@segmentstream-cloud/app 0.1.0 → 0.3.0

package/dist/cookies.js

@@ -1,16 +1,12 @@
 import { base64UrlDecode, base64UrlEncode } from "./pkce.js";
+import { safeReturnTo } from "./return-to.js";
+export { safeReturnTo } from "./return-to.js";
 export const REFRESH_COOKIE_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
 export const AUTH_FLOW_COOKIE_MAX_AGE_SECONDS = 10 * 60;
-const SECURE_NAMES = {
-    session: "__Host-ss_app_session",
-    refresh: "__Host-ss_app_refresh",
-    authFlow: "__Host-ss_app_auth",
-};
-const LOOPBACK_NAMES = {
-    session: "ss_app_session",
-    refresh: "ss_app_refresh",
-    authFlow: "ss_app_auth",
-};
+/** Sign-ins one browser can have in progress at once; one more abandons them all. */
+export const MAX_PENDING_AUTH_FLOWS = 4;
+const SECURE_PREFIX = "__Host-";
+const AUTH_FLOW_STATE = /^[A-Za-z0-9_-]{1,128}$/;
 export function isLoopbackHostname(hostname) {
     const normalized = hostname.toLowerCase();
     return (normalized === "localhost" ||
@@ -23,18 +19,38 @@ export function isLoopbackHostname(hostname) {
  * Browsers reject `Secure` and `__Host-` cookies on plain-HTTP origins, except that
  * local development on http://localhost should still work. Every other origin uses
  * `__Host-` cookies, which cannot be set by sibling subdomains.
+ *
+ * Browsers share cookies between ports, so apps on `localhost:3000` and `localhost:3001`
+ * see one cookie jar. Names carry the workspace id to keep each app's session its own.
  */
-export function cookiePolicyFor(url) {
+export function cookiePolicyFor(url, workspaceId) {
     const insecureLoopback = url.protocol === "http:" && isLoopbackHostname(url.hostname);
-    return insecureLoopback
-        ? { secure: false, names: LOOPBACK_NAMES }
-        : { secure: true, names: SECURE_NAMES };
+    return {
+        secure: !insecureLoopback,
+        names: cookieNames(insecureLoopback ? "" : SECURE_PREFIX, workspaceId),
+    };
 }
 /** Candidate cookie names for code that only knows the request host (Server Components). */
-export function sessionCookieCandidates(hostname) {
-    return isLoopbackHostname(hostname)
-        ? [SECURE_NAMES.session, LOOPBACK_NAMES.session]
-        : [SECURE_NAMES.session];
+export function sessionCookieCandidates(hostname, workspaceId) {
+    const secure = cookieNames(SECURE_PREFIX, workspaceId).session;
+    return isLoopbackHostname(hostname) ? [secure, cookieNames("", workspaceId).session] : [secure];
+}
+function cookieNames(prefix, workspaceId) {
+    // Workspace ids are UUIDs; anything else is kept to cookie-name characters.
+    const scope = workspaceId.replace(/[^A-Za-z0-9_-]/g, "_");
+    return {
+        session: `${prefix}ss_app_session.${scope}`,
+        refresh: `${prefix}ss_app_refresh.${scope}`,
+        authFlowPrefix: `${prefix}ss_app_auth.${scope}.`,
+    };
+}
+/** The cookie holding one sign-in's flow, or undefined for a `state` this SDK never issues. */
+export function authFlowCookieName(policy, state) {
+    return AUTH_FLOW_STATE.test(state) ? `${policy.names.authFlowPrefix}${state}` : undefined;
+}
+/** The sign-in flow cookies a request carries, one per sign-in still in progress. */
+export function pendingAuthFlowCookies(policy, requestCookieNames) {
+    return requestCookieNames.filter((name) => name.startsWith(policy.names.authFlowPrefix));
 }
 function cookieAttributes(policy, maxAge) {
     return {
@@ -55,13 +71,10 @@ export function clearSessionCookies(response, policy) {
     clearCookie(response, policy, policy.names.refresh);
 }
 export function setAuthFlowCookie(response, policy, flow) {
-    response.cookies.set(policy.names.authFlow, encodeAuthFlowState(flow), cookieAttributes(policy, AUTH_FLOW_COOKIE_MAX_AGE_SECONDS));
-}
-export function clearAuthFlowCookie(response, policy) {
-    clearCookie(response, policy, policy.names.authFlow);
+    response.cookies.set(`${policy.names.authFlowPrefix}${flow.state}`, encodeAuthFlowState(flow), cookieAttributes(policy, AUTH_FLOW_COOKIE_MAX_AGE_SECONDS));
 }
 // `__Host-` cookies are only replaced when the clearing cookie repeats Secure and Path=/.
-function clearCookie(response, policy, name) {
+export function clearCookie(response, policy, name) {
     response.cookies.set(name, "", { ...cookieAttributes(policy, 0), expires: new Date(0) });
 }
 export function encodeAuthFlowState(flow) {
@@ -98,30 +111,6 @@ function isAuthFlowState(value) {
         typeof record.redirectUri === "string" &&
         typeof record.returnTo === "string");
 }
-/** Reduces a return path to a same-origin relative path, falling back to `/`. */
-export function safeReturnTo(value) {
-    if (typeof value !== "string" ||
-        !value.startsWith("/") ||
-        value.startsWith("//") ||
-        value.startsWith("/\\")) {
-        return "/";
-    }
-    if (/[\u0000-\u001f\u007f]/.test(value)) {
-        return "/";
-    }
-    const placeholderOrigin = "https://return-to.invalid";
-    let url;
-    try {
-        url = new URL(value, placeholderOrigin);
-    }
-    catch {
-        return "/";
-    }
-    if (url.origin !== placeholderOrigin) {
-        return "/";
-    }
-    return `${url.pathname}${url.search}${url.hash}`;
-}
 /**
  * Replaces the named cookies in a raw `Cookie` request header while preserving every
  * other cookie byte for byte.

package/dist/data.d.ts

@@ -0,0 +1,126 @@
+import type { ResolvedConfig } from "./config.js";
+import type { QueryParameters } from "./parameters.js";
+import type { Fetch } from "./sessions.js";
+export { SegmentStreamApiError } from "./errors.js";
+export type WarehouseValue = string | number | boolean | null;
+export type WarehouseRow = Record<string, WarehouseValue>;
+export interface WarehouseColumn {
+    readonly name: string;
+    readonly type: string;
+    readonly mode: string;
+    readonly description: string;
+}
+/** How much of a query result to wait for and collect. */
+export interface WarehouseReadOptions {
+    /** Rows to collect across pages before stopping. Defaults to 10,000. */
+    readonly maxRows?: number;
+    /** Rows per API page, 1–1,000. Defaults to the smaller of `maxRows` and 1,000. */
+    readonly pageSize?: number;
+    /** How long to wait for a running query. Defaults to 60 seconds. */
+    readonly timeoutMs?: number;
+    readonly signal?: AbortSignal;
+}
+export interface WarehouseQueryOptions extends WarehouseReadOptions {
+    /** Values for named `@parameters` in the SQL. Never interpolate values into the SQL text. */
+    readonly params?: QueryParameters;
+    /** Lowers the workspace's per-query byte ceiling for this query. */
+    readonly maximumBytesBilled?: number | bigint | string;
+}
+export interface WarehouseQueryResult<Row = WarehouseRow> {
+    readonly queryId: string | null;
+    readonly columns: readonly WarehouseColumn[];
+    readonly rows: Row[];
+    /** Rows in the full result, which may exceed `rows` when `truncated`. */
+    readonly totalRows: number | null;
+    /** True when more rows exist than `maxRows` allowed. */
+    readonly truncated: boolean;
+    readonly bytesProcessed: string | null;
+    readonly bytesBilled: string | null;
+    readonly cacheHit: boolean | null;
+}
+export interface WarehouseDryRun {
+    readonly columns: readonly WarehouseColumn[];
+    readonly bytesProcessed: string | null;
+    readonly maximumBytesBilled: string;
+}
+export interface SemanticQueryRequest {
+    readonly dimensions: readonly string[];
+    readonly measures: readonly string[];
+    readonly dateRange: {
+        readonly from: string;
+        readonly to: string;
+    };
+    readonly granularity?: "day" | "week" | "month";
+    readonly filters?: ReadonlyArray<{
+        readonly dimension: string;
+        readonly operator: "equals" | "in" | "isNull" | "isNotNull";
+        readonly value?: string | number | boolean;
+        readonly values?: ReadonlyArray<string | number | boolean>;
+    }>;
+    readonly orderBy?: ReadonlyArray<{
+        readonly measure?: string;
+        readonly dimension?: string;
+        readonly direction: "asc" | "desc";
+    }>;
+    readonly limit?: number;
+}
+export interface SemanticField {
+    readonly name: string;
+    readonly label: string;
+    readonly type: string;
+    readonly unit?: string;
+    readonly format?: string;
+}
+export interface SemanticQueryResult<Row = Record<string, string | boolean | null>> {
+    readonly deploymentId: string | null;
+    readonly definitionDigest: string;
+    readonly fields: readonly SemanticField[];
+    readonly rows: Row[];
+    readonly truncated: boolean;
+    readonly execution: {
+        readonly elapsedMs: number;
+        readonly bytesProcessed?: string;
+        readonly bytesBilled?: string;
+    };
+}
+export interface WarehouseClient {
+    /** Runs read-only SQL in the workspace warehouse as the signed-in user's app session. */
+    readonly query: <Row = WarehouseRow>(sql: string, options?: WarehouseQueryOptions) => Promise<WarehouseQueryResult<Row>>;
+    /**
+     * Resumes a query by ID from a later request. Queries keep running in the warehouse for
+     * up to an hour after `query()` stops waiting, and each request uses a fresh app token.
+     */
+    readonly result: <Row = WarehouseRow>(queryId: string, options?: WarehouseReadOptions) => Promise<WarehouseQueryResult<Row>>;
+    /** Validates SQL and estimates bytes processed without running it. */
+    readonly dryRun: (sql: string, options?: Pick<WarehouseQueryOptions, "params" | "maximumBytesBilled" | "signal">) => Promise<WarehouseDryRun>;
+}
+export interface SemanticClient {
+    readonly list: () => Promise<{
+        readonly deploymentId: string | null;
+        readonly models: readonly unknown[];
+    }>;
+    readonly get: (model: string) => Promise<{
+        readonly deploymentId: string | null;
+        readonly definitionDigest: string;
+        readonly model: unknown;
+    }>;
+    readonly query: <Row = Record<string, string | boolean | null>>(model: string, request: SemanticQueryRequest) => Promise<SemanticQueryResult<Row>>;
+}
+export interface DataClientDependencies {
+    readonly config: ResolvedConfig;
+    readonly fetch: Fetch;
+    readonly getAccessToken: () => Promise<string | null>;
+    /**
+     * The workspace app credential, `SEGMENTSTREAM_APP_CREDENTIAL`, read on every call. The API
+     * accepts it for warehouse queries and their results; without it they use the session token.
+     */
+    readonly getAppCredential?: () => string | undefined;
+    readonly sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+    readonly now?: () => number;
+}
+/** Server-side SegmentStream API access as the signed-in member. */
+export declare function createDataClient(dependencies: DataClientDependencies): {
+    fetch: (path: string, init?: RequestInit) => Promise<Response>;
+    warehouse: WarehouseClient;
+    semantic: SemanticClient;
+};

package/dist/data.js

@@ -0,0 +1,206 @@
+import { SegmentStreamApiError, readJson } from "./errors.js";
+import { encodeParameters } from "./parameters.js";
+export { SegmentStreamApiError } from "./errors.js";
+const REQUEST_TIMEOUT_MS = 45_000;
+const DEFAULT_MAX_ROWS = 10_000;
+const MAXIMUM_PAGE_SIZE = 1000;
+const DEFAULT_TIMEOUT_MS = 60_000;
+const FIRST_POLL_MS = 500;
+const LONGEST_POLL_MS = 2000;
+/** Server-side SegmentStream API access as the signed-in member. */
+export function createDataClient(dependencies) {
+    const { config } = dependencies;
+    const workspace = `/api/v1/workspaces/${encodeURIComponent(config.workspaceId)}`;
+    const sleep = dependencies.sleep ?? defaultSleep;
+    const now = dependencies.now ?? Date.now;
+    /** Calls any SegmentStream API path as the signed-in member; the token never leaves the server. */
+    function apiFetch(path, init = {}) {
+        return authorizedFetch(path, init, dependencies.getAccessToken);
+    }
+    /** Warehouse queries prefer the app's own credential, which needs no SegmentStream session. */
+    async function warehouseToken() {
+        return dependencies.getAppCredential?.() ?? dependencies.getAccessToken();
+    }
+    async function authorizedFetch(path, init, getToken) {
+        if (!path.startsWith("/api/")) {
+            throw new TypeError('SegmentStream API paths start with "/api/", for example "/api/v1/me".');
+        }
+        const token = await getToken();
+        if (token === null) {
+            throw new SegmentStreamApiError({
+                code: "app_session_missing",
+                status: 401,
+                detail: "No signed-in SegmentStream session for this request; call SegmentStream from Server Components, Route Handlers, or Server Functions behind the SegmentStream proxy.",
+            });
+        }
+        const headers = new Headers(init.headers);
+        const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+        headers.set("authorization", `Bearer ${token}`);
+        if (!headers.has("accept")) {
+            headers.set("accept", "application/json");
+        }
+        try {
+            return await dependencies.fetch(`${config.baseUrl}${path}`, {
+                ...init,
+                headers,
+                cache: "no-store",
+                redirect: "error",
+                signal: init.signal ? AbortSignal.any([init.signal, timeout]) : timeout,
+            });
+        }
+        catch (error) {
+            if (init.signal?.aborted) {
+                throw error;
+            }
+            throw new SegmentStreamApiError({
+                code: "segmentstream_unreachable",
+                status: 503,
+                detail: "SegmentStream could not be reached.",
+                retryable: true,
+            });
+        }
+    }
+    async function call(method, path, body, signal, getToken = dependencies.getAccessToken) {
+        const response = await authorizedFetch(path, {
+            method,
+            ...(body === undefined
+                ? {}
+                : { body: JSON.stringify(body), headers: { "content-type": "application/json" } }),
+            ...(signal ? { signal } : {}),
+        }, getToken);
+        const payload = await readJson(response);
+        if (!response.ok) {
+            throw errorFrom(response.status, payload);
+        }
+        return payload;
+    }
+    function limits(options) {
+        const maxRows = positiveInteger(options.maxRows ?? DEFAULT_MAX_ROWS, "maxRows");
+        const pageSize = positiveInteger(options.pageSize ?? Math.min(maxRows, MAXIMUM_PAGE_SIZE), "pageSize");
+        return { maxRows, pageSize, deadline: now() + (options.timeoutMs ?? DEFAULT_TIMEOUT_MS) };
+    }
+    /** Waits for a running query, then follows pages up to `maxRows`. */
+    async function collect(first, { maxRows, pageSize, deadline }, signal) {
+        let page = first;
+        const queryId = page.id ?? null;
+        let wait = FIRST_POLL_MS;
+        while (page.state === "running") {
+            if (queryId === null || now() + wait > deadline) {
+                throw new SegmentStreamApiError({
+                    code: "query_timeout",
+                    status: 504,
+                    detail: "The query is still running; resume it from a later request with warehouse.result(queryId).",
+                    retryable: true,
+                    queryId: queryId ?? undefined,
+                });
+            }
+            await sleep(wait, signal);
+            wait = Math.min(wait * 2, LONGEST_POLL_MS);
+            page = (await read(queryId, pageSize, undefined, signal)).query;
+        }
+        const head = page;
+        const rows = [...page.rows];
+        while (page.nextPageToken !== undefined && rows.length < maxRows && queryId !== null) {
+            page = (await read(queryId, pageSize, page.nextPageToken, signal)).query;
+            rows.push(...page.rows);
+        }
+        return {
+            queryId,
+            columns: head.columns,
+            rows: rows.slice(0, maxRows),
+            totalRows: head.totalRows === undefined ? null : Number(head.totalRows),
+            truncated: rows.length > maxRows || page.nextPageToken !== undefined,
+            bytesProcessed: head.bytesProcessed ?? null,
+            bytesBilled: head.bytesBilled ?? null,
+            cacheHit: head.cacheHit ?? null,
+        };
+    }
+    async function query(sql, options = {}) {
+        const bounds = limits(options);
+        const { query: page } = await call("POST", `${workspace}/warehouse/queries`, {
+            sql,
+            parameters: encodeParameters(options.params),
+            ...bytesLimit(options.maximumBytesBilled),
+            pageSize: bounds.pageSize,
+        }, options.signal, warehouseToken);
+        return collect(page, bounds, options.signal);
+    }
+    async function result(queryId, options = {}) {
+        const bounds = limits(options);
+        const { query: page } = await read(queryId, bounds.pageSize, undefined, options.signal);
+        return collect(page, bounds, options.signal);
+    }
+    function read(queryId, pageSize, pageToken, signal) {
+        const search = new URLSearchParams({ pageSize: String(pageSize) });
+        if (pageToken !== undefined) {
+            search.set("pageToken", pageToken);
+        }
+        return call("GET", `${workspace}/warehouse/queries/${encodeURIComponent(queryId)}?${search.toString()}`, undefined, signal, warehouseToken);
+    }
+    const warehouse = {
+        query,
+        result,
+        dryRun: async (sql, options = {}) => {
+            const { query: page } = await call("POST", `${workspace}/warehouse/queries`, {
+                sql,
+                parameters: encodeParameters(options.params),
+                ...bytesLimit(options.maximumBytesBilled),
+                dryRun: true,
+            }, options.signal, warehouseToken);
+            return {
+                columns: page.columns,
+                bytesProcessed: page.bytesProcessed ?? null,
+                maximumBytesBilled: page.maximumBytesBilled,
+            };
+        },
+    };
+    const semantic = {
+        list: () => call("GET", `${workspace}/semantic-models`),
+        get: (model) => call("GET", `${workspace}/semantic-models/${encodeURIComponent(model)}`),
+        query: (model, request) => call("POST", `${workspace}/semantic-models/${encodeURIComponent(model)}/query`, request),
+    };
+    return { fetch: apiFetch, warehouse, semantic };
+}
+function bytesLimit(value) {
+    if (value === undefined) {
+        return {};
+    }
+    const text = String(value);
+    if (!/^[1-9][0-9]*$/.test(text)) {
+        throw new TypeError("maximumBytesBilled must be a positive whole number of bytes.");
+    }
+    return { maximumBytesBilled: text };
+}
+function positiveInteger(value, name) {
+    if (!Number.isInteger(value) || value < 1) {
+        throw new TypeError(`${name} must be a positive integer.`);
+    }
+    return value;
+}
+function errorFrom(status, payload) {
+    const body = typeof payload === "object" && payload !== null ? payload : {};
+    return new SegmentStreamApiError({
+        code: typeof body.error === "string" ? body.error : `http_${status}`,
+        status,
+        detail: typeof body.detail === "string" ? body.detail : "SegmentStream rejected the request.",
+        requestId: typeof body.requestId === "string" ? body.requestId : undefined,
+        retryable: typeof body.retryable === "boolean" ? body.retryable : status >= 500,
+    });
+}
+function defaultSleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(signal.reason);
+            return;
+        }
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", abort);
+            resolve();
+        }, ms);
+        const abort = () => {
+            clearTimeout(timer);
+            reject(signal?.reason);
+        };
+        signal?.addEventListener("abort", abort, { once: true });
+    });
+}

package/dist/errors.d.ts

@@ -0,0 +1,36 @@
+/** One problem with a request's input, as the ontology service reports it. */
+export interface ApiIssue {
+    readonly path: ReadonlyArray<string | number>;
+    readonly message: string;
+}
+/**
+ * A failed SegmentStream or ontology request; `code` is the API error code, such as `not_invited`,
+ * `forbidden`, `action_rejected` or `query_timeout`.
+ */
+export declare class SegmentStreamApiError extends Error {
+    readonly code: string;
+    readonly status: number;
+    readonly detail: string;
+    readonly requestId: string | undefined;
+    readonly retryable: boolean;
+    /** The warehouse query this error concerns, when one was started. */
+    readonly queryId: string | undefined;
+    /** What was wrong with the input, for `invalid_request`, `invalid_input` and `action_rejected`. */
+    readonly issues: ReadonlyArray<ApiIssue>;
+    constructor(input: {
+        readonly code: string;
+        readonly status: number;
+        readonly detail: string;
+        readonly requestId?: string | undefined;
+        readonly retryable?: boolean;
+        readonly queryId?: string | undefined;
+        readonly issues?: ReadonlyArray<ApiIssue>;
+        /** The underlying failure, kept for server logs. */
+        readonly cause?: unknown;
+    });
+}
+/** The person signed in, but the ontology has no member row for them. */
+export declare const NOT_INVITED = "not_invited";
+/** The error body of a failed response: `{ error, detail, requestId, issues? }`. */
+export declare function apiErrorFrom(status: number, payload: unknown, fallbackDetail: string): SegmentStreamApiError;
+export declare function readJson(response: Response): Promise<unknown>;

package/dist/errors.js

@@ -0,0 +1,66 @@
+/**
+ * A failed SegmentStream or ontology request; `code` is the API error code, such as `not_invited`,
+ * `forbidden`, `action_rejected` or `query_timeout`.
+ */
+export class SegmentStreamApiError extends Error {
+    code;
+    status;
+    detail;
+    requestId;
+    retryable;
+    /** The warehouse query this error concerns, when one was started. */
+    queryId;
+    /** What was wrong with the input, for `invalid_request`, `invalid_input` and `action_rejected`. */
+    issues;
+    constructor(input) {
+        super(`${input.detail} (${input.code})`, input.cause === undefined ? undefined : { cause: input.cause });
+        this.name = "SegmentStreamApiError";
+        this.code = input.code;
+        this.status = input.status;
+        this.detail = input.detail;
+        this.requestId = input.requestId;
+        this.retryable = input.retryable ?? false;
+        this.queryId = input.queryId;
+        this.issues = input.issues ?? [];
+    }
+}
+/** The person signed in, but the ontology has no member row for them. */
+export const NOT_INVITED = "not_invited";
+/** The error body of a failed response: `{ error, detail, requestId, issues? }`. */
+export function apiErrorFrom(status, payload, fallbackDetail) {
+    const body = typeof payload === "object" && payload !== null ? payload : {};
+    return new SegmentStreamApiError({
+        code: typeof body.error === "string" ? body.error : `http_${status}`,
+        status,
+        detail: typeof body.detail === "string" ? body.detail : fallbackDetail,
+        requestId: typeof body.requestId === "string" ? body.requestId : undefined,
+        retryable: typeof body.retryable === "boolean" ? body.retryable : status >= 500 || status === 429,
+        issues: issuesFrom(body.issues),
+    });
+}
+function issuesFrom(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.flatMap((candidate) => {
+        if (typeof candidate !== "object" || candidate === null) {
+            return [];
+        }
+        const { path, message } = candidate;
+        if (typeof message !== "string") {
+            return [];
+        }
+        const segments = Array.isArray(path)
+            ? path.filter((segment) => typeof segment === "string" || typeof segment === "number")
+            : [];
+        return [{ path: segments, message }];
+    });
+}
+export async function readJson(response) {
+    try {
+        return await response.json();
+    }
+    catch {
+        return null;
+    }
+}

package/dist/handlers.js

@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server";
-import { clearAuthFlowCookie, clearSessionCookies, cookiePolicyFor, decodeAuthFlowState, safeReturnTo, setSessionCookies, } from "./cookies.js";
+import { authFlowCookieName, clearCookie, clearSessionCookies, cookiePolicyFor, decodeAuthFlowState, pendingAuthFlowCookies, safeReturnTo, setSessionCookies, } from "./cookies.js";
 import { constantTimeEqual } from "./pkce.js";
 import { CALLBACK_PATH, SIGNED_OUT_PATH, SIGN_IN_PATH, SDK_ROUTE_PREFIX, signInRedirect, } from "./sign-in.js";
 export function createHandlers(context) {
@@ -29,19 +29,25 @@ export function createHandlers(context) {
     return { GET, POST };
 }
 async function handleCallback(context, request) {
-    const policy = cookiePolicyFor(request.nextUrl);
-    const flow = decodeAuthFlowState(request.cookies.get(policy.names.authFlow)?.value);
+    const policy = cookiePolicyFor(request.nextUrl, context.config.workspaceId);
     const code = request.nextUrl.searchParams.get("code");
     const state = request.nextUrl.searchParams.get("state");
+    const flowCookie = state === null ? undefined : authFlowCookieName(policy, state);
+    const flow = flowCookie === undefined ? null : decodeAuthFlowState(request.cookies.get(flowCookie)?.value);
     if (request.nextUrl.searchParams.get("error") === "access_denied") {
-        return callbackFailure(policy, 403, "You don't have access to this app.");
+        return callbackFailure(policy, flowCookie, 403, "You don't have access to this app.");
     }
-    if (flow === null ||
+    if (state === null ||
+        flowCookie === undefined ||
+        flow === null ||
         code === null ||
         code === "" ||
-        state === null ||
         !constantTimeEqual(state, flow.state)) {
-        return callbackFailure(policy, 400, "This sign-in link is invalid or has expired.");
+        // A replayed or abandoned sign-in whose browser has signed in since, for example in another tab.
+        if (await hasSession(context, request, policy)) {
+            return returnToApp(request, policy, flowCookie, "/");
+        }
+        return callbackFailure(policy, flowCookie, 400, "This sign-in link is invalid or has expired.");
     }
     const exchange = await context.requestToken({
         grantType: "authorization_code",
@@ -50,47 +56,65 @@ async function handleCallback(context, request) {
         redirectUri: flow.redirectUri,
     });
     if (exchange.status === "unavailable") {
-        return callbackFailure(policy, 503, "Sign-in is temporarily unavailable. Try again in a moment.");
+        return callbackFailure(policy, flowCookie, 503, "Sign-in is temporarily unavailable. Try again in a moment.");
     }
     if (exchange.status === "rejected") {
         const accessRevoked = exchange.httpStatus === 403 || exchange.code === "access_revoked";
         return accessRevoked
-            ? callbackFailure(policy, 403, "You don't have access to this app.")
-            : callbackFailure(policy, 400, "Sign-in could not be completed. Try again.");
+            ? callbackFailure(policy, flowCookie, 403, "You don't have access to this app.")
+            : callbackFailure(policy, flowCookie, 400, "Sign-in could not be completed. Try again.");
     }
     // A token this app would reject must not become a session, or sign-in would loop.
     const verification = await context.verifyToken(exchange.tokens.accessToken);
     if (verification.status === "unavailable") {
-        return callbackFailure(policy, 503, "Sign-in is temporarily unavailable. Try again in a moment.");
+        return callbackFailure(policy, flowCookie, 503, "Sign-in is temporarily unavailable. Try again in a moment.");
     }
     if (verification.status !== "valid") {
-        return callbackFailure(policy, 400, "Sign-in returned a session for a different app.");
+        return callbackFailure(policy, flowCookie, 400, "Sign-in returned a session for a different app.");
     }
-    const response = NextResponse.redirect(new URL(flow.returnTo, request.nextUrl.origin), 303);
-    response.headers.set("cache-control", "no-store");
-    clearAuthFlowCookie(response, policy);
+    const response = returnToApp(request, policy, flowCookie, flow.returnTo);
     setSessionCookies(response, policy, exchange.tokens);
     return response;
 }
+async function hasSession(context, request, policy) {
+    const accessToken = request.cookies.get(policy.names.session)?.value;
+    if (accessToken === undefined || accessToken === "") {
+        return false;
+    }
+    return (await context.verifyToken(accessToken)).status === "valid";
+}
+function returnToApp(request, policy, flowCookie, returnTo) {
+    const response = NextResponse.redirect(new URL(returnTo, request.nextUrl.origin), 303);
+    response.headers.set("cache-control", "no-store");
+    if (flowCookie !== undefined) {
+        clearCookie(response, policy, flowCookie);
+    }
+    return response;
+}
 async function handleSignOut(context, request) {
     const origin = request.headers.get("origin");
     if (origin !== null && origin !== request.nextUrl.origin) {
         return htmlResponse(403, "Sign-out refused", "Sign out from this app's own pages.", "Return to the app");
     }
-    const policy = cookiePolicyFor(request.nextUrl);
+    const policy = cookiePolicyFor(request.nextUrl, context.config.workspaceId);
     const refreshToken = request.cookies.get(policy.names.refresh)?.value;
     if (refreshToken !== undefined && refreshToken !== "") {
         await context.revokeSession(refreshToken);
     }
     const response = NextResponse.redirect(new URL(SIGNED_OUT_PATH, request.nextUrl.origin), 303);
+    const pendingFlows = pendingAuthFlowCookies(policy, request.cookies.getAll().map((cookie) => cookie.name));
     response.headers.set("cache-control", "no-store");
     clearSessionCookies(response, policy);
-    clearAuthFlowCookie(response, policy);
+    for (const name of pendingFlows) {
+        clearCookie(response, policy, name);
+    }
     return response;
 }
-function callbackFailure(policy, status, message) {
+function callbackFailure(policy, flowCookie, status, message) {
     const response = htmlResponse(status, "Sign-in failed", message, "Try again");
-    clearAuthFlowCookie(response, policy);
+    if (flowCookie !== undefined) {
+        clearCookie(response, policy, flowCookie);
+    }
     return response;
 }
 function notFound() {