@segmentstream-cloud/app 0.0.0-stage → 0.2.0

package/dist/cookies.js

@@ -0,0 +1,142 @@
+import { base64UrlDecode, base64UrlEncode } from "./pkce.js";
+export const REFRESH_COOKIE_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
+export const AUTH_FLOW_COOKIE_MAX_AGE_SECONDS = 10 * 60;
+const SECURE_NAMES = {
+    session: "__Host-ss_app_session",
+    refresh: "__Host-ss_app_refresh",
+    authFlow: "__Host-ss_app_auth",
+};
+const LOOPBACK_NAMES = {
+    session: "ss_app_session",
+    refresh: "ss_app_refresh",
+    authFlow: "ss_app_auth",
+};
+export function isLoopbackHostname(hostname) {
+    const normalized = hostname.toLowerCase();
+    return (normalized === "localhost" ||
+        normalized.endsWith(".localhost") ||
+        normalized === "[::1]" ||
+        normalized === "::1" ||
+        /^127(?:\.\d{1,3}){3}$/.test(normalized));
+}
+/**
+ * Browsers reject `Secure` and `__Host-` cookies on plain-HTTP origins, except that
+ * local development on http://localhost should still work. Every other origin uses
+ * `__Host-` cookies, which cannot be set by sibling subdomains.
+ */
+export function cookiePolicyFor(url) {
+    const insecureLoopback = url.protocol === "http:" && isLoopbackHostname(url.hostname);
+    return insecureLoopback
+        ? { secure: false, names: LOOPBACK_NAMES }
+        : { secure: true, names: SECURE_NAMES };
+}
+/** Candidate cookie names for code that only knows the request host (Server Components). */
+export function sessionCookieCandidates(hostname) {
+    return isLoopbackHostname(hostname)
+        ? [SECURE_NAMES.session, LOOPBACK_NAMES.session]
+        : [SECURE_NAMES.session];
+}
+function cookieAttributes(policy, maxAge) {
+    return {
+        httpOnly: true,
+        secure: policy.secure,
+        sameSite: "lax",
+        path: "/",
+        maxAge,
+    };
+}
+export function setSessionCookies(response, policy, tokens) {
+    const accessMaxAge = Math.max(1, Math.floor(tokens.expiresIn));
+    response.cookies.set(policy.names.session, tokens.accessToken, cookieAttributes(policy, accessMaxAge));
+    response.cookies.set(policy.names.refresh, tokens.refreshToken, cookieAttributes(policy, REFRESH_COOKIE_MAX_AGE_SECONDS));
+}
+export function clearSessionCookies(response, policy) {
+    clearCookie(response, policy, policy.names.session);
+    clearCookie(response, policy, policy.names.refresh);
+}
+export function setAuthFlowCookie(response, policy, flow) {
+    response.cookies.set(policy.names.authFlow, encodeAuthFlowState(flow), cookieAttributes(policy, AUTH_FLOW_COOKIE_MAX_AGE_SECONDS));
+}
+export function clearAuthFlowCookie(response, policy) {
+    clearCookie(response, policy, policy.names.authFlow);
+}
+// `__Host-` cookies are only replaced when the clearing cookie repeats Secure and Path=/.
+function clearCookie(response, policy, name) {
+    response.cookies.set(name, "", { ...cookieAttributes(policy, 0), expires: new Date(0) });
+}
+export function encodeAuthFlowState(flow) {
+    return base64UrlEncode(new TextEncoder().encode(JSON.stringify(flow)));
+}
+export function decodeAuthFlowState(value) {
+    if (value === undefined || value === "") {
+        return null;
+    }
+    let candidate;
+    try {
+        candidate = JSON.parse(new TextDecoder().decode(base64UrlDecode(value)));
+    }
+    catch {
+        return null;
+    }
+    if (!isAuthFlowState(candidate)) {
+        return null;
+    }
+    return {
+        state: candidate.state,
+        codeVerifier: candidate.codeVerifier,
+        redirectUri: candidate.redirectUri,
+        returnTo: safeReturnTo(candidate.returnTo),
+    };
+}
+function isAuthFlowState(value) {
+    if (typeof value !== "object" || value === null) {
+        return false;
+    }
+    const record = value;
+    return (typeof record.state === "string" &&
+        typeof record.codeVerifier === "string" &&
+        typeof record.redirectUri === "string" &&
+        typeof record.returnTo === "string");
+}
+/** Reduces a return path to a same-origin relative path, falling back to `/`. */
+export function safeReturnTo(value) {
+    if (typeof value !== "string" ||
+        !value.startsWith("/") ||
+        value.startsWith("//") ||
+        value.startsWith("/\\")) {
+        return "/";
+    }
+    if (/[\u0000-\u001f\u007f]/.test(value)) {
+        return "/";
+    }
+    const placeholderOrigin = "https://return-to.invalid";
+    let url;
+    try {
+        url = new URL(value, placeholderOrigin);
+    }
+    catch {
+        return "/";
+    }
+    if (url.origin !== placeholderOrigin) {
+        return "/";
+    }
+    return `${url.pathname}${url.search}${url.hash}`;
+}
+/**
+ * Replaces the named cookies in a raw `Cookie` request header while preserving every
+ * other cookie byte for byte.
+ */
+export function replaceRequestCookies(cookieHeader, replacements) {
+    const replacedNames = new Set(Object.keys(replacements));
+    const preserved = (cookieHeader ?? "")
+        .split(";")
+        .map((pair) => pair.trim())
+        .filter((pair) => pair !== "")
+        .filter((pair) => !replacedNames.has(cookiePairName(pair)));
+    const replaced = Object.entries(replacements).map(([name, value]) => `${name}=${value}`);
+    return [...preserved, ...replaced].join("; ");
+}
+function cookiePairName(pair) {
+    const separator = pair.indexOf("=");
+    return (separator === -1 ? pair : pair.slice(0, separator)).trim();
+}

package/dist/data.d.ts

@@ -0,0 +1,138 @@
+import type { ResolvedConfig } from "./config.js";
+import type { QueryParameters } from "./parameters.js";
+import type { Fetch } from "./sessions.js";
+/** A failed SegmentStream API request; `code` is the API error code. */
+export declare class SegmentStreamApiError extends Error {
+    readonly code: string;
+    readonly status: number;
+    readonly detail: string;
+    readonly requestId: string | undefined;
+    readonly retryable: boolean;
+    /** The warehouse query this error concerns, when one was started. */
+    readonly queryId: string | undefined;
+    constructor(input: {
+        readonly code: string;
+        readonly status: number;
+        readonly detail: string;
+        readonly requestId?: string | undefined;
+        readonly retryable?: boolean;
+        readonly queryId?: string | undefined;
+    });
+}
+export type WarehouseValue = string | number | boolean | null;
+export type WarehouseRow = Record<string, WarehouseValue>;
+export interface WarehouseColumn {
+    readonly name: string;
+    readonly type: string;
+    readonly mode: string;
+    readonly description: string;
+}
+/** How much of a query result to wait for and collect. */
+export interface WarehouseReadOptions {
+    /** Rows to collect across pages before stopping. Defaults to 10,000. */
+    readonly maxRows?: number;
+    /** Rows per API page, 1–1,000. Defaults to the smaller of `maxRows` and 1,000. */
+    readonly pageSize?: number;
+    /** How long to wait for a running query. Defaults to 60 seconds. */
+    readonly timeoutMs?: number;
+    readonly signal?: AbortSignal;
+}
+export interface WarehouseQueryOptions extends WarehouseReadOptions {
+    /** Values for named `@parameters` in the SQL. Never interpolate values into the SQL text. */
+    readonly params?: QueryParameters;
+    /** Lowers the workspace's per-query byte ceiling for this query. */
+    readonly maximumBytesBilled?: number | bigint | string;
+}
+export interface WarehouseQueryResult<Row = WarehouseRow> {
+    readonly queryId: string | null;
+    readonly columns: readonly WarehouseColumn[];
+    readonly rows: Row[];
+    /** Rows in the full result, which may exceed `rows` when `truncated`. */
+    readonly totalRows: number | null;
+    /** True when more rows exist than `maxRows` allowed. */
+    readonly truncated: boolean;
+    readonly bytesProcessed: string | null;
+    readonly bytesBilled: string | null;
+    readonly cacheHit: boolean | null;
+}
+export interface WarehouseDryRun {
+    readonly columns: readonly WarehouseColumn[];
+    readonly bytesProcessed: string | null;
+    readonly maximumBytesBilled: string;
+}
+export interface SemanticQueryRequest {
+    readonly dimensions: readonly string[];
+    readonly measures: readonly string[];
+    readonly dateRange: {
+        readonly from: string;
+        readonly to: string;
+    };
+    readonly granularity?: "day" | "week" | "month";
+    readonly filters?: ReadonlyArray<{
+        readonly dimension: string;
+        readonly operator: "equals" | "in" | "isNull" | "isNotNull";
+        readonly value?: string | number | boolean;
+        readonly values?: ReadonlyArray<string | number | boolean>;
+    }>;
+    readonly orderBy?: ReadonlyArray<{
+        readonly measure?: string;
+        readonly dimension?: string;
+        readonly direction: "asc" | "desc";
+    }>;
+    readonly limit?: number;
+}
+export interface SemanticField {
+    readonly name: string;
+    readonly label: string;
+    readonly type: string;
+    readonly unit?: string;
+    readonly format?: string;
+}
+export interface SemanticQueryResult<Row = Record<string, string | boolean | null>> {
+    readonly deploymentId: string | null;
+    readonly definitionDigest: string;
+    readonly fields: readonly SemanticField[];
+    readonly rows: Row[];
+    readonly truncated: boolean;
+    readonly execution: {
+        readonly elapsedMs: number;
+        readonly bytesProcessed?: string;
+        readonly bytesBilled?: string;
+    };
+}
+export interface WarehouseClient {
+    /** Runs read-only SQL in the workspace warehouse as the signed-in user's app session. */
+    readonly query: <Row = WarehouseRow>(sql: string, options?: WarehouseQueryOptions) => Promise<WarehouseQueryResult<Row>>;
+    /**
+     * Resumes a query by ID from a later request. Queries keep running in the warehouse for
+     * up to an hour after `query()` stops waiting, and each request uses a fresh app token.
+     */
+    readonly result: <Row = WarehouseRow>(queryId: string, options?: WarehouseReadOptions) => Promise<WarehouseQueryResult<Row>>;
+    /** Validates SQL and estimates bytes processed without running it. */
+    readonly dryRun: (sql: string, options?: Pick<WarehouseQueryOptions, "params" | "maximumBytesBilled" | "signal">) => Promise<WarehouseDryRun>;
+}
+export interface SemanticClient {
+    readonly list: () => Promise<{
+        readonly deploymentId: string | null;
+        readonly models: readonly unknown[];
+    }>;
+    readonly get: (model: string) => Promise<{
+        readonly deploymentId: string | null;
+        readonly definitionDigest: string;
+        readonly model: unknown;
+    }>;
+    readonly query: <Row = Record<string, string | boolean | null>>(model: string, request: SemanticQueryRequest) => Promise<SemanticQueryResult<Row>>;
+}
+export interface DataClientDependencies {
+    readonly config: ResolvedConfig;
+    readonly fetch: Fetch;
+    readonly getAccessToken: () => Promise<string | null>;
+    readonly sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+    readonly now?: () => number;
+}
+/** Server-side SegmentStream API access as the signed-in member. */
+export declare function createDataClient(dependencies: DataClientDependencies): {
+    fetch: (path: string, init?: RequestInit) => Promise<Response>;
+    warehouse: WarehouseClient;
+    semantic: SemanticClient;
+};

package/dist/data.js

@@ -0,0 +1,225 @@
+import { encodeParameters } from "./parameters.js";
+/** A failed SegmentStream API request; `code` is the API error code. */
+export class SegmentStreamApiError extends Error {
+    code;
+    status;
+    detail;
+    requestId;
+    retryable;
+    /** The warehouse query this error concerns, when one was started. */
+    queryId;
+    constructor(input) {
+        super(`${input.detail} (${input.code})`);
+        this.name = "SegmentStreamApiError";
+        this.code = input.code;
+        this.status = input.status;
+        this.detail = input.detail;
+        this.requestId = input.requestId;
+        this.retryable = input.retryable ?? false;
+        this.queryId = input.queryId;
+    }
+}
+const REQUEST_TIMEOUT_MS = 45_000;
+const DEFAULT_MAX_ROWS = 10_000;
+const MAXIMUM_PAGE_SIZE = 1000;
+const DEFAULT_TIMEOUT_MS = 60_000;
+const FIRST_POLL_MS = 500;
+const LONGEST_POLL_MS = 2000;
+/** Server-side SegmentStream API access as the signed-in member. */
+export function createDataClient(dependencies) {
+    const { config } = dependencies;
+    const workspace = `/api/v1/workspaces/${encodeURIComponent(config.workspaceId)}`;
+    const sleep = dependencies.sleep ?? defaultSleep;
+    const now = dependencies.now ?? Date.now;
+    /** Calls any SegmentStream API path as the signed-in member; the token never leaves the server. */
+    async function apiFetch(path, init = {}) {
+        if (!path.startsWith("/api/")) {
+            throw new TypeError('SegmentStream API paths start with "/api/", for example "/api/v1/me".');
+        }
+        const token = await dependencies.getAccessToken();
+        if (token === null) {
+            throw new SegmentStreamApiError({
+                code: "app_session_missing",
+                status: 401,
+                detail: "No signed-in SegmentStream session for this request; call SegmentStream from Server Components, Route Handlers, or Server Functions behind the SegmentStream proxy.",
+            });
+        }
+        const headers = new Headers(init.headers);
+        const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+        headers.set("authorization", `Bearer ${token}`);
+        if (!headers.has("accept")) {
+            headers.set("accept", "application/json");
+        }
+        try {
+            return await dependencies.fetch(`${config.baseUrl}${path}`, {
+                ...init,
+                headers,
+                cache: "no-store",
+                redirect: "error",
+                signal: init.signal ? AbortSignal.any([init.signal, timeout]) : timeout,
+            });
+        }
+        catch (error) {
+            if (init.signal?.aborted) {
+                throw error;
+            }
+            throw new SegmentStreamApiError({
+                code: "segmentstream_unreachable",
+                status: 503,
+                detail: "SegmentStream could not be reached.",
+                retryable: true,
+            });
+        }
+    }
+    async function call(method, path, body, signal) {
+        const response = await apiFetch(path, {
+            method,
+            ...(body === undefined
+                ? {}
+                : { body: JSON.stringify(body), headers: { "content-type": "application/json" } }),
+            ...(signal ? { signal } : {}),
+        });
+        const payload = await readJson(response);
+        if (!response.ok) {
+            throw errorFrom(response.status, payload);
+        }
+        return payload;
+    }
+    function limits(options) {
+        const maxRows = positiveInteger(options.maxRows ?? DEFAULT_MAX_ROWS, "maxRows");
+        const pageSize = positiveInteger(options.pageSize ?? Math.min(maxRows, MAXIMUM_PAGE_SIZE), "pageSize");
+        return { maxRows, pageSize, deadline: now() + (options.timeoutMs ?? DEFAULT_TIMEOUT_MS) };
+    }
+    /** Waits for a running query, then follows pages up to `maxRows`. */
+    async function collect(first, { maxRows, pageSize, deadline }, signal) {
+        let page = first;
+        const queryId = page.id ?? null;
+        let wait = FIRST_POLL_MS;
+        while (page.state === "running") {
+            if (queryId === null || now() + wait > deadline) {
+                throw new SegmentStreamApiError({
+                    code: "query_timeout",
+                    status: 504,
+                    detail: "The query is still running; resume it from a later request with warehouse.result(queryId).",
+                    retryable: true,
+                    queryId: queryId ?? undefined,
+                });
+            }
+            await sleep(wait, signal);
+            wait = Math.min(wait * 2, LONGEST_POLL_MS);
+            page = (await read(queryId, pageSize, undefined, signal)).query;
+        }
+        const head = page;
+        const rows = [...page.rows];
+        while (page.nextPageToken !== undefined && rows.length < maxRows && queryId !== null) {
+            page = (await read(queryId, pageSize, page.nextPageToken, signal)).query;
+            rows.push(...page.rows);
+        }
+        return {
+            queryId,
+            columns: head.columns,
+            rows: rows.slice(0, maxRows),
+            totalRows: head.totalRows === undefined ? null : Number(head.totalRows),
+            truncated: rows.length > maxRows || page.nextPageToken !== undefined,
+            bytesProcessed: head.bytesProcessed ?? null,
+            bytesBilled: head.bytesBilled ?? null,
+            cacheHit: head.cacheHit ?? null,
+        };
+    }
+    async function query(sql, options = {}) {
+        const bounds = limits(options);
+        const { query: page } = await call("POST", `${workspace}/warehouse/queries`, {
+            sql,
+            parameters: encodeParameters(options.params),
+            ...bytesLimit(options.maximumBytesBilled),
+            pageSize: bounds.pageSize,
+        }, options.signal);
+        return collect(page, bounds, options.signal);
+    }
+    async function result(queryId, options = {}) {
+        const bounds = limits(options);
+        const { query: page } = await read(queryId, bounds.pageSize, undefined, options.signal);
+        return collect(page, bounds, options.signal);
+    }
+    function read(queryId, pageSize, pageToken, signal) {
+        const search = new URLSearchParams({ pageSize: String(pageSize) });
+        if (pageToken !== undefined) {
+            search.set("pageToken", pageToken);
+        }
+        return call("GET", `${workspace}/warehouse/queries/${encodeURIComponent(queryId)}?${search.toString()}`, undefined, signal);
+    }
+    const warehouse = {
+        query,
+        result,
+        dryRun: async (sql, options = {}) => {
+            const { query: page } = await call("POST", `${workspace}/warehouse/queries`, {
+                sql,
+                parameters: encodeParameters(options.params),
+                ...bytesLimit(options.maximumBytesBilled),
+                dryRun: true,
+            }, options.signal);
+            return {
+                columns: page.columns,
+                bytesProcessed: page.bytesProcessed ?? null,
+                maximumBytesBilled: page.maximumBytesBilled,
+            };
+        },
+    };
+    const semantic = {
+        list: () => call("GET", `${workspace}/semantic-models`),
+        get: (model) => call("GET", `${workspace}/semantic-models/${encodeURIComponent(model)}`),
+        query: (model, request) => call("POST", `${workspace}/semantic-models/${encodeURIComponent(model)}/query`, request),
+    };
+    return { fetch: apiFetch, warehouse, semantic };
+}
+function bytesLimit(value) {
+    if (value === undefined) {
+        return {};
+    }
+    const text = String(value);
+    if (!/^[1-9][0-9]*$/.test(text)) {
+        throw new TypeError("maximumBytesBilled must be a positive whole number of bytes.");
+    }
+    return { maximumBytesBilled: text };
+}
+function positiveInteger(value, name) {
+    if (!Number.isInteger(value) || value < 1) {
+        throw new TypeError(`${name} must be a positive integer.`);
+    }
+    return value;
+}
+async function readJson(response) {
+    try {
+        return await response.json();
+    }
+    catch {
+        return null;
+    }
+}
+function errorFrom(status, payload) {
+    const body = typeof payload === "object" && payload !== null ? payload : {};
+    return new SegmentStreamApiError({
+        code: typeof body.error === "string" ? body.error : `http_${status}`,
+        status,
+        detail: typeof body.detail === "string" ? body.detail : "SegmentStream rejected the request.",
+        requestId: typeof body.requestId === "string" ? body.requestId : undefined,
+        retryable: typeof body.retryable === "boolean" ? body.retryable : status >= 500,
+    });
+}
+function defaultSleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(signal.reason);
+            return;
+        }
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", abort);
+            resolve();
+        }, ms);
+        const abort = () => {
+            clearTimeout(timer);
+            reject(signal?.reason);
+        };
+        signal?.addEventListener("abort", abort, { once: true });
+    });
+}

package/dist/handlers.d.ts

@@ -0,0 +1,8 @@
+import type { NextRequest } from "next/server";
+import type { AppContext } from "./context.js";
+export type RouteHandler = (request: NextRequest) => Promise<Response>;
+export interface SegmentStreamRouteHandlers {
+    readonly GET: RouteHandler;
+    readonly POST: RouteHandler;
+}
+export declare function createHandlers(context: AppContext): SegmentStreamRouteHandlers;

package/dist/handlers.js

@@ -0,0 +1,133 @@
+import { NextResponse } from "next/server";
+import { clearAuthFlowCookie, clearSessionCookies, cookiePolicyFor, decodeAuthFlowState, safeReturnTo, setSessionCookies, } from "./cookies.js";
+import { constantTimeEqual } from "./pkce.js";
+import { CALLBACK_PATH, SIGNED_OUT_PATH, SIGN_IN_PATH, SDK_ROUTE_PREFIX, signInRedirect, } from "./sign-in.js";
+export function createHandlers(context) {
+    async function GET(request) {
+        switch (request.nextUrl.pathname) {
+            case CALLBACK_PATH:
+                return handleCallback(context, request);
+            case SIGN_IN_PATH:
+                return signInRedirect({
+                    config: context.config,
+                    request,
+                    returnTo: safeReturnTo(request.nextUrl.searchParams.get("returnTo")),
+                    clearSession: false,
+                });
+            case SIGNED_OUT_PATH:
+                return htmlResponse(200, "You're signed out", "You have signed out of this app.", "Sign in again");
+            default:
+                return notFound();
+        }
+    }
+    async function POST(request) {
+        if (request.nextUrl.pathname === `${SDK_ROUTE_PREFIX}/sign-out`) {
+            return handleSignOut(context, request);
+        }
+        return notFound();
+    }
+    return { GET, POST };
+}
+async function handleCallback(context, request) {
+    const policy = cookiePolicyFor(request.nextUrl);
+    const flow = decodeAuthFlowState(request.cookies.get(policy.names.authFlow)?.value);
+    const code = request.nextUrl.searchParams.get("code");
+    const state = request.nextUrl.searchParams.get("state");
+    if (request.nextUrl.searchParams.get("error") === "access_denied") {
+        return callbackFailure(policy, 403, "You don't have access to this app.");
+    }
+    if (flow === null ||
+        code === null ||
+        code === "" ||
+        state === null ||
+        !constantTimeEqual(state, flow.state)) {
+        return callbackFailure(policy, 400, "This sign-in link is invalid or has expired.");
+    }
+    const exchange = await context.requestToken({
+        grantType: "authorization_code",
+        code,
+        codeVerifier: flow.codeVerifier,
+        redirectUri: flow.redirectUri,
+    });
+    if (exchange.status === "unavailable") {
+        return callbackFailure(policy, 503, "Sign-in is temporarily unavailable. Try again in a moment.");
+    }
+    if (exchange.status === "rejected") {
+        const accessRevoked = exchange.httpStatus === 403 || exchange.code === "access_revoked";
+        return accessRevoked
+            ? callbackFailure(policy, 403, "You don't have access to this app.")
+            : callbackFailure(policy, 400, "Sign-in could not be completed. Try again.");
+    }
+    // A token this app would reject must not become a session, or sign-in would loop.
+    const verification = await context.verifyToken(exchange.tokens.accessToken);
+    if (verification.status === "unavailable") {
+        return callbackFailure(policy, 503, "Sign-in is temporarily unavailable. Try again in a moment.");
+    }
+    if (verification.status !== "valid") {
+        return callbackFailure(policy, 400, "Sign-in returned a session for a different app.");
+    }
+    const response = NextResponse.redirect(new URL(flow.returnTo, request.nextUrl.origin), 303);
+    response.headers.set("cache-control", "no-store");
+    clearAuthFlowCookie(response, policy);
+    setSessionCookies(response, policy, exchange.tokens);
+    return response;
+}
+async function handleSignOut(context, request) {
+    const origin = request.headers.get("origin");
+    if (origin !== null && origin !== request.nextUrl.origin) {
+        return htmlResponse(403, "Sign-out refused", "Sign out from this app's own pages.", "Return to the app");
+    }
+    const policy = cookiePolicyFor(request.nextUrl);
+    const refreshToken = request.cookies.get(policy.names.refresh)?.value;
+    if (refreshToken !== undefined && refreshToken !== "") {
+        await context.revokeSession(refreshToken);
+    }
+    const response = NextResponse.redirect(new URL(SIGNED_OUT_PATH, request.nextUrl.origin), 303);
+    response.headers.set("cache-control", "no-store");
+    clearSessionCookies(response, policy);
+    clearAuthFlowCookie(response, policy);
+    return response;
+}
+function callbackFailure(policy, status, message) {
+    const response = htmlResponse(status, "Sign-in failed", message, "Try again");
+    clearAuthFlowCookie(response, policy);
+    return response;
+}
+function notFound() {
+    return NextResponse.json({ error: "not_found" }, { status: 404, headers: { "cache-control": "no-store" } });
+}
+function htmlResponse(status, title, message, linkLabel) {
+    const body = [
+        "<!doctype html>",
+        '<html lang="en">',
+        "<head>",
+        '<meta charset="utf-8">',
+        '<meta name="viewport" content="width=device-width, initial-scale=1">',
+        '<meta name="robots" content="noindex">',
+        `<title>${escapeHtml(title)}</title>`,
+        "<style>body{font-family:system-ui,sans-serif;max-width:32rem;margin:15vh auto;padding:0 1rem;}</style>",
+        "</head>",
+        "<body>",
+        `<h1>${escapeHtml(title)}</h1>`,
+        `<p>${escapeHtml(message)}</p>`,
+        `<p><a href="/">${escapeHtml(linkLabel)}</a></p>`,
+        "</body>",
+        "</html>",
+    ].join("\n");
+    return new NextResponse(body, {
+        status,
+        headers: {
+            "content-type": "text/html; charset=utf-8",
+            "cache-control": "no-store",
+            "x-content-type-options": "nosniff",
+        },
+    });
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}

package/dist/index.d.ts

@@ -0,0 +1,22 @@
+import type { SegmentStreamApp } from "./app.js";
+import type { SegmentStreamAppConfig } from "./config.js";
+/**
+ * Creates the SegmentStream sign-in integration for a Next.js workspace app.
+ *
+ * ```ts
+ * export const segmentstream = createSegmentStreamApp({
+ *   workspaceId: "wsp_...",
+ *   organizationId: "org_...",
+ * });
+ * ```
+ */
+export declare function createSegmentStreamApp(config: SegmentStreamAppConfig): SegmentStreamApp;
+export { SegmentStreamApiError } from "./data.js";
+export { sql } from "./parameters.js";
+export type { SegmentStreamApp } from "./app.js";
+export type { SemanticClient, SemanticField, SemanticQueryRequest, SemanticQueryResult, WarehouseClient, WarehouseColumn, WarehouseDryRun, WarehouseQueryOptions, WarehouseReadOptions, WarehouseQueryResult, WarehouseRow, WarehouseValue, } from "./data.js";
+export type { ParameterType, QueryParameterValue, QueryParameters, TypedParameter, } from "./parameters.js";
+export type { SegmentStreamAppConfig } from "./config.js";
+export type { SegmentStreamRouteHandlers, RouteHandler } from "./handlers.js";
+export type { ProxyOptions, SegmentStreamProxy } from "./proxy.js";
+export type { AppUser } from "./tokens.js";

package/dist/index.js

@@ -0,0 +1,16 @@
+import { createApp } from "./app.js";
+/**
+ * Creates the SegmentStream sign-in integration for a Next.js workspace app.
+ *
+ * ```ts
+ * export const segmentstream = createSegmentStreamApp({
+ *   workspaceId: "wsp_...",
+ *   organizationId: "org_...",
+ * });
+ * ```
+ */
+export function createSegmentStreamApp(config) {
+    return createApp(config);
+}
+export { SegmentStreamApiError } from "./data.js";
+export { sql } from "./parameters.js";