@segmentstream-cloud/app 0.17.1 → 0.18.0

package/README.md

@@ -253,6 +253,92 @@ The calls take values, not form events: call `submitEmail()` and `submitCode()`
 form's submit handler after `event.preventDefault()`. A second `submitCode()` while one
 runs is ignored, so the last digit and the Enter key may both submit.
 
+## Telegram Mini App sign-in
+
+The Mini App is the same app on any page. Enable it explicitly in both SDKs:
+
+```ts
+// App SDK configuration
+createSegmentStreamApp({ ...link, channels: { telegram: true } });
+
+// Ontology service configuration (the connection used by chat.telegram)
+createOntologyService(ontology, {
+  ...config,
+  channels: { telegram: { connection: "chat_bot", miniApp: {} } },
+});
+```
+
+Without these opt-ins, exchange and Telegram framing stay disabled. Providers default to invited:
+paired members can sign in. Workspace apps may explicitly open `signIn.channels.telegram` for new
+accounts and choose their restricted member grants, `onNewUser` action, notice/reply content and
+lower limits. The exchange uses A1's shared admission, limits and onboarding; browser values cannot
+change them. Members without email are managed by member ID.
+
+Mount `<TelegramSignIn />` in a client layout on any page, or call `useTelegramSignIn()` and render
+its `{status, error}` codes with app-owned copy. `<SignIn />` automatically exchanges when the app
+opts in and Telegram launch data is present; `renderTelegram` optionally renders its status. No
+dedicated Mini App route is provided. In a top-level WebView, an unauthenticated deep link redirects
+to `/sign-in?returnTo=…`; HTTP redirects inherit Telegram's URL fragment, and the SDK reads
+`tgWebAppData` there. Raw assertions never enter redirect queries, logs or persistent storage.
+For Telegram Web, an unauthenticated iframe navigation instead receives an inert exchange shell
+at the original protected URL. It renders no workspace content and makes one exchange, then checks
+that the browser retained the session cookie before reloading the deep link. This requires the app's
+explicit Telegram opt-in and is limited to iframe GET navigations. Decision pages remain unframeable.
+Missing launch data stays idle; a refusal or failed discovery stops without reloading or falling back
+to another provider. The shell has no UI copy; its `data-channel-sign-in` and
+`data-channel-sign-in-error` attributes expose status and machine codes for inspection.
+If the same launch returns to the shell after its one allowed reload, it stops with `launch_loop`;
+reopen the Mini App with fresh launch data to retry.
+Safari and other browsers without usable CHIPS cannot persist an iframe session; the regular
+sign-in redirect remains DENY inside an iframe, so use a top-level Mini App launch.
+Browsers without Fetch Metadata headers fall back to that DENY sign-in redirect.
+Apps using Telegram's Web App script can also supply fresh data from `Telegram.WebApp.initData`:
+
+```tsx
+"use client";
+import { TelegramSignIn } from "@segmentstream-cloud/app/ui";
+
+export function ChannelSession() {
+  return <TelegramSignIn />;
+}
+```
+
+The hook posts each fresh assertion once. A single timer renews at the discovered session's
+`expires_at`, without polling. Supply `initData={() => freshRawInitData}` for a custom integration;
+if Telegram still supplies an expired assertion, reopen the Mini App. The app owns refusal text.
+
+A valid channel session takes precedence over regular OIDC and Neon sessions on server, proxy and
+browser. Stale channel cookies fall through to regular sign-in. `requireUser`, ontology transport,
+`useSession`, `useUser`, permissions and logout use that selection. JavaScript receives session
+metadata, never the opaque token. `getAccessToken()` remains the legacy SegmentStream credential
+API, and legacy SegmentStream-mode `can()` keeps its previous behavior. Routes live outside
+`/api/auth/*`.
+
+Session discovery, configuration and proxy verification/refresh outages remain `unavailable`; they never
+select another provider's user or start an assertion exchange. Retry session discovery or reload
+after recovery. Malformed channel/OIDC identity responses also stop authentication; OIDC discovery
+retains upstream failures instead of reporting a signed-out session. Only confirmed absence or
+refusal is treated as signed out.
+
+Browser discovery probes Neon only when the app configures it. Telegram sign-in also works in
+legacy SegmentStream apps without Neon or OIDC. A separate `SEGMENTSTREAM_ONTOLOGY_URL` uses its
+HTTP(S) origin consistently for channel discovery and protected-page validation.
+Public proxy paths and OAuth metadata discovery bypass cookie verification in every authentication
+mode. Unsupported metadata returns 404 without starting sign-in.
+
+Sessions last one hour absolutely, without refresh tokens. HTTPS cookies are HttpOnly, Secure,
+SameSite=None and Partitioned. Logout revokes the grant and clears the cookie. Renewal, unpairing
+and pairing displacement revoke only that identity's grants; blocking/deactivation revoke all of
+that member's sessions. Writes, exchange and logout require the app's Origin. Framing by Telegram
+Web is enabled only with app opt-in; sign-in, consent and pairing pages always remain DENY.
+
+Before release, manually check Telegram iOS, Android, Desktop and Web: deep-link launch/fragment retention,
+exchange, reload, expiry/fresh data, partitioned-cookie persistence, logout/reopen, mixed sessions
+and revoked/blocked/deactivated members. These checks need a deployed HTTPS app and are separate
+from local fixtures. CI runs the HTTPS iframe suite when Chrome is installed; opt in locally with
+`CHROME_BIN=/usr/bin/google-chrome npm test --workspace packages/app-sdk -- --maxWorkers=1 tests/telegram-launch.browser.test.ts`.
+It uses Chrome and OpenSSL installed on the host and a temporary self-signed certificate.
+
 ## The ontology
 
 `segmentstream.ontology.<entity>` calls the app's ontology service at `/api/ontology`
@@ -347,16 +433,19 @@ export const { POST } = segmentstream.agent.connectHandler();
 
 `segmentstream.agent` holds:
 
-| Call                   | Does                                                                            |
-| ---------------------- | ------------------------------------------------------------------------------- |
-| `pairing(code)`        | `{ provider, display, expiresAt }`; throws `not_found` or `expired`             |
-| `approvePairing(code)` | Links the account to the signed-in member; returns the `AgentIdentity`          |
-| `identities()`         | The member's own: `{ id, provider, externalId, display, createdAt, revokedAt }` |
-| `revokeIdentity(id)`   | Revokes one of them at once                                                     |
-| `connectHandler()`     | `{ POST }` for the page's form: same-origin only, takes `code`, answers `303`   |
+| Call                   | Does                                                                                   |
+| ---------------------- | -------------------------------------------------------------------------------------- |
+| `pairing(code)`        | `{ provider, display, expiresAt }`; throws `not_found` or `expired`                    |
+| `approvePairing(code)` | Links the account to the signed-in member; returns the `AgentIdentity`                 |
+| `identities()`         | The member's own: `{ id, provider, externalId, display, createdAt, revokedAt }`        |
+| `revokeIdentity(id)`   | Revokes one of them at once                                                            |
+| `connectHandler()`     | `{ POST }` for the page's form: same-origin only; `303` on success; throws on conflict |
 
 The handler sends the browser back to `/agent/connect?connected=<provider>`, or to
-`/agent/connect?expired=1` when the code was used or is older than ten minutes. Other
+`/agent/connect?expired=1` when the code was used or is older than ten minutes. An account already
+connected to another member throws `SegmentStreamApiError` with status `409` and
+`code === "identity_in_use"` through the app's existing error mechanism. The app owns conflict copy.
+Same-member pairing is idempotent, and replacing your own previous account on a provider is supported. Other
 refusals, such as `forbidden` for a member the ontology does not admit, throw
 `SegmentStreamApiError`. All calls are server-only and run as the signed-in member;
 the ontology decides every one. The workspace starter renders the page with Tailwind CSS
@@ -610,6 +699,11 @@ SegmentStream sets the first three in the app's environment on deploy.
 
 ## Local development
 
+App SDK checks and builds copy the browser-safe channel protocol from
+`packages/ontology-sdk/src/channel-session.ts` into an ignored source module. The
+packed app includes that module and does not require the ontology npm package at
+runtime. Change the canonical ontology source when updating the wire contract.
+
 Put the deployed `NEON_AUTH_BASE_URL` and a cookie secret in `app/.env.local`;
 Neon Auth trusts `http://localhost:3000`:
 

package/dist/agent.d.ts

@@ -34,7 +34,8 @@ export interface AgentIdentities {
     readonly pairing: (code: string) => Promise<AgentPairing>;
     /**
      * Links the pairing's chat account to the signed-in member. The ontology decides: it refuses a
-     * used or expired code (`not_found`, `expired`) and a member it does not admit (`forbidden`).
+     * used or expired code (`not_found`, `expired`), a member it does not admit (`forbidden`), or an
+     * account linked to another member (`identity_in_use`, HTTP 409).
      * Server-only.
      */
     readonly approvePairing: (code: string) => Promise<AgentIdentity>;

package/dist/agent.js

@@ -9,6 +9,7 @@ const GONE_CODES = new Set(["not_found", "expired"]);
 const STATUS_CODES = {
     403: "forbidden",
     404: "not_found",
+    409: "identity_in_use",
     410: "expired",
 };
 function pairingPath(code, approve) {

package/dist/app.js

@@ -1,7 +1,11 @@
 import { createNeonAuth } from "@neondatabase/auth/next/server";
+import { redirect } from "next/navigation";
 import { NextResponse } from "next/server";
-import { environmentValue, processEnvironment, resolveConfig, resolveNeonAuth } from "./config.js";
+import { environmentValue, hasChannelApps, processEnvironment, resolveConfig, resolveNeonAuth, } from "./config.js";
 import { createAgentIdentities } from "./agent.js";
+import { channelAppFraming } from "./telegram.js";
+import { withTelegramLaunch } from "./telegram-launch.js";
+import { createChannelSession } from "./channel-session.js";
 import { createDataClient } from "./data.js";
 import { withUnframeablePages } from "./decision-pages.js";
 import { SegmentStreamApiError } from "./errors.js";
@@ -10,7 +14,8 @@ import { createNeonSession } from "./neon.js";
 import { createAgentAuthorizations } from "./oauth.js";
 import { createOntologyClient } from "./ontology.js";
 import { createOntologyTransport } from "./ontology-transport.js";
-import { createProxy } from "./proxy.js";
+import { createProxy, matchesPathPrefix, normalizePublicPath, wellKnownResponse } from "./proxy.js";
+import { SDK_ROUTE_PREFIX } from "./sign-in.js";
 import { createServerSession } from "./server.js";
 import { createSessionClient } from "./sessions.js";
 import { withFederation } from "./federation.js";
@@ -25,19 +30,24 @@ export function createApp(config, dependencies = {}) {
     const sessionClient = createSessionClient(resolved, fetchImplementation);
     const issuer = environmentValue(environment, "SEGMENTSTREAM_OIDC_ISSUER");
     const clientId = environmentValue(environment, "SEGMENTSTREAM_OIDC_CLIENT_ID");
-    const federated = (app, proofTransport) => {
+    const withChannelLaunch = (app) => ({
+        ...app,
+        proxy: (options) => withTelegramLaunch(app.proxy(options), resolved.channels),
+    });
+    const federated = (app, proofTransport, channelSession) => {
         if (!issuer && !clientId) {
-            return app;
+            return withChannelLaunch(app);
         }
         if (!issuer || !clientId) {
             throw new Error("SEGMENTSTREAM_OIDC_ISSUER and SEGMENTSTREAM_OIDC_CLIENT_ID must be configured together.");
         }
-        return withFederation(app, resolved, { issuer, clientId }, {
+        return withChannelLaunch(withFederation(app, resolved, { issuer, clientId }, {
             fetch: fetchImplementation,
             ontologyUrl: environmentValue(environment, "SEGMENTSTREAM_ONTOLOGY_URL"),
             neon: neonAuth !== null,
             proofTransport,
-        });
+            channelSession,
+        }));
     };
     const context = {
         config: resolved,
@@ -55,22 +65,81 @@ export function createApp(config, dependencies = {}) {
             getAppCredential,
         });
         const ontologyUrl = environmentValue(environment, "SEGMENTSTREAM_ONTOLOGY_URL");
+        const channel = createChannelSession({
+            enabled: hasChannelApps(resolved.channels),
+            workspaceId: resolved.workspaceId,
+            ontologyUrl,
+            fetch: fetchImplementation,
+        });
+        const getChannelUser = async () => {
+            const session = await channel.read();
+            return session
+                ? {
+                    ...session.user,
+                    email: session.user.email ?? undefined,
+                    name: session.user.name ?? undefined,
+                    organizationId: resolved.organizationId,
+                    workspaceId: resolved.workspaceId,
+                }
+                : null;
+        };
+        const getUser = async () => (await getChannelUser()) ?? legacy.getUser();
         // The ontology service accepts SegmentStream app tokens while workspaces move to Neon Auth.
         const ontologyTransport = createOntologyTransport({
             fetch: fetchImplementation,
             ontologyUrl: ontologyUrl === undefined ? undefined : new URL(ontologyUrl).origin,
-            credentials: { token: legacy.getAccessToken },
+            credentials: { token: async () => (await channel.read())?.token ?? legacy.getAccessToken() },
         });
         return federated({
             authentication: "segmentstream",
-            proxy: (options) => withUnframeablePages(createProxy(context, options)),
+            proxy: (options) => {
+                const primaryProxy = createProxy(context, options);
+                const publicPaths = [SDK_ROUTE_PREFIX, ...(options?.publicPaths ?? [])].map(normalizePublicPath);
+                return withUnframeablePages(async (request) => {
+                    const discovery = wellKnownResponse(request, ontologyUrl);
+                    if (discovery !== undefined) {
+                        return discovery;
+                    }
+                    if (request.nextUrl.pathname.startsWith("/api/ontology/")) {
+                        return ontologyUrl
+                            ? NextResponse.rewrite(new URL(`${request.nextUrl.pathname}${request.nextUrl.search}`, ontologyUrl))
+                            : NextResponse.next();
+                    }
+                    if (hasChannelApps(resolved.channels) && request.nextUrl.pathname === "/sign-in") {
+                        return NextResponse.next();
+                    }
+                    if (publicPaths.some((path) => matchesPathPrefix(request.nextUrl.pathname, path))) {
+                        return primaryProxy(request);
+                    }
+                    const response = (await channel.proxy(request)) ?? (await primaryProxy(request));
+                    if (hasChannelApps(resolved.channels) &&
+                        response.headers.has("location") &&
+                        !request.nextUrl.pathname.startsWith("/api/")) {
+                        const destination = new URL("/sign-in", request.url);
+                        destination.searchParams.set("returnTo", request.nextUrl.pathname + request.nextUrl.search);
+                        response.headers.set("location", destination.href);
+                    }
+                    return response;
+                }, channelAppFraming(resolved.channels));
+            },
             authHandlers: notConfiguredHandlers,
             handlers: () => createHandlers(context),
-            getUser: legacy.getUser,
-            requireUser: legacy.requireUser,
-            // Ontology permissions come with Neon Auth; the legacy sign-in grants none.
+            getUser,
+            requireUser: async () => {
+                if (!hasChannelApps(resolved.channels) && !(await channel.token())) {
+                    return legacy.requireUser();
+                }
+                const user = await getUser();
+                if (!user) {
+                    redirect("/sign-in");
+                }
+                return user;
+            },
             can: async () => false,
-            signOut: legacy.signOut,
+            signOut: async (options) => {
+                await channel.signOut();
+                return legacy.signOut(options);
+            },
             getAccessToken: legacy.getAccessToken,
             fetch: data.fetch,
             warehouse: data.warehouse,
@@ -78,7 +147,7 @@ export function createApp(config, dependencies = {}) {
             ontology: createOntologyClient(ontologyTransport),
             oauth: createAgentAuthorizations(ontologyTransport),
             agent: createAgentIdentities(ontologyTransport),
-        });
+        }, undefined, { getUser: getChannelUser, signOut: channel.signOut, transport: channel.transport });
     }
     const neon = createNeonSession({
         config: resolved,
@@ -95,9 +164,9 @@ export function createApp(config, dependencies = {}) {
     });
     return federated({
         authentication: "neon-auth",
-        proxy: (options) => withUnframeablePages(neon.proxy(options)),
+        proxy: (options) => withUnframeablePages(neon.proxy(options), channelAppFraming(resolved.channels)),
         authHandlers: neon.authHandlers,
-        handlers: () => createHandlers(context),
+        handlers: () => createHandlers(context, { neon: true }),
         getUser: neon.getUser,
         requireUser: neon.requireUser,
         can: neon.can,

package/dist/channel-protocol.d.ts

@@ -0,0 +1,16 @@
+/** Browser-safe wire protocol shared by the ontology service and app SDK. */
+export declare const CHANNEL_SESSION_PATH = "/api/ontology/session";
+export declare const CHANNEL_LOGOUT_PATH = "/api/ontology/sign-in/logout";
+export declare const CHANNEL_SESSION_TTL_SECONDS = 3600;
+export declare const channelSignInPath: (provider: string) => string;
+export declare const channelClientId: (provider: string) => string;
+export declare const channelCookieName: (workspaceId: string) => string;
+export declare const CHANNEL_COOKIE_PATTERN: RegExp;
+export declare const channelCookieAttributes: {
+    httpOnly: boolean;
+    secure: boolean;
+    sameSite: "none";
+    partitioned: boolean;
+    path: string;
+};
+export declare const channelCookie: (name: string, token: string, maxAge: number) => string;

package/dist/channel-protocol.js

@@ -0,0 +1,17 @@
+// Generated from packages/ontology-sdk/src/channel-session.ts; do not edit.
+/** Browser-safe wire protocol shared by the ontology service and app SDK. */
+export const CHANNEL_SESSION_PATH = "/api/ontology/session";
+export const CHANNEL_LOGOUT_PATH = "/api/ontology/sign-in/logout";
+export const CHANNEL_SESSION_TTL_SECONDS = 3600;
+export const channelSignInPath = (provider) => `/api/ontology/sign-in/${encodeURIComponent(provider)}`;
+export const channelClientId = (provider) => `${provider}-mini-app`;
+export const channelCookieName = (workspaceId) => `__Host-ss_channel_session.${workspaceId.replace(/[^A-Za-z0-9_-]/g, "_")}`;
+export const CHANNEL_COOKIE_PATTERN = /^__Host-ss_channel_session\.[A-Za-z0-9_-]+$/;
+export const channelCookieAttributes = {
+    httpOnly: true,
+    secure: true,
+    sameSite: "none",
+    partitioned: true,
+    path: "/",
+};
+export const channelCookie = (name, token, maxAge) => `${name}=${token}; HttpOnly; Secure; SameSite=None; Partitioned; Path=/; Max-Age=${maxAge}`;

package/dist/channel-session.d.ts

@@ -0,0 +1,22 @@
+import { NextResponse } from "next/server";
+import type { NextRequest } from "next/server";
+import { type CurrentUser } from "./me.js";
+import type { Fetch } from "./sessions.js";
+export { channelCookieName } from "./channel-protocol.js";
+export interface ChannelSessionIdentity {
+    readonly token: string;
+    readonly user: CurrentUser;
+}
+/** Workspace-owned opaque app sessions; every discovery checks current membership and revocation. */
+export declare function createChannelSession(options: {
+    readonly enabled?: boolean;
+    readonly workspaceId: string;
+    readonly ontologyUrl: string | undefined;
+    readonly fetch: Fetch;
+}): {
+    token: () => Promise<string | null>;
+    transport: import("./ontology.js").OntologyTransport;
+    read: () => Promise<ChannelSessionIdentity | null>;
+    signOut: () => Promise<void>;
+    proxy: (request: NextRequest) => Promise<NextResponse | undefined>;
+};

package/dist/channel-session.js

@@ -0,0 +1,89 @@
+import { cookies } from "next/headers";
+import { NextResponse } from "next/server";
+import { CHANNEL_LOGOUT_PATH, channelCookieName, channelCookieAttributes, } from "./channel-protocol.js";
+import { apiErrorFrom, readJson, SegmentStreamApiError } from "./errors.js";
+import { isSameOrigin } from "./decision-pages.js";
+import { parseMe } from "./me.js";
+import { createOntologyTransport, ontologyOrigin } from "./ontology-transport.js";
+export { channelCookieName } from "./channel-protocol.js";
+/** Workspace-owned opaque app sessions; every discovery checks current membership and revocation. */
+export function createChannelSession(options) {
+    const name = channelCookieName(options.workspaceId);
+    const token = async () => {
+        if (!options.enabled) {
+            return null;
+        }
+        const credential = (await cookies()).get(name)?.value;
+        return credential?.startsWith("sso_") ? credential : null;
+    };
+    const transport = createOntologyTransport({
+        ...options,
+        credentials: { token },
+    });
+    const read = async () => {
+        const credential = await token();
+        if (!credential) {
+            return null;
+        }
+        const response = await transport.fetch("/me", { method: "GET" });
+        if (response.status === 401 || response.status === 403) {
+            return null;
+        }
+        const payload = await readJson(response);
+        if (!response.ok) {
+            throw apiErrorFrom(response.status, payload, "session_unavailable");
+        }
+        const user = parseMe(payload);
+        if (!user) {
+            throw new SegmentStreamApiError({
+                code: "ontology_invalid_response",
+                status: 502,
+                detail: "ontology_invalid_response",
+            });
+        }
+        return { token: credential, user };
+    };
+    const signOut = async () => {
+        if (!(await token())) {
+            return;
+        }
+        const origin = await ontologyOrigin(undefined);
+        const response = await transport.fetch(CHANNEL_LOGOUT_PATH.replace("/api/ontology", ""), {
+            method: "POST",
+            headers: { origin },
+        });
+        if (!response.ok) {
+            throw apiErrorFrom(response.status, await readJson(response), "logout_failed");
+        }
+        (await cookies()).set(name, "", { ...channelCookieAttributes, maxAge: 0 });
+    };
+    const proxy = async (request) => {
+        if (!options.enabled) {
+            return undefined;
+        }
+        const credential = request.cookies.get(name)?.value;
+        if (!credential?.startsWith("sso_")) {
+            return undefined;
+        }
+        if (!["GET", "HEAD", "OPTIONS"].includes(request.method) && !isSameOrigin(request)) {
+            return NextResponse.json({ error: "cross_origin_session" }, { status: 403 });
+        }
+        const response = await options.fetch(`${await ontologyOrigin(options.ontologyUrl ?? request.nextUrl.origin)}/api/ontology/me`, {
+            headers: {
+                authorization: `Bearer ${credential}`,
+                "x-forwarded-host": request.nextUrl.host,
+                "x-forwarded-proto": request.nextUrl.protocol.slice(0, -1),
+            },
+            cache: "no-store",
+            redirect: "error",
+        });
+        if (response.ok && parseMe(await readJson(response))) {
+            return NextResponse.next();
+        }
+        if (response.status !== 401 && response.status !== 403) {
+            return NextResponse.json({ error: "session_unavailable" }, { status: 503 });
+        }
+        return undefined;
+    };
+    return { token, transport, read, signOut, proxy };
+}

package/dist/config.d.ts

@@ -6,12 +6,15 @@ export interface SegmentStreamAppConfig {
     readonly organizationId: string;
     /** SegmentStream origin. Defaults to `SEGMENTSTREAM_URL`, then `https://cloud.segmentstream.com`. */
     readonly baseUrl?: string;
+    /** Explicit channel app opt-in; omitted providers stay disabled. */
+    readonly channels?: Readonly<Record<string, boolean>>;
 }
 export interface ResolvedConfig {
     readonly workspaceId: string;
     readonly organizationId: string;
     readonly baseUrl: string;
     readonly issuer: string;
+    readonly channels?: Readonly<Record<string, boolean>>;
 }
 /** Environment variables, `process.env` unless a test supplies its own. */
 export type Environment = Readonly<Record<string, string | undefined>>;
@@ -32,3 +35,5 @@ export declare function resolveNeonAuth(environment: Environment): NeonAuthEnvir
 export declare function trimTrailingSlashes(value: string): string;
 /** A variable's trimmed value; unset and blank are the same. */
 export declare function environmentValue(environment: Environment, name: string): string | undefined;
+/** Opt-ins are booleans, separate from ontology admission policy. */
+export declare function hasChannelApps(channels: Readonly<Record<string, boolean>> | undefined): boolean;

package/dist/config.js

@@ -7,7 +7,13 @@ export function resolveConfig(config, environment = processEnvironment()) {
     const organizationId = requireIdentifier("organizationId", config.organizationId);
     const baseUrl = normalizeBaseUrl(config.baseUrl ?? environmentValue(environment, "SEGMENTSTREAM_URL") ?? DEFAULT_BASE_URL);
     const issuer = environmentValue(environment, "SEGMENTSTREAM_APP_TOKEN_ISSUER") ?? new URL(baseUrl).origin;
-    return { workspaceId, organizationId, baseUrl, issuer };
+    return {
+        workspaceId,
+        organizationId,
+        baseUrl,
+        issuer,
+        ...(config.channels ? { channels: config.channels } : {}),
+    };
 }
 /** `null` without `NEON_AUTH_BASE_URL`: the app then signs in with SegmentStream, as in 0.2. */
 export function resolveNeonAuth(environment) {
@@ -61,3 +67,7 @@ export function environmentValue(environment, name) {
     const value = environment[name];
     return value === undefined || value.trim() === "" ? undefined : value.trim();
 }
+/** Opt-ins are booleans, separate from ontology admission policy. */
+export function hasChannelApps(channels) {
+    return Object.values(channels ?? {}).some((enabled) => enabled === true);
+}

package/dist/decision-pages.d.ts

@@ -1,10 +1,11 @@
 import { type SegmentStreamProxy } from "./proxy.js";
+export declare function isDecisionPage(pathname: string): boolean;
 /**
  * The proxy, with the decision pages unframeable: no other site may show them in a frame and trick
  * a member into clicking Allow or Approve. Every app gets this from the SDK, whatever its Next.js
  * config says.
  */
-export declare function withUnframeablePages(proxy: SegmentStreamProxy): SegmentStreamProxy;
+export declare function withUnframeablePages(proxy: SegmentStreamProxy, frameAncestors?: string): SegmentStreamProxy;
 /**
  * Whether a form post came from the app's own pages. A decision must never be made from another
  * site, which could otherwise approve an agent in the member's name. Fetch Metadata describes

package/dist/decision-pages.js

@@ -3,16 +3,19 @@ import { AGENT_CONNECT_PAGE, CONSENT_PAGE } from "./pages.js";
 import { matchesPathPrefix } from "./proxy.js";
 /** Pages where a signed-in member lets an agent act for them. */
 const DECISION_PAGES = [CONSENT_PAGE, AGENT_CONNECT_PAGE, "/sign-in", "/api/oauth/consent"];
+export function isDecisionPage(pathname) {
+    return DECISION_PAGES.some((page) => matchesPathPrefix(pathname, page));
+}
 /**
  * The proxy, with the decision pages unframeable: no other site may show them in a frame and trick
  * a member into clicking Allow or Approve. Every app gets this from the SDK, whatever its Next.js
  * config says.
  */
-export function withUnframeablePages(proxy) {
+export function withUnframeablePages(proxy, frameAncestors) {
     return async (request) => {
         const response = await proxy(request);
         const pathname = request.nextUrl.pathname;
-        if (DECISION_PAGES.some((page) => matchesPathPrefix(pathname, page))) {
+        if (isDecisionPage(pathname)) {
             response.headers.set("cache-control", "no-store");
             response.headers.set("referrer-policy", "no-referrer");
             response.headers.set("x-frame-options", "DENY");
@@ -22,6 +25,16 @@ export function withUnframeablePages(proxy) {
                 : policy.replace(/frame-ancestors[^;]*/g, "frame-ancestors 'none'") +
                     (policy.includes("frame-ancestors") ? "" : "; frame-ancestors 'none'"));
         }
+        else if (frameAncestors &&
+            !["/api", "/mcp", "/.well-known", "/_next"].some((path) => matchesPathPrefix(pathname, path))) {
+            const policy = response.headers.get("content-security-policy");
+            const ancestors = `frame-ancestors ${frameAncestors}`;
+            response.headers.delete("x-frame-options");
+            response.headers.set("content-security-policy", policy === null
+                ? ancestors
+                : policy.replace(/frame-ancestors[^;]*/g, ancestors) +
+                    (policy.includes("frame-ancestors") ? "" : `; ${ancestors}`));
+        }
         return response;
     };
 }

package/dist/federation.d.ts

@@ -2,6 +2,7 @@ import type { SegmentStreamApp } from "./app.js";
 import type { ResolvedConfig } from "./config.js";
 import { type OntologyTransport } from "./ontology.js";
 import type { Fetch } from "./sessions.js";
+import type { AppUser } from "./tokens.js";
 /** Public-client RP. Only workspace-owned opaque sessions are stored in its session cookie. */
 export declare function withFederation<O>(base: SegmentStreamApp<O>, config: ResolvedConfig, oidc: {
     issuer: string;
@@ -11,4 +12,9 @@ export declare function withFederation<O>(base: SegmentStreamApp<O>, config: Res
     ontologyUrl?: string;
     neon: boolean;
     proofTransport?: OntologyTransport;
+    channelSession?: {
+        readonly getUser: () => Promise<AppUser | null>;
+        readonly signOut: () => Promise<void>;
+        readonly transport: OntologyTransport;
+    };
 }): SegmentStreamApp<O>;