@segmentstream-cloud/app 0.16.3 → 0.17.0

package/dist/app.js

@@ -13,6 +13,7 @@ import { createOntologyTransport } from "./ontology-transport.js";
 import { createProxy } from "./proxy.js";
 import { createServerSession } from "./server.js";
 import { createSessionClient } from "./sessions.js";
+import { withFederation } from "./federation.js";
 import { createTokenVerifier, remoteKeySet } from "./tokens.js";
 const NEON_AUTH_NOT_CONFIGURED = "This app signs in with SegmentStream: NEON_AUTH_BASE_URL is not set. SegmentStream sets it on deploy once the workspace has Neon Auth.";
 export function createApp(config, dependencies = {}) {
@@ -22,6 +23,22 @@ export function createApp(config, dependencies = {}) {
     const keySet = dependencies.keySet ?? remoteKeySet(resolved.baseUrl);
     const fetchImplementation = dependencies.fetch ?? ((input, init) => fetch(input, init));
     const sessionClient = createSessionClient(resolved, fetchImplementation);
+    const issuer = environmentValue(environment, "SEGMENTSTREAM_OIDC_ISSUER");
+    const clientId = environmentValue(environment, "SEGMENTSTREAM_OIDC_CLIENT_ID");
+    const federated = (app, proofTransport) => {
+        if (!issuer && !clientId) {
+            return app;
+        }
+        if (!issuer || !clientId) {
+            throw new Error("SEGMENTSTREAM_OIDC_ISSUER and SEGMENTSTREAM_OIDC_CLIENT_ID must be configured together.");
+        }
+        return withFederation(app, resolved, { issuer, clientId }, {
+            fetch: fetchImplementation,
+            ontologyUrl: environmentValue(environment, "SEGMENTSTREAM_ONTOLOGY_URL"),
+            neon: neonAuth !== null,
+            proofTransport,
+        });
+    };
     const context = {
         config: resolved,
         verifyToken: createTokenVerifier(resolved, keySet),
@@ -44,7 +61,7 @@ export function createApp(config, dependencies = {}) {
             ontologyUrl: ontologyUrl === undefined ? undefined : new URL(ontologyUrl).origin,
             credentials: { token: legacy.getAccessToken },
         });
-        return {
+        return federated({
             authentication: "segmentstream",
             proxy: (options) => withUnframeablePages(createProxy(context, options)),
             authHandlers: notConfiguredHandlers,
@@ -61,7 +78,7 @@ export function createApp(config, dependencies = {}) {
             ontology: createOntologyClient(ontologyTransport),
             oauth: createAgentAuthorizations(ontologyTransport),
             agent: createAgentIdentities(ontologyTransport),
-        };
+        });
     }
     const neon = createNeonSession({
         config: resolved,
@@ -76,7 +93,7 @@ export function createApp(config, dependencies = {}) {
         getAccessToken: noSegmentStreamSession,
         getAppCredential,
     });
-    return {
+    return federated({
         authentication: "neon-auth",
         proxy: (options) => withUnframeablePages(neon.proxy(options)),
         authHandlers: neon.authHandlers,
@@ -92,7 +109,7 @@ export function createApp(config, dependencies = {}) {
         ontology: createOntologyClient(neon.ontologyTransport),
         oauth: createAgentAuthorizations(neon.ontologyTransport),
         agent: createAgentIdentities(neon.ontologyTransport),
-    };
+    }, neon.ontologyTransport);
 }
 /** Under Neon Auth the app has no SegmentStream session to call the API with. */
 async function noSegmentStreamSession() {

package/dist/federation.d.ts

@@ -0,0 +1,14 @@
+import type { SegmentStreamApp } from "./app.js";
+import type { ResolvedConfig } from "./config.js";
+import { type OntologyTransport } from "./ontology.js";
+import type { Fetch } from "./sessions.js";
+/** Public-client RP. Only workspace-owned opaque sessions are stored in its session cookie. */
+export declare function withFederation<O>(base: SegmentStreamApp<O>, config: ResolvedConfig, oidc: {
+    issuer: string;
+    clientId: string;
+}, options: {
+    fetch: Fetch;
+    ontologyUrl?: string;
+    neon: boolean;
+    proofTransport?: OntologyTransport;
+}): SegmentStreamApp<O>;

package/dist/federation.js

@@ -0,0 +1,313 @@
+import { cookies, headers } from "next/headers";
+import { redirect } from "next/navigation";
+import { NextResponse } from "next/server";
+import { cookiePolicyFor, isLoopbackHostname, safeReturnTo } from "./cookies.js";
+import { isSameOrigin } from "./decision-pages.js";
+import { parseMe } from "./me.js";
+import { createOntologyTransport, ontologyOrigin } from "./ontology-transport.js";
+import { createOntologyClient } from "./ontology.js";
+import { createAgentAuthorizations } from "./oauth.js";
+import { createAgentIdentities } from "./agent.js";
+import { isAllowed } from "./permissions.js";
+import { base64UrlDecode, base64UrlEncode, constantTimeEqual, createCodeChallenge, randomToken, } from "./pkce.js";
+const PREFIX = "/api/segmentstream";
+const CALLBACK = `${PREFIX}/callback`;
+const LINK = `${PREFIX}/link`;
+const encode = (value) => base64UrlEncode(new TextEncoder().encode(JSON.stringify(value)));
+const decode = (value) => JSON.parse(new TextDecoder().decode(base64UrlDecode(value)));
+const cookieName = (workspaceId, secure, purpose = "session") => `${secure ? "__Host-" : ""}ss_oidc_${purpose}.${workspaceId.replace(/[^A-Za-z0-9_-]/g, "_")}`;
+const attributes = (secure, maxAge) => ({
+    httpOnly: true,
+    secure,
+    sameSite: "lax",
+    path: "/",
+    maxAge,
+});
+/** Public-client RP. Only workspace-owned opaque sessions are stored in its session cookie. */
+export function withFederation(base, config, oidc, options) {
+    const issuer = new URL(oidc.issuer);
+    if (issuer.protocol !== "https:" ||
+        issuer.username ||
+        issuer.password ||
+        issuer.search ||
+        issuer.hash ||
+        oidc.issuer.endsWith("/")) {
+        throw new Error("SEGMENTSTREAM_OIDC_ISSUER must be an HTTPS issuer without a trailing slash.");
+    }
+    const token = async () => {
+        const cookieStore = await cookies();
+        const host = (await headers()).get("host") ?? "";
+        const hostname = URL.parse(`http://${host}`)?.hostname ?? "";
+        const secure = cookieStore.get(cookieName(config.workspaceId, true))?.value;
+        return (secure ??
+            (isLoopbackHostname(hostname)
+                ? cookieStore.get(cookieName(config.workspaceId, false))?.value
+                : undefined) ??
+            null);
+    };
+    const transport = createOntologyTransport({
+        fetch: options.fetch,
+        ontologyUrl: options.ontologyUrl,
+        credentials: { token },
+    });
+    const ontologyTransport = {
+        fetch: async (path, init = {}) => (await token())
+            ? transport.fetch(path, init)
+            : options.proofTransport
+                ? options.proofTransport.fetch(path, init)
+                : transport.fetch(path, init),
+    };
+    async function getUser() {
+        if (!(await token())) {
+            return options.neon ? base.getUser() : null;
+        }
+        const response = await transport.fetch("/me", { cache: "no-store" });
+        const user = response.ok ? parseMe(await response.json()) : null;
+        return user
+            ? {
+                id: user.id,
+                ...(user.email ? { email: user.email } : {}),
+                ...(user.name ? { name: user.name } : {}),
+                organizationId: config.organizationId,
+                workspaceId: config.workspaceId,
+                roles: user.roles,
+                permissions: user.permissions,
+                kind: user.kind,
+                active: user.active,
+            }
+            : null;
+    }
+    const setSession = (response, request, value) => {
+        const { secure } = cookiePolicyFor(new URL(request.url), config.workspaceId);
+        response.cookies.set(cookieName(config.workspaceId, secure), value, attributes(secure, 30 * 86400));
+    };
+    async function GET(request) {
+        const { secure } = cookiePolicyFor(new URL(request.url), config.workspaceId);
+        const flowPrefix = cookieName(config.workspaceId, secure, "flow");
+        const pendingName = cookieName(config.workspaceId, secure, "pending");
+        const path = request.nextUrl.pathname;
+        if (path === `${PREFIX}/configuration`) {
+            return NextResponse.json({ enabled: true }, { headers: { "cache-control": "no-store" } });
+        }
+        if (path === `${PREFIX}/sign-in`) {
+            const state = randomToken();
+            const flow = {
+                state,
+                nonce: randomToken(),
+                verifier: randomToken(),
+                redirectUri: `${request.nextUrl.origin}${CALLBACK}`,
+                returnTo: safeReturnTo(request.nextUrl.searchParams.get("returnTo")),
+                expiresAt: Date.now() + 600_000,
+            };
+            const destination = new URL(`${oidc.issuer}/authorize`);
+            destination.search = new URLSearchParams({
+                response_type: "code",
+                client_id: oidc.clientId,
+                redirect_uri: flow.redirectUri,
+                scope: "openid profile email",
+                state,
+                nonce: flow.nonce,
+                code_challenge_method: "S256",
+                code_challenge: await createCodeChallenge(flow.verifier),
+            }).toString();
+            const response = NextResponse.redirect(destination);
+            const pending = request.cookies
+                .getAll()
+                .filter((cookie) => cookie.name.startsWith(`${flowPrefix}.`));
+            if (pending.length >= 4) {
+                for (const cookie of pending) {
+                    response.cookies.set(cookie.name, "", attributes(secure, 0));
+                }
+            }
+            response.cookies.set(`${flowPrefix}.${state}`, encode(flow), attributes(secure, 600));
+            return response;
+        }
+        if (path === CALLBACK) {
+            const params = request.nextUrl.searchParams;
+            const state = params.get("state") ?? "";
+            const flowName = /^[A-Za-z0-9_-]{43}$/.test(state) ? `${flowPrefix}.${state}` : "";
+            const failed = NextResponse.redirect(new URL("/sign-in?error=segmentstream_sign_in_failed", request.url));
+            if (flowName) {
+                failed.cookies.set(flowName, "", attributes(secure, 0));
+            }
+            try {
+                const value = request.cookies.get(flowName)?.value;
+                const flow = value ? decode(value) : undefined;
+                if (!flow ||
+                    [...params.keys()].some((key) => params.getAll(key).length !== 1) ||
+                    typeof flow.state !== "string" ||
+                    !constantTimeEqual(flow.state, state) ||
+                    flow.redirectUri !== `${request.nextUrl.origin}${CALLBACK}` ||
+                    typeof flow.expiresAt !== "number" ||
+                    flow.expiresAt <= Date.now() ||
+                    typeof flow.verifier !== "string" ||
+                    typeof flow.nonce !== "string" ||
+                    params.get("iss") !== oidc.issuer ||
+                    !params.get("code") ||
+                    params.has("error")) {
+                    return failed;
+                }
+                const response = await options.fetch(`${await ontologyOrigin(options.ontologyUrl)}/api/ontology/federation/exchange`, {
+                    method: "POST",
+                    headers: { "content-type": "application/json" },
+                    redirect: "error",
+                    cache: "no-store",
+                    signal: AbortSignal.timeout(15000),
+                    body: JSON.stringify({
+                        code: params.get("code"),
+                        verifier: flow.verifier,
+                        nonce: flow.nonce,
+                        redirectUri: flow.redirectUri,
+                    }),
+                });
+                const result = (await response.json());
+                if (!response.ok || typeof result.token !== "string") {
+                    return failed;
+                }
+                const returnTo = safeReturnTo(typeof flow.returnTo === "string" ? flow.returnTo : "/");
+                const destination = result.status === "proof_required"
+                    ? `/sign-in?returnTo=${encodeURIComponent(LINK)}`
+                    : returnTo;
+                const completed = NextResponse.redirect(new URL(destination, request.url));
+                completed.cookies.set(flowName, "", attributes(secure, 0));
+                if (result.status === "proof_required" && result.token.startsWith("ssfl_")) {
+                    completed.cookies.set(pendingName, encode({ token: result.token, returnTo }), attributes(secure, 600));
+                }
+                else if (result.status === "signed_in" && result.token.startsWith("ssfs_")) {
+                    setSession(completed, request, result.token);
+                }
+                else {
+                    return failed;
+                }
+                return completed;
+            }
+            catch {
+                return failed;
+            }
+        }
+        if (path === LINK) {
+            if (!options.neon) {
+                return new Response("First connect this identity using a workspace email-code login.", {
+                    status: 403,
+                });
+            }
+            if (!(await base.getUser())) {
+                return NextResponse.redirect(new URL(`/sign-in?returnTo=${encodeURIComponent(LINK)}`, request.url));
+            }
+            return new Response(`<!doctype html><html lang="en"><title>Connect SegmentStream</title>
+        <main><h1>Connect your SegmentStream identity</h1><p>Your workspace login has confirmed your access.
+        Allow this SegmentStream identity to sign in as the same workspace user?</p>
+        <form method="post"><button>Connect and continue</button></form></main></html>`, {
+                headers: {
+                    "content-type": "text/html; charset=utf-8",
+                    "cache-control": "no-store",
+                    "content-security-policy": "default-src 'none'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'",
+                },
+            });
+        }
+        return new Response("Not found", { status: 404 });
+    }
+    async function POST(request) {
+        if (!isSameOrigin(request)) {
+            return new Response("Forbidden", { status: 403 });
+        }
+        const { secure } = cookiePolicyFor(new URL(request.url), config.workspaceId);
+        const pendingName = cookieName(config.workspaceId, secure, "pending");
+        if (request.nextUrl.pathname !== LINK || !options.neon) {
+            return new Response("Not found", { status: 404 });
+        }
+        try {
+            const pending = decode(request.cookies.get(pendingName)?.value ?? "");
+            const response = await options.proofTransport.fetch("/federation/link", {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({ pending: pending.token }),
+            });
+            const body = (await response.json());
+            if (!response.ok || typeof body.token !== "string" || !body.token.startsWith("ssfs_")) {
+                return new Response("The workspace could not link this identity.", { status: 403 });
+            }
+            const completed = NextResponse.redirect(new URL(safeReturnTo(typeof pending.returnTo === "string" ? pending.returnTo : "/"), request.url), 303);
+            setSession(completed, request, body.token);
+            completed.cookies.set(pendingName, "", attributes(secure, 0));
+            return completed;
+        }
+        catch {
+            return new Response("Sign in to the workspace with an email code, then try again.", {
+                status: 403,
+            });
+        }
+    }
+    return {
+        ...base,
+        handlers: () => ({
+            GET: async (request) => protectResponse(await GET(request)),
+            POST: async (request) => protectResponse(await POST(request)),
+        }),
+        getUser,
+        requireUser: async () => {
+            const user = await getUser();
+            if (!user) {
+                redirect("/sign-in");
+            }
+            return user;
+        },
+        can: async (permission) => {
+            const user = await getUser();
+            return !!user && isAllowed(permission, user);
+        },
+        getAccessToken: async () => null,
+        ontology: createOntologyClient(ontologyTransport),
+        oauth: createAgentAuthorizations(ontologyTransport),
+        agent: createAgentIdentities(ontologyTransport),
+        signOut: async (settings) => {
+            if (await token()) {
+                await transport.fetch("/federation/logout", { method: "POST" }).catch(() => undefined);
+            }
+            const store = await cookies();
+            for (const secure of [true, false]) {
+                store.set(cookieName(config.workspaceId, secure), "", attributes(secure, 0));
+            }
+            if (options.neon) {
+                return base.signOut(settings);
+            }
+            redirect(safeReturnTo(settings?.redirectTo ?? "/sign-in"));
+        },
+        proxy: (settings) => async (request) => {
+            const { secure } = cookiePolicyFor(new URL(request.url), config.workspaceId);
+            const credential = request.cookies.get(cookieName(config.workspaceId, secure))?.value;
+            if (request.nextUrl.pathname.startsWith(PREFIX)) {
+                return NextResponse.next();
+            }
+            if (credential &&
+                ![
+                    "/sign-in",
+                    "/api/auth",
+                    "/mcp",
+                    "/api/ontology",
+                    "/_next",
+                    ...(settings?.publicPaths ?? []),
+                ].some((path) => request.nextUrl.pathname === path || request.nextUrl.pathname.startsWith(`${path}/`))) {
+                const origin = options.ontologyUrl ?? request.nextUrl.origin;
+                const response = await options.fetch(`${origin}/api/ontology/me`, {
+                    headers: { authorization: `Bearer ${credential}` },
+                    cache: "no-store",
+                    redirect: "error",
+                    signal: AbortSignal.timeout(10000),
+                });
+                if (response.ok) {
+                    return NextResponse.next();
+                }
+                const denied = NextResponse.redirect(new URL("/sign-in", request.url));
+                denied.cookies.set(cookieName(config.workspaceId, secure), "", attributes(secure, 0));
+                return denied;
+            }
+            return base.proxy(settings)(request);
+        },
+    };
+}
+function protectResponse(response) {
+    response.headers.set("cache-control", "no-store");
+    response.headers.set("referrer-policy", "no-referrer");
+    return response;
+}

package/dist/oauth-completion.js

@@ -8,6 +8,52 @@ function escape(value) {
         "'": "'",
     })[character]);
 }
+// The shadcn/ui tokens and Card, Input and Button styles of the workspace app template, inlined so
+// the page needs no external stylesheet under its strict CSP.
+const STYLE = `
+:root{color-scheme:light;--radius:0.625rem;--background:oklch(1 0 0);--foreground:oklch(0.145 0 0);
+--card:oklch(1 0 0);--primary:oklch(0.205 0 0);--primary-foreground:oklch(0.985 0 0);
+--muted:oklch(0.97 0 0);--muted-foreground:oklch(0.556 0 0);--accent:oklch(0.97 0 0);
+--border:oklch(0.922 0 0);--input:oklch(0.922 0 0);--ring:oklch(0.708 0 0);--field:transparent;
+--outline:var(--background);--outline-hover:var(--accent);--logo:none}
+@media (prefers-color-scheme:dark){:root{color-scheme:dark;--background:oklch(0.145 0 0);
+--foreground:oklch(0.985 0 0);--card:oklch(0.205 0 0);--primary:oklch(0.922 0 0);
+--primary-foreground:oklch(0.205 0 0);--muted:oklch(0.269 0 0);--muted-foreground:oklch(0.708 0 0);
+--accent:oklch(0.269 0 0);--border:oklch(1 0 0 / 10%);--input:oklch(1 0 0 / 15%);
+--ring:oklch(0.556 0 0);--field:oklch(1 0 0 / 4.5%);--outline:oklch(1 0 0 / 4.5%);
+--outline-hover:oklch(1 0 0 / 7.5%);--logo:invert(1)}}
+*{box-sizing:border-box}
+body{margin:0;font-family:ui-sans-serif,system-ui,sans-serif,"Apple Color Emoji","Segoe UI Emoji";
+color:var(--foreground);background:color-mix(in oklab,var(--muted) 40%,var(--background));
+-webkit-font-smoothing:antialiased}
+main{min-height:100svh;max-width:calc(28rem + 3rem);margin:0 auto;padding:1.5rem;display:flex;
+flex-direction:column;align-items:center;justify-content:center;gap:1.5rem}
+main>img{filter:var(--logo);height:auto;max-width:100%}
+.card{width:100%;display:flex;flex-direction:column;gap:1.5rem;padding:1.5rem;
+background:var(--card);border:1px solid var(--border);border-radius:calc(var(--radius) + 4px);
+box-shadow:0 1px 3px 0 rgb(0 0 0 / 0.1),0 1px 2px -1px rgb(0 0 0 / 0.1)}
+header,.content{display:grid;gap:0.5rem}
+h1{margin:0;font-size:1.25rem;line-height:1.75rem;font-weight:600;letter-spacing:-0.025em}
+p{margin:0}.muted{color:var(--muted-foreground);font-size:0.875rem;line-height:1.25rem}
+.status:empty{display:none}.secured{font-size:0.75rem;line-height:1rem;text-align:center}
+.field{display:flex;gap:0.5rem}
+input{flex:1;min-width:0;height:2.25rem;padding:0 0.75rem;border:1px solid var(--input);
+border-radius:calc(var(--radius) - 2px);background:var(--field);color:inherit;
+font:0.875rem/1 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;letter-spacing:0.025em;
+box-shadow:0 1px 2px 0 rgb(0 0 0 / 0.05);outline:none}
+.button{display:inline-flex;align-items:center;justify-content:center;flex-shrink:0;height:2.25rem;
+padding:0 1rem;border:1px solid transparent;border-radius:calc(var(--radius) - 2px);
+background:var(--primary);color:var(--primary-foreground);font-family:inherit;font-size:0.875rem;
+font-weight:500;line-height:1.25rem;text-decoration:none;white-space:nowrap;cursor:pointer;outline:none;
+transition:background-color .15s,box-shadow .15s}
+.button:hover{background:color-mix(in oklab,var(--primary) 90%,transparent)}
+.outline{background:var(--outline);color:var(--foreground);border-color:var(--input);
+box-shadow:0 1px 2px 0 rgb(0 0 0 / 0.05)}.outline:hover{background:var(--outline-hover)}
+input:focus-visible,.button:focus-visible{border-color:var(--ring);
+box-shadow:0 0 0 3px color-mix(in oklab,var(--ring) 50%,transparent)}
+footer{display:flex;justify-content:flex-end}
+@media (max-width:30rem){.field{flex-direction:column}input{flex:none}.button{width:100%}}
+`;
 /** Keep a copyable PKCE-bound code visible while trying the client's loopback callback. */
 export function oauthCompletion(options) {
     // Web Crypto keeps this module bundleable for client components (no node: imports).
@@ -16,12 +62,14 @@ export function oauthCompletion(options) {
     const code = redirect === undefined ? null : new URL(redirect).searchParams.get("code");
     const title = options.approved === false ? "Request denied" : "Authorization complete";
     const manual = code === null
-        ? "<p>You can return to your terminal.</p>"
-        : `
-    <p>Return to your terminal. If it is still waiting, copy and paste this code:</p>
+        ? `<header><h1>${title}</h1><p class="muted">You can return to your terminal.</p></header>`
+        : `<header><h1>${title}</h1>
+    <p class="muted">Return to your terminal. If it is still waiting, copy and paste this code:</p></header>
+    <div class="content"><div class="field">
     <input id="code" aria-label="Authorization code" readonly value="${escape(code)}">
-    <button id="copy" type="button">Copy code</button><p id="status" role="status"></p>
-    <p><a href="${escape(redirect)}">Continue to the client</a></p>`;
+    <button id="copy" class="button" type="button">Copy code</button></div>
+    <p id="status" class="muted status" role="status"></p></div>
+    <footer><a class="button outline" href="${escape(redirect)}">Continue to the client</a></footer>`;
     const script = code === null
         ? ""
         : `
@@ -36,10 +84,11 @@ export function oauthCompletion(options) {
     frame.src = ${JSON.stringify(redirect).replace(/</g, "\\u003c")}; document.body.appendChild(frame);`;
     return new Response(`<!doctype html><html lang="en"><meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1"><title>${title}</title>
-    <style nonce="${nonce}">body{font:16px system-ui;background:#fafafa;color:#18181b;margin:10vh auto;
-    max-width:480px;padding:24px}input,button{font:inherit;padding:12px;margin:8px 0}input{width:95%}</style>
-    <img src="${escape(SEGMENTSTREAM_LOGO_URI)}" alt="SegmentStream" width="210" height="45">
-    <h1>${title}</h1>${manual}<script nonce="${nonce}">${script}</script></html>`, {
+    <style nonce="${nonce}">${STYLE}</style>
+    <main><img src="${escape(SEGMENTSTREAM_LOGO_URI)}" alt="SegmentStream" width="210" height="45">
+    <section class="card">${manual}</section>
+    <p class="muted secured">Secured by SegmentStream</p></main>
+    <script nonce="${nonce}">${script}</script></html>`, {
         headers: {
             "content-type": "text/html; charset=utf-8",
             "cache-control": "no-store",

package/dist/ontology-transport.d.ts

@@ -21,3 +21,4 @@ export interface OntologyTransportOptions {
  * `http://localhost:3100` or the deployed app during local development.
  */
 export declare function createOntologyTransport(options: OntologyTransportOptions): OntologyTransport;
+export declare function ontologyOrigin(configured: string | undefined): Promise<string>;

package/dist/ontology-transport.js

@@ -63,7 +63,7 @@ export function createOntologyTransport(options) {
         },
     };
 }
-async function ontologyOrigin(configured) {
+export async function ontologyOrigin(configured) {
     if (configured !== undefined) {
         return trimTrailingSlashes(configured);
     }

package/dist/ui/sign-in.js

@@ -8,7 +8,7 @@ import { useSignIn } from "./use-sign-in.js";
  */
 export function SignIn({ title = "Sign in", ...options }) {
     const ids = useId();
-    const { step, email, setEmail, code, setCode, pending, error, notice, resendIn, codeLength, destination, signedIn, notInvited, linkInvalid, sessionEmail, submitEmail, submitCode, resend, changeEmail, switchAccount, } = useSignIn(options);
+    const { step, segmentstreamSignInUrl, email, setEmail, code, setCode, pending, error, notice, resendIn, codeLength, destination, signedIn, notInvited, linkInvalid, sessionEmail, submitEmail, submitCode, resend, changeEmail, switchAccount, } = useSignIn(options);
     const codeInput = useRef(null);
     // The code field takes focus when it appears and again after a wrong code.
     useEffect(() => {
@@ -24,7 +24,7 @@ export function SignIn({ title = "Sign in", ...options }) {
         return (_jsxs("section", { className: "ss-card ss-sign-in", "aria-labelledby": `${ids}-title`, children: [_jsx("h1", { id: `${ids}-title`, className: "ss-title", children: "You are signed in" }), _jsx("p", { className: "ss-text", children: sessionEmail === null ? "You already have a session." : `Signed in as ${sessionEmail}.` }), _jsxs("div", { className: "ss-actions", children: [_jsx("a", { className: "ss-button", href: destination, children: "Continue" }), _jsx("button", { type: "button", className: "ss-button ss-button--secondary", onClick: () => void switchAccount(), children: "Use another email" })] })] }));
     }
     if (step === "email") {
-        return (_jsxs("section", { className: "ss-card ss-sign-in", "aria-labelledby": `${ids}-title`, children: [_jsx("h1", { id: `${ids}-title`, className: "ss-title", children: title }), _jsx("p", { className: "ss-text", children: "We will email you a code or a link to sign in." }), _jsxs("form", { className: "ss-form", onSubmit: (event) => {
+        return (_jsxs("section", { className: "ss-card ss-sign-in", "aria-labelledby": `${ids}-title`, children: [_jsx("h1", { id: `${ids}-title`, className: "ss-title", children: title }), _jsx("p", { className: "ss-text", children: "We will email you a code or a link to sign in." }), segmentstreamSignInUrl && (_jsx("a", { className: "ss-button ss-button--secondary", href: segmentstreamSignInUrl, children: "Continue with SegmentStream" })), _jsxs("form", { className: "ss-form", onSubmit: (event) => {
                         event.preventDefault();
                         void submitEmail();
                     }, noValidate: true, children: [linkInvalid && (_jsx("p", { className: "ss-notice", role: "status", children: "This sign-in link is not valid anymore. Enter your email to get a new code." })), _jsxs("div", { className: "ss-field", children: [_jsx("label", { className: "ss-label", htmlFor: `${ids}-email`, children: "Email" }), _jsx("input", { id: `${ids}-email`, className: "ss-input", type: "email", name: "email", autoComplete: "email", inputMode: "email", required: true, value: email, onChange: (event) => setEmail(event.target.value), disabled: pending !== null, "aria-invalid": error !== null, "aria-describedby": error === null ? undefined : errorId })] }), error !== null && (_jsx("p", { id: errorId, className: "ss-error", role: "alert", children: error })), _jsx("button", { type: "submit", className: "ss-button", disabled: pending !== null, "aria-busy": pending === "send", children: pending === "send" ? "Sending…" : "Continue" })] })] }));

package/dist/ui/use-sign-in.d.ts

@@ -19,6 +19,7 @@ export type SignInNoticeCode = "code_resent" | "link_resent";
 export declare const SIGN_IN_ERROR_MESSAGES: Readonly<Record<SignInErrorCode, string>>;
 /** Email sign-in for a form the app renders itself. The calls take values, not form events. */
 export interface SignInController {
+    readonly segmentstreamSignInUrl: string | null;
     /**
      * `email`, then `code` for a member with a Neon Auth account, or `link` when a sign-in link was
      * emailed instead: a first sign-in, whose link creates the account. The link step has nothing to

package/dist/ui/use-sign-in.js

@@ -58,6 +58,21 @@ export function useSignIn({ returnTo, error: reason } = {}) {
     const [noticeCode, setNoticeCode] = useState(null);
     const [resendIn, setResendIn] = useState(0);
     const [switchingAccount, setSwitchingAccount] = useState(false);
+    const [segmentstreamEnabled, setSegmentstreamEnabled] = useState(false);
+    useEffect(() => {
+        let active = true;
+        void fetch("/api/segmentstream/configuration", { credentials: "same-origin" })
+            .then(async (response) => response.ok ? (await response.json()) : null)
+            .then((body) => {
+            if (active) {
+                setSegmentstreamEnabled(body?.enabled === true);
+            }
+        })
+            .catch(() => undefined);
+        return () => {
+            active = false;
+        };
+    }, []);
     const verifying = useRef(false);
     const resendTimer = useRef(undefined);
     const destination = safeReturnTo(returnTo ?? pageReturnTo);
@@ -168,6 +183,9 @@ export function useSignIn({ returnTo, error: reason } = {}) {
         setPending(null);
     }
     return {
+        segmentstreamSignInUrl: segmentstreamEnabled
+            ? `/api/segmentstream/sign-in?returnTo=${encodeURIComponent(destination)}`
+            : null,
         step,
         email,
         setEmail,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@segmentstream-cloud/app",
-  "version": "0.16.3",
+  "version": "0.17.0",
   "description": "Sign-in, users, permissions, the ontology client and warehouse data access for SegmentStream workspace apps built with Next.js.",
   "license": "Apache-2.0",
   "author": "SegmentStream",