, or your own. */
+export type WebHandler = (request: Request) => Promise<Response>;
+
+/** The part of Hono's context this adapter uses (no Hono dependency). */
+export type HonoContextLike = { req: { raw: Request } };
+
+/**
+ * Expose a web-standard handler as a Hono handler:
+ *
+ * ```ts
+ * app.all("/api/opengeni/*", toHonoHandler(handler));
+ * ```
+ */
+export function toHonoHandler(
+  handler: WebHandler,
+): (context: HonoContextLike) => Promise<Response> {
+  return async (context) => await handler(context.req.raw);
+}

package/src/adapters/next.ts

@@ -0,0 +1,42 @@
+import { createSessionProxyHandler, type SessionProxyHandlerOptions } from "../session-proxy";
+
+/** Any web-standard handler: `createSessionProxyHandler`, `createChatHandler`, or your own. */
+export type WebHandler = (request: Request) => Promise<Response>;
+
+/** Route handlers for a Next.js App Router catch-all route. */
+export type NextRouteHandlers = {
+  GET: WebHandler;
+  POST: WebHandler;
+  PUT: WebHandler;
+  PATCH: WebHandler;
+  DELETE: WebHandler;
+};
+
+/**
+ * Expose a web-standard handler as Next.js App Router route handlers.
+ *
+ * ```ts
+ * // app/api/opengeni/[...path]/route.ts
+ * export const dynamic = "force-dynamic";
+ * export const { GET, POST, PUT, PATCH, DELETE } = toNextRouteHandlers(handler);
+ * ```
+ *
+ * Next passes the full request URL (including any `basePath`), so the proxy's
+ * own `/v1/` detection routes it; responses, including SSE, stream as-is.
+ */
+export function toNextRouteHandlers(handler: WebHandler): NextRouteHandlers {
+  // Next calls route handlers with (request, context); only the request matters.
+  const route: WebHandler = async (request) => await handler(request);
+  return { GET: route, POST: route, PUT: route, PATCH: route, DELETE: route };
+}
+
+/**
+ * `createSessionProxyHandler` as Next.js App Router route handlers, for
+ * `app/<mount>/[...path]/route.ts`.
+ */
+export function createSessionProxyRoute(
+  target: Parameters<typeof createSessionProxyHandler>[0],
+  options: SessionProxyHandlerOptions,
+): NextRouteHandlers {
+  return toNextRouteHandlers(createSessionProxyHandler(target, options));
+}

package/src/allowance-refusal.ts

@@ -0,0 +1,5 @@
+/** Browser-safe allowance presentation without exposing the server core. */
+export {
+  allowanceExhaustedMessage,
+  parseAllowanceExhaustedRefusal,
+} from "@opengeni/contracts/allowance-refusal";