@segmentstream-cloud/app 0.16.2 → 0.16.3

package/dist/neon.js

@@ -8,19 +8,14 @@ import { NOT_INVITED, SIGN_IN_LINK_INVALID, SegmentStreamApiError, apiErrorFrom,
 import { parseMe } from "./me.js";
 import { createOntologyTransport } from "./ontology-transport.js";
 import { isAllowed } from "./permissions.js";
-import { matchesPathPrefix, normalizePublicPath } from "./proxy.js";
+import { matchesPathPrefix, normalizePublicPath, wellKnownResponse } from "./proxy.js";
 import { isApiRequest, unauthenticatedResponse } from "./sign-in.js";
 /** The app's sign-in page, which renders `<SignIn />` from `@segmentstream-cloud/app/ui`. */
 export const SIGN_IN_PAGE = "/sign-in";
 /** Where `app/src/app/api/auth/[...path]/route.ts` serves the Neon Auth API. */
 export const AUTH_API_PATH = "/api/auth";
-/** The paths the ontology service answers: its HTTP API, its MCP server and its OAuth metadata. */
-const ONTOLOGY_PATHS = [
-    "/api/ontology",
-    "/mcp",
-    "/.well-known/oauth-protected-resource",
-    "/.well-known/oauth-authorization-server",
-];
+/** The ontology's HTTP API and MCP transport; metadata probes are handled separately. */
+const ONTOLOGY_PATHS = ["/api/ontology", "/mcp"];
 /**
  * Paths every visitor may open: the Neon Auth API, the sign-in page, the health check, and the
  * Next.js assets and metadata files the sign-in page needs.
@@ -310,6 +305,10 @@ export function createNeonSession(dependencies) {
         const publicPaths = [...OPEN_PATHS, ...(options.publicPaths ?? [])].map(normalizePublicPath);
         return async function neonProxy(request) {
             const { pathname, search } = request.nextUrl;
+            const discovery = wellKnownResponse(request, settings.ontologyUrl);
+            if (discovery !== undefined) {
+                return discovery;
+            }
             if (settings.ontologyUrl !== undefined &&
                 ONTOLOGY_PATHS.some((path) => matchesPathPrefix(pathname, path))) {
                 // Local development: the service runs elsewhere; deployed, its paths never reach the app.

package/dist/proxy.d.ts

@@ -11,5 +11,7 @@ export interface ProxyOptions {
 }
 export type SegmentStreamProxy = (request: NextRequest) => Promise<NextResponse>;
 export declare function createProxy(context: AppContext, options?: ProxyOptions): SegmentStreamProxy;
+/** Discovery probes never start browser authentication, including probes for unsupported metadata. */
+export declare function wellKnownResponse(request: NextRequest, ontologyUrl?: string): NextResponse | undefined;
 export declare function normalizePublicPath(path: string): string;
 export declare function matchesPathPrefix(pathname: string, prefix: string): boolean;

package/dist/proxy.js

@@ -22,6 +22,10 @@ export function createProxy(context, options = {}) {
     }
     return async function proxy(request) {
         const pathname = request.nextUrl.pathname;
+        const discovery = wellKnownResponse(request);
+        if (discovery !== undefined) {
+            return discovery;
+        }
         if (matchesPathPrefix(pathname, SDK_ROUTE_PREFIX) ||
             publicPaths.some((path) => matchesPathPrefix(pathname, path))) {
             return NextResponse.next();
@@ -58,6 +62,26 @@ export function createProxy(context, options = {}) {
         return startSignIn(context, request, policy, true);
     };
 }
+const ONTOLOGY_METADATA_PATHS = new Set([
+    "/.well-known/oauth-protected-resource",
+    "/.well-known/oauth-protected-resource/mcp",
+    "/.well-known/oauth-authorization-server",
+]);
+/** Discovery probes never start browser authentication, including probes for unsupported metadata. */
+export function wellKnownResponse(request, ontologyUrl) {
+    const { pathname, search } = request.nextUrl;
+    if (!matchesPathPrefix(pathname, "/.well-known")) {
+        return undefined;
+    }
+    if (ONTOLOGY_METADATA_PATHS.has(pathname)) {
+        return ontologyUrl === undefined
+            ? NextResponse.next()
+            : NextResponse.rewrite(new URL(`${pathname}${search}`, ontologyUrl));
+    }
+    // The issuer is the root origin, so RFC 8414 does not define an AS document suffixed by /mcp.
+    // This service also does not publish OpenID Connect discovery metadata.
+    return NextResponse.json({ error: "not_found" }, { status: 404 });
+}
 /**
  * SegmentStream is unreachable. API requests get a retryable 503; pages restart sign-in,
  * which ends on the callback's error page rather than looping. Session cookies are kept.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@segmentstream-cloud/app",
-  "version": "0.16.2",
+  "version": "0.16.3",
   "description": "Sign-in, users, permissions, the ontology client and warehouse data access for SegmentStream workspace apps built with Next.js.",
   "license": "Apache-2.0",
   "author": "SegmentStream",