@segmentstream-cloud/app 0.1.0 → 0.3.0

package/dist/proxy.d.ts

@@ -11,3 +11,5 @@ export interface ProxyOptions {
 }
 export type SegmentStreamProxy = (request: NextRequest) => Promise<NextResponse>;
 export declare function createProxy(context: AppContext, options?: ProxyOptions): SegmentStreamProxy;
+export declare function normalizePublicPath(path: string): string;
+export declare function matchesPathPrefix(pathname: string, prefix: string): boolean;

package/dist/proxy.js

@@ -4,13 +4,29 @@ import { clearSessionCookies, cookiePolicyFor, replaceRequestCookies, safeReturn
 import { SDK_ROUTE_PREFIX, isApiRequest, signInRedirect, unauthenticatedResponse, } from "./sign-in.js";
 export function createProxy(context, options = {}) {
     const publicPaths = (options.publicPaths ?? []).map(normalizePublicPath);
+    const refreshes = new Map();
+    /**
+     * A page load and the prefetches it triggers arrive together with the same expired
+     * session. They share one refresh instead of each spending the refresh token.
+     */
+    function refreshSession(refreshToken) {
+        const pending = refreshes.get(refreshToken);
+        if (pending !== undefined) {
+            return pending;
+        }
+        const exchange = context
+            .requestToken({ grantType: "refresh_token", refreshToken })
+            .finally(() => refreshes.delete(refreshToken));
+        refreshes.set(refreshToken, exchange);
+        return exchange;
+    }
     return async function proxy(request) {
         const pathname = request.nextUrl.pathname;
         if (matchesPathPrefix(pathname, SDK_ROUTE_PREFIX) ||
             publicPaths.some((path) => matchesPathPrefix(pathname, path))) {
             return NextResponse.next();
         }
-        const policy = cookiePolicyFor(request.nextUrl);
+        const policy = cookiePolicyFor(request.nextUrl, context.config.workspaceId);
         const accessToken = request.cookies.get(policy.names.session)?.value;
         if (accessToken !== undefined && accessToken !== "") {
             const verification = await context.verifyToken(accessToken);
@@ -20,14 +36,14 @@ export function createProxy(context, options = {}) {
         }
         const refreshToken = request.cookies.get(policy.names.refresh)?.value;
         if (refreshToken === undefined || refreshToken === "") {
-            return startSignIn(context, request, accessToken !== undefined);
+            return startSignIn(context, request, policy, accessToken !== undefined);
         }
-        const exchange = await context.requestToken({ grantType: "refresh_token", refreshToken });
+        const exchange = await refreshSession(refreshToken);
         if (exchange.status === "rejected") {
-            return startSignIn(context, request, true);
+            return startSignIn(context, request, policy, true);
         }
         if (exchange.status === "unavailable") {
-            return sessionUnavailable(context, request);
+            return sessionUnavailable(context, request, policy);
         }
         const verification = await context.verifyToken(exchange.tokens.accessToken);
         if (verification.status === "valid") {
@@ -35,28 +51,28 @@ export function createProxy(context, options = {}) {
         }
         if (verification.status === "unavailable") {
             // The refresh token was rotated; keep the new one even though this request cannot proceed.
-            const response = await sessionUnavailable(context, request);
+            const response = await sessionUnavailable(context, request, policy);
             setSessionCookies(response, policy, exchange.tokens);
             return response;
         }
-        return startSignIn(context, request, true);
+        return startSignIn(context, request, policy, true);
     };
 }
 /**
  * SegmentStream is unreachable. API requests get a retryable 503; pages restart sign-in,
  * which ends on the callback's error page rather than looping. Session cookies are kept.
  */
-async function sessionUnavailable(context, request) {
+async function sessionUnavailable(context, request, policy) {
     if (isApiRequest(request)) {
         return NextResponse.json({ error: "session_refresh_unavailable" }, { status: 503, headers: { "cache-control": "no-store", "retry-after": "5" } });
     }
-    return startSignIn(context, request, false);
+    return startSignIn(context, request, policy, false);
 }
-async function startSignIn(context, request, clearSession) {
+async function startSignIn(context, request, policy, clearSession) {
     if (isApiRequest(request)) {
         const response = unauthenticatedResponse();
         if (clearSession) {
-            clearSessionCookies(response, cookiePolicyFor(request.nextUrl));
+            clearSessionCookies(response, policy);
         }
         return response;
     }
@@ -78,12 +94,12 @@ function continueWithSession(request, policy, tokens) {
     setSessionCookies(response, policy, tokens);
     return response;
 }
-function normalizePublicPath(path) {
+export function normalizePublicPath(path) {
     const withLeadingSlash = path.startsWith("/") ? path : `/${path}`;
     const trimmed = trimTrailingSlashes(withLeadingSlash);
     return trimmed === "" ? "/" : trimmed;
 }
-function matchesPathPrefix(pathname, prefix) {
+export function matchesPathPrefix(pathname, prefix) {
     if (prefix === "/") {
         return true;
     }

package/dist/return-to.d.ts

@@ -0,0 +1,2 @@
+/** Reduces a return path to a same-origin relative path, falling back to `/`. */
+export declare function safeReturnTo(value: string | null | undefined): string;

package/dist/return-to.js

@@ -0,0 +1,24 @@
+/** Reduces a return path to a same-origin relative path, falling back to `/`. */
+export function safeReturnTo(value) {
+    if (typeof value !== "string" ||
+        !value.startsWith("/") ||
+        value.startsWith("//") ||
+        value.startsWith("/\\")) {
+        return "/";
+    }
+    if (/[\u0000-\u001f\u007f]/.test(value)) {
+        return "/";
+    }
+    const placeholderOrigin = "https://return-to.invalid";
+    let url;
+    try {
+        url = new URL(value, placeholderOrigin);
+    }
+    catch {
+        return "/";
+    }
+    if (url.origin !== placeholderOrigin) {
+        return "/";
+    }
+    return `${url.pathname}${url.search}${url.hash}`;
+}

package/dist/server.d.ts

@@ -4,5 +4,8 @@ export interface ServerSession {
     readonly getUser: () => Promise<AppUser | null>;
     readonly requireUser: () => Promise<AppUser>;
     readonly getAccessToken: () => Promise<string | null>;
+    readonly signOut: (options?: {
+        readonly redirectTo?: string;
+    }) => Promise<never>;
 }
 export declare function createServerSession(context: AppContext): ServerSession;

package/dist/server.js

@@ -1,13 +1,13 @@
 import { cookies, headers } from "next/headers";
 import { redirect } from "next/navigation";
-import { sessionCookieCandidates } from "./cookies.js";
-import { SIGN_IN_PATH } from "./sign-in.js";
+import { cookiePolicyFor, isLoopbackHostname, safeReturnTo, sessionCookieCandidates, } from "./cookies.js";
+import { SIGNED_OUT_PATH, SIGN_IN_PATH } from "./sign-in.js";
 export function createServerSession(context) {
     async function verifiedSession() {
         const cookieStore = await cookies();
         const headerStore = await headers();
         const hostname = hostnameOf(headerStore.get("host"));
-        for (const name of sessionCookieCandidates(hostname)) {
+        for (const name of sessionCookieCandidates(hostname, context.config.workspaceId)) {
             const token = cookieStore.get(name)?.value;
             if (token === undefined || token === "") {
                 continue;
@@ -21,7 +21,8 @@ export function createServerSession(context) {
     }
     async function getUser() {
         const session = await verifiedSession();
-        return session?.user ?? null;
+        // Ontology roles come with Neon Auth; the legacy sign-in has none.
+        return session === null ? null : { ...session.user, roles: [], permissions: [] };
     }
     async function requireUser() {
         const user = await getUser();
@@ -35,7 +36,36 @@ export function createServerSession(context) {
         const session = await verifiedSession();
         return session?.token ?? null;
     }
-    return { getUser, requireUser, getAccessToken };
+    /** Revokes the app session and clears its cookies, as `POST /api/segmentstream/sign-out` does. */
+    async function signOut(options = {}) {
+        const cookieStore = await cookies();
+        const hostname = hostnameOf((await headers()).get("host"));
+        const policies = [
+            cookiePolicyFor(new URL("https://app.invalid"), context.config.workspaceId),
+            ...(isLoopbackHostname(hostname)
+                ? [cookiePolicyFor(new URL("http://localhost"), context.config.workspaceId)]
+                : []),
+        ];
+        for (const policy of policies) {
+            const refreshToken = cookieStore.get(policy.names.refresh)?.value;
+            if (refreshToken !== undefined && refreshToken !== "") {
+                await context.revokeSession(refreshToken);
+            }
+            for (const name of [policy.names.session, policy.names.refresh]) {
+                // `__Host-` cookies are only replaced when the clearing cookie repeats Secure and Path=/.
+                cookieStore.set(name, "", {
+                    httpOnly: true,
+                    secure: policy.secure,
+                    sameSite: "lax",
+                    path: "/",
+                    maxAge: 0,
+                    expires: new Date(0),
+                });
+            }
+        }
+        redirect(safeReturnTo(options.redirectTo ?? SIGNED_OUT_PATH));
+    }
+    return { getUser, requireUser, getAccessToken, signOut };
 }
 function hostnameOf(host) {
     if (host === null || host === "") {

package/dist/sign-in.d.ts

@@ -17,7 +17,11 @@ export interface SignInRedirectInput {
     readonly returnTo: string;
     readonly clearSession: boolean;
 }
-/** Starts the authorization-code flow with PKCE by redirecting to SegmentStream. */
+/**
+ * Starts the authorization-code flow with PKCE by redirecting to SegmentStream. Each
+ * sign-in keeps its flow in a cookie named after its `state`, so tabs that start
+ * signing in at the same time do not overwrite each other.
+ */
 export declare function signInRedirect(input: SignInRedirectInput): Promise<NextResponse>;
 export interface AuthorizationUrlInput {
     readonly config: ResolvedConfig;

package/dist/sign-in.js

@@ -1,10 +1,12 @@
 import { NextResponse } from "next/server";
-import { clearSessionCookies, cookiePolicyFor, setAuthFlowCookie } from "./cookies.js";
+import { MAX_PENDING_AUTH_FLOWS, clearCookie, clearSessionCookies, cookiePolicyFor, pendingAuthFlowCookies, setAuthFlowCookie, } from "./cookies.js";
 import { createCodeChallenge, randomToken } from "./pkce.js";
 export const SDK_ROUTE_PREFIX = "/api/segmentstream";
 export const CALLBACK_PATH = `${SDK_ROUTE_PREFIX}/callback`;
 export const SIGN_IN_PATH = `${SDK_ROUTE_PREFIX}/sign-in`;
 export const SIGNED_OUT_PATH = `${SDK_ROUTE_PREFIX}/signed-out`;
+/** Longer return paths are dropped so several pending sign-ins still fit in request headers. */
+const MAX_RETURN_TO_LENGTH = 1024;
 /**
  * Requests that cannot follow a cross-origin sign-in redirect: anything other than a
  * top-level page navigation. They receive a 401 instead of a redirect.
@@ -27,17 +29,28 @@ export function isApiRequest(request) {
 export function unauthenticatedResponse() {
     return NextResponse.json({ error: "unauthenticated" }, { status: 401, headers: { "cache-control": "no-store" } });
 }
-/** Starts the authorization-code flow with PKCE by redirecting to SegmentStream. */
+/**
+ * Starts the authorization-code flow with PKCE by redirecting to SegmentStream. Each
+ * sign-in keeps its flow in a cookie named after its `state`, so tabs that start
+ * signing in at the same time do not overwrite each other.
+ */
 export async function signInRedirect(input) {
-    const { config, request, returnTo, clearSession } = input;
-    const policy = cookiePolicyFor(request.nextUrl);
+    const { config, request, clearSession } = input;
+    const policy = cookiePolicyFor(request.nextUrl, config.workspaceId);
     const state = randomToken();
     const codeVerifier = randomToken();
     const codeChallenge = await createCodeChallenge(codeVerifier);
     const redirectUri = `${request.nextUrl.origin}${CALLBACK_PATH}`;
+    const returnTo = input.returnTo.length <= MAX_RETURN_TO_LENGTH ? input.returnTo : "/";
     const authorizeUrl = authorizationUrl({ config, redirectUri, state, codeChallenge });
     const response = NextResponse.redirect(authorizeUrl, 307);
+    const pending = pendingAuthFlowCookies(policy, request.cookies.getAll().map((cookie) => cookie.name));
     response.headers.set("cache-control", "no-store");
+    if (pending.length >= MAX_PENDING_AUTH_FLOWS) {
+        for (const name of pending) {
+            clearCookie(response, policy, name);
+        }
+    }
     setAuthFlowCookie(response, policy, { state, codeVerifier, redirectUri, returnTo });
     if (clearSession) {
         clearSessionCookies(response, policy);

package/dist/tokens.d.ts

@@ -1,17 +1,36 @@
 import type { JWTVerifyGetKey } from "jose";
 import type { ResolvedConfig } from "./config.js";
-/** The signed-in SegmentStream user, as asserted by the app session token. */
-export interface AppUser {
+/** The SegmentStream member a legacy app session token names. */
+export interface TokenUser {
     readonly id: string;
     readonly email?: string;
     readonly name?: string;
     readonly organizationId: string;
     readonly workspaceId: string;
 }
+/**
+ * The signed-in user. With Neon Auth, the person's ontology `user` record with the roles and
+ * permissions from `GET /api/ontology/me`; with the legacy SegmentStream sign-in, the member the app
+ * session token names, without ontology roles.
+ */
+export interface AppUser extends TokenUser {
+    /** Neon Auth: the ontology `user` record's id. Legacy sign-in: the SegmentStream user id. */
+    readonly id: string;
+    /** The ontology roles the user holds, such as `sales`. Empty under the legacy sign-in. */
+    readonly roles: ReadonlyArray<string>;
+    /** The permissions the roles grant, wildcards included. Empty under the legacy sign-in. */
+    readonly permissions: ReadonlyArray<string>;
+    /** Neon Auth: the ontology user's kind, `member` for people. */
+    readonly kind?: string;
+    /** Neon Auth: whether the ontology user is active. */
+    readonly active?: boolean;
+    /** Neon Auth: the person's Neon Auth user id, the session JWT's `sub`. */
+    readonly authUserId?: string;
+}
 export type KeySet = JWTVerifyGetKey;
 export interface VerifiedToken {
     readonly status: "valid";
-    readonly user: AppUser;
+    readonly user: TokenUser;
     readonly token: string;
 }
 export type TokenVerification = VerifiedToken | {

package/dist/ui/components.d.ts

@@ -0,0 +1,27 @@
+import type { ReactNode } from "react";
+export interface ChildrenProps {
+    readonly children?: ReactNode;
+}
+/** Renders its children when a Neon Auth session exists in this browser. */
+export declare function SignedIn({ children }: ChildrenProps): ReactNode;
+/** Renders its children when nobody is signed in. */
+export declare function SignedOut({ children }: ChildrenProps): ReactNode;
+export interface CanProps extends ChildrenProps {
+    /** A permission such as `lead:changeStatus`. The user's wildcards (`lead:*`, `*:*`) count. */
+    readonly permission: string;
+    /** Rendered when the user lacks the permission. Nothing renders while permissions load. */
+    readonly fallback?: ReactNode;
+}
+/**
+ * Renders its children when the signed-in user holds the permission. It only hides controls: the
+ * ontology service checks every read and action itself.
+ */
+export declare function Can({ permission, children, fallback }: CanProps): ReactNode;
+/** Ends the Neon Auth session in this browser, then opens `redirectTo`. */
+export declare function signOut(redirectTo?: string): Promise<void>;
+export interface UserMenuProps {
+    /** Where to go after signing out. Defaults to `/sign-in`. */
+    readonly signedOutPath?: string;
+}
+/** The signed-in user's name, email and roles, and a sign-out button. */
+export declare function UserMenu({ signedOutPath }: UserMenuProps): import("react").JSX.Element | null;

package/dist/ui/components.js

@@ -0,0 +1,63 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useState } from "react";
+import { safeReturnTo } from "../return-to.js";
+import { usePermissions, useSession, useUser } from "./hooks.js";
+import { navigate } from "./navigation.js";
+import { SIGN_IN_PAGE, authClient, clearSession } from "./store.js";
+/** Renders its children when a Neon Auth session exists in this browser. */
+export function SignedIn({ children }) {
+    return useSession().status === "signed-in" ? children : null;
+}
+/** Renders its children when nobody is signed in. */
+export function SignedOut({ children }) {
+    return useSession().status === "signed-out" ? children : null;
+}
+/**
+ * Renders its children when the signed-in user holds the permission. It only hides controls: the
+ * ontology service checks every read and action itself.
+ */
+export function Can({ permission, children, fallback = null }) {
+    const { isLoading, can } = usePermissions();
+    if (isLoading) {
+        return null;
+    }
+    return can(permission) ? children : fallback;
+}
+/** Ends the Neon Auth session in this browser, then opens `redirectTo`. */
+export async function signOut(redirectTo = SIGN_IN_PAGE) {
+    try {
+        await authClient().signOut();
+    }
+    finally {
+        clearSession();
+        navigate(safeReturnTo(redirectTo));
+    }
+}
+/** The signed-in user's name, email and roles, and a sign-out button. */
+export function UserMenu({ signedOutPath = SIGN_IN_PAGE }) {
+    const session = useSession();
+    const state = useUser();
+    const [signingOut, setSigningOut] = useState(false);
+    if (session.status !== "signed-in") {
+        return null;
+    }
+    const user = state.status === "signed-in" ? state.user : null;
+    const name = user?.name ?? session.user.name;
+    const email = user?.email ?? session.user.email;
+    const label = name ?? email ?? "Account";
+    const roles = user?.roles ?? [];
+    return (_jsxs("details", { className: "ss-user-menu", children: [_jsxs("summary", { className: "ss-user-menu-trigger", children: [_jsx("span", { className: "ss-avatar", "aria-hidden": "true", children: initials(label) }), _jsx("span", { className: "ss-user-menu-label", children: label })] }), _jsxs("div", { className: "ss-user-menu-panel", children: [name !== null && _jsx("p", { className: "ss-user-menu-name", children: name }), email !== null && _jsx("p", { className: "ss-user-menu-email", children: email }), roles.length > 0 && (_jsx("ul", { className: "ss-badges", "aria-label": "Roles", children: roles.map((role) => (_jsx("li", { className: "ss-badge", children: role }, role))) })), state.status === "error" && (_jsx("p", { className: "ss-error", role: "alert", children: state.error.detail })), _jsx("button", { type: "button", className: "ss-button ss-button--secondary", disabled: signingOut, "aria-busy": signingOut, onClick: () => {
+                            setSigningOut(true);
+                            void signOut(signedOutPath).catch(() => setSigningOut(false));
+                        }, children: signingOut ? "Signing out…" : "Sign out" })] })] }));
+}
+function initials(label) {
+    const letters = label
+        .split(/[\s@._-]+/)
+        .filter((part) => part !== "")
+        .slice(0, 2)
+        .map((part) => part.charAt(0).toUpperCase())
+        .join("");
+    return letters === "" ? "?" : letters;
+}

package/dist/ui/hooks.d.ts

@@ -0,0 +1,19 @@
+import type { SessionState, UserState } from "./store.js";
+/** The Neon Auth session in this browser: `loading`, `signed-out`, `signed-in` or `unavailable`. */
+export declare function useSession(): SessionState;
+/**
+ * The signed-in user as the ontology knows them, from `GET /api/ontology/me`, loaded once per
+ * session. `status` is `loading`, `signed-out`, `signed-in` (with `user`) or `error` (with `error`;
+ * `error.code` is `not_invited` for people the app has not invited).
+ */
+export declare function useUser(): UserState;
+export interface Permissions {
+    /** True until the user's permissions are known. */
+    readonly isLoading: boolean;
+    readonly roles: ReadonlyArray<string>;
+    readonly permissions: ReadonlyArray<string>;
+    /** Whether the user's permissions cover `permission`, wildcards included. */
+    readonly can: (permission: string) => boolean;
+}
+/** The signed-in user's roles and permissions, from the same per-session answer as `useUser()`. */
+export declare function usePermissions(): Permissions;

package/dist/ui/hooks.js

@@ -0,0 +1,56 @@
+"use client";
+import { useEffect, useMemo, useSyncExternalStore } from "react";
+import { SegmentStreamApiError } from "../errors.js";
+import { isAllowed } from "../permissions.js";
+import { LOADING_USER, SIGNED_OUT_USER, ensureUser, getServerSnapshot, getSnapshot, subscribe, } from "./store.js";
+const UNAVAILABLE_USER = {
+    status: "error",
+    user: null,
+    error: new SegmentStreamApiError({
+        code: "auth_unavailable",
+        status: 503,
+        detail: "Neon Auth could not be reached. Try again in a moment.",
+        retryable: true,
+    }),
+};
+/** The Neon Auth session in this browser: `loading`, `signed-out`, `signed-in` or `unavailable`. */
+export function useSession() {
+    return useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot).session;
+}
+/**
+ * The signed-in user as the ontology knows them, from `GET /api/ontology/me`, loaded once per
+ * session. `status` is `loading`, `signed-out`, `signed-in` (with `user`) or `error` (with `error`;
+ * `error.code` is `not_invited` for people the app has not invited).
+ */
+export function useUser() {
+    const { session, users } = useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot);
+    const sessionId = session.status === "signed-in" ? session.sessionId : null;
+    useEffect(() => {
+        if (sessionId !== null) {
+            ensureUser(sessionId);
+        }
+    }, [sessionId]);
+    switch (session.status) {
+        case "loading":
+            return LOADING_USER;
+        case "signed-out":
+            return SIGNED_OUT_USER;
+        case "unavailable":
+            return UNAVAILABLE_USER;
+        case "signed-in":
+            return users.get(session.sessionId) ?? LOADING_USER;
+    }
+}
+/** The signed-in user's roles and permissions, from the same per-session answer as `useUser()`. */
+export function usePermissions() {
+    const state = useUser();
+    return useMemo(() => {
+        const user = state.status === "signed-in" ? state.user : null;
+        return {
+            isLoading: state.status === "loading",
+            roles: user?.roles ?? [],
+            permissions: user?.permissions ?? [],
+            can: (permission) => user !== null && isAllowed(permission, user),
+        };
+    }, [state]);
+}

package/dist/ui/index.d.ts

@@ -0,0 +1,10 @@
+export { Can, SignedIn, SignedOut, UserMenu, signOut } from "./components.js";
+export type { CanProps, ChildrenProps, UserMenuProps } from "./components.js";
+export { usePermissions, useSession, useUser } from "./hooks.js";
+export type { Permissions } from "./hooks.js";
+export { SignIn, signInErrorMessage } from "./sign-in.js";
+export type { SignInProps } from "./sign-in.js";
+export type { SessionState, SessionUser, UserState } from "./store.js";
+export { isAllowed } from "../permissions.js";
+export type { CurrentUser } from "../me.js";
+export { SegmentStreamApiError, NOT_INVITED } from "../errors.js";

package/dist/ui/index.js

@@ -0,0 +1,8 @@
+"use client";
+// Client components for apps that sign in with Neon Auth. Import the stylesheet once, in the root
+// layout: `import "@segmentstream-cloud/app/ui/styles.css";`.
+export { Can, SignedIn, SignedOut, UserMenu, signOut } from "./components.js";
+export { usePermissions, useSession, useUser } from "./hooks.js";
+export { SignIn, signInErrorMessage } from "./sign-in.js";
+export { isAllowed } from "../permissions.js";
+export { SegmentStreamApiError, NOT_INVITED } from "../errors.js";

package/dist/ui/navigation.d.ts

@@ -0,0 +1,5 @@
+/**
+ * A full page load, so that the server renders the next page with the session cookies Neon Auth
+ * has just set or cleared.
+ */
+export declare function navigate(path: string): void;

package/dist/ui/navigation.js

@@ -0,0 +1,8 @@
+"use client";
+/**
+ * A full page load, so that the server renders the next page with the session cookies Neon Auth
+ * has just set or cleared.
+ */
+export function navigate(path) {
+    window.location.assign(path);
+}

package/dist/ui/sign-in.d.ts

@@ -0,0 +1,19 @@
+export interface SignInProps {
+    /** Where to go once signed in. Defaults to the page's `returnTo` parameter, then `/`. */
+    readonly returnTo?: string;
+    /**
+     * Why the page was opened: `not_invited` when `requireUser()` found no invitation. Defaults to
+     * the page's `error` parameter.
+     */
+    readonly error?: string;
+    /** The heading. Defaults to "Sign in". */
+    readonly title?: string;
+}
+/**
+ * Email code sign-in with Neon Auth: the email address, then the six-digit code sent to it. New
+ * addresses get an account on first sign-in; whether they may use the app is the ontology's
+ * decision, which `requireUser()` reports as `not_invited`.
+ */
+export declare function SignIn({ returnTo, error: reason, title }: SignInProps): import("react").JSX.Element;
+/** A sentence for a Neon Auth (Better Auth) failure. */
+export declare function signInErrorMessage(error: unknown): string;